xref: /freebsd/sys/dev/usb/net/if_muge.c (revision 58a0f0d00c0cc4a90ce584a61470290751bfcac7)
1 /*-
2  * SPDX-License-Identifier: BSD-2-Clause-FreeBSD
3  *
4  * Copyright (C) 2012 Ben Gray <bgray@freebsd.org>.
5  * Copyright (C) 2018 The FreeBSD Foundation.
6  *
7  * This software was developed by Arshan Khanifar <arshankhanifar@gmail.com>
8  * under sponsorship from the FreeBSD Foundation.
9  *
10  * Redistribution and use in source and binary forms, with or without
11  * modification, are permitted provided that the following conditions
12  * are met:
13  * 1. Redistributions of source code must retain the above copyright
14  *    notice, this list of conditions and the following disclaimer.
15  * 2. Redistributions in binary form must reproduce the above copyright
16  *    notice, this list of conditions and the following disclaimer in the
17  *    documentation and/or other materials provided with the distribution.
18  *
19  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
20  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
21  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
22  * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
23  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
24  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
25  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
26  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
27  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
28  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
29  * SUCH DAMAGE.
30  *
31  * $FreeBSD$
32  */
33 
34 #include <sys/cdefs.h>
35 __FBSDID("$FreeBSD$");
36 
37 /*
38  * USB-To-Ethernet adapter driver for Microchip's LAN78XX and related families.
39  *
40  * USB 3.1 to 10/100/1000 Mbps Ethernet
41  * LAN7800 http://www.microchip.com/wwwproducts/en/LAN7800
42  *
43  * USB 2 to 10/100/1000 Mbps Ethernet with built-in USB hub
44  * LAN7515 (no datasheet available, but probes and functions as LAN7800)
45  *
46  * This driver is based on the if_smsc driver, with lan78xx-specific
47  * functionality modelled on Microchip's Linux lan78xx driver.
48  *
49  * UNIMPLEMENTED FEATURES
50  * ------------------
51  * A number of features supported by the lan78xx are not yet implemented in
52  * this driver:
53  *
54  * 1. RX/TX checksum offloading: Nothing has been implemented yet for
55  *    TX checksumming. RX checksumming works with ICMP messages, but is broken
56  *    for TCP/UDP packets.
57  * 2. Direct address translation filtering: Implemented but untested.
58  * 3. VLAN tag removal.
59  * 4. Reading MAC address from the device tree: Specific to the RPi 3B+.
60  *    Currently, the driver assigns a random MAC address itself.
61  * 5. Support for USB interrupt endpoints.
62  * 6. Latency Tolerance Messaging (LTM) support.
63  * 7. TCP LSO support.
64  *
65  */
66 
67 #include <sys/param.h>
68 #include <sys/bus.h>
69 #include <sys/callout.h>
70 #include <sys/condvar.h>
71 #include <sys/kernel.h>
72 #include <sys/lock.h>
73 #include <sys/malloc.h>
74 #include <sys/module.h>
75 #include <sys/mutex.h>
76 #include <sys/priv.h>
77 #include <sys/queue.h>
78 #include <sys/random.h>
79 #include <sys/socket.h>
80 #include <sys/stddef.h>
81 #include <sys/stdint.h>
82 #include <sys/sx.h>
83 #include <sys/sysctl.h>
84 #include <sys/systm.h>
85 #include <sys/unistd.h>
86 
87 #include <net/if.h>
88 #include <net/if_var.h>
89 
90 #include <netinet/in.h>
91 #include <netinet/ip.h>
92 
93 #include "opt_platform.h"
94 
95 #include <dev/usb/usb.h>
96 #include <dev/usb/usbdi.h>
97 #include <dev/usb/usbdi_util.h>
98 #include "usbdevs.h"
99 
100 #define USB_DEBUG_VAR lan78xx_debug
101 #include <dev/usb/usb_debug.h>
102 #include <dev/usb/usb_process.h>
103 
104 #include <dev/usb/net/usb_ethernet.h>
105 
106 #include <dev/usb/net/if_mugereg.h>
107 
108 #ifdef USB_DEBUG
109 static int muge_debug = 0;
110 
111 SYSCTL_NODE(_hw_usb, OID_AUTO, muge, CTLFLAG_RW, 0,
112     "Microchip LAN78xx USB-GigE");
113 SYSCTL_INT(_hw_usb_muge, OID_AUTO, debug, CTLFLAG_RWTUN, &muge_debug, 0,
114     "Debug level");
115 #endif
116 
117 #define MUGE_DEFAULT_RX_CSUM_ENABLE (false)
118 #define MUGE_DEFAULT_TX_CSUM_ENABLE (false)
119 #define MUGE_DEFAULT_TSO_CSUM_ENABLE (false)
120 
121 /* Supported Vendor and Product IDs. */
122 static const struct usb_device_id lan78xx_devs[] = {
123 #define MUGE_DEV(p,i) { USB_VPI(USB_VENDOR_SMC2, USB_PRODUCT_SMC2_##p, i) }
124 	MUGE_DEV(LAN7800_ETH, 0),
125 #undef MUGE_DEV
126 };
127 
128 #ifdef USB_DEBUG
129 #define muge_dbg_printf(sc, fmt, args...) \
130 do { \
131 	if (muge_debug > 0) \
132 		device_printf((sc)->sc_ue.ue_dev, "debug: " fmt, ##args); \
133 } while(0)
134 #else
135 #define muge_dbg_printf(sc, fmt, args...) do { } while (0)
136 #endif
137 
138 #define muge_warn_printf(sc, fmt, args...) \
139 	device_printf((sc)->sc_ue.ue_dev, "warning: " fmt, ##args)
140 
141 #define muge_err_printf(sc, fmt, args...) \
142 	device_printf((sc)->sc_ue.ue_dev, "error: " fmt, ##args)
143 
144 #define ETHER_IS_ZERO(addr) \
145 	(!(addr[0] | addr[1] | addr[2] | addr[3] | addr[4] | addr[5]))
146 
147 #define ETHER_IS_VALID(addr) \
148 	(!ETHER_IS_MULTICAST(addr) && !ETHER_IS_ZERO(addr))
149 
150 /* USB endpoints. */
151 
152 enum {
153 	MUGE_BULK_DT_RD,
154 	MUGE_BULK_DT_WR,
155 #if 0 /* Ignore interrupt endpoints for now as we poll on MII status. */
156 	MUGE_INTR_DT_WR,
157 	MUGE_INTR_DT_RD,
158 #endif
159 	MUGE_N_TRANSFER,
160 };
161 
162 struct muge_softc {
163 	struct usb_ether	sc_ue;
164 	struct mtx		sc_mtx;
165 	struct usb_xfer		*sc_xfer[MUGE_N_TRANSFER];
166 	int			sc_phyno;
167 
168 	/* Settings for the mac control (MAC_CSR) register. */
169 	uint32_t		sc_rfe_ctl;
170 	uint32_t		sc_mdix_ctl;
171 	uint32_t		sc_rev_id;
172 	uint32_t		sc_mchash_table[ETH_DP_SEL_VHF_HASH_LEN];
173 	uint32_t		sc_pfilter_table[MUGE_NUM_PFILTER_ADDRS_][2];
174 
175 	uint32_t		sc_flags;
176 #define MUGE_FLAG_LINK	0x0001
177 };
178 
179 #define MUGE_IFACE_IDX		0
180 
181 #define MUGE_LOCK(_sc)			mtx_lock(&(_sc)->sc_mtx)
182 #define MUGE_UNLOCK(_sc)		mtx_unlock(&(_sc)->sc_mtx)
183 #define MUGE_LOCK_ASSERT(_sc, t)	mtx_assert(&(_sc)->sc_mtx, t)
184 
185 static device_probe_t muge_probe;
186 static device_attach_t muge_attach;
187 static device_detach_t muge_detach;
188 
189 static usb_callback_t muge_bulk_read_callback;
190 static usb_callback_t muge_bulk_write_callback;
191 
192 static miibus_readreg_t lan78xx_miibus_readreg;
193 static miibus_writereg_t lan78xx_miibus_writereg;
194 static miibus_statchg_t lan78xx_miibus_statchg;
195 
196 static int muge_attach_post_sub(struct usb_ether *ue);
197 static uether_fn_t muge_attach_post;
198 static uether_fn_t muge_init;
199 static uether_fn_t muge_stop;
200 static uether_fn_t muge_start;
201 static uether_fn_t muge_tick;
202 static uether_fn_t muge_setmulti;
203 static uether_fn_t muge_setpromisc;
204 
205 static int muge_ifmedia_upd(struct ifnet *);
206 static void muge_ifmedia_sts(struct ifnet *, struct ifmediareq *);
207 
208 static int lan78xx_chip_init(struct muge_softc *sc);
209 static int muge_ioctl(struct ifnet *ifp, u_long cmd, caddr_t data);
210 
211 static const struct usb_config muge_config[MUGE_N_TRANSFER] = {
212 
213 	[MUGE_BULK_DT_WR] = {
214 		.type = UE_BULK,
215 		.endpoint = UE_ADDR_ANY,
216 		.direction = UE_DIR_OUT,
217 		.frames = 16,
218 		.bufsize = 16 * (MCLBYTES + 16),
219 		.flags = {.pipe_bof = 1,.force_short_xfer = 1,},
220 		.callback = muge_bulk_write_callback,
221 		.timeout = 10000,	/* 10 seconds */
222 	},
223 
224 	[MUGE_BULK_DT_RD] = {
225 		.type = UE_BULK,
226 		.endpoint = UE_ADDR_ANY,
227 		.direction = UE_DIR_IN,
228 		.bufsize = 20480,	/* bytes */
229 		.flags = {.pipe_bof = 1,.short_xfer_ok = 1,},
230 		.callback = muge_bulk_read_callback,
231 		.timeout = 0,	/* no timeout */
232 	},
233 	/*
234 	 * The chip supports interrupt endpoints, however they aren't
235 	 * needed as we poll on the MII status.
236 	 */
237 };
238 
239 static const struct usb_ether_methods muge_ue_methods = {
240 	.ue_attach_post = muge_attach_post,
241 	.ue_attach_post_sub = muge_attach_post_sub,
242 	.ue_start = muge_start,
243 	.ue_ioctl = muge_ioctl,
244 	.ue_init = muge_init,
245 	.ue_stop = muge_stop,
246 	.ue_tick = muge_tick,
247 	.ue_setmulti = muge_setmulti,
248 	.ue_setpromisc = muge_setpromisc,
249 	.ue_mii_upd = muge_ifmedia_upd,
250 	.ue_mii_sts = muge_ifmedia_sts,
251 };
252 
253 /**
254  *	lan78xx_read_reg - Read a 32-bit register on the device
255  *	@sc: driver soft context
256  *	@off: offset of the register
257  *	@data: pointer a value that will be populated with the register value
258  *
259  *	LOCKING:
260  *	The device lock must be held before calling this function.
261  *
262  *	RETURNS:
263  *	0 on success, a USB_ERR_?? error code on failure.
264  */
265 static int
266 lan78xx_read_reg(struct muge_softc *sc, uint32_t off, uint32_t *data)
267 {
268 	struct usb_device_request req;
269 	uint32_t buf;
270 	usb_error_t err;
271 
272 	MUGE_LOCK_ASSERT(sc, MA_OWNED);
273 
274 	req.bmRequestType = UT_READ_VENDOR_DEVICE;
275 	req.bRequest = UVR_READ_REG;
276 	USETW(req.wValue, 0);
277 	USETW(req.wIndex, off);
278 	USETW(req.wLength, 4);
279 
280 	err = uether_do_request(&sc->sc_ue, &req, &buf, 1000);
281 	if (err != 0)
282 		muge_warn_printf(sc, "Failed to read register 0x%0x\n", off);
283 	*data = le32toh(buf);
284 	return (err);
285 }
286 
287 /**
288  *	lan78xx_write_reg - Write a 32-bit register on the device
289  *	@sc: driver soft context
290  *	@off: offset of the register
291  *	@data: the 32-bit value to write into the register
292  *
293  *	LOCKING:
294  *	The device lock must be held before calling this function.
295  *
296  *	RETURNS:
297  *	0 on success, a USB_ERR_?? error code on failure.
298  */
299 static int
300 lan78xx_write_reg(struct muge_softc *sc, uint32_t off, uint32_t data)
301 {
302 	struct usb_device_request req;
303 	uint32_t buf;
304 	usb_error_t err;
305 
306 	MUGE_LOCK_ASSERT(sc, MA_OWNED);
307 
308 	buf = htole32(data);
309 
310 	req.bmRequestType = UT_WRITE_VENDOR_DEVICE;
311 	req.bRequest = UVR_WRITE_REG;
312 	USETW(req.wValue, 0);
313 	USETW(req.wIndex, off);
314 	USETW(req.wLength, 4);
315 
316 	err = uether_do_request(&sc->sc_ue, &req, &buf, 1000);
317 	if (err != 0)
318 		muge_warn_printf(sc, "Failed to write register 0x%0x\n", off);
319 	return (err);
320 }
321 
322 /**
323  *	lan78xx_wait_for_bits - Poll on a register value until bits are cleared
324  *	@sc: soft context
325  *	@reg: offset of the register
326  *	@bits: if the bits are clear the function returns
327  *
328  *	LOCKING:
329  *	The device lock must be held before calling this function.
330  *
331  *	RETURNS:
332  *	0 on success, or a USB_ERR_?? error code on failure.
333  */
334 static int
335 lan78xx_wait_for_bits(struct muge_softc *sc, uint32_t reg, uint32_t bits)
336 {
337 	usb_ticks_t start_ticks;
338 	const usb_ticks_t max_ticks = USB_MS_TO_TICKS(1000);
339 	uint32_t val;
340 	int err;
341 
342 	MUGE_LOCK_ASSERT(sc, MA_OWNED);
343 
344 	start_ticks = (usb_ticks_t)ticks;
345 	do {
346 		if ((err = lan78xx_read_reg(sc, reg, &val)) != 0)
347 			return (err);
348 		if (!(val & bits))
349 			return (0);
350 		uether_pause(&sc->sc_ue, hz / 100);
351 	} while (((usb_ticks_t)(ticks - start_ticks)) < max_ticks);
352 
353 	return (USB_ERR_TIMEOUT);
354 }
355 
356 /**
357  *	lan78xx_eeprom_read_raw - Read the attached EEPROM
358  *	@sc: soft context
359  *	@off: the eeprom address offset
360  *	@buf: stores the bytes
361  *	@buflen: the number of bytes to read
362  *
363  *	Simply reads bytes from an attached eeprom.
364  *
365  *	LOCKING:
366  *	The function takes and releases the device lock if not already held.
367  *
368  *	RETURNS:
369  *	0 on success, or a USB_ERR_?? error code on failure.
370  */
371 static int
372 lan78xx_eeprom_read_raw(struct muge_softc *sc, uint16_t off, uint8_t *buf,
373     uint16_t buflen)
374 {
375 	usb_ticks_t start_ticks;
376 	const usb_ticks_t max_ticks = USB_MS_TO_TICKS(1000);
377 	int err, locked;
378 	uint32_t val, saved;
379 	uint16_t i;
380 
381 	locked = mtx_owned(&sc->sc_mtx); /* XXX */
382 	if (!locked)
383 		MUGE_LOCK(sc);
384 
385 	err = lan78xx_read_reg(sc, ETH_HW_CFG, &val);
386 	saved = val;
387 
388 	val &= ~(ETH_HW_CFG_LEDO_EN_ | ETH_HW_CFG_LED1_EN_);
389 	err = lan78xx_write_reg(sc, ETH_HW_CFG, val);
390 
391 	err = lan78xx_wait_for_bits(sc, ETH_E2P_CMD, ETH_E2P_CMD_BUSY_);
392 	if (err != 0) {
393 		muge_warn_printf(sc, "eeprom busy, failed to read data\n");
394 		goto done;
395 	}
396 
397 	/* Start reading the bytes, one at a time. */
398 	for (i = 0; i < buflen; i++) {
399 		val = ETH_E2P_CMD_BUSY_ | ETH_E2P_CMD_READ_;
400 		val |= (ETH_E2P_CMD_ADDR_MASK_ & (off + i));
401 		if ((err = lan78xx_write_reg(sc, ETH_E2P_CMD, val)) != 0)
402 			goto done;
403 
404 		start_ticks = (usb_ticks_t)ticks;
405 		do {
406 			if ((err = lan78xx_read_reg(sc, ETH_E2P_CMD, &val)) !=
407 			    0)
408 				goto done;
409 			if (!(val & ETH_E2P_CMD_BUSY_) ||
410 			    (val & ETH_E2P_CMD_TIMEOUT_))
411 				break;
412 
413 			uether_pause(&sc->sc_ue, hz / 100);
414 		} while (((usb_ticks_t)(ticks - start_ticks)) < max_ticks);
415 
416 		if (val & (ETH_E2P_CMD_BUSY_ | ETH_E2P_CMD_TIMEOUT_)) {
417 			muge_warn_printf(sc, "eeprom command failed\n");
418 			err = USB_ERR_IOERROR;
419 			break;
420 		}
421 
422 		if ((err = lan78xx_read_reg(sc, ETH_E2P_DATA, &val)) != 0)
423 			goto done;
424 
425 		buf[i] = (val & 0xff);
426 	}
427 
428 done:
429 	if (!locked)
430 		MUGE_UNLOCK(sc);
431 	lan78xx_write_reg(sc, ETH_HW_CFG, saved);
432 	return (err);
433 }
434 
435 /**
436  *	lan78xx_eeprom_read - Read EEPROM and confirm it is programmed
437  *	@sc: soft context
438  *	@off: the eeprom address offset
439  *	@buf: stores the bytes
440  *	@buflen: the number of bytes to read
441  *
442  *	RETURNS:
443  *	0 on success, or a USB_ERR_?? error code on failure.
444  */
445 static int
446 lan78xx_eeprom_read(struct muge_softc *sc, uint16_t off, uint8_t *buf,
447     uint16_t buflen)
448 {
449 	uint8_t sig;
450 	int ret;
451 
452 	ret = lan78xx_eeprom_read_raw(sc, ETH_E2P_INDICATOR_OFFSET, &sig, 1);
453 	if ((ret == 0) && (sig == ETH_E2P_INDICATOR)) {
454 		ret = lan78xx_eeprom_read_raw(sc, off, buf, buflen);
455 		muge_dbg_printf(sc, "EEPROM present\n");
456 	} else {
457 		ret = -EINVAL;
458 		muge_dbg_printf(sc, "EEPROM not present\n");
459 	}
460 	return (ret);
461 }
462 
463 /**
464  *	lan78xx_otp_read_raw
465  *	@sc: soft context
466  *	@off: the otp address offset
467  *	@buf: stores the bytes
468  *	@buflen: the number of bytes to read
469  *
470  *	Simply reads bytes from the OTP.
471  *
472  *	LOCKING:
473  *	The function takes and releases the device lock if not already held.
474  *
475  *	RETURNS:
476  *	0 on success, or a USB_ERR_?? error code on failure.
477  *
478  */
479 static int
480 lan78xx_otp_read_raw(struct muge_softc *sc, uint16_t off, uint8_t *buf,
481     uint16_t buflen)
482 {
483 	int locked, err;
484 	uint32_t val;
485 	uint16_t i;
486 	locked = mtx_owned(&sc->sc_mtx);
487 	if (!locked)
488 		MUGE_LOCK(sc);
489 
490 	err = lan78xx_read_reg(sc, OTP_PWR_DN, &val);
491 
492 	/* Checking if bit is set. */
493 	if (val & OTP_PWR_DN_PWRDN_N) {
494 		/* Clear it, then wait for it to be cleared. */
495 		lan78xx_write_reg(sc, OTP_PWR_DN, 0);
496 		err = lan78xx_wait_for_bits(sc, OTP_PWR_DN, OTP_PWR_DN_PWRDN_N);
497 		if (err != 0) {
498 			muge_warn_printf(sc, "OTP off? failed to read data\n");
499 			goto done;
500 		}
501 	}
502 	/* Start reading the bytes, one at a time. */
503 	for (i = 0; i < buflen; i++) {
504 		err = lan78xx_write_reg(sc, OTP_ADDR1,
505 		    ((off + i) >> 8) & OTP_ADDR1_15_11);
506 		err = lan78xx_write_reg(sc, OTP_ADDR2,
507 		    ((off + i) & OTP_ADDR2_10_3));
508 		err = lan78xx_write_reg(sc, OTP_FUNC_CMD, OTP_FUNC_CMD_READ_);
509 		err = lan78xx_write_reg(sc, OTP_CMD_GO, OTP_CMD_GO_GO_);
510 
511 		err = lan78xx_wait_for_bits(sc, OTP_STATUS, OTP_STATUS_BUSY_);
512 		if (err != 0) {
513 			muge_warn_printf(sc, "OTP busy failed to read data\n");
514 			goto done;
515 		}
516 
517 		if ((err = lan78xx_read_reg(sc, OTP_RD_DATA, &val)) != 0)
518 			goto done;
519 
520 		buf[i] = (uint8_t)(val & 0xff);
521 	}
522 
523 done:
524 	if (!locked)
525 		MUGE_UNLOCK(sc);
526 	return (err);
527 }
528 
529 /**
530  *	lan78xx_otp_read
531  *	@sc: soft context
532  *	@off: the otp address offset
533  *	@buf: stores the bytes
534  *	@buflen: the number of bytes to read
535  *
536  *	Simply reads bytes from the otp.
537  *
538  *	LOCKING:
539  *	The function takes and releases device lock if it is not already held.
540  *
541  *	RETURNS:
542  *	0 on success, or a USB_ERR_?? error code on failure.
543  */
544 static int
545 lan78xx_otp_read(struct muge_softc *sc, uint16_t off, uint8_t *buf,
546     uint16_t buflen)
547 {
548 	uint8_t sig;
549 	int err;
550 
551 	err = lan78xx_otp_read_raw(sc, OTP_INDICATOR_OFFSET, &sig, 1);
552 	if (err == 0) {
553 		if (sig == OTP_INDICATOR_1) {
554 		} else if (sig == OTP_INDICATOR_2) {
555 			off += 0x100; /* XXX */
556 		} else {
557 			err = -EINVAL;
558 		}
559 		if (!err)
560 			err = lan78xx_otp_read_raw(sc, off, buf, buflen);
561 	}
562 	return (err);
563 }
564 
565 /**
566  *	lan78xx_setmacaddress - Set the mac address in the device
567  *	@sc: driver soft context
568  *	@addr: pointer to array contain at least 6 bytes of the mac
569  *
570  *	LOCKING:
571  *	Should be called with the MUGE lock held.
572  *
573  *	RETURNS:
574  *	Returns 0 on success or a negative error code.
575  */
576 static int
577 lan78xx_setmacaddress(struct muge_softc *sc, const uint8_t *addr)
578 {
579 	int err;
580 	uint32_t val;
581 
582 	muge_dbg_printf(sc,
583 	    "setting mac address to %02x:%02x:%02x:%02x:%02x:%02x\n",
584 	    addr[0], addr[1], addr[2], addr[3], addr[4], addr[5]);
585 
586 	MUGE_LOCK_ASSERT(sc, MA_OWNED);
587 
588 	val = (addr[3] << 24) | (addr[2] << 16) | (addr[1] << 8) | addr[0];
589 	if ((err = lan78xx_write_reg(sc, ETH_RX_ADDRL, val)) != 0)
590 		goto done;
591 
592 	val = (addr[5] << 8) | addr[4];
593 	err = lan78xx_write_reg(sc, ETH_RX_ADDRH, val);
594 
595 done:
596 	return (err);
597 }
598 
599 /**
600  *	lan78xx_set_rx_max_frame_length
601  *	@sc: driver soft context
602  *	@size: pointer to array contain at least 6 bytes of the mac
603  *
604  *	Sets the maximum frame length to be received. Frames bigger than
605  *	this size are aborted.
606  *
607  *	RETURNS:
608  *	Returns 0 on success or a negative error code.
609  */
610 static int
611 lan78xx_set_rx_max_frame_length(struct muge_softc *sc, int size)
612 {
613 	int err = 0;
614 	uint32_t buf;
615 	bool rxenabled;
616 
617 	/* First we have to disable rx before changing the length. */
618 	err = lan78xx_read_reg(sc, ETH_MAC_RX, &buf);
619 	rxenabled = ((buf & ETH_MAC_RX_EN_) != 0);
620 
621 	if (rxenabled) {
622 		buf &= ~ETH_MAC_RX_EN_;
623 		err = lan78xx_write_reg(sc, ETH_MAC_RX, buf);
624 	}
625 
626 	/* Setting max frame length. */
627 	buf &= ~ETH_MAC_RX_MAX_FR_SIZE_MASK_;
628 	buf |= (((size + 4) << ETH_MAC_RX_MAX_FR_SIZE_SHIFT_) &
629 	    ETH_MAC_RX_MAX_FR_SIZE_MASK_);
630 	err = lan78xx_write_reg(sc, ETH_MAC_RX, buf);
631 
632 	/* If it were enabled before, we enable it back. */
633 
634 	if (rxenabled) {
635 		buf |= ETH_MAC_RX_EN_;
636 		err = lan78xx_write_reg(sc, ETH_MAC_RX, buf);
637 	}
638 
639 	return (0);
640 }
641 
642 /**
643  *	lan78xx_miibus_readreg - Read a MII/MDIO register
644  *	@dev: usb ether device
645  *	@phy: the number of phy reading from
646  *	@reg: the register address
647  *
648  *	LOCKING:
649  *	Takes and releases the device mutex lock if not already held.
650  *
651  *	RETURNS:
652  *	Returns the 16-bits read from the MII register, if this function fails
653  *	0 is returned.
654  */
655 static int
656 lan78xx_miibus_readreg(device_t dev, int phy, int reg) {
657 
658 	struct muge_softc *sc = device_get_softc(dev);
659 	int locked;
660 	uint32_t addr, val;
661 
662 	val = 0;
663 	locked = mtx_owned(&sc->sc_mtx);
664 	if (!locked)
665 		MUGE_LOCK(sc);
666 
667 	if (lan78xx_wait_for_bits(sc, ETH_MII_ACC, ETH_MII_ACC_MII_BUSY_) !=
668 	    0) {
669 		muge_warn_printf(sc, "MII is busy\n");
670 		goto done;
671 	}
672 
673 	addr = (phy << 11) | (reg << 6) |
674 	    ETH_MII_ACC_MII_READ_ | ETH_MII_ACC_MII_BUSY_;
675 	lan78xx_write_reg(sc, ETH_MII_ACC, addr);
676 
677 	if (lan78xx_wait_for_bits(sc, ETH_MII_ACC, ETH_MII_ACC_MII_BUSY_) !=
678 	    0) {
679 		muge_warn_printf(sc, "MII read timeout\n");
680 		goto done;
681 	}
682 
683 	lan78xx_read_reg(sc, ETH_MII_DATA, &val);
684 	val = le32toh(val);
685 
686 done:
687 	if (!locked)
688 		MUGE_UNLOCK(sc);
689 
690 	return (val & 0xFFFF);
691 }
692 
693 /**
694  *	lan78xx_miibus_writereg - Writes a MII/MDIO register
695  *	@dev: usb ether device
696  *	@phy: the number of phy writing to
697  *	@reg: the register address
698  *	@val: the value to write
699  *
700  *	Attempts to write a PHY register through the usb controller registers.
701  *
702  *	LOCKING:
703  *	Takes and releases the device mutex lock if not already held.
704  *
705  *	RETURNS:
706  *	Always returns 0 regardless of success or failure.
707  */
708 static int
709 lan78xx_miibus_writereg(device_t dev, int phy, int reg, int val)
710 {
711 	struct muge_softc *sc = device_get_softc(dev);
712 	int locked;
713 	uint32_t addr;
714 
715 	if (sc->sc_phyno != phy)
716 		return (0);
717 
718 	locked = mtx_owned(&sc->sc_mtx);
719 	if (!locked)
720 		MUGE_LOCK(sc);
721 
722 	if (lan78xx_wait_for_bits(sc, ETH_MII_ACC, ETH_MII_ACC_MII_BUSY_) !=
723 	    0) {
724 		muge_warn_printf(sc, "MII is busy\n");
725 		goto done;
726 	}
727 
728 	val = htole32(val);
729 	lan78xx_write_reg(sc, ETH_MII_DATA, val);
730 
731 	addr = (phy << 11) | (reg << 6) |
732 	    ETH_MII_ACC_MII_WRITE_ | ETH_MII_ACC_MII_BUSY_;
733 	lan78xx_write_reg(sc, ETH_MII_ACC, addr);
734 
735 	if (lan78xx_wait_for_bits(sc, ETH_MII_ACC, ETH_MII_ACC_MII_BUSY_) != 0)
736 		muge_warn_printf(sc, "MII write timeout\n");
737 
738 done:
739 	if (!locked)
740 		MUGE_UNLOCK(sc);
741 	return (0);
742 }
743 
744 /*
745  *	lan78xx_miibus_statchg - Called to detect phy status change
746  *	@dev: usb ether device
747  *
748  *	This function is called periodically by the system to poll for status
749  *	changes of the link.
750  *
751  *	LOCKING:
752  *	Takes and releases the device mutex lock if not already held.
753  */
754 static void
755 lan78xx_miibus_statchg(device_t dev)
756 {
757 	struct muge_softc *sc = device_get_softc(dev);
758 	struct mii_data *mii = uether_getmii(&sc->sc_ue);
759 	struct ifnet *ifp;
760 	int locked;
761 	int err;
762 	uint32_t flow = 0;
763 	uint32_t fct_flow = 0;
764 
765 	locked = mtx_owned(&sc->sc_mtx);
766 	if (!locked)
767 		MUGE_LOCK(sc);
768 
769 	ifp = uether_getifp(&sc->sc_ue);
770 	if (mii == NULL || ifp == NULL ||
771 	    (ifp->if_drv_flags & IFF_DRV_RUNNING) == 0)
772 		goto done;
773 
774 	/* Use the MII status to determine link status */
775 	sc->sc_flags &= ~MUGE_FLAG_LINK;
776 	if ((mii->mii_media_status & (IFM_ACTIVE | IFM_AVALID)) ==
777 	    (IFM_ACTIVE | IFM_AVALID)) {
778 		muge_dbg_printf(sc, "media is active\n");
779 		switch (IFM_SUBTYPE(mii->mii_media_active)) {
780 		case IFM_10_T:
781 		case IFM_100_TX:
782 			sc->sc_flags |= MUGE_FLAG_LINK;
783 			muge_dbg_printf(sc, "10/100 ethernet\n");
784 			break;
785 		case IFM_1000_T:
786 			sc->sc_flags |= MUGE_FLAG_LINK;
787 			muge_dbg_printf(sc, "Gigabit ethernet\n");
788 			break;
789 		default:
790 			break;
791 		}
792 	}
793 	/* Lost link, do nothing. */
794 	if ((sc->sc_flags & MUGE_FLAG_LINK) == 0) {
795 		muge_dbg_printf(sc, "link flag not set\n");
796 		goto done;
797 	}
798 
799 	err = lan78xx_read_reg(sc, ETH_FCT_FLOW, &fct_flow);
800 	if (err) {
801 		muge_warn_printf(sc,
802 		   "failed to read initial flow control thresholds, error %d\n",
803 		    err);
804 		goto done;
805 	}
806 
807 	/* Enable/disable full duplex operation and TX/RX pause. */
808 	if ((IFM_OPTIONS(mii->mii_media_active) & IFM_FDX) != 0) {
809 		muge_dbg_printf(sc, "full duplex operation\n");
810 
811 		/* Enable transmit MAC flow control function. */
812 		if ((IFM_OPTIONS(mii->mii_media_active) & IFM_ETH_TXPAUSE) != 0)
813 			flow |= ETH_FLOW_CR_TX_FCEN_ | 0xFFFF;
814 
815 		if ((IFM_OPTIONS(mii->mii_media_active) & IFM_ETH_RXPAUSE) != 0)
816 			flow |= ETH_FLOW_CR_RX_FCEN_;
817 	}
818 
819 	/* XXX Flow control settings obtained from Microchip's driver. */
820 	switch(usbd_get_speed(sc->sc_ue.ue_udev)) {
821 	case USB_SPEED_SUPER:
822 		fct_flow = 0x817;
823 		break;
824 	case USB_SPEED_HIGH:
825 		fct_flow = 0x211;
826 		break;
827 	default:
828 		break;
829 	}
830 
831 	err += lan78xx_write_reg(sc, ETH_FLOW, flow);
832 	err += lan78xx_write_reg(sc, ETH_FCT_FLOW, fct_flow);
833 	if (err)
834 		muge_warn_printf(sc, "media change failed, error %d\n", err);
835 
836 done:
837 	if (!locked)
838 		MUGE_UNLOCK(sc);
839 }
840 
841 /*
842  *	lan78xx_set_mdix_auto - Configure the device to enable automatic
843  *	crossover and polarity detection.  LAN7800 provides HP Auto-MDIX
844  *	functionality for seamless crossover and polarity detection.
845  *
846  *	@sc: driver soft context
847  *
848  *	LOCKING:
849  *	Takes and releases the device mutex lock if not already held.
850  */
851 static void
852 lan78xx_set_mdix_auto(struct muge_softc *sc)
853 {
854 	uint32_t buf, err;
855 
856 	err = lan78xx_miibus_writereg(sc->sc_ue.ue_dev, sc->sc_phyno,
857 	    MUGE_EXT_PAGE_ACCESS, MUGE_EXT_PAGE_SPACE_1);
858 
859 	buf = lan78xx_miibus_readreg(sc->sc_ue.ue_dev, sc->sc_phyno,
860 	    MUGE_EXT_MODE_CTRL);
861 	buf &= ~MUGE_EXT_MODE_CTRL_MDIX_MASK_;
862 	buf |= MUGE_EXT_MODE_CTRL_AUTO_MDIX_;
863 
864 	lan78xx_miibus_readreg(sc->sc_ue.ue_dev, sc->sc_phyno, MII_BMCR);
865 	err += lan78xx_miibus_writereg(sc->sc_ue.ue_dev, sc->sc_phyno,
866 	    MUGE_EXT_MODE_CTRL, buf);
867 
868 	err += lan78xx_miibus_writereg(sc->sc_ue.ue_dev, sc->sc_phyno,
869 	    MUGE_EXT_PAGE_ACCESS, MUGE_EXT_PAGE_SPACE_0);
870 
871 	if (err != 0)
872 		muge_warn_printf(sc, "error setting PHY's MDIX status\n");
873 
874 	sc->sc_mdix_ctl = buf;
875 }
876 
877 /**
878  *	lan78xx_phy_init - Initialises the in-built MUGE phy
879  *	@sc: driver soft context
880  *
881  *	Resets the PHY part of the chip and then initialises it to default
882  *	values.  The 'link down' and 'auto-negotiation complete' interrupts
883  *	from the PHY are also enabled, however we don't monitor the interrupt
884  *	endpoints for the moment.
885  *
886  *	RETURNS:
887  *	Returns 0 on success or EIO if failed to reset the PHY.
888  */
889 static int
890 lan78xx_phy_init(struct muge_softc *sc)
891 {
892 	muge_dbg_printf(sc, "Initializing PHY.\n");
893 	uint16_t bmcr;
894 	usb_ticks_t start_ticks;
895 	const usb_ticks_t max_ticks = USB_MS_TO_TICKS(1000);
896 
897 	MUGE_LOCK_ASSERT(sc, MA_OWNED);
898 
899 	/* Reset phy and wait for reset to complete. */
900 	lan78xx_miibus_writereg(sc->sc_ue.ue_dev, sc->sc_phyno, MII_BMCR,
901 	    BMCR_RESET);
902 
903 	start_ticks = ticks;
904 	do {
905 		uether_pause(&sc->sc_ue, hz / 100);
906 		bmcr = lan78xx_miibus_readreg(sc->sc_ue.ue_dev, sc->sc_phyno,
907 		    MII_BMCR);
908 	} while ((bmcr & BMCR_RESET) && ((ticks - start_ticks) < max_ticks));
909 
910 	if (((usb_ticks_t)(ticks - start_ticks)) >= max_ticks) {
911 		muge_err_printf(sc, "PHY reset timed-out\n");
912 		return (EIO);
913 	}
914 
915 	/* Setup phy to interrupt upon link down or autoneg completion. */
916 	lan78xx_miibus_readreg(sc->sc_ue.ue_dev, sc->sc_phyno,
917 	    MUGE_PHY_INTR_STAT);
918 	lan78xx_miibus_writereg(sc->sc_ue.ue_dev, sc->sc_phyno,
919 	    MUGE_PHY_INTR_MASK,
920 	    (MUGE_PHY_INTR_ANEG_COMP | MUGE_PHY_INTR_LINK_CHANGE));
921 
922 	/* Enable Auto-MDIX for crossover and polarity detection. */
923 	lan78xx_set_mdix_auto(sc);
924 
925 	/* Enable all modes. */
926 	lan78xx_miibus_writereg(sc->sc_ue.ue_dev, sc->sc_phyno, MII_ANAR,
927 	    ANAR_10 | ANAR_10_FD | ANAR_TX | ANAR_TX_FD |
928 	    ANAR_CSMA | ANAR_FC | ANAR_PAUSE_ASYM);
929 
930 	/* Restart auto-negotation. */
931 	bmcr |= BMCR_STARTNEG;
932 	bmcr |= BMCR_AUTOEN;
933 	lan78xx_miibus_writereg(sc->sc_ue.ue_dev, sc->sc_phyno, MII_BMCR, bmcr);
934 	bmcr = lan78xx_miibus_readreg(sc->sc_ue.ue_dev, sc->sc_phyno, MII_BMCR);
935 	return (0);
936 }
937 
938 /**
939  *	lan78xx_chip_init - Initialises the chip after power on
940  *	@sc: driver soft context
941  *
942  *	This initialisation sequence is modelled on the procedure in the Linux
943  *	driver.
944  *
945  *	RETURNS:
946  *	Returns 0 on success or an error code on failure.
947  */
948 static int
949 lan78xx_chip_init(struct muge_softc *sc)
950 {
951 	int err;
952 	int locked;
953 	uint32_t buf;
954 	uint32_t burst_cap;
955 
956 	locked = mtx_owned(&sc->sc_mtx);
957 	if (!locked)
958 		MUGE_LOCK(sc);
959 
960 	/* Enter H/W config mode. */
961 	lan78xx_write_reg(sc, ETH_HW_CFG, ETH_HW_CFG_LRST_);
962 
963 	if ((err = lan78xx_wait_for_bits(sc, ETH_HW_CFG, ETH_HW_CFG_LRST_)) !=
964 	    0) {
965 		muge_warn_printf(sc,
966 		    "timed-out waiting for lite reset to complete\n");
967 		goto init_failed;
968 	}
969 
970 	/* Set the mac address. */
971 	if ((err = lan78xx_setmacaddress(sc, sc->sc_ue.ue_eaddr)) != 0) {
972 		muge_warn_printf(sc, "failed to set the MAC address\n");
973 		goto init_failed;
974 	}
975 
976 	/* Read and display the revision register. */
977 	if ((err = lan78xx_read_reg(sc, ETH_ID_REV, &sc->sc_rev_id)) < 0) {
978 		muge_warn_printf(sc, "failed to read ETH_ID_REV (err = %d)\n",
979 		    err);
980 		goto init_failed;
981 	}
982 
983 	device_printf(sc->sc_ue.ue_dev, "chip 0x%04lx, rev. %04lx\n",
984 		(sc->sc_rev_id & ETH_ID_REV_CHIP_ID_MASK_) >> 16,
985 		(sc->sc_rev_id & ETH_ID_REV_CHIP_REV_MASK_));
986 
987 	/* Respond to BULK-IN tokens with a NAK when RX FIFO is empty. */
988 	if ((err = lan78xx_read_reg(sc, ETH_USB_CFG0, &buf)) != 0) {
989 		muge_warn_printf(sc, "failed to read ETH_USB_CFG0 (err=%d)\n", err);
990 		goto init_failed;
991 	}
992 	buf |= ETH_USB_CFG_BIR_;
993 	lan78xx_write_reg(sc, ETH_USB_CFG0, buf);
994 
995 	/*
996 	 * XXX LTM support will go here.
997 	 */
998 
999 	/* Configuring the burst cap. */
1000 	switch (usbd_get_speed(sc->sc_ue.ue_udev)) {
1001 	case USB_SPEED_SUPER:
1002 		burst_cap = MUGE_DEFAULT_BURST_CAP_SIZE/MUGE_SS_USB_PKT_SIZE;
1003 		break;
1004 	case USB_SPEED_HIGH:
1005 		burst_cap = MUGE_DEFAULT_BURST_CAP_SIZE/MUGE_HS_USB_PKT_SIZE;
1006 		break;
1007 	default:
1008 		burst_cap = MUGE_DEFAULT_BURST_CAP_SIZE/MUGE_FS_USB_PKT_SIZE;
1009 	}
1010 
1011 	lan78xx_write_reg(sc, ETH_BURST_CAP, burst_cap);
1012 
1013 	/* Set the default bulk in delay (same value from Linux driver). */
1014 	lan78xx_write_reg(sc, ETH_BULK_IN_DLY, MUGE_DEFAULT_BULK_IN_DELAY);
1015 
1016 	/* Multiple ethernet frames per USB packets. */
1017 	err = lan78xx_read_reg(sc, ETH_HW_CFG, &buf);
1018 	buf |= ETH_HW_CFG_MEF_;
1019 	err = lan78xx_write_reg(sc, ETH_HW_CFG, buf);
1020 
1021 	/* Enable burst cap. */
1022 	if ((err = lan78xx_read_reg(sc, ETH_USB_CFG0, &buf)) < 0) {
1023 		muge_warn_printf(sc, "failed to read ETH_USB_CFG0 (err=%d)\n",
1024 		    err);
1025 		goto init_failed;
1026 	}
1027 	buf |= ETH_USB_CFG_BCE_;
1028 	err = lan78xx_write_reg(sc, ETH_USB_CFG0, buf);
1029 
1030 	/*
1031 	 * Set FCL's RX and TX FIFO sizes: according to data sheet this is
1032 	 * already the default value. But we initialize it to the same value
1033 	 * anyways, as that's what the Linux driver does.
1034 	 *
1035 	 */
1036 	buf = (MUGE_MAX_RX_FIFO_SIZE - 512) / 512;
1037 	err = lan78xx_write_reg(sc, ETH_FCT_RX_FIFO_END, buf);
1038 
1039 	buf = (MUGE_MAX_TX_FIFO_SIZE - 512) / 512;
1040 	err = lan78xx_write_reg(sc, ETH_FCT_TX_FIFO_END, buf);
1041 
1042 	/* Enabling interrupts. (Not using them for now) */
1043 	err = lan78xx_write_reg(sc, ETH_INT_STS, ETH_INT_STS_CLEAR_ALL_);
1044 
1045 	/*
1046 	 * Initializing flow control registers to 0.  These registers are
1047 	 * properly set is handled in link-reset function in the Linux driver.
1048 	 */
1049 	err = lan78xx_write_reg(sc, ETH_FLOW, 0);
1050 	err = lan78xx_write_reg(sc, ETH_FCT_FLOW, 0);
1051 
1052 	/*
1053 	 * Settings for the RFE, we enable broadcast and destination address
1054 	 * perfect filtering.
1055 	 */
1056 	err = lan78xx_read_reg(sc, ETH_RFE_CTL, &buf);
1057 	buf |= ETH_RFE_CTL_BCAST_EN_ | ETH_RFE_CTL_DA_PERFECT_;
1058 	err = lan78xx_write_reg(sc, ETH_RFE_CTL, buf);
1059 
1060 	/*
1061 	 * At this point the Linux driver writes multicast tables, and enables
1062 	 * checksum engines. But in FreeBSD that gets done in muge_init,
1063 	 * which gets called when the interface is brought up.
1064 	 */
1065 
1066 	/* Reset the PHY. */
1067 	lan78xx_write_reg(sc, ETH_PMT_CTL, ETH_PMT_CTL_PHY_RST_);
1068 	if ((err = lan78xx_wait_for_bits(sc, ETH_PMT_CTL,
1069 	    ETH_PMT_CTL_PHY_RST_)) != 0) {
1070 		muge_warn_printf(sc,
1071 		    "timed-out waiting for phy reset to complete\n");
1072 		goto init_failed;
1073 	}
1074 
1075 	/* Enable automatic duplex detection and automatic speed detection. */
1076 	err = lan78xx_read_reg(sc, ETH_MAC_CR, &buf);
1077 	buf |= ETH_MAC_CR_AUTO_DUPLEX_ | ETH_MAC_CR_AUTO_SPEED_;
1078 	err = lan78xx_write_reg(sc, ETH_MAC_CR, buf);
1079 
1080 	/*
1081 	 * Enable PHY interrupts (Not really getting used for now)
1082 	 * ETH_INT_EP_CTL: interrupt endpoint control register
1083 	 * phy events cause interrupts to be issued
1084 	 */
1085 	err = lan78xx_read_reg(sc, ETH_INT_EP_CTL, &buf);
1086 	buf |= ETH_INT_ENP_PHY_INT;
1087 	err = lan78xx_write_reg(sc, ETH_INT_EP_CTL, buf);
1088 
1089 	/*
1090 	 * Enables mac's transmitter.  It will transmit frames from the buffer
1091 	 * onto the cable.
1092 	 */
1093 	err = lan78xx_read_reg(sc, ETH_MAC_TX, &buf);
1094 	buf |= ETH_MAC_TX_TXEN_;
1095 	err = lan78xx_write_reg(sc, ETH_MAC_TX, buf);
1096 
1097 	/* FIFO is capable of transmitting frames to MAC. */
1098 	err = lan78xx_read_reg(sc, ETH_FCT_TX_CTL, &buf);
1099 	buf |= ETH_FCT_TX_CTL_EN_;
1100 	err = lan78xx_write_reg(sc, ETH_FCT_TX_CTL, buf);
1101 
1102 	/*
1103 	 * Set max frame length.  In linux this is dev->mtu (which by default
1104 	 * is 1500) + VLAN_ETH_HLEN = 1518.
1105 	 */
1106 	err = lan78xx_set_rx_max_frame_length(sc, ETHER_MAX_LEN);
1107 
1108 	/* Initialise the PHY. */
1109 	if ((err = lan78xx_phy_init(sc)) != 0)
1110 		goto init_failed;
1111 
1112 	/* Enable MAC RX. */
1113 	err = lan78xx_read_reg(sc, ETH_MAC_RX, &buf);
1114 	buf |= ETH_MAC_RX_EN_;
1115 	err = lan78xx_write_reg(sc, ETH_MAC_RX, buf);
1116 
1117 	/* Enable FIFO controller RX. */
1118 	err = lan78xx_read_reg(sc, ETH_FCT_RX_CTL, &buf);
1119 	buf |= ETH_FCT_TX_CTL_EN_;
1120 	err = lan78xx_write_reg(sc, ETH_FCT_RX_CTL, buf);
1121 
1122 	return (0);
1123 
1124 init_failed:
1125 	if (!locked)
1126 		MUGE_UNLOCK(sc);
1127 
1128 	muge_err_printf(sc, "lan78xx_chip_init failed (err=%d)\n", err);
1129 	return (err);
1130 }
1131 
1132 static void
1133 muge_bulk_read_callback(struct usb_xfer *xfer, usb_error_t error)
1134 {
1135 	struct muge_softc *sc = usbd_xfer_softc(xfer);
1136 	struct usb_ether *ue = &sc->sc_ue;
1137 	struct ifnet *ifp = uether_getifp(ue);
1138 	struct mbuf *m;
1139 	struct usb_page_cache *pc;
1140 	uint16_t pktlen;
1141 	uint32_t rx_cmd_a, rx_cmd_b;
1142 	uint16_t rx_cmd_c;
1143 	int off;
1144 	int actlen;
1145 
1146 	usbd_xfer_status(xfer, &actlen, NULL, NULL, NULL);
1147 	muge_dbg_printf(sc, "rx : actlen %d\n", actlen);
1148 
1149 	switch (USB_GET_STATE(xfer)) {
1150 	case USB_ST_TRANSFERRED:
1151 
1152 		/*
1153 		 * There is always a zero length frame after bringing the
1154 		 * interface up.
1155 		 */
1156 		if (actlen < (sizeof(rx_cmd_a) + ETHER_CRC_LEN))
1157 			goto tr_setup;
1158 
1159 		/*
1160 		 * There may be multiple packets in the USB frame.  Each will
1161 		 * have a header and each needs to have its own mbuf allocated
1162 		 * and populated for it.
1163 		 */
1164 		pc = usbd_xfer_get_frame(xfer, 0);
1165 		off = 0;
1166 
1167 		while (off < actlen) {
1168 
1169 			/* The frame header is aligned on a 4 byte boundary. */
1170 			off = ((off + 0x3) & ~0x3);
1171 
1172 			/* Extract RX CMD A. */
1173 			if (off + sizeof(rx_cmd_a) > actlen)
1174 				goto tr_setup;
1175 			usbd_copy_out(pc, off, &rx_cmd_a, sizeof(rx_cmd_a));
1176 			off += (sizeof(rx_cmd_a));
1177 			rx_cmd_a = le32toh(rx_cmd_a);
1178 
1179 
1180 			/* Extract RX CMD B. */
1181 			if (off + sizeof(rx_cmd_b) > actlen)
1182 				goto tr_setup;
1183 			usbd_copy_out(pc, off, &rx_cmd_b, sizeof(rx_cmd_b));
1184 			off += (sizeof(rx_cmd_b));
1185 			rx_cmd_b = le32toh(rx_cmd_b);
1186 
1187 
1188 			/* Extract RX CMD C. */
1189 			if (off + sizeof(rx_cmd_c) > actlen)
1190 				goto tr_setup;
1191 			usbd_copy_out(pc, off, &rx_cmd_c, sizeof(rx_cmd_c));
1192 			off += (sizeof(rx_cmd_c));
1193 			rx_cmd_c = le32toh(rx_cmd_c);
1194 
1195 			if (off > actlen)
1196 				goto tr_setup;
1197 
1198 			pktlen = (rx_cmd_a & RX_CMD_A_LEN_MASK_);
1199 
1200 			muge_dbg_printf(sc,
1201 			    "rx_cmd_a 0x%08x rx_cmd_b 0x%08x rx_cmd_c 0x%04x "
1202 			    " pktlen %d actlen %d off %d\n",
1203 			    rx_cmd_a, rx_cmd_b, rx_cmd_c, pktlen, actlen, off);
1204 
1205 			if (rx_cmd_a & RX_CMD_A_RED_) {
1206 				muge_dbg_printf(sc,
1207 				     "rx error (hdr 0x%08x)\n", rx_cmd_a);
1208 				if_inc_counter(ifp, IFCOUNTER_IERRORS, 1);
1209 			} else {
1210 				/* Ethernet frame too big or too small? */
1211 				if ((pktlen < ETHER_HDR_LEN) ||
1212 				    (pktlen > (actlen - off)))
1213 					goto tr_setup;
1214 
1215 				/* Create a new mbuf to store the packet. */
1216 				m = uether_newbuf();
1217 				if (m == NULL) {
1218 					muge_warn_printf(sc,
1219 					    "failed to create new mbuf\n");
1220 					if_inc_counter(ifp, IFCOUNTER_IQDROPS,
1221 					    1);
1222 					goto tr_setup;
1223 				}
1224 
1225 				usbd_copy_out(pc, off, mtod(m, uint8_t *),
1226 				    pktlen);
1227 
1228 				/*
1229 				 * Check if RX checksums are computed, and
1230 				 * offload them
1231 				 */
1232 				if ((ifp->if_capabilities & IFCAP_RXCSUM) &&
1233 				    !(rx_cmd_a & RX_CMD_A_ICSM_)) {
1234 					struct ether_header *eh;
1235 					eh = mtod(m, struct ether_header *);
1236 					/*
1237 					 * Remove the extra 2 bytes of the csum
1238 					 *
1239 					 * The checksum appears to be
1240 					 * simplistically calculated over the
1241 					 * protocol headers up to the end of the
1242 					 * eth frame.  Which means if the eth
1243 					 * frame is padded the csum calculation
1244 					 * is incorrectly performed over the
1245 					 * padding bytes as well.  Therefore to
1246 					 * be safe we ignore the H/W csum on
1247 					 * frames less than or equal to
1248 					 * 64 bytes.
1249 					 *
1250 					 * Protocols checksummed:
1251 					 * TCP, UDP, ICMP, IGMP, IP
1252 					 */
1253 					if (pktlen > ETHER_MIN_LEN) {
1254 						m->m_pkthdr.csum_flags |=
1255 						    CSUM_DATA_VALID;
1256 
1257 						/*
1258 						 * Copy the checksum from the
1259 						 * last 2 bytes of the transfer
1260 						 * and put in the csum_data
1261 						 * field.
1262 						 */
1263 						usbd_copy_out(pc,
1264 						    (off + pktlen),
1265 						    &m->m_pkthdr.csum_data, 2);
1266 
1267 						/*
1268 						 * The data is copied in network
1269 						 * order, but the csum algorithm
1270 						 * in the kernel expects it to
1271 						 * be in host network order.
1272 						 */
1273 						m->m_pkthdr.csum_data =
1274 						   ntohs(m->m_pkthdr.csum_data);
1275 
1276 						muge_dbg_printf(sc,
1277 						    "RX checksum offloaded (0x%04x)\n",
1278 						    m->m_pkthdr.csum_data);
1279 					}
1280 				}
1281 
1282 				/* Enqueue the mbuf on the receive queue. */
1283 				if (pktlen < (4 + ETHER_HDR_LEN)) {
1284 					m_freem(m);
1285 					goto tr_setup;
1286 				}
1287 				/* Remove 4 trailing bytes */
1288 				uether_rxmbuf(ue, m, pktlen - 4);
1289 			}
1290 
1291 			/*
1292 			 * Update the offset to move to the next potential
1293 			 * packet.
1294 			 */
1295 			off += pktlen;
1296 		}
1297 
1298 		/* FALLTHROUGH */
1299 	case USB_ST_SETUP:
1300 tr_setup:
1301 		usbd_xfer_set_frame_len(xfer, 0, usbd_xfer_max_len(xfer));
1302 		usbd_transfer_submit(xfer);
1303 		uether_rxflush(ue);
1304 		return;
1305 
1306 	default:
1307 		if (error != USB_ERR_CANCELLED) {
1308 			muge_warn_printf(sc, "bulk read error, %s\n",
1309 			    usbd_errstr(error));
1310 			usbd_xfer_set_stall(xfer);
1311 			goto tr_setup;
1312 		}
1313 		return;
1314 	}
1315 }
1316 
1317 /**
1318  *	muge_bulk_write_callback - Write callback used to send ethernet frame(s)
1319  *	@xfer: the USB transfer
1320  *	@error: error code if the transfers is in an errored state
1321  *
1322  *	The main write function that pulls ethernet frames off the queue and
1323  *	sends them out.
1324  *
1325  */
1326 static void
1327 muge_bulk_write_callback(struct usb_xfer *xfer, usb_error_t error)
1328 {
1329 	struct muge_softc *sc = usbd_xfer_softc(xfer);
1330 	struct ifnet *ifp = uether_getifp(&sc->sc_ue);
1331 	struct usb_page_cache *pc;
1332 	struct mbuf *m;
1333 	int nframes;
1334 	uint32_t frm_len = 0, tx_cmd_a = 0, tx_cmd_b = 0;
1335 
1336 	switch (USB_GET_STATE(xfer)) {
1337 	case USB_ST_TRANSFERRED:
1338 		muge_dbg_printf(sc,
1339 		    "USB TRANSFER status: USB_ST_TRANSFERRED\n");
1340 		ifp->if_drv_flags &= ~IFF_DRV_OACTIVE;
1341 		/* FALLTHROUGH */
1342 	case USB_ST_SETUP:
1343 		muge_dbg_printf(sc, "USB TRANSFER status: USB_ST_SETUP\n");
1344 tr_setup:
1345 		if ((sc->sc_flags & MUGE_FLAG_LINK) == 0 ||
1346 			(ifp->if_drv_flags & IFF_DRV_OACTIVE) != 0) {
1347 			muge_dbg_printf(sc,
1348 			    "sc->sc_flags & MUGE_FLAG_LINK: %d\n",
1349 			    (sc->sc_flags & MUGE_FLAG_LINK));
1350 			muge_dbg_printf(sc,
1351 			    "ifp->if_drv_flags & IFF_DRV_OACTIVE: %d\n",
1352 			    (ifp->if_drv_flags & IFF_DRV_OACTIVE));
1353 			muge_dbg_printf(sc,
1354 			    "USB TRANSFER not sending: no link or controller is busy \n");
1355 			/*
1356 			 * Don't send anything if there is no link or
1357 			 * controller is busy.
1358 			 */
1359 			return;
1360 		}
1361 		for (nframes = 0; nframes < 16 &&
1362 		    !IFQ_DRV_IS_EMPTY(&ifp->if_snd); nframes++) {
1363 			IFQ_DRV_DEQUEUE(&ifp->if_snd, m);
1364 			if (m == NULL)
1365 				break;
1366 			usbd_xfer_set_frame_offset(xfer, nframes * MCLBYTES,
1367 				nframes);
1368 			frm_len = 0;
1369 			pc = usbd_xfer_get_frame(xfer, nframes);
1370 
1371 			/*
1372 			 * Each frame is prefixed with two 32-bit values
1373 			 * describing the length of the packet and buffer.
1374 			 */
1375 			tx_cmd_a = (m->m_pkthdr.len & TX_CMD_A_LEN_MASK_) |
1376 			     TX_CMD_A_FCS_;
1377 			tx_cmd_a = htole32(tx_cmd_a);
1378 			usbd_copy_in(pc, 0, &tx_cmd_a, sizeof(tx_cmd_a));
1379 
1380 			tx_cmd_b = 0;
1381 
1382 			/* TCP LSO Support will probably be implemented here. */
1383 			tx_cmd_b = htole32(tx_cmd_b);
1384 			usbd_copy_in(pc, 4, &tx_cmd_b, sizeof(tx_cmd_b));
1385 
1386 			frm_len += 8;
1387 
1388 			/* Next copy in the actual packet */
1389 			usbd_m_copy_in(pc, frm_len, m, 0, m->m_pkthdr.len);
1390 			frm_len += m->m_pkthdr.len;
1391 
1392 			if_inc_counter(ifp, IFCOUNTER_OPACKETS, 1);
1393 
1394 			/*
1395 			 * If there's a BPF listener, bounce a copy of this
1396 			 * frame to it.
1397 			 */
1398 			BPF_MTAP(ifp, m);
1399 			m_freem(m);
1400 
1401 			/* Set frame length. */
1402 			usbd_xfer_set_frame_len(xfer, nframes, frm_len);
1403 		}
1404 
1405 		muge_dbg_printf(sc, "USB TRANSFER nframes: %d\n", nframes);
1406 		if (nframes != 0) {
1407 			muge_dbg_printf(sc, "USB TRANSFER submit attempt\n");
1408 			usbd_xfer_set_frames(xfer, nframes);
1409 			usbd_transfer_submit(xfer);
1410 			ifp->if_drv_flags |= IFF_DRV_OACTIVE;
1411 		}
1412 		return;
1413 
1414 	default:
1415 		if_inc_counter(ifp, IFCOUNTER_OERRORS, 1);
1416 		ifp->if_drv_flags &= ~IFF_DRV_OACTIVE;
1417 
1418 		if (error != USB_ERR_CANCELLED) {
1419 			muge_err_printf(sc,
1420 			    "usb error on tx: %s\n", usbd_errstr(error));
1421 			usbd_xfer_set_stall(xfer);
1422 			goto tr_setup;
1423 		}
1424 		return;
1425 	}
1426 }
1427 
1428 /**
1429  *	muge_attach_post - Called after the driver attached to the USB interface
1430  *	@ue: the USB ethernet device
1431  *
1432  *	This is where the chip is intialised for the first time.  This is
1433  *	different from the muge_init() function in that that one is designed to
1434  *	setup the H/W to match the UE settings and can be called after a reset.
1435  *
1436  */
1437 static void
1438 muge_attach_post(struct usb_ether *ue)
1439 {
1440 	struct muge_softc *sc = uether_getsc(ue);
1441 	uint32_t mac_h, mac_l;
1442 	muge_dbg_printf(sc, "Calling muge_attach_post.\n");
1443 
1444 	/* Setup some of the basics */
1445 	sc->sc_phyno = 1;
1446 
1447 	/*
1448 	 * Attempt to get the mac address, if an EEPROM is not attached this
1449 	 * will just return FF:FF:FF:FF:FF:FF, so in such cases we invent a MAC
1450 	 * address based on urandom.
1451 	 */
1452 	memset(sc->sc_ue.ue_eaddr, 0xff, ETHER_ADDR_LEN);
1453 
1454 	uint32_t val;
1455 	lan78xx_read_reg(sc, 0, &val);
1456 
1457 	/* Read current MAC address from RX_ADDRx registers. */
1458 	if ((lan78xx_read_reg(sc, ETH_RX_ADDRL, &mac_l) == 0) &&
1459 	    (lan78xx_read_reg(sc, ETH_RX_ADDRH, &mac_h) == 0)) {
1460 		sc->sc_ue.ue_eaddr[5] = (uint8_t)((mac_h >> 8) & 0xff);
1461 		sc->sc_ue.ue_eaddr[4] = (uint8_t)((mac_h) & 0xff);
1462 		sc->sc_ue.ue_eaddr[3] = (uint8_t)((mac_l >> 24) & 0xff);
1463 		sc->sc_ue.ue_eaddr[2] = (uint8_t)((mac_l >> 16) & 0xff);
1464 		sc->sc_ue.ue_eaddr[1] = (uint8_t)((mac_l >> 8) & 0xff);
1465 		sc->sc_ue.ue_eaddr[0] = (uint8_t)((mac_l) & 0xff);
1466 	}
1467 
1468 	/* If RX_ADDRx did not provide a valid MAC address, try EEPROM. */
1469 	if (!ETHER_IS_VALID(sc->sc_ue.ue_eaddr)) {
1470 		if ((lan78xx_eeprom_read(sc, ETH_E2P_MAC_OFFSET,
1471 		    sc->sc_ue.ue_eaddr, ETHER_ADDR_LEN) == 0) ||
1472 		    (lan78xx_otp_read(sc, OTP_MAC_OFFSET,
1473 		    sc->sc_ue.ue_eaddr, ETHER_ADDR_LEN) == 0)) {
1474 			if (ETHER_IS_VALID(sc->sc_ue.ue_eaddr)) {
1475 				muge_dbg_printf(sc, "MAC read from EEPROM\n");
1476 			} else {
1477 				muge_dbg_printf(sc, "MAC assigned randomly\n");
1478 				read_random(sc->sc_ue.ue_eaddr, ETHER_ADDR_LEN);
1479 				sc->sc_ue.ue_eaddr[0] &= ~0x01;	/* unicast */
1480 				sc->sc_ue.ue_eaddr[0] |= 0x02;/* locally administered */
1481 			}
1482 		} else {
1483 			muge_dbg_printf(sc, "MAC assigned randomly\n");
1484 			arc4rand(sc->sc_ue.ue_eaddr, ETHER_ADDR_LEN, 0);
1485 			sc->sc_ue.ue_eaddr[0] &= ~0x01;	/* unicast */
1486 			sc->sc_ue.ue_eaddr[0] |= 0x02;	/* locally administered */
1487 		}
1488 	} else {
1489 		muge_dbg_printf(sc, "MAC assigned from registers\n");
1490 	}
1491 
1492 	/* Initialise the chip for the first time */
1493 	lan78xx_chip_init(sc);
1494 }
1495 
1496 /**
1497  *	muge_attach_post_sub - Called after attach to the USB interface
1498  *	@ue: the USB ethernet device
1499  *
1500  *	Most of this is boilerplate code and copied from the base USB ethernet
1501  *	driver.  It has been overriden so that we can indicate to the system
1502  *	that the chip supports H/W checksumming.
1503  *
1504  *	RETURNS:
1505  *	Returns 0 on success or a negative error code.
1506  */
1507 static int
1508 muge_attach_post_sub(struct usb_ether *ue)
1509 {
1510 	struct muge_softc *sc;
1511 	struct ifnet *ifp;
1512 	int error;
1513 
1514 	sc = uether_getsc(ue);
1515 	muge_dbg_printf(sc, "Calling muge_attach_post_sub.\n");
1516 	ifp = ue->ue_ifp;
1517 	ifp->if_flags = IFF_BROADCAST | IFF_SIMPLEX | IFF_MULTICAST;
1518 	ifp->if_start = uether_start;
1519 	ifp->if_ioctl = muge_ioctl;
1520 	ifp->if_init = uether_init;
1521 	IFQ_SET_MAXLEN(&ifp->if_snd, ifqmaxlen);
1522 	ifp->if_snd.ifq_drv_maxlen = ifqmaxlen;
1523 	IFQ_SET_READY(&ifp->if_snd);
1524 
1525 	/*
1526 	 * The chip supports TCP/UDP checksum offloading on TX and RX paths,
1527 	 * however currently only RX checksum is supported in the driver
1528 	 * (see top of file).
1529 	 */
1530 	ifp->if_hwassist = 0;
1531 	if (MUGE_DEFAULT_RX_CSUM_ENABLE)
1532 		ifp->if_capabilities |= IFCAP_RXCSUM;
1533 
1534 	if (MUGE_DEFAULT_TX_CSUM_ENABLE)
1535 		ifp->if_capabilities |= IFCAP_TXCSUM;
1536 
1537 	/*
1538 	 * In the Linux driver they also enable scatter/gather (NETIF_F_SG)
1539 	 * here, that's something related to socket buffers used in Linux.
1540 	 * FreeBSD doesn't have that as an interface feature.
1541 	 */
1542 	if (MUGE_DEFAULT_TSO_CSUM_ENABLE)
1543 		ifp->if_capabilities |= IFCAP_TSO4 | IFCAP_TSO6;
1544 
1545 #if 0
1546 	/* TX checksuming is disabled since not yet implemented. */
1547 	ifp->if_capabilities |= IFCAP_TXCSUM;
1548 	ifp->if_capenable |= IFCAP_TXCSUM;
1549 	ifp->if_hwassist = CSUM_TCP | CSUM_UDP;
1550 #endif
1551 
1552 	ifp->if_capenable = ifp->if_capabilities;
1553 
1554 	mtx_lock(&Giant);
1555 	error = mii_attach(ue->ue_dev, &ue->ue_miibus, ifp,
1556 		uether_ifmedia_upd, ue->ue_methods->ue_mii_sts,
1557 		BMSR_DEFCAPMASK, sc->sc_phyno, MII_OFFSET_ANY, 0);
1558 	mtx_unlock(&Giant);
1559 
1560 	return (0);
1561 }
1562 
1563 /**
1564  *	muge_start - Starts communication with the LAN78xx chip
1565  *	@ue: USB ether interface
1566  */
1567 static void
1568 muge_start(struct usb_ether *ue)
1569 {
1570 	struct muge_softc *sc = uether_getsc(ue);
1571 
1572 	/*
1573 	 * Start the USB transfers, if not already started.
1574 	 */
1575 	usbd_transfer_start(sc->sc_xfer[MUGE_BULK_DT_RD]);
1576 	usbd_transfer_start(sc->sc_xfer[MUGE_BULK_DT_WR]);
1577 }
1578 
1579 /**
1580  *	muge_ioctl - ioctl function for the device
1581  *	@ifp: interface pointer
1582  *	@cmd: the ioctl command
1583  *	@data: data passed in the ioctl call, typically a pointer to struct
1584  *	ifreq.
1585  *
1586  *	The ioctl routine is overridden to detect change requests for the H/W
1587  *	checksum capabilities.
1588  *
1589  *	RETURNS:
1590  *	0 on success and an error code on failure.
1591  */
1592 static int
1593 muge_ioctl(struct ifnet *ifp, u_long cmd, caddr_t data)
1594 {
1595 	struct usb_ether *ue = ifp->if_softc;
1596 	struct muge_softc *sc;
1597 	struct ifreq *ifr;
1598 	int rc;
1599 	int mask;
1600 	int reinit;
1601 
1602 	if (cmd == SIOCSIFCAP) {
1603 		sc = uether_getsc(ue);
1604 		ifr = (struct ifreq *)data;
1605 
1606 		MUGE_LOCK(sc);
1607 
1608 		rc = 0;
1609 		reinit = 0;
1610 
1611 		mask = ifr->ifr_reqcap ^ ifp->if_capenable;
1612 
1613 		/* Modify the RX CSUM enable bits. */
1614 		if ((mask & IFCAP_RXCSUM) != 0 &&
1615 			(ifp->if_capabilities & IFCAP_RXCSUM) != 0) {
1616 			ifp->if_capenable ^= IFCAP_RXCSUM;
1617 
1618 			if (ifp->if_drv_flags & IFF_DRV_RUNNING) {
1619 				ifp->if_drv_flags &= ~IFF_DRV_RUNNING;
1620 				reinit = 1;
1621 			}
1622 		}
1623 
1624 		MUGE_UNLOCK(sc);
1625 		if (reinit)
1626 			uether_init(ue);
1627 
1628 	} else {
1629 		rc = uether_ioctl(ifp, cmd, data);
1630 	}
1631 
1632 	return (rc);
1633 }
1634 
1635 /**
1636  *	muge_reset - Reset the SMSC chip
1637  *	@sc: device soft context
1638  *
1639  *	LOCKING:
1640  *	Should be called with the SMSC lock held.
1641  */
1642 static void
1643 muge_reset(struct muge_softc *sc)
1644 {
1645 	struct usb_config_descriptor *cd;
1646 	usb_error_t err;
1647 
1648 	cd = usbd_get_config_descriptor(sc->sc_ue.ue_udev);
1649 
1650 	err = usbd_req_set_config(sc->sc_ue.ue_udev, &sc->sc_mtx,
1651 	    cd->bConfigurationValue);
1652 	if (err)
1653 		muge_warn_printf(sc, "reset failed (ignored)\n");
1654 
1655 	/* Wait a little while for the chip to get its brains in order. */
1656 	uether_pause(&sc->sc_ue, hz / 100);
1657 
1658 	/* Reinitialize controller to achieve full reset. */
1659 	lan78xx_chip_init(sc);
1660 }
1661 
1662 /**
1663  * muge_set_addr_filter
1664  *
1665  *	@sc: device soft context
1666  *	@index: index of the entry to the perfect address table
1667  *	@addr: address to be written
1668  *
1669  */
1670 static void
1671 muge_set_addr_filter(struct muge_softc *sc, int index,
1672     uint8_t addr[ETHER_ADDR_LEN])
1673 {
1674 	uint32_t tmp;
1675 
1676 	if ((sc) && (index > 0) && (index < MUGE_NUM_PFILTER_ADDRS_)) {
1677 		tmp = addr[3];
1678 		tmp |= addr[2] | (tmp << 8);
1679 		tmp |= addr[1] | (tmp << 8);
1680 		tmp |= addr[0] | (tmp << 8);
1681 		sc->sc_pfilter_table[index][1] = tmp;
1682 		tmp = addr[5];
1683 		tmp |= addr[4] | (tmp << 8);
1684 		tmp |= ETH_MAF_HI_VALID_ | ETH_MAF_HI_TYPE_DST_;
1685 		sc->sc_pfilter_table[index][0] = tmp;
1686 	}
1687 }
1688 
1689 /**
1690  *	lan78xx_dataport_write - write to the selected RAM
1691  *	@sc: The device soft context.
1692  *	@ram_select: Select which RAM to access.
1693  *	@addr: Starting address to write to.
1694  *	@buf: word-sized buffer to write to RAM, starting at @addr.
1695  *	@length: length of @buf
1696  *
1697  *
1698  *	RETURNS:
1699  *	0 if write successful.
1700  */
1701 static int
1702 lan78xx_dataport_write(struct muge_softc *sc, uint32_t ram_select,
1703     uint32_t addr, uint32_t length, uint32_t *buf)
1704 {
1705 	uint32_t dp_sel;
1706 	int i, ret;
1707 
1708 	MUGE_LOCK_ASSERT(sc, MA_OWNED);
1709 	ret = lan78xx_wait_for_bits(sc, ETH_DP_SEL, ETH_DP_SEL_DPRDY_);
1710 	if (ret < 0)
1711 		goto done;
1712 
1713 	ret = lan78xx_read_reg(sc, ETH_DP_SEL, &dp_sel);
1714 
1715 	dp_sel &= ~ETH_DP_SEL_RSEL_MASK_;
1716 	dp_sel |= ram_select;
1717 
1718 	ret = lan78xx_write_reg(sc, ETH_DP_SEL, dp_sel);
1719 
1720 	for (i = 0; i < length; i++) {
1721 		ret = lan78xx_write_reg(sc, ETH_DP_ADDR, addr + i);
1722 		ret = lan78xx_write_reg(sc, ETH_DP_DATA, buf[i]);
1723 		ret = lan78xx_write_reg(sc, ETH_DP_CMD, ETH_DP_CMD_WRITE_);
1724 		ret = lan78xx_wait_for_bits(sc, ETH_DP_SEL, ETH_DP_SEL_DPRDY_);
1725 		if (ret != 0)
1726 			goto done;
1727 	}
1728 
1729 done:
1730 	return (ret);
1731 }
1732 
1733 /**
1734  * muge_multicast_write
1735  * @sc: device's soft context
1736  *
1737  * Writes perfect addres filters and hash address filters to their
1738  * corresponding registers and RAMs.
1739  *
1740  */
1741 static void
1742 muge_multicast_write(struct muge_softc *sc)
1743 {
1744 	int i, ret;
1745 	lan78xx_dataport_write(sc, ETH_DP_SEL_RSEL_VLAN_DA_,
1746 	    ETH_DP_SEL_VHF_VLAN_LEN, ETH_DP_SEL_VHF_HASH_LEN,
1747 	    sc->sc_mchash_table);
1748 
1749 	for (i = 1; i < MUGE_NUM_PFILTER_ADDRS_; i++) {
1750 		ret = lan78xx_write_reg(sc, PFILTER_HI(i), 0);
1751 		ret = lan78xx_write_reg(sc, PFILTER_LO(i),
1752 		    sc->sc_pfilter_table[i][1]);
1753 		ret = lan78xx_write_reg(sc, PFILTER_HI(i),
1754 		    sc->sc_pfilter_table[i][0]);
1755 	}
1756 }
1757 
1758 /**
1759  *	muge_hash - Calculate the hash of a mac address
1760  *	@addr: The mac address to calculate the hash on
1761  *
1762  *	This function is used when configuring a range of multicast mac
1763  *	addresses to filter on.  The hash of the mac address is put in the
1764  *	device's mac hash table.
1765  *
1766  *	RETURNS:
1767  *	Returns a value from 0-63 value which is the hash of the mac address.
1768  */
1769 static inline uint32_t
1770 muge_hash(uint8_t addr[ETHER_ADDR_LEN])
1771 {
1772 	return (ether_crc32_be(addr, ETHER_ADDR_LEN) >> 26) & 0x3f;
1773 }
1774 
1775 /**
1776  *	muge_setmulti - Setup multicast
1777  *	@ue: usb ethernet device context
1778  *
1779  *	Tells the device to either accept frames with a multicast mac address,
1780  *	a select group of m'cast mac addresses or just the devices mac address.
1781  *
1782  *	LOCKING:
1783  *	Should be called with the MUGE lock held.
1784  */
1785 static void
1786 muge_setmulti(struct usb_ether *ue)
1787 {
1788 	struct muge_softc *sc = uether_getsc(ue);
1789 	struct ifnet *ifp = uether_getifp(ue);
1790 	uint8_t i, *addr;
1791 	struct ifmultiaddr *ifma;
1792 
1793 	MUGE_LOCK_ASSERT(sc, MA_OWNED);
1794 
1795 	sc->sc_rfe_ctl &= ~(ETH_RFE_CTL_UCAST_EN_ | ETH_RFE_CTL_MCAST_EN_ |
1796 		ETH_RFE_CTL_DA_PERFECT_ | ETH_RFE_CTL_MCAST_HASH_);
1797 
1798 	/* Initialize hash filter table. */
1799 	for (i = 0; i < ETH_DP_SEL_VHF_HASH_LEN; i++)
1800 		sc->sc_mchash_table[i] = 0;
1801 
1802 	/* Initialize perfect filter table. */
1803 	for (i = 1; i < MUGE_NUM_PFILTER_ADDRS_; i++) {
1804 		sc->sc_pfilter_table[i][0] =
1805 		sc->sc_pfilter_table[i][1] = 0;
1806 	}
1807 
1808 	sc->sc_rfe_ctl |= ETH_RFE_CTL_BCAST_EN_;
1809 
1810 	if (ifp->if_flags & IFF_PROMISC) {
1811 		muge_dbg_printf(sc, "promiscuous mode enabled\n");
1812 		sc->sc_rfe_ctl |= ETH_RFE_CTL_MCAST_EN_ | ETH_RFE_CTL_UCAST_EN_;
1813 	} else if (ifp->if_flags & IFF_ALLMULTI){
1814 		muge_dbg_printf(sc, "receive all multicast enabled\n");
1815 		sc->sc_rfe_ctl |= ETH_RFE_CTL_MCAST_EN_;
1816 	} else {
1817 		/* Lock the mac address list before hashing each of them. */
1818 		if_maddr_rlock(ifp);
1819 		if (!CK_STAILQ_EMPTY(&ifp->if_multiaddrs)) {
1820 			i = 1;
1821 			CK_STAILQ_FOREACH(ifma, &ifp->if_multiaddrs,
1822 			    ifma_link) {
1823 				/* First fill up the perfect address table. */
1824 				addr = LLADDR((struct sockaddr_dl *)
1825 				    ifma->ifma_addr);
1826 				if (i < 33 /* XXX */) {
1827 					muge_set_addr_filter(sc, i, addr);
1828 				} else {
1829 					uint32_t bitnum = muge_hash(addr);
1830 					sc->sc_mchash_table[bitnum / 32] |=
1831 					    (1 << (bitnum % 32));
1832 					sc->sc_rfe_ctl |=
1833 					    ETH_RFE_CTL_MCAST_HASH_;
1834 				}
1835 				i++;
1836 			}
1837 		}
1838 		if_maddr_runlock(ifp);
1839 		muge_multicast_write(sc);
1840 	}
1841 	lan78xx_write_reg(sc, ETH_RFE_CTL, sc->sc_rfe_ctl);
1842 }
1843 
1844 /**
1845  *	muge_setpromisc - Enables/disables promiscuous mode
1846  *	@ue: usb ethernet device context
1847  *
1848  *	LOCKING:
1849  *	Should be called with the MUGE lock held.
1850  */
1851 static void
1852 muge_setpromisc(struct usb_ether *ue)
1853 {
1854 	struct muge_softc *sc = uether_getsc(ue);
1855 	struct ifnet *ifp = uether_getifp(ue);
1856 
1857 	muge_dbg_printf(sc, "promiscuous mode %sabled\n",
1858 	    (ifp->if_flags & IFF_PROMISC) ? "en" : "dis");
1859 
1860 	MUGE_LOCK_ASSERT(sc, MA_OWNED);
1861 
1862 	if (ifp->if_flags & IFF_PROMISC)
1863 		sc->sc_rfe_ctl |= ETH_RFE_CTL_MCAST_EN_ | ETH_RFE_CTL_UCAST_EN_;
1864 	else
1865 		sc->sc_rfe_ctl &= ~(ETH_RFE_CTL_MCAST_EN_);
1866 
1867 	lan78xx_write_reg(sc, ETH_RFE_CTL, sc->sc_rfe_ctl);
1868 }
1869 
1870 /**
1871  *	muge_sethwcsum - Enable or disable H/W UDP and TCP checksumming
1872  *	@sc: driver soft context
1873  *
1874  *	LOCKING:
1875  *	Should be called with the MUGE lock held.
1876  *
1877  *	RETURNS:
1878  *	Returns 0 on success or a negative error code.
1879  */
1880 static int muge_sethwcsum(struct muge_softc *sc)
1881 {
1882 	struct ifnet *ifp = uether_getifp(&sc->sc_ue);
1883 	int err;
1884 
1885 	if (!ifp)
1886 		return (-EIO);
1887 
1888 	MUGE_LOCK_ASSERT(sc, MA_OWNED);
1889 
1890 	if (ifp->if_capabilities & IFCAP_RXCSUM) {
1891 		sc->sc_rfe_ctl |= ETH_RFE_CTL_IGMP_COE_ | ETH_RFE_CTL_ICMP_COE_;
1892 		sc->sc_rfe_ctl |= ETH_RFE_CTL_TCPUDP_COE_ | ETH_RFE_CTL_IP_COE_;
1893 	} else {
1894 		sc->sc_rfe_ctl &=
1895 		    ~(ETH_RFE_CTL_IGMP_COE_ | ETH_RFE_CTL_ICMP_COE_);
1896 		sc->sc_rfe_ctl &=
1897 		     ~(ETH_RFE_CTL_TCPUDP_COE_ | ETH_RFE_CTL_IP_COE_);
1898 	}
1899 
1900 	sc->sc_rfe_ctl &= ~ETH_RFE_CTL_VLAN_FILTER_;
1901 
1902 	err = lan78xx_write_reg(sc, ETH_RFE_CTL, sc->sc_rfe_ctl);
1903 
1904 	if (err != 0) {
1905 		muge_warn_printf(sc, "failed to write ETH_RFE_CTL (err=%d)\n",
1906 		    err);
1907 		return (err);
1908 	}
1909 
1910 	return (0);
1911 }
1912 
1913 /**
1914  *	muge_ifmedia_upd - Set media options
1915  *	@ifp: interface pointer
1916  *
1917  *	Basically boilerplate code that simply calls the mii functions to set
1918  *	the media options.
1919  *
1920  *	LOCKING:
1921  *	The device lock must be held before this function is called.
1922  *
1923  *	RETURNS:
1924  *	Returns 0 on success or a negative error code.
1925  */
1926 static int
1927 muge_ifmedia_upd(struct ifnet *ifp)
1928 {
1929 	struct muge_softc *sc = ifp->if_softc;
1930 	muge_dbg_printf(sc, "Calling muge_ifmedia_upd.\n");
1931 	struct mii_data *mii = uether_getmii(&sc->sc_ue);
1932 	struct mii_softc *miisc;
1933 	int err;
1934 
1935 	MUGE_LOCK_ASSERT(sc, MA_OWNED);
1936 
1937 	LIST_FOREACH(miisc, &mii->mii_phys, mii_list)
1938 		PHY_RESET(miisc);
1939 	err = mii_mediachg(mii);
1940 	return (err);
1941 }
1942 
1943 /**
1944  *	muge_init - Initialises the LAN95xx chip
1945  *	@ue: USB ether interface
1946  *
1947  *	Called when the interface is brought up (i.e. ifconfig ue0 up), this
1948  *	initialise the interface and the rx/tx pipes.
1949  *
1950  *	LOCKING:
1951  *	Should be called with the MUGE lock held.
1952  */
1953 static void
1954 muge_init(struct usb_ether *ue)
1955 {
1956 	struct muge_softc *sc = uether_getsc(ue);
1957 	muge_dbg_printf(sc, "Calling muge_init.\n");
1958 	struct ifnet *ifp = uether_getifp(ue);
1959 	MUGE_LOCK_ASSERT(sc, MA_OWNED);
1960 
1961 	if (lan78xx_setmacaddress(sc, IF_LLADDR(ifp)))
1962 		muge_dbg_printf(sc, "setting MAC address failed\n");
1963 
1964 	if ((ifp->if_drv_flags & IFF_DRV_RUNNING) != 0)
1965 		return;
1966 
1967 	/* Cancel pending I/O. */
1968 	muge_stop(ue);
1969 
1970 	/* Reset the ethernet interface. */
1971 	muge_reset(sc);
1972 
1973 	/* Load the multicast filter. */
1974 	muge_setmulti(ue);
1975 
1976 	/* TCP/UDP checksum offload engines. */
1977 	muge_sethwcsum(sc);
1978 
1979 	usbd_xfer_set_stall(sc->sc_xfer[MUGE_BULK_DT_WR]);
1980 
1981 	/* Indicate we are up and running. */
1982 	ifp->if_drv_flags |= IFF_DRV_RUNNING;
1983 
1984 	/* Switch to selected media. */
1985 	muge_ifmedia_upd(ifp);
1986 	muge_start(ue);
1987 }
1988 
1989 /**
1990  *	muge_stop - Stops communication with the LAN78xx chip
1991  *	@ue: USB ether interface
1992  */
1993 static void
1994 muge_stop(struct usb_ether *ue)
1995 {
1996 	struct muge_softc *sc = uether_getsc(ue);
1997 	struct ifnet *ifp = uether_getifp(ue);
1998 
1999 	MUGE_LOCK_ASSERT(sc, MA_OWNED);
2000 
2001 	ifp->if_drv_flags &= ~(IFF_DRV_RUNNING | IFF_DRV_OACTIVE);
2002 	sc->sc_flags &= ~MUGE_FLAG_LINK;
2003 
2004 	/*
2005 	 * Stop all the transfers, if not already stopped.
2006 	 */
2007 	usbd_transfer_stop(sc->sc_xfer[MUGE_BULK_DT_WR]);
2008 	usbd_transfer_stop(sc->sc_xfer[MUGE_BULK_DT_RD]);
2009 }
2010 
2011 /**
2012  *	muge_tick - Called periodically to monitor the state of the LAN95xx chip
2013  *	@ue: USB ether interface
2014  *
2015  *	Simply calls the mii status functions to check the state of the link.
2016  *
2017  *	LOCKING:
2018  *	Should be called with the MUGE lock held.
2019  */
2020 static void
2021 muge_tick(struct usb_ether *ue)
2022 {
2023 
2024 	struct muge_softc *sc = uether_getsc(ue);
2025 	struct mii_data *mii = uether_getmii(&sc->sc_ue);
2026 
2027 	MUGE_LOCK_ASSERT(sc, MA_OWNED);
2028 
2029 	mii_tick(mii);
2030 	if ((sc->sc_flags & MUGE_FLAG_LINK) == 0) {
2031 		lan78xx_miibus_statchg(ue->ue_dev);
2032 		if ((sc->sc_flags & MUGE_FLAG_LINK) != 0)
2033 			muge_start(ue);
2034 	}
2035 }
2036 
2037 /**
2038  *	muge_ifmedia_sts - Report current media status
2039  *	@ifp: inet interface pointer
2040  *	@ifmr: interface media request
2041  *
2042  *	Call the mii functions to get the media status.
2043  *
2044  *	LOCKING:
2045  *	Internally takes and releases the device lock.
2046  */
2047 static void
2048 muge_ifmedia_sts(struct ifnet *ifp, struct ifmediareq *ifmr)
2049 {
2050 	struct muge_softc *sc = ifp->if_softc;
2051 	struct mii_data *mii = uether_getmii(&sc->sc_ue);
2052 
2053 	MUGE_LOCK(sc);
2054 	mii_pollstat(mii);
2055 	ifmr->ifm_active = mii->mii_media_active;
2056 	ifmr->ifm_status = mii->mii_media_status;
2057 	MUGE_UNLOCK(sc);
2058 }
2059 
2060 /**
2061  *	muge_probe - Probe the interface.
2062  *	@dev: muge device handle
2063  *
2064  *	Checks if the device is a match for this driver.
2065  *
2066  *	RETURNS:
2067  *	Returns 0 on success or an error code on failure.
2068  */
2069 static int
2070 muge_probe(device_t dev)
2071 {
2072 	struct usb_attach_arg *uaa = device_get_ivars(dev);
2073 
2074 	if (uaa->usb_mode != USB_MODE_HOST)
2075 		return (ENXIO);
2076 	if (uaa->info.bConfigIndex != MUGE_CONFIG_INDEX)
2077 		return (ENXIO);
2078 	if (uaa->info.bIfaceIndex != MUGE_IFACE_IDX)
2079 		return (ENXIO);
2080 	return (usbd_lookup_id_by_uaa(lan78xx_devs, sizeof(lan78xx_devs), uaa));
2081 }
2082 
2083 /**
2084  *	muge_attach - Attach the interface.
2085  *	@dev: muge device handle
2086  *
2087  *	Allocate softc structures, do ifmedia setup and ethernet/BPF attach.
2088  *
2089  *	RETURNS:
2090  *	Returns 0 on success or a negative error code.
2091  */
2092 static int
2093 muge_attach(device_t dev)
2094 {
2095 	struct usb_attach_arg *uaa = device_get_ivars(dev);
2096 	struct muge_softc *sc = device_get_softc(dev);
2097 	struct usb_ether *ue = &sc->sc_ue;
2098 	uint8_t iface_index;
2099 	int err;
2100 
2101 	sc->sc_flags = USB_GET_DRIVER_INFO(uaa);
2102 
2103 	device_set_usb_desc(dev);
2104 
2105 	mtx_init(&sc->sc_mtx, device_get_nameunit(dev), NULL, MTX_DEF);
2106 
2107 	/* Setup the endpoints for the Microchip LAN78xx device. */
2108 	iface_index = MUGE_IFACE_IDX;
2109 	err = usbd_transfer_setup(uaa->device, &iface_index, sc->sc_xfer,
2110 	    muge_config, MUGE_N_TRANSFER, sc, &sc->sc_mtx);
2111 	if (err) {
2112 		device_printf(dev, "error: allocating USB transfers failed\n");
2113 		goto detach;
2114 	}
2115 
2116 	ue->ue_sc = sc;
2117 	ue->ue_dev = dev;
2118 	ue->ue_udev = uaa->device;
2119 	ue->ue_mtx = &sc->sc_mtx;
2120 	ue->ue_methods = &muge_ue_methods;
2121 
2122 	err = uether_ifattach(ue);
2123 	if (err) {
2124 		device_printf(dev, "error: could not attach interface\n");
2125 		goto detach;
2126 	}
2127 	return (0);
2128 
2129 detach:
2130 	muge_detach(dev);
2131 	return (ENXIO);
2132 }
2133 
2134 /**
2135  *	muge_detach - Detach the interface.
2136  *	@dev: muge device handle
2137  *
2138  *	RETURNS:
2139  *	Returns 0.
2140  */
2141 static int
2142 muge_detach(device_t dev)
2143 {
2144 
2145 	struct muge_softc *sc = device_get_softc(dev);
2146 	struct usb_ether *ue = &sc->sc_ue;
2147 
2148 	usbd_transfer_unsetup(sc->sc_xfer, MUGE_N_TRANSFER);
2149 	uether_ifdetach(ue);
2150 	mtx_destroy(&sc->sc_mtx);
2151 
2152 	return (0);
2153 }
2154 
2155 static device_method_t muge_methods[] = {
2156 	/* Device interface */
2157 	DEVMETHOD(device_probe, muge_probe),
2158 	DEVMETHOD(device_attach, muge_attach),
2159 	DEVMETHOD(device_detach, muge_detach),
2160 
2161 	/* Bus interface */
2162 	DEVMETHOD(bus_print_child, bus_generic_print_child),
2163 	DEVMETHOD(bus_driver_added, bus_generic_driver_added),
2164 
2165 	/* MII interface */
2166 	DEVMETHOD(miibus_readreg, lan78xx_miibus_readreg),
2167 	DEVMETHOD(miibus_writereg, lan78xx_miibus_writereg),
2168 	DEVMETHOD(miibus_statchg, lan78xx_miibus_statchg),
2169 
2170 	DEVMETHOD_END
2171 };
2172 
2173 static driver_t muge_driver = {
2174 	.name = "muge",
2175 	.methods = muge_methods,
2176 	.size = sizeof(struct muge_softc),
2177 };
2178 
2179 static devclass_t muge_devclass;
2180 
2181 DRIVER_MODULE(muge, uhub, muge_driver, muge_devclass, NULL, 0);
2182 DRIVER_MODULE(miibus, muge, miibus_driver, miibus_devclass, 0, 0);
2183 MODULE_DEPEND(muge, uether, 1, 1, 1);
2184 MODULE_DEPEND(muge, usb, 1, 1, 1);
2185 MODULE_DEPEND(muge, ether, 1, 1, 1);
2186 MODULE_DEPEND(muge, miibus, 1, 1, 1);
2187 MODULE_VERSION(muge, 1);
2188 USB_PNP_HOST_INFO(lan78xx_devs);
2189