xref: /dflybsd-src/sys/dev/netif/sn/if_sn.c (revision fda7d3889b1114d34ad3a52a7257a2b80fe24e4c)
1 /*
2  * Copyright (c) 1996 Gardner Buchanan <gbuchanan@shl.com>
3  * All rights reserved.
4  *
5  * Redistribution and use in source and binary forms, with or without
6  * modification, are permitted provided that the following conditions
7  * are met:
8  * 1. Redistributions of source code must retain the above copyright
9  *    notice, this list of conditions and the following disclaimer.
10  * 2. Redistributions in binary form must reproduce the above copyright
11  *    notice, this list of conditions and the following disclaimer in the
12  *    documentation and/or other materials provided with the distribution.
13  * 3. All advertising materials mentioning features or use of this software
14  *    must display the following acknowledgement:
15  *      This product includes software developed by Gardner Buchanan.
16  * 4. The name of Gardner Buchanan may not be used to endorse or promote
17  *    products derived from this software without specific prior written
18  *    permission.
19  *
20  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
21  * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
22  * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
23  * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
24  * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
25  * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
26  * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
27  * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
28  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
29  * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
30  *
31  *   $FreeBSD: src/sys/dev/sn/if_sn.c,v 1.7.2.3 2001/02/04 04:38:38 toshi Exp $
32  */
33 
34 /*
35  * This is a driver for SMC's 9000 series of Ethernet adapters.
36  *
37  * This FreeBSD driver is derived from the smc9194 Linux driver by
38  * Erik Stahlman and is Copyright (C) 1996 by Erik Stahlman.
39  * This driver also shamelessly borrows from the FreeBSD ep driver
40  * which is Copyright (C) 1994 Herb Peyerl <hpeyerl@novatel.ca>
41  * All rights reserved.
42  *
43  * It is set up for my SMC91C92 equipped Ampro LittleBoard embedded
44  * PC.  It is adapted from Erik Stahlman's Linux driver which worked
45  * with his EFA Info*Express SVC VLB adaptor.  According to SMC's databook,
46  * it will work for the entire SMC 9xxx series. (Ha Ha)
47  *
48  * "Features" of the SMC chip:
49  *   4608 byte packet memory. (for the 91C92.  Others have more)
50  *   EEPROM for configuration
51  *   AUI/TP selection
52  *
53  * Authors:
54  *      Erik Stahlman                   erik@vt.edu
55  *      Herb Peyerl                     hpeyerl@novatel.ca
56  *      Andres Vega Garcia              avega@sophia.inria.fr
57  *      Serge Babkin                    babkin@hq.icb.chel.su
58  *      Gardner Buchanan                gbuchanan@shl.com
59  *
60  * Sources:
61  *    o   SMC databook
62  *    o   "smc9194.c:v0.10(FIXED) 02/15/96 by Erik Stahlman (erik@vt.edu)"
63  *    o   "if_ep.c,v 1.19 1995/01/24 20:53:45 davidg Exp"
64  *
65  * Known Bugs:
66  *    o   The hardware multicast filter isn't used yet.
67  *    o   Setting of the hardware address isn't supported.
68  *    o   Hardware padding isn't used.
69  */
70 
71 /*
72  * Modifications for Megahertz X-Jack Ethernet Card (XJ-10BT)
73  *
74  * Copyright (c) 1996 by Tatsumi Hosokawa <hosokawa@jp.FreeBSD.org>
75  *                       BSD-nomads, Tokyo, Japan.
76  */
77 /*
78  * Multicast support by Kei TANAKA <kei@pal.xerox.com>
79  * Special thanks to itojun@itojun.org
80  */
81 
82 #undef	SN_DEBUG	/* (by hosokawa) */
83 
84 #include <sys/param.h>
85 #include <sys/systm.h>
86 #include <sys/kernel.h>
87 #include <sys/interrupt.h>
88 #include <sys/errno.h>
89 #include <sys/sockio.h>
90 #include <sys/malloc.h>
91 #include <sys/mbuf.h>
92 #include <sys/socket.h>
93 #include <sys/syslog.h>
94 #include <sys/serialize.h>
95 #include <sys/module.h>
96 #include <sys/bus.h>
97 #include <sys/rman.h>
98 #include <sys/thread2.h>
99 
100 #include <net/ethernet.h>
101 #include <net/if.h>
102 #include <net/ifq_var.h>
103 #include <net/if_arp.h>
104 #include <net/if_dl.h>
105 #include <net/if_types.h>
106 #include <net/if_mib.h>
107 
108 #ifdef INET
109 #include <netinet/in.h>
110 #include <netinet/in_systm.h>
111 #include <netinet/in_var.h>
112 #include <netinet/ip.h>
113 #endif
114 
115 #include <net/bpf.h>
116 #include <net/bpfdesc.h>
117 
118 #include <machine/clock.h>
119 
120 #include "if_snreg.h"
121 #include "if_snvar.h"
122 
123 /* Exported variables */
124 devclass_t sn_devclass;
125 
126 static int snioctl(struct ifnet * ifp, u_long, caddr_t, struct ucred *);
127 
128 static void snresume(struct ifnet *);
129 
130 void sninit(void *);
131 void snread(struct ifnet *);
132 void snreset(struct sn_softc *);
133 void snstart(struct ifnet *);
134 void snstop(struct sn_softc *);
135 void snwatchdog(struct ifnet *);
136 
137 static void sn_setmcast(struct sn_softc *);
138 static int sn_getmcf(struct arpcom *ac, u_char *mcf);
139 static u_int smc_crc(u_char *);
140 
141 DECLARE_DUMMY_MODULE(if_sn);
142 
143 /* I (GB) have been unlucky getting the hardware padding
144  * to work properly.
145  */
146 #define SW_PAD
147 
148 static const char *chip_ids[15] = {
149 	NULL, NULL, NULL,
150 	 /* 3 */ "SMC91C90/91C92",
151 	 /* 4 */ "SMC91C94",
152 	 /* 5 */ "SMC91C95",
153 	NULL,
154 	 /* 7 */ "SMC91C100",
155 	 /* 8 */ "SMC91C100FD",
156 	NULL, NULL, NULL,
157 	NULL, NULL, NULL
158 };
159 
160 int
161 sn_attach(device_t dev)
162 {
163 	struct sn_softc *sc = device_get_softc(dev);
164 	struct ifnet   *ifp = &sc->arpcom.ac_if;
165 	u_short         i;
166 	u_char         *p;
167 	int             rev;
168 	u_short         address;
169 	int		j;
170 	int		error;
171 
172 	sn_activate(dev);
173 
174 	snstop(sc);
175 
176 	sc->dev = dev;
177 	sc->pages_wanted = -1;
178 
179 	device_printf(dev, " ");
180 
181 	SMC_SELECT_BANK(3);
182 	rev = inw(BASE + REVISION_REG_W);
183 	if (chip_ids[(rev >> 4) & 0xF])
184 		kprintf("%s ", chip_ids[(rev >> 4) & 0xF]);
185 
186 	SMC_SELECT_BANK(1);
187 	i = inw(BASE + CONFIG_REG_W);
188 	kprintf("%s\n", i & CR_AUI_SELECT ? "AUI" : "UTP");
189 
190 	if (sc->pccard_enaddr)
191 		for (j = 0; j < 3; j++) {
192 			u_short	w;
193 
194 			w = (u_short)sc->arpcom.ac_enaddr[j * 2] |
195 				(((u_short)sc->arpcom.ac_enaddr[j * 2 + 1]) << 8);
196 			outw(BASE + IAR_ADDR0_REG_W + j * 2, w);
197 		}
198 
199 	/*
200 	 * Read the station address from the chip. The MAC address is bank 1,
201 	 * regs 4 - 9
202 	 */
203 	SMC_SELECT_BANK(1);
204 	p = (u_char *) & sc->arpcom.ac_enaddr;
205 	for (i = 0; i < 6; i += 2) {
206 		address = inw(BASE + IAR_ADDR0_REG_W + i);
207 		p[i + 1] = address >> 8;
208 		p[i] = address & 0xFF;
209 	}
210 	ifp->if_softc = sc;
211 	if_initname(ifp, "sn", device_get_unit(dev));
212 	ifp->if_mtu = ETHERMTU;
213 	ifp->if_flags = IFF_BROADCAST | IFF_SIMPLEX | IFF_MULTICAST;
214 	ifp->if_start = snstart;
215 	ifp->if_ioctl = snioctl;
216 	ifp->if_watchdog = snwatchdog;
217 	ifp->if_init = sninit;
218 	ifq_set_maxlen(&ifp->if_snd, IFQ_MAXLEN);
219 	ifq_set_ready(&ifp->if_snd);
220 	ifp->if_timer = 0;
221 
222 	ether_ifattach(ifp, sc->arpcom.ac_enaddr, NULL);
223 
224 	error = bus_setup_intr(dev, sc->irq_res, INTR_MPSAFE,
225 			       sn_intr, sc, &sc->intrhand,
226 			       ifp->if_serializer);
227 	if (error) {
228 		ether_ifdetach(ifp);
229 		sn_deactivate(dev);
230 		return error;
231 	}
232 
233 	ifp->if_cpuid = rman_get_cpuid(sc->irq_res);
234 	KKASSERT(ifp->if_cpuid >= 0 && ifp->if_cpuid < ncpus);
235 
236 	return 0;
237 }
238 
239 
240 /*
241  * Reset and initialize the chip
242  */
243 void
244 sninit(void *xsc)
245 {
246 	struct sn_softc *sc = xsc;
247 	struct ifnet *ifp = &sc->arpcom.ac_if;
248 	int             flags;
249 	int             mask;
250 
251 	/*
252 	 * This resets the registers mostly to defaults, but doesn't affect
253 	 * EEPROM.  After the reset cycle, we pause briefly for the chip to
254 	 * be happy.
255 	 */
256 	SMC_SELECT_BANK(0);
257 	outw(BASE + RECV_CONTROL_REG_W, RCR_SOFTRESET);
258 	SMC_DELAY();
259 	outw(BASE + RECV_CONTROL_REG_W, 0x0000);
260 	SMC_DELAY();
261 	SMC_DELAY();
262 
263 	outw(BASE + TXMIT_CONTROL_REG_W, 0x0000);
264 
265 	/*
266 	 * Set the control register to automatically release succesfully
267 	 * transmitted packets (making the best use out of our limited
268 	 * memory) and to enable the EPH interrupt on certain TX errors.
269 	 */
270 	SMC_SELECT_BANK(1);
271 	outw(BASE + CONTROL_REG_W, (CTR_AUTO_RELEASE | CTR_TE_ENABLE |
272 				    CTR_CR_ENABLE | CTR_LE_ENABLE));
273 
274 	/* Set squelch level to 240mV (default 480mV) */
275 	flags = inw(BASE + CONFIG_REG_W);
276 	flags |= CR_SET_SQLCH;
277 	outw(BASE + CONFIG_REG_W, flags);
278 
279 	/*
280 	 * Reset the MMU and wait for it to be un-busy.
281 	 */
282 	SMC_SELECT_BANK(2);
283 	outw(BASE + MMU_CMD_REG_W, MMUCR_RESET);
284 	while (inw(BASE + MMU_CMD_REG_W) & MMUCR_BUSY)	/* NOTHING */
285 		;
286 
287 	/*
288 	 * Disable all interrupts
289 	 */
290 	outb(BASE + INTR_MASK_REG_B, 0x00);
291 
292 	sn_setmcast(sc);
293 
294 	/*
295 	 * Set the transmitter control.  We want it enabled.
296 	 */
297 	flags = TCR_ENABLE;
298 
299 #ifndef SW_PAD
300 	/*
301 	 * I (GB) have been unlucky getting this to work.
302 	 */
303 	flags |= TCR_PAD_ENABLE;
304 #endif	/* SW_PAD */
305 
306 	outw(BASE + TXMIT_CONTROL_REG_W, flags);
307 
308 
309 	/*
310 	 * Now, enable interrupts
311 	 */
312 	SMC_SELECT_BANK(2);
313 
314 	mask = IM_EPH_INT |
315 		IM_RX_OVRN_INT |
316 		IM_RCV_INT |
317 		IM_TX_INT;
318 
319 	outb(BASE + INTR_MASK_REG_B, mask);
320 	sc->intr_mask = mask;
321 	sc->pages_wanted = -1;
322 
323 
324 	/*
325 	 * Mark the interface running but not active.
326 	 */
327 	ifp->if_flags |= IFF_RUNNING;
328 	ifp->if_flags &= ~IFF_OACTIVE;
329 
330 	/*
331 	 * Attempt to push out any waiting packets.
332 	 */
333 	if_devstart(ifp);
334 }
335 
336 
337 void
338 snstart(struct ifnet *ifp)
339 {
340 	struct sn_softc *sc = ifp->if_softc;
341 	u_int  len;
342 	struct mbuf *m;
343 	struct mbuf    *top;
344 	int             pad;
345 	int             mask;
346 	u_short         length;
347 	u_short         numPages;
348 	u_char          packet_no;
349 	int             time_out;
350 
351 	if ((ifp->if_flags & (IFF_OACTIVE | IFF_RUNNING)) != IFF_RUNNING)
352 		return;
353 
354 	if (sc->pages_wanted != -1) {
355 		/* XXX should never happen */
356 		kprintf("%s: snstart() while memory allocation pending\n",
357 		       ifp->if_xname);
358 		ifp->if_flags |= IFF_OACTIVE;
359 		return;
360 	}
361 startagain:
362 
363 	/*
364 	 * Sneak a peek at the next packet
365 	 */
366 	m = ifq_dequeue(&ifp->if_snd, NULL);
367 	if (m == NULL)
368 		return;
369 
370 	/*
371 	 * Compute the frame length and set pad to give an overall even
372 	 * number of bytes.  Below we assume that the packet length is even.
373 	 */
374 	for (len = 0, top = m; m; m = m->m_next)
375 		len += m->m_len;
376 
377 	pad = (len & 1);
378 
379 	/*
380 	 * We drop packets that are too large. Perhaps we should truncate
381 	 * them instead?
382 	 */
383 	if (len + pad > ETHER_MAX_LEN - ETHER_CRC_LEN) {
384 		kprintf("%s: large packet discarded (A)\n", ifp->if_xname);
385 		++sc->arpcom.ac_if.if_oerrors;
386 		m_freem(top);
387 		goto readcheck;
388 	}
389 #ifdef SW_PAD
390 
391 	/*
392 	 * If HW padding is not turned on, then pad to ETHER_MIN_LEN.
393 	 */
394 	if (len < ETHER_MIN_LEN - ETHER_CRC_LEN)
395 		pad = ETHER_MIN_LEN - ETHER_CRC_LEN - len;
396 
397 #endif	/* SW_PAD */
398 
399 	length = pad + len;
400 
401 	/*
402 	 * The MMU wants the number of pages to be the number of 256 byte
403 	 * 'pages', minus 1 (A packet can't ever have 0 pages. We also
404 	 * include space for the status word, byte count and control bytes in
405 	 * the allocation request.
406 	 */
407 	numPages = (length + 6) >> 8;
408 
409 
410 	/*
411 	 * Now, try to allocate the memory
412 	 */
413 	SMC_SELECT_BANK(2);
414 	outw(BASE + MMU_CMD_REG_W, MMUCR_ALLOC | numPages);
415 
416 	/*
417 	 * Wait a short amount of time to see if the allocation request
418 	 * completes.  Otherwise, I enable the interrupt and wait for
419 	 * completion asyncronously.
420 	 */
421 
422 	time_out = MEMORY_WAIT_TIME;
423 	do {
424 		if (inb(BASE + INTR_STAT_REG_B) & IM_ALLOC_INT)
425 			break;
426 	} while (--time_out);
427 
428 	if (!time_out) {
429 
430 		/*
431 		 * No memory now.  Oh well, wait until the chip finds memory
432 		 * later.   Remember how many pages we were asking for and
433 		 * enable the allocation completion interrupt. Also set a
434 		 * watchdog in case  we miss the interrupt. We mark the
435 		 * interface active since there is no point in attempting an
436 		 * snstart() until after the memory is available.
437 		 */
438 		mask = inb(BASE + INTR_MASK_REG_B) | IM_ALLOC_INT;
439 		outb(BASE + INTR_MASK_REG_B, mask);
440 		sc->intr_mask = mask;
441 
442 		ifp->if_timer = 1;
443 		ifp->if_flags |= IFF_OACTIVE;
444 		sc->pages_wanted = numPages;
445 		ifq_prepend(&ifp->if_snd, top);
446 
447 		return;
448 	}
449 	/*
450 	 * The memory allocation completed.  Check the results.
451 	 */
452 	packet_no = inb(BASE + ALLOC_RESULT_REG_B);
453 	if (packet_no & ARR_FAILED) {
454 		kprintf("%s: Memory allocation failed\n", ifp->if_xname);
455 		ifq_prepend(&ifp->if_snd, top);
456 		goto startagain;
457 	}
458 	/*
459 	 * We have a packet number, so tell the card to use it.
460 	 */
461 	outb(BASE + PACKET_NUM_REG_B, packet_no);
462 
463 	/*
464 	 * Point to the beginning of the packet
465 	 */
466 	outw(BASE + POINTER_REG_W, PTR_AUTOINC | 0x0000);
467 
468 	/*
469 	 * Send the packet length (+6 for status, length and control byte)
470 	 * and the status word (set to zeros)
471 	 */
472 	outw(BASE + DATA_REG_W, 0);
473 	outb(BASE + DATA_REG_B, (length + 6) & 0xFF);
474 	outb(BASE + DATA_REG_B, (length + 6) >> 8);
475 
476 	/*
477 	 * Push out the data to the card.
478 	 */
479 	for (m = top; m != NULL; m = m->m_next) {
480 
481 		/*
482 		 * Push out words.
483 		 */
484 		outsw(BASE + DATA_REG_W, mtod(m, caddr_t), m->m_len / 2);
485 
486 		/*
487 		 * Push out remaining byte.
488 		 */
489 		if (m->m_len & 1)
490 			outb(BASE + DATA_REG_B, *(mtod(m, caddr_t) + m->m_len - 1));
491 	}
492 
493 	/*
494 	 * Push out padding.
495 	 */
496 	while (pad > 1) {
497 		outw(BASE + DATA_REG_W, 0);
498 		pad -= 2;
499 	}
500 	if (pad)
501 		outb(BASE + DATA_REG_B, 0);
502 
503 	/*
504 	 * Push out control byte and unused packet byte The control byte is 0
505 	 * meaning the packet is even lengthed and no special CRC handling is
506 	 * desired.
507 	 */
508 	outw(BASE + DATA_REG_W, 0);
509 
510 	/*
511 	 * Enable the interrupts and let the chipset deal with it Also set a
512 	 * watchdog in case we miss the interrupt.
513 	 */
514 	mask = inb(BASE + INTR_MASK_REG_B) | (IM_TX_INT | IM_TX_EMPTY_INT);
515 	outb(BASE + INTR_MASK_REG_B, mask);
516 	sc->intr_mask = mask;
517 
518 	outw(BASE + MMU_CMD_REG_W, MMUCR_ENQUEUE);
519 
520 	ifp->if_flags |= IFF_OACTIVE;
521 	ifp->if_timer = 1;
522 
523 	BPF_MTAP(ifp, top);
524 
525 	ifp->if_opackets++;
526 	m_freem(top);
527 
528 readcheck:
529 
530 	/*
531 	 * Is another packet coming in?  We don't want to overflow the tiny
532 	 * RX FIFO.  If nothing has arrived then attempt to queue another
533 	 * transmit packet.
534 	 */
535 	if (inw(BASE + FIFO_PORTS_REG_W) & FIFO_REMPTY)
536 		goto startagain;
537 }
538 
539 
540 
541 /* Resume a packet transmit operation after a memory allocation
542  * has completed.
543  *
544  * This is basically a hacked up copy of snstart() which handles
545  * a completed memory allocation the same way snstart() does.
546  * It then passes control to snstart to handle any other queued
547  * packets.
548  */
549 static void
550 snresume(struct ifnet *ifp)
551 {
552 	struct sn_softc *sc = ifp->if_softc;
553 	u_int  len;
554 	struct mbuf *m;
555 	struct mbuf    *top;
556 	int             pad;
557 	int             mask;
558 	u_short         length;
559 	u_short         numPages;
560 	u_short         pages_wanted;
561 	u_char          packet_no;
562 
563 	if (sc->pages_wanted < 0)
564 		return;
565 
566 	pages_wanted = sc->pages_wanted;
567 	sc->pages_wanted = -1;
568 
569 	/*
570 	 * Sneak a peek at the next packet
571 	 */
572 	m = ifq_dequeue(&ifp->if_snd, NULL);
573 	if (m == NULL) {
574 		kprintf("%s: snresume() with nothing to send\n",
575 			ifp->if_xname);
576 		return;
577 	}
578 
579 	/*
580 	 * Compute the frame length and set pad to give an overall even
581 	 * number of bytes.  Below we assume that the packet length is even.
582 	 */
583 	for (len = 0, top = m; m; m = m->m_next)
584 		len += m->m_len;
585 
586 	pad = (len & 1);
587 
588 	/*
589 	 * We drop packets that are too large. Perhaps we should truncate
590 	 * them instead?
591 	 */
592 	if (len + pad > ETHER_MAX_LEN - ETHER_CRC_LEN) {
593 		kprintf("%s: large packet discarded (B)\n", ifp->if_xname);
594 		++ifp->if_oerrors;
595 		m_freem(top);
596 		return;
597 	}
598 #ifdef SW_PAD
599 
600 	/*
601 	 * If HW padding is not turned on, then pad to ETHER_MIN_LEN.
602 	 */
603 	if (len < ETHER_MIN_LEN - ETHER_CRC_LEN)
604 		pad = ETHER_MIN_LEN - ETHER_CRC_LEN - len;
605 
606 #endif	/* SW_PAD */
607 
608 	length = pad + len;
609 
610 
611 	/*
612 	 * The MMU wants the number of pages to be the number of 256 byte
613 	 * 'pages', minus 1 (A packet can't ever have 0 pages. We also
614 	 * include space for the status word, byte count and control bytes in
615 	 * the allocation request.
616 	 */
617 	numPages = (length + 6) >> 8;
618 
619 
620 	SMC_SELECT_BANK(2);
621 
622 	/*
623 	 * The memory allocation completed.  Check the results. If it failed,
624 	 * we simply set a watchdog timer and hope for the best.
625 	 */
626 	packet_no = inb(BASE + ALLOC_RESULT_REG_B);
627 	if (packet_no & ARR_FAILED) {
628 		kprintf("%s: Memory allocation failed.  Weird.\n", ifp->if_xname);
629 		ifp->if_timer = 1;
630 		ifq_prepend(&ifp->if_snd, top);
631 		goto try_start;
632 	}
633 	/*
634 	 * We have a packet number, so tell the card to use it.
635 	 */
636 	outb(BASE + PACKET_NUM_REG_B, packet_no);
637 
638 	/*
639 	 * Now, numPages should match the pages_wanted recorded when the
640 	 * memory allocation was initiated.
641 	 */
642 	if (pages_wanted != numPages) {
643 		kprintf("%s: memory allocation wrong size.  Weird.\n", ifp->if_xname);
644 		/*
645 		 * If the allocation was the wrong size we simply release the
646 		 * memory once it is granted. Wait for the MMU to be un-busy.
647 		 */
648 		while (inw(BASE + MMU_CMD_REG_W) & MMUCR_BUSY)	/* NOTHING */
649 			;
650 		outw(BASE + MMU_CMD_REG_W, MMUCR_FREEPKT);
651 
652 		ifq_prepend(&ifp->if_snd, top);
653 		return;
654 	}
655 	/*
656 	 * Point to the beginning of the packet
657 	 */
658 	outw(BASE + POINTER_REG_W, PTR_AUTOINC | 0x0000);
659 
660 	/*
661 	 * Send the packet length (+6 for status, length and control byte)
662 	 * and the status word (set to zeros)
663 	 */
664 	outw(BASE + DATA_REG_W, 0);
665 	outb(BASE + DATA_REG_B, (length + 6) & 0xFF);
666 	outb(BASE + DATA_REG_B, (length + 6) >> 8);
667 
668 	/*
669 	 * Push out the data to the card.
670 	 */
671 	for (m = top; m != NULL; m = m->m_next) {
672 
673 		/*
674 		 * Push out words.
675 		 */
676 		outsw(BASE + DATA_REG_W, mtod(m, caddr_t), m->m_len / 2);
677 
678 		/*
679 		 * Push out remaining byte.
680 		 */
681 		if (m->m_len & 1)
682 			outb(BASE + DATA_REG_B, *(mtod(m, caddr_t) + m->m_len - 1));
683 	}
684 
685 	/*
686 	 * Push out padding.
687 	 */
688 	while (pad > 1) {
689 		outw(BASE + DATA_REG_W, 0);
690 		pad -= 2;
691 	}
692 	if (pad)
693 		outb(BASE + DATA_REG_B, 0);
694 
695 	/*
696 	 * Push out control byte and unused packet byte The control byte is 0
697 	 * meaning the packet is even lengthed and no special CRC handling is
698 	 * desired.
699 	 */
700 	outw(BASE + DATA_REG_W, 0);
701 
702 	/*
703 	 * Enable the interrupts and let the chipset deal with it Also set a
704 	 * watchdog in case we miss the interrupt.
705 	 */
706 	mask = inb(BASE + INTR_MASK_REG_B) | (IM_TX_INT | IM_TX_EMPTY_INT);
707 	outb(BASE + INTR_MASK_REG_B, mask);
708 	sc->intr_mask = mask;
709 	outw(BASE + MMU_CMD_REG_W, MMUCR_ENQUEUE);
710 
711 	BPF_MTAP(ifp, top);
712 
713 	ifp->if_opackets++;
714 	m_freem(top);
715 
716 try_start:
717 
718 	/*
719 	 * Now pass control to snstart() to queue any additional packets
720 	 */
721 	ifp->if_flags &= ~IFF_OACTIVE;
722 	if_devstart(ifp);
723 
724 	/*
725 	 * We've sent something, so we're active.  Set a watchdog in case the
726 	 * TX_EMPTY interrupt is lost.
727 	 */
728 	ifp->if_flags |= IFF_OACTIVE;
729 	ifp->if_timer = 1;
730 }
731 
732 
733 void
734 sn_intr(void *arg)
735 {
736 	int             status, interrupts;
737 	struct sn_softc *sc = (struct sn_softc *) arg;
738 	struct ifnet   *ifp = &sc->arpcom.ac_if;
739 
740 	/*
741 	 * Chip state registers
742 	 */
743 	u_char          mask;
744 	u_char          packet_no;
745 	u_short         tx_status;
746 	u_short         card_stats;
747 
748 	/*
749 	 * Clear the watchdog.
750 	 */
751 	ifp->if_timer = 0;
752 
753 	SMC_SELECT_BANK(2);
754 
755 	/*
756 	 * Obtain the current interrupt mask and clear the hardware mask
757 	 * while servicing interrupts.
758 	 */
759 	mask = inb(BASE + INTR_MASK_REG_B);
760 	outb(BASE + INTR_MASK_REG_B, 0x00);
761 
762 	/*
763 	 * Get the set of interrupts which occurred and eliminate any which
764 	 * are masked.
765 	 */
766 	interrupts = inb(BASE + INTR_STAT_REG_B);
767 	status = interrupts & mask;
768 
769 	/*
770 	 * Now, process each of the interrupt types.
771 	 */
772 
773 	/*
774 	 * Receive Overrun.
775 	 */
776 	if (status & IM_RX_OVRN_INT) {
777 
778 		/*
779 		 * Acknowlege Interrupt
780 		 */
781 		SMC_SELECT_BANK(2);
782 		outb(BASE + INTR_ACK_REG_B, IM_RX_OVRN_INT);
783 
784 		++sc->arpcom.ac_if.if_ierrors;
785 	}
786 	/*
787 	 * Got a packet.
788 	 */
789 	if (status & IM_RCV_INT) {
790 #if 1
791 		int             packet_number;
792 
793 		SMC_SELECT_BANK(2);
794 		packet_number = inw(BASE + FIFO_PORTS_REG_W);
795 
796 		if (packet_number & FIFO_REMPTY) {
797 
798 			/*
799 			 * we got called , but nothing was on the FIFO
800 			 */
801 			kprintf("sn: Receive interrupt with nothing on FIFO\n");
802 
803 			goto out;
804 		}
805 #endif
806 		snread(ifp);
807 	}
808 	/*
809 	 * An on-card memory allocation came through.
810 	 */
811 	if (status & IM_ALLOC_INT) {
812 
813 		/*
814 		 * Disable this interrupt.
815 		 */
816 		mask &= ~IM_ALLOC_INT;
817 		sc->arpcom.ac_if.if_flags &= ~IFF_OACTIVE;
818 		snresume(&sc->arpcom.ac_if);
819 	}
820 	/*
821 	 * TX Completion.  Handle a transmit error message. This will only be
822 	 * called when there is an error, because of the AUTO_RELEASE mode.
823 	 */
824 	if (status & IM_TX_INT) {
825 
826 		/*
827 		 * Acknowlege Interrupt
828 		 */
829 		SMC_SELECT_BANK(2);
830 		outb(BASE + INTR_ACK_REG_B, IM_TX_INT);
831 
832 		packet_no = inw(BASE + FIFO_PORTS_REG_W);
833 		packet_no &= FIFO_TX_MASK;
834 
835 		/*
836 		 * select this as the packet to read from
837 		 */
838 		outb(BASE + PACKET_NUM_REG_B, packet_no);
839 
840 		/*
841 		 * Position the pointer to the first word from this packet
842 		 */
843 		outw(BASE + POINTER_REG_W, PTR_AUTOINC | PTR_READ | 0x0000);
844 
845 		/*
846 		 * Fetch the TX status word.  The value found here will be a
847 		 * copy of the EPH_STATUS_REG_W at the time the transmit
848 		 * failed.
849 		 */
850 		tx_status = inw(BASE + DATA_REG_W);
851 
852 		if (tx_status & EPHSR_TX_SUC) {
853 			device_printf(sc->dev,
854 			    "Successful packet caused interrupt\n");
855 		} else {
856 			++sc->arpcom.ac_if.if_oerrors;
857 		}
858 
859 		if (tx_status & EPHSR_LATCOL)
860 			++sc->arpcom.ac_if.if_collisions;
861 
862 		/*
863 		 * Some of these errors will have disabled transmit.
864 		 * Re-enable transmit now.
865 		 */
866 		SMC_SELECT_BANK(0);
867 
868 #ifdef SW_PAD
869 		outw(BASE + TXMIT_CONTROL_REG_W, TCR_ENABLE);
870 #else
871 		outw(BASE + TXMIT_CONTROL_REG_W, TCR_ENABLE | TCR_PAD_ENABLE);
872 #endif	/* SW_PAD */
873 
874 		/*
875 		 * kill the failed packet. Wait for the MMU to be un-busy.
876 		 */
877 		SMC_SELECT_BANK(2);
878 		while (inw(BASE + MMU_CMD_REG_W) & MMUCR_BUSY)	/* NOTHING */
879 			;
880 		outw(BASE + MMU_CMD_REG_W, MMUCR_FREEPKT);
881 
882 		/*
883 		 * Attempt to queue more transmits.
884 		 */
885 		sc->arpcom.ac_if.if_flags &= ~IFF_OACTIVE;
886 		if_devstart(&sc->arpcom.ac_if);
887 	}
888 	/*
889 	 * Transmit underrun.  We use this opportunity to update transmit
890 	 * statistics from the card.
891 	 */
892 	if (status & IM_TX_EMPTY_INT) {
893 
894 		/*
895 		 * Acknowlege Interrupt
896 		 */
897 		SMC_SELECT_BANK(2);
898 		outb(BASE + INTR_ACK_REG_B, IM_TX_EMPTY_INT);
899 
900 		/*
901 		 * Disable this interrupt.
902 		 */
903 		mask &= ~IM_TX_EMPTY_INT;
904 
905 		SMC_SELECT_BANK(0);
906 		card_stats = inw(BASE + COUNTER_REG_W);
907 
908 		/*
909 		 * Single collisions
910 		 */
911 		sc->arpcom.ac_if.if_collisions += card_stats & ECR_COLN_MASK;
912 
913 		/*
914 		 * Multiple collisions
915 		 */
916 		sc->arpcom.ac_if.if_collisions += (card_stats & ECR_MCOLN_MASK) >> 4;
917 
918 		SMC_SELECT_BANK(2);
919 
920 		/*
921 		 * Attempt to enqueue some more stuff.
922 		 */
923 		sc->arpcom.ac_if.if_flags &= ~IFF_OACTIVE;
924 		if_devstart(&sc->arpcom.ac_if);
925 	}
926 	/*
927 	 * Some other error.  Try to fix it by resetting the adapter.
928 	 */
929 	if (status & IM_EPH_INT) {
930 		snstop(sc);
931 		sninit(sc);
932 	}
933 
934 out:
935 	/*
936 	 * Handled all interrupt sources.
937 	 */
938 
939 	SMC_SELECT_BANK(2);
940 
941 	/*
942 	 * Reestablish interrupts from mask which have not been deselected
943 	 * during this interrupt.  Note that the hardware mask, which was set
944 	 * to 0x00 at the start of this service routine, may have been
945 	 * updated by one or more of the interrupt handers and we must let
946 	 * those new interrupts stay enabled here.
947 	 */
948 	mask |= inb(BASE + INTR_MASK_REG_B);
949 	outb(BASE + INTR_MASK_REG_B, mask);
950 	sc->intr_mask = mask;
951 }
952 
953 void
954 snread(struct ifnet *ifp)
955 {
956         struct sn_softc *sc = ifp->if_softc;
957 	struct mbuf    *m;
958 	short           status;
959 	int             packet_number;
960 	u_short         packet_length;
961 	u_char         *data;
962 
963 	SMC_SELECT_BANK(2);
964 #if 0
965 	packet_number = inw(BASE + FIFO_PORTS_REG_W);
966 
967 	if (packet_number & FIFO_REMPTY) {
968 
969 		/*
970 		 * we got called , but nothing was on the FIFO
971 		 */
972 		kprintf("sn: Receive interrupt with nothing on FIFO\n");
973 		return;
974 	}
975 #endif
976 read_another:
977 
978 	/*
979 	 * Start reading from the start of the packet. Since PTR_RCV is set,
980 	 * packet number is found in FIFO_PORTS_REG_W, FIFO_RX_MASK.
981 	 */
982 	outw(BASE + POINTER_REG_W, PTR_READ | PTR_RCV | PTR_AUTOINC | 0x0000);
983 
984 	/*
985 	 * First two words are status and packet_length
986 	 */
987 	status = inw(BASE + DATA_REG_W);
988 	packet_length = inw(BASE + DATA_REG_W) & RLEN_MASK;
989 
990 	/*
991 	 * The packet length contains 3 extra words: status, length, and a
992 	 * extra word with the control byte.
993 	 */
994 	packet_length -= 6;
995 
996 	/*
997 	 * Account for receive errors and discard.
998 	 */
999 	if (status & RS_ERRORS) {
1000 		++ifp->if_ierrors;
1001 		goto out;
1002 	}
1003 	/*
1004 	 * A packet is received.
1005 	 */
1006 
1007 	/*
1008 	 * Adjust for odd-length packet.
1009 	 */
1010 	if (status & RS_ODDFRAME)
1011 		packet_length++;
1012 
1013 	/*
1014 	 * Allocate a header mbuf from the kernel.
1015 	 */
1016 	MGETHDR(m, MB_DONTWAIT, MT_DATA);
1017 	if (m == NULL)
1018 		goto out;
1019 
1020 	m->m_pkthdr.rcvif = ifp;
1021 	m->m_pkthdr.len = m->m_len = packet_length;
1022 
1023 	/*
1024 	 * Attach an mbuf cluster
1025 	 */
1026 	MCLGET(m, MB_DONTWAIT);
1027 
1028 	/*
1029 	 * Insist on getting a cluster
1030 	 */
1031 	if ((m->m_flags & M_EXT) == 0) {
1032 		m_freem(m);
1033 		++ifp->if_ierrors;
1034 		kprintf("sn: snread() kernel memory allocation problem\n");
1035 		goto out;
1036 	}
1037 
1038 	/*
1039 	 * Get packet, including link layer address, from interface.
1040 	 */
1041 
1042 	data = mtod(m, u_char *);
1043 	insw(BASE + DATA_REG_W, data, packet_length >> 1);
1044 	if (packet_length & 1) {
1045 		data += packet_length & ~1;
1046 		*data = inb(BASE + DATA_REG_B);
1047 	}
1048 	++ifp->if_ipackets;
1049 
1050 	m->m_pkthdr.len = m->m_len = packet_length;
1051 
1052 	ifp->if_input(ifp, m);
1053 
1054 out:
1055 
1056 	/*
1057 	 * Error or good, tell the card to get rid of this packet Wait for
1058 	 * the MMU to be un-busy.
1059 	 */
1060 	SMC_SELECT_BANK(2);
1061 	while (inw(BASE + MMU_CMD_REG_W) & MMUCR_BUSY)	/* NOTHING */
1062 		;
1063 	outw(BASE + MMU_CMD_REG_W, MMUCR_RELEASE);
1064 
1065 	/*
1066 	 * Check whether another packet is ready
1067 	 */
1068 	packet_number = inw(BASE + FIFO_PORTS_REG_W);
1069 	if (packet_number & FIFO_REMPTY) {
1070 		return;
1071 	}
1072 	goto read_another;
1073 }
1074 
1075 
1076 /*
1077  * Handle IOCTLS.  This function is completely stolen from if_ep.c
1078  * As with its progenitor, it does not handle hardware address
1079  * changes.
1080  */
1081 static int
1082 snioctl(struct ifnet *ifp, u_long cmd, caddr_t data, struct ucred *cr)
1083 {
1084 	struct sn_softc *sc = ifp->if_softc;
1085 	int error = 0;
1086 
1087 	switch (cmd) {
1088 	case SIOCSIFFLAGS:
1089 		if ((ifp->if_flags & IFF_UP) == 0 && ifp->if_flags & IFF_RUNNING) {
1090 			ifp->if_flags &= ~IFF_RUNNING;
1091 			snstop(sc);
1092 			break;
1093 		} else {
1094 			/* reinitialize card on any parameter change */
1095 			sninit(sc);
1096 			break;
1097 		}
1098 		break;
1099 
1100 #ifdef notdef
1101 	case SIOCGHWADDR:
1102 		bcopy((caddr_t) sc->sc_addr, (caddr_t) & ifr->ifr_data,
1103 		      sizeof(sc->sc_addr));
1104 		break;
1105 #endif
1106 
1107 	case SIOCADDMULTI:
1108 	    /* update multicast filter list. */
1109 	    sn_setmcast(sc);
1110 	    error = 0;
1111 	    break;
1112 	case SIOCDELMULTI:
1113 	    /* update multicast filter list. */
1114 	    sn_setmcast(sc);
1115 	    error = 0;
1116 	    break;
1117 	default:
1118 		error = ether_ioctl(ifp, cmd, data);
1119 		break;
1120 	}
1121 
1122 	return (error);
1123 }
1124 
1125 void
1126 snreset(struct sn_softc *sc)
1127 {
1128 	snstop(sc);
1129 	sninit(sc);
1130 }
1131 
1132 void
1133 snwatchdog(struct ifnet *ifp)
1134 {
1135 	sn_intr(ifp->if_softc);
1136 }
1137 
1138 
1139 /* 1. zero the interrupt mask
1140  * 2. clear the enable receive flag
1141  * 3. clear the enable xmit flags
1142  */
1143 void
1144 snstop(struct sn_softc *sc)
1145 {
1146 
1147 	struct ifnet   *ifp = &sc->arpcom.ac_if;
1148 
1149 	/*
1150 	 * Clear interrupt mask; disable all interrupts.
1151 	 */
1152 	SMC_SELECT_BANK(2);
1153 	outb(BASE + INTR_MASK_REG_B, 0x00);
1154 
1155 	/*
1156 	 * Disable transmitter and Receiver
1157 	 */
1158 	SMC_SELECT_BANK(0);
1159 	outw(BASE + RECV_CONTROL_REG_W, 0x0000);
1160 	outw(BASE + TXMIT_CONTROL_REG_W, 0x0000);
1161 
1162 	/*
1163 	 * Cancel watchdog.
1164 	 */
1165 	ifp->if_timer = 0;
1166 }
1167 
1168 
1169 int
1170 sn_activate(device_t dev)
1171 {
1172 	struct sn_softc *sc = device_get_softc(dev);
1173 
1174 	sc->port_rid = 0;
1175 	sc->port_res = bus_alloc_resource(dev, SYS_RES_IOPORT, &sc->port_rid,
1176 	    0, ~0, SMC_IO_EXTENT, RF_ACTIVE);
1177 	if (!sc->port_res) {
1178 #ifdef SN_DEBUG
1179 		device_printf(dev, "Cannot allocate ioport\n");
1180 #endif
1181 		return ENOMEM;
1182 	}
1183 
1184 	sc->irq_rid = 0;
1185 	sc->irq_res = bus_alloc_resource_any(dev, SYS_RES_IRQ, &sc->irq_rid,
1186 	    RF_ACTIVE);
1187 	if (!sc->irq_res) {
1188 #ifdef SN_DEBUG
1189 		device_printf(dev, "Cannot allocate irq\n");
1190 #endif
1191 		sn_deactivate(dev);
1192 		return ENOMEM;
1193 	}
1194 
1195 	sc->sn_io_addr = rman_get_start(sc->port_res);
1196 	return (0);
1197 }
1198 
1199 void
1200 sn_deactivate(device_t dev)
1201 {
1202 	struct sn_softc *sc = device_get_softc(dev);
1203 
1204 	if (sc->port_res)
1205 		bus_release_resource(dev, SYS_RES_IOPORT, sc->port_rid,
1206 		    sc->port_res);
1207 	sc->port_res = 0;
1208 	if (sc->irq_res)
1209 		bus_release_resource(dev, SYS_RES_IRQ, sc->irq_rid,
1210 		    sc->irq_res);
1211 	sc->irq_res = 0;
1212 	return;
1213 }
1214 
1215 /*
1216  * Function: sn_probe( device_t dev, int pccard )
1217  *
1218  * Purpose:
1219  *      Tests to see if a given ioaddr points to an SMC9xxx chip.
1220  *      Tries to cause as little damage as possible if it's not a SMC chip.
1221  *      Returns a 0 on success
1222  *
1223  * Algorithm:
1224  *      (1) see if the high byte of BANK_SELECT is 0x33
1225  *      (2) compare the ioaddr with the base register's address
1226  *      (3) see if I recognize the chip ID in the appropriate register
1227  *
1228  *
1229  */
1230 int
1231 sn_probe(device_t dev, int pccard)
1232 {
1233 	struct sn_softc *sc = device_get_softc(dev);
1234 	u_int           bank;
1235 	u_short         revision_register;
1236 	u_short         base_address_register;
1237 	u_short		ioaddr;
1238 	int		err;
1239 
1240 	if ((err = sn_activate(dev)) != 0)
1241 		return err;
1242 
1243 	ioaddr = sc->sn_io_addr;
1244 
1245 	/*
1246 	 * First, see if the high byte is 0x33
1247 	 */
1248 	bank = inw(ioaddr + BANK_SELECT_REG_W);
1249 	if ((bank & BSR_DETECT_MASK) != BSR_DETECT_VALUE) {
1250 #ifdef	SN_DEBUG
1251 		device_printf(dev, "test1 failed\n");
1252 #endif
1253 		goto error;
1254 	}
1255 	/*
1256 	 * The above MIGHT indicate a device, but I need to write to further
1257 	 * test this.  Go to bank 0, then test that the register still
1258 	 * reports the high byte is 0x33.
1259 	 */
1260 	outw(ioaddr + BANK_SELECT_REG_W, 0x0000);
1261 	bank = inw(ioaddr + BANK_SELECT_REG_W);
1262 	if ((bank & BSR_DETECT_MASK) != BSR_DETECT_VALUE) {
1263 #ifdef	SN_DEBUG
1264 		device_printf(dev, "test2 failed\n");
1265 #endif
1266 		goto error;
1267 	}
1268 	/*
1269 	 * well, we've already written once, so hopefully another time won't
1270 	 * hurt.  This time, I need to switch the bank register to bank 1, so
1271 	 * I can access the base address register.  The contents of the
1272 	 * BASE_ADDR_REG_W register, after some jiggery pokery, is expected
1273 	 * to match the I/O port address where the adapter is being probed.
1274 	 */
1275 	outw(ioaddr + BANK_SELECT_REG_W, 0x0001);
1276 	base_address_register = inw(ioaddr + BASE_ADDR_REG_W);
1277 
1278 	/*
1279 	 * This test is nonsence on PC-card architecture, so if
1280 	 * pccard == 1, skip this test. (hosokawa)
1281 	 */
1282 	if (!pccard && (ioaddr != (base_address_register >> 3 & 0x3E0))) {
1283 
1284 		/*
1285 		 * Well, the base address register didn't match.  Must not
1286 		 * have been a SMC chip after all.
1287 		 */
1288 		/*
1289 		 * kprintf("sn: ioaddr %x doesn't match card configuration
1290 		 * (%x)\n", ioaddr, base_address_register >> 3 & 0x3E0 );
1291 		 */
1292 
1293 #ifdef	SN_DEBUG
1294 		device_printf(dev, "test3 failed ioaddr = 0x%x, "
1295 		    "base_address_register = 0x%x\n", ioaddr,
1296 		    base_address_register >> 3 & 0x3E0);
1297 #endif
1298 		goto error;
1299 	}
1300 	/*
1301 	 * Check if the revision register is something that I recognize.
1302 	 * These might need to be added to later, as future revisions could
1303 	 * be added.
1304 	 */
1305 	outw(ioaddr + BANK_SELECT_REG_W, 0x3);
1306 	revision_register = inw(ioaddr + REVISION_REG_W);
1307 	if (!chip_ids[(revision_register >> 4) & 0xF]) {
1308 
1309 		/*
1310 		 * I don't regonize this chip, so...
1311 		 */
1312 #ifdef	SN_DEBUG
1313 		device_printf(dev, "test4 failed\n");
1314 #endif
1315 		goto error;
1316 	}
1317 	/*
1318 	 * at this point I'll assume that the chip is an SMC9xxx. It might be
1319 	 * prudent to check a listing of MAC addresses against the hardware
1320 	 * address, or do some other tests.
1321 	 */
1322 	sn_deactivate(dev);
1323 	return 0;
1324  error:
1325 	sn_deactivate(dev);
1326 	return ENXIO;
1327 }
1328 
1329 #define MCFSZ 8
1330 
1331 static void
1332 sn_setmcast(struct sn_softc *sc)
1333 {
1334 	struct ifnet *ifp = (struct ifnet *)sc;
1335 	int flags;
1336 
1337 	/*
1338 	 * Set the receiver filter.  We want receive enabled and auto strip
1339 	 * of CRC from received packet.  If we are promiscuous then set that
1340 	 * bit too.
1341 	 */
1342 	flags = RCR_ENABLE | RCR_STRIP_CRC;
1343 
1344 	if (ifp->if_flags & IFF_PROMISC) {
1345 		flags |= RCR_PROMISC | RCR_ALMUL;
1346 	} else if (ifp->if_flags & IFF_ALLMULTI) {
1347 		flags |= RCR_ALMUL;
1348 	} else {
1349 		u_char mcf[MCFSZ];
1350 		if (sn_getmcf(&sc->arpcom, mcf)) {
1351 			/* set filter */
1352 			SMC_SELECT_BANK(3);
1353 			outw(BASE + MULTICAST1_REG_W,
1354 			    ((u_short)mcf[1] << 8) |  mcf[0]);
1355 			outw(BASE + MULTICAST2_REG_W,
1356 			    ((u_short)mcf[3] << 8) |  mcf[2]);
1357 			outw(BASE + MULTICAST3_REG_W,
1358 			    ((u_short)mcf[5] << 8) |  mcf[4]);
1359 			outw(BASE + MULTICAST4_REG_W,
1360 			    ((u_short)mcf[7] << 8) |  mcf[6]);
1361 		} else {
1362 			flags |= RCR_ALMUL;
1363 		}
1364 	}
1365 	SMC_SELECT_BANK(0);
1366 	outw(BASE + RECV_CONTROL_REG_W, flags);
1367 }
1368 
1369 static int
1370 sn_getmcf(struct arpcom *ac, u_char *mcf)
1371 {
1372 	int i;
1373 	u_int index, index2;
1374 	u_char *af = mcf;
1375 	struct ifmultiaddr *ifma;
1376 
1377 	bzero(mcf, MCFSZ);
1378 
1379 	TAILQ_FOREACH(ifma, &ac->ac_if.if_multiaddrs, ifma_link) {
1380 	    if (ifma->ifma_addr->sa_family != AF_LINK)
1381 		return 0;
1382 	    index = smc_crc(LLADDR((struct sockaddr_dl *)ifma->ifma_addr)) & 0x3f;
1383 	    index2 = 0;
1384 	    for (i = 0; i < 6; i++) {
1385 		index2 <<= 1;
1386 		index2 |= (index & 0x01);
1387 		index >>= 1;
1388 	    }
1389 	    af[index2 >> 3] |= 1 << (index2 & 7);
1390 	}
1391 	return 1;  /* use multicast filter */
1392 }
1393 
1394 static u_int
1395 smc_crc(u_char *s)
1396 {
1397 	int perByte;
1398 	int perBit;
1399 	const u_int poly = 0xedb88320;
1400 	u_int v = 0xffffffff;
1401 	u_char c;
1402 
1403 	for (perByte = 0; perByte < ETHER_ADDR_LEN; perByte++) {
1404 		c = s[perByte];
1405 		for (perBit = 0; perBit < 8; perBit++) {
1406 			v = (v >> 1)^(((v ^ c) & 0x01) ? poly : 0);
1407 			c >>= 1;
1408 		}
1409 	}
1410 	return v;
1411 }
1412