xref: /freebsd/sys/dev/usb/net/if_muge.c (revision 4928135658a9d0eaee37003df6137ab363fcb0b4)
1 /*-
2  * SPDX-License-Identifier: BSD-2-Clause-FreeBSD
3  *
4  * Copyright (C) 2012 Ben Gray <bgray@freebsd.org>.
5  * Copyright (C) 2018 The FreeBSD Foundation.
6  *
7  * This software was developed by Arshan Khanifar <arshankhanifar@gmail.com>
8  * under sponsorship from the FreeBSD Foundation.
9  *
10  * Redistribution and use in source and binary forms, with or without
11  * modification, are permitted provided that the following conditions
12  * are met:
13  * 1. Redistributions of source code must retain the above copyright
14  *    notice, this list of conditions and the following disclaimer.
15  * 2. Redistributions in binary form must reproduce the above copyright
16  *    notice, this list of conditions and the following disclaimer in the
17  *    documentation and/or other materials provided with the distribution.
18  *
19  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
20  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
21  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
22  * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
23  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
24  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
25  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
26  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
27  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
28  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
29  * SUCH DAMAGE.
30  *
31  * $FreeBSD$
32  */
33 
34 #include <sys/cdefs.h>
35 __FBSDID("$FreeBSD$");
36 
37 /*
38  * USB-To-Ethernet adapter driver for Microchip's LAN78XX and related families.
39  *
40  * USB 3.1 to 10/100/1000 Mbps Ethernet
41  * LAN7800 http://www.microchip.com/wwwproducts/en/LAN7800
42  *
43  * USB 2 to 10/100/1000 Mbps Ethernet with built-in USB hub
44  * LAN7515 (no datasheet available, but probes and functions as LAN7800)
45  *
46  * This driver is based on the if_smsc driver, with lan78xx-specific
47  * functionality modelled on Microchip's Linux lan78xx driver.
48  *
49  * UNIMPLEMENTED FEATURES
50  * ------------------
51  * A number of features supported by the lan78xx are not yet implemented in
52  * this driver:
53  *
54  * 1. RX/TX checksum offloading: Nothing has been implemented yet for
55  *    TX checksumming. RX checksumming works with ICMP messages, but is broken
56  *    for TCP/UDP packets.
57  * 2. Direct address translation filtering: Implemented but untested.
58  * 3. VLAN tag removal.
59  * 4. Reading MAC address from the device tree: Specific to the RPi 3B+.
60  *    Currently, the driver assigns a random MAC address itself.
61  * 5. Support for USB interrupt endpoints.
62  * 6. Latency Tolerance Messaging (LTM) support.
63  * 7. TCP LSO support.
64  *
65  */
66 
67 #include <sys/param.h>
68 #include <sys/bus.h>
69 #include <sys/callout.h>
70 #include <sys/condvar.h>
71 #include <sys/kernel.h>
72 #include <sys/lock.h>
73 #include <sys/malloc.h>
74 #include <sys/module.h>
75 #include <sys/mutex.h>
76 #include <sys/priv.h>
77 #include <sys/queue.h>
78 #include <sys/random.h>
79 #include <sys/socket.h>
80 #include <sys/stddef.h>
81 #include <sys/stdint.h>
82 #include <sys/sx.h>
83 #include <sys/sysctl.h>
84 #include <sys/systm.h>
85 #include <sys/unistd.h>
86 
87 #include <net/if.h>
88 #include <net/if_var.h>
89 
90 #include <netinet/in.h>
91 #include <netinet/ip.h>
92 
93 #include "opt_platform.h"
94 
95 #include <dev/usb/usb.h>
96 #include <dev/usb/usbdi.h>
97 #include <dev/usb/usbdi_util.h>
98 #include "usbdevs.h"
99 
100 #define USB_DEBUG_VAR lan78xx_debug
101 #include <dev/usb/usb_debug.h>
102 #include <dev/usb/usb_process.h>
103 
104 #include <dev/usb/net/usb_ethernet.h>
105 
106 #include <dev/usb/net/if_mugereg.h>
107 
108 #ifdef USB_DEBUG
109 static int muge_debug = 0;
110 
111 SYSCTL_NODE(_hw_usb, OID_AUTO, muge, CTLFLAG_RW, 0,
112     "Microchip LAN78xx USB-GigE");
113 SYSCTL_INT(_hw_usb_muge, OID_AUTO, debug, CTLFLAG_RWTUN, &muge_debug, 0,
114     "Debug level");
115 #endif
116 
117 #define MUGE_DEFAULT_RX_CSUM_ENABLE (false)
118 #define MUGE_DEFAULT_TX_CSUM_ENABLE (false)
119 #define MUGE_DEFAULT_TSO_CSUM_ENABLE (false)
120 
121 /* Supported Vendor and Product IDs. */
122 static const struct usb_device_id lan78xx_devs[] = {
123 #define MUGE_DEV(p,i) { USB_VPI(USB_VENDOR_SMC2, USB_PRODUCT_SMC2_##p, i) }
124 	MUGE_DEV(LAN7800_ETH, 0),
125 	MUGE_DEV(LAN7801_ETH, 0),
126 	MUGE_DEV(LAN7850_ETH, 0),
127 #undef MUGE_DEV
128 };
129 
130 #ifdef USB_DEBUG
131 #define muge_dbg_printf(sc, fmt, args...) \
132 do { \
133 	if (muge_debug > 0) \
134 		device_printf((sc)->sc_ue.ue_dev, "debug: " fmt, ##args); \
135 } while(0)
136 #else
137 #define muge_dbg_printf(sc, fmt, args...) do { } while (0)
138 #endif
139 
140 #define muge_warn_printf(sc, fmt, args...) \
141 	device_printf((sc)->sc_ue.ue_dev, "warning: " fmt, ##args)
142 
143 #define muge_err_printf(sc, fmt, args...) \
144 	device_printf((sc)->sc_ue.ue_dev, "error: " fmt, ##args)
145 
146 #define ETHER_IS_ZERO(addr) \
147 	(!(addr[0] | addr[1] | addr[2] | addr[3] | addr[4] | addr[5]))
148 
149 #define ETHER_IS_VALID(addr) \
150 	(!ETHER_IS_MULTICAST(addr) && !ETHER_IS_ZERO(addr))
151 
152 /* USB endpoints. */
153 
154 enum {
155 	MUGE_BULK_DT_RD,
156 	MUGE_BULK_DT_WR,
157 #if 0 /* Ignore interrupt endpoints for now as we poll on MII status. */
158 	MUGE_INTR_DT_WR,
159 	MUGE_INTR_DT_RD,
160 #endif
161 	MUGE_N_TRANSFER,
162 };
163 
164 struct muge_softc {
165 	struct usb_ether	sc_ue;
166 	struct mtx		sc_mtx;
167 	struct usb_xfer		*sc_xfer[MUGE_N_TRANSFER];
168 	int			sc_phyno;
169 
170 	/* Settings for the mac control (MAC_CSR) register. */
171 	uint32_t		sc_rfe_ctl;
172 	uint32_t		sc_mdix_ctl;
173 	uint16_t		chipid;
174 	uint16_t		chiprev;
175 	uint32_t		sc_mchash_table[ETH_DP_SEL_VHF_HASH_LEN];
176 	uint32_t		sc_pfilter_table[MUGE_NUM_PFILTER_ADDRS_][2];
177 
178 	uint32_t		sc_flags;
179 #define	MUGE_FLAG_LINK		0x0001
180 #define	MUGE_FLAG_INIT_DONE	0x0002
181 };
182 
183 #define MUGE_IFACE_IDX		0
184 
185 #define MUGE_LOCK(_sc)			mtx_lock(&(_sc)->sc_mtx)
186 #define MUGE_UNLOCK(_sc)		mtx_unlock(&(_sc)->sc_mtx)
187 #define MUGE_LOCK_ASSERT(_sc, t)	mtx_assert(&(_sc)->sc_mtx, t)
188 
189 static device_probe_t muge_probe;
190 static device_attach_t muge_attach;
191 static device_detach_t muge_detach;
192 
193 static usb_callback_t muge_bulk_read_callback;
194 static usb_callback_t muge_bulk_write_callback;
195 
196 static miibus_readreg_t lan78xx_miibus_readreg;
197 static miibus_writereg_t lan78xx_miibus_writereg;
198 static miibus_statchg_t lan78xx_miibus_statchg;
199 
200 static int muge_attach_post_sub(struct usb_ether *ue);
201 static uether_fn_t muge_attach_post;
202 static uether_fn_t muge_init;
203 static uether_fn_t muge_stop;
204 static uether_fn_t muge_start;
205 static uether_fn_t muge_tick;
206 static uether_fn_t muge_setmulti;
207 static uether_fn_t muge_setpromisc;
208 
209 static int muge_ifmedia_upd(struct ifnet *);
210 static void muge_ifmedia_sts(struct ifnet *, struct ifmediareq *);
211 
212 static int lan78xx_chip_init(struct muge_softc *sc);
213 static int muge_ioctl(struct ifnet *ifp, u_long cmd, caddr_t data);
214 
215 static const struct usb_config muge_config[MUGE_N_TRANSFER] = {
216 
217 	[MUGE_BULK_DT_WR] = {
218 		.type = UE_BULK,
219 		.endpoint = UE_ADDR_ANY,
220 		.direction = UE_DIR_OUT,
221 		.frames = 16,
222 		.bufsize = 16 * (MCLBYTES + 16),
223 		.flags = {.pipe_bof = 1,.force_short_xfer = 1,},
224 		.callback = muge_bulk_write_callback,
225 		.timeout = 10000,	/* 10 seconds */
226 	},
227 
228 	[MUGE_BULK_DT_RD] = {
229 		.type = UE_BULK,
230 		.endpoint = UE_ADDR_ANY,
231 		.direction = UE_DIR_IN,
232 		.bufsize = 20480,	/* bytes */
233 		.flags = {.pipe_bof = 1,.short_xfer_ok = 1,},
234 		.callback = muge_bulk_read_callback,
235 		.timeout = 0,	/* no timeout */
236 	},
237 	/*
238 	 * The chip supports interrupt endpoints, however they aren't
239 	 * needed as we poll on the MII status.
240 	 */
241 };
242 
243 static const struct usb_ether_methods muge_ue_methods = {
244 	.ue_attach_post = muge_attach_post,
245 	.ue_attach_post_sub = muge_attach_post_sub,
246 	.ue_start = muge_start,
247 	.ue_ioctl = muge_ioctl,
248 	.ue_init = muge_init,
249 	.ue_stop = muge_stop,
250 	.ue_tick = muge_tick,
251 	.ue_setmulti = muge_setmulti,
252 	.ue_setpromisc = muge_setpromisc,
253 	.ue_mii_upd = muge_ifmedia_upd,
254 	.ue_mii_sts = muge_ifmedia_sts,
255 };
256 
257 /**
258  *	lan78xx_read_reg - Read a 32-bit register on the device
259  *	@sc: driver soft context
260  *	@off: offset of the register
261  *	@data: pointer a value that will be populated with the register value
262  *
263  *	LOCKING:
264  *	The device lock must be held before calling this function.
265  *
266  *	RETURNS:
267  *	0 on success, a USB_ERR_?? error code on failure.
268  */
269 static int
270 lan78xx_read_reg(struct muge_softc *sc, uint32_t off, uint32_t *data)
271 {
272 	struct usb_device_request req;
273 	uint32_t buf;
274 	usb_error_t err;
275 
276 	MUGE_LOCK_ASSERT(sc, MA_OWNED);
277 
278 	req.bmRequestType = UT_READ_VENDOR_DEVICE;
279 	req.bRequest = UVR_READ_REG;
280 	USETW(req.wValue, 0);
281 	USETW(req.wIndex, off);
282 	USETW(req.wLength, 4);
283 
284 	err = uether_do_request(&sc->sc_ue, &req, &buf, 1000);
285 	if (err != 0)
286 		muge_warn_printf(sc, "Failed to read register 0x%0x\n", off);
287 	*data = le32toh(buf);
288 	return (err);
289 }
290 
291 /**
292  *	lan78xx_write_reg - Write a 32-bit register on the device
293  *	@sc: driver soft context
294  *	@off: offset of the register
295  *	@data: the 32-bit value to write into the register
296  *
297  *	LOCKING:
298  *	The device lock must be held before calling this function.
299  *
300  *	RETURNS:
301  *	0 on success, a USB_ERR_?? error code on failure.
302  */
303 static int
304 lan78xx_write_reg(struct muge_softc *sc, uint32_t off, uint32_t data)
305 {
306 	struct usb_device_request req;
307 	uint32_t buf;
308 	usb_error_t err;
309 
310 	MUGE_LOCK_ASSERT(sc, MA_OWNED);
311 
312 	buf = htole32(data);
313 
314 	req.bmRequestType = UT_WRITE_VENDOR_DEVICE;
315 	req.bRequest = UVR_WRITE_REG;
316 	USETW(req.wValue, 0);
317 	USETW(req.wIndex, off);
318 	USETW(req.wLength, 4);
319 
320 	err = uether_do_request(&sc->sc_ue, &req, &buf, 1000);
321 	if (err != 0)
322 		muge_warn_printf(sc, "Failed to write register 0x%0x\n", off);
323 	return (err);
324 }
325 
326 /**
327  *	lan78xx_wait_for_bits - Poll on a register value until bits are cleared
328  *	@sc: soft context
329  *	@reg: offset of the register
330  *	@bits: if the bits are clear the function returns
331  *
332  *	LOCKING:
333  *	The device lock must be held before calling this function.
334  *
335  *	RETURNS:
336  *	0 on success, or a USB_ERR_?? error code on failure.
337  */
338 static int
339 lan78xx_wait_for_bits(struct muge_softc *sc, uint32_t reg, uint32_t bits)
340 {
341 	usb_ticks_t start_ticks;
342 	const usb_ticks_t max_ticks = USB_MS_TO_TICKS(1000);
343 	uint32_t val;
344 	int err;
345 
346 	MUGE_LOCK_ASSERT(sc, MA_OWNED);
347 
348 	start_ticks = (usb_ticks_t)ticks;
349 	do {
350 		if ((err = lan78xx_read_reg(sc, reg, &val)) != 0)
351 			return (err);
352 		if (!(val & bits))
353 			return (0);
354 		uether_pause(&sc->sc_ue, hz / 100);
355 	} while (((usb_ticks_t)(ticks - start_ticks)) < max_ticks);
356 
357 	return (USB_ERR_TIMEOUT);
358 }
359 
360 /**
361  *	lan78xx_eeprom_read_raw - Read the attached EEPROM
362  *	@sc: soft context
363  *	@off: the eeprom address offset
364  *	@buf: stores the bytes
365  *	@buflen: the number of bytes to read
366  *
367  *	Simply reads bytes from an attached eeprom.
368  *
369  *	LOCKING:
370  *	The function takes and releases the device lock if not already held.
371  *
372  *	RETURNS:
373  *	0 on success, or a USB_ERR_?? error code on failure.
374  */
375 static int
376 lan78xx_eeprom_read_raw(struct muge_softc *sc, uint16_t off, uint8_t *buf,
377     uint16_t buflen)
378 {
379 	usb_ticks_t start_ticks;
380 	const usb_ticks_t max_ticks = USB_MS_TO_TICKS(1000);
381 	int err, locked;
382 	uint32_t val, saved;
383 	uint16_t i;
384 
385 	locked = mtx_owned(&sc->sc_mtx); /* XXX */
386 	if (!locked)
387 		MUGE_LOCK(sc);
388 
389 	err = lan78xx_read_reg(sc, ETH_HW_CFG, &val);
390 	saved = val;
391 
392 	val &= ~(ETH_HW_CFG_LEDO_EN_ | ETH_HW_CFG_LED1_EN_);
393 	err = lan78xx_write_reg(sc, ETH_HW_CFG, val);
394 
395 	err = lan78xx_wait_for_bits(sc, ETH_E2P_CMD, ETH_E2P_CMD_BUSY_);
396 	if (err != 0) {
397 		muge_warn_printf(sc, "eeprom busy, failed to read data\n");
398 		goto done;
399 	}
400 
401 	/* Start reading the bytes, one at a time. */
402 	for (i = 0; i < buflen; i++) {
403 		val = ETH_E2P_CMD_BUSY_ | ETH_E2P_CMD_READ_;
404 		val |= (ETH_E2P_CMD_ADDR_MASK_ & (off + i));
405 		if ((err = lan78xx_write_reg(sc, ETH_E2P_CMD, val)) != 0)
406 			goto done;
407 
408 		start_ticks = (usb_ticks_t)ticks;
409 		do {
410 			if ((err = lan78xx_read_reg(sc, ETH_E2P_CMD, &val)) !=
411 			    0)
412 				goto done;
413 			if (!(val & ETH_E2P_CMD_BUSY_) ||
414 			    (val & ETH_E2P_CMD_TIMEOUT_))
415 				break;
416 
417 			uether_pause(&sc->sc_ue, hz / 100);
418 		} while (((usb_ticks_t)(ticks - start_ticks)) < max_ticks);
419 
420 		if (val & (ETH_E2P_CMD_BUSY_ | ETH_E2P_CMD_TIMEOUT_)) {
421 			muge_warn_printf(sc, "eeprom command failed\n");
422 			err = USB_ERR_IOERROR;
423 			break;
424 		}
425 
426 		if ((err = lan78xx_read_reg(sc, ETH_E2P_DATA, &val)) != 0)
427 			goto done;
428 
429 		buf[i] = (val & 0xff);
430 	}
431 
432 done:
433 	if (!locked)
434 		MUGE_UNLOCK(sc);
435 	lan78xx_write_reg(sc, ETH_HW_CFG, saved);
436 	return (err);
437 }
438 
439 /**
440  *	lan78xx_eeprom_read - Read EEPROM and confirm it is programmed
441  *	@sc: soft context
442  *	@off: the eeprom address offset
443  *	@buf: stores the bytes
444  *	@buflen: the number of bytes to read
445  *
446  *	RETURNS:
447  *	0 on success, or a USB_ERR_?? error code on failure.
448  */
449 static int
450 lan78xx_eeprom_read(struct muge_softc *sc, uint16_t off, uint8_t *buf,
451     uint16_t buflen)
452 {
453 	uint8_t sig;
454 	int ret;
455 
456 	ret = lan78xx_eeprom_read_raw(sc, ETH_E2P_INDICATOR_OFFSET, &sig, 1);
457 	if ((ret == 0) && (sig == ETH_E2P_INDICATOR)) {
458 		ret = lan78xx_eeprom_read_raw(sc, off, buf, buflen);
459 		muge_dbg_printf(sc, "EEPROM present\n");
460 	} else {
461 		ret = -EINVAL;
462 		muge_dbg_printf(sc, "EEPROM not present\n");
463 	}
464 	return (ret);
465 }
466 
467 /**
468  *	lan78xx_otp_read_raw
469  *	@sc: soft context
470  *	@off: the otp address offset
471  *	@buf: stores the bytes
472  *	@buflen: the number of bytes to read
473  *
474  *	Simply reads bytes from the OTP.
475  *
476  *	LOCKING:
477  *	The function takes and releases the device lock if not already held.
478  *
479  *	RETURNS:
480  *	0 on success, or a USB_ERR_?? error code on failure.
481  *
482  */
483 static int
484 lan78xx_otp_read_raw(struct muge_softc *sc, uint16_t off, uint8_t *buf,
485     uint16_t buflen)
486 {
487 	int locked, err;
488 	uint32_t val;
489 	uint16_t i;
490 	locked = mtx_owned(&sc->sc_mtx);
491 	if (!locked)
492 		MUGE_LOCK(sc);
493 
494 	err = lan78xx_read_reg(sc, OTP_PWR_DN, &val);
495 
496 	/* Checking if bit is set. */
497 	if (val & OTP_PWR_DN_PWRDN_N) {
498 		/* Clear it, then wait for it to be cleared. */
499 		lan78xx_write_reg(sc, OTP_PWR_DN, 0);
500 		err = lan78xx_wait_for_bits(sc, OTP_PWR_DN, OTP_PWR_DN_PWRDN_N);
501 		if (err != 0) {
502 			muge_warn_printf(sc, "OTP off? failed to read data\n");
503 			goto done;
504 		}
505 	}
506 	/* Start reading the bytes, one at a time. */
507 	for (i = 0; i < buflen; i++) {
508 		err = lan78xx_write_reg(sc, OTP_ADDR1,
509 		    ((off + i) >> 8) & OTP_ADDR1_15_11);
510 		err = lan78xx_write_reg(sc, OTP_ADDR2,
511 		    ((off + i) & OTP_ADDR2_10_3));
512 		err = lan78xx_write_reg(sc, OTP_FUNC_CMD, OTP_FUNC_CMD_READ_);
513 		err = lan78xx_write_reg(sc, OTP_CMD_GO, OTP_CMD_GO_GO_);
514 
515 		err = lan78xx_wait_for_bits(sc, OTP_STATUS, OTP_STATUS_BUSY_);
516 		if (err != 0) {
517 			muge_warn_printf(sc, "OTP busy failed to read data\n");
518 			goto done;
519 		}
520 
521 		if ((err = lan78xx_read_reg(sc, OTP_RD_DATA, &val)) != 0)
522 			goto done;
523 
524 		buf[i] = (uint8_t)(val & 0xff);
525 	}
526 
527 done:
528 	if (!locked)
529 		MUGE_UNLOCK(sc);
530 	return (err);
531 }
532 
533 /**
534  *	lan78xx_otp_read
535  *	@sc: soft context
536  *	@off: the otp address offset
537  *	@buf: stores the bytes
538  *	@buflen: the number of bytes to read
539  *
540  *	Simply reads bytes from the otp.
541  *
542  *	LOCKING:
543  *	The function takes and releases device lock if it is not already held.
544  *
545  *	RETURNS:
546  *	0 on success, or a USB_ERR_?? error code on failure.
547  */
548 static int
549 lan78xx_otp_read(struct muge_softc *sc, uint16_t off, uint8_t *buf,
550     uint16_t buflen)
551 {
552 	uint8_t sig;
553 	int err;
554 
555 	err = lan78xx_otp_read_raw(sc, OTP_INDICATOR_OFFSET, &sig, 1);
556 	if (err == 0) {
557 		if (sig == OTP_INDICATOR_1) {
558 		} else if (sig == OTP_INDICATOR_2) {
559 			off += 0x100; /* XXX */
560 		} else {
561 			err = -EINVAL;
562 		}
563 		if (!err)
564 			err = lan78xx_otp_read_raw(sc, off, buf, buflen);
565 	}
566 	return (err);
567 }
568 
569 /**
570  *	lan78xx_setmacaddress - Set the mac address in the device
571  *	@sc: driver soft context
572  *	@addr: pointer to array contain at least 6 bytes of the mac
573  *
574  *	LOCKING:
575  *	Should be called with the MUGE lock held.
576  *
577  *	RETURNS:
578  *	Returns 0 on success or a negative error code.
579  */
580 static int
581 lan78xx_setmacaddress(struct muge_softc *sc, const uint8_t *addr)
582 {
583 	int err;
584 	uint32_t val;
585 
586 	muge_dbg_printf(sc,
587 	    "setting mac address to %02x:%02x:%02x:%02x:%02x:%02x\n",
588 	    addr[0], addr[1], addr[2], addr[3], addr[4], addr[5]);
589 
590 	MUGE_LOCK_ASSERT(sc, MA_OWNED);
591 
592 	val = (addr[3] << 24) | (addr[2] << 16) | (addr[1] << 8) | addr[0];
593 	if ((err = lan78xx_write_reg(sc, ETH_RX_ADDRL, val)) != 0)
594 		goto done;
595 
596 	val = (addr[5] << 8) | addr[4];
597 	err = lan78xx_write_reg(sc, ETH_RX_ADDRH, val);
598 
599 done:
600 	return (err);
601 }
602 
603 /**
604  *	lan78xx_set_rx_max_frame_length
605  *	@sc: driver soft context
606  *	@size: pointer to array contain at least 6 bytes of the mac
607  *
608  *	Sets the maximum frame length to be received. Frames bigger than
609  *	this size are aborted.
610  *
611  *	RETURNS:
612  *	Returns 0 on success or a negative error code.
613  */
614 static int
615 lan78xx_set_rx_max_frame_length(struct muge_softc *sc, int size)
616 {
617 	int err = 0;
618 	uint32_t buf;
619 	bool rxenabled;
620 
621 	/* First we have to disable rx before changing the length. */
622 	err = lan78xx_read_reg(sc, ETH_MAC_RX, &buf);
623 	rxenabled = ((buf & ETH_MAC_RX_EN_) != 0);
624 
625 	if (rxenabled) {
626 		buf &= ~ETH_MAC_RX_EN_;
627 		err = lan78xx_write_reg(sc, ETH_MAC_RX, buf);
628 	}
629 
630 	/* Setting max frame length. */
631 	buf &= ~ETH_MAC_RX_MAX_FR_SIZE_MASK_;
632 	buf |= (((size + 4) << ETH_MAC_RX_MAX_FR_SIZE_SHIFT_) &
633 	    ETH_MAC_RX_MAX_FR_SIZE_MASK_);
634 	err = lan78xx_write_reg(sc, ETH_MAC_RX, buf);
635 
636 	/* If it were enabled before, we enable it back. */
637 
638 	if (rxenabled) {
639 		buf |= ETH_MAC_RX_EN_;
640 		err = lan78xx_write_reg(sc, ETH_MAC_RX, buf);
641 	}
642 
643 	return (0);
644 }
645 
646 /**
647  *	lan78xx_miibus_readreg - Read a MII/MDIO register
648  *	@dev: usb ether device
649  *	@phy: the number of phy reading from
650  *	@reg: the register address
651  *
652  *	LOCKING:
653  *	Takes and releases the device mutex lock if not already held.
654  *
655  *	RETURNS:
656  *	Returns the 16-bits read from the MII register, if this function fails
657  *	0 is returned.
658  */
659 static int
660 lan78xx_miibus_readreg(device_t dev, int phy, int reg) {
661 
662 	struct muge_softc *sc = device_get_softc(dev);
663 	int locked;
664 	uint32_t addr, val;
665 
666 	val = 0;
667 	locked = mtx_owned(&sc->sc_mtx);
668 	if (!locked)
669 		MUGE_LOCK(sc);
670 
671 	if (lan78xx_wait_for_bits(sc, ETH_MII_ACC, ETH_MII_ACC_MII_BUSY_) !=
672 	    0) {
673 		muge_warn_printf(sc, "MII is busy\n");
674 		goto done;
675 	}
676 
677 	addr = (phy << 11) | (reg << 6) |
678 	    ETH_MII_ACC_MII_READ_ | ETH_MII_ACC_MII_BUSY_;
679 	lan78xx_write_reg(sc, ETH_MII_ACC, addr);
680 
681 	if (lan78xx_wait_for_bits(sc, ETH_MII_ACC, ETH_MII_ACC_MII_BUSY_) !=
682 	    0) {
683 		muge_warn_printf(sc, "MII read timeout\n");
684 		goto done;
685 	}
686 
687 	lan78xx_read_reg(sc, ETH_MII_DATA, &val);
688 	val = le32toh(val);
689 
690 done:
691 	if (!locked)
692 		MUGE_UNLOCK(sc);
693 
694 	return (val & 0xFFFF);
695 }
696 
697 /**
698  *	lan78xx_miibus_writereg - Writes a MII/MDIO register
699  *	@dev: usb ether device
700  *	@phy: the number of phy writing to
701  *	@reg: the register address
702  *	@val: the value to write
703  *
704  *	Attempts to write a PHY register through the usb controller registers.
705  *
706  *	LOCKING:
707  *	Takes and releases the device mutex lock if not already held.
708  *
709  *	RETURNS:
710  *	Always returns 0 regardless of success or failure.
711  */
712 static int
713 lan78xx_miibus_writereg(device_t dev, int phy, int reg, int val)
714 {
715 	struct muge_softc *sc = device_get_softc(dev);
716 	int locked;
717 	uint32_t addr;
718 
719 	if (sc->sc_phyno != phy)
720 		return (0);
721 
722 	locked = mtx_owned(&sc->sc_mtx);
723 	if (!locked)
724 		MUGE_LOCK(sc);
725 
726 	if (lan78xx_wait_for_bits(sc, ETH_MII_ACC, ETH_MII_ACC_MII_BUSY_) !=
727 	    0) {
728 		muge_warn_printf(sc, "MII is busy\n");
729 		goto done;
730 	}
731 
732 	val = htole32(val);
733 	lan78xx_write_reg(sc, ETH_MII_DATA, val);
734 
735 	addr = (phy << 11) | (reg << 6) |
736 	    ETH_MII_ACC_MII_WRITE_ | ETH_MII_ACC_MII_BUSY_;
737 	lan78xx_write_reg(sc, ETH_MII_ACC, addr);
738 
739 	if (lan78xx_wait_for_bits(sc, ETH_MII_ACC, ETH_MII_ACC_MII_BUSY_) != 0)
740 		muge_warn_printf(sc, "MII write timeout\n");
741 
742 done:
743 	if (!locked)
744 		MUGE_UNLOCK(sc);
745 	return (0);
746 }
747 
748 /*
749  *	lan78xx_miibus_statchg - Called to detect phy status change
750  *	@dev: usb ether device
751  *
752  *	This function is called periodically by the system to poll for status
753  *	changes of the link.
754  *
755  *	LOCKING:
756  *	Takes and releases the device mutex lock if not already held.
757  */
758 static void
759 lan78xx_miibus_statchg(device_t dev)
760 {
761 	struct muge_softc *sc = device_get_softc(dev);
762 	struct mii_data *mii = uether_getmii(&sc->sc_ue);
763 	struct ifnet *ifp;
764 	int locked;
765 	int err;
766 	uint32_t flow = 0;
767 	uint32_t fct_flow = 0;
768 
769 	locked = mtx_owned(&sc->sc_mtx);
770 	if (!locked)
771 		MUGE_LOCK(sc);
772 
773 	ifp = uether_getifp(&sc->sc_ue);
774 	if (mii == NULL || ifp == NULL ||
775 	    (ifp->if_drv_flags & IFF_DRV_RUNNING) == 0)
776 		goto done;
777 
778 	/* Use the MII status to determine link status */
779 	sc->sc_flags &= ~MUGE_FLAG_LINK;
780 	if ((mii->mii_media_status & (IFM_ACTIVE | IFM_AVALID)) ==
781 	    (IFM_ACTIVE | IFM_AVALID)) {
782 		muge_dbg_printf(sc, "media is active\n");
783 		switch (IFM_SUBTYPE(mii->mii_media_active)) {
784 		case IFM_10_T:
785 		case IFM_100_TX:
786 			sc->sc_flags |= MUGE_FLAG_LINK;
787 			muge_dbg_printf(sc, "10/100 ethernet\n");
788 			break;
789 		case IFM_1000_T:
790 			sc->sc_flags |= MUGE_FLAG_LINK;
791 			muge_dbg_printf(sc, "Gigabit ethernet\n");
792 			break;
793 		default:
794 			break;
795 		}
796 	}
797 	/* Lost link, do nothing. */
798 	if ((sc->sc_flags & MUGE_FLAG_LINK) == 0) {
799 		muge_dbg_printf(sc, "link flag not set\n");
800 		goto done;
801 	}
802 
803 	err = lan78xx_read_reg(sc, ETH_FCT_FLOW, &fct_flow);
804 	if (err) {
805 		muge_warn_printf(sc,
806 		   "failed to read initial flow control thresholds, error %d\n",
807 		    err);
808 		goto done;
809 	}
810 
811 	/* Enable/disable full duplex operation and TX/RX pause. */
812 	if ((IFM_OPTIONS(mii->mii_media_active) & IFM_FDX) != 0) {
813 		muge_dbg_printf(sc, "full duplex operation\n");
814 
815 		/* Enable transmit MAC flow control function. */
816 		if ((IFM_OPTIONS(mii->mii_media_active) & IFM_ETH_TXPAUSE) != 0)
817 			flow |= ETH_FLOW_CR_TX_FCEN_ | 0xFFFF;
818 
819 		if ((IFM_OPTIONS(mii->mii_media_active) & IFM_ETH_RXPAUSE) != 0)
820 			flow |= ETH_FLOW_CR_RX_FCEN_;
821 	}
822 
823 	/* XXX Flow control settings obtained from Microchip's driver. */
824 	switch(usbd_get_speed(sc->sc_ue.ue_udev)) {
825 	case USB_SPEED_SUPER:
826 		fct_flow = 0x817;
827 		break;
828 	case USB_SPEED_HIGH:
829 		fct_flow = 0x211;
830 		break;
831 	default:
832 		break;
833 	}
834 
835 	err += lan78xx_write_reg(sc, ETH_FLOW, flow);
836 	err += lan78xx_write_reg(sc, ETH_FCT_FLOW, fct_flow);
837 	if (err)
838 		muge_warn_printf(sc, "media change failed, error %d\n", err);
839 
840 done:
841 	if (!locked)
842 		MUGE_UNLOCK(sc);
843 }
844 
845 /*
846  *	lan78xx_set_mdix_auto - Configure the device to enable automatic
847  *	crossover and polarity detection.  LAN7800 provides HP Auto-MDIX
848  *	functionality for seamless crossover and polarity detection.
849  *
850  *	@sc: driver soft context
851  *
852  *	LOCKING:
853  *	Takes and releases the device mutex lock if not already held.
854  */
855 static void
856 lan78xx_set_mdix_auto(struct muge_softc *sc)
857 {
858 	uint32_t buf, err;
859 
860 	err = lan78xx_miibus_writereg(sc->sc_ue.ue_dev, sc->sc_phyno,
861 	    MUGE_EXT_PAGE_ACCESS, MUGE_EXT_PAGE_SPACE_1);
862 
863 	buf = lan78xx_miibus_readreg(sc->sc_ue.ue_dev, sc->sc_phyno,
864 	    MUGE_EXT_MODE_CTRL);
865 	buf &= ~MUGE_EXT_MODE_CTRL_MDIX_MASK_;
866 	buf |= MUGE_EXT_MODE_CTRL_AUTO_MDIX_;
867 
868 	lan78xx_miibus_readreg(sc->sc_ue.ue_dev, sc->sc_phyno, MII_BMCR);
869 	err += lan78xx_miibus_writereg(sc->sc_ue.ue_dev, sc->sc_phyno,
870 	    MUGE_EXT_MODE_CTRL, buf);
871 
872 	err += lan78xx_miibus_writereg(sc->sc_ue.ue_dev, sc->sc_phyno,
873 	    MUGE_EXT_PAGE_ACCESS, MUGE_EXT_PAGE_SPACE_0);
874 
875 	if (err != 0)
876 		muge_warn_printf(sc, "error setting PHY's MDIX status\n");
877 
878 	sc->sc_mdix_ctl = buf;
879 }
880 
881 /**
882  *	lan78xx_phy_init - Initialises the in-built MUGE phy
883  *	@sc: driver soft context
884  *
885  *	Resets the PHY part of the chip and then initialises it to default
886  *	values.  The 'link down' and 'auto-negotiation complete' interrupts
887  *	from the PHY are also enabled, however we don't monitor the interrupt
888  *	endpoints for the moment.
889  *
890  *	RETURNS:
891  *	Returns 0 on success or EIO if failed to reset the PHY.
892  */
893 static int
894 lan78xx_phy_init(struct muge_softc *sc)
895 {
896 	muge_dbg_printf(sc, "Initializing PHY.\n");
897 	uint16_t bmcr;
898 	usb_ticks_t start_ticks;
899 	const usb_ticks_t max_ticks = USB_MS_TO_TICKS(1000);
900 
901 	MUGE_LOCK_ASSERT(sc, MA_OWNED);
902 
903 	/* Reset phy and wait for reset to complete. */
904 	lan78xx_miibus_writereg(sc->sc_ue.ue_dev, sc->sc_phyno, MII_BMCR,
905 	    BMCR_RESET);
906 
907 	start_ticks = ticks;
908 	do {
909 		uether_pause(&sc->sc_ue, hz / 100);
910 		bmcr = lan78xx_miibus_readreg(sc->sc_ue.ue_dev, sc->sc_phyno,
911 		    MII_BMCR);
912 	} while ((bmcr & BMCR_RESET) && ((ticks - start_ticks) < max_ticks));
913 
914 	if (((usb_ticks_t)(ticks - start_ticks)) >= max_ticks) {
915 		muge_err_printf(sc, "PHY reset timed-out\n");
916 		return (EIO);
917 	}
918 
919 	/* Setup phy to interrupt upon link down or autoneg completion. */
920 	lan78xx_miibus_readreg(sc->sc_ue.ue_dev, sc->sc_phyno,
921 	    MUGE_PHY_INTR_STAT);
922 	lan78xx_miibus_writereg(sc->sc_ue.ue_dev, sc->sc_phyno,
923 	    MUGE_PHY_INTR_MASK,
924 	    (MUGE_PHY_INTR_ANEG_COMP | MUGE_PHY_INTR_LINK_CHANGE));
925 
926 	/* Enable Auto-MDIX for crossover and polarity detection. */
927 	lan78xx_set_mdix_auto(sc);
928 
929 	/* Enable all modes. */
930 	lan78xx_miibus_writereg(sc->sc_ue.ue_dev, sc->sc_phyno, MII_ANAR,
931 	    ANAR_10 | ANAR_10_FD | ANAR_TX | ANAR_TX_FD |
932 	    ANAR_CSMA | ANAR_FC | ANAR_PAUSE_ASYM);
933 
934 	/* Restart auto-negotation. */
935 	bmcr |= BMCR_STARTNEG;
936 	bmcr |= BMCR_AUTOEN;
937 	lan78xx_miibus_writereg(sc->sc_ue.ue_dev, sc->sc_phyno, MII_BMCR, bmcr);
938 	bmcr = lan78xx_miibus_readreg(sc->sc_ue.ue_dev, sc->sc_phyno, MII_BMCR);
939 	return (0);
940 }
941 
942 /**
943  *	lan78xx_chip_init - Initialises the chip after power on
944  *	@sc: driver soft context
945  *
946  *	This initialisation sequence is modelled on the procedure in the Linux
947  *	driver.
948  *
949  *	RETURNS:
950  *	Returns 0 on success or an error code on failure.
951  */
952 static int
953 lan78xx_chip_init(struct muge_softc *sc)
954 {
955 	int err;
956 	uint32_t buf;
957 	uint32_t burst_cap;
958 
959 	MUGE_LOCK_ASSERT(sc, MA_OWNED);
960 
961 	/* Enter H/W config mode. */
962 	lan78xx_write_reg(sc, ETH_HW_CFG, ETH_HW_CFG_LRST_);
963 
964 	if ((err = lan78xx_wait_for_bits(sc, ETH_HW_CFG, ETH_HW_CFG_LRST_)) !=
965 	    0) {
966 		muge_warn_printf(sc,
967 		    "timed-out waiting for lite reset to complete\n");
968 		goto init_failed;
969 	}
970 
971 	/* Set the mac address. */
972 	if ((err = lan78xx_setmacaddress(sc, sc->sc_ue.ue_eaddr)) != 0) {
973 		muge_warn_printf(sc, "failed to set the MAC address\n");
974 		goto init_failed;
975 	}
976 
977 	/* Read and display the revision register. */
978 	if ((err = lan78xx_read_reg(sc, ETH_ID_REV, &buf)) < 0) {
979 		muge_warn_printf(sc, "failed to read ETH_ID_REV (err = %d)\n",
980 		    err);
981 		goto init_failed;
982 	}
983 	sc->chipid = (buf & ETH_ID_REV_CHIP_ID_MASK_) >> 16;
984 	sc->chiprev = buf & ETH_ID_REV_CHIP_REV_MASK_;
985 	if (sc->chipid != ETH_ID_REV_CHIP_ID_7800_) {
986 		muge_warn_printf(sc, "Chip ID 0x%04x not yet supported\n",
987 		    sc->chipid);
988 		goto init_failed;
989 	}
990 	device_printf(sc->sc_ue.ue_dev, "Chip ID 0x%04x rev %04x\n", sc->chipid,
991 	    sc->chiprev);
992 
993 	/* Respond to BULK-IN tokens with a NAK when RX FIFO is empty. */
994 	if ((err = lan78xx_read_reg(sc, ETH_USB_CFG0, &buf)) != 0) {
995 		muge_warn_printf(sc, "failed to read ETH_USB_CFG0 (err=%d)\n", err);
996 		goto init_failed;
997 	}
998 	buf |= ETH_USB_CFG_BIR_;
999 	lan78xx_write_reg(sc, ETH_USB_CFG0, buf);
1000 
1001 	/*
1002 	 * XXX LTM support will go here.
1003 	 */
1004 
1005 	/* Configuring the burst cap. */
1006 	switch (usbd_get_speed(sc->sc_ue.ue_udev)) {
1007 	case USB_SPEED_SUPER:
1008 		burst_cap = MUGE_DEFAULT_BURST_CAP_SIZE/MUGE_SS_USB_PKT_SIZE;
1009 		break;
1010 	case USB_SPEED_HIGH:
1011 		burst_cap = MUGE_DEFAULT_BURST_CAP_SIZE/MUGE_HS_USB_PKT_SIZE;
1012 		break;
1013 	default:
1014 		burst_cap = MUGE_DEFAULT_BURST_CAP_SIZE/MUGE_FS_USB_PKT_SIZE;
1015 	}
1016 
1017 	lan78xx_write_reg(sc, ETH_BURST_CAP, burst_cap);
1018 
1019 	/* Set the default bulk in delay (same value from Linux driver). */
1020 	lan78xx_write_reg(sc, ETH_BULK_IN_DLY, MUGE_DEFAULT_BULK_IN_DELAY);
1021 
1022 	/* Multiple ethernet frames per USB packets. */
1023 	err = lan78xx_read_reg(sc, ETH_HW_CFG, &buf);
1024 	buf |= ETH_HW_CFG_MEF_;
1025 	err = lan78xx_write_reg(sc, ETH_HW_CFG, buf);
1026 
1027 	/* Enable burst cap. */
1028 	if ((err = lan78xx_read_reg(sc, ETH_USB_CFG0, &buf)) < 0) {
1029 		muge_warn_printf(sc, "failed to read ETH_USB_CFG0 (err=%d)\n",
1030 		    err);
1031 		goto init_failed;
1032 	}
1033 	buf |= ETH_USB_CFG_BCE_;
1034 	err = lan78xx_write_reg(sc, ETH_USB_CFG0, buf);
1035 
1036 	/*
1037 	 * Set FCL's RX and TX FIFO sizes: according to data sheet this is
1038 	 * already the default value. But we initialize it to the same value
1039 	 * anyways, as that's what the Linux driver does.
1040 	 *
1041 	 */
1042 	buf = (MUGE_MAX_RX_FIFO_SIZE - 512) / 512;
1043 	err = lan78xx_write_reg(sc, ETH_FCT_RX_FIFO_END, buf);
1044 
1045 	buf = (MUGE_MAX_TX_FIFO_SIZE - 512) / 512;
1046 	err = lan78xx_write_reg(sc, ETH_FCT_TX_FIFO_END, buf);
1047 
1048 	/* Enabling interrupts. (Not using them for now) */
1049 	err = lan78xx_write_reg(sc, ETH_INT_STS, ETH_INT_STS_CLEAR_ALL_);
1050 
1051 	/*
1052 	 * Initializing flow control registers to 0.  These registers are
1053 	 * properly set is handled in link-reset function in the Linux driver.
1054 	 */
1055 	err = lan78xx_write_reg(sc, ETH_FLOW, 0);
1056 	err = lan78xx_write_reg(sc, ETH_FCT_FLOW, 0);
1057 
1058 	/*
1059 	 * Settings for the RFE, we enable broadcast and destination address
1060 	 * perfect filtering.
1061 	 */
1062 	err = lan78xx_read_reg(sc, ETH_RFE_CTL, &buf);
1063 	buf |= ETH_RFE_CTL_BCAST_EN_ | ETH_RFE_CTL_DA_PERFECT_;
1064 	err = lan78xx_write_reg(sc, ETH_RFE_CTL, buf);
1065 
1066 	/*
1067 	 * At this point the Linux driver writes multicast tables, and enables
1068 	 * checksum engines. But in FreeBSD that gets done in muge_init,
1069 	 * which gets called when the interface is brought up.
1070 	 */
1071 
1072 	/* Reset the PHY. */
1073 	lan78xx_write_reg(sc, ETH_PMT_CTL, ETH_PMT_CTL_PHY_RST_);
1074 	if ((err = lan78xx_wait_for_bits(sc, ETH_PMT_CTL,
1075 	    ETH_PMT_CTL_PHY_RST_)) != 0) {
1076 		muge_warn_printf(sc,
1077 		    "timed-out waiting for phy reset to complete\n");
1078 		goto init_failed;
1079 	}
1080 
1081 	/* Enable automatic duplex detection and automatic speed detection. */
1082 	err = lan78xx_read_reg(sc, ETH_MAC_CR, &buf);
1083 	buf |= ETH_MAC_CR_AUTO_DUPLEX_ | ETH_MAC_CR_AUTO_SPEED_;
1084 	err = lan78xx_write_reg(sc, ETH_MAC_CR, buf);
1085 
1086 	/*
1087 	 * Enable PHY interrupts (Not really getting used for now)
1088 	 * ETH_INT_EP_CTL: interrupt endpoint control register
1089 	 * phy events cause interrupts to be issued
1090 	 */
1091 	err = lan78xx_read_reg(sc, ETH_INT_EP_CTL, &buf);
1092 	buf |= ETH_INT_ENP_PHY_INT;
1093 	err = lan78xx_write_reg(sc, ETH_INT_EP_CTL, buf);
1094 
1095 	/*
1096 	 * Enables mac's transmitter.  It will transmit frames from the buffer
1097 	 * onto the cable.
1098 	 */
1099 	err = lan78xx_read_reg(sc, ETH_MAC_TX, &buf);
1100 	buf |= ETH_MAC_TX_TXEN_;
1101 	err = lan78xx_write_reg(sc, ETH_MAC_TX, buf);
1102 
1103 	/* FIFO is capable of transmitting frames to MAC. */
1104 	err = lan78xx_read_reg(sc, ETH_FCT_TX_CTL, &buf);
1105 	buf |= ETH_FCT_TX_CTL_EN_;
1106 	err = lan78xx_write_reg(sc, ETH_FCT_TX_CTL, buf);
1107 
1108 	/*
1109 	 * Set max frame length.  In linux this is dev->mtu (which by default
1110 	 * is 1500) + VLAN_ETH_HLEN = 1518.
1111 	 */
1112 	err = lan78xx_set_rx_max_frame_length(sc, ETHER_MAX_LEN);
1113 
1114 	/* Initialise the PHY. */
1115 	if ((err = lan78xx_phy_init(sc)) != 0)
1116 		goto init_failed;
1117 
1118 	/* Enable MAC RX. */
1119 	err = lan78xx_read_reg(sc, ETH_MAC_RX, &buf);
1120 	buf |= ETH_MAC_RX_EN_;
1121 	err = lan78xx_write_reg(sc, ETH_MAC_RX, buf);
1122 
1123 	/* Enable FIFO controller RX. */
1124 	err = lan78xx_read_reg(sc, ETH_FCT_RX_CTL, &buf);
1125 	buf |= ETH_FCT_TX_CTL_EN_;
1126 	err = lan78xx_write_reg(sc, ETH_FCT_RX_CTL, buf);
1127 
1128 	sc->sc_flags |= MUGE_FLAG_INIT_DONE;
1129 	return (0);
1130 
1131 init_failed:
1132 	muge_err_printf(sc, "lan78xx_chip_init failed (err=%d)\n", err);
1133 	return (err);
1134 }
1135 
1136 static void
1137 muge_bulk_read_callback(struct usb_xfer *xfer, usb_error_t error)
1138 {
1139 	struct muge_softc *sc = usbd_xfer_softc(xfer);
1140 	struct usb_ether *ue = &sc->sc_ue;
1141 	struct ifnet *ifp = uether_getifp(ue);
1142 	struct mbuf *m;
1143 	struct usb_page_cache *pc;
1144 	uint16_t pktlen;
1145 	uint32_t rx_cmd_a, rx_cmd_b;
1146 	uint16_t rx_cmd_c;
1147 	int off;
1148 	int actlen;
1149 
1150 	usbd_xfer_status(xfer, &actlen, NULL, NULL, NULL);
1151 	muge_dbg_printf(sc, "rx : actlen %d\n", actlen);
1152 
1153 	switch (USB_GET_STATE(xfer)) {
1154 	case USB_ST_TRANSFERRED:
1155 
1156 		/*
1157 		 * There is always a zero length frame after bringing the
1158 		 * interface up.
1159 		 */
1160 		if (actlen < (sizeof(rx_cmd_a) + ETHER_CRC_LEN))
1161 			goto tr_setup;
1162 
1163 		/*
1164 		 * There may be multiple packets in the USB frame.  Each will
1165 		 * have a header and each needs to have its own mbuf allocated
1166 		 * and populated for it.
1167 		 */
1168 		pc = usbd_xfer_get_frame(xfer, 0);
1169 		off = 0;
1170 
1171 		while (off < actlen) {
1172 
1173 			/* The frame header is aligned on a 4 byte boundary. */
1174 			off = ((off + 0x3) & ~0x3);
1175 
1176 			/* Extract RX CMD A. */
1177 			if (off + sizeof(rx_cmd_a) > actlen)
1178 				goto tr_setup;
1179 			usbd_copy_out(pc, off, &rx_cmd_a, sizeof(rx_cmd_a));
1180 			off += (sizeof(rx_cmd_a));
1181 			rx_cmd_a = le32toh(rx_cmd_a);
1182 
1183 
1184 			/* Extract RX CMD B. */
1185 			if (off + sizeof(rx_cmd_b) > actlen)
1186 				goto tr_setup;
1187 			usbd_copy_out(pc, off, &rx_cmd_b, sizeof(rx_cmd_b));
1188 			off += (sizeof(rx_cmd_b));
1189 			rx_cmd_b = le32toh(rx_cmd_b);
1190 
1191 
1192 			/* Extract RX CMD C. */
1193 			if (off + sizeof(rx_cmd_c) > actlen)
1194 				goto tr_setup;
1195 			usbd_copy_out(pc, off, &rx_cmd_c, sizeof(rx_cmd_c));
1196 			off += (sizeof(rx_cmd_c));
1197 			rx_cmd_c = le32toh(rx_cmd_c);
1198 
1199 			if (off > actlen)
1200 				goto tr_setup;
1201 
1202 			pktlen = (rx_cmd_a & RX_CMD_A_LEN_MASK_);
1203 
1204 			muge_dbg_printf(sc,
1205 			    "rx_cmd_a 0x%08x rx_cmd_b 0x%08x rx_cmd_c 0x%04x "
1206 			    " pktlen %d actlen %d off %d\n",
1207 			    rx_cmd_a, rx_cmd_b, rx_cmd_c, pktlen, actlen, off);
1208 
1209 			if (rx_cmd_a & RX_CMD_A_RED_) {
1210 				muge_dbg_printf(sc,
1211 				     "rx error (hdr 0x%08x)\n", rx_cmd_a);
1212 				if_inc_counter(ifp, IFCOUNTER_IERRORS, 1);
1213 			} else {
1214 				/* Ethernet frame too big or too small? */
1215 				if ((pktlen < ETHER_HDR_LEN) ||
1216 				    (pktlen > (actlen - off)))
1217 					goto tr_setup;
1218 
1219 				/* Create a new mbuf to store the packet. */
1220 				m = uether_newbuf();
1221 				if (m == NULL) {
1222 					muge_warn_printf(sc,
1223 					    "failed to create new mbuf\n");
1224 					if_inc_counter(ifp, IFCOUNTER_IQDROPS,
1225 					    1);
1226 					goto tr_setup;
1227 				}
1228 
1229 				usbd_copy_out(pc, off, mtod(m, uint8_t *),
1230 				    pktlen);
1231 
1232 				/*
1233 				 * Check if RX checksums are computed, and
1234 				 * offload them
1235 				 */
1236 				if ((ifp->if_capabilities & IFCAP_RXCSUM) &&
1237 				    !(rx_cmd_a & RX_CMD_A_ICSM_)) {
1238 					struct ether_header *eh;
1239 					eh = mtod(m, struct ether_header *);
1240 					/*
1241 					 * Remove the extra 2 bytes of the csum
1242 					 *
1243 					 * The checksum appears to be
1244 					 * simplistically calculated over the
1245 					 * protocol headers up to the end of the
1246 					 * eth frame.  Which means if the eth
1247 					 * frame is padded the csum calculation
1248 					 * is incorrectly performed over the
1249 					 * padding bytes as well.  Therefore to
1250 					 * be safe we ignore the H/W csum on
1251 					 * frames less than or equal to
1252 					 * 64 bytes.
1253 					 *
1254 					 * Protocols checksummed:
1255 					 * TCP, UDP, ICMP, IGMP, IP
1256 					 */
1257 					if (pktlen > ETHER_MIN_LEN) {
1258 						m->m_pkthdr.csum_flags |=
1259 						    CSUM_DATA_VALID;
1260 
1261 						/*
1262 						 * Copy the checksum from the
1263 						 * last 2 bytes of the transfer
1264 						 * and put in the csum_data
1265 						 * field.
1266 						 */
1267 						usbd_copy_out(pc,
1268 						    (off + pktlen),
1269 						    &m->m_pkthdr.csum_data, 2);
1270 
1271 						/*
1272 						 * The data is copied in network
1273 						 * order, but the csum algorithm
1274 						 * in the kernel expects it to
1275 						 * be in host network order.
1276 						 */
1277 						m->m_pkthdr.csum_data =
1278 						   ntohs(m->m_pkthdr.csum_data);
1279 
1280 						muge_dbg_printf(sc,
1281 						    "RX checksum offloaded (0x%04x)\n",
1282 						    m->m_pkthdr.csum_data);
1283 					}
1284 				}
1285 
1286 				/* Enqueue the mbuf on the receive queue. */
1287 				if (pktlen < (4 + ETHER_HDR_LEN)) {
1288 					m_freem(m);
1289 					goto tr_setup;
1290 				}
1291 				/* Remove 4 trailing bytes */
1292 				uether_rxmbuf(ue, m, pktlen - 4);
1293 			}
1294 
1295 			/*
1296 			 * Update the offset to move to the next potential
1297 			 * packet.
1298 			 */
1299 			off += pktlen;
1300 		}
1301 
1302 		/* FALLTHROUGH */
1303 	case USB_ST_SETUP:
1304 tr_setup:
1305 		usbd_xfer_set_frame_len(xfer, 0, usbd_xfer_max_len(xfer));
1306 		usbd_transfer_submit(xfer);
1307 		uether_rxflush(ue);
1308 		return;
1309 
1310 	default:
1311 		if (error != USB_ERR_CANCELLED) {
1312 			muge_warn_printf(sc, "bulk read error, %s\n",
1313 			    usbd_errstr(error));
1314 			usbd_xfer_set_stall(xfer);
1315 			goto tr_setup;
1316 		}
1317 		return;
1318 	}
1319 }
1320 
1321 /**
1322  *	muge_bulk_write_callback - Write callback used to send ethernet frame(s)
1323  *	@xfer: the USB transfer
1324  *	@error: error code if the transfers is in an errored state
1325  *
1326  *	The main write function that pulls ethernet frames off the queue and
1327  *	sends them out.
1328  *
1329  */
1330 static void
1331 muge_bulk_write_callback(struct usb_xfer *xfer, usb_error_t error)
1332 {
1333 	struct muge_softc *sc = usbd_xfer_softc(xfer);
1334 	struct ifnet *ifp = uether_getifp(&sc->sc_ue);
1335 	struct usb_page_cache *pc;
1336 	struct mbuf *m;
1337 	int nframes;
1338 	uint32_t frm_len = 0, tx_cmd_a = 0, tx_cmd_b = 0;
1339 
1340 	switch (USB_GET_STATE(xfer)) {
1341 	case USB_ST_TRANSFERRED:
1342 		muge_dbg_printf(sc,
1343 		    "USB TRANSFER status: USB_ST_TRANSFERRED\n");
1344 		ifp->if_drv_flags &= ~IFF_DRV_OACTIVE;
1345 		/* FALLTHROUGH */
1346 	case USB_ST_SETUP:
1347 		muge_dbg_printf(sc, "USB TRANSFER status: USB_ST_SETUP\n");
1348 tr_setup:
1349 		if ((sc->sc_flags & MUGE_FLAG_LINK) == 0 ||
1350 			(ifp->if_drv_flags & IFF_DRV_OACTIVE) != 0) {
1351 			muge_dbg_printf(sc,
1352 			    "sc->sc_flags & MUGE_FLAG_LINK: %d\n",
1353 			    (sc->sc_flags & MUGE_FLAG_LINK));
1354 			muge_dbg_printf(sc,
1355 			    "ifp->if_drv_flags & IFF_DRV_OACTIVE: %d\n",
1356 			    (ifp->if_drv_flags & IFF_DRV_OACTIVE));
1357 			muge_dbg_printf(sc,
1358 			    "USB TRANSFER not sending: no link or controller is busy \n");
1359 			/*
1360 			 * Don't send anything if there is no link or
1361 			 * controller is busy.
1362 			 */
1363 			return;
1364 		}
1365 		for (nframes = 0; nframes < 16 &&
1366 		    !IFQ_DRV_IS_EMPTY(&ifp->if_snd); nframes++) {
1367 			IFQ_DRV_DEQUEUE(&ifp->if_snd, m);
1368 			if (m == NULL)
1369 				break;
1370 			usbd_xfer_set_frame_offset(xfer, nframes * MCLBYTES,
1371 				nframes);
1372 			frm_len = 0;
1373 			pc = usbd_xfer_get_frame(xfer, nframes);
1374 
1375 			/*
1376 			 * Each frame is prefixed with two 32-bit values
1377 			 * describing the length of the packet and buffer.
1378 			 */
1379 			tx_cmd_a = (m->m_pkthdr.len & TX_CMD_A_LEN_MASK_) |
1380 			     TX_CMD_A_FCS_;
1381 			tx_cmd_a = htole32(tx_cmd_a);
1382 			usbd_copy_in(pc, 0, &tx_cmd_a, sizeof(tx_cmd_a));
1383 
1384 			tx_cmd_b = 0;
1385 
1386 			/* TCP LSO Support will probably be implemented here. */
1387 			tx_cmd_b = htole32(tx_cmd_b);
1388 			usbd_copy_in(pc, 4, &tx_cmd_b, sizeof(tx_cmd_b));
1389 
1390 			frm_len += 8;
1391 
1392 			/* Next copy in the actual packet */
1393 			usbd_m_copy_in(pc, frm_len, m, 0, m->m_pkthdr.len);
1394 			frm_len += m->m_pkthdr.len;
1395 
1396 			if_inc_counter(ifp, IFCOUNTER_OPACKETS, 1);
1397 
1398 			/*
1399 			 * If there's a BPF listener, bounce a copy of this
1400 			 * frame to it.
1401 			 */
1402 			BPF_MTAP(ifp, m);
1403 			m_freem(m);
1404 
1405 			/* Set frame length. */
1406 			usbd_xfer_set_frame_len(xfer, nframes, frm_len);
1407 		}
1408 
1409 		muge_dbg_printf(sc, "USB TRANSFER nframes: %d\n", nframes);
1410 		if (nframes != 0) {
1411 			muge_dbg_printf(sc, "USB TRANSFER submit attempt\n");
1412 			usbd_xfer_set_frames(xfer, nframes);
1413 			usbd_transfer_submit(xfer);
1414 			ifp->if_drv_flags |= IFF_DRV_OACTIVE;
1415 		}
1416 		return;
1417 
1418 	default:
1419 		if_inc_counter(ifp, IFCOUNTER_OERRORS, 1);
1420 		ifp->if_drv_flags &= ~IFF_DRV_OACTIVE;
1421 
1422 		if (error != USB_ERR_CANCELLED) {
1423 			muge_err_printf(sc,
1424 			    "usb error on tx: %s\n", usbd_errstr(error));
1425 			usbd_xfer_set_stall(xfer);
1426 			goto tr_setup;
1427 		}
1428 		return;
1429 	}
1430 }
1431 
1432 /**
1433  *	muge_attach_post - Called after the driver attached to the USB interface
1434  *	@ue: the USB ethernet device
1435  *
1436  *	This is where the chip is intialised for the first time.  This is
1437  *	different from the muge_init() function in that that one is designed to
1438  *	setup the H/W to match the UE settings and can be called after a reset.
1439  *
1440  */
1441 static void
1442 muge_attach_post(struct usb_ether *ue)
1443 {
1444 	struct muge_softc *sc = uether_getsc(ue);
1445 	uint32_t mac_h, mac_l;
1446 	muge_dbg_printf(sc, "Calling muge_attach_post.\n");
1447 
1448 	/* Setup some of the basics */
1449 	sc->sc_phyno = 1;
1450 
1451 	/*
1452 	 * Attempt to get the mac address, if an EEPROM is not attached this
1453 	 * will just return FF:FF:FF:FF:FF:FF, so in such cases we invent a MAC
1454 	 * address based on urandom.
1455 	 */
1456 	memset(sc->sc_ue.ue_eaddr, 0xff, ETHER_ADDR_LEN);
1457 
1458 	uint32_t val;
1459 	lan78xx_read_reg(sc, 0, &val);
1460 
1461 	/* Read current MAC address from RX_ADDRx registers. */
1462 	if ((lan78xx_read_reg(sc, ETH_RX_ADDRL, &mac_l) == 0) &&
1463 	    (lan78xx_read_reg(sc, ETH_RX_ADDRH, &mac_h) == 0)) {
1464 		sc->sc_ue.ue_eaddr[5] = (uint8_t)((mac_h >> 8) & 0xff);
1465 		sc->sc_ue.ue_eaddr[4] = (uint8_t)((mac_h) & 0xff);
1466 		sc->sc_ue.ue_eaddr[3] = (uint8_t)((mac_l >> 24) & 0xff);
1467 		sc->sc_ue.ue_eaddr[2] = (uint8_t)((mac_l >> 16) & 0xff);
1468 		sc->sc_ue.ue_eaddr[1] = (uint8_t)((mac_l >> 8) & 0xff);
1469 		sc->sc_ue.ue_eaddr[0] = (uint8_t)((mac_l) & 0xff);
1470 	}
1471 
1472 	/* If RX_ADDRx did not provide a valid MAC address, try EEPROM. */
1473 	if (!ETHER_IS_VALID(sc->sc_ue.ue_eaddr)) {
1474 		if ((lan78xx_eeprom_read(sc, ETH_E2P_MAC_OFFSET,
1475 		    sc->sc_ue.ue_eaddr, ETHER_ADDR_LEN) == 0) ||
1476 		    (lan78xx_otp_read(sc, OTP_MAC_OFFSET,
1477 		    sc->sc_ue.ue_eaddr, ETHER_ADDR_LEN) == 0)) {
1478 			if (ETHER_IS_VALID(sc->sc_ue.ue_eaddr)) {
1479 				muge_dbg_printf(sc, "MAC read from EEPROM\n");
1480 			} else {
1481 				muge_dbg_printf(sc, "MAC assigned randomly\n");
1482 				read_random(sc->sc_ue.ue_eaddr, ETHER_ADDR_LEN);
1483 				sc->sc_ue.ue_eaddr[0] &= ~0x01;	/* unicast */
1484 				sc->sc_ue.ue_eaddr[0] |= 0x02;/* locally administered */
1485 			}
1486 		} else {
1487 			muge_dbg_printf(sc, "MAC assigned randomly\n");
1488 			arc4rand(sc->sc_ue.ue_eaddr, ETHER_ADDR_LEN, 0);
1489 			sc->sc_ue.ue_eaddr[0] &= ~0x01;	/* unicast */
1490 			sc->sc_ue.ue_eaddr[0] |= 0x02;	/* locally administered */
1491 		}
1492 	} else {
1493 		muge_dbg_printf(sc, "MAC assigned from registers\n");
1494 	}
1495 
1496 	/* Initialise the chip for the first time */
1497 	lan78xx_chip_init(sc);
1498 }
1499 
1500 /**
1501  *	muge_attach_post_sub - Called after attach to the USB interface
1502  *	@ue: the USB ethernet device
1503  *
1504  *	Most of this is boilerplate code and copied from the base USB ethernet
1505  *	driver.  It has been overriden so that we can indicate to the system
1506  *	that the chip supports H/W checksumming.
1507  *
1508  *	RETURNS:
1509  *	Returns 0 on success or a negative error code.
1510  */
1511 static int
1512 muge_attach_post_sub(struct usb_ether *ue)
1513 {
1514 	struct muge_softc *sc;
1515 	struct ifnet *ifp;
1516 	int error;
1517 
1518 	sc = uether_getsc(ue);
1519 	muge_dbg_printf(sc, "Calling muge_attach_post_sub.\n");
1520 	ifp = ue->ue_ifp;
1521 	ifp->if_flags = IFF_BROADCAST | IFF_SIMPLEX | IFF_MULTICAST;
1522 	ifp->if_start = uether_start;
1523 	ifp->if_ioctl = muge_ioctl;
1524 	ifp->if_init = uether_init;
1525 	IFQ_SET_MAXLEN(&ifp->if_snd, ifqmaxlen);
1526 	ifp->if_snd.ifq_drv_maxlen = ifqmaxlen;
1527 	IFQ_SET_READY(&ifp->if_snd);
1528 
1529 	/*
1530 	 * The chip supports TCP/UDP checksum offloading on TX and RX paths,
1531 	 * however currently only RX checksum is supported in the driver
1532 	 * (see top of file).
1533 	 */
1534 	ifp->if_hwassist = 0;
1535 	if (MUGE_DEFAULT_RX_CSUM_ENABLE)
1536 		ifp->if_capabilities |= IFCAP_RXCSUM;
1537 
1538 	if (MUGE_DEFAULT_TX_CSUM_ENABLE)
1539 		ifp->if_capabilities |= IFCAP_TXCSUM;
1540 
1541 	/*
1542 	 * In the Linux driver they also enable scatter/gather (NETIF_F_SG)
1543 	 * here, that's something related to socket buffers used in Linux.
1544 	 * FreeBSD doesn't have that as an interface feature.
1545 	 */
1546 	if (MUGE_DEFAULT_TSO_CSUM_ENABLE)
1547 		ifp->if_capabilities |= IFCAP_TSO4 | IFCAP_TSO6;
1548 
1549 #if 0
1550 	/* TX checksuming is disabled since not yet implemented. */
1551 	ifp->if_capabilities |= IFCAP_TXCSUM;
1552 	ifp->if_capenable |= IFCAP_TXCSUM;
1553 	ifp->if_hwassist = CSUM_TCP | CSUM_UDP;
1554 #endif
1555 
1556 	ifp->if_capenable = ifp->if_capabilities;
1557 
1558 	mtx_lock(&Giant);
1559 	error = mii_attach(ue->ue_dev, &ue->ue_miibus, ifp,
1560 		uether_ifmedia_upd, ue->ue_methods->ue_mii_sts,
1561 		BMSR_DEFCAPMASK, sc->sc_phyno, MII_OFFSET_ANY, 0);
1562 	mtx_unlock(&Giant);
1563 
1564 	return (0);
1565 }
1566 
1567 /**
1568  *	muge_start - Starts communication with the LAN78xx chip
1569  *	@ue: USB ether interface
1570  */
1571 static void
1572 muge_start(struct usb_ether *ue)
1573 {
1574 	struct muge_softc *sc = uether_getsc(ue);
1575 
1576 	/*
1577 	 * Start the USB transfers, if not already started.
1578 	 */
1579 	usbd_transfer_start(sc->sc_xfer[MUGE_BULK_DT_RD]);
1580 	usbd_transfer_start(sc->sc_xfer[MUGE_BULK_DT_WR]);
1581 }
1582 
1583 /**
1584  *	muge_ioctl - ioctl function for the device
1585  *	@ifp: interface pointer
1586  *	@cmd: the ioctl command
1587  *	@data: data passed in the ioctl call, typically a pointer to struct
1588  *	ifreq.
1589  *
1590  *	The ioctl routine is overridden to detect change requests for the H/W
1591  *	checksum capabilities.
1592  *
1593  *	RETURNS:
1594  *	0 on success and an error code on failure.
1595  */
1596 static int
1597 muge_ioctl(struct ifnet *ifp, u_long cmd, caddr_t data)
1598 {
1599 	struct usb_ether *ue = ifp->if_softc;
1600 	struct muge_softc *sc;
1601 	struct ifreq *ifr;
1602 	int rc;
1603 	int mask;
1604 	int reinit;
1605 
1606 	if (cmd == SIOCSIFCAP) {
1607 		sc = uether_getsc(ue);
1608 		ifr = (struct ifreq *)data;
1609 
1610 		MUGE_LOCK(sc);
1611 
1612 		rc = 0;
1613 		reinit = 0;
1614 
1615 		mask = ifr->ifr_reqcap ^ ifp->if_capenable;
1616 
1617 		/* Modify the RX CSUM enable bits. */
1618 		if ((mask & IFCAP_RXCSUM) != 0 &&
1619 			(ifp->if_capabilities & IFCAP_RXCSUM) != 0) {
1620 			ifp->if_capenable ^= IFCAP_RXCSUM;
1621 
1622 			if (ifp->if_drv_flags & IFF_DRV_RUNNING) {
1623 				ifp->if_drv_flags &= ~IFF_DRV_RUNNING;
1624 				reinit = 1;
1625 			}
1626 		}
1627 
1628 		MUGE_UNLOCK(sc);
1629 		if (reinit)
1630 			uether_init(ue);
1631 
1632 	} else {
1633 		rc = uether_ioctl(ifp, cmd, data);
1634 	}
1635 
1636 	return (rc);
1637 }
1638 
1639 /**
1640  *	muge_reset - Reset the SMSC chip
1641  *	@sc: device soft context
1642  *
1643  *	LOCKING:
1644  *	Should be called with the SMSC lock held.
1645  */
1646 static void
1647 muge_reset(struct muge_softc *sc)
1648 {
1649 	struct usb_config_descriptor *cd;
1650 	usb_error_t err;
1651 
1652 	cd = usbd_get_config_descriptor(sc->sc_ue.ue_udev);
1653 
1654 	err = usbd_req_set_config(sc->sc_ue.ue_udev, &sc->sc_mtx,
1655 	    cd->bConfigurationValue);
1656 	if (err)
1657 		muge_warn_printf(sc, "reset failed (ignored)\n");
1658 
1659 	/* Wait a little while for the chip to get its brains in order. */
1660 	uether_pause(&sc->sc_ue, hz / 100);
1661 
1662 	/* Reinitialize controller to achieve full reset. */
1663 	lan78xx_chip_init(sc);
1664 }
1665 
1666 /**
1667  * muge_set_addr_filter
1668  *
1669  *	@sc: device soft context
1670  *	@index: index of the entry to the perfect address table
1671  *	@addr: address to be written
1672  *
1673  */
1674 static void
1675 muge_set_addr_filter(struct muge_softc *sc, int index,
1676     uint8_t addr[ETHER_ADDR_LEN])
1677 {
1678 	uint32_t tmp;
1679 
1680 	if ((sc) && (index > 0) && (index < MUGE_NUM_PFILTER_ADDRS_)) {
1681 		tmp = addr[3];
1682 		tmp |= addr[2] | (tmp << 8);
1683 		tmp |= addr[1] | (tmp << 8);
1684 		tmp |= addr[0] | (tmp << 8);
1685 		sc->sc_pfilter_table[index][1] = tmp;
1686 		tmp = addr[5];
1687 		tmp |= addr[4] | (tmp << 8);
1688 		tmp |= ETH_MAF_HI_VALID_ | ETH_MAF_HI_TYPE_DST_;
1689 		sc->sc_pfilter_table[index][0] = tmp;
1690 	}
1691 }
1692 
1693 /**
1694  *	lan78xx_dataport_write - write to the selected RAM
1695  *	@sc: The device soft context.
1696  *	@ram_select: Select which RAM to access.
1697  *	@addr: Starting address to write to.
1698  *	@buf: word-sized buffer to write to RAM, starting at @addr.
1699  *	@length: length of @buf
1700  *
1701  *
1702  *	RETURNS:
1703  *	0 if write successful.
1704  */
1705 static int
1706 lan78xx_dataport_write(struct muge_softc *sc, uint32_t ram_select,
1707     uint32_t addr, uint32_t length, uint32_t *buf)
1708 {
1709 	uint32_t dp_sel;
1710 	int i, ret;
1711 
1712 	MUGE_LOCK_ASSERT(sc, MA_OWNED);
1713 	ret = lan78xx_wait_for_bits(sc, ETH_DP_SEL, ETH_DP_SEL_DPRDY_);
1714 	if (ret < 0)
1715 		goto done;
1716 
1717 	ret = lan78xx_read_reg(sc, ETH_DP_SEL, &dp_sel);
1718 
1719 	dp_sel &= ~ETH_DP_SEL_RSEL_MASK_;
1720 	dp_sel |= ram_select;
1721 
1722 	ret = lan78xx_write_reg(sc, ETH_DP_SEL, dp_sel);
1723 
1724 	for (i = 0; i < length; i++) {
1725 		ret = lan78xx_write_reg(sc, ETH_DP_ADDR, addr + i);
1726 		ret = lan78xx_write_reg(sc, ETH_DP_DATA, buf[i]);
1727 		ret = lan78xx_write_reg(sc, ETH_DP_CMD, ETH_DP_CMD_WRITE_);
1728 		ret = lan78xx_wait_for_bits(sc, ETH_DP_SEL, ETH_DP_SEL_DPRDY_);
1729 		if (ret != 0)
1730 			goto done;
1731 	}
1732 
1733 done:
1734 	return (ret);
1735 }
1736 
1737 /**
1738  * muge_multicast_write
1739  * @sc: device's soft context
1740  *
1741  * Writes perfect addres filters and hash address filters to their
1742  * corresponding registers and RAMs.
1743  *
1744  */
1745 static void
1746 muge_multicast_write(struct muge_softc *sc)
1747 {
1748 	int i, ret;
1749 	lan78xx_dataport_write(sc, ETH_DP_SEL_RSEL_VLAN_DA_,
1750 	    ETH_DP_SEL_VHF_VLAN_LEN, ETH_DP_SEL_VHF_HASH_LEN,
1751 	    sc->sc_mchash_table);
1752 
1753 	for (i = 1; i < MUGE_NUM_PFILTER_ADDRS_; i++) {
1754 		ret = lan78xx_write_reg(sc, PFILTER_HI(i), 0);
1755 		ret = lan78xx_write_reg(sc, PFILTER_LO(i),
1756 		    sc->sc_pfilter_table[i][1]);
1757 		ret = lan78xx_write_reg(sc, PFILTER_HI(i),
1758 		    sc->sc_pfilter_table[i][0]);
1759 	}
1760 }
1761 
1762 /**
1763  *	muge_hash - Calculate the hash of a mac address
1764  *	@addr: The mac address to calculate the hash on
1765  *
1766  *	This function is used when configuring a range of multicast mac
1767  *	addresses to filter on.  The hash of the mac address is put in the
1768  *	device's mac hash table.
1769  *
1770  *	RETURNS:
1771  *	Returns a value from 0-63 value which is the hash of the mac address.
1772  */
1773 static inline uint32_t
1774 muge_hash(uint8_t addr[ETHER_ADDR_LEN])
1775 {
1776 	return (ether_crc32_be(addr, ETHER_ADDR_LEN) >> 26) & 0x3f;
1777 }
1778 
1779 /**
1780  *	muge_setmulti - Setup multicast
1781  *	@ue: usb ethernet device context
1782  *
1783  *	Tells the device to either accept frames with a multicast mac address,
1784  *	a select group of m'cast mac addresses or just the devices mac address.
1785  *
1786  *	LOCKING:
1787  *	Should be called with the MUGE lock held.
1788  */
1789 static void
1790 muge_setmulti(struct usb_ether *ue)
1791 {
1792 	struct muge_softc *sc = uether_getsc(ue);
1793 	struct ifnet *ifp = uether_getifp(ue);
1794 	uint8_t i, *addr;
1795 	struct ifmultiaddr *ifma;
1796 
1797 	MUGE_LOCK_ASSERT(sc, MA_OWNED);
1798 
1799 	sc->sc_rfe_ctl &= ~(ETH_RFE_CTL_UCAST_EN_ | ETH_RFE_CTL_MCAST_EN_ |
1800 		ETH_RFE_CTL_DA_PERFECT_ | ETH_RFE_CTL_MCAST_HASH_);
1801 
1802 	/* Initialize hash filter table. */
1803 	for (i = 0; i < ETH_DP_SEL_VHF_HASH_LEN; i++)
1804 		sc->sc_mchash_table[i] = 0;
1805 
1806 	/* Initialize perfect filter table. */
1807 	for (i = 1; i < MUGE_NUM_PFILTER_ADDRS_; i++) {
1808 		sc->sc_pfilter_table[i][0] =
1809 		sc->sc_pfilter_table[i][1] = 0;
1810 	}
1811 
1812 	sc->sc_rfe_ctl |= ETH_RFE_CTL_BCAST_EN_;
1813 
1814 	if (ifp->if_flags & IFF_PROMISC) {
1815 		muge_dbg_printf(sc, "promiscuous mode enabled\n");
1816 		sc->sc_rfe_ctl |= ETH_RFE_CTL_MCAST_EN_ | ETH_RFE_CTL_UCAST_EN_;
1817 	} else if (ifp->if_flags & IFF_ALLMULTI){
1818 		muge_dbg_printf(sc, "receive all multicast enabled\n");
1819 		sc->sc_rfe_ctl |= ETH_RFE_CTL_MCAST_EN_;
1820 	} else {
1821 		/* Lock the mac address list before hashing each of them. */
1822 		if_maddr_rlock(ifp);
1823 		if (!CK_STAILQ_EMPTY(&ifp->if_multiaddrs)) {
1824 			i = 1;
1825 			CK_STAILQ_FOREACH(ifma, &ifp->if_multiaddrs,
1826 			    ifma_link) {
1827 				/* First fill up the perfect address table. */
1828 				addr = LLADDR((struct sockaddr_dl *)
1829 				    ifma->ifma_addr);
1830 				if (i < 33 /* XXX */) {
1831 					muge_set_addr_filter(sc, i, addr);
1832 				} else {
1833 					uint32_t bitnum = muge_hash(addr);
1834 					sc->sc_mchash_table[bitnum / 32] |=
1835 					    (1 << (bitnum % 32));
1836 					sc->sc_rfe_ctl |=
1837 					    ETH_RFE_CTL_MCAST_HASH_;
1838 				}
1839 				i++;
1840 			}
1841 		}
1842 		if_maddr_runlock(ifp);
1843 		muge_multicast_write(sc);
1844 	}
1845 	lan78xx_write_reg(sc, ETH_RFE_CTL, sc->sc_rfe_ctl);
1846 }
1847 
1848 /**
1849  *	muge_setpromisc - Enables/disables promiscuous mode
1850  *	@ue: usb ethernet device context
1851  *
1852  *	LOCKING:
1853  *	Should be called with the MUGE lock held.
1854  */
1855 static void
1856 muge_setpromisc(struct usb_ether *ue)
1857 {
1858 	struct muge_softc *sc = uether_getsc(ue);
1859 	struct ifnet *ifp = uether_getifp(ue);
1860 
1861 	muge_dbg_printf(sc, "promiscuous mode %sabled\n",
1862 	    (ifp->if_flags & IFF_PROMISC) ? "en" : "dis");
1863 
1864 	MUGE_LOCK_ASSERT(sc, MA_OWNED);
1865 
1866 	if (ifp->if_flags & IFF_PROMISC)
1867 		sc->sc_rfe_ctl |= ETH_RFE_CTL_MCAST_EN_ | ETH_RFE_CTL_UCAST_EN_;
1868 	else
1869 		sc->sc_rfe_ctl &= ~(ETH_RFE_CTL_MCAST_EN_);
1870 
1871 	lan78xx_write_reg(sc, ETH_RFE_CTL, sc->sc_rfe_ctl);
1872 }
1873 
1874 /**
1875  *	muge_sethwcsum - Enable or disable H/W UDP and TCP checksumming
1876  *	@sc: driver soft context
1877  *
1878  *	LOCKING:
1879  *	Should be called with the MUGE lock held.
1880  *
1881  *	RETURNS:
1882  *	Returns 0 on success or a negative error code.
1883  */
1884 static int muge_sethwcsum(struct muge_softc *sc)
1885 {
1886 	struct ifnet *ifp = uether_getifp(&sc->sc_ue);
1887 	int err;
1888 
1889 	if (!ifp)
1890 		return (-EIO);
1891 
1892 	MUGE_LOCK_ASSERT(sc, MA_OWNED);
1893 
1894 	if (ifp->if_capabilities & IFCAP_RXCSUM) {
1895 		sc->sc_rfe_ctl |= ETH_RFE_CTL_IGMP_COE_ | ETH_RFE_CTL_ICMP_COE_;
1896 		sc->sc_rfe_ctl |= ETH_RFE_CTL_TCPUDP_COE_ | ETH_RFE_CTL_IP_COE_;
1897 	} else {
1898 		sc->sc_rfe_ctl &=
1899 		    ~(ETH_RFE_CTL_IGMP_COE_ | ETH_RFE_CTL_ICMP_COE_);
1900 		sc->sc_rfe_ctl &=
1901 		     ~(ETH_RFE_CTL_TCPUDP_COE_ | ETH_RFE_CTL_IP_COE_);
1902 	}
1903 
1904 	sc->sc_rfe_ctl &= ~ETH_RFE_CTL_VLAN_FILTER_;
1905 
1906 	err = lan78xx_write_reg(sc, ETH_RFE_CTL, sc->sc_rfe_ctl);
1907 
1908 	if (err != 0) {
1909 		muge_warn_printf(sc, "failed to write ETH_RFE_CTL (err=%d)\n",
1910 		    err);
1911 		return (err);
1912 	}
1913 
1914 	return (0);
1915 }
1916 
1917 /**
1918  *	muge_ifmedia_upd - Set media options
1919  *	@ifp: interface pointer
1920  *
1921  *	Basically boilerplate code that simply calls the mii functions to set
1922  *	the media options.
1923  *
1924  *	LOCKING:
1925  *	The device lock must be held before this function is called.
1926  *
1927  *	RETURNS:
1928  *	Returns 0 on success or a negative error code.
1929  */
1930 static int
1931 muge_ifmedia_upd(struct ifnet *ifp)
1932 {
1933 	struct muge_softc *sc = ifp->if_softc;
1934 	muge_dbg_printf(sc, "Calling muge_ifmedia_upd.\n");
1935 	struct mii_data *mii = uether_getmii(&sc->sc_ue);
1936 	struct mii_softc *miisc;
1937 	int err;
1938 
1939 	MUGE_LOCK_ASSERT(sc, MA_OWNED);
1940 
1941 	LIST_FOREACH(miisc, &mii->mii_phys, mii_list)
1942 		PHY_RESET(miisc);
1943 	err = mii_mediachg(mii);
1944 	return (err);
1945 }
1946 
1947 /**
1948  *	muge_init - Initialises the LAN95xx chip
1949  *	@ue: USB ether interface
1950  *
1951  *	Called when the interface is brought up (i.e. ifconfig ue0 up), this
1952  *	initialise the interface and the rx/tx pipes.
1953  *
1954  *	LOCKING:
1955  *	Should be called with the MUGE lock held.
1956  */
1957 static void
1958 muge_init(struct usb_ether *ue)
1959 {
1960 	struct muge_softc *sc = uether_getsc(ue);
1961 	muge_dbg_printf(sc, "Calling muge_init.\n");
1962 	struct ifnet *ifp = uether_getifp(ue);
1963 	MUGE_LOCK_ASSERT(sc, MA_OWNED);
1964 
1965 	if (lan78xx_setmacaddress(sc, IF_LLADDR(ifp)))
1966 		muge_dbg_printf(sc, "setting MAC address failed\n");
1967 
1968 	if ((ifp->if_drv_flags & IFF_DRV_RUNNING) != 0)
1969 		return;
1970 
1971 	/* Cancel pending I/O. */
1972 	muge_stop(ue);
1973 
1974 	/* Reset the ethernet interface. */
1975 	muge_reset(sc);
1976 
1977 	/* Load the multicast filter. */
1978 	muge_setmulti(ue);
1979 
1980 	/* TCP/UDP checksum offload engines. */
1981 	muge_sethwcsum(sc);
1982 
1983 	usbd_xfer_set_stall(sc->sc_xfer[MUGE_BULK_DT_WR]);
1984 
1985 	/* Indicate we are up and running. */
1986 	ifp->if_drv_flags |= IFF_DRV_RUNNING;
1987 
1988 	/* Switch to selected media. */
1989 	muge_ifmedia_upd(ifp);
1990 	muge_start(ue);
1991 }
1992 
1993 /**
1994  *	muge_stop - Stops communication with the LAN78xx chip
1995  *	@ue: USB ether interface
1996  */
1997 static void
1998 muge_stop(struct usb_ether *ue)
1999 {
2000 	struct muge_softc *sc = uether_getsc(ue);
2001 	struct ifnet *ifp = uether_getifp(ue);
2002 
2003 	MUGE_LOCK_ASSERT(sc, MA_OWNED);
2004 
2005 	ifp->if_drv_flags &= ~(IFF_DRV_RUNNING | IFF_DRV_OACTIVE);
2006 	sc->sc_flags &= ~MUGE_FLAG_LINK;
2007 
2008 	/*
2009 	 * Stop all the transfers, if not already stopped.
2010 	 */
2011 	usbd_transfer_stop(sc->sc_xfer[MUGE_BULK_DT_WR]);
2012 	usbd_transfer_stop(sc->sc_xfer[MUGE_BULK_DT_RD]);
2013 }
2014 
2015 /**
2016  *	muge_tick - Called periodically to monitor the state of the LAN95xx chip
2017  *	@ue: USB ether interface
2018  *
2019  *	Simply calls the mii status functions to check the state of the link.
2020  *
2021  *	LOCKING:
2022  *	Should be called with the MUGE lock held.
2023  */
2024 static void
2025 muge_tick(struct usb_ether *ue)
2026 {
2027 
2028 	struct muge_softc *sc = uether_getsc(ue);
2029 	struct mii_data *mii = uether_getmii(&sc->sc_ue);
2030 
2031 	MUGE_LOCK_ASSERT(sc, MA_OWNED);
2032 
2033 	mii_tick(mii);
2034 	if ((sc->sc_flags & MUGE_FLAG_LINK) == 0) {
2035 		lan78xx_miibus_statchg(ue->ue_dev);
2036 		if ((sc->sc_flags & MUGE_FLAG_LINK) != 0)
2037 			muge_start(ue);
2038 	}
2039 }
2040 
2041 /**
2042  *	muge_ifmedia_sts - Report current media status
2043  *	@ifp: inet interface pointer
2044  *	@ifmr: interface media request
2045  *
2046  *	Call the mii functions to get the media status.
2047  *
2048  *	LOCKING:
2049  *	Internally takes and releases the device lock.
2050  */
2051 static void
2052 muge_ifmedia_sts(struct ifnet *ifp, struct ifmediareq *ifmr)
2053 {
2054 	struct muge_softc *sc = ifp->if_softc;
2055 	struct mii_data *mii = uether_getmii(&sc->sc_ue);
2056 
2057 	MUGE_LOCK(sc);
2058 	mii_pollstat(mii);
2059 	ifmr->ifm_active = mii->mii_media_active;
2060 	ifmr->ifm_status = mii->mii_media_status;
2061 	MUGE_UNLOCK(sc);
2062 }
2063 
2064 /**
2065  *	muge_probe - Probe the interface.
2066  *	@dev: muge device handle
2067  *
2068  *	Checks if the device is a match for this driver.
2069  *
2070  *	RETURNS:
2071  *	Returns 0 on success or an error code on failure.
2072  */
2073 static int
2074 muge_probe(device_t dev)
2075 {
2076 	struct usb_attach_arg *uaa = device_get_ivars(dev);
2077 
2078 	if (uaa->usb_mode != USB_MODE_HOST)
2079 		return (ENXIO);
2080 	if (uaa->info.bConfigIndex != MUGE_CONFIG_INDEX)
2081 		return (ENXIO);
2082 	if (uaa->info.bIfaceIndex != MUGE_IFACE_IDX)
2083 		return (ENXIO);
2084 	return (usbd_lookup_id_by_uaa(lan78xx_devs, sizeof(lan78xx_devs), uaa));
2085 }
2086 
2087 /**
2088  *	muge_attach - Attach the interface.
2089  *	@dev: muge device handle
2090  *
2091  *	Allocate softc structures, do ifmedia setup and ethernet/BPF attach.
2092  *
2093  *	RETURNS:
2094  *	Returns 0 on success or a negative error code.
2095  */
2096 static int
2097 muge_attach(device_t dev)
2098 {
2099 	struct usb_attach_arg *uaa = device_get_ivars(dev);
2100 	struct muge_softc *sc = device_get_softc(dev);
2101 	struct usb_ether *ue = &sc->sc_ue;
2102 	uint8_t iface_index;
2103 	int err;
2104 
2105 	sc->sc_flags = USB_GET_DRIVER_INFO(uaa);
2106 
2107 	device_set_usb_desc(dev);
2108 
2109 	mtx_init(&sc->sc_mtx, device_get_nameunit(dev), NULL, MTX_DEF);
2110 
2111 	/* Setup the endpoints for the Microchip LAN78xx device. */
2112 	iface_index = MUGE_IFACE_IDX;
2113 	err = usbd_transfer_setup(uaa->device, &iface_index, sc->sc_xfer,
2114 	    muge_config, MUGE_N_TRANSFER, sc, &sc->sc_mtx);
2115 	if (err) {
2116 		device_printf(dev, "error: allocating USB transfers failed\n");
2117 		goto err;
2118 	}
2119 
2120 	ue->ue_sc = sc;
2121 	ue->ue_dev = dev;
2122 	ue->ue_udev = uaa->device;
2123 	ue->ue_mtx = &sc->sc_mtx;
2124 	ue->ue_methods = &muge_ue_methods;
2125 
2126 	err = uether_ifattach(ue);
2127 	if (err) {
2128 		device_printf(dev, "error: could not attach interface\n");
2129 		goto err_usbd;
2130 	}
2131 
2132 	/* Wait for lan78xx_chip_init from post-attach callback to complete. */
2133 	uether_ifattach_wait(ue);
2134 	if (!(sc->sc_flags & MUGE_FLAG_INIT_DONE))
2135 		goto err_attached;
2136 
2137 	return (0);
2138 
2139 err_attached:
2140 	uether_ifdetach(ue);
2141 err_usbd:
2142 	usbd_transfer_unsetup(sc->sc_xfer, MUGE_N_TRANSFER);
2143 err:
2144 	mtx_destroy(&sc->sc_mtx);
2145 	return (ENXIO);
2146 }
2147 
2148 /**
2149  *	muge_detach - Detach the interface.
2150  *	@dev: muge device handle
2151  *
2152  *	RETURNS:
2153  *	Returns 0.
2154  */
2155 static int
2156 muge_detach(device_t dev)
2157 {
2158 
2159 	struct muge_softc *sc = device_get_softc(dev);
2160 	struct usb_ether *ue = &sc->sc_ue;
2161 
2162 	usbd_transfer_unsetup(sc->sc_xfer, MUGE_N_TRANSFER);
2163 	uether_ifdetach(ue);
2164 	mtx_destroy(&sc->sc_mtx);
2165 
2166 	return (0);
2167 }
2168 
2169 static device_method_t muge_methods[] = {
2170 	/* Device interface */
2171 	DEVMETHOD(device_probe, muge_probe),
2172 	DEVMETHOD(device_attach, muge_attach),
2173 	DEVMETHOD(device_detach, muge_detach),
2174 
2175 	/* Bus interface */
2176 	DEVMETHOD(bus_print_child, bus_generic_print_child),
2177 	DEVMETHOD(bus_driver_added, bus_generic_driver_added),
2178 
2179 	/* MII interface */
2180 	DEVMETHOD(miibus_readreg, lan78xx_miibus_readreg),
2181 	DEVMETHOD(miibus_writereg, lan78xx_miibus_writereg),
2182 	DEVMETHOD(miibus_statchg, lan78xx_miibus_statchg),
2183 
2184 	DEVMETHOD_END
2185 };
2186 
2187 static driver_t muge_driver = {
2188 	.name = "muge",
2189 	.methods = muge_methods,
2190 	.size = sizeof(struct muge_softc),
2191 };
2192 
2193 static devclass_t muge_devclass;
2194 
2195 DRIVER_MODULE(muge, uhub, muge_driver, muge_devclass, NULL, 0);
2196 DRIVER_MODULE(miibus, muge, miibus_driver, miibus_devclass, 0, 0);
2197 MODULE_DEPEND(muge, uether, 1, 1, 1);
2198 MODULE_DEPEND(muge, usb, 1, 1, 1);
2199 MODULE_DEPEND(muge, ether, 1, 1, 1);
2200 MODULE_DEPEND(muge, miibus, 1, 1, 1);
2201 MODULE_VERSION(muge, 1);
2202 USB_PNP_HOST_INFO(lan78xx_devs);
2203