xref: /netbsd-src/sys/dev/ic/mb86960.c (revision 274254cdae52594c1aa480a736aef78313d15c9c)
1 /*	$NetBSD: mb86960.c,v 1.72 2008/12/16 22:35:31 christos Exp $	*/
2 
3 /*
4  * All Rights Reserved, Copyright (C) Fujitsu Limited 1995
5  *
6  * This software may be used, modified, copied, distributed, and sold, in
7  * both source and binary form provided that the above copyright, these
8  * terms and the following disclaimer are retained.  The name of the author
9  * and/or the contributor may not be used to endorse or promote products
10  * derived from this software without specific prior written permission.
11  *
12  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND THE CONTRIBUTOR ``AS IS'' AND
13  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
14  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
15  * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR THE CONTRIBUTOR BE LIABLE
16  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
17  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
18  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION.
19  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
20  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
21  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
22  * SUCH DAMAGE.
23  */
24 
25 /*
26  * Portions copyright (C) 1993, David Greenman.  This software may be used,
27  * modified, copied, distributed, and sold, in both source and binary form
28  * provided that the above copyright and these terms are retained.  Under no
29  * circumstances is the author responsible for the proper functioning of this
30  * software, nor does the author assume any responsibility for damages
31  * incurred with its use.
32  */
33 
34 #include <sys/cdefs.h>
35 __KERNEL_RCSID(0, "$NetBSD: mb86960.c,v 1.72 2008/12/16 22:35:31 christos Exp $");
36 
37 /*
38  * Device driver for Fujitsu MB86960A/MB86965A based Ethernet cards.
39  * Contributed by M.S. <seki@sysrap.cs.fujitsu.co.jp>
40  *
41  * This version is intended to be a generic template for various
42  * MB86960A/MB86965A based Ethernet cards.  It currently supports
43  * Fujitsu FMV-180 series (i.e., FMV-181 and FMV-182) and Allied-
44  * Telesis AT1700 series and RE2000 series.  There are some
45  * unnecessary hooks embedded, which are primarily intended to support
46  * other types of Ethernet cards, but the author is not sure whether
47  * they are useful.
48  */
49 
50 #include "opt_inet.h"
51 #include "bpfilter.h"
52 #include "rnd.h"
53 
54 #include <sys/param.h>
55 #include <sys/systm.h>
56 #include <sys/errno.h>
57 #include <sys/ioctl.h>
58 #include <sys/mbuf.h>
59 #include <sys/socket.h>
60 #include <sys/syslog.h>
61 #include <sys/device.h>
62 #if NRND > 0
63 #include <sys/rnd.h>
64 #endif
65 
66 #include <net/if.h>
67 #include <net/if_dl.h>
68 #include <net/if_types.h>
69 #include <net/if_media.h>
70 #include <net/if_ether.h>
71 
72 #ifdef INET
73 #include <netinet/in.h>
74 #include <netinet/in_systm.h>
75 #include <netinet/in_var.h>
76 #include <netinet/ip.h>
77 #include <netinet/if_inarp.h>
78 #endif
79 
80 
81 #if NBPFILTER > 0
82 #include <net/bpf.h>
83 #include <net/bpfdesc.h>
84 #endif
85 
86 #include <sys/bus.h>
87 
88 #include <dev/ic/mb86960reg.h>
89 #include <dev/ic/mb86960var.h>
90 
91 #ifndef __BUS_SPACE_HAS_STREAM_METHODS
92 #define bus_space_write_stream_2	bus_space_write_2
93 #define bus_space_write_multi_stream_2	bus_space_write_multi_2
94 #define bus_space_read_multi_stream_2	bus_space_read_multi_2
95 #endif /* __BUS_SPACE_HAS_STREAM_METHODS */
96 
97 /* Standard driver entry points.  These can be static. */
98 void	mb86960_init(struct mb86960_softc *);
99 int	mb86960_ioctl(struct ifnet *, u_long, void *);
100 void	mb86960_start(struct ifnet *);
101 void	mb86960_reset(struct mb86960_softc *);
102 void	mb86960_watchdog(struct ifnet *);
103 
104 /* Local functions.  Order of declaration is confused.  FIXME. */
105 int	mb86960_get_packet(struct mb86960_softc *, u_int);
106 void	mb86960_stop(struct mb86960_softc *);
107 void	mb86960_tint(struct mb86960_softc *, uint8_t);
108 void	mb86960_rint(struct mb86960_softc *, uint8_t);
109 static inline
110 void	mb86960_xmit(struct mb86960_softc *);
111 void	mb86960_write_mbufs(struct mb86960_softc *, struct mbuf *);
112 static inline
113 void	mb86960_droppacket(struct mb86960_softc *);
114 void	mb86960_getmcaf(struct ethercom *, uint8_t *);
115 void	mb86960_setmode(struct mb86960_softc *);
116 void	mb86960_loadmar(struct mb86960_softc *);
117 
118 int	mb86960_mediachange(struct ifnet *);
119 void	mb86960_mediastatus(struct ifnet *, struct ifmediareq *);
120 
121 #if FE_DEBUG >= 1
122 void	mb86960_dump(int, struct mb86960_softc *);
123 #endif
124 
125 void
126 mb86960_attach(struct mb86960_softc *sc, uint8_t *myea)
127 {
128 	bus_space_tag_t bst = sc->sc_bst;
129 	bus_space_handle_t bsh = sc->sc_bsh;
130 
131 	/* Register values which depend on board design. */
132 	sc->proto_dlcr4 = FE_D4_LBC_DISABLE | FE_D4_CNTRL;
133 	sc->proto_dlcr5 = 0;
134 	sc->proto_dlcr7 = FE_D7_BYTSWP_LH;
135 	if ((sc->sc_flags & FE_FLAGS_MB86960) != 0)
136 		sc->proto_dlcr7 |= FE_D7_ED_TEST; /* XXX */
137 	sc->proto_bmpr13 = FE_B13_TPTYPE_UTP | FE_B13_PORT_AUTO;
138 
139 	/*
140 	 * Program the 86960 as following defaults:
141 	 *	SRAM: 32KB, 100ns, byte-wide access.
142 	 *	Transmission buffer: 4KB x 2.
143 	 *	System bus interface: 16 bits.
144 	 * These values except TXBSIZE should be modified as per
145 	 * sc_flags which is set in MD attachments, because they
146 	 * are hard-wired on the board. Modifying TXBSIZE will affect
147 	 * the driver performance.
148 	 */
149 	sc->proto_dlcr6 = FE_D6_BUFSIZ_32KB | FE_D6_TXBSIZ_2x4KB |
150 	    FE_D6_BBW_BYTE | FE_D6_SRAM_100ns;
151 	if (sc->sc_flags & FE_FLAGS_SBW_BYTE)
152 		sc->proto_dlcr6 |= FE_D6_SBW_BYTE;
153 	if (sc->sc_flags & FE_FLAGS_SRAM_150ns)
154 		sc->proto_dlcr6 &= ~FE_D6_SRAM_100ns;
155 
156 	/*
157 	 * Minimum initialization of the hardware.
158 	 * We write into registers; hope I/O ports have no
159 	 * overlap with other boards.
160 	 */
161 
162 	/* Initialize 86960. */
163 	bus_space_write_1(bst, bsh, FE_DLCR6,
164 	    sc->proto_dlcr6 | FE_D6_DLC_DISABLE);
165 	delay(200);
166 
167 #ifdef DIAGNOSTIC
168 	if (myea == NULL) {
169 		aprint_error_dev(sc->sc_dev,
170 		    "ethernet address shouldn't be NULL\n");
171 		panic("NULL ethernet address");
172 	}
173 #endif
174 	memcpy(sc->sc_enaddr, myea, sizeof(sc->sc_enaddr));
175 
176 	/* Disable all interrupts. */
177 	bus_space_write_1(bst, bsh, FE_DLCR2, 0);
178 	bus_space_write_1(bst, bsh, FE_DLCR3, 0);
179 }
180 
181 /*
182  * Install interface into kernel networking data structures
183  */
184 void
185 mb86960_config(struct mb86960_softc *sc, int *media, int nmedia, int defmedia)
186 {
187 	cfdata_t cf = device_cfdata(sc->sc_dev);
188 	struct ifnet *ifp = &sc->sc_ec.ec_if;
189 	int i;
190 
191 	/* Stop the 86960. */
192 	mb86960_stop(sc);
193 
194 	/* Initialize ifnet structure. */
195 	strlcpy(ifp->if_xname, device_xname(sc->sc_dev), IFNAMSIZ);
196 	ifp->if_softc = sc;
197 	ifp->if_start = mb86960_start;
198 	ifp->if_ioctl = mb86960_ioctl;
199 	ifp->if_watchdog = mb86960_watchdog;
200 	ifp->if_flags =
201 	    IFF_BROADCAST | IFF_SIMPLEX | IFF_NOTRAILERS | IFF_MULTICAST;
202 	IFQ_SET_READY(&ifp->if_snd);
203 
204 #if FE_DEBUG >= 3
205 	log(LOG_INFO, "%s: mb86960_config()\n", device_xname(sc->sc_dev));
206 	mb86960_dump(LOG_INFO, sc);
207 #endif
208 
209 #if FE_SINGLE_TRANSMISSION
210 	/* Override txb config to allocate minimum. */
211 	sc->proto_dlcr6 &= ~FE_D6_TXBSIZ;
212 	sc->proto_dlcr6 |=  FE_D6_TXBSIZ_2x2KB;
213 #endif
214 
215 	/* Modify hardware config if it is requested. */
216 	if ((cf->cf_flags & FE_FLAGS_OVERRIDE_DLCR6) != 0)
217 		sc->proto_dlcr6 = cf->cf_flags & FE_FLAGS_DLCR6_VALUE;
218 
219 	/* Find TX buffer size, based on the hardware dependent proto. */
220 	switch (sc->proto_dlcr6 & FE_D6_TXBSIZ) {
221 	case FE_D6_TXBSIZ_2x2KB:
222 		sc->txb_size = 2048;
223 		break;
224 	case FE_D6_TXBSIZ_2x4KB:
225 		sc->txb_size = 4096;
226 		break;
227 	case FE_D6_TXBSIZ_2x8KB:
228 		sc->txb_size = 8192;
229 		break;
230 	default:
231 		/* Oops, we can't work with single buffer configuration. */
232 #if FE_DEBUG >= 2
233 		log(LOG_WARNING, "%s: strange TXBSIZ config; fixing\n",
234 		    device_xname(sc->sc_dev));
235 #endif
236 		sc->proto_dlcr6 &= ~FE_D6_TXBSIZ;
237 		sc->proto_dlcr6 |=  FE_D6_TXBSIZ_2x2KB;
238 		sc->txb_size = 2048;
239 		break;
240 	}
241 
242 	/* Initialize media goo. */
243 	ifmedia_init(&sc->sc_media, 0, mb86960_mediachange,
244 	    mb86960_mediastatus);
245 	if (media != NULL) {
246 		for (i = 0; i < nmedia; i++)
247 			ifmedia_add(&sc->sc_media, media[i], 0, NULL);
248 		ifmedia_set(&sc->sc_media, defmedia);
249 	} else {
250 		ifmedia_add(&sc->sc_media, IFM_ETHER|IFM_MANUAL, 0, NULL);
251 		ifmedia_set(&sc->sc_media, IFM_ETHER|IFM_MANUAL);
252 	}
253 
254 	/* Attach the interface. */
255 	if_attach(ifp);
256 	ether_ifattach(ifp, sc->sc_enaddr);
257 
258 #if NRND > 0
259 	rnd_attach_source(&sc->rnd_source, device_xname(sc->sc_dev),
260 	    RND_TYPE_NET, 0);
261 #endif
262 	/* Print additional info when attached. */
263 	aprint_normal_dev(sc->sc_dev, "Ethernet address %s\n",
264 	    ether_sprintf(sc->sc_enaddr));
265 
266 #if FE_DEBUG >= 3
267 	{
268 		int buf, txb, bbw, sbw, ram;
269 
270 		buf = txb = bbw = sbw = ram = -1;
271 		switch (sc->proto_dlcr6 & FE_D6_BUFSIZ) {
272 		case FE_D6_BUFSIZ_8KB:
273 			buf = 8;
274 			break;
275 		case FE_D6_BUFSIZ_16KB:
276 			buf = 16;
277 			break;
278 		case FE_D6_BUFSIZ_32KB:
279 			buf = 32;
280 			break;
281 		case FE_D6_BUFSIZ_64KB:
282 			buf = 64;
283 			break;
284 		}
285 		switch (sc->proto_dlcr6 & FE_D6_TXBSIZ) {
286 		case FE_D6_TXBSIZ_2x2KB:
287 			txb = 2;
288 			break;
289 		case FE_D6_TXBSIZ_2x4KB:
290 			txb = 4;
291 			break;
292 		case FE_D6_TXBSIZ_2x8KB:
293 			txb = 8;
294 			break;
295 		}
296 		switch (sc->proto_dlcr6 & FE_D6_BBW) {
297 		case FE_D6_BBW_BYTE:
298 			bbw = 8;
299 			break;
300 		case FE_D6_BBW_WORD:
301 			bbw = 16;
302 			break;
303 		}
304 		switch (sc->proto_dlcr6 & FE_D6_SBW) {
305 		case FE_D6_SBW_BYTE:
306 			sbw = 8;
307 			break;
308 		case FE_D6_SBW_WORD:
309 			sbw = 16;
310 			break;
311 		}
312 		switch (sc->proto_dlcr6 & FE_D6_SRAM) {
313 		case FE_D6_SRAM_100ns:
314 			ram = 100;
315 			break;
316 		case FE_D6_SRAM_150ns:
317 			ram = 150;
318 			break;
319 		}
320 		aprint_debug_dev(sc->sc_dev,
321 		    "SRAM %dKB %dbit %dns, TXB %dKBx2, %dbit I/O\n",
322 		    buf, bbw, ram, txb, sbw);
323 	}
324 #endif
325 
326 	/* The attach is successful. */
327 	sc->sc_stat |= FE_STAT_ATTACHED;
328 }
329 
330 /*
331  * Media change callback.
332  */
333 int
334 mb86960_mediachange(struct ifnet *ifp)
335 {
336 	struct mb86960_softc *sc = ifp->if_softc;
337 
338 	if (sc->sc_mediachange)
339 		return (*sc->sc_mediachange)(sc);
340 	return 0;
341 }
342 
343 /*
344  * Media status callback.
345  */
346 void
347 mb86960_mediastatus(struct ifnet *ifp, struct ifmediareq *ifmr)
348 {
349 	struct mb86960_softc *sc = ifp->if_softc;
350 
351 	if ((sc->sc_stat & FE_STAT_ENABLED) == 0) {
352 		ifmr->ifm_active = IFM_ETHER | IFM_NONE;
353 		ifmr->ifm_status = 0;
354 		return;
355 	}
356 
357 	if (sc->sc_mediastatus)
358 		(*sc->sc_mediastatus)(sc, ifmr);
359 }
360 
361 /*
362  * Reset interface.
363  */
364 void
365 mb86960_reset(struct mb86960_softc *sc)
366 {
367 	int s;
368 
369 	s = splnet();
370 	mb86960_stop(sc);
371 	mb86960_init(sc);
372 	splx(s);
373 }
374 
375 /*
376  * Stop everything on the interface.
377  *
378  * All buffered packets, both transmitting and receiving,
379  * if any, will be lost by stopping the interface.
380  */
381 void
382 mb86960_stop(struct mb86960_softc *sc)
383 {
384 	bus_space_tag_t bst = sc->sc_bst;
385 	bus_space_handle_t bsh = sc->sc_bsh;
386 
387 #if FE_DEBUG >= 3
388 	log(LOG_INFO, "%s: top of mb86960_stop()\n", device_xname(sc->sc_dev));
389 	mb86960_dump(LOG_INFO, sc);
390 #endif
391 
392 	/* Disable interrupts. */
393 	bus_space_write_1(bst, bsh, FE_DLCR2, 0x00);
394 	bus_space_write_1(bst, bsh, FE_DLCR3, 0x00);
395 
396 	/* Stop interface hardware. */
397 	delay(200);
398 	bus_space_write_1(bst, bsh, FE_DLCR6,
399 	    sc->proto_dlcr6 | FE_D6_DLC_DISABLE);
400 	delay(200);
401 
402 	/* Clear all interrupt status. */
403 	bus_space_write_1(bst, bsh, FE_DLCR0, 0xFF);
404 	bus_space_write_1(bst, bsh, FE_DLCR1, 0xFF);
405 
406 	/* Put the chip in stand-by mode. */
407 	delay(200);
408 	bus_space_write_1(bst, bsh, FE_DLCR7,
409 	    sc->proto_dlcr7 | FE_D7_POWER_DOWN);
410 	delay(200);
411 
412 	/* MAR loading can be delayed. */
413 	sc->filter_change = 0;
414 
415 	/* Call a hook. */
416 	if (sc->stop_card)
417 		(*sc->stop_card)(sc);
418 
419 #if FE_DEBUG >= 3
420 	log(LOG_INFO, "%s: end of mb86960_stop()\n", sc->sc_dev));
421 	mb86960_dump(LOG_INFO, sc);
422 #endif
423 }
424 
425 /*
426  * Device timeout/watchdog routine. Entered if the device neglects to
427  * generate an interrupt after a transmit has been started on it.
428  */
429 void
430 mb86960_watchdog(struct ifnet *ifp)
431 {
432 	struct mb86960_softc *sc = ifp->if_softc;
433 
434 	log(LOG_ERR, "%s: device timeout\n", device_xname(sc->sc_dev));
435 #if FE_DEBUG >= 3
436 	mb86960_dump(LOG_INFO, sc);
437 #endif
438 
439 	/* Record how many packets are lost by this accident. */
440 	sc->sc_ec.ec_if.if_oerrors += sc->txb_sched + sc->txb_count;
441 
442 	mb86960_reset(sc);
443 }
444 
445 /*
446  * Drop (skip) a packet from receive buffer in 86960 memory.
447  */
448 static inline void
449 mb86960_droppacket(struct mb86960_softc *sc)
450 {
451 	bus_space_tag_t bst = sc->sc_bst;
452 	bus_space_handle_t bsh = sc->sc_bsh;
453 
454 	bus_space_write_1(bst, bsh, FE_BMPR14, FE_B14_FILTER | FE_B14_SKIP);
455 }
456 
457 /*
458  * Initialize device.
459  */
460 void
461 mb86960_init(struct mb86960_softc *sc)
462 {
463 	bus_space_tag_t bst = sc->sc_bst;
464 	bus_space_handle_t bsh = sc->sc_bsh;
465 	struct ifnet *ifp = &sc->sc_ec.ec_if;
466 	int i;
467 
468 #if FE_DEBUG >= 3
469 	log(LOG_INFO, "%s: top of mb86960_init()\n", device_xname(sc->sc_dev));
470 	mb86960_dump(LOG_INFO, sc);
471 #endif
472 
473 	/* Reset transmitter flags. */
474 	ifp->if_flags &= ~IFF_OACTIVE;
475 	ifp->if_timer = 0;
476 
477 	sc->txb_free = sc->txb_size;
478 	sc->txb_count = 0;
479 	sc->txb_sched = 0;
480 
481 	/* Do any card-specific initialization, if applicable. */
482 	if (sc->init_card)
483 		(*sc->init_card)(sc);
484 
485 #if FE_DEBUG >= 3
486 	log(LOG_INFO, "%s: after init hook\n", device_xname(sc->sc_dev));
487 	mb86960_dump(LOG_INFO, sc);
488 #endif
489 
490 	/*
491 	 * Make sure to disable the chip, also.
492 	 * This may also help re-programming the chip after
493 	 * hot insertion of PCMCIAs.
494 	 */
495 	bus_space_write_1(bst, bsh, FE_DLCR6,
496 	    sc->proto_dlcr6 | FE_D6_DLC_DISABLE);
497 	delay(200);
498 
499 	/* Power up the chip and select register bank for DLCRs. */
500 	bus_space_write_1(bst, bsh, FE_DLCR7,
501 	    sc->proto_dlcr7 | FE_D7_RBS_DLCR | FE_D7_POWER_UP);
502 	delay(200);
503 
504 	/* Feed the station address. */
505 	bus_space_write_region_1(bst, bsh, FE_DLCR8,
506 	    sc->sc_enaddr, ETHER_ADDR_LEN);
507 
508 	/* Select the BMPR bank for runtime register access. */
509 	bus_space_write_1(bst, bsh, FE_DLCR7,
510 	    sc->proto_dlcr7 | FE_D7_RBS_BMPR | FE_D7_POWER_UP);
511 
512 	/* Initialize registers. */
513 	bus_space_write_1(bst, bsh, FE_DLCR0, 0xFF);	/* Clear all bits. */
514 	bus_space_write_1(bst, bsh, FE_DLCR1, 0xFF);	/* ditto. */
515 	bus_space_write_1(bst, bsh, FE_DLCR2, 0x00);
516 	bus_space_write_1(bst, bsh, FE_DLCR3, 0x00);
517 	bus_space_write_1(bst, bsh, FE_DLCR4, sc->proto_dlcr4);
518 	bus_space_write_1(bst, bsh, FE_DLCR5, sc->proto_dlcr5);
519 	bus_space_write_1(bst, bsh, FE_BMPR10, 0x00);
520 	bus_space_write_1(bst, bsh, FE_BMPR11, FE_B11_CTRL_SKIP);
521 	bus_space_write_1(bst, bsh, FE_BMPR12, 0x00);
522 	bus_space_write_1(bst, bsh, FE_BMPR13, sc->proto_bmpr13);
523 	bus_space_write_1(bst, bsh, FE_BMPR14, FE_B14_FILTER);
524 	bus_space_write_1(bst, bsh, FE_BMPR15, 0x00);
525 
526 #if FE_DEBUG >= 3
527 	log(LOG_INFO, "%s: just before enabling DLC\n",
528 	    device_xname(sc->sc_dev));
529 	mb86960_dump(LOG_INFO, sc);
530 #endif
531 
532 	/* Enable interrupts. */
533 	bus_space_write_1(bst, bsh, FE_DLCR2, FE_TMASK);
534 	bus_space_write_1(bst, bsh, FE_DLCR3, FE_RMASK);
535 
536 	/* Enable transmitter and receiver. */
537 	delay(200);
538 	bus_space_write_1(bst, bsh, FE_DLCR6,
539 	    sc->proto_dlcr6 | FE_D6_DLC_ENABLE);
540 	delay(200);
541 
542 #if FE_DEBUG >= 3
543 	log(LOG_INFO, "%s: just after enabling DLC\n",
544 	    device_xname(sc->sc_dev));
545 	mb86960_dump(LOG_INFO, sc);
546 #endif
547 
548 	/*
549 	 * Make sure to empty the receive buffer.
550 	 *
551 	 * This may be redundant, but *if* the receive buffer were full
552 	 * at this point, the driver would hang.  I have experienced
553 	 * some strange hangups just after UP.  I hope the following
554 	 * code solve the problem.
555 	 *
556 	 * I have changed the order of hardware initialization.
557 	 * I think the receive buffer cannot have any packets at this
558 	 * point in this version.  The following code *must* be
559 	 * redundant now.  FIXME.
560 	 */
561 	for (i = 0; i < FE_MAX_RECV_COUNT; i++) {
562 		if (bus_space_read_1(bst, bsh, FE_DLCR5) & FE_D5_BUFEMP)
563 			break;
564 		mb86960_droppacket(sc);
565 	}
566 #if FE_DEBUG >= 1
567 	if (i >= FE_MAX_RECV_COUNT)
568 		log(LOG_ERR, "%s: cannot empty receive buffer\n",
569 		    device_xname(sc->sc_dev));
570 #endif
571 #if FE_DEBUG >= 3
572 	if (i < FE_MAX_RECV_COUNT)
573 		log(LOG_INFO, "%s: receive buffer emptied (%d)\n",
574 		    device_xname(sc->sc_dev), i);
575 #endif
576 
577 #if FE_DEBUG >= 3
578 	log(LOG_INFO, "%s: after ERB loop\n", device_xname(sc->sc_dev));
579 	mb86960_dump(LOG_INFO, sc);
580 #endif
581 
582 	/* Do we need this here? */
583 	bus_space_write_1(bst, bsh, FE_DLCR0, 0xFF);	/* Clear all bits. */
584 	bus_space_write_1(bst, bsh, FE_DLCR1, 0xFF);	/* ditto. */
585 
586 #if FE_DEBUG >= 3
587 	log(LOG_INFO, "%s: after FIXME\n", device_xname(sc->sc_dev));
588 	mb86960_dump(LOG_INFO, sc);
589 #endif
590 
591 	/* Set 'running' flag. */
592 	ifp->if_flags |= IFF_RUNNING;
593 
594 	/*
595 	 * At this point, the interface is runnung properly,
596 	 * except that it receives *no* packets.  we then call
597 	 * mb86960_setmode() to tell the chip what packets to be
598 	 * received, based on the if_flags and multicast group
599 	 * list.  It completes the initialization process.
600 	 */
601 	mb86960_setmode(sc);
602 
603 #if FE_DEBUG >= 3
604 	log(LOG_INFO, "%s: after setmode\n", device_xname(sc->sc_dev));
605 	mb86960_dump(LOG_INFO, sc);
606 #endif
607 
608 	/* ...and attempt to start output. */
609 	mb86960_start(ifp);
610 
611 #if FE_DEBUG >= 3
612 	log(LOG_INFO, "%s: end of mb86960_init()\n", device_xname(sc->sc_dev));
613 	mb86960_dump(LOG_INFO, sc);
614 #endif
615 }
616 
617 /*
618  * This routine actually starts the transmission on the interface
619  */
620 static inline void
621 mb86960_xmit(struct mb86960_softc *sc)
622 {
623 	bus_space_tag_t bst = sc->sc_bst;
624 	bus_space_handle_t bsh = sc->sc_bsh;
625 
626 	/*
627 	 * Set a timer just in case we never hear from the board again.
628 	 * We use longer timeout for multiple packet transmission.
629 	 * I'm not sure this timer value is appropriate.  FIXME.
630 	 */
631 	sc->sc_ec.ec_if.if_timer = 1 + sc->txb_count;
632 
633 	/* Update txb variables. */
634 	sc->txb_sched = sc->txb_count;
635 	sc->txb_count = 0;
636 	sc->txb_free = sc->txb_size;
637 
638 #if FE_DELAYED_PADDING
639 	/* Omit the postponed padding process. */
640 	sc->txb_padding = 0;
641 #endif
642 
643 	/* Start transmitter, passing packets in TX buffer. */
644 	bus_space_write_1(bst, bsh, FE_BMPR10, sc->txb_sched | FE_B10_START);
645 }
646 
647 /*
648  * Start output on interface.
649  * We make two assumptions here:
650  *  1) that the current priority is set to splnet _before_ this code
651  *     is called *and* is returned to the appropriate priority after
652  *     return
653  *  2) that the IFF_OACTIVE flag is checked before this code is called
654  *     (i.e. that the output part of the interface is idle)
655  */
656 void
657 mb86960_start(struct ifnet *ifp)
658 {
659 	struct mb86960_softc *sc = ifp->if_softc;
660 	struct mbuf *m;
661 
662 #if FE_DEBUG >= 1
663 	/* Just a sanity check. */
664 	if ((sc->txb_count == 0) != (sc->txb_free == sc->txb_size)) {
665 		/*
666 		 * Txb_count and txb_free co-works to manage the
667 		 * transmission buffer.  Txb_count keeps track of the
668 		 * used potion of the buffer, while txb_free does unused
669 		 * potion.  So, as long as the driver runs properly,
670 		 * txb_count is zero if and only if txb_free is same
671 		 * as txb_size (which represents whole buffer.)
672 		 */
673 		log(LOG_ERR, "%s: inconsistent txb variables (%d, %d)\n",
674 		    device_xname(sc->sc_dev), sc->txb_count, sc->txb_free);
675 		/*
676 		 * So, what should I do, then?
677 		 *
678 		 * We now know txb_count and txb_free contradicts.  We
679 		 * cannot, however, tell which is wrong.  More
680 		 * over, we cannot peek 86960 transmission buffer or
681 		 * reset the transmission buffer.  (In fact, we can
682 		 * reset the entire interface.  I don't want to do it.)
683 		 *
684 		 * If txb_count is incorrect, leaving it as is will cause
685 		 * sending of gabages after next interrupt.  We have to
686 		 * avoid it.  Hence, we reset the txb_count here.  If
687 		 * txb_free was incorrect, resetting txb_count just loose
688 		 * some packets.  We can live with it.
689 		 */
690 		sc->txb_count = 0;
691 	}
692 #endif
693 
694 #if FE_DEBUG >= 1
695 	/*
696 	 * First, see if there are buffered packets and an idle
697 	 * transmitter - should never happen at this point.
698 	 */
699 	if ((sc->txb_count > 0) && (sc->txb_sched == 0)) {
700 		log(LOG_ERR, "%s: transmitter idle with %d buffered packets\n",
701 		    device_xname(sc->sc_dev), sc->txb_count);
702 		mb86960_xmit(sc);
703 	}
704 #endif
705 
706 	/*
707 	 * Stop accepting more transmission packets temporarily, when
708 	 * a filter change request is delayed.  Updating the MARs on
709 	 * 86960 flushes the transmisstion buffer, so it is delayed
710 	 * until all buffered transmission packets have been sent
711 	 * out.
712 	 */
713 	if (sc->filter_change) {
714 		/*
715 		 * Filter change request is delayed only when the DLC is
716 		 * working.  DLC soon raise an interrupt after finishing
717 		 * the work.
718 		 */
719 		goto indicate_active;
720 	}
721 
722 	for (;;) {
723 		/*
724 		 * See if there is room to put another packet in the buffer.
725 		 * We *could* do better job by peeking the send queue to
726 		 * know the length of the next packet.  Current version just
727 		 * tests against the worst case (i.e., longest packet).  FIXME.
728 		 *
729 		 * When adding the packet-peek feature, don't forget adding a
730 		 * test on txb_count against QUEUEING_MAX.
731 		 * There is a little chance the packet count exceeds
732 		 * the limit.  Assume transmission buffer is 8KB (2x8KB
733 		 * configuration) and an application sends a bunch of small
734 		 * (i.e., minimum packet sized) packets rapidly.  An 8KB
735 		 * buffer can hold 130 blocks of 62 bytes long...
736 		 */
737 		if (sc->txb_free <
738 		    (ETHER_MAX_LEN - ETHER_CRC_LEN) + FE_TXLEN_SIZE) {
739 			/* No room. */
740 			goto indicate_active;
741 		}
742 
743 #if FE_SINGLE_TRANSMISSION
744 		if (sc->txb_count > 0) {
745 			/* Just one packet per a transmission buffer. */
746 			goto indicate_active;
747 		}
748 #endif
749 
750 		/*
751 		 * Get the next mbuf chain for a packet to send.
752 		 */
753 		IFQ_DEQUEUE(&ifp->if_snd, m);
754 		if (m == 0) {
755 			/* No more packets to send. */
756 			goto indicate_inactive;
757 		}
758 
759 #if NBPFILTER > 0
760 		/* Tap off here if there is a BPF listener. */
761 		if (ifp->if_bpf)
762 			bpf_mtap(ifp->if_bpf, m);
763 #endif
764 
765 		/*
766 		 * Copy the mbuf chain into the transmission buffer.
767 		 * txb_* variables are updated as necessary.
768 		 */
769 		mb86960_write_mbufs(sc, m);
770 
771 		m_freem(m);
772 
773 		/* Start transmitter if it's idle. */
774 		if (sc->txb_sched == 0)
775 			mb86960_xmit(sc);
776 	}
777 
778 indicate_inactive:
779 	/*
780 	 * We are using the !OACTIVE flag to indicate to
781 	 * the outside world that we can accept an
782 	 * additional packet rather than that the
783 	 * transmitter is _actually_ active.  Indeed, the
784 	 * transmitter may be active, but if we haven't
785 	 * filled all the buffers with data then we still
786 	 * want to accept more.
787 	 */
788 	ifp->if_flags &= ~IFF_OACTIVE;
789 	return;
790 
791 indicate_active:
792 	/*
793 	 * The transmitter is active, and there are no room for
794 	 * more outgoing packets in the transmission buffer.
795 	 */
796 	ifp->if_flags |= IFF_OACTIVE;
797 	return;
798 }
799 
800 /*
801  * Transmission interrupt handler
802  * The control flow of this function looks silly.  FIXME.
803  */
804 void
805 mb86960_tint(struct mb86960_softc *sc, uint8_t tstat)
806 {
807 	bus_space_tag_t bst = sc->sc_bst;
808 	bus_space_handle_t bsh = sc->sc_bsh;
809 	struct ifnet *ifp = &sc->sc_ec.ec_if;
810 	int left;
811 	int col;
812 
813 	/*
814 	 * Handle "excessive collision" interrupt.
815 	 */
816 	if (tstat & FE_D0_COLL16) {
817 		/*
818 		 * Find how many packets (including this collided one)
819 		 * are left unsent in transmission buffer.
820 		 */
821 		left = bus_space_read_1(bst, bsh, FE_BMPR10);
822 
823 #if FE_DEBUG >= 2
824 		log(LOG_WARNING, "%s: excessive collision (%d/%d)\n",
825 		    device_xname(sc->sc_dev), left, sc->txb_sched);
826 #endif
827 #if FE_DEBUG >= 3
828 		mb86960_dump(LOG_INFO, sc);
829 #endif
830 
831 		/*
832 		 * Update statistics.
833 		 */
834 		ifp->if_collisions += 16;
835 		ifp->if_oerrors++;
836 		ifp->if_opackets += sc->txb_sched - left;
837 
838 		/*
839 		 * Collision statistics has been updated.
840 		 * Clear the collision flag on 86960 now to avoid confusion.
841 		 */
842 		bus_space_write_1(bst, bsh, FE_DLCR0, FE_D0_COLLID);
843 
844 		/*
845 		 * Restart transmitter, skipping the
846 		 * collided packet.
847 		 *
848 		 * We *must* skip the packet to keep network running
849 		 * properly.  Excessive collision error is an
850 		 * indication of the network overload.  If we
851 		 * tried sending the same packet after excessive
852 		 * collision, the network would be filled with
853 		 * out-of-time packets.  Packets belonging
854 		 * to reliable transport (such as TCP) are resent
855 		 * by some upper layer.
856 		 */
857 		bus_space_write_1(bst, bsh, FE_BMPR11,
858 		    FE_B11_CTRL_SKIP | FE_B11_MODE1);
859 		sc->txb_sched = left - 1;
860 	}
861 
862 	/*
863 	 * Handle "transmission complete" interrupt.
864 	 */
865 	if (tstat & FE_D0_TXDONE) {
866 		/*
867 		 * Add in total number of collisions on last
868 		 * transmission.  We also clear "collision occurred" flag
869 		 * here.
870 		 *
871 		 * 86960 has a design flow on collision count on multiple
872 		 * packet transmission.  When we send two or more packets
873 		 * with one start command (that's what we do when the
874 		 * transmission queue is clauded), 86960 informs us number
875 		 * of collisions occurred on the last packet on the
876 		 * transmission only.  Number of collisions on previous
877 		 * packets are lost.  I have told that the fact is clearly
878 		 * stated in the Fujitsu document.
879 		 *
880 		 * I considered not to mind it seriously.  Collision
881 		 * count is not so important, anyway.  Any comments?  FIXME.
882 		 */
883 
884 		if (bus_space_read_1(bst, bsh, FE_DLCR0) & FE_D0_COLLID) {
885 			/* Clear collision flag. */
886 			bus_space_write_1(bst, bsh, FE_DLCR0, FE_D0_COLLID);
887 
888 			/* Extract collision count from 86960. */
889 			col = bus_space_read_1(bst, bsh, FE_DLCR4) & FE_D4_COL;
890 			if (col == 0) {
891 				/*
892 				 * Status register indicates collisions,
893 				 * while the collision count is zero.
894 				 * This can happen after multiple packet
895 				 * transmission, indicating that one or more
896 				 * previous packet(s) had been collided.
897 				 *
898 				 * Since the accurate number of collisions
899 				 * has been lost, we just guess it as 1;
900 				 * Am I too optimistic?  FIXME.
901 				 */
902 				col = 1;
903 			} else
904 				col >>= FE_D4_COL_SHIFT;
905 			ifp->if_collisions += col;
906 #if FE_DEBUG >= 4
907 			log(LOG_WARNING, "%s: %d collision%s (%d)\n",
908 			    device_xname(sc->sc_dev), col, col == 1 ? "" : "s",
909 			    sc->txb_sched);
910 #endif
911 		}
912 
913 		/*
914 		 * Update total number of successfully
915 		 * transmitted packets.
916 		 */
917 		ifp->if_opackets += sc->txb_sched;
918 		sc->txb_sched = 0;
919 	}
920 
921 	if (sc->txb_sched == 0) {
922 		/*
923 		 * The transmitter is no more active.
924 		 * Reset output active flag and watchdog timer.
925 		 */
926 		ifp->if_flags &= ~IFF_OACTIVE;
927 		ifp->if_timer = 0;
928 
929 		/*
930 		 * If more data is ready to transmit in the buffer, start
931 		 * transmitting them.  Otherwise keep transmitter idle,
932 		 * even if more data is queued.  This gives receive
933 		 * process a slight priority.
934 		 */
935 		if (sc->txb_count > 0)
936 			mb86960_xmit(sc);
937 	}
938 }
939 
940 /*
941  * Ethernet interface receiver interrupt.
942  */
943 void
944 mb86960_rint(struct mb86960_softc *sc, uint8_t rstat)
945 {
946 	bus_space_tag_t bst = sc->sc_bst;
947 	bus_space_handle_t bsh = sc->sc_bsh;
948 	struct ifnet *ifp = &sc->sc_ec.ec_if;
949 	u_int status, len;
950 	int i;
951 
952 	/*
953 	 * Update statistics if this interrupt is caused by an error.
954 	 */
955 	if (rstat & (FE_D1_OVRFLO | FE_D1_CRCERR | FE_D1_ALGERR |
956 	    FE_D1_SRTPKT)) {
957 #if FE_DEBUG >= 3
958 		char sbuf[sizeof(FE_D1_ERRBITS) + 64];
959 
960 		snprintb(sbuf, sizeof(sbuf), FE_D1_ERRBITS, rstat);
961 		log(LOG_WARNING, "%s: receive error: %s\n",
962 		    device_xname(sc->sc_dev), sbuf);
963 #endif
964 		ifp->if_ierrors++;
965 	}
966 
967 	/*
968 	 * MB86960 has a flag indicating "receive queue empty."
969 	 * We just loop checking the flag to pull out all received
970 	 * packets.
971 	 *
972 	 * We limit the number of iterrations to avoid infinite loop.
973 	 * It can be caused by a very slow CPU (some broken
974 	 * peripheral may insert incredible number of wait cycles)
975 	 * or, worse, by a broken MB86960 chip.
976 	 */
977 	for (i = 0; i < FE_MAX_RECV_COUNT; i++) {
978 		/* Stop the iterration if 86960 indicates no packets. */
979 		if (bus_space_read_1(bst, bsh, FE_DLCR5) & FE_D5_BUFEMP)
980 			break;
981 
982 		/*
983 		 * Extract receive packet status from the receive
984 		 * packet header.
985 		 */
986 		if (sc->sc_flags & FE_FLAGS_SBW_BYTE) {
987 			status = bus_space_read_1(bst, bsh, FE_BMPR8);
988 			(void)bus_space_read_1(bst, bsh, FE_BMPR8);
989 		} else
990 			status = bus_space_read_2(bst, bsh, FE_BMPR8);
991 
992 #if FE_DEBUG >= 4
993 		log(LOG_INFO, "%s: receive status = %02x\n",
994 		    device_xname(sc->sc_dev), status);
995 #endif
996 
997 		/*
998 		 * If there was an error, update statistics and drop
999 		 * the packet, unless the interface is in promiscuous
1000 		 * mode.
1001 		 */
1002 		if ((status & FE_RXSTAT_GOODPKT) == 0) {
1003 			if ((ifp->if_flags & IFF_PROMISC) == 0) {
1004 				ifp->if_ierrors++;
1005 				mb86960_droppacket(sc);
1006 				continue;
1007 			}
1008 		}
1009 
1010 		/*
1011 		 * Extract the packet length from the receive packet header.
1012 		 * It is a sum of a header (14 bytes) and a payload.
1013 		 * CRC has been stripped off by the 86960.
1014 		 */
1015 		if (sc->sc_flags & FE_FLAGS_SBW_BYTE) {
1016 			len  = bus_space_read_1(bst, bsh, FE_BMPR8);
1017 			len |= bus_space_read_1(bst, bsh, FE_BMPR8) << 8;
1018 		} else
1019 			len = bus_space_read_2(bst, bsh, FE_BMPR8);
1020 
1021 		/*
1022 		 * MB86965 checks the packet length and drop big packet
1023 		 * before passing it to us.  There are no chance we can
1024 		 * get [crufty] packets.  Hence, if the length exceeds
1025 		 * the specified limit, it means some serious failure,
1026 		 * such as out-of-sync on receive buffer management.
1027 		 *
1028 		 * Is this statement true?  FIXME.
1029 		 */
1030 		if (len > (ETHER_MAX_LEN - ETHER_CRC_LEN) ||
1031 		    len < ETHER_HDR_LEN) {
1032 #if FE_DEBUG >= 2
1033 			log(LOG_WARNING,
1034 			    "%s: received a %s packet? (%u bytes)\n",
1035 			    device_xname(sc->sc_dev),
1036 			    len < ETHER_HDR_LEN ? "partial" : "big", len);
1037 #endif
1038 			ifp->if_ierrors++;
1039 			mb86960_droppacket(sc);
1040 			continue;
1041 		}
1042 
1043 		/*
1044 		 * Check for a short (RUNT) packet.  We *do* check
1045 		 * but do nothing other than print a message.
1046 		 * Short packets are illegal, but does nothing bad
1047 		 * if it carries data for upper layer.
1048 		 */
1049 #if FE_DEBUG >= 2
1050 		if (len < (ETHER_MIN_LEN - ETHER_CRC_LEN)) {
1051 			log(LOG_WARNING,
1052 			    "%s: received a short packet? (%u bytes)\n",
1053 			    device_xname(sc->sc_dev), len);
1054 		}
1055 #endif
1056 
1057 		/*
1058 		 * Go get a packet.
1059 		 */
1060 		if (mb86960_get_packet(sc, len) == 0) {
1061 			/* Skip a packet, updating statistics. */
1062 #if FE_DEBUG >= 2
1063 			log(LOG_WARNING,
1064 			    "%s: out of mbufs; dropping packet (%u bytes)\n",
1065 			    device_xname(sc->sc_dev), len);
1066 #endif
1067 			ifp->if_ierrors++;
1068 			mb86960_droppacket(sc);
1069 
1070 			/*
1071 			 * We stop receiving packets, even if there are
1072 			 * more in the buffer.  We hope we can get more
1073 			 * mbufs next time.
1074 			 */
1075 			return;
1076 		}
1077 
1078 		/* Successfully received a packet.  Update stat. */
1079 		ifp->if_ipackets++;
1080 	}
1081 }
1082 
1083 /*
1084  * Ethernet interface interrupt processor
1085  */
1086 int
1087 mb86960_intr(void *arg)
1088 {
1089 	struct mb86960_softc *sc = arg;
1090 	bus_space_tag_t bst = sc->sc_bst;
1091 	bus_space_handle_t bsh = sc->sc_bsh;
1092 	struct ifnet *ifp = &sc->sc_ec.ec_if;
1093 	uint8_t tstat, rstat;
1094 
1095 	if ((sc->sc_stat & FE_STAT_ENABLED) == 0 ||
1096 	    !device_is_active(sc->sc_dev))
1097 		return 0;
1098 
1099 #if FE_DEBUG >= 4
1100 	log(LOG_INFO, "%s: mb86960_intr()\n", device_xname(sc->sc_dev));
1101 	mb86960_dump(LOG_INFO, sc);
1102 #endif
1103 
1104 	/*
1105 	 * Get interrupt conditions, masking unneeded flags.
1106 	 */
1107 	tstat = bus_space_read_1(bst, bsh, FE_DLCR0) & FE_TMASK;
1108 	rstat = bus_space_read_1(bst, bsh, FE_DLCR1) & FE_RMASK;
1109 	if (tstat == 0 && rstat == 0)
1110 		return 0;
1111 
1112 	/*
1113 	 * Loop until there are no more new interrupt conditions.
1114 	 */
1115 	for (;;) {
1116 		/*
1117 		 * Reset the conditions we are acknowledging.
1118 		 */
1119 		bus_space_write_1(bst, bsh, FE_DLCR0, tstat);
1120 		bus_space_write_1(bst, bsh, FE_DLCR1, rstat);
1121 
1122 		/*
1123 		 * Handle transmitter interrupts. Handle these first because
1124 		 * the receiver will reset the board under some conditions.
1125 		 */
1126 		if (tstat != 0)
1127 			mb86960_tint(sc, tstat);
1128 
1129 		/*
1130 		 * Handle receiver interrupts.
1131 		 */
1132 		if (rstat != 0)
1133 			mb86960_rint(sc, rstat);
1134 
1135 		/*
1136 		 * Update the multicast address filter if it is
1137 		 * needed and possible.  We do it now, because
1138 		 * we can make sure the transmission buffer is empty,
1139 		 * and there is a good chance that the receive queue
1140 		 * is empty.  It will minimize the possibility of
1141 		 * packet lossage.
1142 		 */
1143 		if (sc->filter_change &&
1144 		    sc->txb_count == 0 && sc->txb_sched == 0) {
1145 			mb86960_loadmar(sc);
1146 			ifp->if_flags &= ~IFF_OACTIVE;
1147 		}
1148 
1149 		/*
1150 		 * If it looks like the transmitter can take more data,
1151 		 * attempt to start output on the interface. This is done
1152 		 * after handling the receiver interrupt to give the
1153 		 * receive operation priority.
1154 		 */
1155 		if ((ifp->if_flags & IFF_OACTIVE) == 0)
1156 			mb86960_start(ifp);
1157 
1158 #if NRND > 0
1159 		if (rstat != 0 || tstat != 0)
1160 			rnd_add_uint32(&sc->rnd_source, rstat + tstat);
1161 #endif
1162 
1163 		/*
1164 		 * Get interrupt conditions, masking unneeded flags.
1165 		 */
1166 		tstat = bus_space_read_1(bst, bsh, FE_DLCR0) & FE_TMASK;
1167 		rstat = bus_space_read_1(bst, bsh, FE_DLCR1) & FE_RMASK;
1168 		if (tstat == 0 && rstat == 0)
1169 			return 1;
1170 	}
1171 }
1172 
1173 /*
1174  * Process an ioctl request.  This code needs some work - it looks pretty ugly.
1175  */
1176 int
1177 mb86960_ioctl(struct ifnet *ifp, u_long cmd, void *data)
1178 {
1179 	struct mb86960_softc *sc = ifp->if_softc;
1180 	struct ifaddr *ifa = (struct ifaddr *)data;
1181 	struct ifreq *ifr = (struct ifreq *)data;
1182 	int s, error = 0;
1183 
1184 #if FE_DEBUG >= 3
1185 	log(LOG_INFO, "%s: ioctl(%lx)\n", device_xname(sc->sc_dev), cmd);
1186 #endif
1187 
1188 	s = splnet();
1189 
1190 	switch (cmd) {
1191 	case SIOCINITIFADDR:
1192 		if ((error = mb86960_enable(sc)) != 0)
1193 			break;
1194 		ifp->if_flags |= IFF_UP;
1195 
1196 		mb86960_init(sc);
1197 		switch (ifa->ifa_addr->sa_family) {
1198 #ifdef INET
1199 		case AF_INET:
1200 			arp_ifinit(ifp, ifa);
1201 			break;
1202 #endif
1203 		default:
1204 			break;
1205 		}
1206 		break;
1207 
1208 	case SIOCSIFFLAGS:
1209 		if ((error = ifioctl_common(ifp, cmd, data)) != 0)
1210 			break;
1211 		/* XXX re-use ether_ioctl() */
1212 		switch (ifp->if_flags & (IFF_UP|IFF_RUNNING)) {
1213 		case IFF_RUNNING:
1214 			/*
1215 			 * If interface is marked down and it is running, then
1216 			 * stop it.
1217 			 */
1218 			mb86960_stop(sc);
1219 			ifp->if_flags &= ~IFF_RUNNING;
1220 			mb86960_disable(sc);
1221 			break;
1222 		case IFF_UP:
1223 			/*
1224 			 * If interface is marked up and it is stopped, then
1225 			 * start it.
1226 			 */
1227 			if ((error = mb86960_enable(sc)) != 0)
1228 				break;
1229 			mb86960_init(sc);
1230 			break;
1231 		case IFF_UP|IFF_RUNNING:
1232 			/*
1233 			 * Reset the interface to pick up changes in any other
1234 			 * flags that affect hardware registers.
1235 			 */
1236 			mb86960_setmode(sc);
1237 			break;
1238 		case 0:
1239 			break;
1240 		}
1241 #if FE_DEBUG >= 1
1242 		/* "ifconfig fe0 debug" to print register dump. */
1243 		if (ifp->if_flags & IFF_DEBUG) {
1244 			log(LOG_INFO, "%s: SIOCSIFFLAGS(DEBUG)\n",
1245 			    device_xname(sc->sc_dev));
1246 			mb86960_dump(LOG_DEBUG, sc);
1247 		}
1248 #endif
1249 		break;
1250 
1251 	case SIOCADDMULTI:
1252 	case SIOCDELMULTI:
1253 		if ((sc->sc_stat & FE_STAT_ENABLED) == 0) {
1254 			error = EIO;
1255 			break;
1256 		}
1257 
1258 		/* Update our multicast list. */
1259 		if ((error = ether_ioctl(ifp, cmd, data)) == ENETRESET) {
1260 			/*
1261 			 * Multicast list has changed; set the hardware filter
1262 			 * accordingly.
1263 			 */
1264 			if (ifp->if_flags & IFF_RUNNING)
1265 				mb86960_setmode(sc);
1266 			error = 0;
1267 		}
1268 		break;
1269 
1270 	case SIOCGIFMEDIA:
1271 	case SIOCSIFMEDIA:
1272 		error = ifmedia_ioctl(ifp, ifr, &sc->sc_media, cmd);
1273 		break;
1274 
1275 	default:
1276 		error = ether_ioctl(ifp, cmd, data);
1277 		break;
1278 	}
1279 
1280 	splx(s);
1281 	return error;
1282 }
1283 
1284 /*
1285  * Retrieve packet from receive buffer and send to the next level up via
1286  * ether_input(). If there is a BPF listener, give a copy to BPF, too.
1287  * Returns 0 if success, -1 if error (i.e., mbuf allocation failure).
1288  */
1289 int
1290 mb86960_get_packet(struct mb86960_softc *sc, u_int len)
1291 {
1292 	bus_space_tag_t bst = sc->sc_bst;
1293 	bus_space_handle_t bsh = sc->sc_bsh;
1294 	struct ifnet *ifp = &sc->sc_ec.ec_if;
1295 	struct mbuf *m;
1296 
1297 	/* Allocate a header mbuf. */
1298 	MGETHDR(m, M_DONTWAIT, MT_DATA);
1299 	if (m == 0)
1300 		return 0;
1301 	m->m_pkthdr.rcvif = ifp;
1302 	m->m_pkthdr.len = len;
1303 
1304 	/* The following silliness is to make NFS happy. */
1305 #define	EROUND	((sizeof(struct ether_header) + 3) & ~3)
1306 #define	EOFF	(EROUND - sizeof(struct ether_header))
1307 
1308 	/*
1309 	 * Our strategy has one more problem.  There is a policy on
1310 	 * mbuf cluster allocation.  It says that we must have at
1311 	 * least MINCLSIZE (208 bytes) to allocate a cluster.  For a
1312 	 * packet of a size between (MHLEN - 2) to (MINCLSIZE - 2),
1313 	 * our code violates the rule...
1314 	 * On the other hand, the current code is short, simple,
1315 	 * and fast, however.  It does no harmful thing, just waists
1316 	 * some memory.  Any comments?  FIXME.
1317 	 */
1318 
1319 	/* Attach a cluster if this packet doesn't fit in a normal mbuf. */
1320 	if (len > MHLEN - EOFF) {
1321 		MCLGET(m, M_DONTWAIT);
1322 		if ((m->m_flags & M_EXT) == 0) {
1323 			m_freem(m);
1324 			return 0;
1325 		}
1326 	}
1327 
1328 	/*
1329 	 * The following assumes there is room for the ether header in the
1330 	 * header mbuf.
1331 	 */
1332 	m->m_data += EOFF;
1333 
1334 	/* Set the length of this packet. */
1335 	m->m_len = len;
1336 
1337 	/* Get a packet. */
1338 	if (sc->sc_flags & FE_FLAGS_SBW_BYTE)
1339 		bus_space_read_multi_1(bst, bsh, FE_BMPR8,
1340 		    mtod(m, uint8_t *), len);
1341 	else
1342 		bus_space_read_multi_stream_2(bst, bsh, FE_BMPR8,
1343 		    mtod(m, uint16_t *), (len + 1) >> 1);
1344 
1345 #if NBPFILTER > 0
1346 	/*
1347 	 * Check if there's a BPF listener on this interface.  If so, hand off
1348 	 * the raw packet to bpf.
1349 	 */
1350 	if (ifp->if_bpf)
1351 		bpf_mtap(ifp->if_bpf, m);
1352 #endif
1353 
1354 	(*ifp->if_input)(ifp, m);
1355 	return 1;
1356 }
1357 
1358 /*
1359  * Write an mbuf chain to the transmission buffer memory using 16 bit PIO.
1360  * Returns number of bytes actually written, including length word.
1361  *
1362  * If an mbuf chain is too long for an Ethernet frame, it is not sent.
1363  * Packets shorter than Ethernet minimum are legal, and we pad them
1364  * before sending out.  An exception is "partial" packets which are
1365  * shorter than mandatory Ethernet header.
1366  *
1367  * I wrote a code for an experimental "delayed padding" technique.
1368  * When employed, it postpones the padding process for short packets.
1369  * If xmit() occurred at the moment, the padding process is omitted, and
1370  * garbages are sent as pad data.  If next packet is stored in the
1371  * transmission buffer before xmit(), write_mbuf() pads the previous
1372  * packet before transmitting new packet.  This *may* gain the
1373  * system performance (slightly).
1374  */
1375 void
1376 mb86960_write_mbufs(struct mb86960_softc *sc, struct mbuf *m)
1377 {
1378 	bus_space_tag_t bst = sc->sc_bst;
1379 	bus_space_handle_t bsh = sc->sc_bsh;
1380 	int totlen, len;
1381 #if FE_DEBUG >= 2
1382 	struct mbuf *mp;
1383 #endif
1384 
1385 #if FE_DELAYED_PADDING
1386 	/* Do the "delayed padding." */
1387 	if (sc->txb_padding > 0) {
1388 		if (sc->sc_flags & FE_FLAGS_SBW_BYTE) {
1389 			for (len = sc->txb_padding; len > 0; len--)
1390 				bus_space_write_1(bst, bsh, FE_BMPR8, 0);
1391 		} else {
1392 			for (len = sc->txb_padding >> 1; len > 0; len--)
1393 				bus_space_write_2(bst, bsh, FE_BMPR8, 0);
1394 		}
1395 		sc->txb_padding = 0;
1396 	}
1397 #endif
1398 
1399 	/* We need to use m->m_pkthdr.len, so require the header */
1400 	if ((m->m_flags & M_PKTHDR) == 0)
1401 	  	panic("mb86960_write_mbufs: no header mbuf");
1402 
1403 #if FE_DEBUG >= 2
1404 	/* First, count up the total number of bytes to copy. */
1405 	for (totlen = 0, mp = m; mp != 0; mp = mp->m_next)
1406 		totlen += mp->m_len;
1407 	/* Check if this matches the one in the packet header. */
1408 	if (totlen != m->m_pkthdr.len)
1409 		log(LOG_WARNING, "%s: packet length mismatch? (%d/%d)\n",
1410 		    device_xname(sc->sc_dev), totlen, m->m_pkthdr.len);
1411 #else
1412 	/* Just use the length value in the packet header. */
1413 	totlen = m->m_pkthdr.len;
1414 #endif
1415 
1416 #if FE_DEBUG >= 1
1417 	/*
1418 	 * Should never send big packets.  If such a packet is passed,
1419 	 * it should be a bug of upper layer.  We just ignore it.
1420 	 * ... Partial (too short) packets, neither.
1421 	 */
1422 	if (totlen > (ETHER_MAX_LEN - ETHER_CRC_LEN) ||
1423 	    totlen < ETHER_HDR_LEN) {
1424 		log(LOG_ERR, "%s: got a %s packet (%u bytes) to send\n",
1425 		    device_xname(sc->sc_dev),
1426 		    totlen < ETHER_HDR_LEN ? "partial" : "big", totlen);
1427 		sc->sc_ec.ec_if.if_oerrors++;
1428 		return;
1429 	}
1430 #endif
1431 
1432 	/*
1433 	 * Put the length word for this frame.
1434 	 * Does 86960 accept odd length?  -- Yes.
1435 	 * Do we need to pad the length to minimum size by ourselves?
1436 	 * -- Generally yes.  But for (or will be) the last
1437 	 * packet in the transmission buffer, we can skip the
1438 	 * padding process.  It may gain performance slightly.  FIXME.
1439 	 */
1440 	len = max(totlen, (ETHER_MIN_LEN - ETHER_CRC_LEN));
1441 	if (sc->sc_flags & FE_FLAGS_SBW_BYTE) {
1442 		bus_space_write_1(bst, bsh, FE_BMPR8, len);
1443 		bus_space_write_1(bst, bsh, FE_BMPR8, len >> 8);
1444 	} else {
1445 		bus_space_write_2(bst, bsh, FE_BMPR8, len);
1446 		/* roundup packet length since we will use word access */
1447 		totlen = (totlen + 1) & ~1;
1448 	}
1449 
1450 	/*
1451 	 * Update buffer status now.
1452 	 * Truncate the length up to an even number
1453 	 * if the chip is set in SBW_WORD mode.
1454 	 */
1455 	sc->txb_free -= FE_TXLEN_SIZE +
1456 	    max(totlen, (ETHER_MIN_LEN - ETHER_CRC_LEN));
1457 	sc->txb_count++;
1458 
1459 #if FE_DELAYED_PADDING
1460 	/* Postpone the packet padding if necessary. */
1461 	if (totlen < (ETHER_MIN_LEN - ETHER_CRC_LEN))
1462 		sc->txb_padding = (ETHER_MIN_LEN - ETHER_CRC_LEN) - totlen;
1463 #endif
1464 
1465 	/*
1466 	 * Transfer the data from mbuf chain to the transmission buffer.
1467 	 * If the MB86960 is configured in word mode, data needs to be
1468 	 * transferred as words, and only words.
1469 	 * So that we require some extra code to patch over odd-length
1470 	 * or unaligned mbufs.
1471 	 */
1472 	if (sc->sc_flags & FE_FLAGS_SBW_BYTE) {
1473 		/* It's simple in byte mode. */
1474 		for (; m != NULL; m = m->m_next) {
1475 			if (m->m_len) {
1476 				bus_space_write_multi_1(bst, bsh, FE_BMPR8,
1477 				    mtod(m, uint8_t *), m->m_len);
1478 			}
1479 		}
1480 	} else {
1481 		/* a bit trickier in word mode. */
1482 		uint8_t *data, savebyte[2];
1483 		int leftover;
1484 
1485 		leftover = 0;
1486 		savebyte[0] = savebyte[1] = 0;
1487 
1488 		for (; m != NULL; m = m->m_next) {
1489 			len = m->m_len;
1490 			if (len == 0)
1491 				continue;
1492 			data = mtod(m, uint8_t *);
1493 			while (len > 0) {
1494 				if (leftover) {
1495 					/*
1496 					 * Data left over (from mbuf or
1497 					 * realignment). Buffer the next
1498 					 * byte, and write it and the
1499 					 * leftover data out.
1500 					 */
1501 					savebyte[1] = *data++;
1502 					len--;
1503 					bus_space_write_stream_2(bst, bsh,
1504 					   FE_BMPR8, *(uint16_t *)savebyte);
1505 					leftover = 0;
1506 				} else if (BUS_SPACE_ALIGNED_POINTER(data,
1507 				    uint16_t) == 0) {
1508 					/*
1509 					 * Unaligned data; buffer the next byte.
1510 					 */
1511 					savebyte[0] = *data++;
1512 					len--;
1513 					leftover = 1;
1514 				} else {
1515 					/*
1516 					 * Aligned data; output contiguous
1517 					 * words as much as we can, then
1518 					 * buffer the remaining byte, if any.
1519 					 */
1520 					leftover = len & 1;
1521 					len &= ~1;
1522 					bus_space_write_multi_stream_2(bst, bsh,
1523 					    FE_BMPR8, (uint16_t *)data,
1524 					    len >> 1);
1525 					data += len;
1526 					if (leftover)
1527 						savebyte[0] = *data++;
1528 					len = 0;
1529 				}
1530 			}
1531 			if (len < 0)
1532 				panic("mb86960_write_mbufs: negative len");
1533 		}
1534 		if (leftover) {
1535 			savebyte[1] = 0;
1536 			bus_space_write_stream_2(bst, bsh, FE_BMPR8,
1537 			    *(uint16_t *)savebyte);
1538 		}
1539 	}
1540 #if FE_DELAYED_PADDING == 0
1541 	/*
1542 	 * Pad the packet to the minimum length if necessary.
1543 	 */
1544 	len = (ETHER_MIN_LEN - ETHER_CRC_LEN) - totlen;
1545 	if (len > 0) {
1546 		if (sc->sc_flags & FE_FLAGS_SBW_BYTE) {
1547 			while (len-- > 0)
1548 				bus_space_write_1(bst, bsh, FE_BMPR8, 0);
1549 		} else {
1550 			len >>= 1;
1551 			while (len-- > 0)
1552 				bus_space_write_2(bst, bsh, FE_BMPR8, 0);
1553 		}
1554 	}
1555 #endif
1556 }
1557 
1558 /*
1559  * Compute the multicast address filter from the
1560  * list of multicast addresses we need to listen to.
1561  */
1562 void
1563 mb86960_getmcaf(struct ethercom *ec, uint8_t *af)
1564 {
1565 	struct ifnet *ifp = &ec->ec_if;
1566 	struct ether_multi *enm;
1567 	uint32_t crc;
1568 	struct ether_multistep step;
1569 
1570 	/*
1571 	 * Set up multicast address filter by passing all multicast addresses
1572 	 * through a crc generator, and then using the high order 6 bits as an
1573 	 * index into the 64 bit logical address filter.  The high order bit
1574 	 * selects the word, while the rest of the bits select the bit within
1575 	 * the word.
1576 	 */
1577 
1578 	if ((ifp->if_flags & IFF_PROMISC) != 0)
1579 		goto allmulti;
1580 
1581 	memset(af, 0, FE_FILTER_LEN);
1582 	ETHER_FIRST_MULTI(step, ec, enm);
1583 	while (enm != NULL) {
1584 		if (memcmp(enm->enm_addrlo, enm->enm_addrhi,
1585 		    sizeof(enm->enm_addrlo)) != 0) {
1586 			/*
1587 			 * We must listen to a range of multicast addresses.
1588 			 * For now, just accept all multicasts, rather than
1589 			 * trying to set only those filter bits needed to match
1590 			 * the range.  (At this time, the only use of address
1591 			 * ranges is for IP multicast routing, for which the
1592 			 * range is big enough to require all bits set.)
1593 			 */
1594 			goto allmulti;
1595 		}
1596 
1597 		crc = ether_crc32_le(enm->enm_addrlo, ETHER_ADDR_LEN);
1598 
1599 		/* Just want the 6 most significant bits. */
1600 		crc >>= 26;
1601 
1602 		/* Turn on the corresponding bit in the filter. */
1603 		af[crc >> 3] |= 1 << (crc & 7);
1604 
1605 		ETHER_NEXT_MULTI(step, enm);
1606 	}
1607 	ifp->if_flags &= ~IFF_ALLMULTI;
1608 	return;
1609 
1610 allmulti:
1611 	ifp->if_flags |= IFF_ALLMULTI;
1612 	memset(af, 0xff, FE_FILTER_LEN);
1613 }
1614 
1615 /*
1616  * Calculate a new "multicast packet filter" and put the 86960
1617  * receiver in appropriate mode.
1618  */
1619 void
1620 mb86960_setmode(struct mb86960_softc *sc)
1621 {
1622 	bus_space_tag_t bst = sc->sc_bst;
1623 	bus_space_handle_t bsh = sc->sc_bsh;
1624 	int flags = sc->sc_ec.ec_if.if_flags;
1625 
1626 	/*
1627 	 * If the interface is not running, we postpone the update
1628 	 * process for receive modes and multicast address filter
1629 	 * until the interface is restarted.  It reduces some
1630 	 * complicated job on maintaining chip states.  (Earlier versions
1631 	 * of this driver had a bug on that point...)
1632 	 *
1633 	 * To complete the trick, mb86960_init() calls mb86960_setmode() after
1634 	 * restarting the interface.
1635 	 */
1636 	if ((flags & IFF_RUNNING) == 0)
1637 		return;
1638 
1639 	/*
1640 	 * Promiscuous mode is handled separately.
1641 	 */
1642 	if ((flags & IFF_PROMISC) != 0) {
1643 		/*
1644 		 * Program 86960 to receive all packets on the segment
1645 		 * including those directed to other stations.
1646 		 * Multicast filter stored in MARs are ignored
1647 		 * under this setting, so we don't need to update it.
1648 		 *
1649 		 * Promiscuous mode is used solely by BPF, and BPF only
1650 		 * listens to valid (no error) packets.  So, we ignore
1651 		 * errornous ones even in this mode.
1652 		 */
1653 		bus_space_write_1(bst, bsh, FE_DLCR5,
1654 		    sc->proto_dlcr5 | FE_D5_AFM0 | FE_D5_AFM1);
1655 		sc->filter_change = 0;
1656 
1657 #if FE_DEBUG >= 3
1658 		log(LOG_INFO, "%s: promiscuous mode\n",
1659 		    device_xname(sc->sc_dev));
1660 #endif
1661 		return;
1662 	}
1663 
1664 	/*
1665 	 * Turn the chip to the normal (non-promiscuous) mode.
1666 	 */
1667 	bus_space_write_1(bst, bsh, FE_DLCR5, sc->proto_dlcr5 | FE_D5_AFM1);
1668 
1669 	/*
1670 	 * Find the new multicast filter value.
1671 	 */
1672 	mb86960_getmcaf(&sc->sc_ec, sc->filter);
1673 	sc->filter_change = 1;
1674 
1675 #if FE_DEBUG >= 3
1676 	log(LOG_INFO,
1677 	    "%s: address filter: [%02x %02x %02x %02x %02x %02x %02x %02x]\n",
1678 	    device_xname(sc->sc_dev),
1679 	    sc->filter[0], sc->filter[1], sc->filter[2], sc->filter[3],
1680 	    sc->filter[4], sc->filter[5], sc->filter[6], sc->filter[7]);
1681 #endif
1682 
1683 	/*
1684 	 * We have to update the multicast filter in the 86960, A.S.A.P.
1685 	 *
1686 	 * Note that the DLC (Data Linc Control unit, i.e. transmitter
1687 	 * and receiver) must be stopped when feeding the filter, and
1688 	 * DLC trashes all packets in both transmission and receive
1689 	 * buffers when stopped.
1690 	 *
1691 	 * ... Are the above sentenses correct?  I have to check the
1692 	 *     manual of the MB86960A.  FIXME.
1693 	 *
1694 	 * To reduce the packet lossage, we delay the filter update
1695 	 * process until buffers are empty.
1696 	 */
1697 	if (sc->txb_sched == 0 && sc->txb_count == 0 &&
1698 	    (bus_space_read_1(bst, bsh, FE_DLCR1) & FE_D1_PKTRDY) == 0) {
1699 		/*
1700 		 * Buffers are (apparently) empty.  Load
1701 		 * the new filter value into MARs now.
1702 		 */
1703 		mb86960_loadmar(sc);
1704 	} else {
1705 		/*
1706 		 * Buffers are not empty.  Mark that we have to update
1707 		 * the MARs.  The new filter will be loaded by mb86960_intr()
1708 		 * later.
1709 		 */
1710 #if FE_DEBUG >= 4
1711 		log(LOG_INFO, "%s: filter change delayed\n",
1712 		    device_xname(sc->sc_dev));
1713 #endif
1714 	}
1715 }
1716 
1717 /*
1718  * Load a new multicast address filter into MARs.
1719  *
1720  * The caller must have splnet'ed befor mb86960_loadmar.
1721  * This function starts the DLC upon return.  So it can be called only
1722  * when the chip is working, i.e., from the driver's point of view, when
1723  * a device is RUNNING.  (I mistook the point in previous versions.)
1724  */
1725 void
1726 mb86960_loadmar(struct mb86960_softc *sc)
1727 {
1728 	bus_space_tag_t bst = sc->sc_bst;
1729 	bus_space_handle_t bsh = sc->sc_bsh;
1730 
1731 	/* Stop the DLC (transmitter and receiver). */
1732 	bus_space_write_1(bst, bsh, FE_DLCR6,
1733 	    sc->proto_dlcr6 | FE_D6_DLC_DISABLE);
1734 
1735 	/* Select register bank 1 for MARs. */
1736 	bus_space_write_1(bst, bsh, FE_DLCR7,
1737 	    sc->proto_dlcr7 | FE_D7_RBS_MAR | FE_D7_POWER_UP);
1738 
1739 	/* Copy filter value into the registers. */
1740 	bus_space_write_region_1(bst, bsh, FE_MAR8, sc->filter, FE_FILTER_LEN);
1741 
1742 	/* Restore the bank selection for BMPRs (i.e., runtime registers). */
1743 	bus_space_write_1(bst, bsh, FE_DLCR7,
1744 	    sc->proto_dlcr7 | FE_D7_RBS_BMPR | FE_D7_POWER_UP);
1745 
1746 	/* Restart the DLC. */
1747 	bus_space_write_1(bst, bsh, FE_DLCR6,
1748 	    sc->proto_dlcr6 | FE_D6_DLC_ENABLE);
1749 
1750 	/* We have just updated the filter. */
1751 	sc->filter_change = 0;
1752 
1753 #if FE_DEBUG >= 3
1754 	log(LOG_INFO, "%s: address filter changed\n", device_xname(sc->sc_dev));
1755 #endif
1756 }
1757 
1758 /*
1759  * Enable power on the interface.
1760  */
1761 int
1762 mb86960_enable(struct mb86960_softc *sc)
1763 {
1764 
1765 #if FE_DEBUG >= 3
1766 	log(LOG_INFO, "%s: mb86960_enable()\n", device_xname(sc->sc_dev));
1767 #endif
1768 
1769 	if ((sc->sc_stat & FE_STAT_ENABLED) == 0 && sc->sc_enable != NULL) {
1770 		if ((*sc->sc_enable)(sc) != 0) {
1771 			aprint_error_dev(sc->sc_dev, "device enable failed\n");
1772 			return EIO;
1773 		}
1774 	}
1775 
1776 	sc->sc_stat |= FE_STAT_ENABLED;
1777 	return 0;
1778 }
1779 
1780 /*
1781  * Disable power on the interface.
1782  */
1783 void
1784 mb86960_disable(struct mb86960_softc *sc)
1785 {
1786 
1787 #if FE_DEBUG >= 3
1788 	log(LOG_INFO, "%s: mb86960_disable()\n", device_xname(sc->sc_dev));
1789 #endif
1790 
1791 	if ((sc->sc_stat & FE_STAT_ENABLED) != 0 && sc->sc_disable != NULL) {
1792 		(*sc->sc_disable)(sc);
1793 		sc->sc_stat &= ~FE_STAT_ENABLED;
1794 	}
1795 }
1796 
1797 /*
1798  * mbe_activate:
1799  *
1800  *	Handle device activation/deactivation requests.
1801  */
1802 int
1803 mb86960_activate(struct device *self, enum devact act)
1804 {
1805 	struct mb86960_softc *sc = (struct mb86960_softc *)self;
1806 	int rv, s;
1807 
1808 	rv = 0;
1809 	s = splnet();
1810 	switch (act) {
1811 	case DVACT_ACTIVATE:
1812 		rv = EOPNOTSUPP;
1813 		break;
1814 
1815 	case DVACT_DEACTIVATE:
1816 		if_deactivate(&sc->sc_ec.ec_if);
1817 		break;
1818 	}
1819 	splx(s);
1820 	return rv;
1821 }
1822 
1823 /*
1824  * mb86960_detach:
1825  *
1826  *	Detach a MB86960 interface.
1827  */
1828 int
1829 mb86960_detach(struct mb86960_softc *sc)
1830 {
1831 	struct ifnet *ifp = &sc->sc_ec.ec_if;
1832 
1833 	/* Succeed now if there's no work to do. */
1834 	if ((sc->sc_stat & FE_STAT_ATTACHED) == 0)
1835 		return 0;
1836 
1837 	/* Delete all media. */
1838 	ifmedia_delete_instance(&sc->sc_media, IFM_INST_ANY);
1839 
1840 #if NRND > 0
1841 	/* Unhook the entropy source. */
1842 	rnd_detach_source(&sc->rnd_source);
1843 #endif
1844 	ether_ifdetach(ifp);
1845 	if_detach(ifp);
1846 
1847 	mb86960_disable(sc);
1848 	return 0;
1849 }
1850 
1851 /*
1852  * Routines to read all bytes from the config EEPROM (93C06) through MB86965A.
1853  */
1854 void
1855 mb86965_read_eeprom(bus_space_tag_t iot, bus_space_handle_t ioh, uint8_t *data)
1856 {
1857 	int addr, op, bit;
1858 	uint16_t val;
1859 
1860 	/* Read bytes from EEPROM; two bytes per an iteration. */
1861 	for (addr = 0; addr < FE_EEPROM_SIZE / 2; addr++) {
1862 		/* Reset the EEPROM interface. */
1863 		bus_space_write_1(iot, ioh, FE_BMPR16, 0x00);
1864 		bus_space_write_1(iot, ioh, FE_BMPR17, 0x00);
1865 		bus_space_write_1(iot, ioh, FE_BMPR16, FE_B16_SELECT);
1866 
1867 		/* Send start bit. */
1868 		bus_space_write_1(iot, ioh, FE_BMPR17, FE_B17_DATA);
1869 		FE_EEPROM_DELAY();
1870 		bus_space_write_1(iot, ioh,
1871 		    FE_BMPR16, FE_B16_SELECT | FE_B16_CLOCK);
1872 		FE_EEPROM_DELAY();
1873 		bus_space_write_1(iot, ioh, FE_BMPR16, FE_B16_SELECT);
1874 
1875 		/* Send read command and read address. */
1876 		op = 0x80 | addr;	/* READ instruction */
1877 		for (bit = 8; bit > 0; bit--) {
1878 			bus_space_write_1(iot, ioh, FE_BMPR17,
1879 			    (op & (1 << (bit - 1))) ? FE_B17_DATA : 0);
1880 			FE_EEPROM_DELAY();
1881 			bus_space_write_1(iot, ioh,
1882 			    FE_BMPR16, FE_B16_SELECT | FE_B16_CLOCK);
1883 			FE_EEPROM_DELAY();
1884 			bus_space_write_1(iot, ioh, FE_BMPR16, FE_B16_SELECT);
1885 		}
1886 		bus_space_write_1(iot, ioh, FE_BMPR17, 0x00);
1887 
1888 		/* Read two bytes in each address */
1889 		val = 0;
1890 		for (bit = 16; bit > 0; bit--) {
1891 			FE_EEPROM_DELAY();
1892 			bus_space_write_1(iot, ioh,
1893 			    FE_BMPR16, FE_B16_SELECT | FE_B16_CLOCK);
1894 			FE_EEPROM_DELAY();
1895 			if (bus_space_read_1(iot, ioh, FE_BMPR17) &
1896 			    FE_B17_DATA)
1897 				val |= 1 << (bit - 1);
1898 			bus_space_write_1(iot, ioh,
1899 			    FE_BMPR16, FE_B16_SELECT);
1900 		}
1901 		data[addr * 2]     = val >> 8;
1902 		data[addr * 2 + 1] = val & 0xff;
1903 	}
1904 
1905 	/* Make sure the EEPROM is turned off. */
1906 	bus_space_write_1(iot, ioh, FE_BMPR16, 0);
1907 	bus_space_write_1(iot, ioh, FE_BMPR17, 0);
1908 
1909 #if FE_DEBUG >= 3
1910 	/* Report what we got. */
1911 	log(LOG_INFO, "mb86965_read_eeprom: "
1912 	    " %02x%02x%02x%02x %02x%02x%02x%02x -"
1913 	    " %02x%02x%02x%02x %02x%02x%02x%02x -"
1914 	    " %02x%02x%02x%02x %02x%02x%02x%02x -"
1915 	    " %02x%02x%02x%02x %02x%02x%02x%02x\n",
1916 	    data[ 0], data[ 1], data[ 2], data[ 3],
1917 	    data[ 4], data[ 5], data[ 6], data[ 7],
1918 	    data[ 8], data[ 9], data[10], data[11],
1919 	    data[12], data[13], data[14], data[15],
1920 	    data[16], data[17], data[18], data[19],
1921 	    data[20], data[21], data[22], data[23],
1922 	    data[24], data[25], data[26], data[27],
1923 	    data[28], data[29], data[30], data[31]);
1924 #endif
1925 }
1926 
1927 #if FE_DEBUG >= 1
1928 void
1929 mb86960_dump(int level, struct mb86960_softc *sc)
1930 {
1931 	bus_space_tag_t bst = sc->sc_bst;
1932 	bus_space_handle_t bsh = sc->sc_bsh;
1933 	uint8_t save_dlcr7;
1934 
1935 	save_dlcr7 = bus_space_read_1(bst, bsh, FE_DLCR7);
1936 
1937 	log(level, "\tDLCR = %02x %02x %02x %02x %02x %02x %02x %02x\n",
1938 	    bus_space_read_1(bst, bsh, FE_DLCR0),
1939 	    bus_space_read_1(bst, bsh, FE_DLCR1),
1940 	    bus_space_read_1(bst, bsh, FE_DLCR2),
1941 	    bus_space_read_1(bst, bsh, FE_DLCR3),
1942 	    bus_space_read_1(bst, bsh, FE_DLCR4),
1943 	    bus_space_read_1(bst, bsh, FE_DLCR5),
1944 	    bus_space_read_1(bst, bsh, FE_DLCR6),
1945 	    bus_space_read_1(bst, bsh, FE_DLCR7));
1946 
1947 	bus_space_write_1(bst, bsh, FE_DLCR7,
1948 	    (save_dlcr7 & ~FE_D7_RBS) | FE_D7_RBS_DLCR);
1949 	log(level, "\t       %02x %02x %02x %02x %02x %02x %02x %02x\n",
1950 	    bus_space_read_1(bst, bsh, FE_DLCR8),
1951 	    bus_space_read_1(bst, bsh, FE_DLCR9),
1952 	    bus_space_read_1(bst, bsh, FE_DLCR10),
1953 	    bus_space_read_1(bst, bsh, FE_DLCR11),
1954 	    bus_space_read_1(bst, bsh, FE_DLCR12),
1955 	    bus_space_read_1(bst, bsh, FE_DLCR13),
1956 	    bus_space_read_1(bst, bsh, FE_DLCR14),
1957 	    bus_space_read_1(bst, bsh, FE_DLCR15));
1958 
1959 	bus_space_write_1(bst, bsh, FE_DLCR7,
1960 	    (save_dlcr7 & ~FE_D7_RBS) | FE_D7_RBS_MAR);
1961 	log(level, "\tMAR  = %02x %02x %02x %02x %02x %02x %02x %02x\n",
1962 	    bus_space_read_1(bst, bsh, FE_MAR8),
1963 	    bus_space_read_1(bst, bsh, FE_MAR9),
1964 	    bus_space_read_1(bst, bsh, FE_MAR10),
1965 	    bus_space_read_1(bst, bsh, FE_MAR11),
1966 	    bus_space_read_1(bst, bsh, FE_MAR12),
1967 	    bus_space_read_1(bst, bsh, FE_MAR13),
1968 	    bus_space_read_1(bst, bsh, FE_MAR14),
1969 	    bus_space_read_1(bst, bsh, FE_MAR15));
1970 
1971 	bus_space_write_1(bst, bsh, FE_DLCR7,
1972 	    (save_dlcr7 & ~FE_D7_RBS) | FE_D7_RBS_BMPR);
1973 	log(level,
1974 	    "\tBMPR = xx xx %02x %02x %02x %02x %02x %02x %02x %02x xx %02x\n",
1975 	    bus_space_read_1(bst, bsh, FE_BMPR10),
1976 	    bus_space_read_1(bst, bsh, FE_BMPR11),
1977 	    bus_space_read_1(bst, bsh, FE_BMPR12),
1978 	    bus_space_read_1(bst, bsh, FE_BMPR13),
1979 	    bus_space_read_1(bst, bsh, FE_BMPR14),
1980 	    bus_space_read_1(bst, bsh, FE_BMPR15),
1981 	    bus_space_read_1(bst, bsh, FE_BMPR16),
1982 	    bus_space_read_1(bst, bsh, FE_BMPR17),
1983 	    bus_space_read_1(bst, bsh, FE_BMPR19));
1984 
1985 	bus_space_write_1(bst, bsh, FE_DLCR7, save_dlcr7);
1986 }
1987 #endif
1988 
1989