xref: /netbsd-src/sys/dev/ic/rtl8169.c (revision f3cfa6f6ce31685c6c4a758bc430e69eb99f50a4)
1 /*	$NetBSD: rtl8169.c,v 1.159 2019/05/30 02:32:18 msaitoh Exp $	*/
2 
3 /*
4  * Copyright (c) 1997, 1998-2003
5  *	Bill Paul <wpaul@windriver.com>.  All rights reserved.
6  *
7  * Redistribution and use in source and binary forms, with or without
8  * modification, are permitted provided that the following conditions
9  * are met:
10  * 1. Redistributions of source code must retain the above copyright
11  *    notice, this list of conditions and the following disclaimer.
12  * 2. Redistributions in binary form must reproduce the above copyright
13  *    notice, this list of conditions and the following disclaimer in the
14  *    documentation and/or other materials provided with the distribution.
15  * 3. All advertising materials mentioning features or use of this software
16  *    must display the following acknowledgement:
17  *	This product includes software developed by Bill Paul.
18  * 4. Neither the name of the author nor the names of any co-contributors
19  *    may be used to endorse or promote products derived from this software
20  *    without specific prior written permission.
21  *
22  * THIS SOFTWARE IS PROVIDED BY Bill Paul AND CONTRIBUTORS ``AS IS'' AND
23  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
24  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
25  * ARE DISCLAIMED.  IN NO EVENT SHALL Bill Paul OR THE VOICES IN HIS HEAD
26  * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
27  * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
28  * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
29  * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
30  * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
31  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
32  * THE POSSIBILITY OF SUCH DAMAGE.
33  */
34 
35 #include <sys/cdefs.h>
36 __KERNEL_RCSID(0, "$NetBSD: rtl8169.c,v 1.159 2019/05/30 02:32:18 msaitoh Exp $");
37 /* $FreeBSD: /repoman/r/ncvs/src/sys/dev/re/if_re.c,v 1.20 2004/04/11 20:34:08 ru Exp $ */
38 
39 /*
40  * RealTek 8139C+/8169/8169S/8168/8110S PCI NIC driver
41  *
42  * Written by Bill Paul <wpaul@windriver.com>
43  * Senior Networking Software Engineer
44  * Wind River Systems
45  */
46 
47 /*
48  * This driver is designed to support RealTek's next generation of
49  * 10/100 and 10/100/1000 PCI ethernet controllers. There are currently
50  * six devices in this family: the RTL8139C+, the RTL8169, the RTL8169S,
51  * RTL8110S, the RTL8168 and the RTL8111.
52  *
53  * The 8139C+ is a 10/100 ethernet chip. It is backwards compatible
54  * with the older 8139 family, however it also supports a special
55  * C+ mode of operation that provides several new performance enhancing
56  * features. These include:
57  *
58  *	o Descriptor based DMA mechanism. Each descriptor represents
59  *	  a single packet fragment. Data buffers may be aligned on
60  *	  any byte boundary.
61  *
62  *	o 64-bit DMA
63  *
64  *	o TCP/IP checksum offload for both RX and TX
65  *
66  *	o High and normal priority transmit DMA rings
67  *
68  *	o VLAN tag insertion and extraction
69  *
70  *	o TCP large send (segmentation offload)
71  *
72  * Like the 8139, the 8139C+ also has a built-in 10/100 PHY. The C+
73  * programming API is fairly straightforward. The RX filtering, EEPROM
74  * access and PHY access is the same as it is on the older 8139 series
75  * chips.
76  *
77  * The 8169 is a 64-bit 10/100/1000 gigabit ethernet MAC. It has almost the
78  * same programming API and feature set as the 8139C+ with the following
79  * differences and additions:
80  *
81  *	o 1000Mbps mode
82  *
83  *	o Jumbo frames
84  *
85  *	o GMII and TBI ports/registers for interfacing with copper
86  *	  or fiber PHYs
87  *
88  *      o RX and TX DMA rings can have up to 1024 descriptors
89  *        (the 8139C+ allows a maximum of 64)
90  *
91  *	o Slight differences in register layout from the 8139C+
92  *
93  * The TX start and timer interrupt registers are at different locations
94  * on the 8169 than they are on the 8139C+. Also, the status word in the
95  * RX descriptor has a slightly different bit layout. The 8169 does not
96  * have a built-in PHY. Most reference boards use a Marvell 88E1000 'Alaska'
97  * copper gigE PHY.
98  *
99  * The 8169S/8110S 10/100/1000 devices have built-in copper gigE PHYs
100  * (the 'S' stands for 'single-chip'). These devices have the same
101  * programming API as the older 8169, but also have some vendor-specific
102  * registers for the on-board PHY. The 8110S is a LAN-on-motherboard
103  * part designed to be pin-compatible with the RealTek 8100 10/100 chip.
104  *
105  * This driver takes advantage of the RX and TX checksum offload and
106  * VLAN tag insertion/extraction features. It also implements TX
107  * interrupt moderation using the timer interrupt registers, which
108  * significantly reduces TX interrupt load. There is also support
109  * for jumbo frames, however the 8169/8169S/8110S can not transmit
110  * jumbo frames larger than 7.5K, so the max MTU possible with this
111  * driver is 7500 bytes.
112  */
113 
114 
115 #include <sys/param.h>
116 #include <sys/endian.h>
117 #include <sys/systm.h>
118 #include <sys/sockio.h>
119 #include <sys/mbuf.h>
120 #include <sys/malloc.h>
121 #include <sys/kernel.h>
122 #include <sys/socket.h>
123 #include <sys/device.h>
124 
125 #include <net/if.h>
126 #include <net/if_arp.h>
127 #include <net/if_dl.h>
128 #include <net/if_ether.h>
129 #include <net/if_media.h>
130 #include <net/if_vlanvar.h>
131 
132 #include <netinet/in_systm.h>	/* XXX for IP_MAXPACKET */
133 #include <netinet/in.h>		/* XXX for IP_MAXPACKET */
134 #include <netinet/ip.h>		/* XXX for IP_MAXPACKET */
135 
136 #include <net/bpf.h>
137 #include <sys/rndsource.h>
138 
139 #include <sys/bus.h>
140 
141 #include <dev/mii/mii.h>
142 #include <dev/mii/miivar.h>
143 
144 #include <dev/ic/rtl81x9reg.h>
145 #include <dev/ic/rtl81x9var.h>
146 
147 #include <dev/ic/rtl8169var.h>
148 
149 static inline void re_set_bufaddr(struct re_desc *, bus_addr_t);
150 
151 static int re_newbuf(struct rtk_softc *, int, struct mbuf *);
152 static int re_rx_list_init(struct rtk_softc *);
153 static int re_tx_list_init(struct rtk_softc *);
154 static void re_rxeof(struct rtk_softc *);
155 static void re_txeof(struct rtk_softc *);
156 static void re_tick(void *);
157 static void re_start(struct ifnet *);
158 static int re_ioctl(struct ifnet *, u_long, void *);
159 static int re_init(struct ifnet *);
160 static void re_stop(struct ifnet *, int);
161 static void re_watchdog(struct ifnet *);
162 
163 static int re_enable(struct rtk_softc *);
164 static void re_disable(struct rtk_softc *);
165 
166 static int re_gmii_readreg(device_t, int, int, uint16_t *);
167 static int re_gmii_writereg(device_t, int, int, uint16_t);
168 
169 static int re_miibus_readreg(device_t, int, int, uint16_t *);
170 static int re_miibus_writereg(device_t, int, int, uint16_t);
171 static void re_miibus_statchg(struct ifnet *);
172 
173 static void re_reset(struct rtk_softc *);
174 
175 static inline void
176 re_set_bufaddr(struct re_desc *d, bus_addr_t addr)
177 {
178 
179 	d->re_bufaddr_lo = htole32((uint32_t)addr);
180 	if (sizeof(bus_addr_t) == sizeof(uint64_t))
181 		d->re_bufaddr_hi = htole32((uint64_t)addr >> 32);
182 	else
183 		d->re_bufaddr_hi = 0;
184 }
185 
186 static int
187 re_gmii_readreg(device_t dev, int phy, int reg, uint16_t *val)
188 {
189 	struct rtk_softc *sc = device_private(dev);
190 	uint32_t data;
191 	int i;
192 
193 	if (phy != 7)
194 		return -1;
195 
196 	/* Let the rgephy driver read the GMEDIASTAT register */
197 
198 	if (reg == RTK_GMEDIASTAT) {
199 		*val = CSR_READ_1(sc, RTK_GMEDIASTAT);
200 		return 0;
201 	}
202 
203 	CSR_WRITE_4(sc, RTK_PHYAR, reg << 16);
204 	DELAY(1000);
205 
206 	for (i = 0; i < RTK_TIMEOUT; i++) {
207 		data = CSR_READ_4(sc, RTK_PHYAR);
208 		if (data & RTK_PHYAR_BUSY)
209 			break;
210 		DELAY(100);
211 	}
212 
213 	if (i == RTK_TIMEOUT) {
214 		printf("%s: PHY read failed\n", device_xname(sc->sc_dev));
215 		return ETIMEDOUT;
216 	}
217 
218 	*val = data & RTK_PHYAR_PHYDATA;
219 	return 0;
220 }
221 
222 static int
223 re_gmii_writereg(device_t dev, int phy, int reg, uint16_t val)
224 {
225 	struct rtk_softc *sc = device_private(dev);
226 	uint32_t data;
227 	int i;
228 
229 	CSR_WRITE_4(sc, RTK_PHYAR, (reg << 16) |
230 	    (val & RTK_PHYAR_PHYDATA) | RTK_PHYAR_BUSY);
231 	DELAY(1000);
232 
233 	for (i = 0; i < RTK_TIMEOUT; i++) {
234 		data = CSR_READ_4(sc, RTK_PHYAR);
235 		if (!(data & RTK_PHYAR_BUSY))
236 			break;
237 		DELAY(100);
238 	}
239 
240 	if (i == RTK_TIMEOUT) {
241 		printf("%s: PHY write reg %x <- %hx failed\n",
242 		    device_xname(sc->sc_dev), reg, val);
243 		return ETIMEDOUT;
244 	}
245 
246 	return 0;
247 }
248 
249 static int
250 re_miibus_readreg(device_t dev, int phy, int reg, uint16_t *val)
251 {
252 	struct rtk_softc *sc = device_private(dev);
253 	uint16_t re8139_reg = 0;
254 	int s, rv = 0;
255 
256 	s = splnet();
257 
258 	if ((sc->sc_quirk & RTKQ_8139CPLUS) == 0) {
259 		rv = re_gmii_readreg(dev, phy, reg, val);
260 		splx(s);
261 		return rv;
262 	}
263 
264 	/* Pretend the internal PHY is only at address 0 */
265 	if (phy) {
266 		splx(s);
267 		return -1;
268 	}
269 	switch (reg) {
270 	case MII_BMCR:
271 		re8139_reg = RTK_BMCR;
272 		break;
273 	case MII_BMSR:
274 		re8139_reg = RTK_BMSR;
275 		break;
276 	case MII_ANAR:
277 		re8139_reg = RTK_ANAR;
278 		break;
279 	case MII_ANER:
280 		re8139_reg = RTK_ANER;
281 		break;
282 	case MII_ANLPAR:
283 		re8139_reg = RTK_LPAR;
284 		break;
285 	case MII_PHYIDR1:
286 	case MII_PHYIDR2:
287 		*val = 0;
288 		splx(s);
289 		return 0;
290 	/*
291 	 * Allow the rlphy driver to read the media status
292 	 * register. If we have a link partner which does not
293 	 * support NWAY, this is the register which will tell
294 	 * us the results of parallel detection.
295 	 */
296 	case RTK_MEDIASTAT:
297 		*val = CSR_READ_1(sc, RTK_MEDIASTAT);
298 		splx(s);
299 		return 0;
300 	default:
301 		printf("%s: bad phy register\n", device_xname(sc->sc_dev));
302 		splx(s);
303 		return -1;
304 	}
305 	*val = CSR_READ_2(sc, re8139_reg);
306 	if ((sc->sc_quirk & RTKQ_8139CPLUS) != 0 && re8139_reg == RTK_BMCR) {
307 		/* 8139C+ has different bit layout. */
308 		*val &= ~(BMCR_LOOP | BMCR_ISO);
309 	}
310 	splx(s);
311 	return 0;
312 }
313 
314 static int
315 re_miibus_writereg(device_t dev, int phy, int reg, uint16_t val)
316 {
317 	struct rtk_softc *sc = device_private(dev);
318 	uint16_t re8139_reg = 0;
319 	int s, rv;
320 
321 	s = splnet();
322 
323 	if ((sc->sc_quirk & RTKQ_8139CPLUS) == 0) {
324 		rv = re_gmii_writereg(dev, phy, reg, val);
325 		splx(s);
326 		return rv;
327 	}
328 
329 	/* Pretend the internal PHY is only at address 0 */
330 	if (phy) {
331 		splx(s);
332 		return -1;
333 	}
334 	switch (reg) {
335 	case MII_BMCR:
336 		re8139_reg = RTK_BMCR;
337 		if ((sc->sc_quirk & RTKQ_8139CPLUS) != 0) {
338 			/* 8139C+ has different bit layout. */
339 			val &= ~(BMCR_LOOP | BMCR_ISO);
340 		}
341 		break;
342 	case MII_BMSR:
343 		re8139_reg = RTK_BMSR;
344 		break;
345 	case MII_ANAR:
346 		re8139_reg = RTK_ANAR;
347 		break;
348 	case MII_ANER:
349 		re8139_reg = RTK_ANER;
350 		break;
351 	case MII_ANLPAR:
352 		re8139_reg = RTK_LPAR;
353 		break;
354 	case MII_PHYIDR1:
355 	case MII_PHYIDR2:
356 		splx(s);
357 		return 0;
358 		break;
359 	default:
360 		printf("%s: bad phy register\n", device_xname(sc->sc_dev));
361 		splx(s);
362 		return -1;
363 	}
364 	CSR_WRITE_2(sc, re8139_reg, val);
365 	splx(s);
366 	return 0;
367 }
368 
369 static void
370 re_miibus_statchg(struct ifnet *ifp)
371 {
372 
373 	return;
374 }
375 
376 static void
377 re_reset(struct rtk_softc *sc)
378 {
379 	int i;
380 
381 	CSR_WRITE_1(sc, RTK_COMMAND, RTK_CMD_RESET);
382 
383 	for (i = 0; i < RTK_TIMEOUT; i++) {
384 		DELAY(10);
385 		if ((CSR_READ_1(sc, RTK_COMMAND) & RTK_CMD_RESET) == 0)
386 			break;
387 	}
388 	if (i == RTK_TIMEOUT)
389 		printf("%s: reset never completed!\n",
390 		    device_xname(sc->sc_dev));
391 
392 	/*
393 	 * NB: Realtek-supplied FreeBSD driver does this only for MACFG_3,
394 	 *     but also says "Rtl8169s sigle chip detected".
395 	 */
396 	if ((sc->sc_quirk & RTKQ_MACLDPS) != 0)
397 		CSR_WRITE_1(sc, RTK_LDPS, 1);
398 
399 }
400 
401 /*
402  * The following routine is designed to test for a defect on some
403  * 32-bit 8169 cards. Some of these NICs have the REQ64# and ACK64#
404  * lines connected to the bus, however for a 32-bit only card, they
405  * should be pulled high. The result of this defect is that the
406  * NIC will not work right if you plug it into a 64-bit slot: DMA
407  * operations will be done with 64-bit transfers, which will fail
408  * because the 64-bit data lines aren't connected.
409  *
410  * There's no way to work around this (short of talking a soldering
411  * iron to the board), however we can detect it. The method we use
412  * here is to put the NIC into digital loopback mode, set the receiver
413  * to promiscuous mode, and then try to send a frame. We then compare
414  * the frame data we sent to what was received. If the data matches,
415  * then the NIC is working correctly, otherwise we know the user has
416  * a defective NIC which has been mistakenly plugged into a 64-bit PCI
417  * slot. In the latter case, there's no way the NIC can work correctly,
418  * so we print out a message on the console and abort the device attach.
419  */
420 
421 int
422 re_diag(struct rtk_softc *sc)
423 {
424 	struct ifnet *ifp = &sc->ethercom.ec_if;
425 	struct mbuf *m0;
426 	struct ether_header *eh;
427 	struct re_rxsoft *rxs;
428 	struct re_desc *cur_rx;
429 	bus_dmamap_t dmamap;
430 	uint16_t status;
431 	uint32_t rxstat;
432 	int total_len, i, s, error = 0;
433 	static const uint8_t dst[] = { 0x00, 'h', 'e', 'l', 'l', 'o' };
434 	static const uint8_t src[] = { 0x00, 'w', 'o', 'r', 'l', 'd' };
435 
436 	/* Allocate a single mbuf */
437 
438 	MGETHDR(m0, M_DONTWAIT, MT_DATA);
439 	if (m0 == NULL)
440 		return ENOBUFS;
441 
442 	/*
443 	 * Initialize the NIC in test mode. This sets the chip up
444 	 * so that it can send and receive frames, but performs the
445 	 * following special functions:
446 	 * - Puts receiver in promiscuous mode
447 	 * - Enables digital loopback mode
448 	 * - Leaves interrupts turned off
449 	 */
450 
451 	ifp->if_flags |= IFF_PROMISC;
452 	sc->re_testmode = 1;
453 	re_init(ifp);
454 	re_stop(ifp, 0);
455 	DELAY(100000);
456 	re_init(ifp);
457 
458 	/* Put some data in the mbuf */
459 
460 	eh = mtod(m0, struct ether_header *);
461 	memcpy(eh->ether_dhost, &dst, ETHER_ADDR_LEN);
462 	memcpy(eh->ether_shost, &src, ETHER_ADDR_LEN);
463 	eh->ether_type = htons(ETHERTYPE_IP);
464 	m0->m_pkthdr.len = m0->m_len = ETHER_MIN_LEN - ETHER_CRC_LEN;
465 
466 	/*
467 	 * Queue the packet, start transmission.
468 	 */
469 
470 	CSR_WRITE_2(sc, RTK_ISR, 0xFFFF);
471 	s = splnet();
472 	IF_ENQUEUE(&ifp->if_snd, m0);
473 	re_start(ifp);
474 	splx(s);
475 	m0 = NULL;
476 
477 	/* Wait for it to propagate through the chip */
478 
479 	DELAY(100000);
480 	for (i = 0; i < RTK_TIMEOUT; i++) {
481 		status = CSR_READ_2(sc, RTK_ISR);
482 		if ((status & (RTK_ISR_TIMEOUT_EXPIRED | RTK_ISR_RX_OK)) ==
483 		    (RTK_ISR_TIMEOUT_EXPIRED | RTK_ISR_RX_OK))
484 			break;
485 		DELAY(10);
486 	}
487 	if (i == RTK_TIMEOUT) {
488 		aprint_error_dev(sc->sc_dev,
489 		    "diagnostic failed, failed to receive packet "
490 		    "in loopback mode\n");
491 		error = EIO;
492 		goto done;
493 	}
494 
495 	/*
496 	 * The packet should have been dumped into the first
497 	 * entry in the RX DMA ring. Grab it from there.
498 	 */
499 
500 	rxs = &sc->re_ldata.re_rxsoft[0];
501 	dmamap = rxs->rxs_dmamap;
502 	bus_dmamap_sync(sc->sc_dmat, dmamap, 0, dmamap->dm_mapsize,
503 	    BUS_DMASYNC_POSTREAD);
504 	bus_dmamap_unload(sc->sc_dmat, dmamap);
505 
506 	m0 = rxs->rxs_mbuf;
507 	rxs->rxs_mbuf = NULL;
508 	eh = mtod(m0, struct ether_header *);
509 
510 	RE_RXDESCSYNC(sc, 0, BUS_DMASYNC_POSTREAD|BUS_DMASYNC_POSTWRITE);
511 	cur_rx = &sc->re_ldata.re_rx_list[0];
512 	rxstat = le32toh(cur_rx->re_cmdstat);
513 	total_len = rxstat & sc->re_rxlenmask;
514 
515 	if (total_len != ETHER_MIN_LEN) {
516 		aprint_error_dev(sc->sc_dev,
517 		    "diagnostic failed, received short packet\n");
518 		error = EIO;
519 		goto done;
520 	}
521 
522 	/* Test that the received packet data matches what we sent. */
523 
524 	if (memcmp(&eh->ether_dhost, &dst, ETHER_ADDR_LEN) ||
525 	    memcmp(&eh->ether_shost, &src, ETHER_ADDR_LEN) ||
526 	    ntohs(eh->ether_type) != ETHERTYPE_IP) {
527 		aprint_error_dev(sc->sc_dev, "WARNING, DMA FAILURE!\n"
528 		    "expected TX data: %s/%s/0x%x\n"
529 		    "received RX data: %s/%s/0x%x\n"
530 		    "You may have a defective 32-bit NIC plugged "
531 		    "into a 64-bit PCI slot.\n"
532 		    "Please re-install the NIC in a 32-bit slot "
533 		    "for proper operation.\n"
534 		    "Read the re(4) man page for more details.\n" ,
535 		    ether_sprintf(dst),  ether_sprintf(src), ETHERTYPE_IP,
536 		    ether_sprintf(eh->ether_dhost),
537 		    ether_sprintf(eh->ether_shost), ntohs(eh->ether_type));
538 		error = EIO;
539 	}
540 
541  done:
542 	/* Turn interface off, release resources */
543 
544 	sc->re_testmode = 0;
545 	ifp->if_flags &= ~IFF_PROMISC;
546 	re_stop(ifp, 0);
547 	if (m0 != NULL)
548 		m_freem(m0);
549 
550 	return error;
551 }
552 
553 
554 /*
555  * Attach the interface. Allocate softc structures, do ifmedia
556  * setup and ethernet/BPF attach.
557  */
558 void
559 re_attach(struct rtk_softc *sc)
560 {
561 	uint8_t eaddr[ETHER_ADDR_LEN];
562 	struct ifnet *ifp;
563 	struct mii_data *mii = &sc->mii;
564 	int error = 0, i;
565 
566 	if ((sc->sc_quirk & RTKQ_8139CPLUS) == 0) {
567 		uint32_t hwrev;
568 
569 		/* Revision of 8169/8169S/8110s in bits 30..26, 23 */
570 		hwrev = CSR_READ_4(sc, RTK_TXCFG) & RTK_TXCFG_HWREV;
571 		switch (hwrev) {
572 		case RTK_HWREV_8169:
573 			sc->sc_quirk |= RTKQ_8169NONS;
574 			break;
575 		case RTK_HWREV_8169S:
576 		case RTK_HWREV_8110S:
577 		case RTK_HWREV_8169_8110SB:
578 		case RTK_HWREV_8169_8110SBL:
579 		case RTK_HWREV_8169_8110SC:
580 			sc->sc_quirk |= RTKQ_MACLDPS;
581 			break;
582 		case RTK_HWREV_8168_SPIN1:
583 		case RTK_HWREV_8168_SPIN2:
584 		case RTK_HWREV_8168_SPIN3:
585 			sc->sc_quirk |= RTKQ_MACSTAT;
586 			break;
587 		case RTK_HWREV_8168C:
588 		case RTK_HWREV_8168C_SPIN2:
589 		case RTK_HWREV_8168CP:
590 		case RTK_HWREV_8168D:
591 		case RTK_HWREV_8168DP:
592 			sc->sc_quirk |= RTKQ_DESCV2 | RTKQ_NOEECMD |
593 			    RTKQ_MACSTAT | RTKQ_CMDSTOP;
594 			/*
595 			 * From FreeBSD driver:
596 			 *
597 			 * These (8168/8111) controllers support jumbo frame
598 			 * but it seems that enabling it requires touching
599 			 * additional magic registers. Depending on MAC
600 			 * revisions some controllers need to disable
601 			 * checksum offload. So disable jumbo frame until
602 			 * I have better idea what it really requires to
603 			 * make it support.
604 			 * RTL8168C/CP : supports up to 6KB jumbo frame.
605 			 * RTL8111C/CP : supports up to 9KB jumbo frame.
606 			 */
607 			sc->sc_quirk |= RTKQ_NOJUMBO;
608 			break;
609 		case RTK_HWREV_8168E:
610 		case RTK_HWREV_8168H:
611 		case RTK_HWREV_8168H_SPIN1:
612 			sc->sc_quirk |= RTKQ_DESCV2 | RTKQ_NOEECMD |
613 			    RTKQ_MACSTAT | RTKQ_CMDSTOP | RTKQ_PHYWAKE_PM |
614 			    RTKQ_NOJUMBO;
615 			break;
616 		case RTK_HWREV_8168E_VL:
617 		case RTK_HWREV_8168F:
618 			sc->sc_quirk |= RTKQ_DESCV2 | RTKQ_NOEECMD |
619 			    RTKQ_MACSTAT | RTKQ_CMDSTOP | RTKQ_NOJUMBO;
620 			break;
621 		case RTK_HWREV_8168G:
622 		case RTK_HWREV_8168G_SPIN1:
623 		case RTK_HWREV_8168G_SPIN2:
624 		case RTK_HWREV_8168G_SPIN4:
625 			sc->sc_quirk |= RTKQ_DESCV2 | RTKQ_NOEECMD |
626 			    RTKQ_MACSTAT | RTKQ_CMDSTOP | RTKQ_NOJUMBO |
627 			    RTKQ_RXDV_GATED;
628 			break;
629 		case RTK_HWREV_8100E:
630 		case RTK_HWREV_8100E_SPIN2:
631 		case RTK_HWREV_8101E:
632 			sc->sc_quirk |= RTKQ_NOJUMBO;
633 			break;
634 		case RTK_HWREV_8102E:
635 		case RTK_HWREV_8102EL:
636 		case RTK_HWREV_8103E:
637 			sc->sc_quirk |= RTKQ_DESCV2 | RTKQ_NOEECMD |
638 			    RTKQ_MACSTAT | RTKQ_CMDSTOP | RTKQ_NOJUMBO;
639 			break;
640 		default:
641 			aprint_normal_dev(sc->sc_dev,
642 			    "Unknown revision (0x%08x)\n", hwrev);
643 			/* assume the latest features */
644 			sc->sc_quirk |= RTKQ_DESCV2 | RTKQ_NOEECMD;
645 			sc->sc_quirk |= RTKQ_NOJUMBO;
646 		}
647 
648 		/* Set RX length mask */
649 		sc->re_rxlenmask = RE_RDESC_STAT_GFRAGLEN;
650 		sc->re_ldata.re_tx_desc_cnt = RE_TX_DESC_CNT_8169;
651 	} else {
652 		sc->sc_quirk |= RTKQ_NOJUMBO;
653 
654 		/* Set RX length mask */
655 		sc->re_rxlenmask = RE_RDESC_STAT_FRAGLEN;
656 		sc->re_ldata.re_tx_desc_cnt = RE_TX_DESC_CNT_8139;
657 	}
658 
659 	/* Reset the adapter. */
660 	re_reset(sc);
661 
662 	/*
663 	 * RTL81x9 chips automatically read EEPROM to init MAC address,
664 	 * and some NAS override its MAC address per own configuration,
665 	 * so no need to explicitely read EEPROM and set ID registers.
666 	 */
667 #ifdef RE_USE_EECMD
668 	if ((sc->sc_quirk & RTKQ_NOEECMD) != 0) {
669 		/*
670 		 * Get station address from ID registers.
671 		 */
672 		for (i = 0; i < ETHER_ADDR_LEN; i++)
673 			eaddr[i] = CSR_READ_1(sc, RTK_IDR0 + i);
674 	} else {
675 		uint16_t val;
676 		int addr_len;
677 
678 		/*
679 		 * Get station address from the EEPROM.
680 		 */
681 		if (rtk_read_eeprom(sc, RTK_EE_ID, RTK_EEADDR_LEN1) == 0x8129)
682 			addr_len = RTK_EEADDR_LEN1;
683 		else
684 			addr_len = RTK_EEADDR_LEN0;
685 
686 		/*
687 		 * Get station address from the EEPROM.
688 		 */
689 		for (i = 0; i < ETHER_ADDR_LEN / 2; i++) {
690 			val = rtk_read_eeprom(sc, RTK_EE_EADDR0 + i, addr_len);
691 			eaddr[(i * 2) + 0] = val & 0xff;
692 			eaddr[(i * 2) + 1] = val >> 8;
693 		}
694 	}
695 #else
696 	/*
697 	 * Get station address from ID registers.
698 	 */
699 	for (i = 0; i < ETHER_ADDR_LEN; i++)
700 		eaddr[i] = CSR_READ_1(sc, RTK_IDR0 + i);
701 #endif
702 
703 	/* Take PHY out of power down mode. */
704 	if ((sc->sc_quirk & RTKQ_PHYWAKE_PM) != 0)
705 		CSR_WRITE_1(sc, RTK_PMCH, CSR_READ_1(sc, RTK_PMCH) | 0x80);
706 
707 	aprint_normal_dev(sc->sc_dev, "Ethernet address %s\n",
708 	    ether_sprintf(eaddr));
709 
710 	if (sc->re_ldata.re_tx_desc_cnt >
711 	    PAGE_SIZE / sizeof(struct re_desc)) {
712 		sc->re_ldata.re_tx_desc_cnt =
713 		    PAGE_SIZE / sizeof(struct re_desc);
714 	}
715 
716 	aprint_verbose_dev(sc->sc_dev, "using %d tx descriptors\n",
717 	    sc->re_ldata.re_tx_desc_cnt);
718 	KASSERT(RE_NEXT_TX_DESC(sc, RE_TX_DESC_CNT(sc) - 1) == 0);
719 
720 	/* Allocate DMA'able memory for the TX ring */
721 	if ((error = bus_dmamem_alloc(sc->sc_dmat, RE_TX_LIST_SZ(sc),
722 	    RE_RING_ALIGN, 0, &sc->re_ldata.re_tx_listseg, 1,
723 	    &sc->re_ldata.re_tx_listnseg, BUS_DMA_NOWAIT)) != 0) {
724 		aprint_error_dev(sc->sc_dev,
725 		    "can't allocate tx listseg, error = %d\n", error);
726 		goto fail_0;
727 	}
728 
729 	/* Load the map for the TX ring. */
730 	if ((error = bus_dmamem_map(sc->sc_dmat, &sc->re_ldata.re_tx_listseg,
731 	    sc->re_ldata.re_tx_listnseg, RE_TX_LIST_SZ(sc),
732 	    (void **)&sc->re_ldata.re_tx_list,
733 	    BUS_DMA_COHERENT | BUS_DMA_NOWAIT)) != 0) {
734 		aprint_error_dev(sc->sc_dev,
735 		    "can't map tx list, error = %d\n", error);
736 		goto fail_1;
737 	}
738 	memset(sc->re_ldata.re_tx_list, 0, RE_TX_LIST_SZ(sc));
739 
740 	if ((error = bus_dmamap_create(sc->sc_dmat, RE_TX_LIST_SZ(sc), 1,
741 	    RE_TX_LIST_SZ(sc), 0, 0,
742 	    &sc->re_ldata.re_tx_list_map)) != 0) {
743 		aprint_error_dev(sc->sc_dev,
744 		    "can't create tx list map, error = %d\n", error);
745 		goto fail_2;
746 	}
747 
748 
749 	if ((error = bus_dmamap_load(sc->sc_dmat,
750 	    sc->re_ldata.re_tx_list_map, sc->re_ldata.re_tx_list,
751 	    RE_TX_LIST_SZ(sc), NULL, BUS_DMA_NOWAIT)) != 0) {
752 		aprint_error_dev(sc->sc_dev,
753 		    "can't load tx list, error = %d\n", error);
754 		goto fail_3;
755 	}
756 
757 	/* Create DMA maps for TX buffers */
758 	for (i = 0; i < RE_TX_QLEN; i++) {
759 		error = bus_dmamap_create(sc->sc_dmat,
760 		    round_page(IP_MAXPACKET),
761 		    RE_TX_DESC_CNT(sc), RE_TDESC_CMD_FRAGLEN,
762 		    0, 0, &sc->re_ldata.re_txq[i].txq_dmamap);
763 		if (error) {
764 			aprint_error_dev(sc->sc_dev,
765 			    "can't create DMA map for TX\n");
766 			goto fail_4;
767 		}
768 	}
769 
770 	/* Allocate DMA'able memory for the RX ring */
771 	/* XXX see also a comment about RE_RX_DMAMEM_SZ in rtl81x9var.h */
772 	if ((error = bus_dmamem_alloc(sc->sc_dmat,
773 	    RE_RX_DMAMEM_SZ, RE_RING_ALIGN, 0, &sc->re_ldata.re_rx_listseg, 1,
774 	    &sc->re_ldata.re_rx_listnseg, BUS_DMA_NOWAIT)) != 0) {
775 		aprint_error_dev(sc->sc_dev,
776 		    "can't allocate rx listseg, error = %d\n", error);
777 		goto fail_4;
778 	}
779 
780 	/* Load the map for the RX ring. */
781 	if ((error = bus_dmamem_map(sc->sc_dmat, &sc->re_ldata.re_rx_listseg,
782 	    sc->re_ldata.re_rx_listnseg, RE_RX_DMAMEM_SZ,
783 	    (void **)&sc->re_ldata.re_rx_list,
784 	    BUS_DMA_COHERENT | BUS_DMA_NOWAIT)) != 0) {
785 		aprint_error_dev(sc->sc_dev,
786 		    "can't map rx list, error = %d\n", error);
787 		goto fail_5;
788 	}
789 	memset(sc->re_ldata.re_rx_list, 0, RE_RX_DMAMEM_SZ);
790 
791 	if ((error = bus_dmamap_create(sc->sc_dmat,
792 	    RE_RX_DMAMEM_SZ, 1, RE_RX_DMAMEM_SZ, 0, 0,
793 	    &sc->re_ldata.re_rx_list_map)) != 0) {
794 		aprint_error_dev(sc->sc_dev,
795 		    "can't create rx list map, error = %d\n", error);
796 		goto fail_6;
797 	}
798 
799 	if ((error = bus_dmamap_load(sc->sc_dmat,
800 	    sc->re_ldata.re_rx_list_map, sc->re_ldata.re_rx_list,
801 	    RE_RX_DMAMEM_SZ, NULL, BUS_DMA_NOWAIT)) != 0) {
802 		aprint_error_dev(sc->sc_dev,
803 		    "can't load rx list, error = %d\n", error);
804 		goto fail_7;
805 	}
806 
807 	/* Create DMA maps for RX buffers */
808 	for (i = 0; i < RE_RX_DESC_CNT; i++) {
809 		error = bus_dmamap_create(sc->sc_dmat, MCLBYTES, 1, MCLBYTES,
810 		    0, 0, &sc->re_ldata.re_rxsoft[i].rxs_dmamap);
811 		if (error) {
812 			aprint_error_dev(sc->sc_dev,
813 			    "can't create DMA map for RX\n");
814 			goto fail_8;
815 		}
816 	}
817 
818 	/*
819 	 * Record interface as attached. From here, we should not fail.
820 	 */
821 	sc->sc_flags |= RTK_ATTACHED;
822 
823 	ifp = &sc->ethercom.ec_if;
824 	ifp->if_softc = sc;
825 	strlcpy(ifp->if_xname, device_xname(sc->sc_dev), IFNAMSIZ);
826 	ifp->if_mtu = ETHERMTU;
827 	ifp->if_flags = IFF_BROADCAST | IFF_SIMPLEX | IFF_MULTICAST;
828 	ifp->if_ioctl = re_ioctl;
829 	sc->ethercom.ec_capabilities |=
830 	    ETHERCAP_VLAN_MTU | ETHERCAP_VLAN_HWTAGGING;
831 	ifp->if_start = re_start;
832 	ifp->if_stop = re_stop;
833 
834 	/*
835 	 * IFCAP_CSUM_IPv4_Tx on re(4) is broken for small packets,
836 	 * so we have a workaround to handle the bug by padding
837 	 * such packets manually.
838 	 */
839 	ifp->if_capabilities |=
840 	    IFCAP_CSUM_IPv4_Tx | IFCAP_CSUM_IPv4_Rx |
841 	    IFCAP_CSUM_TCPv4_Tx | IFCAP_CSUM_TCPv4_Rx |
842 	    IFCAP_CSUM_UDPv4_Tx | IFCAP_CSUM_UDPv4_Rx |
843 	    IFCAP_TSOv4;
844 
845 	ifp->if_watchdog = re_watchdog;
846 	ifp->if_init = re_init;
847 	ifp->if_snd.ifq_maxlen = RE_IFQ_MAXLEN;
848 	ifp->if_capenable = ifp->if_capabilities;
849 	IFQ_SET_READY(&ifp->if_snd);
850 
851 	callout_init(&sc->rtk_tick_ch, 0);
852 
853 	/* Do MII setup */
854 	mii->mii_ifp = ifp;
855 	mii->mii_readreg = re_miibus_readreg;
856 	mii->mii_writereg = re_miibus_writereg;
857 	mii->mii_statchg = re_miibus_statchg;
858 	sc->ethercom.ec_mii = mii;
859 	ifmedia_init(&mii->mii_media, IFM_IMASK, ether_mediachange,
860 	    ether_mediastatus);
861 	mii_attach(sc->sc_dev, mii, 0xffffffff, MII_PHY_ANY,
862 	    MII_OFFSET_ANY, 0);
863 	ifmedia_set(&mii->mii_media, IFM_ETHER | IFM_AUTO);
864 
865 	/*
866 	 * Call MI attach routine.
867 	 */
868 	if_attach(ifp);
869 	if_deferred_start_init(ifp, NULL);
870 	ether_ifattach(ifp, eaddr);
871 
872 	rnd_attach_source(&sc->rnd_source, device_xname(sc->sc_dev),
873 	    RND_TYPE_NET, RND_FLAG_DEFAULT);
874 
875 	if (pmf_device_register(sc->sc_dev, NULL, NULL))
876 		pmf_class_network_register(sc->sc_dev, ifp);
877 	else
878 		aprint_error_dev(sc->sc_dev,
879 		    "couldn't establish power handler\n");
880 
881 	return;
882 
883  fail_8:
884 	/* Destroy DMA maps for RX buffers. */
885 	for (i = 0; i < RE_RX_DESC_CNT; i++)
886 		if (sc->re_ldata.re_rxsoft[i].rxs_dmamap != NULL)
887 			bus_dmamap_destroy(sc->sc_dmat,
888 			    sc->re_ldata.re_rxsoft[i].rxs_dmamap);
889 
890 	/* Free DMA'able memory for the RX ring. */
891 	bus_dmamap_unload(sc->sc_dmat, sc->re_ldata.re_rx_list_map);
892  fail_7:
893 	bus_dmamap_destroy(sc->sc_dmat, sc->re_ldata.re_rx_list_map);
894  fail_6:
895 	bus_dmamem_unmap(sc->sc_dmat,
896 	    (void *)sc->re_ldata.re_rx_list, RE_RX_DMAMEM_SZ);
897  fail_5:
898 	bus_dmamem_free(sc->sc_dmat,
899 	    &sc->re_ldata.re_rx_listseg, sc->re_ldata.re_rx_listnseg);
900 
901  fail_4:
902 	/* Destroy DMA maps for TX buffers. */
903 	for (i = 0; i < RE_TX_QLEN; i++)
904 		if (sc->re_ldata.re_txq[i].txq_dmamap != NULL)
905 			bus_dmamap_destroy(sc->sc_dmat,
906 			    sc->re_ldata.re_txq[i].txq_dmamap);
907 
908 	/* Free DMA'able memory for the TX ring. */
909 	bus_dmamap_unload(sc->sc_dmat, sc->re_ldata.re_tx_list_map);
910  fail_3:
911 	bus_dmamap_destroy(sc->sc_dmat, sc->re_ldata.re_tx_list_map);
912  fail_2:
913 	bus_dmamem_unmap(sc->sc_dmat,
914 	    (void *)sc->re_ldata.re_tx_list, RE_TX_LIST_SZ(sc));
915  fail_1:
916 	bus_dmamem_free(sc->sc_dmat,
917 	    &sc->re_ldata.re_tx_listseg, sc->re_ldata.re_tx_listnseg);
918  fail_0:
919 	return;
920 }
921 
922 
923 /*
924  * re_activate:
925  *     Handle device activation/deactivation requests.
926  */
927 int
928 re_activate(device_t self, enum devact act)
929 {
930 	struct rtk_softc *sc = device_private(self);
931 
932 	switch (act) {
933 	case DVACT_DEACTIVATE:
934 		if_deactivate(&sc->ethercom.ec_if);
935 		return 0;
936 	default:
937 		return EOPNOTSUPP;
938 	}
939 }
940 
941 /*
942  * re_detach:
943  *     Detach a rtk interface.
944  */
945 int
946 re_detach(struct rtk_softc *sc)
947 {
948 	struct ifnet *ifp = &sc->ethercom.ec_if;
949 	int i;
950 
951 	/*
952 	 * Succeed now if there isn't any work to do.
953 	 */
954 	if ((sc->sc_flags & RTK_ATTACHED) == 0)
955 		return 0;
956 
957 	/* Unhook our tick handler. */
958 	callout_stop(&sc->rtk_tick_ch);
959 
960 	/* Detach all PHYs. */
961 	mii_detach(&sc->mii, MII_PHY_ANY, MII_OFFSET_ANY);
962 
963 	/* Delete all remaining media. */
964 	ifmedia_delete_instance(&sc->mii.mii_media, IFM_INST_ANY);
965 
966 	rnd_detach_source(&sc->rnd_source);
967 	ether_ifdetach(ifp);
968 	if_detach(ifp);
969 
970 	/* Destroy DMA maps for RX buffers. */
971 	for (i = 0; i < RE_RX_DESC_CNT; i++)
972 		if (sc->re_ldata.re_rxsoft[i].rxs_dmamap != NULL)
973 			bus_dmamap_destroy(sc->sc_dmat,
974 			    sc->re_ldata.re_rxsoft[i].rxs_dmamap);
975 
976 	/* Free DMA'able memory for the RX ring. */
977 	bus_dmamap_unload(sc->sc_dmat, sc->re_ldata.re_rx_list_map);
978 	bus_dmamap_destroy(sc->sc_dmat, sc->re_ldata.re_rx_list_map);
979 	bus_dmamem_unmap(sc->sc_dmat,
980 	    (void *)sc->re_ldata.re_rx_list, RE_RX_DMAMEM_SZ);
981 	bus_dmamem_free(sc->sc_dmat,
982 	    &sc->re_ldata.re_rx_listseg, sc->re_ldata.re_rx_listnseg);
983 
984 	/* Destroy DMA maps for TX buffers. */
985 	for (i = 0; i < RE_TX_QLEN; i++)
986 		if (sc->re_ldata.re_txq[i].txq_dmamap != NULL)
987 			bus_dmamap_destroy(sc->sc_dmat,
988 			    sc->re_ldata.re_txq[i].txq_dmamap);
989 
990 	/* Free DMA'able memory for the TX ring. */
991 	bus_dmamap_unload(sc->sc_dmat, sc->re_ldata.re_tx_list_map);
992 	bus_dmamap_destroy(sc->sc_dmat, sc->re_ldata.re_tx_list_map);
993 	bus_dmamem_unmap(sc->sc_dmat,
994 	    (void *)sc->re_ldata.re_tx_list, RE_TX_LIST_SZ(sc));
995 	bus_dmamem_free(sc->sc_dmat,
996 	    &sc->re_ldata.re_tx_listseg, sc->re_ldata.re_tx_listnseg);
997 
998 	pmf_device_deregister(sc->sc_dev);
999 
1000 	/* we don't want to run again */
1001 	sc->sc_flags &= ~RTK_ATTACHED;
1002 
1003 	return 0;
1004 }
1005 
1006 /*
1007  * re_enable:
1008  *     Enable the RTL81X9 chip.
1009  */
1010 static int
1011 re_enable(struct rtk_softc *sc)
1012 {
1013 
1014 	if (RTK_IS_ENABLED(sc) == 0 && sc->sc_enable != NULL) {
1015 		if ((*sc->sc_enable)(sc) != 0) {
1016 			printf("%s: device enable failed\n",
1017 			    device_xname(sc->sc_dev));
1018 			return EIO;
1019 		}
1020 		sc->sc_flags |= RTK_ENABLED;
1021 	}
1022 	return 0;
1023 }
1024 
1025 /*
1026  * re_disable:
1027  *     Disable the RTL81X9 chip.
1028  */
1029 static void
1030 re_disable(struct rtk_softc *sc)
1031 {
1032 
1033 	if (RTK_IS_ENABLED(sc) && sc->sc_disable != NULL) {
1034 		(*sc->sc_disable)(sc);
1035 		sc->sc_flags &= ~RTK_ENABLED;
1036 	}
1037 }
1038 
1039 static int
1040 re_newbuf(struct rtk_softc *sc, int idx, struct mbuf *m)
1041 {
1042 	struct mbuf *n = NULL;
1043 	bus_dmamap_t map;
1044 	struct re_desc *d;
1045 	struct re_rxsoft *rxs;
1046 	uint32_t cmdstat;
1047 	int error;
1048 
1049 	if (m == NULL) {
1050 		MGETHDR(n, M_DONTWAIT, MT_DATA);
1051 		if (n == NULL)
1052 			return ENOBUFS;
1053 
1054 		MCLGET(n, M_DONTWAIT);
1055 		if ((n->m_flags & M_EXT) == 0) {
1056 			m_freem(n);
1057 			return ENOBUFS;
1058 		}
1059 		m = n;
1060 	} else
1061 		m->m_data = m->m_ext.ext_buf;
1062 
1063 	/*
1064 	 * Initialize mbuf length fields and fixup
1065 	 * alignment so that the frame payload is
1066 	 * longword aligned.
1067 	 */
1068 	m->m_len = m->m_pkthdr.len = MCLBYTES - RE_ETHER_ALIGN;
1069 	m->m_data += RE_ETHER_ALIGN;
1070 
1071 	rxs = &sc->re_ldata.re_rxsoft[idx];
1072 	map = rxs->rxs_dmamap;
1073 	error = bus_dmamap_load_mbuf(sc->sc_dmat, map, m,
1074 	    BUS_DMA_READ|BUS_DMA_NOWAIT);
1075 
1076 	if (error)
1077 		goto out;
1078 
1079 	bus_dmamap_sync(sc->sc_dmat, map, 0, map->dm_mapsize,
1080 	    BUS_DMASYNC_PREREAD);
1081 
1082 	d = &sc->re_ldata.re_rx_list[idx];
1083 #ifdef DIAGNOSTIC
1084 	RE_RXDESCSYNC(sc, idx, BUS_DMASYNC_POSTREAD|BUS_DMASYNC_POSTWRITE);
1085 	cmdstat = le32toh(d->re_cmdstat);
1086 	RE_RXDESCSYNC(sc, idx, BUS_DMASYNC_PREREAD);
1087 	if (cmdstat & RE_RDESC_STAT_OWN) {
1088 		panic("%s: tried to map busy RX descriptor",
1089 		    device_xname(sc->sc_dev));
1090 	}
1091 #endif
1092 
1093 	rxs->rxs_mbuf = m;
1094 
1095 	d->re_vlanctl = 0;
1096 	cmdstat = map->dm_segs[0].ds_len;
1097 	if (idx == (RE_RX_DESC_CNT - 1))
1098 		cmdstat |= RE_RDESC_CMD_EOR;
1099 	re_set_bufaddr(d, map->dm_segs[0].ds_addr);
1100 	d->re_cmdstat = htole32(cmdstat);
1101 	RE_RXDESCSYNC(sc, idx, BUS_DMASYNC_PREREAD|BUS_DMASYNC_PREWRITE);
1102 	cmdstat |= RE_RDESC_CMD_OWN;
1103 	d->re_cmdstat = htole32(cmdstat);
1104 	RE_RXDESCSYNC(sc, idx, BUS_DMASYNC_PREREAD|BUS_DMASYNC_PREWRITE);
1105 
1106 	return 0;
1107  out:
1108 	if (n != NULL)
1109 		m_freem(n);
1110 	return ENOMEM;
1111 }
1112 
1113 static int
1114 re_tx_list_init(struct rtk_softc *sc)
1115 {
1116 	int i;
1117 
1118 	memset(sc->re_ldata.re_tx_list, 0, RE_TX_LIST_SZ(sc));
1119 	for (i = 0; i < RE_TX_QLEN; i++) {
1120 		sc->re_ldata.re_txq[i].txq_mbuf = NULL;
1121 	}
1122 
1123 	bus_dmamap_sync(sc->sc_dmat,
1124 	    sc->re_ldata.re_tx_list_map, 0,
1125 	    sc->re_ldata.re_tx_list_map->dm_mapsize,
1126 	    BUS_DMASYNC_PREREAD|BUS_DMASYNC_PREWRITE);
1127 	sc->re_ldata.re_txq_prodidx = 0;
1128 	sc->re_ldata.re_txq_considx = 0;
1129 	sc->re_ldata.re_txq_free = RE_TX_QLEN;
1130 	sc->re_ldata.re_tx_free = RE_TX_DESC_CNT(sc);
1131 	sc->re_ldata.re_tx_nextfree = 0;
1132 
1133 	return 0;
1134 }
1135 
1136 static int
1137 re_rx_list_init(struct rtk_softc *sc)
1138 {
1139 	int i;
1140 
1141 	memset(sc->re_ldata.re_rx_list, 0, RE_RX_LIST_SZ);
1142 
1143 	for (i = 0; i < RE_RX_DESC_CNT; i++) {
1144 		if (re_newbuf(sc, i, NULL) == ENOBUFS)
1145 			return ENOBUFS;
1146 	}
1147 
1148 	sc->re_ldata.re_rx_prodidx = 0;
1149 	sc->re_head = sc->re_tail = NULL;
1150 
1151 	return 0;
1152 }
1153 
1154 /*
1155  * RX handler for C+ and 8169. For the gigE chips, we support
1156  * the reception of jumbo frames that have been fragmented
1157  * across multiple 2K mbuf cluster buffers.
1158  */
1159 static void
1160 re_rxeof(struct rtk_softc *sc)
1161 {
1162 	struct mbuf *m;
1163 	struct ifnet *ifp;
1164 	int i, total_len;
1165 	struct re_desc *cur_rx;
1166 	struct re_rxsoft *rxs;
1167 	uint32_t rxstat, rxvlan;
1168 
1169 	ifp = &sc->ethercom.ec_if;
1170 
1171 	for (i = sc->re_ldata.re_rx_prodidx;; i = RE_NEXT_RX_DESC(sc, i)) {
1172 		cur_rx = &sc->re_ldata.re_rx_list[i];
1173 		RE_RXDESCSYNC(sc, i,
1174 		    BUS_DMASYNC_POSTREAD|BUS_DMASYNC_POSTWRITE);
1175 		rxstat = le32toh(cur_rx->re_cmdstat);
1176 		rxvlan = le32toh(cur_rx->re_vlanctl);
1177 		RE_RXDESCSYNC(sc, i, BUS_DMASYNC_PREREAD);
1178 		if ((rxstat & RE_RDESC_STAT_OWN) != 0) {
1179 			break;
1180 		}
1181 		total_len = rxstat & sc->re_rxlenmask;
1182 		rxs = &sc->re_ldata.re_rxsoft[i];
1183 		m = rxs->rxs_mbuf;
1184 
1185 		/* Invalidate the RX mbuf and unload its map */
1186 
1187 		bus_dmamap_sync(sc->sc_dmat,
1188 		    rxs->rxs_dmamap, 0, rxs->rxs_dmamap->dm_mapsize,
1189 		    BUS_DMASYNC_POSTREAD);
1190 		bus_dmamap_unload(sc->sc_dmat, rxs->rxs_dmamap);
1191 
1192 		if ((rxstat & RE_RDESC_STAT_EOF) == 0) {
1193 			m->m_len = MCLBYTES - RE_ETHER_ALIGN;
1194 			if (sc->re_head == NULL)
1195 				sc->re_head = sc->re_tail = m;
1196 			else {
1197 				m_remove_pkthdr(m);
1198 				sc->re_tail->m_next = m;
1199 				sc->re_tail = m;
1200 			}
1201 			re_newbuf(sc, i, NULL);
1202 			continue;
1203 		}
1204 
1205 		/*
1206 		 * NOTE: for the 8139C+, the frame length field
1207 		 * is always 12 bits in size, but for the gigE chips,
1208 		 * it is 13 bits (since the max RX frame length is 16K).
1209 		 * Unfortunately, all 32 bits in the status word
1210 		 * were already used, so to make room for the extra
1211 		 * length bit, RealTek took out the 'frame alignment
1212 		 * error' bit and shifted the other status bits
1213 		 * over one slot. The OWN, EOR, FS and LS bits are
1214 		 * still in the same places. We have already extracted
1215 		 * the frame length and checked the OWN bit, so rather
1216 		 * than using an alternate bit mapping, we shift the
1217 		 * status bits one space to the right so we can evaluate
1218 		 * them using the 8169 status as though it was in the
1219 		 * same format as that of the 8139C+.
1220 		 */
1221 		if ((sc->sc_quirk & RTKQ_8139CPLUS) == 0)
1222 			rxstat >>= 1;
1223 
1224 		if (__predict_false((rxstat & RE_RDESC_STAT_RXERRSUM) != 0)) {
1225 #ifdef RE_DEBUG
1226 			printf("%s: RX error (rxstat = 0x%08x)",
1227 			    device_xname(sc->sc_dev), rxstat);
1228 			if (rxstat & RE_RDESC_STAT_FRALIGN)
1229 				printf(", frame alignment error");
1230 			if (rxstat & RE_RDESC_STAT_BUFOFLOW)
1231 				printf(", out of buffer space");
1232 			if (rxstat & RE_RDESC_STAT_FIFOOFLOW)
1233 				printf(", FIFO overrun");
1234 			if (rxstat & RE_RDESC_STAT_GIANT)
1235 				printf(", giant packet");
1236 			if (rxstat & RE_RDESC_STAT_RUNT)
1237 				printf(", runt packet");
1238 			if (rxstat & RE_RDESC_STAT_CRCERR)
1239 				printf(", CRC error");
1240 			printf("\n");
1241 #endif
1242 			ifp->if_ierrors++;
1243 			/*
1244 			 * If this is part of a multi-fragment packet,
1245 			 * discard all the pieces.
1246 			 */
1247 			if (sc->re_head != NULL) {
1248 				m_freem(sc->re_head);
1249 				sc->re_head = sc->re_tail = NULL;
1250 			}
1251 			re_newbuf(sc, i, m);
1252 			continue;
1253 		}
1254 
1255 		/*
1256 		 * If allocating a replacement mbuf fails,
1257 		 * reload the current one.
1258 		 */
1259 
1260 		if (__predict_false(re_newbuf(sc, i, NULL) != 0)) {
1261 			ifp->if_ierrors++;
1262 			if (sc->re_head != NULL) {
1263 				m_freem(sc->re_head);
1264 				sc->re_head = sc->re_tail = NULL;
1265 			}
1266 			re_newbuf(sc, i, m);
1267 			continue;
1268 		}
1269 
1270 		if (sc->re_head != NULL) {
1271 			m->m_len = total_len % (MCLBYTES - RE_ETHER_ALIGN);
1272 			/*
1273 			 * Special case: if there's 4 bytes or less
1274 			 * in this buffer, the mbuf can be discarded:
1275 			 * the last 4 bytes is the CRC, which we don't
1276 			 * care about anyway.
1277 			 */
1278 			if (m->m_len <= ETHER_CRC_LEN) {
1279 				sc->re_tail->m_len -=
1280 				    (ETHER_CRC_LEN - m->m_len);
1281 				m_freem(m);
1282 			} else {
1283 				m->m_len -= ETHER_CRC_LEN;
1284 				m_remove_pkthdr(m);
1285 				sc->re_tail->m_next = m;
1286 			}
1287 			m = sc->re_head;
1288 			sc->re_head = sc->re_tail = NULL;
1289 			m->m_pkthdr.len = total_len - ETHER_CRC_LEN;
1290 		} else
1291 			m->m_pkthdr.len = m->m_len =
1292 			    (total_len - ETHER_CRC_LEN);
1293 
1294 		m_set_rcvif(m, ifp);
1295 
1296 		/* Do RX checksumming */
1297 		if ((sc->sc_quirk & RTKQ_DESCV2) == 0) {
1298 			/* Check IP header checksum */
1299 			if ((rxstat & RE_RDESC_STAT_PROTOID) != 0) {
1300 				m->m_pkthdr.csum_flags |= M_CSUM_IPv4;
1301 				if (rxstat & RE_RDESC_STAT_IPSUMBAD)
1302 					m->m_pkthdr.csum_flags |=
1303 					    M_CSUM_IPv4_BAD;
1304 
1305 				/* Check TCP/UDP checksum */
1306 				if (RE_TCPPKT(rxstat)) {
1307 					m->m_pkthdr.csum_flags |= M_CSUM_TCPv4;
1308 					if (rxstat & RE_RDESC_STAT_TCPSUMBAD)
1309 						m->m_pkthdr.csum_flags |=
1310 						    M_CSUM_TCP_UDP_BAD;
1311 				} else if (RE_UDPPKT(rxstat)) {
1312 					m->m_pkthdr.csum_flags |= M_CSUM_UDPv4;
1313 					if (rxstat & RE_RDESC_STAT_UDPSUMBAD) {
1314 						/*
1315 						 * XXX: 8139C+ thinks UDP csum
1316 						 * 0xFFFF is bad, force software
1317 						 * calculation.
1318 						 */
1319 						if (sc->sc_quirk & RTKQ_8139CPLUS)
1320 							m->m_pkthdr.csum_flags
1321 							    &= ~M_CSUM_UDPv4;
1322 						else
1323 							m->m_pkthdr.csum_flags
1324 							    |= M_CSUM_TCP_UDP_BAD;
1325 					}
1326 				}
1327 			}
1328 		} else {
1329 			/* Check IPv4 header checksum */
1330 			if ((rxvlan & RE_RDESC_VLANCTL_IPV4) != 0) {
1331 				m->m_pkthdr.csum_flags |= M_CSUM_IPv4;
1332 				if (rxstat & RE_RDESC_STAT_IPSUMBAD)
1333 					m->m_pkthdr.csum_flags |=
1334 					    M_CSUM_IPv4_BAD;
1335 
1336 				/* Check TCPv4/UDPv4 checksum */
1337 				if (RE_TCPPKT(rxstat)) {
1338 					m->m_pkthdr.csum_flags |= M_CSUM_TCPv4;
1339 					if (rxstat & RE_RDESC_STAT_TCPSUMBAD)
1340 						m->m_pkthdr.csum_flags |=
1341 						    M_CSUM_TCP_UDP_BAD;
1342 				} else if (RE_UDPPKT(rxstat)) {
1343 					m->m_pkthdr.csum_flags |= M_CSUM_UDPv4;
1344 					if (rxstat & RE_RDESC_STAT_UDPSUMBAD)
1345 						m->m_pkthdr.csum_flags |=
1346 						    M_CSUM_TCP_UDP_BAD;
1347 				}
1348 			}
1349 			/* XXX Check TCPv6/UDPv6 checksum? */
1350 		}
1351 
1352 		if (rxvlan & RE_RDESC_VLANCTL_TAG) {
1353 			vlan_set_tag(m,
1354 			     bswap16(rxvlan & RE_RDESC_VLANCTL_DATA));
1355 		}
1356 		if_percpuq_enqueue(ifp->if_percpuq, m);
1357 	}
1358 
1359 	sc->re_ldata.re_rx_prodidx = i;
1360 }
1361 
1362 static void
1363 re_txeof(struct rtk_softc *sc)
1364 {
1365 	struct ifnet *ifp;
1366 	struct re_txq *txq;
1367 	uint32_t txstat;
1368 	int idx, descidx;
1369 
1370 	ifp = &sc->ethercom.ec_if;
1371 
1372 	for (idx = sc->re_ldata.re_txq_considx;
1373 	    sc->re_ldata.re_txq_free < RE_TX_QLEN;
1374 	    idx = RE_NEXT_TXQ(sc, idx), sc->re_ldata.re_txq_free++) {
1375 		txq = &sc->re_ldata.re_txq[idx];
1376 		KASSERT(txq->txq_mbuf != NULL);
1377 
1378 		descidx = txq->txq_descidx;
1379 		RE_TXDESCSYNC(sc, descidx,
1380 		    BUS_DMASYNC_POSTREAD|BUS_DMASYNC_POSTWRITE);
1381 		txstat =
1382 		    le32toh(sc->re_ldata.re_tx_list[descidx].re_cmdstat);
1383 		RE_TXDESCSYNC(sc, descidx, BUS_DMASYNC_PREREAD);
1384 		KASSERT((txstat & RE_TDESC_CMD_EOF) != 0);
1385 		if (txstat & RE_TDESC_CMD_OWN) {
1386 			break;
1387 		}
1388 
1389 		sc->re_ldata.re_tx_free += txq->txq_nsegs;
1390 		KASSERT(sc->re_ldata.re_tx_free <= RE_TX_DESC_CNT(sc));
1391 		bus_dmamap_sync(sc->sc_dmat, txq->txq_dmamap,
1392 		    0, txq->txq_dmamap->dm_mapsize, BUS_DMASYNC_POSTWRITE);
1393 		bus_dmamap_unload(sc->sc_dmat, txq->txq_dmamap);
1394 		m_freem(txq->txq_mbuf);
1395 		txq->txq_mbuf = NULL;
1396 
1397 		if (txstat & (RE_TDESC_STAT_EXCESSCOL | RE_TDESC_STAT_COLCNT))
1398 			ifp->if_collisions++;
1399 		if (txstat & RE_TDESC_STAT_TXERRSUM)
1400 			ifp->if_oerrors++;
1401 		else
1402 			ifp->if_opackets++;
1403 	}
1404 
1405 	sc->re_ldata.re_txq_considx = idx;
1406 
1407 	if (sc->re_ldata.re_txq_free > RE_NTXDESC_RSVD)
1408 		ifp->if_flags &= ~IFF_OACTIVE;
1409 
1410 	/*
1411 	 * If not all descriptors have been released reaped yet,
1412 	 * reload the timer so that we will eventually get another
1413 	 * interrupt that will cause us to re-enter this routine.
1414 	 * This is done in case the transmitter has gone idle.
1415 	 */
1416 	if (sc->re_ldata.re_txq_free < RE_TX_QLEN) {
1417 		if ((sc->sc_quirk & RTKQ_IM_HW) == 0)
1418 			CSR_WRITE_4(sc, RTK_TIMERCNT, 1);
1419 		if ((sc->sc_quirk & RTKQ_PCIE) != 0) {
1420 			/*
1421 			 * Some chips will ignore a second TX request
1422 			 * issued while an existing transmission is in
1423 			 * progress. If the transmitter goes idle but
1424 			 * there are still packets waiting to be sent,
1425 			 * we need to restart the channel here to flush
1426 			 * them out. This only seems to be required with
1427 			 * the PCIe devices.
1428 			 */
1429 			CSR_WRITE_1(sc, RTK_GTXSTART, RTK_TXSTART_START);
1430 		}
1431 	} else
1432 		ifp->if_timer = 0;
1433 }
1434 
1435 static void
1436 re_tick(void *arg)
1437 {
1438 	struct rtk_softc *sc = arg;
1439 	int s;
1440 
1441 	/* XXX: just return for 8169S/8110S with rev 2 or newer phy */
1442 	s = splnet();
1443 
1444 	mii_tick(&sc->mii);
1445 	splx(s);
1446 
1447 	callout_reset(&sc->rtk_tick_ch, hz, re_tick, sc);
1448 }
1449 
1450 int
1451 re_intr(void *arg)
1452 {
1453 	struct rtk_softc *sc = arg;
1454 	struct ifnet *ifp;
1455 	uint16_t status;
1456 	int handled = 0;
1457 
1458 	if (!device_has_power(sc->sc_dev))
1459 		return 0;
1460 
1461 	ifp = &sc->ethercom.ec_if;
1462 
1463 	if ((ifp->if_flags & IFF_UP) == 0)
1464 		return 0;
1465 
1466 	const uint16_t status_mask = (sc->sc_quirk & RTKQ_IM_HW) ?
1467 	    RTK_INTRS_IM_HW : RTK_INTRS_CPLUS;
1468 
1469 	for (;;) {
1470 
1471 		status = CSR_READ_2(sc, RTK_ISR);
1472 		/* If the card has gone away the read returns 0xffff. */
1473 		if (status == 0xffff)
1474 			break;
1475 		if (status) {
1476 			handled = 1;
1477 			CSR_WRITE_2(sc, RTK_ISR, status);
1478 		}
1479 
1480 		if ((status & status_mask) == 0)
1481 			break;
1482 
1483 		if (status & (RTK_ISR_RX_OK | RTK_ISR_RX_ERR))
1484 			re_rxeof(sc);
1485 
1486 		if (status & (RTK_ISR_TIMEOUT_EXPIRED | RTK_ISR_TX_ERR |
1487 		    RTK_ISR_TX_DESC_UNAVAIL | RTK_ISR_TX_OK))
1488 			re_txeof(sc);
1489 
1490 		if (status & RTK_ISR_SYSTEM_ERR) {
1491 			re_init(ifp);
1492 		}
1493 
1494 		if (status & RTK_ISR_LINKCHG) {
1495 			callout_stop(&sc->rtk_tick_ch);
1496 			re_tick(sc);
1497 		}
1498 	}
1499 
1500 	if (handled)
1501 		if_schedule_deferred_start(ifp);
1502 
1503 	rnd_add_uint32(&sc->rnd_source, status);
1504 
1505 	return handled;
1506 }
1507 
1508 
1509 
1510 /*
1511  * Main transmit routine for C+ and gigE NICs.
1512  */
1513 
1514 static void
1515 re_start(struct ifnet *ifp)
1516 {
1517 	struct rtk_softc *sc;
1518 	struct mbuf *m;
1519 	bus_dmamap_t map;
1520 	struct re_txq *txq;
1521 	struct re_desc *d;
1522 	uint32_t cmdstat, re_flags, vlanctl;
1523 	int ofree, idx, error, nsegs, seg;
1524 	int startdesc, curdesc, lastdesc;
1525 	bool pad;
1526 
1527 	sc = ifp->if_softc;
1528 	ofree = sc->re_ldata.re_txq_free;
1529 
1530 	for (idx = sc->re_ldata.re_txq_prodidx;; idx = RE_NEXT_TXQ(sc, idx)) {
1531 
1532 		IFQ_POLL(&ifp->if_snd, m);
1533 		if (m == NULL)
1534 			break;
1535 
1536 		if (sc->re_ldata.re_txq_free == 0 ||
1537 		    sc->re_ldata.re_tx_free == 0) {
1538 			/* no more free slots left */
1539 			ifp->if_flags |= IFF_OACTIVE;
1540 			break;
1541 		}
1542 
1543 		/*
1544 		 * Set up checksum offload. Note: checksum offload bits must
1545 		 * appear in all descriptors of a multi-descriptor transmit
1546 		 * attempt. (This is according to testing done with an 8169
1547 		 * chip. I'm not sure if this is a requirement or a bug.)
1548 		 */
1549 
1550 		vlanctl = 0;
1551 		if ((m->m_pkthdr.csum_flags & M_CSUM_TSOv4) != 0) {
1552 			uint32_t segsz = m->m_pkthdr.segsz;
1553 
1554 			if ((sc->sc_quirk & RTKQ_DESCV2) == 0) {
1555 				re_flags = RE_TDESC_CMD_LGSEND |
1556 				    (segsz << RE_TDESC_CMD_MSSVAL_SHIFT);
1557 			} else {
1558 				re_flags = RE_TDESC_CMD_LGSEND_V4;
1559 				vlanctl |=
1560 				    (segsz << RE_TDESC_VLANCTL_MSSVAL_SHIFT);
1561 			}
1562 		} else {
1563 			/*
1564 			 * set RE_TDESC_CMD_IPCSUM if any checksum offloading
1565 			 * is requested.  otherwise, RE_TDESC_CMD_TCPCSUM/
1566 			 * RE_TDESC_CMD_UDPCSUM doesn't make effects.
1567 			 */
1568 			re_flags = 0;
1569 			if ((m->m_pkthdr.csum_flags &
1570 			    (M_CSUM_IPv4 | M_CSUM_TCPv4 | M_CSUM_UDPv4))
1571 			    != 0) {
1572 				if ((sc->sc_quirk & RTKQ_DESCV2) == 0) {
1573 					re_flags |= RE_TDESC_CMD_IPCSUM;
1574 					if (m->m_pkthdr.csum_flags &
1575 					    M_CSUM_TCPv4) {
1576 						re_flags |=
1577 						    RE_TDESC_CMD_TCPCSUM;
1578 					} else if (m->m_pkthdr.csum_flags &
1579 					    M_CSUM_UDPv4) {
1580 						re_flags |=
1581 						    RE_TDESC_CMD_UDPCSUM;
1582 					}
1583 				} else {
1584 					vlanctl |= RE_TDESC_VLANCTL_IPCSUM;
1585 					if (m->m_pkthdr.csum_flags &
1586 					    M_CSUM_TCPv4) {
1587 						vlanctl |=
1588 						    RE_TDESC_VLANCTL_TCPCSUM;
1589 					} else if (m->m_pkthdr.csum_flags &
1590 					    M_CSUM_UDPv4) {
1591 						vlanctl |=
1592 						    RE_TDESC_VLANCTL_UDPCSUM;
1593 					}
1594 				}
1595 			}
1596 		}
1597 
1598 		txq = &sc->re_ldata.re_txq[idx];
1599 		map = txq->txq_dmamap;
1600 		error = bus_dmamap_load_mbuf(sc->sc_dmat, map, m,
1601 		    BUS_DMA_WRITE|BUS_DMA_NOWAIT);
1602 
1603 		if (__predict_false(error)) {
1604 			/* XXX try to defrag if EFBIG? */
1605 			printf("%s: can't map mbuf (error %d)\n",
1606 			    device_xname(sc->sc_dev), error);
1607 
1608 			IFQ_DEQUEUE(&ifp->if_snd, m);
1609 			m_freem(m);
1610 			ifp->if_oerrors++;
1611 			continue;
1612 		}
1613 
1614 		nsegs = map->dm_nsegs;
1615 		pad = false;
1616 		if (__predict_false(m->m_pkthdr.len <= RE_IP4CSUMTX_PADLEN &&
1617 		    (re_flags & RE_TDESC_CMD_IPCSUM) != 0 &&
1618 		    (sc->sc_quirk & RTKQ_DESCV2) == 0)) {
1619 			pad = true;
1620 			nsegs++;
1621 		}
1622 
1623 		if (nsegs > sc->re_ldata.re_tx_free) {
1624 			/*
1625 			 * Not enough free descriptors to transmit this packet.
1626 			 */
1627 			ifp->if_flags |= IFF_OACTIVE;
1628 			bus_dmamap_unload(sc->sc_dmat, map);
1629 			break;
1630 		}
1631 
1632 		IFQ_DEQUEUE(&ifp->if_snd, m);
1633 
1634 		/*
1635 		 * Make sure that the caches are synchronized before we
1636 		 * ask the chip to start DMA for the packet data.
1637 		 */
1638 		bus_dmamap_sync(sc->sc_dmat, map, 0, map->dm_mapsize,
1639 		    BUS_DMASYNC_PREWRITE);
1640 
1641 		/*
1642 		 * Set up hardware VLAN tagging. Note: vlan tag info must
1643 		 * appear in all descriptors of a multi-descriptor
1644 		 * transmission attempt.
1645 		 */
1646 		if (vlan_has_tag(m))
1647 			vlanctl |= bswap16(vlan_get_tag(m)) |
1648 			    RE_TDESC_VLANCTL_TAG;
1649 
1650 		/*
1651 		 * Map the segment array into descriptors.
1652 		 * Note that we set the start-of-frame and
1653 		 * end-of-frame markers for either TX or RX,
1654 		 * but they really only have meaning in the TX case.
1655 		 * (In the RX case, it's the chip that tells us
1656 		 *  where packets begin and end.)
1657 		 * We also keep track of the end of the ring
1658 		 * and set the end-of-ring bits as needed,
1659 		 * and we set the ownership bits in all except
1660 		 * the very first descriptor. (The caller will
1661 		 * set this descriptor later when it start
1662 		 * transmission or reception.)
1663 		 */
1664 		curdesc = startdesc = sc->re_ldata.re_tx_nextfree;
1665 		lastdesc = -1;
1666 		for (seg = 0; seg < map->dm_nsegs;
1667 		    seg++, curdesc = RE_NEXT_TX_DESC(sc, curdesc)) {
1668 			d = &sc->re_ldata.re_tx_list[curdesc];
1669 #ifdef DIAGNOSTIC
1670 			RE_TXDESCSYNC(sc, curdesc,
1671 			    BUS_DMASYNC_POSTREAD|BUS_DMASYNC_POSTWRITE);
1672 			cmdstat = le32toh(d->re_cmdstat);
1673 			RE_TXDESCSYNC(sc, curdesc, BUS_DMASYNC_PREREAD);
1674 			if (cmdstat & RE_TDESC_STAT_OWN) {
1675 				panic("%s: tried to map busy TX descriptor",
1676 				    device_xname(sc->sc_dev));
1677 			}
1678 #endif
1679 
1680 			d->re_vlanctl = htole32(vlanctl);
1681 			re_set_bufaddr(d, map->dm_segs[seg].ds_addr);
1682 			cmdstat = re_flags | map->dm_segs[seg].ds_len;
1683 			if (seg == 0)
1684 				cmdstat |= RE_TDESC_CMD_SOF;
1685 			else
1686 				cmdstat |= RE_TDESC_CMD_OWN;
1687 			if (curdesc == (RE_TX_DESC_CNT(sc) - 1))
1688 				cmdstat |= RE_TDESC_CMD_EOR;
1689 			if (seg == nsegs - 1) {
1690 				cmdstat |= RE_TDESC_CMD_EOF;
1691 				lastdesc = curdesc;
1692 			}
1693 			d->re_cmdstat = htole32(cmdstat);
1694 			RE_TXDESCSYNC(sc, curdesc,
1695 			    BUS_DMASYNC_PREREAD|BUS_DMASYNC_PREWRITE);
1696 		}
1697 		if (__predict_false(pad)) {
1698 			d = &sc->re_ldata.re_tx_list[curdesc];
1699 			d->re_vlanctl = htole32(vlanctl);
1700 			re_set_bufaddr(d, RE_TXPADDADDR(sc));
1701 			cmdstat = re_flags |
1702 			    RE_TDESC_CMD_OWN | RE_TDESC_CMD_EOF |
1703 			    (RE_IP4CSUMTX_PADLEN + 1 - m->m_pkthdr.len);
1704 			if (curdesc == (RE_TX_DESC_CNT(sc) - 1))
1705 				cmdstat |= RE_TDESC_CMD_EOR;
1706 			d->re_cmdstat = htole32(cmdstat);
1707 			RE_TXDESCSYNC(sc, curdesc,
1708 			    BUS_DMASYNC_PREREAD|BUS_DMASYNC_PREWRITE);
1709 			lastdesc = curdesc;
1710 			curdesc = RE_NEXT_TX_DESC(sc, curdesc);
1711 		}
1712 		KASSERT(lastdesc != -1);
1713 
1714 		/* Transfer ownership of packet to the chip. */
1715 
1716 		sc->re_ldata.re_tx_list[startdesc].re_cmdstat |=
1717 		    htole32(RE_TDESC_CMD_OWN);
1718 		RE_TXDESCSYNC(sc, startdesc,
1719 		    BUS_DMASYNC_PREREAD|BUS_DMASYNC_PREWRITE);
1720 
1721 		/* update info of TX queue and descriptors */
1722 		txq->txq_mbuf = m;
1723 		txq->txq_descidx = lastdesc;
1724 		txq->txq_nsegs = nsegs;
1725 
1726 		sc->re_ldata.re_txq_free--;
1727 		sc->re_ldata.re_tx_free -= nsegs;
1728 		sc->re_ldata.re_tx_nextfree = curdesc;
1729 
1730 		/*
1731 		 * If there's a BPF listener, bounce a copy of this frame
1732 		 * to him.
1733 		 */
1734 		bpf_mtap(ifp, m, BPF_D_OUT);
1735 	}
1736 
1737 	if (sc->re_ldata.re_txq_free < ofree) {
1738 		/*
1739 		 * TX packets are enqueued.
1740 		 */
1741 		sc->re_ldata.re_txq_prodidx = idx;
1742 
1743 		/*
1744 		 * Start the transmitter to poll.
1745 		 *
1746 		 * RealTek put the TX poll request register in a different
1747 		 * location on the 8169 gigE chip. I don't know why.
1748 		 */
1749 		if ((sc->sc_quirk & RTKQ_8139CPLUS) != 0)
1750 			CSR_WRITE_1(sc, RTK_TXSTART, RTK_TXSTART_START);
1751 		else
1752 			CSR_WRITE_1(sc, RTK_GTXSTART, RTK_TXSTART_START);
1753 
1754 		if ((sc->sc_quirk & RTKQ_IM_HW) == 0) {
1755 			/*
1756 			 * Use the countdown timer for interrupt moderation.
1757 			 * 'TX done' interrupts are disabled. Instead, we reset
1758 			 * the countdown timer, which will begin counting until
1759 			 * it hits the value in the TIMERINT register, and then
1760 			 * trigger an interrupt. Each time we write to the
1761 			 * TIMERCNT register, the timer count is reset to 0.
1762 			 */
1763 			CSR_WRITE_4(sc, RTK_TIMERCNT, 1);
1764 		}
1765 
1766 		/*
1767 		 * Set a timeout in case the chip goes out to lunch.
1768 		 */
1769 		ifp->if_timer = 5;
1770 	}
1771 }
1772 
1773 static int
1774 re_init(struct ifnet *ifp)
1775 {
1776 	struct rtk_softc *sc = ifp->if_softc;
1777 	uint32_t rxcfg = 0;
1778 	uint16_t cfg;
1779 	int error;
1780 #ifdef RE_USE_EECMD
1781 	const uint8_t *enaddr;
1782 	uint32_t reg;
1783 #endif
1784 
1785 	if ((error = re_enable(sc)) != 0)
1786 		goto out;
1787 
1788 	/*
1789 	 * Cancel pending I/O and free all RX/TX buffers.
1790 	 */
1791 	re_stop(ifp, 0);
1792 
1793 	re_reset(sc);
1794 
1795 	/*
1796 	 * Enable C+ RX and TX mode, as well as VLAN stripping and
1797 	 * RX checksum offload. We must configure the C+ register
1798 	 * before all others.
1799 	 */
1800 	cfg = RE_CPLUSCMD_PCI_MRW;
1801 
1802 	/*
1803 	 * XXX: For old 8169 set bit 14.
1804 	 *      For 8169S/8110S and above, do not set bit 14.
1805 	 */
1806 	if ((sc->sc_quirk & RTKQ_8169NONS) != 0)
1807 		cfg |= (0x1 << 14);
1808 
1809 	if ((sc->ethercom.ec_capenable & ETHERCAP_VLAN_HWTAGGING) != 0)
1810 		cfg |= RE_CPLUSCMD_VLANSTRIP;
1811 	if ((ifp->if_capenable & (IFCAP_CSUM_IPv4_Rx |
1812 	     IFCAP_CSUM_TCPv4_Rx | IFCAP_CSUM_UDPv4_Rx)) != 0)
1813 		cfg |= RE_CPLUSCMD_RXCSUM_ENB;
1814 	if ((sc->sc_quirk & RTKQ_MACSTAT) != 0) {
1815 		cfg |= RE_CPLUSCMD_MACSTAT_DIS;
1816 		cfg |= RE_CPLUSCMD_TXENB;
1817 	} else
1818 		cfg |= RE_CPLUSCMD_RXENB | RE_CPLUSCMD_TXENB;
1819 
1820 	CSR_WRITE_2(sc, RTK_CPLUS_CMD, cfg);
1821 
1822 	/* XXX: from Realtek-supplied Linux driver. Wholly undocumented. */
1823 	if ((sc->sc_quirk & RTKQ_8139CPLUS) == 0) {
1824 		if ((sc->sc_quirk & RTKQ_IM_HW) == 0) {
1825 			CSR_WRITE_2(sc, RTK_IM, 0x0000);
1826 		} else {
1827 			CSR_WRITE_2(sc, RTK_IM, 0x5151);
1828 		}
1829 	}
1830 
1831 	DELAY(10000);
1832 
1833 #ifdef RE_USE_EECMD
1834 	/*
1835 	 * Init our MAC address.  Even though the chipset
1836 	 * documentation doesn't mention it, we need to enter "Config
1837 	 * register write enable" mode to modify the ID registers.
1838 	 */
1839 	CSR_WRITE_1(sc, RTK_EECMD, RTK_EEMODE_WRITECFG);
1840 	enaddr = CLLADDR(ifp->if_sadl);
1841 	reg = enaddr[0] | (enaddr[1] << 8) |
1842 	    (enaddr[2] << 16) | (enaddr[3] << 24);
1843 	CSR_WRITE_4(sc, RTK_IDR0, reg);
1844 	reg = enaddr[4] | (enaddr[5] << 8);
1845 	CSR_WRITE_4(sc, RTK_IDR4, reg);
1846 	CSR_WRITE_1(sc, RTK_EECMD, RTK_EEMODE_OFF);
1847 #endif
1848 
1849 	/*
1850 	 * For C+ mode, initialize the RX descriptors and mbufs.
1851 	 */
1852 	re_rx_list_init(sc);
1853 	re_tx_list_init(sc);
1854 
1855 	/*
1856 	 * Load the addresses of the RX and TX lists into the chip.
1857 	 */
1858 	CSR_WRITE_4(sc, RTK_RXLIST_ADDR_HI,
1859 	    RE_ADDR_HI(sc->re_ldata.re_rx_list_map->dm_segs[0].ds_addr));
1860 	CSR_WRITE_4(sc, RTK_RXLIST_ADDR_LO,
1861 	    RE_ADDR_LO(sc->re_ldata.re_rx_list_map->dm_segs[0].ds_addr));
1862 
1863 	CSR_WRITE_4(sc, RTK_TXLIST_ADDR_HI,
1864 	    RE_ADDR_HI(sc->re_ldata.re_tx_list_map->dm_segs[0].ds_addr));
1865 	CSR_WRITE_4(sc, RTK_TXLIST_ADDR_LO,
1866 	    RE_ADDR_LO(sc->re_ldata.re_tx_list_map->dm_segs[0].ds_addr));
1867 
1868 	if (sc->sc_quirk & RTKQ_RXDV_GATED) {
1869 		CSR_WRITE_4(sc, RTK_MISC,
1870 		    CSR_READ_4(sc, RTK_MISC) & ~RTK_MISC_RXDV_GATED_EN);
1871 	}
1872 
1873 	/*
1874 	 * Enable transmit and receive.
1875 	 */
1876 	CSR_WRITE_1(sc, RTK_COMMAND, RTK_CMD_TX_ENB | RTK_CMD_RX_ENB);
1877 
1878 	/*
1879 	 * Set the initial TX and RX configuration.
1880 	 */
1881 	if (sc->re_testmode && (sc->sc_quirk & RTKQ_8169NONS) != 0) {
1882 		/* test mode is needed only for old 8169 */
1883 		CSR_WRITE_4(sc, RTK_TXCFG,
1884 		    RE_TXCFG_CONFIG | RTK_LOOPTEST_ON);
1885 	} else
1886 		CSR_WRITE_4(sc, RTK_TXCFG, RE_TXCFG_CONFIG);
1887 
1888 	CSR_WRITE_1(sc, RTK_EARLY_TX_THRESH, 16);
1889 
1890 	CSR_WRITE_4(sc, RTK_RXCFG, RE_RXCFG_CONFIG);
1891 
1892 	/* Set the individual bit to receive frames for this host only. */
1893 	rxcfg = CSR_READ_4(sc, RTK_RXCFG);
1894 	rxcfg |= RTK_RXCFG_RX_INDIV;
1895 
1896 	/* If we want promiscuous mode, set the allframes bit. */
1897 	if (ifp->if_flags & IFF_PROMISC)
1898 		rxcfg |= RTK_RXCFG_RX_ALLPHYS;
1899 	else
1900 		rxcfg &= ~RTK_RXCFG_RX_ALLPHYS;
1901 	CSR_WRITE_4(sc, RTK_RXCFG, rxcfg);
1902 
1903 	/*
1904 	 * Set capture broadcast bit to capture broadcast frames.
1905 	 */
1906 	if (ifp->if_flags & IFF_BROADCAST)
1907 		rxcfg |= RTK_RXCFG_RX_BROAD;
1908 	else
1909 		rxcfg &= ~RTK_RXCFG_RX_BROAD;
1910 	CSR_WRITE_4(sc, RTK_RXCFG, rxcfg);
1911 
1912 	/*
1913 	 * Program the multicast filter, if necessary.
1914 	 */
1915 	rtk_setmulti(sc);
1916 
1917 	/*
1918 	 * Enable interrupts.
1919 	 */
1920 	if (sc->re_testmode)
1921 		CSR_WRITE_2(sc, RTK_IMR, 0);
1922 	else if ((sc->sc_quirk & RTKQ_IM_HW) != 0)
1923 		CSR_WRITE_2(sc, RTK_IMR, RTK_INTRS_IM_HW);
1924 	else
1925 		CSR_WRITE_2(sc, RTK_IMR, RTK_INTRS_CPLUS);
1926 
1927 	/* Start RX/TX process. */
1928 	CSR_WRITE_4(sc, RTK_MISSEDPKT, 0);
1929 #ifdef notdef
1930 	/* Enable receiver and transmitter. */
1931 	CSR_WRITE_1(sc, RTK_COMMAND, RTK_CMD_TX_ENB | RTK_CMD_RX_ENB);
1932 #endif
1933 
1934 	/*
1935 	 * Initialize the timer interrupt register so that
1936 	 * a timer interrupt will be generated once the timer
1937 	 * reaches a certain number of ticks. The timer is
1938 	 * reloaded on each transmit. This gives us TX interrupt
1939 	 * moderation, which dramatically improves TX frame rate.
1940 	 */
1941 
1942 	unsigned defer;		/* timer interval / ns */
1943 	unsigned period;	/* busclock period / ns */
1944 
1945 	/*
1946 	 * Maximum frame rate
1947 	 * 1500 byte PDU -> 81274 Hz
1948 	 *   46 byte PDU -> 1488096 Hz
1949 	 *
1950 	 * Deferring interrupts by up to 128us needs descriptors for
1951 	 * 1500 byte PDU -> 10.4 frames
1952 	 *   46 byte PDU -> 190.4 frames
1953 	 *
1954 	 */
1955 	defer = 128000;
1956 
1957 	if ((sc->sc_quirk & RTKQ_IM_HW) != 0) {
1958 		period = 1;
1959 		defer = 0;
1960 	} else if ((sc->sc_quirk & RTKQ_PCIE) != 0) {
1961 		period = 8;
1962 	} else {
1963 		switch (CSR_READ_1(sc, RTK_CFG2_BUSFREQ) & 0x7) {
1964 		case RTK_BUSFREQ_33MHZ:
1965 			period = 30;
1966 			break;
1967 		case RTK_BUSFREQ_66MHZ:
1968 			period = 15;
1969 			break;
1970 		default:
1971 			/* lowest possible clock */
1972 			period = 60;
1973 			break;
1974 		}
1975 	}
1976 
1977 	/* Timer Interrupt register address varies */
1978 	uint16_t re8139_reg;
1979 	if ((sc->sc_quirk & RTKQ_8139CPLUS) != 0)
1980 		re8139_reg = RTK_TIMERINT;
1981 	else
1982 		re8139_reg = RTK_TIMERINT_8169;
1983 	CSR_WRITE_4(sc, re8139_reg, defer / period);
1984 
1985 	if ((sc->sc_quirk & RTKQ_8139CPLUS) == 0) {
1986 		/*
1987 		 * For 8169 gigE NICs, set the max allowed RX packet
1988 		 * size so we can receive jumbo frames.
1989 		 */
1990 		CSR_WRITE_2(sc, RTK_MAXRXPKTLEN, 16383);
1991 	}
1992 
1993 	if (sc->re_testmode)
1994 		return 0;
1995 
1996 	CSR_WRITE_1(sc, RTK_CFG1, RTK_CFG1_DRVLOAD);
1997 
1998 	ifp->if_flags |= IFF_RUNNING;
1999 	ifp->if_flags &= ~IFF_OACTIVE;
2000 
2001 	callout_reset(&sc->rtk_tick_ch, hz, re_tick, sc);
2002 
2003  out:
2004 	if (error) {
2005 		ifp->if_flags &= ~(IFF_RUNNING | IFF_OACTIVE);
2006 		ifp->if_timer = 0;
2007 		printf("%s: interface not running\n",
2008 		    device_xname(sc->sc_dev));
2009 	}
2010 
2011 	return error;
2012 }
2013 
2014 static int
2015 re_ioctl(struct ifnet *ifp, u_long command, void *data)
2016 {
2017 	struct rtk_softc *sc = ifp->if_softc;
2018 	struct ifreq *ifr = data;
2019 	int s, error = 0;
2020 
2021 	s = splnet();
2022 
2023 	switch (command) {
2024 	case SIOCSIFMTU:
2025 		/*
2026 		 * Disable jumbo frames if it's not supported.
2027 		 */
2028 		if ((sc->sc_quirk & RTKQ_NOJUMBO) != 0 &&
2029 		    ifr->ifr_mtu > ETHERMTU) {
2030 			error = EINVAL;
2031 			break;
2032 		}
2033 
2034 		if (ifr->ifr_mtu < ETHERMIN || ifr->ifr_mtu > ETHERMTU_JUMBO)
2035 			error = EINVAL;
2036 		else if ((error = ifioctl_common(ifp, command, data)) ==
2037 		    ENETRESET)
2038 			error = 0;
2039 		break;
2040 	default:
2041 		if ((error = ether_ioctl(ifp, command, data)) != ENETRESET)
2042 			break;
2043 
2044 		error = 0;
2045 
2046 		if (command == SIOCSIFCAP)
2047 			error = (*ifp->if_init)(ifp);
2048 		else if (command != SIOCADDMULTI && command != SIOCDELMULTI)
2049 			;
2050 		else if (ifp->if_flags & IFF_RUNNING)
2051 			rtk_setmulti(sc);
2052 		break;
2053 	}
2054 
2055 	splx(s);
2056 
2057 	return error;
2058 }
2059 
2060 static void
2061 re_watchdog(struct ifnet *ifp)
2062 {
2063 	struct rtk_softc *sc;
2064 	int s;
2065 
2066 	sc = ifp->if_softc;
2067 	s = splnet();
2068 	printf("%s: watchdog timeout\n", device_xname(sc->sc_dev));
2069 	ifp->if_oerrors++;
2070 
2071 	re_txeof(sc);
2072 	re_rxeof(sc);
2073 
2074 	re_init(ifp);
2075 
2076 	splx(s);
2077 }
2078 
2079 /*
2080  * Stop the adapter and free any mbufs allocated to the
2081  * RX and TX lists.
2082  */
2083 static void
2084 re_stop(struct ifnet *ifp, int disable)
2085 {
2086 	int i;
2087 	struct rtk_softc *sc = ifp->if_softc;
2088 
2089 	callout_stop(&sc->rtk_tick_ch);
2090 
2091 	mii_down(&sc->mii);
2092 
2093 	if ((sc->sc_quirk & RTKQ_CMDSTOP) != 0)
2094 		CSR_WRITE_1(sc, RTK_COMMAND, RTK_CMD_STOPREQ | RTK_CMD_TX_ENB |
2095 		    RTK_CMD_RX_ENB);
2096 	else
2097 		CSR_WRITE_1(sc, RTK_COMMAND, 0x00);
2098 	DELAY(1000);
2099 	CSR_WRITE_2(sc, RTK_IMR, 0x0000);
2100 	CSR_WRITE_2(sc, RTK_ISR, 0xFFFF);
2101 
2102 	if (sc->re_head != NULL) {
2103 		m_freem(sc->re_head);
2104 		sc->re_head = sc->re_tail = NULL;
2105 	}
2106 
2107 	/* Free the TX list buffers. */
2108 	for (i = 0; i < RE_TX_QLEN; i++) {
2109 		if (sc->re_ldata.re_txq[i].txq_mbuf != NULL) {
2110 			bus_dmamap_unload(sc->sc_dmat,
2111 			    sc->re_ldata.re_txq[i].txq_dmamap);
2112 			m_freem(sc->re_ldata.re_txq[i].txq_mbuf);
2113 			sc->re_ldata.re_txq[i].txq_mbuf = NULL;
2114 		}
2115 	}
2116 
2117 	/* Free the RX list buffers. */
2118 	for (i = 0; i < RE_RX_DESC_CNT; i++) {
2119 		if (sc->re_ldata.re_rxsoft[i].rxs_mbuf != NULL) {
2120 			bus_dmamap_unload(sc->sc_dmat,
2121 			    sc->re_ldata.re_rxsoft[i].rxs_dmamap);
2122 			m_freem(sc->re_ldata.re_rxsoft[i].rxs_mbuf);
2123 			sc->re_ldata.re_rxsoft[i].rxs_mbuf = NULL;
2124 		}
2125 	}
2126 
2127 	if (disable)
2128 		re_disable(sc);
2129 
2130 	ifp->if_flags &= ~(IFF_RUNNING | IFF_OACTIVE);
2131 	ifp->if_timer = 0;
2132 }
2133