Home | History | Annotate | Line # | Download | only in pci
      1 /*	$NetBSD: if_pcn.c,v 1.83 2026/03/29 14:46:04 kre Exp $	*/
      2 
      3 /*
      4  * Copyright (c) 2001 Wasabi Systems, Inc.
      5  * All rights reserved.
      6  *
      7  * Written by Jason R. Thorpe for Wasabi Systems, Inc.
      8  *
      9  * Redistribution and use in source and binary forms, with or without
     10  * modification, are permitted provided that the following conditions
     11  * are met:
     12  * 1. Redistributions of source code must retain the above copyright
     13  *    notice, this list of conditions and the following disclaimer.
     14  * 2. Redistributions in binary form must reproduce the above copyright
     15  *    notice, this list of conditions and the following disclaimer in the
     16  *    documentation and/or other materials provided with the distribution.
     17  * 3. All advertising materials mentioning features or use of this software
     18  *    must display the following acknowledgement:
     19  *	This product includes software developed for the NetBSD Project by
     20  *	Wasabi Systems, Inc.
     21  * 4. The name of Wasabi Systems, Inc. may not be used to endorse
     22  *    or promote products derived from this software without specific prior
     23  *    written permission.
     24  *
     25  * THIS SOFTWARE IS PROVIDED BY WASABI SYSTEMS, INC. ``AS IS'' AND
     26  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
     27  * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
     28  * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL WASABI SYSTEMS, INC
     29  * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
     30  * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
     31  * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
     32  * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
     33  * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
     34  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
     35  * POSSIBILITY OF SUCH DAMAGE.
     36  */
     37 
     38 /*
     39  * Device driver for the AMD PCnet-PCI series of Ethernet
     40  * chips:
     41  *
     42  *	* Am79c970 PCnet-PCI Single-Chip Ethernet Controller for PCI
     43  *	  Local Bus
     44  *
     45  *	* Am79c970A PCnet-PCI II Single-Chip Full-Duplex Ethernet Controller
     46  *	  for PCI Local Bus
     47  *
     48  *	* Am79c971 PCnet-FAST Single-Chip Full-Duplex 10/100Mbps
     49  *	  Ethernet Controller for PCI Local Bus
     50  *
     51  *	* Am79c972 PCnet-FAST+ Enhanced 10/100Mbps PCI Ethernet Controller
     52  *	  with OnNow Support
     53  *
     54  *	* Am79c973/Am79c975 PCnet-FAST III Single-Chip 10/100Mbps PCI
     55  *	  Ethernet Controller with Integrated PHY
     56  *
     57  * This also supports the virtual PCnet-PCI Ethernet interface found
     58  * in VMware.
     59  *
     60  * TODO:
     61  *
     62  *	* Split this into bus-specific and bus-independent portions.
     63  *	  The core could also be used for the ILACC (Am79900) 32-bit
     64  *	  Ethernet chip (XXX only if we use an ILACC-compatible SWSTYLE).
     65  */
     66 
     67 #include <sys/cdefs.h>
     68 __KERNEL_RCSID(0, "$NetBSD: if_pcn.c,v 1.83 2026/03/29 14:46:04 kre Exp $");
     69 
     70 #include <sys/param.h>
     71 #include <sys/systm.h>
     72 #include <sys/callout.h>
     73 #include <sys/mbuf.h>
     74 #include <sys/kernel.h>
     75 #include <sys/socket.h>
     76 #include <sys/ioctl.h>
     77 #include <sys/errno.h>
     78 #include <sys/device.h>
     79 #include <sys/queue.h>
     80 
     81 #include <sys/rndsource.h>
     82 
     83 #include <net/if.h>
     84 #include <net/if_dl.h>
     85 #include <net/if_media.h>
     86 #include <net/if_ether.h>
     87 
     88 #include <net/bpf.h>
     89 
     90 #include <sys/bus.h>
     91 #include <sys/intr.h>
     92 #include <machine/endian.h>
     93 
     94 #include <dev/mii/mii.h>
     95 #include <dev/mii/miivar.h>
     96 
     97 #include <dev/ic/am79900reg.h>
     98 #include <dev/ic/lancereg.h>
     99 
    100 #include <dev/pci/pcireg.h>
    101 #include <dev/pci/pcivar.h>
    102 #include <dev/pci/pcidevs.h>
    103 
    104 #include <dev/pci/if_pcnreg.h>
    105 
    106 /*
    107  * Transmit descriptor list size.  This is arbitrary, but allocate
    108  * enough descriptors for 128 pending transmissions, and 4 segments
    109  * per packet.  This MUST work out to a power of 2.
    110  *
    111  * NOTE: We can't have any more than 512 Tx descriptors, SO BE CAREFUL!
    112  *
    113  * So we play a little trick here.  We give each packet up to 16
    114  * DMA segments, but only allocate the max of 512 descriptors.  The
    115  * transmit logic can deal with this, we just are hoping to sneak by.
    116  */
    117 #define	PCN_NTXSEGS		16
    118 #define	PCN_NTXSEGS_VMWARE	8	/* bug in VMware's emulation */
    119 
    120 #define	PCN_TXQUEUELEN		128
    121 #define	PCN_TXQUEUELEN_MASK	(PCN_TXQUEUELEN - 1)
    122 #define	PCN_NTXDESC		512
    123 #define	PCN_NTXDESC_MASK	(PCN_NTXDESC - 1)
    124 #define	PCN_NEXTTX(x)		(((x) + 1) & PCN_NTXDESC_MASK)
    125 #define	PCN_NEXTTXS(x)		(((x) + 1) & PCN_TXQUEUELEN_MASK)
    126 
    127 /* Tx interrupt every N + 1 packets. */
    128 #define	PCN_TXINTR_MASK		7
    129 
    130 /*
    131  * Receive descriptor list size.  We have one Rx buffer per incoming
    132  * packet, so this logic is a little simpler.
    133  */
    134 #define	PCN_NRXDESC		128
    135 #define	PCN_NRXDESC_MASK	(PCN_NRXDESC - 1)
    136 #define	PCN_NEXTRX(x)		(((x) + 1) & PCN_NRXDESC_MASK)
    137 
    138 /*
    139  * Control structures are DMA'd to the PCnet chip.  We allocate them in
    140  * a single clump that maps to a single DMA segment to make several things
    141  * easier.
    142  */
    143 struct pcn_control_data {
    144 	/* The transmit descriptors. */
    145 	struct letmd pcd_txdescs[PCN_NTXDESC];
    146 
    147 	/* The receive descriptors. */
    148 	struct lermd pcd_rxdescs[PCN_NRXDESC];
    149 
    150 	/* The init block. */
    151 	struct leinit pcd_initblock;
    152 };
    153 
    154 #define	PCN_CDOFF(x)	offsetof(struct pcn_control_data, x)
    155 #define	PCN_CDTXOFF(x)	PCN_CDOFF(pcd_txdescs[(x)])
    156 #define	PCN_CDRXOFF(x)	PCN_CDOFF(pcd_rxdescs[(x)])
    157 #define	PCN_CDINITOFF	PCN_CDOFF(pcd_initblock)
    158 
    159 /*
    160  * Software state for transmit jobs.
    161  */
    162 struct pcn_txsoft {
    163 	struct mbuf *txs_mbuf;		/* head of our mbuf chain */
    164 	bus_dmamap_t txs_dmamap;	/* our DMA map */
    165 	int txs_firstdesc;		/* first descriptor in packet */
    166 	int txs_lastdesc;		/* last descriptor in packet */
    167 };
    168 
    169 /*
    170  * Software state for receive jobs.
    171  */
    172 struct pcn_rxsoft {
    173 	struct mbuf *rxs_mbuf;		/* head of our mbuf chain */
    174 	bus_dmamap_t rxs_dmamap;	/* our DMA map */
    175 };
    176 
    177 /*
    178  * Description of Rx FIFO watermarks for various revisions.
    179  */
    180 static const char * const pcn_79c970_rcvfw[] = {
    181 	"16 bytes",
    182 	"64 bytes",
    183 	"128 bytes",
    184 	NULL,
    185 };
    186 
    187 static const char * const pcn_79c971_rcvfw[] = {
    188 	"16 bytes",
    189 	"64 bytes",
    190 	"112 bytes",
    191 	NULL,
    192 };
    193 
    194 /*
    195  * Description of Tx start points for various revisions.
    196  */
    197 static const char * const pcn_79c970_xmtsp[] = {
    198 	"8 bytes",
    199 	"64 bytes",
    200 	"128 bytes",
    201 	"248 bytes",
    202 };
    203 
    204 static const char * const pcn_79c971_xmtsp[] = {
    205 	"20 bytes",
    206 	"64 bytes",
    207 	"128 bytes",
    208 	"248 bytes",
    209 };
    210 
    211 static const char * const pcn_79c971_xmtsp_sram[] = {
    212 	"44 bytes",
    213 	"64 bytes",
    214 	"128 bytes",
    215 	"store-and-forward",
    216 };
    217 
    218 /*
    219  * Description of Tx FIFO watermarks for various revisions.
    220  */
    221 static const char * const pcn_79c970_xmtfw[] = {
    222 	"16 bytes",
    223 	"64 bytes",
    224 	"128 bytes",
    225 	NULL,
    226 };
    227 
    228 static const char * const pcn_79c971_xmtfw[] = {
    229 	"16 bytes",
    230 	"64 bytes",
    231 	"108 bytes",
    232 	NULL,
    233 };
    234 
    235 /*
    236  * Software state per device.
    237  */
    238 struct pcn_softc {
    239 	device_t sc_dev;		/* generic device information */
    240 	bus_space_tag_t sc_st;		/* bus space tag */
    241 	bus_space_handle_t sc_sh;	/* bus space handle */
    242 	bus_dma_tag_t sc_dmat;		/* bus DMA tag */
    243 	struct ethercom sc_ethercom;	/* Ethernet common data */
    244 
    245 	/* Points to our media routines, etc. */
    246 	const struct pcn_variant *sc_variant;
    247 
    248 	void *sc_ih;			/* interrupt cookie */
    249 
    250 	struct mii_data sc_mii;		/* MII/media information */
    251 
    252 	callout_t sc_tick_ch;		/* tick callout */
    253 
    254 	bus_dmamap_t sc_cddmamap;	/* control data DMA map */
    255 #define	sc_cddma	sc_cddmamap->dm_segs[0].ds_addr
    256 
    257 	/* Software state for transmit and receive descriptors. */
    258 	struct pcn_txsoft sc_txsoft[PCN_TXQUEUELEN];
    259 	struct pcn_rxsoft sc_rxsoft[PCN_NRXDESC];
    260 
    261 	/* Control data structures */
    262 	struct pcn_control_data *sc_control_data;
    263 #define	sc_txdescs	sc_control_data->pcd_txdescs
    264 #define	sc_rxdescs	sc_control_data->pcd_rxdescs
    265 #define	sc_initblock	sc_control_data->pcd_initblock
    266 
    267 #ifdef PCN_EVENT_COUNTERS
    268 	/* Event counters. */
    269 	struct evcnt sc_ev_txdstall;	/* Tx stalled due to no txd */
    270 	struct evcnt sc_ev_txintr;	/* Tx interrupts */
    271 	struct evcnt sc_ev_rxintr;	/* Rx interrupts */
    272 	struct evcnt sc_ev_babl;	/* BABL in pcn_intr() */
    273 	struct evcnt sc_ev_miss;	/* MISS in pcn_intr() */
    274 	struct evcnt sc_ev_merr;	/* MERR in pcn_intr() */
    275 
    276 	struct evcnt sc_ev_txseg1;	/* Tx packets w/ 1 segment */
    277 	struct evcnt sc_ev_txseg2;	/* Tx packets w/ 2 segments */
    278 	struct evcnt sc_ev_txseg3;	/* Tx packets w/ 3 segments */
    279 	struct evcnt sc_ev_txseg4;	/* Tx packets w/ 4 segments */
    280 	struct evcnt sc_ev_txseg5;	/* Tx packets w/ 5 segments */
    281 	struct evcnt sc_ev_txsegmore;	/* Tx packets w/ more than 5 segments */
    282 	struct evcnt sc_ev_txcopy;	/* Tx copies required */
    283 #endif /* PCN_EVENT_COUNTERS */
    284 
    285 	const char * const *sc_rcvfw_desc;	/* Rx FIFO watermark info */
    286 	int sc_rcvfw;
    287 
    288 	const char * const *sc_xmtsp_desc;	/* Tx start point info */
    289 	int sc_xmtsp;
    290 
    291 	const char * const *sc_xmtfw_desc;	/* Tx FIFO watermark info */
    292 	int sc_xmtfw;
    293 
    294 	int sc_flags;			/* misc. flags; see below */
    295 	int sc_swstyle;			/* the software style in use */
    296 
    297 	int sc_txfree;			/* number of free Tx descriptors */
    298 	int sc_txnext;			/* next ready Tx descriptor */
    299 
    300 	int sc_txsfree;			/* number of free Tx jobs */
    301 	int sc_txsnext;			/* next free Tx job */
    302 	int sc_txsdirty;		/* dirty Tx jobs */
    303 
    304 	int sc_rxptr;			/* next ready Rx descriptor/job */
    305 
    306 	uint32_t sc_csr5;		/* prototype CSR5 register */
    307 	uint32_t sc_mode;		/* prototype MODE register */
    308 
    309 	krndsource_t rnd_source;	/* random source */
    310 };
    311 
    312 /* sc_flags */
    313 #define	PCN_F_HAS_MII		0x0001	/* has MII */
    314 
    315 #ifdef PCN_EVENT_COUNTERS
    316 #define	PCN_EVCNT_INCR(ev)	(ev)->ev_count++
    317 #else
    318 #define	PCN_EVCNT_INCR(ev)	/* nothing */
    319 #endif
    320 
    321 #define	PCN_CDTXADDR(sc, x)	((sc)->sc_cddma + PCN_CDTXOFF((x)))
    322 #define	PCN_CDRXADDR(sc, x)	((sc)->sc_cddma + PCN_CDRXOFF((x)))
    323 #define	PCN_CDINITADDR(sc)	((sc)->sc_cddma + PCN_CDINITOFF)
    324 
    325 #define	PCN_CDTXSYNC(sc, x, n, ops)					\
    326 do {									\
    327 	int __x, __n;							\
    328 									\
    329 	__x = (x);							\
    330 	__n = (n);							\
    331 									\
    332 	/* If it will wrap around, sync to the end of the ring. */	\
    333 	if ((__x + __n) > PCN_NTXDESC) {				\
    334 		bus_dmamap_sync((sc)->sc_dmat, (sc)->sc_cddmamap,	\
    335 		    PCN_CDTXOFF(__x), sizeof(struct letmd) *		\
    336 		    (PCN_NTXDESC - __x), (ops));			\
    337 		__n -= (PCN_NTXDESC - __x);				\
    338 		__x = 0;						\
    339 	}								\
    340 									\
    341 	/* Now sync whatever is left. */				\
    342 	bus_dmamap_sync((sc)->sc_dmat, (sc)->sc_cddmamap,		\
    343 	    PCN_CDTXOFF(__x), sizeof(struct letmd) * __n, (ops));	\
    344 } while (/*CONSTCOND*/0)
    345 
    346 #define	PCN_CDRXSYNC(sc, x, ops)					\
    347 	bus_dmamap_sync((sc)->sc_dmat, (sc)->sc_cddmamap,		\
    348 	    PCN_CDRXOFF((x)), sizeof(struct lermd), (ops))
    349 
    350 #define	PCN_CDINITSYNC(sc, ops)						\
    351 	bus_dmamap_sync((sc)->sc_dmat, (sc)->sc_cddmamap,		\
    352 	    PCN_CDINITOFF, sizeof(struct leinit), (ops))
    353 
    354 #define	PCN_INIT_RXDESC(sc, x)						\
    355 do {									\
    356 	struct pcn_rxsoft *__rxs = &(sc)->sc_rxsoft[(x)];		\
    357 	struct lermd *__rmd = &(sc)->sc_rxdescs[(x)];			\
    358 	struct mbuf *__m = __rxs->rxs_mbuf;				\
    359 									\
    360 	/*								\
    361 	 * Note: We scoot the packet forward 2 bytes in the buffer	\
    362 	 * so that the payload after the Ethernet header is aligned	\
    363 	 * to a 4-byte boundary.					\
    364 	 */								\
    365 	__m->m_data = __m->m_ext.ext_buf + 2;				\
    366 									\
    367 	if ((sc)->sc_swstyle == LE_B20_SSTYLE_PCNETPCI3) {		\
    368 		__rmd->rmd2 =						\
    369 		    htole32(__rxs->rxs_dmamap->dm_segs[0].ds_addr + 2);	\
    370 		__rmd->rmd0 = 0;					\
    371 	} else {							\
    372 		__rmd->rmd2 = 0;					\
    373 		__rmd->rmd0 =						\
    374 		    htole32(__rxs->rxs_dmamap->dm_segs[0].ds_addr + 2);	\
    375 	}								\
    376 	__rmd->rmd1 = htole32(LE_R1_OWN | LE_R1_ONES |			\
    377 	    (LE_BCNT(MCLBYTES - 2) & LE_R1_BCNT_MASK));			\
    378 	PCN_CDRXSYNC((sc), (x), BUS_DMASYNC_PREREAD | BUS_DMASYNC_PREWRITE);\
    379 } while(/*CONSTCOND*/0)
    380 
    381 static void	pcn_start(struct ifnet *);
    382 static void	pcn_watchdog(struct ifnet *);
    383 static int	pcn_ioctl(struct ifnet *, u_long, void *);
    384 static int	pcn_init(struct ifnet *);
    385 static void	pcn_stop(struct ifnet *, int);
    386 
    387 static bool	pcn_shutdown(device_t, int);
    388 
    389 static void	pcn_reset(struct pcn_softc *);
    390 static void	pcn_rxdrain(struct pcn_softc *);
    391 static int	pcn_add_rxbuf(struct pcn_softc *, int);
    392 static void	pcn_tick(void *);
    393 
    394 static void	pcn_spnd(struct pcn_softc *);
    395 
    396 static void	pcn_set_filter(struct pcn_softc *);
    397 
    398 static int	pcn_intr(void *);
    399 static void	pcn_txintr(struct pcn_softc *);
    400 static int	pcn_rxintr(struct pcn_softc *);
    401 
    402 static int	pcn_mii_readreg(device_t, int, int, uint16_t *);
    403 static int	pcn_mii_writereg(device_t, int, int, uint16_t);
    404 static void	pcn_mii_statchg(struct ifnet *);
    405 
    406 static void	pcn_79c970_mediainit(struct pcn_softc *);
    407 static int	pcn_79c970_mediachange(struct ifnet *);
    408 static void	pcn_79c970_mediastatus(struct ifnet *, struct ifmediareq *);
    409 
    410 static void	pcn_79c971_mediainit(struct pcn_softc *);
    411 
    412 /*
    413  * Description of a PCnet-PCI variant.  Used to select media access
    414  * method, mostly, and to print a nice description of the chip.
    415  */
    416 static const struct pcn_variant {
    417 	const char *pcv_desc;
    418 	void (*pcv_mediainit)(struct pcn_softc *);
    419 	uint16_t pcv_chipid;
    420 } pcn_variants[] = {
    421 	{ "Am79c970 PCnet-PCI",
    422 	  pcn_79c970_mediainit,
    423 	  PARTID_Am79c970 },
    424 
    425 	{ "Am79c970A PCnet-PCI II",
    426 	  pcn_79c970_mediainit,
    427 	  PARTID_Am79c970A },
    428 
    429 	{ "Am79c971 PCnet-FAST",
    430 	  pcn_79c971_mediainit,
    431 	  PARTID_Am79c971 },
    432 
    433 	{ "Am79c972 PCnet-FAST+",
    434 	  pcn_79c971_mediainit,
    435 	  PARTID_Am79c972 },
    436 
    437 	{ "Am79c973 PCnet-FAST III",
    438 	  pcn_79c971_mediainit,
    439 	  PARTID_Am79c973 },
    440 
    441 	{ "Am79c975 PCnet-FAST III",
    442 	  pcn_79c971_mediainit,
    443 	  PARTID_Am79c975 },
    444 
    445 	{ "Unknown PCnet-PCI variant",
    446 	  pcn_79c971_mediainit,
    447 	  0 },
    448 };
    449 
    450 int	pcn_copy_small = 0;
    451 
    452 static int	pcn_match(device_t, cfdata_t, void *);
    453 static void	pcn_attach(device_t, device_t, void *);
    454 
    455 CFATTACH_DECL_NEW(pcn, sizeof(struct pcn_softc),
    456     pcn_match, pcn_attach, NULL, NULL);
    457 
    458 /*
    459  * Routines to read and write the PCnet-PCI CSR/BCR space.
    460  */
    461 
    462 static inline uint32_t
    463 pcn_csr_read(struct pcn_softc *sc, int reg)
    464 {
    465 
    466 	bus_space_write_4(sc->sc_st, sc->sc_sh, PCN32_RAP, reg);
    467 	return bus_space_read_4(sc->sc_st, sc->sc_sh, PCN32_RDP);
    468 }
    469 
    470 static inline void
    471 pcn_csr_write(struct pcn_softc *sc, int reg, uint32_t val)
    472 {
    473 
    474 	bus_space_write_4(sc->sc_st, sc->sc_sh, PCN32_RAP, reg);
    475 	bus_space_write_4(sc->sc_st, sc->sc_sh, PCN32_RDP, val);
    476 }
    477 
    478 static inline uint32_t
    479 pcn_bcr_read(struct pcn_softc *sc, int reg)
    480 {
    481 
    482 	bus_space_write_4(sc->sc_st, sc->sc_sh, PCN32_RAP, reg);
    483 	return bus_space_read_4(sc->sc_st, sc->sc_sh, PCN32_BDP);
    484 }
    485 
    486 static inline void
    487 pcn_bcr_write(struct pcn_softc *sc, int reg, uint32_t val)
    488 {
    489 
    490 	bus_space_write_4(sc->sc_st, sc->sc_sh, PCN32_RAP, reg);
    491 	bus_space_write_4(sc->sc_st, sc->sc_sh, PCN32_BDP, val);
    492 }
    493 
    494 static bool
    495 pcn_is_vmware(const char *enaddr)
    496 {
    497 
    498 	/*
    499 	 * VMware uses the OUI 00:0c:29 for auto-generated MAC
    500 	 * addresses.
    501 	 */
    502 	if (enaddr[0] == 0x00 && enaddr[1] == 0x0c && enaddr[2] == 0x29)
    503 		return TRUE;
    504 
    505 	/*
    506 	 * VMware uses the OUI 00:50:56 for manually-set MAC
    507 	 * addresses (and some auto-generated ones).
    508 	 */
    509 	if (enaddr[0] == 0x00 && enaddr[1] == 0x50 && enaddr[2] == 0x56)
    510 		return TRUE;
    511 
    512 	return FALSE;
    513 }
    514 
    515 static const struct pcn_variant *
    516 pcn_lookup_variant(uint16_t chipid)
    517 {
    518 	const struct pcn_variant *pcv;
    519 
    520 	for (pcv = pcn_variants; pcv->pcv_chipid != 0; pcv++) {
    521 		if (chipid == pcv->pcv_chipid)
    522 			return pcv;
    523 	}
    524 
    525 	/*
    526 	 * This covers unknown chips, which we simply treat like
    527 	 * a generic PCnet-FAST.
    528 	 */
    529 	return pcv;
    530 }
    531 
    532 static int
    533 pcn_match(device_t parent, cfdata_t cf, void *aux)
    534 {
    535 	struct pci_attach_args *pa = aux;
    536 
    537 	/*
    538 	 * IBM Makes a PCI variant of this card which shows up as a
    539 	 * Trident Microsystems 4DWAVE DX (ethernet network, revision 0x25)
    540 	 * this card is truly a pcn card, so we have a special case match for
    541 	 * it
    542 	 */
    543 
    544 	if (PCI_VENDOR(pa->pa_id) == PCI_VENDOR_TRIDENT &&
    545 	    PCI_PRODUCT(pa->pa_id) == PCI_PRODUCT_TRIDENT_4DWAVE_DX &&
    546 	    PCI_CLASS(pa->pa_class) == PCI_CLASS_NETWORK)
    547 		return 1;
    548 
    549 	if (PCI_VENDOR(pa->pa_id) != PCI_VENDOR_AMD)
    550 		return 0;
    551 
    552 	switch (PCI_PRODUCT(pa->pa_id)) {
    553 	case PCI_PRODUCT_AMD_PCNET_PCI:
    554 		/* Beat if_le_pci.c */
    555 		return 10;
    556 	}
    557 
    558 	return 0;
    559 }
    560 
    561 static void
    562 pcn_attach(device_t parent, device_t self, void *aux)
    563 {
    564 	struct pcn_softc *sc = device_private(self);
    565 	struct pci_attach_args *pa = aux;
    566 	struct ifnet *ifp = &sc->sc_ethercom.ec_if;
    567 	pci_chipset_tag_t pc = pa->pa_pc;
    568 	pci_intr_handle_t ih;
    569 	const char *intrstr = NULL;
    570 	bus_space_tag_t iot, memt;
    571 	bus_space_handle_t ioh, memh;
    572 	bus_dma_segment_t seg;
    573 	int ioh_valid, memh_valid;
    574 	int ntxsegs, i, rseg, error;
    575 	uint32_t chipid, reg;
    576 	uint8_t enaddr[ETHER_ADDR_LEN];
    577 	bool is_vmware;
    578 	char intrbuf[PCI_INTRSTR_LEN];
    579 
    580 	sc->sc_dev = self;
    581 	callout_init(&sc->sc_tick_ch, 0);
    582 	callout_setfunc(&sc->sc_tick_ch, pcn_tick, sc);
    583 
    584 	aprint_normal(": AMD PCnet-PCI Ethernet\n");
    585 
    586 	/*
    587 	 * Map the device.
    588 	 */
    589 	ioh_valid = (pci_mapreg_map(pa, PCN_PCI_CBIO, PCI_MAPREG_TYPE_IO, 0,
    590 	    &iot, &ioh, NULL, NULL) == 0);
    591 	memh_valid = (pci_mapreg_map(pa, PCN_PCI_CBMEM,
    592 	    PCI_MAPREG_TYPE_MEM | PCI_MAPREG_MEM_TYPE_32BIT, 0,
    593 	    &memt, &memh, NULL, NULL) == 0);
    594 
    595 	if (memh_valid) {
    596 		sc->sc_st = memt;
    597 		sc->sc_sh = memh;
    598 	} else if (ioh_valid) {
    599 		sc->sc_st = iot;
    600 		sc->sc_sh = ioh;
    601 	} else {
    602 		aprint_error_dev(self, "unable to map device registers\n");
    603 		return;
    604 	}
    605 
    606 	sc->sc_dmat = pa->pa_dmat;
    607 
    608 	/* Make sure bus mastering is enabled. */
    609 	pci_conf_write(pc, pa->pa_tag, PCI_COMMAND_STATUS_REG,
    610 	    pci_conf_read(pc, pa->pa_tag, PCI_COMMAND_STATUS_REG) |
    611 	    PCI_COMMAND_MASTER_ENABLE);
    612 
    613 	/* power up chip */
    614 	if ((error = pci_activate(pa->pa_pc, pa->pa_tag, self,
    615 	    NULL)) && error != EOPNOTSUPP) {
    616 		aprint_error_dev(self, "cannot activate %d\n", error);
    617 		return;
    618 	}
    619 
    620 	/*
    621 	 * Reset the chip to a known state.  This also puts the
    622 	 * chip into 32-bit mode.
    623 	 */
    624 	pcn_reset(sc);
    625 
    626 	/*
    627 	 * On some systems with the chip is an on-board device, the
    628 	 * EEPROM is not used.  Handle this by reading the MAC address
    629 	 * from the CSRs (assuming that boot firmware has written
    630 	 * it there).
    631 	 */
    632 	if (device_getprop_bool(sc->sc_dev, "am79c970-no-eeprom")) {
    633 		for (i = 0; i < 3; i++) {
    634 			uint32_t val;
    635 			val = pcn_csr_read(sc, LE_CSR12 + i);
    636 			enaddr[2 * i] = val & 0xff;
    637 			enaddr[2 * i + 1] = (val >> 8) & 0xff;
    638 		}
    639 	} else {
    640 		/*
    641 		 * Read the address ROM 4 bytes at a time; works on
    642 		 * real hardware, and accommodates some emulators which
    643 		 * believe that after pcn_reset(), we are in DWIO mode
    644 		 * where byte access is not supported.
    645 		 */
    646 		for (i = 0; i < ETHER_ADDR_LEN; i+= 4) {
    647 			uint32_t word;
    648 			word = bus_space_read_4(sc->sc_st, sc->sc_sh,
    649 			    PCN32_APROM + i);
    650 			enaddr[i] = word & 0xff;
    651 			if (i + 1 < ETHER_ADDR_LEN) {
    652 				enaddr[i + 1] = (word >> 8) & 0xff;
    653 			}
    654 			if (i + 2 < ETHER_ADDR_LEN) {
    655 				enaddr[i + 2] = (word >> 16) & 0xff;
    656 			}
    657 			if (i + 3 < ETHER_ADDR_LEN) {
    658 				enaddr[i + 3] = (word >> 24) & 0xff;
    659 			}
    660 		}
    661 	}
    662 
    663 	/* Check to see if this is a VMware emulated network interface. */
    664 	is_vmware = pcn_is_vmware(enaddr);
    665 
    666 	/*
    667 	 * Now that the device is mapped, attempt to figure out what
    668 	 * kind of chip we have.  Note that IDL has all 32 bits of
    669 	 * the chip ID when we're in 32-bit mode.
    670 	 */
    671 	chipid = pcn_csr_read(sc, LE_CSR88);
    672 	sc->sc_variant = pcn_lookup_variant(CHIPID_PARTID(chipid));
    673 
    674 	aprint_normal_dev(self, "%s rev %d, Ethernet address %s\n",
    675 	    sc->sc_variant->pcv_desc, CHIPID_VER(chipid),
    676 	    ether_sprintf(enaddr));
    677 
    678 	/*
    679 	 * VMware has a bug in its network interface emulation; we must
    680 	 * limit the number of Tx segments.
    681 	 */
    682 	if (is_vmware) {
    683 		device_setprop_bool(sc->sc_dev, "am79c970-vmware-tx-bug", true);
    684 		ntxsegs = PCN_NTXSEGS_VMWARE;
    685 		aprint_verbose_dev(self,
    686 		    "VMware Tx segment count bug detected\n");
    687 	} else {
    688 		ntxsegs = PCN_NTXSEGS;
    689 	}
    690 
    691 	/*
    692 	 * Map and establish our interrupt.
    693 	 */
    694 	if (pci_intr_map(pa, &ih)) {
    695 		aprint_error_dev(self, "unable to map interrupt\n");
    696 		return;
    697 	}
    698 	intrstr = pci_intr_string(pc, ih, intrbuf, sizeof(intrbuf));
    699 	sc->sc_ih = pci_intr_establish_xname(pc, ih, IPL_NET, pcn_intr, sc,
    700 	    device_xname(self));
    701 	if (sc->sc_ih == NULL) {
    702 		aprint_error_dev(self, "unable to establish interrupt");
    703 		if (intrstr != NULL)
    704 			aprint_error(" at %s", intrstr);
    705 		aprint_error("\n");
    706 		return;
    707 	}
    708 	aprint_normal_dev(self, "interrupting at %s\n", intrstr);
    709 
    710 	/*
    711 	 * Allocate the control data structures, and create and load the
    712 	 * DMA map for it.
    713 	 */
    714 	if ((error = bus_dmamem_alloc(sc->sc_dmat,
    715 	     sizeof(struct pcn_control_data), PAGE_SIZE, 0, &seg, 1, &rseg,
    716 	     0)) != 0) {
    717 		aprint_error_dev(self, "unable to allocate control data, "
    718 		    "error = %d\n", error);
    719 		goto fail_0;
    720 	}
    721 
    722 	if ((error = bus_dmamem_map(sc->sc_dmat, &seg, rseg,
    723 	     sizeof(struct pcn_control_data), (void **)&sc->sc_control_data,
    724 	     BUS_DMA_COHERENT)) != 0) {
    725 		aprint_error_dev(self, "unable to map control data, "
    726 		    "error = %d\n", error);
    727 		goto fail_1;
    728 	}
    729 
    730 	if ((error = bus_dmamap_create(sc->sc_dmat,
    731 	     sizeof(struct pcn_control_data), 1,
    732 	     sizeof(struct pcn_control_data), 0, 0, &sc->sc_cddmamap)) != 0) {
    733 		aprint_error_dev(self, "unable to create control data DMA map, "
    734 		    "error = %d\n", error);
    735 		goto fail_2;
    736 	}
    737 
    738 	if ((error = bus_dmamap_load(sc->sc_dmat, sc->sc_cddmamap,
    739 	     sc->sc_control_data, sizeof(struct pcn_control_data), NULL,
    740 	     0)) != 0) {
    741 		aprint_error_dev(self,
    742 		    "unable to load control data DMA map, error = %d\n", error);
    743 		goto fail_3;
    744 	}
    745 
    746 	/* Create the transmit buffer DMA maps. */
    747 	for (i = 0; i < PCN_TXQUEUELEN; i++) {
    748 		if ((error = bus_dmamap_create(sc->sc_dmat, MCLBYTES,
    749 		     ntxsegs, MCLBYTES, 0, 0,
    750 		     &sc->sc_txsoft[i].txs_dmamap)) != 0) {
    751 			aprint_error_dev(self,
    752 			    "unable to create tx DMA map %d, error = %d\n",
    753 			    i, error);
    754 			goto fail_4;
    755 		}
    756 	}
    757 
    758 	/* Create the receive buffer DMA maps. */
    759 	for (i = 0; i < PCN_NRXDESC; i++) {
    760 		if ((error = bus_dmamap_create(sc->sc_dmat, MCLBYTES, 1,
    761 		     MCLBYTES, 0, 0, &sc->sc_rxsoft[i].rxs_dmamap)) != 0) {
    762 			aprint_error_dev(self,
    763 			    "unable to create rx DMA map %d, error = %d\n",
    764 			    i, error);
    765 			goto fail_5;
    766 		}
    767 		sc->sc_rxsoft[i].rxs_mbuf = NULL;
    768 	}
    769 
    770 	/* Initialize our media structures. */
    771 	(*sc->sc_variant->pcv_mediainit)(sc);
    772 
    773 	/*
    774 	 * Initialize FIFO watermark info.
    775 	 */
    776 	switch (sc->sc_variant->pcv_chipid) {
    777 	case PARTID_Am79c970:
    778 	case PARTID_Am79c970A:
    779 		sc->sc_rcvfw_desc = pcn_79c970_rcvfw;
    780 		sc->sc_xmtsp_desc = pcn_79c970_xmtsp;
    781 		sc->sc_xmtfw_desc = pcn_79c970_xmtfw;
    782 		break;
    783 
    784 	default:
    785 		sc->sc_rcvfw_desc = pcn_79c971_rcvfw;
    786 		/*
    787 		 * Read BCR25 to determine how much SRAM is
    788 		 * on the board.  If > 0, then we the chip
    789 		 * uses different Start Point thresholds.
    790 		 *
    791 		 * Note BCR25 and BCR26 are loaded from the
    792 		 * EEPROM on RST, and unaffected by S_RESET,
    793 		 * so we don't really have to worry about
    794 		 * them except for this.
    795 		 */
    796 		reg = pcn_bcr_read(sc, LE_BCR25) & 0x00ff;
    797 		if (reg != 0)
    798 			sc->sc_xmtsp_desc = pcn_79c971_xmtsp_sram;
    799 		else
    800 			sc->sc_xmtsp_desc = pcn_79c971_xmtsp;
    801 		sc->sc_xmtfw_desc = pcn_79c971_xmtfw;
    802 		break;
    803 	}
    804 
    805 	/*
    806 	 * Set up defaults -- see the tables above for what these
    807 	 * values mean.
    808 	 *
    809 	 * XXX How should we tune RCVFW and XMTFW?
    810 	 */
    811 	sc->sc_rcvfw = 1;	/* minimum for full-duplex */
    812 	sc->sc_xmtsp = 1;
    813 	sc->sc_xmtfw = 0;
    814 
    815 	ifp = &sc->sc_ethercom.ec_if;
    816 	strcpy(ifp->if_xname, device_xname(self));
    817 	ifp->if_softc = sc;
    818 	ifp->if_flags = IFF_BROADCAST | IFF_SIMPLEX | IFF_MULTICAST;
    819 	ifp->if_ioctl = pcn_ioctl;
    820 	ifp->if_start = pcn_start;
    821 	ifp->if_watchdog = pcn_watchdog;
    822 	ifp->if_init = pcn_init;
    823 	ifp->if_stop = pcn_stop;
    824 	IFQ_SET_READY(&ifp->if_snd);
    825 
    826 	/* Attach the interface. */
    827 	if_attach(ifp);
    828 	if_deferred_start_init(ifp, NULL);
    829 	ether_ifattach(ifp, enaddr);
    830 	rnd_attach_source(&sc->rnd_source, device_xname(self),
    831 	    RND_TYPE_NET, RND_FLAG_DEFAULT);
    832 
    833 #ifdef PCN_EVENT_COUNTERS
    834 	/* Attach event counters. */
    835 	evcnt_attach_dynamic(&sc->sc_ev_txdstall, EVCNT_TYPE_MISC,
    836 	    NULL, device_xname(self), "txdstall");
    837 	evcnt_attach_dynamic(&sc->sc_ev_txintr, EVCNT_TYPE_INTR,
    838 	    NULL, device_xname(self), "txintr");
    839 	evcnt_attach_dynamic(&sc->sc_ev_rxintr, EVCNT_TYPE_INTR,
    840 	    NULL, device_xname(self), "rxintr");
    841 	evcnt_attach_dynamic(&sc->sc_ev_babl, EVCNT_TYPE_MISC,
    842 	    NULL, device_xname(self), "babl");
    843 	evcnt_attach_dynamic(&sc->sc_ev_miss, EVCNT_TYPE_MISC,
    844 	    NULL, device_xname(self), "miss");
    845 	evcnt_attach_dynamic(&sc->sc_ev_merr, EVCNT_TYPE_MISC,
    846 	    NULL, device_xname(self), "merr");
    847 
    848 	evcnt_attach_dynamic(&sc->sc_ev_txseg1, EVCNT_TYPE_MISC,
    849 	    NULL, device_xname(self), "txseg1");
    850 	evcnt_attach_dynamic(&sc->sc_ev_txseg2, EVCNT_TYPE_MISC,
    851 	    NULL, device_xname(self), "txseg2");
    852 	evcnt_attach_dynamic(&sc->sc_ev_txseg3, EVCNT_TYPE_MISC,
    853 	    NULL, device_xname(self), "txseg3");
    854 	evcnt_attach_dynamic(&sc->sc_ev_txseg4, EVCNT_TYPE_MISC,
    855 	    NULL, device_xname(self), "txseg4");
    856 	evcnt_attach_dynamic(&sc->sc_ev_txseg5, EVCNT_TYPE_MISC,
    857 	    NULL, device_xname(self), "txseg5");
    858 	evcnt_attach_dynamic(&sc->sc_ev_txsegmore, EVCNT_TYPE_MISC,
    859 	    NULL, device_xname(self), "txsegmore");
    860 	evcnt_attach_dynamic(&sc->sc_ev_txcopy, EVCNT_TYPE_MISC,
    861 	    NULL, device_xname(self), "txcopy");
    862 #endif /* PCN_EVENT_COUNTERS */
    863 
    864 	/*
    865 	 * Establish power handler with shutdown hook, to make sure
    866 	 * the interface is shutdown during reboot.
    867 	 */
    868 	if (pmf_device_register1(self, NULL, NULL, pcn_shutdown))
    869 		pmf_class_network_register(self, ifp);
    870 	else
    871 		aprint_error_dev(self, "couldn't establish power handler\n");
    872 
    873 	return;
    874 
    875 	/*
    876 	 * Free any resources we've allocated during the failed attach
    877 	 * attempt.  Do this in reverse order and fall through.
    878 	 */
    879  fail_5:
    880 	for (i = 0; i < PCN_NRXDESC; i++) {
    881 		if (sc->sc_rxsoft[i].rxs_dmamap != NULL)
    882 			bus_dmamap_destroy(sc->sc_dmat,
    883 			    sc->sc_rxsoft[i].rxs_dmamap);
    884 	}
    885  fail_4:
    886 	for (i = 0; i < PCN_TXQUEUELEN; i++) {
    887 		if (sc->sc_txsoft[i].txs_dmamap != NULL)
    888 			bus_dmamap_destroy(sc->sc_dmat,
    889 			    sc->sc_txsoft[i].txs_dmamap);
    890 	}
    891 	bus_dmamap_unload(sc->sc_dmat, sc->sc_cddmamap);
    892  fail_3:
    893 	bus_dmamap_destroy(sc->sc_dmat, sc->sc_cddmamap);
    894  fail_2:
    895 	bus_dmamem_unmap(sc->sc_dmat, (void *)sc->sc_control_data,
    896 	    sizeof(struct pcn_control_data));
    897  fail_1:
    898 	bus_dmamem_free(sc->sc_dmat, &seg, rseg);
    899  fail_0:
    900 	return;
    901 }
    902 
    903 /*
    904  * pcn_shutdown:
    905  *
    906  *	Make sure the interface is stopped at reboot time.
    907  */
    908 static bool
    909 pcn_shutdown(device_t self, int howto)
    910 {
    911 	struct pcn_softc *sc = device_private(self);
    912 
    913 	pcn_stop(&sc->sc_ethercom.ec_if, 1);
    914 	/* explicitly reset the chip for some onboard one with lazy firmware */
    915 	pcn_reset(sc);
    916 
    917 	return true;
    918 }
    919 
    920 /*
    921  * pcn_start:		[ifnet interface function]
    922  *
    923  *	Start packet transmission on the interface.
    924  */
    925 static void
    926 pcn_start(struct ifnet *ifp)
    927 {
    928 	struct pcn_softc *sc = ifp->if_softc;
    929 	struct mbuf *m0, *m;
    930 	struct pcn_txsoft *txs;
    931 	bus_dmamap_t dmamap;
    932 	int error, nexttx, lasttx = -1, ofree, seg;
    933 
    934 	if ((ifp->if_flags & IFF_RUNNING) != IFF_RUNNING)
    935 		return;
    936 
    937 	/*
    938 	 * Remember the previous number of free descriptors and
    939 	 * the first descriptor we'll use.
    940 	 */
    941 	ofree = sc->sc_txfree;
    942 
    943 	/*
    944 	 * Loop through the send queue, setting up transmit descriptors
    945 	 * until we drain the queue, or use up all available transmit
    946 	 * descriptors.
    947 	 */
    948 	while (sc->sc_txsfree != 0) {
    949 		/* Grab a packet off the queue. */
    950 		IFQ_POLL(&ifp->if_snd, m0);
    951 		if (m0 == NULL)
    952 			break;
    953 		m = NULL;
    954 
    955 		txs = &sc->sc_txsoft[sc->sc_txsnext];
    956 		dmamap = txs->txs_dmamap;
    957 
    958 		/*
    959 		 * Load the DMA map.  If this fails, the packet either
    960 		 * didn't fit in the allotted number of segments, or we
    961 		 * were short on resources.  In this case, we'll copy
    962 		 * and try again.
    963 		 */
    964 		if (bus_dmamap_load_mbuf(sc->sc_dmat, dmamap, m0,
    965 		    BUS_DMA_WRITE | BUS_DMA_NOWAIT) != 0) {
    966 			PCN_EVCNT_INCR(&sc->sc_ev_txcopy);
    967 			MGETHDR(m, M_DONTWAIT, MT_DATA);
    968 			if (m == NULL) {
    969 				printf("%s: unable to allocate Tx mbuf\n",
    970 				    device_xname(sc->sc_dev));
    971 				break;
    972 			}
    973 			MCLAIM(m, &sc->sc_ethercom.ec_rx_mowner);
    974 			if (m0->m_pkthdr.len > MHLEN) {
    975 				MCLGET(m, M_DONTWAIT);
    976 				if ((m->m_flags & M_EXT) == 0) {
    977 					printf("%s: unable to allocate Tx "
    978 					    "cluster\n",
    979 					    device_xname(sc->sc_dev));
    980 					m_freem(m);
    981 					break;
    982 				}
    983 			}
    984 			m_copydata(m0, 0, m0->m_pkthdr.len, mtod(m, void *));
    985 			m->m_pkthdr.len = m->m_len = m0->m_pkthdr.len;
    986 			error = bus_dmamap_load_mbuf(sc->sc_dmat, dmamap,
    987 			    m, BUS_DMA_WRITE | BUS_DMA_NOWAIT);
    988 			if (error) {
    989 				printf("%s: unable to load Tx buffer, "
    990 				    "error = %d\n", device_xname(sc->sc_dev),
    991 				    error);
    992 				m_freem(m);
    993 				break;
    994 			}
    995 		}
    996 
    997 		/*
    998 		 * Ensure we have enough descriptors free to describe
    999 		 * the packet.  Note, we always reserve one descriptor
   1000 		 * at the end of the ring as a termination point, to
   1001 		 * prevent wrap-around.
   1002 		 */
   1003 		if (dmamap->dm_nsegs > (sc->sc_txfree - 1)) {
   1004 			/*
   1005 			 * Not enough free descriptors to transmit this
   1006 			 * packet.
   1007 			 */
   1008 			bus_dmamap_unload(sc->sc_dmat, dmamap);
   1009 			m_freem(m);
   1010 			PCN_EVCNT_INCR(&sc->sc_ev_txdstall);
   1011 			break;
   1012 		}
   1013 
   1014 		IFQ_DEQUEUE(&ifp->if_snd, m0);
   1015 		if (m != NULL) {
   1016 			m_freem(m0);
   1017 			m0 = m;
   1018 		}
   1019 
   1020 		/*
   1021 		 * WE ARE NOW COMMITTED TO TRANSMITTING THE PACKET.
   1022 		 */
   1023 
   1024 		/* Sync the DMA map. */
   1025 		bus_dmamap_sync(sc->sc_dmat, dmamap, 0, dmamap->dm_mapsize,
   1026 		    BUS_DMASYNC_PREWRITE);
   1027 
   1028 #ifdef PCN_EVENT_COUNTERS
   1029 		switch (dmamap->dm_nsegs) {
   1030 		case 1:
   1031 			PCN_EVCNT_INCR(&sc->sc_ev_txseg1);
   1032 			break;
   1033 		case 2:
   1034 			PCN_EVCNT_INCR(&sc->sc_ev_txseg2);
   1035 			break;
   1036 		case 3:
   1037 			PCN_EVCNT_INCR(&sc->sc_ev_txseg3);
   1038 			break;
   1039 		case 4:
   1040 			PCN_EVCNT_INCR(&sc->sc_ev_txseg4);
   1041 			break;
   1042 		case 5:
   1043 			PCN_EVCNT_INCR(&sc->sc_ev_txseg5);
   1044 			break;
   1045 		default:
   1046 			PCN_EVCNT_INCR(&sc->sc_ev_txsegmore);
   1047 			break;
   1048 		}
   1049 #endif /* PCN_EVENT_COUNTERS */
   1050 
   1051 		/*
   1052 		 * Initialize the transmit descriptors.
   1053 		 */
   1054 		if (sc->sc_swstyle == LE_B20_SSTYLE_PCNETPCI3) {
   1055 			for (nexttx = sc->sc_txnext, seg = 0;
   1056 			     seg < dmamap->dm_nsegs;
   1057 			     seg++, nexttx = PCN_NEXTTX(nexttx)) {
   1058 				/*
   1059 				 * If this is the first descriptor we're
   1060 				 * enqueueing, don't set the OWN bit just
   1061 				 * yet.  That could cause a race condition.
   1062 				 * We'll do it below.
   1063 				 */
   1064 				sc->sc_txdescs[nexttx].tmd0 = 0;
   1065 				sc->sc_txdescs[nexttx].tmd2 =
   1066 				    htole32(dmamap->dm_segs[seg].ds_addr);
   1067 				sc->sc_txdescs[nexttx].tmd1 =
   1068 				    htole32(LE_T1_ONES |
   1069 				    (nexttx == sc->sc_txnext ? 0 : LE_T1_OWN) |
   1070 				    (LE_BCNT(dmamap->dm_segs[seg].ds_len) &
   1071 				     LE_T1_BCNT_MASK));
   1072 				lasttx = nexttx;
   1073 			}
   1074 		} else {
   1075 			for (nexttx = sc->sc_txnext, seg = 0;
   1076 			     seg < dmamap->dm_nsegs;
   1077 			     seg++, nexttx = PCN_NEXTTX(nexttx)) {
   1078 				/*
   1079 				 * If this is the first descriptor we're
   1080 				 * enqueueing, don't set the OWN bit just
   1081 				 * yet.  That could cause a race condition.
   1082 				 * We'll do it below.
   1083 				 */
   1084 				sc->sc_txdescs[nexttx].tmd0 =
   1085 				    htole32(dmamap->dm_segs[seg].ds_addr);
   1086 				sc->sc_txdescs[nexttx].tmd2 = 0;
   1087 				sc->sc_txdescs[nexttx].tmd1 =
   1088 				    htole32(LE_T1_ONES |
   1089 				    (nexttx == sc->sc_txnext ? 0 : LE_T1_OWN) |
   1090 				    (LE_BCNT(dmamap->dm_segs[seg].ds_len) &
   1091 				     LE_T1_BCNT_MASK));
   1092 				lasttx = nexttx;
   1093 			}
   1094 		}
   1095 
   1096 		KASSERT(lasttx != -1);
   1097 		/* Interrupt on the packet, if appropriate. */
   1098 		if ((sc->sc_txsnext & PCN_TXINTR_MASK) == 0)
   1099 			sc->sc_txdescs[lasttx].tmd1 |= htole32(LE_T1_LTINT);
   1100 
   1101 		/* Set `start of packet' and `end of packet' appropriately. */
   1102 		sc->sc_txdescs[lasttx].tmd1 |= htole32(LE_T1_ENP);
   1103 		sc->sc_txdescs[sc->sc_txnext].tmd1 |=
   1104 		    htole32(LE_T1_OWN | LE_T1_STP);
   1105 
   1106 		/* Sync the descriptors we're using. */
   1107 		PCN_CDTXSYNC(sc, sc->sc_txnext, dmamap->dm_nsegs,
   1108 		    BUS_DMASYNC_PREREAD | BUS_DMASYNC_PREWRITE);
   1109 
   1110 		/* Kick the transmitter. */
   1111 		pcn_csr_write(sc, LE_CSR0, LE_C0_INEA | LE_C0_TDMD);
   1112 
   1113 		/*
   1114 		 * Store a pointer to the packet so we can free it later,
   1115 		 * and remember what txdirty will be once the packet is
   1116 		 * done.
   1117 		 */
   1118 		txs->txs_mbuf = m0;
   1119 		txs->txs_firstdesc = sc->sc_txnext;
   1120 		txs->txs_lastdesc = lasttx;
   1121 
   1122 		/* Advance the tx pointer. */
   1123 		sc->sc_txfree -= dmamap->dm_nsegs;
   1124 		sc->sc_txnext = nexttx;
   1125 
   1126 		sc->sc_txsfree--;
   1127 		sc->sc_txsnext = PCN_NEXTTXS(sc->sc_txsnext);
   1128 
   1129 		/* Pass the packet to any BPF listeners. */
   1130 		bpf_mtap(ifp, m0, BPF_D_OUT);
   1131 	}
   1132 
   1133 	if (sc->sc_txfree != ofree) {
   1134 		/* Set a watchdog timer in case the chip flakes out. */
   1135 		ifp->if_timer = 5;
   1136 	}
   1137 }
   1138 
   1139 /*
   1140  * pcn_watchdog:	[ifnet interface function]
   1141  *
   1142  *	Watchdog timer handler.
   1143  */
   1144 static void
   1145 pcn_watchdog(struct ifnet *ifp)
   1146 {
   1147 	struct pcn_softc *sc = ifp->if_softc;
   1148 
   1149 	/*
   1150 	 * Since we're not interrupting every packet, sweep
   1151 	 * up before we report an error.
   1152 	 */
   1153 	pcn_txintr(sc);
   1154 
   1155 	if (sc->sc_txfree != PCN_NTXDESC) {
   1156 		printf("%s: device timeout (txfree %d txsfree %d)\n",
   1157 		    device_xname(sc->sc_dev), sc->sc_txfree, sc->sc_txsfree);
   1158 		if_statinc(ifp, if_oerrors);
   1159 
   1160 		/* Reset the interface. */
   1161 		(void) pcn_init(ifp);
   1162 	}
   1163 
   1164 	/* Try to get more packets going. */
   1165 	pcn_start(ifp);
   1166 }
   1167 
   1168 /*
   1169  * pcn_ioctl:		[ifnet interface function]
   1170  *
   1171  *	Handle control requests from the operator.
   1172  */
   1173 static int
   1174 pcn_ioctl(struct ifnet *ifp, u_long cmd, void *data)
   1175 {
   1176 	int s, error;
   1177 
   1178 	s = splnet();
   1179 
   1180 	switch (cmd) {
   1181 	default:
   1182 		error = ether_ioctl(ifp, cmd, data);
   1183 		if (error == ENETRESET) {
   1184 			/*
   1185 			 * Multicast list has changed; set the hardware filter
   1186 			 * accordingly.
   1187 			 */
   1188 			if (ifp->if_flags & IFF_RUNNING)
   1189 				error = pcn_init(ifp);
   1190 			else
   1191 				error = 0;
   1192 		}
   1193 		break;
   1194 	}
   1195 
   1196 	/* Try to get more packets going. */
   1197 	pcn_start(ifp);
   1198 
   1199 	splx(s);
   1200 	return error;
   1201 }
   1202 
   1203 /*
   1204  * pcn_intr:
   1205  *
   1206  *	Interrupt service routine.
   1207  */
   1208 static int
   1209 pcn_intr(void *arg)
   1210 {
   1211 	struct pcn_softc *sc = arg;
   1212 	struct ifnet *ifp = &sc->sc_ethercom.ec_if;
   1213 	uint32_t csr0;
   1214 	int wantinit, handled = 0;
   1215 
   1216 	for (wantinit = 0; wantinit == 0;) {
   1217 		csr0 = pcn_csr_read(sc, LE_CSR0);
   1218 		if ((csr0 & LE_C0_INTR) == 0)
   1219 			break;
   1220 
   1221 		rnd_add_uint32(&sc->rnd_source, csr0);
   1222 
   1223 		/* ACK the bits and re-enable interrupts. */
   1224 		pcn_csr_write(sc, LE_CSR0, csr0 &
   1225 		    (LE_C0_INEA | LE_C0_BABL | LE_C0_MISS | LE_C0_MERR |
   1226 			LE_C0_RINT | LE_C0_TINT | LE_C0_IDON));
   1227 
   1228 		handled = 1;
   1229 
   1230 		if (csr0 & LE_C0_RINT) {
   1231 			PCN_EVCNT_INCR(&sc->sc_ev_rxintr);
   1232 			wantinit = pcn_rxintr(sc);
   1233 		}
   1234 
   1235 		if (csr0 & LE_C0_TINT) {
   1236 			PCN_EVCNT_INCR(&sc->sc_ev_txintr);
   1237 			pcn_txintr(sc);
   1238 		}
   1239 
   1240 		if (csr0 & LE_C0_ERR) {
   1241 			if (csr0 & LE_C0_BABL) {
   1242 				PCN_EVCNT_INCR(&sc->sc_ev_babl);
   1243 				if_statinc(ifp, if_oerrors);
   1244 			}
   1245 			if (csr0 & LE_C0_MISS) {
   1246 				PCN_EVCNT_INCR(&sc->sc_ev_miss);
   1247 				if_statinc(ifp, if_ierrors);
   1248 			}
   1249 			if (csr0 & LE_C0_MERR) {
   1250 				PCN_EVCNT_INCR(&sc->sc_ev_merr);
   1251 				printf("%s: memory error\n",
   1252 				    device_xname(sc->sc_dev));
   1253 				wantinit = 1;
   1254 				break;
   1255 			}
   1256 		}
   1257 
   1258 		if ((csr0 & LE_C0_RXON) == 0) {
   1259 			printf("%s: receiver disabled\n",
   1260 			    device_xname(sc->sc_dev));
   1261 			if_statinc(ifp, if_ierrors);
   1262 			wantinit = 1;
   1263 		}
   1264 
   1265 		if ((csr0 & LE_C0_TXON) == 0) {
   1266 			printf("%s: transmitter disabled\n",
   1267 			    device_xname(sc->sc_dev));
   1268 			if_statinc(ifp, if_oerrors);
   1269 			wantinit = 1;
   1270 		}
   1271 	}
   1272 
   1273 	if (handled) {
   1274 		if (wantinit)
   1275 			pcn_init(ifp);
   1276 
   1277 		/* Try to get more packets going. */
   1278 		if_schedule_deferred_start(ifp);
   1279 	}
   1280 
   1281 	return handled;
   1282 }
   1283 
   1284 /*
   1285  * pcn_spnd:
   1286  *
   1287  *	Suspend the chip.
   1288  */
   1289 static void
   1290 pcn_spnd(struct pcn_softc *sc)
   1291 {
   1292 	int i;
   1293 
   1294 	pcn_csr_write(sc, LE_CSR5, sc->sc_csr5 | LE_C5_SPND);
   1295 
   1296 	for (i = 0; i < 10000; i++) {
   1297 		if (pcn_csr_read(sc, LE_CSR5) & LE_C5_SPND)
   1298 			return;
   1299 		delay(5);
   1300 	}
   1301 
   1302 	printf("%s: WARNING: chip failed to enter suspended state\n",
   1303 	    device_xname(sc->sc_dev));
   1304 }
   1305 
   1306 /*
   1307  * pcn_txintr:
   1308  *
   1309  *	Helper; handle transmit interrupts.
   1310  */
   1311 static void
   1312 pcn_txintr(struct pcn_softc *sc)
   1313 {
   1314 	struct ifnet *ifp = &sc->sc_ethercom.ec_if;
   1315 	struct pcn_txsoft *txs;
   1316 	uint32_t tmd1, tmd2, tmd;
   1317 	int i, j;
   1318 
   1319 	/*
   1320 	 * Go through our Tx list and free mbufs for those
   1321 	 * frames which have been transmitted.
   1322 	 */
   1323 	for (i = sc->sc_txsdirty; sc->sc_txsfree != PCN_TXQUEUELEN;
   1324 	     i = PCN_NEXTTXS(i), sc->sc_txsfree++) {
   1325 		txs = &sc->sc_txsoft[i];
   1326 
   1327 		PCN_CDTXSYNC(sc, txs->txs_firstdesc, txs->txs_dmamap->dm_nsegs,
   1328 		    BUS_DMASYNC_POSTREAD | BUS_DMASYNC_POSTWRITE);
   1329 
   1330 		tmd1 = le32toh(sc->sc_txdescs[txs->txs_lastdesc].tmd1);
   1331 		if (tmd1 & LE_T1_OWN)
   1332 			break;
   1333 
   1334 		/*
   1335 		 * Slightly annoying -- we have to loop through the
   1336 		 * descriptors we've used looking for ERR, since it
   1337 		 * can appear on any descriptor in the chain.
   1338 		 */
   1339 		for (j = txs->txs_firstdesc;; j = PCN_NEXTTX(j)) {
   1340 			tmd = le32toh(sc->sc_txdescs[j].tmd1);
   1341 			if (tmd & LE_T1_ERR) {
   1342 				if_statinc(ifp, if_oerrors);
   1343 				if (sc->sc_swstyle == LE_B20_SSTYLE_PCNETPCI3)
   1344 					tmd2 = le32toh(sc->sc_txdescs[j].tmd0);
   1345 				else
   1346 					tmd2 = le32toh(sc->sc_txdescs[j].tmd2);
   1347 				if (tmd2 & LE_T2_UFLO) {
   1348 					if (sc->sc_xmtsp < LE_C80_XMTSP_MAX) {
   1349 						sc->sc_xmtsp++;
   1350 						printf("%s: transmit "
   1351 						    "underrun; new threshold: "
   1352 						    "%s\n",
   1353 						    device_xname(sc->sc_dev),
   1354 						    sc->sc_xmtsp_desc[
   1355 						    sc->sc_xmtsp]);
   1356 						pcn_spnd(sc);
   1357 						pcn_csr_write(sc, LE_CSR80,
   1358 						    LE_C80_RCVFW(sc->sc_rcvfw) |
   1359 						    LE_C80_XMTSP(sc->sc_xmtsp) |
   1360 						    LE_C80_XMTFW(sc->sc_xmtfw));
   1361 						pcn_csr_write(sc, LE_CSR5,
   1362 						    sc->sc_csr5);
   1363 					} else {
   1364 						printf("%s: transmit "
   1365 						    "underrun\n",
   1366 						    device_xname(sc->sc_dev));
   1367 					}
   1368 				} else if (tmd2 & LE_T2_BUFF) {
   1369 					printf("%s: transmit buffer error\n",
   1370 					    device_xname(sc->sc_dev));
   1371 				}
   1372 				if (tmd2 & LE_T2_LCOL)
   1373 					if_statinc(ifp, if_collisions);
   1374 				if (tmd2 & LE_T2_RTRY)
   1375 					if_statadd(ifp, if_collisions, 16);
   1376 				goto next_packet;
   1377 			}
   1378 			if (j == txs->txs_lastdesc)
   1379 				break;
   1380 		}
   1381 		if (tmd1 & LE_T1_ONE)
   1382 			if_statinc(ifp, if_collisions);
   1383 		else if (tmd & LE_T1_MORE) {
   1384 			/* Real number is unknown. */
   1385 			if_statadd(ifp, if_collisions, 2);
   1386 		}
   1387 		if_statinc(ifp, if_opackets);
   1388  next_packet:
   1389 		sc->sc_txfree += txs->txs_dmamap->dm_nsegs;
   1390 		bus_dmamap_sync(sc->sc_dmat, txs->txs_dmamap,
   1391 		    0, txs->txs_dmamap->dm_mapsize, BUS_DMASYNC_POSTWRITE);
   1392 		bus_dmamap_unload(sc->sc_dmat, txs->txs_dmamap);
   1393 		m_freem(txs->txs_mbuf);
   1394 		txs->txs_mbuf = NULL;
   1395 	}
   1396 
   1397 	/* Update the dirty transmit buffer pointer. */
   1398 	sc->sc_txsdirty = i;
   1399 
   1400 	/*
   1401 	 * If there are no more pending transmissions, cancel the watchdog
   1402 	 * timer.
   1403 	 */
   1404 	if (sc->sc_txsfree == PCN_TXQUEUELEN)
   1405 		ifp->if_timer = 0;
   1406 }
   1407 
   1408 /*
   1409  * pcn_rxintr:
   1410  *
   1411  *	Helper; handle receive interrupts.
   1412  */
   1413 static int
   1414 pcn_rxintr(struct pcn_softc *sc)
   1415 {
   1416 	struct ifnet *ifp = &sc->sc_ethercom.ec_if;
   1417 	struct pcn_rxsoft *rxs;
   1418 	struct mbuf *m;
   1419 	uint32_t rmd1;
   1420 	int i, len;
   1421 
   1422 	for (i = sc->sc_rxptr;; i = PCN_NEXTRX(i)) {
   1423 		rxs = &sc->sc_rxsoft[i];
   1424 
   1425 		PCN_CDRXSYNC(sc, i,
   1426 		    BUS_DMASYNC_POSTREAD | BUS_DMASYNC_POSTWRITE);
   1427 
   1428 		rmd1 = le32toh(sc->sc_rxdescs[i].rmd1);
   1429 
   1430 		if (rmd1 & LE_R1_OWN)
   1431 			break;
   1432 
   1433 		/*
   1434 		 * Check for errors and make sure the packet fit into
   1435 		 * a single buffer.  We have structured this block of
   1436 		 * code the way it is in order to compress it into
   1437 		 * one test in the common case (no error).
   1438 		 */
   1439 		if (__predict_false((rmd1 & (LE_R1_STP | LE_R1_ENP |LE_R1_ERR))
   1440 		    != (LE_R1_STP | LE_R1_ENP))) {
   1441 			/* Make sure the packet is in a single buffer. */
   1442 			if ((rmd1 & (LE_R1_STP | LE_R1_ENP)) !=
   1443 			    (LE_R1_STP | LE_R1_ENP)) {
   1444 				printf("%s: packet spilled into next buffer\n",
   1445 				    device_xname(sc->sc_dev));
   1446 				return 1;	/* pcn_intr() will re-init */
   1447 			}
   1448 
   1449 			/*
   1450 			 * If the packet had an error, simple recycle the
   1451 			 * buffer.
   1452 			 */
   1453 			if (rmd1 & LE_R1_ERR) {
   1454 				if_statinc(ifp, if_ierrors);
   1455 				/*
   1456 				 * If we got an overflow error, chances
   1457 				 * are there will be a CRC error.  In
   1458 				 * this case, just print the overflow
   1459 				 * error, and skip the others.
   1460 				 */
   1461 				if (rmd1 & LE_R1_OFLO)
   1462 					printf("%s: overflow error\n",
   1463 					    device_xname(sc->sc_dev));
   1464 				else {
   1465 #define	PRINTIT(x, str)							\
   1466 					if (rmd1 & (x))			\
   1467 						printf("%s: %s\n",	\
   1468 						    device_xname(sc->sc_dev), \
   1469 						    str);
   1470 					PRINTIT(LE_R1_FRAM, "framing error");
   1471 					PRINTIT(LE_R1_CRC, "CRC error");
   1472 					PRINTIT(LE_R1_BUFF, "buffer error");
   1473 				}
   1474 #undef PRINTIT
   1475 				PCN_INIT_RXDESC(sc, i);
   1476 				continue;
   1477 			}
   1478 		}
   1479 
   1480 		bus_dmamap_sync(sc->sc_dmat, rxs->rxs_dmamap, 0,
   1481 		    rxs->rxs_dmamap->dm_mapsize, BUS_DMASYNC_POSTREAD);
   1482 
   1483 		/*
   1484 		 * No errors; receive the packet.
   1485 		 */
   1486 		if (sc->sc_swstyle == LE_B20_SSTYLE_PCNETPCI3)
   1487 			len = le32toh(sc->sc_rxdescs[i].rmd0) & LE_R1_BCNT_MASK;
   1488 		else
   1489 			len = le32toh(sc->sc_rxdescs[i].rmd2) & LE_R1_BCNT_MASK;
   1490 
   1491 		/*
   1492 		 * The LANCE family includes the CRC with every packet;
   1493 		 * trim it off here.
   1494 		 */
   1495 		len -= ETHER_CRC_LEN;
   1496 
   1497 		/*
   1498 		 * If the packet is small enough to fit in a
   1499 		 * single header mbuf, allocate one and copy
   1500 		 * the data into it.  This greatly reduces
   1501 		 * memory consumption when we receive lots
   1502 		 * of small packets.
   1503 		 *
   1504 		 * Otherwise, we add a new buffer to the receive
   1505 		 * chain.  If this fails, we drop the packet and
   1506 		 * recycle the old buffer.
   1507 		 */
   1508 		if (pcn_copy_small != 0 && len <= (MHLEN - 2)) {
   1509 			MGETHDR(m, M_DONTWAIT, MT_DATA);
   1510 			if (m == NULL)
   1511 				goto dropit;
   1512 			MCLAIM(m, &sc->sc_ethercom.ec_rx_mowner);
   1513 			m->m_data += 2;
   1514 			memcpy(mtod(m, void *),
   1515 			    mtod(rxs->rxs_mbuf, void *), len);
   1516 			PCN_INIT_RXDESC(sc, i);
   1517 			bus_dmamap_sync(sc->sc_dmat, rxs->rxs_dmamap, 0,
   1518 			    rxs->rxs_dmamap->dm_mapsize,
   1519 			    BUS_DMASYNC_PREREAD);
   1520 		} else {
   1521 			m = rxs->rxs_mbuf;
   1522 			if (pcn_add_rxbuf(sc, i) != 0) {
   1523  dropit:
   1524 				if_statinc(ifp, if_ierrors);
   1525 				PCN_INIT_RXDESC(sc, i);
   1526 				bus_dmamap_sync(sc->sc_dmat,
   1527 				    rxs->rxs_dmamap, 0,
   1528 				    rxs->rxs_dmamap->dm_mapsize,
   1529 				    BUS_DMASYNC_PREREAD);
   1530 				continue;
   1531 			}
   1532 		}
   1533 
   1534 		m_set_rcvif(m, ifp);
   1535 		m->m_pkthdr.len = m->m_len = len;
   1536 
   1537 		/* Pass it on. */
   1538 		if_percpuq_enqueue(ifp->if_percpuq, m);
   1539 	}
   1540 
   1541 	/* Update the receive pointer. */
   1542 	sc->sc_rxptr = i;
   1543 	return 0;
   1544 }
   1545 
   1546 /*
   1547  * pcn_tick:
   1548  *
   1549  *	One second timer, used to tick the MII.
   1550  */
   1551 static void
   1552 pcn_tick(void *arg)
   1553 {
   1554 	struct pcn_softc *sc = arg;
   1555 	int s;
   1556 
   1557 	s = splnet();
   1558 	mii_tick(&sc->sc_mii);
   1559 	splx(s);
   1560 
   1561 	callout_schedule(&sc->sc_tick_ch, hz);
   1562 }
   1563 
   1564 /*
   1565  * pcn_reset:
   1566  *
   1567  *	Perform a soft reset on the PCnet-PCI.
   1568  */
   1569 static void
   1570 pcn_reset(struct pcn_softc *sc)
   1571 {
   1572 
   1573 	/*
   1574 	 * The PCnet-PCI chip is reset by reading from the
   1575 	 * RESET register.  Note that while the NE2100 LANCE
   1576 	 * boards require a write after the read, the PCnet-PCI
   1577 	 * chips do not require this.
   1578 	 *
   1579 	 * Since we don't know if we're in 16-bit or 32-bit
   1580 	 * mode right now, issue both (it's safe) in the
   1581 	 * hopes that one will succeed.
   1582 	 */
   1583 	(void) bus_space_read_2(sc->sc_st, sc->sc_sh, PCN16_RESET);
   1584 	(void) bus_space_read_4(sc->sc_st, sc->sc_sh, PCN32_RESET);
   1585 
   1586 	/* Wait 1ms for it to finish. */
   1587 	delay(1000);
   1588 
   1589 	/*
   1590 	 * Select 32-bit I/O mode by issuing a 32-bit write to the
   1591 	 * RDP.  Since the RAP is 0 after a reset, writing a 0
   1592 	 * to RDP is safe (since it simply clears CSR0).
   1593 	 */
   1594 	bus_space_write_4(sc->sc_st, sc->sc_sh, PCN32_RDP, 0);
   1595 }
   1596 
   1597 /*
   1598  * pcn_init:		[ifnet interface function]
   1599  *
   1600  *	Initialize the interface.  Must be called at splnet().
   1601  */
   1602 static int
   1603 pcn_init(struct ifnet *ifp)
   1604 {
   1605 	struct pcn_softc *sc = ifp->if_softc;
   1606 	struct pcn_rxsoft *rxs;
   1607 	const uint8_t *enaddr = CLLADDR(ifp->if_sadl);
   1608 	int i, error = 0;
   1609 	uint32_t reg;
   1610 
   1611 	/* Cancel any pending I/O. */
   1612 	pcn_stop(ifp, 0);
   1613 
   1614 	/* Reset the chip to a known state. */
   1615 	pcn_reset(sc);
   1616 
   1617 	/*
   1618 	 * On the Am79c970, select SSTYLE 2, and SSTYLE 3 on everything
   1619 	 * else.
   1620 	 *
   1621 	 * XXX It'd be really nice to use SSTYLE 2 on all the chips,
   1622 	 * because the structure layout is compatible with ILACC,
   1623 	 * but the burst mode is only available in SSTYLE 3, and
   1624 	 * burst mode should provide some performance enhancement.
   1625 	 */
   1626 	if (sc->sc_variant->pcv_chipid == PARTID_Am79c970)
   1627 		sc->sc_swstyle = LE_B20_SSTYLE_PCNETPCI2;
   1628 	else
   1629 		sc->sc_swstyle = LE_B20_SSTYLE_PCNETPCI3;
   1630 	pcn_bcr_write(sc, LE_BCR20, sc->sc_swstyle);
   1631 
   1632 	/* Initialize the transmit descriptor ring. */
   1633 	memset(sc->sc_txdescs, 0, sizeof(sc->sc_txdescs));
   1634 	PCN_CDTXSYNC(sc, 0, PCN_NTXDESC,
   1635 	    BUS_DMASYNC_PREREAD | BUS_DMASYNC_PREWRITE);
   1636 	sc->sc_txfree = PCN_NTXDESC;
   1637 	sc->sc_txnext = 0;
   1638 
   1639 	/* Initialize the transmit job descriptors. */
   1640 	for (i = 0; i < PCN_TXQUEUELEN; i++)
   1641 		sc->sc_txsoft[i].txs_mbuf = NULL;
   1642 	sc->sc_txsfree = PCN_TXQUEUELEN;
   1643 	sc->sc_txsnext = 0;
   1644 	sc->sc_txsdirty = 0;
   1645 
   1646 	/*
   1647 	 * Initialize the receive descriptor and receive job
   1648 	 * descriptor rings.
   1649 	 */
   1650 	for (i = 0; i < PCN_NRXDESC; i++) {
   1651 		rxs = &sc->sc_rxsoft[i];
   1652 		if (rxs->rxs_mbuf == NULL) {
   1653 			if ((error = pcn_add_rxbuf(sc, i)) != 0) {
   1654 				printf("%s: unable to allocate or map rx "
   1655 				    "buffer %d, error = %d\n",
   1656 				    device_xname(sc->sc_dev), i, error);
   1657 				/*
   1658 				 * XXX Should attempt to run with fewer receive
   1659 				 * XXX buffers instead of just failing.
   1660 				 */
   1661 				pcn_rxdrain(sc);
   1662 				goto out;
   1663 			}
   1664 		} else
   1665 			PCN_INIT_RXDESC(sc, i);
   1666 	}
   1667 	sc->sc_rxptr = 0;
   1668 
   1669 	/* Initialize MODE for the initialization block. */
   1670 	sc->sc_mode = 0;
   1671 	if (ifp->if_flags & IFF_PROMISC)
   1672 		sc->sc_mode |= LE_C15_PROM;
   1673 	if ((ifp->if_flags & IFF_BROADCAST) == 0)
   1674 		sc->sc_mode |= LE_C15_DRCVBC;
   1675 
   1676 	/*
   1677 	 * If we have MII, simply select MII in the MODE register,
   1678 	 * and clear ASEL.  Otherwise, let ASEL stand (for now),
   1679 	 * and leave PORTSEL alone (it is ignored with ASEL is set).
   1680 	 */
   1681 	if (sc->sc_flags & PCN_F_HAS_MII) {
   1682 		pcn_bcr_write(sc, LE_BCR2,
   1683 		    pcn_bcr_read(sc, LE_BCR2) & ~LE_B2_ASEL);
   1684 		sc->sc_mode |= LE_C15_PORTSEL(PORTSEL_MII);
   1685 
   1686 		/*
   1687 		 * Disable MII auto-negotiation.  We handle that in
   1688 		 * our own MII layer.
   1689 		 */
   1690 		pcn_bcr_write(sc, LE_BCR32,
   1691 		    pcn_bcr_read(sc, LE_BCR32) | LE_B32_DANAS);
   1692 	}
   1693 
   1694 	/*
   1695 	 * Set the Tx and Rx descriptor ring addresses in the init
   1696 	 * block, the TLEN and RLEN other fields of the init block
   1697 	 * MODE register.
   1698 	 */
   1699 	sc->sc_initblock.init_rdra = htole32(PCN_CDRXADDR(sc, 0));
   1700 	sc->sc_initblock.init_tdra = htole32(PCN_CDTXADDR(sc, 0));
   1701 	sc->sc_initblock.init_mode = htole32(sc->sc_mode |
   1702 	    (((uint32_t)ffs(PCN_NTXDESC) - 1) << 28) |
   1703 	    ((ffs(PCN_NRXDESC) - 1) << 20));
   1704 
   1705 	/* Set the station address in the init block. */
   1706 	sc->sc_initblock.init_padr[0] = htole32(enaddr[0] |
   1707 	    (enaddr[1] << 8) | (enaddr[2] << 16) |
   1708 	    ((uint32_t)enaddr[3] << 24));
   1709 	sc->sc_initblock.init_padr[1] = htole32(enaddr[4] |
   1710 	    (enaddr[5] << 8));
   1711 
   1712 	/* Set the multicast filter in the init block. */
   1713 	pcn_set_filter(sc);
   1714 
   1715 	/* Initialize CSR3. */
   1716 	pcn_csr_write(sc, LE_CSR3, LE_C3_MISSM | LE_C3_IDONM | LE_C3_DXSUFLO);
   1717 
   1718 	/* Initialize CSR4. */
   1719 	pcn_csr_write(sc, LE_CSR4, LE_C4_DMAPLUS | LE_C4_APAD_XMT |
   1720 	    LE_C4_MFCOM | LE_C4_RCVCCOM | LE_C4_TXSTRTM);
   1721 
   1722 	/* Initialize CSR5. */
   1723 	sc->sc_csr5 = LE_C5_LTINTEN | LE_C5_SINTE;
   1724 	pcn_csr_write(sc, LE_CSR5, sc->sc_csr5);
   1725 
   1726 	/*
   1727 	 * If we have an Am79c971 or greater, initialize CSR7.
   1728 	 *
   1729 	 * XXX Might be nice to use the MII auto-poll interrupt someday.
   1730 	 */
   1731 	switch (sc->sc_variant->pcv_chipid) {
   1732 	case PARTID_Am79c970:
   1733 	case PARTID_Am79c970A:
   1734 		/* Not available on these chips. */
   1735 		break;
   1736 
   1737 	default:
   1738 		pcn_csr_write(sc, LE_CSR7, LE_C7_FASTSPNDE);
   1739 		break;
   1740 	}
   1741 
   1742 	/*
   1743 	 * On the Am79c970A and greater, initialize BCR18 to
   1744 	 * enable burst mode.
   1745 	 *
   1746 	 * Also enable the "no underflow" option on the Am79c971 and
   1747 	 * higher, which prevents the chip from generating transmit
   1748 	 * underflows, yet sill provides decent performance.  Note if
   1749 	 * chip is not connected to external SRAM, then we still have
   1750 	 * to handle underflow errors (the NOUFLO bit is ignored in
   1751 	 * that case).
   1752 	 */
   1753 	reg = pcn_bcr_read(sc, LE_BCR18);
   1754 	switch (sc->sc_variant->pcv_chipid) {
   1755 	case PARTID_Am79c970:
   1756 		break;
   1757 
   1758 	case PARTID_Am79c970A:
   1759 		reg |= LE_B18_BREADE | LE_B18_BWRITE;
   1760 		break;
   1761 
   1762 	default:
   1763 		reg |= LE_B18_BREADE | LE_B18_BWRITE | LE_B18_NOUFLO;
   1764 		break;
   1765 	}
   1766 	pcn_bcr_write(sc, LE_BCR18, reg);
   1767 
   1768 	/*
   1769 	 * Initialize CSR80 (FIFO thresholds for Tx and Rx).
   1770 	 */
   1771 	pcn_csr_write(sc, LE_CSR80, LE_C80_RCVFW(sc->sc_rcvfw) |
   1772 	    LE_C80_XMTSP(sc->sc_xmtsp) | LE_C80_XMTFW(sc->sc_xmtfw));
   1773 
   1774 	/*
   1775 	 * Send the init block to the chip, and wait for it
   1776 	 * to be processed.
   1777 	 */
   1778 	PCN_CDINITSYNC(sc, BUS_DMASYNC_PREWRITE);
   1779 	pcn_csr_write(sc, LE_CSR1, PCN_CDINITADDR(sc) & 0xffff);
   1780 	pcn_csr_write(sc, LE_CSR2, (PCN_CDINITADDR(sc) >> 16) & 0xffff);
   1781 	pcn_csr_write(sc, LE_CSR0, LE_C0_INIT);
   1782 	delay(100);
   1783 	for (i = 0; i < 10000; i++) {
   1784 		if (pcn_csr_read(sc, LE_CSR0) & LE_C0_IDON)
   1785 			break;
   1786 		delay(10);
   1787 	}
   1788 	PCN_CDINITSYNC(sc, BUS_DMASYNC_POSTWRITE);
   1789 	if (i == 10000) {
   1790 		printf("%s: timeout processing init block\n",
   1791 		    device_xname(sc->sc_dev));
   1792 		error = EIO;
   1793 		goto out;
   1794 	}
   1795 
   1796 	/* Set the media. */
   1797 	if ((error = mii_ifmedia_change(&sc->sc_mii)) != 0)
   1798 		goto out;
   1799 
   1800 	/* Enable interrupts and external activity (and ACK IDON). */
   1801 	pcn_csr_write(sc, LE_CSR0, LE_C0_INEA | LE_C0_STRT | LE_C0_IDON);
   1802 
   1803 	if (sc->sc_flags & PCN_F_HAS_MII) {
   1804 		/* Start the one second MII clock. */
   1805 		callout_schedule(&sc->sc_tick_ch, hz);
   1806 	}
   1807 
   1808 	/* ...all done! */
   1809 	ifp->if_flags |= IFF_RUNNING;
   1810 
   1811  out:
   1812 	if (error)
   1813 		printf("%s: interface not running\n", device_xname(sc->sc_dev));
   1814 	return error;
   1815 }
   1816 
   1817 /*
   1818  * pcn_rxdrain:
   1819  *
   1820  *	Drain the receive queue.
   1821  */
   1822 static void
   1823 pcn_rxdrain(struct pcn_softc *sc)
   1824 {
   1825 	struct pcn_rxsoft *rxs;
   1826 	int i;
   1827 
   1828 	for (i = 0; i < PCN_NRXDESC; i++) {
   1829 		rxs = &sc->sc_rxsoft[i];
   1830 		if (rxs->rxs_mbuf != NULL) {
   1831 			bus_dmamap_unload(sc->sc_dmat, rxs->rxs_dmamap);
   1832 			m_freem(rxs->rxs_mbuf);
   1833 			rxs->rxs_mbuf = NULL;
   1834 		}
   1835 	}
   1836 }
   1837 
   1838 /*
   1839  * pcn_stop:		[ifnet interface function]
   1840  *
   1841  *	Stop transmission on the interface.
   1842  */
   1843 static void
   1844 pcn_stop(struct ifnet *ifp, int disable)
   1845 {
   1846 	struct pcn_softc *sc = ifp->if_softc;
   1847 	struct pcn_txsoft *txs;
   1848 	int i;
   1849 
   1850 	if (sc->sc_flags & PCN_F_HAS_MII) {
   1851 		/* Stop the one second clock. */
   1852 		callout_stop(&sc->sc_tick_ch);
   1853 
   1854 		/* Down the MII. */
   1855 		mii_down(&sc->sc_mii);
   1856 	}
   1857 
   1858 	/* Stop the chip. */
   1859 	pcn_csr_write(sc, LE_CSR0, LE_C0_STOP);
   1860 
   1861 	/* Release any queued transmit buffers. */
   1862 	for (i = 0; i < PCN_TXQUEUELEN; i++) {
   1863 		txs = &sc->sc_txsoft[i];
   1864 		if (txs->txs_mbuf != NULL) {
   1865 			bus_dmamap_unload(sc->sc_dmat, txs->txs_dmamap);
   1866 			m_freem(txs->txs_mbuf);
   1867 			txs->txs_mbuf = NULL;
   1868 		}
   1869 	}
   1870 
   1871 	/* Mark the interface as down and cancel the watchdog timer. */
   1872 	ifp->if_flags &= ~IFF_RUNNING;
   1873 	ifp->if_timer = 0;
   1874 
   1875 	if (disable)
   1876 		pcn_rxdrain(sc);
   1877 }
   1878 
   1879 /*
   1880  * pcn_add_rxbuf:
   1881  *
   1882  *	Add a receive buffer to the indicated descriptor.
   1883  */
   1884 static int
   1885 pcn_add_rxbuf(struct pcn_softc *sc, int idx)
   1886 {
   1887 	struct pcn_rxsoft *rxs = &sc->sc_rxsoft[idx];
   1888 	struct mbuf *m;
   1889 	int error;
   1890 
   1891 	MGETHDR(m, M_DONTWAIT, MT_DATA);
   1892 	if (m == NULL)
   1893 		return ENOBUFS;
   1894 	MCLAIM(m, &sc->sc_ethercom.ec_rx_mowner);
   1895 
   1896 	MCLGET(m, M_DONTWAIT);
   1897 	if ((m->m_flags & M_EXT) == 0) {
   1898 		m_freem(m);
   1899 		return ENOBUFS;
   1900 	}
   1901 
   1902 	if (rxs->rxs_mbuf != NULL)
   1903 		bus_dmamap_unload(sc->sc_dmat, rxs->rxs_dmamap);
   1904 
   1905 	rxs->rxs_mbuf = m;
   1906 
   1907 	error = bus_dmamap_load(sc->sc_dmat, rxs->rxs_dmamap,
   1908 	    m->m_ext.ext_buf, m->m_ext.ext_size, NULL,
   1909 	    BUS_DMA_READ | BUS_DMA_NOWAIT);
   1910 	if (error) {
   1911 		printf("%s: can't load rx DMA map %d, error = %d\n",
   1912 		    device_xname(sc->sc_dev), idx, error);
   1913 		panic("pcn_add_rxbuf");
   1914 	}
   1915 
   1916 	bus_dmamap_sync(sc->sc_dmat, rxs->rxs_dmamap, 0,
   1917 	    rxs->rxs_dmamap->dm_mapsize, BUS_DMASYNC_PREREAD);
   1918 
   1919 	PCN_INIT_RXDESC(sc, idx);
   1920 
   1921 	return 0;
   1922 }
   1923 
   1924 /*
   1925  * pcn_set_filter:
   1926  *
   1927  *	Set up the receive filter.
   1928  */
   1929 static void
   1930 pcn_set_filter(struct pcn_softc *sc)
   1931 {
   1932 	struct ethercom *ec = &sc->sc_ethercom;
   1933 	struct ifnet *ifp = &sc->sc_ethercom.ec_if;
   1934 	struct ether_multi *enm;
   1935 	struct ether_multistep step;
   1936 	uint32_t crc;
   1937 
   1938 	/*
   1939 	 * Set up the multicast address filter by passing all multicast
   1940 	 * addresses through a CRC generator, and then using the high
   1941 	 * order 6 bits as an index into the 64-bit logical address
   1942 	 * filter.  The high order bits select the word, while the rest
   1943 	 * of the bits select the bit within the word.
   1944 	 */
   1945 
   1946 	if (ifp->if_flags & IFF_PROMISC)
   1947 		goto allmulti;
   1948 
   1949 	sc->sc_initblock.init_ladrf[0] =
   1950 	    sc->sc_initblock.init_ladrf[1] =
   1951 	    sc->sc_initblock.init_ladrf[2] =
   1952 	    sc->sc_initblock.init_ladrf[3] = 0;
   1953 
   1954 	ETHER_LOCK(ec);
   1955 	ETHER_FIRST_MULTI(step, ec, enm);
   1956 	while (enm != NULL) {
   1957 		if (memcmp(enm->enm_addrlo, enm->enm_addrhi, ETHER_ADDR_LEN)) {
   1958 			/*
   1959 			 * We must listen to a range of multicast addresses.
   1960 			 * For now, just accept all multicasts, rather than
   1961 			 * trying to set only those filter bits needed to match
   1962 			 * the range.  (At this time, the only use of address
   1963 			 * ranges is for IP multicast routing, for which the
   1964 			 * range is big enough to require all bits set.)
   1965 			 */
   1966 			ETHER_UNLOCK(ec);
   1967 			goto allmulti;
   1968 		}
   1969 
   1970 		crc = ether_crc32_le(enm->enm_addrlo, ETHER_ADDR_LEN);
   1971 
   1972 		/* Just want the 6 most significant bits. */
   1973 		crc >>= 26;
   1974 
   1975 		/* Set the corresponding bit in the filter. */
   1976 		sc->sc_initblock.init_ladrf[crc >> 4] |=
   1977 		    htole16(1 << (crc & 0xf));
   1978 
   1979 		ETHER_NEXT_MULTI(step, enm);
   1980 	}
   1981 	ETHER_UNLOCK(ec);
   1982 
   1983 	ifp->if_flags &= ~IFF_ALLMULTI;
   1984 	return;
   1985 
   1986  allmulti:
   1987 	ifp->if_flags |= IFF_ALLMULTI;
   1988 	sc->sc_initblock.init_ladrf[0] =
   1989 	    sc->sc_initblock.init_ladrf[1] =
   1990 	    sc->sc_initblock.init_ladrf[2] =
   1991 	    sc->sc_initblock.init_ladrf[3] = 0xffff;
   1992 }
   1993 
   1994 /*
   1995  * pcn_79c970_mediainit:
   1996  *
   1997  *	Initialize media for the Am79c970.
   1998  */
   1999 static void
   2000 pcn_79c970_mediainit(struct pcn_softc *sc)
   2001 {
   2002 	struct ifnet *ifp = &sc->sc_ethercom.ec_if;
   2003 	struct mii_data * const mii = &sc->sc_mii;
   2004 	const char *sep = "";
   2005 
   2006 	mii->mii_ifp = ifp;
   2007 
   2008 	ifmedia_init(&mii->mii_media, IFM_IMASK, pcn_79c970_mediachange,
   2009 	    pcn_79c970_mediastatus);
   2010 
   2011 #define	ADD(str, m, d)							\
   2012 do {									\
   2013 	aprint_normal("%s%s", sep, str);				\
   2014 	ifmedia_add(&mii->mii_media, IFM_ETHER | (m), (d), NULL);	\
   2015 	sep = ", ";							\
   2016 } while (/*CONSTCOND*/0)
   2017 
   2018 	aprint_normal("%s: ", device_xname(sc->sc_dev));
   2019 	ADD("10base5", IFM_10_5, PORTSEL_AUI);
   2020 	if (sc->sc_variant->pcv_chipid == PARTID_Am79c970A)
   2021 		ADD("10base5-FDX", IFM_10_5 | IFM_FDX, PORTSEL_AUI);
   2022 	ADD("10baseT", IFM_10_T, PORTSEL_10T);
   2023 	if (sc->sc_variant->pcv_chipid == PARTID_Am79c970A)
   2024 		ADD("10baseT-FDX", IFM_10_T | IFM_FDX, PORTSEL_10T);
   2025 	ADD("auto", IFM_AUTO, 0);
   2026 	if (sc->sc_variant->pcv_chipid == PARTID_Am79c970A)
   2027 		ADD("auto-FDX", IFM_AUTO | IFM_FDX, 0);
   2028 	aprint_normal("\n");
   2029 
   2030 	ifmedia_set(&mii->mii_media, IFM_ETHER | IFM_AUTO);
   2031 }
   2032 
   2033 /*
   2034  * pcn_79c970_mediastatus:	[ifmedia interface function]
   2035  *
   2036  *	Get the current interface media status (Am79c970 version).
   2037  */
   2038 static void
   2039 pcn_79c970_mediastatus(struct ifnet *ifp, struct ifmediareq *ifmr)
   2040 {
   2041 	struct pcn_softc *sc = ifp->if_softc;
   2042 
   2043 	/*
   2044 	 * The currently selected media is always the active media.
   2045 	 * Note: We have no way to determine what media the AUTO
   2046 	 * process picked.
   2047 	 */
   2048 	ifmr->ifm_active = sc->sc_mii.mii_media.ifm_media;
   2049 }
   2050 
   2051 /*
   2052  * pcn_79c970_mediachange:	[ifmedia interface function]
   2053  *
   2054  *	Set hardware to newly-selected media (Am79c970 version).
   2055  */
   2056 static int
   2057 pcn_79c970_mediachange(struct ifnet *ifp)
   2058 {
   2059 	struct pcn_softc *sc = ifp->if_softc;
   2060 	uint32_t reg;
   2061 
   2062 	if (IFM_SUBTYPE(sc->sc_mii.mii_media.ifm_media) == IFM_AUTO) {
   2063 		/*
   2064 		 * CSR15:PORTSEL doesn't matter.  Just set BCR2:ASEL.
   2065 		 */
   2066 		reg = pcn_bcr_read(sc, LE_BCR2);
   2067 		reg |= LE_B2_ASEL;
   2068 		pcn_bcr_write(sc, LE_BCR2, reg);
   2069 	} else {
   2070 		/*
   2071 		 * Clear BCR2:ASEL and set the new CSR15:PORTSEL value.
   2072 		 */
   2073 		reg = pcn_bcr_read(sc, LE_BCR2);
   2074 		reg &= ~LE_B2_ASEL;
   2075 		pcn_bcr_write(sc, LE_BCR2, reg);
   2076 
   2077 		reg = pcn_csr_read(sc, LE_CSR15);
   2078 		reg = (reg & ~LE_C15_PORTSEL(PORTSEL_MASK)) |
   2079 		    LE_C15_PORTSEL(sc->sc_mii.mii_media.ifm_cur->ifm_data);
   2080 		pcn_csr_write(sc, LE_CSR15, reg);
   2081 	}
   2082 
   2083 	if ((sc->sc_mii.mii_media.ifm_media & IFM_FDX) != 0) {
   2084 		reg = LE_B9_FDEN;
   2085 		if (IFM_SUBTYPE(sc->sc_mii.mii_media.ifm_media) == IFM_10_5)
   2086 			reg |= LE_B9_AUIFD;
   2087 		pcn_bcr_write(sc, LE_BCR9, reg);
   2088 	} else
   2089 		pcn_bcr_write(sc, LE_BCR9, 0);
   2090 
   2091 	return 0;
   2092 }
   2093 
   2094 /*
   2095  * pcn_79c971_mediainit:
   2096  *
   2097  *	Initialize media for the Am79c971.
   2098  */
   2099 static void
   2100 pcn_79c971_mediainit(struct pcn_softc *sc)
   2101 {
   2102 	struct ifnet *ifp = &sc->sc_ethercom.ec_if;
   2103 	struct mii_data * const mii = &sc->sc_mii;
   2104 
   2105 	/* We have MII. */
   2106 	sc->sc_flags |= PCN_F_HAS_MII;
   2107 
   2108 	/*
   2109 	 * The built-in 10BASE-T interface is mapped to the MII
   2110 	 * on the PCNet-FAST.  Unfortunately, there's no EEPROM
   2111 	 * word that tells us which PHY to use.
   2112 	 * This driver used to ignore all but the first PHY to
   2113 	 * answer, but this code was removed to support multiple
   2114 	 * external PHYs. As the default instance will be the first
   2115 	 * one to answer, no harm is done by letting the possibly
   2116 	 * non-connected internal PHY show up.
   2117 	 */
   2118 
   2119 	/* Initialize our media structures and probe the MII. */
   2120 	mii->mii_ifp = ifp;
   2121 	mii->mii_readreg = pcn_mii_readreg;
   2122 	mii->mii_writereg = pcn_mii_writereg;
   2123 	mii->mii_statchg = pcn_mii_statchg;
   2124 
   2125 	sc->sc_ethercom.ec_mii = mii;
   2126 	ifmedia_init(&mii->mii_media, 0, ether_mediachange, ether_mediastatus);
   2127 
   2128 	mii_attach(sc->sc_dev, mii, 0xffffffff, MII_PHY_ANY,
   2129 	    MII_OFFSET_ANY, 0);
   2130 	if (LIST_FIRST(&mii->mii_phys) == NULL) {
   2131 		ifmedia_add(&mii->mii_media, IFM_ETHER | IFM_NONE, 0, NULL);
   2132 		ifmedia_set(&mii->mii_media, IFM_ETHER | IFM_NONE);
   2133 	} else
   2134 		ifmedia_set(&mii->mii_media, IFM_ETHER | IFM_AUTO);
   2135 }
   2136 
   2137 /*
   2138  * pcn_mii_readreg:	[mii interface function]
   2139  *
   2140  *	Read a PHY register on the MII.
   2141  */
   2142 static int
   2143 pcn_mii_readreg(device_t self, int phy, int reg, uint16_t *val)
   2144 {
   2145 	struct pcn_softc *sc = device_private(self);
   2146 
   2147 	pcn_bcr_write(sc, LE_BCR33, reg | (phy << PHYAD_SHIFT));
   2148 	*val = pcn_bcr_read(sc, LE_BCR34) & LE_B34_MIIMD;
   2149 	if (*val == 0xffff)
   2150 		return -1;
   2151 
   2152 	return 0;
   2153 }
   2154 
   2155 /*
   2156  * pcn_mii_writereg:	[mii interface function]
   2157  *
   2158  *	Write a PHY register on the MII.
   2159  */
   2160 static int
   2161 pcn_mii_writereg(device_t self, int phy, int reg, uint16_t val)
   2162 {
   2163 	struct pcn_softc *sc = device_private(self);
   2164 
   2165 	pcn_bcr_write(sc, LE_BCR33, reg | (phy << PHYAD_SHIFT));
   2166 	pcn_bcr_write(sc, LE_BCR34, val);
   2167 
   2168 	return 0;
   2169 }
   2170 
   2171 /*
   2172  * pcn_mii_statchg:	[mii interface function]
   2173  *
   2174  *	Callback from MII layer when media changes.
   2175  */
   2176 static void
   2177 pcn_mii_statchg(struct ifnet *ifp)
   2178 {
   2179 	struct pcn_softc *sc = ifp->if_softc;
   2180 
   2181 	if ((sc->sc_mii.mii_media_active & IFM_FDX) != 0)
   2182 		pcn_bcr_write(sc, LE_BCR9, LE_B9_FDEN);
   2183 	else
   2184 		pcn_bcr_write(sc, LE_BCR9, 0);
   2185 }
   2186