An early Christmas present: add driver support for a whole bunch of

PCI fast ethernet adapters, plus man pages.

if_pn.c: Netgear FA310TX model D1, LinkSys LNE100TX, Matrox FastNIC 10/100,
         various other PNIC devices

if_mx.c: NDC Communications SOHOware SFA100 (Macronix 98713A), various
         other boards based on the Macronix 98713, 98713A, 98715, 98715A
         and 98725 chips

if_vr.c: D-Link DFE530-TX, other boards based on the VIA Rhine and
         Rhine II chips (note: the D-Link and certain other cards
         that actually use a Rhine II chip still return the PCI
         device ID of the Rhine I. I don't know why, and it doesn't
         really matter since the driver treats both chips the same
         anyway.)

if_wb.c: Trendware TE100-PCIE and various other cards based on the
         Winbond W89C840F chip (the Trendware card is identical to
         the sample boards Winbond sent me, so who knows how many
         clones there are running around)

All drivers include support for ifmedia, BPF and hardware multicast
filtering.

Also updated GENERIC, LINT, RELNOTES.TXT, userconfig and
sysinstall device list.

I also have a driver for the ASIX AX88140A in the works.

18 files changed, 13516 insertions, 14 deletions

diff --git a/sys/amd64/conf/GENERIC b/sys/amd64/conf/GENERIC
index f2c58b6..7c18050 100644
--- a/sys/amd64/conf/GENERIC
+++ b/sys/amd64/conf/GENERIC
@@ -11,7 +11,7 @@
 # device lines is present in the ./LINT configuration file. If you are 
 # in doubt as to the purpose or necessity of a line, check first in LINT.
 #
-#	$Id: GENERIC,v 1.131 1998/11/12 11:29:28 obrien Exp $
+#	$Id: GENERIC,v 1.132 1998/11/26 23:13:11 n_hibma Exp $
 
 machine		"i386"
 cpu		"I386_CPU"
@@ -140,10 +140,14 @@ device		psm0	at isa? port IO_KBD conflicts tty irq 12
 # revision 1.20 of this file.
 device de0
 device fxp0
+device mx0
+device pn0
 device rl0
 device tl0
 device tx0
+device vr0
 device vx0
+device wb0
 device xl0
 
 device ed0 at isa? port 0x280 net irq 10 iomem 0xd8000
diff --git a/sys/conf/NOTES b/sys/conf/NOTES
index f8a6a7d..5d9da98 100644
--- a/sys/conf/NOTES
+++ b/sys/conf/NOTES
@@ -2,7 +2,7 @@
 # LINT -- config file for checking all the sources, tries to pull in
 #	as much of the source tree as it can.
 #
-#	$Id: LINT,v 1.505 1998/11/23 09:59:02 phk Exp $
+#	$Id: LINT,v 1.506 1998/12/03 20:06:00 dillon Exp $
 #
 # NB: You probably don't want to try running a kernel built from this
 # file.  Instead, you should start from GENERIC, and add options from
@@ -1435,10 +1435,21 @@ options	"EISA_SLOTS=12"
 # The `fxp' device provides support for the Intel EtherExpress Pro/100B
 # PCI Fast Ethernet adapters.
 #
+# The `mx' device provides support for various fast ethernet adapters
+# based on the Macronix 98713, 987615 ans 98725 series chips.
+#
+# The `pn' device provides support for various fast ethernet adapters
+# based on the Lite-On 82c168 and 82c169 PNIC chips, including the
+# LinkSys LNE100TX, the NetGear FA310TX rev. D1 and the Matrox
+# FastNIC 10/100.
+#
 # The 'rl' device provides support for PCI fast ethernet adapters based
 # on the RealTek 8129/8139 chipset. Note that the RealTek driver defaults
 # to useing programmed I/O to do register accesses because memory mapped
-# mode seems to cause severe lockups on SMP hardware.
+# mode seems to cause severe lockups on SMP hardware. This driver also
+# supports the Accton EN1207D `Cheetah' adapter, which uses a chip called
+# the MPX 5030/5038, which is either a RealTek in disguise or a RealTek
+# workalike.
 #
 # The 'tl' device provides support for the Texas Instruments TNETE100
 # series 'ThunderLAN' cards and integrated ethernet controllers. This
@@ -1449,10 +1460,18 @@ options	"EISA_SLOTS=12"
 #
 # The `tx' device provides support for the SMC 9432TX cards.
 #
+# The `vr' device provides support for various fast ethernet adapters
+# based on the VIA Technologies VT3043 `Rhine I' and VT86C100A `Rhine II'
+# chips, including the D-Link DFE530TX.
+#
 # The `vx' device provides support for the 3Com 3C590 and 3C595
 # early support
 #
-# The `xl' driver provides support for the 3Com 3c900, 3c905 and
+# The `wb' device provides support for various fast ethernet adapters
+# based on the Winbond W89C840F chip. Note: this is not the same as
+# the Winbond W89C940F, which is an NE2000 clone.
+#
+# The `xl' device provides support for the 3Com 3c900, 3c905 and
 # 3c905B (Fast) Etherlink XL cards and integrated controllers. This
 # includes the integrated 3c905B-TX chips in certain Dell Optiplex and
 # Dell Precision desktop machines and the integrated 3c905-TX chips
@@ -1499,10 +1518,14 @@ controller	ncr0
 controller	isp0
 device		de0
 device		fxp0
+device		mx0
+device		pn0
 device		rl0
 device		tl0
 device		tx0
+device		vr0
 device		vx0
+device		wb0
 device		xl0
 device		fpa0
 device		meteor0
diff --git a/sys/conf/files b/sys/conf/files
index 7d18ce7..c67be78 100644
--- a/sys/conf/files
+++ b/sys/conf/files
@@ -536,12 +536,16 @@ pci/if_ed_p.c		optional ed device-driver
 pci/if_en_pci.c		optional en device-driver
 pci/if_fxp.c		optional fxp device-driver
 pci/if_lnc_p.c		optional lnc device-driver
+pci/if_mx.c		optional mx device-driver
+pci/if_pn.c		optional pn device-driver
 pci/if_fpa.c		optional fpa device-driver
 pci/if_rl.c		optional rl device-driver
 pci/if_sr_p.c		optional sr device-driver
 pci/if_tl.c		optional tl device-driver
 pci/if_tx.c		optional tx device-driver
+pci/if_vr.c		optional vr device-driver
 pci/if_vx_pci.c		optional vx device-driver
+pci/if_wb.c		optional wb device-driver
 pci/if_xl.c		optional xl device-driver
 pci/isp_pci.c		optional isp device-driver
 pci/meteor.c		optional meteor device-driver
diff --git a/sys/dev/vr/if_vr.c b/sys/dev/vr/if_vr.c
new file mode 100644
index 0000000..a5a2fc4
--- /dev/null
+++ b/sys/dev/vr/if_vr.c
@@ -0,0 +1,1962 @@
+/*
+ * Copyright (c) 1997, 1998
+ *	Bill Paul <wpaul@ctr.columbia.edu>.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ * 3. All advertising materials mentioning features or use of this software
+ *    must display the following acknowledgement:
+ *	This product includes software developed by Bill Paul.
+ * 4. Neither the name of the author nor the names of any co-contributors
+ *    may be used to endorse or promote products derived from this software
+ *    without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY Bill Paul AND CONTRIBUTORS ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL Bill Paul OR THE VOICES IN HIS HEAD
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ *
+ *	$Id: if_vr.c,v 1.13 1998/12/01 22:08:11 wpaul Exp $
+ */
+
+/*
+ * VIA Rhine fast ethernet PCI NIC driver
+ *
+ * Supports various network adapters based on the VIA Rhine
+ * and Rhine II PCI controllers, including the D-Link DFE530TX.
+ * Datasheets are available at http://www.via.com.tw.
+ *
+ * Written by Bill Paul <wpaul@ctr.columbia.edu>
+ * Electrical Engineering Department
+ * Columbia University, New York City
+ */
+
+/*
+ * The VIA Rhine controllers are similar in some respects to the
+ * the DEC tulip chips, except less complicated. The controller
+ * uses an MII bus and an external physical layer interface. The
+ * receiver has a one entry perfect filter and a 64-bit hash table
+ * multicast filter. Transmit and receive descriptors are similar
+ * to the tulip.
+ *
+ * The Rhine has a serious flaw in its transmit DMA mechanism:
+ * transmit buffers must be longword aligned. Unfortunately,
+ * FreeBSD doesn't guarantee that mbufs will be filled in starting
+ * at longword boundaries, so we have to do a buffer copy before
+ * transmission.
+ */
+
+#include "bpfilter.h"
+
+#include <sys/param.h>
+#include <sys/systm.h>
+#include <sys/sockio.h>
+#include <sys/mbuf.h>
+#include <sys/malloc.h>
+#include <sys/kernel.h>
+#include <sys/socket.h>
+
+#include <net/if.h>
+#include <net/if_arp.h>
+#include <net/ethernet.h>
+#include <net/if_dl.h>
+#include <net/if_media.h>
+
+#if NBPFILTER > 0
+#include <net/bpf.h>
+#endif
+
+#include <vm/vm.h>              /* for vtophys */
+#include <vm/pmap.h>            /* for vtophys */
+#include <machine/clock.h>      /* for DELAY */
+#include <machine/bus_pio.h>
+#include <machine/bus_memio.h>
+#include <machine/bus.h>
+
+#include <pci/pcireg.h>
+#include <pci/pcivar.h>
+
+#define VR_USEIOSPACE
+
+/* #define VR_BACKGROUND_AUTONEG */
+
+#include <pci/if_vrreg.h>
+
+#ifndef lint
+static char rcsid[] =
+	"$Id: if_vr.c,v 1.13 1998/12/01 22:08:11 wpaul Exp $";
+#endif
+
+/*
+ * Various supported device vendors/types and their names.
+ */
+static struct vr_type vr_devs[] = {
+	{ VIA_VENDORID, VIA_DEVICEID_RHINE,
+		"VIA VT3043 Rhine I 10/100BaseTX" },
+	{ VIA_VENDORID, VIA_DEVICEID_RHINE_II,
+		"VIA VT86C100A Rhine II 10/100BaseTX" },
+	{ 0, 0, NULL }
+};
+
+/*
+ * Various supported PHY vendors/types and their names. Note that
+ * this driver will work with pretty much any MII-compliant PHY,
+ * so failure to positively identify the chip is not a fatal error.
+ */
+
+static struct vr_type vr_phys[] = {
+	{ TI_PHY_VENDORID, TI_PHY_10BT, "<TI ThunderLAN 10BT (internal)>" },
+	{ TI_PHY_VENDORID, TI_PHY_100VGPMI, "<TI TNETE211 100VG Any-LAN>" },
+	{ NS_PHY_VENDORID, NS_PHY_83840A, "<National Semiconductor DP83840A>"},
+	{ LEVEL1_PHY_VENDORID, LEVEL1_PHY_LXT970, "<Level 1 LXT970>" }, 
+	{ INTEL_PHY_VENDORID, INTEL_PHY_82555, "<Intel 82555>" },
+	{ SEEQ_PHY_VENDORID, SEEQ_PHY_80220, "<SEEQ 80220>" },
+	{ 0, 0, "<MII-compliant physical interface>" }
+};
+
+static unsigned long vr_count = 0;
+static char *vr_probe		__P((pcici_t, pcidi_t));
+static void vr_attach		__P((pcici_t, int));
+
+static int vr_newbuf		__P((struct vr_softc *,
+						struct vr_chain_onefrag *));
+static int vr_encap		__P((struct vr_softc *, struct vr_chain *,
+						struct mbuf * ));
+
+static void vr_rxeof		__P((struct vr_softc *));
+static void vr_rxeoc		__P((struct vr_softc *));
+static void vr_txeof		__P((struct vr_softc *));
+static void vr_txeoc		__P((struct vr_softc *));
+static void vr_intr		__P((void *));
+static void vr_start		__P((struct ifnet *));
+static int vr_ioctl		__P((struct ifnet *, u_long, caddr_t));
+static void vr_init		__P((void *));
+static void vr_stop		__P((struct vr_softc *));
+static void vr_watchdog		__P((struct ifnet *));
+static void vr_shutdown		__P((int, void *));
+static int vr_ifmedia_upd	__P((struct ifnet *));
+static void vr_ifmedia_sts	__P((struct ifnet *, struct ifmediareq *));
+
+static void vr_mii_sync		__P((struct vr_softc *));
+static void vr_mii_send		__P((struct vr_softc *, u_int32_t, int));
+static int vr_mii_readreg	__P((struct vr_softc *, struct vr_mii_frame *));
+static int vr_mii_writereg	__P((struct vr_softc *, struct vr_mii_frame *));
+static u_int16_t vr_phy_readreg	__P((struct vr_softc *, int));
+static void vr_phy_writereg	__P((struct vr_softc *, u_int16_t, u_int16_t));
+
+static void vr_autoneg_xmit	__P((struct vr_softc *));
+static void vr_autoneg_mii	__P((struct vr_softc *, int, int));
+static void vr_setmode_mii	__P((struct vr_softc *, int));
+static void vr_getmode_mii	__P((struct vr_softc *));
+static void vr_setcfg		__P((struct vr_softc *, u_int16_t));
+static u_int8_t vr_calchash	__P((u_int8_t *));
+static void vr_setmulti		__P((struct vr_softc *));
+static void vr_reset		__P((struct vr_softc *));
+static int vr_list_rx_init	__P((struct vr_softc *));
+static int vr_list_tx_init	__P((struct vr_softc *));
+
+#define VR_SETBIT(sc, reg, x)				\
+	CSR_WRITE_1(sc, reg,				\
+		CSR_READ_1(sc, reg) | x)
+
+#define VR_CLRBIT(sc, reg, x)				\
+	CSR_WRITE_1(sc, reg,				\
+		CSR_READ_1(sc, reg) & ~x)
+
+#define VR_SETBIT16(sc, reg, x)				\
+	CSR_WRITE_2(sc, reg,				\
+		CSR_READ_2(sc, reg) | x)
+
+#define VR_CLRBIT16(sc, reg, x)				\
+	CSR_WRITE_2(sc, reg,				\
+		CSR_READ_2(sc, reg) & ~x)
+
+#define VR_SETBIT32(sc, reg, x)				\
+	CSR_WRITE_4(sc, reg,				\
+		CSR_READ_4(sc, reg) | x)
+
+#define VR_CLRBIT32(sc, reg, x)				\
+	CSR_WRITE_4(sc, reg,				\
+		CSR_READ_4(sc, reg) & ~x)
+
+#define SIO_SET(x)					\
+	CSR_WRITE_1(sc, VR_MIICMD,			\
+		CSR_READ_1(sc, VR_MIICMD) | x)
+
+#define SIO_CLR(x)					\
+	CSR_WRITE_1(sc, VR_MIICMD,			\
+		CSR_READ_1(sc, VR_MIICMD) & ~x)
+
+/*
+ * Sync the PHYs by setting data bit and strobing the clock 32 times.
+ */
+static void vr_mii_sync(sc)
+	struct vr_softc		*sc;
+{
+	register int		i;
+
+	SIO_SET(VR_MIICMD_DIR|VR_MIICMD_DATAIN);
+
+	for (i = 0; i < 32; i++) {
+		SIO_SET(VR_MIICMD_CLK);
+		DELAY(1);
+		SIO_CLR(VR_MIICMD_CLK);
+		DELAY(1);
+	}
+
+	return;
+}
+
+/*
+ * Clock a series of bits through the MII.
+ */
+static void vr_mii_send(sc, bits, cnt)
+	struct vr_softc		*sc;
+	u_int32_t		bits;
+	int			cnt;
+{
+	int			i;
+
+	SIO_CLR(VR_MIICMD_CLK);
+
+	for (i = (0x1 << (cnt - 1)); i; i >>= 1) {
+                if (bits & i) {
+			SIO_SET(VR_MIICMD_DATAIN);
+                } else {
+			SIO_CLR(VR_MIICMD_DATAIN);
+                }
+		DELAY(1);
+		SIO_CLR(VR_MIICMD_CLK);
+		DELAY(1);
+		SIO_SET(VR_MIICMD_CLK);
+	}
+}
+
+/*
+ * Read an PHY register through the MII.
+ */
+static int vr_mii_readreg(sc, frame)
+	struct vr_softc		*sc;
+	struct vr_mii_frame	*frame;
+	
+{
+	int			i, ack, s;
+
+	s = splimp();
+
+	/*
+	 * Set up frame for RX.
+	 */
+	frame->mii_stdelim = VR_MII_STARTDELIM;
+	frame->mii_opcode = VR_MII_READOP;
+	frame->mii_turnaround = 0;
+	frame->mii_data = 0;
+	
+	CSR_WRITE_1(sc, VR_MIICMD, 0);
+	VR_SETBIT(sc, VR_MIICMD, VR_MIICMD_DIRECTPGM);
+
+	/*
+ 	 * Turn on data xmit.
+	 */
+	SIO_SET(VR_MIICMD_DIR);
+
+	vr_mii_sync(sc);
+
+	/*
+	 * Send command/address info.
+	 */
+	vr_mii_send(sc, frame->mii_stdelim, 2);
+	vr_mii_send(sc, frame->mii_opcode, 2);
+	vr_mii_send(sc, frame->mii_phyaddr, 5);
+	vr_mii_send(sc, frame->mii_regaddr, 5);
+
+	/* Idle bit */
+	SIO_CLR((VR_MIICMD_CLK|VR_MIICMD_DATAIN));
+	DELAY(1);
+	SIO_SET(VR_MIICMD_CLK);
+	DELAY(1);
+
+	/* Turn off xmit. */
+	SIO_CLR(VR_MIICMD_DIR);
+
+	/* Check for ack */
+	SIO_CLR(VR_MIICMD_CLK);
+	DELAY(1);
+	SIO_SET(VR_MIICMD_CLK);
+	DELAY(1);
+	ack = CSR_READ_4(sc, VR_MIICMD) & VR_MIICMD_DATAOUT;
+
+	/*
+	 * Now try reading data bits. If the ack failed, we still
+	 * need to clock through 16 cycles to keep the PHY(s) in sync.
+	 */
+	if (ack) {
+		for(i = 0; i < 16; i++) {
+			SIO_CLR(VR_MIICMD_CLK);
+			DELAY(1);
+			SIO_SET(VR_MIICMD_CLK);
+			DELAY(1);
+		}
+		goto fail;
+	}
+
+	for (i = 0x8000; i; i >>= 1) {
+		SIO_CLR(VR_MIICMD_CLK);
+		DELAY(1);
+		if (!ack) {
+			if (CSR_READ_4(sc, VR_MIICMD) & VR_MIICMD_DATAOUT)
+				frame->mii_data |= i;
+			DELAY(1);
+		}
+		SIO_SET(VR_MIICMD_CLK);
+		DELAY(1);
+	}
+
+fail:
+
+	SIO_CLR(VR_MIICMD_CLK);
+	DELAY(1);
+	SIO_SET(VR_MIICMD_CLK);
+	DELAY(1);
+
+	splx(s);
+
+	if (ack)
+		return(1);
+	return(0);
+}
+
+/*
+ * Write to a PHY register through the MII.
+ */
+static int vr_mii_writereg(sc, frame)
+	struct vr_softc		*sc;
+	struct vr_mii_frame	*frame;
+	
+{
+	int			s;
+
+	s = splimp();
+
+	CSR_WRITE_1(sc, VR_MIICMD, 0);
+	VR_SETBIT(sc, VR_MIICMD, VR_MIICMD_DIRECTPGM);
+
+	/*
+	 * Set up frame for TX.
+	 */
+
+	frame->mii_stdelim = VR_MII_STARTDELIM;
+	frame->mii_opcode = VR_MII_WRITEOP;
+	frame->mii_turnaround = VR_MII_TURNAROUND;
+	
+	/*
+ 	 * Turn on data output.
+	 */
+	SIO_SET(VR_MIICMD_DIR);
+
+	vr_mii_sync(sc);
+
+	vr_mii_send(sc, frame->mii_stdelim, 2);
+	vr_mii_send(sc, frame->mii_opcode, 2);
+	vr_mii_send(sc, frame->mii_phyaddr, 5);
+	vr_mii_send(sc, frame->mii_regaddr, 5);
+	vr_mii_send(sc, frame->mii_turnaround, 2);
+	vr_mii_send(sc, frame->mii_data, 16);
+
+	/* Idle bit. */
+	SIO_SET(VR_MIICMD_CLK);
+	DELAY(1);
+	SIO_CLR(VR_MIICMD_CLK);
+	DELAY(1);
+
+	/*
+	 * Turn off xmit.
+	 */
+	SIO_CLR(VR_MIICMD_DIR);
+
+	splx(s);
+
+	return(0);
+}
+
+static u_int16_t vr_phy_readreg(sc, reg)
+	struct vr_softc		*sc;
+	int			reg;
+{
+	struct vr_mii_frame	frame;
+
+	bzero((char *)&frame, sizeof(frame));
+
+	frame.mii_phyaddr = sc->vr_phy_addr;
+	frame.mii_regaddr = reg;
+	vr_mii_readreg(sc, &frame);
+
+	return(frame.mii_data);
+}
+
+static void vr_phy_writereg(sc, reg, data)
+	struct vr_softc		*sc;
+	u_int16_t		reg;
+	u_int16_t		data;
+{
+	struct vr_mii_frame	frame;
+
+	bzero((char *)&frame, sizeof(frame));
+
+	frame.mii_phyaddr = sc->vr_phy_addr;
+	frame.mii_regaddr = reg;
+	frame.mii_data = data;
+
+	vr_mii_writereg(sc, &frame);
+
+	return;
+}
+
+/*
+ * Calculate CRC of a multicast group address, return the lower 6 bits.
+ */
+static u_int8_t vr_calchash(addr)
+	u_int8_t		*addr;
+{
+	u_int32_t		crc, carry;
+	int			i, j;
+	u_int8_t		c;
+
+	/* Compute CRC for the address value. */
+	crc = 0xFFFFFFFF; /* initial value */
+
+	for (i = 0; i < 6; i++) {
+		c = *(addr + i);
+		for (j = 0; j < 8; j++) {
+			carry = ((crc & 0x80000000) ? 1 : 0) ^ (c & 0x01);
+			crc <<= 1;
+			c >>= 1;
+			if (carry)
+				crc = (crc ^ 0x04c11db6) | carry;
+		}
+	}
+
+	/* return the filter bit position */
+	return((crc >> 26) & 0x0000003F);
+}
+
+/*
+ * Program the 64-bit multicast hash filter.
+ */
+static void vr_setmulti(sc)
+	struct vr_softc		*sc;
+{
+	struct ifnet		*ifp;
+	int			h = 0;
+	u_int32_t		hashes[2] = { 0, 0 };
+	struct ifmultiaddr	*ifma;
+	u_int8_t		rxfilt;
+	int			mcnt = 0;
+
+	ifp = &sc->arpcom.ac_if;
+
+	rxfilt = CSR_READ_1(sc, VR_RXCFG);
+
+	if (ifp->if_flags & IFF_ALLMULTI || ifp->if_flags & IFF_PROMISC) {
+		rxfilt |= VR_RXCFG_RX_MULTI;
+		CSR_WRITE_1(sc, VR_RXCFG, rxfilt);
+		CSR_WRITE_4(sc, VR_MAR0, 0xFFFFFFFF);
+		CSR_WRITE_4(sc, VR_MAR1, 0xFFFFFFFF);
+		return;
+	}
+
+	/* first, zot all the existing hash bits */
+	CSR_WRITE_4(sc, VR_MAR0, 0);
+	CSR_WRITE_4(sc, VR_MAR1, 0);
+
+	/* now program new ones */
+	for (ifma = ifp->if_multiaddrs.lh_first; ifma != NULL;
+				ifma = ifma->ifma_link.le_next) {
+		if (ifma->ifma_addr->sa_family != AF_LINK)
+			continue;
+		h = vr_calchash(LLADDR((struct sockaddr_dl *)ifma->ifma_addr));
+		if (h < 32)
+			hashes[0] |= (1 << h);
+		else
+			hashes[1] |= (1 << (h - 32));
+		mcnt++;
+	}
+
+	if (mcnt)
+		rxfilt |= VR_RXCFG_RX_MULTI;
+	else
+		rxfilt &= ~VR_RXCFG_RX_MULTI;
+
+	CSR_WRITE_4(sc, VR_MAR0, hashes[0]);
+	CSR_WRITE_4(sc, VR_MAR1, hashes[1]);
+	CSR_WRITE_1(sc, VR_RXCFG, rxfilt);
+
+	return;
+}
+
+/*
+ * Initiate an autonegotiation session.
+ */
+static void vr_autoneg_xmit(sc)
+	struct vr_softc		*sc;
+{
+	u_int16_t		phy_sts;
+
+	vr_phy_writereg(sc, PHY_BMCR, PHY_BMCR_RESET);
+	DELAY(500);
+	while(vr_phy_readreg(sc, PHY_BMCR)
+			& PHY_BMCR_RESET);
+
+	phy_sts = vr_phy_readreg(sc, PHY_BMCR);
+	phy_sts |= PHY_BMCR_AUTONEGENBL|PHY_BMCR_AUTONEGRSTR;
+	vr_phy_writereg(sc, PHY_BMCR, phy_sts);
+
+	return;
+}
+
+/*
+ * Invoke autonegotiation on a PHY.
+ */
+static void vr_autoneg_mii(sc, flag, verbose)
+	struct vr_softc		*sc;
+	int			flag;
+	int			verbose;
+{
+	u_int16_t		phy_sts = 0, media, advert, ability;
+	struct ifnet		*ifp;
+	struct ifmedia		*ifm;
+
+	ifm = &sc->ifmedia;
+	ifp = &sc->arpcom.ac_if;
+
+	ifm->ifm_media = IFM_ETHER | IFM_AUTO;
+
+	/*
+	 * The 100baseT4 PHY on the 3c905-T4 has the 'autoneg supported'
+	 * bit cleared in the status register, but has the 'autoneg enabled'
+	 * bit set in the control register. This is a contradiction, and
+	 * I'm not sure how to handle it. If you want to force an attempt
+	 * to autoneg for 100baseT4 PHYs, #define FORCE_AUTONEG_TFOUR
+	 * and see what happens.
+	 */
+#ifndef FORCE_AUTONEG_TFOUR
+	/*
+	 * First, see if autoneg is supported. If not, there's
+	 * no point in continuing.
+	 */
+	phy_sts = vr_phy_readreg(sc, PHY_BMSR);
+	if (!(phy_sts & PHY_BMSR_CANAUTONEG)) {
+		if (verbose)
+			printf("vr%d: autonegotiation not supported\n",
+							sc->vr_unit);
+		ifm->ifm_media = IFM_ETHER|IFM_10_T|IFM_HDX;	
+		return;
+	}
+#endif
+
+	switch (flag) {
+	case VR_FLAG_FORCEDELAY:
+		/*
+	 	 * XXX Never use this option anywhere but in the probe
+	 	 * routine: making the kernel stop dead in its tracks
+ 		 * for three whole seconds after we've gone multi-user
+		 * is really bad manners.
+	 	 */
+		vr_autoneg_xmit(sc);
+		DELAY(5000000);
+		break;
+	case VR_FLAG_SCHEDDELAY:
+		/*
+		 * Wait for the transmitter to go idle before starting
+		 * an autoneg session, otherwise vr_start() may clobber
+	 	 * our timeout, and we don't want to allow transmission
+		 * during an autoneg session since that can screw it up.
+	 	 */
+		if (sc->vr_cdata.vr_tx_head != NULL) {
+			sc->vr_want_auto = 1;
+			return;
+		}
+		vr_autoneg_xmit(sc);
+		ifp->if_timer = 5;
+		sc->vr_autoneg = 1;
+		sc->vr_want_auto = 0;
+		return;
+		break;
+	case VR_FLAG_DELAYTIMEO:
+		ifp->if_timer = 0;
+		sc->vr_autoneg = 0;
+		break;
+	default:
+		printf("vr%d: invalid autoneg flag: %d\n", sc->vr_unit, flag);
+		return;
+	}
+
+	if (vr_phy_readreg(sc, PHY_BMSR) & PHY_BMSR_AUTONEGCOMP) {
+		if (verbose)
+			printf("vr%d: autoneg complete, ", sc->vr_unit);
+		phy_sts = vr_phy_readreg(sc, PHY_BMSR);
+	} else {
+		if (verbose)
+			printf("vr%d: autoneg not complete, ", sc->vr_unit);
+	}
+
+	media = vr_phy_readreg(sc, PHY_BMCR);
+
+	/* Link is good. Report modes and set duplex mode. */
+	if (vr_phy_readreg(sc, PHY_BMSR) & PHY_BMSR_LINKSTAT) {
+		if (verbose)
+			printf("link status good ");
+		advert = vr_phy_readreg(sc, PHY_ANAR);
+		ability = vr_phy_readreg(sc, PHY_LPAR);
+
+		if (advert & PHY_ANAR_100BT4 && ability & PHY_ANAR_100BT4) {
+			ifm->ifm_media = IFM_ETHER|IFM_100_T4;
+			media |= PHY_BMCR_SPEEDSEL;
+			media &= ~PHY_BMCR_DUPLEX;
+			printf("(100baseT4)\n");
+		} else if (advert & PHY_ANAR_100BTXFULL &&
+			ability & PHY_ANAR_100BTXFULL) {
+			ifm->ifm_media = IFM_ETHER|IFM_100_TX|IFM_FDX;
+			media |= PHY_BMCR_SPEEDSEL;
+			media |= PHY_BMCR_DUPLEX;
+			printf("(full-duplex, 100Mbps)\n");
+		} else if (advert & PHY_ANAR_100BTXHALF &&
+			ability & PHY_ANAR_100BTXHALF) {
+			ifm->ifm_media = IFM_ETHER|IFM_100_TX|IFM_HDX;
+			media |= PHY_BMCR_SPEEDSEL;
+			media &= ~PHY_BMCR_DUPLEX;
+			printf("(half-duplex, 100Mbps)\n");
+		} else if (advert & PHY_ANAR_10BTFULL &&
+			ability & PHY_ANAR_10BTFULL) {
+			ifm->ifm_media = IFM_ETHER|IFM_10_T|IFM_FDX;
+			media &= ~PHY_BMCR_SPEEDSEL;
+			media |= PHY_BMCR_DUPLEX;
+			printf("(full-duplex, 10Mbps)\n");
+		} else {
+			ifm->ifm_media = IFM_ETHER|IFM_10_T|IFM_HDX;
+			media &= ~PHY_BMCR_SPEEDSEL;
+			media &= ~PHY_BMCR_DUPLEX;
+			printf("(half-duplex, 10Mbps)\n");
+		}
+
+		media &= ~PHY_BMCR_AUTONEGENBL;
+
+		/* Set ASIC's duplex mode to match the PHY. */
+		vr_setcfg(sc, media);
+		vr_phy_writereg(sc, PHY_BMCR, media);
+	} else {
+		if (verbose)
+			printf("no carrier\n");
+	}
+
+	vr_init(sc);
+
+	if (sc->vr_tx_pend) {
+		sc->vr_autoneg = 0;
+		sc->vr_tx_pend = 0;
+		vr_start(ifp);
+	}
+
+	return;
+}
+
+static void vr_getmode_mii(sc)
+	struct vr_softc		*sc;
+{
+	u_int16_t		bmsr;
+	struct ifnet		*ifp;
+
+	ifp = &sc->arpcom.ac_if;
+
+	bmsr = vr_phy_readreg(sc, PHY_BMSR);
+	if (bootverbose)
+		printf("vr%d: PHY status word: %x\n", sc->vr_unit, bmsr);
+
+	/* fallback */
+	sc->ifmedia.ifm_media = IFM_ETHER|IFM_10_T|IFM_HDX;
+
+	if (bmsr & PHY_BMSR_10BTHALF) {
+		if (bootverbose)
+			printf("vr%d: 10Mbps half-duplex mode supported\n",
+								sc->vr_unit);
+		ifmedia_add(&sc->ifmedia,
+			IFM_ETHER|IFM_10_T|IFM_HDX, 0, NULL);
+		ifmedia_add(&sc->ifmedia, IFM_ETHER|IFM_10_T, 0, NULL);
+	}
+
+	if (bmsr & PHY_BMSR_10BTFULL) {
+		if (bootverbose)
+			printf("vr%d: 10Mbps full-duplex mode supported\n",
+								sc->vr_unit);
+		ifmedia_add(&sc->ifmedia,
+			IFM_ETHER|IFM_10_T|IFM_FDX, 0, NULL);
+		sc->ifmedia.ifm_media = IFM_ETHER|IFM_10_T|IFM_FDX;
+	}
+
+	if (bmsr & PHY_BMSR_100BTXHALF) {
+		if (bootverbose)
+			printf("vr%d: 100Mbps half-duplex mode supported\n",
+								sc->vr_unit);
+		ifp->if_baudrate = 100000000;
+		ifmedia_add(&sc->ifmedia, IFM_ETHER|IFM_100_TX, 0, NULL);
+		ifmedia_add(&sc->ifmedia,
+			IFM_ETHER|IFM_100_TX|IFM_HDX, 0, NULL);
+		sc->ifmedia.ifm_media = IFM_ETHER|IFM_100_TX|IFM_HDX;
+	}
+
+	if (bmsr & PHY_BMSR_100BTXFULL) {
+		if (bootverbose)
+			printf("vr%d: 100Mbps full-duplex mode supported\n",
+								sc->vr_unit);
+		ifp->if_baudrate = 100000000;
+		ifmedia_add(&sc->ifmedia,
+			IFM_ETHER|IFM_100_TX|IFM_FDX, 0, NULL);
+		sc->ifmedia.ifm_media = IFM_ETHER|IFM_100_TX|IFM_FDX;
+	}
+
+	/* Some also support 100BaseT4. */
+	if (bmsr & PHY_BMSR_100BT4) {
+		if (bootverbose)
+			printf("vr%d: 100baseT4 mode supported\n", sc->vr_unit);
+		ifp->if_baudrate = 100000000;
+		ifmedia_add(&sc->ifmedia, IFM_ETHER|IFM_100_T4, 0, NULL);
+		sc->ifmedia.ifm_media = IFM_ETHER|IFM_100_T4;
+#ifdef FORCE_AUTONEG_TFOUR
+		if (bootverbose)
+			printf("vr%d: forcing on autoneg support for BT4\n",
+							 sc->vr_unit);
+		ifmedia_add(&sc->ifmedia, IFM_ETHER|IFM_AUTO, 0 NULL):
+		sc->ifmedia.ifm_media = IFM_ETHER|IFM_AUTO;
+#endif
+	}
+
+	if (bmsr & PHY_BMSR_CANAUTONEG) {
+		if (bootverbose)
+			printf("vr%d: autoneg supported\n", sc->vr_unit);
+		ifmedia_add(&sc->ifmedia, IFM_ETHER|IFM_AUTO, 0, NULL);
+		sc->ifmedia.ifm_media = IFM_ETHER|IFM_AUTO;
+	}
+
+	return;
+}
+
+/*
+ * Set speed and duplex mode.
+ */
+static void vr_setmode_mii(sc, media)
+	struct vr_softc		*sc;
+	int			media;
+{
+	u_int16_t		bmcr;
+	struct ifnet		*ifp;
+
+	ifp = &sc->arpcom.ac_if;
+
+	/*
+	 * If an autoneg session is in progress, stop it.
+	 */
+	if (sc->vr_autoneg) {
+		printf("vr%d: canceling autoneg session\n", sc->vr_unit);
+		ifp->if_timer = sc->vr_autoneg = sc->vr_want_auto = 0;
+		bmcr = vr_phy_readreg(sc, PHY_BMCR);
+		bmcr &= ~PHY_BMCR_AUTONEGENBL;
+		vr_phy_writereg(sc, PHY_BMCR, bmcr);
+	}
+
+	printf("vr%d: selecting MII, ", sc->vr_unit);
+
+	bmcr = vr_phy_readreg(sc, PHY_BMCR);
+
+	bmcr &= ~(PHY_BMCR_AUTONEGENBL|PHY_BMCR_SPEEDSEL|
+			PHY_BMCR_DUPLEX|PHY_BMCR_LOOPBK);
+
+	if (IFM_SUBTYPE(media) == IFM_100_T4) {
+		printf("100Mbps/T4, half-duplex\n");
+		bmcr |= PHY_BMCR_SPEEDSEL;
+		bmcr &= ~PHY_BMCR_DUPLEX;
+	}
+
+	if (IFM_SUBTYPE(media) == IFM_100_TX) {
+		printf("100Mbps, ");
+		bmcr |= PHY_BMCR_SPEEDSEL;
+	}
+
+	if (IFM_SUBTYPE(media) == IFM_10_T) {
+		printf("10Mbps, ");
+		bmcr &= ~PHY_BMCR_SPEEDSEL;
+	}
+
+	if ((media & IFM_GMASK) == IFM_FDX) {
+		printf("full duplex\n");
+		bmcr |= PHY_BMCR_DUPLEX;
+	} else {
+		printf("half duplex\n");
+		bmcr &= ~PHY_BMCR_DUPLEX;
+	}
+
+	vr_setcfg(sc, bmcr);
+	vr_phy_writereg(sc, PHY_BMCR, bmcr);
+
+	return;
+}
+
+/*
+ * In order to fiddle with the
+ * 'full-duplex' and '100Mbps' bits in the netconfig register, we
+ * first have to put the transmit and/or receive logic in the idle state.
+ */
+static void vr_setcfg(sc, bmcr)
+	struct vr_softc		*sc;
+	u_int16_t		bmcr;
+{
+	int			restart = 0;
+
+	if (CSR_READ_2(sc, VR_COMMAND) & (VR_CMD_TX_ON|VR_CMD_RX_ON)) {
+		restart = 1;
+		VR_CLRBIT16(sc, VR_COMMAND, (VR_CMD_TX_ON|VR_CMD_RX_ON));
+	}
+
+	if (bmcr & PHY_BMCR_DUPLEX)
+		VR_SETBIT16(sc, VR_COMMAND, VR_CMD_FULLDUPLEX);
+	else
+		VR_CLRBIT16(sc, VR_COMMAND, VR_CMD_FULLDUPLEX);
+
+	if (restart)
+		VR_SETBIT16(sc, VR_COMMAND, VR_CMD_TX_ON|VR_CMD_RX_ON);
+
+	return;
+}
+
+static void vr_reset(sc)
+	struct vr_softc		*sc;
+{
+	register int		i;
+
+	VR_SETBIT16(sc, VR_COMMAND, VR_CMD_RESET);
+
+	for (i = 0; i < VR_TIMEOUT; i++) {
+		DELAY(10);
+		if (!(CSR_READ_2(sc, VR_COMMAND) & VR_CMD_RESET))
+			break;
+	}
+	if (i == VR_TIMEOUT)
+		printf("vr%d: reset never completed!\n", sc->vr_unit);
+
+	/* Wait a little while for the chip to get its brains in order. */
+	DELAY(1000);
+
+        return;
+}
+
+/*
+ * Probe for a VIA Rhine chip. Check the PCI vendor and device
+ * IDs against our list and return a device name if we find a match.
+ */
+static char *
+vr_probe(config_id, device_id)
+	pcici_t			config_id;
+	pcidi_t			device_id;
+{
+	struct vr_type		*t;
+
+	t = vr_devs;
+
+	while(t->vr_name != NULL) {
+		if ((device_id & 0xFFFF) == t->vr_vid &&
+		    ((device_id >> 16) & 0xFFFF) == t->vr_did) {
+			return(t->vr_name);
+		}
+		t++;
+	}
+
+	return(NULL);
+}
+
+/*
+ * Attach the interface. Allocate softc structures, do ifmedia
+ * setup and ethernet/BPF attach.
+ */
+static void
+vr_attach(config_id, unit)
+	pcici_t			config_id;
+	int			unit;
+{
+	int			s, i;
+#ifndef VR_USEIOSPACE
+	vm_offset_t		pbase, vbase;
+#endif
+	u_char			eaddr[ETHER_ADDR_LEN];
+	u_int32_t		command;
+	struct vr_softc		*sc;
+	struct ifnet		*ifp;
+	int			media = IFM_ETHER|IFM_100_TX|IFM_FDX;
+	unsigned int		round;
+	caddr_t			roundptr;
+	struct vr_type		*p;
+	u_int16_t		phy_vid, phy_did, phy_sts;
+
+	s = splimp();
+
+	sc = malloc(sizeof(struct vr_softc), M_DEVBUF, M_NOWAIT);
+	if (sc == NULL) {
+		printf("vr%d: no memory for softc struct!\n", unit);
+		return;
+	}
+	bzero(sc, sizeof(struct vr_softc));
+
+	/*
+	 * Handle power management nonsense.
+	 */
+
+	command = pci_conf_read(config_id, VR_PCI_CAPID) & 0x000000FF;
+	if (command == 0x01) {
+
+		command = pci_conf_read(config_id, VR_PCI_PWRMGMTCTRL);
+		if (command & VR_PSTATE_MASK) {
+			u_int32_t		iobase, membase, irq;
+
+			/* Save important PCI config data. */
+			iobase = pci_conf_read(config_id, VR_PCI_LOIO);
+			membase = pci_conf_read(config_id, VR_PCI_LOMEM);
+			irq = pci_conf_read(config_id, VR_PCI_INTLINE);
+
+			/* Reset the power state. */
+			printf("vr%d: chip is in D%d power mode "
+			"-- setting to D0\n", unit, command & VR_PSTATE_MASK);
+			command &= 0xFFFFFFFC;
+			pci_conf_write(config_id, VR_PCI_PWRMGMTCTRL, command);
+
+			/* Restore PCI config data. */
+			pci_conf_write(config_id, VR_PCI_LOIO, iobase);
+			pci_conf_write(config_id, VR_PCI_LOMEM, membase);
+			pci_conf_write(config_id, VR_PCI_INTLINE, irq);
+		}
+	}
+
+	/*
+	 * Map control/status registers.
+	 */
+	command = pci_conf_read(config_id, PCI_COMMAND_STATUS_REG);
+	command |= (PCIM_CMD_PORTEN|PCIM_CMD_MEMEN|PCIM_CMD_BUSMASTEREN);
+	pci_conf_write(config_id, PCI_COMMAND_STATUS_REG, command);
+	command = pci_conf_read(config_id, PCI_COMMAND_STATUS_REG);
+
+#ifdef VR_USEIOSPACE
+	if (!(command & PCIM_CMD_PORTEN)) {
+		printf("vr%d: failed to enable I/O ports!\n", unit);
+		free(sc, M_DEVBUF);
+		goto fail;
+	}
+
+	if (!pci_map_port(config_id, VR_PCI_LOIO,
+					(u_int16_t *)(&sc->vr_bhandle))) {
+		printf ("vr%d: couldn't map ports\n", unit);
+		goto fail;
+	}
+	sc->vr_btag = I386_BUS_SPACE_IO;
+#else
+	if (!(command & PCIM_CMD_MEMEN)) {
+		printf("vr%d: failed to enable memory mapping!\n", unit);
+		goto fail;
+	}
+
+	if (!pci_map_mem(config_id, VR_PCI_LOMEM, &vbase, &pbase)) {
+		printf ("vr%d: couldn't map memory\n", unit);
+		goto fail;
+	}
+
+	sc->vr_bhandle = vbase;
+	sc->vr_btag = I386_BUS_SPACE_MEM;
+#endif
+
+	/* Allocate interrupt */
+	if (!pci_map_int(config_id, vr_intr, sc, &net_imask)) {
+		printf("vr%d: couldn't map interrupt\n", unit);
+		goto fail;
+	}
+
+	/* Reset the adapter. */
+	vr_reset(sc);
+
+	/*
+	 * Get station address. The way the Rhine chips work,
+	 * you're not allowed to directly access the EEPROM once
+	 * they've been programmed a special way. Consequently,
+	 * we need to read the node address from the PAR0 and PAR1
+	 * registers.
+	 */
+	VR_SETBIT(sc, VR_EECSR, VR_EECSR_LOAD);
+	DELAY(200);
+	for (i = 0; i < ETHER_ADDR_LEN; i++)
+		eaddr[i] = CSR_READ_1(sc, VR_PAR0 + i);
+
+	/*
+	 * A Rhine chip was detected. Inform the world.
+	 */
+	printf("vr%d: Ethernet address: %6D\n", unit, eaddr, ":");
+
+	sc->vr_unit = unit;
+	bcopy(eaddr, (char *)&sc->arpcom.ac_enaddr, ETHER_ADDR_LEN);
+
+	sc->vr_ldata_ptr = malloc(sizeof(struct vr_list_data) + 8,
+				M_DEVBUF, M_NOWAIT);
+	if (sc->vr_ldata_ptr == NULL) {
+		free(sc, M_DEVBUF);
+		printf("vr%d: no memory for list buffers!\n", unit);
+		return;
+	}
+
+	sc->vr_ldata = (struct vr_list_data *)sc->vr_ldata_ptr;
+	round = (unsigned int)sc->vr_ldata_ptr & 0xF;
+	roundptr = sc->vr_ldata_ptr;
+	for (i = 0; i < 8; i++) {
+		if (round % 8) {
+			round++;
+			roundptr++;
+		} else
+			break;
+	}
+	sc->vr_ldata = (struct vr_list_data *)roundptr;
+	bzero(sc->vr_ldata, sizeof(struct vr_list_data));
+
+	ifp = &sc->arpcom.ac_if;
+	ifp->if_softc = sc;
+	ifp->if_unit = unit;
+	ifp->if_name = "vr";
+	ifp->if_mtu = ETHERMTU;
+	ifp->if_flags = IFF_BROADCAST | IFF_SIMPLEX | IFF_MULTICAST;
+	ifp->if_ioctl = vr_ioctl;
+	ifp->if_output = ether_output;
+	ifp->if_start = vr_start;
+	ifp->if_watchdog = vr_watchdog;
+	ifp->if_init = vr_init;
+	ifp->if_baudrate = 10000000;
+
+	if (bootverbose)
+		printf("vr%d: probing for a PHY\n", sc->vr_unit);
+	for (i = VR_PHYADDR_MIN; i < VR_PHYADDR_MAX + 1; i++) {
+		if (bootverbose)
+			printf("vr%d: checking address: %d\n",
+						sc->vr_unit, i);
+		sc->vr_phy_addr = i;
+		vr_phy_writereg(sc, PHY_BMCR, PHY_BMCR_RESET);
+		DELAY(500);
+		while(vr_phy_readreg(sc, PHY_BMCR)
+				& PHY_BMCR_RESET);
+		if ((phy_sts = vr_phy_readreg(sc, PHY_BMSR)))
+			break;
+	}
+	if (phy_sts) {
+		phy_vid = vr_phy_readreg(sc, PHY_VENID);
+		phy_did = vr_phy_readreg(sc, PHY_DEVID);
+		if (bootverbose)
+			printf("vr%d: found PHY at address %d, ",
+					sc->vr_unit, sc->vr_phy_addr);
+		if (bootverbose)
+			printf("vendor id: %x device id: %x\n",
+				phy_vid, phy_did);
+		p = vr_phys;
+		while(p->vr_vid) {
+			if (phy_vid == p->vr_vid &&
+				(phy_did | 0x000F) == p->vr_did) {
+				sc->vr_pinfo = p;
+				break;
+			}
+			p++;
+		}
+		if (sc->vr_pinfo == NULL)
+			sc->vr_pinfo = &vr_phys[PHY_UNKNOWN];
+		if (bootverbose)
+			printf("vr%d: PHY type: %s\n",
+				sc->vr_unit, sc->vr_pinfo->vr_name);
+	} else {
+		printf("vr%d: MII without any phy!\n", sc->vr_unit);
+		goto fail;
+	}
+
+	/*
+	 * Do ifmedia setup.
+	 */
+	ifmedia_init(&sc->ifmedia, 0, vr_ifmedia_upd, vr_ifmedia_sts);
+
+	vr_getmode_mii(sc);
+	vr_autoneg_mii(sc, VR_FLAG_FORCEDELAY, 1);
+	media = sc->ifmedia.ifm_media;
+	vr_stop(sc);
+
+	ifmedia_set(&sc->ifmedia, media);
+
+	/*
+	 * Call MI attach routines.
+	 */
+	if_attach(ifp);
+	ether_ifattach(ifp);
+
+#if NBPFILTER > 0
+	bpfattach(ifp, DLT_EN10MB, sizeof(struct ether_header));
+#endif
+
+	at_shutdown(vr_shutdown, sc, SHUTDOWN_POST_SYNC);
+
+fail:
+	splx(s);
+	return;
+}
+
+/*
+ * Initialize the transmit descriptors.
+ */
+static int vr_list_tx_init(sc)
+	struct vr_softc		*sc;
+{
+	struct vr_chain_data	*cd;
+	struct vr_list_data	*ld;
+	int			i;
+
+	cd = &sc->vr_cdata;
+	ld = sc->vr_ldata;
+	for (i = 0; i < VR_TX_LIST_CNT; i++) {
+		cd->vr_tx_chain[i].vr_ptr = &ld->vr_tx_list[i];
+		if (i == (VR_TX_LIST_CNT - 1))
+			cd->vr_tx_chain[i].vr_nextdesc = 
+				&cd->vr_tx_chain[0];
+		else
+			cd->vr_tx_chain[i].vr_nextdesc =
+				&cd->vr_tx_chain[i + 1];
+	}
+
+	cd->vr_tx_free = &cd->vr_tx_chain[0];
+	cd->vr_tx_tail = cd->vr_tx_head = NULL;
+
+	return(0);
+}
+
+
+/*
+ * Initialize the RX descriptors and allocate mbufs for them. Note that
+ * we arrange the descriptors in a closed ring, so that the last descriptor
+ * points back to the first.
+ */
+static int vr_list_rx_init(sc)
+	struct vr_softc		*sc;
+{
+	struct vr_chain_data	*cd;
+	struct vr_list_data	*ld;
+	int			i;
+
+	cd = &sc->vr_cdata;
+	ld = sc->vr_ldata;
+
+	for (i = 0; i < VR_RX_LIST_CNT; i++) {
+		cd->vr_rx_chain[i].vr_ptr =
+			(struct vr_desc *)&ld->vr_rx_list[i];
+		if (vr_newbuf(sc, &cd->vr_rx_chain[i]) == ENOBUFS)
+			return(ENOBUFS);
+		if (i == (VR_RX_LIST_CNT - 1)) {
+			cd->vr_rx_chain[i].vr_nextdesc =
+					&cd->vr_rx_chain[0];
+			ld->vr_rx_list[i].vr_next =
+					vtophys(&ld->vr_rx_list[0]);
+		} else {
+			cd->vr_rx_chain[i].vr_nextdesc =
+					&cd->vr_rx_chain[i + 1];
+			ld->vr_rx_list[i].vr_next =
+					vtophys(&ld->vr_rx_list[i + 1]);
+		}
+	}
+
+	cd->vr_rx_head = &cd->vr_rx_chain[0];
+
+	return(0);
+}
+
+/*
+ * Initialize an RX descriptor and attach an MBUF cluster.
+ * Note: the length fields are only 11 bits wide, which means the
+ * largest size we can specify is 2047. This is important because
+ * MCLBYTES is 2048, so we have to subtract one otherwise we'll
+ * overflow the field and make a mess.
+ */
+static int vr_newbuf(sc, c)
+	struct vr_softc		*sc;
+	struct vr_chain_onefrag	*c;
+{
+	struct mbuf		*m_new = NULL;
+
+	MGETHDR(m_new, M_DONTWAIT, MT_DATA);
+	if (m_new == NULL) {
+		printf("vr%d: no memory for rx list -- packet dropped!\n",
+								sc->vr_unit);
+		return(ENOBUFS);
+	}
+
+	MCLGET(m_new, M_DONTWAIT);
+	if (!(m_new->m_flags & M_EXT)) {
+		printf("vr%d: no memory for rx list -- packet dropped!\n",
+								sc->vr_unit);
+		m_freem(m_new);
+		return(ENOBUFS);
+	}
+
+	c->vr_mbuf = m_new;
+	c->vr_ptr->vr_status = VR_RXSTAT;
+	c->vr_ptr->vr_data = vtophys(mtod(m_new, caddr_t));
+	c->vr_ptr->vr_ctl = VR_RXCTL_CHAIN | (MCLBYTES - 1);
+
+	return(0);
+}
+
+/*
+ * A frame has been uploaded: pass the resulting mbuf chain up to
+ * the higher level protocols.
+ */
+static void vr_rxeof(sc)
+	struct vr_softc		*sc;
+{
+        struct ether_header	*eh;
+        struct mbuf		*m;
+        struct ifnet		*ifp;
+	struct vr_chain_onefrag	*cur_rx;
+	int			total_len = 0;
+	u_int32_t		rxstat;
+
+	ifp = &sc->arpcom.ac_if;
+
+	while(!((rxstat = sc->vr_cdata.vr_rx_head->vr_ptr->vr_status) &
+							VR_RXSTAT_OWN)) {
+		cur_rx = sc->vr_cdata.vr_rx_head;
+		sc->vr_cdata.vr_rx_head = cur_rx->vr_nextdesc;
+
+		/*
+		 * If an error occurs, update stats, clear the
+		 * status word and leave the mbuf cluster in place:
+		 * it should simply get re-used next time this descriptor
+	 	 * comes up in the ring.
+		 */
+		if (rxstat & VR_RXSTAT_RXERR) {
+			ifp->if_ierrors++;
+			printf("vr%d: rx error: ", sc->vr_unit);
+			switch(rxstat & 0x000000FF) {
+			case VR_RXSTAT_CRCERR:
+				printf("crc error\n");
+				break;
+			case VR_RXSTAT_FRAMEALIGNERR:
+				printf("frame alignment error\n");
+				break;
+			case VR_RXSTAT_FIFOOFLOW:
+				printf("FIFO overflow\n");
+				break;
+			case VR_RXSTAT_GIANT:
+				printf("received giant packet\n");
+				break;
+			case VR_RXSTAT_RUNT:
+				printf("received runt packet\n");
+				break;
+			case VR_RXSTAT_BUSERR:
+				printf("system bus error\n");
+				break;
+			case VR_RXSTAT_BUFFERR:
+				printf("rx buffer error\n");
+				break;
+			default:
+				printf("unknown rx error\n");
+				break;
+			}
+			cur_rx->vr_ptr->vr_status = VR_RXSTAT;
+			cur_rx->vr_ptr->vr_ctl =
+			VR_RXCTL_CHAIN | (MCLBYTES - 1);
+			continue;
+		}
+
+		/* No errors; receive the packet. */	
+		m = cur_rx->vr_mbuf;
+		total_len = VR_RXBYTES(cur_rx->vr_ptr->vr_status);
+
+		/*
+		 * Try to conjure up a new mbuf cluster. If that
+		 * fails, it means we have an out of memory condition and
+		 * should leave the buffer in place and continue. This will
+		 * result in a lost packet, but there's little else we
+		 * can do in this situation.
+		 */
+		if (vr_newbuf(sc, cur_rx) == ENOBUFS) {
+			ifp->if_ierrors++;
+			cur_rx->vr_ptr->vr_status =
+				VR_RXSTAT_FIRSTFRAG|VR_RXSTAT_LASTFRAG;
+			cur_rx->vr_ptr->vr_ctl =
+			VR_RXCTL_CHAIN | (MCLBYTES - 1);
+			continue;
+		}
+
+		ifp->if_ipackets++;
+		eh = mtod(m, struct ether_header *);
+		m->m_pkthdr.rcvif = ifp;
+		m->m_pkthdr.len = m->m_len = total_len;
+#if NBPFILTER > 0
+		/*
+		 * Handle BPF listeners. Let the BPF user see the packet, but
+		 * don't pass it up to the ether_input() layer unless it's
+		 * a broadcast packet, multicast packet, matches our ethernet
+		 * address or the interface is in promiscuous mode.
+		 */
+		if (ifp->if_bpf) {
+			bpf_mtap(ifp, m);
+			if (ifp->if_flags & IFF_PROMISC &&
+				(bcmp(eh->ether_dhost, sc->arpcom.ac_enaddr,
+						ETHER_ADDR_LEN) &&
+					(eh->ether_dhost[0] & 1) == 0)) {
+				m_freem(m);
+				continue;
+			}
+		}
+#endif
+		/* Remove header from mbuf and pass it on. */
+		m_adj(m, sizeof(struct ether_header));
+		ether_input(ifp, eh, m);
+	}
+
+	return;
+}
+
+void vr_rxeoc(sc)
+	struct vr_softc		*sc;
+{
+
+	vr_rxeof(sc);
+	VR_CLRBIT16(sc, VR_COMMAND, VR_CMD_RX_ON);
+	CSR_WRITE_4(sc, VR_RXADDR, vtophys(sc->vr_cdata.vr_rx_head->vr_ptr));
+	VR_SETBIT16(sc, VR_COMMAND, VR_CMD_RX_ON);
+	VR_SETBIT16(sc, VR_COMMAND, VR_CMD_RX_GO);
+
+	return;
+}
+
+/*
+ * A frame was downloaded to the chip. It's safe for us to clean up
+ * the list buffers.
+ */
+
+static void vr_txeof(sc)
+	struct vr_softc		*sc;
+{
+	struct vr_chain		*cur_tx;
+	struct ifnet		*ifp;
+	register struct mbuf	*n;
+
+	ifp = &sc->arpcom.ac_if;
+
+	/* Clear the timeout timer. */
+	ifp->if_timer = 0;
+
+	/* Sanity check. */
+	if (sc->vr_cdata.vr_tx_head == NULL)
+		return;
+
+	/*
+	 * Go through our tx list and free mbufs for those
+	 * frames that have been transmitted.
+	 */
+	while(sc->vr_cdata.vr_tx_head->vr_mbuf != NULL) {
+		u_int32_t		txstat;
+
+		cur_tx = sc->vr_cdata.vr_tx_head;
+		txstat = cur_tx->vr_ptr->vr_status;
+
+		if ((txstat & VR_TXSTAT_OWN) || txstat == VR_UNSENT)
+			break;
+
+		if (txstat & VR_TXSTAT_ERRSUM) {
+			ifp->if_oerrors++;
+			if (txstat & VR_TXSTAT_DEFER)
+				ifp->if_collisions++;
+			if (txstat & VR_TXSTAT_LATECOLL)
+				ifp->if_collisions++;
+		}
+
+		ifp->if_collisions +=(txstat & VR_TXSTAT_COLLCNT) >> 3;
+
+		ifp->if_opackets++;
+        	MFREE(cur_tx->vr_mbuf, n);
+		cur_tx->vr_mbuf = NULL;
+
+		if (sc->vr_cdata.vr_tx_head == sc->vr_cdata.vr_tx_tail) {
+			sc->vr_cdata.vr_tx_head = NULL;
+			sc->vr_cdata.vr_tx_tail = NULL;
+			break;
+		}
+
+		sc->vr_cdata.vr_tx_head = cur_tx->vr_nextdesc;
+	}
+
+	return;
+}
+
+/*
+ * TX 'end of channel' interrupt handler.
+ */
+static void vr_txeoc(sc)
+	struct vr_softc		*sc;
+{
+	struct ifnet		*ifp;
+
+	ifp = &sc->arpcom.ac_if;
+
+	ifp->if_timer = 0;
+
+	if (sc->vr_cdata.vr_tx_head == NULL) {
+		ifp->if_flags &= ~IFF_OACTIVE;
+		sc->vr_cdata.vr_tx_tail = NULL;
+		if (sc->vr_want_auto)
+			vr_autoneg_mii(sc, VR_FLAG_SCHEDDELAY, 1);
+	} else {
+		if (VR_TXOWN(sc->vr_cdata.vr_tx_head) == VR_UNSENT) {
+			VR_TXOWN(sc->vr_cdata.vr_tx_head) = VR_TXSTAT_OWN;
+			ifp->if_timer = 5;
+			VR_SETBIT16(sc, VR_COMMAND, VR_CMD_TX_ON|VR_CMD_TX_GO);
+		}
+	}
+
+	return;
+}
+
+static void vr_intr(arg)
+	void			*arg;
+{
+	struct vr_softc		*sc;
+	struct ifnet		*ifp;
+	u_int16_t		status;
+
+	sc = arg;
+	ifp = &sc->arpcom.ac_if;
+
+	/* Supress unwanted interrupts. */
+	if (!(ifp->if_flags & IFF_UP)) {
+		vr_stop(sc);
+		return;
+	}
+
+	/* Disable interrupts. */
+	CSR_WRITE_2(sc, VR_IMR, 0x0000);
+
+	for (;;) {
+
+		status = CSR_READ_2(sc, VR_ISR);
+		if (status)
+			CSR_WRITE_2(sc, VR_ISR, status);
+
+		if ((status & VR_INTRS) == 0)
+			break;
+
+		if (status & VR_ISR_RX_OK)
+			vr_rxeof(sc);
+
+		if ((status & VR_ISR_RX_ERR) || (status & VR_ISR_RX_NOBUF) ||
+		    (status & VR_ISR_RX_NOBUF) || (status & VR_ISR_RX_OFLOW) ||
+		    (status & VR_ISR_RX_DROPPED)) {
+			vr_rxeof(sc);
+			vr_rxeoc(sc);
+		}
+
+		if (status & VR_ISR_TX_OK) {
+			vr_txeof(sc);
+			vr_txeoc(sc);
+		}
+
+		if ((status & VR_ISR_TX_UNDERRUN)||(status & VR_ISR_TX_ABRT)){ 
+			ifp->if_oerrors++;
+			vr_txeof(sc);
+			if (sc->vr_cdata.vr_tx_head != NULL) {
+				VR_SETBIT16(sc, VR_COMMAND, VR_CMD_TX_ON);
+				VR_SETBIT16(sc, VR_COMMAND, VR_CMD_TX_GO);
+			}
+		}
+
+		if (status & VR_ISR_BUSERR) {
+			vr_reset(sc);
+			vr_init(sc);
+		}
+	}
+
+	/* Re-enable interrupts. */
+	CSR_WRITE_2(sc, VR_IMR, VR_INTRS);
+
+	if (ifp->if_snd.ifq_head != NULL) {
+		vr_start(ifp);
+	}
+
+	return;
+}
+
+/*
+ * Encapsulate an mbuf chain in a descriptor by coupling the mbuf data
+ * pointers to the fragment pointers.
+ */
+static int vr_encap(sc, c, m_head)
+	struct vr_softc		*sc;
+	struct vr_chain		*c;
+	struct mbuf		*m_head;
+{
+	int			frag = 0;
+	struct vr_desc		*f = NULL;
+	int			total_len;
+	struct mbuf		*m;
+
+	m = m_head;
+	total_len = 0;
+
+	/*
+	 * The VIA Rhine wants packet buffers to be longword
+	 * aligned, but very often our mbufs aren't. Rather than
+	 * waste time trying to decide when to copy and when not
+	 * to copy, just do it all the time.
+	 */
+	if (m != NULL) {
+		struct mbuf		*m_new = NULL;
+
+		MGETHDR(m_new, M_DONTWAIT, MT_DATA);
+		if (m_new == NULL) {
+			printf("vr%d: no memory for tx list", sc->vr_unit);
+			return(1);
+		}
+		if (m_head->m_pkthdr.len > MHLEN) {
+			MCLGET(m_new, M_DONTWAIT);
+			if (!(m_new->m_flags & M_EXT)) {
+				m_freem(m_new);
+				printf("vr%d: no memory for tx list",
+						sc->vr_unit);
+				return(1);
+			}
+		}
+		m_copydata(m_head, 0, m_head->m_pkthdr.len,	
+					mtod(m_new, caddr_t));
+		m_new->m_pkthdr.len = m_new->m_len = m_head->m_pkthdr.len;
+		m_freem(m_head);
+		m_head = m_new;
+		/*
+		 * The Rhine chip doesn't auto-pad, so we have to make
+		 * sure to pad short frames out to the minimum frame length
+		 * ourselves.
+		 */
+		if (m_head->m_len < VR_MIN_FRAMELEN) {
+			m_new->m_pkthdr.len += VR_MIN_FRAMELEN - m_new->m_len;
+			m_new->m_len = m_new->m_pkthdr.len;
+		}
+		f = c->vr_ptr;
+		f->vr_data = vtophys(mtod(m_new, caddr_t));
+		f->vr_ctl = total_len = m_new->m_len;
+		f->vr_ctl |= VR_TXCTL_TLINK|VR_TXCTL_FIRSTFRAG;
+		f->vr_status = 0;
+		frag = 1;
+	}
+
+	c->vr_mbuf = m_head;
+	c->vr_ptr->vr_ctl |= VR_TXCTL_LASTFRAG;
+	c->vr_ptr->vr_next = vtophys(c->vr_nextdesc->vr_ptr);
+
+	return(0);
+}
+
+/*
+ * Main transmit routine. To avoid having to do mbuf copies, we put pointers
+ * to the mbuf data regions directly in the transmit lists. We also save a
+ * copy of the pointers since the transmit list fragment pointers are
+ * physical addresses.
+ */
+
+static void vr_start(ifp)
+	struct ifnet		*ifp;
+{
+	struct vr_softc		*sc;
+	struct mbuf		*m_head = NULL;
+	struct vr_chain		*cur_tx = NULL, *start_tx;
+
+	sc = ifp->if_softc;
+
+	if (sc->vr_autoneg) {
+		sc->vr_tx_pend = 1;
+		return;
+	}
+
+	/*
+	 * Check for an available queue slot. If there are none,
+	 * punt.
+	 */
+	if (sc->vr_cdata.vr_tx_free->vr_mbuf != NULL) {
+		ifp->if_flags |= IFF_OACTIVE;
+		return;
+	}
+
+	start_tx = sc->vr_cdata.vr_tx_free;
+
+	while(sc->vr_cdata.vr_tx_free->vr_mbuf == NULL) {
+		IF_DEQUEUE(&ifp->if_snd, m_head);
+		if (m_head == NULL)
+			break;
+
+		/* Pick a descriptor off the free list. */
+		cur_tx = sc->vr_cdata.vr_tx_free;
+		sc->vr_cdata.vr_tx_free = cur_tx->vr_nextdesc;
+
+		/* Pack the data into the descriptor. */
+		vr_encap(sc, cur_tx, m_head);
+
+		if (cur_tx != start_tx)
+			VR_TXOWN(cur_tx) = VR_TXSTAT_OWN;
+
+#if NBPFILTER > 0
+		/*
+		 * If there's a BPF listener, bounce a copy of this frame
+		 * to him.
+		 */
+		if (ifp->if_bpf)
+			bpf_mtap(ifp, cur_tx->vr_mbuf);
+#endif
+	}
+
+	/*
+	 * Place the request for the upload interrupt
+	 * in the last descriptor in the chain. This way, if
+	 * we're chaining several packets at once, we'll only
+	 * get an interupt once for the whole chain rather than
+	 * once for each packet.
+	 */
+	cur_tx->vr_ptr->vr_ctl |= VR_TXCTL_FINT;
+	sc->vr_cdata.vr_tx_tail = cur_tx;
+
+	if (sc->vr_cdata.vr_tx_head == NULL) {
+		sc->vr_cdata.vr_tx_head = start_tx;
+		VR_TXOWN(start_tx) = VR_TXSTAT_OWN;
+		VR_SETBIT16(sc, VR_COMMAND, VR_CMD_TX_ON|VR_CMD_TX_GO);
+	} else {
+		VR_TXOWN(start_tx) = VR_UNSENT;
+	}
+
+	/*
+	 * Set a timeout in case the chip goes out to lunch.
+	 */
+	ifp->if_timer = 5;
+
+	return;
+}
+
+static void vr_init(xsc)
+	void			*xsc;
+{
+	struct vr_softc		*sc = xsc;
+	struct ifnet		*ifp = &sc->arpcom.ac_if;
+	u_int16_t		phy_bmcr = 0;
+	int			s;
+
+	if (sc->vr_autoneg)
+		return;
+
+	s = splimp();
+
+	if (sc->vr_pinfo != NULL)
+		phy_bmcr = vr_phy_readreg(sc, PHY_BMCR);
+
+	/*
+	 * Cancel pending I/O and free all RX/TX buffers.
+	 */
+	vr_stop(sc);
+	vr_reset(sc);
+
+	VR_CLRBIT(sc, VR_RXCFG, VR_RXCFG_RX_THRESH);
+	VR_SETBIT(sc, VR_RXCFG, VR_RXTHRESH_STORENFWD);
+
+	VR_CLRBIT(sc, VR_TXCFG, VR_TXCFG_TX_THRESH);
+	VR_SETBIT(sc, VR_TXCFG, VR_TXTHRESH_STORENFWD);
+
+	/* Init circular RX list. */
+	if (vr_list_rx_init(sc) == ENOBUFS) {
+		printf("vr%d: initialization failed: no "
+			"memory for rx buffers\n", sc->vr_unit);
+		vr_stop(sc);
+		(void)splx(s);
+		return;
+	}
+
+	/*
+	 * Init tx descriptors.
+	 */
+	vr_list_tx_init(sc);
+
+	/* If we want promiscuous mode, set the allframes bit. */
+	if (ifp->if_flags & IFF_PROMISC)
+		VR_SETBIT(sc, VR_RXCFG, VR_RXCFG_RX_PROMISC);
+	else
+		VR_CLRBIT(sc, VR_RXCFG, VR_RXCFG_RX_PROMISC);
+
+	/* Set capture broadcast bit to capture broadcast frames. */
+	if (ifp->if_flags & IFF_BROADCAST)
+		VR_SETBIT(sc, VR_RXCFG, VR_RXCFG_RX_BROAD);
+	else
+		VR_CLRBIT(sc, VR_RXCFG, VR_RXCFG_RX_BROAD);
+
+	/*
+	 * Program the multicast filter, if necessary.
+	 */
+	vr_setmulti(sc);
+
+	/*
+	 * Load the address of the RX list.
+	 */
+	CSR_WRITE_4(sc, VR_RXADDR, vtophys(sc->vr_cdata.vr_rx_head->vr_ptr));
+
+	/* Enable receiver and transmitter. */
+	CSR_WRITE_2(sc, VR_COMMAND, VR_CMD_TX_NOPOLL|VR_CMD_START|
+				    VR_CMD_TX_ON|VR_CMD_RX_ON|
+				    VR_CMD_RX_GO);
+
+	vr_setcfg(sc, vr_phy_readreg(sc, PHY_BMCR));
+
+	CSR_WRITE_4(sc, VR_TXADDR, vtophys(&sc->vr_ldata->vr_tx_list[0]));
+
+	/*
+	 * Enable interrupts.
+	 */
+	CSR_WRITE_2(sc, VR_ISR, 0xFFFF);
+	CSR_WRITE_2(sc, VR_IMR, VR_INTRS);
+
+	/* Restore state of BMCR */
+	if (sc->vr_pinfo != NULL)
+		vr_phy_writereg(sc, PHY_BMCR, phy_bmcr);
+
+	ifp->if_flags |= IFF_RUNNING;
+	ifp->if_flags &= ~IFF_OACTIVE;
+
+	(void)splx(s);
+
+	return;
+}
+
+/*
+ * Set media options.
+ */
+static int vr_ifmedia_upd(ifp)
+	struct ifnet		*ifp;
+{
+	struct vr_softc		*sc;
+	struct ifmedia		*ifm;
+
+	sc = ifp->if_softc;
+	ifm = &sc->ifmedia;
+
+	if (IFM_TYPE(ifm->ifm_media) != IFM_ETHER)
+		return(EINVAL);
+
+	if (IFM_SUBTYPE(ifm->ifm_media) == IFM_AUTO)
+		vr_autoneg_mii(sc, VR_FLAG_SCHEDDELAY, 1);
+	else
+		vr_setmode_mii(sc, ifm->ifm_media);
+
+	return(0);
+}
+
+/*
+ * Report current media status.
+ */
+static void vr_ifmedia_sts(ifp, ifmr)
+	struct ifnet		*ifp;
+	struct ifmediareq	*ifmr;
+{
+	struct vr_softc		*sc;
+	u_int16_t		advert = 0, ability = 0;
+
+	sc = ifp->if_softc;
+
+	ifmr->ifm_active = IFM_ETHER;
+
+	if (!(vr_phy_readreg(sc, PHY_BMCR) & PHY_BMCR_AUTONEGENBL)) {
+		if (vr_phy_readreg(sc, PHY_BMCR) & PHY_BMCR_SPEEDSEL)
+			ifmr->ifm_active = IFM_ETHER|IFM_100_TX;
+		else
+			ifmr->ifm_active = IFM_ETHER|IFM_10_T;
+		if (vr_phy_readreg(sc, PHY_BMCR) & PHY_BMCR_DUPLEX)
+			ifmr->ifm_active |= IFM_FDX;
+		else
+			ifmr->ifm_active |= IFM_HDX;
+		return;
+	}
+
+	ability = vr_phy_readreg(sc, PHY_LPAR);
+	advert = vr_phy_readreg(sc, PHY_ANAR);
+	if (advert & PHY_ANAR_100BT4 &&
+		ability & PHY_ANAR_100BT4) {
+		ifmr->ifm_active = IFM_ETHER|IFM_100_T4;
+	} else if (advert & PHY_ANAR_100BTXFULL &&
+		ability & PHY_ANAR_100BTXFULL) {
+		ifmr->ifm_active = IFM_ETHER|IFM_100_TX|IFM_FDX;
+	} else if (advert & PHY_ANAR_100BTXHALF &&
+		ability & PHY_ANAR_100BTXHALF) {
+		ifmr->ifm_active = IFM_ETHER|IFM_100_TX|IFM_HDX;
+	} else if (advert & PHY_ANAR_10BTFULL &&
+		ability & PHY_ANAR_10BTFULL) {
+		ifmr->ifm_active = IFM_ETHER|IFM_10_T|IFM_FDX;
+	} else if (advert & PHY_ANAR_10BTHALF &&
+		ability & PHY_ANAR_10BTHALF) {
+		ifmr->ifm_active = IFM_ETHER|IFM_10_T|IFM_HDX;
+	}
+
+	return;
+}
+
+static int vr_ioctl(ifp, command, data)
+	struct ifnet		*ifp;
+	u_long			command;
+	caddr_t			data;
+{
+	struct vr_softc		*sc = ifp->if_softc;
+	struct ifreq		*ifr = (struct ifreq *) data;
+	int			s, error = 0;
+
+	s = splimp();
+
+	switch(command) {
+	case SIOCSIFADDR:
+	case SIOCGIFADDR:
+	case SIOCSIFMTU:
+		error = ether_ioctl(ifp, command, data);
+		break;
+	case SIOCSIFFLAGS:
+		if (ifp->if_flags & IFF_UP) {
+			vr_init(sc);
+		} else {
+			if (ifp->if_flags & IFF_RUNNING)
+				vr_stop(sc);
+		}
+		error = 0;
+		break;
+	case SIOCADDMULTI:
+	case SIOCDELMULTI:
+		vr_setmulti(sc);
+		error = 0;
+		break;
+	case SIOCGIFMEDIA:
+	case SIOCSIFMEDIA:
+		error = ifmedia_ioctl(ifp, ifr, &sc->ifmedia, command);
+		break;
+	default:
+		error = EINVAL;
+		break;
+	}
+
+	(void)splx(s);
+
+	return(error);
+}
+
+static void vr_watchdog(ifp)
+	struct ifnet		*ifp;
+{
+	struct vr_softc		*sc;
+
+	sc = ifp->if_softc;
+
+	if (sc->vr_autoneg) {
+		vr_autoneg_mii(sc, VR_FLAG_DELAYTIMEO, 1);
+		return;
+	}
+
+	ifp->if_oerrors++;
+	printf("vr%d: watchdog timeout\n", sc->vr_unit);
+
+	if (!(vr_phy_readreg(sc, PHY_BMSR) & PHY_BMSR_LINKSTAT))
+		printf("vr%d: no carrier - transceiver cable problem?\n",
+								sc->vr_unit);
+
+	vr_stop(sc);
+	vr_reset(sc);
+	vr_init(sc);
+
+	if (ifp->if_snd.ifq_head != NULL)
+		vr_start(ifp);
+
+	return;
+}
+
+/*
+ * Stop the adapter and free any mbufs allocated to the
+ * RX and TX lists.
+ */
+static void vr_stop(sc)
+	struct vr_softc		*sc;
+{
+	register int		i;
+	struct ifnet		*ifp;
+
+	ifp = &sc->arpcom.ac_if;
+	ifp->if_timer = 0;
+
+	VR_SETBIT16(sc, VR_COMMAND, VR_CMD_STOP);
+	VR_CLRBIT16(sc, VR_COMMAND, (VR_CMD_RX_ON|VR_CMD_TX_ON));
+	CSR_WRITE_2(sc, VR_IMR, 0x0000);
+	CSR_WRITE_4(sc, VR_TXADDR, 0x00000000);
+	CSR_WRITE_4(sc, VR_RXADDR, 0x00000000);
+
+	/*
+	 * Free data in the RX lists.
+	 */
+	for (i = 0; i < VR_RX_LIST_CNT; i++) {
+		if (sc->vr_cdata.vr_rx_chain[i].vr_mbuf != NULL) {
+			m_freem(sc->vr_cdata.vr_rx_chain[i].vr_mbuf);
+			sc->vr_cdata.vr_rx_chain[i].vr_mbuf = NULL;
+		}
+	}
+	bzero((char *)&sc->vr_ldata->vr_rx_list,
+		sizeof(sc->vr_ldata->vr_rx_list));
+
+	/*
+	 * Free the TX list buffers.
+	 */
+	for (i = 0; i < VR_TX_LIST_CNT; i++) {
+		if (sc->vr_cdata.vr_tx_chain[i].vr_mbuf != NULL) {
+			m_freem(sc->vr_cdata.vr_tx_chain[i].vr_mbuf);
+			sc->vr_cdata.vr_tx_chain[i].vr_mbuf = NULL;
+		}
+	}
+
+	bzero((char *)&sc->vr_ldata->vr_tx_list,
+		sizeof(sc->vr_ldata->vr_tx_list));
+
+	ifp->if_flags &= ~(IFF_RUNNING | IFF_OACTIVE);
+
+	return;
+}
+
+/*
+ * Stop all chip I/O so that the kernel's probe routines don't
+ * get confused by errant DMAs when rebooting.
+ */
+static void vr_shutdown(howto, arg)
+	int			howto;
+	void			*arg;
+{
+	struct vr_softc		*sc = (struct vr_softc *)arg;
+
+	vr_stop(sc);
+
+	return;
+}
+
+static struct pci_device vr_device = {
+	"vr",
+	vr_probe,
+	vr_attach,
+	&vr_count,
+	NULL
+};
+DATA_SET(pcidevice_set, vr_device);
diff --git a/sys/dev/vr/if_vrreg.h b/sys/dev/vr/if_vrreg.h
new file mode 100644
index 0000000..42f3a13
--- /dev/null
+++ b/sys/dev/vr/if_vrreg.h
@@ -0,0 +1,615 @@
+/*
+ * Copyright (c) 1997, 1998
+ *	Bill Paul <wpaul@ctr.columbia.edu>.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ * 3. All advertising materials mentioning features or use of this software
+ *    must display the following acknowledgement:
+ *	This product includes software developed by Bill Paul.
+ * 4. Neither the name of the author nor the names of any co-contributors
+ *    may be used to endorse or promote products derived from this software
+ *    without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY Bill Paul AND CONTRIBUTORS ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL Bill Paul OR THE VOICES IN HIS HEAD
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ *
+ *	$Id: if_vrreg.h,v 1.8 1998/12/01 22:08:11 wpaul Exp $
+ */
+
+/*
+ * Rhine register definitions.
+ */
+
+#define VR_PAR0			0x00	/* node address 0 to 4 */
+#define VR_PAR1			0x04	/* node address 2 to 6 */
+#define VR_RXCFG		0x06	/* receiver config register */
+#define VR_TXCFG		0x07	/* transmit config register */
+#define VR_COMMAND		0x08	/* command register */
+#define VR_ISR			0x0C	/* interrupt/status register */
+#define VR_IMR			0x0E	/* interrupt mask register */
+#define VR_MAR0			0x10	/* multicast hash 0 */
+#define VR_MAR1			0x14	/* multicast hash 1 */
+#define VR_RXADDR		0x18	/* rx descriptor list start addr */
+#define VR_TXADDR		0x1C	/* tx descriptor list start addr */
+#define VR_CURRXDESC0		0x20
+#define VR_CURRXDESC1		0x24
+#define VR_CURRXDESC2		0x28
+#define VR_CURRXDESC3		0x2C
+#define VR_NEXTRXDESC0		0x30
+#define VR_NEXTRXDESC1		0x34
+#define VR_NEXTRXDESC2		0x38
+#define VR_NEXTRXDESC3		0x3C
+#define VR_CURTXDESC0		0x40
+#define VR_CURTXDESC1		0x44
+#define VR_CURTXDESC2		0x48
+#define VR_CURTXDESC3		0x4C
+#define VR_NEXTTXDESC0		0x50
+#define VR_NEXTTXDESC1		0x54
+#define VR_NEXTTXDESC2		0x58
+#define VR_NEXTTXDESC3		0x5C
+#define VR_CURRXDMA		0x60	/* current RX DMA address */
+#define VR_CURTXDMA		0x64	/* current TX DMA address */
+#define VR_TALLYCNT		0x68	/* tally counter test register */
+#define VR_PHYADDR		0x6C
+#define VR_MIISTAT		0x6D
+#define VR_BCR0			0x6E
+#define VR_BCR1			0x6F
+#define VR_MIICMD		0x70
+#define VR_MIIADDR		0x71
+#define VR_MIIDATA		0x72
+#define VR_EECSR		0x74
+#define VR_TEST			0x75
+#define VR_GPIO			0x76
+#define VR_CONFIG		0x78
+#define VR_MPA_CNT		0x7C
+#define VR_CRC_CNT		0x7E
+
+/*
+ * RX config bits.
+ */
+#define VR_RXCFG_RX_ERRPKTS	0x01
+#define VR_RXCFG_RX_RUNT	0x02
+#define VR_RXCFG_RX_MULTI	0x04
+#define VR_RXCFG_RX_BROAD	0x08
+#define VR_RXCFG_RX_PROMISC	0x10
+#define VR_RXCFG_RX_THRESH	0xE0
+
+#define VR_RXTHRESH_32BYTES	0x00
+#define VR_RXTHRESH_64BYTES	0x20
+#define VR_RXTHRESH_128BYTES	0x40
+#define VR_RXTHRESH_256BYTES	0x60
+#define VR_RXTHRESH_512BYTES	0x80
+#define VR_RXTHRESH_768BYTES	0xA0
+#define VR_RXTHRESH_1024BYTES	0xC0
+#define VR_RXTHRESH_STORENFWD	0xE0
+
+/*
+ * TX config bits.
+ */
+#define VR_TXCFG_RSVD0		0x01
+#define VR_TXCFG_LOOPBKMODE	0x06
+#define VR_TXCFG_BACKOFF	0x08
+#define VR_TXCFG_RSVD1		0x10
+#define VR_TXCFG_TX_THRESH	0xE0
+
+#define VR_TXTHRESH_32BYTES	0x00
+#define VR_TXTHRESH_64BYTES	0x20
+#define VR_TXTHRESH_128BYTES	0x40
+#define VR_TXTHRESH_256BYTES	0x60
+#define VR_TXTHRESH_512BYTES	0x80
+#define VR_TXTHRESH_768BYTES	0xA0
+#define VR_TXTHRESH_1024BYTES	0xC0
+#define VR_TXTHRESH_STORENFWD	0xE0
+
+/*
+ * Command register bits.
+ */
+#define VR_CMD_INIT		0x0001
+#define VR_CMD_START		0x0002
+#define VR_CMD_STOP		0x0004
+#define VR_CMD_RX_ON		0x0008
+#define VR_CMD_TX_ON		0x0010
+#define	VR_CMD_TX_GO		0x0020
+#define VR_CMD_RX_GO		0x0040
+#define VR_CMD_RSVD		0x0080
+#define VR_CMD_RX_EARLY		0x0100
+#define VR_CMD_TX_EARLY		0x0200
+#define VR_CMD_FULLDUPLEX	0x0400
+#define VR_CMD_TX_NOPOLL	0x0800
+
+#define VR_CMD_RESET		0x8000
+
+/*
+ * Interrupt status bits.
+ */
+#define VR_ISR_RX_OK		0x0001	/* packet rx ok */
+#define VR_ISR_TX_OK		0x0002	/* packet tx ok */
+#define VR_ISR_RX_ERR		0x0004	/* packet rx with err */
+#define VR_ISR_TX_ABRT		0x0008	/* tx aborted due to excess colls */
+#define VR_ISR_TX_UNDERRUN	0x0010	/* tx buffer underflow */
+#define VR_ISR_RX_NOBUF		0x0020	/* no rx buffer available */
+#define VR_ISR_BUSERR		0x0040	/* PCI bus error */
+#define VR_ISR_STATSOFLOW	0x0080	/* stats counter oflow */
+#define VR_ISR_RX_EARLY		0x0100	/* rx early */
+#define VR_ISR_LINKSTAT		0x0200	/* MII status change */
+#define VR_ISR_RX_OFLOW		0x0400	/* rx FIFO overflow */
+#define VR_ISR_RX_DROPPED	0x0800
+#define VR_ISR_RX_NOBUF2	0x1000
+#define VR_ISR_TX_ABRT2		0x2000
+#define VR_ISR_LINKSTAT2	0x4000
+#define VR_ISR_MAGICPACKET	0x8000
+
+/*
+ * Interrupt mask bits.
+ */
+#define VR_IMR_RX_OK		0x0001	/* packet rx ok */
+#define VR_IMR_TX_OK		0x0002	/* packet tx ok */
+#define VR_IMR_RX_ERR		0x0004	/* packet rx with err */
+#define VR_IMR_TX_ABRT		0x0008	/* tx aborted due to excess colls */
+#define VR_IMR_TX_UNDERRUN	0x0010	/* tx buffer underflow */
+#define VR_IMR_RX_NOBUF		0x0020	/* no rx buffer available */
+#define VR_IMR_BUSERR		0x0040	/* PCI bus error */
+#define VR_IMR_STATSOFLOW	0x0080	/* stats counter oflow */
+#define VR_IMR_RX_EARLY		0x0100	/* rx early */
+#define VR_IMR_LINKSTAT		0x0200	/* MII status change */
+#define VR_IMR_RX_OFLOW		0x0400	/* rx FIFO overflow */
+#define VR_IMR_RX_DROPPED	0x0800
+#define VR_IMR_RX_NOBUF2	0x1000
+#define VR_IMR_TX_ABRT2		0x2000
+#define VR_IMR_LINKSTAT2	0x4000
+#define VR_IMR_MAGICPACKET	0x8000
+
+#define VR_INTRS							\
+	(VR_IMR_RX_OK|VR_IMR_TX_OK|VR_IMR_RX_NOBUF|			\
+	VR_IMR_TX_ABRT|VR_IMR_TX_UNDERRUN|VR_IMR_BUSERR|		\
+	VR_IMR_RX_ERR|VR_ISR_RX_DROPPED)
+
+/*
+ * MII status register.
+ */
+
+#define VR_MIISTAT_SPEED	0x01
+#define VR_MIISTAT_LINKFAULT	0x02
+#define VR_MIISTAT_MGTREADERR	0x04
+#define VR_MIISTAT_MIIERR	0x08
+#define VR_MIISTAT_PHYOPT	0x10
+#define VR_MIISTAT_MDC_SPEED	0x20
+#define VR_MIISTAT_RSVD		0x40
+#define VR_MIISTAT_GPIO1POLL	0x80
+
+/*
+ * MII command register bits.
+ */
+#define VR_MIICMD_CLK		0x01
+#define VR_MIICMD_DATAOUT	0x02
+#define VR_MIICMD_DATAIN	0x04
+#define VR_MIICMD_DIR		0x08
+#define VR_MIICMD_DIRECTPGM	0x10
+#define VR_MIICMD_WRITE_ENB	0x20
+#define VR_MIICMD_READ_ENB	0x40
+#define VR_MIICMD_AUTOPOLL	0x80
+
+/*
+ * EEPROM control bits.
+ */
+#define VR_EECSR_DATAIN		0x01	/* data out */
+#define VR_EECSR_DATAOUT	0x02	/* data in */
+#define VR_EECSR_CLK		0x04	/* clock */
+#define VR_EECSR_CS		0x08	/* chip select */
+#define VR_EECSR_DPM		0x10
+#define VR_EECSR_LOAD		0x20
+#define VR_EECSR_EMBP		0x40
+#define VR_EECSR_EEPR		0x80
+
+#define VR_EECMD_WRITE		0x140
+#define VR_EECMD_READ		0x180
+#define VR_EECMD_ERASE		0x1c0
+
+/*
+ * Test register bits.
+ */
+#define VR_TEST_TEST0		0x01
+#define VR_TEST_TEST1		0x02
+#define VR_TEST_TEST2		0x04
+#define VR_TEST_TSTUD		0x08
+#define VR_TEST_TSTOV		0x10
+#define VR_TEST_BKOFF		0x20
+#define VR_TEST_FCOL		0x40
+#define VR_TEST_HBDES		0x80
+
+/*
+ * Config register bits.
+ */
+#define VR_CFG_GPIO2OUTENB	0x00000001
+#define VR_CFG_GPIO2OUT		0x00000002	/* gen. purp. pin */
+#define VR_CFG_GPIO2IN		0x00000004	/* gen. purp. pin */
+#define VR_CFG_AUTOOPT		0x00000008	/* enable rx/tx autopoll */
+#define VR_CFG_MIIOPT		0x00000010
+#define VR_CFG_MMIENB		0x00000020	/* memory mapped mode enb */
+#define VR_CFG_JUMPER		0x00000040	/* PHY and oper. mode select */
+#define VR_CFG_EELOAD		0x00000080	/* enable EEPROM programming */
+#define VR_CFG_LATMENB		0x00000100	/* larency timer effect enb. */
+#define VR_CFG_MRREADWAIT	0x00000200
+#define VR_CFG_MRWRITEWAIT	0x00000400
+#define VR_CFG_RX_ARB		0x00000800
+#define VR_CFG_TX_ARB		0x00001000
+#define VR_CFG_READMULTI	0x00002000
+#define VR_CFG_TX_PACE		0x00004000
+#define VR_CFG_TX_QDIS		0x00008000
+#define VR_CFG_ROMSEL0		0x00010000
+#define VR_CFG_ROMSEL1		0x00020000
+#define VR_CFG_ROMSEL2		0x00040000
+#define VR_CFG_ROMTIMESEL	0x00080000
+#define VR_CFG_RSVD0		0x00100000
+#define VR_CFG_ROMDLY		0x00200000
+#define VR_CFG_ROMOPT		0x00400000
+#define VR_CFG_RSVD1		0x00800000
+#define VR_CFG_BACKOFFOPT	0x01000000
+#define VR_CFG_BACKOFFMOD	0x02000000
+#define VR_CFG_CAPEFFECT	0x04000000
+#define VR_CFG_BACKOFFRAND	0x08000000
+#define VR_CFG_MAGICKPACKET	0x10000000
+#define VR_CFG_PCIREADLINE	0x20000000
+#define VR_CFG_DIAG		0x40000000
+#define VR_CFG_GPIOEN		0x80000000
+
+/*
+ * Rhine TX/RX list structure.
+ */
+
+struct vr_desc {
+	u_int32_t		vr_status;
+	u_int32_t		vr_ctl;
+	u_int32_t		vr_ptr1;
+	u_int32_t		vr_ptr2;
+};
+
+#define vr_data		vr_ptr1
+#define vr_next		vr_ptr2
+
+
+#define VR_RXSTAT_RXERR		0x00000001
+#define VR_RXSTAT_CRCERR	0x00000002
+#define VR_RXSTAT_FRAMEALIGNERR	0x00000004
+#define VR_RXSTAT_FIFOOFLOW	0x00000008
+#define VR_RXSTAT_GIANT		0x00000010
+#define VR_RXSTAT_RUNT		0x00000020
+#define VR_RXSTAT_BUSERR	0x00000040
+#define VR_RXSTAT_BUFFERR	0x00000080
+#define VR_RXSTAT_LASTFRAG	0x00000100
+#define VR_RXSTAT_FIRSTFRAG	0x00000200
+#define VR_RXSTAT_RLINK		0x00000400
+#define VR_RXSTAT_RX_PHYS	0x00000800
+#define VR_RXSTAT_RX_BROAD	0x00001000
+#define VR_RXSTAT_RX_MULTI	0x00002000
+#define VR_RXSTAT_RX_OK		0x00004000
+#define VR_RXSTAT_RXLEN		0x07FF0000
+#define VR_RXSTAT_RXLEN_EXT	0x78000000
+#define VR_RXSTAT_OWN		0x80000000
+
+#define VR_RXBYTES(x)		((x & VR_RXSTAT_RXLEN) >> 16)
+#define VR_RXSTAT (VR_RXSTAT_FIRSTFRAG|VR_RXSTAT_LASTFRAG|VR_RXSTAT_OWN)
+
+#define VR_RXCTL_BUFLEN		0x000007FF
+#define VR_RXCTL_BUFLEN_EXT	0x00007800
+#define VR_RXCTL_CHAIN		0x00008000
+#define VR_RXCTL_RX_INTR	0x00800000
+
+
+#define VR_TXSTAT_DEFER		0x00000001
+#define VR_TXSTAT_UNDERRUN	0x00000002
+#define VR_TXSTAT_COLLCNT	0x00000078
+#define VR_TXSTAT_SQE		0x00000080
+#define VR_TXSTAT_ABRT		0x00000100
+#define VR_TXSTAT_LATECOLL	0x00000200
+#define VR_TXSTAT_CARRLOST	0x00000400
+#define VR_TXSTAT_BUSERR	0x00002000
+#define VR_TXSTAT_JABTIMEO	0x00004000
+#define VR_TXSTAT_ERRSUM	0x00008000
+#define VR_TXSTAT_OWN		0x80000000
+
+#define VR_TXCTL_BUFLEN		0x000007FF
+#define VR_TXCTL_BUFLEN_EXT	0x00007800
+#define VR_TXCTL_TLINK		0x00008000
+#define VR_TXCTL_FIRSTFRAG	0x00200000
+#define VR_TXCTL_LASTFRAG	0x00400000
+#define VR_TXCTL_FINT		0x00800000
+
+
+#define VR_MAXFRAGS		16
+#define VR_RX_LIST_CNT		64
+#define VR_TX_LIST_CNT		64
+#define VR_MIN_FRAMELEN		60
+#define VR_FRAMELEN		1536
+
+#define VR_TXOWN(x)		x->vr_ptr->vr_status
+#define VR_UNSENT		0x12341234
+
+struct vr_list_data {
+	struct vr_desc		vr_rx_list[VR_RX_LIST_CNT];
+	struct vr_desc		vr_tx_list[VR_TX_LIST_CNT];
+};
+
+struct vr_chain {
+	struct vr_desc		*vr_ptr;
+	struct mbuf		*vr_mbuf;
+	struct vr_chain		*vr_nextdesc;
+};
+
+struct vr_chain_onefrag {
+	struct vr_desc		*vr_ptr;
+	struct mbuf		*vr_mbuf;
+	struct vr_chain_onefrag	*vr_nextdesc;
+};
+
+struct vr_chain_data {
+	struct vr_chain_onefrag	vr_rx_chain[VR_RX_LIST_CNT];
+	struct vr_chain		vr_tx_chain[VR_TX_LIST_CNT];
+
+	struct vr_chain_onefrag	*vr_rx_head;
+
+	struct vr_chain		*vr_tx_head;
+	struct vr_chain		*vr_tx_tail;
+	struct vr_chain		*vr_tx_free;
+};
+
+struct vr_type {
+	u_int16_t		vr_vid;
+	u_int16_t		vr_did;
+	char			*vr_name;
+};
+
+struct vr_mii_frame {
+	u_int8_t		mii_stdelim;
+	u_int8_t		mii_opcode;
+	u_int8_t		mii_phyaddr;
+	u_int8_t		mii_regaddr;
+	u_int8_t		mii_turnaround;
+	u_int16_t		mii_data;
+};
+
+/*
+ * MII constants
+ */
+#define VR_MII_STARTDELIM	0x01
+#define VR_MII_READOP		0x02
+#define VR_MII_WRITEOP		0x01
+#define VR_MII_TURNAROUND	0x02
+
+#define VR_FLAG_FORCEDELAY	1
+#define VR_FLAG_SCHEDDELAY	2
+#define VR_FLAG_DELAYTIMEO	3	
+
+struct vr_softc {
+	struct arpcom		arpcom;		/* interface info */
+	struct ifmedia		ifmedia;	/* media info */
+	bus_space_handle_t	vr_bhandle;	/* bus space handle */
+	bus_space_tag_t		vr_btag;	/* bus space tag */
+	struct vr_type		*vr_info;	/* Rhine adapter info */
+	struct vr_type		*vr_pinfo;	/* phy info */
+	u_int8_t		vr_unit;	/* interface number */
+	u_int8_t		vr_type;
+	u_int8_t		vr_phy_addr;	/* PHY address */
+	u_int8_t		vr_tx_pend;	/* TX pending */
+	u_int8_t		vr_want_auto;
+	u_int8_t		vr_autoneg;
+	caddr_t			vr_ldata_ptr;
+	struct vr_list_data	*vr_ldata;
+	struct vr_chain_data	vr_cdata;
+};
+
+/*
+ * register space access macros
+ */
+#define CSR_WRITE_4(sc, reg, val)	\
+	bus_space_write_4(sc->vr_btag, sc->vr_bhandle, reg, val)
+#define CSR_WRITE_2(sc, reg, val)	\
+	bus_space_write_2(sc->vr_btag, sc->vr_bhandle, reg, val)
+#define CSR_WRITE_1(sc, reg, val)	\
+	bus_space_write_1(sc->vr_btag, sc->vr_bhandle, reg, val)
+
+#define CSR_READ_4(sc, reg)		\
+	bus_space_read_4(sc->vr_btag, sc->vr_bhandle, reg)
+#define CSR_READ_2(sc, reg)		\
+	bus_space_read_2(sc->vr_btag, sc->vr_bhandle, reg)
+#define CSR_READ_1(sc, reg)		\
+	bus_space_read_1(sc->vr_btag, sc->vr_bhandle, reg)
+
+#define VR_TIMEOUT		1000
+
+/*
+ * General constants that are fun to know.
+ *
+ * VIA vendor ID
+ */
+#define	VIA_VENDORID		0x1106
+
+/*
+ * VIA Rhine device IDs.
+ */
+#define	VIA_DEVICEID_RHINE	0x3043
+#define VIA_DEVICEID_RHINE_II	0x6100
+
+
+/*
+ * Texas Instruments PHY identifiers
+ */
+#define TI_PHY_VENDORID		0x4000
+#define TI_PHY_10BT		0x501F
+#define TI_PHY_100VGPMI		0x502F
+
+/*
+ * These ID values are for the NS DP83840A 10/100 PHY
+ */
+#define NS_PHY_VENDORID		0x2000
+#define NS_PHY_83840A		0x5C0F
+
+/*
+ * Level 1 10/100 PHY
+ */
+#define LEVEL1_PHY_VENDORID	0x7810
+#define LEVEL1_PHY_LXT970	0x000F
+
+/*
+ * Intel 82555 10/100 PHY
+ */
+#define INTEL_PHY_VENDORID	0x0A28
+#define INTEL_PHY_82555		0x015F
+
+/*
+ * SEEQ 80220 10/100 PHY
+ */
+#define SEEQ_PHY_VENDORID	0x0016
+#define SEEQ_PHY_80220		0xF83F
+
+
+/*
+ * PCI low memory base and low I/O base register, and
+ * other PCI registers.
+ */
+
+#define VR_PCI_VENDOR_ID	0x00
+#define VR_PCI_DEVICE_ID	0x02
+#define VR_PCI_COMMAND		0x04
+#define VR_PCI_STATUS		0x06
+#define VR_PCI_CLASSCODE	0x09
+#define VR_PCI_LATENCY_TIMER	0x0D
+#define VR_PCI_HEADER_TYPE	0x0E
+#define VR_PCI_LOIO		0x10
+#define VR_PCI_LOMEM		0x14
+#define VR_PCI_BIOSROM		0x30
+#define VR_PCI_INTLINE		0x3C
+#define VR_PCI_INTPIN		0x3D
+#define VR_PCI_MINGNT		0x3E
+#define VR_PCI_MINLAT		0x0F
+#define VR_PCI_RESETOPT		0x48
+#define VR_PCI_EEPROM_DATA	0x4C
+
+/* power management registers */
+#define VR_PCI_CAPID		0xDC /* 8 bits */
+#define VR_PCI_NEXTPTR		0xDD /* 8 bits */
+#define VR_PCI_PWRMGMTCAP	0xDE /* 16 bits */
+#define VR_PCI_PWRMGMTCTRL	0xE0 /* 16 bits */
+
+#define VR_PSTATE_MASK		0x0003
+#define VR_PSTATE_D0		0x0000
+#define VR_PSTATE_D1		0x0002
+#define VR_PSTATE_D2		0x0002
+#define VR_PSTATE_D3		0x0003
+#define VR_PME_EN		0x0010
+#define VR_PME_STATUS		0x8000
+
+#define PHY_UNKNOWN		6
+
+#define VR_PHYADDR_MIN		0x00
+#define VR_PHYADDR_MAX		0x1F
+
+#define PHY_BMCR		0x00
+#define PHY_BMSR		0x01
+#define PHY_VENID		0x02
+#define PHY_DEVID		0x03
+#define PHY_ANAR		0x04
+#define PHY_LPAR		0x05
+#define PHY_ANEXP		0x06
+
+#define PHY_ANAR_NEXTPAGE	0x8000
+#define PHY_ANAR_RSVD0		0x4000
+#define PHY_ANAR_TLRFLT		0x2000
+#define PHY_ANAR_RSVD1		0x1000
+#define PHY_ANAR_RSVD2		0x0800
+#define PHY_ANAR_RSVD3		0x0400
+#define PHY_ANAR_100BT4		0x0200
+#define PHY_ANAR_100BTXFULL	0x0100
+#define PHY_ANAR_100BTXHALF	0x0080
+#define PHY_ANAR_10BTFULL	0x0040
+#define PHY_ANAR_10BTHALF	0x0020
+#define PHY_ANAR_PROTO4		0x0010
+#define PHY_ANAR_PROTO3		0x0008
+#define PHY_ANAR_PROTO2		0x0004
+#define PHY_ANAR_PROTO1		0x0002
+#define PHY_ANAR_PROTO0		0x0001
+
+/*
+ * These are the register definitions for the PHY (physical layer
+ * interface chip).
+ */
+/*
+ * PHY BMCR Basic Mode Control Register
+ */
+#define PHY_BMCR_RESET			0x8000
+#define PHY_BMCR_LOOPBK			0x4000
+#define PHY_BMCR_SPEEDSEL		0x2000
+#define PHY_BMCR_AUTONEGENBL		0x1000
+#define PHY_BMCR_RSVD0			0x0800	/* write as zero */
+#define PHY_BMCR_ISOLATE		0x0400
+#define PHY_BMCR_AUTONEGRSTR		0x0200
+#define PHY_BMCR_DUPLEX			0x0100
+#define PHY_BMCR_COLLTEST		0x0080
+#define PHY_BMCR_RSVD1			0x0040	/* write as zero, don't care */
+#define PHY_BMCR_RSVD2			0x0020	/* write as zero, don't care */
+#define PHY_BMCR_RSVD3			0x0010	/* write as zero, don't care */
+#define PHY_BMCR_RSVD4			0x0008	/* write as zero, don't care */
+#define PHY_BMCR_RSVD5			0x0004	/* write as zero, don't care */
+#define PHY_BMCR_RSVD6			0x0002	/* write as zero, don't care */
+#define PHY_BMCR_RSVD7			0x0001	/* write as zero, don't care */
+/*
+ * RESET: 1 == software reset, 0 == normal operation
+ * Resets status and control registers to default values.
+ * Relatches all hardware config values.
+ *
+ * LOOPBK: 1 == loopback operation enabled, 0 == normal operation
+ *
+ * SPEEDSEL: 1 == 100Mb/s, 0 == 10Mb/s
+ * Link speed is selected byt his bit or if auto-negotiation if bit
+ * 12 (AUTONEGENBL) is set (in which case the value of this register
+ * is ignored).
+ *
+ * AUTONEGENBL: 1 == Autonegotiation enabled, 0 == Autonegotiation disabled
+ * Bits 8 and 13 are ignored when autoneg is set, otherwise bits 8 and 13
+ * determine speed and mode. Should be cleared and then set if PHY configured
+ * for no autoneg on startup.
+ *
+ * ISOLATE: 1 == isolate PHY from MII, 0 == normal operation
+ *
+ * AUTONEGRSTR: 1 == restart autonegotiation, 0 = normal operation
+ *
+ * DUPLEX: 1 == full duplex mode, 0 == half duplex mode
+ *
+ * COLLTEST: 1 == collision test enabled, 0 == normal operation
+ */
+
+/* 
+ * PHY, BMSR Basic Mode Status Register 
+ */   
+#define PHY_BMSR_100BT4			0x8000
+#define PHY_BMSR_100BTXFULL		0x4000
+#define PHY_BMSR_100BTXHALF		0x2000
+#define PHY_BMSR_10BTFULL		0x1000
+#define PHY_BMSR_10BTHALF		0x0800
+#define PHY_BMSR_RSVD1			0x0400	/* write as zero, don't care */
+#define PHY_BMSR_RSVD2			0x0200	/* write as zero, don't care */
+#define PHY_BMSR_RSVD3			0x0100	/* write as zero, don't care */
+#define PHY_BMSR_RSVD4			0x0080	/* write as zero, don't care */
+#define PHY_BMSR_MFPRESUP		0x0040
+#define PHY_BMSR_AUTONEGCOMP		0x0020
+#define PHY_BMSR_REMFAULT		0x0010
+#define PHY_BMSR_CANAUTONEG		0x0008
+#define PHY_BMSR_LINKSTAT		0x0004
+#define PHY_BMSR_JABBER			0x0002
+#define PHY_BMSR_EXTENDED		0x0001
diff --git a/sys/i386/conf/GENERIC b/sys/i386/conf/GENERIC
index f2c58b6..7c18050 100644
--- a/sys/i386/conf/GENERIC
+++ b/sys/i386/conf/GENERIC
@@ -11,7 +11,7 @@
 # device lines is present in the ./LINT configuration file. If you are 
 # in doubt as to the purpose or necessity of a line, check first in LINT.
 #
-#	$Id: GENERIC,v 1.131 1998/11/12 11:29:28 obrien Exp $
+#	$Id: GENERIC,v 1.132 1998/11/26 23:13:11 n_hibma Exp $
 
 machine		"i386"
 cpu		"I386_CPU"
@@ -140,10 +140,14 @@ device		psm0	at isa? port IO_KBD conflicts tty irq 12
 # revision 1.20 of this file.
 device de0
 device fxp0
+device mx0
+device pn0
 device rl0
 device tl0
 device tx0
+device vr0
 device vx0
+device wb0
 device xl0
 
 device ed0 at isa? port 0x280 net irq 10 iomem 0xd8000
diff --git a/sys/i386/conf/LINT b/sys/i386/conf/LINT
index f8a6a7d..5d9da98 100644
--- a/sys/i386/conf/LINT
+++ b/sys/i386/conf/LINT
@@ -2,7 +2,7 @@
 # LINT -- config file for checking all the sources, tries to pull in
 #	as much of the source tree as it can.
 #
-#	$Id: LINT,v 1.505 1998/11/23 09:59:02 phk Exp $
+#	$Id: LINT,v 1.506 1998/12/03 20:06:00 dillon Exp $
 #
 # NB: You probably don't want to try running a kernel built from this
 # file.  Instead, you should start from GENERIC, and add options from
@@ -1435,10 +1435,21 @@ options	"EISA_SLOTS=12"
 # The `fxp' device provides support for the Intel EtherExpress Pro/100B
 # PCI Fast Ethernet adapters.
 #
+# The `mx' device provides support for various fast ethernet adapters
+# based on the Macronix 98713, 987615 ans 98725 series chips.
+#
+# The `pn' device provides support for various fast ethernet adapters
+# based on the Lite-On 82c168 and 82c169 PNIC chips, including the
+# LinkSys LNE100TX, the NetGear FA310TX rev. D1 and the Matrox
+# FastNIC 10/100.
+#
 # The 'rl' device provides support for PCI fast ethernet adapters based
 # on the RealTek 8129/8139 chipset. Note that the RealTek driver defaults
 # to useing programmed I/O to do register accesses because memory mapped
-# mode seems to cause severe lockups on SMP hardware.
+# mode seems to cause severe lockups on SMP hardware. This driver also
+# supports the Accton EN1207D `Cheetah' adapter, which uses a chip called
+# the MPX 5030/5038, which is either a RealTek in disguise or a RealTek
+# workalike.
 #
 # The 'tl' device provides support for the Texas Instruments TNETE100
 # series 'ThunderLAN' cards and integrated ethernet controllers. This
@@ -1449,10 +1460,18 @@ options	"EISA_SLOTS=12"
 #
 # The `tx' device provides support for the SMC 9432TX cards.
 #
+# The `vr' device provides support for various fast ethernet adapters
+# based on the VIA Technologies VT3043 `Rhine I' and VT86C100A `Rhine II'
+# chips, including the D-Link DFE530TX.
+#
 # The `vx' device provides support for the 3Com 3C590 and 3C595
 # early support
 #
-# The `xl' driver provides support for the 3Com 3c900, 3c905 and
+# The `wb' device provides support for various fast ethernet adapters
+# based on the Winbond W89C840F chip. Note: this is not the same as
+# the Winbond W89C940F, which is an NE2000 clone.
+#
+# The `xl' device provides support for the 3Com 3c900, 3c905 and
 # 3c905B (Fast) Etherlink XL cards and integrated controllers. This
 # includes the integrated 3c905B-TX chips in certain Dell Optiplex and
 # Dell Precision desktop machines and the integrated 3c905-TX chips
@@ -1499,10 +1518,14 @@ controller	ncr0
 controller	isp0
 device		de0
 device		fxp0
+device		mx0
+device		pn0
 device		rl0
 device		tl0
 device		tx0
+device		vr0
 device		vx0
+device		wb0
 device		xl0
 device		fpa0
 device		meteor0
diff --git a/sys/i386/conf/NOTES b/sys/i386/conf/NOTES
index f8a6a7d..5d9da98 100644
--- a/sys/i386/conf/NOTES
+++ b/sys/i386/conf/NOTES
@@ -2,7 +2,7 @@
 # LINT -- config file for checking all the sources, tries to pull in
 #	as much of the source tree as it can.
 #
-#	$Id: LINT,v 1.505 1998/11/23 09:59:02 phk Exp $
+#	$Id: LINT,v 1.506 1998/12/03 20:06:00 dillon Exp $
 #
 # NB: You probably don't want to try running a kernel built from this
 # file.  Instead, you should start from GENERIC, and add options from
@@ -1435,10 +1435,21 @@ options	"EISA_SLOTS=12"
 # The `fxp' device provides support for the Intel EtherExpress Pro/100B
 # PCI Fast Ethernet adapters.
 #
+# The `mx' device provides support for various fast ethernet adapters
+# based on the Macronix 98713, 987615 ans 98725 series chips.
+#
+# The `pn' device provides support for various fast ethernet adapters
+# based on the Lite-On 82c168 and 82c169 PNIC chips, including the
+# LinkSys LNE100TX, the NetGear FA310TX rev. D1 and the Matrox
+# FastNIC 10/100.
+#
 # The 'rl' device provides support for PCI fast ethernet adapters based
 # on the RealTek 8129/8139 chipset. Note that the RealTek driver defaults
 # to useing programmed I/O to do register accesses because memory mapped
-# mode seems to cause severe lockups on SMP hardware.
+# mode seems to cause severe lockups on SMP hardware. This driver also
+# supports the Accton EN1207D `Cheetah' adapter, which uses a chip called
+# the MPX 5030/5038, which is either a RealTek in disguise or a RealTek
+# workalike.
 #
 # The 'tl' device provides support for the Texas Instruments TNETE100
 # series 'ThunderLAN' cards and integrated ethernet controllers. This
@@ -1449,10 +1460,18 @@ options	"EISA_SLOTS=12"
 #
 # The `tx' device provides support for the SMC 9432TX cards.
 #
+# The `vr' device provides support for various fast ethernet adapters
+# based on the VIA Technologies VT3043 `Rhine I' and VT86C100A `Rhine II'
+# chips, including the D-Link DFE530TX.
+#
 # The `vx' device provides support for the 3Com 3C590 and 3C595
 # early support
 #
-# The `xl' driver provides support for the 3Com 3c900, 3c905 and
+# The `wb' device provides support for various fast ethernet adapters
+# based on the Winbond W89C840F chip. Note: this is not the same as
+# the Winbond W89C940F, which is an NE2000 clone.
+#
+# The `xl' device provides support for the 3Com 3c900, 3c905 and
 # 3c905B (Fast) Etherlink XL cards and integrated controllers. This
 # includes the integrated 3c905B-TX chips in certain Dell Optiplex and
 # Dell Precision desktop machines and the integrated 3c905-TX chips
@@ -1499,10 +1518,14 @@ controller	ncr0
 controller	isp0
 device		de0
 device		fxp0
+device		mx0
+device		pn0
 device		rl0
 device		tl0
 device		tx0
+device		vr0
 device		vx0
+device		wb0
 device		xl0
 device		fpa0
 device		meteor0
diff --git a/sys/i386/conf/SMP-GENERIC b/sys/i386/conf/SMP-GENERIC
index 107cd83..6f2045a 100644
--- a/sys/i386/conf/SMP-GENERIC
+++ b/sys/i386/conf/SMP-GENERIC
@@ -11,7 +11,7 @@
 # device lines is present in the ./LINT configuration file. If you are 
 # in doubt as to the purpose or necessity of a line, check first in LINT.
 #
-#	$Id: SMP-GENERIC,v 1.21 1998/11/03 21:12:20 des Exp $
+#	$Id: SMP-GENERIC,v 1.22 1998/11/03 22:01:22 des Exp $
 
 machine		"i386"
 # SMP does NOT support 386/486 CPUs.
@@ -161,10 +161,14 @@ device		psm0	at isa? port IO_KBD conflicts tty irq 12
 # revision 1.20 of this file.
 device de0
 device fxp0
+device mx0
+device pn0
 device rl0
 device tl0
 device tx0
+device vr0
 device vx0
+device wb0
 device xl0
 
 device ed0 at isa? port 0x280 net irq 10 iomem 0xd8000
diff --git a/sys/i386/i386/userconfig.c b/sys/i386/i386/userconfig.c
index 9a3832b..6189656 100644
--- a/sys/i386/i386/userconfig.c
+++ b/sys/i386/i386/userconfig.c
@@ -46,7 +46,7 @@
  ** (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
  ** THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  **
- **      $Id: userconfig.c,v 1.114 1998/11/03 21:07:51 msmith Exp $
+ **      $Id: userconfig.c,v 1.115 1998/11/04 13:37:43 peter Exp $
  **/
 
 /**
@@ -340,7 +340,11 @@ static DEV_INFO device_info[] = {
 {"de",          "DEC DC21040 Ethernet adapter",		FLG_FIXED,	CLS_NETWORK},
 {"fpa",         "DEC DEFPA PCI FDDI adapter",		FLG_FIXED,	CLS_NETWORK},
 {"rl",          "RealTek 8129/8139 ethernet adapter",	FLG_FIXED,	CLS_NETWORK},
+{"mx",          "Macronix PMAC ethernet adapter",	FLG_FIXED,	CLS_NETWORK},
+{"pn",          "Lite-On 82c168/82c169 PNIC adapter",	FLG_FIXED,	CLS_NETWORK},
 {"tl",          "Texas Instruments ThunderLAN ethernet adapter", FLG_FIXED, CLS_NETWORK},
+{"vr",          "VIA Rhine/Rhine II ethernet adapter",	FLG_FIXED,	CLS_NETWORK},
+{"wb",          "Winbond W89C840F ethernet adapter",	FLG_FIXED,	CLS_NETWORK},
 {"xl",          "3COM 3C90x PCI FDDI adapter",		FLG_FIXED,	CLS_NETWORK},
 
 {"sio",         "8250/16450/16550 Serial port",		0,		CLS_COMMS},
@@ -2454,7 +2458,7 @@ visuserconfig(void)
  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  * SUCH DAMAGE.
  *
- *      $Id: userconfig.c,v 1.114 1998/11/03 21:07:51 msmith Exp $
+ *      $Id: userconfig.c,v 1.115 1998/11/04 13:37:43 peter Exp $
  */
 
 #include "scbus.h"
diff --git a/sys/pci/if_mx.c b/sys/pci/if_mx.c
new file mode 100644
index 0000000..a1938f0
--- /dev/null
+++ b/sys/pci/if_mx.c
@@ -0,0 +1,2403 @@
+/*
+ * Copyright (c) 1997, 1998
+ *	Bill Paul <wpaul@ctr.columbia.edu>.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ * 3. All advertising materials mentioning features or use of this software
+ *    must display the following acknowledgement:
+ *	This product includes software developed by Bill Paul.
+ * 4. Neither the name of the author nor the names of any co-contributors
+ *    may be used to endorse or promote products derived from this software
+ *    without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY Bill Paul AND CONTRIBUTORS ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL Bill Paul OR THE VOICES IN HIS HEAD
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ *
+ *	$Id: if_mx.c,v 1.27 1998/12/01 15:55:20 wpaul Exp $
+ */
+
+/*
+ * Macronix PMAC fast ethernet PCI NIC driver
+ *
+ * Written by Bill Paul <wpaul@ctr.columbia.edu>
+ * Electrical Engineering Department
+ * Columbia University, New York City
+ */
+
+/*
+ * The Macronix 98713, 98715 and 98725 chips are still more tulip clones.
+ * The 98713 has an internal transceiver and an MII bus for external PHYs.
+ * The other two chips have only the internal transceiver. All have
+ * support for built-in autonegotiation. Additionally, there are 98713A
+ * and 98715A chips which support power management. The 98725 chip
+ * supports power management as well.
+ *
+ * Datasheets for the Macronix parts can be obtained from www.macronix.com.
+ * Note however that the datasheets do not describe the TX and RX
+ * descriptor structures or the setup frame format(s). For this, you should
+ * obtain a DEC 21x4x datasheet from developer.intel.com. The Macronix
+ * chips look to be fairly straightforward tulip clones, except for
+ * the NWAY support.
+ */
+
+#include "bpfilter.h"
+
+#include <sys/param.h>
+#include <sys/systm.h>
+#include <sys/sockio.h>
+#include <sys/mbuf.h>
+#include <sys/malloc.h>
+#include <sys/kernel.h>
+#include <sys/socket.h>
+
+#include <net/if.h>
+#include <net/if_arp.h>
+#include <net/ethernet.h>
+#include <net/if_dl.h>
+#include <net/if_media.h>
+
+#if NBPFILTER > 0
+#include <net/bpf.h>
+#endif
+
+#include <vm/vm.h>              /* for vtophys */
+#include <vm/pmap.h>            /* for vtophys */
+#include <machine/clock.h>      /* for DELAY */
+#include <machine/bus_pio.h>
+#include <machine/bus_memio.h>
+#include <machine/bus.h>
+
+#include <pci/pcireg.h>
+#include <pci/pcivar.h>
+
+#define MX_USEIOSPACE
+
+/* #define MX_BACKGROUND_AUTONEG */
+
+#include <pci/if_mxreg.h>
+
+#ifndef lint
+static char rcsid[] =
+	"$Id: if_mx.c,v 1.27 1998/12/01 15:55:20 wpaul Exp $";
+#endif
+
+/*
+ * Various supported device vendors/types and their names.
+ */
+static struct mx_type mx_devs[] = {
+	{ MX_VENDORID, MX_DEVICEID_98713,
+		"Macronix 98713 10/100BaseTX" },
+	{ MX_VENDORID, MX_DEVICEID_98713,
+		"Macronix 98713A 10/100BaseTX" },
+	{ MX_VENDORID, MX_DEVICEID_987x5,
+		"Macronix 98715/98715A 10/100BaseTX" },
+	{ MX_VENDORID, MX_DEVICEID_987x5,
+		"Macronix 98725 10/100BaseTX" },
+	{ 0, 0, NULL }
+};
+
+/*
+ * Various supported PHY vendors/types and their names. Note that
+ * this driver will work with pretty much any MII-compliant PHY,
+ * so failure to positively identify the chip is not a fatal error.
+ */
+
+static struct mx_type mx_phys[] = {
+	{ TI_PHY_VENDORID, TI_PHY_10BT, "<TI ThunderLAN 10BT (internal)>" },
+	{ TI_PHY_VENDORID, TI_PHY_100VGPMI, "<TI TNETE211 100VG Any-LAN>" },
+	{ NS_PHY_VENDORID, NS_PHY_83840A, "<National Semiconductor DP83840A>"},
+	{ LEVEL1_PHY_VENDORID, LEVEL1_PHY_LXT970, "<Level 1 LXT970>" }, 
+	{ INTEL_PHY_VENDORID, INTEL_PHY_82555, "<Intel 82555>" },
+	{ SEEQ_PHY_VENDORID, SEEQ_PHY_80220, "<SEEQ 80220>" },
+	{ 0, 0, "<MII-compliant physical interface>" }
+};
+
+static unsigned long mx_count = 0;
+static char *mx_probe		__P((pcici_t, pcidi_t));
+static void mx_attach		__P((pcici_t, int));
+
+static int mx_newbuf		__P((struct mx_softc *,
+						struct mx_chain_onefrag *));
+static int mx_encap		__P((struct mx_softc *, struct mx_chain *,
+						struct mbuf *));
+
+static void mx_rxeof		__P((struct mx_softc *));
+static void mx_rxeoc		__P((struct mx_softc *));
+static void mx_txeof		__P((struct mx_softc *));
+static void mx_txeoc		__P((struct mx_softc *));
+static void mx_intr		__P((void *));
+static void mx_start		__P((struct ifnet *));
+static int mx_ioctl		__P((struct ifnet *, u_long, caddr_t));
+static void mx_init		__P((void *));
+static void mx_stop		__P((struct mx_softc *));
+static void mx_watchdog		__P((struct ifnet *));
+static void mx_shutdown		__P((int, void *));
+static int mx_ifmedia_upd	__P((struct ifnet *));
+static void mx_ifmedia_sts	__P((struct ifnet *, struct ifmediareq *));
+
+static void mx_delay		__P((struct mx_softc *));
+static void mx_eeprom_idle	__P((struct mx_softc *));
+static void mx_eeprom_putbyte	__P((struct mx_softc *, u_int8_t));
+static void mx_eeprom_getword	__P((struct mx_softc *, u_int8_t, u_int16_t *));
+static void mx_read_eeprom	__P((struct mx_softc *, caddr_t, int,
+							int, int));
+
+static void mx_mii_writebit	__P((struct mx_softc *, int));
+static int mx_mii_readbit	__P((struct mx_softc *));
+static void mx_mii_sync		__P((struct mx_softc *));
+static void mx_mii_send		__P((struct mx_softc *, u_int32_t, int));
+static int mx_mii_readreg	__P((struct mx_softc *, struct mx_mii_frame *));
+static int mx_mii_writereg	__P((struct mx_softc *, struct mx_mii_frame *));
+static u_int16_t mx_phy_readreg	__P((struct mx_softc *, int));
+static void mx_phy_writereg	__P((struct mx_softc *, u_int16_t, u_int16_t));
+
+static void mx_autoneg_xmit	__P((struct mx_softc *));
+static void mx_autoneg_mii	__P((struct mx_softc *, int, int));
+static void mx_autoneg		__P((struct mx_softc *, int, int));
+static void mx_setmode_mii	__P((struct mx_softc *, int));
+static void mx_setmode		__P((struct mx_softc *, int, int));
+static void mx_getmode_mii	__P((struct mx_softc *));
+static void mx_setcfg		__P((struct mx_softc *, u_int16_t));
+static u_int32_t mx_calchash	__P((u_int8_t *));
+static void mx_setfilt		__P((struct mx_softc *));
+static void mx_reset		__P((struct mx_softc *));
+static int mx_list_rx_init	__P((struct mx_softc *));
+static int mx_list_tx_init	__P((struct mx_softc *));
+
+#define MX_SETBIT(sc, reg, x)				\
+	CSR_WRITE_4(sc, reg,				\
+		CSR_READ_4(sc, reg) | x)
+
+#define MX_CLRBIT(sc, reg, x)				\
+	CSR_WRITE_4(sc, reg,				\
+		CSR_READ_4(sc, reg) & ~x)
+
+#define SIO_SET(x)					\
+	CSR_WRITE_4(sc, MX_SIO,				\
+		CSR_READ_4(sc, MX_SIO) | x)
+
+#define SIO_CLR(x)					\
+	CSR_WRITE_4(sc, MX_SIO,				\
+		CSR_READ_4(sc, MX_SIO) & ~x)
+
+static void mx_delay(sc)
+	struct mx_softc		*sc;
+{
+	int			idx;
+
+	for (idx = (300 / 33) + 1; idx > 0; idx--)
+		CSR_READ_4(sc, MX_BUSCTL);
+}
+
+static void mx_eeprom_idle(sc)
+	struct mx_softc		*sc;
+{
+	register int		i;
+
+	CSR_WRITE_4(sc, MX_SIO, MX_SIO_EESEL);
+	mx_delay(sc);
+	MX_SETBIT(sc, MX_SIO,  MX_SIO_ROMCTL_READ);
+	mx_delay(sc);
+	MX_SETBIT(sc, MX_SIO, MX_SIO_EE_CS);
+	mx_delay(sc);
+	MX_SETBIT(sc, MX_SIO, MX_SIO_EE_CLK);
+	mx_delay(sc);
+
+	for (i = 0; i < 25; i++) {
+		MX_CLRBIT(sc, MX_SIO, MX_SIO_EE_CLK);
+		mx_delay(sc);
+		MX_SETBIT(sc, MX_SIO, MX_SIO_EE_CLK);
+		mx_delay(sc);
+	}
+
+	MX_CLRBIT(sc, MX_SIO, MX_SIO_EE_CLK);
+	mx_delay(sc);
+	MX_CLRBIT(sc, MX_SIO, MX_SIO_EE_CS);
+	mx_delay(sc);
+	CSR_WRITE_4(sc, MX_SIO, 0x00000000);
+
+	return;
+}
+
+/*
+ * Send a read command and address to the EEPROM, check for ACK.
+ */
+static void mx_eeprom_putbyte(sc, addr)
+	struct mx_softc		*sc;
+	u_int8_t		addr;
+{
+	register int		d, i;
+
+	d = addr | MX_EECMD_READ;
+
+	/*
+	 * Feed in each bit and stobe the clock.
+	 */
+	for (i = 0x400; i; i >>= 1) {
+		if (d & i) {
+			SIO_SET(MX_SIO_EE_DATAIN);
+		} else {
+			SIO_CLR(MX_SIO_EE_DATAIN);
+		}
+		mx_delay(sc);
+		SIO_SET(MX_SIO_EE_CLK);
+		mx_delay(sc);
+		SIO_CLR(MX_SIO_EE_CLK);
+		mx_delay(sc);
+	}
+
+	return;
+}
+
+/*
+ * Read a word of data stored in the EEPROM at address 'addr.'
+ */
+static void mx_eeprom_getword(sc, addr, dest)
+	struct mx_softc		*sc;
+	u_int8_t		addr;
+	u_int16_t		*dest;
+{
+	register int		i;
+	u_int16_t		word = 0;
+
+	/* Force EEPROM to idle state. */
+	mx_eeprom_idle(sc);
+
+	/* Enter EEPROM access mode. */
+	CSR_WRITE_4(sc, MX_SIO, MX_SIO_EESEL);
+	mx_delay(sc);
+	MX_SETBIT(sc, MX_SIO,  MX_SIO_ROMCTL_READ);
+	mx_delay(sc);
+	MX_SETBIT(sc, MX_SIO, MX_SIO_EE_CS);
+	mx_delay(sc);
+	MX_SETBIT(sc, MX_SIO, MX_SIO_EE_CLK);
+	mx_delay(sc);
+
+	/*
+	 * Send address of word we want to read.
+	 */
+	mx_eeprom_putbyte(sc, addr);
+
+	/*
+	 * Start reading bits from EEPROM.
+	 */
+	for (i = 0x8000; i; i >>= 1) {
+		SIO_SET(MX_SIO_EE_CLK);
+		mx_delay(sc);
+		if (CSR_READ_4(sc, MX_SIO) & MX_SIO_EE_DATAOUT)
+			word |= i;
+		mx_delay(sc);
+		SIO_CLR(MX_SIO_EE_CLK);
+		mx_delay(sc);
+	}
+
+	/* Turn off EEPROM access mode. */
+	mx_eeprom_idle(sc);
+
+	*dest = word;
+
+	return;
+}
+
+/*
+ * Read a sequence of words from the EEPROM.
+ */
+static void mx_read_eeprom(sc, dest, off, cnt, swap)
+	struct mx_softc		*sc;
+	caddr_t			dest;
+	int			off;
+	int			cnt;
+	int			swap;
+{
+	int			i;
+	u_int16_t		word = 0, *ptr;
+
+	for (i = 0; i < cnt; i++) {
+		mx_eeprom_getword(sc, off + i, &word);
+		ptr = (u_int16_t *)(dest + (i * 2));
+		if (swap)
+			*ptr = ntohs(word);
+		else
+			*ptr = word;
+	}
+
+	return;
+}
+
+/*
+ * The following two routines are taken from the Macronix 98713
+ * Application Notes pp.19-21.
+ */
+/*
+ * Write a bit to the MII bus.
+ */
+static void mx_mii_writebit(sc, bit)
+	struct mx_softc		*sc;
+	int			bit;
+{
+	if (bit)
+		CSR_WRITE_4(sc, MX_SIO, MX_SIO_ROMCTL_WRITE|MX_SIO_MII_DATAOUT);
+	else
+		CSR_WRITE_4(sc, MX_SIO, MX_SIO_ROMCTL_WRITE);
+
+	MX_SETBIT(sc, MX_SIO, MX_SIO_MII_CLK);
+	MX_CLRBIT(sc, MX_SIO, MX_SIO_MII_CLK);
+
+	return;
+}
+
+/*
+ * Read a bit from the MII bus.
+ */
+static int mx_mii_readbit(sc)
+	struct mx_softc		*sc;
+{
+	CSR_WRITE_4(sc, MX_SIO, MX_SIO_ROMCTL_READ|MX_SIO_MII_DIR);
+	CSR_READ_4(sc, MX_SIO);
+	MX_SETBIT(sc, MX_SIO, MX_SIO_MII_CLK);
+	MX_CLRBIT(sc, MX_SIO, MX_SIO_MII_CLK);
+	if (CSR_READ_4(sc, MX_SIO) & MX_SIO_MII_DATAIN)
+		return(1);
+
+	return(0);
+}
+
+/*
+ * Sync the PHYs by setting data bit and strobing the clock 32 times.
+ */
+static void mx_mii_sync(sc)
+	struct mx_softc		*sc;
+{
+	register int		i;
+
+	CSR_WRITE_4(sc, MX_SIO, MX_SIO_ROMCTL_WRITE);
+
+	for (i = 0; i < 32; i++)
+		mx_mii_writebit(sc, 1);
+
+	return;
+}
+
+/*
+ * Clock a series of bits through the MII.
+ */
+static void mx_mii_send(sc, bits, cnt)
+	struct mx_softc		*sc;
+	u_int32_t		bits;
+	int			cnt;
+{
+	int			i;
+
+	for (i = (0x1 << (cnt - 1)); i; i >>= 1)
+		mx_mii_writebit(sc, bits & i);
+}
+
+/*
+ * Read an PHY register through the MII.
+ */
+static int mx_mii_readreg(sc, frame)
+	struct mx_softc		*sc;
+	struct mx_mii_frame	*frame;
+	
+{
+	int			i, ack, s;
+
+	s = splimp();
+
+	/*
+	 * Set up frame for RX.
+	 */
+	frame->mii_stdelim = MX_MII_STARTDELIM;
+	frame->mii_opcode = MX_MII_READOP;
+	frame->mii_turnaround = 0;
+	frame->mii_data = 0;
+	
+	/*
+	 * Sync the PHYs.
+	 */
+	mx_mii_sync(sc);
+
+	/*
+	 * Send command/address info.
+	 */
+	mx_mii_send(sc, frame->mii_stdelim, 2);
+	mx_mii_send(sc, frame->mii_opcode, 2);
+	mx_mii_send(sc, frame->mii_phyaddr, 5);
+	mx_mii_send(sc, frame->mii_regaddr, 5);
+
+	/* Idle bit */
+	mx_mii_writebit(sc, 1);
+	mx_mii_writebit(sc, 0);
+
+	/* Check for ack */
+	ack = mx_mii_readbit(sc);
+
+	/*
+	 * Now try reading data bits. If the ack failed, we still
+	 * need to clock through 16 cycles to keep the PHY(s) in sync.
+	 */
+	if (ack) {
+		for(i = 0; i < 16; i++) {
+			mx_mii_readbit(sc);
+		}
+		goto fail;
+	}
+
+	for (i = 0x8000; i; i >>= 1) {
+		if (!ack) {
+			if (mx_mii_readbit(sc))
+				frame->mii_data |= i;
+		}
+	}
+
+fail:
+
+	mx_mii_writebit(sc, 0);
+	mx_mii_writebit(sc, 0);
+
+	splx(s);
+
+	if (ack)
+		return(1);
+	return(0);
+}
+
+/*
+ * Write to a PHY register through the MII.
+ */
+static int mx_mii_writereg(sc, frame)
+	struct mx_softc		*sc;
+	struct mx_mii_frame	*frame;
+	
+{
+	int			s;
+
+	s = splimp();
+	/*
+	 * Set up frame for TX.
+	 */
+
+	frame->mii_stdelim = MX_MII_STARTDELIM;
+	frame->mii_opcode = MX_MII_WRITEOP;
+	frame->mii_turnaround = MX_MII_TURNAROUND;
+
+	/*
+	 * Sync the PHYs.
+	 */	
+	mx_mii_sync(sc);
+
+	mx_mii_send(sc, frame->mii_stdelim, 2);
+	mx_mii_send(sc, frame->mii_opcode, 2);
+	mx_mii_send(sc, frame->mii_phyaddr, 5);
+	mx_mii_send(sc, frame->mii_regaddr, 5);
+	mx_mii_send(sc, frame->mii_turnaround, 2);
+	mx_mii_send(sc, frame->mii_data, 16);
+
+	/* Idle bit. */
+	mx_mii_writebit(sc, 0);
+	mx_mii_writebit(sc, 0);
+
+	splx(s);
+
+	return(0);
+}
+
+static u_int16_t mx_phy_readreg(sc, reg)
+	struct mx_softc		*sc;
+	int			reg;
+{
+	struct mx_mii_frame	frame;
+
+	bzero((char *)&frame, sizeof(frame));
+
+	frame.mii_phyaddr = sc->mx_phy_addr;
+	frame.mii_regaddr = reg;
+	mx_mii_readreg(sc, &frame);
+
+	return(frame.mii_data);
+}
+
+static void mx_phy_writereg(sc, reg, data)
+	struct mx_softc		*sc;
+	u_int16_t		reg;
+	u_int16_t		data;
+{
+	struct mx_mii_frame	frame;
+
+	bzero((char *)&frame, sizeof(frame));
+
+	frame.mii_phyaddr = sc->mx_phy_addr;
+	frame.mii_regaddr = reg;
+	frame.mii_data = data;
+
+	mx_mii_writereg(sc, &frame);
+
+	return;
+}
+
+#define MX_POLY		0xEDB88320
+#define MX_BITS		9
+
+static u_int32_t mx_calchash(addr)
+	u_int8_t		*addr;
+{
+	u_int32_t		idx, bit, data, crc;
+
+	/* Compute CRC for the address value. */
+	crc = 0xFFFFFFFF; /* initial value */
+
+	for (idx = 0; idx < 6; idx++) {
+		for (data = *addr++, bit = 0; bit < 8; bit++, data >>= 1)
+			crc = (crc >> 1) ^ (((crc ^ data) & 1) ? MX_POLY : 0);
+	}
+
+	return (crc & ((1 << MX_BITS) - 1));
+}
+
+/*
+ * Initiate an autonegotiation session.
+ */
+static void mx_autoneg_xmit(sc)
+	struct mx_softc		*sc;
+{
+	u_int16_t		phy_sts;
+
+	mx_phy_writereg(sc, PHY_BMCR, PHY_BMCR_RESET);
+	DELAY(500);
+	while(mx_phy_readreg(sc, PHY_BMCR)
+			& PHY_BMCR_RESET);
+
+	phy_sts = mx_phy_readreg(sc, PHY_BMCR);
+	phy_sts |= PHY_BMCR_AUTONEGENBL|PHY_BMCR_AUTONEGRSTR;
+	mx_phy_writereg(sc, PHY_BMCR, phy_sts);
+
+	return;
+}
+
+/*
+ * Invoke autonegotiation on a PHY.
+ */
+static void mx_autoneg_mii(sc, flag, verbose)
+	struct mx_softc		*sc;
+	int			flag;
+	int			verbose;
+{
+	u_int16_t		phy_sts = 0, media, advert, ability;
+	struct ifnet		*ifp;
+	struct ifmedia		*ifm;
+
+	ifm = &sc->ifmedia;
+	ifp = &sc->arpcom.ac_if;
+
+	ifm->ifm_media = IFM_ETHER | IFM_AUTO;
+
+	/*
+	 * The 100baseT4 PHY on the 3c905-T4 has the 'autoneg supported'
+	 * bit cleared in the status register, but has the 'autoneg enabled'
+	 * bit set in the control register. This is a contradiction, and
+	 * I'm not sure how to handle it. If you want to force an attempt
+	 * to autoneg for 100baseT4 PHYs, #define FORCE_AUTONEG_TFOUR
+	 * and see what happens.
+	 */
+#ifndef FORCE_AUTONEG_TFOUR
+	/*
+	 * First, see if autoneg is supported. If not, there's
+	 * no point in continuing.
+	 */
+	phy_sts = mx_phy_readreg(sc, PHY_BMSR);
+	if (!(phy_sts & PHY_BMSR_CANAUTONEG)) {
+		if (verbose)
+			printf("mx%d: autonegotiation not supported\n",
+							sc->mx_unit);
+		ifm->ifm_media = IFM_ETHER|IFM_10_T|IFM_HDX;	
+		return;
+	}
+#endif
+
+	switch (flag) {
+	case MX_FLAG_FORCEDELAY:
+		/*
+	 	 * XXX Never use this option anywhere but in the probe
+	 	 * routine: making the kernel stop dead in its tracks
+ 		 * for three whole seconds after we've gone multi-user
+		 * is really bad manners.
+	 	 */
+		mx_autoneg_xmit(sc);
+		DELAY(5000000);
+		break;
+	case MX_FLAG_SCHEDDELAY:
+		/*
+		 * Wait for the transmitter to go idle before starting
+		 * an autoneg session, otherwise mx_start() may clobber
+	 	 * our timeout, and we don't want to allow transmission
+		 * during an autoneg session since that can screw it up.
+	 	 */
+		if (sc->mx_cdata.mx_tx_head != NULL) {
+			sc->mx_want_auto = 1;
+			return;
+		}
+		mx_autoneg_xmit(sc);
+		ifp->if_timer = 5;
+		sc->mx_autoneg = 1;
+		sc->mx_want_auto = 0;
+		return;
+		break;
+	case MX_FLAG_DELAYTIMEO:
+		ifp->if_timer = 0;
+		sc->mx_autoneg = 0;
+		break;
+	default:
+		printf("mx%d: invalid autoneg flag: %d\n", sc->mx_unit, flag);
+		return;
+	}
+
+	if (mx_phy_readreg(sc, PHY_BMSR) & PHY_BMSR_AUTONEGCOMP) {
+		if (verbose)
+			printf("mx%d: autoneg complete, ", sc->mx_unit);
+		phy_sts = mx_phy_readreg(sc, PHY_BMSR);
+	} else {
+		if (verbose)
+			printf("mx%d: autoneg not complete, ", sc->mx_unit);
+	}
+
+	media = mx_phy_readreg(sc, PHY_BMCR);
+
+	/* Link is good. Report modes and set duplex mode. */
+	if (mx_phy_readreg(sc, PHY_BMSR) & PHY_BMSR_LINKSTAT) {
+		if (verbose)
+			printf("link status good ");
+		advert = mx_phy_readreg(sc, PHY_ANAR);
+		ability = mx_phy_readreg(sc, PHY_LPAR);
+
+		if (advert & PHY_ANAR_100BT4 && ability & PHY_ANAR_100BT4) {
+			ifm->ifm_media = IFM_ETHER|IFM_100_T4;
+			media |= PHY_BMCR_SPEEDSEL;
+			media &= ~PHY_BMCR_DUPLEX;
+			printf("(100baseT4)\n");
+		} else if (advert & PHY_ANAR_100BTXFULL &&
+			ability & PHY_ANAR_100BTXFULL) {
+			ifm->ifm_media = IFM_ETHER|IFM_100_TX|IFM_FDX;
+			media |= PHY_BMCR_SPEEDSEL;
+			media |= PHY_BMCR_DUPLEX;
+			printf("(full-duplex, 100Mbps)\n");
+		} else if (advert & PHY_ANAR_100BTXHALF &&
+			ability & PHY_ANAR_100BTXHALF) {
+			ifm->ifm_media = IFM_ETHER|IFM_100_TX|IFM_HDX;
+			media |= PHY_BMCR_SPEEDSEL;
+			media &= ~PHY_BMCR_DUPLEX;
+			printf("(half-duplex, 100Mbps)\n");
+		} else if (advert & PHY_ANAR_10BTFULL &&
+			ability & PHY_ANAR_10BTFULL) {
+			ifm->ifm_media = IFM_ETHER|IFM_10_T|IFM_FDX;
+			media &= ~PHY_BMCR_SPEEDSEL;
+			media |= PHY_BMCR_DUPLEX;
+			printf("(full-duplex, 10Mbps)\n");
+		} else if (advert & PHY_ANAR_10BTHALF &&
+			ability & PHY_ANAR_10BTHALF) {
+			ifm->ifm_media = IFM_ETHER|IFM_10_T|IFM_HDX;
+			media &= ~PHY_BMCR_SPEEDSEL;
+			media &= ~PHY_BMCR_DUPLEX;
+			printf("(half-duplex, 10Mbps)\n");
+		}
+
+		media &= ~PHY_BMCR_AUTONEGENBL;
+
+		/* Set ASIC's duplex mode to match the PHY. */
+		mx_setcfg(sc, media);
+		mx_phy_writereg(sc, PHY_BMCR, media);
+	} else {
+		if (verbose)
+			printf("no carrier\n");
+	}
+
+	mx_init(sc);
+
+	if (sc->mx_tx_pend) {
+		sc->mx_autoneg = 0;
+		sc->mx_tx_pend = 0;
+		mx_start(ifp);
+	}
+
+	return;
+}
+
+/*
+ * Invoke autoneg using internal NWAY.
+ */
+static void mx_autoneg(sc, flag, verbose)
+	struct mx_softc		*sc;
+	int			flag;
+	int			verbose;
+{
+	u_int32_t		media, ability;
+	struct ifnet		*ifp;
+	struct ifmedia		*ifm;
+
+	ifm = &sc->ifmedia;
+	ifp = &sc->arpcom.ac_if;
+
+	ifm->ifm_media = IFM_ETHER | IFM_AUTO;
+
+	switch (flag) {
+	case MX_FLAG_FORCEDELAY:
+		/*
+	 	 * XXX Never use this option anywhere but in the probe
+	 	 * routine: making the kernel stop dead in its tracks
+ 		 * for three whole seconds after we've gone multi-user
+		 * is really bad manners.
+	 	 */
+		MX_CLRBIT(sc, MX_NETCFG, MX_NETCFG_PORTSEL);
+		MX_SETBIT(sc, MX_NETCFG, MX_NETCFG_FULLDUPLEX);
+		MX_SETBIT(sc, MX_10BTCTRL, MX_TCTL_AUTONEGENBL);
+		MX_SETBIT(sc, MX_10BTCTRL, MX_ASTAT_TXDISABLE);
+		DELAY(5000000);
+		break;
+	case MX_FLAG_SCHEDDELAY:
+		/*
+		 * Wait for the transmitter to go idle before starting
+		 * an autoneg session, otherwise mx_start() may clobber
+	 	 * our timeout, and we don't want to allow transmission
+		 * during an autoneg session since that can screw it up.
+	 	 */
+		if (sc->mx_cdata.mx_tx_head != NULL) {
+			sc->mx_want_auto = 1;
+			return;
+		}
+		MX_CLRBIT(sc, MX_NETCFG, MX_NETCFG_PORTSEL);
+		MX_SETBIT(sc, MX_NETCFG, MX_NETCFG_FULLDUPLEX);
+		MX_SETBIT(sc, MX_10BTCTRL, MX_TCTL_AUTONEGENBL);
+		MX_SETBIT(sc, MX_10BTCTRL, MX_ASTAT_TXDISABLE);
+		ifp->if_timer = 5;
+		sc->mx_autoneg = 1;
+		sc->mx_want_auto = 0;
+		return;
+		break;
+	case MX_FLAG_DELAYTIMEO:
+		ifp->if_timer = 0;
+		sc->mx_autoneg = 0;
+		break;
+	default:
+		printf("mx%d: invalid autoneg flag: %d\n", sc->mx_unit, flag);
+		return;
+	}
+
+	if ((CSR_READ_4(sc, MX_10BTSTAT) & MX_TSTAT_ANEGSTAT) ==
+						MX_ASTAT_AUTONEGCMP) {
+		if (verbose)
+			printf("mx%d: autoneg complete, ", sc->mx_unit);
+	} else {
+		if (verbose)
+			printf("mx%d: autoneg not complete, ", sc->mx_unit);
+	}
+
+	media = CSR_READ_4(sc, MX_NETCFG);
+
+	/* Link is good. Report modes and set duplex mode. */
+	if (!(CSR_READ_4(sc, MX_10BTSTAT) & MX_TSTAT_LS10) ||
+		!(CSR_READ_4(sc, MX_10BTSTAT) & MX_TSTAT_LS100)) {
+		if (verbose)
+			printf("link status good ");
+		ability = CSR_READ_4(sc, MX_NWAYSTAT);
+		if (ability & MX_NWAY_100BT4) {
+			ifm->ifm_media = IFM_ETHER|IFM_100_T4;
+			media |= MX_NETCFG_PORTSEL|MX_NETCFG_PCS|
+					MX_NETCFG_SCRAMBLER;
+			media &= ~(MX_NETCFG_FULLDUPLEX|MX_NETCFG_SPEEDSEL);
+			printf("(100baseT4)\n");
+		} else if (ability & MX_NWAY_100BTFULL) {
+			ifm->ifm_media = IFM_ETHER|IFM_100_TX|IFM_FDX;
+			media |= MX_NETCFG_PORTSEL|MX_NETCFG_PCS|
+					MX_NETCFG_SCRAMBLER;
+			media |= MX_NETCFG_FULLDUPLEX;
+			media &= ~MX_NETCFG_SPEEDSEL;
+			printf("(full-duplex, 100Mbps)\n");
+		} else if (ability & MX_NWAY_100BTHALF) {
+			ifm->ifm_media = IFM_ETHER|IFM_100_TX|IFM_HDX;
+			media |= MX_NETCFG_PORTSEL|MX_NETCFG_PCS|
+					MX_NETCFG_SCRAMBLER;
+			media &= ~(MX_NETCFG_FULLDUPLEX|MX_NETCFG_SPEEDSEL);
+			printf("(half-duplex, 100Mbps)\n");
+		} else if (ability & MX_NWAY_10BTFULL) {
+			ifm->ifm_media = IFM_ETHER|IFM_10_T|IFM_FDX;
+			media &= ~MX_NETCFG_PORTSEL;
+			media |= (MX_NETCFG_FULLDUPLEX|MX_NETCFG_SPEEDSEL);
+			printf("(full-duplex, 10Mbps)\n");
+		} else {
+			ifm->ifm_media = IFM_ETHER|IFM_10_T|IFM_HDX;
+			media &= ~MX_NETCFG_PORTSEL;
+			media &= ~MX_NETCFG_FULLDUPLEX;
+			media |= MX_NETCFG_SPEEDSEL;
+			printf("(half-duplex, 10Mbps)\n");
+		}
+
+		CSR_WRITE_4(sc, MX_NETCFG, media);
+		MX_CLRBIT(sc, MX_10BTCTRL, MX_TCTL_AUTONEGENBL);
+	} else {
+		if (verbose)
+			printf("no carrier\n");
+	}
+
+	mx_init(sc);
+
+	if (sc->mx_tx_pend) {
+		sc->mx_autoneg = 0;
+		sc->mx_tx_pend = 0;
+		mx_start(ifp);
+	}
+
+	return;
+}
+
+static void mx_getmode_mii(sc)
+	struct mx_softc		*sc;
+{
+	u_int16_t		bmsr;
+	struct ifnet		*ifp;
+
+	ifp = &sc->arpcom.ac_if;
+
+	bmsr = mx_phy_readreg(sc, PHY_BMSR);
+	if (bootverbose)
+		printf("mx%d: PHY status word: %x\n", sc->mx_unit, bmsr);
+
+	/* fallback */
+	sc->ifmedia.ifm_media = IFM_ETHER|IFM_10_T|IFM_HDX;
+
+	if (bmsr & PHY_BMSR_10BTHALF) {
+		if (bootverbose)
+			printf("mx%d: 10Mbps half-duplex mode supported\n",
+								sc->mx_unit);
+		ifmedia_add(&sc->ifmedia,
+			IFM_ETHER|IFM_10_T|IFM_HDX, 0, NULL);
+		ifmedia_add(&sc->ifmedia, IFM_ETHER|IFM_10_T, 0, NULL);
+	}
+
+	if (bmsr & PHY_BMSR_10BTFULL) {
+		if (bootverbose)
+			printf("mx%d: 10Mbps full-duplex mode supported\n",
+								sc->mx_unit);
+		ifmedia_add(&sc->ifmedia,
+			IFM_ETHER|IFM_10_T|IFM_FDX, 0, NULL);
+		sc->ifmedia.ifm_media = IFM_ETHER|IFM_10_T|IFM_FDX;
+	}
+
+	if (bmsr & PHY_BMSR_100BTXHALF) {
+		if (bootverbose)
+			printf("mx%d: 100Mbps half-duplex mode supported\n",
+								sc->mx_unit);
+		ifp->if_baudrate = 100000000;
+		ifmedia_add(&sc->ifmedia, IFM_ETHER|IFM_100_TX, 0, NULL);
+		ifmedia_add(&sc->ifmedia,
+			IFM_ETHER|IFM_100_TX|IFM_HDX, 0, NULL);
+		sc->ifmedia.ifm_media = IFM_ETHER|IFM_100_TX|IFM_HDX;
+	}
+
+	if (bmsr & PHY_BMSR_100BTXFULL) {
+		if (bootverbose)
+			printf("mx%d: 100Mbps full-duplex mode supported\n",
+								sc->mx_unit);
+		ifp->if_baudrate = 100000000;
+		ifmedia_add(&sc->ifmedia,
+			IFM_ETHER|IFM_100_TX|IFM_FDX, 0, NULL);
+		sc->ifmedia.ifm_media = IFM_ETHER|IFM_100_TX|IFM_FDX;
+	}
+
+	/* Some also support 100BaseT4. */
+	if (bmsr & PHY_BMSR_100BT4) {
+		if (bootverbose)
+			printf("mx%d: 100baseT4 mode supported\n", sc->mx_unit);
+		ifp->if_baudrate = 100000000;
+		ifmedia_add(&sc->ifmedia, IFM_ETHER|IFM_100_T4, 0, NULL);
+		sc->ifmedia.ifm_media = IFM_ETHER|IFM_100_T4;
+#ifdef FORCE_AUTONEG_TFOUR
+		if (bootverbose)
+			printf("mx%d: forcing on autoneg support for BT4\n",
+							 sc->mx_unit);
+		ifmedia_add(&sc->ifmedia, IFM_ETHER|IFM_AUTO, 0 NULL):
+		sc->ifmedia.ifm_media = IFM_ETHER|IFM_AUTO;
+#endif
+	}
+
+	if (bmsr & PHY_BMSR_CANAUTONEG) {
+		if (bootverbose)
+			printf("mx%d: autoneg supported\n", sc->mx_unit);
+		ifmedia_add(&sc->ifmedia, IFM_ETHER|IFM_AUTO, 0, NULL);
+		sc->ifmedia.ifm_media = IFM_ETHER|IFM_AUTO;
+	}
+
+	return;
+}
+
+/*
+ * Set speed and duplex mode.
+ */
+static void mx_setmode_mii(sc, media)
+	struct mx_softc		*sc;
+	int			media;
+{
+	u_int16_t		bmcr;
+	struct ifnet		*ifp;
+
+	ifp = &sc->arpcom.ac_if;
+
+	/*
+	 * If an autoneg session is in progress, stop it.
+	 */
+	if (sc->mx_autoneg) {
+		printf("mx%d: canceling autoneg session\n", sc->mx_unit);
+		ifp->if_timer = sc->mx_autoneg = sc->mx_want_auto = 0;
+		bmcr = mx_phy_readreg(sc, PHY_BMCR);
+		bmcr &= ~PHY_BMCR_AUTONEGENBL;
+		mx_phy_writereg(sc, PHY_BMCR, bmcr);
+	}
+
+	printf("mx%d: selecting MII, ", sc->mx_unit);
+
+	bmcr = mx_phy_readreg(sc, PHY_BMCR);
+
+	bmcr &= ~(PHY_BMCR_AUTONEGENBL|PHY_BMCR_SPEEDSEL|
+			PHY_BMCR_DUPLEX|PHY_BMCR_LOOPBK);
+
+	if (IFM_SUBTYPE(media) == IFM_100_T4) {
+		printf("100Mbps/T4, half-duplex\n");
+		bmcr |= PHY_BMCR_SPEEDSEL;
+		bmcr &= ~PHY_BMCR_DUPLEX;
+	}
+
+	if (IFM_SUBTYPE(media) == IFM_100_TX) {
+		printf("100Mbps, ");
+		bmcr |= PHY_BMCR_SPEEDSEL;
+	}
+
+	if (IFM_SUBTYPE(media) == IFM_10_T) {
+		printf("10Mbps, ");
+		bmcr &= ~PHY_BMCR_SPEEDSEL;
+	}
+
+	if ((media & IFM_GMASK) == IFM_FDX) {
+		printf("full duplex\n");
+		bmcr |= PHY_BMCR_DUPLEX;
+	} else {
+		printf("half duplex\n");
+		bmcr &= ~PHY_BMCR_DUPLEX;
+	}
+
+	mx_setcfg(sc, bmcr);
+	mx_phy_writereg(sc, PHY_BMCR, bmcr);
+
+	return;
+}
+
+/*
+ * Set speed and duplex mode on internal transceiver.
+ */
+static void mx_setmode(sc, media, verbose)
+	struct mx_softc		*sc;
+	int			media;
+	int			verbose;
+{
+	struct ifnet		*ifp;
+	u_int32_t		mode;
+
+	ifp = &sc->arpcom.ac_if;
+
+	/*
+	 * If an autoneg session is in progress, stop it.
+	 */
+	if (sc->mx_autoneg) {
+		printf("mx%d: canceling autoneg session\n", sc->mx_unit);
+		ifp->if_timer = sc->mx_autoneg = sc->mx_want_auto = 0;
+		MX_CLRBIT(sc, MX_10BTCTRL, MX_TCTL_AUTONEGENBL);
+	}
+
+	if (verbose)
+		printf("mx%d: selecting NWAY, ", sc->mx_unit);
+
+	mode = CSR_READ_4(sc, MX_NETCFG);
+
+	mode &= ~(MX_NETCFG_FULLDUPLEX|MX_NETCFG_PORTSEL|
+		MX_NETCFG_PCS|MX_NETCFG_SCRAMBLER|MX_NETCFG_SPEEDSEL);
+
+	if (IFM_SUBTYPE(media) == IFM_100_T4) {
+		if (verbose)
+			printf("100Mbps/T4, half-duplex\n");
+		mode |= MX_NETCFG_PORTSEL|MX_NETCFG_PCS|MX_NETCFG_SCRAMBLER;
+	}
+
+	if (IFM_SUBTYPE(media) == IFM_100_TX) {
+		if (verbose)
+			printf("100Mbps, ");
+		mode |= MX_NETCFG_PORTSEL|MX_NETCFG_PCS|MX_NETCFG_SCRAMBLER;
+	}
+
+	if (IFM_SUBTYPE(media) == IFM_10_T) {
+		if (verbose)
+			printf("10Mbps, ");
+		mode &= ~MX_NETCFG_PORTSEL;
+		mode |= MX_NETCFG_SPEEDSEL;
+	}
+
+	if ((media & IFM_GMASK) == IFM_FDX) {
+		if (verbose)
+			printf("full duplex\n");
+		mode |= MX_NETCFG_FULLDUPLEX;
+	} else {
+		if (verbose)
+			printf("half duplex\n");
+		mode &= ~MX_NETCFG_FULLDUPLEX;
+	}
+
+	CSR_WRITE_4(sc, MX_NETCFG, mode);
+
+	return;
+}
+
+/*
+ * Programming the receiver filter on the tulip/PMAC is gross. You
+ * have to construct a special setup frame and download it to the
+ * chip via the transmit DMA engine. This routine is also somewhat
+ * gross, as the setup frame is sent synchronously rather than putting
+ * on the transmit queue. The transmitter has to be stopped, then we
+ * can download the frame and wait for the 'owned' bit to clear.
+ *
+ * We always program the chip using 'hash perfect' mode, i.e. one perfect
+ * address (our node address) and a 512-bit hash filter for multicast
+ * frames. We also sneak the broadcast address into the hash filter since
+ * we need that too.
+ */
+void mx_setfilt(sc)
+	struct mx_softc		*sc;
+{
+	struct mx_desc		*sframe;
+	u_int32_t		h, *sp;
+	struct ifmultiaddr	*ifma;
+	struct ifnet		*ifp;
+	int			i;
+
+	ifp = &sc->arpcom.ac_if;
+
+	MX_CLRBIT(sc, MX_NETCFG, MX_NETCFG_TX_ON);
+	MX_SETBIT(sc, MX_ISR, MX_ISR_TX_IDLE);
+
+	sframe = &sc->mx_cdata.mx_sframe;
+	sp = (u_int32_t *)&sc->mx_cdata.mx_sbuf;
+	bzero((char *)sp, MX_SFRAME_LEN);
+
+	sframe->mx_next = vtophys(&sc->mx_ldata->mx_tx_list[0]);
+	sframe->mx_data = vtophys(&sc->mx_cdata.mx_sbuf);
+	sframe->mx_ctl = MX_SFRAME_LEN | MX_TXCTL_TLINK |
+			MX_TXCTL_SETUP | MX_FILTER_HASHPERF;
+
+	/* If we want promiscuous mode, set the allframes bit. */
+	if (ifp->if_flags & IFF_PROMISC)
+		MX_SETBIT(sc, MX_NETCFG, MX_NETCFG_RX_PROMISC);
+	else
+		MX_CLRBIT(sc, MX_NETCFG, MX_NETCFG_RX_PROMISC);
+
+	if (ifp->if_flags & IFF_ALLMULTI)
+		MX_SETBIT(sc, MX_NETCFG, MX_NETCFG_RX_ALLMULTI);
+
+	for (ifma = ifp->if_multiaddrs.lh_first; ifma != NULL;
+				ifma = ifma->ifma_link.le_next) {
+		if (ifma->ifma_addr->sa_family != AF_LINK)
+			continue;
+		h = mx_calchash(LLADDR((struct sockaddr_dl *)ifma->ifma_addr));
+		sp[h >> 4] |= 1 << (h & 0xF);
+	}
+
+	if (ifp->if_flags & IFF_BROADCAST) {
+		h = mx_calchash(etherbroadcastaddr);
+		sp[h >> 4] |= 1 << (h & 0xF);
+	}
+
+	sp[39] = ((u_int16_t *)sc->arpcom.ac_enaddr)[0];
+	sp[40] = ((u_int16_t *)sc->arpcom.ac_enaddr)[1];
+	sp[41] = ((u_int16_t *)sc->arpcom.ac_enaddr)[2];
+
+	CSR_WRITE_4(sc, MX_TXADDR, vtophys(sframe));
+	MX_SETBIT(sc, MX_NETCFG, MX_NETCFG_TX_ON);
+	sframe->mx_status = MX_TXSTAT_OWN;
+	CSR_WRITE_4(sc, MX_TXSTART, 0xFFFFFFFF);
+
+	/*
+	 * Wait for chip to clear the 'own' bit.
+	 */
+	for (i = 0; i < MX_TIMEOUT; i++) {
+		DELAY(10);
+		if (sframe->mx_status != MX_TXSTAT_OWN)
+			break;
+	}
+
+	if (i == MX_TIMEOUT)
+		printf("mx%d: failed to send setup frame\n", sc->mx_unit);
+
+	MX_SETBIT(sc, MX_ISR, MX_ISR_TX_NOBUF|MX_ISR_TX_IDLE);
+
+	return;
+}
+
+/*
+ * In order to fiddle with the
+ * 'full-duplex' and '100Mbps' bits in the netconfig register, we
+ * first have to put the transmit and/or receive logic in the idle state.
+ */
+static void mx_setcfg(sc, bmcr)
+	struct mx_softc		*sc;
+	u_int16_t		bmcr;
+{
+	int			i, restart = 0;
+
+	if (CSR_READ_4(sc, MX_NETCFG) & (MX_NETCFG_TX_ON|MX_NETCFG_RX_ON)) {
+		restart = 1;
+		MX_CLRBIT(sc, MX_NETCFG, (MX_NETCFG_TX_ON|MX_NETCFG_RX_ON));
+
+		for (i = 0; i < MX_TIMEOUT; i++) {
+			DELAY(10);
+			if (CSR_READ_4(sc, MX_ISR) & MX_ISR_TX_IDLE)
+				break;
+		}
+
+		if (i == MX_TIMEOUT)
+			printf("mx%d: failed to force tx and "
+				"rx to idle state\n", sc->mx_unit);
+
+	}
+
+	if (bmcr & PHY_BMCR_SPEEDSEL)
+		MX_CLRBIT(sc, MX_NETCFG, MX_NETCFG_SPEEDSEL);
+	else
+		MX_SETBIT(sc, MX_NETCFG, MX_NETCFG_SPEEDSEL);
+
+	if (bmcr & PHY_BMCR_DUPLEX)
+		MX_SETBIT(sc, MX_NETCFG, MX_NETCFG_FULLDUPLEX);
+	else
+		MX_CLRBIT(sc, MX_NETCFG, MX_NETCFG_FULLDUPLEX);
+
+	if (restart)
+		MX_SETBIT(sc, MX_NETCFG, MX_NETCFG_TX_ON|MX_NETCFG_RX_ON);
+
+	return;
+}
+
+static void mx_reset(sc)
+	struct mx_softc		*sc;
+{
+	register int		i;
+
+	MX_SETBIT(sc, MX_BUSCTL, MX_BUSCTL_RESET);
+
+	for (i = 0; i < MX_TIMEOUT; i++) {
+		DELAY(10);
+		if (!(CSR_READ_4(sc, MX_BUSCTL) & MX_BUSCTL_RESET))
+			break;
+	}
+	if (i == MX_TIMEOUT)
+		printf("mx%d: reset never completed!\n", sc->mx_unit);
+
+	/* Wait a little while for the chip to get its brains in order. */
+	DELAY(1000);
+        return;
+}
+
+/*
+ * Probe for a Macronix PMAC chip. Check the PCI vendor and device
+ * IDs against our list and return a device name if we find a match.
+ * We do a little bit of extra work to identify the exact type of
+ * chip. The MX98713 and MX98713A have the same PCI vendor/device ID,
+ * but different revision IDs. The same is true for 98715/98715A
+ * chips and the 98725. This doesn't affect a whole lot, but it
+ * lets us tell the user exactly what type of device they have
+ * in the probe output.
+ */
+static char *
+mx_probe(config_id, device_id)
+	pcici_t			config_id;
+	pcidi_t			device_id;
+{
+	struct mx_type		*t;
+	u_int32_t		rev;
+
+	t = mx_devs;
+
+	while(t->mx_name != NULL) {
+		if ((device_id & 0xFFFF) == t->mx_vid &&
+		    ((device_id >> 16) & 0xFFFF) == t->mx_did) {
+			/* Check the PCI revision */
+			rev = pci_conf_read(config_id, MX_PCI_REVID) & 0xFF;
+			if (rev > MX_REVISION_98713 && rev < MX_REVISION_98715)
+				t++;
+			if (rev >= MX_REVISION_98725)
+				t++;
+			return(t->mx_name);
+		}
+		t++;
+	}
+
+	return(NULL);
+}
+
+/*
+ * Attach the interface. Allocate softc structures, do ifmedia
+ * setup and ethernet/BPF attach.
+ */
+static void
+mx_attach(config_id, unit)
+	pcici_t			config_id;
+	int			unit;
+{
+	int			s, i;
+#ifndef MX_USEIOSPACE
+	vm_offset_t		pbase, vbase;
+#endif
+	u_char			eaddr[ETHER_ADDR_LEN];
+	u_int32_t		command;
+	struct mx_softc		*sc;
+	struct ifnet		*ifp;
+	int			media = IFM_ETHER|IFM_100_TX|IFM_FDX;
+	unsigned int		round;
+	caddr_t			roundptr;
+	struct mx_type		*p;
+	u_int16_t		phy_vid, phy_did, phy_sts, mac_offset = 0;
+	u_int32_t		revision, pci_id;
+
+	s = splimp();
+
+	sc = malloc(sizeof(struct mx_softc), M_DEVBUF, M_NOWAIT);
+	if (sc == NULL) {
+		printf("mx%d: no memory for softc struct!\n", unit);
+		return;
+	}
+	bzero(sc, sizeof(struct mx_softc));
+
+	/*
+	 * Handle power management nonsense.
+	 */
+
+	command = pci_conf_read(config_id, MX_PCI_CAPID) & 0x000000FF;
+	if (command == 0x01) {
+
+		command = pci_conf_read(config_id, MX_PCI_PWRMGMTCTRL);
+		if (command & MX_PSTATE_MASK) {
+			u_int32_t		iobase, membase, irq;
+
+			/* Save important PCI config data. */
+			iobase = pci_conf_read(config_id, MX_PCI_LOIO);
+			membase = pci_conf_read(config_id, MX_PCI_LOMEM);
+			irq = pci_conf_read(config_id, MX_PCI_INTLINE);
+
+			/* Reset the power state. */
+			printf("mx%d: chip is in D%d power mode "
+			"-- setting to D0\n", unit, command & MX_PSTATE_MASK);
+			command &= 0xFFFFFFFC;
+			pci_conf_write(config_id, MX_PCI_PWRMGMTCTRL, command);
+
+			/* Restore PCI config data. */
+			pci_conf_write(config_id, MX_PCI_LOIO, iobase);
+			pci_conf_write(config_id, MX_PCI_LOMEM, membase);
+			pci_conf_write(config_id, MX_PCI_INTLINE, irq);
+		}
+	}
+
+	/*
+	 * Map control/status registers.
+	 */
+	command = pci_conf_read(config_id, PCI_COMMAND_STATUS_REG);
+	command |= (PCIM_CMD_PORTEN|PCIM_CMD_MEMEN|PCIM_CMD_BUSMASTEREN);
+	pci_conf_write(config_id, PCI_COMMAND_STATUS_REG, command);
+	command = pci_conf_read(config_id, PCI_COMMAND_STATUS_REG);
+
+#ifdef MX_USEIOSPACE
+	if (!(command & PCIM_CMD_PORTEN)) {
+		printf("mx%d: failed to enable I/O ports!\n", unit);
+		free(sc, M_DEVBUF);
+		goto fail;
+	}
+
+	if (!pci_map_port(config_id, MX_PCI_LOIO,
+					(u_short *)&(sc->mx_bhandle))) {
+		printf ("mx%d: couldn't map ports\n", unit);
+		goto fail;
+        }
+	sc->mx_btag = I386_BUS_SPACE_IO;
+#else
+	if (!(command & PCIM_CMD_MEMEN)) {
+		printf("mx%d: failed to enable memory mapping!\n", unit);
+		goto fail;
+	}
+
+	if (!pci_map_mem(config_id, MX_PCI_LOMEM, &vbase, &pbase)) {
+		printf ("mx%d: couldn't map memory\n", unit);
+		goto fail;
+	}
+	sc->mx_btag = I386_BUS_SPACE_MEM;
+	sc->mx_bhandle = vbase;
+#endif
+
+	/* Allocate interrupt */
+	if (!pci_map_int(config_id, mx_intr, sc, &net_imask)) {
+		printf("mx%d: couldn't map interrupt\n", unit);
+		goto fail;
+	}
+
+	/* Need this info to decide on a chip type. */
+	revision = pci_conf_read(config_id, MX_PCI_REVID) & 0x000000FF;
+	pci_id = pci_conf_read(config_id, MX_PCI_VENDOR_ID) & 0x0000FFFF;
+
+	if (pci_id == MX_DEVICEID_98713 && revision == MX_REVISION_98713)
+		sc->mx_type = MX_TYPE_98713;
+	else
+		sc->mx_type = MX_TYPE_987x5;
+
+	/* Reset the adapter. */
+	mx_reset(sc);
+
+	/*
+	 * Get station address from the EEPROM.
+	 */
+	mx_read_eeprom(sc, (caddr_t)&mac_offset,
+			(MX_EE_NODEADDR_OFFSET / 2), 1, 0);
+	mx_read_eeprom(sc, (caddr_t)&eaddr, (mac_offset / 2), 3, 0);
+
+	/*
+	 * A PMAC chip was detected. Inform the world.
+	 */
+	printf("mx%d: Ethernet address: %6D\n", unit, eaddr, ":");
+
+	sc->mx_unit = unit;
+	bcopy(eaddr, (char *)&sc->arpcom.ac_enaddr, ETHER_ADDR_LEN);
+
+	sc->mx_ldata_ptr = malloc(sizeof(struct mx_list_data) + 8,
+				M_DEVBUF, M_NOWAIT);
+	if (sc->mx_ldata_ptr == NULL) {
+		free(sc, M_DEVBUF);
+		printf("mx%d: no memory for list buffers!\n", unit);
+		return;
+	}
+
+	sc->mx_ldata = (struct mx_list_data *)sc->mx_ldata_ptr;
+	round = (unsigned int)sc->mx_ldata_ptr & 0xF;
+	roundptr = sc->mx_ldata_ptr;
+	for (i = 0; i < 8; i++) {
+		if (round % 8) {
+			round++;
+			roundptr++;
+		}
+			break;
+	}
+	sc->mx_ldata = (struct mx_list_data *)roundptr;
+	bzero(sc->mx_ldata, sizeof(struct mx_list_data));
+
+	ifp = &sc->arpcom.ac_if;
+	ifp->if_softc = sc;
+	ifp->if_unit = unit;
+	ifp->if_name = "mx";
+	ifp->if_mtu = ETHERMTU;
+	ifp->if_flags = IFF_BROADCAST | IFF_SIMPLEX | IFF_MULTICAST;
+	ifp->if_ioctl = mx_ioctl;
+	ifp->if_output = ether_output;
+	ifp->if_start = mx_start;
+	ifp->if_watchdog = mx_watchdog;
+	ifp->if_init = mx_init;
+	ifp->if_baudrate = 10000000;
+
+
+	if (sc->mx_type == MX_TYPE_98713) {
+		if (bootverbose)
+			printf("mx%d: probing for a PHY\n", sc->mx_unit);
+		for (i = MX_PHYADDR_MIN; i < MX_PHYADDR_MAX + 1; i++) {
+			if (bootverbose)
+				printf("mx%d: checking address: %d\n",
+							sc->mx_unit, i);
+			sc->mx_phy_addr = i;
+			mx_phy_writereg(sc, PHY_BMCR, PHY_BMCR_RESET);
+			DELAY(500);
+			while(mx_phy_readreg(sc, PHY_BMCR)
+					& PHY_BMCR_RESET);
+			if ((phy_sts = mx_phy_readreg(sc, PHY_BMSR)))
+				break;
+		}
+		if (phy_sts) {
+			phy_vid = mx_phy_readreg(sc, PHY_VENID);
+			phy_did = mx_phy_readreg(sc, PHY_DEVID);
+			if (bootverbose)
+				printf("mx%d: found PHY at address %d, ",
+					sc->mx_unit, sc->mx_phy_addr);
+			if (bootverbose)
+				printf("vendor id: %x device id: %x\n",
+				phy_vid, phy_did);
+			p = mx_phys;
+			while(p->mx_vid) {
+				if (phy_vid == p->mx_vid &&
+					(phy_did | 0x000F) == p->mx_did) {
+					sc->mx_pinfo = p;
+					break;
+				}
+				p++;
+			}
+			if (sc->mx_pinfo == NULL)
+				sc->mx_pinfo = &mx_phys[PHY_UNKNOWN];
+			if (bootverbose)
+				printf("mx%d: PHY type: %s\n",
+					sc->mx_unit, sc->mx_pinfo->mx_name);
+		} else {
+#ifdef DIAGNOSTIC
+			printf("mx%d: MII without any phy!\n", sc->mx_unit);
+#endif
+		}
+	}
+
+	/*
+	 * Do ifmedia setup.
+	 */
+	ifmedia_init(&sc->ifmedia, 0, mx_ifmedia_upd, mx_ifmedia_sts);
+
+	if (sc->mx_type == MX_TYPE_98713 && sc->mx_pinfo != NULL) {
+		mx_getmode_mii(sc);
+		mx_autoneg_mii(sc, MX_FLAG_FORCEDELAY, 1);
+	} else {
+		ifmedia_add(&sc->ifmedia,
+			IFM_ETHER|IFM_10_T|IFM_HDX, 0, NULL);
+		ifmedia_add(&sc->ifmedia,
+			IFM_ETHER|IFM_10_T|IFM_FDX, 0, NULL);
+		ifmedia_add(&sc->ifmedia, IFM_ETHER|IFM_10_T, 0, NULL);
+		ifmedia_add(&sc->ifmedia,
+			IFM_ETHER|IFM_100_TX|IFM_HDX, 0, NULL);
+		ifmedia_add(&sc->ifmedia,
+			IFM_ETHER|IFM_100_TX|IFM_FDX, 0, NULL);
+		ifmedia_add(&sc->ifmedia, IFM_ETHER|IFM_100_TX, 0, NULL);
+		ifmedia_add(&sc->ifmedia, IFM_ETHER|IFM_AUTO, 0, NULL);
+		mx_autoneg(sc, MX_FLAG_FORCEDELAY, 1);
+	}
+
+	media = sc->ifmedia.ifm_media;
+	mx_stop(sc);
+
+	ifmedia_set(&sc->ifmedia, media);
+
+	/*
+	 * Call MI attach routines.
+	 */
+	if_attach(ifp);
+	ether_ifattach(ifp);
+
+#if NBPFILTER > 0
+	bpfattach(ifp, DLT_EN10MB, sizeof(struct ether_header));
+#endif
+	at_shutdown(mx_shutdown, sc, SHUTDOWN_POST_SYNC);
+
+fail:
+	splx(s);
+	return;
+}
+
+/*
+ * Initialize the transmit descriptors.
+ */
+static int mx_list_tx_init(sc)
+	struct mx_softc		*sc;
+{
+	struct mx_chain_data	*cd;
+	struct mx_list_data	*ld;
+	int			i;
+
+	cd = &sc->mx_cdata;
+	ld = sc->mx_ldata;
+	for (i = 0; i < MX_TX_LIST_CNT; i++) {
+		cd->mx_tx_chain[i].mx_ptr = &ld->mx_tx_list[i];
+		if (i == (MX_TX_LIST_CNT - 1))
+			cd->mx_tx_chain[i].mx_nextdesc =
+				&cd->mx_tx_chain[0];
+		else
+			cd->mx_tx_chain[i].mx_nextdesc =
+				&cd->mx_tx_chain[i + 1];
+	}
+
+	cd->mx_tx_free = &cd->mx_tx_chain[0];
+	cd->mx_tx_tail = cd->mx_tx_head = NULL;
+
+	return(0);
+}
+
+
+/*
+ * Initialize the RX descriptors and allocate mbufs for them. Note that
+ * we arrange the descriptors in a closed ring, so that the last descriptor
+ * points back to the first.
+ */
+static int mx_list_rx_init(sc)
+	struct mx_softc		*sc;
+{
+	struct mx_chain_data	*cd;
+	struct mx_list_data	*ld;
+	int			i;
+
+	cd = &sc->mx_cdata;
+	ld = sc->mx_ldata;
+
+	for (i = 0; i < MX_RX_LIST_CNT; i++) {
+		cd->mx_rx_chain[i].mx_ptr =
+			(struct mx_desc *)&ld->mx_rx_list[i];
+		if (mx_newbuf(sc, &cd->mx_rx_chain[i]) == ENOBUFS)
+			return(ENOBUFS);
+		if (i == (MX_RX_LIST_CNT - 1)) {
+			cd->mx_rx_chain[i].mx_nextdesc = &cd->mx_rx_chain[0];
+			ld->mx_rx_list[i].mx_next =
+					vtophys(&ld->mx_rx_list[0]);
+		} else {
+			cd->mx_rx_chain[i].mx_nextdesc = &cd->mx_rx_chain[i + 1];
+			ld->mx_rx_list[i].mx_next =
+					vtophys(&ld->mx_rx_list[i + 1]);
+		}
+	}
+
+	cd->mx_rx_head = &cd->mx_rx_chain[0];
+
+	return(0);
+}
+
+/*
+ * Initialize an RX descriptor and attach an MBUF cluster.
+ * Note: the length fields are only 11 bits wide, which means the
+ * largest size we can specify is 2047. This is important because
+ * MCLBYTES is 2048, so we have to subtract one otherwise we'll
+ * overflow the field and make a mess.
+ */
+static int mx_newbuf(sc, c)
+	struct mx_softc		*sc;
+	struct mx_chain_onefrag	*c;
+{
+	struct mbuf		*m_new = NULL;
+
+	MGETHDR(m_new, M_DONTWAIT, MT_DATA);
+	if (m_new == NULL) {
+		printf("mx%d: no memory for rx list -- packet dropped!\n",
+								sc->mx_unit);
+		return(ENOBUFS);
+	}
+
+	MCLGET(m_new, M_DONTWAIT);
+	if (!(m_new->m_flags & M_EXT)) {
+		printf("mx%d: no memory for rx list -- packet dropped!\n",
+								sc->mx_unit);
+		m_freem(m_new);
+		return(ENOBUFS);
+	}
+
+	c->mx_mbuf = m_new;
+	c->mx_ptr->mx_status = MX_RXSTAT;
+	c->mx_ptr->mx_data = vtophys(mtod(m_new, caddr_t));
+	c->mx_ptr->mx_ctl = MX_RXCTL_RLINK | (MCLBYTES - 1);
+
+	return(0);
+}
+
+/*
+ * A frame has been uploaded: pass the resulting mbuf chain up to
+ * the higher level protocols.
+ */
+static void mx_rxeof(sc)
+	struct mx_softc		*sc;
+{
+        struct ether_header	*eh;
+        struct mbuf		*m;
+        struct ifnet		*ifp;
+	struct mx_chain_onefrag	*cur_rx;
+	int			total_len = 0;
+	u_int32_t		rxstat;
+
+	ifp = &sc->arpcom.ac_if;
+
+	while(!((rxstat = sc->mx_cdata.mx_rx_head->mx_ptr->mx_status) &
+							MX_RXSTAT_OWN)) {
+		cur_rx = sc->mx_cdata.mx_rx_head;
+		sc->mx_cdata.mx_rx_head = cur_rx->mx_nextdesc;
+
+		/*
+		 * If an error occurs, update stats, clear the
+		 * status word and leave the mbuf cluster in place:
+		 * it should simply get re-used next time this descriptor
+	 	 * comes up in the ring.
+		 */
+		if (rxstat & MX_RXSTAT_RXERR) {
+			ifp->if_ierrors++;
+			if (rxstat & MX_RXSTAT_COLLSEEN)
+				ifp->if_collisions++;
+			cur_rx->mx_ptr->mx_status = MX_RXSTAT;
+			cur_rx->mx_ptr->mx_ctl =
+				MX_RXCTL_RLINK | (MCLBYTES - 1);
+			continue;
+		}
+
+		/* No errors; receive the packet. */	
+		m = cur_rx->mx_mbuf;
+		total_len = MX_RXBYTES(cur_rx->mx_ptr->mx_status);
+
+		/*
+		 * Try to conjure up a new mbuf cluster. If that
+		 * fails, it means we have an out of memory condition and
+		 * should leave the buffer in place and continue. This will
+		 * result in a lost packet, but there's little else we
+		 * can do in this situation.
+		 */
+		if (mx_newbuf(sc, cur_rx) == ENOBUFS) {
+			ifp->if_ierrors++;
+			cur_rx->mx_ptr->mx_status =
+				MX_RXSTAT_FIRSTFRAG|MX_RXSTAT_LASTFRAG;
+			cur_rx->mx_ptr->mx_ctl =
+					MX_RXCTL_RLINK | (MCLBYTES - 1);
+			continue;
+		}
+
+		ifp->if_ipackets++;
+		eh = mtod(m, struct ether_header *);
+		m->m_pkthdr.rcvif = ifp;
+		m->m_pkthdr.len = m->m_len = total_len;
+#if NBPFILTER > 0
+		/*
+		 * Handle BPF listeners. Let the BPF user see the packet, but
+		 * don't pass it up to the ether_input() layer unless it's
+		 * a broadcast packet, multicast packet, matches our ethernet
+		 * address or the interface is in promiscuous mode.
+		 */
+		if (ifp->if_bpf) {
+			bpf_mtap(ifp, m);
+			if (ifp->if_flags & IFF_PROMISC &&
+				(bcmp(eh->ether_dhost, sc->arpcom.ac_enaddr,
+						ETHER_ADDR_LEN) &&
+					(eh->ether_dhost[0] & 1) == 0)) {
+				m_freem(m);
+				continue;
+			}
+		}
+#endif
+		/* Remove header from mbuf and pass it on. */
+		m_adj(m, sizeof(struct ether_header));
+		ether_input(ifp, eh, m);
+	}
+
+	return;
+}
+
+void mx_rxeoc(sc)
+	struct mx_softc		*sc;
+{
+
+	mx_rxeof(sc);
+	MX_CLRBIT(sc, MX_NETCFG, MX_NETCFG_RX_ON);
+	CSR_WRITE_4(sc, MX_RXADDR, vtophys(sc->mx_cdata.mx_rx_head->mx_ptr));
+	MX_SETBIT(sc, MX_NETCFG, MX_NETCFG_RX_ON);
+	CSR_WRITE_4(sc, MX_RXSTART, 0xFFFFFFFF);
+
+	return;
+}
+
+/*
+ * A frame was downloaded to the chip. It's safe for us to clean up
+ * the list buffers.
+ */
+
+static void mx_txeof(sc)
+	struct mx_softc		*sc;
+{
+	struct mx_chain		*cur_tx;
+	struct ifnet		*ifp;
+
+	ifp = &sc->arpcom.ac_if;
+
+	/* Clear the timeout timer. */
+	ifp->if_timer = 0;
+
+	if (sc->mx_cdata.mx_tx_head == NULL)
+		return;
+
+	/*
+	 * Go through our tx list and free mbufs for those
+	 * frames that have been transmitted.
+	 */
+	while(sc->mx_cdata.mx_tx_head->mx_mbuf != NULL) {
+		u_int32_t		txstat;
+
+		cur_tx = sc->mx_cdata.mx_tx_head;
+		txstat = MX_TXSTATUS(cur_tx);
+
+		if ((txstat & MX_TXSTAT_OWN) || txstat == MX_UNSENT)
+			break;
+
+		if (txstat & MX_TXSTAT_ERRSUM) {
+			ifp->if_oerrors++;
+			if (txstat & MX_TXSTAT_EXCESSCOLL)
+				ifp->if_collisions++;
+			if (txstat & MX_TXSTAT_LATECOLL)
+				ifp->if_collisions++;
+		}
+
+		ifp->if_collisions += (txstat & MX_TXSTAT_COLLCNT) >> 3;
+
+		ifp->if_opackets++;
+		m_freem(cur_tx->mx_mbuf);
+		cur_tx->mx_mbuf = NULL;
+
+		if (sc->mx_cdata.mx_tx_head == sc->mx_cdata.mx_tx_tail) {
+			sc->mx_cdata.mx_tx_head = NULL;
+			sc->mx_cdata.mx_tx_tail = NULL;
+			break;
+		}
+
+		sc->mx_cdata.mx_tx_head = cur_tx->mx_nextdesc;
+	}
+
+	return;
+}
+
+/*
+ * TX 'end of channel' interrupt handler.
+ */
+static void mx_txeoc(sc)
+	struct mx_softc		*sc;
+{
+	struct ifnet		*ifp;
+
+	ifp = &sc->arpcom.ac_if;
+
+	ifp->if_timer = 0;
+
+	if (sc->mx_cdata.mx_tx_head == NULL) {
+		ifp->if_flags &= ~IFF_OACTIVE;
+		sc->mx_cdata.mx_tx_tail = NULL;
+		if (sc->mx_want_auto) {
+			if (sc->mx_type == MX_TYPE_98713 &&
+						sc->mx_pinfo != NULL)
+				mx_autoneg_mii(sc, MX_FLAG_DELAYTIMEO, 1);
+			else
+				mx_autoneg(sc, MX_FLAG_DELAYTIMEO, 1);
+		}
+	} else {
+		if (MX_TXOWN(sc->mx_cdata.mx_tx_head) == MX_UNSENT) {
+			MX_TXOWN(sc->mx_cdata.mx_tx_head) = MX_TXSTAT_OWN;
+			ifp->if_timer = 5;
+			CSR_WRITE_4(sc, MX_TXSTART, 0xFFFFFFFF);
+		}
+	}
+
+	return;
+}
+
+static void mx_intr(arg)
+	void			*arg;
+{
+	struct mx_softc		*sc;
+	struct ifnet		*ifp;
+	u_int32_t		status;
+
+	sc = arg;
+	ifp = &sc->arpcom.ac_if;
+
+	/* Supress unwanted interrupts */
+	if (!(ifp->if_flags & IFF_UP)) {
+		mx_stop(sc);
+		return;
+	}
+
+	/* Disable interrupts. */
+	CSR_WRITE_4(sc, MX_IMR, 0x00000000);
+
+	for (;;) {
+		status = CSR_READ_4(sc, MX_ISR);
+		if (status)
+			CSR_WRITE_4(sc, MX_ISR, status);
+
+		if ((status & MX_INTRS) == 0)
+			break;
+
+		if (status & MX_ISR_TX_OK)
+			mx_txeof(sc);
+
+		if (status & MX_ISR_TX_NOBUF)
+			mx_txeoc(sc);
+
+		if (status & MX_ISR_TX_IDLE) {
+			mx_txeof(sc);
+			if (sc->mx_cdata.mx_tx_head != NULL) {
+				MX_SETBIT(sc, MX_NETCFG, MX_NETCFG_TX_ON);
+				CSR_WRITE_4(sc, MX_TXSTART, 0xFFFFFFFF);
+			}
+		}
+
+		if (status & MX_ISR_TX_UNDERRUN) {
+			u_int32_t		cfg;
+			cfg = CSR_READ_4(sc, MX_NETCFG);
+			if ((cfg & MX_NETCFG_TX_THRESH) == MX_TXTHRESH_160BYTES)
+				MX_SETBIT(sc, MX_NETCFG, MX_NETCFG_STORENFWD);
+			else
+				CSR_WRITE_4(sc, MX_NETCFG, cfg + 0x4000);
+		}
+
+		if (status & MX_ISR_RX_OK)
+			mx_rxeof(sc);
+
+		if ((status & MX_ISR_RX_WATDOGTIMEO)
+					|| (status & MX_ISR_RX_NOBUF))
+			mx_rxeoc(sc);
+
+		if (status & MX_ISR_BUS_ERR) {
+			mx_reset(sc);
+			mx_init(sc);
+		}
+	}
+
+	/* Re-enable interrupts. */
+	CSR_WRITE_4(sc, MX_IMR, MX_INTRS);
+
+	if (ifp->if_snd.ifq_head != NULL) {
+		mx_start(ifp);
+	}
+
+	return;
+}
+
+/*
+ * Encapsulate an mbuf chain in a descriptor by coupling the mbuf data
+ * pointers to the fragment pointers.
+ */
+static int mx_encap(sc, c, m_head)
+	struct mx_softc		*sc;
+	struct mx_chain		*c;
+	struct mbuf		*m_head;
+{
+	int			frag = 0;
+	volatile struct mx_desc	*f = NULL;
+	int			total_len;
+	struct mbuf		*m;
+
+	/*
+ 	 * Start packing the mbufs in this chain into
+	 * the fragment pointers. Stop when we run out
+ 	 * of fragments or hit the end of the mbuf chain.
+	 */
+	m = m_head;
+	total_len = 0;
+
+	for (m = m_head, frag = 0; m != NULL; m = m->m_next) {
+		if (m->m_len != 0) {
+			if (frag == MX_MAXFRAGS)
+				break;
+			total_len += m->m_len;
+			f = &c->mx_ptr->mx_frag[frag];
+			f->mx_ctl = MX_TXCTL_TLINK | m->m_len;
+			if (frag == 0) {
+				f->mx_status = 0;
+				f->mx_ctl |= MX_TXCTL_FIRSTFRAG;
+			} else
+				f->mx_status = MX_TXSTAT_OWN;
+			f->mx_next = vtophys(&c->mx_ptr->mx_frag[frag + 1]);
+			f->mx_data = vtophys(mtod(m, vm_offset_t));
+			frag++;
+		}
+	}
+
+	/*
+	 * Handle special case: we ran out of fragments,
+	 * but we have more mbufs left in the chain. Copy the
+	 * data into an mbuf cluster. Note that we don't
+	 * bother clearing the values in the other fragment
+	 * pointers/counters; it wouldn't gain us anything,
+	 * and would waste cycles.
+	 */
+	if (m != NULL) {
+		struct mbuf		*m_new = NULL;
+
+		MGETHDR(m_new, M_DONTWAIT, MT_DATA);
+		if (m_new == NULL) {
+			printf("mx%d: no memory for tx list", sc->mx_unit);
+			return(1);
+		}
+		if (m_head->m_pkthdr.len > MHLEN) {
+			MCLGET(m_new, M_DONTWAIT);
+			if (!(m_new->m_flags & M_EXT)) {
+				m_freem(m_new);
+				printf("mx%d: no memory for tx list",
+						sc->mx_unit);
+				return(1);
+			}
+		}
+		m_copydata(m_head, 0, m_head->m_pkthdr.len,	
+					mtod(m_new, caddr_t));
+		m_new->m_pkthdr.len = m_new->m_len = m_head->m_pkthdr.len;
+		m_freem(m_head);
+		m_head = m_new;
+		f = &c->mx_ptr->mx_frag[0];
+		f->mx_status = 0;
+		f->mx_data = vtophys(mtod(m_new, caddr_t));
+		f->mx_ctl = total_len = m_new->m_len;
+		f->mx_ctl |= MX_TXCTL_TLINK|MX_TXCTL_FIRSTFRAG;
+		frag = 1;
+	}
+
+
+	if (total_len < MX_MIN_FRAMELEN) {
+		f = &c->mx_ptr->mx_frag[frag];
+		f->mx_ctl = MX_MIN_FRAMELEN - total_len;
+		f->mx_data = vtophys(&sc->mx_cdata.mx_pad);
+		f->mx_ctl |= MX_TXCTL_TLINK;
+		f->mx_status = MX_TXSTAT_OWN;
+		frag++;
+	}
+
+	c->mx_mbuf = m_head;
+	c->mx_lastdesc = frag - 1;
+	MX_TXCTL(c) |= MX_TXCTL_LASTFRAG;
+	MX_TXNEXT(c) = vtophys(&c->mx_nextdesc->mx_ptr->mx_frag[0]);
+	return(0);
+}
+
+/*
+ * Main transmit routine. To avoid having to do mbuf copies, we put pointers
+ * to the mbuf data regions directly in the transmit lists. We also save a
+ * copy of the pointers since the transmit list fragment pointers are
+ * physical addresses.
+ */
+
+static void mx_start(ifp)
+	struct ifnet		*ifp;
+{
+	struct mx_softc		*sc;
+	struct mbuf		*m_head = NULL;
+	struct mx_chain		*cur_tx = NULL, *start_tx;
+
+	sc = ifp->if_softc;
+
+	if (sc->mx_autoneg) {
+		sc->mx_tx_pend = 1;
+		return;
+	}
+
+	/*
+	 * Check for an available queue slot. If there are none,
+	 * punt.
+	 */
+	if (sc->mx_cdata.mx_tx_free->mx_mbuf != NULL) {
+		ifp->if_flags |= IFF_OACTIVE;
+		return;
+	}
+
+	start_tx = sc->mx_cdata.mx_tx_free;
+
+	while(sc->mx_cdata.mx_tx_free->mx_mbuf == NULL) {
+		IF_DEQUEUE(&ifp->if_snd, m_head);
+		if (m_head == NULL)
+			break;
+
+		/* Pick a descriptor off the free list. */
+		cur_tx = sc->mx_cdata.mx_tx_free;
+		sc->mx_cdata.mx_tx_free = cur_tx->mx_nextdesc;
+
+		/* Pack the data into the descriptor. */
+		mx_encap(sc, cur_tx, m_head);
+		if (cur_tx != start_tx)
+			MX_TXOWN(cur_tx) = MX_TXSTAT_OWN;
+
+#if NBPFILTER > 0
+		/*
+		 * If there's a BPF listener, bounce a copy of this frame
+		 * to him.
+		 */
+		if (ifp->if_bpf)
+			bpf_mtap(ifp, cur_tx->mx_mbuf);
+#endif
+	}
+
+	/*
+	 * Place the request for the upload interrupt
+	 * in the last descriptor in the chain. This way, if
+	 * we're chaining several packets at once, we'll only
+	 * get an interupt once for the whole chain rather than
+	 * once for each packet.
+	 */
+	MX_TXCTL(cur_tx) |= MX_TXCTL_FINT;
+	sc->mx_cdata.mx_tx_tail = cur_tx;
+
+	if (sc->mx_cdata.mx_tx_head == NULL) {
+		sc->mx_cdata.mx_tx_head = start_tx;
+		MX_TXOWN(start_tx) = MX_TXSTAT_OWN;
+		CSR_WRITE_4(sc, MX_TXSTART, 0xFFFFFFFF);
+	} else {
+		MX_TXOWN(start_tx) = MX_UNSENT;
+	}
+
+	/*
+	 * Set a timeout in case the chip goes out to lunch.
+	 */
+	ifp->if_timer = 5;
+
+	return;
+}
+
+static void mx_init(xsc)
+	void			*xsc;
+{
+	struct mx_softc		*sc = xsc;
+	struct ifnet		*ifp = &sc->arpcom.ac_if;
+	u_int16_t		phy_bmcr = 0;
+	int			s;
+
+	if (sc->mx_autoneg)
+		return;
+
+	s = splimp();
+
+	if (sc->mx_pinfo != NULL)
+		phy_bmcr = mx_phy_readreg(sc, PHY_BMCR);
+
+	/*
+	 * Cancel pending I/O and free all RX/TX buffers.
+	 */
+	mx_stop(sc);
+	mx_reset(sc);
+
+	/*
+	 * Set cache alignment and burst length.
+	 */
+	CSR_WRITE_4(sc, MX_BUSCTL, MX_BUSCTL_CONFIG);
+
+	MX_SETBIT(sc, MX_NETCFG, MX_NETCFG_NO_RXCRC);
+	MX_CLRBIT(sc, MX_NETCFG, MX_NETCFG_HEARTBEAT);
+	MX_CLRBIT(sc, MX_NETCFG, MX_NETCFG_STORENFWD);
+	MX_CLRBIT(sc, MX_NETCFG, MX_NETCFG_TX_BACKOFF);
+
+	/*
+	 * The app notes for the 98713 and 98715A say that
+	 * in order to have the chips operate properly, a magic
+	 * number must be written to CSR16. Macronix does not
+	 * document the meaning of these bits so there's no way
+	 * to know exactly what they mean. The 98713 has a magic
+	 * number all its own; the rest all use a different one.
+	 */
+	MX_CLRBIT(sc, MX_MAGICPACKET, 0xFFFF0000);
+	if (sc->mx_type == MX_TYPE_98713)
+		MX_SETBIT(sc, MX_MAGICPACKET, MX_MAGIC_98713);
+	else
+		MX_SETBIT(sc, MX_MAGICPACKET, MX_MAGIC_98715);
+
+	if (sc->mx_pinfo != NULL) {
+		MX_SETBIT(sc, MX_WATCHDOG, MX_WDOG_JABBERDIS);
+		mx_setcfg(sc, mx_phy_readreg(sc, PHY_BMCR));
+	} else
+		mx_setmode(sc, sc->ifmedia.ifm_media, 0);
+
+	MX_CLRBIT(sc, MX_NETCFG, MX_NETCFG_TX_THRESH);
+	MX_CLRBIT(sc, MX_NETCFG, MX_NETCFG_SPEEDSEL);
+
+	if (IFM_SUBTYPE(sc->ifmedia.ifm_media) == IFM_10_T)
+		MX_SETBIT(sc, MX_NETCFG, MX_TXTHRESH_160BYTES);
+	else
+		MX_SETBIT(sc, MX_NETCFG, MX_TXTHRESH_72BYTES);
+
+	/* Init circular RX list. */
+	if (mx_list_rx_init(sc) == ENOBUFS) {
+		printf("mx%d: initialization failed: no "
+			"memory for rx buffers\n", sc->mx_unit);
+		mx_stop(sc);
+		(void)splx(s);
+		return;
+	}
+
+	/*
+	 * Init tx descriptors.
+	 */
+	mx_list_tx_init(sc);
+
+	/*
+	 * Load the address of the RX list.
+	 */
+	CSR_WRITE_4(sc, MX_RXADDR, vtophys(sc->mx_cdata.mx_rx_head->mx_ptr));
+
+	/*
+	 * Load the RX/multicast filter.
+	 */
+	mx_setfilt(sc);
+
+	/*
+	 * Enable interrupts.
+	 */
+	CSR_WRITE_4(sc, MX_IMR, MX_INTRS);
+	CSR_WRITE_4(sc, MX_ISR, 0xFFFFFFFF);
+
+	/* Enable receiver and transmitter. */
+	MX_SETBIT(sc, MX_NETCFG, MX_NETCFG_TX_ON|MX_NETCFG_RX_ON);
+	CSR_WRITE_4(sc, MX_RXSTART, 0xFFFFFFFF);
+
+	/* Restore state of BMCR */
+	if (sc->mx_pinfo != NULL)
+		mx_phy_writereg(sc, PHY_BMCR, phy_bmcr);
+
+	ifp->if_flags |= IFF_RUNNING;
+	ifp->if_flags &= ~IFF_OACTIVE;
+
+	(void)splx(s);
+
+	return;
+}
+
+/*
+ * Set media options.
+ */
+static int mx_ifmedia_upd(ifp)
+	struct ifnet		*ifp;
+{
+	struct mx_softc		*sc;
+	struct ifmedia		*ifm;
+
+	sc = ifp->if_softc;
+	ifm = &sc->ifmedia;
+
+	if (IFM_TYPE(ifm->ifm_media) != IFM_ETHER)
+		return(EINVAL);
+
+	if (sc->mx_type == MX_TYPE_98713 && sc->mx_pinfo != NULL) {
+		if (IFM_SUBTYPE(ifm->ifm_media) == IFM_AUTO)
+			mx_autoneg_mii(sc, MX_FLAG_SCHEDDELAY, 1);
+		else
+			mx_setmode_mii(sc, ifm->ifm_media);
+	} else {
+		if (IFM_SUBTYPE(ifm->ifm_media) == IFM_AUTO)
+			mx_autoneg(sc, MX_FLAG_SCHEDDELAY, 1);
+		else
+			mx_setmode(sc, ifm->ifm_media, 1);
+	}
+
+	return(0);
+}
+
+/*
+ * Report current media status.
+ */
+static void mx_ifmedia_sts(ifp, ifmr)
+	struct ifnet		*ifp;
+	struct ifmediareq	*ifmr;
+{
+	struct mx_softc		*sc;
+	u_int16_t		advert = 0, ability = 0;
+	u_int32_t		media = 0;
+
+	sc = ifp->if_softc;
+
+	ifmr->ifm_active = IFM_ETHER;
+
+	if (sc->mx_type != MX_TYPE_98713 || sc->mx_pinfo == NULL) {
+		media = CSR_READ_4(sc, MX_NETCFG);
+		if (media & MX_NETCFG_PORTSEL)
+			ifmr->ifm_active = IFM_ETHER|IFM_100_TX;
+		else
+			ifmr->ifm_active = IFM_ETHER|IFM_10_T;
+		if (media & MX_NETCFG_FULLDUPLEX)
+			ifmr->ifm_active |= IFM_FDX;
+		else
+			ifmr->ifm_active |= IFM_HDX;
+		return;
+	}
+
+	if (!(mx_phy_readreg(sc, PHY_BMCR) & PHY_BMCR_AUTONEGENBL)) {
+		if (mx_phy_readreg(sc, PHY_BMCR) & PHY_BMCR_SPEEDSEL)
+			ifmr->ifm_active = IFM_ETHER|IFM_100_TX;
+		else
+			ifmr->ifm_active = IFM_ETHER|IFM_10_T;
+		if (mx_phy_readreg(sc, PHY_BMCR) & PHY_BMCR_DUPLEX)
+			ifmr->ifm_active |= IFM_FDX;
+		else
+			ifmr->ifm_active |= IFM_HDX;
+		return;
+	}
+
+	ability = mx_phy_readreg(sc, PHY_LPAR);
+	advert = mx_phy_readreg(sc, PHY_ANAR);
+	if (advert & PHY_ANAR_100BT4 &&
+		ability & PHY_ANAR_100BT4) {
+		ifmr->ifm_active = IFM_ETHER|IFM_100_T4;
+	} else if (advert & PHY_ANAR_100BTXFULL &&
+		ability & PHY_ANAR_100BTXFULL) {
+		ifmr->ifm_active = IFM_ETHER|IFM_100_TX|IFM_FDX;
+	} else if (advert & PHY_ANAR_100BTXHALF &&
+		ability & PHY_ANAR_100BTXHALF) {
+		ifmr->ifm_active = IFM_ETHER|IFM_100_TX|IFM_HDX;
+	} else if (advert & PHY_ANAR_10BTFULL &&
+		ability & PHY_ANAR_10BTFULL) {
+		ifmr->ifm_active = IFM_ETHER|IFM_10_T|IFM_FDX;
+	} else if (advert & PHY_ANAR_10BTHALF &&
+		ability & PHY_ANAR_10BTHALF) {
+		ifmr->ifm_active = IFM_ETHER|IFM_10_T|IFM_HDX;
+	}
+
+	return;
+}
+
+static int mx_ioctl(ifp, command, data)
+	struct ifnet		*ifp;
+	u_long			command;
+	caddr_t			data;
+{
+	struct mx_softc		*sc = ifp->if_softc;
+	struct ifreq		*ifr = (struct ifreq *) data;
+	int			s, error = 0;
+
+	s = splimp();
+
+	switch(command) {
+	case SIOCSIFADDR:
+	case SIOCGIFADDR:
+	case SIOCSIFMTU:
+		error = ether_ioctl(ifp, command, data);
+		break;
+	case SIOCSIFFLAGS:
+		if (ifp->if_flags & IFF_UP) {
+			mx_init(sc);
+		} else {
+			if (ifp->if_flags & IFF_RUNNING)
+				mx_stop(sc);
+		}
+		error = 0;
+		break;
+	case SIOCADDMULTI:
+	case SIOCDELMULTI:
+		mx_init(sc);
+		error = 0;
+		break;
+	case SIOCGIFMEDIA:
+	case SIOCSIFMEDIA:
+		error = ifmedia_ioctl(ifp, ifr, &sc->ifmedia, command);
+		break;
+	default:
+		error = EINVAL;
+		break;
+	}
+
+	(void)splx(s);
+
+	return(error);
+}
+
+static void mx_watchdog(ifp)
+	struct ifnet		*ifp;
+{
+	struct mx_softc		*sc;
+
+	sc = ifp->if_softc;
+
+	if (sc->mx_autoneg) {
+		if (sc->mx_type == MX_TYPE_98713 && sc->mx_pinfo != NULL)
+			mx_autoneg_mii(sc, MX_FLAG_DELAYTIMEO, 1);
+		else
+			mx_autoneg(sc, MX_FLAG_DELAYTIMEO, 1);
+		return;
+	}
+
+	ifp->if_oerrors++;
+	printf("mx%d: watchdog timeout\n", sc->mx_unit);
+
+	if (sc->mx_pinfo == NULL) {
+		if (!(CSR_READ_4(sc, MX_10BTSTAT) & MX_TSTAT_LS10) ||
+			!(CSR_READ_4(sc, MX_10BTSTAT) & MX_TSTAT_LS100))
+			printf("mx%d: no carrier - transceiver "
+				"cable problem?\n", sc->mx_unit);
+	} else {
+		if (!(mx_phy_readreg(sc, PHY_BMSR) & PHY_BMSR_LINKSTAT))
+			printf("mx%d: no carrier - transceiver "
+				"cable problem?\n", sc->mx_unit);
+	}
+
+	mx_stop(sc);
+	mx_reset(sc);
+	mx_init(sc);
+
+	if (ifp->if_snd.ifq_head != NULL)
+		mx_start(ifp);
+
+	return;
+}
+
+/*
+ * Stop the adapter and free any mbufs allocated to the
+ * RX and TX lists.
+ */
+static void mx_stop(sc)
+	struct mx_softc		*sc;
+{
+	register int		i;
+	struct ifnet		*ifp;
+
+	ifp = &sc->arpcom.ac_if;
+	ifp->if_timer = 0;
+
+	MX_CLRBIT(sc, MX_NETCFG, (MX_NETCFG_RX_ON|MX_NETCFG_TX_ON));
+	CSR_WRITE_4(sc, MX_IMR, 0x00000000);
+	CSR_WRITE_4(sc, MX_TXADDR, 0x00000000);
+	CSR_WRITE_4(sc, MX_RXADDR, 0x00000000);
+
+	/*
+	 * Free data in the RX lists.
+	 */
+	for (i = 0; i < MX_RX_LIST_CNT; i++) {
+		if (sc->mx_cdata.mx_rx_chain[i].mx_mbuf != NULL) {
+			m_freem(sc->mx_cdata.mx_rx_chain[i].mx_mbuf);
+			sc->mx_cdata.mx_rx_chain[i].mx_mbuf = NULL;
+		}
+	}
+	bzero((char *)&sc->mx_ldata->mx_rx_list,
+		sizeof(sc->mx_ldata->mx_rx_list));
+
+	/*
+	 * Free the TX list buffers.
+	 */
+	for (i = 0; i < MX_TX_LIST_CNT; i++) {
+		if (sc->mx_cdata.mx_tx_chain[i].mx_mbuf != NULL) {
+			m_freem(sc->mx_cdata.mx_tx_chain[i].mx_mbuf);
+			sc->mx_cdata.mx_tx_chain[i].mx_mbuf = NULL;
+		}
+	}
+
+	bzero((char *)&sc->mx_ldata->mx_tx_list,
+		sizeof(sc->mx_ldata->mx_tx_list));
+
+	ifp->if_flags &= ~(IFF_RUNNING | IFF_OACTIVE);
+
+	return;
+}
+
+/*
+ * Stop all chip I/O so that the kernel's probe routines don't
+ * get confused by errant DMAs when rebooting.
+ */
+static void mx_shutdown(howto, arg)
+	int			howto;
+	void			*arg;
+{
+	struct mx_softc		*sc = (struct mx_softc *)arg;
+
+	mx_stop(sc);
+
+	return;
+}
+
+static struct pci_device mx_device = {
+	"mx",
+	mx_probe,
+	mx_attach,
+	&mx_count,
+	NULL
+};
+DATA_SET(pcidevice_set, mx_device);
diff --git a/sys/pci/if_mxreg.h b/sys/pci/if_mxreg.h
new file mode 100644
index 0000000..80e0f19
--- /dev/null
+++ b/sys/pci/if_mxreg.h
@@ -0,0 +1,695 @@
+/*
+ * Copyright (c) 1997, 1998
+ *	Bill Paul <wpaul@ctr.columbia.edu>.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ * 3. All advertising materials mentioning features or use of this software
+ *    must display the following acknowledgement:
+ *	This product includes software developed by Bill Paul.
+ * 4. Neither the name of the author nor the names of any co-contributors
+ *    may be used to endorse or promote products derived from this software
+ *    without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY Bill Paul AND CONTRIBUTORS ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL Bill Paul OR THE VOICES IN HIS HEAD
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ *
+ *	$Id: if_mxreg.h,v 1.11 1998/12/01 15:55:20 wpaul Exp $
+ */
+
+/*
+ * Macronix register definitions.
+ */
+
+#define MX_BUSCTL		0x00	/* bus control */
+#define MX_TXSTART		0x08	/* tx start demand */
+#define MX_RXSTART		0x10	/* rx start demand */
+#define MX_RXADDR		0x18	/* rx descriptor list start addr */
+#define MX_TXADDR		0x20	/* tx descriptor list start addr */
+#define MX_ISR			0x28	/* interrupt status register */
+#define MX_NETCFG		0x30	/* network config register */
+#define MX_IMR			0x38	/* interrupt mask */
+#define MX_FRAMESDISCARDED	0x40	/* # of discarded frames */
+#define MX_SIO			0x48	/* MII and ROM/EEPROM access */
+#define MX_RESERVED		0x50
+#define MX_TIMER		0x58	/* general timer */
+#define MX_10BTSTAT		0x60
+#define MX_SIARESET		0x68
+#define MX_10BTCTRL		0x70
+#define MX_WATCHDOG		0x78
+#define MX_MAGICPACKET		0x80
+#define MX_NWAYSTAT		0xA0
+
+/*
+ * These are magic values that must be written into CSR16
+ * (MX_MAGICPACKET) in order to put the chip into proper
+ * operating mode. The magic numbers are documented in the
+ * Macronix 98715 application notes.
+ */
+#define MX_MAGIC_98713		0x0F370000
+#define MX_MAGIC_98713A		0x0B3C0000
+#define MX_MAGIC_98715		0x0B3C0000
+#define MX_MAGIC_98725		0x0B3C0000
+
+#define MX_REVISION_98713	0x10
+#define MX_REVISION_98715	0x20
+#define MX_REVISION_98725	0x30
+
+/*
+ * As far as the driver is concerned, there are two 'types' of
+ * chips to be concerned with. One is a 98713 with an external
+ * PHY on the MII. The other covers pretty much everything else,
+ * since all the other Macronix chips have built-in transceivers.
+ * This type setting governs what which mode selection routines
+ * we use (MII or built-in). It also govers which of the 'magic'
+ * numbers we write into CSR16.
+ */
+#define MX_TYPE_98713		0x1
+#define MX_TYPE_987x5		0x2
+
+/*
+ * Bus control bits.
+ */
+#define MX_BUSCTL_RESET		0x00000001
+#define MX_BUSCTL_ARBITRATION	0x00000002
+#define MX_BUSCTL_SKIPLEN	0x0000007C
+#define MX_BUSCTL_BUF_BIGENDIAN	0x00000080
+#define MX_BUSCTL_BURSTLEN	0x00003F00
+#define MX_BUSCTL_CACHEALIGN	0x0000C000
+#define MX_BUSCTL_XMITPOLL	0x00060000
+
+#define MX_SKIPLEN_1LONG	0x00000004
+#define MX_SKIPLEN_2LONG	0x00000008
+#define MX_SKIPLEN_3LONG	0x00000010
+#define MX_SKIPLEN_4LONG	0x00000020
+#define MX_SKIPLEN_5LONG	0x00000040
+
+#define MX_CACHEALIGN_8LONG	0x00004000
+#define MX_CACHEALIGN_16LONG	0x00008000
+#define MX_CACHEALIGN_32LONG	0x0000C000
+
+#define MX_BURSTLEN_USECA	0x00000000
+#define MX_BURSTLEN_1LONG	0x00000100
+#define MX_BURSTLEN_2LONG	0x00000200
+#define MX_BURSTLEN_4LONG	0x00000400
+#define MX_BURSTLEN_8LONG	0x00000800
+#define MX_BURSTLEN_16LONG	0x00001000
+#define MX_BURSTLEN_32LONG	0x00002000
+
+#define MX_TXPOLL_OFF		0x00000000
+#define MX_TXPOLL_200U		0x00020000
+#define MX_TXPOLL_800U		0x00040000
+#define MX_TXPOLL_1600U		0x00060000
+
+#define MX_BUSCTL_CONFIG	(MX_BUSCTL_ARBITRATION|MX_CACHEALIGN_8LONG| \
+					MX_BURSTLEN_8LONG)
+
+/*
+ * Interrupt status bits.
+ */
+#define MX_ISR_TX_OK		0x00000001
+#define MX_ISR_TX_IDLE		0x00000002
+#define MX_ISR_TX_NOBUF		0x00000004
+#define MX_ISR_TX_JABBERTIMEO	0x00000008
+#define MX_ISR_LINKGOOD		0x00000010
+#define MX_ISR_TX_UNDERRUN	0x00000020
+#define MX_ISR_RX_OK		0x00000040
+#define MX_ISR_RX_NOBUF		0x00000080
+#define MX_ISR_RX_READ		0x00000100
+#define MX_ISR_RX_WATDOGTIMEO	0x00000200
+#define MX_ISR_TX_EARLY		0x00000400
+#define MX_ISR_TIMER_EXPIRED	0x00000800
+#define MX_ISR_LINKFAIL		0x00001000
+#define MX_ISR_BUS_ERR		0x00002000
+#define MX_ISR_RX_EARLY		0x00004000
+#define MX_ISR_ABNORMAL		0x00008000
+#define MX_ISR_NORMAL		0x00010000
+#define MX_ISR_RX_STATE		0x000E0000
+#define MX_ISR_TX_STATE		0x00700000
+#define MX_ISR_BUSERRTYPE	0x03800000
+#define MX_ISR_100MBPSLINK	0x08000000
+#define MX_ISR_MAGICKPACK	0x10000000
+
+#define MX_RXSTATE_STOPPED	0x00000000	/* 000 - Stopped */
+#define MX_RXSTATE_FETCH	0x00020000	/* 001 - Fetching descriptor */
+#define MX_RXSTATE_ENDCHECK	0x00040000	/* 010 - check for rx end */
+#define MX_RXSTATE_WAIT		0x00060000	/* 011 - waiting for packet */
+#define MX_RXSTATE_SUSPEND	0x00080000	/* 100 - suspend rx */
+#define MX_RXSTATE_CLOSE	0x000A0000	/* 101 - close tx desc */
+#define MX_RXSTATE_FLUSH	0x000C0000	/* 110 - flush from FIFO */
+#define MX_RXSTATE_DEQUEUE	0x000E0000	/* 111 - dequeue from FIFO */
+
+#define MX_TXSTATE_RESET	0x00000000	/* 000 - reset */
+#define MX_TXSTATE_FETCH	0x00100000	/* 001 - fetching descriptor */
+#define MX_TXSTATE_WAITEND	0x00200000	/* 010 - wait for tx end */
+#define MX_TXSTATE_READING	0x00300000	/* 011 - read and enqueue */
+#define MX_TXSTATE_RSVD		0x00400000	/* 100 - reserved */
+#define MX_TXSTATE_SETUP	0x00500000	/* 101 - setup packet */
+#define MX_TXSTATE_SUSPEND	0x00600000	/* 110 - suspend tx */
+#define MX_TXSTATE_CLOSE	0x00700000	/* 111 - close tx desc */
+
+/*
+ * Network config bits.
+ */
+#define MX_NETCFG_RX_HASHPERF	0x00000001
+#define MX_NETCFG_RX_ON		0x00000002
+#define MX_NETCFG_RX_HASHONLY	0x00000004
+#define MX_NETCFG_RX_BADFRAMES	0x00000008
+#define MX_NETCFG_RX_INVFILT	0x00000010
+#define MX_NETCFG_BACKOFFCNT	0x00000020
+#define MX_NETCFG_RX_PROMISC	0x00000040
+#define MX_NETCFG_RX_ALLMULTI	0x00000080
+#define MX_NETCFG_FULLDUPLEX	0x00000200
+#define MX_NETCFG_LOOPBACK	0x00000C00
+#define MX_NETCFG_FORCECOLL	0x00001000
+#define MX_NETCFG_TX_ON		0x00002000
+#define MX_NETCFG_TX_THRESH	0x0000C000
+#define MX_NETCFG_TX_BACKOFF	0x00020000
+#define MX_NETCFG_PORTSEL	0x00040000	/* 0 == 10, 1 == 100 */
+#define MX_NETCFG_HEARTBEAT	0x00080000
+#define MX_NETCFG_STORENFWD	0x00200000
+#define MX_NETCFG_SPEEDSEL	0x00400000	/* 1 == 10, 0 == 100 */
+#define MX_NETCFG_PCS		0x00800000
+#define MX_NETCFG_SCRAMBLER	0x01000000
+#define MX_NETCFG_NO_RXCRC	0x02000000
+
+#define MX_OPMODE_NORM		0x00000000
+#define MX_OPMODE_INTLOOP	0x00000400
+#define MX_OPMODE_EXTLOOP	0x00000800
+
+#define MX_TXTHRESH_72BYTES	0x00000000
+#define MX_TXTHRESH_96BYTES	0x00004000
+#define MX_TXTHRESH_128BYTES	0x00008000
+#define MX_TXTHRESH_160BYTES	0x0000C000
+
+
+/*
+ * Interrupt mask bits.
+ */
+#define MX_IMR_TX_OK		0x00000001
+#define MX_IMR_TX_IDLE		0x00000002
+#define MX_IMR_TX_NOBUF		0x00000004
+#define MX_IMR_TX_JABBERTIMEO	0x00000008
+#define MX_IMR_LINKGOOD		0x00000010
+#define MX_IMR_TX_UNDERRUN	0x00000020
+#define MX_IMR_RX_OK		0x00000040
+#define MX_IMR_RX_NOBUF		0x00000080
+#define MX_IMR_RX_READ		0x00000100
+#define MX_IMR_RX_WATDOGTIMEO	0x00000200
+#define MX_IMR_TX_EARLY		0x00000400
+#define MX_IMR_TIMER_EXPIRED	0x00000800
+#define MX_IMR_LINKFAIL		0x00001000
+#define MX_IMR_BUS_ERR		0x00002000
+#define MX_IMR_RX_EARLY		0x00004000
+#define MX_IMR_ABNORMAL		0x00008000
+#define MX_IMR_NORMAL		0x00010000
+#define MX_IMR_100MBPSLINK	0x08000000
+#define MX_IMR_MAGICKPACK	0x10000000
+
+#define MX_INTRS	\
+	(MX_IMR_RX_OK|MX_IMR_TX_OK|MX_IMR_RX_NOBUF|MX_IMR_RX_WATDOGTIMEO|\
+	MX_IMR_TX_NOBUF|MX_IMR_TX_UNDERRUN|MX_IMR_BUS_ERR|		\
+	MX_IMR_ABNORMAL|MX_IMR_NORMAL/*|MX_IMR_TX_EARLY*/)
+/*
+ * Serial I/O (EEPROM/ROM) bits.
+ */
+#define MX_SIO_EE_CS		0x00000001	/* EEPROM chip select */
+#define MX_SIO_EE_CLK		0x00000002	/* EEPROM clock */
+#define MX_SIO_EE_DATAIN	0x00000004	/* EEPROM data output */
+#define MX_SIO_EE_DATAOUT	0x00000008	/* EEPROM data input */
+#define MX_SIO_ROMDATA4		0x00000010
+#define MX_SIO_ROMDATA5		0x00000020
+#define MX_SIO_ROMDATA6		0x00000040
+#define MX_SIO_ROMDATA7		0x00000080
+#define MX_SIO_EESEL		0x00000800
+#define MX_SIO_ROMSEL		0x00001000
+#define MX_SIO_ROMCTL_WRITE	0x00002000
+#define MX_SIO_ROMCTL_READ	0x00004000
+#define MX_SIO_MII_CLK		0x00010000	/* MDIO clock */
+#define MX_SIO_MII_DATAOUT	0x00020000	/* MDIO data out */
+#define MX_SIO_MII_DIR		0x00040000	/* MDIO dir */
+#define MX_SIO_MII_DATAIN	0x00080000	/* MDIO data in */
+
+#define MX_EECMD_WRITE		0x140
+#define MX_EECMD_READ		0x180
+#define MX_EECMD_ERASE		0x1c0
+
+#define MX_EE_NODEADDR_OFFSET	0x70
+#define MX_EE_NODEADDR		10
+
+/*
+ * General purpose timer register
+ */
+#define MX_TIMER_VALUE		0x0000FFFF
+#define MX_TIMER_CONTINUUS	0x00010000
+
+/*
+ * 10baseT status register
+ */
+#define MX_TSTAT_LS100		0x00000002 /* link status of 100baseTX */
+#define MX_TSTAT_LS10		0x00000004 /* link status of 10baseT */
+#define MX_TSTAT_AUTOPOLARITY	0x00000008
+#define MX_TSTAT_REMFAULT	0x00000800
+#define MX_TSTAT_ANEGSTAT	0x00007000
+#define MX_TSTAT_LP_CAN_NWAY	0x00008000 /* link partner supports NWAY */
+#define MX_TSTAT_LPCODEWORD	0xFFFF0000 /* link partner's code word */
+
+#define MX_ASTAT_DISABLE	0x00000000
+#define MX_ASTAT_TXDISABLE	0x00001000
+#define MX_ASTAT_ABDETECT	0x00002000
+#define MX_ASTAT_ACKDETECT	0x00003000
+#define MX_ASTAT_CMPACKDETECT	0x00004000
+#define MX_ASTAT_AUTONEGCMP	0x00005000
+#define MX_ASTAT_LINKCHECK	0x00006000
+
+/*
+ * PHY reset register
+ */
+#define MX_SIA_RESET_NWAY	0x00000001
+#define MX_SIA_RESET_100TX	0x00000002
+
+/*
+ * 10baseT control register
+ */
+#define MX_TCTL_LOOPBACK	0x00000002
+#define MX_TCTL_POWERDOWN	0x00000004
+#define MX_TCTL_HALFDUPLEX	0x00000040
+#define MX_TCTL_AUTONEGENBL	0x00000080
+#define MX_TCTL_RX_SQUELCH	0x00000100
+#define MX_TCTL_LINKTEST	0x00001000
+#define MX_TCTL_100BTXHALF	0x00010000
+#define MX_TCTL_100BTXFULL	0x00020000
+#define MX_TCTL_100BT4		0x00040000
+
+/*
+ * Watchdog timer register
+ */
+#define MX_WDOG_JABBERDIS	0x00000001
+#define MX_WDOG_HOSTUNJAB	0x00000002
+#define MX_WDOG_JABBERCLK	0x00000004
+#define MX_WDOG_RXWDOGDIS	0x00000010
+#define MX_WDOG_RXWDOGCLK	0x00000020
+#define MX_WDOG_MUSTBEZERO	0x00000100
+
+/*
+ * Magic packet register
+ */
+#define MX_MPACK_DISABLE	0x00400000
+
+/*
+ * NWAY status register.
+ */
+#define MX_NWAY_10BTHALF	0x08000000
+#define MX_NWAY_10BTFULL	0x10000000
+#define MX_NWAY_100BTHALF	0x20000000
+#define MX_NWAY_100BTFULL	0x40000000
+#define MX_NWAY_100BT4		0x80000000
+
+/*
+ * Size of a setup frame.
+ */
+#define MX_SFRAME_LEN		192
+
+/*
+ * Macronix TX/RX list structure.
+ */
+
+struct mx_desc {
+	volatile u_int32_t	mx_status;
+	volatile u_int32_t	mx_ctl;
+	volatile u_int32_t	mx_ptr1;
+	volatile u_int32_t	mx_ptr2;
+};
+
+#define mx_data		mx_ptr1
+#define mx_next		mx_ptr2
+
+#define MX_RXSTAT_FIFOOFLOW	0x00000001
+#define MX_RXSTAT_CRCERR	0x00000002
+#define MX_RXSTAT_DRIBBLE	0x00000004
+#define MX_RXSTAT_WATCHDOG	0x00000010
+#define MX_RXSTAT_FRAMETYPE	0x00000020	/* 0 == IEEE 802.3 */
+#define MX_RXSTAT_COLLSEEN	0x00000040
+#define MX_RXSTAT_GIANT		0x00000080
+#define MX_RXSTAT_LASTFRAG	0x00000100
+#define MX_RXSTAT_FIRSTFRAG	0x00000200
+#define MX_RXSTAT_MULTICAST	0x00000400
+#define MX_RXSTAT_RUNT		0x00000800
+#define MX_RXSTAT_RXTYPE	0x00003000
+#define MX_RXSTAT_RXERR		0x00008000
+#define MX_RXSTAT_RXLEN		0x3FFF0000
+#define MX_RXSTAT_OWN		0x80000000
+
+#define MX_RXBYTES(x)		((x & MX_RXSTAT_RXLEN) >> 16)
+#define MX_RXSTAT (MX_RXSTAT_FIRSTFRAG|MX_RXSTAT_LASTFRAG|MX_RXSTAT_OWN)
+
+#define MX_RXCTL_BUFLEN1	0x00000FFF
+#define MX_RXCTL_BUFLEN2	0x00FFF000
+#define MX_RXCTL_RLINK		0x01000000
+#define MX_RXCTL_RLAST		0x02000000
+
+#define MX_TXSTAT_DEFER		0x00000001
+#define MX_TXSTAT_UNDERRUN	0x00000002
+#define MX_TXSTAT_LINKFAIl	0x00000003
+#define MX_TXSTAT_COLLCNT	0x00000078
+#define MX_TXSTAT_SQE		0x00000080
+#define MX_TXSTAT_EXCESSCOLL	0x00000100
+#define MX_TXSTAT_LATECOLL	0x00000200
+#define MX_TXSTAT_NOCARRIER	0x00000400
+#define MX_TXSTAT_CARRLOST	0x00000800
+#define MX_TXSTAT_JABTIMEO	0x00004000
+#define MX_TXSTAT_ERRSUM	0x00008000
+#define MX_TXSTAT_OWN		0x80000000
+
+#define MX_TXCTL_BUFLEN1	0x000007FF
+#define MX_TXCTL_BUFLEN2	0x003FF800
+#define MX_TXCTL_FILTTYPE0	0x00400000
+#define MX_TXCTL_PAD		0x00800000
+#define MX_TXCTL_TLINK		0x01000000
+#define MX_TXCTL_TLAST		0x02000000
+#define MX_TXCTL_NOCRC		0x04000000
+#define MX_TXCTL_SETUP		0x08000000
+#define MX_TXCTL_FILTTYPE1	0x10000000
+#define MX_TXCTL_FIRSTFRAG	0x20000000
+#define MX_TXCTL_LASTFRAG	0x40000000
+#define MX_TXCTL_FINT		0x80000000
+
+#define MX_FILTER_PERFECT	0x00000000
+#define MX_FILTER_HASHPERF	0x00400000
+#define MX_FILTER_INVERSE	0x10000000
+#define MX_FILTER_HASHONLY	0x10400000
+
+#define MX_MAXFRAGS		16
+#define MX_RX_LIST_CNT		64
+#define MX_TX_LIST_CNT		64
+#define MX_MIN_FRAMELEN		60
+
+/*
+ * A tx 'super descriptor' is actually 16 regular descriptors
+ * back to back.
+ */
+struct mx_txdesc {
+	volatile struct mx_desc	mx_frag[MX_MAXFRAGS];
+};
+
+#define MX_TXNEXT(x)	x->mx_ptr->mx_frag[x->mx_lastdesc].mx_next
+#define MX_TXSTATUS(x)	x->mx_ptr->mx_frag[x->mx_lastdesc].mx_status
+#define MX_TXCTL(x)	x->mx_ptr->mx_frag[x->mx_lastdesc].mx_ctl
+#define MX_TXDATA(x)	x->mx_ptr->mx_frag[x->mx_lastdesc].mx_data
+
+#define MX_TXOWN(x)	x->mx_ptr->mx_frag[0].mx_status
+
+#define MX_UNSENT	0x12341234
+
+struct mx_list_data {
+	volatile struct mx_desc		mx_rx_list[MX_RX_LIST_CNT];
+	volatile struct mx_txdesc	mx_tx_list[MX_TX_LIST_CNT];
+};
+
+struct mx_chain {
+	volatile struct mx_txdesc	*mx_ptr;
+	struct mbuf			*mx_mbuf;
+	struct mx_chain			*mx_nextdesc;
+	u_int8_t			mx_lastdesc;
+};
+
+struct mx_chain_onefrag {
+	volatile struct mx_desc	*mx_ptr;
+	struct mbuf		*mx_mbuf;
+	struct mx_chain_onefrag	*mx_nextdesc;
+};
+
+struct mx_chain_data {
+	struct mx_desc		mx_sframe;
+	u_int32_t		mx_sbuf[MX_SFRAME_LEN/sizeof(u_int32_t)];
+	u_int8_t		mx_pad[MX_MIN_FRAMELEN];
+	struct mx_chain_onefrag	mx_rx_chain[MX_RX_LIST_CNT];
+	struct mx_chain		mx_tx_chain[MX_TX_LIST_CNT];
+
+	struct mx_chain_onefrag	*mx_rx_head;
+
+	struct mx_chain		*mx_tx_head;
+	struct mx_chain		*mx_tx_tail;
+	struct mx_chain		*mx_tx_free;
+};
+
+struct mx_type {
+	u_int16_t		mx_vid;
+	u_int16_t		mx_did;
+	char			*mx_name;
+};
+
+struct mx_mii_frame {
+	u_int8_t		mii_stdelim;
+	u_int8_t		mii_opcode;
+	u_int8_t		mii_phyaddr;
+	u_int8_t		mii_regaddr;
+	u_int8_t		mii_turnaround;
+	u_int16_t		mii_data;
+};
+
+/*
+ * MII constants
+ */
+#define MX_MII_STARTDELIM	0x01
+#define MX_MII_READOP		0x02
+#define MX_MII_WRITEOP		0x01
+#define MX_MII_TURNAROUND	0x02
+
+#define MX_FLAG_FORCEDELAY	1
+#define MX_FLAG_SCHEDDELAY	2
+#define MX_FLAG_DELAYTIMEO	3	
+
+struct mx_softc {
+	struct arpcom		arpcom;		/* interface info */
+	struct ifmedia		ifmedia;	/* media info */
+	bus_space_handle_t	mx_bhandle;	/* bus space handle */
+	bus_space_tag_t		mx_btag;	/* bus space tag */
+	struct mx_type		*mx_info;	/* Macronix adapter info */
+	struct mx_type		*mx_pinfo;	/* phy info */
+	u_int8_t		mx_unit;	/* interface number */
+	u_int8_t		mx_type;
+	u_int8_t		mx_phy_addr;	/* PHY address */
+	u_int8_t		mx_tx_pend;	/* TX pending */
+	u_int8_t		mx_want_auto;
+	u_int8_t		mx_autoneg;
+	u_int8_t		mx_singlebuf;
+	caddr_t			mx_ldata_ptr;
+	struct mx_list_data	*mx_ldata;
+	struct mx_chain_data	mx_cdata;
+};
+
+/*
+ * register space access macros
+ */
+#define CSR_WRITE_4(sc, reg, val)	\
+	bus_space_write_4(sc->mx_btag, sc->mx_bhandle, reg, val)
+#define CSR_WRITE_2(sc, reg, val)	\
+	bus_space_write_2(sc->mx_btag, sc->mx_bbhandle, reg, val)
+#define CSR_WRITE_1(sc, reg, val)	\
+	bus_space_write_1(sc->mx_btag, sc->mx_bhandle, reg, val)
+
+#define CSR_READ_4(sc, reg)		\
+	bus_space_read_4(sc->mx_btag, sc->mx_bhandle, reg)
+#define CSR_READ_2(sc, reg)		\
+	bus_space_read_2(sc->mx_btag, sc->mx_bhandle, reg)
+#define CSR_READ_1(sc, reg)		\
+	bus_space_read_1(sc->mx_btag, sc->mx_bhandle, reg)
+
+#define MX_TIMEOUT		1000
+
+/*
+ * General constants that are fun to know.
+ *
+ * Macronix PCI vendor ID
+ */
+#define	MX_VENDORID		0x10D9
+
+/*
+ * Macronix PMAC device IDs.
+ */
+#define MX_DEVICEID_98713	0x0512
+#define MX_DEVICEID_987x5	0x0531
+
+/*
+ * Texas Instruments PHY identifiers
+ */
+#define TI_PHY_VENDORID		0x4000
+#define TI_PHY_10BT		0x501F
+#define TI_PHY_100VGPMI		0x502F
+
+/*
+ * These ID values are for the NS DP83840A 10/100 PHY
+ */
+#define NS_PHY_VENDORID		0x2000
+#define NS_PHY_83840A		0x5C0F
+
+/*
+ * Level 1 10/100 PHY
+ */
+#define LEVEL1_PHY_VENDORID	0x7810
+#define LEVEL1_PHY_LXT970	0x000F
+
+/*
+ * Intel 82555 10/100 PHY
+ */
+#define INTEL_PHY_VENDORID	0x0A28
+#define INTEL_PHY_82555		0x015F
+
+/*
+ * SEEQ 80220 10/100 PHY
+ */
+#define SEEQ_PHY_VENDORID	0x0016
+#define SEEQ_PHY_80220		0xF83F
+
+
+/*
+ * PCI low memory base and low I/O base register, and
+ * other PCI registers.
+ */
+
+#define MX_PCI_VENDOR_ID	0x00
+#define MX_PCI_DEVICE_ID	0x02
+#define MX_PCI_COMMAND		0x04
+#define MX_PCI_STATUS		0x06
+#define MX_PCI_REVID		0x08
+#define MX_PCI_CLASSCODE	0x09
+#define MX_PCI_LATENCY_TIMER	0x0D
+#define MX_PCI_HEADER_TYPE	0x0E
+#define MX_PCI_LOIO		0x10
+#define MX_PCI_LOMEM		0x14
+#define MX_PCI_BIOSROM		0x30
+#define MX_PCI_INTLINE		0x3C
+#define MX_PCI_INTPIN		0x3D
+#define MX_PCI_MINGNT		0x3E
+#define MX_PCI_MINLAT		0x0F
+#define MX_PCI_RESETOPT		0x48
+#define MX_PCI_EEPROM_DATA	0x4C
+
+/* power management registers */
+#define MX_PCI_CAPID		0x44 /* 8 bits */
+#define MX_PCI_NEXTPTR		0x45 /* 8 bits */
+#define MX_PCI_PWRMGMTCAP	0x46 /* 16 bits */
+#define MX_PCI_PWRMGMTCTRL	0x48 /* 16 bits */
+
+#define MX_PSTATE_MASK		0x0003
+#define MX_PSTATE_D0		0x0000
+#define MX_PSTATE_D1		0x0001
+#define MX_PSTATE_D2		0x0002
+#define MX_PSTATE_D3		0x0003
+#define MX_PME_EN		0x0010
+#define MX_PME_STATUS		0x8000
+
+#define PHY_UNKNOWN		6
+
+#define MX_PHYADDR_MIN		0x00
+#define MX_PHYADDR_MAX		0x1F
+
+#define PHY_BMCR		0x00
+#define PHY_BMSR		0x01
+#define PHY_VENID		0x02
+#define PHY_DEVID		0x03
+#define PHY_ANAR		0x04
+#define PHY_LPAR		0x05
+#define PHY_ANEXP		0x06
+
+#define PHY_ANAR_NEXTPAGE	0x8000
+#define PHY_ANAR_RSVD0		0x4000
+#define PHY_ANAR_TLRFLT		0x2000
+#define PHY_ANAR_RSVD1		0x1000
+#define PHY_ANAR_RSVD2		0x0800
+#define PHY_ANAR_RSVD3		0x0400
+#define PHY_ANAR_100BT4		0x0200
+#define PHY_ANAR_100BTXFULL	0x0100
+#define PHY_ANAR_100BTXHALF	0x0080
+#define PHY_ANAR_10BTFULL	0x0040
+#define PHY_ANAR_10BTHALF	0x0020
+#define PHY_ANAR_PROTO4		0x0010
+#define PHY_ANAR_PROTO3		0x0008
+#define PHY_ANAR_PROTO2		0x0004
+#define PHY_ANAR_PROTO1		0x0002
+#define PHY_ANAR_PROTO0		0x0001
+
+/*
+ * These are the register definitions for the PHY (physical layer
+ * interface chip).
+ */
+/*
+ * PHY BMCR Basic Mode Control Register
+ */
+#define PHY_BMCR_RESET			0x8000
+#define PHY_BMCR_LOOPBK			0x4000
+#define PHY_BMCR_SPEEDSEL		0x2000
+#define PHY_BMCR_AUTONEGENBL		0x1000
+#define PHY_BMCR_RSVD0			0x0800	/* write as zero */
+#define PHY_BMCR_ISOLATE		0x0400
+#define PHY_BMCR_AUTONEGRSTR		0x0200
+#define PHY_BMCR_DUPLEX			0x0100
+#define PHY_BMCR_COLLTEST		0x0080
+#define PHY_BMCR_RSVD1			0x0040	/* write as zero, don't care */
+#define PHY_BMCR_RSVD2			0x0020	/* write as zero, don't care */
+#define PHY_BMCR_RSVD3			0x0010	/* write as zero, don't care */
+#define PHY_BMCR_RSVD4			0x0008	/* write as zero, don't care */
+#define PHY_BMCR_RSVD5			0x0004	/* write as zero, don't care */
+#define PHY_BMCR_RSVD6			0x0002	/* write as zero, don't care */
+#define PHY_BMCR_RSVD7			0x0001	/* write as zero, don't care */
+/*
+ * RESET: 1 == software reset, 0 == normal operation
+ * Resets status and control registers to default values.
+ * Relatches all hardware config values.
+ *
+ * LOOPBK: 1 == loopback operation enabled, 0 == normal operation
+ *
+ * SPEEDSEL: 1 == 100Mb/s, 0 == 10Mb/s
+ * Link speed is selected byt his bit or if auto-negotiation if bit
+ * 12 (AUTONEGENBL) is set (in which case the value of this register
+ * is ignored).
+ *
+ * AUTONEGENBL: 1 == Autonegotiation enabled, 0 == Autonegotiation disabled
+ * Bits 8 and 13 are ignored when autoneg is set, otherwise bits 8 and 13
+ * determine speed and mode. Should be cleared and then set if PHY configured
+ * for no autoneg on startup.
+ *
+ * ISOLATE: 1 == isolate PHY from MII, 0 == normal operation
+ *
+ * AUTONEGRSTR: 1 == restart autonegotiation, 0 = normal operation
+ *
+ * DUPLEX: 1 == full duplex mode, 0 == half duplex mode
+ *
+ * COLLTEST: 1 == collision test enabled, 0 == normal operation
+ */
+
+/* 
+ * PHY, BMSR Basic Mode Status Register 
+ */   
+#define PHY_BMSR_100BT4			0x8000
+#define PHY_BMSR_100BTXFULL		0x4000
+#define PHY_BMSR_100BTXHALF		0x2000
+#define PHY_BMSR_10BTFULL		0x1000
+#define PHY_BMSR_10BTHALF		0x0800
+#define PHY_BMSR_RSVD1			0x0400	/* write as zero, don't care */
+#define PHY_BMSR_RSVD2			0x0200	/* write as zero, don't care */
+#define PHY_BMSR_RSVD3			0x0100	/* write as zero, don't care */
+#define PHY_BMSR_RSVD4			0x0080	/* write as zero, don't care */
+#define PHY_BMSR_MFPRESUP		0x0040
+#define PHY_BMSR_AUTONEGCOMP		0x0020
+#define PHY_BMSR_REMFAULT		0x0010
+#define PHY_BMSR_CANAUTONEG		0x0008
+#define PHY_BMSR_LINKSTAT		0x0004
+#define PHY_BMSR_JABBER			0x0002
+#define PHY_BMSR_EXTENDED		0x0001
diff --git a/sys/pci/if_pn.c b/sys/pci/if_pn.c
new file mode 100644
index 0000000..efee8d1
--- /dev/null
+++ b/sys/pci/if_pn.c
@@ -0,0 +1,1822 @@
+/*
+ * Copyright (c) 1997, 1998
+ *	Bill Paul <wpaul@ctr.columbia.edu>.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ * 3. All advertising materials mentioning features or use of this software
+ *    must display the following acknowledgement:
+ *	This product includes software developed by Bill Paul.
+ * 4. Neither the name of the author nor the names of any co-contributors
+ *    may be used to endorse or promote products derived from this software
+ *    without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY Bill Paul AND CONTRIBUTORS ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL Bill Paul OR THE VOICES IN HIS HEAD
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ *
+ *	$Id: if_pn.c,v 1.32 1998/11/29 06:40:07 wpaul Exp $
+ */
+
+/*
+ * 82c168/82c169 PNIC fast ethernet PCI NIC driver
+ *
+ * Supports various network adapters based on the Lite-On PNIC
+ * PCI network controller chip including the LinkSys LNE100TX.
+ *
+ * Written by Bill Paul <wpaul@ctr.columbia.edu>
+ * Electrical Engineering Department
+ * Columbia University, New York City
+ */
+
+/*
+ * The PNIC chip is a DEC tulip clone. This driver uses much of the
+ * same code from the driver for the Winbond chip (which is also a
+ * tulip clone) except for the MII, EEPROM and filter programming.
+ *
+ * Technically we could merge support for this chip into the 'de'
+ * driver, but it's such a mess that I'm afraid to go near it.
+ *
+ * The PNIC appears to support both an external MII and an internal
+ * transceiver. I think most 100Mbps implementations use a PHY attached
+ * the the MII. The LinkSys board that I have uses a Myson MTD972
+ * 100BaseTX PHY.
+ */
+
+#include "bpfilter.h"
+
+#include <sys/param.h>
+#include <sys/systm.h>
+#include <sys/sockio.h>
+#include <sys/mbuf.h>
+#include <sys/malloc.h>
+#include <sys/kernel.h>
+#include <sys/socket.h>
+
+#include <net/if.h>
+#include <net/if_arp.h>
+#include <net/ethernet.h>
+#include <net/if_dl.h>
+#include <net/if_media.h>
+
+#if NBPFILTER > 0
+#include <net/bpf.h>
+#endif
+
+#include <vm/vm.h>              /* for vtophys */
+#include <vm/pmap.h>            /* for vtophys */
+#include <machine/clock.h>      /* for DELAY */
+#include <machine/bus_pio.h>
+#include <machine/bus_memio.h>
+#include <machine/bus.h>
+
+#include <pci/pcireg.h>
+#include <pci/pcivar.h>
+
+#define PN_USEIOSPACE
+
+/* #define PN_BACKGROUND_AUTONEG */
+
+#include <pci/if_pnreg.h>
+
+#ifndef lint
+static char rcsid[] =
+	"$Id: if_pn.c,v 1.32 1998/11/29 06:40:07 wpaul Exp $";
+#endif
+
+/*
+ * Various supported device vendors/types and their names.
+ */
+static struct pn_type pn_devs[] = {
+	{ PN_VENDORID, PN_DEVICEID_PNIC,
+		"82c168/82c169 PNIC 10/100BaseTX" },
+	{ 0, 0, NULL }
+};
+
+/*
+ * Various supported PHY vendors/types and their names. Note that
+ * this driver will work with pretty much any MII-compliant PHY,
+ * so failure to positively identify the chip is not a fatal error.
+ */
+
+static struct pn_type pn_phys[] = {
+	{ TI_PHY_VENDORID, TI_PHY_10BT, "<TI ThunderLAN 10BT (internal)>" },
+	{ TI_PHY_VENDORID, TI_PHY_100VGPMI, "<TI TNETE211 100VG Any-LAN>" },
+	{ NS_PHY_VENDORID, NS_PHY_83840A, "<National Semiconductor DP83840A>"},
+	{ LEVEL1_PHY_VENDORID, LEVEL1_PHY_LXT970, "<Level 1 LXT970>" }, 
+	{ INTEL_PHY_VENDORID, INTEL_PHY_82555, "<Intel 82555>" },
+	{ SEEQ_PHY_VENDORID, SEEQ_PHY_80220, "<SEEQ 80220>" },
+	{ 0, 0, "<MII-compliant physical interface>" }
+};
+
+static unsigned long pn_count = 0;
+static char *pn_probe		__P((pcici_t, pcidi_t));
+static void pn_attach		__P((pcici_t, int));
+
+static int pn_newbuf		__P((struct pn_softc *,
+						struct pn_chain_onefrag *));
+static int pn_encap		__P((struct pn_softc *, struct pn_chain *,
+						struct mbuf *));
+
+static void pn_rxeof		__P((struct pn_softc *));
+static void pn_rxeoc		__P((struct pn_softc *));
+static void pn_txeof		__P((struct pn_softc *));
+static void pn_txeoc		__P((struct pn_softc *));
+static void pn_intr		__P((void *));
+static void pn_start		__P((struct ifnet *));
+static int pn_ioctl		__P((struct ifnet *, u_long, caddr_t));
+static void pn_init		__P((void *));
+static void pn_stop		__P((struct pn_softc *));
+static void pn_watchdog		__P((struct ifnet *));
+static void pn_shutdown		__P((int, void *));
+static int pn_ifmedia_upd	__P((struct ifnet *));
+static void pn_ifmedia_sts	__P((struct ifnet *, struct ifmediareq *));
+
+static void pn_eeprom_getword	__P((struct pn_softc *, u_int8_t, u_int16_t *));
+static void pn_read_eeprom	__P((struct pn_softc *, caddr_t, int,
+							int, int));
+static u_int16_t pn_phy_readreg	__P((struct pn_softc *, int));
+static void pn_phy_writereg	__P((struct pn_softc *, u_int16_t, u_int16_t));
+
+static void pn_autoneg_xmit	__P((struct pn_softc *));
+static void pn_autoneg_mii	__P((struct pn_softc *, int, int));
+static void pn_setmode_mii	__P((struct pn_softc *, int));
+static void pn_getmode_mii	__P((struct pn_softc *));
+static void pn_setcfg		__P((struct pn_softc *, u_int16_t));
+static u_int32_t pn_calchash	__P((u_int8_t *));
+static void pn_setfilt		__P((struct pn_softc *));
+static void pn_reset		__P((struct pn_softc *));
+static int pn_list_rx_init	__P((struct pn_softc *));
+static int pn_list_tx_init	__P((struct pn_softc *));
+
+#define PN_SETBIT(sc, reg, x)				\
+	CSR_WRITE_4(sc, reg,				\
+		CSR_READ_4(sc, reg) | x)
+
+#define PN_CLRBIT(sc, reg, x)				\
+	CSR_WRITE_4(sc, reg,				\
+		CSR_READ_4(sc, reg) & ~x)
+
+/*
+ * Read a word of data stored in the EEPROM at address 'addr.'
+ */
+static void pn_eeprom_getword(sc, addr, dest)
+	struct pn_softc		*sc;
+	u_int8_t		addr;
+	u_int16_t		*dest;
+{
+	register int		i;
+	u_int32_t		r;
+
+	CSR_WRITE_4(sc, PN_SIOCTL, PN_EE_READ|addr);
+
+	for (i = 0; i < PN_TIMEOUT; i++) {
+		DELAY(1);
+		r = CSR_READ_4(sc, PN_SIO);
+		if (!(r & PN_SIO_BUSY)) {
+			*dest = (u_int16_t)(r & 0x0000FFFF);
+			return;
+		}
+	}
+
+	return;
+
+}
+
+/*
+ * Read a sequence of words from the EEPROM.
+ */
+static void pn_read_eeprom(sc, dest, off, cnt, swap)
+	struct pn_softc		*sc;
+	caddr_t			dest;
+	int			off;
+	int			cnt;
+	int			swap;
+{
+	int			i;
+	u_int16_t		word = 0, *ptr;
+
+	for (i = 0; i < cnt; i++) {
+		pn_eeprom_getword(sc, off + i, &word);
+		ptr = (u_int16_t *)(dest + (i * 2));
+		if (swap)
+			*ptr = ntohs(word);
+		else
+			*ptr = word;
+	}
+
+	return;
+}
+
+static u_int16_t pn_phy_readreg(sc, reg)
+	struct pn_softc		*sc;
+	int			reg;
+{
+	int			i;
+	u_int32_t		rval;
+
+	CSR_WRITE_4(sc, PN_MII,
+		PN_MII_READ | (sc->pn_phy_addr << 23) | (reg << 18));
+
+	for (i = 0; i < PN_TIMEOUT; i++) {
+		DELAY(1);
+		rval = CSR_READ_4(sc, PN_MII);
+		if (!(rval & PN_MII_BUSY)) {
+			if ((u_int16_t)(rval & 0x0000FFFF) == 0xFFFF)
+				return(0);
+			else
+				return((u_int16_t)(rval & 0x0000FFFF));
+		}
+	}
+
+	return(0);
+}
+
+static void pn_phy_writereg(sc, reg, data)
+	struct pn_softc		*sc;
+	u_int16_t		reg;
+	u_int16_t		data;
+{
+	int			i;
+
+	CSR_WRITE_4(sc, PN_MII,
+		PN_MII_WRITE | (sc->pn_phy_addr << 23) | (reg << 18) | data);
+
+
+	for (i = 0; i < PN_TIMEOUT; i++) {
+		if (!(CSR_READ_4(sc, PN_MII) & PN_MII_BUSY))
+			break;
+	}
+
+	return;
+}
+
+#define PN_POLY		0xEDB88320
+#define PN_BITS		9
+
+static u_int32_t pn_calchash(addr)
+	u_int8_t		*addr;
+{
+	u_int32_t		idx, bit, data, crc;
+
+	/* Compute CRC for the address value. */
+	crc = 0xFFFFFFFF; /* initial value */
+
+	for (idx = 0; idx < 6; idx++) {
+		for (data = *addr++, bit = 0; bit < 8; bit++, data >>= 1)
+			crc = (crc >> 1) ^ (((crc ^ data) & 1) ? PN_POLY : 0);
+	}
+
+	return (crc & ((1 << PN_BITS) - 1));
+}
+
+/*
+ * Initiate an autonegotiation session.
+ */
+static void pn_autoneg_xmit(sc)
+	struct pn_softc		*sc;
+{
+	u_int16_t		phy_sts;
+
+	pn_phy_writereg(sc, PHY_BMCR, PHY_BMCR_RESET);
+	DELAY(500);
+	while(pn_phy_readreg(sc, PHY_BMCR)
+			& PHY_BMCR_RESET);
+
+	phy_sts = pn_phy_readreg(sc, PHY_BMCR);
+	phy_sts |= PHY_BMCR_AUTONEGENBL|PHY_BMCR_AUTONEGRSTR;
+	pn_phy_writereg(sc, PHY_BMCR, phy_sts);
+
+	return;
+}
+
+/*
+ * Invoke autonegotiation on a PHY.
+ */
+static void pn_autoneg_mii(sc, flag, verbose)
+	struct pn_softc		*sc;
+	int			flag;
+	int			verbose;
+{
+	u_int16_t		phy_sts = 0, media, advert, ability;
+	struct ifnet		*ifp;
+	struct ifmedia		*ifm;
+
+	ifm = &sc->ifmedia;
+	ifp = &sc->arpcom.ac_if;
+
+	ifm->ifm_media = IFM_ETHER | IFM_AUTO;
+
+	/*
+	 * The 100baseT4 PHY on the 3c905-T4 has the 'autoneg supported'
+	 * bit cleared in the status register, but has the 'autoneg enabled'
+	 * bit set in the control register. This is a contradiction, and
+	 * I'm not sure how to handle it. If you want to force an attempt
+	 * to autoneg for 100baseT4 PHYs, #define FORCE_AUTONEG_TFOUR
+	 * and see what happens.
+	 */
+#ifndef FORCE_AUTONEG_TFOUR
+	/*
+	 * First, see if autoneg is supported. If not, there's
+	 * no point in continuing.
+	 */
+	phy_sts = pn_phy_readreg(sc, PHY_BMSR);
+	if (!(phy_sts & PHY_BMSR_CANAUTONEG)) {
+		if (verbose)
+			printf("pn%d: autonegotiation not supported\n",
+							sc->pn_unit);
+		ifm->ifm_media = IFM_ETHER|IFM_10_T|IFM_HDX;	
+		return;
+	}
+#endif
+
+	switch (flag) {
+	case PN_FLAG_FORCEDELAY:
+		/*
+	 	 * XXX Never use this option anywhere but in the probe
+	 	 * routine: making the kernel stop dead in its tracks
+ 		 * for three whole seconds after we've gone multi-user
+		 * is really bad manners.
+	 	 */
+		pn_autoneg_xmit(sc);
+		DELAY(5000000);
+		break;
+	case PN_FLAG_SCHEDDELAY:
+		/*
+		 * Wait for the transmitter to go idle before starting
+		 * an autoneg session, otherwise pn_start() may clobber
+	 	 * our timeout, and we don't want to allow transmission
+		 * during an autoneg session since that can screw it up.
+	 	 */
+		if (sc->pn_cdata.pn_tx_head != NULL) {
+			sc->pn_want_auto = 1;
+			return;
+		}
+		pn_autoneg_xmit(sc);
+		ifp->if_timer = 5;
+		sc->pn_autoneg = 1;
+		sc->pn_want_auto = 0;
+		return;
+		break;
+	case PN_FLAG_DELAYTIMEO:
+		ifp->if_timer = 0;
+		sc->pn_autoneg = 0;
+		break;
+	default:
+		printf("pn%d: invalid autoneg flag: %d\n", sc->pn_unit, flag);
+		return;
+	}
+
+	if (pn_phy_readreg(sc, PHY_BMSR) & PHY_BMSR_AUTONEGCOMP) {
+		if (verbose)
+			printf("pn%d: autoneg complete, ", sc->pn_unit);
+		phy_sts = pn_phy_readreg(sc, PHY_BMSR);
+	} else {
+		if (verbose)
+			printf("pn%d: autoneg not complete, ", sc->pn_unit);
+	}
+
+	media = pn_phy_readreg(sc, PHY_BMCR);
+
+	/* Link is good. Report modes and set duplex mode. */
+	if (pn_phy_readreg(sc, PHY_BMSR) & PHY_BMSR_LINKSTAT) {
+		if (verbose)
+			printf("link status good ");
+		advert = pn_phy_readreg(sc, PHY_ANAR);
+		ability = pn_phy_readreg(sc, PHY_LPAR);
+
+		if (advert & PHY_ANAR_100BT4 && ability & PHY_ANAR_100BT4) {
+			ifm->ifm_media = IFM_ETHER|IFM_100_T4;
+			media |= PHY_BMCR_SPEEDSEL;
+			media &= ~PHY_BMCR_DUPLEX;
+			printf("(100baseT4)\n");
+		} else if (advert & PHY_ANAR_100BTXFULL &&
+			ability & PHY_ANAR_100BTXFULL) {
+			ifm->ifm_media = IFM_ETHER|IFM_100_TX|IFM_FDX;
+			media |= PHY_BMCR_SPEEDSEL;
+			media |= PHY_BMCR_DUPLEX;
+			printf("(full-duplex, 100Mbps)\n");
+		} else if (advert & PHY_ANAR_100BTXHALF &&
+			ability & PHY_ANAR_100BTXHALF) {
+			ifm->ifm_media = IFM_ETHER|IFM_100_TX|IFM_HDX;
+			media |= PHY_BMCR_SPEEDSEL;
+			media &= ~PHY_BMCR_DUPLEX;
+			printf("(half-duplex, 100Mbps)\n");
+		} else if (advert & PHY_ANAR_10BTFULL &&
+			ability & PHY_ANAR_10BTFULL) {
+			ifm->ifm_media = IFM_ETHER|IFM_10_T|IFM_FDX;
+			media &= ~PHY_BMCR_SPEEDSEL;
+			media |= PHY_BMCR_DUPLEX;
+			printf("(full-duplex, 10Mbps)\n");
+		} else if (advert & PHY_ANAR_10BTHALF &&
+			ability & PHY_ANAR_10BTHALF) {
+			ifm->ifm_media = IFM_ETHER|IFM_10_T|IFM_HDX;
+			media &= ~PHY_BMCR_SPEEDSEL;
+			media &= ~PHY_BMCR_DUPLEX;
+			printf("(half-duplex, 10Mbps)\n");
+		}
+
+		media &= ~PHY_BMCR_AUTONEGENBL;
+
+		/* Set ASIC's duplex mode to match the PHY. */
+		pn_setcfg(sc, media);
+		pn_phy_writereg(sc, PHY_BMCR, media);
+	} else {
+		if (verbose)
+			printf("no carrier\n");
+	}
+
+	pn_init(sc);
+
+	if (sc->pn_tx_pend) {
+		sc->pn_autoneg = 0;
+		sc->pn_tx_pend = 0;
+		pn_start(ifp);
+	}
+
+	return;
+}
+
+static void pn_getmode_mii(sc)
+	struct pn_softc		*sc;
+{
+	u_int16_t		bmsr;
+	struct ifnet		*ifp;
+
+	ifp = &sc->arpcom.ac_if;
+
+	bmsr = pn_phy_readreg(sc, PHY_BMSR);
+	if (bootverbose)
+		printf("pn%d: PHY status word: %x\n", sc->pn_unit, bmsr);
+
+	/* fallback */
+	sc->ifmedia.ifm_media = IFM_ETHER|IFM_10_T|IFM_HDX;
+
+	if (bmsr & PHY_BMSR_10BTHALF) {
+		if (bootverbose)
+			printf("pn%d: 10Mbps half-duplex mode supported\n",
+								sc->pn_unit);
+		ifmedia_add(&sc->ifmedia,
+			IFM_ETHER|IFM_10_T|IFM_HDX, 0, NULL);
+		ifmedia_add(&sc->ifmedia, IFM_ETHER|IFM_10_T, 0, NULL);
+	}
+
+	if (bmsr & PHY_BMSR_10BTFULL) {
+		if (bootverbose)
+			printf("pn%d: 10Mbps full-duplex mode supported\n",
+								sc->pn_unit);
+		ifmedia_add(&sc->ifmedia,
+			IFM_ETHER|IFM_10_T|IFM_FDX, 0, NULL);
+		sc->ifmedia.ifm_media = IFM_ETHER|IFM_10_T|IFM_FDX;
+	}
+
+	if (bmsr & PHY_BMSR_100BTXHALF) {
+		if (bootverbose)
+			printf("pn%d: 100Mbps half-duplex mode supported\n",
+								sc->pn_unit);
+		ifp->if_baudrate = 100000000;
+		ifmedia_add(&sc->ifmedia, IFM_ETHER|IFM_100_TX, 0, NULL);
+		ifmedia_add(&sc->ifmedia,
+			IFM_ETHER|IFM_100_TX|IFM_HDX, 0, NULL);
+		sc->ifmedia.ifm_media = IFM_ETHER|IFM_100_TX|IFM_HDX;
+	}
+
+	if (bmsr & PHY_BMSR_100BTXFULL) {
+		if (bootverbose)
+			printf("pn%d: 100Mbps full-duplex mode supported\n",
+								sc->pn_unit);
+		ifp->if_baudrate = 100000000;
+		ifmedia_add(&sc->ifmedia,
+			IFM_ETHER|IFM_100_TX|IFM_FDX, 0, NULL);
+		sc->ifmedia.ifm_media = IFM_ETHER|IFM_100_TX|IFM_FDX;
+	}
+
+	/* Some also support 100BaseT4. */
+	if (bmsr & PHY_BMSR_100BT4) {
+		if (bootverbose)
+			printf("pn%d: 100baseT4 mode supported\n", sc->pn_unit);
+		ifp->if_baudrate = 100000000;
+		ifmedia_add(&sc->ifmedia, IFM_ETHER|IFM_100_T4, 0, NULL);
+		sc->ifmedia.ifm_media = IFM_ETHER|IFM_100_T4;
+#ifdef FORCE_AUTONEG_TFOUR
+		if (bootverbose)
+			printf("pn%d: forcing on autoneg support for BT4\n",
+							 sc->pn_unit);
+		ifmedia_add(&sc->ifmedia, IFM_ETHER|IFM_AUTO, 0 NULL):
+		sc->ifmedia.ifm_media = IFM_ETHER|IFM_AUTO;
+#endif
+	}
+
+	if (bmsr & PHY_BMSR_CANAUTONEG) {
+		if (bootverbose)
+			printf("pn%d: autoneg supported\n", sc->pn_unit);
+		ifmedia_add(&sc->ifmedia, IFM_ETHER|IFM_AUTO, 0, NULL);
+		sc->ifmedia.ifm_media = IFM_ETHER|IFM_AUTO;
+	}
+
+	return;
+}
+
+/*
+ * Set speed and duplex mode.
+ */
+static void pn_setmode_mii(sc, media)
+	struct pn_softc		*sc;
+	int			media;
+{
+	u_int16_t		bmcr;
+	struct ifnet		*ifp;
+
+	ifp = &sc->arpcom.ac_if;
+
+	/*
+	 * If an autoneg session is in progress, stop it.
+	 */
+	if (sc->pn_autoneg) {
+		printf("pn%d: canceling autoneg session\n", sc->pn_unit);
+		ifp->if_timer = sc->pn_autoneg = sc->pn_want_auto = 0;
+		bmcr = pn_phy_readreg(sc, PHY_BMCR);
+		bmcr &= ~PHY_BMCR_AUTONEGENBL;
+		pn_phy_writereg(sc, PHY_BMCR, bmcr);
+	}
+
+	printf("pn%d: selecting MII, ", sc->pn_unit);
+
+	bmcr = pn_phy_readreg(sc, PHY_BMCR);
+
+	bmcr &= ~(PHY_BMCR_AUTONEGENBL|PHY_BMCR_SPEEDSEL|
+			PHY_BMCR_DUPLEX|PHY_BMCR_LOOPBK);
+
+	if (IFM_SUBTYPE(media) == IFM_100_T4) {
+		printf("100Mbps/T4, half-duplex\n");
+		bmcr |= PHY_BMCR_SPEEDSEL;
+		bmcr &= ~PHY_BMCR_DUPLEX;
+	}
+
+	if (IFM_SUBTYPE(media) == IFM_100_TX) {
+		printf("100Mbps, ");
+		bmcr |= PHY_BMCR_SPEEDSEL;
+	}
+
+	if (IFM_SUBTYPE(media) == IFM_10_T) {
+		printf("10Mbps, ");
+		bmcr &= ~PHY_BMCR_SPEEDSEL;
+	}
+
+	if ((media & IFM_GMASK) == IFM_FDX) {
+		printf("full duplex\n");
+		bmcr |= PHY_BMCR_DUPLEX;
+	} else {
+		printf("half duplex\n");
+		bmcr &= ~PHY_BMCR_DUPLEX;
+	}
+
+	pn_setcfg(sc, bmcr);
+	pn_phy_writereg(sc, PHY_BMCR, bmcr);
+
+	return;
+}
+
+/*
+ * Programming the receiver filter on the tulip/PNIC is gross. You
+ * have to construct a special setup frame and download it to the
+ * chip via the transmit DMA engine. This routine is also somewhat
+ * gross, as the setup frame is sent synchronously rather than putting
+ * on the transmit queue. The transmitter has to be stopped, then we
+ * can download the frame and wait for the 'owned' bit to clear.
+ *
+ * We always program the chip using 'hash perfect' mode, i.e. one perfect
+ * address (our node address) and a 512-bit hash filter for multicast
+ * frames. We also sneak the broadcast address into the hash filter since
+ * we need that too.
+ */
+void pn_setfilt(sc)
+	struct pn_softc		*sc;
+{
+	struct pn_desc		*sframe;
+	u_int32_t		h, *sp;
+	struct ifmultiaddr	*ifma;
+	struct ifnet		*ifp;
+	int			i;
+
+	ifp = &sc->arpcom.ac_if;
+
+	PN_CLRBIT(sc, PN_NETCFG, PN_NETCFG_TX_ON);
+	PN_SETBIT(sc, PN_ISR, PN_ISR_TX_IDLE);
+
+	sframe = &sc->pn_cdata.pn_sframe;
+	sp = (u_int32_t *)&sc->pn_cdata.pn_sbuf;
+	bzero((char *)sp, PN_SFRAME_LEN);
+
+	sframe->pn_status = PN_TXSTAT_OWN;
+	sframe->pn_next = vtophys(&sc->pn_ldata->pn_tx_list[0]);
+	sframe->pn_data = vtophys(&sc->pn_cdata.pn_sbuf);
+	sframe->pn_ctl = PN_SFRAME_LEN | PN_TXCTL_TLINK |
+			PN_TXCTL_SETUP | PN_FILTER_HASHPERF;
+
+	/* If we want promiscuous mode, set the allframes bit. */
+	if (ifp->if_flags & IFF_PROMISC)
+		PN_SETBIT(sc, PN_NETCFG, PN_NETCFG_RX_PROMISC);
+	else
+		PN_CLRBIT(sc, PN_NETCFG, PN_NETCFG_RX_PROMISC);
+
+	if (ifp->if_flags & IFF_ALLMULTI)
+		PN_SETBIT(sc, PN_NETCFG, PN_NETCFG_RX_ALLMULTI);
+
+	for (ifma = ifp->if_multiaddrs.lh_first; ifma != NULL;
+				ifma = ifma->ifma_link.le_next) {
+		if (ifma->ifma_addr->sa_family != AF_LINK)
+			continue;
+		h = pn_calchash(LLADDR((struct sockaddr_dl *)ifma->ifma_addr));
+		sp[h >> 4] |= 1 << (h & 0xF);
+	}
+
+	if (ifp->if_flags & IFF_BROADCAST) {
+		h = pn_calchash(etherbroadcastaddr);
+		sp[h >> 4] |= 1 << (h & 0xF);
+	}
+
+	sp[39] = ((u_int16_t *)sc->arpcom.ac_enaddr)[0];
+	sp[40] = ((u_int16_t *)sc->arpcom.ac_enaddr)[1];
+	sp[41] = ((u_int16_t *)sc->arpcom.ac_enaddr)[2];
+
+	CSR_WRITE_4(sc, PN_TXADDR, vtophys(sframe));
+	PN_SETBIT(sc, PN_NETCFG, PN_NETCFG_TX_ON);
+	CSR_WRITE_4(sc, PN_TXSTART, 0xFFFFFFFF);
+
+	/*
+	 * Wait for chip to clear the 'own' bit.
+	 */
+	for (i = 0; i < PN_TIMEOUT; i++) {
+		DELAY(10);
+		if (sframe->pn_status != PN_TXSTAT_OWN)
+			break;
+	}
+
+	if (i == PN_TIMEOUT)
+		printf("pn%d: failed to send setup frame\n", sc->pn_unit);
+
+	PN_SETBIT(sc, PN_ISR, PN_ISR_TX_NOBUF|PN_ISR_TX_IDLE);
+
+	return;
+}
+
+/*
+ * In order to fiddle with the
+ * 'full-duplex' and '100Mbps' bits in the netconfig register, we
+ * first have to put the transmit and/or receive logic in the idle state.
+ */
+static void pn_setcfg(sc, bmcr)
+	struct pn_softc		*sc;
+	u_int16_t		bmcr;
+{
+	int			i, restart = 0;
+
+	if (CSR_READ_4(sc, PN_NETCFG) & (PN_NETCFG_TX_ON|PN_NETCFG_RX_ON)) {
+		restart = 1;
+		PN_CLRBIT(sc, PN_NETCFG, (PN_NETCFG_TX_ON|PN_NETCFG_RX_ON));
+
+		for (i = 0; i < PN_TIMEOUT; i++) {
+			DELAY(10);
+			if ((CSR_READ_4(sc, PN_ISR) & PN_ISR_TX_IDLE) &&
+				(CSR_READ_4(sc, PN_ISR) & PN_ISR_RX_IDLE))
+				break;
+		}
+
+		if (i == PN_TIMEOUT)
+			printf("pn%d: failed to force tx and "
+				"rx to idle state\n", sc->pn_unit);
+
+	}
+
+	if (bmcr & PHY_BMCR_SPEEDSEL)
+		PN_CLRBIT(sc, PN_NETCFG, PN_NETCFG_SPEEDSEL);
+	else
+		PN_SETBIT(sc, PN_NETCFG, PN_NETCFG_SPEEDSEL);
+
+	if (bmcr & PHY_BMCR_DUPLEX)
+		PN_SETBIT(sc, PN_NETCFG, PN_NETCFG_FULLDUPLEX);
+	else
+		PN_CLRBIT(sc, PN_NETCFG, PN_NETCFG_FULLDUPLEX);
+
+	if (restart)
+		PN_SETBIT(sc, PN_NETCFG, PN_NETCFG_TX_ON|PN_NETCFG_RX_ON);
+
+	return;
+}
+
+static void pn_reset(sc)
+	struct pn_softc		*sc;
+{
+	register int		i;
+
+	PN_SETBIT(sc, PN_BUSCTL, PN_BUSCTL_RESET);
+
+	for (i = 0; i < PN_TIMEOUT; i++) {
+		DELAY(10);
+		if (!(CSR_READ_4(sc, PN_BUSCTL) & PN_BUSCTL_RESET))
+			break;
+	}
+	if (i == PN_TIMEOUT)
+		printf("pn%d: reset never completed!\n", sc->pn_unit);
+
+	/* Wait a little while for the chip to get its brains in order. */
+	DELAY(1000);
+        return;
+}
+
+/*
+ * Probe for a Lite-On PNIC chip. Check the PCI vendor and device
+ * IDs against our list and return a device name if we find a match.
+ */
+static char *
+pn_probe(config_id, device_id)
+	pcici_t			config_id;
+	pcidi_t			device_id;
+{
+	struct pn_type		*t;
+
+	t = pn_devs;
+
+	while(t->pn_name != NULL) {
+		if ((device_id & 0xFFFF) == t->pn_vid &&
+		    ((device_id >> 16) & 0xFFFF) == t->pn_did) {
+			return(t->pn_name);
+		}
+		t++;
+	}
+
+	return(NULL);
+}
+
+/*
+ * Attach the interface. Allocate softc structures, do ifmedia
+ * setup and ethernet/BPF attach.
+ */
+static void
+pn_attach(config_id, unit)
+	pcici_t			config_id;
+	int			unit;
+{
+	int			s, i;
+#ifndef PN_USEIOSPACE
+	vm_offset_t		pbase, vbase;
+#endif
+	u_char			eaddr[ETHER_ADDR_LEN];
+	u_int32_t		command;
+	struct pn_softc		*sc;
+	struct ifnet		*ifp;
+	int			media = IFM_ETHER|IFM_100_TX|IFM_FDX;
+	unsigned int		round;
+	caddr_t			roundptr;
+	struct pn_type		*p;
+	u_int16_t		phy_vid, phy_did, phy_sts;
+
+	s = splimp();
+
+	sc = malloc(sizeof(struct pn_softc), M_DEVBUF, M_NOWAIT);
+	if (sc == NULL) {
+		printf("pn%d: no memory for softc struct!\n", unit);
+		return;
+	}
+	bzero(sc, sizeof(struct pn_softc));
+
+	/*
+	 * Handle power management nonsense.
+	 */
+
+	command = pci_conf_read(config_id, PN_PCI_CAPID) & 0x000000FF;
+	if (command == 0x01) {
+
+		command = pci_conf_read(config_id, PN_PCI_PWRMGMTCTRL);
+		if (command & PN_PSTATE_MASK) {
+			u_int32_t		iobase, membase, irq;
+
+			/* Save important PCI config data. */
+			iobase = pci_conf_read(config_id, PN_PCI_LOIO);
+			membase = pci_conf_read(config_id, PN_PCI_LOMEM);
+			irq = pci_conf_read(config_id, PN_PCI_INTLINE);
+
+			/* Reset the power state. */
+			printf("pn%d: chip is in D%d power mode "
+			"-- setting to D0\n", unit, command & PN_PSTATE_MASK);
+			command &= 0xFFFFFFFC;
+			pci_conf_write(config_id, PN_PCI_PWRMGMTCTRL, command);
+
+			/* Restore PCI config data. */
+			pci_conf_write(config_id, PN_PCI_LOIO, iobase);
+			pci_conf_write(config_id, PN_PCI_LOMEM, membase);
+			pci_conf_write(config_id, PN_PCI_INTLINE, irq);
+		}
+	}
+
+	/*
+	 * Map control/status registers.
+	 */
+	command = pci_conf_read(config_id, PCI_COMMAND_STATUS_REG);
+	command |= (PCIM_CMD_PORTEN|PCIM_CMD_MEMEN|PCIM_CMD_BUSMASTEREN);
+	pci_conf_write(config_id, PCI_COMMAND_STATUS_REG, command);
+	command = pci_conf_read(config_id, PCI_COMMAND_STATUS_REG);
+
+#ifdef PN_USEIOSPACE
+	if (!(command & PCIM_CMD_PORTEN)) {
+		printf("pn%d: failed to enable I/O ports!\n", unit);
+		free(sc, M_DEVBUF);
+		goto fail;
+	}
+
+	if (!pci_map_port(config_id, PN_PCI_LOIO,
+					(u_short *)&(sc->pn_bhandle))) {
+		printf ("pn%d: couldn't map ports\n", unit);
+		goto fail;
+	}
+	sc->pn_btag = I386_BUS_SPACE_IO;
+#else
+	if (!(command & PCIM_CMD_MEMEN)) {
+		printf("pn%d: failed to enable memory mapping!\n", unit);
+		goto fail;
+	}
+
+	if (!pci_map_mem(config_id, PN_PCI_LOMEM, &vbase, &pbase)) {
+		printf ("pn%d: couldn't map memory\n", unit);
+		goto fail;
+	}
+	sc->pn_bhandle = vbase;
+	sc->pn_btag = I386_BUS_SPACE_MEM;
+#endif
+
+	/* Allocate interrupt */
+	if (!pci_map_int(config_id, pn_intr, sc, &net_imask)) {
+		printf("pn%d: couldn't map interrupt\n", unit);
+		goto fail;
+	}
+
+	/* Reset the adapter. */
+	pn_reset(sc);
+
+	/*
+	 * Get station address from the EEPROM.
+	 */
+	pn_read_eeprom(sc, (caddr_t)&eaddr, 0, 3, 1);
+
+	/*
+	 * A PNIC chip was detected. Inform the world.
+	 */
+	printf("pn%d: Ethernet address: %6D\n", unit, eaddr, ":");
+
+	sc->pn_unit = unit;
+	bcopy(eaddr, (char *)&sc->arpcom.ac_enaddr, ETHER_ADDR_LEN);
+
+	sc->pn_ldata_ptr = malloc(sizeof(struct pn_list_data) + 8,
+				M_DEVBUF, M_NOWAIT);
+	if (sc->pn_ldata_ptr == NULL) {
+		free(sc, M_DEVBUF);
+		printf("pn%d: no memory for list buffers!\n", unit);
+		return;
+	}
+
+	sc->pn_ldata = (struct pn_list_data *)sc->pn_ldata_ptr;
+	round = (unsigned int)sc->pn_ldata_ptr & 0xF;
+	roundptr = sc->pn_ldata_ptr;
+	for (i = 0; i < 8; i++) {
+		if (round % 8) {
+			round++;
+			roundptr++;
+		} else
+			break;
+	}
+	sc->pn_ldata = (struct pn_list_data *)roundptr;
+	bzero(sc->pn_ldata, sizeof(struct pn_list_data));
+
+	ifp = &sc->arpcom.ac_if;
+	ifp->if_softc = sc;
+	ifp->if_unit = unit;
+	ifp->if_name = "pn";
+	ifp->if_mtu = ETHERMTU;
+	ifp->if_flags = IFF_BROADCAST | IFF_SIMPLEX | IFF_MULTICAST;
+	ifp->if_ioctl = pn_ioctl;
+	ifp->if_output = ether_output;
+	ifp->if_start = pn_start;
+	ifp->if_watchdog = pn_watchdog;
+	ifp->if_init = pn_init;
+	ifp->if_baudrate = 10000000;
+
+	if (bootverbose)
+		printf("pn%d: probing for a PHY\n", sc->pn_unit);
+	for (i = PN_PHYADDR_MIN; i < PN_PHYADDR_MAX + 1; i++) {
+		if (bootverbose)
+			printf("pn%d: checking address: %d\n",
+						sc->pn_unit, i);
+		sc->pn_phy_addr = i;
+		pn_phy_writereg(sc, PHY_BMCR, PHY_BMCR_RESET);
+		DELAY(500);
+		while(pn_phy_readreg(sc, PHY_BMCR)
+				& PHY_BMCR_RESET);
+		if ((phy_sts = pn_phy_readreg(sc, PHY_BMSR)))
+			break;
+	}
+	if (phy_sts) {
+		phy_vid = pn_phy_readreg(sc, PHY_VENID);
+		phy_did = pn_phy_readreg(sc, PHY_DEVID);
+		if (bootverbose)
+			printf("pn%d: found PHY at address %d, ",
+					sc->pn_unit, sc->pn_phy_addr);
+		if (bootverbose)
+			printf("vendor id: %x device id: %x\n",
+				phy_vid, phy_did);
+		p = pn_phys;
+		while(p->pn_vid) {
+			if (phy_vid == p->pn_vid &&
+				(phy_did | 0x000F) == p->pn_did) {
+				sc->pn_pinfo = p;
+				break;
+			}
+			p++;
+		}
+		if (sc->pn_pinfo == NULL)
+			sc->pn_pinfo = &pn_phys[PHY_UNKNOWN];
+		if (bootverbose)
+			printf("pn%d: PHY type: %s\n",
+				sc->pn_unit, sc->pn_pinfo->pn_name);
+	} else {
+		printf("pn%d: MII without any phy!\n", sc->pn_unit);
+		goto fail;
+	}
+
+	/*
+	 * Do ifmedia setup.
+	 */
+	ifmedia_init(&sc->ifmedia, 0, pn_ifmedia_upd, pn_ifmedia_sts);
+
+	pn_getmode_mii(sc);
+	pn_autoneg_mii(sc, PN_FLAG_FORCEDELAY, 1);
+	media = sc->ifmedia.ifm_media;
+	pn_stop(sc);
+
+	ifmedia_set(&sc->ifmedia, media);
+
+	/*
+	 * Call MI attach routines.
+	 */
+	if_attach(ifp);
+	ether_ifattach(ifp);
+
+#if NBPFILTER > 0
+	bpfattach(ifp, DLT_EN10MB, sizeof(struct ether_header));
+#endif
+	at_shutdown(pn_shutdown, sc, SHUTDOWN_POST_SYNC);
+
+fail:
+	splx(s);
+	return;
+}
+
+/*
+ * Initialize the transmit descriptors.
+ */
+static int pn_list_tx_init(sc)
+	struct pn_softc		*sc;
+{
+	struct pn_chain_data	*cd;
+	struct pn_list_data	*ld;
+	int			i;
+
+	cd = &sc->pn_cdata;
+	ld = sc->pn_ldata;
+	for (i = 0; i < PN_TX_LIST_CNT; i++) {
+		cd->pn_tx_chain[i].pn_ptr = &ld->pn_tx_list[i];
+		if (i == (PN_TX_LIST_CNT - 1))
+			cd->pn_tx_chain[i].pn_nextdesc =
+				&cd->pn_tx_chain[0];
+		else
+			cd->pn_tx_chain[i].pn_nextdesc =
+				&cd->pn_tx_chain[i + 1];
+	}
+
+	cd->pn_tx_free = &cd->pn_tx_chain[0];
+	cd->pn_tx_tail = cd->pn_tx_head = NULL;
+
+	return(0);
+}
+
+
+/*
+ * Initialize the RX descriptors and allocate mbufs for them. Note that
+ * we arrange the descriptors in a closed ring, so that the last descriptor
+ * points back to the first.
+ */
+static int pn_list_rx_init(sc)
+	struct pn_softc		*sc;
+{
+	struct pn_chain_data	*cd;
+	struct pn_list_data	*ld;
+	int			i;
+
+	cd = &sc->pn_cdata;
+	ld = sc->pn_ldata;
+
+	for (i = 0; i < PN_RX_LIST_CNT; i++) {
+		cd->pn_rx_chain[i].pn_ptr =
+			(struct pn_desc *)&ld->pn_rx_list[i];
+		if (pn_newbuf(sc, &cd->pn_rx_chain[i]) == ENOBUFS)
+			return(ENOBUFS);
+		if (i == (PN_RX_LIST_CNT - 1)) {
+			cd->pn_rx_chain[i].pn_nextdesc = &cd->pn_rx_chain[0];
+			ld->pn_rx_list[i].pn_next =
+					vtophys(&ld->pn_rx_list[0]);
+		} else {
+			cd->pn_rx_chain[i].pn_nextdesc = &cd->pn_rx_chain[i + 1];
+			ld->pn_rx_list[i].pn_next =
+					vtophys(&ld->pn_rx_list[i + 1]);
+		}
+	}
+
+	cd->pn_rx_head = &cd->pn_rx_chain[0];
+
+	return(0);
+}
+
+/*
+ * Initialize an RX descriptor and attach an MBUF cluster.
+ * Note: the length fields are only 11 bits wide, which means the
+ * largest size we can specify is 2047. This is important because
+ * MCLBYTES is 2048, so we have to subtract one otherwise we'll
+ * overflow the field and make a mess.
+ */
+static int pn_newbuf(sc, c)
+	struct pn_softc		*sc;
+	struct pn_chain_onefrag	*c;
+{
+	struct mbuf		*m_new = NULL;
+
+	MGETHDR(m_new, M_DONTWAIT, MT_DATA);
+	if (m_new == NULL) {
+		printf("pn%d: no memory for rx list -- packet dropped!\n",
+								sc->pn_unit);
+		return(ENOBUFS);
+	}
+
+	MCLGET(m_new, M_DONTWAIT);
+	if (!(m_new->m_flags & M_EXT)) {
+		printf("pn%d: no memory for rx list -- packet dropped!\n",
+								sc->pn_unit);
+		m_freem(m_new);
+		return(ENOBUFS);
+	}
+
+	c->pn_mbuf = m_new;
+	c->pn_ptr->pn_status = PN_RXSTAT;
+	c->pn_ptr->pn_data = vtophys(mtod(m_new, caddr_t));
+	c->pn_ptr->pn_ctl = PN_RXCTL_RLINK | (MCLBYTES - 1);
+
+	return(0);
+}
+
+/*
+ * A frame has been uploaded: pass the resulting mbuf chain up to
+ * the higher level protocols.
+ */
+static void pn_rxeof(sc)
+	struct pn_softc		*sc;
+{
+        struct ether_header	*eh;
+        struct mbuf		*m;
+        struct ifnet		*ifp;
+	struct pn_chain_onefrag	*cur_rx;
+	int			total_len = 0;
+	u_int32_t		rxstat;
+
+	ifp = &sc->arpcom.ac_if;
+
+	while(!((rxstat = sc->pn_cdata.pn_rx_head->pn_ptr->pn_status) &
+							PN_RXSTAT_OWN)) {
+		cur_rx = sc->pn_cdata.pn_rx_head;
+		sc->pn_cdata.pn_rx_head = cur_rx->pn_nextdesc;
+
+		/*
+		 * If an error occurs, update stats, clear the
+		 * status word and leave the mbuf cluster in place:
+		 * it should simply get re-used next time this descriptor
+	 	 * comes up in the ring.
+		 */
+		if (rxstat & PN_RXSTAT_RXERR) {
+			ifp->if_ierrors++;
+			if (rxstat & PN_RXSTAT_COLLSEEN)
+				ifp->if_collisions++;
+			cur_rx->pn_ptr->pn_status = PN_RXSTAT;
+			cur_rx->pn_ptr->pn_ctl =
+				PN_RXCTL_RLINK | (MCLBYTES - 1);
+			continue;
+		}
+
+		/* No errors; receive the packet. */	
+		m = cur_rx->pn_mbuf;
+		total_len = PN_RXBYTES(cur_rx->pn_ptr->pn_status);
+
+		/*
+		 * Try to conjure up a new mbuf cluster. If that
+		 * fails, it means we have an out of memory condition and
+		 * should leave the buffer in place and continue. This will
+		 * result in a lost packet, but there's little else we
+		 * can do in this situation.
+		 */
+		if (pn_newbuf(sc, cur_rx) == ENOBUFS) {
+			ifp->if_ierrors++;
+			cur_rx->pn_ptr->pn_status =
+				PN_RXSTAT_FIRSTFRAG|PN_RXSTAT_LASTFRAG;
+			cur_rx->pn_ptr->pn_ctl =
+					PN_RXCTL_RLINK | (MCLBYTES - 1);
+			continue;
+		}
+
+		ifp->if_ipackets++;
+		eh = mtod(m, struct ether_header *);
+		m->m_pkthdr.rcvif = ifp;
+		m->m_pkthdr.len = m->m_len = total_len;
+#if NBPFILTER > 0
+		/*
+		 * Handle BPF listeners. Let the BPF user see the packet, but
+		 * don't pass it up to the ether_input() layer unless it's
+		 * a broadcast packet, multicast packet, matches our ethernet
+		 * address or the interface is in promiscuous mode.
+		 */
+		if (ifp->if_bpf) {
+			bpf_mtap(ifp, m);
+			if (ifp->if_flags & IFF_PROMISC &&
+				(bcmp(eh->ether_dhost, sc->arpcom.ac_enaddr,
+						ETHER_ADDR_LEN) &&
+					(eh->ether_dhost[0] & 1) == 0)) {
+				m_freem(m);
+				continue;
+			}
+		}
+#endif
+		/* Remove header from mbuf and pass it on. */
+		m_adj(m, sizeof(struct ether_header));
+		ether_input(ifp, eh, m);
+	}
+
+	return;
+}
+
+void pn_rxeoc(sc)
+	struct pn_softc		*sc;
+{
+
+	pn_rxeof(sc);
+	PN_CLRBIT(sc, PN_NETCFG, PN_NETCFG_RX_ON);
+	CSR_WRITE_4(sc, PN_RXADDR, vtophys(sc->pn_cdata.pn_rx_head->pn_ptr));
+	PN_SETBIT(sc, PN_NETCFG, PN_NETCFG_RX_ON);
+	CSR_WRITE_4(sc, PN_RXSTART, 0xFFFFFFFF);
+
+	return;
+}
+
+/*
+ * A frame was downloaded to the chip. It's safe for us to clean up
+ * the list buffers.
+ */
+
+static void pn_txeof(sc)
+	struct pn_softc		*sc;
+{
+	struct pn_chain		*cur_tx;
+	struct ifnet		*ifp;
+
+	ifp = &sc->arpcom.ac_if;
+
+	/* Clear the timeout timer. */
+	ifp->if_timer = 0;
+
+	if (sc->pn_cdata.pn_tx_head == NULL)
+		return;
+
+	/*
+	 * Go through our tx list and free mbufs for those
+	 * frames that have been transmitted.
+	 */
+	while(sc->pn_cdata.pn_tx_head->pn_mbuf != NULL) {
+		u_int32_t		txstat;
+
+		cur_tx = sc->pn_cdata.pn_tx_head;
+		txstat = PN_TXSTATUS(cur_tx);
+
+		if ((txstat & PN_TXSTAT_OWN) || txstat == PN_UNSENT)
+			break;
+
+		if (txstat & PN_TXSTAT_ERRSUM) {
+			ifp->if_oerrors++;
+			if (txstat & PN_TXSTAT_EXCESSCOLL)
+				ifp->if_collisions++;
+			if (txstat & PN_TXSTAT_LATECOLL)
+				ifp->if_collisions++;
+		}
+
+		ifp->if_collisions += (txstat & PN_TXSTAT_COLLCNT) >> 3;
+
+
+		ifp->if_opackets++;
+		m_freem(cur_tx->pn_mbuf);
+		cur_tx->pn_mbuf = NULL;
+
+		if (sc->pn_cdata.pn_tx_head == sc->pn_cdata.pn_tx_tail) {
+			sc->pn_cdata.pn_tx_head = NULL;
+			sc->pn_cdata.pn_tx_tail = NULL;
+			break;
+		}
+
+		sc->pn_cdata.pn_tx_head = cur_tx->pn_nextdesc;
+	}
+
+	return;
+}
+
+/*
+ * TX 'end of channel' interrupt handler.
+ */
+static void pn_txeoc(sc)
+	struct pn_softc		*sc;
+{
+	struct ifnet		*ifp;
+
+	ifp = &sc->arpcom.ac_if;
+
+	ifp->if_timer = 0;
+
+	if (sc->pn_cdata.pn_tx_head == NULL) {
+		ifp->if_flags &= ~IFF_OACTIVE;
+		sc->pn_cdata.pn_tx_tail = NULL;
+		if (sc->pn_want_auto)
+			pn_autoneg_mii(sc, PN_FLAG_SCHEDDELAY, 1);
+	} else {
+		if (PN_TXOWN(sc->pn_cdata.pn_tx_head) == PN_UNSENT) {
+			PN_TXOWN(sc->pn_cdata.pn_tx_head) = PN_TXSTAT_OWN;
+			ifp->if_timer = 5;
+			CSR_WRITE_4(sc, PN_TXSTART, 0xFFFFFFFF);
+		}
+	}
+
+	return;
+}
+
+static void pn_intr(arg)
+	void			*arg;
+{
+	struct pn_softc		*sc;
+	struct ifnet		*ifp;
+	u_int32_t		status;
+
+	sc = arg;
+	ifp = &sc->arpcom.ac_if;
+
+	/* Supress unwanted interrupts. */
+	if (!(ifp->if_flags & IFF_UP)) {
+		pn_stop(sc);
+		return;
+	}
+
+	/* Disable interrupts. */
+	CSR_WRITE_4(sc, PN_IMR, 0x00000000);
+
+	for (;;) {
+		status = CSR_READ_4(sc, PN_ISR);
+		if (status)
+			CSR_WRITE_4(sc, PN_ISR, status);
+
+		if ((status & PN_INTRS) == 0)
+			break;
+
+
+		if (status & PN_ISR_RX_OK)
+			pn_rxeof(sc);
+
+		if ((status & PN_ISR_RX_WATCHDOG) || (status & PN_ISR_RX_IDLE)
+					|| (status & PN_ISR_RX_NOBUF))
+			pn_rxeoc(sc);
+
+		if (status & PN_ISR_TX_OK)
+			pn_txeof(sc);
+
+ 		if (status & PN_ISR_TX_NOBUF)
+			pn_txeoc(sc);
+
+		if (status & PN_ISR_TX_IDLE) {
+			pn_txeof(sc);
+			if (sc->pn_cdata.pn_tx_head != NULL) {
+				PN_SETBIT(sc, PN_NETCFG, PN_NETCFG_TX_ON);
+				CSR_WRITE_4(sc, PN_TXSTART, 0xFFFFFFFF);
+			}
+		}
+
+		if (status & PN_ISR_TX_UNDERRUN) {
+			ifp->if_oerrors++;
+			pn_txeof(sc);
+			if (sc->pn_cdata.pn_tx_head != NULL) {
+				PN_SETBIT(sc, PN_NETCFG, PN_NETCFG_TX_ON);
+				CSR_WRITE_4(sc, PN_TXSTART, 0xFFFFFFFF);
+			}
+		}
+
+		if (status & PN_ISR_BUS_ERR) {
+			pn_reset(sc);
+			pn_init(sc);
+		}
+	}
+
+	/* Re-enable interrupts. */
+	CSR_WRITE_4(sc, PN_IMR, PN_INTRS);
+
+	if (ifp->if_snd.ifq_head != NULL) {
+		pn_start(ifp);
+	}
+
+	return;
+}
+
+/*
+ * Encapsulate an mbuf chain in a descriptor by coupling the mbuf data
+ * pointers to the fragment pointers.
+ */
+static int pn_encap(sc, c, m_head)
+	struct pn_softc		*sc;
+	struct pn_chain		*c;
+	struct mbuf		*m_head;
+{
+	int			frag = 0;
+	struct pn_desc		*f = NULL;
+	int			total_len;
+	struct mbuf		*m;
+
+	/*
+ 	 * Start packing the mbufs in this chain into
+	 * the fragment pointers. Stop when we run out
+ 	 * of fragments or hit the end of the mbuf chain.
+	 */
+	m = m_head;
+	total_len = 0;
+
+	for (m = m_head, frag = 0; m != NULL; m = m->m_next) {
+		if (m->m_len != 0) {
+			if (frag == PN_MAXFRAGS)
+				break;
+			total_len += m->m_len;
+			f = &c->pn_ptr->pn_frag[frag];
+			f->pn_ctl = PN_TXCTL_TLINK | m->m_len;
+			if (frag == 0) {
+				f->pn_ctl |= PN_TXCTL_FIRSTFRAG;
+				f->pn_status = 0;
+			} else
+				f->pn_status = PN_TXSTAT_OWN;
+			f->pn_data = vtophys(mtod(m, vm_offset_t));
+			f->pn_next = vtophys(&c->pn_ptr->pn_frag[frag + 1]);
+			frag++;
+		}
+	}
+
+	/*
+	 * Handle special case: we used up all 16 fragments,
+	 * but we have more mbufs left in the chain. Copy the
+	 * data into an mbuf cluster. Note that we don't
+	 * bother clearing the values in the other fragment
+	 * pointers/counters; it wouldn't gain us anything,
+	 * and would waste cycles.
+	 */
+	if (m != NULL) {
+		struct mbuf		*m_new = NULL;
+
+		MGETHDR(m_new, M_DONTWAIT, MT_DATA);
+		if (m_new == NULL) {
+			printf("pn%d: no memory for tx list", sc->pn_unit);
+			return(1);
+		}
+		if (m_head->m_pkthdr.len > MHLEN) {
+			MCLGET(m_new, M_DONTWAIT);
+			if (!(m_new->m_flags & M_EXT)) {
+				m_freem(m_new);
+				printf("pn%d: no memory for tx list",
+						sc->pn_unit);
+				return(1);
+			}
+		}
+		m_copydata(m_head, 0, m_head->m_pkthdr.len,	
+					mtod(m_new, caddr_t));
+		m_new->m_pkthdr.len = m_new->m_len = m_head->m_pkthdr.len;
+		m_freem(m_head);
+		m_head = m_new;
+		f = &c->pn_ptr->pn_frag[0];
+		f->pn_data = vtophys(mtod(m_new, caddr_t));
+		f->pn_ctl = total_len = m_new->m_len;
+		f->pn_ctl |= PN_TXCTL_TLINK|PN_TXCTL_FIRSTFRAG;
+		frag = 1;
+	}
+
+
+	c->pn_mbuf = m_head;
+	c->pn_lastdesc = frag - 1;
+	PN_TXCTL(c) |= PN_TXCTL_LASTFRAG;
+	PN_TXNEXT(c) = vtophys(&c->pn_nextdesc->pn_ptr->pn_frag[0]);
+
+	return(0);
+}
+
+/*
+ * Main transmit routine. To avoid having to do mbuf copies, we put pointers
+ * to the mbuf data regions directly in the transmit lists. We also save a
+ * copy of the pointers since the transmit list fragment pointers are
+ * physical addresses.
+ */
+
+static void pn_start(ifp)
+	struct ifnet		*ifp;
+{
+	struct pn_softc		*sc;
+	struct mbuf		*m_head = NULL;
+	struct pn_chain		*cur_tx = NULL, *start_tx;
+
+	sc = ifp->if_softc;
+
+	if (sc->pn_autoneg) {
+		sc->pn_tx_pend = 1;
+		return;
+	}
+
+	/*
+	 * Check for an available queue slot. If there are none,
+	 * punt.
+	 */
+	if (sc->pn_cdata.pn_tx_free->pn_mbuf != NULL) {
+		ifp->if_flags |= IFF_OACTIVE;
+		return;
+	}
+
+	start_tx = sc->pn_cdata.pn_tx_free;
+
+	while(sc->pn_cdata.pn_tx_free->pn_mbuf == NULL) {
+		IF_DEQUEUE(&ifp->if_snd, m_head);
+		if (m_head == NULL)
+			break;
+
+		/* Pick a descriptor off the free list. */
+		cur_tx = sc->pn_cdata.pn_tx_free;
+		sc->pn_cdata.pn_tx_free = cur_tx->pn_nextdesc;
+
+		/* Pack the data into the descriptor. */
+		pn_encap(sc, cur_tx, m_head);
+
+		if (cur_tx != start_tx)
+			PN_TXOWN(cur_tx) = PN_TXSTAT_OWN;
+
+#if NBPFILTER > 0
+		/*
+		 * If there's a BPF listener, bounce a copy of this frame
+		 * to him.
+		 */
+		if (ifp->if_bpf)
+			bpf_mtap(ifp, cur_tx->pn_mbuf);
+#endif
+	}
+
+	/*
+	 * Place the request for the upload interrupt
+	 * in the last descriptor in the chain. This way, if
+	 * we're chaining several packets at once, we'll only
+	 * get an interupt once for the whole chain rather than
+	 * once for each packet.
+	 */
+	PN_TXCTL(cur_tx) |= PN_TXCTL_FINT;
+	sc->pn_cdata.pn_tx_tail = cur_tx;
+
+	if (sc->pn_cdata.pn_tx_head == NULL) {
+		sc->pn_cdata.pn_tx_head = start_tx;
+		PN_TXOWN(start_tx) = PN_TXSTAT_OWN;
+		CSR_WRITE_4(sc, PN_TXSTART, 0xFFFFFFFF);
+	} else {
+		PN_TXOWN(start_tx) = PN_UNSENT;
+	}
+
+	/*
+	 * Set a timeout in case the chip goes out to lunch.
+	 */
+	ifp->if_timer = 5;
+
+	return;
+}
+
+static void pn_init(xsc)
+	void			*xsc;
+{
+	struct pn_softc		*sc = xsc;
+	struct ifnet		*ifp = &sc->arpcom.ac_if;
+	u_int16_t		phy_bmcr = 0;
+	int			s;
+
+	if (sc->pn_autoneg)
+		return;
+
+	s = splimp();
+
+	if (sc->pn_pinfo != NULL)
+		phy_bmcr = pn_phy_readreg(sc, PHY_BMCR);
+
+	/*
+	 * Cancel pending I/O and free all RX/TX buffers.
+	 */
+	pn_stop(sc);
+	pn_reset(sc);
+
+	/*
+	 * Set cache alignment and burst length.
+	 */
+	CSR_WRITE_4(sc, PN_BUSCTL, PN_BUSCTL_CONFIG);
+
+	PN_CLRBIT(sc, PN_NETCFG, PN_NETCFG_TX_IMMEDIATE);
+	PN_SETBIT(sc, PN_NETCFG, PN_NETCFG_NO_RXCRC);
+	PN_CLRBIT(sc, PN_NETCFG, PN_NETCFG_HEARTBEAT);
+	PN_CLRBIT(sc, PN_NETCFG, PN_NETCFG_STORENFWD);
+	PN_CLRBIT(sc, PN_NETCFG, PN_NETCFG_TX_BACKOFF);
+
+	PN_CLRBIT(sc, PN_NETCFG, PN_NETCFG_TX_THRESH);
+	PN_SETBIT(sc, PN_NETCFG, PN_TXTHRESH_72BYTES);
+
+	pn_setcfg(sc, pn_phy_readreg(sc, PHY_BMCR));
+
+	if (sc->pn_pinfo != NULL) {
+		PN_SETBIT(sc, PN_NETCFG, PN_NETCFG_MIIENB);
+		PN_SETBIT(sc, PN_ENDEC, PN_ENDEC_JABBERDIS);
+	}
+
+	/* Init circular RX list. */
+	if (pn_list_rx_init(sc) == ENOBUFS) {
+		printf("pn%d: initialization failed: no "
+			"memory for rx buffers\n", sc->pn_unit);
+		pn_stop(sc);
+		(void)splx(s);
+		return;
+	}
+
+	/*
+	 * Init tx descriptors.
+	 */
+	pn_list_tx_init(sc);
+
+	/*
+	 * Load the address of the RX list.
+	 */
+	CSR_WRITE_4(sc, PN_RXADDR, vtophys(sc->pn_cdata.pn_rx_head->pn_ptr));
+
+	/*
+	 * Load the RX/multicast filter.
+	 */
+	pn_setfilt(sc);
+
+	/*
+	 * Enable interrupts.
+	 */
+	CSR_WRITE_4(sc, PN_IMR, PN_INTRS);
+	CSR_WRITE_4(sc, PN_ISR, 0xFFFFFFFF);
+
+	/* Enable receiver and transmitter. */
+	PN_SETBIT(sc, PN_NETCFG, PN_NETCFG_TX_ON|PN_NETCFG_RX_ON);
+	CSR_WRITE_4(sc, PN_RXSTART, 0xFFFFFFFF);
+
+	/* Restore state of BMCR */
+	if (sc->pn_pinfo != NULL)
+		pn_phy_writereg(sc, PHY_BMCR, phy_bmcr);
+
+	ifp->if_flags |= IFF_RUNNING;
+	ifp->if_flags &= ~IFF_OACTIVE;
+
+	(void)splx(s);
+
+	return;
+}
+
+/*
+ * Set media options.
+ */
+static int pn_ifmedia_upd(ifp)
+	struct ifnet		*ifp;
+{
+	struct pn_softc		*sc;
+	struct ifmedia		*ifm;
+
+	sc = ifp->if_softc;
+	ifm = &sc->ifmedia;
+
+	if (IFM_TYPE(ifm->ifm_media) != IFM_ETHER)
+		return(EINVAL);
+
+	if (IFM_SUBTYPE(ifm->ifm_media) == IFM_AUTO)
+		pn_autoneg_mii(sc, PN_FLAG_SCHEDDELAY, 1);
+	else
+		pn_setmode_mii(sc, ifm->ifm_media);
+
+	return(0);
+}
+
+/*
+ * Report current media status.
+ */
+static void pn_ifmedia_sts(ifp, ifmr)
+	struct ifnet		*ifp;
+	struct ifmediareq	*ifmr;
+{
+	struct pn_softc		*sc;
+	u_int16_t		advert = 0, ability = 0;
+
+	sc = ifp->if_softc;
+
+	ifmr->ifm_active = IFM_ETHER;
+
+	if (!(pn_phy_readreg(sc, PHY_BMCR) & PHY_BMCR_AUTONEGENBL)) {
+		if (pn_phy_readreg(sc, PHY_BMCR) & PHY_BMCR_SPEEDSEL)
+			ifmr->ifm_active = IFM_ETHER|IFM_100_TX;
+		else
+			ifmr->ifm_active = IFM_ETHER|IFM_10_T;
+		if (pn_phy_readreg(sc, PHY_BMCR) & PHY_BMCR_DUPLEX)
+			ifmr->ifm_active |= IFM_FDX;
+		else
+			ifmr->ifm_active |= IFM_HDX;
+		return;
+	}
+
+	ability = pn_phy_readreg(sc, PHY_LPAR);
+	advert = pn_phy_readreg(sc, PHY_ANAR);
+	if (advert & PHY_ANAR_100BT4 &&
+		ability & PHY_ANAR_100BT4) {
+		ifmr->ifm_active = IFM_ETHER|IFM_100_T4;
+	} else if (advert & PHY_ANAR_100BTXFULL &&
+		ability & PHY_ANAR_100BTXFULL) {
+		ifmr->ifm_active = IFM_ETHER|IFM_100_TX|IFM_FDX;
+	} else if (advert & PHY_ANAR_100BTXHALF &&
+		ability & PHY_ANAR_100BTXHALF) {
+		ifmr->ifm_active = IFM_ETHER|IFM_100_TX|IFM_HDX;
+	} else if (advert & PHY_ANAR_10BTFULL &&
+		ability & PHY_ANAR_10BTFULL) {
+		ifmr->ifm_active = IFM_ETHER|IFM_10_T|IFM_FDX;
+	} else if (advert & PHY_ANAR_10BTHALF &&
+		ability & PHY_ANAR_10BTHALF) {
+		ifmr->ifm_active = IFM_ETHER|IFM_10_T|IFM_HDX;
+	}
+
+	return;
+}
+
+static int pn_ioctl(ifp, command, data)
+	struct ifnet		*ifp;
+	u_long			command;
+	caddr_t			data;
+{
+	struct pn_softc		*sc = ifp->if_softc;
+	struct ifreq		*ifr = (struct ifreq *) data;
+	int			s, error = 0;
+
+	s = splimp();
+
+	switch(command) {
+	case SIOCSIFADDR:
+	case SIOCGIFADDR:
+	case SIOCSIFMTU:
+		error = ether_ioctl(ifp, command, data);
+		break;
+	case SIOCSIFFLAGS:
+		if (ifp->if_flags & IFF_UP) {
+			pn_init(sc);
+		} else {
+			if (ifp->if_flags & IFF_RUNNING)
+				pn_stop(sc);
+		}
+		error = 0;
+		break;
+	case SIOCADDMULTI:
+	case SIOCDELMULTI:
+		pn_init(sc);
+		error = 0;
+		break;
+	case SIOCGIFMEDIA:
+	case SIOCSIFMEDIA:
+		error = ifmedia_ioctl(ifp, ifr, &sc->ifmedia, command);
+		break;
+	default:
+		error = EINVAL;
+		break;
+	}
+
+	(void)splx(s);
+
+	return(error);
+}
+
+static void pn_watchdog(ifp)
+	struct ifnet		*ifp;
+{
+	struct pn_softc		*sc;
+
+	sc = ifp->if_softc;
+
+	if (sc->pn_autoneg) {
+		pn_autoneg_mii(sc, PN_FLAG_DELAYTIMEO, 1);
+		return;
+	}
+
+	ifp->if_oerrors++;
+	printf("pn%d: watchdog timeout\n", sc->pn_unit);
+
+	if (!(pn_phy_readreg(sc, PHY_BMSR) & PHY_BMSR_LINKSTAT))
+		printf("pn%d: no carrier - transceiver cable problem?\n",
+								sc->pn_unit);
+	pn_stop(sc);
+	pn_reset(sc);
+	pn_init(sc);
+
+	if (ifp->if_snd.ifq_head != NULL)
+		pn_start(ifp);
+
+	return;
+}
+
+/*
+ * Stop the adapter and free any mbufs allocated to the
+ * RX and TX lists.
+ */
+static void pn_stop(sc)
+	struct pn_softc		*sc;
+{
+	register int		i;
+	struct ifnet		*ifp;
+
+	ifp = &sc->arpcom.ac_if;
+	ifp->if_timer = 0;
+
+	PN_CLRBIT(sc, PN_NETCFG, (PN_NETCFG_RX_ON|PN_NETCFG_TX_ON));
+	CSR_WRITE_4(sc, PN_IMR, 0x00000000);
+	CSR_WRITE_4(sc, PN_TXADDR, 0x00000000);
+	CSR_WRITE_4(sc, PN_RXADDR, 0x00000000);
+
+	/*
+	 * Free data in the RX lists.
+	 */
+	for (i = 0; i < PN_RX_LIST_CNT; i++) {
+		if (sc->pn_cdata.pn_rx_chain[i].pn_mbuf != NULL) {
+			m_freem(sc->pn_cdata.pn_rx_chain[i].pn_mbuf);
+			sc->pn_cdata.pn_rx_chain[i].pn_mbuf = NULL;
+		}
+	}
+	bzero((char *)&sc->pn_ldata->pn_rx_list,
+		sizeof(sc->pn_ldata->pn_rx_list));
+
+	/*
+	 * Free the TX list buffers.
+	 */
+	for (i = 0; i < PN_TX_LIST_CNT; i++) {
+		if (sc->pn_cdata.pn_tx_chain[i].pn_mbuf != NULL) {
+			m_freem(sc->pn_cdata.pn_tx_chain[i].pn_mbuf);
+			sc->pn_cdata.pn_tx_chain[i].pn_mbuf = NULL;
+		}
+	}
+
+	bzero((char *)&sc->pn_ldata->pn_tx_list,
+		sizeof(sc->pn_ldata->pn_tx_list));
+
+	ifp->if_flags &= ~(IFF_RUNNING | IFF_OACTIVE);
+
+	return;
+}
+
+/*
+ * Stop all chip I/O so that the kernel's probe routines don't
+ * get confused by errant DMAs when rebooting.
+ */
+static void pn_shutdown(howto, arg)
+	int			howto;
+	void			*arg;
+{
+	struct pn_softc		*sc = (struct pn_softc *)arg;
+
+	pn_stop(sc);
+
+	return;
+}
+
+static struct pci_device pn_device = {
+	"pn",
+	pn_probe,
+	pn_attach,
+	&pn_count,
+	NULL
+};
+DATA_SET(pcidevice_set, pn_device);
diff --git a/sys/pci/if_pnreg.h b/sys/pci/if_pnreg.h
new file mode 100644
index 0000000..08ae606
--- /dev/null
+++ b/sys/pci/if_pnreg.h
@@ -0,0 +1,643 @@
+/*
+ * Copyright (c) 1997, 1998
+ *	Bill Paul <wpaul@ctr.columbia.edu>.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ * 3. All advertising materials mentioning features or use of this software
+ *    must display the following acknowledgement:
+ *	This product includes software developed by Bill Paul.
+ * 4. Neither the name of the author nor the names of any co-contributors
+ *    may be used to endorse or promote products derived from this software
+ *    without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY Bill Paul AND CONTRIBUTORS ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL Bill Paul OR THE VOICES IN HIS HEAD
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ *
+ *	$Id: if_pnreg.h,v 1.12 1998/11/23 16:53:26 wpaul Exp $
+ */
+
+/*
+ * PNIC register definitions.
+ */
+
+#define PN_BUSCTL		0x00	/* bus control */
+#define PN_TXSTART		0x08	/* tx start demand */
+#define PN_RXSTART		0x10	/* rx start demand */
+#define PN_RXADDR		0x18	/* rx descriptor list start addr */
+#define PN_TXADDR		0x20	/* tx descriptor list start addr */
+#define PN_ISR			0x28	/* interrupt status register */
+#define PN_NETCFG		0x30	/* network config register */
+#define PN_IMR			0x38	/* interrupt mask */
+#define PN_FRAMESDISCARDED	0x40	/* # of discarded frames */
+#define PN_SIO			0x48	/* MII and ROM/EEPROM access */
+#define PN_GEN			0x60	/* general purpose register */
+#define PN_ENDEC		0x78	/* ENDEC general register */
+#define PN_SIOPWR		0x90	/* serial eeprom power up */
+#define PN_SIOCTL		0x98	/* EEPROM control register */
+#define PN_MII			0xA0	/* MII access register */
+#define PN_NWAY			0xB8	/* Internal NWAY register */
+
+
+/*
+ * Bus control bits.
+ */
+#define PN_BUSCTL_RESET		0x00000001
+#define PN_BUSCTL_ARBITRATION	0x00000002
+#define PN_BUSCTL_SKIPLEN	0x0000007C
+#define PN_BUSCTL_BUF_BIGENDIAN	0x00000080
+#define PN_BUSCTL_BURSTLEN	0x00003F00
+#define PN_BUSCTL_CACHEALIGN	0x0000C000
+#define PN_BUSCTL_TXPOLL	0x000E0000
+
+#define PN_SKIPLEN_1LONG	0x00000004
+#define PN_SKIPLEN_2LONG	0x00000008
+#define PN_SKIPLEN_3LONG	0x00000010
+#define PN_SKIPLEN_4LONG	0x00000020
+#define PN_SKIPLEN_5LONG	0x00000040
+
+#define PN_CACHEALIGN_8LONG	0x00004000
+#define PN_CACHEALIGN_16LONG	0x00008000
+#define PN_CACHEALIGN_32LONG	0x0000C000
+
+#define PN_BURSTLEN_USECA	0x00000000
+#define PN_BURSTLEN_1LONG	0x00000100
+#define PN_BURSTLEN_2LONG	0x00000200
+#define PN_BURSTLEN_4LONG	0x00000400
+#define PN_BURSTLEN_8LONG	0x00000800
+#define PN_BURSTLEN_16LONG	0x00001000
+#define PN_BURSTLEN_32LONG	0x00002000
+
+#define PN_TXPOLL_OFF		0x00000000
+#define PN_TXPOLL_200U		0x00020000
+#define PN_TXPOLL_800U		0x00040000
+#define PN_TXPOLL_1600U		0x00060000
+#define PN_TXPOLL_12_8M		0x00080000
+#define PN_TXPOLL_25_6M		0x000A0000
+#define PN_TXPOLL_51_2M		0x000C0000
+#define PN_TXPOLL_102_4M	0x000E0000
+
+#define PN_BUSCTL_CONFIG	\
+	(PN_CACHEALIGN_8LONG|PN_BURSTLEN_8LONG)
+
+/*
+ * Interrupt status bits.
+ */
+#define PN_ISR_TX_OK		0x00000001	/* packet tx ok */
+#define PN_ISR_TX_IDLE		0x00000002	/* tx stopped */
+#define PN_ISR_TX_NOBUF		0x00000004	/* no tx buffer available */
+#define PN_ISR_TX_JABTIMEO	0x00000008	/* jabber timeout */
+#define PN_ISR_LINKPASS		0x00000010	/* link test pass */
+#define PN_ISR_TX_UNDERRUN	0x00000020	/* transmit underrun */
+#define PN_ISR_RX_OK		0x00000040	/* packet rx ok */
+#define PN_ISR_RX_NOBUF		0x00000080	/* rx buffer unavailable */
+#define PN_ISR_RX_IDLE		0x00000100	/* rx stopped */
+#define PN_ISR_RX_WATCHDOG	0x00000200	/* rx watchdog timeo */
+#define PN_ISR_TX_EARLY		0x00000400	/* rx watchdog timeo */
+#define PN_ISR_BUS_ERR		0x00002000
+#define PN_ISR_ABNORMAL		0x00008000
+#define PN_ISR_NORMAL		0x00010000
+#define PN_ISR_RX_STATE		0x000E0000
+#define PN_ISR_TX_STATE		0x00700000
+#define PN_ISR_BUSERRTYPE	0x03800000
+#define PN_ISR_TXABORT		0x04000000	/* tx abort */
+
+#define PN_RXSTATE_STOPPED	0x00000000	/* 000 - Stopped */
+#define PN_RXSTATE_FETCH	0x00020000	/* 001 - Fetching descriptor */
+#define PN_RXSTATE_ENDCHECK	0x00040000	/* 010 - check for rx end */
+#define PN_RXSTATE_WAIT		0x00060000	/* 011 - waiting for packet */
+#define PN_RXSTATE_SUSPEND	0x00080000	/* 100 - suspend rx */
+#define PN_RXSTATE_CLOSE	0x000A0000	/* 101 - close rx desc */
+#define PN_RXSTATE_FLUSH	0x000C0000	/* 110 - flush from FIFO */
+#define PN_RXSTATE_DEQUEUE	0x000E0000	/* 111 - dequeue from FIFO */
+
+#define PN_TXSTATE_RESET	0x00000000	/* 000 - reset */
+#define PN_TXSTATE_FETCH	0x00100000	/* 001 - fetching descriptor */
+#define PN_TXSTATE_WAITEND	0x00200000	/* 010 - wait for tx end */
+#define PN_TXSTATE_READING	0x00300000	/* 011 - read and enqueue */
+#define PN_TXSTATE_RSVD		0x00400000	/* 100 - reserved */
+#define PN_TXSTATE_SETUP	0x00500000	/* 101 - setup packet */
+#define PN_TXSTATE_SUSPEND	0x00600000	/* 110 - suspend tx */
+#define PN_TXSTATE_CLOSE	0x00700000	/* 111 - close tx desc */
+
+#define PN_BUSERR_PARITY	0x00000000
+#define PN_BUSERR_MASTABRT	0x00800000
+#define PN_BUSERR_TGTABRT	0x01000000
+#define PN_BUSERR_RSVD1		0x01800000
+#define PN_BUSERR_RSVD2		0x02000000
+
+/*
+ * Network config bits.
+ */
+#define PN_NETCFG_HASHPERF	0x00000001	/* 0 == perf, 1 == hash */
+#define PN_NETCFG_RX_ON		0x00000002
+#define PN_NETCFG_HASHONLY	0x00000004	/* 1 == allhash */
+#define PN_NETCFG_RX_PASSERR	0x00000008
+#define PN_NETCFG_INVERSFILT	0x00000010
+#define PN_NETCFG_BACKOFF	0x00000020
+#define PN_NETCFG_RX_PROMISC	0x00000040
+#define PN_NETCFG_RX_ALLMULTI	0x00000080
+#define PN_NETCFG_FLAKYOSC	0x00000100
+#define PN_NETCFG_FULLDUPLEX	0x00000200
+#define PN_NETCFG_OPERMODE	0x00000C00
+#define PN_NETCFG_FORCECOLL	0x00001000
+#define PN_NETCFG_TX_ON		0x00002000
+#define PN_NETCFG_TX_THRESH	0x0000C000
+#define PN_NETCFG_TX_BACKOFF	0x00020000
+#define PN_NETCFG_MIIENB	0x00040000	/* 1 == MII, 0 == internal */
+#define PN_NETCFG_HEARTBEAT	0x00080000	/* 1 == disabled */
+#define PN_NETCFG_TX_IMMEDIATE	0x00100000
+#define PN_NETCFG_STORENFWD	0x00200000
+#define PN_NETCFG_SPEEDSEL	0x00400000	/* 1 == 10Mbps 0 == 100Mbps */
+#define PN_NETCFG_PCS		0x00800000	/* 1 == 100baseTX */
+#define PN_NETCFG_NO_RXCRC	0x02000000
+#define PN_NETCFG_EXT_ENDEC	0x40000000	/* 1 == ext, 0 == int PHY */
+
+#define PN_OPMODE_NORM		0x00000000
+#define PN_OPMODE_INTLOOP	0x00000400
+#define PN_OPMODE_EXTLOOP	0x00000800
+
+#define PN_TXTHRESH_72BYTES	0x00000000
+#define PN_TXTHRESH_96BYTES	0x00004000
+#define PN_TXTHRESH_128BYTES	0x00008000
+#define PN_TXTHRESH_160BYTES	0x0000C000
+
+/*
+ * Interrupt mask bits.
+ */
+#define PN_IMR_TX_OK		0x00000001	/* packet tx ok */
+#define PN_IMR_TX_IDLE		0x00000002	/* tx stopped */
+#define PN_IMR_TX_NOBUF		0x00000004	/* no tx buffer available */
+#define PN_IMR_TX_JABTIMEO	0x00000008	/* jabber timeout */
+#define PN_IMR_LINKPASS		0x00000010	/* link test pass */
+#define PN_IMR_TX_UNDERRUN	0x00000020	/* transmit underrun */
+#define PN_IMR_RX_OK		0x00000040	/* packet rx ok */
+#define PN_IMR_RX_NOBUF		0x00000080	/* rx buffer unavailable */
+#define PN_IMR_RX_IDLE		0x00000100	/* rx stopped */
+#define PN_IMR_RX_WATCHDOG	0x00000200	/* rx watchdog timeo */
+#define PN_IMR_TX_EARLY		0x00000400	/* rx watchdog timeo */
+#define PN_IMR_BUS_ERR		0x00002000
+#define PN_IMR_ABNORMAL		0x00008000
+#define PN_IMR_NORMAL		0x00010000
+#define PN_ISR_TXABORT		0x04000000	/* tx abort */
+
+#define PN_INTRS							\
+	(PN_IMR_RX_OK|PN_IMR_TX_OK|PN_IMR_RX_NOBUF|			\
+	PN_IMR_TX_NOBUF|PN_IMR_TX_UNDERRUN|PN_IMR_BUS_ERR|		\
+	PN_IMR_ABNORMAL|PN_IMR_NORMAL)
+
+/*
+ * Serial I/O (EEPROM/ROM) bits.
+ */
+#define PN_SIO_DATA		0x0000003F
+#define PN_SIO_OPCODE		0x00000300
+#define PN_SIO_BUSY		0x80000000
+
+/*
+ * SIOCTL/EEPROM bits
+ */
+#define PN_EE_READ		0x600
+
+/*
+ * General purpose register bits.
+ */
+#define PN_GEN_CTL		0x000000F0
+#define PN_GEN_100TX_LINK	0x00000008
+#define PN_GEN_BNC_ENB		0x00000004
+#define PN_GEN_100TX_LOOP	0x00000002	/* 1 == normal, 0 == loop */
+#define PN_GEN_SPEEDSEL		0x00000001	/* 1 == 100Mbps, 0 == 10Mbps */
+#define PN_GEN_MUSTBEONE	0x00000030
+
+/*
+ * General ENDEC bits.
+ */
+#define PN_ENDEC_JABBERDIS	0x000000001	/* 1 == disable, 0 == enable */
+
+/*
+ * MII bits.
+ */
+#define PN_MII_DATA		0x0000FFFF
+#define PN_MII_REGADDR		0x007C0000
+#define PN_MII_PHYADDR		0x0F800000
+#define PN_MII_OPCODE		0x30000000
+#define PN_MII_RESERVED		0x00020000
+#define PN_MII_BUSY		0x80000000
+
+#define PN_MII_READ		0x60020000 /* read PHY command */
+#define PN_MII_WRITE		0x50020000 /* write PHY command */
+
+/*
+ * Internal PHY NWAY register bits.
+ */
+#define PN_NWAY_RESET		0x00000001	/* reset */
+#define PN_NWAY_PDOWN		0x00000002	/* power down */
+#define PN_NWAY_BYPASS		0x00000004	/* bypass */
+#define PN_NWAY_AUILOWCUR	0x00000008	/* AUI low current */
+#define PN_NWAY_TPEXTEND	0x00000010	/* low squelch voltage */
+#define PN_NWAY_POLARITY	0x00000020	/* 0 == on, 1 == off */
+#define PN_NWAY_TP		0x00000040	/* 1 == tp, 0 == AUI */
+#define PN_NWAY_AUIVOLT		0x00000080	/* 1 == full, 0 == half */
+#define PN_NWAY_DUPLEX		0x00000100	/* 1 == full, 0 == half */
+#define PN_NWAY_LINKTEST	0x00000200	/* 1 == on, 0 == off */
+#define PN_NWAY_AUTODETECT	0x00000400	/* 1 == off, 0 == on */
+#define PN_NWAY_SPEEDSEL	0x00000800	/* 0 == 10, 1 == 100 */
+#define PN_NWAY_NWAY_ENB	0x00001000	/* 0 == off, 1 == on */
+#define PN_NWAY_CAP10HALF	0x00002000
+#define PN_NWAY_CAP10FULL	0x00004000
+#define	PN_NWAY_CAP100FULL	0x00008000
+#define PN_NWAY_CAP100HALF	0x00010000
+#define PN_NWAY_CAP100T4	0x00020000
+#define PN_NWAY_AUTONEGRSTR	0x02000000
+#define PN_NWAY_REMFAULT	0x04000000
+#define PN_NWAY_LPAR10HALF	0x08000000
+#define PN_NWAY_LPAR10FULL	0x10000000
+#define PN_NWAY_LPAR100FULL	0x20000000
+#define PN_NWAY_LPAR100HALF	0x40000000
+#define PN_NWAY_LPAR100T4	0x80000000
+
+/*
+ * Size of a setup frame.
+ */
+#define PN_SFRAME_LEN		192
+
+/*
+ * PNIC TX/RX list structure.
+ */
+
+struct pn_desc {
+	u_int32_t		pn_status;
+	u_int32_t		pn_ctl;
+	u_int32_t		pn_ptr1;
+	u_int32_t		pn_ptr2;
+};
+
+#define pn_data		pn_ptr1
+#define pn_next		pn_ptr2
+
+
+#define RX_RXSTAT_FIFOOFLOW	0x00000001
+#define PN_RXSTAT_CRCERR	0x00000002
+#define PN_RXSTAT_DRIBBLE	0x00000004
+#define PN_RXSTAT_WATCHDOG	0x00000010
+#define PN_RXSTAT_FRAMETYPE	0x00000020	/* 0 == IEEE 802.3 */
+#define PN_RXSTAT_COLLSEEN	0x00000040
+#define PN_RXSTAT_GIANT		0x00000080
+#define PN_RXSTAT_LASTFRAG	0x00000100
+#define PN_RXSTAT_FIRSTFRAG	0x00000200
+#define PN_RXSTAT_MULTICAST	0x00000400
+#define PN_RXSTAT_RUNT		0x00000800
+#define PN_RXSTAT_RXTYPE	0x00003000
+#define PN_RXSTAT_RXERR		0x00008000
+#define PN_RXSTAT_RXLEN		0x7FFF0000
+#define PN_RXSTAT_OWN		0x80000000
+
+#define PN_RXBYTES(x)		((x & PN_RXSTAT_RXLEN) >> 16)
+#define PN_RXSTAT (PN_RXSTAT_FIRSTFRAG|PN_RXSTAT_LASTFRAG|PN_RXSTAT_OWN)
+
+#define PN_RXCTL_BUFLEN1	0x00000FFF
+#define PN_RXCTL_BUFLEN2	0x00FFF000
+#define PN_RXCTL_RLINK		0x01000000
+#define PN_RXCTL_RLAST		0x02000000
+
+#define PN_TXSTAT_DEFER		0x00000001
+#define PN_TXSTAT_UNDERRUN	0x00000002
+#define PN_TXSTAT_LINKFAIL	0x00000003
+#define PN_TXSTAT_COLLCNT	0x00000078
+#define PN_TXSTAT_SQE		0x00000080
+#define PN_TXSTAT_EXCESSCOLL	0x00000100
+#define PN_TXSTAT_LATECOLL	0x00000200
+#define PN_TXSTAT_NOCARRIER	0x00000400
+#define PN_TXSTAT_CARRLOST	0x00000800
+#define PN_TXSTAT_JABTIMEO	0x00004000
+#define PN_TXSTAT_ERRSUM	0x00008000
+#define PN_TXSTAT_OWN		0x80000000
+
+#define PN_TXCTL_BUFLEN1	0x000007FF
+#define PN_TXCTL_BUFLEN2	0x003FF800
+#define PN_TXCTL_FILTTYPE0	0x00400000
+#define PN_TXCTL_PAD		0x00800000
+#define PN_TXCTL_TLINK		0x01000000
+#define PN_TXCTL_TLAST		0x02000000
+#define PN_TXCTL_NOCRC		0x04000000
+#define PN_TXCTL_SETUP		0x08000000
+#define PN_TXCTL_FILTTYPE1	0x10000000
+#define PN_TXCTL_FIRSTFRAG	0x20000000
+#define PN_TXCTL_LASTFRAG	0x40000000
+#define PN_TXCTL_FINT		0x80000000
+
+#define PN_FILTER_PERFECT	0x00000000
+#define PN_FILTER_HASHPERF	0x00400000
+#define PN_FILTER_INVERSE	0x10000000
+#define PN_FILTER_HASHONLY	0x10400000
+
+#define PN_MAXFRAGS		16
+#define PN_RX_LIST_CNT		64
+#define PN_TX_LIST_CNT		64
+#define PN_MIN_FRAMELEN		60
+#define PN_FRAMELEN		1536
+
+/*
+ * A tx 'super descriptor' is actually 16 regular descriptors
+ * back to back.
+ */
+struct pn_txdesc {
+	struct pn_desc		pn_frag[PN_MAXFRAGS];
+};
+
+#define PN_TXNEXT(x)	x->pn_ptr->pn_frag[x->pn_lastdesc].pn_next
+#define PN_TXSTATUS(x)	x->pn_ptr->pn_frag[x->pn_lastdesc].pn_status
+#define PN_TXCTL(x)	x->pn_ptr->pn_frag[x->pn_lastdesc].pn_ctl
+#define PN_TXDATA(x)	x->pn_ptr->pn_frag[x->pn_lastdesc].pn_data
+
+#define PN_TXOWN(x)	x->pn_ptr->pn_frag[0].pn_status
+
+#define PN_UNSENT	0x12344321
+
+struct pn_list_data {
+	struct pn_desc		pn_rx_list[PN_RX_LIST_CNT];
+	struct pn_txdesc	pn_tx_list[PN_TX_LIST_CNT];
+};
+
+struct pn_chain {
+	struct pn_txdesc	*pn_ptr;
+	struct mbuf		*pn_mbuf;
+	struct pn_chain		*pn_nextdesc;
+	u_int8_t		pn_lastdesc;
+};
+
+struct pn_chain_onefrag {
+	struct pn_desc		*pn_ptr;
+	struct mbuf		*pn_mbuf;
+	struct pn_chain_onefrag	*pn_nextdesc;
+};
+
+struct pn_chain_data {
+	struct pn_desc		pn_sframe;
+	u_int32_t		pn_sbuf[PN_SFRAME_LEN/sizeof(u_int32_t)];
+	struct pn_chain_onefrag	pn_rx_chain[PN_RX_LIST_CNT];
+	struct pn_chain		pn_tx_chain[PN_TX_LIST_CNT];
+
+	struct pn_chain_onefrag	*pn_rx_head;
+
+	struct pn_chain		*pn_tx_head;
+	struct pn_chain		*pn_tx_tail;
+	struct pn_chain		*pn_tx_free;
+};
+
+struct pn_type {
+	u_int16_t		pn_vid;
+	u_int16_t		pn_did;
+	char			*pn_name;
+};
+
+struct pn_mii_frame {
+	u_int8_t		mii_stdelim;
+	u_int8_t		mii_opcode;
+	u_int8_t		mii_phyaddr;
+	u_int8_t		mii_regaddr;
+	u_int8_t		mii_turnaround;
+	u_int16_t		mii_data;
+};
+
+/*
+ * MII constants
+ */
+#define PN_MII_STARTDELIM	0x01
+#define PN_MII_READOP		0x02
+#define PN_MII_WRITEOP		0x01
+#define PN_MII_TURNAROUND	0x02
+
+#define PN_FLAG_FORCEDELAY	1
+#define PN_FLAG_SCHEDDELAY	2
+#define PN_FLAG_DELAYTIMEO	3	
+
+struct pn_softc {
+	struct arpcom		arpcom;		/* interface info */
+	struct ifmedia		ifmedia;	/* media info */
+	bus_space_handle_t	pn_bhandle;	/* bus space handle */
+	bus_space_tag_t		pn_btag;	/* bus space tag */
+	struct pn_type		*pn_info;	/* PNIC adapter info */
+	struct pn_type		*pn_pinfo;	/* phy info */
+	u_int8_t		pn_unit;	/* interface number */
+	u_int8_t		pn_type;
+	u_int8_t		pn_phy_addr;	/* PHY address */
+	u_int8_t		pn_tx_pend;	/* TX pending */
+	u_int8_t		pn_want_auto;
+	u_int8_t		pn_autoneg;
+	caddr_t			pn_ldata_ptr;
+	struct pn_list_data	*pn_ldata;
+	struct pn_chain_data	pn_cdata;
+};
+
+/*
+ * register space access macros
+ */
+#define CSR_WRITE_4(sc, reg, val)	\
+	bus_space_write_4(sc->pn_btag, sc->pn_bhandle, reg, val)
+#define CSR_WRITE_2(sc, reg, val)	\
+	bus_space_write_2(sc->pn_btag, sc->pn_bbhandle, reg, val)
+#define CSR_WRITE_1(sc, reg, val)	\
+	bus_space_write_1(sc->pn_btag, sc->pn_bhandle, reg, val)
+
+#define CSR_READ_4(sc, reg)		\
+	bus_space_read_4(sc->pn_btag, sc->pn_bhandle, reg)
+#define CSR_READ_2(sc, reg)		\
+	bus_space_read_2(sc->pn_btag, sc->pn_bhandle, reg)
+#define CSR_READ_1(sc, reg)		\
+	bus_space_read_1(sc->pn_btag, sc->pn_bhandle, reg)
+
+#define PN_TIMEOUT		1000
+
+/*
+ * General constants that are fun to know.
+ *
+ * Lite-On PNIC PCI vendor ID
+ */
+#define	PN_VENDORID		0x11AD
+
+/*
+ * Lite-On PNIC PCI device ID.
+ */
+#define	PN_DEVICEID_PNIC	0x0002
+
+/*
+ * Texas Instruments PHY identifiers
+ */
+#define TI_PHY_VENDORID		0x4000
+#define TI_PHY_10BT		0x501F
+#define TI_PHY_100VGPMI		0x502F
+
+/*
+ * These ID values are for the NS DP83840A 10/100 PHY
+ */
+#define NS_PHY_VENDORID		0x2000
+#define NS_PHY_83840A		0x5C0F
+
+/*
+ * Level 1 10/100 PHY
+ */
+#define LEVEL1_PHY_VENDORID	0x7810
+#define LEVEL1_PHY_LXT970	0x000F
+
+/*
+ * Intel 82555 10/100 PHY
+ */
+#define INTEL_PHY_VENDORID	0x0A28
+#define INTEL_PHY_82555		0x015F
+
+/*
+ * SEEQ 80220 10/100 PHY
+ */
+#define SEEQ_PHY_VENDORID	0x0016
+#define SEEQ_PHY_80220		0xF83F
+
+
+/*
+ * PCI low memory base and low I/O base register, and
+ * other PCI registers.
+ */
+
+#define PN_PCI_VENDOR_ID	0x00
+#define PN_PCI_DEVICE_ID	0x02
+#define PN_PCI_COMMAND		0x04
+#define PN_PCI_STATUS		0x06
+#define PN_PCI_CLASSCODE	0x09
+#define PN_PCI_LATENCY_TIMER	0x0D
+#define PN_PCI_HEADER_TYPE	0x0E
+#define PN_PCI_LOIO		0x10
+#define PN_PCI_LOMEM		0x14
+#define PN_PCI_BIOSROM		0x30
+#define PN_PCI_INTLINE		0x3C
+#define PN_PCI_INTPIN		0x3D
+#define PN_PCI_MINGNT		0x3E
+#define PN_PCI_MINLAT		0x0F
+#define PN_PCI_RESETOPT		0x48
+#define PN_PCI_EEPROM_DATA	0x4C
+
+/* power management registers */
+#define PN_PCI_CAPID		0xDC /* 8 bits */
+#define PN_PCI_NEXTPTR		0xDD /* 8 bits */
+#define PN_PCI_PWRMGMTCAP	0xDE /* 16 bits */
+#define PN_PCI_PWRMGMTCTRL	0xE0 /* 16 bits */
+
+#define PN_PSTATE_MASK		0x0003
+#define PN_PSTATE_D0		0x0000
+#define PN_PSTATE_D1		0x0002
+#define PN_PSTATE_D2		0x0002
+#define PN_PSTATE_D3		0x0003
+#define PN_PME_EN		0x0010
+#define PN_PME_STATUS		0x8000
+
+#define PHY_UNKNOWN		6
+
+#define PN_PHYADDR_MIN		0x00
+#define PN_PHYADDR_MAX		0x1F
+
+#define PHY_BMCR		0x00
+#define PHY_BMSR		0x01
+#define PHY_VENID		0x02
+#define PHY_DEVID		0x03
+#define PHY_ANAR		0x04
+#define PHY_LPAR		0x05
+#define PHY_ANEXP		0x06
+
+#define PHY_ANAR_NEXTPAGE	0x8000
+#define PHY_ANAR_RSVD0		0x4000
+#define PHY_ANAR_TLRFLT		0x2000
+#define PHY_ANAR_RSVD1		0x1000
+#define PHY_ANAR_RSVD2		0x0800
+#define PHY_ANAR_RSVD3		0x0400
+#define PHY_ANAR_100BT4		0x0200
+#define PHY_ANAR_100BTXFULL	0x0100
+#define PHY_ANAR_100BTXHALF	0x0080
+#define PHY_ANAR_10BTFULL	0x0040
+#define PHY_ANAR_10BTHALF	0x0020
+#define PHY_ANAR_PROTO4		0x0010
+#define PHY_ANAR_PROTO3		0x0008
+#define PHY_ANAR_PROTO2		0x0004
+#define PHY_ANAR_PROTO1		0x0002
+#define PHY_ANAR_PROTO0		0x0001
+
+/*
+ * These are the register definitions for the PHY (physical layer
+ * interface chip).
+ */
+/*
+ * PHY BMCR Basic Mode Control Register
+ */
+#define PHY_BMCR_RESET			0x8000
+#define PHY_BMCR_LOOPBK			0x4000
+#define PHY_BMCR_SPEEDSEL		0x2000
+#define PHY_BMCR_AUTONEGENBL		0x1000
+#define PHY_BMCR_RSVD0			0x0800	/* write as zero */
+#define PHY_BMCR_ISOLATE		0x0400
+#define PHY_BMCR_AUTONEGRSTR		0x0200
+#define PHY_BMCR_DUPLEX			0x0100
+#define PHY_BMCR_COLLTEST		0x0080
+#define PHY_BMCR_RSVD1			0x0040	/* write as zero, don't care */
+#define PHY_BMCR_RSVD2			0x0020	/* write as zero, don't care */
+#define PHY_BMCR_RSVD3			0x0010	/* write as zero, don't care */
+#define PHY_BMCR_RSVD4			0x0008	/* write as zero, don't care */
+#define PHY_BMCR_RSVD5			0x0004	/* write as zero, don't care */
+#define PHY_BMCR_RSVD6			0x0002	/* write as zero, don't care */
+#define PHY_BMCR_RSVD7			0x0001	/* write as zero, don't care */
+/*
+ * RESET: 1 == software reset, 0 == normal operation
+ * Resets status and control registers to default values.
+ * Relatches all hardware config values.
+ *
+ * LOOPBK: 1 == loopback operation enabled, 0 == normal operation
+ *
+ * SPEEDSEL: 1 == 100Mb/s, 0 == 10Mb/s
+ * Link speed is selected byt his bit or if auto-negotiation if bit
+ * 12 (AUTONEGENBL) is set (in which case the value of this register
+ * is ignored).
+ *
+ * AUTONEGENBL: 1 == Autonegotiation enabled, 0 == Autonegotiation disabled
+ * Bits 8 and 13 are ignored when autoneg is set, otherwise bits 8 and 13
+ * determine speed and mode. Should be cleared and then set if PHY configured
+ * for no autoneg on startup.
+ *
+ * ISOLATE: 1 == isolate PHY from MII, 0 == normal operation
+ *
+ * AUTONEGRSTR: 1 == restart autonegotiation, 0 = normal operation
+ *
+ * DUPLEX: 1 == full duplex mode, 0 == half duplex mode
+ *
+ * COLLTEST: 1 == collision test enabled, 0 == normal operation
+ */
+
+/* 
+ * PHY, BMSR Basic Mode Status Register 
+ */   
+#define PHY_BMSR_100BT4			0x8000
+#define PHY_BMSR_100BTXFULL		0x4000
+#define PHY_BMSR_100BTXHALF		0x2000
+#define PHY_BMSR_10BTFULL		0x1000
+#define PHY_BMSR_10BTHALF		0x0800
+#define PHY_BMSR_RSVD1			0x0400	/* write as zero, don't care */
+#define PHY_BMSR_RSVD2			0x0200	/* write as zero, don't care */
+#define PHY_BMSR_RSVD3			0x0100	/* write as zero, don't care */
+#define PHY_BMSR_RSVD4			0x0080	/* write as zero, don't care */
+#define PHY_BMSR_MFPRESUP		0x0040
+#define PHY_BMSR_AUTONEGCOMP		0x0020
+#define PHY_BMSR_REMFAULT		0x0010
+#define PHY_BMSR_CANAUTONEG		0x0008
+#define PHY_BMSR_LINKSTAT		0x0004
+#define PHY_BMSR_JABBER			0x0002
+#define PHY_BMSR_EXTENDED		0x0001
diff --git a/sys/pci/if_vr.c b/sys/pci/if_vr.c
new file mode 100644
index 0000000..a5a2fc4
--- /dev/null
+++ b/sys/pci/if_vr.c
@@ -0,0 +1,1962 @@
+/*
+ * Copyright (c) 1997, 1998
+ *	Bill Paul <wpaul@ctr.columbia.edu>.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ * 3. All advertising materials mentioning features or use of this software
+ *    must display the following acknowledgement:
+ *	This product includes software developed by Bill Paul.
+ * 4. Neither the name of the author nor the names of any co-contributors
+ *    may be used to endorse or promote products derived from this software
+ *    without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY Bill Paul AND CONTRIBUTORS ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL Bill Paul OR THE VOICES IN HIS HEAD
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ *
+ *	$Id: if_vr.c,v 1.13 1998/12/01 22:08:11 wpaul Exp $
+ */
+
+/*
+ * VIA Rhine fast ethernet PCI NIC driver
+ *
+ * Supports various network adapters based on the VIA Rhine
+ * and Rhine II PCI controllers, including the D-Link DFE530TX.
+ * Datasheets are available at http://www.via.com.tw.
+ *
+ * Written by Bill Paul <wpaul@ctr.columbia.edu>
+ * Electrical Engineering Department
+ * Columbia University, New York City
+ */
+
+/*
+ * The VIA Rhine controllers are similar in some respects to the
+ * the DEC tulip chips, except less complicated. The controller
+ * uses an MII bus and an external physical layer interface. The
+ * receiver has a one entry perfect filter and a 64-bit hash table
+ * multicast filter. Transmit and receive descriptors are similar
+ * to the tulip.
+ *
+ * The Rhine has a serious flaw in its transmit DMA mechanism:
+ * transmit buffers must be longword aligned. Unfortunately,
+ * FreeBSD doesn't guarantee that mbufs will be filled in starting
+ * at longword boundaries, so we have to do a buffer copy before
+ * transmission.
+ */
+
+#include "bpfilter.h"
+
+#include <sys/param.h>
+#include <sys/systm.h>
+#include <sys/sockio.h>
+#include <sys/mbuf.h>
+#include <sys/malloc.h>
+#include <sys/kernel.h>
+#include <sys/socket.h>
+
+#include <net/if.h>
+#include <net/if_arp.h>
+#include <net/ethernet.h>
+#include <net/if_dl.h>
+#include <net/if_media.h>
+
+#if NBPFILTER > 0
+#include <net/bpf.h>
+#endif
+
+#include <vm/vm.h>              /* for vtophys */
+#include <vm/pmap.h>            /* for vtophys */
+#include <machine/clock.h>      /* for DELAY */
+#include <machine/bus_pio.h>
+#include <machine/bus_memio.h>
+#include <machine/bus.h>
+
+#include <pci/pcireg.h>
+#include <pci/pcivar.h>
+
+#define VR_USEIOSPACE
+
+/* #define VR_BACKGROUND_AUTONEG */
+
+#include <pci/if_vrreg.h>
+
+#ifndef lint
+static char rcsid[] =
+	"$Id: if_vr.c,v 1.13 1998/12/01 22:08:11 wpaul Exp $";
+#endif
+
+/*
+ * Various supported device vendors/types and their names.
+ */
+static struct vr_type vr_devs[] = {
+	{ VIA_VENDORID, VIA_DEVICEID_RHINE,
+		"VIA VT3043 Rhine I 10/100BaseTX" },
+	{ VIA_VENDORID, VIA_DEVICEID_RHINE_II,
+		"VIA VT86C100A Rhine II 10/100BaseTX" },
+	{ 0, 0, NULL }
+};
+
+/*
+ * Various supported PHY vendors/types and their names. Note that
+ * this driver will work with pretty much any MII-compliant PHY,
+ * so failure to positively identify the chip is not a fatal error.
+ */
+
+static struct vr_type vr_phys[] = {
+	{ TI_PHY_VENDORID, TI_PHY_10BT, "<TI ThunderLAN 10BT (internal)>" },
+	{ TI_PHY_VENDORID, TI_PHY_100VGPMI, "<TI TNETE211 100VG Any-LAN>" },
+	{ NS_PHY_VENDORID, NS_PHY_83840A, "<National Semiconductor DP83840A>"},
+	{ LEVEL1_PHY_VENDORID, LEVEL1_PHY_LXT970, "<Level 1 LXT970>" }, 
+	{ INTEL_PHY_VENDORID, INTEL_PHY_82555, "<Intel 82555>" },
+	{ SEEQ_PHY_VENDORID, SEEQ_PHY_80220, "<SEEQ 80220>" },
+	{ 0, 0, "<MII-compliant physical interface>" }
+};
+
+static unsigned long vr_count = 0;
+static char *vr_probe		__P((pcici_t, pcidi_t));
+static void vr_attach		__P((pcici_t, int));
+
+static int vr_newbuf		__P((struct vr_softc *,
+						struct vr_chain_onefrag *));
+static int vr_encap		__P((struct vr_softc *, struct vr_chain *,
+						struct mbuf * ));
+
+static void vr_rxeof		__P((struct vr_softc *));
+static void vr_rxeoc		__P((struct vr_softc *));
+static void vr_txeof		__P((struct vr_softc *));
+static void vr_txeoc		__P((struct vr_softc *));
+static void vr_intr		__P((void *));
+static void vr_start		__P((struct ifnet *));
+static int vr_ioctl		__P((struct ifnet *, u_long, caddr_t));
+static void vr_init		__P((void *));
+static void vr_stop		__P((struct vr_softc *));
+static void vr_watchdog		__P((struct ifnet *));
+static void vr_shutdown		__P((int, void *));
+static int vr_ifmedia_upd	__P((struct ifnet *));
+static void vr_ifmedia_sts	__P((struct ifnet *, struct ifmediareq *));
+
+static void vr_mii_sync		__P((struct vr_softc *));
+static void vr_mii_send		__P((struct vr_softc *, u_int32_t, int));
+static int vr_mii_readreg	__P((struct vr_softc *, struct vr_mii_frame *));
+static int vr_mii_writereg	__P((struct vr_softc *, struct vr_mii_frame *));
+static u_int16_t vr_phy_readreg	__P((struct vr_softc *, int));
+static void vr_phy_writereg	__P((struct vr_softc *, u_int16_t, u_int16_t));
+
+static void vr_autoneg_xmit	__P((struct vr_softc *));
+static void vr_autoneg_mii	__P((struct vr_softc *, int, int));
+static void vr_setmode_mii	__P((struct vr_softc *, int));
+static void vr_getmode_mii	__P((struct vr_softc *));
+static void vr_setcfg		__P((struct vr_softc *, u_int16_t));
+static u_int8_t vr_calchash	__P((u_int8_t *));
+static void vr_setmulti		__P((struct vr_softc *));
+static void vr_reset		__P((struct vr_softc *));
+static int vr_list_rx_init	__P((struct vr_softc *));
+static int vr_list_tx_init	__P((struct vr_softc *));
+
+#define VR_SETBIT(sc, reg, x)				\
+	CSR_WRITE_1(sc, reg,				\
+		CSR_READ_1(sc, reg) | x)
+
+#define VR_CLRBIT(sc, reg, x)				\
+	CSR_WRITE_1(sc, reg,				\
+		CSR_READ_1(sc, reg) & ~x)
+
+#define VR_SETBIT16(sc, reg, x)				\
+	CSR_WRITE_2(sc, reg,				\
+		CSR_READ_2(sc, reg) | x)
+
+#define VR_CLRBIT16(sc, reg, x)				\
+	CSR_WRITE_2(sc, reg,				\
+		CSR_READ_2(sc, reg) & ~x)
+
+#define VR_SETBIT32(sc, reg, x)				\
+	CSR_WRITE_4(sc, reg,				\
+		CSR_READ_4(sc, reg) | x)
+
+#define VR_CLRBIT32(sc, reg, x)				\
+	CSR_WRITE_4(sc, reg,				\
+		CSR_READ_4(sc, reg) & ~x)
+
+#define SIO_SET(x)					\
+	CSR_WRITE_1(sc, VR_MIICMD,			\
+		CSR_READ_1(sc, VR_MIICMD) | x)
+
+#define SIO_CLR(x)					\
+	CSR_WRITE_1(sc, VR_MIICMD,			\
+		CSR_READ_1(sc, VR_MIICMD) & ~x)
+
+/*
+ * Sync the PHYs by setting data bit and strobing the clock 32 times.
+ */
+static void vr_mii_sync(sc)
+	struct vr_softc		*sc;
+{
+	register int		i;
+
+	SIO_SET(VR_MIICMD_DIR|VR_MIICMD_DATAIN);
+
+	for (i = 0; i < 32; i++) {
+		SIO_SET(VR_MIICMD_CLK);
+		DELAY(1);
+		SIO_CLR(VR_MIICMD_CLK);
+		DELAY(1);
+	}
+
+	return;
+}
+
+/*
+ * Clock a series of bits through the MII.
+ */
+static void vr_mii_send(sc, bits, cnt)
+	struct vr_softc		*sc;
+	u_int32_t		bits;
+	int			cnt;
+{
+	int			i;
+
+	SIO_CLR(VR_MIICMD_CLK);
+
+	for (i = (0x1 << (cnt - 1)); i; i >>= 1) {
+                if (bits & i) {
+			SIO_SET(VR_MIICMD_DATAIN);
+                } else {
+			SIO_CLR(VR_MIICMD_DATAIN);
+                }
+		DELAY(1);
+		SIO_CLR(VR_MIICMD_CLK);
+		DELAY(1);
+		SIO_SET(VR_MIICMD_CLK);
+	}
+}
+
+/*
+ * Read an PHY register through the MII.
+ */
+static int vr_mii_readreg(sc, frame)
+	struct vr_softc		*sc;
+	struct vr_mii_frame	*frame;
+	
+{
+	int			i, ack, s;
+
+	s = splimp();
+
+	/*
+	 * Set up frame for RX.
+	 */
+	frame->mii_stdelim = VR_MII_STARTDELIM;
+	frame->mii_opcode = VR_MII_READOP;
+	frame->mii_turnaround = 0;
+	frame->mii_data = 0;
+	
+	CSR_WRITE_1(sc, VR_MIICMD, 0);
+	VR_SETBIT(sc, VR_MIICMD, VR_MIICMD_DIRECTPGM);
+
+	/*
+ 	 * Turn on data xmit.
+	 */
+	SIO_SET(VR_MIICMD_DIR);
+
+	vr_mii_sync(sc);
+
+	/*
+	 * Send command/address info.
+	 */
+	vr_mii_send(sc, frame->mii_stdelim, 2);
+	vr_mii_send(sc, frame->mii_opcode, 2);
+	vr_mii_send(sc, frame->mii_phyaddr, 5);
+	vr_mii_send(sc, frame->mii_regaddr, 5);
+
+	/* Idle bit */
+	SIO_CLR((VR_MIICMD_CLK|VR_MIICMD_DATAIN));
+	DELAY(1);
+	SIO_SET(VR_MIICMD_CLK);
+	DELAY(1);
+
+	/* Turn off xmit. */
+	SIO_CLR(VR_MIICMD_DIR);
+
+	/* Check for ack */
+	SIO_CLR(VR_MIICMD_CLK);
+	DELAY(1);
+	SIO_SET(VR_MIICMD_CLK);
+	DELAY(1);
+	ack = CSR_READ_4(sc, VR_MIICMD) & VR_MIICMD_DATAOUT;
+
+	/*
+	 * Now try reading data bits. If the ack failed, we still
+	 * need to clock through 16 cycles to keep the PHY(s) in sync.
+	 */
+	if (ack) {
+		for(i = 0; i < 16; i++) {
+			SIO_CLR(VR_MIICMD_CLK);
+			DELAY(1);
+			SIO_SET(VR_MIICMD_CLK);
+			DELAY(1);
+		}
+		goto fail;
+	}
+
+	for (i = 0x8000; i; i >>= 1) {
+		SIO_CLR(VR_MIICMD_CLK);
+		DELAY(1);
+		if (!ack) {
+			if (CSR_READ_4(sc, VR_MIICMD) & VR_MIICMD_DATAOUT)
+				frame->mii_data |= i;
+			DELAY(1);
+		}
+		SIO_SET(VR_MIICMD_CLK);
+		DELAY(1);
+	}
+
+fail:
+
+	SIO_CLR(VR_MIICMD_CLK);
+	DELAY(1);
+	SIO_SET(VR_MIICMD_CLK);
+	DELAY(1);
+
+	splx(s);
+
+	if (ack)
+		return(1);
+	return(0);
+}
+
+/*
+ * Write to a PHY register through the MII.
+ */
+static int vr_mii_writereg(sc, frame)
+	struct vr_softc		*sc;
+	struct vr_mii_frame	*frame;
+	
+{
+	int			s;
+
+	s = splimp();
+
+	CSR_WRITE_1(sc, VR_MIICMD, 0);
+	VR_SETBIT(sc, VR_MIICMD, VR_MIICMD_DIRECTPGM);
+
+	/*
+	 * Set up frame for TX.
+	 */
+
+	frame->mii_stdelim = VR_MII_STARTDELIM;
+	frame->mii_opcode = VR_MII_WRITEOP;
+	frame->mii_turnaround = VR_MII_TURNAROUND;
+	
+	/*
+ 	 * Turn on data output.
+	 */
+	SIO_SET(VR_MIICMD_DIR);
+
+	vr_mii_sync(sc);
+
+	vr_mii_send(sc, frame->mii_stdelim, 2);
+	vr_mii_send(sc, frame->mii_opcode, 2);
+	vr_mii_send(sc, frame->mii_phyaddr, 5);
+	vr_mii_send(sc, frame->mii_regaddr, 5);
+	vr_mii_send(sc, frame->mii_turnaround, 2);
+	vr_mii_send(sc, frame->mii_data, 16);
+
+	/* Idle bit. */
+	SIO_SET(VR_MIICMD_CLK);
+	DELAY(1);
+	SIO_CLR(VR_MIICMD_CLK);
+	DELAY(1);
+
+	/*
+	 * Turn off xmit.
+	 */
+	SIO_CLR(VR_MIICMD_DIR);
+
+	splx(s);
+
+	return(0);
+}
+
+static u_int16_t vr_phy_readreg(sc, reg)
+	struct vr_softc		*sc;
+	int			reg;
+{
+	struct vr_mii_frame	frame;
+
+	bzero((char *)&frame, sizeof(frame));
+
+	frame.mii_phyaddr = sc->vr_phy_addr;
+	frame.mii_regaddr = reg;
+	vr_mii_readreg(sc, &frame);
+
+	return(frame.mii_data);
+}
+
+static void vr_phy_writereg(sc, reg, data)
+	struct vr_softc		*sc;
+	u_int16_t		reg;
+	u_int16_t		data;
+{
+	struct vr_mii_frame	frame;
+
+	bzero((char *)&frame, sizeof(frame));
+
+	frame.mii_phyaddr = sc->vr_phy_addr;
+	frame.mii_regaddr = reg;
+	frame.mii_data = data;
+
+	vr_mii_writereg(sc, &frame);
+
+	return;
+}
+
+/*
+ * Calculate CRC of a multicast group address, return the lower 6 bits.
+ */
+static u_int8_t vr_calchash(addr)
+	u_int8_t		*addr;
+{
+	u_int32_t		crc, carry;
+	int			i, j;
+	u_int8_t		c;
+
+	/* Compute CRC for the address value. */
+	crc = 0xFFFFFFFF; /* initial value */
+
+	for (i = 0; i < 6; i++) {
+		c = *(addr + i);
+		for (j = 0; j < 8; j++) {
+			carry = ((crc & 0x80000000) ? 1 : 0) ^ (c & 0x01);
+			crc <<= 1;
+			c >>= 1;
+			if (carry)
+				crc = (crc ^ 0x04c11db6) | carry;
+		}
+	}
+
+	/* return the filter bit position */
+	return((crc >> 26) & 0x0000003F);
+}
+
+/*
+ * Program the 64-bit multicast hash filter.
+ */
+static void vr_setmulti(sc)
+	struct vr_softc		*sc;
+{
+	struct ifnet		*ifp;
+	int			h = 0;
+	u_int32_t		hashes[2] = { 0, 0 };
+	struct ifmultiaddr	*ifma;
+	u_int8_t		rxfilt;
+	int			mcnt = 0;
+
+	ifp = &sc->arpcom.ac_if;
+
+	rxfilt = CSR_READ_1(sc, VR_RXCFG);
+
+	if (ifp->if_flags & IFF_ALLMULTI || ifp->if_flags & IFF_PROMISC) {
+		rxfilt |= VR_RXCFG_RX_MULTI;
+		CSR_WRITE_1(sc, VR_RXCFG, rxfilt);
+		CSR_WRITE_4(sc, VR_MAR0, 0xFFFFFFFF);
+		CSR_WRITE_4(sc, VR_MAR1, 0xFFFFFFFF);
+		return;
+	}
+
+	/* first, zot all the existing hash bits */
+	CSR_WRITE_4(sc, VR_MAR0, 0);
+	CSR_WRITE_4(sc, VR_MAR1, 0);
+
+	/* now program new ones */
+	for (ifma = ifp->if_multiaddrs.lh_first; ifma != NULL;
+				ifma = ifma->ifma_link.le_next) {
+		if (ifma->ifma_addr->sa_family != AF_LINK)
+			continue;
+		h = vr_calchash(LLADDR((struct sockaddr_dl *)ifma->ifma_addr));
+		if (h < 32)
+			hashes[0] |= (1 << h);
+		else
+			hashes[1] |= (1 << (h - 32));
+		mcnt++;
+	}
+
+	if (mcnt)
+		rxfilt |= VR_RXCFG_RX_MULTI;
+	else
+		rxfilt &= ~VR_RXCFG_RX_MULTI;
+
+	CSR_WRITE_4(sc, VR_MAR0, hashes[0]);
+	CSR_WRITE_4(sc, VR_MAR1, hashes[1]);
+	CSR_WRITE_1(sc, VR_RXCFG, rxfilt);
+
+	return;
+}
+
+/*
+ * Initiate an autonegotiation session.
+ */
+static void vr_autoneg_xmit(sc)
+	struct vr_softc		*sc;
+{
+	u_int16_t		phy_sts;
+
+	vr_phy_writereg(sc, PHY_BMCR, PHY_BMCR_RESET);
+	DELAY(500);
+	while(vr_phy_readreg(sc, PHY_BMCR)
+			& PHY_BMCR_RESET);
+
+	phy_sts = vr_phy_readreg(sc, PHY_BMCR);
+	phy_sts |= PHY_BMCR_AUTONEGENBL|PHY_BMCR_AUTONEGRSTR;
+	vr_phy_writereg(sc, PHY_BMCR, phy_sts);
+
+	return;
+}
+
+/*
+ * Invoke autonegotiation on a PHY.
+ */
+static void vr_autoneg_mii(sc, flag, verbose)
+	struct vr_softc		*sc;
+	int			flag;
+	int			verbose;
+{
+	u_int16_t		phy_sts = 0, media, advert, ability;
+	struct ifnet		*ifp;
+	struct ifmedia		*ifm;
+
+	ifm = &sc->ifmedia;
+	ifp = &sc->arpcom.ac_if;
+
+	ifm->ifm_media = IFM_ETHER | IFM_AUTO;
+
+	/*
+	 * The 100baseT4 PHY on the 3c905-T4 has the 'autoneg supported'
+	 * bit cleared in the status register, but has the 'autoneg enabled'
+	 * bit set in the control register. This is a contradiction, and
+	 * I'm not sure how to handle it. If you want to force an attempt
+	 * to autoneg for 100baseT4 PHYs, #define FORCE_AUTONEG_TFOUR
+	 * and see what happens.
+	 */
+#ifndef FORCE_AUTONEG_TFOUR
+	/*
+	 * First, see if autoneg is supported. If not, there's
+	 * no point in continuing.
+	 */
+	phy_sts = vr_phy_readreg(sc, PHY_BMSR);
+	if (!(phy_sts & PHY_BMSR_CANAUTONEG)) {
+		if (verbose)
+			printf("vr%d: autonegotiation not supported\n",
+							sc->vr_unit);
+		ifm->ifm_media = IFM_ETHER|IFM_10_T|IFM_HDX;	
+		return;
+	}
+#endif
+
+	switch (flag) {
+	case VR_FLAG_FORCEDELAY:
+		/*
+	 	 * XXX Never use this option anywhere but in the probe
+	 	 * routine: making the kernel stop dead in its tracks
+ 		 * for three whole seconds after we've gone multi-user
+		 * is really bad manners.
+	 	 */
+		vr_autoneg_xmit(sc);
+		DELAY(5000000);
+		break;
+	case VR_FLAG_SCHEDDELAY:
+		/*
+		 * Wait for the transmitter to go idle before starting
+		 * an autoneg session, otherwise vr_start() may clobber
+	 	 * our timeout, and we don't want to allow transmission
+		 * during an autoneg session since that can screw it up.
+	 	 */
+		if (sc->vr_cdata.vr_tx_head != NULL) {
+			sc->vr_want_auto = 1;
+			return;
+		}
+		vr_autoneg_xmit(sc);
+		ifp->if_timer = 5;
+		sc->vr_autoneg = 1;
+		sc->vr_want_auto = 0;
+		return;
+		break;
+	case VR_FLAG_DELAYTIMEO:
+		ifp->if_timer = 0;
+		sc->vr_autoneg = 0;
+		break;
+	default:
+		printf("vr%d: invalid autoneg flag: %d\n", sc->vr_unit, flag);
+		return;
+	}
+
+	if (vr_phy_readreg(sc, PHY_BMSR) & PHY_BMSR_AUTONEGCOMP) {
+		if (verbose)
+			printf("vr%d: autoneg complete, ", sc->vr_unit);
+		phy_sts = vr_phy_readreg(sc, PHY_BMSR);
+	} else {
+		if (verbose)
+			printf("vr%d: autoneg not complete, ", sc->vr_unit);
+	}
+
+	media = vr_phy_readreg(sc, PHY_BMCR);
+
+	/* Link is good. Report modes and set duplex mode. */
+	if (vr_phy_readreg(sc, PHY_BMSR) & PHY_BMSR_LINKSTAT) {
+		if (verbose)
+			printf("link status good ");
+		advert = vr_phy_readreg(sc, PHY_ANAR);
+		ability = vr_phy_readreg(sc, PHY_LPAR);
+
+		if (advert & PHY_ANAR_100BT4 && ability & PHY_ANAR_100BT4) {
+			ifm->ifm_media = IFM_ETHER|IFM_100_T4;
+			media |= PHY_BMCR_SPEEDSEL;
+			media &= ~PHY_BMCR_DUPLEX;
+			printf("(100baseT4)\n");
+		} else if (advert & PHY_ANAR_100BTXFULL &&
+			ability & PHY_ANAR_100BTXFULL) {
+			ifm->ifm_media = IFM_ETHER|IFM_100_TX|IFM_FDX;
+			media |= PHY_BMCR_SPEEDSEL;
+			media |= PHY_BMCR_DUPLEX;
+			printf("(full-duplex, 100Mbps)\n");
+		} else if (advert & PHY_ANAR_100BTXHALF &&
+			ability & PHY_ANAR_100BTXHALF) {
+			ifm->ifm_media = IFM_ETHER|IFM_100_TX|IFM_HDX;
+			media |= PHY_BMCR_SPEEDSEL;
+			media &= ~PHY_BMCR_DUPLEX;
+			printf("(half-duplex, 100Mbps)\n");
+		} else if (advert & PHY_ANAR_10BTFULL &&
+			ability & PHY_ANAR_10BTFULL) {
+			ifm->ifm_media = IFM_ETHER|IFM_10_T|IFM_FDX;
+			media &= ~PHY_BMCR_SPEEDSEL;
+			media |= PHY_BMCR_DUPLEX;
+			printf("(full-duplex, 10Mbps)\n");
+		} else {
+			ifm->ifm_media = IFM_ETHER|IFM_10_T|IFM_HDX;
+			media &= ~PHY_BMCR_SPEEDSEL;
+			media &= ~PHY_BMCR_DUPLEX;
+			printf("(half-duplex, 10Mbps)\n");
+		}
+
+		media &= ~PHY_BMCR_AUTONEGENBL;
+
+		/* Set ASIC's duplex mode to match the PHY. */
+		vr_setcfg(sc, media);
+		vr_phy_writereg(sc, PHY_BMCR, media);
+	} else {
+		if (verbose)
+			printf("no carrier\n");
+	}
+
+	vr_init(sc);
+
+	if (sc->vr_tx_pend) {
+		sc->vr_autoneg = 0;
+		sc->vr_tx_pend = 0;
+		vr_start(ifp);
+	}
+
+	return;
+}
+
+static void vr_getmode_mii(sc)
+	struct vr_softc		*sc;
+{
+	u_int16_t		bmsr;
+	struct ifnet		*ifp;
+
+	ifp = &sc->arpcom.ac_if;
+
+	bmsr = vr_phy_readreg(sc, PHY_BMSR);
+	if (bootverbose)
+		printf("vr%d: PHY status word: %x\n", sc->vr_unit, bmsr);
+
+	/* fallback */
+	sc->ifmedia.ifm_media = IFM_ETHER|IFM_10_T|IFM_HDX;
+
+	if (bmsr & PHY_BMSR_10BTHALF) {
+		if (bootverbose)
+			printf("vr%d: 10Mbps half-duplex mode supported\n",
+								sc->vr_unit);
+		ifmedia_add(&sc->ifmedia,
+			IFM_ETHER|IFM_10_T|IFM_HDX, 0, NULL);
+		ifmedia_add(&sc->ifmedia, IFM_ETHER|IFM_10_T, 0, NULL);
+	}
+
+	if (bmsr & PHY_BMSR_10BTFULL) {
+		if (bootverbose)
+			printf("vr%d: 10Mbps full-duplex mode supported\n",
+								sc->vr_unit);
+		ifmedia_add(&sc->ifmedia,
+			IFM_ETHER|IFM_10_T|IFM_FDX, 0, NULL);
+		sc->ifmedia.ifm_media = IFM_ETHER|IFM_10_T|IFM_FDX;
+	}
+
+	if (bmsr & PHY_BMSR_100BTXHALF) {
+		if (bootverbose)
+			printf("vr%d: 100Mbps half-duplex mode supported\n",
+								sc->vr_unit);
+		ifp->if_baudrate = 100000000;
+		ifmedia_add(&sc->ifmedia, IFM_ETHER|IFM_100_TX, 0, NULL);
+		ifmedia_add(&sc->ifmedia,
+			IFM_ETHER|IFM_100_TX|IFM_HDX, 0, NULL);
+		sc->ifmedia.ifm_media = IFM_ETHER|IFM_100_TX|IFM_HDX;
+	}
+
+	if (bmsr & PHY_BMSR_100BTXFULL) {
+		if (bootverbose)
+			printf("vr%d: 100Mbps full-duplex mode supported\n",
+								sc->vr_unit);
+		ifp->if_baudrate = 100000000;
+		ifmedia_add(&sc->ifmedia,
+			IFM_ETHER|IFM_100_TX|IFM_FDX, 0, NULL);
+		sc->ifmedia.ifm_media = IFM_ETHER|IFM_100_TX|IFM_FDX;
+	}
+
+	/* Some also support 100BaseT4. */
+	if (bmsr & PHY_BMSR_100BT4) {
+		if (bootverbose)
+			printf("vr%d: 100baseT4 mode supported\n", sc->vr_unit);
+		ifp->if_baudrate = 100000000;
+		ifmedia_add(&sc->ifmedia, IFM_ETHER|IFM_100_T4, 0, NULL);
+		sc->ifmedia.ifm_media = IFM_ETHER|IFM_100_T4;
+#ifdef FORCE_AUTONEG_TFOUR
+		if (bootverbose)
+			printf("vr%d: forcing on autoneg support for BT4\n",
+							 sc->vr_unit);
+		ifmedia_add(&sc->ifmedia, IFM_ETHER|IFM_AUTO, 0 NULL):
+		sc->ifmedia.ifm_media = IFM_ETHER|IFM_AUTO;
+#endif
+	}
+
+	if (bmsr & PHY_BMSR_CANAUTONEG) {
+		if (bootverbose)
+			printf("vr%d: autoneg supported\n", sc->vr_unit);
+		ifmedia_add(&sc->ifmedia, IFM_ETHER|IFM_AUTO, 0, NULL);
+		sc->ifmedia.ifm_media = IFM_ETHER|IFM_AUTO;
+	}
+
+	return;
+}
+
+/*
+ * Set speed and duplex mode.
+ */
+static void vr_setmode_mii(sc, media)
+	struct vr_softc		*sc;
+	int			media;
+{
+	u_int16_t		bmcr;
+	struct ifnet		*ifp;
+
+	ifp = &sc->arpcom.ac_if;
+
+	/*
+	 * If an autoneg session is in progress, stop it.
+	 */
+	if (sc->vr_autoneg) {
+		printf("vr%d: canceling autoneg session\n", sc->vr_unit);
+		ifp->if_timer = sc->vr_autoneg = sc->vr_want_auto = 0;
+		bmcr = vr_phy_readreg(sc, PHY_BMCR);
+		bmcr &= ~PHY_BMCR_AUTONEGENBL;
+		vr_phy_writereg(sc, PHY_BMCR, bmcr);
+	}
+
+	printf("vr%d: selecting MII, ", sc->vr_unit);
+
+	bmcr = vr_phy_readreg(sc, PHY_BMCR);
+
+	bmcr &= ~(PHY_BMCR_AUTONEGENBL|PHY_BMCR_SPEEDSEL|
+			PHY_BMCR_DUPLEX|PHY_BMCR_LOOPBK);
+
+	if (IFM_SUBTYPE(media) == IFM_100_T4) {
+		printf("100Mbps/T4, half-duplex\n");
+		bmcr |= PHY_BMCR_SPEEDSEL;
+		bmcr &= ~PHY_BMCR_DUPLEX;
+	}
+
+	if (IFM_SUBTYPE(media) == IFM_100_TX) {
+		printf("100Mbps, ");
+		bmcr |= PHY_BMCR_SPEEDSEL;
+	}
+
+	if (IFM_SUBTYPE(media) == IFM_10_T) {
+		printf("10Mbps, ");
+		bmcr &= ~PHY_BMCR_SPEEDSEL;
+	}
+
+	if ((media & IFM_GMASK) == IFM_FDX) {
+		printf("full duplex\n");
+		bmcr |= PHY_BMCR_DUPLEX;
+	} else {
+		printf("half duplex\n");
+		bmcr &= ~PHY_BMCR_DUPLEX;
+	}
+
+	vr_setcfg(sc, bmcr);
+	vr_phy_writereg(sc, PHY_BMCR, bmcr);
+
+	return;
+}
+
+/*
+ * In order to fiddle with the
+ * 'full-duplex' and '100Mbps' bits in the netconfig register, we
+ * first have to put the transmit and/or receive logic in the idle state.
+ */
+static void vr_setcfg(sc, bmcr)
+	struct vr_softc		*sc;
+	u_int16_t		bmcr;
+{
+	int			restart = 0;
+
+	if (CSR_READ_2(sc, VR_COMMAND) & (VR_CMD_TX_ON|VR_CMD_RX_ON)) {
+		restart = 1;
+		VR_CLRBIT16(sc, VR_COMMAND, (VR_CMD_TX_ON|VR_CMD_RX_ON));
+	}
+
+	if (bmcr & PHY_BMCR_DUPLEX)
+		VR_SETBIT16(sc, VR_COMMAND, VR_CMD_FULLDUPLEX);
+	else
+		VR_CLRBIT16(sc, VR_COMMAND, VR_CMD_FULLDUPLEX);
+
+	if (restart)
+		VR_SETBIT16(sc, VR_COMMAND, VR_CMD_TX_ON|VR_CMD_RX_ON);
+
+	return;
+}
+
+static void vr_reset(sc)
+	struct vr_softc		*sc;
+{
+	register int		i;
+
+	VR_SETBIT16(sc, VR_COMMAND, VR_CMD_RESET);
+
+	for (i = 0; i < VR_TIMEOUT; i++) {
+		DELAY(10);
+		if (!(CSR_READ_2(sc, VR_COMMAND) & VR_CMD_RESET))
+			break;
+	}
+	if (i == VR_TIMEOUT)
+		printf("vr%d: reset never completed!\n", sc->vr_unit);
+
+	/* Wait a little while for the chip to get its brains in order. */
+	DELAY(1000);
+
+        return;
+}
+
+/*
+ * Probe for a VIA Rhine chip. Check the PCI vendor and device
+ * IDs against our list and return a device name if we find a match.
+ */
+static char *
+vr_probe(config_id, device_id)
+	pcici_t			config_id;
+	pcidi_t			device_id;
+{
+	struct vr_type		*t;
+
+	t = vr_devs;
+
+	while(t->vr_name != NULL) {
+		if ((device_id & 0xFFFF) == t->vr_vid &&
+		    ((device_id >> 16) & 0xFFFF) == t->vr_did) {
+			return(t->vr_name);
+		}
+		t++;
+	}
+
+	return(NULL);
+}
+
+/*
+ * Attach the interface. Allocate softc structures, do ifmedia
+ * setup and ethernet/BPF attach.
+ */
+static void
+vr_attach(config_id, unit)
+	pcici_t			config_id;
+	int			unit;
+{
+	int			s, i;
+#ifndef VR_USEIOSPACE
+	vm_offset_t		pbase, vbase;
+#endif
+	u_char			eaddr[ETHER_ADDR_LEN];
+	u_int32_t		command;
+	struct vr_softc		*sc;
+	struct ifnet		*ifp;
+	int			media = IFM_ETHER|IFM_100_TX|IFM_FDX;
+	unsigned int		round;
+	caddr_t			roundptr;
+	struct vr_type		*p;
+	u_int16_t		phy_vid, phy_did, phy_sts;
+
+	s = splimp();
+
+	sc = malloc(sizeof(struct vr_softc), M_DEVBUF, M_NOWAIT);
+	if (sc == NULL) {
+		printf("vr%d: no memory for softc struct!\n", unit);
+		return;
+	}
+	bzero(sc, sizeof(struct vr_softc));
+
+	/*
+	 * Handle power management nonsense.
+	 */
+
+	command = pci_conf_read(config_id, VR_PCI_CAPID) & 0x000000FF;
+	if (command == 0x01) {
+
+		command = pci_conf_read(config_id, VR_PCI_PWRMGMTCTRL);
+		if (command & VR_PSTATE_MASK) {
+			u_int32_t		iobase, membase, irq;
+
+			/* Save important PCI config data. */
+			iobase = pci_conf_read(config_id, VR_PCI_LOIO);
+			membase = pci_conf_read(config_id, VR_PCI_LOMEM);
+			irq = pci_conf_read(config_id, VR_PCI_INTLINE);
+
+			/* Reset the power state. */
+			printf("vr%d: chip is in D%d power mode "
+			"-- setting to D0\n", unit, command & VR_PSTATE_MASK);
+			command &= 0xFFFFFFFC;
+			pci_conf_write(config_id, VR_PCI_PWRMGMTCTRL, command);
+
+			/* Restore PCI config data. */
+			pci_conf_write(config_id, VR_PCI_LOIO, iobase);
+			pci_conf_write(config_id, VR_PCI_LOMEM, membase);
+			pci_conf_write(config_id, VR_PCI_INTLINE, irq);
+		}
+	}
+
+	/*
+	 * Map control/status registers.
+	 */
+	command = pci_conf_read(config_id, PCI_COMMAND_STATUS_REG);
+	command |= (PCIM_CMD_PORTEN|PCIM_CMD_MEMEN|PCIM_CMD_BUSMASTEREN);
+	pci_conf_write(config_id, PCI_COMMAND_STATUS_REG, command);
+	command = pci_conf_read(config_id, PCI_COMMAND_STATUS_REG);
+
+#ifdef VR_USEIOSPACE
+	if (!(command & PCIM_CMD_PORTEN)) {
+		printf("vr%d: failed to enable I/O ports!\n", unit);
+		free(sc, M_DEVBUF);
+		goto fail;
+	}
+
+	if (!pci_map_port(config_id, VR_PCI_LOIO,
+					(u_int16_t *)(&sc->vr_bhandle))) {
+		printf ("vr%d: couldn't map ports\n", unit);
+		goto fail;
+	}
+	sc->vr_btag = I386_BUS_SPACE_IO;
+#else
+	if (!(command & PCIM_CMD_MEMEN)) {
+		printf("vr%d: failed to enable memory mapping!\n", unit);
+		goto fail;
+	}
+
+	if (!pci_map_mem(config_id, VR_PCI_LOMEM, &vbase, &pbase)) {
+		printf ("vr%d: couldn't map memory\n", unit);
+		goto fail;
+	}
+
+	sc->vr_bhandle = vbase;
+	sc->vr_btag = I386_BUS_SPACE_MEM;
+#endif
+
+	/* Allocate interrupt */
+	if (!pci_map_int(config_id, vr_intr, sc, &net_imask)) {
+		printf("vr%d: couldn't map interrupt\n", unit);
+		goto fail;
+	}
+
+	/* Reset the adapter. */
+	vr_reset(sc);
+
+	/*
+	 * Get station address. The way the Rhine chips work,
+	 * you're not allowed to directly access the EEPROM once
+	 * they've been programmed a special way. Consequently,
+	 * we need to read the node address from the PAR0 and PAR1
+	 * registers.
+	 */
+	VR_SETBIT(sc, VR_EECSR, VR_EECSR_LOAD);
+	DELAY(200);
+	for (i = 0; i < ETHER_ADDR_LEN; i++)
+		eaddr[i] = CSR_READ_1(sc, VR_PAR0 + i);
+
+	/*
+	 * A Rhine chip was detected. Inform the world.
+	 */
+	printf("vr%d: Ethernet address: %6D\n", unit, eaddr, ":");
+
+	sc->vr_unit = unit;
+	bcopy(eaddr, (char *)&sc->arpcom.ac_enaddr, ETHER_ADDR_LEN);
+
+	sc->vr_ldata_ptr = malloc(sizeof(struct vr_list_data) + 8,
+				M_DEVBUF, M_NOWAIT);
+	if (sc->vr_ldata_ptr == NULL) {
+		free(sc, M_DEVBUF);
+		printf("vr%d: no memory for list buffers!\n", unit);
+		return;
+	}
+
+	sc->vr_ldata = (struct vr_list_data *)sc->vr_ldata_ptr;
+	round = (unsigned int)sc->vr_ldata_ptr & 0xF;
+	roundptr = sc->vr_ldata_ptr;
+	for (i = 0; i < 8; i++) {
+		if (round % 8) {
+			round++;
+			roundptr++;
+		} else
+			break;
+	}
+	sc->vr_ldata = (struct vr_list_data *)roundptr;
+	bzero(sc->vr_ldata, sizeof(struct vr_list_data));
+
+	ifp = &sc->arpcom.ac_if;
+	ifp->if_softc = sc;
+	ifp->if_unit = unit;
+	ifp->if_name = "vr";
+	ifp->if_mtu = ETHERMTU;
+	ifp->if_flags = IFF_BROADCAST | IFF_SIMPLEX | IFF_MULTICAST;
+	ifp->if_ioctl = vr_ioctl;
+	ifp->if_output = ether_output;
+	ifp->if_start = vr_start;
+	ifp->if_watchdog = vr_watchdog;
+	ifp->if_init = vr_init;
+	ifp->if_baudrate = 10000000;
+
+	if (bootverbose)
+		printf("vr%d: probing for a PHY\n", sc->vr_unit);
+	for (i = VR_PHYADDR_MIN; i < VR_PHYADDR_MAX + 1; i++) {
+		if (bootverbose)
+			printf("vr%d: checking address: %d\n",
+						sc->vr_unit, i);
+		sc->vr_phy_addr = i;
+		vr_phy_writereg(sc, PHY_BMCR, PHY_BMCR_RESET);
+		DELAY(500);
+		while(vr_phy_readreg(sc, PHY_BMCR)
+				& PHY_BMCR_RESET);
+		if ((phy_sts = vr_phy_readreg(sc, PHY_BMSR)))
+			break;
+	}
+	if (phy_sts) {
+		phy_vid = vr_phy_readreg(sc, PHY_VENID);
+		phy_did = vr_phy_readreg(sc, PHY_DEVID);
+		if (bootverbose)
+			printf("vr%d: found PHY at address %d, ",
+					sc->vr_unit, sc->vr_phy_addr);
+		if (bootverbose)
+			printf("vendor id: %x device id: %x\n",
+				phy_vid, phy_did);
+		p = vr_phys;
+		while(p->vr_vid) {
+			if (phy_vid == p->vr_vid &&
+				(phy_did | 0x000F) == p->vr_did) {
+				sc->vr_pinfo = p;
+				break;
+			}
+			p++;
+		}
+		if (sc->vr_pinfo == NULL)
+			sc->vr_pinfo = &vr_phys[PHY_UNKNOWN];
+		if (bootverbose)
+			printf("vr%d: PHY type: %s\n",
+				sc->vr_unit, sc->vr_pinfo->vr_name);
+	} else {
+		printf("vr%d: MII without any phy!\n", sc->vr_unit);
+		goto fail;
+	}
+
+	/*
+	 * Do ifmedia setup.
+	 */
+	ifmedia_init(&sc->ifmedia, 0, vr_ifmedia_upd, vr_ifmedia_sts);
+
+	vr_getmode_mii(sc);
+	vr_autoneg_mii(sc, VR_FLAG_FORCEDELAY, 1);
+	media = sc->ifmedia.ifm_media;
+	vr_stop(sc);
+
+	ifmedia_set(&sc->ifmedia, media);
+
+	/*
+	 * Call MI attach routines.
+	 */
+	if_attach(ifp);
+	ether_ifattach(ifp);
+
+#if NBPFILTER > 0
+	bpfattach(ifp, DLT_EN10MB, sizeof(struct ether_header));
+#endif
+
+	at_shutdown(vr_shutdown, sc, SHUTDOWN_POST_SYNC);
+
+fail:
+	splx(s);
+	return;
+}
+
+/*
+ * Initialize the transmit descriptors.
+ */
+static int vr_list_tx_init(sc)
+	struct vr_softc		*sc;
+{
+	struct vr_chain_data	*cd;
+	struct vr_list_data	*ld;
+	int			i;
+
+	cd = &sc->vr_cdata;
+	ld = sc->vr_ldata;
+	for (i = 0; i < VR_TX_LIST_CNT; i++) {
+		cd->vr_tx_chain[i].vr_ptr = &ld->vr_tx_list[i];
+		if (i == (VR_TX_LIST_CNT - 1))
+			cd->vr_tx_chain[i].vr_nextdesc = 
+				&cd->vr_tx_chain[0];
+		else
+			cd->vr_tx_chain[i].vr_nextdesc =
+				&cd->vr_tx_chain[i + 1];
+	}
+
+	cd->vr_tx_free = &cd->vr_tx_chain[0];
+	cd->vr_tx_tail = cd->vr_tx_head = NULL;
+
+	return(0);
+}
+
+
+/*
+ * Initialize the RX descriptors and allocate mbufs for them. Note that
+ * we arrange the descriptors in a closed ring, so that the last descriptor
+ * points back to the first.
+ */
+static int vr_list_rx_init(sc)
+	struct vr_softc		*sc;
+{
+	struct vr_chain_data	*cd;
+	struct vr_list_data	*ld;
+	int			i;
+
+	cd = &sc->vr_cdata;
+	ld = sc->vr_ldata;
+
+	for (i = 0; i < VR_RX_LIST_CNT; i++) {
+		cd->vr_rx_chain[i].vr_ptr =
+			(struct vr_desc *)&ld->vr_rx_list[i];
+		if (vr_newbuf(sc, &cd->vr_rx_chain[i]) == ENOBUFS)
+			return(ENOBUFS);
+		if (i == (VR_RX_LIST_CNT - 1)) {
+			cd->vr_rx_chain[i].vr_nextdesc =
+					&cd->vr_rx_chain[0];
+			ld->vr_rx_list[i].vr_next =
+					vtophys(&ld->vr_rx_list[0]);
+		} else {
+			cd->vr_rx_chain[i].vr_nextdesc =
+					&cd->vr_rx_chain[i + 1];
+			ld->vr_rx_list[i].vr_next =
+					vtophys(&ld->vr_rx_list[i + 1]);
+		}
+	}
+
+	cd->vr_rx_head = &cd->vr_rx_chain[0];
+
+	return(0);
+}
+
+/*
+ * Initialize an RX descriptor and attach an MBUF cluster.
+ * Note: the length fields are only 11 bits wide, which means the
+ * largest size we can specify is 2047. This is important because
+ * MCLBYTES is 2048, so we have to subtract one otherwise we'll
+ * overflow the field and make a mess.
+ */
+static int vr_newbuf(sc, c)
+	struct vr_softc		*sc;
+	struct vr_chain_onefrag	*c;
+{
+	struct mbuf		*m_new = NULL;
+
+	MGETHDR(m_new, M_DONTWAIT, MT_DATA);
+	if (m_new == NULL) {
+		printf("vr%d: no memory for rx list -- packet dropped!\n",
+								sc->vr_unit);
+		return(ENOBUFS);
+	}
+
+	MCLGET(m_new, M_DONTWAIT);
+	if (!(m_new->m_flags & M_EXT)) {
+		printf("vr%d: no memory for rx list -- packet dropped!\n",
+								sc->vr_unit);
+		m_freem(m_new);
+		return(ENOBUFS);
+	}
+
+	c->vr_mbuf = m_new;
+	c->vr_ptr->vr_status = VR_RXSTAT;
+	c->vr_ptr->vr_data = vtophys(mtod(m_new, caddr_t));
+	c->vr_ptr->vr_ctl = VR_RXCTL_CHAIN | (MCLBYTES - 1);
+
+	return(0);
+}
+
+/*
+ * A frame has been uploaded: pass the resulting mbuf chain up to
+ * the higher level protocols.
+ */
+static void vr_rxeof(sc)
+	struct vr_softc		*sc;
+{
+        struct ether_header	*eh;
+        struct mbuf		*m;
+        struct ifnet		*ifp;
+	struct vr_chain_onefrag	*cur_rx;
+	int			total_len = 0;
+	u_int32_t		rxstat;
+
+	ifp = &sc->arpcom.ac_if;
+
+	while(!((rxstat = sc->vr_cdata.vr_rx_head->vr_ptr->vr_status) &
+							VR_RXSTAT_OWN)) {
+		cur_rx = sc->vr_cdata.vr_rx_head;
+		sc->vr_cdata.vr_rx_head = cur_rx->vr_nextdesc;
+
+		/*
+		 * If an error occurs, update stats, clear the
+		 * status word and leave the mbuf cluster in place:
+		 * it should simply get re-used next time this descriptor
+	 	 * comes up in the ring.
+		 */
+		if (rxstat & VR_RXSTAT_RXERR) {
+			ifp->if_ierrors++;
+			printf("vr%d: rx error: ", sc->vr_unit);
+			switch(rxstat & 0x000000FF) {
+			case VR_RXSTAT_CRCERR:
+				printf("crc error\n");
+				break;
+			case VR_RXSTAT_FRAMEALIGNERR:
+				printf("frame alignment error\n");
+				break;
+			case VR_RXSTAT_FIFOOFLOW:
+				printf("FIFO overflow\n");
+				break;
+			case VR_RXSTAT_GIANT:
+				printf("received giant packet\n");
+				break;
+			case VR_RXSTAT_RUNT:
+				printf("received runt packet\n");
+				break;
+			case VR_RXSTAT_BUSERR:
+				printf("system bus error\n");
+				break;
+			case VR_RXSTAT_BUFFERR:
+				printf("rx buffer error\n");
+				break;
+			default:
+				printf("unknown rx error\n");
+				break;
+			}
+			cur_rx->vr_ptr->vr_status = VR_RXSTAT;
+			cur_rx->vr_ptr->vr_ctl =
+			VR_RXCTL_CHAIN | (MCLBYTES - 1);
+			continue;
+		}
+
+		/* No errors; receive the packet. */	
+		m = cur_rx->vr_mbuf;
+		total_len = VR_RXBYTES(cur_rx->vr_ptr->vr_status);
+
+		/*
+		 * Try to conjure up a new mbuf cluster. If that
+		 * fails, it means we have an out of memory condition and
+		 * should leave the buffer in place and continue. This will
+		 * result in a lost packet, but there's little else we
+		 * can do in this situation.
+		 */
+		if (vr_newbuf(sc, cur_rx) == ENOBUFS) {
+			ifp->if_ierrors++;
+			cur_rx->vr_ptr->vr_status =
+				VR_RXSTAT_FIRSTFRAG|VR_RXSTAT_LASTFRAG;
+			cur_rx->vr_ptr->vr_ctl =
+			VR_RXCTL_CHAIN | (MCLBYTES - 1);
+			continue;
+		}
+
+		ifp->if_ipackets++;
+		eh = mtod(m, struct ether_header *);
+		m->m_pkthdr.rcvif = ifp;
+		m->m_pkthdr.len = m->m_len = total_len;
+#if NBPFILTER > 0
+		/*
+		 * Handle BPF listeners. Let the BPF user see the packet, but
+		 * don't pass it up to the ether_input() layer unless it's
+		 * a broadcast packet, multicast packet, matches our ethernet
+		 * address or the interface is in promiscuous mode.
+		 */
+		if (ifp->if_bpf) {
+			bpf_mtap(ifp, m);
+			if (ifp->if_flags & IFF_PROMISC &&
+				(bcmp(eh->ether_dhost, sc->arpcom.ac_enaddr,
+						ETHER_ADDR_LEN) &&
+					(eh->ether_dhost[0] & 1) == 0)) {
+				m_freem(m);
+				continue;
+			}
+		}
+#endif
+		/* Remove header from mbuf and pass it on. */
+		m_adj(m, sizeof(struct ether_header));
+		ether_input(ifp, eh, m);
+	}
+
+	return;
+}
+
+void vr_rxeoc(sc)
+	struct vr_softc		*sc;
+{
+
+	vr_rxeof(sc);
+	VR_CLRBIT16(sc, VR_COMMAND, VR_CMD_RX_ON);
+	CSR_WRITE_4(sc, VR_RXADDR, vtophys(sc->vr_cdata.vr_rx_head->vr_ptr));
+	VR_SETBIT16(sc, VR_COMMAND, VR_CMD_RX_ON);
+	VR_SETBIT16(sc, VR_COMMAND, VR_CMD_RX_GO);
+
+	return;
+}
+
+/*
+ * A frame was downloaded to the chip. It's safe for us to clean up
+ * the list buffers.
+ */
+
+static void vr_txeof(sc)
+	struct vr_softc		*sc;
+{
+	struct vr_chain		*cur_tx;
+	struct ifnet		*ifp;
+	register struct mbuf	*n;
+
+	ifp = &sc->arpcom.ac_if;
+
+	/* Clear the timeout timer. */
+	ifp->if_timer = 0;
+
+	/* Sanity check. */
+	if (sc->vr_cdata.vr_tx_head == NULL)
+		return;
+
+	/*
+	 * Go through our tx list and free mbufs for those
+	 * frames that have been transmitted.
+	 */
+	while(sc->vr_cdata.vr_tx_head->vr_mbuf != NULL) {
+		u_int32_t		txstat;
+
+		cur_tx = sc->vr_cdata.vr_tx_head;
+		txstat = cur_tx->vr_ptr->vr_status;
+
+		if ((txstat & VR_TXSTAT_OWN) || txstat == VR_UNSENT)
+			break;
+
+		if (txstat & VR_TXSTAT_ERRSUM) {
+			ifp->if_oerrors++;
+			if (txstat & VR_TXSTAT_DEFER)
+				ifp->if_collisions++;
+			if (txstat & VR_TXSTAT_LATECOLL)
+				ifp->if_collisions++;
+		}
+
+		ifp->if_collisions +=(txstat & VR_TXSTAT_COLLCNT) >> 3;
+
+		ifp->if_opackets++;
+        	MFREE(cur_tx->vr_mbuf, n);
+		cur_tx->vr_mbuf = NULL;
+
+		if (sc->vr_cdata.vr_tx_head == sc->vr_cdata.vr_tx_tail) {
+			sc->vr_cdata.vr_tx_head = NULL;
+			sc->vr_cdata.vr_tx_tail = NULL;
+			break;
+		}
+
+		sc->vr_cdata.vr_tx_head = cur_tx->vr_nextdesc;
+	}
+
+	return;
+}
+
+/*
+ * TX 'end of channel' interrupt handler.
+ */
+static void vr_txeoc(sc)
+	struct vr_softc		*sc;
+{
+	struct ifnet		*ifp;
+
+	ifp = &sc->arpcom.ac_if;
+
+	ifp->if_timer = 0;
+
+	if (sc->vr_cdata.vr_tx_head == NULL) {
+		ifp->if_flags &= ~IFF_OACTIVE;
+		sc->vr_cdata.vr_tx_tail = NULL;
+		if (sc->vr_want_auto)
+			vr_autoneg_mii(sc, VR_FLAG_SCHEDDELAY, 1);
+	} else {
+		if (VR_TXOWN(sc->vr_cdata.vr_tx_head) == VR_UNSENT) {
+			VR_TXOWN(sc->vr_cdata.vr_tx_head) = VR_TXSTAT_OWN;
+			ifp->if_timer = 5;
+			VR_SETBIT16(sc, VR_COMMAND, VR_CMD_TX_ON|VR_CMD_TX_GO);
+		}
+	}
+
+	return;
+}
+
+static void vr_intr(arg)
+	void			*arg;
+{
+	struct vr_softc		*sc;
+	struct ifnet		*ifp;
+	u_int16_t		status;
+
+	sc = arg;
+	ifp = &sc->arpcom.ac_if;
+
+	/* Supress unwanted interrupts. */
+	if (!(ifp->if_flags & IFF_UP)) {
+		vr_stop(sc);
+		return;
+	}
+
+	/* Disable interrupts. */
+	CSR_WRITE_2(sc, VR_IMR, 0x0000);
+
+	for (;;) {
+
+		status = CSR_READ_2(sc, VR_ISR);
+		if (status)
+			CSR_WRITE_2(sc, VR_ISR, status);
+
+		if ((status & VR_INTRS) == 0)
+			break;
+
+		if (status & VR_ISR_RX_OK)
+			vr_rxeof(sc);
+
+		if ((status & VR_ISR_RX_ERR) || (status & VR_ISR_RX_NOBUF) ||
+		    (status & VR_ISR_RX_NOBUF) || (status & VR_ISR_RX_OFLOW) ||
+		    (status & VR_ISR_RX_DROPPED)) {
+			vr_rxeof(sc);
+			vr_rxeoc(sc);
+		}
+
+		if (status & VR_ISR_TX_OK) {
+			vr_txeof(sc);
+			vr_txeoc(sc);
+		}
+
+		if ((status & VR_ISR_TX_UNDERRUN)||(status & VR_ISR_TX_ABRT)){ 
+			ifp->if_oerrors++;
+			vr_txeof(sc);
+			if (sc->vr_cdata.vr_tx_head != NULL) {
+				VR_SETBIT16(sc, VR_COMMAND, VR_CMD_TX_ON);
+				VR_SETBIT16(sc, VR_COMMAND, VR_CMD_TX_GO);
+			}
+		}
+
+		if (status & VR_ISR_BUSERR) {
+			vr_reset(sc);
+			vr_init(sc);
+		}
+	}
+
+	/* Re-enable interrupts. */
+	CSR_WRITE_2(sc, VR_IMR, VR_INTRS);
+
+	if (ifp->if_snd.ifq_head != NULL) {
+		vr_start(ifp);
+	}
+
+	return;
+}
+
+/*
+ * Encapsulate an mbuf chain in a descriptor by coupling the mbuf data
+ * pointers to the fragment pointers.
+ */
+static int vr_encap(sc, c, m_head)
+	struct vr_softc		*sc;
+	struct vr_chain		*c;
+	struct mbuf		*m_head;
+{
+	int			frag = 0;
+	struct vr_desc		*f = NULL;
+	int			total_len;
+	struct mbuf		*m;
+
+	m = m_head;
+	total_len = 0;
+
+	/*
+	 * The VIA Rhine wants packet buffers to be longword
+	 * aligned, but very often our mbufs aren't. Rather than
+	 * waste time trying to decide when to copy and when not
+	 * to copy, just do it all the time.
+	 */
+	if (m != NULL) {
+		struct mbuf		*m_new = NULL;
+
+		MGETHDR(m_new, M_DONTWAIT, MT_DATA);
+		if (m_new == NULL) {
+			printf("vr%d: no memory for tx list", sc->vr_unit);
+			return(1);
+		}
+		if (m_head->m_pkthdr.len > MHLEN) {
+			MCLGET(m_new, M_DONTWAIT);
+			if (!(m_new->m_flags & M_EXT)) {
+				m_freem(m_new);
+				printf("vr%d: no memory for tx list",
+						sc->vr_unit);
+				return(1);
+			}
+		}
+		m_copydata(m_head, 0, m_head->m_pkthdr.len,	
+					mtod(m_new, caddr_t));
+		m_new->m_pkthdr.len = m_new->m_len = m_head->m_pkthdr.len;
+		m_freem(m_head);
+		m_head = m_new;
+		/*
+		 * The Rhine chip doesn't auto-pad, so we have to make
+		 * sure to pad short frames out to the minimum frame length
+		 * ourselves.
+		 */
+		if (m_head->m_len < VR_MIN_FRAMELEN) {
+			m_new->m_pkthdr.len += VR_MIN_FRAMELEN - m_new->m_len;
+			m_new->m_len = m_new->m_pkthdr.len;
+		}
+		f = c->vr_ptr;
+		f->vr_data = vtophys(mtod(m_new, caddr_t));
+		f->vr_ctl = total_len = m_new->m_len;
+		f->vr_ctl |= VR_TXCTL_TLINK|VR_TXCTL_FIRSTFRAG;
+		f->vr_status = 0;
+		frag = 1;
+	}
+
+	c->vr_mbuf = m_head;
+	c->vr_ptr->vr_ctl |= VR_TXCTL_LASTFRAG;
+	c->vr_ptr->vr_next = vtophys(c->vr_nextdesc->vr_ptr);
+
+	return(0);
+}
+
+/*
+ * Main transmit routine. To avoid having to do mbuf copies, we put pointers
+ * to the mbuf data regions directly in the transmit lists. We also save a
+ * copy of the pointers since the transmit list fragment pointers are
+ * physical addresses.
+ */
+
+static void vr_start(ifp)
+	struct ifnet		*ifp;
+{
+	struct vr_softc		*sc;
+	struct mbuf		*m_head = NULL;
+	struct vr_chain		*cur_tx = NULL, *start_tx;
+
+	sc = ifp->if_softc;
+
+	if (sc->vr_autoneg) {
+		sc->vr_tx_pend = 1;
+		return;
+	}
+
+	/*
+	 * Check for an available queue slot. If there are none,
+	 * punt.
+	 */
+	if (sc->vr_cdata.vr_tx_free->vr_mbuf != NULL) {
+		ifp->if_flags |= IFF_OACTIVE;
+		return;
+	}
+
+	start_tx = sc->vr_cdata.vr_tx_free;
+
+	while(sc->vr_cdata.vr_tx_free->vr_mbuf == NULL) {
+		IF_DEQUEUE(&ifp->if_snd, m_head);
+		if (m_head == NULL)
+			break;
+
+		/* Pick a descriptor off the free list. */
+		cur_tx = sc->vr_cdata.vr_tx_free;
+		sc->vr_cdata.vr_tx_free = cur_tx->vr_nextdesc;
+
+		/* Pack the data into the descriptor. */
+		vr_encap(sc, cur_tx, m_head);
+
+		if (cur_tx != start_tx)
+			VR_TXOWN(cur_tx) = VR_TXSTAT_OWN;
+
+#if NBPFILTER > 0
+		/*
+		 * If there's a BPF listener, bounce a copy of this frame
+		 * to him.
+		 */
+		if (ifp->if_bpf)
+			bpf_mtap(ifp, cur_tx->vr_mbuf);
+#endif
+	}
+
+	/*
+	 * Place the request for the upload interrupt
+	 * in the last descriptor in the chain. This way, if
+	 * we're chaining several packets at once, we'll only
+	 * get an interupt once for the whole chain rather than
+	 * once for each packet.
+	 */
+	cur_tx->vr_ptr->vr_ctl |= VR_TXCTL_FINT;
+	sc->vr_cdata.vr_tx_tail = cur_tx;
+
+	if (sc->vr_cdata.vr_tx_head == NULL) {
+		sc->vr_cdata.vr_tx_head = start_tx;
+		VR_TXOWN(start_tx) = VR_TXSTAT_OWN;
+		VR_SETBIT16(sc, VR_COMMAND, VR_CMD_TX_ON|VR_CMD_TX_GO);
+	} else {
+		VR_TXOWN(start_tx) = VR_UNSENT;
+	}
+
+	/*
+	 * Set a timeout in case the chip goes out to lunch.
+	 */
+	ifp->if_timer = 5;
+
+	return;
+}
+
+static void vr_init(xsc)
+	void			*xsc;
+{
+	struct vr_softc		*sc = xsc;
+	struct ifnet		*ifp = &sc->arpcom.ac_if;
+	u_int16_t		phy_bmcr = 0;
+	int			s;
+
+	if (sc->vr_autoneg)
+		return;
+
+	s = splimp();
+
+	if (sc->vr_pinfo != NULL)
+		phy_bmcr = vr_phy_readreg(sc, PHY_BMCR);
+
+	/*
+	 * Cancel pending I/O and free all RX/TX buffers.
+	 */
+	vr_stop(sc);
+	vr_reset(sc);
+
+	VR_CLRBIT(sc, VR_RXCFG, VR_RXCFG_RX_THRESH);
+	VR_SETBIT(sc, VR_RXCFG, VR_RXTHRESH_STORENFWD);
+
+	VR_CLRBIT(sc, VR_TXCFG, VR_TXCFG_TX_THRESH);
+	VR_SETBIT(sc, VR_TXCFG, VR_TXTHRESH_STORENFWD);
+
+	/* Init circular RX list. */
+	if (vr_list_rx_init(sc) == ENOBUFS) {
+		printf("vr%d: initialization failed: no "
+			"memory for rx buffers\n", sc->vr_unit);
+		vr_stop(sc);
+		(void)splx(s);
+		return;
+	}
+
+	/*
+	 * Init tx descriptors.
+	 */
+	vr_list_tx_init(sc);
+
+	/* If we want promiscuous mode, set the allframes bit. */
+	if (ifp->if_flags & IFF_PROMISC)
+		VR_SETBIT(sc, VR_RXCFG, VR_RXCFG_RX_PROMISC);
+	else
+		VR_CLRBIT(sc, VR_RXCFG, VR_RXCFG_RX_PROMISC);
+
+	/* Set capture broadcast bit to capture broadcast frames. */
+	if (ifp->if_flags & IFF_BROADCAST)
+		VR_SETBIT(sc, VR_RXCFG, VR_RXCFG_RX_BROAD);
+	else
+		VR_CLRBIT(sc, VR_RXCFG, VR_RXCFG_RX_BROAD);
+
+	/*
+	 * Program the multicast filter, if necessary.
+	 */
+	vr_setmulti(sc);
+
+	/*
+	 * Load the address of the RX list.
+	 */
+	CSR_WRITE_4(sc, VR_RXADDR, vtophys(sc->vr_cdata.vr_rx_head->vr_ptr));
+
+	/* Enable receiver and transmitter. */
+	CSR_WRITE_2(sc, VR_COMMAND, VR_CMD_TX_NOPOLL|VR_CMD_START|
+				    VR_CMD_TX_ON|VR_CMD_RX_ON|
+				    VR_CMD_RX_GO);
+
+	vr_setcfg(sc, vr_phy_readreg(sc, PHY_BMCR));
+
+	CSR_WRITE_4(sc, VR_TXADDR, vtophys(&sc->vr_ldata->vr_tx_list[0]));
+
+	/*
+	 * Enable interrupts.
+	 */
+	CSR_WRITE_2(sc, VR_ISR, 0xFFFF);
+	CSR_WRITE_2(sc, VR_IMR, VR_INTRS);
+
+	/* Restore state of BMCR */
+	if (sc->vr_pinfo != NULL)
+		vr_phy_writereg(sc, PHY_BMCR, phy_bmcr);
+
+	ifp->if_flags |= IFF_RUNNING;
+	ifp->if_flags &= ~IFF_OACTIVE;
+
+	(void)splx(s);
+
+	return;
+}
+
+/*
+ * Set media options.
+ */
+static int vr_ifmedia_upd(ifp)
+	struct ifnet		*ifp;
+{
+	struct vr_softc		*sc;
+	struct ifmedia		*ifm;
+
+	sc = ifp->if_softc;
+	ifm = &sc->ifmedia;
+
+	if (IFM_TYPE(ifm->ifm_media) != IFM_ETHER)
+		return(EINVAL);
+
+	if (IFM_SUBTYPE(ifm->ifm_media) == IFM_AUTO)
+		vr_autoneg_mii(sc, VR_FLAG_SCHEDDELAY, 1);
+	else
+		vr_setmode_mii(sc, ifm->ifm_media);
+
+	return(0);
+}
+
+/*
+ * Report current media status.
+ */
+static void vr_ifmedia_sts(ifp, ifmr)
+	struct ifnet		*ifp;
+	struct ifmediareq	*ifmr;
+{
+	struct vr_softc		*sc;
+	u_int16_t		advert = 0, ability = 0;
+
+	sc = ifp->if_softc;
+
+	ifmr->ifm_active = IFM_ETHER;
+
+	if (!(vr_phy_readreg(sc, PHY_BMCR) & PHY_BMCR_AUTONEGENBL)) {
+		if (vr_phy_readreg(sc, PHY_BMCR) & PHY_BMCR_SPEEDSEL)
+			ifmr->ifm_active = IFM_ETHER|IFM_100_TX;
+		else
+			ifmr->ifm_active = IFM_ETHER|IFM_10_T;
+		if (vr_phy_readreg(sc, PHY_BMCR) & PHY_BMCR_DUPLEX)
+			ifmr->ifm_active |= IFM_FDX;
+		else
+			ifmr->ifm_active |= IFM_HDX;
+		return;
+	}
+
+	ability = vr_phy_readreg(sc, PHY_LPAR);
+	advert = vr_phy_readreg(sc, PHY_ANAR);
+	if (advert & PHY_ANAR_100BT4 &&
+		ability & PHY_ANAR_100BT4) {
+		ifmr->ifm_active = IFM_ETHER|IFM_100_T4;
+	} else if (advert & PHY_ANAR_100BTXFULL &&
+		ability & PHY_ANAR_100BTXFULL) {
+		ifmr->ifm_active = IFM_ETHER|IFM_100_TX|IFM_FDX;
+	} else if (advert & PHY_ANAR_100BTXHALF &&
+		ability & PHY_ANAR_100BTXHALF) {
+		ifmr->ifm_active = IFM_ETHER|IFM_100_TX|IFM_HDX;
+	} else if (advert & PHY_ANAR_10BTFULL &&
+		ability & PHY_ANAR_10BTFULL) {
+		ifmr->ifm_active = IFM_ETHER|IFM_10_T|IFM_FDX;
+	} else if (advert & PHY_ANAR_10BTHALF &&
+		ability & PHY_ANAR_10BTHALF) {
+		ifmr->ifm_active = IFM_ETHER|IFM_10_T|IFM_HDX;
+	}
+
+	return;
+}
+
+static int vr_ioctl(ifp, command, data)
+	struct ifnet		*ifp;
+	u_long			command;
+	caddr_t			data;
+{
+	struct vr_softc		*sc = ifp->if_softc;
+	struct ifreq		*ifr = (struct ifreq *) data;
+	int			s, error = 0;
+
+	s = splimp();
+
+	switch(command) {
+	case SIOCSIFADDR:
+	case SIOCGIFADDR:
+	case SIOCSIFMTU:
+		error = ether_ioctl(ifp, command, data);
+		break;
+	case SIOCSIFFLAGS:
+		if (ifp->if_flags & IFF_UP) {
+			vr_init(sc);
+		} else {
+			if (ifp->if_flags & IFF_RUNNING)
+				vr_stop(sc);
+		}
+		error = 0;
+		break;
+	case SIOCADDMULTI:
+	case SIOCDELMULTI:
+		vr_setmulti(sc);
+		error = 0;
+		break;
+	case SIOCGIFMEDIA:
+	case SIOCSIFMEDIA:
+		error = ifmedia_ioctl(ifp, ifr, &sc->ifmedia, command);
+		break;
+	default:
+		error = EINVAL;
+		break;
+	}
+
+	(void)splx(s);
+
+	return(error);
+}
+
+static void vr_watchdog(ifp)
+	struct ifnet		*ifp;
+{
+	struct vr_softc		*sc;
+
+	sc = ifp->if_softc;
+
+	if (sc->vr_autoneg) {
+		vr_autoneg_mii(sc, VR_FLAG_DELAYTIMEO, 1);
+		return;
+	}
+
+	ifp->if_oerrors++;
+	printf("vr%d: watchdog timeout\n", sc->vr_unit);
+
+	if (!(vr_phy_readreg(sc, PHY_BMSR) & PHY_BMSR_LINKSTAT))
+		printf("vr%d: no carrier - transceiver cable problem?\n",
+								sc->vr_unit);
+
+	vr_stop(sc);
+	vr_reset(sc);
+	vr_init(sc);
+
+	if (ifp->if_snd.ifq_head != NULL)
+		vr_start(ifp);
+
+	return;
+}
+
+/*
+ * Stop the adapter and free any mbufs allocated to the
+ * RX and TX lists.
+ */
+static void vr_stop(sc)
+	struct vr_softc		*sc;
+{
+	register int		i;
+	struct ifnet		*ifp;
+
+	ifp = &sc->arpcom.ac_if;
+	ifp->if_timer = 0;
+
+	VR_SETBIT16(sc, VR_COMMAND, VR_CMD_STOP);
+	VR_CLRBIT16(sc, VR_COMMAND, (VR_CMD_RX_ON|VR_CMD_TX_ON));
+	CSR_WRITE_2(sc, VR_IMR, 0x0000);
+	CSR_WRITE_4(sc, VR_TXADDR, 0x00000000);
+	CSR_WRITE_4(sc, VR_RXADDR, 0x00000000);
+
+	/*
+	 * Free data in the RX lists.
+	 */
+	for (i = 0; i < VR_RX_LIST_CNT; i++) {
+		if (sc->vr_cdata.vr_rx_chain[i].vr_mbuf != NULL) {
+			m_freem(sc->vr_cdata.vr_rx_chain[i].vr_mbuf);
+			sc->vr_cdata.vr_rx_chain[i].vr_mbuf = NULL;
+		}
+	}
+	bzero((char *)&sc->vr_ldata->vr_rx_list,
+		sizeof(sc->vr_ldata->vr_rx_list));
+
+	/*
+	 * Free the TX list buffers.
+	 */
+	for (i = 0; i < VR_TX_LIST_CNT; i++) {
+		if (sc->vr_cdata.vr_tx_chain[i].vr_mbuf != NULL) {
+			m_freem(sc->vr_cdata.vr_tx_chain[i].vr_mbuf);
+			sc->vr_cdata.vr_tx_chain[i].vr_mbuf = NULL;
+		}
+	}
+
+	bzero((char *)&sc->vr_ldata->vr_tx_list,
+		sizeof(sc->vr_ldata->vr_tx_list));
+
+	ifp->if_flags &= ~(IFF_RUNNING | IFF_OACTIVE);
+
+	return;
+}
+
+/*
+ * Stop all chip I/O so that the kernel's probe routines don't
+ * get confused by errant DMAs when rebooting.
+ */
+static void vr_shutdown(howto, arg)
+	int			howto;
+	void			*arg;
+{
+	struct vr_softc		*sc = (struct vr_softc *)arg;
+
+	vr_stop(sc);
+
+	return;
+}
+
+static struct pci_device vr_device = {
+	"vr",
+	vr_probe,
+	vr_attach,
+	&vr_count,
+	NULL
+};
+DATA_SET(pcidevice_set, vr_device);
diff --git a/sys/pci/if_vrreg.h b/sys/pci/if_vrreg.h
new file mode 100644
index 0000000..42f3a13
--- /dev/null
+++ b/sys/pci/if_vrreg.h
@@ -0,0 +1,615 @@
+/*
+ * Copyright (c) 1997, 1998
+ *	Bill Paul <wpaul@ctr.columbia.edu>.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ * 3. All advertising materials mentioning features or use of this software
+ *    must display the following acknowledgement:
+ *	This product includes software developed by Bill Paul.
+ * 4. Neither the name of the author nor the names of any co-contributors
+ *    may be used to endorse or promote products derived from this software
+ *    without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY Bill Paul AND CONTRIBUTORS ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL Bill Paul OR THE VOICES IN HIS HEAD
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ *
+ *	$Id: if_vrreg.h,v 1.8 1998/12/01 22:08:11 wpaul Exp $
+ */
+
+/*
+ * Rhine register definitions.
+ */
+
+#define VR_PAR0			0x00	/* node address 0 to 4 */
+#define VR_PAR1			0x04	/* node address 2 to 6 */
+#define VR_RXCFG		0x06	/* receiver config register */
+#define VR_TXCFG		0x07	/* transmit config register */
+#define VR_COMMAND		0x08	/* command register */
+#define VR_ISR			0x0C	/* interrupt/status register */
+#define VR_IMR			0x0E	/* interrupt mask register */
+#define VR_MAR0			0x10	/* multicast hash 0 */
+#define VR_MAR1			0x14	/* multicast hash 1 */
+#define VR_RXADDR		0x18	/* rx descriptor list start addr */
+#define VR_TXADDR		0x1C	/* tx descriptor list start addr */
+#define VR_CURRXDESC0		0x20
+#define VR_CURRXDESC1		0x24
+#define VR_CURRXDESC2		0x28
+#define VR_CURRXDESC3		0x2C
+#define VR_NEXTRXDESC0		0x30
+#define VR_NEXTRXDESC1		0x34
+#define VR_NEXTRXDESC2		0x38
+#define VR_NEXTRXDESC3		0x3C
+#define VR_CURTXDESC0		0x40
+#define VR_CURTXDESC1		0x44
+#define VR_CURTXDESC2		0x48
+#define VR_CURTXDESC3		0x4C
+#define VR_NEXTTXDESC0		0x50
+#define VR_NEXTTXDESC1		0x54
+#define VR_NEXTTXDESC2		0x58
+#define VR_NEXTTXDESC3		0x5C
+#define VR_CURRXDMA		0x60	/* current RX DMA address */
+#define VR_CURTXDMA		0x64	/* current TX DMA address */
+#define VR_TALLYCNT		0x68	/* tally counter test register */
+#define VR_PHYADDR		0x6C
+#define VR_MIISTAT		0x6D
+#define VR_BCR0			0x6E
+#define VR_BCR1			0x6F
+#define VR_MIICMD		0x70
+#define VR_MIIADDR		0x71
+#define VR_MIIDATA		0x72
+#define VR_EECSR		0x74
+#define VR_TEST			0x75
+#define VR_GPIO			0x76
+#define VR_CONFIG		0x78
+#define VR_MPA_CNT		0x7C
+#define VR_CRC_CNT		0x7E
+
+/*
+ * RX config bits.
+ */
+#define VR_RXCFG_RX_ERRPKTS	0x01
+#define VR_RXCFG_RX_RUNT	0x02
+#define VR_RXCFG_RX_MULTI	0x04
+#define VR_RXCFG_RX_BROAD	0x08
+#define VR_RXCFG_RX_PROMISC	0x10
+#define VR_RXCFG_RX_THRESH	0xE0
+
+#define VR_RXTHRESH_32BYTES	0x00
+#define VR_RXTHRESH_64BYTES	0x20
+#define VR_RXTHRESH_128BYTES	0x40
+#define VR_RXTHRESH_256BYTES	0x60
+#define VR_RXTHRESH_512BYTES	0x80
+#define VR_RXTHRESH_768BYTES	0xA0
+#define VR_RXTHRESH_1024BYTES	0xC0
+#define VR_RXTHRESH_STORENFWD	0xE0
+
+/*
+ * TX config bits.
+ */
+#define VR_TXCFG_RSVD0		0x01
+#define VR_TXCFG_LOOPBKMODE	0x06
+#define VR_TXCFG_BACKOFF	0x08
+#define VR_TXCFG_RSVD1		0x10
+#define VR_TXCFG_TX_THRESH	0xE0
+
+#define VR_TXTHRESH_32BYTES	0x00
+#define VR_TXTHRESH_64BYTES	0x20
+#define VR_TXTHRESH_128BYTES	0x40
+#define VR_TXTHRESH_256BYTES	0x60
+#define VR_TXTHRESH_512BYTES	0x80
+#define VR_TXTHRESH_768BYTES	0xA0
+#define VR_TXTHRESH_1024BYTES	0xC0
+#define VR_TXTHRESH_STORENFWD	0xE0
+
+/*
+ * Command register bits.
+ */
+#define VR_CMD_INIT		0x0001
+#define VR_CMD_START		0x0002
+#define VR_CMD_STOP		0x0004
+#define VR_CMD_RX_ON		0x0008
+#define VR_CMD_TX_ON		0x0010
+#define	VR_CMD_TX_GO		0x0020
+#define VR_CMD_RX_GO		0x0040
+#define VR_CMD_RSVD		0x0080
+#define VR_CMD_RX_EARLY		0x0100
+#define VR_CMD_TX_EARLY		0x0200
+#define VR_CMD_FULLDUPLEX	0x0400
+#define VR_CMD_TX_NOPOLL	0x0800
+
+#define VR_CMD_RESET		0x8000
+
+/*
+ * Interrupt status bits.
+ */
+#define VR_ISR_RX_OK		0x0001	/* packet rx ok */
+#define VR_ISR_TX_OK		0x0002	/* packet tx ok */
+#define VR_ISR_RX_ERR		0x0004	/* packet rx with err */
+#define VR_ISR_TX_ABRT		0x0008	/* tx aborted due to excess colls */
+#define VR_ISR_TX_UNDERRUN	0x0010	/* tx buffer underflow */
+#define VR_ISR_RX_NOBUF		0x0020	/* no rx buffer available */
+#define VR_ISR_BUSERR		0x0040	/* PCI bus error */
+#define VR_ISR_STATSOFLOW	0x0080	/* stats counter oflow */
+#define VR_ISR_RX_EARLY		0x0100	/* rx early */
+#define VR_ISR_LINKSTAT		0x0200	/* MII status change */
+#define VR_ISR_RX_OFLOW		0x0400	/* rx FIFO overflow */
+#define VR_ISR_RX_DROPPED	0x0800
+#define VR_ISR_RX_NOBUF2	0x1000
+#define VR_ISR_TX_ABRT2		0x2000
+#define VR_ISR_LINKSTAT2	0x4000
+#define VR_ISR_MAGICPACKET	0x8000
+
+/*
+ * Interrupt mask bits.
+ */
+#define VR_IMR_RX_OK		0x0001	/* packet rx ok */
+#define VR_IMR_TX_OK		0x0002	/* packet tx ok */
+#define VR_IMR_RX_ERR		0x0004	/* packet rx with err */
+#define VR_IMR_TX_ABRT		0x0008	/* tx aborted due to excess colls */
+#define VR_IMR_TX_UNDERRUN	0x0010	/* tx buffer underflow */
+#define VR_IMR_RX_NOBUF		0x0020	/* no rx buffer available */
+#define VR_IMR_BUSERR		0x0040	/* PCI bus error */
+#define VR_IMR_STATSOFLOW	0x0080	/* stats counter oflow */
+#define VR_IMR_RX_EARLY		0x0100	/* rx early */
+#define VR_IMR_LINKSTAT		0x0200	/* MII status change */
+#define VR_IMR_RX_OFLOW		0x0400	/* rx FIFO overflow */
+#define VR_IMR_RX_DROPPED	0x0800
+#define VR_IMR_RX_NOBUF2	0x1000
+#define VR_IMR_TX_ABRT2		0x2000
+#define VR_IMR_LINKSTAT2	0x4000
+#define VR_IMR_MAGICPACKET	0x8000
+
+#define VR_INTRS							\
+	(VR_IMR_RX_OK|VR_IMR_TX_OK|VR_IMR_RX_NOBUF|			\
+	VR_IMR_TX_ABRT|VR_IMR_TX_UNDERRUN|VR_IMR_BUSERR|		\
+	VR_IMR_RX_ERR|VR_ISR_RX_DROPPED)
+
+/*
+ * MII status register.
+ */
+
+#define VR_MIISTAT_SPEED	0x01
+#define VR_MIISTAT_LINKFAULT	0x02
+#define VR_MIISTAT_MGTREADERR	0x04
+#define VR_MIISTAT_MIIERR	0x08
+#define VR_MIISTAT_PHYOPT	0x10
+#define VR_MIISTAT_MDC_SPEED	0x20
+#define VR_MIISTAT_RSVD		0x40
+#define VR_MIISTAT_GPIO1POLL	0x80
+
+/*
+ * MII command register bits.
+ */
+#define VR_MIICMD_CLK		0x01
+#define VR_MIICMD_DATAOUT	0x02
+#define VR_MIICMD_DATAIN	0x04
+#define VR_MIICMD_DIR		0x08
+#define VR_MIICMD_DIRECTPGM	0x10
+#define VR_MIICMD_WRITE_ENB	0x20
+#define VR_MIICMD_READ_ENB	0x40
+#define VR_MIICMD_AUTOPOLL	0x80
+
+/*
+ * EEPROM control bits.
+ */
+#define VR_EECSR_DATAIN		0x01	/* data out */
+#define VR_EECSR_DATAOUT	0x02	/* data in */
+#define VR_EECSR_CLK		0x04	/* clock */
+#define VR_EECSR_CS		0x08	/* chip select */
+#define VR_EECSR_DPM		0x10
+#define VR_EECSR_LOAD		0x20
+#define VR_EECSR_EMBP		0x40
+#define VR_EECSR_EEPR		0x80
+
+#define VR_EECMD_WRITE		0x140
+#define VR_EECMD_READ		0x180
+#define VR_EECMD_ERASE		0x1c0
+
+/*
+ * Test register bits.
+ */
+#define VR_TEST_TEST0		0x01
+#define VR_TEST_TEST1		0x02
+#define VR_TEST_TEST2		0x04
+#define VR_TEST_TSTUD		0x08
+#define VR_TEST_TSTOV		0x10
+#define VR_TEST_BKOFF		0x20
+#define VR_TEST_FCOL		0x40
+#define VR_TEST_HBDES		0x80
+
+/*
+ * Config register bits.
+ */
+#define VR_CFG_GPIO2OUTENB	0x00000001
+#define VR_CFG_GPIO2OUT		0x00000002	/* gen. purp. pin */
+#define VR_CFG_GPIO2IN		0x00000004	/* gen. purp. pin */
+#define VR_CFG_AUTOOPT		0x00000008	/* enable rx/tx autopoll */
+#define VR_CFG_MIIOPT		0x00000010
+#define VR_CFG_MMIENB		0x00000020	/* memory mapped mode enb */
+#define VR_CFG_JUMPER		0x00000040	/* PHY and oper. mode select */
+#define VR_CFG_EELOAD		0x00000080	/* enable EEPROM programming */
+#define VR_CFG_LATMENB		0x00000100	/* larency timer effect enb. */
+#define VR_CFG_MRREADWAIT	0x00000200
+#define VR_CFG_MRWRITEWAIT	0x00000400
+#define VR_CFG_RX_ARB		0x00000800
+#define VR_CFG_TX_ARB		0x00001000
+#define VR_CFG_READMULTI	0x00002000
+#define VR_CFG_TX_PACE		0x00004000
+#define VR_CFG_TX_QDIS		0x00008000
+#define VR_CFG_ROMSEL0		0x00010000
+#define VR_CFG_ROMSEL1		0x00020000
+#define VR_CFG_ROMSEL2		0x00040000
+#define VR_CFG_ROMTIMESEL	0x00080000
+#define VR_CFG_RSVD0		0x00100000
+#define VR_CFG_ROMDLY		0x00200000
+#define VR_CFG_ROMOPT		0x00400000
+#define VR_CFG_RSVD1		0x00800000
+#define VR_CFG_BACKOFFOPT	0x01000000
+#define VR_CFG_BACKOFFMOD	0x02000000
+#define VR_CFG_CAPEFFECT	0x04000000
+#define VR_CFG_BACKOFFRAND	0x08000000
+#define VR_CFG_MAGICKPACKET	0x10000000
+#define VR_CFG_PCIREADLINE	0x20000000
+#define VR_CFG_DIAG		0x40000000
+#define VR_CFG_GPIOEN		0x80000000
+
+/*
+ * Rhine TX/RX list structure.
+ */
+
+struct vr_desc {
+	u_int32_t		vr_status;
+	u_int32_t		vr_ctl;
+	u_int32_t		vr_ptr1;
+	u_int32_t		vr_ptr2;
+};
+
+#define vr_data		vr_ptr1
+#define vr_next		vr_ptr2
+
+
+#define VR_RXSTAT_RXERR		0x00000001
+#define VR_RXSTAT_CRCERR	0x00000002
+#define VR_RXSTAT_FRAMEALIGNERR	0x00000004
+#define VR_RXSTAT_FIFOOFLOW	0x00000008
+#define VR_RXSTAT_GIANT		0x00000010
+#define VR_RXSTAT_RUNT		0x00000020
+#define VR_RXSTAT_BUSERR	0x00000040
+#define VR_RXSTAT_BUFFERR	0x00000080
+#define VR_RXSTAT_LASTFRAG	0x00000100
+#define VR_RXSTAT_FIRSTFRAG	0x00000200
+#define VR_RXSTAT_RLINK		0x00000400
+#define VR_RXSTAT_RX_PHYS	0x00000800
+#define VR_RXSTAT_RX_BROAD	0x00001000
+#define VR_RXSTAT_RX_MULTI	0x00002000
+#define VR_RXSTAT_RX_OK		0x00004000
+#define VR_RXSTAT_RXLEN		0x07FF0000
+#define VR_RXSTAT_RXLEN_EXT	0x78000000
+#define VR_RXSTAT_OWN		0x80000000
+
+#define VR_RXBYTES(x)		((x & VR_RXSTAT_RXLEN) >> 16)
+#define VR_RXSTAT (VR_RXSTAT_FIRSTFRAG|VR_RXSTAT_LASTFRAG|VR_RXSTAT_OWN)
+
+#define VR_RXCTL_BUFLEN		0x000007FF
+#define VR_RXCTL_BUFLEN_EXT	0x00007800
+#define VR_RXCTL_CHAIN		0x00008000
+#define VR_RXCTL_RX_INTR	0x00800000
+
+
+#define VR_TXSTAT_DEFER		0x00000001
+#define VR_TXSTAT_UNDERRUN	0x00000002
+#define VR_TXSTAT_COLLCNT	0x00000078
+#define VR_TXSTAT_SQE		0x00000080
+#define VR_TXSTAT_ABRT		0x00000100
+#define VR_TXSTAT_LATECOLL	0x00000200
+#define VR_TXSTAT_CARRLOST	0x00000400
+#define VR_TXSTAT_BUSERR	0x00002000
+#define VR_TXSTAT_JABTIMEO	0x00004000
+#define VR_TXSTAT_ERRSUM	0x00008000
+#define VR_TXSTAT_OWN		0x80000000
+
+#define VR_TXCTL_BUFLEN		0x000007FF
+#define VR_TXCTL_BUFLEN_EXT	0x00007800
+#define VR_TXCTL_TLINK		0x00008000
+#define VR_TXCTL_FIRSTFRAG	0x00200000
+#define VR_TXCTL_LASTFRAG	0x00400000
+#define VR_TXCTL_FINT		0x00800000
+
+
+#define VR_MAXFRAGS		16
+#define VR_RX_LIST_CNT		64
+#define VR_TX_LIST_CNT		64
+#define VR_MIN_FRAMELEN		60
+#define VR_FRAMELEN		1536
+
+#define VR_TXOWN(x)		x->vr_ptr->vr_status
+#define VR_UNSENT		0x12341234
+
+struct vr_list_data {
+	struct vr_desc		vr_rx_list[VR_RX_LIST_CNT];
+	struct vr_desc		vr_tx_list[VR_TX_LIST_CNT];
+};
+
+struct vr_chain {
+	struct vr_desc		*vr_ptr;
+	struct mbuf		*vr_mbuf;
+	struct vr_chain		*vr_nextdesc;
+};
+
+struct vr_chain_onefrag {
+	struct vr_desc		*vr_ptr;
+	struct mbuf		*vr_mbuf;
+	struct vr_chain_onefrag	*vr_nextdesc;
+};
+
+struct vr_chain_data {
+	struct vr_chain_onefrag	vr_rx_chain[VR_RX_LIST_CNT];
+	struct vr_chain		vr_tx_chain[VR_TX_LIST_CNT];
+
+	struct vr_chain_onefrag	*vr_rx_head;
+
+	struct vr_chain		*vr_tx_head;
+	struct vr_chain		*vr_tx_tail;
+	struct vr_chain		*vr_tx_free;
+};
+
+struct vr_type {
+	u_int16_t		vr_vid;
+	u_int16_t		vr_did;
+	char			*vr_name;
+};
+
+struct vr_mii_frame {
+	u_int8_t		mii_stdelim;
+	u_int8_t		mii_opcode;
+	u_int8_t		mii_phyaddr;
+	u_int8_t		mii_regaddr;
+	u_int8_t		mii_turnaround;
+	u_int16_t		mii_data;
+};
+
+/*
+ * MII constants
+ */
+#define VR_MII_STARTDELIM	0x01
+#define VR_MII_READOP		0x02
+#define VR_MII_WRITEOP		0x01
+#define VR_MII_TURNAROUND	0x02
+
+#define VR_FLAG_FORCEDELAY	1
+#define VR_FLAG_SCHEDDELAY	2
+#define VR_FLAG_DELAYTIMEO	3	
+
+struct vr_softc {
+	struct arpcom		arpcom;		/* interface info */
+	struct ifmedia		ifmedia;	/* media info */
+	bus_space_handle_t	vr_bhandle;	/* bus space handle */
+	bus_space_tag_t		vr_btag;	/* bus space tag */
+	struct vr_type		*vr_info;	/* Rhine adapter info */
+	struct vr_type		*vr_pinfo;	/* phy info */
+	u_int8_t		vr_unit;	/* interface number */
+	u_int8_t		vr_type;
+	u_int8_t		vr_phy_addr;	/* PHY address */
+	u_int8_t		vr_tx_pend;	/* TX pending */
+	u_int8_t		vr_want_auto;
+	u_int8_t		vr_autoneg;
+	caddr_t			vr_ldata_ptr;
+	struct vr_list_data	*vr_ldata;
+	struct vr_chain_data	vr_cdata;
+};
+
+/*
+ * register space access macros
+ */
+#define CSR_WRITE_4(sc, reg, val)	\
+	bus_space_write_4(sc->vr_btag, sc->vr_bhandle, reg, val)
+#define CSR_WRITE_2(sc, reg, val)	\
+	bus_space_write_2(sc->vr_btag, sc->vr_bhandle, reg, val)
+#define CSR_WRITE_1(sc, reg, val)	\
+	bus_space_write_1(sc->vr_btag, sc->vr_bhandle, reg, val)
+
+#define CSR_READ_4(sc, reg)		\
+	bus_space_read_4(sc->vr_btag, sc->vr_bhandle, reg)
+#define CSR_READ_2(sc, reg)		\
+	bus_space_read_2(sc->vr_btag, sc->vr_bhandle, reg)
+#define CSR_READ_1(sc, reg)		\
+	bus_space_read_1(sc->vr_btag, sc->vr_bhandle, reg)
+
+#define VR_TIMEOUT		1000
+
+/*
+ * General constants that are fun to know.
+ *
+ * VIA vendor ID
+ */
+#define	VIA_VENDORID		0x1106
+
+/*
+ * VIA Rhine device IDs.
+ */
+#define	VIA_DEVICEID_RHINE	0x3043
+#define VIA_DEVICEID_RHINE_II	0x6100
+
+
+/*
+ * Texas Instruments PHY identifiers
+ */
+#define TI_PHY_VENDORID		0x4000
+#define TI_PHY_10BT		0x501F
+#define TI_PHY_100VGPMI		0x502F
+
+/*
+ * These ID values are for the NS DP83840A 10/100 PHY
+ */
+#define NS_PHY_VENDORID		0x2000
+#define NS_PHY_83840A		0x5C0F
+
+/*
+ * Level 1 10/100 PHY
+ */
+#define LEVEL1_PHY_VENDORID	0x7810
+#define LEVEL1_PHY_LXT970	0x000F
+
+/*
+ * Intel 82555 10/100 PHY
+ */
+#define INTEL_PHY_VENDORID	0x0A28
+#define INTEL_PHY_82555		0x015F
+
+/*
+ * SEEQ 80220 10/100 PHY
+ */
+#define SEEQ_PHY_VENDORID	0x0016
+#define SEEQ_PHY_80220		0xF83F
+
+
+/*
+ * PCI low memory base and low I/O base register, and
+ * other PCI registers.
+ */
+
+#define VR_PCI_VENDOR_ID	0x00
+#define VR_PCI_DEVICE_ID	0x02
+#define VR_PCI_COMMAND		0x04
+#define VR_PCI_STATUS		0x06
+#define VR_PCI_CLASSCODE	0x09
+#define VR_PCI_LATENCY_TIMER	0x0D
+#define VR_PCI_HEADER_TYPE	0x0E
+#define VR_PCI_LOIO		0x10
+#define VR_PCI_LOMEM		0x14
+#define VR_PCI_BIOSROM		0x30
+#define VR_PCI_INTLINE		0x3C
+#define VR_PCI_INTPIN		0x3D
+#define VR_PCI_MINGNT		0x3E
+#define VR_PCI_MINLAT		0x0F
+#define VR_PCI_RESETOPT		0x48
+#define VR_PCI_EEPROM_DATA	0x4C
+
+/* power management registers */
+#define VR_PCI_CAPID		0xDC /* 8 bits */
+#define VR_PCI_NEXTPTR		0xDD /* 8 bits */
+#define VR_PCI_PWRMGMTCAP	0xDE /* 16 bits */
+#define VR_PCI_PWRMGMTCTRL	0xE0 /* 16 bits */
+
+#define VR_PSTATE_MASK		0x0003
+#define VR_PSTATE_D0		0x0000
+#define VR_PSTATE_D1		0x0002
+#define VR_PSTATE_D2		0x0002
+#define VR_PSTATE_D3		0x0003
+#define VR_PME_EN		0x0010
+#define VR_PME_STATUS		0x8000
+
+#define PHY_UNKNOWN		6
+
+#define VR_PHYADDR_MIN		0x00
+#define VR_PHYADDR_MAX		0x1F
+
+#define PHY_BMCR		0x00
+#define PHY_BMSR		0x01
+#define PHY_VENID		0x02
+#define PHY_DEVID		0x03
+#define PHY_ANAR		0x04
+#define PHY_LPAR		0x05
+#define PHY_ANEXP		0x06
+
+#define PHY_ANAR_NEXTPAGE	0x8000
+#define PHY_ANAR_RSVD0		0x4000
+#define PHY_ANAR_TLRFLT		0x2000
+#define PHY_ANAR_RSVD1		0x1000
+#define PHY_ANAR_RSVD2		0x0800
+#define PHY_ANAR_RSVD3		0x0400
+#define PHY_ANAR_100BT4		0x0200
+#define PHY_ANAR_100BTXFULL	0x0100
+#define PHY_ANAR_100BTXHALF	0x0080
+#define PHY_ANAR_10BTFULL	0x0040
+#define PHY_ANAR_10BTHALF	0x0020
+#define PHY_ANAR_PROTO4		0x0010
+#define PHY_ANAR_PROTO3		0x0008
+#define PHY_ANAR_PROTO2		0x0004
+#define PHY_ANAR_PROTO1		0x0002
+#define PHY_ANAR_PROTO0		0x0001
+
+/*
+ * These are the register definitions for the PHY (physical layer
+ * interface chip).
+ */
+/*
+ * PHY BMCR Basic Mode Control Register
+ */
+#define PHY_BMCR_RESET			0x8000
+#define PHY_BMCR_LOOPBK			0x4000
+#define PHY_BMCR_SPEEDSEL		0x2000
+#define PHY_BMCR_AUTONEGENBL		0x1000
+#define PHY_BMCR_RSVD0			0x0800	/* write as zero */
+#define PHY_BMCR_ISOLATE		0x0400
+#define PHY_BMCR_AUTONEGRSTR		0x0200
+#define PHY_BMCR_DUPLEX			0x0100
+#define PHY_BMCR_COLLTEST		0x0080
+#define PHY_BMCR_RSVD1			0x0040	/* write as zero, don't care */
+#define PHY_BMCR_RSVD2			0x0020	/* write as zero, don't care */
+#define PHY_BMCR_RSVD3			0x0010	/* write as zero, don't care */
+#define PHY_BMCR_RSVD4			0x0008	/* write as zero, don't care */
+#define PHY_BMCR_RSVD5			0x0004	/* write as zero, don't care */
+#define PHY_BMCR_RSVD6			0x0002	/* write as zero, don't care */
+#define PHY_BMCR_RSVD7			0x0001	/* write as zero, don't care */
+/*
+ * RESET: 1 == software reset, 0 == normal operation
+ * Resets status and control registers to default values.
+ * Relatches all hardware config values.
+ *
+ * LOOPBK: 1 == loopback operation enabled, 0 == normal operation
+ *
+ * SPEEDSEL: 1 == 100Mb/s, 0 == 10Mb/s
+ * Link speed is selected byt his bit or if auto-negotiation if bit
+ * 12 (AUTONEGENBL) is set (in which case the value of this register
+ * is ignored).
+ *
+ * AUTONEGENBL: 1 == Autonegotiation enabled, 0 == Autonegotiation disabled
+ * Bits 8 and 13 are ignored when autoneg is set, otherwise bits 8 and 13
+ * determine speed and mode. Should be cleared and then set if PHY configured
+ * for no autoneg on startup.
+ *
+ * ISOLATE: 1 == isolate PHY from MII, 0 == normal operation
+ *
+ * AUTONEGRSTR: 1 == restart autonegotiation, 0 = normal operation
+ *
+ * DUPLEX: 1 == full duplex mode, 0 == half duplex mode
+ *
+ * COLLTEST: 1 == collision test enabled, 0 == normal operation
+ */
+
+/* 
+ * PHY, BMSR Basic Mode Status Register 
+ */   
+#define PHY_BMSR_100BT4			0x8000
+#define PHY_BMSR_100BTXFULL		0x4000
+#define PHY_BMSR_100BTXHALF		0x2000
+#define PHY_BMSR_10BTFULL		0x1000
+#define PHY_BMSR_10BTHALF		0x0800
+#define PHY_BMSR_RSVD1			0x0400	/* write as zero, don't care */
+#define PHY_BMSR_RSVD2			0x0200	/* write as zero, don't care */
+#define PHY_BMSR_RSVD3			0x0100	/* write as zero, don't care */
+#define PHY_BMSR_RSVD4			0x0080	/* write as zero, don't care */
+#define PHY_BMSR_MFPRESUP		0x0040
+#define PHY_BMSR_AUTONEGCOMP		0x0020
+#define PHY_BMSR_REMFAULT		0x0010
+#define PHY_BMSR_CANAUTONEG		0x0008
+#define PHY_BMSR_LINKSTAT		0x0004
+#define PHY_BMSR_JABBER			0x0002
+#define PHY_BMSR_EXTENDED		0x0001
diff --git a/sys/pci/if_wb.c b/sys/pci/if_wb.c
new file mode 100644
index 0000000..41fc318
--- /dev/null
+++ b/sys/pci/if_wb.c
@@ -0,0 +1,2113 @@
+/*
+ * Copyright (c) 1997, 1998
+ *	Bill Paul <wpaul@ctr.columbia.edu>.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ * 3. All advertising materials mentioning features or use of this software
+ *    must display the following acknowledgement:
+ *	This product includes software developed by Bill Paul.
+ * 4. Neither the name of the author nor the names of any co-contributors
+ *    may be used to endorse or promote products derived from this software
+ *    without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY Bill Paul AND CONTRIBUTORS ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL Bill Paul OR THE VOICES IN HIS HEAD
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ *
+ *	$Id: if_wb.c,v 1.30 1998/11/29 06:45:16 wpaul Exp $
+ */
+
+/*
+ * Winbond fast ethernet PCI NIC driver
+ *
+ * Supports various cheap network adapters based on the Winbond W89C840F
+ * fast ethernet controller chip. This includes adapters manufactured by
+ * Winbond itself and some made by Linksys.
+ *
+ * Written by Bill Paul <wpaul@ctr.columbia.edu>
+ * Electrical Engineering Department
+ * Columbia University, New York City
+ */
+
+/*
+ * The Winbond W89C840F chip is a bus master; in some ways it resembles
+ * a DEC 'tulip' chip, only not as complicated. Unfortunately, it has
+ * one major difference which is that while the registers do many of
+ * the same things as a tulip adapter, the offsets are different: where
+ * tulip registers are typically spaced 8 bytes apart, the Winbond
+ * registers are spaced 4 bytes apart. The receiver filter is also
+ * programmed differently.
+ * 
+ * Like the tulip, the Winbond chip uses small descriptors containing
+ * a status word, a control word and 32-bit areas that can either be used
+ * to point to two external data blocks, or to point to a single block
+ * and another descriptor in a linked list. Descriptors can be grouped
+ * together in blocks to form fixed length rings or can be chained
+ * together in linked lists. A single packet may be spread out over
+ * several descriptors if necessary.
+ *
+ * For the receive ring, this driver uses a linked list of descriptors,
+ * each pointing to a single mbuf cluster buffer, which us large enough
+ * to hold an entire packet. The link list is looped back to created a
+ * closed ring.
+ *
+ * For transmission, the driver creates a linked list of 'super descriptors'
+ * which each contain several individual descriptors linked toghether.
+ * Each 'super descriptor' contains WB_MAXFRAGS descriptors, which we
+ * abuse as fragment pointers. This allows us to use a buffer managment
+ * scheme very similar to that used in the ThunderLAN and Etherlink XL
+ * drivers.
+ *
+ * Autonegotiation is performed using the external PHY via the MII bus.
+ * The sample boards I have all use a Davicom PHY.
+ *
+ * Note: the author of the Linux driver for the Winbond chip alludes
+ * to some sort of flaw in the chip's design that seems to mandate some
+ * drastic workaround which signigicantly impairs transmit performance.
+ * I have no idea what he's on about: transmit performance with all
+ * three of my test boards seems fine.
+ */
+
+#include "bpfilter.h"
+
+#include <sys/param.h>
+#include <sys/systm.h>
+#include <sys/sockio.h>
+#include <sys/mbuf.h>
+#include <sys/malloc.h>
+#include <sys/kernel.h>
+#include <sys/socket.h>
+
+#include <net/if.h>
+#include <net/if_arp.h>
+#include <net/ethernet.h>
+#include <net/if_dl.h>
+#include <net/if_media.h>
+
+#if NBPFILTER > 0
+#include <net/bpf.h>
+#endif
+
+#include <vm/vm.h>              /* for vtophys */
+#include <vm/pmap.h>            /* for vtophys */
+#include <machine/clock.h>      /* for DELAY */
+#include <machine/bus_memio.h>
+#include <machine/bus_pio.h>
+#include <machine/bus.h>
+
+#include <pci/pcireg.h>
+#include <pci/pcivar.h>
+
+#define WB_USEIOSPACE
+
+/* #define WB_BACKGROUND_AUTONEG */
+
+#include <pci/if_wbreg.h>
+
+#ifndef lint
+static char rcsid[] =
+	"$Id: if_wb.c,v 1.30 1998/11/29 06:45:16 wpaul Exp $";
+#endif
+
+/*
+ * Various supported device vendors/types and their names.
+ */
+static struct wb_type wb_devs[] = {
+	{ WB_VENDORID, WB_DEVICEID_840F,
+		"Winbond W89C840F 10/100BaseTX" },
+	{ CP_VENDORID, CP_DEVICEID_RL100,
+		"Compex RL100-ATX 10/100baseTX" },
+	{ 0, 0, NULL }
+};
+
+/*
+ * Various supported PHY vendors/types and their names. Note that
+ * this driver will work with pretty much any MII-compliant PHY,
+ * so failure to positively identify the chip is not a fatal error.
+ */
+
+static struct wb_type wb_phys[] = {
+	{ TI_PHY_VENDORID, TI_PHY_10BT, "<TI ThunderLAN 10BT (internal)>" },
+	{ TI_PHY_VENDORID, TI_PHY_100VGPMI, "<TI TNETE211 100VG Any-LAN>" },
+	{ NS_PHY_VENDORID, NS_PHY_83840A, "<National Semiconductor DP83840A>"},
+	{ LEVEL1_PHY_VENDORID, LEVEL1_PHY_LXT970, "<Level 1 LXT970>" }, 
+	{ INTEL_PHY_VENDORID, INTEL_PHY_82555, "<Intel 82555>" },
+	{ SEEQ_PHY_VENDORID, SEEQ_PHY_80220, "<SEEQ 80220>" },
+	{ 0, 0, "<MII-compliant physical interface>" }
+};
+
+static unsigned long wb_count = 0;
+static char *wb_probe		__P((pcici_t, pcidi_t));
+static void wb_attach		__P((pcici_t, int));
+
+static int wb_newbuf		__P((struct wb_softc *,
+						struct wb_chain_onefrag *));
+static int wb_encap		__P((struct wb_softc *, struct wb_chain *,
+						struct mbuf *));
+
+static void wb_rxeof		__P((struct wb_softc *));
+static void wb_rxeoc		__P((struct wb_softc *));
+static void wb_txeof		__P((struct wb_softc *));
+static void wb_txeoc		__P((struct wb_softc *));
+static void wb_intr		__P((void *));
+static void wb_start		__P((struct ifnet *));
+static int wb_ioctl		__P((struct ifnet *, u_long, caddr_t));
+static void wb_init		__P((void *));
+static void wb_stop		__P((struct wb_softc *));
+static void wb_watchdog		__P((struct ifnet *));
+static void wb_shutdown		__P((int, void *));
+static int wb_ifmedia_upd	__P((struct ifnet *));
+static void wb_ifmedia_sts	__P((struct ifnet *, struct ifmediareq *));
+
+static void wb_eeprom_putbyte	__P((struct wb_softc *, u_int8_t));
+static void wb_eeprom_getword	__P((struct wb_softc *, u_int8_t, u_int16_t *));
+static void wb_read_eeprom	__P((struct wb_softc *, caddr_t, int,
+							int, int));
+static void wb_mii_sync		__P((struct wb_softc *));
+static void wb_mii_send		__P((struct wb_softc *, u_int32_t, int));
+static int wb_mii_readreg	__P((struct wb_softc *, struct wb_mii_frame *));
+static int wb_mii_writereg	__P((struct wb_softc *, struct wb_mii_frame *));
+static u_int16_t wb_phy_readreg	__P((struct wb_softc *, int));
+static void wb_phy_writereg	__P((struct wb_softc *, u_int16_t, u_int16_t));
+
+static void wb_autoneg_xmit	__P((struct wb_softc *));
+static void wb_autoneg_mii	__P((struct wb_softc *, int, int));
+static void wb_setmode_mii	__P((struct wb_softc *, int));
+static void wb_getmode_mii	__P((struct wb_softc *));
+static void wb_setcfg		__P((struct wb_softc *, u_int16_t));
+static u_int8_t wb_calchash	__P((u_int8_t *));
+static void wb_setmulti		__P((struct wb_softc *));
+static void wb_reset		__P((struct wb_softc *));
+static int wb_list_rx_init	__P((struct wb_softc *));
+static int wb_list_tx_init	__P((struct wb_softc *));
+
+#define WB_SETBIT(sc, reg, x)				\
+	CSR_WRITE_4(sc, reg,				\
+		CSR_READ_4(sc, reg) | x)
+
+#define WB_CLRBIT(sc, reg, x)				\
+	CSR_WRITE_4(sc, reg,				\
+		CSR_READ_4(sc, reg) & ~x)
+
+#define SIO_SET(x)					\
+	CSR_WRITE_4(sc, WB_SIO,				\
+		CSR_READ_4(sc, WB_SIO) | x)
+
+#define SIO_CLR(x)					\
+	CSR_WRITE_4(sc, WB_SIO,				\
+		CSR_READ_4(sc, WB_SIO) & ~x)
+
+/*
+ * Send a read command and address to the EEPROM, check for ACK.
+ */
+static void wb_eeprom_putbyte(sc, addr)
+	struct wb_softc		*sc;
+	u_int8_t		addr;
+{
+	register int		d, i;
+
+	d = addr | WB_EECMD_READ;
+
+	/*
+	 * Feed in each bit and stobe the clock.
+	 */
+	for (i = 0x400; i; i >>= 1) {
+		if (d & i) {
+			SIO_SET(WB_SIO_EE_DATAIN);
+		} else {
+			SIO_CLR(WB_SIO_EE_DATAIN);
+		}
+		DELAY(100);
+		SIO_SET(WB_SIO_EE_CLK);
+		DELAY(150);
+		SIO_CLR(WB_SIO_EE_CLK);
+		DELAY(100);
+	}
+
+	return;
+}
+
+/*
+ * Read a word of data stored in the EEPROM at address 'addr.'
+ */
+static void wb_eeprom_getword(sc, addr, dest)
+	struct wb_softc		*sc;
+	u_int8_t		addr;
+	u_int16_t		*dest;
+{
+	register int		i;
+	u_int16_t		word = 0;
+
+	/* Enter EEPROM access mode. */
+	CSR_WRITE_4(sc, WB_SIO, WB_SIO_EESEL|WB_SIO_EE_CS);
+
+	/*
+	 * Send address of word we want to read.
+	 */
+	wb_eeprom_putbyte(sc, addr);
+
+	CSR_WRITE_4(sc, WB_SIO, WB_SIO_EESEL|WB_SIO_EE_CS);
+
+	/*
+	 * Start reading bits from EEPROM.
+	 */
+	for (i = 0x8000; i; i >>= 1) {
+		SIO_SET(WB_SIO_EE_CLK);
+		DELAY(100);
+		if (CSR_READ_4(sc, WB_SIO) & WB_SIO_EE_DATAOUT)
+			word |= i;
+		SIO_CLR(WB_SIO_EE_CLK);
+		DELAY(100);
+	}
+
+	/* Turn off EEPROM access mode. */
+	CSR_WRITE_4(sc, WB_SIO, 0);
+
+	*dest = word;
+
+	return;
+}
+
+/*
+ * Read a sequence of words from the EEPROM.
+ */
+static void wb_read_eeprom(sc, dest, off, cnt, swap)
+	struct wb_softc		*sc;
+	caddr_t			dest;
+	int			off;
+	int			cnt;
+	int			swap;
+{
+	int			i;
+	u_int16_t		word = 0, *ptr;
+
+	for (i = 0; i < cnt; i++) {
+		wb_eeprom_getword(sc, off + i, &word);
+		ptr = (u_int16_t *)(dest + (i * 2));
+		if (swap)
+			*ptr = ntohs(word);
+		else
+			*ptr = word;
+	}
+
+	return;
+}
+
+/*
+ * Sync the PHYs by setting data bit and strobing the clock 32 times.
+ */
+static void wb_mii_sync(sc)
+	struct wb_softc		*sc;
+{
+	register int		i;
+
+	SIO_SET(WB_SIO_MII_DIR|WB_SIO_MII_DATAIN);
+
+	for (i = 0; i < 32; i++) {
+		SIO_SET(WB_SIO_MII_CLK);
+		DELAY(1);
+		SIO_CLR(WB_SIO_MII_CLK);
+		DELAY(1);
+	}
+
+	return;
+}
+
+/*
+ * Clock a series of bits through the MII.
+ */
+static void wb_mii_send(sc, bits, cnt)
+	struct wb_softc		*sc;
+	u_int32_t		bits;
+	int			cnt;
+{
+	int			i;
+
+	SIO_CLR(WB_SIO_MII_CLK);
+
+	for (i = (0x1 << (cnt - 1)); i; i >>= 1) {
+                if (bits & i) {
+			SIO_SET(WB_SIO_MII_DATAIN);
+                } else {
+			SIO_CLR(WB_SIO_MII_DATAIN);
+                }
+		DELAY(1);
+		SIO_CLR(WB_SIO_MII_CLK);
+		DELAY(1);
+		SIO_SET(WB_SIO_MII_CLK);
+	}
+}
+
+/*
+ * Read an PHY register through the MII.
+ */
+static int wb_mii_readreg(sc, frame)
+	struct wb_softc		*sc;
+	struct wb_mii_frame	*frame;
+	
+{
+	int			i, ack, s;
+
+	s = splimp();
+
+	/*
+	 * Set up frame for RX.
+	 */
+	frame->mii_stdelim = WB_MII_STARTDELIM;
+	frame->mii_opcode = WB_MII_READOP;
+	frame->mii_turnaround = 0;
+	frame->mii_data = 0;
+	
+	CSR_WRITE_4(sc, WB_SIO, 0);
+
+	/*
+ 	 * Turn on data xmit.
+	 */
+	SIO_SET(WB_SIO_MII_DIR);
+
+	wb_mii_sync(sc);
+
+	/*
+	 * Send command/address info.
+	 */
+	wb_mii_send(sc, frame->mii_stdelim, 2);
+	wb_mii_send(sc, frame->mii_opcode, 2);
+	wb_mii_send(sc, frame->mii_phyaddr, 5);
+	wb_mii_send(sc, frame->mii_regaddr, 5);
+
+	/* Idle bit */
+	SIO_CLR((WB_SIO_MII_CLK|WB_SIO_MII_DATAIN));
+	DELAY(1);
+	SIO_SET(WB_SIO_MII_CLK);
+	DELAY(1);
+
+	/* Turn off xmit. */
+	SIO_CLR(WB_SIO_MII_DIR);
+	/* Check for ack */
+	SIO_CLR(WB_SIO_MII_CLK);
+	DELAY(1);
+	SIO_SET(WB_SIO_MII_CLK);
+	DELAY(1);
+	ack = CSR_READ_4(sc, WB_SIO) & WB_SIO_MII_DATAOUT;
+	SIO_CLR(WB_SIO_MII_CLK);
+	DELAY(1);
+	SIO_SET(WB_SIO_MII_CLK);
+	DELAY(1);
+
+	/*
+	 * Now try reading data bits. If the ack failed, we still
+	 * need to clock through 16 cycles to keep the PHY(s) in sync.
+	 */
+	if (ack) {
+		for(i = 0; i < 16; i++) {
+			SIO_CLR(WB_SIO_MII_CLK);
+			DELAY(1);
+			SIO_SET(WB_SIO_MII_CLK);
+			DELAY(1);
+		}
+		goto fail;
+	}
+
+	for (i = 0x8000; i; i >>= 1) {
+		SIO_CLR(WB_SIO_MII_CLK);
+		DELAY(1);
+		if (!ack) {
+			if (CSR_READ_4(sc, WB_SIO) & WB_SIO_MII_DATAOUT)
+				frame->mii_data |= i;
+			DELAY(1);
+		}
+		SIO_SET(WB_SIO_MII_CLK);
+		DELAY(1);
+	}
+
+fail:
+
+	SIO_CLR(WB_SIO_MII_CLK);
+	DELAY(1);
+	SIO_SET(WB_SIO_MII_CLK);
+	DELAY(1);
+
+	splx(s);
+
+	if (ack)
+		return(1);
+	return(0);
+}
+
+/*
+ * Write to a PHY register through the MII.
+ */
+static int wb_mii_writereg(sc, frame)
+	struct wb_softc		*sc;
+	struct wb_mii_frame	*frame;
+	
+{
+	int			s;
+
+	s = splimp();
+	/*
+	 * Set up frame for TX.
+	 */
+
+	frame->mii_stdelim = WB_MII_STARTDELIM;
+	frame->mii_opcode = WB_MII_WRITEOP;
+	frame->mii_turnaround = WB_MII_TURNAROUND;
+	
+	/*
+ 	 * Turn on data output.
+	 */
+	SIO_SET(WB_SIO_MII_DIR);
+
+	wb_mii_sync(sc);
+
+	wb_mii_send(sc, frame->mii_stdelim, 2);
+	wb_mii_send(sc, frame->mii_opcode, 2);
+	wb_mii_send(sc, frame->mii_phyaddr, 5);
+	wb_mii_send(sc, frame->mii_regaddr, 5);
+	wb_mii_send(sc, frame->mii_turnaround, 2);
+	wb_mii_send(sc, frame->mii_data, 16);
+
+	/* Idle bit. */
+	SIO_SET(WB_SIO_MII_CLK);
+	DELAY(1);
+	SIO_CLR(WB_SIO_MII_CLK);
+	DELAY(1);
+
+	/*
+	 * Turn off xmit.
+	 */
+	SIO_CLR(WB_SIO_MII_DIR);
+
+	splx(s);
+
+	return(0);
+}
+
+static u_int16_t wb_phy_readreg(sc, reg)
+	struct wb_softc		*sc;
+	int			reg;
+{
+	struct wb_mii_frame	frame;
+
+	bzero((char *)&frame, sizeof(frame));
+
+	frame.mii_phyaddr = sc->wb_phy_addr;
+	frame.mii_regaddr = reg;
+	wb_mii_readreg(sc, &frame);
+
+	return(frame.mii_data);
+}
+
+static void wb_phy_writereg(sc, reg, data)
+	struct wb_softc		*sc;
+	u_int16_t		reg;
+	u_int16_t		data;
+{
+	struct wb_mii_frame	frame;
+
+	bzero((char *)&frame, sizeof(frame));
+
+	frame.mii_phyaddr = sc->wb_phy_addr;
+	frame.mii_regaddr = reg;
+	frame.mii_data = data;
+
+	wb_mii_writereg(sc, &frame);
+
+	return;
+}
+
+static u_int8_t wb_calchash(addr)
+	u_int8_t		*addr;
+{
+	u_int32_t		crc, carry;
+	int			i, j;
+	u_int8_t		c;
+
+	/* Compute CRC for the address value. */
+	crc = 0xFFFFFFFF; /* initial value */
+
+	for (i = 0; i < 6; i++) {
+		c = *(addr + i);
+		for (j = 0; j < 8; j++) {
+			carry = ((crc & 0x80000000) ? 1 : 0) ^ (c & 0x01);
+			crc <<= 1;
+			c >>= 1;
+			if (carry)
+				crc = (crc ^ 0x04c11db6) | carry;
+		}
+	}
+
+	/*
+	 * return the filter bit position
+	 * Note: I arrived at the following nonsense
+	 * through experimentation. It's not the usual way to
+	 * generate the bit position but it's the only thing
+	 * I could come up with that works.
+	 */
+	return(~(crc >> 26) & 0x0000003F);
+}
+
+/*
+ * Program the 64-bit multicast hash filter.
+ */
+static void wb_setmulti(sc)
+	struct wb_softc		*sc;
+{
+	struct ifnet		*ifp;
+	int			h = 0;
+	u_int32_t		hashes[2] = { 0, 0 };
+	struct ifmultiaddr	*ifma;
+	u_int32_t		rxfilt;
+	int			mcnt = 0;
+
+	ifp = &sc->arpcom.ac_if;
+
+	rxfilt = CSR_READ_4(sc, WB_NETCFG);
+
+	if (ifp->if_flags & IFF_ALLMULTI || ifp->if_flags & IFF_PROMISC) {
+		rxfilt |= WB_NETCFG_RX_MULTI;
+		CSR_WRITE_4(sc, WB_NETCFG, rxfilt);
+		CSR_WRITE_4(sc, WB_MAR0, 0xFFFFFFFF);
+		CSR_WRITE_4(sc, WB_MAR1, 0xFFFFFFFF);
+		return;
+	}
+
+	/* first, zot all the existing hash bits */
+	CSR_WRITE_4(sc, WB_MAR0, 0);
+	CSR_WRITE_4(sc, WB_MAR1, 0);
+
+	/* now program new ones */
+	for (ifma = ifp->if_multiaddrs.lh_first; ifma != NULL;
+				ifma = ifma->ifma_link.le_next) {
+		if (ifma->ifma_addr->sa_family != AF_LINK)
+			continue;
+		h = wb_calchash(LLADDR((struct sockaddr_dl *)ifma->ifma_addr));
+		if (h < 32)
+			hashes[0] |= (1 << h);
+		else
+			hashes[1] |= (1 << (h - 32));
+		mcnt++;
+	}
+
+	if (mcnt)
+		rxfilt |= WB_NETCFG_RX_MULTI;
+	else
+		rxfilt &= ~WB_NETCFG_RX_MULTI;
+
+	CSR_WRITE_4(sc, WB_MAR0, hashes[0]);
+	CSR_WRITE_4(sc, WB_MAR1, hashes[1]);
+	CSR_WRITE_4(sc, WB_NETCFG, rxfilt);
+
+	return;
+}
+
+/*
+ * Initiate an autonegotiation session.
+ */
+static void wb_autoneg_xmit(sc)
+	struct wb_softc		*sc;
+{
+	u_int16_t		phy_sts;
+
+	wb_phy_writereg(sc, PHY_BMCR, PHY_BMCR_RESET);
+	DELAY(500);
+	while(wb_phy_readreg(sc, PHY_BMCR)
+			& PHY_BMCR_RESET);
+
+	phy_sts = wb_phy_readreg(sc, PHY_BMCR);
+	phy_sts |= PHY_BMCR_AUTONEGENBL|PHY_BMCR_AUTONEGRSTR;
+	wb_phy_writereg(sc, PHY_BMCR, phy_sts);
+
+	return;
+}
+
+/*
+ * Invoke autonegotiation on a PHY.
+ */
+static void wb_autoneg_mii(sc, flag, verbose)
+	struct wb_softc		*sc;
+	int			flag;
+	int			verbose;
+{
+	u_int16_t		phy_sts = 0, media, advert, ability;
+	struct ifnet		*ifp;
+	struct ifmedia		*ifm;
+
+	ifm = &sc->ifmedia;
+	ifp = &sc->arpcom.ac_if;
+
+	ifm->ifm_media = IFM_ETHER | IFM_AUTO;
+
+	/*
+	 * The 100baseT4 PHY on the 3c905-T4 has the 'autoneg supported'
+	 * bit cleared in the status register, but has the 'autoneg enabled'
+	 * bit set in the control register. This is a contradiction, and
+	 * I'm not sure how to handle it. If you want to force an attempt
+	 * to autoneg for 100baseT4 PHYs, #define FORCE_AUTONEG_TFOUR
+	 * and see what happens.
+	 */
+#ifndef FORCE_AUTONEG_TFOUR
+	/*
+	 * First, see if autoneg is supported. If not, there's
+	 * no point in continuing.
+	 */
+	phy_sts = wb_phy_readreg(sc, PHY_BMSR);
+	if (!(phy_sts & PHY_BMSR_CANAUTONEG)) {
+		if (verbose)
+			printf("wb%d: autonegotiation not supported\n",
+							sc->wb_unit);
+		ifm->ifm_media = IFM_ETHER|IFM_10_T|IFM_HDX;	
+		return;
+	}
+#endif
+
+	switch (flag) {
+	case WB_FLAG_FORCEDELAY:
+		/*
+	 	 * XXX Never use this option anywhere but in the probe
+	 	 * routine: making the kernel stop dead in its tracks
+ 		 * for three whole seconds after we've gone multi-user
+		 * is really bad manners.
+	 	 */
+		wb_autoneg_xmit(sc);
+		DELAY(5000000);
+		break;
+	case WB_FLAG_SCHEDDELAY:
+		/*
+		 * Wait for the transmitter to go idle before starting
+		 * an autoneg session, otherwise wb_start() may clobber
+	 	 * our timeout, and we don't want to allow transmission
+		 * during an autoneg session since that can screw it up.
+	 	 */
+		if (sc->wb_cdata.wb_tx_head != NULL) {
+			sc->wb_want_auto = 1;
+			return;
+		}
+		wb_autoneg_xmit(sc);
+		ifp->if_timer = 5;
+		sc->wb_autoneg = 1;
+		sc->wb_want_auto = 0;
+		return;
+		break;
+	case WB_FLAG_DELAYTIMEO:
+		ifp->if_timer = 0;
+		sc->wb_autoneg = 0;
+		break;
+	default:
+		printf("wb%d: invalid autoneg flag: %d\n", sc->wb_unit, flag);
+		return;
+	}
+
+	if (wb_phy_readreg(sc, PHY_BMSR) & PHY_BMSR_AUTONEGCOMP) {
+		if (verbose)
+			printf("wb%d: autoneg complete, ", sc->wb_unit);
+		phy_sts = wb_phy_readreg(sc, PHY_BMSR);
+	} else {
+		if (verbose)
+			printf("wb%d: autoneg not complete, ", sc->wb_unit);
+	}
+
+	media = wb_phy_readreg(sc, PHY_BMCR);
+
+	/* Link is good. Report modes and set duplex mode. */
+	if (wb_phy_readreg(sc, PHY_BMSR) & PHY_BMSR_LINKSTAT) {
+		if (verbose)
+			printf("link status good ");
+		advert = wb_phy_readreg(sc, PHY_ANAR);
+		ability = wb_phy_readreg(sc, PHY_LPAR);
+
+		if (advert & PHY_ANAR_100BT4 && ability & PHY_ANAR_100BT4) {
+			ifm->ifm_media = IFM_ETHER|IFM_100_T4;
+			media |= PHY_BMCR_SPEEDSEL;
+			media &= ~PHY_BMCR_DUPLEX;
+			printf("(100baseT4)\n");
+		} else if (advert & PHY_ANAR_100BTXFULL &&
+			ability & PHY_ANAR_100BTXFULL) {
+			ifm->ifm_media = IFM_ETHER|IFM_100_TX|IFM_FDX;
+			media |= PHY_BMCR_SPEEDSEL;
+			media |= PHY_BMCR_DUPLEX;
+			printf("(full-duplex, 100Mbps)\n");
+		} else if (advert & PHY_ANAR_100BTXHALF &&
+			ability & PHY_ANAR_100BTXHALF) {
+			ifm->ifm_media = IFM_ETHER|IFM_100_TX|IFM_HDX;
+			media |= PHY_BMCR_SPEEDSEL;
+			media &= ~PHY_BMCR_DUPLEX;
+			printf("(half-duplex, 100Mbps)\n");
+		} else if (advert & PHY_ANAR_10BTFULL &&
+			ability & PHY_ANAR_10BTFULL) {
+			ifm->ifm_media = IFM_ETHER|IFM_10_T|IFM_FDX;
+			media &= ~PHY_BMCR_SPEEDSEL;
+			media |= PHY_BMCR_DUPLEX;
+			printf("(full-duplex, 10Mbps)\n");
+		} else /* if (advert & PHY_ANAR_10BTHALF &&
+			ability & PHY_ANAR_10BTHALF) */ {
+			ifm->ifm_media = IFM_ETHER|IFM_10_T|IFM_HDX;
+			media &= ~PHY_BMCR_SPEEDSEL;
+			media &= ~PHY_BMCR_DUPLEX;
+			printf("(half-duplex, 10Mbps)\n");
+		}
+
+		media &= ~PHY_BMCR_AUTONEGENBL;
+
+		/* Set ASIC's duplex mode to match the PHY. */
+		wb_setcfg(sc, media);
+		wb_phy_writereg(sc, PHY_BMCR, media);
+	} else {
+		if (verbose)
+			printf("no carrier\n");
+	}
+
+	wb_init(sc);
+
+	if (sc->wb_tx_pend) {
+		sc->wb_autoneg = 0;
+		sc->wb_tx_pend = 0;
+		wb_start(ifp);
+	}
+
+	return;
+}
+
+static void wb_getmode_mii(sc)
+	struct wb_softc		*sc;
+{
+	u_int16_t		bmsr;
+	struct ifnet		*ifp;
+
+	ifp = &sc->arpcom.ac_if;
+
+	bmsr = wb_phy_readreg(sc, PHY_BMSR);
+	if (bootverbose)
+		printf("wb%d: PHY status word: %x\n", sc->wb_unit, bmsr);
+
+	/* fallback */
+	sc->ifmedia.ifm_media = IFM_ETHER|IFM_10_T|IFM_HDX;
+
+	if (bmsr & PHY_BMSR_10BTHALF) {
+		if (bootverbose)
+			printf("wb%d: 10Mbps half-duplex mode supported\n",
+								sc->wb_unit);
+		ifmedia_add(&sc->ifmedia,
+			IFM_ETHER|IFM_10_T|IFM_HDX, 0, NULL);
+		ifmedia_add(&sc->ifmedia, IFM_ETHER|IFM_10_T, 0, NULL);
+	}
+
+	if (bmsr & PHY_BMSR_10BTFULL) {
+		if (bootverbose)
+			printf("wb%d: 10Mbps full-duplex mode supported\n",
+								sc->wb_unit);
+		ifmedia_add(&sc->ifmedia,
+			IFM_ETHER|IFM_10_T|IFM_FDX, 0, NULL);
+		sc->ifmedia.ifm_media = IFM_ETHER|IFM_10_T|IFM_FDX;
+	}
+
+	if (bmsr & PHY_BMSR_100BTXHALF) {
+		if (bootverbose)
+			printf("wb%d: 100Mbps half-duplex mode supported\n",
+								sc->wb_unit);
+		ifp->if_baudrate = 100000000;
+		ifmedia_add(&sc->ifmedia, IFM_ETHER|IFM_100_TX, 0, NULL);
+		ifmedia_add(&sc->ifmedia,
+			IFM_ETHER|IFM_100_TX|IFM_HDX, 0, NULL);
+		sc->ifmedia.ifm_media = IFM_ETHER|IFM_100_TX|IFM_HDX;
+	}
+
+	if (bmsr & PHY_BMSR_100BTXFULL) {
+		if (bootverbose)
+			printf("wb%d: 100Mbps full-duplex mode supported\n",
+								sc->wb_unit);
+		ifp->if_baudrate = 100000000;
+		ifmedia_add(&sc->ifmedia,
+			IFM_ETHER|IFM_100_TX|IFM_FDX, 0, NULL);
+		sc->ifmedia.ifm_media = IFM_ETHER|IFM_100_TX|IFM_FDX;
+	}
+
+	/* Some also support 100BaseT4. */
+	if (bmsr & PHY_BMSR_100BT4) {
+		if (bootverbose)
+			printf("wb%d: 100baseT4 mode supported\n", sc->wb_unit);
+		ifp->if_baudrate = 100000000;
+		ifmedia_add(&sc->ifmedia, IFM_ETHER|IFM_100_T4, 0, NULL);
+		sc->ifmedia.ifm_media = IFM_ETHER|IFM_100_T4;
+#ifdef FORCE_AUTONEG_TFOUR
+		if (bootverbose)
+			printf("wb%d: forcing on autoneg support for BT4\n",
+							 sc->wb_unit);
+		ifmedia_add(&sc->ifmedia, IFM_ETHER|IFM_AUTO, 0 NULL):
+		sc->ifmedia.ifm_media = IFM_ETHER|IFM_AUTO;
+#endif
+	}
+
+	if (bmsr & PHY_BMSR_CANAUTONEG) {
+		if (bootverbose)
+			printf("wb%d: autoneg supported\n", sc->wb_unit);
+		ifmedia_add(&sc->ifmedia, IFM_ETHER|IFM_AUTO, 0, NULL);
+		sc->ifmedia.ifm_media = IFM_ETHER|IFM_AUTO;
+	}
+
+	return;
+}
+
+/*
+ * Set speed and duplex mode.
+ */
+static void wb_setmode_mii(sc, media)
+	struct wb_softc		*sc;
+	int			media;
+{
+	u_int16_t		bmcr;
+	struct ifnet		*ifp;
+
+	ifp = &sc->arpcom.ac_if;
+
+	/*
+	 * If an autoneg session is in progress, stop it.
+	 */
+	if (sc->wb_autoneg) {
+		printf("wb%d: canceling autoneg session\n", sc->wb_unit);
+		ifp->if_timer = sc->wb_autoneg = sc->wb_want_auto = 0;
+		bmcr = wb_phy_readreg(sc, PHY_BMCR);
+		bmcr &= ~PHY_BMCR_AUTONEGENBL;
+		wb_phy_writereg(sc, PHY_BMCR, bmcr);
+	}
+
+	printf("wb%d: selecting MII, ", sc->wb_unit);
+
+	bmcr = wb_phy_readreg(sc, PHY_BMCR);
+
+	bmcr &= ~(PHY_BMCR_AUTONEGENBL|PHY_BMCR_SPEEDSEL|
+			PHY_BMCR_DUPLEX|PHY_BMCR_LOOPBK);
+
+	if (IFM_SUBTYPE(media) == IFM_100_T4) {
+		printf("100Mbps/T4, half-duplex\n");
+		bmcr |= PHY_BMCR_SPEEDSEL;
+		bmcr &= ~PHY_BMCR_DUPLEX;
+	}
+
+	if (IFM_SUBTYPE(media) == IFM_100_TX) {
+		printf("100Mbps, ");
+		bmcr |= PHY_BMCR_SPEEDSEL;
+	}
+
+	if (IFM_SUBTYPE(media) == IFM_10_T) {
+		printf("10Mbps, ");
+		bmcr &= ~PHY_BMCR_SPEEDSEL;
+	}
+
+	if ((media & IFM_GMASK) == IFM_FDX) {
+		printf("full duplex\n");
+		bmcr |= PHY_BMCR_DUPLEX;
+	} else {
+		printf("half duplex\n");
+		bmcr &= ~PHY_BMCR_DUPLEX;
+	}
+
+	wb_setcfg(sc, bmcr);
+	wb_phy_writereg(sc, PHY_BMCR, bmcr);
+
+	return;
+}
+
+/*
+ * The Winbond manual states that in order to fiddle with the
+ * 'full-duplex' and '100Mbps' bits in the netconfig register, we
+ * first have to put the transmit and/or receive logic in the idle state.
+ */
+static void wb_setcfg(sc, bmcr)
+	struct wb_softc		*sc;
+	u_int16_t		bmcr;
+{
+	int			i, restart = 0;
+
+	if (CSR_READ_4(sc, WB_NETCFG) & (WB_NETCFG_TX_ON|WB_NETCFG_RX_ON)) {
+		restart = 1;
+		WB_CLRBIT(sc, WB_NETCFG, (WB_NETCFG_TX_ON|WB_NETCFG_RX_ON));
+
+		for (i = 0; i < WB_TIMEOUT; i++) {
+			DELAY(10);
+			if ((CSR_READ_4(sc, WB_ISR) & WB_ISR_TX_IDLE) &&
+				(CSR_READ_4(sc, WB_ISR) & WB_ISR_RX_IDLE))
+				break;
+		}
+
+		if (i == WB_TIMEOUT)
+			printf("wb%d: failed to force tx and "
+				"rx to idle state\n", sc->wb_unit);
+	}
+
+	if (bmcr & PHY_BMCR_SPEEDSEL)
+		WB_SETBIT(sc, WB_NETCFG, WB_NETCFG_100MBPS);
+	else
+		WB_CLRBIT(sc, WB_NETCFG, WB_NETCFG_100MBPS);
+
+	if (bmcr & PHY_BMCR_DUPLEX)
+		WB_SETBIT(sc, WB_NETCFG, WB_NETCFG_FULLDUPLEX);
+	else
+		WB_CLRBIT(sc, WB_NETCFG, WB_NETCFG_FULLDUPLEX);
+
+	if (restart)
+		WB_SETBIT(sc, WB_NETCFG, WB_NETCFG_TX_ON|WB_NETCFG_RX_ON);
+
+	return;
+}
+
+static void wb_reset(sc)
+	struct wb_softc		*sc;
+{
+	register int		i;
+
+	WB_SETBIT(sc, WB_BUSCTL, WB_BUSCTL_RESET);
+
+	for (i = 0; i < WB_TIMEOUT; i++) {
+		DELAY(10);
+		if (!(CSR_READ_4(sc, WB_BUSCTL) & WB_BUSCTL_RESET))
+			break;
+	}
+	if (i == WB_TIMEOUT)
+		printf("wb%d: reset never completed!\n", sc->wb_unit);
+
+	/* Wait a little while for the chip to get its brains in order. */
+	DELAY(1000);
+
+	/* Reset the damn PHY too. */
+	if (sc->wb_pinfo != NULL)
+		wb_phy_writereg(sc, PHY_BMCR, PHY_BMCR_RESET);
+
+        return;
+}
+
+/*
+ * Probe for a Winbond chip. Check the PCI vendor and device
+ * IDs against our list and return a device name if we find a match.
+ */
+static char *
+wb_probe(config_id, device_id)
+	pcici_t			config_id;
+	pcidi_t			device_id;
+{
+	struct wb_type		*t;
+
+	t = wb_devs;
+
+	while(t->wb_name != NULL) {
+		if ((device_id & 0xFFFF) == t->wb_vid &&
+		    ((device_id >> 16) & 0xFFFF) == t->wb_did) {
+			return(t->wb_name);
+		}
+		t++;
+	}
+
+	return(NULL);
+}
+
+/*
+ * Attach the interface. Allocate softc structures, do ifmedia
+ * setup and ethernet/BPF attach.
+ */
+static void
+wb_attach(config_id, unit)
+	pcici_t			config_id;
+	int			unit;
+{
+	int			s, i;
+#ifndef WB_USEIOSPACE
+	vm_offset_t		pbase, vbase;
+#endif
+	u_char			eaddr[ETHER_ADDR_LEN];
+	u_int32_t		command;
+	struct wb_softc		*sc;
+	struct ifnet		*ifp;
+	int			media = IFM_ETHER|IFM_100_TX|IFM_FDX;
+	unsigned int		round;
+	caddr_t			roundptr;
+	struct wb_type		*p;
+	u_int16_t		phy_vid, phy_did, phy_sts;
+
+	s = splimp();
+
+	sc = malloc(sizeof(struct wb_softc), M_DEVBUF, M_NOWAIT);
+	if (sc == NULL) {
+		printf("wb%d: no memory for softc struct!\n", unit);
+		return;
+	}
+	bzero(sc, sizeof(struct wb_softc));
+
+	/*
+	 * Handle power management nonsense.
+	 */
+
+	command = pci_conf_read(config_id, WB_PCI_CAPID) & 0x000000FF;
+	if (command == 0x01) {
+
+		command = pci_conf_read(config_id, WB_PCI_PWRMGMTCTRL);
+		if (command & WB_PSTATE_MASK) {
+			u_int32_t		iobase, membase, irq;
+
+			/* Save important PCI config data. */
+			iobase = pci_conf_read(config_id, WB_PCI_LOIO);
+			membase = pci_conf_read(config_id, WB_PCI_LOMEM);
+			irq = pci_conf_read(config_id, WB_PCI_INTLINE);
+
+			/* Reset the power state. */
+			printf("wb%d: chip is in D%d power mode "
+			"-- setting to D0\n", unit, command & WB_PSTATE_MASK);
+			command &= 0xFFFFFFFC;
+			pci_conf_write(config_id, WB_PCI_PWRMGMTCTRL, command);
+
+			/* Restore PCI config data. */
+			pci_conf_write(config_id, WB_PCI_LOIO, iobase);
+			pci_conf_write(config_id, WB_PCI_LOMEM, membase);
+			pci_conf_write(config_id, WB_PCI_INTLINE, irq);
+		}
+	}
+
+	/*
+	 * Map control/status registers.
+	 */
+	command = pci_conf_read(config_id, PCI_COMMAND_STATUS_REG);
+	command |= (PCIM_CMD_PORTEN|PCIM_CMD_MEMEN|PCIM_CMD_BUSMASTEREN);
+	pci_conf_write(config_id, PCI_COMMAND_STATUS_REG, command);
+	command = pci_conf_read(config_id, PCI_COMMAND_STATUS_REG);
+
+#ifdef WB_USEIOSPACE
+	if (!(command & PCIM_CMD_PORTEN)) {
+		printf("wb%d: failed to enable I/O ports!\n", unit);
+		free(sc, M_DEVBUF);
+		goto fail;
+	}
+
+	if (!pci_map_port(config_id, WB_PCI_LOIO,
+					(u_int16_t *)&(sc->wb_bhandle))) {
+		printf ("wb%d: couldn't map ports\n", unit);
+		goto fail;
+	}
+	sc->wb_btag = I386_BUS_SPACE_IO;
+#else
+	if (!(command & PCIM_CMD_MEMEN)) {
+		printf("wb%d: failed to enable memory mapping!\n", unit);
+		goto fail;
+	}
+
+	if (!pci_map_mem(config_id, WB_PCI_LOMEM, &vbase, &pbase)) {
+		printf ("wb%d: couldn't map memory\n", unit);
+		goto fail;
+	}
+	sc->csr = (volatile caddr_t)vbase;
+	sc->wb_btag = I386_BUS_SPACE_MEM;
+	sc->wb_bhandle = vbase;
+#endif
+
+	/* Allocate interrupt */
+	if (!pci_map_int(config_id, wb_intr, sc, &net_imask)) {
+		printf("wb%d: couldn't map interrupt\n", unit);
+		goto fail;
+	}
+
+	/* Reset the adapter. */
+	wb_reset(sc);
+
+	/*
+	 * Get station address from the EEPROM.
+	 */
+	wb_read_eeprom(sc, (caddr_t)&eaddr, 0, 3, 0);
+
+	/*
+	 * A Winbond chip was detected. Inform the world.
+	 */
+	printf("wb%d: Ethernet address: %6D\n", unit, eaddr, ":");
+
+	sc->wb_unit = unit;
+	bcopy(eaddr, (char *)&sc->arpcom.ac_enaddr, ETHER_ADDR_LEN);
+
+	sc->wb_ldata_ptr = malloc(sizeof(struct wb_list_data) + 8,
+				M_DEVBUF, M_NOWAIT);
+	if (sc->wb_ldata_ptr == NULL) {
+		free(sc, M_DEVBUF);
+		printf("wb%d: no memory for list buffers!\n", unit);
+		return;
+	}
+
+	sc->wb_ldata = (struct wb_list_data *)sc->wb_ldata_ptr;
+	round = (unsigned int)sc->wb_ldata_ptr & 0xF;
+	roundptr = sc->wb_ldata_ptr;
+	for (i = 0; i < 8; i++) {
+		if (round % 8) {
+			round++;
+			roundptr++;
+		} else
+			break;
+	}
+	sc->wb_ldata = (struct wb_list_data *)roundptr;
+	bzero(sc->wb_ldata, sizeof(struct wb_list_data));
+
+	ifp = &sc->arpcom.ac_if;
+	ifp->if_softc = sc;
+	ifp->if_unit = unit;
+	ifp->if_name = "wb";
+	ifp->if_mtu = ETHERMTU;
+	ifp->if_flags = IFF_BROADCAST | IFF_SIMPLEX | IFF_MULTICAST;
+	ifp->if_ioctl = wb_ioctl;
+	ifp->if_output = ether_output;
+	ifp->if_start = wb_start;
+	ifp->if_watchdog = wb_watchdog;
+	ifp->if_init = wb_init;
+	ifp->if_baudrate = 10000000;
+
+	if (bootverbose)
+		printf("wb%d: probing for a PHY\n", sc->wb_unit);
+	for (i = WB_PHYADDR_MIN; i < WB_PHYADDR_MAX + 1; i++) {
+		if (bootverbose)
+			printf("wb%d: checking address: %d\n",
+						sc->wb_unit, i);
+		sc->wb_phy_addr = i;
+		wb_phy_writereg(sc, PHY_BMCR, PHY_BMCR_RESET);
+		DELAY(500);
+		while(wb_phy_readreg(sc, PHY_BMCR)
+				& PHY_BMCR_RESET);
+		if ((phy_sts = wb_phy_readreg(sc, PHY_BMSR)))
+			break;
+	}
+	if (phy_sts) {
+		phy_vid = wb_phy_readreg(sc, PHY_VENID);
+		phy_did = wb_phy_readreg(sc, PHY_DEVID);
+		if (bootverbose)
+			printf("wb%d: found PHY at address %d, ",
+					sc->wb_unit, sc->wb_phy_addr);
+		if (bootverbose)
+			printf("vendor id: %x device id: %x\n",
+				phy_vid, phy_did);
+		p = wb_phys;
+		while(p->wb_vid) {
+			if (phy_vid == p->wb_vid &&
+				(phy_did | 0x000F) == p->wb_did) {
+				sc->wb_pinfo = p;
+				break;
+			}
+			p++;
+		}
+		if (sc->wb_pinfo == NULL)
+			sc->wb_pinfo = &wb_phys[PHY_UNKNOWN];
+		if (bootverbose)
+			printf("wb%d: PHY type: %s\n",
+				sc->wb_unit, sc->wb_pinfo->wb_name);
+	} else {
+		printf("wb%d: MII without any phy!\n", sc->wb_unit);
+		goto fail;
+	}
+
+	/*
+	 * Do ifmedia setup.
+	 */
+	ifmedia_init(&sc->ifmedia, 0, wb_ifmedia_upd, wb_ifmedia_sts);
+
+	wb_getmode_mii(sc);
+	wb_autoneg_mii(sc, WB_FLAG_FORCEDELAY, 1);
+	media = sc->ifmedia.ifm_media;
+	wb_stop(sc);
+
+	ifmedia_set(&sc->ifmedia, media);
+
+	/*
+	 * Call MI attach routines.
+	 */
+	if_attach(ifp);
+	ether_ifattach(ifp);
+
+#if NBPFILTER > 0
+	bpfattach(ifp, DLT_EN10MB, sizeof(struct ether_header));
+#endif
+	at_shutdown(wb_shutdown, sc, SHUTDOWN_POST_SYNC);
+
+fail:
+	splx(s);
+	return;
+}
+
+/*
+ * Initialize the transmit descriptors.
+ */
+static int wb_list_tx_init(sc)
+	struct wb_softc		*sc;
+{
+	struct wb_chain_data	*cd;
+	struct wb_list_data	*ld;
+	int			i;
+
+	cd = &sc->wb_cdata;
+	ld = sc->wb_ldata;
+
+	for (i = 0; i < WB_TX_LIST_CNT; i++) {
+		cd->wb_tx_chain[i].wb_ptr = &ld->wb_tx_list[i];
+		if (i == (WB_TX_LIST_CNT - 1)) {
+			cd->wb_tx_chain[i].wb_nextdesc =
+				&cd->wb_tx_chain[0];
+		} else {
+			cd->wb_tx_chain[i].wb_nextdesc =
+				&cd->wb_tx_chain[i + 1];
+		}
+	}
+
+	cd->wb_tx_free = &cd->wb_tx_chain[0];
+	cd->wb_tx_tail = cd->wb_tx_head = NULL;
+
+	return(0);
+}
+
+
+/*
+ * Initialize the RX descriptors and allocate mbufs for them. Note that
+ * we arrange the descriptors in a closed ring, so that the last descriptor
+ * points back to the first.
+ */
+static int wb_list_rx_init(sc)
+	struct wb_softc		*sc;
+{
+	struct wb_chain_data	*cd;
+	struct wb_list_data	*ld;
+	int			i;
+
+	cd = &sc->wb_cdata;
+	ld = sc->wb_ldata;
+
+	for (i = 0; i < WB_RX_LIST_CNT; i++) {
+		cd->wb_rx_chain[i].wb_ptr =
+			(struct wb_desc *)&ld->wb_rx_list[i];
+		if (wb_newbuf(sc, &cd->wb_rx_chain[i]) == ENOBUFS)
+			return(ENOBUFS);
+		if (i == (WB_RX_LIST_CNT - 1)) {
+			cd->wb_rx_chain[i].wb_nextdesc = &cd->wb_rx_chain[0];
+			ld->wb_rx_list[i].wb_next = 
+					vtophys(&ld->wb_rx_list[0]);
+		} else {
+			cd->wb_rx_chain[i].wb_nextdesc =
+					&cd->wb_rx_chain[i + 1];
+			ld->wb_rx_list[i].wb_next =
+					vtophys(&ld->wb_rx_list[i + 1]);
+		}
+	}
+
+	cd->wb_rx_head = &cd->wb_rx_chain[0];
+
+	return(0);
+}
+
+/*
+ * Initialize an RX descriptor and attach an MBUF cluster.
+ */
+static int wb_newbuf(sc, c)
+	struct wb_softc		*sc;
+	struct wb_chain_onefrag	*c;
+{
+	struct mbuf		*m_new = NULL;
+
+	MGETHDR(m_new, M_DONTWAIT, MT_DATA);
+	if (m_new == NULL) {
+		printf("wb%d: no memory for rx list -- packet dropped!\n",
+								sc->wb_unit);
+		return(ENOBUFS);
+	}
+
+	MCLGET(m_new, M_DONTWAIT);
+	if (!(m_new->m_flags & M_EXT)) {
+		printf("wb%d: no memory for rx list -- packet dropped!\n",
+								sc->wb_unit);
+		m_freem(m_new);
+		return(ENOBUFS);
+	}
+
+	c->wb_mbuf = m_new;
+	c->wb_ptr->wb_data = vtophys(mtod(m_new, caddr_t));
+	c->wb_ptr->wb_ctl = WB_RXCTL_RLINK | (MCLBYTES - 1);
+	c->wb_ptr->wb_status = WB_RXSTAT;
+
+	return(0);
+}
+
+/*
+ * A frame has been uploaded: pass the resulting mbuf chain up to
+ * the higher level protocols.
+ */
+static void wb_rxeof(sc)
+	struct wb_softc		*sc;
+{
+        struct ether_header	*eh;
+        struct mbuf		*m;
+        struct ifnet		*ifp;
+	struct wb_chain_onefrag	*cur_rx;
+	int			total_len = 0;
+	u_int32_t		rxstat;
+
+	ifp = &sc->arpcom.ac_if;
+
+	while(!((rxstat = sc->wb_cdata.wb_rx_head->wb_ptr->wb_status) &
+							WB_RXSTAT_OWN)) {
+		cur_rx = sc->wb_cdata.wb_rx_head;
+		sc->wb_cdata.wb_rx_head = cur_rx->wb_nextdesc;
+
+		if ((rxstat & WB_RXSTAT_RXERR) || (rxstat & WB_RXSTAT_MIIERR)
+			 || WB_RXBYTES(cur_rx->wb_ptr->wb_status) == 0) {
+			ifp->if_ierrors++;
+			wb_reset(sc);
+			printf("wb%x: receiver babbling: possible chip "
+				"bug, forcing reset\n", sc->wb_unit);
+			ifp->if_flags |= IFF_OACTIVE;
+			ifp->if_timer = 2;
+			return;
+		}
+
+		/* No errors; receive the packet. */	
+		m = cur_rx->wb_mbuf;
+		total_len = WB_RXBYTES(cur_rx->wb_ptr->wb_status);
+
+		/*
+		 * Try to conjure up a new mbuf cluster. If that
+		 * fails, it means we have an out of memory condition and
+		 * should leave the buffer in place and continue. This will
+		 * result in a lost packet, but there's little else we
+		 * can do in this situation.
+		 */
+		if (wb_newbuf(sc, cur_rx) == ENOBUFS) {
+			ifp->if_ierrors++;
+			cur_rx->wb_ptr->wb_ctl =
+					WB_RXCTL_RLINK | (MCLBYTES - 1);
+			cur_rx->wb_ptr->wb_status = WB_RXSTAT;
+			continue;
+		}
+
+		ifp->if_ipackets++;
+		eh = mtod(m, struct ether_header *);
+		m->m_pkthdr.rcvif = ifp;
+		m->m_pkthdr.len = m->m_len = total_len;
+
+#if NBPFILTER > 0
+		/*
+		 * Handle BPF listeners. Let the BPF user see the packet, but
+		 * don't pass it up to the ether_input() layer unless it's
+		 * a broadcast packet, multicast packet, matches our ethernet
+		 * address or the interface is in promiscuous mode.
+		 */
+		if (ifp->if_bpf) {
+			bpf_mtap(ifp, m);
+			if (ifp->if_flags & IFF_PROMISC &&
+				(bcmp(eh->ether_dhost, sc->arpcom.ac_enaddr,
+						ETHER_ADDR_LEN) &&
+					(eh->ether_dhost[0] & 1) == 0)) {
+				m_freem(m);
+				continue;
+			}
+		}
+#endif
+		/* Remove header from mbuf and pass it on. */
+		m_adj(m, sizeof(struct ether_header));
+		ether_input(ifp, eh, m);
+	}
+
+	return;
+}
+
+void wb_rxeoc(sc)
+	struct wb_softc		*sc;
+{
+	wb_rxeof(sc);
+
+	WB_CLRBIT(sc, WB_NETCFG, WB_NETCFG_RX_ON);
+	CSR_WRITE_4(sc, WB_RXADDR, vtophys(&sc->wb_ldata->wb_rx_list[0]));
+	WB_SETBIT(sc, WB_NETCFG, WB_NETCFG_RX_ON);
+	if (CSR_READ_4(sc, WB_ISR) & WB_RXSTATE_SUSPEND)
+		CSR_WRITE_4(sc, WB_RXSTART, 0xFFFFFFFF);
+
+	return;
+}
+
+/*
+ * A frame was downloaded to the chip. It's safe for us to clean up
+ * the list buffers.
+ */
+static void wb_txeof(sc)
+	struct wb_softc		*sc;
+{
+	struct wb_chain		*cur_tx;
+	struct ifnet		*ifp;
+
+	ifp = &sc->arpcom.ac_if;
+
+	/* Clear the timeout timer. */
+	ifp->if_timer = 0;
+
+	if (sc->wb_cdata.wb_tx_head == NULL)
+		return;
+
+	/*
+	 * Go through our tx list and free mbufs for those
+	 * frames that have been transmitted.
+	 */
+	while(sc->wb_cdata.wb_tx_head->wb_mbuf != NULL) {
+		u_int32_t		txstat;
+
+		cur_tx = sc->wb_cdata.wb_tx_head;
+		txstat = WB_TXSTATUS(cur_tx);
+
+		if ((txstat & WB_TXSTAT_OWN) || txstat == WB_UNSENT)
+			break;
+
+		if (txstat & WB_TXSTAT_TXERR) {
+			ifp->if_oerrors++;
+			if (txstat & WB_TXSTAT_ABORT)
+				ifp->if_collisions++;
+			if (txstat & WB_TXSTAT_LATECOLL)
+				ifp->if_collisions++;
+		}
+
+		ifp->if_collisions += (txstat & WB_TXSTAT_COLLCNT) >> 3;
+
+		ifp->if_opackets++;
+		m_freem(cur_tx->wb_mbuf);
+		cur_tx->wb_mbuf = NULL;
+
+		if (sc->wb_cdata.wb_tx_head == sc->wb_cdata.wb_tx_tail) {
+			sc->wb_cdata.wb_tx_head = NULL;
+			sc->wb_cdata.wb_tx_tail = NULL;
+			break;
+		}
+
+		sc->wb_cdata.wb_tx_head = cur_tx->wb_nextdesc;
+	}
+
+	return;
+}
+
+/*
+ * TX 'end of channel' interrupt handler.
+ */
+static void wb_txeoc(sc)
+	struct wb_softc		*sc;
+{
+	struct ifnet		*ifp;
+
+	ifp = &sc->arpcom.ac_if;
+
+	ifp->if_timer = 0;
+
+	if (sc->wb_cdata.wb_tx_head == NULL) {
+		ifp->if_flags &= ~IFF_OACTIVE;
+		sc->wb_cdata.wb_tx_tail = NULL;
+		if (sc->wb_want_auto)
+			wb_autoneg_mii(sc, WB_FLAG_SCHEDDELAY, 1);
+	} else {
+		if (WB_TXOWN(sc->wb_cdata.wb_tx_head) == WB_UNSENT) {
+			WB_TXOWN(sc->wb_cdata.wb_tx_head) = WB_TXSTAT_OWN;
+			ifp->if_timer = 5;
+			CSR_WRITE_4(sc, WB_TXSTART, 0xFFFFFFFF);
+		}
+	}
+
+	return;
+}
+
+static void wb_intr(arg)
+	void			*arg;
+{
+	struct wb_softc		*sc;
+	struct ifnet		*ifp;
+	u_int32_t		status;
+
+	sc = arg;
+	ifp = &sc->arpcom.ac_if;
+
+	if (!(ifp->if_flags & IFF_UP))
+		return;
+
+	/* Disable interrupts. */
+	CSR_WRITE_4(sc, WB_IMR, 0x00000000);
+
+	for (;;) {
+
+		status = CSR_READ_4(sc, WB_ISR);
+		if (status)
+			CSR_WRITE_4(sc, WB_ISR, status);
+
+		if ((status & WB_INTRS) == 0)
+			break;
+
+		if (status & WB_ISR_RX_OK)
+			wb_rxeof(sc);
+
+		if (status & WB_ISR_RX_IDLE)
+			wb_rxeoc(sc);
+
+		if ((status & WB_ISR_RX_NOBUF) || (status & WB_ISR_RX_ERR)) {
+			ifp->if_ierrors++;
+			wb_stop(sc);
+			wb_reset(sc);
+			wb_init(sc);
+		}
+
+		if (status & WB_ISR_TX_OK)
+			wb_txeof(sc);
+
+		if (status & WB_ISR_TX_NOBUF)
+			wb_txeoc(sc);
+
+		if (status & WB_ISR_TX_IDLE) {
+			wb_txeof(sc);
+			if (sc->wb_cdata.wb_tx_head != NULL) {
+				WB_SETBIT(sc, WB_NETCFG, WB_NETCFG_TX_ON);
+				CSR_WRITE_4(sc, WB_TXSTART, 0xFFFFFFFF);
+			}
+		}
+
+		if (status & WB_ISR_TX_UNDERRUN) {
+			ifp->if_oerrors++;
+			wb_txeof(sc);
+			WB_CLRBIT(sc, WB_NETCFG, WB_NETCFG_TX_ON);
+			/* Jack up TX threshold */
+			sc->wb_txthresh += WB_TXTHRESH_CHUNK;
+			WB_CLRBIT(sc, WB_NETCFG, WB_NETCFG_TX_THRESH);
+			WB_SETBIT(sc, WB_NETCFG, WB_TXTHRESH(sc->wb_txthresh));
+			WB_SETBIT(sc, WB_NETCFG, WB_NETCFG_TX_ON);
+		}
+
+		if (status & WB_ISR_BUS_ERR) {
+			wb_reset(sc);
+			wb_init(sc);
+		}
+
+	}
+
+	/* Re-enable interrupts. */
+	CSR_WRITE_4(sc, WB_IMR, WB_INTRS);
+
+	if (ifp->if_snd.ifq_head != NULL) {
+		wb_start(ifp);
+	}
+
+	return;
+}
+
+/*
+ * Encapsulate an mbuf chain in a descriptor by coupling the mbuf data
+ * pointers to the fragment pointers.
+ */
+static int wb_encap(sc, c, m_head)
+	struct wb_softc		*sc;
+	struct wb_chain		*c;
+	struct mbuf		*m_head;
+{
+	int			frag = 0;
+	struct wb_desc		*f = NULL;
+	int			total_len;
+	struct mbuf		*m;
+
+	/*
+ 	 * Start packing the mbufs in this chain into
+	 * the fragment pointers. Stop when we run out
+ 	 * of fragments or hit the end of the mbuf chain.
+	 */
+	m = m_head;
+	total_len = 0;
+
+	for (m = m_head, frag = 0; m != NULL; m = m->m_next) {
+		if (m->m_len != 0) {
+			if (frag == WB_MAXFRAGS)
+				break;
+			total_len += m->m_len;
+			f = &c->wb_ptr->wb_frag[frag];
+			f->wb_ctl = WB_TXCTL_TLINK | m->m_len;
+			if (frag == 0) {
+				f->wb_ctl |= WB_TXCTL_FIRSTFRAG;
+				f->wb_status = 0;
+			} else
+				f->wb_status = WB_TXSTAT_OWN;
+			f->wb_next = vtophys(&c->wb_ptr->wb_frag[frag + 1]);
+			f->wb_data = vtophys(mtod(m, vm_offset_t));
+			frag++;
+		}
+	}
+
+	/*
+	 * Handle special case: we used up all 16 fragments,
+	 * but we have more mbufs left in the chain. Copy the
+	 * data into an mbuf cluster. Note that we don't
+	 * bother clearing the values in the other fragment
+	 * pointers/counters; it wouldn't gain us anything,
+	 * and would waste cycles.
+	 */
+	if (m != NULL) {
+		struct mbuf		*m_new = NULL;
+
+		MGETHDR(m_new, M_DONTWAIT, MT_DATA);
+		if (m_new == NULL) {
+			printf("wb%d: no memory for tx list", sc->wb_unit);
+			return(1);
+		}
+		if (m_head->m_pkthdr.len > MHLEN) {
+			MCLGET(m_new, M_DONTWAIT);
+			if (!(m_new->m_flags & M_EXT)) {
+				m_freem(m_new);
+				printf("wb%d: no memory for tx list",
+						sc->wb_unit);
+				return(1);
+			}
+		}
+		m_copydata(m_head, 0, m_head->m_pkthdr.len,	
+					mtod(m_new, caddr_t));
+		m_new->m_pkthdr.len = m_new->m_len = m_head->m_pkthdr.len;
+		m_freem(m_head);
+		m_head = m_new;
+		f = &c->wb_ptr->wb_frag[0];
+		f->wb_status = 0;
+		f->wb_data = vtophys(mtod(m_new, caddr_t));
+		f->wb_ctl = total_len = m_new->m_len;
+		f->wb_ctl |= WB_TXCTL_TLINK|WB_TXCTL_FIRSTFRAG;
+		frag = 1;
+	}
+
+	if (total_len < WB_MIN_FRAMELEN) {
+		f = &c->wb_ptr->wb_frag[frag];
+		f->wb_ctl = WB_MIN_FRAMELEN - total_len;
+		f->wb_data = vtophys(&sc->wb_cdata.wb_pad);
+		f->wb_ctl |= WB_TXCTL_TLINK;
+		f->wb_status = WB_TXSTAT_OWN;
+		frag++;
+	}
+
+	c->wb_mbuf = m_head;
+	c->wb_lastdesc = frag - 1;
+	WB_TXCTL(c) |= WB_TXCTL_LASTFRAG;
+	WB_TXNEXT(c) = vtophys(&c->wb_nextdesc->wb_ptr->wb_frag[0]);
+
+	return(0);
+}
+
+/*
+ * Main transmit routine. To avoid having to do mbuf copies, we put pointers
+ * to the mbuf data regions directly in the transmit lists. We also save a
+ * copy of the pointers since the transmit list fragment pointers are
+ * physical addresses.
+ */
+
+static void wb_start(ifp)
+	struct ifnet		*ifp;
+{
+	struct wb_softc		*sc;
+	struct mbuf		*m_head = NULL;
+	struct wb_chain		*cur_tx = NULL, *start_tx;
+
+	sc = ifp->if_softc;
+
+	if (sc->wb_autoneg) {
+		sc->wb_tx_pend = 1;
+		return;
+	}
+
+	/*
+	 * Check for an available queue slot. If there are none,
+	 * punt.
+	 */
+	if (sc->wb_cdata.wb_tx_free->wb_mbuf != NULL) {
+		ifp->if_flags |= IFF_OACTIVE;
+		return;
+	}
+
+	start_tx = sc->wb_cdata.wb_tx_free;
+
+	while(sc->wb_cdata.wb_tx_free->wb_mbuf == NULL) {
+		IF_DEQUEUE(&ifp->if_snd, m_head);
+		if (m_head == NULL)
+			break;
+
+		/* Pick a descriptor off the free list. */
+		cur_tx = sc->wb_cdata.wb_tx_free;
+		sc->wb_cdata.wb_tx_free = cur_tx->wb_nextdesc;
+
+		/* Pack the data into the descriptor. */
+		wb_encap(sc, cur_tx, m_head);
+
+		if (cur_tx != start_tx)
+			WB_TXOWN(cur_tx) = WB_TXSTAT_OWN;
+
+#if NBPFILTER > 0
+		/*
+		 * If there's a BPF listener, bounce a copy of this frame
+		 * to him.
+		 */
+		if (ifp->if_bpf)
+			bpf_mtap(ifp, cur_tx->wb_mbuf);
+#endif
+	}
+
+	/*
+	 * Place the request for the upload interrupt
+	 * in the last descriptor in the chain. This way, if
+	 * we're chaining several packets at once, we'll only
+	 * get an interupt once for the whole chain rather than
+	 * once for each packet.
+	 */
+	WB_TXCTL(cur_tx) |= WB_TXCTL_FINT;
+	sc->wb_cdata.wb_tx_tail = cur_tx;
+
+	if (sc->wb_cdata.wb_tx_head == NULL) {
+		sc->wb_cdata.wb_tx_head = start_tx;
+		WB_TXOWN(start_tx) = WB_TXSTAT_OWN;
+		CSR_WRITE_4(sc, WB_TXSTART, 0xFFFFFFFF);
+	} else {
+		/*
+		 * We need to distinguish between the case where
+		 * the own bit is clear because the chip cleared it
+		 * and where the own bit is clear because we haven't
+		 * set it yet. The magic value WB_UNSET is just some
+		 * ramdomly chosen number which doesn't have the own
+	 	 * bit set. When we actually transmit the frame, the
+		 * status word will have _only_ the own bit set, so
+		 * the txeoc handler will be able to tell if it needs
+		 * to initiate another transmission to flush out pending
+		 * frames.
+		 */
+		WB_TXOWN(start_tx) = WB_UNSENT;
+	}
+
+	/*
+	 * Set a timeout in case the chip goes out to lunch.
+	 */
+	ifp->if_timer = 5;
+
+	return;
+}
+
+static void wb_init(xsc)
+	void			*xsc;
+{
+	struct wb_softc		*sc = xsc;
+	struct ifnet		*ifp = &sc->arpcom.ac_if;
+	int			s, i;
+	u_int16_t		phy_bmcr = 0;
+
+	if (sc->wb_autoneg)
+		return;
+
+	s = splimp();
+
+	if (sc->wb_pinfo != NULL)
+		phy_bmcr = wb_phy_readreg(sc, PHY_BMCR);
+
+	/*
+	 * Cancel pending I/O and free all RX/TX buffers.
+	 */
+	wb_stop(sc);
+	wb_reset(sc);
+
+	sc->wb_txthresh = WB_TXTHRESH_INIT;
+
+	/*
+	 * Set cache alignment and burst length.
+	 */
+	CSR_WRITE_4(sc, WB_BUSCTL, WB_BUSCTL_CONFIG);
+	WB_CLRBIT(sc, WB_NETCFG, WB_NETCFG_TX_THRESH);
+	WB_SETBIT(sc, WB_NETCFG, WB_TXTHRESH(sc->wb_txthresh));
+
+	/* This doesn't tend to work too well at 100Mbps. */
+	WB_CLRBIT(sc, WB_NETCFG, WB_NETCFG_TX_EARLY_ON);
+
+	wb_setcfg(sc, phy_bmcr);
+
+	/* Init our MAC address */
+	for (i = 0; i < ETHER_ADDR_LEN; i++) {
+		CSR_WRITE_1(sc, WB_NODE0 + i, sc->arpcom.ac_enaddr[i]);
+	}
+
+	/* Init circular RX list. */
+	if (wb_list_rx_init(sc) == ENOBUFS) {
+		printf("wb%d: initialization failed: no "
+			"memory for rx buffers\n", sc->wb_unit);
+		wb_stop(sc);
+		(void)splx(s);
+		return;
+	}
+
+	/* Init TX descriptors. */
+	wb_list_tx_init(sc);
+
+	/* If we want promiscuous mode, set the allframes bit. */
+	if (ifp->if_flags & IFF_PROMISC) {
+		WB_SETBIT(sc, WB_NETCFG, WB_NETCFG_RX_ALLPHYS);
+	} else {
+		WB_CLRBIT(sc, WB_NETCFG, WB_NETCFG_RX_ALLPHYS);
+	}
+
+	/*
+	 * Set capture broadcast bit to capture broadcast frames.
+	 */
+	if (ifp->if_flags & IFF_BROADCAST) {
+		WB_SETBIT(sc, WB_NETCFG, WB_NETCFG_RX_BROAD);
+	} else {
+		WB_CLRBIT(sc, WB_NETCFG, WB_NETCFG_RX_BROAD);
+	}
+
+	/*
+	 * Program the multicast filter, if necessary.
+	 */
+	wb_setmulti(sc);
+
+	/*
+	 * Load the address of the RX list.
+	 */
+	WB_CLRBIT(sc, WB_NETCFG, WB_NETCFG_RX_ON);
+	CSR_WRITE_4(sc, WB_RXADDR, vtophys(&sc->wb_ldata->wb_rx_list[0]));
+
+	/*
+	 * Enable interrupts.
+	 */
+	CSR_WRITE_4(sc, WB_IMR, WB_INTRS);
+	CSR_WRITE_4(sc, WB_ISR, 0xFFFFFFFF);
+
+	/* Enable receiver and transmitter. */
+	WB_SETBIT(sc, WB_NETCFG, WB_NETCFG_RX_ON);
+	CSR_WRITE_4(sc, WB_RXSTART, 0xFFFFFFFF);
+
+	WB_CLRBIT(sc, WB_NETCFG, WB_NETCFG_TX_ON);
+	CSR_WRITE_4(sc, WB_TXADDR, vtophys(&sc->wb_ldata->wb_tx_list[0]));
+	WB_SETBIT(sc, WB_NETCFG, WB_NETCFG_TX_ON);
+
+	/* Restore state of BMCR */
+	if (sc->wb_pinfo != NULL)
+		wb_phy_writereg(sc, PHY_BMCR, phy_bmcr);
+
+	ifp->if_flags |= IFF_RUNNING;
+	ifp->if_flags &= ~IFF_OACTIVE;
+
+	(void)splx(s);
+
+	return;
+}
+
+/*
+ * Set media options.
+ */
+static int wb_ifmedia_upd(ifp)
+	struct ifnet		*ifp;
+{
+	struct wb_softc		*sc;
+	struct ifmedia		*ifm;
+
+	sc = ifp->if_softc;
+	ifm = &sc->ifmedia;
+
+	if (IFM_TYPE(ifm->ifm_media) != IFM_ETHER)
+		return(EINVAL);
+
+	if (IFM_SUBTYPE(ifm->ifm_media) == IFM_AUTO)
+		wb_autoneg_mii(sc, WB_FLAG_SCHEDDELAY, 1);
+	else
+		wb_setmode_mii(sc, ifm->ifm_media);
+
+	return(0);
+}
+
+/*
+ * Report current media status.
+ */
+static void wb_ifmedia_sts(ifp, ifmr)
+	struct ifnet		*ifp;
+	struct ifmediareq	*ifmr;
+{
+	struct wb_softc		*sc;
+	u_int16_t		advert = 0, ability = 0;
+
+	sc = ifp->if_softc;
+
+	ifmr->ifm_active = IFM_ETHER;
+
+	if (!(wb_phy_readreg(sc, PHY_BMCR) & PHY_BMCR_AUTONEGENBL)) {
+		if (wb_phy_readreg(sc, PHY_BMCR) & PHY_BMCR_SPEEDSEL)
+			ifmr->ifm_active = IFM_ETHER|IFM_100_TX;
+		else
+			ifmr->ifm_active = IFM_ETHER|IFM_10_T;
+		if (wb_phy_readreg(sc, PHY_BMCR) & PHY_BMCR_DUPLEX)
+			ifmr->ifm_active |= IFM_FDX;
+		else
+			ifmr->ifm_active |= IFM_HDX;
+		return;
+	}
+
+	ability = wb_phy_readreg(sc, PHY_LPAR);
+	advert = wb_phy_readreg(sc, PHY_ANAR);
+	if (advert & PHY_ANAR_100BT4 &&
+		ability & PHY_ANAR_100BT4) {
+		ifmr->ifm_active = IFM_ETHER|IFM_100_T4;
+	} else if (advert & PHY_ANAR_100BTXFULL &&
+		ability & PHY_ANAR_100BTXFULL) {
+		ifmr->ifm_active = IFM_ETHER|IFM_100_TX|IFM_FDX;
+	} else if (advert & PHY_ANAR_100BTXHALF &&
+		ability & PHY_ANAR_100BTXHALF) {
+		ifmr->ifm_active = IFM_ETHER|IFM_100_TX|IFM_HDX;
+	} else if (advert & PHY_ANAR_10BTFULL &&
+		ability & PHY_ANAR_10BTFULL) {
+		ifmr->ifm_active = IFM_ETHER|IFM_10_T|IFM_FDX;
+	} else if (advert & PHY_ANAR_10BTHALF &&
+		ability & PHY_ANAR_10BTHALF) {
+		ifmr->ifm_active = IFM_ETHER|IFM_10_T|IFM_HDX;
+	}
+
+	return;
+}
+
+static int wb_ioctl(ifp, command, data)
+	struct ifnet		*ifp;
+	u_long			command;
+	caddr_t			data;
+{
+	struct wb_softc		*sc = ifp->if_softc;
+	struct ifreq		*ifr = (struct ifreq *) data;
+	int			s, error = 0;
+
+	s = splimp();
+
+	switch(command) {
+	case SIOCSIFADDR:
+	case SIOCGIFADDR:
+	case SIOCSIFMTU:
+		error = ether_ioctl(ifp, command, data);
+		break;
+	case SIOCSIFFLAGS:
+		if (ifp->if_flags & IFF_UP) {
+			wb_init(sc);
+		} else {
+			if (ifp->if_flags & IFF_RUNNING)
+				wb_stop(sc);
+		}
+		error = 0;
+		break;
+	case SIOCADDMULTI:
+	case SIOCDELMULTI:
+		wb_setmulti(sc);
+		error = 0;
+		break;
+	case SIOCGIFMEDIA:
+	case SIOCSIFMEDIA:
+		error = ifmedia_ioctl(ifp, ifr, &sc->ifmedia, command);
+		break;
+	default:
+		error = EINVAL;
+		break;
+	}
+
+	(void)splx(s);
+
+	return(error);
+}
+
+static void wb_watchdog(ifp)
+	struct ifnet		*ifp;
+{
+	struct wb_softc		*sc;
+
+	sc = ifp->if_softc;
+
+	if (sc->wb_autoneg) {
+		wb_autoneg_mii(sc, WB_FLAG_DELAYTIMEO, 1);
+		return;
+	}
+
+	ifp->if_oerrors++;
+	printf("wb%d: watchdog timeout\n", sc->wb_unit);
+
+	if (!(wb_phy_readreg(sc, PHY_BMSR) & PHY_BMSR_LINKSTAT))
+		printf("wb%d: no carrier - transceiver cable problem?\n",
+								sc->wb_unit);
+
+	wb_stop(sc);
+	wb_reset(sc);
+	wb_init(sc);
+
+	if (ifp->if_snd.ifq_head != NULL)
+		wb_start(ifp);
+
+	return;
+}
+
+/*
+ * Stop the adapter and free any mbufs allocated to the
+ * RX and TX lists.
+ */
+static void wb_stop(sc)
+	struct wb_softc		*sc;
+{
+	register int		i;
+	struct ifnet		*ifp;
+
+	ifp = &sc->arpcom.ac_if;
+	ifp->if_timer = 0;
+
+	WB_CLRBIT(sc, WB_NETCFG, (WB_NETCFG_RX_ON|WB_NETCFG_TX_ON));
+	CSR_WRITE_4(sc, WB_IMR, 0x00000000);
+	CSR_WRITE_4(sc, WB_TXADDR, 0x00000000);
+	CSR_WRITE_4(sc, WB_RXADDR, 0x00000000);
+
+	/*
+	 * Free data in the RX lists.
+	 */
+	for (i = 0; i < WB_RX_LIST_CNT; i++) {
+		if (sc->wb_cdata.wb_rx_chain[i].wb_mbuf != NULL) {
+			m_freem(sc->wb_cdata.wb_rx_chain[i].wb_mbuf);
+			sc->wb_cdata.wb_rx_chain[i].wb_mbuf = NULL;
+		}
+	}
+	bzero((char *)&sc->wb_ldata->wb_rx_list,
+		sizeof(sc->wb_ldata->wb_rx_list));
+
+	/*
+	 * Free the TX list buffers.
+	 */
+	for (i = 0; i < WB_TX_LIST_CNT; i++) {
+		if (sc->wb_cdata.wb_tx_chain[i].wb_mbuf != NULL) {
+			m_freem(sc->wb_cdata.wb_tx_chain[i].wb_mbuf);
+			sc->wb_cdata.wb_tx_chain[i].wb_mbuf = NULL;
+		}
+	}
+
+	bzero((char *)&sc->wb_ldata->wb_tx_list,
+		sizeof(sc->wb_ldata->wb_tx_list));
+
+	ifp->if_flags &= ~(IFF_RUNNING | IFF_OACTIVE);
+
+	return;
+}
+
+/*
+ * Stop all chip I/O so that the kernel's probe routines don't
+ * get confused by errant DMAs when rebooting.
+ */
+static void wb_shutdown(howto, arg)
+	int			howto;
+	void			*arg;
+{
+	struct wb_softc		*sc = (struct wb_softc *)arg;
+
+	wb_stop(sc);
+
+	return;
+}
+
+static struct pci_device wb_device = {
+	"wb",
+	wb_probe,
+	wb_attach,
+	&wb_count,
+	NULL
+};
+DATA_SET(pcidevice_set, wb_device);
diff --git a/sys/pci/if_wbreg.h b/sys/pci/if_wbreg.h
new file mode 100644
index 0000000..abe7ec5
--- /dev/null
+++ b/sys/pci/if_wbreg.h
@@ -0,0 +1,583 @@
+/*
+ * Copyright (c) 1997, 1998
+ *	Bill Paul <wpaul@ctr.columbia.edu>.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ * 3. All advertising materials mentioning features or use of this software
+ *    must display the following acknowledgement:
+ *	This product includes software developed by Bill Paul.
+ * 4. Neither the name of the author nor the names of any co-contributors
+ *    may be used to endorse or promote products derived from this software
+ *    without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY Bill Paul AND CONTRIBUTORS ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL Bill Paul OR THE VOICES IN HIS HEAD
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ *
+ *	$Id: if_wbreg.h,v 1.12 1998/11/29 06:40:50 wpaul Exp $
+ */
+
+/*
+ * Winbond register definitions.
+ */
+
+#define WB_BUSCTL		0x00	/* bus control */
+#define WB_TXSTART		0x04	/* tx start demand */
+#define WB_RXSTART		0x08	/* rx start demand */
+#define WB_RXADDR		0x0C	/* rx descriptor list start addr */
+#define WB_TXADDR		0x10	/* tx descriptor list start addr */
+#define WB_ISR			0x14	/* interrupt status register */
+#define WB_NETCFG		0x18	/* network config register */
+#define WB_IMR			0x1C	/* interrupt mask */
+#define WB_FRAMESDISCARDED	0x20	/* # of discarded frames */
+#define WB_SIO			0x24	/* MII and ROM/EEPROM access */
+#define WB_BOOTROMADDR		0x28
+#define WB_TIMER		0x2C	/* general timer */
+#define WB_CURRXCTL		0x30	/* current RX descriptor */
+#define WB_CURRXBUF		0x34	/* current RX buffer */
+#define WB_MAR0			0x38	/* multicast filter 0 */
+#define WB_MAR1			0x3C	/* multicast filter 1 */
+#define WB_NODE0		0x40	/* station address 0 */
+#define WB_NODE1		0x44	/* station address 1 */
+#define WB_BOOTROMSIZE		0x48	/* boot ROM size */
+#define WB_CURTXCTL		0x4C	/* current TX descriptor */
+#define WB_CURTXBUF		0x50	/* current TX buffer */
+
+/*
+ * Bus control bits.
+ */
+#define WB_BUSCTL_RESET		0x00000001
+#define WB_BUSCTL_ARBITRATION	0x00000002
+#define WB_BUSCTL_SKIPLEN	0x0000007C
+#define WB_BUSCTL_BUF_BIGENDIAN	0x00000080
+#define WB_BUSCTL_BURSTLEN	0x00003F00
+#define WB_BUSCTL_CACHEALIGN	0x0000C000
+#define WB_BUSCTL_DES_BIGENDIAN	0x00100000
+#define WB_BUSCTL_WAIT		0x00200000
+
+#define WB_SKIPLEN_1LONG	0x00000004
+#define WB_SKIPLEN_2LONG	0x00000008
+#define WB_SKIPLEN_3LONG	0x00000010
+#define WB_SKIPLEN_4LONG	0x00000020
+#define WB_SKIPLEN_5LONG	0x00000040
+
+#define WB_CACHEALIGN_8LONG	0x00004000
+#define WB_CACHEALIGN_16LONG	0x00008000
+#define WB_CACHEALIGN_32LONG	0x0000C000
+
+#define WB_BURSTLEN_USECA	0x00000000
+#define WB_BURSTLEN_1LONG	0x00000100
+#define WB_BURSTLEN_2LONG	0x00000200
+#define WB_BURSTLEN_4LONG	0x00000400
+#define WB_BURSTLEN_8LONG	0x00000800
+#define WB_BURSTLEN_16LONG	0x00001000
+#define WB_BURSTLEN_32LONG	0x00002000
+
+#define WB_BUSCTL_CONFIG	(WB_CACHEALIGN_8LONG|WB_SKIPLEN_3LONG| \
+					WB_BURSTLEN_8LONG)
+
+/*
+ * Interrupt status bits.
+ */
+#define WB_ISR_TX_OK		0x00000001
+#define WB_ISR_TX_IDLE		0x00000002
+#define WB_ISR_TX_NOBUF		0x00000004
+#define WB_ISR_RX_EARLY		0x00000008
+#define WB_ISR_RX_ERR		0x00000010
+#define WB_ISR_TX_UNDERRUN	0x00000020
+#define WB_ISR_RX_OK		0x00000040
+#define WB_ISR_RX_NOBUF		0x00000080
+#define WB_ISR_RX_IDLE		0x00000100
+#define WB_ISR_TX_EARLY		0x00000400
+#define WB_ISR_TIMER_EXPIRED	0x00000800
+#define WB_ISR_BUS_ERR		0x00002000
+#define WB_ISR_ABNORMAL		0x00008000
+#define WB_ISR_NORMAL		0x00010000
+#define WB_ISR_RX_STATE		0x000E0000
+#define WB_ISR_TX_STATE		0x00700000
+#define WB_ISR_BUSERRTYPE	0x03800000
+
+/*
+ * The RX_STATE and TX_STATE fields are not described anywhere in the
+ * Winbond datasheet, however it appears that the Winbond chip is an
+ * attempt at a DEC 'tulip' clone, hence the ISR register is identical
+ * to that of the tulip chip and we can steal the bit definitions from
+ * the tulip documentation.
+ */
+#define WB_RXSTATE_STOPPED	0x00000000	/* 000 - Stopped */
+#define WB_RXSTATE_FETCH	0x00020000	/* 001 - Fetching descriptor */
+#define WB_RXSTATE_ENDCHECK	0x00040000	/* 010 - check for rx end */
+#define WB_RXSTATE_WAIT		0x00060000	/* 011 - waiting for packet */
+#define WB_RXSTATE_SUSPEND	0x00080000	/* 100 - suspend rx */
+#define WB_RXSTATE_CLOSE	0x000A0000	/* 101 - close tx desc */
+#define WB_RXSTATE_FLUSH	0x000C0000	/* 110 - flush from FIFO */
+#define WB_RXSTATE_DEQUEUE	0x000E0000	/* 111 - dequeue from FIFO */
+
+#define WB_TXSTATE_RESET	0x00000000	/* 000 - reset */
+#define WB_TXSTATE_FETCH	0x00100000	/* 001 - fetching descriptor */
+#define WB_TXSTATE_WAITEND	0x00200000	/* 010 - wait for tx end */
+#define WB_TXSTATE_READING	0x00300000	/* 011 - read and enqueue */
+#define WB_TXSTATE_RSVD		0x00400000	/* 100 - reserved */
+#define WB_TXSTATE_SETUP	0x00500000	/* 101 - setup packet */
+#define WB_TXSTATE_SUSPEND	0x00600000	/* 110 - suspend tx */
+#define WB_TXSTATE_CLOSE	0x00700000	/* 111 - close tx desc */
+
+/*
+ * Network config bits.
+ */
+#define WB_NETCFG_RX_ON		0x00000002
+#define WB_NETCFG_RX_ALLPHYS	0x00000008
+#define WB_NETCFG_RX_MULTI	0x00000010
+#define WB_NETCFG_RX_BROAD	0x00000020
+#define WB_NETCFG_RX_RUNT	0x00000040
+#define WB_NETCFG_RX_ERR	0x00000080
+#define WB_NETCFG_FULLDUPLEX	0x00000200
+#define WB_NETCFG_LOOPBACK	0x00000C00
+#define WB_NETCFG_TX_ON		0x00002000
+#define WB_NETCFG_TX_THRESH	0x001FC000
+#define WB_NETCFG_RX_EARLYTHRSH	0x1FE00000
+#define WB_NETCFG_100MBPS	0x20000000
+#define WB_NETCFG_TX_EARLY_ON	0x40000000
+#define WB_NETCFG_RX_EARLY_ON	0x80000000
+
+/*
+ * The tx threshold can be adjusted in increments of 32 bytes.
+ */
+#define WB_TXTHRESH(x)		((x >> 5) << 14)
+#define WB_TXTHRESH_CHUNK	32
+#define WB_TXTHRESH_INIT	72
+ 
+/*
+ * Interrupt mask bits.
+ */
+#define WB_IMR_TX_OK		0x00000001
+#define WB_IMR_TX_IDLE		0x00000002
+#define WB_IMR_TX_NOBUF		0x00000004
+#define WB_IMR_RX_EARLY		0x00000008
+#define WB_IMR_RX_ERR		0x00000010
+#define WB_IMR_TX_UNDERRUN	0x00000020
+#define WB_IMR_RX_OK		0x00000040
+#define WB_IMR_RX_NOBUF		0x00000080
+#define WB_IMR_RX_IDLE		0x00000100
+#define WB_IMR_TX_EARLY		0x00000400
+#define WB_IMR_TIMER_EXPIRED	0x00000800
+#define WB_IMR_BUS_ERR		0x00002000
+#define WB_IMR_ABNORMAL		0x00008000
+#define WB_IMR_NORMAL		0x00010000
+
+#define WB_INTRS	\
+	(WB_IMR_RX_OK|WB_IMR_TX_OK|WB_IMR_RX_NOBUF|WB_IMR_RX_ERR|	\
+	WB_IMR_TX_NOBUF|WB_IMR_TX_UNDERRUN|WB_IMR_BUS_ERR|		\
+	WB_IMR_ABNORMAL|WB_IMR_NORMAL|WB_IMR_TX_EARLY)
+/*
+ * Serial I/O (EEPROM/ROM) bits.
+ */
+#define WB_SIO_EE_CS		0x00000001	/* EEPROM chip select */
+#define WB_SIO_EE_CLK		0x00000002	/* EEPROM clock */
+#define WB_SIO_EE_DATAIN	0x00000004	/* EEPROM data output */
+#define WB_SIO_EE_DATAOUT	0x00000008	/* EEPROM data input */
+#define WB_SIO_ROMDATA4		0x00000010
+#define WB_SIO_ROMDATA5		0x00000020
+#define WB_SIO_ROMDATA6		0x00000040
+#define WB_SIO_ROMDATA7		0x00000080
+#define WB_SIO_ROMCTL_WRITE	0x00000200
+#define WB_SIO_ROMCTL_READ	0x00000400
+#define WB_SIO_EESEL		0x00000800
+#define WB_SIO_MII_CLK		0x00010000	/* MDIO clock */
+#define WB_SIO_MII_DATAIN	0x00020000	/* MDIO data out */
+#define WB_SIO_MII_DIR		0x00040000	/* MDIO dir */
+#define WB_SIO_MII_DATAOUT	0x00080000	/* MDIO data in */
+
+#define WB_EECMD_WRITE		0x140
+#define WB_EECMD_READ		0x180
+#define WB_EECMD_ERASE		0x1c0
+
+/*
+ * Winbond TX/RX descriptor structure.
+ */
+
+struct wb_desc {
+	u_int32_t		wb_status;
+	u_int32_t		wb_ctl;
+	u_int32_t		wb_ptr1;
+	u_int32_t		wb_ptr2;
+};
+
+#define wb_data		wb_ptr1
+#define wb_next		wb_ptr2
+
+#define WB_RXSTAT_CRCERR	0x00000002
+#define WB_RXSTAT_DRIBBLE	0x00000004
+#define WB_RXSTAT_MIIERR	0x00000008
+#define WB_RXSTAT_LATEEVENT	0x00000040
+#define WB_RXSTAT_GIANT		0x00000080
+#define WB_RXSTAT_LASTFRAG	0x00000100
+#define WB_RXSTAT_FIRSTFRAG	0x00000200
+#define WB_RXSTAT_MULTICAST	0x00000400
+#define WB_RXSTAT_RUNT		0x00000800
+#define WB_RXSTAT_RXTYPE	0x00003000
+#define WB_RXSTAT_RXERR		0x00008000
+#define WB_RXSTAT_RXLEN		0x3FFF0000
+#define WB_RXSTAT_RXCMP		0x40000000
+#define WB_RXSTAT_OWN		0x80000000
+
+#define WB_RXBYTES(x)		((x & WB_RXSTAT_RXLEN) >> 16)
+#define WB_RXSTAT (WB_RXSTAT_FIRSTFRAG|WB_RXSTAT_LASTFRAG|WB_RXSTAT_OWN)
+
+#define WB_RXCTL_BUFLEN1	0x00000FFF
+#define WB_RXCTL_BUFLEN2	0x00FFF000
+#define WB_RXCTL_RLINK		0x01000000
+#define WB_RXCTL_RLAST		0x02000000
+
+#define WB_TXSTAT_DEFER		0x00000001
+#define WB_TXSTAT_UNDERRUN	0x00000002
+#define WB_TXSTAT_COLLCNT	0x00000078
+#define WB_TXSTAT_SQE		0x00000080
+#define WB_TXSTAT_ABORT		0x00000100
+#define WB_TXSTAT_LATECOLL	0x00000200
+#define WB_TXSTAT_NOCARRIER	0x00000400
+#define WB_TXSTAT_CARRLOST	0x00000800
+#define WB_TXSTAT_TXERR		0x00001000
+#define WB_TXSTAT_OWN		0x80000000
+
+#define WB_TXCTL_BUFLEN1	0x000007FF
+#define WB_TXCTL_BUFLEN2	0x003FF800
+#define WB_TXCTL_PAD		0x00800000
+#define WB_TXCTL_TLINK		0x01000000
+#define WB_TXCTL_TLAST		0x02000000
+#define WB_TXCTL_NOCRC		0x08000000
+#define WB_TXCTL_FIRSTFRAG	0x20000000
+#define WB_TXCTL_LASTFRAG	0x40000000
+#define WB_TXCTL_FINT		0x80000000
+
+#define WB_MAXFRAGS		16
+#define WB_RX_LIST_CNT		64
+#define WB_TX_LIST_CNT		64
+#define WB_MIN_FRAMELEN		60
+
+/*
+ * A transmit 'super descriptor' is actually WB_MAXFRAGS regular
+ * descriptors clumped together. The idea here is to emulate the
+ * multi-fragment descriptor layout found in devices such as the
+ * Texas Instruments ThunderLAN and 3Com boomerang and cylone chips.
+ * The advantage to using this scheme is that it avoids buffer copies.
+ * The disadvantage is that there's a certain amount of overhead due
+ * to the fact that each 'fragment' is 16 bytes long. In my tests,
+ * this limits top speed to about 10.5MB/sec. It should be more like
+ * 11.5MB/sec. However, the upshot is that you can achieve better
+ * results on slower machines: a Pentium 200 can pump out packets at
+ * same speed as a PII 400.
+ */
+struct wb_txdesc {
+	struct wb_desc		wb_frag[WB_MAXFRAGS];
+};
+
+#define WB_TXNEXT(x)	x->wb_ptr->wb_frag[x->wb_lastdesc].wb_next
+#define WB_TXSTATUS(x)	x->wb_ptr->wb_frag[x->wb_lastdesc].wb_status
+#define WB_TXCTL(x)	x->wb_ptr->wb_frag[x->wb_lastdesc].wb_ctl
+#define WB_TXDATA(x)	x->wb_ptr->wb_frag[x->wb_lastdesc].wb_data
+
+#define WB_TXOWN(x)	x->wb_ptr->wb_frag[0].wb_status
+
+#define WB_UNSENT	0x1234
+
+struct wb_list_data {
+	struct wb_desc		wb_rx_list[WB_RX_LIST_CNT];
+	struct wb_txdesc	wb_tx_list[WB_TX_LIST_CNT];
+};
+
+struct wb_chain {
+	struct wb_txdesc	*wb_ptr;
+	struct mbuf		*wb_mbuf;
+	struct wb_chain		*wb_nextdesc;
+	u_int8_t		wb_lastdesc;
+};
+
+struct wb_chain_onefrag {
+	struct wb_desc		*wb_ptr;
+	struct mbuf		*wb_mbuf;
+	struct wb_chain_onefrag	*wb_nextdesc;
+	u_int8_t		wb_rlast;
+};
+
+struct wb_chain_data {
+	u_int8_t		wb_pad[WB_MIN_FRAMELEN];
+	struct wb_chain_onefrag	wb_rx_chain[WB_RX_LIST_CNT];
+	struct wb_chain		wb_tx_chain[WB_TX_LIST_CNT];
+
+	struct wb_chain_onefrag	*wb_rx_head;
+
+	struct wb_chain		*wb_tx_head;
+	struct wb_chain		*wb_tx_tail;
+	struct wb_chain		*wb_tx_free;
+};
+
+struct wb_type {
+	u_int16_t		wb_vid;
+	u_int16_t		wb_did;
+	char			*wb_name;
+};
+
+struct wb_mii_frame {
+	u_int8_t		mii_stdelim;
+	u_int8_t		mii_opcode;
+	u_int8_t		mii_phyaddr;
+	u_int8_t		mii_regaddr;
+	u_int8_t		mii_turnaround;
+	u_int16_t		mii_data;
+};
+
+/*
+ * MII constants
+ */
+#define WB_MII_STARTDELIM	0x01
+#define WB_MII_READOP		0x02
+#define WB_MII_WRITEOP		0x01
+#define WB_MII_TURNAROUND	0x02
+
+#define WB_FLAG_FORCEDELAY	1
+#define WB_FLAG_SCHEDDELAY	2
+#define WB_FLAG_DELAYTIMEO	3	
+
+struct wb_softc {
+	struct arpcom		arpcom;		/* interface info */
+	struct ifmedia		ifmedia;	/* media info */
+	bus_space_handle_t	wb_bhandle;
+	bus_space_tag_t		wb_btag;
+	struct wb_type		*wb_info;	/* 3Com adapter info */
+	struct wb_type		*wb_pinfo;	/* phy info */
+	u_int8_t		wb_unit;	/* interface number */
+	u_int8_t		wb_type;
+	u_int8_t		wb_phy_addr;	/* PHY address */
+	u_int8_t		wb_tx_pend;	/* TX pending */
+	u_int8_t		wb_want_auto;
+	u_int8_t		wb_autoneg;
+	u_int16_t		wb_txthresh;
+	caddr_t			wb_ldata_ptr;
+	struct wb_list_data	*wb_ldata;
+	struct wb_chain_data	wb_cdata;
+};
+
+/*
+ * register space access macros
+ */
+#define CSR_WRITE_4(sc, reg, val)	\
+	bus_space_write_4(sc->wb_btag, sc->wb_bhandle, reg, val)
+#define CSR_WRITE_2(sc, reg, val)	\
+	bus_space_write_2(sc->wb_btag, sc->wb_bhandle, reg, val)
+#define CSR_WRITE_1(sc, reg, val)	\
+	bus_space_write_1(sc->wb_btag, sc->wb_bhandle, reg, val)
+
+#define CSR_READ_4(sc, reg)	\
+	bus_space_read_4(sc->wb_btag, sc->wb_bhandle, reg)
+#define CSR_READ_2(sc, reg)	\
+	bus_space_read_2(sc->wb_btag, sc->wb_bhandle, reg)
+#define CSR_READ_1(sc, reg)	\
+	bus_space_read_1(sc->wb_btag, sc->wb_bhandle, reg)
+
+#define WB_TIMEOUT		1000
+
+/*
+ * General constants that are fun to know.
+ *
+ * Winbond PCI vendor ID
+ */
+#define	WB_VENDORID		0x1050
+
+/*
+ * Winbond device IDs.
+ */
+#define	WB_DEVICEID_840F	0x0840
+
+/*
+ * Compex vendor ID.
+ */
+#define CP_VENDORID		0x11F6
+
+/*
+ * Compex device IDs.
+ */
+#define CP_DEVICEID_RL100	0x2011
+
+/*
+ * Texas Instruments PHY identifiers
+ */
+#define TI_PHY_VENDORID		0x4000
+#define TI_PHY_10BT		0x501F
+#define TI_PHY_100VGPMI		0x502F
+
+/*
+ * These ID values are for the NS DP83840A 10/100 PHY
+ */
+#define NS_PHY_VENDORID		0x2000
+#define NS_PHY_83840A		0x5C0F
+
+/*
+ * Level 1 10/100 PHY
+ */
+#define LEVEL1_PHY_VENDORID	0x7810
+#define LEVEL1_PHY_LXT970	0x000F
+
+/*
+ * Intel 82555 10/100 PHY
+ */
+#define INTEL_PHY_VENDORID	0x0A28
+#define INTEL_PHY_82555		0x015F
+
+/*
+ * SEEQ 80220 10/100 PHY
+ */
+#define SEEQ_PHY_VENDORID	0x0016
+#define SEEQ_PHY_80220		0xF83F
+
+
+/*
+ * PCI low memory base and low I/O base register, and
+ * other PCI registers. Note: some are only available on
+ * the 3c905B, in particular those that related to power management.
+ */
+
+#define WB_PCI_VENDOR_ID	0x00
+#define WB_PCI_DEVICE_ID	0x02
+#define WB_PCI_COMMAND		0x04
+#define WB_PCI_STATUS		0x06
+#define WB_PCI_CLASSCODE	0x09
+#define WB_PCI_LATENCY_TIMER	0x0D
+#define WB_PCI_HEADER_TYPE	0x0E
+#define WB_PCI_LOIO		0x10
+#define WB_PCI_LOMEM		0x14
+#define WB_PCI_BIOSROM		0x30
+#define WB_PCI_INTLINE		0x3C
+#define WB_PCI_INTPIN		0x3D
+#define WB_PCI_MINGNT		0x3E
+#define WB_PCI_MINLAT		0x0F
+#define WB_PCI_RESETOPT		0x48
+#define WB_PCI_EEPROM_DATA	0x4C
+
+/* power management registers */
+#define WB_PCI_CAPID		0xDC /* 8 bits */
+#define WB_PCI_NEXTPTR		0xDD /* 8 bits */
+#define WB_PCI_PWRMGMTCAP	0xDE /* 16 bits */
+#define WB_PCI_PWRMGMTCTRL	0xE0 /* 16 bits */
+
+#define WB_PSTATE_MASK		0x0003
+#define WB_PSTATE_D0		0x0000
+#define WB_PSTATE_D1		0x0002
+#define WB_PSTATE_D2		0x0002
+#define WB_PSTATE_D3		0x0003
+#define WB_PME_EN		0x0010
+#define WB_PME_STATUS		0x8000
+
+#define PHY_UNKNOWN		6
+
+#define WB_PHYADDR_MIN		0x00
+#define WB_PHYADDR_MAX		0x1F
+
+#define PHY_BMCR		0x00
+#define PHY_BMSR		0x01
+#define PHY_VENID		0x02
+#define PHY_DEVID		0x03
+#define PHY_ANAR		0x04
+#define PHY_LPAR		0x05
+#define PHY_ANEXP		0x06
+
+#define PHY_ANAR_NEXTPAGE	0x8000
+#define PHY_ANAR_RSVD0		0x4000
+#define PHY_ANAR_TLRFLT		0x2000
+#define PHY_ANAR_RSVD1		0x1000
+#define PHY_ANAR_RSVD2		0x0800
+#define PHY_ANAR_RSVD3		0x0400
+#define PHY_ANAR_100BT4		0x0200
+#define PHY_ANAR_100BTXFULL	0x0100
+#define PHY_ANAR_100BTXHALF	0x0080
+#define PHY_ANAR_10BTFULL	0x0040
+#define PHY_ANAR_10BTHALF	0x0020
+#define PHY_ANAR_PROTO4		0x0010
+#define PHY_ANAR_PROTO3		0x0008
+#define PHY_ANAR_PROTO2		0x0004
+#define PHY_ANAR_PROTO1		0x0002
+#define PHY_ANAR_PROTO0		0x0001
+
+/*
+ * These are the register definitions for the PHY (physical layer
+ * interface chip).
+ */
+/*
+ * PHY BMCR Basic Mode Control Register
+ */
+#define PHY_BMCR_RESET			0x8000
+#define PHY_BMCR_LOOPBK			0x4000
+#define PHY_BMCR_SPEEDSEL		0x2000
+#define PHY_BMCR_AUTONEGENBL		0x1000
+#define PHY_BMCR_RSVD0			0x0800	/* write as zero */
+#define PHY_BMCR_ISOLATE		0x0400
+#define PHY_BMCR_AUTONEGRSTR		0x0200
+#define PHY_BMCR_DUPLEX			0x0100
+#define PHY_BMCR_COLLTEST		0x0080
+#define PHY_BMCR_RSVD1			0x0040	/* write as zero, don't care */
+#define PHY_BMCR_RSVD2			0x0020	/* write as zero, don't care */
+#define PHY_BMCR_RSVD3			0x0010	/* write as zero, don't care */
+#define PHY_BMCR_RSVD4			0x0008	/* write as zero, don't care */
+#define PHY_BMCR_RSVD5			0x0004	/* write as zero, don't care */
+#define PHY_BMCR_RSVD6			0x0002	/* write as zero, don't care */
+#define PHY_BMCR_RSVD7			0x0001	/* write as zero, don't care */
+/*
+ * RESET: 1 == software reset, 0 == normal operation
+ * Resets status and control registers to default values.
+ * Relatches all hardware config values.
+ *
+ * LOOPBK: 1 == loopback operation enabled, 0 == normal operation
+ *
+ * SPEEDSEL: 1 == 100Mb/s, 0 == 10Mb/s
+ * Link speed is selected byt his bit or if auto-negotiation if bit
+ * 12 (AUTONEGENBL) is set (in which case the value of this register
+ * is ignored).
+ *
+ * AUTONEGENBL: 1 == Autonegotiation enabled, 0 == Autonegotiation disabled
+ * Bits 8 and 13 are ignored when autoneg is set, otherwise bits 8 and 13
+ * determine speed and mode. Should be cleared and then set if PHY configured
+ * for no autoneg on startup.
+ *
+ * ISOLATE: 1 == isolate PHY from MII, 0 == normal operation
+ *
+ * AUTONEGRSTR: 1 == restart autonegotiation, 0 = normal operation
+ *
+ * DUPLEX: 1 == full duplex mode, 0 == half duplex mode
+ *
+ * COLLTEST: 1 == collision test enabled, 0 == normal operation
+ */
+
+/* 
+ * PHY, BMSR Basic Mode Status Register 
+ */   
+#define PHY_BMSR_100BT4			0x8000
+#define PHY_BMSR_100BTXFULL		0x4000
+#define PHY_BMSR_100BTXHALF		0x2000
+#define PHY_BMSR_10BTFULL		0x1000
+#define PHY_BMSR_10BTHALF		0x0800
+#define PHY_BMSR_RSVD1			0x0400	/* write as zero, don't care */
+#define PHY_BMSR_RSVD2			0x0200	/* write as zero, don't care */
+#define PHY_BMSR_RSVD3			0x0100	/* write as zero, don't care */
+#define PHY_BMSR_RSVD4			0x0080	/* write as zero, don't care */
+#define PHY_BMSR_MFPRESUP		0x0040
+#define PHY_BMSR_AUTONEGCOMP		0x0020
+#define PHY_BMSR_REMFAULT		0x0010
+#define PHY_BMSR_CANAUTONEG		0x0008
+#define PHY_BMSR_LINKSTAT		0x0004
+#define PHY_BMSR_JABBER			0x0002
+#define PHY_BMSR_EXTENDED		0x0001