1/*
2 * Copyright (C) 2008 Michael Brown <mbrown@fensystems.co.uk>.
3 * Copyright (C) 2008 NetXen, Inc.
4 *
5 * This program is free software; you can redistribute it and/or
6 * modify it under the terms of the GNU General Public License as
7 * published by the Free Software Foundation; either version 2 of the
8 * License, or any later version.
9 *
10 * This program is distributed in the hope that it will be useful, but
11 * WITHOUT ANY WARRANTY; without even the implied warranty of
12 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
13 * General Public License for more details.
14 *
15 * You should have received a copy of the GNU General Public License
16 * along with this program; if not, write to the Free Software
17 * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
18 */
19
20FILE_LICENCE ( GPL2_OR_LATER );
21
22#include <stdint.h>
23#include <stdlib.h>
24#include <string.h>
25#include <unistd.h>
26#include <errno.h>
27#include <assert.h>
28#include <byteswap.h>
29#include <gpxe/pci.h>
30#include <gpxe/io.h>
31#include <gpxe/malloc.h>
32#include <gpxe/iobuf.h>
33#include <gpxe/netdevice.h>
34#include <gpxe/if_ether.h>
35#include <gpxe/ethernet.h>
36#include <gpxe/spi.h>
37#include <gpxe/settings.h>
38#include "phantom.h"
39
40/**
41 * @file
42 *
43 * NetXen Phantom NICs
44 *
45 */
46
47/** Maximum number of ports */
48#define PHN_MAX_NUM_PORTS 4
49
50/** Maximum time to wait for command PEG to initialise
51 *
52 * BUGxxxx
53 *
54 * The command PEG will currently report initialisation complete only
55 * when at least one PHY has detected a link (so that the global PHY
56 * clock can be set to 10G/1G as appropriate).  This can take a very,
57 * very long time.
58 *
59 * A future firmware revision should decouple PHY initialisation from
60 * firmware initialisation, at which point the command PEG will report
61 * initialisation complete much earlier, and this timeout can be
62 * reduced.
63 */
64#define PHN_CMDPEG_INIT_TIMEOUT_SEC 50
65
66/** Maximum time to wait for receive PEG to initialise */
67#define PHN_RCVPEG_INIT_TIMEOUT_SEC 2
68
69/** Maximum time to wait for firmware to accept a command */
70#define PHN_ISSUE_CMD_TIMEOUT_MS 2000
71
72/** Maximum time to wait for test memory */
73#define PHN_TEST_MEM_TIMEOUT_MS 100
74
75/** Maximum time to wait for CLP command to be issued */
76#define PHN_CLP_CMD_TIMEOUT_MS 500
77
78/** Link state poll frequency
79 *
80 * The link state will be checked once in every N calls to poll().
81 */
82#define PHN_LINK_POLL_FREQUENCY 4096
83
84/** Number of RX descriptors */
85#define PHN_NUM_RDS 32
86
87/** RX maximum fill level.  Must be strictly less than PHN_NUM_RDS. */
88#define PHN_RDS_MAX_FILL 16
89
90/** RX buffer size */
91#define PHN_RX_BUFSIZE ( 32 /* max LL padding added by card */ + \
92			 ETH_FRAME_LEN )
93
94/** Number of RX status descriptors */
95#define PHN_NUM_SDS 32
96
97/** Number of TX descriptors */
98#define PHN_NUM_CDS 8
99
100/** A Phantom descriptor ring set */
101struct phantom_descriptor_rings {
102	/** RX descriptors */
103	struct phantom_rds rds[PHN_NUM_RDS];
104	/** RX status descriptors */
105	struct phantom_sds sds[PHN_NUM_SDS];
106	/** TX descriptors */
107	union phantom_cds cds[PHN_NUM_CDS];
108	/** TX consumer index */
109	volatile uint32_t cmd_cons;
110};
111
112/** RX context creation request and response buffers */
113struct phantom_create_rx_ctx_rqrsp {
114	struct {
115		struct nx_hostrq_rx_ctx_s rx_ctx;
116		struct nx_hostrq_rds_ring_s rds;
117		struct nx_hostrq_sds_ring_s sds;
118	} __unm_dma_aligned hostrq;
119	struct {
120		struct nx_cardrsp_rx_ctx_s rx_ctx;
121		struct nx_cardrsp_rds_ring_s rds;
122		struct nx_cardrsp_sds_ring_s sds;
123	} __unm_dma_aligned cardrsp;
124};
125
126/** TX context creation request and response buffers */
127struct phantom_create_tx_ctx_rqrsp {
128	struct {
129		struct nx_hostrq_tx_ctx_s tx_ctx;
130	} __unm_dma_aligned hostrq;
131	struct {
132		struct nx_cardrsp_tx_ctx_s tx_ctx;
133	} __unm_dma_aligned cardrsp;
134};
135
136/** A Phantom NIC */
137struct phantom_nic {
138	/** BAR 0 */
139	void *bar0;
140	/** Current CRB window */
141	unsigned long crb_window;
142	/** CRB window access method */
143	unsigned long ( *crb_access ) ( struct phantom_nic *phantom,
144					unsigned long reg );
145
146
147	/** Port number */
148	unsigned int port;
149
150
151	/** RX context ID */
152	uint16_t rx_context_id;
153	/** RX descriptor producer CRB offset */
154	unsigned long rds_producer_crb;
155	/** RX status descriptor consumer CRB offset */
156	unsigned long sds_consumer_crb;
157
158	/** RX producer index */
159	unsigned int rds_producer_idx;
160	/** RX consumer index */
161	unsigned int rds_consumer_idx;
162	/** RX status consumer index */
163	unsigned int sds_consumer_idx;
164	/** RX I/O buffers */
165	struct io_buffer *rds_iobuf[PHN_RDS_MAX_FILL];
166
167
168	/** TX context ID */
169	uint16_t tx_context_id;
170	/** TX descriptor producer CRB offset */
171	unsigned long cds_producer_crb;
172
173	/** TX producer index */
174	unsigned int cds_producer_idx;
175	/** TX consumer index */
176	unsigned int cds_consumer_idx;
177	/** TX I/O buffers */
178	struct io_buffer *cds_iobuf[PHN_NUM_CDS];
179
180
181	/** Descriptor rings */
182	struct phantom_descriptor_rings *desc;
183
184
185	/** Last known link state */
186	uint32_t link_state;
187	/** Link state poll timer */
188	unsigned long link_poll_timer;
189
190
191	/** Non-volatile settings */
192	struct settings settings;
193};
194
195/***************************************************************************
196 *
197 * CRB register access
198 *
199 */
200
201/**
202 * Prepare for access to CRB register via 128MB BAR
203 *
204 * @v phantom		Phantom NIC
205 * @v reg		Register offset within abstract address space
206 * @ret offset		Register offset within PCI BAR0
207 */
208static unsigned long phantom_crb_access_128m ( struct phantom_nic *phantom,
209					       unsigned long reg ) {
210	unsigned long offset = ( 0x6000000 + ( reg & 0x1ffffff ) );
211	uint32_t window = ( reg & 0x2000000 );
212	uint32_t verify_window;
213
214	if ( phantom->crb_window != window ) {
215
216		/* Write to the CRB window register */
217		writel ( window, phantom->bar0 + UNM_128M_CRB_WINDOW );
218
219		/* Ensure that the write has reached the card */
220		verify_window = readl ( phantom->bar0 + UNM_128M_CRB_WINDOW );
221		assert ( verify_window == window );
222
223		/* Record new window */
224		phantom->crb_window = window;
225	}
226
227	return offset;
228}
229
230/**
231 * Prepare for access to CRB register via 32MB BAR
232 *
233 * @v phantom		Phantom NIC
234 * @v reg		Register offset within abstract address space
235 * @ret offset		Register offset within PCI BAR0
236 */
237static unsigned long phantom_crb_access_32m ( struct phantom_nic *phantom,
238					      unsigned long reg ) {
239	unsigned long offset = ( reg & 0x1ffffff );
240	uint32_t window = ( reg & 0x2000000 );
241	uint32_t verify_window;
242
243	if ( phantom->crb_window != window ) {
244
245		/* Write to the CRB window register */
246		writel ( window, phantom->bar0 + UNM_32M_CRB_WINDOW );
247
248		/* Ensure that the write has reached the card */
249		verify_window = readl ( phantom->bar0 + UNM_32M_CRB_WINDOW );
250		assert ( verify_window == window );
251
252		/* Record new window */
253		phantom->crb_window = window;
254	}
255
256	return offset;
257}
258
259/**
260 * Prepare for access to CRB register via 2MB BAR
261 *
262 * @v phantom		Phantom NIC
263 * @v reg		Register offset within abstract address space
264 * @ret offset		Register offset within PCI BAR0
265 */
266static unsigned long phantom_crb_access_2m ( struct phantom_nic *phantom,
267					     unsigned long reg ) {
268	static const struct {
269		uint8_t block;
270		uint16_t window_hi;
271	} reg_window_hi[] = {
272		{ UNM_CRB_BLK_PCIE,	0x773 },
273		{ UNM_CRB_BLK_CAM,	0x416 },
274		{ UNM_CRB_BLK_ROMUSB,	0x421 },
275		{ UNM_CRB_BLK_TEST,	0x295 },
276		{ UNM_CRB_BLK_PEG_0,	0x340 },
277		{ UNM_CRB_BLK_PEG_1,	0x341 },
278		{ UNM_CRB_BLK_PEG_2,	0x342 },
279		{ UNM_CRB_BLK_PEG_3,	0x343 },
280		{ UNM_CRB_BLK_PEG_4,	0x34b },
281	};
282	unsigned int block = UNM_CRB_BLK ( reg );
283	unsigned long offset = UNM_CRB_OFFSET ( reg );
284	uint32_t window;
285	uint32_t verify_window;
286	unsigned int i;
287
288	for ( i = 0 ; i < ( sizeof ( reg_window_hi ) /
289			    sizeof ( reg_window_hi[0] ) ) ; i++ ) {
290
291		if ( reg_window_hi[i].block != block )
292			continue;
293
294		window = ( ( reg_window_hi[i].window_hi << 20 ) |
295			   ( offset & 0x000f0000 ) );
296
297		if ( phantom->crb_window != window ) {
298
299			/* Write to the CRB window register */
300			writel ( window, phantom->bar0 + UNM_2M_CRB_WINDOW );
301
302			/* Ensure that the write has reached the card */
303			verify_window = readl ( phantom->bar0 +
304						UNM_2M_CRB_WINDOW );
305			assert ( verify_window == window );
306
307			/* Record new window */
308			phantom->crb_window = window;
309		}
310
311		return ( 0x1e0000 + ( offset & 0xffff ) );
312	}
313
314	assert ( 0 );
315	return 0;
316}
317
318/**
319 * Read from Phantom CRB register
320 *
321 * @v phantom		Phantom NIC
322 * @v reg		Register offset within abstract address space
323 * @ret	value		Register value
324 */
325static uint32_t phantom_readl ( struct phantom_nic *phantom,
326				unsigned long reg ) {
327	unsigned long offset;
328
329	offset = phantom->crb_access ( phantom, reg );
330	return readl ( phantom->bar0 + offset );
331}
332
333/**
334 * Write to Phantom CRB register
335 *
336 * @v phantom		Phantom NIC
337 * @v value		Register value
338 * @v reg		Register offset within abstract address space
339 */
340static void phantom_writel ( struct phantom_nic *phantom, uint32_t value,
341			     unsigned long reg ) {
342	unsigned long offset;
343
344	offset = phantom->crb_access ( phantom, reg );
345	writel ( value, phantom->bar0 + offset );
346}
347
348/**
349 * Write to Phantom CRB HI/LO register pair
350 *
351 * @v phantom		Phantom NIC
352 * @v value		Register value
353 * @v lo_offset		LO register offset within CRB
354 * @v hi_offset		HI register offset within CRB
355 */
356static inline void phantom_write_hilo ( struct phantom_nic *phantom,
357					uint64_t value,
358					unsigned long lo_offset,
359					unsigned long hi_offset ) {
360	uint32_t lo = ( value & 0xffffffffUL );
361	uint32_t hi = ( value >> 32 );
362
363	phantom_writel ( phantom, lo, lo_offset );
364	phantom_writel ( phantom, hi, hi_offset );
365}
366
367/***************************************************************************
368 *
369 * Firmware message buffer access (for debug)
370 *
371 */
372
373/**
374 * Read from Phantom test memory
375 *
376 * @v phantom		Phantom NIC
377 * @v offset		Offset within test memory
378 * @v buf		8-byte buffer to fill
379 * @ret rc		Return status code
380 */
381static int phantom_read_test_mem_block ( struct phantom_nic *phantom,
382					 unsigned long offset,
383					 uint32_t buf[2] ) {
384	unsigned int retries;
385	uint32_t test_control;
386
387	phantom_write_hilo ( phantom, offset, UNM_TEST_ADDR_LO,
388			     UNM_TEST_ADDR_HI );
389	phantom_writel ( phantom, UNM_TEST_CONTROL_ENABLE, UNM_TEST_CONTROL );
390	phantom_writel ( phantom,
391			 ( UNM_TEST_CONTROL_ENABLE | UNM_TEST_CONTROL_START ),
392			 UNM_TEST_CONTROL );
393
394	for ( retries = 0 ; retries < PHN_TEST_MEM_TIMEOUT_MS ; retries++ ) {
395		test_control = phantom_readl ( phantom, UNM_TEST_CONTROL );
396		if ( ( test_control & UNM_TEST_CONTROL_BUSY ) == 0 ) {
397			buf[0] = phantom_readl ( phantom, UNM_TEST_RDDATA_LO );
398			buf[1] = phantom_readl ( phantom, UNM_TEST_RDDATA_HI );
399			return 0;
400		}
401		mdelay ( 1 );
402	}
403
404	DBGC ( phantom, "Phantom %p timed out waiting for test memory\n",
405	       phantom );
406	return -ETIMEDOUT;
407}
408
409/**
410 * Read single byte from Phantom test memory
411 *
412 * @v phantom		Phantom NIC
413 * @v offset		Offset within test memory
414 * @ret byte		Byte read, or negative error
415 */
416static int phantom_read_test_mem ( struct phantom_nic *phantom,
417				   unsigned long offset ) {
418	static union {
419		uint8_t bytes[8];
420		uint32_t dwords[2];
421	} cache;
422	static unsigned long cache_offset = -1UL;
423	unsigned long sub_offset;
424	int rc;
425
426	sub_offset = ( offset & ( sizeof ( cache ) - 1 ) );
427	offset = ( offset & ~( sizeof ( cache ) - 1 ) );
428
429	if ( cache_offset != offset ) {
430		if ( ( rc = phantom_read_test_mem_block ( phantom, offset,
431							  cache.dwords )) !=0 )
432			return rc;
433		cache_offset = offset;
434	}
435
436	return cache.bytes[sub_offset];
437}
438
439/**
440 * Dump Phantom firmware dmesg log
441 *
442 * @v phantom		Phantom NIC
443 * @v log		Log number
444 * @v max_lines		Maximum number of lines to show, or -1 to show all
445 * @ret rc		Return status code
446 */
447static int phantom_dmesg ( struct phantom_nic *phantom, unsigned int log,
448			    unsigned int max_lines ) {
449	uint32_t head;
450	uint32_t tail;
451	uint32_t len;
452	uint32_t sig;
453	uint32_t offset;
454	int byte;
455
456	/* Optimise out for non-debug builds */
457	if ( ! DBG_LOG )
458		return 0;
459
460	/* Locate log */
461	head = phantom_readl ( phantom, UNM_CAM_RAM_DMESG_HEAD ( log ) );
462	len = phantom_readl ( phantom, UNM_CAM_RAM_DMESG_LEN ( log ) );
463	tail = phantom_readl ( phantom, UNM_CAM_RAM_DMESG_TAIL ( log ) );
464	sig = phantom_readl ( phantom, UNM_CAM_RAM_DMESG_SIG ( log ) );
465	DBGC ( phantom, "Phantom %p firmware dmesg buffer %d (%08x-%08x)\n",
466	       phantom, log, head, tail );
467	assert ( ( head & 0x07 ) == 0 );
468	if ( sig != UNM_CAM_RAM_DMESG_SIG_MAGIC ) {
469		DBGC ( phantom, "Warning: bad signature %08x (want %08lx)\n",
470		       sig, UNM_CAM_RAM_DMESG_SIG_MAGIC );
471	}
472
473	/* Locate start of last (max_lines) lines */
474	for ( offset = tail ; offset > head ; offset-- ) {
475		if ( ( byte = phantom_read_test_mem ( phantom,
476						      ( offset - 1 ) ) ) < 0 )
477			return byte;
478		if ( ( byte == '\n' ) && ( max_lines-- == 0 ) )
479			break;
480	}
481
482	/* Print lines */
483	for ( ; offset < tail ; offset++ ) {
484		if ( ( byte = phantom_read_test_mem ( phantom, offset ) ) < 0 )
485			return byte;
486		DBG ( "%c", byte );
487	}
488	DBG ( "\n" );
489	return 0;
490}
491
492/**
493 * Dump Phantom firmware dmesg logs
494 *
495 * @v phantom		Phantom NIC
496 * @v max_lines		Maximum number of lines to show, or -1 to show all
497 */
498static void __attribute__ (( unused ))
499phantom_dmesg_all ( struct phantom_nic *phantom, unsigned int max_lines ) {
500	unsigned int i;
501
502	for ( i = 0 ; i < UNM_CAM_RAM_NUM_DMESG_BUFFERS ; i++ )
503		phantom_dmesg ( phantom, i, max_lines );
504}
505
506/***************************************************************************
507 *
508 * Firmware interface
509 *
510 */
511
512/**
513 * Wait for firmware to accept command
514 *
515 * @v phantom		Phantom NIC
516 * @ret rc		Return status code
517 */
518static int phantom_wait_for_cmd ( struct phantom_nic *phantom ) {
519	unsigned int retries;
520	uint32_t cdrp;
521
522	for ( retries = 0 ; retries < PHN_ISSUE_CMD_TIMEOUT_MS ; retries++ ) {
523		mdelay ( 1 );
524		cdrp = phantom_readl ( phantom, UNM_NIC_REG_NX_CDRP );
525		if ( NX_CDRP_IS_RSP ( cdrp ) ) {
526			switch ( NX_CDRP_FORM_RSP ( cdrp ) ) {
527			case NX_CDRP_RSP_OK:
528				return 0;
529			case NX_CDRP_RSP_FAIL:
530				return -EIO;
531			case NX_CDRP_RSP_TIMEOUT:
532				return -ETIMEDOUT;
533			default:
534				return -EPROTO;
535			}
536		}
537	}
538
539	DBGC ( phantom, "Phantom %p timed out waiting for firmware to accept "
540	       "command\n", phantom );
541	return -ETIMEDOUT;
542}
543
544/**
545 * Issue command to firmware
546 *
547 * @v phantom		Phantom NIC
548 * @v command		Firmware command
549 * @v arg1		Argument 1
550 * @v arg2		Argument 2
551 * @v arg3		Argument 3
552 * @ret rc		Return status code
553 */
554static int phantom_issue_cmd ( struct phantom_nic *phantom,
555			       uint32_t command, uint32_t arg1, uint32_t arg2,
556			       uint32_t arg3 ) {
557	uint32_t signature;
558	int rc;
559
560	/* Issue command */
561	signature = NX_CDRP_SIGNATURE_MAKE ( phantom->port,
562					     NXHAL_VERSION );
563	DBGC2 ( phantom, "Phantom %p issuing command %08x (%08x, %08x, "
564		"%08x)\n", phantom, command, arg1, arg2, arg3 );
565	phantom_writel ( phantom, signature, UNM_NIC_REG_NX_SIGN );
566	phantom_writel ( phantom, arg1, UNM_NIC_REG_NX_ARG1 );
567	phantom_writel ( phantom, arg2, UNM_NIC_REG_NX_ARG2 );
568	phantom_writel ( phantom, arg3, UNM_NIC_REG_NX_ARG3 );
569	phantom_writel ( phantom, NX_CDRP_FORM_CMD ( command ),
570			 UNM_NIC_REG_NX_CDRP );
571
572	/* Wait for command to be accepted */
573	if ( ( rc = phantom_wait_for_cmd ( phantom ) ) != 0 ) {
574		DBGC ( phantom, "Phantom %p could not issue command: %s\n",
575		       phantom, strerror ( rc ) );
576		return rc;
577	}
578
579	return 0;
580}
581
582/**
583 * Issue buffer-format command to firmware
584 *
585 * @v phantom		Phantom NIC
586 * @v command		Firmware command
587 * @v buffer		Buffer to pass to firmware
588 * @v len		Length of buffer
589 * @ret rc		Return status code
590 */
591static int phantom_issue_buf_cmd ( struct phantom_nic *phantom,
592				   uint32_t command, void *buffer,
593				   size_t len ) {
594	uint64_t physaddr;
595
596	physaddr = virt_to_bus ( buffer );
597	return phantom_issue_cmd ( phantom, command, ( physaddr >> 32 ),
598				   ( physaddr & 0xffffffffUL ), len );
599}
600
601/**
602 * Create Phantom RX context
603 *
604 * @v phantom		Phantom NIC
605 * @ret rc		Return status code
606 */
607static int phantom_create_rx_ctx ( struct phantom_nic *phantom ) {
608	struct phantom_create_rx_ctx_rqrsp *buf;
609	int rc;
610
611	/* Allocate context creation buffer */
612	buf = malloc_dma ( sizeof ( *buf ), UNM_DMA_BUFFER_ALIGN );
613	if ( ! buf ) {
614		rc = -ENOMEM;
615		goto out;
616	}
617	memset ( buf, 0, sizeof ( *buf ) );
618
619	/* Prepare request */
620	buf->hostrq.rx_ctx.host_rsp_dma_addr =
621		cpu_to_le64 ( virt_to_bus ( &buf->cardrsp ) );
622	buf->hostrq.rx_ctx.capabilities[0] =
623		cpu_to_le32 ( NX_CAP0_LEGACY_CONTEXT | NX_CAP0_LEGACY_MN );
624	buf->hostrq.rx_ctx.host_int_crb_mode =
625		cpu_to_le32 ( NX_HOST_INT_CRB_MODE_SHARED );
626	buf->hostrq.rx_ctx.host_rds_crb_mode =
627		cpu_to_le32 ( NX_HOST_RDS_CRB_MODE_UNIQUE );
628	buf->hostrq.rx_ctx.rds_ring_offset = cpu_to_le32 ( 0 );
629	buf->hostrq.rx_ctx.sds_ring_offset =
630		cpu_to_le32 ( sizeof ( buf->hostrq.rds ) );
631	buf->hostrq.rx_ctx.num_rds_rings = cpu_to_le16 ( 1 );
632	buf->hostrq.rx_ctx.num_sds_rings = cpu_to_le16 ( 1 );
633	buf->hostrq.rds.host_phys_addr =
634		cpu_to_le64 ( virt_to_bus ( phantom->desc->rds ) );
635	buf->hostrq.rds.buff_size = cpu_to_le64 ( PHN_RX_BUFSIZE );
636	buf->hostrq.rds.ring_size = cpu_to_le32 ( PHN_NUM_RDS );
637	buf->hostrq.rds.ring_kind = cpu_to_le32 ( NX_RDS_RING_TYPE_NORMAL );
638	buf->hostrq.sds.host_phys_addr =
639		cpu_to_le64 ( virt_to_bus ( phantom->desc->sds ) );
640	buf->hostrq.sds.ring_size = cpu_to_le32 ( PHN_NUM_SDS );
641
642	DBGC ( phantom, "Phantom %p creating RX context\n", phantom );
643	DBGC2_HDA ( phantom, virt_to_bus ( &buf->hostrq ),
644		    &buf->hostrq, sizeof ( buf->hostrq ) );
645
646	/* Issue request */
647	if ( ( rc = phantom_issue_buf_cmd ( phantom,
648					    NX_CDRP_CMD_CREATE_RX_CTX,
649					    &buf->hostrq,
650					    sizeof ( buf->hostrq ) ) ) != 0 ) {
651		DBGC ( phantom, "Phantom %p could not create RX context: "
652		       "%s\n", phantom, strerror ( rc ) );
653		DBGC ( phantom, "Request:\n" );
654		DBGC_HDA ( phantom, virt_to_bus ( &buf->hostrq ),
655			   &buf->hostrq, sizeof ( buf->hostrq ) );
656		DBGC ( phantom, "Response:\n" );
657		DBGC_HDA ( phantom, virt_to_bus ( &buf->cardrsp ),
658			   &buf->cardrsp, sizeof ( buf->cardrsp ) );
659		goto out;
660	}
661
662	/* Retrieve context parameters */
663	phantom->rx_context_id =
664		le16_to_cpu ( buf->cardrsp.rx_ctx.context_id );
665	phantom->rds_producer_crb =
666		( UNM_CAM_RAM +
667		  le32_to_cpu ( buf->cardrsp.rds.host_producer_crb ));
668	phantom->sds_consumer_crb =
669		( UNM_CAM_RAM +
670		  le32_to_cpu ( buf->cardrsp.sds.host_consumer_crb ));
671
672	DBGC ( phantom, "Phantom %p created RX context (id %04x, port phys "
673	       "%02x virt %02x)\n", phantom, phantom->rx_context_id,
674	       buf->cardrsp.rx_ctx.phys_port, buf->cardrsp.rx_ctx.virt_port );
675	DBGC2_HDA ( phantom, virt_to_bus ( &buf->cardrsp ),
676		    &buf->cardrsp, sizeof ( buf->cardrsp ) );
677	DBGC ( phantom, "Phantom %p RDS producer CRB is %08lx\n",
678	       phantom, phantom->rds_producer_crb );
679	DBGC ( phantom, "Phantom %p SDS consumer CRB is %08lx\n",
680	       phantom, phantom->sds_consumer_crb );
681
682 out:
683	free_dma ( buf, sizeof ( *buf ) );
684	return rc;
685}
686
687/**
688 * Destroy Phantom RX context
689 *
690 * @v phantom		Phantom NIC
691 * @ret rc		Return status code
692 */
693static void phantom_destroy_rx_ctx ( struct phantom_nic *phantom ) {
694	int rc;
695
696	DBGC ( phantom, "Phantom %p destroying RX context (id %04x)\n",
697	       phantom, phantom->rx_context_id );
698
699	/* Issue request */
700	if ( ( rc = phantom_issue_cmd ( phantom,
701					NX_CDRP_CMD_DESTROY_RX_CTX,
702					phantom->rx_context_id,
703					NX_DESTROY_CTX_RESET, 0 ) ) != 0 ) {
704		DBGC ( phantom, "Phantom %p could not destroy RX context: "
705		       "%s\n", phantom, strerror ( rc ) );
706		/* We're probably screwed */
707		return;
708	}
709
710	/* Clear context parameters */
711	phantom->rx_context_id = 0;
712	phantom->rds_producer_crb = 0;
713	phantom->sds_consumer_crb = 0;
714
715	/* Reset software counters */
716	phantom->rds_producer_idx = 0;
717	phantom->rds_consumer_idx = 0;
718	phantom->sds_consumer_idx = 0;
719}
720
721/**
722 * Create Phantom TX context
723 *
724 * @v phantom		Phantom NIC
725 * @ret rc		Return status code
726 */
727static int phantom_create_tx_ctx ( struct phantom_nic *phantom ) {
728	struct phantom_create_tx_ctx_rqrsp *buf;
729	int rc;
730
731	/* Allocate context creation buffer */
732	buf = malloc_dma ( sizeof ( *buf ), UNM_DMA_BUFFER_ALIGN );
733	if ( ! buf ) {
734		rc = -ENOMEM;
735		goto out;
736	}
737	memset ( buf, 0, sizeof ( *buf ) );
738
739	/* Prepare request */
740	buf->hostrq.tx_ctx.host_rsp_dma_addr =
741		cpu_to_le64 ( virt_to_bus ( &buf->cardrsp ) );
742	buf->hostrq.tx_ctx.cmd_cons_dma_addr =
743		cpu_to_le64 ( virt_to_bus ( &phantom->desc->cmd_cons ) );
744	buf->hostrq.tx_ctx.capabilities[0] =
745		cpu_to_le32 ( NX_CAP0_LEGACY_CONTEXT | NX_CAP0_LEGACY_MN );
746	buf->hostrq.tx_ctx.host_int_crb_mode =
747		cpu_to_le32 ( NX_HOST_INT_CRB_MODE_SHARED );
748	buf->hostrq.tx_ctx.cds_ring.host_phys_addr =
749		cpu_to_le64 ( virt_to_bus ( phantom->desc->cds ) );
750	buf->hostrq.tx_ctx.cds_ring.ring_size = cpu_to_le32 ( PHN_NUM_CDS );
751
752	DBGC ( phantom, "Phantom %p creating TX context\n", phantom );
753	DBGC2_HDA ( phantom, virt_to_bus ( &buf->hostrq ),
754		    &buf->hostrq, sizeof ( buf->hostrq ) );
755
756	/* Issue request */
757	if ( ( rc = phantom_issue_buf_cmd ( phantom,
758					    NX_CDRP_CMD_CREATE_TX_CTX,
759					    &buf->hostrq,
760					    sizeof ( buf->hostrq ) ) ) != 0 ) {
761		DBGC ( phantom, "Phantom %p could not create TX context: "
762		       "%s\n", phantom, strerror ( rc ) );
763		DBGC ( phantom, "Request:\n" );
764		DBGC_HDA ( phantom, virt_to_bus ( &buf->hostrq ),
765			   &buf->hostrq, sizeof ( buf->hostrq ) );
766		DBGC ( phantom, "Response:\n" );
767		DBGC_HDA ( phantom, virt_to_bus ( &buf->cardrsp ),
768			   &buf->cardrsp, sizeof ( buf->cardrsp ) );
769		goto out;
770	}
771
772	/* Retrieve context parameters */
773	phantom->tx_context_id =
774		le16_to_cpu ( buf->cardrsp.tx_ctx.context_id );
775	phantom->cds_producer_crb =
776		( UNM_CAM_RAM +
777		  le32_to_cpu(buf->cardrsp.tx_ctx.cds_ring.host_producer_crb));
778
779	DBGC ( phantom, "Phantom %p created TX context (id %04x, port phys "
780	       "%02x virt %02x)\n", phantom, phantom->tx_context_id,
781	       buf->cardrsp.tx_ctx.phys_port, buf->cardrsp.tx_ctx.virt_port );
782	DBGC2_HDA ( phantom, virt_to_bus ( &buf->cardrsp ),
783		    &buf->cardrsp, sizeof ( buf->cardrsp ) );
784	DBGC ( phantom, "Phantom %p CDS producer CRB is %08lx\n",
785	       phantom, phantom->cds_producer_crb );
786
787 out:
788	free_dma ( buf, sizeof ( *buf ) );
789	return rc;
790}
791
792/**
793 * Destroy Phantom TX context
794 *
795 * @v phantom		Phantom NIC
796 * @ret rc		Return status code
797 */
798static void phantom_destroy_tx_ctx ( struct phantom_nic *phantom ) {
799	int rc;
800
801	DBGC ( phantom, "Phantom %p destroying TX context (id %04x)\n",
802	       phantom, phantom->tx_context_id );
803
804	/* Issue request */
805	if ( ( rc = phantom_issue_cmd ( phantom,
806					NX_CDRP_CMD_DESTROY_TX_CTX,
807					phantom->tx_context_id,
808					NX_DESTROY_CTX_RESET, 0 ) ) != 0 ) {
809		DBGC ( phantom, "Phantom %p could not destroy TX context: "
810		       "%s\n", phantom, strerror ( rc ) );
811		/* We're probably screwed */
812		return;
813	}
814
815	/* Clear context parameters */
816	phantom->tx_context_id = 0;
817	phantom->cds_producer_crb = 0;
818
819	/* Reset software counters */
820	phantom->cds_producer_idx = 0;
821	phantom->cds_consumer_idx = 0;
822}
823
824/***************************************************************************
825 *
826 * Descriptor ring management
827 *
828 */
829
830/**
831 * Allocate Phantom RX descriptor
832 *
833 * @v phantom		Phantom NIC
834 * @ret index		RX descriptor index, or negative error
835 */
836static int phantom_alloc_rds ( struct phantom_nic *phantom ) {
837	unsigned int rds_producer_idx;
838	unsigned int next_rds_producer_idx;
839
840	/* Check for space in the ring.  RX descriptors are consumed
841	 * out of order, but they are *read* by the hardware in strict
842	 * order.  We maintain a pessimistic consumer index, which is
843	 * guaranteed never to be an overestimate of the number of
844	 * descriptors read by the hardware.
845	 */
846	rds_producer_idx = phantom->rds_producer_idx;
847	next_rds_producer_idx = ( ( rds_producer_idx + 1 ) % PHN_NUM_RDS );
848	if ( next_rds_producer_idx == phantom->rds_consumer_idx ) {
849		DBGC ( phantom, "Phantom %p RDS ring full (index %d not "
850		       "consumed)\n", phantom, next_rds_producer_idx );
851		return -ENOBUFS;
852	}
853
854	return rds_producer_idx;
855}
856
857/**
858 * Post Phantom RX descriptor
859 *
860 * @v phantom		Phantom NIC
861 * @v rds		RX descriptor
862 */
863static void phantom_post_rds ( struct phantom_nic *phantom,
864			       struct phantom_rds *rds ) {
865	unsigned int rds_producer_idx;
866	unsigned int next_rds_producer_idx;
867	struct phantom_rds *entry;
868
869	/* Copy descriptor to ring */
870	rds_producer_idx = phantom->rds_producer_idx;
871	entry = &phantom->desc->rds[rds_producer_idx];
872	memcpy ( entry, rds, sizeof ( *entry ) );
873	DBGC2 ( phantom, "Phantom %p posting RDS %ld (slot %d):\n",
874		phantom, NX_GET ( rds, handle ), rds_producer_idx );
875	DBGC2_HDA ( phantom, virt_to_bus ( entry ), entry, sizeof ( *entry ) );
876
877	/* Update producer index */
878	next_rds_producer_idx = ( ( rds_producer_idx + 1 ) % PHN_NUM_RDS );
879	phantom->rds_producer_idx = next_rds_producer_idx;
880	wmb();
881	phantom_writel ( phantom, phantom->rds_producer_idx,
882			 phantom->rds_producer_crb );
883}
884
885/**
886 * Allocate Phantom TX descriptor
887 *
888 * @v phantom		Phantom NIC
889 * @ret index		TX descriptor index, or negative error
890 */
891static int phantom_alloc_cds ( struct phantom_nic *phantom ) {
892	unsigned int cds_producer_idx;
893	unsigned int next_cds_producer_idx;
894
895	/* Check for space in the ring.  TX descriptors are consumed
896	 * in strict order, so we just check for a collision against
897	 * the consumer index.
898	 */
899	cds_producer_idx = phantom->cds_producer_idx;
900	next_cds_producer_idx = ( ( cds_producer_idx + 1 ) % PHN_NUM_CDS );
901	if ( next_cds_producer_idx == phantom->cds_consumer_idx ) {
902		DBGC ( phantom, "Phantom %p CDS ring full (index %d not "
903		       "consumed)\n", phantom, next_cds_producer_idx );
904		return -ENOBUFS;
905	}
906
907	return cds_producer_idx;
908}
909
910/**
911 * Post Phantom TX descriptor
912 *
913 * @v phantom		Phantom NIC
914 * @v cds		TX descriptor
915 */
916static void phantom_post_cds ( struct phantom_nic *phantom,
917			       union phantom_cds *cds ) {
918	unsigned int cds_producer_idx;
919	unsigned int next_cds_producer_idx;
920	union phantom_cds *entry;
921
922	/* Copy descriptor to ring */
923	cds_producer_idx = phantom->cds_producer_idx;
924	entry = &phantom->desc->cds[cds_producer_idx];
925	memcpy ( entry, cds, sizeof ( *entry ) );
926	DBGC2 ( phantom, "Phantom %p posting CDS %d:\n",
927		phantom, cds_producer_idx );
928	DBGC2_HDA ( phantom, virt_to_bus ( entry ), entry, sizeof ( *entry ) );
929
930	/* Update producer index */
931	next_cds_producer_idx = ( ( cds_producer_idx + 1 ) % PHN_NUM_CDS );
932	phantom->cds_producer_idx = next_cds_producer_idx;
933	wmb();
934	phantom_writel ( phantom, phantom->cds_producer_idx,
935			 phantom->cds_producer_crb );
936}
937
938/***************************************************************************
939 *
940 * MAC address management
941 *
942 */
943
944/**
945 * Add/remove MAC address
946 *
947 * @v phantom		Phantom NIC
948 * @v ll_addr		MAC address to add or remove
949 * @v opcode		MAC request opcode
950 * @ret rc		Return status code
951 */
952static int phantom_update_macaddr ( struct phantom_nic *phantom,
953				    const uint8_t *ll_addr,
954				    unsigned int opcode ) {
955	union phantom_cds cds;
956	int index;
957
958	/* Get descriptor ring entry */
959	index = phantom_alloc_cds ( phantom );
960	if ( index < 0 )
961		return index;
962
963	/* Fill descriptor ring entry */
964	memset ( &cds, 0, sizeof ( cds ) );
965	NX_FILL_1 ( &cds, 0,
966		    nic_request.common.opcode, UNM_NIC_REQUEST );
967	NX_FILL_2 ( &cds, 1,
968		    nic_request.header.opcode, UNM_MAC_EVENT,
969		    nic_request.header.context_id, phantom->port );
970	NX_FILL_7 ( &cds, 2,
971		    nic_request.body.mac_request.opcode, opcode,
972		    nic_request.body.mac_request.mac_addr_0, ll_addr[0],
973		    nic_request.body.mac_request.mac_addr_1, ll_addr[1],
974		    nic_request.body.mac_request.mac_addr_2, ll_addr[2],
975		    nic_request.body.mac_request.mac_addr_3, ll_addr[3],
976		    nic_request.body.mac_request.mac_addr_4, ll_addr[4],
977		    nic_request.body.mac_request.mac_addr_5, ll_addr[5] );
978
979	/* Post descriptor */
980	phantom_post_cds ( phantom, &cds );
981
982	return 0;
983}
984
985/**
986 * Add MAC address
987 *
988 * @v phantom		Phantom NIC
989 * @v ll_addr		MAC address to add or remove
990 * @ret rc		Return status code
991 */
992static inline int phantom_add_macaddr ( struct phantom_nic *phantom,
993					const uint8_t *ll_addr ) {
994
995	DBGC ( phantom, "Phantom %p adding MAC address %s\n",
996	       phantom, eth_ntoa ( ll_addr ) );
997
998	return phantom_update_macaddr ( phantom, ll_addr, UNM_MAC_ADD );
999}
1000
1001/**
1002 * Remove MAC address
1003 *
1004 * @v phantom		Phantom NIC
1005 * @v ll_addr		MAC address to add or remove
1006 * @ret rc		Return status code
1007 */
1008static inline int phantom_del_macaddr ( struct phantom_nic *phantom,
1009					const uint8_t *ll_addr ) {
1010
1011	DBGC ( phantom, "Phantom %p removing MAC address %s\n",
1012	       phantom, eth_ntoa ( ll_addr ) );
1013
1014	return phantom_update_macaddr ( phantom, ll_addr, UNM_MAC_DEL );
1015}
1016
1017/***************************************************************************
1018 *
1019 * Link state detection
1020 *
1021 */
1022
1023/**
1024 * Poll link state
1025 *
1026 * @v netdev		Network device
1027 */
1028static void phantom_poll_link_state ( struct net_device *netdev ) {
1029	struct phantom_nic *phantom = netdev_priv ( netdev );
1030	uint32_t xg_state_p3;
1031	unsigned int link;
1032
1033	/* Read link state */
1034	xg_state_p3 = phantom_readl ( phantom, UNM_NIC_REG_XG_STATE_P3 );
1035
1036	/* If there is no change, do nothing */
1037	if ( phantom->link_state == xg_state_p3 )
1038		return;
1039
1040	/* Record new link state */
1041	DBGC ( phantom, "Phantom %p new link state %08x (was %08x)\n",
1042	       phantom, xg_state_p3, phantom->link_state );
1043	phantom->link_state = xg_state_p3;
1044
1045	/* Indicate link state to gPXE */
1046	link = UNM_NIC_REG_XG_STATE_P3_LINK ( phantom->port,
1047					      phantom->link_state );
1048	switch ( link ) {
1049	case UNM_NIC_REG_XG_STATE_P3_LINK_UP:
1050		DBGC ( phantom, "Phantom %p link is up\n", phantom );
1051		netdev_link_up ( netdev );
1052		break;
1053	case UNM_NIC_REG_XG_STATE_P3_LINK_DOWN:
1054		DBGC ( phantom, "Phantom %p link is down\n", phantom );
1055		netdev_link_down ( netdev );
1056		break;
1057	default:
1058		DBGC ( phantom, "Phantom %p bad link state %d\n",
1059		       phantom, link );
1060		break;
1061	}
1062}
1063
1064/***************************************************************************
1065 *
1066 * Main driver body
1067 *
1068 */
1069
1070/**
1071 * Refill descriptor ring
1072 *
1073 * @v netdev		Net device
1074 */
1075static void phantom_refill_rx_ring ( struct net_device *netdev ) {
1076	struct phantom_nic *phantom = netdev_priv ( netdev );
1077	struct io_buffer *iobuf;
1078	struct phantom_rds rds;
1079	unsigned int handle;
1080	int index;
1081
1082	for ( handle = 0 ; handle < PHN_RDS_MAX_FILL ; handle++ ) {
1083
1084		/* Skip this index if the descriptor has not yet been
1085		 * consumed.
1086		 */
1087		if ( phantom->rds_iobuf[handle] != NULL )
1088			continue;
1089
1090		/* Allocate descriptor ring entry */
1091		index = phantom_alloc_rds ( phantom );
1092		assert ( PHN_RDS_MAX_FILL < PHN_NUM_RDS );
1093		assert ( index >= 0 ); /* Guaranteed by MAX_FILL < NUM_RDS ) */
1094
1095		/* Try to allocate an I/O buffer */
1096		iobuf = alloc_iob ( PHN_RX_BUFSIZE );
1097		if ( ! iobuf ) {
1098			/* Failure is non-fatal; we will retry later */
1099			netdev_rx_err ( netdev, NULL, -ENOMEM );
1100			break;
1101		}
1102
1103		/* Fill descriptor ring entry */
1104		memset ( &rds, 0, sizeof ( rds ) );
1105		NX_FILL_2 ( &rds, 0,
1106			    handle, handle,
1107			    length, iob_len ( iobuf ) );
1108		NX_FILL_1 ( &rds, 1,
1109			    dma_addr, virt_to_bus ( iobuf->data ) );
1110
1111		/* Record I/O buffer */
1112		assert ( phantom->rds_iobuf[handle] == NULL );
1113		phantom->rds_iobuf[handle] = iobuf;
1114
1115		/* Post descriptor */
1116		phantom_post_rds ( phantom, &rds );
1117	}
1118}
1119
1120/**
1121 * Open NIC
1122 *
1123 * @v netdev		Net device
1124 * @ret rc		Return status code
1125 */
1126static int phantom_open ( struct net_device *netdev ) {
1127	struct phantom_nic *phantom = netdev_priv ( netdev );
1128	int rc;
1129
1130	/* Allocate and zero descriptor rings */
1131	phantom->desc = malloc_dma ( sizeof ( *(phantom->desc) ),
1132					  UNM_DMA_BUFFER_ALIGN );
1133	if ( ! phantom->desc ) {
1134		rc = -ENOMEM;
1135		goto err_alloc_desc;
1136	}
1137	memset ( phantom->desc, 0, sizeof ( *(phantom->desc) ) );
1138
1139	/* Create RX context */
1140	if ( ( rc = phantom_create_rx_ctx ( phantom ) ) != 0 )
1141		goto err_create_rx_ctx;
1142
1143	/* Create TX context */
1144	if ( ( rc = phantom_create_tx_ctx ( phantom ) ) != 0 )
1145		goto err_create_tx_ctx;
1146
1147	/* Fill the RX descriptor ring */
1148	phantom_refill_rx_ring ( netdev );
1149
1150	/* Add MAC addresses
1151	 *
1152	 * BUG5583
1153	 *
1154	 * We would like to be able to enable receiving all multicast
1155	 * packets (or, failing that, promiscuous mode), but the
1156	 * firmware doesn't currently support this.
1157	 */
1158	if ( ( rc = phantom_add_macaddr ( phantom,
1159					  netdev->ll_broadcast ) ) != 0 )
1160		goto err_add_macaddr_broadcast;
1161	if ( ( rc = phantom_add_macaddr ( phantom,
1162					  netdev->ll_addr ) ) != 0 )
1163		goto err_add_macaddr_unicast;
1164
1165	return 0;
1166
1167	phantom_del_macaddr ( phantom, netdev->ll_addr );
1168 err_add_macaddr_unicast:
1169	phantom_del_macaddr ( phantom, netdev->ll_broadcast );
1170 err_add_macaddr_broadcast:
1171	phantom_destroy_tx_ctx ( phantom );
1172 err_create_tx_ctx:
1173	phantom_destroy_rx_ctx ( phantom );
1174 err_create_rx_ctx:
1175	free_dma ( phantom->desc, sizeof ( *(phantom->desc) ) );
1176	phantom->desc = NULL;
1177 err_alloc_desc:
1178	return rc;
1179}
1180
1181/**
1182 * Close NIC
1183 *
1184 * @v netdev		Net device
1185 */
1186static void phantom_close ( struct net_device *netdev ) {
1187	struct phantom_nic *phantom = netdev_priv ( netdev );
1188	struct io_buffer *iobuf;
1189	unsigned int i;
1190
1191	/* Shut down the port */
1192	phantom_del_macaddr ( phantom, netdev->ll_addr );
1193	phantom_del_macaddr ( phantom, netdev->ll_broadcast );
1194	phantom_destroy_tx_ctx ( phantom );
1195	phantom_destroy_rx_ctx ( phantom );
1196	free_dma ( phantom->desc, sizeof ( *(phantom->desc) ) );
1197	phantom->desc = NULL;
1198
1199	/* Flush any uncompleted descriptors */
1200	for ( i = 0 ; i < PHN_RDS_MAX_FILL ; i++ ) {
1201		iobuf = phantom->rds_iobuf[i];
1202		if ( iobuf ) {
1203			free_iob ( iobuf );
1204			phantom->rds_iobuf[i] = NULL;
1205		}
1206	}
1207	for ( i = 0 ; i < PHN_NUM_CDS ; i++ ) {
1208		iobuf = phantom->cds_iobuf[i];
1209		if ( iobuf ) {
1210			netdev_tx_complete_err ( netdev, iobuf, -ECANCELED );
1211			phantom->cds_iobuf[i] = NULL;
1212		}
1213	}
1214}
1215
1216/**
1217 * Transmit packet
1218 *
1219 * @v netdev	Network device
1220 * @v iobuf	I/O buffer
1221 * @ret rc	Return status code
1222 */
1223static int phantom_transmit ( struct net_device *netdev,
1224			      struct io_buffer *iobuf ) {
1225	struct phantom_nic *phantom = netdev_priv ( netdev );
1226	union phantom_cds cds;
1227	int index;
1228
1229	/* Get descriptor ring entry */
1230	index = phantom_alloc_cds ( phantom );
1231	if ( index < 0 )
1232		return index;
1233
1234	/* Fill descriptor ring entry */
1235	memset ( &cds, 0, sizeof ( cds ) );
1236	NX_FILL_3 ( &cds, 0,
1237		    tx.opcode, UNM_TX_ETHER_PKT,
1238		    tx.num_buffers, 1,
1239		    tx.length, iob_len ( iobuf ) );
1240	NX_FILL_2 ( &cds, 2,
1241		    tx.port, phantom->port,
1242		    tx.context_id, phantom->port );
1243	NX_FILL_1 ( &cds, 4,
1244		    tx.buffer1_dma_addr, virt_to_bus ( iobuf->data ) );
1245	NX_FILL_1 ( &cds, 5,
1246		    tx.buffer1_length, iob_len ( iobuf ) );
1247
1248	/* Record I/O buffer */
1249	assert ( phantom->cds_iobuf[index] == NULL );
1250	phantom->cds_iobuf[index] = iobuf;
1251
1252	/* Post descriptor */
1253	phantom_post_cds ( phantom, &cds );
1254
1255	return 0;
1256}
1257
1258/**
1259 * Poll for received packets
1260 *
1261 * @v netdev	Network device
1262 */
1263static void phantom_poll ( struct net_device *netdev ) {
1264	struct phantom_nic *phantom = netdev_priv ( netdev );
1265	struct io_buffer *iobuf;
1266	unsigned int cds_consumer_idx;
1267	unsigned int raw_new_cds_consumer_idx;
1268	unsigned int new_cds_consumer_idx;
1269	unsigned int rds_consumer_idx;
1270	unsigned int sds_consumer_idx;
1271	struct phantom_sds *sds;
1272	unsigned int sds_handle;
1273	unsigned int sds_opcode;
1274
1275	/* Check for TX completions */
1276	cds_consumer_idx = phantom->cds_consumer_idx;
1277	raw_new_cds_consumer_idx = phantom->desc->cmd_cons;
1278	new_cds_consumer_idx = le32_to_cpu ( raw_new_cds_consumer_idx );
1279	while ( cds_consumer_idx != new_cds_consumer_idx ) {
1280		DBGC2 ( phantom, "Phantom %p CDS %d complete\n",
1281			phantom, cds_consumer_idx );
1282		/* Completions may be for commands other than TX, so
1283		 * there may not always be an associated I/O buffer.
1284		 */
1285		if ( ( iobuf = phantom->cds_iobuf[cds_consumer_idx] ) ) {
1286			netdev_tx_complete ( netdev, iobuf );
1287			phantom->cds_iobuf[cds_consumer_idx] = NULL;
1288		}
1289		cds_consumer_idx = ( ( cds_consumer_idx + 1 ) % PHN_NUM_CDS );
1290		phantom->cds_consumer_idx = cds_consumer_idx;
1291	}
1292
1293	/* Check for received packets */
1294	rds_consumer_idx = phantom->rds_consumer_idx;
1295	sds_consumer_idx = phantom->sds_consumer_idx;
1296	while ( 1 ) {
1297		sds = &phantom->desc->sds[sds_consumer_idx];
1298		if ( NX_GET ( sds, owner ) == 0 )
1299			break;
1300
1301		DBGC2 ( phantom, "Phantom %p SDS %d status:\n",
1302			phantom, sds_consumer_idx );
1303		DBGC2_HDA ( phantom, virt_to_bus ( sds ), sds, sizeof (*sds) );
1304
1305		/* Check received opcode */
1306		sds_opcode = NX_GET ( sds, opcode );
1307		if ( ( sds_opcode == UNM_RXPKT_DESC ) ||
1308		     ( sds_opcode == UNM_SYN_OFFLOAD ) ) {
1309
1310			/* Sanity check: ensure that all of the SDS
1311			 * descriptor has been written.
1312			 */
1313			if ( NX_GET ( sds, total_length ) == 0 ) {
1314				DBGC ( phantom, "Phantom %p SDS %d "
1315				       "incomplete; deferring\n",
1316				       phantom, sds_consumer_idx );
1317				/* Leave for next poll() */
1318				break;
1319			}
1320
1321			/* Process received packet */
1322			sds_handle = NX_GET ( sds, handle );
1323			iobuf = phantom->rds_iobuf[sds_handle];
1324			assert ( iobuf != NULL );
1325			iob_put ( iobuf, NX_GET ( sds, total_length ) );
1326			iob_pull ( iobuf, NX_GET ( sds, pkt_offset ) );
1327			DBGC2 ( phantom, "Phantom %p RDS %d complete\n",
1328				phantom, sds_handle );
1329			netdev_rx ( netdev, iobuf );
1330			phantom->rds_iobuf[sds_handle] = NULL;
1331
1332			/* Update RDS consumer counter.  This is a
1333			 * lower bound for the number of descriptors
1334			 * that have been read by the hardware, since
1335			 * the hardware must have read at least one
1336			 * descriptor for each completion that we
1337			 * receive.
1338			 */
1339			rds_consumer_idx =
1340				( ( rds_consumer_idx + 1 ) % PHN_NUM_RDS );
1341			phantom->rds_consumer_idx = rds_consumer_idx;
1342
1343		} else {
1344
1345			DBGC ( phantom, "Phantom %p unexpected SDS opcode "
1346			       "%02x\n", phantom, sds_opcode );
1347			DBGC_HDA ( phantom, virt_to_bus ( sds ),
1348				   sds, sizeof ( *sds ) );
1349		}
1350
1351		/* Clear status descriptor */
1352		memset ( sds, 0, sizeof ( *sds ) );
1353
1354		/* Update SDS consumer index */
1355		sds_consumer_idx = ( ( sds_consumer_idx + 1 ) % PHN_NUM_SDS );
1356		phantom->sds_consumer_idx = sds_consumer_idx;
1357		wmb();
1358		phantom_writel ( phantom, phantom->sds_consumer_idx,
1359				 phantom->sds_consumer_crb );
1360	}
1361
1362	/* Refill the RX descriptor ring */
1363	phantom_refill_rx_ring ( netdev );
1364
1365	/* Occasionally poll the link state */
1366	if ( phantom->link_poll_timer-- == 0 ) {
1367		phantom_poll_link_state ( netdev );
1368		/* Reset the link poll timer */
1369		phantom->link_poll_timer = PHN_LINK_POLL_FREQUENCY;
1370	}
1371}
1372
1373/**
1374 * Enable/disable interrupts
1375 *
1376 * @v netdev	Network device
1377 * @v enable	Interrupts should be enabled
1378 */
1379static void phantom_irq ( struct net_device *netdev, int enable ) {
1380	struct phantom_nic *phantom = netdev_priv ( netdev );
1381	static const unsigned long sw_int_mask_reg[PHN_MAX_NUM_PORTS] = {
1382		UNM_NIC_REG_SW_INT_MASK_0,
1383		UNM_NIC_REG_SW_INT_MASK_1,
1384		UNM_NIC_REG_SW_INT_MASK_2,
1385		UNM_NIC_REG_SW_INT_MASK_3
1386	};
1387
1388	phantom_writel ( phantom,
1389			 ( enable ? 1 : 0 ),
1390			 sw_int_mask_reg[phantom->port] );
1391}
1392
1393/** Phantom net device operations */
1394static struct net_device_operations phantom_operations = {
1395	.open		= phantom_open,
1396	.close		= phantom_close,
1397	.transmit	= phantom_transmit,
1398	.poll		= phantom_poll,
1399	.irq		= phantom_irq,
1400};
1401
1402/***************************************************************************
1403 *
1404 * CLP settings
1405 *
1406 */
1407
1408/** Phantom CLP settings tag magic */
1409#define PHN_CLP_TAG_MAGIC 0xc19c1900UL
1410
1411/** Phantom CLP settings tag magic mask */
1412#define PHN_CLP_TAG_MAGIC_MASK 0xffffff00UL
1413
1414/** Phantom CLP data
1415 *
1416 */
1417union phantom_clp_data {
1418	/** Data bytes
1419	 *
1420	 * This field is right-aligned; if only N bytes are present
1421	 * then bytes[0]..bytes[7-N] should be zero, and the data
1422	 * should be in bytes[7-N+1] to bytes[7];
1423	 */
1424	uint8_t bytes[8];
1425	/** Dwords for the CLP interface */
1426	struct {
1427		/** High dword, in network byte order */
1428		uint32_t hi;
1429		/** Low dword, in network byte order */
1430		uint32_t lo;
1431	} dwords;
1432};
1433#define PHN_CLP_BLKSIZE ( sizeof ( union phantom_clp_data ) )
1434
1435/**
1436 * Wait for Phantom CLP command to complete
1437 *
1438 * @v phantom		Phantom NIC
1439 * @ret rc		Return status code
1440 */
1441static int phantom_clp_wait ( struct phantom_nic *phantom ) {
1442	unsigned int retries;
1443	uint32_t status;
1444
1445	for ( retries = 0 ; retries < PHN_CLP_CMD_TIMEOUT_MS ; retries++ ) {
1446		status = phantom_readl ( phantom, UNM_CAM_RAM_CLP_STATUS );
1447		if ( status & UNM_CAM_RAM_CLP_STATUS_DONE )
1448			return 0;
1449		mdelay ( 1 );
1450	}
1451
1452	DBGC ( phantom, "Phantom %p timed out waiting for CLP command\n",
1453	       phantom );
1454	return -ETIMEDOUT;
1455}
1456
1457/**
1458 * Issue Phantom CLP command
1459 *
1460 * @v phantom		Phantom NIC
1461 * @v port		Virtual port number
1462 * @v opcode		Opcode
1463 * @v data_in		Data in, or NULL
1464 * @v data_out		Data out, or NULL
1465 * @v offset		Offset within data
1466 * @v len		Data buffer length
1467 * @ret len		Total transfer length (for reads), or negative error
1468 */
1469static int phantom_clp_cmd ( struct phantom_nic *phantom, unsigned int port,
1470			     unsigned int opcode, const void *data_in,
1471			     void *data_out, size_t offset, size_t len ) {
1472	union phantom_clp_data data;
1473	unsigned int index = ( offset / sizeof ( data ) );
1474	unsigned int last = 0;
1475	size_t in_frag_len;
1476	uint8_t *in_frag;
1477	uint32_t command;
1478	uint32_t status;
1479	size_t read_len;
1480	unsigned int error;
1481	size_t out_frag_len;
1482	uint8_t *out_frag;
1483	int rc;
1484
1485	/* Sanity checks */
1486	assert ( ( offset % sizeof ( data ) ) == 0 );
1487	if ( len > 255 ) {
1488		DBGC ( phantom, "Phantom %p invalid CLP length %zd\n",
1489		       phantom, len );
1490		return -EINVAL;
1491	}
1492
1493	/* Check that CLP interface is ready */
1494	if ( ( rc = phantom_clp_wait ( phantom ) ) != 0 )
1495		return rc;
1496
1497	/* Copy data in */
1498	memset ( &data, 0, sizeof ( data ) );
1499	if ( data_in ) {
1500		assert ( offset < len );
1501		in_frag_len = ( len - offset );
1502		if ( in_frag_len > sizeof ( data ) ) {
1503			in_frag_len = sizeof ( data );
1504		} else {
1505			last = 1;
1506		}
1507		in_frag = &data.bytes[ sizeof ( data ) - in_frag_len ];
1508		memcpy ( in_frag, ( data_in + offset ), in_frag_len );
1509		phantom_writel ( phantom, be32_to_cpu ( data.dwords.lo ),
1510				 UNM_CAM_RAM_CLP_DATA_LO );
1511		phantom_writel ( phantom, be32_to_cpu ( data.dwords.hi ),
1512				 UNM_CAM_RAM_CLP_DATA_HI );
1513	}
1514
1515	/* Issue CLP command */
1516	command = ( ( index << 24 ) | ( ( data_in ? len : 0 ) << 16 ) |
1517		    ( port << 8 ) | ( last << 7 ) | ( opcode << 0 ) );
1518	phantom_writel ( phantom, command, UNM_CAM_RAM_CLP_COMMAND );
1519	mb();
1520	phantom_writel ( phantom, UNM_CAM_RAM_CLP_STATUS_START,
1521			 UNM_CAM_RAM_CLP_STATUS );
1522
1523	/* Wait for command to complete */
1524	if ( ( rc = phantom_clp_wait ( phantom ) ) != 0 )
1525		return rc;
1526
1527	/* Get command status */
1528	status = phantom_readl ( phantom, UNM_CAM_RAM_CLP_STATUS );
1529	read_len = ( ( status >> 16 ) & 0xff );
1530	error = ( ( status >> 8 ) & 0xff );
1531	if ( error ) {
1532		DBGC ( phantom, "Phantom %p CLP command error %02x\n",
1533		       phantom, error );
1534		return -EIO;
1535	}
1536
1537	/* Copy data out */
1538	if ( data_out ) {
1539		data.dwords.lo = cpu_to_be32 ( phantom_readl ( phantom,
1540						  UNM_CAM_RAM_CLP_DATA_LO ) );
1541		data.dwords.hi = cpu_to_be32 ( phantom_readl ( phantom,
1542						  UNM_CAM_RAM_CLP_DATA_HI ) );
1543		out_frag_len = ( read_len - offset );
1544		if ( out_frag_len > sizeof ( data ) )
1545			out_frag_len = sizeof ( data );
1546		out_frag = &data.bytes[ sizeof ( data ) - out_frag_len ];
1547		if ( out_frag_len > ( len - offset ) )
1548			out_frag_len = ( len - offset );
1549		memcpy ( ( data_out + offset ), out_frag, out_frag_len );
1550	}
1551
1552	return read_len;
1553}
1554
1555/**
1556 * Store Phantom CLP setting
1557 *
1558 * @v phantom		Phantom NIC
1559 * @v port		Virtual port number
1560 * @v setting		Setting number
1561 * @v data		Data buffer
1562 * @v len		Length of data buffer
1563 * @ret rc		Return status code
1564 */
1565static int phantom_clp_store ( struct phantom_nic *phantom, unsigned int port,
1566			       unsigned int setting, const void *data,
1567			       size_t len ) {
1568	unsigned int opcode = setting;
1569	size_t offset;
1570	int rc;
1571
1572	for ( offset = 0 ; offset < len ; offset += PHN_CLP_BLKSIZE ) {
1573		if ( ( rc = phantom_clp_cmd ( phantom, port, opcode, data,
1574					      NULL, offset, len ) ) < 0 )
1575			return rc;
1576	}
1577	return 0;
1578}
1579
1580/**
1581 * Fetch Phantom CLP setting
1582 *
1583 * @v phantom		Phantom NIC
1584 * @v port		Virtual port number
1585 * @v setting		Setting number
1586 * @v data		Data buffer
1587 * @v len		Length of data buffer
1588 * @ret len		Length of setting, or negative error
1589 */
1590static int phantom_clp_fetch ( struct phantom_nic *phantom, unsigned int port,
1591			       unsigned int setting, void *data, size_t len ) {
1592	unsigned int opcode = ( setting + 1 );
1593	size_t offset = 0;
1594	int read_len;
1595
1596	while ( 1 ) {
1597		read_len = phantom_clp_cmd ( phantom, port, opcode, NULL,
1598					     data, offset, len );
1599		if ( read_len < 0 )
1600			return read_len;
1601		offset += PHN_CLP_BLKSIZE;
1602		if ( offset >= ( unsigned ) read_len )
1603			break;
1604		if ( offset >= len )
1605			break;
1606	}
1607	return read_len;
1608}
1609
1610/** A Phantom CLP setting */
1611struct phantom_clp_setting {
1612	/** gPXE setting */
1613	struct setting *setting;
1614	/** Setting number */
1615	unsigned int clp_setting;
1616};
1617
1618/** Phantom CLP settings */
1619static struct phantom_clp_setting clp_settings[] = {
1620	{ &mac_setting, 0x01 },
1621};
1622
1623/**
1624 * Find Phantom CLP setting
1625 *
1626 * @v setting		gPXE setting
1627 * @v clp_setting	Setting number, or 0 if not found
1628 */
1629static unsigned int
1630phantom_clp_setting ( struct phantom_nic *phantom, struct setting *setting ) {
1631	struct phantom_clp_setting *clp_setting;
1632	unsigned int i;
1633
1634	/* Search the list of explicitly-defined settings */
1635	for ( i = 0 ; i < ( sizeof ( clp_settings ) /
1636			    sizeof ( clp_settings[0] ) ) ; i++ ) {
1637		clp_setting = &clp_settings[i];
1638		if ( setting_cmp ( setting, clp_setting->setting ) == 0 )
1639			return clp_setting->clp_setting;
1640	}
1641
1642	/* Allow for use of numbered settings */
1643	if ( ( setting->tag & PHN_CLP_TAG_MAGIC_MASK ) == PHN_CLP_TAG_MAGIC )
1644		return ( setting->tag & ~PHN_CLP_TAG_MAGIC_MASK );
1645
1646	DBGC2 ( phantom, "Phantom %p has no \"%s\" setting\n",
1647		phantom, setting->name );
1648
1649	return 0;
1650}
1651
1652/**
1653 * Store Phantom CLP setting
1654 *
1655 * @v settings		Settings block
1656 * @v setting		Setting to store
1657 * @v data		Setting data, or NULL to clear setting
1658 * @v len		Length of setting data
1659 * @ret rc		Return status code
1660 */
1661static int phantom_store_setting ( struct settings *settings,
1662				   struct setting *setting,
1663				   const void *data, size_t len ) {
1664	struct phantom_nic *phantom =
1665		container_of ( settings, struct phantom_nic, settings );
1666	unsigned int clp_setting;
1667	int rc;
1668
1669	/* Find Phantom setting equivalent to gPXE setting */
1670	clp_setting = phantom_clp_setting ( phantom, setting );
1671	if ( ! clp_setting )
1672		return -ENOTSUP;
1673
1674	/* Store setting */
1675	if ( ( rc = phantom_clp_store ( phantom, phantom->port,
1676					clp_setting, data, len ) ) != 0 ) {
1677		DBGC ( phantom, "Phantom %p could not store setting \"%s\": "
1678		       "%s\n", phantom, setting->name, strerror ( rc ) );
1679		return rc;
1680	}
1681
1682	return 0;
1683}
1684
1685/**
1686 * Fetch Phantom CLP setting
1687 *
1688 * @v settings		Settings block
1689 * @v setting		Setting to fetch
1690 * @v data		Buffer to fill with setting data
1691 * @v len		Length of buffer
1692 * @ret len		Length of setting data, or negative error
1693 */
1694static int phantom_fetch_setting ( struct settings *settings,
1695				   struct setting *setting,
1696				   void *data, size_t len ) {
1697	struct phantom_nic *phantom =
1698		container_of ( settings, struct phantom_nic, settings );
1699	unsigned int clp_setting;
1700	int read_len;
1701	int rc;
1702
1703	/* Find Phantom setting equivalent to gPXE setting */
1704	clp_setting = phantom_clp_setting ( phantom, setting );
1705	if ( ! clp_setting )
1706		return -ENOTSUP;
1707
1708	/* Fetch setting */
1709	if ( ( read_len = phantom_clp_fetch ( phantom, phantom->port,
1710					      clp_setting, data, len ) ) < 0 ){
1711		rc = read_len;
1712		DBGC ( phantom, "Phantom %p could not fetch setting \"%s\": "
1713		       "%s\n", phantom, setting->name, strerror ( rc ) );
1714		return rc;
1715	}
1716
1717	return read_len;
1718}
1719
1720/** Phantom CLP settings operations */
1721static struct settings_operations phantom_settings_operations = {
1722	.store		= phantom_store_setting,
1723	.fetch		= phantom_fetch_setting,
1724};
1725
1726/***************************************************************************
1727 *
1728 * Initialisation
1729 *
1730 */
1731
1732/**
1733 * Map Phantom CRB window
1734 *
1735 * @v phantom		Phantom NIC
1736 * @ret rc		Return status code
1737 */
1738static int phantom_map_crb ( struct phantom_nic *phantom,
1739			     struct pci_device *pci ) {
1740	unsigned long bar0_start;
1741	unsigned long bar0_size;
1742
1743	bar0_start = pci_bar_start ( pci, PCI_BASE_ADDRESS_0 );
1744	bar0_size = pci_bar_size ( pci, PCI_BASE_ADDRESS_0 );
1745	DBGC ( phantom, "Phantom %p is PCI %02x:%02x.%x with BAR0 at "
1746	       "%08lx+%lx\n", phantom, pci->bus, PCI_SLOT ( pci->devfn ),
1747	       PCI_FUNC ( pci->devfn ), bar0_start, bar0_size );
1748
1749	if ( ! bar0_start ) {
1750		DBGC ( phantom, "Phantom %p BAR not assigned; ignoring\n",
1751		       phantom );
1752		return -EINVAL;
1753	}
1754
1755	switch ( bar0_size ) {
1756	case ( 128 * 1024 * 1024 ) :
1757		DBGC ( phantom, "Phantom %p has 128MB BAR\n", phantom );
1758		phantom->crb_access = phantom_crb_access_128m;
1759		break;
1760	case ( 32 * 1024 * 1024 ) :
1761		DBGC ( phantom, "Phantom %p has 32MB BAR\n", phantom );
1762		phantom->crb_access = phantom_crb_access_32m;
1763		break;
1764	case ( 2 * 1024 * 1024 ) :
1765		DBGC ( phantom, "Phantom %p has 2MB BAR\n", phantom );
1766		phantom->crb_access = phantom_crb_access_2m;
1767		break;
1768	default:
1769		DBGC ( phantom, "Phantom %p has bad BAR size\n", phantom );
1770		return -EINVAL;
1771	}
1772
1773	phantom->bar0 = ioremap ( bar0_start, bar0_size );
1774	if ( ! phantom->bar0 ) {
1775		DBGC ( phantom, "Phantom %p could not map BAR0\n", phantom );
1776		return -EIO;
1777	}
1778
1779	/* Mark current CRB window as invalid, so that the first
1780	 * read/write will set the current window.
1781	 */
1782	phantom->crb_window = -1UL;
1783
1784	return 0;
1785}
1786
1787/**
1788 * Unhalt all PEGs
1789 *
1790 * @v phantom		Phantom NIC
1791 */
1792static void phantom_unhalt_pegs ( struct phantom_nic *phantom ) {
1793	uint32_t halt_status;
1794
1795	halt_status = phantom_readl ( phantom, UNM_PEG_0_HALT_STATUS );
1796	phantom_writel ( phantom, halt_status, UNM_PEG_0_HALT_STATUS );
1797	halt_status = phantom_readl ( phantom, UNM_PEG_1_HALT_STATUS );
1798	phantom_writel ( phantom, halt_status, UNM_PEG_1_HALT_STATUS );
1799	halt_status = phantom_readl ( phantom, UNM_PEG_2_HALT_STATUS );
1800	phantom_writel ( phantom, halt_status, UNM_PEG_2_HALT_STATUS );
1801	halt_status = phantom_readl ( phantom, UNM_PEG_3_HALT_STATUS );
1802	phantom_writel ( phantom, halt_status, UNM_PEG_3_HALT_STATUS );
1803	halt_status = phantom_readl ( phantom, UNM_PEG_4_HALT_STATUS );
1804	phantom_writel ( phantom, halt_status, UNM_PEG_4_HALT_STATUS );
1805}
1806
1807/**
1808 * Initialise the Phantom command PEG
1809 *
1810 * @v phantom		Phantom NIC
1811 * @ret rc		Return status code
1812 */
1813static int phantom_init_cmdpeg ( struct phantom_nic *phantom ) {
1814	uint32_t cold_boot;
1815	uint32_t sw_reset;
1816	unsigned int retries;
1817	uint32_t cmdpeg_state;
1818	uint32_t last_cmdpeg_state = 0;
1819
1820	/* Check for a previous initialisation.  This could have
1821	 * happened if, for example, the BIOS used the UNDI API to
1822	 * drive the NIC prior to a full PXE boot.
1823	 */
1824	cmdpeg_state = phantom_readl ( phantom, UNM_NIC_REG_CMDPEG_STATE );
1825	if ( cmdpeg_state == UNM_NIC_REG_CMDPEG_STATE_INITIALIZE_ACK ) {
1826		DBGC ( phantom, "Phantom %p command PEG already initialized\n",
1827		       phantom );
1828		/* Unhalt the PEGs.  Previous firmware (e.g. BOFM) may
1829		 * have halted the PEGs to prevent internal bus
1830		 * collisions when the BIOS re-reads the expansion ROM.
1831		 */
1832		phantom_unhalt_pegs ( phantom );
1833		return 0;
1834	}
1835
1836	/* If this was a cold boot, check that the hardware came up ok */
1837	cold_boot = phantom_readl ( phantom, UNM_CAM_RAM_COLD_BOOT );
1838	if ( cold_boot == UNM_CAM_RAM_COLD_BOOT_MAGIC ) {
1839		DBGC ( phantom, "Phantom %p coming up from cold boot\n",
1840		       phantom );
1841		sw_reset = phantom_readl ( phantom, UNM_ROMUSB_GLB_SW_RESET );
1842		if ( sw_reset != UNM_ROMUSB_GLB_SW_RESET_MAGIC ) {
1843			DBGC ( phantom, "Phantom %p reset failed: %08x\n",
1844			       phantom, sw_reset );
1845			return -EIO;
1846		}
1847	} else {
1848		DBGC ( phantom, "Phantom %p coming up from warm boot "
1849		       "(%08x)\n", phantom, cold_boot );
1850	}
1851	/* Clear cold-boot flag */
1852	phantom_writel ( phantom, 0, UNM_CAM_RAM_COLD_BOOT );
1853
1854	/* Set port modes */
1855	phantom_writel ( phantom, UNM_CAM_RAM_PORT_MODE_AUTO_NEG_1G,
1856			 UNM_CAM_RAM_WOL_PORT_MODE );
1857
1858	/* Pass dummy DMA area to card */
1859	phantom_write_hilo ( phantom, 0,
1860			     UNM_NIC_REG_DUMMY_BUF_ADDR_LO,
1861			     UNM_NIC_REG_DUMMY_BUF_ADDR_HI );
1862	phantom_writel ( phantom, UNM_NIC_REG_DUMMY_BUF_INIT,
1863			 UNM_NIC_REG_DUMMY_BUF );
1864
1865	/* Tell the hardware that tuning is complete */
1866	phantom_writel ( phantom, UNM_ROMUSB_GLB_PEGTUNE_DONE_MAGIC,
1867			 UNM_ROMUSB_GLB_PEGTUNE_DONE );
1868
1869	/* Wait for command PEG to finish initialising */
1870	DBGC ( phantom, "Phantom %p initialising command PEG (will take up to "
1871	       "%d seconds)...\n", phantom, PHN_CMDPEG_INIT_TIMEOUT_SEC );
1872	for ( retries = 0; retries < PHN_CMDPEG_INIT_TIMEOUT_SEC; retries++ ) {
1873		cmdpeg_state = phantom_readl ( phantom,
1874					       UNM_NIC_REG_CMDPEG_STATE );
1875		if ( cmdpeg_state != last_cmdpeg_state ) {
1876			DBGC ( phantom, "Phantom %p command PEG state is "
1877			       "%08x after %d seconds...\n",
1878			       phantom, cmdpeg_state, retries );
1879			last_cmdpeg_state = cmdpeg_state;
1880		}
1881		if ( cmdpeg_state == UNM_NIC_REG_CMDPEG_STATE_INITIALIZED ) {
1882			/* Acknowledge the PEG initialisation */
1883			phantom_writel ( phantom,
1884				       UNM_NIC_REG_CMDPEG_STATE_INITIALIZE_ACK,
1885				       UNM_NIC_REG_CMDPEG_STATE );
1886			return 0;
1887		}
1888		mdelay ( 1000 );
1889	}
1890
1891	DBGC ( phantom, "Phantom %p timed out waiting for command PEG to "
1892	       "initialise (status %08x)\n", phantom, cmdpeg_state );
1893	return -ETIMEDOUT;
1894}
1895
1896/**
1897 * Read Phantom MAC address
1898 *
1899 * @v phanton_port	Phantom NIC
1900 * @v hw_addr		Buffer to fill with MAC address
1901 */
1902static void phantom_get_macaddr ( struct phantom_nic *phantom,
1903				  uint8_t *hw_addr ) {
1904	union {
1905		uint8_t mac_addr[2][ETH_ALEN];
1906		uint32_t dwords[3];
1907	} u;
1908	unsigned long offset;
1909	int i;
1910
1911	/* Read the three dwords that include this MAC address and one other */
1912	offset = ( UNM_CAM_RAM_MAC_ADDRS +
1913		   ( 12 * ( phantom->port / 2 ) ) );
1914	for ( i = 0 ; i < 3 ; i++, offset += 4 ) {
1915		u.dwords[i] = phantom_readl ( phantom, offset );
1916	}
1917
1918	/* Copy out the relevant MAC address */
1919	for ( i = 0 ; i < ETH_ALEN ; i++ ) {
1920		hw_addr[ ETH_ALEN - i - 1 ] =
1921			u.mac_addr[ phantom->port & 1 ][i];
1922	}
1923	DBGC ( phantom, "Phantom %p MAC address is %s\n",
1924	       phantom, eth_ntoa ( hw_addr ) );
1925}
1926
1927/**
1928 * Check Phantom is enabled for boot
1929 *
1930 * @v phanton_port	Phantom NIC
1931 * @ret rc		Return status code
1932 *
1933 * This is something of an ugly hack to accommodate an OEM
1934 * requirement.  The NIC has only one expansion ROM BAR, rather than
1935 * one per port.  To allow individual ports to be selectively
1936 * enabled/disabled for PXE boot (as required), we must therefore
1937 * leave the expansion ROM always enabled, and place the per-port
1938 * enable/disable logic within the gPXE driver.
1939 */
1940static int phantom_check_boot_enable ( struct phantom_nic *phantom ) {
1941	unsigned long boot_enable;
1942
1943	boot_enable = phantom_readl ( phantom, UNM_CAM_RAM_BOOT_ENABLE );
1944	if ( ! ( boot_enable & ( 1 << phantom->port ) ) ) {
1945		DBGC ( phantom, "Phantom %p PXE boot is disabled\n",
1946		       phantom );
1947		return -ENOTSUP;
1948	}
1949
1950	return 0;
1951}
1952
1953/**
1954 * Initialise Phantom receive PEG
1955 *
1956 * @v phantom		Phantom NIC
1957 * @ret rc		Return status code
1958 */
1959static int phantom_init_rcvpeg ( struct phantom_nic *phantom ) {
1960	unsigned int retries;
1961	uint32_t rcvpeg_state;
1962	uint32_t last_rcvpeg_state = 0;
1963
1964	DBGC ( phantom, "Phantom %p initialising receive PEG (will take up to "
1965	       "%d seconds)...\n", phantom, PHN_RCVPEG_INIT_TIMEOUT_SEC );
1966	for ( retries = 0; retries < PHN_RCVPEG_INIT_TIMEOUT_SEC; retries++ ) {
1967		rcvpeg_state = phantom_readl ( phantom,
1968					       UNM_NIC_REG_RCVPEG_STATE );
1969		if ( rcvpeg_state != last_rcvpeg_state ) {
1970			DBGC ( phantom, "Phantom %p receive PEG state is "
1971			       "%08x after %d seconds...\n",
1972			       phantom, rcvpeg_state, retries );
1973			last_rcvpeg_state = rcvpeg_state;
1974		}
1975		if ( rcvpeg_state == UNM_NIC_REG_RCVPEG_STATE_INITIALIZED )
1976			return 0;
1977		mdelay ( 1000 );
1978	}
1979
1980	DBGC ( phantom, "Phantom %p timed out waiting for receive PEG to "
1981	       "initialise (status %08x)\n", phantom, rcvpeg_state );
1982	return -ETIMEDOUT;
1983}
1984
1985/**
1986 * Probe PCI device
1987 *
1988 * @v pci		PCI device
1989 * @v id		PCI ID
1990 * @ret rc		Return status code
1991 */
1992static int phantom_probe ( struct pci_device *pci,
1993			   const struct pci_device_id *id __unused ) {
1994	struct net_device *netdev;
1995	struct phantom_nic *phantom;
1996	struct settings *parent_settings;
1997	int rc;
1998
1999	/* Allocate Phantom device */
2000	netdev = alloc_etherdev ( sizeof ( *phantom ) );
2001	if ( ! netdev ) {
2002		rc = -ENOMEM;
2003		goto err_alloc_etherdev;
2004	}
2005	netdev_init ( netdev, &phantom_operations );
2006	phantom = netdev_priv ( netdev );
2007	pci_set_drvdata ( pci, netdev );
2008	netdev->dev = &pci->dev;
2009	memset ( phantom, 0, sizeof ( *phantom ) );
2010	phantom->port = PCI_FUNC ( pci->devfn );
2011	assert ( phantom->port < PHN_MAX_NUM_PORTS );
2012	settings_init ( &phantom->settings,
2013			&phantom_settings_operations,
2014			&netdev->refcnt, "clp", PHN_CLP_TAG_MAGIC );
2015
2016	/* Fix up PCI device */
2017	adjust_pci_device ( pci );
2018
2019	/* Map CRB */
2020	if ( ( rc = phantom_map_crb ( phantom, pci ) ) != 0 )
2021		goto err_map_crb;
2022
2023	/* BUG5945 - need to hack PCI config space on P3 B1 silicon.
2024	 * B2 will have this fixed; remove this hack when B1 is no
2025	 * longer in use.
2026	 */
2027	if ( PCI_FUNC ( pci->devfn ) == 0 ) {
2028		unsigned int i;
2029		for ( i = 0 ; i < 8 ; i++ ) {
2030			uint32_t temp;
2031			pci->devfn = PCI_DEVFN ( PCI_SLOT ( pci->devfn ), i );
2032			pci_read_config_dword ( pci, 0xc8, &temp );
2033			pci_read_config_dword ( pci, 0xc8, &temp );
2034			pci_write_config_dword ( pci, 0xc8, 0xf1000 );
2035		}
2036		pci->devfn = PCI_DEVFN ( PCI_SLOT ( pci->devfn ), 0 );
2037	}
2038
2039	/* Initialise the command PEG */
2040	if ( ( rc = phantom_init_cmdpeg ( phantom ) ) != 0 )
2041		goto err_init_cmdpeg;
2042
2043	/* Initialise the receive PEG */
2044	if ( ( rc = phantom_init_rcvpeg ( phantom ) ) != 0 )
2045		goto err_init_rcvpeg;
2046
2047	/* Read MAC addresses */
2048	phantom_get_macaddr ( phantom, netdev->hw_addr );
2049
2050	/* Skip if boot disabled on NIC */
2051	if ( ( rc = phantom_check_boot_enable ( phantom ) ) != 0 )
2052		goto err_check_boot_enable;
2053
2054	/* Register network devices */
2055	if ( ( rc = register_netdev ( netdev ) ) != 0 ) {
2056		DBGC ( phantom, "Phantom %p could not register net device: "
2057		       "%s\n", phantom, strerror ( rc ) );
2058		goto err_register_netdev;
2059	}
2060
2061	/* Register settings blocks */
2062	parent_settings = netdev_settings ( netdev );
2063	if ( ( rc = register_settings ( &phantom->settings,
2064					parent_settings ) ) != 0 ) {
2065		DBGC ( phantom, "Phantom %p could not register settings: "
2066		       "%s\n", phantom, strerror ( rc ) );
2067		goto err_register_settings;
2068	}
2069
2070	return 0;
2071
2072	unregister_settings ( &phantom->settings );
2073 err_register_settings:
2074	unregister_netdev ( netdev );
2075 err_register_netdev:
2076 err_check_boot_enable:
2077 err_init_rcvpeg:
2078 err_init_cmdpeg:
2079 err_map_crb:
2080	netdev_nullify ( netdev );
2081	netdev_put ( netdev );
2082 err_alloc_etherdev:
2083	return rc;
2084}
2085
2086/**
2087 * Remove PCI device
2088 *
2089 * @v pci		PCI device
2090 */
2091static void phantom_remove ( struct pci_device *pci ) {
2092	struct net_device *netdev = pci_get_drvdata ( pci );
2093	struct phantom_nic *phantom = netdev_priv ( netdev );
2094
2095	unregister_settings ( &phantom->settings );
2096	unregister_netdev ( netdev );
2097	netdev_nullify ( netdev );
2098	netdev_put ( netdev );
2099}
2100
2101/** Phantom PCI IDs */
2102static struct pci_device_id phantom_nics[] = {
2103	PCI_ROM ( 0x4040, 0x0100, "nx", "NX", 0 ),
2104};
2105
2106/** Phantom PCI driver */
2107struct pci_driver phantom_driver __pci_driver = {
2108	.ids = phantom_nics,
2109	.id_count = ( sizeof ( phantom_nics ) / sizeof ( phantom_nics[0] ) ),
2110	.probe = phantom_probe,
2111	.remove = phantom_remove,
2112};
2113