xref: /freebsd/sys/dev/re/if_re.c (revision 160e76972a85398e1d8d19143c145cb8a6f6942e)
1 /*-
2  * Copyright (c) 1997, 1998-2003
3  *	Bill Paul <wpaul@windriver.com>.  All rights reserved.
4  *
5  * Redistribution and use in source and binary forms, with or without
6  * modification, are permitted provided that the following conditions
7  * are met:
8  * 1. Redistributions of source code must retain the above copyright
9  *    notice, this list of conditions and the following disclaimer.
10  * 2. Redistributions in binary form must reproduce the above copyright
11  *    notice, this list of conditions and the following disclaimer in the
12  *    documentation and/or other materials provided with the distribution.
13  * 3. All advertising materials mentioning features or use of this software
14  *    must display the following acknowledgement:
15  *	This product includes software developed by Bill Paul.
16  * 4. Neither the name of the author nor the names of any co-contributors
17  *    may be used to endorse or promote products derived from this software
18  *    without specific prior written permission.
19  *
20  * THIS SOFTWARE IS PROVIDED BY Bill Paul AND CONTRIBUTORS ``AS IS'' AND
21  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
22  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
23  * ARE DISCLAIMED.  IN NO EVENT SHALL Bill Paul OR THE VOICES IN HIS HEAD
24  * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
25  * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
26  * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
27  * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
28  * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
29  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
30  * THE POSSIBILITY OF SUCH DAMAGE.
31  */
32 
33 #include <sys/cdefs.h>
34 __FBSDID("$FreeBSD$");
35 
36 /*
37  * RealTek 8139C+/8169/8169S/8110S/8168/8111/8101E PCI NIC driver
38  *
39  * Written by Bill Paul <wpaul@windriver.com>
40  * Senior Networking Software Engineer
41  * Wind River Systems
42  */
43 
44 /*
45  * This driver is designed to support RealTek's next generation of
46  * 10/100 and 10/100/1000 PCI ethernet controllers. There are currently
47  * seven devices in this family: the RTL8139C+, the RTL8169, the RTL8169S,
48  * RTL8110S, the RTL8168, the RTL8111 and the RTL8101E.
49  *
50  * The 8139C+ is a 10/100 ethernet chip. It is backwards compatible
51  * with the older 8139 family, however it also supports a special
52  * C+ mode of operation that provides several new performance enhancing
53  * features. These include:
54  *
55  *	o Descriptor based DMA mechanism. Each descriptor represents
56  *	  a single packet fragment. Data buffers may be aligned on
57  *	  any byte boundary.
58  *
59  *	o 64-bit DMA
60  *
61  *	o TCP/IP checksum offload for both RX and TX
62  *
63  *	o High and normal priority transmit DMA rings
64  *
65  *	o VLAN tag insertion and extraction
66  *
67  *	o TCP large send (segmentation offload)
68  *
69  * Like the 8139, the 8139C+ also has a built-in 10/100 PHY. The C+
70  * programming API is fairly straightforward. The RX filtering, EEPROM
71  * access and PHY access is the same as it is on the older 8139 series
72  * chips.
73  *
74  * The 8169 is a 64-bit 10/100/1000 gigabit ethernet MAC. It has almost the
75  * same programming API and feature set as the 8139C+ with the following
76  * differences and additions:
77  *
78  *	o 1000Mbps mode
79  *
80  *	o Jumbo frames
81  *
82  *	o GMII and TBI ports/registers for interfacing with copper
83  *	  or fiber PHYs
84  *
85  *	o RX and TX DMA rings can have up to 1024 descriptors
86  *	  (the 8139C+ allows a maximum of 64)
87  *
88  *	o Slight differences in register layout from the 8139C+
89  *
90  * The TX start and timer interrupt registers are at different locations
91  * on the 8169 than they are on the 8139C+. Also, the status word in the
92  * RX descriptor has a slightly different bit layout. The 8169 does not
93  * have a built-in PHY. Most reference boards use a Marvell 88E1000 'Alaska'
94  * copper gigE PHY.
95  *
96  * The 8169S/8110S 10/100/1000 devices have built-in copper gigE PHYs
97  * (the 'S' stands for 'single-chip'). These devices have the same
98  * programming API as the older 8169, but also have some vendor-specific
99  * registers for the on-board PHY. The 8110S is a LAN-on-motherboard
100  * part designed to be pin-compatible with the RealTek 8100 10/100 chip.
101  *
102  * This driver takes advantage of the RX and TX checksum offload and
103  * VLAN tag insertion/extraction features. It also implements TX
104  * interrupt moderation using the timer interrupt registers, which
105  * significantly reduces TX interrupt load. There is also support
106  * for jumbo frames, however the 8169/8169S/8110S can not transmit
107  * jumbo frames larger than 7440, so the max MTU possible with this
108  * driver is 7422 bytes.
109  */
110 
111 #ifdef HAVE_KERNEL_OPTION_HEADERS
112 #include "opt_device_polling.h"
113 #endif
114 
115 #include <sys/param.h>
116 #include <sys/endian.h>
117 #include <sys/systm.h>
118 #include <sys/sockio.h>
119 #include <sys/mbuf.h>
120 #include <sys/malloc.h>
121 #include <sys/module.h>
122 #include <sys/kernel.h>
123 #include <sys/socket.h>
124 #include <sys/lock.h>
125 #include <sys/mutex.h>
126 #include <sys/taskqueue.h>
127 
128 #include <net/if.h>
129 #include <net/if_arp.h>
130 #include <net/ethernet.h>
131 #include <net/if_dl.h>
132 #include <net/if_media.h>
133 #include <net/if_types.h>
134 #include <net/if_vlan_var.h>
135 
136 #include <net/bpf.h>
137 
138 #include <machine/bus.h>
139 #include <machine/resource.h>
140 #include <sys/bus.h>
141 #include <sys/rman.h>
142 
143 #include <dev/mii/mii.h>
144 #include <dev/mii/miivar.h>
145 
146 #include <dev/pci/pcireg.h>
147 #include <dev/pci/pcivar.h>
148 
149 MODULE_DEPEND(re, pci, 1, 1, 1);
150 MODULE_DEPEND(re, ether, 1, 1, 1);
151 MODULE_DEPEND(re, miibus, 1, 1, 1);
152 
153 /* "device miibus" required.  See GENERIC if you get errors here. */
154 #include "miibus_if.h"
155 
156 /*
157  * Default to using PIO access for this driver.
158  */
159 #define RE_USEIOSPACE
160 
161 #include <pci/if_rlreg.h>
162 
163 /* Tunables. */
164 static int msi_disable = 0;
165 TUNABLE_INT("hw.re.msi_disable", &msi_disable);
166 
167 #define RE_CSUM_FEATURES    (CSUM_IP | CSUM_TCP | CSUM_UDP)
168 
169 /*
170  * Various supported device vendors/types and their names.
171  */
172 static struct rl_type re_devs[] = {
173 	{ DLINK_VENDORID, DLINK_DEVICEID_528T, RL_HWREV_8169S,
174 		"D-Link DGE-528(T) Gigabit Ethernet Adapter" },
175 	{ DLINK_VENDORID, DLINK_DEVICEID_528T, RL_HWREV_8169_8110SB,
176 		"D-Link DGE-528(T) Rev.B1 Gigabit Ethernet Adapter" },
177 	{ RT_VENDORID, RT_DEVICEID_8139, RL_HWREV_8139CPLUS,
178 		"RealTek 8139C+ 10/100BaseTX" },
179 	{ RT_VENDORID, RT_DEVICEID_8101E, RL_HWREV_8101E,
180 		"RealTek 8101E PCIe 10/100baseTX" },
181 	{ RT_VENDORID, RT_DEVICEID_8168, RL_HWREV_8168_SPIN1,
182 		"RealTek 8168/8111B PCIe Gigabit Ethernet" },
183 	{ RT_VENDORID, RT_DEVICEID_8168, RL_HWREV_8168_SPIN2,
184 		"RealTek 8168/8111B PCIe Gigabit Ethernet" },
185 	{ RT_VENDORID, RT_DEVICEID_8168, RL_HWREV_8168_SPIN3,
186 		"RealTek 8168/8111B PCIe Gigabit Ethernet" },
187 	{ RT_VENDORID, RT_DEVICEID_8169, RL_HWREV_8169,
188 		"RealTek 8169 Gigabit Ethernet" },
189 	{ RT_VENDORID, RT_DEVICEID_8169, RL_HWREV_8169S,
190 		"RealTek 8169S Single-chip Gigabit Ethernet" },
191 	{ RT_VENDORID, RT_DEVICEID_8169, RL_HWREV_8169_8110SB,
192 		"RealTek 8169SB/8110SB Single-chip Gigabit Ethernet" },
193 	{ RT_VENDORID, RT_DEVICEID_8169, RL_HWREV_8169_8110SC,
194 		"RealTek 8169SC/8110SC Single-chip Gigabit Ethernet" },
195 	{ RT_VENDORID, RT_DEVICEID_8169SC, RL_HWREV_8169_8110SC,
196 		"RealTek 8169SC/8110SC Single-chip Gigabit Ethernet" },
197 	{ RT_VENDORID, RT_DEVICEID_8169, RL_HWREV_8110S,
198 		"RealTek 8110S Single-chip Gigabit Ethernet" },
199 	{ COREGA_VENDORID, COREGA_DEVICEID_CGLAPCIGT, RL_HWREV_8169S,
200 		"Corega CG-LAPCIGT (RTL8169S) Gigabit Ethernet" },
201 	{ LINKSYS_VENDORID, LINKSYS_DEVICEID_EG1032, RL_HWREV_8169S,
202 		"Linksys EG1032 (RTL8169S) Gigabit Ethernet" },
203 	{ USR_VENDORID, USR_DEVICEID_997902, RL_HWREV_8169S,
204 		"US Robotics 997902 (RTL8169S) Gigabit Ethernet" },
205 	{ 0, 0, 0, NULL }
206 };
207 
208 static struct rl_hwrev re_hwrevs[] = {
209 	{ RL_HWREV_8139, RL_8139,  "" },
210 	{ RL_HWREV_8139A, RL_8139, "A" },
211 	{ RL_HWREV_8139AG, RL_8139, "A-G" },
212 	{ RL_HWREV_8139B, RL_8139, "B" },
213 	{ RL_HWREV_8130, RL_8139, "8130" },
214 	{ RL_HWREV_8139C, RL_8139, "C" },
215 	{ RL_HWREV_8139D, RL_8139, "8139D/8100B/8100C" },
216 	{ RL_HWREV_8139CPLUS, RL_8139CPLUS, "C+"},
217 	{ RL_HWREV_8168_SPIN1, RL_8169, "8168"},
218 	{ RL_HWREV_8169, RL_8169, "8169"},
219 	{ RL_HWREV_8169S, RL_8169, "8169S"},
220 	{ RL_HWREV_8110S, RL_8169, "8110S"},
221 	{ RL_HWREV_8169_8110SB, RL_8169, "8169SB"},
222 	{ RL_HWREV_8169_8110SC, RL_8169, "8169SC"},
223 	{ RL_HWREV_8100, RL_8139, "8100"},
224 	{ RL_HWREV_8101, RL_8139, "8101"},
225 	{ RL_HWREV_8100E, RL_8169, "8100E"},
226 	{ RL_HWREV_8101E, RL_8169, "8101E"},
227 	{ RL_HWREV_8168_SPIN2, RL_8169, "8168"},
228 	{ RL_HWREV_8168_SPIN3, RL_8169, "8168"},
229 	{ 0, 0, NULL }
230 };
231 
232 static int re_probe		(device_t);
233 static int re_attach		(device_t);
234 static int re_detach		(device_t);
235 
236 static int re_encap		(struct rl_softc *, struct mbuf **, int *);
237 
238 static void re_dma_map_addr	(void *, bus_dma_segment_t *, int, int);
239 static void re_dma_map_desc	(void *, bus_dma_segment_t *, int,
240 				    bus_size_t, int);
241 static int re_allocmem		(device_t, struct rl_softc *);
242 static int re_newbuf		(struct rl_softc *, int, struct mbuf *);
243 static int re_rx_list_init	(struct rl_softc *);
244 static int re_tx_list_init	(struct rl_softc *);
245 #ifdef RE_FIXUP_RX
246 static __inline void re_fixup_rx
247 				(struct mbuf *);
248 #endif
249 static int re_rxeof		(struct rl_softc *);
250 static void re_txeof		(struct rl_softc *);
251 #ifdef DEVICE_POLLING
252 static void re_poll		(struct ifnet *, enum poll_cmd, int);
253 static void re_poll_locked	(struct ifnet *, enum poll_cmd, int);
254 #endif
255 static int re_intr		(void *);
256 static void re_tick		(void *);
257 static void re_tx_task		(void *, int);
258 static void re_int_task		(void *, int);
259 static void re_start		(struct ifnet *);
260 static int re_ioctl		(struct ifnet *, u_long, caddr_t);
261 static void re_init		(void *);
262 static void re_init_locked	(struct rl_softc *);
263 static void re_stop		(struct rl_softc *);
264 static void re_watchdog		(struct rl_softc *);
265 static int re_suspend		(device_t);
266 static int re_resume		(device_t);
267 static int re_shutdown		(device_t);
268 static int re_ifmedia_upd	(struct ifnet *);
269 static void re_ifmedia_sts	(struct ifnet *, struct ifmediareq *);
270 
271 static void re_eeprom_putbyte	(struct rl_softc *, int);
272 static void re_eeprom_getword	(struct rl_softc *, int, u_int16_t *);
273 static void re_read_eeprom	(struct rl_softc *, caddr_t, int, int);
274 static int re_gmii_readreg	(device_t, int, int);
275 static int re_gmii_writereg	(device_t, int, int, int);
276 
277 static int re_miibus_readreg	(device_t, int, int);
278 static int re_miibus_writereg	(device_t, int, int, int);
279 static void re_miibus_statchg	(device_t);
280 
281 static void re_setmulti		(struct rl_softc *);
282 static void re_reset		(struct rl_softc *);
283 
284 #ifdef RE_DIAG
285 static int re_diag		(struct rl_softc *);
286 #endif
287 
288 #ifdef RE_USEIOSPACE
289 #define RL_RES			SYS_RES_IOPORT
290 #define RL_RID			RL_PCI_LOIO
291 #else
292 #define RL_RES			SYS_RES_MEMORY
293 #define RL_RID			RL_PCI_LOMEM
294 #endif
295 
296 static device_method_t re_methods[] = {
297 	/* Device interface */
298 	DEVMETHOD(device_probe,		re_probe),
299 	DEVMETHOD(device_attach,	re_attach),
300 	DEVMETHOD(device_detach,	re_detach),
301 	DEVMETHOD(device_suspend,	re_suspend),
302 	DEVMETHOD(device_resume,	re_resume),
303 	DEVMETHOD(device_shutdown,	re_shutdown),
304 
305 	/* bus interface */
306 	DEVMETHOD(bus_print_child,	bus_generic_print_child),
307 	DEVMETHOD(bus_driver_added,	bus_generic_driver_added),
308 
309 	/* MII interface */
310 	DEVMETHOD(miibus_readreg,	re_miibus_readreg),
311 	DEVMETHOD(miibus_writereg,	re_miibus_writereg),
312 	DEVMETHOD(miibus_statchg,	re_miibus_statchg),
313 
314 	{ 0, 0 }
315 };
316 
317 static driver_t re_driver = {
318 	"re",
319 	re_methods,
320 	sizeof(struct rl_softc)
321 };
322 
323 static devclass_t re_devclass;
324 
325 DRIVER_MODULE(re, pci, re_driver, re_devclass, 0, 0);
326 DRIVER_MODULE(re, cardbus, re_driver, re_devclass, 0, 0);
327 DRIVER_MODULE(miibus, re, miibus_driver, miibus_devclass, 0, 0);
328 
329 #define EE_SET(x)					\
330 	CSR_WRITE_1(sc, RL_EECMD,			\
331 		CSR_READ_1(sc, RL_EECMD) | x)
332 
333 #define EE_CLR(x)					\
334 	CSR_WRITE_1(sc, RL_EECMD,			\
335 		CSR_READ_1(sc, RL_EECMD) & ~x)
336 
337 /*
338  * Send a read command and address to the EEPROM, check for ACK.
339  */
340 static void
341 re_eeprom_putbyte(sc, addr)
342 	struct rl_softc		*sc;
343 	int			addr;
344 {
345 	register int		d, i;
346 
347 	d = addr | (RL_9346_READ << sc->rl_eewidth);
348 
349 	/*
350 	 * Feed in each bit and strobe the clock.
351 	 */
352 
353 	for (i = 1 << (sc->rl_eewidth + 3); i; i >>= 1) {
354 		if (d & i) {
355 			EE_SET(RL_EE_DATAIN);
356 		} else {
357 			EE_CLR(RL_EE_DATAIN);
358 		}
359 		DELAY(100);
360 		EE_SET(RL_EE_CLK);
361 		DELAY(150);
362 		EE_CLR(RL_EE_CLK);
363 		DELAY(100);
364 	}
365 
366 	return;
367 }
368 
369 /*
370  * Read a word of data stored in the EEPROM at address 'addr.'
371  */
372 static void
373 re_eeprom_getword(sc, addr, dest)
374 	struct rl_softc		*sc;
375 	int			addr;
376 	u_int16_t		*dest;
377 {
378 	register int		i;
379 	u_int16_t		word = 0;
380 
381 	/*
382 	 * Send address of word we want to read.
383 	 */
384 	re_eeprom_putbyte(sc, addr);
385 
386 	/*
387 	 * Start reading bits from EEPROM.
388 	 */
389 	for (i = 0x8000; i; i >>= 1) {
390 		EE_SET(RL_EE_CLK);
391 		DELAY(100);
392 		if (CSR_READ_1(sc, RL_EECMD) & RL_EE_DATAOUT)
393 			word |= i;
394 		EE_CLR(RL_EE_CLK);
395 		DELAY(100);
396 	}
397 
398 	*dest = word;
399 
400 	return;
401 }
402 
403 /*
404  * Read a sequence of words from the EEPROM.
405  */
406 static void
407 re_read_eeprom(sc, dest, off, cnt)
408 	struct rl_softc		*sc;
409 	caddr_t			dest;
410 	int			off;
411 	int			cnt;
412 {
413 	int			i;
414 	u_int16_t		word = 0, *ptr;
415 
416 	CSR_SETBIT_1(sc, RL_EECMD, RL_EEMODE_PROGRAM);
417 
418         DELAY(100);
419 
420 	for (i = 0; i < cnt; i++) {
421 		CSR_SETBIT_1(sc, RL_EECMD, RL_EE_SEL);
422 		re_eeprom_getword(sc, off + i, &word);
423 		CSR_CLRBIT_1(sc, RL_EECMD, RL_EE_SEL);
424 		ptr = (u_int16_t *)(dest + (i * 2));
425                 *ptr = word;
426 	}
427 
428 	CSR_CLRBIT_1(sc, RL_EECMD, RL_EEMODE_PROGRAM);
429 
430 	return;
431 }
432 
433 static int
434 re_gmii_readreg(dev, phy, reg)
435 	device_t		dev;
436 	int			phy, reg;
437 {
438 	struct rl_softc		*sc;
439 	u_int32_t		rval;
440 	int			i;
441 
442 	if (phy != 1)
443 		return (0);
444 
445 	sc = device_get_softc(dev);
446 
447 	/* Let the rgephy driver read the GMEDIASTAT register */
448 
449 	if (reg == RL_GMEDIASTAT) {
450 		rval = CSR_READ_1(sc, RL_GMEDIASTAT);
451 		return (rval);
452 	}
453 
454 	CSR_WRITE_4(sc, RL_PHYAR, reg << 16);
455 	DELAY(1000);
456 
457 	for (i = 0; i < RL_TIMEOUT; i++) {
458 		rval = CSR_READ_4(sc, RL_PHYAR);
459 		if (rval & RL_PHYAR_BUSY)
460 			break;
461 		DELAY(100);
462 	}
463 
464 	if (i == RL_TIMEOUT) {
465 		device_printf(sc->rl_dev, "PHY read failed\n");
466 		return (0);
467 	}
468 
469 	return (rval & RL_PHYAR_PHYDATA);
470 }
471 
472 static int
473 re_gmii_writereg(dev, phy, reg, data)
474 	device_t		dev;
475 	int			phy, reg, data;
476 {
477 	struct rl_softc		*sc;
478 	u_int32_t		rval;
479 	int			i;
480 
481 	sc = device_get_softc(dev);
482 
483 	CSR_WRITE_4(sc, RL_PHYAR, (reg << 16) |
484 	    (data & RL_PHYAR_PHYDATA) | RL_PHYAR_BUSY);
485 	DELAY(1000);
486 
487 	for (i = 0; i < RL_TIMEOUT; i++) {
488 		rval = CSR_READ_4(sc, RL_PHYAR);
489 		if (!(rval & RL_PHYAR_BUSY))
490 			break;
491 		DELAY(100);
492 	}
493 
494 	if (i == RL_TIMEOUT) {
495 		device_printf(sc->rl_dev, "PHY write failed\n");
496 		return (0);
497 	}
498 
499 	return (0);
500 }
501 
502 static int
503 re_miibus_readreg(dev, phy, reg)
504 	device_t		dev;
505 	int			phy, reg;
506 {
507 	struct rl_softc		*sc;
508 	u_int16_t		rval = 0;
509 	u_int16_t		re8139_reg = 0;
510 
511 	sc = device_get_softc(dev);
512 
513 	if (sc->rl_type == RL_8169) {
514 		rval = re_gmii_readreg(dev, phy, reg);
515 		return (rval);
516 	}
517 
518 	/* Pretend the internal PHY is only at address 0 */
519 	if (phy) {
520 		return (0);
521 	}
522 	switch (reg) {
523 	case MII_BMCR:
524 		re8139_reg = RL_BMCR;
525 		break;
526 	case MII_BMSR:
527 		re8139_reg = RL_BMSR;
528 		break;
529 	case MII_ANAR:
530 		re8139_reg = RL_ANAR;
531 		break;
532 	case MII_ANER:
533 		re8139_reg = RL_ANER;
534 		break;
535 	case MII_ANLPAR:
536 		re8139_reg = RL_LPAR;
537 		break;
538 	case MII_PHYIDR1:
539 	case MII_PHYIDR2:
540 		return (0);
541 	/*
542 	 * Allow the rlphy driver to read the media status
543 	 * register. If we have a link partner which does not
544 	 * support NWAY, this is the register which will tell
545 	 * us the results of parallel detection.
546 	 */
547 	case RL_MEDIASTAT:
548 		rval = CSR_READ_1(sc, RL_MEDIASTAT);
549 		return (rval);
550 	default:
551 		device_printf(sc->rl_dev, "bad phy register\n");
552 		return (0);
553 	}
554 	rval = CSR_READ_2(sc, re8139_reg);
555 	if (sc->rl_type == RL_8139CPLUS && re8139_reg == RL_BMCR) {
556 		/* 8139C+ has different bit layout. */
557 		rval &= ~(BMCR_LOOP | BMCR_ISO);
558 	}
559 	return (rval);
560 }
561 
562 static int
563 re_miibus_writereg(dev, phy, reg, data)
564 	device_t		dev;
565 	int			phy, reg, data;
566 {
567 	struct rl_softc		*sc;
568 	u_int16_t		re8139_reg = 0;
569 	int			rval = 0;
570 
571 	sc = device_get_softc(dev);
572 
573 	if (sc->rl_type == RL_8169) {
574 		rval = re_gmii_writereg(dev, phy, reg, data);
575 		return (rval);
576 	}
577 
578 	/* Pretend the internal PHY is only at address 0 */
579 	if (phy)
580 		return (0);
581 
582 	switch (reg) {
583 	case MII_BMCR:
584 		re8139_reg = RL_BMCR;
585 		if (sc->rl_type == RL_8139CPLUS) {
586 			/* 8139C+ has different bit layout. */
587 			data &= ~(BMCR_LOOP | BMCR_ISO);
588 		}
589 		break;
590 	case MII_BMSR:
591 		re8139_reg = RL_BMSR;
592 		break;
593 	case MII_ANAR:
594 		re8139_reg = RL_ANAR;
595 		break;
596 	case MII_ANER:
597 		re8139_reg = RL_ANER;
598 		break;
599 	case MII_ANLPAR:
600 		re8139_reg = RL_LPAR;
601 		break;
602 	case MII_PHYIDR1:
603 	case MII_PHYIDR2:
604 		return (0);
605 		break;
606 	default:
607 		device_printf(sc->rl_dev, "bad phy register\n");
608 		return (0);
609 	}
610 	CSR_WRITE_2(sc, re8139_reg, data);
611 	return (0);
612 }
613 
614 static void
615 re_miibus_statchg(dev)
616 	device_t		dev;
617 {
618 
619 }
620 
621 /*
622  * Program the 64-bit multicast hash filter.
623  */
624 static void
625 re_setmulti(sc)
626 	struct rl_softc		*sc;
627 {
628 	struct ifnet		*ifp;
629 	int			h = 0;
630 	u_int32_t		hashes[2] = { 0, 0 };
631 	struct ifmultiaddr	*ifma;
632 	u_int32_t		rxfilt;
633 	int			mcnt = 0;
634 	u_int32_t		hwrev;
635 
636 	RL_LOCK_ASSERT(sc);
637 
638 	ifp = sc->rl_ifp;
639 
640 
641 	rxfilt = CSR_READ_4(sc, RL_RXCFG);
642 	rxfilt &= ~(RL_RXCFG_RX_ALLPHYS | RL_RXCFG_RX_MULTI);
643 	if (ifp->if_flags & IFF_ALLMULTI || ifp->if_flags & IFF_PROMISC) {
644 		if (ifp->if_flags & IFF_PROMISC)
645 			rxfilt |= RL_RXCFG_RX_ALLPHYS;
646 		/*
647 		 * Unlike other hardwares, we have to explicitly set
648 		 * RL_RXCFG_RX_MULTI to receive multicast frames in
649 		 * promiscuous mode.
650 		 */
651 		rxfilt |= RL_RXCFG_RX_MULTI;
652 		CSR_WRITE_4(sc, RL_RXCFG, rxfilt);
653 		CSR_WRITE_4(sc, RL_MAR0, 0xFFFFFFFF);
654 		CSR_WRITE_4(sc, RL_MAR4, 0xFFFFFFFF);
655 		return;
656 	}
657 
658 	/* first, zot all the existing hash bits */
659 	CSR_WRITE_4(sc, RL_MAR0, 0);
660 	CSR_WRITE_4(sc, RL_MAR4, 0);
661 
662 	/* now program new ones */
663 	IF_ADDR_LOCK(ifp);
664 	TAILQ_FOREACH(ifma, &ifp->if_multiaddrs, ifma_link) {
665 		if (ifma->ifma_addr->sa_family != AF_LINK)
666 			continue;
667 		h = ether_crc32_be(LLADDR((struct sockaddr_dl *)
668 		    ifma->ifma_addr), ETHER_ADDR_LEN) >> 26;
669 		if (h < 32)
670 			hashes[0] |= (1 << h);
671 		else
672 			hashes[1] |= (1 << (h - 32));
673 		mcnt++;
674 	}
675 	IF_ADDR_UNLOCK(ifp);
676 
677 	if (mcnt)
678 		rxfilt |= RL_RXCFG_RX_MULTI;
679 	else
680 		rxfilt &= ~RL_RXCFG_RX_MULTI;
681 
682 	CSR_WRITE_4(sc, RL_RXCFG, rxfilt);
683 
684 	/*
685 	 * For some unfathomable reason, RealTek decided to reverse
686 	 * the order of the multicast hash registers in the PCI Express
687 	 * parts. This means we have to write the hash pattern in reverse
688 	 * order for those devices.
689 	 */
690 
691 	hwrev = CSR_READ_4(sc, RL_TXCFG) & RL_TXCFG_HWREV;
692 
693 	switch (hwrev) {
694 	case RL_HWREV_8100E:
695 	case RL_HWREV_8101E:
696 	case RL_HWREV_8168_SPIN1:
697 	case RL_HWREV_8168_SPIN2:
698 	case RL_HWREV_8168_SPIN3:
699 		CSR_WRITE_4(sc, RL_MAR0, bswap32(hashes[1]));
700 		CSR_WRITE_4(sc, RL_MAR4, bswap32(hashes[0]));
701 		break;
702 	default:
703 		CSR_WRITE_4(sc, RL_MAR0, hashes[0]);
704 		CSR_WRITE_4(sc, RL_MAR4, hashes[1]);
705 		break;
706 	}
707 }
708 
709 static void
710 re_reset(sc)
711 	struct rl_softc		*sc;
712 {
713 	register int		i;
714 
715 	RL_LOCK_ASSERT(sc);
716 
717 	CSR_WRITE_1(sc, RL_COMMAND, RL_CMD_RESET);
718 
719 	for (i = 0; i < RL_TIMEOUT; i++) {
720 		DELAY(10);
721 		if (!(CSR_READ_1(sc, RL_COMMAND) & RL_CMD_RESET))
722 			break;
723 	}
724 	if (i == RL_TIMEOUT)
725 		device_printf(sc->rl_dev, "reset never completed!\n");
726 
727 	CSR_WRITE_1(sc, 0x82, 1);
728 }
729 
730 #ifdef RE_DIAG
731 
732 /*
733  * The following routine is designed to test for a defect on some
734  * 32-bit 8169 cards. Some of these NICs have the REQ64# and ACK64#
735  * lines connected to the bus, however for a 32-bit only card, they
736  * should be pulled high. The result of this defect is that the
737  * NIC will not work right if you plug it into a 64-bit slot: DMA
738  * operations will be done with 64-bit transfers, which will fail
739  * because the 64-bit data lines aren't connected.
740  *
741  * There's no way to work around this (short of talking a soldering
742  * iron to the board), however we can detect it. The method we use
743  * here is to put the NIC into digital loopback mode, set the receiver
744  * to promiscuous mode, and then try to send a frame. We then compare
745  * the frame data we sent to what was received. If the data matches,
746  * then the NIC is working correctly, otherwise we know the user has
747  * a defective NIC which has been mistakenly plugged into a 64-bit PCI
748  * slot. In the latter case, there's no way the NIC can work correctly,
749  * so we print out a message on the console and abort the device attach.
750  */
751 
752 static int
753 re_diag(sc)
754 	struct rl_softc		*sc;
755 {
756 	struct ifnet		*ifp = sc->rl_ifp;
757 	struct mbuf		*m0;
758 	struct ether_header	*eh;
759 	struct rl_desc		*cur_rx;
760 	u_int16_t		status;
761 	u_int32_t		rxstat;
762 	int			total_len, i, error = 0, phyaddr;
763 	u_int8_t		dst[] = { 0x00, 'h', 'e', 'l', 'l', 'o' };
764 	u_int8_t		src[] = { 0x00, 'w', 'o', 'r', 'l', 'd' };
765 
766 	/* Allocate a single mbuf */
767 	MGETHDR(m0, M_DONTWAIT, MT_DATA);
768 	if (m0 == NULL)
769 		return (ENOBUFS);
770 
771 	RL_LOCK(sc);
772 
773 	/*
774 	 * Initialize the NIC in test mode. This sets the chip up
775 	 * so that it can send and receive frames, but performs the
776 	 * following special functions:
777 	 * - Puts receiver in promiscuous mode
778 	 * - Enables digital loopback mode
779 	 * - Leaves interrupts turned off
780 	 */
781 
782 	ifp->if_flags |= IFF_PROMISC;
783 	sc->rl_testmode = 1;
784 	re_reset(sc);
785 	re_init_locked(sc);
786 	sc->rl_link = 1;
787 	if (sc->rl_type == RL_8169)
788 		phyaddr = 1;
789 	else
790 		phyaddr = 0;
791 
792 	re_miibus_writereg(sc->rl_dev, phyaddr, MII_BMCR, BMCR_RESET);
793 	for (i = 0; i < RL_TIMEOUT; i++) {
794 		status = re_miibus_readreg(sc->rl_dev, phyaddr, MII_BMCR);
795 		if (!(status & BMCR_RESET))
796 			break;
797 	}
798 
799 	re_miibus_writereg(sc->rl_dev, phyaddr, MII_BMCR, BMCR_LOOP);
800 	CSR_WRITE_2(sc, RL_ISR, RL_INTRS);
801 
802 	DELAY(100000);
803 
804 	/* Put some data in the mbuf */
805 
806 	eh = mtod(m0, struct ether_header *);
807 	bcopy ((char *)&dst, eh->ether_dhost, ETHER_ADDR_LEN);
808 	bcopy ((char *)&src, eh->ether_shost, ETHER_ADDR_LEN);
809 	eh->ether_type = htons(ETHERTYPE_IP);
810 	m0->m_pkthdr.len = m0->m_len = ETHER_MIN_LEN - ETHER_CRC_LEN;
811 
812 	/*
813 	 * Queue the packet, start transmission.
814 	 * Note: IF_HANDOFF() ultimately calls re_start() for us.
815 	 */
816 
817 	CSR_WRITE_2(sc, RL_ISR, 0xFFFF);
818 	RL_UNLOCK(sc);
819 	/* XXX: re_diag must not be called when in ALTQ mode */
820 	IF_HANDOFF(&ifp->if_snd, m0, ifp);
821 	RL_LOCK(sc);
822 	m0 = NULL;
823 
824 	/* Wait for it to propagate through the chip */
825 
826 	DELAY(100000);
827 	for (i = 0; i < RL_TIMEOUT; i++) {
828 		status = CSR_READ_2(sc, RL_ISR);
829 		CSR_WRITE_2(sc, RL_ISR, status);
830 		if ((status & (RL_ISR_TIMEOUT_EXPIRED|RL_ISR_RX_OK)) ==
831 		    (RL_ISR_TIMEOUT_EXPIRED|RL_ISR_RX_OK))
832 			break;
833 		DELAY(10);
834 	}
835 
836 	if (i == RL_TIMEOUT) {
837 		device_printf(sc->rl_dev,
838 		    "diagnostic failed, failed to receive packet in"
839 		    " loopback mode\n");
840 		error = EIO;
841 		goto done;
842 	}
843 
844 	/*
845 	 * The packet should have been dumped into the first
846 	 * entry in the RX DMA ring. Grab it from there.
847 	 */
848 
849 	bus_dmamap_sync(sc->rl_ldata.rl_rx_list_tag,
850 	    sc->rl_ldata.rl_rx_list_map,
851 	    BUS_DMASYNC_POSTREAD);
852 	bus_dmamap_sync(sc->rl_ldata.rl_mtag,
853 	    sc->rl_ldata.rl_rx_dmamap[0],
854 	    BUS_DMASYNC_POSTWRITE);
855 	bus_dmamap_unload(sc->rl_ldata.rl_mtag,
856 	    sc->rl_ldata.rl_rx_dmamap[0]);
857 
858 	m0 = sc->rl_ldata.rl_rx_mbuf[0];
859 	sc->rl_ldata.rl_rx_mbuf[0] = NULL;
860 	eh = mtod(m0, struct ether_header *);
861 
862 	cur_rx = &sc->rl_ldata.rl_rx_list[0];
863 	total_len = RL_RXBYTES(cur_rx);
864 	rxstat = le32toh(cur_rx->rl_cmdstat);
865 
866 	if (total_len != ETHER_MIN_LEN) {
867 		device_printf(sc->rl_dev,
868 		    "diagnostic failed, received short packet\n");
869 		error = EIO;
870 		goto done;
871 	}
872 
873 	/* Test that the received packet data matches what we sent. */
874 
875 	if (bcmp((char *)&eh->ether_dhost, (char *)&dst, ETHER_ADDR_LEN) ||
876 	    bcmp((char *)&eh->ether_shost, (char *)&src, ETHER_ADDR_LEN) ||
877 	    ntohs(eh->ether_type) != ETHERTYPE_IP) {
878 		device_printf(sc->rl_dev, "WARNING, DMA FAILURE!\n");
879 		device_printf(sc->rl_dev, "expected TX data: %6D/%6D/0x%x\n",
880 		    dst, ":", src, ":", ETHERTYPE_IP);
881 		device_printf(sc->rl_dev, "received RX data: %6D/%6D/0x%x\n",
882 		    eh->ether_dhost, ":",  eh->ether_shost, ":",
883 		    ntohs(eh->ether_type));
884 		device_printf(sc->rl_dev, "You may have a defective 32-bit "
885 		    "NIC plugged into a 64-bit PCI slot.\n");
886 		device_printf(sc->rl_dev, "Please re-install the NIC in a "
887 		    "32-bit slot for proper operation.\n");
888 		device_printf(sc->rl_dev, "Read the re(4) man page for more "
889 		    "details.\n");
890 		error = EIO;
891 	}
892 
893 done:
894 	/* Turn interface off, release resources */
895 
896 	sc->rl_testmode = 0;
897 	sc->rl_link = 0;
898 	ifp->if_flags &= ~IFF_PROMISC;
899 	re_stop(sc);
900 	if (m0 != NULL)
901 		m_freem(m0);
902 
903 	RL_UNLOCK(sc);
904 
905 	return (error);
906 }
907 
908 #endif
909 
910 /*
911  * Probe for a RealTek 8139C+/8169/8110 chip. Check the PCI vendor and device
912  * IDs against our list and return a device name if we find a match.
913  */
914 static int
915 re_probe(dev)
916 	device_t		dev;
917 {
918 	struct rl_type		*t;
919 	struct rl_softc		*sc;
920 	int			rid;
921 	u_int32_t		hwrev;
922 
923 	t = re_devs;
924 	sc = device_get_softc(dev);
925 
926 	while (t->rl_name != NULL) {
927 		if ((pci_get_vendor(dev) == t->rl_vid) &&
928 		    (pci_get_device(dev) == t->rl_did)) {
929 			/*
930 			 * Only attach to rev. 3 of the Linksys EG1032 adapter.
931 			 * Rev. 2 i supported by sk(4).
932 			 */
933 			if ((t->rl_vid == LINKSYS_VENDORID) &&
934 				(t->rl_did == LINKSYS_DEVICEID_EG1032) &&
935 				(pci_get_subdevice(dev) !=
936 				LINKSYS_SUBDEVICE_EG1032_REV3)) {
937 				t++;
938 				continue;
939 			}
940 
941 			/*
942 			 * Temporarily map the I/O space
943 			 * so we can read the chip ID register.
944 			 */
945 			rid = RL_RID;
946 			sc->rl_res = bus_alloc_resource_any(dev, RL_RES, &rid,
947 			    RF_ACTIVE);
948 			if (sc->rl_res == NULL) {
949 				device_printf(dev,
950 				    "couldn't map ports/memory\n");
951 				return (ENXIO);
952 			}
953 			sc->rl_btag = rman_get_bustag(sc->rl_res);
954 			sc->rl_bhandle = rman_get_bushandle(sc->rl_res);
955 			hwrev = CSR_READ_4(sc, RL_TXCFG) & RL_TXCFG_HWREV;
956 			bus_release_resource(dev, RL_RES,
957 			    RL_RID, sc->rl_res);
958 			if (t->rl_basetype == hwrev) {
959 				device_set_desc(dev, t->rl_name);
960 				return (BUS_PROBE_DEFAULT);
961 			}
962 		}
963 		t++;
964 	}
965 
966 	return (ENXIO);
967 }
968 
969 /*
970  * This routine takes the segment list provided as the result of
971  * a bus_dma_map_load() operation and assigns the addresses/lengths
972  * to RealTek DMA descriptors. This can be called either by the RX
973  * code or the TX code. In the RX case, we'll probably wind up mapping
974  * at most one segment. For the TX case, there could be any number of
975  * segments since TX packets may span multiple mbufs. In either case,
976  * if the number of segments is larger than the rl_maxsegs limit
977  * specified by the caller, we abort the mapping operation. Sadly,
978  * whoever designed the buffer mapping API did not provide a way to
979  * return an error from here, so we have to fake it a bit.
980  */
981 
982 static void
983 re_dma_map_desc(arg, segs, nseg, mapsize, error)
984 	void			*arg;
985 	bus_dma_segment_t	*segs;
986 	int			nseg;
987 	bus_size_t		mapsize;
988 	int			error;
989 {
990 	struct rl_dmaload_arg	*ctx;
991 	struct rl_desc		*d = NULL;
992 	int			i = 0, idx;
993 	u_int32_t		cmdstat;
994 	int			totlen = 0;
995 
996 	if (error)
997 		return;
998 
999 	ctx = arg;
1000 
1001 	/* Signal error to caller if there's too many segments */
1002 	if (nseg > ctx->rl_maxsegs) {
1003 		ctx->rl_maxsegs = 0;
1004 		return;
1005 	}
1006 
1007 	/*
1008 	 * Map the segment array into descriptors. Note that we set the
1009 	 * start-of-frame and end-of-frame markers for either TX or RX, but
1010 	 * they really only have meaning in the TX case. (In the RX case,
1011 	 * it's the chip that tells us where packets begin and end.)
1012 	 * We also keep track of the end of the ring and set the
1013 	 * end-of-ring bits as needed, and we set the ownership bits
1014 	 * in all except the very first descriptor. (The caller will
1015 	 * set this descriptor later when it start transmission or
1016 	 * reception.)
1017 	 */
1018 	idx = ctx->rl_idx;
1019 	for (;;) {
1020 		d = &ctx->rl_ring[idx];
1021 		if (le32toh(d->rl_cmdstat) & RL_RDESC_STAT_OWN) {
1022 			ctx->rl_maxsegs = 0;
1023 			return;
1024 		}
1025 		cmdstat = segs[i].ds_len;
1026 		totlen += segs[i].ds_len;
1027 		d->rl_vlanctl = 0;
1028 		d->rl_bufaddr_lo = htole32(RL_ADDR_LO(segs[i].ds_addr));
1029 		d->rl_bufaddr_hi = htole32(RL_ADDR_HI(segs[i].ds_addr));
1030 		if (i == 0)
1031 			cmdstat |= RL_TDESC_CMD_SOF;
1032 		else
1033 			cmdstat |= RL_TDESC_CMD_OWN;
1034 		if (idx == (RL_RX_DESC_CNT - 1))
1035 			cmdstat |= RL_TDESC_CMD_EOR;
1036 		d->rl_cmdstat = htole32(cmdstat | ctx->rl_flags);
1037 		i++;
1038 		if (i == nseg)
1039 			break;
1040 		RL_DESC_INC(idx);
1041 	}
1042 
1043 	d->rl_cmdstat |= htole32(RL_TDESC_CMD_EOF);
1044 	ctx->rl_maxsegs = nseg;
1045 	ctx->rl_idx = idx;
1046 }
1047 
1048 /*
1049  * Map a single buffer address.
1050  */
1051 
1052 static void
1053 re_dma_map_addr(arg, segs, nseg, error)
1054 	void			*arg;
1055 	bus_dma_segment_t	*segs;
1056 	int			nseg;
1057 	int			error;
1058 {
1059 	bus_addr_t		*addr;
1060 
1061 	if (error)
1062 		return;
1063 
1064 	KASSERT(nseg == 1, ("too many DMA segments, %d should be 1", nseg));
1065 	addr = arg;
1066 	*addr = segs->ds_addr;
1067 }
1068 
1069 static int
1070 re_allocmem(dev, sc)
1071 	device_t		dev;
1072 	struct rl_softc		*sc;
1073 {
1074 	int			error;
1075 	int			nseg;
1076 	int			i;
1077 
1078 	/*
1079 	 * Allocate map for RX mbufs.
1080 	 */
1081 	nseg = 32;
1082 	error = bus_dma_tag_create(sc->rl_parent_tag, ETHER_ALIGN, 0,
1083 	    BUS_SPACE_MAXADDR_32BIT, BUS_SPACE_MAXADDR, NULL,
1084 	    NULL, MCLBYTES * nseg, nseg, MCLBYTES, BUS_DMA_ALLOCNOW,
1085 	    NULL, NULL, &sc->rl_ldata.rl_mtag);
1086 	if (error) {
1087 		device_printf(dev, "could not allocate dma tag\n");
1088 		return (ENOMEM);
1089 	}
1090 
1091 	/*
1092 	 * Allocate map for TX descriptor list.
1093 	 */
1094 	error = bus_dma_tag_create(sc->rl_parent_tag, RL_RING_ALIGN,
1095 	    0, BUS_SPACE_MAXADDR_32BIT, BUS_SPACE_MAXADDR, NULL,
1096 	    NULL, RL_TX_LIST_SZ, 1, RL_TX_LIST_SZ, 0,
1097 	    NULL, NULL, &sc->rl_ldata.rl_tx_list_tag);
1098 	if (error) {
1099 		device_printf(dev, "could not allocate dma tag\n");
1100 		return (ENOMEM);
1101 	}
1102 
1103 	/* Allocate DMA'able memory for the TX ring */
1104 
1105 	error = bus_dmamem_alloc(sc->rl_ldata.rl_tx_list_tag,
1106 	    (void **)&sc->rl_ldata.rl_tx_list, BUS_DMA_NOWAIT | BUS_DMA_ZERO,
1107 	    &sc->rl_ldata.rl_tx_list_map);
1108 	if (error)
1109 		return (ENOMEM);
1110 
1111 	/* Load the map for the TX ring. */
1112 
1113 	error = bus_dmamap_load(sc->rl_ldata.rl_tx_list_tag,
1114 	     sc->rl_ldata.rl_tx_list_map, sc->rl_ldata.rl_tx_list,
1115 	     RL_TX_LIST_SZ, re_dma_map_addr,
1116 	     &sc->rl_ldata.rl_tx_list_addr, BUS_DMA_NOWAIT);
1117 
1118 	/* Create DMA maps for TX buffers */
1119 
1120 	for (i = 0; i < RL_TX_DESC_CNT; i++) {
1121 		error = bus_dmamap_create(sc->rl_ldata.rl_mtag, 0,
1122 			    &sc->rl_ldata.rl_tx_dmamap[i]);
1123 		if (error) {
1124 			device_printf(dev, "can't create DMA map for TX\n");
1125 			return (ENOMEM);
1126 		}
1127 	}
1128 
1129 	/*
1130 	 * Allocate map for RX descriptor list.
1131 	 */
1132 	error = bus_dma_tag_create(sc->rl_parent_tag, RL_RING_ALIGN,
1133 	    0, BUS_SPACE_MAXADDR_32BIT, BUS_SPACE_MAXADDR, NULL,
1134 	    NULL, RL_RX_LIST_SZ, 1, RL_RX_LIST_SZ, 0,
1135 	    NULL, NULL, &sc->rl_ldata.rl_rx_list_tag);
1136 	if (error) {
1137 		device_printf(dev, "could not allocate dma tag\n");
1138 		return (ENOMEM);
1139 	}
1140 
1141 	/* Allocate DMA'able memory for the RX ring */
1142 
1143 	error = bus_dmamem_alloc(sc->rl_ldata.rl_rx_list_tag,
1144 	    (void **)&sc->rl_ldata.rl_rx_list, BUS_DMA_NOWAIT | BUS_DMA_ZERO,
1145 	    &sc->rl_ldata.rl_rx_list_map);
1146 	if (error)
1147 		return (ENOMEM);
1148 
1149 	/* Load the map for the RX ring. */
1150 
1151 	error = bus_dmamap_load(sc->rl_ldata.rl_rx_list_tag,
1152 	     sc->rl_ldata.rl_rx_list_map, sc->rl_ldata.rl_rx_list,
1153 	     RL_RX_LIST_SZ, re_dma_map_addr,
1154 	     &sc->rl_ldata.rl_rx_list_addr, BUS_DMA_NOWAIT);
1155 
1156 	/* Create DMA maps for RX buffers */
1157 
1158 	for (i = 0; i < RL_RX_DESC_CNT; i++) {
1159 		error = bus_dmamap_create(sc->rl_ldata.rl_mtag, 0,
1160 			    &sc->rl_ldata.rl_rx_dmamap[i]);
1161 		if (error) {
1162 			device_printf(dev, "can't create DMA map for RX\n");
1163 			return (ENOMEM);
1164 		}
1165 	}
1166 
1167 	return (0);
1168 }
1169 
1170 /*
1171  * Attach the interface. Allocate softc structures, do ifmedia
1172  * setup and ethernet/BPF attach.
1173  */
1174 static int
1175 re_attach(dev)
1176 	device_t		dev;
1177 {
1178 	u_char			eaddr[ETHER_ADDR_LEN];
1179 	u_int16_t		as[ETHER_ADDR_LEN / 2];
1180 	struct rl_softc		*sc;
1181 	struct ifnet		*ifp;
1182 	struct rl_hwrev		*hw_rev;
1183 	int			hwrev;
1184 	u_int16_t		re_did = 0;
1185 	int			error = 0, rid, i;
1186 	int			msic, reg;
1187 
1188 	sc = device_get_softc(dev);
1189 	sc->rl_dev = dev;
1190 
1191 	mtx_init(&sc->rl_mtx, device_get_nameunit(dev), MTX_NETWORK_LOCK,
1192 	    MTX_DEF);
1193 	callout_init_mtx(&sc->rl_stat_callout, &sc->rl_mtx, 0);
1194 
1195 	/*
1196 	 * Map control/status registers.
1197 	 */
1198 	pci_enable_busmaster(dev);
1199 
1200 	rid = RL_RID;
1201 	sc->rl_res = bus_alloc_resource_any(dev, RL_RES, &rid,
1202 	    RF_ACTIVE);
1203 
1204 	if (sc->rl_res == NULL) {
1205 		device_printf(dev, "couldn't map ports/memory\n");
1206 		error = ENXIO;
1207 		goto fail;
1208 	}
1209 
1210 	sc->rl_btag = rman_get_bustag(sc->rl_res);
1211 	sc->rl_bhandle = rman_get_bushandle(sc->rl_res);
1212 
1213 	msic = 0;
1214 	if (pci_find_extcap(dev, PCIY_EXPRESS, &reg) == 0) {
1215 		msic = pci_msi_count(dev);
1216 		if (bootverbose)
1217 			device_printf(dev, "MSI count : %d\n", msic);
1218 	}
1219 	if (msic == RL_MSI_MESSAGES  && msi_disable == 0) {
1220 		if (pci_alloc_msi(dev, &msic) == 0) {
1221 			if (msic == RL_MSI_MESSAGES) {
1222 				device_printf(dev, "Using %d MSI messages\n",
1223 				    msic);
1224 				sc->rl_msi = 1;
1225 			} else
1226 				pci_release_msi(dev);
1227 		}
1228 	}
1229 
1230 	/* Allocate interrupt */
1231 	if (sc->rl_msi == 0) {
1232 		rid = 0;
1233 		sc->rl_irq[0] = bus_alloc_resource_any(dev, SYS_RES_IRQ, &rid,
1234 		    RF_SHAREABLE | RF_ACTIVE);
1235 		if (sc->rl_irq[0] == NULL) {
1236 			device_printf(dev, "couldn't allocate IRQ resources\n");
1237 			error = ENXIO;
1238 			goto fail;
1239 		}
1240 	} else {
1241 		for (i = 0, rid = 1; i < RL_MSI_MESSAGES; i++, rid++) {
1242 			sc->rl_irq[i] = bus_alloc_resource_any(dev,
1243 			    SYS_RES_IRQ, &rid, RF_ACTIVE);
1244 			if (sc->rl_irq[i] == NULL) {
1245 				device_printf(dev,
1246 				    "couldn't llocate IRQ resources for "
1247 				    "message %d\n", rid);
1248 				error = ENXIO;
1249 				goto fail;
1250 			}
1251 		}
1252 	}
1253 
1254 	/* Reset the adapter. */
1255 	RL_LOCK(sc);
1256 	re_reset(sc);
1257 	RL_UNLOCK(sc);
1258 
1259 	hw_rev = re_hwrevs;
1260 	hwrev = CSR_READ_4(sc, RL_TXCFG) & RL_TXCFG_HWREV;
1261 	while (hw_rev->rl_desc != NULL) {
1262 		if (hw_rev->rl_rev == hwrev) {
1263 			sc->rl_type = hw_rev->rl_type;
1264 			break;
1265 		}
1266 		hw_rev++;
1267 	}
1268 
1269 	sc->rl_eewidth = RL_9356_ADDR_LEN;
1270 	re_read_eeprom(sc, (caddr_t)&re_did, 0, 1);
1271 	if (re_did != 0x8129)
1272 	        sc->rl_eewidth = RL_9346_ADDR_LEN;
1273 
1274 	/*
1275 	 * Get station address from the EEPROM.
1276 	 */
1277 	re_read_eeprom(sc, (caddr_t)as, RL_EE_EADDR, 3);
1278 	for (i = 0; i < ETHER_ADDR_LEN / 2; i++)
1279 		as[i] = le16toh(as[i]);
1280 	bcopy(as, eaddr, sizeof(eaddr));
1281 
1282 	if (sc->rl_type == RL_8169) {
1283 		/* Set RX length mask */
1284 		sc->rl_rxlenmask = RL_RDESC_STAT_GFRAGLEN;
1285 		sc->rl_txstart = RL_GTXSTART;
1286 	} else {
1287 		/* Set RX length mask */
1288 		sc->rl_rxlenmask = RL_RDESC_STAT_FRAGLEN;
1289 		sc->rl_txstart = RL_TXSTART;
1290 	}
1291 
1292 	/*
1293 	 * Allocate the parent bus DMA tag appropriate for PCI.
1294 	 */
1295 #define RL_NSEG_NEW 32
1296 	error = bus_dma_tag_create(bus_get_dma_tag(dev), 1, 0,
1297 	    BUS_SPACE_MAXADDR_32BIT, BUS_SPACE_MAXADDR, NULL, NULL,
1298 	    MAXBSIZE, RL_NSEG_NEW, BUS_SPACE_MAXSIZE_32BIT, 0,
1299 	    NULL, NULL, &sc->rl_parent_tag);
1300 	if (error)
1301 		goto fail;
1302 
1303 	error = re_allocmem(dev, sc);
1304 
1305 	if (error)
1306 		goto fail;
1307 
1308 	ifp = sc->rl_ifp = if_alloc(IFT_ETHER);
1309 	if (ifp == NULL) {
1310 		device_printf(dev, "can not if_alloc()\n");
1311 		error = ENOSPC;
1312 		goto fail;
1313 	}
1314 
1315 	/* Do MII setup */
1316 	if (mii_phy_probe(dev, &sc->rl_miibus,
1317 	    re_ifmedia_upd, re_ifmedia_sts)) {
1318 		device_printf(dev, "MII without any phy!\n");
1319 		error = ENXIO;
1320 		goto fail;
1321 	}
1322 
1323 	/* Take PHY out of power down mode. */
1324 	if (sc->rl_type == RL_8169) {
1325 		uint32_t rev;
1326 
1327 		rev = CSR_READ_4(sc, RL_TXCFG);
1328 		/* HWVERID 0, 1 and 2 :  bit26-30, bit23 */
1329 		rev &= 0x7c800000;
1330 		if (rev != 0) {
1331 			/* RTL8169S single chip */
1332 			switch (rev) {
1333 			case RL_HWREV_8169_8110SB:
1334 			case RL_HWREV_8169_8110SC:
1335 			case RL_HWREV_8168_SPIN2:
1336 			case RL_HWREV_8168_SPIN3:
1337 				re_gmii_writereg(dev, 1, 0x1f, 0);
1338 				re_gmii_writereg(dev, 1, 0x0e, 0);
1339 				break;
1340 			default:
1341 				break;
1342 			}
1343 		}
1344 	}
1345 
1346 	ifp->if_softc = sc;
1347 	if_initname(ifp, device_get_name(dev), device_get_unit(dev));
1348 	ifp->if_flags = IFF_BROADCAST | IFF_SIMPLEX | IFF_MULTICAST;
1349 	ifp->if_ioctl = re_ioctl;
1350 	ifp->if_start = re_start;
1351 	ifp->if_hwassist = RE_CSUM_FEATURES;
1352 	ifp->if_capabilities = IFCAP_HWCSUM;
1353 	ifp->if_capenable = ifp->if_capabilities;
1354 	ifp->if_init = re_init;
1355 	IFQ_SET_MAXLEN(&ifp->if_snd, RL_IFQ_MAXLEN);
1356 	ifp->if_snd.ifq_drv_maxlen = RL_IFQ_MAXLEN;
1357 	IFQ_SET_READY(&ifp->if_snd);
1358 
1359 	TASK_INIT(&sc->rl_txtask, 1, re_tx_task, ifp);
1360 	TASK_INIT(&sc->rl_inttask, 0, re_int_task, sc);
1361 
1362 	/*
1363 	 * Call MI attach routine.
1364 	 */
1365 	ether_ifattach(ifp, eaddr);
1366 
1367 	/* VLAN capability setup */
1368 	ifp->if_capabilities |= IFCAP_VLAN_MTU | IFCAP_VLAN_HWTAGGING;
1369 	if (ifp->if_capabilities & IFCAP_HWCSUM)
1370 		ifp->if_capabilities |= IFCAP_VLAN_HWCSUM;
1371 	ifp->if_capenable = ifp->if_capabilities;
1372 #ifdef DEVICE_POLLING
1373 	ifp->if_capabilities |= IFCAP_POLLING;
1374 #endif
1375 	/*
1376 	 * Tell the upper layer(s) we support long frames.
1377 	 * Must appear after the call to ether_ifattach() because
1378 	 * ether_ifattach() sets ifi_hdrlen to the default value.
1379 	 */
1380 	ifp->if_data.ifi_hdrlen = sizeof(struct ether_vlan_header);
1381 
1382 #ifdef RE_DIAG
1383 	/*
1384 	 * Perform hardware diagnostic on the original RTL8169.
1385 	 * Some 32-bit cards were incorrectly wired and would
1386 	 * malfunction if plugged into a 64-bit slot.
1387 	 */
1388 
1389 	if (hwrev == RL_HWREV_8169) {
1390 		error = re_diag(sc);
1391 		if (error) {
1392 			device_printf(dev,
1393 		    	"attach aborted due to hardware diag failure\n");
1394 			ether_ifdetach(ifp);
1395 			goto fail;
1396 		}
1397 	}
1398 #endif
1399 
1400 	/* Hook interrupt last to avoid having to lock softc */
1401 	if (sc->rl_msi == 0)
1402 		error = bus_setup_intr(dev, sc->rl_irq[0],
1403 		    INTR_TYPE_NET | INTR_MPSAFE, re_intr, NULL, sc,
1404 		    &sc->rl_intrhand[0]);
1405 	else {
1406 		for (i = 0; i < RL_MSI_MESSAGES; i++) {
1407 			error = bus_setup_intr(dev, sc->rl_irq[i],
1408 			    INTR_TYPE_NET | INTR_MPSAFE, re_intr, NULL, sc,
1409 		    	    &sc->rl_intrhand[i]);
1410 			if (error != 0)
1411 				break;
1412 		}
1413 	}
1414 	if (error) {
1415 		device_printf(dev, "couldn't set up irq\n");
1416 		ether_ifdetach(ifp);
1417 	}
1418 
1419 fail:
1420 
1421 	if (error)
1422 		re_detach(dev);
1423 
1424 	return (error);
1425 }
1426 
1427 /*
1428  * Shutdown hardware and free up resources. This can be called any
1429  * time after the mutex has been initialized. It is called in both
1430  * the error case in attach and the normal detach case so it needs
1431  * to be careful about only freeing resources that have actually been
1432  * allocated.
1433  */
1434 static int
1435 re_detach(dev)
1436 	device_t		dev;
1437 {
1438 	struct rl_softc		*sc;
1439 	struct ifnet		*ifp;
1440 	int			i, rid;
1441 
1442 	sc = device_get_softc(dev);
1443 	ifp = sc->rl_ifp;
1444 	KASSERT(mtx_initialized(&sc->rl_mtx), ("re mutex not initialized"));
1445 
1446 #ifdef DEVICE_POLLING
1447 	if (ifp->if_capenable & IFCAP_POLLING)
1448 		ether_poll_deregister(ifp);
1449 #endif
1450 	/* These should only be active if attach succeeded */
1451 	if (device_is_attached(dev)) {
1452 		RL_LOCK(sc);
1453 #if 0
1454 		sc->suspended = 1;
1455 #endif
1456 		re_stop(sc);
1457 		RL_UNLOCK(sc);
1458 		callout_drain(&sc->rl_stat_callout);
1459 		taskqueue_drain(taskqueue_fast, &sc->rl_inttask);
1460 		taskqueue_drain(taskqueue_fast, &sc->rl_txtask);
1461 		/*
1462 		 * Force off the IFF_UP flag here, in case someone
1463 		 * still had a BPF descriptor attached to this
1464 		 * interface. If they do, ether_ifdetach() will cause
1465 		 * the BPF code to try and clear the promisc mode
1466 		 * flag, which will bubble down to re_ioctl(),
1467 		 * which will try to call re_init() again. This will
1468 		 * turn the NIC back on and restart the MII ticker,
1469 		 * which will panic the system when the kernel tries
1470 		 * to invoke the re_tick() function that isn't there
1471 		 * anymore.
1472 		 */
1473 		ifp->if_flags &= ~IFF_UP;
1474 		ether_ifdetach(ifp);
1475 	}
1476 	if (sc->rl_miibus)
1477 		device_delete_child(dev, sc->rl_miibus);
1478 	bus_generic_detach(dev);
1479 
1480 	/*
1481 	 * The rest is resource deallocation, so we should already be
1482 	 * stopped here.
1483 	 */
1484 
1485 	for (i = 0; i < RL_MSI_MESSAGES; i++) {
1486 		if (sc->rl_intrhand[i] != NULL) {
1487 			bus_teardown_intr(dev, sc->rl_irq[i],
1488 			    sc->rl_intrhand[i]);
1489 			sc->rl_intrhand[i] = NULL;
1490 		}
1491 	}
1492 	if (ifp != NULL)
1493 		if_free(ifp);
1494 	if (sc->rl_msi == 0) {
1495 		if (sc->rl_irq[0] != NULL) {
1496 			bus_release_resource(dev, SYS_RES_IRQ, 0,
1497 			    sc->rl_irq[0]);
1498 			sc->rl_irq[0] = NULL;
1499 		}
1500 	} else {
1501 		for (i = 0, rid = 1; i < RL_MSI_MESSAGES; i++, rid++) {
1502 			if (sc->rl_irq[i] != NULL) {
1503 				bus_release_resource(dev, SYS_RES_IRQ, rid,
1504 				    sc->rl_irq[i]);
1505 				sc->rl_irq[i] = NULL;
1506 			}
1507 		}
1508 		pci_release_msi(dev);
1509 	}
1510 	if (sc->rl_res)
1511 		bus_release_resource(dev, RL_RES, RL_RID, sc->rl_res);
1512 
1513 	/* Unload and free the RX DMA ring memory and map */
1514 
1515 	if (sc->rl_ldata.rl_rx_list_tag) {
1516 		bus_dmamap_unload(sc->rl_ldata.rl_rx_list_tag,
1517 		    sc->rl_ldata.rl_rx_list_map);
1518 		bus_dmamem_free(sc->rl_ldata.rl_rx_list_tag,
1519 		    sc->rl_ldata.rl_rx_list,
1520 		    sc->rl_ldata.rl_rx_list_map);
1521 		bus_dma_tag_destroy(sc->rl_ldata.rl_rx_list_tag);
1522 	}
1523 
1524 	/* Unload and free the TX DMA ring memory and map */
1525 
1526 	if (sc->rl_ldata.rl_tx_list_tag) {
1527 		bus_dmamap_unload(sc->rl_ldata.rl_tx_list_tag,
1528 		    sc->rl_ldata.rl_tx_list_map);
1529 		bus_dmamem_free(sc->rl_ldata.rl_tx_list_tag,
1530 		    sc->rl_ldata.rl_tx_list,
1531 		    sc->rl_ldata.rl_tx_list_map);
1532 		bus_dma_tag_destroy(sc->rl_ldata.rl_tx_list_tag);
1533 	}
1534 
1535 	/* Destroy all the RX and TX buffer maps */
1536 
1537 	if (sc->rl_ldata.rl_mtag) {
1538 		for (i = 0; i < RL_TX_DESC_CNT; i++)
1539 			bus_dmamap_destroy(sc->rl_ldata.rl_mtag,
1540 			    sc->rl_ldata.rl_tx_dmamap[i]);
1541 		for (i = 0; i < RL_RX_DESC_CNT; i++)
1542 			bus_dmamap_destroy(sc->rl_ldata.rl_mtag,
1543 			    sc->rl_ldata.rl_rx_dmamap[i]);
1544 		bus_dma_tag_destroy(sc->rl_ldata.rl_mtag);
1545 	}
1546 
1547 	/* Unload and free the stats buffer and map */
1548 
1549 	if (sc->rl_ldata.rl_stag) {
1550 		bus_dmamap_unload(sc->rl_ldata.rl_stag,
1551 		    sc->rl_ldata.rl_rx_list_map);
1552 		bus_dmamem_free(sc->rl_ldata.rl_stag,
1553 		    sc->rl_ldata.rl_stats,
1554 		    sc->rl_ldata.rl_smap);
1555 		bus_dma_tag_destroy(sc->rl_ldata.rl_stag);
1556 	}
1557 
1558 	if (sc->rl_parent_tag)
1559 		bus_dma_tag_destroy(sc->rl_parent_tag);
1560 
1561 	mtx_destroy(&sc->rl_mtx);
1562 
1563 	return (0);
1564 }
1565 
1566 static int
1567 re_newbuf(sc, idx, m)
1568 	struct rl_softc		*sc;
1569 	int			idx;
1570 	struct mbuf		*m;
1571 {
1572 	struct rl_dmaload_arg	arg;
1573 	struct mbuf		*n = NULL;
1574 	int			error;
1575 
1576 	if (m == NULL) {
1577 		n = m_getcl(M_DONTWAIT, MT_DATA, M_PKTHDR);
1578 		if (n == NULL)
1579 			return (ENOBUFS);
1580 		m = n;
1581 	} else
1582 		m->m_data = m->m_ext.ext_buf;
1583 
1584 	m->m_len = m->m_pkthdr.len = MCLBYTES;
1585 #ifdef RE_FIXUP_RX
1586 	/*
1587 	 * This is part of an evil trick to deal with non-x86 platforms.
1588 	 * The RealTek chip requires RX buffers to be aligned on 64-bit
1589 	 * boundaries, but that will hose non-x86 machines. To get around
1590 	 * this, we leave some empty space at the start of each buffer
1591 	 * and for non-x86 hosts, we copy the buffer back six bytes
1592 	 * to achieve word alignment. This is slightly more efficient
1593 	 * than allocating a new buffer, copying the contents, and
1594 	 * discarding the old buffer.
1595 	 */
1596 	m_adj(m, RE_ETHER_ALIGN);
1597 #endif
1598 	arg.rl_idx = idx;
1599 	arg.rl_maxsegs = 1;
1600 	arg.rl_flags = 0;
1601 	arg.rl_ring = sc->rl_ldata.rl_rx_list;
1602 
1603 	error = bus_dmamap_load_mbuf(sc->rl_ldata.rl_mtag,
1604 	    sc->rl_ldata.rl_rx_dmamap[idx], m, re_dma_map_desc,
1605 	    &arg, BUS_DMA_NOWAIT);
1606 	if (error || arg.rl_maxsegs != 1) {
1607 		if (n != NULL)
1608 			m_freem(n);
1609 		if (arg.rl_maxsegs == 0)
1610 			bus_dmamap_unload(sc->rl_ldata.rl_mtag,
1611 			    sc->rl_ldata.rl_rx_dmamap[idx]);
1612 		return (ENOMEM);
1613 	}
1614 
1615 	sc->rl_ldata.rl_rx_list[idx].rl_cmdstat |= htole32(RL_RDESC_CMD_OWN);
1616 	sc->rl_ldata.rl_rx_mbuf[idx] = m;
1617 
1618 	bus_dmamap_sync(sc->rl_ldata.rl_mtag,
1619 	    sc->rl_ldata.rl_rx_dmamap[idx],
1620 	    BUS_DMASYNC_PREREAD);
1621 
1622 	return (0);
1623 }
1624 
1625 #ifdef RE_FIXUP_RX
1626 static __inline void
1627 re_fixup_rx(m)
1628 	struct mbuf		*m;
1629 {
1630 	int                     i;
1631 	uint16_t                *src, *dst;
1632 
1633 	src = mtod(m, uint16_t *);
1634 	dst = src - (RE_ETHER_ALIGN - ETHER_ALIGN) / sizeof *src;
1635 
1636 	for (i = 0; i < (m->m_len / sizeof(uint16_t) + 1); i++)
1637 		*dst++ = *src++;
1638 
1639 	m->m_data -= RE_ETHER_ALIGN - ETHER_ALIGN;
1640 
1641 	return;
1642 }
1643 #endif
1644 
1645 static int
1646 re_tx_list_init(sc)
1647 	struct rl_softc		*sc;
1648 {
1649 
1650 	RL_LOCK_ASSERT(sc);
1651 
1652 	bzero ((char *)sc->rl_ldata.rl_tx_list, RL_TX_LIST_SZ);
1653 	bzero ((char *)&sc->rl_ldata.rl_tx_mbuf,
1654 	    (RL_TX_DESC_CNT * sizeof(struct mbuf *)));
1655 
1656 	bus_dmamap_sync(sc->rl_ldata.rl_tx_list_tag,
1657 	    sc->rl_ldata.rl_tx_list_map, BUS_DMASYNC_PREWRITE);
1658 	sc->rl_ldata.rl_tx_prodidx = 0;
1659 	sc->rl_ldata.rl_tx_considx = 0;
1660 	sc->rl_ldata.rl_tx_free = RL_TX_DESC_CNT;
1661 
1662 	return (0);
1663 }
1664 
1665 static int
1666 re_rx_list_init(sc)
1667 	struct rl_softc		*sc;
1668 {
1669 	int			i;
1670 
1671 	bzero ((char *)sc->rl_ldata.rl_rx_list, RL_RX_LIST_SZ);
1672 	bzero ((char *)&sc->rl_ldata.rl_rx_mbuf,
1673 	    (RL_RX_DESC_CNT * sizeof(struct mbuf *)));
1674 
1675 	for (i = 0; i < RL_RX_DESC_CNT; i++) {
1676 		if (re_newbuf(sc, i, NULL) == ENOBUFS)
1677 			return (ENOBUFS);
1678 	}
1679 
1680 	/* Flush the RX descriptors */
1681 
1682 	bus_dmamap_sync(sc->rl_ldata.rl_rx_list_tag,
1683 	    sc->rl_ldata.rl_rx_list_map,
1684 	    BUS_DMASYNC_PREWRITE|BUS_DMASYNC_PREREAD);
1685 
1686 	sc->rl_ldata.rl_rx_prodidx = 0;
1687 	sc->rl_head = sc->rl_tail = NULL;
1688 
1689 	return (0);
1690 }
1691 
1692 /*
1693  * RX handler for C+ and 8169. For the gigE chips, we support
1694  * the reception of jumbo frames that have been fragmented
1695  * across multiple 2K mbuf cluster buffers.
1696  */
1697 static int
1698 re_rxeof(sc)
1699 	struct rl_softc		*sc;
1700 {
1701 	struct mbuf		*m;
1702 	struct ifnet		*ifp;
1703 	int			i, total_len;
1704 	struct rl_desc		*cur_rx;
1705 	u_int32_t		rxstat, rxvlan;
1706 	int			maxpkt = 16;
1707 
1708 	RL_LOCK_ASSERT(sc);
1709 
1710 	ifp = sc->rl_ifp;
1711 	i = sc->rl_ldata.rl_rx_prodidx;
1712 
1713 	/* Invalidate the descriptor memory */
1714 
1715 	bus_dmamap_sync(sc->rl_ldata.rl_rx_list_tag,
1716 	    sc->rl_ldata.rl_rx_list_map,
1717 	    BUS_DMASYNC_POSTREAD);
1718 
1719 	while (!RL_OWN(&sc->rl_ldata.rl_rx_list[i]) && maxpkt) {
1720 		cur_rx = &sc->rl_ldata.rl_rx_list[i];
1721 		m = sc->rl_ldata.rl_rx_mbuf[i];
1722 		total_len = RL_RXBYTES(cur_rx);
1723 		rxstat = le32toh(cur_rx->rl_cmdstat);
1724 		rxvlan = le32toh(cur_rx->rl_vlanctl);
1725 
1726 		/* Invalidate the RX mbuf and unload its map */
1727 
1728 		bus_dmamap_sync(sc->rl_ldata.rl_mtag,
1729 		    sc->rl_ldata.rl_rx_dmamap[i],
1730 		    BUS_DMASYNC_POSTWRITE);
1731 		bus_dmamap_unload(sc->rl_ldata.rl_mtag,
1732 		    sc->rl_ldata.rl_rx_dmamap[i]);
1733 
1734 		if (!(rxstat & RL_RDESC_STAT_EOF)) {
1735 			m->m_len = RE_RX_DESC_BUFLEN;
1736 			if (sc->rl_head == NULL)
1737 				sc->rl_head = sc->rl_tail = m;
1738 			else {
1739 				m->m_flags &= ~M_PKTHDR;
1740 				sc->rl_tail->m_next = m;
1741 				sc->rl_tail = m;
1742 			}
1743 			re_newbuf(sc, i, NULL);
1744 			RL_DESC_INC(i);
1745 			continue;
1746 		}
1747 
1748 		/*
1749 		 * NOTE: for the 8139C+, the frame length field
1750 		 * is always 12 bits in size, but for the gigE chips,
1751 		 * it is 13 bits (since the max RX frame length is 16K).
1752 		 * Unfortunately, all 32 bits in the status word
1753 		 * were already used, so to make room for the extra
1754 		 * length bit, RealTek took out the 'frame alignment
1755 		 * error' bit and shifted the other status bits
1756 		 * over one slot. The OWN, EOR, FS and LS bits are
1757 		 * still in the same places. We have already extracted
1758 		 * the frame length and checked the OWN bit, so rather
1759 		 * than using an alternate bit mapping, we shift the
1760 		 * status bits one space to the right so we can evaluate
1761 		 * them using the 8169 status as though it was in the
1762 		 * same format as that of the 8139C+.
1763 		 */
1764 		if (sc->rl_type == RL_8169)
1765 			rxstat >>= 1;
1766 
1767 		/*
1768 		 * if total_len > 2^13-1, both _RXERRSUM and _GIANT will be
1769 		 * set, but if CRC is clear, it will still be a valid frame.
1770 		 */
1771 		if (rxstat & RL_RDESC_STAT_RXERRSUM && !(total_len > 8191 &&
1772 		    (rxstat & RL_RDESC_STAT_ERRS) == RL_RDESC_STAT_GIANT)) {
1773 			ifp->if_ierrors++;
1774 			/*
1775 			 * If this is part of a multi-fragment packet,
1776 			 * discard all the pieces.
1777 			 */
1778 			if (sc->rl_head != NULL) {
1779 				m_freem(sc->rl_head);
1780 				sc->rl_head = sc->rl_tail = NULL;
1781 			}
1782 			re_newbuf(sc, i, m);
1783 			RL_DESC_INC(i);
1784 			continue;
1785 		}
1786 
1787 		/*
1788 		 * If allocating a replacement mbuf fails,
1789 		 * reload the current one.
1790 		 */
1791 
1792 		if (re_newbuf(sc, i, NULL)) {
1793 			ifp->if_ierrors++;
1794 			if (sc->rl_head != NULL) {
1795 				m_freem(sc->rl_head);
1796 				sc->rl_head = sc->rl_tail = NULL;
1797 			}
1798 			re_newbuf(sc, i, m);
1799 			RL_DESC_INC(i);
1800 			continue;
1801 		}
1802 
1803 		RL_DESC_INC(i);
1804 
1805 		if (sc->rl_head != NULL) {
1806 			m->m_len = total_len % RE_RX_DESC_BUFLEN;
1807 			if (m->m_len == 0)
1808 				m->m_len = RE_RX_DESC_BUFLEN;
1809 			/*
1810 			 * Special case: if there's 4 bytes or less
1811 			 * in this buffer, the mbuf can be discarded:
1812 			 * the last 4 bytes is the CRC, which we don't
1813 			 * care about anyway.
1814 			 */
1815 			if (m->m_len <= ETHER_CRC_LEN) {
1816 				sc->rl_tail->m_len -=
1817 				    (ETHER_CRC_LEN - m->m_len);
1818 				m_freem(m);
1819 			} else {
1820 				m->m_len -= ETHER_CRC_LEN;
1821 				m->m_flags &= ~M_PKTHDR;
1822 				sc->rl_tail->m_next = m;
1823 			}
1824 			m = sc->rl_head;
1825 			sc->rl_head = sc->rl_tail = NULL;
1826 			m->m_pkthdr.len = total_len - ETHER_CRC_LEN;
1827 		} else
1828 			m->m_pkthdr.len = m->m_len =
1829 			    (total_len - ETHER_CRC_LEN);
1830 
1831 #ifdef RE_FIXUP_RX
1832 		re_fixup_rx(m);
1833 #endif
1834 		ifp->if_ipackets++;
1835 		m->m_pkthdr.rcvif = ifp;
1836 
1837 		/* Do RX checksumming if enabled */
1838 
1839 		if (ifp->if_capenable & IFCAP_RXCSUM) {
1840 
1841 			/* Check IP header checksum */
1842 			if (rxstat & RL_RDESC_STAT_PROTOID)
1843 				m->m_pkthdr.csum_flags |= CSUM_IP_CHECKED;
1844 			if (!(rxstat & RL_RDESC_STAT_IPSUMBAD))
1845 				m->m_pkthdr.csum_flags |= CSUM_IP_VALID;
1846 
1847 			/* Check TCP/UDP checksum */
1848 			if ((RL_TCPPKT(rxstat) &&
1849 			    !(rxstat & RL_RDESC_STAT_TCPSUMBAD)) ||
1850 			    (RL_UDPPKT(rxstat) &&
1851 			    !(rxstat & RL_RDESC_STAT_UDPSUMBAD))) {
1852 				m->m_pkthdr.csum_flags |=
1853 				    CSUM_DATA_VALID|CSUM_PSEUDO_HDR;
1854 				m->m_pkthdr.csum_data = 0xffff;
1855 			}
1856 		}
1857 		maxpkt--;
1858 		if (rxvlan & RL_RDESC_VLANCTL_TAG) {
1859 			m->m_pkthdr.ether_vtag =
1860 			    ntohs((rxvlan & RL_RDESC_VLANCTL_DATA));
1861 			m->m_flags |= M_VLANTAG;
1862 		}
1863 		RL_UNLOCK(sc);
1864 		(*ifp->if_input)(ifp, m);
1865 		RL_LOCK(sc);
1866 	}
1867 
1868 	/* Flush the RX DMA ring */
1869 
1870 	bus_dmamap_sync(sc->rl_ldata.rl_rx_list_tag,
1871 	    sc->rl_ldata.rl_rx_list_map,
1872 	    BUS_DMASYNC_PREWRITE|BUS_DMASYNC_PREREAD);
1873 
1874 	sc->rl_ldata.rl_rx_prodidx = i;
1875 
1876 	if (maxpkt)
1877 		return(EAGAIN);
1878 
1879 	return(0);
1880 }
1881 
1882 static void
1883 re_txeof(sc)
1884 	struct rl_softc		*sc;
1885 {
1886 	struct ifnet		*ifp;
1887 	u_int32_t		txstat;
1888 	int			idx;
1889 
1890 	ifp = sc->rl_ifp;
1891 	idx = sc->rl_ldata.rl_tx_considx;
1892 
1893 	/* Invalidate the TX descriptor list */
1894 	bus_dmamap_sync(sc->rl_ldata.rl_tx_list_tag,
1895 	    sc->rl_ldata.rl_tx_list_map,
1896 	    BUS_DMASYNC_POSTREAD);
1897 
1898 	while (sc->rl_ldata.rl_tx_free < RL_TX_DESC_CNT) {
1899 		txstat = le32toh(sc->rl_ldata.rl_tx_list[idx].rl_cmdstat);
1900 		if (txstat & RL_TDESC_CMD_OWN)
1901 			break;
1902 
1903 		sc->rl_ldata.rl_tx_list[idx].rl_bufaddr_lo = 0;
1904 
1905 		/*
1906 		 * We only stash mbufs in the last descriptor
1907 		 * in a fragment chain, which also happens to
1908 		 * be the only place where the TX status bits
1909 		 * are valid.
1910 		 */
1911 		if (txstat & RL_TDESC_CMD_EOF) {
1912 			m_freem(sc->rl_ldata.rl_tx_mbuf[idx]);
1913 			sc->rl_ldata.rl_tx_mbuf[idx] = NULL;
1914 			bus_dmamap_unload(sc->rl_ldata.rl_mtag,
1915 			    sc->rl_ldata.rl_tx_dmamap[idx]);
1916 			if (txstat & (RL_TDESC_STAT_EXCESSCOL|
1917 			    RL_TDESC_STAT_COLCNT))
1918 				ifp->if_collisions++;
1919 			if (txstat & RL_TDESC_STAT_TXERRSUM)
1920 				ifp->if_oerrors++;
1921 			else
1922 				ifp->if_opackets++;
1923 		}
1924 		sc->rl_ldata.rl_tx_free++;
1925 		RL_DESC_INC(idx);
1926 	}
1927 	sc->rl_ldata.rl_tx_considx = idx;
1928 
1929 	/* No changes made to the TX ring, so no flush needed */
1930 
1931 	if (sc->rl_ldata.rl_tx_free > RL_TX_DESC_THLD)
1932 		ifp->if_drv_flags &= ~IFF_DRV_OACTIVE;
1933 
1934 	if (sc->rl_ldata.rl_tx_free < RL_TX_DESC_CNT) {
1935 		/*
1936 		 * Some chips will ignore a second TX request issued
1937 		 * while an existing transmission is in progress. If
1938 		 * the transmitter goes idle but there are still
1939 		 * packets waiting to be sent, we need to restart the
1940 		 * channel here to flush them out. This only seems to
1941 		 * be required with the PCIe devices.
1942 		 */
1943 		CSR_WRITE_1(sc, sc->rl_txstart, RL_TXSTART_START);
1944 
1945 #ifdef RE_TX_MODERATION
1946 		/*
1947 		 * If not all descriptors have been reaped yet, reload
1948 		 * the timer so that we will eventually get another
1949 		 * interrupt that will cause us to re-enter this routine.
1950 		 * This is done in case the transmitter has gone idle.
1951 		 */
1952 		CSR_WRITE_4(sc, RL_TIMERCNT, 1);
1953 #endif
1954 	} else
1955 		sc->rl_watchdog_timer = 0;
1956 }
1957 
1958 static void
1959 re_tick(xsc)
1960 	void			*xsc;
1961 {
1962 	struct rl_softc		*sc;
1963 	struct mii_data		*mii;
1964 	struct ifnet		*ifp;
1965 
1966 	sc = xsc;
1967 	ifp = sc->rl_ifp;
1968 
1969 	RL_LOCK_ASSERT(sc);
1970 
1971 	re_watchdog(sc);
1972 
1973 	mii = device_get_softc(sc->rl_miibus);
1974 	mii_tick(mii);
1975 	if (sc->rl_link) {
1976 		if (!(mii->mii_media_status & IFM_ACTIVE))
1977 			sc->rl_link = 0;
1978 	} else {
1979 		if (mii->mii_media_status & IFM_ACTIVE &&
1980 		    IFM_SUBTYPE(mii->mii_media_active) != IFM_NONE) {
1981 			sc->rl_link = 1;
1982 			if (!IFQ_DRV_IS_EMPTY(&ifp->if_snd))
1983 				taskqueue_enqueue_fast(taskqueue_fast,
1984 				    &sc->rl_txtask);
1985 		}
1986 	}
1987 
1988 	callout_reset(&sc->rl_stat_callout, hz, re_tick, sc);
1989 }
1990 
1991 #ifdef DEVICE_POLLING
1992 static void
1993 re_poll(struct ifnet *ifp, enum poll_cmd cmd, int count)
1994 {
1995 	struct rl_softc *sc = ifp->if_softc;
1996 
1997 	RL_LOCK(sc);
1998 	if (ifp->if_drv_flags & IFF_DRV_RUNNING)
1999 		re_poll_locked(ifp, cmd, count);
2000 	RL_UNLOCK(sc);
2001 }
2002 
2003 static void
2004 re_poll_locked(struct ifnet *ifp, enum poll_cmd cmd, int count)
2005 {
2006 	struct rl_softc *sc = ifp->if_softc;
2007 
2008 	RL_LOCK_ASSERT(sc);
2009 
2010 	sc->rxcycles = count;
2011 	re_rxeof(sc);
2012 	re_txeof(sc);
2013 
2014 	if (!IFQ_DRV_IS_EMPTY(&ifp->if_snd))
2015 		taskqueue_enqueue_fast(taskqueue_fast, &sc->rl_txtask);
2016 
2017 	if (cmd == POLL_AND_CHECK_STATUS) { /* also check status register */
2018 		u_int16_t       status;
2019 
2020 		status = CSR_READ_2(sc, RL_ISR);
2021 		if (status == 0xffff)
2022 			return;
2023 		if (status)
2024 			CSR_WRITE_2(sc, RL_ISR, status);
2025 
2026 		/*
2027 		 * XXX check behaviour on receiver stalls.
2028 		 */
2029 
2030 		if (status & RL_ISR_SYSTEM_ERR) {
2031 			re_reset(sc);
2032 			re_init_locked(sc);
2033 		}
2034 	}
2035 }
2036 #endif /* DEVICE_POLLING */
2037 
2038 static int
2039 re_intr(arg)
2040 	void			*arg;
2041 {
2042 	struct rl_softc		*sc;
2043 	uint16_t		status;
2044 
2045 	sc = arg;
2046 
2047 	status = CSR_READ_2(sc, RL_ISR);
2048 	if (status == 0xFFFF || (status & RL_INTRS_CPLUS) == 0)
2049                 return (FILTER_STRAY);
2050 	CSR_WRITE_2(sc, RL_IMR, 0);
2051 
2052 	taskqueue_enqueue_fast(taskqueue_fast, &sc->rl_inttask);
2053 
2054 	return (FILTER_HANDLED);
2055 }
2056 
2057 static void
2058 re_int_task(arg, npending)
2059 	void			*arg;
2060 	int			npending;
2061 {
2062 	struct rl_softc		*sc;
2063 	struct ifnet		*ifp;
2064 	u_int16_t		status;
2065 	int			rval = 0;
2066 
2067 	sc = arg;
2068 	ifp = sc->rl_ifp;
2069 
2070 	RL_LOCK(sc);
2071 
2072 	status = CSR_READ_2(sc, RL_ISR);
2073         CSR_WRITE_2(sc, RL_ISR, status);
2074 
2075 	if (sc->suspended || !(ifp->if_flags & IFF_UP)) {
2076 		RL_UNLOCK(sc);
2077 		return;
2078 	}
2079 
2080 #ifdef DEVICE_POLLING
2081 	if  (ifp->if_capenable & IFCAP_POLLING) {
2082 		RL_UNLOCK(sc);
2083 		return;
2084 	}
2085 #endif
2086 
2087 	if (status & (RL_ISR_RX_OK|RL_ISR_RX_ERR|RL_ISR_FIFO_OFLOW))
2088 		rval = re_rxeof(sc);
2089 
2090 #ifdef RE_TX_MODERATION
2091 	if (status & (RL_ISR_TIMEOUT_EXPIRED|
2092 #else
2093 	if (status & (RL_ISR_TX_OK|
2094 #endif
2095 	    RL_ISR_TX_ERR|RL_ISR_TX_DESC_UNAVAIL))
2096 		re_txeof(sc);
2097 
2098 	if (status & RL_ISR_SYSTEM_ERR) {
2099 		re_reset(sc);
2100 		re_init_locked(sc);
2101 	}
2102 
2103 	if (status & RL_ISR_LINKCHG) {
2104 		callout_stop(&sc->rl_stat_callout);
2105 		re_tick(sc);
2106 	}
2107 
2108 	if (!IFQ_DRV_IS_EMPTY(&ifp->if_snd))
2109 		taskqueue_enqueue_fast(taskqueue_fast, &sc->rl_txtask);
2110 
2111 	RL_UNLOCK(sc);
2112 
2113         if ((CSR_READ_2(sc, RL_ISR) & RL_INTRS_CPLUS) || rval) {
2114 		taskqueue_enqueue_fast(taskqueue_fast, &sc->rl_inttask);
2115 		return;
2116 	}
2117 
2118 	CSR_WRITE_2(sc, RL_IMR, RL_INTRS_CPLUS);
2119 
2120 	return;
2121 }
2122 
2123 static int
2124 re_encap(sc, m_head, idx)
2125 	struct rl_softc		*sc;
2126 	struct mbuf		**m_head;
2127 	int			*idx;
2128 {
2129 	struct mbuf		*m_new = NULL;
2130 	struct rl_dmaload_arg	arg;
2131 	bus_dmamap_t		map;
2132 	int			error;
2133 
2134 	RL_LOCK_ASSERT(sc);
2135 
2136 	if (sc->rl_ldata.rl_tx_free <= RL_TX_DESC_THLD)
2137 		return (EFBIG);
2138 
2139 	/*
2140 	 * Set up checksum offload. Note: checksum offload bits must
2141 	 * appear in all descriptors of a multi-descriptor transmit
2142 	 * attempt. This is according to testing done with an 8169
2143 	 * chip. This is a requirement.
2144 	 */
2145 
2146 	arg.rl_flags = 0;
2147 
2148 	if (((*m_head)->m_pkthdr.csum_flags & CSUM_TSO) != 0)
2149 		arg.rl_flags = RL_TDESC_CMD_LGSEND |
2150 		    ((uint32_t)(*m_head)->m_pkthdr.tso_segsz <<
2151 		    RL_TDESC_CMD_MSSVAL_SHIFT);
2152 	else {
2153 		if ((*m_head)->m_pkthdr.csum_flags & CSUM_IP)
2154 			arg.rl_flags |= RL_TDESC_CMD_IPCSUM;
2155 		if ((*m_head)->m_pkthdr.csum_flags & CSUM_TCP)
2156 			arg.rl_flags |= RL_TDESC_CMD_TCPCSUM;
2157 		if ((*m_head)->m_pkthdr.csum_flags & CSUM_UDP)
2158 			arg.rl_flags |= RL_TDESC_CMD_UDPCSUM;
2159 	}
2160 
2161 	arg.rl_idx = *idx;
2162 	arg.rl_maxsegs = sc->rl_ldata.rl_tx_free;
2163 	if (arg.rl_maxsegs > RL_TX_DESC_THLD)
2164 		arg.rl_maxsegs -= RL_TX_DESC_THLD;
2165 	arg.rl_ring = sc->rl_ldata.rl_tx_list;
2166 
2167 	map = sc->rl_ldata.rl_tx_dmamap[*idx];
2168 
2169 	/*
2170 	 * With some of the RealTek chips, using the checksum offload
2171 	 * support in conjunction with the autopadding feature results
2172 	 * in the transmission of corrupt frames. For example, if we
2173 	 * need to send a really small IP fragment that's less than 60
2174 	 * bytes in size, and IP header checksumming is enabled, the
2175 	 * resulting ethernet frame that appears on the wire will
2176 	 * have garbled payload. To work around this, if TX checksum
2177 	 * offload is enabled, we always manually pad short frames out
2178 	 * to the minimum ethernet frame size. We do this by pretending
2179 	 * the mbuf chain has too many fragments so the coalescing code
2180 	 * below can assemble the packet into a single buffer that's
2181 	 * padded out to the mininum frame size.
2182 	 *
2183 	 * Note: this appears unnecessary for TCP, and doing it for TCP
2184 	 * with PCIe adapters seems to result in bad checksums.
2185 	 */
2186 
2187 	if (arg.rl_flags && !(arg.rl_flags & RL_TDESC_CMD_TCPCSUM) &&
2188             (*m_head)->m_pkthdr.len < RL_MIN_FRAMELEN)
2189 		error = EFBIG;
2190 	else
2191 		error = bus_dmamap_load_mbuf(sc->rl_ldata.rl_mtag, map,
2192 		    *m_head, re_dma_map_desc, &arg, BUS_DMA_NOWAIT);
2193 
2194 	if (error && error != EFBIG) {
2195 		device_printf(sc->rl_dev, "can't map mbuf (error %d)\n", error);
2196 		return (ENOBUFS);
2197 	}
2198 
2199 	/* Too many segments to map, coalesce into a single mbuf */
2200 
2201 	if (error || arg.rl_maxsegs == 0) {
2202 		if (arg.rl_maxsegs == 0)
2203 			bus_dmamap_unload(sc->rl_ldata.rl_mtag, map);
2204 		m_new = m_defrag(*m_head, M_DONTWAIT);
2205 		if (m_new == NULL) {
2206 			m_freem(*m_head);
2207 			*m_head = NULL;
2208 			return (ENOBUFS);
2209 		}
2210 		*m_head = m_new;
2211 
2212 		/*
2213 		 * Manually pad short frames, and zero the pad space
2214 		 * to avoid leaking data.
2215 		 */
2216 		if (m_new->m_pkthdr.len < RL_MIN_FRAMELEN) {
2217 			bzero(mtod(m_new, char *) + m_new->m_pkthdr.len,
2218 			    RL_MIN_FRAMELEN - m_new->m_pkthdr.len);
2219 			m_new->m_pkthdr.len += RL_MIN_FRAMELEN -
2220 			    m_new->m_pkthdr.len;
2221 			m_new->m_len = m_new->m_pkthdr.len;
2222 		}
2223 
2224 		/* Note that we'll run over RL_TX_DESC_THLD here. */
2225 		arg.rl_maxsegs = sc->rl_ldata.rl_tx_free;
2226 		error = bus_dmamap_load_mbuf(sc->rl_ldata.rl_mtag, map,
2227 		    *m_head, re_dma_map_desc, &arg, BUS_DMA_NOWAIT);
2228 		if (error || arg.rl_maxsegs == 0) {
2229 			device_printf(sc->rl_dev,
2230 			    "can't map defragmented mbuf (error %d)\n", error);
2231 			m_freem(m_new);
2232 			*m_head = NULL;
2233 			if (arg.rl_maxsegs == 0)
2234 				bus_dmamap_unload(sc->rl_ldata.rl_mtag, map);
2235 			return (EFBIG);
2236 		}
2237 	}
2238 
2239 	/*
2240 	 * Insure that the map for this transmission
2241 	 * is placed at the array index of the last descriptor
2242 	 * in this chain.  (Swap last and first dmamaps.)
2243 	 */
2244 	sc->rl_ldata.rl_tx_dmamap[*idx] =
2245 	    sc->rl_ldata.rl_tx_dmamap[arg.rl_idx];
2246 	sc->rl_ldata.rl_tx_dmamap[arg.rl_idx] = map;
2247 
2248 	sc->rl_ldata.rl_tx_mbuf[arg.rl_idx] = *m_head;
2249 	sc->rl_ldata.rl_tx_free -= arg.rl_maxsegs;
2250 
2251 	/*
2252 	 * Set up hardware VLAN tagging. Note: vlan tag info must
2253 	 * appear in the first descriptor of a multi-descriptor
2254 	 * transmission attempt.
2255 	 */
2256 	if ((*m_head)->m_flags & M_VLANTAG)
2257 		sc->rl_ldata.rl_tx_list[*idx].rl_vlanctl =
2258 		    htole32(htons((*m_head)->m_pkthdr.ether_vtag) |
2259 		    RL_TDESC_VLANCTL_TAG);
2260 
2261 	/* Transfer ownership of packet to the chip. */
2262 
2263 	sc->rl_ldata.rl_tx_list[arg.rl_idx].rl_cmdstat |=
2264 	    htole32(RL_TDESC_CMD_OWN);
2265 	if (*idx != arg.rl_idx)
2266 		sc->rl_ldata.rl_tx_list[*idx].rl_cmdstat |=
2267 		    htole32(RL_TDESC_CMD_OWN);
2268 
2269         RL_DESC_INC(arg.rl_idx);
2270 	*idx = arg.rl_idx;
2271 
2272 	return (0);
2273 }
2274 
2275 static void
2276 re_tx_task(arg, npending)
2277 	void			*arg;
2278 	int			npending;
2279 {
2280 	struct ifnet		*ifp;
2281 
2282 	ifp = arg;
2283 	re_start(ifp);
2284 
2285 	return;
2286 }
2287 
2288 /*
2289  * Main transmit routine for C+ and gigE NICs.
2290  */
2291 static void
2292 re_start(ifp)
2293 	struct ifnet		*ifp;
2294 {
2295 	struct rl_softc		*sc;
2296 	struct mbuf		*m_head = NULL;
2297 	int			idx, queued = 0;
2298 
2299 	sc = ifp->if_softc;
2300 
2301 	RL_LOCK(sc);
2302 
2303 	if (!sc->rl_link || ifp->if_drv_flags & IFF_DRV_OACTIVE) {
2304 		RL_UNLOCK(sc);
2305 		return;
2306 	}
2307 
2308 	idx = sc->rl_ldata.rl_tx_prodidx;
2309 
2310 	while (sc->rl_ldata.rl_tx_mbuf[idx] == NULL) {
2311 		IFQ_DRV_DEQUEUE(&ifp->if_snd, m_head);
2312 		if (m_head == NULL)
2313 			break;
2314 
2315 		if (re_encap(sc, &m_head, &idx)) {
2316 			if (m_head == NULL)
2317 				break;
2318 			IFQ_DRV_PREPEND(&ifp->if_snd, m_head);
2319 			ifp->if_drv_flags |= IFF_DRV_OACTIVE;
2320 			break;
2321 		}
2322 
2323 		/*
2324 		 * If there's a BPF listener, bounce a copy of this frame
2325 		 * to him.
2326 		 */
2327 		ETHER_BPF_MTAP(ifp, m_head);
2328 
2329 		queued++;
2330 	}
2331 
2332 	if (queued == 0) {
2333 #ifdef RE_TX_MODERATION
2334 		if (sc->rl_ldata.rl_tx_free != RL_TX_DESC_CNT)
2335 			CSR_WRITE_4(sc, RL_TIMERCNT, 1);
2336 #endif
2337 		RL_UNLOCK(sc);
2338 		return;
2339 	}
2340 
2341 	/* Flush the TX descriptors */
2342 
2343 	bus_dmamap_sync(sc->rl_ldata.rl_tx_list_tag,
2344 	    sc->rl_ldata.rl_tx_list_map,
2345 	    BUS_DMASYNC_PREWRITE|BUS_DMASYNC_PREREAD);
2346 
2347 	sc->rl_ldata.rl_tx_prodidx = idx;
2348 
2349 	CSR_WRITE_1(sc, sc->rl_txstart, RL_TXSTART_START);
2350 
2351 #ifdef RE_TX_MODERATION
2352 	/*
2353 	 * Use the countdown timer for interrupt moderation.
2354 	 * 'TX done' interrupts are disabled. Instead, we reset the
2355 	 * countdown timer, which will begin counting until it hits
2356 	 * the value in the TIMERINT register, and then trigger an
2357 	 * interrupt. Each time we write to the TIMERCNT register,
2358 	 * the timer count is reset to 0.
2359 	 */
2360 	CSR_WRITE_4(sc, RL_TIMERCNT, 1);
2361 #endif
2362 
2363 	/*
2364 	 * Set a timeout in case the chip goes out to lunch.
2365 	 */
2366 	sc->rl_watchdog_timer = 5;
2367 
2368 	RL_UNLOCK(sc);
2369 
2370 	return;
2371 }
2372 
2373 static void
2374 re_init(xsc)
2375 	void			*xsc;
2376 {
2377 	struct rl_softc		*sc = xsc;
2378 
2379 	RL_LOCK(sc);
2380 	re_init_locked(sc);
2381 	RL_UNLOCK(sc);
2382 }
2383 
2384 static void
2385 re_init_locked(sc)
2386 	struct rl_softc		*sc;
2387 {
2388 	struct ifnet		*ifp = sc->rl_ifp;
2389 	struct mii_data		*mii;
2390 	u_int32_t		rxcfg = 0;
2391 	union {
2392 		uint32_t align_dummy;
2393 		u_char eaddr[ETHER_ADDR_LEN];
2394         } eaddr;
2395 
2396 	RL_LOCK_ASSERT(sc);
2397 
2398 	mii = device_get_softc(sc->rl_miibus);
2399 
2400 	/*
2401 	 * Cancel pending I/O and free all RX/TX buffers.
2402 	 */
2403 	re_stop(sc);
2404 
2405 	/*
2406 	 * Enable C+ RX and TX mode, as well as VLAN stripping and
2407 	 * RX checksum offload. We must configure the C+ register
2408 	 * before all others.
2409 	 */
2410 	CSR_WRITE_2(sc, RL_CPLUS_CMD, RL_CPLUSCMD_RXENB|
2411 	    RL_CPLUSCMD_TXENB|RL_CPLUSCMD_PCI_MRW|
2412 	    RL_CPLUSCMD_VLANSTRIP|RL_CPLUSCMD_RXCSUM_ENB);
2413 
2414 	/*
2415 	 * Init our MAC address.  Even though the chipset
2416 	 * documentation doesn't mention it, we need to enter "Config
2417 	 * register write enable" mode to modify the ID registers.
2418 	 */
2419 	/* Copy MAC address on stack to align. */
2420 	bcopy(IF_LLADDR(ifp), eaddr.eaddr, ETHER_ADDR_LEN);
2421 	CSR_WRITE_1(sc, RL_EECMD, RL_EEMODE_WRITECFG);
2422 	CSR_WRITE_4(sc, RL_IDR0,
2423 	    htole32(*(u_int32_t *)(&eaddr.eaddr[0])));
2424 	CSR_WRITE_4(sc, RL_IDR4,
2425 	    htole32(*(u_int32_t *)(&eaddr.eaddr[4])));
2426 	CSR_WRITE_1(sc, RL_EECMD, RL_EEMODE_OFF);
2427 
2428 	/*
2429 	 * For C+ mode, initialize the RX descriptors and mbufs.
2430 	 */
2431 	re_rx_list_init(sc);
2432 	re_tx_list_init(sc);
2433 
2434 	/*
2435 	 * Load the addresses of the RX and TX lists into the chip.
2436 	 */
2437 
2438 	CSR_WRITE_4(sc, RL_RXLIST_ADDR_HI,
2439 	    RL_ADDR_HI(sc->rl_ldata.rl_rx_list_addr));
2440 	CSR_WRITE_4(sc, RL_RXLIST_ADDR_LO,
2441 	    RL_ADDR_LO(sc->rl_ldata.rl_rx_list_addr));
2442 
2443 	CSR_WRITE_4(sc, RL_TXLIST_ADDR_HI,
2444 	    RL_ADDR_HI(sc->rl_ldata.rl_tx_list_addr));
2445 	CSR_WRITE_4(sc, RL_TXLIST_ADDR_LO,
2446 	    RL_ADDR_LO(sc->rl_ldata.rl_tx_list_addr));
2447 
2448 	/*
2449 	 * Enable transmit and receive.
2450 	 */
2451 	CSR_WRITE_1(sc, RL_COMMAND, RL_CMD_TX_ENB|RL_CMD_RX_ENB);
2452 
2453 	/*
2454 	 * Set the initial TX and RX configuration.
2455 	 */
2456 	if (sc->rl_testmode) {
2457 		if (sc->rl_type == RL_8169)
2458 			CSR_WRITE_4(sc, RL_TXCFG,
2459 			    RL_TXCFG_CONFIG|RL_LOOPTEST_ON);
2460 		else
2461 			CSR_WRITE_4(sc, RL_TXCFG,
2462 			    RL_TXCFG_CONFIG|RL_LOOPTEST_ON_CPLUS);
2463 	} else
2464 		CSR_WRITE_4(sc, RL_TXCFG, RL_TXCFG_CONFIG);
2465 
2466 	CSR_WRITE_1(sc, RL_EARLY_TX_THRESH, 16);
2467 
2468 	CSR_WRITE_4(sc, RL_RXCFG, RL_RXCFG_CONFIG);
2469 
2470 	/* Set the individual bit to receive frames for this host only. */
2471 	rxcfg = CSR_READ_4(sc, RL_RXCFG);
2472 	rxcfg |= RL_RXCFG_RX_INDIV;
2473 
2474 	/* If we want promiscuous mode, set the allframes bit. */
2475 	if (ifp->if_flags & IFF_PROMISC)
2476 		rxcfg |= RL_RXCFG_RX_ALLPHYS;
2477 	else
2478 		rxcfg &= ~RL_RXCFG_RX_ALLPHYS;
2479 	CSR_WRITE_4(sc, RL_RXCFG, rxcfg);
2480 
2481 	/*
2482 	 * Set capture broadcast bit to capture broadcast frames.
2483 	 */
2484 	if (ifp->if_flags & IFF_BROADCAST)
2485 		rxcfg |= RL_RXCFG_RX_BROAD;
2486 	else
2487 		rxcfg &= ~RL_RXCFG_RX_BROAD;
2488 	CSR_WRITE_4(sc, RL_RXCFG, rxcfg);
2489 
2490 	/*
2491 	 * Program the multicast filter, if necessary.
2492 	 */
2493 	re_setmulti(sc);
2494 
2495 #ifdef DEVICE_POLLING
2496 	/*
2497 	 * Disable interrupts if we are polling.
2498 	 */
2499 	if (ifp->if_capenable & IFCAP_POLLING)
2500 		CSR_WRITE_2(sc, RL_IMR, 0);
2501 	else	/* otherwise ... */
2502 #endif
2503 
2504 	/*
2505 	 * Enable interrupts.
2506 	 */
2507 	if (sc->rl_testmode)
2508 		CSR_WRITE_2(sc, RL_IMR, 0);
2509 	else
2510 		CSR_WRITE_2(sc, RL_IMR, RL_INTRS_CPLUS);
2511 	CSR_WRITE_2(sc, RL_ISR, RL_INTRS_CPLUS);
2512 
2513 	/* Set initial TX threshold */
2514 	sc->rl_txthresh = RL_TX_THRESH_INIT;
2515 
2516 	/* Start RX/TX process. */
2517 	CSR_WRITE_4(sc, RL_MISSEDPKT, 0);
2518 #ifdef notdef
2519 	/* Enable receiver and transmitter. */
2520 	CSR_WRITE_1(sc, RL_COMMAND, RL_CMD_TX_ENB|RL_CMD_RX_ENB);
2521 #endif
2522 
2523 #ifdef RE_TX_MODERATION
2524 	/*
2525 	 * Initialize the timer interrupt register so that
2526 	 * a timer interrupt will be generated once the timer
2527 	 * reaches a certain number of ticks. The timer is
2528 	 * reloaded on each transmit. This gives us TX interrupt
2529 	 * moderation, which dramatically improves TX frame rate.
2530 	 */
2531 	if (sc->rl_type == RL_8169)
2532 		CSR_WRITE_4(sc, RL_TIMERINT_8169, 0x800);
2533 	else
2534 		CSR_WRITE_4(sc, RL_TIMERINT, 0x400);
2535 #endif
2536 
2537 	/*
2538 	 * For 8169 gigE NICs, set the max allowed RX packet
2539 	 * size so we can receive jumbo frames.
2540 	 */
2541 	if (sc->rl_type == RL_8169)
2542 		CSR_WRITE_2(sc, RL_MAXRXPKTLEN, 16383);
2543 
2544 	if (sc->rl_testmode)
2545 		return;
2546 
2547 	mii_mediachg(mii);
2548 
2549 	CSR_WRITE_1(sc, RL_CFG1, CSR_READ_1(sc, RL_CFG1) | RL_CFG1_DRVLOAD);
2550 
2551 	ifp->if_drv_flags |= IFF_DRV_RUNNING;
2552 	ifp->if_drv_flags &= ~IFF_DRV_OACTIVE;
2553 
2554 	sc->rl_link = 0;
2555 	sc->rl_watchdog_timer = 0;
2556 	callout_reset(&sc->rl_stat_callout, hz, re_tick, sc);
2557 }
2558 
2559 /*
2560  * Set media options.
2561  */
2562 static int
2563 re_ifmedia_upd(ifp)
2564 	struct ifnet		*ifp;
2565 {
2566 	struct rl_softc		*sc;
2567 	struct mii_data		*mii;
2568 
2569 	sc = ifp->if_softc;
2570 	mii = device_get_softc(sc->rl_miibus);
2571 	RL_LOCK(sc);
2572 	mii_mediachg(mii);
2573 	RL_UNLOCK(sc);
2574 
2575 	return (0);
2576 }
2577 
2578 /*
2579  * Report current media status.
2580  */
2581 static void
2582 re_ifmedia_sts(ifp, ifmr)
2583 	struct ifnet		*ifp;
2584 	struct ifmediareq	*ifmr;
2585 {
2586 	struct rl_softc		*sc;
2587 	struct mii_data		*mii;
2588 
2589 	sc = ifp->if_softc;
2590 	mii = device_get_softc(sc->rl_miibus);
2591 
2592 	RL_LOCK(sc);
2593 	mii_pollstat(mii);
2594 	RL_UNLOCK(sc);
2595 	ifmr->ifm_active = mii->mii_media_active;
2596 	ifmr->ifm_status = mii->mii_media_status;
2597 }
2598 
2599 static int
2600 re_ioctl(ifp, command, data)
2601 	struct ifnet		*ifp;
2602 	u_long			command;
2603 	caddr_t			data;
2604 {
2605 	struct rl_softc		*sc = ifp->if_softc;
2606 	struct ifreq		*ifr = (struct ifreq *) data;
2607 	struct mii_data		*mii;
2608 	int			error = 0;
2609 
2610 	switch (command) {
2611 	case SIOCSIFMTU:
2612 		RL_LOCK(sc);
2613 		if (ifr->ifr_mtu > RL_JUMBO_MTU)
2614 			error = EINVAL;
2615 		ifp->if_mtu = ifr->ifr_mtu;
2616 		RL_UNLOCK(sc);
2617 		break;
2618 	case SIOCSIFFLAGS:
2619 		RL_LOCK(sc);
2620 		if ((ifp->if_flags & IFF_UP) != 0) {
2621 			if ((ifp->if_drv_flags & IFF_DRV_RUNNING) != 0) {
2622 				if (((ifp->if_flags ^ sc->rl_if_flags)
2623 				    & IFF_PROMISC) != 0)
2624 					re_setmulti(sc);
2625 			} else
2626 				re_init_locked(sc);
2627 		} else {
2628 			if ((ifp->if_drv_flags & IFF_DRV_RUNNING) != 0)
2629 				re_stop(sc);
2630 		}
2631 		sc->rl_if_flags = ifp->if_flags;
2632 		RL_UNLOCK(sc);
2633 		break;
2634 	case SIOCADDMULTI:
2635 	case SIOCDELMULTI:
2636 		RL_LOCK(sc);
2637 		re_setmulti(sc);
2638 		RL_UNLOCK(sc);
2639 		break;
2640 	case SIOCGIFMEDIA:
2641 	case SIOCSIFMEDIA:
2642 		mii = device_get_softc(sc->rl_miibus);
2643 		error = ifmedia_ioctl(ifp, ifr, &mii->mii_media, command);
2644 		break;
2645 	case SIOCSIFCAP:
2646 	    {
2647 		int mask, reinit;
2648 
2649 		mask = ifr->ifr_reqcap ^ ifp->if_capenable;
2650 		reinit = 0;
2651 #ifdef DEVICE_POLLING
2652 		if (mask & IFCAP_POLLING) {
2653 			if (ifr->ifr_reqcap & IFCAP_POLLING) {
2654 				error = ether_poll_register(re_poll, ifp);
2655 				if (error)
2656 					return(error);
2657 				RL_LOCK(sc);
2658 				/* Disable interrupts */
2659 				CSR_WRITE_2(sc, RL_IMR, 0x0000);
2660 				ifp->if_capenable |= IFCAP_POLLING;
2661 				RL_UNLOCK(sc);
2662 			} else {
2663 				error = ether_poll_deregister(ifp);
2664 				/* Enable interrupts. */
2665 				RL_LOCK(sc);
2666 				CSR_WRITE_2(sc, RL_IMR, RL_INTRS_CPLUS);
2667 				ifp->if_capenable &= ~IFCAP_POLLING;
2668 				RL_UNLOCK(sc);
2669 			}
2670 		}
2671 #endif /* DEVICE_POLLING */
2672 		if (mask & IFCAP_HWCSUM) {
2673 			ifp->if_capenable ^= IFCAP_HWCSUM;
2674 			if (ifp->if_capenable & IFCAP_TXCSUM)
2675 				ifp->if_hwassist |= RE_CSUM_FEATURES;
2676 			else
2677 				ifp->if_hwassist &= ~RE_CSUM_FEATURES;
2678 			reinit = 1;
2679 		}
2680 		if (mask & IFCAP_VLAN_HWTAGGING) {
2681 			ifp->if_capenable ^= IFCAP_VLAN_HWTAGGING;
2682 			reinit = 1;
2683 		}
2684 		if (mask & IFCAP_TSO4) {
2685 			ifp->if_capenable ^= IFCAP_TSO4;
2686 			if ((IFCAP_TSO4 & ifp->if_capenable) &&
2687 			    (IFCAP_TSO4 & ifp->if_capabilities))
2688 				ifp->if_hwassist |= CSUM_TSO;
2689 			else
2690 				ifp->if_hwassist &= ~CSUM_TSO;
2691 		}
2692 		if (reinit && ifp->if_drv_flags & IFF_DRV_RUNNING)
2693 			re_init(sc);
2694 		VLAN_CAPABILITIES(ifp);
2695 	    }
2696 		break;
2697 	default:
2698 		error = ether_ioctl(ifp, command, data);
2699 		break;
2700 	}
2701 
2702 	return (error);
2703 }
2704 
2705 static void
2706 re_watchdog(sc)
2707 	struct rl_softc		*sc;
2708 {
2709 
2710 	RL_LOCK_ASSERT(sc);
2711 
2712 	if (sc->rl_watchdog_timer == 0 || --sc->rl_watchdog_timer != 0)
2713 		return;
2714 
2715 	device_printf(sc->rl_dev, "watchdog timeout\n");
2716 	sc->rl_ifp->if_oerrors++;
2717 
2718 	re_txeof(sc);
2719 	re_rxeof(sc);
2720 	re_init_locked(sc);
2721 }
2722 
2723 /*
2724  * Stop the adapter and free any mbufs allocated to the
2725  * RX and TX lists.
2726  */
2727 static void
2728 re_stop(sc)
2729 	struct rl_softc		*sc;
2730 {
2731 	register int		i;
2732 	struct ifnet		*ifp;
2733 
2734 	RL_LOCK_ASSERT(sc);
2735 
2736 	ifp = sc->rl_ifp;
2737 
2738 	sc->rl_watchdog_timer = 0;
2739 	callout_stop(&sc->rl_stat_callout);
2740 	ifp->if_drv_flags &= ~(IFF_DRV_RUNNING | IFF_DRV_OACTIVE);
2741 
2742 	CSR_WRITE_1(sc, RL_COMMAND, 0x00);
2743 	CSR_WRITE_2(sc, RL_IMR, 0x0000);
2744 	CSR_WRITE_2(sc, RL_ISR, 0xFFFF);
2745 
2746 	if (sc->rl_head != NULL) {
2747 		m_freem(sc->rl_head);
2748 		sc->rl_head = sc->rl_tail = NULL;
2749 	}
2750 
2751 	/* Free the TX list buffers. */
2752 
2753 	for (i = 0; i < RL_TX_DESC_CNT; i++) {
2754 		if (sc->rl_ldata.rl_tx_mbuf[i] != NULL) {
2755 			bus_dmamap_unload(sc->rl_ldata.rl_mtag,
2756 			    sc->rl_ldata.rl_tx_dmamap[i]);
2757 			m_freem(sc->rl_ldata.rl_tx_mbuf[i]);
2758 			sc->rl_ldata.rl_tx_mbuf[i] = NULL;
2759 		}
2760 	}
2761 
2762 	/* Free the RX list buffers. */
2763 
2764 	for (i = 0; i < RL_RX_DESC_CNT; i++) {
2765 		if (sc->rl_ldata.rl_rx_mbuf[i] != NULL) {
2766 			bus_dmamap_unload(sc->rl_ldata.rl_mtag,
2767 			    sc->rl_ldata.rl_rx_dmamap[i]);
2768 			m_freem(sc->rl_ldata.rl_rx_mbuf[i]);
2769 			sc->rl_ldata.rl_rx_mbuf[i] = NULL;
2770 		}
2771 	}
2772 }
2773 
2774 /*
2775  * Device suspend routine.  Stop the interface and save some PCI
2776  * settings in case the BIOS doesn't restore them properly on
2777  * resume.
2778  */
2779 static int
2780 re_suspend(dev)
2781 	device_t		dev;
2782 {
2783 	struct rl_softc		*sc;
2784 
2785 	sc = device_get_softc(dev);
2786 
2787 	RL_LOCK(sc);
2788 	re_stop(sc);
2789 	sc->suspended = 1;
2790 	RL_UNLOCK(sc);
2791 
2792 	return (0);
2793 }
2794 
2795 /*
2796  * Device resume routine.  Restore some PCI settings in case the BIOS
2797  * doesn't, re-enable busmastering, and restart the interface if
2798  * appropriate.
2799  */
2800 static int
2801 re_resume(dev)
2802 	device_t		dev;
2803 {
2804 	struct rl_softc		*sc;
2805 	struct ifnet		*ifp;
2806 
2807 	sc = device_get_softc(dev);
2808 
2809 	RL_LOCK(sc);
2810 
2811 	ifp = sc->rl_ifp;
2812 
2813 	/* reinitialize interface if necessary */
2814 	if (ifp->if_flags & IFF_UP)
2815 		re_init_locked(sc);
2816 
2817 	sc->suspended = 0;
2818 	RL_UNLOCK(sc);
2819 
2820 	return (0);
2821 }
2822 
2823 /*
2824  * Stop all chip I/O so that the kernel's probe routines don't
2825  * get confused by errant DMAs when rebooting.
2826  */
2827 static int
2828 re_shutdown(dev)
2829 	device_t		dev;
2830 {
2831 	struct rl_softc		*sc;
2832 
2833 	sc = device_get_softc(dev);
2834 
2835 	RL_LOCK(sc);
2836 	re_stop(sc);
2837 	/*
2838 	 * Mark interface as down since otherwise we will panic if
2839 	 * interrupt comes in later on, which can happen in some
2840 	 * cases.
2841 	 */
2842 	sc->rl_ifp->if_flags &= ~IFF_UP;
2843 	RL_UNLOCK(sc);
2844 
2845 	return (0);
2846 }
2847