xref: /freebsd-12.1/sys/dev/fe/if_fe.c (revision bc0d1102)
1 /*-
2  * All Rights Reserved, Copyright (C) Fujitsu Limited 1995
3  *
4  * This software may be used, modified, copied, distributed, and sold, in
5  * both source and binary form provided that the above copyright, these
6  * terms and the following disclaimer are retained.  The name of the author
7  * and/or the contributor may not be used to endorse or promote products
8  * derived from this software without specific prior written permission.
9  *
10  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND THE CONTRIBUTOR ``AS IS'' AND
11  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
12  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
13  * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR THE CONTRIBUTOR BE LIABLE
14  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
15  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
16  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION.
17  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
18  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
19  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
20  * SUCH DAMAGE.
21  */
22 
23 #include <sys/cdefs.h>
24 __FBSDID("$FreeBSD$");
25 
26 /*
27  *
28  * Device driver for Fujitsu MB86960A/MB86965A based Ethernet cards.
29  * Contributed by M. Sekiguchi. <[email protected]>
30  *
31  * This version is intended to be a generic template for various
32  * MB86960A/MB86965A based Ethernet cards.  It currently supports
33  * Fujitsu FMV-180 series for ISA and Allied-Telesis AT1700/RE2000
34  * series for ISA, as well as Fujitsu MBH10302 PC Card.
35  * There are some currently-
36  * unused hooks embedded, which are primarily intended to support
37  * other types of Ethernet cards, but the author is not sure whether
38  * they are useful.
39  *
40  * This software is a derivative work of if_ed.c version 1.56 by David
41  * Greenman available as a part of FreeBSD 2.0 RELEASE source distribution.
42  *
43  * The following lines are retained from the original if_ed.c:
44  *
45  * Copyright (C) 1993, David Greenman. This software may be used, modified,
46  *   copied, distributed, and sold, in both source and binary form provided
47  *   that the above copyright and these terms are retained. Under no
48  *   circumstances is the author responsible for the proper functioning
49  *   of this software, nor does the author assume any responsibility
50  *   for damages incurred with its use.
51  */
52 
53 /*
54  * TODO:
55  *  o   To support ISA PnP auto configuration for FMV-183/184.
56  *  o   To reconsider mbuf usage.
57  *  o   To reconsider transmission buffer usage, including
58  *      transmission buffer size (currently 4KB x 2) and pros-and-
59  *      cons of multiple frame transmission.
60  *  o   To test IPX codes.
61  *  o   To test new-bus frontend.
62  */
63 
64 #include <sys/param.h>
65 #include <sys/kernel.h>
66 #include <sys/malloc.h>
67 #include <sys/systm.h>
68 #include <sys/socket.h>
69 #include <sys/sockio.h>
70 #include <sys/mbuf.h>
71 
72 #include <sys/bus.h>
73 #include <machine/bus.h>
74 #include <sys/rman.h>
75 
76 #include <net/ethernet.h>
77 #include <net/if.h>
78 #include <net/if_var.h>
79 #include <net/if_dl.h>
80 #include <net/if_mib.h>
81 #include <net/if_media.h>
82 #include <net/if_types.h>
83 
84 #include <netinet/in.h>
85 #include <netinet/if_ether.h>
86 
87 #include <net/bpf.h>
88 
89 #include <dev/fe/mb86960.h>
90 #include <dev/fe/if_fereg.h>
91 #include <dev/fe/if_fevar.h>
92 
93 /*
94  * Transmit just one packet per a "send" command to 86960.
95  * This option is intended for performance test.  An EXPERIMENTAL option.
96  */
97 #ifndef FE_SINGLE_TRANSMISSION
98 #define FE_SINGLE_TRANSMISSION 0
99 #endif
100 
101 /*
102  * Maximum loops when interrupt.
103  * This option prevents an infinite loop due to hardware failure.
104  * (Some laptops make an infinite loop after PC Card is ejected.)
105  */
106 #ifndef FE_MAX_LOOP
107 #define FE_MAX_LOOP 0x800
108 #endif
109 
110 /*
111  * Device configuration flags.
112  */
113 
114 /* DLCR6 settings.  */
115 #define FE_FLAGS_DLCR6_VALUE	0x007F
116 
117 /* Force DLCR6 override.  */
118 #define FE_FLAGS_OVERRIDE_DLCR6	0x0080
119 
120 
121 devclass_t fe_devclass;
122 
123 /*
124  * Special filter values.
125  */
126 static struct fe_filter const fe_filter_nothing = { FE_FILTER_NOTHING };
127 static struct fe_filter const fe_filter_all     = { FE_FILTER_ALL };
128 
129 /* Standard driver entry points.  These can be static.  */
130 static void		fe_init		(void *);
131 static void		fe_init_locked	(struct fe_softc *);
132 static driver_intr_t	fe_intr;
133 static int		fe_ioctl	(struct ifnet *, u_long, caddr_t);
134 static void		fe_start	(struct ifnet *);
135 static void		fe_start_locked	(struct ifnet *);
136 static void		fe_watchdog	(void *);
137 static int		fe_medchange	(struct ifnet *);
138 static void		fe_medstat	(struct ifnet *, struct ifmediareq *);
139 
140 /* Local functions.  Order of declaration is confused.  FIXME.  */
141 static int	fe_get_packet	( struct fe_softc *, u_short );
142 static void	fe_tint		( struct fe_softc *, u_char );
143 static void	fe_rint		( struct fe_softc *, u_char );
144 static void	fe_xmit		( struct fe_softc * );
145 static void	fe_write_mbufs	( struct fe_softc *, struct mbuf * );
146 static void	fe_setmode	( struct fe_softc * );
147 static void	fe_loadmar	( struct fe_softc * );
148 
149 #ifdef DIAGNOSTIC
150 static void	fe_emptybuffer	( struct fe_softc * );
151 #endif
152 
153 /*
154  * Fe driver specific constants which relate to 86960/86965.
155  */
156 
157 /* Interrupt masks  */
158 #define FE_TMASK ( FE_D2_COLL16 | FE_D2_TXDONE )
159 #define FE_RMASK ( FE_D3_OVRFLO | FE_D3_CRCERR \
160 		 | FE_D3_ALGERR | FE_D3_SRTPKT | FE_D3_PKTRDY )
161 
162 /* Maximum number of iterations for a receive interrupt.  */
163 #define FE_MAX_RECV_COUNT ( ( 65536 - 2048 * 2 ) / 64 )
164 	/*
165 	 * Maximum size of SRAM is 65536,
166 	 * minimum size of transmission buffer in fe is 2x2KB,
167 	 * and minimum amount of received packet including headers
168 	 * added by the chip is 64 bytes.
169 	 * Hence FE_MAX_RECV_COUNT is the upper limit for number
170 	 * of packets in the receive buffer.
171 	 */
172 
173 /*
174  * Miscellaneous definitions not directly related to hardware.
175  */
176 
177 /* The following line must be delete when "net/if_media.h" support it.  */
178 #ifndef IFM_10_FL
179 #define IFM_10_FL	/* 13 */ IFM_10_5
180 #endif
181 
182 #if 0
183 /* Mapping between media bitmap (in fe_softc.mbitmap) and ifm_media.  */
184 static int const bit2media [] = {
185 			IFM_HDX | IFM_ETHER | IFM_AUTO,
186 			IFM_HDX | IFM_ETHER | IFM_MANUAL,
187 			IFM_HDX | IFM_ETHER | IFM_10_T,
188 			IFM_HDX | IFM_ETHER | IFM_10_2,
189 			IFM_HDX | IFM_ETHER | IFM_10_5,
190 			IFM_HDX | IFM_ETHER | IFM_10_FL,
191 			IFM_FDX | IFM_ETHER | IFM_10_T,
192 	/* More can be come here... */
193 			0
194 };
195 #else
196 /* Mapping between media bitmap (in fe_softc.mbitmap) and ifm_media.  */
197 static int const bit2media [] = {
198 			IFM_ETHER | IFM_AUTO,
199 			IFM_ETHER | IFM_MANUAL,
200 			IFM_ETHER | IFM_10_T,
201 			IFM_ETHER | IFM_10_2,
202 			IFM_ETHER | IFM_10_5,
203 			IFM_ETHER | IFM_10_FL,
204 			IFM_ETHER | IFM_10_T,
205 	/* More can be come here... */
206 			0
207 };
208 #endif
209 
210 /*
211  * Check for specific bits in specific registers have specific values.
212  * A common utility function called from various sub-probe routines.
213  */
214 int
215 fe_simple_probe (struct fe_softc const * sc,
216 		 struct fe_simple_probe_struct const * sp)
217 {
218 	struct fe_simple_probe_struct const *p;
219 	int8_t bits;
220 
221 	for (p  = sp; p->mask != 0; p++) {
222 	    bits = fe_inb(sc, p->port);
223  	    printf("port %d, mask %x, bits %x read %x\n", p->port,
224 	      p->mask, p->bits, bits);
225 		if ((bits & p->mask) != p->bits)
226 			return 0;
227 	}
228 	return 1;
229 }
230 
231 /* Test if a given 6 byte value is a valid Ethernet station (MAC)
232    address.  "Vendor" is an expected vendor code (first three bytes,)
233    or a zero when nothing expected.  */
234 int
235 fe_valid_Ether_p (u_char const * addr, unsigned vendor)
236 {
237 #ifdef FE_DEBUG
238 	printf("fe?: validating %6D against %06x\n", addr, ":", vendor);
239 #endif
240 
241 	/* All zero is not allowed as a vendor code.  */
242 	if (addr[0] == 0 && addr[1] == 0 && addr[2] == 0) return 0;
243 
244 	switch (vendor) {
245 	    case 0x000000:
246 		/* Legal Ethernet address (stored in ROM) must have
247 		   its Group and Local bits cleared.  */
248 		if ((addr[0] & 0x03) != 0) return 0;
249 		break;
250 	    case 0x020000:
251 		/* Same as above, but a local address is allowed in
252                    this context.  */
253 		if (ETHER_IS_MULTICAST(addr)) return 0;
254 		break;
255 	    default:
256 		/* Make sure the vendor part matches if one is given.  */
257 		if (   addr[0] != ((vendor >> 16) & 0xFF)
258 		    || addr[1] != ((vendor >>  8) & 0xFF)
259 		    || addr[2] != ((vendor      ) & 0xFF)) return 0;
260 		break;
261 	}
262 
263 	/* Host part must not be all-zeros nor all-ones.  */
264 	if (addr[3] == 0xFF && addr[4] == 0xFF && addr[5] == 0xFF) return 0;
265 	if (addr[3] == 0x00 && addr[4] == 0x00 && addr[5] == 0x00) return 0;
266 
267 	/* Given addr looks like an Ethernet address.  */
268 	return 1;
269 }
270 
271 /* Fill our softc struct with default value.  */
272 void
273 fe_softc_defaults (struct fe_softc *sc)
274 {
275 	/* Prepare for typical register prototypes.  We assume a
276            "typical" board has <32KB> of <fast> SRAM connected with a
277            <byte-wide> data lines.  */
278 	sc->proto_dlcr4 = FE_D4_LBC_DISABLE | FE_D4_CNTRL;
279 	sc->proto_dlcr5 = 0;
280 	sc->proto_dlcr6 = FE_D6_BUFSIZ_32KB | FE_D6_TXBSIZ_2x4KB
281 		| FE_D6_BBW_BYTE | FE_D6_SBW_WORD | FE_D6_SRAM_100ns;
282 	sc->proto_dlcr7 = FE_D7_BYTSWP_LH;
283 	sc->proto_bmpr13 = 0;
284 
285 	/* Assume the probe process (to be done later) is stable.  */
286 	sc->stability = 0;
287 
288 	/* A typical board needs no hooks.  */
289 	sc->init = NULL;
290 	sc->stop = NULL;
291 
292 	/* Assume the board has no software-controllable media selection.  */
293 	sc->mbitmap = MB_HM;
294 	sc->defmedia = MB_HM;
295 	sc->msel = NULL;
296 }
297 
298 /* Common error reporting routine used in probe routines for
299    "soft configured IRQ"-type boards.  */
300 void
301 fe_irq_failure (char const *name, int unit, int irq, char const *list)
302 {
303 	printf("fe%d: %s board is detected, but %s IRQ was given\n",
304 	       unit, name, (irq == NO_IRQ ? "no" : "invalid"));
305 	if (list != NULL) {
306 		printf("fe%d: specify an IRQ from %s in kernel config\n",
307 		       unit, list);
308 	}
309 }
310 
311 /*
312  * Hardware (vendor) specific hooks.
313  */
314 
315 /*
316  * Generic media selection scheme for MB86965 based boards.
317  */
318 void
319 fe_msel_965 (struct fe_softc *sc)
320 {
321 	u_char b13;
322 
323 	/* Find the appropriate bits for BMPR13 tranceiver control.  */
324 	switch (IFM_SUBTYPE(sc->media.ifm_media)) {
325 	    case IFM_AUTO: b13 = FE_B13_PORT_AUTO | FE_B13_TPTYPE_UTP; break;
326 	    case IFM_10_T: b13 = FE_B13_PORT_TP   | FE_B13_TPTYPE_UTP; break;
327 	    default:       b13 = FE_B13_PORT_AUI;  break;
328 	}
329 
330 	/* Write it into the register.  It takes effect immediately.  */
331 	fe_outb(sc, FE_BMPR13, sc->proto_bmpr13 | b13);
332 }
333 
334 
335 /*
336  * Fujitsu MB86965 JLI mode support routines.
337  */
338 
339 /*
340  * Routines to read all bytes from the config EEPROM through MB86965A.
341  * It is a MicroWire (3-wire) serial EEPROM with 6-bit address.
342  * (93C06 or 93C46.)
343  */
344 static void
345 fe_strobe_eeprom_jli (struct fe_softc *sc, u_short bmpr16)
346 {
347 	/*
348 	 * We must guarantee 1us (or more) interval to access slow
349 	 * EEPROMs.  The following redundant code provides enough
350 	 * delay with ISA timing.  (Even if the bus clock is "tuned.")
351 	 * Some modification will be needed on faster busses.
352 	 */
353 	fe_outb(sc, bmpr16, FE_B16_SELECT);
354 	fe_outb(sc, bmpr16, FE_B16_SELECT | FE_B16_CLOCK);
355 	fe_outb(sc, bmpr16, FE_B16_SELECT | FE_B16_CLOCK);
356 	fe_outb(sc, bmpr16, FE_B16_SELECT);
357 }
358 
359 void
360 fe_read_eeprom_jli (struct fe_softc * sc, u_char * data)
361 {
362 	u_char n, val, bit;
363 	u_char save16, save17;
364 
365 	/* Save the current value of the EEPROM interface registers.  */
366 	save16 = fe_inb(sc, FE_BMPR16);
367 	save17 = fe_inb(sc, FE_BMPR17);
368 
369 	/* Read bytes from EEPROM; two bytes per an iteration.  */
370 	for (n = 0; n < JLI_EEPROM_SIZE / 2; n++) {
371 
372 		/* Reset the EEPROM interface.  */
373 		fe_outb(sc, FE_BMPR16, 0x00);
374 		fe_outb(sc, FE_BMPR17, 0x00);
375 
376 		/* Start EEPROM access.  */
377 		fe_outb(sc, FE_BMPR16, FE_B16_SELECT);
378 		fe_outb(sc, FE_BMPR17, FE_B17_DATA);
379 		fe_strobe_eeprom_jli(sc, FE_BMPR16);
380 
381 		/* Pass the iteration count as well as a READ command.  */
382 		val = 0x80 | n;
383 		for (bit = 0x80; bit != 0x00; bit >>= 1) {
384 			fe_outb(sc, FE_BMPR17, (val & bit) ? FE_B17_DATA : 0);
385 			fe_strobe_eeprom_jli(sc, FE_BMPR16);
386 		}
387 		fe_outb(sc, FE_BMPR17, 0x00);
388 
389 		/* Read a byte.  */
390 		val = 0;
391 		for (bit = 0x80; bit != 0x00; bit >>= 1) {
392 			fe_strobe_eeprom_jli(sc, FE_BMPR16);
393 			if (fe_inb(sc, FE_BMPR17) & FE_B17_DATA)
394 				val |= bit;
395 		}
396 		*data++ = val;
397 
398 		/* Read one more byte.  */
399 		val = 0;
400 		for (bit = 0x80; bit != 0x00; bit >>= 1) {
401 			fe_strobe_eeprom_jli(sc, FE_BMPR16);
402 			if (fe_inb(sc, FE_BMPR17) & FE_B17_DATA)
403 				val |= bit;
404 		}
405 		*data++ = val;
406 	}
407 
408 #if 0
409 	/* Reset the EEPROM interface, again.  */
410 	fe_outb(sc, FE_BMPR16, 0x00);
411 	fe_outb(sc, FE_BMPR17, 0x00);
412 #else
413 	/* Make sure to restore the original value of EEPROM interface
414            registers, since we are not yet sure we have MB86965A on
415            the address.  */
416 	fe_outb(sc, FE_BMPR17, save17);
417 	fe_outb(sc, FE_BMPR16, save16);
418 #endif
419 
420 #if 1
421 	/* Report what we got.  */
422 	if (bootverbose) {
423 		int i;
424 		data -= JLI_EEPROM_SIZE;
425 		for (i = 0; i < JLI_EEPROM_SIZE; i += 16) {
426 			if_printf(sc->ifp,
427 			    "EEPROM(JLI):%3x: %16D\n", i, data + i, " ");
428 		}
429 	}
430 #endif
431 }
432 
433 void
434 fe_init_jli (struct fe_softc * sc)
435 {
436 	/* "Reset" by writing into a magic location.  */
437 	DELAY(200);
438 	fe_outb(sc, 0x1E, fe_inb(sc, 0x1E));
439 	DELAY(300);
440 }
441 
442 
443 /*
444  * SSi 78Q8377A support routines.
445  */
446 
447 /*
448  * Routines to read all bytes from the config EEPROM through 78Q8377A.
449  * It is a MicroWire (3-wire) serial EEPROM with 8-bit address.  (I.e.,
450  * 93C56 or 93C66.)
451  *
452  * As I don't have SSi manuals, (hmm, an old song again!) I'm not exactly
453  * sure the following code is correct...  It is just stolen from the
454  * C-NET(98)P2 support routine in FreeBSD(98).
455  */
456 
457 void
458 fe_read_eeprom_ssi (struct fe_softc *sc, u_char *data)
459 {
460 	u_char val, bit;
461 	int n;
462 	u_char save6, save7, save12;
463 
464 	/* Save the current value for the DLCR registers we are about
465            to destroy.  */
466 	save6 = fe_inb(sc, FE_DLCR6);
467 	save7 = fe_inb(sc, FE_DLCR7);
468 
469 	/* Put the 78Q8377A into a state that we can access the EEPROM.  */
470 	fe_outb(sc, FE_DLCR6,
471 	    FE_D6_BBW_WORD | FE_D6_SBW_WORD | FE_D6_DLC_DISABLE);
472 	fe_outb(sc, FE_DLCR7,
473 	    FE_D7_BYTSWP_LH | FE_D7_RBS_BMPR | FE_D7_RDYPNS | FE_D7_POWER_UP);
474 
475 	/* Save the current value for the BMPR12 register, too.  */
476 	save12 = fe_inb(sc, FE_DLCR12);
477 
478 	/* Read bytes from EEPROM; two bytes per an iteration.  */
479 	for (n = 0; n < SSI_EEPROM_SIZE / 2; n++) {
480 
481 		/* Start EEPROM access  */
482 		fe_outb(sc, FE_DLCR12, SSI_EEP);
483 		fe_outb(sc, FE_DLCR12, SSI_EEP | SSI_CSL);
484 
485 		/* Send the following four bits to the EEPROM in the
486 		   specified order: a dummy bit, a start bit, and
487 		   command bits (10) for READ.  */
488 		fe_outb(sc, FE_DLCR12, SSI_EEP | SSI_CSL                    );
489 		fe_outb(sc, FE_DLCR12, SSI_EEP | SSI_CSL | SSI_CLK          );	/* 0 */
490 		fe_outb(sc, FE_DLCR12, SSI_EEP | SSI_CSL           | SSI_DAT);
491 		fe_outb(sc, FE_DLCR12, SSI_EEP | SSI_CSL | SSI_CLK | SSI_DAT);	/* 1 */
492 		fe_outb(sc, FE_DLCR12, SSI_EEP | SSI_CSL           | SSI_DAT);
493 		fe_outb(sc, FE_DLCR12, SSI_EEP | SSI_CSL | SSI_CLK | SSI_DAT);	/* 1 */
494 		fe_outb(sc, FE_DLCR12, SSI_EEP | SSI_CSL                    );
495 		fe_outb(sc, FE_DLCR12, SSI_EEP | SSI_CSL | SSI_CLK          );	/* 0 */
496 
497 		/* Pass the iteration count to the chip.  */
498 		for (bit = 0x80; bit != 0x00; bit >>= 1) {
499 		    val = ( n & bit ) ? SSI_DAT : 0;
500 		    fe_outb(sc, FE_DLCR12, SSI_EEP | SSI_CSL           | val);
501 		    fe_outb(sc, FE_DLCR12, SSI_EEP | SSI_CSL | SSI_CLK | val);
502 		}
503 
504 		/* Read a byte.  */
505 		val = 0;
506 		for (bit = 0x80; bit != 0x00; bit >>= 1) {
507 		    fe_outb(sc, FE_DLCR12, SSI_EEP | SSI_CSL);
508 		    fe_outb(sc, FE_DLCR12, SSI_EEP | SSI_CSL | SSI_CLK);
509 		    if (fe_inb(sc, FE_DLCR12) & SSI_DIN)
510 			val |= bit;
511 		}
512 		*data++ = val;
513 
514 		/* Read one more byte.  */
515 		val = 0;
516 		for (bit = 0x80; bit != 0x00; bit >>= 1) {
517 		    fe_outb(sc, FE_DLCR12, SSI_EEP | SSI_CSL);
518 		    fe_outb(sc, FE_DLCR12, SSI_EEP | SSI_CSL | SSI_CLK);
519 		    if (fe_inb(sc, FE_DLCR12) & SSI_DIN)
520 			val |= bit;
521 		}
522 		*data++ = val;
523 
524 		fe_outb(sc, FE_DLCR12, SSI_EEP);
525 	}
526 
527 	/* Reset the EEPROM interface.  (For now.)  */
528 	fe_outb(sc, FE_DLCR12, 0x00);
529 
530 	/* Restore the saved register values, for the case that we
531            didn't have 78Q8377A at the given address.  */
532 	fe_outb(sc, FE_DLCR12, save12);
533 	fe_outb(sc, FE_DLCR7, save7);
534 	fe_outb(sc, FE_DLCR6, save6);
535 
536 #if 1
537 	/* Report what we got.  */
538 	if (bootverbose) {
539 		int i;
540 		data -= SSI_EEPROM_SIZE;
541 		for (i = 0; i < SSI_EEPROM_SIZE; i += 16) {
542 			if_printf(sc->ifp,
543 			    "EEPROM(SSI):%3x: %16D\n", i, data + i, " ");
544 		}
545 	}
546 #endif
547 }
548 
549 /*
550  * TDK/LANX boards support routines.
551  */
552 
553 /* It is assumed that the CLK line is low and SDA is high (float) upon entry.  */
554 #define LNX_PH(D,K,N) \
555 	((LNX_SDA_##D | LNX_CLK_##K) << N)
556 #define LNX_CYCLE(D1,D2,D3,D4,K1,K2,K3,K4) \
557 	(LNX_PH(D1,K1,0)|LNX_PH(D2,K2,8)|LNX_PH(D3,K3,16)|LNX_PH(D4,K4,24))
558 
559 #define LNX_CYCLE_START	LNX_CYCLE(HI,LO,LO,HI, HI,HI,LO,LO)
560 #define LNX_CYCLE_STOP	LNX_CYCLE(LO,LO,HI,HI, LO,HI,HI,LO)
561 #define LNX_CYCLE_HI	LNX_CYCLE(HI,HI,HI,HI, LO,HI,LO,LO)
562 #define LNX_CYCLE_LO	LNX_CYCLE(LO,LO,LO,HI, LO,HI,LO,LO)
563 #define LNX_CYCLE_INIT	LNX_CYCLE(LO,HI,HI,HI, LO,LO,LO,LO)
564 
565 static void
566 fe_eeprom_cycle_lnx (struct fe_softc *sc, u_short reg20, u_long cycle)
567 {
568 	fe_outb(sc, reg20, (cycle      ) & 0xFF);
569 	DELAY(15);
570 	fe_outb(sc, reg20, (cycle >>  8) & 0xFF);
571 	DELAY(15);
572 	fe_outb(sc, reg20, (cycle >> 16) & 0xFF);
573 	DELAY(15);
574 	fe_outb(sc, reg20, (cycle >> 24) & 0xFF);
575 	DELAY(15);
576 }
577 
578 static u_char
579 fe_eeprom_receive_lnx (struct fe_softc *sc, u_short reg20)
580 {
581 	u_char dat;
582 
583 	fe_outb(sc, reg20, LNX_CLK_HI | LNX_SDA_FL);
584 	DELAY(15);
585 	dat = fe_inb(sc, reg20);
586 	fe_outb(sc, reg20, LNX_CLK_LO | LNX_SDA_FL);
587 	DELAY(15);
588 	return (dat & LNX_SDA_IN);
589 }
590 
591 void
592 fe_read_eeprom_lnx (struct fe_softc *sc, u_char *data)
593 {
594 	int i;
595 	u_char n, bit, val;
596 	u_char save20;
597 	u_short reg20 = 0x14;
598 
599 	save20 = fe_inb(sc, reg20);
600 
601 	/* NOTE: DELAY() timing constants are approximately three
602            times longer (slower) than the required minimum.  This is
603            to guarantee a reliable operation under some tough
604            conditions...  Fortunately, this routine is only called
605            during the boot phase, so the speed is less important than
606            stability.  */
607 
608 #if 1
609 	/* Reset the X24C01's internal state machine and put it into
610 	   the IDLE state.  We usually don't need this, but *if*
611 	   someone (e.g., probe routine of other driver) write some
612 	   garbage into the register at 0x14, synchronization will be
613 	   lost, and the normal EEPROM access protocol won't work.
614 	   Moreover, as there are no easy way to reset, we need a
615 	   _manoeuvre_ here.  (It even lacks a reset pin, so pushing
616 	   the RESET button on the PC doesn't help!)  */
617 	fe_eeprom_cycle_lnx(sc, reg20, LNX_CYCLE_INIT);
618 	for (i = 0; i < 10; i++)
619 		fe_eeprom_cycle_lnx(sc, reg20, LNX_CYCLE_START);
620 	fe_eeprom_cycle_lnx(sc, reg20, LNX_CYCLE_STOP);
621 	DELAY(10000);
622 #endif
623 
624 	/* Issue a start condition.  */
625 	fe_eeprom_cycle_lnx(sc, reg20, LNX_CYCLE_START);
626 
627 	/* Send seven bits of the starting address (zero, in this
628 	   case) and a command bit for READ.  */
629 	val = 0x01;
630 	for (bit = 0x80; bit != 0x00; bit >>= 1) {
631 		if (val & bit) {
632 			fe_eeprom_cycle_lnx(sc, reg20, LNX_CYCLE_HI);
633 		} else {
634 			fe_eeprom_cycle_lnx(sc, reg20, LNX_CYCLE_LO);
635 		}
636 	}
637 
638 	/* Receive an ACK bit.  */
639 	if (fe_eeprom_receive_lnx(sc, reg20)) {
640 		/* ACK was not received.  EEPROM is not present (i.e.,
641 		   this board was not a TDK/LANX) or not working
642 		   properly.  */
643 		if (bootverbose) {
644 			if_printf(sc->ifp,
645 			    "no ACK received from EEPROM(LNX)\n");
646 		}
647 		/* Clear the given buffer to indicate we could not get
648                    any info. and return.  */
649 		bzero(data, LNX_EEPROM_SIZE);
650 		goto RET;
651 	}
652 
653 	/* Read bytes from EEPROM.  */
654 	for (n = 0; n < LNX_EEPROM_SIZE; n++) {
655 
656 		/* Read a byte and store it into the buffer.  */
657 		val = 0x00;
658 		for (bit = 0x80; bit != 0x00; bit >>= 1) {
659 			if (fe_eeprom_receive_lnx(sc, reg20))
660 				val |= bit;
661 		}
662 		*data++ = val;
663 
664 		/* Acknowledge if we have to read more.  */
665 		if (n < LNX_EEPROM_SIZE - 1) {
666 			fe_eeprom_cycle_lnx(sc, reg20, LNX_CYCLE_LO);
667 		}
668 	}
669 
670 	/* Issue a STOP condition, de-activating the clock line.
671 	   It will be safer to keep the clock line low than to leave
672 	   it high.  */
673 	fe_eeprom_cycle_lnx(sc, reg20, LNX_CYCLE_STOP);
674 
675     RET:
676 	fe_outb(sc, reg20, save20);
677 
678 #if 1
679 	/* Report what we got.  */
680 	if (bootverbose) {
681 		data -= LNX_EEPROM_SIZE;
682 		for (i = 0; i < LNX_EEPROM_SIZE; i += 16) {
683 			if_printf(sc->ifp,
684 			     "EEPROM(LNX):%3x: %16D\n", i, data + i, " ");
685 		}
686 	}
687 #endif
688 }
689 
690 void
691 fe_init_lnx (struct fe_softc * sc)
692 {
693 	/* Reset the 86960.  Do we need this?  FIXME.  */
694 	fe_outb(sc, 0x12, 0x06);
695 	DELAY(100);
696 	fe_outb(sc, 0x12, 0x07);
697 	DELAY(100);
698 
699 	/* Setup IRQ control register on the ASIC.  */
700 	fe_outb(sc, 0x14, sc->priv_info);
701 }
702 
703 
704 /*
705  * Ungermann-Bass boards support routine.
706  */
707 void
708 fe_init_ubn (struct fe_softc * sc)
709 {
710  	/* Do we need this?  FIXME.  */
711 	fe_outb(sc, FE_DLCR7,
712 		sc->proto_dlcr7 | FE_D7_RBS_BMPR | FE_D7_POWER_UP);
713  	fe_outb(sc, 0x18, 0x00);
714  	DELAY(200);
715 
716 	/* Setup IRQ control register on the ASIC.  */
717 	fe_outb(sc, 0x14, sc->priv_info);
718 }
719 
720 
721 /*
722  * Install interface into kernel networking data structures
723  */
724 int
725 fe_attach (device_t dev)
726 {
727 	struct fe_softc *sc = device_get_softc(dev);
728 	struct ifnet *ifp;
729 	int flags = device_get_flags(dev);
730 	int b, error;
731 
732 	ifp = sc->ifp = if_alloc(IFT_ETHER);
733 	if (ifp == NULL) {
734 		device_printf(dev, "can not ifalloc\n");
735 		fe_release_resource(dev);
736 		return (ENOSPC);
737 	}
738 
739 	mtx_init(&sc->lock, device_get_nameunit(dev), MTX_NETWORK_LOCK,
740 	    MTX_DEF);
741 	callout_init_mtx(&sc->timer, &sc->lock, 0);
742 
743 	/*
744 	 * Initialize ifnet structure
745 	 */
746  	ifp->if_softc    = sc;
747 	if_initname(sc->ifp, device_get_name(dev), device_get_unit(dev));
748 	ifp->if_start    = fe_start;
749 	ifp->if_ioctl    = fe_ioctl;
750 	ifp->if_init     = fe_init;
751 	ifp->if_linkmib  = &sc->mibdata;
752 	ifp->if_linkmiblen = sizeof (sc->mibdata);
753 
754 #if 0 /* I'm not sure... */
755 	sc->mibdata.dot3Compliance = DOT3COMPLIANCE_COLLS;
756 #endif
757 
758 	/*
759 	 * Set fixed interface flags.
760 	 */
761  	ifp->if_flags = IFF_BROADCAST | IFF_SIMPLEX | IFF_MULTICAST;
762 	IFQ_SET_MAXLEN(&ifp->if_snd, ifqmaxlen);
763 
764 #if FE_SINGLE_TRANSMISSION
765 	/* Override txb config to allocate minimum.  */
766 	sc->proto_dlcr6 &= ~FE_D6_TXBSIZ
767 	sc->proto_dlcr6 |=  FE_D6_TXBSIZ_2x2KB;
768 #endif
769 
770 	/* Modify hardware config if it is requested.  */
771 	if (flags & FE_FLAGS_OVERRIDE_DLCR6)
772 		sc->proto_dlcr6 = flags & FE_FLAGS_DLCR6_VALUE;
773 
774 	/* Find TX buffer size, based on the hardware dependent proto.  */
775 	switch (sc->proto_dlcr6 & FE_D6_TXBSIZ) {
776 	  case FE_D6_TXBSIZ_2x2KB: sc->txb_size = 2048; break;
777 	  case FE_D6_TXBSIZ_2x4KB: sc->txb_size = 4096; break;
778 	  case FE_D6_TXBSIZ_2x8KB: sc->txb_size = 8192; break;
779 	  default:
780 		/* Oops, we can't work with single buffer configuration.  */
781 		if (bootverbose) {
782 			if_printf(sc->ifp,
783 			     "strange TXBSIZ config; fixing\n");
784 		}
785 		sc->proto_dlcr6 &= ~FE_D6_TXBSIZ;
786 		sc->proto_dlcr6 |=  FE_D6_TXBSIZ_2x2KB;
787 		sc->txb_size = 2048;
788 		break;
789 	}
790 
791 	/* Initialize the if_media interface.  */
792 	ifmedia_init(&sc->media, 0, fe_medchange, fe_medstat);
793 	for (b = 0; bit2media[b] != 0; b++) {
794 		if (sc->mbitmap & (1 << b)) {
795 			ifmedia_add(&sc->media, bit2media[b], 0, NULL);
796 		}
797 	}
798 	for (b = 0; bit2media[b] != 0; b++) {
799 		if (sc->defmedia & (1 << b)) {
800 			ifmedia_set(&sc->media, bit2media[b]);
801 			break;
802 		}
803 	}
804 #if 0	/* Turned off; this is called later, when the interface UPs.  */
805 	fe_medchange(sc);
806 #endif
807 
808 	/* Attach and stop the interface. */
809 	FE_LOCK(sc);
810 	fe_stop(sc);
811 	FE_UNLOCK(sc);
812 	ether_ifattach(sc->ifp, sc->enaddr);
813 
814 	error = bus_setup_intr(dev, sc->irq_res, INTR_TYPE_NET | INTR_MPSAFE,
815 			       NULL, fe_intr, sc, &sc->irq_handle);
816 	if (error) {
817 		ether_ifdetach(ifp);
818 		mtx_destroy(&sc->lock);
819 		if_free(ifp);
820 		fe_release_resource(dev);
821 		return ENXIO;
822 	}
823 
824   	/* Print additional info when attached.  */
825  	device_printf(dev, "type %s%s\n", sc->typestr,
826 		      (sc->proto_dlcr4 & FE_D4_DSC) ? ", full duplex" : "");
827 	if (bootverbose) {
828 		int buf, txb, bbw, sbw, ram;
829 
830 		buf = txb = bbw = sbw = ram = -1;
831 		switch ( sc->proto_dlcr6 & FE_D6_BUFSIZ ) {
832 		  case FE_D6_BUFSIZ_8KB:  buf =  8; break;
833 		  case FE_D6_BUFSIZ_16KB: buf = 16; break;
834 		  case FE_D6_BUFSIZ_32KB: buf = 32; break;
835 		  case FE_D6_BUFSIZ_64KB: buf = 64; break;
836 		}
837 		switch ( sc->proto_dlcr6 & FE_D6_TXBSIZ ) {
838 		  case FE_D6_TXBSIZ_2x2KB: txb = 2; break;
839 		  case FE_D6_TXBSIZ_2x4KB: txb = 4; break;
840 		  case FE_D6_TXBSIZ_2x8KB: txb = 8; break;
841 		}
842 		switch ( sc->proto_dlcr6 & FE_D6_BBW ) {
843 		  case FE_D6_BBW_BYTE: bbw =  8; break;
844 		  case FE_D6_BBW_WORD: bbw = 16; break;
845 		}
846 		switch ( sc->proto_dlcr6 & FE_D6_SBW ) {
847 		  case FE_D6_SBW_BYTE: sbw =  8; break;
848 		  case FE_D6_SBW_WORD: sbw = 16; break;
849 		}
850 		switch ( sc->proto_dlcr6 & FE_D6_SRAM ) {
851 		  case FE_D6_SRAM_100ns: ram = 100; break;
852 		  case FE_D6_SRAM_150ns: ram = 150; break;
853 		}
854 		device_printf(dev, "SRAM %dKB %dbit %dns, TXB %dKBx2, %dbit I/O\n",
855 			      buf, bbw, ram, txb, sbw);
856 	}
857 	if (sc->stability & UNSTABLE_IRQ)
858 		device_printf(dev, "warning: IRQ number may be incorrect\n");
859 	if (sc->stability & UNSTABLE_MAC)
860 		device_printf(dev, "warning: above MAC address may be incorrect\n");
861 	if (sc->stability & UNSTABLE_TYPE)
862 		device_printf(dev, "warning: hardware type was not validated\n");
863 
864 	return 0;
865 }
866 
867 int
868 fe_alloc_port(device_t dev, int size)
869 {
870 	struct fe_softc *sc = device_get_softc(dev);
871 	struct resource *res;
872 	int rid;
873 
874 	rid = 0;
875 	res = bus_alloc_resource_anywhere(dev, SYS_RES_IOPORT, &rid,
876 					  size, RF_ACTIVE);
877 	if (res) {
878 		sc->port_used = size;
879 		sc->port_res = res;
880 		return (0);
881 	}
882 
883 	return (ENOENT);
884 }
885 
886 int
887 fe_alloc_irq(device_t dev, int flags)
888 {
889 	struct fe_softc *sc = device_get_softc(dev);
890 	struct resource *res;
891 	int rid;
892 
893 	rid = 0;
894 	res = bus_alloc_resource_any(dev, SYS_RES_IRQ, &rid, RF_ACTIVE | flags);
895 	if (res) {
896 		sc->irq_res = res;
897 		return (0);
898 	}
899 
900 	return (ENOENT);
901 }
902 
903 void
904 fe_release_resource(device_t dev)
905 {
906 	struct fe_softc *sc = device_get_softc(dev);
907 
908 	if (sc->port_res) {
909 		bus_release_resource(dev, SYS_RES_IOPORT, 0, sc->port_res);
910 		sc->port_res = NULL;
911 	}
912 	if (sc->irq_res) {
913 		bus_release_resource(dev, SYS_RES_IRQ, 0, sc->irq_res);
914 		sc->irq_res = NULL;
915 	}
916 }
917 
918 /*
919  * Reset interface, after some (hardware) trouble is deteced.
920  */
921 static void
922 fe_reset (struct fe_softc *sc)
923 {
924 	/* Record how many packets are lost by this accident.  */
925 	if_inc_counter(sc->ifp, IFCOUNTER_OERRORS, sc->txb_sched + sc->txb_count);
926 	sc->mibdata.dot3StatsInternalMacTransmitErrors++;
927 
928 	/* Put the interface into known initial state.  */
929 	fe_stop(sc);
930 	if (sc->ifp->if_flags & IFF_UP)
931 		fe_init_locked(sc);
932 }
933 
934 /*
935  * Stop everything on the interface.
936  *
937  * All buffered packets, both transmitting and receiving,
938  * if any, will be lost by stopping the interface.
939  */
940 void
941 fe_stop (struct fe_softc *sc)
942 {
943 
944 	FE_ASSERT_LOCKED(sc);
945 
946 	/* Disable interrupts.  */
947 	fe_outb(sc, FE_DLCR2, 0x00);
948 	fe_outb(sc, FE_DLCR3, 0x00);
949 
950 	/* Stop interface hardware.  */
951 	DELAY(200);
952 	fe_outb(sc, FE_DLCR6, sc->proto_dlcr6 | FE_D6_DLC_DISABLE);
953 	DELAY(200);
954 
955 	/* Clear all interrupt status.  */
956 	fe_outb(sc, FE_DLCR0, 0xFF);
957 	fe_outb(sc, FE_DLCR1, 0xFF);
958 
959 	/* Put the chip in stand-by mode.  */
960 	DELAY(200);
961 	fe_outb(sc, FE_DLCR7, sc->proto_dlcr7 | FE_D7_POWER_DOWN);
962 	DELAY(200);
963 
964 	/* Reset transmitter variables and interface flags.  */
965 	sc->ifp->if_drv_flags &= ~(IFF_DRV_OACTIVE | IFF_DRV_RUNNING);
966 	sc->tx_timeout = 0;
967 	callout_stop(&sc->timer);
968 	sc->txb_free = sc->txb_size;
969 	sc->txb_count = 0;
970 	sc->txb_sched = 0;
971 
972 	/* MAR loading can be delayed.  */
973 	sc->filter_change = 0;
974 
975 	/* Call a device-specific hook.  */
976 	if (sc->stop)
977 		sc->stop(sc);
978 }
979 
980 /*
981  * Device timeout/watchdog routine. Entered if the device neglects to
982  * generate an interrupt after a transmit has been started on it.
983  */
984 static void
985 fe_watchdog (void *arg)
986 {
987 	struct fe_softc *sc = arg;
988 
989 	FE_ASSERT_LOCKED(sc);
990 
991 	if (sc->tx_timeout && --sc->tx_timeout == 0) {
992 		struct ifnet *ifp = sc->ifp;
993 
994 		/* A "debug" message.  */
995 		if_printf(ifp, "transmission timeout (%d+%d)%s\n",
996 		    sc->txb_sched, sc->txb_count,
997 		    (ifp->if_flags & IFF_UP) ? "" : " when down");
998 		if (ifp->if_get_counter(ifp, IFCOUNTER_OPACKETS) == 0 &&
999 		    ifp->if_get_counter(ifp, IFCOUNTER_IPACKETS) == 0)
1000 			if_printf(ifp, "wrong IRQ setting in config?\n");
1001 		fe_reset(sc);
1002 	}
1003 	callout_reset(&sc->timer, hz, fe_watchdog, sc);
1004 }
1005 
1006 /*
1007  * Initialize device.
1008  */
1009 static void
1010 fe_init (void * xsc)
1011 {
1012 	struct fe_softc *sc = xsc;
1013 
1014 	FE_LOCK(sc);
1015 	fe_init_locked(sc);
1016 	FE_UNLOCK(sc);
1017 }
1018 
1019 static void
1020 fe_init_locked (struct fe_softc *sc)
1021 {
1022 
1023 	/* Start initializing 86960.  */
1024 
1025 	/* Call a hook before we start initializing the chip.  */
1026 	if (sc->init)
1027 		sc->init(sc);
1028 
1029 	/*
1030 	 * Make sure to disable the chip, also.
1031 	 * This may also help re-programming the chip after
1032 	 * hot insertion of PCMCIAs.
1033 	 */
1034 	DELAY(200);
1035 	fe_outb(sc, FE_DLCR6, sc->proto_dlcr6 | FE_D6_DLC_DISABLE);
1036 	DELAY(200);
1037 
1038 	/* Power up the chip and select register bank for DLCRs.  */
1039 	DELAY(200);
1040 	fe_outb(sc, FE_DLCR7,
1041 		sc->proto_dlcr7 | FE_D7_RBS_DLCR | FE_D7_POWER_UP);
1042 	DELAY(200);
1043 
1044 	/* Feed the station address.  */
1045 	fe_outblk(sc, FE_DLCR8, IF_LLADDR(sc->ifp), ETHER_ADDR_LEN);
1046 
1047 	/* Clear multicast address filter to receive nothing.  */
1048 	fe_outb(sc, FE_DLCR7,
1049 		sc->proto_dlcr7 | FE_D7_RBS_MAR | FE_D7_POWER_UP);
1050 	fe_outblk(sc, FE_MAR8, fe_filter_nothing.data, FE_FILTER_LEN);
1051 
1052 	/* Select the BMPR bank for runtime register access.  */
1053 	fe_outb(sc, FE_DLCR7,
1054 		sc->proto_dlcr7 | FE_D7_RBS_BMPR | FE_D7_POWER_UP);
1055 
1056 	/* Initialize registers.  */
1057 	fe_outb(sc, FE_DLCR0, 0xFF);	/* Clear all bits.  */
1058 	fe_outb(sc, FE_DLCR1, 0xFF);	/* ditto.  */
1059 	fe_outb(sc, FE_DLCR2, 0x00);
1060 	fe_outb(sc, FE_DLCR3, 0x00);
1061 	fe_outb(sc, FE_DLCR4, sc->proto_dlcr4);
1062 	fe_outb(sc, FE_DLCR5, sc->proto_dlcr5);
1063 	fe_outb(sc, FE_BMPR10, 0x00);
1064 	fe_outb(sc, FE_BMPR11, FE_B11_CTRL_SKIP | FE_B11_MODE1);
1065 	fe_outb(sc, FE_BMPR12, 0x00);
1066 	fe_outb(sc, FE_BMPR13, sc->proto_bmpr13);
1067 	fe_outb(sc, FE_BMPR14, 0x00);
1068 	fe_outb(sc, FE_BMPR15, 0x00);
1069 
1070 	/* Enable interrupts.  */
1071 	fe_outb(sc, FE_DLCR2, FE_TMASK);
1072 	fe_outb(sc, FE_DLCR3, FE_RMASK);
1073 
1074 	/* Select requested media, just before enabling DLC.  */
1075 	if (sc->msel)
1076 		sc->msel(sc);
1077 
1078 	/* Enable transmitter and receiver.  */
1079 	DELAY(200);
1080 	fe_outb(sc, FE_DLCR6, sc->proto_dlcr6 | FE_D6_DLC_ENABLE);
1081 	DELAY(200);
1082 
1083 #ifdef DIAGNOSTIC
1084 	/*
1085 	 * Make sure to empty the receive buffer.
1086 	 *
1087 	 * This may be redundant, but *if* the receive buffer were full
1088 	 * at this point, then the driver would hang.  I have experienced
1089 	 * some strange hang-up just after UP.  I hope the following
1090 	 * code solve the problem.
1091 	 *
1092 	 * I have changed the order of hardware initialization.
1093 	 * I think the receive buffer cannot have any packets at this
1094 	 * point in this version.  The following code *must* be
1095 	 * redundant now.  FIXME.
1096 	 *
1097 	 * I've heard a rumore that on some PC Card implementation of
1098 	 * 8696x, the receive buffer can have some data at this point.
1099 	 * The following message helps discovering the fact.  FIXME.
1100 	 */
1101 	if (!(fe_inb(sc, FE_DLCR5) & FE_D5_BUFEMP)) {
1102 		if_printf(sc->ifp,
1103 		    "receive buffer has some data after reset\n");
1104 		fe_emptybuffer(sc);
1105 	}
1106 
1107 	/* Do we need this here?  Actually, no.  I must be paranoia.  */
1108 	fe_outb(sc, FE_DLCR0, 0xFF);	/* Clear all bits.  */
1109 	fe_outb(sc, FE_DLCR1, 0xFF);	/* ditto.  */
1110 #endif
1111 
1112 	/* Set 'running' flag, because we are now running.   */
1113 	sc->ifp->if_drv_flags |= IFF_DRV_RUNNING;
1114 	callout_reset(&sc->timer, hz, fe_watchdog, sc);
1115 
1116 	/*
1117 	 * At this point, the interface is running properly,
1118 	 * except that it receives *no* packets.  we then call
1119 	 * fe_setmode() to tell the chip what packets to be
1120 	 * received, based on the if_flags and multicast group
1121 	 * list.  It completes the initialization process.
1122 	 */
1123 	fe_setmode(sc);
1124 
1125 #if 0
1126 	/* ...and attempt to start output queued packets.  */
1127 	/* TURNED OFF, because the semi-auto media prober wants to UP
1128            the interface keeping it idle.  The upper layer will soon
1129            start the interface anyway, and there are no significant
1130            delay.  */
1131 	fe_start_locked(sc->ifp);
1132 #endif
1133 }
1134 
1135 /*
1136  * This routine actually starts the transmission on the interface
1137  */
1138 static void
1139 fe_xmit (struct fe_softc *sc)
1140 {
1141 	/*
1142 	 * Set a timer just in case we never hear from the board again.
1143 	 * We use longer timeout for multiple packet transmission.
1144 	 * I'm not sure this timer value is appropriate.  FIXME.
1145 	 */
1146 	sc->tx_timeout = 1 + sc->txb_count;
1147 
1148 	/* Update txb variables.  */
1149 	sc->txb_sched = sc->txb_count;
1150 	sc->txb_count = 0;
1151 	sc->txb_free = sc->txb_size;
1152 	sc->tx_excolls = 0;
1153 
1154 	/* Start transmitter, passing packets in TX buffer.  */
1155 	fe_outb(sc, FE_BMPR10, sc->txb_sched | FE_B10_START);
1156 }
1157 
1158 /*
1159  * Start output on interface.
1160  * We make one assumption here:
1161  *  1) that the IFF_DRV_OACTIVE flag is checked before this code is called
1162  *     (i.e. that the output part of the interface is idle)
1163  */
1164 static void
1165 fe_start (struct ifnet *ifp)
1166 {
1167 	struct fe_softc *sc = ifp->if_softc;
1168 
1169 	FE_LOCK(sc);
1170 	fe_start_locked(ifp);
1171 	FE_UNLOCK(sc);
1172 }
1173 
1174 static void
1175 fe_start_locked (struct ifnet *ifp)
1176 {
1177 	struct fe_softc *sc = ifp->if_softc;
1178 	struct mbuf *m;
1179 
1180 #ifdef DIAGNOSTIC
1181 	/* Just a sanity check.  */
1182 	if ((sc->txb_count == 0) != (sc->txb_free == sc->txb_size)) {
1183 		/*
1184 		 * Txb_count and txb_free co-works to manage the
1185 		 * transmission buffer.  Txb_count keeps track of the
1186 		 * used potion of the buffer, while txb_free does unused
1187 		 * potion.  So, as long as the driver runs properly,
1188 		 * txb_count is zero if and only if txb_free is same
1189 		 * as txb_size (which represents whole buffer.)
1190 		 */
1191 		if_printf(ifp, "inconsistent txb variables (%d, %d)\n",
1192 			sc->txb_count, sc->txb_free);
1193 		/*
1194 		 * So, what should I do, then?
1195 		 *
1196 		 * We now know txb_count and txb_free contradicts.  We
1197 		 * cannot, however, tell which is wrong.  More
1198 		 * over, we cannot peek 86960 transmission buffer or
1199 		 * reset the transmission buffer.  (In fact, we can
1200 		 * reset the entire interface.  I don't want to do it.)
1201 		 *
1202 		 * If txb_count is incorrect, leaving it as-is will cause
1203 		 * sending of garbage after next interrupt.  We have to
1204 		 * avoid it.  Hence, we reset the txb_count here.  If
1205 		 * txb_free was incorrect, resetting txb_count just loses
1206 		 * some packets.  We can live with it.
1207 		 */
1208 		sc->txb_count = 0;
1209 	}
1210 #endif
1211 
1212 	/*
1213 	 * First, see if there are buffered packets and an idle
1214 	 * transmitter - should never happen at this point.
1215 	 */
1216 	if ((sc->txb_count > 0) && (sc->txb_sched == 0)) {
1217 		if_printf(ifp, "transmitter idle with %d buffered packets\n",
1218 		       sc->txb_count);
1219 		fe_xmit(sc);
1220 	}
1221 
1222 	/*
1223 	 * Stop accepting more transmission packets temporarily, when
1224 	 * a filter change request is delayed.  Updating the MARs on
1225 	 * 86960 flushes the transmission buffer, so it is delayed
1226 	 * until all buffered transmission packets have been sent
1227 	 * out.
1228 	 */
1229 	if (sc->filter_change) {
1230 		/*
1231 		 * Filter change request is delayed only when the DLC is
1232 		 * working.  DLC soon raise an interrupt after finishing
1233 		 * the work.
1234 		 */
1235 		goto indicate_active;
1236 	}
1237 
1238 	for (;;) {
1239 
1240 		/*
1241 		 * See if there is room to put another packet in the buffer.
1242 		 * We *could* do better job by peeking the send queue to
1243 		 * know the length of the next packet.  Current version just
1244 		 * tests against the worst case (i.e., longest packet).  FIXME.
1245 		 *
1246 		 * When adding the packet-peek feature, don't forget adding a
1247 		 * test on txb_count against QUEUEING_MAX.
1248 		 * There is a little chance the packet count exceeds
1249 		 * the limit.  Assume transmission buffer is 8KB (2x8KB
1250 		 * configuration) and an application sends a bunch of small
1251 		 * (i.e., minimum packet sized) packets rapidly.  An 8KB
1252 		 * buffer can hold 130 blocks of 62 bytes long...
1253 		 */
1254 		if (sc->txb_free
1255 		    < ETHER_MAX_LEN - ETHER_CRC_LEN + FE_DATA_LEN_LEN) {
1256 			/* No room.  */
1257 			goto indicate_active;
1258 		}
1259 
1260 #if FE_SINGLE_TRANSMISSION
1261 		if (sc->txb_count > 0) {
1262 			/* Just one packet per a transmission buffer.  */
1263 			goto indicate_active;
1264 		}
1265 #endif
1266 
1267 		/*
1268 		 * Get the next mbuf chain for a packet to send.
1269 		 */
1270 		IF_DEQUEUE(&sc->ifp->if_snd, m);
1271 		if (m == NULL) {
1272 			/* No more packets to send.  */
1273 			goto indicate_inactive;
1274 		}
1275 
1276 		/*
1277 		 * Copy the mbuf chain into the transmission buffer.
1278 		 * txb_* variables are updated as necessary.
1279 		 */
1280 		fe_write_mbufs(sc, m);
1281 
1282 		/* Start transmitter if it's idle.  */
1283 		if ((sc->txb_count > 0) && (sc->txb_sched == 0))
1284 			fe_xmit(sc);
1285 
1286 		/*
1287 		 * Tap off here if there is a bpf listener,
1288 		 * and the device is *not* in promiscuous mode.
1289 		 * (86960 receives self-generated packets if
1290 		 * and only if it is in "receive everything"
1291 		 * mode.)
1292 		 */
1293 		if (!(sc->ifp->if_flags & IFF_PROMISC))
1294 			BPF_MTAP(sc->ifp, m);
1295 
1296 		m_freem(m);
1297 	}
1298 
1299   indicate_inactive:
1300 	/*
1301 	 * We are using the !OACTIVE flag to indicate to
1302 	 * the outside world that we can accept an
1303 	 * additional packet rather than that the
1304 	 * transmitter is _actually_ active.  Indeed, the
1305 	 * transmitter may be active, but if we haven't
1306 	 * filled all the buffers with data then we still
1307 	 * want to accept more.
1308 	 */
1309 	sc->ifp->if_drv_flags &= ~IFF_DRV_OACTIVE;
1310 	return;
1311 
1312   indicate_active:
1313 	/*
1314 	 * The transmitter is active, and there are no room for
1315 	 * more outgoing packets in the transmission buffer.
1316 	 */
1317 	sc->ifp->if_drv_flags |= IFF_DRV_OACTIVE;
1318 	return;
1319 }
1320 
1321 /*
1322  * Drop (skip) a packet from receive buffer in 86960 memory.
1323  */
1324 static void
1325 fe_droppacket (struct fe_softc * sc, int len)
1326 {
1327 	int i;
1328 
1329 	/*
1330 	 * 86960 manual says that we have to read 8 bytes from the buffer
1331 	 * before skip the packets and that there must be more than 8 bytes
1332 	 * remaining in the buffer when issue a skip command.
1333 	 * Remember, we have already read 4 bytes before come here.
1334 	 */
1335 	if (len > 12) {
1336 		/* Read 4 more bytes, and skip the rest of the packet.  */
1337 		if ((sc->proto_dlcr6 & FE_D6_SBW) == FE_D6_SBW_BYTE)
1338 		{
1339 			(void) fe_inb(sc, FE_BMPR8);
1340 			(void) fe_inb(sc, FE_BMPR8);
1341 			(void) fe_inb(sc, FE_BMPR8);
1342 			(void) fe_inb(sc, FE_BMPR8);
1343 		}
1344 		else
1345 		{
1346 			(void) fe_inw(sc, FE_BMPR8);
1347 			(void) fe_inw(sc, FE_BMPR8);
1348 		}
1349 		fe_outb(sc, FE_BMPR14, FE_B14_SKIP);
1350 	} else {
1351 		/* We should not come here unless receiving RUNTs.  */
1352 		if ((sc->proto_dlcr6 & FE_D6_SBW) == FE_D6_SBW_BYTE)
1353 		{
1354 			for (i = 0; i < len; i++)
1355 				(void) fe_inb(sc, FE_BMPR8);
1356 		}
1357 		else
1358 		{
1359 			for (i = 0; i < len; i += 2)
1360 				(void) fe_inw(sc, FE_BMPR8);
1361 		}
1362 	}
1363 }
1364 
1365 #ifdef DIAGNOSTIC
1366 /*
1367  * Empty receiving buffer.
1368  */
1369 static void
1370 fe_emptybuffer (struct fe_softc * sc)
1371 {
1372 	int i;
1373 	u_char saved_dlcr5;
1374 
1375 #ifdef FE_DEBUG
1376 	if_printf(sc->ifp, "emptying receive buffer\n");
1377 #endif
1378 
1379 	/*
1380 	 * Stop receiving packets, temporarily.
1381 	 */
1382 	saved_dlcr5 = fe_inb(sc, FE_DLCR5);
1383 	fe_outb(sc, FE_DLCR5, sc->proto_dlcr5);
1384 	DELAY(1300);
1385 
1386 	/*
1387 	 * When we come here, the receive buffer management may
1388 	 * have been broken.  So, we cannot use skip operation.
1389 	 * Just discard everything in the buffer.
1390 	 */
1391 	if ((sc->proto_dlcr6 & FE_D6_SBW) == FE_D6_SBW_BYTE)
1392 	{
1393 		for (i = 0; i < 65536; i++) {
1394 			if (fe_inb(sc, FE_DLCR5) & FE_D5_BUFEMP)
1395 				break;
1396 			(void) fe_inb(sc, FE_BMPR8);
1397 		}
1398 	}
1399 	else
1400 	{
1401 		for (i = 0; i < 65536; i += 2) {
1402 			if (fe_inb(sc, FE_DLCR5) & FE_D5_BUFEMP)
1403 				break;
1404 			(void) fe_inw(sc, FE_BMPR8);
1405 		}
1406 	}
1407 
1408 	/*
1409 	 * Double check.
1410 	 */
1411 	if (fe_inb(sc, FE_DLCR5) & FE_D5_BUFEMP) {
1412 		if_printf(sc->ifp,
1413 		    "could not empty receive buffer\n");
1414 		/* Hmm.  What should I do if this happens?  FIXME.  */
1415 	}
1416 
1417 	/*
1418 	 * Restart receiving packets.
1419 	 */
1420 	fe_outb(sc, FE_DLCR5, saved_dlcr5);
1421 }
1422 #endif
1423 
1424 /*
1425  * Transmission interrupt handler
1426  * The control flow of this function looks silly.  FIXME.
1427  */
1428 static void
1429 fe_tint (struct fe_softc * sc, u_char tstat)
1430 {
1431 	int left;
1432 	int col;
1433 
1434 	/*
1435 	 * Handle "excessive collision" interrupt.
1436 	 */
1437 	if (tstat & FE_D0_COLL16) {
1438 
1439 		/*
1440 		 * Find how many packets (including this collided one)
1441 		 * are left unsent in transmission buffer.
1442 		 */
1443 		left = fe_inb(sc, FE_BMPR10);
1444 		if_printf(sc->ifp, "excessive collision (%d/%d)\n",
1445 		       left, sc->txb_sched);
1446 
1447 		/*
1448 		 * Clear the collision flag (in 86960) here
1449 		 * to avoid confusing statistics.
1450 		 */
1451 		fe_outb(sc, FE_DLCR0, FE_D0_COLLID);
1452 
1453 		/*
1454 		 * Restart transmitter, skipping the
1455 		 * collided packet.
1456 		 *
1457 		 * We *must* skip the packet to keep network running
1458 		 * properly.  Excessive collision error is an
1459 		 * indication of the network overload.  If we
1460 		 * tried sending the same packet after excessive
1461 		 * collision, the network would be filled with
1462 		 * out-of-time packets.  Packets belonging
1463 		 * to reliable transport (such as TCP) are resent
1464 		 * by some upper layer.
1465 		 */
1466 		fe_outb(sc, FE_BMPR11, FE_B11_CTRL_SKIP | FE_B11_MODE1);
1467 
1468 		/* Update statistics.  */
1469 		sc->tx_excolls++;
1470 	}
1471 
1472 	/*
1473 	 * Handle "transmission complete" interrupt.
1474 	 */
1475 	if (tstat & FE_D0_TXDONE) {
1476 
1477 		/*
1478 		 * Add in total number of collisions on last
1479 		 * transmission.  We also clear "collision occurred" flag
1480 		 * here.
1481 		 *
1482 		 * 86960 has a design flaw on collision count on multiple
1483 		 * packet transmission.  When we send two or more packets
1484 		 * with one start command (that's what we do when the
1485 		 * transmission queue is crowded), 86960 informs us number
1486 		 * of collisions occurred on the last packet on the
1487 		 * transmission only.  Number of collisions on previous
1488 		 * packets are lost.  I have told that the fact is clearly
1489 		 * stated in the Fujitsu document.
1490 		 *
1491 		 * I considered not to mind it seriously.  Collision
1492 		 * count is not so important, anyway.  Any comments?  FIXME.
1493 		 */
1494 
1495 		if (fe_inb(sc, FE_DLCR0) & FE_D0_COLLID) {
1496 
1497 			/* Clear collision flag.  */
1498 			fe_outb(sc, FE_DLCR0, FE_D0_COLLID);
1499 
1500 			/* Extract collision count from 86960.  */
1501 			col = fe_inb(sc, FE_DLCR4);
1502 			col = (col & FE_D4_COL) >> FE_D4_COL_SHIFT;
1503 			if (col == 0) {
1504 				/*
1505 				 * Status register indicates collisions,
1506 				 * while the collision count is zero.
1507 				 * This can happen after multiple packet
1508 				 * transmission, indicating that one or more
1509 				 * previous packet(s) had been collided.
1510 				 *
1511 				 * Since the accurate number of collisions
1512 				 * has been lost, we just guess it as 1;
1513 				 * Am I too optimistic?  FIXME.
1514 				 */
1515 				col = 1;
1516 			}
1517 			if_inc_counter(sc->ifp, IFCOUNTER_COLLISIONS, col);
1518 			if (col == 1)
1519 				sc->mibdata.dot3StatsSingleCollisionFrames++;
1520 			else
1521 				sc->mibdata.dot3StatsMultipleCollisionFrames++;
1522 			sc->mibdata.dot3StatsCollFrequencies[col-1]++;
1523 		}
1524 
1525 		/*
1526 		 * Update transmission statistics.
1527 		 * Be sure to reflect number of excessive collisions.
1528 		 */
1529 		col = sc->tx_excolls;
1530 		if_inc_counter(sc->ifp, IFCOUNTER_OPACKETS, sc->txb_sched - col);
1531 		if_inc_counter(sc->ifp, IFCOUNTER_OERRORS, col);
1532 		if_inc_counter(sc->ifp, IFCOUNTER_COLLISIONS, col * 16);
1533 		sc->mibdata.dot3StatsExcessiveCollisions += col;
1534 		sc->mibdata.dot3StatsCollFrequencies[15] += col;
1535 		sc->txb_sched = 0;
1536 
1537 		/*
1538 		 * The transmitter is no more active.
1539 		 * Reset output active flag and watchdog timer.
1540 		 */
1541 		sc->ifp->if_drv_flags &= ~IFF_DRV_OACTIVE;
1542 		sc->tx_timeout = 0;
1543 
1544 		/*
1545 		 * If more data is ready to transmit in the buffer, start
1546 		 * transmitting them.  Otherwise keep transmitter idle,
1547 		 * even if more data is queued.  This gives receive
1548 		 * process a slight priority.
1549 		 */
1550 		if (sc->txb_count > 0)
1551 			fe_xmit(sc);
1552 	}
1553 }
1554 
1555 /*
1556  * Ethernet interface receiver interrupt.
1557  */
1558 static void
1559 fe_rint (struct fe_softc * sc, u_char rstat)
1560 {
1561 	u_short len;
1562 	u_char status;
1563 	int i;
1564 
1565 	/*
1566 	 * Update statistics if this interrupt is caused by an error.
1567 	 * Note that, when the system was not sufficiently fast, the
1568 	 * receive interrupt might not be acknowledged immediately.  If
1569 	 * one or more errornous frames were received before this routine
1570 	 * was scheduled, they are ignored, and the following error stats
1571 	 * give less than real values.
1572 	 */
1573 	if (rstat & (FE_D1_OVRFLO | FE_D1_CRCERR | FE_D1_ALGERR | FE_D1_SRTPKT)) {
1574 		if (rstat & FE_D1_OVRFLO)
1575 			sc->mibdata.dot3StatsInternalMacReceiveErrors++;
1576 		if (rstat & FE_D1_CRCERR)
1577 			sc->mibdata.dot3StatsFCSErrors++;
1578 		if (rstat & FE_D1_ALGERR)
1579 			sc->mibdata.dot3StatsAlignmentErrors++;
1580 #if 0
1581 		/* The reference MAC receiver defined in 802.3
1582 		   silently ignores short frames (RUNTs) without
1583 		   notifying upper layer.  RFC 1650 (dot3 MIB) is
1584 		   based on the 802.3, and it has no stats entry for
1585 		   RUNTs...  */
1586 		if (rstat & FE_D1_SRTPKT)
1587 			sc->mibdata.dot3StatsFrameTooShorts++; /* :-) */
1588 #endif
1589 		if_inc_counter(sc->ifp, IFCOUNTER_IERRORS, 1);
1590 	}
1591 
1592 	/*
1593 	 * MB86960 has a flag indicating "receive queue empty."
1594 	 * We just loop, checking the flag, to pull out all received
1595 	 * packets.
1596 	 *
1597 	 * We limit the number of iterations to avoid infinite-loop.
1598 	 * The upper bound is set to unrealistic high value.
1599 	 */
1600 	for (i = 0; i < FE_MAX_RECV_COUNT * 2; i++) {
1601 
1602 		/* Stop the iteration if 86960 indicates no packets.  */
1603 		if (fe_inb(sc, FE_DLCR5) & FE_D5_BUFEMP)
1604 			return;
1605 
1606 		/*
1607 		 * Extract a receive status byte.
1608 		 * As our 86960 is in 16 bit bus access mode, we have to
1609 		 * use inw() to get the status byte.  The significant
1610 		 * value is returned in lower 8 bits.
1611 		 */
1612 		if ((sc->proto_dlcr6 & FE_D6_SBW) == FE_D6_SBW_BYTE)
1613 		{
1614 			status = fe_inb(sc, FE_BMPR8);
1615 			(void) fe_inb(sc, FE_BMPR8);
1616 		}
1617 		else
1618 		{
1619 			status = (u_char) fe_inw(sc, FE_BMPR8);
1620 		}
1621 
1622 		/*
1623 		 * Extract the packet length.
1624 		 * It is a sum of a header (14 bytes) and a payload.
1625 		 * CRC has been stripped off by the 86960.
1626 		 */
1627 		if ((sc->proto_dlcr6 & FE_D6_SBW) == FE_D6_SBW_BYTE)
1628 		{
1629 			len  =  fe_inb(sc, FE_BMPR8);
1630 			len |= (fe_inb(sc, FE_BMPR8) << 8);
1631 		}
1632 		else
1633 		{
1634 			len = fe_inw(sc, FE_BMPR8);
1635 		}
1636 
1637 		/*
1638 		 * AS our 86960 is programed to ignore errored frame,
1639 		 * we must not see any error indication in the
1640 		 * receive buffer.  So, any error condition is a
1641 		 * serious error, e.g., out-of-sync of the receive
1642 		 * buffer pointers.
1643 		 */
1644 		if ((status & 0xF0) != 0x20 ||
1645 		    len > ETHER_MAX_LEN - ETHER_CRC_LEN ||
1646 		    len < ETHER_MIN_LEN - ETHER_CRC_LEN) {
1647 			if_printf(sc->ifp,
1648 			    "RX buffer out-of-sync\n");
1649 			if_inc_counter(sc->ifp, IFCOUNTER_IERRORS, 1);
1650 			sc->mibdata.dot3StatsInternalMacReceiveErrors++;
1651 			fe_reset(sc);
1652 			return;
1653 		}
1654 
1655 		/*
1656 		 * Go get a packet.
1657 		 */
1658 		if (fe_get_packet(sc, len) < 0) {
1659 			/*
1660 			 * Negative return from fe_get_packet()
1661 			 * indicates no available mbuf.  We stop
1662 			 * receiving packets, even if there are more
1663 			 * in the buffer.  We hope we can get more
1664 			 * mbuf next time.
1665 			 */
1666 			if_inc_counter(sc->ifp, IFCOUNTER_IERRORS, 1);
1667 			sc->mibdata.dot3StatsMissedFrames++;
1668 			fe_droppacket(sc, len);
1669 			return;
1670 		}
1671 
1672 		/* Successfully received a packet.  Update stat.  */
1673 		if_inc_counter(sc->ifp, IFCOUNTER_IPACKETS, 1);
1674 	}
1675 
1676 	/* Maximum number of frames has been received.  Something
1677            strange is happening here... */
1678 	if_printf(sc->ifp, "unusual receive flood\n");
1679 	sc->mibdata.dot3StatsInternalMacReceiveErrors++;
1680 	fe_reset(sc);
1681 }
1682 
1683 /*
1684  * Ethernet interface interrupt processor
1685  */
1686 static void
1687 fe_intr (void *arg)
1688 {
1689 	struct fe_softc *sc = arg;
1690 	u_char tstat, rstat;
1691 	int loop_count = FE_MAX_LOOP;
1692 
1693 	FE_LOCK(sc);
1694 
1695 	/* Loop until there are no more new interrupt conditions.  */
1696 	while (loop_count-- > 0) {
1697 		/*
1698 		 * Get interrupt conditions, masking unneeded flags.
1699 		 */
1700 		tstat = fe_inb(sc, FE_DLCR0) & FE_TMASK;
1701 		rstat = fe_inb(sc, FE_DLCR1) & FE_RMASK;
1702 		if (tstat == 0 && rstat == 0) {
1703 			FE_UNLOCK(sc);
1704 			return;
1705 		}
1706 
1707 		/*
1708 		 * Reset the conditions we are acknowledging.
1709 		 */
1710 		fe_outb(sc, FE_DLCR0, tstat);
1711 		fe_outb(sc, FE_DLCR1, rstat);
1712 
1713 		/*
1714 		 * Handle transmitter interrupts.
1715 		 */
1716 		if (tstat)
1717 			fe_tint(sc, tstat);
1718 
1719 		/*
1720 		 * Handle receiver interrupts
1721 		 */
1722 		if (rstat)
1723 			fe_rint(sc, rstat);
1724 
1725 		/*
1726 		 * Update the multicast address filter if it is
1727 		 * needed and possible.  We do it now, because
1728 		 * we can make sure the transmission buffer is empty,
1729 		 * and there is a good chance that the receive queue
1730 		 * is empty.  It will minimize the possibility of
1731 		 * packet loss.
1732 		 */
1733 		if (sc->filter_change &&
1734 		    sc->txb_count == 0 && sc->txb_sched == 0) {
1735 			fe_loadmar(sc);
1736 			sc->ifp->if_drv_flags &= ~IFF_DRV_OACTIVE;
1737 		}
1738 
1739 		/*
1740 		 * If it looks like the transmitter can take more data,
1741 		 * attempt to start output on the interface. This is done
1742 		 * after handling the receiver interrupt to give the
1743 		 * receive operation priority.
1744 		 *
1745 		 * BTW, I'm not sure in what case the OACTIVE is on at
1746 		 * this point.  Is the following test redundant?
1747 		 *
1748 		 * No.  This routine polls for both transmitter and
1749 		 * receiver interrupts.  86960 can raise a receiver
1750 		 * interrupt when the transmission buffer is full.
1751 		 */
1752 		if ((sc->ifp->if_drv_flags & IFF_DRV_OACTIVE) == 0)
1753 			fe_start_locked(sc->ifp);
1754 	}
1755 	FE_UNLOCK(sc);
1756 
1757 	if_printf(sc->ifp, "too many loops\n");
1758 }
1759 
1760 /*
1761  * Process an ioctl request. This code needs some work - it looks
1762  * pretty ugly.
1763  */
1764 static int
1765 fe_ioctl (struct ifnet * ifp, u_long command, caddr_t data)
1766 {
1767 	struct fe_softc *sc = ifp->if_softc;
1768 	struct ifreq *ifr = (struct ifreq *)data;
1769 	int error = 0;
1770 
1771 	switch (command) {
1772 
1773 	  case SIOCSIFFLAGS:
1774 		/*
1775 		 * Switch interface state between "running" and
1776 		 * "stopped", reflecting the UP flag.
1777 		 */
1778 		FE_LOCK(sc);
1779 		if (sc->ifp->if_flags & IFF_UP) {
1780 			if ((sc->ifp->if_drv_flags & IFF_DRV_RUNNING) == 0)
1781 				fe_init_locked(sc);
1782 		} else {
1783 			if ((sc->ifp->if_drv_flags & IFF_DRV_RUNNING) != 0)
1784 				fe_stop(sc);
1785 		}
1786 
1787 		/*
1788 		 * Promiscuous and/or multicast flags may have changed,
1789 		 * so reprogram the multicast filter and/or receive mode.
1790 		 */
1791 		fe_setmode(sc);
1792 		FE_UNLOCK(sc);
1793 
1794 		/* Done.  */
1795 		break;
1796 
1797 	  case SIOCADDMULTI:
1798 	  case SIOCDELMULTI:
1799 		/*
1800 		 * Multicast list has changed; set the hardware filter
1801 		 * accordingly.
1802 		 */
1803 		FE_LOCK(sc);
1804 		fe_setmode(sc);
1805 		FE_UNLOCK(sc);
1806 		break;
1807 
1808 	  case SIOCSIFMEDIA:
1809 	  case SIOCGIFMEDIA:
1810 		/* Let if_media to handle these commands and to call
1811 		   us back.  */
1812 		error = ifmedia_ioctl(ifp, ifr, &sc->media, command);
1813 		break;
1814 
1815 	  default:
1816 		error = ether_ioctl(ifp, command, data);
1817 		break;
1818 	}
1819 
1820 	return (error);
1821 }
1822 
1823 /*
1824  * Retrieve packet from receive buffer and send to the next level up via
1825  * ether_input().
1826  * Returns 0 if success, -1 if error (i.e., mbuf allocation failure).
1827  */
1828 static int
1829 fe_get_packet (struct fe_softc * sc, u_short len)
1830 {
1831 	struct ifnet *ifp = sc->ifp;
1832 	struct ether_header *eh;
1833 	struct mbuf *m;
1834 
1835 	FE_ASSERT_LOCKED(sc);
1836 
1837 	/*
1838 	 * NFS wants the data be aligned to the word (4 byte)
1839 	 * boundary.  Ethernet header has 14 bytes.  There is a
1840 	 * 2-byte gap.
1841 	 */
1842 #define NFS_MAGIC_OFFSET 2
1843 
1844 	/*
1845 	 * This function assumes that an Ethernet packet fits in an
1846 	 * mbuf (with a cluster attached when necessary.)  On FreeBSD
1847 	 * 2.0 for x86, which is the primary target of this driver, an
1848 	 * mbuf cluster has 4096 bytes, and we are happy.  On ancient
1849 	 * BSDs, such as vanilla 4.3 for 386, a cluster size was 1024,
1850 	 * however.  If the following #error message were printed upon
1851 	 * compile, you need to rewrite this function.
1852 	 */
1853 #if ( MCLBYTES < ETHER_MAX_LEN - ETHER_CRC_LEN + NFS_MAGIC_OFFSET )
1854 #error "Too small MCLBYTES to use fe driver."
1855 #endif
1856 
1857 	/*
1858 	 * Our strategy has one more problem.  There is a policy on
1859 	 * mbuf cluster allocation.  It says that we must have at
1860 	 * least MINCLSIZE (208 bytes on FreeBSD 2.0 for x86) to
1861 	 * allocate a cluster.  For a packet of a size between
1862 	 * (MHLEN - 2) to (MINCLSIZE - 2), our code violates the rule...
1863 	 * On the other hand, the current code is short, simple,
1864 	 * and fast, however.  It does no harmful thing, just waists
1865 	 * some memory.  Any comments?  FIXME.
1866 	 */
1867 
1868 	/* Allocate an mbuf with packet header info.  */
1869 	MGETHDR(m, M_NOWAIT, MT_DATA);
1870 	if (m == NULL)
1871 		return -1;
1872 
1873 	/* Attach a cluster if this packet doesn't fit in a normal mbuf.  */
1874 	if (len > MHLEN - NFS_MAGIC_OFFSET) {
1875 		if (!(MCLGET(m, M_NOWAIT))) {
1876 			m_freem(m);
1877 			return -1;
1878 		}
1879 	}
1880 
1881 	/* Initialize packet header info.  */
1882 	m->m_pkthdr.rcvif = ifp;
1883 	m->m_pkthdr.len = len;
1884 
1885 	/* Set the length of this packet.  */
1886 	m->m_len = len;
1887 
1888 	/* The following silliness is to make NFS happy */
1889 	m->m_data += NFS_MAGIC_OFFSET;
1890 
1891 	/* Get (actually just point to) the header part.  */
1892 	eh = mtod(m, struct ether_header *);
1893 
1894 	/* Get a packet.  */
1895 	if ((sc->proto_dlcr6 & FE_D6_SBW) == FE_D6_SBW_BYTE)
1896 	{
1897 		fe_insb(sc, FE_BMPR8, (u_int8_t *)eh, len);
1898 	}
1899 	else
1900 	{
1901 		fe_insw(sc, FE_BMPR8, (u_int16_t *)eh, (len + 1) >> 1);
1902 	}
1903 
1904 	/* Feed the packet to upper layer.  */
1905 	FE_UNLOCK(sc);
1906 	(*ifp->if_input)(ifp, m);
1907 	FE_LOCK(sc);
1908 	return 0;
1909 }
1910 
1911 /*
1912  * Write an mbuf chain to the transmission buffer memory using 16 bit PIO.
1913  * Returns number of bytes actually written, including length word.
1914  *
1915  * If an mbuf chain is too long for an Ethernet frame, it is not sent.
1916  * Packets shorter than Ethernet minimum are legal, and we pad them
1917  * before sending out.  An exception is "partial" packets which are
1918  * shorter than mandatory Ethernet header.
1919  */
1920 static void
1921 fe_write_mbufs (struct fe_softc *sc, struct mbuf *m)
1922 {
1923 	u_short length, len;
1924 	struct mbuf *mp;
1925 	u_char *data;
1926 	u_short savebyte;	/* WARNING: Architecture dependent!  */
1927 #define NO_PENDING_BYTE 0xFFFF
1928 
1929 	static u_char padding [ETHER_MIN_LEN - ETHER_CRC_LEN - ETHER_HDR_LEN];
1930 
1931 #ifdef DIAGNOSTIC
1932 	/* First, count up the total number of bytes to copy */
1933 	length = 0;
1934 	for (mp = m; mp != NULL; mp = mp->m_next)
1935 		length += mp->m_len;
1936 
1937 	/* Check if this matches the one in the packet header.  */
1938 	if (length != m->m_pkthdr.len) {
1939 		if_printf(sc->ifp,
1940 		    "packet length mismatch? (%d/%d)\n",
1941 		    length, m->m_pkthdr.len);
1942 	}
1943 #else
1944 	/* Just use the length value in the packet header.  */
1945 	length = m->m_pkthdr.len;
1946 #endif
1947 
1948 #ifdef DIAGNOSTIC
1949 	/*
1950 	 * Should never send big packets.  If such a packet is passed,
1951 	 * it should be a bug of upper layer.  We just ignore it.
1952 	 * ... Partial (too short) packets, neither.
1953 	 */
1954 	if (length < ETHER_HDR_LEN ||
1955 	    length > ETHER_MAX_LEN - ETHER_CRC_LEN) {
1956 		if_printf(sc->ifp,
1957 		    "got an out-of-spec packet (%u bytes) to send\n", length);
1958 		if_inc_counter(sc->ifp, IFCOUNTER_OERRORS, 1);
1959 		sc->mibdata.dot3StatsInternalMacTransmitErrors++;
1960 		return;
1961 	}
1962 #endif
1963 
1964 	/*
1965 	 * Put the length word for this frame.
1966 	 * Does 86960 accept odd length?  -- Yes.
1967 	 * Do we need to pad the length to minimum size by ourselves?
1968 	 * -- Generally yes.  But for (or will be) the last
1969 	 * packet in the transmission buffer, we can skip the
1970 	 * padding process.  It may gain performance slightly.  FIXME.
1971 	 */
1972 	if ((sc->proto_dlcr6 & FE_D6_SBW) == FE_D6_SBW_BYTE)
1973 	{
1974 		len = max(length, ETHER_MIN_LEN - ETHER_CRC_LEN);
1975 		fe_outb(sc, FE_BMPR8,  len & 0x00ff);
1976 		fe_outb(sc, FE_BMPR8, (len & 0xff00) >> 8);
1977 	}
1978 	else
1979 	{
1980 		fe_outw(sc, FE_BMPR8,
1981 			max(length, ETHER_MIN_LEN - ETHER_CRC_LEN));
1982 	}
1983 
1984 	/*
1985 	 * Update buffer status now.
1986 	 * Truncate the length up to an even number, since we use outw().
1987 	 */
1988 	if ((sc->proto_dlcr6 & FE_D6_SBW) != FE_D6_SBW_BYTE)
1989 	{
1990 		length = (length + 1) & ~1;
1991 	}
1992 	sc->txb_free -= FE_DATA_LEN_LEN +
1993 	    max(length, ETHER_MIN_LEN - ETHER_CRC_LEN);
1994 	sc->txb_count++;
1995 
1996 	/*
1997 	 * Transfer the data from mbuf chain to the transmission buffer.
1998 	 * MB86960 seems to require that data be transferred as words, and
1999 	 * only words.  So that we require some extra code to patch
2000 	 * over odd-length mbufs.
2001 	 */
2002 	if ((sc->proto_dlcr6 & FE_D6_SBW) == FE_D6_SBW_BYTE)
2003 	{
2004 		/* 8-bit cards are easy.  */
2005 		for (mp = m; mp != NULL; mp = mp->m_next) {
2006 			if (mp->m_len)
2007 				fe_outsb(sc, FE_BMPR8, mtod(mp, caddr_t),
2008 					 mp->m_len);
2009 		}
2010 	}
2011 	else
2012 	{
2013 		/* 16-bit cards are a pain.  */
2014 		savebyte = NO_PENDING_BYTE;
2015 		for (mp = m; mp != NULL; mp = mp->m_next) {
2016 
2017 			/* Ignore empty mbuf.  */
2018 			len = mp->m_len;
2019 			if (len == 0)
2020 				continue;
2021 
2022 			/* Find the actual data to send.  */
2023 			data = mtod(mp, caddr_t);
2024 
2025 			/* Finish the last byte.  */
2026 			if (savebyte != NO_PENDING_BYTE) {
2027 				fe_outw(sc, FE_BMPR8, savebyte | (*data << 8));
2028 				data++;
2029 				len--;
2030 				savebyte = NO_PENDING_BYTE;
2031 			}
2032 
2033 			/* output contiguous words */
2034 			if (len > 1) {
2035 				fe_outsw(sc, FE_BMPR8, (u_int16_t *)data,
2036 					 len >> 1);
2037 				data += len & ~1;
2038 				len &= 1;
2039 			}
2040 
2041 			/* Save a remaining byte, if there is one.  */
2042 			if (len > 0)
2043 				savebyte = *data;
2044 		}
2045 
2046 		/* Spit the last byte, if the length is odd.  */
2047 		if (savebyte != NO_PENDING_BYTE)
2048 			fe_outw(sc, FE_BMPR8, savebyte);
2049 	}
2050 
2051 	/* Pad to the Ethernet minimum length, if the packet is too short.  */
2052 	if (length < ETHER_MIN_LEN - ETHER_CRC_LEN) {
2053 		if ((sc->proto_dlcr6 & FE_D6_SBW) == FE_D6_SBW_BYTE)
2054 		{
2055 			fe_outsb(sc, FE_BMPR8, padding,
2056 				 ETHER_MIN_LEN - ETHER_CRC_LEN - length);
2057 		}
2058 		else
2059 		{
2060 			fe_outsw(sc, FE_BMPR8, (u_int16_t *)padding,
2061 				 (ETHER_MIN_LEN - ETHER_CRC_LEN - length) >> 1);
2062 		}
2063 	}
2064 }
2065 
2066 /*
2067  * Compute the multicast address filter from the
2068  * list of multicast addresses we need to listen to.
2069  */
2070 static struct fe_filter
2071 fe_mcaf ( struct fe_softc *sc )
2072 {
2073 	int index;
2074 	struct fe_filter filter;
2075 	struct ifmultiaddr *ifma;
2076 
2077 	filter = fe_filter_nothing;
2078 	if_maddr_rlock(sc->ifp);
2079 	CK_STAILQ_FOREACH(ifma, &sc->ifp->if_multiaddrs, ifma_link) {
2080 		if (ifma->ifma_addr->sa_family != AF_LINK)
2081 			continue;
2082 		index = ether_crc32_le(LLADDR((struct sockaddr_dl *)
2083 		    ifma->ifma_addr), ETHER_ADDR_LEN) >> 26;
2084 #ifdef FE_DEBUG
2085 		if_printf(sc->ifp, "hash(%6D) == %d\n",
2086 			enm->enm_addrlo , ":", index);
2087 #endif
2088 
2089 		filter.data[index >> 3] |= 1 << (index & 7);
2090 	}
2091 	if_maddr_runlock(sc->ifp);
2092 	return ( filter );
2093 }
2094 
2095 /*
2096  * Calculate a new "multicast packet filter" and put the 86960
2097  * receiver in appropriate mode.
2098  */
2099 static void
2100 fe_setmode (struct fe_softc *sc)
2101 {
2102 
2103 	/*
2104 	 * If the interface is not running, we postpone the update
2105 	 * process for receive modes and multicast address filter
2106 	 * until the interface is restarted.  It reduces some
2107 	 * complicated job on maintaining chip states.  (Earlier versions
2108 	 * of this driver had a bug on that point...)
2109 	 *
2110 	 * To complete the trick, fe_init() calls fe_setmode() after
2111 	 * restarting the interface.
2112 	 */
2113 	if (!(sc->ifp->if_drv_flags & IFF_DRV_RUNNING))
2114 		return;
2115 
2116 	/*
2117 	 * Promiscuous mode is handled separately.
2118 	 */
2119 	if (sc->ifp->if_flags & IFF_PROMISC) {
2120 		/*
2121 		 * Program 86960 to receive all packets on the segment
2122 		 * including those directed to other stations.
2123 		 * Multicast filter stored in MARs are ignored
2124 		 * under this setting, so we don't need to update it.
2125 		 *
2126 		 * Promiscuous mode in FreeBSD 2 is used solely by
2127 		 * BPF, and BPF only listens to valid (no error) packets.
2128 		 * So, we ignore erroneous ones even in this mode.
2129 		 * (Older versions of fe driver mistook the point.)
2130 		 */
2131 		fe_outb(sc, FE_DLCR5,
2132 			sc->proto_dlcr5 | FE_D5_AFM0 | FE_D5_AFM1);
2133 		sc->filter_change = 0;
2134 		return;
2135 	}
2136 
2137 	/*
2138 	 * Turn the chip to the normal (non-promiscuous) mode.
2139 	 */
2140 	fe_outb(sc, FE_DLCR5, sc->proto_dlcr5 | FE_D5_AFM1);
2141 
2142 	/*
2143 	 * Find the new multicast filter value.
2144 	 */
2145 	if (sc->ifp->if_flags & IFF_ALLMULTI)
2146 		sc->filter = fe_filter_all;
2147 	else
2148 		sc->filter = fe_mcaf(sc);
2149 	sc->filter_change = 1;
2150 
2151 	/*
2152 	 * We have to update the multicast filter in the 86960, A.S.A.P.
2153 	 *
2154 	 * Note that the DLC (Data Link Control unit, i.e. transmitter
2155 	 * and receiver) must be stopped when feeding the filter, and
2156 	 * DLC trashes all packets in both transmission and receive
2157 	 * buffers when stopped.
2158 	 *
2159 	 * To reduce the packet loss, we delay the filter update
2160 	 * process until buffers are empty.
2161 	 */
2162 	if (sc->txb_sched == 0 && sc->txb_count == 0 &&
2163 	    !(fe_inb(sc, FE_DLCR1) & FE_D1_PKTRDY)) {
2164 		/*
2165 		 * Buffers are (apparently) empty.  Load
2166 		 * the new filter value into MARs now.
2167 		 */
2168 		fe_loadmar(sc);
2169 	} else {
2170 		/*
2171 		 * Buffers are not empty.  Mark that we have to update
2172 		 * the MARs.  The new filter will be loaded by feintr()
2173 		 * later.
2174 		 */
2175 	}
2176 }
2177 
2178 /*
2179  * Load a new multicast address filter into MARs.
2180  *
2181  * The caller must have acquired the softc lock before fe_loadmar.
2182  * This function starts the DLC upon return.  So it can be called only
2183  * when the chip is working, i.e., from the driver's point of view, when
2184  * a device is RUNNING.  (I mistook the point in previous versions.)
2185  */
2186 static void
2187 fe_loadmar (struct fe_softc * sc)
2188 {
2189 	/* Stop the DLC (transmitter and receiver).  */
2190 	DELAY(200);
2191 	fe_outb(sc, FE_DLCR6, sc->proto_dlcr6 | FE_D6_DLC_DISABLE);
2192 	DELAY(200);
2193 
2194 	/* Select register bank 1 for MARs.  */
2195 	fe_outb(sc, FE_DLCR7, sc->proto_dlcr7 | FE_D7_RBS_MAR | FE_D7_POWER_UP);
2196 
2197 	/* Copy filter value into the registers.  */
2198 	fe_outblk(sc, FE_MAR8, sc->filter.data, FE_FILTER_LEN);
2199 
2200 	/* Restore the bank selection for BMPRs (i.e., runtime registers).  */
2201 	fe_outb(sc, FE_DLCR7,
2202 		sc->proto_dlcr7 | FE_D7_RBS_BMPR | FE_D7_POWER_UP);
2203 
2204 	/* Restart the DLC.  */
2205 	DELAY(200);
2206 	fe_outb(sc, FE_DLCR6, sc->proto_dlcr6 | FE_D6_DLC_ENABLE);
2207 	DELAY(200);
2208 
2209 	/* We have just updated the filter.  */
2210 	sc->filter_change = 0;
2211 }
2212 
2213 /* Change the media selection.  */
2214 static int
2215 fe_medchange (struct ifnet *ifp)
2216 {
2217 	struct fe_softc *sc = (struct fe_softc *)ifp->if_softc;
2218 
2219 #ifdef DIAGNOSTIC
2220 	/* If_media should not pass any request for a media which this
2221 	   interface doesn't support.  */
2222 	int b;
2223 
2224 	for (b = 0; bit2media[b] != 0; b++) {
2225 		if (bit2media[b] == sc->media.ifm_media) break;
2226 	}
2227 	if (((1 << b) & sc->mbitmap) == 0) {
2228 		if_printf(sc->ifp,
2229 		    "got an unsupported media request (0x%x)\n",
2230 		    sc->media.ifm_media);
2231 		return EINVAL;
2232 	}
2233 #endif
2234 
2235 	/* We don't actually change media when the interface is down.
2236 	   fe_init() will do the job, instead.  Should we also wait
2237 	   until the transmission buffer being empty?  Changing the
2238 	   media when we are sending a frame will cause two garbages
2239 	   on wires, one on old media and another on new.  FIXME */
2240 	FE_LOCK(sc);
2241 	if (sc->ifp->if_flags & IFF_UP) {
2242 		if (sc->msel) sc->msel(sc);
2243 	}
2244 	FE_UNLOCK(sc);
2245 
2246 	return 0;
2247 }
2248 
2249 /* I don't know how I can support media status callback... FIXME.  */
2250 static void
2251 fe_medstat (struct ifnet *ifp, struct ifmediareq *ifmr)
2252 {
2253 	struct fe_softc *sc = ifp->if_softc;
2254 
2255 	ifmr->ifm_active = sc->media.ifm_media;
2256 }
2257