xref: /netbsd-src/sys/dev/ic/smc91cxx.c (revision cd22f25e6f6d1cc1f197fe8c5468a80f51d1c4e1)
1 /*	$NetBSD: smc91cxx.c,v 1.68 2008/04/29 17:48:43 nakayama Exp $	*/
2 
3 /*-
4  * Copyright (c) 1997 The NetBSD Foundation, Inc.
5  * All rights reserved.
6  *
7  * This code is derived from software contributed to The NetBSD Foundation
8  * by Jason R. Thorpe of the Numerical Aerospace Simulation Facility,
9  * NASA Ames Research Center.
10  *
11  * Redistribution and use in source and binary forms, with or without
12  * modification, are permitted provided that the following conditions
13  * are met:
14  * 1. Redistributions of source code must retain the above copyright
15  *    notice, this list of conditions and the following disclaimer.
16  * 2. Redistributions in binary form must reproduce the above copyright
17  *    notice, this list of conditions and the following disclaimer in the
18  *    documentation and/or other materials provided with the distribution.
19  *
20  * THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS
21  * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
22  * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
23  * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS
24  * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
25  * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
26  * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
27  * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
28  * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
29  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
30  * POSSIBILITY OF SUCH DAMAGE.
31  */
32 
33 /*
34  * Copyright (c) 1996 Gardner Buchanan <gbuchanan@shl.com>
35  * All rights reserved.
36  *
37  * Redistribution and use in source and binary forms, with or without
38  * modification, are permitted provided that the following conditions
39  * are met:
40  * 1. Redistributions of source code must retain the above copyright
41  *    notice, this list of conditions and the following disclaimer.
42  * 2. Redistributions in binary form must reproduce the above copyright
43  *    notice, this list of conditions and the following disclaimer in the
44  *    documentation and/or other materials provided with the distribution.
45  * 3. All advertising materials mentioning features or use of this software
46  *    must display the following acknowledgement:
47  *	This product includes software developed by Gardner Buchanan.
48  * 4. The name of Gardner Buchanan may not be used to endorse or promote
49  *    products derived from this software without specific prior written
50  *    permission.
51  *
52  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
53  * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
54  * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
55  * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
56  * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
57  * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
58  * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
59  * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
60  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
61  * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
62  *
63  *   from FreeBSD Id: if_sn.c,v 1.4 1996/03/18 15:47:16 gardner Exp
64  */
65 
66 /*
67  * Core driver for the SMC 91Cxx family of Ethernet chips.
68  *
69  * Memory allocation interrupt logic is drived from an SMC 91C90 driver
70  * written for NetBSD/amiga by Michael Hitch.
71  */
72 
73 #include <sys/cdefs.h>
74 __KERNEL_RCSID(0, "$NetBSD: smc91cxx.c,v 1.68 2008/04/29 17:48:43 nakayama Exp $");
75 
76 #include "opt_inet.h"
77 #include "bpfilter.h"
78 #include "rnd.h"
79 
80 #include <sys/param.h>
81 #include <sys/systm.h>
82 #include <sys/mbuf.h>
83 #include <sys/syslog.h>
84 #include <sys/socket.h>
85 #include <sys/device.h>
86 #include <sys/kernel.h>
87 #include <sys/malloc.h>
88 #include <sys/ioctl.h>
89 #include <sys/errno.h>
90 #if NRND > 0
91 #include <sys/rnd.h>
92 #endif
93 
94 #include <sys/bus.h>
95 #include <sys/intr.h>
96 
97 #include <net/if.h>
98 #include <net/if_dl.h>
99 #include <net/if_ether.h>
100 #include <net/if_media.h>
101 
102 #ifdef INET
103 #include <netinet/in.h>
104 #include <netinet/if_inarp.h>
105 #include <netinet/in_systm.h>
106 #include <netinet/in_var.h>
107 #include <netinet/ip.h>
108 #endif
109 
110 
111 
112 #if NBPFILTER > 0
113 #include <net/bpf.h>
114 #include <net/bpfdesc.h>
115 #endif
116 
117 #include <dev/mii/mii.h>
118 #include <dev/mii/miivar.h>
119 #include <dev/mii/mii_bitbang.h>
120 
121 #include <dev/ic/smc91cxxreg.h>
122 #include <dev/ic/smc91cxxvar.h>
123 
124 #ifndef __BUS_SPACE_HAS_STREAM_METHODS
125 #define bus_space_write_multi_stream_2 bus_space_write_multi_2
126 #define bus_space_write_multi_stream_4 bus_space_write_multi_4
127 #define bus_space_read_multi_stream_2  bus_space_read_multi_2
128 #define bus_space_read_multi_stream_4  bus_space_read_multi_4
129 
130 #define bus_space_write_stream_4 bus_space_write_4
131 #define bus_space_read_stream_4  bus_space_read_4
132 #endif /* __BUS_SPACE_HAS_STREAM_METHODS */
133 
134 /* XXX Hardware padding doesn't work yet(?) */
135 #define	SMC91CXX_SW_PAD
136 #define	SMC91CXX_NO_BYTE_WRITE
137 
138 const char *smc91cxx_idstrs[] = {
139 	NULL,				/* 0 */
140 	NULL,				/* 1 */
141 	NULL,				/* 2 */
142 	"SMC91C90/91C92",		/* 3 */
143 	"SMC91C94/91C96",		/* 4 */
144 	"SMC91C95",			/* 5 */
145 	NULL,				/* 6 */
146 	"SMC91C100",			/* 7 */
147 	"SMC91C100FD",			/* 8 */
148 	"SMC91C111",			/* 9 */
149 	NULL,				/* 10 */
150 	NULL,				/* 11 */
151 	NULL,				/* 12 */
152 	NULL,				/* 13 */
153 	NULL,				/* 14 */
154 	NULL,				/* 15 */
155 };
156 
157 /* Supported media types. */
158 const int smc91cxx_media[] = {
159 	IFM_ETHER|IFM_10_T,
160 	IFM_ETHER|IFM_10_5,
161 };
162 #define	NSMC91CxxMEDIA	(sizeof(smc91cxx_media) / sizeof(smc91cxx_media[0]))
163 
164 /*
165  * MII bit-bang glue.
166  */
167 u_int32_t smc91cxx_mii_bitbang_read(struct device *);
168 void smc91cxx_mii_bitbang_write(struct device *, u_int32_t);
169 
170 const struct mii_bitbang_ops smc91cxx_mii_bitbang_ops = {
171 	smc91cxx_mii_bitbang_read,
172 	smc91cxx_mii_bitbang_write,
173 	{
174 		MR_MDO,		/* MII_BIT_MDO */
175 		MR_MDI,		/* MII_BIT_MDI */
176 		MR_MCLK,	/* MII_BIT_MDC */
177 		MR_MDOE,	/* MII_BIT_DIR_HOST_PHY */
178 		0,		/* MII_BIT_DIR_PHY_HOST */
179 	}
180 };
181 
182 /* MII callbacks */
183 int	smc91cxx_mii_readreg(struct device *, int, int);
184 void	smc91cxx_mii_writereg(struct device *, int, int, int);
185 void	smc91cxx_statchg(struct device *);
186 void	smc91cxx_tick(void *);
187 
188 int	smc91cxx_mediachange(struct ifnet *);
189 void	smc91cxx_mediastatus(struct ifnet *, struct ifmediareq *);
190 
191 int	smc91cxx_set_media(struct smc91cxx_softc *, int);
192 
193 void	smc91cxx_init(struct smc91cxx_softc *);
194 void	smc91cxx_read(struct smc91cxx_softc *);
195 void	smc91cxx_reset(struct smc91cxx_softc *);
196 void	smc91cxx_start(struct ifnet *);
197 uint8_t	smc91cxx_copy_tx_frame(struct smc91cxx_softc *, struct mbuf *);
198 void	smc91cxx_resume(struct smc91cxx_softc *);
199 void	smc91cxx_stop(struct smc91cxx_softc *);
200 void	smc91cxx_watchdog(struct ifnet *);
201 int	smc91cxx_ioctl(struct ifnet *, u_long, void *);
202 
203 static inline int ether_cmp(const void *, const void *);
204 static inline int
205 ether_cmp(va, vb)
206 	const void *va, *vb;
207 {
208 	const u_int8_t *a = va;
209 	const u_int8_t *b = vb;
210 
211 	return ((a[5] != b[5]) || (a[4] != b[4]) || (a[3] != b[3]) ||
212 		(a[2] != b[2]) || (a[1] != b[1]) || (a[0] != b[0]));
213 }
214 
215 static inline void
216 smc91cxx_intr_mask_write(bus_space_tag_t bst, bus_space_handle_t bsh,
217 	uint8_t mask)
218 {
219 	KDASSERT((mask & IM_ERCV_INT) == 0);
220 #ifdef SMC91CXX_NO_BYTE_WRITE
221 #if BYTE_ORDER == LITTLE_ENDIAN
222 	bus_space_write_2(bst, bsh, INTR_STAT_REG_B, mask << 8);
223 #else
224 	bus_space_write_2(bst, bsh, INTR_STAT_REG_B, mask);
225 #endif
226 #else
227 	bus_space_write_1(bst, bsh, INTR_MASK_REG_B, mask);
228 #endif
229 	KDASSERT(!(bus_space_read_1(bst, bsh, INTR_MASK_REG_B) & IM_ERCV_INT));
230 }
231 
232 static inline void
233 smc91cxx_intr_ack_write(bus_space_tag_t bst, bus_space_handle_t bsh,
234 	uint8_t mask)
235 {
236 #ifdef SMC91CXX_NO_BYTE_WRITE
237 #if BYTE_ORDER == LITTLE_ENDIAN
238 	bus_space_write_2(bst, bsh, INTR_ACK_REG_B,
239 	    mask | (bus_space_read_2(bst, bsh, INTR_ACK_REG_B) & 0xff00));
240 #else
241 	bus_space_write_2(bst, bsh, INTR_ACK_REG_B,
242 	    (mask << 8) | (bus_space_read_2(bst, bsh, INTR_ACK_REG_B) & 0xff));
243 #endif
244 #else
245 	bus_space_write_1(bst, bsh, INTR_ACK_REG_B, mask);
246 #endif
247 	KDASSERT(!(bus_space_read_1(bst, bsh, INTR_MASK_REG_B) & IM_ERCV_INT));
248 }
249 
250 void
251 smc91cxx_attach(sc, myea)
252 	struct smc91cxx_softc *sc;
253 	u_int8_t *myea;
254 {
255 	struct ifnet *ifp = &sc->sc_ec.ec_if;
256 	bus_space_tag_t bst = sc->sc_bst;
257 	bus_space_handle_t bsh = sc->sc_bsh;
258 	struct ifmedia *ifm = &sc->sc_mii.mii_media;
259 	const char *idstr;
260 	u_int32_t miicapabilities;
261 	u_int16_t tmp;
262 	u_int8_t enaddr[ETHER_ADDR_LEN];
263 	int i, aui, mult, scale, memsize;
264 	char pbuf[9];
265 
266 	tmp = bus_space_read_2(bst, bsh, BANK_SELECT_REG_W);
267 	/* check magic number */
268 	if ((tmp & BSR_DETECT_MASK) != BSR_DETECT_VALUE) {
269 		aprint_error_dev(&sc->sc_dev, "failed to detect chip, bsr=%04x\n", tmp);
270 		return;
271 	}
272 
273 	/* Make sure the chip is stopped. */
274 	smc91cxx_stop(sc);
275 
276 	SMC_SELECT_BANK(sc, 3);
277 	tmp = bus_space_read_2(bst, bsh, REVISION_REG_W);
278 	sc->sc_chipid = RR_ID(tmp);
279 	idstr = smc91cxx_idstrs[sc->sc_chipid];
280 
281 	aprint_normal_dev(&sc->sc_dev, "");
282 	if (idstr != NULL)
283 		aprint_normal("%s, ", idstr);
284 	else
285 		aprint_normal("unknown chip id %d, ", sc->sc_chipid);
286 	aprint_normal("revision %d, ", RR_REV(tmp));
287 
288 	SMC_SELECT_BANK(sc, 0);
289 	switch (sc->sc_chipid) {
290 	default:
291 		mult = MCR_MEM_MULT(bus_space_read_2(bst, bsh, MEM_CFG_REG_W));
292 		scale = MIR_SCALE_91C9x;
293 		break;
294 
295 	case CHIP_91C111:
296 		mult = MIR_MULT_91C111;
297 		scale = MIR_SCALE_91C111;
298 	}
299 	memsize = bus_space_read_2(bst, bsh, MEM_INFO_REG_W) & MIR_TOTAL_MASK;
300 	if (memsize == 255) memsize++;
301 	memsize *= scale * mult;
302 
303 	format_bytes(pbuf, sizeof(pbuf), memsize);
304 	aprint_normal("buffer size: %s\n", pbuf);
305 
306 	/* Read the station address from the chip. */
307 	SMC_SELECT_BANK(sc, 1);
308 	if (myea == NULL) {
309 		myea = enaddr;
310 		for (i = 0; i < ETHER_ADDR_LEN; i += 2) {
311 			tmp = bus_space_read_2(bst, bsh, IAR_ADDR0_REG_W + i);
312 			myea[i + 1] = (tmp >> 8) & 0xff;
313 			myea[i] = tmp & 0xff;
314 		}
315 	}
316 	aprint_normal_dev(&sc->sc_dev, "MAC address %s, ",
317 	    ether_sprintf(myea));
318 
319 	/* Initialize the ifnet structure. */
320 	strlcpy(ifp->if_xname, device_xname(&sc->sc_dev), IFNAMSIZ);
321 	ifp->if_softc = sc;
322 	ifp->if_start = smc91cxx_start;
323 	ifp->if_ioctl = smc91cxx_ioctl;
324 	ifp->if_watchdog = smc91cxx_watchdog;
325 	ifp->if_flags =
326 	    IFF_BROADCAST | IFF_SIMPLEX | IFF_NOTRAILERS | IFF_MULTICAST;
327 	IFQ_SET_READY(&ifp->if_snd);
328 
329 	/* Attach the interface. */
330 	if_attach(ifp);
331 	ether_ifattach(ifp, myea);
332 
333 	/*
334 	 * Initialize our media structures and MII info.  We will
335 	 * probe the MII if we are on the SMC91Cxx
336 	 */
337 	sc->sc_mii.mii_ifp = ifp;
338 	sc->sc_mii.mii_readreg = smc91cxx_mii_readreg;
339 	sc->sc_mii.mii_writereg = smc91cxx_mii_writereg;
340 	sc->sc_mii.mii_statchg = smc91cxx_statchg;
341 	ifmedia_init(ifm, IFM_IMASK, smc91cxx_mediachange, smc91cxx_mediastatus);
342 
343 	SMC_SELECT_BANK(sc, 1);
344 	tmp = bus_space_read_2(bst, bsh, CONFIG_REG_W);
345 
346 	miicapabilities = BMSR_MEDIAMASK|BMSR_ANEG;
347 	switch (sc->sc_chipid) {
348 	case CHIP_91100:
349 		/*
350 		 * The 91100 does not have full-duplex capabilities,
351 		 * even if the PHY does.
352 		 */
353 		miicapabilities &= ~(BMSR_100TXFDX | BMSR_10TFDX);
354 	case CHIP_91100FD:
355 	case CHIP_91C111:
356 		if (tmp & CR_MII_SELECT) {
357 			aprint_normal("default media MII");
358 			if (sc->sc_chipid == CHIP_91C111) {
359 				aprint_normal(" (%s PHY)\n", (tmp & CR_AUI_SELECT) ?
360 				    "external" : "internal");
361 				sc->sc_internal_phy = !(tmp & CR_AUI_SELECT);
362 			} else
363 				aprint_normal("\n");
364 			mii_attach(&sc->sc_dev, &sc->sc_mii, miicapabilities,
365 			    MII_PHY_ANY, MII_OFFSET_ANY, 0);
366 			if (LIST_FIRST(&sc->sc_mii.mii_phys) == NULL) {
367 				ifmedia_add(&sc->sc_mii.mii_media,
368 				    IFM_ETHER|IFM_NONE, 0, NULL);
369 				ifmedia_set(&sc->sc_mii.mii_media,
370 				    IFM_ETHER|IFM_NONE);
371 			} else {
372 				ifmedia_set(&sc->sc_mii.mii_media,
373 				    IFM_ETHER|IFM_AUTO);
374 			}
375 			sc->sc_flags |= SMC_FLAGS_HAS_MII;
376 			break;
377 		} else
378 		if (sc->sc_chipid == CHIP_91C111) {
379 			/*
380 			 * XXX: Should bring it out of low-power mode
381 			 */
382 			aprint_normal("EPH interface in low power mode\n");
383 			sc->sc_internal_phy = 0;
384 			return;
385 		}
386 		/*FALLTHROUGH*/
387 	default:
388 		aprint_normal("default media %s\n", (aui = (tmp & CR_AUI_SELECT)) ?
389 		    "AUI" : "UTP");
390 		for (i = 0; i < NSMC91CxxMEDIA; i++)
391 			ifmedia_add(ifm, smc91cxx_media[i], 0, NULL);
392 		ifmedia_set(ifm, IFM_ETHER | (aui ? IFM_10_5 : IFM_10_T));
393 		break;
394 	}
395 
396 #if NRND > 0
397 	rnd_attach_source(&sc->rnd_source, device_xname(&sc->sc_dev),
398 			  RND_TYPE_NET, 0);
399 #endif
400 
401 	callout_init(&sc->sc_mii_callout, 0);
402 
403 	/* The attach is successful. */
404 	sc->sc_flags |= SMC_FLAGS_ATTACHED;
405 }
406 
407 /*
408  * Change media according to request.
409  */
410 int
411 smc91cxx_mediachange(ifp)
412 	struct ifnet *ifp;
413 {
414 	struct smc91cxx_softc *sc = ifp->if_softc;
415 
416 	return (smc91cxx_set_media(sc, sc->sc_mii.mii_media.ifm_media));
417 }
418 
419 int
420 smc91cxx_set_media(sc, media)
421 	struct smc91cxx_softc *sc;
422 	int media;
423 {
424 	bus_space_tag_t bst = sc->sc_bst;
425 	bus_space_handle_t bsh = sc->sc_bsh;
426 	u_int16_t tmp;
427 	int rc;
428 
429 	/*
430 	 * If the interface is not currently powered on, just return.
431 	 * When it is enabled later, smc91cxx_init() will properly set
432 	 * up the media for us.
433 	 */
434 	if ((sc->sc_flags & SMC_FLAGS_ENABLED) == 0)
435 		return (0);
436 
437 	if (IFM_TYPE(media) != IFM_ETHER)
438 		return (EINVAL);
439 
440 	if ((sc->sc_flags & SMC_FLAGS_HAS_MII) == 0 ||
441 	    (rc = mii_mediachg(&sc->sc_mii)) == ENXIO)
442 		rc = 0;
443 
444 	switch (IFM_SUBTYPE(media)) {
445 	case IFM_10_T:
446 	case IFM_10_5:
447 		SMC_SELECT_BANK(sc, 1);
448 		tmp = bus_space_read_2(bst, bsh, CONFIG_REG_W);
449 		if (IFM_SUBTYPE(media) == IFM_10_5)
450 			tmp |= CR_AUI_SELECT;
451 		else
452 			tmp &= ~CR_AUI_SELECT;
453 		bus_space_write_2(bst, bsh, CONFIG_REG_W, tmp);
454 		delay(20000);	/* XXX is this needed? */
455 		break;
456 
457 	default:
458 		return (EINVAL);
459 	}
460 
461 	return rc;
462 }
463 
464 /*
465  * Notify the world which media we're using.
466  */
467 void
468 smc91cxx_mediastatus(ifp, ifmr)
469 	struct ifnet *ifp;
470 	struct ifmediareq *ifmr;
471 {
472 	struct smc91cxx_softc *sc = ifp->if_softc;
473 	bus_space_tag_t bst = sc->sc_bst;
474 	bus_space_handle_t bsh = sc->sc_bsh;
475 	u_int16_t tmp;
476 
477 	if ((sc->sc_flags & SMC_FLAGS_ENABLED) == 0) {
478 		ifmr->ifm_active = IFM_ETHER | IFM_NONE;
479 		ifmr->ifm_status = 0;
480 		return;
481 	}
482 
483 	/*
484 	 * If we have MII, go ask the PHY what's going on.
485 	 */
486 	if (sc->sc_flags & SMC_FLAGS_HAS_MII) {
487 		mii_pollstat(&sc->sc_mii);
488 		ifmr->ifm_active = sc->sc_mii.mii_media_active;
489 		ifmr->ifm_status = sc->sc_mii.mii_media_status;
490 		return;
491 	}
492 
493 	SMC_SELECT_BANK(sc, 1);
494 	tmp = bus_space_read_2(bst, bsh, CONFIG_REG_W);
495 	ifmr->ifm_active =
496 	    IFM_ETHER | ((tmp & CR_AUI_SELECT) ? IFM_10_5 : IFM_10_T);
497 }
498 
499 /*
500  * Reset and initialize the chip.
501  */
502 void
503 smc91cxx_init(sc)
504 	struct smc91cxx_softc *sc;
505 {
506 	struct ifnet *ifp = &sc->sc_ec.ec_if;
507 	bus_space_tag_t bst = sc->sc_bst;
508 	bus_space_handle_t bsh = sc->sc_bsh;
509 	u_int16_t tmp;
510 	const u_int8_t *enaddr;
511 	int s, i;
512 
513 	s = splnet();
514 
515 	/*
516 	 * This resets the registers mostly to defaults, but doesn't
517 	 * affect the EEPROM.  After the reset cycle, we pause briefly
518 	 * for the chip to recover.
519 	 *
520 	 * XXX how long are we really supposed to delay?  --thorpej
521 	 */
522 	SMC_SELECT_BANK(sc, 0);
523 	bus_space_write_2(bst, bsh, RECV_CONTROL_REG_W, RCR_SOFTRESET);
524 	delay(100);
525 	bus_space_write_2(bst, bsh, RECV_CONTROL_REG_W, 0);
526 	delay(200);
527 
528 	bus_space_write_2(bst, bsh, TXMIT_CONTROL_REG_W, 0);
529 
530 	/* Set the Ethernet address. */
531 	SMC_SELECT_BANK(sc, 1);
532 	enaddr = (const u_int8_t *)CLLADDR(ifp->if_sadl);
533 	for (i = 0; i < ETHER_ADDR_LEN; i += 2) {
534 		tmp = enaddr[i + 1] << 8 | enaddr[i];
535 		bus_space_write_2(bst, bsh, IAR_ADDR0_REG_W + i, tmp);
536 	}
537 
538 	/*
539 	 * Set the control register to automatically release successfully
540 	 * transmitted packets (making the best use of our limited memory)
541 	 * and enable the EPH interrupt on certain TX errors.
542 	 */
543 	bus_space_write_2(bst, bsh, CONTROL_REG_W, (CTR_AUTO_RELEASE |
544 	    CTR_TE_ENABLE | CTR_CR_ENABLE | CTR_LE_ENABLE));
545 
546 	/*
547 	 * Reset the MMU and wait for it to be un-busy.
548 	 */
549 	SMC_SELECT_BANK(sc, 2);
550 	bus_space_write_2(bst, bsh, MMU_CMD_REG_W, MMUCR_RESET);
551 	sc->sc_txpacketno = ARR_FAILED;
552 	for (;;) {
553 		tmp = bus_space_read_2(bst, bsh, MMU_CMD_REG_W);
554 		if (tmp == 0xffff)	/* card went away! */
555 			return;
556 		if ((tmp & MMUCR_BUSY) == 0)
557 			break;
558 	}
559 
560 	/*
561 	 * Disable all interrupts.
562 	 */
563 	smc91cxx_intr_mask_write(bst, bsh, 0);
564 
565 	/*
566 	 * On the 91c111, enable auto-negotiation, and set the LED
567 	 * status pins to something sane.
568 	 * XXX: Should be some way for MD code to decide the latter.
569 	 */
570 	SMC_SELECT_BANK(sc, 0);
571 	if (sc->sc_chipid == CHIP_91C111) {
572 		bus_space_write_2(bst, bsh, RX_PHY_CONTROL_REG_W,
573 		    RPC_ANEG |
574 		    (RPC_LS_LINK_DETECT << RPC_LSA_SHIFT) |
575 		    (RPC_LS_TXRX << RPC_LSB_SHIFT));
576 	}
577 
578 	/*
579 	 * Set current media.
580 	 */
581 	smc91cxx_set_media(sc, sc->sc_mii.mii_media.ifm_cur->ifm_media);
582 
583 	/*
584 	 * Set the receive filter.  We want receive enable and auto
585 	 * strip of CRC from received packet.  If we are in promisc. mode,
586 	 * then set that bit as well.
587 	 *
588 	 * XXX Initialize multicast filter.  For now, we just accept
589 	 * XXX all multicast.
590 	 */
591 	SMC_SELECT_BANK(sc, 0);
592 
593 	tmp = RCR_ENABLE | RCR_STRIP_CRC | RCR_ALMUL;
594 	if (ifp->if_flags & IFF_PROMISC)
595 		tmp |= RCR_PROMISC;
596 
597 	bus_space_write_2(bst, bsh, RECV_CONTROL_REG_W, tmp);
598 
599 	/*
600 	 * Set transmitter control to "enabled".
601 	 */
602 	tmp = TCR_ENABLE;
603 
604 #ifndef SMC91CXX_SW_PAD
605 	/*
606 	 * Enable hardware padding of transmitted packets.
607 	 * XXX doesn't work?
608 	 */
609 	tmp |= TCR_PAD_ENABLE;
610 #endif
611 
612 	bus_space_write_2(bst, bsh, TXMIT_CONTROL_REG_W, tmp);
613 
614 	/*
615 	 * Now, enable interrupts.
616 	 */
617 	SMC_SELECT_BANK(sc, 2);
618 
619 	sc->sc_intmask = IM_EPH_INT | IM_RX_OVRN_INT | IM_RCV_INT;
620 	if (sc->sc_chipid == CHIP_91C111 && sc->sc_internal_phy) {
621 		sc->sc_intmask |= IM_MD_INT;
622 	}
623 	smc91cxx_intr_mask_write(bst, bsh, sc->sc_intmask);
624 
625 	/* Interface is now running, with no output active. */
626 	ifp->if_flags |= IFF_RUNNING;
627 	ifp->if_flags &= ~IFF_OACTIVE;
628 
629 	if (sc->sc_flags & SMC_FLAGS_HAS_MII) {
630 		/* Start the one second clock. */
631 		callout_reset(&sc->sc_mii_callout, hz, smc91cxx_tick, sc);
632 	}
633 
634 	/*
635 	 * Attempt to start any pending transmission.
636 	 */
637 	smc91cxx_start(ifp);
638 
639 	splx(s);
640 }
641 
642 /*
643  * Start output on an interface.
644  * Must be called at splnet or interrupt level.
645  */
646 void
647 smc91cxx_start(ifp)
648 	struct ifnet *ifp;
649 {
650 	struct smc91cxx_softc *sc = ifp->if_softc;
651 	bus_space_tag_t bst = sc->sc_bst;
652 	bus_space_handle_t bsh = sc->sc_bsh;
653 	u_int len;
654 	struct mbuf *m;
655 	u_int16_t length, npages;
656 	u_int16_t oddbyte;
657 	u_int8_t packetno;
658 	int timo, pad;
659 
660 	if ((ifp->if_flags & (IFF_RUNNING|IFF_OACTIVE)) != IFF_RUNNING)
661 		return;
662 
663  again:
664 	/*
665 	 * Peek at the next packet.
666 	 */
667 	IFQ_POLL(&ifp->if_snd, m);
668 	if (m == NULL)
669 		return;
670 
671 	/*
672 	 * Compute the frame length and set pad to give an overall even
673 	 * number of bytes.  Below, we assume that the packet length
674 	 * is even.
675 	 */
676 	for (len = 0; m != NULL; m = m->m_next)
677 		len += m->m_len;
678 	pad = (len & 1);
679 
680 	/*
681 	 * We drop packets that are too large.  Perhaps we should
682 	 * truncate them instead?
683 	 */
684 	if ((len + pad) > (ETHER_MAX_LEN - ETHER_CRC_LEN)) {
685 		printf("%s: large packet discarded\n", device_xname(&sc->sc_dev));
686 		ifp->if_oerrors++;
687 		IFQ_DEQUEUE(&ifp->if_snd, m);
688 		m_freem(m);
689 		goto readcheck;
690 	}
691 
692 #ifdef SMC91CXX_SW_PAD
693 	/*
694 	 * Not using hardware padding; pad to ETHER_MIN_LEN.
695 	 */
696 	if (len < (ETHER_MIN_LEN - ETHER_CRC_LEN))
697 		pad = ETHER_MIN_LEN - ETHER_CRC_LEN - len;
698 #endif
699 
700 	length = pad + len;
701 
702 	/*
703 	 * The MMU has a 256 byte page size.  The MMU expects us to
704 	 * ask for "npages - 1".  We include space for the status word,
705 	 * byte count, and control bytes in the allocation request.
706 	 */
707 	npages = ((length & ~1) + 6) >> 8;
708 
709 	/*
710 	 * Now allocate the memory.
711 	 */
712 	SMC_SELECT_BANK(sc, 2);
713 	bus_space_write_2(bst, bsh, MMU_CMD_REG_W, MMUCR_ALLOC | npages);
714 
715 	timo = MEMORY_WAIT_TIME;
716 	if (__predict_false((sc->sc_txpacketno & ARR_FAILED) == 0)) {
717 		packetno = sc->sc_txpacketno;
718 		sc->sc_txpacketno = ARR_FAILED;
719 	} else {
720 		do {
721 			if (bus_space_read_1(bst, bsh,
722 			    		     INTR_STAT_REG_B) & IM_ALLOC_INT)
723 				break;
724 			delay(1);
725 		} while (--timo);
726 	}
727 
728 	packetno = bus_space_read_1(bst, bsh, ALLOC_RESULT_REG_B);
729 
730 	if (packetno & ARR_FAILED || timo == 0) {
731 		/*
732 		 * No transmit memory is available.  Record the number
733 		 * of requestd pages and enable the allocation completion
734 		 * interrupt.  Set up the watchdog timer in case we miss
735 		 * the interrupt.  Mark the interface as active so that
736 		 * no one else attempts to transmit while we're allocating
737 		 * memory.
738 		 */
739 		sc->sc_intmask |= IM_ALLOC_INT;
740 		smc91cxx_intr_mask_write(bst, bsh, sc->sc_intmask);
741 		ifp->if_timer = 5;
742 		ifp->if_flags |= IFF_OACTIVE;
743 
744 		return;
745 	}
746 
747 	/*
748 	 * We have a packet number - set the data window.
749 	 */
750 	bus_space_write_1(bst, bsh, PACKET_NUM_REG_B, packetno);
751 
752 	/*
753 	 * Point to the beginning of the packet.
754 	 */
755 	bus_space_write_2(bst, bsh, POINTER_REG_W, PTR_AUTOINC /* | 0x0000 */);
756 
757 	/*
758 	 * Send the packet length (+6 for stats, length, and control bytes)
759 	 * and the status word (set to zeros).
760 	 */
761 	bus_space_write_2(bst, bsh, DATA_REG_W, 0);
762 	bus_space_write_2(bst, bsh, DATA_REG_W, (length + 6) & 0x7ff);
763 
764 	/*
765 	 * Get the packet from the kernel.  This will include the Ethernet
766 	 * frame header, MAC address, etc.
767 	 */
768 	IFQ_DEQUEUE(&ifp->if_snd, m);
769 
770 	/*
771 	 * Push the packet out to the card.
772 	 */
773 	oddbyte = smc91cxx_copy_tx_frame(sc, m);
774 
775 #ifdef SMC91CXX_SW_PAD
776 #if BYTE_ORDER == LITTLE_ENDIAN
777 	if (pad > 1 && (pad & 1)) {
778 		bus_space_write_2(bst, bsh, DATA_REG_W, oddbyte << 0);
779 		oddbyte = 0;
780 	}
781 #else
782 	if (pad > 1 && (pad & 1)) {
783 		bus_space_write_2(bst, bsh, DATA_REG_W, oddbyte << 8);
784 		oddbyte = 0;
785 	}
786 #endif
787 
788 	/*
789 	 * Push out padding.
790 	 */
791 	while (pad > 1) {
792 		bus_space_write_2(bst, bsh, DATA_REG_W, 0);
793 		pad -= 2;
794 	}
795 #endif
796 
797 	/*
798 	 * Push out control byte and unused packet byte.  The control byte
799 	 * is 0, meaning the packet is even lengthed and no special
800 	 * CRC handling is necessary.
801 	 */
802 #if BYTE_ORDER == LITTLE_ENDIAN
803 	bus_space_write_2(bst, bsh, DATA_REG_W,
804 	    oddbyte | (pad ? (CTLB_ODD << 8) : 0));
805 #else
806 	bus_space_write_2(bst, bsh, DATA_REG_W,
807 	    (oddbyte << 8) | (pad ? CTLB_ODD : 0));
808 #endif
809 
810 	/*
811 	 * Enable transmit interrupts and let the chip go.  Set a watchdog
812 	 * in case we miss the interrupt.
813 	 */
814 	sc->sc_intmask |= IM_TX_INT | IM_TX_EMPTY_INT;
815 	smc91cxx_intr_mask_write(bst, bsh, sc->sc_intmask);
816 
817 	bus_space_write_2(bst, bsh, MMU_CMD_REG_W, MMUCR_ENQUEUE);
818 
819 	ifp->if_timer = 5;
820 
821 #if NBPFILTER > 0
822 	/* Hand off a copy to the bpf. */
823 	if (ifp->if_bpf)
824 		bpf_mtap(ifp->if_bpf, m);
825 #endif
826 
827 	ifp->if_opackets++;
828 	m_freem(m);
829 
830  readcheck:
831 	/*
832 	 * Check for incoming pcakets.  We don't want to overflow the small
833 	 * RX FIFO.  If nothing has arrived, attempt to queue another
834 	 * transmit packet.
835 	 */
836 	if (bus_space_read_2(bst, bsh, FIFO_PORTS_REG_W) & FIFO_REMPTY)
837 		goto again;
838 }
839 
840 /*
841  * Squirt a (possibly misaligned) mbuf to the device
842  */
843 uint8_t
844 smc91cxx_copy_tx_frame(sc, m0)
845 	struct smc91cxx_softc *sc;
846 	struct mbuf *m0;
847 {
848 	bus_space_tag_t bst = sc->sc_bst;
849 	bus_space_handle_t bsh = sc->sc_bsh;
850 	struct mbuf *m;
851 	int len, leftover;
852 	u_int16_t dbuf;
853 	u_int8_t *p;
854 #ifdef DIAGNOSTIC
855 	u_int8_t *lim;
856 #endif
857 
858 	/* start out with no leftover data */
859 	leftover = 0;
860 	dbuf = 0;
861 
862 	/* Process the chain of mbufs */
863 	for (m = m0; m != NULL; m = m->m_next) {
864 		/*
865 		 * Process all of the data in a single mbuf.
866 		 */
867 		p = mtod(m, u_int8_t *);
868 		len = m->m_len;
869 #ifdef DIAGNOSTIC
870 		lim = p + len;
871 #endif
872 
873 		while (len > 0) {
874 			if (leftover) {
875 				/*
876 				 * Data left over (from mbuf or realignment).
877 				 * Buffer the next byte, and write it and
878 				 * the leftover data out.
879 				 */
880 				dbuf |= *p++ << 8;
881 				len--;
882 				bus_space_write_2(bst, bsh, DATA_REG_W, dbuf);
883 				leftover = 0;
884 			} else if ((long) p & 1) {
885 				/*
886 				 * Misaligned data.  Buffer the next byte.
887 				 */
888 				dbuf = *p++;
889 				len--;
890 				leftover = 1;
891 			} else {
892 				/*
893 				 * Aligned data.  This is the case we like.
894 				 *
895 				 * Write-region out as much as we can, then
896 				 * buffer the remaining byte (if any).
897 				 */
898 				leftover = len & 1;
899 				len &= ~1;
900 				bus_space_write_multi_stream_2(bst, bsh,
901 				    DATA_REG_W, (u_int16_t *)p, len >> 1);
902 				p += len;
903 
904 				if (leftover)
905 					dbuf = *p++;
906 				len = 0;
907 			}
908 		}
909 		if (len < 0)
910 			panic("smc91cxx_copy_tx_frame: negative len");
911 #ifdef DIAGNOSTIC
912 		if (p != lim)
913 			panic("smc91cxx_copy_tx_frame: p != lim");
914 #endif
915 	}
916 	return dbuf;
917 }
918 
919 /*
920  * Interrupt service routine.
921  */
922 int
923 smc91cxx_intr(arg)
924 	void *arg;
925 {
926 	struct smc91cxx_softc *sc = arg;
927 	struct ifnet *ifp = &sc->sc_ec.ec_if;
928 	bus_space_tag_t bst = sc->sc_bst;
929 	bus_space_handle_t bsh = sc->sc_bsh;
930 	u_int8_t mask, interrupts, status;
931 	u_int16_t packetno, tx_status, card_stats, v;
932 
933 	if ((sc->sc_flags & SMC_FLAGS_ENABLED) == 0 ||
934 	    !device_is_active(&sc->sc_dev))
935 		return (0);
936 
937 	SMC_SELECT_BANK(sc, 2);
938 
939 	/*
940 	 * Obtain the current interrupt status and mask.
941 	 */
942 	v = bus_space_read_2(bst, bsh, INTR_STAT_REG_B);
943 
944 	/*
945 	 * Get the set of interrupt which occurred and eliminate any
946 	 * which are not enabled.
947 	 */
948 #if BYTE_ORDER == LITTLE_ENDIAN
949 	mask = v >> 8;
950 	interrupts = v & 0xff;
951 #else
952 	interrupts = v >> 8;
953 	mask = v & 0xff;
954 #endif
955 	KDASSERT(mask == sc->sc_intmask);
956 	status = interrupts & mask;
957 
958 	/* Ours? */
959 	if (status == 0)
960 		return (0);
961 
962 	/*
963 	 * It's ours; disable all interrupts while we process them.
964 	 */
965 	smc91cxx_intr_mask_write(bst, bsh, 0);
966 
967 	/*
968 	 * Receive overrun interrupts.
969 	 */
970 	if (status & IM_RX_OVRN_INT) {
971 		smc91cxx_intr_ack_write(bst, bsh, IM_RX_OVRN_INT);
972 		ifp->if_ierrors++;
973 	}
974 
975 	/*
976 	 * Receive interrupts.
977 	 */
978 	if (status & IM_RCV_INT) {
979 #if 1 /* DIAGNOSTIC */
980 		packetno = bus_space_read_2(bst, bsh, FIFO_PORTS_REG_W);
981 		if (packetno & FIFO_REMPTY) {
982 			aprint_error_dev(&sc->sc_dev, "receive interrupt on empty fifo\n");
983 			goto out;
984 		} else
985 #endif
986 		smc91cxx_read(sc);
987 	}
988 
989 	/*
990 	 * Memory allocation interrupts.
991 	 */
992 	if (status & IM_ALLOC_INT) {
993 		/* Disable this interrupt. */
994 		mask &= ~IM_ALLOC_INT;
995 		sc->sc_intmask &= ~IM_ALLOC_INT;
996 
997 		/*
998 		 * Save allocated packet number for use in start
999 		 */
1000 		packetno = bus_space_read_1(bst, bsh, ALLOC_RESULT_REG_B);
1001 		KASSERT(sc->sc_txpacketno & ARR_FAILED);
1002 		sc->sc_txpacketno = packetno;
1003 
1004 		/*
1005 		 * We can transmit again!
1006 		 */
1007 		ifp->if_flags &= ~IFF_OACTIVE;
1008 		ifp->if_timer = 0;
1009 	}
1010 
1011 	/*
1012 	 * Transmit complete interrupt.  Handle transmission error messages.
1013 	 * This will only be called on error condition because of AUTO RELEASE
1014 	 * mode.
1015 	 */
1016 	if (status & IM_TX_INT) {
1017 		smc91cxx_intr_ack_write(bst, bsh, IM_TX_INT);
1018 
1019 		packetno = bus_space_read_2(bst, bsh, FIFO_PORTS_REG_W) &
1020 		    FIFO_TX_MASK;
1021 
1022 		/*
1023 		 * Select this as the packet to read from.
1024 		 */
1025 		bus_space_write_1(bst, bsh, PACKET_NUM_REG_B, packetno);
1026 
1027 		/*
1028 		 * Position the pointer to the beginning of the packet.
1029 		 */
1030 		bus_space_write_2(bst, bsh, POINTER_REG_W,
1031 		    PTR_AUTOINC | PTR_READ /* | 0x0000 */);
1032 
1033 		/*
1034 		 * Fetch the TX status word.  This will be a copy of
1035 		 * the EPH_STATUS_REG_W at the time of the transmission
1036 		 * failure.
1037 		 */
1038 		tx_status = bus_space_read_2(bst, bsh, DATA_REG_W);
1039 
1040 		if (tx_status & EPHSR_TX_SUC) {
1041 			static struct timeval txsuc_last;
1042 			static int txsuc_count;
1043 			if (ppsratecheck(&txsuc_last, &txsuc_count, 1))
1044 				printf("%s: successful packet caused TX"
1045 				    " interrupt?!\n", sc->sc_dev.dv_xname);
1046 		} else
1047 			ifp->if_oerrors++;
1048 
1049 		if (tx_status & EPHSR_LATCOL)
1050 			ifp->if_collisions++;
1051 
1052 		/* Disable this interrupt (start will reenable if needed). */
1053 		mask &= ~IM_TX_INT;
1054 		sc->sc_intmask &= ~IM_TX_INT;
1055 
1056 		/*
1057 		 * Some of these errors disable the transmitter; reenable it.
1058 		 */
1059 		SMC_SELECT_BANK(sc, 0);
1060 #ifdef SMC91CXX_SW_PAD
1061 		bus_space_write_2(bst, bsh, TXMIT_CONTROL_REG_W, TCR_ENABLE);
1062 #else
1063 		bus_space_write_2(bst, bsh, TXMIT_CONTROL_REG_W,
1064 		    TCR_ENABLE | TCR_PAD_ENABLE);
1065 #endif
1066 
1067 		/*
1068 		 * Kill the failed packet and wait for the MMU to unbusy.
1069 		 */
1070 		SMC_SELECT_BANK(sc, 2);
1071 		while (bus_space_read_2(bst, bsh, MMU_CMD_REG_W) & MMUCR_BUSY)
1072 			/* XXX bound this loop! */ ;
1073 		bus_space_write_2(bst, bsh, MMU_CMD_REG_W, MMUCR_FREEPKT);
1074 
1075 		ifp->if_timer = 0;
1076 	}
1077 
1078 	/*
1079 	 * Transmit underrun interrupts.  We use this opportunity to
1080 	 * update transmit statistics from the card.
1081 	 */
1082 	if (status & IM_TX_EMPTY_INT) {
1083 		smc91cxx_intr_ack_write(bst, bsh, IM_TX_EMPTY_INT);
1084 
1085 		/* Disable this interrupt. */
1086 		mask &= ~IM_TX_EMPTY_INT;
1087 		sc->sc_intmask &= ~IM_TX_EMPTY_INT;
1088 
1089 		SMC_SELECT_BANK(sc, 0);
1090 		card_stats = bus_space_read_2(bst, bsh, COUNTER_REG_W);
1091 
1092 		/* Single collisions. */
1093 		ifp->if_collisions += card_stats & ECR_COLN_MASK;
1094 
1095 		/* Multiple collisions. */
1096 		ifp->if_collisions += (card_stats & ECR_MCOLN_MASK) >> 4;
1097 
1098 		SMC_SELECT_BANK(sc, 2);
1099 
1100 		ifp->if_timer = 0;
1101 	}
1102 
1103 	if (sc->sc_chipid == CHIP_91C111 && sc->sc_internal_phy &&
1104 	    (status & IM_MD_INT)) {
1105 		/*
1106 		 * Internal PHY status change
1107 		 */
1108 		mii_tick(&sc->sc_mii);
1109 	}
1110 
1111 	/*
1112 	 * Other errors.  Reset the interface.
1113 	 */
1114 	if (status & IM_EPH_INT) {
1115 		smc91cxx_stop(sc);
1116 		smc91cxx_init(sc);
1117 	}
1118 
1119 	/*
1120 	 * Attempt to queue more packets for transmission.
1121 	 */
1122 	smc91cxx_start(ifp);
1123 
1124 out:
1125 	/*
1126 	 * Reenable the interrupts we wish to receive now that processing
1127 	 * is complete.
1128 	 */
1129 	mask |= sc->sc_intmask;
1130 	smc91cxx_intr_mask_write(bst, bsh, mask);
1131 
1132 #if NRND > 0
1133 	if (status)
1134 		rnd_add_uint32(&sc->rnd_source, status);
1135 #endif
1136 
1137 	return (1);
1138 }
1139 
1140 /*
1141  * Read a packet from the card and pass it up to the kernel.
1142  * NOTE!  WE EXPECT TO BE IN REGISTER WINDOW 2!
1143  */
1144 void
1145 smc91cxx_read(sc)
1146 	struct smc91cxx_softc *sc;
1147 {
1148 	struct ifnet *ifp = &sc->sc_ec.ec_if;
1149 	bus_space_tag_t bst = sc->sc_bst;
1150 	bus_space_handle_t bsh = sc->sc_bsh;
1151 	struct ether_header *eh;
1152 	struct mbuf *m;
1153 	u_int16_t status, packetno, packetlen;
1154 	u_int8_t *data;
1155 	u_int32_t dr;
1156 
1157  again:
1158 	/*
1159 	 * Set data pointer to the beginning of the packet.  Since
1160 	 * PTR_RCV is set, the packet number will be found automatically
1161 	 * in FIFO_PORTS_REG_W, FIFO_RX_MASK.
1162 	 */
1163 	packetno = bus_space_read_2(bst, bsh, FIFO_PORTS_REG_W);
1164 	if (packetno & FIFO_REMPTY)
1165 		return;
1166 
1167 	bus_space_write_2(bst, bsh, POINTER_REG_W,
1168 	    PTR_READ | PTR_RCV | PTR_AUTOINC /* | 0x0000 */);
1169 
1170 	/*
1171 	 * First two words are status and packet length.
1172 	 */
1173 	if ((sc->sc_flags & SMC_FLAGS_32BIT_READ) == 0) {
1174 		status = bus_space_read_2(bst, bsh, DATA_REG_W);
1175 		packetlen = bus_space_read_2(bst, bsh, DATA_REG_W);
1176 	} else {
1177 		dr = bus_space_read_4(bst, bsh, DATA_REG_W);
1178 #if BYTE_ORDER == LITTLE_ENDIAN
1179 		status = (u_int16_t)dr;
1180 		packetlen = (u_int16_t)(dr >> 16);
1181 #else
1182 		packetlen = (u_int16_t)dr;
1183 		status = (u_int16_t)(dr >> 16);
1184 #endif
1185 	}
1186 
1187 	packetlen &= RLEN_MASK;
1188 	if (packetlen < ETHER_MIN_LEN - ETHER_CRC_LEN + 6 || packetlen > 1534) {
1189 		ifp->if_ierrors++;
1190 		goto out;
1191 	}
1192 
1193 	/*
1194 	 * The packet length includes 3 extra words: status, length,
1195 	 * and an extra word that includes the control byte.
1196 	 */
1197 	packetlen -= 6;
1198 
1199 	/*
1200 	 * Account for receive errors and discard.
1201 	 */
1202 	if (status & RS_ERRORS) {
1203 		ifp->if_ierrors++;
1204 		goto out;
1205 	}
1206 
1207 	/*
1208 	 * Adjust for odd-length packet.
1209 	 */
1210 	if (status & RS_ODDFRAME)
1211 		packetlen++;
1212 
1213 	/*
1214 	 * Allocate a header mbuf.
1215 	 */
1216 	MGETHDR(m, M_DONTWAIT, MT_DATA);
1217 	if (m == NULL)
1218 		goto out;
1219 	m->m_pkthdr.rcvif = ifp;
1220 	m->m_pkthdr.len = packetlen;
1221 
1222 	/*
1223 	 * Always put the packet in a cluster.
1224 	 * XXX should chain small mbufs if less than threshold.
1225 	 */
1226 	MCLGET(m, M_DONTWAIT);
1227 	if ((m->m_flags & M_EXT) == 0) {
1228 		m_freem(m);
1229 		ifp->if_ierrors++;
1230 		aprint_error_dev(&sc->sc_dev, "can't allocate cluster for incoming packet\n");
1231 		goto out;
1232 	}
1233 
1234 	/*
1235 	 * Pull the packet off the interface.  Make sure the payload
1236 	 * is aligned.
1237 	 */
1238 	if ((sc->sc_flags & SMC_FLAGS_32BIT_READ) == 0) {
1239 		m->m_data = (char *) ALIGN(mtod(m, char *) +
1240 		    sizeof(struct ether_header)) - sizeof(struct ether_header);
1241 
1242 		eh = mtod(m, struct ether_header *);
1243 		data = mtod(m, u_int8_t *);
1244 		KASSERT(trunc_page((uintptr_t)data) == trunc_page((uintptr_t)data + packetlen - 1));
1245 		if (packetlen > 1)
1246 			bus_space_read_multi_stream_2(bst, bsh, DATA_REG_W,
1247 			    (u_int16_t *)data, packetlen >> 1);
1248 		if (packetlen & 1) {
1249 			data += packetlen & ~1;
1250 			*data = bus_space_read_1(bst, bsh, DATA_REG_B);
1251 		}
1252 	} else {
1253 		u_int8_t *dp;
1254 
1255 		m->m_data = (void *) ALIGN(mtod(m, void *));
1256 		eh = mtod(m, struct ether_header *);
1257 		dp = data = mtod(m, u_int8_t *);
1258 		KASSERT(trunc_page((uintptr_t)data) == trunc_page((uintptr_t)data + packetlen - 1));
1259 		if (packetlen > 3)
1260 			bus_space_read_multi_stream_4(bst, bsh, DATA_REG_W,
1261 			    (u_int32_t *)data, packetlen >> 2);
1262 		if (packetlen & 3) {
1263 			data += packetlen & ~3;
1264 			*((u_int32_t *)data) =
1265 			    bus_space_read_stream_4(bst, bsh, DATA_REG_W);
1266 		}
1267 	}
1268 
1269 	ifp->if_ipackets++;
1270 
1271 	/*
1272 	 * Make sure to behave as IFF_SIMPLEX in all cases.
1273 	 * This is to cope with SMC91C92 (Megahertz XJ10BT), which
1274 	 * loops back packets to itself on promiscuous mode.
1275 	 * (should be ensured by chipset configuration)
1276 	 */
1277 	if ((ifp->if_flags & IFF_PROMISC) != 0) {
1278 		/*
1279 		 * Drop packet looped back from myself.
1280 		 */
1281 		if (ether_cmp(eh->ether_shost, CLLADDR(ifp->if_sadl)) == 0) {
1282 			m_freem(m);
1283 			goto out;
1284 		}
1285 	}
1286 
1287 	m->m_pkthdr.len = m->m_len = packetlen;
1288 
1289 #if NBPFILTER > 0
1290 	/*
1291 	 * Hand the packet off to bpf listeners.
1292 	 */
1293 	if (ifp->if_bpf)
1294 		bpf_mtap(ifp->if_bpf, m);
1295 #endif
1296 
1297 	(*ifp->if_input)(ifp, m);
1298 
1299  out:
1300 	/*
1301 	 * Tell the card to free the memory occupied by this packet.
1302 	 */
1303 	while (bus_space_read_2(bst, bsh, MMU_CMD_REG_W) & MMUCR_BUSY)
1304 		/* XXX bound this loop! */ ;
1305 	bus_space_write_2(bst, bsh, MMU_CMD_REG_W, MMUCR_RELEASE);
1306 
1307 	/*
1308 	 * Check for another packet.
1309 	 */
1310 	packetno = bus_space_read_2(bst, bsh, FIFO_PORTS_REG_W);
1311 	if (packetno & FIFO_REMPTY)
1312 		return;
1313 	goto again;
1314 }
1315 
1316 /*
1317  * Process an ioctl request.
1318  */
1319 int
1320 smc91cxx_ioctl(ifp, cmd, data)
1321 	struct ifnet *ifp;
1322 	u_long cmd;
1323 	void *data;
1324 {
1325 	struct smc91cxx_softc *sc = ifp->if_softc;
1326 	struct ifaddr *ifa = (struct ifaddr *)data;
1327 	struct ifreq *ifr = (struct ifreq *)data;
1328 	int s, error = 0;
1329 
1330 	s = splnet();
1331 
1332 	switch (cmd) {
1333 	case SIOCSIFADDR:
1334 		if ((error = smc91cxx_enable(sc)) != 0)
1335 			break;
1336 		ifp->if_flags |= IFF_UP;
1337 		switch (ifa->ifa_addr->sa_family) {
1338 #ifdef INET
1339 		case AF_INET:
1340 		smc91cxx_init(sc);
1341 		arp_ifinit(ifp, ifa);
1342 		break;
1343 #endif
1344 		default:
1345 			smc91cxx_init(sc);
1346 			break;
1347 		}
1348 		break;
1349 
1350 
1351 	case SIOCSIFFLAGS:
1352 		if ((ifp->if_flags & IFF_UP) == 0 &&
1353 		    (ifp->if_flags & IFF_RUNNING) != 0) {
1354 			/*
1355 			 * If interface is marked down and it is running,
1356 			 * stop it.
1357 			 */
1358 			smc91cxx_stop(sc);
1359 			ifp->if_flags &= ~IFF_RUNNING;
1360 			smc91cxx_disable(sc);
1361 		} else if ((ifp->if_flags & IFF_UP) != 0 &&
1362 			   (ifp->if_flags & IFF_RUNNING) == 0) {
1363 			/*
1364 			 * If interface is marked up and it is stopped,
1365 			 * start it.
1366 			 */
1367 			if ((error = smc91cxx_enable(sc)) != 0)
1368 				break;
1369 			smc91cxx_init(sc);
1370 		} else if ((ifp->if_flags & IFF_UP) != 0) {
1371 			/*
1372 			 * Reset the interface to pick up changes in any
1373 			 * other flags that affect hardware registers.
1374 			 */
1375 			smc91cxx_reset(sc);
1376 		}
1377 		break;
1378 
1379 	case SIOCADDMULTI:
1380 	case SIOCDELMULTI:
1381 		if ((sc->sc_flags & SMC_FLAGS_ENABLED) == 0) {
1382 			error = EIO;
1383 			break;
1384 		}
1385 
1386 		if ((error = ether_ioctl(ifp, cmd, data)) == ENETRESET) {
1387 			/*
1388 			 * Multicast list has changed; set the hardware
1389 			 * filter accordingly.
1390 			 */
1391 			if (ifp->if_flags & IFF_RUNNING)
1392 				smc91cxx_reset(sc);
1393 			error = 0;
1394 		}
1395 		break;
1396 
1397 	case SIOCGIFMEDIA:
1398 	case SIOCSIFMEDIA:
1399 		error = ifmedia_ioctl(ifp, ifr, &sc->sc_mii.mii_media, cmd);
1400 		break;
1401 
1402 	default:
1403 		error = EINVAL;
1404 		break;
1405 	}
1406 
1407 	splx(s);
1408 	return (error);
1409 }
1410 
1411 /*
1412  * Reset the interface.
1413  */
1414 void
1415 smc91cxx_reset(sc)
1416 	struct smc91cxx_softc *sc;
1417 {
1418 	int s;
1419 
1420 	s = splnet();
1421 	smc91cxx_stop(sc);
1422 	smc91cxx_init(sc);
1423 	splx(s);
1424 }
1425 
1426 /*
1427  * Watchdog timer.
1428  */
1429 void
1430 smc91cxx_watchdog(ifp)
1431 	struct ifnet *ifp;
1432 {
1433 	struct smc91cxx_softc *sc = ifp->if_softc;
1434 
1435 	log(LOG_ERR, "%s: device timeout\n", device_xname(&sc->sc_dev));
1436 	ifp->if_oerrors++;
1437 	smc91cxx_reset(sc);
1438 }
1439 
1440 /*
1441  * Stop output on the interface.
1442  */
1443 void
1444 smc91cxx_stop(sc)
1445 	struct smc91cxx_softc *sc;
1446 {
1447 	bus_space_tag_t bst = sc->sc_bst;
1448 	bus_space_handle_t bsh = sc->sc_bsh;
1449 
1450 	/*
1451 	 * Clear interrupt mask; disable all interrupts.
1452 	 */
1453 	SMC_SELECT_BANK(sc, 2);
1454 	smc91cxx_intr_mask_write(bst, bsh, 0);
1455 
1456 	/*
1457 	 * Disable transmitter and receiver.
1458 	 */
1459 	SMC_SELECT_BANK(sc, 0);
1460 	bus_space_write_2(bst, bsh, RECV_CONTROL_REG_W, 0);
1461 	bus_space_write_2(bst, bsh, TXMIT_CONTROL_REG_W, 0);
1462 
1463 	/*
1464 	 * Cancel watchdog timer.
1465 	 */
1466 	sc->sc_ec.ec_if.if_timer = 0;
1467 }
1468 
1469 /*
1470  * Enable power on the interface.
1471  */
1472 int
1473 smc91cxx_enable(sc)
1474 	struct smc91cxx_softc *sc;
1475 {
1476 
1477 	if ((sc->sc_flags & SMC_FLAGS_ENABLED) == 0 && sc->sc_enable != NULL) {
1478 		if ((*sc->sc_enable)(sc) != 0) {
1479 			aprint_error_dev(&sc->sc_dev, "device enable failed\n");
1480 			return (EIO);
1481 		}
1482 	}
1483 
1484 	sc->sc_flags |= SMC_FLAGS_ENABLED;
1485 	return (0);
1486 }
1487 
1488 /*
1489  * Disable power on the interface.
1490  */
1491 void
1492 smc91cxx_disable(sc)
1493 	struct smc91cxx_softc *sc;
1494 {
1495 
1496 	if ((sc->sc_flags & SMC_FLAGS_ENABLED) != 0 && sc->sc_disable != NULL) {
1497 		(*sc->sc_disable)(sc);
1498 		sc->sc_flags &= ~SMC_FLAGS_ENABLED;
1499 	}
1500 }
1501 
1502 int
1503 smc91cxx_activate(self, act)
1504 	struct device *self;
1505 	enum devact act;
1506 {
1507 	struct smc91cxx_softc *sc = (struct smc91cxx_softc *)self;
1508 	int rv = 0, s;
1509 
1510 	s = splnet();
1511 	switch (act) {
1512 	case DVACT_ACTIVATE:
1513 		rv = EOPNOTSUPP;
1514 		break;
1515 
1516 	case DVACT_DEACTIVATE:
1517 		if_deactivate(&sc->sc_ec.ec_if);
1518 		break;
1519 	}
1520 	splx(s);
1521 	return (rv);
1522 }
1523 
1524 int
1525 smc91cxx_detach(struct device *self, int flags)
1526 {
1527 	struct smc91cxx_softc *sc = (struct smc91cxx_softc *)self;
1528 	struct ifnet *ifp = &sc->sc_ec.ec_if;
1529 
1530 	/* Succeed now if there's no work to do. */
1531 	if ((sc->sc_flags & SMC_FLAGS_ATTACHED) == 0)
1532 		return (0);
1533 
1534 
1535 	/* smc91cxx_disable() checks SMC_FLAGS_ENABLED */
1536 	smc91cxx_disable(sc);
1537 
1538 	/* smc91cxx_attach() never fails */
1539 
1540 	/* Delete all media. */
1541 	ifmedia_delete_instance(&sc->sc_mii.mii_media, IFM_INST_ANY);
1542 
1543 #if NRND > 0
1544 	rnd_detach_source(&sc->rnd_source);
1545 #endif
1546 	ether_ifdetach(ifp);
1547 	if_detach(ifp);
1548 
1549 	return (0);
1550 }
1551 
1552 u_int32_t
1553 smc91cxx_mii_bitbang_read(self)
1554 	struct device *self;
1555 {
1556 	struct smc91cxx_softc *sc = (void *) self;
1557 
1558 	/* We're already in bank 3. */
1559 	return (bus_space_read_2(sc->sc_bst, sc->sc_bsh, MGMT_REG_W));
1560 }
1561 
1562 void
1563 smc91cxx_mii_bitbang_write(self, val)
1564 	struct device *self;
1565 	u_int32_t val;
1566 {
1567 	struct smc91cxx_softc *sc = (void *) self;
1568 
1569 	/* We're already in bank 3. */
1570 	bus_space_write_2(sc->sc_bst, sc->sc_bsh, MGMT_REG_W, val);
1571 }
1572 
1573 int
1574 smc91cxx_mii_readreg(self, phy, reg)
1575 	struct device *self;
1576 	int phy, reg;
1577 {
1578 	struct smc91cxx_softc *sc = (void *) self;
1579 	int val;
1580 
1581 	SMC_SELECT_BANK(sc, 3);
1582 
1583 	val = mii_bitbang_readreg(self, &smc91cxx_mii_bitbang_ops, phy, reg);
1584 
1585 	SMC_SELECT_BANK(sc, 2);
1586 
1587 	return (val);
1588 }
1589 
1590 void
1591 smc91cxx_mii_writereg(self, phy, reg, val)
1592 	struct device *self;
1593 	int phy, reg, val;
1594 {
1595 	struct smc91cxx_softc *sc = (void *) self;
1596 
1597 	SMC_SELECT_BANK(sc, 3);
1598 
1599 	mii_bitbang_writereg(self, &smc91cxx_mii_bitbang_ops, phy, reg, val);
1600 
1601 	SMC_SELECT_BANK(sc, 2);
1602 }
1603 
1604 void
1605 smc91cxx_statchg(self)
1606 	struct device *self;
1607 {
1608 	struct smc91cxx_softc *sc = (struct smc91cxx_softc *)self;
1609 	bus_space_tag_t bst = sc->sc_bst;
1610 	bus_space_handle_t bsh = sc->sc_bsh;
1611 	int mctl;
1612 
1613 	SMC_SELECT_BANK(sc, 0);
1614 	mctl = bus_space_read_2(bst, bsh, TXMIT_CONTROL_REG_W);
1615 	if (sc->sc_mii.mii_media_active & IFM_FDX)
1616 		mctl |= TCR_SWFDUP;
1617 	else
1618 		mctl &= ~TCR_SWFDUP;
1619 	bus_space_write_2(bst, bsh, TXMIT_CONTROL_REG_W, mctl);
1620 	SMC_SELECT_BANK(sc, 2);	/* back to operating window */
1621 }
1622 
1623 /*
1624  * One second timer, used to tick the MII.
1625  */
1626 void
1627 smc91cxx_tick(arg)
1628 	void *arg;
1629 {
1630 	struct smc91cxx_softc *sc = arg;
1631 	int s;
1632 
1633 #ifdef DIAGNOSTIC
1634 	if ((sc->sc_flags & SMC_FLAGS_HAS_MII) == 0)
1635 		panic("smc91cxx_tick");
1636 #endif
1637 
1638 	if (!device_is_active(&sc->sc_dev))
1639 		return;
1640 
1641 	s = splnet();
1642 	mii_tick(&sc->sc_mii);
1643 	splx(s);
1644 
1645 	callout_reset(&sc->sc_mii_callout, hz, smc91cxx_tick, sc);
1646 }
1647 
1648