xref: /openbsd-src/sys/dev/isa/if_ie.c (revision 50b7afb2c2c0993b0894d4e34bf857cb13ed9c80)
1 /*	$OpenBSD: if_ie.c,v 1.38 2013/11/26 09:50:33 mpi Exp $	*/
2 /*	$NetBSD: if_ie.c,v 1.51 1996/05/12 23:52:48 mycroft Exp $	*/
3 
4 /*-
5  * Copyright (c) 1993, 1994, 1995 Charles Hannum.
6  * Copyright (c) 1992, 1993, University of Vermont and State
7  *  Agricultural College.
8  * Copyright (c) 1992, 1993, Garrett A. Wollman.
9  *
10  * Portions:
11  * Copyright (c) 1993, 1994, 1995, Rodney W. Grimes
12  * Copyright (c) 1994, 1995, Rafal K. Boni
13  * Copyright (c) 1990, 1991, William F. Jolitz
14  * Copyright (c) 1990, The Regents of the University of California
15  *
16  * All rights reserved.
17  *
18  * Redistribution and use in source and binary forms, with or without
19  * modification, are permitted provided that the following conditions
20  * are met:
21  * 1. Redistributions of source code must retain the above copyright
22  *    notice, this list of conditions and the following disclaimer.
23  * 2. Redistributions in binary form must reproduce the above copyright
24  *    notice, this list of conditions and the following disclaimer in the
25  *    documentation and/or other materials provided with the distribution.
26  * 3. All advertising materials mentioning features or use of this software
27  *    must display the following acknowledgement:
28  *	This product includes software developed by Charles Hannum, by the
29  *	University of Vermont and State Agricultural College and Garrett A.
30  *	Wollman, by William F. Jolitz, and by the University of California,
31  *	Berkeley, Lawrence Berkeley Laboratory, and its contributors.
32  * 4. Neither the names of the Universities nor the names of the authors
33  *    may be used to endorse or promote products derived from this software
34  *    without specific prior written permission.
35  *
36  * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
37  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
38  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
39  * ARE DISCLAIMED.  IN NO EVENT SHALL THE UNIVERSITY OR AUTHORS BE LIABLE
40  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
41  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
42  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
43  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
44  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
45  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
46  * SUCH DAMAGE.
47  */
48 
49 /*
50  * Intel 82586 Ethernet chip
51  * Register, bit, and structure definitions.
52  *
53  * Original StarLAN driver written by Garrett Wollman with reference to the
54  * Clarkson Packet Driver code for this chip written by Russ Nelson and others.
55  *
56  * BPF support code taken from hpdev/if_le.c, supplied with tcpdump.
57  *
58  * 3C507 support is loosely based on code donated to NetBSD by Rafal Boni.
59  *
60  * Intel EtherExpress 16 support taken from FreeBSD's if_ix.c, written
61  * by Rodney W. Grimes.
62  *
63  * Majorly cleaned up and 3C507 code merged by Charles Hannum.
64  */
65 
66 /*
67  * The i82586 is a very versatile chip, found in many implementations.
68  * Programming this chip is mostly the same, but certain details differ
69  * from card to card.  This driver is written so that different cards
70  * can be automatically detected at run-time.
71  */
72 
73 /*
74 Mode of operation:
75 
76 We run the 82586 in a standard Ethernet mode.  We keep NFRAMES received frame
77 descriptors around for the receiver to use, and NRXBUF associated receive
78 buffer descriptors, both in a circular list.  Whenever a frame is received, we
79 rotate both lists as necessary.  (The 586 treats both lists as a simple
80 queue.)  We also keep a transmit command around so that packets can be sent
81 off quickly.
82 
83 We configure the adapter in AL-LOC = 1 mode, which means that the
84 Ethernet/802.3 MAC header is placed at the beginning of the receive buffer
85 rather than being split off into various fields in the RFD.  This also means
86 that we must include this header in the transmit buffer as well.
87 
88 By convention, all transmit commands, and only transmit commands, shall have
89 the I (IE_CMD_INTR) bit set in the command.  This way, when an interrupt
90 arrives at ieintr(), it is immediately possible to tell what precisely caused
91 it.  ANY OTHER command-sending routines should run at splnet(), and should
92 post an acknowledgement to every interrupt they generate.
93 
94 The 82586 has a 24-bit address space internally, and the adaptor's memory is
95 located at the top of this region.  However, the value we are given in
96 configuration is the CPU's idea of where the adaptor RAM is.  So, we must go
97 through a few gyrations to come up with a kernel virtual address which
98 represents the actual beginning of the 586 address space.  First, we autosize
99 the RAM by running through several possible sizes and trying to initialize the
100 adapter under the assumption that the selected size is correct.  Then, knowing
101 the correct RAM size, we set up our pointers in the softc.  `sc_maddr'
102 represents the computed base of the 586 address space.  `iomembot' represents
103 the actual configured base of adapter RAM.  Finally, `sc_msize' represents the
104 calculated size of 586 RAM.  Then, when laying out commands, we use the
105 interval [sc_maddr, sc_maddr + sc_msize); to make 24-pointers, we subtract
106 iomem, and to make 16-pointers, we subtract sc_maddr and and with 0xffff.
107 */
108 
109 #include "bpfilter.h"
110 
111 #include <sys/param.h>
112 #include <sys/systm.h>
113 #include <sys/mbuf.h>
114 #include <sys/buf.h>
115 #include <sys/protosw.h>
116 #include <sys/socket.h>
117 #include <sys/ioctl.h>
118 #include <sys/errno.h>
119 #include <sys/syslog.h>
120 #include <sys/device.h>
121 #include <sys/timeout.h>
122 
123 #include <net/if.h>
124 #include <net/if_types.h>
125 #include <net/if_dl.h>
126 #include <net/netisr.h>
127 #include <net/route.h>
128 
129 #if NBPFILTER > 0
130 #include <net/bpf.h>
131 #endif
132 
133 #ifdef INET
134 #include <netinet/in.h>
135 #include <netinet/in_systm.h>
136 #include <netinet/ip.h>
137 #include <netinet/if_ether.h>
138 #endif
139 
140 #include <machine/cpu.h>
141 #include <machine/bus.h>
142 #include <machine/intr.h>
143 
144 #include <dev/isa/isareg.h>
145 #include <dev/isa/isavar.h>
146 #include <i386/isa/isa_machdep.h>	/* XXX USES ISA HOLE DIRECTLY */
147 #include <dev/ic/i82586reg.h>
148 #include <dev/isa/if_ieatt.h>
149 #include <dev/isa/if_ie507.h>
150 #include <dev/isa/if_iee16.h>
151 #include <dev/isa/elink.h>
152 
153 #define	IED_RINT	0x01
154 #define	IED_TINT	0x02
155 #define	IED_RNR		0x04
156 #define	IED_CNA		0x08
157 #define	IED_READFRAME	0x10
158 #define	IED_ENQ		0x20
159 #define	IED_XMIT	0x40
160 #define	IED_ALL		0x7f
161 
162 /*
163 sizeof(iscp) == 1+1+2+4 == 8
164 sizeof(scb) == 2+2+2+2+2+2+2+2 == 16
165 NFRAMES * sizeof(rfd) == NFRAMES*(2+2+2+2+6+6+2+2) == NFRAMES*24 == 384
166 sizeof(xmit_cmd) == 2+2+2+2+6+2 == 18
167 sizeof(transmit buffer) == ETHER_MAX_LEN == 1518
168 sizeof(transmit buffer desc) == 8
169 -----
170 1952
171 
172 NRXBUF * sizeof(rbd) == NRXBUF*(2+2+4+2+2) == NRXBUF*12
173 NRXBUF * IE_RBUF_SIZE == NRXBUF*256
174 
175 NRXBUF should be (16384 - 1952) / (256 + 12) == 14432 / 268 == 53
176 
177 With NRXBUF == 48, this leaves us 1568 bytes for another command or
178 more buffers.  Another transmit command would be 18+8+1518 == 1544
179 ---just barely fits!
180 
181 Obviously all these would have to be reduced for smaller memory sizes.
182 With a larger memory, it would be possible to roughly double the number of
183 both transmit and receive buffers.
184 */
185 
186 #define	NFRAMES		16		/* number of receive frames */
187 #define	NRXBUF		48		/* number of buffers to allocate */
188 #define	IE_RBUF_SIZE	256		/* size of each receive buffer;
189 						MUST BE POWER OF TWO */
190 #define	NTXBUF		2		/* number of transmit commands */
191 #define	IE_TBUF_SIZE	ETHER_MAX_LEN	/* length of transmit buffer */
192 
193 
194 enum ie_hardware {
195 	IE_STARLAN10,
196 	IE_EN100,
197 	IE_SLFIBER,
198 	IE_3C507,
199 	IE_EE16,
200 	IE_UNKNOWN
201 };
202 
203 const char *ie_hardware_names[] = {
204 	"StarLAN 10",
205 	"EN100",
206 	"StarLAN Fiber",
207 	"3C507",
208 	"EtherExpress 16",
209 	"Unknown"
210 };
211 
212 /*
213  * Ethernet status, per interface.
214  */
215 struct ie_softc {
216 	struct device sc_dev;
217 	void *sc_ih;
218 
219 	int sc_iobase;
220 	caddr_t sc_maddr;
221 	u_int sc_msize;
222 
223 	struct arpcom sc_arpcom;
224 
225 	void (*reset_586)(struct ie_softc *);
226 	void (*chan_attn)(struct ie_softc *);
227 
228 	enum ie_hardware hard_type;
229 	int hard_vers;
230 
231 	int want_mcsetup;
232 	int promisc;
233 	volatile struct ie_int_sys_conf_ptr *iscp;
234 	volatile struct ie_sys_ctl_block *scb;
235 
236 	int rfhead, rftail, rbhead, rbtail;
237 	volatile struct ie_recv_frame_desc *rframes[NFRAMES];
238 	volatile struct ie_recv_buf_desc *rbuffs[NRXBUF];
239 	volatile char *cbuffs[NRXBUF];
240 
241 	int xmit_busy;
242 	int xchead, xctail;
243 	volatile struct ie_xmit_cmd *xmit_cmds[NTXBUF];
244 	volatile struct ie_xmit_buf *xmit_buffs[NTXBUF];
245 	u_char *xmit_cbuffs[NTXBUF];
246 
247 	struct ie_en_addr mcast_addrs[MAXMCAST + 1];
248 	int mcast_count;
249 
250 	u_short	irq_encoded;		/* encoded interrupt on IEE16 */
251 
252 #ifdef IEDEBUG
253 	int sc_debug;
254 #endif
255 };
256 
257 void iewatchdog(struct ifnet *);
258 int ieintr(void *);
259 void iestop(struct ie_softc *);
260 int ieinit(struct ie_softc *);
261 int ieioctl(struct ifnet *, u_long, caddr_t);
262 void iestart(struct ifnet *);
263 static void el_reset_586(struct ie_softc *);
264 static void sl_reset_586(struct ie_softc *);
265 static void el_chan_attn(struct ie_softc *);
266 static void sl_chan_attn(struct ie_softc *);
267 static void slel_get_address(struct ie_softc *);
268 
269 static void ee16_reset_586(struct ie_softc *);
270 static void ee16_chan_attn(struct ie_softc *);
271 static void ee16_interrupt_enable(struct ie_softc *);
272 void ee16_eeprom_outbits(struct ie_softc *, int, int);
273 void ee16_eeprom_clock(struct ie_softc *, int);
274 u_short ee16_read_eeprom(struct ie_softc *, int);
275 int ee16_eeprom_inbits(struct ie_softc *);
276 
277 void iereset(struct ie_softc *);
278 void ie_readframe(struct ie_softc *, int);
279 void ie_drop_packet_buffer(struct ie_softc *);
280 void ie_find_mem_size(struct ie_softc *);
281 static int command_and_wait(struct ie_softc *, int,
282     void volatile *, int);
283 void ierint(struct ie_softc *);
284 void ietint(struct ie_softc *);
285 void iexmit(struct ie_softc *);
286 struct mbuf *ieget(struct ie_softc *,
287     struct ether_header *, int *);
288 void iememinit(void *, struct ie_softc *);
289 static int mc_setup(struct ie_softc *, void *);
290 static void mc_reset(struct ie_softc *);
291 
292 #ifdef IEDEBUG
293 void print_rbd(volatile struct ie_recv_buf_desc *);
294 
295 int in_ierint = 0;
296 int in_ietint = 0;
297 #endif
298 
299 int	ieprobe(struct device *, void *, void *);
300 void	ieattach(struct device *, struct device *, void *);
301 int	sl_probe(struct ie_softc *, struct isa_attach_args *);
302 int	el_probe(struct ie_softc *, struct isa_attach_args *);
303 int	ee16_probe(struct ie_softc *, struct isa_attach_args *);
304 int	check_ie_present(struct ie_softc *, caddr_t, u_int);
305 
306 static __inline void ie_setup_config(volatile struct ie_config_cmd *,
307     int, int);
308 static __inline void ie_ack(struct ie_softc *, u_int);
309 static __inline int ether_equal(u_char *, u_char *);
310 static __inline int check_eh(struct ie_softc *, struct ether_header *,
311     int *);
312 static __inline int ie_buflen(struct ie_softc *, int);
313 static __inline int ie_packet_len(struct ie_softc *);
314 
315 static void run_tdr(struct ie_softc *, struct ie_tdr_cmd *);
316 
317 struct cfattach ie_isa_ca = {
318 	sizeof(struct ie_softc), ieprobe, ieattach
319 };
320 
321 struct cfdriver ie_cd = {
322 	NULL, "ie", DV_IFNET
323 };
324 
325 #define MK_24(base, ptr) ((caddr_t)((u_long)ptr - (u_long)base))
326 #define MK_16(base, ptr) ((u_short)(u_long)MK_24(base, ptr))
327 
328 #define PORT	sc->sc_iobase
329 #define MEM 	sc->sc_maddr
330 
331 /*
332  * Here are a few useful functions.  We could have done these as macros, but
333  * since we have the inline facility, it makes sense to use that instead.
334  */
335 static __inline void
336 ie_setup_config(cmd, promiscuous, manchester)
337 	volatile struct ie_config_cmd *cmd;
338 	int promiscuous, manchester;
339 {
340 
341 	cmd->ie_config_count = 0x0c;
342 	cmd->ie_fifo = 8;
343 	cmd->ie_save_bad = 0x40;
344 	cmd->ie_addr_len = 0x2e;
345 	cmd->ie_priority = 0;
346 	cmd->ie_ifs = 0x60;
347 	cmd->ie_slot_low = 0;
348 	cmd->ie_slot_high = 0xf2;
349 	cmd->ie_promisc = promiscuous | manchester << 2;
350 	cmd->ie_crs_cdt = 0;
351 	cmd->ie_min_len = 64;
352 	cmd->ie_junk = 0xff;
353 }
354 
355 static __inline void
356 ie_ack(sc, mask)
357 	struct ie_softc *sc;
358 	u_int mask;
359 {
360 	volatile struct ie_sys_ctl_block *scb = sc->scb;
361 
362 	scb->ie_command = scb->ie_status & mask;
363 	(sc->chan_attn)(sc);
364 
365 	while (scb->ie_command)
366 		;		/* Spin Lock */
367 }
368 
369 int
370 ieprobe(parent, match, aux)
371 	struct device *parent;
372 	void *match, *aux;
373 {
374 	struct ie_softc *sc = match;
375 	struct isa_attach_args *ia = aux;
376 
377 	if (sl_probe(sc, ia))
378 		return 1;
379 	if (el_probe(sc, ia))
380 		return 1;
381 	if (ee16_probe(sc, ia))
382 		return 1;
383 	return 0;
384 }
385 
386 int
387 sl_probe(sc, ia)
388 	struct ie_softc *sc;
389 	struct isa_attach_args *ia;
390 {
391 	u_char c;
392 
393 	sc->sc_iobase = ia->ia_iobase;
394 
395 	/* Need this for part of the probe. */
396 	sc->reset_586 = sl_reset_586;
397 	sc->chan_attn = sl_chan_attn;
398 
399 	c = inb(PORT + IEATT_REVISION);
400 	switch (SL_BOARD(c)) {
401 	case SL10_BOARD:
402 		sc->hard_type = IE_STARLAN10;
403 		break;
404 	case EN100_BOARD:
405 		sc->hard_type = IE_EN100;
406 		break;
407 	case SLFIBER_BOARD:
408 		sc->hard_type = IE_SLFIBER;
409 		break;
410 
411 	default:
412 		/* Anything else is not recognized or cannot be used. */
413 #if 0
414 		printf("%s: unknown AT&T board type code %d\n",
415 		    sc->sc_dev.dv_xname, SL_BOARD(c));
416 #endif
417 		return 0;
418 	}
419 
420 	sc->hard_vers = SL_REV(c);
421 
422 	if (ia->ia_irq == IRQUNK || ia->ia_maddr == MADDRUNK) {
423 		printf("%s: %s does not have soft configuration\n",
424 		    sc->sc_dev.dv_xname, ie_hardware_names[sc->hard_type]);
425 		return 0;
426 	}
427 
428 	/*
429 	 * Divine memory size on-board the card.  Ususally 16k.
430 	 */
431 	sc->sc_maddr = ISA_HOLE_VADDR(ia->ia_maddr);
432 	ie_find_mem_size(sc);
433 
434 	if (!sc->sc_msize) {
435 		printf("%s: can't find shared memory\n", sc->sc_dev.dv_xname);
436 		return 0;
437 	}
438 
439 	if (!ia->ia_msize)
440 		ia->ia_msize = sc->sc_msize;
441 	else if (ia->ia_msize != sc->sc_msize) {
442 		printf("%s: msize mismatch; kernel configured %d != board configured %d\n",
443 		    sc->sc_dev.dv_xname, ia->ia_msize, sc->sc_msize);
444 		return 0;
445 	}
446 
447 	slel_get_address(sc);
448 
449 	ia->ia_iosize = 16;
450 	return 1;
451 }
452 
453 int
454 el_probe(sc, ia)
455 	struct ie_softc *sc;
456 	struct isa_attach_args *ia;
457 {
458 	bus_space_tag_t iot = ia->ia_iot;
459 	bus_space_handle_t ioh;
460 	u_char c;
461 	int i, rval = 0;
462 	u_char signature[] = "*3COM*";
463 
464 	sc->sc_iobase = ia->ia_iobase;
465 
466 	/* Need this for part of the probe. */
467 	sc->reset_586 = el_reset_586;
468 	sc->chan_attn = el_chan_attn;
469 
470 	/*
471 	 * Map the Etherlink ID port for the probe sequence.
472 	 */
473 	if (bus_space_map(iot, ELINK_ID_PORT, 1, 0, &ioh)) {
474 		printf("3c507 probe: can't map Etherlink ID port\n");
475 		return 0;
476 	}
477 
478 	/*
479 	 * Reset and put card in CONFIG state without changing address.
480 	 * XXX Indirect brokenness here!
481 	 */
482 	elink_reset(iot, ioh, sc->sc_dev.dv_parent->dv_unit);
483 	elink_idseq(iot, ioh, ELINK_507_POLY);
484 	elink_idseq(iot, ioh, ELINK_507_POLY);
485 	outb(ELINK_ID_PORT, 0xff);
486 
487 	/* Check for 3COM signature before proceeding. */
488 	outb(PORT + IE507_CTRL, inb(PORT + IE507_CTRL) & 0xfc);	/* XXX */
489 	for (i = 0; i < 6; i++)
490 		if (inb(PORT + i) != signature[i])
491 			goto out;
492 
493 	c = inb(PORT + IE507_MADDR);
494 	if (c & 0x20) {
495 		printf("%s: can't map 3C507 RAM in high memory\n",
496 		    sc->sc_dev.dv_xname);
497 		goto out;
498 	}
499 
500 	/* Go to RUN state. */
501 	outb(ELINK_ID_PORT, 0x00);
502 	elink_idseq(iot, ioh, ELINK_507_POLY);
503 	outb(ELINK_ID_PORT, 0x00);
504 
505 	/* Set bank 2 for version info and read BCD version byte. */
506 	outb(PORT + IE507_CTRL, EL_CTRL_NRST | EL_CTRL_BNK2);
507 	i = inb(PORT + 3);
508 
509 	sc->hard_type = IE_3C507;
510 	sc->hard_vers = 10*(i / 16) + (i % 16) - 1;
511 
512 	i = inb(PORT + IE507_IRQ) & 0x0f;
513 
514 	if (ia->ia_irq != IRQUNK) {
515 		if (ia->ia_irq != i) {
516 			printf("%s: irq mismatch; kernel configured %d != board configured %d\n",
517 			    sc->sc_dev.dv_xname, ia->ia_irq, i);
518 			goto out;
519 		}
520 	} else
521 		ia->ia_irq = i;
522 
523 	i = ((inb(PORT + IE507_MADDR) & 0x1c) << 12) + 0xc0000;
524 
525 	if (ia->ia_maddr != MADDRUNK) {
526 		if (ia->ia_maddr != i) {
527 			printf("%s: maddr mismatch; kernel configured %x != board configured %x\n",
528 			    sc->sc_dev.dv_xname, ia->ia_maddr, i);
529 			goto out;
530 		}
531 	} else
532 		ia->ia_maddr = i;
533 
534 	outb(PORT + IE507_CTRL, EL_CTRL_NORMAL);
535 
536 	/*
537 	 * Divine memory size on-board the card.
538 	 */
539 	sc->sc_maddr = ISA_HOLE_VADDR(ia->ia_maddr);
540 	ie_find_mem_size(sc);
541 
542 	if (!sc->sc_msize) {
543 		printf("%s: can't find shared memory\n", sc->sc_dev.dv_xname);
544 		outb(PORT + IE507_CTRL, EL_CTRL_NRST);
545 		goto out;
546 	}
547 
548 	if (!ia->ia_msize)
549 		ia->ia_msize = sc->sc_msize;
550 	else if (ia->ia_msize != sc->sc_msize) {
551 		printf("%s: msize mismatch; kernel configured %d != board configured %d\n",
552 		    sc->sc_dev.dv_xname, ia->ia_msize, sc->sc_msize);
553 		outb(PORT + IE507_CTRL, EL_CTRL_NRST);
554 		goto out;
555 	}
556 
557 	slel_get_address(sc);
558 
559 	/* Clear the interrupt latch just in case. */
560 	outb(PORT + IE507_ICTRL, 1);
561 
562 	ia->ia_iosize = 16;
563 	rval = 1;
564 
565  out:
566 	bus_space_unmap(iot, ioh, 1);
567 	return rval;
568 }
569 
570 /* Taken almost exactly from Rod's if_ix.c. */
571 
572 int
573 ee16_probe(sc, ia)
574 	struct ie_softc *sc;
575 	struct isa_attach_args *ia;
576 {
577 	int i;
578 	u_short board_id, id_var1, id_var2, checksum = 0;
579 	u_short eaddrtemp, irq;
580         u_short pg, adjust, decode, edecode;
581 	u_char	bart_config;
582 
583 	short	irq_translate[] = {0, 0x09, 0x03, 0x04, 0x05, 0x0a, 0x0b, 0};
584 
585 	/* Need this for part of the probe. */
586 	sc->reset_586 = ee16_reset_586;
587 	sc->chan_attn = ee16_chan_attn;
588 
589 	/* reset any ee16 at the current iobase */
590 	outb(ia->ia_iobase + IEE16_ECTRL, IEE16_RESET_ASIC);
591 	outb(ia->ia_iobase + IEE16_ECTRL, 0);
592 	delay(240);
593 
594 	/* now look for ee16. */
595 	board_id = id_var1 = id_var2 = 0;
596 	for (i=0; i<4 ; i++) {
597 		id_var1 = inb(ia->ia_iobase + IEE16_ID_PORT);
598 		id_var2 = ((id_var1 & 0x03) << 2);
599 		board_id |= (( id_var1 >> 4)  << id_var2);
600 		}
601 
602 	if (board_id != IEE16_ID)
603 		return 0;
604 
605 	/* need sc->sc_iobase for ee16_read_eeprom */
606 	sc->sc_iobase = ia->ia_iobase;
607 	sc->hard_type = IE_EE16;
608 
609 	/*
610 	 * If ia->maddr == MADDRUNK, use value in eeprom location 6.
611 	 *
612 	 * The shared RAM location on the EE16 is encoded into bits
613 	 * 3-7 of EEPROM location 6.  We zero the upper byte, and
614 	 * shift the 5 bits right 3.  The resulting number tells us
615 	 * the RAM location.  Because the EE16 supports either 16k or 32k
616 	 * of shared RAM, we only worry about the 32k locations.
617 	 *
618 	 * NOTE: if a 64k EE16 exists, it should be added to this switch.
619 	 *       then the ia->ia_msize would need to be set per case statement.
620 	 *
621 	 *	value	msize	location
622 	 *	=====	=====	========
623 	 *	0x03	0x8000	0xCC000
624 	 *	0x06	0x8000	0xD0000
625 	 *	0x0C	0x8000	0xD4000
626 	 *	0x18	0x8000	0xD8000
627 	 *
628 	 */
629 
630 	if ((ia->ia_maddr == MADDRUNK) || (ia->ia_msize == 0)) {
631 		i = (ee16_read_eeprom(sc, 6) & 0x00ff ) >> 3;
632 		switch(i) {
633 			case 0x03:
634 				ia->ia_maddr = 0xCC000;
635 				break;
636 			case 0x06:
637 				ia->ia_maddr = 0xD0000;
638 				break;
639 			case 0x0c:
640 				ia->ia_maddr = 0xD4000;
641 				break;
642 			case 0x18:
643 				ia->ia_maddr = 0xD8000;
644 				break;
645 			default:
646 				return 0 ;
647 				break; /* NOTREACHED */
648 		}
649 		ia->ia_msize = 0x8000;
650 	}
651 
652 	/* need to set these after checking for MADDRUNK */
653 	sc->sc_maddr = ISA_HOLE_VADDR(ia->ia_maddr);
654 	sc->sc_msize = ia->ia_msize;
655 
656 	/* need to put the 586 in RESET, and leave it */
657 	outb( PORT + IEE16_ECTRL, IEE16_RESET_586);
658 
659 	/* read the eeprom and checksum it, should == IEE16_ID */
660 	for(i=0 ; i< 0x40 ; i++)
661 		checksum += ee16_read_eeprom(sc, i);
662 
663 	if (checksum != IEE16_ID)
664 		return 0;
665 
666 	/*
667 	 * Size and test the memory on the board.  The size of the memory
668 	 * can be one of 16k, 32k, 48k or 64k.  It can be located in the
669 	 * address range 0xC0000 to 0xEFFFF on 16k boundaries.
670 	 *
671 	 * If the size does not match the passed in memory allocation size
672 	 * issue a warning, but continue with the minimum of the two sizes.
673 	 */
674 
675 	switch (ia->ia_msize) {
676 		case 65536:
677 		case 32768: /* XXX Only support 32k and 64k right now */
678 			break;
679 		case 16384:
680 		case 49512:
681 		default:
682 			printf("ieprobe mapped memory size out of range\n");
683 			return 0;
684 			break; /* NOTREACHED */
685 	}
686 
687 	if ((kvtop(sc->sc_maddr) < 0xC0000) ||
688 	    (kvtop(sc->sc_maddr) + sc->sc_msize > 0xF0000)) {
689 		printf("ieprobe mapped memory address out of range\n");
690 		return 0;
691 	}
692 
693 	pg = (kvtop(sc->sc_maddr) & 0x3C000) >> 14;
694 	adjust = IEE16_MCTRL_FMCS16 | (pg & 0x3) << 2;
695 	decode = ((1 << (sc->sc_msize / 16384)) - 1) << pg;
696 	edecode = ((~decode >> 4) & 0xF0) | (decode >> 8);
697 
698 	/* ZZZ This should be checked against eeprom location 6, low byte */
699 	outb(PORT + IEE16_MEMDEC, decode & 0xFF);
700 	/* ZZZ This should be checked against eeprom location 1, low byte */
701 	outb(PORT + IEE16_MCTRL, adjust);
702 	/* ZZZ Now if I could find this one I would have it made */
703 	outb(PORT + IEE16_MPCTRL, (~decode & 0xFF));
704 	/* ZZZ I think this is location 6, high byte */
705 	outb(PORT + IEE16_MECTRL, edecode); /*XXX disable Exxx */
706 
707 	/*
708 	 * first prime the stupid bart DRAM controller so that it
709 	 * works, then zero out all of memory.
710 	 */
711 	bzero(sc->sc_maddr, 32);
712 	bzero(sc->sc_maddr, sc->sc_msize);
713 
714 	/*
715 	 * Get the encoded interrupt number from the EEPROM, check it
716 	 * against the passed in IRQ.  Issue a warning if they do not
717 	 * match, and fail the probe.  If irq is 'IRQUNK' then we
718 	 * use the EEPROM irq, and continue.
719 	 */
720 	irq = ee16_read_eeprom(sc, IEE16_EEPROM_CONFIG1);
721 	irq = (irq & IEE16_EEPROM_IRQ) >> IEE16_EEPROM_IRQ_SHIFT;
722 	sc->irq_encoded = irq;
723 	irq = irq_translate[irq];
724 	if (ia->ia_irq != IRQUNK) {
725 		if (irq != ia->ia_irq) {
726 #ifdef DIAGNOSTIC
727 			printf("\nie%d: fatal: board IRQ %d does not match kernel\n", sc->sc_dev.dv_unit, irq);
728 #endif /* DIAGNOSTIC */
729 			return 0; 	/* _must_ match or probe fails */
730 		}
731 	} else
732 		ia->ia_irq = irq;
733 
734 	/*
735 	 * Get the hardware ethernet address from the EEPROM and
736 	 * save it in the softc for use by the 586 setup code.
737 	 */
738 	eaddrtemp = ee16_read_eeprom(sc, IEE16_EEPROM_ENET_HIGH);
739 	sc->sc_arpcom.ac_enaddr[1] = eaddrtemp & 0xFF;
740 	sc->sc_arpcom.ac_enaddr[0] = eaddrtemp >> 8;
741 	eaddrtemp = ee16_read_eeprom(sc, IEE16_EEPROM_ENET_MID);
742 	sc->sc_arpcom.ac_enaddr[3] = eaddrtemp & 0xFF;
743 	sc->sc_arpcom.ac_enaddr[2] = eaddrtemp >> 8;
744 	eaddrtemp = ee16_read_eeprom(sc, IEE16_EEPROM_ENET_LOW);
745 	sc->sc_arpcom.ac_enaddr[5] = eaddrtemp & 0xFF;
746 	sc->sc_arpcom.ac_enaddr[4] = eaddrtemp >> 8;
747 
748 	/* disable the board interrupts */
749 	outb(PORT + IEE16_IRQ, sc->irq_encoded);
750 
751 	/* enable loopback to keep bad packets off the wire */
752 	if(sc->hard_type == IE_EE16) {
753 		bart_config = inb(PORT + IEE16_CONFIG);
754 		bart_config |= IEE16_BART_LOOPBACK;
755 		bart_config |= IEE16_BART_MCS16_TEST; /* inb doesn't get bit! */
756 		outb(PORT + IEE16_CONFIG, bart_config);
757 		bart_config = inb(PORT + IEE16_CONFIG);
758 	}
759 
760 	outb(PORT + IEE16_ECTRL, 0);
761 	delay(100);
762 	if (!check_ie_present(sc, sc->sc_maddr, sc->sc_msize))
763 		return 0;
764 
765 	ia->ia_iosize = 16;	/* the number of I/O ports */
766 	return 1;		/* found */
767 }
768 
769 /*
770  * Taken almost exactly from Bill's if_is.c, then modified beyond recognition.
771  */
772 void
773 ieattach(parent, self, aux)
774 	struct device *parent, *self;
775 	void *aux;
776 {
777 	struct ie_softc *sc = (void *)self;
778 	struct isa_attach_args *ia = aux;
779 	struct ifnet *ifp = &sc->sc_arpcom.ac_if;
780 
781 	bcopy(sc->sc_dev.dv_xname, ifp->if_xname, IFNAMSIZ);
782 	ifp->if_softc = sc;
783 	ifp->if_start = iestart;
784 	ifp->if_ioctl = ieioctl;
785 	ifp->if_watchdog = iewatchdog;
786 	ifp->if_flags =
787 	    IFF_BROADCAST | IFF_SIMPLEX | IFF_NOTRAILERS | IFF_MULTICAST;
788 	IFQ_SET_READY(&ifp->if_snd);
789 
790 	/* Attach the interface. */
791 	if_attach(ifp);
792 	ether_ifattach(ifp);
793 
794 	printf(": address %s, type %s R%d\n",
795 	    ether_sprintf(sc->sc_arpcom.ac_enaddr),
796 	    ie_hardware_names[sc->hard_type], sc->hard_vers + 1);
797 
798 	sc->sc_ih = isa_intr_establish(ia->ia_ic, ia->ia_irq, IST_EDGE,
799 	    IPL_NET, ieintr, sc, sc->sc_dev.dv_xname);
800 }
801 
802 /*
803  * Device timeout/watchdog routine.  Entered if the device neglects to generate
804  * an interrupt after a transmit has been started on it.
805  */
806 void
807 iewatchdog(ifp)
808 	struct ifnet *ifp;
809 {
810 	struct ie_softc *sc = ifp->if_softc;
811 
812 	log(LOG_ERR, "%s: device timeout\n", sc->sc_dev.dv_xname);
813 	++sc->sc_arpcom.ac_if.if_oerrors;
814 	iereset(sc);
815 }
816 
817 /*
818  * What to do upon receipt of an interrupt.
819  */
820 int
821 ieintr(arg)
822 	void *arg;
823 {
824 	struct ie_softc *sc = arg;
825 	register u_short status;
826 
827 	/* Clear the interrupt latch on the 3C507. */
828 	if (sc->hard_type == IE_3C507)
829 		outb(PORT + IE507_ICTRL, 1);
830 
831 	/* disable interrupts on the EE16. */
832 	if (sc->hard_type == IE_EE16)
833 		outb(PORT + IEE16_IRQ, sc->irq_encoded);
834 
835 	status = sc->scb->ie_status & IE_ST_WHENCE;
836 	if (status == 0)
837 		return 0;
838 
839 loop:
840 	/* Ack interrupts FIRST in case we receive more during the ISR. */
841 	ie_ack(sc, status);
842 
843 	if (status & (IE_ST_FR | IE_ST_RNR)) {
844 #ifdef IEDEBUG
845 		in_ierint++;
846 		if (sc->sc_debug & IED_RINT)
847 			printf("%s: rint\n", sc->sc_dev.dv_xname);
848 #endif
849 		ierint(sc);
850 #ifdef IEDEBUG
851 		in_ierint--;
852 #endif
853 	}
854 
855 	if (status & IE_ST_CX) {
856 #ifdef IEDEBUG
857 		in_ietint++;
858 		if (sc->sc_debug & IED_TINT)
859 			printf("%s: tint\n", sc->sc_dev.dv_xname);
860 #endif
861 		ietint(sc);
862 #ifdef IEDEBUG
863 		in_ietint--;
864 #endif
865 	}
866 
867 	if (status & IE_ST_RNR) {
868 		printf("%s: receiver not ready\n", sc->sc_dev.dv_xname);
869 		sc->sc_arpcom.ac_if.if_ierrors++;
870 		iereset(sc);
871 	}
872 
873 #ifdef IEDEBUG
874 	if ((status & IE_ST_CNA) && (sc->sc_debug & IED_CNA))
875 		printf("%s: cna\n", sc->sc_dev.dv_xname);
876 #endif
877 
878 	/* Clear the interrupt latch on the 3C507. */
879 	if (sc->hard_type == IE_3C507)
880 		outb(PORT + IE507_ICTRL, 1);
881 
882 	status = sc->scb->ie_status & IE_ST_WHENCE;
883 	if (status == 0) {
884 		/* enable interrupts on the EE16. */
885 		if (sc->hard_type == IE_EE16)
886 		    outb(PORT + IEE16_IRQ, sc->irq_encoded | IEE16_IRQ_ENABLE);
887 		return 1;
888 	}
889 
890 	goto loop;
891 }
892 
893 /*
894  * Process a received-frame interrupt.
895  */
896 void
897 ierint(sc)
898 	struct ie_softc *sc;
899 {
900 	volatile struct ie_sys_ctl_block *scb = sc->scb;
901 	int i, status;
902 	static int timesthru = 1024;
903 
904 	i = sc->rfhead;
905 	for (;;) {
906 		status = sc->rframes[i]->ie_fd_status;
907 
908 		if ((status & IE_FD_COMPLETE) && (status & IE_FD_OK)) {
909 			if (!--timesthru) {
910 				sc->sc_arpcom.ac_if.if_ierrors +=
911 				    scb->ie_err_crc + scb->ie_err_align +
912 				    scb->ie_err_resource + scb->ie_err_overrun;
913 				scb->ie_err_crc = scb->ie_err_align =
914 				    scb->ie_err_resource = scb->ie_err_overrun =
915 				    0;
916 				timesthru = 1024;
917 			}
918 			ie_readframe(sc, i);
919 		} else {
920 			if ((status & IE_FD_RNR) != 0 &&
921 			    (scb->ie_status & IE_RU_READY) == 0) {
922 				sc->rframes[0]->ie_fd_buf_desc =
923 						MK_16(MEM, sc->rbuffs[0]);
924 				scb->ie_recv_list = MK_16(MEM, sc->rframes[0]);
925 				command_and_wait(sc, IE_RU_START, 0, 0);
926 			}
927 			break;
928 		}
929 		i = (i + 1) % NFRAMES;
930 	}
931 }
932 
933 /*
934  * Process a command-complete interrupt.  These are only generated by the
935  * transmission of frames.  This routine is deceptively simple, since most of
936  * the real work is done by iestart().
937  */
938 void
939 ietint(sc)
940 	struct ie_softc *sc;
941 {
942 	struct ifnet *ifp = &sc->sc_arpcom.ac_if;
943 	int status;
944 
945 	ifp->if_timer = 0;
946 	ifp->if_flags &= ~IFF_OACTIVE;
947 
948 	status = sc->xmit_cmds[sc->xctail]->ie_xmit_status;
949 
950 	if (!(status & IE_STAT_COMPL) || (status & IE_STAT_BUSY))
951 		printf("ietint: command still busy!\n");
952 
953 	if (status & IE_STAT_OK) {
954 		ifp->if_opackets++;
955 		ifp->if_collisions += status & IE_XS_MAXCOLL;
956 	} else {
957 		ifp->if_oerrors++;
958 		/*
959 		 * XXX
960 		 * Check SQE and DEFERRED?
961 		 * What if more than one bit is set?
962 		 */
963 		if (status & IE_STAT_ABORT)
964 			printf("%s: send aborted\n", sc->sc_dev.dv_xname);
965 		else if (status & IE_XS_LATECOLL)
966 			printf("%s: late collision\n", sc->sc_dev.dv_xname);
967 		else if (status & IE_XS_NOCARRIER)
968 			printf("%s: no carrier\n", sc->sc_dev.dv_xname);
969 		else if (status & IE_XS_LOSTCTS)
970 			printf("%s: lost CTS\n", sc->sc_dev.dv_xname);
971 		else if (status & IE_XS_UNDERRUN)
972 			printf("%s: DMA underrun\n", sc->sc_dev.dv_xname);
973 		else if (status & IE_XS_EXCMAX) {
974 			printf("%s: too many collisions\n", sc->sc_dev.dv_xname);
975 			ifp->if_collisions += 16;
976 		}
977 	}
978 
979 	/*
980 	 * If multicast addresses were added or deleted while transmitting,
981 	 * mc_reset() set the want_mcsetup flag indicating that we should do
982 	 * it.
983 	 */
984 	if (sc->want_mcsetup) {
985 		mc_setup(sc, (caddr_t)sc->xmit_cbuffs[sc->xctail]);
986 		sc->want_mcsetup = 0;
987 	}
988 
989 	/* Done with the buffer. */
990 	sc->xmit_busy--;
991 	sc->xctail = (sc->xctail + 1) % NTXBUF;
992 
993 	/* Start the next packet, if any, transmitting. */
994 	if (sc->xmit_busy > 0)
995 		iexmit(sc);
996 
997 	iestart(ifp);
998 }
999 
1000 /*
1001  * Compare two Ether/802 addresses for equality, inlined and unrolled for
1002  * speed.  I'd love to have an inline assembler version of this...
1003  */
1004 static __inline int
1005 ether_equal(one, two)
1006 	u_char *one, *two;
1007 {
1008 
1009 	if (one[0] != two[0] || one[1] != two[1] || one[2] != two[2] ||
1010 	    one[3] != two[3] || one[4] != two[4] || one[5] != two[5])
1011 		return 0;
1012 	return 1;
1013 }
1014 
1015 /*
1016  * Check for a valid address.  to_bpf is filled in with one of the following:
1017  *   0 -> BPF doesn't get this packet
1018  *   1 -> BPF does get this packet
1019  *   2 -> BPF does get this packet, but we don't
1020  * Return value is true if the packet is for us, and false otherwise.
1021  *
1022  * This routine is a mess, but it's also critical that it be as fast
1023  * as possible.  It could be made cleaner if we can assume that the
1024  * only client which will fiddle with IFF_PROMISC is BPF.  This is
1025  * probably a good assumption, but we do not make it here.  (Yet.)
1026  */
1027 static __inline int
1028 check_eh(sc, eh, to_bpf)
1029 	struct ie_softc *sc;
1030 	struct ether_header *eh;
1031 	int *to_bpf;
1032 {
1033 	int i;
1034 
1035 	switch (sc->promisc) {
1036 	case IFF_ALLMULTI:
1037 		/*
1038 		 * Receiving all multicasts, but no unicasts except those
1039 		 * destined for us.
1040 		 */
1041 #if NBPFILTER > 0
1042 		*to_bpf = (sc->sc_arpcom.ac_if.if_bpf != 0); /* BPF gets this packet if anybody cares */
1043 #endif
1044 		if (eh->ether_dhost[0] & 1)
1045 			return 1;
1046 		if (ether_equal(eh->ether_dhost, sc->sc_arpcom.ac_enaddr))
1047 			return 1;
1048 		return 0;
1049 
1050 	case IFF_PROMISC:
1051 		/*
1052 		 * Receiving all packets.  These need to be passed on to BPF.
1053 		 */
1054 #if NBPFILTER > 0
1055 		*to_bpf = (sc->sc_arpcom.ac_if.if_bpf != 0) ||
1056 		    (sc->sc_arpcom.ac_if.if_bridgeport != NULL);
1057 #else
1058 		*to_bpf = (sc->sc_arpcom.ac_if.if_bridgeport != NULL);
1059 #endif
1060 		/* If for us, accept and hand up to BPF */
1061 		if (ether_equal(eh->ether_dhost, sc->sc_arpcom.ac_enaddr))
1062 			return 1;
1063 
1064 #if NBPFILTER > 0
1065 		if (*to_bpf && sc->sc_arpcom.ac_if.if_bridgeport == NULL)
1066 			*to_bpf = 2; /* we don't need to see it */
1067 #endif
1068 
1069 		/*
1070 		 * Not a multicast, so BPF wants to see it but we don't.
1071 		 */
1072 		if (!(eh->ether_dhost[0] & 1))
1073 			return 1;
1074 
1075 		/*
1076 		 * If it's one of our multicast groups, accept it and pass it
1077 		 * up.
1078 		 */
1079 		for (i = 0; i < sc->mcast_count; i++) {
1080 			if (ether_equal(eh->ether_dhost, (u_char *)&sc->mcast_addrs[i])) {
1081 #if NBPFILTER > 0
1082 				if (*to_bpf)
1083 					*to_bpf = 1;
1084 #endif
1085 				return 1;
1086 			}
1087 		}
1088 		return 1;
1089 
1090 	case IFF_ALLMULTI | IFF_PROMISC:
1091 		/*
1092 		 * Acting as a multicast router, and BPF running at the same
1093 		 * time.  Whew!  (Hope this is a fast machine...)
1094 		 */
1095 #if NBPFILTER > 0
1096 		*to_bpf = (sc->sc_arpcom.ac_if.if_bpf != 0) ||
1097 		    (sc->sc_arpcom.ac_if.if_bridgeport != NULL);
1098 #else
1099 		*to_bpf = (sc->sc_arpcom.ac_if.if_bridgeport != NULL);
1100 #endif
1101 		/* We want to see multicasts. */
1102 		if (eh->ether_dhost[0] & 1)
1103 			return 1;
1104 
1105 		/* We want to see our own packets */
1106 		if (ether_equal(eh->ether_dhost, sc->sc_arpcom.ac_enaddr))
1107 			return 1;
1108 
1109 		/* Anything else goes to BPF but nothing else. */
1110 #if NBPFILTER > 0
1111 		if (*to_bpf && sc->sc_arpcom.ac_if.if_bridgeport == NULL)
1112 			*to_bpf = 2;
1113 #endif
1114 		return 1;
1115 
1116 	case 0:
1117 		/*
1118 		 * Only accept unicast packets destined for us, or multicasts
1119 		 * for groups that we belong to.  For now, we assume that the
1120 		 * '586 will only return packets that we asked it for.  This
1121 		 * isn't strictly true (it uses hashing for the multicast
1122 		 * filter), but it will do in this case, and we want to get out
1123 		 * of here as quickly as possible.
1124 		 */
1125 #if NBPFILTER > 0
1126 		*to_bpf = (sc->sc_arpcom.ac_if.if_bpf != 0);
1127 #endif
1128 		return 1;
1129 	}
1130 
1131 #ifdef DIAGNOSTIC
1132 	panic("check_eh: impossible");
1133 #endif
1134 	return 0;
1135 }
1136 
1137 /*
1138  * We want to isolate the bits that have meaning...  This assumes that
1139  * IE_RBUF_SIZE is an even power of two.  If somehow the act_len exceeds
1140  * the size of the buffer, then we are screwed anyway.
1141  */
1142 static __inline int
1143 ie_buflen(sc, head)
1144 	struct ie_softc *sc;
1145 	int head;
1146 {
1147 
1148 	return (sc->rbuffs[head]->ie_rbd_actual
1149 	    & (IE_RBUF_SIZE | (IE_RBUF_SIZE - 1)));
1150 }
1151 
1152 static __inline int
1153 ie_packet_len(sc)
1154 	struct ie_softc *sc;
1155 {
1156 	int i;
1157 	int head = sc->rbhead;
1158 	int acc = 0;
1159 
1160 	do {
1161 		if (!(sc->rbuffs[sc->rbhead]->ie_rbd_actual & IE_RBD_USED))
1162 			return -1;
1163 
1164 		i = sc->rbuffs[head]->ie_rbd_actual & IE_RBD_LAST;
1165 
1166 		acc += ie_buflen(sc, head);
1167 		head = (head + 1) % NRXBUF;
1168 	} while (!i);
1169 
1170 	return acc;
1171 }
1172 
1173 /*
1174  * Setup all necessary artifacts for an XMIT command, and then pass the XMIT
1175  * command to the chip to be executed.  On the way, if we have a BPF listener
1176  * also give him a copy.
1177  */
1178 void
1179 iexmit(sc)
1180 	struct ie_softc *sc;
1181 {
1182 
1183 #ifdef IEDEBUG
1184 	if (sc->sc_debug & IED_XMIT)
1185 		printf("%s: xmit buffer %d\n", sc->sc_dev.dv_xname,
1186 		    sc->xctail);
1187 #endif
1188 
1189 #if NBPFILTER > 0
1190 	/*
1191 	 * If BPF is listening on this interface, let it see the packet before
1192 	 * we push it on the wire.
1193 	 */
1194 	if (sc->sc_arpcom.ac_if.if_bpf)
1195 		bpf_tap(sc->sc_arpcom.ac_if.if_bpf,
1196 		    sc->xmit_cbuffs[sc->xctail],
1197 		    sc->xmit_buffs[sc->xctail]->ie_xmit_flags,
1198 		    BPF_DIRECTION_OUT);
1199 #endif
1200 
1201 	sc->xmit_buffs[sc->xctail]->ie_xmit_flags |= IE_XMIT_LAST;
1202 	sc->xmit_buffs[sc->xctail]->ie_xmit_next = 0xffff;
1203 	sc->xmit_buffs[sc->xctail]->ie_xmit_buf =
1204 	    MK_24(MEM, sc->xmit_cbuffs[sc->xctail]);
1205 
1206 	sc->xmit_cmds[sc->xctail]->com.ie_cmd_link = 0xffff;
1207 	sc->xmit_cmds[sc->xctail]->com.ie_cmd_cmd =
1208 	    IE_CMD_XMIT | IE_CMD_INTR | IE_CMD_LAST;
1209 
1210 	sc->xmit_cmds[sc->xctail]->ie_xmit_status = 0;
1211 	sc->xmit_cmds[sc->xctail]->ie_xmit_desc =
1212 	    MK_16(MEM, sc->xmit_buffs[sc->xctail]);
1213 
1214 	sc->scb->ie_command_list = MK_16(MEM, sc->xmit_cmds[sc->xctail]);
1215 	command_and_wait(sc, IE_CU_START, 0, 0);
1216 
1217 	sc->sc_arpcom.ac_if.if_timer = 5;
1218 }
1219 
1220 /*
1221  * Read data off the interface, and turn it into an mbuf chain.
1222  *
1223  * This code is DRAMATICALLY different from the previous version; this version
1224  * tries to allocate the entire mbuf chain up front, given the length of the
1225  * data available.  This enables us to allocate mbuf clusters in many
1226  * situations where before we would have had a long chain of partially-full
1227  * mbufs.  This should help to speed up the operation considerably.  (Provided
1228  * that it works, of course.)
1229  */
1230 struct mbuf *
1231 ieget(sc, ehp, to_bpf)
1232 	struct ie_softc *sc;
1233 	struct ether_header *ehp;
1234 	int *to_bpf;
1235 {
1236 	struct mbuf *top, **mp, *m;
1237 	int len, totlen, resid;
1238 	int thisrboff, thismboff;
1239 	int head;
1240 
1241 	resid = totlen = ie_packet_len(sc);
1242 	if (totlen <= 0)
1243 		return 0;
1244 
1245 	head = sc->rbhead;
1246 
1247 	/*
1248 	 * Snarf the Ethernet header.
1249 	 */
1250 	bcopy((caddr_t)sc->cbuffs[head], (caddr_t)ehp, sizeof *ehp);
1251 
1252 	/*
1253 	 * As quickly as possible, check if this packet is for us.
1254 	 * If not, don't waste a single cycle copying the rest of the
1255 	 * packet in.
1256 	 * This is only a consideration when FILTER is defined; i.e., when
1257 	 * we are either running BPF or doing multicasting.
1258 	 */
1259 	if (!check_eh(sc, ehp, to_bpf)) {
1260 		sc->sc_arpcom.ac_if.if_ierrors--; /* just this case, it's not an error */
1261 		return 0;
1262 	}
1263 
1264 	MGETHDR(m, M_DONTWAIT, MT_DATA);
1265 	if (m == 0)
1266 		return 0;
1267 	m->m_pkthdr.rcvif = &sc->sc_arpcom.ac_if;
1268 	m->m_pkthdr.len = totlen;
1269 	len = MHLEN;
1270 	top = 0;
1271 	mp = &top;
1272 
1273 	/*
1274 	 * This loop goes through and allocates mbufs for all the data we will
1275 	 * be copying in.  It does not actually do the copying yet.
1276 	 */
1277 	while (totlen > 0) {
1278 		if (top) {
1279 			MGET(m, M_DONTWAIT, MT_DATA);
1280 			if (m == 0) {
1281 				m_freem(top);
1282 				return 0;
1283 			}
1284 			len = MLEN;
1285 		}
1286 		if (totlen >= MINCLSIZE) {
1287 			MCLGET(m, M_DONTWAIT);
1288 			if (m->m_flags & M_EXT)
1289 				len = MCLBYTES;
1290 		}
1291 		m->m_len = len = min(totlen, len);
1292 		totlen -= len;
1293 		*mp = m;
1294 		mp = &m->m_next;
1295 	}
1296 
1297 	m = top;
1298 	thisrboff = 0;
1299 	thismboff = 0;
1300 
1301 	/*
1302 	 * Now we take the mbuf chain (hopefully only one mbuf most of the
1303 	 * time) and stuff the data into it.  There are no possible failures at
1304 	 * or after this point.
1305 	 */
1306 	while (resid > 0) {
1307 		int thisrblen = ie_buflen(sc, head) - thisrboff,
1308 		    thismblen = m->m_len - thismboff;
1309 		len = min(thisrblen, thismblen);
1310 
1311 		bcopy((caddr_t)(sc->cbuffs[head] + thisrboff),
1312 		    mtod(m, caddr_t) + thismboff, (u_int)len);
1313 		resid -= len;
1314 
1315 		if (len == thismblen) {
1316 			m = m->m_next;
1317 			thismboff = 0;
1318 		} else
1319 			thismboff += len;
1320 
1321 		if (len == thisrblen) {
1322 			head = (head + 1) % NRXBUF;
1323 			thisrboff = 0;
1324 		} else
1325 			thisrboff += len;
1326 	}
1327 
1328 	/*
1329 	 * Unless something changed strangely while we were doing the copy, we
1330 	 * have now copied everything in from the shared memory.
1331 	 * This means that we are done.
1332 	 */
1333 	return top;
1334 }
1335 
1336 /*
1337  * Read frame NUM from unit UNIT (pre-cached as IE).
1338  *
1339  * This routine reads the RFD at NUM, and copies in the buffers from the list
1340  * of RBD, then rotates the RBD and RFD lists so that the receiver doesn't
1341  * start complaining.  Trailers are DROPPED---there's no point in wasting time
1342  * on confusing code to deal with them.  Hopefully, this machine will never ARP
1343  * for trailers anyway.
1344  */
1345 void
1346 ie_readframe(sc, num)
1347 	struct ie_softc *sc;
1348 	int num;			/* frame number to read */
1349 {
1350 	int status;
1351 	struct mbuf *m = 0;
1352 	struct ether_header eh;
1353 #if NBPFILTER > 0
1354 	int bpf_gets_it = 0;
1355 #endif
1356 
1357 	status = sc->rframes[num]->ie_fd_status;
1358 
1359 	/* Advance the RFD list, since we're done with this descriptor. */
1360 	sc->rframes[num]->ie_fd_status = 0;
1361 	sc->rframes[num]->ie_fd_last |= IE_FD_LAST;
1362 	sc->rframes[sc->rftail]->ie_fd_last &= ~IE_FD_LAST;
1363 	sc->rftail = (sc->rftail + 1) % NFRAMES;
1364 	sc->rfhead = (sc->rfhead + 1) % NFRAMES;
1365 
1366 	if (status & IE_FD_OK) {
1367 #if NBPFILTER > 0
1368 		m = ieget(sc, &eh, &bpf_gets_it);
1369 #else
1370 		m = ieget(sc, &eh, 0);
1371 #endif
1372 		ie_drop_packet_buffer(sc);
1373 	}
1374 	if (m == 0) {
1375 		sc->sc_arpcom.ac_if.if_ierrors++;
1376 		return;
1377 	}
1378 
1379 #ifdef IEDEBUG
1380 	if (sc->sc_debug & IED_READFRAME)
1381 		printf("%s: frame from ether %s type %x\n", sc->sc_dev.dv_xname,
1382 		    ether_sprintf(eh.ether_shost), (u_int)eh.ether_type);
1383 #endif
1384 
1385 #if NBPFILTER > 0
1386 	/* Check for a BPF filter; if so, hand it up. */
1387 	if (bpf_gets_it) {
1388 		/* Pass it up. */
1389 		bpf_mtap(sc->sc_arpcom.ac_if.if_bpf, m, BPF_DIRECTION_IN);
1390 
1391 		/*
1392 		 * A signal passed up from the filtering code indicating that
1393 		 * the packet is intended for BPF but not for the protocol
1394 		 * machinery.  We can save a few cycles by not handing it off
1395 		 * to them.
1396 		 */
1397 		if (bpf_gets_it == 2) {
1398 			m_freem(m);
1399 			return;
1400 		}
1401 	}
1402 #endif /* NBPFILTER > 0 */
1403 
1404 	/*
1405 	 * In here there used to be code to check destination addresses upon
1406 	 * receipt of a packet.  We have deleted that code, and replaced it
1407 	 * with code to check the address much earlier in the cycle, before
1408 	 * copying the data in; this saves us valuable cycles when operating
1409 	 * as a multicast router or when using BPF.
1410 	 */
1411 
1412 	/*
1413 	 * Finally pass this packet up to higher layers.
1414 	 */
1415 	ether_input_mbuf(&sc->sc_arpcom.ac_if, m);
1416 	sc->sc_arpcom.ac_if.if_ipackets++;
1417 }
1418 
1419 void
1420 ie_drop_packet_buffer(sc)
1421 	struct ie_softc *sc;
1422 {
1423 	int i;
1424 
1425 	do {
1426 		/*
1427 		 * This means we are somehow out of sync.  So, we reset the
1428 		 * adapter.
1429 		 */
1430 		if (!(sc->rbuffs[sc->rbhead]->ie_rbd_actual & IE_RBD_USED)) {
1431 #ifdef IEDEBUG
1432 			print_rbd(sc->rbuffs[sc->rbhead]);
1433 #endif
1434 			log(LOG_ERR, "%s: receive descriptors out of sync at %d\n",
1435 			    sc->sc_dev.dv_xname, sc->rbhead);
1436 			iereset(sc);
1437 			return;
1438 		}
1439 
1440 		i = sc->rbuffs[sc->rbhead]->ie_rbd_actual & IE_RBD_LAST;
1441 
1442 		sc->rbuffs[sc->rbhead]->ie_rbd_length |= IE_RBD_LAST;
1443 		sc->rbuffs[sc->rbhead]->ie_rbd_actual = 0;
1444 		sc->rbhead = (sc->rbhead + 1) % NRXBUF;
1445 		sc->rbuffs[sc->rbtail]->ie_rbd_length &= ~IE_RBD_LAST;
1446 		sc->rbtail = (sc->rbtail + 1) % NRXBUF;
1447 	} while (!i);
1448 }
1449 
1450 /*
1451  * Start transmission on an interface.
1452  */
1453 void
1454 iestart(ifp)
1455 	struct ifnet *ifp;
1456 {
1457 	struct ie_softc *sc = ifp->if_softc;
1458 	struct mbuf *m0, *m;
1459 	u_char *buffer;
1460 	u_short len;
1461 
1462 	if ((ifp->if_flags & (IFF_RUNNING | IFF_OACTIVE)) != IFF_RUNNING)
1463 		return;
1464 
1465 	for (;;) {
1466 		if (sc->xmit_busy == NTXBUF) {
1467 			ifp->if_flags |= IFF_OACTIVE;
1468 			break;
1469 		}
1470 
1471 		IFQ_DEQUEUE(&ifp->if_snd, m0);
1472 		if (m0 == 0)
1473 			break;
1474 
1475 		/* We need to use m->m_pkthdr.len, so require the header */
1476 		if ((m0->m_flags & M_PKTHDR) == 0)
1477 			panic("iestart: no header mbuf");
1478 
1479 #if NBPFILTER > 0
1480 		/* Tap off here if there is a BPF listener. */
1481 		if (ifp->if_bpf)
1482 			bpf_mtap(ifp->if_bpf, m0, BPF_DIRECTION_OUT);
1483 #endif
1484 
1485 #ifdef IEDEBUG
1486 		if (sc->sc_debug & IED_ENQ)
1487 			printf("%s: fill buffer %d\n", sc->sc_dev.dv_xname,
1488 			    sc->xchead);
1489 #endif
1490 
1491 		len = 0;
1492 		buffer = sc->xmit_cbuffs[sc->xchead];
1493 
1494 		for (m = m0; m != NULL && (len + m->m_len) < IE_TBUF_SIZE;
1495 		    m = m->m_next) {
1496 			bcopy(mtod(m, caddr_t), buffer, m->m_len);
1497 			buffer += m->m_len;
1498 			len += m->m_len;
1499 		}
1500 		if (m != NULL)
1501 			printf("%s: tbuf overflow\n", sc->sc_dev.dv_xname);
1502 
1503 		m_freem(m0);
1504 
1505 		if (len < ETHER_MIN_LEN - ETHER_CRC_LEN) {
1506 			bzero(buffer, ETHER_MIN_LEN - ETHER_CRC_LEN - len);
1507 			len = ETHER_MIN_LEN - ETHER_CRC_LEN;
1508 			buffer += ETHER_MIN_LEN - ETHER_CRC_LEN;
1509 		}
1510 
1511 		sc->xmit_buffs[sc->xchead]->ie_xmit_flags = len;
1512 
1513 		/* Start the first packet transmitting. */
1514 		if (sc->xmit_busy == 0)
1515 			iexmit(sc);
1516 
1517 		sc->xchead = (sc->xchead + 1) % NTXBUF;
1518 		sc->xmit_busy++;
1519 	}
1520 }
1521 
1522 /*
1523  * Check to see if there's an 82586 out there.
1524  */
1525 int
1526 check_ie_present(sc, where, size)
1527 	struct ie_softc *sc;
1528 	caddr_t where;
1529 	u_int size;
1530 {
1531 	volatile struct ie_sys_conf_ptr *scp;
1532 	volatile struct ie_int_sys_conf_ptr *iscp;
1533 	volatile struct ie_sys_ctl_block *scb;
1534 	u_long realbase;
1535 	int s;
1536 
1537 	s = splnet();
1538 
1539 	realbase = (u_long)where + size - (1 << 24);
1540 
1541 	scp = (volatile struct ie_sys_conf_ptr *)(realbase + IE_SCP_ADDR);
1542 	bzero((char *)scp, sizeof *scp);
1543 
1544 	/*
1545 	 * First we put the ISCP at the bottom of memory; this tests to make
1546 	 * sure that our idea of the size of memory is the same as the
1547 	 * controller's.  This is NOT where the ISCP will be in normal
1548 	 * operation.
1549 	 */
1550 	iscp = (volatile struct ie_int_sys_conf_ptr *)where;
1551 	bzero((char *)iscp, sizeof *iscp);
1552 
1553 	scb = (volatile struct ie_sys_ctl_block *)where;
1554 	bzero((char *)scb, sizeof *scb);
1555 
1556 	scp->ie_bus_use = 0;		/* 16-bit */
1557 	scp->ie_iscp_ptr = (caddr_t)((volatile caddr_t)iscp -
1558 	    (volatile caddr_t)realbase);
1559 
1560 	iscp->ie_busy = 1;
1561 	iscp->ie_scb_offset = MK_16(realbase, scb) + 256;
1562 
1563 	(sc->reset_586)(sc);
1564 	(sc->chan_attn)(sc);
1565 
1566 	delay(100);			/* wait a while... */
1567 
1568 	if (iscp->ie_busy) {
1569 		splx(s);
1570 		return 0;
1571 	}
1572 
1573 	/*
1574 	 * Now relocate the ISCP to its real home, and reset the controller
1575 	 * again.
1576 	 */
1577 	iscp = (void *)ALIGN(realbase + IE_SCP_ADDR - sizeof(*iscp));
1578 	bzero((char *)iscp, sizeof *iscp);
1579 
1580 	scp->ie_iscp_ptr = (caddr_t)((caddr_t)iscp - (caddr_t)realbase);
1581 
1582 	iscp->ie_busy = 1;
1583 	iscp->ie_scb_offset = MK_16(realbase, scb);
1584 
1585 	(sc->reset_586)(sc);
1586 	(sc->chan_attn)(sc);
1587 
1588 	delay(100);
1589 
1590 	if (iscp->ie_busy) {
1591 		splx(s);
1592 		return 0;
1593 	}
1594 
1595 	sc->sc_msize = size;
1596 	sc->sc_maddr = (caddr_t)realbase;
1597 
1598 	sc->iscp = iscp;
1599 	sc->scb = scb;
1600 
1601 	/*
1602 	 * Acknowledge any interrupts we may have caused...
1603 	 */
1604 	ie_ack(sc, IE_ST_WHENCE);
1605 	splx(s);
1606 
1607 	return 1;
1608 }
1609 
1610 /*
1611  * Divine the memory size of ie board UNIT.
1612  * Better hope there's nothing important hiding just below the ie card...
1613  */
1614 void
1615 ie_find_mem_size(sc)
1616 	struct ie_softc *sc;
1617 {
1618 	u_int size;
1619 
1620 	sc->sc_msize = 0;
1621 
1622 	for (size = 65536; size >= 16384; size -= 16384)
1623 		if (check_ie_present(sc, sc->sc_maddr, size))
1624 			return;
1625 
1626 	return;
1627 }
1628 
1629 void
1630 el_reset_586(sc)
1631 	struct ie_softc *sc;
1632 {
1633 
1634 	outb(PORT + IE507_CTRL, EL_CTRL_RESET);
1635 	delay(100);
1636 	outb(PORT + IE507_CTRL, EL_CTRL_NORMAL);
1637 	delay(100);
1638 }
1639 
1640 void
1641 sl_reset_586(sc)
1642 	struct ie_softc *sc;
1643 {
1644 
1645 	outb(PORT + IEATT_RESET, 0);
1646 }
1647 
1648 void
1649 ee16_reset_586(sc)
1650 	struct ie_softc *sc;
1651 {
1652 
1653 	outb(PORT + IEE16_ECTRL, IEE16_RESET_586);
1654 	delay(100);
1655 	outb(PORT + IEE16_ECTRL, 0);
1656 	delay(100);
1657 }
1658 
1659 void
1660 el_chan_attn(sc)
1661 	struct ie_softc *sc;
1662 {
1663 
1664 	outb(PORT + IE507_ATTN, 1);
1665 }
1666 
1667 void
1668 sl_chan_attn(sc)
1669 	struct ie_softc *sc;
1670 {
1671 
1672 	outb(PORT + IEATT_ATTN, 0);
1673 }
1674 
1675 void
1676 ee16_chan_attn(sc)
1677 	struct ie_softc *sc;
1678 {
1679 	outb(PORT + IEE16_ATTN, 0);
1680 }
1681 
1682 u_short
1683 ee16_read_eeprom(sc, location)
1684 	struct ie_softc *sc;
1685 	int location;
1686 {
1687 	int ectrl, edata;
1688 
1689 	ectrl = inb(PORT + IEE16_ECTRL);
1690 	ectrl &= IEE16_ECTRL_MASK;
1691 	ectrl |= IEE16_ECTRL_EECS;
1692 	outb(PORT + IEE16_ECTRL, ectrl);
1693 
1694 	ee16_eeprom_outbits(sc, IEE16_EEPROM_READ, IEE16_EEPROM_OPSIZE1);
1695 	ee16_eeprom_outbits(sc, location, IEE16_EEPROM_ADDR_SIZE);
1696 	edata = ee16_eeprom_inbits(sc);
1697 	ectrl = inb(PORT + IEE16_ECTRL);
1698 	ectrl &= ~(IEE16_RESET_ASIC | IEE16_ECTRL_EEDI | IEE16_ECTRL_EECS);
1699 	outb(PORT + IEE16_ECTRL, ectrl);
1700 	ee16_eeprom_clock(sc, 1);
1701 	ee16_eeprom_clock(sc, 0);
1702 	return edata;
1703 }
1704 
1705 void
1706 ee16_eeprom_outbits(sc, edata, count)
1707 	struct ie_softc *sc;
1708 	int edata, count;
1709 {
1710 	int ectrl, i;
1711 
1712 	ectrl = inb(PORT + IEE16_ECTRL);
1713 	ectrl &= ~IEE16_RESET_ASIC;
1714 	for (i = count - 1; i >= 0; i--) {
1715 		ectrl &= ~IEE16_ECTRL_EEDI;
1716 		if (edata & (1 << i)) {
1717 			ectrl |= IEE16_ECTRL_EEDI;
1718 		}
1719 		outb(PORT + IEE16_ECTRL, ectrl);
1720 		delay(1);	/* eeprom data must be setup for 0.4 uSec */
1721 		ee16_eeprom_clock(sc, 1);
1722 		ee16_eeprom_clock(sc, 0);
1723 	}
1724 	ectrl &= ~IEE16_ECTRL_EEDI;
1725 	outb(PORT + IEE16_ECTRL, ectrl);
1726 	delay(1);		/* eeprom data must be held for 0.4 uSec */
1727 }
1728 
1729 int
1730 ee16_eeprom_inbits(sc)
1731 	struct ie_softc *sc;
1732 {
1733 	int ectrl, edata, i;
1734 
1735 	ectrl = inb(PORT + IEE16_ECTRL);
1736 	ectrl &= ~IEE16_RESET_ASIC;
1737 	for (edata = 0, i = 0; i < 16; i++) {
1738 		edata = edata << 1;
1739 		ee16_eeprom_clock(sc, 1);
1740 		ectrl = inb(PORT + IEE16_ECTRL);
1741 		if (ectrl & IEE16_ECTRL_EEDO) {
1742 			edata |= 1;
1743 		}
1744 		ee16_eeprom_clock(sc, 0);
1745 	}
1746 	return (edata);
1747 }
1748 
1749 void
1750 ee16_eeprom_clock(sc, state)
1751 	struct ie_softc *sc;
1752 	int state;
1753 {
1754 	int ectrl;
1755 
1756 	ectrl = inb(PORT + IEE16_ECTRL);
1757 	ectrl &= ~(IEE16_RESET_ASIC | IEE16_ECTRL_EESK);
1758 	if (state) {
1759 		ectrl |= IEE16_ECTRL_EESK;
1760 	}
1761 	outb(PORT + IEE16_ECTRL, ectrl);
1762 	delay(9);		/* EESK must be stable for 8.38 uSec */
1763 }
1764 
1765 static inline void
1766 ee16_interrupt_enable(sc)
1767 	struct ie_softc *sc;
1768 {
1769 	delay(100);
1770 	outb(PORT + IEE16_IRQ, sc->irq_encoded | IEE16_IRQ_ENABLE);
1771 	delay(100);
1772 }
1773 void
1774 slel_get_address(sc)
1775 	struct ie_softc *sc;
1776 {
1777 	u_char *addr = sc->sc_arpcom.ac_enaddr;
1778 	int i;
1779 
1780 	for (i = 0; i < ETHER_ADDR_LEN; i++)
1781 		addr[i] = inb(PORT + i);
1782 }
1783 
1784 void
1785 iereset(sc)
1786 	struct ie_softc *sc;
1787 {
1788 	int s = splnet();
1789 
1790 	iestop(sc);
1791 
1792 	/*
1793 	 * Stop i82586 dead in its tracks.
1794 	 */
1795 	if (command_and_wait(sc, IE_RU_ABORT | IE_CU_ABORT, 0, 0))
1796 		printf("%s: abort commands timed out\n", sc->sc_dev.dv_xname);
1797 
1798 	if (command_and_wait(sc, IE_RU_DISABLE | IE_CU_STOP, 0, 0))
1799 		printf("%s: disable commands timed out\n", sc->sc_dev.dv_xname);
1800 
1801 	ieinit(sc);
1802 
1803 	splx(s);
1804 }
1805 
1806 /*
1807  * Send a command to the controller and wait for it to either complete or be
1808  * accepted, depending on the command.  If the command pointer is null, then
1809  * pretend that the command is not an action command.  If the command pointer
1810  * is not null, and the command is an action command, wait for
1811  * ((volatile struct ie_cmd_common *)pcmd)->ie_cmd_status & MASK
1812  * to become true.
1813  */
1814 static int
1815 command_and_wait(sc, cmd, pcmd, mask)
1816 	struct ie_softc *sc;
1817 	int cmd;
1818 	volatile void *pcmd;
1819 	int mask;
1820 {
1821 	volatile struct ie_cmd_common *cc = pcmd;
1822 	volatile struct ie_sys_ctl_block *scb = sc->scb;
1823 	int i;
1824 
1825 	scb->ie_command = (u_short)cmd;
1826 
1827 	if (IE_ACTION_COMMAND(cmd) && pcmd) {
1828 		(sc->chan_attn)(sc);
1829 
1830 		/*
1831 		 * According to the packet driver, the minimum timeout should
1832 		 * be .369 seconds, which we round up to .4.
1833 		 *
1834 		 * Now spin-lock waiting for status.  This is not a very nice
1835 		 * thing to do, but I haven't figured out how, or indeed if, we
1836 		 * can put the process waiting for action to sleep.  (We may
1837 		 * be getting called through some other timeout running in the
1838 		 * kernel.)
1839 		 */
1840 		for (i = 36900; i--; DELAY(10))
1841 			if ((cc->ie_cmd_status & mask))
1842 				break;
1843 
1844 		return i < 0;
1845 	} else {
1846 		/*
1847 		 * Otherwise, just wait for the command to be accepted.
1848 		 */
1849 		(sc->chan_attn)(sc);
1850 
1851 		while (scb->ie_command)
1852 			;				/* spin lock */
1853 
1854 		return 0;
1855 	}
1856 }
1857 
1858 /*
1859  * Run the time-domain reflectometer.
1860  */
1861 static void
1862 run_tdr(sc, cmd)
1863 	struct ie_softc *sc;
1864 	struct ie_tdr_cmd *cmd;
1865 {
1866 	int result;
1867 
1868 	cmd->com.ie_cmd_status = 0;
1869 	cmd->com.ie_cmd_cmd = IE_CMD_TDR | IE_CMD_LAST;
1870 	cmd->com.ie_cmd_link = 0xffff;
1871 
1872 	sc->scb->ie_command_list = MK_16(MEM, cmd);
1873 	cmd->ie_tdr_time = 0;
1874 
1875 	if (command_and_wait(sc, IE_CU_START, cmd, IE_STAT_COMPL) ||
1876 	    !(cmd->com.ie_cmd_status & IE_STAT_OK))
1877 		result = 0x10000;
1878 	else
1879 		result = cmd->ie_tdr_time;
1880 
1881 	ie_ack(sc, IE_ST_WHENCE);
1882 
1883 	if (result & IE_TDR_SUCCESS)
1884 		return;
1885 
1886 	if (result & 0x10000)
1887 		printf("%s: TDR command failed\n", sc->sc_dev.dv_xname);
1888 	else if (result & IE_TDR_XCVR)
1889 		printf("%s: transceiver problem\n", sc->sc_dev.dv_xname);
1890 	else if (result & IE_TDR_OPEN)
1891 		printf("%s: TDR detected an open %d clocks away\n",
1892 		    sc->sc_dev.dv_xname, result & IE_TDR_TIME);
1893 	else if (result & IE_TDR_SHORT)
1894 		printf("%s: TDR detected a short %d clocks away\n",
1895 		    sc->sc_dev.dv_xname, result & IE_TDR_TIME);
1896 	else
1897 		printf("%s: TDR returned unknown status %x\n",
1898 		    sc->sc_dev.dv_xname, result);
1899 }
1900 
1901 #define	_ALLOC(p, n)	(bzero(p, n), p += n, p - n)
1902 #define	ALLOC(p, n)	_ALLOC(p, ALIGN(n))
1903 
1904 /*
1905  * Here is a helper routine for ieinit().  This sets up the buffers.
1906  */
1907 void
1908 iememinit(ptr, sc)
1909 	void *ptr;
1910 	struct ie_softc *sc;
1911 {
1912 	int i;
1913 
1914 	/* First lay them out. */
1915 	for (i = 0; i < NFRAMES; i++)
1916 		sc->rframes[i] = ALLOC(ptr, sizeof(*sc->rframes[i]));
1917 
1918 	/* Now link them together. */
1919 	for (i = 0; i < NFRAMES; i++)
1920 		sc->rframes[i]->ie_fd_next =
1921 		    MK_16(MEM, sc->rframes[(i + 1) % NFRAMES]);
1922 
1923 	/* Finally, set the EOL bit on the last one. */
1924 	sc->rframes[NFRAMES - 1]->ie_fd_last |= IE_FD_LAST;
1925 
1926 	/*
1927 	 * Now lay out some buffers for the incoming frames.  Note that we set
1928 	 * aside a bit of slop in each buffer, to make sure that we have enough
1929 	 * space to hold a single frame in every buffer.
1930 	 */
1931 	for (i = 0; i < NRXBUF; i++) {
1932 		sc->rbuffs[i] = ALLOC(ptr, sizeof(*sc->rbuffs[i]));
1933 		sc->rbuffs[i]->ie_rbd_length = IE_RBUF_SIZE;
1934 		sc->rbuffs[i]->ie_rbd_buffer = MK_24(MEM, ptr);
1935 		sc->cbuffs[i] = ALLOC(ptr, IE_RBUF_SIZE);
1936 	}
1937 
1938 	/* Now link them together. */
1939 	for (i = 0; i < NRXBUF; i++)
1940 		sc->rbuffs[i]->ie_rbd_next =
1941 		    MK_16(MEM, sc->rbuffs[(i + 1) % NRXBUF]);
1942 
1943 	/* Tag EOF on the last one. */
1944 	sc->rbuffs[NRXBUF - 1]->ie_rbd_length |= IE_RBD_LAST;
1945 
1946 	/*
1947 	 * We use the head and tail pointers on receive to keep track of the
1948 	 * order in which RFDs and RBDs are used.
1949 	 */
1950 	sc->rfhead = 0;
1951 	sc->rftail = NFRAMES - 1;
1952 	sc->rbhead = 0;
1953 	sc->rbtail = NRXBUF - 1;
1954 
1955 	sc->scb->ie_recv_list = MK_16(MEM, sc->rframes[0]);
1956 	sc->rframes[0]->ie_fd_buf_desc = MK_16(MEM, sc->rbuffs[0]);
1957 
1958 	/*
1959 	 * Finally, the transmit command and buffer are the last little bit of
1960 	 * work.
1961 	 */
1962 	for (i = 0; i < NTXBUF; i++) {
1963 		sc->xmit_cmds[i] = ALLOC(ptr, sizeof(*sc->xmit_cmds[i]));
1964 		sc->xmit_buffs[i] = ALLOC(ptr, sizeof(*sc->xmit_buffs[i]));
1965 	}
1966 
1967 	for (i = 0; i < NTXBUF; i++)
1968 		sc->xmit_cbuffs[i] = ALLOC(ptr, IE_TBUF_SIZE);
1969 
1970 	/* Pointers to last packet sent and next available transmit buffer. */
1971 	sc->xchead = sc->xctail = 0;
1972 
1973 	/* Clear transmit-busy flag and set number of free transmit buffers. */
1974 	sc->xmit_busy = 0;
1975 }
1976 
1977 /*
1978  * Run the multicast setup command.
1979  * Called at splnet().
1980  */
1981 static int
1982 mc_setup(sc, ptr)
1983 	struct ie_softc *sc;
1984 	void *ptr;
1985 {
1986 	volatile struct ie_mcast_cmd *cmd = ptr;
1987 
1988 	cmd->com.ie_cmd_status = 0;
1989 	cmd->com.ie_cmd_cmd = IE_CMD_MCAST | IE_CMD_LAST;
1990 	cmd->com.ie_cmd_link = 0xffff;
1991 
1992 	bcopy((caddr_t)sc->mcast_addrs, (caddr_t)cmd->ie_mcast_addrs,
1993 	    sc->mcast_count * sizeof *sc->mcast_addrs);
1994 
1995 	cmd->ie_mcast_bytes = sc->mcast_count * ETHER_ADDR_LEN; /* grrr... */
1996 
1997 	sc->scb->ie_command_list = MK_16(MEM, cmd);
1998 	if (command_and_wait(sc, IE_CU_START, cmd, IE_STAT_COMPL) ||
1999 	    !(cmd->com.ie_cmd_status & IE_STAT_OK)) {
2000 		printf("%s: multicast address setup command failed\n",
2001 		    sc->sc_dev.dv_xname);
2002 		return 0;
2003 	}
2004 	return 1;
2005 }
2006 
2007 /*
2008  * This routine takes the environment generated by check_ie_present() and adds
2009  * to it all the other structures we need to operate the adapter.  This
2010  * includes executing the CONFIGURE, IA-SETUP, and MC-SETUP commands, starting
2011  * the receiver unit, and clearing interrupts.
2012  *
2013  * THIS ROUTINE MUST BE CALLED AT splnet() OR HIGHER.
2014  */
2015 int
2016 ieinit(sc)
2017 	struct ie_softc *sc;
2018 {
2019 	volatile struct ie_sys_ctl_block *scb = sc->scb;
2020 	void *ptr;
2021 
2022 	ptr = (void *)ALIGN(scb + 1);
2023 
2024 	/*
2025 	 * Send the configure command first.
2026 	 */
2027 	{
2028 		volatile struct ie_config_cmd *cmd = ptr;
2029 
2030 		scb->ie_command_list = MK_16(MEM, cmd);
2031 		cmd->com.ie_cmd_status = 0;
2032 		cmd->com.ie_cmd_cmd = IE_CMD_CONFIG | IE_CMD_LAST;
2033 		cmd->com.ie_cmd_link = 0xffff;
2034 
2035 		ie_setup_config(cmd, sc->promisc != 0,
2036 		    sc->hard_type == IE_STARLAN10);
2037 
2038 		if (command_and_wait(sc, IE_CU_START, cmd, IE_STAT_COMPL) ||
2039 		    !(cmd->com.ie_cmd_status & IE_STAT_OK)) {
2040 			printf("%s: configure command failed\n",
2041 			    sc->sc_dev.dv_xname);
2042 			return 0;
2043 		}
2044 	}
2045 
2046 	/*
2047 	 * Now send the Individual Address Setup command.
2048 	 */
2049 	{
2050 		volatile struct ie_iasetup_cmd *cmd = ptr;
2051 
2052 		scb->ie_command_list = MK_16(MEM, cmd);
2053 		cmd->com.ie_cmd_status = 0;
2054 		cmd->com.ie_cmd_cmd = IE_CMD_IASETUP | IE_CMD_LAST;
2055 		cmd->com.ie_cmd_link = 0xffff;
2056 
2057 		bcopy(sc->sc_arpcom.ac_enaddr, (caddr_t)&cmd->ie_address,
2058 		    sizeof cmd->ie_address);
2059 
2060 		if (command_and_wait(sc, IE_CU_START, cmd, IE_STAT_COMPL) ||
2061 		    !(cmd->com.ie_cmd_status & IE_STAT_OK)) {
2062 			printf("%s: individual address setup command failed\n",
2063 			    sc->sc_dev.dv_xname);
2064 			return 0;
2065 		}
2066 	}
2067 
2068 	/*
2069 	 * Now run the time-domain reflectometer.
2070 	 */
2071 	run_tdr(sc, ptr);
2072 
2073 	/*
2074 	 * Acknowledge any interrupts we have generated thus far.
2075 	 */
2076 	ie_ack(sc, IE_ST_WHENCE);
2077 
2078 	/*
2079 	 * Set up the RFA.
2080 	 */
2081 	iememinit(ptr, sc);
2082 
2083 	sc->sc_arpcom.ac_if.if_flags |= IFF_RUNNING;
2084 	sc->sc_arpcom.ac_if.if_flags &= ~IFF_OACTIVE;
2085 
2086 	sc->scb->ie_recv_list = MK_16(MEM, sc->rframes[0]);
2087 	command_and_wait(sc, IE_RU_START, 0, 0);
2088 
2089 	ie_ack(sc, IE_ST_WHENCE);
2090 
2091 	/* take the ee16 out of loopback */
2092 	{
2093 	u_char	bart_config;
2094 
2095 	if(sc->hard_type == IE_EE16) {
2096 		bart_config = inb(PORT + IEE16_CONFIG);
2097 		bart_config &= ~IEE16_BART_LOOPBACK;
2098 		bart_config |= IEE16_BART_MCS16_TEST; /* inb doesn't get bit! */
2099 		outb(PORT + IEE16_CONFIG, bart_config);
2100 		ee16_interrupt_enable(sc);
2101 		ee16_chan_attn(sc);
2102 		}
2103 	}
2104 	return 0;
2105 }
2106 
2107 void
2108 iestop(sc)
2109 	struct ie_softc *sc;
2110 {
2111 
2112 	command_and_wait(sc, IE_RU_DISABLE, 0, 0);
2113 }
2114 
2115 int
2116 ieioctl(ifp, cmd, data)
2117 	register struct ifnet *ifp;
2118 	u_long cmd;
2119 	caddr_t data;
2120 {
2121 	struct ie_softc *sc = ifp->if_softc;
2122 	struct ifaddr *ifa = (struct ifaddr *)data;
2123 	int s, error = 0;
2124 
2125 	s = splnet();
2126 
2127 	switch (cmd) {
2128 	case SIOCSIFADDR:
2129 		ifp->if_flags |= IFF_UP;
2130 
2131 		switch (ifa->ifa_addr->sa_family) {
2132 #ifdef INET
2133 		case AF_INET:
2134 			ieinit(sc);
2135 			arp_ifinit(&sc->sc_arpcom, ifa);
2136 			break;
2137 #endif
2138 		default:
2139 			ieinit(sc);
2140 			break;
2141 		}
2142 		break;
2143 
2144 	case SIOCSIFFLAGS:
2145 		sc->promisc = ifp->if_flags & (IFF_PROMISC | IFF_ALLMULTI);
2146 		if ((ifp->if_flags & IFF_UP) == 0 &&
2147 		    (ifp->if_flags & IFF_RUNNING) != 0) {
2148 			/*
2149 			 * If interface is marked down and it is running, then
2150 			 * stop it.
2151 			 */
2152 			iestop(sc);
2153 			ifp->if_flags &= ~IFF_RUNNING;
2154 		} else if ((ifp->if_flags & IFF_UP) != 0 &&
2155 			   (ifp->if_flags & IFF_RUNNING) == 0) {
2156 			/*
2157 			 * If interface is marked up and it is stopped, then
2158 			 * start it.
2159 			 */
2160 			ieinit(sc);
2161 		} else {
2162 			/*
2163 			 * Reset the interface to pick up changes in any other
2164 			 * flags that affect hardware registers.
2165 			 */
2166 			iestop(sc);
2167 			ieinit(sc);
2168 		}
2169 #ifdef IEDEBUG
2170 		if (ifp->if_flags & IFF_DEBUG)
2171 			sc->sc_debug = IED_ALL;
2172 		else
2173 			sc->sc_debug = 0;
2174 #endif
2175 		break;
2176 
2177 	default:
2178 		error = ether_ioctl(ifp, &sc->sc_arpcom, cmd, data);
2179 	}
2180 
2181 	if (error == ENETRESET) {
2182 		if (ifp->if_flags & IFF_RUNNING)
2183 			mc_reset(sc);
2184 		error = 0;
2185 	}
2186 
2187 	splx(s);
2188 	return error;
2189 }
2190 
2191 static void
2192 mc_reset(sc)
2193 	struct ie_softc *sc;
2194 {
2195 	struct arpcom *ac = &sc->sc_arpcom;
2196 	struct ether_multi *enm;
2197 	struct ether_multistep step;
2198 
2199 	if (ac->ac_multirangecnt > 0) {
2200 		ac->ac_if.if_flags |= IFF_ALLMULTI;
2201 		ieioctl(&ac->ac_if, SIOCSIFFLAGS, (void *)0);
2202 		goto setflag;
2203 	}
2204 	/*
2205 	 * Step through the list of addresses.
2206 	 */
2207 	sc->mcast_count = 0;
2208 	ETHER_FIRST_MULTI(step, ac, enm);
2209 	while (enm) {
2210 		if (sc->mcast_count >= MAXMCAST) {
2211 			ac->ac_if.if_flags |= IFF_ALLMULTI;
2212 			ieioctl(&ac->ac_if, SIOCSIFFLAGS, (void *)0);
2213 			goto setflag;
2214 		}
2215 
2216 		bcopy(enm->enm_addrlo, &sc->mcast_addrs[sc->mcast_count], 6);
2217 		sc->mcast_count++;
2218 		ETHER_NEXT_MULTI(step, enm);
2219 	}
2220 setflag:
2221 	sc->want_mcsetup = 1;
2222 }
2223 
2224 #ifdef IEDEBUG
2225 void
2226 print_rbd(rbd)
2227 	volatile struct ie_recv_buf_desc *rbd;
2228 {
2229 
2230 	printf("RBD at %08lx:\nactual %04x, next %04x, buffer %08x\n"
2231 	    "length %04x, mbz %04x\n", (u_long)rbd, rbd->ie_rbd_actual,
2232 	    rbd->ie_rbd_next, rbd->ie_rbd_buffer, rbd->ie_rbd_length,
2233 	    rbd->mbz);
2234 }
2235 #endif
2236 
2237