xref: /netbsd-src/sys/dev/ic/rtl8169.c (revision b1c86f5f087524e68db12794ee9c3e3da1ab17a0)
1 /*	$NetBSD: rtl8169.c,v 1.133 2010/07/28 23:30:21 msaitoh Exp $	*/
2 
3 /*
4  * Copyright (c) 1997, 1998-2003
5  *	Bill Paul <wpaul@windriver.com>.  All rights reserved.
6  *
7  * Redistribution and use in source and binary forms, with or without
8  * modification, are permitted provided that the following conditions
9  * are met:
10  * 1. Redistributions of source code must retain the above copyright
11  *    notice, this list of conditions and the following disclaimer.
12  * 2. Redistributions in binary form must reproduce the above copyright
13  *    notice, this list of conditions and the following disclaimer in the
14  *    documentation and/or other materials provided with the distribution.
15  * 3. All advertising materials mentioning features or use of this software
16  *    must display the following acknowledgement:
17  *	This product includes software developed by Bill Paul.
18  * 4. Neither the name of the author nor the names of any co-contributors
19  *    may be used to endorse or promote products derived from this software
20  *    without specific prior written permission.
21  *
22  * THIS SOFTWARE IS PROVIDED BY Bill Paul AND CONTRIBUTORS ``AS IS'' AND
23  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
24  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
25  * ARE DISCLAIMED.  IN NO EVENT SHALL Bill Paul OR THE VOICES IN HIS HEAD
26  * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
27  * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
28  * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
29  * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
30  * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
31  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
32  * THE POSSIBILITY OF SUCH DAMAGE.
33  */
34 
35 #include <sys/cdefs.h>
36 __KERNEL_RCSID(0, "$NetBSD: rtl8169.c,v 1.133 2010/07/28 23:30:21 msaitoh Exp $");
37 /* $FreeBSD: /repoman/r/ncvs/src/sys/dev/re/if_re.c,v 1.20 2004/04/11 20:34:08 ru Exp $ */
38 
39 /*
40  * RealTek 8139C+/8169/8169S/8110S PCI NIC driver
41  *
42  * Written by Bill Paul <wpaul@windriver.com>
43  * Senior Networking Software Engineer
44  * Wind River Systems
45  */
46 
47 /*
48  * This driver is designed to support RealTek's next generation of
49  * 10/100 and 10/100/1000 PCI ethernet controllers. There are currently
50  * four devices in this family: the RTL8139C+, the RTL8169, the RTL8169S
51  * and the RTL8110S.
52  *
53  * The 8139C+ is a 10/100 ethernet chip. It is backwards compatible
54  * with the older 8139 family, however it also supports a special
55  * C+ mode of operation that provides several new performance enhancing
56  * features. These include:
57  *
58  *	o Descriptor based DMA mechanism. Each descriptor represents
59  *	  a single packet fragment. Data buffers may be aligned on
60  *	  any byte boundary.
61  *
62  *	o 64-bit DMA
63  *
64  *	o TCP/IP checksum offload for both RX and TX
65  *
66  *	o High and normal priority transmit DMA rings
67  *
68  *	o VLAN tag insertion and extraction
69  *
70  *	o TCP large send (segmentation offload)
71  *
72  * Like the 8139, the 8139C+ also has a built-in 10/100 PHY. The C+
73  * programming API is fairly straightforward. The RX filtering, EEPROM
74  * access and PHY access is the same as it is on the older 8139 series
75  * chips.
76  *
77  * The 8169 is a 64-bit 10/100/1000 gigabit ethernet MAC. It has almost the
78  * same programming API and feature set as the 8139C+ with the following
79  * differences and additions:
80  *
81  *	o 1000Mbps mode
82  *
83  *	o Jumbo frames
84  *
85  *	o GMII and TBI ports/registers for interfacing with copper
86  *	  or fiber PHYs
87  *
88  *      o RX and TX DMA rings can have up to 1024 descriptors
89  *        (the 8139C+ allows a maximum of 64)
90  *
91  *	o Slight differences in register layout from the 8139C+
92  *
93  * The TX start and timer interrupt registers are at different locations
94  * on the 8169 than they are on the 8139C+. Also, the status word in the
95  * RX descriptor has a slightly different bit layout. The 8169 does not
96  * have a built-in PHY. Most reference boards use a Marvell 88E1000 'Alaska'
97  * copper gigE PHY.
98  *
99  * The 8169S/8110S 10/100/1000 devices have built-in copper gigE PHYs
100  * (the 'S' stands for 'single-chip'). These devices have the same
101  * programming API as the older 8169, but also have some vendor-specific
102  * registers for the on-board PHY. The 8110S is a LAN-on-motherboard
103  * part designed to be pin-compatible with the RealTek 8100 10/100 chip.
104  *
105  * This driver takes advantage of the RX and TX checksum offload and
106  * VLAN tag insertion/extraction features. It also implements TX
107  * interrupt moderation using the timer interrupt registers, which
108  * significantly reduces TX interrupt load. There is also support
109  * for jumbo frames, however the 8169/8169S/8110S can not transmit
110  * jumbo frames larger than 7.5K, so the max MTU possible with this
111  * driver is 7500 bytes.
112  */
113 
114 
115 #include <sys/param.h>
116 #include <sys/endian.h>
117 #include <sys/systm.h>
118 #include <sys/sockio.h>
119 #include <sys/mbuf.h>
120 #include <sys/malloc.h>
121 #include <sys/kernel.h>
122 #include <sys/socket.h>
123 #include <sys/device.h>
124 
125 #include <net/if.h>
126 #include <net/if_arp.h>
127 #include <net/if_dl.h>
128 #include <net/if_ether.h>
129 #include <net/if_media.h>
130 #include <net/if_vlanvar.h>
131 
132 #include <netinet/in_systm.h>	/* XXX for IP_MAXPACKET */
133 #include <netinet/in.h>		/* XXX for IP_MAXPACKET */
134 #include <netinet/ip.h>		/* XXX for IP_MAXPACKET */
135 
136 #include <net/bpf.h>
137 
138 #include <sys/bus.h>
139 
140 #include <dev/mii/mii.h>
141 #include <dev/mii/miivar.h>
142 
143 #include <dev/ic/rtl81x9reg.h>
144 #include <dev/ic/rtl81x9var.h>
145 
146 #include <dev/ic/rtl8169var.h>
147 
148 static inline void re_set_bufaddr(struct re_desc *, bus_addr_t);
149 
150 static int re_newbuf(struct rtk_softc *, int, struct mbuf *);
151 static int re_rx_list_init(struct rtk_softc *);
152 static int re_tx_list_init(struct rtk_softc *);
153 static void re_rxeof(struct rtk_softc *);
154 static void re_txeof(struct rtk_softc *);
155 static void re_tick(void *);
156 static void re_start(struct ifnet *);
157 static int re_ioctl(struct ifnet *, u_long, void *);
158 static int re_init(struct ifnet *);
159 static void re_stop(struct ifnet *, int);
160 static void re_watchdog(struct ifnet *);
161 
162 static int re_enable(struct rtk_softc *);
163 static void re_disable(struct rtk_softc *);
164 
165 static int re_gmii_readreg(device_t, int, int);
166 static void re_gmii_writereg(device_t, int, int, int);
167 
168 static int re_miibus_readreg(device_t, int, int);
169 static void re_miibus_writereg(device_t, int, int, int);
170 static void re_miibus_statchg(device_t);
171 
172 static void re_reset(struct rtk_softc *);
173 
174 static inline void
175 re_set_bufaddr(struct re_desc *d, bus_addr_t addr)
176 {
177 
178 	d->re_bufaddr_lo = htole32((uint32_t)addr);
179 	if (sizeof(bus_addr_t) == sizeof(uint64_t))
180 		d->re_bufaddr_hi = htole32((uint64_t)addr >> 32);
181 	else
182 		d->re_bufaddr_hi = 0;
183 }
184 
185 static int
186 re_gmii_readreg(device_t dev, int phy, int reg)
187 {
188 	struct rtk_softc *sc = device_private(dev);
189 	uint32_t rval;
190 	int i;
191 
192 	if (phy != 7)
193 		return 0;
194 
195 	/* Let the rgephy driver read the GMEDIASTAT register */
196 
197 	if (reg == RTK_GMEDIASTAT) {
198 		rval = CSR_READ_1(sc, RTK_GMEDIASTAT);
199 		return rval;
200 	}
201 
202 	CSR_WRITE_4(sc, RTK_PHYAR, reg << 16);
203 	DELAY(1000);
204 
205 	for (i = 0; i < RTK_TIMEOUT; i++) {
206 		rval = CSR_READ_4(sc, RTK_PHYAR);
207 		if (rval & RTK_PHYAR_BUSY)
208 			break;
209 		DELAY(100);
210 	}
211 
212 	if (i == RTK_TIMEOUT) {
213 		printf("%s: PHY read failed\n", device_xname(sc->sc_dev));
214 		return 0;
215 	}
216 
217 	return rval & RTK_PHYAR_PHYDATA;
218 }
219 
220 static void
221 re_gmii_writereg(device_t dev, int phy, int reg, int data)
222 {
223 	struct rtk_softc *sc = device_private(dev);
224 	uint32_t rval;
225 	int i;
226 
227 	CSR_WRITE_4(sc, RTK_PHYAR, (reg << 16) |
228 	    (data & RTK_PHYAR_PHYDATA) | RTK_PHYAR_BUSY);
229 	DELAY(1000);
230 
231 	for (i = 0; i < RTK_TIMEOUT; i++) {
232 		rval = CSR_READ_4(sc, RTK_PHYAR);
233 		if (!(rval & RTK_PHYAR_BUSY))
234 			break;
235 		DELAY(100);
236 	}
237 
238 	if (i == RTK_TIMEOUT) {
239 		printf("%s: PHY write reg %x <- %x failed\n",
240 		    device_xname(sc->sc_dev), reg, data);
241 	}
242 }
243 
244 static int
245 re_miibus_readreg(device_t dev, int phy, int reg)
246 {
247 	struct rtk_softc *sc = device_private(dev);
248 	uint16_t rval = 0;
249 	uint16_t re8139_reg = 0;
250 	int s;
251 
252 	s = splnet();
253 
254 	if ((sc->sc_quirk & RTKQ_8139CPLUS) == 0) {
255 		rval = re_gmii_readreg(dev, phy, reg);
256 		splx(s);
257 		return rval;
258 	}
259 
260 	/* Pretend the internal PHY is only at address 0 */
261 	if (phy) {
262 		splx(s);
263 		return 0;
264 	}
265 	switch (reg) {
266 	case MII_BMCR:
267 		re8139_reg = RTK_BMCR;
268 		break;
269 	case MII_BMSR:
270 		re8139_reg = RTK_BMSR;
271 		break;
272 	case MII_ANAR:
273 		re8139_reg = RTK_ANAR;
274 		break;
275 	case MII_ANER:
276 		re8139_reg = RTK_ANER;
277 		break;
278 	case MII_ANLPAR:
279 		re8139_reg = RTK_LPAR;
280 		break;
281 	case MII_PHYIDR1:
282 	case MII_PHYIDR2:
283 		splx(s);
284 		return 0;
285 	/*
286 	 * Allow the rlphy driver to read the media status
287 	 * register. If we have a link partner which does not
288 	 * support NWAY, this is the register which will tell
289 	 * us the results of parallel detection.
290 	 */
291 	case RTK_MEDIASTAT:
292 		rval = CSR_READ_1(sc, RTK_MEDIASTAT);
293 		splx(s);
294 		return rval;
295 	default:
296 		printf("%s: bad phy register\n", device_xname(sc->sc_dev));
297 		splx(s);
298 		return 0;
299 	}
300 	rval = CSR_READ_2(sc, re8139_reg);
301 	if ((sc->sc_quirk & RTKQ_8139CPLUS) != 0 && re8139_reg == RTK_BMCR) {
302 		/* 8139C+ has different bit layout. */
303 		rval &= ~(BMCR_LOOP | BMCR_ISO);
304 	}
305 	splx(s);
306 	return rval;
307 }
308 
309 static void
310 re_miibus_writereg(device_t dev, int phy, int reg, int data)
311 {
312 	struct rtk_softc *sc = device_private(dev);
313 	uint16_t re8139_reg = 0;
314 	int s;
315 
316 	s = splnet();
317 
318 	if ((sc->sc_quirk & RTKQ_8139CPLUS) == 0) {
319 		re_gmii_writereg(dev, phy, reg, data);
320 		splx(s);
321 		return;
322 	}
323 
324 	/* Pretend the internal PHY is only at address 0 */
325 	if (phy) {
326 		splx(s);
327 		return;
328 	}
329 	switch (reg) {
330 	case MII_BMCR:
331 		re8139_reg = RTK_BMCR;
332 		if ((sc->sc_quirk & RTKQ_8139CPLUS) != 0) {
333 			/* 8139C+ has different bit layout. */
334 			data &= ~(BMCR_LOOP | BMCR_ISO);
335 		}
336 		break;
337 	case MII_BMSR:
338 		re8139_reg = RTK_BMSR;
339 		break;
340 	case MII_ANAR:
341 		re8139_reg = RTK_ANAR;
342 		break;
343 	case MII_ANER:
344 		re8139_reg = RTK_ANER;
345 		break;
346 	case MII_ANLPAR:
347 		re8139_reg = RTK_LPAR;
348 		break;
349 	case MII_PHYIDR1:
350 	case MII_PHYIDR2:
351 		splx(s);
352 		return;
353 		break;
354 	default:
355 		printf("%s: bad phy register\n", device_xname(sc->sc_dev));
356 		splx(s);
357 		return;
358 	}
359 	CSR_WRITE_2(sc, re8139_reg, data);
360 	splx(s);
361 	return;
362 }
363 
364 static void
365 re_miibus_statchg(device_t dev)
366 {
367 
368 	return;
369 }
370 
371 static void
372 re_reset(struct rtk_softc *sc)
373 {
374 	int i;
375 
376 	CSR_WRITE_1(sc, RTK_COMMAND, RTK_CMD_RESET);
377 
378 	for (i = 0; i < RTK_TIMEOUT; i++) {
379 		DELAY(10);
380 		if ((CSR_READ_1(sc, RTK_COMMAND) & RTK_CMD_RESET) == 0)
381 			break;
382 	}
383 	if (i == RTK_TIMEOUT)
384 		printf("%s: reset never completed!\n",
385 		    device_xname(sc->sc_dev));
386 
387 	/*
388 	 * NB: Realtek-supplied FreeBSD driver does this only for MACFG_3,
389 	 *     but also says "Rtl8169s sigle chip detected".
390 	 */
391 	if ((sc->sc_quirk & RTKQ_MACLDPS) != 0)
392 		CSR_WRITE_1(sc, RTK_LDPS, 1);
393 
394 }
395 
396 /*
397  * The following routine is designed to test for a defect on some
398  * 32-bit 8169 cards. Some of these NICs have the REQ64# and ACK64#
399  * lines connected to the bus, however for a 32-bit only card, they
400  * should be pulled high. The result of this defect is that the
401  * NIC will not work right if you plug it into a 64-bit slot: DMA
402  * operations will be done with 64-bit transfers, which will fail
403  * because the 64-bit data lines aren't connected.
404  *
405  * There's no way to work around this (short of talking a soldering
406  * iron to the board), however we can detect it. The method we use
407  * here is to put the NIC into digital loopback mode, set the receiver
408  * to promiscuous mode, and then try to send a frame. We then compare
409  * the frame data we sent to what was received. If the data matches,
410  * then the NIC is working correctly, otherwise we know the user has
411  * a defective NIC which has been mistakenly plugged into a 64-bit PCI
412  * slot. In the latter case, there's no way the NIC can work correctly,
413  * so we print out a message on the console and abort the device attach.
414  */
415 
416 int
417 re_diag(struct rtk_softc *sc)
418 {
419 	struct ifnet *ifp = &sc->ethercom.ec_if;
420 	struct mbuf *m0;
421 	struct ether_header *eh;
422 	struct re_rxsoft *rxs;
423 	struct re_desc *cur_rx;
424 	bus_dmamap_t dmamap;
425 	uint16_t status;
426 	uint32_t rxstat;
427 	int total_len, i, s, error = 0;
428 	static const uint8_t dst[] = { 0x00, 'h', 'e', 'l', 'l', 'o' };
429 	static const uint8_t src[] = { 0x00, 'w', 'o', 'r', 'l', 'd' };
430 
431 	/* Allocate a single mbuf */
432 
433 	MGETHDR(m0, M_DONTWAIT, MT_DATA);
434 	if (m0 == NULL)
435 		return ENOBUFS;
436 
437 	/*
438 	 * Initialize the NIC in test mode. This sets the chip up
439 	 * so that it can send and receive frames, but performs the
440 	 * following special functions:
441 	 * - Puts receiver in promiscuous mode
442 	 * - Enables digital loopback mode
443 	 * - Leaves interrupts turned off
444 	 */
445 
446 	ifp->if_flags |= IFF_PROMISC;
447 	sc->re_testmode = 1;
448 	re_init(ifp);
449 	re_stop(ifp, 0);
450 	DELAY(100000);
451 	re_init(ifp);
452 
453 	/* Put some data in the mbuf */
454 
455 	eh = mtod(m0, struct ether_header *);
456 	memcpy(eh->ether_dhost, (char *)&dst, ETHER_ADDR_LEN);
457 	memcpy(eh->ether_shost, (char *)&src, ETHER_ADDR_LEN);
458 	eh->ether_type = htons(ETHERTYPE_IP);
459 	m0->m_pkthdr.len = m0->m_len = ETHER_MIN_LEN - ETHER_CRC_LEN;
460 
461 	/*
462 	 * Queue the packet, start transmission.
463 	 */
464 
465 	CSR_WRITE_2(sc, RTK_ISR, 0xFFFF);
466 	s = splnet();
467 	IF_ENQUEUE(&ifp->if_snd, m0);
468 	re_start(ifp);
469 	splx(s);
470 	m0 = NULL;
471 
472 	/* Wait for it to propagate through the chip */
473 
474 	DELAY(100000);
475 	for (i = 0; i < RTK_TIMEOUT; i++) {
476 		status = CSR_READ_2(sc, RTK_ISR);
477 		if ((status & (RTK_ISR_TIMEOUT_EXPIRED | RTK_ISR_RX_OK)) ==
478 		    (RTK_ISR_TIMEOUT_EXPIRED | RTK_ISR_RX_OK))
479 			break;
480 		DELAY(10);
481 	}
482 	if (i == RTK_TIMEOUT) {
483 		aprint_error_dev(sc->sc_dev,
484 		    "diagnostic failed, failed to receive packet "
485 		    "in loopback mode\n");
486 		error = EIO;
487 		goto done;
488 	}
489 
490 	/*
491 	 * The packet should have been dumped into the first
492 	 * entry in the RX DMA ring. Grab it from there.
493 	 */
494 
495 	rxs = &sc->re_ldata.re_rxsoft[0];
496 	dmamap = rxs->rxs_dmamap;
497 	bus_dmamap_sync(sc->sc_dmat, dmamap, 0, dmamap->dm_mapsize,
498 	    BUS_DMASYNC_POSTREAD);
499 	bus_dmamap_unload(sc->sc_dmat, dmamap);
500 
501 	m0 = rxs->rxs_mbuf;
502 	rxs->rxs_mbuf = NULL;
503 	eh = mtod(m0, struct ether_header *);
504 
505 	RE_RXDESCSYNC(sc, 0, BUS_DMASYNC_POSTREAD|BUS_DMASYNC_POSTWRITE);
506 	cur_rx = &sc->re_ldata.re_rx_list[0];
507 	rxstat = le32toh(cur_rx->re_cmdstat);
508 	total_len = rxstat & sc->re_rxlenmask;
509 
510 	if (total_len != ETHER_MIN_LEN) {
511 		aprint_error_dev(sc->sc_dev,
512 		    "diagnostic failed, received short packet\n");
513 		error = EIO;
514 		goto done;
515 	}
516 
517 	/* Test that the received packet data matches what we sent. */
518 
519 	if (memcmp((char *)&eh->ether_dhost, (char *)&dst, ETHER_ADDR_LEN) ||
520 	    memcmp((char *)&eh->ether_shost, (char *)&src, ETHER_ADDR_LEN) ||
521 	    ntohs(eh->ether_type) != ETHERTYPE_IP) {
522 		aprint_error_dev(sc->sc_dev, "WARNING, DMA FAILURE!\n"
523 		    "expected TX data: %s/%s/0x%x\n"
524 		    "received RX data: %s/%s/0x%x\n"
525 		    "You may have a defective 32-bit NIC plugged "
526 		    "into a 64-bit PCI slot.\n"
527 		    "Please re-install the NIC in a 32-bit slot "
528 		    "for proper operation.\n"
529 		    "Read the re(4) man page for more details.\n" ,
530 		    ether_sprintf(dst),  ether_sprintf(src), ETHERTYPE_IP,
531 		    ether_sprintf(eh->ether_dhost),
532 		    ether_sprintf(eh->ether_shost), ntohs(eh->ether_type));
533 		error = EIO;
534 	}
535 
536  done:
537 	/* Turn interface off, release resources */
538 
539 	sc->re_testmode = 0;
540 	ifp->if_flags &= ~IFF_PROMISC;
541 	re_stop(ifp, 0);
542 	if (m0 != NULL)
543 		m_freem(m0);
544 
545 	return error;
546 }
547 
548 
549 /*
550  * Attach the interface. Allocate softc structures, do ifmedia
551  * setup and ethernet/BPF attach.
552  */
553 void
554 re_attach(struct rtk_softc *sc)
555 {
556 	uint8_t eaddr[ETHER_ADDR_LEN];
557 	uint16_t val;
558 	struct ifnet *ifp;
559 	int error = 0, i, addr_len;
560 
561 	if ((sc->sc_quirk & RTKQ_8139CPLUS) == 0) {
562 		uint32_t hwrev;
563 
564 		/* Revision of 8169/8169S/8110s in bits 30..26, 23 */
565 		hwrev = CSR_READ_4(sc, RTK_TXCFG) & RTK_TXCFG_HWREV;
566 		switch (hwrev) {
567 		case RTK_HWREV_8169:
568 			sc->sc_quirk |= RTKQ_8169NONS;
569 			break;
570 		case RTK_HWREV_8169S:
571 		case RTK_HWREV_8110S:
572 		case RTK_HWREV_8169_8110SB:
573 		case RTK_HWREV_8169_8110SBL:
574 		case RTK_HWREV_8169_8110SC:
575 			sc->sc_quirk |= RTKQ_MACLDPS;
576 			break;
577 		case RTK_HWREV_8168_SPIN1:
578 		case RTK_HWREV_8168_SPIN2:
579 		case RTK_HWREV_8168_SPIN3:
580 			sc->sc_quirk |= RTKQ_MACSTAT;
581 			break;
582 		case RTK_HWREV_8168C:
583 		case RTK_HWREV_8168C_SPIN2:
584 		case RTK_HWREV_8168CP:
585 		case RTK_HWREV_8168D:
586 		case RTK_HWREV_8168DP:
587 			sc->sc_quirk |= RTKQ_DESCV2 | RTKQ_NOEECMD |
588 			    RTKQ_MACSTAT | RTKQ_CMDSTOP;
589 			/*
590 			 * From FreeBSD driver:
591 			 *
592 			 * These (8168/8111) controllers support jumbo frame
593 			 * but it seems that enabling it requires touching
594 			 * additional magic registers. Depending on MAC
595 			 * revisions some controllers need to disable
596 			 * checksum offload. So disable jumbo frame until
597 			 * I have better idea what it really requires to
598 			 * make it support.
599 			 * RTL8168C/CP : supports up to 6KB jumbo frame.
600 			 * RTL8111C/CP : supports up to 9KB jumbo frame.
601 			 */
602 			sc->sc_quirk |= RTKQ_NOJUMBO;
603 			break;
604 		case RTK_HWREV_8100E:
605 		case RTK_HWREV_8100E_SPIN2:
606 		case RTK_HWREV_8101E:
607 			sc->sc_quirk |= RTKQ_NOJUMBO;
608 			break;
609 		case RTK_HWREV_8102E:
610 		case RTK_HWREV_8102EL:
611 		case RTK_HWREV_8103E:
612 			sc->sc_quirk |= RTKQ_DESCV2 | RTKQ_NOEECMD |
613 			    RTKQ_MACSTAT | RTKQ_CMDSTOP | RTKQ_NOJUMBO;
614 			break;
615 		default:
616 			aprint_normal_dev(sc->sc_dev,
617 			    "Unknown revision (0x%08x)\n", hwrev);
618 			/* assume the latest features */
619 			sc->sc_quirk |= RTKQ_DESCV2 | RTKQ_NOEECMD;
620 			sc->sc_quirk |= RTKQ_NOJUMBO;
621 		}
622 
623 		/* Set RX length mask */
624 		sc->re_rxlenmask = RE_RDESC_STAT_GFRAGLEN;
625 		sc->re_ldata.re_tx_desc_cnt = RE_TX_DESC_CNT_8169;
626 	} else {
627 		sc->sc_quirk |= RTKQ_NOJUMBO;
628 
629 		/* Set RX length mask */
630 		sc->re_rxlenmask = RE_RDESC_STAT_FRAGLEN;
631 		sc->re_ldata.re_tx_desc_cnt = RE_TX_DESC_CNT_8139;
632 	}
633 
634 	/* Reset the adapter. */
635 	re_reset(sc);
636 
637 	if ((sc->sc_quirk & RTKQ_NOEECMD) != 0) {
638 		/*
639 		 * Get station address from ID registers.
640 		 */
641 		for (i = 0; i < ETHER_ADDR_LEN; i++)
642 			eaddr[i] = CSR_READ_1(sc, RTK_IDR0 + i);
643 	} else {
644 		/*
645 		 * Get station address from the EEPROM.
646 		 */
647 		if (rtk_read_eeprom(sc, RTK_EE_ID, RTK_EEADDR_LEN1) == 0x8129)
648 			addr_len = RTK_EEADDR_LEN1;
649 		else
650 			addr_len = RTK_EEADDR_LEN0;
651 
652 		/*
653 		 * Get station address from the EEPROM.
654 		 */
655 		for (i = 0; i < ETHER_ADDR_LEN / 2; i++) {
656 			val = rtk_read_eeprom(sc, RTK_EE_EADDR0 + i, addr_len);
657 			eaddr[(i * 2) + 0] = val & 0xff;
658 			eaddr[(i * 2) + 1] = val >> 8;
659 		}
660 	}
661 
662 	aprint_normal_dev(sc->sc_dev, "Ethernet address %s\n",
663 	    ether_sprintf(eaddr));
664 
665 	if (sc->re_ldata.re_tx_desc_cnt >
666 	    PAGE_SIZE / sizeof(struct re_desc)) {
667 		sc->re_ldata.re_tx_desc_cnt =
668 		    PAGE_SIZE / sizeof(struct re_desc);
669 	}
670 
671 	aprint_verbose_dev(sc->sc_dev, "using %d tx descriptors\n",
672 	    sc->re_ldata.re_tx_desc_cnt);
673 	KASSERT(RE_NEXT_TX_DESC(sc, RE_TX_DESC_CNT(sc) - 1) == 0);
674 
675 	/* Allocate DMA'able memory for the TX ring */
676 	if ((error = bus_dmamem_alloc(sc->sc_dmat, RE_TX_LIST_SZ(sc),
677 	    RE_RING_ALIGN, 0, &sc->re_ldata.re_tx_listseg, 1,
678 	    &sc->re_ldata.re_tx_listnseg, BUS_DMA_NOWAIT)) != 0) {
679 		aprint_error_dev(sc->sc_dev,
680 		    "can't allocate tx listseg, error = %d\n", error);
681 		goto fail_0;
682 	}
683 
684 	/* Load the map for the TX ring. */
685 	if ((error = bus_dmamem_map(sc->sc_dmat, &sc->re_ldata.re_tx_listseg,
686 	    sc->re_ldata.re_tx_listnseg, RE_TX_LIST_SZ(sc),
687 	    (void **)&sc->re_ldata.re_tx_list,
688 	    BUS_DMA_COHERENT | BUS_DMA_NOWAIT)) != 0) {
689 		aprint_error_dev(sc->sc_dev,
690 		    "can't map tx list, error = %d\n", error);
691 		goto fail_1;
692 	}
693 	memset(sc->re_ldata.re_tx_list, 0, RE_TX_LIST_SZ(sc));
694 
695 	if ((error = bus_dmamap_create(sc->sc_dmat, RE_TX_LIST_SZ(sc), 1,
696 	    RE_TX_LIST_SZ(sc), 0, 0,
697 	    &sc->re_ldata.re_tx_list_map)) != 0) {
698 		aprint_error_dev(sc->sc_dev,
699 		    "can't create tx list map, error = %d\n", error);
700 		goto fail_2;
701 	}
702 
703 
704 	if ((error = bus_dmamap_load(sc->sc_dmat,
705 	    sc->re_ldata.re_tx_list_map, sc->re_ldata.re_tx_list,
706 	    RE_TX_LIST_SZ(sc), NULL, BUS_DMA_NOWAIT)) != 0) {
707 		aprint_error_dev(sc->sc_dev,
708 		    "can't load tx list, error = %d\n", error);
709 		goto fail_3;
710 	}
711 
712 	/* Create DMA maps for TX buffers */
713 	for (i = 0; i < RE_TX_QLEN; i++) {
714 		error = bus_dmamap_create(sc->sc_dmat,
715 		    round_page(IP_MAXPACKET),
716 		    RE_TX_DESC_CNT(sc), RE_TDESC_CMD_FRAGLEN,
717 		    0, 0, &sc->re_ldata.re_txq[i].txq_dmamap);
718 		if (error) {
719 			aprint_error_dev(sc->sc_dev,
720 			    "can't create DMA map for TX\n");
721 			goto fail_4;
722 		}
723 	}
724 
725 	/* Allocate DMA'able memory for the RX ring */
726 	/* XXX see also a comment about RE_RX_DMAMEM_SZ in rtl81x9var.h */
727 	if ((error = bus_dmamem_alloc(sc->sc_dmat,
728 	    RE_RX_DMAMEM_SZ, RE_RING_ALIGN, 0, &sc->re_ldata.re_rx_listseg, 1,
729 	    &sc->re_ldata.re_rx_listnseg, BUS_DMA_NOWAIT)) != 0) {
730 		aprint_error_dev(sc->sc_dev,
731 		    "can't allocate rx listseg, error = %d\n", error);
732 		goto fail_4;
733 	}
734 
735 	/* Load the map for the RX ring. */
736 	if ((error = bus_dmamem_map(sc->sc_dmat, &sc->re_ldata.re_rx_listseg,
737 	    sc->re_ldata.re_rx_listnseg, RE_RX_DMAMEM_SZ,
738 	    (void **)&sc->re_ldata.re_rx_list,
739 	    BUS_DMA_COHERENT | BUS_DMA_NOWAIT)) != 0) {
740 		aprint_error_dev(sc->sc_dev,
741 		    "can't map rx list, error = %d\n", error);
742 		goto fail_5;
743 	}
744 	memset(sc->re_ldata.re_rx_list, 0, RE_RX_DMAMEM_SZ);
745 
746 	if ((error = bus_dmamap_create(sc->sc_dmat,
747 	    RE_RX_DMAMEM_SZ, 1, RE_RX_DMAMEM_SZ, 0, 0,
748 	    &sc->re_ldata.re_rx_list_map)) != 0) {
749 		aprint_error_dev(sc->sc_dev,
750 		    "can't create rx list map, error = %d\n", error);
751 		goto fail_6;
752 	}
753 
754 	if ((error = bus_dmamap_load(sc->sc_dmat,
755 	    sc->re_ldata.re_rx_list_map, sc->re_ldata.re_rx_list,
756 	    RE_RX_DMAMEM_SZ, NULL, BUS_DMA_NOWAIT)) != 0) {
757 		aprint_error_dev(sc->sc_dev,
758 		    "can't load rx list, error = %d\n", error);
759 		goto fail_7;
760 	}
761 
762 	/* Create DMA maps for RX buffers */
763 	for (i = 0; i < RE_RX_DESC_CNT; i++) {
764 		error = bus_dmamap_create(sc->sc_dmat, MCLBYTES, 1, MCLBYTES,
765 		    0, 0, &sc->re_ldata.re_rxsoft[i].rxs_dmamap);
766 		if (error) {
767 			aprint_error_dev(sc->sc_dev,
768 			    "can't create DMA map for RX\n");
769 			goto fail_8;
770 		}
771 	}
772 
773 	/*
774 	 * Record interface as attached. From here, we should not fail.
775 	 */
776 	sc->sc_flags |= RTK_ATTACHED;
777 
778 	ifp = &sc->ethercom.ec_if;
779 	ifp->if_softc = sc;
780 	strlcpy(ifp->if_xname, device_xname(sc->sc_dev), IFNAMSIZ);
781 	ifp->if_mtu = ETHERMTU;
782 	ifp->if_flags = IFF_BROADCAST | IFF_SIMPLEX | IFF_MULTICAST;
783 	ifp->if_ioctl = re_ioctl;
784 	sc->ethercom.ec_capabilities |=
785 	    ETHERCAP_VLAN_MTU | ETHERCAP_VLAN_HWTAGGING;
786 	ifp->if_start = re_start;
787 	ifp->if_stop = re_stop;
788 
789 	/*
790 	 * IFCAP_CSUM_IPv4_Tx on re(4) is broken for small packets,
791 	 * so we have a workaround to handle the bug by padding
792 	 * such packets manually.
793 	 */
794 	ifp->if_capabilities |=
795 	    IFCAP_CSUM_IPv4_Tx | IFCAP_CSUM_IPv4_Rx |
796 	    IFCAP_CSUM_TCPv4_Tx | IFCAP_CSUM_TCPv4_Rx |
797 	    IFCAP_CSUM_UDPv4_Tx | IFCAP_CSUM_UDPv4_Rx |
798 	    IFCAP_TSOv4;
799 
800 	/*
801 	 * XXX
802 	 * Still have no idea how to make TSO work on 8168C, 8168CP,
803 	 * 8102E, 8111C and 8111CP.
804 	 */
805 	if ((sc->sc_quirk & RTKQ_DESCV2) != 0)
806 		ifp->if_capabilities &= ~IFCAP_TSOv4;
807 
808 	ifp->if_watchdog = re_watchdog;
809 	ifp->if_init = re_init;
810 	ifp->if_snd.ifq_maxlen = RE_IFQ_MAXLEN;
811 	ifp->if_capenable = ifp->if_capabilities;
812 	IFQ_SET_READY(&ifp->if_snd);
813 
814 	callout_init(&sc->rtk_tick_ch, 0);
815 
816 	/* Do MII setup */
817 	sc->mii.mii_ifp = ifp;
818 	sc->mii.mii_readreg = re_miibus_readreg;
819 	sc->mii.mii_writereg = re_miibus_writereg;
820 	sc->mii.mii_statchg = re_miibus_statchg;
821 	sc->ethercom.ec_mii = &sc->mii;
822 	ifmedia_init(&sc->mii.mii_media, IFM_IMASK, ether_mediachange,
823 	    ether_mediastatus);
824 	mii_attach(sc->sc_dev, &sc->mii, 0xffffffff, MII_PHY_ANY,
825 	    MII_OFFSET_ANY, 0);
826 	ifmedia_set(&sc->mii.mii_media, IFM_ETHER | IFM_AUTO);
827 
828 	/*
829 	 * Call MI attach routine.
830 	 */
831 	if_attach(ifp);
832 	ether_ifattach(ifp, eaddr);
833 
834 	if (pmf_device_register(sc->sc_dev, NULL, NULL))
835 		pmf_class_network_register(sc->sc_dev, ifp);
836 	else
837 		aprint_error_dev(sc->sc_dev,
838 		    "couldn't establish power handler\n");
839 
840 	return;
841 
842  fail_8:
843 	/* Destroy DMA maps for RX buffers. */
844 	for (i = 0; i < RE_RX_DESC_CNT; i++)
845 		if (sc->re_ldata.re_rxsoft[i].rxs_dmamap != NULL)
846 			bus_dmamap_destroy(sc->sc_dmat,
847 			    sc->re_ldata.re_rxsoft[i].rxs_dmamap);
848 
849 	/* Free DMA'able memory for the RX ring. */
850 	bus_dmamap_unload(sc->sc_dmat, sc->re_ldata.re_rx_list_map);
851  fail_7:
852 	bus_dmamap_destroy(sc->sc_dmat, sc->re_ldata.re_rx_list_map);
853  fail_6:
854 	bus_dmamem_unmap(sc->sc_dmat,
855 	    (void *)sc->re_ldata.re_rx_list, RE_RX_DMAMEM_SZ);
856  fail_5:
857 	bus_dmamem_free(sc->sc_dmat,
858 	    &sc->re_ldata.re_rx_listseg, sc->re_ldata.re_rx_listnseg);
859 
860  fail_4:
861 	/* Destroy DMA maps for TX buffers. */
862 	for (i = 0; i < RE_TX_QLEN; i++)
863 		if (sc->re_ldata.re_txq[i].txq_dmamap != NULL)
864 			bus_dmamap_destroy(sc->sc_dmat,
865 			    sc->re_ldata.re_txq[i].txq_dmamap);
866 
867 	/* Free DMA'able memory for the TX ring. */
868 	bus_dmamap_unload(sc->sc_dmat, sc->re_ldata.re_tx_list_map);
869  fail_3:
870 	bus_dmamap_destroy(sc->sc_dmat, sc->re_ldata.re_tx_list_map);
871  fail_2:
872 	bus_dmamem_unmap(sc->sc_dmat,
873 	    (void *)sc->re_ldata.re_tx_list, RE_TX_LIST_SZ(sc));
874  fail_1:
875 	bus_dmamem_free(sc->sc_dmat,
876 	    &sc->re_ldata.re_tx_listseg, sc->re_ldata.re_tx_listnseg);
877  fail_0:
878 	return;
879 }
880 
881 
882 /*
883  * re_activate:
884  *     Handle device activation/deactivation requests.
885  */
886 int
887 re_activate(device_t self, enum devact act)
888 {
889 	struct rtk_softc *sc = device_private(self);
890 
891 	switch (act) {
892 	case DVACT_DEACTIVATE:
893 		if_deactivate(&sc->ethercom.ec_if);
894 		return 0;
895 	default:
896 		return EOPNOTSUPP;
897 	}
898 }
899 
900 /*
901  * re_detach:
902  *     Detach a rtk interface.
903  */
904 int
905 re_detach(struct rtk_softc *sc)
906 {
907 	struct ifnet *ifp = &sc->ethercom.ec_if;
908 	int i;
909 
910 	/*
911 	 * Succeed now if there isn't any work to do.
912 	 */
913 	if ((sc->sc_flags & RTK_ATTACHED) == 0)
914 		return 0;
915 
916 	/* Unhook our tick handler. */
917 	callout_stop(&sc->rtk_tick_ch);
918 
919 	/* Detach all PHYs. */
920 	mii_detach(&sc->mii, MII_PHY_ANY, MII_OFFSET_ANY);
921 
922 	/* Delete all remaining media. */
923 	ifmedia_delete_instance(&sc->mii.mii_media, IFM_INST_ANY);
924 
925 	ether_ifdetach(ifp);
926 	if_detach(ifp);
927 
928 	/* Destroy DMA maps for RX buffers. */
929 	for (i = 0; i < RE_RX_DESC_CNT; i++)
930 		if (sc->re_ldata.re_rxsoft[i].rxs_dmamap != NULL)
931 			bus_dmamap_destroy(sc->sc_dmat,
932 			    sc->re_ldata.re_rxsoft[i].rxs_dmamap);
933 
934 	/* Free DMA'able memory for the RX ring. */
935 	bus_dmamap_unload(sc->sc_dmat, sc->re_ldata.re_rx_list_map);
936 	bus_dmamap_destroy(sc->sc_dmat, sc->re_ldata.re_rx_list_map);
937 	bus_dmamem_unmap(sc->sc_dmat,
938 	    (void *)sc->re_ldata.re_rx_list, RE_RX_DMAMEM_SZ);
939 	bus_dmamem_free(sc->sc_dmat,
940 	    &sc->re_ldata.re_rx_listseg, sc->re_ldata.re_rx_listnseg);
941 
942 	/* Destroy DMA maps for TX buffers. */
943 	for (i = 0; i < RE_TX_QLEN; i++)
944 		if (sc->re_ldata.re_txq[i].txq_dmamap != NULL)
945 			bus_dmamap_destroy(sc->sc_dmat,
946 			    sc->re_ldata.re_txq[i].txq_dmamap);
947 
948 	/* Free DMA'able memory for the TX ring. */
949 	bus_dmamap_unload(sc->sc_dmat, sc->re_ldata.re_tx_list_map);
950 	bus_dmamap_destroy(sc->sc_dmat, sc->re_ldata.re_tx_list_map);
951 	bus_dmamem_unmap(sc->sc_dmat,
952 	    (void *)sc->re_ldata.re_tx_list, RE_TX_LIST_SZ(sc));
953 	bus_dmamem_free(sc->sc_dmat,
954 	    &sc->re_ldata.re_tx_listseg, sc->re_ldata.re_tx_listnseg);
955 
956 	pmf_device_deregister(sc->sc_dev);
957 
958 	/* we don't want to run again */
959 	sc->sc_flags &= ~RTK_ATTACHED;
960 
961 	return 0;
962 }
963 
964 /*
965  * re_enable:
966  *     Enable the RTL81X9 chip.
967  */
968 static int
969 re_enable(struct rtk_softc *sc)
970 {
971 
972 	if (RTK_IS_ENABLED(sc) == 0 && sc->sc_enable != NULL) {
973 		if ((*sc->sc_enable)(sc) != 0) {
974 			printf("%s: device enable failed\n",
975 			    device_xname(sc->sc_dev));
976 			return EIO;
977 		}
978 		sc->sc_flags |= RTK_ENABLED;
979 	}
980 	return 0;
981 }
982 
983 /*
984  * re_disable:
985  *     Disable the RTL81X9 chip.
986  */
987 static void
988 re_disable(struct rtk_softc *sc)
989 {
990 
991 	if (RTK_IS_ENABLED(sc) && sc->sc_disable != NULL) {
992 		(*sc->sc_disable)(sc);
993 		sc->sc_flags &= ~RTK_ENABLED;
994 	}
995 }
996 
997 static int
998 re_newbuf(struct rtk_softc *sc, int idx, struct mbuf *m)
999 {
1000 	struct mbuf *n = NULL;
1001 	bus_dmamap_t map;
1002 	struct re_desc *d;
1003 	struct re_rxsoft *rxs;
1004 	uint32_t cmdstat;
1005 	int error;
1006 
1007 	if (m == NULL) {
1008 		MGETHDR(n, M_DONTWAIT, MT_DATA);
1009 		if (n == NULL)
1010 			return ENOBUFS;
1011 
1012 		MCLGET(n, M_DONTWAIT);
1013 		if ((n->m_flags & M_EXT) == 0) {
1014 			m_freem(n);
1015 			return ENOBUFS;
1016 		}
1017 		m = n;
1018 	} else
1019 		m->m_data = m->m_ext.ext_buf;
1020 
1021 	/*
1022 	 * Initialize mbuf length fields and fixup
1023 	 * alignment so that the frame payload is
1024 	 * longword aligned.
1025 	 */
1026 	m->m_len = m->m_pkthdr.len = MCLBYTES - RE_ETHER_ALIGN;
1027 	m->m_data += RE_ETHER_ALIGN;
1028 
1029 	rxs = &sc->re_ldata.re_rxsoft[idx];
1030 	map = rxs->rxs_dmamap;
1031 	error = bus_dmamap_load_mbuf(sc->sc_dmat, map, m,
1032 	    BUS_DMA_READ|BUS_DMA_NOWAIT);
1033 
1034 	if (error)
1035 		goto out;
1036 
1037 	bus_dmamap_sync(sc->sc_dmat, map, 0, map->dm_mapsize,
1038 	    BUS_DMASYNC_PREREAD);
1039 
1040 	d = &sc->re_ldata.re_rx_list[idx];
1041 #ifdef DIAGNOSTIC
1042 	RE_RXDESCSYNC(sc, idx, BUS_DMASYNC_POSTREAD|BUS_DMASYNC_POSTWRITE);
1043 	cmdstat = le32toh(d->re_cmdstat);
1044 	RE_RXDESCSYNC(sc, idx, BUS_DMASYNC_PREREAD);
1045 	if (cmdstat & RE_RDESC_STAT_OWN) {
1046 		panic("%s: tried to map busy RX descriptor",
1047 		    device_xname(sc->sc_dev));
1048 	}
1049 #endif
1050 
1051 	rxs->rxs_mbuf = m;
1052 
1053 	d->re_vlanctl = 0;
1054 	cmdstat = map->dm_segs[0].ds_len;
1055 	if (idx == (RE_RX_DESC_CNT - 1))
1056 		cmdstat |= RE_RDESC_CMD_EOR;
1057 	re_set_bufaddr(d, map->dm_segs[0].ds_addr);
1058 	d->re_cmdstat = htole32(cmdstat);
1059 	RE_RXDESCSYNC(sc, idx, BUS_DMASYNC_PREREAD|BUS_DMASYNC_PREWRITE);
1060 	cmdstat |= RE_RDESC_CMD_OWN;
1061 	d->re_cmdstat = htole32(cmdstat);
1062 	RE_RXDESCSYNC(sc, idx, BUS_DMASYNC_PREREAD|BUS_DMASYNC_PREWRITE);
1063 
1064 	return 0;
1065  out:
1066 	if (n != NULL)
1067 		m_freem(n);
1068 	return ENOMEM;
1069 }
1070 
1071 static int
1072 re_tx_list_init(struct rtk_softc *sc)
1073 {
1074 	int i;
1075 
1076 	memset(sc->re_ldata.re_tx_list, 0, RE_TX_LIST_SZ(sc));
1077 	for (i = 0; i < RE_TX_QLEN; i++) {
1078 		sc->re_ldata.re_txq[i].txq_mbuf = NULL;
1079 	}
1080 
1081 	bus_dmamap_sync(sc->sc_dmat,
1082 	    sc->re_ldata.re_tx_list_map, 0,
1083 	    sc->re_ldata.re_tx_list_map->dm_mapsize,
1084 	    BUS_DMASYNC_PREREAD|BUS_DMASYNC_PREWRITE);
1085 	sc->re_ldata.re_txq_prodidx = 0;
1086 	sc->re_ldata.re_txq_considx = 0;
1087 	sc->re_ldata.re_txq_free = RE_TX_QLEN;
1088 	sc->re_ldata.re_tx_free = RE_TX_DESC_CNT(sc);
1089 	sc->re_ldata.re_tx_nextfree = 0;
1090 
1091 	return 0;
1092 }
1093 
1094 static int
1095 re_rx_list_init(struct rtk_softc *sc)
1096 {
1097 	int i;
1098 
1099 	memset(sc->re_ldata.re_rx_list, 0, RE_RX_LIST_SZ);
1100 
1101 	for (i = 0; i < RE_RX_DESC_CNT; i++) {
1102 		if (re_newbuf(sc, i, NULL) == ENOBUFS)
1103 			return ENOBUFS;
1104 	}
1105 
1106 	sc->re_ldata.re_rx_prodidx = 0;
1107 	sc->re_head = sc->re_tail = NULL;
1108 
1109 	return 0;
1110 }
1111 
1112 /*
1113  * RX handler for C+ and 8169. For the gigE chips, we support
1114  * the reception of jumbo frames that have been fragmented
1115  * across multiple 2K mbuf cluster buffers.
1116  */
1117 static void
1118 re_rxeof(struct rtk_softc *sc)
1119 {
1120 	struct mbuf *m;
1121 	struct ifnet *ifp;
1122 	int i, total_len;
1123 	struct re_desc *cur_rx;
1124 	struct re_rxsoft *rxs;
1125 	uint32_t rxstat, rxvlan;
1126 
1127 	ifp = &sc->ethercom.ec_if;
1128 
1129 	for (i = sc->re_ldata.re_rx_prodidx;; i = RE_NEXT_RX_DESC(sc, i)) {
1130 		cur_rx = &sc->re_ldata.re_rx_list[i];
1131 		RE_RXDESCSYNC(sc, i,
1132 		    BUS_DMASYNC_POSTREAD|BUS_DMASYNC_POSTWRITE);
1133 		rxstat = le32toh(cur_rx->re_cmdstat);
1134 		rxvlan = le32toh(cur_rx->re_vlanctl);
1135 		RE_RXDESCSYNC(sc, i, BUS_DMASYNC_PREREAD);
1136 		if ((rxstat & RE_RDESC_STAT_OWN) != 0) {
1137 			break;
1138 		}
1139 		total_len = rxstat & sc->re_rxlenmask;
1140 		rxs = &sc->re_ldata.re_rxsoft[i];
1141 		m = rxs->rxs_mbuf;
1142 
1143 		/* Invalidate the RX mbuf and unload its map */
1144 
1145 		bus_dmamap_sync(sc->sc_dmat,
1146 		    rxs->rxs_dmamap, 0, rxs->rxs_dmamap->dm_mapsize,
1147 		    BUS_DMASYNC_POSTREAD);
1148 		bus_dmamap_unload(sc->sc_dmat, rxs->rxs_dmamap);
1149 
1150 		if ((rxstat & RE_RDESC_STAT_EOF) == 0) {
1151 			m->m_len = MCLBYTES - RE_ETHER_ALIGN;
1152 			if (sc->re_head == NULL)
1153 				sc->re_head = sc->re_tail = m;
1154 			else {
1155 				m->m_flags &= ~M_PKTHDR;
1156 				sc->re_tail->m_next = m;
1157 				sc->re_tail = m;
1158 			}
1159 			re_newbuf(sc, i, NULL);
1160 			continue;
1161 		}
1162 
1163 		/*
1164 		 * NOTE: for the 8139C+, the frame length field
1165 		 * is always 12 bits in size, but for the gigE chips,
1166 		 * it is 13 bits (since the max RX frame length is 16K).
1167 		 * Unfortunately, all 32 bits in the status word
1168 		 * were already used, so to make room for the extra
1169 		 * length bit, RealTek took out the 'frame alignment
1170 		 * error' bit and shifted the other status bits
1171 		 * over one slot. The OWN, EOR, FS and LS bits are
1172 		 * still in the same places. We have already extracted
1173 		 * the frame length and checked the OWN bit, so rather
1174 		 * than using an alternate bit mapping, we shift the
1175 		 * status bits one space to the right so we can evaluate
1176 		 * them using the 8169 status as though it was in the
1177 		 * same format as that of the 8139C+.
1178 		 */
1179 		if ((sc->sc_quirk & RTKQ_8139CPLUS) == 0)
1180 			rxstat >>= 1;
1181 
1182 		if (__predict_false((rxstat & RE_RDESC_STAT_RXERRSUM) != 0)) {
1183 #ifdef RE_DEBUG
1184 			printf("%s: RX error (rxstat = 0x%08x)",
1185 			    device_xname(sc->sc_dev), rxstat);
1186 			if (rxstat & RE_RDESC_STAT_FRALIGN)
1187 				printf(", frame alignment error");
1188 			if (rxstat & RE_RDESC_STAT_BUFOFLOW)
1189 				printf(", out of buffer space");
1190 			if (rxstat & RE_RDESC_STAT_FIFOOFLOW)
1191 				printf(", FIFO overrun");
1192 			if (rxstat & RE_RDESC_STAT_GIANT)
1193 				printf(", giant packet");
1194 			if (rxstat & RE_RDESC_STAT_RUNT)
1195 				printf(", runt packet");
1196 			if (rxstat & RE_RDESC_STAT_CRCERR)
1197 				printf(", CRC error");
1198 			printf("\n");
1199 #endif
1200 			ifp->if_ierrors++;
1201 			/*
1202 			 * If this is part of a multi-fragment packet,
1203 			 * discard all the pieces.
1204 			 */
1205 			if (sc->re_head != NULL) {
1206 				m_freem(sc->re_head);
1207 				sc->re_head = sc->re_tail = NULL;
1208 			}
1209 			re_newbuf(sc, i, m);
1210 			continue;
1211 		}
1212 
1213 		/*
1214 		 * If allocating a replacement mbuf fails,
1215 		 * reload the current one.
1216 		 */
1217 
1218 		if (__predict_false(re_newbuf(sc, i, NULL) != 0)) {
1219 			ifp->if_ierrors++;
1220 			if (sc->re_head != NULL) {
1221 				m_freem(sc->re_head);
1222 				sc->re_head = sc->re_tail = NULL;
1223 			}
1224 			re_newbuf(sc, i, m);
1225 			continue;
1226 		}
1227 
1228 		if (sc->re_head != NULL) {
1229 			m->m_len = total_len % (MCLBYTES - RE_ETHER_ALIGN);
1230 			/*
1231 			 * Special case: if there's 4 bytes or less
1232 			 * in this buffer, the mbuf can be discarded:
1233 			 * the last 4 bytes is the CRC, which we don't
1234 			 * care about anyway.
1235 			 */
1236 			if (m->m_len <= ETHER_CRC_LEN) {
1237 				sc->re_tail->m_len -=
1238 				    (ETHER_CRC_LEN - m->m_len);
1239 				m_freem(m);
1240 			} else {
1241 				m->m_len -= ETHER_CRC_LEN;
1242 				m->m_flags &= ~M_PKTHDR;
1243 				sc->re_tail->m_next = m;
1244 			}
1245 			m = sc->re_head;
1246 			sc->re_head = sc->re_tail = NULL;
1247 			m->m_pkthdr.len = total_len - ETHER_CRC_LEN;
1248 		} else
1249 			m->m_pkthdr.len = m->m_len =
1250 			    (total_len - ETHER_CRC_LEN);
1251 
1252 		ifp->if_ipackets++;
1253 		m->m_pkthdr.rcvif = ifp;
1254 
1255 		/* Do RX checksumming */
1256 		if ((sc->sc_quirk & RTKQ_DESCV2) == 0) {
1257 			/* Check IP header checksum */
1258 			if ((rxstat & RE_RDESC_STAT_PROTOID) != 0) {
1259 				m->m_pkthdr.csum_flags |= M_CSUM_IPv4;
1260 				if (rxstat & RE_RDESC_STAT_IPSUMBAD)
1261 					m->m_pkthdr.csum_flags |=
1262 					    M_CSUM_IPv4_BAD;
1263 
1264 				/* Check TCP/UDP checksum */
1265 				if (RE_TCPPKT(rxstat)) {
1266 					m->m_pkthdr.csum_flags |= M_CSUM_TCPv4;
1267 					if (rxstat & RE_RDESC_STAT_TCPSUMBAD)
1268 						m->m_pkthdr.csum_flags |=
1269 						    M_CSUM_TCP_UDP_BAD;
1270 				} else if (RE_UDPPKT(rxstat)) {
1271 					m->m_pkthdr.csum_flags |= M_CSUM_UDPv4;
1272 					if (rxstat & RE_RDESC_STAT_UDPSUMBAD)
1273 						m->m_pkthdr.csum_flags |=
1274 						    M_CSUM_TCP_UDP_BAD;
1275 				}
1276 			}
1277 		} else {
1278 			/* Check IPv4 header checksum */
1279 			if ((rxvlan & RE_RDESC_VLANCTL_IPV4) != 0) {
1280 				m->m_pkthdr.csum_flags |= M_CSUM_IPv4;
1281 				if (rxstat & RE_RDESC_STAT_IPSUMBAD)
1282 					m->m_pkthdr.csum_flags |=
1283 					    M_CSUM_IPv4_BAD;
1284 
1285 				/* Check TCPv4/UDPv4 checksum */
1286 				if (RE_TCPPKT(rxstat)) {
1287 					m->m_pkthdr.csum_flags |= M_CSUM_TCPv4;
1288 					if (rxstat & RE_RDESC_STAT_TCPSUMBAD)
1289 						m->m_pkthdr.csum_flags |=
1290 						    M_CSUM_TCP_UDP_BAD;
1291 				} else if (RE_UDPPKT(rxstat)) {
1292 					m->m_pkthdr.csum_flags |= M_CSUM_UDPv4;
1293 					if (rxstat & RE_RDESC_STAT_UDPSUMBAD)
1294 						m->m_pkthdr.csum_flags |=
1295 						    M_CSUM_TCP_UDP_BAD;
1296 				}
1297 			}
1298 			/* XXX Check TCPv6/UDPv6 checksum? */
1299 		}
1300 
1301 		if (rxvlan & RE_RDESC_VLANCTL_TAG) {
1302 			VLAN_INPUT_TAG(ifp, m,
1303 			     bswap16(rxvlan & RE_RDESC_VLANCTL_DATA),
1304 			     continue);
1305 		}
1306 		bpf_mtap(ifp, m);
1307 		(*ifp->if_input)(ifp, m);
1308 	}
1309 
1310 	sc->re_ldata.re_rx_prodidx = i;
1311 }
1312 
1313 static void
1314 re_txeof(struct rtk_softc *sc)
1315 {
1316 	struct ifnet *ifp;
1317 	struct re_txq *txq;
1318 	uint32_t txstat;
1319 	int idx, descidx;
1320 
1321 	ifp = &sc->ethercom.ec_if;
1322 
1323 	for (idx = sc->re_ldata.re_txq_considx;
1324 	    sc->re_ldata.re_txq_free < RE_TX_QLEN;
1325 	    idx = RE_NEXT_TXQ(sc, idx), sc->re_ldata.re_txq_free++) {
1326 		txq = &sc->re_ldata.re_txq[idx];
1327 		KASSERT(txq->txq_mbuf != NULL);
1328 
1329 		descidx = txq->txq_descidx;
1330 		RE_TXDESCSYNC(sc, descidx,
1331 		    BUS_DMASYNC_POSTREAD|BUS_DMASYNC_POSTWRITE);
1332 		txstat =
1333 		    le32toh(sc->re_ldata.re_tx_list[descidx].re_cmdstat);
1334 		RE_TXDESCSYNC(sc, descidx, BUS_DMASYNC_PREREAD);
1335 		KASSERT((txstat & RE_TDESC_CMD_EOF) != 0);
1336 		if (txstat & RE_TDESC_CMD_OWN) {
1337 			break;
1338 		}
1339 
1340 		sc->re_ldata.re_tx_free += txq->txq_nsegs;
1341 		KASSERT(sc->re_ldata.re_tx_free <= RE_TX_DESC_CNT(sc));
1342 		bus_dmamap_sync(sc->sc_dmat, txq->txq_dmamap,
1343 		    0, txq->txq_dmamap->dm_mapsize, BUS_DMASYNC_POSTWRITE);
1344 		bus_dmamap_unload(sc->sc_dmat, txq->txq_dmamap);
1345 		m_freem(txq->txq_mbuf);
1346 		txq->txq_mbuf = NULL;
1347 
1348 		if (txstat & (RE_TDESC_STAT_EXCESSCOL | RE_TDESC_STAT_COLCNT))
1349 			ifp->if_collisions++;
1350 		if (txstat & RE_TDESC_STAT_TXERRSUM)
1351 			ifp->if_oerrors++;
1352 		else
1353 			ifp->if_opackets++;
1354 	}
1355 
1356 	sc->re_ldata.re_txq_considx = idx;
1357 
1358 	if (sc->re_ldata.re_txq_free > RE_NTXDESC_RSVD)
1359 		ifp->if_flags &= ~IFF_OACTIVE;
1360 
1361 	/*
1362 	 * If not all descriptors have been released reaped yet,
1363 	 * reload the timer so that we will eventually get another
1364 	 * interrupt that will cause us to re-enter this routine.
1365 	 * This is done in case the transmitter has gone idle.
1366 	 */
1367 	if (sc->re_ldata.re_txq_free < RE_TX_QLEN) {
1368 		CSR_WRITE_4(sc, RTK_TIMERCNT, 1);
1369 		if ((sc->sc_quirk & RTKQ_PCIE) != 0) {
1370 			/*
1371 			 * Some chips will ignore a second TX request
1372 			 * issued while an existing transmission is in
1373 			 * progress. If the transmitter goes idle but
1374 			 * there are still packets waiting to be sent,
1375 			 * we need to restart the channel here to flush
1376 			 * them out. This only seems to be required with
1377 			 * the PCIe devices.
1378 			 */
1379 			CSR_WRITE_1(sc, RTK_GTXSTART, RTK_TXSTART_START);
1380 		}
1381 	} else
1382 		ifp->if_timer = 0;
1383 }
1384 
1385 static void
1386 re_tick(void *arg)
1387 {
1388 	struct rtk_softc *sc = arg;
1389 	int s;
1390 
1391 	/* XXX: just return for 8169S/8110S with rev 2 or newer phy */
1392 	s = splnet();
1393 
1394 	mii_tick(&sc->mii);
1395 	splx(s);
1396 
1397 	callout_reset(&sc->rtk_tick_ch, hz, re_tick, sc);
1398 }
1399 
1400 int
1401 re_intr(void *arg)
1402 {
1403 	struct rtk_softc *sc = arg;
1404 	struct ifnet *ifp;
1405 	uint16_t status;
1406 	int handled = 0;
1407 
1408 	if (!device_has_power(sc->sc_dev))
1409 		return 0;
1410 
1411 	ifp = &sc->ethercom.ec_if;
1412 
1413 	if ((ifp->if_flags & IFF_UP) == 0)
1414 		return 0;
1415 
1416 	for (;;) {
1417 
1418 		status = CSR_READ_2(sc, RTK_ISR);
1419 		/* If the card has gone away the read returns 0xffff. */
1420 		if (status == 0xffff)
1421 			break;
1422 		if (status) {
1423 			handled = 1;
1424 			CSR_WRITE_2(sc, RTK_ISR, status);
1425 		}
1426 
1427 		if ((status & RTK_INTRS_CPLUS) == 0)
1428 			break;
1429 
1430 		if (status & (RTK_ISR_RX_OK | RTK_ISR_RX_ERR))
1431 			re_rxeof(sc);
1432 
1433 		if (status & (RTK_ISR_TIMEOUT_EXPIRED | RTK_ISR_TX_ERR |
1434 		    RTK_ISR_TX_DESC_UNAVAIL))
1435 			re_txeof(sc);
1436 
1437 		if (status & RTK_ISR_SYSTEM_ERR) {
1438 			re_init(ifp);
1439 		}
1440 
1441 		if (status & RTK_ISR_LINKCHG) {
1442 			callout_stop(&sc->rtk_tick_ch);
1443 			re_tick(sc);
1444 		}
1445 	}
1446 
1447 	if (handled && !IFQ_IS_EMPTY(&ifp->if_snd))
1448 		re_start(ifp);
1449 
1450 	return handled;
1451 }
1452 
1453 
1454 
1455 /*
1456  * Main transmit routine for C+ and gigE NICs.
1457  */
1458 
1459 static void
1460 re_start(struct ifnet *ifp)
1461 {
1462 	struct rtk_softc *sc;
1463 	struct mbuf *m;
1464 	bus_dmamap_t map;
1465 	struct re_txq *txq;
1466 	struct re_desc *d;
1467 	struct m_tag *mtag;
1468 	uint32_t cmdstat, re_flags, vlanctl;
1469 	int ofree, idx, error, nsegs, seg;
1470 	int startdesc, curdesc, lastdesc;
1471 	bool pad;
1472 
1473 	sc = ifp->if_softc;
1474 	ofree = sc->re_ldata.re_txq_free;
1475 
1476 	for (idx = sc->re_ldata.re_txq_prodidx;; idx = RE_NEXT_TXQ(sc, idx)) {
1477 
1478 		IFQ_POLL(&ifp->if_snd, m);
1479 		if (m == NULL)
1480 			break;
1481 
1482 		if (sc->re_ldata.re_txq_free == 0 ||
1483 		    sc->re_ldata.re_tx_free == 0) {
1484 			/* no more free slots left */
1485 			ifp->if_flags |= IFF_OACTIVE;
1486 			break;
1487 		}
1488 
1489 		/*
1490 		 * Set up checksum offload. Note: checksum offload bits must
1491 		 * appear in all descriptors of a multi-descriptor transmit
1492 		 * attempt. (This is according to testing done with an 8169
1493 		 * chip. I'm not sure if this is a requirement or a bug.)
1494 		 */
1495 
1496 		vlanctl = 0;
1497 		if ((m->m_pkthdr.csum_flags & M_CSUM_TSOv4) != 0) {
1498 			uint32_t segsz = m->m_pkthdr.segsz;
1499 
1500 			re_flags = RE_TDESC_CMD_LGSEND |
1501 			    (segsz << RE_TDESC_CMD_MSSVAL_SHIFT);
1502 		} else {
1503 			/*
1504 			 * set RE_TDESC_CMD_IPCSUM if any checksum offloading
1505 			 * is requested.  otherwise, RE_TDESC_CMD_TCPCSUM/
1506 			 * RE_TDESC_CMD_UDPCSUM doesn't make effects.
1507 			 */
1508 			re_flags = 0;
1509 			if ((m->m_pkthdr.csum_flags &
1510 			    (M_CSUM_IPv4 | M_CSUM_TCPv4 | M_CSUM_UDPv4))
1511 			    != 0) {
1512 				if ((sc->sc_quirk & RTKQ_DESCV2) == 0) {
1513 					re_flags |= RE_TDESC_CMD_IPCSUM;
1514 					if (m->m_pkthdr.csum_flags &
1515 					    M_CSUM_TCPv4) {
1516 						re_flags |=
1517 						    RE_TDESC_CMD_TCPCSUM;
1518 					} else if (m->m_pkthdr.csum_flags &
1519 					    M_CSUM_UDPv4) {
1520 						re_flags |=
1521 						    RE_TDESC_CMD_UDPCSUM;
1522 					}
1523 				} else {
1524 					vlanctl |= RE_TDESC_VLANCTL_IPCSUM;
1525 					if (m->m_pkthdr.csum_flags &
1526 					    M_CSUM_TCPv4) {
1527 						vlanctl |=
1528 						    RE_TDESC_VLANCTL_TCPCSUM;
1529 					} else if (m->m_pkthdr.csum_flags &
1530 					    M_CSUM_UDPv4) {
1531 						vlanctl |=
1532 						    RE_TDESC_VLANCTL_UDPCSUM;
1533 					}
1534 				}
1535 			}
1536 		}
1537 
1538 		txq = &sc->re_ldata.re_txq[idx];
1539 		map = txq->txq_dmamap;
1540 		error = bus_dmamap_load_mbuf(sc->sc_dmat, map, m,
1541 		    BUS_DMA_WRITE|BUS_DMA_NOWAIT);
1542 
1543 		if (__predict_false(error)) {
1544 			/* XXX try to defrag if EFBIG? */
1545 			printf("%s: can't map mbuf (error %d)\n",
1546 			    device_xname(sc->sc_dev), error);
1547 
1548 			IFQ_DEQUEUE(&ifp->if_snd, m);
1549 			m_freem(m);
1550 			ifp->if_oerrors++;
1551 			continue;
1552 		}
1553 
1554 		nsegs = map->dm_nsegs;
1555 		pad = false;
1556 		if (__predict_false(m->m_pkthdr.len <= RE_IP4CSUMTX_PADLEN &&
1557 		    (re_flags & RE_TDESC_CMD_IPCSUM) != 0 &&
1558 		    (sc->sc_quirk & RTKQ_DESCV2) == 0)) {
1559 			pad = true;
1560 			nsegs++;
1561 		}
1562 
1563 		if (nsegs > sc->re_ldata.re_tx_free) {
1564 			/*
1565 			 * Not enough free descriptors to transmit this packet.
1566 			 */
1567 			ifp->if_flags |= IFF_OACTIVE;
1568 			bus_dmamap_unload(sc->sc_dmat, map);
1569 			break;
1570 		}
1571 
1572 		IFQ_DEQUEUE(&ifp->if_snd, m);
1573 
1574 		/*
1575 		 * Make sure that the caches are synchronized before we
1576 		 * ask the chip to start DMA for the packet data.
1577 		 */
1578 		bus_dmamap_sync(sc->sc_dmat, map, 0, map->dm_mapsize,
1579 		    BUS_DMASYNC_PREWRITE);
1580 
1581 		/*
1582 		 * Set up hardware VLAN tagging. Note: vlan tag info must
1583 		 * appear in all descriptors of a multi-descriptor
1584 		 * transmission attempt.
1585 		 */
1586 		if ((mtag = VLAN_OUTPUT_TAG(&sc->ethercom, m)) != NULL)
1587 			vlanctl |= bswap16(VLAN_TAG_VALUE(mtag)) |
1588 			    RE_TDESC_VLANCTL_TAG;
1589 
1590 		/*
1591 		 * Map the segment array into descriptors.
1592 		 * Note that we set the start-of-frame and
1593 		 * end-of-frame markers for either TX or RX,
1594 		 * but they really only have meaning in the TX case.
1595 		 * (In the RX case, it's the chip that tells us
1596 		 *  where packets begin and end.)
1597 		 * We also keep track of the end of the ring
1598 		 * and set the end-of-ring bits as needed,
1599 		 * and we set the ownership bits in all except
1600 		 * the very first descriptor. (The caller will
1601 		 * set this descriptor later when it start
1602 		 * transmission or reception.)
1603 		 */
1604 		curdesc = startdesc = sc->re_ldata.re_tx_nextfree;
1605 		lastdesc = -1;
1606 		for (seg = 0; seg < map->dm_nsegs;
1607 		    seg++, curdesc = RE_NEXT_TX_DESC(sc, curdesc)) {
1608 			d = &sc->re_ldata.re_tx_list[curdesc];
1609 #ifdef DIAGNOSTIC
1610 			RE_TXDESCSYNC(sc, curdesc,
1611 			    BUS_DMASYNC_POSTREAD|BUS_DMASYNC_POSTWRITE);
1612 			cmdstat = le32toh(d->re_cmdstat);
1613 			RE_TXDESCSYNC(sc, curdesc, BUS_DMASYNC_PREREAD);
1614 			if (cmdstat & RE_TDESC_STAT_OWN) {
1615 				panic("%s: tried to map busy TX descriptor",
1616 				    device_xname(sc->sc_dev));
1617 			}
1618 #endif
1619 
1620 			d->re_vlanctl = htole32(vlanctl);
1621 			re_set_bufaddr(d, map->dm_segs[seg].ds_addr);
1622 			cmdstat = re_flags | map->dm_segs[seg].ds_len;
1623 			if (seg == 0)
1624 				cmdstat |= RE_TDESC_CMD_SOF;
1625 			else
1626 				cmdstat |= RE_TDESC_CMD_OWN;
1627 			if (curdesc == (RE_TX_DESC_CNT(sc) - 1))
1628 				cmdstat |= RE_TDESC_CMD_EOR;
1629 			if (seg == nsegs - 1) {
1630 				cmdstat |= RE_TDESC_CMD_EOF;
1631 				lastdesc = curdesc;
1632 			}
1633 			d->re_cmdstat = htole32(cmdstat);
1634 			RE_TXDESCSYNC(sc, curdesc,
1635 			    BUS_DMASYNC_PREREAD|BUS_DMASYNC_PREWRITE);
1636 		}
1637 		if (__predict_false(pad)) {
1638 			d = &sc->re_ldata.re_tx_list[curdesc];
1639 			d->re_vlanctl = htole32(vlanctl);
1640 			re_set_bufaddr(d, RE_TXPADDADDR(sc));
1641 			cmdstat = re_flags |
1642 			    RE_TDESC_CMD_OWN | RE_TDESC_CMD_EOF |
1643 			    (RE_IP4CSUMTX_PADLEN + 1 - m->m_pkthdr.len);
1644 			if (curdesc == (RE_TX_DESC_CNT(sc) - 1))
1645 				cmdstat |= RE_TDESC_CMD_EOR;
1646 			d->re_cmdstat = htole32(cmdstat);
1647 			RE_TXDESCSYNC(sc, curdesc,
1648 			    BUS_DMASYNC_PREREAD|BUS_DMASYNC_PREWRITE);
1649 			lastdesc = curdesc;
1650 			curdesc = RE_NEXT_TX_DESC(sc, curdesc);
1651 		}
1652 		KASSERT(lastdesc != -1);
1653 
1654 		/* Transfer ownership of packet to the chip. */
1655 
1656 		sc->re_ldata.re_tx_list[startdesc].re_cmdstat |=
1657 		    htole32(RE_TDESC_CMD_OWN);
1658 		RE_TXDESCSYNC(sc, startdesc,
1659 		    BUS_DMASYNC_PREREAD|BUS_DMASYNC_PREWRITE);
1660 
1661 		/* update info of TX queue and descriptors */
1662 		txq->txq_mbuf = m;
1663 		txq->txq_descidx = lastdesc;
1664 		txq->txq_nsegs = nsegs;
1665 
1666 		sc->re_ldata.re_txq_free--;
1667 		sc->re_ldata.re_tx_free -= nsegs;
1668 		sc->re_ldata.re_tx_nextfree = curdesc;
1669 
1670 		/*
1671 		 * If there's a BPF listener, bounce a copy of this frame
1672 		 * to him.
1673 		 */
1674 		bpf_mtap(ifp, m);
1675 	}
1676 
1677 	if (sc->re_ldata.re_txq_free < ofree) {
1678 		/*
1679 		 * TX packets are enqueued.
1680 		 */
1681 		sc->re_ldata.re_txq_prodidx = idx;
1682 
1683 		/*
1684 		 * Start the transmitter to poll.
1685 		 *
1686 		 * RealTek put the TX poll request register in a different
1687 		 * location on the 8169 gigE chip. I don't know why.
1688 		 */
1689 		if ((sc->sc_quirk & RTKQ_8139CPLUS) != 0)
1690 			CSR_WRITE_1(sc, RTK_TXSTART, RTK_TXSTART_START);
1691 		else
1692 			CSR_WRITE_1(sc, RTK_GTXSTART, RTK_TXSTART_START);
1693 
1694 		/*
1695 		 * Use the countdown timer for interrupt moderation.
1696 		 * 'TX done' interrupts are disabled. Instead, we reset the
1697 		 * countdown timer, which will begin counting until it hits
1698 		 * the value in the TIMERINT register, and then trigger an
1699 		 * interrupt. Each time we write to the TIMERCNT register,
1700 		 * the timer count is reset to 0.
1701 		 */
1702 		CSR_WRITE_4(sc, RTK_TIMERCNT, 1);
1703 
1704 		/*
1705 		 * Set a timeout in case the chip goes out to lunch.
1706 		 */
1707 		ifp->if_timer = 5;
1708 	}
1709 }
1710 
1711 static int
1712 re_init(struct ifnet *ifp)
1713 {
1714 	struct rtk_softc *sc = ifp->if_softc;
1715 	const uint8_t *enaddr;
1716 	uint32_t rxcfg = 0;
1717 	uint32_t reg;
1718 	uint16_t cfg;
1719 	int error;
1720 
1721 	if ((error = re_enable(sc)) != 0)
1722 		goto out;
1723 
1724 	/*
1725 	 * Cancel pending I/O and free all RX/TX buffers.
1726 	 */
1727 	re_stop(ifp, 0);
1728 
1729 	re_reset(sc);
1730 
1731 	/*
1732 	 * Enable C+ RX and TX mode, as well as VLAN stripping and
1733 	 * RX checksum offload. We must configure the C+ register
1734 	 * before all others.
1735 	 */
1736 	cfg = RE_CPLUSCMD_PCI_MRW;
1737 
1738 	/*
1739 	 * XXX: For old 8169 set bit 14.
1740 	 *      For 8169S/8110S and above, do not set bit 14.
1741 	 */
1742 	if ((sc->sc_quirk & RTKQ_8169NONS) != 0)
1743 		cfg |= (0x1 << 14);
1744 
1745 	if ((sc->ethercom.ec_capenable & ETHERCAP_VLAN_HWTAGGING) != 0)
1746 		cfg |= RE_CPLUSCMD_VLANSTRIP;
1747 	if ((ifp->if_capenable & (IFCAP_CSUM_IPv4_Rx |
1748 	     IFCAP_CSUM_TCPv4_Rx | IFCAP_CSUM_UDPv4_Rx)) != 0)
1749 		cfg |= RE_CPLUSCMD_RXCSUM_ENB;
1750 	if ((sc->sc_quirk & RTKQ_MACSTAT) != 0) {
1751 		cfg |= RE_CPLUSCMD_MACSTAT_DIS;
1752 		cfg |= RE_CPLUSCMD_TXENB;
1753 	} else
1754 		cfg |= RE_CPLUSCMD_RXENB | RE_CPLUSCMD_TXENB;
1755 
1756 	CSR_WRITE_2(sc, RTK_CPLUS_CMD, cfg);
1757 
1758 	/* XXX: from Realtek-supplied Linux driver. Wholly undocumented. */
1759 	if ((sc->sc_quirk & RTKQ_8139CPLUS) == 0)
1760 		CSR_WRITE_2(sc, RTK_IM, 0x0000);
1761 
1762 	DELAY(10000);
1763 
1764 	/*
1765 	 * Init our MAC address.  Even though the chipset
1766 	 * documentation doesn't mention it, we need to enter "Config
1767 	 * register write enable" mode to modify the ID registers.
1768 	 */
1769 	CSR_WRITE_1(sc, RTK_EECMD, RTK_EEMODE_WRITECFG);
1770 	enaddr = CLLADDR(ifp->if_sadl);
1771 	reg = enaddr[0] | (enaddr[1] << 8) |
1772 	    (enaddr[2] << 16) | (enaddr[3] << 24);
1773 	CSR_WRITE_4(sc, RTK_IDR0, reg);
1774 	reg = enaddr[4] | (enaddr[5] << 8);
1775 	CSR_WRITE_4(sc, RTK_IDR4, reg);
1776 	CSR_WRITE_1(sc, RTK_EECMD, RTK_EEMODE_OFF);
1777 
1778 	/*
1779 	 * For C+ mode, initialize the RX descriptors and mbufs.
1780 	 */
1781 	re_rx_list_init(sc);
1782 	re_tx_list_init(sc);
1783 
1784 	/*
1785 	 * Load the addresses of the RX and TX lists into the chip.
1786 	 */
1787 	CSR_WRITE_4(sc, RTK_RXLIST_ADDR_HI,
1788 	    RE_ADDR_HI(sc->re_ldata.re_rx_list_map->dm_segs[0].ds_addr));
1789 	CSR_WRITE_4(sc, RTK_RXLIST_ADDR_LO,
1790 	    RE_ADDR_LO(sc->re_ldata.re_rx_list_map->dm_segs[0].ds_addr));
1791 
1792 	CSR_WRITE_4(sc, RTK_TXLIST_ADDR_HI,
1793 	    RE_ADDR_HI(sc->re_ldata.re_tx_list_map->dm_segs[0].ds_addr));
1794 	CSR_WRITE_4(sc, RTK_TXLIST_ADDR_LO,
1795 	    RE_ADDR_LO(sc->re_ldata.re_tx_list_map->dm_segs[0].ds_addr));
1796 
1797 	/*
1798 	 * Enable transmit and receive.
1799 	 */
1800 	CSR_WRITE_1(sc, RTK_COMMAND, RTK_CMD_TX_ENB | RTK_CMD_RX_ENB);
1801 
1802 	/*
1803 	 * Set the initial TX and RX configuration.
1804 	 */
1805 	if (sc->re_testmode && (sc->sc_quirk & RTKQ_8169NONS) != 0) {
1806 		/* test mode is needed only for old 8169 */
1807 		CSR_WRITE_4(sc, RTK_TXCFG,
1808 		    RE_TXCFG_CONFIG | RTK_LOOPTEST_ON);
1809 	} else
1810 		CSR_WRITE_4(sc, RTK_TXCFG, RE_TXCFG_CONFIG);
1811 
1812 	CSR_WRITE_1(sc, RTK_EARLY_TX_THRESH, 16);
1813 
1814 	CSR_WRITE_4(sc, RTK_RXCFG, RE_RXCFG_CONFIG);
1815 
1816 	/* Set the individual bit to receive frames for this host only. */
1817 	rxcfg = CSR_READ_4(sc, RTK_RXCFG);
1818 	rxcfg |= RTK_RXCFG_RX_INDIV;
1819 
1820 	/* If we want promiscuous mode, set the allframes bit. */
1821 	if (ifp->if_flags & IFF_PROMISC)
1822 		rxcfg |= RTK_RXCFG_RX_ALLPHYS;
1823 	else
1824 		rxcfg &= ~RTK_RXCFG_RX_ALLPHYS;
1825 	CSR_WRITE_4(sc, RTK_RXCFG, rxcfg);
1826 
1827 	/*
1828 	 * Set capture broadcast bit to capture broadcast frames.
1829 	 */
1830 	if (ifp->if_flags & IFF_BROADCAST)
1831 		rxcfg |= RTK_RXCFG_RX_BROAD;
1832 	else
1833 		rxcfg &= ~RTK_RXCFG_RX_BROAD;
1834 	CSR_WRITE_4(sc, RTK_RXCFG, rxcfg);
1835 
1836 	/*
1837 	 * Program the multicast filter, if necessary.
1838 	 */
1839 	rtk_setmulti(sc);
1840 
1841 	/*
1842 	 * Enable interrupts.
1843 	 */
1844 	if (sc->re_testmode)
1845 		CSR_WRITE_2(sc, RTK_IMR, 0);
1846 	else
1847 		CSR_WRITE_2(sc, RTK_IMR, RTK_INTRS_CPLUS);
1848 
1849 	/* Start RX/TX process. */
1850 	CSR_WRITE_4(sc, RTK_MISSEDPKT, 0);
1851 #ifdef notdef
1852 	/* Enable receiver and transmitter. */
1853 	CSR_WRITE_1(sc, RTK_COMMAND, RTK_CMD_TX_ENB | RTK_CMD_RX_ENB);
1854 #endif
1855 
1856 	/*
1857 	 * Initialize the timer interrupt register so that
1858 	 * a timer interrupt will be generated once the timer
1859 	 * reaches a certain number of ticks. The timer is
1860 	 * reloaded on each transmit. This gives us TX interrupt
1861 	 * moderation, which dramatically improves TX frame rate.
1862 	 */
1863 
1864 	if ((sc->sc_quirk & RTKQ_8139CPLUS) != 0)
1865 		CSR_WRITE_4(sc, RTK_TIMERINT, 0x400);
1866 	else {
1867 		CSR_WRITE_4(sc, RTK_TIMERINT_8169, 0x800);
1868 
1869 		/*
1870 		 * For 8169 gigE NICs, set the max allowed RX packet
1871 		 * size so we can receive jumbo frames.
1872 		 */
1873 		CSR_WRITE_2(sc, RTK_MAXRXPKTLEN, 16383);
1874 	}
1875 
1876 	if (sc->re_testmode)
1877 		return 0;
1878 
1879 	CSR_WRITE_1(sc, RTK_CFG1, RTK_CFG1_DRVLOAD);
1880 
1881 	ifp->if_flags |= IFF_RUNNING;
1882 	ifp->if_flags &= ~IFF_OACTIVE;
1883 
1884 	callout_reset(&sc->rtk_tick_ch, hz, re_tick, sc);
1885 
1886  out:
1887 	if (error) {
1888 		ifp->if_flags &= ~(IFF_RUNNING | IFF_OACTIVE);
1889 		ifp->if_timer = 0;
1890 		printf("%s: interface not running\n",
1891 		    device_xname(sc->sc_dev));
1892 	}
1893 
1894 	return error;
1895 }
1896 
1897 static int
1898 re_ioctl(struct ifnet *ifp, u_long command, void *data)
1899 {
1900 	struct rtk_softc *sc = ifp->if_softc;
1901 	struct ifreq *ifr = data;
1902 	int s, error = 0;
1903 
1904 	s = splnet();
1905 
1906 	switch (command) {
1907 	case SIOCSIFMTU:
1908 		/*
1909 		 * Disable jumbo frames if it's not supported.
1910 		 */
1911 		if ((sc->sc_quirk & RTKQ_NOJUMBO) != 0 &&
1912 		    ifr->ifr_mtu > ETHERMTU) {
1913 			error = EINVAL;
1914 			break;
1915 		}
1916 
1917 		if (ifr->ifr_mtu < ETHERMIN || ifr->ifr_mtu > ETHERMTU_JUMBO)
1918 			error = EINVAL;
1919 		else if ((error = ifioctl_common(ifp, command, data)) ==
1920 		    ENETRESET)
1921 			error = 0;
1922 		break;
1923 	default:
1924 		if ((error = ether_ioctl(ifp, command, data)) != ENETRESET)
1925 			break;
1926 
1927 		error = 0;
1928 
1929 		if (command == SIOCSIFCAP)
1930 			error = (*ifp->if_init)(ifp);
1931 		else if (command != SIOCADDMULTI && command != SIOCDELMULTI)
1932 			;
1933 		else if (ifp->if_flags & IFF_RUNNING)
1934 			rtk_setmulti(sc);
1935 		break;
1936 	}
1937 
1938 	splx(s);
1939 
1940 	return error;
1941 }
1942 
1943 static void
1944 re_watchdog(struct ifnet *ifp)
1945 {
1946 	struct rtk_softc *sc;
1947 	int s;
1948 
1949 	sc = ifp->if_softc;
1950 	s = splnet();
1951 	printf("%s: watchdog timeout\n", device_xname(sc->sc_dev));
1952 	ifp->if_oerrors++;
1953 
1954 	re_txeof(sc);
1955 	re_rxeof(sc);
1956 
1957 	re_init(ifp);
1958 
1959 	splx(s);
1960 }
1961 
1962 /*
1963  * Stop the adapter and free any mbufs allocated to the
1964  * RX and TX lists.
1965  */
1966 static void
1967 re_stop(struct ifnet *ifp, int disable)
1968 {
1969 	int i;
1970 	struct rtk_softc *sc = ifp->if_softc;
1971 
1972 	callout_stop(&sc->rtk_tick_ch);
1973 
1974 	mii_down(&sc->mii);
1975 
1976 	if ((sc->sc_quirk & RTKQ_CMDSTOP) != 0)
1977 		CSR_WRITE_1(sc, RTK_COMMAND, RTK_CMD_STOPREQ | RTK_CMD_TX_ENB |
1978 		    RTK_CMD_RX_ENB);
1979 	else
1980 		CSR_WRITE_1(sc, RTK_COMMAND, 0x00);
1981 	DELAY(1000);
1982 	CSR_WRITE_2(sc, RTK_IMR, 0x0000);
1983 	CSR_WRITE_2(sc, RTK_ISR, 0xFFFF);
1984 
1985 	if (sc->re_head != NULL) {
1986 		m_freem(sc->re_head);
1987 		sc->re_head = sc->re_tail = NULL;
1988 	}
1989 
1990 	/* Free the TX list buffers. */
1991 	for (i = 0; i < RE_TX_QLEN; i++) {
1992 		if (sc->re_ldata.re_txq[i].txq_mbuf != NULL) {
1993 			bus_dmamap_unload(sc->sc_dmat,
1994 			    sc->re_ldata.re_txq[i].txq_dmamap);
1995 			m_freem(sc->re_ldata.re_txq[i].txq_mbuf);
1996 			sc->re_ldata.re_txq[i].txq_mbuf = NULL;
1997 		}
1998 	}
1999 
2000 	/* Free the RX list buffers. */
2001 	for (i = 0; i < RE_RX_DESC_CNT; i++) {
2002 		if (sc->re_ldata.re_rxsoft[i].rxs_mbuf != NULL) {
2003 			bus_dmamap_unload(sc->sc_dmat,
2004 			    sc->re_ldata.re_rxsoft[i].rxs_dmamap);
2005 			m_freem(sc->re_ldata.re_rxsoft[i].rxs_mbuf);
2006 			sc->re_ldata.re_rxsoft[i].rxs_mbuf = NULL;
2007 		}
2008 	}
2009 
2010 	if (disable)
2011 		re_disable(sc);
2012 
2013 	ifp->if_flags &= ~(IFF_RUNNING | IFF_OACTIVE);
2014 	ifp->if_timer = 0;
2015 }
2016