xref: /netbsd-src/sys/dev/pci/if_pcn.c (revision 3816d47b2c42fcd6e549e3407f842a5b1a1d23ad)
1 /*	$NetBSD: if_pcn.c,v 1.48 2009/09/06 13:39:56 tsutsui Exp $	*/
2 
3 /*
4  * Copyright (c) 2001 Wasabi Systems, Inc.
5  * All rights reserved.
6  *
7  * Written by Jason R. Thorpe for Wasabi Systems, Inc.
8  *
9  * Redistribution and use in source and binary forms, with or without
10  * modification, are permitted provided that the following conditions
11  * are met:
12  * 1. Redistributions of source code must retain the above copyright
13  *    notice, this list of conditions and the following disclaimer.
14  * 2. Redistributions in binary form must reproduce the above copyright
15  *    notice, this list of conditions and the following disclaimer in the
16  *    documentation and/or other materials provided with the distribution.
17  * 3. All advertising materials mentioning features or use of this software
18  *    must display the following acknowledgement:
19  *	This product includes software developed for the NetBSD Project by
20  *	Wasabi Systems, Inc.
21  * 4. The name of Wasabi Systems, Inc. may not be used to endorse
22  *    or promote products derived from this software without specific prior
23  *    written permission.
24  *
25  * THIS SOFTWARE IS PROVIDED BY WASABI SYSTEMS, INC. ``AS IS'' AND
26  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
27  * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
28  * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL WASABI SYSTEMS, INC
29  * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
30  * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
31  * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
32  * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
33  * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
34  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
35  * POSSIBILITY OF SUCH DAMAGE.
36  */
37 
38 /*
39  * Device driver for the AMD PCnet-PCI series of Ethernet
40  * chips:
41  *
42  *	* Am79c970 PCnet-PCI Single-Chip Ethernet Controller for PCI
43  *	  Local Bus
44  *
45  *	* Am79c970A PCnet-PCI II Single-Chip Full-Duplex Ethernet Controller
46  *	  for PCI Local Bus
47  *
48  *	* Am79c971 PCnet-FAST Single-Chip Full-Duplex 10/100Mbps
49  *	  Ethernet Controller for PCI Local Bus
50  *
51  *	* Am79c972 PCnet-FAST+ Enhanced 10/100Mbps PCI Ethernet Controller
52  *	  with OnNow Support
53  *
54  *	* Am79c973/Am79c975 PCnet-FAST III Single-Chip 10/100Mbps PCI
55  *	  Ethernet Controller with Integrated PHY
56  *
57  * This also supports the virtual PCnet-PCI Ethernet interface found
58  * in VMware.
59  *
60  * TODO:
61  *
62  *	* Split this into bus-specific and bus-independent portions.
63  *	  The core could also be used for the ILACC (Am79900) 32-bit
64  *	  Ethernet chip (XXX only if we use an ILACC-compatible SWSTYLE).
65  */
66 
67 #include <sys/cdefs.h>
68 __KERNEL_RCSID(0, "$NetBSD: if_pcn.c,v 1.48 2009/09/06 13:39:56 tsutsui Exp $");
69 
70 #include "bpfilter.h"
71 #include "rnd.h"
72 
73 #include <sys/param.h>
74 #include <sys/systm.h>
75 #include <sys/callout.h>
76 #include <sys/mbuf.h>
77 #include <sys/malloc.h>
78 #include <sys/kernel.h>
79 #include <sys/socket.h>
80 #include <sys/ioctl.h>
81 #include <sys/errno.h>
82 #include <sys/device.h>
83 #include <sys/queue.h>
84 
85 #if NRND > 0
86 #include <sys/rnd.h>
87 #endif
88 
89 #include <uvm/uvm_extern.h>		/* for PAGE_SIZE */
90 
91 #include <net/if.h>
92 #include <net/if_dl.h>
93 #include <net/if_media.h>
94 #include <net/if_ether.h>
95 
96 #if NBPFILTER > 0
97 #include <net/bpf.h>
98 #endif
99 
100 #include <sys/bus.h>
101 #include <sys/intr.h>
102 #include <machine/endian.h>
103 
104 #include <dev/mii/mii.h>
105 #include <dev/mii/miivar.h>
106 
107 #include <dev/ic/am79900reg.h>
108 #include <dev/ic/lancereg.h>
109 
110 #include <dev/pci/pcireg.h>
111 #include <dev/pci/pcivar.h>
112 #include <dev/pci/pcidevs.h>
113 
114 #include <dev/pci/if_pcnreg.h>
115 
116 /*
117  * Transmit descriptor list size.  This is arbitrary, but allocate
118  * enough descriptors for 128 pending transmissions, and 4 segments
119  * per packet.  This MUST work out to a power of 2.
120  *
121  * NOTE: We can't have any more than 512 Tx descriptors, SO BE CAREFUL!
122  *
123  * So we play a little trick here.  We give each packet up to 16
124  * DMA segments, but only allocate the max of 512 descriptors.  The
125  * transmit logic can deal with this, we just are hoping to sneak by.
126  */
127 #define	PCN_NTXSEGS		16
128 #define	PCN_NTXSEGS_VMWARE	8	/* bug in VMware's emulation */
129 
130 #define	PCN_TXQUEUELEN		128
131 #define	PCN_TXQUEUELEN_MASK	(PCN_TXQUEUELEN - 1)
132 #define	PCN_NTXDESC		512
133 #define	PCN_NTXDESC_MASK	(PCN_NTXDESC - 1)
134 #define	PCN_NEXTTX(x)		(((x) + 1) & PCN_NTXDESC_MASK)
135 #define	PCN_NEXTTXS(x)		(((x) + 1) & PCN_TXQUEUELEN_MASK)
136 
137 /* Tx interrupt every N + 1 packets. */
138 #define	PCN_TXINTR_MASK		7
139 
140 /*
141  * Receive descriptor list size.  We have one Rx buffer per incoming
142  * packet, so this logic is a little simpler.
143  */
144 #define	PCN_NRXDESC		128
145 #define	PCN_NRXDESC_MASK	(PCN_NRXDESC - 1)
146 #define	PCN_NEXTRX(x)		(((x) + 1) & PCN_NRXDESC_MASK)
147 
148 /*
149  * Control structures are DMA'd to the PCnet chip.  We allocate them in
150  * a single clump that maps to a single DMA segment to make several things
151  * easier.
152  */
153 struct pcn_control_data {
154 	/* The transmit descriptors. */
155 	struct letmd pcd_txdescs[PCN_NTXDESC];
156 
157 	/* The receive descriptors. */
158 	struct lermd pcd_rxdescs[PCN_NRXDESC];
159 
160 	/* The init block. */
161 	struct leinit pcd_initblock;
162 };
163 
164 #define	PCN_CDOFF(x)	offsetof(struct pcn_control_data, x)
165 #define	PCN_CDTXOFF(x)	PCN_CDOFF(pcd_txdescs[(x)])
166 #define	PCN_CDRXOFF(x)	PCN_CDOFF(pcd_rxdescs[(x)])
167 #define	PCN_CDINITOFF	PCN_CDOFF(pcd_initblock)
168 
169 /*
170  * Software state for transmit jobs.
171  */
172 struct pcn_txsoft {
173 	struct mbuf *txs_mbuf;		/* head of our mbuf chain */
174 	bus_dmamap_t txs_dmamap;	/* our DMA map */
175 	int txs_firstdesc;		/* first descriptor in packet */
176 	int txs_lastdesc;		/* last descriptor in packet */
177 };
178 
179 /*
180  * Software state for receive jobs.
181  */
182 struct pcn_rxsoft {
183 	struct mbuf *rxs_mbuf;		/* head of our mbuf chain */
184 	bus_dmamap_t rxs_dmamap;	/* our DMA map */
185 };
186 
187 /*
188  * Description of Rx FIFO watermarks for various revisions.
189  */
190 static const char * const pcn_79c970_rcvfw[] = {
191 	"16 bytes",
192 	"64 bytes",
193 	"128 bytes",
194 	NULL,
195 };
196 
197 static const char * const pcn_79c971_rcvfw[] = {
198 	"16 bytes",
199 	"64 bytes",
200 	"112 bytes",
201 	NULL,
202 };
203 
204 /*
205  * Description of Tx start points for various revisions.
206  */
207 static const char * const pcn_79c970_xmtsp[] = {
208 	"8 bytes",
209 	"64 bytes",
210 	"128 bytes",
211 	"248 bytes",
212 };
213 
214 static const char * const pcn_79c971_xmtsp[] = {
215 	"20 bytes",
216 	"64 bytes",
217 	"128 bytes",
218 	"248 bytes",
219 };
220 
221 static const char * const pcn_79c971_xmtsp_sram[] = {
222 	"44 bytes",
223 	"64 bytes",
224 	"128 bytes",
225 	"store-and-forward",
226 };
227 
228 /*
229  * Description of Tx FIFO watermarks for various revisions.
230  */
231 static const char * const pcn_79c970_xmtfw[] = {
232 	"16 bytes",
233 	"64 bytes",
234 	"128 bytes",
235 	NULL,
236 };
237 
238 static const char * const pcn_79c971_xmtfw[] = {
239 	"16 bytes",
240 	"64 bytes",
241 	"108 bytes",
242 	NULL,
243 };
244 
245 /*
246  * Software state per device.
247  */
248 struct pcn_softc {
249 	device_t sc_dev;		/* generic device information */
250 	bus_space_tag_t sc_st;		/* bus space tag */
251 	bus_space_handle_t sc_sh;	/* bus space handle */
252 	bus_dma_tag_t sc_dmat;		/* bus DMA tag */
253 	struct ethercom sc_ethercom;	/* Ethernet common data */
254 
255 	/* Points to our media routines, etc. */
256 	const struct pcn_variant *sc_variant;
257 
258 	void *sc_ih;			/* interrupt cookie */
259 
260 	struct mii_data sc_mii;		/* MII/media information */
261 
262 	callout_t sc_tick_ch;		/* tick callout */
263 
264 	bus_dmamap_t sc_cddmamap;	/* control data DMA map */
265 #define	sc_cddma	sc_cddmamap->dm_segs[0].ds_addr
266 
267 	/* Software state for transmit and receive descriptors. */
268 	struct pcn_txsoft sc_txsoft[PCN_TXQUEUELEN];
269 	struct pcn_rxsoft sc_rxsoft[PCN_NRXDESC];
270 
271 	/* Control data structures */
272 	struct pcn_control_data *sc_control_data;
273 #define	sc_txdescs	sc_control_data->pcd_txdescs
274 #define	sc_rxdescs	sc_control_data->pcd_rxdescs
275 #define	sc_initblock	sc_control_data->pcd_initblock
276 
277 #ifdef PCN_EVENT_COUNTERS
278 	/* Event counters. */
279 	struct evcnt sc_ev_txsstall;	/* Tx stalled due to no txs */
280 	struct evcnt sc_ev_txdstall;	/* Tx stalled due to no txd */
281 	struct evcnt sc_ev_txintr;	/* Tx interrupts */
282 	struct evcnt sc_ev_rxintr;	/* Rx interrupts */
283 	struct evcnt sc_ev_babl;	/* BABL in pcn_intr() */
284 	struct evcnt sc_ev_miss;	/* MISS in pcn_intr() */
285 	struct evcnt sc_ev_merr;	/* MERR in pcn_intr() */
286 
287 	struct evcnt sc_ev_txseg1;	/* Tx packets w/ 1 segment */
288 	struct evcnt sc_ev_txseg2;	/* Tx packets w/ 2 segments */
289 	struct evcnt sc_ev_txseg3;	/* Tx packets w/ 3 segments */
290 	struct evcnt sc_ev_txseg4;	/* Tx packets w/ 4 segments */
291 	struct evcnt sc_ev_txseg5;	/* Tx packets w/ 5 segments */
292 	struct evcnt sc_ev_txsegmore;	/* Tx packets w/ more than 5 segments */
293 	struct evcnt sc_ev_txcopy;	/* Tx copies required */
294 #endif /* PCN_EVENT_COUNTERS */
295 
296 	const char * const *sc_rcvfw_desc;	/* Rx FIFO watermark info */
297 	int sc_rcvfw;
298 
299 	const char * const *sc_xmtsp_desc;	/* Tx start point info */
300 	int sc_xmtsp;
301 
302 	const char * const *sc_xmtfw_desc;	/* Tx FIFO watermark info */
303 	int sc_xmtfw;
304 
305 	int sc_flags;			/* misc. flags; see below */
306 	int sc_swstyle;			/* the software style in use */
307 
308 	int sc_txfree;			/* number of free Tx descriptors */
309 	int sc_txnext;			/* next ready Tx descriptor */
310 
311 	int sc_txsfree;			/* number of free Tx jobs */
312 	int sc_txsnext;			/* next free Tx job */
313 	int sc_txsdirty;		/* dirty Tx jobs */
314 
315 	int sc_rxptr;			/* next ready Rx descriptor/job */
316 
317 	uint32_t sc_csr5;		/* prototype CSR5 register */
318 	uint32_t sc_mode;		/* prototype MODE register */
319 
320 #if NRND > 0
321 	rndsource_element_t rnd_source;	/* random source */
322 #endif
323 };
324 
325 /* sc_flags */
326 #define	PCN_F_HAS_MII		0x0001	/* has MII */
327 
328 #ifdef PCN_EVENT_COUNTERS
329 #define	PCN_EVCNT_INCR(ev)	(ev)->ev_count++
330 #else
331 #define	PCN_EVCNT_INCR(ev)	/* nothing */
332 #endif
333 
334 #define	PCN_CDTXADDR(sc, x)	((sc)->sc_cddma + PCN_CDTXOFF((x)))
335 #define	PCN_CDRXADDR(sc, x)	((sc)->sc_cddma + PCN_CDRXOFF((x)))
336 #define	PCN_CDINITADDR(sc)	((sc)->sc_cddma + PCN_CDINITOFF)
337 
338 #define	PCN_CDTXSYNC(sc, x, n, ops)					\
339 do {									\
340 	int __x, __n;							\
341 									\
342 	__x = (x);							\
343 	__n = (n);							\
344 									\
345 	/* If it will wrap around, sync to the end of the ring. */	\
346 	if ((__x + __n) > PCN_NTXDESC) {				\
347 		bus_dmamap_sync((sc)->sc_dmat, (sc)->sc_cddmamap,	\
348 		    PCN_CDTXOFF(__x), sizeof(struct letmd) *		\
349 		    (PCN_NTXDESC - __x), (ops));			\
350 		__n -= (PCN_NTXDESC - __x);				\
351 		__x = 0;						\
352 	}								\
353 									\
354 	/* Now sync whatever is left. */				\
355 	bus_dmamap_sync((sc)->sc_dmat, (sc)->sc_cddmamap,		\
356 	    PCN_CDTXOFF(__x), sizeof(struct letmd) * __n, (ops));	\
357 } while (/*CONSTCOND*/0)
358 
359 #define	PCN_CDRXSYNC(sc, x, ops)					\
360 	bus_dmamap_sync((sc)->sc_dmat, (sc)->sc_cddmamap,		\
361 	    PCN_CDRXOFF((x)), sizeof(struct lermd), (ops))
362 
363 #define	PCN_CDINITSYNC(sc, ops)						\
364 	bus_dmamap_sync((sc)->sc_dmat, (sc)->sc_cddmamap,		\
365 	    PCN_CDINITOFF, sizeof(struct leinit), (ops))
366 
367 #define	PCN_INIT_RXDESC(sc, x)						\
368 do {									\
369 	struct pcn_rxsoft *__rxs = &(sc)->sc_rxsoft[(x)];		\
370 	struct lermd *__rmd = &(sc)->sc_rxdescs[(x)];			\
371 	struct mbuf *__m = __rxs->rxs_mbuf;				\
372 									\
373 	/*								\
374 	 * Note: We scoot the packet forward 2 bytes in the buffer	\
375 	 * so that the payload after the Ethernet header is aligned	\
376 	 * to a 4-byte boundary.					\
377 	 */								\
378 	__m->m_data = __m->m_ext.ext_buf + 2;				\
379 									\
380 	if ((sc)->sc_swstyle == LE_B20_SSTYLE_PCNETPCI3) {		\
381 		__rmd->rmd2 =						\
382 		    htole32(__rxs->rxs_dmamap->dm_segs[0].ds_addr + 2);	\
383 		__rmd->rmd0 = 0;					\
384 	} else {							\
385 		__rmd->rmd2 = 0;					\
386 		__rmd->rmd0 =						\
387 		    htole32(__rxs->rxs_dmamap->dm_segs[0].ds_addr + 2);	\
388 	}								\
389 	__rmd->rmd1 = htole32(LE_R1_OWN|LE_R1_ONES| 			\
390 	    (LE_BCNT(MCLBYTES - 2) & LE_R1_BCNT_MASK));			\
391 	PCN_CDRXSYNC((sc), (x), BUS_DMASYNC_PREREAD|BUS_DMASYNC_PREWRITE);\
392 } while(/*CONSTCOND*/0)
393 
394 static void	pcn_start(struct ifnet *);
395 static void	pcn_watchdog(struct ifnet *);
396 static int	pcn_ioctl(struct ifnet *, u_long, void *);
397 static int	pcn_init(struct ifnet *);
398 static void	pcn_stop(struct ifnet *, int);
399 
400 static bool	pcn_shutdown(device_t, int);
401 
402 static void	pcn_reset(struct pcn_softc *);
403 static void	pcn_rxdrain(struct pcn_softc *);
404 static int	pcn_add_rxbuf(struct pcn_softc *, int);
405 static void	pcn_tick(void *);
406 
407 static void	pcn_spnd(struct pcn_softc *);
408 
409 static void	pcn_set_filter(struct pcn_softc *);
410 
411 static int	pcn_intr(void *);
412 static void	pcn_txintr(struct pcn_softc *);
413 static int	pcn_rxintr(struct pcn_softc *);
414 
415 static int	pcn_mii_readreg(device_t, int, int);
416 static void	pcn_mii_writereg(device_t, int, int, int);
417 static void	pcn_mii_statchg(device_t);
418 
419 static void	pcn_79c970_mediainit(struct pcn_softc *);
420 static int	pcn_79c970_mediachange(struct ifnet *);
421 static void	pcn_79c970_mediastatus(struct ifnet *, struct ifmediareq *);
422 
423 static void	pcn_79c971_mediainit(struct pcn_softc *);
424 
425 /*
426  * Description of a PCnet-PCI variant.  Used to select media access
427  * method, mostly, and to print a nice description of the chip.
428  */
429 static const struct pcn_variant {
430 	const char *pcv_desc;
431 	void (*pcv_mediainit)(struct pcn_softc *);
432 	uint16_t pcv_chipid;
433 } pcn_variants[] = {
434 	{ "Am79c970 PCnet-PCI",
435 	  pcn_79c970_mediainit,
436 	  PARTID_Am79c970 },
437 
438 	{ "Am79c970A PCnet-PCI II",
439 	  pcn_79c970_mediainit,
440 	  PARTID_Am79c970A },
441 
442 	{ "Am79c971 PCnet-FAST",
443 	  pcn_79c971_mediainit,
444 	  PARTID_Am79c971 },
445 
446 	{ "Am79c972 PCnet-FAST+",
447 	  pcn_79c971_mediainit,
448 	  PARTID_Am79c972 },
449 
450 	{ "Am79c973 PCnet-FAST III",
451 	  pcn_79c971_mediainit,
452 	  PARTID_Am79c973 },
453 
454 	{ "Am79c975 PCnet-FAST III",
455 	  pcn_79c971_mediainit,
456 	  PARTID_Am79c975 },
457 
458 	{ "Unknown PCnet-PCI variant",
459 	  pcn_79c971_mediainit,
460 	  0 },
461 };
462 
463 int	pcn_copy_small = 0;
464 
465 static int	pcn_match(device_t, cfdata_t, void *);
466 static void	pcn_attach(device_t, device_t, void *);
467 
468 CFATTACH_DECL_NEW(pcn, sizeof(struct pcn_softc),
469     pcn_match, pcn_attach, NULL, NULL);
470 
471 /*
472  * Routines to read and write the PCnet-PCI CSR/BCR space.
473  */
474 
475 static inline uint32_t
476 pcn_csr_read(struct pcn_softc *sc, int reg)
477 {
478 
479 	bus_space_write_4(sc->sc_st, sc->sc_sh, PCN32_RAP, reg);
480 	return (bus_space_read_4(sc->sc_st, sc->sc_sh, PCN32_RDP));
481 }
482 
483 static inline void
484 pcn_csr_write(struct pcn_softc *sc, int reg, uint32_t val)
485 {
486 
487 	bus_space_write_4(sc->sc_st, sc->sc_sh, PCN32_RAP, reg);
488 	bus_space_write_4(sc->sc_st, sc->sc_sh, PCN32_RDP, val);
489 }
490 
491 static inline uint32_t
492 pcn_bcr_read(struct pcn_softc *sc, int reg)
493 {
494 
495 	bus_space_write_4(sc->sc_st, sc->sc_sh, PCN32_RAP, reg);
496 	return (bus_space_read_4(sc->sc_st, sc->sc_sh, PCN32_BDP));
497 }
498 
499 static inline void
500 pcn_bcr_write(struct pcn_softc *sc, int reg, uint32_t val)
501 {
502 
503 	bus_space_write_4(sc->sc_st, sc->sc_sh, PCN32_RAP, reg);
504 	bus_space_write_4(sc->sc_st, sc->sc_sh, PCN32_BDP, val);
505 }
506 
507 static bool
508 pcn_is_vmware(const char *enaddr)
509 {
510 
511 	/*
512 	 * VMware uses the OUI 00:0c:29 for auto-generated MAC
513 	 * addresses.
514 	 */
515 	if (enaddr[0] == 0x00 && enaddr[1] == 0x0c && enaddr[2] == 0x29)
516 		return (TRUE);
517 
518 	/*
519 	 * VMware uses the OUI 00:50:56 for manually-set MAC
520 	 * addresses (and some auto-generated ones).
521 	 */
522 	if (enaddr[0] == 0x00 && enaddr[1] == 0x50 && enaddr[2] == 0x56)
523 		return (TRUE);
524 
525 	return (FALSE);
526 }
527 
528 static const struct pcn_variant *
529 pcn_lookup_variant(uint16_t chipid)
530 {
531 	const struct pcn_variant *pcv;
532 
533 	for (pcv = pcn_variants; pcv->pcv_chipid != 0; pcv++) {
534 		if (chipid == pcv->pcv_chipid)
535 			return (pcv);
536 	}
537 
538 	/*
539 	 * This covers unknown chips, which we simply treat like
540 	 * a generic PCnet-FAST.
541 	 */
542 	return (pcv);
543 }
544 
545 static int
546 pcn_match(device_t parent, cfdata_t cf, void *aux)
547 {
548 	struct pci_attach_args *pa = aux;
549 
550 	/*
551 	 * IBM Makes a PCI variant of this card which shows up as a
552 	 * Trident Microsystems 4DWAVE DX (ethernet network, revision 0x25)
553 	 * this card is truly a pcn card, so we have a special case match for
554 	 * it
555 	 */
556 
557 	if (PCI_VENDOR(pa->pa_id) == PCI_VENDOR_TRIDENT &&
558 	    PCI_PRODUCT(pa->pa_id) == PCI_PRODUCT_TRIDENT_4DWAVE_DX &&
559 	    PCI_CLASS(pa->pa_class) == PCI_CLASS_NETWORK)
560 		return(1);
561 
562 	if (PCI_VENDOR(pa->pa_id) != PCI_VENDOR_AMD)
563 		return (0);
564 
565 	switch (PCI_PRODUCT(pa->pa_id)) {
566 	case PCI_PRODUCT_AMD_PCNET_PCI:
567 		/* Beat if_le_pci.c */
568 		return (10);
569 	}
570 
571 	return (0);
572 }
573 
574 static void
575 pcn_attach(device_t parent, device_t self, void *aux)
576 {
577 	struct pcn_softc *sc = device_private(self);
578 	struct pci_attach_args *pa = aux;
579 	struct ifnet *ifp = &sc->sc_ethercom.ec_if;
580 	pci_chipset_tag_t pc = pa->pa_pc;
581 	pci_intr_handle_t ih;
582 	const char *intrstr = NULL;
583 	bus_space_tag_t iot, memt;
584 	bus_space_handle_t ioh, memh;
585 	bus_dma_segment_t seg;
586 	int ioh_valid, memh_valid;
587 	int ntxsegs, i, rseg, error;
588 	uint32_t chipid, reg;
589 	uint8_t enaddr[ETHER_ADDR_LEN];
590 	prop_object_t obj;
591 	bool is_vmware;
592 
593 	sc->sc_dev = self;
594 	callout_init(&sc->sc_tick_ch, 0);
595 
596 	aprint_normal(": AMD PCnet-PCI Ethernet\n");
597 
598 	/*
599 	 * Map the device.
600 	 */
601 	ioh_valid = (pci_mapreg_map(pa, PCN_PCI_CBIO, PCI_MAPREG_TYPE_IO, 0,
602 	    &iot, &ioh, NULL, NULL) == 0);
603 	memh_valid = (pci_mapreg_map(pa, PCN_PCI_CBMEM,
604 	    PCI_MAPREG_TYPE_MEM|PCI_MAPREG_MEM_TYPE_32BIT, 0,
605 	    &memt, &memh, NULL, NULL) == 0);
606 
607 	if (memh_valid) {
608 		sc->sc_st = memt;
609 		sc->sc_sh = memh;
610 	} else if (ioh_valid) {
611 		sc->sc_st = iot;
612 		sc->sc_sh = ioh;
613 	} else {
614 		aprint_error_dev(self, "unable to map device registers\n");
615 		return;
616 	}
617 
618 	sc->sc_dmat = pa->pa_dmat;
619 
620 	/* Make sure bus mastering is enabled. */
621 	pci_conf_write(pc, pa->pa_tag, PCI_COMMAND_STATUS_REG,
622 	    pci_conf_read(pc, pa->pa_tag, PCI_COMMAND_STATUS_REG) |
623 	    PCI_COMMAND_MASTER_ENABLE);
624 
625 	/* power up chip */
626 	if ((error = pci_activate(pa->pa_pc, pa->pa_tag, self,
627 	    NULL)) && error != EOPNOTSUPP) {
628 		aprint_error_dev(self, "cannot activate %d\n", error);
629 		return;
630 	}
631 
632 	/*
633 	 * Reset the chip to a known state.  This also puts the
634 	 * chip into 32-bit mode.
635 	 */
636 	pcn_reset(sc);
637 
638 	/*
639 	 * On some systems with the chip is an on-board device, the
640 	 * EEPROM is not used.  Handle this by reading the MAC address
641 	 * from the CSRs (assuming that boot firmware has written
642 	 * it there).
643 	 */
644 	obj = prop_dictionary_get(device_properties(sc->sc_dev),
645 				  "am79c970-no-eeprom");
646 	if (prop_bool_true(obj)) {
647 	        for (i = 0; i < 3; i++) {
648 			uint32_t val;
649 			val = pcn_csr_read(sc, LE_CSR12 + i);
650 			enaddr[2 * i] = val & 0xff;
651 			enaddr[2 * i + 1] = (val >> 8) & 0xff;
652 		}
653 	} else {
654 		for (i = 0; i < ETHER_ADDR_LEN; i++) {
655 			enaddr[i] = bus_space_read_1(sc->sc_st, sc->sc_sh,
656 			    PCN32_APROM + i);
657 		}
658 	}
659 
660 	/* Check to see if this is a VMware emulated network interface. */
661 	is_vmware = pcn_is_vmware(enaddr);
662 
663 	/*
664 	 * Now that the device is mapped, attempt to figure out what
665 	 * kind of chip we have.  Note that IDL has all 32 bits of
666 	 * the chip ID when we're in 32-bit mode.
667 	 */
668 	chipid = pcn_csr_read(sc, LE_CSR88);
669 	sc->sc_variant = pcn_lookup_variant(CHIPID_PARTID(chipid));
670 
671 	aprint_normal_dev(self, "%s rev %d, Ethernet address %s\n",
672 	    sc->sc_variant->pcv_desc, CHIPID_VER(chipid),
673 	    ether_sprintf(enaddr));
674 
675 	/*
676 	 * VMware has a bug in its network interface emulation; we must
677 	 * limit the number of Tx segments.
678 	 */
679 	if (is_vmware) {
680 		ntxsegs = PCN_NTXSEGS_VMWARE;
681 		prop_dictionary_set_bool(device_properties(sc->sc_dev),
682 					 "am79c970-vmware-tx-bug", TRUE);
683 		aprint_verbose_dev(self,
684 		    "VMware Tx segment count bug detected\n");
685 	} else {
686 		ntxsegs = PCN_NTXSEGS;
687 	}
688 
689 	/*
690 	 * Map and establish our interrupt.
691 	 */
692 	if (pci_intr_map(pa, &ih)) {
693 		aprint_error_dev(self, "unable to map interrupt\n");
694 		return;
695 	}
696 	intrstr = pci_intr_string(pc, ih);
697 	sc->sc_ih = pci_intr_establish(pc, ih, IPL_NET, pcn_intr, sc);
698 	if (sc->sc_ih == NULL) {
699 		aprint_error_dev(self, "unable to establish interrupt");
700 		if (intrstr != NULL)
701 			aprint_error(" at %s", intrstr);
702 		aprint_error("\n");
703 		return;
704 	}
705 	aprint_normal_dev(self, "interrupting at %s\n", intrstr);
706 
707 	/*
708 	 * Allocate the control data structures, and create and load the
709 	 * DMA map for it.
710 	 */
711 	if ((error = bus_dmamem_alloc(sc->sc_dmat,
712 	     sizeof(struct pcn_control_data), PAGE_SIZE, 0, &seg, 1, &rseg,
713 	     0)) != 0) {
714 		aprint_error_dev(self, "unable to allocate control data, "
715 		    "error = %d\n", error);
716 		goto fail_0;
717 	}
718 
719 	if ((error = bus_dmamem_map(sc->sc_dmat, &seg, rseg,
720 	     sizeof(struct pcn_control_data), (void **)&sc->sc_control_data,
721 	     BUS_DMA_COHERENT)) != 0) {
722 		aprint_error_dev(self, "unable to map control data, "
723 		    "error = %d\n", error);
724 		goto fail_1;
725 	}
726 
727 	if ((error = bus_dmamap_create(sc->sc_dmat,
728 	     sizeof(struct pcn_control_data), 1,
729 	     sizeof(struct pcn_control_data), 0, 0, &sc->sc_cddmamap)) != 0) {
730 		aprint_error_dev(self, "unable to create control data DMA map, "
731 		    "error = %d\n", error);
732 		goto fail_2;
733 	}
734 
735 	if ((error = bus_dmamap_load(sc->sc_dmat, sc->sc_cddmamap,
736 	     sc->sc_control_data, sizeof(struct pcn_control_data), NULL,
737 	     0)) != 0) {
738 		aprint_error_dev(self,
739 		    "unable to load control data DMA map, error = %d\n", error);
740 		goto fail_3;
741 	}
742 
743 	/* Create the transmit buffer DMA maps. */
744 	for (i = 0; i < PCN_TXQUEUELEN; i++) {
745 		if ((error = bus_dmamap_create(sc->sc_dmat, MCLBYTES,
746 		     ntxsegs, MCLBYTES, 0, 0,
747 		     &sc->sc_txsoft[i].txs_dmamap)) != 0) {
748 			aprint_error_dev(self,
749 			    "unable to create tx DMA map %d, error = %d\n",
750 			    i, error);
751 			goto fail_4;
752 		}
753 	}
754 
755 	/* Create the receive buffer DMA maps. */
756 	for (i = 0; i < PCN_NRXDESC; i++) {
757 		if ((error = bus_dmamap_create(sc->sc_dmat, MCLBYTES, 1,
758 		     MCLBYTES, 0, 0, &sc->sc_rxsoft[i].rxs_dmamap)) != 0) {
759 			aprint_error_dev(self,
760 			    "unable to create rx DMA map %d, error = %d\n",
761 			    i, error);
762 			goto fail_5;
763 		}
764 		sc->sc_rxsoft[i].rxs_mbuf = NULL;
765 	}
766 
767 	/* Initialize our media structures. */
768 	(*sc->sc_variant->pcv_mediainit)(sc);
769 
770 	/*
771 	 * Initialize FIFO watermark info.
772 	 */
773 	switch (sc->sc_variant->pcv_chipid) {
774 	case PARTID_Am79c970:
775 	case PARTID_Am79c970A:
776 		sc->sc_rcvfw_desc = pcn_79c970_rcvfw;
777 		sc->sc_xmtsp_desc = pcn_79c970_xmtsp;
778 		sc->sc_xmtfw_desc = pcn_79c970_xmtfw;
779 		break;
780 
781 	default:
782 		sc->sc_rcvfw_desc = pcn_79c971_rcvfw;
783 		/*
784 		 * Read BCR25 to determine how much SRAM is
785 		 * on the board.  If > 0, then we the chip
786 		 * uses different Start Point thresholds.
787 		 *
788 		 * Note BCR25 and BCR26 are loaded from the
789 		 * EEPROM on RST, and unaffected by S_RESET,
790 		 * so we don't really have to worry about
791 		 * them except for this.
792 		 */
793 		reg = pcn_bcr_read(sc, LE_BCR25) & 0x00ff;
794 		if (reg != 0)
795 			sc->sc_xmtsp_desc = pcn_79c971_xmtsp_sram;
796 		else
797 			sc->sc_xmtsp_desc = pcn_79c971_xmtsp;
798 		sc->sc_xmtfw_desc = pcn_79c971_xmtfw;
799 		break;
800 	}
801 
802 	/*
803 	 * Set up defaults -- see the tables above for what these
804 	 * values mean.
805 	 *
806 	 * XXX How should we tune RCVFW and XMTFW?
807 	 */
808 	sc->sc_rcvfw = 1;	/* minimum for full-duplex */
809 	sc->sc_xmtsp = 1;
810 	sc->sc_xmtfw = 0;
811 
812 	ifp = &sc->sc_ethercom.ec_if;
813 	strcpy(ifp->if_xname, device_xname(self));
814 	ifp->if_softc = sc;
815 	ifp->if_flags = IFF_BROADCAST | IFF_SIMPLEX | IFF_MULTICAST;
816 	ifp->if_ioctl = pcn_ioctl;
817 	ifp->if_start = pcn_start;
818 	ifp->if_watchdog = pcn_watchdog;
819 	ifp->if_init = pcn_init;
820 	ifp->if_stop = pcn_stop;
821 	IFQ_SET_READY(&ifp->if_snd);
822 
823 	/* Attach the interface. */
824 	if_attach(ifp);
825 	ether_ifattach(ifp, enaddr);
826 #if NRND > 0
827 	rnd_attach_source(&sc->rnd_source, device_xname(self),
828 	    RND_TYPE_NET, 0);
829 #endif
830 
831 #ifdef PCN_EVENT_COUNTERS
832 	/* Attach event counters. */
833 	evcnt_attach_dynamic(&sc->sc_ev_txsstall, EVCNT_TYPE_MISC,
834 	    NULL, device_xname(self), "txsstall");
835 	evcnt_attach_dynamic(&sc->sc_ev_txdstall, EVCNT_TYPE_MISC,
836 	    NULL, device_xname(self), "txdstall");
837 	evcnt_attach_dynamic(&sc->sc_ev_txintr, EVCNT_TYPE_INTR,
838 	    NULL, device_xname(self), "txintr");
839 	evcnt_attach_dynamic(&sc->sc_ev_rxintr, EVCNT_TYPE_INTR,
840 	    NULL, device_xname(self), "rxintr");
841 	evcnt_attach_dynamic(&sc->sc_ev_babl, EVCNT_TYPE_MISC,
842 	    NULL, device_xname(self), "babl");
843 	evcnt_attach_dynamic(&sc->sc_ev_miss, EVCNT_TYPE_MISC,
844 	    NULL, device_xname(self), "miss");
845 	evcnt_attach_dynamic(&sc->sc_ev_merr, EVCNT_TYPE_MISC,
846 	    NULL, device_xname(self), "merr");
847 
848 	evcnt_attach_dynamic(&sc->sc_ev_txseg1, EVCNT_TYPE_MISC,
849 	    NULL, device_xname(self), "txseg1");
850 	evcnt_attach_dynamic(&sc->sc_ev_txseg2, EVCNT_TYPE_MISC,
851 	    NULL, device_xname(self), "txseg2");
852 	evcnt_attach_dynamic(&sc->sc_ev_txseg3, EVCNT_TYPE_MISC,
853 	    NULL, device_xname(self), "txseg3");
854 	evcnt_attach_dynamic(&sc->sc_ev_txseg4, EVCNT_TYPE_MISC,
855 	    NULL, device_xname(self), "txseg4");
856 	evcnt_attach_dynamic(&sc->sc_ev_txseg5, EVCNT_TYPE_MISC,
857 	    NULL, device_xname(self), "txseg5");
858 	evcnt_attach_dynamic(&sc->sc_ev_txsegmore, EVCNT_TYPE_MISC,
859 	    NULL, device_xname(self), "txsegmore");
860 	evcnt_attach_dynamic(&sc->sc_ev_txcopy, EVCNT_TYPE_MISC,
861 	    NULL, device_xname(self), "txcopy");
862 #endif /* PCN_EVENT_COUNTERS */
863 
864 	/*
865 	 * Establish power handler with shutdown hook, to make sure
866 	 * the interface is shutdown during reboot.
867 	 */
868 	if (pmf_device_register1(self, NULL, NULL, pcn_shutdown))
869 		pmf_class_network_register(self, ifp);
870 	else
871 		aprint_error_dev(self, "couldn't establish power handler\n");
872 
873 	return;
874 
875 	/*
876 	 * Free any resources we've allocated during the failed attach
877 	 * attempt.  Do this in reverse order and fall through.
878 	 */
879  fail_5:
880 	for (i = 0; i < PCN_NRXDESC; i++) {
881 		if (sc->sc_rxsoft[i].rxs_dmamap != NULL)
882 			bus_dmamap_destroy(sc->sc_dmat,
883 			    sc->sc_rxsoft[i].rxs_dmamap);
884 	}
885  fail_4:
886 	for (i = 0; i < PCN_TXQUEUELEN; i++) {
887 		if (sc->sc_txsoft[i].txs_dmamap != NULL)
888 			bus_dmamap_destroy(sc->sc_dmat,
889 			    sc->sc_txsoft[i].txs_dmamap);
890 	}
891 	bus_dmamap_unload(sc->sc_dmat, sc->sc_cddmamap);
892  fail_3:
893 	bus_dmamap_destroy(sc->sc_dmat, sc->sc_cddmamap);
894  fail_2:
895 	bus_dmamem_unmap(sc->sc_dmat, (void *)sc->sc_control_data,
896 	    sizeof(struct pcn_control_data));
897  fail_1:
898 	bus_dmamem_free(sc->sc_dmat, &seg, rseg);
899  fail_0:
900 	return;
901 }
902 
903 /*
904  * pcn_shutdown:
905  *
906  *	Make sure the interface is stopped at reboot time.
907  */
908 static bool
909 pcn_shutdown(device_t self, int howto)
910 {
911 	struct pcn_softc *sc = device_private(self);
912 
913 	pcn_stop(&sc->sc_ethercom.ec_if, 1);
914 	/* explicitly reset the chip for some onboard one with lazy firmware */
915 	pcn_reset(sc);
916 
917 	return true;
918 }
919 
920 /*
921  * pcn_start:		[ifnet interface function]
922  *
923  *	Start packet transmission on the interface.
924  */
925 static void
926 pcn_start(struct ifnet *ifp)
927 {
928 	struct pcn_softc *sc = ifp->if_softc;
929 	struct mbuf *m0, *m;
930 	struct pcn_txsoft *txs;
931 	bus_dmamap_t dmamap;
932 	int error, nexttx, lasttx = -1, ofree, seg;
933 
934 	if ((ifp->if_flags & (IFF_RUNNING|IFF_OACTIVE)) != IFF_RUNNING)
935 		return;
936 
937 	/*
938 	 * Remember the previous number of free descriptors and
939 	 * the first descriptor we'll use.
940 	 */
941 	ofree = sc->sc_txfree;
942 
943 	/*
944 	 * Loop through the send queue, setting up transmit descriptors
945 	 * until we drain the queue, or use up all available transmit
946 	 * descriptors.
947 	 */
948 	for (;;) {
949 		/* Grab a packet off the queue. */
950 		IFQ_POLL(&ifp->if_snd, m0);
951 		if (m0 == NULL)
952 			break;
953 		m = NULL;
954 
955 		/* Get a work queue entry. */
956 		if (sc->sc_txsfree == 0) {
957 			PCN_EVCNT_INCR(&sc->sc_ev_txsstall);
958 			break;
959 		}
960 
961 		txs = &sc->sc_txsoft[sc->sc_txsnext];
962 		dmamap = txs->txs_dmamap;
963 
964 		/*
965 		 * Load the DMA map.  If this fails, the packet either
966 		 * didn't fit in the alloted number of segments, or we
967 		 * were short on resources.  In this case, we'll copy
968 		 * and try again.
969 		 */
970 		if (bus_dmamap_load_mbuf(sc->sc_dmat, dmamap, m0,
971 		    BUS_DMA_WRITE|BUS_DMA_NOWAIT) != 0) {
972 			PCN_EVCNT_INCR(&sc->sc_ev_txcopy);
973 			MGETHDR(m, M_DONTWAIT, MT_DATA);
974 			if (m == NULL) {
975 				printf("%s: unable to allocate Tx mbuf\n",
976 				    device_xname(sc->sc_dev));
977 				break;
978 			}
979 			if (m0->m_pkthdr.len > MHLEN) {
980 				MCLGET(m, M_DONTWAIT);
981 				if ((m->m_flags & M_EXT) == 0) {
982 					printf("%s: unable to allocate Tx "
983 					    "cluster\n",
984 					    device_xname(sc->sc_dev));
985 					m_freem(m);
986 					break;
987 				}
988 			}
989 			m_copydata(m0, 0, m0->m_pkthdr.len, mtod(m, void *));
990 			m->m_pkthdr.len = m->m_len = m0->m_pkthdr.len;
991 			error = bus_dmamap_load_mbuf(sc->sc_dmat, dmamap,
992 			    m, BUS_DMA_WRITE|BUS_DMA_NOWAIT);
993 			if (error) {
994 				printf("%s: unable to load Tx buffer, "
995 				    "error = %d\n", device_xname(sc->sc_dev),
996 				    error);
997 				break;
998 			}
999 		}
1000 
1001 		/*
1002 		 * Ensure we have enough descriptors free to describe
1003 		 * the packet.  Note, we always reserve one descriptor
1004 		 * at the end of the ring as a termination point, to
1005 		 * prevent wrap-around.
1006 		 */
1007 		if (dmamap->dm_nsegs > (sc->sc_txfree - 1)) {
1008 			/*
1009 			 * Not enough free descriptors to transmit this
1010 			 * packet.  We haven't committed anything yet,
1011 			 * so just unload the DMA map, put the packet
1012 			 * back on the queue, and punt.  Notify the upper
1013 			 * layer that there are not more slots left.
1014 			 *
1015 			 * XXX We could allocate an mbuf and copy, but
1016 			 * XXX is it worth it?
1017 			 */
1018 			ifp->if_flags |= IFF_OACTIVE;
1019 			bus_dmamap_unload(sc->sc_dmat, dmamap);
1020 			if (m != NULL)
1021 				m_freem(m);
1022 			PCN_EVCNT_INCR(&sc->sc_ev_txdstall);
1023 			break;
1024 		}
1025 
1026 		IFQ_DEQUEUE(&ifp->if_snd, m0);
1027 		if (m != NULL) {
1028 			m_freem(m0);
1029 			m0 = m;
1030 		}
1031 
1032 		/*
1033 		 * WE ARE NOW COMMITTED TO TRANSMITTING THE PACKET.
1034 		 */
1035 
1036 		/* Sync the DMA map. */
1037 		bus_dmamap_sync(sc->sc_dmat, dmamap, 0, dmamap->dm_mapsize,
1038 		    BUS_DMASYNC_PREWRITE);
1039 
1040 #ifdef PCN_EVENT_COUNTERS
1041 		switch (dmamap->dm_nsegs) {
1042 		case 1:
1043 			PCN_EVCNT_INCR(&sc->sc_ev_txseg1);
1044 			break;
1045 		case 2:
1046 			PCN_EVCNT_INCR(&sc->sc_ev_txseg2);
1047 			break;
1048 		case 3:
1049 			PCN_EVCNT_INCR(&sc->sc_ev_txseg3);
1050 			break;
1051 		case 4:
1052 			PCN_EVCNT_INCR(&sc->sc_ev_txseg4);
1053 			break;
1054 		case 5:
1055 			PCN_EVCNT_INCR(&sc->sc_ev_txseg5);
1056 			break;
1057 		default:
1058 			PCN_EVCNT_INCR(&sc->sc_ev_txsegmore);
1059 			break;
1060 		}
1061 #endif /* PCN_EVENT_COUNTERS */
1062 
1063 		/*
1064 		 * Initialize the transmit descriptors.
1065 		 */
1066 		if (sc->sc_swstyle == LE_B20_SSTYLE_PCNETPCI3) {
1067 			for (nexttx = sc->sc_txnext, seg = 0;
1068 			     seg < dmamap->dm_nsegs;
1069 			     seg++, nexttx = PCN_NEXTTX(nexttx)) {
1070 				/*
1071 				 * If this is the first descriptor we're
1072 				 * enqueueing, don't set the OWN bit just
1073 				 * yet.  That could cause a race condition.
1074 				 * We'll do it below.
1075 				 */
1076 				sc->sc_txdescs[nexttx].tmd0 = 0;
1077 				sc->sc_txdescs[nexttx].tmd2 =
1078 				    htole32(dmamap->dm_segs[seg].ds_addr);
1079 				sc->sc_txdescs[nexttx].tmd1 =
1080 				    htole32(LE_T1_ONES |
1081 				    (nexttx == sc->sc_txnext ? 0 : LE_T1_OWN) |
1082 				    (LE_BCNT(dmamap->dm_segs[seg].ds_len) &
1083 				     LE_T1_BCNT_MASK));
1084 				lasttx = nexttx;
1085 			}
1086 		} else {
1087 			for (nexttx = sc->sc_txnext, seg = 0;
1088 			     seg < dmamap->dm_nsegs;
1089 			     seg++, nexttx = PCN_NEXTTX(nexttx)) {
1090 				/*
1091 				 * If this is the first descriptor we're
1092 				 * enqueueing, don't set the OWN bit just
1093 				 * yet.  That could cause a race condition.
1094 				 * We'll do it below.
1095 				 */
1096 				sc->sc_txdescs[nexttx].tmd0 =
1097 				    htole32(dmamap->dm_segs[seg].ds_addr);
1098 				sc->sc_txdescs[nexttx].tmd2 = 0;
1099 				sc->sc_txdescs[nexttx].tmd1 =
1100 				    htole32(LE_T1_ONES |
1101 				    (nexttx == sc->sc_txnext ? 0 : LE_T1_OWN) |
1102 				    (LE_BCNT(dmamap->dm_segs[seg].ds_len) &
1103 				     LE_T1_BCNT_MASK));
1104 				lasttx = nexttx;
1105 			}
1106 		}
1107 
1108 		KASSERT(lasttx != -1);
1109 		/* Interrupt on the packet, if appropriate. */
1110 		if ((sc->sc_txsnext & PCN_TXINTR_MASK) == 0)
1111 			sc->sc_txdescs[lasttx].tmd1 |= htole32(LE_T1_LTINT);
1112 
1113 		/* Set `start of packet' and `end of packet' appropriately. */
1114 		sc->sc_txdescs[lasttx].tmd1 |= htole32(LE_T1_ENP);
1115 		sc->sc_txdescs[sc->sc_txnext].tmd1 |=
1116 		    htole32(LE_T1_OWN|LE_T1_STP);
1117 
1118 		/* Sync the descriptors we're using. */
1119 		PCN_CDTXSYNC(sc, sc->sc_txnext, dmamap->dm_nsegs,
1120 		    BUS_DMASYNC_PREREAD|BUS_DMASYNC_PREWRITE);
1121 
1122 		/* Kick the transmitter. */
1123 		pcn_csr_write(sc, LE_CSR0, LE_C0_INEA|LE_C0_TDMD);
1124 
1125 		/*
1126 		 * Store a pointer to the packet so we can free it later,
1127 		 * and remember what txdirty will be once the packet is
1128 		 * done.
1129 		 */
1130 		txs->txs_mbuf = m0;
1131 		txs->txs_firstdesc = sc->sc_txnext;
1132 		txs->txs_lastdesc = lasttx;
1133 
1134 		/* Advance the tx pointer. */
1135 		sc->sc_txfree -= dmamap->dm_nsegs;
1136 		sc->sc_txnext = nexttx;
1137 
1138 		sc->sc_txsfree--;
1139 		sc->sc_txsnext = PCN_NEXTTXS(sc->sc_txsnext);
1140 
1141 #if NBPFILTER > 0
1142 		/* Pass the packet to any BPF listeners. */
1143 		if (ifp->if_bpf)
1144 			bpf_mtap(ifp->if_bpf, m0);
1145 #endif /* NBPFILTER > 0 */
1146 	}
1147 
1148 	if (sc->sc_txsfree == 0 || sc->sc_txfree == 0) {
1149 		/* No more slots left; notify upper layer. */
1150 		ifp->if_flags |= IFF_OACTIVE;
1151 	}
1152 
1153 	if (sc->sc_txfree != ofree) {
1154 		/* Set a watchdog timer in case the chip flakes out. */
1155 		ifp->if_timer = 5;
1156 	}
1157 }
1158 
1159 /*
1160  * pcn_watchdog:	[ifnet interface function]
1161  *
1162  *	Watchdog timer handler.
1163  */
1164 static void
1165 pcn_watchdog(struct ifnet *ifp)
1166 {
1167 	struct pcn_softc *sc = ifp->if_softc;
1168 
1169 	/*
1170 	 * Since we're not interrupting every packet, sweep
1171 	 * up before we report an error.
1172 	 */
1173 	pcn_txintr(sc);
1174 
1175 	if (sc->sc_txfree != PCN_NTXDESC) {
1176 		printf("%s: device timeout (txfree %d txsfree %d)\n",
1177 		    device_xname(sc->sc_dev), sc->sc_txfree, sc->sc_txsfree);
1178 		ifp->if_oerrors++;
1179 
1180 		/* Reset the interface. */
1181 		(void) pcn_init(ifp);
1182 	}
1183 
1184 	/* Try to get more packets going. */
1185 	pcn_start(ifp);
1186 }
1187 
1188 /*
1189  * pcn_ioctl:		[ifnet interface function]
1190  *
1191  *	Handle control requests from the operator.
1192  */
1193 static int
1194 pcn_ioctl(struct ifnet *ifp, u_long cmd, void *data)
1195 {
1196 	struct pcn_softc *sc = ifp->if_softc;
1197 	struct ifreq *ifr = (struct ifreq *) data;
1198 	int s, error;
1199 
1200 	s = splnet();
1201 
1202 	switch (cmd) {
1203 	case SIOCSIFMEDIA:
1204 	case SIOCGIFMEDIA:
1205 		error = ifmedia_ioctl(ifp, ifr, &sc->sc_mii.mii_media, cmd);
1206 		break;
1207 
1208 	default:
1209 		error = ether_ioctl(ifp, cmd, data);
1210 		if (error == ENETRESET) {
1211 			/*
1212 			 * Multicast list has changed; set the hardware filter
1213 			 * accordingly.
1214 			 */
1215 			if (ifp->if_flags & IFF_RUNNING)
1216 				error = pcn_init(ifp);
1217 			else
1218 				error = 0;
1219 		}
1220 		break;
1221 	}
1222 
1223 	/* Try to get more packets going. */
1224 	pcn_start(ifp);
1225 
1226 	splx(s);
1227 	return (error);
1228 }
1229 
1230 /*
1231  * pcn_intr:
1232  *
1233  *	Interrupt service routine.
1234  */
1235 static int
1236 pcn_intr(void *arg)
1237 {
1238 	struct pcn_softc *sc = arg;
1239 	struct ifnet *ifp = &sc->sc_ethercom.ec_if;
1240 	uint32_t csr0;
1241 	int wantinit, handled = 0;
1242 
1243 	for (wantinit = 0; wantinit == 0;) {
1244 		csr0 = pcn_csr_read(sc, LE_CSR0);
1245 		if ((csr0 & LE_C0_INTR) == 0)
1246 			break;
1247 
1248 #if NRND > 0
1249 		if (RND_ENABLED(&sc->rnd_source))
1250 			rnd_add_uint32(&sc->rnd_source, csr0);
1251 #endif
1252 
1253 		/* ACK the bits and re-enable interrupts. */
1254 		pcn_csr_write(sc, LE_CSR0, csr0 &
1255 		    (LE_C0_INEA|LE_C0_BABL|LE_C0_MISS|LE_C0_MERR|LE_C0_RINT|
1256 		     LE_C0_TINT|LE_C0_IDON));
1257 
1258 		handled = 1;
1259 
1260 		if (csr0 & LE_C0_RINT) {
1261 			PCN_EVCNT_INCR(&sc->sc_ev_rxintr);
1262 			wantinit = pcn_rxintr(sc);
1263 		}
1264 
1265 		if (csr0 & LE_C0_TINT) {
1266 			PCN_EVCNT_INCR(&sc->sc_ev_txintr);
1267 			pcn_txintr(sc);
1268 		}
1269 
1270 		if (csr0 & LE_C0_ERR) {
1271 			if (csr0 & LE_C0_BABL) {
1272 				PCN_EVCNT_INCR(&sc->sc_ev_babl);
1273 				ifp->if_oerrors++;
1274 			}
1275 			if (csr0 & LE_C0_MISS) {
1276 				PCN_EVCNT_INCR(&sc->sc_ev_miss);
1277 				ifp->if_ierrors++;
1278 			}
1279 			if (csr0 & LE_C0_MERR) {
1280 				PCN_EVCNT_INCR(&sc->sc_ev_merr);
1281 				printf("%s: memory error\n",
1282 				    device_xname(sc->sc_dev));
1283 				wantinit = 1;
1284 				break;
1285 			}
1286 		}
1287 
1288 		if ((csr0 & LE_C0_RXON) == 0) {
1289 			printf("%s: receiver disabled\n",
1290 			    device_xname(sc->sc_dev));
1291 			ifp->if_ierrors++;
1292 			wantinit = 1;
1293 		}
1294 
1295 		if ((csr0 & LE_C0_TXON) == 0) {
1296 			printf("%s: transmitter disabled\n",
1297 			    device_xname(sc->sc_dev));
1298 			ifp->if_oerrors++;
1299 			wantinit = 1;
1300 		}
1301 	}
1302 
1303 	if (handled) {
1304 		if (wantinit)
1305 			pcn_init(ifp);
1306 
1307 		/* Try to get more packets going. */
1308 		pcn_start(ifp);
1309 	}
1310 
1311 	return (handled);
1312 }
1313 
1314 /*
1315  * pcn_spnd:
1316  *
1317  *	Suspend the chip.
1318  */
1319 static void
1320 pcn_spnd(struct pcn_softc *sc)
1321 {
1322 	int i;
1323 
1324 	pcn_csr_write(sc, LE_CSR5, sc->sc_csr5 | LE_C5_SPND);
1325 
1326 	for (i = 0; i < 10000; i++) {
1327 		if (pcn_csr_read(sc, LE_CSR5) & LE_C5_SPND)
1328 			return;
1329 		delay(5);
1330 	}
1331 
1332 	printf("%s: WARNING: chip failed to enter suspended state\n",
1333 	    device_xname(sc->sc_dev));
1334 }
1335 
1336 /*
1337  * pcn_txintr:
1338  *
1339  *	Helper; handle transmit interrupts.
1340  */
1341 static void
1342 pcn_txintr(struct pcn_softc *sc)
1343 {
1344 	struct ifnet *ifp = &sc->sc_ethercom.ec_if;
1345 	struct pcn_txsoft *txs;
1346 	uint32_t tmd1, tmd2, tmd;
1347 	int i, j;
1348 
1349 	ifp->if_flags &= ~IFF_OACTIVE;
1350 
1351 	/*
1352 	 * Go through our Tx list and free mbufs for those
1353 	 * frames which have been transmitted.
1354 	 */
1355 	for (i = sc->sc_txsdirty; sc->sc_txsfree != PCN_TXQUEUELEN;
1356 	     i = PCN_NEXTTXS(i), sc->sc_txsfree++) {
1357 		txs = &sc->sc_txsoft[i];
1358 
1359 		PCN_CDTXSYNC(sc, txs->txs_firstdesc, txs->txs_dmamap->dm_nsegs,
1360 		    BUS_DMASYNC_POSTREAD|BUS_DMASYNC_POSTWRITE);
1361 
1362 		tmd1 = le32toh(sc->sc_txdescs[txs->txs_lastdesc].tmd1);
1363 		if (tmd1 & LE_T1_OWN)
1364 			break;
1365 
1366 		/*
1367 		 * Slightly annoying -- we have to loop through the
1368 		 * descriptors we've used looking for ERR, since it
1369 		 * can appear on any descriptor in the chain.
1370 		 */
1371 		for (j = txs->txs_firstdesc;; j = PCN_NEXTTX(j)) {
1372 			tmd = le32toh(sc->sc_txdescs[j].tmd1);
1373 			if (tmd & LE_T1_ERR) {
1374 				ifp->if_oerrors++;
1375 				if (sc->sc_swstyle == LE_B20_SSTYLE_PCNETPCI3)
1376 					tmd2 = le32toh(sc->sc_txdescs[j].tmd0);
1377 				else
1378 					tmd2 = le32toh(sc->sc_txdescs[j].tmd2);
1379 				if (tmd2 & LE_T2_UFLO) {
1380 					if (sc->sc_xmtsp < LE_C80_XMTSP_MAX) {
1381 						sc->sc_xmtsp++;
1382 						printf("%s: transmit "
1383 						    "underrun; new threshold: "
1384 						    "%s\n",
1385 						    device_xname(sc->sc_dev),
1386 						    sc->sc_xmtsp_desc[
1387 						    sc->sc_xmtsp]);
1388 						pcn_spnd(sc);
1389 						pcn_csr_write(sc, LE_CSR80,
1390 						    LE_C80_RCVFW(sc->sc_rcvfw) |
1391 						    LE_C80_XMTSP(sc->sc_xmtsp) |
1392 						    LE_C80_XMTFW(sc->sc_xmtfw));
1393 						pcn_csr_write(sc, LE_CSR5,
1394 						    sc->sc_csr5);
1395 					} else {
1396 						printf("%s: transmit "
1397 						    "underrun\n",
1398 						    device_xname(sc->sc_dev));
1399 					}
1400 				} else if (tmd2 & LE_T2_BUFF) {
1401 					printf("%s: transmit buffer error\n",
1402 					    device_xname(sc->sc_dev));
1403 				}
1404 				if (tmd2 & LE_T2_LCOL)
1405 					ifp->if_collisions++;
1406 				if (tmd2 & LE_T2_RTRY)
1407 					ifp->if_collisions += 16;
1408 				goto next_packet;
1409 			}
1410 			if (j == txs->txs_lastdesc)
1411 				break;
1412 		}
1413 		if (tmd1 & LE_T1_ONE)
1414 			ifp->if_collisions++;
1415 		else if (tmd & LE_T1_MORE) {
1416 			/* Real number is unknown. */
1417 			ifp->if_collisions += 2;
1418 		}
1419 		ifp->if_opackets++;
1420  next_packet:
1421 		sc->sc_txfree += txs->txs_dmamap->dm_nsegs;
1422 		bus_dmamap_sync(sc->sc_dmat, txs->txs_dmamap,
1423 		    0, txs->txs_dmamap->dm_mapsize, BUS_DMASYNC_POSTWRITE);
1424 		bus_dmamap_unload(sc->sc_dmat, txs->txs_dmamap);
1425 		m_freem(txs->txs_mbuf);
1426 		txs->txs_mbuf = NULL;
1427 	}
1428 
1429 	/* Update the dirty transmit buffer pointer. */
1430 	sc->sc_txsdirty = i;
1431 
1432 	/*
1433 	 * If there are no more pending transmissions, cancel the watchdog
1434 	 * timer.
1435 	 */
1436 	if (sc->sc_txsfree == PCN_TXQUEUELEN)
1437 		ifp->if_timer = 0;
1438 }
1439 
1440 /*
1441  * pcn_rxintr:
1442  *
1443  *	Helper; handle receive interrupts.
1444  */
1445 static int
1446 pcn_rxintr(struct pcn_softc *sc)
1447 {
1448 	struct ifnet *ifp = &sc->sc_ethercom.ec_if;
1449 	struct pcn_rxsoft *rxs;
1450 	struct mbuf *m;
1451 	uint32_t rmd1;
1452 	int i, len;
1453 
1454 	for (i = sc->sc_rxptr;; i = PCN_NEXTRX(i)) {
1455 		rxs = &sc->sc_rxsoft[i];
1456 
1457 		PCN_CDRXSYNC(sc, i, BUS_DMASYNC_POSTREAD|BUS_DMASYNC_POSTWRITE);
1458 
1459 		rmd1 = le32toh(sc->sc_rxdescs[i].rmd1);
1460 
1461 		if (rmd1 & LE_R1_OWN)
1462 			break;
1463 
1464 		/*
1465 		 * Check for errors and make sure the packet fit into
1466 		 * a single buffer.  We have structured this block of
1467 		 * code the way it is in order to compress it into
1468 		 * one test in the common case (no error).
1469 		 */
1470 		if (__predict_false((rmd1 & (LE_R1_STP|LE_R1_ENP|LE_R1_ERR)) !=
1471 		    (LE_R1_STP|LE_R1_ENP))) {
1472 			/* Make sure the packet is in a single buffer. */
1473 			if ((rmd1 & (LE_R1_STP|LE_R1_ENP)) !=
1474 			    (LE_R1_STP|LE_R1_ENP)) {
1475 				printf("%s: packet spilled into next buffer\n",
1476 				    device_xname(sc->sc_dev));
1477 				return (1);	/* pcn_intr() will re-init */
1478 			}
1479 
1480 			/*
1481 			 * If the packet had an error, simple recycle the
1482 			 * buffer.
1483 			 */
1484 			if (rmd1 & LE_R1_ERR) {
1485 				ifp->if_ierrors++;
1486 				/*
1487 				 * If we got an overflow error, chances
1488 				 * are there will be a CRC error.  In
1489 				 * this case, just print the overflow
1490 				 * error, and skip the others.
1491 				 */
1492 				if (rmd1 & LE_R1_OFLO)
1493 					printf("%s: overflow error\n",
1494 					    device_xname(sc->sc_dev));
1495 				else {
1496 #define	PRINTIT(x, str)							\
1497 					if (rmd1 & (x))			\
1498 						printf("%s: %s\n",	\
1499 						    device_xname(sc->sc_dev), \
1500 						    str);
1501 					PRINTIT(LE_R1_FRAM, "framing error");
1502 					PRINTIT(LE_R1_CRC, "CRC error");
1503 					PRINTIT(LE_R1_BUFF, "buffer error");
1504 				}
1505 #undef PRINTIT
1506 				PCN_INIT_RXDESC(sc, i);
1507 				continue;
1508 			}
1509 		}
1510 
1511 		bus_dmamap_sync(sc->sc_dmat, rxs->rxs_dmamap, 0,
1512 		    rxs->rxs_dmamap->dm_mapsize, BUS_DMASYNC_POSTREAD);
1513 
1514 		/*
1515 		 * No errors; receive the packet.
1516 		 */
1517 		if (sc->sc_swstyle == LE_B20_SSTYLE_PCNETPCI3)
1518 			len = le32toh(sc->sc_rxdescs[i].rmd0) & LE_R1_BCNT_MASK;
1519 		else
1520 			len = le32toh(sc->sc_rxdescs[i].rmd2) & LE_R1_BCNT_MASK;
1521 
1522 		/*
1523 		 * The LANCE family includes the CRC with every packet;
1524 		 * trim it off here.
1525 		 */
1526 		len -= ETHER_CRC_LEN;
1527 
1528 		/*
1529 		 * If the packet is small enough to fit in a
1530 		 * single header mbuf, allocate one and copy
1531 		 * the data into it.  This greatly reduces
1532 		 * memory consumption when we receive lots
1533 		 * of small packets.
1534 		 *
1535 		 * Otherwise, we add a new buffer to the receive
1536 		 * chain.  If this fails, we drop the packet and
1537 		 * recycle the old buffer.
1538 		 */
1539 		if (pcn_copy_small != 0 && len <= (MHLEN - 2)) {
1540 			MGETHDR(m, M_DONTWAIT, MT_DATA);
1541 			if (m == NULL)
1542 				goto dropit;
1543 			m->m_data += 2;
1544 			memcpy(mtod(m, void *),
1545 			    mtod(rxs->rxs_mbuf, void *), len);
1546 			PCN_INIT_RXDESC(sc, i);
1547 			bus_dmamap_sync(sc->sc_dmat, rxs->rxs_dmamap, 0,
1548 			    rxs->rxs_dmamap->dm_mapsize,
1549 			    BUS_DMASYNC_PREREAD);
1550 		} else {
1551 			m = rxs->rxs_mbuf;
1552 			if (pcn_add_rxbuf(sc, i) != 0) {
1553  dropit:
1554 				ifp->if_ierrors++;
1555 				PCN_INIT_RXDESC(sc, i);
1556 				bus_dmamap_sync(sc->sc_dmat,
1557 				    rxs->rxs_dmamap, 0,
1558 				    rxs->rxs_dmamap->dm_mapsize,
1559 				    BUS_DMASYNC_PREREAD);
1560 				continue;
1561 			}
1562 		}
1563 
1564 		m->m_pkthdr.rcvif = ifp;
1565 		m->m_pkthdr.len = m->m_len = len;
1566 
1567 #if NBPFILTER > 0
1568 		/* Pass this up to any BPF listeners. */
1569 		if (ifp->if_bpf)
1570 			bpf_mtap(ifp->if_bpf, m);
1571 #endif /* NBPFILTER > 0 */
1572 
1573 		/* Pass it on. */
1574 		(*ifp->if_input)(ifp, m);
1575 		ifp->if_ipackets++;
1576 	}
1577 
1578 	/* Update the receive pointer. */
1579 	sc->sc_rxptr = i;
1580 	return (0);
1581 }
1582 
1583 /*
1584  * pcn_tick:
1585  *
1586  *	One second timer, used to tick the MII.
1587  */
1588 static void
1589 pcn_tick(void *arg)
1590 {
1591 	struct pcn_softc *sc = arg;
1592 	int s;
1593 
1594 	s = splnet();
1595 	mii_tick(&sc->sc_mii);
1596 	splx(s);
1597 
1598 	callout_reset(&sc->sc_tick_ch, hz, pcn_tick, sc);
1599 }
1600 
1601 /*
1602  * pcn_reset:
1603  *
1604  *	Perform a soft reset on the PCnet-PCI.
1605  */
1606 static void
1607 pcn_reset(struct pcn_softc *sc)
1608 {
1609 
1610 	/*
1611 	 * The PCnet-PCI chip is reset by reading from the
1612 	 * RESET register.  Note that while the NE2100 LANCE
1613 	 * boards require a write after the read, the PCnet-PCI
1614 	 * chips do not require this.
1615 	 *
1616 	 * Since we don't know if we're in 16-bit or 32-bit
1617 	 * mode right now, issue both (it's safe) in the
1618 	 * hopes that one will succeed.
1619 	 */
1620 	(void) bus_space_read_2(sc->sc_st, sc->sc_sh, PCN16_RESET);
1621 	(void) bus_space_read_4(sc->sc_st, sc->sc_sh, PCN32_RESET);
1622 
1623 	/* Wait 1ms for it to finish. */
1624 	delay(1000);
1625 
1626 	/*
1627 	 * Select 32-bit I/O mode by issuing a 32-bit write to the
1628 	 * RDP.  Since the RAP is 0 after a reset, writing a 0
1629 	 * to RDP is safe (since it simply clears CSR0).
1630 	 */
1631 	bus_space_write_4(sc->sc_st, sc->sc_sh, PCN32_RDP, 0);
1632 }
1633 
1634 /*
1635  * pcn_init:		[ifnet interface function]
1636  *
1637  *	Initialize the interface.  Must be called at splnet().
1638  */
1639 static int
1640 pcn_init(struct ifnet *ifp)
1641 {
1642 	struct pcn_softc *sc = ifp->if_softc;
1643 	struct pcn_rxsoft *rxs;
1644 	const uint8_t *enaddr = CLLADDR(ifp->if_sadl);
1645 	int i, error = 0;
1646 	uint32_t reg;
1647 
1648 	/* Cancel any pending I/O. */
1649 	pcn_stop(ifp, 0);
1650 
1651 	/* Reset the chip to a known state. */
1652 	pcn_reset(sc);
1653 
1654 	/*
1655 	 * On the Am79c970, select SSTYLE 2, and SSTYLE 3 on everything
1656 	 * else.
1657 	 *
1658 	 * XXX It'd be really nice to use SSTYLE 2 on all the chips,
1659 	 * because the structure layout is compatible with ILACC,
1660 	 * but the burst mode is only available in SSTYLE 3, and
1661 	 * burst mode should provide some performance enhancement.
1662 	 */
1663 	if (sc->sc_variant->pcv_chipid == PARTID_Am79c970)
1664 		sc->sc_swstyle = LE_B20_SSTYLE_PCNETPCI2;
1665 	else
1666 		sc->sc_swstyle = LE_B20_SSTYLE_PCNETPCI3;
1667 	pcn_bcr_write(sc, LE_BCR20, sc->sc_swstyle);
1668 
1669 	/* Initialize the transmit descriptor ring. */
1670 	memset(sc->sc_txdescs, 0, sizeof(sc->sc_txdescs));
1671 	PCN_CDTXSYNC(sc, 0, PCN_NTXDESC,
1672 	    BUS_DMASYNC_PREREAD|BUS_DMASYNC_PREWRITE);
1673 	sc->sc_txfree = PCN_NTXDESC;
1674 	sc->sc_txnext = 0;
1675 
1676 	/* Initialize the transmit job descriptors. */
1677 	for (i = 0; i < PCN_TXQUEUELEN; i++)
1678 		sc->sc_txsoft[i].txs_mbuf = NULL;
1679 	sc->sc_txsfree = PCN_TXQUEUELEN;
1680 	sc->sc_txsnext = 0;
1681 	sc->sc_txsdirty = 0;
1682 
1683 	/*
1684 	 * Initialize the receive descriptor and receive job
1685 	 * descriptor rings.
1686 	 */
1687 	for (i = 0; i < PCN_NRXDESC; i++) {
1688 		rxs = &sc->sc_rxsoft[i];
1689 		if (rxs->rxs_mbuf == NULL) {
1690 			if ((error = pcn_add_rxbuf(sc, i)) != 0) {
1691 				printf("%s: unable to allocate or map rx "
1692 				    "buffer %d, error = %d\n",
1693 				    device_xname(sc->sc_dev), i, error);
1694 				/*
1695 				 * XXX Should attempt to run with fewer receive
1696 				 * XXX buffers instead of just failing.
1697 				 */
1698 				pcn_rxdrain(sc);
1699 				goto out;
1700 			}
1701 		} else
1702 			PCN_INIT_RXDESC(sc, i);
1703 	}
1704 	sc->sc_rxptr = 0;
1705 
1706 	/* Initialize MODE for the initialization block. */
1707 	sc->sc_mode = 0;
1708 	if (ifp->if_flags & IFF_PROMISC)
1709 		sc->sc_mode |= LE_C15_PROM;
1710 	if ((ifp->if_flags & IFF_BROADCAST) == 0)
1711 		sc->sc_mode |= LE_C15_DRCVBC;
1712 
1713 	/*
1714 	 * If we have MII, simply select MII in the MODE register,
1715 	 * and clear ASEL.  Otherwise, let ASEL stand (for now),
1716 	 * and leave PORTSEL alone (it is ignored with ASEL is set).
1717 	 */
1718 	if (sc->sc_flags & PCN_F_HAS_MII) {
1719 		pcn_bcr_write(sc, LE_BCR2,
1720 		    pcn_bcr_read(sc, LE_BCR2) & ~LE_B2_ASEL);
1721 		sc->sc_mode |= LE_C15_PORTSEL(PORTSEL_MII);
1722 
1723 		/*
1724 		 * Disable MII auto-negotiation.  We handle that in
1725 		 * our own MII layer.
1726 		 */
1727 		pcn_bcr_write(sc, LE_BCR32,
1728 		    pcn_bcr_read(sc, LE_BCR32) | LE_B32_DANAS);
1729 	}
1730 
1731 	/*
1732 	 * Set the Tx and Rx descriptor ring addresses in the init
1733 	 * block, the TLEN and RLEN other fields of the init block
1734 	 * MODE register.
1735 	 */
1736 	sc->sc_initblock.init_rdra = htole32(PCN_CDRXADDR(sc, 0));
1737 	sc->sc_initblock.init_tdra = htole32(PCN_CDTXADDR(sc, 0));
1738 	sc->sc_initblock.init_mode = htole32(sc->sc_mode |
1739 	    ((ffs(PCN_NTXDESC) - 1) << 28) |
1740 	    ((ffs(PCN_NRXDESC) - 1) << 20));
1741 
1742 	/* Set the station address in the init block. */
1743 	sc->sc_initblock.init_padr[0] = htole32(enaddr[0] |
1744 	    (enaddr[1] << 8) | (enaddr[2] << 16) | (enaddr[3] << 24));
1745 	sc->sc_initblock.init_padr[1] = htole32(enaddr[4] |
1746 	    (enaddr[5] << 8));
1747 
1748 	/* Set the multicast filter in the init block. */
1749 	pcn_set_filter(sc);
1750 
1751 	/* Initialize CSR3. */
1752 	pcn_csr_write(sc, LE_CSR3, LE_C3_MISSM|LE_C3_IDONM|LE_C3_DXSUFLO);
1753 
1754 	/* Initialize CSR4. */
1755 	pcn_csr_write(sc, LE_CSR4, LE_C4_DMAPLUS|LE_C4_APAD_XMT|
1756 	    LE_C4_MFCOM|LE_C4_RCVCCOM|LE_C4_TXSTRTM);
1757 
1758 	/* Initialize CSR5. */
1759 	sc->sc_csr5 = LE_C5_LTINTEN|LE_C5_SINTE;
1760 	pcn_csr_write(sc, LE_CSR5, sc->sc_csr5);
1761 
1762 	/*
1763 	 * If we have an Am79c971 or greater, initialize CSR7.
1764 	 *
1765 	 * XXX Might be nice to use the MII auto-poll interrupt someday.
1766 	 */
1767 	switch (sc->sc_variant->pcv_chipid) {
1768 	case PARTID_Am79c970:
1769 	case PARTID_Am79c970A:
1770 		/* Not available on these chips. */
1771 		break;
1772 
1773 	default:
1774 		pcn_csr_write(sc, LE_CSR7, LE_C7_FASTSPNDE);
1775 		break;
1776 	}
1777 
1778 	/*
1779 	 * On the Am79c970A and greater, initialize BCR18 to
1780 	 * enable burst mode.
1781 	 *
1782 	 * Also enable the "no underflow" option on the Am79c971 and
1783 	 * higher, which prevents the chip from generating transmit
1784 	 * underflows, yet sill provides decent performance.  Note if
1785 	 * chip is not connected to external SRAM, then we still have
1786 	 * to handle underflow errors (the NOUFLO bit is ignored in
1787 	 * that case).
1788 	 */
1789 	reg = pcn_bcr_read(sc, LE_BCR18);
1790 	switch (sc->sc_variant->pcv_chipid) {
1791 	case PARTID_Am79c970:
1792 		break;
1793 
1794 	case PARTID_Am79c970A:
1795 		reg |= LE_B18_BREADE|LE_B18_BWRITE;
1796 		break;
1797 
1798 	default:
1799 		reg |= LE_B18_BREADE|LE_B18_BWRITE|LE_B18_NOUFLO;
1800 		break;
1801 	}
1802 	pcn_bcr_write(sc, LE_BCR18, reg);
1803 
1804 	/*
1805 	 * Initialize CSR80 (FIFO thresholds for Tx and Rx).
1806 	 */
1807 	pcn_csr_write(sc, LE_CSR80, LE_C80_RCVFW(sc->sc_rcvfw) |
1808 	    LE_C80_XMTSP(sc->sc_xmtsp) | LE_C80_XMTFW(sc->sc_xmtfw));
1809 
1810 	/*
1811 	 * Send the init block to the chip, and wait for it
1812 	 * to be processed.
1813 	 */
1814 	PCN_CDINITSYNC(sc, BUS_DMASYNC_PREWRITE);
1815 	pcn_csr_write(sc, LE_CSR1, PCN_CDINITADDR(sc) & 0xffff);
1816 	pcn_csr_write(sc, LE_CSR2, (PCN_CDINITADDR(sc) >> 16) & 0xffff);
1817 	pcn_csr_write(sc, LE_CSR0, LE_C0_INIT);
1818 	delay(100);
1819 	for (i = 0; i < 10000; i++) {
1820 		if (pcn_csr_read(sc, LE_CSR0) & LE_C0_IDON)
1821 			break;
1822 		delay(10);
1823 	}
1824 	PCN_CDINITSYNC(sc, BUS_DMASYNC_POSTWRITE);
1825 	if (i == 10000) {
1826 		printf("%s: timeout processing init block\n",
1827 		    device_xname(sc->sc_dev));
1828 		error = EIO;
1829 		goto out;
1830 	}
1831 
1832 	/* Set the media. */
1833 	if ((error = mii_ifmedia_change(&sc->sc_mii)) != 0)
1834 		goto out;
1835 
1836 	/* Enable interrupts and external activity (and ACK IDON). */
1837 	pcn_csr_write(sc, LE_CSR0, LE_C0_INEA|LE_C0_STRT|LE_C0_IDON);
1838 
1839 	if (sc->sc_flags & PCN_F_HAS_MII) {
1840 		/* Start the one second MII clock. */
1841 		callout_reset(&sc->sc_tick_ch, hz, pcn_tick, sc);
1842 	}
1843 
1844 	/* ...all done! */
1845 	ifp->if_flags |= IFF_RUNNING;
1846 	ifp->if_flags &= ~IFF_OACTIVE;
1847 
1848  out:
1849 	if (error)
1850 		printf("%s: interface not running\n", device_xname(sc->sc_dev));
1851 	return (error);
1852 }
1853 
1854 /*
1855  * pcn_rxdrain:
1856  *
1857  *	Drain the receive queue.
1858  */
1859 static void
1860 pcn_rxdrain(struct pcn_softc *sc)
1861 {
1862 	struct pcn_rxsoft *rxs;
1863 	int i;
1864 
1865 	for (i = 0; i < PCN_NRXDESC; i++) {
1866 		rxs = &sc->sc_rxsoft[i];
1867 		if (rxs->rxs_mbuf != NULL) {
1868 			bus_dmamap_unload(sc->sc_dmat, rxs->rxs_dmamap);
1869 			m_freem(rxs->rxs_mbuf);
1870 			rxs->rxs_mbuf = NULL;
1871 		}
1872 	}
1873 }
1874 
1875 /*
1876  * pcn_stop:		[ifnet interface function]
1877  *
1878  *	Stop transmission on the interface.
1879  */
1880 static void
1881 pcn_stop(struct ifnet *ifp, int disable)
1882 {
1883 	struct pcn_softc *sc = ifp->if_softc;
1884 	struct pcn_txsoft *txs;
1885 	int i;
1886 
1887 	if (sc->sc_flags & PCN_F_HAS_MII) {
1888 		/* Stop the one second clock. */
1889 		callout_stop(&sc->sc_tick_ch);
1890 
1891 		/* Down the MII. */
1892 		mii_down(&sc->sc_mii);
1893 	}
1894 
1895 	/* Stop the chip. */
1896 	pcn_csr_write(sc, LE_CSR0, LE_C0_STOP);
1897 
1898 	/* Release any queued transmit buffers. */
1899 	for (i = 0; i < PCN_TXQUEUELEN; i++) {
1900 		txs = &sc->sc_txsoft[i];
1901 		if (txs->txs_mbuf != NULL) {
1902 			bus_dmamap_unload(sc->sc_dmat, txs->txs_dmamap);
1903 			m_freem(txs->txs_mbuf);
1904 			txs->txs_mbuf = NULL;
1905 		}
1906 	}
1907 
1908 	/* Mark the interface as down and cancel the watchdog timer. */
1909 	ifp->if_flags &= ~(IFF_RUNNING | IFF_OACTIVE);
1910 	ifp->if_timer = 0;
1911 
1912 	if (disable)
1913 		pcn_rxdrain(sc);
1914 }
1915 
1916 /*
1917  * pcn_add_rxbuf:
1918  *
1919  *	Add a receive buffer to the indicated descriptor.
1920  */
1921 static int
1922 pcn_add_rxbuf(struct pcn_softc *sc, int idx)
1923 {
1924 	struct pcn_rxsoft *rxs = &sc->sc_rxsoft[idx];
1925 	struct mbuf *m;
1926 	int error;
1927 
1928 	MGETHDR(m, M_DONTWAIT, MT_DATA);
1929 	if (m == NULL)
1930 		return (ENOBUFS);
1931 
1932 	MCLGET(m, M_DONTWAIT);
1933 	if ((m->m_flags & M_EXT) == 0) {
1934 		m_freem(m);
1935 		return (ENOBUFS);
1936 	}
1937 
1938 	if (rxs->rxs_mbuf != NULL)
1939 		bus_dmamap_unload(sc->sc_dmat, rxs->rxs_dmamap);
1940 
1941 	rxs->rxs_mbuf = m;
1942 
1943 	error = bus_dmamap_load(sc->sc_dmat, rxs->rxs_dmamap,
1944 	    m->m_ext.ext_buf, m->m_ext.ext_size, NULL,
1945 	    BUS_DMA_READ|BUS_DMA_NOWAIT);
1946 	if (error) {
1947 		printf("%s: can't load rx DMA map %d, error = %d\n",
1948 		    device_xname(sc->sc_dev), idx, error);
1949 		panic("pcn_add_rxbuf");
1950 	}
1951 
1952 	bus_dmamap_sync(sc->sc_dmat, rxs->rxs_dmamap, 0,
1953 	    rxs->rxs_dmamap->dm_mapsize, BUS_DMASYNC_PREREAD);
1954 
1955 	PCN_INIT_RXDESC(sc, idx);
1956 
1957 	return (0);
1958 }
1959 
1960 /*
1961  * pcn_set_filter:
1962  *
1963  *	Set up the receive filter.
1964  */
1965 static void
1966 pcn_set_filter(struct pcn_softc *sc)
1967 {
1968 	struct ethercom *ec = &sc->sc_ethercom;
1969 	struct ifnet *ifp = &sc->sc_ethercom.ec_if;
1970 	struct ether_multi *enm;
1971 	struct ether_multistep step;
1972 	uint32_t crc;
1973 
1974 	/*
1975 	 * Set up the multicast address filter by passing all multicast
1976 	 * addresses through a CRC generator, and then using the high
1977 	 * order 6 bits as an index into the 64-bit logical address
1978 	 * filter.  The high order bits select the word, while the rest
1979 	 * of the bits select the bit within the word.
1980 	 */
1981 
1982 	if (ifp->if_flags & IFF_PROMISC)
1983 		goto allmulti;
1984 
1985 	sc->sc_initblock.init_ladrf[0] =
1986 	    sc->sc_initblock.init_ladrf[1] =
1987 	    sc->sc_initblock.init_ladrf[2] =
1988 	    sc->sc_initblock.init_ladrf[3] = 0;
1989 
1990 	ETHER_FIRST_MULTI(step, ec, enm);
1991 	while (enm != NULL) {
1992 		if (memcmp(enm->enm_addrlo, enm->enm_addrhi, ETHER_ADDR_LEN)) {
1993 			/*
1994 			 * We must listen to a range of multicast addresses.
1995 			 * For now, just accept all multicasts, rather than
1996 			 * trying to set only those filter bits needed to match
1997 			 * the range.  (At this time, the only use of address
1998 			 * ranges is for IP multicast routing, for which the
1999 			 * range is big enough to require all bits set.)
2000 			 */
2001 			goto allmulti;
2002 		}
2003 
2004 		crc = ether_crc32_le(enm->enm_addrlo, ETHER_ADDR_LEN);
2005 
2006 		/* Just want the 6 most significant bits. */
2007 		crc >>= 26;
2008 
2009 		/* Set the corresponding bit in the filter. */
2010 		sc->sc_initblock.init_ladrf[crc >> 4] |=
2011 		    htole16(1 << (crc & 0xf));
2012 
2013 		ETHER_NEXT_MULTI(step, enm);
2014 	}
2015 
2016 	ifp->if_flags &= ~IFF_ALLMULTI;
2017 	return;
2018 
2019  allmulti:
2020 	ifp->if_flags |= IFF_ALLMULTI;
2021 	sc->sc_initblock.init_ladrf[0] =
2022 	    sc->sc_initblock.init_ladrf[1] =
2023 	    sc->sc_initblock.init_ladrf[2] =
2024 	    sc->sc_initblock.init_ladrf[3] = 0xffff;
2025 }
2026 
2027 /*
2028  * pcn_79c970_mediainit:
2029  *
2030  *	Initialize media for the Am79c970.
2031  */
2032 static void
2033 pcn_79c970_mediainit(struct pcn_softc *sc)
2034 {
2035 	struct ifnet *ifp = &sc->sc_ethercom.ec_if;
2036 	const char *sep = "";
2037 
2038 	sc->sc_mii.mii_ifp = ifp;
2039 
2040 	ifmedia_init(&sc->sc_mii.mii_media, IFM_IMASK, pcn_79c970_mediachange,
2041 	    pcn_79c970_mediastatus);
2042 
2043 #define	ADD(str, m, d)							\
2044 do {									\
2045 	printf("%s%s", sep, str);					\
2046 	ifmedia_add(&sc->sc_mii.mii_media, IFM_ETHER|(m), (d), NULL);	\
2047 	sep = ", ";							\
2048 } while (/*CONSTCOND*/0)
2049 
2050 	printf("%s: ", device_xname(sc->sc_dev));
2051 	ADD("10base5", IFM_10_5, PORTSEL_AUI);
2052 	if (sc->sc_variant->pcv_chipid == PARTID_Am79c970A)
2053 		ADD("10base5-FDX", IFM_10_5|IFM_FDX, PORTSEL_AUI);
2054 	ADD("10baseT", IFM_10_T, PORTSEL_10T);
2055 	if (sc->sc_variant->pcv_chipid == PARTID_Am79c970A)
2056 		ADD("10baseT-FDX", IFM_10_T|IFM_FDX, PORTSEL_10T);
2057 	ADD("auto", IFM_AUTO, 0);
2058 	if (sc->sc_variant->pcv_chipid == PARTID_Am79c970A)
2059 		ADD("auto-FDX", IFM_AUTO|IFM_FDX, 0);
2060 	printf("\n");
2061 
2062 	ifmedia_set(&sc->sc_mii.mii_media, IFM_ETHER|IFM_AUTO);
2063 }
2064 
2065 /*
2066  * pcn_79c970_mediastatus:	[ifmedia interface function]
2067  *
2068  *	Get the current interface media status (Am79c970 version).
2069  */
2070 static void
2071 pcn_79c970_mediastatus(struct ifnet *ifp, struct ifmediareq *ifmr)
2072 {
2073 	struct pcn_softc *sc = ifp->if_softc;
2074 
2075 	/*
2076 	 * The currently selected media is always the active media.
2077 	 * Note: We have no way to determine what media the AUTO
2078 	 * process picked.
2079 	 */
2080 	ifmr->ifm_active = sc->sc_mii.mii_media.ifm_media;
2081 }
2082 
2083 /*
2084  * pcn_79c970_mediachange:	[ifmedia interface function]
2085  *
2086  *	Set hardware to newly-selected media (Am79c970 version).
2087  */
2088 static int
2089 pcn_79c970_mediachange(struct ifnet *ifp)
2090 {
2091 	struct pcn_softc *sc = ifp->if_softc;
2092 	uint32_t reg;
2093 
2094 	if (IFM_SUBTYPE(sc->sc_mii.mii_media.ifm_media) == IFM_AUTO) {
2095 		/*
2096 		 * CSR15:PORTSEL doesn't matter.  Just set BCR2:ASEL.
2097 		 */
2098 		reg = pcn_bcr_read(sc, LE_BCR2);
2099 		reg |= LE_B2_ASEL;
2100 		pcn_bcr_write(sc, LE_BCR2, reg);
2101 	} else {
2102 		/*
2103 		 * Clear BCR2:ASEL and set the new CSR15:PORTSEL value.
2104 		 */
2105 		reg = pcn_bcr_read(sc, LE_BCR2);
2106 		reg &= ~LE_B2_ASEL;
2107 		pcn_bcr_write(sc, LE_BCR2, reg);
2108 
2109 		reg = pcn_csr_read(sc, LE_CSR15);
2110 		reg = (reg & ~LE_C15_PORTSEL(PORTSEL_MASK)) |
2111 		    LE_C15_PORTSEL(sc->sc_mii.mii_media.ifm_cur->ifm_data);
2112 		pcn_csr_write(sc, LE_CSR15, reg);
2113 	}
2114 
2115 	if ((sc->sc_mii.mii_media.ifm_media & IFM_FDX) != 0) {
2116 		reg = LE_B9_FDEN;
2117 		if (IFM_SUBTYPE(sc->sc_mii.mii_media.ifm_media) == IFM_10_5)
2118 			reg |= LE_B9_AUIFD;
2119 		pcn_bcr_write(sc, LE_BCR9, reg);
2120 	} else
2121 		pcn_bcr_write(sc, LE_BCR9, 0);
2122 
2123 	return (0);
2124 }
2125 
2126 /*
2127  * pcn_79c971_mediainit:
2128  *
2129  *	Initialize media for the Am79c971.
2130  */
2131 static void
2132 pcn_79c971_mediainit(struct pcn_softc *sc)
2133 {
2134 	struct ifnet *ifp = &sc->sc_ethercom.ec_if;
2135 
2136 	/* We have MII. */
2137 	sc->sc_flags |= PCN_F_HAS_MII;
2138 
2139 	/*
2140 	 * The built-in 10BASE-T interface is mapped to the MII
2141 	 * on the PCNet-FAST.  Unfortunately, there's no EEPROM
2142 	 * word that tells us which PHY to use.
2143 	 * This driver used to ignore all but the first PHY to
2144 	 * answer, but this code was removed to support multiple
2145 	 * external PHYs. As the default instance will be the first
2146 	 * one to answer, no harm is done by letting the possibly
2147 	 * non-connected internal PHY show up.
2148 	 */
2149 
2150 	/* Initialize our media structures and probe the MII. */
2151 	sc->sc_mii.mii_ifp = ifp;
2152 	sc->sc_mii.mii_readreg = pcn_mii_readreg;
2153 	sc->sc_mii.mii_writereg = pcn_mii_writereg;
2154 	sc->sc_mii.mii_statchg = pcn_mii_statchg;
2155 
2156 	sc->sc_ethercom.ec_mii = &sc->sc_mii;
2157 	ifmedia_init(&sc->sc_mii.mii_media, 0, ether_mediachange,
2158 	    ether_mediastatus);
2159 
2160 	mii_attach(sc->sc_dev, &sc->sc_mii, 0xffffffff, MII_PHY_ANY,
2161 	    MII_OFFSET_ANY, 0);
2162 	if (LIST_FIRST(&sc->sc_mii.mii_phys) == NULL) {
2163 		ifmedia_add(&sc->sc_mii.mii_media, IFM_ETHER|IFM_NONE, 0, NULL);
2164 		ifmedia_set(&sc->sc_mii.mii_media, IFM_ETHER|IFM_NONE);
2165 	} else
2166 		ifmedia_set(&sc->sc_mii.mii_media, IFM_ETHER|IFM_AUTO);
2167 }
2168 
2169 /*
2170  * pcn_mii_readreg:	[mii interface function]
2171  *
2172  *	Read a PHY register on the MII.
2173  */
2174 static int
2175 pcn_mii_readreg(device_t self, int phy, int reg)
2176 {
2177 	struct pcn_softc *sc = device_private(self);
2178 	uint32_t rv;
2179 
2180 	pcn_bcr_write(sc, LE_BCR33, reg | (phy << PHYAD_SHIFT));
2181 	rv = pcn_bcr_read(sc, LE_BCR34) & LE_B34_MIIMD;
2182 	if (rv == 0xffff)
2183 		return (0);
2184 
2185 	return (rv);
2186 }
2187 
2188 /*
2189  * pcn_mii_writereg:	[mii interface function]
2190  *
2191  *	Write a PHY register on the MII.
2192  */
2193 static void
2194 pcn_mii_writereg(device_t self, int phy, int reg, int val)
2195 {
2196 	struct pcn_softc *sc = device_private(self);
2197 
2198 	pcn_bcr_write(sc, LE_BCR33, reg | (phy << PHYAD_SHIFT));
2199 	pcn_bcr_write(sc, LE_BCR34, val);
2200 }
2201 
2202 /*
2203  * pcn_mii_statchg:	[mii interface function]
2204  *
2205  *	Callback from MII layer when media changes.
2206  */
2207 static void
2208 pcn_mii_statchg(device_t self)
2209 {
2210 	struct pcn_softc *sc = device_private(self);
2211 
2212 	if ((sc->sc_mii.mii_media_active & IFM_FDX) != 0)
2213 		pcn_bcr_write(sc, LE_BCR9, LE_B9_FDEN);
2214 	else
2215 		pcn_bcr_write(sc, LE_BCR9, 0);
2216 }
2217