xref: /openbsd-src/sys/dev/ic/re.c (revision 850e275390052b330d93020bf619a739a3c277ac)
1 /*	$OpenBSD: re.c,v 1.90 2008/09/10 14:01:22 blambert Exp $	*/
2 /*	$FreeBSD: if_re.c,v 1.31 2004/09/04 07:54:05 ru Exp $	*/
3 /*
4  * Copyright (c) 1997, 1998-2003
5  *	Bill Paul <wpaul@windriver.com>.  All rights reserved.
6  *
7  * Redistribution and use in source and binary forms, with or without
8  * modification, are permitted provided that the following conditions
9  * are met:
10  * 1. Redistributions of source code must retain the above copyright
11  *    notice, this list of conditions and the following disclaimer.
12  * 2. Redistributions in binary form must reproduce the above copyright
13  *    notice, this list of conditions and the following disclaimer in the
14  *    documentation and/or other materials provided with the distribution.
15  * 3. All advertising materials mentioning features or use of this software
16  *    must display the following acknowledgement:
17  *	This product includes software developed by Bill Paul.
18  * 4. Neither the name of the author nor the names of any co-contributors
19  *    may be used to endorse or promote products derived from this software
20  *    without specific prior written permission.
21  *
22  * THIS SOFTWARE IS PROVIDED BY Bill Paul AND CONTRIBUTORS ``AS IS'' AND
23  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
24  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
25  * ARE DISCLAIMED.  IN NO EVENT SHALL Bill Paul OR THE VOICES IN HIS HEAD
26  * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
27  * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
28  * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
29  * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
30  * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
31  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
32  * THE POSSIBILITY OF SUCH DAMAGE.
33  */
34 
35 /*
36  * RealTek 8139C+/8169/8169S/8110S PCI NIC driver
37  *
38  * Written by Bill Paul <wpaul@windriver.com>
39  * Senior Networking Software Engineer
40  * Wind River Systems
41  */
42 
43 /*
44  * This driver is designed to support RealTek's next generation of
45  * 10/100 and 10/100/1000 PCI ethernet controllers. There are currently
46  * seven devices in this family: the RTL8139C+, the RTL8169, the RTL8169S,
47  * RTL8110S, the RTL8168, the RTL8111 and the RTL8101E.
48  *
49  * The 8139C+ is a 10/100 ethernet chip. It is backwards compatible
50  * with the older 8139 family, however it also supports a special
51  * C+ mode of operation that provides several new performance enhancing
52  * features. These include:
53  *
54  *	o Descriptor based DMA mechanism. Each descriptor represents
55  *	  a single packet fragment. Data buffers may be aligned on
56  *	  any byte boundary.
57  *
58  *	o 64-bit DMA
59  *
60  *	o TCP/IP checksum offload for both RX and TX
61  *
62  *	o High and normal priority transmit DMA rings
63  *
64  *	o VLAN tag insertion and extraction
65  *
66  *	o TCP large send (segmentation offload)
67  *
68  * Like the 8139, the 8139C+ also has a built-in 10/100 PHY. The C+
69  * programming API is fairly straightforward. The RX filtering, EEPROM
70  * access and PHY access is the same as it is on the older 8139 series
71  * chips.
72  *
73  * The 8169 is a 64-bit 10/100/1000 gigabit ethernet MAC. It has almost the
74  * same programming API and feature set as the 8139C+ with the following
75  * differences and additions:
76  *
77  *	o 1000Mbps mode
78  *
79  *	o Jumbo frames
80  *
81  * 	o GMII and TBI ports/registers for interfacing with copper
82  *	  or fiber PHYs
83  *
84  *      o RX and TX DMA rings can have up to 1024 descriptors
85  *        (the 8139C+ allows a maximum of 64)
86  *
87  *	o Slight differences in register layout from the 8139C+
88  *
89  * The TX start and timer interrupt registers are at different locations
90  * on the 8169 than they are on the 8139C+. Also, the status word in the
91  * RX descriptor has a slightly different bit layout. The 8169 does not
92  * have a built-in PHY. Most reference boards use a Marvell 88E1000 'Alaska'
93  * copper gigE PHY.
94  *
95  * The 8169S/8110S 10/100/1000 devices have built-in copper gigE PHYs
96  * (the 'S' stands for 'single-chip'). These devices have the same
97  * programming API as the older 8169, but also have some vendor-specific
98  * registers for the on-board PHY. The 8110S is a LAN-on-motherboard
99  * part designed to be pin-compatible with the RealTek 8100 10/100 chip.
100  *
101  * This driver takes advantage of the RX and TX checksum offload and
102  * VLAN tag insertion/extraction features. It also implements TX
103  * interrupt moderation using the timer interrupt registers, which
104  * significantly reduces TX interrupt load. There is also support
105  * for jumbo frames, however the 8169/8169S/8110S can not transmit
106  * jumbo frames larger than 7440, so the max MTU possible with this
107  * driver is 7422 bytes.
108  */
109 
110 #include "bpfilter.h"
111 #include "vlan.h"
112 
113 #include <sys/param.h>
114 #include <sys/endian.h>
115 #include <sys/systm.h>
116 #include <sys/sockio.h>
117 #include <sys/mbuf.h>
118 #include <sys/malloc.h>
119 #include <sys/kernel.h>
120 #include <sys/device.h>
121 #include <sys/timeout.h>
122 #include <sys/socket.h>
123 
124 #include <net/if.h>
125 #include <net/if_dl.h>
126 #include <net/if_media.h>
127 
128 #ifdef INET
129 #include <netinet/in.h>
130 #include <netinet/in_systm.h>
131 #include <netinet/in_var.h>
132 #include <netinet/ip.h>
133 #include <netinet/if_ether.h>
134 #endif
135 
136 #if NVLAN > 0
137 #include <net/if_types.h>
138 #include <net/if_vlan_var.h>
139 #endif
140 
141 #if NBPFILTER > 0
142 #include <net/bpf.h>
143 #endif
144 
145 #include <dev/mii/mii.h>
146 #include <dev/mii/miivar.h>
147 
148 #include <dev/pci/pcireg.h>
149 #include <dev/pci/pcivar.h>
150 
151 #include <dev/ic/rtl81x9reg.h>
152 #include <dev/ic/revar.h>
153 
154 #ifdef RE_DEBUG
155 int redebug = 0;
156 #define DPRINTF(x)	do { if (redebug) printf x; } while (0)
157 #else
158 #define DPRINTF(x)
159 #endif
160 
161 static inline void re_set_bufaddr(struct rl_desc *, bus_addr_t);
162 
163 int	re_encap(struct rl_softc *, struct mbuf *, int *);
164 
165 int	re_newbuf(struct rl_softc *, int, struct mbuf *);
166 int	re_rx_list_init(struct rl_softc *);
167 int	re_tx_list_init(struct rl_softc *);
168 void	re_rxeof(struct rl_softc *);
169 void	re_txeof(struct rl_softc *);
170 void	re_tick(void *);
171 void	re_start(struct ifnet *);
172 int	re_ioctl(struct ifnet *, u_long, caddr_t);
173 void	re_watchdog(struct ifnet *);
174 int	re_ifmedia_upd(struct ifnet *);
175 void	re_ifmedia_sts(struct ifnet *, struct ifmediareq *);
176 
177 void	re_eeprom_putbyte(struct rl_softc *, int);
178 void	re_eeprom_getword(struct rl_softc *, int, u_int16_t *);
179 void	re_read_eeprom(struct rl_softc *, caddr_t, int, int);
180 
181 int	re_gmii_readreg(struct device *, int, int);
182 void	re_gmii_writereg(struct device *, int, int, int);
183 
184 int	re_miibus_readreg(struct device *, int, int);
185 void	re_miibus_writereg(struct device *, int, int, int);
186 void	re_miibus_statchg(struct device *);
187 
188 void	re_iff(struct rl_softc *);
189 void	re_reset(struct rl_softc *);
190 
191 #ifdef RE_DIAG
192 int	re_diag(struct rl_softc *);
193 #endif
194 
195 struct cfdriver re_cd = {
196 	0, "re", DV_IFNET
197 };
198 
199 #define EE_SET(x)					\
200 	CSR_WRITE_1(sc, RL_EECMD,			\
201 		CSR_READ_1(sc, RL_EECMD) | x)
202 
203 #define EE_CLR(x)					\
204 	CSR_WRITE_1(sc, RL_EECMD,			\
205 		CSR_READ_1(sc, RL_EECMD) & ~x)
206 
207 static const struct re_revision {
208 	u_int32_t		re_chipid;
209 	const char		*re_name;
210 } re_revisions[] = {
211 	{ RL_HWREV_8100,	"RTL8100" },
212 	{ RL_HWREV_8100E_SPIN1,	"RTL8100E 1" },
213 	{ RL_HWREV_8100E_SPIN2, "RTL8100E 2" },
214 	{ RL_HWREV_8101,	"RTL8101" },
215 	{ RL_HWREV_8101E,	"RTL8101E" },
216 	{ RL_HWREV_8102E,	"RTL8102E" },
217 	{ RL_HWREV_8102EL,	"RTL8102EL" },
218 	{ RL_HWREV_8110S,	"RTL8110S" },
219 	{ RL_HWREV_8139CPLUS,	"RTL8139C+" },
220 	{ RL_HWREV_8168_SPIN1,	"RTL8168 1" },
221 	{ RL_HWREV_8168_SPIN2,	"RTL8168 2" },
222 	{ RL_HWREV_8168_SPIN3,	"RTL8168 3" },
223 	{ RL_HWREV_8168C,	"RTL8168C/8111C" },
224 	{ RL_HWREV_8168C_SPIN2,	"RTL8168C/8111C" },
225 	{ RL_HWREV_8168CP,	"RTL8168CP/8111CP" },
226 	{ RL_HWREV_8169,	"RTL8169" },
227 	{ RL_HWREV_8169_8110SB,	"RTL8169/8110SB" },
228 	{ RL_HWREV_8169_8110SBL, "RTL8169SBL" },
229 	{ RL_HWREV_8169_8110SCd, "RTL8169/8110SCd" },
230 	{ RL_HWREV_8169_8110SCe, "RTL8169/8110SCe" },
231 	{ RL_HWREV_8169S,	"RTL8169S" },
232 
233 	{ 0, NULL }
234 };
235 
236 
237 static inline void
238 re_set_bufaddr(struct rl_desc *d, bus_addr_t addr)
239 {
240 	d->rl_bufaddr_lo = htole32((uint32_t)addr);
241 	if (sizeof(bus_addr_t) == sizeof(uint64_t))
242 		d->rl_bufaddr_hi = htole32((uint64_t)addr >> 32);
243 	else
244 		d->rl_bufaddr_hi = 0;
245 }
246 
247 /*
248  * Send a read command and address to the EEPROM, check for ACK.
249  */
250 void
251 re_eeprom_putbyte(struct rl_softc *sc, int addr)
252 {
253 	int	d, i;
254 
255 	d = addr | (RL_9346_READ << sc->rl_eewidth);
256 
257 	/*
258 	 * Feed in each bit and strobe the clock.
259 	 */
260 
261 	for (i = 1 << (sc->rl_eewidth + 3); i; i >>= 1) {
262 		if (d & i)
263 			EE_SET(RL_EE_DATAIN);
264 		else
265 			EE_CLR(RL_EE_DATAIN);
266 		DELAY(100);
267 		EE_SET(RL_EE_CLK);
268 		DELAY(150);
269 		EE_CLR(RL_EE_CLK);
270 		DELAY(100);
271 	}
272 }
273 
274 /*
275  * Read a word of data stored in the EEPROM at address 'addr.'
276  */
277 void
278 re_eeprom_getword(struct rl_softc *sc, int addr, u_int16_t *dest)
279 {
280 	int		i;
281 	u_int16_t	word = 0;
282 
283 	/*
284 	 * Send address of word we want to read.
285 	 */
286 	re_eeprom_putbyte(sc, addr);
287 
288 	/*
289 	 * Start reading bits from EEPROM.
290 	 */
291 	for (i = 0x8000; i; i >>= 1) {
292 		EE_SET(RL_EE_CLK);
293 		DELAY(100);
294 		if (CSR_READ_1(sc, RL_EECMD) & RL_EE_DATAOUT)
295 			word |= i;
296 		EE_CLR(RL_EE_CLK);
297 		DELAY(100);
298 	}
299 
300 	*dest = word;
301 }
302 
303 /*
304  * Read a sequence of words from the EEPROM.
305  */
306 void
307 re_read_eeprom(struct rl_softc *sc, caddr_t dest, int off, int cnt)
308 {
309 	int		i;
310 	u_int16_t	word = 0, *ptr;
311 
312 	CSR_SETBIT_1(sc, RL_EECMD, RL_EEMODE_PROGRAM);
313 
314 	DELAY(100);
315 
316 	for (i = 0; i < cnt; i++) {
317 		CSR_SETBIT_1(sc, RL_EECMD, RL_EE_SEL);
318 		re_eeprom_getword(sc, off + i, &word);
319 		CSR_CLRBIT_1(sc, RL_EECMD, RL_EE_SEL);
320 		ptr = (u_int16_t *)(dest + (i * 2));
321 		*ptr = word;
322 	}
323 
324 	CSR_CLRBIT_1(sc, RL_EECMD, RL_EEMODE_PROGRAM);
325 }
326 
327 int
328 re_gmii_readreg(struct device *self, int phy, int reg)
329 {
330 	struct rl_softc	*sc = (struct rl_softc *)self;
331 	u_int32_t	rval;
332 	int		i;
333 
334 	if (phy != 7)
335 		return (0);
336 
337 	/* Let the rgephy driver read the GMEDIASTAT register */
338 
339 	if (reg == RL_GMEDIASTAT) {
340 		rval = CSR_READ_1(sc, RL_GMEDIASTAT);
341 		return (rval);
342 	}
343 
344 	CSR_WRITE_4(sc, RL_PHYAR, reg << 16);
345 	DELAY(1000);
346 
347 	for (i = 0; i < RL_TIMEOUT; i++) {
348 		rval = CSR_READ_4(sc, RL_PHYAR);
349 		if (rval & RL_PHYAR_BUSY)
350 			break;
351 		DELAY(100);
352 	}
353 
354 	if (i == RL_TIMEOUT) {
355 		printf ("%s: PHY read failed\n", sc->sc_dev.dv_xname);
356 		return (0);
357 	}
358 
359 	return (rval & RL_PHYAR_PHYDATA);
360 }
361 
362 void
363 re_gmii_writereg(struct device *dev, int phy, int reg, int data)
364 {
365 	struct rl_softc	*sc = (struct rl_softc *)dev;
366 	u_int32_t	rval;
367 	int		i;
368 
369 	CSR_WRITE_4(sc, RL_PHYAR, (reg << 16) |
370 	    (data & RL_PHYAR_PHYDATA) | RL_PHYAR_BUSY);
371 	DELAY(1000);
372 
373 	for (i = 0; i < RL_TIMEOUT; i++) {
374 		rval = CSR_READ_4(sc, RL_PHYAR);
375 		if (!(rval & RL_PHYAR_BUSY))
376 			break;
377 		DELAY(100);
378 	}
379 
380 	if (i == RL_TIMEOUT)
381 		printf ("%s: PHY write failed\n", sc->sc_dev.dv_xname);
382 }
383 
384 int
385 re_miibus_readreg(struct device *dev, int phy, int reg)
386 {
387 	struct rl_softc	*sc = (struct rl_softc *)dev;
388 	u_int16_t	rval = 0;
389 	u_int16_t	re8139_reg = 0;
390 	int		s;
391 
392 	s = splnet();
393 
394 	if (sc->sc_hwrev != RL_HWREV_8139CPLUS) {
395 		rval = re_gmii_readreg(dev, phy, reg);
396 		splx(s);
397 		return (rval);
398 	}
399 
400 	/* Pretend the internal PHY is only at address 0 */
401 	if (phy) {
402 		splx(s);
403 		return (0);
404 	}
405 	switch(reg) {
406 	case MII_BMCR:
407 		re8139_reg = RL_BMCR;
408 		break;
409 	case MII_BMSR:
410 		re8139_reg = RL_BMSR;
411 		break;
412 	case MII_ANAR:
413 		re8139_reg = RL_ANAR;
414 		break;
415 	case MII_ANER:
416 		re8139_reg = RL_ANER;
417 		break;
418 	case MII_ANLPAR:
419 		re8139_reg = RL_LPAR;
420 		break;
421 	case MII_PHYIDR1:
422 	case MII_PHYIDR2:
423 		splx(s);
424 		return (0);
425 	/*
426 	 * Allow the rlphy driver to read the media status
427 	 * register. If we have a link partner which does not
428 	 * support NWAY, this is the register which will tell
429 	 * us the results of parallel detection.
430 	 */
431 	case RL_MEDIASTAT:
432 		rval = CSR_READ_1(sc, RL_MEDIASTAT);
433 		splx(s);
434 		return (rval);
435 	default:
436 		printf("%s: bad phy register %x\n", sc->sc_dev.dv_xname, reg);
437 		splx(s);
438 		return (0);
439 	}
440 	rval = CSR_READ_2(sc, re8139_reg);
441 	if (re8139_reg == RL_BMCR) {
442 		/* 8139C+ has different bit layout. */
443 		rval &= ~(BMCR_LOOP | BMCR_ISO);
444 	}
445 	splx(s);
446 	return (rval);
447 }
448 
449 void
450 re_miibus_writereg(struct device *dev, int phy, int reg, int data)
451 {
452 	struct rl_softc	*sc = (struct rl_softc *)dev;
453 	u_int16_t	re8139_reg = 0;
454 	int		s;
455 
456 	s = splnet();
457 
458 	if (sc->sc_hwrev != RL_HWREV_8139CPLUS) {
459 		re_gmii_writereg(dev, phy, reg, data);
460 		splx(s);
461 		return;
462 	}
463 
464 	/* Pretend the internal PHY is only at address 0 */
465 	if (phy) {
466 		splx(s);
467 		return;
468 	}
469 	switch(reg) {
470 	case MII_BMCR:
471 		re8139_reg = RL_BMCR;
472 		/* 8139C+ has different bit layout. */
473 		data &= ~(BMCR_LOOP | BMCR_ISO);
474 		break;
475 	case MII_BMSR:
476 		re8139_reg = RL_BMSR;
477 		break;
478 	case MII_ANAR:
479 		re8139_reg = RL_ANAR;
480 		break;
481 	case MII_ANER:
482 		re8139_reg = RL_ANER;
483 		break;
484 	case MII_ANLPAR:
485 		re8139_reg = RL_LPAR;
486 		break;
487 	case MII_PHYIDR1:
488 	case MII_PHYIDR2:
489 		splx(s);
490 		return;
491 		break;
492 	default:
493 		printf("%s: bad phy register %x\n", sc->sc_dev.dv_xname, reg);
494 		splx(s);
495 		return;
496 	}
497 	CSR_WRITE_2(sc, re8139_reg, data);
498 	splx(s);
499 }
500 
501 void
502 re_miibus_statchg(struct device *dev)
503 {
504 }
505 
506 void
507 re_iff(struct rl_softc *sc)
508 {
509 	struct ifnet		*ifp = &sc->sc_arpcom.ac_if;
510 	int			h = 0;
511 	u_int32_t		hashes[2] = { 0, 0 };
512 	u_int32_t		rxfilt;
513 	int			mcnt = 0;
514 	struct arpcom		*ac = &sc->sc_arpcom;
515 	struct ether_multi	*enm;
516 	struct ether_multistep	step;
517 
518 	rxfilt = CSR_READ_4(sc, RL_RXCFG);
519 	rxfilt &= ~(RL_RXCFG_RX_ALLPHYS | RL_RXCFG_RX_MULTI);
520 	ifp->if_flags &= ~IFF_ALLMULTI;
521 
522 	if (ifp->if_flags & IFF_PROMISC ||
523 	    ac->ac_multirangecnt > 0) {
524 		ifp ->if_flags |= IFF_ALLMULTI;
525 		rxfilt |= RL_RXCFG_RX_MULTI;
526 		if (ifp->if_flags & IFF_PROMISC)
527 			rxfilt |= RL_RXCFG_RX_ALLPHYS;
528 		hashes[0] = hashes[1] = 0xFFFFFFFF;
529 	} else {
530 		/* first, zot all the existing hash bits */
531 		CSR_WRITE_4(sc, RL_MAR0, 0);
532 		CSR_WRITE_4(sc, RL_MAR4, 0);
533 
534 		/* now program new ones */
535 		ETHER_FIRST_MULTI(step, ac, enm);
536 		while (enm != NULL) {
537 			h = ether_crc32_be(enm->enm_addrlo,
538 			    ETHER_ADDR_LEN) >> 26;
539 			if (h < 32)
540 				hashes[0] |= (1 << h);
541 			else
542 				hashes[1] |= (1 << (h - 32));
543 			mcnt++;
544 			ETHER_NEXT_MULTI(step, enm);
545 		}
546 
547 		if (mcnt)
548 			rxfilt |= RL_RXCFG_RX_MULTI;
549 	}
550 
551 	/*
552 	 * For some unfathomable reason, RealTek decided to reverse
553 	 * the order of the multicast hash registers in the PCI Express
554 	 * parts. This means we have to write the hash pattern in reverse
555 	 * order for those devices.
556 	 */
557 	if (sc->rl_flags & RL_FLAG_INVMAR) {
558 		CSR_WRITE_4(sc, RL_MAR0, swap32(hashes[1]));
559 		CSR_WRITE_4(sc, RL_MAR4, swap32(hashes[0]));
560 	} else {
561 		CSR_WRITE_4(sc, RL_MAR0, hashes[0]);
562 		CSR_WRITE_4(sc, RL_MAR4, hashes[1]);
563 	}
564 
565 	CSR_WRITE_4(sc, RL_RXCFG, rxfilt);
566 }
567 
568 void
569 re_reset(struct rl_softc *sc)
570 {
571 	int	i;
572 
573 	CSR_WRITE_1(sc, RL_COMMAND, RL_CMD_RESET);
574 
575 	for (i = 0; i < RL_TIMEOUT; i++) {
576 		DELAY(10);
577 		if (!(CSR_READ_1(sc, RL_COMMAND) & RL_CMD_RESET))
578 			break;
579 	}
580 	if (i == RL_TIMEOUT)
581 		printf("%s: reset never completed!\n", sc->sc_dev.dv_xname);
582 
583 	CSR_WRITE_1(sc, RL_LDPS, 1);
584 }
585 
586 #ifdef RE_DIAG
587 
588 /*
589  * The following routine is designed to test for a defect on some
590  * 32-bit 8169 cards. Some of these NICs have the REQ64# and ACK64#
591  * lines connected to the bus, however for a 32-bit only card, they
592  * should be pulled high. The result of this defect is that the
593  * NIC will not work right if you plug it into a 64-bit slot: DMA
594  * operations will be done with 64-bit transfers, which will fail
595  * because the 64-bit data lines aren't connected.
596  *
597  * There's no way to work around this (short of talking a soldering
598  * iron to the board), however we can detect it. The method we use
599  * here is to put the NIC into digital loopback mode, set the receiver
600  * to promiscuous mode, and then try to send a frame. We then compare
601  * the frame data we sent to what was received. If the data matches,
602  * then the NIC is working correctly, otherwise we know the user has
603  * a defective NIC which has been mistakenly plugged into a 64-bit PCI
604  * slot. In the latter case, there's no way the NIC can work correctly,
605  * so we print out a message on the console and abort the device attach.
606  */
607 
608 int
609 re_diag(struct rl_softc *sc)
610 {
611 	struct ifnet		*ifp = &sc->sc_arpcom.ac_if;
612 	struct mbuf		*m0;
613 	struct ether_header	*eh;
614 	struct rl_rxsoft	*rxs;
615 	struct rl_desc		*cur_rx;
616 	bus_dmamap_t		dmamap;
617 	u_int16_t		status;
618 	u_int32_t		rxstat;
619 	int			total_len, i, s, error = 0, phyaddr;
620 	u_int8_t		dst[] = { 0x00, 'h', 'e', 'l', 'l', 'o' };
621 	u_int8_t		src[] = { 0x00, 'w', 'o', 'r', 'l', 'd' };
622 
623 	DPRINTF(("inside re_diag\n"));
624 	/* Allocate a single mbuf */
625 
626 	MGETHDR(m0, M_DONTWAIT, MT_DATA);
627 	if (m0 == NULL)
628 		return (ENOBUFS);
629 
630 	/*
631 	 * Initialize the NIC in test mode. This sets the chip up
632 	 * so that it can send and receive frames, but performs the
633 	 * following special functions:
634 	 * - Puts receiver in promiscuous mode
635 	 * - Enables digital loopback mode
636 	 * - Leaves interrupts turned off
637 	 */
638 
639 	ifp->if_flags |= IFF_PROMISC;
640 	sc->rl_testmode = 1;
641 	re_reset(sc);
642 	re_init(ifp);
643 	sc->rl_flags |= RL_FLAG_LINK;
644 	if (sc->sc_hwrev == RL_HWREV_8139CPLUS)
645 		phyaddr = 0;
646 	else
647 		phyaddr = 1;
648 
649 	re_miibus_writereg((struct device *)sc, phyaddr, MII_BMCR,
650 	    BMCR_RESET);
651 	for (i = 0; i < RL_TIMEOUT; i++) {
652 		status = re_miibus_readreg((struct device *)sc,
653 		    phyaddr, MII_BMCR);
654 		if (!(status & BMCR_RESET))
655 			break;
656 	}
657 
658 	re_miibus_writereg((struct device *)sc, phyaddr, MII_BMCR,
659 	    BMCR_LOOP);
660 	CSR_WRITE_2(sc, RL_ISR, RL_INTRS);
661 
662 	DELAY(100000);
663 
664 	/* Put some data in the mbuf */
665 
666 	eh = mtod(m0, struct ether_header *);
667 	bcopy ((char *)&dst, eh->ether_dhost, ETHER_ADDR_LEN);
668 	bcopy ((char *)&src, eh->ether_shost, ETHER_ADDR_LEN);
669 	eh->ether_type = htons(ETHERTYPE_IP);
670 	m0->m_pkthdr.len = m0->m_len = ETHER_MIN_LEN - ETHER_CRC_LEN;
671 
672 	/*
673 	 * Queue the packet, start transmission.
674 	 */
675 
676 	CSR_WRITE_2(sc, RL_ISR, 0xFFFF);
677 	s = splnet();
678 	IFQ_ENQUEUE(&ifp->if_snd, m0, NULL, error);
679 	re_start(ifp);
680 	splx(s);
681 	m0 = NULL;
682 
683 	DPRINTF(("re_diag: transmission started\n"));
684 
685 	/* Wait for it to propagate through the chip */
686 
687 	DELAY(100000);
688 	for (i = 0; i < RL_TIMEOUT; i++) {
689 		status = CSR_READ_2(sc, RL_ISR);
690 		CSR_WRITE_2(sc, RL_ISR, status);
691 		if ((status & (RL_ISR_TIMEOUT_EXPIRED|RL_ISR_RX_OK)) ==
692 		    (RL_ISR_TIMEOUT_EXPIRED|RL_ISR_RX_OK))
693 			break;
694 		DELAY(10);
695 	}
696 	if (i == RL_TIMEOUT) {
697 		printf("%s: diagnostic failed, failed to receive packet "
698 		    "in loopback mode\n", sc->sc_dev.dv_xname);
699 		error = EIO;
700 		goto done;
701 	}
702 
703 	/*
704 	 * The packet should have been dumped into the first
705 	 * entry in the RX DMA ring. Grab it from there.
706 	 */
707 
708 	rxs = &sc->rl_ldata.rl_rxsoft[0];
709 	dmamap = rxs->rxs_dmamap;
710 	bus_dmamap_sync(sc->sc_dmat, dmamap, 0, dmamap->dm_mapsize,
711 	    BUS_DMASYNC_POSTREAD);
712 	bus_dmamap_unload(sc->sc_dmat, dmamap);
713 
714 	m0 = rxs->rxs_mbuf;
715 	rxs->rxs_mbuf = NULL;
716 	eh = mtod(m0, struct ether_header *);
717 
718 	RL_RXDESCSYNC(sc, 0, BUS_DMASYNC_POSTREAD|BUS_DMASYNC_POSTWRITE);
719 	cur_rx = &sc->rl_ldata.rl_rx_list[0];
720 	rxstat = letoh32(cur_rx->rl_cmdstat);
721 	total_len = rxstat & sc->rl_rxlenmask;
722 
723 	if (total_len != ETHER_MIN_LEN) {
724 		printf("%s: diagnostic failed, received short packet\n",
725 		    sc->sc_dev.dv_xname);
726 		error = EIO;
727 		goto done;
728 	}
729 
730 	DPRINTF(("re_diag: packet received\n"));
731 
732 	/* Test that the received packet data matches what we sent. */
733 
734 	if (bcmp((char *)&eh->ether_dhost, (char *)&dst, ETHER_ADDR_LEN) ||
735 	    bcmp((char *)&eh->ether_shost, (char *)&src, ETHER_ADDR_LEN) ||
736 	    ntohs(eh->ether_type) != ETHERTYPE_IP) {
737 		printf("%s: WARNING, DMA FAILURE!\n", sc->sc_dev.dv_xname);
738 		printf("%s: expected TX data: %s",
739 		    sc->sc_dev.dv_xname, ether_sprintf(dst));
740 		printf("/%s/0x%x\n", ether_sprintf(src), ETHERTYPE_IP);
741 		printf("%s: received RX data: %s",
742 		    sc->sc_dev.dv_xname,
743 		    ether_sprintf(eh->ether_dhost));
744 		printf("/%s/0x%x\n", ether_sprintf(eh->ether_shost),
745 		    ntohs(eh->ether_type));
746 		printf("%s: You may have a defective 32-bit NIC plugged "
747 		    "into a 64-bit PCI slot.\n", sc->sc_dev.dv_xname);
748 		printf("%s: Please re-install the NIC in a 32-bit slot "
749 		    "for proper operation.\n", sc->sc_dev.dv_xname);
750 		printf("%s: Read the re(4) man page for more details.\n",
751 		    sc->sc_dev.dv_xname);
752 		error = EIO;
753 	}
754 
755 done:
756 	/* Turn interface off, release resources */
757 	sc->rl_testmode = 0;
758 	sc->rl_flags &= ~RL_FLAG_LINK;
759 	ifp->if_flags &= ~IFF_PROMISC;
760 	re_stop(ifp, 1);
761 	if (m0 != NULL)
762 		m_freem(m0);
763 	DPRINTF(("leaving re_diag\n"));
764 
765 	return (error);
766 }
767 
768 #endif
769 
770 #ifdef __armish__
771 /*
772  * Thecus N2100 doesn't store the full mac address in eeprom
773  * so we read the old mac address from the device before the reset
774  * in hopes that the proper mac address is already there.
775  */
776 union {
777 	u_int32_t eaddr_word[2];
778 	u_char eaddr[ETHER_ADDR_LEN];
779 } boot_eaddr;
780 int boot_eaddr_valid;
781 #endif /* __armish__ */
782 /*
783  * Attach the interface. Allocate softc structures, do ifmedia
784  * setup and ethernet/BPF attach.
785  */
786 int
787 re_attach(struct rl_softc *sc, const char *intrstr)
788 {
789 	u_char		eaddr[ETHER_ADDR_LEN];
790 	u_int16_t	as[ETHER_ADDR_LEN / 2];
791 	struct ifnet	*ifp;
792 	u_int16_t	re_did = 0;
793 	int		error = 0, i;
794 	const struct re_revision *rr;
795 	const char	*re_name = NULL;
796 
797 	/* Reset the adapter. */
798 	re_reset(sc);
799 
800 	sc->sc_hwrev = CSR_READ_4(sc, RL_TXCFG) & RL_TXCFG_HWREV;
801 
802 	switch (sc->sc_hwrev) {
803 	case RL_HWREV_8139CPLUS:
804 		sc->rl_flags |= RL_FLAG_NOJUMBO;
805 		break;
806 	case RL_HWREV_8100E_SPIN1:
807 	case RL_HWREV_8100E_SPIN2:
808 	case RL_HWREV_8101E:
809 		sc->rl_flags |= RL_FLAG_NOJUMBO | RL_FLAG_INVMAR |
810 		    RL_FLAG_PHYWAKE;
811 		break;
812 	case RL_HWREV_8102E:
813 	case RL_HWREV_8102EL:
814 		sc->rl_flags |= RL_FLAG_NOJUMBO | RL_FLAG_INVMAR |
815 		    RL_FLAG_PHYWAKE | RL_FLAG_PAR | RL_FLAG_DESCV2 |
816 		    RL_FLAG_MACSTAT;
817 		break;
818 	case RL_HWREV_8168_SPIN1:
819 	case RL_HWREV_8168_SPIN2:
820 	case RL_HWREV_8168_SPIN3:
821 		sc->rl_flags |= RL_FLAG_INVMAR | RL_FLAG_PHYWAKE |
822 		    RL_FLAG_MACSTAT;
823 		break;
824 	case RL_HWREV_8168C:
825 	case RL_HWREV_8168C_SPIN2:
826 	case RL_HWREV_8168CP:
827 		sc->rl_flags |= RL_FLAG_INVMAR | RL_FLAG_PHYWAKE |
828 		    RL_FLAG_PAR | RL_FLAG_DESCV2 | RL_FLAG_MACSTAT;
829 		/*
830 		 * These controllers support jumbo frame but it seems
831 		 * that enabling it requires touching additional magic
832 		 * registers. Depending on MAC revisions some
833 		 * controllers need to disable checksum offload. So
834 		 * disable jumbo frame until I have better idea what
835 		 * it really requires to make it support.
836 		 * RTL8168C/CP : supports up to 6KB jumbo frame.
837 		 * RTL8111C/CP : supports up to 9KB jumbo frame.
838 		 */
839 		sc->rl_flags |= RL_FLAG_NOJUMBO;
840 		break;
841 	case RL_HWREV_8169_8110SB:
842 	case RL_HWREV_8169_8110SBL:
843 	case RL_HWREV_8169_8110SCd:
844 	case RL_HWREV_8169_8110SCe:
845 		sc->rl_flags |= RL_FLAG_PHYWAKE;
846 		break;
847 	default:
848 		break;
849 	}
850 
851 	if (sc->rl_flags & RL_FLAG_PAR) {
852 		/*
853 		 * XXX Should have a better way to extract station
854 		 * address from EEPROM.
855 		 */
856 		for (i = 0; i < ETHER_ADDR_LEN; i++)
857 			eaddr[i] = CSR_READ_1(sc, RL_IDR0 + i);
858 	} else {
859 		sc->rl_eewidth = RL_9356_ADDR_LEN;
860 		re_read_eeprom(sc, (caddr_t)&re_did, 0, 1);
861 		if (re_did != 0x8129)
862 			sc->rl_eewidth = RL_9346_ADDR_LEN;
863 
864 		/*
865 		 * Get station address from the EEPROM.
866 		 */
867 		re_read_eeprom(sc, (caddr_t)as, RL_EE_EADDR, 3);
868 		for (i = 0; i < ETHER_ADDR_LEN / 2; i++)
869 			as[i] = letoh16(as[i]);
870 		bcopy(as, eaddr, sizeof(eaddr));
871 
872 #ifdef __armish__
873 		/*
874 		 * On the Thecus N2100, the MAC address in the EEPROM is
875 		 * always 00:14:fd:10:00:00.  The proper MAC address is
876 		 * stored in flash.  Fortunately RedBoot configures the
877 		 * proper MAC address (for the first onboard interface)
878 		 * which we can read from the IDR.
879 		 */
880 		if (eaddr[0] == 0x00 && eaddr[1] == 0x14 &&
881 		    eaddr[2] == 0xfd && eaddr[3] == 0x10 &&
882 		    eaddr[4] == 0x00 && eaddr[5] == 0x00) {
883 			if (boot_eaddr_valid == 0) {
884 				boot_eaddr.eaddr_word[1] =
885 				    letoh32(CSR_READ_4(sc, RL_IDR4));
886 				boot_eaddr.eaddr_word[0] =
887 				    letoh32(CSR_READ_4(sc, RL_IDR0));
888 				boot_eaddr_valid = 1;
889 			}
890 
891 			bcopy(boot_eaddr.eaddr, eaddr, sizeof(eaddr));
892 			eaddr[5] += sc->sc_dev.dv_unit;
893 		}
894 #endif
895 	}
896 
897 	/*
898 	 * Set RX length mask, TX poll request register
899 	 * and TX descriptor count.
900 	 */
901 	if (sc->sc_hwrev == RL_HWREV_8139CPLUS) {
902 		sc->rl_rxlenmask = RL_RDESC_STAT_FRAGLEN;
903 		sc->rl_txstart = RL_TXSTART;
904 		sc->rl_ldata.rl_tx_desc_cnt = RL_TX_DESC_CNT_8139;
905 	} else {
906 		sc->rl_rxlenmask = RL_RDESC_STAT_GFRAGLEN;
907 		sc->rl_txstart = RL_GTXSTART;
908 		sc->rl_ldata.rl_tx_desc_cnt = RL_TX_DESC_CNT_8169;
909 	}
910 
911 	bcopy(eaddr, (char *)&sc->sc_arpcom.ac_enaddr, ETHER_ADDR_LEN);
912 
913 	for (rr = re_revisions; rr->re_name != NULL; rr++) {
914 		if (rr->re_chipid == sc->sc_hwrev)
915 			re_name = rr->re_name;
916 	}
917 
918 	if (re_name == NULL)
919 		printf(": unknown ASIC (0x%04x)", sc->sc_hwrev >> 16);
920 	else
921 		printf(": %s (0x%04x)", re_name, sc->sc_hwrev >> 16);
922 
923 	printf(", %s, address %s\n", intrstr,
924 	    ether_sprintf(sc->sc_arpcom.ac_enaddr));
925 
926 	if (sc->rl_ldata.rl_tx_desc_cnt >
927 	    PAGE_SIZE / sizeof(struct rl_desc)) {
928 		sc->rl_ldata.rl_tx_desc_cnt =
929 		    PAGE_SIZE / sizeof(struct rl_desc);
930 	}
931 
932 	/* Allocate DMA'able memory for the TX ring */
933 	if ((error = bus_dmamem_alloc(sc->sc_dmat, RL_TX_LIST_SZ(sc),
934 		    RL_RING_ALIGN, 0, &sc->rl_ldata.rl_tx_listseg, 1,
935 		    &sc->rl_ldata.rl_tx_listnseg, BUS_DMA_NOWAIT)) != 0) {
936 		printf("%s: can't allocate tx listseg, error = %d\n",
937 		    sc->sc_dev.dv_xname, error);
938 		goto fail_0;
939 	}
940 
941 	/* Load the map for the TX ring. */
942 	if ((error = bus_dmamem_map(sc->sc_dmat, &sc->rl_ldata.rl_tx_listseg,
943 		    sc->rl_ldata.rl_tx_listnseg, RL_TX_LIST_SZ(sc),
944 		    (caddr_t *)&sc->rl_ldata.rl_tx_list,
945 		    BUS_DMA_COHERENT | BUS_DMA_NOWAIT)) != 0) {
946 		printf("%s: can't map tx list, error = %d\n",
947 		    sc->sc_dev.dv_xname, error);
948 		goto fail_1;
949 	}
950 	memset(sc->rl_ldata.rl_tx_list, 0, RL_TX_LIST_SZ(sc));
951 
952 	if ((error = bus_dmamap_create(sc->sc_dmat, RL_TX_LIST_SZ(sc), 1,
953 		    RL_TX_LIST_SZ(sc), 0, 0,
954 		    &sc->rl_ldata.rl_tx_list_map)) != 0) {
955 		printf("%s: can't create tx list map, error = %d\n",
956 		    sc->sc_dev.dv_xname, error);
957 		goto fail_2;
958 	}
959 
960 	if ((error = bus_dmamap_load(sc->sc_dmat,
961 		    sc->rl_ldata.rl_tx_list_map, sc->rl_ldata.rl_tx_list,
962 		    RL_TX_LIST_SZ(sc), NULL, BUS_DMA_NOWAIT)) != 0) {
963 		printf("%s: can't load tx list, error = %d\n",
964 		    sc->sc_dev.dv_xname, error);
965 		goto fail_3;
966 	}
967 
968 	/* Create DMA maps for TX buffers */
969 	for (i = 0; i < RL_TX_QLEN; i++) {
970 		error = bus_dmamap_create(sc->sc_dmat,
971 		    RL_JUMBO_FRAMELEN,
972 		    RL_TX_DESC_CNT(sc) - RL_NTXDESC_RSVD, RL_TDESC_CMD_FRAGLEN,
973 		    0, 0, &sc->rl_ldata.rl_txq[i].txq_dmamap);
974 		if (error) {
975 			printf("%s: can't create DMA map for TX\n",
976 			    sc->sc_dev.dv_xname);
977 			goto fail_4;
978 		}
979 	}
980 
981         /* Allocate DMA'able memory for the RX ring */
982 	if ((error = bus_dmamem_alloc(sc->sc_dmat, RL_RX_DMAMEM_SZ,
983 		    RL_RING_ALIGN, 0, &sc->rl_ldata.rl_rx_listseg, 1,
984 		    &sc->rl_ldata.rl_rx_listnseg, BUS_DMA_NOWAIT)) != 0) {
985 		printf("%s: can't allocate rx listnseg, error = %d\n",
986 		    sc->sc_dev.dv_xname, error);
987 		goto fail_4;
988 	}
989 
990         /* Load the map for the RX ring. */
991 	if ((error = bus_dmamem_map(sc->sc_dmat, &sc->rl_ldata.rl_rx_listseg,
992 		    sc->rl_ldata.rl_rx_listnseg, RL_RX_DMAMEM_SZ,
993 		    (caddr_t *)&sc->rl_ldata.rl_rx_list,
994 		    BUS_DMA_COHERENT | BUS_DMA_NOWAIT)) != 0) {
995 		printf("%s: can't map rx list, error = %d\n",
996 		    sc->sc_dev.dv_xname, error);
997 		goto fail_5;
998 
999 	}
1000 	memset(sc->rl_ldata.rl_rx_list, 0, RL_RX_DMAMEM_SZ);
1001 
1002 	if ((error = bus_dmamap_create(sc->sc_dmat, RL_RX_DMAMEM_SZ, 1,
1003 		    RL_RX_DMAMEM_SZ, 0, 0,
1004 		    &sc->rl_ldata.rl_rx_list_map)) != 0) {
1005 		printf("%s: can't create rx list map, error = %d\n",
1006 		    sc->sc_dev.dv_xname, error);
1007 		goto fail_6;
1008 	}
1009 
1010 	if ((error = bus_dmamap_load(sc->sc_dmat,
1011 		    sc->rl_ldata.rl_rx_list_map, sc->rl_ldata.rl_rx_list,
1012 		    RL_RX_DMAMEM_SZ, NULL, BUS_DMA_NOWAIT)) != 0) {
1013 		printf("%s: can't load rx list, error = %d\n",
1014 		    sc->sc_dev.dv_xname, error);
1015 		goto fail_7;
1016 	}
1017 
1018         /* Create DMA maps for RX buffers */
1019         for (i = 0; i < RL_RX_DESC_CNT; i++) {
1020                 error = bus_dmamap_create(sc->sc_dmat, MCLBYTES, 1, MCLBYTES,
1021                     0, 0, &sc->rl_ldata.rl_rxsoft[i].rxs_dmamap);
1022                 if (error) {
1023                         printf("%s: can't create DMA map for RX\n",
1024                             sc->sc_dev.dv_xname);
1025 			goto fail_8;
1026                 }
1027         }
1028 
1029 	ifp = &sc->sc_arpcom.ac_if;
1030 	ifp->if_softc = sc;
1031 	strlcpy(ifp->if_xname, sc->sc_dev.dv_xname, IFNAMSIZ);
1032 	ifp->if_flags = IFF_BROADCAST | IFF_SIMPLEX | IFF_MULTICAST;
1033 	ifp->if_ioctl = re_ioctl;
1034 	ifp->if_start = re_start;
1035 	ifp->if_watchdog = re_watchdog;
1036 	ifp->if_init = re_init;
1037 	if ((sc->rl_flags & RL_FLAG_NOJUMBO) == 0)
1038 		ifp->if_hardmtu = RL_JUMBO_MTU;
1039 	IFQ_SET_MAXLEN(&ifp->if_snd, RL_TX_QLEN);
1040 	IFQ_SET_READY(&ifp->if_snd);
1041 
1042 	ifp->if_capabilities = IFCAP_VLAN_MTU | IFCAP_CSUM_IPv4 |
1043 			       IFCAP_CSUM_TCPv4 | IFCAP_CSUM_UDPv4;
1044 
1045 #if NVLAN > 0
1046 	ifp->if_capabilities |= IFCAP_VLAN_HWTAGGING;
1047 #endif
1048 
1049 	timeout_set(&sc->timer_handle, re_tick, sc);
1050 
1051 	/* Take PHY out of power down mode. */
1052 	if (sc->rl_flags & RL_FLAG_PHYWAKE) {
1053 		re_gmii_writereg((struct device *)sc, 1, 0x1f, 0);
1054 		re_gmii_writereg((struct device *)sc, 1, 0x0e, 0);
1055 	}
1056 
1057 	/* Do MII setup */
1058 	sc->sc_mii.mii_ifp = ifp;
1059 	sc->sc_mii.mii_readreg = re_miibus_readreg;
1060 	sc->sc_mii.mii_writereg = re_miibus_writereg;
1061 	sc->sc_mii.mii_statchg = re_miibus_statchg;
1062 	ifmedia_init(&sc->sc_mii.mii_media, IFM_IMASK, re_ifmedia_upd,
1063 	    re_ifmedia_sts);
1064 	mii_attach(&sc->sc_dev, &sc->sc_mii, 0xffffffff, MII_PHY_ANY,
1065 	    MII_OFFSET_ANY, MIIF_DOPAUSE);
1066 	if (LIST_FIRST(&sc->sc_mii.mii_phys) == NULL) {
1067 		printf("%s: no PHY found!\n", sc->sc_dev.dv_xname);
1068 		ifmedia_add(&sc->sc_mii.mii_media,
1069 		    IFM_ETHER|IFM_NONE, 0, NULL);
1070 		ifmedia_set(&sc->sc_mii.mii_media,
1071 		    IFM_ETHER|IFM_NONE);
1072 	} else
1073 		ifmedia_set(&sc->sc_mii.mii_media, IFM_ETHER|IFM_AUTO);
1074 
1075 	/*
1076 	 * Call MI attach routine.
1077 	 */
1078 	re_reset(sc);
1079 	if_attach(ifp);
1080 	ether_ifattach(ifp);
1081 
1082 #ifdef RE_DIAG
1083 	/*
1084 	 * Perform hardware diagnostic on the original RTL8169.
1085 	 * Some 32-bit cards were incorrectly wired and would
1086 	 * malfunction if plugged into a 64-bit slot.
1087 	 */
1088 	if (sc->sc_hwrev == RL_HWREV_8169) {
1089 		error = re_diag(sc);
1090 		if (error) {
1091 			printf("%s: attach aborted due to hardware diag failure\n",
1092 			    sc->sc_dev.dv_xname);
1093 			ether_ifdetach(ifp);
1094 			goto fail_8;
1095 		}
1096 	}
1097 #endif
1098 
1099 	return (0);
1100 
1101 fail_8:
1102 	/* Destroy DMA maps for RX buffers. */
1103 	for (i = 0; i < RL_RX_DESC_CNT; i++) {
1104 		if (sc->rl_ldata.rl_rxsoft[i].rxs_dmamap != NULL)
1105 			bus_dmamap_destroy(sc->sc_dmat,
1106 			    sc->rl_ldata.rl_rxsoft[i].rxs_dmamap);
1107 	}
1108 
1109 	/* Free DMA'able memory for the RX ring. */
1110 	bus_dmamap_unload(sc->sc_dmat, sc->rl_ldata.rl_rx_list_map);
1111 fail_7:
1112 	bus_dmamap_destroy(sc->sc_dmat, sc->rl_ldata.rl_rx_list_map);
1113 fail_6:
1114 	bus_dmamem_unmap(sc->sc_dmat,
1115 	    (caddr_t)sc->rl_ldata.rl_rx_list, RL_RX_DMAMEM_SZ);
1116 fail_5:
1117 	bus_dmamem_free(sc->sc_dmat,
1118 	    &sc->rl_ldata.rl_rx_listseg, sc->rl_ldata.rl_rx_listnseg);
1119 
1120 fail_4:
1121 	/* Destroy DMA maps for TX buffers. */
1122 	for (i = 0; i < RL_TX_QLEN; i++) {
1123 		if (sc->rl_ldata.rl_txq[i].txq_dmamap != NULL)
1124 			bus_dmamap_destroy(sc->sc_dmat,
1125 			    sc->rl_ldata.rl_txq[i].txq_dmamap);
1126 	}
1127 
1128 	/* Free DMA'able memory for the TX ring. */
1129 	bus_dmamap_unload(sc->sc_dmat, sc->rl_ldata.rl_tx_list_map);
1130 fail_3:
1131 	bus_dmamap_destroy(sc->sc_dmat, sc->rl_ldata.rl_tx_list_map);
1132 fail_2:
1133 	bus_dmamem_unmap(sc->sc_dmat,
1134 	    (caddr_t)sc->rl_ldata.rl_tx_list, RL_TX_LIST_SZ(sc));
1135 fail_1:
1136 	bus_dmamem_free(sc->sc_dmat,
1137 	    &sc->rl_ldata.rl_tx_listseg, sc->rl_ldata.rl_tx_listnseg);
1138 fail_0:
1139  	return (1);
1140 }
1141 
1142 
1143 int
1144 re_newbuf(struct rl_softc *sc, int idx, struct mbuf *m)
1145 {
1146 	struct mbuf	*n = NULL;
1147 	bus_dmamap_t	map;
1148 	struct rl_desc	*d;
1149 	struct rl_rxsoft *rxs;
1150 	u_int32_t	cmdstat;
1151 	int		error;
1152 
1153 	if (m == NULL) {
1154 		MGETHDR(n, M_DONTWAIT, MT_DATA);
1155 		if (n == NULL)
1156 			return (ENOBUFS);
1157 
1158 		MCLGET(n, M_DONTWAIT);
1159 		if (!(n->m_flags & M_EXT)) {
1160 			m_freem(n);
1161 			return (ENOBUFS);
1162 		}
1163 		m = n;
1164 	} else
1165 		m->m_data = m->m_ext.ext_buf;
1166 
1167 	/*
1168 	 * Initialize mbuf length fields and fixup
1169 	 * alignment so that the frame payload is
1170 	 * longword aligned on strict alignment archs.
1171 	 */
1172 	m->m_len = m->m_pkthdr.len = RE_RX_DESC_BUFLEN;
1173 	m->m_data += RE_ETHER_ALIGN;
1174 
1175 	rxs = &sc->rl_ldata.rl_rxsoft[idx];
1176 	map = rxs->rxs_dmamap;
1177 	error = bus_dmamap_load_mbuf(sc->sc_dmat, map, m,
1178 	    BUS_DMA_READ|BUS_DMA_NOWAIT);
1179 
1180 	if (error)
1181 		goto out;
1182 
1183 	bus_dmamap_sync(sc->sc_dmat, map, 0, map->dm_mapsize,
1184 	    BUS_DMASYNC_PREREAD);
1185 
1186 	d = &sc->rl_ldata.rl_rx_list[idx];
1187 	RL_RXDESCSYNC(sc, idx, BUS_DMASYNC_POSTREAD|BUS_DMASYNC_POSTWRITE);
1188 	cmdstat = letoh32(d->rl_cmdstat);
1189 	RL_RXDESCSYNC(sc, idx, BUS_DMASYNC_PREREAD);
1190 	if (cmdstat & RL_RDESC_STAT_OWN) {
1191 		printf("%s: tried to map busy RX descriptor\n",
1192 		    sc->sc_dev.dv_xname);
1193 		goto out;
1194 	}
1195 
1196 	rxs->rxs_mbuf = m;
1197 
1198 	d->rl_vlanctl = 0;
1199 	cmdstat = map->dm_segs[0].ds_len;
1200 	if (idx == (RL_RX_DESC_CNT - 1))
1201 		cmdstat |= RL_RDESC_CMD_EOR;
1202 	re_set_bufaddr(d, map->dm_segs[0].ds_addr);
1203 	d->rl_cmdstat = htole32(cmdstat);
1204 	RL_RXDESCSYNC(sc, idx, BUS_DMASYNC_PREREAD|BUS_DMASYNC_PREWRITE);
1205 	cmdstat |= RL_RDESC_CMD_OWN;
1206 	d->rl_cmdstat = htole32(cmdstat);
1207 	RL_RXDESCSYNC(sc, idx, BUS_DMASYNC_PREREAD|BUS_DMASYNC_PREWRITE);
1208 
1209 	return (0);
1210  out:
1211 	if (n != NULL)
1212 		m_freem(n);
1213 	return (ENOMEM);
1214 }
1215 
1216 
1217 int
1218 re_tx_list_init(struct rl_softc *sc)
1219 {
1220 	int i;
1221 
1222 	memset(sc->rl_ldata.rl_tx_list, 0, RL_TX_LIST_SZ(sc));
1223 	for (i = 0; i < RL_TX_QLEN; i++) {
1224 		sc->rl_ldata.rl_txq[i].txq_mbuf = NULL;
1225 	}
1226 
1227 	bus_dmamap_sync(sc->sc_dmat,
1228 	    sc->rl_ldata.rl_tx_list_map, 0,
1229 	    sc->rl_ldata.rl_tx_list_map->dm_mapsize,
1230 	    BUS_DMASYNC_PREREAD|BUS_DMASYNC_PREWRITE);
1231 	sc->rl_ldata.rl_txq_prodidx = 0;
1232 	sc->rl_ldata.rl_txq_considx = 0;
1233 	sc->rl_ldata.rl_tx_free = RL_TX_DESC_CNT(sc);
1234 	sc->rl_ldata.rl_tx_nextfree = 0;
1235 
1236 	return (0);
1237 }
1238 
1239 int
1240 re_rx_list_init(struct rl_softc *sc)
1241 {
1242 	int	i;
1243 
1244 	memset((char *)sc->rl_ldata.rl_rx_list, 0, RL_RX_LIST_SZ);
1245 
1246 	for (i = 0; i < RL_RX_DESC_CNT; i++) {
1247 		if (re_newbuf(sc, i, NULL) == ENOBUFS)
1248 			return (ENOBUFS);
1249 	}
1250 
1251 	sc->rl_ldata.rl_rx_prodidx = 0;
1252 	sc->rl_head = sc->rl_tail = NULL;
1253 
1254 	return (0);
1255 }
1256 
1257 /*
1258  * RX handler for C+ and 8169. For the gigE chips, we support
1259  * the reception of jumbo frames that have been fragmented
1260  * across multiple 2K mbuf cluster buffers.
1261  */
1262 void
1263 re_rxeof(struct rl_softc *sc)
1264 {
1265 	struct mbuf	*m;
1266 	struct ifnet	*ifp;
1267 	int		i, total_len;
1268 	struct rl_desc	*cur_rx;
1269 	struct rl_rxsoft *rxs;
1270 	u_int32_t	rxstat, rxvlan;
1271 
1272 	ifp = &sc->sc_arpcom.ac_if;
1273 
1274 	for (i = sc->rl_ldata.rl_rx_prodidx;; i = RL_NEXT_RX_DESC(sc, i)) {
1275 		cur_rx = &sc->rl_ldata.rl_rx_list[i];
1276 		RL_RXDESCSYNC(sc, i,
1277 		    BUS_DMASYNC_POSTREAD|BUS_DMASYNC_POSTWRITE);
1278 		rxstat = letoh32(cur_rx->rl_cmdstat);
1279 		rxvlan = letoh32(cur_rx->rl_vlanctl);
1280 		RL_RXDESCSYNC(sc, i, BUS_DMASYNC_PREREAD);
1281 		if ((rxstat & RL_RDESC_STAT_OWN) != 0)
1282 			break;
1283 		total_len = rxstat & sc->rl_rxlenmask;
1284 		rxs = &sc->rl_ldata.rl_rxsoft[i];
1285 		m = rxs->rxs_mbuf;
1286 
1287 		/* Invalidate the RX mbuf and unload its map */
1288 
1289 		bus_dmamap_sync(sc->sc_dmat,
1290 		    rxs->rxs_dmamap, 0, rxs->rxs_dmamap->dm_mapsize,
1291 		    BUS_DMASYNC_POSTREAD);
1292 		bus_dmamap_unload(sc->sc_dmat, rxs->rxs_dmamap);
1293 
1294 		if (!(rxstat & RL_RDESC_STAT_EOF)) {
1295 			m->m_len = RE_RX_DESC_BUFLEN;
1296 			if (sc->rl_head == NULL)
1297 				sc->rl_head = sc->rl_tail = m;
1298 			else {
1299 				m->m_flags &= ~M_PKTHDR;
1300 				sc->rl_tail->m_next = m;
1301 				sc->rl_tail = m;
1302 			}
1303 			re_newbuf(sc, i, NULL);
1304 			continue;
1305 		}
1306 
1307 		/*
1308 		 * NOTE: for the 8139C+, the frame length field
1309 		 * is always 12 bits in size, but for the gigE chips,
1310 		 * it is 13 bits (since the max RX frame length is 16K).
1311 		 * Unfortunately, all 32 bits in the status word
1312 		 * were already used, so to make room for the extra
1313 		 * length bit, RealTek took out the 'frame alignment
1314 		 * error' bit and shifted the other status bits
1315 		 * over one slot. The OWN, EOR, FS and LS bits are
1316 		 * still in the same places. We have already extracted
1317 		 * the frame length and checked the OWN bit, so rather
1318 		 * than using an alternate bit mapping, we shift the
1319 		 * status bits one space to the right so we can evaluate
1320 		 * them using the 8169 status as though it was in the
1321 		 * same format as that of the 8139C+.
1322 		 */
1323 		if (sc->sc_hwrev != RL_HWREV_8139CPLUS)
1324 			rxstat >>= 1;
1325 
1326 		/*
1327 		 * if total_len > 2^13-1, both _RXERRSUM and _GIANT will be
1328 		 * set, but if CRC is clear, it will still be a valid frame.
1329 		 */
1330 		if (rxstat & RL_RDESC_STAT_RXERRSUM && !(total_len > 8191 &&
1331 		    (rxstat & RL_RDESC_STAT_ERRS) == RL_RDESC_STAT_GIANT)) {
1332 			ifp->if_ierrors++;
1333 			/*
1334 			 * If this is part of a multi-fragment packet,
1335 			 * discard all the pieces.
1336 			 */
1337 			if (sc->rl_head != NULL) {
1338 				m_freem(sc->rl_head);
1339 				sc->rl_head = sc->rl_tail = NULL;
1340 			}
1341 			re_newbuf(sc, i, m);
1342 			continue;
1343 		}
1344 
1345 		/*
1346 		 * If allocating a replacement mbuf fails,
1347 		 * reload the current one.
1348 		 */
1349 
1350 		if (re_newbuf(sc, i, NULL)) {
1351 			ifp->if_ierrors++;
1352 			if (sc->rl_head != NULL) {
1353 				m_freem(sc->rl_head);
1354 				sc->rl_head = sc->rl_tail = NULL;
1355 			}
1356 			re_newbuf(sc, i, m);
1357 			continue;
1358 		}
1359 
1360 		if (sc->rl_head != NULL) {
1361 			m->m_len = total_len % RE_RX_DESC_BUFLEN;
1362 			if (m->m_len == 0)
1363 				m->m_len = RE_RX_DESC_BUFLEN;
1364 			/*
1365 			 * Special case: if there's 4 bytes or less
1366 			 * in this buffer, the mbuf can be discarded:
1367 			 * the last 4 bytes is the CRC, which we don't
1368 			 * care about anyway.
1369 			 */
1370 			if (m->m_len <= ETHER_CRC_LEN) {
1371 				sc->rl_tail->m_len -=
1372 				    (ETHER_CRC_LEN - m->m_len);
1373 				m_freem(m);
1374 			} else {
1375 				m->m_len -= ETHER_CRC_LEN;
1376 				m->m_flags &= ~M_PKTHDR;
1377 				sc->rl_tail->m_next = m;
1378 			}
1379 			m = sc->rl_head;
1380 			sc->rl_head = sc->rl_tail = NULL;
1381 			m->m_pkthdr.len = total_len - ETHER_CRC_LEN;
1382 		} else
1383 			m->m_pkthdr.len = m->m_len =
1384 			    (total_len - ETHER_CRC_LEN);
1385 
1386 		ifp->if_ipackets++;
1387 		m->m_pkthdr.rcvif = ifp;
1388 
1389 		/* Do RX checksumming */
1390 
1391 		if (sc->rl_flags & RL_FLAG_DESCV2) {
1392 			/* Check IP header checksum */
1393 			if ((rxstat & RL_RDESC_STAT_PROTOID) &&
1394 			    !(rxstat & RL_RDESC_STAT_IPSUMBAD) &&
1395 			    (rxvlan & RL_RDESC_IPV4))
1396 				m->m_pkthdr.csum_flags |= M_IPV4_CSUM_IN_OK;
1397 
1398 			/* Check TCP/UDP checksum */
1399 			if (((rxstat & RL_RDESC_STAT_TCP) &&
1400 			    !(rxstat & RL_RDESC_STAT_TCPSUMBAD)) ||
1401 			    ((rxstat & RL_RDESC_STAT_UDP) &&
1402 			    !(rxstat & RL_RDESC_STAT_UDPSUMBAD)))
1403 				m->m_pkthdr.csum_flags |= M_TCP_CSUM_IN_OK |
1404 				    M_UDP_CSUM_IN_OK;
1405 		} else {
1406 			/* Check IP header checksum */
1407 			if ((rxstat & RL_RDESC_STAT_PROTOID) &&
1408 			    !(rxstat & RL_RDESC_STAT_IPSUMBAD))
1409 				m->m_pkthdr.csum_flags |= M_IPV4_CSUM_IN_OK;
1410 
1411 			/* Check TCP/UDP checksum */
1412 			if ((RL_TCPPKT(rxstat) &&
1413 			    !(rxstat & RL_RDESC_STAT_TCPSUMBAD)) ||
1414 			    (RL_UDPPKT(rxstat) &&
1415 			    !(rxstat & RL_RDESC_STAT_UDPSUMBAD)))
1416 				m->m_pkthdr.csum_flags |= M_TCP_CSUM_IN_OK |
1417 				    M_UDP_CSUM_IN_OK;
1418 		}
1419 
1420 #if NBPFILTER > 0
1421 		if (ifp->if_bpf)
1422 			bpf_mtap(ifp->if_bpf, m, BPF_DIRECTION_IN);
1423 #endif
1424 		ether_input_mbuf(ifp, m);
1425 	}
1426 
1427 	sc->rl_ldata.rl_rx_prodidx = i;
1428 }
1429 
1430 void
1431 re_txeof(struct rl_softc *sc)
1432 {
1433 	struct ifnet	*ifp;
1434 	struct rl_txq	*txq;
1435 	uint32_t	txstat;
1436 	int		idx, descidx;
1437 
1438 	ifp = &sc->sc_arpcom.ac_if;
1439 
1440 	for (idx = sc->rl_ldata.rl_txq_considx;; idx = RL_NEXT_TXQ(sc, idx)) {
1441 		txq = &sc->rl_ldata.rl_txq[idx];
1442 
1443 		if (txq->txq_mbuf == NULL) {
1444 			KASSERT(idx == sc->rl_ldata.rl_txq_prodidx);
1445 			break;
1446 		}
1447 
1448 		descidx = txq->txq_descidx;
1449 		RL_TXDESCSYNC(sc, descidx,
1450 		    BUS_DMASYNC_POSTREAD|BUS_DMASYNC_POSTWRITE);
1451 		txstat =
1452 		    letoh32(sc->rl_ldata.rl_tx_list[descidx].rl_cmdstat);
1453 		RL_TXDESCSYNC(sc, descidx, BUS_DMASYNC_PREREAD);
1454 		KASSERT((txstat & RL_TDESC_CMD_EOF) != 0);
1455 		if (txstat & RL_TDESC_CMD_OWN)
1456 			break;
1457 
1458 		sc->rl_ldata.rl_tx_free += txq->txq_nsegs;
1459 		KASSERT(sc->rl_ldata.rl_tx_free <= RL_TX_DESC_CNT(sc));
1460 		bus_dmamap_sync(sc->sc_dmat, txq->txq_dmamap,
1461 		    0, txq->txq_dmamap->dm_mapsize, BUS_DMASYNC_POSTWRITE);
1462 		bus_dmamap_unload(sc->sc_dmat, txq->txq_dmamap);
1463 		m_freem(txq->txq_mbuf);
1464 		txq->txq_mbuf = NULL;
1465 
1466 		if (txstat & (RL_TDESC_STAT_EXCESSCOL | RL_TDESC_STAT_COLCNT))
1467 			ifp->if_collisions++;
1468 		if (txstat & RL_TDESC_STAT_TXERRSUM)
1469 			ifp->if_oerrors++;
1470 		else
1471 			ifp->if_opackets++;
1472 	}
1473 
1474 	sc->rl_ldata.rl_txq_considx = idx;
1475 
1476 	if (sc->rl_ldata.rl_tx_free > RL_NTXDESC_RSVD)
1477 		ifp->if_flags &= ~IFF_OACTIVE;
1478 
1479 	if (sc->rl_ldata.rl_tx_free < RL_TX_DESC_CNT(sc)) {
1480 		/*
1481 		 * Some chips will ignore a second TX request issued while an
1482 		 * existing transmission is in progress. If the transmitter goes
1483 		 * idle but there are still packets waiting to be sent, we need
1484 		 * to restart the channel here to flush them out. This only
1485 		 * seems to be required with the PCIe devices.
1486 		 */
1487 		CSR_WRITE_1(sc, sc->rl_txstart, RL_TXSTART_START);
1488 
1489 		/*
1490 		 * If not all descriptors have been released reaped yet,
1491 		 * reload the timer so that we will eventually get another
1492 		 * interrupt that will cause us to re-enter this routine.
1493 		 * This is done in case the transmitter has gone idle.
1494 		 */
1495 		CSR_WRITE_4(sc, RL_TIMERCNT, 1);
1496 	} else
1497 		ifp->if_timer = 0;
1498 }
1499 
1500 void
1501 re_tick(void *xsc)
1502 {
1503 	struct rl_softc	*sc = xsc;
1504 	struct mii_data	*mii;
1505 	struct ifnet	*ifp;
1506 	int s;
1507 
1508 	ifp = &sc->sc_arpcom.ac_if;
1509 	mii = &sc->sc_mii;
1510 
1511 	s = splnet();
1512 
1513 	mii_tick(mii);
1514 	if (sc->rl_flags & RL_FLAG_LINK) {
1515 		if (!(mii->mii_media_status & IFM_ACTIVE))
1516 			sc->rl_flags &= ~RL_FLAG_LINK;
1517 	} else {
1518 		if (mii->mii_media_status & IFM_ACTIVE &&
1519 		    IFM_SUBTYPE(mii->mii_media_active) != IFM_NONE) {
1520 			sc->rl_flags |= RL_FLAG_LINK;
1521 			if (!IFQ_IS_EMPTY(&ifp->if_snd))
1522 				re_start(ifp);
1523 		}
1524 	}
1525 	splx(s);
1526 
1527 	timeout_add_sec(&sc->timer_handle, 1);
1528 }
1529 
1530 int
1531 re_intr(void *arg)
1532 {
1533 	struct rl_softc	*sc = arg;
1534 	struct ifnet	*ifp;
1535 	u_int16_t	status;
1536 	int		claimed = 0;
1537 
1538 	ifp = &sc->sc_arpcom.ac_if;
1539 
1540 	if (!(ifp->if_flags & IFF_UP))
1541 		return (0);
1542 
1543 	for (;;) {
1544 
1545 		status = CSR_READ_2(sc, RL_ISR);
1546 		/* If the card has gone away the read returns 0xffff. */
1547 		if (status == 0xffff)
1548 			break;
1549 		if (status)
1550 			CSR_WRITE_2(sc, RL_ISR, status);
1551 
1552 		if ((status & RL_INTRS_CPLUS) == 0)
1553 			break;
1554 
1555 		if (status & (RL_ISR_RX_OK | RL_ISR_RX_ERR)) {
1556 			re_rxeof(sc);
1557 			claimed = 1;
1558 		}
1559 
1560 		if (status & (RL_ISR_TIMEOUT_EXPIRED | RL_ISR_TX_ERR |
1561 		    RL_ISR_TX_DESC_UNAVAIL)) {
1562 			re_txeof(sc);
1563 			claimed = 1;
1564 		}
1565 
1566 		if (status & RL_ISR_SYSTEM_ERR) {
1567 			re_reset(sc);
1568 			re_init(ifp);
1569 			claimed = 1;
1570 		}
1571 
1572 		if (status & RL_ISR_LINKCHG) {
1573 			timeout_del(&sc->timer_handle);
1574 			re_tick(sc);
1575 			claimed = 1;
1576 		}
1577 	}
1578 
1579 	if (claimed && !IFQ_IS_EMPTY(&ifp->if_snd))
1580 		re_start(ifp);
1581 
1582 	return (claimed);
1583 }
1584 
1585 int
1586 re_encap(struct rl_softc *sc, struct mbuf *m, int *idx)
1587 {
1588 	bus_dmamap_t	map;
1589 	int		error, seg, nsegs, uidx, startidx, curidx, lastidx, pad;
1590 	struct rl_desc	*d;
1591 	u_int32_t	cmdstat, vlanctl = 0, csum_flags = 0;
1592 	struct rl_txq	*txq;
1593 #if NVLAN > 0
1594 	struct ifvlan	*ifv = NULL;
1595 
1596 	if ((m->m_flags & (M_PROTO1|M_PKTHDR)) == (M_PROTO1|M_PKTHDR) &&
1597 	    m->m_pkthdr.rcvif != NULL)
1598 		ifv = m->m_pkthdr.rcvif->if_softc;
1599 #endif
1600 
1601 	if (sc->rl_ldata.rl_tx_free <= RL_NTXDESC_RSVD)
1602 		return (EFBIG);
1603 
1604 	/*
1605 	 * Set up checksum offload. Note: checksum offload bits must
1606 	 * appear in all descriptors of a multi-descriptor transmit
1607 	 * attempt. This is according to testing done with an 8169
1608 	 * chip. This is a requirement.
1609 	 */
1610 
1611 	/*
1612 	 * Set RL_TDESC_CMD_IPCSUM if any checksum offloading
1613 	 * is requested.  Otherwise, RL_TDESC_CMD_TCPCSUM/
1614 	 * RL_TDESC_CMD_UDPCSUM does not take affect.
1615 	 */
1616 
1617 	if ((m->m_pkthdr.csum_flags &
1618 	    (M_IPV4_CSUM_OUT|M_TCPV4_CSUM_OUT|M_UDPV4_CSUM_OUT)) != 0) {
1619 		if (sc->rl_flags & RL_FLAG_DESCV2) {
1620 			vlanctl |= RL_TDESC_CMD_IPCSUMV2;
1621 			if (m->m_pkthdr.csum_flags & M_TCPV4_CSUM_OUT)
1622 				vlanctl |= RL_TDESC_CMD_TCPCSUMV2;
1623 			if (m->m_pkthdr.csum_flags & M_UDPV4_CSUM_OUT)
1624 				vlanctl |= RL_TDESC_CMD_UDPCSUMV2;
1625 		} else {
1626 			csum_flags |= RL_TDESC_CMD_IPCSUM;
1627 			if (m->m_pkthdr.csum_flags & M_TCPV4_CSUM_OUT)
1628 				csum_flags |= RL_TDESC_CMD_TCPCSUM;
1629 			if (m->m_pkthdr.csum_flags & M_UDPV4_CSUM_OUT)
1630 				csum_flags |= RL_TDESC_CMD_UDPCSUM;
1631 		}
1632 	}
1633 
1634 	txq = &sc->rl_ldata.rl_txq[*idx];
1635 	map = txq->txq_dmamap;
1636 	error = bus_dmamap_load_mbuf(sc->sc_dmat, map, m,
1637 	    BUS_DMA_WRITE|BUS_DMA_NOWAIT);
1638 	if (error) {
1639 		/* XXX try to defrag if EFBIG? */
1640 		printf("%s: can't map mbuf (error %d)\n",
1641 		    sc->sc_dev.dv_xname, error);
1642 		return (error);
1643 	}
1644 
1645 	nsegs = map->dm_nsegs;
1646 	pad = 0;
1647 	if ((sc->rl_flags & RL_FLAG_DESCV2) == 0 &&
1648 	    m->m_pkthdr.len <= RL_IP4CSUMTX_PADLEN &&
1649 	    (csum_flags & RL_TDESC_CMD_IPCSUM) != 0) {
1650 		pad = 1;
1651 		nsegs++;
1652 	}
1653 
1654 	if (nsegs > sc->rl_ldata.rl_tx_free - RL_NTXDESC_RSVD) {
1655 		error = EFBIG;
1656 		goto fail_unload;
1657 	}
1658 
1659 	/*
1660 	 * Make sure that the caches are synchronized before we
1661 	 * ask the chip to start DMA for the packet data.
1662 	 */
1663 	bus_dmamap_sync(sc->sc_dmat, map, 0, map->dm_mapsize,
1664 		BUS_DMASYNC_PREWRITE);
1665 
1666 	/*
1667 	 * Set up hardware VLAN tagging. Note: vlan tag info must
1668 	 * appear in all descriptors of a multi-descriptor
1669 	 * transmission attempt.
1670 	 */
1671 #if NVLAN > 0
1672 	if (ifv != NULL)
1673 		vlanctl |= swap16(ifv->ifv_tag) | RL_TDESC_VLANCTL_TAG;
1674 #endif
1675 
1676 	/*
1677 	 * Map the segment array into descriptors. Note that we set the
1678 	 * start-of-frame and end-of-frame markers for either TX or RX, but
1679 	 * they really only have meaning in the TX case. (In the RX case,
1680 	 * it's the chip that tells us where packets begin and end.)
1681 	 * We also keep track of the end of the ring and set the
1682 	 * end-of-ring bits as needed, and we set the ownership bits
1683 	 * in all except the very first descriptor. (The caller will
1684 	 * set this descriptor later when it start transmission or
1685 	 * reception.)
1686 	 */
1687 	curidx = startidx = sc->rl_ldata.rl_tx_nextfree;
1688 	lastidx = -1;
1689 	for (seg = 0; seg < map->dm_nsegs;
1690 	    seg++, curidx = RL_NEXT_TX_DESC(sc, curidx)) {
1691 		d = &sc->rl_ldata.rl_tx_list[curidx];
1692 		RL_TXDESCSYNC(sc, curidx,
1693 		    BUS_DMASYNC_POSTREAD|BUS_DMASYNC_POSTWRITE);
1694 		cmdstat = letoh32(d->rl_cmdstat);
1695 		RL_TXDESCSYNC(sc, curidx, BUS_DMASYNC_PREREAD);
1696 		if (cmdstat & RL_TDESC_STAT_OWN) {
1697 			printf("%s: tried to map busy TX descriptor\n",
1698 			    sc->sc_dev.dv_xname);
1699 			for (; seg > 0; seg --) {
1700 				uidx = (curidx + RL_TX_DESC_CNT(sc) - seg) %
1701 				    RL_TX_DESC_CNT(sc);
1702 				sc->rl_ldata.rl_tx_list[uidx].rl_cmdstat = 0;
1703 				RL_TXDESCSYNC(sc, uidx,
1704 				    BUS_DMASYNC_PREREAD|BUS_DMASYNC_PREWRITE);
1705 			}
1706 			error = ENOBUFS;
1707 			goto fail_unload;
1708 		}
1709 
1710 		d->rl_vlanctl = htole32(vlanctl);
1711 		re_set_bufaddr(d, map->dm_segs[seg].ds_addr);
1712 		cmdstat = csum_flags | map->dm_segs[seg].ds_len;
1713 		if (seg == 0)
1714 			cmdstat |= RL_TDESC_CMD_SOF;
1715 		else
1716 			cmdstat |= RL_TDESC_CMD_OWN;
1717 		if (curidx == (RL_TX_DESC_CNT(sc) - 1))
1718 			cmdstat |= RL_TDESC_CMD_EOR;
1719 		if (seg == nsegs - 1) {
1720 			cmdstat |= RL_TDESC_CMD_EOF;
1721 			lastidx = curidx;
1722 		}
1723 		d->rl_cmdstat = htole32(cmdstat);
1724 		RL_TXDESCSYNC(sc, curidx,
1725 		    BUS_DMASYNC_PREREAD|BUS_DMASYNC_PREWRITE);
1726 	}
1727 	if (pad) {
1728 		bus_addr_t paddaddr;
1729 
1730 		d = &sc->rl_ldata.rl_tx_list[curidx];
1731 		d->rl_vlanctl = htole32(vlanctl);
1732 		paddaddr = RL_TXPADDADDR(sc);
1733 		re_set_bufaddr(d, paddaddr);
1734 		cmdstat = csum_flags |
1735 		    RL_TDESC_CMD_OWN | RL_TDESC_CMD_EOF |
1736 		    (RL_IP4CSUMTX_PADLEN + 1 - m->m_pkthdr.len);
1737 		if (curidx == (RL_TX_DESC_CNT(sc) - 1))
1738 			cmdstat |= RL_TDESC_CMD_EOR;
1739 		d->rl_cmdstat = htole32(cmdstat);
1740 		RL_TXDESCSYNC(sc, curidx,
1741 		    BUS_DMASYNC_PREREAD|BUS_DMASYNC_PREWRITE);
1742 		lastidx = curidx;
1743 		curidx = RL_NEXT_TX_DESC(sc, curidx);
1744 	}
1745 	KASSERT(lastidx != -1);
1746 
1747 	/* Transfer ownership of packet to the chip. */
1748 
1749 	sc->rl_ldata.rl_tx_list[startidx].rl_cmdstat |=
1750 	    htole32(RL_TDESC_CMD_OWN);
1751 	RL_TXDESCSYNC(sc, startidx, BUS_DMASYNC_PREREAD|BUS_DMASYNC_PREWRITE);
1752 
1753 	/* update info of TX queue and descriptors */
1754 	txq->txq_mbuf = m;
1755 	txq->txq_descidx = lastidx;
1756 	txq->txq_nsegs = nsegs;
1757 
1758 	sc->rl_ldata.rl_tx_free -= nsegs;
1759 	sc->rl_ldata.rl_tx_nextfree = curidx;
1760 
1761 	*idx = RL_NEXT_TXQ(sc, *idx);
1762 
1763 	return (0);
1764 
1765 fail_unload:
1766 	bus_dmamap_unload(sc->sc_dmat, map);
1767 
1768 	return (error);
1769 }
1770 
1771 /*
1772  * Main transmit routine for C+ and gigE NICs.
1773  */
1774 
1775 void
1776 re_start(struct ifnet *ifp)
1777 {
1778 	struct rl_softc	*sc;
1779 	int		idx, queued = 0;
1780 
1781 	sc = ifp->if_softc;
1782 
1783 	if (ifp->if_flags & IFF_OACTIVE)
1784 		return;
1785 	if ((sc->rl_flags & RL_FLAG_LINK) == 0)
1786 		return;
1787 
1788 	idx = sc->rl_ldata.rl_txq_prodidx;
1789 	for (;;) {
1790 		struct mbuf *m;
1791 		int error;
1792 
1793 		IFQ_POLL(&ifp->if_snd, m);
1794 		if (m == NULL)
1795 			break;
1796 
1797 		if (sc->rl_ldata.rl_txq[idx].txq_mbuf != NULL) {
1798 			KASSERT(idx == sc->rl_ldata.rl_txq_considx);
1799 			ifp->if_flags |= IFF_OACTIVE;
1800 			break;
1801 		}
1802 
1803 		error = re_encap(sc, m, &idx);
1804 		if (error == EFBIG &&
1805 		    sc->rl_ldata.rl_tx_free == RL_TX_DESC_CNT(sc)) {
1806 			IFQ_DEQUEUE(&ifp->if_snd, m);
1807 			m_freem(m);
1808 			ifp->if_oerrors++;
1809 			continue;
1810 		}
1811 		if (error) {
1812 			ifp->if_flags |= IFF_OACTIVE;
1813 			break;
1814 		}
1815 
1816 		IFQ_DEQUEUE(&ifp->if_snd, m);
1817 		queued++;
1818 
1819 #if NBPFILTER > 0
1820 		/*
1821 		 * If there's a BPF listener, bounce a copy of this frame
1822 		 * to him.
1823 		 */
1824 		if (ifp->if_bpf)
1825 			bpf_mtap(ifp->if_bpf, m, BPF_DIRECTION_OUT);
1826 #endif
1827 	}
1828 
1829 	if (queued == 0) {
1830 		if (sc->rl_ldata.rl_tx_free != RL_TX_DESC_CNT(sc))
1831 			CSR_WRITE_4(sc, RL_TIMERCNT, 1);
1832 		return;
1833 	}
1834 
1835 	sc->rl_ldata.rl_txq_prodidx = idx;
1836 
1837 	CSR_WRITE_1(sc, sc->rl_txstart, RL_TXSTART_START);
1838 
1839 	/*
1840 	 * Use the countdown timer for interrupt moderation.
1841 	 * 'TX done' interrupts are disabled. Instead, we reset the
1842 	 * countdown timer, which will begin counting until it hits
1843 	 * the value in the TIMERINT register, and then trigger an
1844 	 * interrupt. Each time we write to the TIMERCNT register,
1845 	 * the timer count is reset to 0.
1846 	 */
1847 	CSR_WRITE_4(sc, RL_TIMERCNT, 1);
1848 
1849 	/*
1850 	 * Set a timeout in case the chip goes out to lunch.
1851 	 */
1852 	ifp->if_timer = 5;
1853 }
1854 
1855 int
1856 re_init(struct ifnet *ifp)
1857 {
1858 	struct rl_softc *sc = ifp->if_softc;
1859 	u_int32_t	rxcfg = 0;
1860 	u_int16_t	cfg;
1861 	int		s;
1862 	union {
1863 		u_int32_t align_dummy;
1864 		u_char eaddr[ETHER_ADDR_LEN];
1865 	} eaddr;
1866 
1867 	s = splnet();
1868 
1869 	/*
1870 	 * Cancel pending I/O and free all RX/TX buffers.
1871 	 */
1872 	re_stop(ifp, 0);
1873 
1874 	/*
1875 	 * Enable C+ RX and TX mode, as well as RX checksum offload.
1876 	 * We must configure the C+ register before all others.
1877 	 */
1878 	cfg = RL_CPLUSCMD_PCI_MRW;
1879 	if (ifp->if_capabilities & IFCAP_CSUM_IPv4)
1880 		cfg |= RL_CPLUSCMD_RXCSUM_ENB;
1881 	if (sc->rl_flags & RL_FLAG_MACSTAT) {
1882 		cfg |= RL_CPLUSCMD_MACSTAT_DIS;
1883 		/* XXX magic. */
1884 		cfg |= 0x0001;
1885 	} else {
1886 		cfg |= RL_CPLUSCMD_RXENB | RL_CPLUSCMD_TXENB;
1887 	}
1888 	CSR_WRITE_2(sc, RL_CPLUS_CMD, cfg);
1889 
1890 	/*
1891 	 * Init our MAC address.  Even though the chipset
1892 	 * documentation doesn't mention it, we need to enter "Config
1893 	 * register write enable" mode to modify the ID registers.
1894 	 */
1895 	bcopy(sc->sc_arpcom.ac_enaddr, eaddr.eaddr, ETHER_ADDR_LEN);
1896 	CSR_WRITE_1(sc, RL_EECMD, RL_EEMODE_WRITECFG);
1897 	CSR_WRITE_4(sc, RL_IDR4,
1898 	    htole32(*(u_int32_t *)(&eaddr.eaddr[4])));
1899 	CSR_WRITE_4(sc, RL_IDR0,
1900 	    htole32(*(u_int32_t *)(&eaddr.eaddr[0])));
1901 	CSR_WRITE_1(sc, RL_EECMD, RL_EEMODE_OFF);
1902 
1903 	/*
1904 	 * For C+ mode, initialize the RX descriptors and mbufs.
1905 	 */
1906 	re_rx_list_init(sc);
1907 	re_tx_list_init(sc);
1908 
1909 	/*
1910 	 * Load the addresses of the RX and TX lists into the chip.
1911 	 */
1912 	CSR_WRITE_4(sc, RL_RXLIST_ADDR_HI,
1913 	    RL_ADDR_HI(sc->rl_ldata.rl_rx_list_map->dm_segs[0].ds_addr));
1914 	CSR_WRITE_4(sc, RL_RXLIST_ADDR_LO,
1915 	    RL_ADDR_LO(sc->rl_ldata.rl_rx_list_map->dm_segs[0].ds_addr));
1916 
1917 	CSR_WRITE_4(sc, RL_TXLIST_ADDR_HI,
1918 	    RL_ADDR_HI(sc->rl_ldata.rl_tx_list_map->dm_segs[0].ds_addr));
1919 	CSR_WRITE_4(sc, RL_TXLIST_ADDR_LO,
1920 	    RL_ADDR_LO(sc->rl_ldata.rl_tx_list_map->dm_segs[0].ds_addr));
1921 
1922 	/*
1923 	 * Enable transmit and receive.
1924 	 */
1925 	CSR_WRITE_1(sc, RL_COMMAND, RL_CMD_TX_ENB|RL_CMD_RX_ENB);
1926 
1927 	/*
1928 	 * Set the initial TX and RX configuration.
1929 	 */
1930 	if (sc->rl_testmode) {
1931 		if (sc->sc_hwrev == RL_HWREV_8139CPLUS)
1932 			CSR_WRITE_4(sc, RL_TXCFG,
1933 			    RL_TXCFG_CONFIG|RL_LOOPTEST_ON_CPLUS);
1934 		else
1935 			CSR_WRITE_4(sc, RL_TXCFG,
1936 			    RL_TXCFG_CONFIG|RL_LOOPTEST_ON);
1937 	} else
1938 		CSR_WRITE_4(sc, RL_TXCFG, RL_TXCFG_CONFIG);
1939 
1940 	CSR_WRITE_1(sc, RL_EARLY_TX_THRESH, 16);
1941 
1942 	CSR_WRITE_4(sc, RL_RXCFG, RL_RXCFG_CONFIG);
1943 
1944 	/* Set the individual bit to receive frames for this host only. */
1945 	rxcfg = CSR_READ_4(sc, RL_RXCFG);
1946 	rxcfg |= RL_RXCFG_RX_INDIV;
1947 
1948 	/*
1949 	 * Set capture broadcast bit to capture broadcast frames.
1950 	 */
1951 	if (ifp->if_flags & IFF_BROADCAST)
1952 		rxcfg |= RL_RXCFG_RX_BROAD;
1953 	else
1954 		rxcfg &= ~RL_RXCFG_RX_BROAD;
1955 
1956 	CSR_WRITE_4(sc, RL_RXCFG, rxcfg);
1957 
1958 	/* Program promiscuous mode and multicast filters. */
1959 	re_iff(sc);
1960 
1961 	/*
1962 	 * Enable interrupts.
1963 	 */
1964 	if (sc->rl_testmode)
1965 		CSR_WRITE_2(sc, RL_IMR, 0);
1966 	else
1967 		CSR_WRITE_2(sc, RL_IMR, RL_INTRS_CPLUS);
1968 	CSR_WRITE_2(sc, RL_ISR, RL_INTRS_CPLUS);
1969 
1970 	/* Start RX/TX process. */
1971 	CSR_WRITE_4(sc, RL_MISSEDPKT, 0);
1972 #ifdef notdef
1973 	/* Enable receiver and transmitter. */
1974 	CSR_WRITE_1(sc, RL_COMMAND, RL_CMD_TX_ENB|RL_CMD_RX_ENB);
1975 #endif
1976 
1977 	/*
1978 	 * Initialize the timer interrupt register so that
1979 	 * a timer interrupt will be generated once the timer
1980 	 * reaches a certain number of ticks. The timer is
1981 	 * reloaded on each transmit. This gives us TX interrupt
1982 	 * moderation, which dramatically improves TX frame rate.
1983 	 */
1984 	if (sc->sc_hwrev == RL_HWREV_8139CPLUS)
1985 		CSR_WRITE_4(sc, RL_TIMERINT, 0x400);
1986 	else
1987 		CSR_WRITE_4(sc, RL_TIMERINT_8169, 0x800);
1988 
1989 	/*
1990 	 * For 8169 gigE NICs, set the max allowed RX packet
1991 	 * size so we can receive jumbo frames.
1992 	 */
1993 	if (sc->sc_hwrev != RL_HWREV_8139CPLUS)
1994 		CSR_WRITE_2(sc, RL_MAXRXPKTLEN, 16383);
1995 
1996 	if (sc->rl_testmode)
1997 		return (0);
1998 
1999 	mii_mediachg(&sc->sc_mii);
2000 
2001 	CSR_WRITE_1(sc, RL_CFG1, CSR_READ_1(sc, RL_CFG1) | RL_CFG1_DRVLOAD);
2002 
2003 	ifp->if_flags |= IFF_RUNNING;
2004 	ifp->if_flags &= ~IFF_OACTIVE;
2005 
2006 	splx(s);
2007 
2008 	sc->rl_flags &= ~RL_FLAG_LINK;
2009 
2010 	timeout_add_sec(&sc->timer_handle, 1);
2011 
2012 	return (0);
2013 }
2014 
2015 /*
2016  * Set media options.
2017  */
2018 int
2019 re_ifmedia_upd(struct ifnet *ifp)
2020 {
2021 	struct rl_softc	*sc;
2022 
2023 	sc = ifp->if_softc;
2024 
2025 	return (mii_mediachg(&sc->sc_mii));
2026 }
2027 
2028 /*
2029  * Report current media status.
2030  */
2031 void
2032 re_ifmedia_sts(struct ifnet *ifp, struct ifmediareq *ifmr)
2033 {
2034 	struct rl_softc	*sc;
2035 
2036 	sc = ifp->if_softc;
2037 
2038 	mii_pollstat(&sc->sc_mii);
2039 	ifmr->ifm_active = sc->sc_mii.mii_media_active;
2040 	ifmr->ifm_status = sc->sc_mii.mii_media_status;
2041 }
2042 
2043 int
2044 re_ioctl(struct ifnet *ifp, u_long command, caddr_t data)
2045 {
2046 	struct rl_softc	*sc = ifp->if_softc;
2047 	struct ifreq	*ifr = (struct ifreq *) data;
2048 	struct ifaddr *ifa = (struct ifaddr *)data;
2049 	int		s, error = 0;
2050 
2051 	s = splnet();
2052 
2053 	if ((error = ether_ioctl(ifp, &sc->sc_arpcom, command,
2054 	    data)) > 0) {
2055 		splx(s);
2056 		return (error);
2057 	}
2058 
2059 	switch(command) {
2060 	case SIOCSIFADDR:
2061 		ifp->if_flags |= IFF_UP;
2062 		if (!(ifp->if_flags & IFF_RUNNING))
2063 			re_init(ifp);
2064 #ifdef INET
2065 		if (ifa->ifa_addr->sa_family == AF_INET)
2066 			arp_ifinit(&sc->sc_arpcom, ifa);
2067 #endif /* INET */
2068 		break;
2069 	case SIOCSIFMTU:
2070 		if (ifr->ifr_mtu < ETHERMIN || ifr->ifr_mtu > ifp->if_hardmtu)
2071 			error = EINVAL;
2072 		else if (ifp->if_mtu != ifr->ifr_mtu)
2073 			ifp->if_mtu = ifr->ifr_mtu;
2074 		break;
2075 	case SIOCSIFFLAGS:
2076 		if (ifp->if_flags & IFF_UP) {
2077 			if (ifp->if_flags & IFF_RUNNING)
2078 				re_iff(sc);
2079 			else
2080 				re_init(ifp);
2081 		} else {
2082 			if (ifp->if_flags & IFF_RUNNING)
2083 				re_stop(ifp, 1);
2084 		}
2085 		sc->if_flags = ifp->if_flags;
2086 		break;
2087 	case SIOCADDMULTI:
2088 	case SIOCDELMULTI:
2089 		error = (command == SIOCADDMULTI) ?
2090 		    ether_addmulti(ifr, &sc->sc_arpcom) :
2091 		    ether_delmulti(ifr, &sc->sc_arpcom);
2092 		if (error == ENETRESET) {
2093 			/*
2094 			 * Multicast list has changed; set the hardware
2095 			 * filter accordingly.
2096 			 */
2097 			if (ifp->if_flags & IFF_RUNNING)
2098 				re_iff(sc);
2099 			error = 0;
2100 		}
2101 		break;
2102 	case SIOCGIFMEDIA:
2103 	case SIOCSIFMEDIA:
2104 		error = ifmedia_ioctl(ifp, ifr, &sc->sc_mii.mii_media, command);
2105 		break;
2106 	default:
2107 		error = EINVAL;
2108 		break;
2109 	}
2110 
2111 	splx(s);
2112 
2113 	return (error);
2114 }
2115 
2116 void
2117 re_watchdog(struct ifnet *ifp)
2118 {
2119 	struct rl_softc	*sc;
2120 	int	s;
2121 
2122 	sc = ifp->if_softc;
2123 	s = splnet();
2124 	printf("%s: watchdog timeout\n", sc->sc_dev.dv_xname);
2125 	ifp->if_oerrors++;
2126 
2127 	re_txeof(sc);
2128 	re_rxeof(sc);
2129 
2130 	re_init(ifp);
2131 
2132 	splx(s);
2133 }
2134 
2135 /*
2136  * Stop the adapter and free any mbufs allocated to the
2137  * RX and TX lists.
2138  */
2139 void
2140 re_stop(struct ifnet *ifp, int disable)
2141 {
2142 	struct rl_softc *sc;
2143 	int	i;
2144 
2145 	sc = ifp->if_softc;
2146 
2147 	ifp->if_timer = 0;
2148 	sc->rl_flags &= ~RL_FLAG_LINK;
2149 
2150 	timeout_del(&sc->timer_handle);
2151 	ifp->if_flags &= ~(IFF_RUNNING | IFF_OACTIVE);
2152 
2153 	mii_down(&sc->sc_mii);
2154 
2155 	CSR_WRITE_1(sc, RL_COMMAND, 0x00);
2156 	CSR_WRITE_2(sc, RL_IMR, 0x0000);
2157 	CSR_WRITE_2(sc, RL_ISR, 0xFFFF);
2158 
2159 	if (sc->rl_head != NULL) {
2160 		m_freem(sc->rl_head);
2161 		sc->rl_head = sc->rl_tail = NULL;
2162 	}
2163 
2164 	/* Free the TX list buffers. */
2165 	for (i = 0; i < RL_TX_QLEN; i++) {
2166 		if (sc->rl_ldata.rl_txq[i].txq_mbuf != NULL) {
2167 			bus_dmamap_unload(sc->sc_dmat,
2168 			    sc->rl_ldata.rl_txq[i].txq_dmamap);
2169 			m_freem(sc->rl_ldata.rl_txq[i].txq_mbuf);
2170 			sc->rl_ldata.rl_txq[i].txq_mbuf = NULL;
2171 		}
2172 	}
2173 
2174 	/* Free the RX list buffers. */
2175 	for (i = 0; i < RL_RX_DESC_CNT; i++) {
2176 		if (sc->rl_ldata.rl_rxsoft[i].rxs_mbuf != NULL) {
2177 			bus_dmamap_unload(sc->sc_dmat,
2178 			    sc->rl_ldata.rl_rxsoft[i].rxs_dmamap);
2179 			m_freem(sc->rl_ldata.rl_rxsoft[i].rxs_mbuf);
2180 			sc->rl_ldata.rl_rxsoft[i].rxs_mbuf = NULL;
2181 		}
2182 	}
2183 }
2184