9 files changed, 3513 insertions, 1522 deletions

diff --git a/sys/dev/netmap/if_em_netmap.h b/sys/dev/netmap/if_em_netmap.h
index 5bfbd3d76adc..1ea11238aaaf 100644
--- a/sys/dev/netmap/if_em_netmap.h
+++ b/sys/dev/netmap/if_em_netmap.h
@@ -43,35 +43,6 @@ static void	em_netmap_block_tasks(struct adapter *);
 static void	em_netmap_unblock_tasks(struct adapter *);
 
 
-static void
-em_netmap_lock_wrapper(struct ifnet *ifp, int what, u_int queueid)
-{
-	struct adapter *adapter = ifp->if_softc;
-
-	ASSERT(queueid < adapter->num_queues);
-	switch (what) {
-	case NETMAP_CORE_LOCK:
-		EM_CORE_LOCK(adapter);
-		break;
-	case NETMAP_CORE_UNLOCK:
-		EM_CORE_UNLOCK(adapter);
-		break;
-	case NETMAP_TX_LOCK:
-		EM_TX_LOCK(&adapter->tx_rings[queueid]);
-		break;
-	case NETMAP_TX_UNLOCK:
-		EM_TX_UNLOCK(&adapter->tx_rings[queueid]);
-		break;
-	case NETMAP_RX_LOCK:
-		EM_RX_LOCK(&adapter->rx_rings[queueid]);
-		break;
-	case NETMAP_RX_UNLOCK:
-		EM_RX_UNLOCK(&adapter->rx_rings[queueid]);
-		break;
-	}
-}
-
-
 // XXX do we need to block/unblock the tasks ?
 static void
 em_netmap_block_tasks(struct adapter *adapter)
@@ -137,7 +108,7 @@ em_netmap_reg(struct ifnet *ifp, int onoff)
 		ifp->if_capenable |= IFCAP_NETMAP;
 
 		na->if_transmit = ifp->if_transmit;
-		ifp->if_transmit = netmap_start;
+		ifp->if_transmit = netmap_transmit;
 
 		em_init_locked(adapter);
 		if ((ifp->if_drv_flags & (IFF_DRV_RUNNING | IFF_DRV_OACTIVE)) == 0) {
@@ -160,7 +131,7 @@ fail:
  * Reconcile kernel and user view of the transmit ring.
  */
 static int
-em_netmap_txsync(struct ifnet *ifp, u_int ring_nr, int do_lock)
+em_netmap_txsync(struct ifnet *ifp, u_int ring_nr, int flags)
 {
 	struct adapter *adapter = ifp->if_softc;
 	struct tx_ring *txr = &adapter->tx_rings[ring_nr];
@@ -176,8 +147,6 @@ em_netmap_txsync(struct ifnet *ifp, u_int ring_nr, int do_lock)
 	if (k > lim)
 		return netmap_ring_reinit(kring);
 
-	if (do_lock)
-		EM_TX_LOCK(txr);
 	bus_dmamap_sync(txr->txdma.dma_tag, txr->txdma.dma_map,
 			BUS_DMASYNC_POSTREAD);
 
@@ -202,8 +171,6 @@ em_netmap_txsync(struct ifnet *ifp, u_int ring_nr, int do_lock)
 			u_int len = slot->len;
 
 			if (addr == netmap_buffer_base || len > NETMAP_BUF_SIZE) {
-				if (do_lock)
-					EM_TX_UNLOCK(txr);
 				return netmap_ring_reinit(kring);
 			}
 
@@ -252,8 +219,6 @@ em_netmap_txsync(struct ifnet *ifp, u_int ring_nr, int do_lock)
 	/* update avail to what the kernel knows */
 	ring->avail = kring->nr_hwavail;
 
-	if (do_lock)
-		EM_TX_UNLOCK(txr);
 	return 0;
 }
 
@@ -262,7 +227,7 @@ em_netmap_txsync(struct ifnet *ifp, u_int ring_nr, int do_lock)
  * Reconcile kernel and user view of the receive ring.
  */
 static int
-em_netmap_rxsync(struct ifnet *ifp, u_int ring_nr, int do_lock)
+em_netmap_rxsync(struct ifnet *ifp, u_int ring_nr, int flags)
 {
 	struct adapter *adapter = ifp->if_softc;
 	struct rx_ring *rxr = &adapter->rx_rings[ring_nr];
@@ -270,16 +235,13 @@ em_netmap_rxsync(struct ifnet *ifp, u_int ring_nr, int do_lock)
 	struct netmap_kring *kring = &na->rx_rings[ring_nr];
 	struct netmap_ring *ring = kring->ring;
 	u_int j, l, n, lim = kring->nkr_num_slots - 1;
-	int force_update = do_lock || kring->nr_kflags & NKR_PENDINTR;
+	int force_update = (flags & NAF_FORCE_READ) || kring->nr_kflags & NKR_PENDINTR;
 	u_int k = ring->cur, resvd = ring->reserved;
 
 	k = ring->cur;
 	if (k > lim)
 		return netmap_ring_reinit(kring);
 
-	if (do_lock)
-		EM_RX_LOCK(rxr);
-
 	/* XXX check sync modes */
 	bus_dmamap_sync(rxr->rxdma.dma_tag, rxr->rxdma.dma_map,
 			BUS_DMASYNC_POSTREAD | BUS_DMASYNC_POSTWRITE);
@@ -334,8 +296,6 @@ em_netmap_rxsync(struct ifnet *ifp, u_int ring_nr, int do_lock)
 			void *addr = PNMB(slot, &paddr);
 
 			if (addr == netmap_buffer_base) { /* bad buf */
-				if (do_lock)
-					EM_RX_UNLOCK(rxr);
 				return netmap_ring_reinit(kring);
 			}
 
@@ -364,8 +324,6 @@ em_netmap_rxsync(struct ifnet *ifp, u_int ring_nr, int do_lock)
 	}
 	/* tell userspace that there are new packets */
 	ring->avail = kring->nr_hwavail - resvd;
-	if (do_lock)
-		EM_RX_UNLOCK(rxr);
 	return 0;
 }
 
@@ -378,12 +336,11 @@ em_netmap_attach(struct adapter *adapter)
 	bzero(&na, sizeof(na));
 
 	na.ifp = adapter->ifp;
-	na.separate_locks = 1;
+	na.na_flags = NAF_BDG_MAYSLEEP;
 	na.num_tx_desc = adapter->num_tx_desc;
 	na.num_rx_desc = adapter->num_rx_desc;
 	na.nm_txsync = em_netmap_txsync;
 	na.nm_rxsync = em_netmap_rxsync;
-	na.nm_lock = em_netmap_lock_wrapper;
 	na.nm_register = em_netmap_reg;
 	netmap_attach(&na, adapter->num_queues);
 }
diff --git a/sys/dev/netmap/if_igb_netmap.h b/sys/dev/netmap/if_igb_netmap.h
index a94ca3b18835..10d94b5faa38 100644
--- a/sys/dev/netmap/if_igb_netmap.h
+++ b/sys/dev/netmap/if_igb_netmap.h
@@ -39,38 +39,6 @@
 
 
 /*
- * wrapper to export locks to the generic code
- */
-static void
-igb_netmap_lock_wrapper(struct ifnet *ifp, int what, u_int queueid)
-{
-	struct adapter *adapter = ifp->if_softc;
-
-	ASSERT(queueid < adapter->num_queues);
-	switch (what) {
-	case NETMAP_CORE_LOCK:
-		IGB_CORE_LOCK(adapter);
-		break;
-	case NETMAP_CORE_UNLOCK:
-		IGB_CORE_UNLOCK(adapter);
-		break;
-	case NETMAP_TX_LOCK:
-		IGB_TX_LOCK(&adapter->tx_rings[queueid]);
-		break;
-	case NETMAP_TX_UNLOCK:
-		IGB_TX_UNLOCK(&adapter->tx_rings[queueid]);
-		break;
-	case NETMAP_RX_LOCK:
-		IGB_RX_LOCK(&adapter->rx_rings[queueid]);
-		break;
-	case NETMAP_RX_UNLOCK:
-		IGB_RX_UNLOCK(&adapter->rx_rings[queueid]);
-		break;
-	}
-}
-
-
-/*
  * register-unregister routine
  */
 static int
@@ -92,7 +60,7 @@ igb_netmap_reg(struct ifnet *ifp, int onoff)
 		ifp->if_capenable |= IFCAP_NETMAP;
 
 		na->if_transmit = ifp->if_transmit;
-		ifp->if_transmit = netmap_start;
+		ifp->if_transmit = netmap_transmit;
 
 		igb_init_locked(adapter);
 		if ((ifp->if_drv_flags & (IFF_DRV_RUNNING | IFF_DRV_OACTIVE)) == 0) {
@@ -114,7 +82,7 @@ fail:
  * Reconcile kernel and user view of the transmit ring.
  */
 static int
-igb_netmap_txsync(struct ifnet *ifp, u_int ring_nr, int do_lock)
+igb_netmap_txsync(struct ifnet *ifp, u_int ring_nr, int flags)
 {
 	struct adapter *adapter = ifp->if_softc;
 	struct tx_ring *txr = &adapter->tx_rings[ring_nr];
@@ -130,8 +98,6 @@ igb_netmap_txsync(struct ifnet *ifp, u_int ring_nr, int do_lock)
 	if (k > lim)
 		return netmap_ring_reinit(kring);
 
-	if (do_lock)
-		IGB_TX_LOCK(txr);
 	bus_dmamap_sync(txr->txdma.dma_tag, txr->txdma.dma_map,
 	    BUS_DMASYNC_POSTREAD);
 
@@ -153,7 +119,14 @@ igb_netmap_txsync(struct ifnet *ifp, u_int ring_nr, int do_lock)
 			/* curr is the current slot in the nic ring */
 			union e1000_adv_tx_desc *curr =
 			    (union e1000_adv_tx_desc *)&txr->tx_base[l];
-			struct igb_tx_buffer *txbuf = &txr->tx_buffers[l];
+#ifndef IGB_MEDIA_RESET
+/* at the same time as IGB_MEDIA_RESET was defined, the
+ * tx buffer descriptor was renamed, so use this to revert
+ * back to the old name.
+ */
+#define igb_tx_buf igb_tx_buffer
+#endif
+			struct igb_tx_buf *txbuf = &txr->tx_buffers[l];
 			int flags = ((slot->flags & NS_REPORT) ||
 				j == 0 || j == report_frequency) ?
 					E1000_ADVTXD_DCMD_RS : 0;
@@ -162,8 +135,6 @@ igb_netmap_txsync(struct ifnet *ifp, u_int ring_nr, int do_lock)
 			u_int len = slot->len;
 
 			if (addr == netmap_buffer_base || len > NETMAP_BUF_SIZE) {
-				if (do_lock)
-					IGB_TX_UNLOCK(txr);
 				return netmap_ring_reinit(kring);
 			}
 
@@ -223,8 +194,6 @@ igb_netmap_txsync(struct ifnet *ifp, u_int ring_nr, int do_lock)
 	/* update avail to what the kernel knows */
 	ring->avail = kring->nr_hwavail;
 
-	if (do_lock)
-		IGB_TX_UNLOCK(txr);
 	return 0;
 }
 
@@ -233,7 +202,7 @@ igb_netmap_txsync(struct ifnet *ifp, u_int ring_nr, int do_lock)
  * Reconcile kernel and user view of the receive ring.
  */
 static int
-igb_netmap_rxsync(struct ifnet *ifp, u_int ring_nr, int do_lock)
+igb_netmap_rxsync(struct ifnet *ifp, u_int ring_nr, int flags)
 {
 	struct adapter *adapter = ifp->if_softc;
 	struct rx_ring *rxr = &adapter->rx_rings[ring_nr];
@@ -241,16 +210,13 @@ igb_netmap_rxsync(struct ifnet *ifp, u_int ring_nr, int do_lock)
 	struct netmap_kring *kring = &na->rx_rings[ring_nr];
 	struct netmap_ring *ring = kring->ring;
 	u_int j, l, n, lim = kring->nkr_num_slots - 1;
-	int force_update = do_lock || kring->nr_kflags & NKR_PENDINTR;
+	int force_update = (flags & NAF_FORCE_READ) || kring->nr_kflags & NKR_PENDINTR;
 	u_int k = ring->cur, resvd = ring->reserved;
 
 	k = ring->cur;
 	if (k > lim)
 		return netmap_ring_reinit(kring);
 
-	if (do_lock)
-		IGB_RX_LOCK(rxr);
-
 	/* XXX check sync modes */
 	bus_dmamap_sync(rxr->rxdma.dma_tag, rxr->rxdma.dma_map,
 	    BUS_DMASYNC_POSTREAD | BUS_DMASYNC_POSTWRITE);
@@ -303,8 +269,6 @@ igb_netmap_rxsync(struct ifnet *ifp, u_int ring_nr, int do_lock)
 			void *addr = PNMB(slot, &paddr);
 
 			if (addr == netmap_buffer_base) { /* bad buf */
-				if (do_lock)
-					IGB_RX_UNLOCK(rxr);
 				return netmap_ring_reinit(kring);
 			}
 
@@ -332,8 +296,6 @@ igb_netmap_rxsync(struct ifnet *ifp, u_int ring_nr, int do_lock)
 	}
 	/* tell userspace that there are new packets */
 	ring->avail = kring->nr_hwavail - resvd;
-	if (do_lock)
-		IGB_RX_UNLOCK(rxr);
 	return 0;
 }
 
@@ -346,12 +308,11 @@ igb_netmap_attach(struct adapter *adapter)
 	bzero(&na, sizeof(na));
 
 	na.ifp = adapter->ifp;
-	na.separate_locks = 1;
+	na.na_flags = NAF_BDG_MAYSLEEP;
 	na.num_tx_desc = adapter->num_tx_desc;
 	na.num_rx_desc = adapter->num_rx_desc;
 	na.nm_txsync = igb_netmap_txsync;
 	na.nm_rxsync = igb_netmap_rxsync;
-	na.nm_lock = igb_netmap_lock_wrapper;
 	na.nm_register = igb_netmap_reg;
 	netmap_attach(&na, adapter->num_queues);
 }	
diff --git a/sys/dev/netmap/if_lem_netmap.h b/sys/dev/netmap/if_lem_netmap.h
index acef45f0d884..25e5c7c27e3e 100644
--- a/sys/dev/netmap/if_lem_netmap.h
+++ b/sys/dev/netmap/if_lem_netmap.h
@@ -39,35 +39,6 @@
 #include <dev/netmap/netmap_kern.h>
 
 
-static void
-lem_netmap_lock_wrapper(struct ifnet *ifp, int what, u_int ringid)
-{
-	struct adapter *adapter = ifp->if_softc;
-
-	/* only one ring here so ignore the ringid */
-	switch (what) {
-	case NETMAP_CORE_LOCK:
-		EM_CORE_LOCK(adapter);
-		break;
-	case NETMAP_CORE_UNLOCK:
-		EM_CORE_UNLOCK(adapter);
-		break;
-	case NETMAP_TX_LOCK:
-		EM_TX_LOCK(adapter);
-		break;
-	case NETMAP_TX_UNLOCK:
-		EM_TX_UNLOCK(adapter);
-		break;
-	case NETMAP_RX_LOCK:
-		EM_RX_LOCK(adapter);
-		break;
-	case NETMAP_RX_UNLOCK:
-		EM_RX_UNLOCK(adapter);
-		break;
-	}
-}
-
-
 /*
  * Register/unregister
  */
@@ -81,6 +52,8 @@ lem_netmap_reg(struct ifnet *ifp, int onoff)
 	if (na == NULL)
 		return EINVAL;
 
+	EM_CORE_LOCK(adapter);
+
 	lem_disable_intr(adapter);
 
 	/* Tell the stack that the interface is no longer active */
@@ -95,7 +68,7 @@ lem_netmap_reg(struct ifnet *ifp, int onoff)
 		ifp->if_capenable |= IFCAP_NETMAP;
 
 		na->if_transmit = ifp->if_transmit;
-		ifp->if_transmit = netmap_start;
+		ifp->if_transmit = netmap_transmit;
 
 		lem_init_locked(adapter);
 		if ((ifp->if_drv_flags & (IFF_DRV_RUNNING | IFF_DRV_OACTIVE)) == 0) {
@@ -114,6 +87,8 @@ fail:
 	taskqueue_unblock(adapter->tq); // XXX do we need this ?
 #endif /* !EM_LEGCY_IRQ */
 
+	EM_CORE_UNLOCK(adapter);
+
 	return (error);
 }
 
@@ -122,7 +97,7 @@ fail:
  * Reconcile kernel and user view of the transmit ring.
  */
 static int
-lem_netmap_txsync(struct ifnet *ifp, u_int ring_nr, int do_lock)
+lem_netmap_txsync(struct ifnet *ifp, u_int ring_nr, int flags)
 {
 	struct adapter *adapter = ifp->if_softc;
 	struct netmap_adapter *na = NA(ifp);
@@ -133,13 +108,16 @@ lem_netmap_txsync(struct ifnet *ifp, u_int ring_nr, int do_lock)
 	/* generate an interrupt approximately every half ring */
 	int report_frequency = kring->nkr_num_slots >> 1;
 
+	ND("%s: hwofs %d, hwcur %d hwavail %d lease %d cur %d avail %d",
+		ifp->if_xname,
+		kring->nkr_hwofs, kring->nr_hwcur, kring->nr_hwavail,
+		kring->nkr_hwlease,
+		ring->cur, ring->avail);
 	/* take a copy of ring->cur now, and never read it again */
 	k = ring->cur;
 	if (k > lim)
 		return netmap_ring_reinit(kring);
 
-	if (do_lock)
-		EM_TX_LOCK(adapter);
 	bus_dmamap_sync(adapter->txdma.dma_tag, adapter->txdma.dma_map,
 			BUS_DMASYNC_POSTREAD);
 	/*
@@ -147,6 +125,8 @@ lem_netmap_txsync(struct ifnet *ifp, u_int ring_nr, int do_lock)
 	 * netmap ring, l is the corresponding index in the NIC ring.
 	 */
 	j = kring->nr_hwcur;
+	if (netmap_verbose > 255)
+		RD(5, "device %s send %d->%d", ifp->if_xname, j, k);
 	if (j != k) {	/* we have new packets to send */
 		l = netmap_idx_k2n(kring, j);
 		for (n = 0; j != k; n++) {
@@ -163,13 +143,12 @@ lem_netmap_txsync(struct ifnet *ifp, u_int ring_nr, int do_lock)
 			u_int len = slot->len;
 
 			if (addr == netmap_buffer_base || len > NETMAP_BUF_SIZE) {
-				if (do_lock)
-					EM_TX_UNLOCK(adapter);
 				return netmap_ring_reinit(kring);
 			}
+			ND("slot %d NIC %d %s", j, l, nm_dump_buf(addr, len, 128, NULL));
 
 			slot->flags &= ~NS_REPORT;
-			if (slot->flags & NS_BUF_CHANGED) {
+			if (1 || slot->flags & NS_BUF_CHANGED) {
 				/* buffer has changed, reload map */
 				netmap_reload_map(adapter->txtag, txbuf->map, addr);
 				curr->buffer_addr = htole64(paddr);
@@ -180,11 +159,13 @@ lem_netmap_txsync(struct ifnet *ifp, u_int ring_nr, int do_lock)
 			    htole32( adapter->txd_cmd | len |
 				(E1000_TXD_CMD_EOP | flags) );
 
+			ND("len %d kring %d nic %d", len, j, l);
 			bus_dmamap_sync(adapter->txtag, txbuf->map,
 			    BUS_DMASYNC_PREWRITE);
 			j = (j == lim) ? 0 : j + 1;
 			l = (l == lim) ? 0 : l + 1;
 		}
+		ND("sent %d packets from %d, TDT now %d", n, kring->nr_hwcur, l);
 		kring->nr_hwcur = k; /* the saved ring->cur */
 		kring->nr_hwavail -= n;
 
@@ -199,6 +180,7 @@ lem_netmap_txsync(struct ifnet *ifp, u_int ring_nr, int do_lock)
 
 		/* record completed transmissions using TDH */
 		l = E1000_READ_REG(&adapter->hw, E1000_TDH(0));
+		ND("tdh is now %d", l);
 		if (l >= kring->nkr_num_slots) { /* XXX can it happen ? */
 			D("bad TDH %d", l);
 			l -= kring->nkr_num_slots;
@@ -208,6 +190,9 @@ lem_netmap_txsync(struct ifnet *ifp, u_int ring_nr, int do_lock)
 			/* some tx completed, increment hwavail. */
 			if (delta < 0)
 				delta += kring->nkr_num_slots;
+			if (netmap_verbose > 255)
+				RD(5, "%s tx recover %d bufs",
+					ifp->if_xname, delta);
 			adapter->next_tx_to_clean = l;
 			kring->nr_hwavail += delta;
 		}
@@ -215,8 +200,6 @@ lem_netmap_txsync(struct ifnet *ifp, u_int ring_nr, int do_lock)
 	/* update avail to what the kernel knows */
 	ring->avail = kring->nr_hwavail;
 
-	if (do_lock)
-		EM_TX_UNLOCK(adapter);
 	return 0;
 }
 
@@ -225,21 +208,19 @@ lem_netmap_txsync(struct ifnet *ifp, u_int ring_nr, int do_lock)
  * Reconcile kernel and user view of the receive ring.
  */
 static int
-lem_netmap_rxsync(struct ifnet *ifp, u_int ring_nr, int do_lock)
+lem_netmap_rxsync(struct ifnet *ifp, u_int ring_nr, int flags)
 {
 	struct adapter *adapter = ifp->if_softc;
 	struct netmap_adapter *na = NA(ifp);
 	struct netmap_kring *kring = &na->rx_rings[ring_nr];
 	struct netmap_ring *ring = kring->ring;
 	int j, l, n, lim = kring->nkr_num_slots - 1;
-	int force_update = do_lock || kring->nr_kflags & NKR_PENDINTR;
+	int force_update = (flags & NAF_FORCE_READ) || kring->nr_kflags & NKR_PENDINTR;
 	u_int k = ring->cur, resvd = ring->reserved;
 
 	if (k > lim)
 		return netmap_ring_reinit(kring);
 
-	if (do_lock)
-		EM_RX_LOCK(adapter);
 
 	/* XXX check sync modes */
 	bus_dmamap_sync(adapter->rxdma.dma_tag, adapter->rxdma.dma_map,
@@ -251,6 +232,10 @@ lem_netmap_rxsync(struct ifnet *ifp, u_int ring_nr, int do_lock)
 	 */
 	l = adapter->next_rx_desc_to_check;
 	j = netmap_idx_n2k(kring, l);
+	ND("%s: next NIC %d kring %d (ofs %d), hwcur %d hwavail %d cur %d avail %d",
+		ifp->if_xname,
+		l, j,  kring->nkr_hwofs, kring->nr_hwcur, kring->nr_hwavail,
+		ring->cur, ring->avail);
 	if (netmap_no_pendintr || force_update) {
 		uint16_t slot_flags = kring->nkr_slot_flags;
 
@@ -266,6 +251,8 @@ lem_netmap_rxsync(struct ifnet *ifp, u_int ring_nr, int do_lock)
 				D("bogus pkt size at %d", j);
 				len = 0;
 			}
+			ND("\n%s", nm_dump_buf(NMB(&ring->slot[j]),
+				len, 128, NULL));
 			ring->slot[j].len = len;
 			ring->slot[j].flags = slot_flags;
 			bus_dmamap_sync(adapter->rxtag,
@@ -300,8 +287,6 @@ lem_netmap_rxsync(struct ifnet *ifp, u_int ring_nr, int do_lock)
 			void *addr = PNMB(slot, &paddr);
 
 			if (addr == netmap_buffer_base) { /* bad buf */
-				if (do_lock)
-					EM_RX_UNLOCK(adapter);
 				return netmap_ring_reinit(kring);
 			}
 
@@ -332,8 +317,6 @@ lem_netmap_rxsync(struct ifnet *ifp, u_int ring_nr, int do_lock)
 	}
 	/* tell userspace that there are new packets */
 	ring->avail = kring->nr_hwavail - resvd;
-	if (do_lock)
-		EM_RX_UNLOCK(adapter);
 	return 0;
 }
 
@@ -346,12 +329,11 @@ lem_netmap_attach(struct adapter *adapter)
 	bzero(&na, sizeof(na));
 
 	na.ifp = adapter->ifp;
-	na.separate_locks = 1;
+	na.na_flags = NAF_BDG_MAYSLEEP;
 	na.num_tx_desc = adapter->num_tx_desc;
 	na.num_rx_desc = adapter->num_rx_desc;
 	na.nm_txsync = lem_netmap_txsync;
 	na.nm_rxsync = lem_netmap_rxsync;
-	na.nm_lock = lem_netmap_lock_wrapper;
 	na.nm_register = lem_netmap_reg;
 	netmap_attach(&na, 1);
 }
diff --git a/sys/dev/netmap/if_re_netmap.h b/sys/dev/netmap/if_re_netmap.h
index f0f1f1969f4e..ac781ccb572e 100644
--- a/sys/dev/netmap/if_re_netmap.h
+++ b/sys/dev/netmap/if_re_netmap.h
@@ -39,33 +39,6 @@
 
 
 /*
- * wrapper to export locks to the generic code
- * We should not use the tx/rx locks
- */
-static void
-re_netmap_lock_wrapper(struct ifnet *ifp, int what, u_int queueid)
-{
-	struct rl_softc *adapter = ifp->if_softc;
-
-	switch (what) {
-	case NETMAP_CORE_LOCK:
-		RL_LOCK(adapter);
-		break;
-	case NETMAP_CORE_UNLOCK:
-		RL_UNLOCK(adapter);
-		break;
-
-	case NETMAP_TX_LOCK:
-	case NETMAP_RX_LOCK:
-	case NETMAP_TX_UNLOCK:
-	case NETMAP_RX_UNLOCK:
-		D("invalid lock call %d, no tx/rx locks here", what);
-		break;
-	}
-}
-
-
-/*
  * support for netmap register/unregisted. We are already under core lock.
  * only called on the first register or the last unregister.
  */
@@ -88,7 +61,7 @@ re_netmap_reg(struct ifnet *ifp, int onoff)
 
 		/* save if_transmit to restore it later */
 		na->if_transmit = ifp->if_transmit;
-		ifp->if_transmit = netmap_start;
+		ifp->if_transmit = netmap_transmit;
 
 		re_init_locked(adapter);
 
@@ -111,7 +84,7 @@ fail:
  * Reconcile kernel and user view of the transmit ring.
  */
 static int
-re_netmap_txsync(struct ifnet *ifp, u_int ring_nr, int do_lock)
+re_netmap_txsync(struct ifnet *ifp, u_int ring_nr, int flags)
 {
 	struct rl_softc *sc = ifp->if_softc;
 	struct rl_txdesc *txd = sc->rl_ldata.rl_tx_desc;
@@ -124,9 +97,6 @@ re_netmap_txsync(struct ifnet *ifp, u_int ring_nr, int do_lock)
 	if (k > lim)
 		return netmap_ring_reinit(kring);
 
-	if (do_lock)
-		RL_LOCK(sc);
-
 	/* Sync the TX descriptor list */
 	bus_dmamap_sync(sc->rl_ldata.rl_tx_list_tag,
             sc->rl_ldata.rl_tx_list_map,
@@ -164,8 +134,6 @@ re_netmap_txsync(struct ifnet *ifp, u_int ring_nr, int do_lock)
 			int len = slot->len;
 
 			if (addr == netmap_buffer_base || len > NETMAP_BUF_SIZE) {
-				if (do_lock)
-					RL_UNLOCK(sc);
 				// XXX what about prodidx ?
 				return netmap_ring_reinit(kring);
 			}
@@ -200,8 +168,6 @@ re_netmap_txsync(struct ifnet *ifp, u_int ring_nr, int do_lock)
 		/* start ? */
 		CSR_WRITE_1(sc, sc->rl_txstart, RL_TXSTART_START);
 	}
-	if (do_lock)
-		RL_UNLOCK(sc);
 	return 0;
 }
 
@@ -210,7 +176,7 @@ re_netmap_txsync(struct ifnet *ifp, u_int ring_nr, int do_lock)
  * Reconcile kernel and user view of the receive ring.
  */
 static int
-re_netmap_rxsync(struct ifnet *ifp, u_int ring_nr, int do_lock)
+re_netmap_rxsync(struct ifnet *ifp, u_int ring_nr, int flags)
 {
 	struct rl_softc *sc = ifp->if_softc;
 	struct rl_rxdesc *rxd = sc->rl_ldata.rl_rx_desc;
@@ -218,15 +184,13 @@ re_netmap_rxsync(struct ifnet *ifp, u_int ring_nr, int do_lock)
 	struct netmap_kring *kring = &na->rx_rings[ring_nr];
 	struct netmap_ring *ring = kring->ring;
 	int j, l, n, lim = kring->nkr_num_slots - 1;
-	int force_update = do_lock || kring->nr_kflags & NKR_PENDINTR;
+	int force_update = (flags & NAF_FORCE_READ) || kring->nr_kflags & NKR_PENDINTR;
 	u_int k = ring->cur, resvd = ring->reserved;
 
 	k = ring->cur;
 	if (k > lim)
 		return netmap_ring_reinit(kring);
 
-	if (do_lock)
-		RL_LOCK(sc);
 	/* XXX check sync modes */
 	bus_dmamap_sync(sc->rl_ldata.rl_rx_list_tag,
 	    sc->rl_ldata.rl_rx_list_map,
@@ -291,8 +255,6 @@ re_netmap_rxsync(struct ifnet *ifp, u_int ring_nr, int do_lock)
 			void *addr = PNMB(slot, &paddr);
 
 			if (addr == netmap_buffer_base) { /* bad buf */
-				if (do_lock)
-					RL_UNLOCK(sc);
 				return netmap_ring_reinit(kring);
 			}
 
@@ -323,8 +285,6 @@ re_netmap_rxsync(struct ifnet *ifp, u_int ring_nr, int do_lock)
 	}
 	/* tell userspace that there are new packets */
 	ring->avail = kring->nr_hwavail - resvd;
-	if (do_lock)
-		RL_UNLOCK(sc);
 	return 0;
 }
 
@@ -411,12 +371,11 @@ re_netmap_attach(struct rl_softc *sc)
 	bzero(&na, sizeof(na));
 
 	na.ifp = sc->rl_ifp;
-	na.separate_locks = 0;
+	na.na_flags = NAF_BDG_MAYSLEEP;
 	na.num_tx_desc = sc->rl_ldata.rl_tx_desc_cnt;
 	na.num_rx_desc = sc->rl_ldata.rl_rx_desc_cnt;
 	na.nm_txsync = re_netmap_txsync;
 	na.nm_rxsync = re_netmap_rxsync;
-	na.nm_lock = re_netmap_lock_wrapper;
 	na.nm_register = re_netmap_reg;
 	netmap_attach(&na, 1);
 }
diff --git a/sys/dev/netmap/ixgbe_netmap.h b/sys/dev/netmap/ixgbe_netmap.h
index be790502c276..fca1cf1e0a90 100644
--- a/sys/dev/netmap/ixgbe_netmap.h
+++ b/sys/dev/netmap/ixgbe_netmap.h
@@ -72,37 +72,6 @@ SYSCTL_INT(_dev_netmap, OID_AUTO, ix_rx_miss,
 SYSCTL_INT(_dev_netmap, OID_AUTO, ix_rx_miss_bufs,
     CTLFLAG_RW, &ix_rx_miss_bufs, 0, "potentially missed rx intr bufs");
 
-/*
- * wrapper to export locks to the generic netmap code.
- */
-static void
-ixgbe_netmap_lock_wrapper(struct ifnet *_a, int what, u_int queueid)
-{
-	struct adapter *adapter = _a->if_softc;
-
-	ASSERT(queueid < adapter->num_queues);
-	switch (what) {
-	case NETMAP_CORE_LOCK:
-		IXGBE_CORE_LOCK(adapter);
-		break;
-	case NETMAP_CORE_UNLOCK:
-		IXGBE_CORE_UNLOCK(adapter);
-		break;
-	case NETMAP_TX_LOCK:
-		IXGBE_TX_LOCK(&adapter->tx_rings[queueid]);
-		break;
-	case NETMAP_TX_UNLOCK:
-		IXGBE_TX_UNLOCK(&adapter->tx_rings[queueid]);
-		break;
-	case NETMAP_RX_LOCK:
-		IXGBE_RX_LOCK(&adapter->rx_rings[queueid]);
-		break;
-	case NETMAP_RX_UNLOCK:
-		IXGBE_RX_UNLOCK(&adapter->rx_rings[queueid]);
-		break;
-	}
-}
-
 
 static void
 set_crcstrip(struct ixgbe_hw *hw, int onoff)
@@ -155,6 +124,7 @@ ixgbe_netmap_reg(struct ifnet *ifp, int onoff)
 	if (na == NULL)
 		return EINVAL; /* no netmap support here */
 
+	IXGBE_CORE_LOCK(adapter);
 	ixgbe_disable_intr(adapter);
 
 	/* Tell the stack that the interface is no longer active */
@@ -166,7 +136,7 @@ ixgbe_netmap_reg(struct ifnet *ifp, int onoff)
 
 		/* save if_transmit and replace with our routine */
 		na->if_transmit = ifp->if_transmit;
-		ifp->if_transmit = netmap_start;
+		ifp->if_transmit = netmap_transmit;
 
 		/*
 		 * reinitialize the adapter, now with netmap flag set,
@@ -186,6 +156,7 @@ fail:
 		ixgbe_init_locked(adapter);	/* also enables intr */
 	}
 	set_crcstrip(&adapter->hw, onoff);
+	IXGBE_CORE_UNLOCK(adapter);
 	return (error);
 }
 
@@ -213,12 +184,11 @@ fail:
  *
  * ring->avail is never used, only checked for bogus values.
  *
- * do_lock is set iff the function is called from the ioctl handler.
- * In this case, grab a lock around the body, and also reclaim transmitted
+ * I flags & FORCE_RECLAIM, reclaim transmitted
  * buffers irrespective of interrupt mitigation.
  */
 static int
-ixgbe_netmap_txsync(struct ifnet *ifp, u_int ring_nr, int do_lock)
+ixgbe_netmap_txsync(struct ifnet *ifp, u_int ring_nr, int flags)
 {
 	struct adapter *adapter = ifp->if_softc;
 	struct tx_ring *txr = &adapter->tx_rings[ring_nr];
@@ -237,8 +207,6 @@ ixgbe_netmap_txsync(struct ifnet *ifp, u_int ring_nr, int do_lock)
 
 	if (k > lim)
 		return netmap_ring_reinit(kring);
-	if (do_lock)
-		IXGBE_TX_LOCK(txr);
 
 	bus_dmamap_sync(txr->txdma.dma_tag, txr->txdma.dma_map,
 			BUS_DMASYNC_POSTREAD);
@@ -303,8 +271,6 @@ ixgbe_netmap_txsync(struct ifnet *ifp, u_int ring_nr, int do_lock)
 			 */
 			if (addr == netmap_buffer_base || len > NETMAP_BUF_SIZE) {
 ring_reset:
-				if (do_lock)
-					IXGBE_TX_UNLOCK(txr);
 				return netmap_ring_reinit(kring);
 			}
 
@@ -347,7 +313,7 @@ ring_reset:
 	 * In all cases kring->nr_kflags indicates which slot will be
 	 * checked upon a tx interrupt (nkr_num_slots means none).
 	 */
-	if (do_lock) {
+	if (flags & NAF_FORCE_RECLAIM) {
 		j = 1; /* forced reclaim, ignore interrupts */
 		kring->nr_kflags = kring->nkr_num_slots;
 	} else if (kring->nr_hwavail > 0) {
@@ -422,8 +388,6 @@ ring_reset:
 	/* update avail to what the kernel knows */
 	ring->avail = kring->nr_hwavail;
 
-	if (do_lock)
-		IXGBE_TX_UNLOCK(txr);
 	return 0;
 }
 
@@ -442,10 +406,11 @@ ring_reset:
  * from nr_hwavail, make the descriptors available for the next reads,
  * and set kring->nr_hwcur = ring->cur and ring->avail = kring->nr_hwavail.
  *
- * do_lock has a special meaning: please refer to txsync.
+ * If (flags & NAF_FORCE_READ) also check for incoming packets irrespective
+ * of whether or not we received an interrupt.
  */
 static int
-ixgbe_netmap_rxsync(struct ifnet *ifp, u_int ring_nr, int do_lock)
+ixgbe_netmap_rxsync(struct ifnet *ifp, u_int ring_nr, int flags)
 {
 	struct adapter *adapter = ifp->if_softc;
 	struct rx_ring *rxr = &adapter->rx_rings[ring_nr];
@@ -453,14 +418,12 @@ ixgbe_netmap_rxsync(struct ifnet *ifp, u_int ring_nr, int do_lock)
 	struct netmap_kring *kring = &na->rx_rings[ring_nr];
 	struct netmap_ring *ring = kring->ring;
 	u_int j, l, n, lim = kring->nkr_num_slots - 1;
-	int force_update = do_lock || kring->nr_kflags & NKR_PENDINTR;
+	int force_update = (flags & NAF_FORCE_READ) || kring->nr_kflags & NKR_PENDINTR;
 	u_int k = ring->cur, resvd = ring->reserved;
 
 	if (k > lim)
 		return netmap_ring_reinit(kring);
 
-	if (do_lock)
-		IXGBE_RX_LOCK(rxr);
 	/* XXX check sync modes */
 	bus_dmamap_sync(rxr->rxdma.dma_tag, rxr->rxdma.dma_map,
 			BUS_DMASYNC_POSTREAD | BUS_DMASYNC_POSTWRITE);
@@ -571,13 +534,9 @@ ixgbe_netmap_rxsync(struct ifnet *ifp, u_int ring_nr, int do_lock)
 	/* tell userspace that there are new packets */
 	ring->avail = kring->nr_hwavail - resvd;
 
-	if (do_lock)
-		IXGBE_RX_UNLOCK(rxr);
 	return 0;
 
 ring_reset:
-	if (do_lock)
-		IXGBE_RX_UNLOCK(rxr);
 	return netmap_ring_reinit(kring);
 }
 
@@ -597,12 +556,11 @@ ixgbe_netmap_attach(struct adapter *adapter)
 	bzero(&na, sizeof(na));
 
 	na.ifp = adapter->ifp;
-	na.separate_locks = 1;	/* this card has separate rx/tx locks */
+	na.na_flags = NAF_BDG_MAYSLEEP;
 	na.num_tx_desc = adapter->num_tx_desc;
 	na.num_rx_desc = adapter->num_rx_desc;
 	na.nm_txsync = ixgbe_netmap_txsync;
 	na.nm_rxsync = ixgbe_netmap_rxsync;
-	na.nm_lock = ixgbe_netmap_lock_wrapper;
 	na.nm_register = ixgbe_netmap_reg;
 	netmap_attach(&na, adapter->num_queues);
 }	
diff --git a/sys/dev/netmap/netmap.c b/sys/dev/netmap/netmap.c
index b55c338fa907..19be406f6dbc 100644
--- a/sys/dev/netmap/netmap.c
+++ b/sys/dev/netmap/netmap.c
@@ -23,7 +23,6 @@
  * SUCH DAMAGE.
  */
 
-#define NM_BRIDGE
 
 /*
  * This module supports memory mapped access to network devices,
@@ -52,18 +51,84 @@
  *    packets on the output interface.
  * 6. select() or poll() can be used to wait for events on individual
  *    transmit or receive queues (or all queues for a given interface).
- */
+ *
 
-#ifdef linux
-#include "bsd_glue.h"
-static netdev_tx_t linux_netmap_start(struct sk_buff *skb, struct net_device *dev);
-#endif /* linux */
+		SYNCHRONIZATION (USER)
 
-#ifdef __APPLE__
-#include "osx_glue.h"
-#endif /* __APPLE__ */
+The netmap rings and data structures may be shared among multiple
+user threads or even independent processes.
+Any synchronization among those threads/processes is delegated
+to the threads themselves. Only one thread at a time can be in
+a system call on the same netmap ring. The OS does not enforce
+this and only guarantees against system crashes in case of
+invalid usage.
 
-#ifdef __FreeBSD__
+		LOCKING (INTERNAL)
+
+Within the kernel, access to the netmap rings is protected as follows:
+
+- a spinlock on each ring, to handle producer/consumer races on
+  RX rings attached to the host stack (against multiple host
+  threads writing from the host stack to the same ring),
+  and on 'destination' rings attached to a VALE switch
+  (i.e. RX rings in VALE ports, and TX rings in NIC/host ports)
+  protecting multiple active senders for the same destination)
+
+- an atomic variable to guarantee that there is at most one
+  instance of *_*xsync() on the ring at any time.
+  For rings connected to user file
+  descriptors, an atomic_test_and_set() protects this, and the
+  lock on the ring is not actually used.
+  For NIC RX rings connected to a VALE switch, an atomic_test_and_set()
+  is also used to prevent multiple executions (the driver might indeed
+  already guarantee this).
+  For NIC TX rings connected to a VALE switch, the lock arbitrates
+  access to the queue (both when allocating buffers and when pushing
+  them out).
+
+- *xsync() should be protected against initializations of the card.
+  On FreeBSD most devices have the reset routine protected by
+  a RING lock (ixgbe, igb, em) or core lock (re). lem is missing
+  the RING protection on rx_reset(), this should be added.
+
+  On linux there is an external lock on the tx path, which probably
+  also arbitrates access to the reset routine. XXX to be revised
+
+- a per-interface core_lock protecting access from the host stack
+  while interfaces may be detached from netmap mode.
+  XXX there should be no need for this lock if we detach the interfaces
+  only while they are down.
+
+
+--- VALE SWITCH ---
+
+NMG_LOCK() serializes all modifications to switches and ports.
+A switch cannot be deleted until all ports are gone.
+
+For each switch, an SX lock (RWlock on linux) protects
+deletion of ports. When configuring or deleting a new port, the
+lock is acquired in exclusive mode (after holding NMG_LOCK).
+When forwarding, the lock is acquired in shared mode (without NMG_LOCK).
+The lock is held throughout the entire forwarding cycle,
+during which the thread may incur in a page fault.
+Hence it is important that sleepable shared locks are used.
+
+On the rx ring, the per-port lock is grabbed initially to reserve
+a number of slot in the ring, then the lock is released,
+packets are copied from source to destination, and then
+the lock is acquired again and the receive ring is updated.
+(A similar thing is done on the tx ring for NIC and host stack
+ports attached to the switch)
+
+ */
+
+/*
+ * OS-specific code that is used only within this file.
+ * Other OS-specific code that must be accessed by drivers
+ * is present in netmap_kern.h
+ */
+
+#if defined(__FreeBSD__)
 #include <sys/cdefs.h> /* prerequisite */
 __FBSDID("$FreeBSD$");
 
@@ -84,25 +149,143 @@ __FBSDID("$FreeBSD$");
 #include <sys/rwlock.h>
 #include <vm/vm.h>	/* vtophys */
 #include <vm/pmap.h>	/* vtophys */
+#include <vm/vm_param.h>
+#include <vm/vm_object.h>
+#include <vm/vm_page.h>
+#include <vm/vm_pager.h>
+#include <vm/uma.h>
 #include <sys/socket.h> /* sockaddrs */
-#include <machine/bus.h>
 #include <sys/selinfo.h>
 #include <sys/sysctl.h>
 #include <net/if.h>
+#include <net/if_var.h>
 #include <net/bpf.h>		/* BIOCIMMEDIATE */
 #include <net/vnet.h>
 #include <machine/bus.h>	/* bus_dmamap_* */
+#include <sys/endian.h>
+#include <sys/refcount.h>
 
-MALLOC_DEFINE(M_NETMAP, "netmap", "Network memory map");
-#endif /* __FreeBSD__ */
+#define prefetch(x)	__builtin_prefetch(x)
+
+#define BDG_RWLOCK_T		struct rwlock // struct rwlock
+
+#define	BDG_RWINIT(b)		\
+	rw_init_flags(&(b)->bdg_lock, "bdg lock", RW_NOWITNESS)
+#define BDG_WLOCK(b)		rw_wlock(&(b)->bdg_lock)
+#define BDG_WUNLOCK(b)		rw_wunlock(&(b)->bdg_lock)
+#define BDG_RLOCK(b)		rw_rlock(&(b)->bdg_lock)
+#define BDG_RTRYLOCK(b)		rw_try_rlock(&(b)->bdg_lock)
+#define BDG_RUNLOCK(b)		rw_runlock(&(b)->bdg_lock)
+#define BDG_RWDESTROY(b)	rw_destroy(&(b)->bdg_lock)
+
+
+/* netmap global lock.
+ * normally called within the user thread (upon a system call)
+ * or when a file descriptor or process is terminated
+ * (last close or last munmap)
+ */
+
+#define NMG_LOCK_T		struct mtx
+#define NMG_LOCK_INIT()		mtx_init(&netmap_global_lock, "netmap global lock", NULL, MTX_DEF)
+#define NMG_LOCK_DESTROY()	mtx_destroy(&netmap_global_lock)
+#define NMG_LOCK()		mtx_lock(&netmap_global_lock)
+#define NMG_UNLOCK()		mtx_unlock(&netmap_global_lock)
+#define NMG_LOCK_ASSERT()	mtx_assert(&netmap_global_lock, MA_OWNED)
+
+
+/* atomic operations */
+#include <machine/atomic.h>
+#define NM_ATOMIC_TEST_AND_SET(p)	(!atomic_cmpset_acq_int((p), 0, 1))
+#define NM_ATOMIC_CLEAR(p)		atomic_store_rel_int((p), 0)
+
+
+#elif defined(linux)
+
+#include "bsd_glue.h"
+
+static netdev_tx_t linux_netmap_start_xmit(struct sk_buff *, struct net_device *);
+
+static struct device_driver*
+linux_netmap_find_driver(struct device *dev)
+{
+	struct device_driver *dd;
+
+	while ( (dd = dev->driver) == NULL ) {
+		if ( (dev = dev->parent) == NULL )
+			return NULL;
+	}
+	return dd;
+}
+
+static struct net_device*
+ifunit_ref(const char *name)
+{
+	struct net_device *ifp = dev_get_by_name(&init_net, name);
+	struct device_driver *dd;
+
+	if (ifp == NULL)
+		return NULL;
 
+	if ( (dd = linux_netmap_find_driver(&ifp->dev)) == NULL )
+		goto error;
+
+	if (!try_module_get(dd->owner))
+		goto error;
+
+	return ifp;
+error:
+	dev_put(ifp);
+	return NULL;
+}
+
+static void
+if_rele(struct net_device *ifp)
+{
+	struct device_driver *dd;
+	dd = linux_netmap_find_driver(&ifp->dev);
+	dev_put(ifp);
+	if (dd)
+		module_put(dd->owner);
+}
+
+// XXX a mtx would suffice here too 20130404 gl
+#define NMG_LOCK_T		struct semaphore
+#define NMG_LOCK_INIT()		sema_init(&netmap_global_lock, 1)
+#define NMG_LOCK_DESTROY()	
+#define NMG_LOCK()		down(&netmap_global_lock)
+#define NMG_UNLOCK()		up(&netmap_global_lock)
+#define NMG_LOCK_ASSERT()	//	XXX to be completed
+
+
+#elif defined(__APPLE__)
+
+#warning OSX support is only partial
+#include "osx_glue.h"
+
+#else
+
+#error	Unsupported platform
+
+#endif /* unsupported */
+
+/*
+ * common headers
+ */
 #include <net/netmap.h>
 #include <dev/netmap/netmap_kern.h>
+#include <dev/netmap/netmap_mem2.h>
+
 
-/* XXX the following variables must be deprecated and included in nm_mem */
+MALLOC_DEFINE(M_NETMAP, "netmap", "Network memory map");
+
+/*
+ * The following variables are used by the drivers and replicate
+ * fields in the global memory pool. They only refer to buffers
+ * used by physical interfaces.
+ */
 u_int netmap_total_buffers;
 u_int netmap_buf_size;
-char *netmap_buffer_base;	/* address of an invalid buffer */
+char *netmap_buffer_base;	/* also address of an invalid buffer */
 
 /* user-controlled variables */
 int netmap_verbose;
@@ -119,54 +302,219 @@ SYSCTL_INT(_dev_netmap, OID_AUTO, mitigate, CTLFLAG_RW, &netmap_mitigate, 0, "")
 int netmap_no_pendintr = 1;
 SYSCTL_INT(_dev_netmap, OID_AUTO, no_pendintr,
     CTLFLAG_RW, &netmap_no_pendintr, 0, "Always look for new received packets.");
+int netmap_txsync_retry = 2;
+SYSCTL_INT(_dev_netmap, OID_AUTO, txsync_retry, CTLFLAG_RW,
+    &netmap_txsync_retry, 0 , "Number of txsync loops in bridge's flush.");
 
 int netmap_drop = 0;	/* debugging */
 int netmap_flags = 0;	/* debug flags */
 int netmap_fwd = 0;	/* force transparent mode */
+int netmap_mmap_unreg = 0; /* allow mmap of unregistered fds */
 
 SYSCTL_INT(_dev_netmap, OID_AUTO, drop, CTLFLAG_RW, &netmap_drop, 0 , "");
 SYSCTL_INT(_dev_netmap, OID_AUTO, flags, CTLFLAG_RW, &netmap_flags, 0 , "");
 SYSCTL_INT(_dev_netmap, OID_AUTO, fwd, CTLFLAG_RW, &netmap_fwd, 0 , "");
+SYSCTL_INT(_dev_netmap, OID_AUTO, mmap_unreg, CTLFLAG_RW, &netmap_mmap_unreg, 0, "");
+
+NMG_LOCK_T	netmap_global_lock;
+
+/*
+ * protect against multiple threads using the same ring.
+ * also check that the ring has not been stopped.
+ */
+#define NM_KR_BUSY	1
+#define NM_KR_STOPPED	2
+static void nm_kr_put(struct netmap_kring *kr);
+static __inline int nm_kr_tryget(struct netmap_kring *kr)
+{
+	/* check a first time without taking the lock 
+	 * to avoid starvation for nm_kr_get()
+	 */
+	if (unlikely(kr->nkr_stopped)) {
+		ND("ring %p stopped (%d)", kr, kr->nkr_stopped);
+		return NM_KR_STOPPED;
+	}
+	if (unlikely(NM_ATOMIC_TEST_AND_SET(&kr->nr_busy)))
+		return NM_KR_BUSY;
+	/* check a second time with lock held */
+	if (unlikely(kr->nkr_stopped)) {
+		ND("ring %p stopped (%d)", kr, kr->nkr_stopped);
+		nm_kr_put(kr);
+		return NM_KR_STOPPED;
+	}
+	return 0;
+}
+
+static __inline void nm_kr_put(struct netmap_kring *kr)
+{
+	NM_ATOMIC_CLEAR(&kr->nr_busy);
+}
+
+static void nm_kr_get(struct netmap_kring *kr)
+{
+	while (NM_ATOMIC_TEST_AND_SET(&kr->nr_busy))
+		tsleep(kr, 0, "NM_KR_GET", 4);
+}
+
+static void nm_disable_ring(struct netmap_kring *kr)
+{
+	kr->nkr_stopped = 1;
+	nm_kr_get(kr);
+	mtx_lock(&kr->q_lock);
+	mtx_unlock(&kr->q_lock);
+	nm_kr_put(kr);
+}
+
+void netmap_disable_all_rings(struct ifnet *ifp)
+{
+	struct netmap_adapter *na;
+	int i;
+
+	if (!(ifp->if_capenable & IFCAP_NETMAP))
+		return;
+
+	na = NA(ifp);
+
+	for (i = 0; i < na->num_tx_rings + 1; i++) {
+		nm_disable_ring(na->tx_rings + i);
+		selwakeuppri(&na->tx_rings[i].si, PI_NET);
+	}
+	for (i = 0; i < na->num_rx_rings + 1; i++) {
+		nm_disable_ring(na->rx_rings + i);
+		selwakeuppri(&na->rx_rings[i].si, PI_NET);
+	}
+	selwakeuppri(&na->tx_si, PI_NET);
+	selwakeuppri(&na->rx_si, PI_NET);
+}
+
+void netmap_enable_all_rings(struct ifnet *ifp)
+{
+	struct netmap_adapter *na;
+	int i;
+
+	if (!(ifp->if_capenable & IFCAP_NETMAP))
+		return;
+
+	na = NA(ifp);
+	for (i = 0; i < na->num_tx_rings + 1; i++) {
+		D("enabling %p", na->tx_rings + i);
+		na->tx_rings[i].nkr_stopped = 0;
+	}
+	for (i = 0; i < na->num_rx_rings + 1; i++) {
+		D("enabling %p", na->rx_rings + i);
+		na->rx_rings[i].nkr_stopped = 0;
+	}
+}
 
-#ifdef NM_BRIDGE /* support for netmap bridge */
 
 /*
- * system parameters.
+ * generic bound_checking function
+ */
+u_int
+nm_bound_var(u_int *v, u_int dflt, u_int lo, u_int hi, const char *msg)
+{
+	u_int oldv = *v;
+	const char *op = NULL;
+
+	if (dflt < lo)
+		dflt = lo;
+	if (dflt > hi)
+		dflt = hi;
+	if (oldv < lo) {
+		*v = dflt;
+		op = "Bump";
+	} else if (oldv > hi) {
+		*v = hi;
+		op = "Clamp";
+	}
+	if (op && msg)
+		printf("%s %s to %d (was %d)\n", op, msg, *v, oldv);
+	return *v;
+}
+
+/*
+ * packet-dump function, user-supplied or static buffer.
+ * The destination buffer must be at least 30+4*len
+ */
+const char *
+nm_dump_buf(char *p, int len, int lim, char *dst)
+{
+	static char _dst[8192];
+        int i, j, i0;
+	static char hex[] ="0123456789abcdef";
+	char *o;	/* output position */
+
+#define P_HI(x)	hex[((x) & 0xf0)>>4]
+#define P_LO(x)	hex[((x) & 0xf)]
+#define P_C(x)	((x) >= 0x20 && (x) <= 0x7e ? (x) : '.')
+	if (!dst)
+		dst = _dst;
+	if (lim <= 0 || lim > len)
+		lim = len;
+	o = dst;
+	sprintf(o, "buf 0x%p len %d lim %d\n", p, len, lim);
+	o += strlen(o);
+	/* hexdump routine */
+	for (i = 0; i < lim; ) {
+		sprintf(o, "%5d: ", i);
+		o += strlen(o);
+		memset(o, ' ', 48);
+		i0 = i;
+		for (j=0; j < 16 && i < lim; i++, j++) {
+			o[j*3] = P_HI(p[i]);
+			o[j*3+1] = P_LO(p[i]);
+		}
+		i = i0;
+		for (j=0; j < 16 && i < lim; i++, j++)
+			o[j + 48] = P_C(p[i]);
+		o[j+48] = '\n';
+		o += j+49;
+	}
+	*o = '\0';
+#undef P_HI
+#undef P_LO
+#undef P_C
+	return dst;
+}
+
+/*
+ * system parameters (most of them in netmap_kern.h)
+ * NM_NAME	prefix for switch port names, default "vale"
+ * NM_BDG_MAXPORTS	number of ports
+ * NM_BRIDGES	max number of switches in the system.
+ *	XXX should become a sysctl or tunable
+ *
+ * Switch ports are named valeX:Y where X is the switch name and Y
+ * is the port. If Y matches a physical interface name, the port is
+ * connected to a physical device.
  *
- * All switched ports have prefix NM_NAME.
- * The switch has a max of NM_BDG_MAXPORTS ports (often stored in a bitmap,
- * so a practical upper bound is 64).
- * Each tx ring is read-write, whereas rx rings are readonly (XXX not done yet).
+ * Unlike physical interfaces, switch ports use their own memory region
+ * for rings and buffers.
  * The virtual interfaces use per-queue lock instead of core lock.
  * In the tx loop, we aggregate traffic in batches to make all operations
- * faster. The batch size is NM_BDG_BATCH
+ * faster. The batch size is bridge_batch.
  */
-#define	NM_NAME			"vale"	/* prefix for the interface */
-#define NM_BDG_MAXPORTS		16	/* up to 64 ? */
+#define NM_BDG_MAXRINGS		16	/* XXX unclear how many. */
+#define NM_BDG_MAXSLOTS		4096	/* XXX same as above */
 #define NM_BRIDGE_RINGSIZE	1024	/* in the device */
 #define NM_BDG_HASH		1024	/* forwarding table entries */
 #define NM_BDG_BATCH		1024	/* entries in the forwarding buffer */
-#define	NM_BRIDGES		4	/* number of bridges */
-
-
-int netmap_bridge = NM_BDG_BATCH; /* bridge batch size */
-SYSCTL_INT(_dev_netmap, OID_AUTO, bridge, CTLFLAG_RW, &netmap_bridge, 0 , "");
-
-#ifdef linux
-
-#define	refcount_acquire(_a)	atomic_add(1, (atomic_t *)_a)
-#define	refcount_release(_a)	atomic_dec_and_test((atomic_t *)_a)
+#define NM_MULTISEG		64	/* max size of a chain of bufs */
+/* actual size of the tables */
+#define NM_BDG_BATCH_MAX	(NM_BDG_BATCH + NM_MULTISEG)
+/* NM_FT_NULL terminates a list of slots in the ft */
+#define NM_FT_NULL		NM_BDG_BATCH_MAX
+#define	NM_BRIDGES		8	/* number of bridges */
 
-#else /* !linux */
 
-#ifdef __FreeBSD__
-#include <sys/endian.h>
-#include <sys/refcount.h>
-#endif /* __FreeBSD__ */
-
-#define prefetch(x)	__builtin_prefetch(x)
+/*
+ * bridge_batch is set via sysctl to the max batch size to be
+ * used in the bridge. The actual value may be larger as the
+ * last packet in the block may overflow the size.
+ */
+int bridge_batch = NM_BDG_BATCH; /* bridge batch size */
+SYSCTL_INT(_dev_netmap, OID_AUTO, bridge_batch, CTLFLAG_RW, &bridge_batch, 0 , "");
 
-#endif /* !linux */
 
 /*
  * These are used to handle reference counters for bridge ports.
@@ -174,63 +522,165 @@ SYSCTL_INT(_dev_netmap, OID_AUTO, bridge, CTLFLAG_RW, &netmap_bridge, 0 , "");
 #define	ADD_BDG_REF(ifp)	refcount_acquire(&NA(ifp)->na_bdg_refcount)
 #define	DROP_BDG_REF(ifp)	refcount_release(&NA(ifp)->na_bdg_refcount)
 
-static void bdg_netmap_attach(struct ifnet *ifp);
+/* The bridge references the buffers using the device specific look up table */
+static inline void *
+BDG_NMB(struct netmap_mem_d *nmd, struct netmap_slot *slot)
+{
+	struct lut_entry *lut = nmd->pools[NETMAP_BUF_POOL].lut;
+	uint32_t i = slot->buf_idx;
+	return (unlikely(i >= nmd->pools[NETMAP_BUF_POOL].objtotal)) ?  lut[0].vaddr : lut[i].vaddr;
+}
+
+static int bdg_netmap_attach(struct netmap_adapter *);
 static int bdg_netmap_reg(struct ifnet *ifp, int onoff);
-/* per-tx-queue entry */
+int kern_netmap_regif(struct nmreq *nmr);
+
+/*
+ * Each transmit queue accumulates a batch of packets into
+ * a structure before forwarding. Packets to the same
+ * destination are put in a list using ft_next as a link field.
+ * ft_frags and ft_next are valid only on the first fragment.
+ */
 struct nm_bdg_fwd {	/* forwarding entry for a bridge */
-	void *buf;
-	uint64_t dst;	/* dst mask */
-	uint32_t src;	/* src index ? */
-	uint16_t len;	/* src len */
+	void *ft_buf;		/* netmap or indirect buffer */
+	uint8_t ft_frags;	/* how many fragments (only on 1st frag) */
+	uint8_t _ft_port;	/* dst port (unused) */
+	uint16_t ft_flags;	/* flags, e.g. indirect */
+	uint16_t ft_len;	/* src fragment len */
+	uint16_t ft_next;	/* next packet to same destination */
 };
 
+/*
+ * For each output interface, nm_bdg_q is used to construct a list.
+ * bq_len is the number of output buffers (we can have coalescing
+ * during the copy).
+ */
+struct nm_bdg_q {
+	uint16_t bq_head;
+	uint16_t bq_tail;
+	uint32_t bq_len;	/* number of buffers */
+};
+
+/* XXX revise this */
 struct nm_hash_ent {
 	uint64_t	mac;	/* the top 2 bytes are the epoch */
 	uint64_t	ports;
 };
 
 /*
+ * nm_bridge is a descriptor for a VALE switch.
  * Interfaces for a bridge are all in bdg_ports[].
  * The array has fixed size, an empty entry does not terminate
- * the search. But lookups only occur on attach/detach so we
+ * the search, but lookups only occur on attach/detach so we
  * don't mind if they are slow.
  *
- * The bridge is non blocking on the transmit ports.
+ * The bridge is non blocking on the transmit ports: excess
+ * packets are dropped if there is no room on the output port.
  *
  * bdg_lock protects accesses to the bdg_ports array.
+ * This is a rw lock (or equivalent).
  */
 struct nm_bridge {
-	struct ifnet *bdg_ports[NM_BDG_MAXPORTS];
-	int n_ports;
-	uint64_t act_ports;
-	int freelist;	/* first buffer index */
-	NM_SELINFO_T si;	/* poll/select wait queue */
-	NM_LOCK_T bdg_lock;	/* protect the selinfo ? */
+	/* XXX what is the proper alignment/layout ? */
+	BDG_RWLOCK_T	bdg_lock;	/* protects bdg_ports */
+	int		bdg_namelen;
+	uint32_t	bdg_active_ports; /* 0 means free */
+	char		bdg_basename[IFNAMSIZ];
 
-	/* the forwarding table, MAC+ports */
-	struct nm_hash_ent ht[NM_BDG_HASH];
+	/* Indexes of active ports (up to active_ports)
+	 * and all other remaining ports.
+	 */
+	uint8_t		bdg_port_index[NM_BDG_MAXPORTS];
+
+	struct netmap_adapter *bdg_ports[NM_BDG_MAXPORTS];
 
-	int namelen;	/* 0 means free */
-	char basename[IFNAMSIZ];
+
+	/*
+	 * The function to decide the destination port.
+	 * It returns either of an index of the destination port,
+	 * NM_BDG_BROADCAST to broadcast this packet, or NM_BDG_NOPORT not to
+	 * forward this packet.  ring_nr is the source ring index, and the
+	 * function may overwrite this value to forward this packet to a
+	 * different ring index.
+	 * This function must be set by netmap_bdgctl().
+	 */
+	bdg_lookup_fn_t nm_bdg_lookup;
+
+	/* the forwarding table, MAC+ports.
+	 * XXX should be changed to an argument to be passed to
+	 * the lookup function, and allocated on attach
+	 */
+	struct nm_hash_ent ht[NM_BDG_HASH];
 };
 
+
+/*
+ * XXX in principle nm_bridges could be created dynamically
+ * Right now we have a static array and deletions are protected
+ * by an exclusive lock.
+ */
 struct nm_bridge nm_bridges[NM_BRIDGES];
 
-#define BDG_LOCK(b)	mtx_lock(&(b)->bdg_lock)
-#define BDG_UNLOCK(b)	mtx_unlock(&(b)->bdg_lock)
+
+/*
+ * A few function to tell which kind of port are we using.
+ * XXX should we hold a lock ?
+ *
+ * nma_is_vp()		virtual port
+ * nma_is_host()	port connected to the host stack
+ * nma_is_hw()		port connected to a NIC
+ */
+int nma_is_vp(struct netmap_adapter *na);
+int
+nma_is_vp(struct netmap_adapter *na)
+{
+	return na->nm_register == bdg_netmap_reg;
+}
+
+static __inline int
+nma_is_host(struct netmap_adapter *na)
+{
+	return na->nm_register == NULL;
+}
+
+static __inline int
+nma_is_hw(struct netmap_adapter *na)
+{
+	/* In case of sw adapter, nm_register is NULL */
+	return !nma_is_vp(na) && !nma_is_host(na);
+}
+
+
+/*
+ * If the NIC is owned by the kernel
+ * (i.e., bridge), neither another bridge nor user can use it;
+ * if the NIC is owned by a user, only users can share it.
+ * Evaluation must be done under NMG_LOCK().
+ */
+#define NETMAP_OWNED_BY_KERN(ifp)	(!nma_is_vp(NA(ifp)) && NA(ifp)->na_bdg)
+#define NETMAP_OWNED_BY_ANY(ifp) \
+	(NETMAP_OWNED_BY_KERN(ifp) || (NA(ifp)->refcount > 0))
 
 /*
  * NA(ifp)->bdg_port	port index
  */
 
-// XXX only for multiples of 64 bytes, non overlapped.
+
+/*
+ * this is a slightly optimized copy routine which rounds
+ * to multiple of 64 bytes and is often faster than dealing
+ * with other odd sizes. We assume there is enough room
+ * in the source and destination buffers.
+ *
+ * XXX only for multiples of 64 bytes, non overlapped.
+ */
 static inline void
 pkt_copy(void *_src, void *_dst, int l)
 {
         uint64_t *src = _src;
         uint64_t *dst = _dst;
         if (unlikely(l >= 1024)) {
-                bcopy(src, dst, l);
+                memcpy(dst, src, l);
                 return;
         }
         for (; likely(l > 0); l-=64) {
@@ -245,19 +695,28 @@ pkt_copy(void *_src, void *_dst, int l)
         }
 }
 
+
 /*
  * locate a bridge among the existing ones.
+ * MUST BE CALLED WITH NMG_LOCK()
+ *
  * a ':' in the name terminates the bridge name. Otherwise, just NM_NAME.
  * We assume that this is called with a name of at least NM_NAME chars.
  */
 static struct nm_bridge *
-nm_find_bridge(const char *name)
+nm_find_bridge(const char *name, int create)
 {
-	int i, l, namelen, e;
+	int i, l, namelen;
 	struct nm_bridge *b = NULL;
 
+	NMG_LOCK_ASSERT();
+
 	namelen = strlen(NM_NAME);	/* base length */
-	l = strlen(name);		/* actual length */
+	l = name ? strlen(name) : 0;		/* actual length */
+	if (l < namelen) {
+		D("invalid bridge name %s", name ? name : NULL);
+		return NULL;
+	}
 	for (i = namelen + 1; i < l; i++) {
 		if (name[i] == ':') {
 			namelen = i;
@@ -268,30 +727,101 @@ nm_find_bridge(const char *name)
 		namelen = IFNAMSIZ;
 	ND("--- prefix is '%.*s' ---", namelen, name);
 
-	/* use the first entry for locking */
-	BDG_LOCK(nm_bridges); // XXX do better
-	for (e = -1, i = 1; i < NM_BRIDGES; i++) {
-		b = nm_bridges + i;
-		if (b->namelen == 0)
-			e = i;	/* record empty slot */
-		else if (strncmp(name, b->basename, namelen) == 0) {
+	/* lookup the name, remember empty slot if there is one */
+	for (i = 0; i < NM_BRIDGES; i++) {
+		struct nm_bridge *x = nm_bridges + i;
+
+		if (x->bdg_active_ports == 0) {
+			if (create && b == NULL)
+				b = x;	/* record empty slot */
+		} else if (x->bdg_namelen != namelen) {
+			continue;
+		} else if (strncmp(name, x->bdg_basename, namelen) == 0) {
 			ND("found '%.*s' at %d", namelen, name, i);
+			b = x;
 			break;
 		}
 	}
-	if (i == NM_BRIDGES) { /* all full */
-		if (e == -1) { /* no empty slot */
-			b = NULL;
-		} else {
-			b = nm_bridges + e;
-			strncpy(b->basename, name, namelen);
-			b->namelen = namelen;
-		}
+	if (i == NM_BRIDGES && b) { /* name not found, can create entry */
+		/* initialize the bridge */
+		strncpy(b->bdg_basename, name, namelen);
+		ND("create new bridge %s with ports %d", b->bdg_basename,
+			b->bdg_active_ports);
+		b->bdg_namelen = namelen;
+		b->bdg_active_ports = 0;
+		for (i = 0; i < NM_BDG_MAXPORTS; i++)
+			b->bdg_port_index[i] = i;
+		/* set the default function */
+		b->nm_bdg_lookup = netmap_bdg_learning;
+		/* reset the MAC address table */
+		bzero(b->ht, sizeof(struct nm_hash_ent) * NM_BDG_HASH);
 	}
-	BDG_UNLOCK(nm_bridges);
 	return b;
 }
-#endif /* NM_BRIDGE */
+
+
+/*
+ * Free the forwarding tables for rings attached to switch ports.
+ */
+static void
+nm_free_bdgfwd(struct netmap_adapter *na)
+{
+	int nrings, i;
+	struct netmap_kring *kring;
+
+	NMG_LOCK_ASSERT();
+	nrings = nma_is_vp(na) ? na->num_tx_rings : na->num_rx_rings;
+	kring = nma_is_vp(na) ? na->tx_rings : na->rx_rings;
+	for (i = 0; i < nrings; i++) {
+		if (kring[i].nkr_ft) {
+			free(kring[i].nkr_ft, M_DEVBUF);
+			kring[i].nkr_ft = NULL; /* protect from freeing twice */
+		}
+	}
+	if (nma_is_hw(na))
+		nm_free_bdgfwd(SWNA(na->ifp));
+}
+
+
+/*
+ * Allocate the forwarding tables for the rings attached to the bridge ports.
+ */
+static int
+nm_alloc_bdgfwd(struct netmap_adapter *na)
+{
+	int nrings, l, i, num_dstq;
+	struct netmap_kring *kring;
+
+	NMG_LOCK_ASSERT();
+	/* all port:rings + broadcast */
+	num_dstq = NM_BDG_MAXPORTS * NM_BDG_MAXRINGS + 1;
+	l = sizeof(struct nm_bdg_fwd) * NM_BDG_BATCH_MAX;
+	l += sizeof(struct nm_bdg_q) * num_dstq;
+	l += sizeof(uint16_t) * NM_BDG_BATCH_MAX;
+
+	nrings = nma_is_vp(na) ? na->num_tx_rings : na->num_rx_rings;
+	kring = nma_is_vp(na) ? na->tx_rings : na->rx_rings;
+	for (i = 0; i < nrings; i++) {
+		struct nm_bdg_fwd *ft;
+		struct nm_bdg_q *dstq;
+		int j;
+
+		ft = malloc(l, M_DEVBUF, M_NOWAIT | M_ZERO);
+		if (!ft) {
+			nm_free_bdgfwd(na);
+			return ENOMEM;
+		}
+		dstq = (struct nm_bdg_q *)(ft + NM_BDG_BATCH_MAX);
+		for (j = 0; j < num_dstq; j++) {
+			dstq[j].bq_head = dstq[j].bq_tail = NM_FT_NULL;
+			dstq[j].bq_len = 0;
+		}
+		kring[i].nkr_ft = ft;
+	}
+	if (nma_is_hw(na))
+		nm_alloc_bdgfwd(SWNA(na->ifp));
+	return 0;
+}
 
 
 /*
@@ -338,9 +868,15 @@ netmap_update_config(struct netmap_adapter *na)
 	return 1;
 }
 
-/*------------- memory allocator -----------------*/
-#include "netmap_mem2.c"
-/*------------ end of memory allocator ----------*/
+static struct netmap_if *
+netmap_if_new(const char *ifname, struct netmap_adapter *na)
+{
+	if (netmap_update_config(na)) {
+		/* configuration mismatch, report and fail */
+		return NULL;
+	}
+	return netmap_mem_if_new(ifname, na);
+}
 
 
 /* Structure associated to each thread which registered an interface.
@@ -366,270 +902,434 @@ netmap_update_config(struct netmap_adapter *na)
  * private structure is destroyed.
  */
 struct netmap_priv_d {
-	struct netmap_if * volatile np_nifp;	/* netmap interface descriptor. */
+	struct netmap_if * volatile np_nifp;	/* netmap if descriptor. */
 
-	struct ifnet	*np_ifp;	/* device for which we hold a reference */
+	struct ifnet	*np_ifp;	/* device for which we hold a ref. */
 	int		np_ringid;	/* from the ioctl */
 	u_int		np_qfirst, np_qlast;	/* range of rings to scan */
 	uint16_t	np_txpoll;
 
-	unsigned long	ref_done;	/* use with NMA_LOCK held */
+	struct netmap_mem_d *np_mref;	/* use with NMG_LOCK held */
+#ifdef __FreeBSD__
+	int		np_refcount;	/* use with NMG_LOCK held */
+#endif /* __FreeBSD__ */
 };
 
-
+/* grab a reference to the memory allocator, if we don't have one already.  The
+ * reference is taken from the netmap_adapter registered with the priv.
+ *
+ */
 static int
-netmap_get_memory(struct netmap_priv_d* p)
+netmap_get_memory_locked(struct netmap_priv_d* p)
 {
+	struct netmap_mem_d *nmd;
 	int error = 0;
-	NMA_LOCK();
-	if (!p->ref_done) {
-		error = netmap_memory_finalize();
+
+	if (p->np_ifp == NULL) {
+		if (!netmap_mmap_unreg)
+			return ENODEV;
+		/* for compatibility with older versions of the API
+ 		 * we use the global allocator when no interface has been
+ 		 * registered
+ 		 */
+		nmd = &nm_mem;
+	} else {
+		nmd = NA(p->np_ifp)->nm_mem;
+	}
+	if (p->np_mref == NULL) {
+		error = netmap_mem_finalize(nmd);
 		if (!error)
-			p->ref_done = 1;
+			p->np_mref = nmd;
+	} else if (p->np_mref != nmd) {
+		/* a virtual port has been registered, but previous
+ 		 * syscalls already used the global allocator.
+ 		 * We cannot continue
+ 		 */
+		error = ENODEV;
 	}
-	NMA_UNLOCK();
 	return error;
 }
 
+static int
+netmap_get_memory(struct netmap_priv_d* p)
+{
+	int error;
+	NMG_LOCK();
+	error = netmap_get_memory_locked(p);
+	NMG_UNLOCK();
+	return error;
+}
+
+static int
+netmap_have_memory_locked(struct netmap_priv_d* p)
+{
+	return p->np_mref != NULL;
+}
+
+static void
+netmap_drop_memory_locked(struct netmap_priv_d* p)
+{
+	if (p->np_mref) {
+		netmap_mem_deref(p->np_mref);
+		p->np_mref = NULL;
+	}
+}
+
 /*
  * File descriptor's private data destructor.
  *
  * Call nm_register(ifp,0) to stop netmap mode on the interface and
  * revert to normal operation. We expect that np_ifp has not gone.
+ * The second argument is the nifp to work on. In some cases it is
+ * not attached yet to the netmap_priv_d so we need to pass it as
+ * a separate argument.
  */
-/* call with NMA_LOCK held */
+/* call with NMG_LOCK held */
 static void
-netmap_dtor_locked(void *data)
+netmap_do_unregif(struct netmap_priv_d *priv, struct netmap_if *nifp)
 {
-	struct netmap_priv_d *priv = data;
 	struct ifnet *ifp = priv->np_ifp;
 	struct netmap_adapter *na = NA(ifp);
-	struct netmap_if *nifp = priv->np_nifp;
 
+	NMG_LOCK_ASSERT();
 	na->refcount--;
 	if (na->refcount <= 0) {	/* last instance */
-		u_int i, j, lim;
+		u_int i;
 
 		if (netmap_verbose)
 			D("deleting last instance for %s", ifp->if_xname);
 		/*
-		 * there is a race here with *_netmap_task() and
-		 * netmap_poll(), which don't run under NETMAP_REG_LOCK.
-		 * na->refcount == 0 && na->ifp->if_capenable & IFCAP_NETMAP
-		 * (aka NETMAP_DELETING(na)) are a unique marker that the
-		 * device is dying.
-		 * Before destroying stuff we sleep a bit, and then complete
-		 * the job. NIOCREG should realize the condition and
-		 * loop until they can continue; the other routines
-		 * should check the condition at entry and quit if
-		 * they cannot run.
+		 * (TO CHECK) This function is only called
+		 * when the last reference to this file descriptor goes
+		 * away. This means we cannot have any pending poll()
+		 * or interrupt routine operating on the structure.
+		 * XXX The file may be closed in a thread while
+		 * another thread is using it.
+		 * Linux keeps the file opened until the last reference
+		 * by any outstanding ioctl/poll or mmap is gone.
+		 * FreeBSD does not track mmap()s (but we do) and
+		 * wakes up any sleeping poll(). Need to check what
+		 * happens if the close() occurs while a concurrent
+		 * syscall is running.
 		 */
-		na->nm_lock(ifp, NETMAP_REG_UNLOCK, 0);
-		tsleep(na, 0, "NIOCUNREG", 4);
-		na->nm_lock(ifp, NETMAP_REG_LOCK, 0);
 		na->nm_register(ifp, 0); /* off, clear IFCAP_NETMAP */
 		/* Wake up any sleeping threads. netmap_poll will
 		 * then return POLLERR
+		 * XXX The wake up now must happen during *_down(), when
+		 * we order all activities to stop. -gl
 		 */
-		for (i = 0; i < na->num_tx_rings + 1; i++)
-			selwakeuppri(&na->tx_rings[i].si, PI_NET);
-		for (i = 0; i < na->num_rx_rings + 1; i++)
-			selwakeuppri(&na->rx_rings[i].si, PI_NET);
-		selwakeuppri(&na->tx_si, PI_NET);
-		selwakeuppri(&na->rx_si, PI_NET);
-		/* release all buffers */
+		nm_free_bdgfwd(na);
 		for (i = 0; i < na->num_tx_rings + 1; i++) {
-			struct netmap_ring *ring = na->tx_rings[i].ring;
-			lim = na->tx_rings[i].nkr_num_slots;
-			for (j = 0; j < lim; j++)
-				netmap_free_buf(nifp, ring->slot[j].buf_idx);
-			/* knlist_destroy(&na->tx_rings[i].si.si_note); */
 			mtx_destroy(&na->tx_rings[i].q_lock);
 		}
 		for (i = 0; i < na->num_rx_rings + 1; i++) {
-			struct netmap_ring *ring = na->rx_rings[i].ring;
-			lim = na->rx_rings[i].nkr_num_slots;
-			for (j = 0; j < lim; j++)
-				netmap_free_buf(nifp, ring->slot[j].buf_idx);
-			/* knlist_destroy(&na->rx_rings[i].si.si_note); */
 			mtx_destroy(&na->rx_rings[i].q_lock);
 		}
 		/* XXX kqueue(9) needed; these will mirror knlist_init. */
 		/* knlist_destroy(&na->tx_si.si_note); */
 		/* knlist_destroy(&na->rx_si.si_note); */
-		netmap_free_rings(na);
-		wakeup(na);
+		if (nma_is_hw(na))
+			SWNA(ifp)->tx_rings = SWNA(ifp)->rx_rings = NULL;
 	}
-	netmap_if_free(nifp);
+	/*
+	 * netmap_mem_if_delete() deletes the nifp, and if this is
+	 * the last instance also buffers, rings and krings.
+	 */
+	netmap_mem_if_delete(na, nifp);
 }
 
+
+/* we assume netmap adapter exists
+ * Called with NMG_LOCK held
+ */
 static void
 nm_if_rele(struct ifnet *ifp)
 {
-#ifndef NM_BRIDGE
-	if_rele(ifp);
-#else /* NM_BRIDGE */
-	int i, full;
+	int i, is_hw, hw, sw, lim;
 	struct nm_bridge *b;
+	struct netmap_adapter *na;
+	uint8_t tmp[NM_BDG_MAXPORTS];
 
-	if (strncmp(ifp->if_xname, NM_NAME, sizeof(NM_NAME) - 1)) {
+	NMG_LOCK_ASSERT();
+	/* I can be called not only for get_ifp()-ed references where netmap's
+	 * capability is guaranteed, but also for non-netmap-capable NICs.
+	 */
+	if (!NETMAP_CAPABLE(ifp) || !NA(ifp)->na_bdg) {
 		if_rele(ifp);
 		return;
 	}
+	na = NA(ifp);
+	b = na->na_bdg;
+	is_hw = nma_is_hw(na);
+
+	ND("%s has %d references", ifp->if_xname, NA(ifp)->na_bdg_refcount);
+
 	if (!DROP_BDG_REF(ifp))
 		return;
-	b = ifp->if_bridge;
-	BDG_LOCK(nm_bridges);
-	BDG_LOCK(b);
-	ND("want to disconnect %s from the bridge", ifp->if_xname);
-	full = 0;
-	for (i = 0; i < NM_BDG_MAXPORTS; i++) {
-		if (b->bdg_ports[i] == ifp) {
-			b->bdg_ports[i] = NULL;
-			bzero(ifp, sizeof(*ifp));
-			free(ifp, M_DEVBUF);
-			break;
+
+	/*
+	New algorithm:
+	make a copy of bdg_port_index;
+	lookup NA(ifp)->bdg_port and SWNA(ifp)->bdg_port
+	in the array of bdg_port_index, replacing them with
+	entries from the bottom of the array;
+	decrement bdg_active_ports;
+	acquire BDG_WLOCK() and copy back the array.
+	 */
+	
+	hw = NA(ifp)->bdg_port;
+	sw = (is_hw && SWNA(ifp)->na_bdg) ? SWNA(ifp)->bdg_port : -1;
+	lim = b->bdg_active_ports;
+
+	ND("detach %d and %d (lim %d)", hw, sw, lim);
+	/* make a copy of the list of active ports, update it,
+	 * and then copy back within BDG_WLOCK().
+	 */
+	memcpy(tmp, b->bdg_port_index, sizeof(tmp));
+	for (i = 0; (hw >= 0 || sw >= 0) && i < lim; ) {
+		if (hw >= 0 && tmp[i] == hw) {
+			ND("detach hw %d at %d", hw, i);
+			lim--; /* point to last active port */
+			tmp[i] = tmp[lim]; /* swap with i */
+			tmp[lim] = hw;	/* now this is inactive */
+			hw = -1;
+		} else if (sw >= 0 && tmp[i] == sw) {
+			ND("detach sw %d at %d", sw, i);
+			lim--;
+			tmp[i] = tmp[lim];
+			tmp[lim] = sw;
+			sw = -1;
+		} else {
+			i++;
 		}
-		else if (b->bdg_ports[i] != NULL)
-			full = 1;
 	}
-	BDG_UNLOCK(b);
-	if (full == 0) {
-		ND("freeing bridge %d", b - nm_bridges);
-		b->namelen = 0;
+	if (hw >= 0 || sw >= 0) {
+		D("XXX delete failed hw %d sw %d, should panic...", hw, sw);
+	}
+	hw = NA(ifp)->bdg_port;
+	sw = (is_hw && SWNA(ifp)->na_bdg) ?  SWNA(ifp)->bdg_port : -1;
+
+	BDG_WLOCK(b);
+	b->bdg_ports[hw] = NULL;
+	na->na_bdg = NULL;
+	if (sw >= 0) {
+		b->bdg_ports[sw] = NULL;
+		SWNA(ifp)->na_bdg = NULL;
+	}
+	memcpy(b->bdg_port_index, tmp, sizeof(tmp));
+	b->bdg_active_ports = lim;
+	BDG_WUNLOCK(b);
+
+	ND("now %d active ports", lim);
+	if (lim == 0) {
+		ND("marking bridge %s as free", b->bdg_basename);
+		b->nm_bdg_lookup = NULL;
+	}
+
+	if (is_hw) {
+		if_rele(ifp);
+	} else {
+		if (na->na_flags & NAF_MEM_OWNER)
+			netmap_mem_private_delete(na->nm_mem);
+		bzero(na, sizeof(*na));
+		free(na, M_DEVBUF);
+		bzero(ifp, sizeof(*ifp));
+		free(ifp, M_DEVBUF);
 	}
-	BDG_UNLOCK(nm_bridges);
-	if (i == NM_BDG_MAXPORTS)
-		D("ouch, cannot find ifp to remove");
-#endif /* NM_BRIDGE */
 }
 
-static void
-netmap_dtor(void *data)
+
+/*
+ * returns 1 if this is the last instance and we can free priv
+ */
+static int
+netmap_dtor_locked(struct netmap_priv_d *priv)
 {
-	struct netmap_priv_d *priv = data;
 	struct ifnet *ifp = priv->np_ifp;
 
-	NMA_LOCK();
+#ifdef __FreeBSD__
+	/*
+	 * np_refcount is the number of active mmaps on
+	 * this file descriptor
+	 */
+	if (--priv->np_refcount > 0) {
+		return 0;
+	}
+#endif /* __FreeBSD__ */
+	if (ifp) {
+		netmap_do_unregif(priv, priv->np_nifp);
+	}
+	netmap_drop_memory_locked(priv);
 	if (ifp) {
-		struct netmap_adapter *na = NA(ifp);
-
-		na->nm_lock(ifp, NETMAP_REG_LOCK, 0);
-		netmap_dtor_locked(data);
-		na->nm_lock(ifp, NETMAP_REG_UNLOCK, 0);
-
 		nm_if_rele(ifp); /* might also destroy *na */
 	}
-	if (priv->ref_done) {
-		netmap_memory_deref();
+	return 1;
+}
+
+static void
+netmap_dtor(void *data)
+{
+	struct netmap_priv_d *priv = data;
+	int last_instance;
+
+	NMG_LOCK();
+	last_instance = netmap_dtor_locked(priv);
+	NMG_UNLOCK();
+	if (last_instance) {
+		bzero(priv, sizeof(*priv));	/* for safety */
+		free(priv, M_DEVBUF);
 	}
-	NMA_UNLOCK();
-	bzero(priv, sizeof(*priv));	/* XXX for safety */
-	free(priv, M_DEVBUF);
 }
 
+
 #ifdef __FreeBSD__
-#include <vm/vm.h>
-#include <vm/vm_param.h>
-#include <vm/vm_object.h>
-#include <vm/vm_page.h>
-#include <vm/vm_pager.h>
-#include <vm/uma.h>
 
-static struct cdev_pager_ops saved_cdev_pager_ops;
+/*
+ * In order to track whether pages are still mapped, we hook into
+ * the standard cdev_pager and intercept the constructor and
+ * destructor.
+ */
+
+struct netmap_vm_handle_t {
+	struct cdev 		*dev;
+	struct netmap_priv_d	*priv;
+};
 
 static int
 netmap_dev_pager_ctor(void *handle, vm_ooffset_t size, vm_prot_t prot,
     vm_ooffset_t foff, struct ucred *cred, u_short *color)
 {
-	if (netmap_verbose)
-		D("first mmap for %p", handle);
-	return saved_cdev_pager_ops.cdev_pg_ctor(handle,
-			size, prot, foff, cred, color);
+	struct netmap_vm_handle_t *vmh = handle;
+	D("handle %p size %jd prot %d foff %jd",
+		handle, (intmax_t)size, prot, (intmax_t)foff);
+	dev_ref(vmh->dev);	
+	return 0;	
 }
 
+
 static void
 netmap_dev_pager_dtor(void *handle)
 {
-	saved_cdev_pager_ops.cdev_pg_dtor(handle);
-	ND("ready to release memory for %p", handle);
+	struct netmap_vm_handle_t *vmh = handle;
+	struct cdev *dev = vmh->dev;
+	struct netmap_priv_d *priv = vmh->priv;
+	D("handle %p", handle);
+	netmap_dtor(priv);
+	free(vmh, M_DEVBUF);
+	dev_rel(dev);
+}
+
+static int
+netmap_dev_pager_fault(vm_object_t object, vm_ooffset_t offset,
+	int prot, vm_page_t *mres)
+{
+	struct netmap_vm_handle_t *vmh = object->handle;
+	struct netmap_priv_d *priv = vmh->priv;
+	vm_paddr_t paddr;
+	vm_page_t page;
+	vm_memattr_t memattr;
+	vm_pindex_t pidx;
+
+	ND("object %p offset %jd prot %d mres %p",
+			object, (intmax_t)offset, prot, mres);
+	memattr = object->memattr;
+	pidx = OFF_TO_IDX(offset);
+	paddr = netmap_mem_ofstophys(priv->np_mref, offset);
+	if (paddr == 0)
+		return VM_PAGER_FAIL;
+
+	if (((*mres)->flags & PG_FICTITIOUS) != 0) {
+		/*
+		 * If the passed in result page is a fake page, update it with
+		 * the new physical address.
+		 */
+		page = *mres;
+		vm_page_updatefake(page, paddr, memattr);
+	} else {
+		/*
+		 * Replace the passed in reqpage page with our own fake page and
+		 * free up the all of the original pages.
+		 */
+#ifndef VM_OBJECT_WUNLOCK	/* FreeBSD < 10.x */
+#define VM_OBJECT_WUNLOCK VM_OBJECT_UNLOCK
+#define VM_OBJECT_WLOCK	VM_OBJECT_LOCK
+#endif /* VM_OBJECT_WUNLOCK */
+
+		VM_OBJECT_WUNLOCK(object);
+		page = vm_page_getfake(paddr, memattr);
+		VM_OBJECT_WLOCK(object);
+		vm_page_lock(*mres);
+		vm_page_free(*mres);
+		vm_page_unlock(*mres);
+		*mres = page;
+		vm_page_insert(page, object, pidx);
+	}
+	page->valid = VM_PAGE_BITS_ALL;
+	return (VM_PAGER_OK);
 }
 
 
 static struct cdev_pager_ops netmap_cdev_pager_ops = {
         .cdev_pg_ctor = netmap_dev_pager_ctor,
         .cdev_pg_dtor = netmap_dev_pager_dtor,
-        .cdev_pg_fault = NULL,
+        .cdev_pg_fault = netmap_dev_pager_fault,
 };
 
+
 static int
 netmap_mmap_single(struct cdev *cdev, vm_ooffset_t *foff,
 	vm_size_t objsize,  vm_object_t *objp, int prot)
 {
+	int error;
+	struct netmap_vm_handle_t *vmh;
+	struct netmap_priv_d *priv;
 	vm_object_t obj;
 
-	ND("cdev %p foff %jd size %jd objp %p prot %d", cdev,
+	D("cdev %p foff %jd size %jd objp %p prot %d", cdev,
 	    (intmax_t )*foff, (intmax_t )objsize, objp, prot);
-	obj = vm_pager_allocate(OBJT_DEVICE, cdev, objsize, prot, *foff,
-            curthread->td_ucred);
-	ND("returns obj %p", obj);
-	if (obj == NULL)
-		return EINVAL;
-	if (saved_cdev_pager_ops.cdev_pg_fault == NULL) {
-		ND("initialize cdev_pager_ops");
-		saved_cdev_pager_ops = *(obj->un_pager.devp.ops);
-		netmap_cdev_pager_ops.cdev_pg_fault =
-			saved_cdev_pager_ops.cdev_pg_fault;
-	};
-	obj->un_pager.devp.ops = &netmap_cdev_pager_ops;
-	*objp = obj;
-	return 0;
-}
-#endif /* __FreeBSD__ */
-
-
-/*
- * mmap(2) support for the "netmap" device.
- *
- * Expose all the memory previously allocated by our custom memory
- * allocator: this way the user has only to issue a single mmap(2), and
- * can work on all the data structures flawlessly.
- *
- * Return 0 on success, -1 otherwise.
- */
-
-#ifdef __FreeBSD__
-static int
-netmap_mmap(__unused struct cdev *dev,
-#if __FreeBSD_version < 900000
-		vm_offset_t offset, vm_paddr_t *paddr, int nprot
-#else
-		vm_ooffset_t offset, vm_paddr_t *paddr, int nprot,
-		__unused vm_memattr_t *memattr
-#endif
-	)
-{
-	int error = 0;
-	struct netmap_priv_d *priv;
+	
+	vmh = malloc(sizeof(struct netmap_vm_handle_t), M_DEVBUF,
+			      M_NOWAIT | M_ZERO);
+	if (vmh == NULL)
+		return ENOMEM;
+	vmh->dev = cdev;
 
-	if (nprot & PROT_EXEC)
-		return (-1);	// XXX -1 or EINVAL ?
+	NMG_LOCK();
+	error = devfs_get_cdevpriv((void**)&priv);
+	if (error)
+		goto err_unlock;
+	vmh->priv = priv;
+	priv->np_refcount++;
+	NMG_UNLOCK();
 
-	error = devfs_get_cdevpriv((void **)&priv);
-	if (error == EBADF) {	/* called on fault, memory is initialized */
-		ND(5, "handling fault at ofs 0x%x", offset);
-		error = 0;
-	} else if (error == 0)	/* make sure memory is set */
-		error = netmap_get_memory(priv);
+	error = netmap_get_memory(priv);
 	if (error)
-		return (error);
+		goto err_deref;
 
-	ND("request for offset 0x%x", (uint32_t)offset);
-	*paddr = netmap_ofstophys(offset);
+	obj = cdev_pager_allocate(vmh, OBJT_DEVICE, 
+		&netmap_cdev_pager_ops, objsize, prot,
+		*foff, NULL);
+	if (obj == NULL) {
+		D("cdev_pager_allocate failed");
+		error = EINVAL;
+		goto err_deref;
+	}
+		
+	*objp = obj;
+	return 0;
 
-	return (*paddr ? 0 : ENOMEM);
+err_deref:
+	NMG_LOCK();
+	priv->np_refcount--;
+err_unlock:
+	NMG_UNLOCK();
+// err:
+	free(vmh, M_DEVBUF);
+	return error;
 }
 
+
+// XXX can we remove this ?
 static int
 netmap_close(struct cdev *dev, int fflag, int devtype, struct thread *td)
 {
@@ -639,12 +1339,19 @@ netmap_close(struct cdev *dev, int fflag, int devtype, struct thread *td)
 	return 0;
 }
 
+
 static int
 netmap_open(struct cdev *dev, int oflags, int devtype, struct thread *td)
 {
 	struct netmap_priv_d *priv;
 	int error;
 
+	(void)dev;
+	(void)oflags;
+	(void)devtype;
+	(void)td;
+
+	// XXX wait or nowait ?
 	priv = malloc(sizeof(struct netmap_priv_d), M_DEVBUF,
 			      M_NOWAIT | M_ZERO);
 	if (priv == NULL)
@@ -654,6 +1361,8 @@ netmap_open(struct cdev *dev, int oflags, int devtype, struct thread *td)
 	if (error)
 	        return error;
 
+	priv->np_refcount = 1;
+
 	return 0;
 }
 #endif /* __FreeBSD__ */
@@ -677,6 +1386,7 @@ netmap_open(struct cdev *dev, int oflags, int devtype, struct thread *td)
  * might take a while before releasing the buffer.
  */
 
+
 /*
  * pass a chain of buffers to the host stack as coming from 'dst'
  */
@@ -701,6 +1411,7 @@ struct mbq {
 	int count;
 };
 
+
 /*
  * put a copy of the buffers marked NS_FORWARD into an mbuf chain.
  * Run from hwcur to cur - reserved
@@ -713,24 +1424,30 @@ netmap_grab_packets(struct netmap_kring *kring, struct mbq *q, int force)
 	 * the queue is drained in all cases.
 	 * XXX handle reserved
 	 */
-	int k = kring->ring->cur - kring->ring->reserved;
-	u_int n, lim = kring->nkr_num_slots - 1;
+	u_int lim = kring->nkr_num_slots - 1;
 	struct mbuf *m, *tail = q->tail;
+	u_int k = kring->ring->cur, n = kring->ring->reserved;
+	struct netmap_mem_d *nmd = kring->na->nm_mem;
 
-	if (k < 0)
-		k = k + kring->nkr_num_slots;
+	/* compute the final position, ring->cur - ring->reserved */
+	if (n > 0) {
+		if (k < n)
+			k += kring->nkr_num_slots;
+		k += n;
+	}
 	for (n = kring->nr_hwcur; n != k;) {
 		struct netmap_slot *slot = &kring->ring->slot[n];
 
-		n = (n == lim) ? 0 : n + 1;
+		n = nm_next(n, lim);
 		if ((slot->flags & NS_FORWARD) == 0 && !force)
 			continue;
-		if (slot->len < 14 || slot->len > NETMAP_BUF_SIZE) {
+		if (slot->len < 14 || slot->len > NETMAP_BDG_BUF_SIZE(nmd)) {
 			D("bad pkt at %d len %d", n, slot->len);
 			continue;
 		}
 		slot->flags &= ~NS_FORWARD; // XXX needed ?
-		m = m_devget(NMB(slot), slot->len, 0, kring->na->ifp, NULL);
+		/* XXX adapt to the case of a multisegment packet */
+		m = m_devget(BDG_NMB(nmd, slot), slot->len, 0, kring->na->ifp, NULL);
 
 		if (m == NULL)
 			break;
@@ -745,10 +1462,19 @@ netmap_grab_packets(struct netmap_kring *kring, struct mbq *q, int force)
 	q->tail = tail;
 }
 
+
 /*
- * called under main lock to send packets from the host to the NIC
  * The host ring has packets from nr_hwcur to (cur - reserved)
- * to be sent down. We scan the tx rings, which have just been
+ * to be sent down to the NIC.
+ * We need to use the queue lock on the source (host RX ring)
+ * to protect against netmap_transmit.
+ * If the user is well behaved we do not need to acquire locks
+ * on the destination(s),
+ * so we only need to make sure that there are no panics because
+ * of user errors.
+ * XXX verify
+ *
+ * We scan the tx rings, which have just been
  * flushed so nr_hwcur == cur. Pushing packets down means
  * increment cur and decrement avail.
  * XXX to be verified
@@ -758,14 +1484,23 @@ netmap_sw_to_nic(struct netmap_adapter *na)
 {
 	struct netmap_kring *kring = &na->rx_rings[na->num_rx_rings];
 	struct netmap_kring *k1 = &na->tx_rings[0];
-	int i, howmany, src_lim, dst_lim;
+	u_int i, howmany, src_lim, dst_lim;
+
+	/* XXX we should also check that the carrier is on */
+	if (kring->nkr_stopped)
+		return;
+
+	mtx_lock(&kring->q_lock);
+
+	if (kring->nkr_stopped)
+		goto out;
 
 	howmany = kring->nr_hwavail;	/* XXX otherwise cur - reserved - nr_hwcur */
 
-	src_lim = kring->nkr_num_slots;
+	src_lim = kring->nkr_num_slots - 1;
 	for (i = 0; howmany > 0 && i < na->num_tx_rings; i++, k1++) {
 		ND("%d packets left to ring %d (space %d)", howmany, i, k1->nr_hwavail);
-		dst_lim = k1->nkr_num_slots;
+		dst_lim = k1->nkr_num_slots - 1;
 		while (howmany > 0 && k1->ring->avail > 0) {
 			struct netmap_slot *src, *dst, tmp;
 			src = &kring->ring->slot[kring->nr_hwcur];
@@ -781,39 +1516,45 @@ netmap_sw_to_nic(struct netmap_adapter *na)
 				dst->len, dst->buf_idx,
 				kring->nr_hwcur, k1->ring->cur);
 
-			if (++kring->nr_hwcur >= src_lim)
-				kring->nr_hwcur = 0;
+			kring->nr_hwcur = nm_next(kring->nr_hwcur, src_lim);
 			howmany--;
 			kring->nr_hwavail--;
-			if (++k1->ring->cur >= dst_lim)
-				k1->ring->cur = 0;
+			k1->ring->cur = nm_next(k1->ring->cur, dst_lim);
 			k1->ring->avail--;
 		}
 		kring->ring->cur = kring->nr_hwcur; // XXX
-		k1++;
+		k1++; // XXX why?
 	}
+out:
+	mtx_unlock(&kring->q_lock);
 }
 
+
 /*
- * netmap_sync_to_host() passes packets up. We are called from a
+ * netmap_txsync_to_host() passes packets up. We are called from a
  * system call in user process context, and the only contention
  * can be among multiple user threads erroneously calling
  * this routine concurrently.
  */
 static void
-netmap_sync_to_host(struct netmap_adapter *na)
+netmap_txsync_to_host(struct netmap_adapter *na)
 {
 	struct netmap_kring *kring = &na->tx_rings[na->num_tx_rings];
 	struct netmap_ring *ring = kring->ring;
 	u_int k, lim = kring->nkr_num_slots - 1;
-	struct mbq q = { NULL, NULL };
+	struct mbq q = { NULL, NULL, 0 };
 
+	if (nm_kr_tryget(kring)) {
+		D("ring %p busy (user error)", kring);
+		return;
+	}
 	k = ring->cur;
 	if (k > lim) {
+		D("invalid ring index in stack TX kring %p", kring);
 		netmap_ring_reinit(kring);
+		nm_kr_put(kring);
 		return;
 	}
-	// na->nm_lock(na->ifp, NETMAP_CORE_LOCK, 0);
 
 	/* Take packets from hwcur to cur and pass them up.
 	 * In case of no buffers we give up. At the end of the loop,
@@ -822,14 +1563,32 @@ netmap_sync_to_host(struct netmap_adapter *na)
 	netmap_grab_packets(kring, &q, 1);
 	kring->nr_hwcur = k;
 	kring->nr_hwavail = ring->avail = lim;
-	// na->nm_lock(na->ifp, NETMAP_CORE_UNLOCK, 0);
 
+	nm_kr_put(kring);
 	netmap_send_up(na->ifp, q.head);
 }
 
+
+/*
+ * This is the 'txsync' handler to send from a software ring to the
+ * host stack.
+ */
+/* SWNA(ifp)->txrings[0] is always NA(ifp)->txrings[NA(ifp)->num_txrings] */
+static int
+netmap_bdg_to_host(struct ifnet *ifp, u_int ring_nr, int flags)
+{
+	(void)ring_nr;
+	(void)flags;
+	if (netmap_verbose > 255)
+		RD(5, "sync to host %s ring %d", ifp->if_xname, ring_nr);
+	netmap_txsync_to_host(NA(ifp));
+	return 0;
+}
+
+
 /*
  * rxsync backend for packets coming from the host stack.
- * They have been put in the queue by netmap_start() so we
+ * They have been put in the queue by netmap_transmit() so we
  * need to protect access to the kring using a lock.
  *
  * This routine also does the selrecord if called from the poll handler
@@ -839,7 +1598,7 @@ netmap_sync_to_host(struct netmap_adapter *na)
  *     as an additional hidden argument.
  */
 static void
-netmap_sync_from_host(struct netmap_adapter *na, struct thread *td, void *pwait)
+netmap_rxsync_from_host(struct netmap_adapter *na, struct thread *td, void *pwait)
 {
 	struct netmap_kring *kring = &na->rx_rings[na->num_rx_rings];
 	struct netmap_ring *ring = kring->ring;
@@ -847,10 +1606,19 @@ netmap_sync_from_host(struct netmap_adapter *na, struct thread *td, void *pwait)
 	u_int k = ring->cur, resvd = ring->reserved;
 
 	(void)pwait;	/* disable unused warnings */
-	na->nm_lock(na->ifp, NETMAP_CORE_LOCK, 0);
+
+	if (kring->nkr_stopped) /* check a first time without lock */
+		return;
+
+	/* XXX as an optimization we could reuse na->core_lock */
+	mtx_lock(&kring->q_lock);
+
+	if (kring->nkr_stopped)  /* check again with lock held */
+		goto unlock_out;
+
 	if (k >= lim) {
 		netmap_ring_reinit(kring);
-		return;
+		goto unlock_out;
 	}
 	/* new packets are already set in nr_hwavail */
 	/* skip past packets that userspace has released */
@@ -872,85 +1640,200 @@ netmap_sync_from_host(struct netmap_adapter *na, struct thread *td, void *pwait)
 		selrecord(td, &kring->si);
 	if (k && (netmap_verbose & NM_VERB_HOST))
 		D("%d pkts from stack", k);
-	na->nm_lock(na->ifp, NETMAP_CORE_UNLOCK, 0);
+unlock_out:
+
+	mtx_unlock(&kring->q_lock);
 }
 
 
 /*
+ * MUST BE CALLED UNDER NMG_LOCK()
+ *
  * get a refcounted reference to an interface.
+ * This is always called in the execution of an ioctl().
+ *
  * Return ENXIO if the interface does not exist, EINVAL if netmap
  * is not supported by the interface.
  * If successful, hold a reference.
+ *
+ * When the NIC is attached to a bridge, reference is managed
+ * at na->na_bdg_refcount using ADD/DROP_BDG_REF() as well as
+ * virtual ports.  Hence, on the final DROP_BDG_REF(), the NIC
+ * is detached from the bridge, then ifp's refcount is dropped (this
+ * is equivalent to that ifp is destroyed in case of virtual ports.
+ *
+ * This function uses if_rele() when we want to prevent the NIC from
+ * being detached from the bridge in error handling.  But once refcount
+ * is acquired by this function, it must be released using nm_if_rele().
  */
 static int
-get_ifp(const char *name, struct ifnet **ifp)
+get_ifp(struct nmreq *nmr, struct ifnet **ifp, int create)
 {
-#ifdef NM_BRIDGE
+	const char *name = nmr->nr_name;
+	int namelen = strlen(name);
 	struct ifnet *iter = NULL;
+	int no_prefix = 0;
 
-	do {
-		struct nm_bridge *b;
-		int i, l, cand = -1;
+	/* first try to see if this is a bridge port. */
+	struct nm_bridge *b;
+	struct netmap_adapter *na;
+	int i, j, cand = -1, cand2 = -1;
+	int needed;
 
-		if (strncmp(name, NM_NAME, sizeof(NM_NAME) - 1))
-			break;
-		b = nm_find_bridge(name);
-		if (b == NULL) {
-			D("no bridges available for '%s'", name);
-			return (ENXIO);
-		}
-		/* XXX locking */
-		BDG_LOCK(b);
-		/* lookup in the local list of ports */
-		for (i = 0; i < NM_BDG_MAXPORTS; i++) {
-			iter = b->bdg_ports[i];
-			if (iter == NULL) {
-				if (cand == -1)
-					cand = i; /* potential insert point */
-				continue;
-			}
-			if (!strcmp(iter->if_xname, name)) {
-				ADD_BDG_REF(iter);
-				ND("found existing interface");
-				BDG_UNLOCK(b);
-				break;
-			}
+	NMG_LOCK_ASSERT();
+	*ifp = NULL;	/* default */
+	if (strncmp(name, NM_NAME, sizeof(NM_NAME) - 1)) {
+		no_prefix = 1;	/* no VALE prefix */
+		goto no_bridge_port;
+	}
+
+	b = nm_find_bridge(name, create);
+	if (b == NULL) {
+		D("no bridges available for '%s'", name);
+		return (ENXIO);
+	}
+
+	/* Now we are sure that name starts with the bridge's name,
+	 * lookup the port in the bridge. We need to scan the entire
+	 * list. It is not important to hold a WLOCK on the bridge
+	 * during the search because NMG_LOCK already guarantees
+	 * that there are no other possible writers.
+	 */
+
+	/* lookup in the local list of ports */
+	for (j = 0; j < b->bdg_active_ports; j++) {
+		i = b->bdg_port_index[j];
+		na = b->bdg_ports[i];
+		// KASSERT(na != NULL);
+		iter = na->ifp;
+		/* XXX make sure the name only contains one : */
+		if (!strcmp(iter->if_xname, name) /* virtual port */ ||
+		    (namelen > b->bdg_namelen && !strcmp(iter->if_xname,
+		    name + b->bdg_namelen + 1)) /* NIC */) {
+			ADD_BDG_REF(iter);
+			ND("found existing if %s refs %d", name,
+				NA(iter)->na_bdg_refcount);
+			*ifp = iter;
+			/* we are done, this is surely netmap capable */
+			return 0;
 		}
-		if (i < NM_BDG_MAXPORTS) /* already unlocked */
-			break;
-		if (cand == -1) {
-			D("bridge full, cannot create new port");
-no_port:
-			BDG_UNLOCK(b);
-			*ifp = NULL;
+	}
+	/* not found, should we create it? */
+	if (!create)
+		return ENXIO;
+	/* yes we should, see if we have space to attach entries */
+	needed = 2; /* in some cases we only need 1 */
+	if (b->bdg_active_ports + needed >= NM_BDG_MAXPORTS) {
+		D("bridge full %d, cannot create new port", b->bdg_active_ports);
+		return EINVAL;
+	}
+	/* record the next two ports available, but do not allocate yet */
+	cand = b->bdg_port_index[b->bdg_active_ports];
+	cand2 = b->bdg_port_index[b->bdg_active_ports + 1];
+	ND("+++ bridge %s port %s used %d avail %d %d",
+		b->bdg_basename, name, b->bdg_active_ports, cand, cand2);
+
+	/*
+	 * try see if there is a matching NIC with this name
+	 * (after the bridge's name)
+	 */
+	iter = ifunit_ref(name + b->bdg_namelen + 1);
+	if (!iter) { /* this is a virtual port */
+		/* Create a temporary NA with arguments, then
+		 * bdg_netmap_attach() will allocate the real one
+		 * and attach it to the ifp
+		 */
+		struct netmap_adapter tmp_na;
+		int error;
+
+		if (nmr->nr_cmd) {
+			/* nr_cmd must be 0 for a virtual port */
 			return EINVAL;
 		}
-		ND("create new bridge port %s", name);
-		/* space for forwarding list after the ifnet */
-		l = sizeof(*iter) +
-			 sizeof(struct nm_bdg_fwd)*NM_BDG_BATCH ;
-		iter = malloc(l, M_DEVBUF, M_NOWAIT | M_ZERO);
+		bzero(&tmp_na, sizeof(tmp_na));
+		/* bound checking */
+		tmp_na.num_tx_rings = nmr->nr_tx_rings;
+		nm_bound_var(&tmp_na.num_tx_rings, 1, 1, NM_BDG_MAXRINGS, NULL);
+		nmr->nr_tx_rings = tmp_na.num_tx_rings; // write back
+		tmp_na.num_rx_rings = nmr->nr_rx_rings;
+		nm_bound_var(&tmp_na.num_rx_rings, 1, 1, NM_BDG_MAXRINGS, NULL);
+		nmr->nr_rx_rings = tmp_na.num_rx_rings; // write back
+		nm_bound_var(&nmr->nr_tx_slots, NM_BRIDGE_RINGSIZE,
+				1, NM_BDG_MAXSLOTS, NULL);
+		tmp_na.num_tx_desc = nmr->nr_tx_slots;
+		nm_bound_var(&nmr->nr_rx_slots, NM_BRIDGE_RINGSIZE,
+				1, NM_BDG_MAXSLOTS, NULL);
+		tmp_na.num_rx_desc = nmr->nr_rx_slots;
+
+	 	/* create a struct ifnet for the new port.
+		 * need M_NOWAIT as we are under nma_lock
+		 */
+		iter = malloc(sizeof(*iter), M_DEVBUF, M_NOWAIT | M_ZERO);
 		if (!iter)
-			goto no_port;
+			return ENOMEM;
+
 		strcpy(iter->if_xname, name);
-		bdg_netmap_attach(iter);
-		b->bdg_ports[cand] = iter;
-		iter->if_bridge = b;
-		ADD_BDG_REF(iter);
-		BDG_UNLOCK(b);
-		ND("attaching virtual bridge %p", b);
-	} while (0);
+		tmp_na.ifp = iter;
+		/* bdg_netmap_attach creates a struct netmap_adapter */
+		error = bdg_netmap_attach(&tmp_na);
+		if (error) {
+			D("error %d", error);
+			free(iter, M_DEVBUF);
+			return error;
+		}
+		cand2 = -1;	/* only need one port */
+	} else if (NETMAP_CAPABLE(iter)) { /* this is a NIC */
+		/* make sure the NIC is not already in use */
+		if (NETMAP_OWNED_BY_ANY(iter)) {
+			D("NIC %s busy, cannot attach to bridge",
+				iter->if_xname);
+			if_rele(iter); /* don't detach from bridge */
+			return EINVAL;
+		}
+		if (nmr->nr_arg1 != NETMAP_BDG_HOST)
+			cand2 = -1; /* only need one port */
+	} else { /* not a netmap-capable NIC */
+		if_rele(iter); /* don't detach from bridge */
+		return EINVAL;
+	}
+	na = NA(iter);
+
+	BDG_WLOCK(b);
+	na->bdg_port = cand;
+	ND("NIC  %p to bridge port %d", NA(iter), cand);
+	/* bind the port to the bridge (virtual ports are not active) */
+	b->bdg_ports[cand] = na;
+	na->na_bdg = b;
+	b->bdg_active_ports++;
+	if (cand2 >= 0) {
+		/* also bind the host stack to the bridge */
+		b->bdg_ports[cand2] = SWNA(iter);
+		SWNA(iter)->bdg_port = cand2;
+		SWNA(iter)->na_bdg = b;
+		b->bdg_active_ports++;
+		ND("host %p to bridge port %d", SWNA(iter), cand2);
+	}
+	ADD_BDG_REF(iter);	// XXX one or two ?
+	ND("if %s refs %d", name, NA(iter)->na_bdg_refcount);
+	BDG_WUNLOCK(b);
+	*ifp = iter;
+	return 0;
+
+no_bridge_port:
 	*ifp = iter;
 	if (! *ifp)
-#endif /* NM_BRIDGE */
-	*ifp = ifunit_ref(name);
+		*ifp = ifunit_ref(name);
 	if (*ifp == NULL)
 		return (ENXIO);
-	/* can do this if the capability exists and if_pspare[0]
-	 * points to the netmap descriptor.
-	 */
-	if (NETMAP_CAPABLE(*ifp))
-		return 0;	/* valid pointer, we hold the refcount */
+
+	if (NETMAP_CAPABLE(*ifp)) {
+		/* Users cannot use the NIC attached to a bridge directly */
+		if (no_prefix && NETMAP_OWNED_BY_KERN(*ifp)) {
+			if_rele(*ifp); /* don't detach from bridge */
+			return EINVAL;
+		} else
+			return 0;	/* valid pointer, we hold the refcount */
+	}
 	nm_if_rele(*ifp);
 	return EINVAL;	// not NETMAP capable
 }
@@ -975,6 +1858,7 @@ netmap_ring_reinit(struct netmap_kring *kring)
 	u_int i, lim = kring->nkr_num_slots - 1;
 	int errors = 0;
 
+	// XXX KASSERT nm_kr_tryget
 	RD(10, "called for %s", kring->na->ifp->if_xname);
 	if (ring->cur > lim)
 		errors++;
@@ -986,7 +1870,7 @@ netmap_ring_reinit(struct netmap_kring *kring)
 				D("bad buffer at slot %d idx %d len %d ", i, idx, len);
 			ring->slot[i].buf_idx = 0;
 			ring->slot[i].len = 0;
-		} else if (len > NETMAP_BUF_SIZE) {
+		} else if (len > NETMAP_BDG_BUF_SIZE(kring->na->nm_mem)) {
 			ring->slot[i].len = 0;
 			if (!errors++)
 				D("bad len %d at slot %d idx %d",
@@ -1022,8 +1906,7 @@ netmap_set_ringid(struct netmap_priv_d *priv, u_int ringid)
 	struct netmap_adapter *na = NA(ifp);
 	u_int i = ringid & NETMAP_RING_MASK;
 	/* initially (np_qfirst == np_qlast) we don't want to lock */
-	int need_lock = (priv->np_qfirst != priv->np_qlast);
-	int lim = na->num_rx_rings;
+	u_int lim = na->num_rx_rings;
 
 	if (na->num_tx_rings > lim)
 		lim = na->num_tx_rings;
@@ -1031,8 +1914,6 @@ netmap_set_ringid(struct netmap_priv_d *priv, u_int ringid)
 		D("invalid ring id %d", i);
 		return (EINVAL);
 	}
-	if (need_lock)
-		na->nm_lock(ifp, NETMAP_CORE_LOCK, 0);
 	priv->np_ringid = ringid;
 	if (ringid & NETMAP_SW_RING) {
 		priv->np_qfirst = NETMAP_SW_RING;
@@ -1045,8 +1926,6 @@ netmap_set_ringid(struct netmap_priv_d *priv, u_int ringid)
 		priv->np_qlast = NETMAP_HW_RING ;
 	}
 	priv->np_txpoll = (ringid & NETMAP_NO_TX_POLL) ? 0 : 1;
-	if (need_lock)
-		na->nm_lock(ifp, NETMAP_CORE_UNLOCK, 0);
     if (netmap_verbose) {
 	if (ringid & NETMAP_SW_RING)
 		D("ringid %s set to SW RING", ifp->if_xname);
@@ -1059,6 +1938,345 @@ netmap_set_ringid(struct netmap_priv_d *priv, u_int ringid)
 	return 0;
 }
 
+
+/*
+ * possibly move the interface to netmap-mode.
+ * If success it returns a pointer to netmap_if, otherwise NULL.
+ * This must be called with NMG_LOCK held.
+ */
+static struct netmap_if *
+netmap_do_regif(struct netmap_priv_d *priv, struct ifnet *ifp,
+	uint16_t ringid, int *err)
+{
+	struct netmap_adapter *na = NA(ifp);
+	struct netmap_if *nifp = NULL;
+	int error, need_mem;
+
+	NMG_LOCK_ASSERT();
+	/* ring configuration may have changed, fetch from the card */
+	netmap_update_config(na);
+	priv->np_ifp = ifp;     /* store the reference */
+	error = netmap_set_ringid(priv, ringid);
+	if (error)
+		goto out;
+	/* ensure allocators are ready */
+	need_mem = !netmap_have_memory_locked(priv);
+	if (need_mem) {
+		error = netmap_get_memory_locked(priv);
+		ND("get_memory returned %d", error);
+		if (error)
+			goto out;
+	}
+	nifp = netmap_if_new(ifp->if_xname, na);
+	if (nifp == NULL) { /* allocation failed */
+		/* we should drop the allocator, but only
+		 * if we were the ones who grabbed it
+		 */
+		if (need_mem)
+			netmap_drop_memory_locked(priv);
+		error = ENOMEM;
+		goto out;
+	}
+	na->refcount++;
+	if (ifp->if_capenable & IFCAP_NETMAP) {
+		/* was already set */
+	} else {
+		u_int i;
+		/* Otherwise set the card in netmap mode
+		 * and make it use the shared buffers.
+		 *
+		 * If the interface is attached to a bridge, lock it.
+		 */
+		if (NETMAP_OWNED_BY_KERN(ifp))
+			BDG_WLOCK(NA(ifp)->na_bdg);
+		for (i = 0 ; i < na->num_tx_rings + 1; i++)
+			mtx_init(&na->tx_rings[i].q_lock, "nm_txq_lock",
+			    NULL, MTX_DEF);
+		for (i = 0 ; i < na->num_rx_rings + 1; i++) {
+			mtx_init(&na->rx_rings[i].q_lock, "nm_rxq_lock",
+			    NULL, MTX_DEF);
+		}
+		if (nma_is_hw(na)) {
+			SWNA(ifp)->tx_rings = &na->tx_rings[na->num_tx_rings];
+			SWNA(ifp)->rx_rings = &na->rx_rings[na->num_rx_rings];
+		}
+		/*
+		 * do not core lock because the race is harmless here,
+		 * there cannot be any traffic to netmap_transmit()
+		 */
+		error = na->nm_register(ifp, 1); /* mode on */
+		// XXX do we need to nm_alloc_bdgfwd() in all cases ?
+		if (!error)
+			error = nm_alloc_bdgfwd(na);
+		if (error) {
+			netmap_do_unregif(priv, nifp);
+			nifp = NULL;
+		}
+		if (NETMAP_OWNED_BY_KERN(ifp))
+			BDG_WUNLOCK(NA(ifp)->na_bdg);
+
+	}
+out:
+	*err = error;
+	if (nifp != NULL) {
+		/*
+		 * advertise that the interface is ready bt setting ni_nifp.
+		 * The barrier is needed because readers (poll and *SYNC)
+		 * check for priv->np_nifp != NULL without locking
+		 */
+		wmb(); /* make sure previous writes are visible to all CPUs */
+		priv->np_nifp = nifp;
+	}
+	return nifp;
+}
+
+/* Process NETMAP_BDG_ATTACH and NETMAP_BDG_DETACH */
+static int
+nm_bdg_attach(struct nmreq *nmr)
+{
+	struct ifnet *ifp;
+	struct netmap_if *nifp;
+	struct netmap_priv_d *npriv;
+	int error;
+
+	npriv = malloc(sizeof(*npriv), M_DEVBUF, M_NOWAIT|M_ZERO);
+	if (npriv == NULL)
+		return ENOMEM;
+	NMG_LOCK();
+	error = get_ifp(nmr, &ifp, 1 /* create if not exists */);
+	if (error) /* no device, or another bridge or user owns the device */
+		goto unlock_exit;
+	/* get_ifp() sets na_bdg if this is a physical interface
+	 * that we can attach to a switch.
+	 */
+	if (!NETMAP_OWNED_BY_KERN(ifp)) {
+		/* got reference to a virtual port or direct access to a NIC.
+		 * perhaps specified no bridge prefix or wrong NIC name
+		 */
+		error = EINVAL;
+		goto unref_exit;
+	}
+
+	if (NA(ifp)->refcount > 0) { /* already registered */
+		error = EBUSY;
+		DROP_BDG_REF(ifp);
+		goto unlock_exit;
+	}
+
+	nifp = netmap_do_regif(npriv, ifp, nmr->nr_ringid, &error);
+	if (!nifp) {
+		goto unref_exit;
+	}
+
+	NA(ifp)->na_kpriv = npriv;
+	NMG_UNLOCK();
+	ND("registered %s to netmap-mode", ifp->if_xname);
+	return 0;
+
+unref_exit:
+	nm_if_rele(ifp);
+unlock_exit:
+	NMG_UNLOCK();
+	bzero(npriv, sizeof(*npriv));
+	free(npriv, M_DEVBUF);
+	return error;
+}
+
+static int
+nm_bdg_detach(struct nmreq *nmr)
+{
+	struct ifnet *ifp;
+	int error;
+	int last_instance;
+
+	NMG_LOCK();
+	error = get_ifp(nmr, &ifp, 0 /* don't create */);
+	if (error) { /* no device, or another bridge or user owns the device */
+		goto unlock_exit;
+	}
+	/* XXX do we need to check this ? */
+	if (!NETMAP_OWNED_BY_KERN(ifp)) {
+		/* got reference to a virtual port or direct access to a NIC.
+		 * perhaps specified no bridge's prefix or wrong NIC's name
+		 */
+		error = EINVAL;
+		goto unref_exit;
+	}
+
+	if (NA(ifp)->refcount == 0) { /* not registered */
+		error = EINVAL;
+		goto unref_exit;
+	}
+
+	DROP_BDG_REF(ifp); /* the one from get_ifp */
+	last_instance = netmap_dtor_locked(NA(ifp)->na_kpriv); /* unregister */
+	NMG_UNLOCK();
+	if (!last_instance) {
+		D("--- error, trying to detach an entry with active mmaps");
+		error = EINVAL;
+	} else {
+		struct netmap_priv_d *npriv = NA(ifp)->na_kpriv;
+		NA(ifp)->na_kpriv = NULL;
+
+		bzero(npriv, sizeof(*npriv));
+		free(npriv, M_DEVBUF);
+	}
+	return error;
+
+unref_exit:
+	nm_if_rele(ifp);
+unlock_exit:
+	NMG_UNLOCK();
+	return error;
+}
+
+
+/* Initialize necessary fields of sw adapter located in right after hw's
+ * one.  sw adapter attaches a pair of sw rings of the netmap-mode NIC.
+ * It is always activated and deactivated at the same tie with the hw's one.
+ * Thus we don't need refcounting on the sw adapter.
+ * Regardless of NIC's feature we use separate lock so that anybody can lock
+ * me independently from the hw adapter.
+ * Make sure nm_register is NULL to be handled as FALSE in nma_is_hw
+ */
+static void
+netmap_attach_sw(struct ifnet *ifp)
+{
+	struct netmap_adapter *hw_na = NA(ifp);
+	struct netmap_adapter *na = SWNA(ifp);
+
+	na->ifp = ifp;
+	na->num_rx_rings = na->num_tx_rings = 1;
+	na->num_tx_desc = hw_na->num_tx_desc;
+	na->num_rx_desc = hw_na->num_rx_desc;
+	na->nm_txsync = netmap_bdg_to_host;
+	/* we use the same memory allocator as the
+	 * the hw adapter */
+	na->nm_mem = hw_na->nm_mem;
+}
+
+
+/* exported to kernel callers, e.g. OVS ?
+ * Entry point.
+ * Called without NMG_LOCK.
+ */
+int
+netmap_bdg_ctl(struct nmreq *nmr, bdg_lookup_fn_t func)
+{
+	struct nm_bridge *b;
+	struct netmap_adapter *na;
+	struct ifnet *iter;
+	char *name = nmr->nr_name;
+	int cmd = nmr->nr_cmd, namelen = strlen(name);
+	int error = 0, i, j;
+
+	switch (cmd) {
+	case NETMAP_BDG_ATTACH:
+		error = nm_bdg_attach(nmr);
+		break;
+
+	case NETMAP_BDG_DETACH:
+		error = nm_bdg_detach(nmr);
+		break;
+
+	case NETMAP_BDG_LIST:
+		/* this is used to enumerate bridges and ports */
+		if (namelen) { /* look up indexes of bridge and port */
+			if (strncmp(name, NM_NAME, strlen(NM_NAME))) {
+				error = EINVAL;
+				break;
+			}
+			NMG_LOCK();
+			b = nm_find_bridge(name, 0 /* don't create */);
+			if (!b) {
+				error = ENOENT;
+				NMG_UNLOCK();
+				break;
+			}
+
+			error = ENOENT;
+			for (j = 0; j < b->bdg_active_ports; j++) {
+				i = b->bdg_port_index[j];
+				na = b->bdg_ports[i];
+				if (na == NULL) {
+					D("---AAAAAAAAARGH-------");
+					continue;
+				}
+				iter = na->ifp;
+				/* the former and the latter identify a
+				 * virtual port and a NIC, respectively
+				 */
+				if (!strcmp(iter->if_xname, name) ||
+				    (namelen > b->bdg_namelen &&
+				    !strcmp(iter->if_xname,
+				    name + b->bdg_namelen + 1))) {
+					/* bridge index */
+					nmr->nr_arg1 = b - nm_bridges;
+					nmr->nr_arg2 = i; /* port index */
+					error = 0;
+					break;
+				}
+			}
+			NMG_UNLOCK();
+		} else {
+			/* return the first non-empty entry starting from
+			 * bridge nr_arg1 and port nr_arg2.
+			 *
+			 * Users can detect the end of the same bridge by
+			 * seeing the new and old value of nr_arg1, and can
+			 * detect the end of all the bridge by error != 0
+			 */
+			i = nmr->nr_arg1;
+			j = nmr->nr_arg2;
+
+			NMG_LOCK();
+			for (error = ENOENT; i < NM_BRIDGES; i++) {
+				b = nm_bridges + i;
+				if (j >= b->bdg_active_ports) {
+					j = 0; /* following bridges scan from 0 */
+					continue;
+				}
+				nmr->nr_arg1 = i;
+				nmr->nr_arg2 = j;
+				j = b->bdg_port_index[j];
+				na = b->bdg_ports[j];
+				iter = na->ifp;
+				strncpy(name, iter->if_xname, (size_t)IFNAMSIZ);
+				error = 0;
+				break;
+			}
+			NMG_UNLOCK();
+		}
+		break;
+
+	case NETMAP_BDG_LOOKUP_REG:
+		/* register a lookup function to the given bridge.
+		 * nmr->nr_name may be just bridge's name (including ':'
+		 * if it is not just NM_NAME).
+		 */
+		if (!func) {
+			error = EINVAL;
+			break;
+		}
+		NMG_LOCK();
+		b = nm_find_bridge(name, 0 /* don't create */);
+		if (!b) {
+			error = EINVAL;
+		} else {
+			b->nm_bdg_lookup = func;
+		}
+		NMG_UNLOCK();
+		break;
+
+	default:
+		D("invalid cmd (nmr->nr_cmd) (0x%x)", cmd);
+		error = EINVAL;
+		break;
+	}
+	return error;
+}
+
+
 /*
  * ioctl(2) support for the "netmap" device.
  *
@@ -1077,12 +2295,13 @@ netmap_ioctl(struct cdev *dev, u_long cmd, caddr_t data,
 	int fflag, struct thread *td)
 {
 	struct netmap_priv_d *priv = NULL;
-	struct ifnet *ifp;
+	struct ifnet *ifp = NULL;
 	struct nmreq *nmr = (struct nmreq *) data;
-	struct netmap_adapter *na;
+	struct netmap_adapter *na = NULL;
 	int error;
 	u_int i, lim;
 	struct netmap_if *nifp;
+	struct netmap_kring *krings;
 
 	(void)dev;	/* UNUSED */
 	(void)fflag;	/* UNUSED */
@@ -1121,28 +2340,44 @@ netmap_ioctl(struct cdev *dev, u_long cmd, caddr_t data,
 			error = EINVAL;
 			break;
 		}
-		/* update configuration */
-		error = netmap_get_memory(priv);
-		ND("get_memory returned %d", error);
-		if (error)
-			break;
-		/* memsize is always valid */
-		nmr->nr_memsize = nm_mem.nm_totalsize;
-		nmr->nr_offset = 0;
-		nmr->nr_rx_rings = nmr->nr_tx_rings = 0;
-		nmr->nr_rx_slots = nmr->nr_tx_slots = 0;
-		if (nmr->nr_name[0] == '\0')	/* just get memory info */
+		if (nmr->nr_cmd == NETMAP_BDG_LIST) {
+			error = netmap_bdg_ctl(nmr, NULL);
 			break;
-		error = get_ifp(nmr->nr_name, &ifp); /* get a refcount */
-		if (error)
-			break;
-		na = NA(ifp); /* retrieve netmap_adapter */
-		netmap_update_config(na);
-		nmr->nr_rx_rings = na->num_rx_rings;
-		nmr->nr_tx_rings = na->num_tx_rings;
-		nmr->nr_rx_slots = na->num_rx_desc;
-		nmr->nr_tx_slots = na->num_tx_desc;
-		nm_if_rele(ifp);	/* return the refcount */
+		}
+
+		NMG_LOCK();
+		do {
+			/* memsize is always valid */
+			struct netmap_mem_d *nmd = &nm_mem;
+			u_int memflags;
+
+			if (nmr->nr_name[0] != '\0') {
+				/* get a refcount */
+				error = get_ifp(nmr, &ifp, 1 /* create */);
+				if (error)
+					break;
+				na = NA(ifp);  /* retrieve the netmap adapter */
+				nmd = na->nm_mem; /* and its memory allocator */
+			}
+			
+			error = netmap_mem_get_info(nmd, &nmr->nr_memsize, &memflags);
+			if (error)
+				break;
+			if (na == NULL) /* only memory info */
+				break;
+			nmr->nr_offset = 0;
+			nmr->nr_rx_slots = nmr->nr_tx_slots = 0;
+			netmap_update_config(na);
+			nmr->nr_rx_rings = na->num_rx_rings;
+			nmr->nr_tx_rings = na->num_tx_rings;
+			nmr->nr_rx_slots = na->num_rx_desc;
+			nmr->nr_tx_slots = na->num_tx_desc;
+			if (memflags & NETMAP_MEM_PRIVATE)
+				nmr->nr_ringid |= NETMAP_PRIV_MEM;
+		} while (0);
+		if (ifp)
+			nm_if_rele(ifp);	/* return the refcount */
+		NMG_UNLOCK();
 		break;
 
 	case NIOCREGIF:
@@ -1151,96 +2386,61 @@ netmap_ioctl(struct cdev *dev, u_long cmd, caddr_t data,
 			error = EINVAL;
 			break;
 		}
-		/* ensure allocators are ready */
-		error = netmap_get_memory(priv);
-		ND("get_memory returned %d", error);
-		if (error)
-			break;
-
-		/* protect access to priv from concurrent NIOCREGIF */
-		NMA_LOCK();
-		if (priv->np_ifp != NULL) {	/* thread already registered */
-			error = netmap_set_ringid(priv, nmr->nr_ringid);
-			NMA_UNLOCK();
-			break;
-		}
-		/* find the interface and a reference */
-		error = get_ifp(nmr->nr_name, &ifp); /* keep reference */
-		if (error) {
-			NMA_UNLOCK();
+		/* possibly attach/detach NIC and VALE switch */
+		i = nmr->nr_cmd;
+		if (i == NETMAP_BDG_ATTACH || i == NETMAP_BDG_DETACH) {
+			error = netmap_bdg_ctl(nmr, NULL);
 			break;
-		}
-		na = NA(ifp); /* retrieve netmap adapter */
-
-		for (i = 10; i > 0; i--) {
-			na->nm_lock(ifp, NETMAP_REG_LOCK, 0);
-			if (!NETMAP_DELETING(na))
-				break;
-			na->nm_lock(ifp, NETMAP_REG_UNLOCK, 0);
-			tsleep(na, 0, "NIOCREGIF", hz/10);
-		}
-		if (i == 0) {
-			D("too many NIOCREGIF attempts, give up");
+		} else if (i != 0) {
+			D("nr_cmd must be 0 not %d", i);
 			error = EINVAL;
-			nm_if_rele(ifp);	/* return the refcount */
-			NMA_UNLOCK();
 			break;
 		}
 
-		/* ring configuration may have changed, fetch from the card */
-		netmap_update_config(na);
-		priv->np_ifp = ifp;	/* store the reference */
-		error = netmap_set_ringid(priv, nmr->nr_ringid);
-		if (error)
-			goto error;
-		nifp = netmap_if_new(nmr->nr_name, na);
-		if (nifp == NULL) { /* allocation failed */
-			error = ENOMEM;
-		} else if (ifp->if_capenable & IFCAP_NETMAP) {
-			/* was already set */
-		} else {
-			/* Otherwise set the card in netmap mode
-			 * and make it use the shared buffers.
-			 */
-			for (i = 0 ; i < na->num_tx_rings + 1; i++)
-				mtx_init(&na->tx_rings[i].q_lock, "nm_txq_lock", MTX_NETWORK_LOCK, MTX_DEF);
-			for (i = 0 ; i < na->num_rx_rings + 1; i++) {
-				mtx_init(&na->rx_rings[i].q_lock, "nm_rxq_lock", MTX_NETWORK_LOCK, MTX_DEF);
+		/* protect access to priv from concurrent NIOCREGIF */
+		NMG_LOCK();
+		do {
+			u_int memflags;
+
+			if (priv->np_ifp != NULL) {	/* thread already registered */
+				error = netmap_set_ringid(priv, nmr->nr_ringid);
+				break;
 			}
-			error = na->nm_register(ifp, 1); /* mode on */
-			if (error) {
-				netmap_dtor_locked(priv);
-				netmap_if_free(nifp);
+			/* find the interface and a reference */
+			error = get_ifp(nmr, &ifp, 1 /* create */); /* keep reference */
+			if (error)
+				break;
+			if (NETMAP_OWNED_BY_KERN(ifp)) {
+				nm_if_rele(ifp);
+				error = EBUSY;
+				break;
+			}
+			nifp = netmap_do_regif(priv, ifp, nmr->nr_ringid, &error);
+			if (!nifp) {    /* reg. failed, release priv and ref */
+				nm_if_rele(ifp);        /* return the refcount */
+				priv->np_ifp = NULL;
+				priv->np_nifp = NULL;
+				break;
 			}
-		}
-
-		if (error) {	/* reg. failed, release priv and ref */
-error:
-			na->nm_lock(ifp, NETMAP_REG_UNLOCK, 0);
-			nm_if_rele(ifp);	/* return the refcount */
-			priv->np_ifp = NULL;
-			priv->np_nifp = NULL;
-			NMA_UNLOCK();
-			break;
-		}
-
-		na->nm_lock(ifp, NETMAP_REG_UNLOCK, 0);
-
-		/* the following assignment is a commitment.
-		 * Readers (i.e., poll and *SYNC) check for
-		 * np_nifp != NULL without locking
-		 */
-		wmb(); /* make sure previous writes are visible to all CPUs */
-		priv->np_nifp = nifp;
-		NMA_UNLOCK();
 
-		/* return the offset of the netmap_if object */
-		nmr->nr_rx_rings = na->num_rx_rings;
-		nmr->nr_tx_rings = na->num_tx_rings;
-		nmr->nr_rx_slots = na->num_rx_desc;
-		nmr->nr_tx_slots = na->num_tx_desc;
-		nmr->nr_memsize = nm_mem.nm_totalsize;
-		nmr->nr_offset = netmap_if_offset(nifp);
+			/* return the offset of the netmap_if object */
+			na = NA(ifp); /* retrieve netmap adapter */
+			nmr->nr_rx_rings = na->num_rx_rings;
+			nmr->nr_tx_rings = na->num_tx_rings;
+			nmr->nr_rx_slots = na->num_rx_desc;
+			nmr->nr_tx_slots = na->num_tx_desc;
+			error = netmap_mem_get_info(na->nm_mem, &nmr->nr_memsize, &memflags);
+			if (error) {
+				nm_if_rele(ifp);
+				break;
+			}
+			if (memflags & NETMAP_MEM_PRIVATE) {
+				nmr->nr_ringid |= NETMAP_PRIV_MEM;
+				*(uint32_t *)(uintptr_t)&nifp->ni_flags |= NI_PRIV_MEM;
+			}
+			nmr->nr_offset = netmap_mem_if_offset(na->nm_mem, nifp);
+		} while (0);
+		NMG_UNLOCK();
 		break;
 
 	case NIOCUNREGIF:
@@ -1259,7 +2459,6 @@ error:
 		}
 		rmb(); /* make sure following reads are not from cache */
 
-
 		ifp = priv->np_ifp;	/* we have a reference */
 
 		if (ifp == NULL) {
@@ -1271,9 +2470,9 @@ error:
 		na = NA(ifp); /* retrieve netmap adapter */
 		if (priv->np_qfirst == NETMAP_SW_RING) { /* host rings */
 			if (cmd == NIOCTXSYNC)
-				netmap_sync_to_host(na);
+				netmap_txsync_to_host(na);
 			else
-				netmap_sync_from_host(na, NULL, NULL);
+				netmap_rxsync_from_host(na, NULL, NULL);
 			break;
 		}
 		/* find the last ring to scan */
@@ -1282,22 +2481,28 @@ error:
 			lim = (cmd == NIOCTXSYNC) ?
 			    na->num_tx_rings : na->num_rx_rings;
 
+		krings = (cmd == NIOCTXSYNC) ? na->tx_rings : na->rx_rings;
 		for (i = priv->np_qfirst; i < lim; i++) {
+			struct netmap_kring *kring = krings + i;
+			if (nm_kr_tryget(kring)) {
+				error = EBUSY;
+				goto out;
+			}
 			if (cmd == NIOCTXSYNC) {
-				struct netmap_kring *kring = &na->tx_rings[i];
 				if (netmap_verbose & NM_VERB_TXSYNC)
 					D("pre txsync ring %d cur %d hwcur %d",
 					    i, kring->ring->cur,
 					    kring->nr_hwcur);
-				na->nm_txsync(ifp, i, 1 /* do lock */);
+				na->nm_txsync(ifp, i, NAF_FORCE_RECLAIM);
 				if (netmap_verbose & NM_VERB_TXSYNC)
 					D("post txsync ring %d cur %d hwcur %d",
 					    i, kring->ring->cur,
 					    kring->nr_hwcur);
 			} else {
-				na->nm_rxsync(ifp, i, 1 /* do lock */);
+				na->nm_rxsync(ifp, i, NAF_FORCE_READ);
 				microtime(&na->rx_rings[i].ring->ts);
 			}
+			nm_kr_put(kring);
 		}
 
 		break;
@@ -1313,14 +2518,19 @@ error:
 	default:	/* allow device-specific ioctls */
 	    {
 		struct socket so;
+
 		bzero(&so, sizeof(so));
-		error = get_ifp(nmr->nr_name, &ifp); /* keep reference */
-		if (error)
+		NMG_LOCK();
+		error = get_ifp(nmr, &ifp, 0 /* don't create */); /* keep reference */
+		if (error) {
+			NMG_UNLOCK();
 			break;
+		}
 		so.so_vnet = ifp->if_vnet;
 		// so->so_proto not null.
 		error = ifioctl(&so, cmd, data, td);
 		nm_if_rele(ifp);
+		NMG_UNLOCK();
 		break;
 	    }
 
@@ -1329,6 +2539,7 @@ error:
 		error = EOPNOTSUPP;
 #endif /* linux */
 	}
+out:
 
 	CURVNET_RESTORE();
 	return (error);
@@ -1341,7 +2552,7 @@ error:
  * Can be called for one or more queues.
  * Return true the event mask corresponding to ready events.
  * If there are no ready events, do a selrecord on either individual
- * selfd or on the global one.
+ * selinfo or on the global one.
  * Device-dependent parts (locking and sync of tx/rx rings)
  * are done through callbacks.
  *
@@ -1356,12 +2567,13 @@ netmap_poll(struct cdev *dev, int events, struct thread *td)
 	struct netmap_adapter *na;
 	struct ifnet *ifp;
 	struct netmap_kring *kring;
-	u_int core_lock, i, check_all, want_tx, want_rx, revents = 0;
+	u_int i, check_all_tx, check_all_rx, want_tx, want_rx, revents = 0;
 	u_int lim_tx, lim_rx, host_forwarded = 0;
 	struct mbq q = { NULL, NULL, 0 };
-	enum {NO_CL, NEED_CL, LOCKED_CL }; /* see below */
 	void *pwait = dev;	/* linux compatibility */
 
+		int retry_tx = 1;
+
 	(void)pwait;
 
 	if (devfs_get_cdevpriv((void **)&priv) != 0 || priv == NULL)
@@ -1387,18 +2599,18 @@ netmap_poll(struct cdev *dev, int events, struct thread *td)
 
 	lim_tx = na->num_tx_rings;
 	lim_rx = na->num_rx_rings;
-	/* how many queues we are scanning */
+
 	if (priv->np_qfirst == NETMAP_SW_RING) {
+		/* handle the host stack ring */
 		if (priv->np_txpoll || want_tx) {
 			/* push any packets up, then we are always ready */
-			kring = &na->tx_rings[lim_tx];
-			netmap_sync_to_host(na);
+			netmap_txsync_to_host(na);
 			revents |= want_tx;
 		}
 		if (want_rx) {
 			kring = &na->rx_rings[lim_rx];
 			if (kring->ring->avail == 0)
-				netmap_sync_from_host(na, td, dev);
+				netmap_rxsync_from_host(na, td, dev);
 			if (kring->ring->avail > 0) {
 				revents |= want_rx;
 			}
@@ -1412,56 +2624,27 @@ netmap_poll(struct cdev *dev, int events, struct thread *td)
 			&& want_rx
 			&& (netmap_fwd || kring->ring->flags & NR_FORWARD) ) {
 		if (kring->ring->avail == 0)
-			netmap_sync_from_host(na, td, dev);
+			netmap_rxsync_from_host(na, td, dev);
 		if (kring->ring->avail > 0)
 			revents |= want_rx;
 	}
 
 	/*
-	 * check_all is set if the card has more than one queue and
+	 * check_all is set if the card has more than one queue AND
 	 * the client is polling all of them. If true, we sleep on
-	 * the "global" selfd, otherwise we sleep on individual selfd
-	 * (we can only sleep on one of them per direction).
-	 * The interrupt routine in the driver should always wake on
-	 * the individual selfd, and also on the global one if the card
-	 * has more than one ring.
-	 *
-	 * If the card has only one lock, we just use that.
-	 * If the card has separate ring locks, we just use those
-	 * unless we are doing check_all, in which case the whole
-	 * loop is wrapped by the global lock.
-	 * We acquire locks only when necessary: if poll is called
-	 * when buffers are available, we can just return without locks.
+	 * the "global" selinfo, otherwise we sleep on individual selinfo
+	 * (FreeBSD only allows two selinfo's per file descriptor).
+	 * The interrupt routine in the driver wake one or the other
+	 * (or both) depending on which clients are active.
 	 *
 	 * rxsync() is only called if we run out of buffers on a POLLIN.
 	 * txsync() is called if we run out of buffers on POLLOUT, or
 	 * there are pending packets to send. The latter can be disabled
 	 * passing NETMAP_NO_TX_POLL in the NIOCREG call.
 	 */
-	check_all = (priv->np_qlast == NETMAP_HW_RING) && (lim_tx > 1 || lim_rx > 1);
+	check_all_tx = (priv->np_qlast == NETMAP_HW_RING) && (lim_tx > 1);
+	check_all_rx = (priv->np_qlast == NETMAP_HW_RING) && (lim_rx > 1);
 
-	/*
-	 * core_lock indicates what to do with the core lock.
-	 * The core lock is used when either the card has no individual
-	 * locks, or it has individual locks but we are cheking all
-	 * rings so we need the core lock to avoid missing wakeup events.
-	 *
-	 * It has three possible states:
-	 * NO_CL	we don't need to use the core lock, e.g.
-	 *		because we are protected by individual locks.
-	 * NEED_CL	we need the core lock. In this case, when we
-	 *		call the lock routine, move to LOCKED_CL
-	 *		to remember to release the lock once done.
-	 * LOCKED_CL	core lock is set, so we need to release it.
-	 */
-	core_lock = (check_all || !na->separate_locks) ? NEED_CL : NO_CL;
-#ifdef NM_BRIDGE
-	/* the bridge uses separate locks */
-	if (na->nm_register == bdg_netmap_reg) {
-		ND("not using core lock for %s", ifp->if_xname);
-		core_lock = NO_CL;
-	}
-#endif /* NM_BRIDGE */
 	if (priv->np_qlast != NETMAP_HW_RING) {
 		lim_tx = lim_rx = priv->np_qlast;
 	}
@@ -1492,28 +2675,33 @@ netmap_poll(struct cdev *dev, int events, struct thread *td)
 	 * to avoid that the tx rings stall).
 	 */
 	if (priv->np_txpoll || want_tx) {
+		/* If we really want to be woken up (want_tx),
+		 * do a selrecord, either on the global or on
+		 * the private structure.  Then issue the txsync
+		 * so there is no race in the selrecord/selwait
+		 */
 flush_tx:
 		for (i = priv->np_qfirst; i < lim_tx; i++) {
 			kring = &na->tx_rings[i];
 			/*
-			 * Skip the current ring if want_tx == 0
+			 * Skip this ring if want_tx == 0
 			 * (we have already done a successful sync on
 			 * a previous ring) AND kring->cur == kring->hwcur
 			 * (there are no pending transmissions for this ring).
 			 */
 			if (!want_tx && kring->ring->cur == kring->nr_hwcur)
 				continue;
-			if (core_lock == NEED_CL) {
-				na->nm_lock(ifp, NETMAP_CORE_LOCK, 0);
-				core_lock = LOCKED_CL;
+			/* make sure only one user thread is doing this */
+			if (nm_kr_tryget(kring)) {
+				ND("ring %p busy is %d", kring, (int)kring->nr_busy);
+				revents |= POLLERR;
+				goto out;
 			}
-			if (na->separate_locks)
-				na->nm_lock(ifp, NETMAP_TX_LOCK, i);
+
 			if (netmap_verbose & NM_VERB_TXSYNC)
 				D("send %d on %s %d",
-					kring->ring->cur,
-					ifp->if_xname, i);
-			if (na->nm_txsync(ifp, i, 0 /* no lock */))
+					kring->ring->cur, ifp->if_xname, i);
+			if (na->nm_txsync(ifp, i, 0))
 				revents |= POLLERR;
 
 			/* Check avail/call selrecord only if called with POLLOUT */
@@ -1524,11 +2712,15 @@ flush_tx:
 					 */
 					revents |= want_tx;
 					want_tx = 0;
-				} else if (!check_all)
-					selrecord(td, &kring->si);
+				}
 			}
-			if (na->separate_locks)
-				na->nm_lock(ifp, NETMAP_TX_UNLOCK, i);
+			nm_kr_put(kring);
+		}
+		if (want_tx && retry_tx) {
+			selrecord(td, check_all_tx ?
+			    &na->tx_si : &na->tx_rings[priv->np_qfirst].si);
+			retry_tx = 0;
+			goto flush_tx;
 		}
 	}
 
@@ -1537,110 +2729,70 @@ flush_tx:
 	 * Do it on all rings because otherwise we starve.
 	 */
 	if (want_rx) {
+		int retry_rx = 1;
+do_retry_rx:
 		for (i = priv->np_qfirst; i < lim_rx; i++) {
 			kring = &na->rx_rings[i];
-			if (core_lock == NEED_CL) {
-				na->nm_lock(ifp, NETMAP_CORE_LOCK, 0);
-				core_lock = LOCKED_CL;
+
+			if (nm_kr_tryget(kring)) {
+				revents |= POLLERR;
+				goto out;
 			}
-			if (na->separate_locks)
-				na->nm_lock(ifp, NETMAP_RX_LOCK, i);
+
+			/* XXX NR_FORWARD should only be read on
+			 * physical or NIC ports
+			 */
 			if (netmap_fwd ||kring->ring->flags & NR_FORWARD) {
 				ND(10, "forwarding some buffers up %d to %d",
 				    kring->nr_hwcur, kring->ring->cur);
 				netmap_grab_packets(kring, &q, netmap_fwd);
 			}
 
-			if (na->nm_rxsync(ifp, i, 0 /* no lock */))
+			if (na->nm_rxsync(ifp, i, 0))
 				revents |= POLLERR;
 			if (netmap_no_timestamp == 0 ||
 					kring->ring->flags & NR_TIMESTAMP) {
 				microtime(&kring->ring->ts);
 			}
 
-			if (kring->ring->avail > 0)
+			if (kring->ring->avail > 0) {
 				revents |= want_rx;
-			else if (!check_all)
-				selrecord(td, &kring->si);
-			if (na->separate_locks)
-				na->nm_lock(ifp, NETMAP_RX_UNLOCK, i);
+				retry_rx = 0;
+			}
+			nm_kr_put(kring);
+		}
+		if (retry_rx) {
+			retry_rx = 0;
+			selrecord(td, check_all_rx ?
+			    &na->rx_si : &na->rx_rings[priv->np_qfirst].si);
+			goto do_retry_rx;
 		}
-	}
-	if (check_all && revents == 0) { /* signal on the global queue */
-		if (want_tx)
-			selrecord(td, &na->tx_si);
-		if (want_rx)
-			selrecord(td, &na->rx_si);
 	}
 
-	/* forward host to the netmap ring */
+	/* forward host to the netmap ring.
+	 * I am accessing nr_hwavail without lock, but netmap_transmit
+	 * can only increment it, so the operation is safe.
+	 */
 	kring = &na->rx_rings[lim_rx];
-	if (kring->nr_hwavail > 0)
-		ND("host rx %d has %d packets", lim_rx, kring->nr_hwavail);
 	if ( (priv->np_qlast == NETMAP_HW_RING) // XXX check_all
 			&& (netmap_fwd || kring->ring->flags & NR_FORWARD)
 			 && kring->nr_hwavail > 0 && !host_forwarded) {
-		if (core_lock == NEED_CL) {
-			na->nm_lock(ifp, NETMAP_CORE_LOCK, 0);
-			core_lock = LOCKED_CL;
-		}
 		netmap_sw_to_nic(na);
 		host_forwarded = 1; /* prevent another pass */
 		want_rx = 0;
 		goto flush_tx;
 	}
 
-	if (core_lock == LOCKED_CL)
-		na->nm_lock(ifp, NETMAP_CORE_UNLOCK, 0);
 	if (q.head)
 		netmap_send_up(na->ifp, q.head);
 
+out:
+
 	return (revents);
 }
 
 /*------- driver support routines ------*/
 
-/*
- * default lock wrapper.
- */
-static void
-netmap_lock_wrapper(struct ifnet *dev, int what, u_int queueid)
-{
-	struct netmap_adapter *na = NA(dev);
-
-	switch (what) {
-#ifdef linux	/* some system do not need lock on register */
-	case NETMAP_REG_LOCK:
-	case NETMAP_REG_UNLOCK:
-		break;
-#endif /* linux */
-
-	case NETMAP_CORE_LOCK:
-		mtx_lock(&na->core_lock);
-		break;
-
-	case NETMAP_CORE_UNLOCK:
-		mtx_unlock(&na->core_lock);
-		break;
-
-	case NETMAP_TX_LOCK:
-		mtx_lock(&na->tx_rings[queueid].q_lock);
-		break;
-
-	case NETMAP_TX_UNLOCK:
-		mtx_unlock(&na->tx_rings[queueid].q_lock);
-		break;
-
-	case NETMAP_RX_LOCK:
-		mtx_lock(&na->rx_rings[queueid].q_lock);
-		break;
-
-	case NETMAP_RX_UNLOCK:
-		mtx_unlock(&na->rx_rings[queueid].q_lock);
-		break;
-	}
-}
-
 
 /*
  * Initialize a ``netmap_adapter`` object created by driver on attach.
@@ -1657,14 +2809,17 @@ netmap_lock_wrapper(struct ifnet *dev, int what, u_int queueid)
  * setups.
  */
 int
-netmap_attach(struct netmap_adapter *arg, int num_queues)
+netmap_attach(struct netmap_adapter *arg, u_int num_queues)
 {
 	struct netmap_adapter *na = NULL;
 	struct ifnet *ifp = arg ? arg->ifp : NULL;
+	size_t len;
 
 	if (arg == NULL || ifp == NULL)
 		goto fail;
-	na = malloc(sizeof(*na), M_DEVBUF, M_NOWAIT | M_ZERO);
+	/* a VALE port uses two endpoints */
+	len = nma_is_vp(arg) ? sizeof(*na) : sizeof(*na) * 2;
+	na = malloc(len, M_DEVBUF, M_NOWAIT | M_ZERO);
 	if (na == NULL)
 		goto fail;
 	WNA(ifp) = na;
@@ -1676,23 +2831,21 @@ netmap_attach(struct netmap_adapter *arg, int num_queues)
 	na->refcount = na->na_single = na->na_multi = 0;
 	/* Core lock initialized here, others after netmap_if_new. */
 	mtx_init(&na->core_lock, "netmap core lock", MTX_NETWORK_LOCK, MTX_DEF);
-	if (na->nm_lock == NULL) {
-		ND("using default locks for %s", ifp->if_xname);
-		na->nm_lock = netmap_lock_wrapper;
-	}
-
 #ifdef linux
-	if (!ifp->netdev_ops) {
-		D("ouch, we cannot override netdev_ops");
-		goto fail;
+	if (ifp->netdev_ops) {
+		ND("netdev_ops %p", ifp->netdev_ops);
+		/* prepare a clone of the netdev ops */
+#if LINUX_VERSION_CODE < KERNEL_VERSION(2, 6, 28)
+		na->nm_ndo.ndo_start_xmit = ifp->netdev_ops;
+#else
+		na->nm_ndo = *ifp->netdev_ops;
+#endif
 	}
-#if LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 28)
-	/* if needed, prepare a clone of the entire netdev ops */
-	na->nm_ndo = *ifp->netdev_ops;
-#endif /* 2.6.28 and above */
-	na->nm_ndo.ndo_start_xmit = linux_netmap_start;
+	na->nm_ndo.ndo_start_xmit = linux_netmap_start_xmit;
 #endif /* linux */
-
+	na->nm_mem = arg->nm_mem ? arg->nm_mem : &nm_mem;
+	if (!nma_is_vp(arg))
+		netmap_attach_sw(ifp);
 	D("success for %s", ifp->if_xname);
 	return 0;
 
@@ -1721,57 +2874,112 @@ netmap_detach(struct ifnet *ifp)
 		D("freeing leftover tx_rings");
 		free(na->tx_rings, M_DEVBUF);
 	}
+	if (na->na_flags & NAF_MEM_OWNER)
+		netmap_mem_private_delete(na->nm_mem);
 	bzero(na, sizeof(*na));
 	WNA(ifp) = NULL;
 	free(na, M_DEVBUF);
 }
 
 
+int
+nm_bdg_flush(struct nm_bdg_fwd *ft, u_int n,
+	struct netmap_adapter *na, u_int ring_nr);
+
+
 /*
  * Intercept packets from the network stack and pass them
  * to netmap as incoming packets on the 'software' ring.
- * We are not locked when called.
+ * We rely on the OS to make sure that the ifp and na do not go
+ * away (typically the caller checks for IFF_DRV_RUNNING or the like).
+ * In nm_register() or whenever there is a reinitialization,
+ * we make sure to access the core lock and per-ring locks
+ * so that IFCAP_NETMAP is visible here.
  */
 int
-netmap_start(struct ifnet *ifp, struct mbuf *m)
+netmap_transmit(struct ifnet *ifp, struct mbuf *m)
 {
 	struct netmap_adapter *na = NA(ifp);
-	struct netmap_kring *kring = &na->rx_rings[na->num_rx_rings];
+	struct netmap_kring *kring;
 	u_int i, len = MBUF_LEN(m);
-	u_int error = EBUSY, lim = kring->nkr_num_slots - 1;
+	u_int error = EBUSY, lim;
 	struct netmap_slot *slot;
 
+	// XXX [Linux] we do not need this lock
+	// if we follow the down/configure/up protocol -gl
+	// mtx_lock(&na->core_lock);
+	if ( (ifp->if_capenable & IFCAP_NETMAP) == 0) {
+		/* interface not in netmap mode anymore */
+		error = ENXIO;
+		goto done;
+	}
+
+	kring = &na->rx_rings[na->num_rx_rings];
+	lim = kring->nkr_num_slots - 1;
 	if (netmap_verbose & NM_VERB_HOST)
 		D("%s packet %d len %d from the stack", ifp->if_xname,
 			kring->nr_hwcur + kring->nr_hwavail, len);
-	if (len > NETMAP_BUF_SIZE) { /* too long for us */
+	// XXX reconsider long packets if we handle fragments
+	if (len > NETMAP_BDG_BUF_SIZE(na->nm_mem)) { /* too long for us */
 		D("%s from_host, drop packet size %d > %d", ifp->if_xname,
-			len, NETMAP_BUF_SIZE);
-		m_freem(m);
-		return EINVAL;
+			len, NETMAP_BDG_BUF_SIZE(na->nm_mem));
+		goto done;
+	}
+	if (SWNA(ifp)->na_bdg) {
+		struct nm_bdg_fwd *ft;
+		char *dst;
+
+		na = SWNA(ifp); /* we operate on the host port */
+		ft = na->rx_rings[0].nkr_ft;
+		dst = BDG_NMB(na->nm_mem, &na->rx_rings[0].ring->slot[0]);
+
+		/* use slot 0 in the ft, there is nothing queued here */
+		/* XXX we can save the copy calling m_copydata in nm_bdg_flush,
+		 * need a special flag for this.
+		 */
+		m_copydata(m, 0, (int)len, dst);
+		ft->ft_flags = 0;
+		ft->ft_len = len;
+		ft->ft_buf = dst;
+		ft->ft_next = NM_FT_NULL;
+		ft->ft_frags = 1;
+		if (netmap_verbose & NM_VERB_HOST)
+			RD(5, "pkt %p size %d to bridge port %d",
+				dst, len, na->bdg_port);
+		nm_bdg_flush(ft, 1, na, 0);
+		na = NA(ifp);	/* back to the regular object/lock */
+		error = 0;
+		goto done;
 	}
-	na->nm_lock(ifp, NETMAP_CORE_LOCK, 0);
+
+	/* protect against other instances of netmap_transmit,
+	 * and userspace invocations of rxsync().
+	 * XXX could reuse core_lock
+	 */
+	// XXX [Linux] there can be no other instances of netmap_transmit
+	// on this same ring, but we still need this lock to protect
+	// concurrent access from netmap_sw_to_nic() -gl
+	mtx_lock(&kring->q_lock);
 	if (kring->nr_hwavail >= lim) {
 		if (netmap_verbose)
 			D("stack ring %s full\n", ifp->if_xname);
-		goto done;	/* no space */
+	} else {
+		/* compute the insert position */
+		i = nm_kr_rxpos(kring);
+		slot = &kring->ring->slot[i];
+		m_copydata(m, 0, (int)len, BDG_NMB(na->nm_mem, slot));
+		slot->len = len;
+		slot->flags = kring->nkr_slot_flags;
+		kring->nr_hwavail++;
+		if (netmap_verbose  & NM_VERB_HOST)
+			D("wake up host ring %s %d", na->ifp->if_xname, na->num_rx_rings);
+		selwakeuppri(&kring->si, PI_NET);
+		error = 0;
 	}
+	mtx_unlock(&kring->q_lock);
 
-	/* compute the insert position */
-	i = kring->nr_hwcur + kring->nr_hwavail;
-	if (i > lim)
-		i -= lim + 1;
-	slot = &kring->ring->slot[i];
-	m_copydata(m, 0, len, NMB(slot));
-	slot->len = len;
-	slot->flags = kring->nkr_slot_flags;
-	kring->nr_hwavail++;
-	if (netmap_verbose  & NM_VERB_HOST)
-		D("wake up host ring %s %d", na->ifp->if_xname, na->num_rx_rings);
-	selwakeuppri(&kring->si, PI_NET);
-	error = 0;
 done:
-	na->nm_lock(ifp, NETMAP_CORE_UNLOCK, 0);
+	// mtx_unlock(&na->core_lock);
 
 	/* release the mbuf in either cases of success or failure. As an
 	 * alternative, put the mbuf in a free list and free the list
@@ -1789,17 +2997,29 @@ done:
  * If netmap mode is not set just return NULL.
  */
 struct netmap_slot *
-netmap_reset(struct netmap_adapter *na, enum txrx tx, int n,
+netmap_reset(struct netmap_adapter *na, enum txrx tx, u_int n,
 	u_int new_cur)
 {
 	struct netmap_kring *kring;
 	int new_hwofs, lim;
 
-	if (na == NULL)
+	if (na == NULL) {
+		D("NULL na, should not happen");
 		return NULL;	/* no netmap support here */
-	if (!(na->ifp->if_capenable & IFCAP_NETMAP))
+	}
+	if (!(na->ifp->if_capenable & IFCAP_NETMAP)) {
+		ND("interface not in netmap mode");
 		return NULL;	/* nothing to reinitialize */
+	}
 
+	/* XXX note- in the new scheme, we are not guaranteed to be
+	 * under lock (e.g. when called on a device reset).
+	 * In this case, we should set a flag and do not trust too
+	 * much the values. In practice: TODO
+	 * - set a RESET flag somewhere in the kring
+	 * - do the processing in a conservative way
+	 * - let the *sync() fixup at the end.
+	 */
 	if (tx == NR_TX) {
 		if (n >= na->num_tx_rings)
 			return NULL;
@@ -1815,13 +3035,15 @@ netmap_reset(struct netmap_adapter *na, enum txrx tx, int n,
 	if (new_hwofs > lim)
 		new_hwofs -= lim + 1;
 
-	/* Alwayws set the new offset value and realign the ring. */
+	/* Always set the new offset value and realign the ring. */
+	D("%s hwofs %d -> %d, hwavail %d -> %d",
+		tx == NR_TX ? "TX" : "RX",
+		kring->nkr_hwofs, new_hwofs,
+		kring->nr_hwavail,
+		tx == NR_TX ? lim : kring->nr_hwavail);
 	kring->nkr_hwofs = new_hwofs;
 	if (tx == NR_TX)
-		kring->nr_hwavail = kring->nkr_num_slots - 1;
-	ND(10, "new hwofs %d on %s %s[%d]",
-			kring->nkr_hwofs, na->ifp->if_xname,
-			tx == NR_TX ? "TX" : "RX", n);
+		kring->nr_hwavail = lim;
 
 #if 0 // def linux
 	/* XXX check that the mappings are correct */
@@ -1834,7 +3056,7 @@ netmap_reset(struct netmap_adapter *na, enum txrx tx, int n,
 
 #endif /* linux */
 	/*
-	 * Wakeup on the individual and global lock
+	 * Wakeup on the individual and global selwait
 	 * We do the wakeup here, but the ring is not yet reconfigured.
 	 * However, we are under lock so there are no races.
 	 */
@@ -1845,37 +3067,152 @@ netmap_reset(struct netmap_adapter *na, enum txrx tx, int n,
 
 
 /*
- * Default functions to handle rx/tx interrupts
- * we have 4 cases:
- * 1 ring, single lock:
- *	lock(core); wake(i=0); unlock(core)
- * N rings, single lock:
- *	lock(core); wake(i); wake(N+1) unlock(core)
- * 1 ring, separate locks: (i=0)
- *	lock(i); wake(i); unlock(i)
- * N rings, separate locks:
- *	lock(i); wake(i); unlock(i); lock(core) wake(N+1) unlock(core)
- * work_done is non-null on the RX path.
+ * Grab packets from a kring, move them into the ft structure
+ * associated to the tx (input) port. Max one instance per port,
+ * filtered on input (ioctl, poll or XXX).
+ * Returns the next position in the ring.
+ */
+static int
+nm_bdg_preflush(struct netmap_adapter *na, u_int ring_nr,
+	struct netmap_kring *kring, u_int end)
+{
+	struct netmap_ring *ring = kring->ring;
+	struct nm_bdg_fwd *ft;
+	u_int j = kring->nr_hwcur, lim = kring->nkr_num_slots - 1;
+	u_int ft_i = 0;	/* start from 0 */
+	u_int frags = 1; /* how many frags ? */
+	struct nm_bridge *b = na->na_bdg;
+
+	/* To protect against modifications to the bridge we acquire a
+	 * shared lock, waiting if we can sleep (if the source port is
+	 * attached to a user process) or with a trylock otherwise (NICs).
+	 */
+	ND("wait rlock for %d packets", ((j > end ? lim+1 : 0) + end) - j);
+	if (na->na_flags & NAF_BDG_MAYSLEEP)
+		BDG_RLOCK(b);
+	else if (!BDG_RTRYLOCK(b))
+		return 0;
+	ND(5, "rlock acquired for %d packets", ((j > end ? lim+1 : 0) + end) - j);
+	ft = kring->nkr_ft;
+
+	for (; likely(j != end); j = nm_next(j, lim)) {
+		struct netmap_slot *slot = &ring->slot[j];
+		char *buf;
+
+		ft[ft_i].ft_len = slot->len;
+		ft[ft_i].ft_flags = slot->flags;
+
+		ND("flags is 0x%x", slot->flags);
+		/* this slot goes into a list so initialize the link field */
+		ft[ft_i].ft_next = NM_FT_NULL;
+		buf = ft[ft_i].ft_buf = (slot->flags & NS_INDIRECT) ?
+			(void *)(uintptr_t)slot->ptr : BDG_NMB(na->nm_mem, slot);
+		prefetch(buf);
+		++ft_i;
+		if (slot->flags & NS_MOREFRAG) {
+			frags++;
+			continue;
+		}
+		if (unlikely(netmap_verbose && frags > 1))
+			RD(5, "%d frags at %d", frags, ft_i - frags);
+		ft[ft_i - frags].ft_frags = frags;
+		frags = 1;
+		if (unlikely((int)ft_i >= bridge_batch))
+			ft_i = nm_bdg_flush(ft, ft_i, na, ring_nr);
+	}
+	if (frags > 1) {
+		D("truncate incomplete fragment at %d (%d frags)", ft_i, frags);
+		// ft_i > 0, ft[ft_i-1].flags has NS_MOREFRAG
+		ft[ft_i - 1].ft_frags &= ~NS_MOREFRAG;
+		ft[ft_i - frags].ft_frags = frags - 1;
+	}
+	if (ft_i)
+		ft_i = nm_bdg_flush(ft, ft_i, na, ring_nr);
+	BDG_RUNLOCK(b);
+	return j;
+}
+
+
+/*
+ * Pass packets from nic to the bridge.
+ * XXX TODO check locking: this is called from the interrupt
+ * handler so we should make sure that the interface is not
+ * disconnected while passing down an interrupt.
  *
- * The 'q' argument also includes flag to tell whether the queue is
- * already locked on enter, and whether it should remain locked on exit.
- * This helps adapting to different defaults in drivers and OSes.
+ * Note, no user process can access this NIC so we can ignore
+ * the info in the 'ring'.
+ */
+static void
+netmap_nic_to_bdg(struct ifnet *ifp, u_int ring_nr)
+{
+	struct netmap_adapter *na = NA(ifp);
+	struct netmap_kring *kring = &na->rx_rings[ring_nr];
+	struct netmap_ring *ring = kring->ring;
+	u_int j, k;
+
+	/* make sure that only one thread is ever in here,
+	 * after which we can unlock. Probably unnecessary XXX.
+	 */
+	if (nm_kr_tryget(kring)) 
+		return;
+	/* fetch packets that have arrived.
+	 * XXX maybe do this in a loop ?
+	 */
+	if (na->nm_rxsync(ifp, ring_nr, 0))
+		goto put_out;
+	if (kring->nr_hwavail == 0 && netmap_verbose) {
+		D("how strange, interrupt with no packets on %s",
+			ifp->if_xname);
+		goto put_out;
+	}
+	k = nm_kr_rxpos(kring);
+
+	j = nm_bdg_preflush(na, ring_nr, kring, k);
+
+	/* we consume everything, but we cannot update kring directly
+	 * because the nic may have destroyed the info in the NIC ring.
+	 * So we need to call rxsync again to restore it.
+	 */
+	ring->cur = j;
+	ring->avail = 0;
+	na->nm_rxsync(ifp, ring_nr, 0);
+
+put_out:
+	nm_kr_put(kring);
+	return;
+}
+
+
+/*
+ * Default functions to handle rx/tx interrupts from a physical device.
+ * "work_done" is non-null on the RX path, NULL for the TX path.
+ * We rely on the OS to make sure that there is only one active
+ * instance per queue, and that there is appropriate locking.
+ *
+ * If the card is not in netmap mode, simply return 0,
+ * so that the caller proceeds with regular processing.
+ *
+ * If the card is connected to a netmap file descriptor,
+ * do a selwakeup on the individual queue, plus one on the global one
+ * if needed (multiqueue card _and_ there are multiqueue listeners),
+ * and return 1.
+ *
+ * Finally, if called on rx from an interface connected to a switch,
+ * calls the proper forwarding routine, and return 1.
  */
 int
-netmap_rx_irq(struct ifnet *ifp, int q, int *work_done)
+netmap_rx_irq(struct ifnet *ifp, u_int q, u_int *work_done)
 {
 	struct netmap_adapter *na;
-	struct netmap_kring *r;
-	NM_SELINFO_T *main_wq;
-	int locktype, unlocktype, lock;
+	struct netmap_kring *kring;
 
 	if (!(ifp->if_capenable & IFCAP_NETMAP))
 		return 0;
 
-	lock = q & (NETMAP_LOCKED_ENTER | NETMAP_LOCKED_EXIT);
-	q = q & NETMAP_RING_MASK;
+	q &= NETMAP_RING_MASK;
 
-	ND(5, "received %s queue %d", work_done ? "RX" : "TX" , q);
+	if (netmap_verbose)
+		RD(5, "received %s queue %d", work_done ? "RX" : "TX" , q);
 	na = NA(ifp);
 	if (na->na_flags & NAF_SKIP_INTR) {
 		ND("use regular interrupt");
@@ -1885,49 +3222,31 @@ netmap_rx_irq(struct ifnet *ifp, int q, int *work_done)
 	if (work_done) { /* RX path */
 		if (q >= na->num_rx_rings)
 			return 0;	// not a physical queue
-		r = na->rx_rings + q;
-		r->nr_kflags |= NKR_PENDINTR;
-		main_wq = (na->num_rx_rings > 1) ? &na->rx_si : NULL;
-		locktype = NETMAP_RX_LOCK;
-		unlocktype = NETMAP_RX_UNLOCK;
+		kring = na->rx_rings + q;
+		kring->nr_kflags |= NKR_PENDINTR;	// XXX atomic ?
+		if (na->na_bdg != NULL) {
+			netmap_nic_to_bdg(ifp, q);
+		} else {
+			selwakeuppri(&kring->si, PI_NET);
+			if (na->num_rx_rings > 1 /* or multiple listeners */ )
+				selwakeuppri(&na->rx_si, PI_NET);
+		}
+		*work_done = 1; /* do not fire napi again */
 	} else { /* TX path */
 		if (q >= na->num_tx_rings)
 			return 0;	// not a physical queue
-		r = na->tx_rings + q;
-		main_wq = (na->num_tx_rings > 1) ? &na->tx_si : NULL;
-		work_done = &q; /* dummy */
-		locktype = NETMAP_TX_LOCK;
-		unlocktype = NETMAP_TX_UNLOCK;
-	}
-	if (na->separate_locks) {
-		if (!(lock & NETMAP_LOCKED_ENTER))
-			na->nm_lock(ifp, locktype, q);
-		selwakeuppri(&r->si, PI_NET);
-		na->nm_lock(ifp, unlocktype, q);
-		if (main_wq) {
-			na->nm_lock(ifp, NETMAP_CORE_LOCK, 0);
-			selwakeuppri(main_wq, PI_NET);
-			na->nm_lock(ifp, NETMAP_CORE_UNLOCK, 0);
-		}
-		/* lock the queue again if requested */
-		if (lock & NETMAP_LOCKED_EXIT)
-			na->nm_lock(ifp, locktype, q);
-	} else {
-		if (!(lock & NETMAP_LOCKED_ENTER))
-			na->nm_lock(ifp, NETMAP_CORE_LOCK, 0);
-		selwakeuppri(&r->si, PI_NET);
-		if (main_wq)
-			selwakeuppri(main_wq, PI_NET);
-		if (!(lock & NETMAP_LOCKED_EXIT))
-			na->nm_lock(ifp, NETMAP_CORE_UNLOCK, 0);
+		kring = na->tx_rings + q;
+		selwakeuppri(&kring->si, PI_NET);
+		if (na->num_tx_rings > 1 /* or multiple listeners */ )
+			selwakeuppri(&na->tx_si, PI_NET);
 	}
-	*work_done = 1; /* do not fire napi again */
 	return 1;
 }
 
 
 #ifdef linux	/* linux-specific routines */
 
+
 /*
  * Remap linux arguments into the FreeBSD call.
  * - pwait is the poll table, passed as 'dev';
@@ -1950,14 +3269,14 @@ linux_netmap_poll(struct file * file, struct poll_table_struct *pwait)
 	return netmap_poll((void *)pwait, events, (void *)file);
 }
 
+
 static int
 linux_netmap_mmap(struct file *f, struct vm_area_struct *vma)
 {
-	int lut_skip, i, j;
-	int user_skip = 0;
-	struct lut_entry *l_entry;
 	int error = 0;
-	unsigned long off, tomap;
+	unsigned long off, va;
+	vm_ooffset_t pa;
+	struct netmap_priv_d *priv = f->private_data;
 	/*
 	 * vma->vm_start: start of mapping user address space
 	 * vma->vm_end: end of the mapping user address space
@@ -1966,68 +3285,45 @@ linux_netmap_mmap(struct file *f, struct vm_area_struct *vma)
 
 	// XXX security checks
 
-	error = netmap_get_memory(f->private_data);
+	error = netmap_get_memory(priv);
 	ND("get_memory returned %d", error);
 	if (error)
 	    return -error;
 
-	off = vma->vm_pgoff << PAGE_SHIFT; /* offset in bytes */
-	tomap = vma->vm_end - vma->vm_start;
-	for (i = 0; i < NETMAP_POOLS_NR; i++) {  /* loop through obj_pools */
-		const struct netmap_obj_pool *p = &nm_mem.pools[i];
-		/*
-		 * In each pool memory is allocated in clusters
-		 * of size _clustsize, each containing clustentries
-		 * entries. For each object k we already store the
-		 * vtophys mapping in lut[k] so we use that, scanning
-		 * the lut[] array in steps of clustentries,
-		 * and we map each cluster (not individual pages,
-		 * it would be overkill -- XXX slow ? 20130415).
-		 */
-
-		/*
-		 * We interpret vm_pgoff as an offset into the whole
-		 * netmap memory, as if all clusters where contiguous.
-		 */
-		for (lut_skip = 0, j = 0; j < p->_numclusters; j++, lut_skip += p->clustentries) {
-			unsigned long paddr, mapsize;
-			if (p->_clustsize <= off) {
-				off -= p->_clustsize;
-				continue;
-			}
-			l_entry = &p->lut[lut_skip]; /* first obj in the cluster */
-			paddr = l_entry->paddr + off;
-			mapsize = p->_clustsize - off;
-			off = 0;
-			if (mapsize > tomap)
-				mapsize = tomap;
-			ND("remap_pfn_range(%lx, %lx, %lx)",
-				vma->vm_start + user_skip,
-				paddr >> PAGE_SHIFT, mapsize);
-			if (remap_pfn_range(vma, vma->vm_start + user_skip,
-					paddr >> PAGE_SHIFT, mapsize,
-					vma->vm_page_prot))
-				return -EAGAIN; // XXX check return value
-			user_skip += mapsize;
-			tomap -= mapsize;
-			if (tomap == 0)
-				goto done;
-		}
+	if ((vma->vm_start & ~PAGE_MASK) || (vma->vm_end & ~PAGE_MASK)) {
+		ND("vm_start = %lx vm_end = %lx", vma->vm_start, vma->vm_end);
+		return -EINVAL;
 	}
-done:
 
+	for (va = vma->vm_start, off = vma->vm_pgoff;
+	     va < vma->vm_end;
+	     va += PAGE_SIZE, off++)
+	{
+		pa = netmap_mem_ofstophys(priv->np_mref, off << PAGE_SHIFT);
+		if (pa == 0) 
+			return -EINVAL;
+	
+		ND("va %lx pa %p", va, pa);	
+		error = remap_pfn_range(vma, va, pa >> PAGE_SHIFT, PAGE_SIZE, vma->vm_page_prot);
+		if (error) 
+			return error;
+	}
 	return 0;
 }
 
+
+/*
+ * This one is probably already protected by the netif lock XXX
+ */
 static netdev_tx_t
-linux_netmap_start(struct sk_buff *skb, struct net_device *dev)
+linux_netmap_start_xmit(struct sk_buff *skb, struct net_device *dev)
 {
-	netmap_start(dev, skb);
+	netmap_transmit(dev, skb);
 	return (NETDEV_TX_OK);
 }
 
 
-#if LINUX_VERSION_CODE < KERNEL_VERSION(2,6,37)	// XXX was 38
+#if LINUX_VERSION_CODE < KERNEL_VERSION(2,6,36)	// XXX was 37
 #define LIN_IOCTL_NAME	.ioctl
 int
 linux_netmap_ioctl(struct inode *inode, struct file *file, u_int cmd, u_long data /* arg */)
@@ -2041,6 +3337,9 @@ linux_netmap_ioctl(struct file *file, u_int cmd, u_long data /* arg */)
 	struct nmreq nmr;
 	bzero(&nmr, sizeof(nmr));
 
+	if (cmd == NIOCTXSYNC || cmd == NIOCRXSYNC) {
+		data = 0;	/* no argument required here */
+	}
 	if (data && copy_from_user(&nmr, (void *)data, sizeof(nmr) ) != 0)
 		return -EFAULT;
 	ret = netmap_ioctl(NULL, cmd, (caddr_t)&nmr, 0, (void *)file);
@@ -2059,6 +3358,7 @@ netmap_release(struct inode *inode, struct file *file)
 	return (0);
 }
 
+
 static int
 linux_netmap_open(struct inode *inode, struct file *file)
 {
@@ -2075,7 +3375,9 @@ linux_netmap_open(struct inode *inode, struct file *file)
 	return (0);
 }
 
+
 static struct file_operations netmap_fops = {
+    .owner = THIS_MODULE,
     .open = linux_netmap_open,
     .mmap = linux_netmap_mmap,
     LIN_IOCTL_NAME = linux_netmap_ioctl,
@@ -2083,6 +3385,7 @@ static struct file_operations netmap_fops = {
     .release = netmap_release,
 };
 
+
 static struct miscdevice netmap_cdevsw = {	/* same name as FreeBSD */
 	MISC_DYNAMIC_MINOR,
 	"netmap",
@@ -2092,6 +3395,7 @@ static struct miscdevice netmap_cdevsw = {	/* same name as FreeBSD */
 static int netmap_init(void);
 static void netmap_fini(void);
 
+
 /* Errors have negative values on linux */
 static int linux_netmap_init(void)
 {
@@ -2111,6 +3415,10 @@ EXPORT_SYMBOL(netmap_reset);		// ring init routines
 EXPORT_SYMBOL(netmap_buf_size);
 EXPORT_SYMBOL(netmap_rx_irq);		// default irq handler
 EXPORT_SYMBOL(netmap_no_pendintr);	// XXX mitigation - should go away
+EXPORT_SYMBOL(netmap_bdg_ctl);		// bridge configuration routine
+EXPORT_SYMBOL(netmap_bdg_learning);	// the default lookup function
+EXPORT_SYMBOL(netmap_disable_all_rings);
+EXPORT_SYMBOL(netmap_enable_all_rings);
 
 
 MODULE_AUTHOR("http://info.iet.unipi.it/~luigi/netmap/");
@@ -2119,11 +3427,11 @@ MODULE_LICENSE("Dual BSD/GPL"); /* the code here is all BSD. */
 
 #else /* __FreeBSD__ */
 
+
 static struct cdevsw netmap_cdevsw = {
 	.d_version = D_VERSION,
 	.d_name = "netmap",
 	.d_open = netmap_open,
-	.d_mmap = netmap_mmap,
 	.d_mmap_single = netmap_mmap_single,
 	.d_ioctl = netmap_ioctl,
 	.d_poll = netmap_poll,
@@ -2131,7 +3439,6 @@ static struct cdevsw netmap_cdevsw = {
 };
 #endif /* __FreeBSD__ */
 
-#ifdef NM_BRIDGE
 /*
  *---- support for virtual bridge -----
  */
@@ -2180,234 +3487,445 @@ nm_bridge_rthash(const uint8_t *addr)
 static int
 bdg_netmap_reg(struct ifnet *ifp, int onoff)
 {
-	int i, err = 0;
-	struct nm_bridge *b = ifp->if_bridge;
-
-	BDG_LOCK(b);
+	/* the interface is already attached to the bridge,
+	 * so we only need to toggle IFCAP_NETMAP.
+	 */
 	if (onoff) {
-		/* the interface must be already in the list.
-		 * only need to mark the port as active
-		 */
-		ND("should attach %s to the bridge", ifp->if_xname);
-		for (i=0; i < NM_BDG_MAXPORTS; i++)
-			if (b->bdg_ports[i] == ifp)
-				break;
-		if (i == NM_BDG_MAXPORTS) {
-			D("no more ports available");
-			err = EINVAL;
-			goto done;
-		}
-		ND("setting %s in netmap mode", ifp->if_xname);
 		ifp->if_capenable |= IFCAP_NETMAP;
-		NA(ifp)->bdg_port = i;
-		b->act_ports |= (1<<i);
-		b->bdg_ports[i] = ifp;
 	} else {
-		/* should be in the list, too -- remove from the mask */
-		ND("removing %s from netmap mode", ifp->if_xname);
 		ifp->if_capenable &= ~IFCAP_NETMAP;
-		i = NA(ifp)->bdg_port;
-		b->act_ports &= ~(1<<i);
 	}
-done:
-	BDG_UNLOCK(b);
-	return err;
+	return 0;
 }
 
 
-static int
-nm_bdg_flush(struct nm_bdg_fwd *ft, int n, struct ifnet *ifp)
+/*
+ * Lookup function for a learning bridge.
+ * Update the hash table with the source address,
+ * and then returns the destination port index, and the
+ * ring in *dst_ring (at the moment, always use ring 0)
+ */
+u_int
+netmap_bdg_learning(char *buf, u_int buf_len, uint8_t *dst_ring,
+		struct netmap_adapter *na)
 {
-	int i, ifn;
-	uint64_t all_dst, dst;
+	struct nm_hash_ent *ht = na->na_bdg->ht;
 	uint32_t sh, dh;
-	uint64_t mysrc = 1 << NA(ifp)->bdg_port;
+	u_int dst, mysrc = na->bdg_port;
 	uint64_t smac, dmac;
-	struct netmap_slot *slot;
-	struct nm_bridge *b = ifp->if_bridge;
 
-	ND("prepare to send %d packets, act_ports 0x%x", n, b->act_ports);
-	/* only consider valid destinations */
-	all_dst = (b->act_ports & ~mysrc);
-	/* first pass: hash and find destinations */
-	for (i = 0; likely(i < n); i++) {
-		uint8_t *buf = ft[i].buf;
-		dmac = le64toh(*(uint64_t *)(buf)) & 0xffffffffffff;
-		smac = le64toh(*(uint64_t *)(buf + 4));
-		smac >>= 16;
-		if (unlikely(netmap_verbose)) {
-		    uint8_t *s = buf+6, *d = buf;
-		    D("%d len %4d %02x:%02x:%02x:%02x:%02x:%02x -> %02x:%02x:%02x:%02x:%02x:%02x",
-			i,
-			ft[i].len,
-			s[0], s[1], s[2], s[3], s[4], s[5],
-			d[0], d[1], d[2], d[3], d[4], d[5]);
+	if (buf_len < 14) {
+		D("invalid buf length %d", buf_len);
+		return NM_BDG_NOPORT;
+	}
+	dmac = le64toh(*(uint64_t *)(buf)) & 0xffffffffffff;
+	smac = le64toh(*(uint64_t *)(buf + 4));
+	smac >>= 16;
+
+	/*
+	 * The hash is somewhat expensive, there might be some
+	 * worthwhile optimizations here.
+	 */
+	if ((buf[6] & 1) == 0) { /* valid src */
+		uint8_t *s = buf+6;
+		sh = nm_bridge_rthash(s); // XXX hash of source
+		/* update source port forwarding entry */
+		ht[sh].mac = smac;	/* XXX expire ? */
+		ht[sh].ports = mysrc;
+		if (netmap_verbose)
+		    D("src %02x:%02x:%02x:%02x:%02x:%02x on port %d",
+			s[0], s[1], s[2], s[3], s[4], s[5], mysrc);
+	}
+	dst = NM_BDG_BROADCAST;
+	if ((buf[0] & 1) == 0) { /* unicast */
+		dh = nm_bridge_rthash(buf); // XXX hash of dst
+		if (ht[dh].mac == dmac) {	/* found dst */
+			dst = ht[dh].ports;
 		}
-		/*
-		 * The hash is somewhat expensive, there might be some
-		 * worthwhile optimizations here.
-		 */
-		if ((buf[6] & 1) == 0) { /* valid src */
-		    	uint8_t *s = buf+6;
-			sh = nm_bridge_rthash(buf+6); // XXX hash of source
-			/* update source port forwarding entry */
-			b->ht[sh].mac = smac;	/* XXX expire ? */
-			b->ht[sh].ports = mysrc;
-			if (netmap_verbose)
-			    D("src %02x:%02x:%02x:%02x:%02x:%02x on port %d",
-				s[0], s[1], s[2], s[3], s[4], s[5], NA(ifp)->bdg_port);
+		/* XXX otherwise return NM_BDG_UNKNOWN ? */
+	}
+	*dst_ring = 0;
+	return dst;
+}
+
+
+/*
+ * This flush routine supports only unicast and broadcast but a large
+ * number of ports, and lets us replace the learn and dispatch functions.
+ */
+int
+nm_bdg_flush(struct nm_bdg_fwd *ft, u_int n, struct netmap_adapter *na,
+		u_int ring_nr)
+{
+	struct nm_bdg_q *dst_ents, *brddst;
+	uint16_t num_dsts = 0, *dsts;
+	struct nm_bridge *b = na->na_bdg;
+	u_int i, j, me = na->bdg_port;
+
+	/*
+	 * The work area (pointed by ft) is followed by an array of
+	 * pointers to queues , dst_ents; there are NM_BDG_MAXRINGS
+	 * queues per port plus one for the broadcast traffic.
+	 * Then we have an array of destination indexes.
+	 */
+	dst_ents = (struct nm_bdg_q *)(ft + NM_BDG_BATCH_MAX);
+	dsts = (uint16_t *)(dst_ents + NM_BDG_MAXPORTS * NM_BDG_MAXRINGS + 1);
+
+	/* first pass: find a destination for each packet in the batch */
+	for (i = 0; likely(i < n); i += ft[i].ft_frags) {
+		uint8_t dst_ring = ring_nr; /* default, same ring as origin */
+		uint16_t dst_port, d_i;
+		struct nm_bdg_q *d;
+
+		ND("slot %d frags %d", i, ft[i].ft_frags);
+		dst_port = b->nm_bdg_lookup(ft[i].ft_buf, ft[i].ft_len,
+			&dst_ring, na);
+		if (netmap_verbose > 255)
+			RD(5, "slot %d port %d -> %d", i, me, dst_port);
+		if (dst_port == NM_BDG_NOPORT)
+			continue; /* this packet is identified to be dropped */
+		else if (unlikely(dst_port > NM_BDG_MAXPORTS))
+			continue;
+		else if (dst_port == NM_BDG_BROADCAST)
+			dst_ring = 0; /* broadcasts always go to ring 0 */
+		else if (unlikely(dst_port == me ||
+		    !b->bdg_ports[dst_port]))
+			continue;
+
+		/* get a position in the scratch pad */
+		d_i = dst_port * NM_BDG_MAXRINGS + dst_ring;
+		d = dst_ents + d_i;
+
+		/* append the first fragment to the list */
+		if (d->bq_head == NM_FT_NULL) { /* new destination */
+			d->bq_head = d->bq_tail = i;
+			/* remember this position to be scanned later */
+			if (dst_port != NM_BDG_BROADCAST)
+				dsts[num_dsts++] = d_i;
+		} else {
+			ft[d->bq_tail].ft_next = i;
+			d->bq_tail = i;
 		}
-		dst = 0;
-		if ( (buf[0] & 1) == 0) { /* unicast */
-		    	uint8_t *d = buf;
-			dh = nm_bridge_rthash(buf); // XXX hash of dst
-			if (b->ht[dh].mac == dmac) {	/* found dst */
-				dst = b->ht[dh].ports;
-				if (netmap_verbose)
-				    D("dst %02x:%02x:%02x:%02x:%02x:%02x to port %x",
-					d[0], d[1], d[2], d[3], d[4], d[5], (uint32_t)(dst >> 16));
-			}
+		d->bq_len += ft[i].ft_frags;
+	}
+
+	/*
+	 * Broadcast traffic goes to ring 0 on all destinations.
+	 * So we need to add these rings to the list of ports to scan.
+	 * XXX at the moment we scan all NM_BDG_MAXPORTS ports, which is
+	 * expensive. We should keep a compact list of active destinations
+	 * so we could shorten this loop.
+	 */
+	brddst = dst_ents + NM_BDG_BROADCAST * NM_BDG_MAXRINGS;
+	if (brddst->bq_head != NM_FT_NULL) {
+		for (j = 0; likely(j < b->bdg_active_ports); j++) {
+			uint16_t d_i;
+			i = b->bdg_port_index[j];
+			if (unlikely(i == me))
+				continue;
+			d_i = i * NM_BDG_MAXRINGS;
+			if (dst_ents[d_i].bq_head == NM_FT_NULL)
+				dsts[num_dsts++] = d_i;
 		}
-		if (dst == 0)
-			dst = all_dst;
-		dst &= all_dst; /* only consider valid ports */
-		if (unlikely(netmap_verbose))
-			D("pkt goes to ports 0x%x", (uint32_t)dst);
-		ft[i].dst = dst;
 	}
 
-	/* second pass, scan interfaces and forward */
-	all_dst = (b->act_ports & ~mysrc);
-	for (ifn = 0; all_dst; ifn++) {
-		struct ifnet *dst_ifp = b->bdg_ports[ifn];
-		struct netmap_adapter *na;
+	ND(5, "pass 1 done %d pkts %d dsts", n, num_dsts);
+	/* second pass: scan destinations (XXX will be modular somehow) */
+	for (i = 0; i < num_dsts; i++) {
+		struct ifnet *dst_ifp;
+		struct netmap_adapter *dst_na;
 		struct netmap_kring *kring;
 		struct netmap_ring *ring;
-		int j, lim, sent, locked;
+		u_int dst_nr, is_vp, lim, j, sent = 0, d_i, next, brd_next;
+		u_int needed, howmany;
+		int retry = netmap_txsync_retry;
+		struct nm_bdg_q *d;
+		uint32_t my_start = 0, lease_idx = 0;
+		int nrings;
 
-		if (!dst_ifp)
-			continue;
-		ND("scan port %d %s", ifn, dst_ifp->if_xname);
-		dst = 1 << ifn;
-		if ((dst & all_dst) == 0)	/* skip if not set */
-			continue;
-		all_dst &= ~dst;	/* clear current node */
-		na = NA(dst_ifp);
+		d_i = dsts[i];
+		ND("second pass %d port %d", i, d_i);
+		d = dst_ents + d_i;
+		// XXX fix the division
+		dst_na = b->bdg_ports[d_i/NM_BDG_MAXRINGS];
+		/* protect from the lookup function returning an inactive
+		 * destination port
+		 */
+		if (unlikely(dst_na == NULL))
+			goto cleanup;
+		if (dst_na->na_flags & NAF_SW_ONLY)
+			goto cleanup;
+		dst_ifp = dst_na->ifp;
+		/*
+		 * The interface may be in !netmap mode in two cases:
+		 * - when na is attached but not activated yet;
+		 * - when na is being deactivated but is still attached.
+		 */
+		if (unlikely(!(dst_ifp->if_capenable & IFCAP_NETMAP))) {
+			ND("not in netmap mode!");
+			goto cleanup;
+		}
+
+		/* there is at least one either unicast or broadcast packet */
+		brd_next = brddst->bq_head;
+		next = d->bq_head;
+		/* we need to reserve this many slots. If fewer are
+		 * available, some packets will be dropped.
+		 * Packets may have multiple fragments, so we may not use
+		 * there is a chance that we may not use all of the slots
+		 * we have claimed, so we will need to handle the leftover
+		 * ones when we regain the lock.
+		 */
+		needed = d->bq_len + brddst->bq_len;
+
+		is_vp = nma_is_vp(dst_na);
+		ND(5, "pass 2 dst %d is %x %s",
+			i, d_i, is_vp ? "virtual" : "nic/host");
+		dst_nr = d_i & (NM_BDG_MAXRINGS-1);
+		if (is_vp) { /* virtual port */
+			nrings = dst_na->num_rx_rings;
+		} else {
+			nrings = dst_na->num_tx_rings;
+		}
+		if (dst_nr >= nrings)
+			dst_nr = dst_nr % nrings;
+		kring = is_vp ?  &dst_na->rx_rings[dst_nr] :
+				&dst_na->tx_rings[dst_nr];
+		ring = kring->ring;
+		lim = kring->nkr_num_slots - 1;
+
+retry:
+
+		/* reserve the buffers in the queue and an entry
+		 * to report completion, and drop lock.
+		 * XXX this might become a helper function.
+		 */
+		mtx_lock(&kring->q_lock);
+		if (kring->nkr_stopped) {
+			mtx_unlock(&kring->q_lock);
+			goto cleanup;
+		}
+		/* on physical interfaces, do a txsync to recover
+		 * slots for packets already transmitted.
+		 * XXX maybe we could be optimistic and rely on a retry
+		 * in case of failure.
+		 */
+		if (nma_is_hw(dst_na)) {
+			dst_na->nm_txsync(dst_ifp, dst_nr, 0);
+		}
+		my_start = j = kring->nkr_hwlease;
+		howmany = nm_kr_space(kring, is_vp);
+		if (needed < howmany)
+			howmany = needed;
+		lease_idx = nm_kr_lease(kring, howmany, is_vp);
+		mtx_unlock(&kring->q_lock);
+
+		/* only retry if we need more than available slots */
+		if (retry && needed <= howmany)
+			retry = 0;
 
-		ring = NULL;
-		kring = NULL;
-		lim = sent = locked = 0;
-		/* inside, scan slots */
-		for (i = 0; likely(i < n); i++) {
-			if ((ft[i].dst & dst) == 0)
-				continue;	/* not here */
-			if (!locked) {
-				kring = &na->rx_rings[0];
-				ring = kring->ring;
-				lim = kring->nkr_num_slots - 1;
-				na->nm_lock(dst_ifp, NETMAP_RX_LOCK, 0);
-				locked = 1;
+		/* copy to the destination queue */
+		while (howmany > 0) {
+			struct netmap_slot *slot;
+			struct nm_bdg_fwd *ft_p, *ft_end;
+			u_int cnt;
+
+			/* find the queue from which we pick next packet.
+			 * NM_FT_NULL is always higher than valid indexes
+			 * so we never dereference it if the other list
+			 * has packets (and if both are empty we never
+			 * get here).
+			 */
+			if (next < brd_next) {
+				ft_p = ft + next;
+				next = ft_p->ft_next;
+			} else { /* insert broadcast */
+				ft_p = ft + brd_next;
+				brd_next = ft_p->ft_next;
 			}
-			if (unlikely(kring->nr_hwavail >= lim)) {
-				if (netmap_verbose)
-					D("rx ring full on %s", ifp->if_xname);
+			cnt = ft_p->ft_frags; // cnt > 0
+			if (unlikely(cnt > howmany))
+			    break; /* no more space */
+			howmany -= cnt;
+			if (netmap_verbose && cnt > 1)
+				RD(5, "rx %d frags to %d", cnt, j);
+			ft_end = ft_p + cnt;
+			do {
+			    void *dst, *src = ft_p->ft_buf;
+			    size_t len = (ft_p->ft_len + 63) & ~63;
+
+			    slot = &ring->slot[j];
+			    dst = BDG_NMB(dst_na->nm_mem, slot);
+			    /* round to a multiple of 64 */
+
+			    ND("send %d %d bytes at %s:%d",
+				i, ft_p->ft_len, dst_ifp->if_xname, j);
+			    if (ft_p->ft_flags & NS_INDIRECT) {
+				if (copyin(src, dst, len)) {
+					// invalid user pointer, pretend len is 0
+					ft_p->ft_len = 0;
+				}
+			    } else {
+				//memcpy(dst, src, len);
+				pkt_copy(src, dst, (int)len);
+			    }
+			    slot->len = ft_p->ft_len;
+			    slot->flags = (cnt << 8)| NS_MOREFRAG;
+			    j = nm_next(j, lim);
+			    ft_p++;
+			    sent++;
+			} while (ft_p != ft_end);
+			slot->flags = (cnt << 8); /* clear flag on last entry */
+			/* are we done ? */
+			if (next == NM_FT_NULL && brd_next == NM_FT_NULL)
 				break;
-			}
-			j = kring->nr_hwcur + kring->nr_hwavail;
-			if (j > lim)
-				j -= kring->nkr_num_slots;
-			slot = &ring->slot[j];
-			ND("send %d %d bytes at %s:%d", i, ft[i].len, dst_ifp->if_xname, j);
-			pkt_copy(ft[i].buf, NMB(slot), ft[i].len);
-			slot->len = ft[i].len;
-			kring->nr_hwavail++;
-			sent++;
 		}
-		if (locked) {
-			ND("sent %d on %s", sent, dst_ifp->if_xname);
-			if (sent)
+		{
+		    /* current position */
+		    uint32_t *p = kring->nkr_leases; /* shorthand */
+		    uint32_t update_pos;
+		    int still_locked = 1;
+
+		    mtx_lock(&kring->q_lock);
+		    if (unlikely(howmany > 0)) {
+			/* not used all bufs. If i am the last one
+			 * i can recover the slots, otherwise must
+			 * fill them with 0 to mark empty packets.
+			 */
+			ND("leftover %d bufs", howmany);
+			if (nm_next(lease_idx, lim) == kring->nkr_lease_idx) {
+			    /* yes i am the last one */
+			    ND("roll back nkr_hwlease to %d", j);
+			    kring->nkr_hwlease = j;
+			} else {
+			    while (howmany-- > 0) {
+				ring->slot[j].len = 0;
+				ring->slot[j].flags = 0;
+				j = nm_next(j, lim);
+			    }
+			}
+		    }
+		    p[lease_idx] = j; /* report I am done */
+
+		    update_pos = is_vp ? nm_kr_rxpos(kring) : ring->cur;
+
+		    if (my_start == update_pos) {
+			/* all slots before my_start have been reported,
+			 * so scan subsequent leases to see if other ranges
+			 * have been completed, and to a selwakeup or txsync.
+		         */
+			while (lease_idx != kring->nkr_lease_idx &&
+				p[lease_idx] != NR_NOSLOT) {
+			    j = p[lease_idx];
+			    p[lease_idx] = NR_NOSLOT;
+			    lease_idx = nm_next(lease_idx, lim); 
+			}
+			/* j is the new 'write' position. j != my_start
+			 * means there are new buffers to report
+			 */
+			if (likely(j != my_start)) {
+			    if (is_vp) {
+				uint32_t old_avail = kring->nr_hwavail;
+
+				kring->nr_hwavail = (j >= kring->nr_hwcur) ?
+					j - kring->nr_hwcur :
+					j + lim + 1 - kring->nr_hwcur;
+				if (kring->nr_hwavail < old_avail) {
+					D("avail shrink %d -> %d",
+						old_avail, kring->nr_hwavail);
+				}
+				still_locked = 0;
+				mtx_unlock(&kring->q_lock);
 				selwakeuppri(&kring->si, PI_NET);
-			na->nm_lock(dst_ifp, NETMAP_RX_UNLOCK, 0);
+			    } else {
+				ring->cur = j;
+				/* XXX update avail ? */
+				still_locked = 0;
+				dst_na->nm_txsync(dst_ifp, dst_nr, 0);
+				mtx_unlock(&kring->q_lock);
+
+				/* retry to send more packets */
+				if (nma_is_hw(dst_na) && retry--)
+					goto retry;
+			    }
+			}
+		    }
+		    if (still_locked)
+			mtx_unlock(&kring->q_lock);
 		}
+cleanup:
+		d->bq_head = d->bq_tail = NM_FT_NULL; /* cleanup */
+		d->bq_len = 0;
 	}
+	brddst->bq_head = brddst->bq_tail = NM_FT_NULL; /* cleanup */
+	brddst->bq_len = 0;
 	return 0;
 }
 
+
 /*
- * main dispatch routine
+ * main dispatch routine for the bridge.
+ * We already know that only one thread is running this.
+ * we must run nm_bdg_preflush without lock.
  */
 static int
-bdg_netmap_txsync(struct ifnet *ifp, u_int ring_nr, int do_lock)
+bdg_netmap_txsync(struct ifnet *ifp, u_int ring_nr, int flags)
 {
 	struct netmap_adapter *na = NA(ifp);
 	struct netmap_kring *kring = &na->tx_rings[ring_nr];
 	struct netmap_ring *ring = kring->ring;
-	int i, j, k, lim = kring->nkr_num_slots - 1;
-	struct nm_bdg_fwd *ft = (struct nm_bdg_fwd *)(ifp + 1);
-	int ft_i;	/* position in the forwarding table */
+	u_int j, k, lim = kring->nkr_num_slots - 1;
 
 	k = ring->cur;
 	if (k > lim)
 		return netmap_ring_reinit(kring);
-	if (do_lock)
-		na->nm_lock(ifp, NETMAP_TX_LOCK, ring_nr);
 
-	if (netmap_bridge <= 0) { /* testing only */
+	if (bridge_batch <= 0) { /* testing only */
 		j = k; // used all
 		goto done;
 	}
-	if (netmap_bridge > NM_BDG_BATCH)
-		netmap_bridge = NM_BDG_BATCH;
-
-	ft_i = 0;	/* start from 0 */
-	for (j = kring->nr_hwcur; likely(j != k); j = unlikely(j == lim) ? 0 : j+1) {
-		struct netmap_slot *slot = &ring->slot[j];
-		int len = ft[ft_i].len = slot->len;
-		char *buf = ft[ft_i].buf = NMB(slot);
+	if (bridge_batch > NM_BDG_BATCH)
+		bridge_batch = NM_BDG_BATCH;
 
-		prefetch(buf);
-		if (unlikely(len < 14))
-			continue;
-		if (unlikely(++ft_i == netmap_bridge))
-			ft_i = nm_bdg_flush(ft, ft_i, ifp);
-	}
-	if (ft_i)
-		ft_i = nm_bdg_flush(ft, ft_i, ifp);
-	/* count how many packets we sent */
-	i = k - j;
-	if (i < 0)
-		i += kring->nkr_num_slots;
-	kring->nr_hwavail = kring->nkr_num_slots - 1 - i;
+	j = nm_bdg_preflush(na, ring_nr, kring, k);
 	if (j != k)
 		D("early break at %d/ %d, avail %d", j, k, kring->nr_hwavail);
+	/* k-j modulo ring size is the number of slots processed */
+	if (k < j)
+		k += kring->nkr_num_slots;
+	kring->nr_hwavail = lim - (k - j);
 
 done:
 	kring->nr_hwcur = j;
 	ring->avail = kring->nr_hwavail;
-	if (do_lock)
-		na->nm_lock(ifp, NETMAP_TX_UNLOCK, ring_nr);
-
 	if (netmap_verbose)
-		D("%s ring %d lock %d", ifp->if_xname, ring_nr, do_lock);
+		D("%s ring %d flags %d", ifp->if_xname, ring_nr, flags);
 	return 0;
 }
 
+
+/*
+ * user process reading from a VALE switch.
+ * Already protected against concurrent calls from userspace,
+ * but we must acquire the queue's lock to protect against
+ * writers on the same queue.
+ */
 static int
-bdg_netmap_rxsync(struct ifnet *ifp, u_int ring_nr, int do_lock)
+bdg_netmap_rxsync(struct ifnet *ifp, u_int ring_nr, int flags)
 {
 	struct netmap_adapter *na = NA(ifp);
 	struct netmap_kring *kring = &na->rx_rings[ring_nr];
 	struct netmap_ring *ring = kring->ring;
-	u_int j, n, lim = kring->nkr_num_slots - 1;
+	u_int j, lim = kring->nkr_num_slots - 1;
 	u_int k = ring->cur, resvd = ring->reserved;
+	int n;
 
-	ND("%s ring %d lock %d avail %d",
-		ifp->if_xname, ring_nr, do_lock, kring->nr_hwavail);
-
-	if (k > lim)
-		return netmap_ring_reinit(kring);
-	if (do_lock)
-		na->nm_lock(ifp, NETMAP_RX_LOCK, ring_nr);
+	mtx_lock(&kring->q_lock);
+	if (k > lim) {
+		D("ouch dangerous reset!!!");
+		n = netmap_ring_reinit(kring);
+		goto done;
+	}
 
 	/* skip past packets that userspace has released */
 	j = kring->nr_hwcur;    /* netmap ring index */
@@ -2426,48 +3944,50 @@ bdg_netmap_rxsync(struct ifnet *ifp, u_int ring_nr, int do_lock)
 		ND("userspace releases %d packets", n);
                 for (n = 0; likely(j != k); n++) {
                         struct netmap_slot *slot = &ring->slot[j];
-                        void *addr = NMB(slot);
+                        void *addr = BDG_NMB(na->nm_mem, slot);
 
                         if (addr == netmap_buffer_base) { /* bad buf */
-                                if (do_lock)
-                                        na->nm_lock(ifp, NETMAP_RX_UNLOCK, ring_nr);
-                                return netmap_ring_reinit(kring);
+				D("bad buffer index %d, ignore ?",
+					slot->buf_idx);
                         }
-			/* decrease refcount for buffer */
-
 			slot->flags &= ~NS_BUF_CHANGED;
-                        j = unlikely(j == lim) ? 0 : j + 1;
+                        j = nm_next(j, lim);
                 }
                 kring->nr_hwavail -= n;
                 kring->nr_hwcur = k;
         }
         /* tell userspace that there are new packets */
         ring->avail = kring->nr_hwavail - resvd;
-
-	if (do_lock)
-		na->nm_lock(ifp, NETMAP_RX_UNLOCK, ring_nr);
-	return 0;
+	n = 0;
+done:
+	mtx_unlock(&kring->q_lock);
+	return n;
 }
 
-static void
-bdg_netmap_attach(struct ifnet *ifp)
+
+static int
+bdg_netmap_attach(struct netmap_adapter *arg)
 {
 	struct netmap_adapter na;
 
 	ND("attaching virtual bridge");
 	bzero(&na, sizeof(na));
 
-	na.ifp = ifp;
-	na.separate_locks = 1;
-	na.num_tx_desc = NM_BRIDGE_RINGSIZE;
-	na.num_rx_desc = NM_BRIDGE_RINGSIZE;
+	na.ifp = arg->ifp;
+	na.na_flags = NAF_BDG_MAYSLEEP | NAF_MEM_OWNER;
+	na.num_tx_rings = arg->num_tx_rings;
+	na.num_rx_rings = arg->num_rx_rings;
+	na.num_tx_desc = arg->num_tx_desc;
+	na.num_rx_desc = arg->num_rx_desc;
 	na.nm_txsync = bdg_netmap_txsync;
 	na.nm_rxsync = bdg_netmap_rxsync;
 	na.nm_register = bdg_netmap_reg;
-	netmap_attach(&na, 1);
+	na.nm_mem = netmap_mem_private_new(arg->ifp->if_xname,
+			na.num_tx_rings, na.num_tx_desc,
+			na.num_rx_rings, na.num_rx_desc);
+	return netmap_attach(&na, na.num_tx_rings);
 }
 
-#endif /* NM_BRIDGE */
 
 static struct cdev *netmap_dev; /* /dev/netmap character device. */
 
@@ -2483,9 +4003,11 @@ static struct cdev *netmap_dev; /* /dev/netmap character device. */
 static int
 netmap_init(void)
 {
-	int error;
+	int i, error;
+
+	NMG_LOCK_INIT();
 
-	error = netmap_memory_init();
+	error = netmap_mem_init();
 	if (error != 0) {
 		printf("netmap: unable to initialize the memory allocator.\n");
 		return (error);
@@ -2494,13 +4016,9 @@ netmap_init(void)
 	netmap_dev = make_dev(&netmap_cdevsw, 0, UID_ROOT, GID_WHEEL, 0660,
 			      "netmap");
 
-#ifdef NM_BRIDGE
-	{
-	int i;
+	bzero(nm_bridges, sizeof(struct nm_bridge) * NM_BRIDGES); /* safety */
 	for (i = 0; i < NM_BRIDGES; i++)
-		mtx_init(&nm_bridges[i].bdg_lock, "bdg lock", "bdg_lock", MTX_DEF);
-	}
-#endif
+		BDG_RWINIT(&nm_bridges[i]);
 	return (error);
 }
 
@@ -2514,7 +4032,8 @@ static void
 netmap_fini(void)
 {
 	destroy_dev(netmap_dev);
-	netmap_memory_fini();
+	netmap_mem_fini();
+	NMG_LOCK_DESTROY();
 	printf("netmap: unloaded module.\n");
 }
 
diff --git a/sys/dev/netmap/netmap_kern.h b/sys/dev/netmap/netmap_kern.h
index 7ab617e72699..12bd882521b3 100644
--- a/sys/dev/netmap/netmap_kern.h
+++ b/sys/dev/netmap/netmap_kern.h
@@ -35,14 +35,16 @@
 
 #if defined(__FreeBSD__)
 
-#define likely(x)	__builtin_expect(!!(x), 1)
-#define unlikely(x)	__builtin_expect(!!(x), 0)
+#define likely(x)	__builtin_expect((long)!!(x), 1L)
+#define unlikely(x)	__builtin_expect((long)!!(x), 0L)
 
 #define	NM_LOCK_T	struct mtx
 #define	NM_SELINFO_T	struct selinfo
 #define	MBUF_LEN(m)	((m)->m_pkthdr.len)
 #define	NM_SEND_UP(ifp, m)	((ifp)->if_input)(ifp, m)
 
+#define NM_ATOMIC_T	volatile int
+
 #elif defined (linux)
 
 #define	NM_LOCK_T	safe_spinlock_t	// see bsd_glue.h
@@ -50,9 +52,11 @@
 #define	MBUF_LEN(m)	((m)->len)
 #define	NM_SEND_UP(ifp, m)	netif_rx(m)
 
+#define NM_ATOMIC_T	volatile long unsigned int
+
 #ifndef DEV_NETMAP
 #define DEV_NETMAP
-#endif
+#endif /* DEV_NETMAP */
 
 /*
  * IFCAP_NETMAP goes into net_device's priv_flags (if_capenable).
@@ -63,7 +67,7 @@
 #if LINUX_VERSION_CODE < KERNEL_VERSION(2,6,37)
 #define IFCAP_NETMAP	0x8000
 #else
-#define IFCAP_NETMAP	0x100000
+#define IFCAP_NETMAP	0x200000
 #endif
 
 #elif defined (__APPLE__)
@@ -105,6 +109,11 @@
 	} while (0)
 
 struct netmap_adapter;
+struct nm_bdg_fwd;
+struct nm_bridge;
+struct netmap_priv_d;
+
+const char *nm_dump_buf(char *p, int len, int lim, char *dst);
 
 /*
  * private, kernel view of a ring. Keeps track of the status of
@@ -123,25 +132,120 @@ struct netmap_adapter;
  * 	the next empty buffer as known by the hardware (next_to_check or so).
  * TX rings: hwcur + hwofs coincides with next_to_send
  *
+ * Clients cannot issue concurrent syscall on a ring. The system
+ * detects this and reports an error using two flags,
+ * NKR_WBUSY and NKR_RBUSY
  * For received packets, slot->flags is set to nkr_slot_flags
  * so we can provide a proper initial value (e.g. set NS_FORWARD
  * when operating in 'transparent' mode).
+ *
+ * The following fields are used to implement lock-free copy of packets
+ * from input to output ports in VALE switch:
+ *	nkr_hwlease	buffer after the last one being copied.
+ *			A writer in nm_bdg_flush reserves N buffers
+ *			from nr_hwlease, advances it, then does the
+ *			copy outside the lock.
+ *			In RX rings (used for VALE ports),
+ *			nkr_hwcur + nkr_hwavail <= nkr_hwlease < nkr_hwcur+N-1
+ *			In TX rings (used for NIC or host stack ports)
+ *			nkr_hwcur <= nkr_hwlease < nkr_hwcur+ nkr_hwavail
+ *	nkr_leases	array of nkr_num_slots where writers can report
+ *			completion of their block. NR_NOSLOT (~0) indicates
+ *			that the writer has not finished yet
+ *	nkr_lease_idx	index of next free slot in nr_leases, to be assigned 
+ *
+ * The kring is manipulated by txsync/rxsync and generic netmap function.
+ * q_lock is used to arbitrate access to the kring from within the netmap
+ * code, and this and other protections guarantee that there is never
+ * more than 1 concurrent call to txsync or rxsync. So we are free
+ * to manipulate the kring from within txsync/rxsync without any extra
+ * locks.
  */
 struct netmap_kring {
 	struct netmap_ring *ring;
-	u_int nr_hwcur;
-	int nr_hwavail;
-	u_int nr_kflags;	/* private driver flags */
+	uint32_t nr_hwcur;
+	uint32_t nr_hwavail;
+	uint32_t nr_kflags;	/* private driver flags */
 #define NKR_PENDINTR	0x1	// Pending interrupt.
-	u_int nkr_num_slots;
+	uint32_t nkr_num_slots;
+	int32_t	nkr_hwofs;	/* offset between NIC and netmap ring */
 
 	uint16_t	nkr_slot_flags;	/* initial value for flags */
-	int	nkr_hwofs;	/* offset between NIC and netmap ring */
 	struct netmap_adapter *na;
+	struct nm_bdg_fwd *nkr_ft;
+	uint32_t *nkr_leases;
+#define NR_NOSLOT	((uint32_t)~0)
+	uint32_t nkr_hwlease;
+	uint32_t nkr_lease_idx;
+
 	NM_SELINFO_T si;	/* poll/select wait queue */
-	NM_LOCK_T q_lock;	/* used if no device lock available */
+	NM_LOCK_T q_lock;	/* protects kring and ring. */
+	NM_ATOMIC_T nr_busy;	/* prevent concurrent syscalls */
+
+	volatile int nkr_stopped;
 } __attribute__((__aligned__(64)));
 
+
+/* return the next index, with wraparound */
+static inline uint32_t
+nm_next(uint32_t i, uint32_t lim)
+{
+	return unlikely (i == lim) ? 0 : i + 1;
+}
+
+/*
+ *
+ * Here is the layout for the Rx and Tx rings.
+
+       RxRING                            TxRING
+
+      +-----------------+            +-----------------+
+      |                 |            |                 |
+      |XXX free slot XXX|            |XXX free slot XXX|
+      +-----------------+            +-----------------+
+      |                 |<-hwcur     |                 |<-hwcur
+      | reserved    h   |            | (ready          |
+      +-----------  w  -+            |  to be          |
+ cur->|             a   |            |  sent)      h   |
+      |             v   |            +----------   w   |
+      |             a   |       cur->| (being      a   |
+      |             i   |            |  prepared)  v   |
+      | avail       l   |            |             a   |
+      +-----------------+            +  a  ------  i   +
+      |                 | ...        |  v          l   |<-hwlease
+      | (being          | ...        |  a              | ...
+      |  prepared)      | ...        |  i              | ...
+      +-----------------+ ...        |  l              | ...
+      |                 |<-hwlease   +-----------------+
+      |                 |            |                 |
+      |                 |            |                 |
+      |                 |            |                 |
+      |                 |            |                 |
+      +-----------------+            +-----------------+
+
+ * The cur/avail (user view) and hwcur/hwavail (kernel view)
+ * are used in the normal operation of the card.
+ *
+ * When a ring is the output of a switch port (Rx ring for
+ * a VALE port, Tx ring for the host stack or NIC), slots
+ * are reserved in blocks through 'hwlease' which points
+ * to the next unused slot.
+ * On an Rx ring, hwlease is always after hwavail,
+ * and completions cause avail to advance.
+ * On a Tx ring, hwlease is always between cur and hwavail,
+ * and completions cause cur to advance.
+ *
+ * nm_kr_space() returns the maximum number of slots that
+ * can be assigned.
+ * nm_kr_lease() reserves the required number of buffers,
+ *    advances nkr_hwlease and also returns an entry in
+ *    a circular array where completions should be reported.
+ */
+
+
+
+
+
 /*
  * This struct extends the 'struct adapter' (or
  * equivalent) device descriptor. It contains all fields needed to
@@ -160,6 +264,14 @@ struct netmap_adapter {
 #define NAF_SKIP_INTR	1	/* use the regular interrupt handler.
 				 * useful during initialization
 				 */
+#define NAF_SW_ONLY	2	/* forward packets only to sw adapter */
+#define NAF_BDG_MAYSLEEP 4	/* the bridge is allowed to sleep when
+				 * forwarding packets coming from this
+				 * interface
+				 */
+#define NAF_MEM_OWNER	8	/* the adapter is responsible for the
+				 * deallocation of the memory allocator
+				 */
 	int refcount; /* number of user-space descriptors using this
 			 interface, which is equal to the number of
 			 struct netmap_if objs in the mapped region. */
@@ -172,9 +284,6 @@ struct netmap_adapter {
 	int na_single;	/* threads attached to a single hw queue */
 	int na_multi;	/* threads attached to multiple hw queues */
 
-	int separate_locks; /* set if the interface suports different
-			       locks for rx, tx and core. */
-
 	u_int num_rx_rings; /* number of adapter receive rings */
 	u_int num_tx_rings; /* number of adapter transmit rings */
 
@@ -203,9 +312,11 @@ struct netmap_adapter {
 	NM_LOCK_T core_lock;	/* used if no device lock available */
 
 	int (*nm_register)(struct ifnet *, int onoff);
-	void (*nm_lock)(struct ifnet *, int what, u_int ringid);
-	int (*nm_txsync)(struct ifnet *, u_int ring, int lock);
-	int (*nm_rxsync)(struct ifnet *, u_int ring, int lock);
+
+	int (*nm_txsync)(struct ifnet *, u_int ring, int flags);
+	int (*nm_rxsync)(struct ifnet *, u_int ring, int flags);
+#define NAF_FORCE_READ    1
+#define NAF_FORCE_RECLAIM 2
 	/* return configuration information */
 	int (*nm_config)(struct ifnet *, u_int *txr, u_int *txd,
 					u_int *rxr, u_int *rxd);
@@ -218,16 +329,116 @@ struct netmap_adapter {
 	 *	when it goes to 0 we can detach+free this port
 	 *	(a bridge port is always attached if it exists;
 	 *	it is not always registered)
+	 * na_bdg points to the bridge this NA is attached to.
 	 */
 	int bdg_port;
 	int na_bdg_refcount;
+	struct nm_bridge *na_bdg;
+	/* When we attach a physical interface to the bridge, we
+	 * allow the controlling process to terminate, so we need
+	 * a place to store the netmap_priv_d data structure.
+	 * This is only done when physical interfaces are attached to a bridge.
+	 */
+	struct netmap_priv_d *na_kpriv;
 
+	/* memory allocator */
+ 	struct netmap_mem_d *nm_mem;
 #ifdef linux
 	struct net_device_ops nm_ndo;
 #endif /* linux */
 };
 
 /*
+ * Available space in the ring.
+ */
+static inline uint32_t
+nm_kr_space(struct netmap_kring *k, int is_rx)
+{
+	int space;
+
+	if (is_rx) {
+		int busy = k->nkr_hwlease - k->nr_hwcur;
+		if (busy < 0)
+			busy += k->nkr_num_slots;
+		space = k->nkr_num_slots - 1 - busy;
+	} else {
+		space = k->nr_hwcur + k->nr_hwavail - k->nkr_hwlease;
+		if (space < 0)
+			space += k->nkr_num_slots;
+	}
+#if 0
+	// sanity check
+	if (k->nkr_hwlease >= k->nkr_num_slots ||
+		k->nr_hwcur >= k->nkr_num_slots ||
+		k->nr_hwavail >= k->nkr_num_slots ||
+		busy < 0 ||
+		busy >= k->nkr_num_slots) {
+		D("invalid kring, cur %d avail %d lease %d lease_idx %d lim %d",			k->nr_hwcur, k->nr_hwavail, k->nkr_hwlease,
+			k->nkr_lease_idx, k->nkr_num_slots);
+	}
+#endif
+	return space;
+}
+
+
+/* return update position */
+static inline uint32_t
+nm_kr_rxpos(struct netmap_kring *k)
+{
+	uint32_t pos = k->nr_hwcur + k->nr_hwavail;
+	if (pos >= k->nkr_num_slots)
+		pos -= k->nkr_num_slots;
+#if 0
+	if (pos >= k->nkr_num_slots ||
+		k->nkr_hwlease >= k->nkr_num_slots ||
+		k->nr_hwcur >= k->nkr_num_slots ||
+		k->nr_hwavail >= k->nkr_num_slots ||
+		k->nkr_lease_idx >= k->nkr_num_slots) {
+		D("invalid kring, cur %d avail %d lease %d lease_idx %d lim %d",			k->nr_hwcur, k->nr_hwavail, k->nkr_hwlease,
+			k->nkr_lease_idx, k->nkr_num_slots);
+	}
+#endif
+	return pos;
+}
+
+
+/* make a lease on the kring for N positions. return the
+ * lease index
+ */
+static inline uint32_t
+nm_kr_lease(struct netmap_kring *k, u_int n, int is_rx)
+{
+	uint32_t lim = k->nkr_num_slots - 1;
+	uint32_t lease_idx = k->nkr_lease_idx;
+
+	k->nkr_leases[lease_idx] = NR_NOSLOT;
+	k->nkr_lease_idx = nm_next(lease_idx, lim);
+
+	if (n > nm_kr_space(k, is_rx)) {
+		D("invalid request for %d slots", n);
+		panic("x");
+	}
+	/* XXX verify that there are n slots */
+	k->nkr_hwlease += n;
+	if (k->nkr_hwlease > lim)
+		k->nkr_hwlease -= lim + 1;
+
+	if (k->nkr_hwlease >= k->nkr_num_slots ||
+		k->nr_hwcur >= k->nkr_num_slots ||
+		k->nr_hwavail >= k->nkr_num_slots ||
+		k->nkr_lease_idx >= k->nkr_num_slots) {
+		D("invalid kring %s, cur %d avail %d lease %d lease_idx %d lim %d",
+			k->na->ifp->if_xname,
+			k->nr_hwcur, k->nr_hwavail, k->nkr_hwlease,
+			k->nkr_lease_idx, k->nkr_num_slots);
+	}
+	return lease_idx;
+}
+
+
+/*
+ * XXX NETMAP_DELETING() is unused
+ *
  * The combination of "enable" (ifp->if_capenable & IFCAP_NETMAP)
  * and refcount gives the status of the interface, namely:
  *
@@ -242,25 +453,6 @@ struct netmap_adapter {
 #define NETMAP_DELETING(_na)  (  ((_na)->refcount == 0) &&	\
 	( (_na)->ifp->if_capenable & IFCAP_NETMAP) )
 
-/*
- * parameters for (*nm_lock)(adapter, what, index)
- */
-enum {
-	NETMAP_NO_LOCK = 0,
-	NETMAP_CORE_LOCK, NETMAP_CORE_UNLOCK,
-	NETMAP_TX_LOCK, NETMAP_TX_UNLOCK,
-	NETMAP_RX_LOCK, NETMAP_RX_UNLOCK,
-#ifdef __FreeBSD__
-#define	NETMAP_REG_LOCK		NETMAP_CORE_LOCK
-#define	NETMAP_REG_UNLOCK	NETMAP_CORE_UNLOCK
-#else
-	NETMAP_REG_LOCK, NETMAP_REG_UNLOCK
-#endif
-};
-
-/* How to handle locking support in netmap_rx_irq/netmap_tx_irq */
-#define	NETMAP_LOCKED_ENTER	0x10000000	/* already locked on enter */
-#define	NETMAP_LOCKED_EXIT	0x20000000	/* keep locked on exit */
 
 /*
  * The following are support routines used by individual drivers to
@@ -271,7 +463,7 @@ enum {
  *
  * netmap_detach() frees the memory allocated by netmap_attach().
  *
- * netmap_start() replaces the if_transmit routine of the interface,
+ * netmap_transmit() replaces the if_transmit routine of the interface,
  *	and is used to intercept packets coming from the stack.
  *
  * netmap_load_map/netmap_reload_map are helper routines to set/reset
@@ -280,14 +472,32 @@ enum {
  * netmap_reset() is a helper routine to be called in the driver
  *	when reinitializing a ring.
  */
-int netmap_attach(struct netmap_adapter *, int);
+int netmap_attach(struct netmap_adapter *, u_int);
 void netmap_detach(struct ifnet *);
-int netmap_start(struct ifnet *, struct mbuf *);
+int netmap_transmit(struct ifnet *, struct mbuf *);
 enum txrx { NR_RX = 0, NR_TX = 1 };
 struct netmap_slot *netmap_reset(struct netmap_adapter *na,
-	enum txrx tx, int n, u_int new_cur);
+	enum txrx tx, u_int n, u_int new_cur);
 int netmap_ring_reinit(struct netmap_kring *);
 
+u_int nm_bound_var(u_int *v, u_int dflt, u_int lo, u_int hi, const char *msg);
+
+/*
+ * The following bridge-related interfaces are used by other kernel modules
+ * In the version that only supports unicast or broadcast, the lookup
+ * function can return 0 .. NM_BDG_MAXPORTS-1 for regular ports,
+ * NM_BDG_MAXPORTS for broadcast, NM_BDG_MAXPORTS+1 for unknown.
+ * XXX in practice "unknown" might be handled same as broadcast.
+ */
+typedef u_int (*bdg_lookup_fn_t)(char *buf, u_int len, uint8_t *ring_nr,
+		struct netmap_adapter *);
+int netmap_bdg_ctl(struct nmreq *nmr, bdg_lookup_fn_t func);
+u_int netmap_bdg_learning(char *, u_int, uint8_t *, struct netmap_adapter *);
+#define	NM_NAME			"vale"	/* prefix for the bridge port name */
+#define	NM_BDG_MAXPORTS		254	/* up to 32 for bitmap, 254 ok otherwise */
+#define	NM_BDG_BROADCAST	NM_BDG_MAXPORTS
+#define	NM_BDG_NOPORT		(NM_BDG_MAXPORTS+1)
+
 extern u_int netmap_buf_size;
 #define NETMAP_BUF_SIZE	netmap_buf_size	// XXX remove
 extern int netmap_mitigate;
@@ -309,11 +519,15 @@ enum {                                  /* verbose flags */
 /*
  * NA returns a pointer to the struct netmap adapter from the ifp,
  * WNA is used to write it.
+ * SWNA() is used for the "host stack" endpoint associated
+ *	to an interface. It is allocated together with the main NA(),
+ *	as an array of two objects.
  */
 #ifndef WNA
 #define	WNA(_ifp)	(_ifp)->if_pspare[0]
 #endif
 #define	NA(_ifp)	((struct netmap_adapter *)WNA(_ifp))
+#define	SWNA(_ifp)	(NA(_ifp) + 1)
 
 /*
  * Macros to determine if an interface is netmap capable or netmap enabled.
@@ -417,6 +631,7 @@ netmap_reload_map(bus_dma_tag_t tag, bus_dmamap_t map, void *buf)
 
 #endif /* linux */
 
+
 /*
  * functions to map NIC to KRING indexes (n2k) and vice versa (k2n)
  */
@@ -481,7 +696,15 @@ PNMB(struct netmap_slot *slot, uint64_t *pp)
 }
 
 /* default functions to handle rx/tx interrupts */
-int netmap_rx_irq(struct ifnet *, int, int *);
+int netmap_rx_irq(struct ifnet *, u_int, u_int *);
 #define netmap_tx_irq(_n, _q) netmap_rx_irq(_n, _q, NULL)
 
+#ifdef __FreeBSD__
+MALLOC_DECLARE(M_NETMAP);
+#endif /* __FreeBSD__ */
+
+
+void netmap_disable_all_rings(struct ifnet *);
+void netmap_enable_all_rings(struct ifnet *);
+
 #endif /* _NET_NETMAP_KERN_H_ */
diff --git a/sys/dev/netmap/netmap_mem2.c b/sys/dev/netmap/netmap_mem2.c
index dcf4b06d874d..a78904216057 100644
--- a/sys/dev/netmap/netmap_mem2.c
+++ b/sys/dev/netmap/netmap_mem2.c
@@ -23,107 +23,48 @@
  * SUCH DAMAGE.
  */
 
-/*
- * $FreeBSD$
- *
- * (New) memory allocator for netmap
- */
+#ifdef linux
+#include "bsd_glue.h"
+#endif /* linux */
 
-/*
- * This allocator creates three memory pools:
- *	nm_if_pool	for the struct netmap_if
- *	nm_ring_pool	for the struct netmap_ring
- *	nm_buf_pool	for the packet buffers.
- *
- * that contain netmap objects. Each pool is made of a number of clusters,
- * multiple of a page size, each containing an integer number of objects.
- * The clusters are contiguous in user space but not in the kernel.
- * Only nm_buf_pool needs to be dma-able,
- * but for convenience use the same type of allocator for all.
- *
- * Once mapped, the three pools are exported to userspace
- * as a contiguous block, starting from nm_if_pool. Each
- * cluster (and pool) is an integral number of pages.
- *   [ . . . ][ . . . . . .][ . . . . . . . . . .]
- *    nm_if     nm_ring            nm_buf
- *
- * The userspace areas contain offsets of the objects in userspace.
- * When (at init time) we write these offsets, we find out the index
- * of the object, and from there locate the offset from the beginning
- * of the region.
- *
- * The invididual allocators manage a pool of memory for objects of
- * the same size.
- * The pool is split into smaller clusters, whose size is a
- * multiple of the page size. The cluster size is chosen
- * to minimize the waste for a given max cluster size
- * (we do it by brute force, as we have relatively few objects
- * per cluster).
- *
- * Objects are aligned to the cache line (64 bytes) rounding up object
- * sizes when needed. A bitmap contains the state of each object.
- * Allocation scans the bitmap; this is done only on attach, so we are not
- * too worried about performance
- *
- * For each allocator we can define (thorugh sysctl) the size and
- * number of each object. Memory is allocated at the first use of a
- * netmap file descriptor, and can be freed when all such descriptors
- * have been released (including unmapping the memory).
- * If memory is scarce, the system tries to get as much as possible
- * and the sysctl values reflect the actual allocation.
- * Together with desired values, the sysctl export also absolute
- * min and maximum values that cannot be overridden.
- *
- * struct netmap_if:
- *	variable size, max 16 bytes per ring pair plus some fixed amount.
- *	1024 bytes should be large enough in practice.
- *
- *	In the worst case we have one netmap_if per ring in the system.
- *
- * struct netmap_ring
- *	variable size, 8 byte per slot plus some fixed amount.
- *	Rings can be large (e.g. 4k slots, or >32Kbytes).
- *	We default to 36 KB (9 pages), and a few hundred rings.
- *
- * struct netmap_buffer
- *	The more the better, both because fast interfaces tend to have
- *	many slots, and because we may want to use buffers to store
- *	packets in userspace avoiding copies.
- *	Must contain a full frame (eg 1518, or more for vlans, jumbo
- *	frames etc.) plus be nicely aligned, plus some NICs restrict
- *	the size to multiple of 1K or so. Default to 2K
- */
+#ifdef __APPLE__
+#include "osx_glue.h"
+#endif /* __APPLE__ */
 
-#define NETMAP_BUF_MAX_NUM	20*4096*2	/* large machine */
+#ifdef __FreeBSD__
+#include <sys/cdefs.h> /* prerequisite */
+__FBSDID("$FreeBSD$");
 
-#ifdef linux
-// XXX a mtx would suffice here 20130415 lr
-// #define NMA_LOCK_T		safe_spinlock_t
-#define NMA_LOCK_T		struct semaphore
-#define NMA_LOCK_INIT()		sema_init(&nm_mem.nm_mtx, 1)
-#define NMA_LOCK_DESTROY()
-#define NMA_LOCK()		down(&nm_mem.nm_mtx)
-#define NMA_UNLOCK()		up(&nm_mem.nm_mtx)
-#else /* !linux */
-#define NMA_LOCK_T		struct mtx
-#define NMA_LOCK_INIT()		mtx_init(&nm_mem.nm_mtx, "netmap memory allocator lock", NULL, MTX_DEF)
-#define NMA_LOCK_DESTROY()	mtx_destroy(&nm_mem.nm_mtx)
-#define NMA_LOCK()		mtx_lock(&nm_mem.nm_mtx)
-#define NMA_UNLOCK()		mtx_unlock(&nm_mem.nm_mtx)
-#endif /* linux */
+#include <sys/types.h>
+#include <sys/malloc.h>
+#include <sys/proc.h>
+#include <vm/vm.h>	/* vtophys */
+#include <vm/pmap.h>	/* vtophys */
+#include <sys/socket.h> /* sockaddrs */
+#include <sys/selinfo.h>
+#include <sys/sysctl.h>
+#include <net/if.h>
+#include <net/if_var.h>
+#include <net/vnet.h>
+#include <machine/bus.h>	/* bus_dmamap_* */
 
-enum {
-	NETMAP_IF_POOL   = 0,
-	NETMAP_RING_POOL,
-	NETMAP_BUF_POOL,
-	NETMAP_POOLS_NR
-};
+#endif /* __FreeBSD__ */
 
+#include <net/netmap.h>
+#include <dev/netmap/netmap_kern.h>
+#include "netmap_mem2.h"
 
-struct netmap_obj_params {
-	u_int size;
-	u_int num;
-};
+#ifdef linux
+#define NMA_LOCK_INIT(n)	sema_init(&(n)->nm_mtx, 1)
+#define NMA_LOCK_DESTROY(n)
+#define NMA_LOCK(n)		down(&(n)->nm_mtx)
+#define NMA_UNLOCK(n)		up(&(n)->nm_mtx)
+#else /* !linux */
+#define NMA_LOCK_INIT(n)	mtx_init(&(n)->nm_mtx, "netmap memory allocator lock", NULL, MTX_DEF)
+#define NMA_LOCK_DESTROY(n)	mtx_destroy(&(n)->nm_mtx)
+#define NMA_LOCK(n)		mtx_lock(&(n)->nm_mtx)
+#define NMA_UNLOCK(n)		mtx_unlock(&(n)->nm_mtx)
+#endif /* linux */
 
 
 struct netmap_obj_params netmap_params[NETMAP_POOLS_NR] = {
@@ -142,47 +83,15 @@ struct netmap_obj_params netmap_params[NETMAP_POOLS_NR] = {
 };
 
 
-struct netmap_obj_pool {
-	char name[16];		/* name of the allocator */
-	u_int objtotal;         /* actual total number of objects. */
-	u_int objfree;          /* number of free objects. */
-	u_int clustentries;	/* actual objects per cluster */
-
-	/* limits */
-	u_int objminsize;	/* minimum object size */
-	u_int objmaxsize;	/* maximum object size */
-	u_int nummin;		/* minimum number of objects */
-	u_int nummax;		/* maximum number of objects */
-
-	/* the total memory space is _numclusters*_clustsize */
-	u_int _numclusters;	/* how many clusters */
-	u_int _clustsize;        /* cluster size */
-	u_int _objsize;		/* actual object size */
-
-	u_int _memtotal;	/* _numclusters*_clustsize */
-	struct lut_entry *lut;  /* virt,phys addresses, objtotal entries */
-	uint32_t *bitmap;       /* one bit per buffer, 1 means free */
-	uint32_t bitmap_slots;	/* number of uint32 entries in bitmap */
-};
-
-
-struct netmap_mem_d {
-	NMA_LOCK_T nm_mtx;  /* protect the allocator */
-	u_int nm_totalsize; /* shorthand */
-
-	int finalized;		/* !=0 iff preallocation done */
-	int lasterr;		/* last error for curr config */
-	int refcount;		/* existing priv structures */
-	/* the three allocators */
-	struct netmap_obj_pool pools[NETMAP_POOLS_NR];
-};
-
 /*
  * nm_mem is the memory allocator used for all physical interfaces
  * running in netmap mode.
  * Virtual (VALE) ports will have each its own allocator.
  */
-static struct netmap_mem_d nm_mem = {	/* Our memory allocator. */
+static int netmap_mem_global_config(struct netmap_mem_d *nmd);
+static int netmap_mem_global_finalize(struct netmap_mem_d *nmd);
+static void netmap_mem_global_deref(struct netmap_mem_d *nmd);
+struct netmap_mem_d nm_mem = {	/* Our memory allocator. */
 	.pools = {
 		[NETMAP_IF_POOL] = {
 			.name 	= "netmap_if",
@@ -206,15 +115,55 @@ static struct netmap_mem_d nm_mem = {	/* Our memory allocator. */
 			.nummax	    = 1000000, /* one million! */
 		},
 	},
+	.config   = netmap_mem_global_config,
+	.finalize = netmap_mem_global_finalize,
+	.deref    = netmap_mem_global_deref,
 };
 
+
 // XXX logically belongs to nm_mem
 struct lut_entry *netmap_buffer_lut;	/* exported */
 
+/* blueprint for the private memory allocators */
+static int netmap_mem_private_config(struct netmap_mem_d *nmd);
+static int netmap_mem_private_finalize(struct netmap_mem_d *nmd);
+static void netmap_mem_private_deref(struct netmap_mem_d *nmd);
+const struct netmap_mem_d nm_blueprint = {
+	.pools = {
+		[NETMAP_IF_POOL] = {
+			.name 	= "%s_if",
+			.objminsize = sizeof(struct netmap_if),
+			.objmaxsize = 4096,
+			.nummin     = 1,
+			.nummax	    = 10,
+		},
+		[NETMAP_RING_POOL] = {
+			.name 	= "%s_ring",
+			.objminsize = sizeof(struct netmap_ring),
+			.objmaxsize = 32*PAGE_SIZE,
+			.nummin     = 2,
+			.nummax	    = 1024,
+		},
+		[NETMAP_BUF_POOL] = {
+			.name	= "%s_buf",
+			.objminsize = 64,
+			.objmaxsize = 65536,
+			.nummin     = 4,
+			.nummax	    = 1000000, /* one million! */
+		},
+	},
+	.config   = netmap_mem_private_config,
+	.finalize = netmap_mem_private_finalize,
+	.deref    = netmap_mem_private_deref,
+
+	.flags = NETMAP_MEM_PRIVATE,
+};
+
 /* memory allocator related sysctls */
 
 #define STRINGIFY(x) #x
 
+
 #define DECLARE_SYSCTLS(id, name) \
 	SYSCTL_INT(_dev_netmap, OID_AUTO, name##_size, \
 	    CTLFLAG_RW, &netmap_params[id].size, 0, "Requested size of netmap " STRINGIFY(name) "s"); \
@@ -225,43 +174,71 @@ struct lut_entry *netmap_buffer_lut;	/* exported */
         SYSCTL_INT(_dev_netmap, OID_AUTO, name##_curr_num, \
             CTLFLAG_RD, &nm_mem.pools[id].objtotal, 0, "Current number of netmap " STRINGIFY(name) "s")
 
+SYSCTL_DECL(_dev_netmap);
 DECLARE_SYSCTLS(NETMAP_IF_POOL, if);
 DECLARE_SYSCTLS(NETMAP_RING_POOL, ring);
 DECLARE_SYSCTLS(NETMAP_BUF_POOL, buf);
 
 /*
- * Convert a userspace offset to a physical address.
- * XXX only called in the FreeBSD's netmap_mmap()
- * because in linux we map everything at once.
- *
  * First, find the allocator that contains the requested offset,
  * then locate the cluster through a lookup table.
  */
-static inline vm_paddr_t
-netmap_ofstophys(vm_offset_t offset)
+vm_paddr_t
+netmap_mem_ofstophys(struct netmap_mem_d* nmd, vm_ooffset_t offset)
 {
 	int i;
-	vm_offset_t o = offset;
-	struct netmap_obj_pool *p = nm_mem.pools;
+	vm_ooffset_t o = offset;
+	vm_paddr_t pa;
+	struct netmap_obj_pool *p;
+
+	NMA_LOCK(nmd);
+	p = nmd->pools;
 
-	for (i = 0; i < NETMAP_POOLS_NR; offset -= p[i]._memtotal, i++) {
-		if (offset >= p[i]._memtotal)
+	for (i = 0; i < NETMAP_POOLS_NR; offset -= p[i].memtotal, i++) {
+		if (offset >= p[i].memtotal)
 			continue;
 		// now lookup the cluster's address
-		return p[i].lut[offset / p[i]._objsize].paddr +
+		pa = p[i].lut[offset / p[i]._objsize].paddr +
 			offset % p[i]._objsize;
+		NMA_UNLOCK(nmd);
+		return pa;
 	}
 	/* this is only in case of errors */
 	D("invalid ofs 0x%x out of 0x%x 0x%x 0x%x", (u_int)o,
-		p[NETMAP_IF_POOL]._memtotal,
-		p[NETMAP_IF_POOL]._memtotal
-			+ p[NETMAP_RING_POOL]._memtotal,
-		p[NETMAP_IF_POOL]._memtotal
-			+ p[NETMAP_RING_POOL]._memtotal
-			+ p[NETMAP_BUF_POOL]._memtotal);
+		p[NETMAP_IF_POOL].memtotal,
+		p[NETMAP_IF_POOL].memtotal
+			+ p[NETMAP_RING_POOL].memtotal,
+		p[NETMAP_IF_POOL].memtotal
+			+ p[NETMAP_RING_POOL].memtotal
+			+ p[NETMAP_BUF_POOL].memtotal);
+	NMA_UNLOCK(nmd);
 	return 0;	// XXX bad address
 }
 
+int
+netmap_mem_get_info(struct netmap_mem_d* nmd, u_int* size, u_int *memflags)
+{
+	int error = 0;
+	NMA_LOCK(nmd);
+	error = nmd->config(nmd);
+	if (error)
+		goto out;
+	if (nmd->flags & NETMAP_MEM_FINALIZED) {
+		*size = nmd->nm_totalsize;
+	} else {
+		int i;
+		*size = 0;
+		for (i = 0; i < NETMAP_POOLS_NR; i++) {
+			struct netmap_obj_pool *p = nmd->pools + i;
+			*size += (p->_numclusters * p->_clustsize);
+		}
+	}
+	*memflags = nmd->flags;
+out:
+	NMA_UNLOCK(nmd);
+	return error;
+}
+
 /*
  * we store objects by kernel address, need to find the offset
  * within the pool to export the value to userspace.
@@ -271,7 +248,7 @@ netmap_ofstophys(vm_offset_t offset)
 static ssize_t
 netmap_obj_offset(struct netmap_obj_pool *p, const void *vaddr)
 {
-	int i, k = p->clustentries, n = p->objtotal;
+	int i, k = p->_clustentries, n = p->objtotal;
 	ssize_t ofs = 0;
 
 	for (i = 0; i < n; i += k, ofs += p->_clustsize) {
@@ -292,25 +269,35 @@ netmap_obj_offset(struct netmap_obj_pool *p, const void *vaddr)
 }
 
 /* Helper functions which convert virtual addresses to offsets */
-#define netmap_if_offset(v)					\
-	netmap_obj_offset(&nm_mem.pools[NETMAP_IF_POOL], (v))
+#define netmap_if_offset(n, v)					\
+	netmap_obj_offset(&(n)->pools[NETMAP_IF_POOL], (v))
 
-#define netmap_ring_offset(v)					\
-    (nm_mem.pools[NETMAP_IF_POOL]._memtotal + 			\
-	netmap_obj_offset(&nm_mem.pools[NETMAP_RING_POOL], (v)))
+#define netmap_ring_offset(n, v)				\
+    ((n)->pools[NETMAP_IF_POOL].memtotal + 			\
+	netmap_obj_offset(&(n)->pools[NETMAP_RING_POOL], (v)))
 
-#define netmap_buf_offset(v)					\
-    (nm_mem.pools[NETMAP_IF_POOL]._memtotal +			\
-	nm_mem.pools[NETMAP_RING_POOL]._memtotal +		\
-	netmap_obj_offset(&nm_mem.pools[NETMAP_BUF_POOL], (v)))
+#define netmap_buf_offset(n, v)					\
+    ((n)->pools[NETMAP_IF_POOL].memtotal +			\
+	(n)->pools[NETMAP_RING_POOL].memtotal +		\
+	netmap_obj_offset(&(n)->pools[NETMAP_BUF_POOL], (v)))
 
 
+ssize_t
+netmap_mem_if_offset(struct netmap_mem_d *nmd, const void *addr)
+{
+	ssize_t v;
+	NMA_LOCK(nmd);
+	v = netmap_if_offset(nmd, addr);
+	NMA_UNLOCK(nmd);
+	return v;
+}
+
 /*
  * report the index, and use start position as a hint,
  * otherwise buffer allocation becomes terribly expensive.
  */
 static void *
-netmap_obj_malloc(struct netmap_obj_pool *p, int len, uint32_t *start, uint32_t *index)
+netmap_obj_malloc(struct netmap_obj_pool *p, u_int len, uint32_t *start, uint32_t *index)
 {
 	uint32_t i = 0;			/* index in the bitmap */
 	uint32_t mask, j;		/* slot counter */
@@ -374,10 +361,10 @@ netmap_obj_free(struct netmap_obj_pool *p, uint32_t j)
 static void
 netmap_obj_free_va(struct netmap_obj_pool *p, void *vaddr)
 {
-	int i, j, n = p->_memtotal / p->_clustsize;
+	u_int i, j, n = p->numclusters;
 
-	for (i = 0, j = 0; i < n; i++, j += p->clustentries) {
-		void *base = p->lut[i * p->clustentries].vaddr;
+	for (i = 0, j = 0; i < n; i++, j += p->_clustentries) {
+		void *base = p->lut[i * p->_clustentries].vaddr;
 		ssize_t relofs = (ssize_t) vaddr - (ssize_t) base;
 
 		/* Given address, is out of the scope of the current cluster.*/
@@ -385,7 +372,7 @@ netmap_obj_free_va(struct netmap_obj_pool *p, void *vaddr)
 			continue;
 
 		j = j + relofs / p->_objsize;
-		KASSERT(j != 0, ("Cannot free object 0"));
+		/* KASSERT(j != 0, ("Cannot free object 0")); */
 		netmap_obj_free(p, j);
 		return;
 	}
@@ -393,32 +380,32 @@ netmap_obj_free_va(struct netmap_obj_pool *p, void *vaddr)
 	    vaddr, p->name);
 }
 
-#define netmap_if_malloc(len)	netmap_obj_malloc(&nm_mem.pools[NETMAP_IF_POOL], len, NULL, NULL)
-#define netmap_if_free(v)	netmap_obj_free_va(&nm_mem.pools[NETMAP_IF_POOL], (v))
-#define netmap_ring_malloc(len)	netmap_obj_malloc(&nm_mem.pools[NETMAP_RING_POOL], len, NULL, NULL)
-#define netmap_ring_free(v)	netmap_obj_free_va(&nm_mem.pools[NETMAP_RING_POOL], (v))
-#define netmap_buf_malloc(_pos, _index)			\
-	netmap_obj_malloc(&nm_mem.pools[NETMAP_BUF_POOL], NETMAP_BUF_SIZE, _pos, _index)
+#define netmap_if_malloc(n, len)	netmap_obj_malloc(&(n)->pools[NETMAP_IF_POOL], len, NULL, NULL)
+#define netmap_if_free(n, v)		netmap_obj_free_va(&(n)->pools[NETMAP_IF_POOL], (v))
+#define netmap_ring_malloc(n, len)	netmap_obj_malloc(&(n)->pools[NETMAP_RING_POOL], len, NULL, NULL)
+#define netmap_ring_free(n, v)		netmap_obj_free_va(&(n)->pools[NETMAP_RING_POOL], (v))
+#define netmap_buf_malloc(n, _pos, _index)			\
+	netmap_obj_malloc(&(n)->pools[NETMAP_BUF_POOL], NETMAP_BDG_BUF_SIZE(n), _pos, _index)
 
 
 /* Return the index associated to the given packet buffer */
-#define netmap_buf_index(v)						\
-    (netmap_obj_offset(&nm_mem.pools[NETMAP_BUF_POOL], (v)) / nm_mem.pools[NETMAP_BUF_POOL]._objsize)
+#define netmap_buf_index(n, v)						\
+    (netmap_obj_offset(&(n)->pools[NETMAP_BUF_POOL], (v)) / NETMAP_BDG_BUF_SIZE(n))
 
 
 /* Return nonzero on error */
 static int
-netmap_new_bufs(struct netmap_if *nifp,
+netmap_new_bufs(struct netmap_mem_d *nmd, struct netmap_if *nifp,
                 struct netmap_slot *slot, u_int n)
 {
-	struct netmap_obj_pool *p = &nm_mem.pools[NETMAP_BUF_POOL];
-	int i = 0;	/* slot counter */
+	struct netmap_obj_pool *p = &nmd->pools[NETMAP_BUF_POOL];
+	u_int i = 0;	/* slot counter */
 	uint32_t pos = 0;	/* slot in p->bitmap */
 	uint32_t index = 0;	/* buffer index */
 
 	(void)nifp;	/* UNUSED */
 	for (i = 0; i < n; i++) {
-		void *vaddr = netmap_buf_malloc(&pos, &index);
+		void *vaddr = netmap_buf_malloc(nmd, &pos, &index);
 		if (vaddr == NULL) {
 			D("unable to locate empty packet buffer");
 			goto cleanup;
@@ -446,10 +433,11 @@ cleanup:
 
 
 static void
-netmap_free_buf(struct netmap_if *nifp, uint32_t i)
+netmap_free_buf(struct netmap_mem_d *nmd, struct netmap_if *nifp, uint32_t i)
 {
-	struct netmap_obj_pool *p = &nm_mem.pools[NETMAP_BUF_POOL];
+	struct netmap_obj_pool *p = &nmd->pools[NETMAP_BUF_POOL];
 
+	(void)nifp;
 	if (i < 2 || i >= p->objtotal) {
 		D("Cannot free buf#%d: should be in [2, %d[", i, p->objtotal);
 		return;
@@ -460,16 +448,19 @@ netmap_free_buf(struct netmap_if *nifp, uint32_t i)
 static void
 netmap_reset_obj_allocator(struct netmap_obj_pool *p)
 {
+
 	if (p == NULL)
 		return;
 	if (p->bitmap)
 		free(p->bitmap, M_NETMAP);
 	p->bitmap = NULL;
 	if (p->lut) {
-		int i;
-		for (i = 0; i < p->objtotal; i += p->clustentries) {
+		u_int i;
+		size_t sz = p->_clustsize;
+
+		for (i = 0; i < p->objtotal; i += p->_clustentries) {
 			if (p->lut[i].vaddr)
-				contigfree(p->lut[i].vaddr, p->_clustsize, M_NETMAP);
+				contigfree(p->lut[i].vaddr, sz, M_NETMAP);
 		}
 		bzero(p->lut, sizeof(struct lut_entry) * p->objtotal);
 #ifdef linux
@@ -479,6 +470,10 @@ netmap_reset_obj_allocator(struct netmap_obj_pool *p)
 #endif
 	}
 	p->lut = NULL;
+	p->objtotal = 0;
+	p->memtotal = 0;
+	p->numclusters = 0;
+	p->objfree = 0;
 }
 
 /*
@@ -496,8 +491,7 @@ netmap_destroy_obj_allocator(struct netmap_obj_pool *p)
  * We receive a request for objtotal objects, of size objsize each.
  * Internally we may round up both numbers, as we allocate objects
  * in small clusters multiple of the page size.
- * In the allocator we don't need to store the objsize,
- * but we do need to keep track of objtotal' and clustentries,
+ * We need to keep track of objtotal and clustentries,
  * as they are needed when freeing memory.
  *
  * XXX note -- userspace needs the buffers to be contiguous,
@@ -509,16 +503,21 @@ netmap_destroy_obj_allocator(struct netmap_obj_pool *p)
 static int
 netmap_config_obj_allocator(struct netmap_obj_pool *p, u_int objtotal, u_int objsize)
 {
-	int i, n;
+	int i;
 	u_int clustsize;	/* the cluster size, multiple of page size */
 	u_int clustentries;	/* how many objects per entry */
 
+	/* we store the current request, so we can
+	 * detect configuration changes later */
+	p->r_objtotal = objtotal;
+	p->r_objsize = objsize;
+
 #define MAX_CLUSTSIZE	(1<<17)
 #define LINE_ROUND	64
 	if (objsize >= MAX_CLUSTSIZE) {
 		/* we could do it but there is no point */
 		D("unsupported allocation for %d bytes", objsize);
-		goto error;
+		return EINVAL;
 	}
 	/* make sure objsize is a multiple of LINE_ROUND */
 	i = (objsize & (LINE_ROUND - 1));
@@ -529,12 +528,12 @@ netmap_config_obj_allocator(struct netmap_obj_pool *p, u_int objtotal, u_int obj
 	if (objsize < p->objminsize || objsize > p->objmaxsize) {
 		D("requested objsize %d out of range [%d, %d]",
 			objsize, p->objminsize, p->objmaxsize);
-		goto error;
+		return EINVAL;
 	}
 	if (objtotal < p->nummin || objtotal > p->nummax) {
 		D("requested objtotal %d out of range [%d, %d]",
 			objtotal, p->nummin, p->nummax);
-		goto error;
+		return EINVAL;
 	}
 	/*
 	 * Compute number of objects using a brute-force approach:
@@ -568,22 +567,15 @@ netmap_config_obj_allocator(struct netmap_obj_pool *p, u_int objtotal, u_int obj
 	 * The number of clusters is n = ceil(objtotal/clustentries)
 	 * objtotal' = n * clustentries
 	 */
-	p->clustentries = clustentries;
+	p->_clustentries = clustentries;
 	p->_clustsize = clustsize;
-	n = (objtotal + clustentries - 1) / clustentries;
-	p->_numclusters = n;
-	p->objtotal = n * clustentries;
-	p->objfree = p->objtotal - 2; /* obj 0 and 1 are reserved */
-	p->_memtotal = p->_numclusters * p->_clustsize;
-	p->_objsize = objsize;
+	p->_numclusters = (objtotal + clustentries - 1) / clustentries;
 
-	return 0;
-
-error:
+	/* actual values (may be larger than requested) */
 	p->_objsize = objsize;
-	p->objtotal = objtotal;
+	p->_objtotal = p->_numclusters * clustentries;
 
-	return EINVAL;
+	return 0;
 }
 
 
@@ -591,7 +583,12 @@ error:
 static int
 netmap_finalize_obj_allocator(struct netmap_obj_pool *p)
 {
-	int i, n;
+	int i; /* must be signed */
+	size_t n;
+
+	/* optimistically assume we have enough memory */
+	p->numclusters = p->_numclusters;
+	p->objtotal = p->_objtotal;
 
 	n = sizeof(struct lut_entry) * p->objtotal;
 #ifdef linux
@@ -600,7 +597,7 @@ netmap_finalize_obj_allocator(struct netmap_obj_pool *p)
 	p->lut = malloc(n, M_NETMAP, M_NOWAIT | M_ZERO);
 #endif
 	if (p->lut == NULL) {
-		D("Unable to create lookup table (%d bytes) for '%s'", n, p->name);
+		D("Unable to create lookup table (%d bytes) for '%s'", (int)n, p->name);
 		goto clean;
 	}
 
@@ -608,7 +605,7 @@ netmap_finalize_obj_allocator(struct netmap_obj_pool *p)
 	n = (p->objtotal + 31) / 32;
 	p->bitmap = malloc(sizeof(uint32_t) * n, M_NETMAP, M_NOWAIT | M_ZERO);
 	if (p->bitmap == NULL) {
-		D("Unable to create bitmap (%d entries) for allocator '%s'", n,
+		D("Unable to create bitmap (%d entries) for allocator '%s'", (int)n,
 		    p->name);
 		goto clean;
 	}
@@ -617,31 +614,34 @@ netmap_finalize_obj_allocator(struct netmap_obj_pool *p)
 	/*
 	 * Allocate clusters, init pointers and bitmap
 	 */
-	for (i = 0; i < p->objtotal;) {
-		int lim = i + p->clustentries;
+
+	n = p->_clustsize;
+	for (i = 0; i < (int)p->objtotal;) {
+		int lim = i + p->_clustentries;
 		char *clust;
 
-		clust = contigmalloc(p->_clustsize, M_NETMAP, M_NOWAIT | M_ZERO,
-		    0, -1UL, PAGE_SIZE, 0);
+		clust = contigmalloc(n, M_NETMAP, M_NOWAIT | M_ZERO,
+		    (size_t)0, -1UL, PAGE_SIZE, 0);
 		if (clust == NULL) {
 			/*
 			 * If we get here, there is a severe memory shortage,
 			 * so halve the allocated memory to reclaim some.
-			 * XXX check boundaries
 			 */
 			D("Unable to create cluster at %d for '%s' allocator",
 			    i, p->name);
+			if (i < 2) /* nothing to halve */
+				goto out;
 			lim = i / 2;
 			for (i--; i >= lim; i--) {
 				p->bitmap[ (i>>5) ] &=  ~( 1 << (i & 31) );
-				if (i % p->clustentries == 0 && p->lut[i].vaddr)
+				if (i % p->_clustentries == 0 && p->lut[i].vaddr)
 					contigfree(p->lut[i].vaddr,
-						p->_clustsize, M_NETMAP);
+						n, M_NETMAP);
 			}
+		out:
 			p->objtotal = i;
-			p->objfree = p->objtotal - 2;
-			p->_numclusters = i / p->clustentries;
-			p->_memtotal = p->_numclusters * p->_clustsize;
+			/* we may have stopped in the middle of a cluster */
+			p->numclusters = (i + p->_clustentries - 1) / p->_clustentries;
 			break;
 		}
 		for (; i < lim; i++, clust += p->_objsize) {
@@ -650,11 +650,14 @@ netmap_finalize_obj_allocator(struct netmap_obj_pool *p)
 			p->lut[i].paddr = vtophys(clust);
 		}
 	}
-	p->bitmap[0] = ~3; /* objs 0 and 1 is always busy */
+	p->objfree = p->objtotal;
+	p->memtotal = p->numclusters * p->_clustsize;
+	if (p->objfree == 0)
+		goto clean;
 	if (netmap_verbose)
 		D("Pre-allocated %d clusters (%d/%dKB) for '%s'",
-		    p->_numclusters, p->_clustsize >> 10,
-		    p->_memtotal >> 10, p->name);
+		    p->numclusters, p->_clustsize >> 10,
+		    p->memtotal >> 10, p->name);
 
 	return 0;
 
@@ -665,148 +668,275 @@ clean:
 
 /* call with lock held */
 static int
-netmap_memory_config_changed(void)
+netmap_memory_config_changed(struct netmap_mem_d *nmd)
 {
 	int i;
 
 	for (i = 0; i < NETMAP_POOLS_NR; i++) {
-		if (nm_mem.pools[i]._objsize != netmap_params[i].size ||
-		    nm_mem.pools[i].objtotal != netmap_params[i].num)
+		if (nmd->pools[i].r_objsize != netmap_params[i].size ||
+		    nmd->pools[i].r_objtotal != netmap_params[i].num)
 		    return 1;
 	}
 	return 0;
 }
 
+static void
+netmap_mem_reset_all(struct netmap_mem_d *nmd)
+{
+	int i;
+	D("resetting %p", nmd);
+	for (i = 0; i < NETMAP_POOLS_NR; i++) {
+		netmap_reset_obj_allocator(&nmd->pools[i]);
+	}
+	nmd->flags  &= ~NETMAP_MEM_FINALIZED;
+}
+
+static int
+netmap_mem_finalize_all(struct netmap_mem_d *nmd)
+{
+	int i;
+	if (nmd->flags & NETMAP_MEM_FINALIZED)
+		return 0;
+	nmd->lasterr = 0;
+	nmd->nm_totalsize = 0;
+	for (i = 0; i < NETMAP_POOLS_NR; i++) {
+		nmd->lasterr = netmap_finalize_obj_allocator(&nmd->pools[i]);
+		if (nmd->lasterr)
+			goto error;
+		nmd->nm_totalsize += nmd->pools[i].memtotal;
+	}
+	/* buffers 0 and 1 are reserved */
+	nmd->pools[NETMAP_BUF_POOL].objfree -= 2;
+	nmd->pools[NETMAP_BUF_POOL].bitmap[0] = ~3;
+	nmd->flags |= NETMAP_MEM_FINALIZED;
+
+	D("Have %d KB for interfaces, %d KB for rings and %d MB for buffers",
+	    nmd->pools[NETMAP_IF_POOL].memtotal >> 10,
+	    nmd->pools[NETMAP_RING_POOL].memtotal >> 10,
+	    nmd->pools[NETMAP_BUF_POOL].memtotal >> 20);
+
+	D("Free buffers: %d", nmd->pools[NETMAP_BUF_POOL].objfree);
+
+
+	return 0;
+error:
+	netmap_mem_reset_all(nmd);
+	return nmd->lasterr;
+}
+
+
+
+void
+netmap_mem_private_delete(struct netmap_mem_d *nmd)
+{
+	if (nmd == NULL)
+		return;
+	D("deleting %p", nmd);
+	if (nmd->refcount > 0)
+		D("bug: deleting mem allocator with refcount=%d!", nmd->refcount);
+	D("done deleting %p", nmd);
+	NMA_LOCK_DESTROY(nmd);
+	free(nmd, M_DEVBUF);
+}
+
+static int
+netmap_mem_private_config(struct netmap_mem_d *nmd)
+{
+	/* nothing to do, we are configured on creation
+ 	 * and configuration never changes thereafter
+ 	 */
+	return 0;
+}
+
+static int
+netmap_mem_private_finalize(struct netmap_mem_d *nmd)
+{
+	int err;
+	NMA_LOCK(nmd);
+	nmd->refcount++;
+	err = netmap_mem_finalize_all(nmd);
+	NMA_UNLOCK(nmd);
+	return err;
+
+}
+
+static void netmap_mem_private_deref(struct netmap_mem_d *nmd)
+{
+	NMA_LOCK(nmd);
+	if (--nmd->refcount <= 0)
+		netmap_mem_reset_all(nmd);
+	NMA_UNLOCK(nmd);
+}
+
+struct netmap_mem_d *
+netmap_mem_private_new(const char *name, u_int txr, u_int txd, u_int rxr, u_int rxd)
+{
+	struct netmap_mem_d *d = NULL;
+	struct netmap_obj_params p[NETMAP_POOLS_NR];
+	int i;
+	u_int maxd;
+
+	d = malloc(sizeof(struct netmap_mem_d),
+			M_DEVBUF, M_NOWAIT | M_ZERO);
+	if (d == NULL)
+		return NULL;
+
+	*d = nm_blueprint;
+
+	/* XXX the rest of the code assumes the stack rings are alwasy present */
+	txr++;
+	rxr++;
+	p[NETMAP_IF_POOL].size = sizeof(struct netmap_if) +
+		sizeof(ssize_t) * (txr + rxr);
+	p[NETMAP_IF_POOL].num = 2;
+	maxd = (txd > rxd) ? txd : rxd;
+	p[NETMAP_RING_POOL].size = sizeof(struct netmap_ring) +
+		sizeof(struct netmap_slot) * maxd;
+	p[NETMAP_RING_POOL].num = txr + rxr;
+	p[NETMAP_BUF_POOL].size = 2048; /* XXX find a way to let the user choose this */
+	p[NETMAP_BUF_POOL].num = rxr * (rxd + 2) + txr * (txd + 2);
+
+	D("req if %d*%d ring %d*%d buf %d*%d",
+			p[NETMAP_IF_POOL].num,
+			p[NETMAP_IF_POOL].size,
+			p[NETMAP_RING_POOL].num,
+			p[NETMAP_RING_POOL].size,
+			p[NETMAP_BUF_POOL].num,
+			p[NETMAP_BUF_POOL].size);
+
+	for (i = 0; i < NETMAP_POOLS_NR; i++) {
+		snprintf(d->pools[i].name, NETMAP_POOL_MAX_NAMSZ,
+				nm_blueprint.pools[i].name,
+				name);
+		if (netmap_config_obj_allocator(&d->pools[i],
+				p[i].num, p[i].size))
+			goto error;
+	}
+
+	d->flags &= ~NETMAP_MEM_FINALIZED;
+
+	NMA_LOCK_INIT(d);
+
+	return d;
+error:
+	netmap_mem_private_delete(d);
+	return NULL;
+}
+
 
 /* call with lock held */
 static int
-netmap_memory_config(void)
+netmap_mem_global_config(struct netmap_mem_d *nmd)
 {
 	int i;
 
-	if (!netmap_memory_config_changed())
+	if (nmd->refcount)
+		/* already in use, we cannot change the configuration */
+		goto out;
+
+	if (!netmap_memory_config_changed(nmd))
 		goto out;
 
 	D("reconfiguring");
 
-	if (nm_mem.finalized) {
+	if (nmd->flags & NETMAP_MEM_FINALIZED) {
 		/* reset previous allocation */
 		for (i = 0; i < NETMAP_POOLS_NR; i++) {
-			netmap_reset_obj_allocator(&nm_mem.pools[i]);
+			netmap_reset_obj_allocator(&nmd->pools[i]);
 		}
-		nm_mem.finalized = 0;
+		nmd->flags &= ~NETMAP_MEM_FINALIZED;
         }
 
 	for (i = 0; i < NETMAP_POOLS_NR; i++) {
-		nm_mem.lasterr = netmap_config_obj_allocator(&nm_mem.pools[i],
+		nmd->lasterr = netmap_config_obj_allocator(&nmd->pools[i],
 				netmap_params[i].num, netmap_params[i].size);
-		if (nm_mem.lasterr)
+		if (nmd->lasterr)
 			goto out;
 	}
 
-	D("Have %d KB for interfaces, %d KB for rings and %d MB for buffers",
-	    nm_mem.pools[NETMAP_IF_POOL]._memtotal >> 10,
-	    nm_mem.pools[NETMAP_RING_POOL]._memtotal >> 10,
-	    nm_mem.pools[NETMAP_BUF_POOL]._memtotal >> 20);
-
 out:
 
-	return nm_mem.lasterr;
+	return nmd->lasterr;
 }
 
-/* call with lock held */
 static int
-netmap_memory_finalize(void)
+netmap_mem_global_finalize(struct netmap_mem_d *nmd)
 {
-	int i;
-	u_int totalsize = 0;
+	int err;
+
+	NMA_LOCK(nmd);
 
-	nm_mem.refcount++;
-	if (nm_mem.refcount > 1) {
-		ND("busy (refcount %d)", nm_mem.refcount);
-		goto out;
-	}
 
 	/* update configuration if changed */
-	if (netmap_memory_config())
+	if (netmap_mem_global_config(nmd))
 		goto out;
 
-	if (nm_mem.finalized) {
+	nmd->refcount++;
+
+	if (nmd->flags & NETMAP_MEM_FINALIZED) {
 		/* may happen if config is not changed */
 		ND("nothing to do");
 		goto out;
 	}
 
-	for (i = 0; i < NETMAP_POOLS_NR; i++) {
-		nm_mem.lasterr = netmap_finalize_obj_allocator(&nm_mem.pools[i]);
-		if (nm_mem.lasterr)
-			goto cleanup;
-		totalsize += nm_mem.pools[i]._memtotal;
-	}
-	nm_mem.nm_totalsize = totalsize;
+	if (netmap_mem_finalize_all(nmd))
+		goto out;
 
 	/* backward compatibility */
-	netmap_buf_size = nm_mem.pools[NETMAP_BUF_POOL]._objsize;
-	netmap_total_buffers = nm_mem.pools[NETMAP_BUF_POOL].objtotal;
-
-	netmap_buffer_lut = nm_mem.pools[NETMAP_BUF_POOL].lut;
-	netmap_buffer_base = nm_mem.pools[NETMAP_BUF_POOL].lut[0].vaddr;
+	netmap_buf_size = nmd->pools[NETMAP_BUF_POOL]._objsize;
+	netmap_total_buffers = nmd->pools[NETMAP_BUF_POOL].objtotal;
 
-	nm_mem.finalized = 1;
-	nm_mem.lasterr = 0;
+	netmap_buffer_lut = nmd->pools[NETMAP_BUF_POOL].lut;
+	netmap_buffer_base = nmd->pools[NETMAP_BUF_POOL].lut[0].vaddr;
 
-	/* make sysctl values match actual values in the pools */
-	for (i = 0; i < NETMAP_POOLS_NR; i++) {
-		netmap_params[i].size = nm_mem.pools[i]._objsize;
-		netmap_params[i].num  = nm_mem.pools[i].objtotal;
-	}
+	nmd->lasterr = 0;
 
 out:
-	if (nm_mem.lasterr)
-		nm_mem.refcount--;
+	if (nmd->lasterr)
+		nmd->refcount--;
+	err = nmd->lasterr;
 
-	return nm_mem.lasterr;
+	NMA_UNLOCK(nmd);
 
-cleanup:
-	for (i = 0; i < NETMAP_POOLS_NR; i++) {
-		netmap_reset_obj_allocator(&nm_mem.pools[i]);
-	}
-	nm_mem.refcount--;
+	return err;
 
-	return nm_mem.lasterr;
 }
 
-static int
-netmap_memory_init(void)
+int
+netmap_mem_init(void)
 {
-	NMA_LOCK_INIT();
+	NMA_LOCK_INIT(&nm_mem);
 	return (0);
 }
 
-static void
-netmap_memory_fini(void)
+void
+netmap_mem_fini(void)
 {
 	int i;
 
 	for (i = 0; i < NETMAP_POOLS_NR; i++) {
 	    netmap_destroy_obj_allocator(&nm_mem.pools[i]);
 	}
-	NMA_LOCK_DESTROY();
+	NMA_LOCK_DESTROY(&nm_mem);
 }
 
 static void
 netmap_free_rings(struct netmap_adapter *na)
 {
-	int i;
+	u_int i;
 	if (!na->tx_rings)
 		return;
 	for (i = 0; i < na->num_tx_rings + 1; i++) {
-		netmap_ring_free(na->tx_rings[i].ring);
-		na->tx_rings[i].ring = NULL;
+		if (na->tx_rings[i].ring) {
+			netmap_ring_free(na->nm_mem, na->tx_rings[i].ring);
+			na->tx_rings[i].ring = NULL;
+		}
 	}
 	for (i = 0; i < na->num_rx_rings + 1; i++) {
-		netmap_ring_free(na->rx_rings[i].ring);
-		na->rx_rings[i].ring = NULL;
+		if (na->rx_rings[i].ring) {
+			netmap_ring_free(na->nm_mem, na->rx_rings[i].ring);
+			na->rx_rings[i].ring = NULL;
+		}
 	}
 	free(na->tx_rings, M_DEVBUF);
 	na->tx_rings = na->rx_rings = NULL;
@@ -818,50 +948,76 @@ netmap_free_rings(struct netmap_adapter *na)
 /*
  * Allocate the per-fd structure netmap_if.
  * If this is the first instance, also allocate the krings, rings etc.
+ *
+ * We assume that the configuration stored in na
+ * (number of tx/rx rings and descs) does not change while
+ * the interface is in netmap mode.
  */
-static void *
-netmap_if_new(const char *ifname, struct netmap_adapter *na)
+extern int nma_is_vp(struct netmap_adapter *na);
+struct netmap_if *
+netmap_mem_if_new(const char *ifname, struct netmap_adapter *na)
 {
 	struct netmap_if *nifp;
 	struct netmap_ring *ring;
 	ssize_t base; /* handy for relative offsets between rings and nifp */
 	u_int i, len, ndesc, ntx, nrx;
 	struct netmap_kring *kring;
+	uint32_t *tx_leases = NULL, *rx_leases = NULL;
 
-	if (netmap_update_config(na)) {
-		/* configuration mismatch, report and fail */
-		return NULL;
-	}
+	/*
+	 * verify whether virtual port need the stack ring
+	 */
 	ntx = na->num_tx_rings + 1; /* shorthand, include stack ring */
 	nrx = na->num_rx_rings + 1; /* shorthand, include stack ring */
 	/*
 	 * the descriptor is followed inline by an array of offsets
 	 * to the tx and rx rings in the shared memory region.
+	 * For virtual rx rings we also allocate an array of
+	 * pointers to assign to nkr_leases.
 	 */
+
+	NMA_LOCK(na->nm_mem);
+
 	len = sizeof(struct netmap_if) + (nrx + ntx) * sizeof(ssize_t);
-	nifp = netmap_if_malloc(len);
+	nifp = netmap_if_malloc(na->nm_mem, len);
 	if (nifp == NULL) {
+		NMA_UNLOCK(na->nm_mem);
 		return NULL;
 	}
 
 	/* initialize base fields -- override const */
-	*(int *)(uintptr_t)&nifp->ni_tx_rings = na->num_tx_rings;
-	*(int *)(uintptr_t)&nifp->ni_rx_rings = na->num_rx_rings;
-	strncpy(nifp->ni_name, ifname, IFNAMSIZ);
+	*(u_int *)(uintptr_t)&nifp->ni_tx_rings = na->num_tx_rings;
+	*(u_int *)(uintptr_t)&nifp->ni_rx_rings = na->num_rx_rings;
+	strncpy(nifp->ni_name, ifname, (size_t)IFNAMSIZ);
 
-	(na->refcount)++;	/* XXX atomic ? we are under lock */
-	if (na->refcount > 1) { /* already setup, we are done */
+	if (na->refcount) { /* already setup, we are done */
 		goto final;
 	}
 
 	len = (ntx + nrx) * sizeof(struct netmap_kring);
-	na->tx_rings = malloc(len, M_DEVBUF, M_NOWAIT | M_ZERO);
+	/*
+	 * Leases are attached to TX rings on NIC/host ports,
+	 * and to RX rings on VALE ports.
+	 */
+	if (nma_is_vp(na)) {
+		len += sizeof(uint32_t) * na->num_rx_desc * na->num_rx_rings;
+	} else {
+		len += sizeof(uint32_t) * na->num_tx_desc * ntx;
+	}
+
+	na->tx_rings = malloc((size_t)len, M_DEVBUF, M_NOWAIT | M_ZERO);
 	if (na->tx_rings == NULL) {
 		D("Cannot allocate krings for %s", ifname);
 		goto cleanup;
 	}
 	na->rx_rings = na->tx_rings + ntx;
 
+	if (nma_is_vp(na)) {
+		rx_leases = (uint32_t *)(na->rx_rings + nrx);
+	} else {
+		tx_leases = (uint32_t *)(na->rx_rings + nrx);
+	}
+
 	/*
 	 * First instance, allocate netmap rings and buffers for this card
 	 * The rings are contiguous, but have variable size.
@@ -872,7 +1028,7 @@ netmap_if_new(const char *ifname, struct netmap_adapter *na)
 		bzero(kring, sizeof(*kring));
 		len = sizeof(struct netmap_ring) +
 			  ndesc * sizeof(struct netmap_slot);
-		ring = netmap_ring_malloc(len);
+		ring = netmap_ring_malloc(na->nm_mem, len);
 		if (ring == NULL) {
 			D("Cannot allocate tx_ring[%d] for %s", i, ifname);
 			goto cleanup;
@@ -880,11 +1036,15 @@ netmap_if_new(const char *ifname, struct netmap_adapter *na)
 		ND("txring[%d] at %p ofs %d", i, ring);
 		kring->na = na;
 		kring->ring = ring;
-		*(int *)(uintptr_t)&ring->num_slots = kring->nkr_num_slots = ndesc;
+		if (tx_leases) {
+			kring->nkr_leases = tx_leases;
+			tx_leases += ndesc;
+		}
+		*(uint32_t *)(uintptr_t)&ring->num_slots = kring->nkr_num_slots = ndesc;
 		*(ssize_t *)(uintptr_t)&ring->buf_ofs =
-		    (nm_mem.pools[NETMAP_IF_POOL]._memtotal +
-			nm_mem.pools[NETMAP_RING_POOL]._memtotal) -
-			netmap_ring_offset(ring);
+		    (na->nm_mem->pools[NETMAP_IF_POOL].memtotal +
+			na->nm_mem->pools[NETMAP_RING_POOL].memtotal) -
+			netmap_ring_offset(na->nm_mem, ring);
 
 		/*
 		 * IMPORTANT:
@@ -894,9 +1054,10 @@ netmap_if_new(const char *ifname, struct netmap_adapter *na)
 		 */
 		ring->avail = kring->nr_hwavail = ndesc - 1;
 		ring->cur = kring->nr_hwcur = 0;
-		*(int *)(uintptr_t)&ring->nr_buf_size = NETMAP_BUF_SIZE;
+		*(uint16_t *)(uintptr_t)&ring->nr_buf_size =
+			NETMAP_BDG_BUF_SIZE(na->nm_mem);
 		ND("initializing slots for txring[%d]", i);
-		if (netmap_new_bufs(nifp, ring->slot, ndesc)) {
+		if (netmap_new_bufs(na->nm_mem, nifp, ring->slot, ndesc)) {
 			D("Cannot allocate buffers for tx_ring[%d] for %s", i, ifname);
 			goto cleanup;
 		}
@@ -908,7 +1069,7 @@ netmap_if_new(const char *ifname, struct netmap_adapter *na)
 		bzero(kring, sizeof(*kring));
 		len = sizeof(struct netmap_ring) +
 			  ndesc * sizeof(struct netmap_slot);
-		ring = netmap_ring_malloc(len);
+		ring = netmap_ring_malloc(na->nm_mem, len);
 		if (ring == NULL) {
 			D("Cannot allocate rx_ring[%d] for %s", i, ifname);
 			goto cleanup;
@@ -917,17 +1078,22 @@ netmap_if_new(const char *ifname, struct netmap_adapter *na)
 
 		kring->na = na;
 		kring->ring = ring;
-		*(int *)(uintptr_t)&ring->num_slots = kring->nkr_num_slots = ndesc;
+		if (rx_leases && i < na->num_rx_rings) {
+			kring->nkr_leases = rx_leases;
+			rx_leases += ndesc;
+		}
+		*(uint32_t *)(uintptr_t)&ring->num_slots = kring->nkr_num_slots = ndesc;
 		*(ssize_t *)(uintptr_t)&ring->buf_ofs =
-		    (nm_mem.pools[NETMAP_IF_POOL]._memtotal +
-		        nm_mem.pools[NETMAP_RING_POOL]._memtotal) -
-			netmap_ring_offset(ring);
+		    (na->nm_mem->pools[NETMAP_IF_POOL].memtotal +
+		        na->nm_mem->pools[NETMAP_RING_POOL].memtotal) -
+			netmap_ring_offset(na->nm_mem, ring);
 
 		ring->cur = kring->nr_hwcur = 0;
 		ring->avail = kring->nr_hwavail = 0; /* empty */
-		*(int *)(uintptr_t)&ring->nr_buf_size = NETMAP_BUF_SIZE;
+		*(int *)(uintptr_t)&ring->nr_buf_size =
+			NETMAP_BDG_BUF_SIZE(na->nm_mem);
 		ND("initializing slots for rxring[%d]", i);
-		if (netmap_new_bufs(nifp, ring->slot, ndesc)) {
+		if (netmap_new_bufs(na->nm_mem, nifp, ring->slot, ndesc)) {
 			D("Cannot allocate buffers for rx_ring[%d] for %s", i, ifname);
 			goto cleanup;
 		}
@@ -947,28 +1113,78 @@ final:
 	 * between the ring and nifp, so the information is usable in
 	 * userspace to reach the ring from the nifp.
 	 */
-	base = netmap_if_offset(nifp);
+	base = netmap_if_offset(na->nm_mem, nifp);
 	for (i = 0; i < ntx; i++) {
 		*(ssize_t *)(uintptr_t)&nifp->ring_ofs[i] =
-			netmap_ring_offset(na->tx_rings[i].ring) - base;
+			netmap_ring_offset(na->nm_mem, na->tx_rings[i].ring) - base;
 	}
 	for (i = 0; i < nrx; i++) {
 		*(ssize_t *)(uintptr_t)&nifp->ring_ofs[i+ntx] =
-			netmap_ring_offset(na->rx_rings[i].ring) - base;
+			netmap_ring_offset(na->nm_mem, na->rx_rings[i].ring) - base;
 	}
+
+	NMA_UNLOCK(na->nm_mem);
+
 	return (nifp);
 cleanup:
 	netmap_free_rings(na);
-	netmap_if_free(nifp);
-	(na->refcount)--;
+	netmap_if_free(na->nm_mem, nifp);
+
+	NMA_UNLOCK(na->nm_mem);
+
 	return NULL;
 }
 
-/* call with NMA_LOCK held */
+void
+netmap_mem_if_delete(struct netmap_adapter *na, struct netmap_if *nifp)
+{
+	if (nifp == NULL)
+		/* nothing to do */
+		return;
+	NMA_LOCK(na->nm_mem);
+
+	if (na->refcount <= 0) {
+		/* last instance, release bufs and rings */
+		u_int i, j, lim;
+		struct netmap_ring *ring;
+
+		for (i = 0; i < na->num_tx_rings + 1; i++) {
+			ring = na->tx_rings[i].ring;
+			lim = na->tx_rings[i].nkr_num_slots;
+			for (j = 0; j < lim; j++)
+				netmap_free_buf(na->nm_mem, nifp, ring->slot[j].buf_idx);
+		}
+		for (i = 0; i < na->num_rx_rings + 1; i++) {
+			ring = na->rx_rings[i].ring;
+			lim = na->rx_rings[i].nkr_num_slots;
+			for (j = 0; j < lim; j++)
+				netmap_free_buf(na->nm_mem, nifp, ring->slot[j].buf_idx);
+		}
+		netmap_free_rings(na);
+	}
+	netmap_if_free(na->nm_mem, nifp);
+
+	NMA_UNLOCK(na->nm_mem);
+}
+
 static void
-netmap_memory_deref(void)
+netmap_mem_global_deref(struct netmap_mem_d *nmd)
 {
-	nm_mem.refcount--;
+	NMA_LOCK(nmd);
+
+	nmd->refcount--;
 	if (netmap_verbose)
-		D("refcount = %d", nm_mem.refcount);
+		D("refcount = %d", nmd->refcount);
+
+	NMA_UNLOCK(nmd);
+}
+
+int netmap_mem_finalize(struct netmap_mem_d *nmd)
+{
+	return nmd->finalize(nmd);
+}
+
+void netmap_mem_deref(struct netmap_mem_d *nmd)
+{
+	return nmd->deref(nmd);
 }
diff --git a/sys/dev/netmap/netmap_mem2.h b/sys/dev/netmap/netmap_mem2.h
new file mode 100644
index 000000000000..83f31d011c45
--- /dev/null
+++ b/sys/dev/netmap/netmap_mem2.h
@@ -0,0 +1,216 @@
+/*
+ * Copyright (C) 2012-2013 Matteo Landi, Luigi Rizzo, Giuseppe Lettieri. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *   1. Redistributions of source code must retain the above copyright
+ *      notice, this list of conditions and the following disclaimer.
+ *   2. Redistributions in binary form must reproduce the above copyright
+ *      notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ */
+
+/*
+ * $FreeBSD$
+ *
+ * (New) memory allocator for netmap
+ */
+
+/*
+ * This allocator creates three memory pools:
+ *	nm_if_pool	for the struct netmap_if
+ *	nm_ring_pool	for the struct netmap_ring
+ *	nm_buf_pool	for the packet buffers.
+ *
+ * that contain netmap objects. Each pool is made of a number of clusters,
+ * multiple of a page size, each containing an integer number of objects.
+ * The clusters are contiguous in user space but not in the kernel.
+ * Only nm_buf_pool needs to be dma-able,
+ * but for convenience use the same type of allocator for all.
+ *
+ * Once mapped, the three pools are exported to userspace
+ * as a contiguous block, starting from nm_if_pool. Each
+ * cluster (and pool) is an integral number of pages.
+ *   [ . . . ][ . . . . . .][ . . . . . . . . . .]
+ *    nm_if     nm_ring            nm_buf
+ *
+ * The userspace areas contain offsets of the objects in userspace.
+ * When (at init time) we write these offsets, we find out the index
+ * of the object, and from there locate the offset from the beginning
+ * of the region.
+ *
+ * The invididual allocators manage a pool of memory for objects of
+ * the same size.
+ * The pool is split into smaller clusters, whose size is a
+ * multiple of the page size. The cluster size is chosen
+ * to minimize the waste for a given max cluster size
+ * (we do it by brute force, as we have relatively few objects
+ * per cluster).
+ *
+ * Objects are aligned to the cache line (64 bytes) rounding up object
+ * sizes when needed. A bitmap contains the state of each object.
+ * Allocation scans the bitmap; this is done only on attach, so we are not
+ * too worried about performance
+ *
+ * For each allocator we can define (thorugh sysctl) the size and
+ * number of each object. Memory is allocated at the first use of a
+ * netmap file descriptor, and can be freed when all such descriptors
+ * have been released (including unmapping the memory).
+ * If memory is scarce, the system tries to get as much as possible
+ * and the sysctl values reflect the actual allocation.
+ * Together with desired values, the sysctl export also absolute
+ * min and maximum values that cannot be overridden.
+ *
+ * struct netmap_if:
+ *	variable size, max 16 bytes per ring pair plus some fixed amount.
+ *	1024 bytes should be large enough in practice.
+ *
+ *	In the worst case we have one netmap_if per ring in the system.
+ *
+ * struct netmap_ring
+ *	variable size, 8 byte per slot plus some fixed amount.
+ *	Rings can be large (e.g. 4k slots, or >32Kbytes).
+ *	We default to 36 KB (9 pages), and a few hundred rings.
+ *
+ * struct netmap_buffer
+ *	The more the better, both because fast interfaces tend to have
+ *	many slots, and because we may want to use buffers to store
+ *	packets in userspace avoiding copies.
+ *	Must contain a full frame (eg 1518, or more for vlans, jumbo
+ *	frames etc.) plus be nicely aligned, plus some NICs restrict
+ *	the size to multiple of 1K or so. Default to 2K
+ */
+#ifndef _NET_NETMAP_MEM2_H_
+#define _NET_NETMAP_MEM2_H_
+
+
+#define NETMAP_BUF_MAX_NUM	20*4096*2	/* large machine */
+
+#define NETMAP_POOL_MAX_NAMSZ	32
+
+
+enum {
+	NETMAP_IF_POOL   = 0,
+	NETMAP_RING_POOL,
+	NETMAP_BUF_POOL,
+	NETMAP_POOLS_NR
+};
+
+
+struct netmap_obj_params {
+	u_int size;
+	u_int num;
+};
+struct netmap_obj_pool {
+	char name[NETMAP_POOL_MAX_NAMSZ];	/* name of the allocator */
+
+	/* ---------------------------------------------------*/
+	/* these are only meaningful if the pool is finalized */
+	/* (see 'finalized' field in netmap_mem_d)            */
+	u_int objtotal;         /* actual total number of objects. */
+	u_int memtotal;		/* actual total memory space */
+	u_int numclusters;	/* actual number of clusters */
+
+	u_int objfree;          /* number of free objects. */
+
+	struct lut_entry *lut;  /* virt,phys addresses, objtotal entries */
+	uint32_t *bitmap;       /* one bit per buffer, 1 means free */
+	uint32_t bitmap_slots;	/* number of uint32 entries in bitmap */
+	/* ---------------------------------------------------*/
+
+	/* limits */
+	u_int objminsize;	/* minimum object size */
+	u_int objmaxsize;	/* maximum object size */
+	u_int nummin;		/* minimum number of objects */
+	u_int nummax;		/* maximum number of objects */
+
+	/* these are changed only by config */
+	u_int _objtotal;	/* total number of objects */
+	u_int _objsize;		/* object size */
+	u_int _clustsize;       /* cluster size */
+	u_int _clustentries;    /* objects per cluster */
+	u_int _numclusters;	/* number of clusters */
+
+	/* requested values */
+	u_int r_objtotal;
+	u_int r_objsize;
+};
+
+#ifdef linux
+// XXX a mtx would suffice here 20130415 lr
+#define NMA_LOCK_T		struct semaphore
+#else /* !linux */
+#define NMA_LOCK_T		struct mtx
+#endif /* linux */
+
+typedef int (*netmap_mem_config_t)(struct netmap_mem_d*);
+typedef int (*netmap_mem_finalize_t)(struct netmap_mem_d*);
+typedef void (*netmap_mem_deref_t)(struct netmap_mem_d*);
+
+
+/* We implement two kinds of netmap_mem_d structures:
+ *
+ * - global: used by hardware NICS;
+ *
+ * - private: used by VALE ports.
+ *
+ * In both cases, the netmap_mem_d structure has the same lifetime as the
+ * netmap_adapter of the corresponding NIC or port. It is the responsibility of
+ * the client code to delete the private allocator when the associated
+ * netmap_adapter is freed (this is implemented by the NAF_MEM_OWNER flag in
+ * netmap.c).  The 'refcount' field counts the number of active users of the
+ * structure. The global allocator uses this information to prevent/allow
+ * reconfiguration. The private allocators release all their memory when there
+ * are no active users.  By 'active user' we mean an existing netmap_priv
+ * structure holding a reference to the allocator.
+ */
+struct netmap_mem_d {
+	NMA_LOCK_T nm_mtx;  /* protect the allocator */
+	u_int nm_totalsize; /* shorthand */
+
+	u_int flags;
+#define NETMAP_MEM_FINALIZED	0x1	/* preallocation done */
+#define NETMAP_MEM_PRIVATE	0x2	/* uses private address space */
+	int lasterr;		/* last error for curr config */
+	int refcount;		/* existing priv structures */
+	/* the three allocators */
+	struct netmap_obj_pool pools[NETMAP_POOLS_NR];
+
+	netmap_mem_config_t   config;	
+	netmap_mem_finalize_t finalize;
+	netmap_mem_deref_t    deref;
+};
+
+extern struct netmap_mem_d nm_mem;
+
+vm_paddr_t netmap_mem_ofstophys(struct netmap_mem_d *, vm_ooffset_t);
+int	   netmap_mem_finalize(struct netmap_mem_d *);
+int 	   netmap_mem_init(void);
+void 	   netmap_mem_fini(void);
+struct netmap_if *   netmap_mem_if_new(const char *, struct netmap_adapter *);
+void 	   netmap_mem_if_delete(struct netmap_adapter *na, struct netmap_if *nifp);
+void 	   netmap_mem_deref(struct netmap_mem_d *);
+int	   netmap_mem_get_info(struct netmap_mem_d *nm_mem, u_int *size, u_int *memflags);
+ssize_t    netmap_mem_if_offset(struct netmap_mem_d *nm_mem, const void *vaddr);
+struct netmap_mem_d*
+	   netmap_mem_private_new(const char *name, u_int txr, u_int txd, u_int rxr, u_int rxd);
+void	   netmap_mem_private_delete(struct netmap_mem_d *nm_mem);
+
+#define NETMAP_BDG_BUF_SIZE(n)	((n)->pools[NETMAP_BUF_POOL]._objsize)
+
+
+
+#endif