xref: /netbsd-src/sys/dev/ic/mb86960.c (revision bdc22b2e01993381dcefeff2bc9b56ca75a4235c)
1 /*	$NetBSD: mb86960.c,v 1.87 2018/06/26 06:48:00 msaitoh Exp $	*/
2 
3 /*
4  * All Rights Reserved, Copyright (C) Fujitsu Limited 1995
5  *
6  * This software may be used, modified, copied, distributed, and sold, in
7  * both source and binary form provided that the above copyright, these
8  * terms and the following disclaimer are retained.  The name of the author
9  * and/or the contributor may not be used to endorse or promote products
10  * derived from this software without specific prior written permission.
11  *
12  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND THE CONTRIBUTOR ``AS IS'' AND
13  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
14  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
15  * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR THE CONTRIBUTOR BE LIABLE
16  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
17  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
18  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION.
19  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
20  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
21  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
22  * SUCH DAMAGE.
23  */
24 
25 /*
26  * Portions copyright (C) 1993, David Greenman.  This software may be used,
27  * modified, copied, distributed, and sold, in both source and binary form
28  * provided that the above copyright and these terms are retained.  Under no
29  * circumstances is the author responsible for the proper functioning of this
30  * software, nor does the author assume any responsibility for damages
31  * incurred with its use.
32  */
33 
34 #include <sys/cdefs.h>
35 __KERNEL_RCSID(0, "$NetBSD: mb86960.c,v 1.87 2018/06/26 06:48:00 msaitoh Exp $");
36 
37 /*
38  * Device driver for Fujitsu MB86960A/MB86965A based Ethernet cards.
39  * Contributed by M.S. <seki@sysrap.cs.fujitsu.co.jp>
40  *
41  * This version is intended to be a generic template for various
42  * MB86960A/MB86965A based Ethernet cards.  It currently supports
43  * Fujitsu FMV-180 series (i.e., FMV-181 and FMV-182) and Allied-
44  * Telesis AT1700 series and RE2000 series.  There are some
45  * unnecessary hooks embedded, which are primarily intended to support
46  * other types of Ethernet cards, but the author is not sure whether
47  * they are useful.
48  */
49 
50 #include "opt_inet.h"
51 
52 #include <sys/param.h>
53 #include <sys/systm.h>
54 #include <sys/errno.h>
55 #include <sys/ioctl.h>
56 #include <sys/mbuf.h>
57 #include <sys/socket.h>
58 #include <sys/syslog.h>
59 #include <sys/device.h>
60 #include <sys/rndsource.h>
61 
62 #include <net/if.h>
63 #include <net/if_dl.h>
64 #include <net/if_types.h>
65 #include <net/if_media.h>
66 #include <net/if_ether.h>
67 #include <net/bpf.h>
68 
69 #ifdef INET
70 #include <netinet/in.h>
71 #include <netinet/in_systm.h>
72 #include <netinet/in_var.h>
73 #include <netinet/ip.h>
74 #include <netinet/if_inarp.h>
75 #endif
76 
77 #include <sys/bus.h>
78 
79 #include <dev/ic/mb86960reg.h>
80 #include <dev/ic/mb86960var.h>
81 
82 #ifndef __BUS_SPACE_HAS_STREAM_METHODS
83 #define bus_space_write_stream_2	bus_space_write_2
84 #define bus_space_write_multi_stream_2	bus_space_write_multi_2
85 #define bus_space_read_multi_stream_2	bus_space_read_multi_2
86 #endif /* __BUS_SPACE_HAS_STREAM_METHODS */
87 
88 /* Standard driver entry points.  These can be static. */
89 void	mb86960_init(struct mb86960_softc *);
90 int	mb86960_ioctl(struct ifnet *, u_long, void *);
91 void	mb86960_start(struct ifnet *);
92 void	mb86960_reset(struct mb86960_softc *);
93 void	mb86960_watchdog(struct ifnet *);
94 
95 /* Local functions.  Order of declaration is confused.  FIXME. */
96 int	mb86960_get_packet(struct mb86960_softc *, u_int);
97 void	mb86960_stop(struct mb86960_softc *);
98 void	mb86960_tint(struct mb86960_softc *, uint8_t);
99 void	mb86960_rint(struct mb86960_softc *, uint8_t);
100 static inline
101 void	mb86960_xmit(struct mb86960_softc *);
102 void	mb86960_write_mbufs(struct mb86960_softc *, struct mbuf *);
103 static inline
104 void	mb86960_droppacket(struct mb86960_softc *);
105 void	mb86960_getmcaf(struct ethercom *, uint8_t *);
106 void	mb86960_setmode(struct mb86960_softc *);
107 void	mb86960_loadmar(struct mb86960_softc *);
108 
109 int	mb86960_mediachange(struct ifnet *);
110 void	mb86960_mediastatus(struct ifnet *, struct ifmediareq *);
111 
112 #if FE_DEBUG >= 1
113 void	mb86960_dump(int, struct mb86960_softc *);
114 #endif
115 
116 void
117 mb86960_attach(struct mb86960_softc *sc, uint8_t *myea)
118 {
119 	bus_space_tag_t bst = sc->sc_bst;
120 	bus_space_handle_t bsh = sc->sc_bsh;
121 
122 	/* Register values which depend on board design. */
123 	sc->proto_dlcr4 = FE_D4_LBC_DISABLE | FE_D4_CNTRL;
124 	sc->proto_dlcr5 = 0;
125 	sc->proto_dlcr7 = FE_D7_BYTSWP_LH;
126 	if ((sc->sc_flags & FE_FLAGS_MB86960) != 0)
127 		sc->proto_dlcr7 |= FE_D7_ED_TEST; /* XXX */
128 	sc->proto_bmpr13 = FE_B13_TPTYPE_UTP | FE_B13_PORT_AUTO;
129 
130 	/*
131 	 * Program the 86960 as following defaults:
132 	 *	SRAM: 32KB, 100ns, byte-wide access.
133 	 *	Transmission buffer: 4KB x 2.
134 	 *	System bus interface: 16 bits.
135 	 * These values except TXBSIZE should be modified as per
136 	 * sc_flags which is set in MD attachments, because they
137 	 * are hard-wired on the board. Modifying TXBSIZE will affect
138 	 * the driver performance.
139 	 */
140 	sc->proto_dlcr6 = FE_D6_BUFSIZ_32KB | FE_D6_TXBSIZ_2x4KB |
141 	    FE_D6_BBW_BYTE | FE_D6_SRAM_100ns;
142 	if (sc->sc_flags & FE_FLAGS_SBW_BYTE)
143 		sc->proto_dlcr6 |= FE_D6_SBW_BYTE;
144 	if (sc->sc_flags & FE_FLAGS_SRAM_150ns)
145 		sc->proto_dlcr6 &= ~FE_D6_SRAM_100ns;
146 
147 	/*
148 	 * Minimum initialization of the hardware.
149 	 * We write into registers; hope I/O ports have no
150 	 * overlap with other boards.
151 	 */
152 
153 	/* Initialize 86960. */
154 	bus_space_write_1(bst, bsh, FE_DLCR6,
155 	    sc->proto_dlcr6 | FE_D6_DLC_DISABLE);
156 	delay(200);
157 
158 #ifdef DIAGNOSTIC
159 	if (myea == NULL) {
160 		aprint_error_dev(sc->sc_dev,
161 		    "ethernet address shouldn't be NULL\n");
162 		panic("NULL ethernet address");
163 	}
164 #endif
165 	memcpy(sc->sc_enaddr, myea, sizeof(sc->sc_enaddr));
166 
167 	/* Disable all interrupts. */
168 	bus_space_write_1(bst, bsh, FE_DLCR2, 0);
169 	bus_space_write_1(bst, bsh, FE_DLCR3, 0);
170 }
171 
172 /*
173  * Install interface into kernel networking data structures
174  */
175 void
176 mb86960_config(struct mb86960_softc *sc, int *media, int nmedia, int defmedia)
177 {
178 	cfdata_t cf = device_cfdata(sc->sc_dev);
179 	struct ifnet *ifp = &sc->sc_ec.ec_if;
180 	int i;
181 
182 	/* Stop the 86960. */
183 	mb86960_stop(sc);
184 
185 	/* Initialize ifnet structure. */
186 	strlcpy(ifp->if_xname, device_xname(sc->sc_dev), IFNAMSIZ);
187 	ifp->if_softc = sc;
188 	ifp->if_start = mb86960_start;
189 	ifp->if_ioctl = mb86960_ioctl;
190 	ifp->if_watchdog = mb86960_watchdog;
191 	ifp->if_flags =
192 	    IFF_BROADCAST | IFF_SIMPLEX | IFF_NOTRAILERS | IFF_MULTICAST;
193 	IFQ_SET_READY(&ifp->if_snd);
194 
195 #if FE_DEBUG >= 3
196 	log(LOG_INFO, "%s: mb86960_config()\n", device_xname(sc->sc_dev));
197 	mb86960_dump(LOG_INFO, sc);
198 #endif
199 
200 #if FE_SINGLE_TRANSMISSION
201 	/* Override txb config to allocate minimum. */
202 	sc->proto_dlcr6 &= ~FE_D6_TXBSIZ;
203 	sc->proto_dlcr6 |=  FE_D6_TXBSIZ_2x2KB;
204 #endif
205 
206 	/* Modify hardware config if it is requested. */
207 	if ((cf->cf_flags & FE_FLAGS_OVERRIDE_DLCR6) != 0)
208 		sc->proto_dlcr6 = cf->cf_flags & FE_FLAGS_DLCR6_VALUE;
209 
210 	/* Find TX buffer size, based on the hardware dependent proto. */
211 	switch (sc->proto_dlcr6 & FE_D6_TXBSIZ) {
212 	case FE_D6_TXBSIZ_2x2KB:
213 		sc->txb_size = 2048;
214 		break;
215 	case FE_D6_TXBSIZ_2x4KB:
216 		sc->txb_size = 4096;
217 		break;
218 	case FE_D6_TXBSIZ_2x8KB:
219 		sc->txb_size = 8192;
220 		break;
221 	default:
222 		/* Oops, we can't work with single buffer configuration. */
223 #if FE_DEBUG >= 2
224 		log(LOG_WARNING, "%s: strange TXBSIZ config; fixing\n",
225 		    device_xname(sc->sc_dev));
226 #endif
227 		sc->proto_dlcr6 &= ~FE_D6_TXBSIZ;
228 		sc->proto_dlcr6 |=  FE_D6_TXBSIZ_2x2KB;
229 		sc->txb_size = 2048;
230 		break;
231 	}
232 
233 	/* Initialize media goo. */
234 	ifmedia_init(&sc->sc_media, 0, mb86960_mediachange,
235 	    mb86960_mediastatus);
236 	if (media != NULL) {
237 		for (i = 0; i < nmedia; i++)
238 			ifmedia_add(&sc->sc_media, media[i], 0, NULL);
239 		ifmedia_set(&sc->sc_media, defmedia);
240 	} else {
241 		ifmedia_add(&sc->sc_media, IFM_ETHER|IFM_MANUAL, 0, NULL);
242 		ifmedia_set(&sc->sc_media, IFM_ETHER|IFM_MANUAL);
243 	}
244 
245 	/* Attach the interface. */
246 	if_attach(ifp);
247 	if_deferred_start_init(ifp, NULL);
248 	ether_ifattach(ifp, sc->sc_enaddr);
249 
250 	rnd_attach_source(&sc->rnd_source, device_xname(sc->sc_dev),
251 	    RND_TYPE_NET, RND_FLAG_DEFAULT);
252 
253 	/* Print additional info when attached. */
254 	aprint_normal_dev(sc->sc_dev, "Ethernet address %s\n",
255 	    ether_sprintf(sc->sc_enaddr));
256 
257 #if FE_DEBUG >= 3
258 	{
259 		int buf, txb, bbw, sbw, ram;
260 
261 		buf = txb = bbw = sbw = ram = -1;
262 		switch (sc->proto_dlcr6 & FE_D6_BUFSIZ) {
263 		case FE_D6_BUFSIZ_8KB:
264 			buf = 8;
265 			break;
266 		case FE_D6_BUFSIZ_16KB:
267 			buf = 16;
268 			break;
269 		case FE_D6_BUFSIZ_32KB:
270 			buf = 32;
271 			break;
272 		case FE_D6_BUFSIZ_64KB:
273 			buf = 64;
274 			break;
275 		}
276 		switch (sc->proto_dlcr6 & FE_D6_TXBSIZ) {
277 		case FE_D6_TXBSIZ_2x2KB:
278 			txb = 2;
279 			break;
280 		case FE_D6_TXBSIZ_2x4KB:
281 			txb = 4;
282 			break;
283 		case FE_D6_TXBSIZ_2x8KB:
284 			txb = 8;
285 			break;
286 		}
287 		switch (sc->proto_dlcr6 & FE_D6_BBW) {
288 		case FE_D6_BBW_BYTE:
289 			bbw = 8;
290 			break;
291 		case FE_D6_BBW_WORD:
292 			bbw = 16;
293 			break;
294 		}
295 		switch (sc->proto_dlcr6 & FE_D6_SBW) {
296 		case FE_D6_SBW_BYTE:
297 			sbw = 8;
298 			break;
299 		case FE_D6_SBW_WORD:
300 			sbw = 16;
301 			break;
302 		}
303 		switch (sc->proto_dlcr6 & FE_D6_SRAM) {
304 		case FE_D6_SRAM_100ns:
305 			ram = 100;
306 			break;
307 		case FE_D6_SRAM_150ns:
308 			ram = 150;
309 			break;
310 		}
311 		aprint_debug_dev(sc->sc_dev,
312 		    "SRAM %dKB %dbit %dns, TXB %dKBx2, %dbit I/O\n",
313 		    buf, bbw, ram, txb, sbw);
314 	}
315 #endif
316 
317 	/* The attach is successful. */
318 	sc->sc_stat |= FE_STAT_ATTACHED;
319 }
320 
321 /*
322  * Media change callback.
323  */
324 int
325 mb86960_mediachange(struct ifnet *ifp)
326 {
327 	struct mb86960_softc *sc = ifp->if_softc;
328 
329 	if (sc->sc_mediachange)
330 		return (*sc->sc_mediachange)(sc);
331 	return 0;
332 }
333 
334 /*
335  * Media status callback.
336  */
337 void
338 mb86960_mediastatus(struct ifnet *ifp, struct ifmediareq *ifmr)
339 {
340 	struct mb86960_softc *sc = ifp->if_softc;
341 
342 	if ((sc->sc_stat & FE_STAT_ENABLED) == 0) {
343 		ifmr->ifm_active = IFM_ETHER | IFM_NONE;
344 		ifmr->ifm_status = 0;
345 		return;
346 	}
347 
348 	if (sc->sc_mediastatus)
349 		(*sc->sc_mediastatus)(sc, ifmr);
350 }
351 
352 /*
353  * Reset interface.
354  */
355 void
356 mb86960_reset(struct mb86960_softc *sc)
357 {
358 	int s;
359 
360 	s = splnet();
361 	mb86960_stop(sc);
362 	mb86960_init(sc);
363 	splx(s);
364 }
365 
366 /*
367  * Stop everything on the interface.
368  *
369  * All buffered packets, both transmitting and receiving,
370  * if any, will be lost by stopping the interface.
371  */
372 void
373 mb86960_stop(struct mb86960_softc *sc)
374 {
375 	bus_space_tag_t bst = sc->sc_bst;
376 	bus_space_handle_t bsh = sc->sc_bsh;
377 
378 #if FE_DEBUG >= 3
379 	log(LOG_INFO, "%s: top of mb86960_stop()\n", device_xname(sc->sc_dev));
380 	mb86960_dump(LOG_INFO, sc);
381 #endif
382 
383 	/* Disable interrupts. */
384 	bus_space_write_1(bst, bsh, FE_DLCR2, 0x00);
385 	bus_space_write_1(bst, bsh, FE_DLCR3, 0x00);
386 
387 	/* Stop interface hardware. */
388 	delay(200);
389 	bus_space_write_1(bst, bsh, FE_DLCR6,
390 	    sc->proto_dlcr6 | FE_D6_DLC_DISABLE);
391 	delay(200);
392 
393 	/* Clear all interrupt status. */
394 	bus_space_write_1(bst, bsh, FE_DLCR0, 0xFF);
395 	bus_space_write_1(bst, bsh, FE_DLCR1, 0xFF);
396 
397 	/* Put the chip in stand-by mode. */
398 	delay(200);
399 	bus_space_write_1(bst, bsh, FE_DLCR7,
400 	    sc->proto_dlcr7 | FE_D7_POWER_DOWN);
401 	delay(200);
402 
403 	/* MAR loading can be delayed. */
404 	sc->filter_change = 0;
405 
406 	/* Call a hook. */
407 	if (sc->stop_card)
408 		(*sc->stop_card)(sc);
409 
410 #if FE_DEBUG >= 3
411 	log(LOG_INFO, "%s: end of mb86960_stop()\n", device_xname(sc->sc_dev));
412 	mb86960_dump(LOG_INFO, sc);
413 #endif
414 }
415 
416 /*
417  * Device timeout/watchdog routine. Entered if the device neglects to
418  * generate an interrupt after a transmit has been started on it.
419  */
420 void
421 mb86960_watchdog(struct ifnet *ifp)
422 {
423 	struct mb86960_softc *sc = ifp->if_softc;
424 
425 	log(LOG_ERR, "%s: device timeout\n", device_xname(sc->sc_dev));
426 #if FE_DEBUG >= 3
427 	mb86960_dump(LOG_INFO, sc);
428 #endif
429 
430 	/* Record how many packets are lost by this accident. */
431 	sc->sc_ec.ec_if.if_oerrors += sc->txb_sched + sc->txb_count;
432 
433 	mb86960_reset(sc);
434 }
435 
436 /*
437  * Drop (skip) a packet from receive buffer in 86960 memory.
438  */
439 static inline void
440 mb86960_droppacket(struct mb86960_softc *sc)
441 {
442 	bus_space_tag_t bst = sc->sc_bst;
443 	bus_space_handle_t bsh = sc->sc_bsh;
444 
445 	bus_space_write_1(bst, bsh, FE_BMPR14, FE_B14_FILTER | FE_B14_SKIP);
446 }
447 
448 /*
449  * Initialize device.
450  */
451 void
452 mb86960_init(struct mb86960_softc *sc)
453 {
454 	bus_space_tag_t bst = sc->sc_bst;
455 	bus_space_handle_t bsh = sc->sc_bsh;
456 	struct ifnet *ifp = &sc->sc_ec.ec_if;
457 	int i;
458 
459 #if FE_DEBUG >= 3
460 	log(LOG_INFO, "%s: top of mb86960_init()\n", device_xname(sc->sc_dev));
461 	mb86960_dump(LOG_INFO, sc);
462 #endif
463 
464 	/* Reset transmitter flags. */
465 	ifp->if_flags &= ~IFF_OACTIVE;
466 	ifp->if_timer = 0;
467 
468 	sc->txb_free = sc->txb_size;
469 	sc->txb_count = 0;
470 	sc->txb_sched = 0;
471 
472 	/* Do any card-specific initialization, if applicable. */
473 	if (sc->init_card)
474 		(*sc->init_card)(sc);
475 
476 #if FE_DEBUG >= 3
477 	log(LOG_INFO, "%s: after init hook\n", device_xname(sc->sc_dev));
478 	mb86960_dump(LOG_INFO, sc);
479 #endif
480 
481 	/*
482 	 * Make sure to disable the chip, also.
483 	 * This may also help re-programming the chip after
484 	 * hot insertion of PCMCIAs.
485 	 */
486 	bus_space_write_1(bst, bsh, FE_DLCR6,
487 	    sc->proto_dlcr6 | FE_D6_DLC_DISABLE);
488 	delay(200);
489 
490 	/* Power up the chip and select register bank for DLCRs. */
491 	bus_space_write_1(bst, bsh, FE_DLCR7,
492 	    sc->proto_dlcr7 | FE_D7_RBS_DLCR | FE_D7_POWER_UP);
493 	delay(200);
494 
495 	/* Feed the station address. */
496 	bus_space_write_region_1(bst, bsh, FE_DLCR8,
497 	    sc->sc_enaddr, ETHER_ADDR_LEN);
498 
499 	/* Select the BMPR bank for runtime register access. */
500 	bus_space_write_1(bst, bsh, FE_DLCR7,
501 	    sc->proto_dlcr7 | FE_D7_RBS_BMPR | FE_D7_POWER_UP);
502 
503 	/* Initialize registers. */
504 	bus_space_write_1(bst, bsh, FE_DLCR0, 0xFF);	/* Clear all bits. */
505 	bus_space_write_1(bst, bsh, FE_DLCR1, 0xFF);	/* ditto. */
506 	bus_space_write_1(bst, bsh, FE_DLCR2, 0x00);
507 	bus_space_write_1(bst, bsh, FE_DLCR3, 0x00);
508 	bus_space_write_1(bst, bsh, FE_DLCR4, sc->proto_dlcr4);
509 	bus_space_write_1(bst, bsh, FE_DLCR5, sc->proto_dlcr5);
510 	bus_space_write_1(bst, bsh, FE_BMPR10, 0x00);
511 	bus_space_write_1(bst, bsh, FE_BMPR11, FE_B11_CTRL_SKIP);
512 	bus_space_write_1(bst, bsh, FE_BMPR12, 0x00);
513 	bus_space_write_1(bst, bsh, FE_BMPR13, sc->proto_bmpr13);
514 	bus_space_write_1(bst, bsh, FE_BMPR14, FE_B14_FILTER);
515 	bus_space_write_1(bst, bsh, FE_BMPR15, 0x00);
516 
517 #if FE_DEBUG >= 3
518 	log(LOG_INFO, "%s: just before enabling DLC\n",
519 	    device_xname(sc->sc_dev));
520 	mb86960_dump(LOG_INFO, sc);
521 #endif
522 
523 	/* Enable interrupts. */
524 	bus_space_write_1(bst, bsh, FE_DLCR2, FE_TMASK);
525 	bus_space_write_1(bst, bsh, FE_DLCR3, FE_RMASK);
526 
527 	/* Enable transmitter and receiver. */
528 	delay(200);
529 	bus_space_write_1(bst, bsh, FE_DLCR6,
530 	    sc->proto_dlcr6 | FE_D6_DLC_ENABLE);
531 	delay(200);
532 
533 #if FE_DEBUG >= 3
534 	log(LOG_INFO, "%s: just after enabling DLC\n",
535 	    device_xname(sc->sc_dev));
536 	mb86960_dump(LOG_INFO, sc);
537 #endif
538 
539 	/*
540 	 * Make sure to empty the receive buffer.
541 	 *
542 	 * This may be redundant, but *if* the receive buffer were full
543 	 * at this point, the driver would hang.  I have experienced
544 	 * some strange hangups just after UP.  I hope the following
545 	 * code solve the problem.
546 	 *
547 	 * I have changed the order of hardware initialization.
548 	 * I think the receive buffer cannot have any packets at this
549 	 * point in this version.  The following code *must* be
550 	 * redundant now.  FIXME.
551 	 */
552 	for (i = 0; i < FE_MAX_RECV_COUNT; i++) {
553 		if (bus_space_read_1(bst, bsh, FE_DLCR5) & FE_D5_BUFEMP)
554 			break;
555 		mb86960_droppacket(sc);
556 	}
557 #if FE_DEBUG >= 1
558 	if (i >= FE_MAX_RECV_COUNT)
559 		log(LOG_ERR, "%s: cannot empty receive buffer\n",
560 		    device_xname(sc->sc_dev));
561 #endif
562 #if FE_DEBUG >= 3
563 	if (i < FE_MAX_RECV_COUNT)
564 		log(LOG_INFO, "%s: receive buffer emptied (%d)\n",
565 		    device_xname(sc->sc_dev), i);
566 #endif
567 
568 #if FE_DEBUG >= 3
569 	log(LOG_INFO, "%s: after ERB loop\n", device_xname(sc->sc_dev));
570 	mb86960_dump(LOG_INFO, sc);
571 #endif
572 
573 	/* Do we need this here? */
574 	bus_space_write_1(bst, bsh, FE_DLCR0, 0xFF);	/* Clear all bits. */
575 	bus_space_write_1(bst, bsh, FE_DLCR1, 0xFF);	/* ditto. */
576 
577 #if FE_DEBUG >= 3
578 	log(LOG_INFO, "%s: after FIXME\n", device_xname(sc->sc_dev));
579 	mb86960_dump(LOG_INFO, sc);
580 #endif
581 
582 	/* Set 'running' flag. */
583 	ifp->if_flags |= IFF_RUNNING;
584 
585 	/*
586 	 * At this point, the interface is runnung properly,
587 	 * except that it receives *no* packets.  we then call
588 	 * mb86960_setmode() to tell the chip what packets to be
589 	 * received, based on the if_flags and multicast group
590 	 * list.  It completes the initialization process.
591 	 */
592 	mb86960_setmode(sc);
593 
594 #if FE_DEBUG >= 3
595 	log(LOG_INFO, "%s: after setmode\n", device_xname(sc->sc_dev));
596 	mb86960_dump(LOG_INFO, sc);
597 #endif
598 
599 	/* ...and attempt to start output. */
600 	mb86960_start(ifp);
601 
602 #if FE_DEBUG >= 3
603 	log(LOG_INFO, "%s: end of mb86960_init()\n", device_xname(sc->sc_dev));
604 	mb86960_dump(LOG_INFO, sc);
605 #endif
606 }
607 
608 /*
609  * This routine actually starts the transmission on the interface
610  */
611 static inline void
612 mb86960_xmit(struct mb86960_softc *sc)
613 {
614 	bus_space_tag_t bst = sc->sc_bst;
615 	bus_space_handle_t bsh = sc->sc_bsh;
616 
617 	/*
618 	 * Set a timer just in case we never hear from the board again.
619 	 * We use longer timeout for multiple packet transmission.
620 	 * I'm not sure this timer value is appropriate.  FIXME.
621 	 */
622 	sc->sc_ec.ec_if.if_timer = 1 + sc->txb_count;
623 
624 	/* Update txb variables. */
625 	sc->txb_sched = sc->txb_count;
626 	sc->txb_count = 0;
627 	sc->txb_free = sc->txb_size;
628 
629 #if FE_DELAYED_PADDING
630 	/* Omit the postponed padding process. */
631 	sc->txb_padding = 0;
632 #endif
633 
634 	/* Start transmitter, passing packets in TX buffer. */
635 	bus_space_write_1(bst, bsh, FE_BMPR10, sc->txb_sched | FE_B10_START);
636 }
637 
638 /*
639  * Start output on interface.
640  * We make two assumptions here:
641  *  1) that the current priority is set to splnet _before_ this code
642  *     is called *and* is returned to the appropriate priority after
643  *     return
644  *  2) that the IFF_OACTIVE flag is checked before this code is called
645  *     (i.e. that the output part of the interface is idle)
646  */
647 void
648 mb86960_start(struct ifnet *ifp)
649 {
650 	struct mb86960_softc *sc = ifp->if_softc;
651 	struct mbuf *m;
652 
653 #if FE_DEBUG >= 1
654 	/* Just a sanity check. */
655 	if ((sc->txb_count == 0) != (sc->txb_free == sc->txb_size)) {
656 		/*
657 		 * Txb_count and txb_free co-works to manage the
658 		 * transmission buffer.  Txb_count keeps track of the
659 		 * used potion of the buffer, while txb_free does unused
660 		 * potion.  So, as long as the driver runs properly,
661 		 * txb_count is zero if and only if txb_free is same
662 		 * as txb_size (which represents whole buffer.)
663 		 */
664 		log(LOG_ERR, "%s: inconsistent txb variables (%d, %d)\n",
665 		    device_xname(sc->sc_dev), sc->txb_count, sc->txb_free);
666 		/*
667 		 * So, what should I do, then?
668 		 *
669 		 * We now know txb_count and txb_free contradicts.  We
670 		 * cannot, however, tell which is wrong.  More
671 		 * over, we cannot peek 86960 transmission buffer or
672 		 * reset the transmission buffer.  (In fact, we can
673 		 * reset the entire interface.  I don't want to do it.)
674 		 *
675 		 * If txb_count is incorrect, leaving it as is will cause
676 		 * sending of garbage after the next interrupt.  We have to
677 		 * avoid it.  Hence, we reset the txb_count here.  If
678 		 * txb_free was incorrect, resetting txb_count just loose
679 		 * some packets.  We can live with it.
680 		 */
681 		sc->txb_count = 0;
682 	}
683 #endif
684 
685 #if FE_DEBUG >= 1
686 	/*
687 	 * First, see if there are buffered packets and an idle
688 	 * transmitter - should never happen at this point.
689 	 */
690 	if ((sc->txb_count > 0) && (sc->txb_sched == 0)) {
691 		log(LOG_ERR, "%s: transmitter idle with %d buffered packets\n",
692 		    device_xname(sc->sc_dev), sc->txb_count);
693 		mb86960_xmit(sc);
694 	}
695 #endif
696 
697 	/*
698 	 * Stop accepting more transmission packets temporarily, when
699 	 * a filter change request is delayed.  Updating the MARs on
700 	 * 86960 flushes the transmisstion buffer, so it is delayed
701 	 * until all buffered transmission packets have been sent
702 	 * out.
703 	 */
704 	if (sc->filter_change) {
705 		/*
706 		 * Filter change request is delayed only when the DLC is
707 		 * working.  DLC soon raise an interrupt after finishing
708 		 * the work.
709 		 */
710 		goto indicate_active;
711 	}
712 
713 	for (;;) {
714 		/*
715 		 * See if there is room to put another packet in the buffer.
716 		 * We *could* do better job by peeking the send queue to
717 		 * know the length of the next packet.  Current version just
718 		 * tests against the worst case (i.e., longest packet).  FIXME.
719 		 *
720 		 * When adding the packet-peek feature, don't forget adding a
721 		 * test on txb_count against QUEUEING_MAX.
722 		 * There is a little chance the packet count exceeds
723 		 * the limit.  Assume transmission buffer is 8KB (2x8KB
724 		 * configuration) and an application sends a bunch of small
725 		 * (i.e., minimum packet sized) packets rapidly.  An 8KB
726 		 * buffer can hold 130 blocks of 62 bytes long...
727 		 */
728 		if (sc->txb_free <
729 		    (ETHER_MAX_LEN - ETHER_CRC_LEN) + FE_TXLEN_SIZE) {
730 			/* No room. */
731 			goto indicate_active;
732 		}
733 
734 #if FE_SINGLE_TRANSMISSION
735 		if (sc->txb_count > 0) {
736 			/* Just one packet per a transmission buffer. */
737 			goto indicate_active;
738 		}
739 #endif
740 
741 		/*
742 		 * Get the next mbuf chain for a packet to send.
743 		 */
744 		IFQ_DEQUEUE(&ifp->if_snd, m);
745 		if (m == 0) {
746 			/* No more packets to send. */
747 			goto indicate_inactive;
748 		}
749 
750 		/* Tap off here if there is a BPF listener. */
751 		bpf_mtap(ifp, m, BPF_D_OUT);
752 
753 		/*
754 		 * Copy the mbuf chain into the transmission buffer.
755 		 * txb_* variables are updated as necessary.
756 		 */
757 		mb86960_write_mbufs(sc, m);
758 
759 		m_freem(m);
760 
761 		/* Start transmitter if it's idle. */
762 		if (sc->txb_sched == 0)
763 			mb86960_xmit(sc);
764 	}
765 
766 indicate_inactive:
767 	/*
768 	 * We are using the !OACTIVE flag to indicate to
769 	 * the outside world that we can accept an
770 	 * additional packet rather than that the
771 	 * transmitter is _actually_ active.  Indeed, the
772 	 * transmitter may be active, but if we haven't
773 	 * filled all the buffers with data then we still
774 	 * want to accept more.
775 	 */
776 	ifp->if_flags &= ~IFF_OACTIVE;
777 	return;
778 
779 indicate_active:
780 	/*
781 	 * The transmitter is active, and there are no room for
782 	 * more outgoing packets in the transmission buffer.
783 	 */
784 	ifp->if_flags |= IFF_OACTIVE;
785 	return;
786 }
787 
788 /*
789  * Transmission interrupt handler
790  * The control flow of this function looks silly.  FIXME.
791  */
792 void
793 mb86960_tint(struct mb86960_softc *sc, uint8_t tstat)
794 {
795 	bus_space_tag_t bst = sc->sc_bst;
796 	bus_space_handle_t bsh = sc->sc_bsh;
797 	struct ifnet *ifp = &sc->sc_ec.ec_if;
798 	int left;
799 	int col;
800 
801 	/*
802 	 * Handle "excessive collision" interrupt.
803 	 */
804 	if (tstat & FE_D0_COLL16) {
805 		/*
806 		 * Find how many packets (including this collided one)
807 		 * are left unsent in transmission buffer.
808 		 */
809 		left = bus_space_read_1(bst, bsh, FE_BMPR10);
810 
811 #if FE_DEBUG >= 2
812 		log(LOG_WARNING, "%s: excessive collision (%d/%d)\n",
813 		    device_xname(sc->sc_dev), left, sc->txb_sched);
814 #endif
815 #if FE_DEBUG >= 3
816 		mb86960_dump(LOG_INFO, sc);
817 #endif
818 
819 		/*
820 		 * Update statistics.
821 		 */
822 		ifp->if_collisions += 16;
823 		ifp->if_oerrors++;
824 		ifp->if_opackets += sc->txb_sched - left;
825 
826 		/*
827 		 * Collision statistics has been updated.
828 		 * Clear the collision flag on 86960 now to avoid confusion.
829 		 */
830 		bus_space_write_1(bst, bsh, FE_DLCR0, FE_D0_COLLID);
831 
832 		/*
833 		 * Restart transmitter, skipping the
834 		 * collided packet.
835 		 *
836 		 * We *must* skip the packet to keep network running
837 		 * properly.  Excessive collision error is an
838 		 * indication of the network overload.  If we
839 		 * tried sending the same packet after excessive
840 		 * collision, the network would be filled with
841 		 * out-of-time packets.  Packets belonging
842 		 * to reliable transport (such as TCP) are resent
843 		 * by some upper layer.
844 		 */
845 		bus_space_write_1(bst, bsh, FE_BMPR11,
846 		    FE_B11_CTRL_SKIP | FE_B11_MODE1);
847 		sc->txb_sched = left - 1;
848 	}
849 
850 	/*
851 	 * Handle "transmission complete" interrupt.
852 	 */
853 	if (tstat & FE_D0_TXDONE) {
854 		/*
855 		 * Add in total number of collisions on last
856 		 * transmission.  We also clear "collision occurred" flag
857 		 * here.
858 		 *
859 		 * 86960 has a design flow on collision count on multiple
860 		 * packet transmission.  When we send two or more packets
861 		 * with one start command (that's what we do when the
862 		 * transmission queue is clauded), 86960 informs us number
863 		 * of collisions occurred on the last packet on the
864 		 * transmission only.  Number of collisions on previous
865 		 * packets are lost.  I have told that the fact is clearly
866 		 * stated in the Fujitsu document.
867 		 *
868 		 * I considered not to mind it seriously.  Collision
869 		 * count is not so important, anyway.  Any comments?  FIXME.
870 		 */
871 
872 		if (bus_space_read_1(bst, bsh, FE_DLCR0) & FE_D0_COLLID) {
873 			/* Clear collision flag. */
874 			bus_space_write_1(bst, bsh, FE_DLCR0, FE_D0_COLLID);
875 
876 			/* Extract collision count from 86960. */
877 			col = bus_space_read_1(bst, bsh, FE_DLCR4) & FE_D4_COL;
878 			if (col == 0) {
879 				/*
880 				 * Status register indicates collisions,
881 				 * while the collision count is zero.
882 				 * This can happen after multiple packet
883 				 * transmission, indicating that one or more
884 				 * previous packet(s) had been collided.
885 				 *
886 				 * Since the accurate number of collisions
887 				 * has been lost, we just guess it as 1;
888 				 * Am I too optimistic?  FIXME.
889 				 */
890 				col = 1;
891 			} else
892 				col >>= FE_D4_COL_SHIFT;
893 			ifp->if_collisions += col;
894 #if FE_DEBUG >= 4
895 			log(LOG_WARNING, "%s: %d collision%s (%d)\n",
896 			    device_xname(sc->sc_dev), col, col == 1 ? "" : "s",
897 			    sc->txb_sched);
898 #endif
899 		}
900 
901 		/*
902 		 * Update total number of successfully
903 		 * transmitted packets.
904 		 */
905 		ifp->if_opackets += sc->txb_sched;
906 		sc->txb_sched = 0;
907 	}
908 
909 	if (sc->txb_sched == 0) {
910 		/*
911 		 * The transmitter is no more active.
912 		 * Reset output active flag and watchdog timer.
913 		 */
914 		ifp->if_flags &= ~IFF_OACTIVE;
915 		ifp->if_timer = 0;
916 
917 		/*
918 		 * If more data is ready to transmit in the buffer, start
919 		 * transmitting them.  Otherwise keep transmitter idle,
920 		 * even if more data is queued.  This gives receive
921 		 * process a slight priority.
922 		 */
923 		if (sc->txb_count > 0)
924 			mb86960_xmit(sc);
925 	}
926 }
927 
928 /*
929  * Ethernet interface receiver interrupt.
930  */
931 void
932 mb86960_rint(struct mb86960_softc *sc, uint8_t rstat)
933 {
934 	bus_space_tag_t bst = sc->sc_bst;
935 	bus_space_handle_t bsh = sc->sc_bsh;
936 	struct ifnet *ifp = &sc->sc_ec.ec_if;
937 	u_int status, len;
938 	int i;
939 
940 	/*
941 	 * Update statistics if this interrupt is caused by an error.
942 	 */
943 	if (rstat & (FE_D1_OVRFLO | FE_D1_CRCERR | FE_D1_ALGERR |
944 	    FE_D1_SRTPKT)) {
945 #if FE_DEBUG >= 3
946 		char sbuf[sizeof(FE_D1_ERRBITS) + 64];
947 
948 		snprintb(sbuf, sizeof(sbuf), FE_D1_ERRBITS, rstat);
949 		log(LOG_WARNING, "%s: receive error: %s\n",
950 		    device_xname(sc->sc_dev), sbuf);
951 #endif
952 		ifp->if_ierrors++;
953 	}
954 
955 	/*
956 	 * MB86960 has a flag indicating "receive queue empty."
957 	 * We just loop checking the flag to pull out all received
958 	 * packets.
959 	 *
960 	 * We limit the number of iterrations to avoid infinite loop.
961 	 * It can be caused by a very slow CPU (some broken
962 	 * peripheral may insert incredible number of wait cycles)
963 	 * or, worse, by a broken MB86960 chip.
964 	 */
965 	for (i = 0; i < FE_MAX_RECV_COUNT; i++) {
966 		/* Stop the iterration if 86960 indicates no packets. */
967 		if (bus_space_read_1(bst, bsh, FE_DLCR5) & FE_D5_BUFEMP)
968 			break;
969 
970 		/*
971 		 * Extract receive packet status from the receive
972 		 * packet header.
973 		 */
974 		if (sc->sc_flags & FE_FLAGS_SBW_BYTE) {
975 			status = bus_space_read_1(bst, bsh, FE_BMPR8);
976 			(void)bus_space_read_1(bst, bsh, FE_BMPR8);
977 		} else
978 			status = bus_space_read_2(bst, bsh, FE_BMPR8);
979 
980 #if FE_DEBUG >= 4
981 		log(LOG_INFO, "%s: receive status = %02x\n",
982 		    device_xname(sc->sc_dev), status);
983 #endif
984 
985 		/*
986 		 * If there was an error, update statistics and drop
987 		 * the packet, unless the interface is in promiscuous
988 		 * mode.
989 		 */
990 		if ((status & FE_RXSTAT_GOODPKT) == 0) {
991 			if ((ifp->if_flags & IFF_PROMISC) == 0) {
992 				ifp->if_ierrors++;
993 				mb86960_droppacket(sc);
994 				continue;
995 			}
996 		}
997 
998 		/*
999 		 * Extract the packet length from the receive packet header.
1000 		 * It is a sum of a header (14 bytes) and a payload.
1001 		 * CRC has been stripped off by the 86960.
1002 		 */
1003 		if (sc->sc_flags & FE_FLAGS_SBW_BYTE) {
1004 			len  = bus_space_read_1(bst, bsh, FE_BMPR8);
1005 			len |= bus_space_read_1(bst, bsh, FE_BMPR8) << 8;
1006 		} else
1007 			len = bus_space_read_2(bst, bsh, FE_BMPR8);
1008 
1009 		/*
1010 		 * MB86965 checks the packet length and drop big packet
1011 		 * before passing it to us.  There are no chance we can
1012 		 * get [crufty] packets.  Hence, if the length exceeds
1013 		 * the specified limit, it means some serious failure,
1014 		 * such as out-of-sync on receive buffer management.
1015 		 *
1016 		 * Is this statement true?  FIXME.
1017 		 */
1018 		if (len > (ETHER_MAX_LEN - ETHER_CRC_LEN) ||
1019 		    len < ETHER_HDR_LEN) {
1020 #if FE_DEBUG >= 2
1021 			log(LOG_WARNING,
1022 			    "%s: received a %s packet? (%u bytes)\n",
1023 			    device_xname(sc->sc_dev),
1024 			    len < ETHER_HDR_LEN ? "partial" : "big", len);
1025 #endif
1026 			ifp->if_ierrors++;
1027 			mb86960_droppacket(sc);
1028 			continue;
1029 		}
1030 
1031 		/*
1032 		 * Check for a short (RUNT) packet.  We *do* check
1033 		 * but do nothing other than print a message.
1034 		 * Short packets are illegal, but does nothing bad
1035 		 * if it carries data for upper layer.
1036 		 */
1037 #if FE_DEBUG >= 2
1038 		if (len < (ETHER_MIN_LEN - ETHER_CRC_LEN)) {
1039 			log(LOG_WARNING,
1040 			    "%s: received a short packet? (%u bytes)\n",
1041 			    device_xname(sc->sc_dev), len);
1042 		}
1043 #endif
1044 
1045 		/*
1046 		 * Go get a packet.
1047 		 */
1048 		if (mb86960_get_packet(sc, len) == 0) {
1049 			/* Skip a packet, updating statistics. */
1050 #if FE_DEBUG >= 2
1051 			log(LOG_WARNING,
1052 			    "%s: out of mbufs; dropping packet (%u bytes)\n",
1053 			    device_xname(sc->sc_dev), len);
1054 #endif
1055 			ifp->if_ierrors++;
1056 			mb86960_droppacket(sc);
1057 
1058 			/*
1059 			 * We stop receiving packets, even if there are
1060 			 * more in the buffer.  We hope we can get more
1061 			 * mbufs next time.
1062 			 */
1063 			return;
1064 		}
1065 	}
1066 }
1067 
1068 /*
1069  * Ethernet interface interrupt processor
1070  */
1071 int
1072 mb86960_intr(void *arg)
1073 {
1074 	struct mb86960_softc *sc = arg;
1075 	bus_space_tag_t bst = sc->sc_bst;
1076 	bus_space_handle_t bsh = sc->sc_bsh;
1077 	struct ifnet *ifp = &sc->sc_ec.ec_if;
1078 	uint8_t tstat, rstat;
1079 
1080 	if ((sc->sc_stat & FE_STAT_ENABLED) == 0 ||
1081 	    !device_is_active(sc->sc_dev))
1082 		return 0;
1083 
1084 #if FE_DEBUG >= 4
1085 	log(LOG_INFO, "%s: mb86960_intr()\n", device_xname(sc->sc_dev));
1086 	mb86960_dump(LOG_INFO, sc);
1087 #endif
1088 
1089 	/*
1090 	 * Get interrupt conditions, masking unneeded flags.
1091 	 */
1092 	tstat = bus_space_read_1(bst, bsh, FE_DLCR0) & FE_TMASK;
1093 	rstat = bus_space_read_1(bst, bsh, FE_DLCR1) & FE_RMASK;
1094 	if (tstat == 0 && rstat == 0)
1095 		return 0;
1096 
1097 	/*
1098 	 * Loop until there are no more new interrupt conditions.
1099 	 */
1100 	for (;;) {
1101 		/*
1102 		 * Reset the conditions we are acknowledging.
1103 		 */
1104 		bus_space_write_1(bst, bsh, FE_DLCR0, tstat);
1105 		bus_space_write_1(bst, bsh, FE_DLCR1, rstat);
1106 
1107 		/*
1108 		 * Handle transmitter interrupts. Handle these first because
1109 		 * the receiver will reset the board under some conditions.
1110 		 */
1111 		if (tstat != 0)
1112 			mb86960_tint(sc, tstat);
1113 
1114 		/*
1115 		 * Handle receiver interrupts.
1116 		 */
1117 		if (rstat != 0)
1118 			mb86960_rint(sc, rstat);
1119 
1120 		/*
1121 		 * Update the multicast address filter if it is
1122 		 * needed and possible.  We do it now, because
1123 		 * we can make sure the transmission buffer is empty,
1124 		 * and there is a good chance that the receive queue
1125 		 * is empty.  It will minimize the possibility of
1126 		 * packet lossage.
1127 		 */
1128 		if (sc->filter_change &&
1129 		    sc->txb_count == 0 && sc->txb_sched == 0) {
1130 			mb86960_loadmar(sc);
1131 			ifp->if_flags &= ~IFF_OACTIVE;
1132 		}
1133 
1134 		/*
1135 		 * If it looks like the transmitter can take more data,
1136 		 * attempt to start output on the interface. This is done
1137 		 * after handling the receiver interrupt to give the
1138 		 * receive operation priority.
1139 		 */
1140 		if ((ifp->if_flags & IFF_OACTIVE) == 0)
1141 			if_schedule_deferred_start(ifp);
1142 
1143 		if (rstat != 0 || tstat != 0)
1144 			rnd_add_uint32(&sc->rnd_source, rstat + tstat);
1145 
1146 		/*
1147 		 * Get interrupt conditions, masking unneeded flags.
1148 		 */
1149 		tstat = bus_space_read_1(bst, bsh, FE_DLCR0) & FE_TMASK;
1150 		rstat = bus_space_read_1(bst, bsh, FE_DLCR1) & FE_RMASK;
1151 		if (tstat == 0 && rstat == 0)
1152 			return 1;
1153 	}
1154 }
1155 
1156 /*
1157  * Process an ioctl request.  This code needs some work - it looks pretty ugly.
1158  */
1159 int
1160 mb86960_ioctl(struct ifnet *ifp, u_long cmd, void *data)
1161 {
1162 	struct mb86960_softc *sc = ifp->if_softc;
1163 	struct ifaddr *ifa = (struct ifaddr *)data;
1164 	struct ifreq *ifr = (struct ifreq *)data;
1165 	int s, error = 0;
1166 
1167 #if FE_DEBUG >= 3
1168 	log(LOG_INFO, "%s: ioctl(%lx)\n", device_xname(sc->sc_dev), cmd);
1169 #endif
1170 
1171 	s = splnet();
1172 
1173 	switch (cmd) {
1174 	case SIOCINITIFADDR:
1175 		if ((error = mb86960_enable(sc)) != 0)
1176 			break;
1177 		ifp->if_flags |= IFF_UP;
1178 
1179 		mb86960_init(sc);
1180 		switch (ifa->ifa_addr->sa_family) {
1181 #ifdef INET
1182 		case AF_INET:
1183 			arp_ifinit(ifp, ifa);
1184 			break;
1185 #endif
1186 		default:
1187 			break;
1188 		}
1189 		break;
1190 
1191 	case SIOCSIFFLAGS:
1192 		if ((error = ifioctl_common(ifp, cmd, data)) != 0)
1193 			break;
1194 		/* XXX re-use ether_ioctl() */
1195 		switch (ifp->if_flags & (IFF_UP|IFF_RUNNING)) {
1196 		case IFF_RUNNING:
1197 			/*
1198 			 * If interface is marked down and it is running, then
1199 			 * stop it.
1200 			 */
1201 			mb86960_stop(sc);
1202 			ifp->if_flags &= ~IFF_RUNNING;
1203 			mb86960_disable(sc);
1204 			break;
1205 		case IFF_UP:
1206 			/*
1207 			 * If interface is marked up and it is stopped, then
1208 			 * start it.
1209 			 */
1210 			if ((error = mb86960_enable(sc)) != 0)
1211 				break;
1212 			mb86960_init(sc);
1213 			break;
1214 		case IFF_UP|IFF_RUNNING:
1215 			/*
1216 			 * Reset the interface to pick up changes in any other
1217 			 * flags that affect hardware registers.
1218 			 */
1219 			mb86960_setmode(sc);
1220 			break;
1221 		case 0:
1222 			break;
1223 		}
1224 #if FE_DEBUG >= 1
1225 		/* "ifconfig fe0 debug" to print register dump. */
1226 		if (ifp->if_flags & IFF_DEBUG) {
1227 			log(LOG_INFO, "%s: SIOCSIFFLAGS(DEBUG)\n",
1228 			    device_xname(sc->sc_dev));
1229 			mb86960_dump(LOG_DEBUG, sc);
1230 		}
1231 #endif
1232 		break;
1233 
1234 	case SIOCADDMULTI:
1235 	case SIOCDELMULTI:
1236 		if ((sc->sc_stat & FE_STAT_ENABLED) == 0) {
1237 			error = EIO;
1238 			break;
1239 		}
1240 
1241 		/* Update our multicast list. */
1242 		if ((error = ether_ioctl(ifp, cmd, data)) == ENETRESET) {
1243 			/*
1244 			 * Multicast list has changed; set the hardware filter
1245 			 * accordingly.
1246 			 */
1247 			if (ifp->if_flags & IFF_RUNNING)
1248 				mb86960_setmode(sc);
1249 			error = 0;
1250 		}
1251 		break;
1252 
1253 	case SIOCGIFMEDIA:
1254 	case SIOCSIFMEDIA:
1255 		error = ifmedia_ioctl(ifp, ifr, &sc->sc_media, cmd);
1256 		break;
1257 
1258 	default:
1259 		error = ether_ioctl(ifp, cmd, data);
1260 		break;
1261 	}
1262 
1263 	splx(s);
1264 	return error;
1265 }
1266 
1267 /*
1268  * Retrieve packet from receive buffer and send to the next level up via
1269  * ether_input(). If there is a BPF listener, give a copy to BPF, too.
1270  * Returns 0 if success, -1 if error (i.e., mbuf allocation failure).
1271  */
1272 int
1273 mb86960_get_packet(struct mb86960_softc *sc, u_int len)
1274 {
1275 	bus_space_tag_t bst = sc->sc_bst;
1276 	bus_space_handle_t bsh = sc->sc_bsh;
1277 	struct ifnet *ifp = &sc->sc_ec.ec_if;
1278 	struct mbuf *m;
1279 
1280 	/* Allocate a header mbuf. */
1281 	MGETHDR(m, M_DONTWAIT, MT_DATA);
1282 	if (m == 0)
1283 		return 0;
1284 	m_set_rcvif(m, ifp);
1285 	m->m_pkthdr.len = len;
1286 
1287 	/* The following silliness is to make NFS happy. */
1288 #define	EROUND	((sizeof(struct ether_header) + 3) & ~3)
1289 #define	EOFF	(EROUND - sizeof(struct ether_header))
1290 
1291 	/*
1292 	 * Our strategy has one more problem.  There is a policy on
1293 	 * mbuf cluster allocation.  It says that we must have at
1294 	 * least MINCLSIZE (208 bytes) to allocate a cluster.  For a
1295 	 * packet of a size between (MHLEN - 2) to (MINCLSIZE - 2),
1296 	 * our code violates the rule...
1297 	 * On the other hand, the current code is short, simple,
1298 	 * and fast, however.  It does no harmful thing, just waists
1299 	 * some memory.  Any comments?  FIXME.
1300 	 */
1301 
1302 	/* Attach a cluster if this packet doesn't fit in a normal mbuf. */
1303 	if (len > MHLEN - EOFF) {
1304 		MCLGET(m, M_DONTWAIT);
1305 		if ((m->m_flags & M_EXT) == 0) {
1306 			m_freem(m);
1307 			return 0;
1308 		}
1309 	}
1310 
1311 	/*
1312 	 * The following assumes there is room for the ether header in the
1313 	 * header mbuf.
1314 	 */
1315 	m->m_data += EOFF;
1316 
1317 	/* Set the length of this packet. */
1318 	m->m_len = len;
1319 
1320 	/* Get a packet. */
1321 	if (sc->sc_flags & FE_FLAGS_SBW_BYTE)
1322 		bus_space_read_multi_1(bst, bsh, FE_BMPR8,
1323 		    mtod(m, uint8_t *), len);
1324 	else
1325 		bus_space_read_multi_stream_2(bst, bsh, FE_BMPR8,
1326 		    mtod(m, uint16_t *), (len + 1) >> 1);
1327 
1328 	if_percpuq_enqueue(ifp->if_percpuq, m);
1329 	return 1;
1330 }
1331 
1332 /*
1333  * Write an mbuf chain to the transmission buffer memory using 16 bit PIO.
1334  * Returns number of bytes actually written, including length word.
1335  *
1336  * If an mbuf chain is too long for an Ethernet frame, it is not sent.
1337  * Packets shorter than Ethernet minimum are legal, and we pad them
1338  * before sending out.  An exception is "partial" packets which are
1339  * shorter than mandatory Ethernet header.
1340  *
1341  * I wrote a code for an experimental "delayed padding" technique.
1342  * When employed, it postpones the padding process for short packets.
1343  * If xmit() occurred at the moment, the padding process is omitted, and
1344  * garbages are sent as pad data.  If next packet is stored in the
1345  * transmission buffer before xmit(), write_mbuf() pads the previous
1346  * packet before transmitting new packet.  This *may* gain the
1347  * system performance (slightly).
1348  */
1349 void
1350 mb86960_write_mbufs(struct mb86960_softc *sc, struct mbuf *m)
1351 {
1352 	bus_space_tag_t bst = sc->sc_bst;
1353 	bus_space_handle_t bsh = sc->sc_bsh;
1354 	int totlen, len;
1355 #if FE_DEBUG >= 2
1356 	struct mbuf *mp;
1357 #endif
1358 
1359 #if FE_DELAYED_PADDING
1360 	/* Do the "delayed padding." */
1361 	if (sc->txb_padding > 0) {
1362 		if (sc->sc_flags & FE_FLAGS_SBW_BYTE) {
1363 			for (len = sc->txb_padding; len > 0; len--)
1364 				bus_space_write_1(bst, bsh, FE_BMPR8, 0);
1365 		} else {
1366 			for (len = sc->txb_padding >> 1; len > 0; len--)
1367 				bus_space_write_2(bst, bsh, FE_BMPR8, 0);
1368 		}
1369 		sc->txb_padding = 0;
1370 	}
1371 #endif
1372 
1373 	/* We need to use m->m_pkthdr.len, so require the header */
1374 	if ((m->m_flags & M_PKTHDR) == 0)
1375 	  	panic("mb86960_write_mbufs: no header mbuf");
1376 
1377 #if FE_DEBUG >= 2
1378 	/* First, count up the total number of bytes to copy. */
1379 	for (totlen = 0, mp = m; mp != 0; mp = mp->m_next)
1380 		totlen += mp->m_len;
1381 	/* Check if this matches the one in the packet header. */
1382 	if (totlen != m->m_pkthdr.len)
1383 		log(LOG_WARNING, "%s: packet length mismatch? (%d/%d)\n",
1384 		    device_xname(sc->sc_dev), totlen, m->m_pkthdr.len);
1385 #else
1386 	/* Just use the length value in the packet header. */
1387 	totlen = m->m_pkthdr.len;
1388 #endif
1389 
1390 #if FE_DEBUG >= 1
1391 	/*
1392 	 * Should never send big packets.  If such a packet is passed,
1393 	 * it should be a bug of upper layer.  We just ignore it.
1394 	 * ... Partial (too short) packets, neither.
1395 	 */
1396 	if (totlen > (ETHER_MAX_LEN - ETHER_CRC_LEN) ||
1397 	    totlen < ETHER_HDR_LEN) {
1398 		log(LOG_ERR, "%s: got a %s packet (%u bytes) to send\n",
1399 		    device_xname(sc->sc_dev),
1400 		    totlen < ETHER_HDR_LEN ? "partial" : "big", totlen);
1401 		sc->sc_ec.ec_if.if_oerrors++;
1402 		return;
1403 	}
1404 #endif
1405 
1406 	/*
1407 	 * Put the length word for this frame.
1408 	 * Does 86960 accept odd length?  -- Yes.
1409 	 * Do we need to pad the length to minimum size by ourselves?
1410 	 * -- Generally yes.  But for (or will be) the last
1411 	 * packet in the transmission buffer, we can skip the
1412 	 * padding process.  It may gain performance slightly.  FIXME.
1413 	 */
1414 	len = max(totlen, (ETHER_MIN_LEN - ETHER_CRC_LEN));
1415 	if (sc->sc_flags & FE_FLAGS_SBW_BYTE) {
1416 		bus_space_write_1(bst, bsh, FE_BMPR8, len);
1417 		bus_space_write_1(bst, bsh, FE_BMPR8, len >> 8);
1418 	} else {
1419 		bus_space_write_2(bst, bsh, FE_BMPR8, len);
1420 		/* roundup packet length since we will use word access */
1421 		totlen = (totlen + 1) & ~1;
1422 	}
1423 
1424 	/*
1425 	 * Update buffer status now.
1426 	 * Truncate the length up to an even number
1427 	 * if the chip is set in SBW_WORD mode.
1428 	 */
1429 	sc->txb_free -= FE_TXLEN_SIZE +
1430 	    max(totlen, (ETHER_MIN_LEN - ETHER_CRC_LEN));
1431 	sc->txb_count++;
1432 
1433 #if FE_DELAYED_PADDING
1434 	/* Postpone the packet padding if necessary. */
1435 	if (totlen < (ETHER_MIN_LEN - ETHER_CRC_LEN))
1436 		sc->txb_padding = (ETHER_MIN_LEN - ETHER_CRC_LEN) - totlen;
1437 #endif
1438 
1439 	/*
1440 	 * Transfer the data from mbuf chain to the transmission buffer.
1441 	 * If the MB86960 is configured in word mode, data needs to be
1442 	 * transferred as words, and only words.
1443 	 * So that we require some extra code to patch over odd-length
1444 	 * or unaligned mbufs.
1445 	 */
1446 	if (sc->sc_flags & FE_FLAGS_SBW_BYTE) {
1447 		/* It's simple in byte mode. */
1448 		for (; m != NULL; m = m->m_next) {
1449 			if (m->m_len) {
1450 				bus_space_write_multi_1(bst, bsh, FE_BMPR8,
1451 				    mtod(m, uint8_t *), m->m_len);
1452 			}
1453 		}
1454 	} else {
1455 		/* a bit trickier in word mode. */
1456 		uint8_t *data, savebyte[2];
1457 		int leftover;
1458 
1459 		leftover = 0;
1460 		savebyte[0] = savebyte[1] = 0;
1461 
1462 		for (; m != NULL; m = m->m_next) {
1463 			len = m->m_len;
1464 			if (len == 0)
1465 				continue;
1466 			data = mtod(m, uint8_t *);
1467 			while (len > 0) {
1468 				if (leftover) {
1469 					/*
1470 					 * Data left over (from mbuf or
1471 					 * realignment). Buffer the next
1472 					 * byte, and write it and the
1473 					 * leftover data out.
1474 					 */
1475 					savebyte[1] = *data++;
1476 					len--;
1477 					bus_space_write_stream_2(bst, bsh,
1478 					   FE_BMPR8, *(uint16_t *)savebyte);
1479 					leftover = 0;
1480 				} else if (BUS_SPACE_ALIGNED_POINTER(data,
1481 				    uint16_t) == 0) {
1482 					/*
1483 					 * Unaligned data; buffer the next byte.
1484 					 */
1485 					savebyte[0] = *data++;
1486 					len--;
1487 					leftover = 1;
1488 				} else {
1489 					/*
1490 					 * Aligned data; output contiguous
1491 					 * words as much as we can, then
1492 					 * buffer the remaining byte, if any.
1493 					 */
1494 					leftover = len & 1;
1495 					len &= ~1;
1496 					bus_space_write_multi_stream_2(bst, bsh,
1497 					    FE_BMPR8, (uint16_t *)data,
1498 					    len >> 1);
1499 					data += len;
1500 					if (leftover)
1501 						savebyte[0] = *data++;
1502 					len = 0;
1503 				}
1504 			}
1505 			if (len < 0)
1506 				panic("mb86960_write_mbufs: negative len");
1507 		}
1508 		if (leftover) {
1509 			savebyte[1] = 0;
1510 			bus_space_write_stream_2(bst, bsh, FE_BMPR8,
1511 			    *(uint16_t *)savebyte);
1512 		}
1513 	}
1514 #if FE_DELAYED_PADDING == 0
1515 	/*
1516 	 * Pad the packet to the minimum length if necessary.
1517 	 */
1518 	len = (ETHER_MIN_LEN - ETHER_CRC_LEN) - totlen;
1519 	if (len > 0) {
1520 		if (sc->sc_flags & FE_FLAGS_SBW_BYTE) {
1521 			while (len-- > 0)
1522 				bus_space_write_1(bst, bsh, FE_BMPR8, 0);
1523 		} else {
1524 			len >>= 1;
1525 			while (len-- > 0)
1526 				bus_space_write_2(bst, bsh, FE_BMPR8, 0);
1527 		}
1528 	}
1529 #endif
1530 }
1531 
1532 /*
1533  * Compute the multicast address filter from the
1534  * list of multicast addresses we need to listen to.
1535  */
1536 void
1537 mb86960_getmcaf(struct ethercom *ec, uint8_t *af)
1538 {
1539 	struct ifnet *ifp = &ec->ec_if;
1540 	struct ether_multi *enm;
1541 	uint32_t crc;
1542 	struct ether_multistep step;
1543 
1544 	/*
1545 	 * Set up multicast address filter by passing all multicast addresses
1546 	 * through a crc generator, and then using the high order 6 bits as an
1547 	 * index into the 64 bit logical address filter.  The high order bit
1548 	 * selects the word, while the rest of the bits select the bit within
1549 	 * the word.
1550 	 */
1551 
1552 	if ((ifp->if_flags & IFF_PROMISC) != 0)
1553 		goto allmulti;
1554 
1555 	memset(af, 0, FE_FILTER_LEN);
1556 	ETHER_FIRST_MULTI(step, ec, enm);
1557 	while (enm != NULL) {
1558 		if (memcmp(enm->enm_addrlo, enm->enm_addrhi,
1559 		    sizeof(enm->enm_addrlo)) != 0) {
1560 			/*
1561 			 * We must listen to a range of multicast addresses.
1562 			 * For now, just accept all multicasts, rather than
1563 			 * trying to set only those filter bits needed to match
1564 			 * the range.  (At this time, the only use of address
1565 			 * ranges is for IP multicast routing, for which the
1566 			 * range is big enough to require all bits set.)
1567 			 */
1568 			goto allmulti;
1569 		}
1570 
1571 		crc = ether_crc32_le(enm->enm_addrlo, ETHER_ADDR_LEN);
1572 
1573 		/* Just want the 6 most significant bits. */
1574 		crc >>= 26;
1575 
1576 		/* Turn on the corresponding bit in the filter. */
1577 		af[crc >> 3] |= 1 << (crc & 7);
1578 
1579 		ETHER_NEXT_MULTI(step, enm);
1580 	}
1581 	ifp->if_flags &= ~IFF_ALLMULTI;
1582 	return;
1583 
1584 allmulti:
1585 	ifp->if_flags |= IFF_ALLMULTI;
1586 	memset(af, 0xff, FE_FILTER_LEN);
1587 }
1588 
1589 /*
1590  * Calculate a new "multicast packet filter" and put the 86960
1591  * receiver in appropriate mode.
1592  */
1593 void
1594 mb86960_setmode(struct mb86960_softc *sc)
1595 {
1596 	bus_space_tag_t bst = sc->sc_bst;
1597 	bus_space_handle_t bsh = sc->sc_bsh;
1598 	int flags = sc->sc_ec.ec_if.if_flags;
1599 
1600 	/*
1601 	 * If the interface is not running, we postpone the update
1602 	 * process for receive modes and multicast address filter
1603 	 * until the interface is restarted.  It reduces some
1604 	 * complicated job on maintaining chip states.  (Earlier versions
1605 	 * of this driver had a bug on that point...)
1606 	 *
1607 	 * To complete the trick, mb86960_init() calls mb86960_setmode() after
1608 	 * restarting the interface.
1609 	 */
1610 	if ((flags & IFF_RUNNING) == 0)
1611 		return;
1612 
1613 	/*
1614 	 * Promiscuous mode is handled separately.
1615 	 */
1616 	if ((flags & IFF_PROMISC) != 0) {
1617 		/*
1618 		 * Program 86960 to receive all packets on the segment
1619 		 * including those directed to other stations.
1620 		 * Multicast filter stored in MARs are ignored
1621 		 * under this setting, so we don't need to update it.
1622 		 *
1623 		 * Promiscuous mode is used solely by BPF, and BPF only
1624 		 * listens to valid (no error) packets.  So, we ignore
1625 		 * errornous ones even in this mode.
1626 		 */
1627 		bus_space_write_1(bst, bsh, FE_DLCR5,
1628 		    sc->proto_dlcr5 | FE_D5_AFM0 | FE_D5_AFM1);
1629 		sc->filter_change = 0;
1630 
1631 #if FE_DEBUG >= 3
1632 		log(LOG_INFO, "%s: promiscuous mode\n",
1633 		    device_xname(sc->sc_dev));
1634 #endif
1635 		return;
1636 	}
1637 
1638 	/*
1639 	 * Turn the chip to the normal (non-promiscuous) mode.
1640 	 */
1641 	bus_space_write_1(bst, bsh, FE_DLCR5, sc->proto_dlcr5 | FE_D5_AFM1);
1642 
1643 	/*
1644 	 * Find the new multicast filter value.
1645 	 */
1646 	mb86960_getmcaf(&sc->sc_ec, sc->filter);
1647 	sc->filter_change = 1;
1648 
1649 #if FE_DEBUG >= 3
1650 	log(LOG_INFO,
1651 	    "%s: address filter: [%02x %02x %02x %02x %02x %02x %02x %02x]\n",
1652 	    device_xname(sc->sc_dev),
1653 	    sc->filter[0], sc->filter[1], sc->filter[2], sc->filter[3],
1654 	    sc->filter[4], sc->filter[5], sc->filter[6], sc->filter[7]);
1655 #endif
1656 
1657 	/*
1658 	 * We have to update the multicast filter in the 86960, A.S.A.P.
1659 	 *
1660 	 * Note that the DLC (Data Linc Control unit, i.e. transmitter
1661 	 * and receiver) must be stopped when feeding the filter, and
1662 	 * DLC trashes all packets in both transmission and receive
1663 	 * buffers when stopped.
1664 	 *
1665 	 * ... Are the above sentenses correct?  I have to check the
1666 	 *     manual of the MB86960A.  FIXME.
1667 	 *
1668 	 * To reduce the packet lossage, we delay the filter update
1669 	 * process until buffers are empty.
1670 	 */
1671 	if (sc->txb_sched == 0 && sc->txb_count == 0 &&
1672 	    (bus_space_read_1(bst, bsh, FE_DLCR1) & FE_D1_PKTRDY) == 0) {
1673 		/*
1674 		 * Buffers are (apparently) empty.  Load
1675 		 * the new filter value into MARs now.
1676 		 */
1677 		mb86960_loadmar(sc);
1678 	} else {
1679 		/*
1680 		 * Buffers are not empty.  Mark that we have to update
1681 		 * the MARs.  The new filter will be loaded by mb86960_intr()
1682 		 * later.
1683 		 */
1684 #if FE_DEBUG >= 4
1685 		log(LOG_INFO, "%s: filter change delayed\n",
1686 		    device_xname(sc->sc_dev));
1687 #endif
1688 	}
1689 }
1690 
1691 /*
1692  * Load a new multicast address filter into MARs.
1693  *
1694  * The caller must have splnet'ed befor mb86960_loadmar.
1695  * This function starts the DLC upon return.  So it can be called only
1696  * when the chip is working, i.e., from the driver's point of view, when
1697  * a device is RUNNING.  (I mistook the point in previous versions.)
1698  */
1699 void
1700 mb86960_loadmar(struct mb86960_softc *sc)
1701 {
1702 	bus_space_tag_t bst = sc->sc_bst;
1703 	bus_space_handle_t bsh = sc->sc_bsh;
1704 
1705 	/* Stop the DLC (transmitter and receiver). */
1706 	bus_space_write_1(bst, bsh, FE_DLCR6,
1707 	    sc->proto_dlcr6 | FE_D6_DLC_DISABLE);
1708 
1709 	/* Select register bank 1 for MARs. */
1710 	bus_space_write_1(bst, bsh, FE_DLCR7,
1711 	    sc->proto_dlcr7 | FE_D7_RBS_MAR | FE_D7_POWER_UP);
1712 
1713 	/* Copy filter value into the registers. */
1714 	bus_space_write_region_1(bst, bsh, FE_MAR8, sc->filter, FE_FILTER_LEN);
1715 
1716 	/* Restore the bank selection for BMPRs (i.e., runtime registers). */
1717 	bus_space_write_1(bst, bsh, FE_DLCR7,
1718 	    sc->proto_dlcr7 | FE_D7_RBS_BMPR | FE_D7_POWER_UP);
1719 
1720 	/* Restart the DLC. */
1721 	bus_space_write_1(bst, bsh, FE_DLCR6,
1722 	    sc->proto_dlcr6 | FE_D6_DLC_ENABLE);
1723 
1724 	/* We have just updated the filter. */
1725 	sc->filter_change = 0;
1726 
1727 #if FE_DEBUG >= 3
1728 	log(LOG_INFO, "%s: address filter changed\n", device_xname(sc->sc_dev));
1729 #endif
1730 }
1731 
1732 /*
1733  * Enable power on the interface.
1734  */
1735 int
1736 mb86960_enable(struct mb86960_softc *sc)
1737 {
1738 
1739 #if FE_DEBUG >= 3
1740 	log(LOG_INFO, "%s: mb86960_enable()\n", device_xname(sc->sc_dev));
1741 #endif
1742 
1743 	if ((sc->sc_stat & FE_STAT_ENABLED) == 0 && sc->sc_enable != NULL) {
1744 		if ((*sc->sc_enable)(sc) != 0) {
1745 			aprint_error_dev(sc->sc_dev, "device enable failed\n");
1746 			return EIO;
1747 		}
1748 	}
1749 
1750 	sc->sc_stat |= FE_STAT_ENABLED;
1751 	return 0;
1752 }
1753 
1754 /*
1755  * Disable power on the interface.
1756  */
1757 void
1758 mb86960_disable(struct mb86960_softc *sc)
1759 {
1760 
1761 #if FE_DEBUG >= 3
1762 	log(LOG_INFO, "%s: mb86960_disable()\n", device_xname(sc->sc_dev));
1763 #endif
1764 
1765 	if ((sc->sc_stat & FE_STAT_ENABLED) != 0 && sc->sc_disable != NULL) {
1766 		(*sc->sc_disable)(sc);
1767 		sc->sc_stat &= ~FE_STAT_ENABLED;
1768 	}
1769 }
1770 
1771 /*
1772  * mbe_activate:
1773  *
1774  *	Handle device activation/deactivation requests.
1775  */
1776 int
1777 mb86960_activate(device_t self, enum devact act)
1778 {
1779 	struct mb86960_softc *sc = device_private(self);
1780 
1781 	switch (act) {
1782 	case DVACT_DEACTIVATE:
1783 		if_deactivate(&sc->sc_ec.ec_if);
1784 		return 0;
1785 	default:
1786 		return EOPNOTSUPP;
1787 	}
1788 }
1789 
1790 /*
1791  * mb86960_detach:
1792  *
1793  *	Detach a MB86960 interface.
1794  */
1795 int
1796 mb86960_detach(struct mb86960_softc *sc)
1797 {
1798 	struct ifnet *ifp = &sc->sc_ec.ec_if;
1799 
1800 	/* Succeed now if there's no work to do. */
1801 	if ((sc->sc_stat & FE_STAT_ATTACHED) == 0)
1802 		return 0;
1803 
1804 	/* Delete all media. */
1805 	ifmedia_delete_instance(&sc->sc_media, IFM_INST_ANY);
1806 
1807 	/* Unhook the entropy source. */
1808 	rnd_detach_source(&sc->rnd_source);
1809 
1810 	ether_ifdetach(ifp);
1811 	if_detach(ifp);
1812 
1813 	mb86960_disable(sc);
1814 	return 0;
1815 }
1816 
1817 /*
1818  * Routines to read all bytes from the config EEPROM (93C06) through MB86965A.
1819  */
1820 void
1821 mb86965_read_eeprom(bus_space_tag_t iot, bus_space_handle_t ioh, uint8_t *data)
1822 {
1823 	int addr, op, bit;
1824 	uint16_t val;
1825 
1826 	/* Read bytes from EEPROM; two bytes per an iteration. */
1827 	for (addr = 0; addr < FE_EEPROM_SIZE / 2; addr++) {
1828 		/* Reset the EEPROM interface. */
1829 		bus_space_write_1(iot, ioh, FE_BMPR16, 0x00);
1830 		bus_space_write_1(iot, ioh, FE_BMPR17, 0x00);
1831 		bus_space_write_1(iot, ioh, FE_BMPR16, FE_B16_SELECT);
1832 
1833 		/* Send start bit. */
1834 		bus_space_write_1(iot, ioh, FE_BMPR17, FE_B17_DATA);
1835 		FE_EEPROM_DELAY();
1836 		bus_space_write_1(iot, ioh,
1837 		    FE_BMPR16, FE_B16_SELECT | FE_B16_CLOCK);
1838 		FE_EEPROM_DELAY();
1839 		bus_space_write_1(iot, ioh, FE_BMPR16, FE_B16_SELECT);
1840 
1841 		/* Send read command and read address. */
1842 		op = 0x80 | addr;	/* READ instruction */
1843 		for (bit = 8; bit > 0; bit--) {
1844 			bus_space_write_1(iot, ioh, FE_BMPR17,
1845 			    (op & (1 << (bit - 1))) ? FE_B17_DATA : 0);
1846 			FE_EEPROM_DELAY();
1847 			bus_space_write_1(iot, ioh,
1848 			    FE_BMPR16, FE_B16_SELECT | FE_B16_CLOCK);
1849 			FE_EEPROM_DELAY();
1850 			bus_space_write_1(iot, ioh, FE_BMPR16, FE_B16_SELECT);
1851 		}
1852 		bus_space_write_1(iot, ioh, FE_BMPR17, 0x00);
1853 
1854 		/* Read two bytes in each address */
1855 		val = 0;
1856 		for (bit = 16; bit > 0; bit--) {
1857 			FE_EEPROM_DELAY();
1858 			bus_space_write_1(iot, ioh,
1859 			    FE_BMPR16, FE_B16_SELECT | FE_B16_CLOCK);
1860 			FE_EEPROM_DELAY();
1861 			if (bus_space_read_1(iot, ioh, FE_BMPR17) &
1862 			    FE_B17_DATA)
1863 				val |= 1 << (bit - 1);
1864 			bus_space_write_1(iot, ioh,
1865 			    FE_BMPR16, FE_B16_SELECT);
1866 		}
1867 		data[addr * 2]     = val >> 8;
1868 		data[addr * 2 + 1] = val & 0xff;
1869 	}
1870 
1871 	/* Make sure the EEPROM is turned off. */
1872 	bus_space_write_1(iot, ioh, FE_BMPR16, 0);
1873 	bus_space_write_1(iot, ioh, FE_BMPR17, 0);
1874 
1875 #if FE_DEBUG >= 3
1876 	/* Report what we got. */
1877 	log(LOG_INFO, "mb86965_read_eeprom: "
1878 	    " %02x%02x%02x%02x %02x%02x%02x%02x -"
1879 	    " %02x%02x%02x%02x %02x%02x%02x%02x -"
1880 	    " %02x%02x%02x%02x %02x%02x%02x%02x -"
1881 	    " %02x%02x%02x%02x %02x%02x%02x%02x\n",
1882 	    data[ 0], data[ 1], data[ 2], data[ 3],
1883 	    data[ 4], data[ 5], data[ 6], data[ 7],
1884 	    data[ 8], data[ 9], data[10], data[11],
1885 	    data[12], data[13], data[14], data[15],
1886 	    data[16], data[17], data[18], data[19],
1887 	    data[20], data[21], data[22], data[23],
1888 	    data[24], data[25], data[26], data[27],
1889 	    data[28], data[29], data[30], data[31]);
1890 #endif
1891 }
1892 
1893 #if FE_DEBUG >= 1
1894 void
1895 mb86960_dump(int level, struct mb86960_softc *sc)
1896 {
1897 	bus_space_tag_t bst = sc->sc_bst;
1898 	bus_space_handle_t bsh = sc->sc_bsh;
1899 	uint8_t save_dlcr7;
1900 
1901 	save_dlcr7 = bus_space_read_1(bst, bsh, FE_DLCR7);
1902 
1903 	log(level, "\tDLCR = %02x %02x %02x %02x %02x %02x %02x %02x\n",
1904 	    bus_space_read_1(bst, bsh, FE_DLCR0),
1905 	    bus_space_read_1(bst, bsh, FE_DLCR1),
1906 	    bus_space_read_1(bst, bsh, FE_DLCR2),
1907 	    bus_space_read_1(bst, bsh, FE_DLCR3),
1908 	    bus_space_read_1(bst, bsh, FE_DLCR4),
1909 	    bus_space_read_1(bst, bsh, FE_DLCR5),
1910 	    bus_space_read_1(bst, bsh, FE_DLCR6),
1911 	    bus_space_read_1(bst, bsh, FE_DLCR7));
1912 
1913 	bus_space_write_1(bst, bsh, FE_DLCR7,
1914 	    (save_dlcr7 & ~FE_D7_RBS) | FE_D7_RBS_DLCR);
1915 	log(level, "\t       %02x %02x %02x %02x %02x %02x %02x %02x\n",
1916 	    bus_space_read_1(bst, bsh, FE_DLCR8),
1917 	    bus_space_read_1(bst, bsh, FE_DLCR9),
1918 	    bus_space_read_1(bst, bsh, FE_DLCR10),
1919 	    bus_space_read_1(bst, bsh, FE_DLCR11),
1920 	    bus_space_read_1(bst, bsh, FE_DLCR12),
1921 	    bus_space_read_1(bst, bsh, FE_DLCR13),
1922 	    bus_space_read_1(bst, bsh, FE_DLCR14),
1923 	    bus_space_read_1(bst, bsh, FE_DLCR15));
1924 
1925 	bus_space_write_1(bst, bsh, FE_DLCR7,
1926 	    (save_dlcr7 & ~FE_D7_RBS) | FE_D7_RBS_MAR);
1927 	log(level, "\tMAR  = %02x %02x %02x %02x %02x %02x %02x %02x\n",
1928 	    bus_space_read_1(bst, bsh, FE_MAR8),
1929 	    bus_space_read_1(bst, bsh, FE_MAR9),
1930 	    bus_space_read_1(bst, bsh, FE_MAR10),
1931 	    bus_space_read_1(bst, bsh, FE_MAR11),
1932 	    bus_space_read_1(bst, bsh, FE_MAR12),
1933 	    bus_space_read_1(bst, bsh, FE_MAR13),
1934 	    bus_space_read_1(bst, bsh, FE_MAR14),
1935 	    bus_space_read_1(bst, bsh, FE_MAR15));
1936 
1937 	bus_space_write_1(bst, bsh, FE_DLCR7,
1938 	    (save_dlcr7 & ~FE_D7_RBS) | FE_D7_RBS_BMPR);
1939 	log(level,
1940 	    "\tBMPR = xx xx %02x %02x %02x %02x %02x %02x %02x %02x xx %02x\n",
1941 	    bus_space_read_1(bst, bsh, FE_BMPR10),
1942 	    bus_space_read_1(bst, bsh, FE_BMPR11),
1943 	    bus_space_read_1(bst, bsh, FE_BMPR12),
1944 	    bus_space_read_1(bst, bsh, FE_BMPR13),
1945 	    bus_space_read_1(bst, bsh, FE_BMPR14),
1946 	    bus_space_read_1(bst, bsh, FE_BMPR15),
1947 	    bus_space_read_1(bst, bsh, FE_BMPR16),
1948 	    bus_space_read_1(bst, bsh, FE_BMPR17),
1949 	    bus_space_read_1(bst, bsh, FE_BMPR19));
1950 
1951 	bus_space_write_1(bst, bsh, FE_DLCR7, save_dlcr7);
1952 }
1953 #endif
1954 
1955