xref: /freebsd-12.1/sys/dev/txp/if_txp.c (revision 8dcd2ed3)
1 /*	$OpenBSD: if_txp.c,v 1.48 2001/06/27 06:34:50 kjc Exp $	*/
2 
3 /*-
4  * SPDX-License-Identifier: BSD-4-Clause
5  *
6  * Copyright (c) 2001
7  *	Jason L. Wright <[email protected]>, Theo de Raadt, and
8  *	Aaron Campbell <[email protected]>.  All rights reserved.
9  *
10  * Redistribution and use in source and binary forms, with or without
11  * modification, are permitted provided that the following conditions
12  * are met:
13  * 1. Redistributions of source code must retain the above copyright
14  *    notice, this list of conditions and the following disclaimer.
15  * 2. Redistributions in binary form must reproduce the above copyright
16  *    notice, this list of conditions and the following disclaimer in the
17  *    documentation and/or other materials provided with the distribution.
18  * 3. All advertising materials mentioning features or use of this software
19  *    must display the following acknowledgement:
20  *	This product includes software developed by Jason L. Wright,
21  *	Theo de Raadt and Aaron Campbell.
22  * 4. Neither the name of the author nor the names of any co-contributors
23  *    may be used to endorse or promote products derived from this software
24  *    without specific prior written permission.
25  *
26  * THIS SOFTWARE IS PROVIDED BY THE AUTHORS ``AS IS'' AND ANY EXPRESS OR
27  * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
28  * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
29  * ARE DISCLAIMED.  IN NO EVENT SHALL Bill Paul OR THE VOICES IN HIS HEAD
30  * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
31  * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
32  * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
33  * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
34  * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
35  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
36  * THE POSSIBILITY OF SUCH DAMAGE.
37  */
38 
39 #include <sys/cdefs.h>
40 __FBSDID("$FreeBSD$");
41 
42 /*
43  * Driver for 3c990 (Typhoon) Ethernet ASIC
44  */
45 #include <sys/param.h>
46 #include <sys/systm.h>
47 #include <sys/bus.h>
48 #include <sys/endian.h>
49 #include <sys/kernel.h>
50 #include <sys/lock.h>
51 #include <sys/malloc.h>
52 #include <sys/mbuf.h>
53 #include <sys/module.h>
54 #include <sys/mutex.h>
55 #include <sys/queue.h>
56 #include <sys/rman.h>
57 #include <sys/socket.h>
58 #include <sys/sockio.h>
59 #include <sys/sysctl.h>
60 #include <sys/taskqueue.h>
61 
62 #include <net/bpf.h>
63 #include <net/if.h>
64 #include <net/if_var.h>
65 #include <net/if_arp.h>
66 #include <net/ethernet.h>
67 #include <net/if_dl.h>
68 #include <net/if_media.h>
69 #include <net/if_types.h>
70 #include <net/if_vlan_var.h>
71 
72 #include <netinet/in.h>
73 #include <netinet/in_systm.h>
74 #include <netinet/ip.h>
75 
76 #include <dev/mii/mii.h>
77 
78 #include <dev/pci/pcireg.h>
79 #include <dev/pci/pcivar.h>
80 
81 #include <machine/bus.h>
82 #include <machine/in_cksum.h>
83 
84 #include <dev/txp/if_txpreg.h>
85 #include <dev/txp/3c990img.h>
86 
87 MODULE_DEPEND(txp, pci, 1, 1, 1);
88 MODULE_DEPEND(txp, ether, 1, 1, 1);
89 
90 /*
91  * XXX Known Typhoon firmware issues.
92  *
93  * 1. It seems that firmware has Tx TCP/UDP checksum offloading bug.
94  *    The firmware hangs when it's told to compute TCP/UDP checksum.
95  *    I'm not sure whether the firmware requires special alignment to
96  *    do checksum offloading but datasheet says nothing about that.
97  * 2. Datasheet says nothing for maximum number of fragmented
98  *    descriptors supported. Experimentation shows up to 16 fragment
99  *    descriptors are supported in the firmware. For TSO case, upper
100  *    stack can send 64KB sized IP datagram plus link header size(
101  *    ethernet header + VLAN tag)  frame but controller can handle up
102  *    to 64KB frame given that PAGE_SIZE is 4KB(i.e. 16 * PAGE_SIZE).
103  *    Because frames that need TSO operation of hardware can be
104  *    larger than 64KB I disabled TSO capability. TSO operation for
105  *    less than or equal to 16 fragment descriptors works without
106  *    problems, though.
107  * 3. VLAN hardware tag stripping is always enabled in the firmware
108  *    even if it's explicitly told to not strip the tag. It's
109  *    possible to add the tag back in Rx handler if VLAN hardware
110  *    tag is not active but I didn't try that as it would be
111  *    layering violation.
112  * 4. TXP_CMD_RECV_BUFFER_CONTROL does not work as expected in
113  *    datasheet such that driver should handle the alignment
114  *    restriction by copying received frame to align the frame on
115  *    32bit boundary on strict-alignment architectures. This adds a
116  *    lot of CPU burden and it effectively reduce Rx performance on
117  *    strict-alignment architectures(e.g. sparc64, arm and mips).
118  *
119  * Unfortunately it seems that 3Com have no longer interests in
120  * releasing fixed firmware so we may have to live with these bugs.
121  */
122 
123 #define	TXP_CSUM_FEATURES	(CSUM_IP)
124 
125 /*
126  * Various supported device vendors/types and their names.
127  */
128 static struct txp_type txp_devs[] = {
129 	{ TXP_VENDORID_3COM, TXP_DEVICEID_3CR990_TX_95,
130 	    "3Com 3cR990-TX-95 Etherlink with 3XP Processor" },
131 	{ TXP_VENDORID_3COM, TXP_DEVICEID_3CR990_TX_97,
132 	    "3Com 3cR990-TX-97 Etherlink with 3XP Processor" },
133 	{ TXP_VENDORID_3COM, TXP_DEVICEID_3CR990B_TXM,
134 	    "3Com 3cR990B-TXM Etherlink with 3XP Processor" },
135 	{ TXP_VENDORID_3COM, TXP_DEVICEID_3CR990_SRV_95,
136 	    "3Com 3cR990-SRV-95 Etherlink Server with 3XP Processor" },
137 	{ TXP_VENDORID_3COM, TXP_DEVICEID_3CR990_SRV_97,
138 	    "3Com 3cR990-SRV-97 Etherlink Server with 3XP Processor" },
139 	{ TXP_VENDORID_3COM, TXP_DEVICEID_3CR990B_SRV,
140 	    "3Com 3cR990B-SRV Etherlink Server with 3XP Processor" },
141 	{ 0, 0, NULL }
142 };
143 
144 static int txp_probe(device_t);
145 static int txp_attach(device_t);
146 static int txp_detach(device_t);
147 static int txp_shutdown(device_t);
148 static int txp_suspend(device_t);
149 static int txp_resume(device_t);
150 static int txp_intr(void *);
151 static void txp_int_task(void *, int);
152 static void txp_tick(void *);
153 static int txp_ioctl(struct ifnet *, u_long, caddr_t);
154 static uint64_t txp_get_counter(struct ifnet *, ift_counter);
155 static void txp_start(struct ifnet *);
156 static void txp_start_locked(struct ifnet *);
157 static int txp_encap(struct txp_softc *, struct txp_tx_ring *, struct mbuf **);
158 static void txp_stop(struct txp_softc *);
159 static void txp_init(void *);
160 static void txp_init_locked(struct txp_softc *);
161 static void txp_watchdog(struct txp_softc *);
162 
163 static int txp_reset(struct txp_softc *);
164 static int txp_boot(struct txp_softc *, uint32_t);
165 static int txp_sleep(struct txp_softc *, int);
166 static int txp_wait(struct txp_softc *, uint32_t);
167 static int txp_download_fw(struct txp_softc *);
168 static int txp_download_fw_wait(struct txp_softc *);
169 static int txp_download_fw_section(struct txp_softc *,
170     struct txp_fw_section_header *, int);
171 static int txp_alloc_rings(struct txp_softc *);
172 static void txp_init_rings(struct txp_softc *);
173 static int txp_dma_alloc(struct txp_softc *, char *, bus_dma_tag_t *,
174     bus_size_t, bus_size_t, bus_dmamap_t *, void **, bus_size_t, bus_addr_t *);
175 static void txp_dma_free(struct txp_softc *, bus_dma_tag_t *, bus_dmamap_t,
176     void **, bus_addr_t *);
177 static void txp_free_rings(struct txp_softc *);
178 static int txp_rxring_fill(struct txp_softc *);
179 static void txp_rxring_empty(struct txp_softc *);
180 static void txp_set_filter(struct txp_softc *);
181 
182 static int txp_cmd_desc_numfree(struct txp_softc *);
183 static int txp_command(struct txp_softc *, uint16_t, uint16_t, uint32_t,
184     uint32_t, uint16_t *, uint32_t *, uint32_t *, int);
185 static int txp_ext_command(struct txp_softc *, uint16_t, uint16_t,
186     uint32_t, uint32_t, struct txp_ext_desc *, uint8_t,
187     struct txp_rsp_desc **, int);
188 static int txp_response(struct txp_softc *, uint16_t, uint16_t,
189     struct txp_rsp_desc **);
190 static void txp_rsp_fixup(struct txp_softc *, struct txp_rsp_desc *,
191     struct txp_rsp_desc *);
192 static int txp_set_capabilities(struct txp_softc *);
193 
194 static void txp_ifmedia_sts(struct ifnet *, struct ifmediareq *);
195 static int txp_ifmedia_upd(struct ifnet *);
196 #ifdef TXP_DEBUG
197 static void txp_show_descriptor(void *);
198 #endif
199 static void txp_tx_reclaim(struct txp_softc *, struct txp_tx_ring *);
200 static void txp_rxbuf_reclaim(struct txp_softc *);
201 #ifndef __NO_STRICT_ALIGNMENT
202 static __inline void txp_fixup_rx(struct mbuf *);
203 #endif
204 static int txp_rx_reclaim(struct txp_softc *, struct txp_rx_ring *, int);
205 static void txp_stats_save(struct txp_softc *);
206 static void txp_stats_update(struct txp_softc *, struct txp_rsp_desc *);
207 static void txp_sysctl_node(struct txp_softc *);
208 static int sysctl_int_range(SYSCTL_HANDLER_ARGS, int, int);
209 static int sysctl_hw_txp_proc_limit(SYSCTL_HANDLER_ARGS);
210 
211 static int prefer_iomap = 0;
212 TUNABLE_INT("hw.txp.prefer_iomap", &prefer_iomap);
213 
214 static device_method_t txp_methods[] = {
215         /* Device interface */
216 	DEVMETHOD(device_probe,		txp_probe),
217 	DEVMETHOD(device_attach,	txp_attach),
218 	DEVMETHOD(device_detach,	txp_detach),
219 	DEVMETHOD(device_shutdown,	txp_shutdown),
220 	DEVMETHOD(device_suspend,	txp_suspend),
221 	DEVMETHOD(device_resume,	txp_resume),
222 
223 	{ NULL, NULL }
224 };
225 
226 static driver_t txp_driver = {
227 	"txp",
228 	txp_methods,
229 	sizeof(struct txp_softc)
230 };
231 
232 static devclass_t txp_devclass;
233 
234 DRIVER_MODULE(txp, pci, txp_driver, txp_devclass, 0, 0);
235 
236 static int
237 txp_probe(device_t dev)
238 {
239 	struct txp_type *t;
240 
241 	t = txp_devs;
242 
243 	while (t->txp_name != NULL) {
244 		if ((pci_get_vendor(dev) == t->txp_vid) &&
245 		    (pci_get_device(dev) == t->txp_did)) {
246 			device_set_desc(dev, t->txp_name);
247 			return (BUS_PROBE_DEFAULT);
248 		}
249 		t++;
250 	}
251 
252 	return (ENXIO);
253 }
254 
255 static int
256 txp_attach(device_t dev)
257 {
258 	struct txp_softc *sc;
259 	struct ifnet *ifp;
260 	struct txp_rsp_desc *rsp;
261 	uint16_t p1;
262 	uint32_t p2, reg;
263 	int error = 0, pmc, rid;
264 	uint8_t eaddr[ETHER_ADDR_LEN], *ver;
265 
266 	sc = device_get_softc(dev);
267 	sc->sc_dev = dev;
268 
269 	mtx_init(&sc->sc_mtx, device_get_nameunit(dev), MTX_NETWORK_LOCK,
270 	    MTX_DEF);
271 	callout_init_mtx(&sc->sc_tick, &sc->sc_mtx, 0);
272 	TASK_INIT(&sc->sc_int_task, 0, txp_int_task, sc);
273 	TAILQ_INIT(&sc->sc_busy_list);
274 	TAILQ_INIT(&sc->sc_free_list);
275 
276 	ifmedia_init(&sc->sc_ifmedia, 0, txp_ifmedia_upd, txp_ifmedia_sts);
277 	ifmedia_add(&sc->sc_ifmedia, IFM_ETHER | IFM_10_T, 0, NULL);
278 	ifmedia_add(&sc->sc_ifmedia, IFM_ETHER | IFM_10_T | IFM_HDX, 0, NULL);
279 	ifmedia_add(&sc->sc_ifmedia, IFM_ETHER | IFM_10_T | IFM_FDX, 0, NULL);
280 	ifmedia_add(&sc->sc_ifmedia, IFM_ETHER | IFM_100_TX, 0, NULL);
281 	ifmedia_add(&sc->sc_ifmedia, IFM_ETHER | IFM_100_TX | IFM_HDX, 0, NULL);
282 	ifmedia_add(&sc->sc_ifmedia, IFM_ETHER | IFM_100_TX | IFM_FDX, 0, NULL);
283 	ifmedia_add(&sc->sc_ifmedia, IFM_ETHER | IFM_AUTO, 0, NULL);
284 
285 	pci_enable_busmaster(dev);
286 	/* Prefer memory space register mapping over IO space. */
287 	if (prefer_iomap == 0) {
288 		sc->sc_res_id = PCIR_BAR(1);
289 		sc->sc_res_type = SYS_RES_MEMORY;
290 	} else {
291 		sc->sc_res_id = PCIR_BAR(0);
292 		sc->sc_res_type = SYS_RES_IOPORT;
293 	}
294 	sc->sc_res = bus_alloc_resource_any(dev, sc->sc_res_type,
295 	    &sc->sc_res_id, RF_ACTIVE);
296 	if (sc->sc_res == NULL && prefer_iomap == 0) {
297 		sc->sc_res_id = PCIR_BAR(0);
298 		sc->sc_res_type = SYS_RES_IOPORT;
299 		sc->sc_res = bus_alloc_resource_any(dev, sc->sc_res_type,
300 		    &sc->sc_res_id, RF_ACTIVE);
301 	}
302 	if (sc->sc_res == NULL) {
303 		device_printf(dev, "couldn't map ports/memory\n");
304 		ifmedia_removeall(&sc->sc_ifmedia);
305 		mtx_destroy(&sc->sc_mtx);
306 		return (ENXIO);
307 	}
308 
309 	/* Enable MWI. */
310 	reg = pci_read_config(dev, PCIR_COMMAND, 2);
311 	reg |= PCIM_CMD_MWRICEN;
312 	pci_write_config(dev, PCIR_COMMAND, reg, 2);
313 	/* Check cache line size. */
314 	reg = pci_read_config(dev, PCIR_CACHELNSZ, 1);
315 	reg <<= 4;
316 	if (reg == 0 || (reg % 16) != 0)
317 		device_printf(sc->sc_dev,
318 		    "invalid cache line size : %u\n", reg);
319 
320 	/* Allocate interrupt */
321 	rid = 0;
322 	sc->sc_irq = bus_alloc_resource_any(dev, SYS_RES_IRQ, &rid,
323 	    RF_SHAREABLE | RF_ACTIVE);
324 
325 	if (sc->sc_irq == NULL) {
326 		device_printf(dev, "couldn't map interrupt\n");
327 		error = ENXIO;
328 		goto fail;
329 	}
330 
331 	if ((error = txp_alloc_rings(sc)) != 0)
332 		goto fail;
333 	txp_init_rings(sc);
334 	txp_sysctl_node(sc);
335 	/* Reset controller and make it reload sleep image. */
336 	if (txp_reset(sc) != 0) {
337 		error = ENXIO;
338 		goto fail;
339 	}
340 
341 	/* Let controller boot from sleep image. */
342 	if (txp_boot(sc, STAT_WAITING_FOR_HOST_REQUEST) != 0) {
343 		device_printf(sc->sc_dev, "could not boot sleep image\n");
344 		error = ENXIO;
345 		goto fail;
346 	}
347 
348 	/* Get station address. */
349 	if (txp_command(sc, TXP_CMD_STATION_ADDRESS_READ, 0, 0, 0,
350 	    &p1, &p2, NULL, TXP_CMD_WAIT)) {
351 		error = ENXIO;
352 		goto fail;
353 	}
354 
355 	p1 = le16toh(p1);
356 	eaddr[0] = ((uint8_t *)&p1)[1];
357 	eaddr[1] = ((uint8_t *)&p1)[0];
358 	p2 = le32toh(p2);
359 	eaddr[2] = ((uint8_t *)&p2)[3];
360 	eaddr[3] = ((uint8_t *)&p2)[2];
361 	eaddr[4] = ((uint8_t *)&p2)[1];
362 	eaddr[5] = ((uint8_t *)&p2)[0];
363 
364 	ifp = sc->sc_ifp = if_alloc(IFT_ETHER);
365 	if (ifp == NULL) {
366 		device_printf(dev, "can not allocate ifnet structure\n");
367 		error = ENOSPC;
368 		goto fail;
369 	}
370 
371 	/*
372 	 * Show sleep image version information which may help to
373 	 * diagnose sleep image specific issues.
374 	 */
375 	rsp = NULL;
376 	if (txp_ext_command(sc, TXP_CMD_VERSIONS_READ, 0, 0, 0, NULL, 0,
377 	    &rsp, TXP_CMD_WAIT)) {
378 		device_printf(dev, "can not read sleep image version\n");
379 		error = ENXIO;
380 		goto fail;
381 	}
382 	if (rsp->rsp_numdesc == 0) {
383 		p2 = le32toh(rsp->rsp_par2) & 0xFFFF;
384 		device_printf(dev, "Typhoon 1.0 sleep image (2000/%02u/%02u)\n",
385 		    p2 >> 8, p2 & 0xFF);
386 	} else if (rsp->rsp_numdesc == 2) {
387 		p2 = le32toh(rsp->rsp_par2);
388 		ver = (uint8_t *)(rsp + 1);
389 		/*
390 		 * Even if datasheet says the command returns a NULL
391 		 * terminated version string, explicitly terminate
392 		 * the string. Given that several bugs of firmware
393 		 * I can't trust this simple one.
394 		 */
395 		ver[25] = '\0';
396 		device_printf(dev,
397 		    "Typhoon 1.1+ sleep image %02u.%03u.%03u %s\n",
398 		    p2 >> 24, (p2 >> 12) & 0xFFF, p2 & 0xFFF, ver);
399 	} else {
400 		p2 = le32toh(rsp->rsp_par2);
401 		device_printf(dev,
402 		    "Unknown Typhoon sleep image version: %u:0x%08x\n",
403 		    rsp->rsp_numdesc, p2);
404 	}
405 	free(rsp, M_DEVBUF);
406 
407 	sc->sc_xcvr = TXP_XCVR_AUTO;
408 	txp_command(sc, TXP_CMD_XCVR_SELECT, TXP_XCVR_AUTO, 0, 0,
409 	    NULL, NULL, NULL, TXP_CMD_NOWAIT);
410 	ifmedia_set(&sc->sc_ifmedia, IFM_ETHER | IFM_AUTO);
411 
412 	ifp->if_softc = sc;
413 	if_initname(ifp, device_get_name(dev), device_get_unit(dev));
414 	ifp->if_flags = IFF_BROADCAST | IFF_SIMPLEX | IFF_MULTICAST;
415 	ifp->if_ioctl = txp_ioctl;
416 	ifp->if_start = txp_start;
417 	ifp->if_init = txp_init;
418 	ifp->if_get_counter = txp_get_counter;
419 	ifp->if_snd.ifq_drv_maxlen = TX_ENTRIES - 1;
420 	IFQ_SET_MAXLEN(&ifp->if_snd, ifp->if_snd.ifq_drv_maxlen);
421 	IFQ_SET_READY(&ifp->if_snd);
422 	/*
423 	 * It's possible to read firmware's offload capability but
424 	 * we have not downloaded the firmware yet so announce
425 	 * working capability here. We're not interested in IPSec
426 	 * capability and due to the lots of firmware bug we can't
427 	 * advertise the whole capability anyway.
428 	 */
429 	ifp->if_capabilities = IFCAP_RXCSUM | IFCAP_TXCSUM;
430 	if (pci_find_cap(dev, PCIY_PMG, &pmc) == 0)
431 		ifp->if_capabilities |= IFCAP_WOL_MAGIC;
432 	/* Enable all capabilities. */
433 	ifp->if_capenable = ifp->if_capabilities;
434 
435 	ether_ifattach(ifp, eaddr);
436 
437 	/* VLAN capability setup. */
438 	ifp->if_capabilities |= IFCAP_VLAN_MTU;
439 	ifp->if_capabilities |= IFCAP_VLAN_HWTAGGING | IFCAP_VLAN_HWCSUM;
440 	ifp->if_capenable = ifp->if_capabilities;
441 	/* Tell the upper layer(s) we support long frames. */
442 	ifp->if_hdrlen = sizeof(struct ether_vlan_header);
443 
444 	WRITE_REG(sc, TXP_IER, TXP_INTR_NONE);
445 	WRITE_REG(sc, TXP_IMR, TXP_INTR_ALL);
446 
447 	/* Create local taskq. */
448 	sc->sc_tq = taskqueue_create_fast("txp_taskq", M_WAITOK,
449 	    taskqueue_thread_enqueue, &sc->sc_tq);
450 	if (sc->sc_tq == NULL) {
451 		device_printf(dev, "could not create taskqueue.\n");
452 		ether_ifdetach(ifp);
453 		error = ENXIO;
454 		goto fail;
455 	}
456 	taskqueue_start_threads(&sc->sc_tq, 1, PI_NET, "%s taskq",
457 	    device_get_nameunit(sc->sc_dev));
458 
459 	/* Put controller into sleep. */
460 	if (txp_sleep(sc, 0) != 0) {
461 		ether_ifdetach(ifp);
462 		error = ENXIO;
463 		goto fail;
464 	}
465 
466 	error = bus_setup_intr(dev, sc->sc_irq, INTR_TYPE_NET | INTR_MPSAFE,
467 	    txp_intr, NULL, sc, &sc->sc_intrhand);
468 
469 	if (error != 0) {
470 		ether_ifdetach(ifp);
471 		device_printf(dev, "couldn't set up interrupt handler.\n");
472 		goto fail;
473 	}
474 
475 	return (0);
476 
477 fail:
478 	if (error != 0)
479 		txp_detach(dev);
480 	return (error);
481 }
482 
483 static int
484 txp_detach(device_t dev)
485 {
486 	struct txp_softc *sc;
487 	struct ifnet *ifp;
488 
489 	sc = device_get_softc(dev);
490 
491 	ifp = sc->sc_ifp;
492 	if (device_is_attached(dev)) {
493 		TXP_LOCK(sc);
494 		sc->sc_flags |= TXP_FLAG_DETACH;
495 		txp_stop(sc);
496 		TXP_UNLOCK(sc);
497 		callout_drain(&sc->sc_tick);
498 		taskqueue_drain(sc->sc_tq, &sc->sc_int_task);
499 		ether_ifdetach(ifp);
500 	}
501 	WRITE_REG(sc, TXP_IMR, TXP_INTR_ALL);
502 
503 	ifmedia_removeall(&sc->sc_ifmedia);
504 	if (sc->sc_intrhand != NULL)
505 		bus_teardown_intr(dev, sc->sc_irq, sc->sc_intrhand);
506 	if (sc->sc_irq != NULL)
507 		bus_release_resource(dev, SYS_RES_IRQ, 0, sc->sc_irq);
508 	if (sc->sc_res != NULL)
509 		bus_release_resource(dev, sc->sc_res_type, sc->sc_res_id,
510 		    sc->sc_res);
511 	if (sc->sc_ifp != NULL) {
512 		if_free(sc->sc_ifp);
513 		sc->sc_ifp = NULL;
514 	}
515 	txp_free_rings(sc);
516 	mtx_destroy(&sc->sc_mtx);
517 
518 	return (0);
519 }
520 
521 static int
522 txp_reset(struct txp_softc *sc)
523 {
524 	uint32_t r;
525 	int i;
526 
527 	/* Disable interrupts. */
528 	WRITE_REG(sc, TXP_IER, TXP_INTR_NONE);
529 	WRITE_REG(sc, TXP_IMR, TXP_INTR_ALL);
530 	/* Ack all pending interrupts. */
531 	WRITE_REG(sc, TXP_ISR, TXP_INTR_ALL);
532 
533 	r = 0;
534 	WRITE_REG(sc, TXP_SRR, TXP_SRR_ALL);
535 	DELAY(1000);
536 	WRITE_REG(sc, TXP_SRR, 0);
537 
538 	/* Should wait max 6 seconds. */
539 	for (i = 0; i < 6000; i++) {
540 		r = READ_REG(sc, TXP_A2H_0);
541 		if (r == STAT_WAITING_FOR_HOST_REQUEST)
542 			break;
543 		DELAY(1000);
544 	}
545 
546 	if (r != STAT_WAITING_FOR_HOST_REQUEST)
547 		device_printf(sc->sc_dev, "reset hung\n");
548 
549 	WRITE_REG(sc, TXP_IER, TXP_INTR_NONE);
550 	WRITE_REG(sc, TXP_IMR, TXP_INTR_ALL);
551 	WRITE_REG(sc, TXP_ISR, TXP_INTR_ALL);
552 
553 	/*
554 	 * Give more time to complete loading sleep image before
555 	 * trying to boot from sleep image.
556 	 */
557 	DELAY(5000);
558 
559 	return (0);
560 }
561 
562 static int
563 txp_boot(struct txp_softc *sc, uint32_t state)
564 {
565 
566 	/* See if it's waiting for boot, and try to boot it. */
567 	if (txp_wait(sc, state) != 0) {
568 		device_printf(sc->sc_dev, "not waiting for boot\n");
569 		return (ENXIO);
570 	}
571 
572 	WRITE_REG(sc, TXP_H2A_2, TXP_ADDR_HI(sc->sc_ldata.txp_boot_paddr));
573 	TXP_BARRIER(sc, TXP_H2A_2, 4, BUS_SPACE_BARRIER_WRITE);
574 	WRITE_REG(sc, TXP_H2A_1, TXP_ADDR_LO(sc->sc_ldata.txp_boot_paddr));
575 	TXP_BARRIER(sc, TXP_H2A_1, 4, BUS_SPACE_BARRIER_WRITE);
576 	WRITE_REG(sc, TXP_H2A_0, TXP_BOOTCMD_REGISTER_BOOT_RECORD);
577 	TXP_BARRIER(sc, TXP_H2A_0, 4, BUS_SPACE_BARRIER_WRITE);
578 
579 	/* See if it booted. */
580 	if (txp_wait(sc, STAT_RUNNING) != 0) {
581 		device_printf(sc->sc_dev, "firmware not running\n");
582 		return (ENXIO);
583 	}
584 
585 	/* Clear TX and CMD ring write registers. */
586 	WRITE_REG(sc, TXP_H2A_1, TXP_BOOTCMD_NULL);
587 	TXP_BARRIER(sc, TXP_H2A_1, 4, BUS_SPACE_BARRIER_WRITE);
588 	WRITE_REG(sc, TXP_H2A_2, TXP_BOOTCMD_NULL);
589 	TXP_BARRIER(sc, TXP_H2A_2, 4, BUS_SPACE_BARRIER_WRITE);
590 	WRITE_REG(sc, TXP_H2A_3, TXP_BOOTCMD_NULL);
591 	TXP_BARRIER(sc, TXP_H2A_3, 4, BUS_SPACE_BARRIER_WRITE);
592 	WRITE_REG(sc, TXP_H2A_0, TXP_BOOTCMD_NULL);
593 	TXP_BARRIER(sc, TXP_H2A_0, 4, BUS_SPACE_BARRIER_WRITE);
594 
595 	return (0);
596 }
597 
598 static int
599 txp_download_fw(struct txp_softc *sc)
600 {
601 	struct txp_fw_file_header *fileheader;
602 	struct txp_fw_section_header *secthead;
603 	int sect;
604 	uint32_t error, ier, imr;
605 
606 	TXP_LOCK_ASSERT(sc);
607 
608 	error = 0;
609 	ier = READ_REG(sc, TXP_IER);
610 	WRITE_REG(sc, TXP_IER, ier | TXP_INT_A2H_0);
611 
612 	imr = READ_REG(sc, TXP_IMR);
613 	WRITE_REG(sc, TXP_IMR, imr | TXP_INT_A2H_0);
614 
615 	if (txp_wait(sc, STAT_WAITING_FOR_HOST_REQUEST) != 0) {
616 		device_printf(sc->sc_dev, "not waiting for host request\n");
617 		error = ETIMEDOUT;
618 		goto fail;
619 	}
620 
621 	/* Ack the status. */
622 	WRITE_REG(sc, TXP_ISR, TXP_INT_A2H_0);
623 
624 	fileheader = (struct txp_fw_file_header *)tc990image;
625 	if (bcmp("TYPHOON", fileheader->magicid, sizeof(fileheader->magicid))) {
626 		device_printf(sc->sc_dev, "firmware invalid magic\n");
627 		goto fail;
628 	}
629 
630 	/* Tell boot firmware to get ready for image. */
631 	WRITE_REG(sc, TXP_H2A_1, le32toh(fileheader->addr));
632 	TXP_BARRIER(sc, TXP_H2A_1, 4, BUS_SPACE_BARRIER_WRITE);
633 	WRITE_REG(sc, TXP_H2A_2, le32toh(fileheader->hmac[0]));
634 	TXP_BARRIER(sc, TXP_H2A_2, 4, BUS_SPACE_BARRIER_WRITE);
635 	WRITE_REG(sc, TXP_H2A_3, le32toh(fileheader->hmac[1]));
636 	TXP_BARRIER(sc, TXP_H2A_3, 4, BUS_SPACE_BARRIER_WRITE);
637 	WRITE_REG(sc, TXP_H2A_4, le32toh(fileheader->hmac[2]));
638 	TXP_BARRIER(sc, TXP_H2A_4, 4, BUS_SPACE_BARRIER_WRITE);
639 	WRITE_REG(sc, TXP_H2A_5, le32toh(fileheader->hmac[3]));
640 	TXP_BARRIER(sc, TXP_H2A_5, 4, BUS_SPACE_BARRIER_WRITE);
641 	WRITE_REG(sc, TXP_H2A_6, le32toh(fileheader->hmac[4]));
642 	TXP_BARRIER(sc, TXP_H2A_6, 4, BUS_SPACE_BARRIER_WRITE);
643 	WRITE_REG(sc, TXP_H2A_0, TXP_BOOTCMD_RUNTIME_IMAGE);
644 	TXP_BARRIER(sc, TXP_H2A_0, 4, BUS_SPACE_BARRIER_WRITE);
645 
646 	if (txp_download_fw_wait(sc)) {
647 		device_printf(sc->sc_dev, "firmware wait failed, initial\n");
648 		error = ETIMEDOUT;
649 		goto fail;
650 	}
651 
652 	secthead = (struct txp_fw_section_header *)(((uint8_t *)tc990image) +
653 	    sizeof(struct txp_fw_file_header));
654 
655 	for (sect = 0; sect < le32toh(fileheader->nsections); sect++) {
656 		if ((error = txp_download_fw_section(sc, secthead, sect)) != 0)
657 			goto fail;
658 		secthead = (struct txp_fw_section_header *)
659 		    (((uint8_t *)secthead) + le32toh(secthead->nbytes) +
660 		    sizeof(*secthead));
661 	}
662 
663 	WRITE_REG(sc, TXP_H2A_0, TXP_BOOTCMD_DOWNLOAD_COMPLETE);
664 	TXP_BARRIER(sc, TXP_H2A_0, 4, BUS_SPACE_BARRIER_WRITE);
665 
666 	if (txp_wait(sc, STAT_WAITING_FOR_BOOT) != 0) {
667 		device_printf(sc->sc_dev, "not waiting for boot\n");
668 		error = ETIMEDOUT;
669 		goto fail;
670 	}
671 
672 fail:
673 	WRITE_REG(sc, TXP_IER, ier);
674 	WRITE_REG(sc, TXP_IMR, imr);
675 
676 	return (error);
677 }
678 
679 static int
680 txp_download_fw_wait(struct txp_softc *sc)
681 {
682 	uint32_t i;
683 
684 	TXP_LOCK_ASSERT(sc);
685 
686 	for (i = 0; i < TXP_TIMEOUT; i++) {
687 		if ((READ_REG(sc, TXP_ISR) & TXP_INT_A2H_0) != 0)
688 			break;
689 		DELAY(50);
690 	}
691 
692 	if (i == TXP_TIMEOUT) {
693 		device_printf(sc->sc_dev, "firmware wait failed comm0\n");
694 		return (ETIMEDOUT);
695 	}
696 
697 	WRITE_REG(sc, TXP_ISR, TXP_INT_A2H_0);
698 
699 	if (READ_REG(sc, TXP_A2H_0) != STAT_WAITING_FOR_SEGMENT) {
700 		device_printf(sc->sc_dev, "firmware not waiting for segment\n");
701 		return (ETIMEDOUT);
702 	}
703 	return (0);
704 }
705 
706 static int
707 txp_download_fw_section(struct txp_softc *sc,
708     struct txp_fw_section_header *sect, int sectnum)
709 {
710 	bus_dma_tag_t sec_tag;
711 	bus_dmamap_t sec_map;
712 	bus_addr_t sec_paddr;
713 	uint8_t *sec_buf;
714 	int rseg, err = 0;
715 	struct mbuf m;
716 	uint16_t csum;
717 
718 	TXP_LOCK_ASSERT(sc);
719 
720 	/* Skip zero length sections. */
721 	if (le32toh(sect->nbytes) == 0)
722 		return (0);
723 
724 	/* Make sure we aren't past the end of the image. */
725 	rseg = ((uint8_t *)sect) - ((uint8_t *)tc990image);
726 	if (rseg >= sizeof(tc990image)) {
727 		device_printf(sc->sc_dev,
728 		    "firmware invalid section address, section %d\n", sectnum);
729 		return (EIO);
730 	}
731 
732 	/* Make sure this section doesn't go past the end. */
733 	rseg += le32toh(sect->nbytes);
734 	if (rseg >= sizeof(tc990image)) {
735 		device_printf(sc->sc_dev, "firmware truncated section %d\n",
736 		    sectnum);
737 		return (EIO);
738 	}
739 
740 	sec_tag = NULL;
741 	sec_map = NULL;
742 	sec_buf = NULL;
743 	/* XXX */
744 	TXP_UNLOCK(sc);
745 	err = txp_dma_alloc(sc, "firmware sections", &sec_tag, sizeof(uint32_t),
746 	    0, &sec_map, (void **)&sec_buf, le32toh(sect->nbytes), &sec_paddr);
747 	TXP_LOCK(sc);
748 	if (err != 0)
749 		goto bail;
750 	bcopy(((uint8_t *)sect) + sizeof(*sect), sec_buf,
751 	    le32toh(sect->nbytes));
752 
753 	/*
754 	 * dummy up mbuf and verify section checksum
755 	 */
756 	m.m_type = MT_DATA;
757 	m.m_next = m.m_nextpkt = NULL;
758 	m.m_len = le32toh(sect->nbytes);
759 	m.m_data = sec_buf;
760 	m.m_flags = 0;
761 	csum = in_cksum(&m, le32toh(sect->nbytes));
762 	if (csum != sect->cksum) {
763 		device_printf(sc->sc_dev,
764 		    "firmware section %d, bad cksum (expected 0x%x got 0x%x)\n",
765 		    sectnum, le16toh(sect->cksum), csum);
766 		err = EIO;
767 		goto bail;
768 	}
769 
770 	bus_dmamap_sync(sec_tag, sec_map, BUS_DMASYNC_PREWRITE);
771 
772 	WRITE_REG(sc, TXP_H2A_1, le32toh(sect->nbytes));
773 	TXP_BARRIER(sc, TXP_H2A_1, 4, BUS_SPACE_BARRIER_WRITE);
774 	WRITE_REG(sc, TXP_H2A_2, le16toh(sect->cksum));
775 	TXP_BARRIER(sc, TXP_H2A_2, 4, BUS_SPACE_BARRIER_WRITE);
776 	WRITE_REG(sc, TXP_H2A_3, le32toh(sect->addr));
777 	TXP_BARRIER(sc, TXP_H2A_3, 4, BUS_SPACE_BARRIER_WRITE);
778 	WRITE_REG(sc, TXP_H2A_4, TXP_ADDR_HI(sec_paddr));
779 	TXP_BARRIER(sc, TXP_H2A_4, 4, BUS_SPACE_BARRIER_WRITE);
780 	WRITE_REG(sc, TXP_H2A_5, TXP_ADDR_LO(sec_paddr));
781 	TXP_BARRIER(sc, TXP_H2A_5, 4, BUS_SPACE_BARRIER_WRITE);
782 	WRITE_REG(sc, TXP_H2A_0, TXP_BOOTCMD_SEGMENT_AVAILABLE);
783 	TXP_BARRIER(sc, TXP_H2A_0, 4, BUS_SPACE_BARRIER_WRITE);
784 
785 	if (txp_download_fw_wait(sc)) {
786 		device_printf(sc->sc_dev,
787 		    "firmware wait failed, section %d\n", sectnum);
788 		err = ETIMEDOUT;
789 	}
790 
791 	bus_dmamap_sync(sec_tag, sec_map, BUS_DMASYNC_POSTWRITE);
792 bail:
793 	txp_dma_free(sc, &sec_tag, sec_map, (void **)&sec_buf, &sec_paddr);
794 	return (err);
795 }
796 
797 static int
798 txp_intr(void *vsc)
799 {
800 	struct txp_softc *sc;
801 	uint32_t status;
802 
803 	sc = vsc;
804 	status = READ_REG(sc, TXP_ISR);
805 	if ((status & TXP_INT_LATCH) == 0)
806 		return (FILTER_STRAY);
807 	WRITE_REG(sc, TXP_ISR, status);
808 	WRITE_REG(sc, TXP_IMR, TXP_INTR_ALL);
809 	taskqueue_enqueue(sc->sc_tq, &sc->sc_int_task);
810 
811 	return (FILTER_HANDLED);
812 }
813 
814 static void
815 txp_int_task(void *arg, int pending)
816 {
817 	struct txp_softc *sc;
818 	struct ifnet *ifp;
819 	struct txp_hostvar *hv;
820 	uint32_t isr;
821 	int more;
822 
823 	sc = (struct txp_softc *)arg;
824 
825 	TXP_LOCK(sc);
826 	ifp = sc->sc_ifp;
827 	hv = sc->sc_hostvar;
828 	isr = READ_REG(sc, TXP_ISR);
829 	if ((isr & TXP_INT_LATCH) != 0)
830 		WRITE_REG(sc, TXP_ISR, isr);
831 
832 	if ((ifp->if_drv_flags & IFF_DRV_RUNNING) != 0) {
833 		bus_dmamap_sync(sc->sc_cdata.txp_hostvar_tag,
834 		    sc->sc_cdata.txp_hostvar_map,
835 		    BUS_DMASYNC_POSTREAD | BUS_DMASYNC_POSTWRITE);
836 		more = 0;
837 		if ((*sc->sc_rxhir.r_roff) != (*sc->sc_rxhir.r_woff))
838 			more += txp_rx_reclaim(sc, &sc->sc_rxhir,
839 			    sc->sc_process_limit);
840 		if ((*sc->sc_rxlor.r_roff) != (*sc->sc_rxlor.r_woff))
841 			more += txp_rx_reclaim(sc, &sc->sc_rxlor,
842 			    sc->sc_process_limit);
843 		/*
844 		 * XXX
845 		 * It seems controller is not smart enough to handle
846 		 * FIFO overflow conditions under heavy network load.
847 		 * No matter how often new Rx buffers are passed to
848 		 * controller the situation didn't change. Maybe
849 		 * flow-control would be the only way to mitigate the
850 		 * issue but firmware does not have commands that
851 		 * control the threshold of emitting pause frames.
852 		 */
853 		if (hv->hv_rx_buf_write_idx == hv->hv_rx_buf_read_idx)
854 			txp_rxbuf_reclaim(sc);
855 		if (sc->sc_txhir.r_cnt && (sc->sc_txhir.r_cons !=
856 		    TXP_OFFSET2IDX(le32toh(*(sc->sc_txhir.r_off)))))
857 			txp_tx_reclaim(sc, &sc->sc_txhir);
858 		if (sc->sc_txlor.r_cnt && (sc->sc_txlor.r_cons !=
859 		    TXP_OFFSET2IDX(le32toh(*(sc->sc_txlor.r_off)))))
860 			txp_tx_reclaim(sc, &sc->sc_txlor);
861 		bus_dmamap_sync(sc->sc_cdata.txp_hostvar_tag,
862 		    sc->sc_cdata.txp_hostvar_map,
863 		    BUS_DMASYNC_PREREAD | BUS_DMASYNC_PREWRITE);
864 		if (!IFQ_DRV_IS_EMPTY(&ifp->if_snd))
865 			txp_start_locked(sc->sc_ifp);
866 		if (more != 0 || READ_REG(sc, TXP_ISR & TXP_INT_LATCH) != 0) {
867 			taskqueue_enqueue(sc->sc_tq, &sc->sc_int_task);
868 			TXP_UNLOCK(sc);
869 			return;
870 		}
871 	}
872 
873 	/* Re-enable interrupts. */
874 	WRITE_REG(sc, TXP_IMR, TXP_INTR_NONE);
875 	TXP_UNLOCK(sc);
876 }
877 
878 #ifndef __NO_STRICT_ALIGNMENT
879 static __inline void
880 txp_fixup_rx(struct mbuf *m)
881 {
882 	int i;
883 	uint16_t *src, *dst;
884 
885 	src = mtod(m, uint16_t *);
886 	dst = src - (TXP_RXBUF_ALIGN - ETHER_ALIGN) / sizeof *src;
887 
888 	for (i = 0; i < (m->m_len / sizeof(uint16_t) + 1); i++)
889 		*dst++ = *src++;
890 
891 	m->m_data -= TXP_RXBUF_ALIGN - ETHER_ALIGN;
892 }
893 #endif
894 
895 static int
896 txp_rx_reclaim(struct txp_softc *sc, struct txp_rx_ring *r, int count)
897 {
898 	struct ifnet *ifp;
899 	struct txp_rx_desc *rxd;
900 	struct mbuf *m;
901 	struct txp_rx_swdesc *sd;
902 	uint32_t roff, woff, rx_stat, prog;
903 
904 	TXP_LOCK_ASSERT(sc);
905 
906 	ifp = sc->sc_ifp;
907 
908 	bus_dmamap_sync(r->r_tag, r->r_map, BUS_DMASYNC_POSTREAD |
909 	    BUS_DMASYNC_POSTWRITE);
910 
911 	roff = le32toh(*r->r_roff);
912 	woff = le32toh(*r->r_woff);
913 	rxd = r->r_desc + roff / sizeof(struct txp_rx_desc);
914 	for (prog = 0; roff != woff; prog++, count--) {
915 		if (count <= 0)
916 			break;
917 		bcopy((u_long *)&rxd->rx_vaddrlo, &sd, sizeof(sd));
918 		KASSERT(sd != NULL, ("%s: Rx desc ring corrupted", __func__));
919 		bus_dmamap_sync(sc->sc_cdata.txp_rx_tag, sd->sd_map,
920 		    BUS_DMASYNC_POSTREAD);
921 		bus_dmamap_unload(sc->sc_cdata.txp_rx_tag, sd->sd_map);
922 		m = sd->sd_mbuf;
923 		KASSERT(m != NULL, ("%s: Rx buffer ring corrupted", __func__));
924 		sd->sd_mbuf = NULL;
925 		TAILQ_REMOVE(&sc->sc_busy_list, sd, sd_next);
926 		TAILQ_INSERT_TAIL(&sc->sc_free_list, sd, sd_next);
927 		if ((rxd->rx_flags & RX_FLAGS_ERROR) != 0) {
928 			if (bootverbose)
929 				device_printf(sc->sc_dev, "Rx error %u\n",
930 				    le32toh(rxd->rx_stat) & RX_ERROR_MASK);
931 			m_freem(m);
932 			goto next;
933 		}
934 
935 		m->m_pkthdr.len = m->m_len = le16toh(rxd->rx_len);
936 		m->m_pkthdr.rcvif = ifp;
937 #ifndef __NO_STRICT_ALIGNMENT
938 		txp_fixup_rx(m);
939 #endif
940 		rx_stat = le32toh(rxd->rx_stat);
941 		if ((ifp->if_capenable & IFCAP_RXCSUM) != 0) {
942 			if ((rx_stat & RX_STAT_IPCKSUMBAD) != 0)
943 				m->m_pkthdr.csum_flags |= CSUM_IP_CHECKED;
944 			else if ((rx_stat & RX_STAT_IPCKSUMGOOD) != 0)
945 				m->m_pkthdr.csum_flags |=
946 				    CSUM_IP_CHECKED|CSUM_IP_VALID;
947 
948 			if ((rx_stat & RX_STAT_TCPCKSUMGOOD) != 0 ||
949 			    (rx_stat & RX_STAT_UDPCKSUMGOOD) != 0) {
950 				m->m_pkthdr.csum_flags |=
951 				    CSUM_DATA_VALID | CSUM_PSEUDO_HDR;
952 				m->m_pkthdr.csum_data = 0xffff;
953 			}
954 		}
955 
956 		/*
957 		 * XXX
958 		 * Typhoon has a firmware bug that VLAN tag is always
959 		 * stripped out even if it is told to not remove the tag.
960 		 * Therefore don't check if_capenable here.
961 		 */
962 		if (/* (ifp->if_capenable & IFCAP_VLAN_HWTAGGING) != 0 && */
963 		    (rx_stat & RX_STAT_VLAN) != 0) {
964 			m->m_pkthdr.ether_vtag =
965 			    bswap16((le32toh(rxd->rx_vlan) >> 16));
966 			m->m_flags |= M_VLANTAG;
967 		}
968 
969 		TXP_UNLOCK(sc);
970 		(*ifp->if_input)(ifp, m);
971 		TXP_LOCK(sc);
972 
973 next:
974 		roff += sizeof(struct txp_rx_desc);
975 		if (roff == (RX_ENTRIES * sizeof(struct txp_rx_desc))) {
976 			roff = 0;
977 			rxd = r->r_desc;
978 		} else
979 			rxd++;
980 		prog++;
981 	}
982 
983 	if (prog == 0)
984 		return (0);
985 
986 	bus_dmamap_sync(r->r_tag, r->r_map, BUS_DMASYNC_PREREAD |
987 	    BUS_DMASYNC_PREWRITE);
988 	*r->r_roff = le32toh(roff);
989 
990 	return (count > 0 ? 0 : EAGAIN);
991 }
992 
993 static void
994 txp_rxbuf_reclaim(struct txp_softc *sc)
995 {
996 	struct txp_hostvar *hv;
997 	struct txp_rxbuf_desc *rbd;
998 	struct txp_rx_swdesc *sd;
999 	bus_dma_segment_t segs[1];
1000 	int nsegs, prod, prog;
1001 	uint32_t cons;
1002 
1003 	TXP_LOCK_ASSERT(sc);
1004 
1005 	hv = sc->sc_hostvar;
1006 	cons = TXP_OFFSET2IDX(le32toh(hv->hv_rx_buf_read_idx));
1007 	prod = sc->sc_rxbufprod;
1008 	TXP_DESC_INC(prod, RXBUF_ENTRIES);
1009 	if (prod == cons)
1010 		return;
1011 
1012 	bus_dmamap_sync(sc->sc_cdata.txp_rxbufs_tag,
1013 	    sc->sc_cdata.txp_rxbufs_map,
1014 	    BUS_DMASYNC_POSTREAD | BUS_DMASYNC_POSTWRITE);
1015 
1016 	for (prog = 0; prod != cons; prog++) {
1017 		sd = TAILQ_FIRST(&sc->sc_free_list);
1018 		if (sd == NULL)
1019 			break;
1020 		rbd = sc->sc_rxbufs + prod;
1021 		bcopy((u_long *)&rbd->rb_vaddrlo, &sd, sizeof(sd));
1022 		sd->sd_mbuf = m_getcl(M_NOWAIT, MT_DATA, M_PKTHDR);
1023 		if (sd->sd_mbuf == NULL)
1024 			break;
1025 		sd->sd_mbuf->m_pkthdr.len = sd->sd_mbuf->m_len = MCLBYTES;
1026 #ifndef __NO_STRICT_ALIGNMENT
1027 		m_adj(sd->sd_mbuf, TXP_RXBUF_ALIGN);
1028 #endif
1029 		if (bus_dmamap_load_mbuf_sg(sc->sc_cdata.txp_rx_tag,
1030 		    sd->sd_map, sd->sd_mbuf, segs, &nsegs, 0) != 0) {
1031 			m_freem(sd->sd_mbuf);
1032 			sd->sd_mbuf = NULL;
1033 			break;
1034 		}
1035 		KASSERT(nsegs == 1, ("%s : %d segments returned!", __func__,
1036 		    nsegs));
1037 		TAILQ_REMOVE(&sc->sc_free_list, sd, sd_next);
1038 		TAILQ_INSERT_TAIL(&sc->sc_busy_list, sd, sd_next);
1039 		bus_dmamap_sync(sc->sc_cdata.txp_rx_tag, sd->sd_map,
1040 		    BUS_DMASYNC_PREREAD);
1041 		rbd->rb_paddrlo = htole32(TXP_ADDR_LO(segs[0].ds_addr));
1042 		rbd->rb_paddrhi = htole32(TXP_ADDR_HI(segs[0].ds_addr));
1043 		TXP_DESC_INC(prod, RXBUF_ENTRIES);
1044 	}
1045 
1046 	if (prog == 0)
1047 		return;
1048 	bus_dmamap_sync(sc->sc_cdata.txp_rxbufs_tag,
1049 	    sc->sc_cdata.txp_rxbufs_map,
1050 	    BUS_DMASYNC_PREREAD | BUS_DMASYNC_PREWRITE);
1051 	prod = (prod + RXBUF_ENTRIES - 1) % RXBUF_ENTRIES;
1052 	sc->sc_rxbufprod = prod;
1053 	hv->hv_rx_buf_write_idx = htole32(TXP_IDX2OFFSET(prod));
1054 }
1055 
1056 /*
1057  * Reclaim mbufs and entries from a transmit ring.
1058  */
1059 static void
1060 txp_tx_reclaim(struct txp_softc *sc, struct txp_tx_ring *r)
1061 {
1062 	struct ifnet *ifp;
1063 	uint32_t idx;
1064 	uint32_t cons, cnt;
1065 	struct txp_tx_desc *txd;
1066 	struct txp_swdesc *sd;
1067 
1068 	TXP_LOCK_ASSERT(sc);
1069 
1070 	bus_dmamap_sync(r->r_tag, r->r_map, BUS_DMASYNC_POSTREAD |
1071 	    BUS_DMASYNC_POSTWRITE);
1072 	ifp = sc->sc_ifp;
1073 	idx = TXP_OFFSET2IDX(le32toh(*(r->r_off)));
1074 	cons = r->r_cons;
1075 	cnt = r->r_cnt;
1076 	txd = r->r_desc + cons;
1077 	sd = sc->sc_txd + cons;
1078 
1079 	for (cnt = r->r_cnt; cons != idx && cnt > 0; cnt--) {
1080 		if ((txd->tx_flags & TX_FLAGS_TYPE_M) == TX_FLAGS_TYPE_DATA) {
1081 			if (sd->sd_mbuf != NULL) {
1082 				bus_dmamap_sync(sc->sc_cdata.txp_tx_tag,
1083 				    sd->sd_map, BUS_DMASYNC_POSTWRITE);
1084 				bus_dmamap_unload(sc->sc_cdata.txp_tx_tag,
1085 				    sd->sd_map);
1086 				m_freem(sd->sd_mbuf);
1087 				sd->sd_mbuf = NULL;
1088 				txd->tx_addrlo = 0;
1089 				txd->tx_addrhi = 0;
1090 				txd->tx_flags = 0;
1091 			}
1092 		}
1093 		ifp->if_drv_flags &= ~IFF_DRV_OACTIVE;
1094 
1095 		if (++cons == TX_ENTRIES) {
1096 			txd = r->r_desc;
1097 			cons = 0;
1098 			sd = sc->sc_txd;
1099 		} else {
1100 			txd++;
1101 			sd++;
1102 		}
1103 	}
1104 
1105 	bus_dmamap_sync(r->r_tag, r->r_map, BUS_DMASYNC_PREREAD |
1106 	    BUS_DMASYNC_PREWRITE);
1107 	r->r_cons = cons;
1108 	r->r_cnt = cnt;
1109 	if (cnt == 0)
1110 		sc->sc_watchdog_timer = 0;
1111 }
1112 
1113 static int
1114 txp_shutdown(device_t dev)
1115 {
1116 
1117 	return (txp_suspend(dev));
1118 }
1119 
1120 static int
1121 txp_suspend(device_t dev)
1122 {
1123 	struct txp_softc *sc;
1124 	struct ifnet *ifp;
1125 	uint8_t *eaddr;
1126 	uint16_t p1;
1127 	uint32_t p2;
1128 	int pmc;
1129 	uint16_t pmstat;
1130 
1131 	sc = device_get_softc(dev);
1132 
1133 	TXP_LOCK(sc);
1134 	ifp = sc->sc_ifp;
1135 	txp_stop(sc);
1136 	txp_init_rings(sc);
1137 	/* Reset controller and make it reload sleep image. */
1138 	txp_reset(sc);
1139 	/* Let controller boot from sleep image. */
1140 	if (txp_boot(sc, STAT_WAITING_FOR_HOST_REQUEST) != 0)
1141 		device_printf(sc->sc_dev, "couldn't boot sleep image\n");
1142 
1143 	/* Set station address. */
1144 	eaddr = IF_LLADDR(sc->sc_ifp);
1145 	p1 = 0;
1146 	((uint8_t *)&p1)[1] = eaddr[0];
1147 	((uint8_t *)&p1)[0] = eaddr[1];
1148 	p1 = le16toh(p1);
1149 	((uint8_t *)&p2)[3] = eaddr[2];
1150 	((uint8_t *)&p2)[2] = eaddr[3];
1151 	((uint8_t *)&p2)[1] = eaddr[4];
1152 	((uint8_t *)&p2)[0] = eaddr[5];
1153 	p2 = le32toh(p2);
1154 	txp_command(sc, TXP_CMD_STATION_ADDRESS_WRITE, p1, p2, 0, NULL, NULL,
1155 	    NULL, TXP_CMD_WAIT);
1156 	txp_set_filter(sc);
1157 	WRITE_REG(sc, TXP_IER, TXP_INTR_NONE);
1158 	WRITE_REG(sc, TXP_IMR, TXP_INTR_ALL);
1159 	txp_sleep(sc, sc->sc_ifp->if_capenable);
1160 	if (pci_find_cap(sc->sc_dev, PCIY_PMG, &pmc) == 0) {
1161 		/* Request PME. */
1162 		pmstat = pci_read_config(sc->sc_dev,
1163 		    pmc + PCIR_POWER_STATUS, 2);
1164 		pmstat &= ~(PCIM_PSTAT_PME | PCIM_PSTAT_PMEENABLE);
1165 		if ((ifp->if_capenable & IFCAP_WOL) != 0)
1166 			pmstat |= PCIM_PSTAT_PME | PCIM_PSTAT_PMEENABLE;
1167 		pci_write_config(sc->sc_dev,
1168 		    pmc + PCIR_POWER_STATUS, pmstat, 2);
1169 	}
1170 	TXP_UNLOCK(sc);
1171 
1172 	return (0);
1173 }
1174 
1175 static int
1176 txp_resume(device_t dev)
1177 {
1178 	struct txp_softc *sc;
1179 	int pmc;
1180 	uint16_t pmstat;
1181 
1182 	sc = device_get_softc(dev);
1183 
1184 	TXP_LOCK(sc);
1185 	if (pci_find_cap(sc->sc_dev, PCIY_PMG, &pmc) == 0) {
1186 		/* Disable PME and clear PME status. */
1187 		pmstat = pci_read_config(sc->sc_dev,
1188 		    pmc + PCIR_POWER_STATUS, 2);
1189 		if ((pmstat & PCIM_PSTAT_PMEENABLE) != 0) {
1190 			pmstat &= ~PCIM_PSTAT_PMEENABLE;
1191 			pci_write_config(sc->sc_dev,
1192 			    pmc + PCIR_POWER_STATUS, pmstat, 2);
1193 		}
1194 	}
1195 	if ((sc->sc_ifp->if_flags & IFF_UP) != 0)
1196 		txp_init_locked(sc);
1197 	TXP_UNLOCK(sc);
1198 
1199 	return (0);
1200 }
1201 
1202 struct txp_dmamap_arg {
1203 	bus_addr_t	txp_busaddr;
1204 };
1205 
1206 static void
1207 txp_dmamap_cb(void *arg, bus_dma_segment_t *segs, int nsegs, int error)
1208 {
1209 	struct txp_dmamap_arg *ctx;
1210 
1211 	if (error != 0)
1212 		return;
1213 
1214 	KASSERT(nsegs == 1, ("%s: %d segments returned!", __func__, nsegs));
1215 
1216 	ctx = (struct txp_dmamap_arg *)arg;
1217 	ctx->txp_busaddr = segs[0].ds_addr;
1218 }
1219 
1220 static int
1221 txp_dma_alloc(struct txp_softc *sc, char *type, bus_dma_tag_t *tag,
1222     bus_size_t alignment, bus_size_t boundary, bus_dmamap_t *map, void **buf,
1223     bus_size_t size, bus_addr_t *paddr)
1224 {
1225 	struct txp_dmamap_arg ctx;
1226 	int error;
1227 
1228 	/* Create DMA block tag. */
1229 	error = bus_dma_tag_create(
1230 	    sc->sc_cdata.txp_parent_tag,	/* parent */
1231 	    alignment, boundary,	/* algnmnt, boundary */
1232 	    BUS_SPACE_MAXADDR,		/* lowaddr */
1233 	    BUS_SPACE_MAXADDR,		/* highaddr */
1234 	    NULL, NULL,			/* filter, filterarg */
1235 	    size,			/* maxsize */
1236 	    1,				/* nsegments */
1237 	    size,			/* maxsegsize */
1238 	    0,				/* flags */
1239 	    NULL, NULL,			/* lockfunc, lockarg */
1240 	    tag);
1241 	if (error != 0) {
1242 		device_printf(sc->sc_dev,
1243 		    "could not create DMA tag for %s.\n", type);
1244 		return (error);
1245 	}
1246 
1247 	*paddr = 0;
1248 	/* Allocate DMA'able memory and load the DMA map. */
1249 	error = bus_dmamem_alloc(*tag, buf, BUS_DMA_WAITOK | BUS_DMA_ZERO |
1250 	    BUS_DMA_COHERENT, map);
1251 	if (error != 0) {
1252 		device_printf(sc->sc_dev,
1253 		    "could not allocate DMA'able memory for %s.\n", type);
1254 		return (error);
1255 	}
1256 
1257 	ctx.txp_busaddr = 0;
1258 	error = bus_dmamap_load(*tag, *map, *(uint8_t **)buf,
1259 	    size, txp_dmamap_cb, &ctx, BUS_DMA_NOWAIT);
1260 	if (error != 0 || ctx.txp_busaddr == 0) {
1261 		device_printf(sc->sc_dev,
1262 		    "could not load DMA'able memory for %s.\n", type);
1263 		return (error);
1264 	}
1265 	*paddr = ctx.txp_busaddr;
1266 
1267 	return (0);
1268 }
1269 
1270 static void
1271 txp_dma_free(struct txp_softc *sc, bus_dma_tag_t *tag, bus_dmamap_t map,
1272     void **buf, bus_addr_t *paddr)
1273 {
1274 
1275 	if (*tag != NULL) {
1276 		if (*paddr != 0)
1277 			bus_dmamap_unload(*tag, map);
1278 		if (buf != NULL)
1279 			bus_dmamem_free(*tag, *(uint8_t **)buf, map);
1280 		*(uint8_t **)buf = NULL;
1281 		*paddr = 0;
1282 		bus_dma_tag_destroy(*tag);
1283 		*tag = NULL;
1284 	}
1285 }
1286 
1287 static int
1288 txp_alloc_rings(struct txp_softc *sc)
1289 {
1290 	struct txp_boot_record *boot;
1291 	struct txp_ldata *ld;
1292 	struct txp_swdesc *txd;
1293 	struct txp_rxbuf_desc *rbd;
1294 	struct txp_rx_swdesc *sd;
1295 	int error, i;
1296 
1297 	ld = &sc->sc_ldata;
1298 	boot = ld->txp_boot;
1299 
1300 	/* boot record */
1301 	sc->sc_boot = boot;
1302 
1303 	/*
1304 	 * Create parent ring/DMA block tag.
1305 	 * Datasheet says that all ring addresses and descriptors
1306 	 * support 64bits addressing. However the controller is
1307 	 * known to have no support DAC so limit DMA address space
1308 	 * to 32bits.
1309 	 */
1310 	error = bus_dma_tag_create(
1311 	    bus_get_dma_tag(sc->sc_dev), /* parent */
1312 	    1, 0,			/* algnmnt, boundary */
1313 	    BUS_SPACE_MAXADDR_32BIT,	/* lowaddr */
1314 	    BUS_SPACE_MAXADDR,		/* highaddr */
1315 	    NULL, NULL,			/* filter, filterarg */
1316 	    BUS_SPACE_MAXSIZE_32BIT,	/* maxsize */
1317 	    0,				/* nsegments */
1318 	    BUS_SPACE_MAXSIZE_32BIT,	/* maxsegsize */
1319 	    0,				/* flags */
1320 	    NULL, NULL,			/* lockfunc, lockarg */
1321 	    &sc->sc_cdata.txp_parent_tag);
1322 	if (error != 0) {
1323 		device_printf(sc->sc_dev, "could not create parent DMA tag.\n");
1324 		return (error);
1325 	}
1326 
1327 	/* Boot record. */
1328 	error = txp_dma_alloc(sc, "boot record",
1329 	    &sc->sc_cdata.txp_boot_tag, sizeof(uint32_t), 0,
1330 	    &sc->sc_cdata.txp_boot_map, (void **)&sc->sc_ldata.txp_boot,
1331 	    sizeof(struct txp_boot_record),
1332 	    &sc->sc_ldata.txp_boot_paddr);
1333 	if (error != 0)
1334 		return (error);
1335 	boot = sc->sc_ldata.txp_boot;
1336 	sc->sc_boot = boot;
1337 
1338 	/* Host variables. */
1339 	error = txp_dma_alloc(sc, "host variables",
1340 	    &sc->sc_cdata.txp_hostvar_tag, sizeof(uint32_t), 0,
1341 	    &sc->sc_cdata.txp_hostvar_map, (void **)&sc->sc_ldata.txp_hostvar,
1342 	    sizeof(struct txp_hostvar),
1343 	    &sc->sc_ldata.txp_hostvar_paddr);
1344 	if (error != 0)
1345 		return (error);
1346 	boot->br_hostvar_lo =
1347 	    htole32(TXP_ADDR_LO(sc->sc_ldata.txp_hostvar_paddr));
1348 	boot->br_hostvar_hi =
1349 	    htole32(TXP_ADDR_HI(sc->sc_ldata.txp_hostvar_paddr));
1350 	sc->sc_hostvar = sc->sc_ldata.txp_hostvar;
1351 
1352 	/* Hi priority tx ring. */
1353 	error = txp_dma_alloc(sc, "hi priority tx ring",
1354 	    &sc->sc_cdata.txp_txhiring_tag, sizeof(struct txp_tx_desc), 0,
1355 	    &sc->sc_cdata.txp_txhiring_map, (void **)&sc->sc_ldata.txp_txhiring,
1356 	    sizeof(struct txp_tx_desc) * TX_ENTRIES,
1357 	    &sc->sc_ldata.txp_txhiring_paddr);
1358 	if (error != 0)
1359 		return (error);
1360 	boot->br_txhipri_lo =
1361 	    htole32(TXP_ADDR_LO(sc->sc_ldata.txp_txhiring_paddr));
1362 	boot->br_txhipri_hi =
1363 	    htole32(TXP_ADDR_HI(sc->sc_ldata.txp_txhiring_paddr));
1364 	boot->br_txhipri_siz =
1365 	    htole32(TX_ENTRIES * sizeof(struct txp_tx_desc));
1366 	sc->sc_txhir.r_tag = sc->sc_cdata.txp_txhiring_tag;
1367 	sc->sc_txhir.r_map = sc->sc_cdata.txp_txhiring_map;
1368 	sc->sc_txhir.r_reg = TXP_H2A_1;
1369 	sc->sc_txhir.r_desc = sc->sc_ldata.txp_txhiring;
1370 	sc->sc_txhir.r_cons = sc->sc_txhir.r_prod = sc->sc_txhir.r_cnt = 0;
1371 	sc->sc_txhir.r_off = &sc->sc_hostvar->hv_tx_hi_desc_read_idx;
1372 
1373 	/* Low priority tx ring. */
1374 	error = txp_dma_alloc(sc, "low priority tx ring",
1375 	    &sc->sc_cdata.txp_txloring_tag, sizeof(struct txp_tx_desc), 0,
1376 	    &sc->sc_cdata.txp_txloring_map, (void **)&sc->sc_ldata.txp_txloring,
1377 	    sizeof(struct txp_tx_desc) * TX_ENTRIES,
1378 	    &sc->sc_ldata.txp_txloring_paddr);
1379 	if (error != 0)
1380 		return (error);
1381 	boot->br_txlopri_lo =
1382 	    htole32(TXP_ADDR_LO(sc->sc_ldata.txp_txloring_paddr));
1383 	boot->br_txlopri_hi =
1384 	    htole32(TXP_ADDR_HI(sc->sc_ldata.txp_txloring_paddr));
1385 	boot->br_txlopri_siz =
1386 	    htole32(TX_ENTRIES * sizeof(struct txp_tx_desc));
1387 	sc->sc_txlor.r_tag = sc->sc_cdata.txp_txloring_tag;
1388 	sc->sc_txlor.r_map = sc->sc_cdata.txp_txloring_map;
1389 	sc->sc_txlor.r_reg = TXP_H2A_3;
1390 	sc->sc_txlor.r_desc = sc->sc_ldata.txp_txloring;
1391 	sc->sc_txlor.r_cons = sc->sc_txlor.r_prod = sc->sc_txlor.r_cnt = 0;
1392 	sc->sc_txlor.r_off = &sc->sc_hostvar->hv_tx_lo_desc_read_idx;
1393 
1394 	/* High priority rx ring. */
1395 	error = txp_dma_alloc(sc, "hi priority rx ring",
1396 	    &sc->sc_cdata.txp_rxhiring_tag,
1397 	    roundup(sizeof(struct txp_rx_desc), 16), 0,
1398 	    &sc->sc_cdata.txp_rxhiring_map, (void **)&sc->sc_ldata.txp_rxhiring,
1399 	    sizeof(struct txp_rx_desc) * RX_ENTRIES,
1400 	    &sc->sc_ldata.txp_rxhiring_paddr);
1401 	if (error != 0)
1402 		return (error);
1403 	boot->br_rxhipri_lo =
1404 	    htole32(TXP_ADDR_LO(sc->sc_ldata.txp_rxhiring_paddr));
1405 	boot->br_rxhipri_hi =
1406 	    htole32(TXP_ADDR_HI(sc->sc_ldata.txp_rxhiring_paddr));
1407 	boot->br_rxhipri_siz =
1408 	    htole32(RX_ENTRIES * sizeof(struct txp_rx_desc));
1409 	sc->sc_rxhir.r_tag = sc->sc_cdata.txp_rxhiring_tag;
1410 	sc->sc_rxhir.r_map = sc->sc_cdata.txp_rxhiring_map;
1411 	sc->sc_rxhir.r_desc = sc->sc_ldata.txp_rxhiring;
1412 	sc->sc_rxhir.r_roff = &sc->sc_hostvar->hv_rx_hi_read_idx;
1413 	sc->sc_rxhir.r_woff = &sc->sc_hostvar->hv_rx_hi_write_idx;
1414 
1415 	/* Low priority rx ring. */
1416 	error = txp_dma_alloc(sc, "low priority rx ring",
1417 	    &sc->sc_cdata.txp_rxloring_tag,
1418 	    roundup(sizeof(struct txp_rx_desc), 16), 0,
1419 	    &sc->sc_cdata.txp_rxloring_map, (void **)&sc->sc_ldata.txp_rxloring,
1420 	    sizeof(struct txp_rx_desc) * RX_ENTRIES,
1421 	    &sc->sc_ldata.txp_rxloring_paddr);
1422 	if (error != 0)
1423 		return (error);
1424 	boot->br_rxlopri_lo =
1425 	    htole32(TXP_ADDR_LO(sc->sc_ldata.txp_rxloring_paddr));
1426 	boot->br_rxlopri_hi =
1427 	    htole32(TXP_ADDR_HI(sc->sc_ldata.txp_rxloring_paddr));
1428 	boot->br_rxlopri_siz =
1429 	    htole32(RX_ENTRIES * sizeof(struct txp_rx_desc));
1430 	sc->sc_rxlor.r_tag = sc->sc_cdata.txp_rxloring_tag;
1431 	sc->sc_rxlor.r_map = sc->sc_cdata.txp_rxloring_map;
1432 	sc->sc_rxlor.r_desc = sc->sc_ldata.txp_rxloring;
1433 	sc->sc_rxlor.r_roff = &sc->sc_hostvar->hv_rx_lo_read_idx;
1434 	sc->sc_rxlor.r_woff = &sc->sc_hostvar->hv_rx_lo_write_idx;
1435 
1436 	/* Command ring. */
1437 	error = txp_dma_alloc(sc, "command ring",
1438 	    &sc->sc_cdata.txp_cmdring_tag, sizeof(struct txp_cmd_desc), 0,
1439 	    &sc->sc_cdata.txp_cmdring_map, (void **)&sc->sc_ldata.txp_cmdring,
1440 	    sizeof(struct txp_cmd_desc) * CMD_ENTRIES,
1441 	    &sc->sc_ldata.txp_cmdring_paddr);
1442 	if (error != 0)
1443 		return (error);
1444 	boot->br_cmd_lo = htole32(TXP_ADDR_LO(sc->sc_ldata.txp_cmdring_paddr));
1445 	boot->br_cmd_hi = htole32(TXP_ADDR_HI(sc->sc_ldata.txp_cmdring_paddr));
1446 	boot->br_cmd_siz = htole32(CMD_ENTRIES * sizeof(struct txp_cmd_desc));
1447 	sc->sc_cmdring.base = sc->sc_ldata.txp_cmdring;
1448 	sc->sc_cmdring.size = CMD_ENTRIES * sizeof(struct txp_cmd_desc);
1449 	sc->sc_cmdring.lastwrite = 0;
1450 
1451 	/* Response ring. */
1452 	error = txp_dma_alloc(sc, "response ring",
1453 	    &sc->sc_cdata.txp_rspring_tag, sizeof(struct txp_rsp_desc), 0,
1454 	    &sc->sc_cdata.txp_rspring_map, (void **)&sc->sc_ldata.txp_rspring,
1455 	    sizeof(struct txp_rsp_desc) * RSP_ENTRIES,
1456 	    &sc->sc_ldata.txp_rspring_paddr);
1457 	if (error != 0)
1458 		return (error);
1459 	boot->br_resp_lo = htole32(TXP_ADDR_LO(sc->sc_ldata.txp_rspring_paddr));
1460 	boot->br_resp_hi = htole32(TXP_ADDR_HI(sc->sc_ldata.txp_rspring_paddr));
1461 	boot->br_resp_siz = htole32(RSP_ENTRIES * sizeof(struct txp_rsp_desc));
1462 	sc->sc_rspring.base = sc->sc_ldata.txp_rspring;
1463 	sc->sc_rspring.size = RSP_ENTRIES * sizeof(struct txp_rsp_desc);
1464 	sc->sc_rspring.lastwrite = 0;
1465 
1466 	/* Receive buffer ring. */
1467 	error = txp_dma_alloc(sc, "receive buffer ring",
1468 	    &sc->sc_cdata.txp_rxbufs_tag, sizeof(struct txp_rxbuf_desc), 0,
1469 	    &sc->sc_cdata.txp_rxbufs_map, (void **)&sc->sc_ldata.txp_rxbufs,
1470 	    sizeof(struct txp_rxbuf_desc) * RXBUF_ENTRIES,
1471 	    &sc->sc_ldata.txp_rxbufs_paddr);
1472 	if (error != 0)
1473 		return (error);
1474 	boot->br_rxbuf_lo =
1475 	    htole32(TXP_ADDR_LO(sc->sc_ldata.txp_rxbufs_paddr));
1476 	boot->br_rxbuf_hi =
1477 	    htole32(TXP_ADDR_HI(sc->sc_ldata.txp_rxbufs_paddr));
1478 	boot->br_rxbuf_siz =
1479 	    htole32(RXBUF_ENTRIES * sizeof(struct txp_rxbuf_desc));
1480 	sc->sc_rxbufs = sc->sc_ldata.txp_rxbufs;
1481 
1482 	/* Zero ring. */
1483 	error = txp_dma_alloc(sc, "zero buffer",
1484 	    &sc->sc_cdata.txp_zero_tag, sizeof(uint32_t), 0,
1485 	    &sc->sc_cdata.txp_zero_map, (void **)&sc->sc_ldata.txp_zero,
1486 	    sizeof(uint32_t), &sc->sc_ldata.txp_zero_paddr);
1487 	if (error != 0)
1488 		return (error);
1489 	boot->br_zero_lo = htole32(TXP_ADDR_LO(sc->sc_ldata.txp_zero_paddr));
1490 	boot->br_zero_hi = htole32(TXP_ADDR_HI(sc->sc_ldata.txp_zero_paddr));
1491 
1492 	bus_dmamap_sync(sc->sc_cdata.txp_boot_tag, sc->sc_cdata.txp_boot_map,
1493 	    BUS_DMASYNC_PREREAD | BUS_DMASYNC_PREWRITE);
1494 
1495 	/* Create Tx buffers. */
1496 	error = bus_dma_tag_create(
1497 	    sc->sc_cdata.txp_parent_tag,	/* parent */
1498 	    1, 0,			/* algnmnt, boundary */
1499 	    BUS_SPACE_MAXADDR,		/* lowaddr */
1500 	    BUS_SPACE_MAXADDR,		/* highaddr */
1501 	    NULL, NULL,			/* filter, filterarg */
1502 	    MCLBYTES * TXP_MAXTXSEGS,	/* maxsize */
1503 	    TXP_MAXTXSEGS,		/* nsegments */
1504 	    MCLBYTES,			/* maxsegsize */
1505 	    0,				/* flags */
1506 	    NULL, NULL,			/* lockfunc, lockarg */
1507 	    &sc->sc_cdata.txp_tx_tag);
1508 	if (error != 0) {
1509 		device_printf(sc->sc_dev, "could not create Tx DMA tag.\n");
1510 		goto fail;
1511 	}
1512 
1513 	/* Create tag for Rx buffers. */
1514 	error = bus_dma_tag_create(
1515 	    sc->sc_cdata.txp_parent_tag,	/* parent */
1516 	    TXP_RXBUF_ALIGN, 0,		/* algnmnt, boundary */
1517 	    BUS_SPACE_MAXADDR,		/* lowaddr */
1518 	    BUS_SPACE_MAXADDR,		/* highaddr */
1519 	    NULL, NULL,			/* filter, filterarg */
1520 	    MCLBYTES,			/* maxsize */
1521 	    1,				/* nsegments */
1522 	    MCLBYTES,			/* maxsegsize */
1523 	    0,				/* flags */
1524 	    NULL, NULL,			/* lockfunc, lockarg */
1525 	    &sc->sc_cdata.txp_rx_tag);
1526 	if (error != 0) {
1527 		device_printf(sc->sc_dev, "could not create Rx DMA tag.\n");
1528 		goto fail;
1529 	}
1530 
1531 	/* Create DMA maps for Tx buffers. */
1532 	for (i = 0; i < TX_ENTRIES; i++) {
1533 		txd = &sc->sc_txd[i];
1534 		txd->sd_mbuf = NULL;
1535 		txd->sd_map = NULL;
1536 		error = bus_dmamap_create(sc->sc_cdata.txp_tx_tag, 0,
1537 		    &txd->sd_map);
1538 		if (error != 0) {
1539 			device_printf(sc->sc_dev,
1540 			    "could not create Tx dmamap.\n");
1541 			goto fail;
1542 		}
1543 	}
1544 
1545 	/* Create DMA maps for Rx buffers. */
1546 	for (i = 0; i < RXBUF_ENTRIES; i++) {
1547 		sd = malloc(sizeof(struct txp_rx_swdesc), M_DEVBUF,
1548 		    M_NOWAIT | M_ZERO);
1549 		if (sd == NULL) {
1550 			error = ENOMEM;
1551 			goto fail;
1552 		}
1553 		/*
1554 		 * The virtual address part of descriptor is not used
1555 		 * by hardware so use that to save an ring entry. We
1556 		 * need bcopy here otherwise the address wouldn't be
1557 		 * valid on big-endian architectures.
1558 		 */
1559 		rbd = sc->sc_rxbufs + i;
1560 		bcopy(&sd, (u_long *)&rbd->rb_vaddrlo, sizeof(sd));
1561 		sd->sd_mbuf = NULL;
1562 		sd->sd_map = NULL;
1563 		error = bus_dmamap_create(sc->sc_cdata.txp_rx_tag, 0,
1564 		    &sd->sd_map);
1565 		if (error != 0) {
1566 			device_printf(sc->sc_dev,
1567 			    "could not create Rx dmamap.\n");
1568 			goto fail;
1569 		}
1570 		TAILQ_INSERT_TAIL(&sc->sc_free_list, sd, sd_next);
1571 	}
1572 
1573 fail:
1574 	return (error);
1575 }
1576 
1577 static void
1578 txp_init_rings(struct txp_softc *sc)
1579 {
1580 
1581 	bzero(sc->sc_ldata.txp_hostvar, sizeof(struct txp_hostvar));
1582 	bzero(sc->sc_ldata.txp_zero, sizeof(uint32_t));
1583 	sc->sc_txhir.r_cons = 0;
1584 	sc->sc_txhir.r_prod = 0;
1585 	sc->sc_txhir.r_cnt = 0;
1586 	sc->sc_txlor.r_cons = 0;
1587 	sc->sc_txlor.r_prod = 0;
1588 	sc->sc_txlor.r_cnt = 0;
1589 	sc->sc_cmdring.lastwrite = 0;
1590 	sc->sc_rspring.lastwrite = 0;
1591 	sc->sc_rxbufprod = 0;
1592 	bus_dmamap_sync(sc->sc_cdata.txp_hostvar_tag,
1593 	    sc->sc_cdata.txp_hostvar_map,
1594 	    BUS_DMASYNC_PREREAD | BUS_DMASYNC_PREWRITE);
1595 }
1596 
1597 static int
1598 txp_wait(struct txp_softc *sc, uint32_t state)
1599 {
1600 	uint32_t reg;
1601 	int i;
1602 
1603 	for (i = 0; i < TXP_TIMEOUT; i++) {
1604 		reg = READ_REG(sc, TXP_A2H_0);
1605 		if (reg == state)
1606 			break;
1607 		DELAY(50);
1608 	}
1609 
1610 	return (i == TXP_TIMEOUT ? ETIMEDOUT : 0);
1611 }
1612 
1613 static void
1614 txp_free_rings(struct txp_softc *sc)
1615 {
1616 	struct txp_swdesc *txd;
1617 	struct txp_rx_swdesc *sd;
1618 	int i;
1619 
1620 	/* Tx buffers. */
1621 	if (sc->sc_cdata.txp_tx_tag != NULL) {
1622 		for (i = 0; i < TX_ENTRIES; i++) {
1623 			txd = &sc->sc_txd[i];
1624 			if (txd->sd_map != NULL) {
1625 				bus_dmamap_destroy(sc->sc_cdata.txp_tx_tag,
1626 				    txd->sd_map);
1627 				txd->sd_map = NULL;
1628 			}
1629 		}
1630 		bus_dma_tag_destroy(sc->sc_cdata.txp_tx_tag);
1631 		sc->sc_cdata.txp_tx_tag = NULL;
1632 	}
1633 	/* Rx buffers. */
1634 	if (sc->sc_cdata.txp_rx_tag != NULL) {
1635 		if (sc->sc_rxbufs != NULL) {
1636 			KASSERT(TAILQ_FIRST(&sc->sc_busy_list) == NULL,
1637 			    ("%s : still have busy Rx buffers", __func__));
1638 			while ((sd = TAILQ_FIRST(&sc->sc_free_list)) != NULL) {
1639 				TAILQ_REMOVE(&sc->sc_free_list, sd, sd_next);
1640 				if (sd->sd_map != NULL) {
1641 					bus_dmamap_destroy(
1642 					    sc->sc_cdata.txp_rx_tag,
1643 					    sd->sd_map);
1644 					sd->sd_map = NULL;
1645 				}
1646 				free(sd, M_DEVBUF);
1647 			}
1648 		}
1649 		bus_dma_tag_destroy(sc->sc_cdata.txp_rx_tag);
1650 		sc->sc_cdata.txp_rx_tag = NULL;
1651 	}
1652 
1653 	/* Hi priority Tx ring. */
1654 	txp_dma_free(sc, &sc->sc_cdata.txp_txhiring_tag,
1655 	    sc->sc_cdata.txp_txhiring_map,
1656 	    (void **)&sc->sc_ldata.txp_txhiring,
1657 	    &sc->sc_ldata.txp_txhiring_paddr);
1658 	/* Low priority Tx ring. */
1659 	txp_dma_free(sc, &sc->sc_cdata.txp_txloring_tag,
1660 	    sc->sc_cdata.txp_txloring_map,
1661 	    (void **)&sc->sc_ldata.txp_txloring,
1662 	    &sc->sc_ldata.txp_txloring_paddr);
1663 	/* Hi priority Rx ring. */
1664 	txp_dma_free(sc, &sc->sc_cdata.txp_rxhiring_tag,
1665 	    sc->sc_cdata.txp_rxhiring_map,
1666 	    (void **)&sc->sc_ldata.txp_rxhiring,
1667 	    &sc->sc_ldata.txp_rxhiring_paddr);
1668 	/* Low priority Rx ring. */
1669 	txp_dma_free(sc, &sc->sc_cdata.txp_rxloring_tag,
1670 	    sc->sc_cdata.txp_rxloring_map,
1671 	    (void **)&sc->sc_ldata.txp_rxloring,
1672 	    &sc->sc_ldata.txp_rxloring_paddr);
1673 	/* Receive buffer ring. */
1674 	txp_dma_free(sc, &sc->sc_cdata.txp_rxbufs_tag,
1675 	    sc->sc_cdata.txp_rxbufs_map, (void **)&sc->sc_ldata.txp_rxbufs,
1676 	    &sc->sc_ldata.txp_rxbufs_paddr);
1677 	/* Command ring. */
1678 	txp_dma_free(sc, &sc->sc_cdata.txp_cmdring_tag,
1679 	    sc->sc_cdata.txp_cmdring_map, (void **)&sc->sc_ldata.txp_cmdring,
1680 	    &sc->sc_ldata.txp_cmdring_paddr);
1681 	/* Response ring. */
1682 	txp_dma_free(sc, &sc->sc_cdata.txp_rspring_tag,
1683 	    sc->sc_cdata.txp_rspring_map, (void **)&sc->sc_ldata.txp_rspring,
1684 	    &sc->sc_ldata.txp_rspring_paddr);
1685 	/* Zero ring. */
1686 	txp_dma_free(sc, &sc->sc_cdata.txp_zero_tag,
1687 	    sc->sc_cdata.txp_zero_map, (void **)&sc->sc_ldata.txp_zero,
1688 	    &sc->sc_ldata.txp_zero_paddr);
1689 	/* Host variables. */
1690 	txp_dma_free(sc, &sc->sc_cdata.txp_hostvar_tag,
1691 	    sc->sc_cdata.txp_hostvar_map, (void **)&sc->sc_ldata.txp_hostvar,
1692 	    &sc->sc_ldata.txp_hostvar_paddr);
1693 	/* Boot record. */
1694 	txp_dma_free(sc, &sc->sc_cdata.txp_boot_tag,
1695 	    sc->sc_cdata.txp_boot_map, (void **)&sc->sc_ldata.txp_boot,
1696 	    &sc->sc_ldata.txp_boot_paddr);
1697 
1698 	if (sc->sc_cdata.txp_parent_tag != NULL) {
1699 		bus_dma_tag_destroy(sc->sc_cdata.txp_parent_tag);
1700 		sc->sc_cdata.txp_parent_tag = NULL;
1701 	}
1702 
1703 }
1704 
1705 static int
1706 txp_ioctl(struct ifnet *ifp, u_long command, caddr_t data)
1707 {
1708 	struct txp_softc *sc = ifp->if_softc;
1709 	struct ifreq *ifr = (struct ifreq *)data;
1710 	int capenable, error = 0, mask;
1711 
1712 	switch(command) {
1713 	case SIOCSIFFLAGS:
1714 		TXP_LOCK(sc);
1715 		if ((ifp->if_flags & IFF_UP) != 0) {
1716 			if ((ifp->if_drv_flags & IFF_DRV_RUNNING) != 0) {
1717 				if (((ifp->if_flags ^ sc->sc_if_flags)
1718 				    & (IFF_PROMISC | IFF_ALLMULTI)) != 0)
1719 					txp_set_filter(sc);
1720 			} else {
1721 				if ((sc->sc_flags & TXP_FLAG_DETACH) == 0)
1722 					txp_init_locked(sc);
1723 			}
1724 		} else {
1725 			if ((ifp->if_drv_flags & IFF_DRV_RUNNING) != 0)
1726 				txp_stop(sc);
1727 		}
1728 		sc->sc_if_flags = ifp->if_flags;
1729 		TXP_UNLOCK(sc);
1730 		break;
1731 	case SIOCADDMULTI:
1732 	case SIOCDELMULTI:
1733 		/*
1734 		 * Multicast list has changed; set the hardware
1735 		 * filter accordingly.
1736 		 */
1737 		TXP_LOCK(sc);
1738 		if ((ifp->if_drv_flags & IFF_DRV_RUNNING) != 0)
1739 			txp_set_filter(sc);
1740 		TXP_UNLOCK(sc);
1741 		break;
1742 	case SIOCSIFCAP:
1743 		TXP_LOCK(sc);
1744 		capenable = ifp->if_capenable;
1745 		mask = ifr->ifr_reqcap ^ ifp->if_capenable;
1746 		if ((mask & IFCAP_TXCSUM) != 0 &&
1747 		    (ifp->if_capabilities & IFCAP_TXCSUM) != 0) {
1748 			ifp->if_capenable ^= IFCAP_TXCSUM;
1749 			if ((ifp->if_capenable & IFCAP_TXCSUM) != 0)
1750 				ifp->if_hwassist |= TXP_CSUM_FEATURES;
1751 			else
1752 				ifp->if_hwassist &= ~TXP_CSUM_FEATURES;
1753 		}
1754 		if ((mask & IFCAP_RXCSUM) != 0 &&
1755 		    (ifp->if_capabilities & IFCAP_RXCSUM) != 0)
1756 			ifp->if_capenable ^= IFCAP_RXCSUM;
1757 		if ((mask & IFCAP_WOL_MAGIC) != 0 &&
1758 		    (ifp->if_capabilities & IFCAP_WOL_MAGIC) != 0)
1759 			ifp->if_capenable ^= IFCAP_WOL_MAGIC;
1760 		if ((mask & IFCAP_VLAN_HWTAGGING) != 0 &&
1761 		    (ifp->if_capabilities & IFCAP_VLAN_HWTAGGING) != 0)
1762 			ifp->if_capenable ^= IFCAP_VLAN_HWTAGGING;
1763 		if ((mask & IFCAP_VLAN_HWCSUM) != 0 &&
1764 		    (ifp->if_capabilities & IFCAP_VLAN_HWCSUM) != 0)
1765 			ifp->if_capenable ^= IFCAP_VLAN_HWCSUM;
1766 		if ((ifp->if_capenable & IFCAP_TXCSUM) == 0)
1767 			ifp->if_capenable &= ~IFCAP_VLAN_HWCSUM;
1768 		if ((ifp->if_capenable & IFCAP_VLAN_HWTAGGING) == 0)
1769 			ifp->if_capenable &= ~IFCAP_VLAN_HWCSUM;
1770 		if (capenable != ifp->if_capenable)
1771 			txp_set_capabilities(sc);
1772 		TXP_UNLOCK(sc);
1773 		VLAN_CAPABILITIES(ifp);
1774 		break;
1775 	case SIOCGIFMEDIA:
1776 	case SIOCSIFMEDIA:
1777 		error = ifmedia_ioctl(ifp, ifr, &sc->sc_ifmedia, command);
1778 		break;
1779 	default:
1780 		error = ether_ioctl(ifp, command, data);
1781 		break;
1782 	}
1783 
1784 	return (error);
1785 }
1786 
1787 static int
1788 txp_rxring_fill(struct txp_softc *sc)
1789 {
1790 	struct txp_rxbuf_desc *rbd;
1791 	struct txp_rx_swdesc *sd;
1792 	bus_dma_segment_t segs[1];
1793 	int error, i, nsegs;
1794 
1795 	TXP_LOCK_ASSERT(sc);
1796 
1797 	bus_dmamap_sync(sc->sc_cdata.txp_rxbufs_tag,
1798 	    sc->sc_cdata.txp_rxbufs_map,
1799 	    BUS_DMASYNC_POSTREAD | BUS_DMASYNC_POSTWRITE);
1800 
1801 	for (i = 0; i < RXBUF_ENTRIES; i++) {
1802 		sd = TAILQ_FIRST(&sc->sc_free_list);
1803 		if (sd == NULL)
1804 			return (ENOMEM);
1805 		rbd = sc->sc_rxbufs + i;
1806 		bcopy(&sd, (u_long *)&rbd->rb_vaddrlo, sizeof(sd));
1807 		KASSERT(sd->sd_mbuf == NULL,
1808 		    ("%s : Rx buffer ring corrupted", __func__));
1809 		sd->sd_mbuf = m_getcl(M_NOWAIT, MT_DATA, M_PKTHDR);
1810 		if (sd->sd_mbuf == NULL)
1811 			return (ENOMEM);
1812 		sd->sd_mbuf->m_pkthdr.len = sd->sd_mbuf->m_len = MCLBYTES;
1813 #ifndef __NO_STRICT_ALIGNMENT
1814 		m_adj(sd->sd_mbuf, TXP_RXBUF_ALIGN);
1815 #endif
1816 		if ((error = bus_dmamap_load_mbuf_sg(sc->sc_cdata.txp_rx_tag,
1817 		    sd->sd_map, sd->sd_mbuf, segs, &nsegs, 0)) != 0) {
1818 			m_freem(sd->sd_mbuf);
1819 			sd->sd_mbuf = NULL;
1820 			return (error);
1821 		}
1822 		KASSERT(nsegs == 1, ("%s : %d segments returned!", __func__,
1823 		    nsegs));
1824 		TAILQ_REMOVE(&sc->sc_free_list, sd, sd_next);
1825 		TAILQ_INSERT_TAIL(&sc->sc_busy_list, sd, sd_next);
1826 		bus_dmamap_sync(sc->sc_cdata.txp_rx_tag, sd->sd_map,
1827 		    BUS_DMASYNC_PREREAD);
1828 		rbd->rb_paddrlo = htole32(TXP_ADDR_LO(segs[0].ds_addr));
1829 		rbd->rb_paddrhi = htole32(TXP_ADDR_HI(segs[0].ds_addr));
1830 	}
1831 
1832 	bus_dmamap_sync(sc->sc_cdata.txp_rxbufs_tag,
1833 	    sc->sc_cdata.txp_rxbufs_map,
1834 	    BUS_DMASYNC_PREREAD | BUS_DMASYNC_PREWRITE);
1835 	sc->sc_rxbufprod = RXBUF_ENTRIES - 1;
1836 	sc->sc_hostvar->hv_rx_buf_write_idx =
1837 	    htole32(TXP_IDX2OFFSET(RXBUF_ENTRIES - 1));
1838 
1839 	return (0);
1840 }
1841 
1842 static void
1843 txp_rxring_empty(struct txp_softc *sc)
1844 {
1845 	struct txp_rx_swdesc *sd;
1846 	int cnt;
1847 
1848 	TXP_LOCK_ASSERT(sc);
1849 
1850 	if (sc->sc_rxbufs == NULL)
1851 		return;
1852 	bus_dmamap_sync(sc->sc_cdata.txp_hostvar_tag,
1853 	    sc->sc_cdata.txp_hostvar_map,
1854 	    BUS_DMASYNC_POSTREAD | BUS_DMASYNC_POSTWRITE);
1855 
1856 	/* Release allocated Rx buffers. */
1857 	cnt = 0;
1858 	while ((sd = TAILQ_FIRST(&sc->sc_busy_list)) != NULL) {
1859 		TAILQ_REMOVE(&sc->sc_busy_list, sd, sd_next);
1860 		KASSERT(sd->sd_mbuf != NULL,
1861 		    ("%s : Rx buffer ring corrupted", __func__));
1862 		bus_dmamap_sync(sc->sc_cdata.txp_rx_tag, sd->sd_map,
1863 		    BUS_DMASYNC_POSTREAD);
1864 		bus_dmamap_unload(sc->sc_cdata.txp_rx_tag, sd->sd_map);
1865 		m_freem(sd->sd_mbuf);
1866 		sd->sd_mbuf = NULL;
1867 		TAILQ_INSERT_TAIL(&sc->sc_free_list, sd, sd_next);
1868 		cnt++;
1869 	}
1870 }
1871 
1872 static void
1873 txp_init(void *xsc)
1874 {
1875 	struct txp_softc *sc;
1876 
1877 	sc = xsc;
1878 	TXP_LOCK(sc);
1879 	txp_init_locked(sc);
1880 	TXP_UNLOCK(sc);
1881 }
1882 
1883 static void
1884 txp_init_locked(struct txp_softc *sc)
1885 {
1886 	struct ifnet *ifp;
1887 	uint8_t *eaddr;
1888 	uint16_t p1;
1889 	uint32_t p2;
1890 	int error;
1891 
1892 	TXP_LOCK_ASSERT(sc);
1893 	ifp = sc->sc_ifp;
1894 
1895 	if ((ifp->if_drv_flags & IFF_DRV_RUNNING) != 0)
1896 		return;
1897 
1898 	/* Initialize ring structure. */
1899 	txp_init_rings(sc);
1900 	/* Wakeup controller. */
1901 	WRITE_REG(sc, TXP_H2A_0, TXP_BOOTCMD_WAKEUP);
1902 	TXP_BARRIER(sc, TXP_H2A_0, 4, BUS_SPACE_BARRIER_WRITE);
1903 	/*
1904 	 * It seems that earlier NV image can go back to online from
1905 	 * wakeup command but newer ones require controller reset.
1906 	 * So jut reset controller again.
1907 	 */
1908 	if (txp_reset(sc) != 0)
1909 		goto init_fail;
1910 	/* Download firmware. */
1911 	error = txp_download_fw(sc);
1912 	if (error != 0) {
1913 		device_printf(sc->sc_dev, "could not download firmware.\n");
1914 		goto init_fail;
1915 	}
1916 	bus_dmamap_sync(sc->sc_cdata.txp_hostvar_tag,
1917 	    sc->sc_cdata.txp_hostvar_map,
1918 	    BUS_DMASYNC_POSTREAD | BUS_DMASYNC_POSTWRITE);
1919 	if ((error = txp_rxring_fill(sc)) != 0) {
1920 		device_printf(sc->sc_dev, "no memory for Rx buffers.\n");
1921 		goto init_fail;
1922 	}
1923 	bus_dmamap_sync(sc->sc_cdata.txp_hostvar_tag,
1924 	    sc->sc_cdata.txp_hostvar_map,
1925 	    BUS_DMASYNC_PREREAD | BUS_DMASYNC_PREWRITE);
1926 	if (txp_boot(sc, STAT_WAITING_FOR_BOOT) != 0) {
1927 		device_printf(sc->sc_dev, "could not boot firmware.\n");
1928 		goto init_fail;
1929 	}
1930 
1931 	/*
1932 	 * Quite contrary to Typhoon T2 software functional specification,
1933 	 * it seems that TXP_CMD_RECV_BUFFER_CONTROL command is not
1934 	 * implemented in the firmware. This means driver should have to
1935 	 * handle misaligned frames on alignment architectures. AFAIK this
1936 	 * is the only controller manufactured by 3Com that has this stupid
1937 	 * bug. 3Com should fix this.
1938 	 */
1939 	if (txp_command(sc, TXP_CMD_MAX_PKT_SIZE_WRITE, TXP_MAX_PKTLEN, 0, 0,
1940 	    NULL, NULL, NULL, TXP_CMD_NOWAIT) != 0)
1941 		goto init_fail;
1942 	/* Undocumented command(interrupt coalescing disable?) - From Linux. */
1943 	if (txp_command(sc, TXP_CMD_FILTER_DEFINE, 0, 0, 0, NULL, NULL, NULL,
1944 	    TXP_CMD_NOWAIT) != 0)
1945 		goto init_fail;
1946 
1947 	/* Set station address. */
1948 	eaddr = IF_LLADDR(sc->sc_ifp);
1949 	p1 = 0;
1950 	((uint8_t *)&p1)[1] = eaddr[0];
1951 	((uint8_t *)&p1)[0] = eaddr[1];
1952 	p1 = le16toh(p1);
1953 	((uint8_t *)&p2)[3] = eaddr[2];
1954 	((uint8_t *)&p2)[2] = eaddr[3];
1955 	((uint8_t *)&p2)[1] = eaddr[4];
1956 	((uint8_t *)&p2)[0] = eaddr[5];
1957 	p2 = le32toh(p2);
1958 	if (txp_command(sc, TXP_CMD_STATION_ADDRESS_WRITE, p1, p2, 0,
1959 	    NULL, NULL, NULL, TXP_CMD_NOWAIT) != 0)
1960 		goto init_fail;
1961 
1962 	txp_set_filter(sc);
1963 	txp_set_capabilities(sc);
1964 
1965 	if (txp_command(sc, TXP_CMD_CLEAR_STATISTICS, 0, 0, 0,
1966 	    NULL, NULL, NULL, TXP_CMD_NOWAIT))
1967 		goto init_fail;
1968 	if (txp_command(sc, TXP_CMD_XCVR_SELECT, sc->sc_xcvr, 0, 0,
1969 	    NULL, NULL, NULL, TXP_CMD_NOWAIT) != 0)
1970 		goto init_fail;
1971 	if (txp_command(sc, TXP_CMD_TX_ENABLE, 0, 0, 0, NULL, NULL, NULL,
1972 	    TXP_CMD_NOWAIT) != 0)
1973 		goto init_fail;
1974 	if (txp_command(sc, TXP_CMD_RX_ENABLE, 0, 0, 0, NULL, NULL, NULL,
1975 	    TXP_CMD_NOWAIT) != 0)
1976 		goto init_fail;
1977 
1978 	/* Ack all pending interrupts and enable interrupts. */
1979 	WRITE_REG(sc, TXP_ISR, TXP_INTR_ALL);
1980 	WRITE_REG(sc, TXP_IER, TXP_INTRS);
1981 	WRITE_REG(sc, TXP_IMR, TXP_INTR_NONE);
1982 
1983 	ifp->if_drv_flags |= IFF_DRV_RUNNING;
1984 	ifp->if_drv_flags &= ~IFF_DRV_OACTIVE;
1985 
1986 	callout_reset(&sc->sc_tick, hz, txp_tick, sc);
1987 	return;
1988 
1989 init_fail:
1990 	txp_rxring_empty(sc);
1991 	txp_init_rings(sc);
1992 	txp_reset(sc);
1993 	WRITE_REG(sc, TXP_IMR, TXP_INTR_ALL);
1994 }
1995 
1996 static void
1997 txp_tick(void *vsc)
1998 {
1999 	struct txp_softc *sc;
2000 	struct ifnet *ifp;
2001 	struct txp_rsp_desc *rsp;
2002 	struct txp_ext_desc *ext;
2003 	int link;
2004 
2005 	sc = vsc;
2006 	TXP_LOCK_ASSERT(sc);
2007 	bus_dmamap_sync(sc->sc_cdata.txp_hostvar_tag,
2008 	    sc->sc_cdata.txp_hostvar_map,
2009 	    BUS_DMASYNC_POSTREAD | BUS_DMASYNC_POSTWRITE);
2010 	txp_rxbuf_reclaim(sc);
2011 	bus_dmamap_sync(sc->sc_cdata.txp_hostvar_tag,
2012 	    sc->sc_cdata.txp_hostvar_map,
2013 	    BUS_DMASYNC_PREREAD | BUS_DMASYNC_PREWRITE);
2014 
2015 	ifp = sc->sc_ifp;
2016 	rsp = NULL;
2017 
2018 	link = sc->sc_flags & TXP_FLAG_LINK;
2019 	if (txp_ext_command(sc, TXP_CMD_READ_STATISTICS, 0, 0, 0, NULL, 0,
2020 	    &rsp, TXP_CMD_WAIT))
2021 		goto out;
2022 	if (rsp->rsp_numdesc != 6)
2023 		goto out;
2024 	txp_stats_update(sc, rsp);
2025 	if (link == 0 && (sc->sc_flags & TXP_FLAG_LINK) != 0) {
2026 		ext = (struct txp_ext_desc *)(rsp + 1);
2027 		/* Update baudrate with resolved speed. */
2028 		if ((ext[5].ext_2 & 0x02) != 0)
2029 			ifp->if_baudrate = IF_Mbps(100);
2030 		else
2031 			ifp->if_baudrate = IF_Mbps(10);
2032 	}
2033 
2034 out:
2035 	if (rsp != NULL)
2036 		free(rsp, M_DEVBUF);
2037 	txp_watchdog(sc);
2038 	callout_reset(&sc->sc_tick, hz, txp_tick, sc);
2039 }
2040 
2041 static void
2042 txp_start(struct ifnet *ifp)
2043 {
2044 	struct txp_softc *sc;
2045 
2046 	sc = ifp->if_softc;
2047 	TXP_LOCK(sc);
2048 	txp_start_locked(ifp);
2049 	TXP_UNLOCK(sc);
2050 }
2051 
2052 static void
2053 txp_start_locked(struct ifnet *ifp)
2054 {
2055 	struct txp_softc *sc;
2056 	struct mbuf *m_head;
2057 	int enq;
2058 
2059 	sc = ifp->if_softc;
2060 	TXP_LOCK_ASSERT(sc);
2061 
2062 	if ((ifp->if_drv_flags & (IFF_DRV_RUNNING | IFF_DRV_OACTIVE)) !=
2063 	   IFF_DRV_RUNNING || (sc->sc_flags & TXP_FLAG_LINK) == 0)
2064 		return;
2065 
2066 	for (enq = 0; !IFQ_DRV_IS_EMPTY(&ifp->if_snd); ) {
2067 		IFQ_DRV_DEQUEUE(&ifp->if_snd, m_head);
2068 		if (m_head == NULL)
2069 			break;
2070 		/*
2071 		 * Pack the data into the transmit ring. If we
2072 		 * don't have room, set the OACTIVE flag and wait
2073 		 * for the NIC to drain the ring.
2074 		 * ATM only Hi-ring is used.
2075 		 */
2076 		if (txp_encap(sc, &sc->sc_txhir, &m_head)) {
2077 			if (m_head == NULL)
2078 				break;
2079 			IFQ_DRV_PREPEND(&ifp->if_snd, m_head);
2080 			ifp->if_drv_flags |= IFF_DRV_OACTIVE;
2081 			break;
2082 		}
2083 
2084 		/*
2085 		 * If there's a BPF listener, bounce a copy of this frame
2086 		 * to him.
2087 		 */
2088 		ETHER_BPF_MTAP(ifp, m_head);
2089 
2090 		/* Send queued frame. */
2091 		WRITE_REG(sc, sc->sc_txhir.r_reg,
2092 		    TXP_IDX2OFFSET(sc->sc_txhir.r_prod));
2093 	}
2094 
2095 	if (enq > 0) {
2096 		/* Set a timeout in case the chip goes out to lunch. */
2097 		sc->sc_watchdog_timer = TXP_TX_TIMEOUT;
2098 	}
2099 }
2100 
2101 static int
2102 txp_encap(struct txp_softc *sc, struct txp_tx_ring *r, struct mbuf **m_head)
2103 {
2104 	struct txp_tx_desc *first_txd;
2105 	struct txp_frag_desc *fxd;
2106 	struct txp_swdesc *sd;
2107 	struct mbuf *m;
2108 	bus_dma_segment_t txsegs[TXP_MAXTXSEGS];
2109 	int error, i, nsegs;
2110 
2111 	TXP_LOCK_ASSERT(sc);
2112 
2113 	M_ASSERTPKTHDR((*m_head));
2114 
2115 	m = *m_head;
2116 	first_txd = r->r_desc + r->r_prod;
2117 	sd = sc->sc_txd + r->r_prod;
2118 
2119 	error = bus_dmamap_load_mbuf_sg(sc->sc_cdata.txp_tx_tag, sd->sd_map,
2120 	    *m_head, txsegs, &nsegs, 0);
2121 	if (error == EFBIG) {
2122 		m = m_collapse(*m_head, M_NOWAIT, TXP_MAXTXSEGS);
2123 		if (m == NULL) {
2124 			m_freem(*m_head);
2125 			*m_head = NULL;
2126 			return (ENOMEM);
2127 		}
2128 		*m_head = m;
2129 		error = bus_dmamap_load_mbuf_sg(sc->sc_cdata.txp_tx_tag,
2130 		    sd->sd_map, *m_head, txsegs, &nsegs, 0);
2131 		if (error != 0) {
2132 			m_freem(*m_head);
2133 			*m_head = NULL;
2134 			return (error);
2135 		}
2136 	} else if (error != 0)
2137 		return (error);
2138 	if (nsegs == 0) {
2139 		m_freem(*m_head);
2140 		*m_head = NULL;
2141 		return (EIO);
2142 	}
2143 
2144 	/* Check descriptor overrun. */
2145 	if (r->r_cnt + nsegs >= TX_ENTRIES - TXP_TXD_RESERVED) {
2146 		bus_dmamap_unload(sc->sc_cdata.txp_tx_tag, sd->sd_map);
2147 		return (ENOBUFS);
2148 	}
2149 	bus_dmamap_sync(sc->sc_cdata.txp_tx_tag, sd->sd_map,
2150 	    BUS_DMASYNC_PREWRITE);
2151 	sd->sd_mbuf = m;
2152 
2153 	first_txd->tx_flags = TX_FLAGS_TYPE_DATA;
2154 	first_txd->tx_numdesc = 0;
2155 	first_txd->tx_addrlo = 0;
2156 	first_txd->tx_addrhi = 0;
2157 	first_txd->tx_totlen = 0;
2158 	first_txd->tx_pflags = 0;
2159 	r->r_cnt++;
2160 	TXP_DESC_INC(r->r_prod, TX_ENTRIES);
2161 
2162 	/* Configure Tx IP/TCP/UDP checksum offload. */
2163 	if ((m->m_pkthdr.csum_flags & CSUM_IP) != 0)
2164 		first_txd->tx_pflags |= htole32(TX_PFLAGS_IPCKSUM);
2165 #ifdef notyet
2166 	/* XXX firmware bug. */
2167 	if ((m->m_pkthdr.csum_flags & CSUM_TCP) != 0)
2168 		first_txd->tx_pflags |= htole32(TX_PFLAGS_TCPCKSUM);
2169 	if ((m->m_pkthdr.csum_flags & CSUM_UDP) != 0)
2170 		first_txd->tx_pflags |= htole32(TX_PFLAGS_UDPCKSUM);
2171 #endif
2172 
2173 	/* Configure VLAN hardware tag insertion. */
2174 	if ((m->m_flags & M_VLANTAG) != 0)
2175 		first_txd->tx_pflags |=
2176 		    htole32(TX_PFLAGS_VLAN | TX_PFLAGS_PRIO |
2177 		    (bswap16(m->m_pkthdr.ether_vtag) << TX_PFLAGS_VLANTAG_S));
2178 
2179 	for (i = 0; i < nsegs; i++) {
2180 		fxd = (struct txp_frag_desc *)(r->r_desc + r->r_prod);
2181 		fxd->frag_flags = FRAG_FLAGS_TYPE_FRAG | TX_FLAGS_VALID;
2182 		fxd->frag_rsvd1 = 0;
2183 		fxd->frag_len = htole16(txsegs[i].ds_len);
2184 		fxd->frag_addrhi = htole32(TXP_ADDR_HI(txsegs[i].ds_addr));
2185 		fxd->frag_addrlo = htole32(TXP_ADDR_LO(txsegs[i].ds_addr));
2186 		fxd->frag_rsvd2 = 0;
2187 		first_txd->tx_numdesc++;
2188 		r->r_cnt++;
2189 		TXP_DESC_INC(r->r_prod, TX_ENTRIES);
2190 	}
2191 
2192 	/* Lastly set valid flag. */
2193 	first_txd->tx_flags |= TX_FLAGS_VALID;
2194 
2195 	/* Sync descriptors. */
2196 	bus_dmamap_sync(r->r_tag, r->r_map,
2197 	    BUS_DMASYNC_PREREAD | BUS_DMASYNC_PREWRITE);
2198 
2199 	return (0);
2200 }
2201 
2202 /*
2203  * Handle simple commands sent to the typhoon
2204  */
2205 static int
2206 txp_command(struct txp_softc *sc, uint16_t id, uint16_t in1, uint32_t in2,
2207     uint32_t in3, uint16_t *out1, uint32_t *out2, uint32_t *out3, int wait)
2208 {
2209 	struct txp_rsp_desc *rsp;
2210 
2211 	rsp = NULL;
2212 	if (txp_ext_command(sc, id, in1, in2, in3, NULL, 0, &rsp, wait) != 0) {
2213 		device_printf(sc->sc_dev, "command 0x%02x failed\n", id);
2214 		return (-1);
2215 	}
2216 
2217 	if (wait == TXP_CMD_NOWAIT)
2218 		return (0);
2219 
2220 	KASSERT(rsp != NULL, ("rsp is NULL!\n"));
2221 	if (out1 != NULL)
2222 		*out1 = le16toh(rsp->rsp_par1);
2223 	if (out2 != NULL)
2224 		*out2 = le32toh(rsp->rsp_par2);
2225 	if (out3 != NULL)
2226 		*out3 = le32toh(rsp->rsp_par3);
2227 	free(rsp, M_DEVBUF);
2228 	return (0);
2229 }
2230 
2231 static int
2232 txp_ext_command(struct txp_softc *sc, uint16_t id, uint16_t in1, uint32_t in2,
2233     uint32_t in3, struct txp_ext_desc *in_extp, uint8_t in_extn,
2234     struct txp_rsp_desc **rspp, int wait)
2235 {
2236 	struct txp_hostvar *hv;
2237 	struct txp_cmd_desc *cmd;
2238 	struct txp_ext_desc *ext;
2239 	uint32_t idx, i;
2240 	uint16_t seq;
2241 	int error;
2242 
2243 	error = 0;
2244 	hv = sc->sc_hostvar;
2245 	if (txp_cmd_desc_numfree(sc) < (in_extn + 1)) {
2246 		device_printf(sc->sc_dev,
2247 		    "%s : out of free cmd descriptors for command 0x%02x\n",
2248 		    __func__, id);
2249 		return (ENOBUFS);
2250 	}
2251 
2252 	bus_dmamap_sync(sc->sc_cdata.txp_cmdring_tag,
2253 	    sc->sc_cdata.txp_cmdring_map, BUS_DMASYNC_POSTWRITE);
2254 	idx = sc->sc_cmdring.lastwrite;
2255 	cmd = (struct txp_cmd_desc *)(((uint8_t *)sc->sc_cmdring.base) + idx);
2256 	bzero(cmd, sizeof(*cmd));
2257 
2258 	cmd->cmd_numdesc = in_extn;
2259 	seq = sc->sc_seq++;
2260 	cmd->cmd_seq = htole16(seq);
2261 	cmd->cmd_id = htole16(id);
2262 	cmd->cmd_par1 = htole16(in1);
2263 	cmd->cmd_par2 = htole32(in2);
2264 	cmd->cmd_par3 = htole32(in3);
2265 	cmd->cmd_flags = CMD_FLAGS_TYPE_CMD |
2266 	    (wait == TXP_CMD_WAIT ? CMD_FLAGS_RESP : 0) | CMD_FLAGS_VALID;
2267 
2268 	idx += sizeof(struct txp_cmd_desc);
2269 	if (idx == sc->sc_cmdring.size)
2270 		idx = 0;
2271 
2272 	for (i = 0; i < in_extn; i++) {
2273 		ext = (struct txp_ext_desc *)(((uint8_t *)sc->sc_cmdring.base) + idx);
2274 		bcopy(in_extp, ext, sizeof(struct txp_ext_desc));
2275 		in_extp++;
2276 		idx += sizeof(struct txp_cmd_desc);
2277 		if (idx == sc->sc_cmdring.size)
2278 			idx = 0;
2279 	}
2280 
2281 	sc->sc_cmdring.lastwrite = idx;
2282 	bus_dmamap_sync(sc->sc_cdata.txp_cmdring_tag,
2283 	    sc->sc_cdata.txp_cmdring_map, BUS_DMASYNC_PREWRITE);
2284 	bus_dmamap_sync(sc->sc_cdata.txp_hostvar_tag,
2285 	    sc->sc_cdata.txp_hostvar_map, BUS_DMASYNC_PREREAD |
2286 	    BUS_DMASYNC_PREWRITE);
2287 	WRITE_REG(sc, TXP_H2A_2, sc->sc_cmdring.lastwrite);
2288 	TXP_BARRIER(sc, TXP_H2A_2, 4, BUS_SPACE_BARRIER_WRITE);
2289 
2290 	if (wait == TXP_CMD_NOWAIT)
2291 		return (0);
2292 
2293 	for (i = 0; i < TXP_TIMEOUT; i++) {
2294 		bus_dmamap_sync(sc->sc_cdata.txp_hostvar_tag,
2295 		    sc->sc_cdata.txp_hostvar_map, BUS_DMASYNC_POSTREAD |
2296 		    BUS_DMASYNC_POSTWRITE);
2297 		if (le32toh(hv->hv_resp_read_idx) !=
2298 		    le32toh(hv->hv_resp_write_idx)) {
2299 			error = txp_response(sc, id, seq, rspp);
2300 			bus_dmamap_sync(sc->sc_cdata.txp_hostvar_tag,
2301 			    sc->sc_cdata.txp_hostvar_map,
2302 			    BUS_DMASYNC_PREREAD | BUS_DMASYNC_PREWRITE);
2303 			if (error != 0)
2304 				return (error);
2305  			if (*rspp != NULL)
2306 				break;
2307 		}
2308 		DELAY(50);
2309 	}
2310 	if (i == TXP_TIMEOUT) {
2311 		device_printf(sc->sc_dev, "command 0x%02x timedout\n", id);
2312 		error = ETIMEDOUT;
2313 	}
2314 
2315 	return (error);
2316 }
2317 
2318 static int
2319 txp_response(struct txp_softc *sc, uint16_t id, uint16_t seq,
2320     struct txp_rsp_desc **rspp)
2321 {
2322 	struct txp_hostvar *hv;
2323 	struct txp_rsp_desc *rsp;
2324 	uint32_t ridx;
2325 
2326 	bus_dmamap_sync(sc->sc_cdata.txp_rspring_tag,
2327 	    sc->sc_cdata.txp_rspring_map, BUS_DMASYNC_POSTREAD);
2328 	hv = sc->sc_hostvar;
2329 	ridx = le32toh(hv->hv_resp_read_idx);
2330 	while (ridx != le32toh(hv->hv_resp_write_idx)) {
2331 		rsp = (struct txp_rsp_desc *)(((uint8_t *)sc->sc_rspring.base) + ridx);
2332 
2333 		if (id == le16toh(rsp->rsp_id) &&
2334 		    le16toh(rsp->rsp_seq) == seq) {
2335 			*rspp = (struct txp_rsp_desc *)malloc(
2336 			    sizeof(struct txp_rsp_desc) * (rsp->rsp_numdesc + 1),
2337 			    M_DEVBUF, M_NOWAIT);
2338 			if (*rspp == NULL) {
2339 				device_printf(sc->sc_dev,"%s : command 0x%02x "
2340 				    "memory allocation failure\n",
2341 				    __func__, id);
2342 				return (ENOMEM);
2343 			}
2344 			txp_rsp_fixup(sc, rsp, *rspp);
2345 			return (0);
2346 		}
2347 
2348 		if ((rsp->rsp_flags & RSP_FLAGS_ERROR) != 0) {
2349 			device_printf(sc->sc_dev,
2350 			    "%s : command 0x%02x response error!\n", __func__,
2351 			    le16toh(rsp->rsp_id));
2352 			txp_rsp_fixup(sc, rsp, NULL);
2353 			ridx = le32toh(hv->hv_resp_read_idx);
2354 			continue;
2355 		}
2356 
2357 		/*
2358 		 * The following unsolicited responses are handled during
2359 		 * processing of TXP_CMD_READ_STATISTICS which requires
2360 		 * response. Driver abuses the command to detect media
2361 		 * status change.
2362 		 * TXP_CMD_FILTER_DEFINE is not an unsolicited response
2363 		 * but we don't process response ring in interrupt handler
2364 		 * so we have to ignore this command here, otherwise
2365 		 * unknown command message would be printed.
2366 		 */
2367 		switch (le16toh(rsp->rsp_id)) {
2368 		case TXP_CMD_CYCLE_STATISTICS:
2369 		case TXP_CMD_FILTER_DEFINE:
2370 			break;
2371 		case TXP_CMD_MEDIA_STATUS_READ:
2372 			if ((le16toh(rsp->rsp_par1) & 0x0800) == 0) {
2373 				sc->sc_flags |= TXP_FLAG_LINK;
2374 				if_link_state_change(sc->sc_ifp,
2375 				    LINK_STATE_UP);
2376 			} else {
2377 				sc->sc_flags &= ~TXP_FLAG_LINK;
2378 				if_link_state_change(sc->sc_ifp,
2379 				    LINK_STATE_DOWN);
2380 			}
2381 			break;
2382 		case TXP_CMD_HELLO_RESPONSE:
2383 			/*
2384 			 * Driver should repsond to hello message but
2385 			 * TXP_CMD_READ_STATISTICS is issued for every
2386 			 * hz, therefore there is no need to send an
2387 			 * explicit command here.
2388 			 */
2389 			device_printf(sc->sc_dev, "%s : hello\n", __func__);
2390 			break;
2391 		default:
2392 			device_printf(sc->sc_dev,
2393 			    "%s : unknown command 0x%02x\n", __func__,
2394 			    le16toh(rsp->rsp_id));
2395 		}
2396 		txp_rsp_fixup(sc, rsp, NULL);
2397 		ridx = le32toh(hv->hv_resp_read_idx);
2398 	}
2399 
2400 	return (0);
2401 }
2402 
2403 static void
2404 txp_rsp_fixup(struct txp_softc *sc, struct txp_rsp_desc *rsp,
2405     struct txp_rsp_desc *dst)
2406 {
2407 	struct txp_rsp_desc *src;
2408 	struct txp_hostvar *hv;
2409 	uint32_t i, ridx;
2410 
2411 	src = rsp;
2412 	hv = sc->sc_hostvar;
2413 	ridx = le32toh(hv->hv_resp_read_idx);
2414 
2415 	for (i = 0; i < rsp->rsp_numdesc + 1; i++) {
2416 		if (dst != NULL)
2417 			bcopy(src, dst++, sizeof(struct txp_rsp_desc));
2418 		ridx += sizeof(struct txp_rsp_desc);
2419 		if (ridx == sc->sc_rspring.size) {
2420 			src = sc->sc_rspring.base;
2421 			ridx = 0;
2422 		} else
2423 			src++;
2424 		sc->sc_rspring.lastwrite = ridx;
2425 	}
2426 
2427 	hv->hv_resp_read_idx = htole32(ridx);
2428 }
2429 
2430 static int
2431 txp_cmd_desc_numfree(struct txp_softc *sc)
2432 {
2433 	struct txp_hostvar *hv;
2434 	struct txp_boot_record *br;
2435 	uint32_t widx, ridx, nfree;
2436 
2437 	bus_dmamap_sync(sc->sc_cdata.txp_hostvar_tag,
2438 	    sc->sc_cdata.txp_hostvar_map,
2439 	    BUS_DMASYNC_POSTREAD | BUS_DMASYNC_POSTWRITE);
2440 	hv = sc->sc_hostvar;
2441 	br = sc->sc_boot;
2442 	widx = sc->sc_cmdring.lastwrite;
2443 	ridx = le32toh(hv->hv_cmd_read_idx);
2444 
2445 	if (widx == ridx) {
2446 		/* Ring is completely free */
2447 		nfree = le32toh(br->br_cmd_siz) - sizeof(struct txp_cmd_desc);
2448 	} else {
2449 		if (widx > ridx)
2450 			nfree = le32toh(br->br_cmd_siz) -
2451 			    (widx - ridx + sizeof(struct txp_cmd_desc));
2452 		else
2453 			nfree = ridx - widx - sizeof(struct txp_cmd_desc);
2454 	}
2455 
2456 	return (nfree / sizeof(struct txp_cmd_desc));
2457 }
2458 
2459 static int
2460 txp_sleep(struct txp_softc *sc, int capenable)
2461 {
2462 	uint16_t events;
2463 	int error;
2464 
2465 	events = 0;
2466 	if ((capenable & IFCAP_WOL_MAGIC) != 0)
2467 		events |= 0x01;
2468 	error = txp_command(sc, TXP_CMD_ENABLE_WAKEUP_EVENTS, events, 0, 0,
2469 	    NULL, NULL, NULL, TXP_CMD_NOWAIT);
2470 	if (error == 0) {
2471 		/* Goto sleep. */
2472 		error = txp_command(sc, TXP_CMD_GOTO_SLEEP, 0, 0, 0, NULL,
2473 		    NULL, NULL, TXP_CMD_NOWAIT);
2474 		if (error == 0) {
2475 			error = txp_wait(sc, STAT_SLEEPING);
2476 			if (error != 0)
2477 				device_printf(sc->sc_dev,
2478 				    "unable to enter into sleep\n");
2479 		}
2480 	}
2481 
2482 	return (error);
2483 }
2484 
2485 static void
2486 txp_stop(struct txp_softc *sc)
2487 {
2488 	struct ifnet *ifp;
2489 
2490 	TXP_LOCK_ASSERT(sc);
2491 	ifp = sc->sc_ifp;
2492 
2493 	if ((ifp->if_drv_flags & IFF_DRV_RUNNING) == 0)
2494 		return;
2495 
2496 	WRITE_REG(sc, TXP_IER, TXP_INTR_NONE);
2497 	WRITE_REG(sc, TXP_ISR, TXP_INTR_ALL);
2498 
2499 	ifp->if_drv_flags &= ~(IFF_DRV_RUNNING | IFF_DRV_OACTIVE);
2500 	sc->sc_flags &= ~TXP_FLAG_LINK;
2501 
2502 	callout_stop(&sc->sc_tick);
2503 
2504 	txp_command(sc, TXP_CMD_TX_DISABLE, 0, 0, 0, NULL, NULL, NULL,
2505 	    TXP_CMD_NOWAIT);
2506 	txp_command(sc, TXP_CMD_RX_DISABLE, 0, 0, 0, NULL, NULL, NULL,
2507 	    TXP_CMD_NOWAIT);
2508 	/* Save statistics for later use. */
2509 	txp_stats_save(sc);
2510 	/* Halt controller. */
2511 	txp_command(sc, TXP_CMD_HALT, 0, 0, 0, NULL, NULL, NULL,
2512 	    TXP_CMD_NOWAIT);
2513 
2514 	if (txp_wait(sc, STAT_HALTED) != 0)
2515 		device_printf(sc->sc_dev, "controller halt timedout!\n");
2516 	/* Reclaim Tx/Rx buffers. */
2517 	if (sc->sc_txhir.r_cnt && (sc->sc_txhir.r_cons !=
2518 	    TXP_OFFSET2IDX(le32toh(*(sc->sc_txhir.r_off)))))
2519 		txp_tx_reclaim(sc, &sc->sc_txhir);
2520 	if (sc->sc_txlor.r_cnt && (sc->sc_txlor.r_cons !=
2521 	    TXP_OFFSET2IDX(le32toh(*(sc->sc_txlor.r_off)))))
2522 		txp_tx_reclaim(sc, &sc->sc_txlor);
2523 	txp_rxring_empty(sc);
2524 
2525 	txp_init_rings(sc);
2526 	/* Reset controller and make it reload sleep image. */
2527 	txp_reset(sc);
2528 	/* Let controller boot from sleep image. */
2529 	if (txp_boot(sc, STAT_WAITING_FOR_HOST_REQUEST) != 0)
2530 		device_printf(sc->sc_dev, "could not boot sleep image\n");
2531 	txp_sleep(sc, 0);
2532 }
2533 
2534 static void
2535 txp_watchdog(struct txp_softc *sc)
2536 {
2537 	struct ifnet *ifp;
2538 
2539 	TXP_LOCK_ASSERT(sc);
2540 
2541 	if (sc->sc_watchdog_timer == 0 || --sc->sc_watchdog_timer)
2542 		return;
2543 
2544 	ifp = sc->sc_ifp;
2545 	if_printf(ifp, "watchdog timeout -- resetting\n");
2546 	if_inc_counter(ifp, IFCOUNTER_OERRORS, 1);
2547 	txp_stop(sc);
2548 	txp_init_locked(sc);
2549 }
2550 
2551 static int
2552 txp_ifmedia_upd(struct ifnet *ifp)
2553 {
2554 	struct txp_softc *sc = ifp->if_softc;
2555 	struct ifmedia *ifm = &sc->sc_ifmedia;
2556 	uint16_t new_xcvr;
2557 
2558 	TXP_LOCK(sc);
2559 	if (IFM_TYPE(ifm->ifm_media) != IFM_ETHER) {
2560 		TXP_UNLOCK(sc);
2561 		return (EINVAL);
2562 	}
2563 
2564 	if (IFM_SUBTYPE(ifm->ifm_media) == IFM_10_T) {
2565 		if ((ifm->ifm_media & IFM_GMASK) == IFM_FDX)
2566 			new_xcvr = TXP_XCVR_10_FDX;
2567 		else
2568 			new_xcvr = TXP_XCVR_10_HDX;
2569 	} else if (IFM_SUBTYPE(ifm->ifm_media) == IFM_100_TX) {
2570 		if ((ifm->ifm_media & IFM_GMASK) == IFM_FDX)
2571 			new_xcvr = TXP_XCVR_100_FDX;
2572 		else
2573 			new_xcvr = TXP_XCVR_100_HDX;
2574 	} else if (IFM_SUBTYPE(ifm->ifm_media) == IFM_AUTO) {
2575 		new_xcvr = TXP_XCVR_AUTO;
2576 	} else {
2577 		TXP_UNLOCK(sc);
2578 		return (EINVAL);
2579 	}
2580 
2581 	/* nothing to do */
2582 	if (sc->sc_xcvr == new_xcvr) {
2583 		TXP_UNLOCK(sc);
2584 		return (0);
2585 	}
2586 
2587 	txp_command(sc, TXP_CMD_XCVR_SELECT, new_xcvr, 0, 0,
2588 	    NULL, NULL, NULL, TXP_CMD_NOWAIT);
2589 	sc->sc_xcvr = new_xcvr;
2590 	TXP_UNLOCK(sc);
2591 
2592 	return (0);
2593 }
2594 
2595 static void
2596 txp_ifmedia_sts(struct ifnet *ifp, struct ifmediareq *ifmr)
2597 {
2598 	struct txp_softc *sc = ifp->if_softc;
2599 	struct ifmedia *ifm = &sc->sc_ifmedia;
2600 	uint16_t bmsr, bmcr, anar, anlpar;
2601 
2602 	ifmr->ifm_status = IFM_AVALID;
2603 	ifmr->ifm_active = IFM_ETHER;
2604 
2605 	TXP_LOCK(sc);
2606 	/* Check whether firmware is running. */
2607 	if ((ifp->if_drv_flags & IFF_DRV_RUNNING) == 0)
2608 		goto bail;
2609 	if (txp_command(sc, TXP_CMD_PHY_MGMT_READ, 0, MII_BMSR, 0,
2610 	    &bmsr, NULL, NULL, TXP_CMD_WAIT))
2611 		goto bail;
2612 	if (txp_command(sc, TXP_CMD_PHY_MGMT_READ, 0, MII_BMSR, 0,
2613 	    &bmsr, NULL, NULL, TXP_CMD_WAIT))
2614 		goto bail;
2615 
2616 	if (txp_command(sc, TXP_CMD_PHY_MGMT_READ, 0, MII_BMCR, 0,
2617 	    &bmcr, NULL, NULL, TXP_CMD_WAIT))
2618 		goto bail;
2619 
2620 	if (txp_command(sc, TXP_CMD_PHY_MGMT_READ, 0, MII_ANLPAR, 0,
2621 	    &anlpar, NULL, NULL, TXP_CMD_WAIT))
2622 		goto bail;
2623 
2624 	if (txp_command(sc, TXP_CMD_PHY_MGMT_READ, 0, MII_ANAR, 0,
2625 	    &anar, NULL, NULL, TXP_CMD_WAIT))
2626 		goto bail;
2627 	TXP_UNLOCK(sc);
2628 
2629 	if (bmsr & BMSR_LINK)
2630 		ifmr->ifm_status |= IFM_ACTIVE;
2631 
2632 	if (bmcr & BMCR_ISO) {
2633 		ifmr->ifm_active |= IFM_NONE;
2634 		ifmr->ifm_status = 0;
2635 		return;
2636 	}
2637 
2638 	if (bmcr & BMCR_LOOP)
2639 		ifmr->ifm_active |= IFM_LOOP;
2640 
2641 	if (bmcr & BMCR_AUTOEN) {
2642 		if ((bmsr & BMSR_ACOMP) == 0) {
2643 			ifmr->ifm_active |= IFM_NONE;
2644 			return;
2645 		}
2646 
2647 		anlpar &= anar;
2648 		if (anlpar & ANLPAR_TX_FD)
2649 			ifmr->ifm_active |= IFM_100_TX|IFM_FDX;
2650 		else if (anlpar & ANLPAR_T4)
2651 			ifmr->ifm_active |= IFM_100_T4;
2652 		else if (anlpar & ANLPAR_TX)
2653 			ifmr->ifm_active |= IFM_100_TX;
2654 		else if (anlpar & ANLPAR_10_FD)
2655 			ifmr->ifm_active |= IFM_10_T|IFM_FDX;
2656 		else if (anlpar & ANLPAR_10)
2657 			ifmr->ifm_active |= IFM_10_T;
2658 		else
2659 			ifmr->ifm_active |= IFM_NONE;
2660 	} else
2661 		ifmr->ifm_active = ifm->ifm_cur->ifm_media;
2662 	return;
2663 
2664 bail:
2665 	TXP_UNLOCK(sc);
2666 	ifmr->ifm_active |= IFM_NONE;
2667 	ifmr->ifm_status &= ~IFM_AVALID;
2668 }
2669 
2670 #ifdef TXP_DEBUG
2671 static void
2672 txp_show_descriptor(void *d)
2673 {
2674 	struct txp_cmd_desc *cmd = d;
2675 	struct txp_rsp_desc *rsp = d;
2676 	struct txp_tx_desc *txd = d;
2677 	struct txp_frag_desc *frgd = d;
2678 
2679 	switch (cmd->cmd_flags & CMD_FLAGS_TYPE_M) {
2680 	case CMD_FLAGS_TYPE_CMD:
2681 		/* command descriptor */
2682 		printf("[cmd flags 0x%x num %d id %d seq %d par1 0x%x par2 0x%x par3 0x%x]\n",
2683 		    cmd->cmd_flags, cmd->cmd_numdesc, le16toh(cmd->cmd_id),
2684 		    le16toh(cmd->cmd_seq), le16toh(cmd->cmd_par1),
2685 		    le32toh(cmd->cmd_par2), le32toh(cmd->cmd_par3));
2686 		break;
2687 	case CMD_FLAGS_TYPE_RESP:
2688 		/* response descriptor */
2689 		printf("[rsp flags 0x%x num %d id %d seq %d par1 0x%x par2 0x%x par3 0x%x]\n",
2690 		    rsp->rsp_flags, rsp->rsp_numdesc, le16toh(rsp->rsp_id),
2691 		    le16toh(rsp->rsp_seq), le16toh(rsp->rsp_par1),
2692 		    le32toh(rsp->rsp_par2), le32toh(rsp->rsp_par3));
2693 		break;
2694 	case CMD_FLAGS_TYPE_DATA:
2695 		/* data header (assuming tx for now) */
2696 		printf("[data flags 0x%x num %d totlen %d addr 0x%x/0x%x pflags 0x%x]",
2697 		    txd->tx_flags, txd->tx_numdesc, le16toh(txd->tx_totlen),
2698 		    le32toh(txd->tx_addrlo), le32toh(txd->tx_addrhi),
2699 		    le32toh(txd->tx_pflags));
2700 		break;
2701 	case CMD_FLAGS_TYPE_FRAG:
2702 		/* fragment descriptor */
2703 		printf("[frag flags 0x%x rsvd1 0x%x len %d addr 0x%x/0x%x rsvd2 0x%x]",
2704 		    frgd->frag_flags, frgd->frag_rsvd1, le16toh(frgd->frag_len),
2705 		    le32toh(frgd->frag_addrlo), le32toh(frgd->frag_addrhi),
2706 		    le32toh(frgd->frag_rsvd2));
2707 		break;
2708 	default:
2709 		printf("[unknown(%x) flags 0x%x num %d id %d seq %d par1 0x%x par2 0x%x par3 0x%x]\n",
2710 		    cmd->cmd_flags & CMD_FLAGS_TYPE_M,
2711 		    cmd->cmd_flags, cmd->cmd_numdesc, le16toh(cmd->cmd_id),
2712 		    le16toh(cmd->cmd_seq), le16toh(cmd->cmd_par1),
2713 		    le32toh(cmd->cmd_par2), le32toh(cmd->cmd_par3));
2714 		break;
2715 	}
2716 }
2717 #endif
2718 
2719 static void
2720 txp_set_filter(struct txp_softc *sc)
2721 {
2722 	struct ifnet *ifp;
2723 	uint32_t crc, mchash[2];
2724 	uint16_t filter;
2725 	struct ifmultiaddr *ifma;
2726 	int mcnt;
2727 
2728 	TXP_LOCK_ASSERT(sc);
2729 
2730 	ifp = sc->sc_ifp;
2731 	filter = TXP_RXFILT_DIRECT;
2732 	if ((ifp->if_flags & IFF_BROADCAST) != 0)
2733 		filter |= TXP_RXFILT_BROADCAST;
2734 	if ((ifp->if_flags & (IFF_PROMISC | IFF_ALLMULTI)) != 0) {
2735 		if ((ifp->if_flags & IFF_ALLMULTI) != 0)
2736 			filter |= TXP_RXFILT_ALLMULTI;
2737 		if ((ifp->if_flags & IFF_PROMISC) != 0)
2738 			filter = TXP_RXFILT_PROMISC;
2739 		goto setit;
2740 	}
2741 
2742 	mchash[0] = mchash[1] = 0;
2743 	mcnt = 0;
2744 	if_maddr_rlock(ifp);
2745 	CK_STAILQ_FOREACH(ifma, &ifp->if_multiaddrs, ifma_link) {
2746 		if (ifma->ifma_addr->sa_family != AF_LINK)
2747 			continue;
2748 		crc = ether_crc32_be(LLADDR((struct sockaddr_dl *)
2749 		    ifma->ifma_addr), ETHER_ADDR_LEN);
2750 		crc &= 0x3f;
2751 		mchash[crc >> 5] |= 1 << (crc & 0x1f);
2752 		mcnt++;
2753 	}
2754 	if_maddr_runlock(ifp);
2755 
2756 	if (mcnt > 0) {
2757 		filter |= TXP_RXFILT_HASHMULTI;
2758 		txp_command(sc, TXP_CMD_MCAST_HASH_MASK_WRITE, 2, mchash[0],
2759 		    mchash[1], NULL, NULL, NULL, TXP_CMD_NOWAIT);
2760 	}
2761 
2762 setit:
2763 	txp_command(sc, TXP_CMD_RX_FILTER_WRITE, filter, 0, 0,
2764 	    NULL, NULL, NULL, TXP_CMD_NOWAIT);
2765 }
2766 
2767 static int
2768 txp_set_capabilities(struct txp_softc *sc)
2769 {
2770 	struct ifnet *ifp;
2771 	uint32_t rxcap, txcap;
2772 
2773 	TXP_LOCK_ASSERT(sc);
2774 
2775 	rxcap = txcap = 0;
2776 	ifp = sc->sc_ifp;
2777 	if ((ifp->if_capenable & IFCAP_TXCSUM) != 0) {
2778 		if ((ifp->if_hwassist & CSUM_IP) != 0)
2779 			txcap |= OFFLOAD_IPCKSUM;
2780 		if ((ifp->if_hwassist & CSUM_TCP) != 0)
2781 			txcap |= OFFLOAD_TCPCKSUM;
2782 		if ((ifp->if_hwassist & CSUM_UDP) != 0)
2783 			txcap |= OFFLOAD_UDPCKSUM;
2784 		rxcap = txcap;
2785 	}
2786 	if ((ifp->if_capenable & IFCAP_RXCSUM) == 0)
2787 		rxcap &= ~(OFFLOAD_IPCKSUM | OFFLOAD_TCPCKSUM |
2788 		    OFFLOAD_UDPCKSUM);
2789 	if ((ifp->if_capabilities & IFCAP_VLAN_HWTAGGING) != 0) {
2790 		rxcap |= OFFLOAD_VLAN;
2791 		txcap |= OFFLOAD_VLAN;
2792 	}
2793 
2794 	/* Tell firmware new offload configuration. */
2795 	return (txp_command(sc, TXP_CMD_OFFLOAD_WRITE, 0, txcap, rxcap, NULL,
2796 	    NULL, NULL, TXP_CMD_NOWAIT));
2797 }
2798 
2799 static void
2800 txp_stats_save(struct txp_softc *sc)
2801 {
2802 	struct txp_rsp_desc *rsp;
2803 
2804 	TXP_LOCK_ASSERT(sc);
2805 
2806 	rsp = NULL;
2807 	if (txp_ext_command(sc, TXP_CMD_READ_STATISTICS, 0, 0, 0, NULL, 0,
2808 	    &rsp, TXP_CMD_WAIT))
2809 		goto out;
2810 	if (rsp->rsp_numdesc != 6)
2811 		goto out;
2812 	txp_stats_update(sc, rsp);
2813 out:
2814 	if (rsp != NULL)
2815 		free(rsp, M_DEVBUF);
2816 	bcopy(&sc->sc_stats, &sc->sc_ostats, sizeof(struct txp_hw_stats));
2817 }
2818 
2819 static void
2820 txp_stats_update(struct txp_softc *sc, struct txp_rsp_desc *rsp)
2821 {
2822 	struct txp_hw_stats *ostats, *stats;
2823 	struct txp_ext_desc *ext;
2824 
2825 	TXP_LOCK_ASSERT(sc);
2826 
2827 	ext = (struct txp_ext_desc *)(rsp + 1);
2828 	ostats = &sc->sc_ostats;
2829 	stats = &sc->sc_stats;
2830 	stats->tx_frames = ostats->tx_frames + le32toh(rsp->rsp_par2);
2831 	stats->tx_bytes = ostats->tx_bytes + (uint64_t)le32toh(rsp->rsp_par3) +
2832 	    ((uint64_t)le32toh(ext[0].ext_1) << 32);
2833 	stats->tx_deferred = ostats->tx_deferred + le32toh(ext[0].ext_2);
2834 	stats->tx_late_colls = ostats->tx_late_colls + le32toh(ext[0].ext_3);
2835 	stats->tx_colls = ostats->tx_colls + le32toh(ext[0].ext_4);
2836 	stats->tx_carrier_lost = ostats->tx_carrier_lost +
2837 	    le32toh(ext[1].ext_1);
2838 	stats->tx_multi_colls = ostats->tx_multi_colls +
2839 	    le32toh(ext[1].ext_2);
2840 	stats->tx_excess_colls = ostats->tx_excess_colls +
2841 	    le32toh(ext[1].ext_3);
2842 	stats->tx_fifo_underruns = ostats->tx_fifo_underruns +
2843 	    le32toh(ext[1].ext_4);
2844 	stats->tx_mcast_oflows = ostats->tx_mcast_oflows +
2845 	    le32toh(ext[2].ext_1);
2846 	stats->tx_filtered = ostats->tx_filtered + le32toh(ext[2].ext_2);
2847 	stats->rx_frames = ostats->rx_frames + le32toh(ext[2].ext_3);
2848 	stats->rx_bytes = ostats->rx_bytes + (uint64_t)le32toh(ext[2].ext_4) +
2849 	    ((uint64_t)le32toh(ext[3].ext_1) << 32);
2850 	stats->rx_fifo_oflows = ostats->rx_fifo_oflows + le32toh(ext[3].ext_2);
2851 	stats->rx_badssd = ostats->rx_badssd + le32toh(ext[3].ext_3);
2852 	stats->rx_crcerrs = ostats->rx_crcerrs + le32toh(ext[3].ext_4);
2853 	stats->rx_lenerrs = ostats->rx_lenerrs + le32toh(ext[4].ext_1);
2854 	stats->rx_bcast_frames = ostats->rx_bcast_frames +
2855 	    le32toh(ext[4].ext_2);
2856 	stats->rx_mcast_frames = ostats->rx_mcast_frames +
2857 	    le32toh(ext[4].ext_3);
2858 	stats->rx_oflows = ostats->rx_oflows + le32toh(ext[4].ext_4);
2859 	stats->rx_filtered = ostats->rx_filtered + le32toh(ext[5].ext_1);
2860 }
2861 
2862 static uint64_t
2863 txp_get_counter(struct ifnet *ifp, ift_counter cnt)
2864 {
2865 	struct txp_softc *sc;
2866 	struct txp_hw_stats *stats;
2867 
2868 	sc = if_getsoftc(ifp);
2869 	stats = &sc->sc_stats;
2870 
2871 	switch (cnt) {
2872 	case IFCOUNTER_IERRORS:
2873 		return (stats->rx_fifo_oflows + stats->rx_badssd +
2874 		    stats->rx_crcerrs + stats->rx_lenerrs + stats->rx_oflows);
2875 	case IFCOUNTER_OERRORS:
2876 		return (stats->tx_deferred + stats->tx_carrier_lost +
2877 		    stats->tx_fifo_underruns + stats->tx_mcast_oflows);
2878 	case IFCOUNTER_COLLISIONS:
2879 		return (stats->tx_late_colls + stats->tx_multi_colls +
2880 		    stats->tx_excess_colls);
2881 	case IFCOUNTER_OPACKETS:
2882 		return (stats->tx_frames);
2883 	case IFCOUNTER_IPACKETS:
2884 		return (stats->rx_frames);
2885 	default:
2886 		return (if_get_counter_default(ifp, cnt));
2887 	}
2888 }
2889 
2890 #define	TXP_SYSCTL_STAT_ADD32(c, h, n, p, d)	\
2891 	    SYSCTL_ADD_UINT(c, h, OID_AUTO, n, CTLFLAG_RD, p, 0, d)
2892 
2893 #if __FreeBSD_version >= 900030
2894 #define	TXP_SYSCTL_STAT_ADD64(c, h, n, p, d)	\
2895 	    SYSCTL_ADD_UQUAD(c, h, OID_AUTO, n, CTLFLAG_RD, p, d)
2896 #elif __FreeBSD_version > 800000
2897 #define	TXP_SYSCTL_STAT_ADD64(c, h, n, p, d)	\
2898 	    SYSCTL_ADD_QUAD(c, h, OID_AUTO, n, CTLFLAG_RD, p, d)
2899 #else
2900 #define	TXP_SYSCTL_STAT_ADD64(c, h, n, p, d)	\
2901 	    SYSCTL_ADD_ULONG(c, h, OID_AUTO, n, CTLFLAG_RD, p, d)
2902 #endif
2903 
2904 static void
2905 txp_sysctl_node(struct txp_softc *sc)
2906 {
2907 	struct sysctl_ctx_list *ctx;
2908 	struct sysctl_oid_list *child, *parent;
2909 	struct sysctl_oid *tree;
2910 	struct txp_hw_stats *stats;
2911 	int error;
2912 
2913 	stats = &sc->sc_stats;
2914 	ctx = device_get_sysctl_ctx(sc->sc_dev);
2915 	child = SYSCTL_CHILDREN(device_get_sysctl_tree(sc->sc_dev));
2916 	SYSCTL_ADD_PROC(ctx, child, OID_AUTO, "process_limit",
2917 	    CTLTYPE_INT | CTLFLAG_RW, &sc->sc_process_limit, 0,
2918 	    sysctl_hw_txp_proc_limit, "I",
2919 	    "max number of Rx events to process");
2920 	/* Pull in device tunables. */
2921 	sc->sc_process_limit = TXP_PROC_DEFAULT;
2922 	error = resource_int_value(device_get_name(sc->sc_dev),
2923 	    device_get_unit(sc->sc_dev), "process_limit",
2924 	    &sc->sc_process_limit);
2925 	if (error == 0) {
2926 		if (sc->sc_process_limit < TXP_PROC_MIN ||
2927 		    sc->sc_process_limit > TXP_PROC_MAX) {
2928 			device_printf(sc->sc_dev,
2929 			    "process_limit value out of range; "
2930 			    "using default: %d\n", TXP_PROC_DEFAULT);
2931 			sc->sc_process_limit = TXP_PROC_DEFAULT;
2932 		}
2933 	}
2934 	tree = SYSCTL_ADD_NODE(ctx, child, OID_AUTO, "stats", CTLFLAG_RD,
2935 	    NULL, "TXP statistics");
2936 	parent = SYSCTL_CHILDREN(tree);
2937 
2938 	/* Tx statistics. */
2939 	tree = SYSCTL_ADD_NODE(ctx, parent, OID_AUTO, "tx", CTLFLAG_RD,
2940 	    NULL, "Tx MAC statistics");
2941 	child = SYSCTL_CHILDREN(tree);
2942 
2943 	TXP_SYSCTL_STAT_ADD32(ctx, child, "frames",
2944 	    &stats->tx_frames, "Frames");
2945 	TXP_SYSCTL_STAT_ADD64(ctx, child, "octets",
2946 	    &stats->tx_bytes, "Octets");
2947 	TXP_SYSCTL_STAT_ADD32(ctx, child, "deferred",
2948 	    &stats->tx_deferred, "Deferred frames");
2949 	TXP_SYSCTL_STAT_ADD32(ctx, child, "late_colls",
2950 	    &stats->tx_late_colls, "Late collisions");
2951 	TXP_SYSCTL_STAT_ADD32(ctx, child, "colls",
2952 	    &stats->tx_colls, "Collisions");
2953 	TXP_SYSCTL_STAT_ADD32(ctx, child, "carrier_lost",
2954 	    &stats->tx_carrier_lost, "Carrier lost");
2955 	TXP_SYSCTL_STAT_ADD32(ctx, child, "multi_colls",
2956 	    &stats->tx_multi_colls, "Multiple collisions");
2957 	TXP_SYSCTL_STAT_ADD32(ctx, child, "excess_colls",
2958 	    &stats->tx_excess_colls, "Excessive collisions");
2959 	TXP_SYSCTL_STAT_ADD32(ctx, child, "fifo_underruns",
2960 	    &stats->tx_fifo_underruns, "FIFO underruns");
2961 	TXP_SYSCTL_STAT_ADD32(ctx, child, "mcast_oflows",
2962 	    &stats->tx_mcast_oflows, "Multicast overflows");
2963 	TXP_SYSCTL_STAT_ADD32(ctx, child, "filtered",
2964 	    &stats->tx_filtered, "Filtered frames");
2965 
2966 	/* Rx statistics. */
2967 	tree = SYSCTL_ADD_NODE(ctx, parent, OID_AUTO, "rx", CTLFLAG_RD,
2968 	    NULL, "Rx MAC statistics");
2969 	child = SYSCTL_CHILDREN(tree);
2970 
2971 	TXP_SYSCTL_STAT_ADD32(ctx, child, "frames",
2972 	    &stats->rx_frames, "Frames");
2973 	TXP_SYSCTL_STAT_ADD64(ctx, child, "octets",
2974 	    &stats->rx_bytes, "Octets");
2975 	TXP_SYSCTL_STAT_ADD32(ctx, child, "fifo_oflows",
2976 	    &stats->rx_fifo_oflows, "FIFO overflows");
2977 	TXP_SYSCTL_STAT_ADD32(ctx, child, "badssd",
2978 	    &stats->rx_badssd, "Bad SSD");
2979 	TXP_SYSCTL_STAT_ADD32(ctx, child, "crcerrs",
2980 	    &stats->rx_crcerrs, "CRC errors");
2981 	TXP_SYSCTL_STAT_ADD32(ctx, child, "lenerrs",
2982 	    &stats->rx_lenerrs, "Length errors");
2983 	TXP_SYSCTL_STAT_ADD32(ctx, child, "bcast_frames",
2984 	    &stats->rx_bcast_frames, "Broadcast frames");
2985 	TXP_SYSCTL_STAT_ADD32(ctx, child, "mcast_frames",
2986 	    &stats->rx_mcast_frames, "Multicast frames");
2987 	TXP_SYSCTL_STAT_ADD32(ctx, child, "oflows",
2988 	    &stats->rx_oflows, "Overflows");
2989 	TXP_SYSCTL_STAT_ADD32(ctx, child, "filtered",
2990 	    &stats->rx_filtered, "Filtered frames");
2991 }
2992 
2993 #undef TXP_SYSCTL_STAT_ADD32
2994 #undef TXP_SYSCTL_STAT_ADD64
2995 
2996 static int
2997 sysctl_int_range(SYSCTL_HANDLER_ARGS, int low, int high)
2998 {
2999 	int error, value;
3000 
3001 	if (arg1 == NULL)
3002 		return (EINVAL);
3003 	value = *(int *)arg1;
3004 	error = sysctl_handle_int(oidp, &value, 0, req);
3005 	if (error || req->newptr == NULL)
3006 		return (error);
3007 	if (value < low || value > high)
3008 		return (EINVAL);
3009         *(int *)arg1 = value;
3010 
3011         return (0);
3012 }
3013 
3014 static int
3015 sysctl_hw_txp_proc_limit(SYSCTL_HANDLER_ARGS)
3016 {
3017 	return (sysctl_int_range(oidp, arg1, arg2, req,
3018 	    TXP_PROC_MIN, TXP_PROC_MAX));
3019 }
3020