xref: /netbsd-src/sys/dev/ic/mb86960.c (revision ce2c90c7c172d95d2402a5b3d96d8f8e6d138a21)
1 /*	$NetBSD: mb86960.c,v 1.65 2006/09/07 02:40:32 dogcow Exp $	*/
2 
3 /*
4  * All Rights Reserved, Copyright (C) Fujitsu Limited 1995
5  *
6  * This software may be used, modified, copied, distributed, and sold, in
7  * both source and binary form provided that the above copyright, these
8  * terms and the following disclaimer are retained.  The name of the author
9  * and/or the contributor may not be used to endorse or promote products
10  * derived from this software without specific prior written permission.
11  *
12  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND THE CONTRIBUTOR ``AS IS'' AND
13  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
14  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
15  * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR THE CONTRIBUTOR BE LIABLE
16  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
17  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
18  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION.
19  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
20  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
21  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
22  * SUCH DAMAGE.
23  */
24 
25 /*
26  * Portions copyright (C) 1993, David Greenman.  This software may be used,
27  * modified, copied, distributed, and sold, in both source and binary form
28  * provided that the above copyright and these terms are retained.  Under no
29  * circumstances is the author responsible for the proper functioning of this
30  * software, nor does the author assume any responsibility for damages
31  * incurred with its use.
32  */
33 
34 #include <sys/cdefs.h>
35 __KERNEL_RCSID(0, "$NetBSD: mb86960.c,v 1.65 2006/09/07 02:40:32 dogcow Exp $");
36 
37 /*
38  * Device driver for Fujitsu MB86960A/MB86965A based Ethernet cards.
39  * Contributed by M.S. <seki@sysrap.cs.fujitsu.co.jp>
40  *
41  * This version is intended to be a generic template for various
42  * MB86960A/MB86965A based Ethernet cards.  It currently supports
43  * Fujitsu FMV-180 series (i.e., FMV-181 and FMV-182) and Allied-
44  * Telesis AT1700 series and RE2000 series.  There are some
45  * unnecessary hooks embedded, which are primarily intended to support
46  * other types of Ethernet cards, but the author is not sure whether
47  * they are useful.
48  */
49 
50 #include "opt_inet.h"
51 #include "bpfilter.h"
52 #include "rnd.h"
53 
54 #include <sys/param.h>
55 #include <sys/systm.h>
56 #include <sys/errno.h>
57 #include <sys/ioctl.h>
58 #include <sys/mbuf.h>
59 #include <sys/socket.h>
60 #include <sys/syslog.h>
61 #include <sys/device.h>
62 #if NRND > 0
63 #include <sys/rnd.h>
64 #endif
65 
66 #include <net/if.h>
67 #include <net/if_dl.h>
68 #include <net/if_types.h>
69 #include <net/if_media.h>
70 #include <net/if_ether.h>
71 
72 #ifdef INET
73 #include <netinet/in.h>
74 #include <netinet/in_systm.h>
75 #include <netinet/in_var.h>
76 #include <netinet/ip.h>
77 #include <netinet/if_inarp.h>
78 #endif
79 
80 
81 #if NBPFILTER > 0
82 #include <net/bpf.h>
83 #include <net/bpfdesc.h>
84 #endif
85 
86 #include <machine/bus.h>
87 
88 #include <dev/ic/mb86960reg.h>
89 #include <dev/ic/mb86960var.h>
90 
91 #ifndef __BUS_SPACE_HAS_STREAM_METHODS
92 #define bus_space_write_stream_2	bus_space_write_2
93 #define bus_space_write_multi_stream_2	bus_space_write_multi_2
94 #define bus_space_read_multi_stream_2	bus_space_read_multi_2
95 #endif /* __BUS_SPACE_HAS_STREAM_METHODS */
96 
97 /* Standard driver entry points.  These can be static. */
98 void	mb86960_init(struct mb86960_softc *);
99 int	mb86960_ioctl(struct ifnet *, u_long, caddr_t);
100 void	mb86960_start(struct ifnet *);
101 void	mb86960_reset(struct mb86960_softc *);
102 void	mb86960_watchdog(struct ifnet *);
103 
104 /* Local functions.  Order of declaration is confused.  FIXME. */
105 int	mb86960_get_packet(struct mb86960_softc *, u_int);
106 void	mb86960_stop(struct mb86960_softc *);
107 void	mb86960_tint(struct mb86960_softc *, uint8_t);
108 void	mb86960_rint(struct mb86960_softc *, uint8_t);
109 static inline
110 void	mb86960_xmit(struct mb86960_softc *);
111 void	mb86960_write_mbufs(struct mb86960_softc *, struct mbuf *);
112 static inline
113 void	mb86960_droppacket(struct mb86960_softc *);
114 void	mb86960_getmcaf(struct ethercom *, uint8_t *);
115 void	mb86960_setmode(struct mb86960_softc *);
116 void	mb86960_loadmar(struct mb86960_softc *);
117 
118 int	mb86960_mediachange(struct ifnet *);
119 void	mb86960_mediastatus(struct ifnet *, struct ifmediareq *);
120 
121 #if FE_DEBUG >= 1
122 void	mb86960_dump(int, struct mb86960_softc *);
123 #endif
124 
125 void
126 mb86960_attach(struct mb86960_softc *sc, uint8_t *myea)
127 {
128 	bus_space_tag_t bst = sc->sc_bst;
129 	bus_space_handle_t bsh = sc->sc_bsh;
130 
131 	/* Register values which depend on board design. */
132 	sc->proto_dlcr4 = FE_D4_LBC_DISABLE | FE_D4_CNTRL;
133 	sc->proto_dlcr5 = 0;
134 	sc->proto_dlcr7 = FE_D7_BYTSWP_LH;
135 	if ((sc->sc_flags & FE_FLAGS_MB86960) != 0)
136 		sc->proto_dlcr7 |= FE_D7_ED_TEST; /* XXX */
137 	sc->proto_bmpr13 = FE_B13_TPTYPE_UTP | FE_B13_PORT_AUTO;
138 
139 	/*
140 	 * Program the 86960 as following defaults:
141 	 *	SRAM: 32KB, 100ns, byte-wide access.
142 	 *	Transmission buffer: 4KB x 2.
143 	 *	System bus interface: 16 bits.
144 	 * These values except TXBSIZE should be modified as per
145 	 * sc_flags which is set in MD attachments, because they
146 	 * are hard-wired on the board. Modifying TXBSIZE will affect
147 	 * the driver performance.
148 	 */
149 	sc->proto_dlcr6 = FE_D6_BUFSIZ_32KB | FE_D6_TXBSIZ_2x4KB |
150 	    FE_D6_BBW_BYTE | FE_D6_SRAM_100ns;
151 	if (sc->sc_flags & FE_FLAGS_SBW_BYTE)
152 		sc->proto_dlcr6 |= FE_D6_SBW_BYTE;
153 	if (sc->sc_flags & FE_FLAGS_SRAM_150ns)
154 		sc->proto_dlcr6 &= ~FE_D6_SRAM_100ns;
155 
156 	/*
157 	 * Minimum initialization of the hardware.
158 	 * We write into registers; hope I/O ports have no
159 	 * overlap with other boards.
160 	 */
161 
162 	/* Initialize 86960. */
163 	bus_space_write_1(bst, bsh, FE_DLCR6,
164 	    sc->proto_dlcr6 | FE_D6_DLC_DISABLE);
165 	delay(200);
166 
167 #ifdef DIAGNOSTIC
168 	if (myea == NULL) {
169 		printf("%s: ethernet address shouldn't be NULL\n",
170 		    sc->sc_dev.dv_xname);
171 		panic("NULL ethernet address");
172 	}
173 #endif
174 	memcpy(sc->sc_enaddr, myea, sizeof(sc->sc_enaddr));
175 
176 	/* Disable all interrupts. */
177 	bus_space_write_1(bst, bsh, FE_DLCR2, 0);
178 	bus_space_write_1(bst, bsh, FE_DLCR3, 0);
179 }
180 
181 /*
182  * Install interface into kernel networking data structures
183  */
184 void
185 mb86960_config(struct mb86960_softc *sc, int *media, int nmedia, int defmedia)
186 {
187 	struct cfdata *cf = device_cfdata(&sc->sc_dev);
188 	struct ifnet *ifp = &sc->sc_ec.ec_if;
189 	int i;
190 
191 	/* Stop the 86960. */
192 	mb86960_stop(sc);
193 
194 	/* Initialize ifnet structure. */
195 	strcpy(ifp->if_xname, sc->sc_dev.dv_xname);
196 	ifp->if_softc = sc;
197 	ifp->if_start = mb86960_start;
198 	ifp->if_ioctl = mb86960_ioctl;
199 	ifp->if_watchdog = mb86960_watchdog;
200 	ifp->if_flags =
201 	    IFF_BROADCAST | IFF_SIMPLEX | IFF_NOTRAILERS | IFF_MULTICAST;
202 	IFQ_SET_READY(&ifp->if_snd);
203 
204 #if FE_DEBUG >= 3
205 	log(LOG_INFO, "%s: mb86960_config()\n", sc->sc_dev.dv_xname);
206 	mb86960_dump(LOG_INFO, sc);
207 #endif
208 
209 #if FE_SINGLE_TRANSMISSION
210 	/* Override txb config to allocate minimum. */
211 	sc->proto_dlcr6 &= ~FE_D6_TXBSIZ;
212 	sc->proto_dlcr6 |=  FE_D6_TXBSIZ_2x2KB;
213 #endif
214 
215 	/* Modify hardware config if it is requested. */
216 	if ((cf->cf_flags & FE_FLAGS_OVERRIDE_DLCR6) != 0)
217 		sc->proto_dlcr6 = cf->cf_flags & FE_FLAGS_DLCR6_VALUE;
218 
219 	/* Find TX buffer size, based on the hardware dependent proto. */
220 	switch (sc->proto_dlcr6 & FE_D6_TXBSIZ) {
221 	case FE_D6_TXBSIZ_2x2KB:
222 		sc->txb_size = 2048;
223 		break;
224 	case FE_D6_TXBSIZ_2x4KB:
225 		sc->txb_size = 4096;
226 		break;
227 	case FE_D6_TXBSIZ_2x8KB:
228 		sc->txb_size = 8192;
229 		break;
230 	default:
231 		/* Oops, we can't work with single buffer configuration. */
232 #if FE_DEBUG >= 2
233 		log(LOG_WARNING, "%s: strange TXBSIZ config; fixing\n",
234 		    sc->sc_dev.dv_xname);
235 #endif
236 		sc->proto_dlcr6 &= ~FE_D6_TXBSIZ;
237 		sc->proto_dlcr6 |=  FE_D6_TXBSIZ_2x2KB;
238 		sc->txb_size = 2048;
239 		break;
240 	}
241 
242 	/* Initialize media goo. */
243 	ifmedia_init(&sc->sc_media, 0, mb86960_mediachange,
244 	    mb86960_mediastatus);
245 	if (media != NULL) {
246 		for (i = 0; i < nmedia; i++)
247 			ifmedia_add(&sc->sc_media, media[i], 0, NULL);
248 		ifmedia_set(&sc->sc_media, defmedia);
249 	} else {
250 		ifmedia_add(&sc->sc_media, IFM_ETHER|IFM_MANUAL, 0, NULL);
251 		ifmedia_set(&sc->sc_media, IFM_ETHER|IFM_MANUAL);
252 	}
253 
254 	/* Attach the interface. */
255 	if_attach(ifp);
256 	ether_ifattach(ifp, sc->sc_enaddr);
257 
258 #if NRND > 0
259 	rnd_attach_source(&sc->rnd_source, sc->sc_dev.dv_xname,
260 	    RND_TYPE_NET, 0);
261 #endif
262 	/* Print additional info when attached. */
263 	printf("%s: Ethernet address %s\n", sc->sc_dev.dv_xname,
264 	    ether_sprintf(sc->sc_enaddr));
265 
266 #if FE_DEBUG >= 3
267 	{
268 		int buf, txb, bbw, sbw, ram;
269 
270 		buf = txb = bbw = sbw = ram = -1;
271 		switch (sc->proto_dlcr6 & FE_D6_BUFSIZ) {
272 		case FE_D6_BUFSIZ_8KB:
273 			buf = 8;
274 			break;
275 		case FE_D6_BUFSIZ_16KB:
276 			buf = 16;
277 			break;
278 		case FE_D6_BUFSIZ_32KB:
279 			buf = 32;
280 			break;
281 		case FE_D6_BUFSIZ_64KB:
282 			buf = 64;
283 			break;
284 		}
285 		switch (sc->proto_dlcr6 & FE_D6_TXBSIZ) {
286 		case FE_D6_TXBSIZ_2x2KB:
287 			txb = 2;
288 			break;
289 		case FE_D6_TXBSIZ_2x4KB:
290 			txb = 4;
291 			break;
292 		case FE_D6_TXBSIZ_2x8KB:
293 			txb = 8;
294 			break;
295 		}
296 		switch (sc->proto_dlcr6 & FE_D6_BBW) {
297 		case FE_D6_BBW_BYTE:
298 			bbw = 8;
299 			break;
300 		case FE_D6_BBW_WORD:
301 			bbw = 16;
302 			break;
303 		}
304 		switch (sc->proto_dlcr6 & FE_D6_SBW) {
305 		case FE_D6_SBW_BYTE:
306 			sbw = 8;
307 			break;
308 		case FE_D6_SBW_WORD:
309 			sbw = 16;
310 			break;
311 		}
312 		switch (sc->proto_dlcr6 & FE_D6_SRAM) {
313 		case FE_D6_SRAM_100ns:
314 			ram = 100;
315 			break;
316 		case FE_D6_SRAM_150ns:
317 			ram = 150;
318 			break;
319 		}
320 		printf("%s: SRAM %dKB %dbit %dns, TXB %dKBx2, %dbit I/O\n",
321 		    sc->sc_dev.dv_xname, buf, bbw, ram, txb, sbw);
322 	}
323 #endif
324 
325 	/* The attach is successful. */
326 	sc->sc_stat |= FE_STAT_ATTACHED;
327 }
328 
329 /*
330  * Media change callback.
331  */
332 int
333 mb86960_mediachange(struct ifnet *ifp)
334 {
335 	struct mb86960_softc *sc = ifp->if_softc;
336 
337 	if (sc->sc_mediachange)
338 		return ((*sc->sc_mediachange)(sc));
339 	return (0);
340 }
341 
342 /*
343  * Media status callback.
344  */
345 void
346 mb86960_mediastatus(struct ifnet *ifp, struct ifmediareq *ifmr)
347 {
348 	struct mb86960_softc *sc = ifp->if_softc;
349 
350 	if ((sc->sc_stat & FE_STAT_ENABLED) == 0) {
351 		ifmr->ifm_active = IFM_ETHER | IFM_NONE;
352 		ifmr->ifm_status = 0;
353 		return;
354 	}
355 
356 	if (sc->sc_mediastatus)
357 		(*sc->sc_mediastatus)(sc, ifmr);
358 }
359 
360 /*
361  * Reset interface.
362  */
363 void
364 mb86960_reset(struct mb86960_softc *sc)
365 {
366 	int s;
367 
368 	s = splnet();
369 	mb86960_stop(sc);
370 	mb86960_init(sc);
371 	splx(s);
372 }
373 
374 /*
375  * Stop everything on the interface.
376  *
377  * All buffered packets, both transmitting and receiving,
378  * if any, will be lost by stopping the interface.
379  */
380 void
381 mb86960_stop(struct mb86960_softc *sc)
382 {
383 	bus_space_tag_t bst = sc->sc_bst;
384 	bus_space_handle_t bsh = sc->sc_bsh;
385 
386 #if FE_DEBUG >= 3
387 	log(LOG_INFO, "%s: top of mb86960_stop()\n", sc->sc_dev.dv_xname);
388 	mb86960_dump(LOG_INFO, sc);
389 #endif
390 
391 	/* Disable interrupts. */
392 	bus_space_write_1(bst, bsh, FE_DLCR2, 0x00);
393 	bus_space_write_1(bst, bsh, FE_DLCR3, 0x00);
394 
395 	/* Stop interface hardware. */
396 	delay(200);
397 	bus_space_write_1(bst, bsh, FE_DLCR6,
398 	    sc->proto_dlcr6 | FE_D6_DLC_DISABLE);
399 	delay(200);
400 
401 	/* Clear all interrupt status. */
402 	bus_space_write_1(bst, bsh, FE_DLCR0, 0xFF);
403 	bus_space_write_1(bst, bsh, FE_DLCR1, 0xFF);
404 
405 	/* Put the chip in stand-by mode. */
406 	delay(200);
407 	bus_space_write_1(bst, bsh, FE_DLCR7,
408 	    sc->proto_dlcr7 | FE_D7_POWER_DOWN);
409 	delay(200);
410 
411 	/* MAR loading can be delayed. */
412 	sc->filter_change = 0;
413 
414 	/* Call a hook. */
415 	if (sc->stop_card)
416 		(*sc->stop_card)(sc);
417 
418 #if FE_DEBUG >= 3
419 	log(LOG_INFO, "%s: end of mb86960_stop()\n", sc->sc_dev.dv_xname);
420 	mb86960_dump(LOG_INFO, sc);
421 #endif
422 }
423 
424 /*
425  * Device timeout/watchdog routine. Entered if the device neglects to
426  * generate an interrupt after a transmit has been started on it.
427  */
428 void
429 mb86960_watchdog(struct ifnet *ifp)
430 {
431 	struct mb86960_softc *sc = ifp->if_softc;
432 
433 	log(LOG_ERR, "%s: device timeout\n", sc->sc_dev.dv_xname);
434 #if FE_DEBUG >= 3
435 	mb86960_dump(LOG_INFO, sc);
436 #endif
437 
438 	/* Record how many packets are lost by this accident. */
439 	sc->sc_ec.ec_if.if_oerrors += sc->txb_sched + sc->txb_count;
440 
441 	mb86960_reset(sc);
442 }
443 
444 /*
445  * Drop (skip) a packet from receive buffer in 86960 memory.
446  */
447 static inline void
448 mb86960_droppacket(struct mb86960_softc *sc)
449 {
450 	bus_space_tag_t bst = sc->sc_bst;
451 	bus_space_handle_t bsh = sc->sc_bsh;
452 
453 	bus_space_write_1(bst, bsh, FE_BMPR14, FE_B14_FILTER | FE_B14_SKIP);
454 }
455 
456 /*
457  * Initialize device.
458  */
459 void
460 mb86960_init(struct mb86960_softc *sc)
461 {
462 	bus_space_tag_t bst = sc->sc_bst;
463 	bus_space_handle_t bsh = sc->sc_bsh;
464 	struct ifnet *ifp = &sc->sc_ec.ec_if;
465 	int i;
466 
467 #if FE_DEBUG >= 3
468 	log(LOG_INFO, "%s: top of mb86960_init()\n", sc->sc_dev.dv_xname);
469 	mb86960_dump(LOG_INFO, sc);
470 #endif
471 
472 	/* Reset transmitter flags. */
473 	ifp->if_flags &= ~IFF_OACTIVE;
474 	ifp->if_timer = 0;
475 
476 	sc->txb_free = sc->txb_size;
477 	sc->txb_count = 0;
478 	sc->txb_sched = 0;
479 
480 	/* Do any card-specific initialization, if applicable. */
481 	if (sc->init_card)
482 		(*sc->init_card)(sc);
483 
484 #if FE_DEBUG >= 3
485 	log(LOG_INFO, "%s: after init hook\n", sc->sc_dev.dv_xname);
486 	mb86960_dump(LOG_INFO, sc);
487 #endif
488 
489 	/*
490 	 * Make sure to disable the chip, also.
491 	 * This may also help re-programming the chip after
492 	 * hot insertion of PCMCIAs.
493 	 */
494 	bus_space_write_1(bst, bsh, FE_DLCR6,
495 	    sc->proto_dlcr6 | FE_D6_DLC_DISABLE);
496 	delay(200);
497 
498 	/* Power up the chip and select register bank for DLCRs. */
499 	bus_space_write_1(bst, bsh, FE_DLCR7,
500 	    sc->proto_dlcr7 | FE_D7_RBS_DLCR | FE_D7_POWER_UP);
501 	delay(200);
502 
503 	/* Feed the station address. */
504 	bus_space_write_region_1(bst, bsh, FE_DLCR8,
505 	    sc->sc_enaddr, ETHER_ADDR_LEN);
506 
507 	/* Select the BMPR bank for runtime register access. */
508 	bus_space_write_1(bst, bsh, FE_DLCR7,
509 	    sc->proto_dlcr7 | FE_D7_RBS_BMPR | FE_D7_POWER_UP);
510 
511 	/* Initialize registers. */
512 	bus_space_write_1(bst, bsh, FE_DLCR0, 0xFF);	/* Clear all bits. */
513 	bus_space_write_1(bst, bsh, FE_DLCR1, 0xFF);	/* ditto. */
514 	bus_space_write_1(bst, bsh, FE_DLCR2, 0x00);
515 	bus_space_write_1(bst, bsh, FE_DLCR3, 0x00);
516 	bus_space_write_1(bst, bsh, FE_DLCR4, sc->proto_dlcr4);
517 	bus_space_write_1(bst, bsh, FE_DLCR5, sc->proto_dlcr5);
518 	bus_space_write_1(bst, bsh, FE_BMPR10, 0x00);
519 	bus_space_write_1(bst, bsh, FE_BMPR11, FE_B11_CTRL_SKIP);
520 	bus_space_write_1(bst, bsh, FE_BMPR12, 0x00);
521 	bus_space_write_1(bst, bsh, FE_BMPR13, sc->proto_bmpr13);
522 	bus_space_write_1(bst, bsh, FE_BMPR14, FE_B14_FILTER);
523 	bus_space_write_1(bst, bsh, FE_BMPR15, 0x00);
524 
525 #if FE_DEBUG >= 3
526 	log(LOG_INFO, "%s: just before enabling DLC\n", sc->sc_dev.dv_xname);
527 	mb86960_dump(LOG_INFO, sc);
528 #endif
529 
530 	/* Enable interrupts. */
531 	bus_space_write_1(bst, bsh, FE_DLCR2, FE_TMASK);
532 	bus_space_write_1(bst, bsh, FE_DLCR3, FE_RMASK);
533 
534 	/* Enable transmitter and receiver. */
535 	delay(200);
536 	bus_space_write_1(bst, bsh, FE_DLCR6,
537 	    sc->proto_dlcr6 | FE_D6_DLC_ENABLE);
538 	delay(200);
539 
540 #if FE_DEBUG >= 3
541 	log(LOG_INFO, "%s: just after enabling DLC\n", sc->sc_dev.dv_xname);
542 	mb86960_dump(LOG_INFO, sc);
543 #endif
544 
545 	/*
546 	 * Make sure to empty the receive buffer.
547 	 *
548 	 * This may be redundant, but *if* the receive buffer were full
549 	 * at this point, the driver would hang.  I have experienced
550 	 * some strange hangups just after UP.  I hope the following
551 	 * code solve the problem.
552 	 *
553 	 * I have changed the order of hardware initialization.
554 	 * I think the receive buffer cannot have any packets at this
555 	 * point in this version.  The following code *must* be
556 	 * redundant now.  FIXME.
557 	 */
558 	for (i = 0; i < FE_MAX_RECV_COUNT; i++) {
559 		if (bus_space_read_1(bst, bsh, FE_DLCR5) & FE_D5_BUFEMP)
560 			break;
561 		mb86960_droppacket(sc);
562 	}
563 #if FE_DEBUG >= 1
564 	if (i >= FE_MAX_RECV_COUNT)
565 		log(LOG_ERR, "%s: cannot empty receive buffer\n",
566 		    sc->sc_dev.dv_xname);
567 #endif
568 #if FE_DEBUG >= 3
569 	if (i < FE_MAX_RECV_COUNT)
570 		log(LOG_INFO, "%s: receive buffer emptied (%d)\n",
571 		    sc->sc_dev.dv_xname, i);
572 #endif
573 
574 #if FE_DEBUG >= 3
575 	log(LOG_INFO, "%s: after ERB loop\n", sc->sc_dev.dv_xname);
576 	mb86960_dump(LOG_INFO, sc);
577 #endif
578 
579 	/* Do we need this here? */
580 	bus_space_write_1(bst, bsh, FE_DLCR0, 0xFF);	/* Clear all bits. */
581 	bus_space_write_1(bst, bsh, FE_DLCR1, 0xFF);	/* ditto. */
582 
583 #if FE_DEBUG >= 3
584 	log(LOG_INFO, "%s: after FIXME\n", sc->sc_dev.dv_xname);
585 	mb86960_dump(LOG_INFO, sc);
586 #endif
587 
588 	/* Set 'running' flag. */
589 	ifp->if_flags |= IFF_RUNNING;
590 
591 	/*
592 	 * At this point, the interface is runnung properly,
593 	 * except that it receives *no* packets.  we then call
594 	 * mb86960_setmode() to tell the chip what packets to be
595 	 * received, based on the if_flags and multicast group
596 	 * list.  It completes the initialization process.
597 	 */
598 	mb86960_setmode(sc);
599 
600 #if FE_DEBUG >= 3
601 	log(LOG_INFO, "%s: after setmode\n", sc->sc_dev.dv_xname);
602 	mb86960_dump(LOG_INFO, sc);
603 #endif
604 
605 	/* ...and attempt to start output. */
606 	mb86960_start(ifp);
607 
608 #if FE_DEBUG >= 3
609 	log(LOG_INFO, "%s: end of mb86960_init()\n", sc->sc_dev.dv_xname);
610 	mb86960_dump(LOG_INFO, sc);
611 #endif
612 }
613 
614 /*
615  * This routine actually starts the transmission on the interface
616  */
617 static inline void
618 mb86960_xmit(struct mb86960_softc *sc)
619 {
620 	bus_space_tag_t bst = sc->sc_bst;
621 	bus_space_handle_t bsh = sc->sc_bsh;
622 
623 	/*
624 	 * Set a timer just in case we never hear from the board again.
625 	 * We use longer timeout for multiple packet transmission.
626 	 * I'm not sure this timer value is appropriate.  FIXME.
627 	 */
628 	sc->sc_ec.ec_if.if_timer = 1 + sc->txb_count;
629 
630 	/* Update txb variables. */
631 	sc->txb_sched = sc->txb_count;
632 	sc->txb_count = 0;
633 	sc->txb_free = sc->txb_size;
634 
635 #if FE_DELAYED_PADDING
636 	/* Omit the postponed padding process. */
637 	sc->txb_padding = 0;
638 #endif
639 
640 	/* Start transmitter, passing packets in TX buffer. */
641 	bus_space_write_1(bst, bsh, FE_BMPR10, sc->txb_sched | FE_B10_START);
642 }
643 
644 /*
645  * Start output on interface.
646  * We make two assumptions here:
647  *  1) that the current priority is set to splnet _before_ this code
648  *     is called *and* is returned to the appropriate priority after
649  *     return
650  *  2) that the IFF_OACTIVE flag is checked before this code is called
651  *     (i.e. that the output part of the interface is idle)
652  */
653 void
654 mb86960_start(struct ifnet *ifp)
655 {
656 	struct mb86960_softc *sc = ifp->if_softc;
657 	struct mbuf *m;
658 
659 #if FE_DEBUG >= 1
660 	/* Just a sanity check. */
661 	if ((sc->txb_count == 0) != (sc->txb_free == sc->txb_size)) {
662 		/*
663 		 * Txb_count and txb_free co-works to manage the
664 		 * transmission buffer.  Txb_count keeps track of the
665 		 * used potion of the buffer, while txb_free does unused
666 		 * potion.  So, as long as the driver runs properly,
667 		 * txb_count is zero if and only if txb_free is same
668 		 * as txb_size (which represents whole buffer.)
669 		 */
670 		log(LOG_ERR, "%s: inconsistent txb variables (%d, %d)\n",
671 		    sc->sc_dev.dv_xname, sc->txb_count, sc->txb_free);
672 		/*
673 		 * So, what should I do, then?
674 		 *
675 		 * We now know txb_count and txb_free contradicts.  We
676 		 * cannot, however, tell which is wrong.  More
677 		 * over, we cannot peek 86960 transmission buffer or
678 		 * reset the transmission buffer.  (In fact, we can
679 		 * reset the entire interface.  I don't want to do it.)
680 		 *
681 		 * If txb_count is incorrect, leaving it as is will cause
682 		 * sending of gabages after next interrupt.  We have to
683 		 * avoid it.  Hence, we reset the txb_count here.  If
684 		 * txb_free was incorrect, resetting txb_count just loose
685 		 * some packets.  We can live with it.
686 		 */
687 		sc->txb_count = 0;
688 	}
689 #endif
690 
691 #if FE_DEBUG >= 1
692 	/*
693 	 * First, see if there are buffered packets and an idle
694 	 * transmitter - should never happen at this point.
695 	 */
696 	if ((sc->txb_count > 0) && (sc->txb_sched == 0)) {
697 		log(LOG_ERR, "%s: transmitter idle with %d buffered packets\n",
698 		    sc->sc_dev.dv_xname, sc->txb_count);
699 		mb86960_xmit(sc);
700 	}
701 #endif
702 
703 	/*
704 	 * Stop accepting more transmission packets temporarily, when
705 	 * a filter change request is delayed.  Updating the MARs on
706 	 * 86960 flushes the transmisstion buffer, so it is delayed
707 	 * until all buffered transmission packets have been sent
708 	 * out.
709 	 */
710 	if (sc->filter_change) {
711 		/*
712 		 * Filter change request is delayed only when the DLC is
713 		 * working.  DLC soon raise an interrupt after finishing
714 		 * the work.
715 		 */
716 		goto indicate_active;
717 	}
718 
719 	for (;;) {
720 		/*
721 		 * See if there is room to put another packet in the buffer.
722 		 * We *could* do better job by peeking the send queue to
723 		 * know the length of the next packet.  Current version just
724 		 * tests against the worst case (i.e., longest packet).  FIXME.
725 		 *
726 		 * When adding the packet-peek feature, don't forget adding a
727 		 * test on txb_count against QUEUEING_MAX.
728 		 * There is a little chance the packet count exceeds
729 		 * the limit.  Assume transmission buffer is 8KB (2x8KB
730 		 * configuration) and an application sends a bunch of small
731 		 * (i.e., minimum packet sized) packets rapidly.  An 8KB
732 		 * buffer can hold 130 blocks of 62 bytes long...
733 		 */
734 		if (sc->txb_free <
735 		    (ETHER_MAX_LEN - ETHER_CRC_LEN) + FE_TXLEN_SIZE) {
736 			/* No room. */
737 			goto indicate_active;
738 		}
739 
740 #if FE_SINGLE_TRANSMISSION
741 		if (sc->txb_count > 0) {
742 			/* Just one packet per a transmission buffer. */
743 			goto indicate_active;
744 		}
745 #endif
746 
747 		/*
748 		 * Get the next mbuf chain for a packet to send.
749 		 */
750 		IFQ_DEQUEUE(&ifp->if_snd, m);
751 		if (m == 0) {
752 			/* No more packets to send. */
753 			goto indicate_inactive;
754 		}
755 
756 #if NBPFILTER > 0
757 		/* Tap off here if there is a BPF listener. */
758 		if (ifp->if_bpf)
759 			bpf_mtap(ifp->if_bpf, m);
760 #endif
761 
762 		/*
763 		 * Copy the mbuf chain into the transmission buffer.
764 		 * txb_* variables are updated as necessary.
765 		 */
766 		mb86960_write_mbufs(sc, m);
767 
768 		m_freem(m);
769 
770 		/* Start transmitter if it's idle. */
771 		if (sc->txb_sched == 0)
772 			mb86960_xmit(sc);
773 	}
774 
775 indicate_inactive:
776 	/*
777 	 * We are using the !OACTIVE flag to indicate to
778 	 * the outside world that we can accept an
779 	 * additional packet rather than that the
780 	 * transmitter is _actually_ active.  Indeed, the
781 	 * transmitter may be active, but if we haven't
782 	 * filled all the buffers with data then we still
783 	 * want to accept more.
784 	 */
785 	ifp->if_flags &= ~IFF_OACTIVE;
786 	return;
787 
788 indicate_active:
789 	/*
790 	 * The transmitter is active, and there are no room for
791 	 * more outgoing packets in the transmission buffer.
792 	 */
793 	ifp->if_flags |= IFF_OACTIVE;
794 	return;
795 }
796 
797 /*
798  * Transmission interrupt handler
799  * The control flow of this function looks silly.  FIXME.
800  */
801 void
802 mb86960_tint(struct mb86960_softc *sc, uint8_t tstat)
803 {
804 	bus_space_tag_t bst = sc->sc_bst;
805 	bus_space_handle_t bsh = sc->sc_bsh;
806 	struct ifnet *ifp = &sc->sc_ec.ec_if;
807 	int left;
808 	int col;
809 
810 	/*
811 	 * Handle "excessive collision" interrupt.
812 	 */
813 	if (tstat & FE_D0_COLL16) {
814 		/*
815 		 * Find how many packets (including this collided one)
816 		 * are left unsent in transmission buffer.
817 		 */
818 		left = bus_space_read_1(bst, bsh, FE_BMPR10);
819 
820 #if FE_DEBUG >= 2
821 		log(LOG_WARNING, "%s: excessive collision (%d/%d)\n",
822 		    sc->sc_dev.dv_xname, left, sc->txb_sched);
823 #endif
824 #if FE_DEBUG >= 3
825 		mb86960_dump(LOG_INFO, sc);
826 #endif
827 
828 		/*
829 		 * Update statistics.
830 		 */
831 		ifp->if_collisions += 16;
832 		ifp->if_oerrors++;
833 		ifp->if_opackets += sc->txb_sched - left;
834 
835 		/*
836 		 * Collision statistics has been updated.
837 		 * Clear the collision flag on 86960 now to avoid confusion.
838 		 */
839 		bus_space_write_1(bst, bsh, FE_DLCR0, FE_D0_COLLID);
840 
841 		/*
842 		 * Restart transmitter, skipping the
843 		 * collided packet.
844 		 *
845 		 * We *must* skip the packet to keep network running
846 		 * properly.  Excessive collision error is an
847 		 * indication of the network overload.  If we
848 		 * tried sending the same packet after excessive
849 		 * collision, the network would be filled with
850 		 * out-of-time packets.  Packets belonging
851 		 * to reliable transport (such as TCP) are resent
852 		 * by some upper layer.
853 		 */
854 		bus_space_write_1(bst, bsh, FE_BMPR11,
855 		    FE_B11_CTRL_SKIP | FE_B11_MODE1);
856 		sc->txb_sched = left - 1;
857 	}
858 
859 	/*
860 	 * Handle "transmission complete" interrupt.
861 	 */
862 	if (tstat & FE_D0_TXDONE) {
863 		/*
864 		 * Add in total number of collisions on last
865 		 * transmission.  We also clear "collision occurred" flag
866 		 * here.
867 		 *
868 		 * 86960 has a design flow on collision count on multiple
869 		 * packet transmission.  When we send two or more packets
870 		 * with one start command (that's what we do when the
871 		 * transmission queue is clauded), 86960 informs us number
872 		 * of collisions occurred on the last packet on the
873 		 * transmission only.  Number of collisions on previous
874 		 * packets are lost.  I have told that the fact is clearly
875 		 * stated in the Fujitsu document.
876 		 *
877 		 * I considered not to mind it seriously.  Collision
878 		 * count is not so important, anyway.  Any comments?  FIXME.
879 		 */
880 
881 		if (bus_space_read_1(bst, bsh, FE_DLCR0) & FE_D0_COLLID) {
882 			/* Clear collision flag. */
883 			bus_space_write_1(bst, bsh, FE_DLCR0, FE_D0_COLLID);
884 
885 			/* Extract collision count from 86960. */
886 			col = bus_space_read_1(bst, bsh, FE_DLCR4) & FE_D4_COL;
887 			if (col == 0) {
888 				/*
889 				 * Status register indicates collisions,
890 				 * while the collision count is zero.
891 				 * This can happen after multiple packet
892 				 * transmission, indicating that one or more
893 				 * previous packet(s) had been collided.
894 				 *
895 				 * Since the accurate number of collisions
896 				 * has been lost, we just guess it as 1;
897 				 * Am I too optimistic?  FIXME.
898 				 */
899 				col = 1;
900 			} else
901 				col >>= FE_D4_COL_SHIFT;
902 			ifp->if_collisions += col;
903 #if FE_DEBUG >= 4
904 			log(LOG_WARNING, "%s: %d collision%s (%d)\n",
905 			    sc->sc_dev.dv_xname, col, col == 1 ? "" : "s",
906 			    sc->txb_sched);
907 #endif
908 		}
909 
910 		/*
911 		 * Update total number of successfully
912 		 * transmitted packets.
913 		 */
914 		ifp->if_opackets += sc->txb_sched;
915 		sc->txb_sched = 0;
916 	}
917 
918 	if (sc->txb_sched == 0) {
919 		/*
920 		 * The transmitter is no more active.
921 		 * Reset output active flag and watchdog timer.
922 		 */
923 		ifp->if_flags &= ~IFF_OACTIVE;
924 		ifp->if_timer = 0;
925 
926 		/*
927 		 * If more data is ready to transmit in the buffer, start
928 		 * transmitting them.  Otherwise keep transmitter idle,
929 		 * even if more data is queued.  This gives receive
930 		 * process a slight priority.
931 		 */
932 		if (sc->txb_count > 0)
933 			mb86960_xmit(sc);
934 	}
935 }
936 
937 /*
938  * Ethernet interface receiver interrupt.
939  */
940 void
941 mb86960_rint(struct mb86960_softc *sc, uint8_t rstat)
942 {
943 	bus_space_tag_t bst = sc->sc_bst;
944 	bus_space_handle_t bsh = sc->sc_bsh;
945 	struct ifnet *ifp = &sc->sc_ec.ec_if;
946 	u_int status, len;
947 	int i;
948 
949 	/*
950 	 * Update statistics if this interrupt is caused by an error.
951 	 */
952 	if (rstat & (FE_D1_OVRFLO | FE_D1_CRCERR | FE_D1_ALGERR |
953 	    FE_D1_SRTPKT)) {
954 #if FE_DEBUG >= 3
955 		char sbuf[sizeof(FE_D1_ERRBITS) + 64];
956 
957 		bitmask_snprintf(rstat, FE_D1_ERRBITS, sbuf, sizeof(sbuf));
958 		log(LOG_WARNING, "%s: receive error: %s\n",
959 		    sc->sc_dev.dv_xname, sbuf);
960 #endif
961 		ifp->if_ierrors++;
962 	}
963 
964 	/*
965 	 * MB86960 has a flag indicating "receive queue empty."
966 	 * We just loop checking the flag to pull out all received
967 	 * packets.
968 	 *
969 	 * We limit the number of iterrations to avoid infinite loop.
970 	 * It can be caused by a very slow CPU (some broken
971 	 * peripheral may insert incredible number of wait cycles)
972 	 * or, worse, by a broken MB86960 chip.
973 	 */
974 	for (i = 0; i < FE_MAX_RECV_COUNT; i++) {
975 		/* Stop the iterration if 86960 indicates no packets. */
976 		if (bus_space_read_1(bst, bsh, FE_DLCR5) & FE_D5_BUFEMP)
977 			break;
978 
979 		/*
980 		 * Extract receive packet status from the receive
981 		 * packet header.
982 		 */
983 		if (sc->sc_flags & FE_FLAGS_SBW_BYTE) {
984 			status = bus_space_read_1(bst, bsh, FE_BMPR8);
985 			(void)bus_space_read_1(bst, bsh, FE_BMPR8);
986 		} else
987 			status = bus_space_read_2(bst, bsh, FE_BMPR8);
988 
989 #if FE_DEBUG >= 4
990 		log(LOG_INFO, "%s: receive status = %02x\n",
991 		    sc->sc_dev.dv_xname, status);
992 #endif
993 
994 		/*
995 		 * If there was an error, update statistics and drop
996 		 * the packet, unless the interface is in promiscuous
997 		 * mode.
998 		 */
999 		if ((status & FE_RXSTAT_GOODPKT) == 0) {
1000 			if ((ifp->if_flags & IFF_PROMISC) == 0) {
1001 				ifp->if_ierrors++;
1002 				mb86960_droppacket(sc);
1003 				continue;
1004 			}
1005 		}
1006 
1007 		/*
1008 		 * Extract the packet length from the receive packet header.
1009 		 * It is a sum of a header (14 bytes) and a payload.
1010 		 * CRC has been stripped off by the 86960.
1011 		 */
1012 		if (sc->sc_flags & FE_FLAGS_SBW_BYTE) {
1013 			len  = bus_space_read_1(bst, bsh, FE_BMPR8);
1014 			len |= bus_space_read_1(bst, bsh, FE_BMPR8) << 8;
1015 		} else
1016 			len = bus_space_read_2(bst, bsh, FE_BMPR8);
1017 
1018 		/*
1019 		 * MB86965 checks the packet length and drop big packet
1020 		 * before passing it to us.  There are no chance we can
1021 		 * get [crufty] packets.  Hence, if the length exceeds
1022 		 * the specified limit, it means some serious failure,
1023 		 * such as out-of-sync on receive buffer management.
1024 		 *
1025 		 * Is this statement true?  FIXME.
1026 		 */
1027 		if (len > (ETHER_MAX_LEN - ETHER_CRC_LEN) ||
1028 		    len < ETHER_HDR_LEN) {
1029 #if FE_DEBUG >= 2
1030 			log(LOG_WARNING,
1031 			    "%s: received a %s packet? (%u bytes)\n",
1032 			    sc->sc_dev.dv_xname,
1033 			    len < ETHER_HDR_LEN ? "partial" : "big", len);
1034 #endif
1035 			ifp->if_ierrors++;
1036 			mb86960_droppacket(sc);
1037 			continue;
1038 		}
1039 
1040 		/*
1041 		 * Check for a short (RUNT) packet.  We *do* check
1042 		 * but do nothing other than print a message.
1043 		 * Short packets are illegal, but does nothing bad
1044 		 * if it carries data for upper layer.
1045 		 */
1046 #if FE_DEBUG >= 2
1047 		if (len < (ETHER_MIN_LEN - ETHER_CRC_LEN)) {
1048 			log(LOG_WARNING,
1049 			    "%s: received a short packet? (%u bytes)\n",
1050 			    sc->sc_dev.dv_xname, len);
1051 		}
1052 #endif
1053 
1054 		/*
1055 		 * Go get a packet.
1056 		 */
1057 		if (mb86960_get_packet(sc, len) == 0) {
1058 			/* Skip a packet, updating statistics. */
1059 #if FE_DEBUG >= 2
1060 			log(LOG_WARNING,
1061 			    "%s: out of mbufs; dropping packet (%u bytes)\n",
1062 			    sc->sc_dev.dv_xname, len);
1063 #endif
1064 			ifp->if_ierrors++;
1065 			mb86960_droppacket(sc);
1066 
1067 			/*
1068 			 * We stop receiving packets, even if there are
1069 			 * more in the buffer.  We hope we can get more
1070 			 * mbufs next time.
1071 			 */
1072 			return;
1073 		}
1074 
1075 		/* Successfully received a packet.  Update stat. */
1076 		ifp->if_ipackets++;
1077 	}
1078 }
1079 
1080 /*
1081  * Ethernet interface interrupt processor
1082  */
1083 int
1084 mb86960_intr(void *arg)
1085 {
1086 	struct mb86960_softc *sc = arg;
1087 	bus_space_tag_t bst = sc->sc_bst;
1088 	bus_space_handle_t bsh = sc->sc_bsh;
1089 	struct ifnet *ifp = &sc->sc_ec.ec_if;
1090 	uint8_t tstat, rstat;
1091 
1092 	if ((sc->sc_stat & FE_STAT_ENABLED) == 0 ||
1093 	    !device_is_active(&sc->sc_dev))
1094 		return (0);
1095 
1096 #if FE_DEBUG >= 4
1097 	log(LOG_INFO, "%s: mb86960_intr()\n", sc->sc_dev.dv_xname);
1098 	mb86960_dump(LOG_INFO, sc);
1099 #endif
1100 
1101 	/*
1102 	 * Get interrupt conditions, masking unneeded flags.
1103 	 */
1104 	tstat = bus_space_read_1(bst, bsh, FE_DLCR0) & FE_TMASK;
1105 	rstat = bus_space_read_1(bst, bsh, FE_DLCR1) & FE_RMASK;
1106 	if (tstat == 0 && rstat == 0)
1107 		return (0);
1108 
1109 	/*
1110 	 * Loop until there are no more new interrupt conditions.
1111 	 */
1112 	for (;;) {
1113 		/*
1114 		 * Reset the conditions we are acknowledging.
1115 		 */
1116 		bus_space_write_1(bst, bsh, FE_DLCR0, tstat);
1117 		bus_space_write_1(bst, bsh, FE_DLCR1, rstat);
1118 
1119 		/*
1120 		 * Handle transmitter interrupts. Handle these first because
1121 		 * the receiver will reset the board under some conditions.
1122 		 */
1123 		if (tstat != 0)
1124 			mb86960_tint(sc, tstat);
1125 
1126 		/*
1127 		 * Handle receiver interrupts.
1128 		 */
1129 		if (rstat != 0)
1130 			mb86960_rint(sc, rstat);
1131 
1132 		/*
1133 		 * Update the multicast address filter if it is
1134 		 * needed and possible.  We do it now, because
1135 		 * we can make sure the transmission buffer is empty,
1136 		 * and there is a good chance that the receive queue
1137 		 * is empty.  It will minimize the possibility of
1138 		 * packet lossage.
1139 		 */
1140 		if (sc->filter_change &&
1141 		    sc->txb_count == 0 && sc->txb_sched == 0) {
1142 			mb86960_loadmar(sc);
1143 			ifp->if_flags &= ~IFF_OACTIVE;
1144 		}
1145 
1146 		/*
1147 		 * If it looks like the transmitter can take more data,
1148 		 * attempt to start output on the interface. This is done
1149 		 * after handling the receiver interrupt to give the
1150 		 * receive operation priority.
1151 		 */
1152 		if ((ifp->if_flags & IFF_OACTIVE) == 0)
1153 			mb86960_start(ifp);
1154 
1155 #if NRND > 0
1156 		if (rstat != 0 || tstat != 0)
1157 			rnd_add_uint32(&sc->rnd_source, rstat + tstat);
1158 #endif
1159 
1160 		/*
1161 		 * Get interrupt conditions, masking unneeded flags.
1162 		 */
1163 		tstat = bus_space_read_1(bst, bsh, FE_DLCR0) & FE_TMASK;
1164 		rstat = bus_space_read_1(bst, bsh, FE_DLCR1) & FE_RMASK;
1165 		if (tstat == 0 && rstat == 0)
1166 			return (1);
1167 	}
1168 }
1169 
1170 /*
1171  * Process an ioctl request.  This code needs some work - it looks pretty ugly.
1172  */
1173 int
1174 mb86960_ioctl(struct ifnet *ifp, u_long cmd, caddr_t data)
1175 {
1176 	struct mb86960_softc *sc = ifp->if_softc;
1177 	struct ifaddr *ifa = (struct ifaddr *)data;
1178 	struct ifreq *ifr = (struct ifreq *)data;
1179 	int s, error = 0;
1180 
1181 #if FE_DEBUG >= 3
1182 	log(LOG_INFO, "%s: ioctl(%lx)\n", sc->sc_dev.dv_xname, cmd);
1183 #endif
1184 
1185 	s = splnet();
1186 
1187 	switch (cmd) {
1188 	case SIOCSIFADDR:
1189 		if ((error = mb86960_enable(sc)) != 0)
1190 			break;
1191 		ifp->if_flags |= IFF_UP;
1192 
1193 		switch (ifa->ifa_addr->sa_family) {
1194 #ifdef INET
1195 		case AF_INET:
1196 			mb86960_init(sc);
1197 			arp_ifinit(ifp, ifa);
1198 			break;
1199 #endif
1200 		default:
1201 			mb86960_init(sc);
1202 			break;
1203 		}
1204 		break;
1205 
1206 	case SIOCSIFFLAGS:
1207 		if ((ifp->if_flags & IFF_UP) == 0 &&
1208 		    (ifp->if_flags & IFF_RUNNING) != 0) {
1209 			/*
1210 			 * If interface is marked down and it is running, then
1211 			 * stop it.
1212 			 */
1213 			mb86960_stop(sc);
1214 			ifp->if_flags &= ~IFF_RUNNING;
1215 			mb86960_disable(sc);
1216 		} else if ((ifp->if_flags & IFF_UP) != 0 &&
1217 		    (ifp->if_flags & IFF_RUNNING) == 0) {
1218 			/*
1219 			 * If interface is marked up and it is stopped, then
1220 			 * start it.
1221 			 */
1222 			if ((error = mb86960_enable(sc)) != 0)
1223 				break;
1224 			mb86960_init(sc);
1225 		} else if ((ifp->if_flags & IFF_UP) != 0) {
1226 			/*
1227 			 * Reset the interface to pick up changes in any other
1228 			 * flags that affect hardware registers.
1229 			 */
1230 			mb86960_setmode(sc);
1231 		}
1232 #if FE_DEBUG >= 1
1233 		/* "ifconfig fe0 debug" to print register dump. */
1234 		if (ifp->if_flags & IFF_DEBUG) {
1235 			log(LOG_INFO, "%s: SIOCSIFFLAGS(DEBUG)\n",
1236 			    sc->sc_dev.dv_xname);
1237 			mb86960_dump(LOG_DEBUG, sc);
1238 		}
1239 #endif
1240 		break;
1241 
1242 	case SIOCADDMULTI:
1243 	case SIOCDELMULTI:
1244 		if ((sc->sc_stat & FE_STAT_ENABLED) == 0) {
1245 			error = EIO;
1246 			break;
1247 		}
1248 
1249 		/* Update our multicast list. */
1250 		error = (cmd == SIOCADDMULTI) ?
1251 		    ether_addmulti(ifr, &sc->sc_ec) :
1252 		    ether_delmulti(ifr, &sc->sc_ec);
1253 
1254 		if (error == ENETRESET) {
1255 			/*
1256 			 * Multicast list has changed; set the hardware filter
1257 			 * accordingly.
1258 			 */
1259 			if (ifp->if_flags & IFF_RUNNING)
1260 				mb86960_setmode(sc);
1261 			error = 0;
1262 		}
1263 		break;
1264 
1265 	case SIOCGIFMEDIA:
1266 	case SIOCSIFMEDIA:
1267 		error = ifmedia_ioctl(ifp, ifr, &sc->sc_media, cmd);
1268 		break;
1269 
1270 	default:
1271 		error = EINVAL;
1272 		break;
1273 	}
1274 
1275 	splx(s);
1276 	return (error);
1277 }
1278 
1279 /*
1280  * Retrieve packet from receive buffer and send to the next level up via
1281  * ether_input(). If there is a BPF listener, give a copy to BPF, too.
1282  * Returns 0 if success, -1 if error (i.e., mbuf allocation failure).
1283  */
1284 int
1285 mb86960_get_packet(struct mb86960_softc *sc, u_int len)
1286 {
1287 	bus_space_tag_t bst = sc->sc_bst;
1288 	bus_space_handle_t bsh = sc->sc_bsh;
1289 	struct ifnet *ifp = &sc->sc_ec.ec_if;
1290 	struct mbuf *m;
1291 
1292 	/* Allocate a header mbuf. */
1293 	MGETHDR(m, M_DONTWAIT, MT_DATA);
1294 	if (m == 0)
1295 		return (0);
1296 	m->m_pkthdr.rcvif = ifp;
1297 	m->m_pkthdr.len = len;
1298 
1299 	/* The following silliness is to make NFS happy. */
1300 #define	EROUND	((sizeof(struct ether_header) + 3) & ~3)
1301 #define	EOFF	(EROUND - sizeof(struct ether_header))
1302 
1303 	/*
1304 	 * Our strategy has one more problem.  There is a policy on
1305 	 * mbuf cluster allocation.  It says that we must have at
1306 	 * least MINCLSIZE (208 bytes) to allocate a cluster.  For a
1307 	 * packet of a size between (MHLEN - 2) to (MINCLSIZE - 2),
1308 	 * our code violates the rule...
1309 	 * On the other hand, the current code is short, simple,
1310 	 * and fast, however.  It does no harmful thing, just waists
1311 	 * some memory.  Any comments?  FIXME.
1312 	 */
1313 
1314 	/* Attach a cluster if this packet doesn't fit in a normal mbuf. */
1315 	if (len > MHLEN - EOFF) {
1316 		MCLGET(m, M_DONTWAIT);
1317 		if ((m->m_flags & M_EXT) == 0) {
1318 			m_freem(m);
1319 			return (0);
1320 		}
1321 	}
1322 
1323 	/*
1324 	 * The following assumes there is room for the ether header in the
1325 	 * header mbuf.
1326 	 */
1327 	m->m_data += EOFF;
1328 
1329 	/* Set the length of this packet. */
1330 	m->m_len = len;
1331 
1332 	/* Get a packet. */
1333 	if (sc->sc_flags & FE_FLAGS_SBW_BYTE)
1334 		bus_space_read_multi_1(bst, bsh, FE_BMPR8,
1335 		    mtod(m, uint8_t *), len);
1336 	else
1337 		bus_space_read_multi_stream_2(bst, bsh, FE_BMPR8,
1338 		    mtod(m, uint16_t *), (len + 1) >> 1);
1339 
1340 #if NBPFILTER > 0
1341 	/*
1342 	 * Check if there's a BPF listener on this interface.  If so, hand off
1343 	 * the raw packet to bpf.
1344 	 */
1345 	if (ifp->if_bpf)
1346 		bpf_mtap(ifp->if_bpf, m);
1347 #endif
1348 
1349 	(*ifp->if_input)(ifp, m);
1350 	return (1);
1351 }
1352 
1353 /*
1354  * Write an mbuf chain to the transmission buffer memory using 16 bit PIO.
1355  * Returns number of bytes actually written, including length word.
1356  *
1357  * If an mbuf chain is too long for an Ethernet frame, it is not sent.
1358  * Packets shorter than Ethernet minimum are legal, and we pad them
1359  * before sending out.  An exception is "partial" packets which are
1360  * shorter than mandatory Ethernet header.
1361  *
1362  * I wrote a code for an experimental "delayed padding" technique.
1363  * When employed, it postpones the padding process for short packets.
1364  * If xmit() occurred at the moment, the padding process is omitted, and
1365  * garbages are sent as pad data.  If next packet is stored in the
1366  * transmission buffer before xmit(), write_mbuf() pads the previous
1367  * packet before transmitting new packet.  This *may* gain the
1368  * system performance (slightly).
1369  */
1370 void
1371 mb86960_write_mbufs(struct mb86960_softc *sc, struct mbuf *m)
1372 {
1373 	bus_space_tag_t bst = sc->sc_bst;
1374 	bus_space_handle_t bsh = sc->sc_bsh;
1375 	int totlen, len;
1376 #if FE_DEBUG >= 2
1377 	struct mbuf *mp;
1378 #endif
1379 
1380 #if FE_DELAYED_PADDING
1381 	/* Do the "delayed padding." */
1382 	if (sc->txb_padding > 0) {
1383 		if (sc->sc_flags & FE_FLAGS_SBW_BYTE) {
1384 			for (len = sc->txb_padding; len > 0; len--)
1385 				bus_space_write_1(bst, bsh, FE_BMPR8, 0);
1386 		} else {
1387 			for (len = sc->txb_padding >> 1; len > 0; len--)
1388 				bus_space_write_2(bst, bsh, FE_BMPR8, 0);
1389 		}
1390 		sc->txb_padding = 0;
1391 	}
1392 #endif
1393 
1394 	/* We need to use m->m_pkthdr.len, so require the header */
1395 	if ((m->m_flags & M_PKTHDR) == 0)
1396 	  	panic("mb86960_write_mbufs: no header mbuf");
1397 
1398 #if FE_DEBUG >= 2
1399 	/* First, count up the total number of bytes to copy. */
1400 	for (totlen = 0, mp = m; mp != 0; mp = mp->m_next)
1401 		totlen += mp->m_len;
1402 	/* Check if this matches the one in the packet header. */
1403 	if (totlen != m->m_pkthdr.len)
1404 		log(LOG_WARNING, "%s: packet length mismatch? (%d/%d)\n",
1405 		    sc->sc_dev.dv_xname, totlen, m->m_pkthdr.len);
1406 #else
1407 	/* Just use the length value in the packet header. */
1408 	totlen = m->m_pkthdr.len;
1409 #endif
1410 
1411 #if FE_DEBUG >= 1
1412 	/*
1413 	 * Should never send big packets.  If such a packet is passed,
1414 	 * it should be a bug of upper layer.  We just ignore it.
1415 	 * ... Partial (too short) packets, neither.
1416 	 */
1417 	if (totlen > (ETHER_MAX_LEN - ETHER_CRC_LEN) ||
1418 	    totlen < ETHER_HDR_LEN) {
1419 		log(LOG_ERR, "%s: got a %s packet (%u bytes) to send\n",
1420 		    sc->sc_dev.dv_xname,
1421 		    totlen < ETHER_HDR_LEN ? "partial" : "big", totlen);
1422 		sc->sc_ec.ec_if.if_oerrors++;
1423 		return;
1424 	}
1425 #endif
1426 
1427 	/*
1428 	 * Put the length word for this frame.
1429 	 * Does 86960 accept odd length?  -- Yes.
1430 	 * Do we need to pad the length to minimum size by ourselves?
1431 	 * -- Generally yes.  But for (or will be) the last
1432 	 * packet in the transmission buffer, we can skip the
1433 	 * padding process.  It may gain performance slightly.  FIXME.
1434 	 */
1435 	len = max(totlen, (ETHER_MIN_LEN - ETHER_CRC_LEN));
1436 	if (sc->sc_flags & FE_FLAGS_SBW_BYTE) {
1437 		bus_space_write_1(bst, bsh, FE_BMPR8, len);
1438 		bus_space_write_1(bst, bsh, FE_BMPR8, len >> 8);
1439 	} else {
1440 		bus_space_write_2(bst, bsh, FE_BMPR8, len);
1441 		/* roundup packet length since we will use word access */
1442 		totlen = (totlen + 1) & ~1;
1443 	}
1444 
1445 	/*
1446 	 * Update buffer status now.
1447 	 * Truncate the length up to an even number
1448 	 * if the chip is set in SBW_WORD mode.
1449 	 */
1450 	sc->txb_free -= FE_TXLEN_SIZE +
1451 	    max(totlen, (ETHER_MIN_LEN - ETHER_CRC_LEN));
1452 	sc->txb_count++;
1453 
1454 #if FE_DELAYED_PADDING
1455 	/* Postpone the packet padding if necessary. */
1456 	if (totlen < (ETHER_MIN_LEN - ETHER_CRC_LEN))
1457 		sc->txb_padding = (ETHER_MIN_LEN - ETHER_CRC_LEN) - totlen;
1458 #endif
1459 
1460 	/*
1461 	 * Transfer the data from mbuf chain to the transmission buffer.
1462 	 * If the MB86960 is configured in word mode, data needs to be
1463 	 * transferred as words, and only words.
1464 	 * So that we require some extra code to patch over odd-length
1465 	 * or unaligned mbufs.
1466 	 */
1467 	if (sc->sc_flags & FE_FLAGS_SBW_BYTE) {
1468 		/* It's simple in byte mode. */
1469 		for (; m != NULL; m = m->m_next) {
1470 			if (m->m_len) {
1471 				bus_space_write_multi_1(bst, bsh, FE_BMPR8,
1472 				    mtod(m, uint8_t *), m->m_len);
1473 			}
1474 		}
1475 	} else {
1476 		/* a bit trickier in word mode. */
1477 		uint8_t *data, savebyte[2];
1478 		int leftover;
1479 
1480 		leftover = 0;
1481 		savebyte[0] = savebyte[1] = 0;
1482 
1483 		for (; m != NULL; m = m->m_next) {
1484 			len = m->m_len;
1485 			if (len == 0)
1486 				continue;
1487 			data = mtod(m, uint8_t *);
1488 			while (len > 0) {
1489 				if (leftover) {
1490 					/*
1491 					 * Data left over (from mbuf or
1492 					 * realignment). Buffer the next
1493 					 * byte, and write it and the
1494 					 * leftover data out.
1495 					 */
1496 					savebyte[1] = *data++;
1497 					len--;
1498 					bus_space_write_stream_2(bst, bsh,
1499 					   FE_BMPR8, *(uint16_t *)savebyte);
1500 					leftover = 0;
1501 				} else if (BUS_SPACE_ALIGNED_POINTER(data,
1502 				    uint16_t) == 0) {
1503 					/*
1504 					 * Unaligned data; buffer the next byte.
1505 					 */
1506 					savebyte[0] = *data++;
1507 					len--;
1508 					leftover = 1;
1509 				} else {
1510 					/*
1511 					 * Aligned data; output contiguous
1512 					 * words as much as we can, then
1513 					 * buffer the remaining byte, if any.
1514 					 */
1515 					leftover = len & 1;
1516 					len &= ~1;
1517 					bus_space_write_multi_stream_2(bst, bsh,
1518 					    FE_BMPR8, (uint16_t *)data,
1519 					    len >> 1);
1520 					data += len;
1521 					if (leftover)
1522 						savebyte[0] = *data++;
1523 					len = 0;
1524 				}
1525 			}
1526 			if (len < 0)
1527 				panic("mb86960_write_mbufs: negative len");
1528 		}
1529 		if (leftover) {
1530 			savebyte[1] = 0;
1531 			bus_space_write_stream_2(bst, bsh, FE_BMPR8,
1532 			    *(uint16_t *)savebyte);
1533 		}
1534 	}
1535 #if FE_DELAYED_PADDING == 0
1536 	/*
1537 	 * Pad the packet to the minimum length if necessary.
1538 	 */
1539 	len = (ETHER_MIN_LEN - ETHER_CRC_LEN) - totlen;
1540 	if (len > 0) {
1541 		if (sc->sc_flags & FE_FLAGS_SBW_BYTE) {
1542 			while (len-- > 0)
1543 				bus_space_write_1(bst, bsh, FE_BMPR8, 0);
1544 		} else {
1545 			len >>= 1;
1546 			while (len-- > 0)
1547 				bus_space_write_2(bst, bsh, FE_BMPR8, 0);
1548 		}
1549 	}
1550 #endif
1551 }
1552 
1553 /*
1554  * Compute the multicast address filter from the
1555  * list of multicast addresses we need to listen to.
1556  */
1557 void
1558 mb86960_getmcaf(struct ethercom *ec, uint8_t *af)
1559 {
1560 	struct ifnet *ifp = &ec->ec_if;
1561 	struct ether_multi *enm;
1562 	uint32_t crc;
1563 	struct ether_multistep step;
1564 
1565 	/*
1566 	 * Set up multicast address filter by passing all multicast addresses
1567 	 * through a crc generator, and then using the high order 6 bits as an
1568 	 * index into the 64 bit logical address filter.  The high order bit
1569 	 * selects the word, while the rest of the bits select the bit within
1570 	 * the word.
1571 	 */
1572 
1573 	if ((ifp->if_flags & IFF_PROMISC) != 0)
1574 		goto allmulti;
1575 
1576 	memset(af, 0, FE_FILTER_LEN);
1577 	ETHER_FIRST_MULTI(step, ec, enm);
1578 	while (enm != NULL) {
1579 		if (memcmp(enm->enm_addrlo, enm->enm_addrhi,
1580 		    sizeof(enm->enm_addrlo)) != 0) {
1581 			/*
1582 			 * We must listen to a range of multicast addresses.
1583 			 * For now, just accept all multicasts, rather than
1584 			 * trying to set only those filter bits needed to match
1585 			 * the range.  (At this time, the only use of address
1586 			 * ranges is for IP multicast routing, for which the
1587 			 * range is big enough to require all bits set.)
1588 			 */
1589 			goto allmulti;
1590 		}
1591 
1592 		crc = ether_crc32_le(enm->enm_addrlo, ETHER_ADDR_LEN);
1593 
1594 		/* Just want the 6 most significant bits. */
1595 		crc >>= 26;
1596 
1597 		/* Turn on the corresponding bit in the filter. */
1598 		af[crc >> 3] |= 1 << (crc & 7);
1599 
1600 		ETHER_NEXT_MULTI(step, enm);
1601 	}
1602 	ifp->if_flags &= ~IFF_ALLMULTI;
1603 	return;
1604 
1605 allmulti:
1606 	ifp->if_flags |= IFF_ALLMULTI;
1607 	memset(af, 0xff, FE_FILTER_LEN);
1608 }
1609 
1610 /*
1611  * Calculate a new "multicast packet filter" and put the 86960
1612  * receiver in appropriate mode.
1613  */
1614 void
1615 mb86960_setmode(struct mb86960_softc *sc)
1616 {
1617 	bus_space_tag_t bst = sc->sc_bst;
1618 	bus_space_handle_t bsh = sc->sc_bsh;
1619 	int flags = sc->sc_ec.ec_if.if_flags;
1620 
1621 	/*
1622 	 * If the interface is not running, we postpone the update
1623 	 * process for receive modes and multicast address filter
1624 	 * until the interface is restarted.  It reduces some
1625 	 * complicated job on maintaining chip states.  (Earlier versions
1626 	 * of this driver had a bug on that point...)
1627 	 *
1628 	 * To complete the trick, mb86960_init() calls mb86960_setmode() after
1629 	 * restarting the interface.
1630 	 */
1631 	if ((flags & IFF_RUNNING) == 0)
1632 		return;
1633 
1634 	/*
1635 	 * Promiscuous mode is handled separately.
1636 	 */
1637 	if ((flags & IFF_PROMISC) != 0) {
1638 		/*
1639 		 * Program 86960 to receive all packets on the segment
1640 		 * including those directed to other stations.
1641 		 * Multicast filter stored in MARs are ignored
1642 		 * under this setting, so we don't need to update it.
1643 		 *
1644 		 * Promiscuous mode is used solely by BPF, and BPF only
1645 		 * listens to valid (no error) packets.  So, we ignore
1646 		 * errornous ones even in this mode.
1647 		 */
1648 		bus_space_write_1(bst, bsh, FE_DLCR5,
1649 		    sc->proto_dlcr5 | FE_D5_AFM0 | FE_D5_AFM1);
1650 		sc->filter_change = 0;
1651 
1652 #if FE_DEBUG >= 3
1653 		log(LOG_INFO, "%s: promiscuous mode\n", sc->sc_dev.dv_xname);
1654 #endif
1655 		return;
1656 	}
1657 
1658 	/*
1659 	 * Turn the chip to the normal (non-promiscuous) mode.
1660 	 */
1661 	bus_space_write_1(bst, bsh, FE_DLCR5, sc->proto_dlcr5 | FE_D5_AFM1);
1662 
1663 	/*
1664 	 * Find the new multicast filter value.
1665 	 */
1666 	mb86960_getmcaf(&sc->sc_ec, sc->filter);
1667 	sc->filter_change = 1;
1668 
1669 #if FE_DEBUG >= 3
1670 	log(LOG_INFO,
1671 	    "%s: address filter: [%02x %02x %02x %02x %02x %02x %02x %02x]\n",
1672 	    sc->sc_dev.dv_xname,
1673 	    sc->filter[0], sc->filter[1], sc->filter[2], sc->filter[3],
1674 	    sc->filter[4], sc->filter[5], sc->filter[6], sc->filter[7]);
1675 #endif
1676 
1677 	/*
1678 	 * We have to update the multicast filter in the 86960, A.S.A.P.
1679 	 *
1680 	 * Note that the DLC (Data Linc Control unit, i.e. transmitter
1681 	 * and receiver) must be stopped when feeding the filter, and
1682 	 * DLC trashes all packets in both transmission and receive
1683 	 * buffers when stopped.
1684 	 *
1685 	 * ... Are the above sentenses correct?  I have to check the
1686 	 *     manual of the MB86960A.  FIXME.
1687 	 *
1688 	 * To reduce the packet lossage, we delay the filter update
1689 	 * process until buffers are empty.
1690 	 */
1691 	if (sc->txb_sched == 0 && sc->txb_count == 0 &&
1692 	    (bus_space_read_1(bst, bsh, FE_DLCR1) & FE_D1_PKTRDY) == 0) {
1693 		/*
1694 		 * Buffers are (apparently) empty.  Load
1695 		 * the new filter value into MARs now.
1696 		 */
1697 		mb86960_loadmar(sc);
1698 	} else {
1699 		/*
1700 		 * Buffers are not empty.  Mark that we have to update
1701 		 * the MARs.  The new filter will be loaded by mb86960_intr()
1702 		 * later.
1703 		 */
1704 #if FE_DEBUG >= 4
1705 		log(LOG_INFO, "%s: filter change delayed\n",
1706 		    sc->sc_dev.dv_xname);
1707 #endif
1708 	}
1709 }
1710 
1711 /*
1712  * Load a new multicast address filter into MARs.
1713  *
1714  * The caller must have splnet'ed befor mb86960_loadmar.
1715  * This function starts the DLC upon return.  So it can be called only
1716  * when the chip is working, i.e., from the driver's point of view, when
1717  * a device is RUNNING.  (I mistook the point in previous versions.)
1718  */
1719 void
1720 mb86960_loadmar(struct mb86960_softc *sc)
1721 {
1722 	bus_space_tag_t bst = sc->sc_bst;
1723 	bus_space_handle_t bsh = sc->sc_bsh;
1724 
1725 	/* Stop the DLC (transmitter and receiver). */
1726 	bus_space_write_1(bst, bsh, FE_DLCR6,
1727 	    sc->proto_dlcr6 | FE_D6_DLC_DISABLE);
1728 
1729 	/* Select register bank 1 for MARs. */
1730 	bus_space_write_1(bst, bsh, FE_DLCR7,
1731 	    sc->proto_dlcr7 | FE_D7_RBS_MAR | FE_D7_POWER_UP);
1732 
1733 	/* Copy filter value into the registers. */
1734 	bus_space_write_region_1(bst, bsh, FE_MAR8, sc->filter, FE_FILTER_LEN);
1735 
1736 	/* Restore the bank selection for BMPRs (i.e., runtime registers). */
1737 	bus_space_write_1(bst, bsh, FE_DLCR7,
1738 	    sc->proto_dlcr7 | FE_D7_RBS_BMPR | FE_D7_POWER_UP);
1739 
1740 	/* Restart the DLC. */
1741 	bus_space_write_1(bst, bsh, FE_DLCR6,
1742 	    sc->proto_dlcr6 | FE_D6_DLC_ENABLE);
1743 
1744 	/* We have just updated the filter. */
1745 	sc->filter_change = 0;
1746 
1747 #if FE_DEBUG >= 3
1748 	log(LOG_INFO, "%s: address filter changed\n", sc->sc_dev.dv_xname);
1749 #endif
1750 }
1751 
1752 /*
1753  * Enable power on the interface.
1754  */
1755 int
1756 mb86960_enable(struct mb86960_softc *sc)
1757 {
1758 
1759 #if FE_DEBUG >= 3
1760 	log(LOG_INFO, "%s: mb86960_enable()\n", sc->sc_dev.dv_xname);
1761 #endif
1762 
1763 	if ((sc->sc_stat & FE_STAT_ENABLED) == 0 && sc->sc_enable != NULL) {
1764 		if ((*sc->sc_enable)(sc) != 0) {
1765 			printf("%s: device enable failed\n",
1766 			    sc->sc_dev.dv_xname);
1767 			return (EIO);
1768 		}
1769 	}
1770 
1771 	sc->sc_stat |= FE_STAT_ENABLED;
1772 	return (0);
1773 }
1774 
1775 /*
1776  * Disable power on the interface.
1777  */
1778 void
1779 mb86960_disable(struct mb86960_softc *sc)
1780 {
1781 
1782 #if FE_DEBUG >= 3
1783 	log(LOG_INFO, "%s: mb86960_disable()\n", sc->sc_dev.dv_xname);
1784 #endif
1785 
1786 	if ((sc->sc_stat & FE_STAT_ENABLED) != 0 && sc->sc_disable != NULL) {
1787 		(*sc->sc_disable)(sc);
1788 		sc->sc_stat &= ~FE_STAT_ENABLED;
1789 	}
1790 }
1791 
1792 /*
1793  * mbe_activate:
1794  *
1795  *	Handle device activation/deactivation requests.
1796  */
1797 int
1798 mb86960_activate(struct device *self, enum devact act)
1799 {
1800 	struct mb86960_softc *sc = (struct mb86960_softc *)self;
1801 	int rv, s;
1802 
1803 	rv = 0;
1804 	s = splnet();
1805 	switch (act) {
1806 	case DVACT_ACTIVATE:
1807 		rv = EOPNOTSUPP;
1808 		break;
1809 
1810 	case DVACT_DEACTIVATE:
1811 		if_deactivate(&sc->sc_ec.ec_if);
1812 		break;
1813 	}
1814 	splx(s);
1815 	return (rv);
1816 }
1817 
1818 /*
1819  * mb86960_detach:
1820  *
1821  *	Detach a MB86960 interface.
1822  */
1823 int
1824 mb86960_detach(struct mb86960_softc *sc)
1825 {
1826 	struct ifnet *ifp = &sc->sc_ec.ec_if;
1827 
1828 	/* Succeed now if there's no work to do. */
1829 	if ((sc->sc_stat & FE_STAT_ATTACHED) == 0)
1830 		return (0);
1831 
1832 	/* Delete all media. */
1833 	ifmedia_delete_instance(&sc->sc_media, IFM_INST_ANY);
1834 
1835 #if NRND > 0
1836 	/* Unhook the entropy source. */
1837 	rnd_detach_source(&sc->rnd_source);
1838 #endif
1839 	ether_ifdetach(ifp);
1840 	if_detach(ifp);
1841 
1842 	mb86960_disable(sc);
1843 	return (0);
1844 }
1845 
1846 /*
1847  * Routines to read all bytes from the config EEPROM (93C06) through MB86965A.
1848  */
1849 void
1850 mb86965_read_eeprom(bus_space_tag_t iot, bus_space_handle_t ioh, uint8_t *data)
1851 {
1852 	int addr, op, bit;
1853 	uint16_t val;
1854 
1855 	/* Read bytes from EEPROM; two bytes per an iteration. */
1856 	for (addr = 0; addr < FE_EEPROM_SIZE / 2; addr++) {
1857 		/* Reset the EEPROM interface. */
1858 		bus_space_write_1(iot, ioh, FE_BMPR16, 0x00);
1859 		bus_space_write_1(iot, ioh, FE_BMPR17, 0x00);
1860 		bus_space_write_1(iot, ioh, FE_BMPR16, FE_B16_SELECT);
1861 
1862 		/* Send start bit. */
1863 		bus_space_write_1(iot, ioh, FE_BMPR17, FE_B17_DATA);
1864 		FE_EEPROM_DELAY();
1865 		bus_space_write_1(iot, ioh,
1866 		    FE_BMPR16, FE_B16_SELECT | FE_B16_CLOCK);
1867 		FE_EEPROM_DELAY();
1868 		bus_space_write_1(iot, ioh, FE_BMPR16, FE_B16_SELECT);
1869 
1870 		/* Send read command and read address. */
1871 		op = 0x80 | addr;	/* READ instruction */
1872 		for (bit = 8; bit > 0; bit--) {
1873 			bus_space_write_1(iot, ioh, FE_BMPR17,
1874 			    (op & (1 << (bit - 1))) ? FE_B17_DATA : 0);
1875 			FE_EEPROM_DELAY();
1876 			bus_space_write_1(iot, ioh,
1877 			    FE_BMPR16, FE_B16_SELECT | FE_B16_CLOCK);
1878 			FE_EEPROM_DELAY();
1879 			bus_space_write_1(iot, ioh, FE_BMPR16, FE_B16_SELECT);
1880 		}
1881 		bus_space_write_1(iot, ioh, FE_BMPR17, 0x00);
1882 
1883 		/* Read two bytes in each address */
1884 		val = 0;
1885 		for (bit = 16; bit > 0; bit--) {
1886 			FE_EEPROM_DELAY();
1887 			bus_space_write_1(iot, ioh,
1888 			    FE_BMPR16, FE_B16_SELECT | FE_B16_CLOCK);
1889 			FE_EEPROM_DELAY();
1890 			if (bus_space_read_1(iot, ioh, FE_BMPR17) &
1891 			    FE_B17_DATA)
1892 				val |= 1 << (bit - 1);
1893 			bus_space_write_1(iot, ioh,
1894 			    FE_BMPR16, FE_B16_SELECT);
1895 		}
1896 		data[addr * 2]     = val >> 8;
1897 		data[addr * 2 + 1] = val & 0xff;
1898 	}
1899 
1900 	/* Make sure the EEPROM is turned off. */
1901 	bus_space_write_1(iot, ioh, FE_BMPR16, 0);
1902 	bus_space_write_1(iot, ioh, FE_BMPR17, 0);
1903 
1904 #if FE_DEBUG >= 3
1905 	/* Report what we got. */
1906 	log(LOG_INFO, "mb86965_read_eeprom: "
1907 	    " %02x%02x%02x%02x %02x%02x%02x%02x -"
1908 	    " %02x%02x%02x%02x %02x%02x%02x%02x -"
1909 	    " %02x%02x%02x%02x %02x%02x%02x%02x -"
1910 	    " %02x%02x%02x%02x %02x%02x%02x%02x\n",
1911 	    data[ 0], data[ 1], data[ 2], data[ 3],
1912 	    data[ 4], data[ 5], data[ 6], data[ 7],
1913 	    data[ 8], data[ 9], data[10], data[11],
1914 	    data[12], data[13], data[14], data[15],
1915 	    data[16], data[17], data[18], data[19],
1916 	    data[20], data[21], data[22], data[23],
1917 	    data[24], data[25], data[26], data[27],
1918 	    data[28], data[29], data[30], data[31]);
1919 #endif
1920 }
1921 
1922 #if FE_DEBUG >= 1
1923 void
1924 mb86960_dump(int level, struct mb86960_softc *sc)
1925 {
1926 	bus_space_tag_t bst = sc->sc_bst;
1927 	bus_space_handle_t bsh = sc->sc_bsh;
1928 	uint8_t save_dlcr7;
1929 
1930 	save_dlcr7 = bus_space_read_1(bst, bsh, FE_DLCR7);
1931 
1932 	log(level, "\tDLCR = %02x %02x %02x %02x %02x %02x %02x %02x\n",
1933 	    bus_space_read_1(bst, bsh, FE_DLCR0),
1934 	    bus_space_read_1(bst, bsh, FE_DLCR1),
1935 	    bus_space_read_1(bst, bsh, FE_DLCR2),
1936 	    bus_space_read_1(bst, bsh, FE_DLCR3),
1937 	    bus_space_read_1(bst, bsh, FE_DLCR4),
1938 	    bus_space_read_1(bst, bsh, FE_DLCR5),
1939 	    bus_space_read_1(bst, bsh, FE_DLCR6),
1940 	    bus_space_read_1(bst, bsh, FE_DLCR7));
1941 
1942 	bus_space_write_1(bst, bsh, FE_DLCR7,
1943 	    (save_dlcr7 & ~FE_D7_RBS) | FE_D7_RBS_DLCR);
1944 	log(level, "\t       %02x %02x %02x %02x %02x %02x %02x %02x\n",
1945 	    bus_space_read_1(bst, bsh, FE_DLCR8),
1946 	    bus_space_read_1(bst, bsh, FE_DLCR9),
1947 	    bus_space_read_1(bst, bsh, FE_DLCR10),
1948 	    bus_space_read_1(bst, bsh, FE_DLCR11),
1949 	    bus_space_read_1(bst, bsh, FE_DLCR12),
1950 	    bus_space_read_1(bst, bsh, FE_DLCR13),
1951 	    bus_space_read_1(bst, bsh, FE_DLCR14),
1952 	    bus_space_read_1(bst, bsh, FE_DLCR15));
1953 
1954 	bus_space_write_1(bst, bsh, FE_DLCR7,
1955 	    (save_dlcr7 & ~FE_D7_RBS) | FE_D7_RBS_MAR);
1956 	log(level, "\tMAR  = %02x %02x %02x %02x %02x %02x %02x %02x\n",
1957 	    bus_space_read_1(bst, bsh, FE_MAR8),
1958 	    bus_space_read_1(bst, bsh, FE_MAR9),
1959 	    bus_space_read_1(bst, bsh, FE_MAR10),
1960 	    bus_space_read_1(bst, bsh, FE_MAR11),
1961 	    bus_space_read_1(bst, bsh, FE_MAR12),
1962 	    bus_space_read_1(bst, bsh, FE_MAR13),
1963 	    bus_space_read_1(bst, bsh, FE_MAR14),
1964 	    bus_space_read_1(bst, bsh, FE_MAR15));
1965 
1966 	bus_space_write_1(bst, bsh, FE_DLCR7,
1967 	    (save_dlcr7 & ~FE_D7_RBS) | FE_D7_RBS_BMPR);
1968 	log(level,
1969 	    "\tBMPR = xx xx %02x %02x %02x %02x %02x %02x %02x %02x xx %02x\n",
1970 	    bus_space_read_1(bst, bsh, FE_BMPR10),
1971 	    bus_space_read_1(bst, bsh, FE_BMPR11),
1972 	    bus_space_read_1(bst, bsh, FE_BMPR12),
1973 	    bus_space_read_1(bst, bsh, FE_BMPR13),
1974 	    bus_space_read_1(bst, bsh, FE_BMPR14),
1975 	    bus_space_read_1(bst, bsh, FE_BMPR15),
1976 	    bus_space_read_1(bst, bsh, FE_BMPR16),
1977 	    bus_space_read_1(bst, bsh, FE_BMPR17),
1978 	    bus_space_read_1(bst, bsh, FE_BMPR19));
1979 
1980 	bus_space_write_1(bst, bsh, FE_DLCR7, save_dlcr7);
1981 }
1982 #endif
1983 
1984