xref: /netbsd-src/sys/dev/ic/rtl8169.c (revision 7f21db1c0118155e0dd40b75182e30c589d9f63e)
1 /*	$NetBSD: rtl8169.c,v 1.129 2010/01/19 22:06:25 pooka Exp $	*/
2 
3 /*
4  * Copyright (c) 1997, 1998-2003
5  *	Bill Paul <wpaul@windriver.com>.  All rights reserved.
6  *
7  * Redistribution and use in source and binary forms, with or without
8  * modification, are permitted provided that the following conditions
9  * are met:
10  * 1. Redistributions of source code must retain the above copyright
11  *    notice, this list of conditions and the following disclaimer.
12  * 2. Redistributions in binary form must reproduce the above copyright
13  *    notice, this list of conditions and the following disclaimer in the
14  *    documentation and/or other materials provided with the distribution.
15  * 3. All advertising materials mentioning features or use of this software
16  *    must display the following acknowledgement:
17  *	This product includes software developed by Bill Paul.
18  * 4. Neither the name of the author nor the names of any co-contributors
19  *    may be used to endorse or promote products derived from this software
20  *    without specific prior written permission.
21  *
22  * THIS SOFTWARE IS PROVIDED BY Bill Paul AND CONTRIBUTORS ``AS IS'' AND
23  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
24  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
25  * ARE DISCLAIMED.  IN NO EVENT SHALL Bill Paul OR THE VOICES IN HIS HEAD
26  * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
27  * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
28  * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
29  * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
30  * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
31  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
32  * THE POSSIBILITY OF SUCH DAMAGE.
33  */
34 
35 #include <sys/cdefs.h>
36 __KERNEL_RCSID(0, "$NetBSD: rtl8169.c,v 1.129 2010/01/19 22:06:25 pooka Exp $");
37 /* $FreeBSD: /repoman/r/ncvs/src/sys/dev/re/if_re.c,v 1.20 2004/04/11 20:34:08 ru Exp $ */
38 
39 /*
40  * RealTek 8139C+/8169/8169S/8110S PCI NIC driver
41  *
42  * Written by Bill Paul <wpaul@windriver.com>
43  * Senior Networking Software Engineer
44  * Wind River Systems
45  */
46 
47 /*
48  * This driver is designed to support RealTek's next generation of
49  * 10/100 and 10/100/1000 PCI ethernet controllers. There are currently
50  * four devices in this family: the RTL8139C+, the RTL8169, the RTL8169S
51  * and the RTL8110S.
52  *
53  * The 8139C+ is a 10/100 ethernet chip. It is backwards compatible
54  * with the older 8139 family, however it also supports a special
55  * C+ mode of operation that provides several new performance enhancing
56  * features. These include:
57  *
58  *	o Descriptor based DMA mechanism. Each descriptor represents
59  *	  a single packet fragment. Data buffers may be aligned on
60  *	  any byte boundary.
61  *
62  *	o 64-bit DMA
63  *
64  *	o TCP/IP checksum offload for both RX and TX
65  *
66  *	o High and normal priority transmit DMA rings
67  *
68  *	o VLAN tag insertion and extraction
69  *
70  *	o TCP large send (segmentation offload)
71  *
72  * Like the 8139, the 8139C+ also has a built-in 10/100 PHY. The C+
73  * programming API is fairly straightforward. The RX filtering, EEPROM
74  * access and PHY access is the same as it is on the older 8139 series
75  * chips.
76  *
77  * The 8169 is a 64-bit 10/100/1000 gigabit ethernet MAC. It has almost the
78  * same programming API and feature set as the 8139C+ with the following
79  * differences and additions:
80  *
81  *	o 1000Mbps mode
82  *
83  *	o Jumbo frames
84  *
85  *	o GMII and TBI ports/registers for interfacing with copper
86  *	  or fiber PHYs
87  *
88  *      o RX and TX DMA rings can have up to 1024 descriptors
89  *        (the 8139C+ allows a maximum of 64)
90  *
91  *	o Slight differences in register layout from the 8139C+
92  *
93  * The TX start and timer interrupt registers are at different locations
94  * on the 8169 than they are on the 8139C+. Also, the status word in the
95  * RX descriptor has a slightly different bit layout. The 8169 does not
96  * have a built-in PHY. Most reference boards use a Marvell 88E1000 'Alaska'
97  * copper gigE PHY.
98  *
99  * The 8169S/8110S 10/100/1000 devices have built-in copper gigE PHYs
100  * (the 'S' stands for 'single-chip'). These devices have the same
101  * programming API as the older 8169, but also have some vendor-specific
102  * registers for the on-board PHY. The 8110S is a LAN-on-motherboard
103  * part designed to be pin-compatible with the RealTek 8100 10/100 chip.
104  *
105  * This driver takes advantage of the RX and TX checksum offload and
106  * VLAN tag insertion/extraction features. It also implements TX
107  * interrupt moderation using the timer interrupt registers, which
108  * significantly reduces TX interrupt load. There is also support
109  * for jumbo frames, however the 8169/8169S/8110S can not transmit
110  * jumbo frames larger than 7.5K, so the max MTU possible with this
111  * driver is 7500 bytes.
112  */
113 
114 
115 #include <sys/param.h>
116 #include <sys/endian.h>
117 #include <sys/systm.h>
118 #include <sys/sockio.h>
119 #include <sys/mbuf.h>
120 #include <sys/malloc.h>
121 #include <sys/kernel.h>
122 #include <sys/socket.h>
123 #include <sys/device.h>
124 
125 #include <net/if.h>
126 #include <net/if_arp.h>
127 #include <net/if_dl.h>
128 #include <net/if_ether.h>
129 #include <net/if_media.h>
130 #include <net/if_vlanvar.h>
131 
132 #include <netinet/in_systm.h>	/* XXX for IP_MAXPACKET */
133 #include <netinet/in.h>		/* XXX for IP_MAXPACKET */
134 #include <netinet/ip.h>		/* XXX for IP_MAXPACKET */
135 
136 #include <net/bpf.h>
137 
138 #include <sys/bus.h>
139 
140 #include <dev/mii/mii.h>
141 #include <dev/mii/miivar.h>
142 
143 #include <dev/ic/rtl81x9reg.h>
144 #include <dev/ic/rtl81x9var.h>
145 
146 #include <dev/ic/rtl8169var.h>
147 
148 static inline void re_set_bufaddr(struct re_desc *, bus_addr_t);
149 
150 static int re_newbuf(struct rtk_softc *, int, struct mbuf *);
151 static int re_rx_list_init(struct rtk_softc *);
152 static int re_tx_list_init(struct rtk_softc *);
153 static void re_rxeof(struct rtk_softc *);
154 static void re_txeof(struct rtk_softc *);
155 static void re_tick(void *);
156 static void re_start(struct ifnet *);
157 static int re_ioctl(struct ifnet *, u_long, void *);
158 static int re_init(struct ifnet *);
159 static void re_stop(struct ifnet *, int);
160 static void re_watchdog(struct ifnet *);
161 
162 static int re_enable(struct rtk_softc *);
163 static void re_disable(struct rtk_softc *);
164 
165 static int re_gmii_readreg(device_t, int, int);
166 static void re_gmii_writereg(device_t, int, int, int);
167 
168 static int re_miibus_readreg(device_t, int, int);
169 static void re_miibus_writereg(device_t, int, int, int);
170 static void re_miibus_statchg(device_t);
171 
172 static void re_reset(struct rtk_softc *);
173 
174 static inline void
175 re_set_bufaddr(struct re_desc *d, bus_addr_t addr)
176 {
177 
178 	d->re_bufaddr_lo = htole32((uint32_t)addr);
179 	if (sizeof(bus_addr_t) == sizeof(uint64_t))
180 		d->re_bufaddr_hi = htole32((uint64_t)addr >> 32);
181 	else
182 		d->re_bufaddr_hi = 0;
183 }
184 
185 static int
186 re_gmii_readreg(device_t dev, int phy, int reg)
187 {
188 	struct rtk_softc *sc = device_private(dev);
189 	uint32_t rval;
190 	int i;
191 
192 	if (phy != 7)
193 		return 0;
194 
195 	/* Let the rgephy driver read the GMEDIASTAT register */
196 
197 	if (reg == RTK_GMEDIASTAT) {
198 		rval = CSR_READ_1(sc, RTK_GMEDIASTAT);
199 		return rval;
200 	}
201 
202 	CSR_WRITE_4(sc, RTK_PHYAR, reg << 16);
203 	DELAY(1000);
204 
205 	for (i = 0; i < RTK_TIMEOUT; i++) {
206 		rval = CSR_READ_4(sc, RTK_PHYAR);
207 		if (rval & RTK_PHYAR_BUSY)
208 			break;
209 		DELAY(100);
210 	}
211 
212 	if (i == RTK_TIMEOUT) {
213 		printf("%s: PHY read failed\n", device_xname(sc->sc_dev));
214 		return 0;
215 	}
216 
217 	return rval & RTK_PHYAR_PHYDATA;
218 }
219 
220 static void
221 re_gmii_writereg(device_t dev, int phy, int reg, int data)
222 {
223 	struct rtk_softc *sc = device_private(dev);
224 	uint32_t rval;
225 	int i;
226 
227 	CSR_WRITE_4(sc, RTK_PHYAR, (reg << 16) |
228 	    (data & RTK_PHYAR_PHYDATA) | RTK_PHYAR_BUSY);
229 	DELAY(1000);
230 
231 	for (i = 0; i < RTK_TIMEOUT; i++) {
232 		rval = CSR_READ_4(sc, RTK_PHYAR);
233 		if (!(rval & RTK_PHYAR_BUSY))
234 			break;
235 		DELAY(100);
236 	}
237 
238 	if (i == RTK_TIMEOUT) {
239 		printf("%s: PHY write reg %x <- %x failed\n",
240 		    device_xname(sc->sc_dev), reg, data);
241 	}
242 }
243 
244 static int
245 re_miibus_readreg(device_t dev, int phy, int reg)
246 {
247 	struct rtk_softc *sc = device_private(dev);
248 	uint16_t rval = 0;
249 	uint16_t re8139_reg = 0;
250 	int s;
251 
252 	s = splnet();
253 
254 	if ((sc->sc_quirk & RTKQ_8139CPLUS) == 0) {
255 		rval = re_gmii_readreg(dev, phy, reg);
256 		splx(s);
257 		return rval;
258 	}
259 
260 	/* Pretend the internal PHY is only at address 0 */
261 	if (phy) {
262 		splx(s);
263 		return 0;
264 	}
265 	switch (reg) {
266 	case MII_BMCR:
267 		re8139_reg = RTK_BMCR;
268 		break;
269 	case MII_BMSR:
270 		re8139_reg = RTK_BMSR;
271 		break;
272 	case MII_ANAR:
273 		re8139_reg = RTK_ANAR;
274 		break;
275 	case MII_ANER:
276 		re8139_reg = RTK_ANER;
277 		break;
278 	case MII_ANLPAR:
279 		re8139_reg = RTK_LPAR;
280 		break;
281 	case MII_PHYIDR1:
282 	case MII_PHYIDR2:
283 		splx(s);
284 		return 0;
285 	/*
286 	 * Allow the rlphy driver to read the media status
287 	 * register. If we have a link partner which does not
288 	 * support NWAY, this is the register which will tell
289 	 * us the results of parallel detection.
290 	 */
291 	case RTK_MEDIASTAT:
292 		rval = CSR_READ_1(sc, RTK_MEDIASTAT);
293 		splx(s);
294 		return rval;
295 	default:
296 		printf("%s: bad phy register\n", device_xname(sc->sc_dev));
297 		splx(s);
298 		return 0;
299 	}
300 	rval = CSR_READ_2(sc, re8139_reg);
301 	if ((sc->sc_quirk & RTKQ_8139CPLUS) != 0 && re8139_reg == RTK_BMCR) {
302 		/* 8139C+ has different bit layout. */
303 		rval &= ~(BMCR_LOOP | BMCR_ISO);
304 	}
305 	splx(s);
306 	return rval;
307 }
308 
309 static void
310 re_miibus_writereg(device_t dev, int phy, int reg, int data)
311 {
312 	struct rtk_softc *sc = device_private(dev);
313 	uint16_t re8139_reg = 0;
314 	int s;
315 
316 	s = splnet();
317 
318 	if ((sc->sc_quirk & RTKQ_8139CPLUS) == 0) {
319 		re_gmii_writereg(dev, phy, reg, data);
320 		splx(s);
321 		return;
322 	}
323 
324 	/* Pretend the internal PHY is only at address 0 */
325 	if (phy) {
326 		splx(s);
327 		return;
328 	}
329 	switch (reg) {
330 	case MII_BMCR:
331 		re8139_reg = RTK_BMCR;
332 		if ((sc->sc_quirk & RTKQ_8139CPLUS) != 0) {
333 			/* 8139C+ has different bit layout. */
334 			data &= ~(BMCR_LOOP | BMCR_ISO);
335 		}
336 		break;
337 	case MII_BMSR:
338 		re8139_reg = RTK_BMSR;
339 		break;
340 	case MII_ANAR:
341 		re8139_reg = RTK_ANAR;
342 		break;
343 	case MII_ANER:
344 		re8139_reg = RTK_ANER;
345 		break;
346 	case MII_ANLPAR:
347 		re8139_reg = RTK_LPAR;
348 		break;
349 	case MII_PHYIDR1:
350 	case MII_PHYIDR2:
351 		splx(s);
352 		return;
353 		break;
354 	default:
355 		printf("%s: bad phy register\n", device_xname(sc->sc_dev));
356 		splx(s);
357 		return;
358 	}
359 	CSR_WRITE_2(sc, re8139_reg, data);
360 	splx(s);
361 	return;
362 }
363 
364 static void
365 re_miibus_statchg(device_t dev)
366 {
367 
368 	return;
369 }
370 
371 static void
372 re_reset(struct rtk_softc *sc)
373 {
374 	int i;
375 
376 	CSR_WRITE_1(sc, RTK_COMMAND, RTK_CMD_RESET);
377 
378 	for (i = 0; i < RTK_TIMEOUT; i++) {
379 		DELAY(10);
380 		if ((CSR_READ_1(sc, RTK_COMMAND) & RTK_CMD_RESET) == 0)
381 			break;
382 	}
383 	if (i == RTK_TIMEOUT)
384 		printf("%s: reset never completed!\n",
385 		    device_xname(sc->sc_dev));
386 
387 	/*
388 	 * NB: Realtek-supplied FreeBSD driver does this only for MACFG_3,
389 	 *     but also says "Rtl8169s sigle chip detected".
390 	 */
391 	if ((sc->sc_quirk & RTKQ_MACLDPS) != 0)
392 		CSR_WRITE_1(sc, RTK_LDPS, 1);
393 
394 }
395 
396 /*
397  * The following routine is designed to test for a defect on some
398  * 32-bit 8169 cards. Some of these NICs have the REQ64# and ACK64#
399  * lines connected to the bus, however for a 32-bit only card, they
400  * should be pulled high. The result of this defect is that the
401  * NIC will not work right if you plug it into a 64-bit slot: DMA
402  * operations will be done with 64-bit transfers, which will fail
403  * because the 64-bit data lines aren't connected.
404  *
405  * There's no way to work around this (short of talking a soldering
406  * iron to the board), however we can detect it. The method we use
407  * here is to put the NIC into digital loopback mode, set the receiver
408  * to promiscuous mode, and then try to send a frame. We then compare
409  * the frame data we sent to what was received. If the data matches,
410  * then the NIC is working correctly, otherwise we know the user has
411  * a defective NIC which has been mistakenly plugged into a 64-bit PCI
412  * slot. In the latter case, there's no way the NIC can work correctly,
413  * so we print out a message on the console and abort the device attach.
414  */
415 
416 int
417 re_diag(struct rtk_softc *sc)
418 {
419 	struct ifnet *ifp = &sc->ethercom.ec_if;
420 	struct mbuf *m0;
421 	struct ether_header *eh;
422 	struct re_rxsoft *rxs;
423 	struct re_desc *cur_rx;
424 	bus_dmamap_t dmamap;
425 	uint16_t status;
426 	uint32_t rxstat;
427 	int total_len, i, s, error = 0;
428 	static const uint8_t dst[] = { 0x00, 'h', 'e', 'l', 'l', 'o' };
429 	static const uint8_t src[] = { 0x00, 'w', 'o', 'r', 'l', 'd' };
430 
431 	/* Allocate a single mbuf */
432 
433 	MGETHDR(m0, M_DONTWAIT, MT_DATA);
434 	if (m0 == NULL)
435 		return ENOBUFS;
436 
437 	/*
438 	 * Initialize the NIC in test mode. This sets the chip up
439 	 * so that it can send and receive frames, but performs the
440 	 * following special functions:
441 	 * - Puts receiver in promiscuous mode
442 	 * - Enables digital loopback mode
443 	 * - Leaves interrupts turned off
444 	 */
445 
446 	ifp->if_flags |= IFF_PROMISC;
447 	sc->re_testmode = 1;
448 	re_init(ifp);
449 	re_stop(ifp, 0);
450 	DELAY(100000);
451 	re_init(ifp);
452 
453 	/* Put some data in the mbuf */
454 
455 	eh = mtod(m0, struct ether_header *);
456 	memcpy(eh->ether_dhost, (char *)&dst, ETHER_ADDR_LEN);
457 	memcpy(eh->ether_shost, (char *)&src, ETHER_ADDR_LEN);
458 	eh->ether_type = htons(ETHERTYPE_IP);
459 	m0->m_pkthdr.len = m0->m_len = ETHER_MIN_LEN - ETHER_CRC_LEN;
460 
461 	/*
462 	 * Queue the packet, start transmission.
463 	 */
464 
465 	CSR_WRITE_2(sc, RTK_ISR, 0xFFFF);
466 	s = splnet();
467 	IF_ENQUEUE(&ifp->if_snd, m0);
468 	re_start(ifp);
469 	splx(s);
470 	m0 = NULL;
471 
472 	/* Wait for it to propagate through the chip */
473 
474 	DELAY(100000);
475 	for (i = 0; i < RTK_TIMEOUT; i++) {
476 		status = CSR_READ_2(sc, RTK_ISR);
477 		if ((status & (RTK_ISR_TIMEOUT_EXPIRED | RTK_ISR_RX_OK)) ==
478 		    (RTK_ISR_TIMEOUT_EXPIRED | RTK_ISR_RX_OK))
479 			break;
480 		DELAY(10);
481 	}
482 	if (i == RTK_TIMEOUT) {
483 		aprint_error_dev(sc->sc_dev,
484 		    "diagnostic failed, failed to receive packet "
485 		    "in loopback mode\n");
486 		error = EIO;
487 		goto done;
488 	}
489 
490 	/*
491 	 * The packet should have been dumped into the first
492 	 * entry in the RX DMA ring. Grab it from there.
493 	 */
494 
495 	rxs = &sc->re_ldata.re_rxsoft[0];
496 	dmamap = rxs->rxs_dmamap;
497 	bus_dmamap_sync(sc->sc_dmat, dmamap, 0, dmamap->dm_mapsize,
498 	    BUS_DMASYNC_POSTREAD);
499 	bus_dmamap_unload(sc->sc_dmat, dmamap);
500 
501 	m0 = rxs->rxs_mbuf;
502 	rxs->rxs_mbuf = NULL;
503 	eh = mtod(m0, struct ether_header *);
504 
505 	RE_RXDESCSYNC(sc, 0, BUS_DMASYNC_POSTREAD|BUS_DMASYNC_POSTWRITE);
506 	cur_rx = &sc->re_ldata.re_rx_list[0];
507 	rxstat = le32toh(cur_rx->re_cmdstat);
508 	total_len = rxstat & sc->re_rxlenmask;
509 
510 	if (total_len != ETHER_MIN_LEN) {
511 		aprint_error_dev(sc->sc_dev,
512 		    "diagnostic failed, received short packet\n");
513 		error = EIO;
514 		goto done;
515 	}
516 
517 	/* Test that the received packet data matches what we sent. */
518 
519 	if (memcmp((char *)&eh->ether_dhost, (char *)&dst, ETHER_ADDR_LEN) ||
520 	    memcmp((char *)&eh->ether_shost, (char *)&src, ETHER_ADDR_LEN) ||
521 	    ntohs(eh->ether_type) != ETHERTYPE_IP) {
522 		aprint_error_dev(sc->sc_dev, "WARNING, DMA FAILURE!\n"
523 		    "expected TX data: %s/%s/0x%x\n"
524 		    "received RX data: %s/%s/0x%x\n"
525 		    "You may have a defective 32-bit NIC plugged "
526 		    "into a 64-bit PCI slot.\n"
527 		    "Please re-install the NIC in a 32-bit slot "
528 		    "for proper operation.\n"
529 		    "Read the re(4) man page for more details.\n" ,
530 		    ether_sprintf(dst),  ether_sprintf(src), ETHERTYPE_IP,
531 		    ether_sprintf(eh->ether_dhost),
532 		    ether_sprintf(eh->ether_shost), ntohs(eh->ether_type));
533 		error = EIO;
534 	}
535 
536  done:
537 	/* Turn interface off, release resources */
538 
539 	sc->re_testmode = 0;
540 	ifp->if_flags &= ~IFF_PROMISC;
541 	re_stop(ifp, 0);
542 	if (m0 != NULL)
543 		m_freem(m0);
544 
545 	return error;
546 }
547 
548 
549 /*
550  * Attach the interface. Allocate softc structures, do ifmedia
551  * setup and ethernet/BPF attach.
552  */
553 void
554 re_attach(struct rtk_softc *sc)
555 {
556 	uint8_t eaddr[ETHER_ADDR_LEN];
557 	uint16_t val;
558 	struct ifnet *ifp;
559 	int error = 0, i, addr_len;
560 
561 	if ((sc->sc_quirk & RTKQ_8139CPLUS) == 0) {
562 		uint32_t hwrev;
563 
564 		/* Revision of 8169/8169S/8110s in bits 30..26, 23 */
565 		hwrev = CSR_READ_4(sc, RTK_TXCFG) & RTK_TXCFG_HWREV;
566 		switch (hwrev) {
567 		case RTK_HWREV_8169:
568 			sc->sc_quirk |= RTKQ_8169NONS;
569 			break;
570 		case RTK_HWREV_8169S:
571 		case RTK_HWREV_8110S:
572 		case RTK_HWREV_8169_8110SB:
573 		case RTK_HWREV_8169_8110SC:
574 			sc->sc_quirk |= RTKQ_MACLDPS;
575 			break;
576 		case RTK_HWREV_8168_SPIN1:
577 		case RTK_HWREV_8168_SPIN2:
578 		case RTK_HWREV_8168_SPIN3:
579 			sc->sc_quirk |= RTKQ_MACSTAT;
580 			break;
581 		case RTK_HWREV_8168C:
582 		case RTK_HWREV_8168C_SPIN2:
583 		case RTK_HWREV_8168CP:
584 		case RTK_HWREV_8168D:
585 		case RTK_HWREV_8168DP:
586 			sc->sc_quirk |= RTKQ_DESCV2 | RTKQ_NOEECMD |
587 			    RTKQ_MACSTAT | RTKQ_CMDSTOP;
588 			/*
589 			 * From FreeBSD driver:
590 			 *
591 			 * These (8168/8111) controllers support jumbo frame
592 			 * but it seems that enabling it requires touching
593 			 * additional magic registers. Depending on MAC
594 			 * revisions some controllers need to disable
595 			 * checksum offload. So disable jumbo frame until
596 			 * I have better idea what it really requires to
597 			 * make it support.
598 			 * RTL8168C/CP : supports up to 6KB jumbo frame.
599 			 * RTL8111C/CP : supports up to 9KB jumbo frame.
600 			 */
601 			sc->sc_quirk |= RTKQ_NOJUMBO;
602 			break;
603 		case RTK_HWREV_8100E:
604 		case RTK_HWREV_8100E_SPIN2:
605 		case RTK_HWREV_8101E:
606 			sc->sc_quirk |= RTKQ_NOJUMBO;
607 			break;
608 		case RTK_HWREV_8102E:
609 		case RTK_HWREV_8102EL:
610 		case RTK_HWREV_8103E:
611 			sc->sc_quirk |= RTKQ_DESCV2 | RTKQ_NOEECMD |
612 			    RTKQ_MACSTAT | RTKQ_CMDSTOP | RTKQ_NOJUMBO;
613 			break;
614 		default:
615 			aprint_normal_dev(sc->sc_dev,
616 			    "Unknown revision (0x%08x)\n", hwrev);
617 			/* assume the latest features */
618 			sc->sc_quirk |= RTKQ_DESCV2 | RTKQ_NOEECMD;
619 			sc->sc_quirk |= RTKQ_NOJUMBO;
620 		}
621 
622 		/* Set RX length mask */
623 		sc->re_rxlenmask = RE_RDESC_STAT_GFRAGLEN;
624 		sc->re_ldata.re_tx_desc_cnt = RE_TX_DESC_CNT_8169;
625 	} else {
626 		sc->sc_quirk |= RTKQ_NOJUMBO;
627 
628 		/* Set RX length mask */
629 		sc->re_rxlenmask = RE_RDESC_STAT_FRAGLEN;
630 		sc->re_ldata.re_tx_desc_cnt = RE_TX_DESC_CNT_8139;
631 	}
632 
633 	/* Reset the adapter. */
634 	re_reset(sc);
635 
636 	if ((sc->sc_quirk & RTKQ_NOEECMD) != 0) {
637 		/*
638 		 * Get station address from ID registers.
639 		 */
640 		for (i = 0; i < ETHER_ADDR_LEN; i++)
641 			eaddr[i] = CSR_READ_1(sc, RTK_IDR0 + i);
642 	} else {
643 		/*
644 		 * Get station address from the EEPROM.
645 		 */
646 		if (rtk_read_eeprom(sc, RTK_EE_ID, RTK_EEADDR_LEN1) == 0x8129)
647 			addr_len = RTK_EEADDR_LEN1;
648 		else
649 			addr_len = RTK_EEADDR_LEN0;
650 
651 		/*
652 		 * Get station address from the EEPROM.
653 		 */
654 		for (i = 0; i < ETHER_ADDR_LEN / 2; i++) {
655 			val = rtk_read_eeprom(sc, RTK_EE_EADDR0 + i, addr_len);
656 			eaddr[(i * 2) + 0] = val & 0xff;
657 			eaddr[(i * 2) + 1] = val >> 8;
658 		}
659 	}
660 
661 	aprint_normal_dev(sc->sc_dev, "Ethernet address %s\n",
662 	    ether_sprintf(eaddr));
663 
664 	if (sc->re_ldata.re_tx_desc_cnt >
665 	    PAGE_SIZE / sizeof(struct re_desc)) {
666 		sc->re_ldata.re_tx_desc_cnt =
667 		    PAGE_SIZE / sizeof(struct re_desc);
668 	}
669 
670 	aprint_verbose_dev(sc->sc_dev, "using %d tx descriptors\n",
671 	    sc->re_ldata.re_tx_desc_cnt);
672 	KASSERT(RE_NEXT_TX_DESC(sc, RE_TX_DESC_CNT(sc) - 1) == 0);
673 
674 	/* Allocate DMA'able memory for the TX ring */
675 	if ((error = bus_dmamem_alloc(sc->sc_dmat, RE_TX_LIST_SZ(sc),
676 	    RE_RING_ALIGN, 0, &sc->re_ldata.re_tx_listseg, 1,
677 	    &sc->re_ldata.re_tx_listnseg, BUS_DMA_NOWAIT)) != 0) {
678 		aprint_error_dev(sc->sc_dev,
679 		    "can't allocate tx listseg, error = %d\n", error);
680 		goto fail_0;
681 	}
682 
683 	/* Load the map for the TX ring. */
684 	if ((error = bus_dmamem_map(sc->sc_dmat, &sc->re_ldata.re_tx_listseg,
685 	    sc->re_ldata.re_tx_listnseg, RE_TX_LIST_SZ(sc),
686 	    (void **)&sc->re_ldata.re_tx_list,
687 	    BUS_DMA_COHERENT | BUS_DMA_NOWAIT)) != 0) {
688 		aprint_error_dev(sc->sc_dev,
689 		    "can't map tx list, error = %d\n", error);
690 		goto fail_1;
691 	}
692 	memset(sc->re_ldata.re_tx_list, 0, RE_TX_LIST_SZ(sc));
693 
694 	if ((error = bus_dmamap_create(sc->sc_dmat, RE_TX_LIST_SZ(sc), 1,
695 	    RE_TX_LIST_SZ(sc), 0, 0,
696 	    &sc->re_ldata.re_tx_list_map)) != 0) {
697 		aprint_error_dev(sc->sc_dev,
698 		    "can't create tx list map, error = %d\n", error);
699 		goto fail_2;
700 	}
701 
702 
703 	if ((error = bus_dmamap_load(sc->sc_dmat,
704 	    sc->re_ldata.re_tx_list_map, sc->re_ldata.re_tx_list,
705 	    RE_TX_LIST_SZ(sc), NULL, BUS_DMA_NOWAIT)) != 0) {
706 		aprint_error_dev(sc->sc_dev,
707 		    "can't load tx list, error = %d\n", error);
708 		goto fail_3;
709 	}
710 
711 	/* Create DMA maps for TX buffers */
712 	for (i = 0; i < RE_TX_QLEN; i++) {
713 		error = bus_dmamap_create(sc->sc_dmat,
714 		    round_page(IP_MAXPACKET),
715 		    RE_TX_DESC_CNT(sc), RE_TDESC_CMD_FRAGLEN,
716 		    0, 0, &sc->re_ldata.re_txq[i].txq_dmamap);
717 		if (error) {
718 			aprint_error_dev(sc->sc_dev,
719 			    "can't create DMA map for TX\n");
720 			goto fail_4;
721 		}
722 	}
723 
724 	/* Allocate DMA'able memory for the RX ring */
725 	/* XXX see also a comment about RE_RX_DMAMEM_SZ in rtl81x9var.h */
726 	if ((error = bus_dmamem_alloc(sc->sc_dmat,
727 	    RE_RX_DMAMEM_SZ, RE_RING_ALIGN, 0, &sc->re_ldata.re_rx_listseg, 1,
728 	    &sc->re_ldata.re_rx_listnseg, BUS_DMA_NOWAIT)) != 0) {
729 		aprint_error_dev(sc->sc_dev,
730 		    "can't allocate rx listseg, error = %d\n", error);
731 		goto fail_4;
732 	}
733 
734 	/* Load the map for the RX ring. */
735 	if ((error = bus_dmamem_map(sc->sc_dmat, &sc->re_ldata.re_rx_listseg,
736 	    sc->re_ldata.re_rx_listnseg, RE_RX_DMAMEM_SZ,
737 	    (void **)&sc->re_ldata.re_rx_list,
738 	    BUS_DMA_COHERENT | BUS_DMA_NOWAIT)) != 0) {
739 		aprint_error_dev(sc->sc_dev,
740 		    "can't map rx list, error = %d\n", error);
741 		goto fail_5;
742 	}
743 	memset(sc->re_ldata.re_rx_list, 0, RE_RX_DMAMEM_SZ);
744 
745 	if ((error = bus_dmamap_create(sc->sc_dmat,
746 	    RE_RX_DMAMEM_SZ, 1, RE_RX_DMAMEM_SZ, 0, 0,
747 	    &sc->re_ldata.re_rx_list_map)) != 0) {
748 		aprint_error_dev(sc->sc_dev,
749 		    "can't create rx list map, error = %d\n", error);
750 		goto fail_6;
751 	}
752 
753 	if ((error = bus_dmamap_load(sc->sc_dmat,
754 	    sc->re_ldata.re_rx_list_map, sc->re_ldata.re_rx_list,
755 	    RE_RX_DMAMEM_SZ, NULL, BUS_DMA_NOWAIT)) != 0) {
756 		aprint_error_dev(sc->sc_dev,
757 		    "can't load rx list, error = %d\n", error);
758 		goto fail_7;
759 	}
760 
761 	/* Create DMA maps for RX buffers */
762 	for (i = 0; i < RE_RX_DESC_CNT; i++) {
763 		error = bus_dmamap_create(sc->sc_dmat, MCLBYTES, 1, MCLBYTES,
764 		    0, 0, &sc->re_ldata.re_rxsoft[i].rxs_dmamap);
765 		if (error) {
766 			aprint_error_dev(sc->sc_dev,
767 			    "can't create DMA map for RX\n");
768 			goto fail_8;
769 		}
770 	}
771 
772 	/*
773 	 * Record interface as attached. From here, we should not fail.
774 	 */
775 	sc->sc_flags |= RTK_ATTACHED;
776 
777 	ifp = &sc->ethercom.ec_if;
778 	ifp->if_softc = sc;
779 	strlcpy(ifp->if_xname, device_xname(sc->sc_dev), IFNAMSIZ);
780 	ifp->if_mtu = ETHERMTU;
781 	ifp->if_flags = IFF_BROADCAST | IFF_SIMPLEX | IFF_MULTICAST;
782 	ifp->if_ioctl = re_ioctl;
783 	sc->ethercom.ec_capabilities |=
784 	    ETHERCAP_VLAN_MTU | ETHERCAP_VLAN_HWTAGGING;
785 	ifp->if_start = re_start;
786 	ifp->if_stop = re_stop;
787 
788 	/*
789 	 * IFCAP_CSUM_IPv4_Tx on re(4) is broken for small packets,
790 	 * so we have a workaround to handle the bug by padding
791 	 * such packets manually.
792 	 */
793 	ifp->if_capabilities |=
794 	    IFCAP_CSUM_IPv4_Tx | IFCAP_CSUM_IPv4_Rx |
795 	    IFCAP_CSUM_TCPv4_Tx | IFCAP_CSUM_TCPv4_Rx |
796 	    IFCAP_CSUM_UDPv4_Tx | IFCAP_CSUM_UDPv4_Rx |
797 	    IFCAP_TSOv4;
798 
799 	/*
800 	 * XXX
801 	 * Still have no idea how to make TSO work on 8168C, 8168CP,
802 	 * 8102E, 8111C and 8111CP.
803 	 */
804 	if ((sc->sc_quirk & RTKQ_DESCV2) != 0)
805 		ifp->if_capabilities &= ~IFCAP_TSOv4;
806 
807 	ifp->if_watchdog = re_watchdog;
808 	ifp->if_init = re_init;
809 	ifp->if_snd.ifq_maxlen = RE_IFQ_MAXLEN;
810 	ifp->if_capenable = ifp->if_capabilities;
811 	IFQ_SET_READY(&ifp->if_snd);
812 
813 	callout_init(&sc->rtk_tick_ch, 0);
814 
815 	/* Do MII setup */
816 	sc->mii.mii_ifp = ifp;
817 	sc->mii.mii_readreg = re_miibus_readreg;
818 	sc->mii.mii_writereg = re_miibus_writereg;
819 	sc->mii.mii_statchg = re_miibus_statchg;
820 	sc->ethercom.ec_mii = &sc->mii;
821 	ifmedia_init(&sc->mii.mii_media, IFM_IMASK, ether_mediachange,
822 	    ether_mediastatus);
823 	mii_attach(sc->sc_dev, &sc->mii, 0xffffffff, MII_PHY_ANY,
824 	    MII_OFFSET_ANY, 0);
825 	ifmedia_set(&sc->mii.mii_media, IFM_ETHER | IFM_AUTO);
826 
827 	/*
828 	 * Call MI attach routine.
829 	 */
830 	if_attach(ifp);
831 	ether_ifattach(ifp, eaddr);
832 
833 	if (pmf_device_register(sc->sc_dev, NULL, NULL))
834 		pmf_class_network_register(sc->sc_dev, ifp);
835 	else
836 		aprint_error_dev(sc->sc_dev,
837 		    "couldn't establish power handler\n");
838 
839 	return;
840 
841  fail_8:
842 	/* Destroy DMA maps for RX buffers. */
843 	for (i = 0; i < RE_RX_DESC_CNT; i++)
844 		if (sc->re_ldata.re_rxsoft[i].rxs_dmamap != NULL)
845 			bus_dmamap_destroy(sc->sc_dmat,
846 			    sc->re_ldata.re_rxsoft[i].rxs_dmamap);
847 
848 	/* Free DMA'able memory for the RX ring. */
849 	bus_dmamap_unload(sc->sc_dmat, sc->re_ldata.re_rx_list_map);
850  fail_7:
851 	bus_dmamap_destroy(sc->sc_dmat, sc->re_ldata.re_rx_list_map);
852  fail_6:
853 	bus_dmamem_unmap(sc->sc_dmat,
854 	    (void *)sc->re_ldata.re_rx_list, RE_RX_DMAMEM_SZ);
855  fail_5:
856 	bus_dmamem_free(sc->sc_dmat,
857 	    &sc->re_ldata.re_rx_listseg, sc->re_ldata.re_rx_listnseg);
858 
859  fail_4:
860 	/* Destroy DMA maps for TX buffers. */
861 	for (i = 0; i < RE_TX_QLEN; i++)
862 		if (sc->re_ldata.re_txq[i].txq_dmamap != NULL)
863 			bus_dmamap_destroy(sc->sc_dmat,
864 			    sc->re_ldata.re_txq[i].txq_dmamap);
865 
866 	/* Free DMA'able memory for the TX ring. */
867 	bus_dmamap_unload(sc->sc_dmat, sc->re_ldata.re_tx_list_map);
868  fail_3:
869 	bus_dmamap_destroy(sc->sc_dmat, sc->re_ldata.re_tx_list_map);
870  fail_2:
871 	bus_dmamem_unmap(sc->sc_dmat,
872 	    (void *)sc->re_ldata.re_tx_list, RE_TX_LIST_SZ(sc));
873  fail_1:
874 	bus_dmamem_free(sc->sc_dmat,
875 	    &sc->re_ldata.re_tx_listseg, sc->re_ldata.re_tx_listnseg);
876  fail_0:
877 	return;
878 }
879 
880 
881 /*
882  * re_activate:
883  *     Handle device activation/deactivation requests.
884  */
885 int
886 re_activate(device_t self, enum devact act)
887 {
888 	struct rtk_softc *sc = device_private(self);
889 
890 	switch (act) {
891 	case DVACT_DEACTIVATE:
892 		if_deactivate(&sc->ethercom.ec_if);
893 		return 0;
894 	default:
895 		return EOPNOTSUPP;
896 	}
897 }
898 
899 /*
900  * re_detach:
901  *     Detach a rtk interface.
902  */
903 int
904 re_detach(struct rtk_softc *sc)
905 {
906 	struct ifnet *ifp = &sc->ethercom.ec_if;
907 	int i;
908 
909 	/*
910 	 * Succeed now if there isn't any work to do.
911 	 */
912 	if ((sc->sc_flags & RTK_ATTACHED) == 0)
913 		return 0;
914 
915 	/* Unhook our tick handler. */
916 	callout_stop(&sc->rtk_tick_ch);
917 
918 	/* Detach all PHYs. */
919 	mii_detach(&sc->mii, MII_PHY_ANY, MII_OFFSET_ANY);
920 
921 	/* Delete all remaining media. */
922 	ifmedia_delete_instance(&sc->mii.mii_media, IFM_INST_ANY);
923 
924 	ether_ifdetach(ifp);
925 	if_detach(ifp);
926 
927 	/* Destroy DMA maps for RX buffers. */
928 	for (i = 0; i < RE_RX_DESC_CNT; i++)
929 		if (sc->re_ldata.re_rxsoft[i].rxs_dmamap != NULL)
930 			bus_dmamap_destroy(sc->sc_dmat,
931 			    sc->re_ldata.re_rxsoft[i].rxs_dmamap);
932 
933 	/* Free DMA'able memory for the RX ring. */
934 	bus_dmamap_unload(sc->sc_dmat, sc->re_ldata.re_rx_list_map);
935 	bus_dmamap_destroy(sc->sc_dmat, sc->re_ldata.re_rx_list_map);
936 	bus_dmamem_unmap(sc->sc_dmat,
937 	    (void *)sc->re_ldata.re_rx_list, RE_RX_DMAMEM_SZ);
938 	bus_dmamem_free(sc->sc_dmat,
939 	    &sc->re_ldata.re_rx_listseg, sc->re_ldata.re_rx_listnseg);
940 
941 	/* Destroy DMA maps for TX buffers. */
942 	for (i = 0; i < RE_TX_QLEN; i++)
943 		if (sc->re_ldata.re_txq[i].txq_dmamap != NULL)
944 			bus_dmamap_destroy(sc->sc_dmat,
945 			    sc->re_ldata.re_txq[i].txq_dmamap);
946 
947 	/* Free DMA'able memory for the TX ring. */
948 	bus_dmamap_unload(sc->sc_dmat, sc->re_ldata.re_tx_list_map);
949 	bus_dmamap_destroy(sc->sc_dmat, sc->re_ldata.re_tx_list_map);
950 	bus_dmamem_unmap(sc->sc_dmat,
951 	    (void *)sc->re_ldata.re_tx_list, RE_TX_LIST_SZ(sc));
952 	bus_dmamem_free(sc->sc_dmat,
953 	    &sc->re_ldata.re_tx_listseg, sc->re_ldata.re_tx_listnseg);
954 
955 	pmf_device_deregister(sc->sc_dev);
956 
957 	return 0;
958 }
959 
960 /*
961  * re_enable:
962  *     Enable the RTL81X9 chip.
963  */
964 static int
965 re_enable(struct rtk_softc *sc)
966 {
967 
968 	if (RTK_IS_ENABLED(sc) == 0 && sc->sc_enable != NULL) {
969 		if ((*sc->sc_enable)(sc) != 0) {
970 			printf("%s: device enable failed\n",
971 			    device_xname(sc->sc_dev));
972 			return EIO;
973 		}
974 		sc->sc_flags |= RTK_ENABLED;
975 	}
976 	return 0;
977 }
978 
979 /*
980  * re_disable:
981  *     Disable the RTL81X9 chip.
982  */
983 static void
984 re_disable(struct rtk_softc *sc)
985 {
986 
987 	if (RTK_IS_ENABLED(sc) && sc->sc_disable != NULL) {
988 		(*sc->sc_disable)(sc);
989 		sc->sc_flags &= ~RTK_ENABLED;
990 	}
991 }
992 
993 static int
994 re_newbuf(struct rtk_softc *sc, int idx, struct mbuf *m)
995 {
996 	struct mbuf *n = NULL;
997 	bus_dmamap_t map;
998 	struct re_desc *d;
999 	struct re_rxsoft *rxs;
1000 	uint32_t cmdstat;
1001 	int error;
1002 
1003 	if (m == NULL) {
1004 		MGETHDR(n, M_DONTWAIT, MT_DATA);
1005 		if (n == NULL)
1006 			return ENOBUFS;
1007 
1008 		MCLGET(n, M_DONTWAIT);
1009 		if ((n->m_flags & M_EXT) == 0) {
1010 			m_freem(n);
1011 			return ENOBUFS;
1012 		}
1013 		m = n;
1014 	} else
1015 		m->m_data = m->m_ext.ext_buf;
1016 
1017 	/*
1018 	 * Initialize mbuf length fields and fixup
1019 	 * alignment so that the frame payload is
1020 	 * longword aligned.
1021 	 */
1022 	m->m_len = m->m_pkthdr.len = MCLBYTES - RE_ETHER_ALIGN;
1023 	m->m_data += RE_ETHER_ALIGN;
1024 
1025 	rxs = &sc->re_ldata.re_rxsoft[idx];
1026 	map = rxs->rxs_dmamap;
1027 	error = bus_dmamap_load_mbuf(sc->sc_dmat, map, m,
1028 	    BUS_DMA_READ|BUS_DMA_NOWAIT);
1029 
1030 	if (error)
1031 		goto out;
1032 
1033 	bus_dmamap_sync(sc->sc_dmat, map, 0, map->dm_mapsize,
1034 	    BUS_DMASYNC_PREREAD);
1035 
1036 	d = &sc->re_ldata.re_rx_list[idx];
1037 #ifdef DIAGNOSTIC
1038 	RE_RXDESCSYNC(sc, idx, BUS_DMASYNC_POSTREAD|BUS_DMASYNC_POSTWRITE);
1039 	cmdstat = le32toh(d->re_cmdstat);
1040 	RE_RXDESCSYNC(sc, idx, BUS_DMASYNC_PREREAD);
1041 	if (cmdstat & RE_RDESC_STAT_OWN) {
1042 		panic("%s: tried to map busy RX descriptor",
1043 		    device_xname(sc->sc_dev));
1044 	}
1045 #endif
1046 
1047 	rxs->rxs_mbuf = m;
1048 
1049 	d->re_vlanctl = 0;
1050 	cmdstat = map->dm_segs[0].ds_len;
1051 	if (idx == (RE_RX_DESC_CNT - 1))
1052 		cmdstat |= RE_RDESC_CMD_EOR;
1053 	re_set_bufaddr(d, map->dm_segs[0].ds_addr);
1054 	d->re_cmdstat = htole32(cmdstat);
1055 	RE_RXDESCSYNC(sc, idx, BUS_DMASYNC_PREREAD|BUS_DMASYNC_PREWRITE);
1056 	cmdstat |= RE_RDESC_CMD_OWN;
1057 	d->re_cmdstat = htole32(cmdstat);
1058 	RE_RXDESCSYNC(sc, idx, BUS_DMASYNC_PREREAD|BUS_DMASYNC_PREWRITE);
1059 
1060 	return 0;
1061  out:
1062 	if (n != NULL)
1063 		m_freem(n);
1064 	return ENOMEM;
1065 }
1066 
1067 static int
1068 re_tx_list_init(struct rtk_softc *sc)
1069 {
1070 	int i;
1071 
1072 	memset(sc->re_ldata.re_tx_list, 0, RE_TX_LIST_SZ(sc));
1073 	for (i = 0; i < RE_TX_QLEN; i++) {
1074 		sc->re_ldata.re_txq[i].txq_mbuf = NULL;
1075 	}
1076 
1077 	bus_dmamap_sync(sc->sc_dmat,
1078 	    sc->re_ldata.re_tx_list_map, 0,
1079 	    sc->re_ldata.re_tx_list_map->dm_mapsize,
1080 	    BUS_DMASYNC_PREREAD|BUS_DMASYNC_PREWRITE);
1081 	sc->re_ldata.re_txq_prodidx = 0;
1082 	sc->re_ldata.re_txq_considx = 0;
1083 	sc->re_ldata.re_txq_free = RE_TX_QLEN;
1084 	sc->re_ldata.re_tx_free = RE_TX_DESC_CNT(sc);
1085 	sc->re_ldata.re_tx_nextfree = 0;
1086 
1087 	return 0;
1088 }
1089 
1090 static int
1091 re_rx_list_init(struct rtk_softc *sc)
1092 {
1093 	int i;
1094 
1095 	memset(sc->re_ldata.re_rx_list, 0, RE_RX_LIST_SZ);
1096 
1097 	for (i = 0; i < RE_RX_DESC_CNT; i++) {
1098 		if (re_newbuf(sc, i, NULL) == ENOBUFS)
1099 			return ENOBUFS;
1100 	}
1101 
1102 	sc->re_ldata.re_rx_prodidx = 0;
1103 	sc->re_head = sc->re_tail = NULL;
1104 
1105 	return 0;
1106 }
1107 
1108 /*
1109  * RX handler for C+ and 8169. For the gigE chips, we support
1110  * the reception of jumbo frames that have been fragmented
1111  * across multiple 2K mbuf cluster buffers.
1112  */
1113 static void
1114 re_rxeof(struct rtk_softc *sc)
1115 {
1116 	struct mbuf *m;
1117 	struct ifnet *ifp;
1118 	int i, total_len;
1119 	struct re_desc *cur_rx;
1120 	struct re_rxsoft *rxs;
1121 	uint32_t rxstat, rxvlan;
1122 
1123 	ifp = &sc->ethercom.ec_if;
1124 
1125 	for (i = sc->re_ldata.re_rx_prodidx;; i = RE_NEXT_RX_DESC(sc, i)) {
1126 		cur_rx = &sc->re_ldata.re_rx_list[i];
1127 		RE_RXDESCSYNC(sc, i,
1128 		    BUS_DMASYNC_POSTREAD|BUS_DMASYNC_POSTWRITE);
1129 		rxstat = le32toh(cur_rx->re_cmdstat);
1130 		rxvlan = le32toh(cur_rx->re_vlanctl);
1131 		RE_RXDESCSYNC(sc, i, BUS_DMASYNC_PREREAD);
1132 		if ((rxstat & RE_RDESC_STAT_OWN) != 0) {
1133 			break;
1134 		}
1135 		total_len = rxstat & sc->re_rxlenmask;
1136 		rxs = &sc->re_ldata.re_rxsoft[i];
1137 		m = rxs->rxs_mbuf;
1138 
1139 		/* Invalidate the RX mbuf and unload its map */
1140 
1141 		bus_dmamap_sync(sc->sc_dmat,
1142 		    rxs->rxs_dmamap, 0, rxs->rxs_dmamap->dm_mapsize,
1143 		    BUS_DMASYNC_POSTREAD);
1144 		bus_dmamap_unload(sc->sc_dmat, rxs->rxs_dmamap);
1145 
1146 		if ((rxstat & RE_RDESC_STAT_EOF) == 0) {
1147 			m->m_len = MCLBYTES - RE_ETHER_ALIGN;
1148 			if (sc->re_head == NULL)
1149 				sc->re_head = sc->re_tail = m;
1150 			else {
1151 				m->m_flags &= ~M_PKTHDR;
1152 				sc->re_tail->m_next = m;
1153 				sc->re_tail = m;
1154 			}
1155 			re_newbuf(sc, i, NULL);
1156 			continue;
1157 		}
1158 
1159 		/*
1160 		 * NOTE: for the 8139C+, the frame length field
1161 		 * is always 12 bits in size, but for the gigE chips,
1162 		 * it is 13 bits (since the max RX frame length is 16K).
1163 		 * Unfortunately, all 32 bits in the status word
1164 		 * were already used, so to make room for the extra
1165 		 * length bit, RealTek took out the 'frame alignment
1166 		 * error' bit and shifted the other status bits
1167 		 * over one slot. The OWN, EOR, FS and LS bits are
1168 		 * still in the same places. We have already extracted
1169 		 * the frame length and checked the OWN bit, so rather
1170 		 * than using an alternate bit mapping, we shift the
1171 		 * status bits one space to the right so we can evaluate
1172 		 * them using the 8169 status as though it was in the
1173 		 * same format as that of the 8139C+.
1174 		 */
1175 		if ((sc->sc_quirk & RTKQ_8139CPLUS) == 0)
1176 			rxstat >>= 1;
1177 
1178 		if (__predict_false((rxstat & RE_RDESC_STAT_RXERRSUM) != 0)) {
1179 #ifdef RE_DEBUG
1180 			printf("%s: RX error (rxstat = 0x%08x)",
1181 			    device_xname(sc->sc_dev), rxstat);
1182 			if (rxstat & RE_RDESC_STAT_FRALIGN)
1183 				printf(", frame alignment error");
1184 			if (rxstat & RE_RDESC_STAT_BUFOFLOW)
1185 				printf(", out of buffer space");
1186 			if (rxstat & RE_RDESC_STAT_FIFOOFLOW)
1187 				printf(", FIFO overrun");
1188 			if (rxstat & RE_RDESC_STAT_GIANT)
1189 				printf(", giant packet");
1190 			if (rxstat & RE_RDESC_STAT_RUNT)
1191 				printf(", runt packet");
1192 			if (rxstat & RE_RDESC_STAT_CRCERR)
1193 				printf(", CRC error");
1194 			printf("\n");
1195 #endif
1196 			ifp->if_ierrors++;
1197 			/*
1198 			 * If this is part of a multi-fragment packet,
1199 			 * discard all the pieces.
1200 			 */
1201 			if (sc->re_head != NULL) {
1202 				m_freem(sc->re_head);
1203 				sc->re_head = sc->re_tail = NULL;
1204 			}
1205 			re_newbuf(sc, i, m);
1206 			continue;
1207 		}
1208 
1209 		/*
1210 		 * If allocating a replacement mbuf fails,
1211 		 * reload the current one.
1212 		 */
1213 
1214 		if (__predict_false(re_newbuf(sc, i, NULL) != 0)) {
1215 			ifp->if_ierrors++;
1216 			if (sc->re_head != NULL) {
1217 				m_freem(sc->re_head);
1218 				sc->re_head = sc->re_tail = NULL;
1219 			}
1220 			re_newbuf(sc, i, m);
1221 			continue;
1222 		}
1223 
1224 		if (sc->re_head != NULL) {
1225 			m->m_len = total_len % (MCLBYTES - RE_ETHER_ALIGN);
1226 			/*
1227 			 * Special case: if there's 4 bytes or less
1228 			 * in this buffer, the mbuf can be discarded:
1229 			 * the last 4 bytes is the CRC, which we don't
1230 			 * care about anyway.
1231 			 */
1232 			if (m->m_len <= ETHER_CRC_LEN) {
1233 				sc->re_tail->m_len -=
1234 				    (ETHER_CRC_LEN - m->m_len);
1235 				m_freem(m);
1236 			} else {
1237 				m->m_len -= ETHER_CRC_LEN;
1238 				m->m_flags &= ~M_PKTHDR;
1239 				sc->re_tail->m_next = m;
1240 			}
1241 			m = sc->re_head;
1242 			sc->re_head = sc->re_tail = NULL;
1243 			m->m_pkthdr.len = total_len - ETHER_CRC_LEN;
1244 		} else
1245 			m->m_pkthdr.len = m->m_len =
1246 			    (total_len - ETHER_CRC_LEN);
1247 
1248 		ifp->if_ipackets++;
1249 		m->m_pkthdr.rcvif = ifp;
1250 
1251 		/* Do RX checksumming */
1252 		if ((sc->sc_quirk & RTKQ_DESCV2) == 0) {
1253 			/* Check IP header checksum */
1254 			if ((rxstat & RE_RDESC_STAT_PROTOID) != 0) {
1255 				m->m_pkthdr.csum_flags |= M_CSUM_IPv4;
1256 				if (rxstat & RE_RDESC_STAT_IPSUMBAD)
1257 					m->m_pkthdr.csum_flags |=
1258 					    M_CSUM_IPv4_BAD;
1259 
1260 				/* Check TCP/UDP checksum */
1261 				if (RE_TCPPKT(rxstat)) {
1262 					m->m_pkthdr.csum_flags |= M_CSUM_TCPv4;
1263 					if (rxstat & RE_RDESC_STAT_TCPSUMBAD)
1264 						m->m_pkthdr.csum_flags |=
1265 						    M_CSUM_TCP_UDP_BAD;
1266 				} else if (RE_UDPPKT(rxstat)) {
1267 					m->m_pkthdr.csum_flags |= M_CSUM_UDPv4;
1268 					if (rxstat & RE_RDESC_STAT_UDPSUMBAD)
1269 						m->m_pkthdr.csum_flags |=
1270 						    M_CSUM_TCP_UDP_BAD;
1271 				}
1272 			}
1273 		} else {
1274 			/* Check IPv4 header checksum */
1275 			if ((rxvlan & RE_RDESC_VLANCTL_IPV4) != 0) {
1276 				m->m_pkthdr.csum_flags |= M_CSUM_IPv4;
1277 				if (rxstat & RE_RDESC_STAT_IPSUMBAD)
1278 					m->m_pkthdr.csum_flags |=
1279 					    M_CSUM_IPv4_BAD;
1280 
1281 				/* Check TCPv4/UDPv4 checksum */
1282 				if (RE_TCPPKT(rxstat)) {
1283 					m->m_pkthdr.csum_flags |= M_CSUM_TCPv4;
1284 					if (rxstat & RE_RDESC_STAT_TCPSUMBAD)
1285 						m->m_pkthdr.csum_flags |=
1286 						    M_CSUM_TCP_UDP_BAD;
1287 				} else if (RE_UDPPKT(rxstat)) {
1288 					m->m_pkthdr.csum_flags |= M_CSUM_UDPv4;
1289 					if (rxstat & RE_RDESC_STAT_UDPSUMBAD)
1290 						m->m_pkthdr.csum_flags |=
1291 						    M_CSUM_TCP_UDP_BAD;
1292 				}
1293 			}
1294 			/* XXX Check TCPv6/UDPv6 checksum? */
1295 		}
1296 
1297 		if (rxvlan & RE_RDESC_VLANCTL_TAG) {
1298 			VLAN_INPUT_TAG(ifp, m,
1299 			     bswap16(rxvlan & RE_RDESC_VLANCTL_DATA),
1300 			     continue);
1301 		}
1302 		if (ifp->if_bpf)
1303 			bpf_ops->bpf_mtap(ifp->if_bpf, m);
1304 		(*ifp->if_input)(ifp, m);
1305 	}
1306 
1307 	sc->re_ldata.re_rx_prodidx = i;
1308 }
1309 
1310 static void
1311 re_txeof(struct rtk_softc *sc)
1312 {
1313 	struct ifnet *ifp;
1314 	struct re_txq *txq;
1315 	uint32_t txstat;
1316 	int idx, descidx;
1317 
1318 	ifp = &sc->ethercom.ec_if;
1319 
1320 	for (idx = sc->re_ldata.re_txq_considx;
1321 	    sc->re_ldata.re_txq_free < RE_TX_QLEN;
1322 	    idx = RE_NEXT_TXQ(sc, idx), sc->re_ldata.re_txq_free++) {
1323 		txq = &sc->re_ldata.re_txq[idx];
1324 		KASSERT(txq->txq_mbuf != NULL);
1325 
1326 		descidx = txq->txq_descidx;
1327 		RE_TXDESCSYNC(sc, descidx,
1328 		    BUS_DMASYNC_POSTREAD|BUS_DMASYNC_POSTWRITE);
1329 		txstat =
1330 		    le32toh(sc->re_ldata.re_tx_list[descidx].re_cmdstat);
1331 		RE_TXDESCSYNC(sc, descidx, BUS_DMASYNC_PREREAD);
1332 		KASSERT((txstat & RE_TDESC_CMD_EOF) != 0);
1333 		if (txstat & RE_TDESC_CMD_OWN) {
1334 			break;
1335 		}
1336 
1337 		sc->re_ldata.re_tx_free += txq->txq_nsegs;
1338 		KASSERT(sc->re_ldata.re_tx_free <= RE_TX_DESC_CNT(sc));
1339 		bus_dmamap_sync(sc->sc_dmat, txq->txq_dmamap,
1340 		    0, txq->txq_dmamap->dm_mapsize, BUS_DMASYNC_POSTWRITE);
1341 		bus_dmamap_unload(sc->sc_dmat, txq->txq_dmamap);
1342 		m_freem(txq->txq_mbuf);
1343 		txq->txq_mbuf = NULL;
1344 
1345 		if (txstat & (RE_TDESC_STAT_EXCESSCOL | RE_TDESC_STAT_COLCNT))
1346 			ifp->if_collisions++;
1347 		if (txstat & RE_TDESC_STAT_TXERRSUM)
1348 			ifp->if_oerrors++;
1349 		else
1350 			ifp->if_opackets++;
1351 	}
1352 
1353 	sc->re_ldata.re_txq_considx = idx;
1354 
1355 	if (sc->re_ldata.re_txq_free > RE_NTXDESC_RSVD)
1356 		ifp->if_flags &= ~IFF_OACTIVE;
1357 
1358 	/*
1359 	 * If not all descriptors have been released reaped yet,
1360 	 * reload the timer so that we will eventually get another
1361 	 * interrupt that will cause us to re-enter this routine.
1362 	 * This is done in case the transmitter has gone idle.
1363 	 */
1364 	if (sc->re_ldata.re_txq_free < RE_TX_QLEN) {
1365 		CSR_WRITE_4(sc, RTK_TIMERCNT, 1);
1366 		if ((sc->sc_quirk & RTKQ_PCIE) != 0) {
1367 			/*
1368 			 * Some chips will ignore a second TX request
1369 			 * issued while an existing transmission is in
1370 			 * progress. If the transmitter goes idle but
1371 			 * there are still packets waiting to be sent,
1372 			 * we need to restart the channel here to flush
1373 			 * them out. This only seems to be required with
1374 			 * the PCIe devices.
1375 			 */
1376 			CSR_WRITE_1(sc, RTK_GTXSTART, RTK_TXSTART_START);
1377 		}
1378 	} else
1379 		ifp->if_timer = 0;
1380 }
1381 
1382 static void
1383 re_tick(void *arg)
1384 {
1385 	struct rtk_softc *sc = arg;
1386 	int s;
1387 
1388 	/* XXX: just return for 8169S/8110S with rev 2 or newer phy */
1389 	s = splnet();
1390 
1391 	mii_tick(&sc->mii);
1392 	splx(s);
1393 
1394 	callout_reset(&sc->rtk_tick_ch, hz, re_tick, sc);
1395 }
1396 
1397 int
1398 re_intr(void *arg)
1399 {
1400 	struct rtk_softc *sc = arg;
1401 	struct ifnet *ifp;
1402 	uint16_t status;
1403 	int handled = 0;
1404 
1405 	if (!device_has_power(sc->sc_dev))
1406 		return 0;
1407 
1408 	ifp = &sc->ethercom.ec_if;
1409 
1410 	if ((ifp->if_flags & IFF_UP) == 0)
1411 		return 0;
1412 
1413 	for (;;) {
1414 
1415 		status = CSR_READ_2(sc, RTK_ISR);
1416 		/* If the card has gone away the read returns 0xffff. */
1417 		if (status == 0xffff)
1418 			break;
1419 		if (status) {
1420 			handled = 1;
1421 			CSR_WRITE_2(sc, RTK_ISR, status);
1422 		}
1423 
1424 		if ((status & RTK_INTRS_CPLUS) == 0)
1425 			break;
1426 
1427 		if (status & (RTK_ISR_RX_OK | RTK_ISR_RX_ERR))
1428 			re_rxeof(sc);
1429 
1430 		if (status & (RTK_ISR_TIMEOUT_EXPIRED | RTK_ISR_TX_ERR |
1431 		    RTK_ISR_TX_DESC_UNAVAIL))
1432 			re_txeof(sc);
1433 
1434 		if (status & RTK_ISR_SYSTEM_ERR) {
1435 			re_init(ifp);
1436 		}
1437 
1438 		if (status & RTK_ISR_LINKCHG) {
1439 			callout_stop(&sc->rtk_tick_ch);
1440 			re_tick(sc);
1441 		}
1442 	}
1443 
1444 	if (handled && !IFQ_IS_EMPTY(&ifp->if_snd))
1445 		re_start(ifp);
1446 
1447 	return handled;
1448 }
1449 
1450 
1451 
1452 /*
1453  * Main transmit routine for C+ and gigE NICs.
1454  */
1455 
1456 static void
1457 re_start(struct ifnet *ifp)
1458 {
1459 	struct rtk_softc *sc;
1460 	struct mbuf *m;
1461 	bus_dmamap_t map;
1462 	struct re_txq *txq;
1463 	struct re_desc *d;
1464 	struct m_tag *mtag;
1465 	uint32_t cmdstat, re_flags, vlanctl;
1466 	int ofree, idx, error, nsegs, seg;
1467 	int startdesc, curdesc, lastdesc;
1468 	bool pad;
1469 
1470 	sc = ifp->if_softc;
1471 	ofree = sc->re_ldata.re_txq_free;
1472 
1473 	for (idx = sc->re_ldata.re_txq_prodidx;; idx = RE_NEXT_TXQ(sc, idx)) {
1474 
1475 		IFQ_POLL(&ifp->if_snd, m);
1476 		if (m == NULL)
1477 			break;
1478 
1479 		if (sc->re_ldata.re_txq_free == 0 ||
1480 		    sc->re_ldata.re_tx_free == 0) {
1481 			/* no more free slots left */
1482 			ifp->if_flags |= IFF_OACTIVE;
1483 			break;
1484 		}
1485 
1486 		/*
1487 		 * Set up checksum offload. Note: checksum offload bits must
1488 		 * appear in all descriptors of a multi-descriptor transmit
1489 		 * attempt. (This is according to testing done with an 8169
1490 		 * chip. I'm not sure if this is a requirement or a bug.)
1491 		 */
1492 
1493 		vlanctl = 0;
1494 		if ((m->m_pkthdr.csum_flags & M_CSUM_TSOv4) != 0) {
1495 			uint32_t segsz = m->m_pkthdr.segsz;
1496 
1497 			re_flags = RE_TDESC_CMD_LGSEND |
1498 			    (segsz << RE_TDESC_CMD_MSSVAL_SHIFT);
1499 		} else {
1500 			/*
1501 			 * set RE_TDESC_CMD_IPCSUM if any checksum offloading
1502 			 * is requested.  otherwise, RE_TDESC_CMD_TCPCSUM/
1503 			 * RE_TDESC_CMD_UDPCSUM doesn't make effects.
1504 			 */
1505 			re_flags = 0;
1506 			if ((m->m_pkthdr.csum_flags &
1507 			    (M_CSUM_IPv4 | M_CSUM_TCPv4 | M_CSUM_UDPv4))
1508 			    != 0) {
1509 				if ((sc->sc_quirk & RTKQ_DESCV2) == 0) {
1510 					re_flags |= RE_TDESC_CMD_IPCSUM;
1511 					if (m->m_pkthdr.csum_flags &
1512 					    M_CSUM_TCPv4) {
1513 						re_flags |=
1514 						    RE_TDESC_CMD_TCPCSUM;
1515 					} else if (m->m_pkthdr.csum_flags &
1516 					    M_CSUM_UDPv4) {
1517 						re_flags |=
1518 						    RE_TDESC_CMD_UDPCSUM;
1519 					}
1520 				} else {
1521 					vlanctl |= RE_TDESC_VLANCTL_IPCSUM;
1522 					if (m->m_pkthdr.csum_flags &
1523 					    M_CSUM_TCPv4) {
1524 						vlanctl |=
1525 						    RE_TDESC_VLANCTL_TCPCSUM;
1526 					} else if (m->m_pkthdr.csum_flags &
1527 					    M_CSUM_UDPv4) {
1528 						vlanctl |=
1529 						    RE_TDESC_VLANCTL_UDPCSUM;
1530 					}
1531 				}
1532 			}
1533 		}
1534 
1535 		txq = &sc->re_ldata.re_txq[idx];
1536 		map = txq->txq_dmamap;
1537 		error = bus_dmamap_load_mbuf(sc->sc_dmat, map, m,
1538 		    BUS_DMA_WRITE|BUS_DMA_NOWAIT);
1539 
1540 		if (__predict_false(error)) {
1541 			/* XXX try to defrag if EFBIG? */
1542 			printf("%s: can't map mbuf (error %d)\n",
1543 			    device_xname(sc->sc_dev), error);
1544 
1545 			IFQ_DEQUEUE(&ifp->if_snd, m);
1546 			m_freem(m);
1547 			ifp->if_oerrors++;
1548 			continue;
1549 		}
1550 
1551 		nsegs = map->dm_nsegs;
1552 		pad = false;
1553 		if (__predict_false(m->m_pkthdr.len <= RE_IP4CSUMTX_PADLEN &&
1554 		    (re_flags & RE_TDESC_CMD_IPCSUM) != 0 &&
1555 		    (sc->sc_quirk & RTKQ_DESCV2) == 0)) {
1556 			pad = true;
1557 			nsegs++;
1558 		}
1559 
1560 		if (nsegs > sc->re_ldata.re_tx_free) {
1561 			/*
1562 			 * Not enough free descriptors to transmit this packet.
1563 			 */
1564 			ifp->if_flags |= IFF_OACTIVE;
1565 			bus_dmamap_unload(sc->sc_dmat, map);
1566 			break;
1567 		}
1568 
1569 		IFQ_DEQUEUE(&ifp->if_snd, m);
1570 
1571 		/*
1572 		 * Make sure that the caches are synchronized before we
1573 		 * ask the chip to start DMA for the packet data.
1574 		 */
1575 		bus_dmamap_sync(sc->sc_dmat, map, 0, map->dm_mapsize,
1576 		    BUS_DMASYNC_PREWRITE);
1577 
1578 		/*
1579 		 * Set up hardware VLAN tagging. Note: vlan tag info must
1580 		 * appear in all descriptors of a multi-descriptor
1581 		 * transmission attempt.
1582 		 */
1583 		if ((mtag = VLAN_OUTPUT_TAG(&sc->ethercom, m)) != NULL)
1584 			vlanctl |= bswap16(VLAN_TAG_VALUE(mtag)) |
1585 			    RE_TDESC_VLANCTL_TAG;
1586 
1587 		/*
1588 		 * Map the segment array into descriptors.
1589 		 * Note that we set the start-of-frame and
1590 		 * end-of-frame markers for either TX or RX,
1591 		 * but they really only have meaning in the TX case.
1592 		 * (In the RX case, it's the chip that tells us
1593 		 *  where packets begin and end.)
1594 		 * We also keep track of the end of the ring
1595 		 * and set the end-of-ring bits as needed,
1596 		 * and we set the ownership bits in all except
1597 		 * the very first descriptor. (The caller will
1598 		 * set this descriptor later when it start
1599 		 * transmission or reception.)
1600 		 */
1601 		curdesc = startdesc = sc->re_ldata.re_tx_nextfree;
1602 		lastdesc = -1;
1603 		for (seg = 0; seg < map->dm_nsegs;
1604 		    seg++, curdesc = RE_NEXT_TX_DESC(sc, curdesc)) {
1605 			d = &sc->re_ldata.re_tx_list[curdesc];
1606 #ifdef DIAGNOSTIC
1607 			RE_TXDESCSYNC(sc, curdesc,
1608 			    BUS_DMASYNC_POSTREAD|BUS_DMASYNC_POSTWRITE);
1609 			cmdstat = le32toh(d->re_cmdstat);
1610 			RE_TXDESCSYNC(sc, curdesc, BUS_DMASYNC_PREREAD);
1611 			if (cmdstat & RE_TDESC_STAT_OWN) {
1612 				panic("%s: tried to map busy TX descriptor",
1613 				    device_xname(sc->sc_dev));
1614 			}
1615 #endif
1616 
1617 			d->re_vlanctl = htole32(vlanctl);
1618 			re_set_bufaddr(d, map->dm_segs[seg].ds_addr);
1619 			cmdstat = re_flags | map->dm_segs[seg].ds_len;
1620 			if (seg == 0)
1621 				cmdstat |= RE_TDESC_CMD_SOF;
1622 			else
1623 				cmdstat |= RE_TDESC_CMD_OWN;
1624 			if (curdesc == (RE_TX_DESC_CNT(sc) - 1))
1625 				cmdstat |= RE_TDESC_CMD_EOR;
1626 			if (seg == nsegs - 1) {
1627 				cmdstat |= RE_TDESC_CMD_EOF;
1628 				lastdesc = curdesc;
1629 			}
1630 			d->re_cmdstat = htole32(cmdstat);
1631 			RE_TXDESCSYNC(sc, curdesc,
1632 			    BUS_DMASYNC_PREREAD|BUS_DMASYNC_PREWRITE);
1633 		}
1634 		if (__predict_false(pad)) {
1635 			d = &sc->re_ldata.re_tx_list[curdesc];
1636 			d->re_vlanctl = htole32(vlanctl);
1637 			re_set_bufaddr(d, RE_TXPADDADDR(sc));
1638 			cmdstat = re_flags |
1639 			    RE_TDESC_CMD_OWN | RE_TDESC_CMD_EOF |
1640 			    (RE_IP4CSUMTX_PADLEN + 1 - m->m_pkthdr.len);
1641 			if (curdesc == (RE_TX_DESC_CNT(sc) - 1))
1642 				cmdstat |= RE_TDESC_CMD_EOR;
1643 			d->re_cmdstat = htole32(cmdstat);
1644 			RE_TXDESCSYNC(sc, curdesc,
1645 			    BUS_DMASYNC_PREREAD|BUS_DMASYNC_PREWRITE);
1646 			lastdesc = curdesc;
1647 			curdesc = RE_NEXT_TX_DESC(sc, curdesc);
1648 		}
1649 		KASSERT(lastdesc != -1);
1650 
1651 		/* Transfer ownership of packet to the chip. */
1652 
1653 		sc->re_ldata.re_tx_list[startdesc].re_cmdstat |=
1654 		    htole32(RE_TDESC_CMD_OWN);
1655 		RE_TXDESCSYNC(sc, startdesc,
1656 		    BUS_DMASYNC_PREREAD|BUS_DMASYNC_PREWRITE);
1657 
1658 		/* update info of TX queue and descriptors */
1659 		txq->txq_mbuf = m;
1660 		txq->txq_descidx = lastdesc;
1661 		txq->txq_nsegs = nsegs;
1662 
1663 		sc->re_ldata.re_txq_free--;
1664 		sc->re_ldata.re_tx_free -= nsegs;
1665 		sc->re_ldata.re_tx_nextfree = curdesc;
1666 
1667 		/*
1668 		 * If there's a BPF listener, bounce a copy of this frame
1669 		 * to him.
1670 		 */
1671 		if (ifp->if_bpf)
1672 			bpf_ops->bpf_mtap(ifp->if_bpf, m);
1673 	}
1674 
1675 	if (sc->re_ldata.re_txq_free < ofree) {
1676 		/*
1677 		 * TX packets are enqueued.
1678 		 */
1679 		sc->re_ldata.re_txq_prodidx = idx;
1680 
1681 		/*
1682 		 * Start the transmitter to poll.
1683 		 *
1684 		 * RealTek put the TX poll request register in a different
1685 		 * location on the 8169 gigE chip. I don't know why.
1686 		 */
1687 		if ((sc->sc_quirk & RTKQ_8139CPLUS) != 0)
1688 			CSR_WRITE_1(sc, RTK_TXSTART, RTK_TXSTART_START);
1689 		else
1690 			CSR_WRITE_1(sc, RTK_GTXSTART, RTK_TXSTART_START);
1691 
1692 		/*
1693 		 * Use the countdown timer for interrupt moderation.
1694 		 * 'TX done' interrupts are disabled. Instead, we reset the
1695 		 * countdown timer, which will begin counting until it hits
1696 		 * the value in the TIMERINT register, and then trigger an
1697 		 * interrupt. Each time we write to the TIMERCNT register,
1698 		 * the timer count is reset to 0.
1699 		 */
1700 		CSR_WRITE_4(sc, RTK_TIMERCNT, 1);
1701 
1702 		/*
1703 		 * Set a timeout in case the chip goes out to lunch.
1704 		 */
1705 		ifp->if_timer = 5;
1706 	}
1707 }
1708 
1709 static int
1710 re_init(struct ifnet *ifp)
1711 {
1712 	struct rtk_softc *sc = ifp->if_softc;
1713 	const uint8_t *enaddr;
1714 	uint32_t rxcfg = 0;
1715 	uint32_t reg;
1716 	uint16_t cfg;
1717 	int error;
1718 
1719 	if ((error = re_enable(sc)) != 0)
1720 		goto out;
1721 
1722 	/*
1723 	 * Cancel pending I/O and free all RX/TX buffers.
1724 	 */
1725 	re_stop(ifp, 0);
1726 
1727 	re_reset(sc);
1728 
1729 	/*
1730 	 * Enable C+ RX and TX mode, as well as VLAN stripping and
1731 	 * RX checksum offload. We must configure the C+ register
1732 	 * before all others.
1733 	 */
1734 	cfg = RE_CPLUSCMD_PCI_MRW;
1735 
1736 	/*
1737 	 * XXX: For old 8169 set bit 14.
1738 	 *      For 8169S/8110S and above, do not set bit 14.
1739 	 */
1740 	if ((sc->sc_quirk & RTKQ_8169NONS) != 0)
1741 		cfg |= (0x1 << 14);
1742 
1743 	if ((ifp->if_capenable & ETHERCAP_VLAN_HWTAGGING) != 0)
1744 		cfg |= RE_CPLUSCMD_VLANSTRIP;
1745 	if ((ifp->if_capenable & (IFCAP_CSUM_IPv4_Rx |
1746 	     IFCAP_CSUM_TCPv4_Rx | IFCAP_CSUM_UDPv4_Rx)) != 0)
1747 		cfg |= RE_CPLUSCMD_RXCSUM_ENB;
1748 	if ((sc->sc_quirk & RTKQ_MACSTAT) != 0) {
1749 		cfg |= RE_CPLUSCMD_MACSTAT_DIS;
1750 		cfg |= RE_CPLUSCMD_TXENB;
1751 	} else
1752 		cfg |= RE_CPLUSCMD_RXENB | RE_CPLUSCMD_TXENB;
1753 
1754 	CSR_WRITE_2(sc, RTK_CPLUS_CMD, cfg);
1755 
1756 	/* XXX: from Realtek-supplied Linux driver. Wholly undocumented. */
1757 	if ((sc->sc_quirk & RTKQ_8139CPLUS) == 0)
1758 		CSR_WRITE_2(sc, RTK_IM, 0x0000);
1759 
1760 	DELAY(10000);
1761 
1762 	/*
1763 	 * Init our MAC address.  Even though the chipset
1764 	 * documentation doesn't mention it, we need to enter "Config
1765 	 * register write enable" mode to modify the ID registers.
1766 	 */
1767 	CSR_WRITE_1(sc, RTK_EECMD, RTK_EEMODE_WRITECFG);
1768 	enaddr = CLLADDR(ifp->if_sadl);
1769 	reg = enaddr[0] | (enaddr[1] << 8) |
1770 	    (enaddr[2] << 16) | (enaddr[3] << 24);
1771 	CSR_WRITE_4(sc, RTK_IDR0, reg);
1772 	reg = enaddr[4] | (enaddr[5] << 8);
1773 	CSR_WRITE_4(sc, RTK_IDR4, reg);
1774 	CSR_WRITE_1(sc, RTK_EECMD, RTK_EEMODE_OFF);
1775 
1776 	/*
1777 	 * For C+ mode, initialize the RX descriptors and mbufs.
1778 	 */
1779 	re_rx_list_init(sc);
1780 	re_tx_list_init(sc);
1781 
1782 	/*
1783 	 * Load the addresses of the RX and TX lists into the chip.
1784 	 */
1785 	CSR_WRITE_4(sc, RTK_RXLIST_ADDR_HI,
1786 	    RE_ADDR_HI(sc->re_ldata.re_rx_list_map->dm_segs[0].ds_addr));
1787 	CSR_WRITE_4(sc, RTK_RXLIST_ADDR_LO,
1788 	    RE_ADDR_LO(sc->re_ldata.re_rx_list_map->dm_segs[0].ds_addr));
1789 
1790 	CSR_WRITE_4(sc, RTK_TXLIST_ADDR_HI,
1791 	    RE_ADDR_HI(sc->re_ldata.re_tx_list_map->dm_segs[0].ds_addr));
1792 	CSR_WRITE_4(sc, RTK_TXLIST_ADDR_LO,
1793 	    RE_ADDR_LO(sc->re_ldata.re_tx_list_map->dm_segs[0].ds_addr));
1794 
1795 	/*
1796 	 * Enable transmit and receive.
1797 	 */
1798 	CSR_WRITE_1(sc, RTK_COMMAND, RTK_CMD_TX_ENB | RTK_CMD_RX_ENB);
1799 
1800 	/*
1801 	 * Set the initial TX and RX configuration.
1802 	 */
1803 	if (sc->re_testmode && (sc->sc_quirk & RTKQ_8169NONS) != 0) {
1804 		/* test mode is needed only for old 8169 */
1805 		CSR_WRITE_4(sc, RTK_TXCFG,
1806 		    RE_TXCFG_CONFIG | RTK_LOOPTEST_ON);
1807 	} else
1808 		CSR_WRITE_4(sc, RTK_TXCFG, RE_TXCFG_CONFIG);
1809 
1810 	CSR_WRITE_1(sc, RTK_EARLY_TX_THRESH, 16);
1811 
1812 	CSR_WRITE_4(sc, RTK_RXCFG, RE_RXCFG_CONFIG);
1813 
1814 	/* Set the individual bit to receive frames for this host only. */
1815 	rxcfg = CSR_READ_4(sc, RTK_RXCFG);
1816 	rxcfg |= RTK_RXCFG_RX_INDIV;
1817 
1818 	/* If we want promiscuous mode, set the allframes bit. */
1819 	if (ifp->if_flags & IFF_PROMISC)
1820 		rxcfg |= RTK_RXCFG_RX_ALLPHYS;
1821 	else
1822 		rxcfg &= ~RTK_RXCFG_RX_ALLPHYS;
1823 	CSR_WRITE_4(sc, RTK_RXCFG, rxcfg);
1824 
1825 	/*
1826 	 * Set capture broadcast bit to capture broadcast frames.
1827 	 */
1828 	if (ifp->if_flags & IFF_BROADCAST)
1829 		rxcfg |= RTK_RXCFG_RX_BROAD;
1830 	else
1831 		rxcfg &= ~RTK_RXCFG_RX_BROAD;
1832 	CSR_WRITE_4(sc, RTK_RXCFG, rxcfg);
1833 
1834 	/*
1835 	 * Program the multicast filter, if necessary.
1836 	 */
1837 	rtk_setmulti(sc);
1838 
1839 	/*
1840 	 * Enable interrupts.
1841 	 */
1842 	if (sc->re_testmode)
1843 		CSR_WRITE_2(sc, RTK_IMR, 0);
1844 	else
1845 		CSR_WRITE_2(sc, RTK_IMR, RTK_INTRS_CPLUS);
1846 
1847 	/* Start RX/TX process. */
1848 	CSR_WRITE_4(sc, RTK_MISSEDPKT, 0);
1849 #ifdef notdef
1850 	/* Enable receiver and transmitter. */
1851 	CSR_WRITE_1(sc, RTK_COMMAND, RTK_CMD_TX_ENB | RTK_CMD_RX_ENB);
1852 #endif
1853 
1854 	/*
1855 	 * Initialize the timer interrupt register so that
1856 	 * a timer interrupt will be generated once the timer
1857 	 * reaches a certain number of ticks. The timer is
1858 	 * reloaded on each transmit. This gives us TX interrupt
1859 	 * moderation, which dramatically improves TX frame rate.
1860 	 */
1861 
1862 	if ((sc->sc_quirk & RTKQ_8139CPLUS) != 0)
1863 		CSR_WRITE_4(sc, RTK_TIMERINT, 0x400);
1864 	else {
1865 		CSR_WRITE_4(sc, RTK_TIMERINT_8169, 0x800);
1866 
1867 		/*
1868 		 * For 8169 gigE NICs, set the max allowed RX packet
1869 		 * size so we can receive jumbo frames.
1870 		 */
1871 		CSR_WRITE_2(sc, RTK_MAXRXPKTLEN, 16383);
1872 	}
1873 
1874 	if (sc->re_testmode)
1875 		return 0;
1876 
1877 	CSR_WRITE_1(sc, RTK_CFG1, RTK_CFG1_DRVLOAD);
1878 
1879 	ifp->if_flags |= IFF_RUNNING;
1880 	ifp->if_flags &= ~IFF_OACTIVE;
1881 
1882 	callout_reset(&sc->rtk_tick_ch, hz, re_tick, sc);
1883 
1884  out:
1885 	if (error) {
1886 		ifp->if_flags &= ~(IFF_RUNNING | IFF_OACTIVE);
1887 		ifp->if_timer = 0;
1888 		printf("%s: interface not running\n",
1889 		    device_xname(sc->sc_dev));
1890 	}
1891 
1892 	return error;
1893 }
1894 
1895 static int
1896 re_ioctl(struct ifnet *ifp, u_long command, void *data)
1897 {
1898 	struct rtk_softc *sc = ifp->if_softc;
1899 	struct ifreq *ifr = data;
1900 	int s, error = 0;
1901 
1902 	s = splnet();
1903 
1904 	switch (command) {
1905 	case SIOCSIFMTU:
1906 		/*
1907 		 * Disable jumbo frames if it's not supported.
1908 		 */
1909 		if ((sc->sc_quirk & RTKQ_NOJUMBO) != 0 &&
1910 		    ifr->ifr_mtu > ETHERMTU) {
1911 			error = EINVAL;
1912 			break;
1913 		}
1914 
1915 		if (ifr->ifr_mtu < ETHERMIN || ifr->ifr_mtu > ETHERMTU_JUMBO)
1916 			error = EINVAL;
1917 		else if ((error = ifioctl_common(ifp, command, data)) ==
1918 		    ENETRESET)
1919 			error = 0;
1920 		break;
1921 	default:
1922 		if ((error = ether_ioctl(ifp, command, data)) != ENETRESET)
1923 			break;
1924 
1925 		error = 0;
1926 
1927 		if (command == SIOCSIFCAP)
1928 			error = (*ifp->if_init)(ifp);
1929 		else if (command != SIOCADDMULTI && command != SIOCDELMULTI)
1930 			;
1931 		else if (ifp->if_flags & IFF_RUNNING)
1932 			rtk_setmulti(sc);
1933 		break;
1934 	}
1935 
1936 	splx(s);
1937 
1938 	return error;
1939 }
1940 
1941 static void
1942 re_watchdog(struct ifnet *ifp)
1943 {
1944 	struct rtk_softc *sc;
1945 	int s;
1946 
1947 	sc = ifp->if_softc;
1948 	s = splnet();
1949 	printf("%s: watchdog timeout\n", device_xname(sc->sc_dev));
1950 	ifp->if_oerrors++;
1951 
1952 	re_txeof(sc);
1953 	re_rxeof(sc);
1954 
1955 	re_init(ifp);
1956 
1957 	splx(s);
1958 }
1959 
1960 /*
1961  * Stop the adapter and free any mbufs allocated to the
1962  * RX and TX lists.
1963  */
1964 static void
1965 re_stop(struct ifnet *ifp, int disable)
1966 {
1967 	int i;
1968 	struct rtk_softc *sc = ifp->if_softc;
1969 
1970 	callout_stop(&sc->rtk_tick_ch);
1971 
1972 	mii_down(&sc->mii);
1973 
1974 	if ((sc->sc_quirk & RTKQ_CMDSTOP) != 0)
1975 		CSR_WRITE_1(sc, RTK_COMMAND, RTK_CMD_STOPREQ | RTK_CMD_TX_ENB |
1976 		    RTK_CMD_RX_ENB);
1977 	else
1978 		CSR_WRITE_1(sc, RTK_COMMAND, 0x00);
1979 	DELAY(1000);
1980 	CSR_WRITE_2(sc, RTK_IMR, 0x0000);
1981 	CSR_WRITE_2(sc, RTK_ISR, 0xFFFF);
1982 
1983 	if (sc->re_head != NULL) {
1984 		m_freem(sc->re_head);
1985 		sc->re_head = sc->re_tail = NULL;
1986 	}
1987 
1988 	/* Free the TX list buffers. */
1989 	for (i = 0; i < RE_TX_QLEN; i++) {
1990 		if (sc->re_ldata.re_txq[i].txq_mbuf != NULL) {
1991 			bus_dmamap_unload(sc->sc_dmat,
1992 			    sc->re_ldata.re_txq[i].txq_dmamap);
1993 			m_freem(sc->re_ldata.re_txq[i].txq_mbuf);
1994 			sc->re_ldata.re_txq[i].txq_mbuf = NULL;
1995 		}
1996 	}
1997 
1998 	/* Free the RX list buffers. */
1999 	for (i = 0; i < RE_RX_DESC_CNT; i++) {
2000 		if (sc->re_ldata.re_rxsoft[i].rxs_mbuf != NULL) {
2001 			bus_dmamap_unload(sc->sc_dmat,
2002 			    sc->re_ldata.re_rxsoft[i].rxs_dmamap);
2003 			m_freem(sc->re_ldata.re_rxsoft[i].rxs_mbuf);
2004 			sc->re_ldata.re_rxsoft[i].rxs_mbuf = NULL;
2005 		}
2006 	}
2007 
2008 	if (disable)
2009 		re_disable(sc);
2010 
2011 	ifp->if_flags &= ~(IFF_RUNNING | IFF_OACTIVE);
2012 	ifp->if_timer = 0;
2013 }
2014