int entry = lp->cur_rx & RX_RING_MOD_MASK; int boguscnt = RX_RING_SIZE / 2; 
int entry = lp->cur_rx & lp->rx_mod_mask; int boguscnt = lp->rx_ring_size / 2; 
pcnet32_rx(struct net_device *dev){    struct pcnet32_private *lp = dev->priv;    int entry = lp->cur_rx & RX_RING_MOD_MASK;    int boguscnt = RX_RING_SIZE / 2;    /* If we own the next entry, it's a new packet. Send it up. */    while ((short)le16_to_cpu(lp->rx_ring[entry].status) >= 0) {	int status = (short)le16_to_cpu(lp->rx_ring[entry].status) >> 8;	if (status != 0x03) {			/* There was an error. */	    /*	     * There is a tricky error noted by John Murphy,	     * <murf@perftech.com> to Russ Nelson: Even with full-sized	     * buffers it's possible for a jabber packet to use two	     * buffers, with only the last correctly noting the error.	     */	    if (status & 0x01)	/* Only count a general error at the */		lp->stats.rx_errors++; /* end of a packet.*/	    if (status & 0x20) lp->stats.rx_frame_errors++;	    if (status & 0x10) lp->stats.rx_over_errors++;	    if (status & 0x08) lp->stats.rx_crc_errors++;	    if (status & 0x04) lp->stats.rx_fifo_errors++;	    lp->rx_ring[entry].status &= le16_to_cpu(0x03ff);	} else {	    /* Malloc up new buffer, compatible with net-2e. */	    short pkt_len = (le32_to_cpu(lp->rx_ring[entry].msg_length) & 0xfff)-4;	    struct sk_buff *skb;	    /* Discard oversize frames. */	    if (unlikely(pkt_len > PKT_BUF_SZ - 2)) {		if (netif_msg_drv(lp))		    printk(KERN_ERR "%s: Impossible packet size %d!\n",			    dev->name, pkt_len);		lp->stats.rx_errors++;	    } else if (pkt_len < 60) {		if (netif_msg_rx_err(lp))		    printk(KERN_ERR "%s: Runt packet!\n", dev->name);		lp->stats.rx_errors++;	    } else {		int rx_in_place = 0;		if (pkt_len > rx_copybreak) {		    struct sk_buff *newskb;		    if ((newskb = dev_alloc_skb(PKT_BUF_SZ))) {			skb_reserve (newskb, 2);			skb = lp->rx_skbuff[entry];			pci_unmap_single(lp->pci_dev, lp->rx_dma_addr[entry],				PKT_BUF_SZ-2, PCI_DMA_FROMDEVICE);			skb_put (skb, pkt_len);			lp->rx_skbuff[entry] = newskb;			newskb->dev = dev;			lp->rx_dma_addr[entry] =			    pci_map_single(lp->pci_dev, newskb->data,				    PKT_BUF_SZ-2, PCI_DMA_FROMDEVICE);			lp->rx_ring[entry].base = le32_to_cpu(lp->rx_dma_addr[entry]);			rx_in_place = 1;		    } else			skb = NULL;		} else {		    skb = dev_alloc_skb(pkt_len+2);		}		if (skb == NULL) {		    int i;		    if (netif_msg_drv(lp))			printk(KERN_ERR "%s: Memory squeeze, deferring packet.\n",				dev->name);		    for (i = 0; i < RX_RING_SIZE; i++)			if ((short)le16_to_cpu(lp->rx_ring[(entry+i)				    & RX_RING_MOD_MASK].status) < 0)			    break;		    if (i > RX_RING_SIZE -2) {			lp->stats.rx_dropped++;			lp->rx_ring[entry].status |= le16_to_cpu(0x8000);			wmb();	/* Make sure adapter sees owner change */			lp->cur_rx++;		    }		    break;		}		skb->dev = dev;		if (!rx_in_place) {		    skb_reserve(skb,2); /* 16 byte align */		    skb_put(skb,pkt_len);	/* Make room */		    pci_dma_sync_single_for_cpu(lp->pci_dev,						lp->rx_dma_addr[entry],						PKT_BUF_SZ-2,						PCI_DMA_FROMDEVICE);		    eth_copy_and_sum(skb,			    (unsigned char *)(lp->rx_skbuff[entry]->data),			    pkt_len,0);		    pci_dma_sync_single_for_device(lp->pci_dev,						   lp->rx_dma_addr[entry],						   PKT_BUF_SZ-2,						   PCI_DMA_FROMDEVICE);		}		lp->stats.rx_bytes += skb->len;		skb->protocol=eth_type_trans(skb,dev);		netif_rx(skb);		dev->last_rx = jiffies;		lp->stats.rx_packets++;	    }	}	/*	 * The docs say that the buffer length isn't touched, but Andrew Boyd	 * of QNX reports that some revs of the 79C965 clear it.	 */	lp->rx_ring[entry].buf_length = le16_to_cpu(2-PKT_BUF_SZ);	wmb(); /* Make sure owner changes after all others are visible */	lp->rx_ring[entry].status |= le16_to_cpu(0x8000);	entry = (++lp->cur_rx) & RX_RING_MOD_MASK;	if (--boguscnt <= 0) break;	/* don't stay in loop forever */    }    return 0;}
4520	/local/tlutelli/issta_data/temp/c/2005_temp/2005/4520/eabf04151682bc7b57c84fea58cf9e4e5a3cf2a9/pcnet32.c/buggy/drivers/net/pcnet32.c