xref: /netbsd-src/sys/dev/ic/rtl8169.c (revision 7fa608457b817eca6e0977b37f758ae064f3c99c)
1 /*	$NetBSD: rtl8169.c,v 1.89 2007/10/19 11:59:59 ad Exp $	*/
2 
3 /*
4  * Copyright (c) 1997, 1998-2003
5  *	Bill Paul <wpaul@windriver.com>.  All rights reserved.
6  *
7  * Redistribution and use in source and binary forms, with or without
8  * modification, are permitted provided that the following conditions
9  * are met:
10  * 1. Redistributions of source code must retain the above copyright
11  *    notice, this list of conditions and the following disclaimer.
12  * 2. Redistributions in binary form must reproduce the above copyright
13  *    notice, this list of conditions and the following disclaimer in the
14  *    documentation and/or other materials provided with the distribution.
15  * 3. All advertising materials mentioning features or use of this software
16  *    must display the following acknowledgement:
17  *	This product includes software developed by Bill Paul.
18  * 4. Neither the name of the author nor the names of any co-contributors
19  *    may be used to endorse or promote products derived from this software
20  *    without specific prior written permission.
21  *
22  * THIS SOFTWARE IS PROVIDED BY Bill Paul AND CONTRIBUTORS ``AS IS'' AND
23  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
24  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
25  * ARE DISCLAIMED.  IN NO EVENT SHALL Bill Paul OR THE VOICES IN HIS HEAD
26  * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
27  * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
28  * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
29  * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
30  * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
31  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
32  * THE POSSIBILITY OF SUCH DAMAGE.
33  */
34 
35 #include <sys/cdefs.h>
36 /* $FreeBSD: /repoman/r/ncvs/src/sys/dev/re/if_re.c,v 1.20 2004/04/11 20:34:08 ru Exp $ */
37 
38 /*
39  * RealTek 8139C+/8169/8169S/8110S PCI NIC driver
40  *
41  * Written by Bill Paul <wpaul@windriver.com>
42  * Senior Networking Software Engineer
43  * Wind River Systems
44  */
45 
46 /*
47  * This driver is designed to support RealTek's next generation of
48  * 10/100 and 10/100/1000 PCI ethernet controllers. There are currently
49  * four devices in this family: the RTL8139C+, the RTL8169, the RTL8169S
50  * and the RTL8110S.
51  *
52  * The 8139C+ is a 10/100 ethernet chip. It is backwards compatible
53  * with the older 8139 family, however it also supports a special
54  * C+ mode of operation that provides several new performance enhancing
55  * features. These include:
56  *
57  *	o Descriptor based DMA mechanism. Each descriptor represents
58  *	  a single packet fragment. Data buffers may be aligned on
59  *	  any byte boundary.
60  *
61  *	o 64-bit DMA
62  *
63  *	o TCP/IP checksum offload for both RX and TX
64  *
65  *	o High and normal priority transmit DMA rings
66  *
67  *	o VLAN tag insertion and extraction
68  *
69  *	o TCP large send (segmentation offload)
70  *
71  * Like the 8139, the 8139C+ also has a built-in 10/100 PHY. The C+
72  * programming API is fairly straightforward. The RX filtering, EEPROM
73  * access and PHY access is the same as it is on the older 8139 series
74  * chips.
75  *
76  * The 8169 is a 64-bit 10/100/1000 gigabit ethernet MAC. It has almost the
77  * same programming API and feature set as the 8139C+ with the following
78  * differences and additions:
79  *
80  *	o 1000Mbps mode
81  *
82  *	o Jumbo frames
83  *
84  * 	o GMII and TBI ports/registers for interfacing with copper
85  *	  or fiber PHYs
86  *
87  *      o RX and TX DMA rings can have up to 1024 descriptors
88  *        (the 8139C+ allows a maximum of 64)
89  *
90  *	o Slight differences in register layout from the 8139C+
91  *
92  * The TX start and timer interrupt registers are at different locations
93  * on the 8169 than they are on the 8139C+. Also, the status word in the
94  * RX descriptor has a slightly different bit layout. The 8169 does not
95  * have a built-in PHY. Most reference boards use a Marvell 88E1000 'Alaska'
96  * copper gigE PHY.
97  *
98  * The 8169S/8110S 10/100/1000 devices have built-in copper gigE PHYs
99  * (the 'S' stands for 'single-chip'). These devices have the same
100  * programming API as the older 8169, but also have some vendor-specific
101  * registers for the on-board PHY. The 8110S is a LAN-on-motherboard
102  * part designed to be pin-compatible with the RealTek 8100 10/100 chip.
103  *
104  * This driver takes advantage of the RX and TX checksum offload and
105  * VLAN tag insertion/extraction features. It also implements TX
106  * interrupt moderation using the timer interrupt registers, which
107  * significantly reduces TX interrupt load. There is also support
108  * for jumbo frames, however the 8169/8169S/8110S can not transmit
109  * jumbo frames larger than 7.5K, so the max MTU possible with this
110  * driver is 7500 bytes.
111  */
112 
113 #include "bpfilter.h"
114 #include "vlan.h"
115 
116 #include <sys/param.h>
117 #include <sys/endian.h>
118 #include <sys/systm.h>
119 #include <sys/sockio.h>
120 #include <sys/mbuf.h>
121 #include <sys/malloc.h>
122 #include <sys/kernel.h>
123 #include <sys/socket.h>
124 #include <sys/device.h>
125 
126 #include <net/if.h>
127 #include <net/if_arp.h>
128 #include <net/if_dl.h>
129 #include <net/if_ether.h>
130 #include <net/if_media.h>
131 #include <net/if_vlanvar.h>
132 
133 #include <netinet/in_systm.h>	/* XXX for IP_MAXPACKET */
134 #include <netinet/in.h>		/* XXX for IP_MAXPACKET */
135 #include <netinet/ip.h>		/* XXX for IP_MAXPACKET */
136 
137 #if NBPFILTER > 0
138 #include <net/bpf.h>
139 #endif
140 
141 #include <sys/bus.h>
142 
143 #include <dev/mii/mii.h>
144 #include <dev/mii/miivar.h>
145 
146 #include <dev/ic/rtl81x9reg.h>
147 #include <dev/ic/rtl81x9var.h>
148 
149 #include <dev/ic/rtl8169var.h>
150 
151 static inline void re_set_bufaddr(struct re_desc *, bus_addr_t);
152 
153 static int re_newbuf(struct rtk_softc *, int, struct mbuf *);
154 static int re_rx_list_init(struct rtk_softc *);
155 static int re_tx_list_init(struct rtk_softc *);
156 static void re_rxeof(struct rtk_softc *);
157 static void re_txeof(struct rtk_softc *);
158 static void re_tick(void *);
159 static void re_start(struct ifnet *);
160 static int re_ioctl(struct ifnet *, u_long, void *);
161 static int re_init(struct ifnet *);
162 static void re_stop(struct ifnet *, int);
163 static void re_watchdog(struct ifnet *);
164 
165 static void re_shutdown(void *);
166 static int re_enable(struct rtk_softc *);
167 static void re_disable(struct rtk_softc *);
168 static void re_power(int, void *);
169 
170 static int re_ifmedia_upd(struct ifnet *);
171 static void re_ifmedia_sts(struct ifnet *, struct ifmediareq *);
172 
173 static int re_gmii_readreg(struct device *, int, int);
174 static void re_gmii_writereg(struct device *, int, int, int);
175 
176 static int re_miibus_readreg(struct device *, int, int);
177 static void re_miibus_writereg(struct device *, int, int, int);
178 static void re_miibus_statchg(struct device *);
179 
180 static void re_reset(struct rtk_softc *);
181 
182 static inline void
183 re_set_bufaddr(struct re_desc *d, bus_addr_t addr)
184 {
185 
186 	d->re_bufaddr_lo = htole32((uint32_t)addr);
187 	if (sizeof(bus_addr_t) == sizeof(uint64_t))
188 		d->re_bufaddr_hi = htole32((uint64_t)addr >> 32);
189 	else
190 		d->re_bufaddr_hi = 0;
191 }
192 
193 static int
194 re_gmii_readreg(struct device *self, int phy, int reg)
195 {
196 	struct rtk_softc	*sc = (void *)self;
197 	uint32_t		rval;
198 	int			i;
199 
200 	if (phy != 7)
201 		return 0;
202 
203 	/* Let the rgephy driver read the GMEDIASTAT register */
204 
205 	if (reg == RTK_GMEDIASTAT) {
206 		rval = CSR_READ_1(sc, RTK_GMEDIASTAT);
207 		return rval;
208 	}
209 
210 	CSR_WRITE_4(sc, RTK_PHYAR, reg << 16);
211 	DELAY(1000);
212 
213 	for (i = 0; i < RTK_TIMEOUT; i++) {
214 		rval = CSR_READ_4(sc, RTK_PHYAR);
215 		if (rval & RTK_PHYAR_BUSY)
216 			break;
217 		DELAY(100);
218 	}
219 
220 	if (i == RTK_TIMEOUT) {
221 		aprint_error("%s: PHY read failed\n", sc->sc_dev.dv_xname);
222 		return 0;
223 	}
224 
225 	return rval & RTK_PHYAR_PHYDATA;
226 }
227 
228 static void
229 re_gmii_writereg(struct device *dev, int phy, int reg, int data)
230 {
231 	struct rtk_softc	*sc = (void *)dev;
232 	uint32_t		rval;
233 	int			i;
234 
235 	CSR_WRITE_4(sc, RTK_PHYAR, (reg << 16) |
236 	    (data & RTK_PHYAR_PHYDATA) | RTK_PHYAR_BUSY);
237 	DELAY(1000);
238 
239 	for (i = 0; i < RTK_TIMEOUT; i++) {
240 		rval = CSR_READ_4(sc, RTK_PHYAR);
241 		if (!(rval & RTK_PHYAR_BUSY))
242 			break;
243 		DELAY(100);
244 	}
245 
246 	if (i == RTK_TIMEOUT) {
247 		aprint_error("%s: PHY write reg %x <- %x failed\n",
248 		    sc->sc_dev.dv_xname, reg, data);
249 	}
250 }
251 
252 static int
253 re_miibus_readreg(struct device *dev, int phy, int reg)
254 {
255 	struct rtk_softc	*sc = (void *)dev;
256 	uint16_t		rval = 0;
257 	uint16_t		re8139_reg = 0;
258 	int			s;
259 
260 	s = splnet();
261 
262 	if ((sc->sc_quirk & RTKQ_8139CPLUS) == 0) {
263 		rval = re_gmii_readreg(dev, phy, reg);
264 		splx(s);
265 		return rval;
266 	}
267 
268 	/* Pretend the internal PHY is only at address 0 */
269 	if (phy) {
270 		splx(s);
271 		return 0;
272 	}
273 	switch (reg) {
274 	case MII_BMCR:
275 		re8139_reg = RTK_BMCR;
276 		break;
277 	case MII_BMSR:
278 		re8139_reg = RTK_BMSR;
279 		break;
280 	case MII_ANAR:
281 		re8139_reg = RTK_ANAR;
282 		break;
283 	case MII_ANER:
284 		re8139_reg = RTK_ANER;
285 		break;
286 	case MII_ANLPAR:
287 		re8139_reg = RTK_LPAR;
288 		break;
289 	case MII_PHYIDR1:
290 	case MII_PHYIDR2:
291 		splx(s);
292 		return 0;
293 	/*
294 	 * Allow the rlphy driver to read the media status
295 	 * register. If we have a link partner which does not
296 	 * support NWAY, this is the register which will tell
297 	 * us the results of parallel detection.
298 	 */
299 	case RTK_MEDIASTAT:
300 		rval = CSR_READ_1(sc, RTK_MEDIASTAT);
301 		splx(s);
302 		return rval;
303 	default:
304 		aprint_error("%s: bad phy register\n", sc->sc_dev.dv_xname);
305 		splx(s);
306 		return 0;
307 	}
308 	rval = CSR_READ_2(sc, re8139_reg);
309 	if ((sc->sc_quirk & RTKQ_8139CPLUS) != 0 && re8139_reg == RTK_BMCR) {
310 		/* 8139C+ has different bit layout. */
311 		rval &= ~(BMCR_LOOP | BMCR_ISO);
312 	}
313 	splx(s);
314 	return rval;
315 }
316 
317 static void
318 re_miibus_writereg(struct device *dev, int phy, int reg, int data)
319 {
320 	struct rtk_softc	*sc = (void *)dev;
321 	uint16_t		re8139_reg = 0;
322 	int			s;
323 
324 	s = splnet();
325 
326 	if ((sc->sc_quirk & RTKQ_8139CPLUS) == 0) {
327 		re_gmii_writereg(dev, phy, reg, data);
328 		splx(s);
329 		return;
330 	}
331 
332 	/* Pretend the internal PHY is only at address 0 */
333 	if (phy) {
334 		splx(s);
335 		return;
336 	}
337 	switch (reg) {
338 	case MII_BMCR:
339 		re8139_reg = RTK_BMCR;
340 		if ((sc->sc_quirk & RTKQ_8139CPLUS) != 0) {
341 			/* 8139C+ has different bit layout. */
342 			data &= ~(BMCR_LOOP | BMCR_ISO);
343 		}
344 		break;
345 	case MII_BMSR:
346 		re8139_reg = RTK_BMSR;
347 		break;
348 	case MII_ANAR:
349 		re8139_reg = RTK_ANAR;
350 		break;
351 	case MII_ANER:
352 		re8139_reg = RTK_ANER;
353 		break;
354 	case MII_ANLPAR:
355 		re8139_reg = RTK_LPAR;
356 		break;
357 	case MII_PHYIDR1:
358 	case MII_PHYIDR2:
359 		splx(s);
360 		return;
361 		break;
362 	default:
363 		aprint_error("%s: bad phy register\n", sc->sc_dev.dv_xname);
364 		splx(s);
365 		return;
366 	}
367 	CSR_WRITE_2(sc, re8139_reg, data);
368 	splx(s);
369 	return;
370 }
371 
372 static void
373 re_miibus_statchg(struct device *dev)
374 {
375 
376 	return;
377 }
378 
379 static void
380 re_reset(struct rtk_softc *sc)
381 {
382 	int		i;
383 
384 	CSR_WRITE_1(sc, RTK_COMMAND, RTK_CMD_RESET);
385 
386 	for (i = 0; i < RTK_TIMEOUT; i++) {
387 		DELAY(10);
388 		if ((CSR_READ_1(sc, RTK_COMMAND) & RTK_CMD_RESET) == 0)
389 			break;
390 	}
391 	if (i == RTK_TIMEOUT)
392 		aprint_error("%s: reset never completed!\n",
393 		    sc->sc_dev.dv_xname);
394 
395 	/*
396 	 * NB: Realtek-supplied Linux driver does this only for
397 	 * MCFG_METHOD_2, which corresponds to sc->sc_rev == 2.
398 	 */
399 	if (1) /* XXX check softc flag for 8169s version */
400 		CSR_WRITE_1(sc, RTK_LDPS, 1);
401 
402 	return;
403 }
404 
405 /*
406  * The following routine is designed to test for a defect on some
407  * 32-bit 8169 cards. Some of these NICs have the REQ64# and ACK64#
408  * lines connected to the bus, however for a 32-bit only card, they
409  * should be pulled high. The result of this defect is that the
410  * NIC will not work right if you plug it into a 64-bit slot: DMA
411  * operations will be done with 64-bit transfers, which will fail
412  * because the 64-bit data lines aren't connected.
413  *
414  * There's no way to work around this (short of talking a soldering
415  * iron to the board), however we can detect it. The method we use
416  * here is to put the NIC into digital loopback mode, set the receiver
417  * to promiscuous mode, and then try to send a frame. We then compare
418  * the frame data we sent to what was received. If the data matches,
419  * then the NIC is working correctly, otherwise we know the user has
420  * a defective NIC which has been mistakenly plugged into a 64-bit PCI
421  * slot. In the latter case, there's no way the NIC can work correctly,
422  * so we print out a message on the console and abort the device attach.
423  */
424 
425 int
426 re_diag(struct rtk_softc *sc)
427 {
428 	struct ifnet		*ifp = &sc->ethercom.ec_if;
429 	struct mbuf		*m0;
430 	struct ether_header	*eh;
431 	struct re_rxsoft	*rxs;
432 	struct re_desc		*cur_rx;
433 	bus_dmamap_t		dmamap;
434 	uint16_t		status;
435 	uint32_t		rxstat;
436 	int			total_len, i, s, error = 0;
437 	static const uint8_t	dst[] = { 0x00, 'h', 'e', 'l', 'l', 'o' };
438 	static const uint8_t	src[] = { 0x00, 'w', 'o', 'r', 'l', 'd' };
439 
440 	/* Allocate a single mbuf */
441 
442 	MGETHDR(m0, M_DONTWAIT, MT_DATA);
443 	if (m0 == NULL)
444 		return ENOBUFS;
445 
446 	/*
447 	 * Initialize the NIC in test mode. This sets the chip up
448 	 * so that it can send and receive frames, but performs the
449 	 * following special functions:
450 	 * - Puts receiver in promiscuous mode
451 	 * - Enables digital loopback mode
452 	 * - Leaves interrupts turned off
453 	 */
454 
455 	ifp->if_flags |= IFF_PROMISC;
456 	sc->re_testmode = 1;
457 	re_init(ifp);
458 	re_stop(ifp, 0);
459 	DELAY(100000);
460 	re_init(ifp);
461 
462 	/* Put some data in the mbuf */
463 
464 	eh = mtod(m0, struct ether_header *);
465 	memcpy(eh->ether_dhost, (char *)&dst, ETHER_ADDR_LEN);
466 	memcpy(eh->ether_shost, (char *)&src, ETHER_ADDR_LEN);
467 	eh->ether_type = htons(ETHERTYPE_IP);
468 	m0->m_pkthdr.len = m0->m_len = ETHER_MIN_LEN - ETHER_CRC_LEN;
469 
470 	/*
471 	 * Queue the packet, start transmission.
472 	 */
473 
474 	CSR_WRITE_2(sc, RTK_ISR, 0xFFFF);
475 	s = splnet();
476 	IF_ENQUEUE(&ifp->if_snd, m0);
477 	re_start(ifp);
478 	splx(s);
479 	m0 = NULL;
480 
481 	/* Wait for it to propagate through the chip */
482 
483 	DELAY(100000);
484 	for (i = 0; i < RTK_TIMEOUT; i++) {
485 		status = CSR_READ_2(sc, RTK_ISR);
486 		if ((status & (RTK_ISR_TIMEOUT_EXPIRED | RTK_ISR_RX_OK)) ==
487 		    (RTK_ISR_TIMEOUT_EXPIRED | RTK_ISR_RX_OK))
488 			break;
489 		DELAY(10);
490 	}
491 	if (i == RTK_TIMEOUT) {
492 		aprint_error("%s: diagnostic failed, failed to receive packet "
493 		    "in loopback mode\n", sc->sc_dev.dv_xname);
494 		error = EIO;
495 		goto done;
496 	}
497 
498 	/*
499 	 * The packet should have been dumped into the first
500 	 * entry in the RX DMA ring. Grab it from there.
501 	 */
502 
503 	rxs = &sc->re_ldata.re_rxsoft[0];
504 	dmamap = rxs->rxs_dmamap;
505 	bus_dmamap_sync(sc->sc_dmat, dmamap, 0, dmamap->dm_mapsize,
506 	    BUS_DMASYNC_POSTREAD);
507 	bus_dmamap_unload(sc->sc_dmat, dmamap);
508 
509 	m0 = rxs->rxs_mbuf;
510 	rxs->rxs_mbuf = NULL;
511 	eh = mtod(m0, struct ether_header *);
512 
513 	RE_RXDESCSYNC(sc, 0, BUS_DMASYNC_POSTREAD|BUS_DMASYNC_POSTWRITE);
514 	cur_rx = &sc->re_ldata.re_rx_list[0];
515 	rxstat = le32toh(cur_rx->re_cmdstat);
516 	total_len = rxstat & sc->re_rxlenmask;
517 
518 	if (total_len != ETHER_MIN_LEN) {
519 		aprint_error("%s: diagnostic failed, received short packet\n",
520 		    sc->sc_dev.dv_xname);
521 		error = EIO;
522 		goto done;
523 	}
524 
525 	/* Test that the received packet data matches what we sent. */
526 
527 	if (memcmp((char *)&eh->ether_dhost, (char *)&dst, ETHER_ADDR_LEN) ||
528 	    memcmp((char *)&eh->ether_shost, (char *)&src, ETHER_ADDR_LEN) ||
529 	    ntohs(eh->ether_type) != ETHERTYPE_IP) {
530 		aprint_error("%s: WARNING, DMA FAILURE!\n",
531 		    sc->sc_dev.dv_xname);
532 		aprint_error("%s: expected TX data: %s",
533 		    sc->sc_dev.dv_xname, ether_sprintf(dst));
534 		aprint_error("/%s/0x%x\n", ether_sprintf(src), ETHERTYPE_IP);
535 		aprint_error("%s: received RX data: %s",
536 		    sc->sc_dev.dv_xname,
537 		    ether_sprintf(eh->ether_dhost));
538 		aprint_error("/%s/0x%x\n", ether_sprintf(eh->ether_shost),
539 		    ntohs(eh->ether_type));
540 		aprint_error("%s: You may have a defective 32-bit NIC plugged "
541 		    "into a 64-bit PCI slot.\n", sc->sc_dev.dv_xname);
542 		aprint_error("%s: Please re-install the NIC in a 32-bit slot "
543 		    "for proper operation.\n", sc->sc_dev.dv_xname);
544 		aprint_error("%s: Read the re(4) man page for more details.\n",
545 		    sc->sc_dev.dv_xname);
546 		error = EIO;
547 	}
548 
549  done:
550 	/* Turn interface off, release resources */
551 
552 	sc->re_testmode = 0;
553 	ifp->if_flags &= ~IFF_PROMISC;
554 	re_stop(ifp, 0);
555 	if (m0 != NULL)
556 		m_freem(m0);
557 
558 	return error;
559 }
560 
561 
562 /*
563  * Attach the interface. Allocate softc structures, do ifmedia
564  * setup and ethernet/BPF attach.
565  */
566 void
567 re_attach(struct rtk_softc *sc)
568 {
569 	u_char			eaddr[ETHER_ADDR_LEN];
570 	uint16_t		val;
571 	struct ifnet		*ifp;
572 	int			error = 0, i, addr_len;
573 
574 	/* Reset the adapter. */
575 	re_reset(sc);
576 
577 	if (rtk_read_eeprom(sc, RTK_EE_ID, RTK_EEADDR_LEN1) == 0x8129)
578 		addr_len = RTK_EEADDR_LEN1;
579 	else
580 		addr_len = RTK_EEADDR_LEN0;
581 
582 	/*
583 	 * Get station address from the EEPROM.
584 	 */
585 	for (i = 0; i < 3; i++) {
586 		val = rtk_read_eeprom(sc, RTK_EE_EADDR0 + i, addr_len);
587 		eaddr[(i * 2) + 0] = val & 0xff;
588 		eaddr[(i * 2) + 1] = val >> 8;
589 	}
590 
591 	if ((sc->sc_quirk & RTKQ_8139CPLUS) == 0) {
592 		uint32_t hwrev;
593 
594 		/* Revision of 8169/8169S/8110s in bits 30..26, 23 */
595 		hwrev = CSR_READ_4(sc, RTK_TXCFG) & RTK_TXCFG_HWREV;
596 		/* These rev numbers are taken from Realtek's driver */
597 		if (       hwrev == RTK_HWREV_8100E_SPIN2) {
598 			sc->sc_rev = 15;
599 		} else if (hwrev == RTK_HWREV_8100E) {
600 			sc->sc_rev = 14;
601 		} else if (hwrev == RTK_HWREV_8101E) {
602 			sc->sc_rev = 13;
603 		} else if (hwrev == RTK_HWREV_8168_SPIN2 ||
604 		           hwrev == RTK_HWREV_8168_SPIN3) {
605 			sc->sc_rev = 12;
606 		} else if (hwrev == RTK_HWREV_8168_SPIN1) {
607 			sc->sc_rev = 11;
608 		} else if (hwrev == RTK_HWREV_8169_8110SC) {
609 			sc->sc_rev = 5;
610 		} else if (hwrev == RTK_HWREV_8169_8110SB) {
611 			sc->sc_rev = 4;
612 		} else if (hwrev == RTK_HWREV_8169S) {
613 			sc->sc_rev = 3;
614 		} else if (hwrev == RTK_HWREV_8110S) {
615 			sc->sc_rev = 2;
616 		} else if (hwrev == RTK_HWREV_8169) {
617 			sc->sc_rev = 1;
618 			sc->sc_quirk |= RTKQ_8169NONS;
619 		} else {
620 			aprint_normal("%s: Unknown revision (0x%08x)\n",
621 			    sc->sc_dev.dv_xname, hwrev);
622 			/* assume the latest one */
623 			sc->sc_rev = 15;
624 		}
625 
626 		/* Set RX length mask */
627 		sc->re_rxlenmask = RE_RDESC_STAT_GFRAGLEN;
628 		sc->re_ldata.re_tx_desc_cnt = RE_TX_DESC_CNT_8169;
629 	} else {
630 		/* Set RX length mask */
631 		sc->re_rxlenmask = RE_RDESC_STAT_FRAGLEN;
632 		sc->re_ldata.re_tx_desc_cnt = RE_TX_DESC_CNT_8139;
633 	}
634 
635 	aprint_normal("%s: Ethernet address %s\n",
636 	    sc->sc_dev.dv_xname, ether_sprintf(eaddr));
637 
638 	if (sc->re_ldata.re_tx_desc_cnt >
639 	    PAGE_SIZE / sizeof(struct re_desc)) {
640 		sc->re_ldata.re_tx_desc_cnt =
641 		    PAGE_SIZE / sizeof(struct re_desc);
642 	}
643 
644 	aprint_verbose("%s: using %d tx descriptors\n",
645 	    sc->sc_dev.dv_xname, sc->re_ldata.re_tx_desc_cnt);
646 	KASSERT(RE_NEXT_TX_DESC(sc, RE_TX_DESC_CNT(sc) - 1) == 0);
647 
648 	/* Allocate DMA'able memory for the TX ring */
649 	if ((error = bus_dmamem_alloc(sc->sc_dmat, RE_TX_LIST_SZ(sc),
650 	    RE_RING_ALIGN, 0, &sc->re_ldata.re_tx_listseg, 1,
651 	    &sc->re_ldata.re_tx_listnseg, BUS_DMA_NOWAIT)) != 0) {
652 		aprint_error("%s: can't allocate tx listseg, error = %d\n",
653 		    sc->sc_dev.dv_xname, error);
654 		goto fail_0;
655 	}
656 
657 	/* Load the map for the TX ring. */
658 	if ((error = bus_dmamem_map(sc->sc_dmat, &sc->re_ldata.re_tx_listseg,
659 	    sc->re_ldata.re_tx_listnseg, RE_TX_LIST_SZ(sc),
660 	    (void **)&sc->re_ldata.re_tx_list,
661 	    BUS_DMA_COHERENT | BUS_DMA_NOWAIT)) != 0) {
662 		aprint_error("%s: can't map tx list, error = %d\n",
663 		    sc->sc_dev.dv_xname, error);
664 	  	goto fail_1;
665 	}
666 	memset(sc->re_ldata.re_tx_list, 0, RE_TX_LIST_SZ(sc));
667 
668 	if ((error = bus_dmamap_create(sc->sc_dmat, RE_TX_LIST_SZ(sc), 1,
669 	    RE_TX_LIST_SZ(sc), 0, 0,
670 	    &sc->re_ldata.re_tx_list_map)) != 0) {
671 		aprint_error("%s: can't create tx list map, error = %d\n",
672 		    sc->sc_dev.dv_xname, error);
673 		goto fail_2;
674 	}
675 
676 
677 	if ((error = bus_dmamap_load(sc->sc_dmat,
678 	    sc->re_ldata.re_tx_list_map, sc->re_ldata.re_tx_list,
679 	    RE_TX_LIST_SZ(sc), NULL, BUS_DMA_NOWAIT)) != 0) {
680 		aprint_error("%s: can't load tx list, error = %d\n",
681 		    sc->sc_dev.dv_xname, error);
682 		goto fail_3;
683 	}
684 
685 	/* Create DMA maps for TX buffers */
686 	for (i = 0; i < RE_TX_QLEN; i++) {
687 		error = bus_dmamap_create(sc->sc_dmat,
688 		    round_page(IP_MAXPACKET),
689 		    RE_TX_DESC_CNT(sc) - RE_NTXDESC_RSVD, RE_TDESC_CMD_FRAGLEN,
690 		    0, 0, &sc->re_ldata.re_txq[i].txq_dmamap);
691 		if (error) {
692 			aprint_error("%s: can't create DMA map for TX\n",
693 			    sc->sc_dev.dv_xname);
694 			goto fail_4;
695 		}
696 	}
697 
698 	/* Allocate DMA'able memory for the RX ring */
699 	/* XXX see also a comment about RE_RX_DMAMEM_SZ in rtl81x9var.h */
700 	if ((error = bus_dmamem_alloc(sc->sc_dmat,
701 	    RE_RX_DMAMEM_SZ, RE_RING_ALIGN, 0, &sc->re_ldata.re_rx_listseg, 1,
702 	    &sc->re_ldata.re_rx_listnseg, BUS_DMA_NOWAIT)) != 0) {
703 		aprint_error("%s: can't allocate rx listseg, error = %d\n",
704 		    sc->sc_dev.dv_xname, error);
705 		goto fail_4;
706 	}
707 
708 	/* Load the map for the RX ring. */
709 	if ((error = bus_dmamem_map(sc->sc_dmat, &sc->re_ldata.re_rx_listseg,
710 	    sc->re_ldata.re_rx_listnseg, RE_RX_DMAMEM_SZ,
711 	    (void **)&sc->re_ldata.re_rx_list,
712 	    BUS_DMA_COHERENT | BUS_DMA_NOWAIT)) != 0) {
713 		aprint_error("%s: can't map rx list, error = %d\n",
714 		    sc->sc_dev.dv_xname, error);
715 		goto fail_5;
716 	}
717 	memset(sc->re_ldata.re_rx_list, 0, RE_RX_DMAMEM_SZ);
718 
719 	if ((error = bus_dmamap_create(sc->sc_dmat,
720 	    RE_RX_DMAMEM_SZ, 1, RE_RX_DMAMEM_SZ, 0, 0,
721 	    &sc->re_ldata.re_rx_list_map)) != 0) {
722 		aprint_error("%s: can't create rx list map, error = %d\n",
723 		    sc->sc_dev.dv_xname, error);
724 		goto fail_6;
725 	}
726 
727 	if ((error = bus_dmamap_load(sc->sc_dmat,
728 	    sc->re_ldata.re_rx_list_map, sc->re_ldata.re_rx_list,
729 	    RE_RX_DMAMEM_SZ, NULL, BUS_DMA_NOWAIT)) != 0) {
730 		aprint_error("%s: can't load rx list, error = %d\n",
731 		    sc->sc_dev.dv_xname, error);
732 		goto fail_7;
733 	}
734 
735 	/* Create DMA maps for RX buffers */
736 	for (i = 0; i < RE_RX_DESC_CNT; i++) {
737 		error = bus_dmamap_create(sc->sc_dmat, MCLBYTES, 1, MCLBYTES,
738 		    0, 0, &sc->re_ldata.re_rxsoft[i].rxs_dmamap);
739 		if (error) {
740 			aprint_error("%s: can't create DMA map for RX\n",
741 			    sc->sc_dev.dv_xname);
742 			goto fail_8;
743 		}
744 	}
745 
746 	/*
747 	 * Record interface as attached. From here, we should not fail.
748 	 */
749 	sc->sc_flags |= RTK_ATTACHED;
750 
751 	ifp = &sc->ethercom.ec_if;
752 	ifp->if_softc = sc;
753 	strcpy(ifp->if_xname, sc->sc_dev.dv_xname);
754 	ifp->if_mtu = ETHERMTU;
755 	ifp->if_flags = IFF_BROADCAST | IFF_SIMPLEX | IFF_MULTICAST;
756 	ifp->if_ioctl = re_ioctl;
757 	sc->ethercom.ec_capabilities |=
758 	    ETHERCAP_VLAN_MTU | ETHERCAP_VLAN_HWTAGGING;
759 	ifp->if_start = re_start;
760 	ifp->if_stop = re_stop;
761 
762 	/*
763 	 * IFCAP_CSUM_IPv4_Tx on re(4) is broken for small packets,
764 	 * so we have a workaround to handle the bug by padding
765 	 * such packets manually.
766 	 */
767 	ifp->if_capabilities |=
768 	    IFCAP_CSUM_IPv4_Tx | IFCAP_CSUM_IPv4_Rx |
769 	    IFCAP_CSUM_TCPv4_Tx | IFCAP_CSUM_TCPv4_Rx |
770 	    IFCAP_CSUM_UDPv4_Tx | IFCAP_CSUM_UDPv4_Rx |
771 	    IFCAP_TSOv4;
772 	ifp->if_watchdog = re_watchdog;
773 	ifp->if_init = re_init;
774 	ifp->if_snd.ifq_maxlen = RE_IFQ_MAXLEN;
775 	ifp->if_capenable = ifp->if_capabilities;
776 	IFQ_SET_READY(&ifp->if_snd);
777 
778 	callout_init(&sc->rtk_tick_ch, 0);
779 
780 	/* Do MII setup */
781 	sc->mii.mii_ifp = ifp;
782 	sc->mii.mii_readreg = re_miibus_readreg;
783 	sc->mii.mii_writereg = re_miibus_writereg;
784 	sc->mii.mii_statchg = re_miibus_statchg;
785 	ifmedia_init(&sc->mii.mii_media, IFM_IMASK, re_ifmedia_upd,
786 	    re_ifmedia_sts);
787 	mii_attach(&sc->sc_dev, &sc->mii, 0xffffffff, MII_PHY_ANY,
788 	    MII_OFFSET_ANY, 0);
789 	ifmedia_set(&sc->mii.mii_media, IFM_ETHER | IFM_AUTO);
790 
791 	/*
792 	 * Call MI attach routine.
793 	 */
794 	if_attach(ifp);
795 	ether_ifattach(ifp, eaddr);
796 
797 
798 	/*
799 	 * Make sure the interface is shutdown during reboot.
800 	 */
801 	sc->sc_sdhook = shutdownhook_establish(re_shutdown, sc);
802 	if (sc->sc_sdhook == NULL)
803 		aprint_error("%s: WARNING: unable to establish shutdown hook\n",
804 		    sc->sc_dev.dv_xname);
805 	/*
806 	 * Add a suspend hook to make sure we come back up after a
807 	 * resume.
808 	 */
809 	sc->sc_powerhook = powerhook_establish(sc->sc_dev.dv_xname,
810 	    re_power, sc);
811 	if (sc->sc_powerhook == NULL)
812 		aprint_error("%s: WARNING: unable to establish power hook\n",
813 		    sc->sc_dev.dv_xname);
814 
815 
816 	return;
817 
818  fail_8:
819 	/* Destroy DMA maps for RX buffers. */
820 	for (i = 0; i < RE_RX_DESC_CNT; i++)
821 		if (sc->re_ldata.re_rxsoft[i].rxs_dmamap != NULL)
822 			bus_dmamap_destroy(sc->sc_dmat,
823 			    sc->re_ldata.re_rxsoft[i].rxs_dmamap);
824 
825 	/* Free DMA'able memory for the RX ring. */
826 	bus_dmamap_unload(sc->sc_dmat, sc->re_ldata.re_rx_list_map);
827  fail_7:
828 	bus_dmamap_destroy(sc->sc_dmat, sc->re_ldata.re_rx_list_map);
829  fail_6:
830 	bus_dmamem_unmap(sc->sc_dmat,
831 	    (void *)sc->re_ldata.re_rx_list, RE_RX_DMAMEM_SZ);
832  fail_5:
833 	bus_dmamem_free(sc->sc_dmat,
834 	    &sc->re_ldata.re_rx_listseg, sc->re_ldata.re_rx_listnseg);
835 
836  fail_4:
837 	/* Destroy DMA maps for TX buffers. */
838 	for (i = 0; i < RE_TX_QLEN; i++)
839 		if (sc->re_ldata.re_txq[i].txq_dmamap != NULL)
840 			bus_dmamap_destroy(sc->sc_dmat,
841 			    sc->re_ldata.re_txq[i].txq_dmamap);
842 
843 	/* Free DMA'able memory for the TX ring. */
844 	bus_dmamap_unload(sc->sc_dmat, sc->re_ldata.re_tx_list_map);
845  fail_3:
846 	bus_dmamap_destroy(sc->sc_dmat, sc->re_ldata.re_tx_list_map);
847  fail_2:
848 	bus_dmamem_unmap(sc->sc_dmat,
849 	    (void *)sc->re_ldata.re_tx_list, RE_TX_LIST_SZ(sc));
850  fail_1:
851 	bus_dmamem_free(sc->sc_dmat,
852 	    &sc->re_ldata.re_tx_listseg, sc->re_ldata.re_tx_listnseg);
853  fail_0:
854 	return;
855 }
856 
857 
858 /*
859  * re_activate:
860  *     Handle device activation/deactivation requests.
861  */
862 int
863 re_activate(struct device *self, enum devact act)
864 {
865 	struct rtk_softc *sc = (void *)self;
866 	int s, error = 0;
867 
868 	s = splnet();
869 	switch (act) {
870 	case DVACT_ACTIVATE:
871 		error = EOPNOTSUPP;
872 		break;
873 	case DVACT_DEACTIVATE:
874 		mii_activate(&sc->mii, act, MII_PHY_ANY, MII_OFFSET_ANY);
875 		if_deactivate(&sc->ethercom.ec_if);
876 		break;
877 	}
878 	splx(s);
879 
880 	return error;
881 }
882 
883 /*
884  * re_detach:
885  *     Detach a rtk interface.
886  */
887 int
888 re_detach(struct rtk_softc *sc)
889 {
890 	struct ifnet *ifp = &sc->ethercom.ec_if;
891 	int i;
892 
893 	/*
894 	 * Succeed now if there isn't any work to do.
895 	 */
896 	if ((sc->sc_flags & RTK_ATTACHED) == 0)
897 		return 0;
898 
899 	/* Unhook our tick handler. */
900 	callout_stop(&sc->rtk_tick_ch);
901 
902 	/* Detach all PHYs. */
903 	mii_detach(&sc->mii, MII_PHY_ANY, MII_OFFSET_ANY);
904 
905 	/* Delete all remaining media. */
906 	ifmedia_delete_instance(&sc->mii.mii_media, IFM_INST_ANY);
907 
908 	ether_ifdetach(ifp);
909 	if_detach(ifp);
910 
911 	/* Destroy DMA maps for RX buffers. */
912 	for (i = 0; i < RE_RX_DESC_CNT; i++)
913 		if (sc->re_ldata.re_rxsoft[i].rxs_dmamap != NULL)
914 			bus_dmamap_destroy(sc->sc_dmat,
915 			    sc->re_ldata.re_rxsoft[i].rxs_dmamap);
916 
917 	/* Free DMA'able memory for the RX ring. */
918 	bus_dmamap_unload(sc->sc_dmat, sc->re_ldata.re_rx_list_map);
919 	bus_dmamap_destroy(sc->sc_dmat, sc->re_ldata.re_rx_list_map);
920 	bus_dmamem_unmap(sc->sc_dmat,
921 	    (void *)sc->re_ldata.re_rx_list, RE_RX_DMAMEM_SZ);
922 	bus_dmamem_free(sc->sc_dmat,
923 	    &sc->re_ldata.re_rx_listseg, sc->re_ldata.re_rx_listnseg);
924 
925 	/* Destroy DMA maps for TX buffers. */
926 	for (i = 0; i < RE_TX_QLEN; i++)
927 		if (sc->re_ldata.re_txq[i].txq_dmamap != NULL)
928 			bus_dmamap_destroy(sc->sc_dmat,
929 			    sc->re_ldata.re_txq[i].txq_dmamap);
930 
931 	/* Free DMA'able memory for the TX ring. */
932 	bus_dmamap_unload(sc->sc_dmat, sc->re_ldata.re_tx_list_map);
933 	bus_dmamap_destroy(sc->sc_dmat, sc->re_ldata.re_tx_list_map);
934 	bus_dmamem_unmap(sc->sc_dmat,
935 	    (void *)sc->re_ldata.re_tx_list, RE_TX_LIST_SZ(sc));
936 	bus_dmamem_free(sc->sc_dmat,
937 	    &sc->re_ldata.re_tx_listseg, sc->re_ldata.re_tx_listnseg);
938 
939 
940 	shutdownhook_disestablish(sc->sc_sdhook);
941 	powerhook_disestablish(sc->sc_powerhook);
942 
943 	return 0;
944 }
945 
946 /*
947  * re_enable:
948  *     Enable the RTL81X9 chip.
949  */
950 static int
951 re_enable(struct rtk_softc *sc)
952 {
953 
954 	if (RTK_IS_ENABLED(sc) == 0 && sc->sc_enable != NULL) {
955 		if ((*sc->sc_enable)(sc) != 0) {
956 			aprint_error("%s: device enable failed\n",
957 			    sc->sc_dev.dv_xname);
958 			return EIO;
959 		}
960 		sc->sc_flags |= RTK_ENABLED;
961 	}
962 	return 0;
963 }
964 
965 /*
966  * re_disable:
967  *     Disable the RTL81X9 chip.
968  */
969 static void
970 re_disable(struct rtk_softc *sc)
971 {
972 
973 	if (RTK_IS_ENABLED(sc) && sc->sc_disable != NULL) {
974 		(*sc->sc_disable)(sc);
975 		sc->sc_flags &= ~RTK_ENABLED;
976 	}
977 }
978 
979 /*
980  * re_power:
981  *     Power management (suspend/resume) hook.
982  */
983 void
984 re_power(int why, void *arg)
985 {
986 	struct rtk_softc *sc = (void *)arg;
987 	struct ifnet *ifp = &sc->ethercom.ec_if;
988 	int s;
989 
990 	s = splnet();
991 	switch (why) {
992 	case PWR_SUSPEND:
993 	case PWR_STANDBY:
994 		re_stop(ifp, 0);
995 		if (sc->sc_power != NULL)
996 			(*sc->sc_power)(sc, why);
997 		break;
998 	case PWR_RESUME:
999 		if (ifp->if_flags & IFF_UP) {
1000 			if (sc->sc_power != NULL)
1001 				(*sc->sc_power)(sc, why);
1002 			re_init(ifp);
1003 		}
1004 		break;
1005 	case PWR_SOFTSUSPEND:
1006 	case PWR_SOFTSTANDBY:
1007 	case PWR_SOFTRESUME:
1008 		break;
1009 	}
1010 	splx(s);
1011 }
1012 
1013 
1014 static int
1015 re_newbuf(struct rtk_softc *sc, int idx, struct mbuf *m)
1016 {
1017 	struct mbuf		*n = NULL;
1018 	bus_dmamap_t		map;
1019 	struct re_desc		*d;
1020 	struct re_rxsoft	*rxs;
1021 	uint32_t		cmdstat;
1022 	int			error;
1023 
1024 	if (m == NULL) {
1025 		MGETHDR(n, M_DONTWAIT, MT_DATA);
1026 		if (n == NULL)
1027 			return ENOBUFS;
1028 
1029 		MCLGET(n, M_DONTWAIT);
1030 		if ((n->m_flags & M_EXT) == 0) {
1031 			m_freem(n);
1032 			return ENOBUFS;
1033 		}
1034 		m = n;
1035 	} else
1036 		m->m_data = m->m_ext.ext_buf;
1037 
1038 	/*
1039 	 * Initialize mbuf length fields and fixup
1040 	 * alignment so that the frame payload is
1041 	 * longword aligned.
1042 	 */
1043 	m->m_len = m->m_pkthdr.len = MCLBYTES - RE_ETHER_ALIGN;
1044 	m->m_data += RE_ETHER_ALIGN;
1045 
1046 	rxs = &sc->re_ldata.re_rxsoft[idx];
1047 	map = rxs->rxs_dmamap;
1048 	error = bus_dmamap_load_mbuf(sc->sc_dmat, map, m,
1049 	    BUS_DMA_READ|BUS_DMA_NOWAIT);
1050 
1051 	if (error)
1052 		goto out;
1053 
1054 	bus_dmamap_sync(sc->sc_dmat, map, 0, map->dm_mapsize,
1055 	    BUS_DMASYNC_PREREAD);
1056 
1057 	d = &sc->re_ldata.re_rx_list[idx];
1058 #ifdef DIAGNOSTIC
1059 	RE_RXDESCSYNC(sc, idx, BUS_DMASYNC_POSTREAD|BUS_DMASYNC_POSTWRITE);
1060 	cmdstat = le32toh(d->re_cmdstat);
1061 	RE_RXDESCSYNC(sc, idx, BUS_DMASYNC_PREREAD);
1062 	if (cmdstat & RE_RDESC_STAT_OWN) {
1063 		panic("%s: tried to map busy RX descriptor",
1064 		    sc->sc_dev.dv_xname);
1065 	}
1066 #endif
1067 
1068 	rxs->rxs_mbuf = m;
1069 
1070 	d->re_vlanctl = 0;
1071 	cmdstat = map->dm_segs[0].ds_len;
1072 	if (idx == (RE_RX_DESC_CNT - 1))
1073 		cmdstat |= RE_RDESC_CMD_EOR;
1074 	re_set_bufaddr(d, map->dm_segs[0].ds_addr);
1075 	d->re_cmdstat = htole32(cmdstat);
1076 	RE_RXDESCSYNC(sc, idx, BUS_DMASYNC_PREREAD|BUS_DMASYNC_PREWRITE);
1077 	cmdstat |= RE_RDESC_CMD_OWN;
1078 	d->re_cmdstat = htole32(cmdstat);
1079 	RE_RXDESCSYNC(sc, idx, BUS_DMASYNC_PREREAD|BUS_DMASYNC_PREWRITE);
1080 
1081 	return 0;
1082  out:
1083 	if (n != NULL)
1084 		m_freem(n);
1085 	return ENOMEM;
1086 }
1087 
1088 static int
1089 re_tx_list_init(struct rtk_softc *sc)
1090 {
1091 	int i;
1092 
1093 	memset(sc->re_ldata.re_tx_list, 0, RE_TX_LIST_SZ(sc));
1094 	for (i = 0; i < RE_TX_QLEN; i++) {
1095 		sc->re_ldata.re_txq[i].txq_mbuf = NULL;
1096 	}
1097 
1098 	bus_dmamap_sync(sc->sc_dmat,
1099 	    sc->re_ldata.re_tx_list_map, 0,
1100 	    sc->re_ldata.re_tx_list_map->dm_mapsize,
1101 	    BUS_DMASYNC_PREREAD|BUS_DMASYNC_PREWRITE);
1102 	sc->re_ldata.re_txq_prodidx = 0;
1103 	sc->re_ldata.re_txq_considx = 0;
1104 	sc->re_ldata.re_txq_free = RE_TX_QLEN;
1105 	sc->re_ldata.re_tx_free = RE_TX_DESC_CNT(sc);
1106 	sc->re_ldata.re_tx_nextfree = 0;
1107 
1108 	return 0;
1109 }
1110 
1111 static int
1112 re_rx_list_init(struct rtk_softc *sc)
1113 {
1114 	int			i;
1115 
1116 	memset((char *)sc->re_ldata.re_rx_list, 0, RE_RX_LIST_SZ);
1117 
1118 	for (i = 0; i < RE_RX_DESC_CNT; i++) {
1119 		if (re_newbuf(sc, i, NULL) == ENOBUFS)
1120 			return ENOBUFS;
1121 	}
1122 
1123 	sc->re_ldata.re_rx_prodidx = 0;
1124 	sc->re_head = sc->re_tail = NULL;
1125 
1126 	return 0;
1127 }
1128 
1129 /*
1130  * RX handler for C+ and 8169. For the gigE chips, we support
1131  * the reception of jumbo frames that have been fragmented
1132  * across multiple 2K mbuf cluster buffers.
1133  */
1134 static void
1135 re_rxeof(struct rtk_softc *sc)
1136 {
1137 	struct mbuf		*m;
1138 	struct ifnet		*ifp;
1139 	int			i, total_len;
1140 	struct re_desc		*cur_rx;
1141 	struct re_rxsoft	*rxs;
1142 	uint32_t		rxstat, rxvlan;
1143 
1144 	ifp = &sc->ethercom.ec_if;
1145 
1146 	for (i = sc->re_ldata.re_rx_prodidx;; i = RE_NEXT_RX_DESC(sc, i)) {
1147 		cur_rx = &sc->re_ldata.re_rx_list[i];
1148 		RE_RXDESCSYNC(sc, i,
1149 		    BUS_DMASYNC_POSTREAD|BUS_DMASYNC_POSTWRITE);
1150 		rxstat = le32toh(cur_rx->re_cmdstat);
1151 		RE_RXDESCSYNC(sc, i, BUS_DMASYNC_PREREAD);
1152 		if ((rxstat & RE_RDESC_STAT_OWN) != 0) {
1153 			break;
1154 		}
1155 		total_len = rxstat & sc->re_rxlenmask;
1156 		rxvlan = le32toh(cur_rx->re_vlanctl);
1157 		rxs = &sc->re_ldata.re_rxsoft[i];
1158 		m = rxs->rxs_mbuf;
1159 
1160 		/* Invalidate the RX mbuf and unload its map */
1161 
1162 		bus_dmamap_sync(sc->sc_dmat,
1163 		    rxs->rxs_dmamap, 0, rxs->rxs_dmamap->dm_mapsize,
1164 		    BUS_DMASYNC_POSTREAD);
1165 		bus_dmamap_unload(sc->sc_dmat, rxs->rxs_dmamap);
1166 
1167 		if ((rxstat & RE_RDESC_STAT_EOF) == 0) {
1168 			m->m_len = MCLBYTES - RE_ETHER_ALIGN;
1169 			if (sc->re_head == NULL)
1170 				sc->re_head = sc->re_tail = m;
1171 			else {
1172 				m->m_flags &= ~M_PKTHDR;
1173 				sc->re_tail->m_next = m;
1174 				sc->re_tail = m;
1175 			}
1176 			re_newbuf(sc, i, NULL);
1177 			continue;
1178 		}
1179 
1180 		/*
1181 		 * NOTE: for the 8139C+, the frame length field
1182 		 * is always 12 bits in size, but for the gigE chips,
1183 		 * it is 13 bits (since the max RX frame length is 16K).
1184 		 * Unfortunately, all 32 bits in the status word
1185 		 * were already used, so to make room for the extra
1186 		 * length bit, RealTek took out the 'frame alignment
1187 		 * error' bit and shifted the other status bits
1188 		 * over one slot. The OWN, EOR, FS and LS bits are
1189 		 * still in the same places. We have already extracted
1190 		 * the frame length and checked the OWN bit, so rather
1191 		 * than using an alternate bit mapping, we shift the
1192 		 * status bits one space to the right so we can evaluate
1193 		 * them using the 8169 status as though it was in the
1194 		 * same format as that of the 8139C+.
1195 		 */
1196 		if ((sc->sc_quirk & RTKQ_8139CPLUS) == 0)
1197 			rxstat >>= 1;
1198 
1199 		if (__predict_false((rxstat & RE_RDESC_STAT_RXERRSUM) != 0)) {
1200 #ifdef RE_DEBUG
1201 			aprint_error("%s: RX error (rxstat = 0x%08x)",
1202 			    sc->sc_dev.dv_xname, rxstat);
1203 			if (rxstat & RE_RDESC_STAT_FRALIGN)
1204 				aprint_error(", frame alignment error");
1205 			if (rxstat & RE_RDESC_STAT_BUFOFLOW)
1206 				aprint_error(", out of buffer space");
1207 			if (rxstat & RE_RDESC_STAT_FIFOOFLOW)
1208 				aprint_error(", FIFO overrun");
1209 			if (rxstat & RE_RDESC_STAT_GIANT)
1210 				aprint_error(", giant packet");
1211 			if (rxstat & RE_RDESC_STAT_RUNT)
1212 				aprint_error(", runt packet");
1213 			if (rxstat & RE_RDESC_STAT_CRCERR)
1214 				aprint_error(", CRC error");
1215 			aprint_error("\n");
1216 #endif
1217 			ifp->if_ierrors++;
1218 			/*
1219 			 * If this is part of a multi-fragment packet,
1220 			 * discard all the pieces.
1221 			 */
1222 			if (sc->re_head != NULL) {
1223 				m_freem(sc->re_head);
1224 				sc->re_head = sc->re_tail = NULL;
1225 			}
1226 			re_newbuf(sc, i, m);
1227 			continue;
1228 		}
1229 
1230 		/*
1231 		 * If allocating a replacement mbuf fails,
1232 		 * reload the current one.
1233 		 */
1234 
1235 		if (__predict_false(re_newbuf(sc, i, NULL) != 0)) {
1236 			ifp->if_ierrors++;
1237 			if (sc->re_head != NULL) {
1238 				m_freem(sc->re_head);
1239 				sc->re_head = sc->re_tail = NULL;
1240 			}
1241 			re_newbuf(sc, i, m);
1242 			continue;
1243 		}
1244 
1245 		if (sc->re_head != NULL) {
1246 			m->m_len = total_len % (MCLBYTES - RE_ETHER_ALIGN);
1247 			/*
1248 			 * Special case: if there's 4 bytes or less
1249 			 * in this buffer, the mbuf can be discarded:
1250 			 * the last 4 bytes is the CRC, which we don't
1251 			 * care about anyway.
1252 			 */
1253 			if (m->m_len <= ETHER_CRC_LEN) {
1254 				sc->re_tail->m_len -=
1255 				    (ETHER_CRC_LEN - m->m_len);
1256 				m_freem(m);
1257 			} else {
1258 				m->m_len -= ETHER_CRC_LEN;
1259 				m->m_flags &= ~M_PKTHDR;
1260 				sc->re_tail->m_next = m;
1261 			}
1262 			m = sc->re_head;
1263 			sc->re_head = sc->re_tail = NULL;
1264 			m->m_pkthdr.len = total_len - ETHER_CRC_LEN;
1265 		} else
1266 			m->m_pkthdr.len = m->m_len =
1267 			    (total_len - ETHER_CRC_LEN);
1268 
1269 		ifp->if_ipackets++;
1270 		m->m_pkthdr.rcvif = ifp;
1271 
1272 		/* Do RX checksumming */
1273 
1274 		/* Check IP header checksum */
1275 		if (rxstat & RE_RDESC_STAT_PROTOID) {
1276 			m->m_pkthdr.csum_flags |= M_CSUM_IPv4;
1277 			if (rxstat & RE_RDESC_STAT_IPSUMBAD)
1278 				m->m_pkthdr.csum_flags |= M_CSUM_IPv4_BAD;
1279 		}
1280 
1281 		/* Check TCP/UDP checksum */
1282 		if (RE_TCPPKT(rxstat)) {
1283 			m->m_pkthdr.csum_flags |= M_CSUM_TCPv4;
1284 			if (rxstat & RE_RDESC_STAT_TCPSUMBAD)
1285 				m->m_pkthdr.csum_flags |= M_CSUM_TCP_UDP_BAD;
1286 		} else if (RE_UDPPKT(rxstat)) {
1287 			m->m_pkthdr.csum_flags |= M_CSUM_UDPv4;
1288 			if (rxstat & RE_RDESC_STAT_UDPSUMBAD)
1289 				m->m_pkthdr.csum_flags |= M_CSUM_TCP_UDP_BAD;
1290 		}
1291 
1292 		if (rxvlan & RE_RDESC_VLANCTL_TAG) {
1293 			VLAN_INPUT_TAG(ifp, m,
1294 			     bswap16(rxvlan & RE_RDESC_VLANCTL_DATA),
1295 			     continue);
1296 		}
1297 #if NBPFILTER > 0
1298 		if (ifp->if_bpf)
1299 			bpf_mtap(ifp->if_bpf, m);
1300 #endif
1301 		(*ifp->if_input)(ifp, m);
1302 	}
1303 
1304 	sc->re_ldata.re_rx_prodidx = i;
1305 }
1306 
1307 static void
1308 re_txeof(struct rtk_softc *sc)
1309 {
1310 	struct ifnet		*ifp;
1311 	struct re_txq		*txq;
1312 	uint32_t		txstat;
1313 	int			idx, descidx;
1314 
1315 	ifp = &sc->ethercom.ec_if;
1316 
1317 	for (idx = sc->re_ldata.re_txq_considx;
1318 	    sc->re_ldata.re_txq_free < RE_TX_QLEN;
1319 	    idx = RE_NEXT_TXQ(sc, idx), sc->re_ldata.re_txq_free++) {
1320 		txq = &sc->re_ldata.re_txq[idx];
1321 		KASSERT(txq->txq_mbuf != NULL);
1322 
1323 		descidx = txq->txq_descidx;
1324 		RE_TXDESCSYNC(sc, descidx,
1325 		    BUS_DMASYNC_POSTREAD|BUS_DMASYNC_POSTWRITE);
1326 		txstat =
1327 		    le32toh(sc->re_ldata.re_tx_list[descidx].re_cmdstat);
1328 		RE_TXDESCSYNC(sc, descidx, BUS_DMASYNC_PREREAD);
1329 		KASSERT((txstat & RE_TDESC_CMD_EOF) != 0);
1330 		if (txstat & RE_TDESC_CMD_OWN) {
1331 			break;
1332 		}
1333 
1334 		sc->re_ldata.re_tx_free += txq->txq_nsegs;
1335 		KASSERT(sc->re_ldata.re_tx_free <= RE_TX_DESC_CNT(sc));
1336 		bus_dmamap_sync(sc->sc_dmat, txq->txq_dmamap,
1337 		    0, txq->txq_dmamap->dm_mapsize, BUS_DMASYNC_POSTWRITE);
1338 		bus_dmamap_unload(sc->sc_dmat, txq->txq_dmamap);
1339 		m_freem(txq->txq_mbuf);
1340 		txq->txq_mbuf = NULL;
1341 
1342 		if (txstat & (RE_TDESC_STAT_EXCESSCOL | RE_TDESC_STAT_COLCNT))
1343 			ifp->if_collisions++;
1344 		if (txstat & RE_TDESC_STAT_TXERRSUM)
1345 			ifp->if_oerrors++;
1346 		else
1347 			ifp->if_opackets++;
1348 	}
1349 
1350 	sc->re_ldata.re_txq_considx = idx;
1351 
1352 	if (sc->re_ldata.re_txq_free > RE_NTXDESC_RSVD)
1353 		ifp->if_flags &= ~IFF_OACTIVE;
1354 
1355 	/*
1356 	 * If not all descriptors have been released reaped yet,
1357 	 * reload the timer so that we will eventually get another
1358 	 * interrupt that will cause us to re-enter this routine.
1359 	 * This is done in case the transmitter has gone idle.
1360 	 */
1361 	if (sc->re_ldata.re_txq_free < RE_TX_QLEN) {
1362 		CSR_WRITE_4(sc, RTK_TIMERCNT, 1);
1363 		if ((sc->sc_quirk & RTKQ_PCIE) != 0) {
1364 			/*
1365 			 * Some chips will ignore a second TX request
1366 			 * issued while an existing transmission is in
1367 			 * progress. If the transmitter goes idle but
1368 			 * there are still packets waiting to be sent,
1369 			 * we need to restart the channel here to flush
1370 			 * them out. This only seems to be required with
1371 			 * the PCIe devices.
1372 			 */
1373 			CSR_WRITE_2(sc, RTK_GTXSTART, RTK_TXSTART_START);
1374 		}
1375 	} else
1376 		ifp->if_timer = 0;
1377 }
1378 
1379 /*
1380  * Stop all chip I/O so that the kernel's probe routines don't
1381  * get confused by errant DMAs when rebooting.
1382  */
1383 static void
1384 re_shutdown(void *vsc)
1385 
1386 {
1387 	struct rtk_softc	*sc = vsc;
1388 
1389 	re_stop(&sc->ethercom.ec_if, 0);
1390 }
1391 
1392 
1393 static void
1394 re_tick(void *xsc)
1395 {
1396 	struct rtk_softc	*sc = xsc;
1397 	int s;
1398 
1399 	/*XXX: just return for 8169S/8110S with rev 2 or newer phy */
1400 	s = splnet();
1401 
1402 	mii_tick(&sc->mii);
1403 	splx(s);
1404 
1405 	callout_reset(&sc->rtk_tick_ch, hz, re_tick, sc);
1406 }
1407 
1408 #ifdef DEVICE_POLLING
1409 static void
1410 re_poll(struct ifnet *ifp, enum poll_cmd cmd, int count)
1411 {
1412 	struct rtk_softc *sc = ifp->if_softc;
1413 
1414 	RTK_LOCK(sc);
1415 	if ((ifp->if_capenable & IFCAP_POLLING) == 0) {
1416 		ether_poll_deregister(ifp);
1417 		cmd = POLL_DEREGISTER;
1418 	}
1419 	if (cmd == POLL_DEREGISTER) { /* final call, enable interrupts */
1420 		CSR_WRITE_2(sc, RTK_IMR, RTK_INTRS_CPLUS);
1421 		goto done;
1422 	}
1423 
1424 	sc->rxcycles = count;
1425 	re_rxeof(sc);
1426 	re_txeof(sc);
1427 
1428 	if (IFQ_IS_EMPTY(&ifp->if_snd) == 0)
1429 		(*ifp->if_start)(ifp);
1430 
1431 	if (cmd == POLL_AND_CHECK_STATUS) { /* also check status register */
1432 		uint16_t       status;
1433 
1434 		status = CSR_READ_2(sc, RTK_ISR);
1435 		if (status == 0xffff)
1436 			goto done;
1437 		if (status)
1438 			CSR_WRITE_2(sc, RTK_ISR, status);
1439 
1440 		/*
1441 		 * XXX check behaviour on receiver stalls.
1442 		 */
1443 
1444 		if (status & RTK_ISR_SYSTEM_ERR) {
1445 			re_init(sc);
1446 		}
1447 	}
1448  done:
1449 	RTK_UNLOCK(sc);
1450 }
1451 #endif /* DEVICE_POLLING */
1452 
1453 int
1454 re_intr(void *arg)
1455 {
1456 	struct rtk_softc	*sc = arg;
1457 	struct ifnet		*ifp;
1458 	uint16_t		status;
1459 	int			handled = 0;
1460 
1461 	ifp = &sc->ethercom.ec_if;
1462 
1463 	if ((ifp->if_flags & IFF_UP) == 0)
1464 		return 0;
1465 
1466 #ifdef DEVICE_POLLING
1467 	if (ifp->if_flags & IFF_POLLING)
1468 		goto done;
1469 	if ((ifp->if_capenable & IFCAP_POLLING) &&
1470 	    ether_poll_register(re_poll, ifp)) { /* ok, disable interrupts */
1471 		CSR_WRITE_2(sc, RTK_IMR, 0x0000);
1472 		re_poll(ifp, 0, 1);
1473 		goto done;
1474 	}
1475 #endif /* DEVICE_POLLING */
1476 
1477 	for (;;) {
1478 
1479 		status = CSR_READ_2(sc, RTK_ISR);
1480 		/* If the card has gone away the read returns 0xffff. */
1481 		if (status == 0xffff)
1482 			break;
1483 		if (status) {
1484 			handled = 1;
1485 			CSR_WRITE_2(sc, RTK_ISR, status);
1486 		}
1487 
1488 		if ((status & RTK_INTRS_CPLUS) == 0)
1489 			break;
1490 
1491 		if (status & (RTK_ISR_RX_OK | RTK_ISR_RX_ERR))
1492 			re_rxeof(sc);
1493 
1494 		if (status & (RTK_ISR_TIMEOUT_EXPIRED | RTK_ISR_TX_ERR |
1495 		    RTK_ISR_TX_DESC_UNAVAIL))
1496 			re_txeof(sc);
1497 
1498 		if (status & RTK_ISR_SYSTEM_ERR) {
1499 			re_init(ifp);
1500 		}
1501 
1502 		if (status & RTK_ISR_LINKCHG) {
1503 			callout_stop(&sc->rtk_tick_ch);
1504 			re_tick(sc);
1505 		}
1506 	}
1507 
1508 	if (handled && !IFQ_IS_EMPTY(&ifp->if_snd))
1509 		re_start(ifp);
1510 
1511 #ifdef DEVICE_POLLING
1512  done:
1513 #endif
1514 
1515 	return handled;
1516 }
1517 
1518 
1519 
1520 /*
1521  * Main transmit routine for C+ and gigE NICs.
1522  */
1523 
1524 static void
1525 re_start(struct ifnet *ifp)
1526 {
1527 	struct rtk_softc	*sc;
1528 	struct mbuf		*m;
1529 	bus_dmamap_t		map;
1530 	struct re_txq		*txq;
1531 	struct re_desc		*d;
1532 	struct m_tag		*mtag;
1533 	uint32_t		cmdstat, re_flags;
1534 	int			ofree, idx, error, nsegs, seg;
1535 	int			startdesc, curdesc, lastdesc;
1536 	bool			pad;
1537 
1538 	sc = ifp->if_softc;
1539 	ofree = sc->re_ldata.re_txq_free;
1540 
1541 	for (idx = sc->re_ldata.re_txq_prodidx;; idx = RE_NEXT_TXQ(sc, idx)) {
1542 
1543 		IFQ_POLL(&ifp->if_snd, m);
1544 		if (m == NULL)
1545 			break;
1546 
1547 		if (sc->re_ldata.re_txq_free == 0 ||
1548 		    sc->re_ldata.re_tx_free <= RE_NTXDESC_RSVD) {
1549 			/* no more free slots left */
1550 			ifp->if_flags |= IFF_OACTIVE;
1551 			break;
1552 		}
1553 
1554 		/*
1555 		 * Set up checksum offload. Note: checksum offload bits must
1556 		 * appear in all descriptors of a multi-descriptor transmit
1557 		 * attempt. (This is according to testing done with an 8169
1558 		 * chip. I'm not sure if this is a requirement or a bug.)
1559 		 */
1560 
1561 		if ((m->m_pkthdr.csum_flags & M_CSUM_TSOv4) != 0) {
1562 			uint32_t segsz = m->m_pkthdr.segsz;
1563 
1564 			re_flags = RE_TDESC_CMD_LGSEND |
1565 			    (segsz << RE_TDESC_CMD_MSSVAL_SHIFT);
1566 		} else {
1567 			/*
1568 			 * set RE_TDESC_CMD_IPCSUM if any checksum offloading
1569 			 * is requested.  otherwise, RE_TDESC_CMD_TCPCSUM/
1570 			 * RE_TDESC_CMD_UDPCSUM doesn't make effects.
1571 			 */
1572 			re_flags = 0;
1573 			if ((m->m_pkthdr.csum_flags &
1574 			    (M_CSUM_IPv4 | M_CSUM_TCPv4 | M_CSUM_UDPv4))
1575 			    != 0) {
1576 				re_flags |= RE_TDESC_CMD_IPCSUM;
1577 				if (m->m_pkthdr.csum_flags & M_CSUM_TCPv4) {
1578 					re_flags |= RE_TDESC_CMD_TCPCSUM;
1579 				} else if (m->m_pkthdr.csum_flags &
1580 				    M_CSUM_UDPv4) {
1581 					re_flags |= RE_TDESC_CMD_UDPCSUM;
1582 				}
1583 			}
1584 		}
1585 
1586 		txq = &sc->re_ldata.re_txq[idx];
1587 		map = txq->txq_dmamap;
1588 		error = bus_dmamap_load_mbuf(sc->sc_dmat, map, m,
1589 		    BUS_DMA_WRITE|BUS_DMA_NOWAIT);
1590 
1591 		if (__predict_false(error)) {
1592 			/* XXX try to defrag if EFBIG? */
1593 			aprint_error("%s: can't map mbuf (error %d)\n",
1594 			    sc->sc_dev.dv_xname, error);
1595 
1596 			IFQ_DEQUEUE(&ifp->if_snd, m);
1597 			m_freem(m);
1598 			ifp->if_oerrors++;
1599 			continue;
1600 		}
1601 
1602 		nsegs = map->dm_nsegs;
1603 		pad = false;
1604 		if (__predict_false(m->m_pkthdr.len <= RE_IP4CSUMTX_PADLEN &&
1605 		    (re_flags & RE_TDESC_CMD_IPCSUM) != 0)) {
1606 			pad = true;
1607 			nsegs++;
1608 		}
1609 
1610 		if (nsegs > sc->re_ldata.re_tx_free - RE_NTXDESC_RSVD) {
1611 			/*
1612 			 * Not enough free descriptors to transmit this packet.
1613 			 */
1614 			ifp->if_flags |= IFF_OACTIVE;
1615 			bus_dmamap_unload(sc->sc_dmat, map);
1616 			break;
1617 		}
1618 
1619 		IFQ_DEQUEUE(&ifp->if_snd, m);
1620 
1621 		/*
1622 		 * Make sure that the caches are synchronized before we
1623 		 * ask the chip to start DMA for the packet data.
1624 		 */
1625 		bus_dmamap_sync(sc->sc_dmat, map, 0, map->dm_mapsize,
1626 		    BUS_DMASYNC_PREWRITE);
1627 
1628 		/*
1629 		 * Map the segment array into descriptors.
1630 		 * Note that we set the start-of-frame and
1631 		 * end-of-frame markers for either TX or RX,
1632 		 * but they really only have meaning in the TX case.
1633 		 * (In the RX case, it's the chip that tells us
1634 		 *  where packets begin and end.)
1635 		 * We also keep track of the end of the ring
1636 		 * and set the end-of-ring bits as needed,
1637 		 * and we set the ownership bits in all except
1638 		 * the very first descriptor. (The caller will
1639 		 * set this descriptor later when it start
1640 		 * transmission or reception.)
1641 		 */
1642 		curdesc = startdesc = sc->re_ldata.re_tx_nextfree;
1643 		lastdesc = -1;
1644 		for (seg = 0; seg < map->dm_nsegs;
1645 		    seg++, curdesc = RE_NEXT_TX_DESC(sc, curdesc)) {
1646 			d = &sc->re_ldata.re_tx_list[curdesc];
1647 #ifdef DIAGNOSTIC
1648 			RE_TXDESCSYNC(sc, curdesc,
1649 			    BUS_DMASYNC_POSTREAD|BUS_DMASYNC_POSTWRITE);
1650 			cmdstat = le32toh(d->re_cmdstat);
1651 			RE_TXDESCSYNC(sc, curdesc, BUS_DMASYNC_PREREAD);
1652 			if (cmdstat & RE_TDESC_STAT_OWN) {
1653 				panic("%s: tried to map busy TX descriptor",
1654 				    sc->sc_dev.dv_xname);
1655 			}
1656 #endif
1657 
1658 			d->re_vlanctl = 0;
1659 			re_set_bufaddr(d, map->dm_segs[seg].ds_addr);
1660 			cmdstat = re_flags | map->dm_segs[seg].ds_len;
1661 			if (seg == 0)
1662 				cmdstat |= RE_TDESC_CMD_SOF;
1663 			else
1664 				cmdstat |= RE_TDESC_CMD_OWN;
1665 			if (curdesc == (RE_TX_DESC_CNT(sc) - 1))
1666 				cmdstat |= RE_TDESC_CMD_EOR;
1667 			if (seg == nsegs - 1) {
1668 				cmdstat |= RE_TDESC_CMD_EOF;
1669 				lastdesc = curdesc;
1670 			}
1671 			d->re_cmdstat = htole32(cmdstat);
1672 			RE_TXDESCSYNC(sc, curdesc,
1673 			    BUS_DMASYNC_PREREAD|BUS_DMASYNC_PREWRITE);
1674 		}
1675 		if (__predict_false(pad)) {
1676 			bus_addr_t paddaddr;
1677 
1678 			d = &sc->re_ldata.re_tx_list[curdesc];
1679 			d->re_vlanctl = 0;
1680 			paddaddr = RE_TXPADDADDR(sc);
1681 			re_set_bufaddr(d, paddaddr);
1682 			cmdstat = re_flags |
1683 			    RE_TDESC_CMD_OWN | RE_TDESC_CMD_EOF |
1684 			    (RE_IP4CSUMTX_PADLEN + 1 - m->m_pkthdr.len);
1685 			if (curdesc == (RE_TX_DESC_CNT(sc) - 1))
1686 				cmdstat |= RE_TDESC_CMD_EOR;
1687 			d->re_cmdstat = htole32(cmdstat);
1688 			RE_TXDESCSYNC(sc, curdesc,
1689 			    BUS_DMASYNC_PREREAD|BUS_DMASYNC_PREWRITE);
1690 			lastdesc = curdesc;
1691 			curdesc = RE_NEXT_TX_DESC(sc, curdesc);
1692 		}
1693 		KASSERT(lastdesc != -1);
1694 
1695 		/*
1696 		 * Set up hardware VLAN tagging. Note: vlan tag info must
1697 		 * appear in the first descriptor of a multi-descriptor
1698 		 * transmission attempt.
1699 		 */
1700 		if ((mtag = VLAN_OUTPUT_TAG(&sc->ethercom, m)) != NULL) {
1701 			sc->re_ldata.re_tx_list[startdesc].re_vlanctl =
1702 			    htole32(bswap16(VLAN_TAG_VALUE(mtag)) |
1703 			    RE_TDESC_VLANCTL_TAG);
1704 		}
1705 
1706 		/* Transfer ownership of packet to the chip. */
1707 
1708 		sc->re_ldata.re_tx_list[startdesc].re_cmdstat |=
1709 		    htole32(RE_TDESC_CMD_OWN);
1710 		RE_TXDESCSYNC(sc, startdesc,
1711 		    BUS_DMASYNC_PREREAD|BUS_DMASYNC_PREWRITE);
1712 
1713 		/* update info of TX queue and descriptors */
1714 		txq->txq_mbuf = m;
1715 		txq->txq_descidx = lastdesc;
1716 		txq->txq_nsegs = nsegs;
1717 
1718 		sc->re_ldata.re_txq_free--;
1719 		sc->re_ldata.re_tx_free -= nsegs;
1720 		sc->re_ldata.re_tx_nextfree = curdesc;
1721 
1722 #if NBPFILTER > 0
1723 		/*
1724 		 * If there's a BPF listener, bounce a copy of this frame
1725 		 * to him.
1726 		 */
1727 		if (ifp->if_bpf)
1728 			bpf_mtap(ifp->if_bpf, m);
1729 #endif
1730 	}
1731 
1732 	if (sc->re_ldata.re_txq_free < ofree) {
1733 		/*
1734 		 * TX packets are enqueued.
1735 		 */
1736 		sc->re_ldata.re_txq_prodidx = idx;
1737 
1738 		/*
1739 		 * Start the transmitter to poll.
1740 		 *
1741 		 * RealTek put the TX poll request register in a different
1742 		 * location on the 8169 gigE chip. I don't know why.
1743 		 */
1744 		if ((sc->sc_quirk & RTKQ_8139CPLUS) != 0)
1745 			CSR_WRITE_1(sc, RTK_TXSTART, RTK_TXSTART_START);
1746 		else
1747 			CSR_WRITE_2(sc, RTK_GTXSTART, RTK_TXSTART_START);
1748 
1749 		/*
1750 		 * Use the countdown timer for interrupt moderation.
1751 		 * 'TX done' interrupts are disabled. Instead, we reset the
1752 		 * countdown timer, which will begin counting until it hits
1753 		 * the value in the TIMERINT register, and then trigger an
1754 		 * interrupt. Each time we write to the TIMERCNT register,
1755 		 * the timer count is reset to 0.
1756 		 */
1757 		CSR_WRITE_4(sc, RTK_TIMERCNT, 1);
1758 
1759 		/*
1760 		 * Set a timeout in case the chip goes out to lunch.
1761 		 */
1762 		ifp->if_timer = 5;
1763 	}
1764 }
1765 
1766 static int
1767 re_init(struct ifnet *ifp)
1768 {
1769 	struct rtk_softc	*sc = ifp->if_softc;
1770 	const uint8_t		*enaddr;
1771 	uint32_t		rxcfg = 0;
1772 	uint32_t		reg;
1773 	int error;
1774 
1775 	if ((error = re_enable(sc)) != 0)
1776 		goto out;
1777 
1778 	/*
1779 	 * Cancel pending I/O and free all RX/TX buffers.
1780 	 */
1781 	re_stop(ifp, 0);
1782 
1783 	re_reset(sc);
1784 
1785 	/*
1786 	 * Enable C+ RX and TX mode, as well as VLAN stripping and
1787 	 * RX checksum offload. We must configure the C+ register
1788 	 * before all others.
1789 	 */
1790 	reg = 0;
1791 
1792 	/*
1793 	 * XXX: Realtek docs say bits 0 and 1 are reserved, for 8169S/8110S.
1794 	 * FreeBSD  drivers set these bits anyway (for 8139C+?).
1795 	 * So far, it works.
1796 	 */
1797 
1798 	/*
1799 	 * XXX: For old 8169 set bit 14.
1800 	 *      For 8169S/8110S and above, do not set bit 14.
1801 	 */
1802 	if ((sc->sc_quirk & RTKQ_8169NONS) != 0)
1803 		reg |= (0x1 << 14) | RTK_CPLUSCMD_PCI_MRW;;
1804 
1805 	if (1)  {/* not for 8169S ? */
1806 		reg |=
1807 		    RTK_CPLUSCMD_VLANSTRIP |
1808 		    (ifp->if_capenable &
1809 		    (IFCAP_CSUM_IPv4_Rx | IFCAP_CSUM_TCPv4_Rx |
1810 		     IFCAP_CSUM_UDPv4_Rx) ?
1811 		    RTK_CPLUSCMD_RXCSUM_ENB : 0);
1812 	}
1813 
1814 	CSR_WRITE_2(sc, RTK_CPLUS_CMD,
1815 	    reg | RTK_CPLUSCMD_RXENB | RTK_CPLUSCMD_TXENB);
1816 
1817 	/* XXX: from Realtek-supplied Linux driver. Wholly undocumented. */
1818 	if ((sc->sc_quirk & RTKQ_8139CPLUS) == 0)
1819 		CSR_WRITE_2(sc, RTK_IM, 0x0000);
1820 
1821 	DELAY(10000);
1822 
1823 	/*
1824 	 * Init our MAC address.  Even though the chipset
1825 	 * documentation doesn't mention it, we need to enter "Config
1826 	 * register write enable" mode to modify the ID registers.
1827 	 */
1828 	CSR_WRITE_1(sc, RTK_EECMD, RTK_EEMODE_WRITECFG);
1829 	enaddr = CLLADDR(ifp->if_sadl);
1830 	reg = enaddr[0] | (enaddr[1] << 8) |
1831 	    (enaddr[2] << 16) | (enaddr[3] << 24);
1832 	CSR_WRITE_4(sc, RTK_IDR0, reg);
1833 	reg = enaddr[4] | (enaddr[5] << 8);
1834 	CSR_WRITE_4(sc, RTK_IDR4, reg);
1835 	CSR_WRITE_1(sc, RTK_EECMD, RTK_EEMODE_OFF);
1836 
1837 	/*
1838 	 * For C+ mode, initialize the RX descriptors and mbufs.
1839 	 */
1840 	re_rx_list_init(sc);
1841 	re_tx_list_init(sc);
1842 
1843 	/*
1844 	 * Load the addresses of the RX and TX lists into the chip.
1845 	 */
1846 	CSR_WRITE_4(sc, RTK_RXLIST_ADDR_HI,
1847 	    RE_ADDR_HI(sc->re_ldata.re_rx_list_map->dm_segs[0].ds_addr));
1848 	CSR_WRITE_4(sc, RTK_RXLIST_ADDR_LO,
1849 	    RE_ADDR_LO(sc->re_ldata.re_rx_list_map->dm_segs[0].ds_addr));
1850 
1851 	CSR_WRITE_4(sc, RTK_TXLIST_ADDR_HI,
1852 	    RE_ADDR_HI(sc->re_ldata.re_tx_list_map->dm_segs[0].ds_addr));
1853 	CSR_WRITE_4(sc, RTK_TXLIST_ADDR_LO,
1854 	    RE_ADDR_LO(sc->re_ldata.re_tx_list_map->dm_segs[0].ds_addr));
1855 
1856 	/*
1857 	 * Enable transmit and receive.
1858 	 */
1859 	CSR_WRITE_1(sc, RTK_COMMAND, RTK_CMD_TX_ENB | RTK_CMD_RX_ENB);
1860 
1861 	/*
1862 	 * Set the initial TX and RX configuration.
1863 	 */
1864 	if (sc->re_testmode && (sc->sc_quirk & RTKQ_8169NONS) != 0) {
1865 		/* test mode is needed only for old 8169 */
1866 		CSR_WRITE_4(sc, RTK_TXCFG,
1867 		    RE_TXCFG_CONFIG | RTK_LOOPTEST_ON);
1868 	} else
1869 		CSR_WRITE_4(sc, RTK_TXCFG, RE_TXCFG_CONFIG);
1870 
1871 	CSR_WRITE_1(sc, RTK_EARLY_TX_THRESH, 16);
1872 
1873 	CSR_WRITE_4(sc, RTK_RXCFG, RE_RXCFG_CONFIG);
1874 
1875 	/* Set the individual bit to receive frames for this host only. */
1876 	rxcfg = CSR_READ_4(sc, RTK_RXCFG);
1877 	rxcfg |= RTK_RXCFG_RX_INDIV;
1878 
1879 	/* If we want promiscuous mode, set the allframes bit. */
1880 	if (ifp->if_flags & IFF_PROMISC)
1881 		rxcfg |= RTK_RXCFG_RX_ALLPHYS;
1882 	else
1883 		rxcfg &= ~RTK_RXCFG_RX_ALLPHYS;
1884 	CSR_WRITE_4(sc, RTK_RXCFG, rxcfg);
1885 
1886 	/*
1887 	 * Set capture broadcast bit to capture broadcast frames.
1888 	 */
1889 	if (ifp->if_flags & IFF_BROADCAST)
1890 		rxcfg |= RTK_RXCFG_RX_BROAD;
1891 	else
1892 		rxcfg &= ~RTK_RXCFG_RX_BROAD;
1893 	CSR_WRITE_4(sc, RTK_RXCFG, rxcfg);
1894 
1895 	/*
1896 	 * Program the multicast filter, if necessary.
1897 	 */
1898 	rtk_setmulti(sc);
1899 
1900 #ifdef DEVICE_POLLING
1901 	/*
1902 	 * Disable interrupts if we are polling.
1903 	 */
1904 	if (ifp->if_flags & IFF_POLLING)
1905 		CSR_WRITE_2(sc, RTK_IMR, 0);
1906 	else	/* otherwise ... */
1907 #endif /* DEVICE_POLLING */
1908 	/*
1909 	 * Enable interrupts.
1910 	 */
1911 	if (sc->re_testmode)
1912 		CSR_WRITE_2(sc, RTK_IMR, 0);
1913 	else
1914 		CSR_WRITE_2(sc, RTK_IMR, RTK_INTRS_CPLUS);
1915 
1916 	/* Start RX/TX process. */
1917 	CSR_WRITE_4(sc, RTK_MISSEDPKT, 0);
1918 #ifdef notdef
1919 	/* Enable receiver and transmitter. */
1920 	CSR_WRITE_1(sc, RTK_COMMAND, RTK_CMD_TX_ENB | RTK_CMD_RX_ENB);
1921 #endif
1922 
1923 	/*
1924 	 * Initialize the timer interrupt register so that
1925 	 * a timer interrupt will be generated once the timer
1926 	 * reaches a certain number of ticks. The timer is
1927 	 * reloaded on each transmit. This gives us TX interrupt
1928 	 * moderation, which dramatically improves TX frame rate.
1929 	 */
1930 
1931 	if ((sc->sc_quirk & RTKQ_8139CPLUS) != 0)
1932 		CSR_WRITE_4(sc, RTK_TIMERINT, 0x400);
1933 	else {
1934 		CSR_WRITE_4(sc, RTK_TIMERINT_8169, 0x800);
1935 
1936 		/*
1937 		 * For 8169 gigE NICs, set the max allowed RX packet
1938 		 * size so we can receive jumbo frames.
1939 		 */
1940 		CSR_WRITE_2(sc, RTK_MAXRXPKTLEN, 16383);
1941 	}
1942 
1943 	if (sc->re_testmode)
1944 		return 0;
1945 
1946 	CSR_WRITE_1(sc, RTK_CFG1, RTK_CFG1_DRVLOAD);
1947 
1948 	ifp->if_flags |= IFF_RUNNING;
1949 	ifp->if_flags &= ~IFF_OACTIVE;
1950 
1951 	callout_reset(&sc->rtk_tick_ch, hz, re_tick, sc);
1952 
1953  out:
1954 	if (error) {
1955 		ifp->if_flags &= ~(IFF_RUNNING | IFF_OACTIVE);
1956 		ifp->if_timer = 0;
1957 		aprint_error("%s: interface not running\n",
1958 		    sc->sc_dev.dv_xname);
1959 	}
1960 
1961 	return error;
1962 }
1963 
1964 /*
1965  * Set media options.
1966  */
1967 static int
1968 re_ifmedia_upd(struct ifnet *ifp)
1969 {
1970 	struct rtk_softc	*sc;
1971 
1972 	sc = ifp->if_softc;
1973 
1974 	return mii_mediachg(&sc->mii);
1975 }
1976 
1977 /*
1978  * Report current media status.
1979  */
1980 static void
1981 re_ifmedia_sts(struct ifnet *ifp, struct ifmediareq *ifmr)
1982 {
1983 	struct rtk_softc	*sc;
1984 
1985 	sc = ifp->if_softc;
1986 
1987 	mii_pollstat(&sc->mii);
1988 	ifmr->ifm_active = sc->mii.mii_media_active;
1989 	ifmr->ifm_status = sc->mii.mii_media_status;
1990 }
1991 
1992 static int
1993 re_ioctl(struct ifnet *ifp, u_long command, void *data)
1994 {
1995 	struct rtk_softc	*sc = ifp->if_softc;
1996 	struct ifreq		*ifr = (struct ifreq *) data;
1997 	int			s, error = 0;
1998 
1999 	s = splnet();
2000 
2001 	switch (command) {
2002 	case SIOCSIFMTU:
2003 		if (ifr->ifr_mtu > RE_JUMBO_MTU)
2004 			error = EINVAL;
2005 		ifp->if_mtu = ifr->ifr_mtu;
2006 		break;
2007 	case SIOCGIFMEDIA:
2008 	case SIOCSIFMEDIA:
2009 		error = ifmedia_ioctl(ifp, ifr, &sc->mii.mii_media, command);
2010 		break;
2011 	default:
2012 		error = ether_ioctl(ifp, command, data);
2013 		if (error == ENETRESET) {
2014 			if (ifp->if_flags & IFF_RUNNING)
2015 				rtk_setmulti(sc);
2016 			error = 0;
2017 		}
2018 		break;
2019 	}
2020 
2021 	splx(s);
2022 
2023 	return error;
2024 }
2025 
2026 static void
2027 re_watchdog(struct ifnet *ifp)
2028 {
2029 	struct rtk_softc	*sc;
2030 	int			s;
2031 
2032 	sc = ifp->if_softc;
2033 	s = splnet();
2034 	aprint_error("%s: watchdog timeout\n", sc->sc_dev.dv_xname);
2035 	ifp->if_oerrors++;
2036 
2037 	re_txeof(sc);
2038 	re_rxeof(sc);
2039 
2040 	re_init(ifp);
2041 
2042 	splx(s);
2043 }
2044 
2045 /*
2046  * Stop the adapter and free any mbufs allocated to the
2047  * RX and TX lists.
2048  */
2049 static void
2050 re_stop(struct ifnet *ifp, int disable)
2051 {
2052 	int		i;
2053 	struct rtk_softc *sc = ifp->if_softc;
2054 
2055 	callout_stop(&sc->rtk_tick_ch);
2056 
2057 #ifdef DEVICE_POLLING
2058 	ether_poll_deregister(ifp);
2059 #endif /* DEVICE_POLLING */
2060 
2061 	mii_down(&sc->mii);
2062 
2063 	CSR_WRITE_1(sc, RTK_COMMAND, 0x00);
2064 	CSR_WRITE_2(sc, RTK_IMR, 0x0000);
2065 
2066 	if (sc->re_head != NULL) {
2067 		m_freem(sc->re_head);
2068 		sc->re_head = sc->re_tail = NULL;
2069 	}
2070 
2071 	/* Free the TX list buffers. */
2072 	for (i = 0; i < RE_TX_QLEN; i++) {
2073 		if (sc->re_ldata.re_txq[i].txq_mbuf != NULL) {
2074 			bus_dmamap_unload(sc->sc_dmat,
2075 			    sc->re_ldata.re_txq[i].txq_dmamap);
2076 			m_freem(sc->re_ldata.re_txq[i].txq_mbuf);
2077 			sc->re_ldata.re_txq[i].txq_mbuf = NULL;
2078 		}
2079 	}
2080 
2081 	/* Free the RX list buffers. */
2082 	for (i = 0; i < RE_RX_DESC_CNT; i++) {
2083 		if (sc->re_ldata.re_rxsoft[i].rxs_mbuf != NULL) {
2084 			bus_dmamap_unload(sc->sc_dmat,
2085 			    sc->re_ldata.re_rxsoft[i].rxs_dmamap);
2086 			m_freem(sc->re_ldata.re_rxsoft[i].rxs_mbuf);
2087 			sc->re_ldata.re_rxsoft[i].rxs_mbuf = NULL;
2088 		}
2089 	}
2090 
2091 	if (disable)
2092 		re_disable(sc);
2093 
2094 	ifp->if_flags &= ~(IFF_RUNNING | IFF_OACTIVE);
2095 	ifp->if_timer = 0;
2096 }
2097