]> CyberLeo.Net >> Repos - FreeBSD/FreeBSD.git/blob - sys/dev/usb/net/if_ure.c
Fix ure device driver susceptible to packet-in-packet attack.
[FreeBSD/FreeBSD.git] / sys / dev / usb / net / if_ure.c
1 /*-
2  * Copyright (c) 2015-2016 Kevin Lo <kevlo@FreeBSD.org>
3  * All rights reserved.
4  *
5  * Redistribution and use in source and binary forms, with or without
6  * modification, are permitted provided that the following conditions
7  * are met:
8  * 1. Redistributions of source code must retain the above copyright
9  *    notice, this list of conditions and the following disclaimer.
10  * 2. Redistributions in binary form must reproduce the above copyright
11  *    notice, this list of conditions and the following disclaimer in the
12  *    documentation and/or other materials provided with the distribution.
13  *
14  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
15  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
16  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
17  * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
18  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
19  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
20  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
21  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
22  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
23  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
24  * SUCH DAMAGE.
25  */
26
27 #include <sys/cdefs.h>
28 __FBSDID("$FreeBSD$");
29
30 #include <sys/param.h>
31 #include <sys/systm.h>
32 #include <sys/bus.h>
33 #include <sys/condvar.h>
34 #include <sys/kernel.h>
35 #include <sys/lock.h>
36 #include <sys/module.h>
37 #include <sys/mutex.h>
38 #include <sys/socket.h>
39 #include <sys/sysctl.h>
40 #include <sys/unistd.h>
41
42 #include <net/if.h>
43 #include <net/if_var.h>
44
45 #include <dev/usb/usb.h>
46 #include <dev/usb/usbdi.h>
47 #include <dev/usb/usbdi_util.h>
48 #include "usbdevs.h"
49
50 #define USB_DEBUG_VAR   ure_debug
51 #include <dev/usb/usb_debug.h>
52 #include <dev/usb/usb_process.h>
53
54 #include <dev/usb/net/usb_ethernet.h>
55 #include <dev/usb/net/if_urereg.h>
56
57 #ifdef USB_DEBUG
58 static int ure_debug = 0;
59
60 static SYSCTL_NODE(_hw_usb, OID_AUTO, ure, CTLFLAG_RW, 0, "USB ure");
61 SYSCTL_INT(_hw_usb_ure, OID_AUTO, debug, CTLFLAG_RWTUN, &ure_debug, 0,
62     "Debug level");
63 #endif
64
65 /*
66  * Various supported device vendors/products.
67  */
68 static const STRUCT_USB_HOST_ID ure_devs[] = {
69 #define URE_DEV(v,p,i)  { USB_VPI(USB_VENDOR_##v, USB_PRODUCT_##v##_##p, i) }
70         URE_DEV(LENOVO, RTL8153, 0),
71         URE_DEV(NVIDIA, RTL8153, 0),
72         URE_DEV(REALTEK, RTL8152, URE_FLAG_8152),
73         URE_DEV(REALTEK, RTL8153, 0),
74         URE_DEV(TPLINK, RTL8153, 0),
75 #undef URE_DEV
76 };
77
78 static device_probe_t ure_probe;
79 static device_attach_t ure_attach;
80 static device_detach_t ure_detach;
81
82 static usb_callback_t ure_bulk_read_callback;
83 static usb_callback_t ure_bulk_write_callback;
84
85 static miibus_readreg_t ure_miibus_readreg;
86 static miibus_writereg_t ure_miibus_writereg;
87 static miibus_statchg_t ure_miibus_statchg;
88
89 static uether_fn_t ure_attach_post;
90 static uether_fn_t ure_init;
91 static uether_fn_t ure_stop;
92 static uether_fn_t ure_start;
93 static uether_fn_t ure_tick;
94 static uether_fn_t ure_rxfilter;
95
96 static int      ure_ctl(struct ure_softc *, uint8_t, uint16_t, uint16_t,
97                     void *, int);
98 static int      ure_read_mem(struct ure_softc *, uint16_t, uint16_t, void *,
99                     int);
100 static int      ure_write_mem(struct ure_softc *, uint16_t, uint16_t, void *,
101                     int);
102 static uint8_t  ure_read_1(struct ure_softc *, uint16_t, uint16_t);
103 static uint16_t ure_read_2(struct ure_softc *, uint16_t, uint16_t);
104 static uint32_t ure_read_4(struct ure_softc *, uint16_t, uint16_t);
105 static int      ure_write_1(struct ure_softc *, uint16_t, uint16_t, uint32_t);
106 static int      ure_write_2(struct ure_softc *, uint16_t, uint16_t, uint32_t);
107 static int      ure_write_4(struct ure_softc *, uint16_t, uint16_t, uint32_t);
108 static uint16_t ure_ocp_reg_read(struct ure_softc *, uint16_t);
109 static void     ure_ocp_reg_write(struct ure_softc *, uint16_t, uint16_t);
110
111 static void     ure_read_chipver(struct ure_softc *);
112 static int      ure_attach_post_sub(struct usb_ether *);
113 static void     ure_reset(struct ure_softc *);
114 static int      ure_ifmedia_upd(struct ifnet *);
115 static void     ure_ifmedia_sts(struct ifnet *, struct ifmediareq *);
116 static int      ure_ioctl(struct ifnet *, u_long, caddr_t);
117 static void     ure_rtl8152_init(struct ure_softc *);
118 static void     ure_rtl8153_init(struct ure_softc *);
119 static void     ure_disable_teredo(struct ure_softc *);
120 static void     ure_init_fifo(struct ure_softc *);
121
122 static const struct usb_config ure_config[URE_N_TRANSFER] = {
123         [URE_BULK_DT_WR] = {
124                 .type = UE_BULK,
125                 .endpoint = UE_ADDR_ANY,
126                 .direction = UE_DIR_OUT,
127                 .bufsize = MCLBYTES,
128                 .flags = {.pipe_bof = 1,.force_short_xfer = 1,},
129                 .callback = ure_bulk_write_callback,
130                 .timeout = 10000,       /* 10 seconds */
131         },
132         [URE_BULK_DT_RD] = {
133                 .type = UE_BULK,
134                 .endpoint = UE_ADDR_ANY,
135                 .direction = UE_DIR_IN,
136                 .bufsize = 16384,
137                 .flags = {.pipe_bof = 1,.short_xfer_ok = 1,},
138                 .callback = ure_bulk_read_callback,
139                 .timeout = 0,   /* no timeout */
140         },
141 };
142
143 static device_method_t ure_methods[] = {
144         /* Device interface. */
145         DEVMETHOD(device_probe, ure_probe),
146         DEVMETHOD(device_attach, ure_attach),
147         DEVMETHOD(device_detach, ure_detach),
148
149         /* MII interface. */
150         DEVMETHOD(miibus_readreg, ure_miibus_readreg),
151         DEVMETHOD(miibus_writereg, ure_miibus_writereg),
152         DEVMETHOD(miibus_statchg, ure_miibus_statchg),
153
154         DEVMETHOD_END
155 };
156
157 static driver_t ure_driver = {
158         .name = "ure",
159         .methods = ure_methods,
160         .size = sizeof(struct ure_softc),
161 };
162
163 static devclass_t ure_devclass;
164
165 DRIVER_MODULE(ure, uhub, ure_driver, ure_devclass, NULL, NULL);
166 DRIVER_MODULE(miibus, ure, miibus_driver, miibus_devclass, NULL, NULL);
167 MODULE_DEPEND(ure, uether, 1, 1, 1);
168 MODULE_DEPEND(ure, usb, 1, 1, 1);
169 MODULE_DEPEND(ure, ether, 1, 1, 1);
170 MODULE_DEPEND(ure, miibus, 1, 1, 1);
171 MODULE_VERSION(ure, 1);
172 USB_PNP_HOST_INFO(ure_devs);
173
174 static const struct usb_ether_methods ure_ue_methods = {
175         .ue_attach_post = ure_attach_post,
176         .ue_attach_post_sub = ure_attach_post_sub,
177         .ue_start = ure_start,
178         .ue_init = ure_init,
179         .ue_stop = ure_stop,
180         .ue_tick = ure_tick,
181         .ue_setmulti = ure_rxfilter,
182         .ue_setpromisc = ure_rxfilter,
183         .ue_mii_upd = ure_ifmedia_upd,
184         .ue_mii_sts = ure_ifmedia_sts,
185 };
186
187 static int
188 ure_ctl(struct ure_softc *sc, uint8_t rw, uint16_t val, uint16_t index,
189     void *buf, int len)
190 {
191         struct usb_device_request req;
192
193         URE_LOCK_ASSERT(sc, MA_OWNED);
194
195         if (rw == URE_CTL_WRITE)
196                 req.bmRequestType = UT_WRITE_VENDOR_DEVICE;
197         else
198                 req.bmRequestType = UT_READ_VENDOR_DEVICE;
199         req.bRequest = UR_SET_ADDRESS;
200         USETW(req.wValue, val);
201         USETW(req.wIndex, index);
202         USETW(req.wLength, len);
203
204         return (uether_do_request(&sc->sc_ue, &req, buf, 1000));
205 }
206
207 static int
208 ure_read_mem(struct ure_softc *sc, uint16_t addr, uint16_t index,
209     void *buf, int len)
210 {
211
212         return (ure_ctl(sc, URE_CTL_READ, addr, index, buf, len));
213 }
214
215 static int
216 ure_write_mem(struct ure_softc *sc, uint16_t addr, uint16_t index,
217     void *buf, int len)
218 {
219
220         return (ure_ctl(sc, URE_CTL_WRITE, addr, index, buf, len));
221 }
222
223 static uint8_t
224 ure_read_1(struct ure_softc *sc, uint16_t reg, uint16_t index)
225 {
226         uint32_t val;
227         uint8_t temp[4];
228         uint8_t shift;
229
230         shift = (reg & 3) << 3;
231         reg &= ~3;
232         
233         ure_read_mem(sc, reg, index, &temp, 4);
234         val = UGETDW(temp);
235         val >>= shift;
236
237         return (val & 0xff);
238 }
239
240 static uint16_t
241 ure_read_2(struct ure_softc *sc, uint16_t reg, uint16_t index)
242 {
243         uint32_t val;
244         uint8_t temp[4];
245         uint8_t shift;
246
247         shift = (reg & 2) << 3;
248         reg &= ~3;
249
250         ure_read_mem(sc, reg, index, &temp, 4);
251         val = UGETDW(temp);
252         val >>= shift;
253
254         return (val & 0xffff);
255 }
256
257 static uint32_t
258 ure_read_4(struct ure_softc *sc, uint16_t reg, uint16_t index)
259 {
260         uint8_t temp[4];
261
262         ure_read_mem(sc, reg, index, &temp, 4);
263         return (UGETDW(temp));
264 }
265
266 static int
267 ure_write_1(struct ure_softc *sc, uint16_t reg, uint16_t index, uint32_t val)
268 {
269         uint16_t byen;
270         uint8_t temp[4];
271         uint8_t shift;
272
273         byen = URE_BYTE_EN_BYTE;
274         shift = reg & 3;
275         val &= 0xff;
276
277         if (reg & 3) {
278                 byen <<= shift;
279                 val <<= (shift << 3);
280                 reg &= ~3;
281         }
282
283         USETDW(temp, val);
284         return (ure_write_mem(sc, reg, index | byen, &temp, 4));
285 }
286
287 static int
288 ure_write_2(struct ure_softc *sc, uint16_t reg, uint16_t index, uint32_t val)
289 {
290         uint16_t byen;
291         uint8_t temp[4];
292         uint8_t shift;
293
294         byen = URE_BYTE_EN_WORD;
295         shift = reg & 2;
296         val &= 0xffff;
297
298         if (reg & 2) {
299                 byen <<= shift;
300                 val <<= (shift << 3);
301                 reg &= ~3;
302         }
303
304         USETDW(temp, val);
305         return (ure_write_mem(sc, reg, index | byen, &temp, 4));
306 }
307
308 static int
309 ure_write_4(struct ure_softc *sc, uint16_t reg, uint16_t index, uint32_t val)
310 {
311         uint8_t temp[4];
312
313         USETDW(temp, val);
314         return (ure_write_mem(sc, reg, index | URE_BYTE_EN_DWORD, &temp, 4));
315 }
316
317 static uint16_t
318 ure_ocp_reg_read(struct ure_softc *sc, uint16_t addr)
319 {
320         uint16_t reg;
321
322         ure_write_2(sc, URE_PLA_OCP_GPHY_BASE, URE_MCU_TYPE_PLA, addr & 0xf000);
323         reg = (addr & 0x0fff) | 0xb000;
324
325         return (ure_read_2(sc, reg, URE_MCU_TYPE_PLA));
326 }
327
328 static void
329 ure_ocp_reg_write(struct ure_softc *sc, uint16_t addr, uint16_t data)
330 {
331         uint16_t reg;
332
333         ure_write_2(sc, URE_PLA_OCP_GPHY_BASE, URE_MCU_TYPE_PLA, addr & 0xf000);
334         reg = (addr & 0x0fff) | 0xb000;
335
336         ure_write_2(sc, reg, URE_MCU_TYPE_PLA, data);
337 }
338
339 static int
340 ure_miibus_readreg(device_t dev, int phy, int reg)
341 {
342         struct ure_softc *sc;
343         uint16_t val;
344         int locked;
345
346         sc = device_get_softc(dev);
347         locked = mtx_owned(&sc->sc_mtx);
348         if (!locked)
349                 URE_LOCK(sc);
350
351         /* Let the rgephy driver read the URE_GMEDIASTAT register. */
352         if (reg == URE_GMEDIASTAT) {
353                 if (!locked)
354                         URE_UNLOCK(sc);
355                 return (ure_read_1(sc, URE_GMEDIASTAT, URE_MCU_TYPE_PLA));
356         }
357
358         val = ure_ocp_reg_read(sc, URE_OCP_BASE_MII + reg * 2);
359
360         if (!locked)
361                 URE_UNLOCK(sc);
362         return (val);
363 }
364
365 static int
366 ure_miibus_writereg(device_t dev, int phy, int reg, int val)
367 {
368         struct ure_softc *sc;
369         int locked;
370
371         sc = device_get_softc(dev);
372         if (sc->sc_phyno != phy)
373                 return (0);
374
375         locked = mtx_owned(&sc->sc_mtx);
376         if (!locked)
377                 URE_LOCK(sc);
378         
379         ure_ocp_reg_write(sc, URE_OCP_BASE_MII + reg * 2, val);
380
381         if (!locked)
382                 URE_UNLOCK(sc);
383         return (0);
384 }
385
386 static void
387 ure_miibus_statchg(device_t dev)
388 {
389         struct ure_softc *sc;
390         struct mii_data *mii;
391         struct ifnet *ifp;
392         int locked;
393
394         sc = device_get_softc(dev);
395         mii = GET_MII(sc);
396         locked = mtx_owned(&sc->sc_mtx);
397         if (!locked)
398                 URE_LOCK(sc);
399
400         ifp = uether_getifp(&sc->sc_ue);
401         if (mii == NULL || ifp == NULL ||
402             (ifp->if_drv_flags & IFF_DRV_RUNNING) == 0)
403                 goto done;
404
405         sc->sc_flags &= ~URE_FLAG_LINK;
406         if ((mii->mii_media_status & (IFM_ACTIVE | IFM_AVALID)) ==
407             (IFM_ACTIVE | IFM_AVALID)) {
408                 switch (IFM_SUBTYPE(mii->mii_media_active)) {
409                 case IFM_10_T:
410                 case IFM_100_TX:
411                         sc->sc_flags |= URE_FLAG_LINK;
412                         break;
413                 case IFM_1000_T:
414                         if ((sc->sc_flags & URE_FLAG_8152) != 0)
415                                 break;
416                         sc->sc_flags |= URE_FLAG_LINK;
417                         break;
418                 default:
419                         break;
420                 }
421         }
422
423         /* Lost link, do nothing. */
424         if ((sc->sc_flags & URE_FLAG_LINK) == 0)
425                 goto done;
426 done:
427         if (!locked)
428                 URE_UNLOCK(sc);
429 }
430
431 /*
432  * Probe for a RTL8152/RTL8153 chip.
433  */
434 static int
435 ure_probe(device_t dev)
436 {
437         struct usb_attach_arg *uaa;
438
439         uaa = device_get_ivars(dev);
440         if (uaa->usb_mode != USB_MODE_HOST)
441                 return (ENXIO);
442         if (uaa->info.bConfigIndex != URE_CONFIG_IDX)
443                 return (ENXIO);
444         if (uaa->info.bIfaceIndex != URE_IFACE_IDX)
445                 return (ENXIO);
446
447         return (usbd_lookup_id_by_uaa(ure_devs, sizeof(ure_devs), uaa));
448 }
449
450 /*
451  * Attach the interface. Allocate softc structures, do ifmedia
452  * setup and ethernet/BPF attach.
453  */
454 static int
455 ure_attach(device_t dev)
456 {
457         struct usb_attach_arg *uaa = device_get_ivars(dev);
458         struct ure_softc *sc = device_get_softc(dev);
459         struct usb_ether *ue = &sc->sc_ue;
460         uint8_t iface_index;
461         int error;
462
463         sc->sc_flags = USB_GET_DRIVER_INFO(uaa);
464         device_set_usb_desc(dev);
465         mtx_init(&sc->sc_mtx, device_get_nameunit(dev), NULL, MTX_DEF);
466
467         iface_index = URE_IFACE_IDX;
468         error = usbd_transfer_setup(uaa->device, &iface_index, sc->sc_xfer,
469             ure_config, URE_N_TRANSFER, sc, &sc->sc_mtx);
470         if (error != 0) {
471                 device_printf(dev, "allocating USB transfers failed\n");
472                 goto detach;
473         }
474
475         ue->ue_sc = sc;
476         ue->ue_dev = dev;
477         ue->ue_udev = uaa->device;
478         ue->ue_mtx = &sc->sc_mtx;
479         ue->ue_methods = &ure_ue_methods;
480
481         error = uether_ifattach(ue);
482         if (error != 0) {
483                 device_printf(dev, "could not attach interface\n");
484                 goto detach;
485         }
486         return (0);                     /* success */
487
488 detach:
489         ure_detach(dev);
490         return (ENXIO);                 /* failure */
491 }
492
493 static int
494 ure_detach(device_t dev)
495 {
496         struct ure_softc *sc = device_get_softc(dev);
497         struct usb_ether *ue = &sc->sc_ue;
498
499         usbd_transfer_unsetup(sc->sc_xfer, URE_N_TRANSFER);
500         uether_ifdetach(ue);
501         mtx_destroy(&sc->sc_mtx);
502
503         return (0);
504 }
505
506 static void
507 ure_bulk_read_callback(struct usb_xfer *xfer, usb_error_t error)
508 {
509         struct ure_softc *sc = usbd_xfer_softc(xfer);
510         struct usb_ether *ue = &sc->sc_ue;
511         struct ifnet *ifp = uether_getifp(ue);
512         struct usb_page_cache *pc;
513         struct ure_rxpkt pkt;
514         int actlen, len;
515
516         usbd_xfer_status(xfer, &actlen, NULL, NULL, NULL);
517
518         switch (USB_GET_STATE(xfer)) {
519         case USB_ST_TRANSFERRED:
520                 if (actlen < (int)(sizeof(pkt))) {
521                         if_inc_counter(ifp, IFCOUNTER_IERRORS, 1);
522                         goto tr_setup;
523                 }
524                 pc = usbd_xfer_get_frame(xfer, 0);
525                 usbd_copy_out(pc, 0, &pkt, sizeof(pkt));
526                 len = le32toh(pkt.ure_pktlen) & URE_RXPKT_LEN_MASK;
527                 len -= ETHER_CRC_LEN;
528                 if (actlen < (int)(len + sizeof(pkt))) {
529                         if_inc_counter(ifp, IFCOUNTER_IERRORS, 1);
530                         goto tr_setup;
531                 }
532
533                 uether_rxbuf(ue, pc, sizeof(pkt), len);
534                 /* FALLTHROUGH */
535         case USB_ST_SETUP:
536 tr_setup:
537                 usbd_xfer_set_frame_len(xfer, 0, usbd_xfer_max_len(xfer));
538                 usbd_transfer_submit(xfer);
539                 uether_rxflush(ue);
540                 return;
541
542         default:                        /* Error */
543                 DPRINTF("bulk read error, %s\n",
544                     usbd_errstr(error));
545
546                 if (error != USB_ERR_CANCELLED) {
547                         /* try to clear stall first */
548                         usbd_xfer_set_stall(xfer);
549                         goto tr_setup;
550                 }
551                 return;
552         }
553 }
554
555 static void
556 ure_bulk_write_callback(struct usb_xfer *xfer, usb_error_t error)
557 {
558         struct ure_softc *sc = usbd_xfer_softc(xfer);
559         struct ifnet *ifp = uether_getifp(&sc->sc_ue);
560         struct usb_page_cache *pc;
561         struct mbuf *m;
562         struct ure_txpkt txpkt;
563         int len, pos;
564
565         switch (USB_GET_STATE(xfer)) {
566         case USB_ST_TRANSFERRED:
567                 DPRINTFN(11, "transfer complete\n");
568                 ifp->if_drv_flags &= ~IFF_DRV_OACTIVE;
569                 /* FALLTHROUGH */
570         case USB_ST_SETUP:
571 tr_setup:
572                 if ((sc->sc_flags & URE_FLAG_LINK) == 0 ||
573                     (ifp->if_drv_flags & IFF_DRV_OACTIVE) != 0) {
574                         /*
575                          * don't send anything if there is no link !
576                          */
577                         return;
578                 }
579                 IFQ_DRV_DEQUEUE(&ifp->if_snd, m);
580                 if (m == NULL)
581                         break;
582                 pos = 0;
583                 len = m->m_pkthdr.len;
584                 pc = usbd_xfer_get_frame(xfer, 0);
585                 memset(&txpkt, 0, sizeof(txpkt));
586                 txpkt.ure_pktlen = htole32((len & URE_TXPKT_LEN_MASK) |
587                     URE_TKPKT_TX_FS | URE_TKPKT_TX_LS);
588                 usbd_copy_in(pc, pos, &txpkt, sizeof(txpkt));
589                 pos += sizeof(txpkt);
590                 usbd_m_copy_in(pc, pos, m, 0, m->m_pkthdr.len);
591                 pos += m->m_pkthdr.len;
592
593                 if_inc_counter(ifp, IFCOUNTER_OPACKETS, 1);
594
595                 /*
596                  * If there's a BPF listener, bounce a copy
597                  * of this frame to him.
598                  */
599                 BPF_MTAP(ifp, m);
600
601                 m_freem(m);
602
603                 /* Set frame length. */
604                 usbd_xfer_set_frame_len(xfer, 0, pos);
605
606                 usbd_transfer_submit(xfer);
607                 ifp->if_drv_flags |= IFF_DRV_OACTIVE;
608                 return;
609         default:                        /* Error */
610                 DPRINTFN(11, "transfer error, %s\n",
611                     usbd_errstr(error));
612
613                 if_inc_counter(ifp, IFCOUNTER_OERRORS, 1);
614                 ifp->if_drv_flags &= ~IFF_DRV_OACTIVE;
615
616                 if (error != USB_ERR_CANCELLED) {
617                         /* try to clear stall first */
618                         usbd_xfer_set_stall(xfer);
619                         goto tr_setup;
620                 }
621                 return;
622         }
623 }
624
625 static void
626 ure_read_chipver(struct ure_softc *sc)
627 {
628         uint16_t ver;
629
630         ver = ure_read_2(sc, URE_PLA_TCR1, URE_MCU_TYPE_PLA) & URE_VERSION_MASK;
631         switch (ver) {
632         case 0x4c00:
633                 sc->sc_chip |= URE_CHIP_VER_4C00;
634                 break;
635         case 0x4c10:
636                 sc->sc_chip |= URE_CHIP_VER_4C10;
637                 break;
638         case 0x5c00:
639                 sc->sc_chip |= URE_CHIP_VER_5C00;
640                 break;
641         case 0x5c10:
642                 sc->sc_chip |= URE_CHIP_VER_5C10;
643                 break;
644         case 0x5c20:
645                 sc->sc_chip |= URE_CHIP_VER_5C20;
646                 break;
647         case 0x5c30:
648                 sc->sc_chip |= URE_CHIP_VER_5C30;
649                 break;
650         default:
651                 device_printf(sc->sc_ue.ue_dev,
652                     "unknown version 0x%04x\n", ver);
653                 break;
654         }
655 }
656
657 static void
658 ure_attach_post(struct usb_ether *ue)
659 {
660         struct ure_softc *sc = uether_getsc(ue);
661
662         sc->sc_phyno = 0;
663
664         /* Determine the chip version. */
665         ure_read_chipver(sc);
666
667         /* Initialize controller and get station address. */
668         if (sc->sc_flags & URE_FLAG_8152)
669                 ure_rtl8152_init(sc);
670         else
671                 ure_rtl8153_init(sc);
672
673         if (sc->sc_chip & URE_CHIP_VER_4C00)
674                 ure_read_mem(sc, URE_PLA_IDR, URE_MCU_TYPE_PLA,
675                     ue->ue_eaddr, 8);
676         else
677                 ure_read_mem(sc, URE_PLA_BACKUP, URE_MCU_TYPE_PLA,
678                     ue->ue_eaddr, 8);
679 }
680
681 static int
682 ure_attach_post_sub(struct usb_ether *ue)
683 {
684         struct ure_softc *sc;
685         struct ifnet *ifp;
686         int error;
687
688         sc = uether_getsc(ue);
689         ifp = ue->ue_ifp;
690         ifp->if_flags = IFF_BROADCAST | IFF_SIMPLEX | IFF_MULTICAST;
691         ifp->if_start = uether_start;
692         ifp->if_ioctl = ure_ioctl;
693         ifp->if_init = uether_init;
694         IFQ_SET_MAXLEN(&ifp->if_snd, ifqmaxlen);
695         ifp->if_snd.ifq_drv_maxlen = ifqmaxlen;
696         IFQ_SET_READY(&ifp->if_snd);
697
698         mtx_lock(&Giant);
699         error = mii_attach(ue->ue_dev, &ue->ue_miibus, ifp,
700             uether_ifmedia_upd, ue->ue_methods->ue_mii_sts,
701             BMSR_DEFCAPMASK, sc->sc_phyno, MII_OFFSET_ANY, 0);
702         mtx_unlock(&Giant);
703
704         return (error);
705 }
706
707 static void
708 ure_init(struct usb_ether *ue)
709 {
710         struct ure_softc *sc = uether_getsc(ue);
711         struct ifnet *ifp = uether_getifp(ue);
712
713         URE_LOCK_ASSERT(sc, MA_OWNED);
714
715         if ((ifp->if_drv_flags & IFF_DRV_RUNNING) != 0)
716                 return;
717
718         /* Cancel pending I/O. */
719         ure_stop(ue);
720
721         ure_reset(sc);
722
723         /* Set MAC address. */
724         ure_write_mem(sc, URE_PLA_IDR, URE_MCU_TYPE_PLA | URE_BYTE_EN_SIX_BYTES,
725             IF_LLADDR(ifp), 8);
726
727         /* Reset the packet filter. */
728         ure_write_2(sc, URE_PLA_FMC, URE_MCU_TYPE_PLA,
729             ure_read_2(sc, URE_PLA_FMC, URE_MCU_TYPE_PLA) &
730             ~URE_FMC_FCR_MCU_EN);
731         ure_write_2(sc, URE_PLA_FMC, URE_MCU_TYPE_PLA,
732             ure_read_2(sc, URE_PLA_FMC, URE_MCU_TYPE_PLA) |
733             URE_FMC_FCR_MCU_EN);
734             
735         /* Enable transmit and receive. */
736         ure_write_1(sc, URE_PLA_CR, URE_MCU_TYPE_PLA,
737             ure_read_1(sc, URE_PLA_CR, URE_MCU_TYPE_PLA) | URE_CR_RE |
738             URE_CR_TE);
739
740         ure_write_2(sc, URE_PLA_MISC_1, URE_MCU_TYPE_PLA,
741             ure_read_2(sc, URE_PLA_MISC_1, URE_MCU_TYPE_PLA) &
742             ~URE_RXDY_GATED_EN);
743
744         /*  Configure RX filters. */
745         ure_rxfilter(ue);
746
747         usbd_xfer_set_stall(sc->sc_xfer[URE_BULK_DT_WR]);
748
749         /* Indicate we are up and running. */
750         ifp->if_drv_flags |= IFF_DRV_RUNNING;
751
752         /* Switch to selected media. */
753         ure_ifmedia_upd(ifp);
754 }
755
756 static void
757 ure_tick(struct usb_ether *ue)
758 {
759         struct ure_softc *sc = uether_getsc(ue);
760         struct mii_data *mii = GET_MII(sc);
761
762         URE_LOCK_ASSERT(sc, MA_OWNED);
763
764         mii_tick(mii);
765         if ((sc->sc_flags & URE_FLAG_LINK) == 0
766             && mii->mii_media_status & IFM_ACTIVE &&
767             IFM_SUBTYPE(mii->mii_media_active) != IFM_NONE) {
768                 sc->sc_flags |= URE_FLAG_LINK;
769                 ure_start(ue);
770         }
771 }
772
773 /*
774  * Program the 64-bit multicast hash filter.
775  */
776 static void
777 ure_rxfilter(struct usb_ether *ue)
778 {
779         struct ure_softc *sc = uether_getsc(ue);
780         struct ifnet *ifp = uether_getifp(ue);
781         struct ifmultiaddr *ifma;
782         uint32_t h, rxmode;
783         uint32_t hashes[2] = { 0, 0 };
784
785         URE_LOCK_ASSERT(sc, MA_OWNED);
786
787         rxmode = ure_read_4(sc, URE_PLA_RCR, URE_MCU_TYPE_PLA);
788         rxmode &= ~(URE_RCR_AAP | URE_RCR_AM);
789         rxmode |= URE_RCR_APM;  /* accept physical match packets */
790         rxmode |= URE_RCR_AB;   /* always accept broadcasts */
791         if (ifp->if_flags & (IFF_ALLMULTI | IFF_PROMISC)) {
792                 if (ifp->if_flags & IFF_PROMISC)
793                         rxmode |= URE_RCR_AAP;
794                 rxmode |= URE_RCR_AM;
795                 hashes[0] = hashes[1] = 0xffffffff;
796                 goto done;
797         }
798
799         rxmode |= URE_RCR_AM;
800         if_maddr_rlock(ifp);
801         CK_STAILQ_FOREACH(ifma, &ifp->if_multiaddrs, ifma_link) {
802                 if (ifma->ifma_addr->sa_family != AF_LINK)
803                         continue;
804                 h = ether_crc32_be(LLADDR((struct sockaddr_dl *)
805                 ifma->ifma_addr), ETHER_ADDR_LEN) >> 26;
806                 if (h < 32)
807                         hashes[0] |= (1 << h);
808                 else
809                         hashes[1] |= (1 << (h - 32));
810         }
811         if_maddr_runlock(ifp);
812
813         h = bswap32(hashes[0]);
814         hashes[0] = bswap32(hashes[1]);
815         hashes[1] = h;
816         rxmode |= URE_RCR_AM;
817
818 done:
819         ure_write_4(sc, URE_PLA_MAR0, URE_MCU_TYPE_PLA, hashes[0]);
820         ure_write_4(sc, URE_PLA_MAR4, URE_MCU_TYPE_PLA, hashes[1]);
821         ure_write_4(sc, URE_PLA_RCR, URE_MCU_TYPE_PLA, rxmode);
822 }
823
824 static void
825 ure_start(struct usb_ether *ue)
826 {
827         struct ure_softc *sc = uether_getsc(ue);
828
829         /*
830          * start the USB transfers, if not already started:
831          */
832         usbd_transfer_start(sc->sc_xfer[URE_BULK_DT_RD]);
833         usbd_transfer_start(sc->sc_xfer[URE_BULK_DT_WR]);
834 }
835
836 static void
837 ure_reset(struct ure_softc *sc)
838 {
839         int i;
840
841         ure_write_1(sc, URE_PLA_CR, URE_MCU_TYPE_PLA, URE_CR_RST);
842
843         for (i = 0; i < URE_TIMEOUT; i++) {
844                 if (!(ure_read_1(sc, URE_PLA_CR, URE_MCU_TYPE_PLA) &
845                     URE_CR_RST))
846                         break;
847                 uether_pause(&sc->sc_ue, hz / 100);
848         }
849         if (i == URE_TIMEOUT)
850                 device_printf(sc->sc_ue.ue_dev, "reset never completed\n");
851 }
852
853 /*
854  * Set media options.
855  */
856 static int
857 ure_ifmedia_upd(struct ifnet *ifp)
858 {
859         struct ure_softc *sc = ifp->if_softc;
860         struct mii_data *mii = GET_MII(sc);
861         struct mii_softc *miisc;
862         int error;
863
864         URE_LOCK_ASSERT(sc, MA_OWNED);
865
866         LIST_FOREACH(miisc, &mii->mii_phys, mii_list)
867                 PHY_RESET(miisc);
868         error = mii_mediachg(mii);
869         return (error);
870 }
871
872 /*
873  * Report current media status.
874  */
875 static void
876 ure_ifmedia_sts(struct ifnet *ifp, struct ifmediareq *ifmr)
877 {
878         struct ure_softc *sc;
879         struct mii_data *mii;
880
881         sc = ifp->if_softc;
882         mii = GET_MII(sc);
883
884         URE_LOCK(sc);
885         mii_pollstat(mii);
886         ifmr->ifm_active = mii->mii_media_active;
887         ifmr->ifm_status = mii->mii_media_status;
888         URE_UNLOCK(sc);
889 }
890
891 static int
892 ure_ioctl(struct ifnet *ifp, u_long cmd, caddr_t data)
893 {
894         struct usb_ether *ue = ifp->if_softc;
895         struct ure_softc *sc;
896         struct ifreq *ifr;
897         int error, mask, reinit;
898
899         sc = uether_getsc(ue);
900         ifr = (struct ifreq *)data;
901         error = 0;
902         reinit = 0;
903         if (cmd == SIOCSIFCAP) {
904                 URE_LOCK(sc);
905                 mask = ifr->ifr_reqcap ^ ifp->if_capenable;
906                 if (reinit > 0 && ifp->if_drv_flags & IFF_DRV_RUNNING)
907                         ifp->if_drv_flags &= ~IFF_DRV_RUNNING;
908                 else
909                         reinit = 0;
910                 URE_UNLOCK(sc);
911                 if (reinit > 0)
912                         uether_init(ue);
913         } else
914                 error = uether_ioctl(ifp, cmd, data);
915
916         return (error);
917 }
918
919 static void
920 ure_rtl8152_init(struct ure_softc *sc)
921 {
922         uint32_t pwrctrl;
923
924         /* Disable ALDPS. */
925         ure_ocp_reg_write(sc, URE_OCP_ALDPS_CONFIG, URE_ENPDNPS | URE_LINKENA |
926             URE_DIS_SDSAVE);
927         uether_pause(&sc->sc_ue, hz / 50);
928
929         if (sc->sc_chip & URE_CHIP_VER_4C00) {
930                 ure_write_2(sc, URE_PLA_LED_FEATURE, URE_MCU_TYPE_PLA,
931                     ure_read_2(sc, URE_PLA_LED_FEATURE, URE_MCU_TYPE_PLA) &
932                     ~URE_LED_MODE_MASK);
933         }
934
935         ure_write_2(sc, URE_USB_UPS_CTRL, URE_MCU_TYPE_USB,
936             ure_read_2(sc, URE_USB_UPS_CTRL, URE_MCU_TYPE_USB) &
937             ~URE_POWER_CUT);
938         ure_write_2(sc, URE_USB_PM_CTRL_STATUS, URE_MCU_TYPE_USB,
939             ure_read_2(sc, URE_USB_PM_CTRL_STATUS, URE_MCU_TYPE_USB) &
940             ~URE_RESUME_INDICATE);
941
942         ure_write_2(sc, URE_PLA_PHY_PWR, URE_MCU_TYPE_PLA,
943             ure_read_2(sc, URE_PLA_PHY_PWR, URE_MCU_TYPE_PLA) |
944             URE_TX_10M_IDLE_EN | URE_PFM_PWM_SWITCH);
945         pwrctrl = ure_read_4(sc, URE_PLA_MAC_PWR_CTRL, URE_MCU_TYPE_PLA);
946         pwrctrl &= ~URE_MCU_CLK_RATIO_MASK;
947         pwrctrl |= URE_MCU_CLK_RATIO | URE_D3_CLK_GATED_EN;
948         ure_write_4(sc, URE_PLA_MAC_PWR_CTRL, URE_MCU_TYPE_PLA, pwrctrl);
949         ure_write_2(sc, URE_PLA_GPHY_INTR_IMR, URE_MCU_TYPE_PLA,
950             URE_GPHY_STS_MSK | URE_SPEED_DOWN_MSK | URE_SPDWN_RXDV_MSK |
951             URE_SPDWN_LINKCHG_MSK);
952
953         /* Disable Rx aggregation. */
954         ure_write_2(sc, URE_USB_USB_CTRL, URE_MCU_TYPE_USB,
955             ure_read_2(sc, URE_USB_USB_CTRL, URE_MCU_TYPE_USB) |
956             URE_RX_AGG_DISABLE);
957
958         /* Disable ALDPS. */
959         ure_ocp_reg_write(sc, URE_OCP_ALDPS_CONFIG, URE_ENPDNPS | URE_LINKENA |
960             URE_DIS_SDSAVE);
961         uether_pause(&sc->sc_ue, hz / 50);
962
963         ure_init_fifo(sc);
964
965         ure_write_1(sc, URE_USB_TX_AGG, URE_MCU_TYPE_USB,
966             URE_TX_AGG_MAX_THRESHOLD);
967         ure_write_4(sc, URE_USB_RX_BUF_TH, URE_MCU_TYPE_USB, URE_RX_THR_HIGH);
968         ure_write_4(sc, URE_USB_TX_DMA, URE_MCU_TYPE_USB,
969             URE_TEST_MODE_DISABLE | URE_TX_SIZE_ADJUST1);
970 }
971
972 static void
973 ure_rtl8153_init(struct ure_softc *sc)
974 {
975         uint16_t val;
976         uint8_t u1u2[8];
977         int i;
978
979         /* Disable ALDPS. */
980         ure_ocp_reg_write(sc, URE_OCP_POWER_CFG,
981             ure_ocp_reg_read(sc, URE_OCP_POWER_CFG) & ~URE_EN_ALDPS);
982         uether_pause(&sc->sc_ue, hz / 50);
983
984         memset(u1u2, 0x00, sizeof(u1u2));
985         ure_write_mem(sc, URE_USB_TOLERANCE,
986             URE_MCU_TYPE_USB | URE_BYTE_EN_SIX_BYTES, u1u2, sizeof(u1u2));
987
988         for (i = 0; i < URE_TIMEOUT; i++) {
989                 if (ure_read_2(sc, URE_PLA_BOOT_CTRL, URE_MCU_TYPE_PLA) &
990                     URE_AUTOLOAD_DONE)
991                         break;
992                 uether_pause(&sc->sc_ue, hz / 100);
993         }
994         if (i == URE_TIMEOUT)
995                 device_printf(sc->sc_ue.ue_dev,
996                     "timeout waiting for chip autoload\n");
997
998         for (i = 0; i < URE_TIMEOUT; i++) {
999                 val = ure_ocp_reg_read(sc, URE_OCP_PHY_STATUS) &
1000                     URE_PHY_STAT_MASK;
1001                 if (val == URE_PHY_STAT_LAN_ON || val == URE_PHY_STAT_PWRDN)
1002                         break;
1003                 uether_pause(&sc->sc_ue, hz / 100);
1004         }
1005         if (i == URE_TIMEOUT)
1006                 device_printf(sc->sc_ue.ue_dev,
1007                     "timeout waiting for phy to stabilize\n");
1008         
1009         ure_write_2(sc, URE_USB_U2P3_CTRL, URE_MCU_TYPE_USB,
1010             ure_read_2(sc, URE_USB_U2P3_CTRL, URE_MCU_TYPE_USB) &
1011             ~URE_U2P3_ENABLE);
1012
1013         if (sc->sc_chip & URE_CHIP_VER_5C10) {
1014                 val = ure_read_2(sc, URE_USB_SSPHYLINK2, URE_MCU_TYPE_USB);
1015                 val &= ~URE_PWD_DN_SCALE_MASK;
1016                 val |= URE_PWD_DN_SCALE(96);
1017                 ure_write_2(sc, URE_USB_SSPHYLINK2, URE_MCU_TYPE_USB, val);
1018
1019                 ure_write_1(sc, URE_USB_USB2PHY, URE_MCU_TYPE_USB,
1020                     ure_read_1(sc, URE_USB_USB2PHY, URE_MCU_TYPE_USB) |
1021                     URE_USB2PHY_L1 | URE_USB2PHY_SUSPEND);
1022         } else if (sc->sc_chip & URE_CHIP_VER_5C20) {
1023                 ure_write_1(sc, URE_PLA_DMY_REG0, URE_MCU_TYPE_PLA,
1024                     ure_read_1(sc, URE_PLA_DMY_REG0, URE_MCU_TYPE_PLA) &
1025                     ~URE_ECM_ALDPS);
1026         }
1027         if (sc->sc_chip & (URE_CHIP_VER_5C20 | URE_CHIP_VER_5C30)) {
1028                 val = ure_read_1(sc, URE_USB_CSR_DUMMY1, URE_MCU_TYPE_USB);
1029                 if (ure_read_2(sc, URE_USB_BURST_SIZE, URE_MCU_TYPE_USB) ==
1030                     0)
1031                         val &= ~URE_DYNAMIC_BURST;
1032                 else
1033                         val |= URE_DYNAMIC_BURST;
1034                 ure_write_1(sc, URE_USB_CSR_DUMMY1, URE_MCU_TYPE_USB, val);
1035         }
1036
1037         ure_write_1(sc, URE_USB_CSR_DUMMY2, URE_MCU_TYPE_USB,
1038             ure_read_1(sc, URE_USB_CSR_DUMMY2, URE_MCU_TYPE_USB) |
1039             URE_EP4_FULL_FC);
1040         
1041         ure_write_2(sc, URE_USB_WDT11_CTRL, URE_MCU_TYPE_USB,
1042             ure_read_2(sc, URE_USB_WDT11_CTRL, URE_MCU_TYPE_USB) &
1043             ~URE_TIMER11_EN);
1044
1045         ure_write_2(sc, URE_PLA_LED_FEATURE, URE_MCU_TYPE_PLA,
1046             ure_read_2(sc, URE_PLA_LED_FEATURE, URE_MCU_TYPE_PLA) &
1047             ~URE_LED_MODE_MASK);
1048             
1049         if ((sc->sc_chip & URE_CHIP_VER_5C10) &&
1050             usbd_get_speed(sc->sc_ue.ue_udev) != USB_SPEED_SUPER)
1051                 val = URE_LPM_TIMER_500MS;
1052         else
1053                 val = URE_LPM_TIMER_500US;
1054         ure_write_1(sc, URE_USB_LPM_CTRL, URE_MCU_TYPE_USB,
1055             val | URE_FIFO_EMPTY_1FB | URE_ROK_EXIT_LPM);
1056
1057         val = ure_read_2(sc, URE_USB_AFE_CTRL2, URE_MCU_TYPE_USB);
1058         val &= ~URE_SEN_VAL_MASK;
1059         val |= URE_SEN_VAL_NORMAL | URE_SEL_RXIDLE;
1060         ure_write_2(sc, URE_USB_AFE_CTRL2, URE_MCU_TYPE_USB, val);
1061
1062         ure_write_2(sc, URE_USB_CONNECT_TIMER, URE_MCU_TYPE_USB, 0x0001);
1063
1064         ure_write_2(sc, URE_USB_POWER_CUT, URE_MCU_TYPE_USB,
1065             ure_read_2(sc, URE_USB_POWER_CUT, URE_MCU_TYPE_USB) &
1066             ~(URE_PWR_EN | URE_PHASE2_EN));
1067         ure_write_2(sc, URE_USB_MISC_0, URE_MCU_TYPE_USB,
1068             ure_read_2(sc, URE_USB_MISC_0, URE_MCU_TYPE_USB) &
1069             ~URE_PCUT_STATUS);
1070
1071         memset(u1u2, 0xff, sizeof(u1u2));
1072         ure_write_mem(sc, URE_USB_TOLERANCE,
1073             URE_MCU_TYPE_USB | URE_BYTE_EN_SIX_BYTES, u1u2, sizeof(u1u2));
1074
1075         ure_write_2(sc, URE_PLA_MAC_PWR_CTRL, URE_MCU_TYPE_PLA,
1076             URE_ALDPS_SPDWN_RATIO);
1077         ure_write_2(sc, URE_PLA_MAC_PWR_CTRL2, URE_MCU_TYPE_PLA,
1078             URE_EEE_SPDWN_RATIO);
1079         ure_write_2(sc, URE_PLA_MAC_PWR_CTRL3, URE_MCU_TYPE_PLA,
1080             URE_PKT_AVAIL_SPDWN_EN | URE_SUSPEND_SPDWN_EN |
1081             URE_U1U2_SPDWN_EN | URE_L1_SPDWN_EN);
1082         ure_write_2(sc, URE_PLA_MAC_PWR_CTRL4, URE_MCU_TYPE_PLA,
1083             URE_PWRSAVE_SPDWN_EN | URE_RXDV_SPDWN_EN | URE_TX10MIDLE_EN |
1084             URE_TP100_SPDWN_EN | URE_TP500_SPDWN_EN | URE_TP1000_SPDWN_EN |
1085             URE_EEE_SPDWN_EN);
1086
1087         val = ure_read_2(sc, URE_USB_U2P3_CTRL, URE_MCU_TYPE_USB);
1088         if (!(sc->sc_chip & (URE_CHIP_VER_5C00 | URE_CHIP_VER_5C10)))
1089                 val |= URE_U2P3_ENABLE;
1090         else
1091                 val &= ~URE_U2P3_ENABLE;
1092         ure_write_2(sc, URE_USB_U2P3_CTRL, URE_MCU_TYPE_USB, val);
1093
1094         memset(u1u2, 0x00, sizeof(u1u2));
1095         ure_write_mem(sc, URE_USB_TOLERANCE,
1096             URE_MCU_TYPE_USB | URE_BYTE_EN_SIX_BYTES, u1u2, sizeof(u1u2));
1097
1098         /* Disable ALDPS. */
1099         ure_ocp_reg_write(sc, URE_OCP_POWER_CFG,
1100             ure_ocp_reg_read(sc, URE_OCP_POWER_CFG) & ~URE_EN_ALDPS);
1101         uether_pause(&sc->sc_ue, hz / 50);
1102
1103         ure_init_fifo(sc);
1104
1105         /* Disable Rx aggregation. */
1106         ure_write_2(sc, URE_USB_USB_CTRL, URE_MCU_TYPE_USB,
1107             ure_read_2(sc, URE_USB_USB_CTRL, URE_MCU_TYPE_USB) |
1108             URE_RX_AGG_DISABLE);
1109
1110         val = ure_read_2(sc, URE_USB_U2P3_CTRL, URE_MCU_TYPE_USB);
1111         if (!(sc->sc_chip & (URE_CHIP_VER_5C00 | URE_CHIP_VER_5C10)))
1112                 val |= URE_U2P3_ENABLE;
1113         else
1114                 val &= ~URE_U2P3_ENABLE;
1115         ure_write_2(sc, URE_USB_U2P3_CTRL, URE_MCU_TYPE_USB, val);
1116
1117         memset(u1u2, 0xff, sizeof(u1u2));
1118         ure_write_mem(sc, URE_USB_TOLERANCE,
1119             URE_MCU_TYPE_USB | URE_BYTE_EN_SIX_BYTES, u1u2, sizeof(u1u2));
1120 }
1121
1122 static void
1123 ure_stop(struct usb_ether *ue)
1124 {
1125         struct ure_softc *sc = uether_getsc(ue);
1126         struct ifnet *ifp = uether_getifp(ue);
1127
1128         URE_LOCK_ASSERT(sc, MA_OWNED);
1129
1130         ifp->if_drv_flags &= ~(IFF_DRV_RUNNING | IFF_DRV_OACTIVE);
1131         sc->sc_flags &= ~URE_FLAG_LINK;
1132
1133         /*
1134          * stop all the transfers, if not already stopped:
1135          */
1136         usbd_transfer_stop(sc->sc_xfer[URE_BULK_DT_WR]);
1137         usbd_transfer_stop(sc->sc_xfer[URE_BULK_DT_RD]);
1138 }
1139
1140 static void
1141 ure_disable_teredo(struct ure_softc *sc)
1142 {
1143
1144         ure_write_4(sc, URE_PLA_TEREDO_CFG, URE_MCU_TYPE_PLA,
1145             ure_read_4(sc, URE_PLA_TEREDO_CFG, URE_MCU_TYPE_PLA) & 
1146             ~(URE_TEREDO_SEL | URE_TEREDO_RS_EVENT_MASK | URE_OOB_TEREDO_EN));
1147         ure_write_2(sc, URE_PLA_WDT6_CTRL, URE_MCU_TYPE_PLA,
1148             URE_WDT6_SET_MODE);
1149         ure_write_2(sc, URE_PLA_REALWOW_TIMER, URE_MCU_TYPE_PLA, 0);
1150         ure_write_4(sc, URE_PLA_TEREDO_TIMER, URE_MCU_TYPE_PLA, 0);
1151 }
1152
1153 static void
1154 ure_init_fifo(struct ure_softc *sc)
1155 {
1156         uint32_t rx_fifo1, rx_fifo2;
1157         int i;
1158
1159         ure_write_2(sc, URE_PLA_MISC_1, URE_MCU_TYPE_PLA,
1160             ure_read_2(sc, URE_PLA_MISC_1, URE_MCU_TYPE_PLA) |
1161             URE_RXDY_GATED_EN);
1162
1163         ure_disable_teredo(sc);
1164
1165         ure_write_4(sc, URE_PLA_RCR, URE_MCU_TYPE_PLA,
1166             ure_read_4(sc, URE_PLA_RCR, URE_MCU_TYPE_PLA) &
1167             ~URE_RCR_ACPT_ALL);
1168
1169         if (!(sc->sc_flags & URE_FLAG_8152)) {
1170                 if (sc->sc_chip & (URE_CHIP_VER_5C00 | URE_CHIP_VER_5C10 |
1171                     URE_CHIP_VER_5C20)) {
1172                                 ure_ocp_reg_write(sc, URE_OCP_ADC_CFG,
1173                                     URE_CKADSEL_L | URE_ADC_EN | URE_EN_EMI_L);
1174                 }
1175                 if (sc->sc_chip & URE_CHIP_VER_5C00) {
1176                         ure_ocp_reg_write(sc, URE_OCP_EEE_CFG,
1177                             ure_ocp_reg_read(sc, URE_OCP_EEE_CFG) & 
1178                             ~URE_CTAP_SHORT_EN);
1179                 }
1180                 ure_ocp_reg_write(sc, URE_OCP_POWER_CFG,
1181                     ure_ocp_reg_read(sc, URE_OCP_POWER_CFG) |
1182                     URE_EEE_CLKDIV_EN);
1183                 ure_ocp_reg_write(sc, URE_OCP_DOWN_SPEED,
1184                     ure_ocp_reg_read(sc, URE_OCP_DOWN_SPEED) |
1185                     URE_EN_10M_BGOFF);
1186                 ure_ocp_reg_write(sc, URE_OCP_POWER_CFG,
1187                     ure_ocp_reg_read(sc, URE_OCP_POWER_CFG) |
1188                     URE_EN_10M_PLLOFF);
1189                 ure_ocp_reg_write(sc, URE_OCP_SRAM_ADDR, URE_SRAM_IMPEDANCE);
1190                 ure_ocp_reg_write(sc, URE_OCP_SRAM_DATA, 0x0b13);
1191                 ure_write_2(sc, URE_PLA_PHY_PWR, URE_MCU_TYPE_PLA,
1192                     ure_read_2(sc, URE_PLA_PHY_PWR, URE_MCU_TYPE_PLA) |
1193                     URE_PFM_PWM_SWITCH);
1194
1195                 /* Enable LPF corner auto tune. */
1196                 ure_ocp_reg_write(sc, URE_OCP_SRAM_ADDR, URE_SRAM_LPF_CFG);
1197                 ure_ocp_reg_write(sc, URE_OCP_SRAM_DATA, 0xf70f);
1198
1199                 /* Adjust 10M amplitude. */
1200                 ure_ocp_reg_write(sc, URE_OCP_SRAM_ADDR, URE_SRAM_10M_AMP1);
1201                 ure_ocp_reg_write(sc, URE_OCP_SRAM_DATA, 0x00af);
1202                 ure_ocp_reg_write(sc, URE_OCP_SRAM_ADDR, URE_SRAM_10M_AMP2);
1203                 ure_ocp_reg_write(sc, URE_OCP_SRAM_DATA, 0x0208);
1204         }
1205
1206         ure_reset(sc);
1207
1208         ure_write_1(sc, URE_PLA_CR, URE_MCU_TYPE_PLA, 0);
1209
1210         ure_write_1(sc, URE_PLA_OOB_CTRL, URE_MCU_TYPE_PLA,
1211             ure_read_1(sc, URE_PLA_OOB_CTRL, URE_MCU_TYPE_PLA) &
1212             ~URE_NOW_IS_OOB);
1213
1214         ure_write_2(sc, URE_PLA_SFF_STS_7, URE_MCU_TYPE_PLA,
1215             ure_read_2(sc, URE_PLA_SFF_STS_7, URE_MCU_TYPE_PLA) &
1216             ~URE_MCU_BORW_EN);
1217         for (i = 0; i < URE_TIMEOUT; i++) {
1218                 if (ure_read_1(sc, URE_PLA_OOB_CTRL, URE_MCU_TYPE_PLA) &
1219                     URE_LINK_LIST_READY)
1220                         break;
1221                 uether_pause(&sc->sc_ue, hz / 100);
1222         }
1223         if (i == URE_TIMEOUT)
1224                 device_printf(sc->sc_ue.ue_dev,
1225                     "timeout waiting for OOB control\n");
1226         ure_write_2(sc, URE_PLA_SFF_STS_7, URE_MCU_TYPE_PLA,
1227             ure_read_2(sc, URE_PLA_SFF_STS_7, URE_MCU_TYPE_PLA) |
1228             URE_RE_INIT_LL);
1229         for (i = 0; i < URE_TIMEOUT; i++) {
1230                 if (ure_read_1(sc, URE_PLA_OOB_CTRL, URE_MCU_TYPE_PLA) &
1231                     URE_LINK_LIST_READY)
1232                         break;
1233                 uether_pause(&sc->sc_ue, hz / 100);
1234         }
1235         if (i == URE_TIMEOUT)
1236                 device_printf(sc->sc_ue.ue_dev,
1237                     "timeout waiting for OOB control\n");
1238
1239         ure_write_2(sc, URE_PLA_CPCR, URE_MCU_TYPE_PLA,
1240             ure_read_2(sc, URE_PLA_CPCR, URE_MCU_TYPE_PLA) &
1241             ~URE_CPCR_RX_VLAN);
1242         ure_write_2(sc, URE_PLA_TCR0, URE_MCU_TYPE_PLA,
1243             ure_read_2(sc, URE_PLA_TCR0, URE_MCU_TYPE_PLA) |
1244             URE_TCR0_AUTO_FIFO);
1245
1246         /* Configure Rx FIFO threshold. */
1247         ure_write_4(sc, URE_PLA_RXFIFO_CTRL0, URE_MCU_TYPE_PLA,
1248             URE_RXFIFO_THR1_NORMAL);
1249         if (usbd_get_speed(sc->sc_ue.ue_udev) == USB_SPEED_FULL) {
1250                 rx_fifo1 = URE_RXFIFO_THR2_FULL;
1251                 rx_fifo2 = URE_RXFIFO_THR3_FULL;
1252         } else {
1253                 rx_fifo1 = URE_RXFIFO_THR2_HIGH;
1254                 rx_fifo2 = URE_RXFIFO_THR3_HIGH;
1255         }
1256         ure_write_4(sc, URE_PLA_RXFIFO_CTRL1, URE_MCU_TYPE_PLA, rx_fifo1);
1257         ure_write_4(sc, URE_PLA_RXFIFO_CTRL2, URE_MCU_TYPE_PLA, rx_fifo2);
1258
1259         /* Configure Tx FIFO threshold. */
1260         ure_write_4(sc, URE_PLA_TXFIFO_CTRL, URE_MCU_TYPE_PLA,
1261             URE_TXFIFO_THR_NORMAL);
1262 }