Driver for PNIC boards

3 files changed, 2971 insertions, 1 deletions

diff --git a/sys/dev/pci/files.pci b/sys/dev/pci/files.pci
index 3ad4f3dfaf2..ba3cde3a5c4 100644
--- a/sys/dev/pci/files.pci
+++ b/sys/dev/pci/files.pci
@@ -1,4 +1,4 @@
-#	$OpenBSD: files.pci,v 1.34 1999/01/10 22:30:44 downsj Exp $
+#	$OpenBSD: files.pci,v 1.35 1999/01/11 04:28:24 jason Exp $
 #	$NetBSD: files.pci,v 1.20 1996/09/24 17:47:15 christos Exp $
 #
 # Config file and device description for machine-independent PCI code.
@@ -103,6 +103,11 @@ device	rl: ether, ifnet, mii, ifmedia
 attach	rl at pci
 file	dev/pci/if_rl.c			rl
 
+# Lite-On PNIC
+device	pn: ether, ifnet, ifmedia
+attach	pn at pci
+file	dev/pci/if_pn.c			pn
+
 # Macronix
 device	mx: ether, ifnet, ifmedia
 attach	mx at pci
diff --git a/sys/dev/pci/if_pn.c b/sys/dev/pci/if_pn.c
new file mode 100644
index 00000000000..5f7b1db3235
--- /dev/null
+++ b/sys/dev/pci/if_pn.c
@@ -0,0 +1,2303 @@
+/*	$OpenBSD: if_pn.c,v 1.1 1999/01/11 04:28:24 jason Exp $	*/
+
+/*
+ * Copyright (c) 1997, 1998
+ *	Bill Paul <wpaul@ctr.columbia.edu>.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ * 3. All advertising materials mentioning features or use of this software
+ *    must display the following acknowledgement:
+ *	This product includes software developed by Bill Paul.
+ * 4. Neither the name of the author nor the names of any co-contributors
+ *    may be used to endorse or promote products derived from this software
+ *    without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY Bill Paul AND CONTRIBUTORS ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL Bill Paul OR THE VOICES IN HIS HEAD
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ *
+ *	$FreeBSD: if_pn.c,v 1.6 1999/01/05 00:59:08 wpaul Exp $
+ */
+
+/*
+ * 82c168/82c169 PNIC fast ethernet PCI NIC driver
+ *
+ * Supports various network adapters based on the Lite-On PNIC
+ * PCI network controller chip including the LinkSys LNE100TX.
+ *
+ * Written by Bill Paul <wpaul@ctr.columbia.edu>
+ * Electrical Engineering Department
+ * Columbia University, New York City
+ */
+
+/*
+ * The PNIC chip is a DEC tulip clone. This driver uses much of the
+ * same code from the driver for the Winbond chip (which is also a
+ * tulip clone) except for the MII, EEPROM and filter programming.
+ *
+ * Technically we could merge support for this chip into the 'de'
+ * driver, but it's such a mess that I'm afraid to go near it.
+ *
+ * The PNIC appears to support both an external MII and an internal
+ * transceiver. I think most 100Mbps implementations use a PHY attached
+ * the the MII. The LinkSys board that I have uses a Myson MTD972
+ * 100BaseTX PHY.
+ */
+
+#include "bpfilter.h"
+
+#include <sys/param.h>
+#include <sys/systm.h>
+#include <sys/sockio.h>
+#include <sys/mbuf.h>
+#include <sys/malloc.h>
+#include <sys/kernel.h>
+#include <sys/socket.h>
+
+#ifdef __FreeBSD__
+#include <net/if.h>
+#include <net/if_arp.h>
+#include <net/ethernet.h>
+#include <net/if_dl.h>
+#include <net/if_media.h>
+
+#if NBPFILTER > 0
+#include <net/bpf.h>
+#endif
+
+#include <vm/vm.h>		/* for vtophys */
+#include <vm/pmap.h>		/* for vtophys */
+#include <machine/clock.h>	/* for DELAY */
+#include <machine/bus_pio.h>
+#include <machine/bus_memio.h>
+#include <machine/bus.h>
+
+#include <pci/pcireg.h>
+#include <pci/pcivar.h>
+#endif /* FreeBSD */
+
+#ifdef __OpenBSD__
+#define bootverbose 0
+#include <vm/vm.h>		/* for vtophys */
+#include <vm/pmap.h>		/* for vtophys */
+#include <sys/device.h>
+#include <net/if.h>
+#include <net/if_dl.h>
+#include <net/if_types.h>
+#include <net/if_media.h>
+
+#if NBPFILTER > 0
+#include <net/bpf.h>
+#endif
+
+#ifdef INET
+#include <netinet/in.h>
+#include <netinet/in_systm.h>
+#include <netinet/in_var.h>
+#include <netinet/ip.h>
+#include <netinet/if_ether.h>
+#endif
+
+#include <dev/pci/pcireg.h>
+#include <dev/pci/pcivar.h>
+#include <dev/pci/pcidevs.h>
+#endif
+
+#define PN_USEIOSPACE
+
+/* #define PN_BACKGROUND_AUTONEG */
+
+#define PN_PROMISC_BUG_WAR
+
+#ifdef __FreeBSD__
+#include <pci/if_pnreg.h>
+#else
+#include <dev/pci/if_pnreg.h>
+#endif
+
+#if !defined(lint) && defined(__FreeBSD__)
+static const char rcsid[] =
+	"$Id: if_pn.c,v 1.1 1999/01/11 04:28:24 jason Exp $";
+#endif
+
+#if defined(__FreeBSD__)
+/*
+ * Various supported device vendors/types and their names.
+ */
+static struct pn_type pn_devs[] = {
+	{ PN_VENDORID, PN_DEVICEID_PNIC,
+		"82c168/82c169 PNIC 10/100BaseTX" },
+	{ 0, 0, NULL }
+};
+#endif
+
+/*
+ * Various supported PHY vendors/types and their names. Note that
+ * this driver will work with pretty much any MII-compliant PHY,
+ * so failure to positively identify the chip is not a fatal error.
+ */
+
+static struct pn_type pn_phys[] = {
+	{ TI_PHY_VENDORID, TI_PHY_10BT, "<TI ThunderLAN 10BT (internal)>" },
+	{ TI_PHY_VENDORID, TI_PHY_100VGPMI, "<TI TNETE211 100VG Any-LAN>" },
+	{ NS_PHY_VENDORID, NS_PHY_83840A, "<National Semiconductor DP83840A>"},
+	{ LEVEL1_PHY_VENDORID, LEVEL1_PHY_LXT970, "<Level 1 LXT970>" }, 
+	{ INTEL_PHY_VENDORID, INTEL_PHY_82555, "<Intel 82555>" },
+	{ SEEQ_PHY_VENDORID, SEEQ_PHY_80220, "<SEEQ 80220>" },
+	{ 0, 0, "<MII-compliant physical interface>" }
+};
+
+#if defined(__FreeBSD__)
+static unsigned long pn_count = 0;
+static const char *pn_probe	__P((pcici_t, pcidi_t));
+static void pn_attach		__P((pcici_t, int));
+static void pn_intr		__P((void *));
+static void pn_shutdown		__P((int, void *));
+#elif defined(__OpenBSD__)
+static int pn_probe	__P((struct device *, void *, void *));
+static void pn_attach	__P((struct device *, struct device *, void *));
+static int pn_intr	__P((void *));
+static void pn_shutdown	__P((void *));
+#endif
+
+static int pn_newbuf		__P((struct pn_softc *,
+						struct pn_chain_onefrag *));
+static int pn_encap		__P((struct pn_softc *, struct pn_chain *,
+						struct mbuf *));
+
+#ifdef PN_PROMISC_BUG_WAR
+static void pn_promisc_bug_war	__P((struct pn_softc *,
+						struct pn_chain_onefrag *));
+#endif
+static void pn_rxeof		__P((struct pn_softc *));
+static void pn_rxeoc		__P((struct pn_softc *));
+static void pn_txeof		__P((struct pn_softc *));
+static void pn_txeoc		__P((struct pn_softc *));
+static void pn_start		__P((struct ifnet *));
+static int pn_ioctl		__P((struct ifnet *, u_long, caddr_t));
+static void pn_init		__P((void *));
+static void pn_stop		__P((struct pn_softc *));
+static void pn_watchdog		__P((struct ifnet *));
+static int pn_ifmedia_upd	__P((struct ifnet *));
+static void pn_ifmedia_sts	__P((struct ifnet *, struct ifmediareq *));
+
+static void pn_eeprom_getword	__P((struct pn_softc *, u_int8_t, u_int16_t *));
+static void pn_read_eeprom	__P((struct pn_softc *, caddr_t, int,
+							int, int));
+static u_int16_t pn_phy_readreg	__P((struct pn_softc *, int));
+static void pn_phy_writereg	__P((struct pn_softc *, u_int16_t, u_int16_t));
+
+static void pn_autoneg_xmit	__P((struct pn_softc *));
+static void pn_autoneg_mii	__P((struct pn_softc *, int, int));
+static void pn_setmode_mii	__P((struct pn_softc *, int));
+static void pn_getmode_mii	__P((struct pn_softc *));
+static void pn_setcfg		__P((struct pn_softc *, u_int16_t));
+static u_int32_t pn_calchash	__P((u_int8_t *));
+static void pn_setfilt		__P((struct pn_softc *));
+static void pn_reset		__P((struct pn_softc *));
+static int pn_list_rx_init	__P((struct pn_softc *));
+static int pn_list_tx_init	__P((struct pn_softc *));
+
+#define PN_SETBIT(sc, reg, x)				\
+	CSR_WRITE_4(sc, reg,				\
+		CSR_READ_4(sc, reg) | x)
+
+#define PN_CLRBIT(sc, reg, x)				\
+	CSR_WRITE_4(sc, reg,				\
+		CSR_READ_4(sc, reg) & ~x)
+
+/*
+ * Read a word of data stored in the EEPROM at address 'addr.'
+ */
+static void pn_eeprom_getword(sc, addr, dest)
+	struct pn_softc		*sc;
+	u_int8_t		addr;
+	u_int16_t		*dest;
+{
+	register int		i;
+	u_int32_t		r;
+
+	CSR_WRITE_4(sc, PN_SIOCTL, PN_EE_READ|addr);
+
+	for (i = 0; i < PN_TIMEOUT; i++) {
+		DELAY(1);
+		r = CSR_READ_4(sc, PN_SIO);
+		if (!(r & PN_SIO_BUSY)) {
+			*dest = (u_int16_t)(r & 0x0000FFFF);
+			return;
+		}
+	}
+
+	return;
+
+}
+
+/*
+ * Read a sequence of words from the EEPROM.
+ */
+static void pn_read_eeprom(sc, dest, off, cnt, swap)
+	struct pn_softc		*sc;
+	caddr_t			dest;
+	int			off;
+	int			cnt;
+	int			swap;
+{
+	int			i;
+	u_int16_t		word = 0, *ptr;
+
+	for (i = 0; i < cnt; i++) {
+		pn_eeprom_getword(sc, off + i, &word);
+		ptr = (u_int16_t *)(dest + (i * 2));
+		if (swap)
+			*ptr = ntohs(word);
+		else
+			*ptr = word;
+	}
+
+	return;
+}
+
+static u_int16_t pn_phy_readreg(sc, reg)
+	struct pn_softc		*sc;
+	int			reg;
+{
+	int			i;
+	u_int32_t		rval;
+
+	CSR_WRITE_4(sc, PN_MII,
+		PN_MII_READ | (sc->pn_phy_addr << 23) | (reg << 18));
+
+	for (i = 0; i < PN_TIMEOUT; i++) {
+		DELAY(1);
+		rval = CSR_READ_4(sc, PN_MII);
+		if (!(rval & PN_MII_BUSY)) {
+			if ((u_int16_t)(rval & 0x0000FFFF) == 0xFFFF)
+				return(0);
+			else
+				return((u_int16_t)(rval & 0x0000FFFF));
+		}
+	}
+
+	return(0);
+}
+
+static void pn_phy_writereg(sc, reg, data)
+	struct pn_softc		*sc;
+	u_int16_t		reg;
+	u_int16_t		data;
+{
+	int			i;
+
+	CSR_WRITE_4(sc, PN_MII,
+		PN_MII_WRITE | (sc->pn_phy_addr << 23) | (reg << 18) | data);
+
+
+	for (i = 0; i < PN_TIMEOUT; i++) {
+		if (!(CSR_READ_4(sc, PN_MII) & PN_MII_BUSY))
+			break;
+	}
+
+	return;
+}
+
+#define PN_POLY		0xEDB88320
+#define PN_BITS		9
+
+static u_int32_t pn_calchash(addr)
+	u_int8_t		*addr;
+{
+	u_int32_t		idx, bit, data, crc;
+
+	/* Compute CRC for the address value. */
+	crc = 0xFFFFFFFF; /* initial value */
+
+	for (idx = 0; idx < 6; idx++) {
+		for (data = *addr++, bit = 0; bit < 8; bit++, data >>= 1)
+			crc = (crc >> 1) ^ (((crc ^ data) & 1) ? PN_POLY : 0);
+	}
+
+	return (crc & ((1 << PN_BITS) - 1));
+}
+
+/*
+ * Initiate an autonegotiation session.
+ */
+static void pn_autoneg_xmit(sc)
+	struct pn_softc		*sc;
+{
+	u_int16_t		phy_sts;
+
+	pn_phy_writereg(sc, PHY_BMCR, PHY_BMCR_RESET);
+	DELAY(500);
+	while(pn_phy_readreg(sc, PHY_BMCR)
+			& PHY_BMCR_RESET);
+
+	phy_sts = pn_phy_readreg(sc, PHY_BMCR);
+	phy_sts |= PHY_BMCR_AUTONEGENBL|PHY_BMCR_AUTONEGRSTR;
+	pn_phy_writereg(sc, PHY_BMCR, phy_sts);
+
+	return;
+}
+
+/*
+ * Invoke autonegotiation on a PHY.
+ */
+static void pn_autoneg_mii(sc, flag, verbose)
+	struct pn_softc		*sc;
+	int			flag;
+	int			verbose;
+{
+	u_int16_t		phy_sts = 0, media, advert, ability;
+	struct ifnet		*ifp;
+	struct ifmedia		*ifm;
+
+	ifm = &sc->ifmedia;
+	ifp = &sc->arpcom.ac_if;
+
+	ifm->ifm_media = IFM_ETHER | IFM_AUTO;
+
+	/*
+	 * The 100baseT4 PHY on the 3c905-T4 has the 'autoneg supported'
+	 * bit cleared in the status register, but has the 'autoneg enabled'
+	 * bit set in the control register. This is a contradiction, and
+	 * I'm not sure how to handle it. If you want to force an attempt
+	 * to autoneg for 100baseT4 PHYs, #define FORCE_AUTONEG_TFOUR
+	 * and see what happens.
+	 */
+#ifndef FORCE_AUTONEG_TFOUR
+	/*
+	 * First, see if autoneg is supported. If not, there's
+	 * no point in continuing.
+	 */
+	phy_sts = pn_phy_readreg(sc, PHY_BMSR);
+	if (!(phy_sts & PHY_BMSR_CANAUTONEG)) {
+		if (verbose)
+			printf("pn%d: autonegotiation not supported\n",
+							sc->pn_unit);
+		ifm->ifm_media = IFM_ETHER|IFM_10_T|IFM_HDX;	
+		return;
+	}
+#endif
+
+	switch (flag) {
+	case PN_FLAG_FORCEDELAY:
+		/*
+	 	 * XXX Never use this option anywhere but in the probe
+	 	 * routine: making the kernel stop dead in its tracks
+ 		 * for three whole seconds after we've gone multi-user
+		 * is really bad manners.
+	 	 */
+		pn_autoneg_xmit(sc);
+		DELAY(5000000);
+		break;
+	case PN_FLAG_SCHEDDELAY:
+		/*
+		 * Wait for the transmitter to go idle before starting
+		 * an autoneg session, otherwise pn_start() may clobber
+	 	 * our timeout, and we don't want to allow transmission
+		 * during an autoneg session since that can screw it up.
+	 	 */
+		if (sc->pn_cdata.pn_tx_head != NULL) {
+			sc->pn_want_auto = 1;
+			return;
+		}
+		pn_autoneg_xmit(sc);
+		ifp->if_timer = 5;
+		sc->pn_autoneg = 1;
+		sc->pn_want_auto = 0;
+		return;
+		break;
+	case PN_FLAG_DELAYTIMEO:
+		ifp->if_timer = 0;
+		sc->pn_autoneg = 0;
+		break;
+	default:
+		printf("pn%d: invalid autoneg flag: %d\n", sc->pn_unit, flag);
+		return;
+	}
+
+	if (pn_phy_readreg(sc, PHY_BMSR) & PHY_BMSR_AUTONEGCOMP) {
+		if (verbose)
+			printf("pn%d: autoneg complete, ", sc->pn_unit);
+		phy_sts = pn_phy_readreg(sc, PHY_BMSR);
+	} else {
+		if (verbose)
+			printf("pn%d: autoneg not complete, ", sc->pn_unit);
+	}
+
+	media = pn_phy_readreg(sc, PHY_BMCR);
+
+	/* Link is good. Report modes and set duplex mode. */
+	if (pn_phy_readreg(sc, PHY_BMSR) & PHY_BMSR_LINKSTAT) {
+		if (verbose)
+			printf("link status good ");
+		advert = pn_phy_readreg(sc, PHY_ANAR);
+		ability = pn_phy_readreg(sc, PHY_LPAR);
+
+		if (advert & PHY_ANAR_100BT4 && ability & PHY_ANAR_100BT4) {
+			ifm->ifm_media = IFM_ETHER|IFM_100_T4;
+			media |= PHY_BMCR_SPEEDSEL;
+			media &= ~PHY_BMCR_DUPLEX;
+			printf("(100baseT4)\n");
+		} else if (advert & PHY_ANAR_100BTXFULL &&
+			ability & PHY_ANAR_100BTXFULL) {
+			ifm->ifm_media = IFM_ETHER|IFM_100_TX|IFM_FDX;
+			media |= PHY_BMCR_SPEEDSEL;
+			media |= PHY_BMCR_DUPLEX;
+			printf("(full-duplex, 100Mbps)\n");
+		} else if (advert & PHY_ANAR_100BTXHALF &&
+			ability & PHY_ANAR_100BTXHALF) {
+			ifm->ifm_media = IFM_ETHER|IFM_100_TX|IFM_HDX;
+			media |= PHY_BMCR_SPEEDSEL;
+			media &= ~PHY_BMCR_DUPLEX;
+			printf("(half-duplex, 100Mbps)\n");
+		} else if (advert & PHY_ANAR_10BTFULL &&
+			ability & PHY_ANAR_10BTFULL) {
+			ifm->ifm_media = IFM_ETHER|IFM_10_T|IFM_FDX;
+			media &= ~PHY_BMCR_SPEEDSEL;
+			media |= PHY_BMCR_DUPLEX;
+			printf("(full-duplex, 10Mbps)\n");
+		} else if (advert & PHY_ANAR_10BTHALF &&
+			ability & PHY_ANAR_10BTHALF) {
+			ifm->ifm_media = IFM_ETHER|IFM_10_T|IFM_HDX;
+			media &= ~PHY_BMCR_SPEEDSEL;
+			media &= ~PHY_BMCR_DUPLEX;
+			printf("(half-duplex, 10Mbps)\n");
+		}
+
+		media &= ~PHY_BMCR_AUTONEGENBL;
+
+		/* Set ASIC's duplex mode to match the PHY. */
+		pn_setcfg(sc, media);
+		pn_phy_writereg(sc, PHY_BMCR, media);
+	} else {
+		if (verbose)
+			printf("no carrier\n");
+	}
+
+	pn_init(sc);
+
+	if (sc->pn_tx_pend) {
+		sc->pn_autoneg = 0;
+		sc->pn_tx_pend = 0;
+		pn_start(ifp);
+	}
+
+	return;
+}
+
+static void pn_getmode_mii(sc)
+	struct pn_softc		*sc;
+{
+	u_int16_t		bmsr;
+	struct ifnet		*ifp;
+
+	ifp = &sc->arpcom.ac_if;
+
+	bmsr = pn_phy_readreg(sc, PHY_BMSR);
+	if (bootverbose)
+		printf("pn%d: PHY status word: %x\n", sc->pn_unit, bmsr);
+
+	/* fallback */
+	sc->ifmedia.ifm_media = IFM_ETHER|IFM_10_T|IFM_HDX;
+
+	if (bmsr & PHY_BMSR_10BTHALF) {
+		if (bootverbose)
+			printf("pn%d: 10Mbps half-duplex mode supported\n",
+								sc->pn_unit);
+		ifmedia_add(&sc->ifmedia,
+			IFM_ETHER|IFM_10_T|IFM_HDX, 0, NULL);
+		ifmedia_add(&sc->ifmedia, IFM_ETHER|IFM_10_T, 0, NULL);
+	}
+
+	if (bmsr & PHY_BMSR_10BTFULL) {
+		if (bootverbose)
+			printf("pn%d: 10Mbps full-duplex mode supported\n",
+								sc->pn_unit);
+		ifmedia_add(&sc->ifmedia,
+			IFM_ETHER|IFM_10_T|IFM_FDX, 0, NULL);
+		sc->ifmedia.ifm_media = IFM_ETHER|IFM_10_T|IFM_FDX;
+	}
+
+	if (bmsr & PHY_BMSR_100BTXHALF) {
+		if (bootverbose)
+			printf("pn%d: 100Mbps half-duplex mode supported\n",
+								sc->pn_unit);
+		ifp->if_baudrate = 100000000;
+		ifmedia_add(&sc->ifmedia, IFM_ETHER|IFM_100_TX, 0, NULL);
+		ifmedia_add(&sc->ifmedia,
+			IFM_ETHER|IFM_100_TX|IFM_HDX, 0, NULL);
+		sc->ifmedia.ifm_media = IFM_ETHER|IFM_100_TX|IFM_HDX;
+	}
+
+	if (bmsr & PHY_BMSR_100BTXFULL) {
+		if (bootverbose)
+			printf("pn%d: 100Mbps full-duplex mode supported\n",
+								sc->pn_unit);
+		ifp->if_baudrate = 100000000;
+		ifmedia_add(&sc->ifmedia,
+			IFM_ETHER|IFM_100_TX|IFM_FDX, 0, NULL);
+		sc->ifmedia.ifm_media = IFM_ETHER|IFM_100_TX|IFM_FDX;
+	}
+
+	/* Some also support 100BaseT4. */
+	if (bmsr & PHY_BMSR_100BT4) {
+		if (bootverbose)
+			printf("pn%d: 100baseT4 mode supported\n", sc->pn_unit);
+		ifp->if_baudrate = 100000000;
+		ifmedia_add(&sc->ifmedia, IFM_ETHER|IFM_100_T4, 0, NULL);
+		sc->ifmedia.ifm_media = IFM_ETHER|IFM_100_T4;
+#ifdef FORCE_AUTONEG_TFOUR
+		if (bootverbose)
+			printf("pn%d: forcing on autoneg support for BT4\n",
+							 sc->pn_unit);
+		ifmedia_add(&sc->ifmedia, IFM_ETHER|IFM_AUTO, 0 NULL):
+		sc->ifmedia.ifm_media = IFM_ETHER|IFM_AUTO;
+#endif
+	}
+
+	if (bmsr & PHY_BMSR_CANAUTONEG) {
+		if (bootverbose)
+			printf("pn%d: autoneg supported\n", sc->pn_unit);
+		ifmedia_add(&sc->ifmedia, IFM_ETHER|IFM_AUTO, 0, NULL);
+		sc->ifmedia.ifm_media = IFM_ETHER|IFM_AUTO;
+	}
+
+	return;
+}
+
+/*
+ * Set speed and duplex mode.
+ */
+static void pn_setmode_mii(sc, media)
+	struct pn_softc		*sc;
+	int			media;
+{
+	u_int16_t		bmcr;
+	struct ifnet		*ifp;
+
+	ifp = &sc->arpcom.ac_if;
+
+	/*
+	 * If an autoneg session is in progress, stop it.
+	 */
+	if (sc->pn_autoneg) {
+		printf("pn%d: canceling autoneg session\n", sc->pn_unit);
+		ifp->if_timer = sc->pn_autoneg = sc->pn_want_auto = 0;
+		bmcr = pn_phy_readreg(sc, PHY_BMCR);
+		bmcr &= ~PHY_BMCR_AUTONEGENBL;
+		pn_phy_writereg(sc, PHY_BMCR, bmcr);
+	}
+
+	printf("pn%d: selecting MII, ", sc->pn_unit);
+
+	bmcr = pn_phy_readreg(sc, PHY_BMCR);
+
+	bmcr &= ~(PHY_BMCR_AUTONEGENBL|PHY_BMCR_SPEEDSEL|
+			PHY_BMCR_DUPLEX|PHY_BMCR_LOOPBK);
+
+	if (IFM_SUBTYPE(media) == IFM_100_T4) {
+		printf("100Mbps/T4, half-duplex\n");
+		bmcr |= PHY_BMCR_SPEEDSEL;
+		bmcr &= ~PHY_BMCR_DUPLEX;
+	}
+
+	if (IFM_SUBTYPE(media) == IFM_100_TX) {
+		printf("100Mbps, ");
+		bmcr |= PHY_BMCR_SPEEDSEL;
+	}
+
+	if (IFM_SUBTYPE(media) == IFM_10_T) {
+		printf("10Mbps, ");
+		bmcr &= ~PHY_BMCR_SPEEDSEL;
+	}
+
+	if ((media & IFM_GMASK) == IFM_FDX) {
+		printf("full duplex\n");
+		bmcr |= PHY_BMCR_DUPLEX;
+	} else {
+		printf("half duplex\n");
+		bmcr &= ~PHY_BMCR_DUPLEX;
+	}
+
+	pn_setcfg(sc, bmcr);
+	pn_phy_writereg(sc, PHY_BMCR, bmcr);
+
+	return;
+}
+
+/*
+ * Programming the receiver filter on the tulip/PNIC is gross. You
+ * have to construct a special setup frame and download it to the
+ * chip via the transmit DMA engine. This routine is also somewhat
+ * gross, as the setup frame is sent synchronously rather than putting
+ * on the transmit queue. The transmitter has to be stopped, then we
+ * can download the frame and wait for the 'owned' bit to clear.
+ *
+ * We always program the chip using 'hash perfect' mode, i.e. one perfect
+ * address (our node address) and a 512-bit hash filter for multicast
+ * frames. We also sneak the broadcast address into the hash filter since
+ * we need that too.
+ */
+void pn_setfilt(sc)
+	struct pn_softc		*sc;
+{
+	struct pn_desc		*sframe;
+	u_int32_t		h, *sp;
+#ifdef __FreeBSD__
+	struct ifmultiaddr	*ifma;
+#else
+	struct arpcom *ac = &sc->arpcom;
+	struct ether_multi *enm;
+	struct ether_multistep step;
+#endif
+	struct ifnet		*ifp;
+	int			i;
+
+	ifp = &sc->arpcom.ac_if;
+
+	PN_CLRBIT(sc, PN_NETCFG, PN_NETCFG_TX_ON);
+	PN_SETBIT(sc, PN_ISR, PN_ISR_TX_IDLE);
+
+	sframe = &sc->pn_cdata.pn_sframe;
+	sp = (u_int32_t *)&sc->pn_cdata.pn_sbuf;
+	bzero((char *)sp, PN_SFRAME_LEN);
+
+	sframe->pn_status = PN_TXSTAT_OWN;
+	sframe->pn_next = vtophys(&sc->pn_ldata->pn_tx_list[0]);
+	sframe->pn_data = vtophys(&sc->pn_cdata.pn_sbuf);
+	sframe->pn_ctl = PN_SFRAME_LEN | PN_TXCTL_TLINK |
+			PN_TXCTL_SETUP | PN_FILTER_HASHPERF;
+
+	/* If we want promiscuous mode, set the allframes bit. */
+	if (ifp->if_flags & IFF_PROMISC)
+		PN_SETBIT(sc, PN_NETCFG, PN_NETCFG_RX_PROMISC);
+	else
+		PN_CLRBIT(sc, PN_NETCFG, PN_NETCFG_RX_PROMISC);
+
+	if (ifp->if_flags & IFF_ALLMULTI)
+		PN_SETBIT(sc, PN_NETCFG, PN_NETCFG_RX_ALLMULTI);
+
+#ifdef __FreeBSD__
+	for (ifma = ifp->if_multiaddrs.lh_first; ifma != NULL;
+				ifma = ifma->ifma_link.le_next) {
+		if (ifma->ifma_addr->sa_family != AF_LINK)
+			continue;
+		h = pn_calchash(LLADDR((struct sockaddr_dl *)ifma->ifma_addr));
+		sp[h >> 4] |= 1 << (h & 0xF);
+	}
+#endif
+
+#ifdef __OpenBSD__
+	ETHER_FIRST_MULTI(step, ac, enm);
+	while (enm != NULL) {
+		h = pn_calchash(enm->enm_addrlo);
+		sp[h >> 4] |= 1 << (h & 0xf);
+		ETHER_NEXT_MULTI(step, enm);
+	}
+#endif
+
+	if (ifp->if_flags & IFF_BROADCAST) {
+		h = pn_calchash(etherbroadcastaddr);
+		sp[h >> 4] |= 1 << (h & 0xF);
+	}
+
+	sp[39] = ((u_int16_t *)sc->arpcom.ac_enaddr)[0];
+	sp[40] = ((u_int16_t *)sc->arpcom.ac_enaddr)[1];
+	sp[41] = ((u_int16_t *)sc->arpcom.ac_enaddr)[2];
+
+	CSR_WRITE_4(sc, PN_TXADDR, vtophys(sframe));
+	PN_SETBIT(sc, PN_NETCFG, PN_NETCFG_TX_ON);
+	CSR_WRITE_4(sc, PN_TXSTART, 0xFFFFFFFF);
+
+	/*
+	 * Wait for chip to clear the 'own' bit.
+	 */
+	for (i = 0; i < PN_TIMEOUT; i++) {
+		DELAY(10);
+		if (sframe->pn_status != PN_TXSTAT_OWN)
+			break;
+	}
+
+	if (i == PN_TIMEOUT)
+		printf("pn%d: failed to send setup frame\n", sc->pn_unit);
+
+	PN_SETBIT(sc, PN_ISR, PN_ISR_TX_NOBUF|PN_ISR_TX_IDLE);
+
+	return;
+}
+
+/*
+ * In order to fiddle with the
+ * 'full-duplex' and '100Mbps' bits in the netconfig register, we
+ * first have to put the transmit and/or receive logic in the idle state.
+ */
+static void pn_setcfg(sc, bmcr)
+	struct pn_softc		*sc;
+	u_int16_t		bmcr;
+{
+	int			i, restart = 0;
+
+	if (CSR_READ_4(sc, PN_NETCFG) & (PN_NETCFG_TX_ON|PN_NETCFG_RX_ON)) {
+		restart = 1;
+		PN_CLRBIT(sc, PN_NETCFG, (PN_NETCFG_TX_ON|PN_NETCFG_RX_ON));
+
+		for (i = 0; i < PN_TIMEOUT; i++) {
+			DELAY(10);
+			if ((CSR_READ_4(sc, PN_ISR) & PN_ISR_TX_IDLE) &&
+				(CSR_READ_4(sc, PN_ISR) & PN_ISR_RX_IDLE))
+				break;
+		}
+
+		if (i == PN_TIMEOUT)
+			printf("pn%d: failed to force tx and "
+				"rx to idle state\n", sc->pn_unit);
+
+	}
+
+	if (bmcr & PHY_BMCR_SPEEDSEL)
+		PN_CLRBIT(sc, PN_NETCFG, PN_NETCFG_SPEEDSEL);
+	else
+		PN_SETBIT(sc, PN_NETCFG, PN_NETCFG_SPEEDSEL);
+
+	if (bmcr & PHY_BMCR_DUPLEX)
+		PN_SETBIT(sc, PN_NETCFG, PN_NETCFG_FULLDUPLEX);
+	else
+		PN_CLRBIT(sc, PN_NETCFG, PN_NETCFG_FULLDUPLEX);
+
+	if (restart)
+		PN_SETBIT(sc, PN_NETCFG, PN_NETCFG_TX_ON|PN_NETCFG_RX_ON);
+
+	return;
+}
+
+static void pn_reset(sc)
+	struct pn_softc		*sc;
+{
+	register int		i;
+
+	PN_SETBIT(sc, PN_BUSCTL, PN_BUSCTL_RESET);
+
+	for (i = 0; i < PN_TIMEOUT; i++) {
+		DELAY(10);
+		if (!(CSR_READ_4(sc, PN_BUSCTL) & PN_BUSCTL_RESET))
+			break;
+	}
+	if (i == PN_TIMEOUT)
+		printf("pn%d: reset never completed!\n", sc->pn_unit);
+
+	/* Wait a little while for the chip to get its brains in order. */
+	DELAY(1000);
+	return;
+}
+
+#ifdef __FreeBSD__
+/*
+ * Probe for a Lite-On PNIC chip. Check the PCI vendor and device
+ * IDs against our list and return a device name if we find a match.
+ */
+static const char *
+pn_probe(config_id, device_id)
+	pcici_t			config_id;
+	pcidi_t			device_id;
+{
+	struct pn_type		*t;
+
+	t = pn_devs;
+
+	while(t->pn_name != NULL) {
+		if ((device_id & 0xFFFF) == t->pn_vid &&
+		    ((device_id >> 16) & 0xFFFF) == t->pn_did) {
+			return(t->pn_name);
+		}
+		t++;
+	}
+
+	return(NULL);
+}
+
+/*
+ * Attach the interface. Allocate softc structures, do ifmedia
+ * setup and ethernet/BPF attach.
+ */
+static void
+pn_attach(config_id, unit)
+	pcici_t			config_id;
+	int			unit;
+{
+	int			s, i;
+#ifndef PN_USEIOSPACE
+	vm_offset_t		pbase, vbase;
+#endif
+	u_char			eaddr[ETHER_ADDR_LEN];
+	u_int32_t		command;
+	struct pn_softc		*sc;
+	struct ifnet		*ifp;
+	int			media = IFM_ETHER|IFM_100_TX|IFM_FDX;
+	unsigned int		round;
+	caddr_t			roundptr;
+	struct pn_type		*p;
+	u_int16_t		phy_vid, phy_did, phy_sts;
+#ifdef PN_PROMISC_BUG_WAR
+	u_int32_t		revision = 0;
+#endif
+
+	s = splimp();
+
+	sc = malloc(sizeof(struct pn_softc), M_DEVBUF, M_NOWAIT);
+	if (sc == NULL) {
+		printf("pn%d: no memory for softc struct!\n", unit);
+		return;
+	}
+	bzero(sc, sizeof(struct pn_softc));
+
+	/*
+	 * Handle power management nonsense.
+	 */
+
+	command = pci_conf_read(config_id, PN_PCI_CAPID) & 0x000000FF;
+	if (command == 0x01) {
+
+		command = pci_conf_read(config_id, PN_PCI_PWRMGMTCTRL);
+		if (command & PN_PSTATE_MASK) {
+			u_int32_t		iobase, membase, irq;
+
+			/* Save important PCI config data. */
+			iobase = pci_conf_read(config_id, PN_PCI_LOIO);
+			membase = pci_conf_read(config_id, PN_PCI_LOMEM);
+			irq = pci_conf_read(config_id, PN_PCI_INTLINE);
+
+			/* Reset the power state. */
+			printf("pn%d: chip is in D%d power mode "
+			"-- setting to D0\n", unit, command & PN_PSTATE_MASK);
+			command &= 0xFFFFFFFC;
+			pci_conf_write(config_id, PN_PCI_PWRMGMTCTRL, command);
+
+			/* Restore PCI config data. */
+			pci_conf_write(config_id, PN_PCI_LOIO, iobase);
+			pci_conf_write(config_id, PN_PCI_LOMEM, membase);
+			pci_conf_write(config_id, PN_PCI_INTLINE, irq);
+		}
+	}
+
+	/*
+	 * Map control/status registers.
+	 */
+	command = pci_conf_read(config_id, PCI_COMMAND_STATUS_REG);
+	command |= (PCIM_CMD_PORTEN|PCIM_CMD_MEMEN|PCIM_CMD_BUSMASTEREN);
+	pci_conf_write(config_id, PCI_COMMAND_STATUS_REG, command);
+	command = pci_conf_read(config_id, PCI_COMMAND_STATUS_REG);
+
+#ifdef PN_USEIOSPACE
+	if (!(command & PCIM_CMD_PORTEN)) {
+		printf("pn%d: failed to enable I/O ports!\n", unit);
+		free(sc, M_DEVBUF);
+		goto fail;
+	}
+
+	if (!pci_map_port(config_id, PN_PCI_LOIO,
+					(u_short *)&(sc->pn_bhandle))) {
+		printf ("pn%d: couldn't map ports\n", unit);
+		goto fail;
+	}
+	sc->pn_btag = I386_BUS_SPACE_IO;
+#else
+	if (!(command & PCIM_CMD_MEMEN)) {
+		printf("pn%d: failed to enable memory mapping!\n", unit);
+		goto fail;
+	}
+
+	if (!pci_map_mem(config_id, PN_PCI_LOMEM, &vbase, &pbase)) {
+		printf ("pn%d: couldn't map memory\n", unit);
+		goto fail;
+	}
+	sc->pn_bhandle = vbase;
+	sc->pn_btag = I386_BUS_SPACE_MEM;
+#endif
+
+	/* Allocate interrupt */
+	if (!pci_map_int(config_id, pn_intr, sc, &net_imask)) {
+		printf("pn%d: couldn't map interrupt\n", unit);
+		goto fail;
+	}
+
+	/* Reset the adapter. */
+	pn_reset(sc);
+
+	/*
+	 * Get station address from the EEPROM.
+	 */
+	pn_read_eeprom(sc, (caddr_t)&eaddr, 0, 3, 1);
+
+	/*
+	 * A PNIC chip was detected. Inform the world.
+	 */
+	printf("pn%d: Ethernet address: %6D\n", unit, eaddr, ":");
+
+	sc->pn_unit = unit;
+	bcopy(eaddr, (char *)&sc->arpcom.ac_enaddr, ETHER_ADDR_LEN);
+
+	sc->pn_ldata_ptr = malloc(sizeof(struct pn_list_data) + 8,
+				M_DEVBUF, M_NOWAIT);
+	if (sc->pn_ldata_ptr == NULL) {
+		free(sc, M_DEVBUF);
+		printf("pn%d: no memory for list buffers!\n", unit);
+		goto fail;
+	}
+
+	sc->pn_ldata = (struct pn_list_data *)sc->pn_ldata_ptr;
+	round = (unsigned int)sc->pn_ldata_ptr & 0xF;
+	roundptr = sc->pn_ldata_ptr;
+	for (i = 0; i < 8; i++) {
+		if (round % 8) {
+			round++;
+			roundptr++;
+		} else
+			break;
+	}
+	sc->pn_ldata = (struct pn_list_data *)roundptr;
+	bzero(sc->pn_ldata, sizeof(struct pn_list_data));
+
+#ifdef PN_PROMISC_BUG_WAR
+	revision = pci_conf_read(config_id, PN_PCI_REVISION) & 0x000000FF;
+	if (revision == PN_169B_REV || revision == PN_169_REV) {
+		sc->pn_promisc_war = 1;
+		sc->pn_promisc_buf = malloc(PN_RXLEN * 5, M_DEVBUF, M_NOWAIT);
+		if (sc->pn_promisc_buf == NULL) {
+			printf("pn%d: no memory for workaround buffer\n", unit);
+			goto fail;
+		}
+	} else {
+		sc->pn_promisc_war = 0;
+	}
+#endif
+
+	ifp = &sc->arpcom.ac_if;
+	ifp->if_softc = sc;
+	ifp->if_unit = unit;
+	ifp->if_name = "pn";
+	ifp->if_mtu = ETHERMTU;
+	ifp->if_flags = IFF_BROADCAST | IFF_SIMPLEX | IFF_MULTICAST;
+	ifp->if_ioctl = pn_ioctl;
+	ifp->if_output = ether_output;
+	ifp->if_start = pn_start;
+	ifp->if_watchdog = pn_watchdog;
+	ifp->if_init = pn_init;
+	ifp->if_baudrate = 10000000;
+
+	if (bootverbose)
+		printf("pn%d: probing for a PHY\n", sc->pn_unit);
+	for (i = PN_PHYADDR_MIN; i < PN_PHYADDR_MAX + 1; i++) {
+		if (bootverbose)
+			printf("pn%d: checking address: %d\n",
+						sc->pn_unit, i);
+		sc->pn_phy_addr = i;
+		pn_phy_writereg(sc, PHY_BMCR, PHY_BMCR_RESET);
+		DELAY(500);
+		while(pn_phy_readreg(sc, PHY_BMCR)
+				& PHY_BMCR_RESET);
+		if ((phy_sts = pn_phy_readreg(sc, PHY_BMSR)))
+			break;
+	}
+	if (phy_sts) {
+		phy_vid = pn_phy_readreg(sc, PHY_VENID);
+		phy_did = pn_phy_readreg(sc, PHY_DEVID);
+		if (bootverbose)
+			printf("pn%d: found PHY at address %d, ",
+					sc->pn_unit, sc->pn_phy_addr);
+		if (bootverbose)
+			printf("vendor id: %x device id: %x\n",
+				phy_vid, phy_did);
+		p = pn_phys;
+		while(p->pn_vid) {
+			if (phy_vid == p->pn_vid &&
+				(phy_did | 0x000F) == p->pn_did) {
+				sc->pn_pinfo = p;
+				break;
+			}
+			p++;
+		}
+		if (sc->pn_pinfo == NULL)
+			sc->pn_pinfo = &pn_phys[PHY_UNKNOWN];
+		if (bootverbose)
+			printf("pn%d: PHY type: %s\n",
+				sc->pn_unit, sc->pn_pinfo->pn_name);
+	} else {
+		printf("pn%d: MII without any phy!\n", sc->pn_unit);
+		goto fail;
+	}
+
+	/*
+	 * Do ifmedia setup.
+	 */
+	ifmedia_init(&sc->ifmedia, 0, pn_ifmedia_upd, pn_ifmedia_sts);
+
+	pn_getmode_mii(sc);
+	pn_autoneg_mii(sc, PN_FLAG_FORCEDELAY, 1);
+	media = sc->ifmedia.ifm_media;
+	pn_stop(sc);
+
+	ifmedia_set(&sc->ifmedia, media);
+
+	/*
+	 * Call MI attach routines.
+	 */
+	if_attach(ifp);
+	ether_ifattach(ifp);
+
+#if NBPFILTER > 0
+	bpfattach(ifp, DLT_EN10MB, sizeof(struct ether_header));
+#endif
+	at_shutdown(pn_shutdown, sc, SHUTDOWN_POST_SYNC);
+
+fail:
+	splx(s);
+	return;
+}
+#endif /* FreeBSD */
+
+/*
+ * Initialize the transmit descriptors.
+ */
+static int pn_list_tx_init(sc)
+	struct pn_softc		*sc;
+{
+	struct pn_chain_data	*cd;
+	struct pn_list_data	*ld;
+	int			i;
+
+	cd = &sc->pn_cdata;
+	ld = sc->pn_ldata;
+	for (i = 0; i < PN_TX_LIST_CNT; i++) {
+		cd->pn_tx_chain[i].pn_ptr = &ld->pn_tx_list[i];
+		if (i == (PN_TX_LIST_CNT - 1))
+			cd->pn_tx_chain[i].pn_nextdesc =
+				&cd->pn_tx_chain[0];
+		else
+			cd->pn_tx_chain[i].pn_nextdesc =
+				&cd->pn_tx_chain[i + 1];
+	}
+
+	cd->pn_tx_free = &cd->pn_tx_chain[0];
+	cd->pn_tx_tail = cd->pn_tx_head = NULL;
+
+	return(0);
+}
+
+
+/*
+ * Initialize the RX descriptors and allocate mbufs for them. Note that
+ * we arrange the descriptors in a closed ring, so that the last descriptor
+ * points back to the first.
+ */
+static int pn_list_rx_init(sc)
+	struct pn_softc		*sc;
+{
+	struct pn_chain_data	*cd;
+	struct pn_list_data	*ld;
+	int			i;
+
+	cd = &sc->pn_cdata;
+	ld = sc->pn_ldata;
+
+	for (i = 0; i < PN_RX_LIST_CNT; i++) {
+		cd->pn_rx_chain[i].pn_ptr =
+			(struct pn_desc *)&ld->pn_rx_list[i];
+		if (pn_newbuf(sc, &cd->pn_rx_chain[i]) == ENOBUFS)
+			return(ENOBUFS);
+		if (i == (PN_RX_LIST_CNT - 1)) {
+			cd->pn_rx_chain[i].pn_nextdesc = &cd->pn_rx_chain[0];
+			ld->pn_rx_list[i].pn_next =
+					vtophys(&ld->pn_rx_list[0]);
+		} else {
+			cd->pn_rx_chain[i].pn_nextdesc = &cd->pn_rx_chain[i + 1];
+			ld->pn_rx_list[i].pn_next =
+					vtophys(&ld->pn_rx_list[i + 1]);
+		}
+	}
+
+	cd->pn_rx_head = &cd->pn_rx_chain[0];
+
+	return(0);
+}
+
+/*
+ * Initialize an RX descriptor and attach an MBUF cluster.
+ * Note: the length fields are only 11 bits wide, which means the
+ * largest size we can specify is 2047. This is important because
+ * MCLBYTES is 2048, so we have to subtract one otherwise we'll
+ * overflow the field and make a mess.
+ */
+static int pn_newbuf(sc, c)
+	struct pn_softc		*sc;
+	struct pn_chain_onefrag	*c;
+{
+	struct mbuf		*m_new = NULL;
+
+	MGETHDR(m_new, M_DONTWAIT, MT_DATA);
+	if (m_new == NULL) {
+		printf("pn%d: no memory for rx list -- packet dropped!\n",
+								sc->pn_unit);
+		return(ENOBUFS);
+	}
+
+	MCLGET(m_new, M_DONTWAIT);
+	if (!(m_new->m_flags & M_EXT)) {
+		printf("pn%d: no memory for rx list -- packet dropped!\n",
+								sc->pn_unit);
+		m_freem(m_new);
+		return(ENOBUFS);
+	}
+
+	/*
+	 * Zero the buffer. This is part of the workaround for the
+	 * promiscuous mode bug in the revision 33 PNIC chips.
+	 */
+	bzero((char *)mtod(m_new, char *), MCLBYTES);
+	m_new->m_len = m_new->m_pkthdr.len = MCLBYTES;
+
+	c->pn_mbuf = m_new;
+	c->pn_ptr->pn_status = PN_RXSTAT;
+	c->pn_ptr->pn_data = vtophys(mtod(m_new, caddr_t));
+	c->pn_ptr->pn_ctl = PN_RXCTL_RLINK | PN_RXLEN;
+
+	return(0);
+}
+
+#ifdef PN_PROMISC_BUG_WAR
+/*
+ * Grrrrr.
+ * Revision 33 of the PNIC chip has a terrible bug in it that manifests
+ * itself when you enable promiscuous mode. Sometimes instead of uploading
+ * one complete frame, it uploads its entire FIFO memory. The frame we
+ * want is at the end of this whole mess, but we never know exactly
+ * how much data has been uploaded, so finding it can be hard.
+ *
+ * There is only one way to do it reliably, and it's disgusting.
+ * Here's what we know:
+ *
+ * - We know there will always be somewhere between one and three extra
+ *   descriptors uploaded.
+ *
+ * - We know the desired received frame will always be at the end of the
+ *   total data upload.
+ *
+ * - We know the size of the desired received frame because it will be
+ *   provided in the length field of the status word in the last descriptor.
+ *
+ * Here's what we do:
+ *
+ * - When we allocate buffers for the receive ring, we bzero() them.
+ *   This means that we know that the buffer contents should be all
+ *   zeros, except for data uploaded by the chip.
+ *
+ * - We also force the PNIC chip to upload frames that include the
+ *   ethernet CRC at the end.
+ *
+ * - We gather all of the bogus frame data into a single buffer.
+ *
+ * - We then position a pointer at the end of this buffer and scan
+ *   backwards until we encounter the first non-zero byte of data.
+ *   This is the end of the received frame. We know we will encounter
+ *   some data at the end of the frame because the CRC will always be
+ *   there, so even if the sender transmits a packet of all zeros,
+ *   we won't be fooled.
+ *
+ * - We know the size of the actual received frame, so we subtract
+ *   that value from the current pointer location. This brings us
+ *   to the start of the actual received packet.
+ *
+ * - We copy this into an mbuf and pass it on, along with the actual
+ *   frame length.
+ *
+ * The performance hit is tremendous, but it beats dropping frames all
+ * the time.
+ */
+
+#define PN_WHOLEFRAME	(PN_RXSTAT_FIRSTFRAG|PN_RXSTAT_LASTFRAG)
+static void pn_promisc_bug_war(sc, cur_rx)
+	struct pn_softc		*sc;
+	struct pn_chain_onefrag	*cur_rx;
+{
+	struct pn_chain_onefrag	*c;
+	unsigned char		*ptr;
+	int			total_len;
+	u_int32_t		rxstat = 0;
+
+	c = sc->pn_promisc_bug_save;
+	ptr = sc->pn_promisc_buf;
+	bzero(ptr, sizeof(PN_RXLEN * 5));
+
+	/* Copy all the bytes from the bogus buffers. */
+	while ((c->pn_ptr->pn_status & PN_WHOLEFRAME) != PN_WHOLEFRAME) {
+		rxstat = c->pn_ptr->pn_status;
+		m_copydata(c->pn_mbuf, 0, PN_RXLEN, ptr);
+		ptr += PN_RXLEN - 2; /* round down to 32-bit boundary */
+		if (c == cur_rx)
+			break;
+		if (rxstat & PN_RXSTAT_LASTFRAG)
+			break;
+		c->pn_ptr->pn_status = PN_RXSTAT;
+		c->pn_ptr->pn_ctl = PN_RXCTL_RLINK | PN_RXLEN;
+		bzero((char *)mtod(c->pn_mbuf, char *), MCLBYTES);
+		c = c->pn_nextdesc;
+	}
+
+
+	/* Find the length of the actual receive frame. */
+	total_len = PN_RXBYTES(rxstat);
+
+	/* Scan backwards until we hit a non-zero byte. */
+	while(*ptr == 0x00) {
+		ptr--;
+	}
+
+	if ((u_int32_t)(ptr) & 0x3)
+		ptr -= 1;
+
+	/* Now find the start of the frame. */
+	ptr -= total_len;
+	if (ptr < sc->pn_promisc_buf)
+		ptr = sc->pn_promisc_buf;
+
+	/*
+	 * Now copy the salvaged frame to the last mbuf and fake up
+	 * the status word to make it look like a successful
+ 	 * frame reception.
+	 */
+	m_copyback(cur_rx->pn_mbuf, 0, total_len, ptr);
+	cur_rx->pn_mbuf->m_len = c->pn_mbuf->m_pkthdr.len = MCLBYTES;
+	cur_rx->pn_ptr->pn_status |= PN_RXSTAT_FIRSTFRAG;
+
+	return;
+}
+#endif
+
+/*
+ * A frame has been uploaded: pass the resulting mbuf chain up to
+ * the higher level protocols.
+ */
+static void pn_rxeof(sc)
+	struct pn_softc		*sc;
+{
+	struct ether_header	*eh;
+	struct mbuf		*m;
+	struct ifnet		*ifp;
+	struct pn_chain_onefrag	*cur_rx;
+	int			total_len = 0;
+	u_int32_t		rxstat;
+
+	ifp = &sc->arpcom.ac_if;
+
+	while(!((rxstat = sc->pn_cdata.pn_rx_head->pn_ptr->pn_status) &
+							PN_RXSTAT_OWN)) {
+		cur_rx = sc->pn_cdata.pn_rx_head;
+		sc->pn_cdata.pn_rx_head = cur_rx->pn_nextdesc;
+
+#ifdef PN_PROMISC_BUG_WAR
+		/*
+		 * XXX The PNIC seems to have a bug that manifests
+		 * when the promiscuous mode bit is set: we have to
+		 * watch for it and work around it.
+		 */
+		if (sc->pn_promisc_war && ifp->if_flags & IFF_PROMISC) {
+			if ((rxstat & PN_WHOLEFRAME) != PN_WHOLEFRAME) {
+				if (rxstat & PN_RXSTAT_FIRSTFRAG)
+					sc->pn_promisc_bug_save = cur_rx;
+				if ((rxstat & PN_RXSTAT_LASTFRAG) == 0)
+					continue;
+				pn_promisc_bug_war(sc, cur_rx);
+				rxstat = cur_rx->pn_ptr->pn_status;
+			}
+		}
+#endif
+
+		/*
+		 * If an error occurs, update stats, clear the
+		 * status word and leave the mbuf cluster in place:
+		 * it should simply get re-used next time this descriptor
+	 	 * comes up in the ring.
+		 */
+		if (rxstat & PN_RXSTAT_RXERR) {
+			ifp->if_ierrors++;
+			if (rxstat & PN_RXSTAT_COLLSEEN)
+				ifp->if_collisions++;
+			cur_rx->pn_ptr->pn_status = PN_RXSTAT;
+			cur_rx->pn_ptr->pn_ctl = PN_RXCTL_RLINK | PN_RXLEN;
+			bzero((char *)mtod(cur_rx->pn_mbuf, char *), MCLBYTES);
+			continue;
+		}
+
+		/* No errors; receive the packet. */	
+		m = cur_rx->pn_mbuf;
+		total_len = PN_RXBYTES(cur_rx->pn_ptr->pn_status);
+
+		/* Trim off the CRC. */
+		total_len -= ETHER_CRC_LEN;
+
+		/*
+		 * Try to conjure up a new mbuf cluster. If that
+		 * fails, it means we have an out of memory condition and
+		 * should leave the buffer in place and continue. This will
+		 * result in a lost packet, but there's little else we
+		 * can do in this situation.
+		 */
+		if (pn_newbuf(sc, cur_rx) == ENOBUFS) {
+			ifp->if_ierrors++;
+			cur_rx->pn_ptr->pn_status = PN_RXSTAT;
+			cur_rx->pn_ptr->pn_ctl = PN_RXCTL_RLINK | PN_RXLEN;
+			bzero((char *)mtod(cur_rx->pn_mbuf, char *), MCLBYTES);
+			continue;
+		}
+
+		ifp->if_ipackets++;
+		eh = mtod(m, struct ether_header *);
+		m->m_pkthdr.rcvif = ifp;
+		m->m_pkthdr.len = m->m_len = total_len;
+#if NBPFILTER > 0
+		/*
+		 * Handle BPF listeners. Let the BPF user see the packet, but
+		 * don't pass it up to the ether_input() layer unless it's
+		 * a broadcast packet, multicast packet, matches our ethernet
+		 * address or the interface is in promiscuous mode.
+		 */
+		if (ifp->if_bpf) {
+#ifdef __FreeBSD__
+			bpf_mtap(ifp, m);
+#else
+			bpf_mtap(ifp->if_bpf, m);
+#endif
+			if (ifp->if_flags & IFF_PROMISC &&
+				(bcmp(eh->ether_dhost, sc->arpcom.ac_enaddr,
+						ETHER_ADDR_LEN) &&
+					(eh->ether_dhost[0] & 1) == 0)) {
+				m_freem(m);
+				continue;
+			}
+		}
+#endif
+		/* Remove header from mbuf and pass it on. */
+		m_adj(m, sizeof(struct ether_header));
+		ether_input(ifp, eh, m);
+	}
+
+	return;
+}
+
+void pn_rxeoc(sc)
+	struct pn_softc		*sc;
+{
+
+	pn_rxeof(sc);
+	PN_CLRBIT(sc, PN_NETCFG, PN_NETCFG_RX_ON);
+	CSR_WRITE_4(sc, PN_RXADDR, vtophys(sc->pn_cdata.pn_rx_head->pn_ptr));
+	PN_SETBIT(sc, PN_NETCFG, PN_NETCFG_RX_ON);
+	CSR_WRITE_4(sc, PN_RXSTART, 0xFFFFFFFF);
+
+	return;
+}
+
+/*
+ * A frame was downloaded to the chip. It's safe for us to clean up
+ * the list buffers.
+ */
+
+static void pn_txeof(sc)
+	struct pn_softc		*sc;
+{
+	struct pn_chain		*cur_tx;
+	struct ifnet		*ifp;
+
+	ifp = &sc->arpcom.ac_if;
+
+	/* Clear the timeout timer. */
+	ifp->if_timer = 0;
+
+	if (sc->pn_cdata.pn_tx_head == NULL)
+		return;
+
+	/*
+	 * Go through our tx list and free mbufs for those
+	 * frames that have been transmitted.
+	 */
+	while(sc->pn_cdata.pn_tx_head->pn_mbuf != NULL) {
+		u_int32_t		txstat;
+
+		cur_tx = sc->pn_cdata.pn_tx_head;
+		txstat = PN_TXSTATUS(cur_tx);
+
+		if ((txstat & PN_TXSTAT_OWN) || txstat == PN_UNSENT)
+			break;
+
+		if (txstat & PN_TXSTAT_ERRSUM) {
+			ifp->if_oerrors++;
+			if (txstat & PN_TXSTAT_EXCESSCOLL)
+				ifp->if_collisions++;
+			if (txstat & PN_TXSTAT_LATECOLL)
+				ifp->if_collisions++;
+		}
+
+		ifp->if_collisions += (txstat & PN_TXSTAT_COLLCNT) >> 3;
+
+
+		ifp->if_opackets++;
+		m_freem(cur_tx->pn_mbuf);
+		cur_tx->pn_mbuf = NULL;
+
+		if (sc->pn_cdata.pn_tx_head == sc->pn_cdata.pn_tx_tail) {
+			sc->pn_cdata.pn_tx_head = NULL;
+			sc->pn_cdata.pn_tx_tail = NULL;
+			break;
+		}
+
+		sc->pn_cdata.pn_tx_head = cur_tx->pn_nextdesc;
+	}
+
+	return;
+}
+
+/*
+ * TX 'end of channel' interrupt handler.
+ */
+static void pn_txeoc(sc)
+	struct pn_softc		*sc;
+{
+	struct ifnet		*ifp;
+
+	ifp = &sc->arpcom.ac_if;
+
+	ifp->if_timer = 0;
+
+	if (sc->pn_cdata.pn_tx_head == NULL) {
+		ifp->if_flags &= ~IFF_OACTIVE;
+		sc->pn_cdata.pn_tx_tail = NULL;
+		if (sc->pn_want_auto)
+			pn_autoneg_mii(sc, PN_FLAG_SCHEDDELAY, 1);
+	} else {
+		if (PN_TXOWN(sc->pn_cdata.pn_tx_head) == PN_UNSENT) {
+			PN_TXOWN(sc->pn_cdata.pn_tx_head) = PN_TXSTAT_OWN;
+			ifp->if_timer = 5;
+			CSR_WRITE_4(sc, PN_TXSTART, 0xFFFFFFFF);
+		}
+	}
+
+	return;
+}
+
+#ifdef __OpenBSD__
+static int pn_intr(arg)
+#else
+static void pn_intr(arg)
+#endif
+	void			*arg;
+{
+	struct pn_softc		*sc;
+	struct ifnet		*ifp;
+	u_int32_t		status;
+#ifdef __OpenBSD__
+	int			claimed = 0;
+#endif
+
+	sc = arg;
+	ifp = &sc->arpcom.ac_if;
+
+	/* Supress unwanted interrupts. */
+	if (!(ifp->if_flags & IFF_UP)) {
+		pn_stop(sc);
+#ifdef __OpenBSD__
+		return claimed;
+#else
+		return;
+#endif
+	}
+
+	/* Disable interrupts. */
+	CSR_WRITE_4(sc, PN_IMR, 0x00000000);
+
+	for (;;) {
+		status = CSR_READ_4(sc, PN_ISR);
+		if (status)
+			CSR_WRITE_4(sc, PN_ISR, status);
+
+		if ((status & PN_INTRS) == 0)
+			break;
+
+#ifdef __OpenBSD__
+		claimed = 1;
+#endif
+
+		if (status & PN_ISR_RX_OK)
+			pn_rxeof(sc);
+
+		if ((status & PN_ISR_RX_WATCHDOG) || (status & PN_ISR_RX_IDLE)
+					|| (status & PN_ISR_RX_NOBUF))
+			pn_rxeoc(sc);
+
+		if (status & PN_ISR_TX_OK)
+			pn_txeof(sc);
+
+ 		if (status & PN_ISR_TX_NOBUF)
+			pn_txeoc(sc);
+
+		if (status & PN_ISR_TX_IDLE) {
+			pn_txeof(sc);
+			if (sc->pn_cdata.pn_tx_head != NULL) {
+				PN_SETBIT(sc, PN_NETCFG, PN_NETCFG_TX_ON);
+				CSR_WRITE_4(sc, PN_TXSTART, 0xFFFFFFFF);
+			}
+		}
+
+		if (status & PN_ISR_TX_UNDERRUN) {
+			ifp->if_oerrors++;
+			pn_txeof(sc);
+			if (sc->pn_cdata.pn_tx_head != NULL) {
+				PN_SETBIT(sc, PN_NETCFG, PN_NETCFG_TX_ON);
+				CSR_WRITE_4(sc, PN_TXSTART, 0xFFFFFFFF);
+			}
+		}
+
+		if (status & PN_ISR_BUS_ERR) {
+			pn_reset(sc);
+			pn_init(sc);
+		}
+	}
+
+	/* Re-enable interrupts. */
+	CSR_WRITE_4(sc, PN_IMR, PN_INTRS);
+
+	if (ifp->if_snd.ifq_head != NULL) {
+		pn_start(ifp);
+	}
+
+#ifdef __OpenBSD__
+	return claimed;
+#else
+	return;
+#endif
+}
+
+/*
+ * Encapsulate an mbuf chain in a descriptor by coupling the mbuf data
+ * pointers to the fragment pointers.
+ */
+static int pn_encap(sc, c, m_head)
+	struct pn_softc		*sc;
+	struct pn_chain		*c;
+	struct mbuf		*m_head;
+{
+	int			frag = 0;
+	struct pn_desc		*f = NULL;
+	int			total_len;
+	struct mbuf		*m;
+
+	/*
+ 	 * Start packing the mbufs in this chain into
+	 * the fragment pointers. Stop when we run out
+ 	 * of fragments or hit the end of the mbuf chain.
+	 */
+	m = m_head;
+	total_len = 0;
+
+	for (m = m_head, frag = 0; m != NULL; m = m->m_next) {
+		if (m->m_len != 0) {
+			if (frag == PN_MAXFRAGS)
+				break;
+			total_len += m->m_len;
+			f = &c->pn_ptr->pn_frag[frag];
+			f->pn_ctl = PN_TXCTL_TLINK | m->m_len;
+			if (frag == 0) {
+				f->pn_ctl |= PN_TXCTL_FIRSTFRAG;
+				f->pn_status = 0;
+			} else
+				f->pn_status = PN_TXSTAT_OWN;
+			f->pn_data = vtophys(mtod(m, vm_offset_t));
+			f->pn_next = vtophys(&c->pn_ptr->pn_frag[frag + 1]);
+			frag++;
+		}
+	}
+
+	/*
+	 * Handle special case: we used up all 16 fragments,
+	 * but we have more mbufs left in the chain. Copy the
+	 * data into an mbuf cluster. Note that we don't
+	 * bother clearing the values in the other fragment
+	 * pointers/counters; it wouldn't gain us anything,
+	 * and would waste cycles.
+	 */
+	if (m != NULL) {
+		struct mbuf		*m_new = NULL;
+
+		MGETHDR(m_new, M_DONTWAIT, MT_DATA);
+		if (m_new == NULL) {
+			printf("pn%d: no memory for tx list", sc->pn_unit);
+			return(1);
+		}
+		if (m_head->m_pkthdr.len > MHLEN) {
+			MCLGET(m_new, M_DONTWAIT);
+			if (!(m_new->m_flags & M_EXT)) {
+				m_freem(m_new);
+				printf("pn%d: no memory for tx list",
+						sc->pn_unit);
+				return(1);
+			}
+		}
+		m_copydata(m_head, 0, m_head->m_pkthdr.len,	
+					mtod(m_new, caddr_t));
+		m_new->m_pkthdr.len = m_new->m_len = m_head->m_pkthdr.len;
+		m_freem(m_head);
+		m_head = m_new;
+		f = &c->pn_ptr->pn_frag[0];
+		f->pn_data = vtophys(mtod(m_new, caddr_t));
+		f->pn_ctl = total_len = m_new->m_len;
+		f->pn_ctl |= PN_TXCTL_TLINK|PN_TXCTL_FIRSTFRAG;
+		frag = 1;
+	}
+
+
+	c->pn_mbuf = m_head;
+	c->pn_lastdesc = frag - 1;
+	PN_TXCTL(c) |= PN_TXCTL_LASTFRAG;
+	PN_TXNEXT(c) = vtophys(&c->pn_nextdesc->pn_ptr->pn_frag[0]);
+
+	return(0);
+}
+
+/*
+ * Main transmit routine. To avoid having to do mbuf copies, we put pointers
+ * to the mbuf data regions directly in the transmit lists. We also save a
+ * copy of the pointers since the transmit list fragment pointers are
+ * physical addresses.
+ */
+
+static void pn_start(ifp)
+	struct ifnet		*ifp;
+{
+	struct pn_softc		*sc;
+	struct mbuf		*m_head = NULL;
+	struct pn_chain		*cur_tx = NULL, *start_tx;
+
+	sc = ifp->if_softc;
+
+	if (sc->pn_autoneg) {
+		sc->pn_tx_pend = 1;
+		return;
+	}
+
+	/*
+	 * Check for an available queue slot. If there are none,
+	 * punt.
+	 */
+	if (sc->pn_cdata.pn_tx_free->pn_mbuf != NULL) {
+		ifp->if_flags |= IFF_OACTIVE;
+		return;
+	}
+
+	start_tx = sc->pn_cdata.pn_tx_free;
+
+	while(sc->pn_cdata.pn_tx_free->pn_mbuf == NULL) {
+		IF_DEQUEUE(&ifp->if_snd, m_head);
+		if (m_head == NULL)
+			break;
+
+		/* Pick a descriptor off the free list. */
+		cur_tx = sc->pn_cdata.pn_tx_free;
+		sc->pn_cdata.pn_tx_free = cur_tx->pn_nextdesc;
+
+		/* Pack the data into the descriptor. */
+		pn_encap(sc, cur_tx, m_head);
+
+		if (cur_tx != start_tx)
+			PN_TXOWN(cur_tx) = PN_TXSTAT_OWN;
+
+#if NBPFILTER > 0
+		/*
+		 * If there's a BPF listener, bounce a copy of this frame
+		 * to him.
+		 */
+		if (ifp->if_bpf)
+#ifdef __FreeBSD__
+			bpf_mtap(ifp, cur_tx->pn_mbuf);
+#else
+			bpf_mtap(ifp->if_bpf, cur_tx->pn_mbuf);
+#endif
+#endif
+	}
+
+	/*
+	 * If there are no packets queued, bail.
+	 */
+	if (cur_tx == NULL)
+		return;
+
+	/*
+	 * Place the request for the upload interrupt
+	 * in the last descriptor in the chain. This way, if
+	 * we're chaining several packets at once, we'll only
+	 * get an interupt once for the whole chain rather than
+	 * once for each packet.
+	 */
+	PN_TXCTL(cur_tx) |= PN_TXCTL_FINT;
+	sc->pn_cdata.pn_tx_tail = cur_tx;
+
+	if (sc->pn_cdata.pn_tx_head == NULL) {
+		sc->pn_cdata.pn_tx_head = start_tx;
+		PN_TXOWN(start_tx) = PN_TXSTAT_OWN;
+		CSR_WRITE_4(sc, PN_TXSTART, 0xFFFFFFFF);
+	} else {
+		PN_TXOWN(start_tx) = PN_UNSENT;
+	}
+
+	/*
+	 * Set a timeout in case the chip goes out to lunch.
+	 */
+	ifp->if_timer = 5;
+
+	return;
+}
+
+static void pn_init(xsc)
+	void			*xsc;
+{
+	struct pn_softc		*sc = xsc;
+	struct ifnet		*ifp = &sc->arpcom.ac_if;
+	u_int16_t		phy_bmcr = 0;
+	int			s;
+
+	if (sc->pn_autoneg)
+		return;
+
+	s = splimp();
+
+	if (sc->pn_pinfo != NULL)
+		phy_bmcr = pn_phy_readreg(sc, PHY_BMCR);
+
+	/*
+	 * Cancel pending I/O and free all RX/TX buffers.
+	 */
+	pn_stop(sc);
+	pn_reset(sc);
+
+	/*
+	 * Set cache alignment and burst length.
+	 */
+	CSR_WRITE_4(sc, PN_BUSCTL, PN_BUSCTL_CONFIG);
+
+	PN_CLRBIT(sc, PN_NETCFG, PN_NETCFG_TX_IMMEDIATE);
+	PN_CLRBIT(sc, PN_NETCFG, PN_NETCFG_NO_RXCRC);
+	PN_CLRBIT(sc, PN_NETCFG, PN_NETCFG_HEARTBEAT);
+	PN_CLRBIT(sc, PN_NETCFG, PN_NETCFG_STORENFWD);
+	PN_CLRBIT(sc, PN_NETCFG, PN_NETCFG_TX_BACKOFF);
+
+	PN_CLRBIT(sc, PN_NETCFG, PN_NETCFG_TX_THRESH);
+	PN_SETBIT(sc, PN_NETCFG, PN_TXTHRESH_72BYTES);
+
+	pn_setcfg(sc, pn_phy_readreg(sc, PHY_BMCR));
+
+	if (sc->pn_pinfo != NULL) {
+		PN_SETBIT(sc, PN_NETCFG, PN_NETCFG_MIIENB);
+		PN_SETBIT(sc, PN_ENDEC, PN_ENDEC_JABBERDIS);
+	}
+
+	/* Init circular RX list. */
+	if (pn_list_rx_init(sc) == ENOBUFS) {
+		printf("pn%d: initialization failed: no "
+			"memory for rx buffers\n", sc->pn_unit);
+		pn_stop(sc);
+		(void)splx(s);
+		return;
+	}
+
+	/*
+	 * Init tx descriptors.
+	 */
+	pn_list_tx_init(sc);
+
+	/*
+	 * Load the address of the RX list.
+	 */
+	CSR_WRITE_4(sc, PN_RXADDR, vtophys(sc->pn_cdata.pn_rx_head->pn_ptr));
+
+	/*
+	 * Load the RX/multicast filter.
+	 */
+	pn_setfilt(sc);
+
+	/*
+	 * Enable interrupts.
+	 */
+	CSR_WRITE_4(sc, PN_IMR, PN_INTRS);
+	CSR_WRITE_4(sc, PN_ISR, 0xFFFFFFFF);
+
+	/* Enable receiver and transmitter. */
+	PN_SETBIT(sc, PN_NETCFG, PN_NETCFG_TX_ON|PN_NETCFG_RX_ON);
+	CSR_WRITE_4(sc, PN_RXSTART, 0xFFFFFFFF);
+
+	/* Restore state of BMCR */
+	if (sc->pn_pinfo != NULL)
+		pn_phy_writereg(sc, PHY_BMCR, phy_bmcr);
+
+	ifp->if_flags |= IFF_RUNNING;
+	ifp->if_flags &= ~IFF_OACTIVE;
+
+	(void)splx(s);
+
+	return;
+}
+
+/*
+ * Set media options.
+ */
+static int pn_ifmedia_upd(ifp)
+	struct ifnet		*ifp;
+{
+	struct pn_softc		*sc;
+	struct ifmedia		*ifm;
+
+	sc = ifp->if_softc;
+	ifm = &sc->ifmedia;
+
+	if (IFM_TYPE(ifm->ifm_media) != IFM_ETHER)
+		return(EINVAL);
+
+	if (IFM_SUBTYPE(ifm->ifm_media) == IFM_AUTO)
+		pn_autoneg_mii(sc, PN_FLAG_SCHEDDELAY, 1);
+	else
+		pn_setmode_mii(sc, ifm->ifm_media);
+
+	return(0);
+}
+
+/*
+ * Report current media status.
+ */
+static void pn_ifmedia_sts(ifp, ifmr)
+	struct ifnet		*ifp;
+	struct ifmediareq	*ifmr;
+{
+	struct pn_softc		*sc;
+	u_int16_t		advert = 0, ability = 0;
+
+	sc = ifp->if_softc;
+
+	ifmr->ifm_active = IFM_ETHER;
+
+	if (!(pn_phy_readreg(sc, PHY_BMCR) & PHY_BMCR_AUTONEGENBL)) {
+		if (pn_phy_readreg(sc, PHY_BMCR) & PHY_BMCR_SPEEDSEL)
+			ifmr->ifm_active = IFM_ETHER|IFM_100_TX;
+		else
+			ifmr->ifm_active = IFM_ETHER|IFM_10_T;
+		if (pn_phy_readreg(sc, PHY_BMCR) & PHY_BMCR_DUPLEX)
+			ifmr->ifm_active |= IFM_FDX;
+		else
+			ifmr->ifm_active |= IFM_HDX;
+		return;
+	}
+
+	ability = pn_phy_readreg(sc, PHY_LPAR);
+	advert = pn_phy_readreg(sc, PHY_ANAR);
+	if (advert & PHY_ANAR_100BT4 &&
+		ability & PHY_ANAR_100BT4) {
+		ifmr->ifm_active = IFM_ETHER|IFM_100_T4;
+	} else if (advert & PHY_ANAR_100BTXFULL &&
+		ability & PHY_ANAR_100BTXFULL) {
+		ifmr->ifm_active = IFM_ETHER|IFM_100_TX|IFM_FDX;
+	} else if (advert & PHY_ANAR_100BTXHALF &&
+		ability & PHY_ANAR_100BTXHALF) {
+		ifmr->ifm_active = IFM_ETHER|IFM_100_TX|IFM_HDX;
+	} else if (advert & PHY_ANAR_10BTFULL &&
+		ability & PHY_ANAR_10BTFULL) {
+		ifmr->ifm_active = IFM_ETHER|IFM_10_T|IFM_FDX;
+	} else if (advert & PHY_ANAR_10BTHALF &&
+		ability & PHY_ANAR_10BTHALF) {
+		ifmr->ifm_active = IFM_ETHER|IFM_10_T|IFM_HDX;
+	}
+
+	return;
+}
+
+static int pn_ioctl(ifp, command, data)
+	struct ifnet		*ifp;
+	u_long			command;
+	caddr_t			data;
+{
+	struct pn_softc		*sc = ifp->if_softc;
+	struct ifreq		*ifr = (struct ifreq *) data;
+	int			s, error = 0;
+#ifdef __OpenBSD__
+	struct ifaddr		*ifa = (struct ifaddr *) data;
+#endif
+
+	s = splimp();
+
+#ifdef __OpenBSD__
+	if ((error = ether_ioctl(ifp, &sc->arpcom, command, data)) > 0) {
+		splx(s);
+		return error;
+	}
+#endif
+
+	switch(command) {
+#ifdef __FreeBSD__
+	case SIOCSIFADDR:
+	case SIOCGIFADDR:
+	case SIOCSIFMTU:
+		error = ether_ioctl(ifp, command, data);
+		break;
+#else
+	case SIOCSIFADDR:
+		ifp->if_flags |= IFF_UP;
+		switch (ifa->ifa_addr->sa_family) {
+#ifdef INET
+		case AF_INET:
+			pn_init(sc);
+			arp_ifinit(&sc->arpcom, ifa);
+			break;
+#endif /* INET */
+		default:
+			pn_init(sc);
+			break;
+		}
+		break;
+#endif
+	case SIOCSIFFLAGS:
+		if (ifp->if_flags & IFF_UP) {
+			pn_init(sc);
+		} else {
+			if (ifp->if_flags & IFF_RUNNING)
+				pn_stop(sc);
+		}
+		error = 0;
+		break;
+	case SIOCADDMULTI:
+	case SIOCDELMULTI:
+		pn_init(sc);
+		error = 0;
+		break;
+	case SIOCGIFMEDIA:
+	case SIOCSIFMEDIA:
+		error = ifmedia_ioctl(ifp, ifr, &sc->ifmedia, command);
+		break;
+	default:
+		error = EINVAL;
+		break;
+	}
+
+	(void)splx(s);
+
+	return(error);
+}
+
+static void pn_watchdog(ifp)
+	struct ifnet		*ifp;
+{
+	struct pn_softc		*sc;
+
+	sc = ifp->if_softc;
+
+	if (sc->pn_autoneg) {
+		pn_autoneg_mii(sc, PN_FLAG_DELAYTIMEO, 1);
+		return;
+	}
+
+	ifp->if_oerrors++;
+	printf("pn%d: watchdog timeout\n", sc->pn_unit);
+
+	if (!(pn_phy_readreg(sc, PHY_BMSR) & PHY_BMSR_LINKSTAT))
+		printf("pn%d: no carrier - transceiver cable problem?\n",
+								sc->pn_unit);
+	pn_stop(sc);
+	pn_reset(sc);
+	pn_init(sc);
+
+	if (ifp->if_snd.ifq_head != NULL)
+		pn_start(ifp);
+
+	return;
+}
+
+/*
+ * Stop the adapter and free any mbufs allocated to the
+ * RX and TX lists.
+ */
+static void pn_stop(sc)
+	struct pn_softc		*sc;
+{
+	register int		i;
+	struct ifnet		*ifp;
+
+	ifp = &sc->arpcom.ac_if;
+	ifp->if_timer = 0;
+
+	PN_CLRBIT(sc, PN_NETCFG, (PN_NETCFG_RX_ON|PN_NETCFG_TX_ON));
+	CSR_WRITE_4(sc, PN_IMR, 0x00000000);
+	CSR_WRITE_4(sc, PN_TXADDR, 0x00000000);
+	CSR_WRITE_4(sc, PN_RXADDR, 0x00000000);
+
+	/*
+	 * Free data in the RX lists.
+	 */
+	for (i = 0; i < PN_RX_LIST_CNT; i++) {
+		if (sc->pn_cdata.pn_rx_chain[i].pn_mbuf != NULL) {
+			m_freem(sc->pn_cdata.pn_rx_chain[i].pn_mbuf);
+			sc->pn_cdata.pn_rx_chain[i].pn_mbuf = NULL;
+		}
+	}
+	bzero((char *)&sc->pn_ldata->pn_rx_list,
+		sizeof(sc->pn_ldata->pn_rx_list));
+
+	/*
+	 * Free the TX list buffers.
+	 */
+	for (i = 0; i < PN_TX_LIST_CNT; i++) {
+		if (sc->pn_cdata.pn_tx_chain[i].pn_mbuf != NULL) {
+			m_freem(sc->pn_cdata.pn_tx_chain[i].pn_mbuf);
+			sc->pn_cdata.pn_tx_chain[i].pn_mbuf = NULL;
+		}
+	}
+
+	bzero((char *)&sc->pn_ldata->pn_tx_list,
+		sizeof(sc->pn_ldata->pn_tx_list));
+
+	ifp->if_flags &= ~(IFF_RUNNING | IFF_OACTIVE);
+
+	return;
+}
+
+#ifdef __FreeBSD__
+/*
+ * Stop all chip I/O so that the kernel's probe routines don't
+ * get confused by errant DMAs when rebooting.
+ */
+static void pn_shutdown(howto, arg)
+	int			howto;
+	void			*arg;
+{
+	struct pn_softc		*sc = (struct pn_softc *)arg;
+
+	pn_stop(sc);
+
+	return;
+}
+
+static struct pci_device pn_device = {
+	"pn",
+	pn_probe,
+	pn_attach,
+	&pn_count,
+	NULL
+};
+DATA_SET(pcidevice_set, pn_device);
+#endif /* __FreeBSD__ */
+
+#ifdef __OpenBSD__
+static int
+pn_probe(parent, match, aux)
+	struct device *parent;
+	void *match;
+	void *aux;
+{
+	struct pci_attach_args *pa = (struct pci_attach_args *)aux;
+
+	if (PCI_VENDOR(pa->pa_id) == PCI_VENDOR_LITEON) {
+		switch (PCI_PRODUCT(pa->pa_id)) {
+		case PCI_PRODUCT_LITEON_PNIC:
+			return (1);
+		}
+	}
+
+	return (0);
+}
+
+static void
+pn_attach(parent, self, aux)
+	struct device *parent, *self;
+	void *aux;
+{
+	struct pn_softc *sc = (struct pn_softc *)self;
+	struct pci_attach_args *pa = aux;
+	pci_chipset_tag_t pc = pa->pa_pc;
+	pci_intr_handle_t ih;
+	const char *intrstr = NULL;
+	struct ifnet *ifp = &sc->arpcom.ac_if;
+	bus_addr_t iobase;
+	bus_size_t iosize;
+	u_int32_t command;
+	u_int16_t phy_did, phy_vid, phy_sts;
+	struct pn_type *p = NULL;
+	int s, i, media = IFM_ETHER|IFM_100_TX|IFM_FDX;
+	u_int round;
+	caddr_t roundptr;
+
+	s = splimp();
+
+	sc->pn_unit = sc->sc_dev.dv_unit;
+	command = pci_conf_read(pa->pa_pc, pa->pa_tag, PCI_COMMAND_STATUS_REG);
+
+#ifdef PN_USEIOSPACE
+	if (!(command & PCI_COMMAND_IO_ENABLE)) {
+		printf(": failed to enable i/o ports\n");
+		goto fail;
+	}
+
+	/*
+	 * Map control/status registers.
+	 */
+	if (pci_io_find(pc, pa->pa_tag, PN_PCI_LOIO, &iobase, &iosize)) {
+		printf(": can't find i/o space\n");
+		goto fail;
+	}
+	if (bus_space_map(pa->pa_iot, iobase, iosize, 0, &sc->pn_bhandle)) {
+		printf(": can't map i/o space\n");
+		goto fail;
+	}
+	sc->pn_btag = pa->pa_iot;
+#else
+	if (!(command & PCI_COMMAND_MEM_ENABLE)) {
+		printf(": failed to enable memory mapping\n");
+		goto fail;
+	}
+	if (pci_mem_find(pc, pa->pa_tag, PN_PCI_LOMEM, &iobase, &iosize, NULL)){
+		printf(": can't find mem space\n");
+		goto fail;
+	}
+	if (bus_space_map(pa->pa_memt, iobase, iosize, 0, &sc->pn_bhandle)) {
+		printf(": can't map mem space\n");
+		goto fail;
+	}
+	sc->pn_btag = pa->pa_memt;
+#endif
+
+	/*
+	 * Allocate our interrupt.
+	 */
+	if (pci_intr_map(pc, pa->pa_intrtag, pa->pa_intrpin,
+	    pa->pa_intrline, &ih)) {
+		printf(": couldn't map interrupt\n");
+		goto fail;
+	}
+	intrstr = pci_intr_string(pc, ih);
+	sc->sc_ih = pci_intr_establish(pc, ih, IPL_NET, pn_intr, sc,
+	    self->dv_xname);
+	if (sc->sc_ih == NULL) {
+		printf(": couldn't establish interrupt");
+		if (intrstr != NULL)
+			printf(" at %s", intrstr);
+		printf("\n");
+		goto fail;
+	}
+	printf(": %s", intrstr);
+
+	pn_reset(sc);
+
+	pn_read_eeprom(sc, (caddr_t)&sc->arpcom.ac_enaddr, 0, 3, 1);
+	printf(" address %s\n", ether_sprintf(sc->arpcom.ac_enaddr));
+
+	sc->pn_ldata_ptr = malloc(sizeof(struct pn_list_data) + 8,
+				M_DEVBUF, M_NOWAIT);
+	if (sc->pn_ldata_ptr == NULL) {
+		printf("%s: no memory for list buffers\n", sc->sc_dev.dv_xname);
+		goto fail;
+	}
+	sc->pn_ldata = (struct pn_list_data *)sc->pn_ldata_ptr;
+	round = (unsigned int)sc->pn_ldata_ptr & 0xf;
+	roundptr = sc->pn_ldata_ptr;
+	for (i = 0; i < 8; i++) {
+		if (round % 8) {
+			round++;
+			roundptr++;
+		}
+		else
+			break;
+	}
+	sc->pn_ldata = (struct pn_list_data *)roundptr;
+	bzero(sc->pn_ldata, sizeof(struct pn_list_data));
+
+	ifp = &sc->arpcom.ac_if;
+	ifp->if_softc = sc;
+	ifp->if_mtu = ETHERMTU;
+	ifp->if_flags = IFF_BROADCAST | IFF_SIMPLEX | IFF_MULTICAST;
+	ifp->if_ioctl = pn_ioctl;
+	ifp->if_output = ether_output;
+	ifp->if_start = pn_start;
+	ifp->if_watchdog = pn_watchdog;
+	ifp->if_baudrate = 10000000;
+	bcopy(sc->sc_dev.dv_xname, ifp->if_xname, IFNAMSIZ);
+
+	for (i = PN_PHYADDR_MIN; i < PN_PHYADDR_MAX + 1; i++) {
+		sc->pn_phy_addr = i;
+		pn_phy_writereg(sc, PHY_BMCR, PHY_BMCR_RESET);
+		DELAY(500);
+		while (pn_phy_readreg(sc, PHY_BMCR) & PHY_BMCR_RESET);
+		if ((phy_sts = pn_phy_readreg(sc, PHY_BMSR)))
+			break;
+	}
+	if (phy_sts) {
+		phy_vid = pn_phy_readreg(sc, PHY_VENID);
+		phy_did = pn_phy_readreg(sc, PHY_DEVID);
+		p = pn_phys;
+		while (p->pn_vid) {
+			if (phy_vid == p->pn_vid &&
+			    (phy_did | 0xf) == p->pn_vid) {
+				sc->pn_pinfo = p;
+				break;
+			}
+			p++;
+		}
+		if (sc->pn_pinfo == NULL)
+			sc->pn_pinfo = &pn_phys[PHY_UNKNOWN];
+	}
+	else {
+		printf("%s: MII without any phy!\n", sc->sc_dev.dv_xname);
+		goto fail;
+	}
+
+	ifmedia_init(&sc->ifmedia, 0, pn_ifmedia_upd, pn_ifmedia_sts);
+	pn_getmode_mii(sc);
+	pn_autoneg_mii(sc, PN_FLAG_FORCEDELAY, 1);
+	media = sc->ifmedia.ifm_media;
+	pn_stop(sc);
+	ifmedia_set(&sc->ifmedia, media);
+
+	if_attach(ifp);
+	ether_ifattach(ifp);
+#if NBPFILTER > 0
+	bpfattach(&sc->arpcom.ac_if.if_bpf, ifp,
+	    DLT_EN10MB, sizeof(struct ether_header));
+#endif
+	shutdownhook_establish(pn_shutdown, sc);
+fail:
+	splx(s);
+}
+
+static void
+pn_shutdown(v)
+	void *v;
+{
+	struct pn_softc *sc = (struct pn_softc *)v;
+
+	pn_stop(sc);
+}
+
+struct cfattach pn_ca = {
+	sizeof(struct pn_softc), pn_probe, pn_attach
+};
+
+struct cfdriver pn_cd = {
+	0, "pn", DV_IFNET
+};
+#endif
diff --git a/sys/dev/pci/if_pnreg.h b/sys/dev/pci/if_pnreg.h
new file mode 100644
index 00000000000..9bb1c1d32a4
--- /dev/null
+++ b/sys/dev/pci/if_pnreg.h
@@ -0,0 +1,662 @@
+/*	$OpenBSD: if_pnreg.h,v 1.1 1999/01/11 04:28:25 jason Exp $	*/
+
+/*
+ * Copyright (c) 1997, 1998
+ *	Bill Paul <wpaul@ctr.columbia.edu>.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ * 3. All advertising materials mentioning features or use of this software
+ *    must display the following acknowledgement:
+ *	This product includes software developed by Bill Paul.
+ * 4. Neither the name of the author nor the names of any co-contributors
+ *    may be used to endorse or promote products derived from this software
+ *    without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY Bill Paul AND CONTRIBUTORS ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL Bill Paul OR THE VOICES IN HIS HEAD
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ *
+ *	$FreeBSD: if_pnreg.h,v 1.4 1999/01/05 00:59:08 wpaul Exp $
+ */
+
+/*
+ * PNIC register definitions.
+ */
+
+#define PN_BUSCTL		0x00	/* bus control */
+#define PN_TXSTART		0x08	/* tx start demand */
+#define PN_RXSTART		0x10	/* rx start demand */
+#define PN_RXADDR		0x18	/* rx descriptor list start addr */
+#define PN_TXADDR		0x20	/* tx descriptor list start addr */
+#define PN_ISR			0x28	/* interrupt status register */
+#define PN_NETCFG		0x30	/* network config register */
+#define PN_IMR			0x38	/* interrupt mask */
+#define PN_FRAMESDISCARDED	0x40	/* # of discarded frames */
+#define PN_SIO			0x48	/* MII and ROM/EEPROM access */
+#define PN_GEN			0x60	/* general purpose register */
+#define PN_ENDEC		0x78	/* ENDEC general register */
+#define PN_SIOPWR		0x90	/* serial eeprom power up */
+#define PN_SIOCTL		0x98	/* EEPROM control register */
+#define PN_MII			0xA0	/* MII access register */
+#define PN_NWAY			0xB8	/* Internal NWAY register */
+
+
+/*
+ * Bus control bits.
+ */
+#define PN_BUSCTL_RESET		0x00000001
+#define PN_BUSCTL_ARBITRATION	0x00000002
+#define PN_BUSCTL_SKIPLEN	0x0000007C
+#define PN_BUSCTL_BUF_BIGENDIAN	0x00000080
+#define PN_BUSCTL_BURSTLEN	0x00003F00
+#define PN_BUSCTL_CACHEALIGN	0x0000C000
+#define PN_BUSCTL_TXPOLL	0x000E0000
+
+#define PN_SKIPLEN_1LONG	0x00000004
+#define PN_SKIPLEN_2LONG	0x00000008
+#define PN_SKIPLEN_3LONG	0x00000010
+#define PN_SKIPLEN_4LONG	0x00000020
+#define PN_SKIPLEN_5LONG	0x00000040
+
+#define PN_CACHEALIGN_8LONG	0x00004000
+#define PN_CACHEALIGN_16LONG	0x00008000
+#define PN_CACHEALIGN_32LONG	0x0000C000
+
+#define PN_BURSTLEN_USECA	0x00000000
+#define PN_BURSTLEN_1LONG	0x00000100
+#define PN_BURSTLEN_2LONG	0x00000200
+#define PN_BURSTLEN_4LONG	0x00000400
+#define PN_BURSTLEN_8LONG	0x00000800
+#define PN_BURSTLEN_16LONG	0x00001000
+#define PN_BURSTLEN_32LONG	0x00002000
+
+#define PN_TXPOLL_OFF		0x00000000
+#define PN_TXPOLL_200U		0x00020000
+#define PN_TXPOLL_800U		0x00040000
+#define PN_TXPOLL_1600U		0x00060000
+#define PN_TXPOLL_12_8M		0x00080000
+#define PN_TXPOLL_25_6M		0x000A0000
+#define PN_TXPOLL_51_2M		0x000C0000
+#define PN_TXPOLL_102_4M	0x000E0000
+
+#define PN_BUSCTL_CONFIG	\
+	(PN_CACHEALIGN_8LONG|PN_BURSTLEN_8LONG)
+
+/*
+ * Interrupt status bits.
+ */
+#define PN_ISR_TX_OK		0x00000001	/* packet tx ok */
+#define PN_ISR_TX_IDLE		0x00000002	/* tx stopped */
+#define PN_ISR_TX_NOBUF		0x00000004	/* no tx buffer available */
+#define PN_ISR_TX_JABTIMEO	0x00000008	/* jabber timeout */
+#define PN_ISR_LINKPASS		0x00000010	/* link test pass */
+#define PN_ISR_TX_UNDERRUN	0x00000020	/* transmit underrun */
+#define PN_ISR_RX_OK		0x00000040	/* packet rx ok */
+#define PN_ISR_RX_NOBUF		0x00000080	/* rx buffer unavailable */
+#define PN_ISR_RX_IDLE		0x00000100	/* rx stopped */
+#define PN_ISR_RX_WATCHDOG	0x00000200	/* rx watchdog timeo */
+#define PN_ISR_TX_EARLY		0x00000400	/* rx watchdog timeo */
+#define PN_ISR_BUS_ERR		0x00002000
+#define PN_ISR_ABNORMAL		0x00008000
+#define PN_ISR_NORMAL		0x00010000
+#define PN_ISR_RX_STATE		0x000E0000
+#define PN_ISR_TX_STATE		0x00700000
+#define PN_ISR_BUSERRTYPE	0x03800000
+#define PN_ISR_TXABORT		0x04000000	/* tx abort */
+
+#define PN_RXSTATE_STOPPED	0x00000000	/* 000 - Stopped */
+#define PN_RXSTATE_FETCH	0x00020000	/* 001 - Fetching descriptor */
+#define PN_RXSTATE_ENDCHECK	0x00040000	/* 010 - check for rx end */
+#define PN_RXSTATE_WAIT		0x00060000	/* 011 - waiting for packet */
+#define PN_RXSTATE_SUSPEND	0x00080000	/* 100 - suspend rx */
+#define PN_RXSTATE_CLOSE	0x000A0000	/* 101 - close rx desc */
+#define PN_RXSTATE_FLUSH	0x000C0000	/* 110 - flush from FIFO */
+#define PN_RXSTATE_DEQUEUE	0x000E0000	/* 111 - dequeue from FIFO */
+
+#define PN_TXSTATE_RESET	0x00000000	/* 000 - reset */
+#define PN_TXSTATE_FETCH	0x00100000	/* 001 - fetching descriptor */
+#define PN_TXSTATE_WAITEND	0x00200000	/* 010 - wait for tx end */
+#define PN_TXSTATE_READING	0x00300000	/* 011 - read and enqueue */
+#define PN_TXSTATE_RSVD		0x00400000	/* 100 - reserved */
+#define PN_TXSTATE_SETUP	0x00500000	/* 101 - setup packet */
+#define PN_TXSTATE_SUSPEND	0x00600000	/* 110 - suspend tx */
+#define PN_TXSTATE_CLOSE	0x00700000	/* 111 - close tx desc */
+
+#define PN_BUSERR_PARITY	0x00000000
+#define PN_BUSERR_MASTABRT	0x00800000
+#define PN_BUSERR_TGTABRT	0x01000000
+#define PN_BUSERR_RSVD1		0x01800000
+#define PN_BUSERR_RSVD2		0x02000000
+
+/*
+ * Network config bits.
+ */
+#define PN_NETCFG_HASHPERF	0x00000001	/* 0 == perf, 1 == hash */
+#define PN_NETCFG_RX_ON		0x00000002
+#define PN_NETCFG_HASHONLY	0x00000004	/* 1 == allhash */
+#define PN_NETCFG_RX_PASSERR	0x00000008
+#define PN_NETCFG_INVERSFILT	0x00000010
+#define PN_NETCFG_BACKOFF	0x00000020
+#define PN_NETCFG_RX_PROMISC	0x00000040
+#define PN_NETCFG_RX_ALLMULTI	0x00000080
+#define PN_NETCFG_FLAKYOSC	0x00000100
+#define PN_NETCFG_FULLDUPLEX	0x00000200
+#define PN_NETCFG_OPERMODE	0x00000C00
+#define PN_NETCFG_FORCECOLL	0x00001000
+#define PN_NETCFG_TX_ON		0x00002000
+#define PN_NETCFG_TX_THRESH	0x0000C000
+#define PN_NETCFG_TX_BACKOFF	0x00020000
+#define PN_NETCFG_MIIENB	0x00040000	/* 1 == MII, 0 == internal */
+#define PN_NETCFG_HEARTBEAT	0x00080000	/* 1 == disabled */
+#define PN_NETCFG_TX_IMMEDIATE	0x00100000
+#define PN_NETCFG_STORENFWD	0x00200000
+#define PN_NETCFG_SPEEDSEL	0x00400000	/* 1 == 10Mbps 0 == 100Mbps */
+#define PN_NETCFG_PCS		0x00800000	/* 1 == 100baseTX */
+#define PN_NETCFG_NO_RXCRC	0x20000000
+#define PN_NETCFG_EXT_ENDEC	0x40000000	/* 1 == ext, 0 == int PHY */
+
+#define PN_OPMODE_NORM		0x00000000
+#define PN_OPMODE_INTLOOP	0x00000400
+#define PN_OPMODE_EXTLOOP	0x00000800
+
+#define PN_TXTHRESH_72BYTES	0x00000000
+#define PN_TXTHRESH_96BYTES	0x00004000
+#define PN_TXTHRESH_128BYTES	0x00008000
+#define PN_TXTHRESH_160BYTES	0x0000C000
+
+/*
+ * Interrupt mask bits.
+ */
+#define PN_IMR_TX_OK		0x00000001	/* packet tx ok */
+#define PN_IMR_TX_IDLE		0x00000002	/* tx stopped */
+#define PN_IMR_TX_NOBUF		0x00000004	/* no tx buffer available */
+#define PN_IMR_TX_JABTIMEO	0x00000008	/* jabber timeout */
+#define PN_IMR_LINKPASS		0x00000010	/* link test pass */
+#define PN_IMR_TX_UNDERRUN	0x00000020	/* transmit underrun */
+#define PN_IMR_RX_OK		0x00000040	/* packet rx ok */
+#define PN_IMR_RX_NOBUF		0x00000080	/* rx buffer unavailable */
+#define PN_IMR_RX_IDLE		0x00000100	/* rx stopped */
+#define PN_IMR_RX_WATCHDOG	0x00000200	/* rx watchdog timeo */
+#define PN_IMR_TX_EARLY		0x00000400	/* rx watchdog timeo */
+#define PN_IMR_BUS_ERR		0x00002000
+#define PN_IMR_ABNORMAL		0x00008000
+#define PN_IMR_NORMAL		0x00010000
+#define PN_ISR_TXABORT		0x04000000	/* tx abort */
+
+#define PN_INTRS							\
+	(PN_IMR_RX_OK|PN_IMR_TX_OK|PN_IMR_RX_NOBUF|			\
+	PN_IMR_TX_NOBUF|PN_IMR_TX_UNDERRUN|PN_IMR_BUS_ERR|		\
+	PN_IMR_ABNORMAL|PN_IMR_NORMAL)
+
+/*
+ * Serial I/O (EEPROM/ROM) bits.
+ */
+#define PN_SIO_DATA		0x0000003F
+#define PN_SIO_OPCODE		0x00000300
+#define PN_SIO_BUSY		0x80000000
+
+/*
+ * SIOCTL/EEPROM bits
+ */
+#define PN_EE_READ		0x600
+
+/*
+ * General purpose register bits.
+ */
+#define PN_GEN_CTL		0x000000F0
+#define PN_GEN_100TX_LINK	0x00000008
+#define PN_GEN_BNC_ENB		0x00000004
+#define PN_GEN_100TX_LOOP	0x00000002	/* 1 == normal, 0 == loop */
+#define PN_GEN_SPEEDSEL		0x00000001	/* 1 == 100Mbps, 0 == 10Mbps */
+#define PN_GEN_MUSTBEONE	0x00000030
+
+/*
+ * General ENDEC bits.
+ */
+#define PN_ENDEC_JABBERDIS	0x000000001	/* 1 == disable, 0 == enable */
+
+/*
+ * MII bits.
+ */
+#define PN_MII_DATA		0x0000FFFF
+#define PN_MII_REGADDR		0x007C0000
+#define PN_MII_PHYADDR		0x0F800000
+#define PN_MII_OPCODE		0x30000000
+#define PN_MII_RESERVED		0x00020000
+#define PN_MII_BUSY		0x80000000
+
+#define PN_MII_READ		0x60020000 /* read PHY command */
+#define PN_MII_WRITE		0x50020000 /* write PHY command */
+
+/*
+ * Internal PHY NWAY register bits.
+ */
+#define PN_NWAY_RESET		0x00000001	/* reset */
+#define PN_NWAY_PDOWN		0x00000002	/* power down */
+#define PN_NWAY_BYPASS		0x00000004	/* bypass */
+#define PN_NWAY_AUILOWCUR	0x00000008	/* AUI low current */
+#define PN_NWAY_TPEXTEND	0x00000010	/* low squelch voltage */
+#define PN_NWAY_POLARITY	0x00000020	/* 0 == on, 1 == off */
+#define PN_NWAY_TP		0x00000040	/* 1 == tp, 0 == AUI */
+#define PN_NWAY_AUIVOLT		0x00000080	/* 1 == full, 0 == half */
+#define PN_NWAY_DUPLEX		0x00000100	/* 1 == full, 0 == half */
+#define PN_NWAY_LINKTEST	0x00000200	/* 1 == on, 0 == off */
+#define PN_NWAY_AUTODETECT	0x00000400	/* 1 == off, 0 == on */
+#define PN_NWAY_SPEEDSEL	0x00000800	/* 0 == 10, 1 == 100 */
+#define PN_NWAY_NWAY_ENB	0x00001000	/* 0 == off, 1 == on */
+#define PN_NWAY_CAP10HALF	0x00002000
+#define PN_NWAY_CAP10FULL	0x00004000
+#define	PN_NWAY_CAP100FULL	0x00008000
+#define PN_NWAY_CAP100HALF	0x00010000
+#define PN_NWAY_CAP100T4	0x00020000
+#define PN_NWAY_AUTONEGRSTR	0x02000000
+#define PN_NWAY_REMFAULT	0x04000000
+#define PN_NWAY_LPAR10HALF	0x08000000
+#define PN_NWAY_LPAR10FULL	0x10000000
+#define PN_NWAY_LPAR100FULL	0x20000000
+#define PN_NWAY_LPAR100HALF	0x40000000
+#define PN_NWAY_LPAR100T4	0x80000000
+
+/*
+ * Size of a setup frame.
+ */
+#define PN_SFRAME_LEN		192
+
+/*
+ * PNIC TX/RX list structure.
+ */
+
+struct pn_desc {
+	u_int32_t		pn_status;
+	u_int32_t		pn_ctl;
+	u_int32_t		pn_ptr1;
+	u_int32_t		pn_ptr2;
+};
+
+#define pn_data		pn_ptr1
+#define pn_next		pn_ptr2
+
+
+#define RX_RXSTAT_FIFOOFLOW	0x00000001
+#define PN_RXSTAT_CRCERR	0x00000002
+#define PN_RXSTAT_DRIBBLE	0x00000004
+#define PN_RXSTAT_WATCHDOG	0x00000010
+#define PN_RXSTAT_FRAMETYPE	0x00000020	/* 0 == IEEE 802.3 */
+#define PN_RXSTAT_COLLSEEN	0x00000040
+#define PN_RXSTAT_GIANT		0x00000080
+#define PN_RXSTAT_LASTFRAG	0x00000100
+#define PN_RXSTAT_FIRSTFRAG	0x00000200
+#define PN_RXSTAT_MULTICAST	0x00000400
+#define PN_RXSTAT_RUNT		0x00000800
+#define PN_RXSTAT_RXTYPE	0x00003000
+#define PN_RXSTAT_RXERR		0x00008000
+#define PN_RXSTAT_RXLEN		0x7FFF0000
+#define PN_RXSTAT_OWN		0x80000000
+
+#define PN_RXBYTES(x)		((x & PN_RXSTAT_RXLEN) >> 16)
+#define PN_RXSTAT (PN_RXSTAT_FIRSTFRAG|PN_RXSTAT_LASTFRAG|PN_RXSTAT_OWN)
+
+#define PN_RXCTL_BUFLEN1	0x00000FFF
+#define PN_RXCTL_BUFLEN2	0x00FFF000
+#define PN_RXCTL_RLINK		0x01000000
+#define PN_RXCTL_RLAST		0x02000000
+
+#define PN_TXSTAT_DEFER		0x00000001
+#define PN_TXSTAT_UNDERRUN	0x00000002
+#define PN_TXSTAT_LINKFAIL	0x00000003
+#define PN_TXSTAT_COLLCNT	0x00000078
+#define PN_TXSTAT_SQE		0x00000080
+#define PN_TXSTAT_EXCESSCOLL	0x00000100
+#define PN_TXSTAT_LATECOLL	0x00000200
+#define PN_TXSTAT_NOCARRIER	0x00000400
+#define PN_TXSTAT_CARRLOST	0x00000800
+#define PN_TXSTAT_JABTIMEO	0x00004000
+#define PN_TXSTAT_ERRSUM	0x00008000
+#define PN_TXSTAT_OWN		0x80000000
+
+#define PN_TXCTL_BUFLEN1	0x000007FF
+#define PN_TXCTL_BUFLEN2	0x003FF800
+#define PN_TXCTL_FILTTYPE0	0x00400000
+#define PN_TXCTL_PAD		0x00800000
+#define PN_TXCTL_TLINK		0x01000000
+#define PN_TXCTL_TLAST		0x02000000
+#define PN_TXCTL_NOCRC		0x04000000
+#define PN_TXCTL_SETUP		0x08000000
+#define PN_TXCTL_FILTTYPE1	0x10000000
+#define PN_TXCTL_FIRSTFRAG	0x20000000
+#define PN_TXCTL_LASTFRAG	0x40000000
+#define PN_TXCTL_FINT		0x80000000
+
+#define PN_FILTER_PERFECT	0x00000000
+#define PN_FILTER_HASHPERF	0x00400000
+#define PN_FILTER_INVERSE	0x10000000
+#define PN_FILTER_HASHONLY	0x10400000
+
+#define PN_MAXFRAGS		16
+#define PN_RX_LIST_CNT		64
+#define PN_TX_LIST_CNT		64
+#define PN_MIN_FRAMELEN		60
+#define PN_FRAMELEN		1536
+#define PN_RXLEN		1518
+
+/*
+ * A tx 'super descriptor' is actually 16 regular descriptors
+ * back to back.
+ */
+struct pn_txdesc {
+	struct pn_desc		pn_frag[PN_MAXFRAGS];
+};
+
+#define PN_TXNEXT(x)	x->pn_ptr->pn_frag[x->pn_lastdesc].pn_next
+#define PN_TXSTATUS(x)	x->pn_ptr->pn_frag[x->pn_lastdesc].pn_status
+#define PN_TXCTL(x)	x->pn_ptr->pn_frag[x->pn_lastdesc].pn_ctl
+#define PN_TXDATA(x)	x->pn_ptr->pn_frag[x->pn_lastdesc].pn_data
+
+#define PN_TXOWN(x)	x->pn_ptr->pn_frag[0].pn_status
+
+#define PN_UNSENT	0x12344321
+
+struct pn_list_data {
+	struct pn_desc		pn_rx_list[PN_RX_LIST_CNT];
+	struct pn_txdesc	pn_tx_list[PN_TX_LIST_CNT];
+};
+
+struct pn_chain {
+	struct pn_txdesc	*pn_ptr;
+	struct mbuf		*pn_mbuf;
+	struct pn_chain		*pn_nextdesc;
+	u_int8_t		pn_lastdesc;
+};
+
+struct pn_chain_onefrag {
+	struct pn_desc		*pn_ptr;
+	struct mbuf		*pn_mbuf;
+	struct pn_chain_onefrag	*pn_nextdesc;
+};
+
+struct pn_chain_data {
+	struct pn_desc		pn_sframe;
+	u_int32_t		pn_sbuf[PN_SFRAME_LEN/sizeof(u_int32_t)];
+	struct pn_chain_onefrag	pn_rx_chain[PN_RX_LIST_CNT];
+	struct pn_chain		pn_tx_chain[PN_TX_LIST_CNT];
+
+	struct pn_chain_onefrag	*pn_rx_head;
+
+	struct pn_chain		*pn_tx_head;
+	struct pn_chain		*pn_tx_tail;
+	struct pn_chain		*pn_tx_free;
+};
+
+struct pn_type {
+	u_int16_t		pn_vid;
+	u_int16_t		pn_did;
+	char			*pn_name;
+};
+
+struct pn_mii_frame {
+	u_int8_t		mii_stdelim;
+	u_int8_t		mii_opcode;
+	u_int8_t		mii_phyaddr;
+	u_int8_t		mii_regaddr;
+	u_int8_t		mii_turnaround;
+	u_int16_t		mii_data;
+};
+
+/*
+ * MII constants
+ */
+#define PN_MII_STARTDELIM	0x01
+#define PN_MII_READOP		0x02
+#define PN_MII_WRITEOP		0x01
+#define PN_MII_TURNAROUND	0x02
+
+#define PN_FLAG_FORCEDELAY	1
+#define PN_FLAG_SCHEDDELAY	2
+#define PN_FLAG_DELAYTIMEO	3	
+
+struct pn_softc {
+#ifdef __OpenBSD__
+	struct device		sc_dev;		/* generic device structure */
+	void *			sc_ih;		/* interrupt handler cookie */
+#endif
+	struct arpcom		arpcom;		/* interface info */
+	struct ifmedia		ifmedia;	/* media info */
+	bus_space_handle_t	pn_bhandle;	/* bus space handle */
+	bus_space_tag_t		pn_btag;	/* bus space tag */
+	struct pn_type		*pn_info;	/* PNIC adapter info */
+	struct pn_type		*pn_pinfo;	/* phy info */
+	u_int8_t		pn_unit;	/* interface number */
+	u_int8_t		pn_type;
+	u_int8_t		pn_phy_addr;	/* PHY address */
+	u_int8_t		pn_tx_pend;	/* TX pending */
+	u_int8_t		pn_want_auto;
+	u_int8_t		pn_autoneg;
+	caddr_t			pn_ldata_ptr;
+#ifdef PN_PROMISC_BUG_WAR
+#define PN_169_REV	32
+#define PN_169B_REV	33
+	u_int8_t		pn_promisc_war;
+	struct pn_chain_onefrag	*pn_promisc_bug_save;
+	unsigned char           *pn_promisc_buf;
+#endif
+	struct pn_list_data	*pn_ldata;
+	struct pn_chain_data	pn_cdata;
+};
+
+/*
+ * register space access macros
+ */
+#define CSR_WRITE_4(sc, reg, val)	\
+	bus_space_write_4(sc->pn_btag, sc->pn_bhandle, reg, val)
+#define CSR_WRITE_2(sc, reg, val)	\
+	bus_space_write_2(sc->pn_btag, sc->pn_bbhandle, reg, val)
+#define CSR_WRITE_1(sc, reg, val)	\
+	bus_space_write_1(sc->pn_btag, sc->pn_bhandle, reg, val)
+
+#define CSR_READ_4(sc, reg)		\
+	bus_space_read_4(sc->pn_btag, sc->pn_bhandle, reg)
+#define CSR_READ_2(sc, reg)		\
+	bus_space_read_2(sc->pn_btag, sc->pn_bhandle, reg)
+#define CSR_READ_1(sc, reg)		\
+	bus_space_read_1(sc->pn_btag, sc->pn_bhandle, reg)
+
+#define PN_TIMEOUT		1000
+
+/*
+ * General constants that are fun to know.
+ *
+ * Lite-On PNIC PCI vendor ID
+ */
+#define	PN_VENDORID		0x11AD
+
+/*
+ * Lite-On PNIC PCI device ID.
+ */
+#define	PN_DEVICEID_PNIC	0x0002
+
+/*
+ * Texas Instruments PHY identifiers
+ */
+#define TI_PHY_VENDORID		0x4000
+#define TI_PHY_10BT		0x501F
+#define TI_PHY_100VGPMI		0x502F
+
+/*
+ * These ID values are for the NS DP83840A 10/100 PHY
+ */
+#define NS_PHY_VENDORID		0x2000
+#define NS_PHY_83840A		0x5C0F
+
+/*
+ * Level 1 10/100 PHY
+ */
+#define LEVEL1_PHY_VENDORID	0x7810
+#define LEVEL1_PHY_LXT970	0x000F
+
+/*
+ * Intel 82555 10/100 PHY
+ */
+#define INTEL_PHY_VENDORID	0x0A28
+#define INTEL_PHY_82555		0x015F
+
+/*
+ * SEEQ 80220 10/100 PHY
+ */
+#define SEEQ_PHY_VENDORID	0x0016
+#define SEEQ_PHY_80220		0xF83F
+
+
+/*
+ * PCI low memory base and low I/O base register, and
+ * other PCI registers.
+ */
+
+#define PN_PCI_VENDOR_ID	0x00
+#define PN_PCI_DEVICE_ID	0x02
+#define PN_PCI_COMMAND		0x04
+#define PN_PCI_STATUS		0x06
+#define PN_PCI_REVISION		0x08
+#define PN_PCI_CLASSCODE	0x09
+#define PN_PCI_LATENCY_TIMER	0x0D
+#define PN_PCI_HEADER_TYPE	0x0E
+#define PN_PCI_LOIO		0x10
+#define PN_PCI_LOMEM		0x14
+#define PN_PCI_BIOSROM		0x30
+#define PN_PCI_INTLINE		0x3C
+#define PN_PCI_INTPIN		0x3D
+#define PN_PCI_MINGNT		0x3E
+#define PN_PCI_MINLAT		0x0F
+#define PN_PCI_RESETOPT		0x48
+#define PN_PCI_EEPROM_DATA	0x4C
+
+/* power management registers */
+#define PN_PCI_CAPID		0xDC /* 8 bits */
+#define PN_PCI_NEXTPTR		0xDD /* 8 bits */
+#define PN_PCI_PWRMGMTCAP	0xDE /* 16 bits */
+#define PN_PCI_PWRMGMTCTRL	0xE0 /* 16 bits */
+
+#define PN_PSTATE_MASK		0x0003
+#define PN_PSTATE_D0		0x0000
+#define PN_PSTATE_D1		0x0002
+#define PN_PSTATE_D2		0x0002
+#define PN_PSTATE_D3		0x0003
+#define PN_PME_EN		0x0010
+#define PN_PME_STATUS		0x8000
+
+#define PHY_UNKNOWN		6
+
+#define PN_PHYADDR_MIN		0x00
+#define PN_PHYADDR_MAX		0x1F
+
+#define PHY_BMCR		0x00
+#define PHY_BMSR		0x01
+#define PHY_VENID		0x02
+#define PHY_DEVID		0x03
+#define PHY_ANAR		0x04
+#define PHY_LPAR		0x05
+#define PHY_ANEXP		0x06
+
+#define PHY_ANAR_NEXTPAGE	0x8000
+#define PHY_ANAR_RSVD0		0x4000
+#define PHY_ANAR_TLRFLT		0x2000
+#define PHY_ANAR_RSVD1		0x1000
+#define PHY_ANAR_RSVD2		0x0800
+#define PHY_ANAR_RSVD3		0x0400
+#define PHY_ANAR_100BT4		0x0200
+#define PHY_ANAR_100BTXFULL	0x0100
+#define PHY_ANAR_100BTXHALF	0x0080
+#define PHY_ANAR_10BTFULL	0x0040
+#define PHY_ANAR_10BTHALF	0x0020
+#define PHY_ANAR_PROTO4		0x0010
+#define PHY_ANAR_PROTO3		0x0008
+#define PHY_ANAR_PROTO2		0x0004
+#define PHY_ANAR_PROTO1		0x0002
+#define PHY_ANAR_PROTO0		0x0001
+
+/*
+ * These are the register definitions for the PHY (physical layer
+ * interface chip).
+ */
+/*
+ * PHY BMCR Basic Mode Control Register
+ */
+#define PHY_BMCR_RESET			0x8000
+#define PHY_BMCR_LOOPBK			0x4000
+#define PHY_BMCR_SPEEDSEL		0x2000
+#define PHY_BMCR_AUTONEGENBL		0x1000
+#define PHY_BMCR_RSVD0			0x0800	/* write as zero */
+#define PHY_BMCR_ISOLATE		0x0400
+#define PHY_BMCR_AUTONEGRSTR		0x0200
+#define PHY_BMCR_DUPLEX			0x0100
+#define PHY_BMCR_COLLTEST		0x0080
+#define PHY_BMCR_RSVD1			0x0040	/* write as zero, don't care */
+#define PHY_BMCR_RSVD2			0x0020	/* write as zero, don't care */
+#define PHY_BMCR_RSVD3			0x0010	/* write as zero, don't care */
+#define PHY_BMCR_RSVD4			0x0008	/* write as zero, don't care */
+#define PHY_BMCR_RSVD5			0x0004	/* write as zero, don't care */
+#define PHY_BMCR_RSVD6			0x0002	/* write as zero, don't care */
+#define PHY_BMCR_RSVD7			0x0001	/* write as zero, don't care */
+/*
+ * RESET: 1 == software reset, 0 == normal operation
+ * Resets status and control registers to default values.
+ * Relatches all hardware config values.
+ *
+ * LOOPBK: 1 == loopback operation enabled, 0 == normal operation
+ *
+ * SPEEDSEL: 1 == 100Mb/s, 0 == 10Mb/s
+ * Link speed is selected byt his bit or if auto-negotiation if bit
+ * 12 (AUTONEGENBL) is set (in which case the value of this register
+ * is ignored).
+ *
+ * AUTONEGENBL: 1 == Autonegotiation enabled, 0 == Autonegotiation disabled
+ * Bits 8 and 13 are ignored when autoneg is set, otherwise bits 8 and 13
+ * determine speed and mode. Should be cleared and then set if PHY configured
+ * for no autoneg on startup.
+ *
+ * ISOLATE: 1 == isolate PHY from MII, 0 == normal operation
+ *
+ * AUTONEGRSTR: 1 == restart autonegotiation, 0 = normal operation
+ *
+ * DUPLEX: 1 == full duplex mode, 0 == half duplex mode
+ *
+ * COLLTEST: 1 == collision test enabled, 0 == normal operation
+ */
+
+/* 
+ * PHY, BMSR Basic Mode Status Register 
+ */   
+#define PHY_BMSR_100BT4			0x8000
+#define PHY_BMSR_100BTXFULL		0x4000
+#define PHY_BMSR_100BTXHALF		0x2000
+#define PHY_BMSR_10BTFULL		0x1000
+#define PHY_BMSR_10BTHALF		0x0800
+#define PHY_BMSR_RSVD1			0x0400	/* write as zero, don't care */
+#define PHY_BMSR_RSVD2			0x0200	/* write as zero, don't care */
+#define PHY_BMSR_RSVD3			0x0100	/* write as zero, don't care */
+#define PHY_BMSR_RSVD4			0x0080	/* write as zero, don't care */
+#define PHY_BMSR_MFPRESUP		0x0040
+#define PHY_BMSR_AUTONEGCOMP		0x0020
+#define PHY_BMSR_REMFAULT		0x0010
+#define PHY_BMSR_CANAUTONEG		0x0008
+#define PHY_BMSR_LINKSTAT		0x0004
+#define PHY_BMSR_JABBER			0x0002
+#define PHY_BMSR_EXTENDED		0x0001
+
+#ifndef ETHER_CRC_LEN
+#define ETHER_CRC_LEN	4
+#endif