xref: /freebsd-12.1/sys/dev/fe/if_fe.c (revision 7de1daeb)
1 /*-
2  * All Rights Reserved, Copyright (C) Fujitsu Limited 1995
3  *
4  * This software may be used, modified, copied, distributed, and sold, in
5  * both source and binary form provided that the above copyright, these
6  * terms and the following disclaimer are retained.  The name of the author
7  * and/or the contributor may not be used to endorse or promote products
8  * derived from this software without specific prior written permission.
9  *
10  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND THE CONTRIBUTOR ``AS IS'' AND
11  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
12  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
13  * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR THE CONTRIBUTOR BE LIABLE
14  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
15  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
16  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION.
17  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
18  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
19  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
20  * SUCH DAMAGE.
21  */
22 
23 #include <sys/cdefs.h>
24 __FBSDID("$FreeBSD$");
25 
26 /*
27  *
28  * Device driver for Fujitsu MB86960A/MB86965A based Ethernet cards.
29  * Contributed by M. Sekiguchi. <[email protected]>
30  *
31  * This version is intended to be a generic template for various
32  * MB86960A/MB86965A based Ethernet cards.  It currently supports
33  * Fujitsu FMV-180 series for ISA and Allied-Telesis AT1700/RE2000
34  * series for ISA, as well as Fujitsu MBH10302 PC Card.
35  * There are some currently-
36  * unused hooks embedded, which are primarily intended to support
37  * other types of Ethernet cards, but the author is not sure whether
38  * they are useful.
39  *
40  * This version also includes some alignments to support RE1000,
41  * C-NET(98)P2 and so on. These cards are not for AT-compatibles,
42  * but for NEC PC-98 bus -- a proprietary bus architecture available
43  * only in Japan. Confusingly, it is different from the Microsoft's
44  * PC98 architecture. :-{
45  * Further work for PC-98 version will be available as a part of
46  * FreeBSD(98) project.
47  *
48  * This software is a derivative work of if_ed.c version 1.56 by David
49  * Greenman available as a part of FreeBSD 2.0 RELEASE source distribution.
50  *
51  * The following lines are retained from the original if_ed.c:
52  *
53  * Copyright (C) 1993, David Greenman. This software may be used, modified,
54  *   copied, distributed, and sold, in both source and binary form provided
55  *   that the above copyright and these terms are retained. Under no
56  *   circumstances is the author responsible for the proper functioning
57  *   of this software, nor does the author assume any responsibility
58  *   for damages incurred with its use.
59  */
60 
61 /*
62  * TODO:
63  *  o   To support ISA PnP auto configuration for FMV-183/184.
64  *  o   To support REX-9886/87(PC-98 only).
65  *  o   To reconsider mbuf usage.
66  *  o   To reconsider transmission buffer usage, including
67  *      transmission buffer size (currently 4KB x 2) and pros-and-
68  *      cons of multiple frame transmission.
69  *  o   To test IPX codes.
70  *  o   To test new-bus frontend.
71  */
72 
73 #include <sys/param.h>
74 #include <sys/kernel.h>
75 #include <sys/malloc.h>
76 #include <sys/systm.h>
77 #include <sys/socket.h>
78 #include <sys/sockio.h>
79 #include <sys/mbuf.h>
80 
81 #include <sys/bus.h>
82 #include <machine/bus.h>
83 #include <sys/rman.h>
84 
85 #include <net/ethernet.h>
86 #include <net/if.h>
87 #include <net/if_var.h>
88 #include <net/if_dl.h>
89 #include <net/if_mib.h>
90 #include <net/if_media.h>
91 #include <net/if_types.h>
92 
93 #include <netinet/in.h>
94 #include <netinet/if_ether.h>
95 
96 #include <net/bpf.h>
97 
98 #include <dev/fe/mb86960.h>
99 #include <dev/fe/if_fereg.h>
100 #include <dev/fe/if_fevar.h>
101 
102 /*
103  * Transmit just one packet per a "send" command to 86960.
104  * This option is intended for performance test.  An EXPERIMENTAL option.
105  */
106 #ifndef FE_SINGLE_TRANSMISSION
107 #define FE_SINGLE_TRANSMISSION 0
108 #endif
109 
110 /*
111  * Maximum loops when interrupt.
112  * This option prevents an infinite loop due to hardware failure.
113  * (Some laptops make an infinite loop after PC Card is ejected.)
114  */
115 #ifndef FE_MAX_LOOP
116 #define FE_MAX_LOOP 0x800
117 #endif
118 
119 /*
120  * Device configuration flags.
121  */
122 
123 /* DLCR6 settings.  */
124 #define FE_FLAGS_DLCR6_VALUE	0x007F
125 
126 /* Force DLCR6 override.  */
127 #define FE_FLAGS_OVERRIDE_DLCR6	0x0080
128 
129 
130 devclass_t fe_devclass;
131 
132 /*
133  * Special filter values.
134  */
135 static struct fe_filter const fe_filter_nothing = { FE_FILTER_NOTHING };
136 static struct fe_filter const fe_filter_all     = { FE_FILTER_ALL };
137 
138 /* Standard driver entry points.  These can be static.  */
139 static void		fe_init		(void *);
140 static void		fe_init_locked	(struct fe_softc *);
141 static driver_intr_t	fe_intr;
142 static int		fe_ioctl	(struct ifnet *, u_long, caddr_t);
143 static void		fe_start	(struct ifnet *);
144 static void		fe_start_locked	(struct ifnet *);
145 static void		fe_watchdog	(void *);
146 static int		fe_medchange	(struct ifnet *);
147 static void		fe_medstat	(struct ifnet *, struct ifmediareq *);
148 
149 /* Local functions.  Order of declaration is confused.  FIXME.  */
150 static int	fe_get_packet	( struct fe_softc *, u_short );
151 static void	fe_tint		( struct fe_softc *, u_char );
152 static void	fe_rint		( struct fe_softc *, u_char );
153 static void	fe_xmit		( struct fe_softc * );
154 static void	fe_write_mbufs	( struct fe_softc *, struct mbuf * );
155 static void	fe_setmode	( struct fe_softc * );
156 static void	fe_loadmar	( struct fe_softc * );
157 
158 #ifdef DIAGNOSTIC
159 static void	fe_emptybuffer	( struct fe_softc * );
160 #endif
161 
162 /*
163  * Fe driver specific constants which relate to 86960/86965.
164  */
165 
166 /* Interrupt masks  */
167 #define FE_TMASK ( FE_D2_COLL16 | FE_D2_TXDONE )
168 #define FE_RMASK ( FE_D3_OVRFLO | FE_D3_CRCERR \
169 		 | FE_D3_ALGERR | FE_D3_SRTPKT | FE_D3_PKTRDY )
170 
171 /* Maximum number of iterations for a receive interrupt.  */
172 #define FE_MAX_RECV_COUNT ( ( 65536 - 2048 * 2 ) / 64 )
173 	/*
174 	 * Maximum size of SRAM is 65536,
175 	 * minimum size of transmission buffer in fe is 2x2KB,
176 	 * and minimum amount of received packet including headers
177 	 * added by the chip is 64 bytes.
178 	 * Hence FE_MAX_RECV_COUNT is the upper limit for number
179 	 * of packets in the receive buffer.
180 	 */
181 
182 /*
183  * Miscellaneous definitions not directly related to hardware.
184  */
185 
186 /* The following line must be delete when "net/if_media.h" support it.  */
187 #ifndef IFM_10_FL
188 #define IFM_10_FL	/* 13 */ IFM_10_5
189 #endif
190 
191 #if 0
192 /* Mapping between media bitmap (in fe_softc.mbitmap) and ifm_media.  */
193 static int const bit2media [] = {
194 			IFM_HDX | IFM_ETHER | IFM_AUTO,
195 			IFM_HDX | IFM_ETHER | IFM_MANUAL,
196 			IFM_HDX | IFM_ETHER | IFM_10_T,
197 			IFM_HDX | IFM_ETHER | IFM_10_2,
198 			IFM_HDX | IFM_ETHER | IFM_10_5,
199 			IFM_HDX | IFM_ETHER | IFM_10_FL,
200 			IFM_FDX | IFM_ETHER | IFM_10_T,
201 	/* More can be come here... */
202 			0
203 };
204 #else
205 /* Mapping between media bitmap (in fe_softc.mbitmap) and ifm_media.  */
206 static int const bit2media [] = {
207 			IFM_ETHER | IFM_AUTO,
208 			IFM_ETHER | IFM_MANUAL,
209 			IFM_ETHER | IFM_10_T,
210 			IFM_ETHER | IFM_10_2,
211 			IFM_ETHER | IFM_10_5,
212 			IFM_ETHER | IFM_10_FL,
213 			IFM_ETHER | IFM_10_T,
214 	/* More can be come here... */
215 			0
216 };
217 #endif
218 
219 /*
220  * Check for specific bits in specific registers have specific values.
221  * A common utility function called from various sub-probe routines.
222  */
223 int
224 fe_simple_probe (struct fe_softc const * sc,
225 		 struct fe_simple_probe_struct const * sp)
226 {
227 	struct fe_simple_probe_struct const *p;
228 	int8_t bits;
229 
230 	for (p  = sp; p->mask != 0; p++) {
231 	    bits = fe_inb(sc, p->port);
232  	    printf("port %d, mask %x, bits %x read %x\n", p->port,
233 	      p->mask, p->bits, bits);
234 		if ((bits & p->mask) != p->bits)
235 			return 0;
236 	}
237 	return 1;
238 }
239 
240 /* Test if a given 6 byte value is a valid Ethernet station (MAC)
241    address.  "Vendor" is an expected vendor code (first three bytes,)
242    or a zero when nothing expected.  */
243 int
244 fe_valid_Ether_p (u_char const * addr, unsigned vendor)
245 {
246 #ifdef FE_DEBUG
247 	printf("fe?: validating %6D against %06x\n", addr, ":", vendor);
248 #endif
249 
250 	/* All zero is not allowed as a vendor code.  */
251 	if (addr[0] == 0 && addr[1] == 0 && addr[2] == 0) return 0;
252 
253 	switch (vendor) {
254 	    case 0x000000:
255 		/* Legal Ethernet address (stored in ROM) must have
256 		   its Group and Local bits cleared.  */
257 		if ((addr[0] & 0x03) != 0) return 0;
258 		break;
259 	    case 0x020000:
260 		/* Same as above, but a local address is allowed in
261                    this context.  */
262 		if (ETHER_IS_MULTICAST(addr)) return 0;
263 		break;
264 	    default:
265 		/* Make sure the vendor part matches if one is given.  */
266 		if (   addr[0] != ((vendor >> 16) & 0xFF)
267 		    || addr[1] != ((vendor >>  8) & 0xFF)
268 		    || addr[2] != ((vendor      ) & 0xFF)) return 0;
269 		break;
270 	}
271 
272 	/* Host part must not be all-zeros nor all-ones.  */
273 	if (addr[3] == 0xFF && addr[4] == 0xFF && addr[5] == 0xFF) return 0;
274 	if (addr[3] == 0x00 && addr[4] == 0x00 && addr[5] == 0x00) return 0;
275 
276 	/* Given addr looks like an Ethernet address.  */
277 	return 1;
278 }
279 
280 /* Fill our softc struct with default value.  */
281 void
282 fe_softc_defaults (struct fe_softc *sc)
283 {
284 	/* Prepare for typical register prototypes.  We assume a
285            "typical" board has <32KB> of <fast> SRAM connected with a
286            <byte-wide> data lines.  */
287 	sc->proto_dlcr4 = FE_D4_LBC_DISABLE | FE_D4_CNTRL;
288 	sc->proto_dlcr5 = 0;
289 	sc->proto_dlcr6 = FE_D6_BUFSIZ_32KB | FE_D6_TXBSIZ_2x4KB
290 		| FE_D6_BBW_BYTE | FE_D6_SBW_WORD | FE_D6_SRAM_100ns;
291 	sc->proto_dlcr7 = FE_D7_BYTSWP_LH;
292 	sc->proto_bmpr13 = 0;
293 
294 	/* Assume the probe process (to be done later) is stable.  */
295 	sc->stability = 0;
296 
297 	/* A typical board needs no hooks.  */
298 	sc->init = NULL;
299 	sc->stop = NULL;
300 
301 	/* Assume the board has no software-controllable media selection.  */
302 	sc->mbitmap = MB_HM;
303 	sc->defmedia = MB_HM;
304 	sc->msel = NULL;
305 }
306 
307 /* Common error reporting routine used in probe routines for
308    "soft configured IRQ"-type boards.  */
309 void
310 fe_irq_failure (char const *name, int unit, int irq, char const *list)
311 {
312 	printf("fe%d: %s board is detected, but %s IRQ was given\n",
313 	       unit, name, (irq == NO_IRQ ? "no" : "invalid"));
314 	if (list != NULL) {
315 		printf("fe%d: specify an IRQ from %s in kernel config\n",
316 		       unit, list);
317 	}
318 }
319 
320 /*
321  * Hardware (vendor) specific hooks.
322  */
323 
324 /*
325  * Generic media selection scheme for MB86965 based boards.
326  */
327 void
328 fe_msel_965 (struct fe_softc *sc)
329 {
330 	u_char b13;
331 
332 	/* Find the appropriate bits for BMPR13 tranceiver control.  */
333 	switch (IFM_SUBTYPE(sc->media.ifm_media)) {
334 	    case IFM_AUTO: b13 = FE_B13_PORT_AUTO | FE_B13_TPTYPE_UTP; break;
335 	    case IFM_10_T: b13 = FE_B13_PORT_TP   | FE_B13_TPTYPE_UTP; break;
336 	    default:       b13 = FE_B13_PORT_AUI;  break;
337 	}
338 
339 	/* Write it into the register.  It takes effect immediately.  */
340 	fe_outb(sc, FE_BMPR13, sc->proto_bmpr13 | b13);
341 }
342 
343 
344 /*
345  * Fujitsu MB86965 JLI mode support routines.
346  */
347 
348 /*
349  * Routines to read all bytes from the config EEPROM through MB86965A.
350  * It is a MicroWire (3-wire) serial EEPROM with 6-bit address.
351  * (93C06 or 93C46.)
352  */
353 static void
354 fe_strobe_eeprom_jli (struct fe_softc *sc, u_short bmpr16)
355 {
356 	/*
357 	 * We must guarantee 1us (or more) interval to access slow
358 	 * EEPROMs.  The following redundant code provides enough
359 	 * delay with ISA timing.  (Even if the bus clock is "tuned.")
360 	 * Some modification will be needed on faster busses.
361 	 */
362 	fe_outb(sc, bmpr16, FE_B16_SELECT);
363 	fe_outb(sc, bmpr16, FE_B16_SELECT | FE_B16_CLOCK);
364 	fe_outb(sc, bmpr16, FE_B16_SELECT | FE_B16_CLOCK);
365 	fe_outb(sc, bmpr16, FE_B16_SELECT);
366 }
367 
368 void
369 fe_read_eeprom_jli (struct fe_softc * sc, u_char * data)
370 {
371 	u_char n, val, bit;
372 	u_char save16, save17;
373 
374 	/* Save the current value of the EEPROM interface registers.  */
375 	save16 = fe_inb(sc, FE_BMPR16);
376 	save17 = fe_inb(sc, FE_BMPR17);
377 
378 	/* Read bytes from EEPROM; two bytes per an iteration.  */
379 	for (n = 0; n < JLI_EEPROM_SIZE / 2; n++) {
380 
381 		/* Reset the EEPROM interface.  */
382 		fe_outb(sc, FE_BMPR16, 0x00);
383 		fe_outb(sc, FE_BMPR17, 0x00);
384 
385 		/* Start EEPROM access.  */
386 		fe_outb(sc, FE_BMPR16, FE_B16_SELECT);
387 		fe_outb(sc, FE_BMPR17, FE_B17_DATA);
388 		fe_strobe_eeprom_jli(sc, FE_BMPR16);
389 
390 		/* Pass the iteration count as well as a READ command.  */
391 		val = 0x80 | n;
392 		for (bit = 0x80; bit != 0x00; bit >>= 1) {
393 			fe_outb(sc, FE_BMPR17, (val & bit) ? FE_B17_DATA : 0);
394 			fe_strobe_eeprom_jli(sc, FE_BMPR16);
395 		}
396 		fe_outb(sc, FE_BMPR17, 0x00);
397 
398 		/* Read a byte.  */
399 		val = 0;
400 		for (bit = 0x80; bit != 0x00; bit >>= 1) {
401 			fe_strobe_eeprom_jli(sc, FE_BMPR16);
402 			if (fe_inb(sc, FE_BMPR17) & FE_B17_DATA)
403 				val |= bit;
404 		}
405 		*data++ = val;
406 
407 		/* Read one more byte.  */
408 		val = 0;
409 		for (bit = 0x80; bit != 0x00; bit >>= 1) {
410 			fe_strobe_eeprom_jli(sc, FE_BMPR16);
411 			if (fe_inb(sc, FE_BMPR17) & FE_B17_DATA)
412 				val |= bit;
413 		}
414 		*data++ = val;
415 	}
416 
417 #if 0
418 	/* Reset the EEPROM interface, again.  */
419 	fe_outb(sc, FE_BMPR16, 0x00);
420 	fe_outb(sc, FE_BMPR17, 0x00);
421 #else
422 	/* Make sure to restore the original value of EEPROM interface
423            registers, since we are not yet sure we have MB86965A on
424            the address.  */
425 	fe_outb(sc, FE_BMPR17, save17);
426 	fe_outb(sc, FE_BMPR16, save16);
427 #endif
428 
429 #if 1
430 	/* Report what we got.  */
431 	if (bootverbose) {
432 		int i;
433 		data -= JLI_EEPROM_SIZE;
434 		for (i = 0; i < JLI_EEPROM_SIZE; i += 16) {
435 			if_printf(sc->ifp,
436 			    "EEPROM(JLI):%3x: %16D\n", i, data + i, " ");
437 		}
438 	}
439 #endif
440 }
441 
442 void
443 fe_init_jli (struct fe_softc * sc)
444 {
445 	/* "Reset" by writing into a magic location.  */
446 	DELAY(200);
447 	fe_outb(sc, 0x1E, fe_inb(sc, 0x1E));
448 	DELAY(300);
449 }
450 
451 
452 /*
453  * SSi 78Q8377A support routines.
454  */
455 
456 /*
457  * Routines to read all bytes from the config EEPROM through 78Q8377A.
458  * It is a MicroWire (3-wire) serial EEPROM with 8-bit address.  (I.e.,
459  * 93C56 or 93C66.)
460  *
461  * As I don't have SSi manuals, (hmm, an old song again!) I'm not exactly
462  * sure the following code is correct...  It is just stolen from the
463  * C-NET(98)P2 support routine in FreeBSD(98).
464  */
465 
466 void
467 fe_read_eeprom_ssi (struct fe_softc *sc, u_char *data)
468 {
469 	u_char val, bit;
470 	int n;
471 	u_char save6, save7, save12;
472 
473 	/* Save the current value for the DLCR registers we are about
474            to destroy.  */
475 	save6 = fe_inb(sc, FE_DLCR6);
476 	save7 = fe_inb(sc, FE_DLCR7);
477 
478 	/* Put the 78Q8377A into a state that we can access the EEPROM.  */
479 	fe_outb(sc, FE_DLCR6,
480 	    FE_D6_BBW_WORD | FE_D6_SBW_WORD | FE_D6_DLC_DISABLE);
481 	fe_outb(sc, FE_DLCR7,
482 	    FE_D7_BYTSWP_LH | FE_D7_RBS_BMPR | FE_D7_RDYPNS | FE_D7_POWER_UP);
483 
484 	/* Save the current value for the BMPR12 register, too.  */
485 	save12 = fe_inb(sc, FE_DLCR12);
486 
487 	/* Read bytes from EEPROM; two bytes per an iteration.  */
488 	for (n = 0; n < SSI_EEPROM_SIZE / 2; n++) {
489 
490 		/* Start EEPROM access  */
491 		fe_outb(sc, FE_DLCR12, SSI_EEP);
492 		fe_outb(sc, FE_DLCR12, SSI_EEP | SSI_CSL);
493 
494 		/* Send the following four bits to the EEPROM in the
495 		   specified order: a dummy bit, a start bit, and
496 		   command bits (10) for READ.  */
497 		fe_outb(sc, FE_DLCR12, SSI_EEP | SSI_CSL                    );
498 		fe_outb(sc, FE_DLCR12, SSI_EEP | SSI_CSL | SSI_CLK          );	/* 0 */
499 		fe_outb(sc, FE_DLCR12, SSI_EEP | SSI_CSL           | SSI_DAT);
500 		fe_outb(sc, FE_DLCR12, SSI_EEP | SSI_CSL | SSI_CLK | SSI_DAT);	/* 1 */
501 		fe_outb(sc, FE_DLCR12, SSI_EEP | SSI_CSL           | SSI_DAT);
502 		fe_outb(sc, FE_DLCR12, SSI_EEP | SSI_CSL | SSI_CLK | SSI_DAT);	/* 1 */
503 		fe_outb(sc, FE_DLCR12, SSI_EEP | SSI_CSL                    );
504 		fe_outb(sc, FE_DLCR12, SSI_EEP | SSI_CSL | SSI_CLK          );	/* 0 */
505 
506 		/* Pass the iteration count to the chip.  */
507 		for (bit = 0x80; bit != 0x00; bit >>= 1) {
508 		    val = ( n & bit ) ? SSI_DAT : 0;
509 		    fe_outb(sc, FE_DLCR12, SSI_EEP | SSI_CSL           | val);
510 		    fe_outb(sc, FE_DLCR12, SSI_EEP | SSI_CSL | SSI_CLK | val);
511 		}
512 
513 		/* Read a byte.  */
514 		val = 0;
515 		for (bit = 0x80; bit != 0x00; bit >>= 1) {
516 		    fe_outb(sc, FE_DLCR12, SSI_EEP | SSI_CSL);
517 		    fe_outb(sc, FE_DLCR12, SSI_EEP | SSI_CSL | SSI_CLK);
518 		    if (fe_inb(sc, FE_DLCR12) & SSI_DIN)
519 			val |= bit;
520 		}
521 		*data++ = val;
522 
523 		/* Read one more byte.  */
524 		val = 0;
525 		for (bit = 0x80; bit != 0x00; bit >>= 1) {
526 		    fe_outb(sc, FE_DLCR12, SSI_EEP | SSI_CSL);
527 		    fe_outb(sc, FE_DLCR12, SSI_EEP | SSI_CSL | SSI_CLK);
528 		    if (fe_inb(sc, FE_DLCR12) & SSI_DIN)
529 			val |= bit;
530 		}
531 		*data++ = val;
532 
533 		fe_outb(sc, FE_DLCR12, SSI_EEP);
534 	}
535 
536 	/* Reset the EEPROM interface.  (For now.)  */
537 	fe_outb(sc, FE_DLCR12, 0x00);
538 
539 	/* Restore the saved register values, for the case that we
540            didn't have 78Q8377A at the given address.  */
541 	fe_outb(sc, FE_DLCR12, save12);
542 	fe_outb(sc, FE_DLCR7, save7);
543 	fe_outb(sc, FE_DLCR6, save6);
544 
545 #if 1
546 	/* Report what we got.  */
547 	if (bootverbose) {
548 		int i;
549 		data -= SSI_EEPROM_SIZE;
550 		for (i = 0; i < SSI_EEPROM_SIZE; i += 16) {
551 			if_printf(sc->ifp,
552 			    "EEPROM(SSI):%3x: %16D\n", i, data + i, " ");
553 		}
554 	}
555 #endif
556 }
557 
558 /*
559  * TDK/LANX boards support routines.
560  */
561 
562 /* It is assumed that the CLK line is low and SDA is high (float) upon entry.  */
563 #define LNX_PH(D,K,N) \
564 	((LNX_SDA_##D | LNX_CLK_##K) << N)
565 #define LNX_CYCLE(D1,D2,D3,D4,K1,K2,K3,K4) \
566 	(LNX_PH(D1,K1,0)|LNX_PH(D2,K2,8)|LNX_PH(D3,K3,16)|LNX_PH(D4,K4,24))
567 
568 #define LNX_CYCLE_START	LNX_CYCLE(HI,LO,LO,HI, HI,HI,LO,LO)
569 #define LNX_CYCLE_STOP	LNX_CYCLE(LO,LO,HI,HI, LO,HI,HI,LO)
570 #define LNX_CYCLE_HI	LNX_CYCLE(HI,HI,HI,HI, LO,HI,LO,LO)
571 #define LNX_CYCLE_LO	LNX_CYCLE(LO,LO,LO,HI, LO,HI,LO,LO)
572 #define LNX_CYCLE_INIT	LNX_CYCLE(LO,HI,HI,HI, LO,LO,LO,LO)
573 
574 static void
575 fe_eeprom_cycle_lnx (struct fe_softc *sc, u_short reg20, u_long cycle)
576 {
577 	fe_outb(sc, reg20, (cycle      ) & 0xFF);
578 	DELAY(15);
579 	fe_outb(sc, reg20, (cycle >>  8) & 0xFF);
580 	DELAY(15);
581 	fe_outb(sc, reg20, (cycle >> 16) & 0xFF);
582 	DELAY(15);
583 	fe_outb(sc, reg20, (cycle >> 24) & 0xFF);
584 	DELAY(15);
585 }
586 
587 static u_char
588 fe_eeprom_receive_lnx (struct fe_softc *sc, u_short reg20)
589 {
590 	u_char dat;
591 
592 	fe_outb(sc, reg20, LNX_CLK_HI | LNX_SDA_FL);
593 	DELAY(15);
594 	dat = fe_inb(sc, reg20);
595 	fe_outb(sc, reg20, LNX_CLK_LO | LNX_SDA_FL);
596 	DELAY(15);
597 	return (dat & LNX_SDA_IN);
598 }
599 
600 void
601 fe_read_eeprom_lnx (struct fe_softc *sc, u_char *data)
602 {
603 	int i;
604 	u_char n, bit, val;
605 	u_char save20;
606 	u_short reg20 = 0x14;
607 
608 	save20 = fe_inb(sc, reg20);
609 
610 	/* NOTE: DELAY() timing constants are approximately three
611            times longer (slower) than the required minimum.  This is
612            to guarantee a reliable operation under some tough
613            conditions...  Fortunately, this routine is only called
614            during the boot phase, so the speed is less important than
615            stability.  */
616 
617 #if 1
618 	/* Reset the X24C01's internal state machine and put it into
619 	   the IDLE state.  We usually don't need this, but *if*
620 	   someone (e.g., probe routine of other driver) write some
621 	   garbage into the register at 0x14, synchronization will be
622 	   lost, and the normal EEPROM access protocol won't work.
623 	   Moreover, as there are no easy way to reset, we need a
624 	   _manoeuvre_ here.  (It even lacks a reset pin, so pushing
625 	   the RESET button on the PC doesn't help!)  */
626 	fe_eeprom_cycle_lnx(sc, reg20, LNX_CYCLE_INIT);
627 	for (i = 0; i < 10; i++)
628 		fe_eeprom_cycle_lnx(sc, reg20, LNX_CYCLE_START);
629 	fe_eeprom_cycle_lnx(sc, reg20, LNX_CYCLE_STOP);
630 	DELAY(10000);
631 #endif
632 
633 	/* Issue a start condition.  */
634 	fe_eeprom_cycle_lnx(sc, reg20, LNX_CYCLE_START);
635 
636 	/* Send seven bits of the starting address (zero, in this
637 	   case) and a command bit for READ.  */
638 	val = 0x01;
639 	for (bit = 0x80; bit != 0x00; bit >>= 1) {
640 		if (val & bit) {
641 			fe_eeprom_cycle_lnx(sc, reg20, LNX_CYCLE_HI);
642 		} else {
643 			fe_eeprom_cycle_lnx(sc, reg20, LNX_CYCLE_LO);
644 		}
645 	}
646 
647 	/* Receive an ACK bit.  */
648 	if (fe_eeprom_receive_lnx(sc, reg20)) {
649 		/* ACK was not received.  EEPROM is not present (i.e.,
650 		   this board was not a TDK/LANX) or not working
651 		   properly.  */
652 		if (bootverbose) {
653 			if_printf(sc->ifp,
654 			    "no ACK received from EEPROM(LNX)\n");
655 		}
656 		/* Clear the given buffer to indicate we could not get
657                    any info. and return.  */
658 		bzero(data, LNX_EEPROM_SIZE);
659 		goto RET;
660 	}
661 
662 	/* Read bytes from EEPROM.  */
663 	for (n = 0; n < LNX_EEPROM_SIZE; n++) {
664 
665 		/* Read a byte and store it into the buffer.  */
666 		val = 0x00;
667 		for (bit = 0x80; bit != 0x00; bit >>= 1) {
668 			if (fe_eeprom_receive_lnx(sc, reg20))
669 				val |= bit;
670 		}
671 		*data++ = val;
672 
673 		/* Acknowledge if we have to read more.  */
674 		if (n < LNX_EEPROM_SIZE - 1) {
675 			fe_eeprom_cycle_lnx(sc, reg20, LNX_CYCLE_LO);
676 		}
677 	}
678 
679 	/* Issue a STOP condition, de-activating the clock line.
680 	   It will be safer to keep the clock line low than to leave
681 	   it high.  */
682 	fe_eeprom_cycle_lnx(sc, reg20, LNX_CYCLE_STOP);
683 
684     RET:
685 	fe_outb(sc, reg20, save20);
686 
687 #if 1
688 	/* Report what we got.  */
689 	if (bootverbose) {
690 		data -= LNX_EEPROM_SIZE;
691 		for (i = 0; i < LNX_EEPROM_SIZE; i += 16) {
692 			if_printf(sc->ifp,
693 			     "EEPROM(LNX):%3x: %16D\n", i, data + i, " ");
694 		}
695 	}
696 #endif
697 }
698 
699 void
700 fe_init_lnx (struct fe_softc * sc)
701 {
702 	/* Reset the 86960.  Do we need this?  FIXME.  */
703 	fe_outb(sc, 0x12, 0x06);
704 	DELAY(100);
705 	fe_outb(sc, 0x12, 0x07);
706 	DELAY(100);
707 
708 	/* Setup IRQ control register on the ASIC.  */
709 	fe_outb(sc, 0x14, sc->priv_info);
710 }
711 
712 
713 /*
714  * Ungermann-Bass boards support routine.
715  */
716 void
717 fe_init_ubn (struct fe_softc * sc)
718 {
719  	/* Do we need this?  FIXME.  */
720 	fe_outb(sc, FE_DLCR7,
721 		sc->proto_dlcr7 | FE_D7_RBS_BMPR | FE_D7_POWER_UP);
722  	fe_outb(sc, 0x18, 0x00);
723  	DELAY(200);
724 
725 	/* Setup IRQ control register on the ASIC.  */
726 	fe_outb(sc, 0x14, sc->priv_info);
727 }
728 
729 
730 /*
731  * Install interface into kernel networking data structures
732  */
733 int
734 fe_attach (device_t dev)
735 {
736 	struct fe_softc *sc = device_get_softc(dev);
737 	struct ifnet *ifp;
738 	int flags = device_get_flags(dev);
739 	int b, error;
740 
741 	ifp = sc->ifp = if_alloc(IFT_ETHER);
742 	if (ifp == NULL) {
743 		device_printf(dev, "can not ifalloc\n");
744 		fe_release_resource(dev);
745 		return (ENOSPC);
746 	}
747 
748 	mtx_init(&sc->lock, device_get_nameunit(dev), MTX_NETWORK_LOCK,
749 	    MTX_DEF);
750 	callout_init_mtx(&sc->timer, &sc->lock, 0);
751 
752 	/*
753 	 * Initialize ifnet structure
754 	 */
755  	ifp->if_softc    = sc;
756 	if_initname(sc->ifp, device_get_name(dev), device_get_unit(dev));
757 	ifp->if_start    = fe_start;
758 	ifp->if_ioctl    = fe_ioctl;
759 	ifp->if_init     = fe_init;
760 	ifp->if_linkmib  = &sc->mibdata;
761 	ifp->if_linkmiblen = sizeof (sc->mibdata);
762 
763 #if 0 /* I'm not sure... */
764 	sc->mibdata.dot3Compliance = DOT3COMPLIANCE_COLLS;
765 #endif
766 
767 	/*
768 	 * Set fixed interface flags.
769 	 */
770  	ifp->if_flags = IFF_BROADCAST | IFF_SIMPLEX | IFF_MULTICAST;
771 	IFQ_SET_MAXLEN(&ifp->if_snd, ifqmaxlen);
772 
773 #if FE_SINGLE_TRANSMISSION
774 	/* Override txb config to allocate minimum.  */
775 	sc->proto_dlcr6 &= ~FE_D6_TXBSIZ
776 	sc->proto_dlcr6 |=  FE_D6_TXBSIZ_2x2KB;
777 #endif
778 
779 	/* Modify hardware config if it is requested.  */
780 	if (flags & FE_FLAGS_OVERRIDE_DLCR6)
781 		sc->proto_dlcr6 = flags & FE_FLAGS_DLCR6_VALUE;
782 
783 	/* Find TX buffer size, based on the hardware dependent proto.  */
784 	switch (sc->proto_dlcr6 & FE_D6_TXBSIZ) {
785 	  case FE_D6_TXBSIZ_2x2KB: sc->txb_size = 2048; break;
786 	  case FE_D6_TXBSIZ_2x4KB: sc->txb_size = 4096; break;
787 	  case FE_D6_TXBSIZ_2x8KB: sc->txb_size = 8192; break;
788 	  default:
789 		/* Oops, we can't work with single buffer configuration.  */
790 		if (bootverbose) {
791 			if_printf(sc->ifp,
792 			     "strange TXBSIZ config; fixing\n");
793 		}
794 		sc->proto_dlcr6 &= ~FE_D6_TXBSIZ;
795 		sc->proto_dlcr6 |=  FE_D6_TXBSIZ_2x2KB;
796 		sc->txb_size = 2048;
797 		break;
798 	}
799 
800 	/* Initialize the if_media interface.  */
801 	ifmedia_init(&sc->media, 0, fe_medchange, fe_medstat);
802 	for (b = 0; bit2media[b] != 0; b++) {
803 		if (sc->mbitmap & (1 << b)) {
804 			ifmedia_add(&sc->media, bit2media[b], 0, NULL);
805 		}
806 	}
807 	for (b = 0; bit2media[b] != 0; b++) {
808 		if (sc->defmedia & (1 << b)) {
809 			ifmedia_set(&sc->media, bit2media[b]);
810 			break;
811 		}
812 	}
813 #if 0	/* Turned off; this is called later, when the interface UPs.  */
814 	fe_medchange(sc);
815 #endif
816 
817 	/* Attach and stop the interface. */
818 	FE_LOCK(sc);
819 	fe_stop(sc);
820 	FE_UNLOCK(sc);
821 	ether_ifattach(sc->ifp, sc->enaddr);
822 
823 	error = bus_setup_intr(dev, sc->irq_res, INTR_TYPE_NET | INTR_MPSAFE,
824 			       NULL, fe_intr, sc, &sc->irq_handle);
825 	if (error) {
826 		ether_ifdetach(ifp);
827 		mtx_destroy(&sc->lock);
828 		if_free(ifp);
829 		fe_release_resource(dev);
830 		return ENXIO;
831 	}
832 
833   	/* Print additional info when attached.  */
834  	device_printf(dev, "type %s%s\n", sc->typestr,
835 		      (sc->proto_dlcr4 & FE_D4_DSC) ? ", full duplex" : "");
836 	if (bootverbose) {
837 		int buf, txb, bbw, sbw, ram;
838 
839 		buf = txb = bbw = sbw = ram = -1;
840 		switch ( sc->proto_dlcr6 & FE_D6_BUFSIZ ) {
841 		  case FE_D6_BUFSIZ_8KB:  buf =  8; break;
842 		  case FE_D6_BUFSIZ_16KB: buf = 16; break;
843 		  case FE_D6_BUFSIZ_32KB: buf = 32; break;
844 		  case FE_D6_BUFSIZ_64KB: buf = 64; break;
845 		}
846 		switch ( sc->proto_dlcr6 & FE_D6_TXBSIZ ) {
847 		  case FE_D6_TXBSIZ_2x2KB: txb = 2; break;
848 		  case FE_D6_TXBSIZ_2x4KB: txb = 4; break;
849 		  case FE_D6_TXBSIZ_2x8KB: txb = 8; break;
850 		}
851 		switch ( sc->proto_dlcr6 & FE_D6_BBW ) {
852 		  case FE_D6_BBW_BYTE: bbw =  8; break;
853 		  case FE_D6_BBW_WORD: bbw = 16; break;
854 		}
855 		switch ( sc->proto_dlcr6 & FE_D6_SBW ) {
856 		  case FE_D6_SBW_BYTE: sbw =  8; break;
857 		  case FE_D6_SBW_WORD: sbw = 16; break;
858 		}
859 		switch ( sc->proto_dlcr6 & FE_D6_SRAM ) {
860 		  case FE_D6_SRAM_100ns: ram = 100; break;
861 		  case FE_D6_SRAM_150ns: ram = 150; break;
862 		}
863 		device_printf(dev, "SRAM %dKB %dbit %dns, TXB %dKBx2, %dbit I/O\n",
864 			      buf, bbw, ram, txb, sbw);
865 	}
866 	if (sc->stability & UNSTABLE_IRQ)
867 		device_printf(dev, "warning: IRQ number may be incorrect\n");
868 	if (sc->stability & UNSTABLE_MAC)
869 		device_printf(dev, "warning: above MAC address may be incorrect\n");
870 	if (sc->stability & UNSTABLE_TYPE)
871 		device_printf(dev, "warning: hardware type was not validated\n");
872 
873 	return 0;
874 }
875 
876 int
877 fe_alloc_port(device_t dev, int size)
878 {
879 	struct fe_softc *sc = device_get_softc(dev);
880 	struct resource *res;
881 	int rid;
882 
883 	rid = 0;
884 	res = bus_alloc_resource(dev, SYS_RES_IOPORT, &rid,
885 				 0ul, ~0ul, size, RF_ACTIVE);
886 	if (res) {
887 		sc->port_used = size;
888 		sc->port_res = res;
889 		return (0);
890 	}
891 
892 	return (ENOENT);
893 }
894 
895 int
896 fe_alloc_irq(device_t dev, int flags)
897 {
898 	struct fe_softc *sc = device_get_softc(dev);
899 	struct resource *res;
900 	int rid;
901 
902 	rid = 0;
903 	res = bus_alloc_resource_any(dev, SYS_RES_IRQ, &rid, RF_ACTIVE | flags);
904 	if (res) {
905 		sc->irq_res = res;
906 		return (0);
907 	}
908 
909 	return (ENOENT);
910 }
911 
912 void
913 fe_release_resource(device_t dev)
914 {
915 	struct fe_softc *sc = device_get_softc(dev);
916 
917 	if (sc->port_res) {
918 		bus_release_resource(dev, SYS_RES_IOPORT, 0, sc->port_res);
919 		sc->port_res = NULL;
920 	}
921 	if (sc->irq_res) {
922 		bus_release_resource(dev, SYS_RES_IRQ, 0, sc->irq_res);
923 		sc->irq_res = NULL;
924 	}
925 }
926 
927 /*
928  * Reset interface, after some (hardware) trouble is deteced.
929  */
930 static void
931 fe_reset (struct fe_softc *sc)
932 {
933 	/* Record how many packets are lost by this accident.  */
934 	if_inc_counter(sc->ifp, IFCOUNTER_OERRORS, sc->txb_sched + sc->txb_count);
935 	sc->mibdata.dot3StatsInternalMacTransmitErrors++;
936 
937 	/* Put the interface into known initial state.  */
938 	fe_stop(sc);
939 	if (sc->ifp->if_flags & IFF_UP)
940 		fe_init_locked(sc);
941 }
942 
943 /*
944  * Stop everything on the interface.
945  *
946  * All buffered packets, both transmitting and receiving,
947  * if any, will be lost by stopping the interface.
948  */
949 void
950 fe_stop (struct fe_softc *sc)
951 {
952 
953 	FE_ASSERT_LOCKED(sc);
954 
955 	/* Disable interrupts.  */
956 	fe_outb(sc, FE_DLCR2, 0x00);
957 	fe_outb(sc, FE_DLCR3, 0x00);
958 
959 	/* Stop interface hardware.  */
960 	DELAY(200);
961 	fe_outb(sc, FE_DLCR6, sc->proto_dlcr6 | FE_D6_DLC_DISABLE);
962 	DELAY(200);
963 
964 	/* Clear all interrupt status.  */
965 	fe_outb(sc, FE_DLCR0, 0xFF);
966 	fe_outb(sc, FE_DLCR1, 0xFF);
967 
968 	/* Put the chip in stand-by mode.  */
969 	DELAY(200);
970 	fe_outb(sc, FE_DLCR7, sc->proto_dlcr7 | FE_D7_POWER_DOWN);
971 	DELAY(200);
972 
973 	/* Reset transmitter variables and interface flags.  */
974 	sc->ifp->if_drv_flags &= ~(IFF_DRV_OACTIVE | IFF_DRV_RUNNING);
975 	sc->tx_timeout = 0;
976 	callout_stop(&sc->timer);
977 	sc->txb_free = sc->txb_size;
978 	sc->txb_count = 0;
979 	sc->txb_sched = 0;
980 
981 	/* MAR loading can be delayed.  */
982 	sc->filter_change = 0;
983 
984 	/* Call a device-specific hook.  */
985 	if (sc->stop)
986 		sc->stop(sc);
987 }
988 
989 /*
990  * Device timeout/watchdog routine. Entered if the device neglects to
991  * generate an interrupt after a transmit has been started on it.
992  */
993 static void
994 fe_watchdog (void *arg)
995 {
996 	struct fe_softc *sc = arg;
997 
998 	FE_ASSERT_LOCKED(sc);
999 
1000 	if (sc->tx_timeout && --sc->tx_timeout == 0) {
1001 		struct ifnet *ifp = sc->ifp;
1002 
1003 		/* A "debug" message.  */
1004 		if_printf(ifp, "transmission timeout (%d+%d)%s\n",
1005 		    sc->txb_sched, sc->txb_count,
1006 		    (ifp->if_flags & IFF_UP) ? "" : " when down");
1007 		if (ifp->if_get_counter(ifp, IFCOUNTER_OPACKETS) == 0 &&
1008 		    ifp->if_get_counter(ifp, IFCOUNTER_IPACKETS) == 0)
1009 			if_printf(ifp, "wrong IRQ setting in config?\n");
1010 		fe_reset(sc);
1011 	}
1012 	callout_reset(&sc->timer, hz, fe_watchdog, sc);
1013 }
1014 
1015 /*
1016  * Initialize device.
1017  */
1018 static void
1019 fe_init (void * xsc)
1020 {
1021 	struct fe_softc *sc = xsc;
1022 
1023 	FE_LOCK(sc);
1024 	fe_init_locked(sc);
1025 	FE_UNLOCK(sc);
1026 }
1027 
1028 static void
1029 fe_init_locked (struct fe_softc *sc)
1030 {
1031 
1032 	/* Start initializing 86960.  */
1033 
1034 	/* Call a hook before we start initializing the chip.  */
1035 	if (sc->init)
1036 		sc->init(sc);
1037 
1038 	/*
1039 	 * Make sure to disable the chip, also.
1040 	 * This may also help re-programming the chip after
1041 	 * hot insertion of PCMCIAs.
1042 	 */
1043 	DELAY(200);
1044 	fe_outb(sc, FE_DLCR6, sc->proto_dlcr6 | FE_D6_DLC_DISABLE);
1045 	DELAY(200);
1046 
1047 	/* Power up the chip and select register bank for DLCRs.  */
1048 	DELAY(200);
1049 	fe_outb(sc, FE_DLCR7,
1050 		sc->proto_dlcr7 | FE_D7_RBS_DLCR | FE_D7_POWER_UP);
1051 	DELAY(200);
1052 
1053 	/* Feed the station address.  */
1054 	fe_outblk(sc, FE_DLCR8, IF_LLADDR(sc->ifp), ETHER_ADDR_LEN);
1055 
1056 	/* Clear multicast address filter to receive nothing.  */
1057 	fe_outb(sc, FE_DLCR7,
1058 		sc->proto_dlcr7 | FE_D7_RBS_MAR | FE_D7_POWER_UP);
1059 	fe_outblk(sc, FE_MAR8, fe_filter_nothing.data, FE_FILTER_LEN);
1060 
1061 	/* Select the BMPR bank for runtime register access.  */
1062 	fe_outb(sc, FE_DLCR7,
1063 		sc->proto_dlcr7 | FE_D7_RBS_BMPR | FE_D7_POWER_UP);
1064 
1065 	/* Initialize registers.  */
1066 	fe_outb(sc, FE_DLCR0, 0xFF);	/* Clear all bits.  */
1067 	fe_outb(sc, FE_DLCR1, 0xFF);	/* ditto.  */
1068 	fe_outb(sc, FE_DLCR2, 0x00);
1069 	fe_outb(sc, FE_DLCR3, 0x00);
1070 	fe_outb(sc, FE_DLCR4, sc->proto_dlcr4);
1071 	fe_outb(sc, FE_DLCR5, sc->proto_dlcr5);
1072 	fe_outb(sc, FE_BMPR10, 0x00);
1073 	fe_outb(sc, FE_BMPR11, FE_B11_CTRL_SKIP | FE_B11_MODE1);
1074 	fe_outb(sc, FE_BMPR12, 0x00);
1075 	fe_outb(sc, FE_BMPR13, sc->proto_bmpr13);
1076 	fe_outb(sc, FE_BMPR14, 0x00);
1077 	fe_outb(sc, FE_BMPR15, 0x00);
1078 
1079 	/* Enable interrupts.  */
1080 	fe_outb(sc, FE_DLCR2, FE_TMASK);
1081 	fe_outb(sc, FE_DLCR3, FE_RMASK);
1082 
1083 	/* Select requested media, just before enabling DLC.  */
1084 	if (sc->msel)
1085 		sc->msel(sc);
1086 
1087 	/* Enable transmitter and receiver.  */
1088 	DELAY(200);
1089 	fe_outb(sc, FE_DLCR6, sc->proto_dlcr6 | FE_D6_DLC_ENABLE);
1090 	DELAY(200);
1091 
1092 #ifdef DIAGNOSTIC
1093 	/*
1094 	 * Make sure to empty the receive buffer.
1095 	 *
1096 	 * This may be redundant, but *if* the receive buffer were full
1097 	 * at this point, then the driver would hang.  I have experienced
1098 	 * some strange hang-up just after UP.  I hope the following
1099 	 * code solve the problem.
1100 	 *
1101 	 * I have changed the order of hardware initialization.
1102 	 * I think the receive buffer cannot have any packets at this
1103 	 * point in this version.  The following code *must* be
1104 	 * redundant now.  FIXME.
1105 	 *
1106 	 * I've heard a rumore that on some PC Card implementation of
1107 	 * 8696x, the receive buffer can have some data at this point.
1108 	 * The following message helps discovering the fact.  FIXME.
1109 	 */
1110 	if (!(fe_inb(sc, FE_DLCR5) & FE_D5_BUFEMP)) {
1111 		if_printf(sc->ifp,
1112 		    "receive buffer has some data after reset\n");
1113 		fe_emptybuffer(sc);
1114 	}
1115 
1116 	/* Do we need this here?  Actually, no.  I must be paranoia.  */
1117 	fe_outb(sc, FE_DLCR0, 0xFF);	/* Clear all bits.  */
1118 	fe_outb(sc, FE_DLCR1, 0xFF);	/* ditto.  */
1119 #endif
1120 
1121 	/* Set 'running' flag, because we are now running.   */
1122 	sc->ifp->if_drv_flags |= IFF_DRV_RUNNING;
1123 	callout_reset(&sc->timer, hz, fe_watchdog, sc);
1124 
1125 	/*
1126 	 * At this point, the interface is running properly,
1127 	 * except that it receives *no* packets.  we then call
1128 	 * fe_setmode() to tell the chip what packets to be
1129 	 * received, based on the if_flags and multicast group
1130 	 * list.  It completes the initialization process.
1131 	 */
1132 	fe_setmode(sc);
1133 
1134 #if 0
1135 	/* ...and attempt to start output queued packets.  */
1136 	/* TURNED OFF, because the semi-auto media prober wants to UP
1137            the interface keeping it idle.  The upper layer will soon
1138            start the interface anyway, and there are no significant
1139            delay.  */
1140 	fe_start_locked(sc->ifp);
1141 #endif
1142 }
1143 
1144 /*
1145  * This routine actually starts the transmission on the interface
1146  */
1147 static void
1148 fe_xmit (struct fe_softc *sc)
1149 {
1150 	/*
1151 	 * Set a timer just in case we never hear from the board again.
1152 	 * We use longer timeout for multiple packet transmission.
1153 	 * I'm not sure this timer value is appropriate.  FIXME.
1154 	 */
1155 	sc->tx_timeout = 1 + sc->txb_count;
1156 
1157 	/* Update txb variables.  */
1158 	sc->txb_sched = sc->txb_count;
1159 	sc->txb_count = 0;
1160 	sc->txb_free = sc->txb_size;
1161 	sc->tx_excolls = 0;
1162 
1163 	/* Start transmitter, passing packets in TX buffer.  */
1164 	fe_outb(sc, FE_BMPR10, sc->txb_sched | FE_B10_START);
1165 }
1166 
1167 /*
1168  * Start output on interface.
1169  * We make one assumption here:
1170  *  1) that the IFF_DRV_OACTIVE flag is checked before this code is called
1171  *     (i.e. that the output part of the interface is idle)
1172  */
1173 static void
1174 fe_start (struct ifnet *ifp)
1175 {
1176 	struct fe_softc *sc = ifp->if_softc;
1177 
1178 	FE_LOCK(sc);
1179 	fe_start_locked(ifp);
1180 	FE_UNLOCK(sc);
1181 }
1182 
1183 static void
1184 fe_start_locked (struct ifnet *ifp)
1185 {
1186 	struct fe_softc *sc = ifp->if_softc;
1187 	struct mbuf *m;
1188 
1189 #ifdef DIAGNOSTIC
1190 	/* Just a sanity check.  */
1191 	if ((sc->txb_count == 0) != (sc->txb_free == sc->txb_size)) {
1192 		/*
1193 		 * Txb_count and txb_free co-works to manage the
1194 		 * transmission buffer.  Txb_count keeps track of the
1195 		 * used potion of the buffer, while txb_free does unused
1196 		 * potion.  So, as long as the driver runs properly,
1197 		 * txb_count is zero if and only if txb_free is same
1198 		 * as txb_size (which represents whole buffer.)
1199 		 */
1200 		if_printf(ifp, "inconsistent txb variables (%d, %d)\n",
1201 			sc->txb_count, sc->txb_free);
1202 		/*
1203 		 * So, what should I do, then?
1204 		 *
1205 		 * We now know txb_count and txb_free contradicts.  We
1206 		 * cannot, however, tell which is wrong.  More
1207 		 * over, we cannot peek 86960 transmission buffer or
1208 		 * reset the transmission buffer.  (In fact, we can
1209 		 * reset the entire interface.  I don't want to do it.)
1210 		 *
1211 		 * If txb_count is incorrect, leaving it as-is will cause
1212 		 * sending of garbage after next interrupt.  We have to
1213 		 * avoid it.  Hence, we reset the txb_count here.  If
1214 		 * txb_free was incorrect, resetting txb_count just loses
1215 		 * some packets.  We can live with it.
1216 		 */
1217 		sc->txb_count = 0;
1218 	}
1219 #endif
1220 
1221 	/*
1222 	 * First, see if there are buffered packets and an idle
1223 	 * transmitter - should never happen at this point.
1224 	 */
1225 	if ((sc->txb_count > 0) && (sc->txb_sched == 0)) {
1226 		if_printf(ifp, "transmitter idle with %d buffered packets\n",
1227 		       sc->txb_count);
1228 		fe_xmit(sc);
1229 	}
1230 
1231 	/*
1232 	 * Stop accepting more transmission packets temporarily, when
1233 	 * a filter change request is delayed.  Updating the MARs on
1234 	 * 86960 flushes the transmission buffer, so it is delayed
1235 	 * until all buffered transmission packets have been sent
1236 	 * out.
1237 	 */
1238 	if (sc->filter_change) {
1239 		/*
1240 		 * Filter change request is delayed only when the DLC is
1241 		 * working.  DLC soon raise an interrupt after finishing
1242 		 * the work.
1243 		 */
1244 		goto indicate_active;
1245 	}
1246 
1247 	for (;;) {
1248 
1249 		/*
1250 		 * See if there is room to put another packet in the buffer.
1251 		 * We *could* do better job by peeking the send queue to
1252 		 * know the length of the next packet.  Current version just
1253 		 * tests against the worst case (i.e., longest packet).  FIXME.
1254 		 *
1255 		 * When adding the packet-peek feature, don't forget adding a
1256 		 * test on txb_count against QUEUEING_MAX.
1257 		 * There is a little chance the packet count exceeds
1258 		 * the limit.  Assume transmission buffer is 8KB (2x8KB
1259 		 * configuration) and an application sends a bunch of small
1260 		 * (i.e., minimum packet sized) packets rapidly.  An 8KB
1261 		 * buffer can hold 130 blocks of 62 bytes long...
1262 		 */
1263 		if (sc->txb_free
1264 		    < ETHER_MAX_LEN - ETHER_CRC_LEN + FE_DATA_LEN_LEN) {
1265 			/* No room.  */
1266 			goto indicate_active;
1267 		}
1268 
1269 #if FE_SINGLE_TRANSMISSION
1270 		if (sc->txb_count > 0) {
1271 			/* Just one packet per a transmission buffer.  */
1272 			goto indicate_active;
1273 		}
1274 #endif
1275 
1276 		/*
1277 		 * Get the next mbuf chain for a packet to send.
1278 		 */
1279 		IF_DEQUEUE(&sc->ifp->if_snd, m);
1280 		if (m == NULL) {
1281 			/* No more packets to send.  */
1282 			goto indicate_inactive;
1283 		}
1284 
1285 		/*
1286 		 * Copy the mbuf chain into the transmission buffer.
1287 		 * txb_* variables are updated as necessary.
1288 		 */
1289 		fe_write_mbufs(sc, m);
1290 
1291 		/* Start transmitter if it's idle.  */
1292 		if ((sc->txb_count > 0) && (sc->txb_sched == 0))
1293 			fe_xmit(sc);
1294 
1295 		/*
1296 		 * Tap off here if there is a bpf listener,
1297 		 * and the device is *not* in promiscuous mode.
1298 		 * (86960 receives self-generated packets if
1299 		 * and only if it is in "receive everything"
1300 		 * mode.)
1301 		 */
1302 		if (!(sc->ifp->if_flags & IFF_PROMISC))
1303 			BPF_MTAP(sc->ifp, m);
1304 
1305 		m_freem(m);
1306 	}
1307 
1308   indicate_inactive:
1309 	/*
1310 	 * We are using the !OACTIVE flag to indicate to
1311 	 * the outside world that we can accept an
1312 	 * additional packet rather than that the
1313 	 * transmitter is _actually_ active.  Indeed, the
1314 	 * transmitter may be active, but if we haven't
1315 	 * filled all the buffers with data then we still
1316 	 * want to accept more.
1317 	 */
1318 	sc->ifp->if_drv_flags &= ~IFF_DRV_OACTIVE;
1319 	return;
1320 
1321   indicate_active:
1322 	/*
1323 	 * The transmitter is active, and there are no room for
1324 	 * more outgoing packets in the transmission buffer.
1325 	 */
1326 	sc->ifp->if_drv_flags |= IFF_DRV_OACTIVE;
1327 	return;
1328 }
1329 
1330 /*
1331  * Drop (skip) a packet from receive buffer in 86960 memory.
1332  */
1333 static void
1334 fe_droppacket (struct fe_softc * sc, int len)
1335 {
1336 	int i;
1337 
1338 	/*
1339 	 * 86960 manual says that we have to read 8 bytes from the buffer
1340 	 * before skip the packets and that there must be more than 8 bytes
1341 	 * remaining in the buffer when issue a skip command.
1342 	 * Remember, we have already read 4 bytes before come here.
1343 	 */
1344 	if (len > 12) {
1345 		/* Read 4 more bytes, and skip the rest of the packet.  */
1346 		if ((sc->proto_dlcr6 & FE_D6_SBW) == FE_D6_SBW_BYTE)
1347 		{
1348 			(void) fe_inb(sc, FE_BMPR8);
1349 			(void) fe_inb(sc, FE_BMPR8);
1350 			(void) fe_inb(sc, FE_BMPR8);
1351 			(void) fe_inb(sc, FE_BMPR8);
1352 		}
1353 		else
1354 		{
1355 			(void) fe_inw(sc, FE_BMPR8);
1356 			(void) fe_inw(sc, FE_BMPR8);
1357 		}
1358 		fe_outb(sc, FE_BMPR14, FE_B14_SKIP);
1359 	} else {
1360 		/* We should not come here unless receiving RUNTs.  */
1361 		if ((sc->proto_dlcr6 & FE_D6_SBW) == FE_D6_SBW_BYTE)
1362 		{
1363 			for (i = 0; i < len; i++)
1364 				(void) fe_inb(sc, FE_BMPR8);
1365 		}
1366 		else
1367 		{
1368 			for (i = 0; i < len; i += 2)
1369 				(void) fe_inw(sc, FE_BMPR8);
1370 		}
1371 	}
1372 }
1373 
1374 #ifdef DIAGNOSTIC
1375 /*
1376  * Empty receiving buffer.
1377  */
1378 static void
1379 fe_emptybuffer (struct fe_softc * sc)
1380 {
1381 	int i;
1382 	u_char saved_dlcr5;
1383 
1384 #ifdef FE_DEBUG
1385 	if_printf(sc->ifp, "emptying receive buffer\n");
1386 #endif
1387 
1388 	/*
1389 	 * Stop receiving packets, temporarily.
1390 	 */
1391 	saved_dlcr5 = fe_inb(sc, FE_DLCR5);
1392 	fe_outb(sc, FE_DLCR5, sc->proto_dlcr5);
1393 	DELAY(1300);
1394 
1395 	/*
1396 	 * When we come here, the receive buffer management may
1397 	 * have been broken.  So, we cannot use skip operation.
1398 	 * Just discard everything in the buffer.
1399 	 */
1400 	if ((sc->proto_dlcr6 & FE_D6_SBW) == FE_D6_SBW_BYTE)
1401 	{
1402 		for (i = 0; i < 65536; i++) {
1403 			if (fe_inb(sc, FE_DLCR5) & FE_D5_BUFEMP)
1404 				break;
1405 			(void) fe_inb(sc, FE_BMPR8);
1406 		}
1407 	}
1408 	else
1409 	{
1410 		for (i = 0; i < 65536; i += 2) {
1411 			if (fe_inb(sc, FE_DLCR5) & FE_D5_BUFEMP)
1412 				break;
1413 			(void) fe_inw(sc, FE_BMPR8);
1414 		}
1415 	}
1416 
1417 	/*
1418 	 * Double check.
1419 	 */
1420 	if (fe_inb(sc, FE_DLCR5) & FE_D5_BUFEMP) {
1421 		if_printf(sc->ifp,
1422 		    "could not empty receive buffer\n");
1423 		/* Hmm.  What should I do if this happens?  FIXME.  */
1424 	}
1425 
1426 	/*
1427 	 * Restart receiving packets.
1428 	 */
1429 	fe_outb(sc, FE_DLCR5, saved_dlcr5);
1430 }
1431 #endif
1432 
1433 /*
1434  * Transmission interrupt handler
1435  * The control flow of this function looks silly.  FIXME.
1436  */
1437 static void
1438 fe_tint (struct fe_softc * sc, u_char tstat)
1439 {
1440 	int left;
1441 	int col;
1442 
1443 	/*
1444 	 * Handle "excessive collision" interrupt.
1445 	 */
1446 	if (tstat & FE_D0_COLL16) {
1447 
1448 		/*
1449 		 * Find how many packets (including this collided one)
1450 		 * are left unsent in transmission buffer.
1451 		 */
1452 		left = fe_inb(sc, FE_BMPR10);
1453 		if_printf(sc->ifp, "excessive collision (%d/%d)\n",
1454 		       left, sc->txb_sched);
1455 
1456 		/*
1457 		 * Clear the collision flag (in 86960) here
1458 		 * to avoid confusing statistics.
1459 		 */
1460 		fe_outb(sc, FE_DLCR0, FE_D0_COLLID);
1461 
1462 		/*
1463 		 * Restart transmitter, skipping the
1464 		 * collided packet.
1465 		 *
1466 		 * We *must* skip the packet to keep network running
1467 		 * properly.  Excessive collision error is an
1468 		 * indication of the network overload.  If we
1469 		 * tried sending the same packet after excessive
1470 		 * collision, the network would be filled with
1471 		 * out-of-time packets.  Packets belonging
1472 		 * to reliable transport (such as TCP) are resent
1473 		 * by some upper layer.
1474 		 */
1475 		fe_outb(sc, FE_BMPR11, FE_B11_CTRL_SKIP | FE_B11_MODE1);
1476 
1477 		/* Update statistics.  */
1478 		sc->tx_excolls++;
1479 	}
1480 
1481 	/*
1482 	 * Handle "transmission complete" interrupt.
1483 	 */
1484 	if (tstat & FE_D0_TXDONE) {
1485 
1486 		/*
1487 		 * Add in total number of collisions on last
1488 		 * transmission.  We also clear "collision occurred" flag
1489 		 * here.
1490 		 *
1491 		 * 86960 has a design flaw on collision count on multiple
1492 		 * packet transmission.  When we send two or more packets
1493 		 * with one start command (that's what we do when the
1494 		 * transmission queue is crowded), 86960 informs us number
1495 		 * of collisions occurred on the last packet on the
1496 		 * transmission only.  Number of collisions on previous
1497 		 * packets are lost.  I have told that the fact is clearly
1498 		 * stated in the Fujitsu document.
1499 		 *
1500 		 * I considered not to mind it seriously.  Collision
1501 		 * count is not so important, anyway.  Any comments?  FIXME.
1502 		 */
1503 
1504 		if (fe_inb(sc, FE_DLCR0) & FE_D0_COLLID) {
1505 
1506 			/* Clear collision flag.  */
1507 			fe_outb(sc, FE_DLCR0, FE_D0_COLLID);
1508 
1509 			/* Extract collision count from 86960.  */
1510 			col = fe_inb(sc, FE_DLCR4);
1511 			col = (col & FE_D4_COL) >> FE_D4_COL_SHIFT;
1512 			if (col == 0) {
1513 				/*
1514 				 * Status register indicates collisions,
1515 				 * while the collision count is zero.
1516 				 * This can happen after multiple packet
1517 				 * transmission, indicating that one or more
1518 				 * previous packet(s) had been collided.
1519 				 *
1520 				 * Since the accurate number of collisions
1521 				 * has been lost, we just guess it as 1;
1522 				 * Am I too optimistic?  FIXME.
1523 				 */
1524 				col = 1;
1525 			}
1526 			if_inc_counter(sc->ifp, IFCOUNTER_COLLISIONS, col);
1527 			if (col == 1)
1528 				sc->mibdata.dot3StatsSingleCollisionFrames++;
1529 			else
1530 				sc->mibdata.dot3StatsMultipleCollisionFrames++;
1531 			sc->mibdata.dot3StatsCollFrequencies[col-1]++;
1532 		}
1533 
1534 		/*
1535 		 * Update transmission statistics.
1536 		 * Be sure to reflect number of excessive collisions.
1537 		 */
1538 		col = sc->tx_excolls;
1539 		if_inc_counter(sc->ifp, IFCOUNTER_OPACKETS, sc->txb_sched - col);
1540 		if_inc_counter(sc->ifp, IFCOUNTER_OERRORS, col);
1541 		if_inc_counter(sc->ifp, IFCOUNTER_COLLISIONS, col * 16);
1542 		sc->mibdata.dot3StatsExcessiveCollisions += col;
1543 		sc->mibdata.dot3StatsCollFrequencies[15] += col;
1544 		sc->txb_sched = 0;
1545 
1546 		/*
1547 		 * The transmitter is no more active.
1548 		 * Reset output active flag and watchdog timer.
1549 		 */
1550 		sc->ifp->if_drv_flags &= ~IFF_DRV_OACTIVE;
1551 		sc->tx_timeout = 0;
1552 
1553 		/*
1554 		 * If more data is ready to transmit in the buffer, start
1555 		 * transmitting them.  Otherwise keep transmitter idle,
1556 		 * even if more data is queued.  This gives receive
1557 		 * process a slight priority.
1558 		 */
1559 		if (sc->txb_count > 0)
1560 			fe_xmit(sc);
1561 	}
1562 }
1563 
1564 /*
1565  * Ethernet interface receiver interrupt.
1566  */
1567 static void
1568 fe_rint (struct fe_softc * sc, u_char rstat)
1569 {
1570 	u_short len;
1571 	u_char status;
1572 	int i;
1573 
1574 	/*
1575 	 * Update statistics if this interrupt is caused by an error.
1576 	 * Note that, when the system was not sufficiently fast, the
1577 	 * receive interrupt might not be acknowledged immediately.  If
1578 	 * one or more errornous frames were received before this routine
1579 	 * was scheduled, they are ignored, and the following error stats
1580 	 * give less than real values.
1581 	 */
1582 	if (rstat & (FE_D1_OVRFLO | FE_D1_CRCERR | FE_D1_ALGERR | FE_D1_SRTPKT)) {
1583 		if (rstat & FE_D1_OVRFLO)
1584 			sc->mibdata.dot3StatsInternalMacReceiveErrors++;
1585 		if (rstat & FE_D1_CRCERR)
1586 			sc->mibdata.dot3StatsFCSErrors++;
1587 		if (rstat & FE_D1_ALGERR)
1588 			sc->mibdata.dot3StatsAlignmentErrors++;
1589 #if 0
1590 		/* The reference MAC receiver defined in 802.3
1591 		   silently ignores short frames (RUNTs) without
1592 		   notifying upper layer.  RFC 1650 (dot3 MIB) is
1593 		   based on the 802.3, and it has no stats entry for
1594 		   RUNTs...  */
1595 		if (rstat & FE_D1_SRTPKT)
1596 			sc->mibdata.dot3StatsFrameTooShorts++; /* :-) */
1597 #endif
1598 		if_inc_counter(sc->ifp, IFCOUNTER_IERRORS, 1);
1599 	}
1600 
1601 	/*
1602 	 * MB86960 has a flag indicating "receive queue empty."
1603 	 * We just loop, checking the flag, to pull out all received
1604 	 * packets.
1605 	 *
1606 	 * We limit the number of iterations to avoid infinite-loop.
1607 	 * The upper bound is set to unrealistic high value.
1608 	 */
1609 	for (i = 0; i < FE_MAX_RECV_COUNT * 2; i++) {
1610 
1611 		/* Stop the iteration if 86960 indicates no packets.  */
1612 		if (fe_inb(sc, FE_DLCR5) & FE_D5_BUFEMP)
1613 			return;
1614 
1615 		/*
1616 		 * Extract a receive status byte.
1617 		 * As our 86960 is in 16 bit bus access mode, we have to
1618 		 * use inw() to get the status byte.  The significant
1619 		 * value is returned in lower 8 bits.
1620 		 */
1621 		if ((sc->proto_dlcr6 & FE_D6_SBW) == FE_D6_SBW_BYTE)
1622 		{
1623 			status = fe_inb(sc, FE_BMPR8);
1624 			(void) fe_inb(sc, FE_BMPR8);
1625 		}
1626 		else
1627 		{
1628 			status = (u_char) fe_inw(sc, FE_BMPR8);
1629 		}
1630 
1631 		/*
1632 		 * Extract the packet length.
1633 		 * It is a sum of a header (14 bytes) and a payload.
1634 		 * CRC has been stripped off by the 86960.
1635 		 */
1636 		if ((sc->proto_dlcr6 & FE_D6_SBW) == FE_D6_SBW_BYTE)
1637 		{
1638 			len  =  fe_inb(sc, FE_BMPR8);
1639 			len |= (fe_inb(sc, FE_BMPR8) << 8);
1640 		}
1641 		else
1642 		{
1643 			len = fe_inw(sc, FE_BMPR8);
1644 		}
1645 
1646 		/*
1647 		 * AS our 86960 is programed to ignore errored frame,
1648 		 * we must not see any error indication in the
1649 		 * receive buffer.  So, any error condition is a
1650 		 * serious error, e.g., out-of-sync of the receive
1651 		 * buffer pointers.
1652 		 */
1653 		if ((status & 0xF0) != 0x20 ||
1654 		    len > ETHER_MAX_LEN - ETHER_CRC_LEN ||
1655 		    len < ETHER_MIN_LEN - ETHER_CRC_LEN) {
1656 			if_printf(sc->ifp,
1657 			    "RX buffer out-of-sync\n");
1658 			if_inc_counter(sc->ifp, IFCOUNTER_IERRORS, 1);
1659 			sc->mibdata.dot3StatsInternalMacReceiveErrors++;
1660 			fe_reset(sc);
1661 			return;
1662 		}
1663 
1664 		/*
1665 		 * Go get a packet.
1666 		 */
1667 		if (fe_get_packet(sc, len) < 0) {
1668 			/*
1669 			 * Negative return from fe_get_packet()
1670 			 * indicates no available mbuf.  We stop
1671 			 * receiving packets, even if there are more
1672 			 * in the buffer.  We hope we can get more
1673 			 * mbuf next time.
1674 			 */
1675 			if_inc_counter(sc->ifp, IFCOUNTER_IERRORS, 1);
1676 			sc->mibdata.dot3StatsMissedFrames++;
1677 			fe_droppacket(sc, len);
1678 			return;
1679 		}
1680 
1681 		/* Successfully received a packet.  Update stat.  */
1682 		if_inc_counter(sc->ifp, IFCOUNTER_IPACKETS, 1);
1683 	}
1684 
1685 	/* Maximum number of frames has been received.  Something
1686            strange is happening here... */
1687 	if_printf(sc->ifp, "unusual receive flood\n");
1688 	sc->mibdata.dot3StatsInternalMacReceiveErrors++;
1689 	fe_reset(sc);
1690 }
1691 
1692 /*
1693  * Ethernet interface interrupt processor
1694  */
1695 static void
1696 fe_intr (void *arg)
1697 {
1698 	struct fe_softc *sc = arg;
1699 	u_char tstat, rstat;
1700 	int loop_count = FE_MAX_LOOP;
1701 
1702 	FE_LOCK(sc);
1703 
1704 	/* Loop until there are no more new interrupt conditions.  */
1705 	while (loop_count-- > 0) {
1706 		/*
1707 		 * Get interrupt conditions, masking unneeded flags.
1708 		 */
1709 		tstat = fe_inb(sc, FE_DLCR0) & FE_TMASK;
1710 		rstat = fe_inb(sc, FE_DLCR1) & FE_RMASK;
1711 		if (tstat == 0 && rstat == 0) {
1712 			FE_UNLOCK(sc);
1713 			return;
1714 		}
1715 
1716 		/*
1717 		 * Reset the conditions we are acknowledging.
1718 		 */
1719 		fe_outb(sc, FE_DLCR0, tstat);
1720 		fe_outb(sc, FE_DLCR1, rstat);
1721 
1722 		/*
1723 		 * Handle transmitter interrupts.
1724 		 */
1725 		if (tstat)
1726 			fe_tint(sc, tstat);
1727 
1728 		/*
1729 		 * Handle receiver interrupts
1730 		 */
1731 		if (rstat)
1732 			fe_rint(sc, rstat);
1733 
1734 		/*
1735 		 * Update the multicast address filter if it is
1736 		 * needed and possible.  We do it now, because
1737 		 * we can make sure the transmission buffer is empty,
1738 		 * and there is a good chance that the receive queue
1739 		 * is empty.  It will minimize the possibility of
1740 		 * packet loss.
1741 		 */
1742 		if (sc->filter_change &&
1743 		    sc->txb_count == 0 && sc->txb_sched == 0) {
1744 			fe_loadmar(sc);
1745 			sc->ifp->if_drv_flags &= ~IFF_DRV_OACTIVE;
1746 		}
1747 
1748 		/*
1749 		 * If it looks like the transmitter can take more data,
1750 		 * attempt to start output on the interface. This is done
1751 		 * after handling the receiver interrupt to give the
1752 		 * receive operation priority.
1753 		 *
1754 		 * BTW, I'm not sure in what case the OACTIVE is on at
1755 		 * this point.  Is the following test redundant?
1756 		 *
1757 		 * No.  This routine polls for both transmitter and
1758 		 * receiver interrupts.  86960 can raise a receiver
1759 		 * interrupt when the transmission buffer is full.
1760 		 */
1761 		if ((sc->ifp->if_drv_flags & IFF_DRV_OACTIVE) == 0)
1762 			fe_start_locked(sc->ifp);
1763 	}
1764 	FE_UNLOCK(sc);
1765 
1766 	if_printf(sc->ifp, "too many loops\n");
1767 }
1768 
1769 /*
1770  * Process an ioctl request. This code needs some work - it looks
1771  * pretty ugly.
1772  */
1773 static int
1774 fe_ioctl (struct ifnet * ifp, u_long command, caddr_t data)
1775 {
1776 	struct fe_softc *sc = ifp->if_softc;
1777 	struct ifreq *ifr = (struct ifreq *)data;
1778 	int error = 0;
1779 
1780 	switch (command) {
1781 
1782 	  case SIOCSIFFLAGS:
1783 		/*
1784 		 * Switch interface state between "running" and
1785 		 * "stopped", reflecting the UP flag.
1786 		 */
1787 		FE_LOCK(sc);
1788 		if (sc->ifp->if_flags & IFF_UP) {
1789 			if ((sc->ifp->if_drv_flags & IFF_DRV_RUNNING) == 0)
1790 				fe_init_locked(sc);
1791 		} else {
1792 			if ((sc->ifp->if_drv_flags & IFF_DRV_RUNNING) != 0)
1793 				fe_stop(sc);
1794 		}
1795 
1796 		/*
1797 		 * Promiscuous and/or multicast flags may have changed,
1798 		 * so reprogram the multicast filter and/or receive mode.
1799 		 */
1800 		fe_setmode(sc);
1801 		FE_UNLOCK(sc);
1802 
1803 		/* Done.  */
1804 		break;
1805 
1806 	  case SIOCADDMULTI:
1807 	  case SIOCDELMULTI:
1808 		/*
1809 		 * Multicast list has changed; set the hardware filter
1810 		 * accordingly.
1811 		 */
1812 		FE_LOCK(sc);
1813 		fe_setmode(sc);
1814 		FE_UNLOCK(sc);
1815 		break;
1816 
1817 	  case SIOCSIFMEDIA:
1818 	  case SIOCGIFMEDIA:
1819 		/* Let if_media to handle these commands and to call
1820 		   us back.  */
1821 		error = ifmedia_ioctl(ifp, ifr, &sc->media, command);
1822 		break;
1823 
1824 	  default:
1825 		error = ether_ioctl(ifp, command, data);
1826 		break;
1827 	}
1828 
1829 	return (error);
1830 }
1831 
1832 /*
1833  * Retrieve packet from receive buffer and send to the next level up via
1834  * ether_input().
1835  * Returns 0 if success, -1 if error (i.e., mbuf allocation failure).
1836  */
1837 static int
1838 fe_get_packet (struct fe_softc * sc, u_short len)
1839 {
1840 	struct ifnet *ifp = sc->ifp;
1841 	struct ether_header *eh;
1842 	struct mbuf *m;
1843 
1844 	FE_ASSERT_LOCKED(sc);
1845 
1846 	/*
1847 	 * NFS wants the data be aligned to the word (4 byte)
1848 	 * boundary.  Ethernet header has 14 bytes.  There is a
1849 	 * 2-byte gap.
1850 	 */
1851 #define NFS_MAGIC_OFFSET 2
1852 
1853 	/*
1854 	 * This function assumes that an Ethernet packet fits in an
1855 	 * mbuf (with a cluster attached when necessary.)  On FreeBSD
1856 	 * 2.0 for x86, which is the primary target of this driver, an
1857 	 * mbuf cluster has 4096 bytes, and we are happy.  On ancient
1858 	 * BSDs, such as vanilla 4.3 for 386, a cluster size was 1024,
1859 	 * however.  If the following #error message were printed upon
1860 	 * compile, you need to rewrite this function.
1861 	 */
1862 #if ( MCLBYTES < ETHER_MAX_LEN - ETHER_CRC_LEN + NFS_MAGIC_OFFSET )
1863 #error "Too small MCLBYTES to use fe driver."
1864 #endif
1865 
1866 	/*
1867 	 * Our strategy has one more problem.  There is a policy on
1868 	 * mbuf cluster allocation.  It says that we must have at
1869 	 * least MINCLSIZE (208 bytes on FreeBSD 2.0 for x86) to
1870 	 * allocate a cluster.  For a packet of a size between
1871 	 * (MHLEN - 2) to (MINCLSIZE - 2), our code violates the rule...
1872 	 * On the other hand, the current code is short, simple,
1873 	 * and fast, however.  It does no harmful thing, just waists
1874 	 * some memory.  Any comments?  FIXME.
1875 	 */
1876 
1877 	/* Allocate an mbuf with packet header info.  */
1878 	MGETHDR(m, M_NOWAIT, MT_DATA);
1879 	if (m == NULL)
1880 		return -1;
1881 
1882 	/* Attach a cluster if this packet doesn't fit in a normal mbuf.  */
1883 	if (len > MHLEN - NFS_MAGIC_OFFSET) {
1884 		if (!(MCLGET(m, M_NOWAIT))) {
1885 			m_freem(m);
1886 			return -1;
1887 		}
1888 	}
1889 
1890 	/* Initialize packet header info.  */
1891 	m->m_pkthdr.rcvif = ifp;
1892 	m->m_pkthdr.len = len;
1893 
1894 	/* Set the length of this packet.  */
1895 	m->m_len = len;
1896 
1897 	/* The following silliness is to make NFS happy */
1898 	m->m_data += NFS_MAGIC_OFFSET;
1899 
1900 	/* Get (actually just point to) the header part.  */
1901 	eh = mtod(m, struct ether_header *);
1902 
1903 	/* Get a packet.  */
1904 	if ((sc->proto_dlcr6 & FE_D6_SBW) == FE_D6_SBW_BYTE)
1905 	{
1906 		fe_insb(sc, FE_BMPR8, (u_int8_t *)eh, len);
1907 	}
1908 	else
1909 	{
1910 		fe_insw(sc, FE_BMPR8, (u_int16_t *)eh, (len + 1) >> 1);
1911 	}
1912 
1913 	/* Feed the packet to upper layer.  */
1914 	FE_UNLOCK(sc);
1915 	(*ifp->if_input)(ifp, m);
1916 	FE_LOCK(sc);
1917 	return 0;
1918 }
1919 
1920 /*
1921  * Write an mbuf chain to the transmission buffer memory using 16 bit PIO.
1922  * Returns number of bytes actually written, including length word.
1923  *
1924  * If an mbuf chain is too long for an Ethernet frame, it is not sent.
1925  * Packets shorter than Ethernet minimum are legal, and we pad them
1926  * before sending out.  An exception is "partial" packets which are
1927  * shorter than mandatory Ethernet header.
1928  */
1929 static void
1930 fe_write_mbufs (struct fe_softc *sc, struct mbuf *m)
1931 {
1932 	u_short length, len;
1933 	struct mbuf *mp;
1934 	u_char *data;
1935 	u_short savebyte;	/* WARNING: Architecture dependent!  */
1936 #define NO_PENDING_BYTE 0xFFFF
1937 
1938 	static u_char padding [ETHER_MIN_LEN - ETHER_CRC_LEN - ETHER_HDR_LEN];
1939 
1940 #ifdef DIAGNOSTIC
1941 	/* First, count up the total number of bytes to copy */
1942 	length = 0;
1943 	for (mp = m; mp != NULL; mp = mp->m_next)
1944 		length += mp->m_len;
1945 
1946 	/* Check if this matches the one in the packet header.  */
1947 	if (length != m->m_pkthdr.len) {
1948 		if_printf(sc->ifp,
1949 		    "packet length mismatch? (%d/%d)\n",
1950 		    length, m->m_pkthdr.len);
1951 	}
1952 #else
1953 	/* Just use the length value in the packet header.  */
1954 	length = m->m_pkthdr.len;
1955 #endif
1956 
1957 #ifdef DIAGNOSTIC
1958 	/*
1959 	 * Should never send big packets.  If such a packet is passed,
1960 	 * it should be a bug of upper layer.  We just ignore it.
1961 	 * ... Partial (too short) packets, neither.
1962 	 */
1963 	if (length < ETHER_HDR_LEN ||
1964 	    length > ETHER_MAX_LEN - ETHER_CRC_LEN) {
1965 		if_printf(sc->ifp,
1966 		    "got an out-of-spec packet (%u bytes) to send\n", length);
1967 		if_inc_counter(sc->ifp, IFCOUNTER_OERRORS, 1);
1968 		sc->mibdata.dot3StatsInternalMacTransmitErrors++;
1969 		return;
1970 	}
1971 #endif
1972 
1973 	/*
1974 	 * Put the length word for this frame.
1975 	 * Does 86960 accept odd length?  -- Yes.
1976 	 * Do we need to pad the length to minimum size by ourselves?
1977 	 * -- Generally yes.  But for (or will be) the last
1978 	 * packet in the transmission buffer, we can skip the
1979 	 * padding process.  It may gain performance slightly.  FIXME.
1980 	 */
1981 	if ((sc->proto_dlcr6 & FE_D6_SBW) == FE_D6_SBW_BYTE)
1982 	{
1983 		len = max(length, ETHER_MIN_LEN - ETHER_CRC_LEN);
1984 		fe_outb(sc, FE_BMPR8,  len & 0x00ff);
1985 		fe_outb(sc, FE_BMPR8, (len & 0xff00) >> 8);
1986 	}
1987 	else
1988 	{
1989 		fe_outw(sc, FE_BMPR8,
1990 			max(length, ETHER_MIN_LEN - ETHER_CRC_LEN));
1991 	}
1992 
1993 	/*
1994 	 * Update buffer status now.
1995 	 * Truncate the length up to an even number, since we use outw().
1996 	 */
1997 	if ((sc->proto_dlcr6 & FE_D6_SBW) != FE_D6_SBW_BYTE)
1998 	{
1999 		length = (length + 1) & ~1;
2000 	}
2001 	sc->txb_free -= FE_DATA_LEN_LEN +
2002 	    max(length, ETHER_MIN_LEN - ETHER_CRC_LEN);
2003 	sc->txb_count++;
2004 
2005 	/*
2006 	 * Transfer the data from mbuf chain to the transmission buffer.
2007 	 * MB86960 seems to require that data be transferred as words, and
2008 	 * only words.  So that we require some extra code to patch
2009 	 * over odd-length mbufs.
2010 	 */
2011 	if ((sc->proto_dlcr6 & FE_D6_SBW) == FE_D6_SBW_BYTE)
2012 	{
2013 		/* 8-bit cards are easy.  */
2014 		for (mp = m; mp != 0; mp = mp->m_next) {
2015 			if (mp->m_len)
2016 				fe_outsb(sc, FE_BMPR8, mtod(mp, caddr_t),
2017 					 mp->m_len);
2018 		}
2019 	}
2020 	else
2021 	{
2022 		/* 16-bit cards are a pain.  */
2023 		savebyte = NO_PENDING_BYTE;
2024 		for (mp = m; mp != 0; mp = mp->m_next) {
2025 
2026 			/* Ignore empty mbuf.  */
2027 			len = mp->m_len;
2028 			if (len == 0)
2029 				continue;
2030 
2031 			/* Find the actual data to send.  */
2032 			data = mtod(mp, caddr_t);
2033 
2034 			/* Finish the last byte.  */
2035 			if (savebyte != NO_PENDING_BYTE) {
2036 				fe_outw(sc, FE_BMPR8, savebyte | (*data << 8));
2037 				data++;
2038 				len--;
2039 				savebyte = NO_PENDING_BYTE;
2040 			}
2041 
2042 			/* output contiguous words */
2043 			if (len > 1) {
2044 				fe_outsw(sc, FE_BMPR8, (u_int16_t *)data,
2045 					 len >> 1);
2046 				data += len & ~1;
2047 				len &= 1;
2048 			}
2049 
2050 			/* Save a remaining byte, if there is one.  */
2051 			if (len > 0)
2052 				savebyte = *data;
2053 		}
2054 
2055 		/* Spit the last byte, if the length is odd.  */
2056 		if (savebyte != NO_PENDING_BYTE)
2057 			fe_outw(sc, FE_BMPR8, savebyte);
2058 	}
2059 
2060 	/* Pad to the Ethernet minimum length, if the packet is too short.  */
2061 	if (length < ETHER_MIN_LEN - ETHER_CRC_LEN) {
2062 		if ((sc->proto_dlcr6 & FE_D6_SBW) == FE_D6_SBW_BYTE)
2063 		{
2064 			fe_outsb(sc, FE_BMPR8, padding,
2065 				 ETHER_MIN_LEN - ETHER_CRC_LEN - length);
2066 		}
2067 		else
2068 		{
2069 			fe_outsw(sc, FE_BMPR8, (u_int16_t *)padding,
2070 				 (ETHER_MIN_LEN - ETHER_CRC_LEN - length) >> 1);
2071 		}
2072 	}
2073 }
2074 
2075 /*
2076  * Compute the multicast address filter from the
2077  * list of multicast addresses we need to listen to.
2078  */
2079 static struct fe_filter
2080 fe_mcaf ( struct fe_softc *sc )
2081 {
2082 	int index;
2083 	struct fe_filter filter;
2084 	struct ifmultiaddr *ifma;
2085 
2086 	filter = fe_filter_nothing;
2087 	if_maddr_rlock(sc->ifp);
2088 	TAILQ_FOREACH(ifma, &sc->ifp->if_multiaddrs, ifma_link) {
2089 		if (ifma->ifma_addr->sa_family != AF_LINK)
2090 			continue;
2091 		index = ether_crc32_le(LLADDR((struct sockaddr_dl *)
2092 		    ifma->ifma_addr), ETHER_ADDR_LEN) >> 26;
2093 #ifdef FE_DEBUG
2094 		if_printf(sc->ifp, "hash(%6D) == %d\n",
2095 			enm->enm_addrlo , ":", index);
2096 #endif
2097 
2098 		filter.data[index >> 3] |= 1 << (index & 7);
2099 	}
2100 	if_maddr_runlock(sc->ifp);
2101 	return ( filter );
2102 }
2103 
2104 /*
2105  * Calculate a new "multicast packet filter" and put the 86960
2106  * receiver in appropriate mode.
2107  */
2108 static void
2109 fe_setmode (struct fe_softc *sc)
2110 {
2111 
2112 	/*
2113 	 * If the interface is not running, we postpone the update
2114 	 * process for receive modes and multicast address filter
2115 	 * until the interface is restarted.  It reduces some
2116 	 * complicated job on maintaining chip states.  (Earlier versions
2117 	 * of this driver had a bug on that point...)
2118 	 *
2119 	 * To complete the trick, fe_init() calls fe_setmode() after
2120 	 * restarting the interface.
2121 	 */
2122 	if (!(sc->ifp->if_drv_flags & IFF_DRV_RUNNING))
2123 		return;
2124 
2125 	/*
2126 	 * Promiscuous mode is handled separately.
2127 	 */
2128 	if (sc->ifp->if_flags & IFF_PROMISC) {
2129 		/*
2130 		 * Program 86960 to receive all packets on the segment
2131 		 * including those directed to other stations.
2132 		 * Multicast filter stored in MARs are ignored
2133 		 * under this setting, so we don't need to update it.
2134 		 *
2135 		 * Promiscuous mode in FreeBSD 2 is used solely by
2136 		 * BPF, and BPF only listens to valid (no error) packets.
2137 		 * So, we ignore erroneous ones even in this mode.
2138 		 * (Older versions of fe driver mistook the point.)
2139 		 */
2140 		fe_outb(sc, FE_DLCR5,
2141 			sc->proto_dlcr5 | FE_D5_AFM0 | FE_D5_AFM1);
2142 		sc->filter_change = 0;
2143 		return;
2144 	}
2145 
2146 	/*
2147 	 * Turn the chip to the normal (non-promiscuous) mode.
2148 	 */
2149 	fe_outb(sc, FE_DLCR5, sc->proto_dlcr5 | FE_D5_AFM1);
2150 
2151 	/*
2152 	 * Find the new multicast filter value.
2153 	 */
2154 	if (sc->ifp->if_flags & IFF_ALLMULTI)
2155 		sc->filter = fe_filter_all;
2156 	else
2157 		sc->filter = fe_mcaf(sc);
2158 	sc->filter_change = 1;
2159 
2160 	/*
2161 	 * We have to update the multicast filter in the 86960, A.S.A.P.
2162 	 *
2163 	 * Note that the DLC (Data Link Control unit, i.e. transmitter
2164 	 * and receiver) must be stopped when feeding the filter, and
2165 	 * DLC trashes all packets in both transmission and receive
2166 	 * buffers when stopped.
2167 	 *
2168 	 * To reduce the packet loss, we delay the filter update
2169 	 * process until buffers are empty.
2170 	 */
2171 	if (sc->txb_sched == 0 && sc->txb_count == 0 &&
2172 	    !(fe_inb(sc, FE_DLCR1) & FE_D1_PKTRDY)) {
2173 		/*
2174 		 * Buffers are (apparently) empty.  Load
2175 		 * the new filter value into MARs now.
2176 		 */
2177 		fe_loadmar(sc);
2178 	} else {
2179 		/*
2180 		 * Buffers are not empty.  Mark that we have to update
2181 		 * the MARs.  The new filter will be loaded by feintr()
2182 		 * later.
2183 		 */
2184 	}
2185 }
2186 
2187 /*
2188  * Load a new multicast address filter into MARs.
2189  *
2190  * The caller must have acquired the softc lock before fe_loadmar.
2191  * This function starts the DLC upon return.  So it can be called only
2192  * when the chip is working, i.e., from the driver's point of view, when
2193  * a device is RUNNING.  (I mistook the point in previous versions.)
2194  */
2195 static void
2196 fe_loadmar (struct fe_softc * sc)
2197 {
2198 	/* Stop the DLC (transmitter and receiver).  */
2199 	DELAY(200);
2200 	fe_outb(sc, FE_DLCR6, sc->proto_dlcr6 | FE_D6_DLC_DISABLE);
2201 	DELAY(200);
2202 
2203 	/* Select register bank 1 for MARs.  */
2204 	fe_outb(sc, FE_DLCR7, sc->proto_dlcr7 | FE_D7_RBS_MAR | FE_D7_POWER_UP);
2205 
2206 	/* Copy filter value into the registers.  */
2207 	fe_outblk(sc, FE_MAR8, sc->filter.data, FE_FILTER_LEN);
2208 
2209 	/* Restore the bank selection for BMPRs (i.e., runtime registers).  */
2210 	fe_outb(sc, FE_DLCR7,
2211 		sc->proto_dlcr7 | FE_D7_RBS_BMPR | FE_D7_POWER_UP);
2212 
2213 	/* Restart the DLC.  */
2214 	DELAY(200);
2215 	fe_outb(sc, FE_DLCR6, sc->proto_dlcr6 | FE_D6_DLC_ENABLE);
2216 	DELAY(200);
2217 
2218 	/* We have just updated the filter.  */
2219 	sc->filter_change = 0;
2220 }
2221 
2222 /* Change the media selection.  */
2223 static int
2224 fe_medchange (struct ifnet *ifp)
2225 {
2226 	struct fe_softc *sc = (struct fe_softc *)ifp->if_softc;
2227 
2228 #ifdef DIAGNOSTIC
2229 	/* If_media should not pass any request for a media which this
2230 	   interface doesn't support.  */
2231 	int b;
2232 
2233 	for (b = 0; bit2media[b] != 0; b++) {
2234 		if (bit2media[b] == sc->media.ifm_media) break;
2235 	}
2236 	if (((1 << b) & sc->mbitmap) == 0) {
2237 		if_printf(sc->ifp,
2238 		    "got an unsupported media request (0x%x)\n",
2239 		    sc->media.ifm_media);
2240 		return EINVAL;
2241 	}
2242 #endif
2243 
2244 	/* We don't actually change media when the interface is down.
2245 	   fe_init() will do the job, instead.  Should we also wait
2246 	   until the transmission buffer being empty?  Changing the
2247 	   media when we are sending a frame will cause two garbages
2248 	   on wires, one on old media and another on new.  FIXME */
2249 	FE_LOCK(sc);
2250 	if (sc->ifp->if_flags & IFF_UP) {
2251 		if (sc->msel) sc->msel(sc);
2252 	}
2253 	FE_UNLOCK(sc);
2254 
2255 	return 0;
2256 }
2257 
2258 /* I don't know how I can support media status callback... FIXME.  */
2259 static void
2260 fe_medstat (struct ifnet *ifp, struct ifmediareq *ifmr)
2261 {
2262 	struct fe_softc *sc = ifp->if_softc;
2263 
2264 	ifmr->ifm_active = sc->media.ifm_media;
2265 }
2266