/*      $NetBSD: if_scx.c,v 1.44 2024/06/29 11:27:12 riastradh Exp $    */

/*-
 * Copyright (c) 2020 The NetBSD Foundation, Inc.
 * All rights reserved.
 *
 * This code is derived from software contributed to The NetBSD Foundation
 * by Tohru Nishimura.
 *
 * Redistribution and use in source and binary forms, with or without
 * modification, are permitted provided that the following conditions
 * are met:
 * 1. Redistributions of source code must retain the above copyright
 *    notice, this list of conditions and the following disclaimer.
 * 2. Redistributions in binary form must reproduce the above copyright
 *    notice, this list of conditions and the following disclaimer in the
 *    documentation and/or other materials provided with the distribution.
 *
 * THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS
 * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
 * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
 * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS
 * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
 * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
 * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
 * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
 * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
 * POSSIBILITY OF SUCH DAMAGE.
 */

#define NOT_MP_SAFE     0

/*
 * Socionext SC2A11 SynQuacer NetSec GbE driver
 *
 * Multiple Tx and Rx queues exist inside and dedicated descriptor
 * fields specifies which queue is to use. Three internal micro-processors
 * to handle incoming frames, outgoing frames and packet data crypto
 * processing. uP programs are stored in an external flash memory and
 * have to be loaded by device driver.
 * NetSec uses Synopsys DesignWare Core EMAC.  DWC implementation
 * register (0x20) is known to have 0x10.36 and feature register (0x1058)
 * reports 0x11056f37.
 *  <24> alternative/enhanced desc format
 *  <18> receive IP type 2 checksum offload
 *  <16> transmit checksum offload
 *  <11> event counter (mac management counter, MMC) 
 */

#include <sys/cdefs.h>
__KERNEL_RCSID(0, "$NetBSD: if_scx.c,v 1.44 2024/06/29 11:27:12 riastradh Exp $");

#include <sys/param.h>
#include <sys/bus.h>
#include <sys/intr.h>
#include <sys/device.h>
#include <sys/callout.h>
#include <sys/mbuf.h>
#include <sys/errno.h>
#include <sys/rndsource.h>
#include <sys/kernel.h>
#include <sys/systm.h>

#include <net/if.h>
#include <net/if_media.h>
#include <net/if_dl.h>
#include <net/if_ether.h>
#include <dev/mii/mii.h>
#include <dev/mii/miivar.h>
#include <net/bpf.h>

#include <dev/fdt/fdtvar.h>
#include <dev/acpi/acpireg.h>
#include <dev/acpi/acpivar.h>
#include <dev/acpi/acpi_intr.h>

/* SC2A11 GbE has 64-bit paddr descriptor */
struct tdes {
        uint32_t t0, t1, t2, t3;
};
struct rdes {
        uint32_t r0, r1, r2, r3;
};
#define T0_OWN          (1U<<31)        /* desc is ready to Tx */
#define T0_LD           (1U<<30)        /* last descriptor in array */
#define T0_DRID         (24)            /* 29:24 desc ring id */
#define T0_PT           (1U<<21)        /* 23:21 "pass-through" */
#define T0_TDRID        (16)            /* 20:16 target desc ring id: GMAC=15 */
#define T0_CC           (1U<<15)        /* ??? */
#define T0_FS           (1U<<9)         /* first segment of frame */
#define T0_LS           (1U<<8)         /* last segment of frame */
#define T0_CSUM         (1U<<7)         /* enable check sum offload */
#define T0_TSO          (1U<<6)         /* enable TCP segment offload */
#define T0_TRS          (1U<<4)         /* 5:4 "TRS" ??? */
/* T1 frame segment address 63:32 */
/* T2 frame segment address 31:0 */
/* T3 31:16 TCP segment length, 15:0 frame segment length to transmit */
#define R0_OWN          (1U<<31)        /* desc is empty */
#define R0_LD           (1U<<30)        /* last descriptor in array */
#define R0_SDRID        (24)            /* 29:24 source desc ring id */
#define R0_FR           (1U<<23)        /* found fragmented */
#define R0_ER           (1U<<21)        /* Rx error indication */
#define R0_ERR          (3U<<16)        /* 18:16 receive error code */
#define R0_TDRID        (12)            /* 15:12 target desc ring id */
#define R0_FS           (1U<<9)         /* first segment of frame */
#define R0_LS           (1U<<8)         /* last segment of frame */
#define R0_CSUM         (3U<<6)         /* 7:6 checksum status, 0: undone */
#define R0_CERR         (2U<<6)         /* 2: found bad */
#define R0_COK          (1U<<6)         /* 1: found ok */
/* R1 frame address 63:32 */
/* R2 frame address 31:0 */
/* R3 31:16 received frame length, 15:0 buffer length to receive */

/*
 * SC2A11 registers. 0x100 - 1204
 */
#define SWRESET         0x104
#define  SRST_RUN       (1U<<31)        /* instruct start, 0 to stop */
#define COMINIT         0x120
#define  INIT_DB        (1U<<2)         /* ???; self clear when done */
#define  INIT_CLS       (1U<<1)         /* ???; self clear when done */
#define xINTSR          0x200           /* aggregated interrupt status */
#define  IRQ_UCODE      (1U<<20)        /* ucode load completed; W1C */
#define  IRQ_MAC        (1U<<19)        /* ??? */
#define  IRQ_PKT        (1U<<18)        /* ??? */
#define  IRQ_BOOTCODE   (1U<<5)         /* ??? */
#define  IRQ_XDONE      (1U<<4)         /* ??? mode change completed */
#define  IRQ_RX         (1U<<1)         /* top level Rx interrupt */
#define  IRQ_TX         (1U<<0)         /* top level Tx interrupt */
#define xINTAEN         0x204           /* INT_A enable */
#define xINTAE_SET      0x234           /* bit to set */
#define xINTAE_CLR      0x238           /* bit to clr */
#define xINTBEN         0x23c           /* INT_B enable */
#define xINTBE_SET      0x240           /* bit to set */
#define xINTBE_CLR      0x244           /* bit to clr */
#define TXISR           0x400           /* transmit status; W1C */
#define TXIEN           0x404           /* tx interrupt enable */
#define TXIE_SET        0x428           /* bit to set */
#define TXIE_CLR        0x42c           /* bit to clr */
#define  TXI_NTOWNR     (1U<<17)        /* ??? desc array got empty */
#define  TXI_TR_ERR     (1U<<16)        /* xmit error detected */
#define  TXI_TXDONE     (1U<<15)        /* xmit completed */
#define  TXI_TMREXP     (1U<<14)        /* coalesce guard timer expired */
#define RXISR           0x440           /* receive status; W1C */
#define RXIEN           0x444           /* rx interrupt enable */
#define RXIE_SET        0x468           /* bit to set */
#define RXIE_CLR        0x46c           /* bit to clr */
#define  RXI_RC_ERR     (1U<<16)        /* recv error detected */
#define  RXI_PKTCNT     (1U<<15)        /* recv counter has new value */
#define  RXI_TMREXP     (1U<<14)        /* coalesce guard timer expired */
#define TDBA_LO         0x408           /* tdes array base addr 31:0 */
#define TDBA_HI         0x434           /* tdes array base addr 63:32 */
#define RDBA_LO         0x448           /* rdes array base addr 31:0 */
#define RDBA_HI         0x474           /* rdes array base addr 63:32 */
#define TXCONF          0x430           /* tdes config */
#define RXCONF          0x470           /* rdes config */
#define  DESCNF_UP      (1U<<31)        /* 'up-and-running' */
#define  DESCNF_CHRST   (1U<<30)        /* channel reset */
#define  DESCNF_TMR     (1U<<4)         /* coalesce timer unit select */
#define  DESCNF_LE      (1)             /* little endian desc format */
#define TXSUBMIT        0x410           /* submit frame(s) to transmit */
#define TXCOALESC       0x418           /* tx intr coalesce upper bound */
#define RXCOALESC       0x458           /* rx intr coalesce upper bound */
#define TCLSCTIME       0x420           /* tintr guard time usec */
#define RCLSCTIME       0x460           /* rintr guard time usec */
#define TXDONECNT       0x414           /* tx completed count, auto-zero */
#define RXAVAILCNT      0x454           /* rx available count, auto-zero */
#define DMACTL_TMR      0x20c           /* DMA cycle tick value */
#define PKTCTRL         0x140           /* pkt engine control */
#define  MODENRM        (1U<<28)        /* set operational mode to 'normal' */
#define  ENJUMBO        (1U<<27)        /* allow jumbo frame */
#define  RPTCSUMERR     (1U<<3)         /* log Rx checksum error */
#define  RPTHDCOMP      (1U<<2)         /* log header incomplete condition */
#define  RPTHDERR       (1U<<1)         /* log header error */
#define  DROPNOMATCH    (1U<<0)         /* drop no match frames */
#define UCODE_PKT       0x0d0           /* packet engine ucode port */
#define UCODE_H2M       0x210           /* host2media engine ucode port */
#define UCODE_M2H       0x21c           /* media2host engine ucode port */
#define CORESTAT        0x218           /* engine run state */
#define  PKTSTOP        (1U<<2)         /* pkt engine stopped */
#define  M2HSTOP        (1U<<1)         /* M2H engine stopped */
#define  H2MSTOP        (1U<<0)         /* H2M engine stopped */
#define DMACTL_H2M      0x214           /* host2media engine control */
#define DMACTL_M2H      0x220           /* media2host engine control */
#define  DMACTL_STOP    (1U<<0)         /* instruct stop; self-clear */
#define  M2H_MODE_TRANS (1U<<20)        /* initiate M2H mode change */
#define MODE_TRANS      0x500           /* mode change completion status */
#define  N2T_DONE       (1U<<20)        /* normal->taiki change completed */
#define  T2N_DONE       (1U<<19)        /* taiki->normal change completed */
#define CLKEN           0x100           /* clock distribution enable */
#define  CLK_G          (1U<<5)         /* feed clk domain G */
#define  CLK_C          (1U<<1)         /* feed clk domain C */
#define  CLK_D          (1U<<0)         /* feed clk domain D */
#define DESC_INIT       0x11fc          /* write 1 for desc init, SC */
#define DESC_SRST       0x1204          /* write 1 for desc sw reset, SC */

/* GMAC register indirect access. thru MACCMD/MACDATA operation */
#define MACDATA         0x11c0          /* gmac register rd/wr data */
#define MACCMD          0x11c4          /* gmac register operation */
#define  CMD_IOWR       (1U<<28)        /* write op */
#define  CMD_BUSY       (1U<<31)        /* busy bit */
#define MACSTAT         0x1024          /* mac interrupt status (unused) */
#define MACINTE         0x1028          /* mac interrupt enable (unused) */

#define FLOWTHR         0x11cc          /* flow control threshold */
/* 31:16 pause threshold, 15:0 resume threshold */
#define INTF_SEL        0x11d4          /* phy interface type */
#define  INTF_GMII      0
#define  INTF_RGMII     1
#define  INTF_RMII      4

#define MCVER           0x22c           /* micro controller version */
#define HWVER           0x230           /* hardware version */

/*
 * GMAC registers are mostly identical to Synopsys DesignWare Core
 * Ethernet. These must be handled by indirect access.
 */
#define GMACMCR         0x0000          /* MAC configuration */
#define  MCR_IBN        (1U<<30)        /* watch in-band-signal */
#define  MCR_CST        (1U<<25)        /* strip CRC */
#define  MCR_TC         (1U<<24)        /* keep RGMII PHY notified */
#define  MCR_WD         (1U<<23)        /* allow long >2048 tx frame */
#define  MCR_JE         (1U<<20)        /* allow ~9018 tx jumbo frame */
#define  MCR_IFG        (7U<<17)        /* 19:17 IFG value 0~7 */
#define  MCR_DCRS       (1U<<16)        /* ignore (G)MII HDX Tx error */
#define  MCR_PS         (1U<<15)        /* 1: MII 10/100, 0: GMII 1000 */
#define  MCR_FES        (1U<<14)        /* force speed 100 */
#define  MCR_DO         (1U<<13)        /* don't receive my own HDX Tx frames */
#define  MCR_LOOP       (1U<<12)        /* run loop back */
#define  MCR_USEFDX     (1U<<11)        /* force full duplex */
#define  MCR_IPCEN      (1U<<10)        /* handle checksum */
#define  MCR_DR         (1U<<9)         /* attempt no tx retry, send once */
#define  MCR_LUD        (1U<<8)         /* link condition report when RGMII */
#define  MCR_ACS        (1U<<7)         /* auto pad auto strip CRC */
#define  MCR_DC         (1U<<4)         /* report excessive tx deferral */
#define  MCR_TE         (1U<<3)         /* run Tx MAC engine, 0 to stop */
#define  MCR_RE         (1U<<2)         /* run Rx MAC engine, 0 to stop */
#define  MCR_PREA       (3U)            /* 1:0 preamble len. 0~2 */
#define GMACAFR         0x0004          /* frame DA/SA address filter */
#define  AFR_RA         (1U<<31)        /* accept all irrespective of filt. */
#define  AFR_HPF        (1U<<10)        /* hash+perfect filter, or hash only */
#define  AFR_SAF        (1U<<9)         /* source address filter */
#define  AFR_SAIF       (1U<<8)         /* SA inverse filtering */
#define  AFR_PCF        (2U<<6)         /* 7:6 accept pause frame 0~3 */
#define  AFR_DBF        (1U<<5)         /* reject broadcast frame */
#define  AFR_PM         (1U<<4)         /* accept all multicast frame */
#define  AFR_DAIF       (1U<<3)         /* DA inverse filtering */
#define  AFR_MHTE       (1U<<2)         /* use multicast hash table */
#define  AFR_UHTE       (1U<<1)         /* use hash table for unicast */
#define  AFR_PR         (1U<<0)         /* run promisc mode */
#define GMACGAR         0x0010          /* MDIO operation */
#define  GAR_PHY        (11)            /* 15:11 mii phy */
#define  GAR_REG        (6)             /* 10:6 mii reg */
#define  GAR_CLK        (2)             /* 5:2 mdio clock tick ratio */
#define  GAR_IOWR       (1U<<1)         /* MDIO write op */
#define  GAR_BUSY       (1U<<0)         /* busy bit */
#define  GAR_MDIO_25_35MHZ      2
#define  GAR_MDIO_35_60MHZ      3
#define  GAR_MDIO_60_100MHZ     0
#define  GAR_MDIO_100_150MHZ    1
#define  GAR_MDIO_150_250MHZ    4
#define  GAR_MDIO_250_300MHZ    5
#define GMACGDR         0x0014          /* MDIO rd/wr data */
#define GMACFCR         0x0018          /* 802.3x flowcontrol */
/* 31:16 pause timer value, 5:4 pause timer threshold */
#define  FCR_RFE        (1U<<2)         /* accept PAUSE to throttle Tx */
#define  FCR_TFE        (1U<<1)         /* generate PAUSE to moderate Rx lvl */
#define GMACIMPL        0x0020          /* implementation id */
#define GMACISR         0x0038          /* interrupt status indication */
#define GMACIMR         0x003c          /* interrupt mask to inhibit */
#define  ISR_TS         (1U<<9)         /* time stamp operation detected */
#define  ISR_CO         (1U<<7)         /* Rx checksum offload completed */
#define  ISR_TX         (1U<<6)         /* Tx completed */
#define  ISR_RX         (1U<<5)         /* Rx completed */
#define  ISR_ANY        (1U<<4)         /* any of above 5-7 report */
#define  ISR_LC         (1U<<0)         /* link status change detected */
#define GMACMAH0        0x0040          /* my own MAC address 47:32 */
#define GMACMAL0        0x0044          /* my own MAC address 31:0 */
#define GMACMAH(i)      ((i)*8+0x40)    /* supplemental MAC addr 1-15 */
#define GMACMAL(i)      ((i)*8+0x44)    /* 31:0 MAC address low part */
/* MAH bit-31: slot in use, 30: SA to match, 29:24 byte-wise don'care */
#define GMACAMAH(i)     ((i)*8+0x800)   /* supplemental MAC addr 16-31 */
#define GMACAMAL(i)     ((i)*8+0x804)   /* 31: MAC address low part */
/* supplimental MAH bit-31: slot in use, no other bit is effective */
#define GMACMHTH        0x0008          /* 64bit multicast hash table 63:32 */
#define GMACMHTL        0x000c          /* 64bit multicast hash table 31:0 */
#define GMACMHT(i)      ((i)*4+0x500)   /* 256-bit alternative mcast hash 0-7 */
#define GMACVTAG        0x001c          /* VLAN tag control */
#define  VTAG_HASH      (1U<<19)        /* use VLAN tag hash table */
#define  VTAG_SVLAN     (1U<<18)        /* handle type 0x88A8 SVLAN frame */
#define  VTAG_INV       (1U<<17)        /* run inverse match logic */
#define  VTAG_ETV       (1U<<16)        /* use only 12bit VID field to match */
/* 15:0 concat of PRIO+CFI+VID */
#define GMACVHT         0x0588          /* 16-bit VLAN tag hash */
#define GMACMIISR       0x00d8          /* resolved RGMII/SGMII link status */
#define  MIISR_LUP      (1U<<3)         /* link up(1)/down(0) report */
#define  MIISR_SPD      (3U<<1)         /* 2:1 speed 10(0)/100(1)/1000(2) */
#define  MIISR_FDX      (1U<<0)         /* fdx detected */

#define GMACLPIS        0x0030          /* LPI control & status */
#define  LPIS_TXA       (1U<<19)        /* complete Tx in progress and LPI */
#define  LPIS_PLS       (1U<<17)
#define  LPIS_EN        (1U<<16)        /* 1: enter LPI mode, 0: exit */
#define  LPIS_TEN       (1U<<0)         /* Tx LPI report */
#define GMACLPIC        0x0034          /* LPI timer control */
#define  LPIC_LST       (5)             /* 16:5 ??? */
#define  LPIC_TWT       (0)             /* 15:0 ??? */
/* 0x700-764 Time Stamp control */

#define GMACBMR         0x1000          /* DMA bus mode control */
/* 24    8xPBL multiply by 8 for RPBL & PBL values
 * 23    USP 1 to use RPBL for Rx DMA burst, 0 to share PBL by Rx and Tx
 * 22:17 RPBL
 * 16    FB fixed burst
 * 15:14 priority between Rx and Tx
 *  3    rxtx ratio 41
 *  2    rxtx ratio 31
 *  1    rxtx ratio 21
 *  0    rxtx ratio 11
 * 13:8  PBL possible DMA burst length
 *  7    ATDS select 32-byte descriptor format for advanced features
 *  6:2  DSL descriptor skip length, 0 for adjuscent, counted on bus width
 *  0    MAC reset op. self-clear
 */
#define  BMR_RST        (1)             /* reset op. self clear when done */
#define GMACTPD         0x1004          /* write any to resume tdes */
#define GMACRPD         0x1008          /* write any to resume rdes */
#define GMACRDLA        0x100c          /* rdes base address 32bit paddr */
#define GMACTDLA        0x1010          /* tdes base address 32bit paddr */
#define GMACDSR         0x1014          /* DMA status detail report; W1C */
#define GMACDIE         0x101c          /* DMA interrupt enable */
#define  DMAI_LPI       (1U<<30)        /* LPI interrupt */
#define  DMAI_TTI       (1U<<29)        /* timestamp trigger interrupt */
#define  DMAI_GMI       (1U<<27)        /* management counter interrupt */
#define  DMAI_GLI       (1U<<26)        /* xMII link change detected */
#define  DMAI_EB        (23)            /* 25:23 DMA bus error detected */
#define  DMAI_TS        (20)            /* 22:20 Tx DMA state report */
#define  DMAI_RS        (17)            /* 29:17 Rx DMA state report */
#define  DMAI_NIS       (1U<<16)        /* normal interrupt summary; W1C */
#define  DMAI_AIS       (1U<<15)        /* abnormal interrupt summary; W1C */
#define  DMAI_ERI       (1U<<14)        /* the first Rx buffer is filled */
#define  DMAI_FBI       (1U<<13)        /* DMA bus error detected */
#define  DMAI_ETI       (1U<<10)        /* single frame Tx completed */
#define  DMAI_RWT       (1U<<9)         /* longer than 2048 frame received */
#define  DMAI_RPS       (1U<<8)         /* Rx process is now stopped */
#define  DMAI_RU        (1U<<7)         /* Rx descriptor not available */
#define  DMAI_RI        (1U<<6)         /* frame Rx completed by !R1_DIC */
#define  DMAI_UNF       (1U<<5)         /* Tx underflow detected */
#define  DMAI_OVF       (1U<<4)         /* receive buffer overflow detected */
#define  DMAI_TJT       (1U<<3)         /* longer than 2048 frame sent */
#define  DMAI_TU        (1U<<2)         /* Tx descriptor not available */
#define  DMAI_TPS       (1U<<1)         /* transmission is stopped */
#define  DMAI_TI        (1U<<0)         /* frame Tx completed by T0_IC */
#define GMACOMR         0x1018          /* DMA operation mode */
#define  OMR_DT         (1U<<26)        /* don't drop error frames */
#define  OMR_RSF        (1U<<25)        /* 1: Rx store&forward, 0: immed. */
#define  OMR_DFF        (1U<<24)        /* don't flush rx frames on shortage */
#define  OMR_TSF        (1U<<21)        /* 1: Tx store&forward, 0: immed. */
#define  OMR_FTF        (1U<<20)        /* initiate tx FIFO reset, SC */
#define  OMR_TTC        (14)            /* 16:14 Tx threshold */
#define  OMR_ST         (1U<<13)        /* run Tx DMA engine, 0 to stop */
#define  OMR_RFD        (11)            /* 12:11 Rx FIFO fill level */
#define  OMR_EFC        (1U<<8)         /* transmit PAUSE to throttle Rx lvl. */
#define  OMR_FEF        (1U<<7)         /* allow to receive error frames */
#define  OMR_SR         (1U<<1)         /* run Rx DMA engine, 0 to stop */
#define GMACEVCS        0x1020          /* missed frame or ovf detected */
#define GMACRWDT        0x1024          /* enable rx watchdog timer interrupt */
#define GMACAXIB        0x1028          /* AXI bus mode control */
#define GMACAXIS        0x102c          /* AXI status report */
/* 0x1048 current tx desc address */
/* 0x104c current rx desc address */
/* 0x1050 current tx buffer address */
/* 0x1054 current rx buffer address */
#define HWFEA           0x1058          /* DWC feature report */
#define  FEA_EXDESC     (1U<<24)        /* alternative/enhanced desc layout */
#define  FEA_2COE       (1U<<18)        /* Rx type 2 IP checksum offload */
#define  FEA_1COE       (1U<<17)        /* Rx type 1 IP checksum offload */
#define  FEA_TXOE       (1U<<16)        /* Tx checksum offload */
#define  FEA_MMC        (1U<<11)        /* RMON event counter */

#define GMACEVCTL       0x0100          /* event counter control */
#define  EVC_FHP        (1U<<5)         /* full-half preset */
#define  EVC_CP         (1U<<4)         /* counter preset */
#define  EVC_MCF        (1U<<3)         /* counter freeze */
#define  EVC_ROR        (1U<<2)         /* auto-zero on counter read */
#define  EVC_CSR        (1U<<1)         /* counter stop rollover */
#define  EVC_CR         (1U<<0)         /* reset counters */
#define GMACEVCNT(i)    ((i)*4+0x114)   /* 80 event counters 0x114 - 0x284 */

/* 0x400-4ac L3/L4 control */

/*
 * flash memory layout
 * 0x00 - 07    48-bit MAC station address. 4 byte wise in BE order.
 * 0x08 - 0b    H->MAC xfer engine program start addr 63:32.
 * 0x0c - 0f    H2M program addr 31:0 (these are absolute addr, not offset)
 * 0x10 - 13    H2M program length in 4 byte count.
 * 0x14 - 0b    M->HOST xfer engine program start addr 63:32.
 * 0x18 - 0f    M2H program addr 31:0 (absolute addr, not relative)
 * 0x1c - 13    M2H program length in 4 byte count.
 * 0x20 - 23    packet engine program addr 31:0, (absolute addr, not offset)
 * 0x24 - 27    packet program length in 4 byte count.
 *
 * above ucode are loaded via mapped reg 0x210, 0x21c and 0x0c0.
 */

#define  _BMR           0x00412080      /* NetSec BMR value, magic spell */
/* NetSec uses local RAM to handle GMAC desc arrays */
#define  _RDLA          0x18000
#define  _TDLA          0x1c000
/* lower address region is used for intermediate frame data buffers */

/*
 * all below are software construction.
 */
#define MD_NTXDESC              128
#define MD_NRXDESC              64

#define MD_NTXSEGS              16
#define MD_TXQUEUELEN           8
#define MD_TXQUEUELEN_MASK      (MD_TXQUEUELEN - 1)
#define MD_TXQUEUE_GC           (MD_TXQUEUELEN / 4)
#define MD_NTXDESC_MASK (MD_NTXDESC - 1)
#define MD_NEXTTX(x)            (((x) + 1) & MD_NTXDESC_MASK)
#define MD_NEXTTXS(x)           (((x) + 1) & MD_TXQUEUELEN_MASK)

#define MD_NRXDESC_MASK (MD_NRXDESC - 1)
#define MD_NEXTRX(x)            (((x) + 1) & MD_NRXDESC_MASK)

struct control_data {
        struct tdes cd_txdescs[MD_NTXDESC];
        struct rdes cd_rxdescs[MD_NRXDESC];
};
#define SCX_CDOFF(x)            offsetof(struct control_data, x)
#define SCX_CDTXOFF(x)          SCX_CDOFF(cd_txdescs[(x)])
#define SCX_CDRXOFF(x)          SCX_CDOFF(cd_rxdescs[(x)])

struct scx_txsoft {
        struct mbuf *txs_mbuf;          /* head of our mbuf chain */
        bus_dmamap_t txs_dmamap;        /* our DMA map */
        int txs_firstdesc;              /* first descriptor in packet */
        int txs_lastdesc;               /* last descriptor in packet */
        int txs_ndesc;                  /* # of descriptors used */
};

struct scx_rxsoft {
        struct mbuf *rxs_mbuf;          /* head of our mbuf chain */
        bus_dmamap_t rxs_dmamap;        /* our DMA map */
};

struct scx_softc {
        device_t sc_dev;                /* generic device information */
        bus_space_tag_t sc_st;          /* bus space tag */
        bus_space_handle_t sc_sh;       /* bus space handle */
        bus_size_t sc_sz;               /* csr map size */
        bus_space_handle_t sc_eesh;     /* eeprom section handle */
        bus_size_t sc_eesz;             /* eeprom map size */
        bus_dma_tag_t sc_dmat;          /* bus DMA tag */
        struct ethercom sc_ethercom;    /* Ethernet common data */
        struct mii_data sc_mii;         /* MII */
        callout_t sc_callout;           /* PHY monitor callout */
        bus_dma_segment_t sc_seg;       /* descriptor store seg */
        int sc_nseg;                    /* descriptor store nseg */
        void *sc_ih;                    /* interrupt cookie */
        int sc_phy_id;                  /* PHY address */
        int sc_flowflags;               /* 802.3x PAUSE flow control */
        uint32_t sc_mdclk;              /* GAR 5:2 clock selection */
        uint32_t sc_t0cotso;            /* T0_CSUM | T0_TSO to run */
        int sc_miigmii;                 /* 1: MII/GMII, 0: RGMII */
        int sc_phandle;                 /* fdt phandle */
        uint64_t sc_freq;
        uint32_t sc_maxsize;

        bus_dmamap_t sc_cddmamap;       /* control data DMA map */
#define sc_cddma        sc_cddmamap->dm_segs[0].ds_addr

        struct control_data *sc_control_data;
#define sc_txdescs      sc_control_data->cd_txdescs
#define sc_rxdescs      sc_control_data->cd_rxdescs

        struct scx_txsoft sc_txsoft[MD_TXQUEUELEN];
        struct scx_rxsoft sc_rxsoft[MD_NRXDESC];
        int sc_txfree;                  /* number of free Tx descriptors */
        int sc_txnext;                  /* next ready Tx descriptor */
        int sc_txsfree;                 /* number of free Tx jobs */
        int sc_txsnext;                 /* next ready Tx job */
        int sc_txsdirty;                /* dirty Tx jobs */
        int sc_rxptr;                   /* next ready Rx descriptor/descsoft */

        krndsource_t rnd_source;        /* random source */
#ifdef GMAC_EVENT_COUNTERS
        /* 80 event counters exist */
#endif
};

#define SCX_CDTXADDR(sc, x)     ((sc)->sc_cddma + SCX_CDTXOFF((x)))
#define SCX_CDRXADDR(sc, x)     ((sc)->sc_cddma + SCX_CDRXOFF((x)))

#define SCX_CDTXSYNC(sc, x, n, ops)                                     \
do {                                                                    \
        int __x, __n;                                                   \
                                                                        \
        __x = (x);                                                      \
        __n = (n);                                                      \
                                                                        \
        /* If it will wrap around, sync to the end of the ring. */      \
        if ((__x + __n) > MD_NTXDESC) {                         \
                bus_dmamap_sync((sc)->sc_dmat, (sc)->sc_cddmamap,       \
                    SCX_CDTXOFF(__x), sizeof(struct tdes) *             \
                    (MD_NTXDESC - __x), (ops));                 \
                __n -= (MD_NTXDESC - __x);                              \
                __x = 0;                                                \
        }                                                               \
                                                                        \
        /* Now sync whatever is left. */                                \
        bus_dmamap_sync((sc)->sc_dmat, (sc)->sc_cddmamap,               \
            SCX_CDTXOFF(__x), sizeof(struct tdes) * __n, (ops));        \
} while (/*CONSTCOND*/0)

#define SCX_CDRXSYNC(sc, x, ops)                                        \
do {                                                                    \
        bus_dmamap_sync((sc)->sc_dmat, (sc)->sc_cddmamap,               \
            SCX_CDRXOFF((x)), sizeof(struct rdes), (ops));              \
} while (/*CONSTCOND*/0)

#define SCX_INIT_RXDESC(sc, x)                                          \
do {                                                                    \
        struct scx_rxsoft *__rxs = &(sc)->sc_rxsoft[(x)];               \
        struct rdes *__rxd = &(sc)->sc_rxdescs[(x)];                    \
        struct mbuf *__m = __rxs->rxs_mbuf;                             \
        bus_addr_t __p = __rxs->rxs_dmamap->dm_segs[0].ds_addr;         \
        bus_size_t __z = __rxs->rxs_dmamap->dm_segs[0].ds_len;          \
        __m->m_data = __m->m_ext.ext_buf;                               \
        __rxd->r3 = htole32(__z - 4);                                   \
        __rxd->r2 = htole32(BUS_ADDR_LO32(__p));                        \
        __rxd->r1 = htole32(BUS_ADDR_HI32(__p));                        \
        __rxd->r0 &= htole32(R0_LD);                                    \
        __rxd->r0 |= htole32(R0_OWN);                                   \
} while (/*CONSTCOND*/0)

/* memory mapped CSR register access */
#define CSR_READ(sc,off) \
            bus_space_read_4((sc)->sc_st, (sc)->sc_sh, (off))
#define CSR_WRITE(sc,off,val) \
            bus_space_write_4((sc)->sc_st, (sc)->sc_sh, (off), (val))

/* flash memory access */
#define EE_READ(sc,off) \
            bus_space_read_4((sc)->sc_st, (sc)->sc_eesh, (off))

static int scx_fdt_match(device_t, cfdata_t, void *);
static void scx_fdt_attach(device_t, device_t, void *);
static int scx_acpi_match(device_t, cfdata_t, void *);
static void scx_acpi_attach(device_t, device_t, void *);

CFATTACH_DECL_NEW(scx_fdt, sizeof(struct scx_softc),
    scx_fdt_match, scx_fdt_attach, NULL, NULL);

CFATTACH_DECL_NEW(scx_acpi, sizeof(struct scx_softc),
    scx_acpi_match, scx_acpi_attach, NULL, NULL);

static void scx_attach_i(struct scx_softc *);
static void scx_reset(struct scx_softc *);
static void scx_stop(struct ifnet *, int);
static int scx_init(struct ifnet *);
static int scx_ioctl(struct ifnet *, u_long, void *);
static void scx_set_rcvfilt(struct scx_softc *);
static void scx_start(struct ifnet *);
static void scx_watchdog(struct ifnet *);
static int scx_intr(void *);
static void txreap(struct scx_softc *);
static void rxfill(struct scx_softc *);
static int add_rxbuf(struct scx_softc *, int);
static void rxdrain(struct scx_softc *sc);
static void mii_statchg(struct ifnet *);
static void scx_ifmedia_sts(struct ifnet *, struct ifmediareq *);
static int mii_readreg(device_t, int, int, uint16_t *);
static int mii_writereg(device_t, int, int, uint16_t);
static void phy_tick(void *);
static void dump_hwfeature(struct scx_softc *);

static void resetuengine(struct scx_softc *);
static void loaducode(struct scx_softc *);
static void injectucode(struct scx_softc *, int, bus_addr_t, bus_size_t);
static void forcephyloopback(struct scx_softc *);
static void resetphytonormal(struct scx_softc *);

static int get_mdioclk(uint32_t);

#define WAIT_FOR_SET(sc, reg, set) \
        wait_for_bits(sc, reg, set, ~0, 0)
#define WAIT_FOR_CLR(sc, reg, clr) \
        wait_for_bits(sc, reg, 0, clr, 0)

static int
wait_for_bits(struct scx_softc *sc, int reg,
    uint32_t set, uint32_t clr, uint32_t fail)
{
        uint32_t val;
        int ntries;

        for (ntries = 0; ntries < 1000; ntries++) {
                val = CSR_READ(sc, reg);
                if ((val & set) || !(val & clr))
                        return 0;
                if (val & fail)
                        return 1;
                DELAY(1);
        }
        return 1;
}

/* GMAC register indirect access */
static int
mac_read(struct scx_softc *sc, int reg)
{

        CSR_WRITE(sc, MACCMD, reg | CMD_BUSY);
        (void)WAIT_FOR_CLR(sc, MACCMD, CMD_BUSY);
        return CSR_READ(sc, MACDATA);
}

static void
mac_write(struct scx_softc *sc, int reg, int val)
{

        CSR_WRITE(sc, MACDATA, val);
        CSR_WRITE(sc, MACCMD, reg | CMD_IOWR | CMD_BUSY);
        (void)WAIT_FOR_CLR(sc, MACCMD, CMD_BUSY);
}

/* dig and decode "clock-frequency" value for a given clkname */
static int
get_clk_freq(int phandle, const char *clkname)
{
        u_int index, n, cells;
        const u_int *p;
        int err, len, resid;
        unsigned int freq = 0;

        err = fdtbus_get_index(phandle, "clock-names", clkname, &index);
        if (err == -1)
                return -1;
        p = fdtbus_get_prop(phandle, "clocks", &len);
        if (p == NULL)
                return -1;
        for (n = 0, resid = len; resid > 0; n++) {
                const int cc_phandle =
                    fdtbus_get_phandle_from_native(be32toh(p[0]));
                if (of_getprop_uint32(cc_phandle, "#clock-cells", &cells))
                        return -1;
                if (n == index) {
                        if (of_getprop_uint32(cc_phandle,
                            "clock-frequency", &freq))
                                return -1;
                        return freq;
                }
                resid -= (cells + 1) * 4;
                p += (cells + 1) * 4;
        }
        return -1;
}

#define ATTACH_DEBUG 1

static const struct device_compatible_entry compat_data[] = {
        { .compat = "socionext,synquacer-netsec" },
        DEVICE_COMPAT_EOL
};
static const struct device_compatible_entry compatible[] = {
        { .compat = "SCX0001" },
        DEVICE_COMPAT_EOL
};

static int
scx_fdt_match(device_t parent, cfdata_t cf, void *aux)
{
        struct fdt_attach_args * const faa = aux;

        return of_compatible_match(faa->faa_phandle, compat_data);
}

static void
scx_fdt_attach(device_t parent, device_t self, void *aux)
{
        struct scx_softc * const sc = device_private(self);
        struct fdt_attach_args * const faa = aux;
        const int phandle = faa->faa_phandle;
        bus_space_handle_t bsh;
        bus_space_handle_t eebsh;
        bus_addr_t addr[2];
        bus_size_t size[2];
        void *intrh;
        char intrstr[128];
        int phy_phandle;
        const char *phy_mode;
        bus_addr_t phy_id;
        long ref_clk;

        if (fdtbus_get_reg(phandle, 0, addr+0, size+0) != 0
            || bus_space_map(faa->faa_bst, addr[0], size[0], 0, &bsh) != 0) {
                aprint_error(": unable to map registers\n");
                return;
        }
        if (fdtbus_get_reg(phandle, 1, addr+1, size+1) != 0
            || bus_space_map(faa->faa_bst, addr[1], size[1], 0, &eebsh) != 0) {
                aprint_error(": unable to map device eeprom\n");
                goto fail;
        }
        if (!fdtbus_intr_str(phandle, 0, intrstr, sizeof(intrstr))) {
                aprint_error(": failed to decode interrupt\n");
                goto fail;
        }

        phy_mode = fdtbus_get_string(phandle, "phy-mode");
        if (phy_mode == NULL)
                aprint_error(": missing 'phy-mode' property\n");
        phy_phandle = fdtbus_get_phandle(phandle, "phy-handle");
        if (phy_phandle == -1
            || fdtbus_get_reg(phy_phandle, 0, &phy_id, NULL) != 0)
                phy_id = MII_PHY_ANY;
        ref_clk = get_clk_freq(phandle, "phy_ref_clk");
        if (ref_clk == -1)
                ref_clk = 250 * 1000 * 1000;

#if ATTACH_DEBUG == 1
aprint_normal("\n");
aprint_normal_dev(self,
    "[FDT] phy mode %s, phy id %d, freq %ld\n",
    phy_mode, (int)phy_id, ref_clk);
aprint_normal("%s", device_xname(self));
#endif

        intrh = fdtbus_intr_establish(phandle, 0, IPL_NET,
                NOT_MP_SAFE, scx_intr, sc);
        if (intrh == NULL) {
                aprint_error(": couldn't establish interrupt\n");
                goto fail;
        }
        aprint_normal(" interrupt on %s", intrstr);

        sc->sc_dev = self;
        sc->sc_st = faa->faa_bst;
        sc->sc_sh = bsh;
        sc->sc_sz = size[0];
        sc->sc_eesh = eebsh;
        sc->sc_eesz = size[1];
        sc->sc_ih = intrh;
        sc->sc_dmat = faa->faa_dmat;
        sc->sc_phandle = phandle;
        sc->sc_phy_id = phy_id;
        sc->sc_freq = ref_clk;

        scx_attach_i(sc);

        return;
 fail:
        if (sc->sc_eesz)
                bus_space_unmap(sc->sc_st, sc->sc_eesh, sc->sc_eesz);
        if (sc->sc_sz)
                bus_space_unmap(sc->sc_st, sc->sc_sh, sc->sc_sz);
        return;
}

static int
scx_acpi_match(device_t parent, cfdata_t cf, void *aux)
{
        struct acpi_attach_args *aa = aux;

        return acpi_compatible_match(aa, compatible);
}

#define HWFEA_DEBUG 1

static void
scx_acpi_attach(device_t parent, device_t self, void *aux)
{
        struct scx_softc * const sc = device_private(self);
        struct acpi_attach_args * const aa = aux;
        ACPI_HANDLE handle = aa->aa_node->ad_handle;
        bus_space_handle_t bsh, eebsh;
        struct acpi_resources res;
        struct acpi_mem *mem, *mem1;
        struct acpi_irq *irq;
        ACPI_INTEGER max_spd, max_frame, phy_id, phy_freq;
        ACPI_STATUS rv;
        void *intrh;

        rv = acpi_resource_parse(self, handle, "_CRS",
            &res, &acpi_resource_parse_ops_default);
        if (ACPI_FAILURE(rv))
                return;
        mem = acpi_res_mem(&res, 0);
        irq = acpi_res_irq(&res, 0);
        if (mem == NULL || irq == NULL || mem->ar_length == 0) {
                aprint_error(": incomplete crs resources\n");
                goto done;
        }
        if (bus_space_map(aa->aa_memt, mem->ar_base, mem->ar_length, 0,
            &bsh) != 0) {
                aprint_error(": unable to map registers\n");
                goto done;
        }
        mem1 = acpi_res_mem(&res, 1); /* EEPROM for MAC address and ucode */
        if (mem1 == NULL || mem1->ar_length == 0) {
                aprint_error(": incomplete eeprom resources\n");
                goto fail_0;
        }
        if (bus_space_map(aa->aa_memt, mem1->ar_base, mem1->ar_length, 0,
            &eebsh)) {
                aprint_error(": unable to map device eeprom\n");
                goto fail_0;
        }
        rv = acpi_dsd_integer(handle, "max-speed", &max_spd);
        if (ACPI_FAILURE(rv))
                max_spd = 1000;
        rv = acpi_dsd_integer(handle, "max-frame-size", &max_frame);
        if (ACPI_FAILURE(rv))
                max_frame = 2048;
        rv = acpi_dsd_integer(handle, "phy-channel", &phy_id);
        if (ACPI_FAILURE(rv))
                phy_id = MII_PHY_ANY;
        rv = acpi_dsd_integer(handle, "socionext,phy-clock-frequency",
                        &phy_freq);
        if (ACPI_FAILURE(rv))
                phy_freq = 250 * 1000 * 1000;

#if ATTACH_DEBUG == 1
aprint_normal_dev(self,
    "[ACPI] max-speed %d, phy id %d, freq %ld\n",
    (int)max_spd, (int)phy_id, phy_freq);
aprint_normal("%s", device_xname(self));
#endif

        intrh = acpi_intr_establish(self, (uint64_t)(uintptr_t)handle,
            IPL_NET, NOT_MP_SAFE, scx_intr, sc, device_xname(self));
        if (intrh == NULL) {
                aprint_error(": couldn't establish interrupt\n");
                goto fail_1;
        }

        sc->sc_dev = self;
        sc->sc_st = aa->aa_memt;
        sc->sc_sh = bsh;
        sc->sc_sz = mem->ar_length;
        sc->sc_eesh = eebsh;
        sc->sc_eesz = mem1->ar_length;
        sc->sc_ih = intrh;
        sc->sc_dmat =
            BUS_DMA_TAG_VALID(aa->aa_dmat64) ? aa->aa_dmat64 : aa->aa_dmat;
        sc->sc_phy_id = (int)phy_id;
        sc->sc_freq = phy_freq;
        sc->sc_maxsize = max_frame;

        scx_attach_i(sc);
 done:
        acpi_resource_cleanup(&res);
        return;
 fail_1:
        bus_space_unmap(sc->sc_st, sc->sc_eesh, sc->sc_eesz);
 fail_0:
        bus_space_unmap(sc->sc_st, sc->sc_sh, sc->sc_sz);
        acpi_resource_cleanup(&res);
        return;
}

static void
scx_attach_i(struct scx_softc *sc)
{
        struct ifnet * const ifp = &sc->sc_ethercom.ec_if;
        struct mii_data * const mii = &sc->sc_mii;
        struct ifmedia * const ifm = &mii->mii_media;
        uint32_t which, dwimp, dwfea;
        uint8_t enaddr[ETHER_ADDR_LEN];
        bus_dma_segment_t seg;
        paddr_t p, q;
        uint32_t csr;
        int i, nseg, error = 0;

        which = CSR_READ(sc, HWVER);    /* Socionext version 5.xx */
        dwimp = mac_read(sc, GMACIMPL); /* DWC implementation XX.YY */
        dwfea = mac_read(sc, HWFEA);    /* DWC feature bits */

        aprint_naive("\n");
        aprint_normal(": Socionext NetSec Gigabit Ethernet controller "
            "%x.%x\n", which >> 16, which & 0xffff);

        aprint_normal_dev(sc->sc_dev,
            "DesignWare EMAC ver 0x%x (0x%x) hw feature %08x\n",
            dwimp & 0xff, dwimp >> 8, dwfea);
        dump_hwfeature(sc);

        /* detected PHY type */
        sc->sc_miigmii = ((dwfea & __BITS(30,28) >> 28) == 0);

        /* fetch MAC address in flash 0:7, stored in big endian order */
        csr = EE_READ(sc, 0x00);
        enaddr[0] = csr >> 24;
        enaddr[1] = csr >> 16;
        enaddr[2] = csr >> 8;
        enaddr[3] = csr;
        csr = EE_READ(sc, 0x04);
        enaddr[4] = csr >> 24;
        enaddr[5] = csr >> 16;
        aprint_normal_dev(sc->sc_dev,
            "Ethernet address %s\n", ether_sprintf(enaddr));

        sc->sc_mdclk = get_mdioclk(sc->sc_freq) << GAR_CLK; /* 5:2 clk ratio */

        mii->mii_ifp = ifp;
        mii->mii_readreg = mii_readreg;
        mii->mii_writereg = mii_writereg;
        mii->mii_statchg = mii_statchg;

        sc->sc_ethercom.ec_mii = mii;
        ifmedia_init(ifm, 0, ether_mediachange, scx_ifmedia_sts);
        mii_attach(sc->sc_dev, mii, 0xffffffff, sc->sc_phy_id,
            MII_OFFSET_ANY, MIIF_DOPAUSE);
        if (LIST_FIRST(&mii->mii_phys) == NULL) {
                ifmedia_add(ifm, IFM_ETHER | IFM_NONE, 0, NULL);
                ifmedia_set(ifm, IFM_ETHER | IFM_NONE);
        } else
                ifmedia_set(ifm, IFM_ETHER | IFM_AUTO);
        ifm->ifm_media = ifm->ifm_cur->ifm_media; /* as if user has requested */

        /*
         * Allocate the control data structures, and create and load the
         * DMA map for it.
         */
        error = bus_dmamem_alloc(sc->sc_dmat,
            sizeof(struct control_data), PAGE_SIZE, 0, &seg, 1, &nseg, 0);
        if (error != 0) {
                aprint_error_dev(sc->sc_dev,
                    "unable to allocate control data, error = %d\n", error);
                goto fail_0;
        }
        error = bus_dmamem_map(sc->sc_dmat, &seg, nseg,
            sizeof(struct control_data), (void **)&sc->sc_control_data,
            BUS_DMA_COHERENT);
        if (error != 0) {
                aprint_error_dev(sc->sc_dev,
                    "unable to map control data, error = %d\n", error);
                goto fail_1;
        }
        error = bus_dmamap_create(sc->sc_dmat,
            sizeof(struct control_data), 1,
            sizeof(struct control_data), 0, 0, &sc->sc_cddmamap);
        if (error != 0) {
                aprint_error_dev(sc->sc_dev,
                    "unable to create control data DMA map, "
                    "error = %d\n", error);
                goto fail_2;
        }
        error = bus_dmamap_load(sc->sc_dmat, sc->sc_cddmamap,
            sc->sc_control_data, sizeof(struct control_data), NULL, 0);
        if (error != 0) {
                aprint_error_dev(sc->sc_dev,
                    "unable to load control data DMA map, error = %d\n",
                    error);
                goto fail_3;
        }
        for (i = 0; i < MD_TXQUEUELEN; i++) {
                if ((error = bus_dmamap_create(sc->sc_dmat, MCLBYTES,
                    MD_NTXSEGS, MCLBYTES, 0, 0,
                    &sc->sc_txsoft[i].txs_dmamap)) != 0) {
                        aprint_error_dev(sc->sc_dev,
                            "unable to create tx DMA map %d, error = %d\n",
                            i, error);
                        goto fail_4;
                }
        }
        for (i = 0; i < MD_NRXDESC; i++) {
                if ((error = bus_dmamap_create(sc->sc_dmat, MCLBYTES,
                    1, MCLBYTES, 0, 0, &sc->sc_rxsoft[i].rxs_dmamap)) != 0) {
                        aprint_error_dev(sc->sc_dev,
                            "unable to create rx DMA map %d, error = %d\n",
                            i, error);
                        goto fail_5;
                }
                sc->sc_rxsoft[i].rxs_mbuf = NULL;
        }
        sc->sc_seg = seg;
        sc->sc_nseg = nseg;
#if 0
aprint_normal_dev(sc->sc_dev, "descriptor ds_addr %lx, ds_len %lx, nseg %d\n", seg.ds_addr, seg.ds_len, nseg);
#endif
        strlcpy(ifp->if_xname, device_xname(sc->sc_dev), IFNAMSIZ);
        ifp->if_softc = sc;
        ifp->if_flags = IFF_BROADCAST | IFF_SIMPLEX | IFF_MULTICAST;
        ifp->if_ioctl = scx_ioctl;
        ifp->if_start = scx_start;
        ifp->if_watchdog = scx_watchdog;
        ifp->if_init = scx_init;
        ifp->if_stop = scx_stop;
        IFQ_SET_READY(&ifp->if_snd);

        /* 802.1Q VLAN-sized frames, and 9000 jumbo frame are supported */
        sc->sc_ethercom.ec_capabilities |= ETHERCAP_VLAN_MTU;
        /* sc->sc_ethercom.ec_capabilities |= ETHERCAP_JUMBO_MTU; not yet */

        sc->sc_flowflags = 0; /* track PAUSE flow caps */

        if_attach(ifp);
        if_deferred_start_init(ifp, NULL);
        ether_ifattach(ifp, enaddr);

        callout_init(&sc->sc_callout, 0);
        callout_setfunc(&sc->sc_callout, phy_tick, sc);

        rnd_attach_source(&sc->rnd_source, device_xname(sc->sc_dev),
            RND_TYPE_NET, RND_FLAG_DEFAULT);

        resetuengine(sc);
        loaducode(sc);

        /* feed NetSec descriptor array base addresses and timer value */
        p = SCX_CDTXADDR(sc, 0);                /* tdes array (ring#0) */
        q = SCX_CDRXADDR(sc, 0);                /* rdes array (ring#1) */
        CSR_WRITE(sc, TDBA_LO, BUS_ADDR_LO32(p));
        CSR_WRITE(sc, TDBA_HI, BUS_ADDR_HI32(p));
        CSR_WRITE(sc, RDBA_LO, BUS_ADDR_LO32(q));
        CSR_WRITE(sc, RDBA_HI, BUS_ADDR_HI32(q));
        CSR_WRITE(sc, TXCONF, DESCNF_LE);       /* little endian */
        CSR_WRITE(sc, RXCONF, DESCNF_LE);       /* little endian */
        CSR_WRITE(sc, DMACTL_TMR, sc->sc_freq / 1000000 - 1);

        forcephyloopback(sc);/* make PHY loopback mode for uengine init */

        CSR_WRITE(sc, xINTSR, IRQ_UCODE); /* pre-cautional W1C */
        CSR_WRITE(sc, CORESTAT, 0);       /* start uengine to reprogram */
        error = WAIT_FOR_SET(sc, xINTSR, IRQ_UCODE);
        if (error) {
                aprint_error_dev(sc->sc_dev, "uengine start failed\n");
        }
        CSR_WRITE(sc, xINTSR, IRQ_UCODE); /* W1C load complete report */

        resetphytonormal(sc); /* take back PHY to normal mode */

        CSR_WRITE(sc, DMACTL_M2H, M2H_MODE_TRANS);
        CSR_WRITE(sc, PKTCTRL, MODENRM); /* change to use normal mode */
        error = WAIT_FOR_SET(sc, MODE_TRANS, T2N_DONE);
        if (error) {
                aprint_error_dev(sc->sc_dev, "uengine mode change failed\n");
        }

        CSR_WRITE(sc, TXISR, ~0);       /* clear pending emtpry/error irq */
        CSR_WRITE(sc, xINTAE_CLR, ~0);  /* disable tx / rx interrupts */

        return;

  fail_5:
        for (i = 0; i < MD_NRXDESC; i++) {
                if (sc->sc_rxsoft[i].rxs_dmamap != NULL)
                        bus_dmamap_destroy(sc->sc_dmat,
                            sc->sc_rxsoft[i].rxs_dmamap);
        }
  fail_4:
        for (i = 0; i < MD_TXQUEUELEN; i++) {
                if (sc->sc_txsoft[i].txs_dmamap != NULL)
                        bus_dmamap_destroy(sc->sc_dmat,
                            sc->sc_txsoft[i].txs_dmamap);
        }
        bus_dmamap_unload(sc->sc_dmat, sc->sc_cddmamap);
  fail_3:
        bus_dmamap_destroy(sc->sc_dmat, sc->sc_cddmamap);
  fail_2:
        bus_dmamem_unmap(sc->sc_dmat, (void *)sc->sc_control_data,
            sizeof(struct control_data));
  fail_1:
        bus_dmamem_free(sc->sc_dmat, &seg, nseg);
  fail_0:
        if (sc->sc_phandle)
                fdtbus_intr_disestablish(sc->sc_phandle, sc->sc_ih);
        else
                acpi_intr_disestablish(sc->sc_ih);
        bus_space_unmap(sc->sc_st, sc->sc_sh, sc->sc_sz);
        return;
}

static void
scx_reset(struct scx_softc *sc)
{
        int loop = 0, busy;

        mac_write(sc, GMACOMR, 0);
        mac_write(sc, GMACBMR, BMR_RST);
        do {
                DELAY(1);
                busy = mac_read(sc, GMACBMR) & BMR_RST;
        } while (++loop < 3000 && busy);
        mac_write(sc, GMACBMR, _BMR);
        mac_write(sc, GMACAFR, 0);
}

static void
scx_stop(struct ifnet *ifp, int disable)
{
        struct scx_softc *sc = ifp->if_softc;
        uint32_t csr;

        /* Stop the one second clock. */
        callout_stop(&sc->sc_callout);

        /* Down the MII. */
        mii_down(&sc->sc_mii);

        /* Mark the interface down and cancel the watchdog timer. */
        ifp->if_flags &= ~IFF_RUNNING;
        ifp->if_timer = 0;

        CSR_WRITE(sc, RXIE_CLR, ~0);
        CSR_WRITE(sc, TXIE_CLR, ~0);
        CSR_WRITE(sc, xINTAE_CLR, ~0);
        CSR_WRITE(sc, TXISR, ~0);
        CSR_WRITE(sc, RXISR, ~0);

        csr = mac_read(sc, GMACOMR);
        mac_write(sc, GMACOMR, csr &~ (OMR_SR | OMR_ST));
}

static int
scx_init(struct ifnet *ifp)
{
        struct scx_softc *sc = ifp->if_softc;
        const uint8_t *ea = CLLADDR(ifp->if_sadl);
        uint32_t csr;
        int i, error;

        /* Cancel pending I/O. */
        scx_stop(ifp, 0);

        /* Reset the chip to a known state. */
        scx_reset(sc);

        /* build sane Tx */
        memset(sc->sc_txdescs, 0, sizeof(struct tdes) * MD_NTXDESC);
        sc->sc_txdescs[MD_NTXDESC - 1].t0 = htole32(T0_LD); /* tie off */
        SCX_CDTXSYNC(sc, 0, MD_NTXDESC,
                    BUS_DMASYNC_PREREAD | BUS_DMASYNC_PREWRITE);
        sc->sc_txfree = MD_NTXDESC;
        sc->sc_txnext = 0;
        for (i = 0; i < MD_TXQUEUELEN; i++)
                sc->sc_txsoft[i].txs_mbuf = NULL;
        sc->sc_txsfree = MD_TXQUEUELEN;
        sc->sc_txsnext = 0;
        sc->sc_txsdirty = 0;

        /* load Rx descriptors with fresh mbuf */
        for (i = 0; i < MD_NRXDESC; i++) {
                if (sc->sc_rxsoft[i].rxs_mbuf == NULL) {
                        if ((error = add_rxbuf(sc, i)) != 0) {
                                aprint_error_dev(sc->sc_dev,
                                    "unable to allocate or map rx "
                                    "buffer %d, error = %d\n",
                                    i, error);
                                rxdrain(sc);
                                goto out;
                        }
                }
                else
                        SCX_INIT_RXDESC(sc, i);
        }
        sc->sc_rxdescs[MD_NRXDESC - 1].r0 = htole32(R0_LD); /* tie off */
        sc->sc_rxptr = 0;

        /* set my address in perfect match slot 0. little endian order */
        csr = (ea[3] << 24) | (ea[2] << 16) | (ea[1] << 8) |  ea[0];
        mac_write(sc, GMACMAL0, csr);
        csr = (ea[5] << 8) | ea[4];
        mac_write(sc, GMACMAH0, csr);

        /* accept multicast frame or run promisc mode */
        scx_set_rcvfilt(sc);

        /* set current media */
        if ((error = ether_mediachange(ifp)) != 0)
                goto out;

        CSR_WRITE(sc, DESC_SRST, 01);
        WAIT_FOR_CLR(sc, DESC_SRST, 01);

        CSR_WRITE(sc, DESC_INIT, 01);
        WAIT_FOR_CLR(sc, DESC_INIT, 01);

        /* feed local memory descriptor array base addresses */
        mac_write(sc, GMACRDLA, _RDLA);         /* GMAC rdes store */
        mac_write(sc, GMACTDLA, _TDLA);         /* GMAC tdes store */

        CSR_WRITE(sc, FLOWTHR, (48<<16) | 36);  /* pause|resume threshold */
        mac_write(sc, GMACFCR, 256 << 16);      /* 31:16 pause value */

        CSR_WRITE(sc, INTF_SEL, sc->sc_miigmii ? INTF_GMII : INTF_RGMII);

        CSR_WRITE(sc, RXCOALESC, 8);            /* Rx coalesce bound */
        CSR_WRITE(sc, TXCOALESC, 8);            /* Tx coalesce bound */
        CSR_WRITE(sc, RCLSCTIME, 500);          /* Rx co. guard time usec */
        CSR_WRITE(sc, TCLSCTIME, 500);          /* Tx co. guard time usec */

        CSR_WRITE(sc, RXIE_SET, RXI_RC_ERR | RXI_PKTCNT | RXI_TMREXP);
        CSR_WRITE(sc, TXIE_SET, TXI_TR_ERR | TXI_TXDONE | TXI_TMREXP);
        CSR_WRITE(sc, xINTAE_SET, IRQ_RX | IRQ_TX);
#if 1
        /* clear event counters, auto-zero after every read */
        mac_write(sc, GMACEVCTL, EVC_CR | EVC_ROR);
#endif
        /* kick to start GMAC engine */
        csr = mac_read(sc, GMACOMR);
        mac_write(sc, GMACOMR, csr | OMR_SR | OMR_ST);

        ifp->if_flags |= IFF_RUNNING;

        /* start one second timer */
        callout_schedule(&sc->sc_callout, hz);
 out:
        return error;
}

static int
scx_ioctl(struct ifnet *ifp, u_long cmd, void *data)
{
        struct scx_softc *sc = ifp->if_softc;
        struct ifreq *ifr = (struct ifreq *)data;
        struct ifmedia *ifm = &sc->sc_mii.mii_media;
        int s, error;

        s = splnet();

        switch (cmd) {
        case SIOCSIFMEDIA:
                /* Flow control requires full-duplex mode. */
                if (IFM_SUBTYPE(ifr->ifr_media) == IFM_AUTO ||
                    (ifr->ifr_media & IFM_FDX) == 0)
                        ifr->ifr_media &= ~IFM_ETH_FMASK;
                if (IFM_SUBTYPE(ifr->ifr_media) != IFM_AUTO) {
                        if ((ifr->ifr_media & IFM_ETH_FMASK) == IFM_FLOW) {
                                /* We can do both TXPAUSE and RXPAUSE. */
                                ifr->ifr_media |=
                                    IFM_ETH_TXPAUSE | IFM_ETH_RXPAUSE;
                        }
                        sc->sc_flowflags = ifr->ifr_media & IFM_ETH_FMASK;
                }
                error = ifmedia_ioctl(ifp, ifr, ifm, cmd);
                break;
        default:
                error = ether_ioctl(ifp, cmd, data);
                if (error != ENETRESET)
                        break;
                error = 0;
                if (cmd == SIOCSIFCAP)
                        error = if_init(ifp);
                if (cmd != SIOCADDMULTI && cmd != SIOCDELMULTI)
                        ;
                else if (ifp->if_flags & IFF_RUNNING) {
                        /*
                         * Multicast list has changed; set the hardware filter
                         * accordingly.
                         */
                        scx_set_rcvfilt(sc);
                }
                break;
        }

        splx(s);
        return error;
}

static uint32_t
bit_reverse_32(uint32_t x)
{
        x = (((x & 0xaaaaaaaa) >> 1) | ((x & 0x55555555) << 1));
        x = (((x & 0xcccccccc) >> 2) | ((x & 0x33333333) << 2));
        x = (((x & 0xf0f0f0f0) >> 4) | ((x & 0x0f0f0f0f) << 4));
        x = (((x & 0xff00ff00) >> 8) | ((x & 0x00ff00ff) << 8));
        return (x >> 16) | (x << 16);
}

#define MCAST_DEBUG 0

static void
scx_set_rcvfilt(struct scx_softc *sc)
{
        struct ethercom * const ec = &sc->sc_ethercom;
        struct ifnet * const ifp = &ec->ec_if;
        struct ether_multistep step;
        struct ether_multi *enm;
        uint32_t mchash[2];     /* 2x 32 = 64 bit */
        uint32_t csr, crc;
        int i;

        csr = mac_read(sc, GMACAFR);
        csr &= ~(AFR_PR | AFR_PM | AFR_MHTE | AFR_HPF);
        mac_write(sc, GMACAFR, csr);

        /* clear 15 entry supplemental perfect match filter */
        for (i = 1; i < 16; i++)
                 mac_write(sc, GMACMAH(i), 0);
        /* build 64 bit multicast hash filter */
        crc = mchash[1] = mchash[0] = 0;

        ETHER_LOCK(ec);
        if (ifp->if_flags & IFF_PROMISC) {
                ec->ec_flags |= ETHER_F_ALLMULTI;
                ETHER_UNLOCK(ec);
                /* run promisc. mode */
                csr |= AFR_PR;
                goto update;
        }
        ec->ec_flags &= ~ETHER_F_ALLMULTI;
        ETHER_FIRST_MULTI(step, ec, enm);
        i = 1; /* slot 0 is occupied */
        while (enm != NULL) {
                if (memcmp(enm->enm_addrlo, enm->enm_addrhi, ETHER_ADDR_LEN)) {
                        /*
                         * We must listen to a range of multicast addresses.
                         * For now, just accept all multicasts, rather than
                         * trying to set only those filter bits needed to match
                         * the range.  (At this time, the only use of address
                         * ranges is for IP multicast routing, for which the
                         * range is big enough to require all bits set.)
                         */
                        ec->ec_flags |= ETHER_F_ALLMULTI;
                        ETHER_UNLOCK(ec);
                        /* accept all multi */
                        csr |= AFR_PM;
                        goto update;
                }
#if MCAST_DEBUG == 1
aprint_normal_dev(sc->sc_dev, "[%d] %s\n", i, ether_sprintf(enm->enm_addrlo));
#endif
                if (i < 16) {
                        /* use 15 entry perfect match filter */
                        uint32_t addr;
                        uint8_t *ep = enm->enm_addrlo;
                        addr = (ep[3] << 24) | (ep[2] << 16)
                             | (ep[1] <<  8) |  ep[0];
                        mac_write(sc, GMACMAL(i), addr);
                        addr = (ep[5] << 8) | ep[4];
                        mac_write(sc, GMACMAH(i), addr | 1U<<31);
                } else {
                        /* use hash table when too many */
                        crc = ether_crc32_le(enm->enm_addrlo, ETHER_ADDR_LEN);
                        crc = bit_reverse_32(~crc);
                        /* 1(31) 5(30:26) bit sampling */
                        mchash[crc >> 31] |= 1 << ((crc >> 26) & 0x1f);
                }
                ETHER_NEXT_MULTI(step, enm);
                i++;
        }
        ETHER_UNLOCK(ec);
        if (crc)
                csr |= AFR_MHTE; /* use mchash[] */
        csr |= AFR_HPF; /* use perfect match as well */
 update:
        mac_write(sc, GMACMHTH, mchash[1]);
        mac_write(sc, GMACMHTL, mchash[0]);
        mac_write(sc, GMACAFR, csr);
        return;
}

static void
scx_start(struct ifnet *ifp)
{
        struct scx_softc *sc = ifp->if_softc;
        struct mbuf *m0;
        struct scx_txsoft *txs;
        bus_dmamap_t dmamap;
        int error, nexttx, lasttx, ofree, seg;
        uint32_t tdes0;

        if ((ifp->if_flags & IFF_RUNNING) == 0)
                return;

        /* Remember the previous number of free descriptors. */
        ofree = sc->sc_txfree;
        /*
         * Loop through the send queue, setting up transmit descriptors
         * until we drain the queue, or use up all available transmit
         * descriptors.
         */
        for (;;) {
                IFQ_POLL(&ifp->if_snd, m0);
                if (m0 == NULL)
                        break;
                if (sc->sc_txsfree < MD_TXQUEUE_GC) {
                        txreap(sc);
                        if (sc->sc_txsfree == 0)
                                break;
                }
                txs = &sc->sc_txsoft[sc->sc_txsnext];
                dmamap = txs->txs_dmamap;
                error = bus_dmamap_load_mbuf(sc->sc_dmat, dmamap, m0,
                    BUS_DMA_WRITE | BUS_DMA_NOWAIT);
                if (error) {
                        if (error == EFBIG) {
                                aprint_error_dev(sc->sc_dev,
                                    "Tx packet consumes too many "
                                    "DMA segments, dropping...\n");
                                IFQ_DEQUEUE(&ifp->if_snd, m0);
                                m_freem(m0);
                                if_statinc(ifp, if_oerrors);
                                continue;
                        }
                        /* Short on resources, just stop for now. */
                        break;
                }
                if (dmamap->dm_nsegs > sc->sc_txfree) {
                        /*
                         * Not enough free descriptors to transmit this
                         * packet.  We haven't committed anything yet,
                         * so just unload the DMA map, put the packet
                         * back on the queue, and punt.
                         */
                        bus_dmamap_unload(sc->sc_dmat, dmamap);
                        break;
                }

                IFQ_DEQUEUE(&ifp->if_snd, m0);
                /*
                 * WE ARE NOW COMMITTED TO TRANSMITTING THE PACKET.
                 */
                bus_dmamap_sync(sc->sc_dmat, dmamap, 0, dmamap->dm_mapsize,
                    BUS_DMASYNC_PREWRITE);

                tdes0 = 0; /* to postpone 1st segment T0_OWN write */
                lasttx = -1;
                for (nexttx = sc->sc_txnext, seg = 0;
                     seg < dmamap->dm_nsegs;
                     seg++, nexttx = MD_NEXTTX(nexttx)) {
                        struct tdes *tdes = &sc->sc_txdescs[nexttx];
                        bus_addr_t p = dmamap->dm_segs[seg].ds_addr;
                        bus_size_t z = dmamap->dm_segs[seg].ds_len;
                        /*
                         * If this is the first descriptor we're
                         * enqueueing, don't set the OWN bit just
                         * yet.  That could cause a race condition.
                         * We'll do it below.
                         */
                        tdes->t3 = htole32(z);
                        tdes->t2 = htole32(BUS_ADDR_LO32(p));
                        tdes->t1 = htole32(BUS_ADDR_HI32(p));
                        tdes->t0 &= htole32(T0_LD);
                        tdes->t0 |= htole32(tdes0 |
                                        (15 << T0_TDRID) | T0_PT |
                                        sc->sc_t0cotso | T0_TRS);
                        tdes0 = T0_OWN; /* 2nd and other segments */
                        /* NB; t0 DRID field contains zero */
                        lasttx = nexttx;
                }

                /* HW lacks of per-frame xmit done interrupt control */

                /* Write deferred 1st segment T0_OWN at the final stage */
                sc->sc_txdescs[lasttx].t0 |= htole32(T0_LS);
                sc->sc_txdescs[sc->sc_txnext].t0 |= htole32(T0_FS | T0_OWN);
                SCX_CDTXSYNC(sc, sc->sc_txnext, dmamap->dm_nsegs,
                    BUS_DMASYNC_PREREAD | BUS_DMASYNC_PREWRITE);

                /* submit one frame to xmit */
                CSR_WRITE(sc, TXSUBMIT, 1);

                txs->txs_mbuf = m0;
                txs->txs_firstdesc = sc->sc_txnext;
                txs->txs_lastdesc = lasttx;
                txs->txs_ndesc = dmamap->dm_nsegs;
                sc->sc_txfree -= txs->txs_ndesc;
                sc->sc_txnext = nexttx;
                sc->sc_txsfree--;
                sc->sc_txsnext = MD_NEXTTXS(sc->sc_txsnext);
                /*
                 * Pass the packet to any BPF listeners.
                 */
                bpf_mtap(ifp, m0, BPF_D_OUT);
        }
        if (sc->sc_txfree != ofree) {
                /* Set a watchdog timer in case the chip flakes out. */
                ifp->if_timer = 5;
        }
}

#define EVENT_DEBUG 1

static void
scx_watchdog(struct ifnet *ifp)
{
        struct scx_softc *sc = ifp->if_softc;

        /*
         * Since we're not interrupting every packet, sweep
         * up before we report an error.
         */
        txreap(sc);

        if (sc->sc_txfree != MD_NTXDESC) {
                aprint_error_dev(sc->sc_dev,
                    "device timeout (txfree %d txsfree %d txnext %d)\n",
                    sc->sc_txfree, sc->sc_txsfree, sc->sc_txnext);
                if_statinc(ifp, if_oerrors);
#if EVENT_DEBUG == 1
aprint_error_dev(sc->sc_dev,
    "tx frames %d, octects %d, bcast %d, mcast %d\n",
    mac_read(sc, GMACEVCNT(1)),
    mac_read(sc, GMACEVCNT(0)),
    mac_read(sc, GMACEVCNT(2)),
    mac_read(sc, GMACEVCNT(3)));
aprint_error_dev(sc->sc_dev,
    "rx frames %d, octects %d, bcast %d, mcast %d\n",
    mac_read(sc, GMACEVCNT(27)),
    mac_read(sc, GMACEVCNT(28)),
    mac_read(sc, GMACEVCNT(30)),
    mac_read(sc, GMACEVCNT(31)));
aprint_error_dev(sc->sc_dev,
    "current tdes addr %x, buf addr %x\n",
    mac_read(sc, 0x1048), mac_read(sc, 0x1050));
aprint_error_dev(sc->sc_dev,
    "current rdes addr %x, buf addr %x\n",
    mac_read(sc, 0x104c), mac_read(sc, 0x1054));
#endif
                /* Reset the interface. */
                scx_init(ifp);
        }

        scx_start(ifp);
}

static int
scx_intr(void *arg)
{
        struct scx_softc *sc = arg;
        uint32_t enable, status;

        status = CSR_READ(sc, xINTSR); /* not W1C */
        enable = CSR_READ(sc, xINTAEN);
        if ((status & enable) == 0)
                return 0;
        if (status & (IRQ_TX | IRQ_RX)) {
                CSR_WRITE(sc, xINTAE_CLR, (IRQ_TX | IRQ_RX));

                status = CSR_READ(sc, RXISR);
                CSR_WRITE(sc, RXISR, status);
                if (status & RXI_RC_ERR)
                        aprint_error_dev(sc->sc_dev, "Rx error\n");
                if (status & (RXI_PKTCNT | RXI_TMREXP)) {
                        rxfill(sc);
                        (void)CSR_READ(sc, RXAVAILCNT); /* clear IRQ_RX ? */
                }

                status = CSR_READ(sc, TXISR);
                CSR_WRITE(sc, TXISR, status);
                if (status & TXI_TR_ERR)
                        aprint_error_dev(sc->sc_dev, "Tx error\n");
                if (status & (TXI_TXDONE | TXI_TMREXP)) {
                        txreap(sc);
                        (void)CSR_READ(sc, TXDONECNT); /* clear IRQ_TX ? */
                }

                CSR_WRITE(sc, xINTAE_SET, (IRQ_TX | IRQ_RX));
        }
        return 1;
}

static void
txreap(struct scx_softc *sc)
{
        struct ifnet *ifp = &sc->sc_ethercom.ec_if;
        struct scx_txsoft *txs;
        uint32_t txstat;
        int i;

        for (i = sc->sc_txsdirty; sc->sc_txsfree != MD_TXQUEUELEN;
             i = MD_NEXTTXS(i), sc->sc_txsfree++) {
                txs = &sc->sc_txsoft[i];

                SCX_CDTXSYNC(sc, txs->txs_firstdesc, txs->txs_ndesc,
                    BUS_DMASYNC_POSTREAD | BUS_DMASYNC_POSTWRITE);

                txstat = le32toh(sc->sc_txdescs[txs->txs_lastdesc].t0);
                if (txstat & T0_OWN) /* desc is still in use */
                        break;

                /* There is no way to tell transmission status per frame */

                if_statinc(ifp, if_opackets);

                sc->sc_txfree += txs->txs_ndesc;
                bus_dmamap_sync(sc->sc_dmat, txs->txs_dmamap,
                    0, txs->txs_dmamap->dm_mapsize, BUS_DMASYNC_POSTWRITE);
                bus_dmamap_unload(sc->sc_dmat, txs->txs_dmamap);
                m_freem(txs->txs_mbuf);
                txs->txs_mbuf = NULL;
        }
        sc->sc_txsdirty = i;
        if (sc->sc_txsfree == MD_TXQUEUELEN)
                ifp->if_timer = 0;
}

static void
rxfill(struct scx_softc *sc)
{
        struct ifnet *ifp = &sc->sc_ethercom.ec_if;
        struct scx_rxsoft *rxs;
        struct mbuf *m;
        uint32_t rxstat, rlen;
        int i;

        for (i = sc->sc_rxptr; /*CONSTCOND*/ 1; i = MD_NEXTRX(i)) {
                SCX_CDRXSYNC(sc, i,
                    BUS_DMASYNC_POSTREAD | BUS_DMASYNC_POSTWRITE);

                rxstat = le32toh(sc->sc_rxdescs[i].r0);
                if (rxstat & R0_OWN) /* desc is left empty */
                        break;

                /* received frame length in R3 31:16 */
                rlen = le32toh(sc->sc_rxdescs[i].r3) >> 16;

                /* R0_FS | R0_LS must have been marked for this desc */
                rxs = &sc->sc_rxsoft[i];
                bus_dmamap_sync(sc->sc_dmat, rxs->rxs_dmamap, 0,
                    rxs->rxs_dmamap->dm_mapsize, BUS_DMASYNC_POSTREAD);

                /* dispense new storage to receive frame */
                m = rxs->rxs_mbuf;
                if (add_rxbuf(sc, i) != 0) {
                        if_statinc(ifp, if_ierrors);    /* resource shortage */
                        SCX_INIT_RXDESC(sc, i);         /* then reuse */
                        bus_dmamap_sync(sc->sc_dmat,
                            rxs->rxs_dmamap, 0,
                            rxs->rxs_dmamap->dm_mapsize,
                            BUS_DMASYNC_PREREAD);
                        continue;
                }
                /* complete mbuf */
                m_set_rcvif(m, ifp);
                m->m_pkthdr.len = m->m_len = rlen;
                m->m_flags |= M_HASFCS;
                if (rxstat & R0_CSUM) {
                        uint32_t csum = M_CSUM_IPv4;
                        if (rxstat & R0_CERR)
                                csum |= M_CSUM_IPv4_BAD;
                        m->m_pkthdr.csum_flags |= csum;
                }
                /* and pass to upper layer */
                if_percpuq_enqueue(ifp->if_percpuq, m);
        }
        sc->sc_rxptr = i;
}

static int
add_rxbuf(struct scx_softc *sc, int i)
{
        struct scx_rxsoft *rxs = &sc->sc_rxsoft[i];
        struct mbuf *m;
        int error;

        MGETHDR(m, M_DONTWAIT, MT_DATA);
        if (m == NULL)
                return ENOBUFS;
        MCLGET(m, M_DONTWAIT);
        if ((m->m_flags & M_EXT) == 0) {
                m_freem(m);
                return ENOBUFS;
        }
        if (rxs->rxs_mbuf != NULL)
                bus_dmamap_unload(sc->sc_dmat, rxs->rxs_dmamap);
        rxs->rxs_mbuf = m;
        error = bus_dmamap_load(sc->sc_dmat, rxs->rxs_dmamap,
            m->m_ext.ext_buf, m->m_ext.ext_size, NULL, BUS_DMA_NOWAIT);
        if (error) {
                aprint_error_dev(sc->sc_dev,
                    "can't load rx DMA map %d, error = %d\n", i, error);
                panic("add_rxbuf");
        }
        bus_dmamap_sync(sc->sc_dmat, rxs->rxs_dmamap, 0,
            rxs->rxs_dmamap->dm_mapsize, BUS_DMASYNC_PREREAD);
        SCX_INIT_RXDESC(sc, i);

        return 0;
}

static void
rxdrain(struct scx_softc *sc)
{
        struct scx_rxsoft *rxs;
        int i;

        for (i = 0; i < MD_NRXDESC; i++) {
                rxs = &sc->sc_rxsoft[i];
                if (rxs->rxs_mbuf != NULL) {
                        bus_dmamap_unload(sc->sc_dmat, rxs->rxs_dmamap);
                        m_freem(rxs->rxs_mbuf);
                        rxs->rxs_mbuf = NULL;
                }
        }
}

#define LINK_DEBUG 0

static void
mii_statchg(struct ifnet *ifp)
{
        struct scx_softc *sc = ifp->if_softc;
        struct mii_data *mii = &sc->sc_mii;
        const int Mbps[4] = { 10, 100, 1000, 0 };
        uint32_t miisr, mcr, fcr;
        int spd;

        /* decode MIISR register value */
        miisr = mac_read(sc, GMACMIISR);
        spd = Mbps[(miisr & MIISR_SPD) >> 1];
#if LINK_DEBUG == 1
        static uint32_t oldmiisr = 0;
        if (miisr != oldmiisr) {
                printf("MII link status (0x%x) %s",
                    miisr, (miisr & MIISR_LUP) ? "up" : "down");
                if (miisr & MIISR_LUP) {
                        printf(" spd%d", spd);
                        if (miisr & MIISR_FDX)
                                printf(",full-duplex");
                }
                printf("\n");
        }
#endif
        /* Get flow control negotiation result. */
        if (IFM_SUBTYPE(mii->mii_media.ifm_cur->ifm_media) == IFM_AUTO &&
            (mii->mii_media_active & IFM_ETH_FMASK) != sc->sc_flowflags)
                sc->sc_flowflags = mii->mii_media_active & IFM_ETH_FMASK;

        /* Adjust speed 1000/100/10. */
        mcr = mac_read(sc, GMACMCR) &~ (MCR_PS | MCR_FES);
        if (sc->sc_miigmii) {
                if (spd != 1000)
                        mcr |= MCR_PS;
        } else {
                if (spd == 100)
                        mcr |= MCR_FES;
        }
        mcr |= MCR_CST | MCR_JE;
        if (sc->sc_miigmii == 0)
                mcr |= MCR_IBN;

        /* Adjust duplexity and PAUSE flow control. */
        mcr &= ~MCR_USEFDX;
        fcr = mac_read(sc, GMACFCR) & ~(FCR_TFE | FCR_RFE);
        if (miisr & MIISR_FDX) {
                if (sc->sc_flowflags & IFM_ETH_TXPAUSE)
                        fcr |= FCR_TFE;
                if (sc->sc_flowflags & IFM_ETH_RXPAUSE)
                        fcr |= FCR_RFE;
                mcr |= MCR_USEFDX;
        }
        mac_write(sc, GMACMCR, mcr);
        mac_write(sc, GMACFCR, fcr);
#if LINK_DEBUG == 1
        if (miisr != oldmiisr) {
                printf("%ctxfe, %crxfe\n",
                    (fcr & FCR_TFE) ? '+' : '-',
                    (fcr & FCR_RFE) ? '+' : '-');
        }
        oldmiisr = miisr;
#endif
}

static void
scx_ifmedia_sts(struct ifnet *ifp, struct ifmediareq *ifmr)
{
        struct scx_softc *sc = ifp->if_softc;
        struct mii_data *mii = &sc->sc_mii;

        mii_pollstat(mii);
        ifmr->ifm_status = mii->mii_media_status;
        ifmr->ifm_active = sc->sc_flowflags |
            (mii->mii_media_active & ~IFM_ETH_FMASK);
}

static int
mii_readreg(device_t self, int phy, int reg, uint16_t *val)
{
        struct scx_softc *sc = device_private(self);
        uint32_t miia;
        int ntries;

        miia = (phy << GAR_PHY) | (reg << GAR_REG) | sc->sc_mdclk;
        mac_write(sc, GMACGAR, miia | GAR_BUSY);
        for (ntries = 0; ntries < 1000; ntries++) {
                if ((mac_read(sc, GMACGAR) & GAR_BUSY) == 0)
                        goto unbusy;
                DELAY(1);
        }
        return ETIMEDOUT;
 unbusy:
        *val = mac_read(sc, GMACGDR);
        return 0;
}

static int
mii_writereg(device_t self, int phy, int reg, uint16_t val)
{
        struct scx_softc *sc = device_private(self);
        uint32_t miia;
        uint16_t dummy;
        int ntries;

        miia = (phy << GAR_PHY) | (reg << GAR_REG) | sc->sc_mdclk;
        mac_write(sc, GMACGDR, val);
        mac_write(sc, GMACGAR, miia | GAR_IOWR | GAR_BUSY);
        for (ntries = 0; ntries < 1000; ntries++) {
                if ((mac_read(sc, GMACGAR) & GAR_BUSY) == 0)
                        goto unbusy;
                DELAY(1);
        }
        return ETIMEDOUT;       
  unbusy:
        mii_readreg(self, phy, MII_PHYIDR1, &dummy); /* dummy read cycle */
        return 0;
}

static void
phy_tick(void *arg)
{
        struct scx_softc *sc = arg;
        struct mii_data *mii = &sc->sc_mii;
        int s;

        s = splnet();
        mii_tick(mii);
        splx(s);
#ifdef GMAC_EVENT_COUNTERS
        /* 80 event counters exist */
#endif
        callout_schedule(&sc->sc_callout, hz);
}

static void
resetuengine(struct scx_softc *sc)
{

        if (CSR_READ(sc, CORESTAT) == 0) {
                /* make sure to stop */
                CSR_WRITE(sc, DMACTL_H2M, DMACTL_STOP);
                CSR_WRITE(sc, DMACTL_M2H, DMACTL_STOP);
                WAIT_FOR_CLR(sc, DMACTL_H2M, DMACTL_STOP);
                WAIT_FOR_CLR(sc, DMACTL_M2H, DMACTL_STOP);
        }
        CSR_WRITE(sc, SWRESET, 0);              /* reset operation */
        CSR_WRITE(sc, SWRESET, SRST_RUN);       /* manifest run */
        CSR_WRITE(sc, COMINIT, INIT_DB | INIT_CLS);
        WAIT_FOR_CLR(sc, COMINIT, (INIT_DB | INIT_CLS));
}

#define UCODE_DEBUG 0

/*
 * 3 independent uengines exist to process host2media, media2host and
 * packet data flows.
 */
static void
loaducode(struct scx_softc *sc)
{
        uint32_t up, lo, sz;
        uint64_t addr;

        up = EE_READ(sc, 0x08); /* H->M ucode addr high */
        lo = EE_READ(sc, 0x0c); /* H->M ucode addr low */
        sz = EE_READ(sc, 0x10); /* H->M ucode size */
        sz *= 4;
        addr = ((uint64_t)up << 32) | lo;
        injectucode(sc, UCODE_H2M, (bus_addr_t)addr, (bus_size_t)sz);
#if UCODE_DEBUG == 1
aprint_normal_dev(sc->sc_dev, "0x%x H2M ucode %u\n", lo, sz);
#endif

        up = EE_READ(sc, 0x14); /* M->H ucode addr high */
        lo = EE_READ(sc, 0x18); /* M->H ucode addr low */
        sz = EE_READ(sc, 0x1c); /* M->H ucode size */
        sz *= 4;
        addr = ((uint64_t)up << 32) | lo;
        injectucode(sc, UCODE_M2H, (bus_addr_t)addr, (bus_size_t)sz);
#if UCODE_DEBUG == 1
aprint_normal_dev(sc->sc_dev, "0x%x M2H ucode %u\n", lo, sz);
#endif

        lo = EE_READ(sc, 0x20); /* PKT ucode addr */
        sz = EE_READ(sc, 0x24); /* PKT ucode size */
        sz *= 4;
        injectucode(sc, UCODE_PKT, (bus_addr_t)lo, (bus_size_t)sz);
#if UCODE_DEBUG == 1
aprint_normal_dev(sc->sc_dev, "0x%x PKT ucode %u\n", lo, sz);
#endif
}

static void
injectucode(struct scx_softc *sc, int port,
        bus_addr_t addr, bus_size_t size)
{
        bus_space_handle_t bsh;
        bus_size_t off;
        uint32_t ucode;

        if (bus_space_map(sc->sc_st, addr, size, 0, &bsh) != 0) {
                aprint_error_dev(sc->sc_dev,
                    "eeprom map failure for ucode port 0x%x\n", port);
                return;
        }
        for (off = 0; off < size; off += 4) {
                ucode = bus_space_read_4(sc->sc_st, bsh, off);
                CSR_WRITE(sc, port, ucode);
        }
        bus_space_unmap(sc->sc_st, bsh, size);
}

static void
forcephyloopback(struct scx_softc *sc)
{
        struct device *d = sc->sc_dev;
        uint16_t val;
        int loop, err;

        err = mii_readreg(d, sc->sc_phy_id, MII_BMCR, &val);
        if (err) {
                aprint_error_dev(d, "forcephyloopback() failed\n");
                return;
        }
        if (val & BMCR_PDOWN)
                val &=  ~BMCR_PDOWN;
        val |= BMCR_ISO;
        (void)mii_writereg(d, sc->sc_phy_id, MII_BMCR, val);
        loop = 100;
        do {
                (void)mii_readreg(d, sc->sc_phy_id, MII_BMCR, &val);
        } while (loop-- > 0 && (val & (BMCR_PDOWN | BMCR_ISO)) != 0);
        (void)mii_writereg(d, sc->sc_phy_id, MII_BMCR, val | BMCR_LOOP);
        loop = 100;
        do {
                (void)mii_readreg(d, sc->sc_phy_id, MII_BMSR, &val);
        } while (loop-- > 0 && (val & BMSR_LINK) != 0);
}

static void
resetphytonormal(struct scx_softc *sc)
{
        struct device *d = sc->sc_dev;
        uint16_t val;
        int loop, err;

        err = mii_readreg(d, sc->sc_phy_id, MII_BMCR, &val);
        if (err) {
                aprint_error_dev(d, "resetphytonormal() failed\n");
        }
        val &= ~BMCR_LOOP;
        (void)mii_writereg(d, sc->sc_phy_id, MII_BMCR, val);
        loop = 100;
        do {
                (void)mii_readreg(d, sc->sc_phy_id, MII_BMCR, &val);
        } while (loop-- > 0 && (val & BMCR_LOOP) != 0);
        (void)mii_writereg(d, sc->sc_phy_id, MII_BMCR, val | BMCR_RESET);
        loop = 100;
        do {
                (void)mii_readreg(d, sc->sc_phy_id, MII_BMCR, &val);
        } while (loop-- > 0 && (val & BMCR_RESET) != 0);
}

/* GAR 5:2 MDIO frequency selection */
static int
get_mdioclk(uint32_t freq)
{

        freq /= 1000 * 1000;
        if (freq < 35)
                return GAR_MDIO_25_35MHZ;
        if (freq < 60)
                return GAR_MDIO_35_60MHZ;
        if (freq < 100)
                return GAR_MDIO_60_100MHZ;
        if (freq < 150)
                return GAR_MDIO_100_150MHZ;
        if (freq < 250)
                return GAR_MDIO_150_250MHZ;
        return GAR_MDIO_250_300MHZ;
}

#define HWFEA_DEBUG 1

static void
dump_hwfeature(struct scx_softc *sc)
{
#if HWFEA_DEBUG == 1
        struct {
                uint32_t bit;
                const char *des;
        } field[] = {
                { 27, "SA/VLAN insertion replacement enabled" },
                { 26, "flexible PPS enabled" },
                { 25, "time stamping with internal system enabled" },
                { 24, "alternate/enhanced descriptor enabled" },
                { 19, "rx FIFO >2048 enabled" },
                { 18, "type 2 IP checksum offload enabled" },
                { 17, "type 1 IP checksum offload enabled" },
                { 16, "Tx checksum offload enabled" },
                { 15, "AV feature enabled" },
                { 14, "EEE energy save feature enabled" },
                { 13, "1588-2008 version 2 advanced feature enabled" },
                { 12, "only 1588-2002 version 1 feature enabled" },
                { 11, "RMON event counter enabled" },
                { 10, "PMT magic packet enabled" },
                { 9,  "PMT remote wakeup enabled" },
                { 8,  "MDIO enabled", },
                { 7,  "L3/L4 filter enabled" },
                { 6,  "TBI/SGMII/RTBI support enabled" },
                { 5,  "supplimental MAC address enabled" },
                { 4,  "receive hash filter enabled" },
                { 3,  "hash size is expanded" },
                { 2,  "Half Duplex enabled" },
                { 1,  "1000 Mbps enabled" },
                { 0,  "10/100 Mbps enabled" },
        };
        const char *nameofmii[] = {
                "GMII or MII",
                "RGMII",
                "SGMII",
                "TBI",
                "RMII",
                "RTBI",
                "SMII",
                "RevMII"
        };
        uint32_t hwfea, mtype, txchan, rxchan;

        hwfea = CSR_READ(sc, HWFEA);
        mtype = (hwfea & __BITS(30,28)) >> 28;
        aprint_normal("HWFEA 0x%08x\n", hwfea);
        aprint_normal("%s <30:28>\n", nameofmii[mtype]);
        for (unsigned i = 0; i < __arraycount(field); i++) {
                if ((hwfea & (1U << field[i].bit)) == 0)
                        continue;
                aprint_normal("%s <%d>\n", field[i].des, field[i].bit);
        }
        if ((txchan = (hwfea & __BITS(23,22)) >> 22) != 0)
                aprint_normal("+%d tx channel available <23,22>\n", txchan);
        if ((rxchan = (hwfea & __BITS(21,20)) >> 20) != 0)
                aprint_normal("+%d rx channel available <21:20>\n", rxchan);
        return;
#endif
}