xref: /openbsd/sys/dev/isa/if_ie.c (revision fc61954a)
1 /*	$OpenBSD: if_ie.c,v 1.52 2016/04/13 10:49:26 mpi Exp $	*/
2 /*	$NetBSD: if_ie.c,v 1.51 1996/05/12 23:52:48 mycroft Exp $	*/
3 
4 /*-
5  * Copyright (c) 1993, 1994, 1995 Charles Hannum.
6  * Copyright (c) 1992, 1993, University of Vermont and State
7  *  Agricultural College.
8  * Copyright (c) 1992, 1993, Garrett A. Wollman.
9  *
10  * Portions:
11  * Copyright (c) 1993, 1994, 1995, Rodney W. Grimes
12  * Copyright (c) 1994, 1995, Rafal K. Boni
13  * Copyright (c) 1990, 1991, William F. Jolitz
14  * Copyright (c) 1990, The Regents of the University of California
15  *
16  * All rights reserved.
17  *
18  * Redistribution and use in source and binary forms, with or without
19  * modification, are permitted provided that the following conditions
20  * are met:
21  * 1. Redistributions of source code must retain the above copyright
22  *    notice, this list of conditions and the following disclaimer.
23  * 2. Redistributions in binary form must reproduce the above copyright
24  *    notice, this list of conditions and the following disclaimer in the
25  *    documentation and/or other materials provided with the distribution.
26  * 3. All advertising materials mentioning features or use of this software
27  *    must display the following acknowledgement:
28  *	This product includes software developed by Charles Hannum, by the
29  *	University of Vermont and State Agricultural College and Garrett A.
30  *	Wollman, by William F. Jolitz, and by the University of California,
31  *	Berkeley, Lawrence Berkeley Laboratory, and its contributors.
32  * 4. Neither the names of the Universities nor the names of the authors
33  *    may be used to endorse or promote products derived from this software
34  *    without specific prior written permission.
35  *
36  * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
37  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
38  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
39  * ARE DISCLAIMED.  IN NO EVENT SHALL THE UNIVERSITY OR AUTHORS BE LIABLE
40  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
41  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
42  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
43  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
44  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
45  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
46  * SUCH DAMAGE.
47  */
48 
49 /*
50  * Intel 82586 Ethernet chip
51  * Register, bit, and structure definitions.
52  *
53  * Original StarLAN driver written by Garrett Wollman with reference to the
54  * Clarkson Packet Driver code for this chip written by Russ Nelson and others.
55  *
56  * BPF support code taken from hpdev/if_le.c, supplied with tcpdump.
57  *
58  * 3C507 support is loosely based on code donated to NetBSD by Rafal Boni.
59  *
60  * Intel EtherExpress 16 support taken from FreeBSD's if_ix.c, written
61  * by Rodney W. Grimes.
62  *
63  * Majorly cleaned up and 3C507 code merged by Charles Hannum.
64  */
65 
66 /*
67  * The i82586 is a very versatile chip, found in many implementations.
68  * Programming this chip is mostly the same, but certain details differ
69  * from card to card.  This driver is written so that different cards
70  * can be automatically detected at run-time.
71  */
72 
73 /*
74 Mode of operation:
75 
76 We run the 82586 in a standard Ethernet mode.  We keep NFRAMES received frame
77 descriptors around for the receiver to use, and NRXBUF associated receive
78 buffer descriptors, both in a circular list.  Whenever a frame is received, we
79 rotate both lists as necessary.  (The 586 treats both lists as a simple
80 queue.)  We also keep a transmit command around so that packets can be sent
81 off quickly.
82 
83 We configure the adapter in AL-LOC = 1 mode, which means that the
84 Ethernet/802.3 MAC header is placed at the beginning of the receive buffer
85 rather than being split off into various fields in the RFD.  This also means
86 that we must include this header in the transmit buffer as well.
87 
88 By convention, all transmit commands, and only transmit commands, shall have
89 the I (IE_CMD_INTR) bit set in the command.  This way, when an interrupt
90 arrives at ieintr(), it is immediately possible to tell what precisely caused
91 it.  ANY OTHER command-sending routines should run at splnet(), and should
92 post an acknowledgement to every interrupt they generate.
93 
94 The 82586 has a 24-bit address space internally, and the adaptor's memory is
95 located at the top of this region.  However, the value we are given in
96 configuration is the CPU's idea of where the adaptor RAM is.  So, we must go
97 through a few gyrations to come up with a kernel virtual address which
98 represents the actual beginning of the 586 address space.  First, we autosize
99 the RAM by running through several possible sizes and trying to initialize the
100 adapter under the assumption that the selected size is correct.  Then, knowing
101 the correct RAM size, we set up our pointers in the softc.  `sc_maddr'
102 represents the computed base of the 586 address space.  `iomembot' represents
103 the actual configured base of adapter RAM.  Finally, `sc_msize' represents the
104 calculated size of 586 RAM.  Then, when laying out commands, we use the
105 interval [sc_maddr, sc_maddr + sc_msize); to make 24-pointers, we subtract
106 iomem, and to make 16-pointers, we subtract sc_maddr and and with 0xffff.
107 */
108 
109 #include "bpfilter.h"
110 
111 #include <sys/param.h>
112 #include <sys/systm.h>
113 #include <sys/mbuf.h>
114 #include <sys/buf.h>
115 #include <sys/protosw.h>
116 #include <sys/socket.h>
117 #include <sys/ioctl.h>
118 #include <sys/errno.h>
119 #include <sys/syslog.h>
120 #include <sys/device.h>
121 #include <sys/timeout.h>
122 
123 #include <net/if.h>
124 
125 #if NBPFILTER > 0
126 #include <net/bpf.h>
127 #endif
128 
129 #include <netinet/in.h>
130 #include <netinet/if_ether.h>
131 
132 #include <machine/cpu.h>
133 #include <machine/bus.h>
134 #include <machine/intr.h>
135 
136 #include <dev/isa/isareg.h>
137 #include <dev/isa/isavar.h>
138 #include <i386/isa/isa_machdep.h>	/* XXX USES ISA HOLE DIRECTLY */
139 #include <dev/ic/i82586reg.h>
140 #include <dev/isa/if_ieatt.h>
141 #include <dev/isa/if_ie507.h>
142 #include <dev/isa/if_iee16.h>
143 #include <dev/isa/elink.h>
144 
145 #define	IED_RINT	0x01
146 #define	IED_TINT	0x02
147 #define	IED_RNR		0x04
148 #define	IED_CNA		0x08
149 #define	IED_READFRAME	0x10
150 #define	IED_ENQ		0x20
151 #define	IED_XMIT	0x40
152 #define	IED_ALL		0x7f
153 
154 /*
155 sizeof(iscp) == 1+1+2+4 == 8
156 sizeof(scb) == 2+2+2+2+2+2+2+2 == 16
157 NFRAMES * sizeof(rfd) == NFRAMES*(2+2+2+2+6+6+2+2) == NFRAMES*24 == 384
158 sizeof(xmit_cmd) == 2+2+2+2+6+2 == 18
159 sizeof(transmit buffer) == ETHER_MAX_LEN == 1518
160 sizeof(transmit buffer desc) == 8
161 -----
162 1952
163 
164 NRXBUF * sizeof(rbd) == NRXBUF*(2+2+4+2+2) == NRXBUF*12
165 NRXBUF * IE_RBUF_SIZE == NRXBUF*256
166 
167 NRXBUF should be (16384 - 1952) / (256 + 12) == 14432 / 268 == 53
168 
169 With NRXBUF == 48, this leaves us 1568 bytes for another command or
170 more buffers.  Another transmit command would be 18+8+1518 == 1544
171 ---just barely fits!
172 
173 Obviously all these would have to be reduced for smaller memory sizes.
174 With a larger memory, it would be possible to roughly double the number of
175 both transmit and receive buffers.
176 */
177 
178 #define	NFRAMES		16		/* number of receive frames */
179 #define	NRXBUF		48		/* number of buffers to allocate */
180 #define	IE_RBUF_SIZE	256		/* size of each receive buffer;
181 						MUST BE POWER OF TWO */
182 #define	NTXBUF		2		/* number of transmit commands */
183 #define	IE_TBUF_SIZE	ETHER_MAX_LEN	/* length of transmit buffer */
184 
185 
186 enum ie_hardware {
187 	IE_STARLAN10,
188 	IE_EN100,
189 	IE_SLFIBER,
190 	IE_3C507,
191 	IE_EE16,
192 	IE_UNKNOWN
193 };
194 
195 const char *ie_hardware_names[] = {
196 	"StarLAN 10",
197 	"EN100",
198 	"StarLAN Fiber",
199 	"3C507",
200 	"EtherExpress 16",
201 	"Unknown"
202 };
203 
204 /*
205  * Ethernet status, per interface.
206  */
207 struct ie_softc {
208 	struct device sc_dev;
209 	void *sc_ih;
210 
211 	int sc_iobase;
212 	caddr_t sc_maddr;
213 	u_int sc_msize;
214 
215 	struct arpcom sc_arpcom;
216 
217 	void (*reset_586)(struct ie_softc *);
218 	void (*chan_attn)(struct ie_softc *);
219 
220 	enum ie_hardware hard_type;
221 	int hard_vers;
222 
223 	int want_mcsetup;
224 	int promisc;
225 	volatile struct ie_int_sys_conf_ptr *iscp;
226 	volatile struct ie_sys_ctl_block *scb;
227 
228 	int rfhead, rftail, rbhead, rbtail;
229 	volatile struct ie_recv_frame_desc *rframes[NFRAMES];
230 	volatile struct ie_recv_buf_desc *rbuffs[NRXBUF];
231 	volatile char *cbuffs[NRXBUF];
232 
233 	int xmit_busy;
234 	int xchead, xctail;
235 	volatile struct ie_xmit_cmd *xmit_cmds[NTXBUF];
236 	volatile struct ie_xmit_buf *xmit_buffs[NTXBUF];
237 	u_char *xmit_cbuffs[NTXBUF];
238 
239 	struct ie_en_addr mcast_addrs[MAXMCAST + 1];
240 	int mcast_count;
241 
242 	u_short	irq_encoded;		/* encoded interrupt on IEE16 */
243 
244 #ifdef IEDEBUG
245 	int sc_debug;
246 #endif
247 };
248 
249 void iewatchdog(struct ifnet *);
250 int ieintr(void *);
251 void iestop(struct ie_softc *);
252 int ieinit(struct ie_softc *);
253 int ieioctl(struct ifnet *, u_long, caddr_t);
254 void iestart(struct ifnet *);
255 static void el_reset_586(struct ie_softc *);
256 static void sl_reset_586(struct ie_softc *);
257 static void el_chan_attn(struct ie_softc *);
258 static void sl_chan_attn(struct ie_softc *);
259 static void slel_get_address(struct ie_softc *);
260 
261 static void ee16_reset_586(struct ie_softc *);
262 static void ee16_chan_attn(struct ie_softc *);
263 static void ee16_interrupt_enable(struct ie_softc *);
264 void ee16_eeprom_outbits(struct ie_softc *, int, int);
265 void ee16_eeprom_clock(struct ie_softc *, int);
266 u_short ee16_read_eeprom(struct ie_softc *, int);
267 int ee16_eeprom_inbits(struct ie_softc *);
268 
269 void iereset(struct ie_softc *);
270 void ie_readframe(struct ie_softc *, int);
271 void ie_drop_packet_buffer(struct ie_softc *);
272 void ie_find_mem_size(struct ie_softc *);
273 static int command_and_wait(struct ie_softc *, int,
274     void volatile *, int);
275 void ierint(struct ie_softc *);
276 void ietint(struct ie_softc *);
277 void iexmit(struct ie_softc *);
278 struct mbuf *ieget(struct ie_softc *, struct ether_header *);
279 void iememinit(void *, struct ie_softc *);
280 static int mc_setup(struct ie_softc *, void *);
281 static void mc_reset(struct ie_softc *);
282 
283 #ifdef IEDEBUG
284 void print_rbd(volatile struct ie_recv_buf_desc *);
285 
286 int in_ierint = 0;
287 int in_ietint = 0;
288 #endif
289 
290 int	ieprobe(struct device *, void *, void *);
291 void	ieattach(struct device *, struct device *, void *);
292 int	sl_probe(struct ie_softc *, struct isa_attach_args *);
293 int	el_probe(struct ie_softc *, struct isa_attach_args *);
294 int	ee16_probe(struct ie_softc *, struct isa_attach_args *);
295 int	check_ie_present(struct ie_softc *, caddr_t, u_int);
296 
297 static __inline void ie_setup_config(volatile struct ie_config_cmd *,
298     int, int);
299 static __inline void ie_ack(struct ie_softc *, u_int);
300 static __inline int ether_equal(u_char *, u_char *);
301 static __inline int check_eh(struct ie_softc *, struct ether_header *);
302 static __inline int ie_buflen(struct ie_softc *, int);
303 static __inline int ie_packet_len(struct ie_softc *);
304 
305 static void run_tdr(struct ie_softc *, struct ie_tdr_cmd *);
306 
307 struct cfattach ie_isa_ca = {
308 	sizeof(struct ie_softc), ieprobe, ieattach
309 };
310 
311 struct cfdriver ie_cd = {
312 	NULL, "ie", DV_IFNET
313 };
314 
315 #define MK_24(base, ptr) ((caddr_t)((u_long)ptr - (u_long)base))
316 #define MK_16(base, ptr) ((u_short)(u_long)MK_24(base, ptr))
317 
318 #define PORT	sc->sc_iobase
319 #define MEM 	sc->sc_maddr
320 
321 /*
322  * Here are a few useful functions.  We could have done these as macros, but
323  * since we have the inline facility, it makes sense to use that instead.
324  */
325 static __inline void
326 ie_setup_config(cmd, promiscuous, manchester)
327 	volatile struct ie_config_cmd *cmd;
328 	int promiscuous, manchester;
329 {
330 
331 	cmd->ie_config_count = 0x0c;
332 	cmd->ie_fifo = 8;
333 	cmd->ie_save_bad = 0x40;
334 	cmd->ie_addr_len = 0x2e;
335 	cmd->ie_priority = 0;
336 	cmd->ie_ifs = 0x60;
337 	cmd->ie_slot_low = 0;
338 	cmd->ie_slot_high = 0xf2;
339 	cmd->ie_promisc = promiscuous | manchester << 2;
340 	cmd->ie_crs_cdt = 0;
341 	cmd->ie_min_len = 64;
342 	cmd->ie_junk = 0xff;
343 }
344 
345 static __inline void
346 ie_ack(sc, mask)
347 	struct ie_softc *sc;
348 	u_int mask;
349 {
350 	volatile struct ie_sys_ctl_block *scb = sc->scb;
351 
352 	scb->ie_command = scb->ie_status & mask;
353 	(sc->chan_attn)(sc);
354 
355 	while (scb->ie_command)
356 		;		/* Spin Lock */
357 }
358 
359 int
360 ieprobe(parent, match, aux)
361 	struct device *parent;
362 	void *match, *aux;
363 {
364 	struct ie_softc *sc = match;
365 	struct isa_attach_args *ia = aux;
366 
367 	if (sl_probe(sc, ia))
368 		return 1;
369 	if (el_probe(sc, ia))
370 		return 1;
371 	if (ee16_probe(sc, ia))
372 		return 1;
373 	return 0;
374 }
375 
376 int
377 sl_probe(sc, ia)
378 	struct ie_softc *sc;
379 	struct isa_attach_args *ia;
380 {
381 	u_char c;
382 
383 	sc->sc_iobase = ia->ia_iobase;
384 
385 	/* Need this for part of the probe. */
386 	sc->reset_586 = sl_reset_586;
387 	sc->chan_attn = sl_chan_attn;
388 
389 	c = inb(PORT + IEATT_REVISION);
390 	switch (SL_BOARD(c)) {
391 	case SL10_BOARD:
392 		sc->hard_type = IE_STARLAN10;
393 		break;
394 	case EN100_BOARD:
395 		sc->hard_type = IE_EN100;
396 		break;
397 	case SLFIBER_BOARD:
398 		sc->hard_type = IE_SLFIBER;
399 		break;
400 
401 	default:
402 		/* Anything else is not recognized or cannot be used. */
403 #if 0
404 		printf("%s: unknown AT&T board type code %d\n",
405 		    sc->sc_dev.dv_xname, SL_BOARD(c));
406 #endif
407 		return 0;
408 	}
409 
410 	sc->hard_vers = SL_REV(c);
411 
412 	if (ia->ia_irq == IRQUNK || ia->ia_maddr == MADDRUNK) {
413 		printf("%s: %s does not have soft configuration\n",
414 		    sc->sc_dev.dv_xname, ie_hardware_names[sc->hard_type]);
415 		return 0;
416 	}
417 
418 	/*
419 	 * Divine memory size on-board the card.  Ususally 16k.
420 	 */
421 	sc->sc_maddr = ISA_HOLE_VADDR(ia->ia_maddr);
422 	ie_find_mem_size(sc);
423 
424 	if (!sc->sc_msize) {
425 		printf("%s: can't find shared memory\n", sc->sc_dev.dv_xname);
426 		return 0;
427 	}
428 
429 	if (!ia->ia_msize)
430 		ia->ia_msize = sc->sc_msize;
431 	else if (ia->ia_msize != sc->sc_msize) {
432 		printf("%s: msize mismatch; kernel configured %d != board configured %d\n",
433 		    sc->sc_dev.dv_xname, ia->ia_msize, sc->sc_msize);
434 		return 0;
435 	}
436 
437 	slel_get_address(sc);
438 
439 	ia->ia_iosize = 16;
440 	return 1;
441 }
442 
443 int
444 el_probe(sc, ia)
445 	struct ie_softc *sc;
446 	struct isa_attach_args *ia;
447 {
448 	bus_space_tag_t iot = ia->ia_iot;
449 	bus_space_handle_t ioh;
450 	u_char c;
451 	int i, rval = 0;
452 	u_char signature[] = "*3COM*";
453 
454 	sc->sc_iobase = ia->ia_iobase;
455 
456 	/* Need this for part of the probe. */
457 	sc->reset_586 = el_reset_586;
458 	sc->chan_attn = el_chan_attn;
459 
460 	/*
461 	 * Map the Etherlink ID port for the probe sequence.
462 	 */
463 	if (bus_space_map(iot, ELINK_ID_PORT, 1, 0, &ioh)) {
464 		printf("3c507 probe: can't map Etherlink ID port\n");
465 		return 0;
466 	}
467 
468 	/*
469 	 * Reset and put card in CONFIG state without changing address.
470 	 * XXX Indirect brokenness here!
471 	 */
472 	elink_reset(iot, ioh, sc->sc_dev.dv_parent->dv_unit);
473 	elink_idseq(iot, ioh, ELINK_507_POLY);
474 	elink_idseq(iot, ioh, ELINK_507_POLY);
475 	outb(ELINK_ID_PORT, 0xff);
476 
477 	/* Check for 3COM signature before proceeding. */
478 	outb(PORT + IE507_CTRL, inb(PORT + IE507_CTRL) & 0xfc);	/* XXX */
479 	for (i = 0; i < 6; i++)
480 		if (inb(PORT + i) != signature[i])
481 			goto out;
482 
483 	c = inb(PORT + IE507_MADDR);
484 	if (c & 0x20) {
485 		printf("%s: can't map 3C507 RAM in high memory\n",
486 		    sc->sc_dev.dv_xname);
487 		goto out;
488 	}
489 
490 	/* Go to RUN state. */
491 	outb(ELINK_ID_PORT, 0x00);
492 	elink_idseq(iot, ioh, ELINK_507_POLY);
493 	outb(ELINK_ID_PORT, 0x00);
494 
495 	/* Set bank 2 for version info and read BCD version byte. */
496 	outb(PORT + IE507_CTRL, EL_CTRL_NRST | EL_CTRL_BNK2);
497 	i = inb(PORT + 3);
498 
499 	sc->hard_type = IE_3C507;
500 	sc->hard_vers = 10*(i / 16) + (i % 16) - 1;
501 
502 	i = inb(PORT + IE507_IRQ) & 0x0f;
503 
504 	if (ia->ia_irq != IRQUNK) {
505 		if (ia->ia_irq != i) {
506 			printf("%s: irq mismatch; kernel configured %d != board configured %d\n",
507 			    sc->sc_dev.dv_xname, ia->ia_irq, i);
508 			goto out;
509 		}
510 	} else
511 		ia->ia_irq = i;
512 
513 	i = ((inb(PORT + IE507_MADDR) & 0x1c) << 12) + 0xc0000;
514 
515 	if (ia->ia_maddr != MADDRUNK) {
516 		if (ia->ia_maddr != i) {
517 			printf("%s: maddr mismatch; kernel configured %x != board configured %x\n",
518 			    sc->sc_dev.dv_xname, ia->ia_maddr, i);
519 			goto out;
520 		}
521 	} else
522 		ia->ia_maddr = i;
523 
524 	outb(PORT + IE507_CTRL, EL_CTRL_NORMAL);
525 
526 	/*
527 	 * Divine memory size on-board the card.
528 	 */
529 	sc->sc_maddr = ISA_HOLE_VADDR(ia->ia_maddr);
530 	ie_find_mem_size(sc);
531 
532 	if (!sc->sc_msize) {
533 		printf("%s: can't find shared memory\n", sc->sc_dev.dv_xname);
534 		outb(PORT + IE507_CTRL, EL_CTRL_NRST);
535 		goto out;
536 	}
537 
538 	if (!ia->ia_msize)
539 		ia->ia_msize = sc->sc_msize;
540 	else if (ia->ia_msize != sc->sc_msize) {
541 		printf("%s: msize mismatch; kernel configured %d != board configured %d\n",
542 		    sc->sc_dev.dv_xname, ia->ia_msize, sc->sc_msize);
543 		outb(PORT + IE507_CTRL, EL_CTRL_NRST);
544 		goto out;
545 	}
546 
547 	slel_get_address(sc);
548 
549 	/* Clear the interrupt latch just in case. */
550 	outb(PORT + IE507_ICTRL, 1);
551 
552 	ia->ia_iosize = 16;
553 	rval = 1;
554 
555  out:
556 	bus_space_unmap(iot, ioh, 1);
557 	return rval;
558 }
559 
560 /* Taken almost exactly from Rod's if_ix.c. */
561 
562 int
563 ee16_probe(sc, ia)
564 	struct ie_softc *sc;
565 	struct isa_attach_args *ia;
566 {
567 	int i;
568 	u_short board_id, id_var1, id_var2, checksum = 0;
569 	u_short eaddrtemp, irq;
570         u_short pg, adjust, decode, edecode;
571 	u_char	bart_config;
572 
573 	short	irq_translate[] = {0, 0x09, 0x03, 0x04, 0x05, 0x0a, 0x0b, 0};
574 
575 	/* Need this for part of the probe. */
576 	sc->reset_586 = ee16_reset_586;
577 	sc->chan_attn = ee16_chan_attn;
578 
579 	/* reset any ee16 at the current iobase */
580 	outb(ia->ia_iobase + IEE16_ECTRL, IEE16_RESET_ASIC);
581 	outb(ia->ia_iobase + IEE16_ECTRL, 0);
582 	delay(240);
583 
584 	/* now look for ee16. */
585 	board_id = id_var1 = id_var2 = 0;
586 	for (i=0; i<4 ; i++) {
587 		id_var1 = inb(ia->ia_iobase + IEE16_ID_PORT);
588 		id_var2 = ((id_var1 & 0x03) << 2);
589 		board_id |= (( id_var1 >> 4)  << id_var2);
590 		}
591 
592 	if (board_id != IEE16_ID)
593 		return 0;
594 
595 	/* need sc->sc_iobase for ee16_read_eeprom */
596 	sc->sc_iobase = ia->ia_iobase;
597 	sc->hard_type = IE_EE16;
598 
599 	/*
600 	 * If ia->maddr == MADDRUNK, use value in eeprom location 6.
601 	 *
602 	 * The shared RAM location on the EE16 is encoded into bits
603 	 * 3-7 of EEPROM location 6.  We zero the upper byte, and
604 	 * shift the 5 bits right 3.  The resulting number tells us
605 	 * the RAM location.  Because the EE16 supports either 16k or 32k
606 	 * of shared RAM, we only worry about the 32k locations.
607 	 *
608 	 * NOTE: if a 64k EE16 exists, it should be added to this switch.
609 	 *       then the ia->ia_msize would need to be set per case statement.
610 	 *
611 	 *	value	msize	location
612 	 *	=====	=====	========
613 	 *	0x03	0x8000	0xCC000
614 	 *	0x06	0x8000	0xD0000
615 	 *	0x0C	0x8000	0xD4000
616 	 *	0x18	0x8000	0xD8000
617 	 *
618 	 */
619 
620 	if ((ia->ia_maddr == MADDRUNK) || (ia->ia_msize == 0)) {
621 		i = (ee16_read_eeprom(sc, 6) & 0x00ff ) >> 3;
622 		switch(i) {
623 			case 0x03:
624 				ia->ia_maddr = 0xCC000;
625 				break;
626 			case 0x06:
627 				ia->ia_maddr = 0xD0000;
628 				break;
629 			case 0x0c:
630 				ia->ia_maddr = 0xD4000;
631 				break;
632 			case 0x18:
633 				ia->ia_maddr = 0xD8000;
634 				break;
635 			default:
636 				return 0 ;
637 				break; /* NOTREACHED */
638 		}
639 		ia->ia_msize = 0x8000;
640 	}
641 
642 	/* need to set these after checking for MADDRUNK */
643 	sc->sc_maddr = ISA_HOLE_VADDR(ia->ia_maddr);
644 	sc->sc_msize = ia->ia_msize;
645 
646 	/* need to put the 586 in RESET, and leave it */
647 	outb( PORT + IEE16_ECTRL, IEE16_RESET_586);
648 
649 	/* read the eeprom and checksum it, should == IEE16_ID */
650 	for(i=0 ; i< 0x40 ; i++)
651 		checksum += ee16_read_eeprom(sc, i);
652 
653 	if (checksum != IEE16_ID)
654 		return 0;
655 
656 	/*
657 	 * Size and test the memory on the board.  The size of the memory
658 	 * can be one of 16k, 32k, 48k or 64k.  It can be located in the
659 	 * address range 0xC0000 to 0xEFFFF on 16k boundaries.
660 	 *
661 	 * If the size does not match the passed in memory allocation size
662 	 * issue a warning, but continue with the minimum of the two sizes.
663 	 */
664 
665 	switch (ia->ia_msize) {
666 		case 65536:
667 		case 32768: /* XXX Only support 32k and 64k right now */
668 			break;
669 		case 16384:
670 		case 49512:
671 		default:
672 			printf("ieprobe mapped memory size out of range\n");
673 			return 0;
674 			break; /* NOTREACHED */
675 	}
676 
677 	if ((kvtop(sc->sc_maddr) < 0xC0000) ||
678 	    (kvtop(sc->sc_maddr) + sc->sc_msize > 0xF0000)) {
679 		printf("ieprobe mapped memory address out of range\n");
680 		return 0;
681 	}
682 
683 	pg = (kvtop(sc->sc_maddr) & 0x3C000) >> 14;
684 	adjust = IEE16_MCTRL_FMCS16 | (pg & 0x3) << 2;
685 	decode = ((1 << (sc->sc_msize / 16384)) - 1) << pg;
686 	edecode = ((~decode >> 4) & 0xF0) | (decode >> 8);
687 
688 	/* ZZZ This should be checked against eeprom location 6, low byte */
689 	outb(PORT + IEE16_MEMDEC, decode & 0xFF);
690 	/* ZZZ This should be checked against eeprom location 1, low byte */
691 	outb(PORT + IEE16_MCTRL, adjust);
692 	/* ZZZ Now if I could find this one I would have it made */
693 	outb(PORT + IEE16_MPCTRL, (~decode & 0xFF));
694 	/* ZZZ I think this is location 6, high byte */
695 	outb(PORT + IEE16_MECTRL, edecode); /*XXX disable Exxx */
696 
697 	/*
698 	 * first prime the stupid bart DRAM controller so that it
699 	 * works, then zero out all of memory.
700 	 */
701 	bzero(sc->sc_maddr, 32);
702 	bzero(sc->sc_maddr, sc->sc_msize);
703 
704 	/*
705 	 * Get the encoded interrupt number from the EEPROM, check it
706 	 * against the passed in IRQ.  Issue a warning if they do not
707 	 * match, and fail the probe.  If irq is 'IRQUNK' then we
708 	 * use the EEPROM irq, and continue.
709 	 */
710 	irq = ee16_read_eeprom(sc, IEE16_EEPROM_CONFIG1);
711 	irq = (irq & IEE16_EEPROM_IRQ) >> IEE16_EEPROM_IRQ_SHIFT;
712 	sc->irq_encoded = irq;
713 	irq = irq_translate[irq];
714 	if (ia->ia_irq != IRQUNK) {
715 		if (irq != ia->ia_irq) {
716 #ifdef DIAGNOSTIC
717 			printf("\nie%d: fatal: board IRQ %d does not match kernel\n", sc->sc_dev.dv_unit, irq);
718 #endif /* DIAGNOSTIC */
719 			return 0; 	/* _must_ match or probe fails */
720 		}
721 	} else
722 		ia->ia_irq = irq;
723 
724 	/*
725 	 * Get the hardware ethernet address from the EEPROM and
726 	 * save it in the softc for use by the 586 setup code.
727 	 */
728 	eaddrtemp = ee16_read_eeprom(sc, IEE16_EEPROM_ENET_HIGH);
729 	sc->sc_arpcom.ac_enaddr[1] = eaddrtemp & 0xFF;
730 	sc->sc_arpcom.ac_enaddr[0] = eaddrtemp >> 8;
731 	eaddrtemp = ee16_read_eeprom(sc, IEE16_EEPROM_ENET_MID);
732 	sc->sc_arpcom.ac_enaddr[3] = eaddrtemp & 0xFF;
733 	sc->sc_arpcom.ac_enaddr[2] = eaddrtemp >> 8;
734 	eaddrtemp = ee16_read_eeprom(sc, IEE16_EEPROM_ENET_LOW);
735 	sc->sc_arpcom.ac_enaddr[5] = eaddrtemp & 0xFF;
736 	sc->sc_arpcom.ac_enaddr[4] = eaddrtemp >> 8;
737 
738 	/* disable the board interrupts */
739 	outb(PORT + IEE16_IRQ, sc->irq_encoded);
740 
741 	/* enable loopback to keep bad packets off the wire */
742 	if(sc->hard_type == IE_EE16) {
743 		bart_config = inb(PORT + IEE16_CONFIG);
744 		bart_config |= IEE16_BART_LOOPBACK;
745 		bart_config |= IEE16_BART_MCS16_TEST; /* inb doesn't get bit! */
746 		outb(PORT + IEE16_CONFIG, bart_config);
747 		bart_config = inb(PORT + IEE16_CONFIG);
748 	}
749 
750 	outb(PORT + IEE16_ECTRL, 0);
751 	delay(100);
752 	if (!check_ie_present(sc, sc->sc_maddr, sc->sc_msize))
753 		return 0;
754 
755 	ia->ia_iosize = 16;	/* the number of I/O ports */
756 	return 1;		/* found */
757 }
758 
759 /*
760  * Taken almost exactly from Bill's if_is.c, then modified beyond recognition.
761  */
762 void
763 ieattach(parent, self, aux)
764 	struct device *parent, *self;
765 	void *aux;
766 {
767 	struct ie_softc *sc = (void *)self;
768 	struct isa_attach_args *ia = aux;
769 	struct ifnet *ifp = &sc->sc_arpcom.ac_if;
770 
771 	bcopy(sc->sc_dev.dv_xname, ifp->if_xname, IFNAMSIZ);
772 	ifp->if_softc = sc;
773 	ifp->if_start = iestart;
774 	ifp->if_ioctl = ieioctl;
775 	ifp->if_watchdog = iewatchdog;
776 	ifp->if_flags =
777 	    IFF_BROADCAST | IFF_SIMPLEX | IFF_MULTICAST;
778 
779 	/* Attach the interface. */
780 	if_attach(ifp);
781 	ether_ifattach(ifp);
782 
783 	printf(": address %s, type %s R%d\n",
784 	    ether_sprintf(sc->sc_arpcom.ac_enaddr),
785 	    ie_hardware_names[sc->hard_type], sc->hard_vers + 1);
786 
787 	sc->sc_ih = isa_intr_establish(ia->ia_ic, ia->ia_irq, IST_EDGE,
788 	    IPL_NET, ieintr, sc, sc->sc_dev.dv_xname);
789 }
790 
791 /*
792  * Device timeout/watchdog routine.  Entered if the device neglects to generate
793  * an interrupt after a transmit has been started on it.
794  */
795 void
796 iewatchdog(ifp)
797 	struct ifnet *ifp;
798 {
799 	struct ie_softc *sc = ifp->if_softc;
800 
801 	log(LOG_ERR, "%s: device timeout\n", sc->sc_dev.dv_xname);
802 	++sc->sc_arpcom.ac_if.if_oerrors;
803 	iereset(sc);
804 }
805 
806 /*
807  * What to do upon receipt of an interrupt.
808  */
809 int
810 ieintr(arg)
811 	void *arg;
812 {
813 	struct ie_softc *sc = arg;
814 	register u_short status;
815 
816 	/* Clear the interrupt latch on the 3C507. */
817 	if (sc->hard_type == IE_3C507)
818 		outb(PORT + IE507_ICTRL, 1);
819 
820 	/* disable interrupts on the EE16. */
821 	if (sc->hard_type == IE_EE16)
822 		outb(PORT + IEE16_IRQ, sc->irq_encoded);
823 
824 	status = sc->scb->ie_status & IE_ST_WHENCE;
825 	if (status == 0)
826 		return 0;
827 
828 loop:
829 	/* Ack interrupts FIRST in case we receive more during the ISR. */
830 	ie_ack(sc, status);
831 
832 	if (status & (IE_ST_FR | IE_ST_RNR)) {
833 #ifdef IEDEBUG
834 		in_ierint++;
835 		if (sc->sc_debug & IED_RINT)
836 			printf("%s: rint\n", sc->sc_dev.dv_xname);
837 #endif
838 		ierint(sc);
839 #ifdef IEDEBUG
840 		in_ierint--;
841 #endif
842 	}
843 
844 	if (status & IE_ST_CX) {
845 #ifdef IEDEBUG
846 		in_ietint++;
847 		if (sc->sc_debug & IED_TINT)
848 			printf("%s: tint\n", sc->sc_dev.dv_xname);
849 #endif
850 		ietint(sc);
851 #ifdef IEDEBUG
852 		in_ietint--;
853 #endif
854 	}
855 
856 	if (status & IE_ST_RNR) {
857 		printf("%s: receiver not ready\n", sc->sc_dev.dv_xname);
858 		sc->sc_arpcom.ac_if.if_ierrors++;
859 		iereset(sc);
860 	}
861 
862 #ifdef IEDEBUG
863 	if ((status & IE_ST_CNA) && (sc->sc_debug & IED_CNA))
864 		printf("%s: cna\n", sc->sc_dev.dv_xname);
865 #endif
866 
867 	/* Clear the interrupt latch on the 3C507. */
868 	if (sc->hard_type == IE_3C507)
869 		outb(PORT + IE507_ICTRL, 1);
870 
871 	status = sc->scb->ie_status & IE_ST_WHENCE;
872 	if (status == 0) {
873 		/* enable interrupts on the EE16. */
874 		if (sc->hard_type == IE_EE16)
875 		    outb(PORT + IEE16_IRQ, sc->irq_encoded | IEE16_IRQ_ENABLE);
876 		return 1;
877 	}
878 
879 	goto loop;
880 }
881 
882 /*
883  * Process a received-frame interrupt.
884  */
885 void
886 ierint(sc)
887 	struct ie_softc *sc;
888 {
889 	volatile struct ie_sys_ctl_block *scb = sc->scb;
890 	int i, status;
891 	static int timesthru = 1024;
892 
893 	i = sc->rfhead;
894 	for (;;) {
895 		status = sc->rframes[i]->ie_fd_status;
896 
897 		if ((status & IE_FD_COMPLETE) && (status & IE_FD_OK)) {
898 			if (!--timesthru) {
899 				sc->sc_arpcom.ac_if.if_ierrors +=
900 				    scb->ie_err_crc + scb->ie_err_align +
901 				    scb->ie_err_resource + scb->ie_err_overrun;
902 				scb->ie_err_crc = scb->ie_err_align =
903 				    scb->ie_err_resource = scb->ie_err_overrun =
904 				    0;
905 				timesthru = 1024;
906 			}
907 			ie_readframe(sc, i);
908 		} else {
909 			if ((status & IE_FD_RNR) != 0 &&
910 			    (scb->ie_status & IE_RU_READY) == 0) {
911 				sc->rframes[0]->ie_fd_buf_desc =
912 						MK_16(MEM, sc->rbuffs[0]);
913 				scb->ie_recv_list = MK_16(MEM, sc->rframes[0]);
914 				command_and_wait(sc, IE_RU_START, 0, 0);
915 			}
916 			break;
917 		}
918 		i = (i + 1) % NFRAMES;
919 	}
920 }
921 
922 /*
923  * Process a command-complete interrupt.  These are only generated by the
924  * transmission of frames.  This routine is deceptively simple, since most of
925  * the real work is done by iestart().
926  */
927 void
928 ietint(sc)
929 	struct ie_softc *sc;
930 {
931 	struct ifnet *ifp = &sc->sc_arpcom.ac_if;
932 	int status;
933 
934 	ifp->if_timer = 0;
935 	ifq_clr_oactive(&ifp->if_snd);
936 
937 	status = sc->xmit_cmds[sc->xctail]->ie_xmit_status;
938 
939 	if (!(status & IE_STAT_COMPL) || (status & IE_STAT_BUSY))
940 		printf("ietint: command still busy!\n");
941 
942 	if (status & IE_STAT_OK) {
943 		ifp->if_opackets++;
944 		ifp->if_collisions += status & IE_XS_MAXCOLL;
945 	} else {
946 		ifp->if_oerrors++;
947 		/*
948 		 * XXX
949 		 * Check SQE and DEFERRED?
950 		 * What if more than one bit is set?
951 		 */
952 		if (status & IE_STAT_ABORT)
953 			printf("%s: send aborted\n", sc->sc_dev.dv_xname);
954 		else if (status & IE_XS_LATECOLL)
955 			printf("%s: late collision\n", sc->sc_dev.dv_xname);
956 		else if (status & IE_XS_NOCARRIER)
957 			printf("%s: no carrier\n", sc->sc_dev.dv_xname);
958 		else if (status & IE_XS_LOSTCTS)
959 			printf("%s: lost CTS\n", sc->sc_dev.dv_xname);
960 		else if (status & IE_XS_UNDERRUN)
961 			printf("%s: DMA underrun\n", sc->sc_dev.dv_xname);
962 		else if (status & IE_XS_EXCMAX) {
963 			printf("%s: too many collisions\n", sc->sc_dev.dv_xname);
964 			ifp->if_collisions += 16;
965 		}
966 	}
967 
968 	/*
969 	 * If multicast addresses were added or deleted while transmitting,
970 	 * mc_reset() set the want_mcsetup flag indicating that we should do
971 	 * it.
972 	 */
973 	if (sc->want_mcsetup) {
974 		mc_setup(sc, (caddr_t)sc->xmit_cbuffs[sc->xctail]);
975 		sc->want_mcsetup = 0;
976 	}
977 
978 	/* Done with the buffer. */
979 	sc->xmit_busy--;
980 	sc->xctail = (sc->xctail + 1) % NTXBUF;
981 
982 	/* Start the next packet, if any, transmitting. */
983 	if (sc->xmit_busy > 0)
984 		iexmit(sc);
985 
986 	iestart(ifp);
987 }
988 
989 /*
990  * Compare two Ether/802 addresses for equality, inlined and unrolled for
991  * speed.  I'd love to have an inline assembler version of this...
992  */
993 static __inline int
994 ether_equal(one, two)
995 	u_char *one, *two;
996 {
997 
998 	if (one[0] != two[0] || one[1] != two[1] || one[2] != two[2] ||
999 	    one[3] != two[3] || one[4] != two[4] || one[5] != two[5])
1000 		return 0;
1001 	return 1;
1002 }
1003 
1004 /*
1005  * Check for a valid address.
1006  * Return value is true if the packet is for us, and false otherwise.
1007  */
1008 static __inline int
1009 check_eh(sc, eh)
1010 	struct ie_softc *sc;
1011 	struct ether_header *eh;
1012 {
1013 	int i;
1014 
1015 	switch (sc->promisc) {
1016 	case IFF_ALLMULTI:
1017 		/*
1018 		 * Receiving all multicasts, but no unicasts except those
1019 		 * destined for us.
1020 		 */
1021 		if (eh->ether_dhost[0] & 1)
1022 			return 1;
1023 		if (ether_equal(eh->ether_dhost, sc->sc_arpcom.ac_enaddr))
1024 			return 1;
1025 		return 0;
1026 
1027 	case IFF_PROMISC:
1028 		/* If for us, accept and hand up to BPF */
1029 		if (ether_equal(eh->ether_dhost, sc->sc_arpcom.ac_enaddr))
1030 			return 1;
1031 
1032 		/*
1033 		 * Not a multicast, so BPF wants to see it but we don't.
1034 		 */
1035 		if (!(eh->ether_dhost[0] & 1))
1036 			return 1;
1037 
1038 		/*
1039 		 * If it's one of our multicast groups, accept it and pass it
1040 		 * up.
1041 		 */
1042 		for (i = 0; i < sc->mcast_count; i++) {
1043 			if (ether_equal(eh->ether_dhost, (u_char *)&sc->mcast_addrs[i])) {
1044 				return 1;
1045 			}
1046 		}
1047 		return 1;
1048 
1049 	case IFF_ALLMULTI | IFF_PROMISC:
1050 		/* We want to see multicasts. */
1051 		if (eh->ether_dhost[0] & 1)
1052 			return 1;
1053 
1054 		/* We want to see our own packets */
1055 		if (ether_equal(eh->ether_dhost, sc->sc_arpcom.ac_enaddr))
1056 			return 1;
1057 
1058 		return 1;
1059 
1060 	case 0:
1061 		return 1;
1062 	}
1063 
1064 #ifdef DIAGNOSTIC
1065 	panic("check_eh: impossible");
1066 #endif
1067 	return 0;
1068 }
1069 
1070 /*
1071  * We want to isolate the bits that have meaning...  This assumes that
1072  * IE_RBUF_SIZE is an even power of two.  If somehow the act_len exceeds
1073  * the size of the buffer, then we are screwed anyway.
1074  */
1075 static __inline int
1076 ie_buflen(sc, head)
1077 	struct ie_softc *sc;
1078 	int head;
1079 {
1080 
1081 	return (sc->rbuffs[head]->ie_rbd_actual
1082 	    & (IE_RBUF_SIZE | (IE_RBUF_SIZE - 1)));
1083 }
1084 
1085 static __inline int
1086 ie_packet_len(sc)
1087 	struct ie_softc *sc;
1088 {
1089 	int i;
1090 	int head = sc->rbhead;
1091 	int acc = 0;
1092 
1093 	do {
1094 		if (!(sc->rbuffs[sc->rbhead]->ie_rbd_actual & IE_RBD_USED))
1095 			return -1;
1096 
1097 		i = sc->rbuffs[head]->ie_rbd_actual & IE_RBD_LAST;
1098 
1099 		acc += ie_buflen(sc, head);
1100 		head = (head + 1) % NRXBUF;
1101 	} while (!i);
1102 
1103 	return acc;
1104 }
1105 
1106 /*
1107  * Setup all necessary artifacts for an XMIT command, and then pass the XMIT
1108  * command to the chip to be executed.  On the way, if we have a BPF listener
1109  * also give him a copy.
1110  */
1111 void
1112 iexmit(sc)
1113 	struct ie_softc *sc;
1114 {
1115 
1116 #ifdef IEDEBUG
1117 	if (sc->sc_debug & IED_XMIT)
1118 		printf("%s: xmit buffer %d\n", sc->sc_dev.dv_xname,
1119 		    sc->xctail);
1120 #endif
1121 
1122 	sc->xmit_buffs[sc->xctail]->ie_xmit_flags |= IE_XMIT_LAST;
1123 	sc->xmit_buffs[sc->xctail]->ie_xmit_next = 0xffff;
1124 	sc->xmit_buffs[sc->xctail]->ie_xmit_buf =
1125 	    MK_24(MEM, sc->xmit_cbuffs[sc->xctail]);
1126 
1127 	sc->xmit_cmds[sc->xctail]->com.ie_cmd_link = 0xffff;
1128 	sc->xmit_cmds[sc->xctail]->com.ie_cmd_cmd =
1129 	    IE_CMD_XMIT | IE_CMD_INTR | IE_CMD_LAST;
1130 
1131 	sc->xmit_cmds[sc->xctail]->ie_xmit_status = 0;
1132 	sc->xmit_cmds[sc->xctail]->ie_xmit_desc =
1133 	    MK_16(MEM, sc->xmit_buffs[sc->xctail]);
1134 
1135 	sc->scb->ie_command_list = MK_16(MEM, sc->xmit_cmds[sc->xctail]);
1136 	command_and_wait(sc, IE_CU_START, 0, 0);
1137 
1138 	sc->sc_arpcom.ac_if.if_timer = 5;
1139 }
1140 
1141 /*
1142  * Read data off the interface, and turn it into an mbuf chain.
1143  *
1144  * This code is DRAMATICALLY different from the previous version; this version
1145  * tries to allocate the entire mbuf chain up front, given the length of the
1146  * data available.  This enables us to allocate mbuf clusters in many
1147  * situations where before we would have had a long chain of partially-full
1148  * mbufs.  This should help to speed up the operation considerably.  (Provided
1149  * that it works, of course.)
1150  */
1151 struct mbuf *
1152 ieget(sc, ehp)
1153 	struct ie_softc *sc;
1154 	struct ether_header *ehp;
1155 {
1156 	struct mbuf *top, **mp, *m;
1157 	int len, totlen, resid;
1158 	int thisrboff, thismboff;
1159 	int head;
1160 
1161 	resid = totlen = ie_packet_len(sc);
1162 	if (totlen <= 0)
1163 		return 0;
1164 
1165 	head = sc->rbhead;
1166 
1167 	/*
1168 	 * Snarf the Ethernet header.
1169 	 */
1170 	bcopy((caddr_t)sc->cbuffs[head], (caddr_t)ehp, sizeof *ehp);
1171 
1172 	/*
1173 	 * As quickly as possible, check if this packet is for us.
1174 	 * If not, don't waste a single cycle copying the rest of the
1175 	 * packet in.
1176 	 * This is only a consideration when FILTER is defined; i.e., when
1177 	 * we are either running BPF or doing multicasting.
1178 	 */
1179 	if (!check_eh(sc, ehp)) {
1180 		sc->sc_arpcom.ac_if.if_ierrors--; /* just this case, it's not an error */
1181 		return 0;
1182 	}
1183 
1184 	MGETHDR(m, M_DONTWAIT, MT_DATA);
1185 	if (m == NULL)
1186 		return 0;
1187 	m->m_pkthdr.len = totlen;
1188 	len = MHLEN;
1189 	top = 0;
1190 	mp = &top;
1191 
1192 	/*
1193 	 * This loop goes through and allocates mbufs for all the data we will
1194 	 * be copying in.  It does not actually do the copying yet.
1195 	 */
1196 	while (totlen > 0) {
1197 		if (top) {
1198 			MGET(m, M_DONTWAIT, MT_DATA);
1199 			if (m == NULL) {
1200 				m_freem(top);
1201 				return 0;
1202 			}
1203 			len = MLEN;
1204 		}
1205 		if (totlen >= MINCLSIZE) {
1206 			MCLGET(m, M_DONTWAIT);
1207 			if (m->m_flags & M_EXT)
1208 				len = MCLBYTES;
1209 		}
1210 		m->m_len = len = min(totlen, len);
1211 		totlen -= len;
1212 		*mp = m;
1213 		mp = &m->m_next;
1214 	}
1215 
1216 	m = top;
1217 	thisrboff = 0;
1218 	thismboff = 0;
1219 
1220 	/*
1221 	 * Now we take the mbuf chain (hopefully only one mbuf most of the
1222 	 * time) and stuff the data into it.  There are no possible failures at
1223 	 * or after this point.
1224 	 */
1225 	while (resid > 0) {
1226 		int thisrblen = ie_buflen(sc, head) - thisrboff,
1227 		    thismblen = m->m_len - thismboff;
1228 		len = min(thisrblen, thismblen);
1229 
1230 		bcopy((caddr_t)(sc->cbuffs[head] + thisrboff),
1231 		    mtod(m, caddr_t) + thismboff, (u_int)len);
1232 		resid -= len;
1233 
1234 		if (len == thismblen) {
1235 			m = m->m_next;
1236 			thismboff = 0;
1237 		} else
1238 			thismboff += len;
1239 
1240 		if (len == thisrblen) {
1241 			head = (head + 1) % NRXBUF;
1242 			thisrboff = 0;
1243 		} else
1244 			thisrboff += len;
1245 	}
1246 
1247 	/*
1248 	 * Unless something changed strangely while we were doing the copy, we
1249 	 * have now copied everything in from the shared memory.
1250 	 * This means that we are done.
1251 	 */
1252 	return top;
1253 }
1254 
1255 /*
1256  * Read frame NUM from unit UNIT (pre-cached as IE).
1257  *
1258  * This routine reads the RFD at NUM, and copies in the buffers from the list
1259  * of RBD, then rotates the RBD and RFD lists so that the receiver doesn't
1260  * start complaining.  Trailers are DROPPED---there's no point in wasting time
1261  * on confusing code to deal with them.  Hopefully, this machine will never ARP
1262  * for trailers anyway.
1263  */
1264 void
1265 ie_readframe(sc, num)
1266 	struct ie_softc *sc;
1267 	int num;			/* frame number to read */
1268 {
1269 	int status;
1270 	struct mbuf *m = NULL;
1271 	struct mbuf_list ml = MBUF_LIST_INITIALIZER();
1272 	struct ether_header eh;
1273 
1274 	status = sc->rframes[num]->ie_fd_status;
1275 
1276 	/* Advance the RFD list, since we're done with this descriptor. */
1277 	sc->rframes[num]->ie_fd_status = 0;
1278 	sc->rframes[num]->ie_fd_last |= IE_FD_LAST;
1279 	sc->rframes[sc->rftail]->ie_fd_last &= ~IE_FD_LAST;
1280 	sc->rftail = (sc->rftail + 1) % NFRAMES;
1281 	sc->rfhead = (sc->rfhead + 1) % NFRAMES;
1282 
1283 	if (status & IE_FD_OK) {
1284 		m = ieget(sc, &eh);
1285 		ie_drop_packet_buffer(sc);
1286 	}
1287 	if (m == NULL) {
1288 		sc->sc_arpcom.ac_if.if_ierrors++;
1289 		return;
1290 	}
1291 
1292 #ifdef IEDEBUG
1293 	if (sc->sc_debug & IED_READFRAME)
1294 		printf("%s: frame from ether %s type %x\n", sc->sc_dev.dv_xname,
1295 		    ether_sprintf(eh.ether_shost), (u_int)eh.ether_type);
1296 #endif
1297 
1298 	ml_enqueue(&ml, m);
1299 	if_input(&sc->sc_arpcom.ac_if, &ml);
1300 }
1301 
1302 void
1303 ie_drop_packet_buffer(sc)
1304 	struct ie_softc *sc;
1305 {
1306 	int i;
1307 
1308 	do {
1309 		/*
1310 		 * This means we are somehow out of sync.  So, we reset the
1311 		 * adapter.
1312 		 */
1313 		if (!(sc->rbuffs[sc->rbhead]->ie_rbd_actual & IE_RBD_USED)) {
1314 #ifdef IEDEBUG
1315 			print_rbd(sc->rbuffs[sc->rbhead]);
1316 #endif
1317 			log(LOG_ERR, "%s: receive descriptors out of sync at %d\n",
1318 			    sc->sc_dev.dv_xname, sc->rbhead);
1319 			iereset(sc);
1320 			return;
1321 		}
1322 
1323 		i = sc->rbuffs[sc->rbhead]->ie_rbd_actual & IE_RBD_LAST;
1324 
1325 		sc->rbuffs[sc->rbhead]->ie_rbd_length |= IE_RBD_LAST;
1326 		sc->rbuffs[sc->rbhead]->ie_rbd_actual = 0;
1327 		sc->rbhead = (sc->rbhead + 1) % NRXBUF;
1328 		sc->rbuffs[sc->rbtail]->ie_rbd_length &= ~IE_RBD_LAST;
1329 		sc->rbtail = (sc->rbtail + 1) % NRXBUF;
1330 	} while (!i);
1331 }
1332 
1333 /*
1334  * Start transmission on an interface.
1335  */
1336 void
1337 iestart(ifp)
1338 	struct ifnet *ifp;
1339 {
1340 	struct ie_softc *sc = ifp->if_softc;
1341 	struct mbuf *m0, *m;
1342 	u_char *buffer;
1343 	u_short len;
1344 
1345 	if (!(ifp->if_flags & IFF_RUNNING) || ifq_is_oactive(&ifp->if_snd))
1346 		return;
1347 
1348 	for (;;) {
1349 		if (sc->xmit_busy == NTXBUF) {
1350 			ifq_set_oactive(&ifp->if_snd);
1351 			break;
1352 		}
1353 
1354 		IFQ_DEQUEUE(&ifp->if_snd, m0);
1355 		if (m0 == NULL)
1356 			break;
1357 
1358 		/* We need to use m->m_pkthdr.len, so require the header */
1359 		if ((m0->m_flags & M_PKTHDR) == 0)
1360 			panic("iestart: no header mbuf");
1361 
1362 #if NBPFILTER > 0
1363 		/* Tap off here if there is a BPF listener. */
1364 		if (ifp->if_bpf)
1365 			bpf_mtap(ifp->if_bpf, m0, BPF_DIRECTION_OUT);
1366 #endif
1367 
1368 #ifdef IEDEBUG
1369 		if (sc->sc_debug & IED_ENQ)
1370 			printf("%s: fill buffer %d\n", sc->sc_dev.dv_xname,
1371 			    sc->xchead);
1372 #endif
1373 
1374 		len = 0;
1375 		buffer = sc->xmit_cbuffs[sc->xchead];
1376 
1377 		for (m = m0; m != NULL && (len + m->m_len) < IE_TBUF_SIZE;
1378 		    m = m->m_next) {
1379 			bcopy(mtod(m, caddr_t), buffer, m->m_len);
1380 			buffer += m->m_len;
1381 			len += m->m_len;
1382 		}
1383 		if (m != NULL)
1384 			printf("%s: tbuf overflow\n", sc->sc_dev.dv_xname);
1385 
1386 		m_freem(m0);
1387 
1388 		if (len < ETHER_MIN_LEN - ETHER_CRC_LEN) {
1389 			bzero(buffer, ETHER_MIN_LEN - ETHER_CRC_LEN - len);
1390 			len = ETHER_MIN_LEN - ETHER_CRC_LEN;
1391 			buffer += ETHER_MIN_LEN - ETHER_CRC_LEN;
1392 		}
1393 
1394 		sc->xmit_buffs[sc->xchead]->ie_xmit_flags = len;
1395 
1396 		/* Start the first packet transmitting. */
1397 		if (sc->xmit_busy == 0)
1398 			iexmit(sc);
1399 
1400 		sc->xchead = (sc->xchead + 1) % NTXBUF;
1401 		sc->xmit_busy++;
1402 	}
1403 }
1404 
1405 /*
1406  * Check to see if there's an 82586 out there.
1407  */
1408 int
1409 check_ie_present(sc, where, size)
1410 	struct ie_softc *sc;
1411 	caddr_t where;
1412 	u_int size;
1413 {
1414 	volatile struct ie_sys_conf_ptr *scp;
1415 	volatile struct ie_int_sys_conf_ptr *iscp;
1416 	volatile struct ie_sys_ctl_block *scb;
1417 	u_long realbase;
1418 	int s;
1419 
1420 	s = splnet();
1421 
1422 	realbase = (u_long)where + size - (1 << 24);
1423 
1424 	scp = (volatile struct ie_sys_conf_ptr *)(realbase + IE_SCP_ADDR);
1425 	bzero((char *)scp, sizeof *scp);
1426 
1427 	/*
1428 	 * First we put the ISCP at the bottom of memory; this tests to make
1429 	 * sure that our idea of the size of memory is the same as the
1430 	 * controller's.  This is NOT where the ISCP will be in normal
1431 	 * operation.
1432 	 */
1433 	iscp = (volatile struct ie_int_sys_conf_ptr *)where;
1434 	bzero((char *)iscp, sizeof *iscp);
1435 
1436 	scb = (volatile struct ie_sys_ctl_block *)where;
1437 	bzero((char *)scb, sizeof *scb);
1438 
1439 	scp->ie_bus_use = 0;		/* 16-bit */
1440 	scp->ie_iscp_ptr = (caddr_t)((volatile caddr_t)iscp -
1441 	    (volatile caddr_t)realbase);
1442 
1443 	iscp->ie_busy = 1;
1444 	iscp->ie_scb_offset = MK_16(realbase, scb) + 256;
1445 
1446 	(sc->reset_586)(sc);
1447 	(sc->chan_attn)(sc);
1448 
1449 	delay(100);			/* wait a while... */
1450 
1451 	if (iscp->ie_busy) {
1452 		splx(s);
1453 		return 0;
1454 	}
1455 
1456 	/*
1457 	 * Now relocate the ISCP to its real home, and reset the controller
1458 	 * again.
1459 	 */
1460 	iscp = (void *)ALIGN(realbase + IE_SCP_ADDR - sizeof(*iscp));
1461 	bzero((char *)iscp, sizeof *iscp);
1462 
1463 	scp->ie_iscp_ptr = (caddr_t)((caddr_t)iscp - (caddr_t)realbase);
1464 
1465 	iscp->ie_busy = 1;
1466 	iscp->ie_scb_offset = MK_16(realbase, scb);
1467 
1468 	(sc->reset_586)(sc);
1469 	(sc->chan_attn)(sc);
1470 
1471 	delay(100);
1472 
1473 	if (iscp->ie_busy) {
1474 		splx(s);
1475 		return 0;
1476 	}
1477 
1478 	sc->sc_msize = size;
1479 	sc->sc_maddr = (caddr_t)realbase;
1480 
1481 	sc->iscp = iscp;
1482 	sc->scb = scb;
1483 
1484 	/*
1485 	 * Acknowledge any interrupts we may have caused...
1486 	 */
1487 	ie_ack(sc, IE_ST_WHENCE);
1488 	splx(s);
1489 
1490 	return 1;
1491 }
1492 
1493 /*
1494  * Divine the memory size of ie board UNIT.
1495  * Better hope there's nothing important hiding just below the ie card...
1496  */
1497 void
1498 ie_find_mem_size(sc)
1499 	struct ie_softc *sc;
1500 {
1501 	u_int size;
1502 
1503 	sc->sc_msize = 0;
1504 
1505 	for (size = 65536; size >= 16384; size -= 16384)
1506 		if (check_ie_present(sc, sc->sc_maddr, size))
1507 			return;
1508 
1509 	return;
1510 }
1511 
1512 void
1513 el_reset_586(sc)
1514 	struct ie_softc *sc;
1515 {
1516 
1517 	outb(PORT + IE507_CTRL, EL_CTRL_RESET);
1518 	delay(100);
1519 	outb(PORT + IE507_CTRL, EL_CTRL_NORMAL);
1520 	delay(100);
1521 }
1522 
1523 void
1524 sl_reset_586(sc)
1525 	struct ie_softc *sc;
1526 {
1527 
1528 	outb(PORT + IEATT_RESET, 0);
1529 }
1530 
1531 void
1532 ee16_reset_586(sc)
1533 	struct ie_softc *sc;
1534 {
1535 
1536 	outb(PORT + IEE16_ECTRL, IEE16_RESET_586);
1537 	delay(100);
1538 	outb(PORT + IEE16_ECTRL, 0);
1539 	delay(100);
1540 }
1541 
1542 void
1543 el_chan_attn(sc)
1544 	struct ie_softc *sc;
1545 {
1546 
1547 	outb(PORT + IE507_ATTN, 1);
1548 }
1549 
1550 void
1551 sl_chan_attn(sc)
1552 	struct ie_softc *sc;
1553 {
1554 
1555 	outb(PORT + IEATT_ATTN, 0);
1556 }
1557 
1558 void
1559 ee16_chan_attn(sc)
1560 	struct ie_softc *sc;
1561 {
1562 	outb(PORT + IEE16_ATTN, 0);
1563 }
1564 
1565 u_short
1566 ee16_read_eeprom(sc, location)
1567 	struct ie_softc *sc;
1568 	int location;
1569 {
1570 	int ectrl, edata;
1571 
1572 	ectrl = inb(PORT + IEE16_ECTRL);
1573 	ectrl &= IEE16_ECTRL_MASK;
1574 	ectrl |= IEE16_ECTRL_EECS;
1575 	outb(PORT + IEE16_ECTRL, ectrl);
1576 
1577 	ee16_eeprom_outbits(sc, IEE16_EEPROM_READ, IEE16_EEPROM_OPSIZE1);
1578 	ee16_eeprom_outbits(sc, location, IEE16_EEPROM_ADDR_SIZE);
1579 	edata = ee16_eeprom_inbits(sc);
1580 	ectrl = inb(PORT + IEE16_ECTRL);
1581 	ectrl &= ~(IEE16_RESET_ASIC | IEE16_ECTRL_EEDI | IEE16_ECTRL_EECS);
1582 	outb(PORT + IEE16_ECTRL, ectrl);
1583 	ee16_eeprom_clock(sc, 1);
1584 	ee16_eeprom_clock(sc, 0);
1585 	return edata;
1586 }
1587 
1588 void
1589 ee16_eeprom_outbits(sc, edata, count)
1590 	struct ie_softc *sc;
1591 	int edata, count;
1592 {
1593 	int ectrl, i;
1594 
1595 	ectrl = inb(PORT + IEE16_ECTRL);
1596 	ectrl &= ~IEE16_RESET_ASIC;
1597 	for (i = count - 1; i >= 0; i--) {
1598 		ectrl &= ~IEE16_ECTRL_EEDI;
1599 		if (edata & (1 << i)) {
1600 			ectrl |= IEE16_ECTRL_EEDI;
1601 		}
1602 		outb(PORT + IEE16_ECTRL, ectrl);
1603 		delay(1);	/* eeprom data must be setup for 0.4 uSec */
1604 		ee16_eeprom_clock(sc, 1);
1605 		ee16_eeprom_clock(sc, 0);
1606 	}
1607 	ectrl &= ~IEE16_ECTRL_EEDI;
1608 	outb(PORT + IEE16_ECTRL, ectrl);
1609 	delay(1);		/* eeprom data must be held for 0.4 uSec */
1610 }
1611 
1612 int
1613 ee16_eeprom_inbits(sc)
1614 	struct ie_softc *sc;
1615 {
1616 	int ectrl, edata, i;
1617 
1618 	ectrl = inb(PORT + IEE16_ECTRL);
1619 	ectrl &= ~IEE16_RESET_ASIC;
1620 	for (edata = 0, i = 0; i < 16; i++) {
1621 		edata = edata << 1;
1622 		ee16_eeprom_clock(sc, 1);
1623 		ectrl = inb(PORT + IEE16_ECTRL);
1624 		if (ectrl & IEE16_ECTRL_EEDO) {
1625 			edata |= 1;
1626 		}
1627 		ee16_eeprom_clock(sc, 0);
1628 	}
1629 	return (edata);
1630 }
1631 
1632 void
1633 ee16_eeprom_clock(sc, state)
1634 	struct ie_softc *sc;
1635 	int state;
1636 {
1637 	int ectrl;
1638 
1639 	ectrl = inb(PORT + IEE16_ECTRL);
1640 	ectrl &= ~(IEE16_RESET_ASIC | IEE16_ECTRL_EESK);
1641 	if (state) {
1642 		ectrl |= IEE16_ECTRL_EESK;
1643 	}
1644 	outb(PORT + IEE16_ECTRL, ectrl);
1645 	delay(9);		/* EESK must be stable for 8.38 uSec */
1646 }
1647 
1648 static inline void
1649 ee16_interrupt_enable(sc)
1650 	struct ie_softc *sc;
1651 {
1652 	delay(100);
1653 	outb(PORT + IEE16_IRQ, sc->irq_encoded | IEE16_IRQ_ENABLE);
1654 	delay(100);
1655 }
1656 void
1657 slel_get_address(sc)
1658 	struct ie_softc *sc;
1659 {
1660 	u_char *addr = sc->sc_arpcom.ac_enaddr;
1661 	int i;
1662 
1663 	for (i = 0; i < ETHER_ADDR_LEN; i++)
1664 		addr[i] = inb(PORT + i);
1665 }
1666 
1667 void
1668 iereset(sc)
1669 	struct ie_softc *sc;
1670 {
1671 	int s = splnet();
1672 
1673 	iestop(sc);
1674 
1675 	/*
1676 	 * Stop i82586 dead in its tracks.
1677 	 */
1678 	if (command_and_wait(sc, IE_RU_ABORT | IE_CU_ABORT, 0, 0))
1679 		printf("%s: abort commands timed out\n", sc->sc_dev.dv_xname);
1680 
1681 	if (command_and_wait(sc, IE_RU_DISABLE | IE_CU_STOP, 0, 0))
1682 		printf("%s: disable commands timed out\n", sc->sc_dev.dv_xname);
1683 
1684 	ieinit(sc);
1685 
1686 	splx(s);
1687 }
1688 
1689 /*
1690  * Send a command to the controller and wait for it to either complete or be
1691  * accepted, depending on the command.  If the command pointer is null, then
1692  * pretend that the command is not an action command.  If the command pointer
1693  * is not null, and the command is an action command, wait for
1694  * ((volatile struct ie_cmd_common *)pcmd)->ie_cmd_status & MASK
1695  * to become true.
1696  */
1697 static int
1698 command_and_wait(sc, cmd, pcmd, mask)
1699 	struct ie_softc *sc;
1700 	int cmd;
1701 	volatile void *pcmd;
1702 	int mask;
1703 {
1704 	volatile struct ie_cmd_common *cc = pcmd;
1705 	volatile struct ie_sys_ctl_block *scb = sc->scb;
1706 	int i;
1707 
1708 	scb->ie_command = (u_short)cmd;
1709 
1710 	if (IE_ACTION_COMMAND(cmd) && pcmd) {
1711 		(sc->chan_attn)(sc);
1712 
1713 		/*
1714 		 * According to the packet driver, the minimum timeout should
1715 		 * be .369 seconds, which we round up to .4.
1716 		 *
1717 		 * Now spin-lock waiting for status.  This is not a very nice
1718 		 * thing to do, but I haven't figured out how, or indeed if, we
1719 		 * can put the process waiting for action to sleep.  (We may
1720 		 * be getting called through some other timeout running in the
1721 		 * kernel.)
1722 		 */
1723 		for (i = 36900; i--; DELAY(10))
1724 			if ((cc->ie_cmd_status & mask))
1725 				break;
1726 
1727 		return i < 0;
1728 	} else {
1729 		/*
1730 		 * Otherwise, just wait for the command to be accepted.
1731 		 */
1732 		(sc->chan_attn)(sc);
1733 
1734 		while (scb->ie_command)
1735 			;				/* spin lock */
1736 
1737 		return 0;
1738 	}
1739 }
1740 
1741 /*
1742  * Run the time-domain reflectometer.
1743  */
1744 static void
1745 run_tdr(sc, cmd)
1746 	struct ie_softc *sc;
1747 	struct ie_tdr_cmd *cmd;
1748 {
1749 	int result;
1750 
1751 	cmd->com.ie_cmd_status = 0;
1752 	cmd->com.ie_cmd_cmd = IE_CMD_TDR | IE_CMD_LAST;
1753 	cmd->com.ie_cmd_link = 0xffff;
1754 
1755 	sc->scb->ie_command_list = MK_16(MEM, cmd);
1756 	cmd->ie_tdr_time = 0;
1757 
1758 	if (command_and_wait(sc, IE_CU_START, cmd, IE_STAT_COMPL) ||
1759 	    !(cmd->com.ie_cmd_status & IE_STAT_OK))
1760 		result = 0x10000;
1761 	else
1762 		result = cmd->ie_tdr_time;
1763 
1764 	ie_ack(sc, IE_ST_WHENCE);
1765 
1766 	if (result & IE_TDR_SUCCESS)
1767 		return;
1768 
1769 	if (result & 0x10000)
1770 		printf("%s: TDR command failed\n", sc->sc_dev.dv_xname);
1771 	else if (result & IE_TDR_XCVR)
1772 		printf("%s: transceiver problem\n", sc->sc_dev.dv_xname);
1773 	else if (result & IE_TDR_OPEN)
1774 		printf("%s: TDR detected an open %d clocks away\n",
1775 		    sc->sc_dev.dv_xname, result & IE_TDR_TIME);
1776 	else if (result & IE_TDR_SHORT)
1777 		printf("%s: TDR detected a short %d clocks away\n",
1778 		    sc->sc_dev.dv_xname, result & IE_TDR_TIME);
1779 	else
1780 		printf("%s: TDR returned unknown status %x\n",
1781 		    sc->sc_dev.dv_xname, result);
1782 }
1783 
1784 #define	_ALLOC(p, n)	(bzero(p, n), p += n, p - n)
1785 #define	ALLOC(p, n)	_ALLOC(p, ALIGN(n))
1786 
1787 /*
1788  * Here is a helper routine for ieinit().  This sets up the buffers.
1789  */
1790 void
1791 iememinit(ptr, sc)
1792 	void *ptr;
1793 	struct ie_softc *sc;
1794 {
1795 	int i;
1796 
1797 	/* First lay them out. */
1798 	for (i = 0; i < NFRAMES; i++)
1799 		sc->rframes[i] = ALLOC(ptr, sizeof(*sc->rframes[i]));
1800 
1801 	/* Now link them together. */
1802 	for (i = 0; i < NFRAMES; i++)
1803 		sc->rframes[i]->ie_fd_next =
1804 		    MK_16(MEM, sc->rframes[(i + 1) % NFRAMES]);
1805 
1806 	/* Finally, set the EOL bit on the last one. */
1807 	sc->rframes[NFRAMES - 1]->ie_fd_last |= IE_FD_LAST;
1808 
1809 	/*
1810 	 * Now lay out some buffers for the incoming frames.  Note that we set
1811 	 * aside a bit of slop in each buffer, to make sure that we have enough
1812 	 * space to hold a single frame in every buffer.
1813 	 */
1814 	for (i = 0; i < NRXBUF; i++) {
1815 		sc->rbuffs[i] = ALLOC(ptr, sizeof(*sc->rbuffs[i]));
1816 		sc->rbuffs[i]->ie_rbd_length = IE_RBUF_SIZE;
1817 		sc->rbuffs[i]->ie_rbd_buffer = MK_24(MEM, ptr);
1818 		sc->cbuffs[i] = ALLOC(ptr, IE_RBUF_SIZE);
1819 	}
1820 
1821 	/* Now link them together. */
1822 	for (i = 0; i < NRXBUF; i++)
1823 		sc->rbuffs[i]->ie_rbd_next =
1824 		    MK_16(MEM, sc->rbuffs[(i + 1) % NRXBUF]);
1825 
1826 	/* Tag EOF on the last one. */
1827 	sc->rbuffs[NRXBUF - 1]->ie_rbd_length |= IE_RBD_LAST;
1828 
1829 	/*
1830 	 * We use the head and tail pointers on receive to keep track of the
1831 	 * order in which RFDs and RBDs are used.
1832 	 */
1833 	sc->rfhead = 0;
1834 	sc->rftail = NFRAMES - 1;
1835 	sc->rbhead = 0;
1836 	sc->rbtail = NRXBUF - 1;
1837 
1838 	sc->scb->ie_recv_list = MK_16(MEM, sc->rframes[0]);
1839 	sc->rframes[0]->ie_fd_buf_desc = MK_16(MEM, sc->rbuffs[0]);
1840 
1841 	/*
1842 	 * Finally, the transmit command and buffer are the last little bit of
1843 	 * work.
1844 	 */
1845 	for (i = 0; i < NTXBUF; i++) {
1846 		sc->xmit_cmds[i] = ALLOC(ptr, sizeof(*sc->xmit_cmds[i]));
1847 		sc->xmit_buffs[i] = ALLOC(ptr, sizeof(*sc->xmit_buffs[i]));
1848 	}
1849 
1850 	for (i = 0; i < NTXBUF; i++)
1851 		sc->xmit_cbuffs[i] = ALLOC(ptr, IE_TBUF_SIZE);
1852 
1853 	/* Pointers to last packet sent and next available transmit buffer. */
1854 	sc->xchead = sc->xctail = 0;
1855 
1856 	/* Clear transmit-busy flag and set number of free transmit buffers. */
1857 	sc->xmit_busy = 0;
1858 }
1859 
1860 /*
1861  * Run the multicast setup command.
1862  * Called at splnet().
1863  */
1864 static int
1865 mc_setup(sc, ptr)
1866 	struct ie_softc *sc;
1867 	void *ptr;
1868 {
1869 	volatile struct ie_mcast_cmd *cmd = ptr;
1870 
1871 	cmd->com.ie_cmd_status = 0;
1872 	cmd->com.ie_cmd_cmd = IE_CMD_MCAST | IE_CMD_LAST;
1873 	cmd->com.ie_cmd_link = 0xffff;
1874 
1875 	bcopy((caddr_t)sc->mcast_addrs, (caddr_t)cmd->ie_mcast_addrs,
1876 	    sc->mcast_count * sizeof *sc->mcast_addrs);
1877 
1878 	cmd->ie_mcast_bytes = sc->mcast_count * ETHER_ADDR_LEN; /* grrr... */
1879 
1880 	sc->scb->ie_command_list = MK_16(MEM, cmd);
1881 	if (command_and_wait(sc, IE_CU_START, cmd, IE_STAT_COMPL) ||
1882 	    !(cmd->com.ie_cmd_status & IE_STAT_OK)) {
1883 		printf("%s: multicast address setup command failed\n",
1884 		    sc->sc_dev.dv_xname);
1885 		return 0;
1886 	}
1887 	return 1;
1888 }
1889 
1890 /*
1891  * This routine takes the environment generated by check_ie_present() and adds
1892  * to it all the other structures we need to operate the adapter.  This
1893  * includes executing the CONFIGURE, IA-SETUP, and MC-SETUP commands, starting
1894  * the receiver unit, and clearing interrupts.
1895  *
1896  * THIS ROUTINE MUST BE CALLED AT splnet() OR HIGHER.
1897  */
1898 int
1899 ieinit(sc)
1900 	struct ie_softc *sc;
1901 {
1902 	volatile struct ie_sys_ctl_block *scb = sc->scb;
1903 	void *ptr;
1904 
1905 	ptr = (void *)ALIGN(scb + 1);
1906 
1907 	/*
1908 	 * Send the configure command first.
1909 	 */
1910 	{
1911 		volatile struct ie_config_cmd *cmd = ptr;
1912 
1913 		scb->ie_command_list = MK_16(MEM, cmd);
1914 		cmd->com.ie_cmd_status = 0;
1915 		cmd->com.ie_cmd_cmd = IE_CMD_CONFIG | IE_CMD_LAST;
1916 		cmd->com.ie_cmd_link = 0xffff;
1917 
1918 		ie_setup_config(cmd, sc->promisc != 0,
1919 		    sc->hard_type == IE_STARLAN10);
1920 
1921 		if (command_and_wait(sc, IE_CU_START, cmd, IE_STAT_COMPL) ||
1922 		    !(cmd->com.ie_cmd_status & IE_STAT_OK)) {
1923 			printf("%s: configure command failed\n",
1924 			    sc->sc_dev.dv_xname);
1925 			return 0;
1926 		}
1927 	}
1928 
1929 	/*
1930 	 * Now send the Individual Address Setup command.
1931 	 */
1932 	{
1933 		volatile struct ie_iasetup_cmd *cmd = ptr;
1934 
1935 		scb->ie_command_list = MK_16(MEM, cmd);
1936 		cmd->com.ie_cmd_status = 0;
1937 		cmd->com.ie_cmd_cmd = IE_CMD_IASETUP | IE_CMD_LAST;
1938 		cmd->com.ie_cmd_link = 0xffff;
1939 
1940 		bcopy(sc->sc_arpcom.ac_enaddr, (caddr_t)&cmd->ie_address,
1941 		    sizeof cmd->ie_address);
1942 
1943 		if (command_and_wait(sc, IE_CU_START, cmd, IE_STAT_COMPL) ||
1944 		    !(cmd->com.ie_cmd_status & IE_STAT_OK)) {
1945 			printf("%s: individual address setup command failed\n",
1946 			    sc->sc_dev.dv_xname);
1947 			return 0;
1948 		}
1949 	}
1950 
1951 	/*
1952 	 * Now run the time-domain reflectometer.
1953 	 */
1954 	run_tdr(sc, ptr);
1955 
1956 	/*
1957 	 * Acknowledge any interrupts we have generated thus far.
1958 	 */
1959 	ie_ack(sc, IE_ST_WHENCE);
1960 
1961 	/*
1962 	 * Set up the RFA.
1963 	 */
1964 	iememinit(ptr, sc);
1965 
1966 	sc->sc_arpcom.ac_if.if_flags |= IFF_RUNNING;
1967 	ifq_clr_oactive(&sc->sc_arpcom.ac_if.if_snd);
1968 
1969 	sc->scb->ie_recv_list = MK_16(MEM, sc->rframes[0]);
1970 	command_and_wait(sc, IE_RU_START, 0, 0);
1971 
1972 	ie_ack(sc, IE_ST_WHENCE);
1973 
1974 	/* take the ee16 out of loopback */
1975 	{
1976 	u_char	bart_config;
1977 
1978 	if(sc->hard_type == IE_EE16) {
1979 		bart_config = inb(PORT + IEE16_CONFIG);
1980 		bart_config &= ~IEE16_BART_LOOPBACK;
1981 		bart_config |= IEE16_BART_MCS16_TEST; /* inb doesn't get bit! */
1982 		outb(PORT + IEE16_CONFIG, bart_config);
1983 		ee16_interrupt_enable(sc);
1984 		ee16_chan_attn(sc);
1985 		}
1986 	}
1987 	return 0;
1988 }
1989 
1990 void
1991 iestop(sc)
1992 	struct ie_softc *sc;
1993 {
1994 
1995 	command_and_wait(sc, IE_RU_DISABLE, 0, 0);
1996 }
1997 
1998 int
1999 ieioctl(ifp, cmd, data)
2000 	register struct ifnet *ifp;
2001 	u_long cmd;
2002 	caddr_t data;
2003 {
2004 	struct ie_softc *sc = ifp->if_softc;
2005 	int s, error = 0;
2006 
2007 	s = splnet();
2008 
2009 	switch (cmd) {
2010 	case SIOCSIFADDR:
2011 		ifp->if_flags |= IFF_UP;
2012 		ieinit(sc);
2013 		break;
2014 
2015 	case SIOCSIFFLAGS:
2016 		sc->promisc = ifp->if_flags & (IFF_PROMISC | IFF_ALLMULTI);
2017 		if ((ifp->if_flags & IFF_UP) == 0 &&
2018 		    (ifp->if_flags & IFF_RUNNING) != 0) {
2019 			/*
2020 			 * If interface is marked down and it is running, then
2021 			 * stop it.
2022 			 */
2023 			iestop(sc);
2024 			ifp->if_flags &= ~IFF_RUNNING;
2025 		} else if ((ifp->if_flags & IFF_UP) != 0 &&
2026 			   (ifp->if_flags & IFF_RUNNING) == 0) {
2027 			/*
2028 			 * If interface is marked up and it is stopped, then
2029 			 * start it.
2030 			 */
2031 			ieinit(sc);
2032 		} else {
2033 			/*
2034 			 * Reset the interface to pick up changes in any other
2035 			 * flags that affect hardware registers.
2036 			 */
2037 			iestop(sc);
2038 			ieinit(sc);
2039 		}
2040 #ifdef IEDEBUG
2041 		if (ifp->if_flags & IFF_DEBUG)
2042 			sc->sc_debug = IED_ALL;
2043 		else
2044 			sc->sc_debug = 0;
2045 #endif
2046 		break;
2047 
2048 	default:
2049 		error = ether_ioctl(ifp, &sc->sc_arpcom, cmd, data);
2050 	}
2051 
2052 	if (error == ENETRESET) {
2053 		if (ifp->if_flags & IFF_RUNNING)
2054 			mc_reset(sc);
2055 		error = 0;
2056 	}
2057 
2058 	splx(s);
2059 	return error;
2060 }
2061 
2062 static void
2063 mc_reset(sc)
2064 	struct ie_softc *sc;
2065 {
2066 	struct arpcom *ac = &sc->sc_arpcom;
2067 	struct ether_multi *enm;
2068 	struct ether_multistep step;
2069 
2070 	if (ac->ac_multirangecnt > 0) {
2071 		ac->ac_if.if_flags |= IFF_ALLMULTI;
2072 		ieioctl(&ac->ac_if, SIOCSIFFLAGS, NULL);
2073 		goto setflag;
2074 	}
2075 	/*
2076 	 * Step through the list of addresses.
2077 	 */
2078 	sc->mcast_count = 0;
2079 	ETHER_FIRST_MULTI(step, ac, enm);
2080 	while (enm) {
2081 		if (sc->mcast_count >= MAXMCAST) {
2082 			ac->ac_if.if_flags |= IFF_ALLMULTI;
2083 			ieioctl(&ac->ac_if, SIOCSIFFLAGS, NULL);
2084 			goto setflag;
2085 		}
2086 
2087 		bcopy(enm->enm_addrlo, &sc->mcast_addrs[sc->mcast_count], 6);
2088 		sc->mcast_count++;
2089 		ETHER_NEXT_MULTI(step, enm);
2090 	}
2091 setflag:
2092 	sc->want_mcsetup = 1;
2093 }
2094 
2095 #ifdef IEDEBUG
2096 void
2097 print_rbd(rbd)
2098 	volatile struct ie_recv_buf_desc *rbd;
2099 {
2100 
2101 	printf("RBD at %08lx:\nactual %04x, next %04x, buffer %08x\n"
2102 	    "length %04x, mbz %04x\n", (u_long)rbd, rbd->ie_rbd_actual,
2103 	    rbd->ie_rbd_next, rbd->ie_rbd_buffer, rbd->ie_rbd_length,
2104 	    rbd->mbz);
2105 }
2106 #endif
2107 
2108