xref: /dflybsd-src/sys/dev/netif/xl/if_xl.c (revision 5e478546f4f82e25a7644793e510fe0028633b46)
1 /*
2  * Copyright (c) 1997, 1998, 1999
3  *	Bill Paul <wpaul@ctr.columbia.edu>.  All rights reserved.
4  *
5  * Redistribution and use in source and binary forms, with or without
6  * modification, are permitted provided that the following conditions
7  * are met:
8  * 1. Redistributions of source code must retain the above copyright
9  *    notice, this list of conditions and the following disclaimer.
10  * 2. Redistributions in binary form must reproduce the above copyright
11  *    notice, this list of conditions and the following disclaimer in the
12  *    documentation and/or other materials provided with the distribution.
13  * 3. All advertising materials mentioning features or use of this software
14  *    must display the following acknowledgement:
15  *	This product includes software developed by Bill Paul.
16  * 4. Neither the name of the author nor the names of any co-contributors
17  *    may be used to endorse or promote products derived from this software
18  *    without specific prior written permission.
19  *
20  * THIS SOFTWARE IS PROVIDED BY Bill Paul AND CONTRIBUTORS ``AS IS'' AND
21  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
22  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
23  * ARE DISCLAIMED.  IN NO EVENT SHALL Bill Paul OR THE VOICES IN HIS HEAD
24  * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
25  * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
26  * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
27  * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
28  * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
29  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
30  * THE POSSIBILITY OF SUCH DAMAGE.
31  *
32  * $FreeBSD: src/sys/pci/if_xl.c,v 1.72.2.28 2003/10/08 06:01:57 murray Exp $
33  * $DragonFly: src/sys/dev/netif/xl/if_xl.c,v 1.40 2005/10/24 08:06:16 sephe Exp $
34  */
35 
36 /*
37  * 3Com 3c90x Etherlink XL PCI NIC driver
38  *
39  * Supports the 3Com "boomerang", "cyclone" and "hurricane" PCI
40  * bus-master chips (3c90x cards and embedded controllers) including
41  * the following:
42  *
43  * 3Com 3c900-TPO	10Mbps/RJ-45
44  * 3Com 3c900-COMBO	10Mbps/RJ-45,AUI,BNC
45  * 3Com 3c905-TX	10/100Mbps/RJ-45
46  * 3Com 3c905-T4	10/100Mbps/RJ-45
47  * 3Com 3c900B-TPO	10Mbps/RJ-45
48  * 3Com 3c900B-COMBO	10Mbps/RJ-45,AUI,BNC
49  * 3Com 3c900B-TPC	10Mbps/RJ-45,BNC
50  * 3Com 3c900B-FL	10Mbps/Fiber-optic
51  * 3Com 3c905B-COMBO	10/100Mbps/RJ-45,AUI,BNC
52  * 3Com 3c905B-TX	10/100Mbps/RJ-45
53  * 3Com 3c905B-FL/FX	10/100Mbps/Fiber-optic
54  * 3Com 3c905C-TX	10/100Mbps/RJ-45 (Tornado ASIC)
55  * 3Com 3c980-TX	10/100Mbps server adapter (Hurricane ASIC)
56  * 3Com 3c980C-TX	10/100Mbps server adapter (Tornado ASIC)
57  * 3Com 3cSOHO100-TX	10/100Mbps/RJ-45 (Hurricane ASIC)
58  * 3Com 3c450-TX	10/100Mbps/RJ-45 (Tornado ASIC)
59  * 3Com 3c555		10/100Mbps/RJ-45 (MiniPCI, Laptop Hurricane)
60  * 3Com 3c556		10/100Mbps/RJ-45 (MiniPCI, Hurricane ASIC)
61  * 3Com 3c556B		10/100Mbps/RJ-45 (MiniPCI, Hurricane ASIC)
62  * 3Com 3c575TX		10/100Mbps/RJ-45 (Cardbus, Hurricane ASIC)
63  * 3Com 3c575B		10/100Mbps/RJ-45 (Cardbus, Hurricane ASIC)
64  * 3Com 3c575C		10/100Mbps/RJ-45 (Cardbus, Hurricane ASIC)
65  * 3Com 3cxfem656	10/100Mbps/RJ-45 (Cardbus, Hurricane ASIC)
66  * 3Com 3cxfem656b	10/100Mbps/RJ-45 (Cardbus, Hurricane ASIC)
67  * 3Com 3cxfem656c	10/100Mbps/RJ-45 (Cardbus, Tornado ASIC)
68  * Dell Optiplex GX1 on-board 3c918 10/100Mbps/RJ-45
69  * Dell on-board 3c920 10/100Mbps/RJ-45
70  * Dell Precision on-board 3c905B 10/100Mbps/RJ-45
71  * Dell Latitude laptop docking station embedded 3c905-TX
72  *
73  * Written by Bill Paul <wpaul@ctr.columbia.edu>
74  * Electrical Engineering Department
75  * Columbia University, New York City
76  */
77 
78 /*
79  * The 3c90x series chips use a bus-master DMA interface for transfering
80  * packets to and from the controller chip. Some of the "vortex" cards
81  * (3c59x) also supported a bus master mode, however for those chips
82  * you could only DMA packets to/from a contiguous memory buffer. For
83  * transmission this would mean copying the contents of the queued mbuf
84  * chain into an mbuf cluster and then DMAing the cluster. This extra
85  * copy would sort of defeat the purpose of the bus master support for
86  * any packet that doesn't fit into a single mbuf.
87  *
88  * By contrast, the 3c90x cards support a fragment-based bus master
89  * mode where mbuf chains can be encapsulated using TX descriptors.
90  * This is similar to other PCI chips such as the Texas Instruments
91  * ThunderLAN and the Intel 82557/82558.
92  *
93  * The "vortex" driver (if_vx.c) happens to work for the "boomerang"
94  * bus master chips because they maintain the old PIO interface for
95  * backwards compatibility, but starting with the 3c905B and the
96  * "cyclone" chips, the compatibility interface has been dropped.
97  * Since using bus master DMA is a big win, we use this driver to
98  * support the PCI "boomerang" chips even though they work with the
99  * "vortex" driver in order to obtain better performance.
100  */
101 
102 #include "opt_polling.h"
103 
104 #include <sys/param.h>
105 #include <sys/systm.h>
106 #include <sys/sockio.h>
107 #include <sys/endian.h>
108 #include <sys/mbuf.h>
109 #include <sys/kernel.h>
110 #include <sys/socket.h>
111 #include <sys/thread2.h>
112 
113 #include <net/if.h>
114 #include <net/ifq_var.h>
115 #include <net/if_arp.h>
116 #include <net/ethernet.h>
117 #include <net/if_dl.h>
118 #include <net/if_media.h>
119 #include <net/vlan/if_vlan_var.h>
120 
121 #include <net/bpf.h>
122 
123 #include <machine/bus_memio.h>
124 #include <machine/bus_pio.h>
125 #include <machine/bus.h>
126 #include <machine/resource.h>
127 #include <sys/bus.h>
128 #include <sys/rman.h>
129 
130 #include "../mii_layer/mii.h"
131 #include "../mii_layer/miivar.h"
132 
133 #include <bus/pci/pcireg.h>
134 #include <bus/pci/pcivar.h>
135 
136 /* "controller miibus0" required.  See GENERIC if you get errors here. */
137 #include "miibus_if.h"
138 
139 #include "if_xlreg.h"
140 
141 #define XL905B_CSUM_FEATURES	(CSUM_IP | CSUM_TCP | CSUM_UDP)
142 
143 /*
144  * Various supported device vendors/types and their names.
145  */
146 static struct xl_type xl_devs[] = {
147 	{ TC_VENDORID, TC_DEVICEID_BOOMERANG_10BT,
148 		"3Com 3c900-TPO Etherlink XL" },
149 	{ TC_VENDORID, TC_DEVICEID_BOOMERANG_10BT_COMBO,
150 		"3Com 3c900-COMBO Etherlink XL" },
151 	{ TC_VENDORID, TC_DEVICEID_BOOMERANG_10_100BT,
152 		"3Com 3c905-TX Fast Etherlink XL" },
153 	{ TC_VENDORID, TC_DEVICEID_BOOMERANG_100BT4,
154 		"3Com 3c905-T4 Fast Etherlink XL" },
155 	{ TC_VENDORID, TC_DEVICEID_KRAKATOA_10BT,
156 		"3Com 3c900B-TPO Etherlink XL" },
157 	{ TC_VENDORID, TC_DEVICEID_KRAKATOA_10BT_COMBO,
158 		"3Com 3c900B-COMBO Etherlink XL" },
159 	{ TC_VENDORID, TC_DEVICEID_KRAKATOA_10BT_TPC,
160 		"3Com 3c900B-TPC Etherlink XL" },
161 	{ TC_VENDORID, TC_DEVICEID_CYCLONE_10FL,
162 		"3Com 3c900B-FL Etherlink XL" },
163 	{ TC_VENDORID, TC_DEVICEID_HURRICANE_10_100BT,
164 		"3Com 3c905B-TX Fast Etherlink XL" },
165 	{ TC_VENDORID, TC_DEVICEID_CYCLONE_10_100BT4,
166 		"3Com 3c905B-T4 Fast Etherlink XL" },
167 	{ TC_VENDORID, TC_DEVICEID_CYCLONE_10_100FX,
168 		"3Com 3c905B-FX/SC Fast Etherlink XL" },
169 	{ TC_VENDORID, TC_DEVICEID_CYCLONE_10_100_COMBO,
170 		"3Com 3c905B-COMBO Fast Etherlink XL" },
171 	{ TC_VENDORID, TC_DEVICEID_TORNADO_10_100BT,
172 		"3Com 3c905C-TX Fast Etherlink XL" },
173 	{ TC_VENDORID, TC_DEVICEID_TORNADO_10_100BT_920B,
174 		"3Com 3c920B-EMB Integrated Fast Etherlink XL" },
175 	{ TC_VENDORID, TC_DEVICEID_HURRICANE_10_100BT_SERV,
176 		"3Com 3c980 Fast Etherlink XL" },
177 	{ TC_VENDORID, TC_DEVICEID_TORNADO_10_100BT_SERV,
178 		"3Com 3c980C Fast Etherlink XL" },
179 	{ TC_VENDORID, TC_DEVICEID_HURRICANE_SOHO100TX,
180 		"3Com 3cSOHO100-TX OfficeConnect" },
181 	{ TC_VENDORID, TC_DEVICEID_TORNADO_HOMECONNECT,
182 		"3Com 3c450-TX HomeConnect" },
183 	{ TC_VENDORID, TC_DEVICEID_HURRICANE_555,
184 		"3Com 3c555 Fast Etherlink XL" },
185 	{ TC_VENDORID, TC_DEVICEID_HURRICANE_556,
186 		"3Com 3c556 Fast Etherlink XL" },
187 	{ TC_VENDORID, TC_DEVICEID_HURRICANE_556B,
188 		"3Com 3c556B Fast Etherlink XL" },
189 	{ TC_VENDORID, TC_DEVICEID_HURRICANE_575A,
190 		"3Com 3c575TX Fast Etherlink XL" },
191 	{ TC_VENDORID, TC_DEVICEID_HURRICANE_575B,
192 		"3Com 3c575B Fast Etherlink XL" },
193 	{ TC_VENDORID, TC_DEVICEID_HURRICANE_575C,
194 		"3Com 3c575C Fast Etherlink XL" },
195 	{ TC_VENDORID, TC_DEVICEID_HURRICANE_656,
196 		"3Com 3c656 Fast Etherlink XL" },
197 	{ TC_VENDORID, TC_DEVICEID_HURRICANE_656B,
198 		"3Com 3c656B Fast Etherlink XL" },
199 	{ TC_VENDORID, TC_DEVICEID_TORNADO_656C,
200 		"3Com 3c656C Fast Etherlink XL" },
201 	{ 0, 0, NULL }
202 };
203 
204 static int xl_probe		(device_t);
205 static int xl_attach		(device_t);
206 static int xl_detach		(device_t);
207 
208 static int xl_newbuf		(struct xl_softc *, struct xl_chain_onefrag *);
209 static void xl_stats_update	(void *);
210 static int xl_encap		(struct xl_softc *, struct xl_chain *,
211 						struct mbuf *);
212 static void xl_rxeof		(struct xl_softc *, int);
213 static int xl_rx_resync		(struct xl_softc *);
214 static void xl_txeof		(struct xl_softc *);
215 static void xl_txeof_90xB	(struct xl_softc *);
216 static void xl_txeoc		(struct xl_softc *);
217 static void xl_intr		(void *);
218 static void xl_start_body	(struct ifnet *, int);
219 static void xl_start		(struct ifnet *);
220 static void xl_start_90xB	(struct ifnet *);
221 static int xl_ioctl		(struct ifnet *, u_long, caddr_t,
222 						struct ucred *);
223 static void xl_init		(void *);
224 static void xl_stop		(struct xl_softc *);
225 static void xl_watchdog		(struct ifnet *);
226 static void xl_shutdown		(device_t);
227 static int xl_suspend		(device_t);
228 static int xl_resume		(device_t);
229 #ifdef DEVICE_POLLING
230 static void xl_poll		(struct ifnet *, enum poll_cmd, int);
231 #endif
232 static void xl_enable_intrs	(struct xl_softc *, uint16_t);
233 
234 static int xl_ifmedia_upd	(struct ifnet *);
235 static void xl_ifmedia_sts	(struct ifnet *, struct ifmediareq *);
236 
237 static int xl_eeprom_wait	(struct xl_softc *);
238 static int xl_read_eeprom	(struct xl_softc *, caddr_t, int, int, int);
239 static void xl_mii_sync		(struct xl_softc *);
240 static void xl_mii_send		(struct xl_softc *, u_int32_t, int);
241 static int xl_mii_readreg	(struct xl_softc *, struct xl_mii_frame *);
242 static int xl_mii_writereg	(struct xl_softc *, struct xl_mii_frame *);
243 
244 static void xl_setcfg		(struct xl_softc *);
245 static void xl_setmode		(struct xl_softc *, int);
246 static void xl_setmulti		(struct xl_softc *);
247 static void xl_setmulti_hash	(struct xl_softc *);
248 static void xl_reset		(struct xl_softc *);
249 static int xl_list_rx_init	(struct xl_softc *);
250 static void xl_list_tx_init	(struct xl_softc *);
251 static void xl_list_tx_init_90xB(struct xl_softc *);
252 static void xl_wait		(struct xl_softc *);
253 static void xl_mediacheck	(struct xl_softc *);
254 static void xl_choose_xcvr	(struct xl_softc *, int);
255 static void xl_dma_map_addr	(void *, bus_dma_segment_t *, int, int);
256 static void xl_dma_map_rxbuf	(void *, bus_dma_segment_t *, int, bus_size_t,
257 						int);
258 static void xl_dma_map_txbuf	(void *, bus_dma_segment_t *, int, bus_size_t,
259 						int);
260 
261 static int xl_dma_alloc		(device_t);
262 static void xl_dma_free		(device_t);
263 
264 #ifdef notdef
265 static void xl_testpacket	(struct xl_softc *);
266 #endif
267 
268 static int xl_miibus_readreg	(device_t, int, int);
269 static int xl_miibus_writereg	(device_t, int, int, int);
270 static void xl_miibus_statchg	(device_t);
271 static void xl_miibus_mediainit	(device_t);
272 
273 static device_method_t xl_methods[] = {
274 	/* Device interface */
275 	DEVMETHOD(device_probe,		xl_probe),
276 	DEVMETHOD(device_attach,	xl_attach),
277 	DEVMETHOD(device_detach,	xl_detach),
278 	DEVMETHOD(device_shutdown,	xl_shutdown),
279 	DEVMETHOD(device_suspend,	xl_suspend),
280 	DEVMETHOD(device_resume,	xl_resume),
281 
282 	/* bus interface */
283 	DEVMETHOD(bus_print_child,	bus_generic_print_child),
284 	DEVMETHOD(bus_driver_added,	bus_generic_driver_added),
285 
286 	/* MII interface */
287 	DEVMETHOD(miibus_readreg,	xl_miibus_readreg),
288 	DEVMETHOD(miibus_writereg,	xl_miibus_writereg),
289 	DEVMETHOD(miibus_statchg,	xl_miibus_statchg),
290 	DEVMETHOD(miibus_mediainit,	xl_miibus_mediainit),
291 
292 	{ 0, 0 }
293 };
294 
295 static driver_t xl_driver = {
296 	"xl",
297 	xl_methods,
298 	sizeof(struct xl_softc)
299 };
300 
301 static devclass_t xl_devclass;
302 
303 DECLARE_DUMMY_MODULE(if_xl);
304 MODULE_DEPEND(if_xl, miibus, 1, 1, 1);
305 DRIVER_MODULE(if_xl, pci, xl_driver, xl_devclass, 0, 0);
306 DRIVER_MODULE(if_xl, cardbus, xl_driver, xl_devclass, 0, 0);
307 DRIVER_MODULE(miibus, xl, miibus_driver, miibus_devclass, 0, 0);
308 
309 static void
310 xl_enable_intrs(struct xl_softc *sc, uint16_t intrs)
311 {
312 	CSR_WRITE_2(sc, XL_COMMAND, XL_CMD_INTR_ACK | 0xFF);
313 	CSR_WRITE_2(sc, XL_COMMAND, XL_CMD_INTR_ENB | intrs);
314 	if (sc->xl_flags & XL_FLAG_FUNCREG)
315 		bus_space_write_4(sc->xl_ftag, sc->xl_fhandle, 4, 0x8000);
316 }
317 
318 static void
319 xl_dma_map_addr(void *arg, bus_dma_segment_t *segs, int nseg, int error)
320 {
321 	u_int32_t *paddr;
322 
323 	paddr = arg;
324 	*paddr = segs->ds_addr;
325 }
326 
327 static void
328 xl_dma_map_rxbuf(void *arg, bus_dma_segment_t *segs, int nseg,
329     bus_size_t mapsize, int error)
330 {
331 	u_int32_t *paddr;
332 
333 	if (error)
334 		return;
335 	KASSERT(nseg == 1, ("xl_dma_map_rxbuf: too many DMA segments"));
336 	paddr = arg;
337 	*paddr = segs->ds_addr;
338 }
339 
340 static void
341 xl_dma_map_txbuf(void *arg, bus_dma_segment_t *segs, int nseg,
342     bus_size_t mapsize, int error)
343 {
344 	struct xl_list *l;
345 	int i, total_len;
346 
347 	if (error)
348 		return;
349 
350 	KASSERT(nseg <= XL_MAXFRAGS, ("too many DMA segments"));
351 
352 	total_len = 0;
353 	l = arg;
354 	for (i = 0; i < nseg; i++) {
355 		KASSERT(segs[i].ds_len <= MCLBYTES, ("segment size too large"));
356 		l->xl_frag[i].xl_addr = htole32(segs[i].ds_addr);
357 		l->xl_frag[i].xl_len = htole32(segs[i].ds_len);
358 		total_len += segs[i].ds_len;
359 	}
360 	l->xl_frag[nseg - 1].xl_len = htole32(segs[nseg - 1].ds_len |
361 	    XL_LAST_FRAG);
362 	l->xl_status = htole32(total_len);
363 	l->xl_next = 0;
364 }
365 
366 /*
367  * Murphy's law says that it's possible the chip can wedge and
368  * the 'command in progress' bit may never clear. Hence, we wait
369  * only a finite amount of time to avoid getting caught in an
370  * infinite loop. Normally this delay routine would be a macro,
371  * but it isn't called during normal operation so we can afford
372  * to make it a function.
373  */
374 static void
375 xl_wait(struct xl_softc *sc)
376 {
377 	int		i;
378 
379 	for (i = 0; i < XL_TIMEOUT; i++) {
380 		if (!(CSR_READ_2(sc, XL_STATUS) & XL_STAT_CMDBUSY))
381 			break;
382 	}
383 
384 	if (i == XL_TIMEOUT)
385 		if_printf(&sc->arpcom.ac_if, "command never completed!");
386 
387 	return;
388 }
389 
390 /*
391  * MII access routines are provided for adapters with external
392  * PHYs (3c905-TX, 3c905-T4, 3c905B-T4) and those with built-in
393  * autoneg logic that's faked up to look like a PHY (3c905B-TX).
394  * Note: if you don't perform the MDIO operations just right,
395  * it's possible to end up with code that works correctly with
396  * some chips/CPUs/processor speeds/bus speeds/etc but not
397  * with others.
398  */
399 #define MII_SET(x)					\
400 	CSR_WRITE_2(sc, XL_W4_PHY_MGMT,			\
401 		CSR_READ_2(sc, XL_W4_PHY_MGMT) | (x))
402 
403 #define MII_CLR(x)					\
404 	CSR_WRITE_2(sc, XL_W4_PHY_MGMT,			\
405 		CSR_READ_2(sc, XL_W4_PHY_MGMT) & ~(x))
406 
407 /*
408  * Sync the PHYs by setting data bit and strobing the clock 32 times.
409  */
410 static void
411 xl_mii_sync(struct xl_softc *sc)
412 {
413 	int		i;
414 
415 	XL_SEL_WIN(4);
416 	MII_SET(XL_MII_DIR|XL_MII_DATA);
417 
418 	for (i = 0; i < 32; i++) {
419 		MII_SET(XL_MII_CLK);
420 		MII_SET(XL_MII_DATA);
421 		MII_SET(XL_MII_DATA);
422 		MII_CLR(XL_MII_CLK);
423 		MII_SET(XL_MII_DATA);
424 		MII_SET(XL_MII_DATA);
425 	}
426 
427 	return;
428 }
429 
430 /*
431  * Clock a series of bits through the MII.
432  */
433 static void
434 xl_mii_send(struct xl_softc *sc, u_int32_t bits, int cnt)
435 {
436 	int			i;
437 
438 	XL_SEL_WIN(4);
439 	MII_CLR(XL_MII_CLK);
440 
441 	for (i = (0x1 << (cnt - 1)); i; i >>= 1) {
442                 if (bits & i) {
443 			MII_SET(XL_MII_DATA);
444                 } else {
445 			MII_CLR(XL_MII_DATA);
446                 }
447 		MII_CLR(XL_MII_CLK);
448 		MII_SET(XL_MII_CLK);
449 	}
450 }
451 
452 /*
453  * Read an PHY register through the MII.
454  */
455 static int
456 xl_mii_readreg(struct xl_softc *sc, struct xl_mii_frame *frame)
457 {
458 	int			i, ack;
459 
460 	crit_enter();
461 
462 	/*
463 	 * Set up frame for RX.
464 	 */
465 	frame->mii_stdelim = XL_MII_STARTDELIM;
466 	frame->mii_opcode = XL_MII_READOP;
467 	frame->mii_turnaround = 0;
468 	frame->mii_data = 0;
469 
470 	/*
471 	 * Select register window 4.
472 	 */
473 
474 	XL_SEL_WIN(4);
475 
476 	CSR_WRITE_2(sc, XL_W4_PHY_MGMT, 0);
477 	/*
478  	 * Turn on data xmit.
479 	 */
480 	MII_SET(XL_MII_DIR);
481 
482 	xl_mii_sync(sc);
483 
484 	/*
485 	 * Send command/address info.
486 	 */
487 	xl_mii_send(sc, frame->mii_stdelim, 2);
488 	xl_mii_send(sc, frame->mii_opcode, 2);
489 	xl_mii_send(sc, frame->mii_phyaddr, 5);
490 	xl_mii_send(sc, frame->mii_regaddr, 5);
491 
492 	/* Idle bit */
493 	MII_CLR((XL_MII_CLK|XL_MII_DATA));
494 	MII_SET(XL_MII_CLK);
495 
496 	/* Turn off xmit. */
497 	MII_CLR(XL_MII_DIR);
498 
499 	/* Check for ack */
500 	MII_CLR(XL_MII_CLK);
501 	ack = CSR_READ_2(sc, XL_W4_PHY_MGMT) & XL_MII_DATA;
502 	MII_SET(XL_MII_CLK);
503 
504 	/*
505 	 * Now try reading data bits. If the ack failed, we still
506 	 * need to clock through 16 cycles to keep the PHY(s) in sync.
507 	 */
508 	if (ack) {
509 		for(i = 0; i < 16; i++) {
510 			MII_CLR(XL_MII_CLK);
511 			MII_SET(XL_MII_CLK);
512 		}
513 		goto fail;
514 	}
515 
516 	for (i = 0x8000; i; i >>= 1) {
517 		MII_CLR(XL_MII_CLK);
518 		if (!ack) {
519 			if (CSR_READ_2(sc, XL_W4_PHY_MGMT) & XL_MII_DATA)
520 				frame->mii_data |= i;
521 		}
522 		MII_SET(XL_MII_CLK);
523 	}
524 
525 fail:
526 
527 	MII_CLR(XL_MII_CLK);
528 	MII_SET(XL_MII_CLK);
529 
530 	crit_exit();
531 
532 	if (ack)
533 		return(1);
534 	return(0);
535 }
536 
537 /*
538  * Write to a PHY register through the MII.
539  */
540 static int
541 xl_mii_writereg(struct xl_softc *sc, struct xl_mii_frame *frame)
542 {
543 	crit_enter();
544 
545 	/*
546 	 * Set up frame for TX.
547 	 */
548 
549 	frame->mii_stdelim = XL_MII_STARTDELIM;
550 	frame->mii_opcode = XL_MII_WRITEOP;
551 	frame->mii_turnaround = XL_MII_TURNAROUND;
552 
553 	/*
554 	 * Select the window 4.
555 	 */
556 	XL_SEL_WIN(4);
557 
558 	/*
559  	 * Turn on data output.
560 	 */
561 	MII_SET(XL_MII_DIR);
562 
563 	xl_mii_sync(sc);
564 
565 	xl_mii_send(sc, frame->mii_stdelim, 2);
566 	xl_mii_send(sc, frame->mii_opcode, 2);
567 	xl_mii_send(sc, frame->mii_phyaddr, 5);
568 	xl_mii_send(sc, frame->mii_regaddr, 5);
569 	xl_mii_send(sc, frame->mii_turnaround, 2);
570 	xl_mii_send(sc, frame->mii_data, 16);
571 
572 	/* Idle bit. */
573 	MII_SET(XL_MII_CLK);
574 	MII_CLR(XL_MII_CLK);
575 
576 	/*
577 	 * Turn off xmit.
578 	 */
579 	MII_CLR(XL_MII_DIR);
580 
581 	crit_exit();
582 
583 	return(0);
584 }
585 
586 static int
587 xl_miibus_readreg(device_t dev, int phy, int reg)
588 {
589 	struct xl_softc		*sc;
590 	struct xl_mii_frame	frame;
591 
592 	sc = device_get_softc(dev);
593 
594 	/*
595 	 * Pretend that PHYs are only available at MII address 24.
596 	 * This is to guard against problems with certain 3Com ASIC
597 	 * revisions that incorrectly map the internal transceiver
598 	 * control registers at all MII addresses. This can cause
599 	 * the miibus code to attach the same PHY several times over.
600 	 */
601 	if ((!(sc->xl_flags & XL_FLAG_PHYOK)) && phy != 24)
602 		return(0);
603 
604 	bzero((char *)&frame, sizeof(frame));
605 
606 	frame.mii_phyaddr = phy;
607 	frame.mii_regaddr = reg;
608 	xl_mii_readreg(sc, &frame);
609 
610 	return(frame.mii_data);
611 }
612 
613 static int
614 xl_miibus_writereg(device_t dev, int phy, int reg, int data)
615 {
616 	struct xl_softc		*sc;
617 	struct xl_mii_frame	frame;
618 
619 	sc = device_get_softc(dev);
620 
621 	if ((!(sc->xl_flags & XL_FLAG_PHYOK)) && phy != 24)
622 		return(0);
623 
624 	bzero((char *)&frame, sizeof(frame));
625 
626 	frame.mii_phyaddr = phy;
627 	frame.mii_regaddr = reg;
628 	frame.mii_data = data;
629 
630 	xl_mii_writereg(sc, &frame);
631 
632 	return(0);
633 }
634 
635 static void
636 xl_miibus_statchg(device_t dev)
637 {
638         struct xl_softc		*sc;
639         struct mii_data		*mii;
640 
641 
642 	sc = device_get_softc(dev);
643 	mii = device_get_softc(sc->xl_miibus);
644 
645 	xl_setcfg(sc);
646 
647 	/* Set ASIC's duplex mode to match the PHY. */
648 	XL_SEL_WIN(3);
649 	if ((mii->mii_media_active & IFM_GMASK) == IFM_FDX)
650 		CSR_WRITE_1(sc, XL_W3_MAC_CTRL, XL_MACCTRL_DUPLEX);
651 	else
652 		CSR_WRITE_1(sc, XL_W3_MAC_CTRL,
653 			(CSR_READ_1(sc, XL_W3_MAC_CTRL) & ~XL_MACCTRL_DUPLEX));
654 
655         return;
656 }
657 
658 /*
659  * Special support for the 3c905B-COMBO. This card has 10/100 support
660  * plus BNC and AUI ports. This means we will have both an miibus attached
661  * plus some non-MII media settings. In order to allow this, we have to
662  * add the extra media to the miibus's ifmedia struct, but we can't do
663  * that during xl_attach() because the miibus hasn't been attached yet.
664  * So instead, we wait until the miibus probe/attach is done, at which
665  * point we will get a callback telling is that it's safe to add our
666  * extra media.
667  */
668 static void
669 xl_miibus_mediainit(device_t dev)
670 {
671         struct xl_softc		*sc;
672         struct mii_data		*mii;
673 	struct ifmedia		*ifm;
674 
675 	sc = device_get_softc(dev);
676 	mii = device_get_softc(sc->xl_miibus);
677 	ifm = &mii->mii_media;
678 
679 	if (sc->xl_media & (XL_MEDIAOPT_AUI|XL_MEDIAOPT_10FL)) {
680 		/*
681 		 * Check for a 10baseFL board in disguise.
682 		 */
683 		if (sc->xl_type == XL_TYPE_905B &&
684 		    sc->xl_media == XL_MEDIAOPT_10FL) {
685 			if (bootverbose)
686 				device_printf(dev, "found 10baseFL\n");
687 			ifmedia_add(ifm, IFM_ETHER|IFM_10_FL, 0, NULL);
688 			ifmedia_add(ifm, IFM_ETHER|IFM_10_FL|IFM_HDX, 0, NULL);
689 			if (sc->xl_caps & XL_CAPS_FULL_DUPLEX)
690 				ifmedia_add(ifm,
691 				    IFM_ETHER|IFM_10_FL|IFM_FDX, 0, NULL);
692 		} else {
693 			if (bootverbose)
694 				device_printf(dev, "found AUI\n");
695 			ifmedia_add(ifm, IFM_ETHER|IFM_10_5, 0, NULL);
696 		}
697 	}
698 
699 	if (sc->xl_media & XL_MEDIAOPT_BNC) {
700 		if (bootverbose)
701 			device_printf(dev, "found BNC\n");
702 		ifmedia_add(ifm, IFM_ETHER|IFM_10_2, 0, NULL);
703 	}
704 
705 	return;
706 }
707 
708 /*
709  * The EEPROM is slow: give it time to come ready after issuing
710  * it a command.
711  */
712 static int
713 xl_eeprom_wait(struct xl_softc *sc)
714 {
715 	int			i;
716 
717 	for (i = 0; i < 100; i++) {
718 		if (CSR_READ_2(sc, XL_W0_EE_CMD) & XL_EE_BUSY)
719 			DELAY(162);
720 		else
721 			break;
722 	}
723 
724 	if (i == 100) {
725 		if_printf(&sc->arpcom.ac_if, "eeprom failed to come ready\n");
726 		return(1);
727 	}
728 
729 	return(0);
730 }
731 
732 /*
733  * Read a sequence of words from the EEPROM. Note that ethernet address
734  * data is stored in the EEPROM in network byte order.
735  */
736 static int
737 xl_read_eeprom(struct xl_softc *sc, caddr_t dest, int off, int cnt, int swap)
738 {
739 	int			err = 0, i;
740 	u_int16_t		word = 0, *ptr;
741 #define EEPROM_5BIT_OFFSET(A) ((((A) << 2) & 0x7F00) | ((A) & 0x003F))
742 #define EEPROM_8BIT_OFFSET(A) ((A) & 0x003F)
743 	/* WARNING! DANGER!
744 	 * It's easy to accidentally overwrite the rom content!
745 	 * Note: the 3c575 uses 8bit EEPROM offsets.
746 	 */
747 	XL_SEL_WIN(0);
748 
749 	if (xl_eeprom_wait(sc))
750 		return(1);
751 
752 	if (sc->xl_flags & XL_FLAG_EEPROM_OFFSET_30)
753 		off += 0x30;
754 
755 	for (i = 0; i < cnt; i++) {
756 		if (sc->xl_flags & XL_FLAG_8BITROM)
757 			CSR_WRITE_2(sc, XL_W0_EE_CMD,
758 			    XL_EE_8BIT_READ | EEPROM_8BIT_OFFSET(off + i));
759 		else
760 			CSR_WRITE_2(sc, XL_W0_EE_CMD,
761 			    XL_EE_READ | EEPROM_5BIT_OFFSET(off + i));
762 		err = xl_eeprom_wait(sc);
763 		if (err)
764 			break;
765 		word = CSR_READ_2(sc, XL_W0_EE_DATA);
766 		ptr = (u_int16_t *)(dest + (i * 2));
767 		if (swap)
768 			*ptr = ntohs(word);
769 		else
770 			*ptr = word;
771 	}
772 
773 	return(err ? 1 : 0);
774 }
775 
776 /*
777  * NICs older than the 3c905B have only one multicast option, which
778  * is to enable reception of all multicast frames.
779  */
780 static void
781 xl_setmulti(struct xl_softc *sc)
782 {
783 	struct ifnet		*ifp;
784 	struct ifmultiaddr	*ifma;
785 	u_int8_t		rxfilt;
786 	int			mcnt = 0;
787 
788 	ifp = &sc->arpcom.ac_if;
789 
790 	XL_SEL_WIN(5);
791 	rxfilt = CSR_READ_1(sc, XL_W5_RX_FILTER);
792 
793 	if (ifp->if_flags & IFF_ALLMULTI) {
794 		rxfilt |= XL_RXFILTER_ALLMULTI;
795 		CSR_WRITE_2(sc, XL_COMMAND, XL_CMD_RX_SET_FILT|rxfilt);
796 		return;
797 	}
798 
799 	LIST_FOREACH(ifma, &ifp->if_multiaddrs, ifma_link)
800 		mcnt++;
801 
802 	if (mcnt)
803 		rxfilt |= XL_RXFILTER_ALLMULTI;
804 	else
805 		rxfilt &= ~XL_RXFILTER_ALLMULTI;
806 
807 	CSR_WRITE_2(sc, XL_COMMAND, XL_CMD_RX_SET_FILT|rxfilt);
808 
809 	return;
810 }
811 
812 /*
813  * 3c905B adapters have a hash filter that we can program.
814  */
815 static void
816 xl_setmulti_hash(struct xl_softc *sc)
817 {
818 	struct ifnet		*ifp;
819 	int			h = 0, i;
820 	struct ifmultiaddr	*ifma;
821 	u_int8_t		rxfilt;
822 	int			mcnt = 0;
823 
824 	ifp = &sc->arpcom.ac_if;
825 
826 	XL_SEL_WIN(5);
827 	rxfilt = CSR_READ_1(sc, XL_W5_RX_FILTER);
828 
829 	if (ifp->if_flags & IFF_ALLMULTI) {
830 		rxfilt |= XL_RXFILTER_ALLMULTI;
831 		CSR_WRITE_2(sc, XL_COMMAND, XL_CMD_RX_SET_FILT|rxfilt);
832 		return;
833 	} else
834 		rxfilt &= ~XL_RXFILTER_ALLMULTI;
835 
836 
837 	/* first, zot all the existing hash bits */
838 	for (i = 0; i < XL_HASHFILT_SIZE; i++)
839 		CSR_WRITE_2(sc, XL_COMMAND, XL_CMD_RX_SET_HASH|i);
840 
841 	/* now program new ones */
842 	LIST_FOREACH(ifma, &ifp->if_multiaddrs, ifma_link) {
843 		if (ifma->ifma_addr->sa_family != AF_LINK)
844 			continue;
845 
846 		/*
847 		 * Note: the 3c905B currently only supports a 64-bit
848 		 * hash table, which means we really only need 6 bits,
849 		 * but the manual indicates that future chip revisions
850 		 * will have a 256-bit hash table, hence the routine is
851 		 * set up to calculate 8 bits of position info in case
852 		 * we need it some day.
853 		 * Note II, The Sequel: _CURRENT_ versions of the 3c905B
854 		 * have a 256 bit hash table. This means we have to use
855 		 * all 8 bits regardless.  On older cards, the upper 2
856 		 * bits will be ignored. Grrrr....
857 		 */
858 		h = ether_crc32_be(
859 			LLADDR((struct sockaddr_dl *)ifma->ifma_addr),
860 			ETHER_ADDR_LEN) & 0xff;
861 		CSR_WRITE_2(sc, XL_COMMAND, XL_CMD_RX_SET_HASH|XL_HASH_SET|h);
862 		mcnt++;
863 	}
864 
865 	if (mcnt)
866 		rxfilt |= XL_RXFILTER_MULTIHASH;
867 	else
868 		rxfilt &= ~XL_RXFILTER_MULTIHASH;
869 
870 	CSR_WRITE_2(sc, XL_COMMAND, XL_CMD_RX_SET_FILT|rxfilt);
871 
872 	return;
873 }
874 
875 #ifdef notdef
876 static void
877 xl_testpacket(struct xl_softc *sc)
878 {
879 	struct mbuf		*m;
880 	struct ifnet		*ifp;
881 
882 	ifp = &sc->arpcom.ac_if;
883 
884 	MGETHDR(m, MB_DONTWAIT, MT_DATA);
885 
886 	if (m == NULL)
887 		return;
888 
889 	bcopy(&sc->arpcom.ac_enaddr,
890 		mtod(m, struct ether_header *)->ether_dhost, ETHER_ADDR_LEN);
891 	bcopy(&sc->arpcom.ac_enaddr,
892 		mtod(m, struct ether_header *)->ether_shost, ETHER_ADDR_LEN);
893 	mtod(m, struct ether_header *)->ether_type = htons(3);
894 	mtod(m, unsigned char *)[14] = 0;
895 	mtod(m, unsigned char *)[15] = 0;
896 	mtod(m, unsigned char *)[16] = 0xE3;
897 	m->m_len = m->m_pkthdr.len = sizeof(struct ether_header) + 3;
898 	IF_ENQUEUE(&ifp->if_snd, m);
899 	xl_start(ifp);
900 
901 	return;
902 }
903 #endif
904 
905 static void
906 xl_setcfg(struct xl_softc *sc)
907 {
908 	u_int32_t		icfg;
909 
910 	XL_SEL_WIN(3);
911 	icfg = CSR_READ_4(sc, XL_W3_INTERNAL_CFG);
912 	icfg &= ~XL_ICFG_CONNECTOR_MASK;
913 	if (sc->xl_media & XL_MEDIAOPT_MII ||
914 		sc->xl_media & XL_MEDIAOPT_BT4)
915 		icfg |= (XL_XCVR_MII << XL_ICFG_CONNECTOR_BITS);
916 	if (sc->xl_media & XL_MEDIAOPT_BTX)
917 		icfg |= (XL_XCVR_AUTO << XL_ICFG_CONNECTOR_BITS);
918 
919 	CSR_WRITE_4(sc, XL_W3_INTERNAL_CFG, icfg);
920 	CSR_WRITE_2(sc, XL_COMMAND, XL_CMD_COAX_STOP);
921 
922 	return;
923 }
924 
925 static void
926 xl_setmode(struct xl_softc *sc, int media)
927 {
928 	struct ifnet *ifp = &sc->arpcom.ac_if;
929 	u_int32_t		icfg;
930 	u_int16_t		mediastat;
931 
932 	if_printf(ifp, "selecting ");
933 
934 	XL_SEL_WIN(4);
935 	mediastat = CSR_READ_2(sc, XL_W4_MEDIA_STATUS);
936 	XL_SEL_WIN(3);
937 	icfg = CSR_READ_4(sc, XL_W3_INTERNAL_CFG);
938 
939 	if (sc->xl_media & XL_MEDIAOPT_BT) {
940 		if (IFM_SUBTYPE(media) == IFM_10_T) {
941 			printf("10baseT transceiver, ");
942 			sc->xl_xcvr = XL_XCVR_10BT;
943 			icfg &= ~XL_ICFG_CONNECTOR_MASK;
944 			icfg |= (XL_XCVR_10BT << XL_ICFG_CONNECTOR_BITS);
945 			mediastat |= XL_MEDIASTAT_LINKBEAT|
946 					XL_MEDIASTAT_JABGUARD;
947 			mediastat &= ~XL_MEDIASTAT_SQEENB;
948 		}
949 	}
950 
951 	if (sc->xl_media & XL_MEDIAOPT_BFX) {
952 		if (IFM_SUBTYPE(media) == IFM_100_FX) {
953 			printf("100baseFX port, ");
954 			sc->xl_xcvr = XL_XCVR_100BFX;
955 			icfg &= ~XL_ICFG_CONNECTOR_MASK;
956 			icfg |= (XL_XCVR_100BFX << XL_ICFG_CONNECTOR_BITS);
957 			mediastat |= XL_MEDIASTAT_LINKBEAT;
958 			mediastat &= ~XL_MEDIASTAT_SQEENB;
959 		}
960 	}
961 
962 	if (sc->xl_media & (XL_MEDIAOPT_AUI|XL_MEDIAOPT_10FL)) {
963 		if (IFM_SUBTYPE(media) == IFM_10_5) {
964 			printf("AUI port, ");
965 			sc->xl_xcvr = XL_XCVR_AUI;
966 			icfg &= ~XL_ICFG_CONNECTOR_MASK;
967 			icfg |= (XL_XCVR_AUI << XL_ICFG_CONNECTOR_BITS);
968 			mediastat &= ~(XL_MEDIASTAT_LINKBEAT|
969 					XL_MEDIASTAT_JABGUARD);
970 			mediastat |= ~XL_MEDIASTAT_SQEENB;
971 		}
972 		if (IFM_SUBTYPE(media) == IFM_10_FL) {
973 			printf("10baseFL transceiver, ");
974 			sc->xl_xcvr = XL_XCVR_AUI;
975 			icfg &= ~XL_ICFG_CONNECTOR_MASK;
976 			icfg |= (XL_XCVR_AUI << XL_ICFG_CONNECTOR_BITS);
977 			mediastat &= ~(XL_MEDIASTAT_LINKBEAT|
978 					XL_MEDIASTAT_JABGUARD);
979 			mediastat |= ~XL_MEDIASTAT_SQEENB;
980 		}
981 	}
982 
983 	if (sc->xl_media & XL_MEDIAOPT_BNC) {
984 		if (IFM_SUBTYPE(media) == IFM_10_2) {
985 			printf("BNC port, ");
986 			sc->xl_xcvr = XL_XCVR_COAX;
987 			icfg &= ~XL_ICFG_CONNECTOR_MASK;
988 			icfg |= (XL_XCVR_COAX << XL_ICFG_CONNECTOR_BITS);
989 			mediastat &= ~(XL_MEDIASTAT_LINKBEAT|
990 					XL_MEDIASTAT_JABGUARD|
991 					XL_MEDIASTAT_SQEENB);
992 		}
993 	}
994 
995 	if ((media & IFM_GMASK) == IFM_FDX ||
996 			IFM_SUBTYPE(media) == IFM_100_FX) {
997 		printf("full duplex\n");
998 		XL_SEL_WIN(3);
999 		CSR_WRITE_1(sc, XL_W3_MAC_CTRL, XL_MACCTRL_DUPLEX);
1000 	} else {
1001 		printf("half duplex\n");
1002 		XL_SEL_WIN(3);
1003 		CSR_WRITE_1(sc, XL_W3_MAC_CTRL,
1004 			(CSR_READ_1(sc, XL_W3_MAC_CTRL) & ~XL_MACCTRL_DUPLEX));
1005 	}
1006 
1007 	if (IFM_SUBTYPE(media) == IFM_10_2)
1008 		CSR_WRITE_2(sc, XL_COMMAND, XL_CMD_COAX_START);
1009 	else
1010 		CSR_WRITE_2(sc, XL_COMMAND, XL_CMD_COAX_STOP);
1011 	CSR_WRITE_4(sc, XL_W3_INTERNAL_CFG, icfg);
1012 	XL_SEL_WIN(4);
1013 	CSR_WRITE_2(sc, XL_W4_MEDIA_STATUS, mediastat);
1014 	DELAY(800);
1015 	XL_SEL_WIN(7);
1016 }
1017 
1018 static void
1019 xl_reset(struct xl_softc *sc)
1020 {
1021 	int		i;
1022 
1023 	XL_SEL_WIN(0);
1024 	CSR_WRITE_2(sc, XL_COMMAND, XL_CMD_RESET |
1025 		    ((sc->xl_flags & XL_FLAG_WEIRDRESET) ?
1026 		     XL_RESETOPT_DISADVFD:0));
1027 
1028 	/*
1029 	 * If we're using memory mapped register mode, pause briefly
1030 	 * after issuing the reset command before trying to access any
1031 	 * other registers. With my 3c575C cardbus card, failing to do
1032 	 * this results in the system locking up while trying to poll
1033 	 * the command busy bit in the status register.
1034 	 */
1035 	if (sc->xl_flags & XL_FLAG_USE_MMIO)
1036 		DELAY(100000);
1037 
1038 	for (i = 0; i < XL_TIMEOUT; i++) {
1039 		DELAY(10);
1040 		if (!(CSR_READ_2(sc, XL_STATUS) & XL_STAT_CMDBUSY))
1041 			break;
1042 	}
1043 
1044 	if (i == XL_TIMEOUT)
1045 		if_printf(&sc->arpcom.ac_if, "reset didn't complete\n");
1046 
1047 	/* Reset TX and RX. */
1048 	/* Note: the RX reset takes an absurd amount of time
1049 	 * on newer versions of the Tornado chips such as those
1050 	 * on the 3c905CX and newer 3c908C cards. We wait an
1051 	 * extra amount of time so that xl_wait() doesn't complain
1052 	 * and annoy the users.
1053 	 */
1054 	CSR_WRITE_2(sc, XL_COMMAND, XL_CMD_RX_RESET);
1055 	DELAY(100000);
1056 	xl_wait(sc);
1057 	CSR_WRITE_2(sc, XL_COMMAND, XL_CMD_TX_RESET);
1058 	xl_wait(sc);
1059 
1060 	if (sc->xl_flags & XL_FLAG_INVERT_LED_PWR ||
1061 	    sc->xl_flags & XL_FLAG_INVERT_MII_PWR) {
1062 		XL_SEL_WIN(2);
1063 		CSR_WRITE_2(sc, XL_W2_RESET_OPTIONS, CSR_READ_2(sc,
1064 		    XL_W2_RESET_OPTIONS)
1065 		    | ((sc->xl_flags & XL_FLAG_INVERT_LED_PWR)?XL_RESETOPT_INVERT_LED:0)
1066 		    | ((sc->xl_flags & XL_FLAG_INVERT_MII_PWR)?XL_RESETOPT_INVERT_MII:0)
1067 		    );
1068 	}
1069 
1070 	/* Wait a little while for the chip to get its brains in order. */
1071 	DELAY(100000);
1072         return;
1073 }
1074 
1075 /*
1076  * Probe for a 3Com Etherlink XL chip. Check the PCI vendor and device
1077  * IDs against our list and return a device name if we find a match.
1078  */
1079 static int
1080 xl_probe(device_t dev)
1081 {
1082 	struct xl_type *t;
1083 	uint16_t vid, did;
1084 
1085 	vid = pci_get_vendor(dev);
1086 	did = pci_get_device(dev);
1087 	for (t = xl_devs; t->xl_name != NULL; t++) {
1088 		if (vid == t->xl_vid && did == t->xl_did) {
1089 			device_set_desc(dev, t->xl_name);
1090 			return(0);
1091 		}
1092 	}
1093 	return(ENXIO);
1094 }
1095 
1096 /*
1097  * This routine is a kludge to work around possible hardware faults
1098  * or manufacturing defects that can cause the media options register
1099  * (or reset options register, as it's called for the first generation
1100  * 3c90x adapters) to return an incorrect result. I have encountered
1101  * one Dell Latitude laptop docking station with an integrated 3c905-TX
1102  * which doesn't have any of the 'mediaopt' bits set. This screws up
1103  * the attach routine pretty badly because it doesn't know what media
1104  * to look for. If we find ourselves in this predicament, this routine
1105  * will try to guess the media options values and warn the user of a
1106  * possible manufacturing defect with his adapter/system/whatever.
1107  */
1108 static void
1109 xl_mediacheck(struct xl_softc *sc)
1110 {
1111 	struct ifnet *ifp = &sc->arpcom.ac_if;
1112 
1113 	/*
1114 	 * If some of the media options bits are set, assume they are
1115 	 * correct. If not, try to figure it out down below.
1116 	 * XXX I should check for 10baseFL, but I don't have an adapter
1117 	 * to test with.
1118 	 */
1119 	if (sc->xl_media & (XL_MEDIAOPT_MASK & ~XL_MEDIAOPT_VCO)) {
1120 		/*
1121 	 	 * Check the XCVR value. If it's not in the normal range
1122 	 	 * of values, we need to fake it up here.
1123 	 	 */
1124 		if (sc->xl_xcvr <= XL_XCVR_AUTO)
1125 			return;
1126 		else {
1127 			if_printf(ifp, "bogus xcvr value in EEPROM (%x)\n",
1128 			    sc->xl_xcvr);
1129 			if_printf(ifp,
1130 			    "choosing new default based on card type\n");
1131 		}
1132 	} else {
1133 		if (sc->xl_type == XL_TYPE_905B &&
1134 		    sc->xl_media & XL_MEDIAOPT_10FL)
1135 			return;
1136 		if_printf(ifp, "WARNING: no media options bits set in "
1137 			"the media options register!!\n");
1138 		if_printf(ifp, "this could be a manufacturing defect in "
1139 			"your adapter or system\n");
1140 		if_printf(ifp, "attempting to guess media type; you "
1141 			"should probably consult your vendor\n");
1142 	}
1143 
1144 	xl_choose_xcvr(sc, 1);
1145 }
1146 
1147 static void
1148 xl_choose_xcvr(struct xl_softc *sc, int verbose)
1149 {
1150 	struct ifnet *ifp = &sc->arpcom.ac_if;
1151 	u_int16_t		devid;
1152 
1153 	/*
1154 	 * Read the device ID from the EEPROM.
1155 	 * This is what's loaded into the PCI device ID register, so it has
1156 	 * to be correct otherwise we wouldn't have gotten this far.
1157 	 */
1158 	xl_read_eeprom(sc, (caddr_t)&devid, XL_EE_PRODID, 1, 0);
1159 
1160 	switch(devid) {
1161 	case TC_DEVICEID_BOOMERANG_10BT:	/* 3c900-TPO */
1162 	case TC_DEVICEID_KRAKATOA_10BT:		/* 3c900B-TPO */
1163 		sc->xl_media = XL_MEDIAOPT_BT;
1164 		sc->xl_xcvr = XL_XCVR_10BT;
1165 		if (verbose)
1166 			if_printf(ifp, "guessing 10BaseT transceiver\n");
1167 		break;
1168 	case TC_DEVICEID_BOOMERANG_10BT_COMBO:	/* 3c900-COMBO */
1169 	case TC_DEVICEID_KRAKATOA_10BT_COMBO:	/* 3c900B-COMBO */
1170 		sc->xl_media = XL_MEDIAOPT_BT|XL_MEDIAOPT_BNC|XL_MEDIAOPT_AUI;
1171 		sc->xl_xcvr = XL_XCVR_10BT;
1172 		if (verbose)
1173 			if_printf(ifp, "guessing COMBO (AUI/BNC/TP)\n");
1174 		break;
1175 	case TC_DEVICEID_KRAKATOA_10BT_TPC:	/* 3c900B-TPC */
1176 		sc->xl_media = XL_MEDIAOPT_BT|XL_MEDIAOPT_BNC;
1177 		sc->xl_xcvr = XL_XCVR_10BT;
1178 		if (verbose)
1179 			if_printf(ifp, "guessing TPC (BNC/TP)\n");
1180 		break;
1181 	case TC_DEVICEID_CYCLONE_10FL:		/* 3c900B-FL */
1182 		sc->xl_media = XL_MEDIAOPT_10FL;
1183 		sc->xl_xcvr = XL_XCVR_AUI;
1184 		if (verbose)
1185 			if_printf(ifp, "guessing 10baseFL\n");
1186 		break;
1187 	case TC_DEVICEID_BOOMERANG_10_100BT:	/* 3c905-TX */
1188 	case TC_DEVICEID_HURRICANE_555:		/* 3c555 */
1189 	case TC_DEVICEID_HURRICANE_556:		/* 3c556 */
1190 	case TC_DEVICEID_HURRICANE_556B:	/* 3c556B */
1191 	case TC_DEVICEID_HURRICANE_575A:	/* 3c575TX */
1192 	case TC_DEVICEID_HURRICANE_575B:	/* 3c575B */
1193 	case TC_DEVICEID_HURRICANE_575C:	/* 3c575C */
1194 	case TC_DEVICEID_HURRICANE_656:		/* 3c656 */
1195 	case TC_DEVICEID_HURRICANE_656B:	/* 3c656B */
1196 	case TC_DEVICEID_TORNADO_656C:		/* 3c656C */
1197 	case TC_DEVICEID_TORNADO_10_100BT_920B:	/* 3c920B-EMB */
1198 		sc->xl_media = XL_MEDIAOPT_MII;
1199 		sc->xl_xcvr = XL_XCVR_MII;
1200 		if (verbose)
1201 			if_printf(ifp, "guessing MII\n");
1202 		break;
1203 	case TC_DEVICEID_BOOMERANG_100BT4:	/* 3c905-T4 */
1204 	case TC_DEVICEID_CYCLONE_10_100BT4:	/* 3c905B-T4 */
1205 		sc->xl_media = XL_MEDIAOPT_BT4;
1206 		sc->xl_xcvr = XL_XCVR_MII;
1207 		if (verbose)
1208 			if_printf(ifp, "guessing 100BaseT4/MII\n");
1209 		break;
1210 	case TC_DEVICEID_HURRICANE_10_100BT:	/* 3c905B-TX */
1211 	case TC_DEVICEID_HURRICANE_10_100BT_SERV:/*3c980-TX */
1212 	case TC_DEVICEID_TORNADO_10_100BT_SERV:	/* 3c980C-TX */
1213 	case TC_DEVICEID_HURRICANE_SOHO100TX:	/* 3cSOHO100-TX */
1214 	case TC_DEVICEID_TORNADO_10_100BT:	/* 3c905C-TX */
1215 	case TC_DEVICEID_TORNADO_HOMECONNECT:	/* 3c450-TX */
1216 		sc->xl_media = XL_MEDIAOPT_BTX;
1217 		sc->xl_xcvr = XL_XCVR_AUTO;
1218 		if (verbose)
1219 			if_printf(ifp, "guessing 10/100 internal\n");
1220 		break;
1221 	case TC_DEVICEID_CYCLONE_10_100_COMBO:	/* 3c905B-COMBO */
1222 		sc->xl_media = XL_MEDIAOPT_BTX|XL_MEDIAOPT_BNC|XL_MEDIAOPT_AUI;
1223 		sc->xl_xcvr = XL_XCVR_AUTO;
1224 		if (verbose)
1225 			if_printf(ifp, "guessing 10/100 plus BNC/AUI\n");
1226 		break;
1227 	default:
1228 		if_printf(ifp,
1229 		    "unknown device ID: %x -- defaulting to 10baseT\n", devid);
1230 		sc->xl_media = XL_MEDIAOPT_BT;
1231 		break;
1232 	}
1233 
1234 	return;
1235 }
1236 
1237 /*
1238  * Attach the interface. Allocate softc structures, do ifmedia
1239  * setup and ethernet/BPF attach.
1240  */
1241 static int
1242 xl_attach(device_t dev)
1243 {
1244 	u_char			eaddr[ETHER_ADDR_LEN];
1245 	u_int16_t		xcvr[2];
1246 	struct xl_softc		*sc;
1247 	struct ifnet		*ifp;
1248 	int			media = IFM_ETHER|IFM_100_TX|IFM_FDX;
1249 	int			error = 0, rid, res;
1250 
1251 	sc = device_get_softc(dev);
1252 
1253 	ifmedia_init(&sc->ifmedia, 0, xl_ifmedia_upd, xl_ifmedia_sts);
1254 
1255 	sc->xl_flags = 0;
1256 	if (pci_get_device(dev) == TC_DEVICEID_HURRICANE_555)
1257 		sc->xl_flags |= XL_FLAG_EEPROM_OFFSET_30 | XL_FLAG_PHYOK;
1258 	if (pci_get_device(dev) == TC_DEVICEID_HURRICANE_556 ||
1259 	    pci_get_device(dev) == TC_DEVICEID_HURRICANE_556B)
1260 		sc->xl_flags |= XL_FLAG_FUNCREG | XL_FLAG_PHYOK |
1261 		    XL_FLAG_EEPROM_OFFSET_30 | XL_FLAG_WEIRDRESET |
1262 		    XL_FLAG_INVERT_LED_PWR | XL_FLAG_INVERT_MII_PWR;
1263 	if (pci_get_device(dev) == TC_DEVICEID_HURRICANE_555 ||
1264 	    pci_get_device(dev) == TC_DEVICEID_HURRICANE_556)
1265 		sc->xl_flags |= XL_FLAG_8BITROM;
1266 	if (pci_get_device(dev) == TC_DEVICEID_HURRICANE_556B)
1267 		sc->xl_flags |= XL_FLAG_NO_XCVR_PWR;
1268 	if (pci_get_device(dev) == TC_DEVICEID_HURRICANE_575B ||
1269 	    pci_get_device(dev) == TC_DEVICEID_HURRICANE_575C ||
1270 	    pci_get_device(dev) == TC_DEVICEID_HURRICANE_656B ||
1271 	    pci_get_device(dev) == TC_DEVICEID_TORNADO_656C)
1272 		sc->xl_flags |= XL_FLAG_FUNCREG;
1273 	if (pci_get_device(dev) == TC_DEVICEID_HURRICANE_575A ||
1274 	    pci_get_device(dev) == TC_DEVICEID_HURRICANE_575B ||
1275 	    pci_get_device(dev) == TC_DEVICEID_HURRICANE_575C ||
1276 	    pci_get_device(dev) == TC_DEVICEID_HURRICANE_656B ||
1277 	    pci_get_device(dev) == TC_DEVICEID_TORNADO_656C)
1278 		sc->xl_flags |= XL_FLAG_PHYOK | XL_FLAG_EEPROM_OFFSET_30 |
1279 		    XL_FLAG_8BITROM;
1280 	if (pci_get_device(dev) == TC_DEVICEID_HURRICANE_656)
1281 		sc->xl_flags |= XL_FLAG_FUNCREG | XL_FLAG_PHYOK;
1282 	if (pci_get_device(dev) == TC_DEVICEID_HURRICANE_575B)
1283 		sc->xl_flags |= XL_FLAG_INVERT_LED_PWR;
1284 	if (pci_get_device(dev) == TC_DEVICEID_HURRICANE_575C)
1285 		sc->xl_flags |= XL_FLAG_INVERT_MII_PWR;
1286 	if (pci_get_device(dev) == TC_DEVICEID_TORNADO_656C)
1287 		sc->xl_flags |= XL_FLAG_INVERT_MII_PWR;
1288 	if (pci_get_device(dev) == TC_DEVICEID_HURRICANE_656 ||
1289 	    pci_get_device(dev) == TC_DEVICEID_HURRICANE_656B)
1290 		sc->xl_flags |= XL_FLAG_INVERT_MII_PWR |
1291 		    XL_FLAG_INVERT_LED_PWR;
1292 	if (pci_get_device(dev) == TC_DEVICEID_TORNADO_10_100BT_920B)
1293 		sc->xl_flags |= XL_FLAG_PHYOK;
1294 #ifndef BURN_BRIDGES
1295 	/*
1296 	 * If this is a 3c905B, we have to check one extra thing.
1297 	 * The 905B supports power management and may be placed in
1298 	 * a low-power mode (D3 mode), typically by certain operating
1299 	 * systems which shall not be named. The PCI BIOS is supposed
1300 	 * to reset the NIC and bring it out of low-power mode, but
1301 	 * some do not. Consequently, we have to see if this chip
1302 	 * supports power management, and if so, make sure it's not
1303 	 * in low-power mode. If power management is available, the
1304 	 * capid byte will be 0x01.
1305 	 *
1306 	 * I _think_ that what actually happens is that the chip
1307 	 * loses its PCI configuration during the transition from
1308 	 * D3 back to D0; this means that it should be possible for
1309 	 * us to save the PCI iobase, membase and IRQ, put the chip
1310 	 * back in the D0 state, then restore the PCI config ourselves.
1311 	 */
1312 
1313 	if (pci_get_powerstate(dev) != PCI_POWERSTATE_D0) {
1314 		u_int32_t		iobase, membase, irq;
1315 
1316 		/* Save important PCI config data. */
1317 		iobase = pci_read_config(dev, XL_PCI_LOIO, 4);
1318 		membase = pci_read_config(dev, XL_PCI_LOMEM, 4);
1319 		irq = pci_read_config(dev, XL_PCI_INTLINE, 4);
1320 
1321 		/* Reset the power state. */
1322 		device_printf(dev, "chip is in D%d power mode "
1323 		    "-- setting to D0\n", pci_get_powerstate(dev));
1324 
1325 		pci_set_powerstate(dev, PCI_POWERSTATE_D0);
1326 
1327 		/* Restore PCI config data. */
1328 		pci_write_config(dev, XL_PCI_LOIO, iobase, 4);
1329 		pci_write_config(dev, XL_PCI_LOMEM, membase, 4);
1330 		pci_write_config(dev, XL_PCI_INTLINE, irq, 4);
1331 	}
1332 #endif
1333 	/*
1334 	 * Map control/status registers.
1335 	 */
1336 	pci_enable_busmaster(dev);
1337 
1338 	rid = XL_PCI_LOMEM;
1339 	res = SYS_RES_MEMORY;
1340 
1341 #if 0
1342 	sc->xl_res = bus_alloc_resource_any(dev, res, &rid, RF_ACTIVE);
1343 #endif
1344 
1345 	if (sc->xl_res != NULL) {
1346 		sc->xl_flags |= XL_FLAG_USE_MMIO;
1347 		if (bootverbose)
1348 			device_printf(dev, "using memory mapped I/O\n");
1349 	} else {
1350 		rid = XL_PCI_LOIO;
1351 		res = SYS_RES_IOPORT;
1352 		sc->xl_res = bus_alloc_resource_any(dev, res, &rid, RF_ACTIVE);
1353 		if (sc->xl_res == NULL) {
1354 			device_printf(dev, "couldn't map ports/memory\n");
1355 			error = ENXIO;
1356 			goto fail;
1357 		}
1358 		if (bootverbose)
1359 			device_printf(dev, "using port I/O\n");
1360 	}
1361 
1362 	sc->xl_btag = rman_get_bustag(sc->xl_res);
1363 	sc->xl_bhandle = rman_get_bushandle(sc->xl_res);
1364 
1365 	if (sc->xl_flags & XL_FLAG_FUNCREG) {
1366 		rid = XL_PCI_FUNCMEM;
1367 		sc->xl_fres = bus_alloc_resource_any(dev, SYS_RES_MEMORY, &rid,
1368 		    RF_ACTIVE);
1369 
1370 		if (sc->xl_fres == NULL) {
1371 			device_printf(dev, "couldn't map funcreg memory\n");
1372 			error = ENXIO;
1373 			goto fail;
1374 		}
1375 
1376 		sc->xl_ftag = rman_get_bustag(sc->xl_fres);
1377 		sc->xl_fhandle = rman_get_bushandle(sc->xl_fres);
1378 	}
1379 
1380 	/* Allocate interrupt */
1381 	rid = 0;
1382 	sc->xl_irq = bus_alloc_resource_any(dev, SYS_RES_IRQ, &rid,
1383 	    RF_SHAREABLE | RF_ACTIVE);
1384 	if (sc->xl_irq == NULL) {
1385 		device_printf(dev, "couldn't map interrupt\n");
1386 		error = ENXIO;
1387 		goto fail;
1388 	}
1389 
1390 	ifp = &sc->arpcom.ac_if;
1391 	if_initname(ifp, device_get_name(dev), device_get_unit(dev));
1392 
1393 	/* Reset the adapter. */
1394 	xl_reset(sc);
1395 
1396 	/*
1397 	 * Get station address from the EEPROM.
1398 	 */
1399 	if (xl_read_eeprom(sc, (caddr_t)&eaddr, XL_EE_OEM_ADR0, 3, 1)) {
1400 		device_printf(dev, "failed to read station address\n");
1401 		error = ENXIO;
1402 		goto fail;
1403 	}
1404 
1405 	callout_init(&sc->xl_stat_timer);
1406 
1407 	error = xl_dma_alloc(dev);
1408 	if (error)
1409 		goto fail;
1410 
1411 	/*
1412 	 * Figure out the card type. 3c905B adapters have the
1413 	 * 'supportsNoTxLength' bit set in the capabilities
1414 	 * word in the EEPROM.
1415 	 * Note: my 3c575C cardbus card lies. It returns a value
1416 	 * of 0x1578 for its capabilities word, which is somewhat
1417  	 * nonsensical. Another way to distinguish a 3c90x chip
1418 	 * from a 3c90xB/C chip is to check for the 'supportsLargePackets'
1419 	 * bit. This will only be set for 3c90x boomerage chips.
1420 	 */
1421 	xl_read_eeprom(sc, (caddr_t)&sc->xl_caps, XL_EE_CAPS, 1, 0);
1422 	if (sc->xl_caps & XL_CAPS_NO_TXLENGTH ||
1423 	    !(sc->xl_caps & XL_CAPS_LARGE_PKTS))
1424 		sc->xl_type = XL_TYPE_905B;
1425 	else
1426 		sc->xl_type = XL_TYPE_90X;
1427 	if (bootverbose) {
1428 		device_printf(dev, "type %s\n",
1429 			      sc->xl_type == XL_TYPE_905B ? "90XB" : "90X");
1430 	}
1431 
1432 	ifp->if_softc = sc;
1433 	ifp->if_mtu = ETHERMTU;
1434 	ifp->if_flags = IFF_BROADCAST | IFF_SIMPLEX | IFF_MULTICAST;
1435 	ifp->if_ioctl = xl_ioctl;
1436 	ifp->if_capabilities = 0;
1437 	if (sc->xl_type == XL_TYPE_905B) {
1438 		ifp->if_start = xl_start_90xB;
1439 		ifp->if_capabilities |= IFCAP_HWCSUM;
1440 	} else {
1441 		ifp->if_start = xl_start;
1442 	}
1443 	ifp->if_watchdog = xl_watchdog;
1444 	ifp->if_init = xl_init;
1445 #ifdef DEVICE_POLLING
1446 	ifp->if_poll = xl_poll;
1447 #endif
1448 	ifp->if_baudrate = 10000000;
1449 	ifq_set_maxlen(&ifp->if_snd, XL_TX_LIST_CNT - 1);
1450 	ifq_set_ready(&ifp->if_snd);
1451 	/*
1452 	 * NOTE: features disabled by default.  This seems to corrupt
1453 	 * tx packet data one out of a million packets or so and then
1454 	 * generates a good checksum so the receiver doesn't
1455 	 * know the packet is bad
1456 	 */
1457 	ifp->if_capenable = 0; /*ifp->if_capabilities;*/
1458 	if (ifp->if_capenable & IFCAP_TXCSUM)
1459 		ifp->if_hwassist = XL905B_CSUM_FEATURES;
1460 
1461 	/*
1462 	 * Now we have to see what sort of media we have.
1463 	 * This includes probing for an MII interace and a
1464 	 * possible PHY.
1465 	 */
1466 	XL_SEL_WIN(3);
1467 	sc->xl_media = CSR_READ_2(sc, XL_W3_MEDIA_OPT);
1468 	if (bootverbose)
1469 		if_printf(ifp, "media options word: %x\n", sc->xl_media);
1470 
1471 	xl_read_eeprom(sc, (char *)&xcvr, XL_EE_ICFG_0, 2, 0);
1472 	sc->xl_xcvr = xcvr[0] | xcvr[1] << 16;
1473 	sc->xl_xcvr &= XL_ICFG_CONNECTOR_MASK;
1474 	sc->xl_xcvr >>= XL_ICFG_CONNECTOR_BITS;
1475 
1476 	xl_mediacheck(sc);
1477 
1478 	if (sc->xl_media & XL_MEDIAOPT_MII || sc->xl_media & XL_MEDIAOPT_BTX
1479 			|| sc->xl_media & XL_MEDIAOPT_BT4) {
1480 		if (bootverbose)
1481 			if_printf(ifp, "found MII/AUTO\n");
1482 		xl_setcfg(sc);
1483 
1484 		error = mii_phy_probe(dev, &sc->xl_miibus,
1485 				      xl_ifmedia_upd, xl_ifmedia_sts);
1486 		if (error) {
1487 			if_printf(ifp, "no PHY found!\n");
1488 			goto fail;
1489 		}
1490 
1491 		goto done;
1492 	}
1493 
1494 	/*
1495 	 * Sanity check. If the user has selected "auto" and this isn't
1496 	 * a 10/100 card of some kind, we need to force the transceiver
1497 	 * type to something sane.
1498 	 */
1499 	if (sc->xl_xcvr == XL_XCVR_AUTO)
1500 		xl_choose_xcvr(sc, bootverbose);
1501 
1502 	/*
1503 	 * Do ifmedia setup.
1504 	 */
1505 	if (sc->xl_media & XL_MEDIAOPT_BT) {
1506 		if (bootverbose)
1507 			if_printf(ifp, "found 10baseT\n");
1508 		ifmedia_add(&sc->ifmedia, IFM_ETHER|IFM_10_T, 0, NULL);
1509 		ifmedia_add(&sc->ifmedia, IFM_ETHER|IFM_10_T|IFM_HDX, 0, NULL);
1510 		if (sc->xl_caps & XL_CAPS_FULL_DUPLEX)
1511 			ifmedia_add(&sc->ifmedia,
1512 			    IFM_ETHER|IFM_10_T|IFM_FDX, 0, NULL);
1513 	}
1514 
1515 	if (sc->xl_media & (XL_MEDIAOPT_AUI|XL_MEDIAOPT_10FL)) {
1516 		/*
1517 		 * Check for a 10baseFL board in disguise.
1518 		 */
1519 		if (sc->xl_type == XL_TYPE_905B &&
1520 		    sc->xl_media == XL_MEDIAOPT_10FL) {
1521 			if (bootverbose)
1522 				if_printf(ifp, "found 10baseFL\n");
1523 			ifmedia_add(&sc->ifmedia, IFM_ETHER|IFM_10_FL, 0, NULL);
1524 			ifmedia_add(&sc->ifmedia, IFM_ETHER|IFM_10_FL|IFM_HDX,
1525 			    0, NULL);
1526 			if (sc->xl_caps & XL_CAPS_FULL_DUPLEX)
1527 				ifmedia_add(&sc->ifmedia,
1528 				    IFM_ETHER|IFM_10_FL|IFM_FDX, 0, NULL);
1529 		} else {
1530 			if (bootverbose)
1531 				if_printf(ifp, "found AUI\n");
1532 			ifmedia_add(&sc->ifmedia, IFM_ETHER|IFM_10_5, 0, NULL);
1533 		}
1534 	}
1535 
1536 	if (sc->xl_media & XL_MEDIAOPT_BNC) {
1537 		if (bootverbose)
1538 			if_printf(ifp, "found BNC\n");
1539 		ifmedia_add(&sc->ifmedia, IFM_ETHER|IFM_10_2, 0, NULL);
1540 	}
1541 
1542 	if (sc->xl_media & XL_MEDIAOPT_BFX) {
1543 		if (bootverbose)
1544 			if_printf(ifp, "found 100baseFX\n");
1545 		ifp->if_baudrate = 100000000;
1546 		ifmedia_add(&sc->ifmedia, IFM_ETHER|IFM_100_FX, 0, NULL);
1547 	}
1548 
1549 	/* Choose a default media. */
1550 	switch(sc->xl_xcvr) {
1551 	case XL_XCVR_10BT:
1552 		media = IFM_ETHER|IFM_10_T;
1553 		xl_setmode(sc, media);
1554 		break;
1555 	case XL_XCVR_AUI:
1556 		if (sc->xl_type == XL_TYPE_905B &&
1557 		    sc->xl_media == XL_MEDIAOPT_10FL) {
1558 			media = IFM_ETHER|IFM_10_FL;
1559 			xl_setmode(sc, media);
1560 		} else {
1561 			media = IFM_ETHER|IFM_10_5;
1562 			xl_setmode(sc, media);
1563 		}
1564 		break;
1565 	case XL_XCVR_COAX:
1566 		media = IFM_ETHER|IFM_10_2;
1567 		xl_setmode(sc, media);
1568 		break;
1569 	case XL_XCVR_AUTO:
1570 	case XL_XCVR_100BTX:
1571 	case XL_XCVR_MII:
1572 		/* Chosen by miibus */
1573 		break;
1574 	case XL_XCVR_100BFX:
1575 		media = IFM_ETHER|IFM_100_FX;
1576 		break;
1577 	default:
1578 		if_printf(ifp, "unknown XCVR type: %d\n", sc->xl_xcvr);
1579 		/*
1580 		 * This will probably be wrong, but it prevents
1581 	 	 * the ifmedia code from panicking.
1582 		 */
1583 		media = IFM_ETHER|IFM_10_T;
1584 		break;
1585 	}
1586 
1587 	if (sc->xl_miibus == NULL)
1588 		ifmedia_set(&sc->ifmedia, media);
1589 
1590 done:
1591 
1592 	if (sc->xl_flags & XL_FLAG_NO_XCVR_PWR) {
1593 		XL_SEL_WIN(0);
1594 		CSR_WRITE_2(sc, XL_W0_MFG_ID, XL_NO_XCVR_PWR_MAGICBITS);
1595 	}
1596 
1597 	/*
1598 	 * Call MI attach routine.
1599 	 */
1600 	ether_ifattach(ifp, eaddr);
1601 
1602         /*
1603          * Tell the upper layer(s) we support long frames.
1604          */
1605         ifp->if_data.ifi_hdrlen = sizeof(struct ether_vlan_header);
1606 
1607 	/* Hook interrupt last to avoid having to lock softc */
1608 	error = bus_setup_intr(dev, sc->xl_irq, 0,
1609 			       xl_intr, sc, &sc->xl_intrhand, NULL);
1610 	if (error) {
1611 		if_printf(ifp, "couldn't set up irq\n");
1612 		ether_ifdetach(ifp);
1613 		goto fail;
1614 	}
1615 
1616 	return 0;
1617 
1618 fail:
1619 	xl_detach(dev);
1620 	return error;
1621 }
1622 
1623 /*
1624  * Shutdown hardware and free up resources. This can be called any
1625  * time after the mutex has been initialized. It is called in both
1626  * the error case in attach and the normal detach case so it needs
1627  * to be careful about only freeing resources that have actually been
1628  * allocated.
1629  */
1630 static int
1631 xl_detach(device_t dev)
1632 {
1633 	struct xl_softc		*sc;
1634 	struct ifnet		*ifp;
1635 	int			rid, res;
1636 
1637 	sc = device_get_softc(dev);
1638 	ifp = &sc->arpcom.ac_if;
1639 
1640 	if (sc->xl_flags & XL_FLAG_USE_MMIO) {
1641 		rid = XL_PCI_LOMEM;
1642 		res = SYS_RES_MEMORY;
1643 	} else {
1644 		rid = XL_PCI_LOIO;
1645 		res = SYS_RES_IOPORT;
1646 	}
1647 
1648 	crit_enter();
1649 
1650 	if (device_is_attached(dev)) {
1651 		xl_reset(sc);
1652 		xl_stop(sc);
1653 		ether_ifdetach(ifp);
1654 	}
1655 
1656 	if (sc->xl_miibus)
1657 		device_delete_child(dev, sc->xl_miibus);
1658 	bus_generic_detach(dev);
1659 	ifmedia_removeall(&sc->ifmedia);
1660 
1661 	if (sc->xl_intrhand)
1662 		bus_teardown_intr(dev, sc->xl_irq, sc->xl_intrhand);
1663 
1664 	crit_exit();
1665 
1666 	if (sc->xl_irq)
1667 		bus_release_resource(dev, SYS_RES_IRQ, 0, sc->xl_irq);
1668 	if (sc->xl_fres != NULL)
1669 		bus_release_resource(dev, SYS_RES_MEMORY,
1670 		    XL_PCI_FUNCMEM, sc->xl_fres);
1671 	if (sc->xl_res)
1672 		bus_release_resource(dev, res, rid, sc->xl_res);
1673 
1674 	xl_dma_free(dev);
1675 
1676 	return(0);
1677 }
1678 
1679 static int
1680 xl_dma_alloc(device_t dev)
1681 {
1682 	struct xl_softc *sc;
1683 	struct xl_chain_data *cd;
1684 	struct xl_list_data *ld;
1685 	int i, error;
1686 
1687 	sc = device_get_softc(dev);
1688 	cd = &sc->xl_cdata;
1689 	ld = &sc->xl_ldata;
1690 
1691 	/*
1692 	 * Now allocate a tag for the DMA descriptor lists and a chunk
1693 	 * of DMA-able memory based on the tag.  Also obtain the DMA
1694 	 * addresses of the RX and TX ring, which we'll need later.
1695 	 * All of our lists are allocated as a contiguous block
1696 	 * of memory.
1697 	 */
1698 	error = bus_dma_tag_create(NULL, 8, 0,
1699 				   BUS_SPACE_MAXADDR_32BIT, BUS_SPACE_MAXADDR,
1700 				   NULL, NULL,
1701 				   XL_RX_LIST_SZ, 1, XL_RX_LIST_SZ,
1702 				   0, &ld->xl_rx_tag);
1703 	if (error) {
1704 		device_printf(dev, "failed to allocate rx dma tag\n");
1705 		return error;
1706 	}
1707 
1708 	error = bus_dmamem_alloc(ld->xl_rx_tag, (void **)&ld->xl_rx_list,
1709 				 BUS_DMA_WAITOK | BUS_DMA_ZERO,
1710 				 &ld->xl_rx_dmamap);
1711 	if (error) {
1712 		device_printf(dev, "no memory for rx list buffers!\n");
1713 		bus_dma_tag_destroy(ld->xl_rx_tag);
1714 		ld->xl_rx_tag = NULL;
1715 		return error;
1716 	}
1717 
1718 	error = bus_dmamap_load(ld->xl_rx_tag, ld->xl_rx_dmamap,
1719 				ld->xl_rx_list, XL_RX_LIST_SZ,
1720 				xl_dma_map_addr, &ld->xl_rx_dmaaddr,
1721 				BUS_DMA_WAITOK);
1722 	if (error) {
1723 		device_printf(dev, "cannot get dma address of the rx ring!\n");
1724 		bus_dmamem_free(ld->xl_rx_tag, ld->xl_rx_list,
1725 				ld->xl_rx_dmamap);
1726 		bus_dma_tag_destroy(ld->xl_rx_tag);
1727 		ld->xl_rx_tag = NULL;
1728 		return error;
1729 	}
1730 
1731 	error = bus_dma_tag_create(NULL, 8, 0,
1732 				   BUS_SPACE_MAXADDR_32BIT, BUS_SPACE_MAXADDR,
1733 				   NULL, NULL,
1734 				   XL_TX_LIST_SZ, 1, XL_TX_LIST_SZ,
1735 				   0, &ld->xl_tx_tag);
1736 	if (error) {
1737 		device_printf(dev, "failed to allocate tx dma tag\n");
1738 		return error;
1739 	}
1740 
1741 	error = bus_dmamem_alloc(ld->xl_tx_tag, (void **)&ld->xl_tx_list,
1742 				 BUS_DMA_WAITOK | BUS_DMA_ZERO,
1743 				 &ld->xl_tx_dmamap);
1744 	if (error) {
1745 		device_printf(dev, "no memory for list buffers!\n");
1746 		bus_dma_tag_destroy(ld->xl_tx_tag);
1747 		ld->xl_tx_tag = NULL;
1748 		return error;
1749 	}
1750 
1751 	error = bus_dmamap_load(ld->xl_tx_tag, ld->xl_tx_dmamap,
1752 				ld->xl_tx_list, XL_TX_LIST_SZ,
1753 				xl_dma_map_addr, &ld->xl_tx_dmaaddr,
1754 				BUS_DMA_WAITOK);
1755 	if (error) {
1756 		device_printf(dev, "cannot get dma address of the tx ring!\n");
1757 		bus_dmamem_free(ld->xl_tx_tag, ld->xl_tx_list,
1758 				ld->xl_tx_dmamap);
1759 		bus_dma_tag_destroy(ld->xl_tx_tag);
1760 		ld->xl_tx_tag = NULL;
1761 		return error;
1762 	}
1763 
1764 	/*
1765 	 * Allocate a DMA tag for the mapping of mbufs.
1766 	 */
1767 	error = bus_dma_tag_create(NULL, 1, 0,
1768 				   BUS_SPACE_MAXADDR_32BIT, BUS_SPACE_MAXADDR,
1769 				   NULL, NULL,
1770 				   MCLBYTES * XL_MAXFRAGS, XL_MAXFRAGS,
1771 				   MCLBYTES, 0, &sc->xl_mtag);
1772 	if (error) {
1773 		device_printf(dev, "failed to allocate mbuf dma tag\n");
1774 		return error;
1775 	}
1776 
1777 	/*
1778 	 * Allocate a spare DMA map for the RX ring.
1779 	 */
1780 	error = bus_dmamap_create(sc->xl_mtag, 0, &sc->xl_tmpmap);
1781 	if (error) {
1782 		device_printf(dev, "failed to create mbuf dma map\n");
1783 		bus_dma_tag_destroy(sc->xl_mtag);
1784 		sc->xl_mtag = NULL;
1785 		return error;
1786 	}
1787 
1788 	for (i = 0; i < XL_RX_LIST_CNT; i++) {
1789 		error = bus_dmamap_create(sc->xl_mtag, 0,
1790 					  &cd->xl_rx_chain[i].xl_map);
1791 		if (error) {
1792 			device_printf(dev, "failed to create %dth "
1793 				      "rx descriptor dma map!\n", i);
1794 			return error;
1795 		}
1796 		cd->xl_rx_chain[i].xl_ptr = &ld->xl_rx_list[i];
1797 	}
1798 
1799 	for (i = 0; i < XL_TX_LIST_CNT; i++) {
1800 		error = bus_dmamap_create(sc->xl_mtag, 0,
1801 					  &cd->xl_tx_chain[i].xl_map);
1802 		if (error) {
1803 			device_printf(dev, "failed to create %dth "
1804 				      "tx descriptor dma map!\n", i);
1805 			return error;
1806 		}
1807 		cd->xl_tx_chain[i].xl_ptr = &ld->xl_tx_list[i];
1808 	}
1809 	return 0;
1810 }
1811 
1812 static void
1813 xl_dma_free(device_t dev)
1814 {
1815 	struct xl_softc *sc;
1816 	struct xl_chain_data *cd;
1817 	struct xl_list_data *ld;
1818 	int i;
1819 
1820 	sc = device_get_softc(dev);
1821 	cd = &sc->xl_cdata;
1822 	ld = &sc->xl_ldata;
1823 
1824 	for (i = 0; i < XL_RX_LIST_CNT; ++i) {
1825 		if (cd->xl_rx_chain[i].xl_ptr != NULL) {
1826 			if (cd->xl_rx_chain[i].xl_mbuf != NULL) {
1827 				bus_dmamap_unload(sc->xl_mtag,
1828 						  cd->xl_rx_chain[i].xl_map);
1829 				m_free(cd->xl_rx_chain[i].xl_mbuf);
1830 			}
1831 			bus_dmamap_destroy(sc->xl_mtag,
1832 					   cd->xl_rx_chain[i].xl_map);
1833 		}
1834 	}
1835 
1836 	for (i = 0; i < XL_TX_LIST_CNT; ++i) {
1837 		if (cd->xl_tx_chain[i].xl_ptr != NULL) {
1838 			if (cd->xl_tx_chain[i].xl_mbuf != NULL) {
1839 				bus_dmamap_unload(sc->xl_mtag,
1840 						  cd->xl_tx_chain[i].xl_map);
1841 				m_free(cd->xl_tx_chain[i].xl_mbuf);
1842 			}
1843 			bus_dmamap_destroy(sc->xl_mtag,
1844 					   cd->xl_tx_chain[i].xl_map);
1845 		}
1846 	}
1847 
1848 	if (ld->xl_rx_tag) {
1849 		bus_dmamap_unload(ld->xl_rx_tag, ld->xl_rx_dmamap);
1850 		bus_dmamem_free(ld->xl_rx_tag, ld->xl_rx_list,
1851 				ld->xl_rx_dmamap);
1852 		bus_dma_tag_destroy(ld->xl_rx_tag);
1853 	}
1854 
1855 	if (ld->xl_tx_tag) {
1856 		bus_dmamap_unload(ld->xl_tx_tag, ld->xl_tx_dmamap);
1857 		bus_dmamem_free(ld->xl_tx_tag, ld->xl_tx_list,
1858 				ld->xl_tx_dmamap);
1859 		bus_dma_tag_destroy(ld->xl_tx_tag);
1860 	}
1861 
1862 	if (sc->xl_mtag) {
1863 		bus_dmamap_destroy(sc->xl_mtag, sc->xl_tmpmap);
1864 		bus_dma_tag_destroy(sc->xl_mtag);
1865 	}
1866 }
1867 
1868 /*
1869  * Initialize the transmit descriptors.
1870  */
1871 static void
1872 xl_list_tx_init(struct xl_softc *sc)
1873 {
1874 	struct xl_chain_data	*cd;
1875 	struct xl_list_data	*ld;
1876 	int			i;
1877 
1878 	cd = &sc->xl_cdata;
1879 	ld = &sc->xl_ldata;
1880 	for (i = 0; i < XL_TX_LIST_CNT; i++) {
1881 		cd->xl_tx_chain[i].xl_phys = ld->xl_tx_dmaaddr +
1882 		    i * sizeof(struct xl_list);
1883 		if (i == (XL_TX_LIST_CNT - 1))
1884 			cd->xl_tx_chain[i].xl_next = NULL;
1885 		else
1886 			cd->xl_tx_chain[i].xl_next = &cd->xl_tx_chain[i + 1];
1887 	}
1888 
1889 	cd->xl_tx_free = &cd->xl_tx_chain[0];
1890 	cd->xl_tx_tail = cd->xl_tx_head = NULL;
1891 
1892 	bus_dmamap_sync(ld->xl_tx_tag, ld->xl_tx_dmamap, BUS_DMASYNC_PREWRITE);
1893 }
1894 
1895 /*
1896  * Initialize the transmit descriptors.
1897  */
1898 static void
1899 xl_list_tx_init_90xB(struct xl_softc *sc)
1900 {
1901 	struct xl_chain_data	*cd;
1902 	struct xl_list_data	*ld;
1903 	int			i;
1904 
1905 	cd = &sc->xl_cdata;
1906 	ld = &sc->xl_ldata;
1907 	for (i = 0; i < XL_TX_LIST_CNT; i++) {
1908 		cd->xl_tx_chain[i].xl_phys = ld->xl_tx_dmaaddr +
1909 		    i * sizeof(struct xl_list);
1910 		if (i == (XL_TX_LIST_CNT - 1))
1911 			cd->xl_tx_chain[i].xl_next = &cd->xl_tx_chain[0];
1912 		else
1913 			cd->xl_tx_chain[i].xl_next = &cd->xl_tx_chain[i + 1];
1914 		if (i == 0) {
1915 			cd->xl_tx_chain[i].xl_prev =
1916 			    &cd->xl_tx_chain[XL_TX_LIST_CNT - 1];
1917 		} else {
1918 			cd->xl_tx_chain[i].xl_prev =
1919 			    &cd->xl_tx_chain[i - 1];
1920 		}
1921 	}
1922 
1923 	ld->xl_tx_list[0].xl_status = htole32(XL_TXSTAT_EMPTY);
1924 
1925 	cd->xl_tx_prod = 1;
1926 	cd->xl_tx_cons = 1;
1927 	cd->xl_tx_cnt = 0;
1928 
1929 	bus_dmamap_sync(ld->xl_tx_tag, ld->xl_tx_dmamap, BUS_DMASYNC_PREWRITE);
1930 }
1931 
1932 /*
1933  * Initialize the RX descriptors and allocate mbufs for them. Note that
1934  * we arrange the descriptors in a closed ring, so that the last descriptor
1935  * points back to the first.
1936  */
1937 static int
1938 xl_list_rx_init(struct xl_softc *sc)
1939 {
1940 	struct xl_chain_data	*cd;
1941 	struct xl_list_data	*ld;
1942 	int			error, i, next;
1943 	u_int32_t		nextptr;
1944 
1945 	cd = &sc->xl_cdata;
1946 	ld = &sc->xl_ldata;
1947 
1948 	for (i = 0; i < XL_RX_LIST_CNT; i++) {
1949 		error = xl_newbuf(sc, &cd->xl_rx_chain[i]);
1950 		if (error)
1951 			return(error);
1952 		if (i == (XL_RX_LIST_CNT - 1))
1953 			next = 0;
1954 		else
1955 			next = i + 1;
1956 		nextptr = ld->xl_rx_dmaaddr +
1957 		    next * sizeof(struct xl_list_onefrag);
1958 		cd->xl_rx_chain[i].xl_next = &cd->xl_rx_chain[next];
1959 		ld->xl_rx_list[i].xl_next = htole32(nextptr);
1960 	}
1961 
1962 	bus_dmamap_sync(ld->xl_rx_tag, ld->xl_rx_dmamap, BUS_DMASYNC_PREWRITE);
1963 	cd->xl_rx_head = &cd->xl_rx_chain[0];
1964 
1965 	return(0);
1966 }
1967 
1968 /*
1969  * Initialize an RX descriptor and attach an MBUF cluster.
1970  * If we fail to do so, we need to leave the old mbuf and
1971  * the old DMA map untouched so that it can be reused.
1972  */
1973 static int
1974 xl_newbuf(struct xl_softc *sc, struct xl_chain_onefrag *c)
1975 {
1976 	struct mbuf		*m_new;
1977 	bus_dmamap_t		map;
1978 	int			error;
1979 	u_int32_t		baddr;
1980 
1981 	m_new = m_getcl(MB_DONTWAIT, MT_DATA, M_PKTHDR);
1982 	if (m_new == NULL)
1983 		return(ENOBUFS);
1984 
1985 	m_new->m_len = m_new->m_pkthdr.len = MCLBYTES;
1986 
1987 	/* Force longword alignment for packet payload. */
1988 	m_adj(m_new, ETHER_ALIGN);
1989 
1990 	error = bus_dmamap_load_mbuf(sc->xl_mtag, sc->xl_tmpmap, m_new,
1991 	    xl_dma_map_rxbuf, &baddr, BUS_DMA_NOWAIT);
1992 	if (error) {
1993 		m_freem(m_new);
1994 		if_printf(&sc->arpcom.ac_if, "can't map mbuf (error %d)\n",
1995 		    error);
1996 		return(error);
1997 	}
1998 
1999 	bus_dmamap_unload(sc->xl_mtag, c->xl_map);
2000 	map = c->xl_map;
2001 	c->xl_map = sc->xl_tmpmap;
2002 	sc->xl_tmpmap = map;
2003 	c->xl_mbuf = m_new;
2004 	c->xl_ptr->xl_frag.xl_len = htole32(m_new->m_len | XL_LAST_FRAG);
2005 	c->xl_ptr->xl_status = 0;
2006 	c->xl_ptr->xl_frag.xl_addr = htole32(baddr);
2007 	bus_dmamap_sync(sc->xl_mtag, c->xl_map, BUS_DMASYNC_PREREAD);
2008 	return(0);
2009 }
2010 
2011 static int
2012 xl_rx_resync(struct xl_softc *sc)
2013 {
2014 	struct xl_chain_onefrag	*pos;
2015 	int			i;
2016 
2017 	pos = sc->xl_cdata.xl_rx_head;
2018 
2019 	for (i = 0; i < XL_RX_LIST_CNT; i++) {
2020 		if (pos->xl_ptr->xl_status)
2021 			break;
2022 		pos = pos->xl_next;
2023 	}
2024 
2025 	if (i == XL_RX_LIST_CNT)
2026 		return(0);
2027 
2028 	sc->xl_cdata.xl_rx_head = pos;
2029 
2030 	return(EAGAIN);
2031 }
2032 
2033 /*
2034  * A frame has been uploaded: pass the resulting mbuf chain up to
2035  * the higher level protocols.
2036  */
2037 static void
2038 xl_rxeof(struct xl_softc *sc, int count)
2039 {
2040         struct mbuf		*m;
2041         struct ifnet		*ifp;
2042 	struct xl_chain_onefrag	*cur_rx;
2043 	int			total_len = 0;
2044 	u_int32_t		rxstat;
2045 
2046 	ifp = &sc->arpcom.ac_if;
2047 
2048 again:
2049 
2050 	bus_dmamap_sync(sc->xl_ldata.xl_rx_tag, sc->xl_ldata.xl_rx_dmamap,
2051 	    BUS_DMASYNC_POSTREAD);
2052 	while((rxstat = le32toh(sc->xl_cdata.xl_rx_head->xl_ptr->xl_status))) {
2053 #ifdef DEVICE_POLLING
2054 		if (count >= 0 && count-- == 0)
2055 			break;
2056 #endif
2057 		cur_rx = sc->xl_cdata.xl_rx_head;
2058 		sc->xl_cdata.xl_rx_head = cur_rx->xl_next;
2059 		total_len = rxstat & XL_RXSTAT_LENMASK;
2060 
2061 		/*
2062 		 * Since we have told the chip to allow large frames,
2063 		 * we need to trap giant frame errors in software. We allow
2064 		 * a little more than the normal frame size to account for
2065 		 * frames with VLAN tags.
2066 		 */
2067 		if (total_len > XL_MAX_FRAMELEN)
2068 			rxstat |= (XL_RXSTAT_UP_ERROR|XL_RXSTAT_OVERSIZE);
2069 
2070 		/*
2071 		 * If an error occurs, update stats, clear the
2072 		 * status word and leave the mbuf cluster in place:
2073 		 * it should simply get re-used next time this descriptor
2074 	 	 * comes up in the ring.
2075 		 */
2076 		if (rxstat & XL_RXSTAT_UP_ERROR) {
2077 			ifp->if_ierrors++;
2078 			cur_rx->xl_ptr->xl_status = 0;
2079 			bus_dmamap_sync(sc->xl_ldata.xl_rx_tag,
2080 			    sc->xl_ldata.xl_rx_dmamap, BUS_DMASYNC_PREWRITE);
2081 			continue;
2082 		}
2083 
2084 		/*
2085 		 * If the error bit was not set, the upload complete
2086 		 * bit should be set which means we have a valid packet.
2087 		 * If not, something truly strange has happened.
2088 		 */
2089 		if (!(rxstat & XL_RXSTAT_UP_CMPLT)) {
2090 			if_printf(ifp,
2091 				  "bad receive status -- packet dropped\n");
2092 			ifp->if_ierrors++;
2093 			cur_rx->xl_ptr->xl_status = 0;
2094 			bus_dmamap_sync(sc->xl_ldata.xl_rx_tag,
2095 			    sc->xl_ldata.xl_rx_dmamap, BUS_DMASYNC_PREWRITE);
2096 			continue;
2097 		}
2098 
2099 		/* No errors; receive the packet. */
2100 		bus_dmamap_sync(sc->xl_mtag, cur_rx->xl_map,
2101 		    BUS_DMASYNC_POSTREAD);
2102 		m = cur_rx->xl_mbuf;
2103 
2104 		/*
2105 		 * Try to conjure up a new mbuf cluster. If that
2106 		 * fails, it means we have an out of memory condition and
2107 		 * should leave the buffer in place and continue. This will
2108 		 * result in a lost packet, but there's little else we
2109 		 * can do in this situation.
2110 		 */
2111 		if (xl_newbuf(sc, cur_rx)) {
2112 			ifp->if_ierrors++;
2113 			cur_rx->xl_ptr->xl_status = 0;
2114 			bus_dmamap_sync(sc->xl_ldata.xl_rx_tag,
2115 			    sc->xl_ldata.xl_rx_dmamap, BUS_DMASYNC_PREWRITE);
2116 			continue;
2117 		}
2118 		bus_dmamap_sync(sc->xl_ldata.xl_rx_tag,
2119 		    sc->xl_ldata.xl_rx_dmamap, BUS_DMASYNC_PREWRITE);
2120 
2121 		ifp->if_ipackets++;
2122 		m->m_pkthdr.rcvif = ifp;
2123 		m->m_pkthdr.len = m->m_len = total_len;
2124 
2125 		if (ifp->if_capenable & IFCAP_RXCSUM) {
2126 			/* Do IP checksum checking. */
2127 			if (rxstat & XL_RXSTAT_IPCKOK)
2128 				m->m_pkthdr.csum_flags |= CSUM_IP_CHECKED;
2129 			if (!(rxstat & XL_RXSTAT_IPCKERR))
2130 				m->m_pkthdr.csum_flags |= CSUM_IP_VALID;
2131 			if ((rxstat & XL_RXSTAT_TCPCOK &&
2132 			     !(rxstat & XL_RXSTAT_TCPCKERR)) ||
2133 			    (rxstat & XL_RXSTAT_UDPCKOK &&
2134 			     !(rxstat & XL_RXSTAT_UDPCKERR))) {
2135 				m->m_pkthdr.csum_flags |=
2136 					CSUM_DATA_VALID|CSUM_PSEUDO_HDR;
2137 				m->m_pkthdr.csum_data = 0xffff;
2138 			}
2139 		}
2140 
2141 		(*ifp->if_input)(ifp, m);
2142 	}
2143 
2144 	if (sc->xl_type != XL_TYPE_905B) {
2145 		/*
2146 		 * Handle the 'end of channel' condition. When the upload
2147 		 * engine hits the end of the RX ring, it will stall. This
2148 		 * is our cue to flush the RX ring, reload the uplist pointer
2149 		 * register and unstall the engine.
2150 		 * XXX This is actually a little goofy. With the ThunderLAN
2151 		 * chip, you get an interrupt when the receiver hits the end
2152 		 * of the receive ring, which tells you exactly when you
2153 		 * you need to reload the ring pointer. Here we have to
2154 		 * fake it. I'm mad at myself for not being clever enough
2155 		 * to avoid the use of a goto here.
2156 		 */
2157 		if (CSR_READ_4(sc, XL_UPLIST_PTR) == 0 ||
2158 		    CSR_READ_4(sc, XL_UPLIST_STATUS) & XL_PKTSTAT_UP_STALLED) {
2159 			CSR_WRITE_2(sc, XL_COMMAND, XL_CMD_UP_STALL);
2160 			xl_wait(sc);
2161 			CSR_WRITE_4(sc, XL_UPLIST_PTR,
2162 				    sc->xl_ldata.xl_rx_dmaaddr);
2163 			sc->xl_cdata.xl_rx_head = &sc->xl_cdata.xl_rx_chain[0];
2164 			CSR_WRITE_2(sc, XL_COMMAND, XL_CMD_UP_UNSTALL);
2165 			goto again;
2166 		}
2167 	}
2168 }
2169 
2170 /*
2171  * A frame was downloaded to the chip. It's safe for us to clean up
2172  * the list buffers.
2173  */
2174 static void
2175 xl_txeof(struct xl_softc *sc)
2176 {
2177 	struct xl_chain		*cur_tx;
2178 	struct ifnet		*ifp;
2179 
2180 	ifp = &sc->arpcom.ac_if;
2181 
2182 	/* Clear the timeout timer. */
2183 	ifp->if_timer = 0;
2184 
2185 	/*
2186 	 * Go through our tx list and free mbufs for those
2187 	 * frames that have been uploaded. Note: the 3c905B
2188 	 * sets a special bit in the status word to let us
2189 	 * know that a frame has been downloaded, but the
2190 	 * original 3c900/3c905 adapters don't do that.
2191 	 * Consequently, we have to use a different test if
2192 	 * xl_type != XL_TYPE_905B.
2193 	 */
2194 	while(sc->xl_cdata.xl_tx_head != NULL) {
2195 		cur_tx = sc->xl_cdata.xl_tx_head;
2196 
2197 		if (CSR_READ_4(sc, XL_DOWNLIST_PTR))
2198 			break;
2199 
2200 		sc->xl_cdata.xl_tx_head = cur_tx->xl_next;
2201 		bus_dmamap_sync(sc->xl_mtag, cur_tx->xl_map,
2202 		    BUS_DMASYNC_POSTWRITE);
2203 		bus_dmamap_unload(sc->xl_mtag, cur_tx->xl_map);
2204 		m_freem(cur_tx->xl_mbuf);
2205 		cur_tx->xl_mbuf = NULL;
2206 		ifp->if_opackets++;
2207 
2208 		cur_tx->xl_next = sc->xl_cdata.xl_tx_free;
2209 		sc->xl_cdata.xl_tx_free = cur_tx;
2210 	}
2211 
2212 	if (sc->xl_cdata.xl_tx_head == NULL) {
2213 		ifp->if_flags &= ~IFF_OACTIVE;
2214 		sc->xl_cdata.xl_tx_tail = NULL;
2215 	} else {
2216 		if (CSR_READ_4(sc, XL_DMACTL) & XL_DMACTL_DOWN_STALLED ||
2217 			!CSR_READ_4(sc, XL_DOWNLIST_PTR)) {
2218 			CSR_WRITE_4(sc, XL_DOWNLIST_PTR,
2219 				sc->xl_cdata.xl_tx_head->xl_phys);
2220 			CSR_WRITE_2(sc, XL_COMMAND, XL_CMD_DOWN_UNSTALL);
2221 		}
2222 	}
2223 
2224 	return;
2225 }
2226 
2227 static void
2228 xl_txeof_90xB(struct xl_softc *sc)
2229 {
2230 	struct xl_chain		*cur_tx = NULL;
2231 	struct ifnet		*ifp;
2232 	int			idx;
2233 
2234 	ifp = &sc->arpcom.ac_if;
2235 
2236 	bus_dmamap_sync(sc->xl_ldata.xl_tx_tag, sc->xl_ldata.xl_tx_dmamap,
2237 	    BUS_DMASYNC_POSTREAD);
2238 	idx = sc->xl_cdata.xl_tx_cons;
2239 	while(idx != sc->xl_cdata.xl_tx_prod) {
2240 
2241 		cur_tx = &sc->xl_cdata.xl_tx_chain[idx];
2242 
2243 		if (!(le32toh(cur_tx->xl_ptr->xl_status) &
2244 		      XL_TXSTAT_DL_COMPLETE))
2245 			break;
2246 
2247 		if (cur_tx->xl_mbuf != NULL) {
2248 			bus_dmamap_sync(sc->xl_mtag, cur_tx->xl_map,
2249 			    BUS_DMASYNC_POSTWRITE);
2250 			bus_dmamap_unload(sc->xl_mtag, cur_tx->xl_map);
2251 			m_freem(cur_tx->xl_mbuf);
2252 			cur_tx->xl_mbuf = NULL;
2253 		}
2254 
2255 		ifp->if_opackets++;
2256 
2257 		sc->xl_cdata.xl_tx_cnt--;
2258 		XL_INC(idx, XL_TX_LIST_CNT);
2259 		ifp->if_timer = 0;
2260 	}
2261 
2262 	sc->xl_cdata.xl_tx_cons = idx;
2263 
2264 	if (cur_tx != NULL)
2265 		ifp->if_flags &= ~IFF_OACTIVE;
2266 
2267 	return;
2268 }
2269 
2270 /*
2271  * TX 'end of channel' interrupt handler. Actually, we should
2272  * only get a 'TX complete' interrupt if there's a transmit error,
2273  * so this is really TX error handler.
2274  */
2275 static void
2276 xl_txeoc(struct xl_softc *sc)
2277 {
2278 	struct ifnet *ifp = &sc->arpcom.ac_if;
2279 	u_int8_t		txstat;
2280 
2281 	while((txstat = CSR_READ_1(sc, XL_TX_STATUS))) {
2282 		if (txstat & XL_TXSTATUS_UNDERRUN ||
2283 			txstat & XL_TXSTATUS_JABBER ||
2284 			txstat & XL_TXSTATUS_RECLAIM) {
2285 			if_printf(ifp, "transmission error: %x\n", txstat);
2286 			CSR_WRITE_2(sc, XL_COMMAND, XL_CMD_TX_RESET);
2287 			xl_wait(sc);
2288 			if (sc->xl_type == XL_TYPE_905B) {
2289 				if (sc->xl_cdata.xl_tx_cnt) {
2290 					int			i;
2291 					struct xl_chain		*c;
2292 					i = sc->xl_cdata.xl_tx_cons;
2293 					c = &sc->xl_cdata.xl_tx_chain[i];
2294 					CSR_WRITE_4(sc, XL_DOWNLIST_PTR,
2295 					    c->xl_phys);
2296 					CSR_WRITE_1(sc, XL_DOWN_POLL, 64);
2297 				}
2298 			} else {
2299 				if (sc->xl_cdata.xl_tx_head != NULL)
2300 					CSR_WRITE_4(sc, XL_DOWNLIST_PTR,
2301 					    sc->xl_cdata.xl_tx_head->xl_phys);
2302 			}
2303 			/*
2304 			 * Remember to set this for the
2305 			 * first generation 3c90X chips.
2306 			 */
2307 			CSR_WRITE_1(sc, XL_TX_FREETHRESH, XL_PACKET_SIZE >> 8);
2308 			if (txstat & XL_TXSTATUS_UNDERRUN &&
2309 			    sc->xl_tx_thresh < XL_PACKET_SIZE) {
2310 				sc->xl_tx_thresh += XL_MIN_FRAMELEN;
2311 				if_printf(ifp, "tx underrun, increasing tx start"
2312 				    " threshold to %d bytes\n",
2313 				    sc->xl_tx_thresh);
2314 			}
2315 			CSR_WRITE_2(sc, XL_COMMAND,
2316 			    XL_CMD_TX_SET_START|sc->xl_tx_thresh);
2317 			if (sc->xl_type == XL_TYPE_905B) {
2318 				CSR_WRITE_2(sc, XL_COMMAND,
2319 				XL_CMD_SET_TX_RECLAIM|(XL_PACKET_SIZE >> 4));
2320 			}
2321 			CSR_WRITE_2(sc, XL_COMMAND, XL_CMD_TX_ENABLE);
2322 			CSR_WRITE_2(sc, XL_COMMAND, XL_CMD_DOWN_UNSTALL);
2323 		} else {
2324 			CSR_WRITE_2(sc, XL_COMMAND, XL_CMD_TX_ENABLE);
2325 			CSR_WRITE_2(sc, XL_COMMAND, XL_CMD_DOWN_UNSTALL);
2326 		}
2327 		/*
2328 		 * Write an arbitrary byte to the TX_STATUS register
2329 	 	 * to clear this interrupt/error and advance to the next.
2330 		 */
2331 		CSR_WRITE_1(sc, XL_TX_STATUS, 0x01);
2332 	}
2333 
2334 	return;
2335 }
2336 
2337 #ifdef DEVICE_POLLING
2338 
2339 static void
2340 xl_poll(struct ifnet *ifp, enum poll_cmd cmd, int count)
2341 {
2342 	struct xl_softc *sc = ifp->if_softc;
2343 
2344 	switch (cmd) {
2345 	case POLL_REGISTER:
2346 		xl_enable_intrs(sc, 0);
2347 		break;
2348 	case POLL_DEREGISTER:
2349 		xl_enable_intrs(sc, XL_INTRS);
2350 		break;
2351 	case POLL_ONLY:
2352 	case POLL_AND_CHECK_STATUS:
2353 		xl_rxeof(sc, count);
2354 		if (sc->xl_type == XL_TYPE_905B)
2355 			xl_txeof_90xB(sc);
2356 		else
2357 			xl_txeof(sc);
2358 
2359 		if (!ifq_is_empty(&ifp->if_snd)) {
2360 			if (sc->xl_type == XL_TYPE_905B)
2361 				xl_start_90xB(ifp);
2362 			else
2363 				xl_start_body(ifp, 0);
2364 		}
2365 
2366 		if (cmd == POLL_AND_CHECK_STATUS) {
2367 			uint16_t status;
2368 
2369 			/* XXX copy & pasted from xl_intr() */
2370 			status = CSR_READ_2(sc, XL_STATUS);
2371 			if ((status & XL_INTRS) && status != 0xFFFF) {
2372 				CSR_WRITE_2(sc, XL_COMMAND,
2373 				    XL_CMD_INTR_ACK | (status & XL_INTRS));
2374 
2375 				if (status & XL_STAT_TX_COMPLETE) {
2376 					ifp->if_oerrors++;
2377 					xl_txeoc(sc);
2378 				}
2379 
2380 				if (status & XL_STAT_ADFAIL) {
2381 					xl_reset(sc);
2382 					xl_init(sc);
2383 				}
2384 
2385 				if (status & XL_STAT_STATSOFLOW) {
2386 					sc->xl_stats_no_timeout = 1;
2387 					xl_stats_update(sc);
2388 					sc->xl_stats_no_timeout = 0;
2389 				}
2390 			}
2391 		}
2392 		break;
2393 	}
2394 }
2395 
2396 #endif	/* DEVICE_POLLING */
2397 
2398 static void
2399 xl_intr(void *arg)
2400 {
2401 	struct xl_softc		*sc;
2402 	struct ifnet		*ifp;
2403 	u_int16_t		status;
2404 
2405 	sc = arg;
2406 	ifp = &sc->arpcom.ac_if;
2407 
2408 	while(((status = CSR_READ_2(sc, XL_STATUS)) & XL_INTRS) &&
2409 	      status != 0xFFFF) {
2410 
2411 		CSR_WRITE_2(sc, XL_COMMAND,
2412 		    XL_CMD_INTR_ACK|(status & XL_INTRS));
2413 
2414 		if (status & XL_STAT_UP_COMPLETE) {
2415 			int			curpkts;
2416 
2417 			curpkts = ifp->if_ipackets;
2418 			xl_rxeof(sc, -1);
2419 			if (curpkts == ifp->if_ipackets) {
2420 				while (xl_rx_resync(sc))
2421 					xl_rxeof(sc, -1);
2422 			}
2423 		}
2424 
2425 		if (status & XL_STAT_DOWN_COMPLETE) {
2426 			if (sc->xl_type == XL_TYPE_905B)
2427 				xl_txeof_90xB(sc);
2428 			else
2429 				xl_txeof(sc);
2430 		}
2431 
2432 		if (status & XL_STAT_TX_COMPLETE) {
2433 			ifp->if_oerrors++;
2434 			xl_txeoc(sc);
2435 		}
2436 
2437 		if (status & XL_STAT_ADFAIL) {
2438 			xl_reset(sc);
2439 			xl_init(sc);
2440 		}
2441 
2442 		if (status & XL_STAT_STATSOFLOW) {
2443 			sc->xl_stats_no_timeout = 1;
2444 			xl_stats_update(sc);
2445 			sc->xl_stats_no_timeout = 0;
2446 		}
2447 	}
2448 
2449 	if (!ifq_is_empty(&ifp->if_snd))
2450 		(*ifp->if_start)(ifp);
2451 
2452 	return;
2453 }
2454 
2455 static void
2456 xl_stats_update(void *xsc)
2457 {
2458 	struct xl_softc		*sc;
2459 	struct ifnet		*ifp;
2460 	struct xl_stats		xl_stats;
2461 	u_int8_t		*p;
2462 	int			i;
2463 	struct mii_data		*mii = NULL;
2464 
2465 	bzero((char *)&xl_stats, sizeof(struct xl_stats));
2466 
2467 	sc = xsc;
2468 	ifp = &sc->arpcom.ac_if;
2469 	if (sc->xl_miibus != NULL)
2470 		mii = device_get_softc(sc->xl_miibus);
2471 
2472 	p = (u_int8_t *)&xl_stats;
2473 
2474 	/* Read all the stats registers. */
2475 	XL_SEL_WIN(6);
2476 
2477 	for (i = 0; i < 16; i++)
2478 		*p++ = CSR_READ_1(sc, XL_W6_CARRIER_LOST + i);
2479 
2480 	ifp->if_ierrors += xl_stats.xl_rx_overrun;
2481 
2482 	ifp->if_collisions += xl_stats.xl_tx_multi_collision +
2483 				xl_stats.xl_tx_single_collision +
2484 				xl_stats.xl_tx_late_collision;
2485 
2486 	/*
2487 	 * Boomerang and cyclone chips have an extra stats counter
2488 	 * in window 4 (BadSSD). We have to read this too in order
2489 	 * to clear out all the stats registers and avoid a statsoflow
2490 	 * interrupt.
2491 	 */
2492 	XL_SEL_WIN(4);
2493 	CSR_READ_1(sc, XL_W4_BADSSD);
2494 
2495 	if ((mii != NULL) && (!sc->xl_stats_no_timeout))
2496 		mii_tick(mii);
2497 
2498 	XL_SEL_WIN(7);
2499 
2500 	if (!sc->xl_stats_no_timeout)
2501 		callout_reset(&sc->xl_stat_timer, hz, xl_stats_update, sc);
2502 
2503 	return;
2504 }
2505 
2506 /*
2507  * Encapsulate an mbuf chain in a descriptor by coupling the mbuf data
2508  * pointers to the fragment pointers.
2509  */
2510 static int
2511 xl_encap(struct xl_softc *sc, struct xl_chain *c, struct mbuf *m_head)
2512 {
2513 	int			error;
2514 	u_int32_t		status;
2515 	struct ifnet		*ifp;
2516 
2517 	ifp = &sc->arpcom.ac_if;
2518 
2519 	/*
2520  	 * Start packing the mbufs in this chain into
2521 	 * the fragment pointers. Stop when we run out
2522  	 * of fragments or hit the end of the mbuf chain.
2523 	 */
2524 	error = bus_dmamap_load_mbuf(sc->xl_mtag, c->xl_map, m_head,
2525 	    xl_dma_map_txbuf, c->xl_ptr, BUS_DMA_NOWAIT);
2526 
2527 	if (error && error != EFBIG) {
2528 		m_freem(m_head);
2529 		if_printf(ifp, "can't map mbuf (error %d)\n", error);
2530 		return(1);
2531 	}
2532 
2533 	/*
2534 	 * Handle special case: we used up all 63 fragments,
2535 	 * but we have more mbufs left in the chain. Copy the
2536 	 * data into an mbuf cluster. Note that we don't
2537 	 * bother clearing the values in the other fragment
2538 	 * pointers/counters; it wouldn't gain us anything,
2539 	 * and would waste cycles.
2540 	 */
2541 	if (error) {
2542 		struct mbuf		*m_new;
2543 
2544 		m_new = m_defrag(m_head, MB_DONTWAIT);
2545 		if (m_new == NULL) {
2546 			m_freem(m_head);
2547 			return(1);
2548 		} else {
2549 			m_head = m_new;
2550 		}
2551 
2552 		error = bus_dmamap_load_mbuf(sc->xl_mtag, c->xl_map,
2553 			m_head, xl_dma_map_txbuf, c->xl_ptr, BUS_DMA_NOWAIT);
2554 		if (error) {
2555 			m_freem(m_head);
2556 			if_printf(ifp, "can't map mbuf (error %d)\n", error);
2557 			return(1);
2558 		}
2559 	}
2560 
2561 	if (sc->xl_type == XL_TYPE_905B) {
2562 		status = XL_TXSTAT_RND_DEFEAT;
2563 
2564 		if (m_head->m_pkthdr.csum_flags) {
2565 			if (m_head->m_pkthdr.csum_flags & CSUM_IP)
2566 				status |= XL_TXSTAT_IPCKSUM;
2567 			if (m_head->m_pkthdr.csum_flags & CSUM_TCP)
2568 				status |= XL_TXSTAT_TCPCKSUM;
2569 			if (m_head->m_pkthdr.csum_flags & CSUM_UDP)
2570 				status |= XL_TXSTAT_UDPCKSUM;
2571 		}
2572 		c->xl_ptr->xl_status = htole32(status);
2573 	}
2574 
2575 	c->xl_mbuf = m_head;
2576 	bus_dmamap_sync(sc->xl_mtag, c->xl_map, BUS_DMASYNC_PREWRITE);
2577 	return(0);
2578 }
2579 
2580 static void
2581 xl_start(struct ifnet *ifp)
2582 {
2583 	xl_start_body(ifp, 1);
2584 }
2585 
2586 /*
2587  * Main transmit routine. To avoid having to do mbuf copies, we put pointers
2588  * to the mbuf data regions directly in the transmit lists. We also save a
2589  * copy of the pointers since the transmit list fragment pointers are
2590  * physical addresses.
2591  */
2592 static void
2593 xl_start_body(struct ifnet *ifp, int proc_rx)
2594 {
2595 	struct xl_softc		*sc;
2596 	struct mbuf		*m_head = NULL;
2597 	struct xl_chain		*prev = NULL, *cur_tx = NULL, *start_tx;
2598 	struct xl_chain		*prev_tx;
2599 	u_int32_t		status;
2600 	int			error;
2601 
2602 	sc = ifp->if_softc;
2603 	/*
2604 	 * Check for an available queue slot. If there are none,
2605 	 * punt.
2606 	 */
2607 	if (sc->xl_cdata.xl_tx_free == NULL) {
2608 		xl_txeoc(sc);
2609 		xl_txeof(sc);
2610 		if (sc->xl_cdata.xl_tx_free == NULL) {
2611 			ifp->if_flags |= IFF_OACTIVE;
2612 			return;
2613 		}
2614 	}
2615 
2616 	start_tx = sc->xl_cdata.xl_tx_free;
2617 
2618 	while(sc->xl_cdata.xl_tx_free != NULL) {
2619 		m_head = ifq_dequeue(&ifp->if_snd);
2620 		if (m_head == NULL)
2621 			break;
2622 
2623 		/* Pick a descriptor off the free list. */
2624 		prev_tx = cur_tx;
2625 		cur_tx = sc->xl_cdata.xl_tx_free;
2626 
2627 		/* Pack the data into the descriptor. */
2628 		error = xl_encap(sc, cur_tx, m_head);
2629 		if (error) {
2630 			cur_tx = prev_tx;
2631 			continue;
2632 		}
2633 
2634 		sc->xl_cdata.xl_tx_free = cur_tx->xl_next;
2635 		cur_tx->xl_next = NULL;
2636 
2637 		/* Chain it together. */
2638 		if (prev != NULL) {
2639 			prev->xl_next = cur_tx;
2640 			prev->xl_ptr->xl_next = htole32(cur_tx->xl_phys);
2641 		}
2642 		prev = cur_tx;
2643 
2644 		BPF_MTAP(ifp, cur_tx->xl_mbuf);
2645 	}
2646 
2647 	/*
2648 	 * If there are no packets queued, bail.
2649 	 */
2650 	if (cur_tx == NULL)
2651 		return;
2652 
2653 	/*
2654 	 * Place the request for the upload interrupt
2655 	 * in the last descriptor in the chain. This way, if
2656 	 * we're chaining several packets at once, we'll only
2657 	 * get an interupt once for the whole chain rather than
2658 	 * once for each packet.
2659 	 */
2660 	cur_tx->xl_ptr->xl_status = htole32(le32toh(cur_tx->xl_ptr->xl_status) |
2661 	    XL_TXSTAT_DL_INTR);
2662 
2663 	/*
2664 	 * Queue the packets. If the TX channel is clear, update
2665 	 * the downlist pointer register.
2666 	 */
2667 	CSR_WRITE_2(sc, XL_COMMAND, XL_CMD_DOWN_STALL);
2668 	xl_wait(sc);
2669 
2670 	if (sc->xl_cdata.xl_tx_head != NULL) {
2671 		sc->xl_cdata.xl_tx_tail->xl_next = start_tx;
2672 		sc->xl_cdata.xl_tx_tail->xl_ptr->xl_next =
2673 		    htole32(start_tx->xl_phys);
2674 		status = sc->xl_cdata.xl_tx_tail->xl_ptr->xl_status;
2675 		sc->xl_cdata.xl_tx_tail->xl_ptr->xl_status =
2676 		    htole32(le32toh(status) & ~XL_TXSTAT_DL_INTR);
2677 		sc->xl_cdata.xl_tx_tail = cur_tx;
2678 	} else {
2679 		sc->xl_cdata.xl_tx_head = start_tx;
2680 		sc->xl_cdata.xl_tx_tail = cur_tx;
2681 	}
2682 	bus_dmamap_sync(sc->xl_ldata.xl_tx_tag, sc->xl_ldata.xl_tx_dmamap,
2683 	    BUS_DMASYNC_PREWRITE);
2684 
2685 	if (!CSR_READ_4(sc, XL_DOWNLIST_PTR))
2686 		CSR_WRITE_4(sc, XL_DOWNLIST_PTR, start_tx->xl_phys);
2687 
2688 	CSR_WRITE_2(sc, XL_COMMAND, XL_CMD_DOWN_UNSTALL);
2689 
2690 	XL_SEL_WIN(7);
2691 
2692 	/*
2693 	 * Set a timeout in case the chip goes out to lunch.
2694 	 */
2695 	ifp->if_timer = 5;
2696 
2697 	if (proc_rx) {
2698 		/*
2699 		 * XXX Under certain conditions, usually on slower machines
2700 		 * where interrupts may be dropped, it's possible for the
2701 		 * adapter to chew up all the buffers in the receive ring
2702 		 * and stall, without us being able to do anything about it.
2703 		 * To guard against this, we need to make a pass over the
2704 		 * RX queue to make sure there aren't any packets pending.
2705 		 * Doing it here means we can flush the receive ring at the
2706 		 * same time the chip is DMAing the transmit descriptors we
2707 		 * just gave it.
2708 		 *
2709 		 * 3Com goes to some lengths to emphasize the Parallel
2710 		 * Tasking (tm) nature of their chips in all their marketing
2711 		 * literature;  we may as well take advantage of it. :)
2712 		 */
2713 		xl_rxeof(sc, -1);
2714 	}
2715 }
2716 
2717 static void
2718 xl_start_90xB(struct ifnet *ifp)
2719 {
2720 	struct xl_softc		*sc;
2721 	struct mbuf		*m_head = NULL;
2722 	struct xl_chain		*prev = NULL, *cur_tx = NULL, *start_tx;
2723 	struct xl_chain		*prev_tx;
2724 	int			error, idx;
2725 
2726 	sc = ifp->if_softc;
2727 
2728 	if (ifp->if_flags & IFF_OACTIVE)
2729 		return;
2730 
2731 	idx = sc->xl_cdata.xl_tx_prod;
2732 	start_tx = &sc->xl_cdata.xl_tx_chain[idx];
2733 
2734 	while (sc->xl_cdata.xl_tx_chain[idx].xl_mbuf == NULL) {
2735 
2736 		if ((XL_TX_LIST_CNT - sc->xl_cdata.xl_tx_cnt) < 3) {
2737 			ifp->if_flags |= IFF_OACTIVE;
2738 			break;
2739 		}
2740 
2741 		m_head = ifq_dequeue(&ifp->if_snd);
2742 		if (m_head == NULL)
2743 			break;
2744 
2745 		prev_tx = cur_tx;
2746 		cur_tx = &sc->xl_cdata.xl_tx_chain[idx];
2747 
2748 		/* Pack the data into the descriptor. */
2749 		error = xl_encap(sc, cur_tx, m_head);
2750 		if (error) {
2751 			cur_tx = prev_tx;
2752 			continue;
2753 		}
2754 
2755 		/* Chain it together. */
2756 		if (prev != NULL)
2757 			prev->xl_ptr->xl_next = htole32(cur_tx->xl_phys);
2758 		prev = cur_tx;
2759 
2760 		BPF_MTAP(ifp, cur_tx->xl_mbuf);
2761 
2762 		XL_INC(idx, XL_TX_LIST_CNT);
2763 		sc->xl_cdata.xl_tx_cnt++;
2764 	}
2765 
2766 	/*
2767 	 * If there are no packets queued, bail.
2768 	 */
2769 	if (cur_tx == NULL)
2770 		return;
2771 
2772 	/*
2773 	 * Place the request for the upload interrupt
2774 	 * in the last descriptor in the chain. This way, if
2775 	 * we're chaining several packets at once, we'll only
2776 	 * get an interupt once for the whole chain rather than
2777 	 * once for each packet.
2778 	 */
2779 	cur_tx->xl_ptr->xl_status = htole32(le32toh(cur_tx->xl_ptr->xl_status) |
2780 	    XL_TXSTAT_DL_INTR);
2781 
2782 	/* Start transmission */
2783 	sc->xl_cdata.xl_tx_prod = idx;
2784 	start_tx->xl_prev->xl_ptr->xl_next = htole32(start_tx->xl_phys);
2785 
2786 	bus_dmamap_sync(sc->xl_ldata.xl_tx_tag, sc->xl_ldata.xl_tx_dmamap,
2787 	    BUS_DMASYNC_PREWRITE);
2788 
2789 	/*
2790 	 * Set a timeout in case the chip goes out to lunch.
2791 	 */
2792 	ifp->if_timer = 5;
2793 }
2794 
2795 static void
2796 xl_init(void *xsc)
2797 {
2798 	struct xl_softc		*sc = xsc;
2799 	struct ifnet		*ifp = &sc->arpcom.ac_if;
2800 	int			error, i;
2801 	u_int16_t		rxfilt = 0;
2802 	struct mii_data		*mii = NULL;
2803 
2804 	crit_enter();
2805 
2806 	/*
2807 	 * Cancel pending I/O and free all RX/TX buffers.
2808 	 */
2809 	xl_stop(sc);
2810 
2811 	if (sc->xl_miibus == NULL) {
2812 		CSR_WRITE_2(sc, XL_COMMAND, XL_CMD_RX_RESET);
2813 		xl_wait(sc);
2814 	}
2815 	CSR_WRITE_2(sc, XL_COMMAND, XL_CMD_TX_RESET);
2816 	xl_wait(sc);
2817 	DELAY(10000);
2818 
2819 	if (sc->xl_miibus != NULL)
2820 		mii = device_get_softc(sc->xl_miibus);
2821 
2822 	/* Init our MAC address */
2823 	XL_SEL_WIN(2);
2824 	for (i = 0; i < ETHER_ADDR_LEN; i++) {
2825 		CSR_WRITE_1(sc, XL_W2_STATION_ADDR_LO + i,
2826 				sc->arpcom.ac_enaddr[i]);
2827 	}
2828 
2829 	/* Clear the station mask. */
2830 	for (i = 0; i < 3; i++)
2831 		CSR_WRITE_2(sc, XL_W2_STATION_MASK_LO + (i * 2), 0);
2832 #ifdef notdef
2833 	/* Reset TX and RX. */
2834 	CSR_WRITE_2(sc, XL_COMMAND, XL_CMD_RX_RESET);
2835 	xl_wait(sc);
2836 	CSR_WRITE_2(sc, XL_COMMAND, XL_CMD_TX_RESET);
2837 	xl_wait(sc);
2838 #endif
2839 	/* Init circular RX list. */
2840 	error = xl_list_rx_init(sc);
2841 	if (error) {
2842 		if_printf(ifp, "initialization of the rx ring failed (%d)\n",
2843 			  error);
2844 		xl_stop(sc);
2845 		crit_exit();
2846 		return;
2847 	}
2848 
2849 	/* Init TX descriptors. */
2850 	if (sc->xl_type == XL_TYPE_905B)
2851 		xl_list_tx_init_90xB(sc);
2852 	else
2853 		xl_list_tx_init(sc);
2854 
2855 	/*
2856 	 * Set the TX freethresh value.
2857 	 * Note that this has no effect on 3c905B "cyclone"
2858 	 * cards but is required for 3c900/3c905 "boomerang"
2859 	 * cards in order to enable the download engine.
2860 	 */
2861 	CSR_WRITE_1(sc, XL_TX_FREETHRESH, XL_PACKET_SIZE >> 8);
2862 
2863 	/* Set the TX start threshold for best performance. */
2864 	sc->xl_tx_thresh = XL_MIN_FRAMELEN;
2865 	CSR_WRITE_2(sc, XL_COMMAND, XL_CMD_TX_SET_START|sc->xl_tx_thresh);
2866 
2867 	/*
2868 	 * If this is a 3c905B, also set the tx reclaim threshold.
2869 	 * This helps cut down on the number of tx reclaim errors
2870 	 * that could happen on a busy network. The chip multiplies
2871 	 * the register value by 16 to obtain the actual threshold
2872 	 * in bytes, so we divide by 16 when setting the value here.
2873 	 * The existing threshold value can be examined by reading
2874 	 * the register at offset 9 in window 5.
2875 	 */
2876 	if (sc->xl_type == XL_TYPE_905B) {
2877 		CSR_WRITE_2(sc, XL_COMMAND,
2878 		    XL_CMD_SET_TX_RECLAIM|(XL_PACKET_SIZE >> 4));
2879 	}
2880 
2881 	/* Set RX filter bits. */
2882 	XL_SEL_WIN(5);
2883 	rxfilt = CSR_READ_1(sc, XL_W5_RX_FILTER);
2884 
2885 	/* Set the individual bit to receive frames for this host only. */
2886 	rxfilt |= XL_RXFILTER_INDIVIDUAL;
2887 
2888 	/* If we want promiscuous mode, set the allframes bit. */
2889 	if (ifp->if_flags & IFF_PROMISC) {
2890 		rxfilt |= XL_RXFILTER_ALLFRAMES;
2891 		CSR_WRITE_2(sc, XL_COMMAND, XL_CMD_RX_SET_FILT|rxfilt);
2892 	} else {
2893 		rxfilt &= ~XL_RXFILTER_ALLFRAMES;
2894 		CSR_WRITE_2(sc, XL_COMMAND, XL_CMD_RX_SET_FILT|rxfilt);
2895 	}
2896 
2897 	/*
2898 	 * Set capture broadcast bit to capture broadcast frames.
2899 	 */
2900 	if (ifp->if_flags & IFF_BROADCAST) {
2901 		rxfilt |= XL_RXFILTER_BROADCAST;
2902 		CSR_WRITE_2(sc, XL_COMMAND, XL_CMD_RX_SET_FILT|rxfilt);
2903 	} else {
2904 		rxfilt &= ~XL_RXFILTER_BROADCAST;
2905 		CSR_WRITE_2(sc, XL_COMMAND, XL_CMD_RX_SET_FILT|rxfilt);
2906 	}
2907 
2908 	/*
2909 	 * Program the multicast filter, if necessary.
2910 	 */
2911 	if (sc->xl_type == XL_TYPE_905B)
2912 		xl_setmulti_hash(sc);
2913 	else
2914 		xl_setmulti(sc);
2915 
2916 	if (sc->xl_type == XL_TYPE_905B) {
2917 		/* Set UP polling interval */
2918 		CSR_WRITE_1(sc, XL_UP_POLL, 64);
2919 	}
2920 
2921 	/*
2922 	 * Load the address of the RX list. We have to
2923 	 * stall the upload engine before we can manipulate
2924 	 * the uplist pointer register, then unstall it when
2925 	 * we're finished. We also have to wait for the
2926 	 * stall command to complete before proceeding.
2927 	 * Note that we have to do this after any RX resets
2928 	 * have completed since the uplist register is cleared
2929 	 * by a reset.
2930 	 */
2931 	CSR_WRITE_2(sc, XL_COMMAND, XL_CMD_UP_STALL);
2932 	xl_wait(sc);
2933 	CSR_WRITE_4(sc, XL_UPLIST_PTR, sc->xl_ldata.xl_rx_dmaaddr);
2934 	CSR_WRITE_2(sc, XL_COMMAND, XL_CMD_UP_UNSTALL);
2935 	xl_wait(sc);
2936 
2937 	if (sc->xl_type == XL_TYPE_905B) {
2938 		/* Set DN polling interval */
2939 		CSR_WRITE_1(sc, XL_DOWN_POLL, 64);
2940 
2941 		/* Load the address of the TX list */
2942 		CSR_WRITE_2(sc, XL_COMMAND, XL_CMD_DOWN_STALL);
2943 		xl_wait(sc);
2944 		CSR_WRITE_4(sc, XL_DOWNLIST_PTR,
2945 		    sc->xl_cdata.xl_tx_chain[0].xl_phys);
2946 		CSR_WRITE_2(sc, XL_COMMAND, XL_CMD_DOWN_UNSTALL);
2947 		xl_wait(sc);
2948 	}
2949 
2950 	/*
2951 	 * If the coax transceiver is on, make sure to enable
2952 	 * the DC-DC converter.
2953  	 */
2954 	XL_SEL_WIN(3);
2955 	if (sc->xl_xcvr == XL_XCVR_COAX)
2956 		CSR_WRITE_2(sc, XL_COMMAND, XL_CMD_COAX_START);
2957 	else
2958 		CSR_WRITE_2(sc, XL_COMMAND, XL_CMD_COAX_STOP);
2959 
2960 	/*
2961 	 * increase packet size to allow reception of 802.1q or ISL packets.
2962 	 * For the 3c90x chip, set the 'allow large packets' bit in the MAC
2963 	 * control register. For 3c90xB/C chips, use the RX packet size
2964 	 * register.
2965 	 */
2966 
2967 	if (sc->xl_type == XL_TYPE_905B) {
2968 		CSR_WRITE_2(sc, XL_W3_MAXPKTSIZE, XL_PACKET_SIZE);
2969 	} else {
2970 		u_int8_t macctl;
2971 		macctl = CSR_READ_1(sc, XL_W3_MAC_CTRL);
2972 		macctl |= XL_MACCTRL_ALLOW_LARGE_PACK;
2973 		CSR_WRITE_1(sc, XL_W3_MAC_CTRL, macctl);
2974 	}
2975 
2976 	/* Clear out the stats counters. */
2977 	CSR_WRITE_2(sc, XL_COMMAND, XL_CMD_STATS_DISABLE);
2978 	sc->xl_stats_no_timeout = 1;
2979 	xl_stats_update(sc);
2980 	sc->xl_stats_no_timeout = 0;
2981 	XL_SEL_WIN(4);
2982 	CSR_WRITE_2(sc, XL_W4_NET_DIAG, XL_NETDIAG_UPPER_BYTES_ENABLE);
2983 	CSR_WRITE_2(sc, XL_COMMAND, XL_CMD_STATS_ENABLE);
2984 
2985 	/*
2986 	 * Enable interrupts.
2987 	 */
2988 	CSR_WRITE_2(sc, XL_COMMAND, XL_CMD_STAT_ENB | XL_INTRS);
2989 #ifdef DEVICE_POLLING
2990 	/* Do not enable interrupt if polling(4) is enabled */
2991 	if ((ifp->if_flags & IFF_POLLING) != 0)
2992 		xl_enable_intrs(sc, 0);
2993 	else
2994 #endif
2995 	xl_enable_intrs(sc, XL_INTRS);
2996 
2997 	/* Set the RX early threshold */
2998 	CSR_WRITE_2(sc, XL_COMMAND, XL_CMD_RX_SET_THRESH|(XL_PACKET_SIZE >>2));
2999 	CSR_WRITE_2(sc, XL_DMACTL, XL_DMACTL_UP_RX_EARLY);
3000 
3001 	/* Enable receiver and transmitter. */
3002 	CSR_WRITE_2(sc, XL_COMMAND, XL_CMD_TX_ENABLE);
3003 	xl_wait(sc);
3004 	CSR_WRITE_2(sc, XL_COMMAND, XL_CMD_RX_ENABLE);
3005 	xl_wait(sc);
3006 
3007 	if (mii != NULL)
3008 		mii_mediachg(mii);
3009 
3010 	/* Select window 7 for normal operations. */
3011 	XL_SEL_WIN(7);
3012 
3013 	ifp->if_flags |= IFF_RUNNING;
3014 	ifp->if_flags &= ~IFF_OACTIVE;
3015 
3016 	callout_reset(&sc->xl_stat_timer, hz, xl_stats_update, sc);
3017 
3018 	crit_exit();
3019 }
3020 
3021 /*
3022  * Set media options.
3023  */
3024 static int
3025 xl_ifmedia_upd(struct ifnet *ifp)
3026 {
3027 	struct xl_softc		*sc;
3028 	struct ifmedia		*ifm = NULL;
3029 	struct mii_data		*mii = NULL;
3030 
3031 	sc = ifp->if_softc;
3032 	if (sc->xl_miibus != NULL)
3033 		mii = device_get_softc(sc->xl_miibus);
3034 	if (mii == NULL)
3035 		ifm = &sc->ifmedia;
3036 	else
3037 		ifm = &mii->mii_media;
3038 
3039 	switch(IFM_SUBTYPE(ifm->ifm_media)) {
3040 	case IFM_100_FX:
3041 	case IFM_10_FL:
3042 	case IFM_10_2:
3043 	case IFM_10_5:
3044 		xl_setmode(sc, ifm->ifm_media);
3045 		return(0);
3046 		break;
3047 	default:
3048 		break;
3049 	}
3050 
3051 	if (sc->xl_media & XL_MEDIAOPT_MII || sc->xl_media & XL_MEDIAOPT_BTX
3052 		|| sc->xl_media & XL_MEDIAOPT_BT4) {
3053 		xl_init(sc);
3054 	} else {
3055 		xl_setmode(sc, ifm->ifm_media);
3056 	}
3057 
3058 	return(0);
3059 }
3060 
3061 /*
3062  * Report current media status.
3063  */
3064 static void
3065 xl_ifmedia_sts(struct ifnet *ifp, struct ifmediareq *ifmr)
3066 {
3067 	struct xl_softc		*sc;
3068 	u_int32_t		icfg;
3069 	struct mii_data		*mii = NULL;
3070 
3071 	sc = ifp->if_softc;
3072 	if (sc->xl_miibus != NULL)
3073 		mii = device_get_softc(sc->xl_miibus);
3074 
3075 	XL_SEL_WIN(3);
3076 	icfg = CSR_READ_4(sc, XL_W3_INTERNAL_CFG) & XL_ICFG_CONNECTOR_MASK;
3077 	icfg >>= XL_ICFG_CONNECTOR_BITS;
3078 
3079 	ifmr->ifm_active = IFM_ETHER;
3080 
3081 	switch(icfg) {
3082 	case XL_XCVR_10BT:
3083 		ifmr->ifm_active = IFM_ETHER|IFM_10_T;
3084 		if (CSR_READ_1(sc, XL_W3_MAC_CTRL) & XL_MACCTRL_DUPLEX)
3085 			ifmr->ifm_active |= IFM_FDX;
3086 		else
3087 			ifmr->ifm_active |= IFM_HDX;
3088 		break;
3089 	case XL_XCVR_AUI:
3090 		if (sc->xl_type == XL_TYPE_905B &&
3091 		    sc->xl_media == XL_MEDIAOPT_10FL) {
3092 			ifmr->ifm_active = IFM_ETHER|IFM_10_FL;
3093 			if (CSR_READ_1(sc, XL_W3_MAC_CTRL) & XL_MACCTRL_DUPLEX)
3094 				ifmr->ifm_active |= IFM_FDX;
3095 			else
3096 				ifmr->ifm_active |= IFM_HDX;
3097 		} else
3098 			ifmr->ifm_active = IFM_ETHER|IFM_10_5;
3099 		break;
3100 	case XL_XCVR_COAX:
3101 		ifmr->ifm_active = IFM_ETHER|IFM_10_2;
3102 		break;
3103 	/*
3104 	 * XXX MII and BTX/AUTO should be separate cases.
3105 	 */
3106 
3107 	case XL_XCVR_100BTX:
3108 	case XL_XCVR_AUTO:
3109 	case XL_XCVR_MII:
3110 		if (mii != NULL) {
3111 			mii_pollstat(mii);
3112 			ifmr->ifm_active = mii->mii_media_active;
3113 			ifmr->ifm_status = mii->mii_media_status;
3114 		}
3115 		break;
3116 	case XL_XCVR_100BFX:
3117 		ifmr->ifm_active = IFM_ETHER|IFM_100_FX;
3118 		break;
3119 	default:
3120 		if_printf(ifp, "unknown XCVR type: %d\n", icfg);
3121 		break;
3122 	}
3123 
3124 	return;
3125 }
3126 
3127 static int
3128 xl_ioctl(struct ifnet *ifp, u_long command, caddr_t data, struct ucred *cr)
3129 {
3130 	struct xl_softc		*sc = ifp->if_softc;
3131 	struct ifreq		*ifr = (struct ifreq *) data;
3132 	int			error = 0;
3133 	struct mii_data		*mii = NULL;
3134 	u_int8_t		rxfilt;
3135 
3136 	crit_enter();
3137 
3138 	switch(command) {
3139 	case SIOCSIFFLAGS:
3140 		XL_SEL_WIN(5);
3141 		rxfilt = CSR_READ_1(sc, XL_W5_RX_FILTER);
3142 		if (ifp->if_flags & IFF_UP) {
3143 			if (ifp->if_flags & IFF_RUNNING &&
3144 			    ifp->if_flags & IFF_PROMISC &&
3145 			    !(sc->xl_if_flags & IFF_PROMISC)) {
3146 				rxfilt |= XL_RXFILTER_ALLFRAMES;
3147 				CSR_WRITE_2(sc, XL_COMMAND,
3148 				    XL_CMD_RX_SET_FILT|rxfilt);
3149 				XL_SEL_WIN(7);
3150 			} else if (ifp->if_flags & IFF_RUNNING &&
3151 			    !(ifp->if_flags & IFF_PROMISC) &&
3152 			    sc->xl_if_flags & IFF_PROMISC) {
3153 				rxfilt &= ~XL_RXFILTER_ALLFRAMES;
3154 				CSR_WRITE_2(sc, XL_COMMAND,
3155 				    XL_CMD_RX_SET_FILT|rxfilt);
3156 				XL_SEL_WIN(7);
3157 			} else
3158 				xl_init(sc);
3159 		} else {
3160 			if (ifp->if_flags & IFF_RUNNING)
3161 				xl_stop(sc);
3162 		}
3163 		sc->xl_if_flags = ifp->if_flags;
3164 		error = 0;
3165 		break;
3166 	case SIOCADDMULTI:
3167 	case SIOCDELMULTI:
3168 		if (sc->xl_type == XL_TYPE_905B)
3169 			xl_setmulti_hash(sc);
3170 		else
3171 			xl_setmulti(sc);
3172 		error = 0;
3173 		break;
3174 	case SIOCGIFMEDIA:
3175 	case SIOCSIFMEDIA:
3176 		if (sc->xl_miibus != NULL)
3177 			mii = device_get_softc(sc->xl_miibus);
3178 		if (mii == NULL)
3179 			error = ifmedia_ioctl(ifp, ifr,
3180 			    &sc->ifmedia, command);
3181 		else
3182 			error = ifmedia_ioctl(ifp, ifr,
3183 			    &mii->mii_media, command);
3184 		break;
3185         case SIOCSIFCAP:
3186 		ifp->if_capenable = ifr->ifr_reqcap;
3187 		if (ifp->if_capenable & IFCAP_TXCSUM)
3188 			ifp->if_hwassist = XL905B_CSUM_FEATURES;
3189 		else
3190 			ifp->if_hwassist = 0;
3191 		break;
3192 	default:
3193 		error = ether_ioctl(ifp, command, data);
3194 		break;
3195 	}
3196 
3197 	crit_exit();
3198 
3199 	return(error);
3200 }
3201 
3202 static void
3203 xl_watchdog(struct ifnet *ifp)
3204 {
3205 	struct xl_softc		*sc;
3206 	u_int16_t		status = 0;
3207 
3208 	sc = ifp->if_softc;
3209 
3210 	ifp->if_oerrors++;
3211 	XL_SEL_WIN(4);
3212 	status = CSR_READ_2(sc, XL_W4_MEDIA_STATUS);
3213 	if_printf(ifp, "watchdog timeout\n");
3214 
3215 	if (status & XL_MEDIASTAT_CARRIER)
3216 		if_printf(ifp, "no carrier - transceiver cable problem?\n");
3217 	xl_txeoc(sc);
3218 	xl_txeof(sc);
3219 	xl_rxeof(sc, -1);
3220 	xl_reset(sc);
3221 	xl_init(sc);
3222 
3223 	if (!ifq_is_empty(&ifp->if_snd))
3224 		(*ifp->if_start)(ifp);
3225 }
3226 
3227 /*
3228  * Stop the adapter and free any mbufs allocated to the
3229  * RX and TX lists.
3230  */
3231 static void
3232 xl_stop(struct xl_softc *sc)
3233 {
3234 	int		i;
3235 	struct ifnet		*ifp;
3236 
3237 	ifp = &sc->arpcom.ac_if;
3238 	ifp->if_timer = 0;
3239 
3240 	CSR_WRITE_2(sc, XL_COMMAND, XL_CMD_RX_DISABLE);
3241 	CSR_WRITE_2(sc, XL_COMMAND, XL_CMD_STATS_DISABLE);
3242 	CSR_WRITE_2(sc, XL_COMMAND, XL_CMD_INTR_ENB);
3243 	CSR_WRITE_2(sc, XL_COMMAND, XL_CMD_RX_DISCARD);
3244 	xl_wait(sc);
3245 	CSR_WRITE_2(sc, XL_COMMAND, XL_CMD_TX_DISABLE);
3246 	CSR_WRITE_2(sc, XL_COMMAND, XL_CMD_COAX_STOP);
3247 	DELAY(800);
3248 
3249 #ifdef foo
3250 	CSR_WRITE_2(sc, XL_COMMAND, XL_CMD_RX_RESET);
3251 	xl_wait(sc);
3252 	CSR_WRITE_2(sc, XL_COMMAND, XL_CMD_TX_RESET);
3253 	xl_wait(sc);
3254 #endif
3255 
3256 	CSR_WRITE_2(sc, XL_COMMAND, XL_CMD_INTR_ACK|XL_STAT_INTLATCH);
3257 	CSR_WRITE_2(sc, XL_COMMAND, XL_CMD_STAT_ENB|0);
3258 	CSR_WRITE_2(sc, XL_COMMAND, XL_CMD_INTR_ENB|0);
3259 	if (sc->xl_flags & XL_FLAG_FUNCREG)
3260 		bus_space_write_4(sc->xl_ftag, sc->xl_fhandle, 4, 0x8000);
3261 
3262 	/* Stop the stats updater. */
3263 	callout_stop(&sc->xl_stat_timer);
3264 
3265 	/*
3266 	 * Free data in the RX lists.
3267 	 */
3268 	for (i = 0; i < XL_RX_LIST_CNT; i++) {
3269 		if (sc->xl_cdata.xl_rx_chain[i].xl_mbuf != NULL) {
3270 			bus_dmamap_unload(sc->xl_mtag,
3271 			    sc->xl_cdata.xl_rx_chain[i].xl_map);
3272 			m_freem(sc->xl_cdata.xl_rx_chain[i].xl_mbuf);
3273 			sc->xl_cdata.xl_rx_chain[i].xl_mbuf = NULL;
3274 		}
3275 	}
3276 	bzero(sc->xl_ldata.xl_rx_list, XL_RX_LIST_SZ);
3277 
3278 	/*
3279 	 * Free the TX list buffers.
3280 	 */
3281 	for (i = 0; i < XL_TX_LIST_CNT; i++) {
3282 		if (sc->xl_cdata.xl_tx_chain[i].xl_mbuf != NULL) {
3283 			bus_dmamap_unload(sc->xl_mtag,
3284 			    sc->xl_cdata.xl_tx_chain[i].xl_map);
3285 			m_freem(sc->xl_cdata.xl_tx_chain[i].xl_mbuf);
3286 			sc->xl_cdata.xl_tx_chain[i].xl_mbuf = NULL;
3287 		}
3288 	}
3289 	bzero(sc->xl_ldata.xl_tx_list, XL_TX_LIST_SZ);
3290 
3291 	ifp->if_flags &= ~(IFF_RUNNING | IFF_OACTIVE);
3292 }
3293 
3294 /*
3295  * Stop all chip I/O so that the kernel's probe routines don't
3296  * get confused by errant DMAs when rebooting.
3297  */
3298 static void
3299 xl_shutdown(device_t dev)
3300 {
3301 	struct xl_softc		*sc;
3302 
3303 	sc = device_get_softc(dev);
3304 
3305 	xl_reset(sc);
3306 	xl_stop(sc);
3307 
3308 	return;
3309 }
3310 
3311 static int
3312 xl_suspend(device_t dev)
3313 {
3314 	struct xl_softc *sc = device_get_softc(dev);
3315 
3316 	crit_enter();
3317 
3318 	xl_stop(sc);
3319 
3320 	crit_exit();
3321 
3322 	return(0);
3323 }
3324 
3325 static int
3326 xl_resume(device_t dev)
3327 {
3328 	struct xl_softc		*sc;
3329 	struct ifnet		*ifp;
3330 
3331 	sc = device_get_softc(dev);
3332 	ifp = &sc->arpcom.ac_if;
3333 
3334 	crit_enter();
3335 
3336 	xl_reset(sc);
3337 	if (ifp->if_flags & IFF_UP)
3338 		xl_init(sc);
3339 
3340 	crit_exit();
3341 
3342 	return(0);
3343 }
3344