xref: /netbsd-src/sys/dev/ic/mb86960.c (revision 7f21db1c0118155e0dd40b75182e30c589d9f63e)
1 /*	$NetBSD: mb86960.c,v 1.76 2010/01/19 22:06:24 pooka Exp $	*/
2 
3 /*
4  * All Rights Reserved, Copyright (C) Fujitsu Limited 1995
5  *
6  * This software may be used, modified, copied, distributed, and sold, in
7  * both source and binary form provided that the above copyright, these
8  * terms and the following disclaimer are retained.  The name of the author
9  * and/or the contributor may not be used to endorse or promote products
10  * derived from this software without specific prior written permission.
11  *
12  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND THE CONTRIBUTOR ``AS IS'' AND
13  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
14  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
15  * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR THE CONTRIBUTOR BE LIABLE
16  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
17  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
18  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION.
19  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
20  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
21  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
22  * SUCH DAMAGE.
23  */
24 
25 /*
26  * Portions copyright (C) 1993, David Greenman.  This software may be used,
27  * modified, copied, distributed, and sold, in both source and binary form
28  * provided that the above copyright and these terms are retained.  Under no
29  * circumstances is the author responsible for the proper functioning of this
30  * software, nor does the author assume any responsibility for damages
31  * incurred with its use.
32  */
33 
34 #include <sys/cdefs.h>
35 __KERNEL_RCSID(0, "$NetBSD: mb86960.c,v 1.76 2010/01/19 22:06:24 pooka Exp $");
36 
37 /*
38  * Device driver for Fujitsu MB86960A/MB86965A based Ethernet cards.
39  * Contributed by M.S. <seki@sysrap.cs.fujitsu.co.jp>
40  *
41  * This version is intended to be a generic template for various
42  * MB86960A/MB86965A based Ethernet cards.  It currently supports
43  * Fujitsu FMV-180 series (i.e., FMV-181 and FMV-182) and Allied-
44  * Telesis AT1700 series and RE2000 series.  There are some
45  * unnecessary hooks embedded, which are primarily intended to support
46  * other types of Ethernet cards, but the author is not sure whether
47  * they are useful.
48  */
49 
50 #include "opt_inet.h"
51 #include "rnd.h"
52 
53 #include <sys/param.h>
54 #include <sys/systm.h>
55 #include <sys/errno.h>
56 #include <sys/ioctl.h>
57 #include <sys/mbuf.h>
58 #include <sys/socket.h>
59 #include <sys/syslog.h>
60 #include <sys/device.h>
61 #if NRND > 0
62 #include <sys/rnd.h>
63 #endif
64 
65 #include <net/if.h>
66 #include <net/if_dl.h>
67 #include <net/if_types.h>
68 #include <net/if_media.h>
69 #include <net/if_ether.h>
70 
71 #ifdef INET
72 #include <netinet/in.h>
73 #include <netinet/in_systm.h>
74 #include <netinet/in_var.h>
75 #include <netinet/ip.h>
76 #include <netinet/if_inarp.h>
77 #endif
78 
79 
80 #include <net/bpf.h>
81 #include <net/bpfdesc.h>
82 
83 #include <sys/bus.h>
84 
85 #include <dev/ic/mb86960reg.h>
86 #include <dev/ic/mb86960var.h>
87 
88 #ifndef __BUS_SPACE_HAS_STREAM_METHODS
89 #define bus_space_write_stream_2	bus_space_write_2
90 #define bus_space_write_multi_stream_2	bus_space_write_multi_2
91 #define bus_space_read_multi_stream_2	bus_space_read_multi_2
92 #endif /* __BUS_SPACE_HAS_STREAM_METHODS */
93 
94 /* Standard driver entry points.  These can be static. */
95 void	mb86960_init(struct mb86960_softc *);
96 int	mb86960_ioctl(struct ifnet *, u_long, void *);
97 void	mb86960_start(struct ifnet *);
98 void	mb86960_reset(struct mb86960_softc *);
99 void	mb86960_watchdog(struct ifnet *);
100 
101 /* Local functions.  Order of declaration is confused.  FIXME. */
102 int	mb86960_get_packet(struct mb86960_softc *, u_int);
103 void	mb86960_stop(struct mb86960_softc *);
104 void	mb86960_tint(struct mb86960_softc *, uint8_t);
105 void	mb86960_rint(struct mb86960_softc *, uint8_t);
106 static inline
107 void	mb86960_xmit(struct mb86960_softc *);
108 void	mb86960_write_mbufs(struct mb86960_softc *, struct mbuf *);
109 static inline
110 void	mb86960_droppacket(struct mb86960_softc *);
111 void	mb86960_getmcaf(struct ethercom *, uint8_t *);
112 void	mb86960_setmode(struct mb86960_softc *);
113 void	mb86960_loadmar(struct mb86960_softc *);
114 
115 int	mb86960_mediachange(struct ifnet *);
116 void	mb86960_mediastatus(struct ifnet *, struct ifmediareq *);
117 
118 #if FE_DEBUG >= 1
119 void	mb86960_dump(int, struct mb86960_softc *);
120 #endif
121 
122 void
123 mb86960_attach(struct mb86960_softc *sc, uint8_t *myea)
124 {
125 	bus_space_tag_t bst = sc->sc_bst;
126 	bus_space_handle_t bsh = sc->sc_bsh;
127 
128 	/* Register values which depend on board design. */
129 	sc->proto_dlcr4 = FE_D4_LBC_DISABLE | FE_D4_CNTRL;
130 	sc->proto_dlcr5 = 0;
131 	sc->proto_dlcr7 = FE_D7_BYTSWP_LH;
132 	if ((sc->sc_flags & FE_FLAGS_MB86960) != 0)
133 		sc->proto_dlcr7 |= FE_D7_ED_TEST; /* XXX */
134 	sc->proto_bmpr13 = FE_B13_TPTYPE_UTP | FE_B13_PORT_AUTO;
135 
136 	/*
137 	 * Program the 86960 as following defaults:
138 	 *	SRAM: 32KB, 100ns, byte-wide access.
139 	 *	Transmission buffer: 4KB x 2.
140 	 *	System bus interface: 16 bits.
141 	 * These values except TXBSIZE should be modified as per
142 	 * sc_flags which is set in MD attachments, because they
143 	 * are hard-wired on the board. Modifying TXBSIZE will affect
144 	 * the driver performance.
145 	 */
146 	sc->proto_dlcr6 = FE_D6_BUFSIZ_32KB | FE_D6_TXBSIZ_2x4KB |
147 	    FE_D6_BBW_BYTE | FE_D6_SRAM_100ns;
148 	if (sc->sc_flags & FE_FLAGS_SBW_BYTE)
149 		sc->proto_dlcr6 |= FE_D6_SBW_BYTE;
150 	if (sc->sc_flags & FE_FLAGS_SRAM_150ns)
151 		sc->proto_dlcr6 &= ~FE_D6_SRAM_100ns;
152 
153 	/*
154 	 * Minimum initialization of the hardware.
155 	 * We write into registers; hope I/O ports have no
156 	 * overlap with other boards.
157 	 */
158 
159 	/* Initialize 86960. */
160 	bus_space_write_1(bst, bsh, FE_DLCR6,
161 	    sc->proto_dlcr6 | FE_D6_DLC_DISABLE);
162 	delay(200);
163 
164 #ifdef DIAGNOSTIC
165 	if (myea == NULL) {
166 		aprint_error_dev(sc->sc_dev,
167 		    "ethernet address shouldn't be NULL\n");
168 		panic("NULL ethernet address");
169 	}
170 #endif
171 	memcpy(sc->sc_enaddr, myea, sizeof(sc->sc_enaddr));
172 
173 	/* Disable all interrupts. */
174 	bus_space_write_1(bst, bsh, FE_DLCR2, 0);
175 	bus_space_write_1(bst, bsh, FE_DLCR3, 0);
176 }
177 
178 /*
179  * Install interface into kernel networking data structures
180  */
181 void
182 mb86960_config(struct mb86960_softc *sc, int *media, int nmedia, int defmedia)
183 {
184 	cfdata_t cf = device_cfdata(sc->sc_dev);
185 	struct ifnet *ifp = &sc->sc_ec.ec_if;
186 	int i;
187 
188 	/* Stop the 86960. */
189 	mb86960_stop(sc);
190 
191 	/* Initialize ifnet structure. */
192 	strlcpy(ifp->if_xname, device_xname(sc->sc_dev), IFNAMSIZ);
193 	ifp->if_softc = sc;
194 	ifp->if_start = mb86960_start;
195 	ifp->if_ioctl = mb86960_ioctl;
196 	ifp->if_watchdog = mb86960_watchdog;
197 	ifp->if_flags =
198 	    IFF_BROADCAST | IFF_SIMPLEX | IFF_NOTRAILERS | IFF_MULTICAST;
199 	IFQ_SET_READY(&ifp->if_snd);
200 
201 #if FE_DEBUG >= 3
202 	log(LOG_INFO, "%s: mb86960_config()\n", device_xname(sc->sc_dev));
203 	mb86960_dump(LOG_INFO, sc);
204 #endif
205 
206 #if FE_SINGLE_TRANSMISSION
207 	/* Override txb config to allocate minimum. */
208 	sc->proto_dlcr6 &= ~FE_D6_TXBSIZ;
209 	sc->proto_dlcr6 |=  FE_D6_TXBSIZ_2x2KB;
210 #endif
211 
212 	/* Modify hardware config if it is requested. */
213 	if ((cf->cf_flags & FE_FLAGS_OVERRIDE_DLCR6) != 0)
214 		sc->proto_dlcr6 = cf->cf_flags & FE_FLAGS_DLCR6_VALUE;
215 
216 	/* Find TX buffer size, based on the hardware dependent proto. */
217 	switch (sc->proto_dlcr6 & FE_D6_TXBSIZ) {
218 	case FE_D6_TXBSIZ_2x2KB:
219 		sc->txb_size = 2048;
220 		break;
221 	case FE_D6_TXBSIZ_2x4KB:
222 		sc->txb_size = 4096;
223 		break;
224 	case FE_D6_TXBSIZ_2x8KB:
225 		sc->txb_size = 8192;
226 		break;
227 	default:
228 		/* Oops, we can't work with single buffer configuration. */
229 #if FE_DEBUG >= 2
230 		log(LOG_WARNING, "%s: strange TXBSIZ config; fixing\n",
231 		    device_xname(sc->sc_dev));
232 #endif
233 		sc->proto_dlcr6 &= ~FE_D6_TXBSIZ;
234 		sc->proto_dlcr6 |=  FE_D6_TXBSIZ_2x2KB;
235 		sc->txb_size = 2048;
236 		break;
237 	}
238 
239 	/* Initialize media goo. */
240 	ifmedia_init(&sc->sc_media, 0, mb86960_mediachange,
241 	    mb86960_mediastatus);
242 	if (media != NULL) {
243 		for (i = 0; i < nmedia; i++)
244 			ifmedia_add(&sc->sc_media, media[i], 0, NULL);
245 		ifmedia_set(&sc->sc_media, defmedia);
246 	} else {
247 		ifmedia_add(&sc->sc_media, IFM_ETHER|IFM_MANUAL, 0, NULL);
248 		ifmedia_set(&sc->sc_media, IFM_ETHER|IFM_MANUAL);
249 	}
250 
251 	/* Attach the interface. */
252 	if_attach(ifp);
253 	ether_ifattach(ifp, sc->sc_enaddr);
254 
255 #if NRND > 0
256 	rnd_attach_source(&sc->rnd_source, device_xname(sc->sc_dev),
257 	    RND_TYPE_NET, 0);
258 #endif
259 	/* Print additional info when attached. */
260 	aprint_normal_dev(sc->sc_dev, "Ethernet address %s\n",
261 	    ether_sprintf(sc->sc_enaddr));
262 
263 #if FE_DEBUG >= 3
264 	{
265 		int buf, txb, bbw, sbw, ram;
266 
267 		buf = txb = bbw = sbw = ram = -1;
268 		switch (sc->proto_dlcr6 & FE_D6_BUFSIZ) {
269 		case FE_D6_BUFSIZ_8KB:
270 			buf = 8;
271 			break;
272 		case FE_D6_BUFSIZ_16KB:
273 			buf = 16;
274 			break;
275 		case FE_D6_BUFSIZ_32KB:
276 			buf = 32;
277 			break;
278 		case FE_D6_BUFSIZ_64KB:
279 			buf = 64;
280 			break;
281 		}
282 		switch (sc->proto_dlcr6 & FE_D6_TXBSIZ) {
283 		case FE_D6_TXBSIZ_2x2KB:
284 			txb = 2;
285 			break;
286 		case FE_D6_TXBSIZ_2x4KB:
287 			txb = 4;
288 			break;
289 		case FE_D6_TXBSIZ_2x8KB:
290 			txb = 8;
291 			break;
292 		}
293 		switch (sc->proto_dlcr6 & FE_D6_BBW) {
294 		case FE_D6_BBW_BYTE:
295 			bbw = 8;
296 			break;
297 		case FE_D6_BBW_WORD:
298 			bbw = 16;
299 			break;
300 		}
301 		switch (sc->proto_dlcr6 & FE_D6_SBW) {
302 		case FE_D6_SBW_BYTE:
303 			sbw = 8;
304 			break;
305 		case FE_D6_SBW_WORD:
306 			sbw = 16;
307 			break;
308 		}
309 		switch (sc->proto_dlcr6 & FE_D6_SRAM) {
310 		case FE_D6_SRAM_100ns:
311 			ram = 100;
312 			break;
313 		case FE_D6_SRAM_150ns:
314 			ram = 150;
315 			break;
316 		}
317 		aprint_debug_dev(sc->sc_dev,
318 		    "SRAM %dKB %dbit %dns, TXB %dKBx2, %dbit I/O\n",
319 		    buf, bbw, ram, txb, sbw);
320 	}
321 #endif
322 
323 	/* The attach is successful. */
324 	sc->sc_stat |= FE_STAT_ATTACHED;
325 }
326 
327 /*
328  * Media change callback.
329  */
330 int
331 mb86960_mediachange(struct ifnet *ifp)
332 {
333 	struct mb86960_softc *sc = ifp->if_softc;
334 
335 	if (sc->sc_mediachange)
336 		return (*sc->sc_mediachange)(sc);
337 	return 0;
338 }
339 
340 /*
341  * Media status callback.
342  */
343 void
344 mb86960_mediastatus(struct ifnet *ifp, struct ifmediareq *ifmr)
345 {
346 	struct mb86960_softc *sc = ifp->if_softc;
347 
348 	if ((sc->sc_stat & FE_STAT_ENABLED) == 0) {
349 		ifmr->ifm_active = IFM_ETHER | IFM_NONE;
350 		ifmr->ifm_status = 0;
351 		return;
352 	}
353 
354 	if (sc->sc_mediastatus)
355 		(*sc->sc_mediastatus)(sc, ifmr);
356 }
357 
358 /*
359  * Reset interface.
360  */
361 void
362 mb86960_reset(struct mb86960_softc *sc)
363 {
364 	int s;
365 
366 	s = splnet();
367 	mb86960_stop(sc);
368 	mb86960_init(sc);
369 	splx(s);
370 }
371 
372 /*
373  * Stop everything on the interface.
374  *
375  * All buffered packets, both transmitting and receiving,
376  * if any, will be lost by stopping the interface.
377  */
378 void
379 mb86960_stop(struct mb86960_softc *sc)
380 {
381 	bus_space_tag_t bst = sc->sc_bst;
382 	bus_space_handle_t bsh = sc->sc_bsh;
383 
384 #if FE_DEBUG >= 3
385 	log(LOG_INFO, "%s: top of mb86960_stop()\n", device_xname(sc->sc_dev));
386 	mb86960_dump(LOG_INFO, sc);
387 #endif
388 
389 	/* Disable interrupts. */
390 	bus_space_write_1(bst, bsh, FE_DLCR2, 0x00);
391 	bus_space_write_1(bst, bsh, FE_DLCR3, 0x00);
392 
393 	/* Stop interface hardware. */
394 	delay(200);
395 	bus_space_write_1(bst, bsh, FE_DLCR6,
396 	    sc->proto_dlcr6 | FE_D6_DLC_DISABLE);
397 	delay(200);
398 
399 	/* Clear all interrupt status. */
400 	bus_space_write_1(bst, bsh, FE_DLCR0, 0xFF);
401 	bus_space_write_1(bst, bsh, FE_DLCR1, 0xFF);
402 
403 	/* Put the chip in stand-by mode. */
404 	delay(200);
405 	bus_space_write_1(bst, bsh, FE_DLCR7,
406 	    sc->proto_dlcr7 | FE_D7_POWER_DOWN);
407 	delay(200);
408 
409 	/* MAR loading can be delayed. */
410 	sc->filter_change = 0;
411 
412 	/* Call a hook. */
413 	if (sc->stop_card)
414 		(*sc->stop_card)(sc);
415 
416 #if FE_DEBUG >= 3
417 	log(LOG_INFO, "%s: end of mb86960_stop()\n", device_xname(sc->sc_dev));
418 	mb86960_dump(LOG_INFO, sc);
419 #endif
420 }
421 
422 /*
423  * Device timeout/watchdog routine. Entered if the device neglects to
424  * generate an interrupt after a transmit has been started on it.
425  */
426 void
427 mb86960_watchdog(struct ifnet *ifp)
428 {
429 	struct mb86960_softc *sc = ifp->if_softc;
430 
431 	log(LOG_ERR, "%s: device timeout\n", device_xname(sc->sc_dev));
432 #if FE_DEBUG >= 3
433 	mb86960_dump(LOG_INFO, sc);
434 #endif
435 
436 	/* Record how many packets are lost by this accident. */
437 	sc->sc_ec.ec_if.if_oerrors += sc->txb_sched + sc->txb_count;
438 
439 	mb86960_reset(sc);
440 }
441 
442 /*
443  * Drop (skip) a packet from receive buffer in 86960 memory.
444  */
445 static inline void
446 mb86960_droppacket(struct mb86960_softc *sc)
447 {
448 	bus_space_tag_t bst = sc->sc_bst;
449 	bus_space_handle_t bsh = sc->sc_bsh;
450 
451 	bus_space_write_1(bst, bsh, FE_BMPR14, FE_B14_FILTER | FE_B14_SKIP);
452 }
453 
454 /*
455  * Initialize device.
456  */
457 void
458 mb86960_init(struct mb86960_softc *sc)
459 {
460 	bus_space_tag_t bst = sc->sc_bst;
461 	bus_space_handle_t bsh = sc->sc_bsh;
462 	struct ifnet *ifp = &sc->sc_ec.ec_if;
463 	int i;
464 
465 #if FE_DEBUG >= 3
466 	log(LOG_INFO, "%s: top of mb86960_init()\n", device_xname(sc->sc_dev));
467 	mb86960_dump(LOG_INFO, sc);
468 #endif
469 
470 	/* Reset transmitter flags. */
471 	ifp->if_flags &= ~IFF_OACTIVE;
472 	ifp->if_timer = 0;
473 
474 	sc->txb_free = sc->txb_size;
475 	sc->txb_count = 0;
476 	sc->txb_sched = 0;
477 
478 	/* Do any card-specific initialization, if applicable. */
479 	if (sc->init_card)
480 		(*sc->init_card)(sc);
481 
482 #if FE_DEBUG >= 3
483 	log(LOG_INFO, "%s: after init hook\n", device_xname(sc->sc_dev));
484 	mb86960_dump(LOG_INFO, sc);
485 #endif
486 
487 	/*
488 	 * Make sure to disable the chip, also.
489 	 * This may also help re-programming the chip after
490 	 * hot insertion of PCMCIAs.
491 	 */
492 	bus_space_write_1(bst, bsh, FE_DLCR6,
493 	    sc->proto_dlcr6 | FE_D6_DLC_DISABLE);
494 	delay(200);
495 
496 	/* Power up the chip and select register bank for DLCRs. */
497 	bus_space_write_1(bst, bsh, FE_DLCR7,
498 	    sc->proto_dlcr7 | FE_D7_RBS_DLCR | FE_D7_POWER_UP);
499 	delay(200);
500 
501 	/* Feed the station address. */
502 	bus_space_write_region_1(bst, bsh, FE_DLCR8,
503 	    sc->sc_enaddr, ETHER_ADDR_LEN);
504 
505 	/* Select the BMPR bank for runtime register access. */
506 	bus_space_write_1(bst, bsh, FE_DLCR7,
507 	    sc->proto_dlcr7 | FE_D7_RBS_BMPR | FE_D7_POWER_UP);
508 
509 	/* Initialize registers. */
510 	bus_space_write_1(bst, bsh, FE_DLCR0, 0xFF);	/* Clear all bits. */
511 	bus_space_write_1(bst, bsh, FE_DLCR1, 0xFF);	/* ditto. */
512 	bus_space_write_1(bst, bsh, FE_DLCR2, 0x00);
513 	bus_space_write_1(bst, bsh, FE_DLCR3, 0x00);
514 	bus_space_write_1(bst, bsh, FE_DLCR4, sc->proto_dlcr4);
515 	bus_space_write_1(bst, bsh, FE_DLCR5, sc->proto_dlcr5);
516 	bus_space_write_1(bst, bsh, FE_BMPR10, 0x00);
517 	bus_space_write_1(bst, bsh, FE_BMPR11, FE_B11_CTRL_SKIP);
518 	bus_space_write_1(bst, bsh, FE_BMPR12, 0x00);
519 	bus_space_write_1(bst, bsh, FE_BMPR13, sc->proto_bmpr13);
520 	bus_space_write_1(bst, bsh, FE_BMPR14, FE_B14_FILTER);
521 	bus_space_write_1(bst, bsh, FE_BMPR15, 0x00);
522 
523 #if FE_DEBUG >= 3
524 	log(LOG_INFO, "%s: just before enabling DLC\n",
525 	    device_xname(sc->sc_dev));
526 	mb86960_dump(LOG_INFO, sc);
527 #endif
528 
529 	/* Enable interrupts. */
530 	bus_space_write_1(bst, bsh, FE_DLCR2, FE_TMASK);
531 	bus_space_write_1(bst, bsh, FE_DLCR3, FE_RMASK);
532 
533 	/* Enable transmitter and receiver. */
534 	delay(200);
535 	bus_space_write_1(bst, bsh, FE_DLCR6,
536 	    sc->proto_dlcr6 | FE_D6_DLC_ENABLE);
537 	delay(200);
538 
539 #if FE_DEBUG >= 3
540 	log(LOG_INFO, "%s: just after enabling DLC\n",
541 	    device_xname(sc->sc_dev));
542 	mb86960_dump(LOG_INFO, sc);
543 #endif
544 
545 	/*
546 	 * Make sure to empty the receive buffer.
547 	 *
548 	 * This may be redundant, but *if* the receive buffer were full
549 	 * at this point, the driver would hang.  I have experienced
550 	 * some strange hangups just after UP.  I hope the following
551 	 * code solve the problem.
552 	 *
553 	 * I have changed the order of hardware initialization.
554 	 * I think the receive buffer cannot have any packets at this
555 	 * point in this version.  The following code *must* be
556 	 * redundant now.  FIXME.
557 	 */
558 	for (i = 0; i < FE_MAX_RECV_COUNT; i++) {
559 		if (bus_space_read_1(bst, bsh, FE_DLCR5) & FE_D5_BUFEMP)
560 			break;
561 		mb86960_droppacket(sc);
562 	}
563 #if FE_DEBUG >= 1
564 	if (i >= FE_MAX_RECV_COUNT)
565 		log(LOG_ERR, "%s: cannot empty receive buffer\n",
566 		    device_xname(sc->sc_dev));
567 #endif
568 #if FE_DEBUG >= 3
569 	if (i < FE_MAX_RECV_COUNT)
570 		log(LOG_INFO, "%s: receive buffer emptied (%d)\n",
571 		    device_xname(sc->sc_dev), i);
572 #endif
573 
574 #if FE_DEBUG >= 3
575 	log(LOG_INFO, "%s: after ERB loop\n", device_xname(sc->sc_dev));
576 	mb86960_dump(LOG_INFO, sc);
577 #endif
578 
579 	/* Do we need this here? */
580 	bus_space_write_1(bst, bsh, FE_DLCR0, 0xFF);	/* Clear all bits. */
581 	bus_space_write_1(bst, bsh, FE_DLCR1, 0xFF);	/* ditto. */
582 
583 #if FE_DEBUG >= 3
584 	log(LOG_INFO, "%s: after FIXME\n", device_xname(sc->sc_dev));
585 	mb86960_dump(LOG_INFO, sc);
586 #endif
587 
588 	/* Set 'running' flag. */
589 	ifp->if_flags |= IFF_RUNNING;
590 
591 	/*
592 	 * At this point, the interface is runnung properly,
593 	 * except that it receives *no* packets.  we then call
594 	 * mb86960_setmode() to tell the chip what packets to be
595 	 * received, based on the if_flags and multicast group
596 	 * list.  It completes the initialization process.
597 	 */
598 	mb86960_setmode(sc);
599 
600 #if FE_DEBUG >= 3
601 	log(LOG_INFO, "%s: after setmode\n", device_xname(sc->sc_dev));
602 	mb86960_dump(LOG_INFO, sc);
603 #endif
604 
605 	/* ...and attempt to start output. */
606 	mb86960_start(ifp);
607 
608 #if FE_DEBUG >= 3
609 	log(LOG_INFO, "%s: end of mb86960_init()\n", device_xname(sc->sc_dev));
610 	mb86960_dump(LOG_INFO, sc);
611 #endif
612 }
613 
614 /*
615  * This routine actually starts the transmission on the interface
616  */
617 static inline void
618 mb86960_xmit(struct mb86960_softc *sc)
619 {
620 	bus_space_tag_t bst = sc->sc_bst;
621 	bus_space_handle_t bsh = sc->sc_bsh;
622 
623 	/*
624 	 * Set a timer just in case we never hear from the board again.
625 	 * We use longer timeout for multiple packet transmission.
626 	 * I'm not sure this timer value is appropriate.  FIXME.
627 	 */
628 	sc->sc_ec.ec_if.if_timer = 1 + sc->txb_count;
629 
630 	/* Update txb variables. */
631 	sc->txb_sched = sc->txb_count;
632 	sc->txb_count = 0;
633 	sc->txb_free = sc->txb_size;
634 
635 #if FE_DELAYED_PADDING
636 	/* Omit the postponed padding process. */
637 	sc->txb_padding = 0;
638 #endif
639 
640 	/* Start transmitter, passing packets in TX buffer. */
641 	bus_space_write_1(bst, bsh, FE_BMPR10, sc->txb_sched | FE_B10_START);
642 }
643 
644 /*
645  * Start output on interface.
646  * We make two assumptions here:
647  *  1) that the current priority is set to splnet _before_ this code
648  *     is called *and* is returned to the appropriate priority after
649  *     return
650  *  2) that the IFF_OACTIVE flag is checked before this code is called
651  *     (i.e. that the output part of the interface is idle)
652  */
653 void
654 mb86960_start(struct ifnet *ifp)
655 {
656 	struct mb86960_softc *sc = ifp->if_softc;
657 	struct mbuf *m;
658 
659 #if FE_DEBUG >= 1
660 	/* Just a sanity check. */
661 	if ((sc->txb_count == 0) != (sc->txb_free == sc->txb_size)) {
662 		/*
663 		 * Txb_count and txb_free co-works to manage the
664 		 * transmission buffer.  Txb_count keeps track of the
665 		 * used potion of the buffer, while txb_free does unused
666 		 * potion.  So, as long as the driver runs properly,
667 		 * txb_count is zero if and only if txb_free is same
668 		 * as txb_size (which represents whole buffer.)
669 		 */
670 		log(LOG_ERR, "%s: inconsistent txb variables (%d, %d)\n",
671 		    device_xname(sc->sc_dev), sc->txb_count, sc->txb_free);
672 		/*
673 		 * So, what should I do, then?
674 		 *
675 		 * We now know txb_count and txb_free contradicts.  We
676 		 * cannot, however, tell which is wrong.  More
677 		 * over, we cannot peek 86960 transmission buffer or
678 		 * reset the transmission buffer.  (In fact, we can
679 		 * reset the entire interface.  I don't want to do it.)
680 		 *
681 		 * If txb_count is incorrect, leaving it as is will cause
682 		 * sending of gabages after next interrupt.  We have to
683 		 * avoid it.  Hence, we reset the txb_count here.  If
684 		 * txb_free was incorrect, resetting txb_count just loose
685 		 * some packets.  We can live with it.
686 		 */
687 		sc->txb_count = 0;
688 	}
689 #endif
690 
691 #if FE_DEBUG >= 1
692 	/*
693 	 * First, see if there are buffered packets and an idle
694 	 * transmitter - should never happen at this point.
695 	 */
696 	if ((sc->txb_count > 0) && (sc->txb_sched == 0)) {
697 		log(LOG_ERR, "%s: transmitter idle with %d buffered packets\n",
698 		    device_xname(sc->sc_dev), sc->txb_count);
699 		mb86960_xmit(sc);
700 	}
701 #endif
702 
703 	/*
704 	 * Stop accepting more transmission packets temporarily, when
705 	 * a filter change request is delayed.  Updating the MARs on
706 	 * 86960 flushes the transmisstion buffer, so it is delayed
707 	 * until all buffered transmission packets have been sent
708 	 * out.
709 	 */
710 	if (sc->filter_change) {
711 		/*
712 		 * Filter change request is delayed only when the DLC is
713 		 * working.  DLC soon raise an interrupt after finishing
714 		 * the work.
715 		 */
716 		goto indicate_active;
717 	}
718 
719 	for (;;) {
720 		/*
721 		 * See if there is room to put another packet in the buffer.
722 		 * We *could* do better job by peeking the send queue to
723 		 * know the length of the next packet.  Current version just
724 		 * tests against the worst case (i.e., longest packet).  FIXME.
725 		 *
726 		 * When adding the packet-peek feature, don't forget adding a
727 		 * test on txb_count against QUEUEING_MAX.
728 		 * There is a little chance the packet count exceeds
729 		 * the limit.  Assume transmission buffer is 8KB (2x8KB
730 		 * configuration) and an application sends a bunch of small
731 		 * (i.e., minimum packet sized) packets rapidly.  An 8KB
732 		 * buffer can hold 130 blocks of 62 bytes long...
733 		 */
734 		if (sc->txb_free <
735 		    (ETHER_MAX_LEN - ETHER_CRC_LEN) + FE_TXLEN_SIZE) {
736 			/* No room. */
737 			goto indicate_active;
738 		}
739 
740 #if FE_SINGLE_TRANSMISSION
741 		if (sc->txb_count > 0) {
742 			/* Just one packet per a transmission buffer. */
743 			goto indicate_active;
744 		}
745 #endif
746 
747 		/*
748 		 * Get the next mbuf chain for a packet to send.
749 		 */
750 		IFQ_DEQUEUE(&ifp->if_snd, m);
751 		if (m == 0) {
752 			/* No more packets to send. */
753 			goto indicate_inactive;
754 		}
755 
756 		/* Tap off here if there is a BPF listener. */
757 		if (ifp->if_bpf)
758 			bpf_ops->bpf_mtap(ifp->if_bpf, m);
759 
760 		/*
761 		 * Copy the mbuf chain into the transmission buffer.
762 		 * txb_* variables are updated as necessary.
763 		 */
764 		mb86960_write_mbufs(sc, m);
765 
766 		m_freem(m);
767 
768 		/* Start transmitter if it's idle. */
769 		if (sc->txb_sched == 0)
770 			mb86960_xmit(sc);
771 	}
772 
773 indicate_inactive:
774 	/*
775 	 * We are using the !OACTIVE flag to indicate to
776 	 * the outside world that we can accept an
777 	 * additional packet rather than that the
778 	 * transmitter is _actually_ active.  Indeed, the
779 	 * transmitter may be active, but if we haven't
780 	 * filled all the buffers with data then we still
781 	 * want to accept more.
782 	 */
783 	ifp->if_flags &= ~IFF_OACTIVE;
784 	return;
785 
786 indicate_active:
787 	/*
788 	 * The transmitter is active, and there are no room for
789 	 * more outgoing packets in the transmission buffer.
790 	 */
791 	ifp->if_flags |= IFF_OACTIVE;
792 	return;
793 }
794 
795 /*
796  * Transmission interrupt handler
797  * The control flow of this function looks silly.  FIXME.
798  */
799 void
800 mb86960_tint(struct mb86960_softc *sc, uint8_t tstat)
801 {
802 	bus_space_tag_t bst = sc->sc_bst;
803 	bus_space_handle_t bsh = sc->sc_bsh;
804 	struct ifnet *ifp = &sc->sc_ec.ec_if;
805 	int left;
806 	int col;
807 
808 	/*
809 	 * Handle "excessive collision" interrupt.
810 	 */
811 	if (tstat & FE_D0_COLL16) {
812 		/*
813 		 * Find how many packets (including this collided one)
814 		 * are left unsent in transmission buffer.
815 		 */
816 		left = bus_space_read_1(bst, bsh, FE_BMPR10);
817 
818 #if FE_DEBUG >= 2
819 		log(LOG_WARNING, "%s: excessive collision (%d/%d)\n",
820 		    device_xname(sc->sc_dev), left, sc->txb_sched);
821 #endif
822 #if FE_DEBUG >= 3
823 		mb86960_dump(LOG_INFO, sc);
824 #endif
825 
826 		/*
827 		 * Update statistics.
828 		 */
829 		ifp->if_collisions += 16;
830 		ifp->if_oerrors++;
831 		ifp->if_opackets += sc->txb_sched - left;
832 
833 		/*
834 		 * Collision statistics has been updated.
835 		 * Clear the collision flag on 86960 now to avoid confusion.
836 		 */
837 		bus_space_write_1(bst, bsh, FE_DLCR0, FE_D0_COLLID);
838 
839 		/*
840 		 * Restart transmitter, skipping the
841 		 * collided packet.
842 		 *
843 		 * We *must* skip the packet to keep network running
844 		 * properly.  Excessive collision error is an
845 		 * indication of the network overload.  If we
846 		 * tried sending the same packet after excessive
847 		 * collision, the network would be filled with
848 		 * out-of-time packets.  Packets belonging
849 		 * to reliable transport (such as TCP) are resent
850 		 * by some upper layer.
851 		 */
852 		bus_space_write_1(bst, bsh, FE_BMPR11,
853 		    FE_B11_CTRL_SKIP | FE_B11_MODE1);
854 		sc->txb_sched = left - 1;
855 	}
856 
857 	/*
858 	 * Handle "transmission complete" interrupt.
859 	 */
860 	if (tstat & FE_D0_TXDONE) {
861 		/*
862 		 * Add in total number of collisions on last
863 		 * transmission.  We also clear "collision occurred" flag
864 		 * here.
865 		 *
866 		 * 86960 has a design flow on collision count on multiple
867 		 * packet transmission.  When we send two or more packets
868 		 * with one start command (that's what we do when the
869 		 * transmission queue is clauded), 86960 informs us number
870 		 * of collisions occurred on the last packet on the
871 		 * transmission only.  Number of collisions on previous
872 		 * packets are lost.  I have told that the fact is clearly
873 		 * stated in the Fujitsu document.
874 		 *
875 		 * I considered not to mind it seriously.  Collision
876 		 * count is not so important, anyway.  Any comments?  FIXME.
877 		 */
878 
879 		if (bus_space_read_1(bst, bsh, FE_DLCR0) & FE_D0_COLLID) {
880 			/* Clear collision flag. */
881 			bus_space_write_1(bst, bsh, FE_DLCR0, FE_D0_COLLID);
882 
883 			/* Extract collision count from 86960. */
884 			col = bus_space_read_1(bst, bsh, FE_DLCR4) & FE_D4_COL;
885 			if (col == 0) {
886 				/*
887 				 * Status register indicates collisions,
888 				 * while the collision count is zero.
889 				 * This can happen after multiple packet
890 				 * transmission, indicating that one or more
891 				 * previous packet(s) had been collided.
892 				 *
893 				 * Since the accurate number of collisions
894 				 * has been lost, we just guess it as 1;
895 				 * Am I too optimistic?  FIXME.
896 				 */
897 				col = 1;
898 			} else
899 				col >>= FE_D4_COL_SHIFT;
900 			ifp->if_collisions += col;
901 #if FE_DEBUG >= 4
902 			log(LOG_WARNING, "%s: %d collision%s (%d)\n",
903 			    device_xname(sc->sc_dev), col, col == 1 ? "" : "s",
904 			    sc->txb_sched);
905 #endif
906 		}
907 
908 		/*
909 		 * Update total number of successfully
910 		 * transmitted packets.
911 		 */
912 		ifp->if_opackets += sc->txb_sched;
913 		sc->txb_sched = 0;
914 	}
915 
916 	if (sc->txb_sched == 0) {
917 		/*
918 		 * The transmitter is no more active.
919 		 * Reset output active flag and watchdog timer.
920 		 */
921 		ifp->if_flags &= ~IFF_OACTIVE;
922 		ifp->if_timer = 0;
923 
924 		/*
925 		 * If more data is ready to transmit in the buffer, start
926 		 * transmitting them.  Otherwise keep transmitter idle,
927 		 * even if more data is queued.  This gives receive
928 		 * process a slight priority.
929 		 */
930 		if (sc->txb_count > 0)
931 			mb86960_xmit(sc);
932 	}
933 }
934 
935 /*
936  * Ethernet interface receiver interrupt.
937  */
938 void
939 mb86960_rint(struct mb86960_softc *sc, uint8_t rstat)
940 {
941 	bus_space_tag_t bst = sc->sc_bst;
942 	bus_space_handle_t bsh = sc->sc_bsh;
943 	struct ifnet *ifp = &sc->sc_ec.ec_if;
944 	u_int status, len;
945 	int i;
946 
947 	/*
948 	 * Update statistics if this interrupt is caused by an error.
949 	 */
950 	if (rstat & (FE_D1_OVRFLO | FE_D1_CRCERR | FE_D1_ALGERR |
951 	    FE_D1_SRTPKT)) {
952 #if FE_DEBUG >= 3
953 		char sbuf[sizeof(FE_D1_ERRBITS) + 64];
954 
955 		snprintb(sbuf, sizeof(sbuf), FE_D1_ERRBITS, rstat);
956 		log(LOG_WARNING, "%s: receive error: %s\n",
957 		    device_xname(sc->sc_dev), sbuf);
958 #endif
959 		ifp->if_ierrors++;
960 	}
961 
962 	/*
963 	 * MB86960 has a flag indicating "receive queue empty."
964 	 * We just loop checking the flag to pull out all received
965 	 * packets.
966 	 *
967 	 * We limit the number of iterrations to avoid infinite loop.
968 	 * It can be caused by a very slow CPU (some broken
969 	 * peripheral may insert incredible number of wait cycles)
970 	 * or, worse, by a broken MB86960 chip.
971 	 */
972 	for (i = 0; i < FE_MAX_RECV_COUNT; i++) {
973 		/* Stop the iterration if 86960 indicates no packets. */
974 		if (bus_space_read_1(bst, bsh, FE_DLCR5) & FE_D5_BUFEMP)
975 			break;
976 
977 		/*
978 		 * Extract receive packet status from the receive
979 		 * packet header.
980 		 */
981 		if (sc->sc_flags & FE_FLAGS_SBW_BYTE) {
982 			status = bus_space_read_1(bst, bsh, FE_BMPR8);
983 			(void)bus_space_read_1(bst, bsh, FE_BMPR8);
984 		} else
985 			status = bus_space_read_2(bst, bsh, FE_BMPR8);
986 
987 #if FE_DEBUG >= 4
988 		log(LOG_INFO, "%s: receive status = %02x\n",
989 		    device_xname(sc->sc_dev), status);
990 #endif
991 
992 		/*
993 		 * If there was an error, update statistics and drop
994 		 * the packet, unless the interface is in promiscuous
995 		 * mode.
996 		 */
997 		if ((status & FE_RXSTAT_GOODPKT) == 0) {
998 			if ((ifp->if_flags & IFF_PROMISC) == 0) {
999 				ifp->if_ierrors++;
1000 				mb86960_droppacket(sc);
1001 				continue;
1002 			}
1003 		}
1004 
1005 		/*
1006 		 * Extract the packet length from the receive packet header.
1007 		 * It is a sum of a header (14 bytes) and a payload.
1008 		 * CRC has been stripped off by the 86960.
1009 		 */
1010 		if (sc->sc_flags & FE_FLAGS_SBW_BYTE) {
1011 			len  = bus_space_read_1(bst, bsh, FE_BMPR8);
1012 			len |= bus_space_read_1(bst, bsh, FE_BMPR8) << 8;
1013 		} else
1014 			len = bus_space_read_2(bst, bsh, FE_BMPR8);
1015 
1016 		/*
1017 		 * MB86965 checks the packet length and drop big packet
1018 		 * before passing it to us.  There are no chance we can
1019 		 * get [crufty] packets.  Hence, if the length exceeds
1020 		 * the specified limit, it means some serious failure,
1021 		 * such as out-of-sync on receive buffer management.
1022 		 *
1023 		 * Is this statement true?  FIXME.
1024 		 */
1025 		if (len > (ETHER_MAX_LEN - ETHER_CRC_LEN) ||
1026 		    len < ETHER_HDR_LEN) {
1027 #if FE_DEBUG >= 2
1028 			log(LOG_WARNING,
1029 			    "%s: received a %s packet? (%u bytes)\n",
1030 			    device_xname(sc->sc_dev),
1031 			    len < ETHER_HDR_LEN ? "partial" : "big", len);
1032 #endif
1033 			ifp->if_ierrors++;
1034 			mb86960_droppacket(sc);
1035 			continue;
1036 		}
1037 
1038 		/*
1039 		 * Check for a short (RUNT) packet.  We *do* check
1040 		 * but do nothing other than print a message.
1041 		 * Short packets are illegal, but does nothing bad
1042 		 * if it carries data for upper layer.
1043 		 */
1044 #if FE_DEBUG >= 2
1045 		if (len < (ETHER_MIN_LEN - ETHER_CRC_LEN)) {
1046 			log(LOG_WARNING,
1047 			    "%s: received a short packet? (%u bytes)\n",
1048 			    device_xname(sc->sc_dev), len);
1049 		}
1050 #endif
1051 
1052 		/*
1053 		 * Go get a packet.
1054 		 */
1055 		if (mb86960_get_packet(sc, len) == 0) {
1056 			/* Skip a packet, updating statistics. */
1057 #if FE_DEBUG >= 2
1058 			log(LOG_WARNING,
1059 			    "%s: out of mbufs; dropping packet (%u bytes)\n",
1060 			    device_xname(sc->sc_dev), len);
1061 #endif
1062 			ifp->if_ierrors++;
1063 			mb86960_droppacket(sc);
1064 
1065 			/*
1066 			 * We stop receiving packets, even if there are
1067 			 * more in the buffer.  We hope we can get more
1068 			 * mbufs next time.
1069 			 */
1070 			return;
1071 		}
1072 
1073 		/* Successfully received a packet.  Update stat. */
1074 		ifp->if_ipackets++;
1075 	}
1076 }
1077 
1078 /*
1079  * Ethernet interface interrupt processor
1080  */
1081 int
1082 mb86960_intr(void *arg)
1083 {
1084 	struct mb86960_softc *sc = arg;
1085 	bus_space_tag_t bst = sc->sc_bst;
1086 	bus_space_handle_t bsh = sc->sc_bsh;
1087 	struct ifnet *ifp = &sc->sc_ec.ec_if;
1088 	uint8_t tstat, rstat;
1089 
1090 	if ((sc->sc_stat & FE_STAT_ENABLED) == 0 ||
1091 	    !device_is_active(sc->sc_dev))
1092 		return 0;
1093 
1094 #if FE_DEBUG >= 4
1095 	log(LOG_INFO, "%s: mb86960_intr()\n", device_xname(sc->sc_dev));
1096 	mb86960_dump(LOG_INFO, sc);
1097 #endif
1098 
1099 	/*
1100 	 * Get interrupt conditions, masking unneeded flags.
1101 	 */
1102 	tstat = bus_space_read_1(bst, bsh, FE_DLCR0) & FE_TMASK;
1103 	rstat = bus_space_read_1(bst, bsh, FE_DLCR1) & FE_RMASK;
1104 	if (tstat == 0 && rstat == 0)
1105 		return 0;
1106 
1107 	/*
1108 	 * Loop until there are no more new interrupt conditions.
1109 	 */
1110 	for (;;) {
1111 		/*
1112 		 * Reset the conditions we are acknowledging.
1113 		 */
1114 		bus_space_write_1(bst, bsh, FE_DLCR0, tstat);
1115 		bus_space_write_1(bst, bsh, FE_DLCR1, rstat);
1116 
1117 		/*
1118 		 * Handle transmitter interrupts. Handle these first because
1119 		 * the receiver will reset the board under some conditions.
1120 		 */
1121 		if (tstat != 0)
1122 			mb86960_tint(sc, tstat);
1123 
1124 		/*
1125 		 * Handle receiver interrupts.
1126 		 */
1127 		if (rstat != 0)
1128 			mb86960_rint(sc, rstat);
1129 
1130 		/*
1131 		 * Update the multicast address filter if it is
1132 		 * needed and possible.  We do it now, because
1133 		 * we can make sure the transmission buffer is empty,
1134 		 * and there is a good chance that the receive queue
1135 		 * is empty.  It will minimize the possibility of
1136 		 * packet lossage.
1137 		 */
1138 		if (sc->filter_change &&
1139 		    sc->txb_count == 0 && sc->txb_sched == 0) {
1140 			mb86960_loadmar(sc);
1141 			ifp->if_flags &= ~IFF_OACTIVE;
1142 		}
1143 
1144 		/*
1145 		 * If it looks like the transmitter can take more data,
1146 		 * attempt to start output on the interface. This is done
1147 		 * after handling the receiver interrupt to give the
1148 		 * receive operation priority.
1149 		 */
1150 		if ((ifp->if_flags & IFF_OACTIVE) == 0)
1151 			mb86960_start(ifp);
1152 
1153 #if NRND > 0
1154 		if (rstat != 0 || tstat != 0)
1155 			rnd_add_uint32(&sc->rnd_source, rstat + tstat);
1156 #endif
1157 
1158 		/*
1159 		 * Get interrupt conditions, masking unneeded flags.
1160 		 */
1161 		tstat = bus_space_read_1(bst, bsh, FE_DLCR0) & FE_TMASK;
1162 		rstat = bus_space_read_1(bst, bsh, FE_DLCR1) & FE_RMASK;
1163 		if (tstat == 0 && rstat == 0)
1164 			return 1;
1165 	}
1166 }
1167 
1168 /*
1169  * Process an ioctl request.  This code needs some work - it looks pretty ugly.
1170  */
1171 int
1172 mb86960_ioctl(struct ifnet *ifp, u_long cmd, void *data)
1173 {
1174 	struct mb86960_softc *sc = ifp->if_softc;
1175 	struct ifaddr *ifa = (struct ifaddr *)data;
1176 	struct ifreq *ifr = (struct ifreq *)data;
1177 	int s, error = 0;
1178 
1179 #if FE_DEBUG >= 3
1180 	log(LOG_INFO, "%s: ioctl(%lx)\n", device_xname(sc->sc_dev), cmd);
1181 #endif
1182 
1183 	s = splnet();
1184 
1185 	switch (cmd) {
1186 	case SIOCINITIFADDR:
1187 		if ((error = mb86960_enable(sc)) != 0)
1188 			break;
1189 		ifp->if_flags |= IFF_UP;
1190 
1191 		mb86960_init(sc);
1192 		switch (ifa->ifa_addr->sa_family) {
1193 #ifdef INET
1194 		case AF_INET:
1195 			arp_ifinit(ifp, ifa);
1196 			break;
1197 #endif
1198 		default:
1199 			break;
1200 		}
1201 		break;
1202 
1203 	case SIOCSIFFLAGS:
1204 		if ((error = ifioctl_common(ifp, cmd, data)) != 0)
1205 			break;
1206 		/* XXX re-use ether_ioctl() */
1207 		switch (ifp->if_flags & (IFF_UP|IFF_RUNNING)) {
1208 		case IFF_RUNNING:
1209 			/*
1210 			 * If interface is marked down and it is running, then
1211 			 * stop it.
1212 			 */
1213 			mb86960_stop(sc);
1214 			ifp->if_flags &= ~IFF_RUNNING;
1215 			mb86960_disable(sc);
1216 			break;
1217 		case IFF_UP:
1218 			/*
1219 			 * If interface is marked up and it is stopped, then
1220 			 * start it.
1221 			 */
1222 			if ((error = mb86960_enable(sc)) != 0)
1223 				break;
1224 			mb86960_init(sc);
1225 			break;
1226 		case IFF_UP|IFF_RUNNING:
1227 			/*
1228 			 * Reset the interface to pick up changes in any other
1229 			 * flags that affect hardware registers.
1230 			 */
1231 			mb86960_setmode(sc);
1232 			break;
1233 		case 0:
1234 			break;
1235 		}
1236 #if FE_DEBUG >= 1
1237 		/* "ifconfig fe0 debug" to print register dump. */
1238 		if (ifp->if_flags & IFF_DEBUG) {
1239 			log(LOG_INFO, "%s: SIOCSIFFLAGS(DEBUG)\n",
1240 			    device_xname(sc->sc_dev));
1241 			mb86960_dump(LOG_DEBUG, sc);
1242 		}
1243 #endif
1244 		break;
1245 
1246 	case SIOCADDMULTI:
1247 	case SIOCDELMULTI:
1248 		if ((sc->sc_stat & FE_STAT_ENABLED) == 0) {
1249 			error = EIO;
1250 			break;
1251 		}
1252 
1253 		/* Update our multicast list. */
1254 		if ((error = ether_ioctl(ifp, cmd, data)) == ENETRESET) {
1255 			/*
1256 			 * Multicast list has changed; set the hardware filter
1257 			 * accordingly.
1258 			 */
1259 			if (ifp->if_flags & IFF_RUNNING)
1260 				mb86960_setmode(sc);
1261 			error = 0;
1262 		}
1263 		break;
1264 
1265 	case SIOCGIFMEDIA:
1266 	case SIOCSIFMEDIA:
1267 		error = ifmedia_ioctl(ifp, ifr, &sc->sc_media, cmd);
1268 		break;
1269 
1270 	default:
1271 		error = ether_ioctl(ifp, cmd, data);
1272 		break;
1273 	}
1274 
1275 	splx(s);
1276 	return error;
1277 }
1278 
1279 /*
1280  * Retrieve packet from receive buffer and send to the next level up via
1281  * ether_input(). If there is a BPF listener, give a copy to BPF, too.
1282  * Returns 0 if success, -1 if error (i.e., mbuf allocation failure).
1283  */
1284 int
1285 mb86960_get_packet(struct mb86960_softc *sc, u_int len)
1286 {
1287 	bus_space_tag_t bst = sc->sc_bst;
1288 	bus_space_handle_t bsh = sc->sc_bsh;
1289 	struct ifnet *ifp = &sc->sc_ec.ec_if;
1290 	struct mbuf *m;
1291 
1292 	/* Allocate a header mbuf. */
1293 	MGETHDR(m, M_DONTWAIT, MT_DATA);
1294 	if (m == 0)
1295 		return 0;
1296 	m->m_pkthdr.rcvif = ifp;
1297 	m->m_pkthdr.len = len;
1298 
1299 	/* The following silliness is to make NFS happy. */
1300 #define	EROUND	((sizeof(struct ether_header) + 3) & ~3)
1301 #define	EOFF	(EROUND - sizeof(struct ether_header))
1302 
1303 	/*
1304 	 * Our strategy has one more problem.  There is a policy on
1305 	 * mbuf cluster allocation.  It says that we must have at
1306 	 * least MINCLSIZE (208 bytes) to allocate a cluster.  For a
1307 	 * packet of a size between (MHLEN - 2) to (MINCLSIZE - 2),
1308 	 * our code violates the rule...
1309 	 * On the other hand, the current code is short, simple,
1310 	 * and fast, however.  It does no harmful thing, just waists
1311 	 * some memory.  Any comments?  FIXME.
1312 	 */
1313 
1314 	/* Attach a cluster if this packet doesn't fit in a normal mbuf. */
1315 	if (len > MHLEN - EOFF) {
1316 		MCLGET(m, M_DONTWAIT);
1317 		if ((m->m_flags & M_EXT) == 0) {
1318 			m_freem(m);
1319 			return 0;
1320 		}
1321 	}
1322 
1323 	/*
1324 	 * The following assumes there is room for the ether header in the
1325 	 * header mbuf.
1326 	 */
1327 	m->m_data += EOFF;
1328 
1329 	/* Set the length of this packet. */
1330 	m->m_len = len;
1331 
1332 	/* Get a packet. */
1333 	if (sc->sc_flags & FE_FLAGS_SBW_BYTE)
1334 		bus_space_read_multi_1(bst, bsh, FE_BMPR8,
1335 		    mtod(m, uint8_t *), len);
1336 	else
1337 		bus_space_read_multi_stream_2(bst, bsh, FE_BMPR8,
1338 		    mtod(m, uint16_t *), (len + 1) >> 1);
1339 
1340 	/*
1341 	 * Check if there's a BPF listener on this interface.  If so, hand off
1342 	 * the raw packet to bpf.
1343 	 */
1344 	if (ifp->if_bpf)
1345 		bpf_ops->bpf_mtap(ifp->if_bpf, m);
1346 
1347 	(*ifp->if_input)(ifp, m);
1348 	return 1;
1349 }
1350 
1351 /*
1352  * Write an mbuf chain to the transmission buffer memory using 16 bit PIO.
1353  * Returns number of bytes actually written, including length word.
1354  *
1355  * If an mbuf chain is too long for an Ethernet frame, it is not sent.
1356  * Packets shorter than Ethernet minimum are legal, and we pad them
1357  * before sending out.  An exception is "partial" packets which are
1358  * shorter than mandatory Ethernet header.
1359  *
1360  * I wrote a code for an experimental "delayed padding" technique.
1361  * When employed, it postpones the padding process for short packets.
1362  * If xmit() occurred at the moment, the padding process is omitted, and
1363  * garbages are sent as pad data.  If next packet is stored in the
1364  * transmission buffer before xmit(), write_mbuf() pads the previous
1365  * packet before transmitting new packet.  This *may* gain the
1366  * system performance (slightly).
1367  */
1368 void
1369 mb86960_write_mbufs(struct mb86960_softc *sc, struct mbuf *m)
1370 {
1371 	bus_space_tag_t bst = sc->sc_bst;
1372 	bus_space_handle_t bsh = sc->sc_bsh;
1373 	int totlen, len;
1374 #if FE_DEBUG >= 2
1375 	struct mbuf *mp;
1376 #endif
1377 
1378 #if FE_DELAYED_PADDING
1379 	/* Do the "delayed padding." */
1380 	if (sc->txb_padding > 0) {
1381 		if (sc->sc_flags & FE_FLAGS_SBW_BYTE) {
1382 			for (len = sc->txb_padding; len > 0; len--)
1383 				bus_space_write_1(bst, bsh, FE_BMPR8, 0);
1384 		} else {
1385 			for (len = sc->txb_padding >> 1; len > 0; len--)
1386 				bus_space_write_2(bst, bsh, FE_BMPR8, 0);
1387 		}
1388 		sc->txb_padding = 0;
1389 	}
1390 #endif
1391 
1392 	/* We need to use m->m_pkthdr.len, so require the header */
1393 	if ((m->m_flags & M_PKTHDR) == 0)
1394 	  	panic("mb86960_write_mbufs: no header mbuf");
1395 
1396 #if FE_DEBUG >= 2
1397 	/* First, count up the total number of bytes to copy. */
1398 	for (totlen = 0, mp = m; mp != 0; mp = mp->m_next)
1399 		totlen += mp->m_len;
1400 	/* Check if this matches the one in the packet header. */
1401 	if (totlen != m->m_pkthdr.len)
1402 		log(LOG_WARNING, "%s: packet length mismatch? (%d/%d)\n",
1403 		    device_xname(sc->sc_dev), totlen, m->m_pkthdr.len);
1404 #else
1405 	/* Just use the length value in the packet header. */
1406 	totlen = m->m_pkthdr.len;
1407 #endif
1408 
1409 #if FE_DEBUG >= 1
1410 	/*
1411 	 * Should never send big packets.  If such a packet is passed,
1412 	 * it should be a bug of upper layer.  We just ignore it.
1413 	 * ... Partial (too short) packets, neither.
1414 	 */
1415 	if (totlen > (ETHER_MAX_LEN - ETHER_CRC_LEN) ||
1416 	    totlen < ETHER_HDR_LEN) {
1417 		log(LOG_ERR, "%s: got a %s packet (%u bytes) to send\n",
1418 		    device_xname(sc->sc_dev),
1419 		    totlen < ETHER_HDR_LEN ? "partial" : "big", totlen);
1420 		sc->sc_ec.ec_if.if_oerrors++;
1421 		return;
1422 	}
1423 #endif
1424 
1425 	/*
1426 	 * Put the length word for this frame.
1427 	 * Does 86960 accept odd length?  -- Yes.
1428 	 * Do we need to pad the length to minimum size by ourselves?
1429 	 * -- Generally yes.  But for (or will be) the last
1430 	 * packet in the transmission buffer, we can skip the
1431 	 * padding process.  It may gain performance slightly.  FIXME.
1432 	 */
1433 	len = max(totlen, (ETHER_MIN_LEN - ETHER_CRC_LEN));
1434 	if (sc->sc_flags & FE_FLAGS_SBW_BYTE) {
1435 		bus_space_write_1(bst, bsh, FE_BMPR8, len);
1436 		bus_space_write_1(bst, bsh, FE_BMPR8, len >> 8);
1437 	} else {
1438 		bus_space_write_2(bst, bsh, FE_BMPR8, len);
1439 		/* roundup packet length since we will use word access */
1440 		totlen = (totlen + 1) & ~1;
1441 	}
1442 
1443 	/*
1444 	 * Update buffer status now.
1445 	 * Truncate the length up to an even number
1446 	 * if the chip is set in SBW_WORD mode.
1447 	 */
1448 	sc->txb_free -= FE_TXLEN_SIZE +
1449 	    max(totlen, (ETHER_MIN_LEN - ETHER_CRC_LEN));
1450 	sc->txb_count++;
1451 
1452 #if FE_DELAYED_PADDING
1453 	/* Postpone the packet padding if necessary. */
1454 	if (totlen < (ETHER_MIN_LEN - ETHER_CRC_LEN))
1455 		sc->txb_padding = (ETHER_MIN_LEN - ETHER_CRC_LEN) - totlen;
1456 #endif
1457 
1458 	/*
1459 	 * Transfer the data from mbuf chain to the transmission buffer.
1460 	 * If the MB86960 is configured in word mode, data needs to be
1461 	 * transferred as words, and only words.
1462 	 * So that we require some extra code to patch over odd-length
1463 	 * or unaligned mbufs.
1464 	 */
1465 	if (sc->sc_flags & FE_FLAGS_SBW_BYTE) {
1466 		/* It's simple in byte mode. */
1467 		for (; m != NULL; m = m->m_next) {
1468 			if (m->m_len) {
1469 				bus_space_write_multi_1(bst, bsh, FE_BMPR8,
1470 				    mtod(m, uint8_t *), m->m_len);
1471 			}
1472 		}
1473 	} else {
1474 		/* a bit trickier in word mode. */
1475 		uint8_t *data, savebyte[2];
1476 		int leftover;
1477 
1478 		leftover = 0;
1479 		savebyte[0] = savebyte[1] = 0;
1480 
1481 		for (; m != NULL; m = m->m_next) {
1482 			len = m->m_len;
1483 			if (len == 0)
1484 				continue;
1485 			data = mtod(m, uint8_t *);
1486 			while (len > 0) {
1487 				if (leftover) {
1488 					/*
1489 					 * Data left over (from mbuf or
1490 					 * realignment). Buffer the next
1491 					 * byte, and write it and the
1492 					 * leftover data out.
1493 					 */
1494 					savebyte[1] = *data++;
1495 					len--;
1496 					bus_space_write_stream_2(bst, bsh,
1497 					   FE_BMPR8, *(uint16_t *)savebyte);
1498 					leftover = 0;
1499 				} else if (BUS_SPACE_ALIGNED_POINTER(data,
1500 				    uint16_t) == 0) {
1501 					/*
1502 					 * Unaligned data; buffer the next byte.
1503 					 */
1504 					savebyte[0] = *data++;
1505 					len--;
1506 					leftover = 1;
1507 				} else {
1508 					/*
1509 					 * Aligned data; output contiguous
1510 					 * words as much as we can, then
1511 					 * buffer the remaining byte, if any.
1512 					 */
1513 					leftover = len & 1;
1514 					len &= ~1;
1515 					bus_space_write_multi_stream_2(bst, bsh,
1516 					    FE_BMPR8, (uint16_t *)data,
1517 					    len >> 1);
1518 					data += len;
1519 					if (leftover)
1520 						savebyte[0] = *data++;
1521 					len = 0;
1522 				}
1523 			}
1524 			if (len < 0)
1525 				panic("mb86960_write_mbufs: negative len");
1526 		}
1527 		if (leftover) {
1528 			savebyte[1] = 0;
1529 			bus_space_write_stream_2(bst, bsh, FE_BMPR8,
1530 			    *(uint16_t *)savebyte);
1531 		}
1532 	}
1533 #if FE_DELAYED_PADDING == 0
1534 	/*
1535 	 * Pad the packet to the minimum length if necessary.
1536 	 */
1537 	len = (ETHER_MIN_LEN - ETHER_CRC_LEN) - totlen;
1538 	if (len > 0) {
1539 		if (sc->sc_flags & FE_FLAGS_SBW_BYTE) {
1540 			while (len-- > 0)
1541 				bus_space_write_1(bst, bsh, FE_BMPR8, 0);
1542 		} else {
1543 			len >>= 1;
1544 			while (len-- > 0)
1545 				bus_space_write_2(bst, bsh, FE_BMPR8, 0);
1546 		}
1547 	}
1548 #endif
1549 }
1550 
1551 /*
1552  * Compute the multicast address filter from the
1553  * list of multicast addresses we need to listen to.
1554  */
1555 void
1556 mb86960_getmcaf(struct ethercom *ec, uint8_t *af)
1557 {
1558 	struct ifnet *ifp = &ec->ec_if;
1559 	struct ether_multi *enm;
1560 	uint32_t crc;
1561 	struct ether_multistep step;
1562 
1563 	/*
1564 	 * Set up multicast address filter by passing all multicast addresses
1565 	 * through a crc generator, and then using the high order 6 bits as an
1566 	 * index into the 64 bit logical address filter.  The high order bit
1567 	 * selects the word, while the rest of the bits select the bit within
1568 	 * the word.
1569 	 */
1570 
1571 	if ((ifp->if_flags & IFF_PROMISC) != 0)
1572 		goto allmulti;
1573 
1574 	memset(af, 0, FE_FILTER_LEN);
1575 	ETHER_FIRST_MULTI(step, ec, enm);
1576 	while (enm != NULL) {
1577 		if (memcmp(enm->enm_addrlo, enm->enm_addrhi,
1578 		    sizeof(enm->enm_addrlo)) != 0) {
1579 			/*
1580 			 * We must listen to a range of multicast addresses.
1581 			 * For now, just accept all multicasts, rather than
1582 			 * trying to set only those filter bits needed to match
1583 			 * the range.  (At this time, the only use of address
1584 			 * ranges is for IP multicast routing, for which the
1585 			 * range is big enough to require all bits set.)
1586 			 */
1587 			goto allmulti;
1588 		}
1589 
1590 		crc = ether_crc32_le(enm->enm_addrlo, ETHER_ADDR_LEN);
1591 
1592 		/* Just want the 6 most significant bits. */
1593 		crc >>= 26;
1594 
1595 		/* Turn on the corresponding bit in the filter. */
1596 		af[crc >> 3] |= 1 << (crc & 7);
1597 
1598 		ETHER_NEXT_MULTI(step, enm);
1599 	}
1600 	ifp->if_flags &= ~IFF_ALLMULTI;
1601 	return;
1602 
1603 allmulti:
1604 	ifp->if_flags |= IFF_ALLMULTI;
1605 	memset(af, 0xff, FE_FILTER_LEN);
1606 }
1607 
1608 /*
1609  * Calculate a new "multicast packet filter" and put the 86960
1610  * receiver in appropriate mode.
1611  */
1612 void
1613 mb86960_setmode(struct mb86960_softc *sc)
1614 {
1615 	bus_space_tag_t bst = sc->sc_bst;
1616 	bus_space_handle_t bsh = sc->sc_bsh;
1617 	int flags = sc->sc_ec.ec_if.if_flags;
1618 
1619 	/*
1620 	 * If the interface is not running, we postpone the update
1621 	 * process for receive modes and multicast address filter
1622 	 * until the interface is restarted.  It reduces some
1623 	 * complicated job on maintaining chip states.  (Earlier versions
1624 	 * of this driver had a bug on that point...)
1625 	 *
1626 	 * To complete the trick, mb86960_init() calls mb86960_setmode() after
1627 	 * restarting the interface.
1628 	 */
1629 	if ((flags & IFF_RUNNING) == 0)
1630 		return;
1631 
1632 	/*
1633 	 * Promiscuous mode is handled separately.
1634 	 */
1635 	if ((flags & IFF_PROMISC) != 0) {
1636 		/*
1637 		 * Program 86960 to receive all packets on the segment
1638 		 * including those directed to other stations.
1639 		 * Multicast filter stored in MARs are ignored
1640 		 * under this setting, so we don't need to update it.
1641 		 *
1642 		 * Promiscuous mode is used solely by BPF, and BPF only
1643 		 * listens to valid (no error) packets.  So, we ignore
1644 		 * errornous ones even in this mode.
1645 		 */
1646 		bus_space_write_1(bst, bsh, FE_DLCR5,
1647 		    sc->proto_dlcr5 | FE_D5_AFM0 | FE_D5_AFM1);
1648 		sc->filter_change = 0;
1649 
1650 #if FE_DEBUG >= 3
1651 		log(LOG_INFO, "%s: promiscuous mode\n",
1652 		    device_xname(sc->sc_dev));
1653 #endif
1654 		return;
1655 	}
1656 
1657 	/*
1658 	 * Turn the chip to the normal (non-promiscuous) mode.
1659 	 */
1660 	bus_space_write_1(bst, bsh, FE_DLCR5, sc->proto_dlcr5 | FE_D5_AFM1);
1661 
1662 	/*
1663 	 * Find the new multicast filter value.
1664 	 */
1665 	mb86960_getmcaf(&sc->sc_ec, sc->filter);
1666 	sc->filter_change = 1;
1667 
1668 #if FE_DEBUG >= 3
1669 	log(LOG_INFO,
1670 	    "%s: address filter: [%02x %02x %02x %02x %02x %02x %02x %02x]\n",
1671 	    device_xname(sc->sc_dev),
1672 	    sc->filter[0], sc->filter[1], sc->filter[2], sc->filter[3],
1673 	    sc->filter[4], sc->filter[5], sc->filter[6], sc->filter[7]);
1674 #endif
1675 
1676 	/*
1677 	 * We have to update the multicast filter in the 86960, A.S.A.P.
1678 	 *
1679 	 * Note that the DLC (Data Linc Control unit, i.e. transmitter
1680 	 * and receiver) must be stopped when feeding the filter, and
1681 	 * DLC trashes all packets in both transmission and receive
1682 	 * buffers when stopped.
1683 	 *
1684 	 * ... Are the above sentenses correct?  I have to check the
1685 	 *     manual of the MB86960A.  FIXME.
1686 	 *
1687 	 * To reduce the packet lossage, we delay the filter update
1688 	 * process until buffers are empty.
1689 	 */
1690 	if (sc->txb_sched == 0 && sc->txb_count == 0 &&
1691 	    (bus_space_read_1(bst, bsh, FE_DLCR1) & FE_D1_PKTRDY) == 0) {
1692 		/*
1693 		 * Buffers are (apparently) empty.  Load
1694 		 * the new filter value into MARs now.
1695 		 */
1696 		mb86960_loadmar(sc);
1697 	} else {
1698 		/*
1699 		 * Buffers are not empty.  Mark that we have to update
1700 		 * the MARs.  The new filter will be loaded by mb86960_intr()
1701 		 * later.
1702 		 */
1703 #if FE_DEBUG >= 4
1704 		log(LOG_INFO, "%s: filter change delayed\n",
1705 		    device_xname(sc->sc_dev));
1706 #endif
1707 	}
1708 }
1709 
1710 /*
1711  * Load a new multicast address filter into MARs.
1712  *
1713  * The caller must have splnet'ed befor mb86960_loadmar.
1714  * This function starts the DLC upon return.  So it can be called only
1715  * when the chip is working, i.e., from the driver's point of view, when
1716  * a device is RUNNING.  (I mistook the point in previous versions.)
1717  */
1718 void
1719 mb86960_loadmar(struct mb86960_softc *sc)
1720 {
1721 	bus_space_tag_t bst = sc->sc_bst;
1722 	bus_space_handle_t bsh = sc->sc_bsh;
1723 
1724 	/* Stop the DLC (transmitter and receiver). */
1725 	bus_space_write_1(bst, bsh, FE_DLCR6,
1726 	    sc->proto_dlcr6 | FE_D6_DLC_DISABLE);
1727 
1728 	/* Select register bank 1 for MARs. */
1729 	bus_space_write_1(bst, bsh, FE_DLCR7,
1730 	    sc->proto_dlcr7 | FE_D7_RBS_MAR | FE_D7_POWER_UP);
1731 
1732 	/* Copy filter value into the registers. */
1733 	bus_space_write_region_1(bst, bsh, FE_MAR8, sc->filter, FE_FILTER_LEN);
1734 
1735 	/* Restore the bank selection for BMPRs (i.e., runtime registers). */
1736 	bus_space_write_1(bst, bsh, FE_DLCR7,
1737 	    sc->proto_dlcr7 | FE_D7_RBS_BMPR | FE_D7_POWER_UP);
1738 
1739 	/* Restart the DLC. */
1740 	bus_space_write_1(bst, bsh, FE_DLCR6,
1741 	    sc->proto_dlcr6 | FE_D6_DLC_ENABLE);
1742 
1743 	/* We have just updated the filter. */
1744 	sc->filter_change = 0;
1745 
1746 #if FE_DEBUG >= 3
1747 	log(LOG_INFO, "%s: address filter changed\n", device_xname(sc->sc_dev));
1748 #endif
1749 }
1750 
1751 /*
1752  * Enable power on the interface.
1753  */
1754 int
1755 mb86960_enable(struct mb86960_softc *sc)
1756 {
1757 
1758 #if FE_DEBUG >= 3
1759 	log(LOG_INFO, "%s: mb86960_enable()\n", device_xname(sc->sc_dev));
1760 #endif
1761 
1762 	if ((sc->sc_stat & FE_STAT_ENABLED) == 0 && sc->sc_enable != NULL) {
1763 		if ((*sc->sc_enable)(sc) != 0) {
1764 			aprint_error_dev(sc->sc_dev, "device enable failed\n");
1765 			return EIO;
1766 		}
1767 	}
1768 
1769 	sc->sc_stat |= FE_STAT_ENABLED;
1770 	return 0;
1771 }
1772 
1773 /*
1774  * Disable power on the interface.
1775  */
1776 void
1777 mb86960_disable(struct mb86960_softc *sc)
1778 {
1779 
1780 #if FE_DEBUG >= 3
1781 	log(LOG_INFO, "%s: mb86960_disable()\n", device_xname(sc->sc_dev));
1782 #endif
1783 
1784 	if ((sc->sc_stat & FE_STAT_ENABLED) != 0 && sc->sc_disable != NULL) {
1785 		(*sc->sc_disable)(sc);
1786 		sc->sc_stat &= ~FE_STAT_ENABLED;
1787 	}
1788 }
1789 
1790 /*
1791  * mbe_activate:
1792  *
1793  *	Handle device activation/deactivation requests.
1794  */
1795 int
1796 mb86960_activate(device_t self, enum devact act)
1797 {
1798 	struct mb86960_softc *sc = device_private(self);
1799 
1800 	switch (act) {
1801 	case DVACT_DEACTIVATE:
1802 		if_deactivate(&sc->sc_ec.ec_if);
1803 		return 0;
1804 	default:
1805 		return EOPNOTSUPP;
1806 	}
1807 }
1808 
1809 /*
1810  * mb86960_detach:
1811  *
1812  *	Detach a MB86960 interface.
1813  */
1814 int
1815 mb86960_detach(struct mb86960_softc *sc)
1816 {
1817 	struct ifnet *ifp = &sc->sc_ec.ec_if;
1818 
1819 	/* Succeed now if there's no work to do. */
1820 	if ((sc->sc_stat & FE_STAT_ATTACHED) == 0)
1821 		return 0;
1822 
1823 	/* Delete all media. */
1824 	ifmedia_delete_instance(&sc->sc_media, IFM_INST_ANY);
1825 
1826 #if NRND > 0
1827 	/* Unhook the entropy source. */
1828 	rnd_detach_source(&sc->rnd_source);
1829 #endif
1830 	ether_ifdetach(ifp);
1831 	if_detach(ifp);
1832 
1833 	mb86960_disable(sc);
1834 	return 0;
1835 }
1836 
1837 /*
1838  * Routines to read all bytes from the config EEPROM (93C06) through MB86965A.
1839  */
1840 void
1841 mb86965_read_eeprom(bus_space_tag_t iot, bus_space_handle_t ioh, uint8_t *data)
1842 {
1843 	int addr, op, bit;
1844 	uint16_t val;
1845 
1846 	/* Read bytes from EEPROM; two bytes per an iteration. */
1847 	for (addr = 0; addr < FE_EEPROM_SIZE / 2; addr++) {
1848 		/* Reset the EEPROM interface. */
1849 		bus_space_write_1(iot, ioh, FE_BMPR16, 0x00);
1850 		bus_space_write_1(iot, ioh, FE_BMPR17, 0x00);
1851 		bus_space_write_1(iot, ioh, FE_BMPR16, FE_B16_SELECT);
1852 
1853 		/* Send start bit. */
1854 		bus_space_write_1(iot, ioh, FE_BMPR17, FE_B17_DATA);
1855 		FE_EEPROM_DELAY();
1856 		bus_space_write_1(iot, ioh,
1857 		    FE_BMPR16, FE_B16_SELECT | FE_B16_CLOCK);
1858 		FE_EEPROM_DELAY();
1859 		bus_space_write_1(iot, ioh, FE_BMPR16, FE_B16_SELECT);
1860 
1861 		/* Send read command and read address. */
1862 		op = 0x80 | addr;	/* READ instruction */
1863 		for (bit = 8; bit > 0; bit--) {
1864 			bus_space_write_1(iot, ioh, FE_BMPR17,
1865 			    (op & (1 << (bit - 1))) ? FE_B17_DATA : 0);
1866 			FE_EEPROM_DELAY();
1867 			bus_space_write_1(iot, ioh,
1868 			    FE_BMPR16, FE_B16_SELECT | FE_B16_CLOCK);
1869 			FE_EEPROM_DELAY();
1870 			bus_space_write_1(iot, ioh, FE_BMPR16, FE_B16_SELECT);
1871 		}
1872 		bus_space_write_1(iot, ioh, FE_BMPR17, 0x00);
1873 
1874 		/* Read two bytes in each address */
1875 		val = 0;
1876 		for (bit = 16; bit > 0; bit--) {
1877 			FE_EEPROM_DELAY();
1878 			bus_space_write_1(iot, ioh,
1879 			    FE_BMPR16, FE_B16_SELECT | FE_B16_CLOCK);
1880 			FE_EEPROM_DELAY();
1881 			if (bus_space_read_1(iot, ioh, FE_BMPR17) &
1882 			    FE_B17_DATA)
1883 				val |= 1 << (bit - 1);
1884 			bus_space_write_1(iot, ioh,
1885 			    FE_BMPR16, FE_B16_SELECT);
1886 		}
1887 		data[addr * 2]     = val >> 8;
1888 		data[addr * 2 + 1] = val & 0xff;
1889 	}
1890 
1891 	/* Make sure the EEPROM is turned off. */
1892 	bus_space_write_1(iot, ioh, FE_BMPR16, 0);
1893 	bus_space_write_1(iot, ioh, FE_BMPR17, 0);
1894 
1895 #if FE_DEBUG >= 3
1896 	/* Report what we got. */
1897 	log(LOG_INFO, "mb86965_read_eeprom: "
1898 	    " %02x%02x%02x%02x %02x%02x%02x%02x -"
1899 	    " %02x%02x%02x%02x %02x%02x%02x%02x -"
1900 	    " %02x%02x%02x%02x %02x%02x%02x%02x -"
1901 	    " %02x%02x%02x%02x %02x%02x%02x%02x\n",
1902 	    data[ 0], data[ 1], data[ 2], data[ 3],
1903 	    data[ 4], data[ 5], data[ 6], data[ 7],
1904 	    data[ 8], data[ 9], data[10], data[11],
1905 	    data[12], data[13], data[14], data[15],
1906 	    data[16], data[17], data[18], data[19],
1907 	    data[20], data[21], data[22], data[23],
1908 	    data[24], data[25], data[26], data[27],
1909 	    data[28], data[29], data[30], data[31]);
1910 #endif
1911 }
1912 
1913 #if FE_DEBUG >= 1
1914 void
1915 mb86960_dump(int level, struct mb86960_softc *sc)
1916 {
1917 	bus_space_tag_t bst = sc->sc_bst;
1918 	bus_space_handle_t bsh = sc->sc_bsh;
1919 	uint8_t save_dlcr7;
1920 
1921 	save_dlcr7 = bus_space_read_1(bst, bsh, FE_DLCR7);
1922 
1923 	log(level, "\tDLCR = %02x %02x %02x %02x %02x %02x %02x %02x\n",
1924 	    bus_space_read_1(bst, bsh, FE_DLCR0),
1925 	    bus_space_read_1(bst, bsh, FE_DLCR1),
1926 	    bus_space_read_1(bst, bsh, FE_DLCR2),
1927 	    bus_space_read_1(bst, bsh, FE_DLCR3),
1928 	    bus_space_read_1(bst, bsh, FE_DLCR4),
1929 	    bus_space_read_1(bst, bsh, FE_DLCR5),
1930 	    bus_space_read_1(bst, bsh, FE_DLCR6),
1931 	    bus_space_read_1(bst, bsh, FE_DLCR7));
1932 
1933 	bus_space_write_1(bst, bsh, FE_DLCR7,
1934 	    (save_dlcr7 & ~FE_D7_RBS) | FE_D7_RBS_DLCR);
1935 	log(level, "\t       %02x %02x %02x %02x %02x %02x %02x %02x\n",
1936 	    bus_space_read_1(bst, bsh, FE_DLCR8),
1937 	    bus_space_read_1(bst, bsh, FE_DLCR9),
1938 	    bus_space_read_1(bst, bsh, FE_DLCR10),
1939 	    bus_space_read_1(bst, bsh, FE_DLCR11),
1940 	    bus_space_read_1(bst, bsh, FE_DLCR12),
1941 	    bus_space_read_1(bst, bsh, FE_DLCR13),
1942 	    bus_space_read_1(bst, bsh, FE_DLCR14),
1943 	    bus_space_read_1(bst, bsh, FE_DLCR15));
1944 
1945 	bus_space_write_1(bst, bsh, FE_DLCR7,
1946 	    (save_dlcr7 & ~FE_D7_RBS) | FE_D7_RBS_MAR);
1947 	log(level, "\tMAR  = %02x %02x %02x %02x %02x %02x %02x %02x\n",
1948 	    bus_space_read_1(bst, bsh, FE_MAR8),
1949 	    bus_space_read_1(bst, bsh, FE_MAR9),
1950 	    bus_space_read_1(bst, bsh, FE_MAR10),
1951 	    bus_space_read_1(bst, bsh, FE_MAR11),
1952 	    bus_space_read_1(bst, bsh, FE_MAR12),
1953 	    bus_space_read_1(bst, bsh, FE_MAR13),
1954 	    bus_space_read_1(bst, bsh, FE_MAR14),
1955 	    bus_space_read_1(bst, bsh, FE_MAR15));
1956 
1957 	bus_space_write_1(bst, bsh, FE_DLCR7,
1958 	    (save_dlcr7 & ~FE_D7_RBS) | FE_D7_RBS_BMPR);
1959 	log(level,
1960 	    "\tBMPR = xx xx %02x %02x %02x %02x %02x %02x %02x %02x xx %02x\n",
1961 	    bus_space_read_1(bst, bsh, FE_BMPR10),
1962 	    bus_space_read_1(bst, bsh, FE_BMPR11),
1963 	    bus_space_read_1(bst, bsh, FE_BMPR12),
1964 	    bus_space_read_1(bst, bsh, FE_BMPR13),
1965 	    bus_space_read_1(bst, bsh, FE_BMPR14),
1966 	    bus_space_read_1(bst, bsh, FE_BMPR15),
1967 	    bus_space_read_1(bst, bsh, FE_BMPR16),
1968 	    bus_space_read_1(bst, bsh, FE_BMPR17),
1969 	    bus_space_read_1(bst, bsh, FE_BMPR19));
1970 
1971 	bus_space_write_1(bst, bsh, FE_DLCR7, save_dlcr7);
1972 }
1973 #endif
1974 
1975