Home | History | Annotate | Line # | Download | only in dev
if_ae.c revision 1.18
      1 /*	$NetBSD: if_ae.c,v 1.18 1995/03/23 13:00:05 briggs Exp $	*/
      2 
      3 /*
      4  * Device driver for National Semiconductor DS8390 based ethernet adapters.
      5  *
      6  * Based on original ISA bus driver by David Greenman, 29-April-1993
      7  *
      8  * Copyright (C) 1993, David Greenman. This software may be used, modified,
      9  *   copied, distributed, and sold, in both source and binary form provided
     10  *   that the above copyright and these terms are retained. Under no
     11  *   circumstances is the author responsible for the proper functioning
     12  *   of this software, nor does the author assume any responsibility
     13  *   for damages incurred with its use.
     14  *
     15  * Adapted for MacBSD by Brad Parker <brad (at) fcr.com>
     16  *
     17  * Currently supports:
     18  *	Apples NB Ethernet card
     19  *	Interlan A310 Nubus Ethernet card
     20  *	Cayman Systems GatorCard
     21  *	Asante MacCon II/E
     22  */
     23 
     24 /*
     25  * $Id: if_ae.c,v 1.18 1995/03/23 13:00:05 briggs Exp $
     26  */
     27 
     28 #include "ae.h"
     29 /* bpfilter included here in case it is needed in future net includes */
     30 #include "bpfilter.h"
     31 
     32 #include <sys/param.h>
     33 #include <sys/systm.h>
     34 #include <sys/errno.h>
     35 #include <sys/ioctl.h>
     36 #include <sys/mbuf.h>
     37 #include <sys/socket.h>
     38 #include <sys/syslog.h>
     39 
     40 #include <net/if.h>
     41 #include <net/if_dl.h>
     42 #include <net/if_types.h>
     43 #include <net/netisr.h>
     44 
     45 #ifdef INET
     46 #include <netinet/in.h>
     47 #include <netinet/in_systm.h>
     48 #include <netinet/in_var.h>
     49 #include <netinet/ip.h>
     50 #include <netinet/if_ether.h>
     51 #endif
     52 
     53 #ifdef NS
     54 #include <netns/ns.h>
     55 #include <netns/ns_if.h>
     56 #endif
     57 
     58 #if NBPFILTER > 0
     59 #include <net/bpf.h>
     60 #include <net/bpfdesc.h>
     61 #endif
     62 
     63 #include <sys/device.h>
     64 #include "../mac68k/via.h"
     65 #include "nubus.h"
     66 #include "if_aereg.h"
     67 
     68 struct ae_device {
     69 	struct device	ae_dev;
     70 /*	struct nubusdev	ae_nu;
     71 	struct intrhand	ae_ih;	*/
     72 };
     73 
     74 /*
     75  * ae_softc: per line info and status
     76  */
     77 struct	ae_softc {
     78 	struct ae_device	*sc_ae;
     79 
     80 	struct	arpcom arpcom;	/* ethernet common */
     81 
     82 	char	*type_str;	/* pointer to type string */
     83 	u_char	vendor;		/* interface vendor */
     84 	u_char	type;		/* interface type code */
     85 	u_char	regs_rev;	/* registers are reversed */
     86 
     87 #define	REG_MAP(sc, reg)	((sc)->regs_rev ? (0x0f-(reg))<<2 : (reg)<<2)
     88 #define NIC_GET(sc, reg)	((sc)->nic_addr[REG_MAP(sc, reg)])
     89 #define NIC_PUT(sc, reg, val)	((sc)->nic_addr[REG_MAP(sc, reg)] = (val))
     90 	volatile caddr_t nic_addr; /* NIC (DS8390) I/O bus address */
     91 	caddr_t	rom_addr;	/* on board prom address */
     92 	caddr_t	smem_start;	/* shared memory start address */
     93 	caddr_t	smem_end;	/* shared memory end address */
     94 	u_long	smem_size;	/* total shared memory size */
     95 	u_char	smem_wr_short;	/* card memory requires int16 writes */
     96 	caddr_t	smem_ring;	/* start of RX ring-buffer (in smem) */
     97 
     98 	caddr_t	bpf;		/* BPF "magic cookie" */
     99 
    100 	u_char	xmit_busy;	/* transmitter is busy */
    101 	u_char	txb_cnt;	/* Number of transmit buffers */
    102 	u_char	txb_next;	/* Pointer to next buffer ready to xmit */
    103 	u_short	txb_next_len;	/* next xmit buffer length */
    104 	u_char	data_buffered;	/* data has been buffered in interface mem */
    105 	u_char	tx_page_start;	/* first page of TX buffer area */
    106 
    107 	u_char	rec_page_start;	/* first page of RX ring-buffer */
    108 	u_char	rec_page_stop;	/* last page of RX ring-buffer */
    109 	u_char	next_packet;	/* pointer to next unread RX packet */
    110 } ae_softc[NAE];
    111 
    112 void	ae_find(), ae_attach();
    113 int	ae_init(), ae_ioctl(), ae_probe(),
    114 	ae_start(), ae_reset(), ae_watchdog(), aeintr();
    115 
    116 struct cfdriver aecd =
    117 { NULL, "ae", ae_probe, ae_attach, DV_IFNET, sizeof(struct ae_device), NULL, 0 };
    118 
    119 static void ae_stop();
    120 static inline void ae_rint();
    121 static inline void ae_xmit();
    122 static inline char *ae_ring_copy();
    123 
    124 extern int ether_output();
    125 
    126 #define	ETHER_MIN_LEN	64
    127 #define ETHER_MAX_LEN	1518
    128 #define	ETHER_ADDR_LEN	6
    129 #define	ETHER_HDR_SIZE	14
    130 
    131 char ae_name[] = "8390 Nubus Ethernet card";
    132 static char zero = 0;
    133 static u_char ones = 0xff;
    134 
    135 struct vendor_S {
    136 	char	*manu;
    137 	int	len;
    138 	int	vendor;
    139 } vend[] = {
    140 	{ "Apple", 5, AE_VENDOR_APPLE },
    141 	{ "3Com",  4, AE_VENDOR_APPLE },
    142 	{ "Dayna", 5, AE_VENDOR_DAYNA },
    143 	{ "Inter", 5, AE_VENDOR_INTERLAN },
    144 	{ "Asant", 5, AE_VENDOR_ASANTE },
    145 };
    146 
    147 static int numvend = sizeof(vend)/sizeof(vend[0]);
    148 
    149 /*
    150  * XXX These two should be moved to locore, and maybe changed to use shorts
    151  * instead of bytes.  The reason for these is that bcopy and bzero use longs,
    152  * which the ethernet cards can't handle.
    153  */
    154 
    155 void
    156 bszero (u_short *addr, int len)
    157 {
    158 	while (len--) {
    159 		*addr++ = 0;
    160 	}
    161 }
    162 
    163 void
    164 bbcopy (char *src, char *dest, int len)
    165 {
    166 	while (len--) {
    167 		*dest++ = *src++;
    168 	}
    169 }
    170 
    171 /*
    172 	short copy; assume destination is always aligned
    173 	and last byte of odd length copy is not important
    174 */
    175 
    176 void
    177 bscopy (char *src, char *dest, int len)
    178 {
    179 	u_short *d = (u_short *)dest;
    180 	u_short *s = (u_short *)src;
    181 	char b1, b2;
    182 
    183 	/* odd case, src addr is unaligned */
    184 	if ( ((u_long)src) & 1 ) {
    185 		while (len > 0) {
    186 			b1 = *src++;
    187 			b2 = len > 1 ? *src++ : (*d & 0xff);
    188 			*d++ = (b1 << 8) | b2;
    189 			len -= 2;
    190 		}
    191 		return;
    192 	}
    193 
    194 	/* normal case, aligned src & dst */
    195 	while (len > 0) {
    196 		*d++ = *s++;
    197 		len -= 2;
    198 	}
    199 }
    200 
    201 void
    202 ae_id_card(nu, sc)
    203 	struct nubus_hw	*nu;
    204 	struct ae_softc	*sc;
    205 {
    206 	int	i;
    207 
    208 	/*
    209 	 * Try to determine what type of card this is...
    210 	 */
    211 	sc->vendor = AE_VENDOR_UNKNOWN;
    212 	for (i=0 ; i<numvend ; i++) {
    213 		if (!strncmp(nu->Slot.manufacturer, vend[i].manu, vend[i].len))
    214 		{
    215 			sc->vendor = vend[i].vendor;
    216 			break;
    217 		}
    218 	}
    219 	sc->type_str = (char *) (nu->Slot.manufacturer);
    220 
    221 }
    222 
    223 int
    224 ae_size_card_memory(sc)
    225 	struct ae_softc	*sc;
    226 {
    227 	u_short *p;
    228 	u_short i1, i2, i3, i4;
    229 	int size;
    230 
    231 	p = (u_short *)sc->smem_start;
    232 
    233 	/*
    234 	 * very simple size memory, assuming it's installed in 8k
    235 	 * banks; also assume it will generally mirror in upper banks
    236 	 * if not installed.
    237 	 */
    238 	i1 = (8192*0)/2;
    239 	i2 = (8192*1)/2;
    240 	i3 = (8192*2)/2;
    241 	i4 = (8192*3)/2;
    242 
    243 	p[i1] = 0x1111;
    244 	p[i2] = 0x2222;
    245 	p[i3] = 0x3333;
    246 	p[i4] = 0x4444;
    247 
    248 	size = 0;
    249 	if (p[i1] == 0x1111 && p[i2] == 0x2222 &&
    250 	    p[i3] == 0x3333 && p[i4] == 0x4444)
    251 		size = 8192*4;
    252 	else
    253 		if ((p[i1] == 0x1111 && p[i2] == 0x2222) ||
    254 		    (p[i1] == 0x3333 && p[i2] == 0x4444))
    255 			size = 8192*2;
    256 		else
    257 			if (p[i1] == 0x1111 || p[i1] == 0x4444)
    258 				size = 8192;
    259 
    260 	if (size == 0)
    261 	  return 0;
    262 
    263 	return size;
    264 }
    265 
    266 int
    267 ae_probe(parent, cf, aux)
    268 	struct cfdriver	*parent;
    269 	struct cfdata	*cf;
    270 	void		*aux;
    271 {
    272 	register struct nubus_hw *nu = (struct nubus_hw *) aux;
    273 	struct ae_softc *sc = &ae_softc[cf->cf_unit];
    274 	int i, memsize;
    275 	int flags = 0;
    276 
    277 	if (nu->Slot.type != NUBUS_NETWORK)
    278 		return 0;
    279 
    280 	ae_id_card(nu, sc);
    281 
    282 	sc->regs_rev = 0;
    283 	sc->smem_wr_short = 0;
    284 
    285 	switch (sc->vendor) {
    286 	      case AE_VENDOR_INTERLAN:
    287 		sc->nic_addr = nu->addr + GC_NIC_OFFSET;
    288 		sc->rom_addr = nu->addr + GC_ROM_OFFSET;
    289 		sc->smem_start = nu->addr + GC_DATA_OFFSET;
    290 		if ((memsize = ae_size_card_memory(sc)) == 0)
    291 			return 0;
    292 
    293 		/* reset the NIC chip */
    294 		*((caddr_t)nu->addr + GC_RESET_OFFSET) = (char)zero;
    295 
    296 		/* Get station address from on-board ROM */
    297 		for (i = 0; i < ETHER_ADDR_LEN; ++i)
    298 			sc->arpcom.ac_enaddr[i] = *(sc->rom_addr + i*4);
    299 		break;
    300 
    301 	      case AE_VENDOR_ASANTE:
    302 		/* memory writes require *(u_short *) */
    303 		sc->smem_wr_short = 1;
    304 		/* otherwise, pretend to be an apple card (fall through) */
    305 
    306 	      case AE_VENDOR_APPLE:
    307 		sc->regs_rev = 1;
    308 		sc->nic_addr = nu->addr + AE_NIC_OFFSET;
    309 		sc->rom_addr = nu->addr + AE_ROM_OFFSET;
    310 		sc->smem_start = nu->addr + AE_DATA_OFFSET;
    311 		if ((memsize = ae_size_card_memory(sc)) == 0)
    312 			return 0;
    313 
    314 		/* Get station address from on-board ROM */
    315 		for (i = 0; i < ETHER_ADDR_LEN; ++i)
    316 			sc->arpcom.ac_enaddr[i] = *(sc->rom_addr + i*2);
    317 		break;
    318 
    319 	      case AE_VENDOR_DAYNA:
    320 		printf("We think we are a Dayna card, but ");
    321 		sc->nic_addr = nu->addr + DP_NIC_OFFSET;
    322 		sc->rom_addr = nu->addr + DP_ROM_OFFSET;
    323 		sc->smem_start = nu->addr + DP_DATA_OFFSET;
    324 		memsize = 8192;
    325 
    326 		/* Get station address from on-board ROM */
    327 		for (i = 0; i < ETHER_ADDR_LEN; ++i)
    328 			sc->arpcom.ac_enaddr[i] = *(sc->rom_addr + i*2);
    329 		printf("it is dangerous to continue.\n");
    330 		return 0; /* Since we don't work yet... */
    331 		break;
    332 
    333 	      default:
    334 		return 0;
    335 		break;
    336 	}
    337 
    338 	/*
    339 	 * allocate one xmit buffer if < 16k, two buffers otherwise
    340 	 */
    341 	if ((memsize < 16384) || (flags & AE_FLAGS_NO_DOUBLE_BUFFERING)) {
    342 		sc->smem_ring =
    343 		  sc->smem_start + (AE_PAGE_SIZE * AE_TXBUF_SIZE);
    344 		sc->txb_cnt = 1;
    345 		sc->rec_page_start = AE_TXBUF_SIZE;
    346 	} else {
    347 		sc->smem_ring =
    348 		  sc->smem_start + (AE_PAGE_SIZE * AE_TXBUF_SIZE * 2);
    349 		sc->txb_cnt = 2;
    350 		sc->rec_page_start = AE_TXBUF_SIZE * 2;
    351 	}
    352 
    353 	sc->smem_size = memsize;
    354 	sc->smem_end = sc->smem_start + memsize;
    355 	sc->rec_page_stop = memsize / AE_PAGE_SIZE;
    356 	sc->tx_page_start = 0;
    357 
    358 	/*
    359 	 * Now zero memory and verify that it is clear
    360 	 */
    361 	bszero((u_short *)sc->smem_start, memsize / 2);
    362 
    363 	for (i = 0; i < memsize; ++i)
    364 		if (sc->smem_start[i]) {
    365 	        	printf("ae: failed to clear shared memory at %x\n",
    366 			       sc->smem_start + i);
    367 
    368 			return(0);
    369 		}
    370 
    371 #ifdef DEBUG_PRINT
    372 	printf("nic_addr %x, rom_addr %x\n",
    373 		sc->nic_addr, sc->rom_addr);
    374 	printf("smem_size %d\n", sc->smem_size);
    375 	printf("smem_start %x, smem_ring %x, smem_end %x\n",
    376 		sc->smem_start, sc->smem_ring, sc->smem_end);
    377 	printf("phys address %02x:%02x:%02x:%02x:%02x:%02x\n",
    378 		sc->arpcom.ac_enaddr[0],
    379 		sc->arpcom.ac_enaddr[1],
    380 		sc->arpcom.ac_enaddr[2],
    381 		sc->arpcom.ac_enaddr[3],
    382 		sc->arpcom.ac_enaddr[4],
    383 		sc->arpcom.ac_enaddr[5]);
    384 #endif
    385 
    386 	return(1);
    387 }
    388 
    389 /*
    390  * Install interface into kernel networking data structures
    391  */
    392 void
    393 ae_attach(parent, self, aux)
    394 	struct cfdriver	*parent, *self;
    395 	void		*aux;
    396 {
    397 	struct nubus_hw	*nu = aux;
    398 	struct ae_device *ae = (struct ae_device *) self;
    399 	struct ae_softc *sc = &ae_softc[ae->ae_dev.dv_unit];
    400 	struct cfdata *cf = ae->ae_dev.dv_cfdata;
    401 	struct ifnet *ifp = &sc->arpcom.ac_if;
    402 	struct ifaddr *ifa;
    403 	struct sockaddr_dl *sdl;
    404 
    405 	sc->sc_ae = ae;
    406 
    407 	/*
    408 	 * Set interface to stopped condition (reset)
    409 	 */
    410 	ae_stop(sc);
    411 
    412 	/*
    413 	 * Initialize ifnet structure
    414 	 */
    415 	ifp->if_unit = ae->ae_dev.dv_unit;
    416 	ifp->if_name = aecd.cd_name;
    417 	ifp->if_mtu = ETHERMTU;
    418 	ifp->if_output = ether_output;
    419 	ifp->if_start = ae_start;
    420 	ifp->if_ioctl = ae_ioctl;
    421 	ifp->if_reset = ae_reset;
    422 	ifp->if_watchdog = ae_watchdog;
    423 	ifp->if_flags = (IFF_BROADCAST | IFF_SIMPLEX | IFF_NOTRAILERS);
    424 
    425 #if 0
    426 	/*
    427 	 * Set default state for ALTPHYS flag (used to disable the transceiver
    428 	 * for AUI operation), based on compile-time config option.
    429 	 */
    430 	if (cf->cf_flags & AE_FLAGS_DISABLE_TRANSCEIVER)
    431 		ifp->if_flags |= IFF_ALTPHYS;
    432 #endif
    433 
    434 	/*
    435 	 * Attach the interface
    436 	 */
    437 	if_attach(ifp);
    438 
    439 	/*
    440 	 * Search down the ifa address list looking for the AF_LINK type entry
    441 	 */
    442  	ifa = ifp->if_addrlist;
    443 	while ((ifa != 0) && (ifa->ifa_addr != 0) &&
    444 	    (ifa->ifa_addr->sa_family != AF_LINK))
    445 		ifa = ifa->ifa_next;
    446 	/*
    447 	 * If we find an AF_LINK type entry we fill in the hardware address.
    448 	 *	This is useful for netstat(1) to keep track of which interface
    449 	 *	is which.
    450 	 */
    451 	if ((ifa != 0) && (ifa->ifa_addr != 0)) {
    452 		/*
    453 		 * Fill in the link-level address for this interface
    454 		 */
    455 		sdl = (struct sockaddr_dl *)ifa->ifa_addr;
    456 		sdl->sdl_type = IFT_ETHER;
    457 		sdl->sdl_alen = ETHER_ADDR_LEN;
    458 		sdl->sdl_slen = 0;
    459 		bbcopy(sc->arpcom.ac_enaddr, LLADDR(sdl), ETHER_ADDR_LEN);
    460 	}
    461 
    462 	/*
    463 	 * Print additional info when attached
    464 	 */
    465 	printf(": address %s, ", ether_sprintf(sc->arpcom.ac_enaddr));
    466 
    467 	if (sc->type_str && (*sc->type_str != 0))
    468 		printf("type %s", sc->type_str);
    469 	else
    470 		printf("type unknown (0x%x)", sc->type);
    471 
    472 	printf(", %dk mem", sc->smem_size / 1024);
    473 
    474 	printf("\n");
    475 
    476 	/*
    477 	 * If BPF is in the kernel, call the attach for it
    478 	 */
    479 #if NBPFILTER > 0
    480 	bpfattach(&sc->bpf, ifp, DLT_EN10MB, sizeof(struct ether_header));
    481 #endif
    482 }
    483 
    484 /*
    485  * Reset interface.
    486  */
    487 int
    488 ae_reset(sc)
    489 	struct ae_softc *sc;
    490 {
    491 	int s;
    492 
    493 	s = splnet();
    494 
    495 	/*
    496 	 * Stop interface and re-initialize.
    497 	 */
    498 	ae_stop(sc);
    499 	ae_init(sc);
    500 
    501 	(void) splx(s);
    502 }
    503 
    504 /*
    505  * Take interface offline.
    506  */
    507 void
    508 ae_stop(sc)
    509 	struct ae_softc *sc;
    510 {
    511 	int n = 5000;
    512 
    513 	/*
    514 	 * Stop everything on the interface, and select page 0 registers.
    515 	 */
    516 	NIC_PUT(sc, AE_P0_CR, AE_CR_RD2|AE_CR_STP);
    517 
    518 	/*
    519 	 * Wait for interface to enter stopped state, but limit # of checks
    520 	 *	to 'n' (about 5ms). It shouldn't even take 5us on modern
    521 	 *	DS8390's, but just in case it's an old one.
    522 	 */
    523 	while (((NIC_GET(sc, AE_P0_ISR) & AE_ISR_RST) == 0) && --n);
    524 }
    525 
    526 /*
    527  * Device timeout/watchdog routine. Entered if the device neglects to
    528  *	generate an interrupt after a transmit has been started on it.
    529  */
    530 static	int aeintr_ctr=0;
    531 int
    532 ae_watchdog(unit)
    533 	short unit;
    534 {
    535 	struct ae_softc *sc = &ae_softc[unit];
    536 
    537 #if 1
    538 /*
    539  * This is a kludge!  The via code seems to miss slot interrupts
    540  * sometimes.  This kludges around that by calling the handler
    541  * by hand if the watchdog is activated. -- XXX (akb)
    542  */
    543 	int	i;
    544 
    545 	i = aeintr_ctr;
    546 
    547 	(*via2itab[1])(1);
    548 
    549 	if (i != aeintr_ctr)
    550 		return;
    551 #endif
    552 
    553 	log(LOG_ERR, "ae%d: device timeout\n", unit);
    554 	ae_reset(sc);
    555 }
    556 
    557 /*
    558  * Initialize device.
    559  */
    560 ae_init(sc)
    561 	struct ae_softc *sc;
    562 {
    563 	struct ifnet *ifp = &sc->arpcom.ac_if;
    564 	int i, s;
    565 	u_char	command;
    566 
    567 	/* address not known */
    568 	if (ifp->if_addrlist == (struct ifaddr *)0) return;
    569 
    570 	/*
    571 	 * Initialize the NIC in the exact order outlined in the NS manual.
    572 	 *	This init procedure is "mandatory"...don't change what or when
    573 	 *	things happen.
    574 	 */
    575 	s = splnet();
    576 
    577 	/* reset transmitter flags */
    578 	sc->data_buffered = 0;
    579 	sc->xmit_busy = 0;
    580 	sc->arpcom.ac_if.if_timer = 0;
    581 
    582 	sc->txb_next = 0;
    583 
    584 	/* This variable is used below - don't move this assignment */
    585 	sc->next_packet = sc->rec_page_start + 1;
    586 
    587 #ifdef DEBUG_PRINT
    588 	printf("page_start %d, page_stop %d, next %d\n",
    589 		sc->rec_page_start, sc->rec_page_stop, sc->next_packet);
    590 #endif
    591 
    592 	/*
    593 	 * Set interface for page 0, Remote DMA complete, Stopped
    594 	 */
    595 	NIC_PUT(sc, AE_P0_CR, AE_CR_RD2|AE_CR_STP);
    596 
    597 	/*
    598 	 * Set FIFO threshold to 4, No auto-init Remote DMA, Burst mode,
    599 	 *	byte order=80x86, word-wide DMA xfers,
    600 	 */
    601 	NIC_PUT(sc, AE_P0_DCR, AE_DCR_FT1|AE_DCR_BMS|AE_DCR_WTS);
    602 
    603 	/*
    604 	 * Clear Remote Byte Count Registers
    605 	 */
    606 	NIC_PUT(sc, AE_P0_RBCR0, zero);
    607 	NIC_PUT(sc, AE_P0_RBCR1, zero);
    608 
    609 	/*
    610 	 * Enable reception of broadcast packets
    611 	 */
    612 	NIC_PUT(sc, AE_P0_RCR, AE_RCR_AB);
    613 
    614 	/*
    615 	 * Place NIC in internal loopback mode
    616 	 */
    617 	NIC_PUT(sc, AE_P0_TCR, AE_TCR_LB0);
    618 
    619 	/*
    620 	 * Initialize transmit/receive (ring-buffer) Page Start
    621 	 */
    622 	NIC_PUT(sc, AE_P0_TPSR, sc->tx_page_start);
    623 	NIC_PUT(sc, AE_P0_PSTART, sc->rec_page_start);
    624 
    625 	/*
    626 	 * Initialize Receiver (ring-buffer) Page Stop and Boundry
    627 	 */
    628 	NIC_PUT(sc, AE_P0_PSTOP, sc->rec_page_stop);
    629 	NIC_PUT(sc, AE_P0_BNRY, sc->rec_page_start);
    630 
    631 	/*
    632 	 * Clear all interrupts. A '1' in each bit position clears the
    633 	 *	corresponding flag.
    634 	 */
    635 	NIC_PUT(sc, AE_P0_ISR, ones);
    636 
    637 	/* make sure interrupts are vectored to us */
    638 	add_nubus_intr((int)sc->rom_addr & 0xFF000000, aeintr, sc - ae_softc);
    639 
    640 	/*
    641 	 * Enable the following interrupts: receive/transmit complete,
    642 	 *	receive/transmit error, and Receiver OverWrite.
    643 	 *
    644 	 * Counter overflow and Remote DMA complete are *not* enabled.
    645 	 */
    646 	NIC_PUT(sc, AE_P0_IMR,
    647 		AE_IMR_PRXE|AE_IMR_PTXE|AE_IMR_RXEE|AE_IMR_TXEE|AE_IMR_OVWE);
    648 
    649 	/*
    650 	 * Program Command Register for page 1
    651 	 */
    652 	NIC_PUT(sc, AE_P0_CR, AE_CR_PAGE_1|AE_CR_RD2|AE_CR_STP);
    653 
    654 	/*
    655 	 * Copy out our station address
    656 	 */
    657 	for (i = 0; i < ETHER_ADDR_LEN; ++i)
    658 		NIC_PUT(sc, AE_P1_PAR0 + i, sc->arpcom.ac_enaddr[i]);
    659 
    660 #if NBPFILTER > 0
    661 	/*
    662 	 * Initialize multicast address hashing registers to accept
    663 	 *	 all multicasts (only used when in promiscuous mode)
    664 	 */
    665 	for (i = 0; i < 8; ++i)
    666 		NIC_PUT(sc, AE_P1_MAR0 + i, 0xff);
    667 #endif
    668 
    669 	/*
    670 	 * Set Current Page pointer to next_packet (initialized above)
    671 	 */
    672 	NIC_PUT(sc, AE_P1_CURR, sc->next_packet);
    673 
    674 	/*
    675 	 * Set Command Register for page 0, Remote DMA complete,
    676 	 * 	and interface Start.
    677 	 */
    678 	NIC_PUT(sc, AE_P1_CR, AE_CR_RD2|AE_CR_STA);
    679 
    680 	/*
    681 	 * Take interface out of loopback
    682 	 */
    683 	NIC_PUT(sc, AE_P0_TCR, zero);
    684 
    685 	/*
    686 	 * Set 'running' flag, and clear output active flag.
    687 	 */
    688 	ifp->if_flags |= IFF_RUNNING;
    689 	ifp->if_flags &= ~IFF_OACTIVE;
    690 
    691 	/*
    692 	 * ...and attempt to start output
    693 	 */
    694 	ae_start(ifp);
    695 
    696 	(void) splx(s);
    697 }
    698 
    699 /*
    700  * This routine actually starts the transmission on the interface
    701  */
    702 static inline void ae_xmit(ifp)
    703 	struct ifnet *ifp;
    704 {
    705 	struct ae_softc *sc = &ae_softc[ifp->if_unit];
    706 	u_short len = sc->txb_next_len;
    707 
    708 	/*
    709 	 * Set NIC for page 0 register access
    710 	 */
    711 	NIC_PUT(sc, AE_P0_CR, AE_CR_RD2|AE_CR_STA);
    712 
    713 	/*
    714 	 * Set TX buffer start page
    715 	 */
    716 	NIC_PUT(sc, AE_P0_TPSR, sc->tx_page_start +
    717 		sc->txb_next * AE_TXBUF_SIZE);
    718 
    719 	/*
    720 	 * Set TX length
    721 	 */
    722 	NIC_PUT(sc, AE_P0_TBCR0, len & 0xff);
    723 	NIC_PUT(sc, AE_P0_TBCR1, len >> 8);
    724 
    725 	/*
    726 	 * Set page 0, Remote DMA complete, Transmit Packet, and *Start*
    727 	 */
    728 	NIC_PUT(sc, AE_P0_CR, AE_CR_RD2|AE_CR_TXP|AE_CR_STA);
    729 
    730 	sc->xmit_busy = 1;
    731 	sc->data_buffered = 0;
    732 
    733 	/*
    734 	 * Switch buffers if we are doing double-buffered transmits
    735 	 */
    736 	if ((sc->txb_next == 0) && (sc->txb_cnt > 1))
    737 		sc->txb_next = 1;
    738 	else
    739 		sc->txb_next = 0;
    740 
    741 	/*
    742 	 * Set a timer just in case we never hear from the board again
    743 	 */
    744 	ifp->if_timer = 2;
    745 }
    746 
    747 /*
    748  * Start output on interface.
    749  * We make two assumptions here:
    750  *  1) that the current priority is set to splnet _before_ this code
    751  *     is called *and* is returned to the appropriate priority after
    752  *     return
    753  *  2) that the IFF_OACTIVE flag is checked before this code is called
    754  *     (i.e. that the output part of the interface is idle)
    755  */
    756 int
    757 ae_start(ifp)
    758 	struct ifnet *ifp;
    759 {
    760 	struct ae_softc *sc = &ae_softc[ifp->if_unit];
    761 	struct mbuf *m0, *m;
    762 	caddr_t buffer;
    763 	int len;
    764 
    765 outloop:
    766 	/*
    767 	 * See if there is room to send more data (i.e. one or both of the
    768 	 *	buffers is empty).
    769 	 */
    770 	if (sc->data_buffered)
    771 		if (sc->xmit_busy) {
    772 			/*
    773 			 * No room. Indicate this to the outside world
    774 			 *	and exit.
    775 			 */
    776 			ifp->if_flags |= IFF_OACTIVE;
    777 			return;
    778 		} else {
    779 			/*
    780 			 * Data is buffered, but we're not transmitting, so
    781 			 *	start the xmit on the buffered data.
    782 			 * Note that ae_xmit() resets the data_buffered flag
    783 			 *	before returning.
    784 			 */
    785 			ae_xmit(ifp);
    786 		}
    787 
    788 	IF_DEQUEUE(&sc->arpcom.ac_if.if_snd, m);
    789 	if (m == 0) {
    790 	/*
    791 	 * The following isn't pretty; we are using the !OACTIVE flag to
    792 	 * indicate to the outside world that we can accept an additional
    793 	 * packet rather than that the transmitter is _actually_
    794 	 * active. Indeed, the transmitter may be active, but if we haven't
    795 	 * filled the secondary buffer with data then we still want to
    796 	 * accept more.
    797 	 * Note that it isn't necessary to test the data_buffered flag -
    798 	 * we wouldn't have tried to de-queue the packet in the first place
    799 	 * if it was set.
    800 	 */
    801 		ifp->if_flags &= ~IFF_OACTIVE;
    802 		return;
    803 	}
    804 
    805 	/*
    806 	 * Copy the mbuf chain into the transmit buffer
    807 	 */
    808 	buffer = sc->smem_start + (sc->txb_next * AE_TXBUF_SIZE * AE_PAGE_SIZE);
    809 	len = 0;
    810 	for (m0 = m; m != 0; m = m->m_next) {
    811 		/*printf("ae: copy %d bytes @ %x\n", m->m_len, buffer);*/
    812 		bscopy(mtod(m, caddr_t), buffer, m->m_len);
    813 		buffer += m->m_len;
    814        		len += m->m_len;
    815 	}
    816 	if (len & 1) len++;
    817 
    818 	sc->txb_next_len = max(len, ETHER_MIN_LEN);
    819 
    820 	if (sc->txb_cnt > 1)
    821 		/*
    822 		 * only set 'buffered' flag if doing multiple buffers
    823 		 */
    824 		sc->data_buffered = 1;
    825 
    826 	if (sc->xmit_busy == 0)
    827 		ae_xmit(ifp);
    828 	/*
    829 	 * If there is BPF support in the configuration, tap off here.
    830 	 *   The following has support for converting trailer packets
    831 	 *   back to normal.
    832 	 */
    833 #if NBPFILTER > 0
    834 	if (sc->bpf) {
    835 		u_short etype;
    836 		int off, datasize, resid;
    837 		struct ether_header *eh;
    838 		struct trailer_header {
    839 			u_short ether_type;
    840 			u_short ether_residual;
    841 		} trailer_header;
    842 		char ether_packet[ETHER_MAX_LEN];
    843 		char *ep;
    844 
    845 		ep = ether_packet;
    846 
    847 		/*
    848 		 * We handle trailers below:
    849 		 * Copy ether header first, then residual data,
    850 		 * then data. Put all this in a temporary buffer
    851 		 * 'ether_packet' and send off to bpf. Since the
    852 		 * system has generated this packet, we assume
    853 		 * that all of the offsets in the packet are
    854 		 * correct; if they're not, the system will almost
    855 		 * certainly crash in m_copydata.
    856 		 * We make no assumptions about how the data is
    857 		 * arranged in the mbuf chain (i.e. how much
    858 		 * data is in each mbuf, if mbuf clusters are
    859 		 * used, etc.), which is why we use m_copydata
    860 		 * to get the ether header rather than assume
    861 		 * that this is located in the first mbuf.
    862 		 */
    863 		/* copy ether header */
    864 		m_copydata(m0, 0, sizeof(struct ether_header), ep);
    865 		eh = (struct ether_header *) ep;
    866 		ep += sizeof(struct ether_header);
    867 		etype = ntohs(eh->ether_type);
    868 		if (etype >= ETHERTYPE_TRAIL &&
    869 		    etype < ETHERTYPE_TRAIL+ETHERTYPE_NTRAILER) {
    870 			datasize = ((etype - ETHERTYPE_TRAIL) << 9);
    871 			off = datasize + sizeof(struct ether_header);
    872 
    873 			/* copy trailer_header into a data structure */
    874 			m_copydata(m0, off, sizeof(struct trailer_header),
    875 				&trailer_header.ether_type);
    876 
    877 			/* copy residual data */
    878 			m_copydata(m0, off+sizeof(struct trailer_header),
    879 				resid = ntohs(trailer_header.ether_residual) -
    880 				sizeof(struct trailer_header), ep);
    881 			ep += resid;
    882 
    883 			/* copy data */
    884 			m_copydata(m0, sizeof(struct ether_header),
    885 				datasize, ep);
    886 			ep += datasize;
    887 
    888 			/* restore original ether packet type */
    889 			eh->ether_type = trailer_header.ether_type;
    890 
    891 			bpf_tap(sc->bpf, ether_packet, ep - ether_packet);
    892 		} else
    893 			bpf_mtap(sc->bpf, m0);
    894 	}
    895 #endif
    896 
    897 	m_freem(m0);
    898 
    899 	/*
    900 	 * If we are doing double-buffering, a buffer might be free to
    901 	 *	fill with another packet, so loop back to the top.
    902 	 */
    903 	if (sc->txb_cnt > 1)
    904 		goto outloop;
    905 	else {
    906 		ifp->if_flags |= IFF_OACTIVE;
    907 		return;
    908 	}
    909 }
    910 
    911 /*
    912  * Ethernet interface receiver interrupt.
    913  */
    914 static inline void
    915 ae_rint(unit)
    916 	int unit;
    917 {
    918 	register struct ae_softc *sc = &ae_softc[unit];
    919 	u_char boundry, current;
    920 	u_short len;
    921 	struct ae_ring *packet_ptr;
    922 
    923 	/*
    924 	 * Set NIC to page 1 registers to get 'current' pointer
    925 	 */
    926 	NIC_PUT(sc, AE_P0_CR, AE_CR_PAGE_1|AE_CR_RD2|AE_CR_STA);
    927 
    928 	/*
    929 	 * 'sc->next_packet' is the logical beginning of the ring-buffer - i.e.
    930 	 *	it points to where new data has been buffered. The 'CURR'
    931 	 *	(current) register points to the logical end of the ring-buffer
    932 	 *	- i.e. it points to where additional new data will be added.
    933 	 *	We loop here until the logical beginning equals the logical
    934 	 *	end (or in other words, until the ring-buffer is empty).
    935 	 */
    936 	while (sc->next_packet != NIC_GET(sc, AE_P1_CURR)) {
    937 
    938 		/* get pointer to this buffer header structure */
    939 		packet_ptr = (struct ae_ring *)(sc->smem_ring +
    940 			 (sc->next_packet - sc->rec_page_start) * AE_PAGE_SIZE);
    941 
    942 		/*
    943 		 * The byte count includes the FCS - Frame Check Sequence (a
    944 		 *	32 bit CRC).
    945 		 */
    946 		len = packet_ptr->count[0] | (packet_ptr->count[1] << 8);
    947 		if ((len >= ETHER_MIN_LEN) && (len <= ETHER_MAX_LEN)) {
    948 			/*
    949 			 * Go get packet. len - 4 removes CRC from length.
    950 			 * (packet_ptr + 1) points to data just after the
    951 			 * packet ring header (+4 bytes)
    952 			 */
    953 			ae_get_packet(sc, (caddr_t)(packet_ptr + 1), len - 4);
    954 			++sc->arpcom.ac_if.if_ipackets;
    955 		} else {
    956 			/*
    957 			 * Really BAD...probably indicates that the ring
    958 			 * pointers are corrupted. Also seen on early rev
    959 			 * chips under high load - the byte order of the
    960 			 * length gets switched.
    961 			 */
    962 			log(LOG_ERR,
    963 				"ae%d: shared memory corrupt - invalid packet length %d\n",
    964 				unit, len);
    965 			ae_reset(sc);
    966 			return;
    967 		}
    968 
    969 		/*
    970 		 * Update next packet pointer
    971 		 */
    972 		sc->next_packet = packet_ptr->next_packet;
    973 
    974 		/*
    975 		 * Update NIC boundry pointer - being careful to keep it
    976 		 *	one buffer behind. (as recommended by NS databook)
    977 		 */
    978 		boundry = sc->next_packet - 1;
    979 		if (boundry < sc->rec_page_start)
    980 			boundry = sc->rec_page_stop - 1;
    981 
    982 		/*
    983 		 * Set NIC to page 0 registers to update boundry register
    984 		 */
    985 		NIC_PUT(sc, AE_P0_CR, AE_CR_RD2|AE_CR_STA);
    986 
    987 		NIC_PUT(sc, AE_P0_BNRY, boundry);
    988 
    989 		/*
    990 		 * Set NIC to page 1 registers before looping to top
    991 		 * (prepare to get 'CURR' current pointer)
    992 		 */
    993 		NIC_PUT(sc, AE_P0_CR, AE_CR_PAGE_1|AE_CR_RD2|AE_CR_STA);
    994 	}
    995 }
    996 
    997 /*
    998  * Ethernet interface interrupt processor
    999  */
   1000 int
   1001 aeintr(unit)
   1002 	int unit;
   1003 {
   1004 	struct ae_softc *sc = &ae_softc[unit];
   1005 	u_char isr;
   1006 
   1007 	aeintr_ctr++;
   1008 	/*
   1009 	 * Set NIC to page 0 registers
   1010 	 */
   1011 	NIC_PUT(sc, AE_P0_CR, AE_CR_RD2|AE_CR_STA);
   1012 
   1013 	/*
   1014 	 * loop until there are no more new interrupts
   1015 	 */
   1016 	while (isr = NIC_GET(sc, AE_P0_ISR)) {
   1017 
   1018 		/*
   1019 		 * reset all the bits that we are 'acknowledging'
   1020 		 *	by writing a '1' to each bit position that was set
   1021 		 * (writing a '1' *clears* the bit)
   1022 		 */
   1023 		NIC_PUT(sc, AE_P0_ISR, isr);
   1024 
   1025 		/*
   1026 		 * Handle transmitter interrupts. Handle these first
   1027 		 *	because the receiver will reset the board under
   1028 		 *	some conditions.
   1029 		 */
   1030 		if (isr & (AE_ISR_PTX|AE_ISR_TXE)) {
   1031 			u_char collisions = NIC_GET(sc, AE_P0_NCR);
   1032 
   1033 			/*
   1034 			 * Check for transmit error. If a TX completed with an
   1035 			 * error, we end up throwing the packet away. Really
   1036 			 * the only error that is possible is excessive
   1037 			 * collisions, and in this case it is best to allow the
   1038 			 * automatic mechanisms of TCP to backoff the flow. Of
   1039 			 * course, with UDP we're screwed, but this is expected
   1040 			 * when a network is heavily loaded.
   1041 			 */
   1042 			if (isr & AE_ISR_TXE) {
   1043 
   1044 				/*
   1045 				 * Excessive collisions (16)
   1046 				 */
   1047 				if ((NIC_GET(sc, AE_P0_TSR) & AE_TSR_ABT)
   1048 					&& (collisions == 0)) {
   1049 					/*
   1050 					 *    When collisions total 16, the
   1051 					 * P0_NCR will indicate 0, and the
   1052 					 * TSR_ABT is set.
   1053 					 */
   1054 					collisions = 16;
   1055 				}
   1056 
   1057 				/*
   1058 				 * update output errors counter
   1059 				 */
   1060 				++sc->arpcom.ac_if.if_oerrors;
   1061 			} else {
   1062 				/*
   1063 				 * Update total number of successfully
   1064 				 * 	transmitted packets.
   1065 				 */
   1066 				++sc->arpcom.ac_if.if_opackets;
   1067 			}
   1068 
   1069 			/*
   1070 			 * reset tx busy and output active flags
   1071 			 */
   1072 			sc->xmit_busy = 0;
   1073 			sc->arpcom.ac_if.if_flags &= ~IFF_OACTIVE;
   1074 
   1075 			/*
   1076 			 * clear watchdog timer
   1077 			 */
   1078 			sc->arpcom.ac_if.if_timer = 0;
   1079 
   1080 			/*
   1081 			 * Add in total number of collisions on last
   1082 			 *	transmission.
   1083 			 */
   1084 			sc->arpcom.ac_if.if_collisions += collisions;
   1085 
   1086 			/*
   1087 			 * If data is ready to transmit, start it transmitting,
   1088 			 *	otherwise defer until after handling receiver
   1089 			 */
   1090 			if (sc->data_buffered)
   1091 				ae_xmit(&sc->arpcom.ac_if);
   1092 		}
   1093 
   1094 		/*
   1095 		 * Handle receiver interrupts
   1096 		 */
   1097 		if (isr & (AE_ISR_PRX|AE_ISR_RXE|AE_ISR_OVW)) {
   1098 		    /*
   1099 		     * Overwrite warning. In order to make sure that a lockup
   1100 		     *	of the local DMA hasn't occurred, we reset and
   1101 		     *	re-init the NIC. The NSC manual suggests only a
   1102 		     *	partial reset/re-init is necessary - but some
   1103 		     *	chips seem to want more. The DMA lockup has been
   1104 		     *	seen only with early rev chips - Methinks this
   1105 		     *	bug was fixed in later revs. -DG
   1106 		     */
   1107 			if (isr & AE_ISR_OVW) {
   1108 				++sc->arpcom.ac_if.if_ierrors;
   1109 				log(LOG_WARNING,
   1110 					"ae%d: warning - receiver ring buffer overrun\n",
   1111 					unit);
   1112 				/*
   1113 				 * Stop/reset/re-init NIC
   1114 				 */
   1115 				ae_reset(sc);
   1116 			} else {
   1117 
   1118 			    /*
   1119 			     * Receiver Error. One or more of: CRC error, frame
   1120 			     *	alignment error FIFO overrun, or missed packet.
   1121 			     */
   1122 				if (isr & AE_ISR_RXE) {
   1123 					++sc->arpcom.ac_if.if_ierrors;
   1124 #ifdef AE_DEBUG
   1125 					printf("ae%d: receive error %x\n", unit,
   1126 						NIC_GET(sc, AE_P0_RSR));
   1127 #endif
   1128 				}
   1129 
   1130 				/*
   1131 				 * Go get the packet(s)
   1132 				 * XXX - Doing this on an error is dubious
   1133 				 *    because there shouldn't be any data to
   1134 				 *    get (we've configured the interface to
   1135 				 *    not accept packets with errors).
   1136 				 */
   1137 				ae_rint (unit);
   1138 			}
   1139 		}
   1140 
   1141 		/*
   1142 		 * If it looks like the transmitter can take more data,
   1143 		 * 	attempt to start output on the interface.
   1144 		 *	This is done after handling the receiver to
   1145 		 *	give the receiver priority.
   1146 		 */
   1147 		if ((sc->arpcom.ac_if.if_flags & IFF_OACTIVE) == 0)
   1148 			ae_start(&sc->arpcom.ac_if);
   1149 
   1150 		/*
   1151 		 * return NIC CR to standard state: page 0, remote DMA complete,
   1152 		 * 	start (toggling the TXP bit off, even if was just set
   1153 		 *	in the transmit routine, is *okay* - it is 'edge'
   1154 		 *	triggered from low to high)
   1155 		 */
   1156 		NIC_PUT(sc, AE_P0_CR, AE_CR_RD2|AE_CR_STA);
   1157 
   1158 		/*
   1159 		 * If the Network Talley Counters overflow, read them to
   1160 		 *	reset them. It appears that old 8390's won't
   1161 		 *	clear the ISR flag otherwise - resulting in an
   1162 		 *	infinite loop.
   1163 		 */
   1164 		if (isr & AE_ISR_CNT) {
   1165 			(void) NIC_GET(sc, AE_P0_CNTR0);
   1166 			(void) NIC_GET(sc, AE_P0_CNTR1);
   1167 			(void) NIC_GET(sc, AE_P0_CNTR2);
   1168 		}
   1169 	}
   1170 	return 0;
   1171 }
   1172 
   1173 /*
   1174  * Process an ioctl request. This code needs some work - it looks
   1175  *	pretty ugly.
   1176  */
   1177 int
   1178 ae_ioctl(ifp, command, data)
   1179 	register struct ifnet *ifp;
   1180 	int command;
   1181 	caddr_t data;
   1182 {
   1183 	register struct ifaddr *ifa = (struct ifaddr *)data;
   1184 	struct ae_softc *sc = &ae_softc[ifp->if_unit];
   1185 	struct ifreq *ifr = (struct ifreq *)data;
   1186 	int s, error = 0;
   1187 
   1188 	s = splnet();
   1189 
   1190 	switch (command) {
   1191 
   1192 	case SIOCSIFADDR:
   1193 		ifp->if_flags |= IFF_UP;
   1194 
   1195 		switch (ifa->ifa_addr->sa_family) {
   1196 #ifdef INET
   1197 		case AF_INET:
   1198 			ae_init(sc);	/* before arpwhohas */
   1199 			/*
   1200 			 * See if another station has *our* IP address.
   1201 			 * i.e.: There is an address conflict! If a
   1202 			 * conflict exists, a message is sent to the
   1203 			 * console.
   1204 			 */
   1205 			((struct arpcom *)ifp)->ac_ipaddr =
   1206 				IA_SIN(ifa)->sin_addr;
   1207 			arpwhohas((struct arpcom *)ifp, &IA_SIN(ifa)->sin_addr);
   1208 			break;
   1209 #endif
   1210 #ifdef NS
   1211 		/*
   1212 		 * XXX - This code is probably wrong
   1213 		 */
   1214 		case AF_NS:
   1215 		    {
   1216 			register struct ns_addr *ina = &(IA_SNS(ifa)->sns_addr);
   1217 
   1218 			if (ns_nullhost(*ina))
   1219 				ina->x_host =
   1220 					*(union ns_host *)(sc->arpcom.ac_enaddr);
   1221 			else {
   1222 				/*
   1223 				 *
   1224 				 */
   1225 				bbcopy((caddr_t)ina->x_host.c_host,
   1226 				    (caddr_t)sc->arpcom.ac_enaddr,
   1227 					sizeof(sc->arpcom.ac_enaddr));
   1228 			}
   1229 			/*
   1230 			 * Set new address
   1231 			 */
   1232 			ae_init(sc);
   1233 			break;
   1234 		    }
   1235 #endif
   1236 		default:
   1237 			ae_init(sc);
   1238 			break;
   1239 		}
   1240 		break;
   1241 
   1242 	case SIOCSIFFLAGS:
   1243 		/*
   1244 		 * If interface is marked down and it is running, then stop it
   1245 		 */
   1246 		if (((ifp->if_flags & IFF_UP) == 0) &&
   1247 		    (ifp->if_flags & IFF_RUNNING)) {
   1248 			ae_stop(sc);
   1249 			ifp->if_flags &= ~IFF_RUNNING;
   1250 		} else {
   1251 		/*
   1252 		 * If interface is marked up and it is stopped, then start it
   1253 		 */
   1254 			if ((ifp->if_flags & IFF_UP) &&
   1255 		    	    ((ifp->if_flags & IFF_RUNNING) == 0))
   1256 				ae_init(sc);
   1257 		}
   1258 #if NBPFILTER > 0
   1259 		if (ifp->if_flags & IFF_PROMISC) {
   1260 			/*
   1261 			 * Set promiscuous mode on interface.
   1262 			 *	XXX - for multicasts to work, we would need to
   1263 			 *		write 1's in all bits of multicast
   1264 			 *		hashing array. For now we assume that
   1265 			 *		this was done in ae_init().
   1266 			 */
   1267 			NIC_PUT(sc, AE_P0_RCR,
   1268 				AE_RCR_PRO|AE_RCR_AM|AE_RCR_AB);
   1269 		} else {
   1270 			/*
   1271 			 * XXX - for multicasts to work, we would need to
   1272 			 *	rewrite the multicast hashing array with the
   1273 			 *	proper hash (would have been destroyed above).
   1274 			 */
   1275 			NIC_PUT(sc, AE_P0_RCR, AE_RCR_AB);
   1276 		}
   1277 #endif
   1278 		break;
   1279 
   1280 	default:
   1281 		error = EINVAL;
   1282 	}
   1283 	(void) splx(s);
   1284 	return (error);
   1285 }
   1286 
   1287 /*
   1288  * Macro to calculate a new address within shared memory when given an offset
   1289  *	from an address, taking into account ring-wrap.
   1290  */
   1291 #define	ringoffset(sc, start, off, type) \
   1292 	((type)( ((caddr_t)(start)+(off) >= (sc)->smem_end) ? \
   1293 		(((caddr_t)(start)+(off))) - (sc)->smem_end \
   1294 		+ (sc)->smem_ring: \
   1295 		((caddr_t)(start)+(off)) ))
   1296 
   1297 /*
   1298  * Retreive packet from shared memory and send to the next level up via
   1299  *	ether_input(). If there is a BPF listener, give a copy to BPF, too.
   1300  */
   1301 ae_get_packet(sc, buf, len)
   1302 	struct ae_softc *sc;
   1303 	char *buf;
   1304 	u_short len;
   1305 {
   1306 	struct ether_header *eh;
   1307     	struct mbuf *m, *head, *ae_ring_to_mbuf();
   1308 	u_short off;
   1309 	int resid;
   1310 	u_short etype;
   1311 	struct trailer_header {
   1312 		u_short	trail_type;
   1313 		u_short trail_residual;
   1314 	} trailer_header;
   1315 
   1316 	/* Allocate a header mbuf */
   1317 	MGETHDR(m, M_DONTWAIT, MT_DATA);
   1318 	if (m == 0)
   1319 		goto bad;
   1320 	m->m_pkthdr.rcvif = &sc->arpcom.ac_if;
   1321 	m->m_pkthdr.len = len;
   1322 	m->m_len = 0;
   1323 	head = m;
   1324 
   1325 	eh = (struct ether_header *)buf;
   1326 
   1327 	/* The following sillines is to make NFS happy */
   1328 #define EROUND	((sizeof(struct ether_header) + 3) & ~3)
   1329 #define EOFF	(EROUND - sizeof(struct ether_header))
   1330 
   1331 	/*
   1332 	 * The following assumes there is room for
   1333 	 * the ether header in the header mbuf
   1334 	 */
   1335 	head->m_data += EOFF;
   1336 	bbcopy(buf, mtod(head, caddr_t), sizeof(struct ether_header));
   1337 	buf += sizeof(struct ether_header);
   1338 	head->m_len += sizeof(struct ether_header);
   1339 	len -= sizeof(struct ether_header);
   1340 
   1341 	etype = ntohs((u_short)eh->ether_type);
   1342 
   1343 	/*
   1344 	 * Deal with trailer protocol:
   1345 	 * If trailer protocol, calculate the datasize as 'off',
   1346 	 * which is also the offset to the trailer header.
   1347 	 * Set resid to the amount of packet data following the
   1348 	 * trailer header.
   1349 	 * Finally, copy residual data into mbuf chain.
   1350 	 */
   1351 	if (etype >= ETHERTYPE_TRAIL &&
   1352 	    etype < ETHERTYPE_TRAIL+ETHERTYPE_NTRAILER) {
   1353 
   1354 		off = (etype - ETHERTYPE_TRAIL) << 9;
   1355 		if ((off + sizeof(struct trailer_header)) > len)
   1356 			goto bad;	/* insanity */
   1357 
   1358 		eh->ether_type = *ringoffset(sc, buf, off, u_short *);
   1359 		resid = ntohs(*ringoffset(sc, buf, off+2, u_short *));
   1360 
   1361 		if ((off + resid) > len) goto bad;	/* insanity */
   1362 
   1363 		resid -= sizeof(struct trailer_header);
   1364 		if (resid < 0) goto bad;	/* insanity */
   1365 
   1366 		m = ae_ring_to_mbuf(sc, ringoffset(sc, buf, off+4, char *),
   1367 				    head, resid);
   1368 		if (m == 0) goto bad;
   1369 
   1370 		len = off;
   1371 		head->m_pkthdr.len -= 4; /* subtract trailer header */
   1372 	}
   1373 
   1374 	/*
   1375 	 * Pull packet off interface. Or if this was a trailer packet,
   1376 	 * the data portion is appended.
   1377 	 */
   1378 	m = ae_ring_to_mbuf(sc, buf, m, len);
   1379 	if (m == 0) goto bad;
   1380 
   1381 #if NBPFILTER > 0
   1382 	/*
   1383 	 * Check if there's a BPF listener on this interface.
   1384 	 * If so, hand off the raw packet to bpf.
   1385 	 */
   1386 	if (sc->bpf) {
   1387 		bpf_mtap(sc->bpf, head);
   1388 
   1389 		/*
   1390 		 * Note that the interface cannot be in promiscuous mode if
   1391 		 * there are no BPF listeners.  And if we are in promiscuous
   1392 		 * mode, we have to check if this packet is really ours.
   1393 		 *
   1394 		 * XXX This test does not support multicasts.
   1395 		 */
   1396 		if ((sc->arpcom.ac_if.if_flags & IFF_PROMISC) &&
   1397 			bcmp(eh->ether_dhost, sc->arpcom.ac_enaddr,
   1398 				sizeof(eh->ether_dhost)) != 0 &&
   1399 			bcmp(eh->ether_dhost, etherbroadcastaddr,
   1400 				sizeof(eh->ether_dhost)) != 0) {
   1401 
   1402 			m_freem(head);
   1403 			return;
   1404 		}
   1405 	}
   1406 #endif
   1407 
   1408 	/*
   1409 	 * Fix up data start offset in mbuf to point past ether header
   1410 	 */
   1411 	m_adj(head, sizeof(struct ether_header));
   1412 
   1413 	ether_input(&sc->arpcom.ac_if, eh, head);
   1414 	return;
   1415 
   1416 bad:	if (head)
   1417 		m_freem(head);
   1418 	return;
   1419 }
   1420 
   1421 /*
   1422  * Supporting routines
   1423  */
   1424 
   1425 /*
   1426  * Given a source and destination address, copy 'amount' of a packet from
   1427  *	the ring buffer into a linear destination buffer. Takes into account
   1428  *	ring-wrap.
   1429  */
   1430 static inline char *
   1431 ae_ring_copy(sc,src,dst,amount)
   1432 	struct ae_softc *sc;
   1433 	char	*src;
   1434 	char	*dst;
   1435 	u_short	amount;
   1436 {
   1437 	u_short	tmp_amount;
   1438 
   1439 	/* does copy wrap to lower addr in ring buffer? */
   1440 	if (src + amount > sc->smem_end) {
   1441 		tmp_amount = sc->smem_end - src;
   1442 		/* copy amount up to end of smem */
   1443 		bbcopy(src, dst, tmp_amount);
   1444 		amount -= tmp_amount;
   1445 		src = sc->smem_ring;
   1446 		dst += tmp_amount;
   1447 	}
   1448 
   1449 	bbcopy(src, dst, amount);
   1450 
   1451 	return(src + amount);
   1452 }
   1453 
   1454 /*
   1455  * Copy data from receive buffer to end of mbuf chain
   1456  * allocate additional mbufs as needed. return pointer
   1457  * to last mbuf in chain.
   1458  * sc = ed info (softc)
   1459  * src = pointer in ed ring buffer
   1460  * dst = pointer to last mbuf in mbuf chain to copy to
   1461  * amount = amount of data to copy
   1462  */
   1463 struct mbuf *
   1464 ae_ring_to_mbuf(sc,src,dst,total_len)
   1465 	struct ae_softc *sc;
   1466 	char *src;
   1467 	struct mbuf *dst;
   1468 	u_short total_len;
   1469 {
   1470 	register struct mbuf *m = dst;
   1471 
   1472 	while (total_len) {
   1473 		register u_short amount = min(total_len, M_TRAILINGSPACE(m));
   1474 
   1475 		if (amount == 0) {
   1476 		  /* no more data in this mbuf, alloc another */
   1477 			/*
   1478 			 * If there is enough data for an mbuf cluster, attempt
   1479 			 * 	to allocate one of those, otherwise, a regular
   1480 			 *	mbuf will do.
   1481 			 * Note that a regular mbuf is always required, even if
   1482 			 *	we get a cluster - getting a cluster does not
   1483 			 *	allocate any mbufs, and one is needed to assign
   1484 			 *	the cluster to. The mbuf that has a cluster
   1485 			 *	extension can not be used to contain data -
   1486 			 *	only the cluster can contain data.
   1487 			 */
   1488 			dst = m;
   1489 			MGET(m, M_DONTWAIT, MT_DATA);
   1490 			if (m == 0)
   1491 				return (0);
   1492 
   1493 			if (total_len >= MINCLSIZE)
   1494 				MCLGET(m, M_DONTWAIT);
   1495 
   1496 			m->m_len = 0;
   1497 			dst->m_next = m;
   1498 			amount = min(total_len, M_TRAILINGSPACE(m));
   1499 		}
   1500 
   1501 		src = ae_ring_copy(sc, src, mtod(m, caddr_t) + m->m_len,
   1502 				   amount);
   1503 
   1504 		m->m_len += amount;
   1505 		total_len -= amount;
   1506 
   1507 	}
   1508 	return (m);
   1509 }
   1510