xref: /dragonfly/sys/dev/netif/xl/if_xl.c (revision 984263bc)
1 /*
2  * Copyright (c) 1997, 1998, 1999
3  *	Bill Paul <wpaul@ctr.columbia.edu>.  All rights reserved.
4  *
5  * Redistribution and use in source and binary forms, with or without
6  * modification, are permitted provided that the following conditions
7  * are met:
8  * 1. Redistributions of source code must retain the above copyright
9  *    notice, this list of conditions and the following disclaimer.
10  * 2. Redistributions in binary form must reproduce the above copyright
11  *    notice, this list of conditions and the following disclaimer in the
12  *    documentation and/or other materials provided with the distribution.
13  * 3. All advertising materials mentioning features or use of this software
14  *    must display the following acknowledgement:
15  *	This product includes software developed by Bill Paul.
16  * 4. Neither the name of the author nor the names of any co-contributors
17  *    may be used to endorse or promote products derived from this software
18  *    without specific prior written permission.
19  *
20  * THIS SOFTWARE IS PROVIDED BY Bill Paul AND CONTRIBUTORS ``AS IS'' AND
21  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
22  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
23  * ARE DISCLAIMED.  IN NO EVENT SHALL Bill Paul OR THE VOICES IN HIS HEAD
24  * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
25  * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
26  * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
27  * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
28  * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
29  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
30  * THE POSSIBILITY OF SUCH DAMAGE.
31  *
32  * $FreeBSD: src/sys/pci/if_xl.c,v 1.72.2.25 2003/02/05 22:03:58 mbr Exp $
33  */
34 
35 /*
36  * 3Com 3c90x Etherlink XL PCI NIC driver
37  *
38  * Supports the 3Com "boomerang", "cyclone" and "hurricane" PCI
39  * bus-master chips (3c90x cards and embedded controllers) including
40  * the following:
41  *
42  * 3Com 3c900-TPO	10Mbps/RJ-45
43  * 3Com 3c900-COMBO	10Mbps/RJ-45,AUI,BNC
44  * 3Com 3c905-TX	10/100Mbps/RJ-45
45  * 3Com 3c905-T4	10/100Mbps/RJ-45
46  * 3Com 3c900B-TPO	10Mbps/RJ-45
47  * 3Com 3c900B-COMBO	10Mbps/RJ-45,AUI,BNC
48  * 3Com 3c900B-TPC	10Mbps/RJ-45,BNC
49  * 3Com 3c900B-FL	10Mbps/Fiber-optic
50  * 3Com 3c905B-COMBO	10/100Mbps/RJ-45,AUI,BNC
51  * 3Com 3c905B-TX	10/100Mbps/RJ-45
52  * 3Com 3c905B-FL/FX	10/100Mbps/Fiber-optic
53  * 3Com 3c905C-TX	10/100Mbps/RJ-45 (Tornado ASIC)
54  * 3Com 3c980-TX	10/100Mbps server adapter (Hurricane ASIC)
55  * 3Com 3c980C-TX	10/100Mbps server adapter (Tornado ASIC)
56  * 3Com 3cSOHO100-TX	10/100Mbps/RJ-45 (Hurricane ASIC)
57  * 3Com 3c450-TX	10/100Mbps/RJ-45 (Tornado ASIC)
58  * 3Com 3c555		10/100Mbps/RJ-45 (MiniPCI, Laptop Hurricane)
59  * 3Com 3c556		10/100Mbps/RJ-45 (MiniPCI, Hurricane ASIC)
60  * 3Com 3c556B		10/100Mbps/RJ-45 (MiniPCI, Hurricane ASIC)
61  * 3Com 3c575TX		10/100Mbps/RJ-45 (Cardbus, Hurricane ASIC)
62  * 3Com 3c575B		10/100Mbps/RJ-45 (Cardbus, Hurricane ASIC)
63  * 3Com 3c575C		10/100Mbps/RJ-45 (Cardbus, Hurricane ASIC)
64  * 3Com 3cxfem656	10/100Mbps/RJ-45 (Cardbus, Hurricane ASIC)
65  * 3Com 3cxfem656b	10/100Mbps/RJ-45 (Cardbus, Hurricane ASIC)
66  * 3Com 3cxfem656c	10/100Mbps/RJ-45 (Cardbus, Tornado ASIC)
67  * Dell Optiplex GX1 on-board 3c918 10/100Mbps/RJ-45
68  * Dell on-board 3c920 10/100Mbps/RJ-45
69  * Dell Precision on-board 3c905B 10/100Mbps/RJ-45
70  * Dell Latitude laptop docking station embedded 3c905-TX
71  *
72  * Written by Bill Paul <wpaul@ctr.columbia.edu>
73  * Electrical Engineering Department
74  * Columbia University, New York City
75  */
76 
77 /*
78  * The 3c90x series chips use a bus-master DMA interface for transfering
79  * packets to and from the controller chip. Some of the "vortex" cards
80  * (3c59x) also supported a bus master mode, however for those chips
81  * you could only DMA packets to/from a contiguous memory buffer. For
82  * transmission this would mean copying the contents of the queued mbuf
83  * chain into a an mbuf cluster and then DMAing the cluster. This extra
84  * copy would sort of defeat the purpose of the bus master support for
85  * any packet that doesn't fit into a single mbuf.
86  *
87  * By contrast, the 3c90x cards support a fragment-based bus master
88  * mode where mbuf chains can be encapsulated using TX descriptors.
89  * This is similar to other PCI chips such as the Texas Instruments
90  * ThunderLAN and the Intel 82557/82558.
91  *
92  * The "vortex" driver (if_vx.c) happens to work for the "boomerang"
93  * bus master chips because they maintain the old PIO interface for
94  * backwards compatibility, but starting with the 3c905B and the
95  * "cyclone" chips, the compatibility interface has been dropped.
96  * Since using bus master DMA is a big win, we use this driver to
97  * support the PCI "boomerang" chips even though they work with the
98  * "vortex" driver in order to obtain better performance.
99  *
100  * This driver is in the /sys/pci directory because it only supports
101  * PCI-based NICs.
102  */
103 
104 #include <sys/param.h>
105 #include <sys/systm.h>
106 #include <sys/sockio.h>
107 #include <sys/mbuf.h>
108 #include <sys/malloc.h>
109 #include <sys/kernel.h>
110 #include <sys/socket.h>
111 
112 #include <net/if.h>
113 #include <net/if_arp.h>
114 #include <net/ethernet.h>
115 #include <net/if_dl.h>
116 #include <net/if_media.h>
117 
118 #include <net/bpf.h>
119 
120 #include <vm/vm.h>              /* for vtophys */
121 #include <vm/pmap.h>            /* for vtophys */
122 #include <machine/clock.h>      /* for DELAY */
123 #include <machine/bus_memio.h>
124 #include <machine/bus_pio.h>
125 #include <machine/bus.h>
126 #include <machine/resource.h>
127 #include <sys/bus.h>
128 #include <sys/rman.h>
129 
130 #include <dev/mii/mii.h>
131 #include <dev/mii/miivar.h>
132 
133 #include <pci/pcireg.h>
134 #include <pci/pcivar.h>
135 
136 MODULE_DEPEND(xl, miibus, 1, 1, 1);
137 
138 /* "controller miibus0" required.  See GENERIC if you get errors here. */
139 #include "miibus_if.h"
140 
141 /*
142  * The following #define causes the code to use PIO to access the
143  * chip's registers instead of memory mapped mode. The reason PIO mode
144  * is on by default is that the Etherlink XL manual seems to indicate
145  * that only the newer revision chips (3c905B) support both PIO and
146  * memory mapped access. Since we want to be compatible with the older
147  * bus master chips, we use PIO here. If you comment this out, the
148  * driver will use memory mapped I/O, which may be faster but which
149  * might not work on some devices.
150  */
151 #define XL_USEIOSPACE
152 
153 #include <pci/if_xlreg.h>
154 
155 #if !defined(lint)
156 static const char rcsid[] =
157   "$FreeBSD: src/sys/pci/if_xl.c,v 1.72.2.25 2003/02/05 22:03:58 mbr Exp $";
158 #endif
159 
160 #define XL905B_CSUM_FEATURES	(CSUM_IP | CSUM_TCP | CSUM_UDP)
161 
162 /*
163  * Various supported device vendors/types and their names.
164  */
165 static struct xl_type xl_devs[] = {
166 	{ TC_VENDORID, TC_DEVICEID_BOOMERANG_10BT,
167 		"3Com 3c900-TPO Etherlink XL" },
168 	{ TC_VENDORID, TC_DEVICEID_BOOMERANG_10BT_COMBO,
169 		"3Com 3c900-COMBO Etherlink XL" },
170 	{ TC_VENDORID, TC_DEVICEID_BOOMERANG_10_100BT,
171 		"3Com 3c905-TX Fast Etherlink XL" },
172 	{ TC_VENDORID, TC_DEVICEID_BOOMERANG_100BT4,
173 		"3Com 3c905-T4 Fast Etherlink XL" },
174 	{ TC_VENDORID, TC_DEVICEID_KRAKATOA_10BT,
175 		"3Com 3c900B-TPO Etherlink XL" },
176 	{ TC_VENDORID, TC_DEVICEID_KRAKATOA_10BT_COMBO,
177 		"3Com 3c900B-COMBO Etherlink XL" },
178 	{ TC_VENDORID, TC_DEVICEID_KRAKATOA_10BT_TPC,
179 		"3Com 3c900B-TPC Etherlink XL" },
180 	{ TC_VENDORID, TC_DEVICEID_CYCLONE_10FL,
181 		"3Com 3c900B-FL Etherlink XL" },
182 	{ TC_VENDORID, TC_DEVICEID_HURRICANE_10_100BT,
183 		"3Com 3c905B-TX Fast Etherlink XL" },
184 	{ TC_VENDORID, TC_DEVICEID_CYCLONE_10_100BT4,
185 		"3Com 3c905B-T4 Fast Etherlink XL" },
186 	{ TC_VENDORID, TC_DEVICEID_CYCLONE_10_100FX,
187 		"3Com 3c905B-FX/SC Fast Etherlink XL" },
188 	{ TC_VENDORID, TC_DEVICEID_CYCLONE_10_100_COMBO,
189 		"3Com 3c905B-COMBO Fast Etherlink XL" },
190 	{ TC_VENDORID, TC_DEVICEID_TORNADO_10_100BT,
191 		"3Com 3c905C-TX Fast Etherlink XL" },
192 	{ TC_VENDORID, TC_DEVICEID_TORNADO_10_100BT_920B,
193 		"3Com 3c920B-EMB Integrated Fast Etherlink XL" },
194 	{ TC_VENDORID, TC_DEVICEID_HURRICANE_10_100BT_SERV,
195 		"3Com 3c980 Fast Etherlink XL" },
196 	{ TC_VENDORID, TC_DEVICEID_TORNADO_10_100BT_SERV,
197 		"3Com 3c980C Fast Etherlink XL" },
198 	{ TC_VENDORID, TC_DEVICEID_HURRICANE_SOHO100TX,
199 		"3Com 3cSOHO100-TX OfficeConnect" },
200 	{ TC_VENDORID, TC_DEVICEID_TORNADO_HOMECONNECT,
201 		"3Com 3c450-TX HomeConnect" },
202 	{ TC_VENDORID, TC_DEVICEID_HURRICANE_555,
203 		"3Com 3c555 Fast Etherlink XL" },
204 	{ TC_VENDORID, TC_DEVICEID_HURRICANE_556,
205 		"3Com 3c556 Fast Etherlink XL" },
206 	{ TC_VENDORID, TC_DEVICEID_HURRICANE_556B,
207 		"3Com 3c556B Fast Etherlink XL" },
208 	{ TC_VENDORID, TC_DEVICEID_HURRICANE_575A,
209 		"3Com 3c575TX Fast Etherlink XL" },
210 	{ TC_VENDORID, TC_DEVICEID_HURRICANE_575B,
211 		"3Com 3c575B Fast Etherlink XL" },
212 	{ TC_VENDORID, TC_DEVICEID_HURRICANE_575C,
213 		"3Com 3c575C Fast Etherlink XL" },
214 	{ TC_VENDORID, TC_DEVICEID_HURRICANE_656,
215 		"3Com 3c656 Fast Etherlink XL" },
216 	{ TC_VENDORID, TC_DEVICEID_HURRICANE_656B,
217 		"3Com 3c656B Fast Etherlink XL" },
218 	{ TC_VENDORID, TC_DEVICEID_TORNADO_656C,
219 		"3Com 3c656C Fast Etherlink XL" },
220 	{ 0, 0, NULL }
221 };
222 
223 static int xl_probe		(device_t);
224 static int xl_attach		(device_t);
225 static int xl_detach		(device_t);
226 
227 static int xl_newbuf		(struct xl_softc *, struct xl_chain_onefrag *);
228 static void xl_stats_update	(void *);
229 static int xl_encap		(struct xl_softc *, struct xl_chain *,
230 						struct mbuf *);
231 static void xl_rxeof		(struct xl_softc *);
232 static int xl_rx_resync		(struct xl_softc *);
233 static void xl_txeof		(struct xl_softc *);
234 static void xl_txeof_90xB	(struct xl_softc *);
235 static void xl_txeoc		(struct xl_softc *);
236 static void xl_intr		(void *);
237 static void xl_start		(struct ifnet *);
238 static void xl_start_90xB	(struct ifnet *);
239 static int xl_ioctl		(struct ifnet *, u_long, caddr_t);
240 static void xl_init		(void *);
241 static void xl_stop		(struct xl_softc *);
242 static void xl_watchdog		(struct ifnet *);
243 static void xl_shutdown		(device_t);
244 static int xl_suspend		(device_t);
245 static int xl_resume		(device_t);
246 
247 static int xl_ifmedia_upd	(struct ifnet *);
248 static void xl_ifmedia_sts	(struct ifnet *, struct ifmediareq *);
249 
250 static int xl_eeprom_wait	(struct xl_softc *);
251 static int xl_read_eeprom	(struct xl_softc *, caddr_t, int, int, int);
252 static void xl_mii_sync		(struct xl_softc *);
253 static void xl_mii_send		(struct xl_softc *, u_int32_t, int);
254 static int xl_mii_readreg	(struct xl_softc *, struct xl_mii_frame *);
255 static int xl_mii_writereg	(struct xl_softc *, struct xl_mii_frame *);
256 
257 static void xl_setcfg		(struct xl_softc *);
258 static void xl_setmode		(struct xl_softc *, int);
259 static u_int8_t xl_calchash	(caddr_t);
260 static void xl_setmulti		(struct xl_softc *);
261 static void xl_setmulti_hash	(struct xl_softc *);
262 static void xl_reset		(struct xl_softc *);
263 static int xl_list_rx_init	(struct xl_softc *);
264 static int xl_list_tx_init	(struct xl_softc *);
265 static int xl_list_tx_init_90xB	(struct xl_softc *);
266 static void xl_wait		(struct xl_softc *);
267 static void xl_mediacheck	(struct xl_softc *);
268 static void xl_choose_xcvr	(struct xl_softc *, int);
269 #ifdef notdef
270 static void xl_testpacket	(struct xl_softc *);
271 #endif
272 
273 static int xl_miibus_readreg	(device_t, int, int);
274 static int xl_miibus_writereg	(device_t, int, int, int);
275 static void xl_miibus_statchg	(device_t);
276 static void xl_miibus_mediainit	(device_t);
277 
278 #ifdef XL_USEIOSPACE
279 #define XL_RES			SYS_RES_IOPORT
280 #define XL_RID			XL_PCI_LOIO
281 #else
282 #define XL_RES			SYS_RES_MEMORY
283 #define XL_RID			XL_PCI_LOMEM
284 #endif
285 
286 static device_method_t xl_methods[] = {
287 	/* Device interface */
288 	DEVMETHOD(device_probe,		xl_probe),
289 	DEVMETHOD(device_attach,	xl_attach),
290 	DEVMETHOD(device_detach,	xl_detach),
291 	DEVMETHOD(device_shutdown,	xl_shutdown),
292 	DEVMETHOD(device_suspend,	xl_suspend),
293 	DEVMETHOD(device_resume,	xl_resume),
294 
295 	/* bus interface */
296 	DEVMETHOD(bus_print_child,	bus_generic_print_child),
297 	DEVMETHOD(bus_driver_added,	bus_generic_driver_added),
298 
299 	/* MII interface */
300 	DEVMETHOD(miibus_readreg,	xl_miibus_readreg),
301 	DEVMETHOD(miibus_writereg,	xl_miibus_writereg),
302 	DEVMETHOD(miibus_statchg,	xl_miibus_statchg),
303 	DEVMETHOD(miibus_mediainit,	xl_miibus_mediainit),
304 
305 	{ 0, 0 }
306 };
307 
308 static driver_t xl_driver = {
309 	"xl",
310 	xl_methods,
311 	sizeof(struct xl_softc)
312 };
313 
314 static devclass_t xl_devclass;
315 
316 DRIVER_MODULE(if_xl, pci, xl_driver, xl_devclass, 0, 0);
317 DRIVER_MODULE(miibus, xl, miibus_driver, miibus_devclass, 0, 0);
318 
319 /*
320  * Murphy's law says that it's possible the chip can wedge and
321  * the 'command in progress' bit may never clear. Hence, we wait
322  * only a finite amount of time to avoid getting caught in an
323  * infinite loop. Normally this delay routine would be a macro,
324  * but it isn't called during normal operation so we can afford
325  * to make it a function.
326  */
327 static void
328 xl_wait(sc)
329 	struct xl_softc		*sc;
330 {
331 	register int		i;
332 
333 	for (i = 0; i < XL_TIMEOUT; i++) {
334 		if (!(CSR_READ_2(sc, XL_STATUS) & XL_STAT_CMDBUSY))
335 			break;
336 	}
337 
338 	if (i == XL_TIMEOUT)
339 		printf("xl%d: command never completed!\n", sc->xl_unit);
340 
341 	return;
342 }
343 
344 /*
345  * MII access routines are provided for adapters with external
346  * PHYs (3c905-TX, 3c905-T4, 3c905B-T4) and those with built-in
347  * autoneg logic that's faked up to look like a PHY (3c905B-TX).
348  * Note: if you don't perform the MDIO operations just right,
349  * it's possible to end up with code that works correctly with
350  * some chips/CPUs/processor speeds/bus speeds/etc but not
351  * with others.
352  */
353 #define MII_SET(x)					\
354 	CSR_WRITE_2(sc, XL_W4_PHY_MGMT,			\
355 		CSR_READ_2(sc, XL_W4_PHY_MGMT) | x)
356 
357 #define MII_CLR(x)					\
358 	CSR_WRITE_2(sc, XL_W4_PHY_MGMT,			\
359 		CSR_READ_2(sc, XL_W4_PHY_MGMT) & ~x)
360 
361 /*
362  * Sync the PHYs by setting data bit and strobing the clock 32 times.
363  */
364 static void
365 xl_mii_sync(sc)
366 	struct xl_softc		*sc;
367 {
368 	register int		i;
369 
370 	XL_SEL_WIN(4);
371 	MII_SET(XL_MII_DIR|XL_MII_DATA);
372 
373 	for (i = 0; i < 32; i++) {
374 		MII_SET(XL_MII_CLK);
375 		DELAY(1);
376 		MII_CLR(XL_MII_CLK);
377 		DELAY(1);
378 	}
379 
380 	return;
381 }
382 
383 /*
384  * Clock a series of bits through the MII.
385  */
386 static void
387 xl_mii_send(sc, bits, cnt)
388 	struct xl_softc		*sc;
389 	u_int32_t		bits;
390 	int			cnt;
391 {
392 	int			i;
393 
394 	XL_SEL_WIN(4);
395 	MII_CLR(XL_MII_CLK);
396 
397 	for (i = (0x1 << (cnt - 1)); i; i >>= 1) {
398                 if (bits & i) {
399 			MII_SET(XL_MII_DATA);
400                 } else {
401 			MII_CLR(XL_MII_DATA);
402                 }
403 		DELAY(1);
404 		MII_CLR(XL_MII_CLK);
405 		DELAY(1);
406 		MII_SET(XL_MII_CLK);
407 	}
408 }
409 
410 /*
411  * Read an PHY register through the MII.
412  */
413 static int
414 xl_mii_readreg(sc, frame)
415 	struct xl_softc		*sc;
416 	struct xl_mii_frame	*frame;
417 
418 {
419 	int			i, ack, s;
420 
421 	s = splimp();
422 
423 	/*
424 	 * Set up frame for RX.
425 	 */
426 	frame->mii_stdelim = XL_MII_STARTDELIM;
427 	frame->mii_opcode = XL_MII_READOP;
428 	frame->mii_turnaround = 0;
429 	frame->mii_data = 0;
430 
431 	/*
432 	 * Select register window 4.
433 	 */
434 
435 	XL_SEL_WIN(4);
436 
437 	CSR_WRITE_2(sc, XL_W4_PHY_MGMT, 0);
438 	/*
439  	 * Turn on data xmit.
440 	 */
441 	MII_SET(XL_MII_DIR);
442 
443 	xl_mii_sync(sc);
444 
445 	/*
446 	 * Send command/address info.
447 	 */
448 	xl_mii_send(sc, frame->mii_stdelim, 2);
449 	xl_mii_send(sc, frame->mii_opcode, 2);
450 	xl_mii_send(sc, frame->mii_phyaddr, 5);
451 	xl_mii_send(sc, frame->mii_regaddr, 5);
452 
453 	/* Idle bit */
454 	MII_CLR((XL_MII_CLK|XL_MII_DATA));
455 	DELAY(1);
456 	MII_SET(XL_MII_CLK);
457 	DELAY(1);
458 
459 	/* Turn off xmit. */
460 	MII_CLR(XL_MII_DIR);
461 
462 	/* Check for ack */
463 	MII_CLR(XL_MII_CLK);
464 	DELAY(1);
465 	ack = CSR_READ_2(sc, XL_W4_PHY_MGMT) & XL_MII_DATA;
466 	MII_SET(XL_MII_CLK);
467 	DELAY(1);
468 
469 	/*
470 	 * Now try reading data bits. If the ack failed, we still
471 	 * need to clock through 16 cycles to keep the PHY(s) in sync.
472 	 */
473 	if (ack) {
474 		for(i = 0; i < 16; i++) {
475 			MII_CLR(XL_MII_CLK);
476 			DELAY(1);
477 			MII_SET(XL_MII_CLK);
478 			DELAY(1);
479 		}
480 		goto fail;
481 	}
482 
483 	for (i = 0x8000; i; i >>= 1) {
484 		MII_CLR(XL_MII_CLK);
485 		DELAY(1);
486 		if (!ack) {
487 			if (CSR_READ_2(sc, XL_W4_PHY_MGMT) & XL_MII_DATA)
488 				frame->mii_data |= i;
489 			DELAY(1);
490 		}
491 		MII_SET(XL_MII_CLK);
492 		DELAY(1);
493 	}
494 
495 fail:
496 
497 	MII_CLR(XL_MII_CLK);
498 	DELAY(1);
499 	MII_SET(XL_MII_CLK);
500 	DELAY(1);
501 
502 	splx(s);
503 
504 	if (ack)
505 		return(1);
506 	return(0);
507 }
508 
509 /*
510  * Write to a PHY register through the MII.
511  */
512 static int
513 xl_mii_writereg(sc, frame)
514 	struct xl_softc		*sc;
515 	struct xl_mii_frame	*frame;
516 
517 {
518 	int			s;
519 
520 	s = splimp();
521 	/*
522 	 * Set up frame for TX.
523 	 */
524 
525 	frame->mii_stdelim = XL_MII_STARTDELIM;
526 	frame->mii_opcode = XL_MII_WRITEOP;
527 	frame->mii_turnaround = XL_MII_TURNAROUND;
528 
529 	/*
530 	 * Select the window 4.
531 	 */
532 	XL_SEL_WIN(4);
533 
534 	/*
535  	 * Turn on data output.
536 	 */
537 	MII_SET(XL_MII_DIR);
538 
539 	xl_mii_sync(sc);
540 
541 	xl_mii_send(sc, frame->mii_stdelim, 2);
542 	xl_mii_send(sc, frame->mii_opcode, 2);
543 	xl_mii_send(sc, frame->mii_phyaddr, 5);
544 	xl_mii_send(sc, frame->mii_regaddr, 5);
545 	xl_mii_send(sc, frame->mii_turnaround, 2);
546 	xl_mii_send(sc, frame->mii_data, 16);
547 
548 	/* Idle bit. */
549 	MII_SET(XL_MII_CLK);
550 	DELAY(1);
551 	MII_CLR(XL_MII_CLK);
552 	DELAY(1);
553 
554 	/*
555 	 * Turn off xmit.
556 	 */
557 	MII_CLR(XL_MII_DIR);
558 
559 	splx(s);
560 
561 	return(0);
562 }
563 
564 static int
565 xl_miibus_readreg(dev, phy, reg)
566 	device_t		dev;
567 	int			phy, reg;
568 {
569 	struct xl_softc		*sc;
570 	struct xl_mii_frame	frame;
571 
572 	sc = device_get_softc(dev);
573 
574 	/*
575 	 * Pretend that PHYs are only available at MII address 24.
576 	 * This is to guard against problems with certain 3Com ASIC
577 	 * revisions that incorrectly map the internal transceiver
578 	 * control registers at all MII addresses. This can cause
579 	 * the miibus code to attach the same PHY several times over.
580 	 */
581 	if ((!(sc->xl_flags & XL_FLAG_PHYOK)) && phy != 24)
582 		return(0);
583 
584 	bzero((char *)&frame, sizeof(frame));
585 
586 	frame.mii_phyaddr = phy;
587 	frame.mii_regaddr = reg;
588 	xl_mii_readreg(sc, &frame);
589 
590 	return(frame.mii_data);
591 }
592 
593 static int
594 xl_miibus_writereg(dev, phy, reg, data)
595 	device_t		dev;
596 	int			phy, reg, data;
597 {
598 	struct xl_softc		*sc;
599 	struct xl_mii_frame	frame;
600 
601 	sc = device_get_softc(dev);
602 
603 	if ((!(sc->xl_flags & XL_FLAG_PHYOK)) && phy != 24)
604 		return(0);
605 
606 	bzero((char *)&frame, sizeof(frame));
607 
608 	frame.mii_phyaddr = phy;
609 	frame.mii_regaddr = reg;
610 	frame.mii_data = data;
611 
612 	xl_mii_writereg(sc, &frame);
613 
614 	return(0);
615 }
616 
617 static void
618 xl_miibus_statchg(dev)
619 	device_t		dev;
620 {
621         struct xl_softc		*sc;
622         struct mii_data		*mii;
623 
624 
625 	sc = device_get_softc(dev);
626 	mii = device_get_softc(sc->xl_miibus);
627 
628 	xl_setcfg(sc);
629 
630 	/* Set ASIC's duplex mode to match the PHY. */
631 	XL_SEL_WIN(3);
632 	if ((mii->mii_media_active & IFM_GMASK) == IFM_FDX)
633 		CSR_WRITE_1(sc, XL_W3_MAC_CTRL, XL_MACCTRL_DUPLEX);
634 	else
635 		CSR_WRITE_1(sc, XL_W3_MAC_CTRL,
636 			(CSR_READ_1(sc, XL_W3_MAC_CTRL) & ~XL_MACCTRL_DUPLEX));
637 
638         return;
639 }
640 
641 /*
642  * Special support for the 3c905B-COMBO. This card has 10/100 support
643  * plus BNC and AUI ports. This means we will have both an miibus attached
644  * plus some non-MII media settings. In order to allow this, we have to
645  * add the extra media to the miibus's ifmedia struct, but we can't do
646  * that during xl_attach() because the miibus hasn't been attached yet.
647  * So instead, we wait until the miibus probe/attach is done, at which
648  * point we will get a callback telling is that it's safe to add our
649  * extra media.
650  */
651 static void
652 xl_miibus_mediainit(dev)
653 	device_t		dev;
654 {
655         struct xl_softc		*sc;
656         struct mii_data		*mii;
657 	struct ifmedia		*ifm;
658 
659 	sc = device_get_softc(dev);
660 	mii = device_get_softc(sc->xl_miibus);
661 	ifm = &mii->mii_media;
662 
663 	if (sc->xl_media & (XL_MEDIAOPT_AUI|XL_MEDIAOPT_10FL)) {
664 		/*
665 		 * Check for a 10baseFL board in disguise.
666 		 */
667 		if (sc->xl_type == XL_TYPE_905B &&
668 		    sc->xl_media == XL_MEDIAOPT_10FL) {
669 			if (bootverbose)
670 				printf("xl%d: found 10baseFL\n", sc->xl_unit);
671 			ifmedia_add(ifm, IFM_ETHER|IFM_10_FL, 0, NULL);
672 			ifmedia_add(ifm, IFM_ETHER|IFM_10_FL|IFM_HDX, 0, NULL);
673 			if (sc->xl_caps & XL_CAPS_FULL_DUPLEX)
674 				ifmedia_add(ifm,
675 				    IFM_ETHER|IFM_10_FL|IFM_FDX, 0, NULL);
676 		} else {
677 			if (bootverbose)
678 				printf("xl%d: found AUI\n", sc->xl_unit);
679 			ifmedia_add(ifm, IFM_ETHER|IFM_10_5, 0, NULL);
680 		}
681 	}
682 
683 	if (sc->xl_media & XL_MEDIAOPT_BNC) {
684 		if (bootverbose)
685 			printf("xl%d: found BNC\n", sc->xl_unit);
686 		ifmedia_add(ifm, IFM_ETHER|IFM_10_2, 0, NULL);
687 	}
688 
689 	return;
690 }
691 
692 /*
693  * The EEPROM is slow: give it time to come ready after issuing
694  * it a command.
695  */
696 static int
697 xl_eeprom_wait(sc)
698 	struct xl_softc		*sc;
699 {
700 	int			i;
701 
702 	for (i = 0; i < 100; i++) {
703 		if (CSR_READ_2(sc, XL_W0_EE_CMD) & XL_EE_BUSY)
704 			DELAY(162);
705 		else
706 			break;
707 	}
708 
709 	if (i == 100) {
710 		printf("xl%d: eeprom failed to come ready\n", sc->xl_unit);
711 		return(1);
712 	}
713 
714 	return(0);
715 }
716 
717 /*
718  * Read a sequence of words from the EEPROM. Note that ethernet address
719  * data is stored in the EEPROM in network byte order.
720  */
721 static int
722 xl_read_eeprom(sc, dest, off, cnt, swap)
723 	struct xl_softc		*sc;
724 	caddr_t			dest;
725 	int			off;
726 	int			cnt;
727 	int			swap;
728 {
729 	int			err = 0, i;
730 	u_int16_t		word = 0, *ptr;
731 #define EEPROM_5BIT_OFFSET(A) ((((A) << 2) & 0x7F00) | ((A) & 0x003F))
732 #define EEPROM_8BIT_OFFSET(A) ((A) & 0x003F)
733 	/* WARNING! DANGER!
734 	 * It's easy to accidentally overwrite the rom content!
735 	 * Note: the 3c575 uses 8bit EEPROM offsets.
736 	 */
737 	XL_SEL_WIN(0);
738 
739 	if (xl_eeprom_wait(sc))
740 		return(1);
741 
742 	if (sc->xl_flags & XL_FLAG_EEPROM_OFFSET_30)
743 		off += 0x30;
744 
745 	for (i = 0; i < cnt; i++) {
746 		if (sc->xl_flags & XL_FLAG_8BITROM)
747 			CSR_WRITE_2(sc, XL_W0_EE_CMD,
748 			    XL_EE_8BIT_READ | EEPROM_8BIT_OFFSET(off + i));
749 		else
750 			CSR_WRITE_2(sc, XL_W0_EE_CMD,
751 			    XL_EE_READ | EEPROM_5BIT_OFFSET(off + i));
752 		err = xl_eeprom_wait(sc);
753 		if (err)
754 			break;
755 		word = CSR_READ_2(sc, XL_W0_EE_DATA);
756 		ptr = (u_int16_t *)(dest + (i * 2));
757 		if (swap)
758 			*ptr = ntohs(word);
759 		else
760 			*ptr = word;
761 	}
762 
763 	return(err ? 1 : 0);
764 }
765 
766 /*
767  * This routine is taken from the 3Com Etherlink XL manual,
768  * page 10-7. It calculates a CRC of the supplied multicast
769  * group address and returns the lower 8 bits, which are used
770  * as the multicast filter position.
771  * Note: the 3c905B currently only supports a 64-bit hash table,
772  * which means we really only need 6 bits, but the manual indicates
773  * that future chip revisions will have a 256-bit hash table,
774  * hence the routine is set up to calculate 8 bits of position
775  * info in case we need it some day.
776  * Note II, The Sequel: _CURRENT_ versions of the 3c905B have a
777  * 256 bit hash table. This means we have to use all 8 bits regardless.
778  * On older cards, the upper 2 bits will be ignored. Grrrr....
779  */
780 static u_int8_t xl_calchash(addr)
781 	caddr_t			addr;
782 {
783 	u_int32_t		crc, carry;
784 	int			i, j;
785 	u_int8_t		c;
786 
787 	/* Compute CRC for the address value. */
788 	crc = 0xFFFFFFFF; /* initial value */
789 
790 	for (i = 0; i < 6; i++) {
791 		c = *(addr + i);
792 		for (j = 0; j < 8; j++) {
793 			carry = ((crc & 0x80000000) ? 1 : 0) ^ (c & 0x01);
794 			crc <<= 1;
795 			c >>= 1;
796 			if (carry)
797 				crc = (crc ^ 0x04c11db6) | carry;
798 		}
799 	}
800 
801 	/* return the filter bit position */
802 	return(crc & 0x000000FF);
803 }
804 
805 /*
806  * NICs older than the 3c905B have only one multicast option, which
807  * is to enable reception of all multicast frames.
808  */
809 static void
810 xl_setmulti(sc)
811 	struct xl_softc		*sc;
812 {
813 	struct ifnet		*ifp;
814 	struct ifmultiaddr	*ifma;
815 	u_int8_t		rxfilt;
816 	int			mcnt = 0;
817 
818 	ifp = &sc->arpcom.ac_if;
819 
820 	XL_SEL_WIN(5);
821 	rxfilt = CSR_READ_1(sc, XL_W5_RX_FILTER);
822 
823 	if (ifp->if_flags & IFF_ALLMULTI) {
824 		rxfilt |= XL_RXFILTER_ALLMULTI;
825 		CSR_WRITE_2(sc, XL_COMMAND, XL_CMD_RX_SET_FILT|rxfilt);
826 		return;
827 	}
828 
829 	for (ifma = ifp->if_multiaddrs.lh_first; ifma != NULL;
830 				ifma = ifma->ifma_link.le_next)
831 		mcnt++;
832 
833 	if (mcnt)
834 		rxfilt |= XL_RXFILTER_ALLMULTI;
835 	else
836 		rxfilt &= ~XL_RXFILTER_ALLMULTI;
837 
838 	CSR_WRITE_2(sc, XL_COMMAND, XL_CMD_RX_SET_FILT|rxfilt);
839 
840 	return;
841 }
842 
843 /*
844  * 3c905B adapters have a hash filter that we can program.
845  */
846 static void
847 xl_setmulti_hash(sc)
848 	struct xl_softc		*sc;
849 {
850 	struct ifnet		*ifp;
851 	int			h = 0, i;
852 	struct ifmultiaddr	*ifma;
853 	u_int8_t		rxfilt;
854 	int			mcnt = 0;
855 
856 	ifp = &sc->arpcom.ac_if;
857 
858 	XL_SEL_WIN(5);
859 	rxfilt = CSR_READ_1(sc, XL_W5_RX_FILTER);
860 
861 	if (ifp->if_flags & IFF_ALLMULTI) {
862 		rxfilt |= XL_RXFILTER_ALLMULTI;
863 		CSR_WRITE_2(sc, XL_COMMAND, XL_CMD_RX_SET_FILT|rxfilt);
864 		return;
865 	} else
866 		rxfilt &= ~XL_RXFILTER_ALLMULTI;
867 
868 
869 	/* first, zot all the existing hash bits */
870 	for (i = 0; i < XL_HASHFILT_SIZE; i++)
871 		CSR_WRITE_2(sc, XL_COMMAND, XL_CMD_RX_SET_HASH|i);
872 
873 	/* now program new ones */
874 	for (ifma = ifp->if_multiaddrs.lh_first; ifma != NULL;
875 				ifma = ifma->ifma_link.le_next) {
876 		if (ifma->ifma_addr->sa_family != AF_LINK)
877 			continue;
878 		h = xl_calchash(LLADDR((struct sockaddr_dl *)ifma->ifma_addr));
879 		CSR_WRITE_2(sc, XL_COMMAND, XL_CMD_RX_SET_HASH|XL_HASH_SET|h);
880 		mcnt++;
881 	}
882 
883 	if (mcnt)
884 		rxfilt |= XL_RXFILTER_MULTIHASH;
885 	else
886 		rxfilt &= ~XL_RXFILTER_MULTIHASH;
887 
888 	CSR_WRITE_2(sc, XL_COMMAND, XL_CMD_RX_SET_FILT|rxfilt);
889 
890 	return;
891 }
892 
893 #ifdef notdef
894 static void
895 xl_testpacket(sc)
896 	struct xl_softc		*sc;
897 {
898 	struct mbuf		*m;
899 	struct ifnet		*ifp;
900 
901 	ifp = &sc->arpcom.ac_if;
902 
903 	MGETHDR(m, M_DONTWAIT, MT_DATA);
904 
905 	if (m == NULL)
906 		return;
907 
908 	bcopy(&sc->arpcom.ac_enaddr,
909 		mtod(m, struct ether_header *)->ether_dhost, ETHER_ADDR_LEN);
910 	bcopy(&sc->arpcom.ac_enaddr,
911 		mtod(m, struct ether_header *)->ether_shost, ETHER_ADDR_LEN);
912 	mtod(m, struct ether_header *)->ether_type = htons(3);
913 	mtod(m, unsigned char *)[14] = 0;
914 	mtod(m, unsigned char *)[15] = 0;
915 	mtod(m, unsigned char *)[16] = 0xE3;
916 	m->m_len = m->m_pkthdr.len = sizeof(struct ether_header) + 3;
917 	IF_ENQUEUE(&ifp->if_snd, m);
918 	xl_start(ifp);
919 
920 	return;
921 }
922 #endif
923 
924 static void
925 xl_setcfg(sc)
926 	struct xl_softc		*sc;
927 {
928 	u_int32_t		icfg;
929 
930 	XL_SEL_WIN(3);
931 	icfg = CSR_READ_4(sc, XL_W3_INTERNAL_CFG);
932 	icfg &= ~XL_ICFG_CONNECTOR_MASK;
933 	if (sc->xl_media & XL_MEDIAOPT_MII ||
934 		sc->xl_media & XL_MEDIAOPT_BT4)
935 		icfg |= (XL_XCVR_MII << XL_ICFG_CONNECTOR_BITS);
936 	if (sc->xl_media & XL_MEDIAOPT_BTX)
937 		icfg |= (XL_XCVR_AUTO << XL_ICFG_CONNECTOR_BITS);
938 
939 	CSR_WRITE_4(sc, XL_W3_INTERNAL_CFG, icfg);
940 	CSR_WRITE_2(sc, XL_COMMAND, XL_CMD_COAX_STOP);
941 
942 	return;
943 }
944 
945 static void
946 xl_setmode(sc, media)
947 	struct xl_softc		*sc;
948 	int			media;
949 {
950 	u_int32_t		icfg;
951 	u_int16_t		mediastat;
952 
953 	printf("xl%d: selecting ", sc->xl_unit);
954 
955 	XL_SEL_WIN(4);
956 	mediastat = CSR_READ_2(sc, XL_W4_MEDIA_STATUS);
957 	XL_SEL_WIN(3);
958 	icfg = CSR_READ_4(sc, XL_W3_INTERNAL_CFG);
959 
960 	if (sc->xl_media & XL_MEDIAOPT_BT) {
961 		if (IFM_SUBTYPE(media) == IFM_10_T) {
962 			printf("10baseT transceiver, ");
963 			sc->xl_xcvr = XL_XCVR_10BT;
964 			icfg &= ~XL_ICFG_CONNECTOR_MASK;
965 			icfg |= (XL_XCVR_10BT << XL_ICFG_CONNECTOR_BITS);
966 			mediastat |= XL_MEDIASTAT_LINKBEAT|
967 					XL_MEDIASTAT_JABGUARD;
968 			mediastat &= ~XL_MEDIASTAT_SQEENB;
969 		}
970 	}
971 
972 	if (sc->xl_media & XL_MEDIAOPT_BFX) {
973 		if (IFM_SUBTYPE(media) == IFM_100_FX) {
974 			printf("100baseFX port, ");
975 			sc->xl_xcvr = XL_XCVR_100BFX;
976 			icfg &= ~XL_ICFG_CONNECTOR_MASK;
977 			icfg |= (XL_XCVR_100BFX << XL_ICFG_CONNECTOR_BITS);
978 			mediastat |= XL_MEDIASTAT_LINKBEAT;
979 			mediastat &= ~XL_MEDIASTAT_SQEENB;
980 		}
981 	}
982 
983 	if (sc->xl_media & (XL_MEDIAOPT_AUI|XL_MEDIAOPT_10FL)) {
984 		if (IFM_SUBTYPE(media) == IFM_10_5) {
985 			printf("AUI port, ");
986 			sc->xl_xcvr = XL_XCVR_AUI;
987 			icfg &= ~XL_ICFG_CONNECTOR_MASK;
988 			icfg |= (XL_XCVR_AUI << XL_ICFG_CONNECTOR_BITS);
989 			mediastat &= ~(XL_MEDIASTAT_LINKBEAT|
990 					XL_MEDIASTAT_JABGUARD);
991 			mediastat |= ~XL_MEDIASTAT_SQEENB;
992 		}
993 		if (IFM_SUBTYPE(media) == IFM_10_FL) {
994 			printf("10baseFL transceiver, ");
995 			sc->xl_xcvr = XL_XCVR_AUI;
996 			icfg &= ~XL_ICFG_CONNECTOR_MASK;
997 			icfg |= (XL_XCVR_AUI << XL_ICFG_CONNECTOR_BITS);
998 			mediastat &= ~(XL_MEDIASTAT_LINKBEAT|
999 					XL_MEDIASTAT_JABGUARD);
1000 			mediastat |= ~XL_MEDIASTAT_SQEENB;
1001 		}
1002 	}
1003 
1004 	if (sc->xl_media & XL_MEDIAOPT_BNC) {
1005 		if (IFM_SUBTYPE(media) == IFM_10_2) {
1006 			printf("BNC port, ");
1007 			sc->xl_xcvr = XL_XCVR_COAX;
1008 			icfg &= ~XL_ICFG_CONNECTOR_MASK;
1009 			icfg |= (XL_XCVR_COAX << XL_ICFG_CONNECTOR_BITS);
1010 			mediastat &= ~(XL_MEDIASTAT_LINKBEAT|
1011 					XL_MEDIASTAT_JABGUARD|
1012 					XL_MEDIASTAT_SQEENB);
1013 		}
1014 	}
1015 
1016 	if ((media & IFM_GMASK) == IFM_FDX ||
1017 			IFM_SUBTYPE(media) == IFM_100_FX) {
1018 		printf("full duplex\n");
1019 		XL_SEL_WIN(3);
1020 		CSR_WRITE_1(sc, XL_W3_MAC_CTRL, XL_MACCTRL_DUPLEX);
1021 	} else {
1022 		printf("half duplex\n");
1023 		XL_SEL_WIN(3);
1024 		CSR_WRITE_1(sc, XL_W3_MAC_CTRL,
1025 			(CSR_READ_1(sc, XL_W3_MAC_CTRL) & ~XL_MACCTRL_DUPLEX));
1026 	}
1027 
1028 	if (IFM_SUBTYPE(media) == IFM_10_2)
1029 		CSR_WRITE_2(sc, XL_COMMAND, XL_CMD_COAX_START);
1030 	else
1031 		CSR_WRITE_2(sc, XL_COMMAND, XL_CMD_COAX_STOP);
1032 	CSR_WRITE_4(sc, XL_W3_INTERNAL_CFG, icfg);
1033 	XL_SEL_WIN(4);
1034 	CSR_WRITE_2(sc, XL_W4_MEDIA_STATUS, mediastat);
1035 	DELAY(800);
1036 	XL_SEL_WIN(7);
1037 
1038 	return;
1039 }
1040 
1041 static void
1042 xl_reset(sc)
1043 	struct xl_softc		*sc;
1044 {
1045 	register int		i;
1046 
1047 	XL_SEL_WIN(0);
1048 	CSR_WRITE_2(sc, XL_COMMAND, XL_CMD_RESET |
1049 		    ((sc->xl_flags & XL_FLAG_WEIRDRESET) ?
1050 		     XL_RESETOPT_DISADVFD:0));
1051 
1052 	for (i = 0; i < XL_TIMEOUT; i++) {
1053 		DELAY(10);
1054 		if (!(CSR_READ_2(sc, XL_STATUS) & XL_STAT_CMDBUSY))
1055 			break;
1056 	}
1057 
1058 	if (i == XL_TIMEOUT)
1059 		printf("xl%d: reset didn't complete\n", sc->xl_unit);
1060 
1061 	/* Reset TX and RX. */
1062 	/* Note: the RX reset takes an absurd amount of time
1063 	 * on newer versions of the Tornado chips such as those
1064 	 * on the 3c905CX and newer 3c908C cards. We wait an
1065 	 * extra amount of time so that xl_wait() doesn't complain
1066 	 * and annoy the users.
1067 	 */
1068 	CSR_WRITE_2(sc, XL_COMMAND, XL_CMD_RX_RESET);
1069 	DELAY(100000);
1070 	xl_wait(sc);
1071 	CSR_WRITE_2(sc, XL_COMMAND, XL_CMD_TX_RESET);
1072 	xl_wait(sc);
1073 
1074 	if (sc->xl_flags & XL_FLAG_INVERT_LED_PWR ||
1075 	    sc->xl_flags & XL_FLAG_INVERT_MII_PWR) {
1076 		XL_SEL_WIN(2);
1077 		CSR_WRITE_2(sc, XL_W2_RESET_OPTIONS, CSR_READ_2(sc,
1078 		    XL_W2_RESET_OPTIONS)
1079 		    | ((sc->xl_flags & XL_FLAG_INVERT_LED_PWR)?XL_RESETOPT_INVERT_LED:0)
1080 		    | ((sc->xl_flags & XL_FLAG_INVERT_MII_PWR)?XL_RESETOPT_INVERT_MII:0)
1081 		    );
1082 	}
1083 
1084 	/* Wait a little while for the chip to get its brains in order. */
1085 	DELAY(100000);
1086         return;
1087 }
1088 
1089 /*
1090  * Probe for a 3Com Etherlink XL chip. Check the PCI vendor and device
1091  * IDs against our list and return a device name if we find a match.
1092  */
1093 static int
1094 xl_probe(dev)
1095 	device_t		dev;
1096 {
1097 	struct xl_type		*t;
1098 
1099 	t = xl_devs;
1100 
1101 	while(t->xl_name != NULL) {
1102 		if ((pci_get_vendor(dev) == t->xl_vid) &&
1103 		    (pci_get_device(dev) == t->xl_did)) {
1104 			device_set_desc(dev, t->xl_name);
1105 			return(0);
1106 		}
1107 		t++;
1108 	}
1109 
1110 	return(ENXIO);
1111 }
1112 
1113 /*
1114  * This routine is a kludge to work around possible hardware faults
1115  * or manufacturing defects that can cause the media options register
1116  * (or reset options register, as it's called for the first generation
1117  * 3c90x adapters) to return an incorrect result. I have encountered
1118  * one Dell Latitude laptop docking station with an integrated 3c905-TX
1119  * which doesn't have any of the 'mediaopt' bits set. This screws up
1120  * the attach routine pretty badly because it doesn't know what media
1121  * to look for. If we find ourselves in this predicament, this routine
1122  * will try to guess the media options values and warn the user of a
1123  * possible manufacturing defect with his adapter/system/whatever.
1124  */
1125 static void
1126 xl_mediacheck(sc)
1127 	struct xl_softc		*sc;
1128 {
1129 
1130 	/*
1131 	 * If some of the media options bits are set, assume they are
1132 	 * correct. If not, try to figure it out down below.
1133 	 * XXX I should check for 10baseFL, but I don't have an adapter
1134 	 * to test with.
1135 	 */
1136 	if (sc->xl_media & (XL_MEDIAOPT_MASK & ~XL_MEDIAOPT_VCO)) {
1137 		/*
1138 	 	 * Check the XCVR value. If it's not in the normal range
1139 	 	 * of values, we need to fake it up here.
1140 	 	 */
1141 		if (sc->xl_xcvr <= XL_XCVR_AUTO)
1142 			return;
1143 		else {
1144 			printf("xl%d: bogus xcvr value "
1145 			"in EEPROM (%x)\n", sc->xl_unit, sc->xl_xcvr);
1146 			printf("xl%d: choosing new default based "
1147 				"on card type\n", sc->xl_unit);
1148 		}
1149 	} else {
1150 		if (sc->xl_type == XL_TYPE_905B &&
1151 		    sc->xl_media & XL_MEDIAOPT_10FL)
1152 			return;
1153 		printf("xl%d: WARNING: no media options bits set in "
1154 			"the media options register!!\n", sc->xl_unit);
1155 		printf("xl%d: this could be a manufacturing defect in "
1156 			"your adapter or system\n", sc->xl_unit);
1157 		printf("xl%d: attempting to guess media type; you "
1158 			"should probably consult your vendor\n", sc->xl_unit);
1159 	}
1160 
1161 	xl_choose_xcvr(sc, 1);
1162 
1163 	return;
1164 }
1165 
1166 static void
1167 xl_choose_xcvr(sc, verbose)
1168 	struct xl_softc		*sc;
1169 	int			verbose;
1170 {
1171 	u_int16_t		devid;
1172 
1173 	/*
1174 	 * Read the device ID from the EEPROM.
1175 	 * This is what's loaded into the PCI device ID register, so it has
1176 	 * to be correct otherwise we wouldn't have gotten this far.
1177 	 */
1178 	xl_read_eeprom(sc, (caddr_t)&devid, XL_EE_PRODID, 1, 0);
1179 
1180 	switch(devid) {
1181 	case TC_DEVICEID_BOOMERANG_10BT:	/* 3c900-TPO */
1182 	case TC_DEVICEID_KRAKATOA_10BT:		/* 3c900B-TPO */
1183 		sc->xl_media = XL_MEDIAOPT_BT;
1184 		sc->xl_xcvr = XL_XCVR_10BT;
1185 		if (verbose)
1186 			printf("xl%d: guessing 10BaseT "
1187 			    "transceiver\n", sc->xl_unit);
1188 		break;
1189 	case TC_DEVICEID_BOOMERANG_10BT_COMBO:	/* 3c900-COMBO */
1190 	case TC_DEVICEID_KRAKATOA_10BT_COMBO:	/* 3c900B-COMBO */
1191 		sc->xl_media = XL_MEDIAOPT_BT|XL_MEDIAOPT_BNC|XL_MEDIAOPT_AUI;
1192 		sc->xl_xcvr = XL_XCVR_10BT;
1193 		if (verbose)
1194 			printf("xl%d: guessing COMBO "
1195 			    "(AUI/BNC/TP)\n", sc->xl_unit);
1196 		break;
1197 	case TC_DEVICEID_KRAKATOA_10BT_TPC:	/* 3c900B-TPC */
1198 		sc->xl_media = XL_MEDIAOPT_BT|XL_MEDIAOPT_BNC;
1199 		sc->xl_xcvr = XL_XCVR_10BT;
1200 		if (verbose)
1201 			printf("xl%d: guessing TPC (BNC/TP)\n", sc->xl_unit);
1202 		break;
1203 	case TC_DEVICEID_CYCLONE_10FL:		/* 3c900B-FL */
1204 		sc->xl_media = XL_MEDIAOPT_10FL;
1205 		sc->xl_xcvr = XL_XCVR_AUI;
1206 		if (verbose)
1207 			printf("xl%d: guessing 10baseFL\n", sc->xl_unit);
1208 		break;
1209 	case TC_DEVICEID_BOOMERANG_10_100BT:	/* 3c905-TX */
1210 	case TC_DEVICEID_HURRICANE_555:		/* 3c555 */
1211 	case TC_DEVICEID_HURRICANE_556:		/* 3c556 */
1212 	case TC_DEVICEID_HURRICANE_556B:	/* 3c556B */
1213 	case TC_DEVICEID_HURRICANE_575A:	/* 3c575TX */
1214 	case TC_DEVICEID_HURRICANE_575B:	/* 3c575B */
1215 	case TC_DEVICEID_HURRICANE_575C:	/* 3c575C */
1216 	case TC_DEVICEID_HURRICANE_656:		/* 3c656 */
1217 	case TC_DEVICEID_HURRICANE_656B:	/* 3c656B */
1218 	case TC_DEVICEID_TORNADO_656C:		/* 3c656C */
1219 	case TC_DEVICEID_TORNADO_10_100BT_920B:	/* 3c920B-EMB */
1220 		sc->xl_media = XL_MEDIAOPT_MII;
1221 		sc->xl_xcvr = XL_XCVR_MII;
1222 		if (verbose)
1223 			printf("xl%d: guessing MII\n", sc->xl_unit);
1224 		break;
1225 	case TC_DEVICEID_BOOMERANG_100BT4:	/* 3c905-T4 */
1226 	case TC_DEVICEID_CYCLONE_10_100BT4:	/* 3c905B-T4 */
1227 		sc->xl_media = XL_MEDIAOPT_BT4;
1228 		sc->xl_xcvr = XL_XCVR_MII;
1229 		if (verbose)
1230 			printf("xl%d: guessing 100BaseT4/MII\n", sc->xl_unit);
1231 		break;
1232 	case TC_DEVICEID_HURRICANE_10_100BT:	/* 3c905B-TX */
1233 	case TC_DEVICEID_HURRICANE_10_100BT_SERV:/*3c980-TX */
1234 	case TC_DEVICEID_TORNADO_10_100BT_SERV:	/* 3c980C-TX */
1235 	case TC_DEVICEID_HURRICANE_SOHO100TX:	/* 3cSOHO100-TX */
1236 	case TC_DEVICEID_TORNADO_10_100BT:	/* 3c905C-TX */
1237 	case TC_DEVICEID_TORNADO_HOMECONNECT:	/* 3c450-TX */
1238 		sc->xl_media = XL_MEDIAOPT_BTX;
1239 		sc->xl_xcvr = XL_XCVR_AUTO;
1240 		if (verbose)
1241 			printf("xl%d: guessing 10/100 internal\n", sc->xl_unit);
1242 		break;
1243 	case TC_DEVICEID_CYCLONE_10_100_COMBO:	/* 3c905B-COMBO */
1244 		sc->xl_media = XL_MEDIAOPT_BTX|XL_MEDIAOPT_BNC|XL_MEDIAOPT_AUI;
1245 		sc->xl_xcvr = XL_XCVR_AUTO;
1246 		if (verbose)
1247 			printf("xl%d: guessing 10/100 "
1248 			    "plus BNC/AUI\n", sc->xl_unit);
1249 		break;
1250 	default:
1251 		printf("xl%d: unknown device ID: %x -- "
1252 			"defaulting to 10baseT\n", sc->xl_unit, devid);
1253 		sc->xl_media = XL_MEDIAOPT_BT;
1254 		break;
1255 	}
1256 
1257 	return;
1258 }
1259 
1260 /*
1261  * Attach the interface. Allocate softc structures, do ifmedia
1262  * setup and ethernet/BPF attach.
1263  */
1264 static int
1265 xl_attach(dev)
1266 	device_t		dev;
1267 {
1268 	int			s;
1269 	u_char			eaddr[ETHER_ADDR_LEN];
1270 	u_int32_t		command;
1271 	struct xl_softc		*sc;
1272 	struct ifnet		*ifp;
1273 	int			media = IFM_ETHER|IFM_100_TX|IFM_FDX;
1274 	int			unit, error = 0, rid;
1275 
1276 	s = splimp();
1277 
1278 	sc = device_get_softc(dev);
1279 	unit = device_get_unit(dev);
1280 
1281 	sc->xl_flags = 0;
1282 	if (pci_get_device(dev) == TC_DEVICEID_HURRICANE_555)
1283 		sc->xl_flags |= XL_FLAG_EEPROM_OFFSET_30 | XL_FLAG_PHYOK;
1284 	if (pci_get_device(dev) == TC_DEVICEID_HURRICANE_556 ||
1285 	    pci_get_device(dev) == TC_DEVICEID_HURRICANE_556B)
1286 		sc->xl_flags |= XL_FLAG_FUNCREG | XL_FLAG_PHYOK |
1287 		    XL_FLAG_EEPROM_OFFSET_30 | XL_FLAG_WEIRDRESET |
1288 		    XL_FLAG_INVERT_LED_PWR | XL_FLAG_INVERT_MII_PWR;
1289 	if (pci_get_device(dev) == TC_DEVICEID_HURRICANE_555 ||
1290 	    pci_get_device(dev) == TC_DEVICEID_HURRICANE_556)
1291 		sc->xl_flags |= XL_FLAG_8BITROM;
1292 	if (pci_get_device(dev) == TC_DEVICEID_HURRICANE_556B)
1293 		sc->xl_flags |= XL_FLAG_NO_XCVR_PWR;
1294 
1295 	if (pci_get_device(dev) == TC_DEVICEID_HURRICANE_575A ||
1296 	    pci_get_device(dev) == TC_DEVICEID_HURRICANE_575B ||
1297 	    pci_get_device(dev) == TC_DEVICEID_HURRICANE_575C ||
1298 	    pci_get_device(dev) == TC_DEVICEID_HURRICANE_656B ||
1299 	    pci_get_device(dev) == TC_DEVICEID_TORNADO_656C)
1300 		sc->xl_flags |= XL_FLAG_FUNCREG | XL_FLAG_PHYOK |
1301 		    XL_FLAG_EEPROM_OFFSET_30 | XL_FLAG_8BITROM;
1302 	if (pci_get_device(dev) == TC_DEVICEID_HURRICANE_656)
1303 		sc->xl_flags |= XL_FLAG_FUNCREG | XL_FLAG_PHYOK;
1304 	if (pci_get_device(dev) == TC_DEVICEID_HURRICANE_575B)
1305 		sc->xl_flags |= XL_FLAG_INVERT_LED_PWR;
1306 	if (pci_get_device(dev) == TC_DEVICEID_HURRICANE_575C)
1307 		sc->xl_flags |= XL_FLAG_INVERT_MII_PWR;
1308 	if (pci_get_device(dev) == TC_DEVICEID_TORNADO_656C)
1309 		sc->xl_flags |= XL_FLAG_INVERT_MII_PWR;
1310 	if (pci_get_device(dev) == TC_DEVICEID_HURRICANE_656 ||
1311 	    pci_get_device(dev) == TC_DEVICEID_HURRICANE_656B)
1312 		sc->xl_flags |= XL_FLAG_INVERT_MII_PWR |
1313 		    XL_FLAG_INVERT_LED_PWR;
1314 	if (pci_get_device(dev) == TC_DEVICEID_TORNADO_10_100BT_920B)
1315 		sc->xl_flags |= XL_FLAG_PHYOK;
1316 
1317 	/*
1318 	 * If this is a 3c905B, we have to check one extra thing.
1319 	 * The 905B supports power management and may be placed in
1320 	 * a low-power mode (D3 mode), typically by certain operating
1321 	 * systems which shall not be named. The PCI BIOS is supposed
1322 	 * to reset the NIC and bring it out of low-power mode, but
1323 	 * some do not. Consequently, we have to see if this chip
1324 	 * supports power management, and if so, make sure it's not
1325 	 * in low-power mode. If power management is available, the
1326 	 * capid byte will be 0x01.
1327 	 *
1328 	 * I _think_ that what actually happens is that the chip
1329 	 * loses its PCI configuration during the transition from
1330 	 * D3 back to D0; this means that it should be possible for
1331 	 * us to save the PCI iobase, membase and IRQ, put the chip
1332 	 * back in the D0 state, then restore the PCI config ourselves.
1333 	 */
1334 
1335 	if (pci_get_powerstate(dev) != PCI_POWERSTATE_D0) {
1336 		u_int32_t		iobase, membase, irq;
1337 
1338 		/* Save important PCI config data. */
1339 		iobase = pci_read_config(dev, XL_PCI_LOIO, 4);
1340 		membase = pci_read_config(dev, XL_PCI_LOMEM, 4);
1341 		irq = pci_read_config(dev, XL_PCI_INTLINE, 4);
1342 
1343 		/* Reset the power state. */
1344 		printf("xl%d: chip is in D%d power mode "
1345 		    "-- setting to D0\n", unit,
1346 		    pci_get_powerstate(dev));
1347 
1348 		pci_set_powerstate(dev, PCI_POWERSTATE_D0);
1349 
1350 		/* Restore PCI config data. */
1351 		pci_write_config(dev, XL_PCI_LOIO, iobase, 4);
1352 		pci_write_config(dev, XL_PCI_LOMEM, membase, 4);
1353 		pci_write_config(dev, XL_PCI_INTLINE, irq, 4);
1354 	}
1355 
1356 	/*
1357 	 * Map control/status registers.
1358 	 */
1359 	pci_enable_busmaster(dev);
1360 	pci_enable_io(dev, SYS_RES_IOPORT);
1361 	pci_enable_io(dev, SYS_RES_MEMORY);
1362 	command = pci_read_config(dev, PCIR_COMMAND, 4);
1363 
1364 #ifdef XL_USEIOSPACE
1365 	if (!(command & PCIM_CMD_PORTEN)) {
1366 		printf("xl%d: failed to enable I/O ports!\n", unit);
1367 		error = ENXIO;
1368 		goto fail;
1369 	}
1370 #else
1371 	if (!(command & PCIM_CMD_MEMEN)) {
1372 		printf("xl%d: failed to enable memory mapping!\n", unit);
1373 		error = ENXIO;
1374 		goto fail;
1375 	}
1376 #endif
1377 
1378 	rid = XL_RID;
1379 	sc->xl_res = bus_alloc_resource(dev, XL_RES, &rid,
1380 	    0, ~0, 1, RF_ACTIVE);
1381 
1382 	if (sc->xl_res == NULL) {
1383 		printf ("xl%d: couldn't map ports/memory\n", unit);
1384 		error = ENXIO;
1385 		goto fail;
1386 	}
1387 
1388 	sc->xl_btag = rman_get_bustag(sc->xl_res);
1389 	sc->xl_bhandle = rman_get_bushandle(sc->xl_res);
1390 
1391 	if (sc->xl_flags & XL_FLAG_FUNCREG) {
1392 		rid = XL_PCI_FUNCMEM;
1393 		sc->xl_fres = bus_alloc_resource(dev, SYS_RES_MEMORY, &rid,
1394 		    0, ~0, 1, RF_ACTIVE);
1395 
1396 		if (sc->xl_fres == NULL) {
1397 			printf ("xl%d: couldn't map ports/memory\n", unit);
1398 			bus_release_resource(dev, XL_RES, XL_RID, sc->xl_res);
1399 			error = ENXIO;
1400 			goto fail;
1401 		}
1402 
1403 		sc->xl_ftag = rman_get_bustag(sc->xl_fres);
1404 		sc->xl_fhandle = rman_get_bushandle(sc->xl_fres);
1405 	}
1406 
1407 	rid = 0;
1408 	sc->xl_irq = bus_alloc_resource(dev, SYS_RES_IRQ, &rid, 0, ~0, 1,
1409 	    RF_SHAREABLE | RF_ACTIVE);
1410 
1411 	if (sc->xl_irq == NULL) {
1412 		printf("xl%d: couldn't map interrupt\n", unit);
1413 		if (sc->xl_fres != NULL)
1414 			bus_release_resource(dev, SYS_RES_MEMORY,
1415 			    XL_PCI_FUNCMEM, sc->xl_fres);
1416 		bus_release_resource(dev, XL_RES, XL_RID, sc->xl_res);
1417 		error = ENXIO;
1418 		goto fail;
1419 	}
1420 
1421 	error = bus_setup_intr(dev, sc->xl_irq, INTR_TYPE_NET,
1422 	    xl_intr, sc, &sc->xl_intrhand);
1423 
1424 	if (error) {
1425 		bus_release_resource(dev, SYS_RES_IRQ, 0, sc->xl_irq);
1426 		if (sc->xl_fres != NULL)
1427 			bus_release_resource(dev, SYS_RES_MEMORY,
1428 			    XL_PCI_FUNCMEM, sc->xl_fres);
1429 		bus_release_resource(dev, XL_RES, XL_RID, sc->xl_res);
1430 		printf("xl%d: couldn't set up irq\n", unit);
1431 		goto fail;
1432 	}
1433 
1434 	/* Reset the adapter. */
1435 	xl_reset(sc);
1436 
1437 	/*
1438 	 * Get station address from the EEPROM.
1439 	 */
1440 	if (xl_read_eeprom(sc, (caddr_t)&eaddr, XL_EE_OEM_ADR0, 3, 1)) {
1441 		printf("xl%d: failed to read station address\n", sc->xl_unit);
1442 		bus_teardown_intr(dev, sc->xl_irq, sc->xl_intrhand);
1443 		bus_release_resource(dev, SYS_RES_IRQ, 0, sc->xl_irq);
1444 		if (sc->xl_fres != NULL)
1445 			bus_release_resource(dev, SYS_RES_MEMORY,
1446 			    XL_PCI_FUNCMEM, sc->xl_fres);
1447 		bus_release_resource(dev, XL_RES, XL_RID, sc->xl_res);
1448 		error = ENXIO;
1449 		goto fail;
1450 	}
1451 
1452 	/*
1453 	 * A 3Com chip was detected. Inform the world.
1454 	 */
1455 	printf("xl%d: Ethernet address: %6D\n", unit, eaddr, ":");
1456 
1457 	sc->xl_unit = unit;
1458 	callout_handle_init(&sc->xl_stat_ch);
1459 	bcopy(eaddr, (char *)&sc->arpcom.ac_enaddr, ETHER_ADDR_LEN);
1460 
1461 	sc->xl_ldata = contigmalloc(sizeof(struct xl_list_data), M_DEVBUF,
1462 	    M_NOWAIT, 0, 0xffffffff, PAGE_SIZE, 0);
1463 
1464 	if (sc->xl_ldata == NULL) {
1465 		printf("xl%d: no memory for list buffers!\n", unit);
1466 		bus_teardown_intr(dev, sc->xl_irq, sc->xl_intrhand);
1467 		bus_release_resource(dev, SYS_RES_IRQ, 0, sc->xl_irq);
1468 		if (sc->xl_fres != NULL)
1469 			bus_release_resource(dev, SYS_RES_MEMORY,
1470 			    XL_PCI_FUNCMEM, sc->xl_fres);
1471 		bus_release_resource(dev, XL_RES, XL_RID, sc->xl_res);
1472 		error = ENXIO;
1473 		goto fail;
1474 	}
1475 
1476 	bzero(sc->xl_ldata, sizeof(struct xl_list_data));
1477 
1478 	/*
1479 	 * Figure out the card type. 3c905B adapters have the
1480 	 * 'supportsNoTxLength' bit set in the capabilities
1481 	 * word in the EEPROM.
1482 	 */
1483 	xl_read_eeprom(sc, (caddr_t)&sc->xl_caps, XL_EE_CAPS, 1, 0);
1484 	if (sc->xl_caps & XL_CAPS_NO_TXLENGTH)
1485 		sc->xl_type = XL_TYPE_905B;
1486 	else
1487 		sc->xl_type = XL_TYPE_90X;
1488 
1489 	ifp = &sc->arpcom.ac_if;
1490 	ifp->if_softc = sc;
1491 	ifp->if_unit = unit;
1492 	ifp->if_name = "xl";
1493 	ifp->if_mtu = ETHERMTU;
1494 	ifp->if_flags = IFF_BROADCAST | IFF_SIMPLEX | IFF_MULTICAST;
1495 	ifp->if_ioctl = xl_ioctl;
1496 	ifp->if_output = ether_output;
1497 	if (sc->xl_type == XL_TYPE_905B) {
1498 		ifp->if_start = xl_start_90xB;
1499 		ifp->if_hwassist = XL905B_CSUM_FEATURES;
1500 		ifp->if_capabilities = IFCAP_HWCSUM;
1501 	} else
1502 		ifp->if_start = xl_start;
1503 	ifp->if_watchdog = xl_watchdog;
1504 	ifp->if_init = xl_init;
1505 	ifp->if_baudrate = 10000000;
1506 	ifp->if_snd.ifq_maxlen = XL_TX_LIST_CNT - 1;
1507 	ifp->if_capenable = ifp->if_capabilities;
1508 
1509 	/*
1510 	 * Now we have to see what sort of media we have.
1511 	 * This includes probing for an MII interace and a
1512 	 * possible PHY.
1513 	 */
1514 	XL_SEL_WIN(3);
1515 	sc->xl_media = CSR_READ_2(sc, XL_W3_MEDIA_OPT);
1516 	if (bootverbose)
1517 		printf("xl%d: media options word: %x\n", sc->xl_unit,
1518 							 sc->xl_media);
1519 
1520 	xl_read_eeprom(sc, (char *)&sc->xl_xcvr, XL_EE_ICFG_0, 2, 0);
1521 	sc->xl_xcvr &= XL_ICFG_CONNECTOR_MASK;
1522 	sc->xl_xcvr >>= XL_ICFG_CONNECTOR_BITS;
1523 
1524 	xl_mediacheck(sc);
1525 
1526 	if (sc->xl_media & XL_MEDIAOPT_MII || sc->xl_media & XL_MEDIAOPT_BTX
1527 			|| sc->xl_media & XL_MEDIAOPT_BT4) {
1528 		if (bootverbose)
1529 			printf("xl%d: found MII/AUTO\n", sc->xl_unit);
1530 		xl_setcfg(sc);
1531 		if (mii_phy_probe(dev, &sc->xl_miibus,
1532 		    xl_ifmedia_upd, xl_ifmedia_sts)) {
1533 			printf("xl%d: no PHY found!\n", sc->xl_unit);
1534 			bus_teardown_intr(dev, sc->xl_irq, sc->xl_intrhand);
1535 			bus_release_resource(dev, SYS_RES_IRQ, 0, sc->xl_irq);
1536 			bus_release_resource(dev, XL_RES, XL_RID, sc->xl_res);
1537 			contigfree(sc->xl_ldata,
1538 			    sizeof(struct xl_list_data), M_DEVBUF);
1539 			error = ENXIO;
1540 			goto fail;
1541 		}
1542 
1543 		goto done;
1544 	}
1545 
1546 	/*
1547 	 * Sanity check. If the user has selected "auto" and this isn't
1548 	 * a 10/100 card of some kind, we need to force the transceiver
1549 	 * type to something sane.
1550 	 */
1551 	if (sc->xl_xcvr == XL_XCVR_AUTO)
1552 		xl_choose_xcvr(sc, bootverbose);
1553 
1554 	/*
1555 	 * Do ifmedia setup.
1556 	 */
1557 
1558 	ifmedia_init(&sc->ifmedia, 0, xl_ifmedia_upd, xl_ifmedia_sts);
1559 
1560 	if (sc->xl_media & XL_MEDIAOPT_BT) {
1561 		if (bootverbose)
1562 			printf("xl%d: found 10baseT\n", sc->xl_unit);
1563 		ifmedia_add(&sc->ifmedia, IFM_ETHER|IFM_10_T, 0, NULL);
1564 		ifmedia_add(&sc->ifmedia, IFM_ETHER|IFM_10_T|IFM_HDX, 0, NULL);
1565 		if (sc->xl_caps & XL_CAPS_FULL_DUPLEX)
1566 			ifmedia_add(&sc->ifmedia,
1567 			    IFM_ETHER|IFM_10_T|IFM_FDX, 0, NULL);
1568 	}
1569 
1570 	if (sc->xl_media & (XL_MEDIAOPT_AUI|XL_MEDIAOPT_10FL)) {
1571 		/*
1572 		 * Check for a 10baseFL board in disguise.
1573 		 */
1574 		if (sc->xl_type == XL_TYPE_905B &&
1575 		    sc->xl_media == XL_MEDIAOPT_10FL) {
1576 			if (bootverbose)
1577 				printf("xl%d: found 10baseFL\n", sc->xl_unit);
1578 			ifmedia_add(&sc->ifmedia, IFM_ETHER|IFM_10_FL, 0, NULL);
1579 			ifmedia_add(&sc->ifmedia, IFM_ETHER|IFM_10_FL|IFM_HDX,
1580 			    0, NULL);
1581 			if (sc->xl_caps & XL_CAPS_FULL_DUPLEX)
1582 				ifmedia_add(&sc->ifmedia,
1583 				    IFM_ETHER|IFM_10_FL|IFM_FDX, 0, NULL);
1584 		} else {
1585 			if (bootverbose)
1586 				printf("xl%d: found AUI\n", sc->xl_unit);
1587 			ifmedia_add(&sc->ifmedia, IFM_ETHER|IFM_10_5, 0, NULL);
1588 		}
1589 	}
1590 
1591 	if (sc->xl_media & XL_MEDIAOPT_BNC) {
1592 		if (bootverbose)
1593 			printf("xl%d: found BNC\n", sc->xl_unit);
1594 		ifmedia_add(&sc->ifmedia, IFM_ETHER|IFM_10_2, 0, NULL);
1595 	}
1596 
1597 	if (sc->xl_media & XL_MEDIAOPT_BFX) {
1598 		if (bootverbose)
1599 			printf("xl%d: found 100baseFX\n", sc->xl_unit);
1600 		ifp->if_baudrate = 100000000;
1601 		ifmedia_add(&sc->ifmedia, IFM_ETHER|IFM_100_FX, 0, NULL);
1602 	}
1603 
1604 	/* Choose a default media. */
1605 	switch(sc->xl_xcvr) {
1606 	case XL_XCVR_10BT:
1607 		media = IFM_ETHER|IFM_10_T;
1608 		xl_setmode(sc, media);
1609 		break;
1610 	case XL_XCVR_AUI:
1611 		if (sc->xl_type == XL_TYPE_905B &&
1612 		    sc->xl_media == XL_MEDIAOPT_10FL) {
1613 			media = IFM_ETHER|IFM_10_FL;
1614 			xl_setmode(sc, media);
1615 		} else {
1616 			media = IFM_ETHER|IFM_10_5;
1617 			xl_setmode(sc, media);
1618 		}
1619 		break;
1620 	case XL_XCVR_COAX:
1621 		media = IFM_ETHER|IFM_10_2;
1622 		xl_setmode(sc, media);
1623 		break;
1624 	case XL_XCVR_AUTO:
1625 	case XL_XCVR_100BTX:
1626 	case XL_XCVR_MII:
1627 		/* Chosen by miibus */
1628 		break;
1629 	case XL_XCVR_100BFX:
1630 		media = IFM_ETHER|IFM_100_FX;
1631 		break;
1632 	default:
1633 		printf("xl%d: unknown XCVR type: %d\n", sc->xl_unit,
1634 							sc->xl_xcvr);
1635 		/*
1636 		 * This will probably be wrong, but it prevents
1637 	 	 * the ifmedia code from panicking.
1638 		 */
1639 		media = IFM_ETHER|IFM_10_T;
1640 		break;
1641 	}
1642 
1643 	if (sc->xl_miibus == NULL)
1644 		ifmedia_set(&sc->ifmedia, media);
1645 
1646 done:
1647 
1648 	if (sc->xl_flags & XL_FLAG_NO_XCVR_PWR) {
1649 		XL_SEL_WIN(0);
1650 		CSR_WRITE_2(sc, XL_W0_MFG_ID, XL_NO_XCVR_PWR_MAGICBITS);
1651 	}
1652 
1653 	/*
1654 	 * Call MI attach routine.
1655 	 */
1656 	ether_ifattach(ifp, ETHER_BPF_SUPPORTED);
1657 
1658 fail:
1659 	splx(s);
1660 	return(error);
1661 }
1662 
1663 static int
1664 xl_detach(dev)
1665 	device_t		dev;
1666 {
1667 	struct xl_softc		*sc;
1668 	struct ifnet		*ifp;
1669 	int			s;
1670 
1671 	s = splimp();
1672 
1673 	sc = device_get_softc(dev);
1674 	ifp = &sc->arpcom.ac_if;
1675 
1676 	xl_reset(sc);
1677 	xl_stop(sc);
1678 	ether_ifdetach(ifp, ETHER_BPF_SUPPORTED);
1679 
1680 	/* Delete any miibus and phy devices attached to this interface */
1681 	if (sc->xl_miibus != NULL) {
1682 		bus_generic_detach(dev);
1683 		device_delete_child(dev, sc->xl_miibus);
1684 	}
1685 
1686 	bus_teardown_intr(dev, sc->xl_irq, sc->xl_intrhand);
1687 	bus_release_resource(dev, SYS_RES_IRQ, 0, sc->xl_irq);
1688 	if (sc->xl_fres != NULL)
1689 		bus_release_resource(dev, SYS_RES_MEMORY,
1690 		    XL_PCI_FUNCMEM, sc->xl_fres);
1691 	bus_release_resource(dev, XL_RES, XL_RID, sc->xl_res);
1692 
1693 	ifmedia_removeall(&sc->ifmedia);
1694 	contigfree(sc->xl_ldata, sizeof(struct xl_list_data), M_DEVBUF);
1695 
1696 	splx(s);
1697 
1698 	return(0);
1699 }
1700 
1701 /*
1702  * Initialize the transmit descriptors.
1703  */
1704 static int
1705 xl_list_tx_init(sc)
1706 	struct xl_softc		*sc;
1707 {
1708 	struct xl_chain_data	*cd;
1709 	struct xl_list_data	*ld;
1710 	int			i;
1711 
1712 	cd = &sc->xl_cdata;
1713 	ld = sc->xl_ldata;
1714 	for (i = 0; i < XL_TX_LIST_CNT; i++) {
1715 		cd->xl_tx_chain[i].xl_ptr = &ld->xl_tx_list[i];
1716 		if (i == (XL_TX_LIST_CNT - 1))
1717 			cd->xl_tx_chain[i].xl_next = NULL;
1718 		else
1719 			cd->xl_tx_chain[i].xl_next = &cd->xl_tx_chain[i + 1];
1720 	}
1721 
1722 	cd->xl_tx_free = &cd->xl_tx_chain[0];
1723 	cd->xl_tx_tail = cd->xl_tx_head = NULL;
1724 
1725 	return(0);
1726 }
1727 
1728 /*
1729  * Initialize the transmit descriptors.
1730  */
1731 static int xl_list_tx_init_90xB(sc)
1732 	struct xl_softc		*sc;
1733 {
1734 	struct xl_chain_data	*cd;
1735 	struct xl_list_data	*ld;
1736 	int			i;
1737 
1738 	cd = &sc->xl_cdata;
1739 	ld = sc->xl_ldata;
1740 	for (i = 0; i < XL_TX_LIST_CNT; i++) {
1741 		cd->xl_tx_chain[i].xl_ptr = &ld->xl_tx_list[i];
1742 		cd->xl_tx_chain[i].xl_phys = vtophys(&ld->xl_tx_list[i]);
1743 		if (i == (XL_TX_LIST_CNT - 1))
1744 			cd->xl_tx_chain[i].xl_next = &cd->xl_tx_chain[0];
1745 		else
1746 			cd->xl_tx_chain[i].xl_next = &cd->xl_tx_chain[i + 1];
1747 		if (i == 0)
1748 			cd->xl_tx_chain[i].xl_prev =
1749 			    &cd->xl_tx_chain[XL_TX_LIST_CNT - 1];
1750 		else
1751 			cd->xl_tx_chain[i].xl_prev =
1752 			    &cd->xl_tx_chain[i - 1];
1753 	}
1754 
1755 	bzero((char *)ld->xl_tx_list,
1756 	    sizeof(struct xl_list) * XL_TX_LIST_CNT);
1757 	ld->xl_tx_list[0].xl_status = XL_TXSTAT_EMPTY;
1758 
1759 	cd->xl_tx_prod = 1;
1760 	cd->xl_tx_cons = 1;
1761 	cd->xl_tx_cnt = 0;
1762 
1763 	return(0);
1764 }
1765 
1766 /*
1767  * Initialize the RX descriptors and allocate mbufs for them. Note that
1768  * we arrange the descriptors in a closed ring, so that the last descriptor
1769  * points back to the first.
1770  */
1771 static int
1772 xl_list_rx_init(sc)
1773 	struct xl_softc		*sc;
1774 {
1775 	struct xl_chain_data	*cd;
1776 	struct xl_list_data	*ld;
1777 	int			i;
1778 
1779 	cd = &sc->xl_cdata;
1780 	ld = sc->xl_ldata;
1781 
1782 	for (i = 0; i < XL_RX_LIST_CNT; i++) {
1783 		cd->xl_rx_chain[i].xl_ptr =
1784 			(struct xl_list_onefrag *)&ld->xl_rx_list[i];
1785 		if (xl_newbuf(sc, &cd->xl_rx_chain[i]) == ENOBUFS)
1786 			return(ENOBUFS);
1787 		if (i == (XL_RX_LIST_CNT - 1)) {
1788 			cd->xl_rx_chain[i].xl_next = &cd->xl_rx_chain[0];
1789 			ld->xl_rx_list[i].xl_next =
1790 			    vtophys(&ld->xl_rx_list[0]);
1791 		} else {
1792 			cd->xl_rx_chain[i].xl_next = &cd->xl_rx_chain[i + 1];
1793 			ld->xl_rx_list[i].xl_next =
1794 			    vtophys(&ld->xl_rx_list[i + 1]);
1795 		}
1796 	}
1797 
1798 	cd->xl_rx_head = &cd->xl_rx_chain[0];
1799 
1800 	return(0);
1801 }
1802 
1803 /*
1804  * Initialize an RX descriptor and attach an MBUF cluster.
1805  */
1806 static int
1807 xl_newbuf(sc, c)
1808 	struct xl_softc		*sc;
1809 	struct xl_chain_onefrag	*c;
1810 {
1811 	struct mbuf		*m_new = NULL;
1812 
1813 	MGETHDR(m_new, M_DONTWAIT, MT_DATA);
1814 	if (m_new == NULL)
1815 		return(ENOBUFS);
1816 
1817 	MCLGET(m_new, M_DONTWAIT);
1818 	if (!(m_new->m_flags & M_EXT)) {
1819 		m_freem(m_new);
1820 		return(ENOBUFS);
1821 	}
1822 
1823 	m_new->m_len = m_new->m_pkthdr.len = MCLBYTES;
1824 
1825 	/* Force longword alignment for packet payload. */
1826 	m_adj(m_new, ETHER_ALIGN);
1827 
1828 	c->xl_mbuf = m_new;
1829 	c->xl_ptr->xl_frag.xl_addr = vtophys(mtod(m_new, caddr_t));
1830 	c->xl_ptr->xl_frag.xl_len = MCLBYTES | XL_LAST_FRAG;
1831 	c->xl_ptr->xl_status = 0;
1832 
1833 	return(0);
1834 }
1835 
1836 static int
1837 xl_rx_resync(sc)
1838 	struct xl_softc		*sc;
1839 {
1840 	struct xl_chain_onefrag	*pos;
1841 	int			i;
1842 
1843 	pos = sc->xl_cdata.xl_rx_head;
1844 
1845 	for (i = 0; i < XL_RX_LIST_CNT; i++) {
1846 		if (pos->xl_ptr->xl_status)
1847 			break;
1848 		pos = pos->xl_next;
1849 	}
1850 
1851 	if (i == XL_RX_LIST_CNT)
1852 		return(0);
1853 
1854 	sc->xl_cdata.xl_rx_head = pos;
1855 
1856 	return(EAGAIN);
1857 }
1858 
1859 /*
1860  * A frame has been uploaded: pass the resulting mbuf chain up to
1861  * the higher level protocols.
1862  */
1863 static void
1864 xl_rxeof(sc)
1865 	struct xl_softc		*sc;
1866 {
1867         struct ether_header	*eh;
1868         struct mbuf		*m;
1869         struct ifnet		*ifp;
1870 	struct xl_chain_onefrag	*cur_rx;
1871 	int			total_len = 0;
1872 	u_int32_t		rxstat;
1873 
1874 	ifp = &sc->arpcom.ac_if;
1875 
1876 again:
1877 
1878 	while((rxstat = sc->xl_cdata.xl_rx_head->xl_ptr->xl_status)) {
1879 		cur_rx = sc->xl_cdata.xl_rx_head;
1880 		sc->xl_cdata.xl_rx_head = cur_rx->xl_next;
1881 
1882 		/*
1883 		 * If an error occurs, update stats, clear the
1884 		 * status word and leave the mbuf cluster in place:
1885 		 * it should simply get re-used next time this descriptor
1886 	 	 * comes up in the ring.
1887 		 */
1888 		if (rxstat & XL_RXSTAT_UP_ERROR) {
1889 			ifp->if_ierrors++;
1890 			cur_rx->xl_ptr->xl_status = 0;
1891 			continue;
1892 		}
1893 
1894 		/*
1895 		 * If there error bit was not set, the upload complete
1896 		 * bit should be set which means we have a valid packet.
1897 		 * If not, something truly strange has happened.
1898 		 */
1899 		if (!(rxstat & XL_RXSTAT_UP_CMPLT)) {
1900 			printf("xl%d: bad receive status -- "
1901 			    "packet dropped", sc->xl_unit);
1902 			ifp->if_ierrors++;
1903 			cur_rx->xl_ptr->xl_status = 0;
1904 			continue;
1905 		}
1906 
1907 		/* No errors; receive the packet. */
1908 		m = cur_rx->xl_mbuf;
1909 		total_len = cur_rx->xl_ptr->xl_status & XL_RXSTAT_LENMASK;
1910 
1911 		/*
1912 		 * Try to conjure up a new mbuf cluster. If that
1913 		 * fails, it means we have an out of memory condition and
1914 		 * should leave the buffer in place and continue. This will
1915 		 * result in a lost packet, but there's little else we
1916 		 * can do in this situation.
1917 		 */
1918 		if (xl_newbuf(sc, cur_rx) == ENOBUFS) {
1919 			ifp->if_ierrors++;
1920 			cur_rx->xl_ptr->xl_status = 0;
1921 			continue;
1922 		}
1923 
1924 		ifp->if_ipackets++;
1925 		eh = mtod(m, struct ether_header *);
1926 		m->m_pkthdr.rcvif = ifp;
1927 		m->m_pkthdr.len = m->m_len = total_len;
1928 
1929 		/* Remove header from mbuf and pass it on. */
1930 		m_adj(m, sizeof(struct ether_header));
1931 
1932 		if (sc->xl_type == XL_TYPE_905B) {
1933 			/* Do IP checksum checking. */
1934 			if (rxstat & XL_RXSTAT_IPCKOK)
1935 				m->m_pkthdr.csum_flags |= CSUM_IP_CHECKED;
1936 			if (!(rxstat & XL_RXSTAT_IPCKERR))
1937 				m->m_pkthdr.csum_flags |= CSUM_IP_VALID;
1938 			if ((rxstat & XL_RXSTAT_TCPCOK &&
1939 			     !(rxstat & XL_RXSTAT_TCPCKERR)) ||
1940 			    (rxstat & XL_RXSTAT_UDPCKOK &&
1941 			     !(rxstat & XL_RXSTAT_UDPCKERR))) {
1942 				m->m_pkthdr.csum_flags |=
1943 					CSUM_DATA_VALID|CSUM_PSEUDO_HDR;
1944 				m->m_pkthdr.csum_data = 0xffff;
1945 			}
1946 		}
1947 		ether_input(ifp, eh, m);
1948 	}
1949 
1950 	/*
1951 	 * Handle the 'end of channel' condition. When the upload
1952 	 * engine hits the end of the RX ring, it will stall. This
1953 	 * is our cue to flush the RX ring, reload the uplist pointer
1954 	 * register and unstall the engine.
1955 	 * XXX This is actually a little goofy. With the ThunderLAN
1956 	 * chip, you get an interrupt when the receiver hits the end
1957 	 * of the receive ring, which tells you exactly when you
1958 	 * you need to reload the ring pointer. Here we have to
1959 	 * fake it. I'm mad at myself for not being clever enough
1960 	 * to avoid the use of a goto here.
1961 	 */
1962 	if (CSR_READ_4(sc, XL_UPLIST_PTR) == 0 ||
1963 		CSR_READ_4(sc, XL_UPLIST_STATUS) & XL_PKTSTAT_UP_STALLED) {
1964 		CSR_WRITE_2(sc, XL_COMMAND, XL_CMD_UP_STALL);
1965 		xl_wait(sc);
1966 		CSR_WRITE_4(sc, XL_UPLIST_PTR,
1967 			vtophys(&sc->xl_ldata->xl_rx_list[0]));
1968 		sc->xl_cdata.xl_rx_head = &sc->xl_cdata.xl_rx_chain[0];
1969 		CSR_WRITE_2(sc, XL_COMMAND, XL_CMD_UP_UNSTALL);
1970 		goto again;
1971 	}
1972 
1973 	return;
1974 }
1975 
1976 /*
1977  * A frame was downloaded to the chip. It's safe for us to clean up
1978  * the list buffers.
1979  */
1980 static void
1981 xl_txeof(sc)
1982 	struct xl_softc		*sc;
1983 {
1984 	struct xl_chain		*cur_tx;
1985 	struct ifnet		*ifp;
1986 
1987 	ifp = &sc->arpcom.ac_if;
1988 
1989 	/* Clear the timeout timer. */
1990 	ifp->if_timer = 0;
1991 
1992 	/*
1993 	 * Go through our tx list and free mbufs for those
1994 	 * frames that have been uploaded. Note: the 3c905B
1995 	 * sets a special bit in the status word to let us
1996 	 * know that a frame has been downloaded, but the
1997 	 * original 3c900/3c905 adapters don't do that.
1998 	 * Consequently, we have to use a different test if
1999 	 * xl_type != XL_TYPE_905B.
2000 	 */
2001 	while(sc->xl_cdata.xl_tx_head != NULL) {
2002 		cur_tx = sc->xl_cdata.xl_tx_head;
2003 
2004 		if (CSR_READ_4(sc, XL_DOWNLIST_PTR))
2005 			break;
2006 
2007 		sc->xl_cdata.xl_tx_head = cur_tx->xl_next;
2008 		m_freem(cur_tx->xl_mbuf);
2009 		cur_tx->xl_mbuf = NULL;
2010 		ifp->if_opackets++;
2011 
2012 		cur_tx->xl_next = sc->xl_cdata.xl_tx_free;
2013 		sc->xl_cdata.xl_tx_free = cur_tx;
2014 	}
2015 
2016 	if (sc->xl_cdata.xl_tx_head == NULL) {
2017 		ifp->if_flags &= ~IFF_OACTIVE;
2018 		sc->xl_cdata.xl_tx_tail = NULL;
2019 	} else {
2020 		if (CSR_READ_4(sc, XL_DMACTL) & XL_DMACTL_DOWN_STALLED ||
2021 			!CSR_READ_4(sc, XL_DOWNLIST_PTR)) {
2022 			CSR_WRITE_4(sc, XL_DOWNLIST_PTR,
2023 				vtophys(sc->xl_cdata.xl_tx_head->xl_ptr));
2024 			CSR_WRITE_2(sc, XL_COMMAND, XL_CMD_DOWN_UNSTALL);
2025 		}
2026 	}
2027 
2028 	return;
2029 }
2030 
2031 static void xl_txeof_90xB(sc)
2032 	struct xl_softc		*sc;
2033 {
2034 	struct xl_chain		*cur_tx = NULL;
2035 	struct ifnet		*ifp;
2036 	int			idx;
2037 
2038 	ifp = &sc->arpcom.ac_if;
2039 
2040 	idx = sc->xl_cdata.xl_tx_cons;
2041 	while(idx != sc->xl_cdata.xl_tx_prod) {
2042 
2043 		cur_tx = &sc->xl_cdata.xl_tx_chain[idx];
2044 
2045 		if (!(cur_tx->xl_ptr->xl_status & XL_TXSTAT_DL_COMPLETE))
2046 			break;
2047 
2048 		if (cur_tx->xl_mbuf != NULL) {
2049 			m_freem(cur_tx->xl_mbuf);
2050 			cur_tx->xl_mbuf = NULL;
2051 		}
2052 
2053 		ifp->if_opackets++;
2054 
2055 		sc->xl_cdata.xl_tx_cnt--;
2056 		XL_INC(idx, XL_TX_LIST_CNT);
2057 		ifp->if_timer = 0;
2058 	}
2059 
2060 	sc->xl_cdata.xl_tx_cons = idx;
2061 
2062 	if (cur_tx != NULL)
2063 		ifp->if_flags &= ~IFF_OACTIVE;
2064 
2065 	return;
2066 }
2067 
2068 /*
2069  * TX 'end of channel' interrupt handler. Actually, we should
2070  * only get a 'TX complete' interrupt if there's a transmit error,
2071  * so this is really TX error handler.
2072  */
2073 static void
2074 xl_txeoc(sc)
2075 	struct xl_softc		*sc;
2076 {
2077 	u_int8_t		txstat;
2078 
2079 	while((txstat = CSR_READ_1(sc, XL_TX_STATUS))) {
2080 		if (txstat & XL_TXSTATUS_UNDERRUN ||
2081 			txstat & XL_TXSTATUS_JABBER ||
2082 			txstat & XL_TXSTATUS_RECLAIM) {
2083 			printf("xl%d: transmission error: %x\n",
2084 						sc->xl_unit, txstat);
2085 			CSR_WRITE_2(sc, XL_COMMAND, XL_CMD_TX_RESET);
2086 			xl_wait(sc);
2087 			if (sc->xl_type == XL_TYPE_905B) {
2088 				if (sc->xl_cdata.xl_tx_cnt) {
2089 					int			i;
2090 					struct xl_chain		*c;
2091 					i = sc->xl_cdata.xl_tx_cons;
2092 					c = &sc->xl_cdata.xl_tx_chain[i];
2093 					CSR_WRITE_4(sc, XL_DOWNLIST_PTR,
2094 					    c->xl_phys);
2095 					CSR_WRITE_1(sc, XL_DOWN_POLL, 64);
2096 				}
2097 			} else {
2098 				if (sc->xl_cdata.xl_tx_head != NULL)
2099 					CSR_WRITE_4(sc, XL_DOWNLIST_PTR,
2100 				vtophys(sc->xl_cdata.xl_tx_head->xl_ptr));
2101 			}
2102 			/*
2103 			 * Remember to set this for the
2104 			 * first generation 3c90X chips.
2105 			 */
2106 			CSR_WRITE_1(sc, XL_TX_FREETHRESH, XL_PACKET_SIZE >> 8);
2107 			if (txstat & XL_TXSTATUS_UNDERRUN &&
2108 			    sc->xl_tx_thresh < XL_PACKET_SIZE) {
2109 				sc->xl_tx_thresh += XL_MIN_FRAMELEN;
2110 				printf("xl%d: tx underrun, increasing tx start"
2111 				    " threshold to %d bytes\n", sc->xl_unit,
2112 				    sc->xl_tx_thresh);
2113 			}
2114 			CSR_WRITE_2(sc, XL_COMMAND,
2115 			    XL_CMD_TX_SET_START|sc->xl_tx_thresh);
2116 			if (sc->xl_type == XL_TYPE_905B) {
2117 				CSR_WRITE_2(sc, XL_COMMAND,
2118 				XL_CMD_SET_TX_RECLAIM|(XL_PACKET_SIZE >> 4));
2119 			}
2120 			CSR_WRITE_2(sc, XL_COMMAND, XL_CMD_TX_ENABLE);
2121 			CSR_WRITE_2(sc, XL_COMMAND, XL_CMD_DOWN_UNSTALL);
2122 		} else {
2123 			CSR_WRITE_2(sc, XL_COMMAND, XL_CMD_TX_ENABLE);
2124 			CSR_WRITE_2(sc, XL_COMMAND, XL_CMD_DOWN_UNSTALL);
2125 		}
2126 		/*
2127 		 * Write an arbitrary byte to the TX_STATUS register
2128 	 	 * to clear this interrupt/error and advance to the next.
2129 		 */
2130 		CSR_WRITE_1(sc, XL_TX_STATUS, 0x01);
2131 	}
2132 
2133 	return;
2134 }
2135 
2136 static void
2137 xl_intr(arg)
2138 	void			*arg;
2139 {
2140 	struct xl_softc		*sc;
2141 	struct ifnet		*ifp;
2142 	u_int16_t		status;
2143 
2144 	sc = arg;
2145 	ifp = &sc->arpcom.ac_if;
2146 
2147 	while((status = CSR_READ_2(sc, XL_STATUS)) & XL_INTRS && status != 0xFFFF) {
2148 
2149 		CSR_WRITE_2(sc, XL_COMMAND,
2150 		    XL_CMD_INTR_ACK|(status & XL_INTRS));
2151 
2152 		if (status & XL_STAT_UP_COMPLETE) {
2153 			int			curpkts;
2154 
2155 			curpkts = ifp->if_ipackets;
2156 			xl_rxeof(sc);
2157 			if (curpkts == ifp->if_ipackets) {
2158 				while (xl_rx_resync(sc))
2159 					xl_rxeof(sc);
2160 			}
2161 		}
2162 
2163 		if (status & XL_STAT_DOWN_COMPLETE) {
2164 			if (sc->xl_type == XL_TYPE_905B)
2165 				xl_txeof_90xB(sc);
2166 			else
2167 				xl_txeof(sc);
2168 		}
2169 
2170 		if (status & XL_STAT_TX_COMPLETE) {
2171 			ifp->if_oerrors++;
2172 			xl_txeoc(sc);
2173 		}
2174 
2175 		if (status & XL_STAT_ADFAIL) {
2176 			xl_reset(sc);
2177 			xl_init(sc);
2178 		}
2179 
2180 		if (status & XL_STAT_STATSOFLOW) {
2181 			sc->xl_stats_no_timeout = 1;
2182 			xl_stats_update(sc);
2183 			sc->xl_stats_no_timeout = 0;
2184 		}
2185 	}
2186 
2187 	if (ifp->if_snd.ifq_head != NULL)
2188 		(*ifp->if_start)(ifp);
2189 
2190 	return;
2191 }
2192 
2193 static void
2194 xl_stats_update(xsc)
2195 	void			*xsc;
2196 {
2197 	struct xl_softc		*sc;
2198 	struct ifnet		*ifp;
2199 	struct xl_stats		xl_stats;
2200 	u_int8_t		*p;
2201 	int			i;
2202 	struct mii_data		*mii = NULL;
2203 
2204 	bzero((char *)&xl_stats, sizeof(struct xl_stats));
2205 
2206 	sc = xsc;
2207 	ifp = &sc->arpcom.ac_if;
2208 	if (sc->xl_miibus != NULL)
2209 		mii = device_get_softc(sc->xl_miibus);
2210 
2211 	p = (u_int8_t *)&xl_stats;
2212 
2213 	/* Read all the stats registers. */
2214 	XL_SEL_WIN(6);
2215 
2216 	for (i = 0; i < 16; i++)
2217 		*p++ = CSR_READ_1(sc, XL_W6_CARRIER_LOST + i);
2218 
2219 	ifp->if_ierrors += xl_stats.xl_rx_overrun;
2220 
2221 	ifp->if_collisions += xl_stats.xl_tx_multi_collision +
2222 				xl_stats.xl_tx_single_collision +
2223 				xl_stats.xl_tx_late_collision;
2224 
2225 	/*
2226 	 * Boomerang and cyclone chips have an extra stats counter
2227 	 * in window 4 (BadSSD). We have to read this too in order
2228 	 * to clear out all the stats registers and avoid a statsoflow
2229 	 * interrupt.
2230 	 */
2231 	XL_SEL_WIN(4);
2232 	CSR_READ_1(sc, XL_W4_BADSSD);
2233 
2234 	if ((mii != NULL) && (!sc->xl_stats_no_timeout))
2235 		mii_tick(mii);
2236 
2237 	XL_SEL_WIN(7);
2238 
2239 	if (!sc->xl_stats_no_timeout)
2240 		sc->xl_stat_ch = timeout(xl_stats_update, sc, hz);
2241 
2242 	return;
2243 }
2244 
2245 /*
2246  * Encapsulate an mbuf chain in a descriptor by coupling the mbuf data
2247  * pointers to the fragment pointers.
2248  */
2249 static int
2250 xl_encap(sc, c, m_head)
2251 	struct xl_softc		*sc;
2252 	struct xl_chain		*c;
2253 	struct mbuf		*m_head;
2254 {
2255 	int			frag;
2256 	struct xl_frag		*f = NULL;
2257 	int			total_len;
2258 	struct mbuf		*m;
2259 
2260 	/*
2261  	 * Start packing the mbufs in this chain into
2262 	 * the fragment pointers. Stop when we run out
2263  	 * of fragments or hit the end of the mbuf chain.
2264 	 */
2265 	m = m_head;
2266 	total_len = 0;
2267 
2268 	for (m = m_head, frag = 0; m != NULL; m = m->m_next) {
2269 		if (m->m_len != 0) {
2270 			if (frag == XL_MAXFRAGS)
2271 				break;
2272 			total_len += m->m_len;
2273 			f = &c->xl_ptr->xl_frag[frag];
2274 			f->xl_addr = vtophys(mtod(m, vm_offset_t));
2275 			f->xl_len = m->m_len;
2276 			frag++;
2277 		}
2278 	}
2279 
2280 	/*
2281 	 * Handle special case: we used up all 63 fragments,
2282 	 * but we have more mbufs left in the chain. Copy the
2283 	 * data into an mbuf cluster. Note that we don't
2284 	 * bother clearing the values in the other fragment
2285 	 * pointers/counters; it wouldn't gain us anything,
2286 	 * and would waste cycles.
2287 	 */
2288 	if (m != NULL) {
2289 		struct mbuf		*m_new = NULL;
2290 
2291 		MGETHDR(m_new, M_DONTWAIT, MT_DATA);
2292 		if (m_new == NULL) {
2293 			printf("xl%d: no memory for tx list", sc->xl_unit);
2294 			return(1);
2295 		}
2296 		if (m_head->m_pkthdr.len > MHLEN) {
2297 			MCLGET(m_new, M_DONTWAIT);
2298 			if (!(m_new->m_flags & M_EXT)) {
2299 				m_freem(m_new);
2300 				printf("xl%d: no memory for tx list",
2301 						sc->xl_unit);
2302 				return(1);
2303 			}
2304 		}
2305 		m_copydata(m_head, 0, m_head->m_pkthdr.len,
2306 					mtod(m_new, caddr_t));
2307 		m_new->m_pkthdr.len = m_new->m_len = m_head->m_pkthdr.len;
2308 		m_freem(m_head);
2309 		m_head = m_new;
2310 		f = &c->xl_ptr->xl_frag[0];
2311 		f->xl_addr = vtophys(mtod(m_new, caddr_t));
2312 		f->xl_len = total_len = m_new->m_len;
2313 	}
2314 
2315 	if (sc->xl_type == XL_TYPE_905B) {
2316 		c->xl_ptr->xl_status = XL_TXSTAT_RND_DEFEAT;
2317 
2318 		if (m_head->m_pkthdr.csum_flags) {
2319 			if (m_head->m_pkthdr.csum_flags & CSUM_IP)
2320 				c->xl_ptr->xl_status |= XL_TXSTAT_IPCKSUM;
2321 			if (m_head->m_pkthdr.csum_flags & CSUM_TCP)
2322 				c->xl_ptr->xl_status |= XL_TXSTAT_TCPCKSUM;
2323 			if (m_head->m_pkthdr.csum_flags & CSUM_UDP)
2324 				c->xl_ptr->xl_status |= XL_TXSTAT_UDPCKSUM;
2325 		}
2326 	} else
2327 		c->xl_ptr->xl_status = total_len;
2328 
2329 	c->xl_mbuf = m_head;
2330 	f->xl_len |= XL_LAST_FRAG;
2331 	c->xl_ptr->xl_next = 0;
2332 
2333 	return(0);
2334 }
2335 
2336 /*
2337  * Main transmit routine. To avoid having to do mbuf copies, we put pointers
2338  * to the mbuf data regions directly in the transmit lists. We also save a
2339  * copy of the pointers since the transmit list fragment pointers are
2340  * physical addresses.
2341  */
2342 static void
2343 xl_start(ifp)
2344 	struct ifnet		*ifp;
2345 {
2346 	struct xl_softc		*sc;
2347 	struct mbuf		*m_head = NULL;
2348 	struct xl_chain		*prev = NULL, *cur_tx = NULL, *start_tx;
2349 
2350 	sc = ifp->if_softc;
2351 
2352 	/*
2353 	 * Check for an available queue slot. If there are none,
2354 	 * punt.
2355 	 */
2356 	if (sc->xl_cdata.xl_tx_free == NULL) {
2357 		xl_txeoc(sc);
2358 		xl_txeof(sc);
2359 		if (sc->xl_cdata.xl_tx_free == NULL) {
2360 			ifp->if_flags |= IFF_OACTIVE;
2361 			return;
2362 		}
2363 	}
2364 
2365 	start_tx = sc->xl_cdata.xl_tx_free;
2366 
2367 	while(sc->xl_cdata.xl_tx_free != NULL) {
2368 		IF_DEQUEUE(&ifp->if_snd, m_head);
2369 		if (m_head == NULL)
2370 			break;
2371 
2372 		/* Pick a descriptor off the free list. */
2373 		cur_tx = sc->xl_cdata.xl_tx_free;
2374 		sc->xl_cdata.xl_tx_free = cur_tx->xl_next;
2375 
2376 		cur_tx->xl_next = NULL;
2377 
2378 		/* Pack the data into the descriptor. */
2379 		xl_encap(sc, cur_tx, m_head);
2380 
2381 		/* Chain it together. */
2382 		if (prev != NULL) {
2383 			prev->xl_next = cur_tx;
2384 			prev->xl_ptr->xl_next = vtophys(cur_tx->xl_ptr);
2385 		}
2386 		prev = cur_tx;
2387 
2388 		/*
2389 		 * If there's a BPF listener, bounce a copy of this frame
2390 		 * to him.
2391 		 */
2392 		if (ifp->if_bpf)
2393 			bpf_mtap(ifp, cur_tx->xl_mbuf);
2394 	}
2395 
2396 	/*
2397 	 * If there are no packets queued, bail.
2398 	 */
2399 	if (cur_tx == NULL)
2400 		return;
2401 
2402 	/*
2403 	 * Place the request for the upload interrupt
2404 	 * in the last descriptor in the chain. This way, if
2405 	 * we're chaining several packets at once, we'll only
2406 	 * get an interupt once for the whole chain rather than
2407 	 * once for each packet.
2408 	 */
2409 	cur_tx->xl_ptr->xl_status |= XL_TXSTAT_DL_INTR;
2410 
2411 	/*
2412 	 * Queue the packets. If the TX channel is clear, update
2413 	 * the downlist pointer register.
2414 	 */
2415 	CSR_WRITE_2(sc, XL_COMMAND, XL_CMD_DOWN_STALL);
2416 	xl_wait(sc);
2417 
2418 	if (sc->xl_cdata.xl_tx_head != NULL) {
2419 		sc->xl_cdata.xl_tx_tail->xl_next = start_tx;
2420 		sc->xl_cdata.xl_tx_tail->xl_ptr->xl_next =
2421 					vtophys(start_tx->xl_ptr);
2422 		sc->xl_cdata.xl_tx_tail->xl_ptr->xl_status &=
2423 					~XL_TXSTAT_DL_INTR;
2424 		sc->xl_cdata.xl_tx_tail = cur_tx;
2425 	} else {
2426 		sc->xl_cdata.xl_tx_head = start_tx;
2427 		sc->xl_cdata.xl_tx_tail = cur_tx;
2428 	}
2429 	if (!CSR_READ_4(sc, XL_DOWNLIST_PTR))
2430 		CSR_WRITE_4(sc, XL_DOWNLIST_PTR, vtophys(start_tx->xl_ptr));
2431 
2432 	CSR_WRITE_2(sc, XL_COMMAND, XL_CMD_DOWN_UNSTALL);
2433 
2434 	XL_SEL_WIN(7);
2435 
2436 	/*
2437 	 * Set a timeout in case the chip goes out to lunch.
2438 	 */
2439 	ifp->if_timer = 5;
2440 
2441 	/*
2442 	 * XXX Under certain conditions, usually on slower machines
2443 	 * where interrupts may be dropped, it's possible for the
2444 	 * adapter to chew up all the buffers in the receive ring
2445 	 * and stall, without us being able to do anything about it.
2446 	 * To guard against this, we need to make a pass over the
2447 	 * RX queue to make sure there aren't any packets pending.
2448 	 * Doing it here means we can flush the receive ring at the
2449 	 * same time the chip is DMAing the transmit descriptors we
2450 	 * just gave it.
2451  	 *
2452 	 * 3Com goes to some lengths to emphasize the Parallel Tasking (tm)
2453 	 * nature of their chips in all their marketing literature;
2454 	 * we may as well take advantage of it. :)
2455 	 */
2456 	xl_rxeof(sc);
2457 
2458 	return;
2459 }
2460 
2461 static void xl_start_90xB(ifp)
2462 	struct ifnet		*ifp;
2463 {
2464 	struct xl_softc		*sc;
2465 	struct mbuf		*m_head = NULL;
2466 	struct xl_chain		*prev = NULL, *cur_tx = NULL, *start_tx;
2467 	int			idx;
2468 
2469 	sc = ifp->if_softc;
2470 
2471 	if (ifp->if_flags & IFF_OACTIVE)
2472 		return;
2473 
2474 	idx = sc->xl_cdata.xl_tx_prod;
2475 	start_tx = &sc->xl_cdata.xl_tx_chain[idx];
2476 
2477 	while (sc->xl_cdata.xl_tx_chain[idx].xl_mbuf == NULL) {
2478 
2479 		if ((XL_TX_LIST_CNT - sc->xl_cdata.xl_tx_cnt) < 3) {
2480 			ifp->if_flags |= IFF_OACTIVE;
2481 			break;
2482 		}
2483 
2484 		IF_DEQUEUE(&ifp->if_snd, m_head);
2485 		if (m_head == NULL)
2486 			break;
2487 
2488 		cur_tx = &sc->xl_cdata.xl_tx_chain[idx];
2489 
2490 		/* Pack the data into the descriptor. */
2491 		xl_encap(sc, cur_tx, m_head);
2492 
2493 		/* Chain it together. */
2494 		if (prev != NULL)
2495 			prev->xl_ptr->xl_next = cur_tx->xl_phys;
2496 		prev = cur_tx;
2497 
2498 		/*
2499 		 * If there's a BPF listener, bounce a copy of this frame
2500 		 * to him.
2501 		 */
2502 		if (ifp->if_bpf)
2503 			bpf_mtap(ifp, cur_tx->xl_mbuf);
2504 
2505 		XL_INC(idx, XL_TX_LIST_CNT);
2506 		sc->xl_cdata.xl_tx_cnt++;
2507 	}
2508 
2509 	/*
2510 	 * If there are no packets queued, bail.
2511 	 */
2512 	if (cur_tx == NULL)
2513 		return;
2514 
2515 	/*
2516 	 * Place the request for the upload interrupt
2517 	 * in the last descriptor in the chain. This way, if
2518 	 * we're chaining several packets at once, we'll only
2519 	 * get an interupt once for the whole chain rather than
2520 	 * once for each packet.
2521 	 */
2522 	cur_tx->xl_ptr->xl_status |= XL_TXSTAT_DL_INTR;
2523 
2524 	/* Start transmission */
2525 	sc->xl_cdata.xl_tx_prod = idx;
2526 	start_tx->xl_prev->xl_ptr->xl_next = start_tx->xl_phys;
2527 
2528 	/*
2529 	 * Set a timeout in case the chip goes out to lunch.
2530 	 */
2531 	ifp->if_timer = 5;
2532 
2533 	return;
2534 }
2535 
2536 static void
2537 xl_init(xsc)
2538 	void			*xsc;
2539 {
2540 	struct xl_softc		*sc = xsc;
2541 	struct ifnet		*ifp = &sc->arpcom.ac_if;
2542 	int			s, i;
2543 	u_int16_t		rxfilt = 0;
2544 	struct mii_data		*mii = NULL;
2545 
2546 	s = splimp();
2547 
2548 	/*
2549 	 * Cancel pending I/O and free all RX/TX buffers.
2550 	 */
2551 	xl_stop(sc);
2552 
2553 	if (sc->xl_miibus == NULL) {
2554 		CSR_WRITE_2(sc, XL_COMMAND, XL_CMD_RX_RESET);
2555 		xl_wait(sc);
2556 	}
2557 	CSR_WRITE_2(sc, XL_COMMAND, XL_CMD_TX_RESET);
2558 	xl_wait(sc);
2559 	DELAY(10000);
2560 
2561 	if (sc->xl_miibus != NULL)
2562 		mii = device_get_softc(sc->xl_miibus);
2563 
2564 	/* Init our MAC address */
2565 	XL_SEL_WIN(2);
2566 	for (i = 0; i < ETHER_ADDR_LEN; i++) {
2567 		CSR_WRITE_1(sc, XL_W2_STATION_ADDR_LO + i,
2568 				sc->arpcom.ac_enaddr[i]);
2569 	}
2570 
2571 	/* Clear the station mask. */
2572 	for (i = 0; i < 3; i++)
2573 		CSR_WRITE_2(sc, XL_W2_STATION_MASK_LO + (i * 2), 0);
2574 #ifdef notdef
2575 	/* Reset TX and RX. */
2576 	CSR_WRITE_2(sc, XL_COMMAND, XL_CMD_RX_RESET);
2577 	xl_wait(sc);
2578 	CSR_WRITE_2(sc, XL_COMMAND, XL_CMD_TX_RESET);
2579 	xl_wait(sc);
2580 #endif
2581 	/* Init circular RX list. */
2582 	if (xl_list_rx_init(sc) == ENOBUFS) {
2583 		printf("xl%d: initialization failed: no "
2584 			"memory for rx buffers\n", sc->xl_unit);
2585 		xl_stop(sc);
2586 		splx(s);
2587 		return;
2588 	}
2589 
2590 	/* Init TX descriptors. */
2591 	if (sc->xl_type == XL_TYPE_905B)
2592 		xl_list_tx_init_90xB(sc);
2593 	else
2594 		xl_list_tx_init(sc);
2595 
2596 	/*
2597 	 * Set the TX freethresh value.
2598 	 * Note that this has no effect on 3c905B "cyclone"
2599 	 * cards but is required for 3c900/3c905 "boomerang"
2600 	 * cards in order to enable the download engine.
2601 	 */
2602 	CSR_WRITE_1(sc, XL_TX_FREETHRESH, XL_PACKET_SIZE >> 8);
2603 
2604 	/* Set the TX start threshold for best performance. */
2605 	sc->xl_tx_thresh = XL_MIN_FRAMELEN;
2606 	CSR_WRITE_2(sc, XL_COMMAND, XL_CMD_TX_SET_START|sc->xl_tx_thresh);
2607 
2608 	/*
2609 	 * If this is a 3c905B, also set the tx reclaim threshold.
2610 	 * This helps cut down on the number of tx reclaim errors
2611 	 * that could happen on a busy network. The chip multiplies
2612 	 * the register value by 16 to obtain the actual threshold
2613 	 * in bytes, so we divide by 16 when setting the value here.
2614 	 * The existing threshold value can be examined by reading
2615 	 * the register at offset 9 in window 5.
2616 	 */
2617 	if (sc->xl_type == XL_TYPE_905B) {
2618 		CSR_WRITE_2(sc, XL_COMMAND,
2619 		    XL_CMD_SET_TX_RECLAIM|(XL_PACKET_SIZE >> 4));
2620 	}
2621 
2622 	/* Set RX filter bits. */
2623 	XL_SEL_WIN(5);
2624 	rxfilt = CSR_READ_1(sc, XL_W5_RX_FILTER);
2625 
2626 	/* Set the individual bit to receive frames for this host only. */
2627 	rxfilt |= XL_RXFILTER_INDIVIDUAL;
2628 
2629 	/* If we want promiscuous mode, set the allframes bit. */
2630 	if (ifp->if_flags & IFF_PROMISC) {
2631 		rxfilt |= XL_RXFILTER_ALLFRAMES;
2632 		CSR_WRITE_2(sc, XL_COMMAND, XL_CMD_RX_SET_FILT|rxfilt);
2633 	} else {
2634 		rxfilt &= ~XL_RXFILTER_ALLFRAMES;
2635 		CSR_WRITE_2(sc, XL_COMMAND, XL_CMD_RX_SET_FILT|rxfilt);
2636 	}
2637 
2638 	/*
2639 	 * Set capture broadcast bit to capture broadcast frames.
2640 	 */
2641 	if (ifp->if_flags & IFF_BROADCAST) {
2642 		rxfilt |= XL_RXFILTER_BROADCAST;
2643 		CSR_WRITE_2(sc, XL_COMMAND, XL_CMD_RX_SET_FILT|rxfilt);
2644 	} else {
2645 		rxfilt &= ~XL_RXFILTER_BROADCAST;
2646 		CSR_WRITE_2(sc, XL_COMMAND, XL_CMD_RX_SET_FILT|rxfilt);
2647 	}
2648 
2649 	/*
2650 	 * Program the multicast filter, if necessary.
2651 	 */
2652 	if (sc->xl_type == XL_TYPE_905B)
2653 		xl_setmulti_hash(sc);
2654 	else
2655 		xl_setmulti(sc);
2656 
2657 	/*
2658 	 * Load the address of the RX list. We have to
2659 	 * stall the upload engine before we can manipulate
2660 	 * the uplist pointer register, then unstall it when
2661 	 * we're finished. We also have to wait for the
2662 	 * stall command to complete before proceeding.
2663 	 * Note that we have to do this after any RX resets
2664 	 * have completed since the uplist register is cleared
2665 	 * by a reset.
2666 	 */
2667 	CSR_WRITE_2(sc, XL_COMMAND, XL_CMD_UP_STALL);
2668 	xl_wait(sc);
2669 	CSR_WRITE_4(sc, XL_UPLIST_PTR, vtophys(&sc->xl_ldata->xl_rx_list[0]));
2670 	CSR_WRITE_2(sc, XL_COMMAND, XL_CMD_UP_UNSTALL);
2671 	xl_wait(sc);
2672 
2673 
2674 	if (sc->xl_type == XL_TYPE_905B) {
2675 		/* Set polling interval */
2676 		CSR_WRITE_1(sc, XL_DOWN_POLL, 64);
2677 		/* Load the address of the TX list */
2678 		CSR_WRITE_2(sc, XL_COMMAND, XL_CMD_DOWN_STALL);
2679 		xl_wait(sc);
2680 		CSR_WRITE_4(sc, XL_DOWNLIST_PTR,
2681 		    vtophys(&sc->xl_ldata->xl_tx_list[0]));
2682 		CSR_WRITE_2(sc, XL_COMMAND, XL_CMD_DOWN_UNSTALL);
2683 		xl_wait(sc);
2684 	}
2685 
2686 	/*
2687 	 * If the coax transceiver is on, make sure to enable
2688 	 * the DC-DC converter.
2689  	 */
2690 	XL_SEL_WIN(3);
2691 	if (sc->xl_xcvr == XL_XCVR_COAX)
2692 		CSR_WRITE_2(sc, XL_COMMAND, XL_CMD_COAX_START);
2693 	else
2694 		CSR_WRITE_2(sc, XL_COMMAND, XL_CMD_COAX_STOP);
2695 
2696 	/* increase packet size to allow reception of 802.1q or ISL packets */
2697 	 if (sc->xl_type == XL_TYPE_905B)
2698 		CSR_WRITE_2(sc, XL_W3_MAXPKTSIZE, XL_PACKET_SIZE);
2699 	/* Clear out the stats counters. */
2700 	CSR_WRITE_2(sc, XL_COMMAND, XL_CMD_STATS_DISABLE);
2701 	sc->xl_stats_no_timeout = 1;
2702 	xl_stats_update(sc);
2703 	sc->xl_stats_no_timeout = 0;
2704 	XL_SEL_WIN(4);
2705 	CSR_WRITE_2(sc, XL_W4_NET_DIAG, XL_NETDIAG_UPPER_BYTES_ENABLE);
2706 	CSR_WRITE_2(sc, XL_COMMAND, XL_CMD_STATS_ENABLE);
2707 
2708 	/*
2709 	 * Enable interrupts.
2710 	 */
2711 	CSR_WRITE_2(sc, XL_COMMAND, XL_CMD_INTR_ACK|0xFF);
2712 	CSR_WRITE_2(sc, XL_COMMAND, XL_CMD_STAT_ENB|XL_INTRS);
2713 	CSR_WRITE_2(sc, XL_COMMAND, XL_CMD_INTR_ENB|XL_INTRS);
2714 	if (sc->xl_flags & XL_FLAG_FUNCREG) bus_space_write_4 (sc->xl_ftag, sc->xl_fhandle, 4, 0x8000);
2715 
2716 	/* Set the RX early threshold */
2717 	CSR_WRITE_2(sc, XL_COMMAND, XL_CMD_RX_SET_THRESH|(XL_PACKET_SIZE >>2));
2718 	CSR_WRITE_2(sc, XL_DMACTL, XL_DMACTL_UP_RX_EARLY);
2719 
2720 	/* Enable receiver and transmitter. */
2721 	CSR_WRITE_2(sc, XL_COMMAND, XL_CMD_TX_ENABLE);
2722 	xl_wait(sc);
2723 	CSR_WRITE_2(sc, XL_COMMAND, XL_CMD_RX_ENABLE);
2724 	xl_wait(sc);
2725 
2726 	if (mii != NULL)
2727 		mii_mediachg(mii);
2728 
2729 	/* Select window 7 for normal operations. */
2730 	XL_SEL_WIN(7);
2731 
2732 	ifp->if_flags |= IFF_RUNNING;
2733 	ifp->if_flags &= ~IFF_OACTIVE;
2734 
2735 	(void)splx(s);
2736 
2737 	sc->xl_stat_ch = timeout(xl_stats_update, sc, hz);
2738 
2739 	return;
2740 }
2741 
2742 /*
2743  * Set media options.
2744  */
2745 static int
2746 xl_ifmedia_upd(ifp)
2747 	struct ifnet		*ifp;
2748 {
2749 	struct xl_softc		*sc;
2750 	struct ifmedia		*ifm = NULL;
2751 	struct mii_data		*mii = NULL;
2752 
2753 	sc = ifp->if_softc;
2754 	if (sc->xl_miibus != NULL)
2755 		mii = device_get_softc(sc->xl_miibus);
2756 	if (mii == NULL)
2757 		ifm = &sc->ifmedia;
2758 	else
2759 		ifm = &mii->mii_media;
2760 
2761 	switch(IFM_SUBTYPE(ifm->ifm_media)) {
2762 	case IFM_100_FX:
2763 	case IFM_10_FL:
2764 	case IFM_10_2:
2765 	case IFM_10_5:
2766 		xl_setmode(sc, ifm->ifm_media);
2767 		return(0);
2768 		break;
2769 	default:
2770 		break;
2771 	}
2772 
2773 	if (sc->xl_media & XL_MEDIAOPT_MII || sc->xl_media & XL_MEDIAOPT_BTX
2774 		|| sc->xl_media & XL_MEDIAOPT_BT4) {
2775 		xl_init(sc);
2776 	} else {
2777 		xl_setmode(sc, ifm->ifm_media);
2778 	}
2779 
2780 	return(0);
2781 }
2782 
2783 /*
2784  * Report current media status.
2785  */
2786 static void
2787 xl_ifmedia_sts(ifp, ifmr)
2788 	struct ifnet		*ifp;
2789 	struct ifmediareq	*ifmr;
2790 {
2791 	struct xl_softc		*sc;
2792 	u_int32_t		icfg;
2793 	struct mii_data		*mii = NULL;
2794 
2795 	sc = ifp->if_softc;
2796 	if (sc->xl_miibus != NULL)
2797 		mii = device_get_softc(sc->xl_miibus);
2798 
2799 	XL_SEL_WIN(3);
2800 	icfg = CSR_READ_4(sc, XL_W3_INTERNAL_CFG) & XL_ICFG_CONNECTOR_MASK;
2801 	icfg >>= XL_ICFG_CONNECTOR_BITS;
2802 
2803 	ifmr->ifm_active = IFM_ETHER;
2804 
2805 	switch(icfg) {
2806 	case XL_XCVR_10BT:
2807 		ifmr->ifm_active = IFM_ETHER|IFM_10_T;
2808 		if (CSR_READ_1(sc, XL_W3_MAC_CTRL) & XL_MACCTRL_DUPLEX)
2809 			ifmr->ifm_active |= IFM_FDX;
2810 		else
2811 			ifmr->ifm_active |= IFM_HDX;
2812 		break;
2813 	case XL_XCVR_AUI:
2814 		if (sc->xl_type == XL_TYPE_905B &&
2815 		    sc->xl_media == XL_MEDIAOPT_10FL) {
2816 			ifmr->ifm_active = IFM_ETHER|IFM_10_FL;
2817 			if (CSR_READ_1(sc, XL_W3_MAC_CTRL) & XL_MACCTRL_DUPLEX)
2818 				ifmr->ifm_active |= IFM_FDX;
2819 			else
2820 				ifmr->ifm_active |= IFM_HDX;
2821 		} else
2822 			ifmr->ifm_active = IFM_ETHER|IFM_10_5;
2823 		break;
2824 	case XL_XCVR_COAX:
2825 		ifmr->ifm_active = IFM_ETHER|IFM_10_2;
2826 		break;
2827 	/*
2828 	 * XXX MII and BTX/AUTO should be separate cases.
2829 	 */
2830 
2831 	case XL_XCVR_100BTX:
2832 	case XL_XCVR_AUTO:
2833 	case XL_XCVR_MII:
2834 		if (mii != NULL) {
2835 			mii_pollstat(mii);
2836 			ifmr->ifm_active = mii->mii_media_active;
2837 			ifmr->ifm_status = mii->mii_media_status;
2838 		}
2839 		break;
2840 	case XL_XCVR_100BFX:
2841 		ifmr->ifm_active = IFM_ETHER|IFM_100_FX;
2842 		break;
2843 	default:
2844 		printf("xl%d: unknown XCVR type: %d\n", sc->xl_unit, icfg);
2845 		break;
2846 	}
2847 
2848 	return;
2849 }
2850 
2851 static int
2852 xl_ioctl(ifp, command, data)
2853 	struct ifnet		*ifp;
2854 	u_long			command;
2855 	caddr_t			data;
2856 {
2857 	struct xl_softc		*sc = ifp->if_softc;
2858 	struct ifreq		*ifr = (struct ifreq *) data;
2859 	int			s, error = 0;
2860 	struct mii_data		*mii = NULL;
2861 	u_int8_t		rxfilt;
2862 
2863 	s = splimp();
2864 
2865 	switch(command) {
2866 	case SIOCSIFADDR:
2867 	case SIOCGIFADDR:
2868 	case SIOCSIFMTU:
2869 		error = ether_ioctl(ifp, command, data);
2870 		break;
2871 	case SIOCSIFFLAGS:
2872 		XL_SEL_WIN(5);
2873 		rxfilt = CSR_READ_1(sc, XL_W5_RX_FILTER);
2874 		if (ifp->if_flags & IFF_UP) {
2875 			if (ifp->if_flags & IFF_RUNNING &&
2876 			    ifp->if_flags & IFF_PROMISC &&
2877 			    !(sc->xl_if_flags & IFF_PROMISC)) {
2878 				rxfilt |= XL_RXFILTER_ALLFRAMES;
2879 				CSR_WRITE_2(sc, XL_COMMAND,
2880 				    XL_CMD_RX_SET_FILT|rxfilt);
2881 				XL_SEL_WIN(7);
2882 			} else if (ifp->if_flags & IFF_RUNNING &&
2883 			    !(ifp->if_flags & IFF_PROMISC) &&
2884 			    sc->xl_if_flags & IFF_PROMISC) {
2885 				rxfilt &= ~XL_RXFILTER_ALLFRAMES;
2886 				CSR_WRITE_2(sc, XL_COMMAND,
2887 				    XL_CMD_RX_SET_FILT|rxfilt);
2888 				XL_SEL_WIN(7);
2889 			} else
2890 				xl_init(sc);
2891 		} else {
2892 			if (ifp->if_flags & IFF_RUNNING)
2893 				xl_stop(sc);
2894 		}
2895 		sc->xl_if_flags = ifp->if_flags;
2896 		error = 0;
2897 		break;
2898 	case SIOCADDMULTI:
2899 	case SIOCDELMULTI:
2900 		if (sc->xl_type == XL_TYPE_905B)
2901 			xl_setmulti_hash(sc);
2902 		else
2903 			xl_setmulti(sc);
2904 		error = 0;
2905 		break;
2906 	case SIOCGIFMEDIA:
2907 	case SIOCSIFMEDIA:
2908 		if (sc->xl_miibus != NULL)
2909 			mii = device_get_softc(sc->xl_miibus);
2910 		if (mii == NULL)
2911 			error = ifmedia_ioctl(ifp, ifr,
2912 			    &sc->ifmedia, command);
2913 		else
2914 			error = ifmedia_ioctl(ifp, ifr,
2915 			    &mii->mii_media, command);
2916 		break;
2917 	default:
2918 		error = EINVAL;
2919 		break;
2920 	}
2921 
2922 	(void)splx(s);
2923 
2924 	return(error);
2925 }
2926 
2927 static void
2928 xl_watchdog(ifp)
2929 	struct ifnet		*ifp;
2930 {
2931 	struct xl_softc		*sc;
2932 	u_int16_t		status = 0;
2933 
2934 	sc = ifp->if_softc;
2935 
2936 	ifp->if_oerrors++;
2937 	XL_SEL_WIN(4);
2938 	status = CSR_READ_2(sc, XL_W4_MEDIA_STATUS);
2939 	printf("xl%d: watchdog timeout\n", sc->xl_unit);
2940 
2941 	if (status & XL_MEDIASTAT_CARRIER)
2942 		printf("xl%d: no carrier - transceiver cable problem?\n",
2943 								sc->xl_unit);
2944 	xl_txeoc(sc);
2945 	xl_txeof(sc);
2946 	xl_rxeof(sc);
2947 	xl_reset(sc);
2948 	xl_init(sc);
2949 
2950 	if (ifp->if_snd.ifq_head != NULL)
2951 		(*ifp->if_start)(ifp);
2952 
2953 	return;
2954 }
2955 
2956 /*
2957  * Stop the adapter and free any mbufs allocated to the
2958  * RX and TX lists.
2959  */
2960 static void
2961 xl_stop(sc)
2962 	struct xl_softc		*sc;
2963 {
2964 	register int		i;
2965 	struct ifnet		*ifp;
2966 
2967 	ifp = &sc->arpcom.ac_if;
2968 	ifp->if_timer = 0;
2969 
2970 	CSR_WRITE_2(sc, XL_COMMAND, XL_CMD_RX_DISABLE);
2971 	CSR_WRITE_2(sc, XL_COMMAND, XL_CMD_STATS_DISABLE);
2972 	CSR_WRITE_2(sc, XL_COMMAND, XL_CMD_INTR_ENB);
2973 	CSR_WRITE_2(sc, XL_COMMAND, XL_CMD_RX_DISCARD);
2974 	xl_wait(sc);
2975 	CSR_WRITE_2(sc, XL_COMMAND, XL_CMD_TX_DISABLE);
2976 	CSR_WRITE_2(sc, XL_COMMAND, XL_CMD_COAX_STOP);
2977 	DELAY(800);
2978 
2979 #ifdef foo
2980 	CSR_WRITE_2(sc, XL_COMMAND, XL_CMD_RX_RESET);
2981 	xl_wait(sc);
2982 	CSR_WRITE_2(sc, XL_COMMAND, XL_CMD_TX_RESET);
2983 	xl_wait(sc);
2984 #endif
2985 
2986 	CSR_WRITE_2(sc, XL_COMMAND, XL_CMD_INTR_ACK|XL_STAT_INTLATCH);
2987 	CSR_WRITE_2(sc, XL_COMMAND, XL_CMD_STAT_ENB|0);
2988 	CSR_WRITE_2(sc, XL_COMMAND, XL_CMD_INTR_ENB|0);
2989 	if (sc->xl_flags & XL_FLAG_FUNCREG) bus_space_write_4 (sc->xl_ftag, sc->xl_fhandle, 4, 0x8000);
2990 
2991 	/* Stop the stats updater. */
2992 	untimeout(xl_stats_update, sc, sc->xl_stat_ch);
2993 
2994 	/*
2995 	 * Free data in the RX lists.
2996 	 */
2997 	for (i = 0; i < XL_RX_LIST_CNT; i++) {
2998 		if (sc->xl_cdata.xl_rx_chain[i].xl_mbuf != NULL) {
2999 			m_freem(sc->xl_cdata.xl_rx_chain[i].xl_mbuf);
3000 			sc->xl_cdata.xl_rx_chain[i].xl_mbuf = NULL;
3001 		}
3002 	}
3003 	bzero((char *)&sc->xl_ldata->xl_rx_list,
3004 		sizeof(sc->xl_ldata->xl_rx_list));
3005 	/*
3006 	 * Free the TX list buffers.
3007 	 */
3008 	for (i = 0; i < XL_TX_LIST_CNT; i++) {
3009 		if (sc->xl_cdata.xl_tx_chain[i].xl_mbuf != NULL) {
3010 			m_freem(sc->xl_cdata.xl_tx_chain[i].xl_mbuf);
3011 			sc->xl_cdata.xl_tx_chain[i].xl_mbuf = NULL;
3012 		}
3013 	}
3014 	bzero((char *)&sc->xl_ldata->xl_tx_list,
3015 		sizeof(sc->xl_ldata->xl_tx_list));
3016 
3017 	ifp->if_flags &= ~(IFF_RUNNING | IFF_OACTIVE);
3018 
3019 	return;
3020 }
3021 
3022 /*
3023  * Stop all chip I/O so that the kernel's probe routines don't
3024  * get confused by errant DMAs when rebooting.
3025  */
3026 static void
3027 xl_shutdown(dev)
3028 	device_t		dev;
3029 {
3030 	struct xl_softc		*sc;
3031 
3032 	sc = device_get_softc(dev);
3033 
3034 	xl_reset(sc);
3035 	xl_stop(sc);
3036 
3037 	return;
3038 }
3039 
3040 static int
3041 xl_suspend(dev)
3042 	device_t		dev;
3043 {
3044 	struct xl_softc		*sc;
3045 	int			s;
3046 
3047 	sc = device_get_softc(dev);
3048 
3049 	s = splimp();
3050 	xl_stop(sc);
3051 	splx(s);
3052 
3053 	return(0);
3054 }
3055 
3056 static int
3057 xl_resume(dev)
3058 	device_t		dev;
3059 {
3060 	struct xl_softc		*sc;
3061 	struct ifnet		*ifp;
3062 	int			s;
3063 
3064 	s = splimp();
3065 	sc = device_get_softc(dev);
3066 	ifp = &sc->arpcom.ac_if;
3067 
3068 	xl_reset(sc);
3069 	if (ifp->if_flags & IFF_UP)
3070 		xl_init(sc);
3071 
3072 	splx(s);
3073 	return(0);
3074 }
3075