Home | History | Annotate | Line # | Download | only in ic
mb86960.c revision 1.64
      1 /*	$NetBSD: mb86960.c,v 1.64 2006/03/29 04:16:49 thorpej Exp $	*/
      2 
      3 /*
      4  * All Rights Reserved, Copyright (C) Fujitsu Limited 1995
      5  *
      6  * This software may be used, modified, copied, distributed, and sold, in
      7  * both source and binary form provided that the above copyright, these
      8  * terms and the following disclaimer are retained.  The name of the author
      9  * and/or the contributor may not be used to endorse or promote products
     10  * derived from this software without specific prior written permission.
     11  *
     12  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND THE CONTRIBUTOR ``AS IS'' AND
     13  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
     14  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
     15  * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR THE CONTRIBUTOR BE LIABLE
     16  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
     17  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
     18  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION.
     19  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
     20  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
     21  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
     22  * SUCH DAMAGE.
     23  */
     24 
     25 /*
     26  * Portions copyright (C) 1993, David Greenman.  This software may be used,
     27  * modified, copied, distributed, and sold, in both source and binary form
     28  * provided that the above copyright and these terms are retained.  Under no
     29  * circumstances is the author responsible for the proper functioning of this
     30  * software, nor does the author assume any responsibility for damages
     31  * incurred with its use.
     32  */
     33 
     34 #include <sys/cdefs.h>
     35 __KERNEL_RCSID(0, "$NetBSD: mb86960.c,v 1.64 2006/03/29 04:16:49 thorpej Exp $");
     36 
     37 /*
     38  * Device driver for Fujitsu MB86960A/MB86965A based Ethernet cards.
     39  * Contributed by M.S. <seki (at) sysrap.cs.fujitsu.co.jp>
     40  *
     41  * This version is intended to be a generic template for various
     42  * MB86960A/MB86965A based Ethernet cards.  It currently supports
     43  * Fujitsu FMV-180 series (i.e., FMV-181 and FMV-182) and Allied-
     44  * Telesis AT1700 series and RE2000 series.  There are some
     45  * unnecessary hooks embedded, which are primarily intended to support
     46  * other types of Ethernet cards, but the author is not sure whether
     47  * they are useful.
     48  */
     49 
     50 #include "opt_inet.h"
     51 #include "opt_ns.h"
     52 #include "bpfilter.h"
     53 #include "rnd.h"
     54 
     55 #include <sys/param.h>
     56 #include <sys/systm.h>
     57 #include <sys/errno.h>
     58 #include <sys/ioctl.h>
     59 #include <sys/mbuf.h>
     60 #include <sys/socket.h>
     61 #include <sys/syslog.h>
     62 #include <sys/device.h>
     63 #if NRND > 0
     64 #include <sys/rnd.h>
     65 #endif
     66 
     67 #include <net/if.h>
     68 #include <net/if_dl.h>
     69 #include <net/if_types.h>
     70 #include <net/if_media.h>
     71 #include <net/if_ether.h>
     72 
     73 #ifdef INET
     74 #include <netinet/in.h>
     75 #include <netinet/in_systm.h>
     76 #include <netinet/in_var.h>
     77 #include <netinet/ip.h>
     78 #include <netinet/if_inarp.h>
     79 #endif
     80 
     81 #ifdef NS
     82 #include <netns/ns.h>
     83 #include <netns/ns_if.h>
     84 #endif
     85 
     86 #if NBPFILTER > 0
     87 #include <net/bpf.h>
     88 #include <net/bpfdesc.h>
     89 #endif
     90 
     91 #include <machine/bus.h>
     92 
     93 #include <dev/ic/mb86960reg.h>
     94 #include <dev/ic/mb86960var.h>
     95 
     96 #ifndef __BUS_SPACE_HAS_STREAM_METHODS
     97 #define bus_space_write_stream_2	bus_space_write_2
     98 #define bus_space_write_multi_stream_2	bus_space_write_multi_2
     99 #define bus_space_read_multi_stream_2	bus_space_read_multi_2
    100 #endif /* __BUS_SPACE_HAS_STREAM_METHODS */
    101 
    102 /* Standard driver entry points.  These can be static. */
    103 void	mb86960_init(struct mb86960_softc *);
    104 int	mb86960_ioctl(struct ifnet *, u_long, caddr_t);
    105 void	mb86960_start(struct ifnet *);
    106 void	mb86960_reset(struct mb86960_softc *);
    107 void	mb86960_watchdog(struct ifnet *);
    108 
    109 /* Local functions.  Order of declaration is confused.  FIXME. */
    110 int	mb86960_get_packet(struct mb86960_softc *, u_int);
    111 void	mb86960_stop(struct mb86960_softc *);
    112 void	mb86960_tint(struct mb86960_softc *, uint8_t);
    113 void	mb86960_rint(struct mb86960_softc *, uint8_t);
    114 static inline
    115 void	mb86960_xmit(struct mb86960_softc *);
    116 void	mb86960_write_mbufs(struct mb86960_softc *, struct mbuf *);
    117 static inline
    118 void	mb86960_droppacket(struct mb86960_softc *);
    119 void	mb86960_getmcaf(struct ethercom *, uint8_t *);
    120 void	mb86960_setmode(struct mb86960_softc *);
    121 void	mb86960_loadmar(struct mb86960_softc *);
    122 
    123 int	mb86960_mediachange(struct ifnet *);
    124 void	mb86960_mediastatus(struct ifnet *, struct ifmediareq *);
    125 
    126 #if FE_DEBUG >= 1
    127 void	mb86960_dump(int, struct mb86960_softc *);
    128 #endif
    129 
    130 void
    131 mb86960_attach(struct mb86960_softc *sc, uint8_t *myea)
    132 {
    133 	bus_space_tag_t bst = sc->sc_bst;
    134 	bus_space_handle_t bsh = sc->sc_bsh;
    135 
    136 	/* Register values which depend on board design. */
    137 	sc->proto_dlcr4 = FE_D4_LBC_DISABLE | FE_D4_CNTRL;
    138 	sc->proto_dlcr5 = 0;
    139 	sc->proto_dlcr7 = FE_D7_BYTSWP_LH;
    140 	if ((sc->sc_flags & FE_FLAGS_MB86960) != 0)
    141 		sc->proto_dlcr7 |= FE_D7_ED_TEST; /* XXX */
    142 	sc->proto_bmpr13 = FE_B13_TPTYPE_UTP | FE_B13_PORT_AUTO;
    143 
    144 	/*
    145 	 * Program the 86960 as following defaults:
    146 	 *	SRAM: 32KB, 100ns, byte-wide access.
    147 	 *	Transmission buffer: 4KB x 2.
    148 	 *	System bus interface: 16 bits.
    149 	 * These values except TXBSIZE should be modified as per
    150 	 * sc_flags which is set in MD attachments, because they
    151 	 * are hard-wired on the board. Modifying TXBSIZE will affect
    152 	 * the driver performance.
    153 	 */
    154 	sc->proto_dlcr6 = FE_D6_BUFSIZ_32KB | FE_D6_TXBSIZ_2x4KB |
    155 	    FE_D6_BBW_BYTE | FE_D6_SRAM_100ns;
    156 	if (sc->sc_flags & FE_FLAGS_SBW_BYTE)
    157 		sc->proto_dlcr6 |= FE_D6_SBW_BYTE;
    158 	if (sc->sc_flags & FE_FLAGS_SRAM_150ns)
    159 		sc->proto_dlcr6 &= ~FE_D6_SRAM_100ns;
    160 
    161 	/*
    162 	 * Minimum initialization of the hardware.
    163 	 * We write into registers; hope I/O ports have no
    164 	 * overlap with other boards.
    165 	 */
    166 
    167 	/* Initialize 86960. */
    168 	bus_space_write_1(bst, bsh, FE_DLCR6,
    169 	    sc->proto_dlcr6 | FE_D6_DLC_DISABLE);
    170 	delay(200);
    171 
    172 #ifdef DIAGNOSTIC
    173 	if (myea == NULL) {
    174 		printf("%s: ethernet address shouldn't be NULL\n",
    175 		    sc->sc_dev.dv_xname);
    176 		panic("NULL ethernet address");
    177 	}
    178 #endif
    179 	memcpy(sc->sc_enaddr, myea, sizeof(sc->sc_enaddr));
    180 
    181 	/* Disable all interrupts. */
    182 	bus_space_write_1(bst, bsh, FE_DLCR2, 0);
    183 	bus_space_write_1(bst, bsh, FE_DLCR3, 0);
    184 }
    185 
    186 /*
    187  * Install interface into kernel networking data structures
    188  */
    189 void
    190 mb86960_config(struct mb86960_softc *sc, int *media, int nmedia, int defmedia)
    191 {
    192 	struct cfdata *cf = device_cfdata(&sc->sc_dev);
    193 	struct ifnet *ifp = &sc->sc_ec.ec_if;
    194 	int i;
    195 
    196 	/* Stop the 86960. */
    197 	mb86960_stop(sc);
    198 
    199 	/* Initialize ifnet structure. */
    200 	strcpy(ifp->if_xname, sc->sc_dev.dv_xname);
    201 	ifp->if_softc = sc;
    202 	ifp->if_start = mb86960_start;
    203 	ifp->if_ioctl = mb86960_ioctl;
    204 	ifp->if_watchdog = mb86960_watchdog;
    205 	ifp->if_flags =
    206 	    IFF_BROADCAST | IFF_SIMPLEX | IFF_NOTRAILERS | IFF_MULTICAST;
    207 	IFQ_SET_READY(&ifp->if_snd);
    208 
    209 #if FE_DEBUG >= 3
    210 	log(LOG_INFO, "%s: mb86960_config()\n", sc->sc_dev.dv_xname);
    211 	mb86960_dump(LOG_INFO, sc);
    212 #endif
    213 
    214 #if FE_SINGLE_TRANSMISSION
    215 	/* Override txb config to allocate minimum. */
    216 	sc->proto_dlcr6 &= ~FE_D6_TXBSIZ;
    217 	sc->proto_dlcr6 |=  FE_D6_TXBSIZ_2x2KB;
    218 #endif
    219 
    220 	/* Modify hardware config if it is requested. */
    221 	if ((cf->cf_flags & FE_FLAGS_OVERRIDE_DLCR6) != 0)
    222 		sc->proto_dlcr6 = cf->cf_flags & FE_FLAGS_DLCR6_VALUE;
    223 
    224 	/* Find TX buffer size, based on the hardware dependent proto. */
    225 	switch (sc->proto_dlcr6 & FE_D6_TXBSIZ) {
    226 	case FE_D6_TXBSIZ_2x2KB:
    227 		sc->txb_size = 2048;
    228 		break;
    229 	case FE_D6_TXBSIZ_2x4KB:
    230 		sc->txb_size = 4096;
    231 		break;
    232 	case FE_D6_TXBSIZ_2x8KB:
    233 		sc->txb_size = 8192;
    234 		break;
    235 	default:
    236 		/* Oops, we can't work with single buffer configuration. */
    237 #if FE_DEBUG >= 2
    238 		log(LOG_WARNING, "%s: strange TXBSIZ config; fixing\n",
    239 		    sc->sc_dev.dv_xname);
    240 #endif
    241 		sc->proto_dlcr6 &= ~FE_D6_TXBSIZ;
    242 		sc->proto_dlcr6 |=  FE_D6_TXBSIZ_2x2KB;
    243 		sc->txb_size = 2048;
    244 		break;
    245 	}
    246 
    247 	/* Initialize media goo. */
    248 	ifmedia_init(&sc->sc_media, 0, mb86960_mediachange,
    249 	    mb86960_mediastatus);
    250 	if (media != NULL) {
    251 		for (i = 0; i < nmedia; i++)
    252 			ifmedia_add(&sc->sc_media, media[i], 0, NULL);
    253 		ifmedia_set(&sc->sc_media, defmedia);
    254 	} else {
    255 		ifmedia_add(&sc->sc_media, IFM_ETHER|IFM_MANUAL, 0, NULL);
    256 		ifmedia_set(&sc->sc_media, IFM_ETHER|IFM_MANUAL);
    257 	}
    258 
    259 	/* Attach the interface. */
    260 	if_attach(ifp);
    261 	ether_ifattach(ifp, sc->sc_enaddr);
    262 
    263 #if NRND > 0
    264 	rnd_attach_source(&sc->rnd_source, sc->sc_dev.dv_xname,
    265 	    RND_TYPE_NET, 0);
    266 #endif
    267 	/* Print additional info when attached. */
    268 	printf("%s: Ethernet address %s\n", sc->sc_dev.dv_xname,
    269 	    ether_sprintf(sc->sc_enaddr));
    270 
    271 #if FE_DEBUG >= 3
    272 	{
    273 		int buf, txb, bbw, sbw, ram;
    274 
    275 		buf = txb = bbw = sbw = ram = -1;
    276 		switch (sc->proto_dlcr6 & FE_D6_BUFSIZ) {
    277 		case FE_D6_BUFSIZ_8KB:
    278 			buf = 8;
    279 			break;
    280 		case FE_D6_BUFSIZ_16KB:
    281 			buf = 16;
    282 			break;
    283 		case FE_D6_BUFSIZ_32KB:
    284 			buf = 32;
    285 			break;
    286 		case FE_D6_BUFSIZ_64KB:
    287 			buf = 64;
    288 			break;
    289 		}
    290 		switch (sc->proto_dlcr6 & FE_D6_TXBSIZ) {
    291 		case FE_D6_TXBSIZ_2x2KB:
    292 			txb = 2;
    293 			break;
    294 		case FE_D6_TXBSIZ_2x4KB:
    295 			txb = 4;
    296 			break;
    297 		case FE_D6_TXBSIZ_2x8KB:
    298 			txb = 8;
    299 			break;
    300 		}
    301 		switch (sc->proto_dlcr6 & FE_D6_BBW) {
    302 		case FE_D6_BBW_BYTE:
    303 			bbw = 8;
    304 			break;
    305 		case FE_D6_BBW_WORD:
    306 			bbw = 16;
    307 			break;
    308 		}
    309 		switch (sc->proto_dlcr6 & FE_D6_SBW) {
    310 		case FE_D6_SBW_BYTE:
    311 			sbw = 8;
    312 			break;
    313 		case FE_D6_SBW_WORD:
    314 			sbw = 16;
    315 			break;
    316 		}
    317 		switch (sc->proto_dlcr6 & FE_D6_SRAM) {
    318 		case FE_D6_SRAM_100ns:
    319 			ram = 100;
    320 			break;
    321 		case FE_D6_SRAM_150ns:
    322 			ram = 150;
    323 			break;
    324 		}
    325 		printf("%s: SRAM %dKB %dbit %dns, TXB %dKBx2, %dbit I/O\n",
    326 		    sc->sc_dev.dv_xname, buf, bbw, ram, txb, sbw);
    327 	}
    328 #endif
    329 
    330 	/* The attach is successful. */
    331 	sc->sc_stat |= FE_STAT_ATTACHED;
    332 }
    333 
    334 /*
    335  * Media change callback.
    336  */
    337 int
    338 mb86960_mediachange(struct ifnet *ifp)
    339 {
    340 	struct mb86960_softc *sc = ifp->if_softc;
    341 
    342 	if (sc->sc_mediachange)
    343 		return ((*sc->sc_mediachange)(sc));
    344 	return (0);
    345 }
    346 
    347 /*
    348  * Media status callback.
    349  */
    350 void
    351 mb86960_mediastatus(struct ifnet *ifp, struct ifmediareq *ifmr)
    352 {
    353 	struct mb86960_softc *sc = ifp->if_softc;
    354 
    355 	if ((sc->sc_stat & FE_STAT_ENABLED) == 0) {
    356 		ifmr->ifm_active = IFM_ETHER | IFM_NONE;
    357 		ifmr->ifm_status = 0;
    358 		return;
    359 	}
    360 
    361 	if (sc->sc_mediastatus)
    362 		(*sc->sc_mediastatus)(sc, ifmr);
    363 }
    364 
    365 /*
    366  * Reset interface.
    367  */
    368 void
    369 mb86960_reset(struct mb86960_softc *sc)
    370 {
    371 	int s;
    372 
    373 	s = splnet();
    374 	mb86960_stop(sc);
    375 	mb86960_init(sc);
    376 	splx(s);
    377 }
    378 
    379 /*
    380  * Stop everything on the interface.
    381  *
    382  * All buffered packets, both transmitting and receiving,
    383  * if any, will be lost by stopping the interface.
    384  */
    385 void
    386 mb86960_stop(struct mb86960_softc *sc)
    387 {
    388 	bus_space_tag_t bst = sc->sc_bst;
    389 	bus_space_handle_t bsh = sc->sc_bsh;
    390 
    391 #if FE_DEBUG >= 3
    392 	log(LOG_INFO, "%s: top of mb86960_stop()\n", sc->sc_dev.dv_xname);
    393 	mb86960_dump(LOG_INFO, sc);
    394 #endif
    395 
    396 	/* Disable interrupts. */
    397 	bus_space_write_1(bst, bsh, FE_DLCR2, 0x00);
    398 	bus_space_write_1(bst, bsh, FE_DLCR3, 0x00);
    399 
    400 	/* Stop interface hardware. */
    401 	delay(200);
    402 	bus_space_write_1(bst, bsh, FE_DLCR6,
    403 	    sc->proto_dlcr6 | FE_D6_DLC_DISABLE);
    404 	delay(200);
    405 
    406 	/* Clear all interrupt status. */
    407 	bus_space_write_1(bst, bsh, FE_DLCR0, 0xFF);
    408 	bus_space_write_1(bst, bsh, FE_DLCR1, 0xFF);
    409 
    410 	/* Put the chip in stand-by mode. */
    411 	delay(200);
    412 	bus_space_write_1(bst, bsh, FE_DLCR7,
    413 	    sc->proto_dlcr7 | FE_D7_POWER_DOWN);
    414 	delay(200);
    415 
    416 	/* MAR loading can be delayed. */
    417 	sc->filter_change = 0;
    418 
    419 	/* Call a hook. */
    420 	if (sc->stop_card)
    421 		(*sc->stop_card)(sc);
    422 
    423 #if FE_DEBUG >= 3
    424 	log(LOG_INFO, "%s: end of mb86960_stop()\n", sc->sc_dev.dv_xname);
    425 	mb86960_dump(LOG_INFO, sc);
    426 #endif
    427 }
    428 
    429 /*
    430  * Device timeout/watchdog routine. Entered if the device neglects to
    431  * generate an interrupt after a transmit has been started on it.
    432  */
    433 void
    434 mb86960_watchdog(struct ifnet *ifp)
    435 {
    436 	struct mb86960_softc *sc = ifp->if_softc;
    437 
    438 	log(LOG_ERR, "%s: device timeout\n", sc->sc_dev.dv_xname);
    439 #if FE_DEBUG >= 3
    440 	mb86960_dump(LOG_INFO, sc);
    441 #endif
    442 
    443 	/* Record how many packets are lost by this accident. */
    444 	sc->sc_ec.ec_if.if_oerrors += sc->txb_sched + sc->txb_count;
    445 
    446 	mb86960_reset(sc);
    447 }
    448 
    449 /*
    450  * Drop (skip) a packet from receive buffer in 86960 memory.
    451  */
    452 static inline void
    453 mb86960_droppacket(struct mb86960_softc *sc)
    454 {
    455 	bus_space_tag_t bst = sc->sc_bst;
    456 	bus_space_handle_t bsh = sc->sc_bsh;
    457 
    458 	bus_space_write_1(bst, bsh, FE_BMPR14, FE_B14_FILTER | FE_B14_SKIP);
    459 }
    460 
    461 /*
    462  * Initialize device.
    463  */
    464 void
    465 mb86960_init(struct mb86960_softc *sc)
    466 {
    467 	bus_space_tag_t bst = sc->sc_bst;
    468 	bus_space_handle_t bsh = sc->sc_bsh;
    469 	struct ifnet *ifp = &sc->sc_ec.ec_if;
    470 	int i;
    471 
    472 #if FE_DEBUG >= 3
    473 	log(LOG_INFO, "%s: top of mb86960_init()\n", sc->sc_dev.dv_xname);
    474 	mb86960_dump(LOG_INFO, sc);
    475 #endif
    476 
    477 	/* Reset transmitter flags. */
    478 	ifp->if_flags &= ~IFF_OACTIVE;
    479 	ifp->if_timer = 0;
    480 
    481 	sc->txb_free = sc->txb_size;
    482 	sc->txb_count = 0;
    483 	sc->txb_sched = 0;
    484 
    485 	/* Do any card-specific initialization, if applicable. */
    486 	if (sc->init_card)
    487 		(*sc->init_card)(sc);
    488 
    489 #if FE_DEBUG >= 3
    490 	log(LOG_INFO, "%s: after init hook\n", sc->sc_dev.dv_xname);
    491 	mb86960_dump(LOG_INFO, sc);
    492 #endif
    493 
    494 	/*
    495 	 * Make sure to disable the chip, also.
    496 	 * This may also help re-programming the chip after
    497 	 * hot insertion of PCMCIAs.
    498 	 */
    499 	bus_space_write_1(bst, bsh, FE_DLCR6,
    500 	    sc->proto_dlcr6 | FE_D6_DLC_DISABLE);
    501 	delay(200);
    502 
    503 	/* Power up the chip and select register bank for DLCRs. */
    504 	bus_space_write_1(bst, bsh, FE_DLCR7,
    505 	    sc->proto_dlcr7 | FE_D7_RBS_DLCR | FE_D7_POWER_UP);
    506 	delay(200);
    507 
    508 	/* Feed the station address. */
    509 	bus_space_write_region_1(bst, bsh, FE_DLCR8,
    510 	    sc->sc_enaddr, ETHER_ADDR_LEN);
    511 
    512 	/* Select the BMPR bank for runtime register access. */
    513 	bus_space_write_1(bst, bsh, FE_DLCR7,
    514 	    sc->proto_dlcr7 | FE_D7_RBS_BMPR | FE_D7_POWER_UP);
    515 
    516 	/* Initialize registers. */
    517 	bus_space_write_1(bst, bsh, FE_DLCR0, 0xFF);	/* Clear all bits. */
    518 	bus_space_write_1(bst, bsh, FE_DLCR1, 0xFF);	/* ditto. */
    519 	bus_space_write_1(bst, bsh, FE_DLCR2, 0x00);
    520 	bus_space_write_1(bst, bsh, FE_DLCR3, 0x00);
    521 	bus_space_write_1(bst, bsh, FE_DLCR4, sc->proto_dlcr4);
    522 	bus_space_write_1(bst, bsh, FE_DLCR5, sc->proto_dlcr5);
    523 	bus_space_write_1(bst, bsh, FE_BMPR10, 0x00);
    524 	bus_space_write_1(bst, bsh, FE_BMPR11, FE_B11_CTRL_SKIP);
    525 	bus_space_write_1(bst, bsh, FE_BMPR12, 0x00);
    526 	bus_space_write_1(bst, bsh, FE_BMPR13, sc->proto_bmpr13);
    527 	bus_space_write_1(bst, bsh, FE_BMPR14, FE_B14_FILTER);
    528 	bus_space_write_1(bst, bsh, FE_BMPR15, 0x00);
    529 
    530 #if FE_DEBUG >= 3
    531 	log(LOG_INFO, "%s: just before enabling DLC\n", sc->sc_dev.dv_xname);
    532 	mb86960_dump(LOG_INFO, sc);
    533 #endif
    534 
    535 	/* Enable interrupts. */
    536 	bus_space_write_1(bst, bsh, FE_DLCR2, FE_TMASK);
    537 	bus_space_write_1(bst, bsh, FE_DLCR3, FE_RMASK);
    538 
    539 	/* Enable transmitter and receiver. */
    540 	delay(200);
    541 	bus_space_write_1(bst, bsh, FE_DLCR6,
    542 	    sc->proto_dlcr6 | FE_D6_DLC_ENABLE);
    543 	delay(200);
    544 
    545 #if FE_DEBUG >= 3
    546 	log(LOG_INFO, "%s: just after enabling DLC\n", sc->sc_dev.dv_xname);
    547 	mb86960_dump(LOG_INFO, sc);
    548 #endif
    549 
    550 	/*
    551 	 * Make sure to empty the receive buffer.
    552 	 *
    553 	 * This may be redundant, but *if* the receive buffer were full
    554 	 * at this point, the driver would hang.  I have experienced
    555 	 * some strange hangups just after UP.  I hope the following
    556 	 * code solve the problem.
    557 	 *
    558 	 * I have changed the order of hardware initialization.
    559 	 * I think the receive buffer cannot have any packets at this
    560 	 * point in this version.  The following code *must* be
    561 	 * redundant now.  FIXME.
    562 	 */
    563 	for (i = 0; i < FE_MAX_RECV_COUNT; i++) {
    564 		if (bus_space_read_1(bst, bsh, FE_DLCR5) & FE_D5_BUFEMP)
    565 			break;
    566 		mb86960_droppacket(sc);
    567 	}
    568 #if FE_DEBUG >= 1
    569 	if (i >= FE_MAX_RECV_COUNT)
    570 		log(LOG_ERR, "%s: cannot empty receive buffer\n",
    571 		    sc->sc_dev.dv_xname);
    572 #endif
    573 #if FE_DEBUG >= 3
    574 	if (i < FE_MAX_RECV_COUNT)
    575 		log(LOG_INFO, "%s: receive buffer emptied (%d)\n",
    576 		    sc->sc_dev.dv_xname, i);
    577 #endif
    578 
    579 #if FE_DEBUG >= 3
    580 	log(LOG_INFO, "%s: after ERB loop\n", sc->sc_dev.dv_xname);
    581 	mb86960_dump(LOG_INFO, sc);
    582 #endif
    583 
    584 	/* Do we need this here? */
    585 	bus_space_write_1(bst, bsh, FE_DLCR0, 0xFF);	/* Clear all bits. */
    586 	bus_space_write_1(bst, bsh, FE_DLCR1, 0xFF);	/* ditto. */
    587 
    588 #if FE_DEBUG >= 3
    589 	log(LOG_INFO, "%s: after FIXME\n", sc->sc_dev.dv_xname);
    590 	mb86960_dump(LOG_INFO, sc);
    591 #endif
    592 
    593 	/* Set 'running' flag. */
    594 	ifp->if_flags |= IFF_RUNNING;
    595 
    596 	/*
    597 	 * At this point, the interface is runnung properly,
    598 	 * except that it receives *no* packets.  we then call
    599 	 * mb86960_setmode() to tell the chip what packets to be
    600 	 * received, based on the if_flags and multicast group
    601 	 * list.  It completes the initialization process.
    602 	 */
    603 	mb86960_setmode(sc);
    604 
    605 #if FE_DEBUG >= 3
    606 	log(LOG_INFO, "%s: after setmode\n", sc->sc_dev.dv_xname);
    607 	mb86960_dump(LOG_INFO, sc);
    608 #endif
    609 
    610 	/* ...and attempt to start output. */
    611 	mb86960_start(ifp);
    612 
    613 #if FE_DEBUG >= 3
    614 	log(LOG_INFO, "%s: end of mb86960_init()\n", sc->sc_dev.dv_xname);
    615 	mb86960_dump(LOG_INFO, sc);
    616 #endif
    617 }
    618 
    619 /*
    620  * This routine actually starts the transmission on the interface
    621  */
    622 static inline void
    623 mb86960_xmit(struct mb86960_softc *sc)
    624 {
    625 	bus_space_tag_t bst = sc->sc_bst;
    626 	bus_space_handle_t bsh = sc->sc_bsh;
    627 
    628 	/*
    629 	 * Set a timer just in case we never hear from the board again.
    630 	 * We use longer timeout for multiple packet transmission.
    631 	 * I'm not sure this timer value is appropriate.  FIXME.
    632 	 */
    633 	sc->sc_ec.ec_if.if_timer = 1 + sc->txb_count;
    634 
    635 	/* Update txb variables. */
    636 	sc->txb_sched = sc->txb_count;
    637 	sc->txb_count = 0;
    638 	sc->txb_free = sc->txb_size;
    639 
    640 #if FE_DELAYED_PADDING
    641 	/* Omit the postponed padding process. */
    642 	sc->txb_padding = 0;
    643 #endif
    644 
    645 	/* Start transmitter, passing packets in TX buffer. */
    646 	bus_space_write_1(bst, bsh, FE_BMPR10, sc->txb_sched | FE_B10_START);
    647 }
    648 
    649 /*
    650  * Start output on interface.
    651  * We make two assumptions here:
    652  *  1) that the current priority is set to splnet _before_ this code
    653  *     is called *and* is returned to the appropriate priority after
    654  *     return
    655  *  2) that the IFF_OACTIVE flag is checked before this code is called
    656  *     (i.e. that the output part of the interface is idle)
    657  */
    658 void
    659 mb86960_start(struct ifnet *ifp)
    660 {
    661 	struct mb86960_softc *sc = ifp->if_softc;
    662 	struct mbuf *m;
    663 
    664 #if FE_DEBUG >= 1
    665 	/* Just a sanity check. */
    666 	if ((sc->txb_count == 0) != (sc->txb_free == sc->txb_size)) {
    667 		/*
    668 		 * Txb_count and txb_free co-works to manage the
    669 		 * transmission buffer.  Txb_count keeps track of the
    670 		 * used potion of the buffer, while txb_free does unused
    671 		 * potion.  So, as long as the driver runs properly,
    672 		 * txb_count is zero if and only if txb_free is same
    673 		 * as txb_size (which represents whole buffer.)
    674 		 */
    675 		log(LOG_ERR, "%s: inconsistent txb variables (%d, %d)\n",
    676 		    sc->sc_dev.dv_xname, sc->txb_count, sc->txb_free);
    677 		/*
    678 		 * So, what should I do, then?
    679 		 *
    680 		 * We now know txb_count and txb_free contradicts.  We
    681 		 * cannot, however, tell which is wrong.  More
    682 		 * over, we cannot peek 86960 transmission buffer or
    683 		 * reset the transmission buffer.  (In fact, we can
    684 		 * reset the entire interface.  I don't want to do it.)
    685 		 *
    686 		 * If txb_count is incorrect, leaving it as is will cause
    687 		 * sending of gabages after next interrupt.  We have to
    688 		 * avoid it.  Hence, we reset the txb_count here.  If
    689 		 * txb_free was incorrect, resetting txb_count just loose
    690 		 * some packets.  We can live with it.
    691 		 */
    692 		sc->txb_count = 0;
    693 	}
    694 #endif
    695 
    696 #if FE_DEBUG >= 1
    697 	/*
    698 	 * First, see if there are buffered packets and an idle
    699 	 * transmitter - should never happen at this point.
    700 	 */
    701 	if ((sc->txb_count > 0) && (sc->txb_sched == 0)) {
    702 		log(LOG_ERR, "%s: transmitter idle with %d buffered packets\n",
    703 		    sc->sc_dev.dv_xname, sc->txb_count);
    704 		mb86960_xmit(sc);
    705 	}
    706 #endif
    707 
    708 	/*
    709 	 * Stop accepting more transmission packets temporarily, when
    710 	 * a filter change request is delayed.  Updating the MARs on
    711 	 * 86960 flushes the transmisstion buffer, so it is delayed
    712 	 * until all buffered transmission packets have been sent
    713 	 * out.
    714 	 */
    715 	if (sc->filter_change) {
    716 		/*
    717 		 * Filter change request is delayed only when the DLC is
    718 		 * working.  DLC soon raise an interrupt after finishing
    719 		 * the work.
    720 		 */
    721 		goto indicate_active;
    722 	}
    723 
    724 	for (;;) {
    725 		/*
    726 		 * See if there is room to put another packet in the buffer.
    727 		 * We *could* do better job by peeking the send queue to
    728 		 * know the length of the next packet.  Current version just
    729 		 * tests against the worst case (i.e., longest packet).  FIXME.
    730 		 *
    731 		 * When adding the packet-peek feature, don't forget adding a
    732 		 * test on txb_count against QUEUEING_MAX.
    733 		 * There is a little chance the packet count exceeds
    734 		 * the limit.  Assume transmission buffer is 8KB (2x8KB
    735 		 * configuration) and an application sends a bunch of small
    736 		 * (i.e., minimum packet sized) packets rapidly.  An 8KB
    737 		 * buffer can hold 130 blocks of 62 bytes long...
    738 		 */
    739 		if (sc->txb_free <
    740 		    (ETHER_MAX_LEN - ETHER_CRC_LEN) + FE_TXLEN_SIZE) {
    741 			/* No room. */
    742 			goto indicate_active;
    743 		}
    744 
    745 #if FE_SINGLE_TRANSMISSION
    746 		if (sc->txb_count > 0) {
    747 			/* Just one packet per a transmission buffer. */
    748 			goto indicate_active;
    749 		}
    750 #endif
    751 
    752 		/*
    753 		 * Get the next mbuf chain for a packet to send.
    754 		 */
    755 		IFQ_DEQUEUE(&ifp->if_snd, m);
    756 		if (m == 0) {
    757 			/* No more packets to send. */
    758 			goto indicate_inactive;
    759 		}
    760 
    761 #if NBPFILTER > 0
    762 		/* Tap off here if there is a BPF listener. */
    763 		if (ifp->if_bpf)
    764 			bpf_mtap(ifp->if_bpf, m);
    765 #endif
    766 
    767 		/*
    768 		 * Copy the mbuf chain into the transmission buffer.
    769 		 * txb_* variables are updated as necessary.
    770 		 */
    771 		mb86960_write_mbufs(sc, m);
    772 
    773 		m_freem(m);
    774 
    775 		/* Start transmitter if it's idle. */
    776 		if (sc->txb_sched == 0)
    777 			mb86960_xmit(sc);
    778 	}
    779 
    780 indicate_inactive:
    781 	/*
    782 	 * We are using the !OACTIVE flag to indicate to
    783 	 * the outside world that we can accept an
    784 	 * additional packet rather than that the
    785 	 * transmitter is _actually_ active.  Indeed, the
    786 	 * transmitter may be active, but if we haven't
    787 	 * filled all the buffers with data then we still
    788 	 * want to accept more.
    789 	 */
    790 	ifp->if_flags &= ~IFF_OACTIVE;
    791 	return;
    792 
    793 indicate_active:
    794 	/*
    795 	 * The transmitter is active, and there are no room for
    796 	 * more outgoing packets in the transmission buffer.
    797 	 */
    798 	ifp->if_flags |= IFF_OACTIVE;
    799 	return;
    800 }
    801 
    802 /*
    803  * Transmission interrupt handler
    804  * The control flow of this function looks silly.  FIXME.
    805  */
    806 void
    807 mb86960_tint(struct mb86960_softc *sc, uint8_t tstat)
    808 {
    809 	bus_space_tag_t bst = sc->sc_bst;
    810 	bus_space_handle_t bsh = sc->sc_bsh;
    811 	struct ifnet *ifp = &sc->sc_ec.ec_if;
    812 	int left;
    813 	int col;
    814 
    815 	/*
    816 	 * Handle "excessive collision" interrupt.
    817 	 */
    818 	if (tstat & FE_D0_COLL16) {
    819 		/*
    820 		 * Find how many packets (including this collided one)
    821 		 * are left unsent in transmission buffer.
    822 		 */
    823 		left = bus_space_read_1(bst, bsh, FE_BMPR10);
    824 
    825 #if FE_DEBUG >= 2
    826 		log(LOG_WARNING, "%s: excessive collision (%d/%d)\n",
    827 		    sc->sc_dev.dv_xname, left, sc->txb_sched);
    828 #endif
    829 #if FE_DEBUG >= 3
    830 		mb86960_dump(LOG_INFO, sc);
    831 #endif
    832 
    833 		/*
    834 		 * Update statistics.
    835 		 */
    836 		ifp->if_collisions += 16;
    837 		ifp->if_oerrors++;
    838 		ifp->if_opackets += sc->txb_sched - left;
    839 
    840 		/*
    841 		 * Collision statistics has been updated.
    842 		 * Clear the collision flag on 86960 now to avoid confusion.
    843 		 */
    844 		bus_space_write_1(bst, bsh, FE_DLCR0, FE_D0_COLLID);
    845 
    846 		/*
    847 		 * Restart transmitter, skipping the
    848 		 * collided packet.
    849 		 *
    850 		 * We *must* skip the packet to keep network running
    851 		 * properly.  Excessive collision error is an
    852 		 * indication of the network overload.  If we
    853 		 * tried sending the same packet after excessive
    854 		 * collision, the network would be filled with
    855 		 * out-of-time packets.  Packets belonging
    856 		 * to reliable transport (such as TCP) are resent
    857 		 * by some upper layer.
    858 		 */
    859 		bus_space_write_1(bst, bsh, FE_BMPR11,
    860 		    FE_B11_CTRL_SKIP | FE_B11_MODE1);
    861 		sc->txb_sched = left - 1;
    862 	}
    863 
    864 	/*
    865 	 * Handle "transmission complete" interrupt.
    866 	 */
    867 	if (tstat & FE_D0_TXDONE) {
    868 		/*
    869 		 * Add in total number of collisions on last
    870 		 * transmission.  We also clear "collision occurred" flag
    871 		 * here.
    872 		 *
    873 		 * 86960 has a design flow on collision count on multiple
    874 		 * packet transmission.  When we send two or more packets
    875 		 * with one start command (that's what we do when the
    876 		 * transmission queue is clauded), 86960 informs us number
    877 		 * of collisions occurred on the last packet on the
    878 		 * transmission only.  Number of collisions on previous
    879 		 * packets are lost.  I have told that the fact is clearly
    880 		 * stated in the Fujitsu document.
    881 		 *
    882 		 * I considered not to mind it seriously.  Collision
    883 		 * count is not so important, anyway.  Any comments?  FIXME.
    884 		 */
    885 
    886 		if (bus_space_read_1(bst, bsh, FE_DLCR0) & FE_D0_COLLID) {
    887 			/* Clear collision flag. */
    888 			bus_space_write_1(bst, bsh, FE_DLCR0, FE_D0_COLLID);
    889 
    890 			/* Extract collision count from 86960. */
    891 			col = bus_space_read_1(bst, bsh, FE_DLCR4) & FE_D4_COL;
    892 			if (col == 0) {
    893 				/*
    894 				 * Status register indicates collisions,
    895 				 * while the collision count is zero.
    896 				 * This can happen after multiple packet
    897 				 * transmission, indicating that one or more
    898 				 * previous packet(s) had been collided.
    899 				 *
    900 				 * Since the accurate number of collisions
    901 				 * has been lost, we just guess it as 1;
    902 				 * Am I too optimistic?  FIXME.
    903 				 */
    904 				col = 1;
    905 			} else
    906 				col >>= FE_D4_COL_SHIFT;
    907 			ifp->if_collisions += col;
    908 #if FE_DEBUG >= 4
    909 			log(LOG_WARNING, "%s: %d collision%s (%d)\n",
    910 			    sc->sc_dev.dv_xname, col, col == 1 ? "" : "s",
    911 			    sc->txb_sched);
    912 #endif
    913 		}
    914 
    915 		/*
    916 		 * Update total number of successfully
    917 		 * transmitted packets.
    918 		 */
    919 		ifp->if_opackets += sc->txb_sched;
    920 		sc->txb_sched = 0;
    921 	}
    922 
    923 	if (sc->txb_sched == 0) {
    924 		/*
    925 		 * The transmitter is no more active.
    926 		 * Reset output active flag and watchdog timer.
    927 		 */
    928 		ifp->if_flags &= ~IFF_OACTIVE;
    929 		ifp->if_timer = 0;
    930 
    931 		/*
    932 		 * If more data is ready to transmit in the buffer, start
    933 		 * transmitting them.  Otherwise keep transmitter idle,
    934 		 * even if more data is queued.  This gives receive
    935 		 * process a slight priority.
    936 		 */
    937 		if (sc->txb_count > 0)
    938 			mb86960_xmit(sc);
    939 	}
    940 }
    941 
    942 /*
    943  * Ethernet interface receiver interrupt.
    944  */
    945 void
    946 mb86960_rint(struct mb86960_softc *sc, uint8_t rstat)
    947 {
    948 	bus_space_tag_t bst = sc->sc_bst;
    949 	bus_space_handle_t bsh = sc->sc_bsh;
    950 	struct ifnet *ifp = &sc->sc_ec.ec_if;
    951 	u_int status, len;
    952 	int i;
    953 
    954 	/*
    955 	 * Update statistics if this interrupt is caused by an error.
    956 	 */
    957 	if (rstat & (FE_D1_OVRFLO | FE_D1_CRCERR | FE_D1_ALGERR |
    958 	    FE_D1_SRTPKT)) {
    959 #if FE_DEBUG >= 3
    960 		char sbuf[sizeof(FE_D1_ERRBITS) + 64];
    961 
    962 		bitmask_snprintf(rstat, FE_D1_ERRBITS, sbuf, sizeof(sbuf));
    963 		log(LOG_WARNING, "%s: receive error: %s\n",
    964 		    sc->sc_dev.dv_xname, sbuf);
    965 #endif
    966 		ifp->if_ierrors++;
    967 	}
    968 
    969 	/*
    970 	 * MB86960 has a flag indicating "receive queue empty."
    971 	 * We just loop checking the flag to pull out all received
    972 	 * packets.
    973 	 *
    974 	 * We limit the number of iterrations to avoid infinite loop.
    975 	 * It can be caused by a very slow CPU (some broken
    976 	 * peripheral may insert incredible number of wait cycles)
    977 	 * or, worse, by a broken MB86960 chip.
    978 	 */
    979 	for (i = 0; i < FE_MAX_RECV_COUNT; i++) {
    980 		/* Stop the iterration if 86960 indicates no packets. */
    981 		if (bus_space_read_1(bst, bsh, FE_DLCR5) & FE_D5_BUFEMP)
    982 			break;
    983 
    984 		/*
    985 		 * Extract receive packet status from the receive
    986 		 * packet header.
    987 		 */
    988 		if (sc->sc_flags & FE_FLAGS_SBW_BYTE) {
    989 			status = bus_space_read_1(bst, bsh, FE_BMPR8);
    990 			(void)bus_space_read_1(bst, bsh, FE_BMPR8);
    991 		} else
    992 			status = bus_space_read_2(bst, bsh, FE_BMPR8);
    993 
    994 #if FE_DEBUG >= 4
    995 		log(LOG_INFO, "%s: receive status = %02x\n",
    996 		    sc->sc_dev.dv_xname, status);
    997 #endif
    998 
    999 		/*
   1000 		 * If there was an error, update statistics and drop
   1001 		 * the packet, unless the interface is in promiscuous
   1002 		 * mode.
   1003 		 */
   1004 		if ((status & FE_RXSTAT_GOODPKT) == 0) {
   1005 			if ((ifp->if_flags & IFF_PROMISC) == 0) {
   1006 				ifp->if_ierrors++;
   1007 				mb86960_droppacket(sc);
   1008 				continue;
   1009 			}
   1010 		}
   1011 
   1012 		/*
   1013 		 * Extract the packet length from the receive packet header.
   1014 		 * It is a sum of a header (14 bytes) and a payload.
   1015 		 * CRC has been stripped off by the 86960.
   1016 		 */
   1017 		if (sc->sc_flags & FE_FLAGS_SBW_BYTE) {
   1018 			len  = bus_space_read_1(bst, bsh, FE_BMPR8);
   1019 			len |= bus_space_read_1(bst, bsh, FE_BMPR8) << 8;
   1020 		} else
   1021 			len = bus_space_read_2(bst, bsh, FE_BMPR8);
   1022 
   1023 		/*
   1024 		 * MB86965 checks the packet length and drop big packet
   1025 		 * before passing it to us.  There are no chance we can
   1026 		 * get [crufty] packets.  Hence, if the length exceeds
   1027 		 * the specified limit, it means some serious failure,
   1028 		 * such as out-of-sync on receive buffer management.
   1029 		 *
   1030 		 * Is this statement true?  FIXME.
   1031 		 */
   1032 		if (len > (ETHER_MAX_LEN - ETHER_CRC_LEN) ||
   1033 		    len < ETHER_HDR_LEN) {
   1034 #if FE_DEBUG >= 2
   1035 			log(LOG_WARNING,
   1036 			    "%s: received a %s packet? (%u bytes)\n",
   1037 			    sc->sc_dev.dv_xname,
   1038 			    len < ETHER_HDR_LEN ? "partial" : "big", len);
   1039 #endif
   1040 			ifp->if_ierrors++;
   1041 			mb86960_droppacket(sc);
   1042 			continue;
   1043 		}
   1044 
   1045 		/*
   1046 		 * Check for a short (RUNT) packet.  We *do* check
   1047 		 * but do nothing other than print a message.
   1048 		 * Short packets are illegal, but does nothing bad
   1049 		 * if it carries data for upper layer.
   1050 		 */
   1051 #if FE_DEBUG >= 2
   1052 		if (len < (ETHER_MIN_LEN - ETHER_CRC_LEN)) {
   1053 			log(LOG_WARNING,
   1054 			    "%s: received a short packet? (%u bytes)\n",
   1055 			    sc->sc_dev.dv_xname, len);
   1056 		}
   1057 #endif
   1058 
   1059 		/*
   1060 		 * Go get a packet.
   1061 		 */
   1062 		if (mb86960_get_packet(sc, len) == 0) {
   1063 			/* Skip a packet, updating statistics. */
   1064 #if FE_DEBUG >= 2
   1065 			log(LOG_WARNING,
   1066 			    "%s: out of mbufs; dropping packet (%u bytes)\n",
   1067 			    sc->sc_dev.dv_xname, len);
   1068 #endif
   1069 			ifp->if_ierrors++;
   1070 			mb86960_droppacket(sc);
   1071 
   1072 			/*
   1073 			 * We stop receiving packets, even if there are
   1074 			 * more in the buffer.  We hope we can get more
   1075 			 * mbufs next time.
   1076 			 */
   1077 			return;
   1078 		}
   1079 
   1080 		/* Successfully received a packet.  Update stat. */
   1081 		ifp->if_ipackets++;
   1082 	}
   1083 }
   1084 
   1085 /*
   1086  * Ethernet interface interrupt processor
   1087  */
   1088 int
   1089 mb86960_intr(void *arg)
   1090 {
   1091 	struct mb86960_softc *sc = arg;
   1092 	bus_space_tag_t bst = sc->sc_bst;
   1093 	bus_space_handle_t bsh = sc->sc_bsh;
   1094 	struct ifnet *ifp = &sc->sc_ec.ec_if;
   1095 	uint8_t tstat, rstat;
   1096 
   1097 	if ((sc->sc_stat & FE_STAT_ENABLED) == 0 ||
   1098 	    !device_is_active(&sc->sc_dev))
   1099 		return (0);
   1100 
   1101 #if FE_DEBUG >= 4
   1102 	log(LOG_INFO, "%s: mb86960_intr()\n", sc->sc_dev.dv_xname);
   1103 	mb86960_dump(LOG_INFO, sc);
   1104 #endif
   1105 
   1106 	/*
   1107 	 * Get interrupt conditions, masking unneeded flags.
   1108 	 */
   1109 	tstat = bus_space_read_1(bst, bsh, FE_DLCR0) & FE_TMASK;
   1110 	rstat = bus_space_read_1(bst, bsh, FE_DLCR1) & FE_RMASK;
   1111 	if (tstat == 0 && rstat == 0)
   1112 		return (0);
   1113 
   1114 	/*
   1115 	 * Loop until there are no more new interrupt conditions.
   1116 	 */
   1117 	for (;;) {
   1118 		/*
   1119 		 * Reset the conditions we are acknowledging.
   1120 		 */
   1121 		bus_space_write_1(bst, bsh, FE_DLCR0, tstat);
   1122 		bus_space_write_1(bst, bsh, FE_DLCR1, rstat);
   1123 
   1124 		/*
   1125 		 * Handle transmitter interrupts. Handle these first because
   1126 		 * the receiver will reset the board under some conditions.
   1127 		 */
   1128 		if (tstat != 0)
   1129 			mb86960_tint(sc, tstat);
   1130 
   1131 		/*
   1132 		 * Handle receiver interrupts.
   1133 		 */
   1134 		if (rstat != 0)
   1135 			mb86960_rint(sc, rstat);
   1136 
   1137 		/*
   1138 		 * Update the multicast address filter if it is
   1139 		 * needed and possible.  We do it now, because
   1140 		 * we can make sure the transmission buffer is empty,
   1141 		 * and there is a good chance that the receive queue
   1142 		 * is empty.  It will minimize the possibility of
   1143 		 * packet lossage.
   1144 		 */
   1145 		if (sc->filter_change &&
   1146 		    sc->txb_count == 0 && sc->txb_sched == 0) {
   1147 			mb86960_loadmar(sc);
   1148 			ifp->if_flags &= ~IFF_OACTIVE;
   1149 		}
   1150 
   1151 		/*
   1152 		 * If it looks like the transmitter can take more data,
   1153 		 * attempt to start output on the interface. This is done
   1154 		 * after handling the receiver interrupt to give the
   1155 		 * receive operation priority.
   1156 		 */
   1157 		if ((ifp->if_flags & IFF_OACTIVE) == 0)
   1158 			mb86960_start(ifp);
   1159 
   1160 #if NRND > 0
   1161 		if (rstat != 0 || tstat != 0)
   1162 			rnd_add_uint32(&sc->rnd_source, rstat + tstat);
   1163 #endif
   1164 
   1165 		/*
   1166 		 * Get interrupt conditions, masking unneeded flags.
   1167 		 */
   1168 		tstat = bus_space_read_1(bst, bsh, FE_DLCR0) & FE_TMASK;
   1169 		rstat = bus_space_read_1(bst, bsh, FE_DLCR1) & FE_RMASK;
   1170 		if (tstat == 0 && rstat == 0)
   1171 			return (1);
   1172 	}
   1173 }
   1174 
   1175 /*
   1176  * Process an ioctl request.  This code needs some work - it looks pretty ugly.
   1177  */
   1178 int
   1179 mb86960_ioctl(struct ifnet *ifp, u_long cmd, caddr_t data)
   1180 {
   1181 	struct mb86960_softc *sc = ifp->if_softc;
   1182 	struct ifaddr *ifa = (struct ifaddr *)data;
   1183 	struct ifreq *ifr = (struct ifreq *)data;
   1184 	int s, error = 0;
   1185 
   1186 #if FE_DEBUG >= 3
   1187 	log(LOG_INFO, "%s: ioctl(%lx)\n", sc->sc_dev.dv_xname, cmd);
   1188 #endif
   1189 
   1190 	s = splnet();
   1191 
   1192 	switch (cmd) {
   1193 	case SIOCSIFADDR:
   1194 		if ((error = mb86960_enable(sc)) != 0)
   1195 			break;
   1196 		ifp->if_flags |= IFF_UP;
   1197 
   1198 		switch (ifa->ifa_addr->sa_family) {
   1199 #ifdef INET
   1200 		case AF_INET:
   1201 			mb86960_init(sc);
   1202 			arp_ifinit(ifp, ifa);
   1203 			break;
   1204 #endif
   1205 #ifdef NS
   1206 		case AF_NS:
   1207 		    {
   1208 			struct ns_addr *ina = &IA_SNS(ifa)->sns_addr;
   1209 
   1210 			if (ns_nullhost(*ina))
   1211 				ina->x_host =
   1212 				    *(union ns_host *)LLADDR(ifp->if_sadl);
   1213 			else {
   1214 				memcpy(LLADDR(ifp->if_sadl),
   1215 				    ina->x_host.c_host, ETHER_ADDR_LEN);
   1216 			}
   1217 			/* Set new address. */
   1218 			mb86960_init(sc);
   1219 			break;
   1220 		    }
   1221 #endif
   1222 		default:
   1223 			mb86960_init(sc);
   1224 			break;
   1225 		}
   1226 		break;
   1227 
   1228 	case SIOCSIFFLAGS:
   1229 		if ((ifp->if_flags & IFF_UP) == 0 &&
   1230 		    (ifp->if_flags & IFF_RUNNING) != 0) {
   1231 			/*
   1232 			 * If interface is marked down and it is running, then
   1233 			 * stop it.
   1234 			 */
   1235 			mb86960_stop(sc);
   1236 			ifp->if_flags &= ~IFF_RUNNING;
   1237 			mb86960_disable(sc);
   1238 		} else if ((ifp->if_flags & IFF_UP) != 0 &&
   1239 		    (ifp->if_flags & IFF_RUNNING) == 0) {
   1240 			/*
   1241 			 * If interface is marked up and it is stopped, then
   1242 			 * start it.
   1243 			 */
   1244 			if ((error = mb86960_enable(sc)) != 0)
   1245 				break;
   1246 			mb86960_init(sc);
   1247 		} else if ((ifp->if_flags & IFF_UP) != 0) {
   1248 			/*
   1249 			 * Reset the interface to pick up changes in any other
   1250 			 * flags that affect hardware registers.
   1251 			 */
   1252 			mb86960_setmode(sc);
   1253 		}
   1254 #if FE_DEBUG >= 1
   1255 		/* "ifconfig fe0 debug" to print register dump. */
   1256 		if (ifp->if_flags & IFF_DEBUG) {
   1257 			log(LOG_INFO, "%s: SIOCSIFFLAGS(DEBUG)\n",
   1258 			    sc->sc_dev.dv_xname);
   1259 			mb86960_dump(LOG_DEBUG, sc);
   1260 		}
   1261 #endif
   1262 		break;
   1263 
   1264 	case SIOCADDMULTI:
   1265 	case SIOCDELMULTI:
   1266 		if ((sc->sc_stat & FE_STAT_ENABLED) == 0) {
   1267 			error = EIO;
   1268 			break;
   1269 		}
   1270 
   1271 		/* Update our multicast list. */
   1272 		error = (cmd == SIOCADDMULTI) ?
   1273 		    ether_addmulti(ifr, &sc->sc_ec) :
   1274 		    ether_delmulti(ifr, &sc->sc_ec);
   1275 
   1276 		if (error == ENETRESET) {
   1277 			/*
   1278 			 * Multicast list has changed; set the hardware filter
   1279 			 * accordingly.
   1280 			 */
   1281 			if (ifp->if_flags & IFF_RUNNING)
   1282 				mb86960_setmode(sc);
   1283 			error = 0;
   1284 		}
   1285 		break;
   1286 
   1287 	case SIOCGIFMEDIA:
   1288 	case SIOCSIFMEDIA:
   1289 		error = ifmedia_ioctl(ifp, ifr, &sc->sc_media, cmd);
   1290 		break;
   1291 
   1292 	default:
   1293 		error = EINVAL;
   1294 		break;
   1295 	}
   1296 
   1297 	splx(s);
   1298 	return (error);
   1299 }
   1300 
   1301 /*
   1302  * Retrieve packet from receive buffer and send to the next level up via
   1303  * ether_input(). If there is a BPF listener, give a copy to BPF, too.
   1304  * Returns 0 if success, -1 if error (i.e., mbuf allocation failure).
   1305  */
   1306 int
   1307 mb86960_get_packet(struct mb86960_softc *sc, u_int len)
   1308 {
   1309 	bus_space_tag_t bst = sc->sc_bst;
   1310 	bus_space_handle_t bsh = sc->sc_bsh;
   1311 	struct ifnet *ifp = &sc->sc_ec.ec_if;
   1312 	struct mbuf *m;
   1313 
   1314 	/* Allocate a header mbuf. */
   1315 	MGETHDR(m, M_DONTWAIT, MT_DATA);
   1316 	if (m == 0)
   1317 		return (0);
   1318 	m->m_pkthdr.rcvif = ifp;
   1319 	m->m_pkthdr.len = len;
   1320 
   1321 	/* The following silliness is to make NFS happy. */
   1322 #define	EROUND	((sizeof(struct ether_header) + 3) & ~3)
   1323 #define	EOFF	(EROUND - sizeof(struct ether_header))
   1324 
   1325 	/*
   1326 	 * Our strategy has one more problem.  There is a policy on
   1327 	 * mbuf cluster allocation.  It says that we must have at
   1328 	 * least MINCLSIZE (208 bytes) to allocate a cluster.  For a
   1329 	 * packet of a size between (MHLEN - 2) to (MINCLSIZE - 2),
   1330 	 * our code violates the rule...
   1331 	 * On the other hand, the current code is short, simple,
   1332 	 * and fast, however.  It does no harmful thing, just waists
   1333 	 * some memory.  Any comments?  FIXME.
   1334 	 */
   1335 
   1336 	/* Attach a cluster if this packet doesn't fit in a normal mbuf. */
   1337 	if (len > MHLEN - EOFF) {
   1338 		MCLGET(m, M_DONTWAIT);
   1339 		if ((m->m_flags & M_EXT) == 0) {
   1340 			m_freem(m);
   1341 			return (0);
   1342 		}
   1343 	}
   1344 
   1345 	/*
   1346 	 * The following assumes there is room for the ether header in the
   1347 	 * header mbuf.
   1348 	 */
   1349 	m->m_data += EOFF;
   1350 
   1351 	/* Set the length of this packet. */
   1352 	m->m_len = len;
   1353 
   1354 	/* Get a packet. */
   1355 	if (sc->sc_flags & FE_FLAGS_SBW_BYTE)
   1356 		bus_space_read_multi_1(bst, bsh, FE_BMPR8,
   1357 		    mtod(m, uint8_t *), len);
   1358 	else
   1359 		bus_space_read_multi_stream_2(bst, bsh, FE_BMPR8,
   1360 		    mtod(m, uint16_t *), (len + 1) >> 1);
   1361 
   1362 #if NBPFILTER > 0
   1363 	/*
   1364 	 * Check if there's a BPF listener on this interface.  If so, hand off
   1365 	 * the raw packet to bpf.
   1366 	 */
   1367 	if (ifp->if_bpf)
   1368 		bpf_mtap(ifp->if_bpf, m);
   1369 #endif
   1370 
   1371 	(*ifp->if_input)(ifp, m);
   1372 	return (1);
   1373 }
   1374 
   1375 /*
   1376  * Write an mbuf chain to the transmission buffer memory using 16 bit PIO.
   1377  * Returns number of bytes actually written, including length word.
   1378  *
   1379  * If an mbuf chain is too long for an Ethernet frame, it is not sent.
   1380  * Packets shorter than Ethernet minimum are legal, and we pad them
   1381  * before sending out.  An exception is "partial" packets which are
   1382  * shorter than mandatory Ethernet header.
   1383  *
   1384  * I wrote a code for an experimental "delayed padding" technique.
   1385  * When employed, it postpones the padding process for short packets.
   1386  * If xmit() occurred at the moment, the padding process is omitted, and
   1387  * garbages are sent as pad data.  If next packet is stored in the
   1388  * transmission buffer before xmit(), write_mbuf() pads the previous
   1389  * packet before transmitting new packet.  This *may* gain the
   1390  * system performance (slightly).
   1391  */
   1392 void
   1393 mb86960_write_mbufs(struct mb86960_softc *sc, struct mbuf *m)
   1394 {
   1395 	bus_space_tag_t bst = sc->sc_bst;
   1396 	bus_space_handle_t bsh = sc->sc_bsh;
   1397 	int totlen, len;
   1398 #if FE_DEBUG >= 2
   1399 	struct mbuf *mp;
   1400 #endif
   1401 
   1402 #if FE_DELAYED_PADDING
   1403 	/* Do the "delayed padding." */
   1404 	if (sc->txb_padding > 0) {
   1405 		if (sc->sc_flags & FE_FLAGS_SBW_BYTE) {
   1406 			for (len = sc->txb_padding; len > 0; len--)
   1407 				bus_space_write_1(bst, bsh, FE_BMPR8, 0);
   1408 		} else {
   1409 			for (len = sc->txb_padding >> 1; len > 0; len--)
   1410 				bus_space_write_2(bst, bsh, FE_BMPR8, 0);
   1411 		}
   1412 		sc->txb_padding = 0;
   1413 	}
   1414 #endif
   1415 
   1416 	/* We need to use m->m_pkthdr.len, so require the header */
   1417 	if ((m->m_flags & M_PKTHDR) == 0)
   1418 	  	panic("mb86960_write_mbufs: no header mbuf");
   1419 
   1420 #if FE_DEBUG >= 2
   1421 	/* First, count up the total number of bytes to copy. */
   1422 	for (totlen = 0, mp = m; mp != 0; mp = mp->m_next)
   1423 		totlen += mp->m_len;
   1424 	/* Check if this matches the one in the packet header. */
   1425 	if (totlen != m->m_pkthdr.len)
   1426 		log(LOG_WARNING, "%s: packet length mismatch? (%d/%d)\n",
   1427 		    sc->sc_dev.dv_xname, totlen, m->m_pkthdr.len);
   1428 #else
   1429 	/* Just use the length value in the packet header. */
   1430 	totlen = m->m_pkthdr.len;
   1431 #endif
   1432 
   1433 #if FE_DEBUG >= 1
   1434 	/*
   1435 	 * Should never send big packets.  If such a packet is passed,
   1436 	 * it should be a bug of upper layer.  We just ignore it.
   1437 	 * ... Partial (too short) packets, neither.
   1438 	 */
   1439 	if (totlen > (ETHER_MAX_LEN - ETHER_CRC_LEN) ||
   1440 	    totlen < ETHER_HDR_LEN) {
   1441 		log(LOG_ERR, "%s: got a %s packet (%u bytes) to send\n",
   1442 		    sc->sc_dev.dv_xname,
   1443 		    totlen < ETHER_HDR_LEN ? "partial" : "big", totlen);
   1444 		sc->sc_ec.ec_if.if_oerrors++;
   1445 		return;
   1446 	}
   1447 #endif
   1448 
   1449 	/*
   1450 	 * Put the length word for this frame.
   1451 	 * Does 86960 accept odd length?  -- Yes.
   1452 	 * Do we need to pad the length to minimum size by ourselves?
   1453 	 * -- Generally yes.  But for (or will be) the last
   1454 	 * packet in the transmission buffer, we can skip the
   1455 	 * padding process.  It may gain performance slightly.  FIXME.
   1456 	 */
   1457 	len = max(totlen, (ETHER_MIN_LEN - ETHER_CRC_LEN));
   1458 	if (sc->sc_flags & FE_FLAGS_SBW_BYTE) {
   1459 		bus_space_write_1(bst, bsh, FE_BMPR8, len);
   1460 		bus_space_write_1(bst, bsh, FE_BMPR8, len >> 8);
   1461 	} else {
   1462 		bus_space_write_2(bst, bsh, FE_BMPR8, len);
   1463 		/* roundup packet length since we will use word access */
   1464 		totlen = (totlen + 1) & ~1;
   1465 	}
   1466 
   1467 	/*
   1468 	 * Update buffer status now.
   1469 	 * Truncate the length up to an even number
   1470 	 * if the chip is set in SBW_WORD mode.
   1471 	 */
   1472 	sc->txb_free -= FE_TXLEN_SIZE +
   1473 	    max(totlen, (ETHER_MIN_LEN - ETHER_CRC_LEN));
   1474 	sc->txb_count++;
   1475 
   1476 #if FE_DELAYED_PADDING
   1477 	/* Postpone the packet padding if necessary. */
   1478 	if (totlen < (ETHER_MIN_LEN - ETHER_CRC_LEN))
   1479 		sc->txb_padding = (ETHER_MIN_LEN - ETHER_CRC_LEN) - totlen;
   1480 #endif
   1481 
   1482 	/*
   1483 	 * Transfer the data from mbuf chain to the transmission buffer.
   1484 	 * If the MB86960 is configured in word mode, data needs to be
   1485 	 * transferred as words, and only words.
   1486 	 * So that we require some extra code to patch over odd-length
   1487 	 * or unaligned mbufs.
   1488 	 */
   1489 	if (sc->sc_flags & FE_FLAGS_SBW_BYTE) {
   1490 		/* It's simple in byte mode. */
   1491 		for (; m != NULL; m = m->m_next) {
   1492 			if (m->m_len) {
   1493 				bus_space_write_multi_1(bst, bsh, FE_BMPR8,
   1494 				    mtod(m, uint8_t *), m->m_len);
   1495 			}
   1496 		}
   1497 	} else {
   1498 		/* a bit trickier in word mode. */
   1499 		uint8_t *data, savebyte[2];
   1500 		int leftover;
   1501 
   1502 		leftover = 0;
   1503 		savebyte[0] = savebyte[1] = 0;
   1504 
   1505 		for (; m != NULL; m = m->m_next) {
   1506 			len = m->m_len;
   1507 			if (len == 0)
   1508 				continue;
   1509 			data = mtod(m, uint8_t *);
   1510 			while (len > 0) {
   1511 				if (leftover) {
   1512 					/*
   1513 					 * Data left over (from mbuf or
   1514 					 * realignment). Buffer the next
   1515 					 * byte, and write it and the
   1516 					 * leftover data out.
   1517 					 */
   1518 					savebyte[1] = *data++;
   1519 					len--;
   1520 					bus_space_write_stream_2(bst, bsh,
   1521 					   FE_BMPR8, *(uint16_t *)savebyte);
   1522 					leftover = 0;
   1523 				} else if (BUS_SPACE_ALIGNED_POINTER(data,
   1524 				    uint16_t) == 0) {
   1525 					/*
   1526 					 * Unaligned data; buffer the next byte.
   1527 					 */
   1528 					savebyte[0] = *data++;
   1529 					len--;
   1530 					leftover = 1;
   1531 				} else {
   1532 					/*
   1533 					 * Aligned data; output contiguous
   1534 					 * words as much as we can, then
   1535 					 * buffer the remaining byte, if any.
   1536 					 */
   1537 					leftover = len & 1;
   1538 					len &= ~1;
   1539 					bus_space_write_multi_stream_2(bst, bsh,
   1540 					    FE_BMPR8, (uint16_t *)data,
   1541 					    len >> 1);
   1542 					data += len;
   1543 					if (leftover)
   1544 						savebyte[0] = *data++;
   1545 					len = 0;
   1546 				}
   1547 			}
   1548 			if (len < 0)
   1549 				panic("mb86960_write_mbufs: negative len");
   1550 		}
   1551 		if (leftover) {
   1552 			savebyte[1] = 0;
   1553 			bus_space_write_stream_2(bst, bsh, FE_BMPR8,
   1554 			    *(uint16_t *)savebyte);
   1555 		}
   1556 	}
   1557 #if FE_DELAYED_PADDING == 0
   1558 	/*
   1559 	 * Pad the packet to the minimum length if necessary.
   1560 	 */
   1561 	len = (ETHER_MIN_LEN - ETHER_CRC_LEN) - totlen;
   1562 	if (len > 0) {
   1563 		if (sc->sc_flags & FE_FLAGS_SBW_BYTE) {
   1564 			while (len-- > 0)
   1565 				bus_space_write_1(bst, bsh, FE_BMPR8, 0);
   1566 		} else {
   1567 			len >>= 1;
   1568 			while (len-- > 0)
   1569 				bus_space_write_2(bst, bsh, FE_BMPR8, 0);
   1570 		}
   1571 	}
   1572 #endif
   1573 }
   1574 
   1575 /*
   1576  * Compute the multicast address filter from the
   1577  * list of multicast addresses we need to listen to.
   1578  */
   1579 void
   1580 mb86960_getmcaf(struct ethercom *ec, uint8_t *af)
   1581 {
   1582 	struct ifnet *ifp = &ec->ec_if;
   1583 	struct ether_multi *enm;
   1584 	uint32_t crc;
   1585 	struct ether_multistep step;
   1586 
   1587 	/*
   1588 	 * Set up multicast address filter by passing all multicast addresses
   1589 	 * through a crc generator, and then using the high order 6 bits as an
   1590 	 * index into the 64 bit logical address filter.  The high order bit
   1591 	 * selects the word, while the rest of the bits select the bit within
   1592 	 * the word.
   1593 	 */
   1594 
   1595 	if ((ifp->if_flags & IFF_PROMISC) != 0)
   1596 		goto allmulti;
   1597 
   1598 	memset(af, 0, FE_FILTER_LEN);
   1599 	ETHER_FIRST_MULTI(step, ec, enm);
   1600 	while (enm != NULL) {
   1601 		if (memcmp(enm->enm_addrlo, enm->enm_addrhi,
   1602 		    sizeof(enm->enm_addrlo)) != 0) {
   1603 			/*
   1604 			 * We must listen to a range of multicast addresses.
   1605 			 * For now, just accept all multicasts, rather than
   1606 			 * trying to set only those filter bits needed to match
   1607 			 * the range.  (At this time, the only use of address
   1608 			 * ranges is for IP multicast routing, for which the
   1609 			 * range is big enough to require all bits set.)
   1610 			 */
   1611 			goto allmulti;
   1612 		}
   1613 
   1614 		crc = ether_crc32_le(enm->enm_addrlo, ETHER_ADDR_LEN);
   1615 
   1616 		/* Just want the 6 most significant bits. */
   1617 		crc >>= 26;
   1618 
   1619 		/* Turn on the corresponding bit in the filter. */
   1620 		af[crc >> 3] |= 1 << (crc & 7);
   1621 
   1622 		ETHER_NEXT_MULTI(step, enm);
   1623 	}
   1624 	ifp->if_flags &= ~IFF_ALLMULTI;
   1625 	return;
   1626 
   1627 allmulti:
   1628 	ifp->if_flags |= IFF_ALLMULTI;
   1629 	memset(af, 0xff, FE_FILTER_LEN);
   1630 }
   1631 
   1632 /*
   1633  * Calculate a new "multicast packet filter" and put the 86960
   1634  * receiver in appropriate mode.
   1635  */
   1636 void
   1637 mb86960_setmode(struct mb86960_softc *sc)
   1638 {
   1639 	bus_space_tag_t bst = sc->sc_bst;
   1640 	bus_space_handle_t bsh = sc->sc_bsh;
   1641 	int flags = sc->sc_ec.ec_if.if_flags;
   1642 
   1643 	/*
   1644 	 * If the interface is not running, we postpone the update
   1645 	 * process for receive modes and multicast address filter
   1646 	 * until the interface is restarted.  It reduces some
   1647 	 * complicated job on maintaining chip states.  (Earlier versions
   1648 	 * of this driver had a bug on that point...)
   1649 	 *
   1650 	 * To complete the trick, mb86960_init() calls mb86960_setmode() after
   1651 	 * restarting the interface.
   1652 	 */
   1653 	if ((flags & IFF_RUNNING) == 0)
   1654 		return;
   1655 
   1656 	/*
   1657 	 * Promiscuous mode is handled separately.
   1658 	 */
   1659 	if ((flags & IFF_PROMISC) != 0) {
   1660 		/*
   1661 		 * Program 86960 to receive all packets on the segment
   1662 		 * including those directed to other stations.
   1663 		 * Multicast filter stored in MARs are ignored
   1664 		 * under this setting, so we don't need to update it.
   1665 		 *
   1666 		 * Promiscuous mode is used solely by BPF, and BPF only
   1667 		 * listens to valid (no error) packets.  So, we ignore
   1668 		 * errornous ones even in this mode.
   1669 		 */
   1670 		bus_space_write_1(bst, bsh, FE_DLCR5,
   1671 		    sc->proto_dlcr5 | FE_D5_AFM0 | FE_D5_AFM1);
   1672 		sc->filter_change = 0;
   1673 
   1674 #if FE_DEBUG >= 3
   1675 		log(LOG_INFO, "%s: promiscuous mode\n", sc->sc_dev.dv_xname);
   1676 #endif
   1677 		return;
   1678 	}
   1679 
   1680 	/*
   1681 	 * Turn the chip to the normal (non-promiscuous) mode.
   1682 	 */
   1683 	bus_space_write_1(bst, bsh, FE_DLCR5, sc->proto_dlcr5 | FE_D5_AFM1);
   1684 
   1685 	/*
   1686 	 * Find the new multicast filter value.
   1687 	 */
   1688 	mb86960_getmcaf(&sc->sc_ec, sc->filter);
   1689 	sc->filter_change = 1;
   1690 
   1691 #if FE_DEBUG >= 3
   1692 	log(LOG_INFO,
   1693 	    "%s: address filter: [%02x %02x %02x %02x %02x %02x %02x %02x]\n",
   1694 	    sc->sc_dev.dv_xname,
   1695 	    sc->filter[0], sc->filter[1], sc->filter[2], sc->filter[3],
   1696 	    sc->filter[4], sc->filter[5], sc->filter[6], sc->filter[7]);
   1697 #endif
   1698 
   1699 	/*
   1700 	 * We have to update the multicast filter in the 86960, A.S.A.P.
   1701 	 *
   1702 	 * Note that the DLC (Data Linc Control unit, i.e. transmitter
   1703 	 * and receiver) must be stopped when feeding the filter, and
   1704 	 * DLC trashes all packets in both transmission and receive
   1705 	 * buffers when stopped.
   1706 	 *
   1707 	 * ... Are the above sentenses correct?  I have to check the
   1708 	 *     manual of the MB86960A.  FIXME.
   1709 	 *
   1710 	 * To reduce the packet lossage, we delay the filter update
   1711 	 * process until buffers are empty.
   1712 	 */
   1713 	if (sc->txb_sched == 0 && sc->txb_count == 0 &&
   1714 	    (bus_space_read_1(bst, bsh, FE_DLCR1) & FE_D1_PKTRDY) == 0) {
   1715 		/*
   1716 		 * Buffers are (apparently) empty.  Load
   1717 		 * the new filter value into MARs now.
   1718 		 */
   1719 		mb86960_loadmar(sc);
   1720 	} else {
   1721 		/*
   1722 		 * Buffers are not empty.  Mark that we have to update
   1723 		 * the MARs.  The new filter will be loaded by mb86960_intr()
   1724 		 * later.
   1725 		 */
   1726 #if FE_DEBUG >= 4
   1727 		log(LOG_INFO, "%s: filter change delayed\n",
   1728 		    sc->sc_dev.dv_xname);
   1729 #endif
   1730 	}
   1731 }
   1732 
   1733 /*
   1734  * Load a new multicast address filter into MARs.
   1735  *
   1736  * The caller must have splnet'ed befor mb86960_loadmar.
   1737  * This function starts the DLC upon return.  So it can be called only
   1738  * when the chip is working, i.e., from the driver's point of view, when
   1739  * a device is RUNNING.  (I mistook the point in previous versions.)
   1740  */
   1741 void
   1742 mb86960_loadmar(struct mb86960_softc *sc)
   1743 {
   1744 	bus_space_tag_t bst = sc->sc_bst;
   1745 	bus_space_handle_t bsh = sc->sc_bsh;
   1746 
   1747 	/* Stop the DLC (transmitter and receiver). */
   1748 	bus_space_write_1(bst, bsh, FE_DLCR6,
   1749 	    sc->proto_dlcr6 | FE_D6_DLC_DISABLE);
   1750 
   1751 	/* Select register bank 1 for MARs. */
   1752 	bus_space_write_1(bst, bsh, FE_DLCR7,
   1753 	    sc->proto_dlcr7 | FE_D7_RBS_MAR | FE_D7_POWER_UP);
   1754 
   1755 	/* Copy filter value into the registers. */
   1756 	bus_space_write_region_1(bst, bsh, FE_MAR8, sc->filter, FE_FILTER_LEN);
   1757 
   1758 	/* Restore the bank selection for BMPRs (i.e., runtime registers). */
   1759 	bus_space_write_1(bst, bsh, FE_DLCR7,
   1760 	    sc->proto_dlcr7 | FE_D7_RBS_BMPR | FE_D7_POWER_UP);
   1761 
   1762 	/* Restart the DLC. */
   1763 	bus_space_write_1(bst, bsh, FE_DLCR6,
   1764 	    sc->proto_dlcr6 | FE_D6_DLC_ENABLE);
   1765 
   1766 	/* We have just updated the filter. */
   1767 	sc->filter_change = 0;
   1768 
   1769 #if FE_DEBUG >= 3
   1770 	log(LOG_INFO, "%s: address filter changed\n", sc->sc_dev.dv_xname);
   1771 #endif
   1772 }
   1773 
   1774 /*
   1775  * Enable power on the interface.
   1776  */
   1777 int
   1778 mb86960_enable(struct mb86960_softc *sc)
   1779 {
   1780 
   1781 #if FE_DEBUG >= 3
   1782 	log(LOG_INFO, "%s: mb86960_enable()\n", sc->sc_dev.dv_xname);
   1783 #endif
   1784 
   1785 	if ((sc->sc_stat & FE_STAT_ENABLED) == 0 && sc->sc_enable != NULL) {
   1786 		if ((*sc->sc_enable)(sc) != 0) {
   1787 			printf("%s: device enable failed\n",
   1788 			    sc->sc_dev.dv_xname);
   1789 			return (EIO);
   1790 		}
   1791 	}
   1792 
   1793 	sc->sc_stat |= FE_STAT_ENABLED;
   1794 	return (0);
   1795 }
   1796 
   1797 /*
   1798  * Disable power on the interface.
   1799  */
   1800 void
   1801 mb86960_disable(struct mb86960_softc *sc)
   1802 {
   1803 
   1804 #if FE_DEBUG >= 3
   1805 	log(LOG_INFO, "%s: mb86960_disable()\n", sc->sc_dev.dv_xname);
   1806 #endif
   1807 
   1808 	if ((sc->sc_stat & FE_STAT_ENABLED) != 0 && sc->sc_disable != NULL) {
   1809 		(*sc->sc_disable)(sc);
   1810 		sc->sc_stat &= ~FE_STAT_ENABLED;
   1811 	}
   1812 }
   1813 
   1814 /*
   1815  * mbe_activate:
   1816  *
   1817  *	Handle device activation/deactivation requests.
   1818  */
   1819 int
   1820 mb86960_activate(struct device *self, enum devact act)
   1821 {
   1822 	struct mb86960_softc *sc = (struct mb86960_softc *)self;
   1823 	int rv, s;
   1824 
   1825 	rv = 0;
   1826 	s = splnet();
   1827 	switch (act) {
   1828 	case DVACT_ACTIVATE:
   1829 		rv = EOPNOTSUPP;
   1830 		break;
   1831 
   1832 	case DVACT_DEACTIVATE:
   1833 		if_deactivate(&sc->sc_ec.ec_if);
   1834 		break;
   1835 	}
   1836 	splx(s);
   1837 	return (rv);
   1838 }
   1839 
   1840 /*
   1841  * mb86960_detach:
   1842  *
   1843  *	Detach a MB86960 interface.
   1844  */
   1845 int
   1846 mb86960_detach(struct mb86960_softc *sc)
   1847 {
   1848 	struct ifnet *ifp = &sc->sc_ec.ec_if;
   1849 
   1850 	/* Succeed now if there's no work to do. */
   1851 	if ((sc->sc_stat & FE_STAT_ATTACHED) == 0)
   1852 		return (0);
   1853 
   1854 	/* Delete all media. */
   1855 	ifmedia_delete_instance(&sc->sc_media, IFM_INST_ANY);
   1856 
   1857 #if NRND > 0
   1858 	/* Unhook the entropy source. */
   1859 	rnd_detach_source(&sc->rnd_source);
   1860 #endif
   1861 	ether_ifdetach(ifp);
   1862 	if_detach(ifp);
   1863 
   1864 	mb86960_disable(sc);
   1865 	return (0);
   1866 }
   1867 
   1868 /*
   1869  * Routines to read all bytes from the config EEPROM (93C06) through MB86965A.
   1870  */
   1871 void
   1872 mb86965_read_eeprom(bus_space_tag_t iot, bus_space_handle_t ioh, uint8_t *data)
   1873 {
   1874 	int addr, op, bit;
   1875 	uint16_t val;
   1876 
   1877 	/* Read bytes from EEPROM; two bytes per an iteration. */
   1878 	for (addr = 0; addr < FE_EEPROM_SIZE / 2; addr++) {
   1879 		/* Reset the EEPROM interface. */
   1880 		bus_space_write_1(iot, ioh, FE_BMPR16, 0x00);
   1881 		bus_space_write_1(iot, ioh, FE_BMPR17, 0x00);
   1882 		bus_space_write_1(iot, ioh, FE_BMPR16, FE_B16_SELECT);
   1883 
   1884 		/* Send start bit. */
   1885 		bus_space_write_1(iot, ioh, FE_BMPR17, FE_B17_DATA);
   1886 		FE_EEPROM_DELAY();
   1887 		bus_space_write_1(iot, ioh,
   1888 		    FE_BMPR16, FE_B16_SELECT | FE_B16_CLOCK);
   1889 		FE_EEPROM_DELAY();
   1890 		bus_space_write_1(iot, ioh, FE_BMPR16, FE_B16_SELECT);
   1891 
   1892 		/* Send read command and read address. */
   1893 		op = 0x80 | addr;	/* READ instruction */
   1894 		for (bit = 8; bit > 0; bit--) {
   1895 			bus_space_write_1(iot, ioh, FE_BMPR17,
   1896 			    (op & (1 << (bit - 1))) ? FE_B17_DATA : 0);
   1897 			FE_EEPROM_DELAY();
   1898 			bus_space_write_1(iot, ioh,
   1899 			    FE_BMPR16, FE_B16_SELECT | FE_B16_CLOCK);
   1900 			FE_EEPROM_DELAY();
   1901 			bus_space_write_1(iot, ioh, FE_BMPR16, FE_B16_SELECT);
   1902 		}
   1903 		bus_space_write_1(iot, ioh, FE_BMPR17, 0x00);
   1904 
   1905 		/* Read two bytes in each address */
   1906 		val = 0;
   1907 		for (bit = 16; bit > 0; bit--) {
   1908 			FE_EEPROM_DELAY();
   1909 			bus_space_write_1(iot, ioh,
   1910 			    FE_BMPR16, FE_B16_SELECT | FE_B16_CLOCK);
   1911 			FE_EEPROM_DELAY();
   1912 			if (bus_space_read_1(iot, ioh, FE_BMPR17) &
   1913 			    FE_B17_DATA)
   1914 				val |= 1 << (bit - 1);
   1915 			bus_space_write_1(iot, ioh,
   1916 			    FE_BMPR16, FE_B16_SELECT);
   1917 		}
   1918 		data[addr * 2]     = val >> 8;
   1919 		data[addr * 2 + 1] = val & 0xff;
   1920 	}
   1921 
   1922 	/* Make sure the EEPROM is turned off. */
   1923 	bus_space_write_1(iot, ioh, FE_BMPR16, 0);
   1924 	bus_space_write_1(iot, ioh, FE_BMPR17, 0);
   1925 
   1926 #if FE_DEBUG >= 3
   1927 	/* Report what we got. */
   1928 	log(LOG_INFO, "mb86965_read_eeprom: "
   1929 	    " %02x%02x%02x%02x %02x%02x%02x%02x -"
   1930 	    " %02x%02x%02x%02x %02x%02x%02x%02x -"
   1931 	    " %02x%02x%02x%02x %02x%02x%02x%02x -"
   1932 	    " %02x%02x%02x%02x %02x%02x%02x%02x\n",
   1933 	    data[ 0], data[ 1], data[ 2], data[ 3],
   1934 	    data[ 4], data[ 5], data[ 6], data[ 7],
   1935 	    data[ 8], data[ 9], data[10], data[11],
   1936 	    data[12], data[13], data[14], data[15],
   1937 	    data[16], data[17], data[18], data[19],
   1938 	    data[20], data[21], data[22], data[23],
   1939 	    data[24], data[25], data[26], data[27],
   1940 	    data[28], data[29], data[30], data[31]);
   1941 #endif
   1942 }
   1943 
   1944 #if FE_DEBUG >= 1
   1945 void
   1946 mb86960_dump(int level, struct mb86960_softc *sc)
   1947 {
   1948 	bus_space_tag_t bst = sc->sc_bst;
   1949 	bus_space_handle_t bsh = sc->sc_bsh;
   1950 	uint8_t save_dlcr7;
   1951 
   1952 	save_dlcr7 = bus_space_read_1(bst, bsh, FE_DLCR7);
   1953 
   1954 	log(level, "\tDLCR = %02x %02x %02x %02x %02x %02x %02x %02x\n",
   1955 	    bus_space_read_1(bst, bsh, FE_DLCR0),
   1956 	    bus_space_read_1(bst, bsh, FE_DLCR1),
   1957 	    bus_space_read_1(bst, bsh, FE_DLCR2),
   1958 	    bus_space_read_1(bst, bsh, FE_DLCR3),
   1959 	    bus_space_read_1(bst, bsh, FE_DLCR4),
   1960 	    bus_space_read_1(bst, bsh, FE_DLCR5),
   1961 	    bus_space_read_1(bst, bsh, FE_DLCR6),
   1962 	    bus_space_read_1(bst, bsh, FE_DLCR7));
   1963 
   1964 	bus_space_write_1(bst, bsh, FE_DLCR7,
   1965 	    (save_dlcr7 & ~FE_D7_RBS) | FE_D7_RBS_DLCR);
   1966 	log(level, "\t       %02x %02x %02x %02x %02x %02x %02x %02x\n",
   1967 	    bus_space_read_1(bst, bsh, FE_DLCR8),
   1968 	    bus_space_read_1(bst, bsh, FE_DLCR9),
   1969 	    bus_space_read_1(bst, bsh, FE_DLCR10),
   1970 	    bus_space_read_1(bst, bsh, FE_DLCR11),
   1971 	    bus_space_read_1(bst, bsh, FE_DLCR12),
   1972 	    bus_space_read_1(bst, bsh, FE_DLCR13),
   1973 	    bus_space_read_1(bst, bsh, FE_DLCR14),
   1974 	    bus_space_read_1(bst, bsh, FE_DLCR15));
   1975 
   1976 	bus_space_write_1(bst, bsh, FE_DLCR7,
   1977 	    (save_dlcr7 & ~FE_D7_RBS) | FE_D7_RBS_MAR);
   1978 	log(level, "\tMAR  = %02x %02x %02x %02x %02x %02x %02x %02x\n",
   1979 	    bus_space_read_1(bst, bsh, FE_MAR8),
   1980 	    bus_space_read_1(bst, bsh, FE_MAR9),
   1981 	    bus_space_read_1(bst, bsh, FE_MAR10),
   1982 	    bus_space_read_1(bst, bsh, FE_MAR11),
   1983 	    bus_space_read_1(bst, bsh, FE_MAR12),
   1984 	    bus_space_read_1(bst, bsh, FE_MAR13),
   1985 	    bus_space_read_1(bst, bsh, FE_MAR14),
   1986 	    bus_space_read_1(bst, bsh, FE_MAR15));
   1987 
   1988 	bus_space_write_1(bst, bsh, FE_DLCR7,
   1989 	    (save_dlcr7 & ~FE_D7_RBS) | FE_D7_RBS_BMPR);
   1990 	log(level,
   1991 	    "\tBMPR = xx xx %02x %02x %02x %02x %02x %02x %02x %02x xx %02x\n",
   1992 	    bus_space_read_1(bst, bsh, FE_BMPR10),
   1993 	    bus_space_read_1(bst, bsh, FE_BMPR11),
   1994 	    bus_space_read_1(bst, bsh, FE_BMPR12),
   1995 	    bus_space_read_1(bst, bsh, FE_BMPR13),
   1996 	    bus_space_read_1(bst, bsh, FE_BMPR14),
   1997 	    bus_space_read_1(bst, bsh, FE_BMPR15),
   1998 	    bus_space_read_1(bst, bsh, FE_BMPR16),
   1999 	    bus_space_read_1(bst, bsh, FE_BMPR17),
   2000 	    bus_space_read_1(bst, bsh, FE_BMPR19));
   2001 
   2002 	bus_space_write_1(bst, bsh, FE_DLCR7, save_dlcr7);
   2003 }
   2004 #endif
   2005 
   2006