xref: /netbsd-src/sys/dev/ic/mb86960.c (revision ba65fde2d7fefa7d39838fa5fa855e62bd606b5e)
1 /*	$NetBSD: mb86960.c,v 1.78 2012/02/02 19:43:03 tls Exp $	*/
2 
3 /*
4  * All Rights Reserved, Copyright (C) Fujitsu Limited 1995
5  *
6  * This software may be used, modified, copied, distributed, and sold, in
7  * both source and binary form provided that the above copyright, these
8  * terms and the following disclaimer are retained.  The name of the author
9  * and/or the contributor may not be used to endorse or promote products
10  * derived from this software without specific prior written permission.
11  *
12  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND THE CONTRIBUTOR ``AS IS'' AND
13  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
14  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
15  * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR THE CONTRIBUTOR BE LIABLE
16  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
17  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
18  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION.
19  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
20  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
21  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
22  * SUCH DAMAGE.
23  */
24 
25 /*
26  * Portions copyright (C) 1993, David Greenman.  This software may be used,
27  * modified, copied, distributed, and sold, in both source and binary form
28  * provided that the above copyright and these terms are retained.  Under no
29  * circumstances is the author responsible for the proper functioning of this
30  * software, nor does the author assume any responsibility for damages
31  * incurred with its use.
32  */
33 
34 #include <sys/cdefs.h>
35 __KERNEL_RCSID(0, "$NetBSD: mb86960.c,v 1.78 2012/02/02 19:43:03 tls Exp $");
36 
37 /*
38  * Device driver for Fujitsu MB86960A/MB86965A based Ethernet cards.
39  * Contributed by M.S. <seki@sysrap.cs.fujitsu.co.jp>
40  *
41  * This version is intended to be a generic template for various
42  * MB86960A/MB86965A based Ethernet cards.  It currently supports
43  * Fujitsu FMV-180 series (i.e., FMV-181 and FMV-182) and Allied-
44  * Telesis AT1700 series and RE2000 series.  There are some
45  * unnecessary hooks embedded, which are primarily intended to support
46  * other types of Ethernet cards, but the author is not sure whether
47  * they are useful.
48  */
49 
50 #include "opt_inet.h"
51 
52 #include <sys/param.h>
53 #include <sys/systm.h>
54 #include <sys/errno.h>
55 #include <sys/ioctl.h>
56 #include <sys/mbuf.h>
57 #include <sys/socket.h>
58 #include <sys/syslog.h>
59 #include <sys/device.h>
60 #include <sys/rnd.h>
61 
62 #include <net/if.h>
63 #include <net/if_dl.h>
64 #include <net/if_types.h>
65 #include <net/if_media.h>
66 #include <net/if_ether.h>
67 
68 #ifdef INET
69 #include <netinet/in.h>
70 #include <netinet/in_systm.h>
71 #include <netinet/in_var.h>
72 #include <netinet/ip.h>
73 #include <netinet/if_inarp.h>
74 #endif
75 
76 
77 #include <net/bpf.h>
78 #include <net/bpfdesc.h>
79 
80 #include <sys/bus.h>
81 
82 #include <dev/ic/mb86960reg.h>
83 #include <dev/ic/mb86960var.h>
84 
85 #ifndef __BUS_SPACE_HAS_STREAM_METHODS
86 #define bus_space_write_stream_2	bus_space_write_2
87 #define bus_space_write_multi_stream_2	bus_space_write_multi_2
88 #define bus_space_read_multi_stream_2	bus_space_read_multi_2
89 #endif /* __BUS_SPACE_HAS_STREAM_METHODS */
90 
91 /* Standard driver entry points.  These can be static. */
92 void	mb86960_init(struct mb86960_softc *);
93 int	mb86960_ioctl(struct ifnet *, u_long, void *);
94 void	mb86960_start(struct ifnet *);
95 void	mb86960_reset(struct mb86960_softc *);
96 void	mb86960_watchdog(struct ifnet *);
97 
98 /* Local functions.  Order of declaration is confused.  FIXME. */
99 int	mb86960_get_packet(struct mb86960_softc *, u_int);
100 void	mb86960_stop(struct mb86960_softc *);
101 void	mb86960_tint(struct mb86960_softc *, uint8_t);
102 void	mb86960_rint(struct mb86960_softc *, uint8_t);
103 static inline
104 void	mb86960_xmit(struct mb86960_softc *);
105 void	mb86960_write_mbufs(struct mb86960_softc *, struct mbuf *);
106 static inline
107 void	mb86960_droppacket(struct mb86960_softc *);
108 void	mb86960_getmcaf(struct ethercom *, uint8_t *);
109 void	mb86960_setmode(struct mb86960_softc *);
110 void	mb86960_loadmar(struct mb86960_softc *);
111 
112 int	mb86960_mediachange(struct ifnet *);
113 void	mb86960_mediastatus(struct ifnet *, struct ifmediareq *);
114 
115 #if FE_DEBUG >= 1
116 void	mb86960_dump(int, struct mb86960_softc *);
117 #endif
118 
119 void
120 mb86960_attach(struct mb86960_softc *sc, uint8_t *myea)
121 {
122 	bus_space_tag_t bst = sc->sc_bst;
123 	bus_space_handle_t bsh = sc->sc_bsh;
124 
125 	/* Register values which depend on board design. */
126 	sc->proto_dlcr4 = FE_D4_LBC_DISABLE | FE_D4_CNTRL;
127 	sc->proto_dlcr5 = 0;
128 	sc->proto_dlcr7 = FE_D7_BYTSWP_LH;
129 	if ((sc->sc_flags & FE_FLAGS_MB86960) != 0)
130 		sc->proto_dlcr7 |= FE_D7_ED_TEST; /* XXX */
131 	sc->proto_bmpr13 = FE_B13_TPTYPE_UTP | FE_B13_PORT_AUTO;
132 
133 	/*
134 	 * Program the 86960 as following defaults:
135 	 *	SRAM: 32KB, 100ns, byte-wide access.
136 	 *	Transmission buffer: 4KB x 2.
137 	 *	System bus interface: 16 bits.
138 	 * These values except TXBSIZE should be modified as per
139 	 * sc_flags which is set in MD attachments, because they
140 	 * are hard-wired on the board. Modifying TXBSIZE will affect
141 	 * the driver performance.
142 	 */
143 	sc->proto_dlcr6 = FE_D6_BUFSIZ_32KB | FE_D6_TXBSIZ_2x4KB |
144 	    FE_D6_BBW_BYTE | FE_D6_SRAM_100ns;
145 	if (sc->sc_flags & FE_FLAGS_SBW_BYTE)
146 		sc->proto_dlcr6 |= FE_D6_SBW_BYTE;
147 	if (sc->sc_flags & FE_FLAGS_SRAM_150ns)
148 		sc->proto_dlcr6 &= ~FE_D6_SRAM_100ns;
149 
150 	/*
151 	 * Minimum initialization of the hardware.
152 	 * We write into registers; hope I/O ports have no
153 	 * overlap with other boards.
154 	 */
155 
156 	/* Initialize 86960. */
157 	bus_space_write_1(bst, bsh, FE_DLCR6,
158 	    sc->proto_dlcr6 | FE_D6_DLC_DISABLE);
159 	delay(200);
160 
161 #ifdef DIAGNOSTIC
162 	if (myea == NULL) {
163 		aprint_error_dev(sc->sc_dev,
164 		    "ethernet address shouldn't be NULL\n");
165 		panic("NULL ethernet address");
166 	}
167 #endif
168 	memcpy(sc->sc_enaddr, myea, sizeof(sc->sc_enaddr));
169 
170 	/* Disable all interrupts. */
171 	bus_space_write_1(bst, bsh, FE_DLCR2, 0);
172 	bus_space_write_1(bst, bsh, FE_DLCR3, 0);
173 }
174 
175 /*
176  * Install interface into kernel networking data structures
177  */
178 void
179 mb86960_config(struct mb86960_softc *sc, int *media, int nmedia, int defmedia)
180 {
181 	cfdata_t cf = device_cfdata(sc->sc_dev);
182 	struct ifnet *ifp = &sc->sc_ec.ec_if;
183 	int i;
184 
185 	/* Stop the 86960. */
186 	mb86960_stop(sc);
187 
188 	/* Initialize ifnet structure. */
189 	strlcpy(ifp->if_xname, device_xname(sc->sc_dev), IFNAMSIZ);
190 	ifp->if_softc = sc;
191 	ifp->if_start = mb86960_start;
192 	ifp->if_ioctl = mb86960_ioctl;
193 	ifp->if_watchdog = mb86960_watchdog;
194 	ifp->if_flags =
195 	    IFF_BROADCAST | IFF_SIMPLEX | IFF_NOTRAILERS | IFF_MULTICAST;
196 	IFQ_SET_READY(&ifp->if_snd);
197 
198 #if FE_DEBUG >= 3
199 	log(LOG_INFO, "%s: mb86960_config()\n", device_xname(sc->sc_dev));
200 	mb86960_dump(LOG_INFO, sc);
201 #endif
202 
203 #if FE_SINGLE_TRANSMISSION
204 	/* Override txb config to allocate minimum. */
205 	sc->proto_dlcr6 &= ~FE_D6_TXBSIZ;
206 	sc->proto_dlcr6 |=  FE_D6_TXBSIZ_2x2KB;
207 #endif
208 
209 	/* Modify hardware config if it is requested. */
210 	if ((cf->cf_flags & FE_FLAGS_OVERRIDE_DLCR6) != 0)
211 		sc->proto_dlcr6 = cf->cf_flags & FE_FLAGS_DLCR6_VALUE;
212 
213 	/* Find TX buffer size, based on the hardware dependent proto. */
214 	switch (sc->proto_dlcr6 & FE_D6_TXBSIZ) {
215 	case FE_D6_TXBSIZ_2x2KB:
216 		sc->txb_size = 2048;
217 		break;
218 	case FE_D6_TXBSIZ_2x4KB:
219 		sc->txb_size = 4096;
220 		break;
221 	case FE_D6_TXBSIZ_2x8KB:
222 		sc->txb_size = 8192;
223 		break;
224 	default:
225 		/* Oops, we can't work with single buffer configuration. */
226 #if FE_DEBUG >= 2
227 		log(LOG_WARNING, "%s: strange TXBSIZ config; fixing\n",
228 		    device_xname(sc->sc_dev));
229 #endif
230 		sc->proto_dlcr6 &= ~FE_D6_TXBSIZ;
231 		sc->proto_dlcr6 |=  FE_D6_TXBSIZ_2x2KB;
232 		sc->txb_size = 2048;
233 		break;
234 	}
235 
236 	/* Initialize media goo. */
237 	ifmedia_init(&sc->sc_media, 0, mb86960_mediachange,
238 	    mb86960_mediastatus);
239 	if (media != NULL) {
240 		for (i = 0; i < nmedia; i++)
241 			ifmedia_add(&sc->sc_media, media[i], 0, NULL);
242 		ifmedia_set(&sc->sc_media, defmedia);
243 	} else {
244 		ifmedia_add(&sc->sc_media, IFM_ETHER|IFM_MANUAL, 0, NULL);
245 		ifmedia_set(&sc->sc_media, IFM_ETHER|IFM_MANUAL);
246 	}
247 
248 	/* Attach the interface. */
249 	if_attach(ifp);
250 	ether_ifattach(ifp, sc->sc_enaddr);
251 
252 	rnd_attach_source(&sc->rnd_source, device_xname(sc->sc_dev),
253 	    RND_TYPE_NET, 0);
254 
255 	/* Print additional info when attached. */
256 	aprint_normal_dev(sc->sc_dev, "Ethernet address %s\n",
257 	    ether_sprintf(sc->sc_enaddr));
258 
259 #if FE_DEBUG >= 3
260 	{
261 		int buf, txb, bbw, sbw, ram;
262 
263 		buf = txb = bbw = sbw = ram = -1;
264 		switch (sc->proto_dlcr6 & FE_D6_BUFSIZ) {
265 		case FE_D6_BUFSIZ_8KB:
266 			buf = 8;
267 			break;
268 		case FE_D6_BUFSIZ_16KB:
269 			buf = 16;
270 			break;
271 		case FE_D6_BUFSIZ_32KB:
272 			buf = 32;
273 			break;
274 		case FE_D6_BUFSIZ_64KB:
275 			buf = 64;
276 			break;
277 		}
278 		switch (sc->proto_dlcr6 & FE_D6_TXBSIZ) {
279 		case FE_D6_TXBSIZ_2x2KB:
280 			txb = 2;
281 			break;
282 		case FE_D6_TXBSIZ_2x4KB:
283 			txb = 4;
284 			break;
285 		case FE_D6_TXBSIZ_2x8KB:
286 			txb = 8;
287 			break;
288 		}
289 		switch (sc->proto_dlcr6 & FE_D6_BBW) {
290 		case FE_D6_BBW_BYTE:
291 			bbw = 8;
292 			break;
293 		case FE_D6_BBW_WORD:
294 			bbw = 16;
295 			break;
296 		}
297 		switch (sc->proto_dlcr6 & FE_D6_SBW) {
298 		case FE_D6_SBW_BYTE:
299 			sbw = 8;
300 			break;
301 		case FE_D6_SBW_WORD:
302 			sbw = 16;
303 			break;
304 		}
305 		switch (sc->proto_dlcr6 & FE_D6_SRAM) {
306 		case FE_D6_SRAM_100ns:
307 			ram = 100;
308 			break;
309 		case FE_D6_SRAM_150ns:
310 			ram = 150;
311 			break;
312 		}
313 		aprint_debug_dev(sc->sc_dev,
314 		    "SRAM %dKB %dbit %dns, TXB %dKBx2, %dbit I/O\n",
315 		    buf, bbw, ram, txb, sbw);
316 	}
317 #endif
318 
319 	/* The attach is successful. */
320 	sc->sc_stat |= FE_STAT_ATTACHED;
321 }
322 
323 /*
324  * Media change callback.
325  */
326 int
327 mb86960_mediachange(struct ifnet *ifp)
328 {
329 	struct mb86960_softc *sc = ifp->if_softc;
330 
331 	if (sc->sc_mediachange)
332 		return (*sc->sc_mediachange)(sc);
333 	return 0;
334 }
335 
336 /*
337  * Media status callback.
338  */
339 void
340 mb86960_mediastatus(struct ifnet *ifp, struct ifmediareq *ifmr)
341 {
342 	struct mb86960_softc *sc = ifp->if_softc;
343 
344 	if ((sc->sc_stat & FE_STAT_ENABLED) == 0) {
345 		ifmr->ifm_active = IFM_ETHER | IFM_NONE;
346 		ifmr->ifm_status = 0;
347 		return;
348 	}
349 
350 	if (sc->sc_mediastatus)
351 		(*sc->sc_mediastatus)(sc, ifmr);
352 }
353 
354 /*
355  * Reset interface.
356  */
357 void
358 mb86960_reset(struct mb86960_softc *sc)
359 {
360 	int s;
361 
362 	s = splnet();
363 	mb86960_stop(sc);
364 	mb86960_init(sc);
365 	splx(s);
366 }
367 
368 /*
369  * Stop everything on the interface.
370  *
371  * All buffered packets, both transmitting and receiving,
372  * if any, will be lost by stopping the interface.
373  */
374 void
375 mb86960_stop(struct mb86960_softc *sc)
376 {
377 	bus_space_tag_t bst = sc->sc_bst;
378 	bus_space_handle_t bsh = sc->sc_bsh;
379 
380 #if FE_DEBUG >= 3
381 	log(LOG_INFO, "%s: top of mb86960_stop()\n", device_xname(sc->sc_dev));
382 	mb86960_dump(LOG_INFO, sc);
383 #endif
384 
385 	/* Disable interrupts. */
386 	bus_space_write_1(bst, bsh, FE_DLCR2, 0x00);
387 	bus_space_write_1(bst, bsh, FE_DLCR3, 0x00);
388 
389 	/* Stop interface hardware. */
390 	delay(200);
391 	bus_space_write_1(bst, bsh, FE_DLCR6,
392 	    sc->proto_dlcr6 | FE_D6_DLC_DISABLE);
393 	delay(200);
394 
395 	/* Clear all interrupt status. */
396 	bus_space_write_1(bst, bsh, FE_DLCR0, 0xFF);
397 	bus_space_write_1(bst, bsh, FE_DLCR1, 0xFF);
398 
399 	/* Put the chip in stand-by mode. */
400 	delay(200);
401 	bus_space_write_1(bst, bsh, FE_DLCR7,
402 	    sc->proto_dlcr7 | FE_D7_POWER_DOWN);
403 	delay(200);
404 
405 	/* MAR loading can be delayed. */
406 	sc->filter_change = 0;
407 
408 	/* Call a hook. */
409 	if (sc->stop_card)
410 		(*sc->stop_card)(sc);
411 
412 #if FE_DEBUG >= 3
413 	log(LOG_INFO, "%s: end of mb86960_stop()\n", device_xname(sc->sc_dev));
414 	mb86960_dump(LOG_INFO, sc);
415 #endif
416 }
417 
418 /*
419  * Device timeout/watchdog routine. Entered if the device neglects to
420  * generate an interrupt after a transmit has been started on it.
421  */
422 void
423 mb86960_watchdog(struct ifnet *ifp)
424 {
425 	struct mb86960_softc *sc = ifp->if_softc;
426 
427 	log(LOG_ERR, "%s: device timeout\n", device_xname(sc->sc_dev));
428 #if FE_DEBUG >= 3
429 	mb86960_dump(LOG_INFO, sc);
430 #endif
431 
432 	/* Record how many packets are lost by this accident. */
433 	sc->sc_ec.ec_if.if_oerrors += sc->txb_sched + sc->txb_count;
434 
435 	mb86960_reset(sc);
436 }
437 
438 /*
439  * Drop (skip) a packet from receive buffer in 86960 memory.
440  */
441 static inline void
442 mb86960_droppacket(struct mb86960_softc *sc)
443 {
444 	bus_space_tag_t bst = sc->sc_bst;
445 	bus_space_handle_t bsh = sc->sc_bsh;
446 
447 	bus_space_write_1(bst, bsh, FE_BMPR14, FE_B14_FILTER | FE_B14_SKIP);
448 }
449 
450 /*
451  * Initialize device.
452  */
453 void
454 mb86960_init(struct mb86960_softc *sc)
455 {
456 	bus_space_tag_t bst = sc->sc_bst;
457 	bus_space_handle_t bsh = sc->sc_bsh;
458 	struct ifnet *ifp = &sc->sc_ec.ec_if;
459 	int i;
460 
461 #if FE_DEBUG >= 3
462 	log(LOG_INFO, "%s: top of mb86960_init()\n", device_xname(sc->sc_dev));
463 	mb86960_dump(LOG_INFO, sc);
464 #endif
465 
466 	/* Reset transmitter flags. */
467 	ifp->if_flags &= ~IFF_OACTIVE;
468 	ifp->if_timer = 0;
469 
470 	sc->txb_free = sc->txb_size;
471 	sc->txb_count = 0;
472 	sc->txb_sched = 0;
473 
474 	/* Do any card-specific initialization, if applicable. */
475 	if (sc->init_card)
476 		(*sc->init_card)(sc);
477 
478 #if FE_DEBUG >= 3
479 	log(LOG_INFO, "%s: after init hook\n", device_xname(sc->sc_dev));
480 	mb86960_dump(LOG_INFO, sc);
481 #endif
482 
483 	/*
484 	 * Make sure to disable the chip, also.
485 	 * This may also help re-programming the chip after
486 	 * hot insertion of PCMCIAs.
487 	 */
488 	bus_space_write_1(bst, bsh, FE_DLCR6,
489 	    sc->proto_dlcr6 | FE_D6_DLC_DISABLE);
490 	delay(200);
491 
492 	/* Power up the chip and select register bank for DLCRs. */
493 	bus_space_write_1(bst, bsh, FE_DLCR7,
494 	    sc->proto_dlcr7 | FE_D7_RBS_DLCR | FE_D7_POWER_UP);
495 	delay(200);
496 
497 	/* Feed the station address. */
498 	bus_space_write_region_1(bst, bsh, FE_DLCR8,
499 	    sc->sc_enaddr, ETHER_ADDR_LEN);
500 
501 	/* Select the BMPR bank for runtime register access. */
502 	bus_space_write_1(bst, bsh, FE_DLCR7,
503 	    sc->proto_dlcr7 | FE_D7_RBS_BMPR | FE_D7_POWER_UP);
504 
505 	/* Initialize registers. */
506 	bus_space_write_1(bst, bsh, FE_DLCR0, 0xFF);	/* Clear all bits. */
507 	bus_space_write_1(bst, bsh, FE_DLCR1, 0xFF);	/* ditto. */
508 	bus_space_write_1(bst, bsh, FE_DLCR2, 0x00);
509 	bus_space_write_1(bst, bsh, FE_DLCR3, 0x00);
510 	bus_space_write_1(bst, bsh, FE_DLCR4, sc->proto_dlcr4);
511 	bus_space_write_1(bst, bsh, FE_DLCR5, sc->proto_dlcr5);
512 	bus_space_write_1(bst, bsh, FE_BMPR10, 0x00);
513 	bus_space_write_1(bst, bsh, FE_BMPR11, FE_B11_CTRL_SKIP);
514 	bus_space_write_1(bst, bsh, FE_BMPR12, 0x00);
515 	bus_space_write_1(bst, bsh, FE_BMPR13, sc->proto_bmpr13);
516 	bus_space_write_1(bst, bsh, FE_BMPR14, FE_B14_FILTER);
517 	bus_space_write_1(bst, bsh, FE_BMPR15, 0x00);
518 
519 #if FE_DEBUG >= 3
520 	log(LOG_INFO, "%s: just before enabling DLC\n",
521 	    device_xname(sc->sc_dev));
522 	mb86960_dump(LOG_INFO, sc);
523 #endif
524 
525 	/* Enable interrupts. */
526 	bus_space_write_1(bst, bsh, FE_DLCR2, FE_TMASK);
527 	bus_space_write_1(bst, bsh, FE_DLCR3, FE_RMASK);
528 
529 	/* Enable transmitter and receiver. */
530 	delay(200);
531 	bus_space_write_1(bst, bsh, FE_DLCR6,
532 	    sc->proto_dlcr6 | FE_D6_DLC_ENABLE);
533 	delay(200);
534 
535 #if FE_DEBUG >= 3
536 	log(LOG_INFO, "%s: just after enabling DLC\n",
537 	    device_xname(sc->sc_dev));
538 	mb86960_dump(LOG_INFO, sc);
539 #endif
540 
541 	/*
542 	 * Make sure to empty the receive buffer.
543 	 *
544 	 * This may be redundant, but *if* the receive buffer were full
545 	 * at this point, the driver would hang.  I have experienced
546 	 * some strange hangups just after UP.  I hope the following
547 	 * code solve the problem.
548 	 *
549 	 * I have changed the order of hardware initialization.
550 	 * I think the receive buffer cannot have any packets at this
551 	 * point in this version.  The following code *must* be
552 	 * redundant now.  FIXME.
553 	 */
554 	for (i = 0; i < FE_MAX_RECV_COUNT; i++) {
555 		if (bus_space_read_1(bst, bsh, FE_DLCR5) & FE_D5_BUFEMP)
556 			break;
557 		mb86960_droppacket(sc);
558 	}
559 #if FE_DEBUG >= 1
560 	if (i >= FE_MAX_RECV_COUNT)
561 		log(LOG_ERR, "%s: cannot empty receive buffer\n",
562 		    device_xname(sc->sc_dev));
563 #endif
564 #if FE_DEBUG >= 3
565 	if (i < FE_MAX_RECV_COUNT)
566 		log(LOG_INFO, "%s: receive buffer emptied (%d)\n",
567 		    device_xname(sc->sc_dev), i);
568 #endif
569 
570 #if FE_DEBUG >= 3
571 	log(LOG_INFO, "%s: after ERB loop\n", device_xname(sc->sc_dev));
572 	mb86960_dump(LOG_INFO, sc);
573 #endif
574 
575 	/* Do we need this here? */
576 	bus_space_write_1(bst, bsh, FE_DLCR0, 0xFF);	/* Clear all bits. */
577 	bus_space_write_1(bst, bsh, FE_DLCR1, 0xFF);	/* ditto. */
578 
579 #if FE_DEBUG >= 3
580 	log(LOG_INFO, "%s: after FIXME\n", device_xname(sc->sc_dev));
581 	mb86960_dump(LOG_INFO, sc);
582 #endif
583 
584 	/* Set 'running' flag. */
585 	ifp->if_flags |= IFF_RUNNING;
586 
587 	/*
588 	 * At this point, the interface is runnung properly,
589 	 * except that it receives *no* packets.  we then call
590 	 * mb86960_setmode() to tell the chip what packets to be
591 	 * received, based on the if_flags and multicast group
592 	 * list.  It completes the initialization process.
593 	 */
594 	mb86960_setmode(sc);
595 
596 #if FE_DEBUG >= 3
597 	log(LOG_INFO, "%s: after setmode\n", device_xname(sc->sc_dev));
598 	mb86960_dump(LOG_INFO, sc);
599 #endif
600 
601 	/* ...and attempt to start output. */
602 	mb86960_start(ifp);
603 
604 #if FE_DEBUG >= 3
605 	log(LOG_INFO, "%s: end of mb86960_init()\n", device_xname(sc->sc_dev));
606 	mb86960_dump(LOG_INFO, sc);
607 #endif
608 }
609 
610 /*
611  * This routine actually starts the transmission on the interface
612  */
613 static inline void
614 mb86960_xmit(struct mb86960_softc *sc)
615 {
616 	bus_space_tag_t bst = sc->sc_bst;
617 	bus_space_handle_t bsh = sc->sc_bsh;
618 
619 	/*
620 	 * Set a timer just in case we never hear from the board again.
621 	 * We use longer timeout for multiple packet transmission.
622 	 * I'm not sure this timer value is appropriate.  FIXME.
623 	 */
624 	sc->sc_ec.ec_if.if_timer = 1 + sc->txb_count;
625 
626 	/* Update txb variables. */
627 	sc->txb_sched = sc->txb_count;
628 	sc->txb_count = 0;
629 	sc->txb_free = sc->txb_size;
630 
631 #if FE_DELAYED_PADDING
632 	/* Omit the postponed padding process. */
633 	sc->txb_padding = 0;
634 #endif
635 
636 	/* Start transmitter, passing packets in TX buffer. */
637 	bus_space_write_1(bst, bsh, FE_BMPR10, sc->txb_sched | FE_B10_START);
638 }
639 
640 /*
641  * Start output on interface.
642  * We make two assumptions here:
643  *  1) that the current priority is set to splnet _before_ this code
644  *     is called *and* is returned to the appropriate priority after
645  *     return
646  *  2) that the IFF_OACTIVE flag is checked before this code is called
647  *     (i.e. that the output part of the interface is idle)
648  */
649 void
650 mb86960_start(struct ifnet *ifp)
651 {
652 	struct mb86960_softc *sc = ifp->if_softc;
653 	struct mbuf *m;
654 
655 #if FE_DEBUG >= 1
656 	/* Just a sanity check. */
657 	if ((sc->txb_count == 0) != (sc->txb_free == sc->txb_size)) {
658 		/*
659 		 * Txb_count and txb_free co-works to manage the
660 		 * transmission buffer.  Txb_count keeps track of the
661 		 * used potion of the buffer, while txb_free does unused
662 		 * potion.  So, as long as the driver runs properly,
663 		 * txb_count is zero if and only if txb_free is same
664 		 * as txb_size (which represents whole buffer.)
665 		 */
666 		log(LOG_ERR, "%s: inconsistent txb variables (%d, %d)\n",
667 		    device_xname(sc->sc_dev), sc->txb_count, sc->txb_free);
668 		/*
669 		 * So, what should I do, then?
670 		 *
671 		 * We now know txb_count and txb_free contradicts.  We
672 		 * cannot, however, tell which is wrong.  More
673 		 * over, we cannot peek 86960 transmission buffer or
674 		 * reset the transmission buffer.  (In fact, we can
675 		 * reset the entire interface.  I don't want to do it.)
676 		 *
677 		 * If txb_count is incorrect, leaving it as is will cause
678 		 * sending of gabages after next interrupt.  We have to
679 		 * avoid it.  Hence, we reset the txb_count here.  If
680 		 * txb_free was incorrect, resetting txb_count just loose
681 		 * some packets.  We can live with it.
682 		 */
683 		sc->txb_count = 0;
684 	}
685 #endif
686 
687 #if FE_DEBUG >= 1
688 	/*
689 	 * First, see if there are buffered packets and an idle
690 	 * transmitter - should never happen at this point.
691 	 */
692 	if ((sc->txb_count > 0) && (sc->txb_sched == 0)) {
693 		log(LOG_ERR, "%s: transmitter idle with %d buffered packets\n",
694 		    device_xname(sc->sc_dev), sc->txb_count);
695 		mb86960_xmit(sc);
696 	}
697 #endif
698 
699 	/*
700 	 * Stop accepting more transmission packets temporarily, when
701 	 * a filter change request is delayed.  Updating the MARs on
702 	 * 86960 flushes the transmisstion buffer, so it is delayed
703 	 * until all buffered transmission packets have been sent
704 	 * out.
705 	 */
706 	if (sc->filter_change) {
707 		/*
708 		 * Filter change request is delayed only when the DLC is
709 		 * working.  DLC soon raise an interrupt after finishing
710 		 * the work.
711 		 */
712 		goto indicate_active;
713 	}
714 
715 	for (;;) {
716 		/*
717 		 * See if there is room to put another packet in the buffer.
718 		 * We *could* do better job by peeking the send queue to
719 		 * know the length of the next packet.  Current version just
720 		 * tests against the worst case (i.e., longest packet).  FIXME.
721 		 *
722 		 * When adding the packet-peek feature, don't forget adding a
723 		 * test on txb_count against QUEUEING_MAX.
724 		 * There is a little chance the packet count exceeds
725 		 * the limit.  Assume transmission buffer is 8KB (2x8KB
726 		 * configuration) and an application sends a bunch of small
727 		 * (i.e., minimum packet sized) packets rapidly.  An 8KB
728 		 * buffer can hold 130 blocks of 62 bytes long...
729 		 */
730 		if (sc->txb_free <
731 		    (ETHER_MAX_LEN - ETHER_CRC_LEN) + FE_TXLEN_SIZE) {
732 			/* No room. */
733 			goto indicate_active;
734 		}
735 
736 #if FE_SINGLE_TRANSMISSION
737 		if (sc->txb_count > 0) {
738 			/* Just one packet per a transmission buffer. */
739 			goto indicate_active;
740 		}
741 #endif
742 
743 		/*
744 		 * Get the next mbuf chain for a packet to send.
745 		 */
746 		IFQ_DEQUEUE(&ifp->if_snd, m);
747 		if (m == 0) {
748 			/* No more packets to send. */
749 			goto indicate_inactive;
750 		}
751 
752 		/* Tap off here if there is a BPF listener. */
753 		bpf_mtap(ifp, m);
754 
755 		/*
756 		 * Copy the mbuf chain into the transmission buffer.
757 		 * txb_* variables are updated as necessary.
758 		 */
759 		mb86960_write_mbufs(sc, m);
760 
761 		m_freem(m);
762 
763 		/* Start transmitter if it's idle. */
764 		if (sc->txb_sched == 0)
765 			mb86960_xmit(sc);
766 	}
767 
768 indicate_inactive:
769 	/*
770 	 * We are using the !OACTIVE flag to indicate to
771 	 * the outside world that we can accept an
772 	 * additional packet rather than that the
773 	 * transmitter is _actually_ active.  Indeed, the
774 	 * transmitter may be active, but if we haven't
775 	 * filled all the buffers with data then we still
776 	 * want to accept more.
777 	 */
778 	ifp->if_flags &= ~IFF_OACTIVE;
779 	return;
780 
781 indicate_active:
782 	/*
783 	 * The transmitter is active, and there are no room for
784 	 * more outgoing packets in the transmission buffer.
785 	 */
786 	ifp->if_flags |= IFF_OACTIVE;
787 	return;
788 }
789 
790 /*
791  * Transmission interrupt handler
792  * The control flow of this function looks silly.  FIXME.
793  */
794 void
795 mb86960_tint(struct mb86960_softc *sc, uint8_t tstat)
796 {
797 	bus_space_tag_t bst = sc->sc_bst;
798 	bus_space_handle_t bsh = sc->sc_bsh;
799 	struct ifnet *ifp = &sc->sc_ec.ec_if;
800 	int left;
801 	int col;
802 
803 	/*
804 	 * Handle "excessive collision" interrupt.
805 	 */
806 	if (tstat & FE_D0_COLL16) {
807 		/*
808 		 * Find how many packets (including this collided one)
809 		 * are left unsent in transmission buffer.
810 		 */
811 		left = bus_space_read_1(bst, bsh, FE_BMPR10);
812 
813 #if FE_DEBUG >= 2
814 		log(LOG_WARNING, "%s: excessive collision (%d/%d)\n",
815 		    device_xname(sc->sc_dev), left, sc->txb_sched);
816 #endif
817 #if FE_DEBUG >= 3
818 		mb86960_dump(LOG_INFO, sc);
819 #endif
820 
821 		/*
822 		 * Update statistics.
823 		 */
824 		ifp->if_collisions += 16;
825 		ifp->if_oerrors++;
826 		ifp->if_opackets += sc->txb_sched - left;
827 
828 		/*
829 		 * Collision statistics has been updated.
830 		 * Clear the collision flag on 86960 now to avoid confusion.
831 		 */
832 		bus_space_write_1(bst, bsh, FE_DLCR0, FE_D0_COLLID);
833 
834 		/*
835 		 * Restart transmitter, skipping the
836 		 * collided packet.
837 		 *
838 		 * We *must* skip the packet to keep network running
839 		 * properly.  Excessive collision error is an
840 		 * indication of the network overload.  If we
841 		 * tried sending the same packet after excessive
842 		 * collision, the network would be filled with
843 		 * out-of-time packets.  Packets belonging
844 		 * to reliable transport (such as TCP) are resent
845 		 * by some upper layer.
846 		 */
847 		bus_space_write_1(bst, bsh, FE_BMPR11,
848 		    FE_B11_CTRL_SKIP | FE_B11_MODE1);
849 		sc->txb_sched = left - 1;
850 	}
851 
852 	/*
853 	 * Handle "transmission complete" interrupt.
854 	 */
855 	if (tstat & FE_D0_TXDONE) {
856 		/*
857 		 * Add in total number of collisions on last
858 		 * transmission.  We also clear "collision occurred" flag
859 		 * here.
860 		 *
861 		 * 86960 has a design flow on collision count on multiple
862 		 * packet transmission.  When we send two or more packets
863 		 * with one start command (that's what we do when the
864 		 * transmission queue is clauded), 86960 informs us number
865 		 * of collisions occurred on the last packet on the
866 		 * transmission only.  Number of collisions on previous
867 		 * packets are lost.  I have told that the fact is clearly
868 		 * stated in the Fujitsu document.
869 		 *
870 		 * I considered not to mind it seriously.  Collision
871 		 * count is not so important, anyway.  Any comments?  FIXME.
872 		 */
873 
874 		if (bus_space_read_1(bst, bsh, FE_DLCR0) & FE_D0_COLLID) {
875 			/* Clear collision flag. */
876 			bus_space_write_1(bst, bsh, FE_DLCR0, FE_D0_COLLID);
877 
878 			/* Extract collision count from 86960. */
879 			col = bus_space_read_1(bst, bsh, FE_DLCR4) & FE_D4_COL;
880 			if (col == 0) {
881 				/*
882 				 * Status register indicates collisions,
883 				 * while the collision count is zero.
884 				 * This can happen after multiple packet
885 				 * transmission, indicating that one or more
886 				 * previous packet(s) had been collided.
887 				 *
888 				 * Since the accurate number of collisions
889 				 * has been lost, we just guess it as 1;
890 				 * Am I too optimistic?  FIXME.
891 				 */
892 				col = 1;
893 			} else
894 				col >>= FE_D4_COL_SHIFT;
895 			ifp->if_collisions += col;
896 #if FE_DEBUG >= 4
897 			log(LOG_WARNING, "%s: %d collision%s (%d)\n",
898 			    device_xname(sc->sc_dev), col, col == 1 ? "" : "s",
899 			    sc->txb_sched);
900 #endif
901 		}
902 
903 		/*
904 		 * Update total number of successfully
905 		 * transmitted packets.
906 		 */
907 		ifp->if_opackets += sc->txb_sched;
908 		sc->txb_sched = 0;
909 	}
910 
911 	if (sc->txb_sched == 0) {
912 		/*
913 		 * The transmitter is no more active.
914 		 * Reset output active flag and watchdog timer.
915 		 */
916 		ifp->if_flags &= ~IFF_OACTIVE;
917 		ifp->if_timer = 0;
918 
919 		/*
920 		 * If more data is ready to transmit in the buffer, start
921 		 * transmitting them.  Otherwise keep transmitter idle,
922 		 * even if more data is queued.  This gives receive
923 		 * process a slight priority.
924 		 */
925 		if (sc->txb_count > 0)
926 			mb86960_xmit(sc);
927 	}
928 }
929 
930 /*
931  * Ethernet interface receiver interrupt.
932  */
933 void
934 mb86960_rint(struct mb86960_softc *sc, uint8_t rstat)
935 {
936 	bus_space_tag_t bst = sc->sc_bst;
937 	bus_space_handle_t bsh = sc->sc_bsh;
938 	struct ifnet *ifp = &sc->sc_ec.ec_if;
939 	u_int status, len;
940 	int i;
941 
942 	/*
943 	 * Update statistics if this interrupt is caused by an error.
944 	 */
945 	if (rstat & (FE_D1_OVRFLO | FE_D1_CRCERR | FE_D1_ALGERR |
946 	    FE_D1_SRTPKT)) {
947 #if FE_DEBUG >= 3
948 		char sbuf[sizeof(FE_D1_ERRBITS) + 64];
949 
950 		snprintb(sbuf, sizeof(sbuf), FE_D1_ERRBITS, rstat);
951 		log(LOG_WARNING, "%s: receive error: %s\n",
952 		    device_xname(sc->sc_dev), sbuf);
953 #endif
954 		ifp->if_ierrors++;
955 	}
956 
957 	/*
958 	 * MB86960 has a flag indicating "receive queue empty."
959 	 * We just loop checking the flag to pull out all received
960 	 * packets.
961 	 *
962 	 * We limit the number of iterrations to avoid infinite loop.
963 	 * It can be caused by a very slow CPU (some broken
964 	 * peripheral may insert incredible number of wait cycles)
965 	 * or, worse, by a broken MB86960 chip.
966 	 */
967 	for (i = 0; i < FE_MAX_RECV_COUNT; i++) {
968 		/* Stop the iterration if 86960 indicates no packets. */
969 		if (bus_space_read_1(bst, bsh, FE_DLCR5) & FE_D5_BUFEMP)
970 			break;
971 
972 		/*
973 		 * Extract receive packet status from the receive
974 		 * packet header.
975 		 */
976 		if (sc->sc_flags & FE_FLAGS_SBW_BYTE) {
977 			status = bus_space_read_1(bst, bsh, FE_BMPR8);
978 			(void)bus_space_read_1(bst, bsh, FE_BMPR8);
979 		} else
980 			status = bus_space_read_2(bst, bsh, FE_BMPR8);
981 
982 #if FE_DEBUG >= 4
983 		log(LOG_INFO, "%s: receive status = %02x\n",
984 		    device_xname(sc->sc_dev), status);
985 #endif
986 
987 		/*
988 		 * If there was an error, update statistics and drop
989 		 * the packet, unless the interface is in promiscuous
990 		 * mode.
991 		 */
992 		if ((status & FE_RXSTAT_GOODPKT) == 0) {
993 			if ((ifp->if_flags & IFF_PROMISC) == 0) {
994 				ifp->if_ierrors++;
995 				mb86960_droppacket(sc);
996 				continue;
997 			}
998 		}
999 
1000 		/*
1001 		 * Extract the packet length from the receive packet header.
1002 		 * It is a sum of a header (14 bytes) and a payload.
1003 		 * CRC has been stripped off by the 86960.
1004 		 */
1005 		if (sc->sc_flags & FE_FLAGS_SBW_BYTE) {
1006 			len  = bus_space_read_1(bst, bsh, FE_BMPR8);
1007 			len |= bus_space_read_1(bst, bsh, FE_BMPR8) << 8;
1008 		} else
1009 			len = bus_space_read_2(bst, bsh, FE_BMPR8);
1010 
1011 		/*
1012 		 * MB86965 checks the packet length and drop big packet
1013 		 * before passing it to us.  There are no chance we can
1014 		 * get [crufty] packets.  Hence, if the length exceeds
1015 		 * the specified limit, it means some serious failure,
1016 		 * such as out-of-sync on receive buffer management.
1017 		 *
1018 		 * Is this statement true?  FIXME.
1019 		 */
1020 		if (len > (ETHER_MAX_LEN - ETHER_CRC_LEN) ||
1021 		    len < ETHER_HDR_LEN) {
1022 #if FE_DEBUG >= 2
1023 			log(LOG_WARNING,
1024 			    "%s: received a %s packet? (%u bytes)\n",
1025 			    device_xname(sc->sc_dev),
1026 			    len < ETHER_HDR_LEN ? "partial" : "big", len);
1027 #endif
1028 			ifp->if_ierrors++;
1029 			mb86960_droppacket(sc);
1030 			continue;
1031 		}
1032 
1033 		/*
1034 		 * Check for a short (RUNT) packet.  We *do* check
1035 		 * but do nothing other than print a message.
1036 		 * Short packets are illegal, but does nothing bad
1037 		 * if it carries data for upper layer.
1038 		 */
1039 #if FE_DEBUG >= 2
1040 		if (len < (ETHER_MIN_LEN - ETHER_CRC_LEN)) {
1041 			log(LOG_WARNING,
1042 			    "%s: received a short packet? (%u bytes)\n",
1043 			    device_xname(sc->sc_dev), len);
1044 		}
1045 #endif
1046 
1047 		/*
1048 		 * Go get a packet.
1049 		 */
1050 		if (mb86960_get_packet(sc, len) == 0) {
1051 			/* Skip a packet, updating statistics. */
1052 #if FE_DEBUG >= 2
1053 			log(LOG_WARNING,
1054 			    "%s: out of mbufs; dropping packet (%u bytes)\n",
1055 			    device_xname(sc->sc_dev), len);
1056 #endif
1057 			ifp->if_ierrors++;
1058 			mb86960_droppacket(sc);
1059 
1060 			/*
1061 			 * We stop receiving packets, even if there are
1062 			 * more in the buffer.  We hope we can get more
1063 			 * mbufs next time.
1064 			 */
1065 			return;
1066 		}
1067 
1068 		/* Successfully received a packet.  Update stat. */
1069 		ifp->if_ipackets++;
1070 	}
1071 }
1072 
1073 /*
1074  * Ethernet interface interrupt processor
1075  */
1076 int
1077 mb86960_intr(void *arg)
1078 {
1079 	struct mb86960_softc *sc = arg;
1080 	bus_space_tag_t bst = sc->sc_bst;
1081 	bus_space_handle_t bsh = sc->sc_bsh;
1082 	struct ifnet *ifp = &sc->sc_ec.ec_if;
1083 	uint8_t tstat, rstat;
1084 
1085 	if ((sc->sc_stat & FE_STAT_ENABLED) == 0 ||
1086 	    !device_is_active(sc->sc_dev))
1087 		return 0;
1088 
1089 #if FE_DEBUG >= 4
1090 	log(LOG_INFO, "%s: mb86960_intr()\n", device_xname(sc->sc_dev));
1091 	mb86960_dump(LOG_INFO, sc);
1092 #endif
1093 
1094 	/*
1095 	 * Get interrupt conditions, masking unneeded flags.
1096 	 */
1097 	tstat = bus_space_read_1(bst, bsh, FE_DLCR0) & FE_TMASK;
1098 	rstat = bus_space_read_1(bst, bsh, FE_DLCR1) & FE_RMASK;
1099 	if (tstat == 0 && rstat == 0)
1100 		return 0;
1101 
1102 	/*
1103 	 * Loop until there are no more new interrupt conditions.
1104 	 */
1105 	for (;;) {
1106 		/*
1107 		 * Reset the conditions we are acknowledging.
1108 		 */
1109 		bus_space_write_1(bst, bsh, FE_DLCR0, tstat);
1110 		bus_space_write_1(bst, bsh, FE_DLCR1, rstat);
1111 
1112 		/*
1113 		 * Handle transmitter interrupts. Handle these first because
1114 		 * the receiver will reset the board under some conditions.
1115 		 */
1116 		if (tstat != 0)
1117 			mb86960_tint(sc, tstat);
1118 
1119 		/*
1120 		 * Handle receiver interrupts.
1121 		 */
1122 		if (rstat != 0)
1123 			mb86960_rint(sc, rstat);
1124 
1125 		/*
1126 		 * Update the multicast address filter if it is
1127 		 * needed and possible.  We do it now, because
1128 		 * we can make sure the transmission buffer is empty,
1129 		 * and there is a good chance that the receive queue
1130 		 * is empty.  It will minimize the possibility of
1131 		 * packet lossage.
1132 		 */
1133 		if (sc->filter_change &&
1134 		    sc->txb_count == 0 && sc->txb_sched == 0) {
1135 			mb86960_loadmar(sc);
1136 			ifp->if_flags &= ~IFF_OACTIVE;
1137 		}
1138 
1139 		/*
1140 		 * If it looks like the transmitter can take more data,
1141 		 * attempt to start output on the interface. This is done
1142 		 * after handling the receiver interrupt to give the
1143 		 * receive operation priority.
1144 		 */
1145 		if ((ifp->if_flags & IFF_OACTIVE) == 0)
1146 			mb86960_start(ifp);
1147 
1148 		if (rstat != 0 || tstat != 0)
1149 			rnd_add_uint32(&sc->rnd_source, rstat + tstat);
1150 
1151 		/*
1152 		 * Get interrupt conditions, masking unneeded flags.
1153 		 */
1154 		tstat = bus_space_read_1(bst, bsh, FE_DLCR0) & FE_TMASK;
1155 		rstat = bus_space_read_1(bst, bsh, FE_DLCR1) & FE_RMASK;
1156 		if (tstat == 0 && rstat == 0)
1157 			return 1;
1158 	}
1159 }
1160 
1161 /*
1162  * Process an ioctl request.  This code needs some work - it looks pretty ugly.
1163  */
1164 int
1165 mb86960_ioctl(struct ifnet *ifp, u_long cmd, void *data)
1166 {
1167 	struct mb86960_softc *sc = ifp->if_softc;
1168 	struct ifaddr *ifa = (struct ifaddr *)data;
1169 	struct ifreq *ifr = (struct ifreq *)data;
1170 	int s, error = 0;
1171 
1172 #if FE_DEBUG >= 3
1173 	log(LOG_INFO, "%s: ioctl(%lx)\n", device_xname(sc->sc_dev), cmd);
1174 #endif
1175 
1176 	s = splnet();
1177 
1178 	switch (cmd) {
1179 	case SIOCINITIFADDR:
1180 		if ((error = mb86960_enable(sc)) != 0)
1181 			break;
1182 		ifp->if_flags |= IFF_UP;
1183 
1184 		mb86960_init(sc);
1185 		switch (ifa->ifa_addr->sa_family) {
1186 #ifdef INET
1187 		case AF_INET:
1188 			arp_ifinit(ifp, ifa);
1189 			break;
1190 #endif
1191 		default:
1192 			break;
1193 		}
1194 		break;
1195 
1196 	case SIOCSIFFLAGS:
1197 		if ((error = ifioctl_common(ifp, cmd, data)) != 0)
1198 			break;
1199 		/* XXX re-use ether_ioctl() */
1200 		switch (ifp->if_flags & (IFF_UP|IFF_RUNNING)) {
1201 		case IFF_RUNNING:
1202 			/*
1203 			 * If interface is marked down and it is running, then
1204 			 * stop it.
1205 			 */
1206 			mb86960_stop(sc);
1207 			ifp->if_flags &= ~IFF_RUNNING;
1208 			mb86960_disable(sc);
1209 			break;
1210 		case IFF_UP:
1211 			/*
1212 			 * If interface is marked up and it is stopped, then
1213 			 * start it.
1214 			 */
1215 			if ((error = mb86960_enable(sc)) != 0)
1216 				break;
1217 			mb86960_init(sc);
1218 			break;
1219 		case IFF_UP|IFF_RUNNING:
1220 			/*
1221 			 * Reset the interface to pick up changes in any other
1222 			 * flags that affect hardware registers.
1223 			 */
1224 			mb86960_setmode(sc);
1225 			break;
1226 		case 0:
1227 			break;
1228 		}
1229 #if FE_DEBUG >= 1
1230 		/* "ifconfig fe0 debug" to print register dump. */
1231 		if (ifp->if_flags & IFF_DEBUG) {
1232 			log(LOG_INFO, "%s: SIOCSIFFLAGS(DEBUG)\n",
1233 			    device_xname(sc->sc_dev));
1234 			mb86960_dump(LOG_DEBUG, sc);
1235 		}
1236 #endif
1237 		break;
1238 
1239 	case SIOCADDMULTI:
1240 	case SIOCDELMULTI:
1241 		if ((sc->sc_stat & FE_STAT_ENABLED) == 0) {
1242 			error = EIO;
1243 			break;
1244 		}
1245 
1246 		/* Update our multicast list. */
1247 		if ((error = ether_ioctl(ifp, cmd, data)) == ENETRESET) {
1248 			/*
1249 			 * Multicast list has changed; set the hardware filter
1250 			 * accordingly.
1251 			 */
1252 			if (ifp->if_flags & IFF_RUNNING)
1253 				mb86960_setmode(sc);
1254 			error = 0;
1255 		}
1256 		break;
1257 
1258 	case SIOCGIFMEDIA:
1259 	case SIOCSIFMEDIA:
1260 		error = ifmedia_ioctl(ifp, ifr, &sc->sc_media, cmd);
1261 		break;
1262 
1263 	default:
1264 		error = ether_ioctl(ifp, cmd, data);
1265 		break;
1266 	}
1267 
1268 	splx(s);
1269 	return error;
1270 }
1271 
1272 /*
1273  * Retrieve packet from receive buffer and send to the next level up via
1274  * ether_input(). If there is a BPF listener, give a copy to BPF, too.
1275  * Returns 0 if success, -1 if error (i.e., mbuf allocation failure).
1276  */
1277 int
1278 mb86960_get_packet(struct mb86960_softc *sc, u_int len)
1279 {
1280 	bus_space_tag_t bst = sc->sc_bst;
1281 	bus_space_handle_t bsh = sc->sc_bsh;
1282 	struct ifnet *ifp = &sc->sc_ec.ec_if;
1283 	struct mbuf *m;
1284 
1285 	/* Allocate a header mbuf. */
1286 	MGETHDR(m, M_DONTWAIT, MT_DATA);
1287 	if (m == 0)
1288 		return 0;
1289 	m->m_pkthdr.rcvif = ifp;
1290 	m->m_pkthdr.len = len;
1291 
1292 	/* The following silliness is to make NFS happy. */
1293 #define	EROUND	((sizeof(struct ether_header) + 3) & ~3)
1294 #define	EOFF	(EROUND - sizeof(struct ether_header))
1295 
1296 	/*
1297 	 * Our strategy has one more problem.  There is a policy on
1298 	 * mbuf cluster allocation.  It says that we must have at
1299 	 * least MINCLSIZE (208 bytes) to allocate a cluster.  For a
1300 	 * packet of a size between (MHLEN - 2) to (MINCLSIZE - 2),
1301 	 * our code violates the rule...
1302 	 * On the other hand, the current code is short, simple,
1303 	 * and fast, however.  It does no harmful thing, just waists
1304 	 * some memory.  Any comments?  FIXME.
1305 	 */
1306 
1307 	/* Attach a cluster if this packet doesn't fit in a normal mbuf. */
1308 	if (len > MHLEN - EOFF) {
1309 		MCLGET(m, M_DONTWAIT);
1310 		if ((m->m_flags & M_EXT) == 0) {
1311 			m_freem(m);
1312 			return 0;
1313 		}
1314 	}
1315 
1316 	/*
1317 	 * The following assumes there is room for the ether header in the
1318 	 * header mbuf.
1319 	 */
1320 	m->m_data += EOFF;
1321 
1322 	/* Set the length of this packet. */
1323 	m->m_len = len;
1324 
1325 	/* Get a packet. */
1326 	if (sc->sc_flags & FE_FLAGS_SBW_BYTE)
1327 		bus_space_read_multi_1(bst, bsh, FE_BMPR8,
1328 		    mtod(m, uint8_t *), len);
1329 	else
1330 		bus_space_read_multi_stream_2(bst, bsh, FE_BMPR8,
1331 		    mtod(m, uint16_t *), (len + 1) >> 1);
1332 
1333 	/*
1334 	 * Check if there's a BPF listener on this interface.  If so, hand off
1335 	 * the raw packet to bpf.
1336 	 */
1337 	bpf_mtap(ifp, m);
1338 
1339 	(*ifp->if_input)(ifp, m);
1340 	return 1;
1341 }
1342 
1343 /*
1344  * Write an mbuf chain to the transmission buffer memory using 16 bit PIO.
1345  * Returns number of bytes actually written, including length word.
1346  *
1347  * If an mbuf chain is too long for an Ethernet frame, it is not sent.
1348  * Packets shorter than Ethernet minimum are legal, and we pad them
1349  * before sending out.  An exception is "partial" packets which are
1350  * shorter than mandatory Ethernet header.
1351  *
1352  * I wrote a code for an experimental "delayed padding" technique.
1353  * When employed, it postpones the padding process for short packets.
1354  * If xmit() occurred at the moment, the padding process is omitted, and
1355  * garbages are sent as pad data.  If next packet is stored in the
1356  * transmission buffer before xmit(), write_mbuf() pads the previous
1357  * packet before transmitting new packet.  This *may* gain the
1358  * system performance (slightly).
1359  */
1360 void
1361 mb86960_write_mbufs(struct mb86960_softc *sc, struct mbuf *m)
1362 {
1363 	bus_space_tag_t bst = sc->sc_bst;
1364 	bus_space_handle_t bsh = sc->sc_bsh;
1365 	int totlen, len;
1366 #if FE_DEBUG >= 2
1367 	struct mbuf *mp;
1368 #endif
1369 
1370 #if FE_DELAYED_PADDING
1371 	/* Do the "delayed padding." */
1372 	if (sc->txb_padding > 0) {
1373 		if (sc->sc_flags & FE_FLAGS_SBW_BYTE) {
1374 			for (len = sc->txb_padding; len > 0; len--)
1375 				bus_space_write_1(bst, bsh, FE_BMPR8, 0);
1376 		} else {
1377 			for (len = sc->txb_padding >> 1; len > 0; len--)
1378 				bus_space_write_2(bst, bsh, FE_BMPR8, 0);
1379 		}
1380 		sc->txb_padding = 0;
1381 	}
1382 #endif
1383 
1384 	/* We need to use m->m_pkthdr.len, so require the header */
1385 	if ((m->m_flags & M_PKTHDR) == 0)
1386 	  	panic("mb86960_write_mbufs: no header mbuf");
1387 
1388 #if FE_DEBUG >= 2
1389 	/* First, count up the total number of bytes to copy. */
1390 	for (totlen = 0, mp = m; mp != 0; mp = mp->m_next)
1391 		totlen += mp->m_len;
1392 	/* Check if this matches the one in the packet header. */
1393 	if (totlen != m->m_pkthdr.len)
1394 		log(LOG_WARNING, "%s: packet length mismatch? (%d/%d)\n",
1395 		    device_xname(sc->sc_dev), totlen, m->m_pkthdr.len);
1396 #else
1397 	/* Just use the length value in the packet header. */
1398 	totlen = m->m_pkthdr.len;
1399 #endif
1400 
1401 #if FE_DEBUG >= 1
1402 	/*
1403 	 * Should never send big packets.  If such a packet is passed,
1404 	 * it should be a bug of upper layer.  We just ignore it.
1405 	 * ... Partial (too short) packets, neither.
1406 	 */
1407 	if (totlen > (ETHER_MAX_LEN - ETHER_CRC_LEN) ||
1408 	    totlen < ETHER_HDR_LEN) {
1409 		log(LOG_ERR, "%s: got a %s packet (%u bytes) to send\n",
1410 		    device_xname(sc->sc_dev),
1411 		    totlen < ETHER_HDR_LEN ? "partial" : "big", totlen);
1412 		sc->sc_ec.ec_if.if_oerrors++;
1413 		return;
1414 	}
1415 #endif
1416 
1417 	/*
1418 	 * Put the length word for this frame.
1419 	 * Does 86960 accept odd length?  -- Yes.
1420 	 * Do we need to pad the length to minimum size by ourselves?
1421 	 * -- Generally yes.  But for (or will be) the last
1422 	 * packet in the transmission buffer, we can skip the
1423 	 * padding process.  It may gain performance slightly.  FIXME.
1424 	 */
1425 	len = max(totlen, (ETHER_MIN_LEN - ETHER_CRC_LEN));
1426 	if (sc->sc_flags & FE_FLAGS_SBW_BYTE) {
1427 		bus_space_write_1(bst, bsh, FE_BMPR8, len);
1428 		bus_space_write_1(bst, bsh, FE_BMPR8, len >> 8);
1429 	} else {
1430 		bus_space_write_2(bst, bsh, FE_BMPR8, len);
1431 		/* roundup packet length since we will use word access */
1432 		totlen = (totlen + 1) & ~1;
1433 	}
1434 
1435 	/*
1436 	 * Update buffer status now.
1437 	 * Truncate the length up to an even number
1438 	 * if the chip is set in SBW_WORD mode.
1439 	 */
1440 	sc->txb_free -= FE_TXLEN_SIZE +
1441 	    max(totlen, (ETHER_MIN_LEN - ETHER_CRC_LEN));
1442 	sc->txb_count++;
1443 
1444 #if FE_DELAYED_PADDING
1445 	/* Postpone the packet padding if necessary. */
1446 	if (totlen < (ETHER_MIN_LEN - ETHER_CRC_LEN))
1447 		sc->txb_padding = (ETHER_MIN_LEN - ETHER_CRC_LEN) - totlen;
1448 #endif
1449 
1450 	/*
1451 	 * Transfer the data from mbuf chain to the transmission buffer.
1452 	 * If the MB86960 is configured in word mode, data needs to be
1453 	 * transferred as words, and only words.
1454 	 * So that we require some extra code to patch over odd-length
1455 	 * or unaligned mbufs.
1456 	 */
1457 	if (sc->sc_flags & FE_FLAGS_SBW_BYTE) {
1458 		/* It's simple in byte mode. */
1459 		for (; m != NULL; m = m->m_next) {
1460 			if (m->m_len) {
1461 				bus_space_write_multi_1(bst, bsh, FE_BMPR8,
1462 				    mtod(m, uint8_t *), m->m_len);
1463 			}
1464 		}
1465 	} else {
1466 		/* a bit trickier in word mode. */
1467 		uint8_t *data, savebyte[2];
1468 		int leftover;
1469 
1470 		leftover = 0;
1471 		savebyte[0] = savebyte[1] = 0;
1472 
1473 		for (; m != NULL; m = m->m_next) {
1474 			len = m->m_len;
1475 			if (len == 0)
1476 				continue;
1477 			data = mtod(m, uint8_t *);
1478 			while (len > 0) {
1479 				if (leftover) {
1480 					/*
1481 					 * Data left over (from mbuf or
1482 					 * realignment). Buffer the next
1483 					 * byte, and write it and the
1484 					 * leftover data out.
1485 					 */
1486 					savebyte[1] = *data++;
1487 					len--;
1488 					bus_space_write_stream_2(bst, bsh,
1489 					   FE_BMPR8, *(uint16_t *)savebyte);
1490 					leftover = 0;
1491 				} else if (BUS_SPACE_ALIGNED_POINTER(data,
1492 				    uint16_t) == 0) {
1493 					/*
1494 					 * Unaligned data; buffer the next byte.
1495 					 */
1496 					savebyte[0] = *data++;
1497 					len--;
1498 					leftover = 1;
1499 				} else {
1500 					/*
1501 					 * Aligned data; output contiguous
1502 					 * words as much as we can, then
1503 					 * buffer the remaining byte, if any.
1504 					 */
1505 					leftover = len & 1;
1506 					len &= ~1;
1507 					bus_space_write_multi_stream_2(bst, bsh,
1508 					    FE_BMPR8, (uint16_t *)data,
1509 					    len >> 1);
1510 					data += len;
1511 					if (leftover)
1512 						savebyte[0] = *data++;
1513 					len = 0;
1514 				}
1515 			}
1516 			if (len < 0)
1517 				panic("mb86960_write_mbufs: negative len");
1518 		}
1519 		if (leftover) {
1520 			savebyte[1] = 0;
1521 			bus_space_write_stream_2(bst, bsh, FE_BMPR8,
1522 			    *(uint16_t *)savebyte);
1523 		}
1524 	}
1525 #if FE_DELAYED_PADDING == 0
1526 	/*
1527 	 * Pad the packet to the minimum length if necessary.
1528 	 */
1529 	len = (ETHER_MIN_LEN - ETHER_CRC_LEN) - totlen;
1530 	if (len > 0) {
1531 		if (sc->sc_flags & FE_FLAGS_SBW_BYTE) {
1532 			while (len-- > 0)
1533 				bus_space_write_1(bst, bsh, FE_BMPR8, 0);
1534 		} else {
1535 			len >>= 1;
1536 			while (len-- > 0)
1537 				bus_space_write_2(bst, bsh, FE_BMPR8, 0);
1538 		}
1539 	}
1540 #endif
1541 }
1542 
1543 /*
1544  * Compute the multicast address filter from the
1545  * list of multicast addresses we need to listen to.
1546  */
1547 void
1548 mb86960_getmcaf(struct ethercom *ec, uint8_t *af)
1549 {
1550 	struct ifnet *ifp = &ec->ec_if;
1551 	struct ether_multi *enm;
1552 	uint32_t crc;
1553 	struct ether_multistep step;
1554 
1555 	/*
1556 	 * Set up multicast address filter by passing all multicast addresses
1557 	 * through a crc generator, and then using the high order 6 bits as an
1558 	 * index into the 64 bit logical address filter.  The high order bit
1559 	 * selects the word, while the rest of the bits select the bit within
1560 	 * the word.
1561 	 */
1562 
1563 	if ((ifp->if_flags & IFF_PROMISC) != 0)
1564 		goto allmulti;
1565 
1566 	memset(af, 0, FE_FILTER_LEN);
1567 	ETHER_FIRST_MULTI(step, ec, enm);
1568 	while (enm != NULL) {
1569 		if (memcmp(enm->enm_addrlo, enm->enm_addrhi,
1570 		    sizeof(enm->enm_addrlo)) != 0) {
1571 			/*
1572 			 * We must listen to a range of multicast addresses.
1573 			 * For now, just accept all multicasts, rather than
1574 			 * trying to set only those filter bits needed to match
1575 			 * the range.  (At this time, the only use of address
1576 			 * ranges is for IP multicast routing, for which the
1577 			 * range is big enough to require all bits set.)
1578 			 */
1579 			goto allmulti;
1580 		}
1581 
1582 		crc = ether_crc32_le(enm->enm_addrlo, ETHER_ADDR_LEN);
1583 
1584 		/* Just want the 6 most significant bits. */
1585 		crc >>= 26;
1586 
1587 		/* Turn on the corresponding bit in the filter. */
1588 		af[crc >> 3] |= 1 << (crc & 7);
1589 
1590 		ETHER_NEXT_MULTI(step, enm);
1591 	}
1592 	ifp->if_flags &= ~IFF_ALLMULTI;
1593 	return;
1594 
1595 allmulti:
1596 	ifp->if_flags |= IFF_ALLMULTI;
1597 	memset(af, 0xff, FE_FILTER_LEN);
1598 }
1599 
1600 /*
1601  * Calculate a new "multicast packet filter" and put the 86960
1602  * receiver in appropriate mode.
1603  */
1604 void
1605 mb86960_setmode(struct mb86960_softc *sc)
1606 {
1607 	bus_space_tag_t bst = sc->sc_bst;
1608 	bus_space_handle_t bsh = sc->sc_bsh;
1609 	int flags = sc->sc_ec.ec_if.if_flags;
1610 
1611 	/*
1612 	 * If the interface is not running, we postpone the update
1613 	 * process for receive modes and multicast address filter
1614 	 * until the interface is restarted.  It reduces some
1615 	 * complicated job on maintaining chip states.  (Earlier versions
1616 	 * of this driver had a bug on that point...)
1617 	 *
1618 	 * To complete the trick, mb86960_init() calls mb86960_setmode() after
1619 	 * restarting the interface.
1620 	 */
1621 	if ((flags & IFF_RUNNING) == 0)
1622 		return;
1623 
1624 	/*
1625 	 * Promiscuous mode is handled separately.
1626 	 */
1627 	if ((flags & IFF_PROMISC) != 0) {
1628 		/*
1629 		 * Program 86960 to receive all packets on the segment
1630 		 * including those directed to other stations.
1631 		 * Multicast filter stored in MARs are ignored
1632 		 * under this setting, so we don't need to update it.
1633 		 *
1634 		 * Promiscuous mode is used solely by BPF, and BPF only
1635 		 * listens to valid (no error) packets.  So, we ignore
1636 		 * errornous ones even in this mode.
1637 		 */
1638 		bus_space_write_1(bst, bsh, FE_DLCR5,
1639 		    sc->proto_dlcr5 | FE_D5_AFM0 | FE_D5_AFM1);
1640 		sc->filter_change = 0;
1641 
1642 #if FE_DEBUG >= 3
1643 		log(LOG_INFO, "%s: promiscuous mode\n",
1644 		    device_xname(sc->sc_dev));
1645 #endif
1646 		return;
1647 	}
1648 
1649 	/*
1650 	 * Turn the chip to the normal (non-promiscuous) mode.
1651 	 */
1652 	bus_space_write_1(bst, bsh, FE_DLCR5, sc->proto_dlcr5 | FE_D5_AFM1);
1653 
1654 	/*
1655 	 * Find the new multicast filter value.
1656 	 */
1657 	mb86960_getmcaf(&sc->sc_ec, sc->filter);
1658 	sc->filter_change = 1;
1659 
1660 #if FE_DEBUG >= 3
1661 	log(LOG_INFO,
1662 	    "%s: address filter: [%02x %02x %02x %02x %02x %02x %02x %02x]\n",
1663 	    device_xname(sc->sc_dev),
1664 	    sc->filter[0], sc->filter[1], sc->filter[2], sc->filter[3],
1665 	    sc->filter[4], sc->filter[5], sc->filter[6], sc->filter[7]);
1666 #endif
1667 
1668 	/*
1669 	 * We have to update the multicast filter in the 86960, A.S.A.P.
1670 	 *
1671 	 * Note that the DLC (Data Linc Control unit, i.e. transmitter
1672 	 * and receiver) must be stopped when feeding the filter, and
1673 	 * DLC trashes all packets in both transmission and receive
1674 	 * buffers when stopped.
1675 	 *
1676 	 * ... Are the above sentenses correct?  I have to check the
1677 	 *     manual of the MB86960A.  FIXME.
1678 	 *
1679 	 * To reduce the packet lossage, we delay the filter update
1680 	 * process until buffers are empty.
1681 	 */
1682 	if (sc->txb_sched == 0 && sc->txb_count == 0 &&
1683 	    (bus_space_read_1(bst, bsh, FE_DLCR1) & FE_D1_PKTRDY) == 0) {
1684 		/*
1685 		 * Buffers are (apparently) empty.  Load
1686 		 * the new filter value into MARs now.
1687 		 */
1688 		mb86960_loadmar(sc);
1689 	} else {
1690 		/*
1691 		 * Buffers are not empty.  Mark that we have to update
1692 		 * the MARs.  The new filter will be loaded by mb86960_intr()
1693 		 * later.
1694 		 */
1695 #if FE_DEBUG >= 4
1696 		log(LOG_INFO, "%s: filter change delayed\n",
1697 		    device_xname(sc->sc_dev));
1698 #endif
1699 	}
1700 }
1701 
1702 /*
1703  * Load a new multicast address filter into MARs.
1704  *
1705  * The caller must have splnet'ed befor mb86960_loadmar.
1706  * This function starts the DLC upon return.  So it can be called only
1707  * when the chip is working, i.e., from the driver's point of view, when
1708  * a device is RUNNING.  (I mistook the point in previous versions.)
1709  */
1710 void
1711 mb86960_loadmar(struct mb86960_softc *sc)
1712 {
1713 	bus_space_tag_t bst = sc->sc_bst;
1714 	bus_space_handle_t bsh = sc->sc_bsh;
1715 
1716 	/* Stop the DLC (transmitter and receiver). */
1717 	bus_space_write_1(bst, bsh, FE_DLCR6,
1718 	    sc->proto_dlcr6 | FE_D6_DLC_DISABLE);
1719 
1720 	/* Select register bank 1 for MARs. */
1721 	bus_space_write_1(bst, bsh, FE_DLCR7,
1722 	    sc->proto_dlcr7 | FE_D7_RBS_MAR | FE_D7_POWER_UP);
1723 
1724 	/* Copy filter value into the registers. */
1725 	bus_space_write_region_1(bst, bsh, FE_MAR8, sc->filter, FE_FILTER_LEN);
1726 
1727 	/* Restore the bank selection for BMPRs (i.e., runtime registers). */
1728 	bus_space_write_1(bst, bsh, FE_DLCR7,
1729 	    sc->proto_dlcr7 | FE_D7_RBS_BMPR | FE_D7_POWER_UP);
1730 
1731 	/* Restart the DLC. */
1732 	bus_space_write_1(bst, bsh, FE_DLCR6,
1733 	    sc->proto_dlcr6 | FE_D6_DLC_ENABLE);
1734 
1735 	/* We have just updated the filter. */
1736 	sc->filter_change = 0;
1737 
1738 #if FE_DEBUG >= 3
1739 	log(LOG_INFO, "%s: address filter changed\n", device_xname(sc->sc_dev));
1740 #endif
1741 }
1742 
1743 /*
1744  * Enable power on the interface.
1745  */
1746 int
1747 mb86960_enable(struct mb86960_softc *sc)
1748 {
1749 
1750 #if FE_DEBUG >= 3
1751 	log(LOG_INFO, "%s: mb86960_enable()\n", device_xname(sc->sc_dev));
1752 #endif
1753 
1754 	if ((sc->sc_stat & FE_STAT_ENABLED) == 0 && sc->sc_enable != NULL) {
1755 		if ((*sc->sc_enable)(sc) != 0) {
1756 			aprint_error_dev(sc->sc_dev, "device enable failed\n");
1757 			return EIO;
1758 		}
1759 	}
1760 
1761 	sc->sc_stat |= FE_STAT_ENABLED;
1762 	return 0;
1763 }
1764 
1765 /*
1766  * Disable power on the interface.
1767  */
1768 void
1769 mb86960_disable(struct mb86960_softc *sc)
1770 {
1771 
1772 #if FE_DEBUG >= 3
1773 	log(LOG_INFO, "%s: mb86960_disable()\n", device_xname(sc->sc_dev));
1774 #endif
1775 
1776 	if ((sc->sc_stat & FE_STAT_ENABLED) != 0 && sc->sc_disable != NULL) {
1777 		(*sc->sc_disable)(sc);
1778 		sc->sc_stat &= ~FE_STAT_ENABLED;
1779 	}
1780 }
1781 
1782 /*
1783  * mbe_activate:
1784  *
1785  *	Handle device activation/deactivation requests.
1786  */
1787 int
1788 mb86960_activate(device_t self, enum devact act)
1789 {
1790 	struct mb86960_softc *sc = device_private(self);
1791 
1792 	switch (act) {
1793 	case DVACT_DEACTIVATE:
1794 		if_deactivate(&sc->sc_ec.ec_if);
1795 		return 0;
1796 	default:
1797 		return EOPNOTSUPP;
1798 	}
1799 }
1800 
1801 /*
1802  * mb86960_detach:
1803  *
1804  *	Detach a MB86960 interface.
1805  */
1806 int
1807 mb86960_detach(struct mb86960_softc *sc)
1808 {
1809 	struct ifnet *ifp = &sc->sc_ec.ec_if;
1810 
1811 	/* Succeed now if there's no work to do. */
1812 	if ((sc->sc_stat & FE_STAT_ATTACHED) == 0)
1813 		return 0;
1814 
1815 	/* Delete all media. */
1816 	ifmedia_delete_instance(&sc->sc_media, IFM_INST_ANY);
1817 
1818 	/* Unhook the entropy source. */
1819 	rnd_detach_source(&sc->rnd_source);
1820 
1821 	ether_ifdetach(ifp);
1822 	if_detach(ifp);
1823 
1824 	mb86960_disable(sc);
1825 	return 0;
1826 }
1827 
1828 /*
1829  * Routines to read all bytes from the config EEPROM (93C06) through MB86965A.
1830  */
1831 void
1832 mb86965_read_eeprom(bus_space_tag_t iot, bus_space_handle_t ioh, uint8_t *data)
1833 {
1834 	int addr, op, bit;
1835 	uint16_t val;
1836 
1837 	/* Read bytes from EEPROM; two bytes per an iteration. */
1838 	for (addr = 0; addr < FE_EEPROM_SIZE / 2; addr++) {
1839 		/* Reset the EEPROM interface. */
1840 		bus_space_write_1(iot, ioh, FE_BMPR16, 0x00);
1841 		bus_space_write_1(iot, ioh, FE_BMPR17, 0x00);
1842 		bus_space_write_1(iot, ioh, FE_BMPR16, FE_B16_SELECT);
1843 
1844 		/* Send start bit. */
1845 		bus_space_write_1(iot, ioh, FE_BMPR17, FE_B17_DATA);
1846 		FE_EEPROM_DELAY();
1847 		bus_space_write_1(iot, ioh,
1848 		    FE_BMPR16, FE_B16_SELECT | FE_B16_CLOCK);
1849 		FE_EEPROM_DELAY();
1850 		bus_space_write_1(iot, ioh, FE_BMPR16, FE_B16_SELECT);
1851 
1852 		/* Send read command and read address. */
1853 		op = 0x80 | addr;	/* READ instruction */
1854 		for (bit = 8; bit > 0; bit--) {
1855 			bus_space_write_1(iot, ioh, FE_BMPR17,
1856 			    (op & (1 << (bit - 1))) ? FE_B17_DATA : 0);
1857 			FE_EEPROM_DELAY();
1858 			bus_space_write_1(iot, ioh,
1859 			    FE_BMPR16, FE_B16_SELECT | FE_B16_CLOCK);
1860 			FE_EEPROM_DELAY();
1861 			bus_space_write_1(iot, ioh, FE_BMPR16, FE_B16_SELECT);
1862 		}
1863 		bus_space_write_1(iot, ioh, FE_BMPR17, 0x00);
1864 
1865 		/* Read two bytes in each address */
1866 		val = 0;
1867 		for (bit = 16; bit > 0; bit--) {
1868 			FE_EEPROM_DELAY();
1869 			bus_space_write_1(iot, ioh,
1870 			    FE_BMPR16, FE_B16_SELECT | FE_B16_CLOCK);
1871 			FE_EEPROM_DELAY();
1872 			if (bus_space_read_1(iot, ioh, FE_BMPR17) &
1873 			    FE_B17_DATA)
1874 				val |= 1 << (bit - 1);
1875 			bus_space_write_1(iot, ioh,
1876 			    FE_BMPR16, FE_B16_SELECT);
1877 		}
1878 		data[addr * 2]     = val >> 8;
1879 		data[addr * 2 + 1] = val & 0xff;
1880 	}
1881 
1882 	/* Make sure the EEPROM is turned off. */
1883 	bus_space_write_1(iot, ioh, FE_BMPR16, 0);
1884 	bus_space_write_1(iot, ioh, FE_BMPR17, 0);
1885 
1886 #if FE_DEBUG >= 3
1887 	/* Report what we got. */
1888 	log(LOG_INFO, "mb86965_read_eeprom: "
1889 	    " %02x%02x%02x%02x %02x%02x%02x%02x -"
1890 	    " %02x%02x%02x%02x %02x%02x%02x%02x -"
1891 	    " %02x%02x%02x%02x %02x%02x%02x%02x -"
1892 	    " %02x%02x%02x%02x %02x%02x%02x%02x\n",
1893 	    data[ 0], data[ 1], data[ 2], data[ 3],
1894 	    data[ 4], data[ 5], data[ 6], data[ 7],
1895 	    data[ 8], data[ 9], data[10], data[11],
1896 	    data[12], data[13], data[14], data[15],
1897 	    data[16], data[17], data[18], data[19],
1898 	    data[20], data[21], data[22], data[23],
1899 	    data[24], data[25], data[26], data[27],
1900 	    data[28], data[29], data[30], data[31]);
1901 #endif
1902 }
1903 
1904 #if FE_DEBUG >= 1
1905 void
1906 mb86960_dump(int level, struct mb86960_softc *sc)
1907 {
1908 	bus_space_tag_t bst = sc->sc_bst;
1909 	bus_space_handle_t bsh = sc->sc_bsh;
1910 	uint8_t save_dlcr7;
1911 
1912 	save_dlcr7 = bus_space_read_1(bst, bsh, FE_DLCR7);
1913 
1914 	log(level, "\tDLCR = %02x %02x %02x %02x %02x %02x %02x %02x\n",
1915 	    bus_space_read_1(bst, bsh, FE_DLCR0),
1916 	    bus_space_read_1(bst, bsh, FE_DLCR1),
1917 	    bus_space_read_1(bst, bsh, FE_DLCR2),
1918 	    bus_space_read_1(bst, bsh, FE_DLCR3),
1919 	    bus_space_read_1(bst, bsh, FE_DLCR4),
1920 	    bus_space_read_1(bst, bsh, FE_DLCR5),
1921 	    bus_space_read_1(bst, bsh, FE_DLCR6),
1922 	    bus_space_read_1(bst, bsh, FE_DLCR7));
1923 
1924 	bus_space_write_1(bst, bsh, FE_DLCR7,
1925 	    (save_dlcr7 & ~FE_D7_RBS) | FE_D7_RBS_DLCR);
1926 	log(level, "\t       %02x %02x %02x %02x %02x %02x %02x %02x\n",
1927 	    bus_space_read_1(bst, bsh, FE_DLCR8),
1928 	    bus_space_read_1(bst, bsh, FE_DLCR9),
1929 	    bus_space_read_1(bst, bsh, FE_DLCR10),
1930 	    bus_space_read_1(bst, bsh, FE_DLCR11),
1931 	    bus_space_read_1(bst, bsh, FE_DLCR12),
1932 	    bus_space_read_1(bst, bsh, FE_DLCR13),
1933 	    bus_space_read_1(bst, bsh, FE_DLCR14),
1934 	    bus_space_read_1(bst, bsh, FE_DLCR15));
1935 
1936 	bus_space_write_1(bst, bsh, FE_DLCR7,
1937 	    (save_dlcr7 & ~FE_D7_RBS) | FE_D7_RBS_MAR);
1938 	log(level, "\tMAR  = %02x %02x %02x %02x %02x %02x %02x %02x\n",
1939 	    bus_space_read_1(bst, bsh, FE_MAR8),
1940 	    bus_space_read_1(bst, bsh, FE_MAR9),
1941 	    bus_space_read_1(bst, bsh, FE_MAR10),
1942 	    bus_space_read_1(bst, bsh, FE_MAR11),
1943 	    bus_space_read_1(bst, bsh, FE_MAR12),
1944 	    bus_space_read_1(bst, bsh, FE_MAR13),
1945 	    bus_space_read_1(bst, bsh, FE_MAR14),
1946 	    bus_space_read_1(bst, bsh, FE_MAR15));
1947 
1948 	bus_space_write_1(bst, bsh, FE_DLCR7,
1949 	    (save_dlcr7 & ~FE_D7_RBS) | FE_D7_RBS_BMPR);
1950 	log(level,
1951 	    "\tBMPR = xx xx %02x %02x %02x %02x %02x %02x %02x %02x xx %02x\n",
1952 	    bus_space_read_1(bst, bsh, FE_BMPR10),
1953 	    bus_space_read_1(bst, bsh, FE_BMPR11),
1954 	    bus_space_read_1(bst, bsh, FE_BMPR12),
1955 	    bus_space_read_1(bst, bsh, FE_BMPR13),
1956 	    bus_space_read_1(bst, bsh, FE_BMPR14),
1957 	    bus_space_read_1(bst, bsh, FE_BMPR15),
1958 	    bus_space_read_1(bst, bsh, FE_BMPR16),
1959 	    bus_space_read_1(bst, bsh, FE_BMPR17),
1960 	    bus_space_read_1(bst, bsh, FE_BMPR19));
1961 
1962 	bus_space_write_1(bst, bsh, FE_DLCR7, save_dlcr7);
1963 }
1964 #endif
1965 
1966