xref: /netbsd-src/sys/dev/ic/mb86960.c (revision c38e7cc395b1472a774ff828e46123de44c628e9)
1 /*	$NetBSD: mb86960.c,v 1.85 2017/05/23 02:19:14 ozaki-r Exp $	*/
2 
3 /*
4  * All Rights Reserved, Copyright (C) Fujitsu Limited 1995
5  *
6  * This software may be used, modified, copied, distributed, and sold, in
7  * both source and binary form provided that the above copyright, these
8  * terms and the following disclaimer are retained.  The name of the author
9  * and/or the contributor may not be used to endorse or promote products
10  * derived from this software without specific prior written permission.
11  *
12  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND THE CONTRIBUTOR ``AS IS'' AND
13  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
14  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
15  * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR THE CONTRIBUTOR BE LIABLE
16  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
17  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
18  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION.
19  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
20  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
21  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
22  * SUCH DAMAGE.
23  */
24 
25 /*
26  * Portions copyright (C) 1993, David Greenman.  This software may be used,
27  * modified, copied, distributed, and sold, in both source and binary form
28  * provided that the above copyright and these terms are retained.  Under no
29  * circumstances is the author responsible for the proper functioning of this
30  * software, nor does the author assume any responsibility for damages
31  * incurred with its use.
32  */
33 
34 #include <sys/cdefs.h>
35 __KERNEL_RCSID(0, "$NetBSD: mb86960.c,v 1.85 2017/05/23 02:19:14 ozaki-r Exp $");
36 
37 /*
38  * Device driver for Fujitsu MB86960A/MB86965A based Ethernet cards.
39  * Contributed by M.S. <seki@sysrap.cs.fujitsu.co.jp>
40  *
41  * This version is intended to be a generic template for various
42  * MB86960A/MB86965A based Ethernet cards.  It currently supports
43  * Fujitsu FMV-180 series (i.e., FMV-181 and FMV-182) and Allied-
44  * Telesis AT1700 series and RE2000 series.  There are some
45  * unnecessary hooks embedded, which are primarily intended to support
46  * other types of Ethernet cards, but the author is not sure whether
47  * they are useful.
48  */
49 
50 #include "opt_inet.h"
51 
52 #include <sys/param.h>
53 #include <sys/systm.h>
54 #include <sys/errno.h>
55 #include <sys/ioctl.h>
56 #include <sys/mbuf.h>
57 #include <sys/socket.h>
58 #include <sys/syslog.h>
59 #include <sys/device.h>
60 #include <sys/rndsource.h>
61 
62 #include <net/if.h>
63 #include <net/if_dl.h>
64 #include <net/if_types.h>
65 #include <net/if_media.h>
66 #include <net/if_ether.h>
67 
68 #ifdef INET
69 #include <netinet/in.h>
70 #include <netinet/in_systm.h>
71 #include <netinet/in_var.h>
72 #include <netinet/ip.h>
73 #include <netinet/if_inarp.h>
74 #endif
75 
76 
77 #include <net/bpf.h>
78 #include <net/bpfdesc.h>
79 
80 #include <sys/bus.h>
81 
82 #include <dev/ic/mb86960reg.h>
83 #include <dev/ic/mb86960var.h>
84 
85 #ifndef __BUS_SPACE_HAS_STREAM_METHODS
86 #define bus_space_write_stream_2	bus_space_write_2
87 #define bus_space_write_multi_stream_2	bus_space_write_multi_2
88 #define bus_space_read_multi_stream_2	bus_space_read_multi_2
89 #endif /* __BUS_SPACE_HAS_STREAM_METHODS */
90 
91 /* Standard driver entry points.  These can be static. */
92 void	mb86960_init(struct mb86960_softc *);
93 int	mb86960_ioctl(struct ifnet *, u_long, void *);
94 void	mb86960_start(struct ifnet *);
95 void	mb86960_reset(struct mb86960_softc *);
96 void	mb86960_watchdog(struct ifnet *);
97 
98 /* Local functions.  Order of declaration is confused.  FIXME. */
99 int	mb86960_get_packet(struct mb86960_softc *, u_int);
100 void	mb86960_stop(struct mb86960_softc *);
101 void	mb86960_tint(struct mb86960_softc *, uint8_t);
102 void	mb86960_rint(struct mb86960_softc *, uint8_t);
103 static inline
104 void	mb86960_xmit(struct mb86960_softc *);
105 void	mb86960_write_mbufs(struct mb86960_softc *, struct mbuf *);
106 static inline
107 void	mb86960_droppacket(struct mb86960_softc *);
108 void	mb86960_getmcaf(struct ethercom *, uint8_t *);
109 void	mb86960_setmode(struct mb86960_softc *);
110 void	mb86960_loadmar(struct mb86960_softc *);
111 
112 int	mb86960_mediachange(struct ifnet *);
113 void	mb86960_mediastatus(struct ifnet *, struct ifmediareq *);
114 
115 #if FE_DEBUG >= 1
116 void	mb86960_dump(int, struct mb86960_softc *);
117 #endif
118 
119 void
120 mb86960_attach(struct mb86960_softc *sc, uint8_t *myea)
121 {
122 	bus_space_tag_t bst = sc->sc_bst;
123 	bus_space_handle_t bsh = sc->sc_bsh;
124 
125 	/* Register values which depend on board design. */
126 	sc->proto_dlcr4 = FE_D4_LBC_DISABLE | FE_D4_CNTRL;
127 	sc->proto_dlcr5 = 0;
128 	sc->proto_dlcr7 = FE_D7_BYTSWP_LH;
129 	if ((sc->sc_flags & FE_FLAGS_MB86960) != 0)
130 		sc->proto_dlcr7 |= FE_D7_ED_TEST; /* XXX */
131 	sc->proto_bmpr13 = FE_B13_TPTYPE_UTP | FE_B13_PORT_AUTO;
132 
133 	/*
134 	 * Program the 86960 as following defaults:
135 	 *	SRAM: 32KB, 100ns, byte-wide access.
136 	 *	Transmission buffer: 4KB x 2.
137 	 *	System bus interface: 16 bits.
138 	 * These values except TXBSIZE should be modified as per
139 	 * sc_flags which is set in MD attachments, because they
140 	 * are hard-wired on the board. Modifying TXBSIZE will affect
141 	 * the driver performance.
142 	 */
143 	sc->proto_dlcr6 = FE_D6_BUFSIZ_32KB | FE_D6_TXBSIZ_2x4KB |
144 	    FE_D6_BBW_BYTE | FE_D6_SRAM_100ns;
145 	if (sc->sc_flags & FE_FLAGS_SBW_BYTE)
146 		sc->proto_dlcr6 |= FE_D6_SBW_BYTE;
147 	if (sc->sc_flags & FE_FLAGS_SRAM_150ns)
148 		sc->proto_dlcr6 &= ~FE_D6_SRAM_100ns;
149 
150 	/*
151 	 * Minimum initialization of the hardware.
152 	 * We write into registers; hope I/O ports have no
153 	 * overlap with other boards.
154 	 */
155 
156 	/* Initialize 86960. */
157 	bus_space_write_1(bst, bsh, FE_DLCR6,
158 	    sc->proto_dlcr6 | FE_D6_DLC_DISABLE);
159 	delay(200);
160 
161 #ifdef DIAGNOSTIC
162 	if (myea == NULL) {
163 		aprint_error_dev(sc->sc_dev,
164 		    "ethernet address shouldn't be NULL\n");
165 		panic("NULL ethernet address");
166 	}
167 #endif
168 	memcpy(sc->sc_enaddr, myea, sizeof(sc->sc_enaddr));
169 
170 	/* Disable all interrupts. */
171 	bus_space_write_1(bst, bsh, FE_DLCR2, 0);
172 	bus_space_write_1(bst, bsh, FE_DLCR3, 0);
173 }
174 
175 /*
176  * Install interface into kernel networking data structures
177  */
178 void
179 mb86960_config(struct mb86960_softc *sc, int *media, int nmedia, int defmedia)
180 {
181 	cfdata_t cf = device_cfdata(sc->sc_dev);
182 	struct ifnet *ifp = &sc->sc_ec.ec_if;
183 	int i;
184 
185 	/* Stop the 86960. */
186 	mb86960_stop(sc);
187 
188 	/* Initialize ifnet structure. */
189 	strlcpy(ifp->if_xname, device_xname(sc->sc_dev), IFNAMSIZ);
190 	ifp->if_softc = sc;
191 	ifp->if_start = mb86960_start;
192 	ifp->if_ioctl = mb86960_ioctl;
193 	ifp->if_watchdog = mb86960_watchdog;
194 	ifp->if_flags =
195 	    IFF_BROADCAST | IFF_SIMPLEX | IFF_NOTRAILERS | IFF_MULTICAST;
196 	IFQ_SET_READY(&ifp->if_snd);
197 
198 #if FE_DEBUG >= 3
199 	log(LOG_INFO, "%s: mb86960_config()\n", device_xname(sc->sc_dev));
200 	mb86960_dump(LOG_INFO, sc);
201 #endif
202 
203 #if FE_SINGLE_TRANSMISSION
204 	/* Override txb config to allocate minimum. */
205 	sc->proto_dlcr6 &= ~FE_D6_TXBSIZ;
206 	sc->proto_dlcr6 |=  FE_D6_TXBSIZ_2x2KB;
207 #endif
208 
209 	/* Modify hardware config if it is requested. */
210 	if ((cf->cf_flags & FE_FLAGS_OVERRIDE_DLCR6) != 0)
211 		sc->proto_dlcr6 = cf->cf_flags & FE_FLAGS_DLCR6_VALUE;
212 
213 	/* Find TX buffer size, based on the hardware dependent proto. */
214 	switch (sc->proto_dlcr6 & FE_D6_TXBSIZ) {
215 	case FE_D6_TXBSIZ_2x2KB:
216 		sc->txb_size = 2048;
217 		break;
218 	case FE_D6_TXBSIZ_2x4KB:
219 		sc->txb_size = 4096;
220 		break;
221 	case FE_D6_TXBSIZ_2x8KB:
222 		sc->txb_size = 8192;
223 		break;
224 	default:
225 		/* Oops, we can't work with single buffer configuration. */
226 #if FE_DEBUG >= 2
227 		log(LOG_WARNING, "%s: strange TXBSIZ config; fixing\n",
228 		    device_xname(sc->sc_dev));
229 #endif
230 		sc->proto_dlcr6 &= ~FE_D6_TXBSIZ;
231 		sc->proto_dlcr6 |=  FE_D6_TXBSIZ_2x2KB;
232 		sc->txb_size = 2048;
233 		break;
234 	}
235 
236 	/* Initialize media goo. */
237 	ifmedia_init(&sc->sc_media, 0, mb86960_mediachange,
238 	    mb86960_mediastatus);
239 	if (media != NULL) {
240 		for (i = 0; i < nmedia; i++)
241 			ifmedia_add(&sc->sc_media, media[i], 0, NULL);
242 		ifmedia_set(&sc->sc_media, defmedia);
243 	} else {
244 		ifmedia_add(&sc->sc_media, IFM_ETHER|IFM_MANUAL, 0, NULL);
245 		ifmedia_set(&sc->sc_media, IFM_ETHER|IFM_MANUAL);
246 	}
247 
248 	/* Attach the interface. */
249 	if_attach(ifp);
250 	if_deferred_start_init(ifp, NULL);
251 	ether_ifattach(ifp, sc->sc_enaddr);
252 
253 	rnd_attach_source(&sc->rnd_source, device_xname(sc->sc_dev),
254 	    RND_TYPE_NET, RND_FLAG_DEFAULT);
255 
256 	/* Print additional info when attached. */
257 	aprint_normal_dev(sc->sc_dev, "Ethernet address %s\n",
258 	    ether_sprintf(sc->sc_enaddr));
259 
260 #if FE_DEBUG >= 3
261 	{
262 		int buf, txb, bbw, sbw, ram;
263 
264 		buf = txb = bbw = sbw = ram = -1;
265 		switch (sc->proto_dlcr6 & FE_D6_BUFSIZ) {
266 		case FE_D6_BUFSIZ_8KB:
267 			buf = 8;
268 			break;
269 		case FE_D6_BUFSIZ_16KB:
270 			buf = 16;
271 			break;
272 		case FE_D6_BUFSIZ_32KB:
273 			buf = 32;
274 			break;
275 		case FE_D6_BUFSIZ_64KB:
276 			buf = 64;
277 			break;
278 		}
279 		switch (sc->proto_dlcr6 & FE_D6_TXBSIZ) {
280 		case FE_D6_TXBSIZ_2x2KB:
281 			txb = 2;
282 			break;
283 		case FE_D6_TXBSIZ_2x4KB:
284 			txb = 4;
285 			break;
286 		case FE_D6_TXBSIZ_2x8KB:
287 			txb = 8;
288 			break;
289 		}
290 		switch (sc->proto_dlcr6 & FE_D6_BBW) {
291 		case FE_D6_BBW_BYTE:
292 			bbw = 8;
293 			break;
294 		case FE_D6_BBW_WORD:
295 			bbw = 16;
296 			break;
297 		}
298 		switch (sc->proto_dlcr6 & FE_D6_SBW) {
299 		case FE_D6_SBW_BYTE:
300 			sbw = 8;
301 			break;
302 		case FE_D6_SBW_WORD:
303 			sbw = 16;
304 			break;
305 		}
306 		switch (sc->proto_dlcr6 & FE_D6_SRAM) {
307 		case FE_D6_SRAM_100ns:
308 			ram = 100;
309 			break;
310 		case FE_D6_SRAM_150ns:
311 			ram = 150;
312 			break;
313 		}
314 		aprint_debug_dev(sc->sc_dev,
315 		    "SRAM %dKB %dbit %dns, TXB %dKBx2, %dbit I/O\n",
316 		    buf, bbw, ram, txb, sbw);
317 	}
318 #endif
319 
320 	/* The attach is successful. */
321 	sc->sc_stat |= FE_STAT_ATTACHED;
322 }
323 
324 /*
325  * Media change callback.
326  */
327 int
328 mb86960_mediachange(struct ifnet *ifp)
329 {
330 	struct mb86960_softc *sc = ifp->if_softc;
331 
332 	if (sc->sc_mediachange)
333 		return (*sc->sc_mediachange)(sc);
334 	return 0;
335 }
336 
337 /*
338  * Media status callback.
339  */
340 void
341 mb86960_mediastatus(struct ifnet *ifp, struct ifmediareq *ifmr)
342 {
343 	struct mb86960_softc *sc = ifp->if_softc;
344 
345 	if ((sc->sc_stat & FE_STAT_ENABLED) == 0) {
346 		ifmr->ifm_active = IFM_ETHER | IFM_NONE;
347 		ifmr->ifm_status = 0;
348 		return;
349 	}
350 
351 	if (sc->sc_mediastatus)
352 		(*sc->sc_mediastatus)(sc, ifmr);
353 }
354 
355 /*
356  * Reset interface.
357  */
358 void
359 mb86960_reset(struct mb86960_softc *sc)
360 {
361 	int s;
362 
363 	s = splnet();
364 	mb86960_stop(sc);
365 	mb86960_init(sc);
366 	splx(s);
367 }
368 
369 /*
370  * Stop everything on the interface.
371  *
372  * All buffered packets, both transmitting and receiving,
373  * if any, will be lost by stopping the interface.
374  */
375 void
376 mb86960_stop(struct mb86960_softc *sc)
377 {
378 	bus_space_tag_t bst = sc->sc_bst;
379 	bus_space_handle_t bsh = sc->sc_bsh;
380 
381 #if FE_DEBUG >= 3
382 	log(LOG_INFO, "%s: top of mb86960_stop()\n", device_xname(sc->sc_dev));
383 	mb86960_dump(LOG_INFO, sc);
384 #endif
385 
386 	/* Disable interrupts. */
387 	bus_space_write_1(bst, bsh, FE_DLCR2, 0x00);
388 	bus_space_write_1(bst, bsh, FE_DLCR3, 0x00);
389 
390 	/* Stop interface hardware. */
391 	delay(200);
392 	bus_space_write_1(bst, bsh, FE_DLCR6,
393 	    sc->proto_dlcr6 | FE_D6_DLC_DISABLE);
394 	delay(200);
395 
396 	/* Clear all interrupt status. */
397 	bus_space_write_1(bst, bsh, FE_DLCR0, 0xFF);
398 	bus_space_write_1(bst, bsh, FE_DLCR1, 0xFF);
399 
400 	/* Put the chip in stand-by mode. */
401 	delay(200);
402 	bus_space_write_1(bst, bsh, FE_DLCR7,
403 	    sc->proto_dlcr7 | FE_D7_POWER_DOWN);
404 	delay(200);
405 
406 	/* MAR loading can be delayed. */
407 	sc->filter_change = 0;
408 
409 	/* Call a hook. */
410 	if (sc->stop_card)
411 		(*sc->stop_card)(sc);
412 
413 #if FE_DEBUG >= 3
414 	log(LOG_INFO, "%s: end of mb86960_stop()\n", device_xname(sc->sc_dev));
415 	mb86960_dump(LOG_INFO, sc);
416 #endif
417 }
418 
419 /*
420  * Device timeout/watchdog routine. Entered if the device neglects to
421  * generate an interrupt after a transmit has been started on it.
422  */
423 void
424 mb86960_watchdog(struct ifnet *ifp)
425 {
426 	struct mb86960_softc *sc = ifp->if_softc;
427 
428 	log(LOG_ERR, "%s: device timeout\n", device_xname(sc->sc_dev));
429 #if FE_DEBUG >= 3
430 	mb86960_dump(LOG_INFO, sc);
431 #endif
432 
433 	/* Record how many packets are lost by this accident. */
434 	sc->sc_ec.ec_if.if_oerrors += sc->txb_sched + sc->txb_count;
435 
436 	mb86960_reset(sc);
437 }
438 
439 /*
440  * Drop (skip) a packet from receive buffer in 86960 memory.
441  */
442 static inline void
443 mb86960_droppacket(struct mb86960_softc *sc)
444 {
445 	bus_space_tag_t bst = sc->sc_bst;
446 	bus_space_handle_t bsh = sc->sc_bsh;
447 
448 	bus_space_write_1(bst, bsh, FE_BMPR14, FE_B14_FILTER | FE_B14_SKIP);
449 }
450 
451 /*
452  * Initialize device.
453  */
454 void
455 mb86960_init(struct mb86960_softc *sc)
456 {
457 	bus_space_tag_t bst = sc->sc_bst;
458 	bus_space_handle_t bsh = sc->sc_bsh;
459 	struct ifnet *ifp = &sc->sc_ec.ec_if;
460 	int i;
461 
462 #if FE_DEBUG >= 3
463 	log(LOG_INFO, "%s: top of mb86960_init()\n", device_xname(sc->sc_dev));
464 	mb86960_dump(LOG_INFO, sc);
465 #endif
466 
467 	/* Reset transmitter flags. */
468 	ifp->if_flags &= ~IFF_OACTIVE;
469 	ifp->if_timer = 0;
470 
471 	sc->txb_free = sc->txb_size;
472 	sc->txb_count = 0;
473 	sc->txb_sched = 0;
474 
475 	/* Do any card-specific initialization, if applicable. */
476 	if (sc->init_card)
477 		(*sc->init_card)(sc);
478 
479 #if FE_DEBUG >= 3
480 	log(LOG_INFO, "%s: after init hook\n", device_xname(sc->sc_dev));
481 	mb86960_dump(LOG_INFO, sc);
482 #endif
483 
484 	/*
485 	 * Make sure to disable the chip, also.
486 	 * This may also help re-programming the chip after
487 	 * hot insertion of PCMCIAs.
488 	 */
489 	bus_space_write_1(bst, bsh, FE_DLCR6,
490 	    sc->proto_dlcr6 | FE_D6_DLC_DISABLE);
491 	delay(200);
492 
493 	/* Power up the chip and select register bank for DLCRs. */
494 	bus_space_write_1(bst, bsh, FE_DLCR7,
495 	    sc->proto_dlcr7 | FE_D7_RBS_DLCR | FE_D7_POWER_UP);
496 	delay(200);
497 
498 	/* Feed the station address. */
499 	bus_space_write_region_1(bst, bsh, FE_DLCR8,
500 	    sc->sc_enaddr, ETHER_ADDR_LEN);
501 
502 	/* Select the BMPR bank for runtime register access. */
503 	bus_space_write_1(bst, bsh, FE_DLCR7,
504 	    sc->proto_dlcr7 | FE_D7_RBS_BMPR | FE_D7_POWER_UP);
505 
506 	/* Initialize registers. */
507 	bus_space_write_1(bst, bsh, FE_DLCR0, 0xFF);	/* Clear all bits. */
508 	bus_space_write_1(bst, bsh, FE_DLCR1, 0xFF);	/* ditto. */
509 	bus_space_write_1(bst, bsh, FE_DLCR2, 0x00);
510 	bus_space_write_1(bst, bsh, FE_DLCR3, 0x00);
511 	bus_space_write_1(bst, bsh, FE_DLCR4, sc->proto_dlcr4);
512 	bus_space_write_1(bst, bsh, FE_DLCR5, sc->proto_dlcr5);
513 	bus_space_write_1(bst, bsh, FE_BMPR10, 0x00);
514 	bus_space_write_1(bst, bsh, FE_BMPR11, FE_B11_CTRL_SKIP);
515 	bus_space_write_1(bst, bsh, FE_BMPR12, 0x00);
516 	bus_space_write_1(bst, bsh, FE_BMPR13, sc->proto_bmpr13);
517 	bus_space_write_1(bst, bsh, FE_BMPR14, FE_B14_FILTER);
518 	bus_space_write_1(bst, bsh, FE_BMPR15, 0x00);
519 
520 #if FE_DEBUG >= 3
521 	log(LOG_INFO, "%s: just before enabling DLC\n",
522 	    device_xname(sc->sc_dev));
523 	mb86960_dump(LOG_INFO, sc);
524 #endif
525 
526 	/* Enable interrupts. */
527 	bus_space_write_1(bst, bsh, FE_DLCR2, FE_TMASK);
528 	bus_space_write_1(bst, bsh, FE_DLCR3, FE_RMASK);
529 
530 	/* Enable transmitter and receiver. */
531 	delay(200);
532 	bus_space_write_1(bst, bsh, FE_DLCR6,
533 	    sc->proto_dlcr6 | FE_D6_DLC_ENABLE);
534 	delay(200);
535 
536 #if FE_DEBUG >= 3
537 	log(LOG_INFO, "%s: just after enabling DLC\n",
538 	    device_xname(sc->sc_dev));
539 	mb86960_dump(LOG_INFO, sc);
540 #endif
541 
542 	/*
543 	 * Make sure to empty the receive buffer.
544 	 *
545 	 * This may be redundant, but *if* the receive buffer were full
546 	 * at this point, the driver would hang.  I have experienced
547 	 * some strange hangups just after UP.  I hope the following
548 	 * code solve the problem.
549 	 *
550 	 * I have changed the order of hardware initialization.
551 	 * I think the receive buffer cannot have any packets at this
552 	 * point in this version.  The following code *must* be
553 	 * redundant now.  FIXME.
554 	 */
555 	for (i = 0; i < FE_MAX_RECV_COUNT; i++) {
556 		if (bus_space_read_1(bst, bsh, FE_DLCR5) & FE_D5_BUFEMP)
557 			break;
558 		mb86960_droppacket(sc);
559 	}
560 #if FE_DEBUG >= 1
561 	if (i >= FE_MAX_RECV_COUNT)
562 		log(LOG_ERR, "%s: cannot empty receive buffer\n",
563 		    device_xname(sc->sc_dev));
564 #endif
565 #if FE_DEBUG >= 3
566 	if (i < FE_MAX_RECV_COUNT)
567 		log(LOG_INFO, "%s: receive buffer emptied (%d)\n",
568 		    device_xname(sc->sc_dev), i);
569 #endif
570 
571 #if FE_DEBUG >= 3
572 	log(LOG_INFO, "%s: after ERB loop\n", device_xname(sc->sc_dev));
573 	mb86960_dump(LOG_INFO, sc);
574 #endif
575 
576 	/* Do we need this here? */
577 	bus_space_write_1(bst, bsh, FE_DLCR0, 0xFF);	/* Clear all bits. */
578 	bus_space_write_1(bst, bsh, FE_DLCR1, 0xFF);	/* ditto. */
579 
580 #if FE_DEBUG >= 3
581 	log(LOG_INFO, "%s: after FIXME\n", device_xname(sc->sc_dev));
582 	mb86960_dump(LOG_INFO, sc);
583 #endif
584 
585 	/* Set 'running' flag. */
586 	ifp->if_flags |= IFF_RUNNING;
587 
588 	/*
589 	 * At this point, the interface is runnung properly,
590 	 * except that it receives *no* packets.  we then call
591 	 * mb86960_setmode() to tell the chip what packets to be
592 	 * received, based on the if_flags and multicast group
593 	 * list.  It completes the initialization process.
594 	 */
595 	mb86960_setmode(sc);
596 
597 #if FE_DEBUG >= 3
598 	log(LOG_INFO, "%s: after setmode\n", device_xname(sc->sc_dev));
599 	mb86960_dump(LOG_INFO, sc);
600 #endif
601 
602 	/* ...and attempt to start output. */
603 	mb86960_start(ifp);
604 
605 #if FE_DEBUG >= 3
606 	log(LOG_INFO, "%s: end of mb86960_init()\n", device_xname(sc->sc_dev));
607 	mb86960_dump(LOG_INFO, sc);
608 #endif
609 }
610 
611 /*
612  * This routine actually starts the transmission on the interface
613  */
614 static inline void
615 mb86960_xmit(struct mb86960_softc *sc)
616 {
617 	bus_space_tag_t bst = sc->sc_bst;
618 	bus_space_handle_t bsh = sc->sc_bsh;
619 
620 	/*
621 	 * Set a timer just in case we never hear from the board again.
622 	 * We use longer timeout for multiple packet transmission.
623 	 * I'm not sure this timer value is appropriate.  FIXME.
624 	 */
625 	sc->sc_ec.ec_if.if_timer = 1 + sc->txb_count;
626 
627 	/* Update txb variables. */
628 	sc->txb_sched = sc->txb_count;
629 	sc->txb_count = 0;
630 	sc->txb_free = sc->txb_size;
631 
632 #if FE_DELAYED_PADDING
633 	/* Omit the postponed padding process. */
634 	sc->txb_padding = 0;
635 #endif
636 
637 	/* Start transmitter, passing packets in TX buffer. */
638 	bus_space_write_1(bst, bsh, FE_BMPR10, sc->txb_sched | FE_B10_START);
639 }
640 
641 /*
642  * Start output on interface.
643  * We make two assumptions here:
644  *  1) that the current priority is set to splnet _before_ this code
645  *     is called *and* is returned to the appropriate priority after
646  *     return
647  *  2) that the IFF_OACTIVE flag is checked before this code is called
648  *     (i.e. that the output part of the interface is idle)
649  */
650 void
651 mb86960_start(struct ifnet *ifp)
652 {
653 	struct mb86960_softc *sc = ifp->if_softc;
654 	struct mbuf *m;
655 
656 #if FE_DEBUG >= 1
657 	/* Just a sanity check. */
658 	if ((sc->txb_count == 0) != (sc->txb_free == sc->txb_size)) {
659 		/*
660 		 * Txb_count and txb_free co-works to manage the
661 		 * transmission buffer.  Txb_count keeps track of the
662 		 * used potion of the buffer, while txb_free does unused
663 		 * potion.  So, as long as the driver runs properly,
664 		 * txb_count is zero if and only if txb_free is same
665 		 * as txb_size (which represents whole buffer.)
666 		 */
667 		log(LOG_ERR, "%s: inconsistent txb variables (%d, %d)\n",
668 		    device_xname(sc->sc_dev), sc->txb_count, sc->txb_free);
669 		/*
670 		 * So, what should I do, then?
671 		 *
672 		 * We now know txb_count and txb_free contradicts.  We
673 		 * cannot, however, tell which is wrong.  More
674 		 * over, we cannot peek 86960 transmission buffer or
675 		 * reset the transmission buffer.  (In fact, we can
676 		 * reset the entire interface.  I don't want to do it.)
677 		 *
678 		 * If txb_count is incorrect, leaving it as is will cause
679 		 * sending of garbage after the next interrupt.  We have to
680 		 * avoid it.  Hence, we reset the txb_count here.  If
681 		 * txb_free was incorrect, resetting txb_count just loose
682 		 * some packets.  We can live with it.
683 		 */
684 		sc->txb_count = 0;
685 	}
686 #endif
687 
688 #if FE_DEBUG >= 1
689 	/*
690 	 * First, see if there are buffered packets and an idle
691 	 * transmitter - should never happen at this point.
692 	 */
693 	if ((sc->txb_count > 0) && (sc->txb_sched == 0)) {
694 		log(LOG_ERR, "%s: transmitter idle with %d buffered packets\n",
695 		    device_xname(sc->sc_dev), sc->txb_count);
696 		mb86960_xmit(sc);
697 	}
698 #endif
699 
700 	/*
701 	 * Stop accepting more transmission packets temporarily, when
702 	 * a filter change request is delayed.  Updating the MARs on
703 	 * 86960 flushes the transmisstion buffer, so it is delayed
704 	 * until all buffered transmission packets have been sent
705 	 * out.
706 	 */
707 	if (sc->filter_change) {
708 		/*
709 		 * Filter change request is delayed only when the DLC is
710 		 * working.  DLC soon raise an interrupt after finishing
711 		 * the work.
712 		 */
713 		goto indicate_active;
714 	}
715 
716 	for (;;) {
717 		/*
718 		 * See if there is room to put another packet in the buffer.
719 		 * We *could* do better job by peeking the send queue to
720 		 * know the length of the next packet.  Current version just
721 		 * tests against the worst case (i.e., longest packet).  FIXME.
722 		 *
723 		 * When adding the packet-peek feature, don't forget adding a
724 		 * test on txb_count against QUEUEING_MAX.
725 		 * There is a little chance the packet count exceeds
726 		 * the limit.  Assume transmission buffer is 8KB (2x8KB
727 		 * configuration) and an application sends a bunch of small
728 		 * (i.e., minimum packet sized) packets rapidly.  An 8KB
729 		 * buffer can hold 130 blocks of 62 bytes long...
730 		 */
731 		if (sc->txb_free <
732 		    (ETHER_MAX_LEN - ETHER_CRC_LEN) + FE_TXLEN_SIZE) {
733 			/* No room. */
734 			goto indicate_active;
735 		}
736 
737 #if FE_SINGLE_TRANSMISSION
738 		if (sc->txb_count > 0) {
739 			/* Just one packet per a transmission buffer. */
740 			goto indicate_active;
741 		}
742 #endif
743 
744 		/*
745 		 * Get the next mbuf chain for a packet to send.
746 		 */
747 		IFQ_DEQUEUE(&ifp->if_snd, m);
748 		if (m == 0) {
749 			/* No more packets to send. */
750 			goto indicate_inactive;
751 		}
752 
753 		/* Tap off here if there is a BPF listener. */
754 		bpf_mtap(ifp, m);
755 
756 		/*
757 		 * Copy the mbuf chain into the transmission buffer.
758 		 * txb_* variables are updated as necessary.
759 		 */
760 		mb86960_write_mbufs(sc, m);
761 
762 		m_freem(m);
763 
764 		/* Start transmitter if it's idle. */
765 		if (sc->txb_sched == 0)
766 			mb86960_xmit(sc);
767 	}
768 
769 indicate_inactive:
770 	/*
771 	 * We are using the !OACTIVE flag to indicate to
772 	 * the outside world that we can accept an
773 	 * additional packet rather than that the
774 	 * transmitter is _actually_ active.  Indeed, the
775 	 * transmitter may be active, but if we haven't
776 	 * filled all the buffers with data then we still
777 	 * want to accept more.
778 	 */
779 	ifp->if_flags &= ~IFF_OACTIVE;
780 	return;
781 
782 indicate_active:
783 	/*
784 	 * The transmitter is active, and there are no room for
785 	 * more outgoing packets in the transmission buffer.
786 	 */
787 	ifp->if_flags |= IFF_OACTIVE;
788 	return;
789 }
790 
791 /*
792  * Transmission interrupt handler
793  * The control flow of this function looks silly.  FIXME.
794  */
795 void
796 mb86960_tint(struct mb86960_softc *sc, uint8_t tstat)
797 {
798 	bus_space_tag_t bst = sc->sc_bst;
799 	bus_space_handle_t bsh = sc->sc_bsh;
800 	struct ifnet *ifp = &sc->sc_ec.ec_if;
801 	int left;
802 	int col;
803 
804 	/*
805 	 * Handle "excessive collision" interrupt.
806 	 */
807 	if (tstat & FE_D0_COLL16) {
808 		/*
809 		 * Find how many packets (including this collided one)
810 		 * are left unsent in transmission buffer.
811 		 */
812 		left = bus_space_read_1(bst, bsh, FE_BMPR10);
813 
814 #if FE_DEBUG >= 2
815 		log(LOG_WARNING, "%s: excessive collision (%d/%d)\n",
816 		    device_xname(sc->sc_dev), left, sc->txb_sched);
817 #endif
818 #if FE_DEBUG >= 3
819 		mb86960_dump(LOG_INFO, sc);
820 #endif
821 
822 		/*
823 		 * Update statistics.
824 		 */
825 		ifp->if_collisions += 16;
826 		ifp->if_oerrors++;
827 		ifp->if_opackets += sc->txb_sched - left;
828 
829 		/*
830 		 * Collision statistics has been updated.
831 		 * Clear the collision flag on 86960 now to avoid confusion.
832 		 */
833 		bus_space_write_1(bst, bsh, FE_DLCR0, FE_D0_COLLID);
834 
835 		/*
836 		 * Restart transmitter, skipping the
837 		 * collided packet.
838 		 *
839 		 * We *must* skip the packet to keep network running
840 		 * properly.  Excessive collision error is an
841 		 * indication of the network overload.  If we
842 		 * tried sending the same packet after excessive
843 		 * collision, the network would be filled with
844 		 * out-of-time packets.  Packets belonging
845 		 * to reliable transport (such as TCP) are resent
846 		 * by some upper layer.
847 		 */
848 		bus_space_write_1(bst, bsh, FE_BMPR11,
849 		    FE_B11_CTRL_SKIP | FE_B11_MODE1);
850 		sc->txb_sched = left - 1;
851 	}
852 
853 	/*
854 	 * Handle "transmission complete" interrupt.
855 	 */
856 	if (tstat & FE_D0_TXDONE) {
857 		/*
858 		 * Add in total number of collisions on last
859 		 * transmission.  We also clear "collision occurred" flag
860 		 * here.
861 		 *
862 		 * 86960 has a design flow on collision count on multiple
863 		 * packet transmission.  When we send two or more packets
864 		 * with one start command (that's what we do when the
865 		 * transmission queue is clauded), 86960 informs us number
866 		 * of collisions occurred on the last packet on the
867 		 * transmission only.  Number of collisions on previous
868 		 * packets are lost.  I have told that the fact is clearly
869 		 * stated in the Fujitsu document.
870 		 *
871 		 * I considered not to mind it seriously.  Collision
872 		 * count is not so important, anyway.  Any comments?  FIXME.
873 		 */
874 
875 		if (bus_space_read_1(bst, bsh, FE_DLCR0) & FE_D0_COLLID) {
876 			/* Clear collision flag. */
877 			bus_space_write_1(bst, bsh, FE_DLCR0, FE_D0_COLLID);
878 
879 			/* Extract collision count from 86960. */
880 			col = bus_space_read_1(bst, bsh, FE_DLCR4) & FE_D4_COL;
881 			if (col == 0) {
882 				/*
883 				 * Status register indicates collisions,
884 				 * while the collision count is zero.
885 				 * This can happen after multiple packet
886 				 * transmission, indicating that one or more
887 				 * previous packet(s) had been collided.
888 				 *
889 				 * Since the accurate number of collisions
890 				 * has been lost, we just guess it as 1;
891 				 * Am I too optimistic?  FIXME.
892 				 */
893 				col = 1;
894 			} else
895 				col >>= FE_D4_COL_SHIFT;
896 			ifp->if_collisions += col;
897 #if FE_DEBUG >= 4
898 			log(LOG_WARNING, "%s: %d collision%s (%d)\n",
899 			    device_xname(sc->sc_dev), col, col == 1 ? "" : "s",
900 			    sc->txb_sched);
901 #endif
902 		}
903 
904 		/*
905 		 * Update total number of successfully
906 		 * transmitted packets.
907 		 */
908 		ifp->if_opackets += sc->txb_sched;
909 		sc->txb_sched = 0;
910 	}
911 
912 	if (sc->txb_sched == 0) {
913 		/*
914 		 * The transmitter is no more active.
915 		 * Reset output active flag and watchdog timer.
916 		 */
917 		ifp->if_flags &= ~IFF_OACTIVE;
918 		ifp->if_timer = 0;
919 
920 		/*
921 		 * If more data is ready to transmit in the buffer, start
922 		 * transmitting them.  Otherwise keep transmitter idle,
923 		 * even if more data is queued.  This gives receive
924 		 * process a slight priority.
925 		 */
926 		if (sc->txb_count > 0)
927 			mb86960_xmit(sc);
928 	}
929 }
930 
931 /*
932  * Ethernet interface receiver interrupt.
933  */
934 void
935 mb86960_rint(struct mb86960_softc *sc, uint8_t rstat)
936 {
937 	bus_space_tag_t bst = sc->sc_bst;
938 	bus_space_handle_t bsh = sc->sc_bsh;
939 	struct ifnet *ifp = &sc->sc_ec.ec_if;
940 	u_int status, len;
941 	int i;
942 
943 	/*
944 	 * Update statistics if this interrupt is caused by an error.
945 	 */
946 	if (rstat & (FE_D1_OVRFLO | FE_D1_CRCERR | FE_D1_ALGERR |
947 	    FE_D1_SRTPKT)) {
948 #if FE_DEBUG >= 3
949 		char sbuf[sizeof(FE_D1_ERRBITS) + 64];
950 
951 		snprintb(sbuf, sizeof(sbuf), FE_D1_ERRBITS, rstat);
952 		log(LOG_WARNING, "%s: receive error: %s\n",
953 		    device_xname(sc->sc_dev), sbuf);
954 #endif
955 		ifp->if_ierrors++;
956 	}
957 
958 	/*
959 	 * MB86960 has a flag indicating "receive queue empty."
960 	 * We just loop checking the flag to pull out all received
961 	 * packets.
962 	 *
963 	 * We limit the number of iterrations to avoid infinite loop.
964 	 * It can be caused by a very slow CPU (some broken
965 	 * peripheral may insert incredible number of wait cycles)
966 	 * or, worse, by a broken MB86960 chip.
967 	 */
968 	for (i = 0; i < FE_MAX_RECV_COUNT; i++) {
969 		/* Stop the iterration if 86960 indicates no packets. */
970 		if (bus_space_read_1(bst, bsh, FE_DLCR5) & FE_D5_BUFEMP)
971 			break;
972 
973 		/*
974 		 * Extract receive packet status from the receive
975 		 * packet header.
976 		 */
977 		if (sc->sc_flags & FE_FLAGS_SBW_BYTE) {
978 			status = bus_space_read_1(bst, bsh, FE_BMPR8);
979 			(void)bus_space_read_1(bst, bsh, FE_BMPR8);
980 		} else
981 			status = bus_space_read_2(bst, bsh, FE_BMPR8);
982 
983 #if FE_DEBUG >= 4
984 		log(LOG_INFO, "%s: receive status = %02x\n",
985 		    device_xname(sc->sc_dev), status);
986 #endif
987 
988 		/*
989 		 * If there was an error, update statistics and drop
990 		 * the packet, unless the interface is in promiscuous
991 		 * mode.
992 		 */
993 		if ((status & FE_RXSTAT_GOODPKT) == 0) {
994 			if ((ifp->if_flags & IFF_PROMISC) == 0) {
995 				ifp->if_ierrors++;
996 				mb86960_droppacket(sc);
997 				continue;
998 			}
999 		}
1000 
1001 		/*
1002 		 * Extract the packet length from the receive packet header.
1003 		 * It is a sum of a header (14 bytes) and a payload.
1004 		 * CRC has been stripped off by the 86960.
1005 		 */
1006 		if (sc->sc_flags & FE_FLAGS_SBW_BYTE) {
1007 			len  = bus_space_read_1(bst, bsh, FE_BMPR8);
1008 			len |= bus_space_read_1(bst, bsh, FE_BMPR8) << 8;
1009 		} else
1010 			len = bus_space_read_2(bst, bsh, FE_BMPR8);
1011 
1012 		/*
1013 		 * MB86965 checks the packet length and drop big packet
1014 		 * before passing it to us.  There are no chance we can
1015 		 * get [crufty] packets.  Hence, if the length exceeds
1016 		 * the specified limit, it means some serious failure,
1017 		 * such as out-of-sync on receive buffer management.
1018 		 *
1019 		 * Is this statement true?  FIXME.
1020 		 */
1021 		if (len > (ETHER_MAX_LEN - ETHER_CRC_LEN) ||
1022 		    len < ETHER_HDR_LEN) {
1023 #if FE_DEBUG >= 2
1024 			log(LOG_WARNING,
1025 			    "%s: received a %s packet? (%u bytes)\n",
1026 			    device_xname(sc->sc_dev),
1027 			    len < ETHER_HDR_LEN ? "partial" : "big", len);
1028 #endif
1029 			ifp->if_ierrors++;
1030 			mb86960_droppacket(sc);
1031 			continue;
1032 		}
1033 
1034 		/*
1035 		 * Check for a short (RUNT) packet.  We *do* check
1036 		 * but do nothing other than print a message.
1037 		 * Short packets are illegal, but does nothing bad
1038 		 * if it carries data for upper layer.
1039 		 */
1040 #if FE_DEBUG >= 2
1041 		if (len < (ETHER_MIN_LEN - ETHER_CRC_LEN)) {
1042 			log(LOG_WARNING,
1043 			    "%s: received a short packet? (%u bytes)\n",
1044 			    device_xname(sc->sc_dev), len);
1045 		}
1046 #endif
1047 
1048 		/*
1049 		 * Go get a packet.
1050 		 */
1051 		if (mb86960_get_packet(sc, len) == 0) {
1052 			/* Skip a packet, updating statistics. */
1053 #if FE_DEBUG >= 2
1054 			log(LOG_WARNING,
1055 			    "%s: out of mbufs; dropping packet (%u bytes)\n",
1056 			    device_xname(sc->sc_dev), len);
1057 #endif
1058 			ifp->if_ierrors++;
1059 			mb86960_droppacket(sc);
1060 
1061 			/*
1062 			 * We stop receiving packets, even if there are
1063 			 * more in the buffer.  We hope we can get more
1064 			 * mbufs next time.
1065 			 */
1066 			return;
1067 		}
1068 	}
1069 }
1070 
1071 /*
1072  * Ethernet interface interrupt processor
1073  */
1074 int
1075 mb86960_intr(void *arg)
1076 {
1077 	struct mb86960_softc *sc = arg;
1078 	bus_space_tag_t bst = sc->sc_bst;
1079 	bus_space_handle_t bsh = sc->sc_bsh;
1080 	struct ifnet *ifp = &sc->sc_ec.ec_if;
1081 	uint8_t tstat, rstat;
1082 
1083 	if ((sc->sc_stat & FE_STAT_ENABLED) == 0 ||
1084 	    !device_is_active(sc->sc_dev))
1085 		return 0;
1086 
1087 #if FE_DEBUG >= 4
1088 	log(LOG_INFO, "%s: mb86960_intr()\n", device_xname(sc->sc_dev));
1089 	mb86960_dump(LOG_INFO, sc);
1090 #endif
1091 
1092 	/*
1093 	 * Get interrupt conditions, masking unneeded flags.
1094 	 */
1095 	tstat = bus_space_read_1(bst, bsh, FE_DLCR0) & FE_TMASK;
1096 	rstat = bus_space_read_1(bst, bsh, FE_DLCR1) & FE_RMASK;
1097 	if (tstat == 0 && rstat == 0)
1098 		return 0;
1099 
1100 	/*
1101 	 * Loop until there are no more new interrupt conditions.
1102 	 */
1103 	for (;;) {
1104 		/*
1105 		 * Reset the conditions we are acknowledging.
1106 		 */
1107 		bus_space_write_1(bst, bsh, FE_DLCR0, tstat);
1108 		bus_space_write_1(bst, bsh, FE_DLCR1, rstat);
1109 
1110 		/*
1111 		 * Handle transmitter interrupts. Handle these first because
1112 		 * the receiver will reset the board under some conditions.
1113 		 */
1114 		if (tstat != 0)
1115 			mb86960_tint(sc, tstat);
1116 
1117 		/*
1118 		 * Handle receiver interrupts.
1119 		 */
1120 		if (rstat != 0)
1121 			mb86960_rint(sc, rstat);
1122 
1123 		/*
1124 		 * Update the multicast address filter if it is
1125 		 * needed and possible.  We do it now, because
1126 		 * we can make sure the transmission buffer is empty,
1127 		 * and there is a good chance that the receive queue
1128 		 * is empty.  It will minimize the possibility of
1129 		 * packet lossage.
1130 		 */
1131 		if (sc->filter_change &&
1132 		    sc->txb_count == 0 && sc->txb_sched == 0) {
1133 			mb86960_loadmar(sc);
1134 			ifp->if_flags &= ~IFF_OACTIVE;
1135 		}
1136 
1137 		/*
1138 		 * If it looks like the transmitter can take more data,
1139 		 * attempt to start output on the interface. This is done
1140 		 * after handling the receiver interrupt to give the
1141 		 * receive operation priority.
1142 		 */
1143 		if ((ifp->if_flags & IFF_OACTIVE) == 0)
1144 			if_schedule_deferred_start(ifp);
1145 
1146 		if (rstat != 0 || tstat != 0)
1147 			rnd_add_uint32(&sc->rnd_source, rstat + tstat);
1148 
1149 		/*
1150 		 * Get interrupt conditions, masking unneeded flags.
1151 		 */
1152 		tstat = bus_space_read_1(bst, bsh, FE_DLCR0) & FE_TMASK;
1153 		rstat = bus_space_read_1(bst, bsh, FE_DLCR1) & FE_RMASK;
1154 		if (tstat == 0 && rstat == 0)
1155 			return 1;
1156 	}
1157 }
1158 
1159 /*
1160  * Process an ioctl request.  This code needs some work - it looks pretty ugly.
1161  */
1162 int
1163 mb86960_ioctl(struct ifnet *ifp, u_long cmd, void *data)
1164 {
1165 	struct mb86960_softc *sc = ifp->if_softc;
1166 	struct ifaddr *ifa = (struct ifaddr *)data;
1167 	struct ifreq *ifr = (struct ifreq *)data;
1168 	int s, error = 0;
1169 
1170 #if FE_DEBUG >= 3
1171 	log(LOG_INFO, "%s: ioctl(%lx)\n", device_xname(sc->sc_dev), cmd);
1172 #endif
1173 
1174 	s = splnet();
1175 
1176 	switch (cmd) {
1177 	case SIOCINITIFADDR:
1178 		if ((error = mb86960_enable(sc)) != 0)
1179 			break;
1180 		ifp->if_flags |= IFF_UP;
1181 
1182 		mb86960_init(sc);
1183 		switch (ifa->ifa_addr->sa_family) {
1184 #ifdef INET
1185 		case AF_INET:
1186 			arp_ifinit(ifp, ifa);
1187 			break;
1188 #endif
1189 		default:
1190 			break;
1191 		}
1192 		break;
1193 
1194 	case SIOCSIFFLAGS:
1195 		if ((error = ifioctl_common(ifp, cmd, data)) != 0)
1196 			break;
1197 		/* XXX re-use ether_ioctl() */
1198 		switch (ifp->if_flags & (IFF_UP|IFF_RUNNING)) {
1199 		case IFF_RUNNING:
1200 			/*
1201 			 * If interface is marked down and it is running, then
1202 			 * stop it.
1203 			 */
1204 			mb86960_stop(sc);
1205 			ifp->if_flags &= ~IFF_RUNNING;
1206 			mb86960_disable(sc);
1207 			break;
1208 		case IFF_UP:
1209 			/*
1210 			 * If interface is marked up and it is stopped, then
1211 			 * start it.
1212 			 */
1213 			if ((error = mb86960_enable(sc)) != 0)
1214 				break;
1215 			mb86960_init(sc);
1216 			break;
1217 		case IFF_UP|IFF_RUNNING:
1218 			/*
1219 			 * Reset the interface to pick up changes in any other
1220 			 * flags that affect hardware registers.
1221 			 */
1222 			mb86960_setmode(sc);
1223 			break;
1224 		case 0:
1225 			break;
1226 		}
1227 #if FE_DEBUG >= 1
1228 		/* "ifconfig fe0 debug" to print register dump. */
1229 		if (ifp->if_flags & IFF_DEBUG) {
1230 			log(LOG_INFO, "%s: SIOCSIFFLAGS(DEBUG)\n",
1231 			    device_xname(sc->sc_dev));
1232 			mb86960_dump(LOG_DEBUG, sc);
1233 		}
1234 #endif
1235 		break;
1236 
1237 	case SIOCADDMULTI:
1238 	case SIOCDELMULTI:
1239 		if ((sc->sc_stat & FE_STAT_ENABLED) == 0) {
1240 			error = EIO;
1241 			break;
1242 		}
1243 
1244 		/* Update our multicast list. */
1245 		if ((error = ether_ioctl(ifp, cmd, data)) == ENETRESET) {
1246 			/*
1247 			 * Multicast list has changed; set the hardware filter
1248 			 * accordingly.
1249 			 */
1250 			if (ifp->if_flags & IFF_RUNNING)
1251 				mb86960_setmode(sc);
1252 			error = 0;
1253 		}
1254 		break;
1255 
1256 	case SIOCGIFMEDIA:
1257 	case SIOCSIFMEDIA:
1258 		error = ifmedia_ioctl(ifp, ifr, &sc->sc_media, cmd);
1259 		break;
1260 
1261 	default:
1262 		error = ether_ioctl(ifp, cmd, data);
1263 		break;
1264 	}
1265 
1266 	splx(s);
1267 	return error;
1268 }
1269 
1270 /*
1271  * Retrieve packet from receive buffer and send to the next level up via
1272  * ether_input(). If there is a BPF listener, give a copy to BPF, too.
1273  * Returns 0 if success, -1 if error (i.e., mbuf allocation failure).
1274  */
1275 int
1276 mb86960_get_packet(struct mb86960_softc *sc, u_int len)
1277 {
1278 	bus_space_tag_t bst = sc->sc_bst;
1279 	bus_space_handle_t bsh = sc->sc_bsh;
1280 	struct ifnet *ifp = &sc->sc_ec.ec_if;
1281 	struct mbuf *m;
1282 
1283 	/* Allocate a header mbuf. */
1284 	MGETHDR(m, M_DONTWAIT, MT_DATA);
1285 	if (m == 0)
1286 		return 0;
1287 	m_set_rcvif(m, ifp);
1288 	m->m_pkthdr.len = len;
1289 
1290 	/* The following silliness is to make NFS happy. */
1291 #define	EROUND	((sizeof(struct ether_header) + 3) & ~3)
1292 #define	EOFF	(EROUND - sizeof(struct ether_header))
1293 
1294 	/*
1295 	 * Our strategy has one more problem.  There is a policy on
1296 	 * mbuf cluster allocation.  It says that we must have at
1297 	 * least MINCLSIZE (208 bytes) to allocate a cluster.  For a
1298 	 * packet of a size between (MHLEN - 2) to (MINCLSIZE - 2),
1299 	 * our code violates the rule...
1300 	 * On the other hand, the current code is short, simple,
1301 	 * and fast, however.  It does no harmful thing, just waists
1302 	 * some memory.  Any comments?  FIXME.
1303 	 */
1304 
1305 	/* Attach a cluster if this packet doesn't fit in a normal mbuf. */
1306 	if (len > MHLEN - EOFF) {
1307 		MCLGET(m, M_DONTWAIT);
1308 		if ((m->m_flags & M_EXT) == 0) {
1309 			m_freem(m);
1310 			return 0;
1311 		}
1312 	}
1313 
1314 	/*
1315 	 * The following assumes there is room for the ether header in the
1316 	 * header mbuf.
1317 	 */
1318 	m->m_data += EOFF;
1319 
1320 	/* Set the length of this packet. */
1321 	m->m_len = len;
1322 
1323 	/* Get a packet. */
1324 	if (sc->sc_flags & FE_FLAGS_SBW_BYTE)
1325 		bus_space_read_multi_1(bst, bsh, FE_BMPR8,
1326 		    mtod(m, uint8_t *), len);
1327 	else
1328 		bus_space_read_multi_stream_2(bst, bsh, FE_BMPR8,
1329 		    mtod(m, uint16_t *), (len + 1) >> 1);
1330 
1331 	if_percpuq_enqueue(ifp->if_percpuq, m);
1332 	return 1;
1333 }
1334 
1335 /*
1336  * Write an mbuf chain to the transmission buffer memory using 16 bit PIO.
1337  * Returns number of bytes actually written, including length word.
1338  *
1339  * If an mbuf chain is too long for an Ethernet frame, it is not sent.
1340  * Packets shorter than Ethernet minimum are legal, and we pad them
1341  * before sending out.  An exception is "partial" packets which are
1342  * shorter than mandatory Ethernet header.
1343  *
1344  * I wrote a code for an experimental "delayed padding" technique.
1345  * When employed, it postpones the padding process for short packets.
1346  * If xmit() occurred at the moment, the padding process is omitted, and
1347  * garbages are sent as pad data.  If next packet is stored in the
1348  * transmission buffer before xmit(), write_mbuf() pads the previous
1349  * packet before transmitting new packet.  This *may* gain the
1350  * system performance (slightly).
1351  */
1352 void
1353 mb86960_write_mbufs(struct mb86960_softc *sc, struct mbuf *m)
1354 {
1355 	bus_space_tag_t bst = sc->sc_bst;
1356 	bus_space_handle_t bsh = sc->sc_bsh;
1357 	int totlen, len;
1358 #if FE_DEBUG >= 2
1359 	struct mbuf *mp;
1360 #endif
1361 
1362 #if FE_DELAYED_PADDING
1363 	/* Do the "delayed padding." */
1364 	if (sc->txb_padding > 0) {
1365 		if (sc->sc_flags & FE_FLAGS_SBW_BYTE) {
1366 			for (len = sc->txb_padding; len > 0; len--)
1367 				bus_space_write_1(bst, bsh, FE_BMPR8, 0);
1368 		} else {
1369 			for (len = sc->txb_padding >> 1; len > 0; len--)
1370 				bus_space_write_2(bst, bsh, FE_BMPR8, 0);
1371 		}
1372 		sc->txb_padding = 0;
1373 	}
1374 #endif
1375 
1376 	/* We need to use m->m_pkthdr.len, so require the header */
1377 	if ((m->m_flags & M_PKTHDR) == 0)
1378 	  	panic("mb86960_write_mbufs: no header mbuf");
1379 
1380 #if FE_DEBUG >= 2
1381 	/* First, count up the total number of bytes to copy. */
1382 	for (totlen = 0, mp = m; mp != 0; mp = mp->m_next)
1383 		totlen += mp->m_len;
1384 	/* Check if this matches the one in the packet header. */
1385 	if (totlen != m->m_pkthdr.len)
1386 		log(LOG_WARNING, "%s: packet length mismatch? (%d/%d)\n",
1387 		    device_xname(sc->sc_dev), totlen, m->m_pkthdr.len);
1388 #else
1389 	/* Just use the length value in the packet header. */
1390 	totlen = m->m_pkthdr.len;
1391 #endif
1392 
1393 #if FE_DEBUG >= 1
1394 	/*
1395 	 * Should never send big packets.  If such a packet is passed,
1396 	 * it should be a bug of upper layer.  We just ignore it.
1397 	 * ... Partial (too short) packets, neither.
1398 	 */
1399 	if (totlen > (ETHER_MAX_LEN - ETHER_CRC_LEN) ||
1400 	    totlen < ETHER_HDR_LEN) {
1401 		log(LOG_ERR, "%s: got a %s packet (%u bytes) to send\n",
1402 		    device_xname(sc->sc_dev),
1403 		    totlen < ETHER_HDR_LEN ? "partial" : "big", totlen);
1404 		sc->sc_ec.ec_if.if_oerrors++;
1405 		return;
1406 	}
1407 #endif
1408 
1409 	/*
1410 	 * Put the length word for this frame.
1411 	 * Does 86960 accept odd length?  -- Yes.
1412 	 * Do we need to pad the length to minimum size by ourselves?
1413 	 * -- Generally yes.  But for (or will be) the last
1414 	 * packet in the transmission buffer, we can skip the
1415 	 * padding process.  It may gain performance slightly.  FIXME.
1416 	 */
1417 	len = max(totlen, (ETHER_MIN_LEN - ETHER_CRC_LEN));
1418 	if (sc->sc_flags & FE_FLAGS_SBW_BYTE) {
1419 		bus_space_write_1(bst, bsh, FE_BMPR8, len);
1420 		bus_space_write_1(bst, bsh, FE_BMPR8, len >> 8);
1421 	} else {
1422 		bus_space_write_2(bst, bsh, FE_BMPR8, len);
1423 		/* roundup packet length since we will use word access */
1424 		totlen = (totlen + 1) & ~1;
1425 	}
1426 
1427 	/*
1428 	 * Update buffer status now.
1429 	 * Truncate the length up to an even number
1430 	 * if the chip is set in SBW_WORD mode.
1431 	 */
1432 	sc->txb_free -= FE_TXLEN_SIZE +
1433 	    max(totlen, (ETHER_MIN_LEN - ETHER_CRC_LEN));
1434 	sc->txb_count++;
1435 
1436 #if FE_DELAYED_PADDING
1437 	/* Postpone the packet padding if necessary. */
1438 	if (totlen < (ETHER_MIN_LEN - ETHER_CRC_LEN))
1439 		sc->txb_padding = (ETHER_MIN_LEN - ETHER_CRC_LEN) - totlen;
1440 #endif
1441 
1442 	/*
1443 	 * Transfer the data from mbuf chain to the transmission buffer.
1444 	 * If the MB86960 is configured in word mode, data needs to be
1445 	 * transferred as words, and only words.
1446 	 * So that we require some extra code to patch over odd-length
1447 	 * or unaligned mbufs.
1448 	 */
1449 	if (sc->sc_flags & FE_FLAGS_SBW_BYTE) {
1450 		/* It's simple in byte mode. */
1451 		for (; m != NULL; m = m->m_next) {
1452 			if (m->m_len) {
1453 				bus_space_write_multi_1(bst, bsh, FE_BMPR8,
1454 				    mtod(m, uint8_t *), m->m_len);
1455 			}
1456 		}
1457 	} else {
1458 		/* a bit trickier in word mode. */
1459 		uint8_t *data, savebyte[2];
1460 		int leftover;
1461 
1462 		leftover = 0;
1463 		savebyte[0] = savebyte[1] = 0;
1464 
1465 		for (; m != NULL; m = m->m_next) {
1466 			len = m->m_len;
1467 			if (len == 0)
1468 				continue;
1469 			data = mtod(m, uint8_t *);
1470 			while (len > 0) {
1471 				if (leftover) {
1472 					/*
1473 					 * Data left over (from mbuf or
1474 					 * realignment). Buffer the next
1475 					 * byte, and write it and the
1476 					 * leftover data out.
1477 					 */
1478 					savebyte[1] = *data++;
1479 					len--;
1480 					bus_space_write_stream_2(bst, bsh,
1481 					   FE_BMPR8, *(uint16_t *)savebyte);
1482 					leftover = 0;
1483 				} else if (BUS_SPACE_ALIGNED_POINTER(data,
1484 				    uint16_t) == 0) {
1485 					/*
1486 					 * Unaligned data; buffer the next byte.
1487 					 */
1488 					savebyte[0] = *data++;
1489 					len--;
1490 					leftover = 1;
1491 				} else {
1492 					/*
1493 					 * Aligned data; output contiguous
1494 					 * words as much as we can, then
1495 					 * buffer the remaining byte, if any.
1496 					 */
1497 					leftover = len & 1;
1498 					len &= ~1;
1499 					bus_space_write_multi_stream_2(bst, bsh,
1500 					    FE_BMPR8, (uint16_t *)data,
1501 					    len >> 1);
1502 					data += len;
1503 					if (leftover)
1504 						savebyte[0] = *data++;
1505 					len = 0;
1506 				}
1507 			}
1508 			if (len < 0)
1509 				panic("mb86960_write_mbufs: negative len");
1510 		}
1511 		if (leftover) {
1512 			savebyte[1] = 0;
1513 			bus_space_write_stream_2(bst, bsh, FE_BMPR8,
1514 			    *(uint16_t *)savebyte);
1515 		}
1516 	}
1517 #if FE_DELAYED_PADDING == 0
1518 	/*
1519 	 * Pad the packet to the minimum length if necessary.
1520 	 */
1521 	len = (ETHER_MIN_LEN - ETHER_CRC_LEN) - totlen;
1522 	if (len > 0) {
1523 		if (sc->sc_flags & FE_FLAGS_SBW_BYTE) {
1524 			while (len-- > 0)
1525 				bus_space_write_1(bst, bsh, FE_BMPR8, 0);
1526 		} else {
1527 			len >>= 1;
1528 			while (len-- > 0)
1529 				bus_space_write_2(bst, bsh, FE_BMPR8, 0);
1530 		}
1531 	}
1532 #endif
1533 }
1534 
1535 /*
1536  * Compute the multicast address filter from the
1537  * list of multicast addresses we need to listen to.
1538  */
1539 void
1540 mb86960_getmcaf(struct ethercom *ec, uint8_t *af)
1541 {
1542 	struct ifnet *ifp = &ec->ec_if;
1543 	struct ether_multi *enm;
1544 	uint32_t crc;
1545 	struct ether_multistep step;
1546 
1547 	/*
1548 	 * Set up multicast address filter by passing all multicast addresses
1549 	 * through a crc generator, and then using the high order 6 bits as an
1550 	 * index into the 64 bit logical address filter.  The high order bit
1551 	 * selects the word, while the rest of the bits select the bit within
1552 	 * the word.
1553 	 */
1554 
1555 	if ((ifp->if_flags & IFF_PROMISC) != 0)
1556 		goto allmulti;
1557 
1558 	memset(af, 0, FE_FILTER_LEN);
1559 	ETHER_FIRST_MULTI(step, ec, enm);
1560 	while (enm != NULL) {
1561 		if (memcmp(enm->enm_addrlo, enm->enm_addrhi,
1562 		    sizeof(enm->enm_addrlo)) != 0) {
1563 			/*
1564 			 * We must listen to a range of multicast addresses.
1565 			 * For now, just accept all multicasts, rather than
1566 			 * trying to set only those filter bits needed to match
1567 			 * the range.  (At this time, the only use of address
1568 			 * ranges is for IP multicast routing, for which the
1569 			 * range is big enough to require all bits set.)
1570 			 */
1571 			goto allmulti;
1572 		}
1573 
1574 		crc = ether_crc32_le(enm->enm_addrlo, ETHER_ADDR_LEN);
1575 
1576 		/* Just want the 6 most significant bits. */
1577 		crc >>= 26;
1578 
1579 		/* Turn on the corresponding bit in the filter. */
1580 		af[crc >> 3] |= 1 << (crc & 7);
1581 
1582 		ETHER_NEXT_MULTI(step, enm);
1583 	}
1584 	ifp->if_flags &= ~IFF_ALLMULTI;
1585 	return;
1586 
1587 allmulti:
1588 	ifp->if_flags |= IFF_ALLMULTI;
1589 	memset(af, 0xff, FE_FILTER_LEN);
1590 }
1591 
1592 /*
1593  * Calculate a new "multicast packet filter" and put the 86960
1594  * receiver in appropriate mode.
1595  */
1596 void
1597 mb86960_setmode(struct mb86960_softc *sc)
1598 {
1599 	bus_space_tag_t bst = sc->sc_bst;
1600 	bus_space_handle_t bsh = sc->sc_bsh;
1601 	int flags = sc->sc_ec.ec_if.if_flags;
1602 
1603 	/*
1604 	 * If the interface is not running, we postpone the update
1605 	 * process for receive modes and multicast address filter
1606 	 * until the interface is restarted.  It reduces some
1607 	 * complicated job on maintaining chip states.  (Earlier versions
1608 	 * of this driver had a bug on that point...)
1609 	 *
1610 	 * To complete the trick, mb86960_init() calls mb86960_setmode() after
1611 	 * restarting the interface.
1612 	 */
1613 	if ((flags & IFF_RUNNING) == 0)
1614 		return;
1615 
1616 	/*
1617 	 * Promiscuous mode is handled separately.
1618 	 */
1619 	if ((flags & IFF_PROMISC) != 0) {
1620 		/*
1621 		 * Program 86960 to receive all packets on the segment
1622 		 * including those directed to other stations.
1623 		 * Multicast filter stored in MARs are ignored
1624 		 * under this setting, so we don't need to update it.
1625 		 *
1626 		 * Promiscuous mode is used solely by BPF, and BPF only
1627 		 * listens to valid (no error) packets.  So, we ignore
1628 		 * errornous ones even in this mode.
1629 		 */
1630 		bus_space_write_1(bst, bsh, FE_DLCR5,
1631 		    sc->proto_dlcr5 | FE_D5_AFM0 | FE_D5_AFM1);
1632 		sc->filter_change = 0;
1633 
1634 #if FE_DEBUG >= 3
1635 		log(LOG_INFO, "%s: promiscuous mode\n",
1636 		    device_xname(sc->sc_dev));
1637 #endif
1638 		return;
1639 	}
1640 
1641 	/*
1642 	 * Turn the chip to the normal (non-promiscuous) mode.
1643 	 */
1644 	bus_space_write_1(bst, bsh, FE_DLCR5, sc->proto_dlcr5 | FE_D5_AFM1);
1645 
1646 	/*
1647 	 * Find the new multicast filter value.
1648 	 */
1649 	mb86960_getmcaf(&sc->sc_ec, sc->filter);
1650 	sc->filter_change = 1;
1651 
1652 #if FE_DEBUG >= 3
1653 	log(LOG_INFO,
1654 	    "%s: address filter: [%02x %02x %02x %02x %02x %02x %02x %02x]\n",
1655 	    device_xname(sc->sc_dev),
1656 	    sc->filter[0], sc->filter[1], sc->filter[2], sc->filter[3],
1657 	    sc->filter[4], sc->filter[5], sc->filter[6], sc->filter[7]);
1658 #endif
1659 
1660 	/*
1661 	 * We have to update the multicast filter in the 86960, A.S.A.P.
1662 	 *
1663 	 * Note that the DLC (Data Linc Control unit, i.e. transmitter
1664 	 * and receiver) must be stopped when feeding the filter, and
1665 	 * DLC trashes all packets in both transmission and receive
1666 	 * buffers when stopped.
1667 	 *
1668 	 * ... Are the above sentenses correct?  I have to check the
1669 	 *     manual of the MB86960A.  FIXME.
1670 	 *
1671 	 * To reduce the packet lossage, we delay the filter update
1672 	 * process until buffers are empty.
1673 	 */
1674 	if (sc->txb_sched == 0 && sc->txb_count == 0 &&
1675 	    (bus_space_read_1(bst, bsh, FE_DLCR1) & FE_D1_PKTRDY) == 0) {
1676 		/*
1677 		 * Buffers are (apparently) empty.  Load
1678 		 * the new filter value into MARs now.
1679 		 */
1680 		mb86960_loadmar(sc);
1681 	} else {
1682 		/*
1683 		 * Buffers are not empty.  Mark that we have to update
1684 		 * the MARs.  The new filter will be loaded by mb86960_intr()
1685 		 * later.
1686 		 */
1687 #if FE_DEBUG >= 4
1688 		log(LOG_INFO, "%s: filter change delayed\n",
1689 		    device_xname(sc->sc_dev));
1690 #endif
1691 	}
1692 }
1693 
1694 /*
1695  * Load a new multicast address filter into MARs.
1696  *
1697  * The caller must have splnet'ed befor mb86960_loadmar.
1698  * This function starts the DLC upon return.  So it can be called only
1699  * when the chip is working, i.e., from the driver's point of view, when
1700  * a device is RUNNING.  (I mistook the point in previous versions.)
1701  */
1702 void
1703 mb86960_loadmar(struct mb86960_softc *sc)
1704 {
1705 	bus_space_tag_t bst = sc->sc_bst;
1706 	bus_space_handle_t bsh = sc->sc_bsh;
1707 
1708 	/* Stop the DLC (transmitter and receiver). */
1709 	bus_space_write_1(bst, bsh, FE_DLCR6,
1710 	    sc->proto_dlcr6 | FE_D6_DLC_DISABLE);
1711 
1712 	/* Select register bank 1 for MARs. */
1713 	bus_space_write_1(bst, bsh, FE_DLCR7,
1714 	    sc->proto_dlcr7 | FE_D7_RBS_MAR | FE_D7_POWER_UP);
1715 
1716 	/* Copy filter value into the registers. */
1717 	bus_space_write_region_1(bst, bsh, FE_MAR8, sc->filter, FE_FILTER_LEN);
1718 
1719 	/* Restore the bank selection for BMPRs (i.e., runtime registers). */
1720 	bus_space_write_1(bst, bsh, FE_DLCR7,
1721 	    sc->proto_dlcr7 | FE_D7_RBS_BMPR | FE_D7_POWER_UP);
1722 
1723 	/* Restart the DLC. */
1724 	bus_space_write_1(bst, bsh, FE_DLCR6,
1725 	    sc->proto_dlcr6 | FE_D6_DLC_ENABLE);
1726 
1727 	/* We have just updated the filter. */
1728 	sc->filter_change = 0;
1729 
1730 #if FE_DEBUG >= 3
1731 	log(LOG_INFO, "%s: address filter changed\n", device_xname(sc->sc_dev));
1732 #endif
1733 }
1734 
1735 /*
1736  * Enable power on the interface.
1737  */
1738 int
1739 mb86960_enable(struct mb86960_softc *sc)
1740 {
1741 
1742 #if FE_DEBUG >= 3
1743 	log(LOG_INFO, "%s: mb86960_enable()\n", device_xname(sc->sc_dev));
1744 #endif
1745 
1746 	if ((sc->sc_stat & FE_STAT_ENABLED) == 0 && sc->sc_enable != NULL) {
1747 		if ((*sc->sc_enable)(sc) != 0) {
1748 			aprint_error_dev(sc->sc_dev, "device enable failed\n");
1749 			return EIO;
1750 		}
1751 	}
1752 
1753 	sc->sc_stat |= FE_STAT_ENABLED;
1754 	return 0;
1755 }
1756 
1757 /*
1758  * Disable power on the interface.
1759  */
1760 void
1761 mb86960_disable(struct mb86960_softc *sc)
1762 {
1763 
1764 #if FE_DEBUG >= 3
1765 	log(LOG_INFO, "%s: mb86960_disable()\n", device_xname(sc->sc_dev));
1766 #endif
1767 
1768 	if ((sc->sc_stat & FE_STAT_ENABLED) != 0 && sc->sc_disable != NULL) {
1769 		(*sc->sc_disable)(sc);
1770 		sc->sc_stat &= ~FE_STAT_ENABLED;
1771 	}
1772 }
1773 
1774 /*
1775  * mbe_activate:
1776  *
1777  *	Handle device activation/deactivation requests.
1778  */
1779 int
1780 mb86960_activate(device_t self, enum devact act)
1781 {
1782 	struct mb86960_softc *sc = device_private(self);
1783 
1784 	switch (act) {
1785 	case DVACT_DEACTIVATE:
1786 		if_deactivate(&sc->sc_ec.ec_if);
1787 		return 0;
1788 	default:
1789 		return EOPNOTSUPP;
1790 	}
1791 }
1792 
1793 /*
1794  * mb86960_detach:
1795  *
1796  *	Detach a MB86960 interface.
1797  */
1798 int
1799 mb86960_detach(struct mb86960_softc *sc)
1800 {
1801 	struct ifnet *ifp = &sc->sc_ec.ec_if;
1802 
1803 	/* Succeed now if there's no work to do. */
1804 	if ((sc->sc_stat & FE_STAT_ATTACHED) == 0)
1805 		return 0;
1806 
1807 	/* Delete all media. */
1808 	ifmedia_delete_instance(&sc->sc_media, IFM_INST_ANY);
1809 
1810 	/* Unhook the entropy source. */
1811 	rnd_detach_source(&sc->rnd_source);
1812 
1813 	ether_ifdetach(ifp);
1814 	if_detach(ifp);
1815 
1816 	mb86960_disable(sc);
1817 	return 0;
1818 }
1819 
1820 /*
1821  * Routines to read all bytes from the config EEPROM (93C06) through MB86965A.
1822  */
1823 void
1824 mb86965_read_eeprom(bus_space_tag_t iot, bus_space_handle_t ioh, uint8_t *data)
1825 {
1826 	int addr, op, bit;
1827 	uint16_t val;
1828 
1829 	/* Read bytes from EEPROM; two bytes per an iteration. */
1830 	for (addr = 0; addr < FE_EEPROM_SIZE / 2; addr++) {
1831 		/* Reset the EEPROM interface. */
1832 		bus_space_write_1(iot, ioh, FE_BMPR16, 0x00);
1833 		bus_space_write_1(iot, ioh, FE_BMPR17, 0x00);
1834 		bus_space_write_1(iot, ioh, FE_BMPR16, FE_B16_SELECT);
1835 
1836 		/* Send start bit. */
1837 		bus_space_write_1(iot, ioh, FE_BMPR17, FE_B17_DATA);
1838 		FE_EEPROM_DELAY();
1839 		bus_space_write_1(iot, ioh,
1840 		    FE_BMPR16, FE_B16_SELECT | FE_B16_CLOCK);
1841 		FE_EEPROM_DELAY();
1842 		bus_space_write_1(iot, ioh, FE_BMPR16, FE_B16_SELECT);
1843 
1844 		/* Send read command and read address. */
1845 		op = 0x80 | addr;	/* READ instruction */
1846 		for (bit = 8; bit > 0; bit--) {
1847 			bus_space_write_1(iot, ioh, FE_BMPR17,
1848 			    (op & (1 << (bit - 1))) ? FE_B17_DATA : 0);
1849 			FE_EEPROM_DELAY();
1850 			bus_space_write_1(iot, ioh,
1851 			    FE_BMPR16, FE_B16_SELECT | FE_B16_CLOCK);
1852 			FE_EEPROM_DELAY();
1853 			bus_space_write_1(iot, ioh, FE_BMPR16, FE_B16_SELECT);
1854 		}
1855 		bus_space_write_1(iot, ioh, FE_BMPR17, 0x00);
1856 
1857 		/* Read two bytes in each address */
1858 		val = 0;
1859 		for (bit = 16; bit > 0; bit--) {
1860 			FE_EEPROM_DELAY();
1861 			bus_space_write_1(iot, ioh,
1862 			    FE_BMPR16, FE_B16_SELECT | FE_B16_CLOCK);
1863 			FE_EEPROM_DELAY();
1864 			if (bus_space_read_1(iot, ioh, FE_BMPR17) &
1865 			    FE_B17_DATA)
1866 				val |= 1 << (bit - 1);
1867 			bus_space_write_1(iot, ioh,
1868 			    FE_BMPR16, FE_B16_SELECT);
1869 		}
1870 		data[addr * 2]     = val >> 8;
1871 		data[addr * 2 + 1] = val & 0xff;
1872 	}
1873 
1874 	/* Make sure the EEPROM is turned off. */
1875 	bus_space_write_1(iot, ioh, FE_BMPR16, 0);
1876 	bus_space_write_1(iot, ioh, FE_BMPR17, 0);
1877 
1878 #if FE_DEBUG >= 3
1879 	/* Report what we got. */
1880 	log(LOG_INFO, "mb86965_read_eeprom: "
1881 	    " %02x%02x%02x%02x %02x%02x%02x%02x -"
1882 	    " %02x%02x%02x%02x %02x%02x%02x%02x -"
1883 	    " %02x%02x%02x%02x %02x%02x%02x%02x -"
1884 	    " %02x%02x%02x%02x %02x%02x%02x%02x\n",
1885 	    data[ 0], data[ 1], data[ 2], data[ 3],
1886 	    data[ 4], data[ 5], data[ 6], data[ 7],
1887 	    data[ 8], data[ 9], data[10], data[11],
1888 	    data[12], data[13], data[14], data[15],
1889 	    data[16], data[17], data[18], data[19],
1890 	    data[20], data[21], data[22], data[23],
1891 	    data[24], data[25], data[26], data[27],
1892 	    data[28], data[29], data[30], data[31]);
1893 #endif
1894 }
1895 
1896 #if FE_DEBUG >= 1
1897 void
1898 mb86960_dump(int level, struct mb86960_softc *sc)
1899 {
1900 	bus_space_tag_t bst = sc->sc_bst;
1901 	bus_space_handle_t bsh = sc->sc_bsh;
1902 	uint8_t save_dlcr7;
1903 
1904 	save_dlcr7 = bus_space_read_1(bst, bsh, FE_DLCR7);
1905 
1906 	log(level, "\tDLCR = %02x %02x %02x %02x %02x %02x %02x %02x\n",
1907 	    bus_space_read_1(bst, bsh, FE_DLCR0),
1908 	    bus_space_read_1(bst, bsh, FE_DLCR1),
1909 	    bus_space_read_1(bst, bsh, FE_DLCR2),
1910 	    bus_space_read_1(bst, bsh, FE_DLCR3),
1911 	    bus_space_read_1(bst, bsh, FE_DLCR4),
1912 	    bus_space_read_1(bst, bsh, FE_DLCR5),
1913 	    bus_space_read_1(bst, bsh, FE_DLCR6),
1914 	    bus_space_read_1(bst, bsh, FE_DLCR7));
1915 
1916 	bus_space_write_1(bst, bsh, FE_DLCR7,
1917 	    (save_dlcr7 & ~FE_D7_RBS) | FE_D7_RBS_DLCR);
1918 	log(level, "\t       %02x %02x %02x %02x %02x %02x %02x %02x\n",
1919 	    bus_space_read_1(bst, bsh, FE_DLCR8),
1920 	    bus_space_read_1(bst, bsh, FE_DLCR9),
1921 	    bus_space_read_1(bst, bsh, FE_DLCR10),
1922 	    bus_space_read_1(bst, bsh, FE_DLCR11),
1923 	    bus_space_read_1(bst, bsh, FE_DLCR12),
1924 	    bus_space_read_1(bst, bsh, FE_DLCR13),
1925 	    bus_space_read_1(bst, bsh, FE_DLCR14),
1926 	    bus_space_read_1(bst, bsh, FE_DLCR15));
1927 
1928 	bus_space_write_1(bst, bsh, FE_DLCR7,
1929 	    (save_dlcr7 & ~FE_D7_RBS) | FE_D7_RBS_MAR);
1930 	log(level, "\tMAR  = %02x %02x %02x %02x %02x %02x %02x %02x\n",
1931 	    bus_space_read_1(bst, bsh, FE_MAR8),
1932 	    bus_space_read_1(bst, bsh, FE_MAR9),
1933 	    bus_space_read_1(bst, bsh, FE_MAR10),
1934 	    bus_space_read_1(bst, bsh, FE_MAR11),
1935 	    bus_space_read_1(bst, bsh, FE_MAR12),
1936 	    bus_space_read_1(bst, bsh, FE_MAR13),
1937 	    bus_space_read_1(bst, bsh, FE_MAR14),
1938 	    bus_space_read_1(bst, bsh, FE_MAR15));
1939 
1940 	bus_space_write_1(bst, bsh, FE_DLCR7,
1941 	    (save_dlcr7 & ~FE_D7_RBS) | FE_D7_RBS_BMPR);
1942 	log(level,
1943 	    "\tBMPR = xx xx %02x %02x %02x %02x %02x %02x %02x %02x xx %02x\n",
1944 	    bus_space_read_1(bst, bsh, FE_BMPR10),
1945 	    bus_space_read_1(bst, bsh, FE_BMPR11),
1946 	    bus_space_read_1(bst, bsh, FE_BMPR12),
1947 	    bus_space_read_1(bst, bsh, FE_BMPR13),
1948 	    bus_space_read_1(bst, bsh, FE_BMPR14),
1949 	    bus_space_read_1(bst, bsh, FE_BMPR15),
1950 	    bus_space_read_1(bst, bsh, FE_BMPR16),
1951 	    bus_space_read_1(bst, bsh, FE_BMPR17),
1952 	    bus_space_read_1(bst, bsh, FE_BMPR19));
1953 
1954 	bus_space_write_1(bst, bsh, FE_DLCR7, save_dlcr7);
1955 }
1956 #endif
1957 
1958