xref: /netbsd-src/sys/dev/ic/mb86960.c (revision c2f76ff004a2cb67efe5b12d97bd3ef7fe89e18d)
1 /*	$NetBSD: mb86960.c,v 1.77 2010/04/05 07:19:35 joerg Exp $	*/
2 
3 /*
4  * All Rights Reserved, Copyright (C) Fujitsu Limited 1995
5  *
6  * This software may be used, modified, copied, distributed, and sold, in
7  * both source and binary form provided that the above copyright, these
8  * terms and the following disclaimer are retained.  The name of the author
9  * and/or the contributor may not be used to endorse or promote products
10  * derived from this software without specific prior written permission.
11  *
12  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND THE CONTRIBUTOR ``AS IS'' AND
13  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
14  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
15  * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR THE CONTRIBUTOR BE LIABLE
16  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
17  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
18  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION.
19  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
20  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
21  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
22  * SUCH DAMAGE.
23  */
24 
25 /*
26  * Portions copyright (C) 1993, David Greenman.  This software may be used,
27  * modified, copied, distributed, and sold, in both source and binary form
28  * provided that the above copyright and these terms are retained.  Under no
29  * circumstances is the author responsible for the proper functioning of this
30  * software, nor does the author assume any responsibility for damages
31  * incurred with its use.
32  */
33 
34 #include <sys/cdefs.h>
35 __KERNEL_RCSID(0, "$NetBSD: mb86960.c,v 1.77 2010/04/05 07:19:35 joerg Exp $");
36 
37 /*
38  * Device driver for Fujitsu MB86960A/MB86965A based Ethernet cards.
39  * Contributed by M.S. <seki@sysrap.cs.fujitsu.co.jp>
40  *
41  * This version is intended to be a generic template for various
42  * MB86960A/MB86965A based Ethernet cards.  It currently supports
43  * Fujitsu FMV-180 series (i.e., FMV-181 and FMV-182) and Allied-
44  * Telesis AT1700 series and RE2000 series.  There are some
45  * unnecessary hooks embedded, which are primarily intended to support
46  * other types of Ethernet cards, but the author is not sure whether
47  * they are useful.
48  */
49 
50 #include "opt_inet.h"
51 #include "rnd.h"
52 
53 #include <sys/param.h>
54 #include <sys/systm.h>
55 #include <sys/errno.h>
56 #include <sys/ioctl.h>
57 #include <sys/mbuf.h>
58 #include <sys/socket.h>
59 #include <sys/syslog.h>
60 #include <sys/device.h>
61 #if NRND > 0
62 #include <sys/rnd.h>
63 #endif
64 
65 #include <net/if.h>
66 #include <net/if_dl.h>
67 #include <net/if_types.h>
68 #include <net/if_media.h>
69 #include <net/if_ether.h>
70 
71 #ifdef INET
72 #include <netinet/in.h>
73 #include <netinet/in_systm.h>
74 #include <netinet/in_var.h>
75 #include <netinet/ip.h>
76 #include <netinet/if_inarp.h>
77 #endif
78 
79 
80 #include <net/bpf.h>
81 #include <net/bpfdesc.h>
82 
83 #include <sys/bus.h>
84 
85 #include <dev/ic/mb86960reg.h>
86 #include <dev/ic/mb86960var.h>
87 
88 #ifndef __BUS_SPACE_HAS_STREAM_METHODS
89 #define bus_space_write_stream_2	bus_space_write_2
90 #define bus_space_write_multi_stream_2	bus_space_write_multi_2
91 #define bus_space_read_multi_stream_2	bus_space_read_multi_2
92 #endif /* __BUS_SPACE_HAS_STREAM_METHODS */
93 
94 /* Standard driver entry points.  These can be static. */
95 void	mb86960_init(struct mb86960_softc *);
96 int	mb86960_ioctl(struct ifnet *, u_long, void *);
97 void	mb86960_start(struct ifnet *);
98 void	mb86960_reset(struct mb86960_softc *);
99 void	mb86960_watchdog(struct ifnet *);
100 
101 /* Local functions.  Order of declaration is confused.  FIXME. */
102 int	mb86960_get_packet(struct mb86960_softc *, u_int);
103 void	mb86960_stop(struct mb86960_softc *);
104 void	mb86960_tint(struct mb86960_softc *, uint8_t);
105 void	mb86960_rint(struct mb86960_softc *, uint8_t);
106 static inline
107 void	mb86960_xmit(struct mb86960_softc *);
108 void	mb86960_write_mbufs(struct mb86960_softc *, struct mbuf *);
109 static inline
110 void	mb86960_droppacket(struct mb86960_softc *);
111 void	mb86960_getmcaf(struct ethercom *, uint8_t *);
112 void	mb86960_setmode(struct mb86960_softc *);
113 void	mb86960_loadmar(struct mb86960_softc *);
114 
115 int	mb86960_mediachange(struct ifnet *);
116 void	mb86960_mediastatus(struct ifnet *, struct ifmediareq *);
117 
118 #if FE_DEBUG >= 1
119 void	mb86960_dump(int, struct mb86960_softc *);
120 #endif
121 
122 void
123 mb86960_attach(struct mb86960_softc *sc, uint8_t *myea)
124 {
125 	bus_space_tag_t bst = sc->sc_bst;
126 	bus_space_handle_t bsh = sc->sc_bsh;
127 
128 	/* Register values which depend on board design. */
129 	sc->proto_dlcr4 = FE_D4_LBC_DISABLE | FE_D4_CNTRL;
130 	sc->proto_dlcr5 = 0;
131 	sc->proto_dlcr7 = FE_D7_BYTSWP_LH;
132 	if ((sc->sc_flags & FE_FLAGS_MB86960) != 0)
133 		sc->proto_dlcr7 |= FE_D7_ED_TEST; /* XXX */
134 	sc->proto_bmpr13 = FE_B13_TPTYPE_UTP | FE_B13_PORT_AUTO;
135 
136 	/*
137 	 * Program the 86960 as following defaults:
138 	 *	SRAM: 32KB, 100ns, byte-wide access.
139 	 *	Transmission buffer: 4KB x 2.
140 	 *	System bus interface: 16 bits.
141 	 * These values except TXBSIZE should be modified as per
142 	 * sc_flags which is set in MD attachments, because they
143 	 * are hard-wired on the board. Modifying TXBSIZE will affect
144 	 * the driver performance.
145 	 */
146 	sc->proto_dlcr6 = FE_D6_BUFSIZ_32KB | FE_D6_TXBSIZ_2x4KB |
147 	    FE_D6_BBW_BYTE | FE_D6_SRAM_100ns;
148 	if (sc->sc_flags & FE_FLAGS_SBW_BYTE)
149 		sc->proto_dlcr6 |= FE_D6_SBW_BYTE;
150 	if (sc->sc_flags & FE_FLAGS_SRAM_150ns)
151 		sc->proto_dlcr6 &= ~FE_D6_SRAM_100ns;
152 
153 	/*
154 	 * Minimum initialization of the hardware.
155 	 * We write into registers; hope I/O ports have no
156 	 * overlap with other boards.
157 	 */
158 
159 	/* Initialize 86960. */
160 	bus_space_write_1(bst, bsh, FE_DLCR6,
161 	    sc->proto_dlcr6 | FE_D6_DLC_DISABLE);
162 	delay(200);
163 
164 #ifdef DIAGNOSTIC
165 	if (myea == NULL) {
166 		aprint_error_dev(sc->sc_dev,
167 		    "ethernet address shouldn't be NULL\n");
168 		panic("NULL ethernet address");
169 	}
170 #endif
171 	memcpy(sc->sc_enaddr, myea, sizeof(sc->sc_enaddr));
172 
173 	/* Disable all interrupts. */
174 	bus_space_write_1(bst, bsh, FE_DLCR2, 0);
175 	bus_space_write_1(bst, bsh, FE_DLCR3, 0);
176 }
177 
178 /*
179  * Install interface into kernel networking data structures
180  */
181 void
182 mb86960_config(struct mb86960_softc *sc, int *media, int nmedia, int defmedia)
183 {
184 	cfdata_t cf = device_cfdata(sc->sc_dev);
185 	struct ifnet *ifp = &sc->sc_ec.ec_if;
186 	int i;
187 
188 	/* Stop the 86960. */
189 	mb86960_stop(sc);
190 
191 	/* Initialize ifnet structure. */
192 	strlcpy(ifp->if_xname, device_xname(sc->sc_dev), IFNAMSIZ);
193 	ifp->if_softc = sc;
194 	ifp->if_start = mb86960_start;
195 	ifp->if_ioctl = mb86960_ioctl;
196 	ifp->if_watchdog = mb86960_watchdog;
197 	ifp->if_flags =
198 	    IFF_BROADCAST | IFF_SIMPLEX | IFF_NOTRAILERS | IFF_MULTICAST;
199 	IFQ_SET_READY(&ifp->if_snd);
200 
201 #if FE_DEBUG >= 3
202 	log(LOG_INFO, "%s: mb86960_config()\n", device_xname(sc->sc_dev));
203 	mb86960_dump(LOG_INFO, sc);
204 #endif
205 
206 #if FE_SINGLE_TRANSMISSION
207 	/* Override txb config to allocate minimum. */
208 	sc->proto_dlcr6 &= ~FE_D6_TXBSIZ;
209 	sc->proto_dlcr6 |=  FE_D6_TXBSIZ_2x2KB;
210 #endif
211 
212 	/* Modify hardware config if it is requested. */
213 	if ((cf->cf_flags & FE_FLAGS_OVERRIDE_DLCR6) != 0)
214 		sc->proto_dlcr6 = cf->cf_flags & FE_FLAGS_DLCR6_VALUE;
215 
216 	/* Find TX buffer size, based on the hardware dependent proto. */
217 	switch (sc->proto_dlcr6 & FE_D6_TXBSIZ) {
218 	case FE_D6_TXBSIZ_2x2KB:
219 		sc->txb_size = 2048;
220 		break;
221 	case FE_D6_TXBSIZ_2x4KB:
222 		sc->txb_size = 4096;
223 		break;
224 	case FE_D6_TXBSIZ_2x8KB:
225 		sc->txb_size = 8192;
226 		break;
227 	default:
228 		/* Oops, we can't work with single buffer configuration. */
229 #if FE_DEBUG >= 2
230 		log(LOG_WARNING, "%s: strange TXBSIZ config; fixing\n",
231 		    device_xname(sc->sc_dev));
232 #endif
233 		sc->proto_dlcr6 &= ~FE_D6_TXBSIZ;
234 		sc->proto_dlcr6 |=  FE_D6_TXBSIZ_2x2KB;
235 		sc->txb_size = 2048;
236 		break;
237 	}
238 
239 	/* Initialize media goo. */
240 	ifmedia_init(&sc->sc_media, 0, mb86960_mediachange,
241 	    mb86960_mediastatus);
242 	if (media != NULL) {
243 		for (i = 0; i < nmedia; i++)
244 			ifmedia_add(&sc->sc_media, media[i], 0, NULL);
245 		ifmedia_set(&sc->sc_media, defmedia);
246 	} else {
247 		ifmedia_add(&sc->sc_media, IFM_ETHER|IFM_MANUAL, 0, NULL);
248 		ifmedia_set(&sc->sc_media, IFM_ETHER|IFM_MANUAL);
249 	}
250 
251 	/* Attach the interface. */
252 	if_attach(ifp);
253 	ether_ifattach(ifp, sc->sc_enaddr);
254 
255 #if NRND > 0
256 	rnd_attach_source(&sc->rnd_source, device_xname(sc->sc_dev),
257 	    RND_TYPE_NET, 0);
258 #endif
259 	/* Print additional info when attached. */
260 	aprint_normal_dev(sc->sc_dev, "Ethernet address %s\n",
261 	    ether_sprintf(sc->sc_enaddr));
262 
263 #if FE_DEBUG >= 3
264 	{
265 		int buf, txb, bbw, sbw, ram;
266 
267 		buf = txb = bbw = sbw = ram = -1;
268 		switch (sc->proto_dlcr6 & FE_D6_BUFSIZ) {
269 		case FE_D6_BUFSIZ_8KB:
270 			buf = 8;
271 			break;
272 		case FE_D6_BUFSIZ_16KB:
273 			buf = 16;
274 			break;
275 		case FE_D6_BUFSIZ_32KB:
276 			buf = 32;
277 			break;
278 		case FE_D6_BUFSIZ_64KB:
279 			buf = 64;
280 			break;
281 		}
282 		switch (sc->proto_dlcr6 & FE_D6_TXBSIZ) {
283 		case FE_D6_TXBSIZ_2x2KB:
284 			txb = 2;
285 			break;
286 		case FE_D6_TXBSIZ_2x4KB:
287 			txb = 4;
288 			break;
289 		case FE_D6_TXBSIZ_2x8KB:
290 			txb = 8;
291 			break;
292 		}
293 		switch (sc->proto_dlcr6 & FE_D6_BBW) {
294 		case FE_D6_BBW_BYTE:
295 			bbw = 8;
296 			break;
297 		case FE_D6_BBW_WORD:
298 			bbw = 16;
299 			break;
300 		}
301 		switch (sc->proto_dlcr6 & FE_D6_SBW) {
302 		case FE_D6_SBW_BYTE:
303 			sbw = 8;
304 			break;
305 		case FE_D6_SBW_WORD:
306 			sbw = 16;
307 			break;
308 		}
309 		switch (sc->proto_dlcr6 & FE_D6_SRAM) {
310 		case FE_D6_SRAM_100ns:
311 			ram = 100;
312 			break;
313 		case FE_D6_SRAM_150ns:
314 			ram = 150;
315 			break;
316 		}
317 		aprint_debug_dev(sc->sc_dev,
318 		    "SRAM %dKB %dbit %dns, TXB %dKBx2, %dbit I/O\n",
319 		    buf, bbw, ram, txb, sbw);
320 	}
321 #endif
322 
323 	/* The attach is successful. */
324 	sc->sc_stat |= FE_STAT_ATTACHED;
325 }
326 
327 /*
328  * Media change callback.
329  */
330 int
331 mb86960_mediachange(struct ifnet *ifp)
332 {
333 	struct mb86960_softc *sc = ifp->if_softc;
334 
335 	if (sc->sc_mediachange)
336 		return (*sc->sc_mediachange)(sc);
337 	return 0;
338 }
339 
340 /*
341  * Media status callback.
342  */
343 void
344 mb86960_mediastatus(struct ifnet *ifp, struct ifmediareq *ifmr)
345 {
346 	struct mb86960_softc *sc = ifp->if_softc;
347 
348 	if ((sc->sc_stat & FE_STAT_ENABLED) == 0) {
349 		ifmr->ifm_active = IFM_ETHER | IFM_NONE;
350 		ifmr->ifm_status = 0;
351 		return;
352 	}
353 
354 	if (sc->sc_mediastatus)
355 		(*sc->sc_mediastatus)(sc, ifmr);
356 }
357 
358 /*
359  * Reset interface.
360  */
361 void
362 mb86960_reset(struct mb86960_softc *sc)
363 {
364 	int s;
365 
366 	s = splnet();
367 	mb86960_stop(sc);
368 	mb86960_init(sc);
369 	splx(s);
370 }
371 
372 /*
373  * Stop everything on the interface.
374  *
375  * All buffered packets, both transmitting and receiving,
376  * if any, will be lost by stopping the interface.
377  */
378 void
379 mb86960_stop(struct mb86960_softc *sc)
380 {
381 	bus_space_tag_t bst = sc->sc_bst;
382 	bus_space_handle_t bsh = sc->sc_bsh;
383 
384 #if FE_DEBUG >= 3
385 	log(LOG_INFO, "%s: top of mb86960_stop()\n", device_xname(sc->sc_dev));
386 	mb86960_dump(LOG_INFO, sc);
387 #endif
388 
389 	/* Disable interrupts. */
390 	bus_space_write_1(bst, bsh, FE_DLCR2, 0x00);
391 	bus_space_write_1(bst, bsh, FE_DLCR3, 0x00);
392 
393 	/* Stop interface hardware. */
394 	delay(200);
395 	bus_space_write_1(bst, bsh, FE_DLCR6,
396 	    sc->proto_dlcr6 | FE_D6_DLC_DISABLE);
397 	delay(200);
398 
399 	/* Clear all interrupt status. */
400 	bus_space_write_1(bst, bsh, FE_DLCR0, 0xFF);
401 	bus_space_write_1(bst, bsh, FE_DLCR1, 0xFF);
402 
403 	/* Put the chip in stand-by mode. */
404 	delay(200);
405 	bus_space_write_1(bst, bsh, FE_DLCR7,
406 	    sc->proto_dlcr7 | FE_D7_POWER_DOWN);
407 	delay(200);
408 
409 	/* MAR loading can be delayed. */
410 	sc->filter_change = 0;
411 
412 	/* Call a hook. */
413 	if (sc->stop_card)
414 		(*sc->stop_card)(sc);
415 
416 #if FE_DEBUG >= 3
417 	log(LOG_INFO, "%s: end of mb86960_stop()\n", device_xname(sc->sc_dev));
418 	mb86960_dump(LOG_INFO, sc);
419 #endif
420 }
421 
422 /*
423  * Device timeout/watchdog routine. Entered if the device neglects to
424  * generate an interrupt after a transmit has been started on it.
425  */
426 void
427 mb86960_watchdog(struct ifnet *ifp)
428 {
429 	struct mb86960_softc *sc = ifp->if_softc;
430 
431 	log(LOG_ERR, "%s: device timeout\n", device_xname(sc->sc_dev));
432 #if FE_DEBUG >= 3
433 	mb86960_dump(LOG_INFO, sc);
434 #endif
435 
436 	/* Record how many packets are lost by this accident. */
437 	sc->sc_ec.ec_if.if_oerrors += sc->txb_sched + sc->txb_count;
438 
439 	mb86960_reset(sc);
440 }
441 
442 /*
443  * Drop (skip) a packet from receive buffer in 86960 memory.
444  */
445 static inline void
446 mb86960_droppacket(struct mb86960_softc *sc)
447 {
448 	bus_space_tag_t bst = sc->sc_bst;
449 	bus_space_handle_t bsh = sc->sc_bsh;
450 
451 	bus_space_write_1(bst, bsh, FE_BMPR14, FE_B14_FILTER | FE_B14_SKIP);
452 }
453 
454 /*
455  * Initialize device.
456  */
457 void
458 mb86960_init(struct mb86960_softc *sc)
459 {
460 	bus_space_tag_t bst = sc->sc_bst;
461 	bus_space_handle_t bsh = sc->sc_bsh;
462 	struct ifnet *ifp = &sc->sc_ec.ec_if;
463 	int i;
464 
465 #if FE_DEBUG >= 3
466 	log(LOG_INFO, "%s: top of mb86960_init()\n", device_xname(sc->sc_dev));
467 	mb86960_dump(LOG_INFO, sc);
468 #endif
469 
470 	/* Reset transmitter flags. */
471 	ifp->if_flags &= ~IFF_OACTIVE;
472 	ifp->if_timer = 0;
473 
474 	sc->txb_free = sc->txb_size;
475 	sc->txb_count = 0;
476 	sc->txb_sched = 0;
477 
478 	/* Do any card-specific initialization, if applicable. */
479 	if (sc->init_card)
480 		(*sc->init_card)(sc);
481 
482 #if FE_DEBUG >= 3
483 	log(LOG_INFO, "%s: after init hook\n", device_xname(sc->sc_dev));
484 	mb86960_dump(LOG_INFO, sc);
485 #endif
486 
487 	/*
488 	 * Make sure to disable the chip, also.
489 	 * This may also help re-programming the chip after
490 	 * hot insertion of PCMCIAs.
491 	 */
492 	bus_space_write_1(bst, bsh, FE_DLCR6,
493 	    sc->proto_dlcr6 | FE_D6_DLC_DISABLE);
494 	delay(200);
495 
496 	/* Power up the chip and select register bank for DLCRs. */
497 	bus_space_write_1(bst, bsh, FE_DLCR7,
498 	    sc->proto_dlcr7 | FE_D7_RBS_DLCR | FE_D7_POWER_UP);
499 	delay(200);
500 
501 	/* Feed the station address. */
502 	bus_space_write_region_1(bst, bsh, FE_DLCR8,
503 	    sc->sc_enaddr, ETHER_ADDR_LEN);
504 
505 	/* Select the BMPR bank for runtime register access. */
506 	bus_space_write_1(bst, bsh, FE_DLCR7,
507 	    sc->proto_dlcr7 | FE_D7_RBS_BMPR | FE_D7_POWER_UP);
508 
509 	/* Initialize registers. */
510 	bus_space_write_1(bst, bsh, FE_DLCR0, 0xFF);	/* Clear all bits. */
511 	bus_space_write_1(bst, bsh, FE_DLCR1, 0xFF);	/* ditto. */
512 	bus_space_write_1(bst, bsh, FE_DLCR2, 0x00);
513 	bus_space_write_1(bst, bsh, FE_DLCR3, 0x00);
514 	bus_space_write_1(bst, bsh, FE_DLCR4, sc->proto_dlcr4);
515 	bus_space_write_1(bst, bsh, FE_DLCR5, sc->proto_dlcr5);
516 	bus_space_write_1(bst, bsh, FE_BMPR10, 0x00);
517 	bus_space_write_1(bst, bsh, FE_BMPR11, FE_B11_CTRL_SKIP);
518 	bus_space_write_1(bst, bsh, FE_BMPR12, 0x00);
519 	bus_space_write_1(bst, bsh, FE_BMPR13, sc->proto_bmpr13);
520 	bus_space_write_1(bst, bsh, FE_BMPR14, FE_B14_FILTER);
521 	bus_space_write_1(bst, bsh, FE_BMPR15, 0x00);
522 
523 #if FE_DEBUG >= 3
524 	log(LOG_INFO, "%s: just before enabling DLC\n",
525 	    device_xname(sc->sc_dev));
526 	mb86960_dump(LOG_INFO, sc);
527 #endif
528 
529 	/* Enable interrupts. */
530 	bus_space_write_1(bst, bsh, FE_DLCR2, FE_TMASK);
531 	bus_space_write_1(bst, bsh, FE_DLCR3, FE_RMASK);
532 
533 	/* Enable transmitter and receiver. */
534 	delay(200);
535 	bus_space_write_1(bst, bsh, FE_DLCR6,
536 	    sc->proto_dlcr6 | FE_D6_DLC_ENABLE);
537 	delay(200);
538 
539 #if FE_DEBUG >= 3
540 	log(LOG_INFO, "%s: just after enabling DLC\n",
541 	    device_xname(sc->sc_dev));
542 	mb86960_dump(LOG_INFO, sc);
543 #endif
544 
545 	/*
546 	 * Make sure to empty the receive buffer.
547 	 *
548 	 * This may be redundant, but *if* the receive buffer were full
549 	 * at this point, the driver would hang.  I have experienced
550 	 * some strange hangups just after UP.  I hope the following
551 	 * code solve the problem.
552 	 *
553 	 * I have changed the order of hardware initialization.
554 	 * I think the receive buffer cannot have any packets at this
555 	 * point in this version.  The following code *must* be
556 	 * redundant now.  FIXME.
557 	 */
558 	for (i = 0; i < FE_MAX_RECV_COUNT; i++) {
559 		if (bus_space_read_1(bst, bsh, FE_DLCR5) & FE_D5_BUFEMP)
560 			break;
561 		mb86960_droppacket(sc);
562 	}
563 #if FE_DEBUG >= 1
564 	if (i >= FE_MAX_RECV_COUNT)
565 		log(LOG_ERR, "%s: cannot empty receive buffer\n",
566 		    device_xname(sc->sc_dev));
567 #endif
568 #if FE_DEBUG >= 3
569 	if (i < FE_MAX_RECV_COUNT)
570 		log(LOG_INFO, "%s: receive buffer emptied (%d)\n",
571 		    device_xname(sc->sc_dev), i);
572 #endif
573 
574 #if FE_DEBUG >= 3
575 	log(LOG_INFO, "%s: after ERB loop\n", device_xname(sc->sc_dev));
576 	mb86960_dump(LOG_INFO, sc);
577 #endif
578 
579 	/* Do we need this here? */
580 	bus_space_write_1(bst, bsh, FE_DLCR0, 0xFF);	/* Clear all bits. */
581 	bus_space_write_1(bst, bsh, FE_DLCR1, 0xFF);	/* ditto. */
582 
583 #if FE_DEBUG >= 3
584 	log(LOG_INFO, "%s: after FIXME\n", device_xname(sc->sc_dev));
585 	mb86960_dump(LOG_INFO, sc);
586 #endif
587 
588 	/* Set 'running' flag. */
589 	ifp->if_flags |= IFF_RUNNING;
590 
591 	/*
592 	 * At this point, the interface is runnung properly,
593 	 * except that it receives *no* packets.  we then call
594 	 * mb86960_setmode() to tell the chip what packets to be
595 	 * received, based on the if_flags and multicast group
596 	 * list.  It completes the initialization process.
597 	 */
598 	mb86960_setmode(sc);
599 
600 #if FE_DEBUG >= 3
601 	log(LOG_INFO, "%s: after setmode\n", device_xname(sc->sc_dev));
602 	mb86960_dump(LOG_INFO, sc);
603 #endif
604 
605 	/* ...and attempt to start output. */
606 	mb86960_start(ifp);
607 
608 #if FE_DEBUG >= 3
609 	log(LOG_INFO, "%s: end of mb86960_init()\n", device_xname(sc->sc_dev));
610 	mb86960_dump(LOG_INFO, sc);
611 #endif
612 }
613 
614 /*
615  * This routine actually starts the transmission on the interface
616  */
617 static inline void
618 mb86960_xmit(struct mb86960_softc *sc)
619 {
620 	bus_space_tag_t bst = sc->sc_bst;
621 	bus_space_handle_t bsh = sc->sc_bsh;
622 
623 	/*
624 	 * Set a timer just in case we never hear from the board again.
625 	 * We use longer timeout for multiple packet transmission.
626 	 * I'm not sure this timer value is appropriate.  FIXME.
627 	 */
628 	sc->sc_ec.ec_if.if_timer = 1 + sc->txb_count;
629 
630 	/* Update txb variables. */
631 	sc->txb_sched = sc->txb_count;
632 	sc->txb_count = 0;
633 	sc->txb_free = sc->txb_size;
634 
635 #if FE_DELAYED_PADDING
636 	/* Omit the postponed padding process. */
637 	sc->txb_padding = 0;
638 #endif
639 
640 	/* Start transmitter, passing packets in TX buffer. */
641 	bus_space_write_1(bst, bsh, FE_BMPR10, sc->txb_sched | FE_B10_START);
642 }
643 
644 /*
645  * Start output on interface.
646  * We make two assumptions here:
647  *  1) that the current priority is set to splnet _before_ this code
648  *     is called *and* is returned to the appropriate priority after
649  *     return
650  *  2) that the IFF_OACTIVE flag is checked before this code is called
651  *     (i.e. that the output part of the interface is idle)
652  */
653 void
654 mb86960_start(struct ifnet *ifp)
655 {
656 	struct mb86960_softc *sc = ifp->if_softc;
657 	struct mbuf *m;
658 
659 #if FE_DEBUG >= 1
660 	/* Just a sanity check. */
661 	if ((sc->txb_count == 0) != (sc->txb_free == sc->txb_size)) {
662 		/*
663 		 * Txb_count and txb_free co-works to manage the
664 		 * transmission buffer.  Txb_count keeps track of the
665 		 * used potion of the buffer, while txb_free does unused
666 		 * potion.  So, as long as the driver runs properly,
667 		 * txb_count is zero if and only if txb_free is same
668 		 * as txb_size (which represents whole buffer.)
669 		 */
670 		log(LOG_ERR, "%s: inconsistent txb variables (%d, %d)\n",
671 		    device_xname(sc->sc_dev), sc->txb_count, sc->txb_free);
672 		/*
673 		 * So, what should I do, then?
674 		 *
675 		 * We now know txb_count and txb_free contradicts.  We
676 		 * cannot, however, tell which is wrong.  More
677 		 * over, we cannot peek 86960 transmission buffer or
678 		 * reset the transmission buffer.  (In fact, we can
679 		 * reset the entire interface.  I don't want to do it.)
680 		 *
681 		 * If txb_count is incorrect, leaving it as is will cause
682 		 * sending of gabages after next interrupt.  We have to
683 		 * avoid it.  Hence, we reset the txb_count here.  If
684 		 * txb_free was incorrect, resetting txb_count just loose
685 		 * some packets.  We can live with it.
686 		 */
687 		sc->txb_count = 0;
688 	}
689 #endif
690 
691 #if FE_DEBUG >= 1
692 	/*
693 	 * First, see if there are buffered packets and an idle
694 	 * transmitter - should never happen at this point.
695 	 */
696 	if ((sc->txb_count > 0) && (sc->txb_sched == 0)) {
697 		log(LOG_ERR, "%s: transmitter idle with %d buffered packets\n",
698 		    device_xname(sc->sc_dev), sc->txb_count);
699 		mb86960_xmit(sc);
700 	}
701 #endif
702 
703 	/*
704 	 * Stop accepting more transmission packets temporarily, when
705 	 * a filter change request is delayed.  Updating the MARs on
706 	 * 86960 flushes the transmisstion buffer, so it is delayed
707 	 * until all buffered transmission packets have been sent
708 	 * out.
709 	 */
710 	if (sc->filter_change) {
711 		/*
712 		 * Filter change request is delayed only when the DLC is
713 		 * working.  DLC soon raise an interrupt after finishing
714 		 * the work.
715 		 */
716 		goto indicate_active;
717 	}
718 
719 	for (;;) {
720 		/*
721 		 * See if there is room to put another packet in the buffer.
722 		 * We *could* do better job by peeking the send queue to
723 		 * know the length of the next packet.  Current version just
724 		 * tests against the worst case (i.e., longest packet).  FIXME.
725 		 *
726 		 * When adding the packet-peek feature, don't forget adding a
727 		 * test on txb_count against QUEUEING_MAX.
728 		 * There is a little chance the packet count exceeds
729 		 * the limit.  Assume transmission buffer is 8KB (2x8KB
730 		 * configuration) and an application sends a bunch of small
731 		 * (i.e., minimum packet sized) packets rapidly.  An 8KB
732 		 * buffer can hold 130 blocks of 62 bytes long...
733 		 */
734 		if (sc->txb_free <
735 		    (ETHER_MAX_LEN - ETHER_CRC_LEN) + FE_TXLEN_SIZE) {
736 			/* No room. */
737 			goto indicate_active;
738 		}
739 
740 #if FE_SINGLE_TRANSMISSION
741 		if (sc->txb_count > 0) {
742 			/* Just one packet per a transmission buffer. */
743 			goto indicate_active;
744 		}
745 #endif
746 
747 		/*
748 		 * Get the next mbuf chain for a packet to send.
749 		 */
750 		IFQ_DEQUEUE(&ifp->if_snd, m);
751 		if (m == 0) {
752 			/* No more packets to send. */
753 			goto indicate_inactive;
754 		}
755 
756 		/* Tap off here if there is a BPF listener. */
757 		bpf_mtap(ifp, m);
758 
759 		/*
760 		 * Copy the mbuf chain into the transmission buffer.
761 		 * txb_* variables are updated as necessary.
762 		 */
763 		mb86960_write_mbufs(sc, m);
764 
765 		m_freem(m);
766 
767 		/* Start transmitter if it's idle. */
768 		if (sc->txb_sched == 0)
769 			mb86960_xmit(sc);
770 	}
771 
772 indicate_inactive:
773 	/*
774 	 * We are using the !OACTIVE flag to indicate to
775 	 * the outside world that we can accept an
776 	 * additional packet rather than that the
777 	 * transmitter is _actually_ active.  Indeed, the
778 	 * transmitter may be active, but if we haven't
779 	 * filled all the buffers with data then we still
780 	 * want to accept more.
781 	 */
782 	ifp->if_flags &= ~IFF_OACTIVE;
783 	return;
784 
785 indicate_active:
786 	/*
787 	 * The transmitter is active, and there are no room for
788 	 * more outgoing packets in the transmission buffer.
789 	 */
790 	ifp->if_flags |= IFF_OACTIVE;
791 	return;
792 }
793 
794 /*
795  * Transmission interrupt handler
796  * The control flow of this function looks silly.  FIXME.
797  */
798 void
799 mb86960_tint(struct mb86960_softc *sc, uint8_t tstat)
800 {
801 	bus_space_tag_t bst = sc->sc_bst;
802 	bus_space_handle_t bsh = sc->sc_bsh;
803 	struct ifnet *ifp = &sc->sc_ec.ec_if;
804 	int left;
805 	int col;
806 
807 	/*
808 	 * Handle "excessive collision" interrupt.
809 	 */
810 	if (tstat & FE_D0_COLL16) {
811 		/*
812 		 * Find how many packets (including this collided one)
813 		 * are left unsent in transmission buffer.
814 		 */
815 		left = bus_space_read_1(bst, bsh, FE_BMPR10);
816 
817 #if FE_DEBUG >= 2
818 		log(LOG_WARNING, "%s: excessive collision (%d/%d)\n",
819 		    device_xname(sc->sc_dev), left, sc->txb_sched);
820 #endif
821 #if FE_DEBUG >= 3
822 		mb86960_dump(LOG_INFO, sc);
823 #endif
824 
825 		/*
826 		 * Update statistics.
827 		 */
828 		ifp->if_collisions += 16;
829 		ifp->if_oerrors++;
830 		ifp->if_opackets += sc->txb_sched - left;
831 
832 		/*
833 		 * Collision statistics has been updated.
834 		 * Clear the collision flag on 86960 now to avoid confusion.
835 		 */
836 		bus_space_write_1(bst, bsh, FE_DLCR0, FE_D0_COLLID);
837 
838 		/*
839 		 * Restart transmitter, skipping the
840 		 * collided packet.
841 		 *
842 		 * We *must* skip the packet to keep network running
843 		 * properly.  Excessive collision error is an
844 		 * indication of the network overload.  If we
845 		 * tried sending the same packet after excessive
846 		 * collision, the network would be filled with
847 		 * out-of-time packets.  Packets belonging
848 		 * to reliable transport (such as TCP) are resent
849 		 * by some upper layer.
850 		 */
851 		bus_space_write_1(bst, bsh, FE_BMPR11,
852 		    FE_B11_CTRL_SKIP | FE_B11_MODE1);
853 		sc->txb_sched = left - 1;
854 	}
855 
856 	/*
857 	 * Handle "transmission complete" interrupt.
858 	 */
859 	if (tstat & FE_D0_TXDONE) {
860 		/*
861 		 * Add in total number of collisions on last
862 		 * transmission.  We also clear "collision occurred" flag
863 		 * here.
864 		 *
865 		 * 86960 has a design flow on collision count on multiple
866 		 * packet transmission.  When we send two or more packets
867 		 * with one start command (that's what we do when the
868 		 * transmission queue is clauded), 86960 informs us number
869 		 * of collisions occurred on the last packet on the
870 		 * transmission only.  Number of collisions on previous
871 		 * packets are lost.  I have told that the fact is clearly
872 		 * stated in the Fujitsu document.
873 		 *
874 		 * I considered not to mind it seriously.  Collision
875 		 * count is not so important, anyway.  Any comments?  FIXME.
876 		 */
877 
878 		if (bus_space_read_1(bst, bsh, FE_DLCR0) & FE_D0_COLLID) {
879 			/* Clear collision flag. */
880 			bus_space_write_1(bst, bsh, FE_DLCR0, FE_D0_COLLID);
881 
882 			/* Extract collision count from 86960. */
883 			col = bus_space_read_1(bst, bsh, FE_DLCR4) & FE_D4_COL;
884 			if (col == 0) {
885 				/*
886 				 * Status register indicates collisions,
887 				 * while the collision count is zero.
888 				 * This can happen after multiple packet
889 				 * transmission, indicating that one or more
890 				 * previous packet(s) had been collided.
891 				 *
892 				 * Since the accurate number of collisions
893 				 * has been lost, we just guess it as 1;
894 				 * Am I too optimistic?  FIXME.
895 				 */
896 				col = 1;
897 			} else
898 				col >>= FE_D4_COL_SHIFT;
899 			ifp->if_collisions += col;
900 #if FE_DEBUG >= 4
901 			log(LOG_WARNING, "%s: %d collision%s (%d)\n",
902 			    device_xname(sc->sc_dev), col, col == 1 ? "" : "s",
903 			    sc->txb_sched);
904 #endif
905 		}
906 
907 		/*
908 		 * Update total number of successfully
909 		 * transmitted packets.
910 		 */
911 		ifp->if_opackets += sc->txb_sched;
912 		sc->txb_sched = 0;
913 	}
914 
915 	if (sc->txb_sched == 0) {
916 		/*
917 		 * The transmitter is no more active.
918 		 * Reset output active flag and watchdog timer.
919 		 */
920 		ifp->if_flags &= ~IFF_OACTIVE;
921 		ifp->if_timer = 0;
922 
923 		/*
924 		 * If more data is ready to transmit in the buffer, start
925 		 * transmitting them.  Otherwise keep transmitter idle,
926 		 * even if more data is queued.  This gives receive
927 		 * process a slight priority.
928 		 */
929 		if (sc->txb_count > 0)
930 			mb86960_xmit(sc);
931 	}
932 }
933 
934 /*
935  * Ethernet interface receiver interrupt.
936  */
937 void
938 mb86960_rint(struct mb86960_softc *sc, uint8_t rstat)
939 {
940 	bus_space_tag_t bst = sc->sc_bst;
941 	bus_space_handle_t bsh = sc->sc_bsh;
942 	struct ifnet *ifp = &sc->sc_ec.ec_if;
943 	u_int status, len;
944 	int i;
945 
946 	/*
947 	 * Update statistics if this interrupt is caused by an error.
948 	 */
949 	if (rstat & (FE_D1_OVRFLO | FE_D1_CRCERR | FE_D1_ALGERR |
950 	    FE_D1_SRTPKT)) {
951 #if FE_DEBUG >= 3
952 		char sbuf[sizeof(FE_D1_ERRBITS) + 64];
953 
954 		snprintb(sbuf, sizeof(sbuf), FE_D1_ERRBITS, rstat);
955 		log(LOG_WARNING, "%s: receive error: %s\n",
956 		    device_xname(sc->sc_dev), sbuf);
957 #endif
958 		ifp->if_ierrors++;
959 	}
960 
961 	/*
962 	 * MB86960 has a flag indicating "receive queue empty."
963 	 * We just loop checking the flag to pull out all received
964 	 * packets.
965 	 *
966 	 * We limit the number of iterrations to avoid infinite loop.
967 	 * It can be caused by a very slow CPU (some broken
968 	 * peripheral may insert incredible number of wait cycles)
969 	 * or, worse, by a broken MB86960 chip.
970 	 */
971 	for (i = 0; i < FE_MAX_RECV_COUNT; i++) {
972 		/* Stop the iterration if 86960 indicates no packets. */
973 		if (bus_space_read_1(bst, bsh, FE_DLCR5) & FE_D5_BUFEMP)
974 			break;
975 
976 		/*
977 		 * Extract receive packet status from the receive
978 		 * packet header.
979 		 */
980 		if (sc->sc_flags & FE_FLAGS_SBW_BYTE) {
981 			status = bus_space_read_1(bst, bsh, FE_BMPR8);
982 			(void)bus_space_read_1(bst, bsh, FE_BMPR8);
983 		} else
984 			status = bus_space_read_2(bst, bsh, FE_BMPR8);
985 
986 #if FE_DEBUG >= 4
987 		log(LOG_INFO, "%s: receive status = %02x\n",
988 		    device_xname(sc->sc_dev), status);
989 #endif
990 
991 		/*
992 		 * If there was an error, update statistics and drop
993 		 * the packet, unless the interface is in promiscuous
994 		 * mode.
995 		 */
996 		if ((status & FE_RXSTAT_GOODPKT) == 0) {
997 			if ((ifp->if_flags & IFF_PROMISC) == 0) {
998 				ifp->if_ierrors++;
999 				mb86960_droppacket(sc);
1000 				continue;
1001 			}
1002 		}
1003 
1004 		/*
1005 		 * Extract the packet length from the receive packet header.
1006 		 * It is a sum of a header (14 bytes) and a payload.
1007 		 * CRC has been stripped off by the 86960.
1008 		 */
1009 		if (sc->sc_flags & FE_FLAGS_SBW_BYTE) {
1010 			len  = bus_space_read_1(bst, bsh, FE_BMPR8);
1011 			len |= bus_space_read_1(bst, bsh, FE_BMPR8) << 8;
1012 		} else
1013 			len = bus_space_read_2(bst, bsh, FE_BMPR8);
1014 
1015 		/*
1016 		 * MB86965 checks the packet length and drop big packet
1017 		 * before passing it to us.  There are no chance we can
1018 		 * get [crufty] packets.  Hence, if the length exceeds
1019 		 * the specified limit, it means some serious failure,
1020 		 * such as out-of-sync on receive buffer management.
1021 		 *
1022 		 * Is this statement true?  FIXME.
1023 		 */
1024 		if (len > (ETHER_MAX_LEN - ETHER_CRC_LEN) ||
1025 		    len < ETHER_HDR_LEN) {
1026 #if FE_DEBUG >= 2
1027 			log(LOG_WARNING,
1028 			    "%s: received a %s packet? (%u bytes)\n",
1029 			    device_xname(sc->sc_dev),
1030 			    len < ETHER_HDR_LEN ? "partial" : "big", len);
1031 #endif
1032 			ifp->if_ierrors++;
1033 			mb86960_droppacket(sc);
1034 			continue;
1035 		}
1036 
1037 		/*
1038 		 * Check for a short (RUNT) packet.  We *do* check
1039 		 * but do nothing other than print a message.
1040 		 * Short packets are illegal, but does nothing bad
1041 		 * if it carries data for upper layer.
1042 		 */
1043 #if FE_DEBUG >= 2
1044 		if (len < (ETHER_MIN_LEN - ETHER_CRC_LEN)) {
1045 			log(LOG_WARNING,
1046 			    "%s: received a short packet? (%u bytes)\n",
1047 			    device_xname(sc->sc_dev), len);
1048 		}
1049 #endif
1050 
1051 		/*
1052 		 * Go get a packet.
1053 		 */
1054 		if (mb86960_get_packet(sc, len) == 0) {
1055 			/* Skip a packet, updating statistics. */
1056 #if FE_DEBUG >= 2
1057 			log(LOG_WARNING,
1058 			    "%s: out of mbufs; dropping packet (%u bytes)\n",
1059 			    device_xname(sc->sc_dev), len);
1060 #endif
1061 			ifp->if_ierrors++;
1062 			mb86960_droppacket(sc);
1063 
1064 			/*
1065 			 * We stop receiving packets, even if there are
1066 			 * more in the buffer.  We hope we can get more
1067 			 * mbufs next time.
1068 			 */
1069 			return;
1070 		}
1071 
1072 		/* Successfully received a packet.  Update stat. */
1073 		ifp->if_ipackets++;
1074 	}
1075 }
1076 
1077 /*
1078  * Ethernet interface interrupt processor
1079  */
1080 int
1081 mb86960_intr(void *arg)
1082 {
1083 	struct mb86960_softc *sc = arg;
1084 	bus_space_tag_t bst = sc->sc_bst;
1085 	bus_space_handle_t bsh = sc->sc_bsh;
1086 	struct ifnet *ifp = &sc->sc_ec.ec_if;
1087 	uint8_t tstat, rstat;
1088 
1089 	if ((sc->sc_stat & FE_STAT_ENABLED) == 0 ||
1090 	    !device_is_active(sc->sc_dev))
1091 		return 0;
1092 
1093 #if FE_DEBUG >= 4
1094 	log(LOG_INFO, "%s: mb86960_intr()\n", device_xname(sc->sc_dev));
1095 	mb86960_dump(LOG_INFO, sc);
1096 #endif
1097 
1098 	/*
1099 	 * Get interrupt conditions, masking unneeded flags.
1100 	 */
1101 	tstat = bus_space_read_1(bst, bsh, FE_DLCR0) & FE_TMASK;
1102 	rstat = bus_space_read_1(bst, bsh, FE_DLCR1) & FE_RMASK;
1103 	if (tstat == 0 && rstat == 0)
1104 		return 0;
1105 
1106 	/*
1107 	 * Loop until there are no more new interrupt conditions.
1108 	 */
1109 	for (;;) {
1110 		/*
1111 		 * Reset the conditions we are acknowledging.
1112 		 */
1113 		bus_space_write_1(bst, bsh, FE_DLCR0, tstat);
1114 		bus_space_write_1(bst, bsh, FE_DLCR1, rstat);
1115 
1116 		/*
1117 		 * Handle transmitter interrupts. Handle these first because
1118 		 * the receiver will reset the board under some conditions.
1119 		 */
1120 		if (tstat != 0)
1121 			mb86960_tint(sc, tstat);
1122 
1123 		/*
1124 		 * Handle receiver interrupts.
1125 		 */
1126 		if (rstat != 0)
1127 			mb86960_rint(sc, rstat);
1128 
1129 		/*
1130 		 * Update the multicast address filter if it is
1131 		 * needed and possible.  We do it now, because
1132 		 * we can make sure the transmission buffer is empty,
1133 		 * and there is a good chance that the receive queue
1134 		 * is empty.  It will minimize the possibility of
1135 		 * packet lossage.
1136 		 */
1137 		if (sc->filter_change &&
1138 		    sc->txb_count == 0 && sc->txb_sched == 0) {
1139 			mb86960_loadmar(sc);
1140 			ifp->if_flags &= ~IFF_OACTIVE;
1141 		}
1142 
1143 		/*
1144 		 * If it looks like the transmitter can take more data,
1145 		 * attempt to start output on the interface. This is done
1146 		 * after handling the receiver interrupt to give the
1147 		 * receive operation priority.
1148 		 */
1149 		if ((ifp->if_flags & IFF_OACTIVE) == 0)
1150 			mb86960_start(ifp);
1151 
1152 #if NRND > 0
1153 		if (rstat != 0 || tstat != 0)
1154 			rnd_add_uint32(&sc->rnd_source, rstat + tstat);
1155 #endif
1156 
1157 		/*
1158 		 * Get interrupt conditions, masking unneeded flags.
1159 		 */
1160 		tstat = bus_space_read_1(bst, bsh, FE_DLCR0) & FE_TMASK;
1161 		rstat = bus_space_read_1(bst, bsh, FE_DLCR1) & FE_RMASK;
1162 		if (tstat == 0 && rstat == 0)
1163 			return 1;
1164 	}
1165 }
1166 
1167 /*
1168  * Process an ioctl request.  This code needs some work - it looks pretty ugly.
1169  */
1170 int
1171 mb86960_ioctl(struct ifnet *ifp, u_long cmd, void *data)
1172 {
1173 	struct mb86960_softc *sc = ifp->if_softc;
1174 	struct ifaddr *ifa = (struct ifaddr *)data;
1175 	struct ifreq *ifr = (struct ifreq *)data;
1176 	int s, error = 0;
1177 
1178 #if FE_DEBUG >= 3
1179 	log(LOG_INFO, "%s: ioctl(%lx)\n", device_xname(sc->sc_dev), cmd);
1180 #endif
1181 
1182 	s = splnet();
1183 
1184 	switch (cmd) {
1185 	case SIOCINITIFADDR:
1186 		if ((error = mb86960_enable(sc)) != 0)
1187 			break;
1188 		ifp->if_flags |= IFF_UP;
1189 
1190 		mb86960_init(sc);
1191 		switch (ifa->ifa_addr->sa_family) {
1192 #ifdef INET
1193 		case AF_INET:
1194 			arp_ifinit(ifp, ifa);
1195 			break;
1196 #endif
1197 		default:
1198 			break;
1199 		}
1200 		break;
1201 
1202 	case SIOCSIFFLAGS:
1203 		if ((error = ifioctl_common(ifp, cmd, data)) != 0)
1204 			break;
1205 		/* XXX re-use ether_ioctl() */
1206 		switch (ifp->if_flags & (IFF_UP|IFF_RUNNING)) {
1207 		case IFF_RUNNING:
1208 			/*
1209 			 * If interface is marked down and it is running, then
1210 			 * stop it.
1211 			 */
1212 			mb86960_stop(sc);
1213 			ifp->if_flags &= ~IFF_RUNNING;
1214 			mb86960_disable(sc);
1215 			break;
1216 		case IFF_UP:
1217 			/*
1218 			 * If interface is marked up and it is stopped, then
1219 			 * start it.
1220 			 */
1221 			if ((error = mb86960_enable(sc)) != 0)
1222 				break;
1223 			mb86960_init(sc);
1224 			break;
1225 		case IFF_UP|IFF_RUNNING:
1226 			/*
1227 			 * Reset the interface to pick up changes in any other
1228 			 * flags that affect hardware registers.
1229 			 */
1230 			mb86960_setmode(sc);
1231 			break;
1232 		case 0:
1233 			break;
1234 		}
1235 #if FE_DEBUG >= 1
1236 		/* "ifconfig fe0 debug" to print register dump. */
1237 		if (ifp->if_flags & IFF_DEBUG) {
1238 			log(LOG_INFO, "%s: SIOCSIFFLAGS(DEBUG)\n",
1239 			    device_xname(sc->sc_dev));
1240 			mb86960_dump(LOG_DEBUG, sc);
1241 		}
1242 #endif
1243 		break;
1244 
1245 	case SIOCADDMULTI:
1246 	case SIOCDELMULTI:
1247 		if ((sc->sc_stat & FE_STAT_ENABLED) == 0) {
1248 			error = EIO;
1249 			break;
1250 		}
1251 
1252 		/* Update our multicast list. */
1253 		if ((error = ether_ioctl(ifp, cmd, data)) == ENETRESET) {
1254 			/*
1255 			 * Multicast list has changed; set the hardware filter
1256 			 * accordingly.
1257 			 */
1258 			if (ifp->if_flags & IFF_RUNNING)
1259 				mb86960_setmode(sc);
1260 			error = 0;
1261 		}
1262 		break;
1263 
1264 	case SIOCGIFMEDIA:
1265 	case SIOCSIFMEDIA:
1266 		error = ifmedia_ioctl(ifp, ifr, &sc->sc_media, cmd);
1267 		break;
1268 
1269 	default:
1270 		error = ether_ioctl(ifp, cmd, data);
1271 		break;
1272 	}
1273 
1274 	splx(s);
1275 	return error;
1276 }
1277 
1278 /*
1279  * Retrieve packet from receive buffer and send to the next level up via
1280  * ether_input(). If there is a BPF listener, give a copy to BPF, too.
1281  * Returns 0 if success, -1 if error (i.e., mbuf allocation failure).
1282  */
1283 int
1284 mb86960_get_packet(struct mb86960_softc *sc, u_int len)
1285 {
1286 	bus_space_tag_t bst = sc->sc_bst;
1287 	bus_space_handle_t bsh = sc->sc_bsh;
1288 	struct ifnet *ifp = &sc->sc_ec.ec_if;
1289 	struct mbuf *m;
1290 
1291 	/* Allocate a header mbuf. */
1292 	MGETHDR(m, M_DONTWAIT, MT_DATA);
1293 	if (m == 0)
1294 		return 0;
1295 	m->m_pkthdr.rcvif = ifp;
1296 	m->m_pkthdr.len = len;
1297 
1298 	/* The following silliness is to make NFS happy. */
1299 #define	EROUND	((sizeof(struct ether_header) + 3) & ~3)
1300 #define	EOFF	(EROUND - sizeof(struct ether_header))
1301 
1302 	/*
1303 	 * Our strategy has one more problem.  There is a policy on
1304 	 * mbuf cluster allocation.  It says that we must have at
1305 	 * least MINCLSIZE (208 bytes) to allocate a cluster.  For a
1306 	 * packet of a size between (MHLEN - 2) to (MINCLSIZE - 2),
1307 	 * our code violates the rule...
1308 	 * On the other hand, the current code is short, simple,
1309 	 * and fast, however.  It does no harmful thing, just waists
1310 	 * some memory.  Any comments?  FIXME.
1311 	 */
1312 
1313 	/* Attach a cluster if this packet doesn't fit in a normal mbuf. */
1314 	if (len > MHLEN - EOFF) {
1315 		MCLGET(m, M_DONTWAIT);
1316 		if ((m->m_flags & M_EXT) == 0) {
1317 			m_freem(m);
1318 			return 0;
1319 		}
1320 	}
1321 
1322 	/*
1323 	 * The following assumes there is room for the ether header in the
1324 	 * header mbuf.
1325 	 */
1326 	m->m_data += EOFF;
1327 
1328 	/* Set the length of this packet. */
1329 	m->m_len = len;
1330 
1331 	/* Get a packet. */
1332 	if (sc->sc_flags & FE_FLAGS_SBW_BYTE)
1333 		bus_space_read_multi_1(bst, bsh, FE_BMPR8,
1334 		    mtod(m, uint8_t *), len);
1335 	else
1336 		bus_space_read_multi_stream_2(bst, bsh, FE_BMPR8,
1337 		    mtod(m, uint16_t *), (len + 1) >> 1);
1338 
1339 	/*
1340 	 * Check if there's a BPF listener on this interface.  If so, hand off
1341 	 * the raw packet to bpf.
1342 	 */
1343 	bpf_mtap(ifp, m);
1344 
1345 	(*ifp->if_input)(ifp, m);
1346 	return 1;
1347 }
1348 
1349 /*
1350  * Write an mbuf chain to the transmission buffer memory using 16 bit PIO.
1351  * Returns number of bytes actually written, including length word.
1352  *
1353  * If an mbuf chain is too long for an Ethernet frame, it is not sent.
1354  * Packets shorter than Ethernet minimum are legal, and we pad them
1355  * before sending out.  An exception is "partial" packets which are
1356  * shorter than mandatory Ethernet header.
1357  *
1358  * I wrote a code for an experimental "delayed padding" technique.
1359  * When employed, it postpones the padding process for short packets.
1360  * If xmit() occurred at the moment, the padding process is omitted, and
1361  * garbages are sent as pad data.  If next packet is stored in the
1362  * transmission buffer before xmit(), write_mbuf() pads the previous
1363  * packet before transmitting new packet.  This *may* gain the
1364  * system performance (slightly).
1365  */
1366 void
1367 mb86960_write_mbufs(struct mb86960_softc *sc, struct mbuf *m)
1368 {
1369 	bus_space_tag_t bst = sc->sc_bst;
1370 	bus_space_handle_t bsh = sc->sc_bsh;
1371 	int totlen, len;
1372 #if FE_DEBUG >= 2
1373 	struct mbuf *mp;
1374 #endif
1375 
1376 #if FE_DELAYED_PADDING
1377 	/* Do the "delayed padding." */
1378 	if (sc->txb_padding > 0) {
1379 		if (sc->sc_flags & FE_FLAGS_SBW_BYTE) {
1380 			for (len = sc->txb_padding; len > 0; len--)
1381 				bus_space_write_1(bst, bsh, FE_BMPR8, 0);
1382 		} else {
1383 			for (len = sc->txb_padding >> 1; len > 0; len--)
1384 				bus_space_write_2(bst, bsh, FE_BMPR8, 0);
1385 		}
1386 		sc->txb_padding = 0;
1387 	}
1388 #endif
1389 
1390 	/* We need to use m->m_pkthdr.len, so require the header */
1391 	if ((m->m_flags & M_PKTHDR) == 0)
1392 	  	panic("mb86960_write_mbufs: no header mbuf");
1393 
1394 #if FE_DEBUG >= 2
1395 	/* First, count up the total number of bytes to copy. */
1396 	for (totlen = 0, mp = m; mp != 0; mp = mp->m_next)
1397 		totlen += mp->m_len;
1398 	/* Check if this matches the one in the packet header. */
1399 	if (totlen != m->m_pkthdr.len)
1400 		log(LOG_WARNING, "%s: packet length mismatch? (%d/%d)\n",
1401 		    device_xname(sc->sc_dev), totlen, m->m_pkthdr.len);
1402 #else
1403 	/* Just use the length value in the packet header. */
1404 	totlen = m->m_pkthdr.len;
1405 #endif
1406 
1407 #if FE_DEBUG >= 1
1408 	/*
1409 	 * Should never send big packets.  If such a packet is passed,
1410 	 * it should be a bug of upper layer.  We just ignore it.
1411 	 * ... Partial (too short) packets, neither.
1412 	 */
1413 	if (totlen > (ETHER_MAX_LEN - ETHER_CRC_LEN) ||
1414 	    totlen < ETHER_HDR_LEN) {
1415 		log(LOG_ERR, "%s: got a %s packet (%u bytes) to send\n",
1416 		    device_xname(sc->sc_dev),
1417 		    totlen < ETHER_HDR_LEN ? "partial" : "big", totlen);
1418 		sc->sc_ec.ec_if.if_oerrors++;
1419 		return;
1420 	}
1421 #endif
1422 
1423 	/*
1424 	 * Put the length word for this frame.
1425 	 * Does 86960 accept odd length?  -- Yes.
1426 	 * Do we need to pad the length to minimum size by ourselves?
1427 	 * -- Generally yes.  But for (or will be) the last
1428 	 * packet in the transmission buffer, we can skip the
1429 	 * padding process.  It may gain performance slightly.  FIXME.
1430 	 */
1431 	len = max(totlen, (ETHER_MIN_LEN - ETHER_CRC_LEN));
1432 	if (sc->sc_flags & FE_FLAGS_SBW_BYTE) {
1433 		bus_space_write_1(bst, bsh, FE_BMPR8, len);
1434 		bus_space_write_1(bst, bsh, FE_BMPR8, len >> 8);
1435 	} else {
1436 		bus_space_write_2(bst, bsh, FE_BMPR8, len);
1437 		/* roundup packet length since we will use word access */
1438 		totlen = (totlen + 1) & ~1;
1439 	}
1440 
1441 	/*
1442 	 * Update buffer status now.
1443 	 * Truncate the length up to an even number
1444 	 * if the chip is set in SBW_WORD mode.
1445 	 */
1446 	sc->txb_free -= FE_TXLEN_SIZE +
1447 	    max(totlen, (ETHER_MIN_LEN - ETHER_CRC_LEN));
1448 	sc->txb_count++;
1449 
1450 #if FE_DELAYED_PADDING
1451 	/* Postpone the packet padding if necessary. */
1452 	if (totlen < (ETHER_MIN_LEN - ETHER_CRC_LEN))
1453 		sc->txb_padding = (ETHER_MIN_LEN - ETHER_CRC_LEN) - totlen;
1454 #endif
1455 
1456 	/*
1457 	 * Transfer the data from mbuf chain to the transmission buffer.
1458 	 * If the MB86960 is configured in word mode, data needs to be
1459 	 * transferred as words, and only words.
1460 	 * So that we require some extra code to patch over odd-length
1461 	 * or unaligned mbufs.
1462 	 */
1463 	if (sc->sc_flags & FE_FLAGS_SBW_BYTE) {
1464 		/* It's simple in byte mode. */
1465 		for (; m != NULL; m = m->m_next) {
1466 			if (m->m_len) {
1467 				bus_space_write_multi_1(bst, bsh, FE_BMPR8,
1468 				    mtod(m, uint8_t *), m->m_len);
1469 			}
1470 		}
1471 	} else {
1472 		/* a bit trickier in word mode. */
1473 		uint8_t *data, savebyte[2];
1474 		int leftover;
1475 
1476 		leftover = 0;
1477 		savebyte[0] = savebyte[1] = 0;
1478 
1479 		for (; m != NULL; m = m->m_next) {
1480 			len = m->m_len;
1481 			if (len == 0)
1482 				continue;
1483 			data = mtod(m, uint8_t *);
1484 			while (len > 0) {
1485 				if (leftover) {
1486 					/*
1487 					 * Data left over (from mbuf or
1488 					 * realignment). Buffer the next
1489 					 * byte, and write it and the
1490 					 * leftover data out.
1491 					 */
1492 					savebyte[1] = *data++;
1493 					len--;
1494 					bus_space_write_stream_2(bst, bsh,
1495 					   FE_BMPR8, *(uint16_t *)savebyte);
1496 					leftover = 0;
1497 				} else if (BUS_SPACE_ALIGNED_POINTER(data,
1498 				    uint16_t) == 0) {
1499 					/*
1500 					 * Unaligned data; buffer the next byte.
1501 					 */
1502 					savebyte[0] = *data++;
1503 					len--;
1504 					leftover = 1;
1505 				} else {
1506 					/*
1507 					 * Aligned data; output contiguous
1508 					 * words as much as we can, then
1509 					 * buffer the remaining byte, if any.
1510 					 */
1511 					leftover = len & 1;
1512 					len &= ~1;
1513 					bus_space_write_multi_stream_2(bst, bsh,
1514 					    FE_BMPR8, (uint16_t *)data,
1515 					    len >> 1);
1516 					data += len;
1517 					if (leftover)
1518 						savebyte[0] = *data++;
1519 					len = 0;
1520 				}
1521 			}
1522 			if (len < 0)
1523 				panic("mb86960_write_mbufs: negative len");
1524 		}
1525 		if (leftover) {
1526 			savebyte[1] = 0;
1527 			bus_space_write_stream_2(bst, bsh, FE_BMPR8,
1528 			    *(uint16_t *)savebyte);
1529 		}
1530 	}
1531 #if FE_DELAYED_PADDING == 0
1532 	/*
1533 	 * Pad the packet to the minimum length if necessary.
1534 	 */
1535 	len = (ETHER_MIN_LEN - ETHER_CRC_LEN) - totlen;
1536 	if (len > 0) {
1537 		if (sc->sc_flags & FE_FLAGS_SBW_BYTE) {
1538 			while (len-- > 0)
1539 				bus_space_write_1(bst, bsh, FE_BMPR8, 0);
1540 		} else {
1541 			len >>= 1;
1542 			while (len-- > 0)
1543 				bus_space_write_2(bst, bsh, FE_BMPR8, 0);
1544 		}
1545 	}
1546 #endif
1547 }
1548 
1549 /*
1550  * Compute the multicast address filter from the
1551  * list of multicast addresses we need to listen to.
1552  */
1553 void
1554 mb86960_getmcaf(struct ethercom *ec, uint8_t *af)
1555 {
1556 	struct ifnet *ifp = &ec->ec_if;
1557 	struct ether_multi *enm;
1558 	uint32_t crc;
1559 	struct ether_multistep step;
1560 
1561 	/*
1562 	 * Set up multicast address filter by passing all multicast addresses
1563 	 * through a crc generator, and then using the high order 6 bits as an
1564 	 * index into the 64 bit logical address filter.  The high order bit
1565 	 * selects the word, while the rest of the bits select the bit within
1566 	 * the word.
1567 	 */
1568 
1569 	if ((ifp->if_flags & IFF_PROMISC) != 0)
1570 		goto allmulti;
1571 
1572 	memset(af, 0, FE_FILTER_LEN);
1573 	ETHER_FIRST_MULTI(step, ec, enm);
1574 	while (enm != NULL) {
1575 		if (memcmp(enm->enm_addrlo, enm->enm_addrhi,
1576 		    sizeof(enm->enm_addrlo)) != 0) {
1577 			/*
1578 			 * We must listen to a range of multicast addresses.
1579 			 * For now, just accept all multicasts, rather than
1580 			 * trying to set only those filter bits needed to match
1581 			 * the range.  (At this time, the only use of address
1582 			 * ranges is for IP multicast routing, for which the
1583 			 * range is big enough to require all bits set.)
1584 			 */
1585 			goto allmulti;
1586 		}
1587 
1588 		crc = ether_crc32_le(enm->enm_addrlo, ETHER_ADDR_LEN);
1589 
1590 		/* Just want the 6 most significant bits. */
1591 		crc >>= 26;
1592 
1593 		/* Turn on the corresponding bit in the filter. */
1594 		af[crc >> 3] |= 1 << (crc & 7);
1595 
1596 		ETHER_NEXT_MULTI(step, enm);
1597 	}
1598 	ifp->if_flags &= ~IFF_ALLMULTI;
1599 	return;
1600 
1601 allmulti:
1602 	ifp->if_flags |= IFF_ALLMULTI;
1603 	memset(af, 0xff, FE_FILTER_LEN);
1604 }
1605 
1606 /*
1607  * Calculate a new "multicast packet filter" and put the 86960
1608  * receiver in appropriate mode.
1609  */
1610 void
1611 mb86960_setmode(struct mb86960_softc *sc)
1612 {
1613 	bus_space_tag_t bst = sc->sc_bst;
1614 	bus_space_handle_t bsh = sc->sc_bsh;
1615 	int flags = sc->sc_ec.ec_if.if_flags;
1616 
1617 	/*
1618 	 * If the interface is not running, we postpone the update
1619 	 * process for receive modes and multicast address filter
1620 	 * until the interface is restarted.  It reduces some
1621 	 * complicated job on maintaining chip states.  (Earlier versions
1622 	 * of this driver had a bug on that point...)
1623 	 *
1624 	 * To complete the trick, mb86960_init() calls mb86960_setmode() after
1625 	 * restarting the interface.
1626 	 */
1627 	if ((flags & IFF_RUNNING) == 0)
1628 		return;
1629 
1630 	/*
1631 	 * Promiscuous mode is handled separately.
1632 	 */
1633 	if ((flags & IFF_PROMISC) != 0) {
1634 		/*
1635 		 * Program 86960 to receive all packets on the segment
1636 		 * including those directed to other stations.
1637 		 * Multicast filter stored in MARs are ignored
1638 		 * under this setting, so we don't need to update it.
1639 		 *
1640 		 * Promiscuous mode is used solely by BPF, and BPF only
1641 		 * listens to valid (no error) packets.  So, we ignore
1642 		 * errornous ones even in this mode.
1643 		 */
1644 		bus_space_write_1(bst, bsh, FE_DLCR5,
1645 		    sc->proto_dlcr5 | FE_D5_AFM0 | FE_D5_AFM1);
1646 		sc->filter_change = 0;
1647 
1648 #if FE_DEBUG >= 3
1649 		log(LOG_INFO, "%s: promiscuous mode\n",
1650 		    device_xname(sc->sc_dev));
1651 #endif
1652 		return;
1653 	}
1654 
1655 	/*
1656 	 * Turn the chip to the normal (non-promiscuous) mode.
1657 	 */
1658 	bus_space_write_1(bst, bsh, FE_DLCR5, sc->proto_dlcr5 | FE_D5_AFM1);
1659 
1660 	/*
1661 	 * Find the new multicast filter value.
1662 	 */
1663 	mb86960_getmcaf(&sc->sc_ec, sc->filter);
1664 	sc->filter_change = 1;
1665 
1666 #if FE_DEBUG >= 3
1667 	log(LOG_INFO,
1668 	    "%s: address filter: [%02x %02x %02x %02x %02x %02x %02x %02x]\n",
1669 	    device_xname(sc->sc_dev),
1670 	    sc->filter[0], sc->filter[1], sc->filter[2], sc->filter[3],
1671 	    sc->filter[4], sc->filter[5], sc->filter[6], sc->filter[7]);
1672 #endif
1673 
1674 	/*
1675 	 * We have to update the multicast filter in the 86960, A.S.A.P.
1676 	 *
1677 	 * Note that the DLC (Data Linc Control unit, i.e. transmitter
1678 	 * and receiver) must be stopped when feeding the filter, and
1679 	 * DLC trashes all packets in both transmission and receive
1680 	 * buffers when stopped.
1681 	 *
1682 	 * ... Are the above sentenses correct?  I have to check the
1683 	 *     manual of the MB86960A.  FIXME.
1684 	 *
1685 	 * To reduce the packet lossage, we delay the filter update
1686 	 * process until buffers are empty.
1687 	 */
1688 	if (sc->txb_sched == 0 && sc->txb_count == 0 &&
1689 	    (bus_space_read_1(bst, bsh, FE_DLCR1) & FE_D1_PKTRDY) == 0) {
1690 		/*
1691 		 * Buffers are (apparently) empty.  Load
1692 		 * the new filter value into MARs now.
1693 		 */
1694 		mb86960_loadmar(sc);
1695 	} else {
1696 		/*
1697 		 * Buffers are not empty.  Mark that we have to update
1698 		 * the MARs.  The new filter will be loaded by mb86960_intr()
1699 		 * later.
1700 		 */
1701 #if FE_DEBUG >= 4
1702 		log(LOG_INFO, "%s: filter change delayed\n",
1703 		    device_xname(sc->sc_dev));
1704 #endif
1705 	}
1706 }
1707 
1708 /*
1709  * Load a new multicast address filter into MARs.
1710  *
1711  * The caller must have splnet'ed befor mb86960_loadmar.
1712  * This function starts the DLC upon return.  So it can be called only
1713  * when the chip is working, i.e., from the driver's point of view, when
1714  * a device is RUNNING.  (I mistook the point in previous versions.)
1715  */
1716 void
1717 mb86960_loadmar(struct mb86960_softc *sc)
1718 {
1719 	bus_space_tag_t bst = sc->sc_bst;
1720 	bus_space_handle_t bsh = sc->sc_bsh;
1721 
1722 	/* Stop the DLC (transmitter and receiver). */
1723 	bus_space_write_1(bst, bsh, FE_DLCR6,
1724 	    sc->proto_dlcr6 | FE_D6_DLC_DISABLE);
1725 
1726 	/* Select register bank 1 for MARs. */
1727 	bus_space_write_1(bst, bsh, FE_DLCR7,
1728 	    sc->proto_dlcr7 | FE_D7_RBS_MAR | FE_D7_POWER_UP);
1729 
1730 	/* Copy filter value into the registers. */
1731 	bus_space_write_region_1(bst, bsh, FE_MAR8, sc->filter, FE_FILTER_LEN);
1732 
1733 	/* Restore the bank selection for BMPRs (i.e., runtime registers). */
1734 	bus_space_write_1(bst, bsh, FE_DLCR7,
1735 	    sc->proto_dlcr7 | FE_D7_RBS_BMPR | FE_D7_POWER_UP);
1736 
1737 	/* Restart the DLC. */
1738 	bus_space_write_1(bst, bsh, FE_DLCR6,
1739 	    sc->proto_dlcr6 | FE_D6_DLC_ENABLE);
1740 
1741 	/* We have just updated the filter. */
1742 	sc->filter_change = 0;
1743 
1744 #if FE_DEBUG >= 3
1745 	log(LOG_INFO, "%s: address filter changed\n", device_xname(sc->sc_dev));
1746 #endif
1747 }
1748 
1749 /*
1750  * Enable power on the interface.
1751  */
1752 int
1753 mb86960_enable(struct mb86960_softc *sc)
1754 {
1755 
1756 #if FE_DEBUG >= 3
1757 	log(LOG_INFO, "%s: mb86960_enable()\n", device_xname(sc->sc_dev));
1758 #endif
1759 
1760 	if ((sc->sc_stat & FE_STAT_ENABLED) == 0 && sc->sc_enable != NULL) {
1761 		if ((*sc->sc_enable)(sc) != 0) {
1762 			aprint_error_dev(sc->sc_dev, "device enable failed\n");
1763 			return EIO;
1764 		}
1765 	}
1766 
1767 	sc->sc_stat |= FE_STAT_ENABLED;
1768 	return 0;
1769 }
1770 
1771 /*
1772  * Disable power on the interface.
1773  */
1774 void
1775 mb86960_disable(struct mb86960_softc *sc)
1776 {
1777 
1778 #if FE_DEBUG >= 3
1779 	log(LOG_INFO, "%s: mb86960_disable()\n", device_xname(sc->sc_dev));
1780 #endif
1781 
1782 	if ((sc->sc_stat & FE_STAT_ENABLED) != 0 && sc->sc_disable != NULL) {
1783 		(*sc->sc_disable)(sc);
1784 		sc->sc_stat &= ~FE_STAT_ENABLED;
1785 	}
1786 }
1787 
1788 /*
1789  * mbe_activate:
1790  *
1791  *	Handle device activation/deactivation requests.
1792  */
1793 int
1794 mb86960_activate(device_t self, enum devact act)
1795 {
1796 	struct mb86960_softc *sc = device_private(self);
1797 
1798 	switch (act) {
1799 	case DVACT_DEACTIVATE:
1800 		if_deactivate(&sc->sc_ec.ec_if);
1801 		return 0;
1802 	default:
1803 		return EOPNOTSUPP;
1804 	}
1805 }
1806 
1807 /*
1808  * mb86960_detach:
1809  *
1810  *	Detach a MB86960 interface.
1811  */
1812 int
1813 mb86960_detach(struct mb86960_softc *sc)
1814 {
1815 	struct ifnet *ifp = &sc->sc_ec.ec_if;
1816 
1817 	/* Succeed now if there's no work to do. */
1818 	if ((sc->sc_stat & FE_STAT_ATTACHED) == 0)
1819 		return 0;
1820 
1821 	/* Delete all media. */
1822 	ifmedia_delete_instance(&sc->sc_media, IFM_INST_ANY);
1823 
1824 #if NRND > 0
1825 	/* Unhook the entropy source. */
1826 	rnd_detach_source(&sc->rnd_source);
1827 #endif
1828 	ether_ifdetach(ifp);
1829 	if_detach(ifp);
1830 
1831 	mb86960_disable(sc);
1832 	return 0;
1833 }
1834 
1835 /*
1836  * Routines to read all bytes from the config EEPROM (93C06) through MB86965A.
1837  */
1838 void
1839 mb86965_read_eeprom(bus_space_tag_t iot, bus_space_handle_t ioh, uint8_t *data)
1840 {
1841 	int addr, op, bit;
1842 	uint16_t val;
1843 
1844 	/* Read bytes from EEPROM; two bytes per an iteration. */
1845 	for (addr = 0; addr < FE_EEPROM_SIZE / 2; addr++) {
1846 		/* Reset the EEPROM interface. */
1847 		bus_space_write_1(iot, ioh, FE_BMPR16, 0x00);
1848 		bus_space_write_1(iot, ioh, FE_BMPR17, 0x00);
1849 		bus_space_write_1(iot, ioh, FE_BMPR16, FE_B16_SELECT);
1850 
1851 		/* Send start bit. */
1852 		bus_space_write_1(iot, ioh, FE_BMPR17, FE_B17_DATA);
1853 		FE_EEPROM_DELAY();
1854 		bus_space_write_1(iot, ioh,
1855 		    FE_BMPR16, FE_B16_SELECT | FE_B16_CLOCK);
1856 		FE_EEPROM_DELAY();
1857 		bus_space_write_1(iot, ioh, FE_BMPR16, FE_B16_SELECT);
1858 
1859 		/* Send read command and read address. */
1860 		op = 0x80 | addr;	/* READ instruction */
1861 		for (bit = 8; bit > 0; bit--) {
1862 			bus_space_write_1(iot, ioh, FE_BMPR17,
1863 			    (op & (1 << (bit - 1))) ? FE_B17_DATA : 0);
1864 			FE_EEPROM_DELAY();
1865 			bus_space_write_1(iot, ioh,
1866 			    FE_BMPR16, FE_B16_SELECT | FE_B16_CLOCK);
1867 			FE_EEPROM_DELAY();
1868 			bus_space_write_1(iot, ioh, FE_BMPR16, FE_B16_SELECT);
1869 		}
1870 		bus_space_write_1(iot, ioh, FE_BMPR17, 0x00);
1871 
1872 		/* Read two bytes in each address */
1873 		val = 0;
1874 		for (bit = 16; bit > 0; bit--) {
1875 			FE_EEPROM_DELAY();
1876 			bus_space_write_1(iot, ioh,
1877 			    FE_BMPR16, FE_B16_SELECT | FE_B16_CLOCK);
1878 			FE_EEPROM_DELAY();
1879 			if (bus_space_read_1(iot, ioh, FE_BMPR17) &
1880 			    FE_B17_DATA)
1881 				val |= 1 << (bit - 1);
1882 			bus_space_write_1(iot, ioh,
1883 			    FE_BMPR16, FE_B16_SELECT);
1884 		}
1885 		data[addr * 2]     = val >> 8;
1886 		data[addr * 2 + 1] = val & 0xff;
1887 	}
1888 
1889 	/* Make sure the EEPROM is turned off. */
1890 	bus_space_write_1(iot, ioh, FE_BMPR16, 0);
1891 	bus_space_write_1(iot, ioh, FE_BMPR17, 0);
1892 
1893 #if FE_DEBUG >= 3
1894 	/* Report what we got. */
1895 	log(LOG_INFO, "mb86965_read_eeprom: "
1896 	    " %02x%02x%02x%02x %02x%02x%02x%02x -"
1897 	    " %02x%02x%02x%02x %02x%02x%02x%02x -"
1898 	    " %02x%02x%02x%02x %02x%02x%02x%02x -"
1899 	    " %02x%02x%02x%02x %02x%02x%02x%02x\n",
1900 	    data[ 0], data[ 1], data[ 2], data[ 3],
1901 	    data[ 4], data[ 5], data[ 6], data[ 7],
1902 	    data[ 8], data[ 9], data[10], data[11],
1903 	    data[12], data[13], data[14], data[15],
1904 	    data[16], data[17], data[18], data[19],
1905 	    data[20], data[21], data[22], data[23],
1906 	    data[24], data[25], data[26], data[27],
1907 	    data[28], data[29], data[30], data[31]);
1908 #endif
1909 }
1910 
1911 #if FE_DEBUG >= 1
1912 void
1913 mb86960_dump(int level, struct mb86960_softc *sc)
1914 {
1915 	bus_space_tag_t bst = sc->sc_bst;
1916 	bus_space_handle_t bsh = sc->sc_bsh;
1917 	uint8_t save_dlcr7;
1918 
1919 	save_dlcr7 = bus_space_read_1(bst, bsh, FE_DLCR7);
1920 
1921 	log(level, "\tDLCR = %02x %02x %02x %02x %02x %02x %02x %02x\n",
1922 	    bus_space_read_1(bst, bsh, FE_DLCR0),
1923 	    bus_space_read_1(bst, bsh, FE_DLCR1),
1924 	    bus_space_read_1(bst, bsh, FE_DLCR2),
1925 	    bus_space_read_1(bst, bsh, FE_DLCR3),
1926 	    bus_space_read_1(bst, bsh, FE_DLCR4),
1927 	    bus_space_read_1(bst, bsh, FE_DLCR5),
1928 	    bus_space_read_1(bst, bsh, FE_DLCR6),
1929 	    bus_space_read_1(bst, bsh, FE_DLCR7));
1930 
1931 	bus_space_write_1(bst, bsh, FE_DLCR7,
1932 	    (save_dlcr7 & ~FE_D7_RBS) | FE_D7_RBS_DLCR);
1933 	log(level, "\t       %02x %02x %02x %02x %02x %02x %02x %02x\n",
1934 	    bus_space_read_1(bst, bsh, FE_DLCR8),
1935 	    bus_space_read_1(bst, bsh, FE_DLCR9),
1936 	    bus_space_read_1(bst, bsh, FE_DLCR10),
1937 	    bus_space_read_1(bst, bsh, FE_DLCR11),
1938 	    bus_space_read_1(bst, bsh, FE_DLCR12),
1939 	    bus_space_read_1(bst, bsh, FE_DLCR13),
1940 	    bus_space_read_1(bst, bsh, FE_DLCR14),
1941 	    bus_space_read_1(bst, bsh, FE_DLCR15));
1942 
1943 	bus_space_write_1(bst, bsh, FE_DLCR7,
1944 	    (save_dlcr7 & ~FE_D7_RBS) | FE_D7_RBS_MAR);
1945 	log(level, "\tMAR  = %02x %02x %02x %02x %02x %02x %02x %02x\n",
1946 	    bus_space_read_1(bst, bsh, FE_MAR8),
1947 	    bus_space_read_1(bst, bsh, FE_MAR9),
1948 	    bus_space_read_1(bst, bsh, FE_MAR10),
1949 	    bus_space_read_1(bst, bsh, FE_MAR11),
1950 	    bus_space_read_1(bst, bsh, FE_MAR12),
1951 	    bus_space_read_1(bst, bsh, FE_MAR13),
1952 	    bus_space_read_1(bst, bsh, FE_MAR14),
1953 	    bus_space_read_1(bst, bsh, FE_MAR15));
1954 
1955 	bus_space_write_1(bst, bsh, FE_DLCR7,
1956 	    (save_dlcr7 & ~FE_D7_RBS) | FE_D7_RBS_BMPR);
1957 	log(level,
1958 	    "\tBMPR = xx xx %02x %02x %02x %02x %02x %02x %02x %02x xx %02x\n",
1959 	    bus_space_read_1(bst, bsh, FE_BMPR10),
1960 	    bus_space_read_1(bst, bsh, FE_BMPR11),
1961 	    bus_space_read_1(bst, bsh, FE_BMPR12),
1962 	    bus_space_read_1(bst, bsh, FE_BMPR13),
1963 	    bus_space_read_1(bst, bsh, FE_BMPR14),
1964 	    bus_space_read_1(bst, bsh, FE_BMPR15),
1965 	    bus_space_read_1(bst, bsh, FE_BMPR16),
1966 	    bus_space_read_1(bst, bsh, FE_BMPR17),
1967 	    bus_space_read_1(bst, bsh, FE_BMPR19));
1968 
1969 	bus_space_write_1(bst, bsh, FE_DLCR7, save_dlcr7);
1970 }
1971 #endif
1972 
1973