staging: ath6kl: buffer overflow in SEND_FRAME ioctl
[linux-2.6/libata-dev.git] / drivers / net / tulip / tulip.h
blobed66a16711dceadc550db0316bd52c8bef15688d
1 /*
2 drivers/net/tulip/tulip.h
4 Copyright 2000,2001 The Linux Kernel Team
5 Written/copyright 1994-2001 by Donald Becker.
7 This software may be used and distributed according to the terms
8 of the GNU General Public License, incorporated herein by reference.
10 Please refer to Documentation/DocBook/tulip-user.{pdf,ps,html}
11 for more information on this driver.
13 Please submit bugs to http://bugzilla.kernel.org/ .
16 #ifndef __NET_TULIP_H__
17 #define __NET_TULIP_H__
19 #include <linux/kernel.h>
20 #include <linux/types.h>
21 #include <linux/spinlock.h>
22 #include <linux/netdevice.h>
23 #include <linux/ethtool.h>
24 #include <linux/timer.h>
25 #include <linux/delay.h>
26 #include <linux/pci.h>
27 #include <asm/io.h>
28 #include <asm/irq.h>
29 #include <asm/unaligned.h>
33 /* undefine, or define to various debugging levels (>4 == obscene levels) */
34 #define TULIP_DEBUG 1
36 #ifdef CONFIG_TULIP_MMIO
37 #define TULIP_BAR 1 /* CBMA */
38 #else
39 #define TULIP_BAR 0 /* CBIO */
40 #endif
44 struct tulip_chip_table {
45 char *chip_name;
46 int io_size;
47 int valid_intrs; /* CSR7 interrupt enable settings */
48 int flags;
49 void (*media_timer) (unsigned long);
50 work_func_t media_task;
54 enum tbl_flag {
55 HAS_MII = 0x00001,
56 HAS_MEDIA_TABLE = 0x00002,
57 CSR12_IN_SROM = 0x00004,
58 ALWAYS_CHECK_MII = 0x00008,
59 HAS_ACPI = 0x00010,
60 MC_HASH_ONLY = 0x00020, /* Hash-only multicast filter. */
61 HAS_PNICNWAY = 0x00080,
62 HAS_NWAY = 0x00040, /* Uses internal NWay xcvr. */
63 HAS_INTR_MITIGATION = 0x00100,
64 IS_ASIX = 0x00200,
65 HAS_8023X = 0x00400,
66 COMET_MAC_ADDR = 0x00800,
67 HAS_PCI_MWI = 0x01000,
68 HAS_PHY_IRQ = 0x02000,
69 HAS_SWAPPED_SEEPROM = 0x04000,
70 NEEDS_FAKE_MEDIA_TABLE = 0x08000,
71 COMET_PM = 0x10000,
75 /* chip types. careful! order is VERY IMPORTANT here, as these
76 * are used throughout the driver as indices into arrays */
77 /* Note 21142 == 21143. */
78 enum chips {
79 DC21040 = 0,
80 DC21041 = 1,
81 DC21140 = 2,
82 DC21142 = 3, DC21143 = 3,
83 LC82C168,
84 MX98713,
85 MX98715,
86 MX98725,
87 AX88140,
88 PNIC2,
89 COMET,
90 COMPEX9881,
91 I21145,
92 DM910X,
93 CONEXANT,
97 enum MediaIs {
98 MediaIsFD = 1,
99 MediaAlwaysFD = 2,
100 MediaIsMII = 4,
101 MediaIsFx = 8,
102 MediaIs100 = 16
106 /* Offsets to the Command and Status Registers, "CSRs". All accesses
107 must be longword instructions and quadword aligned. */
108 enum tulip_offsets {
109 CSR0 = 0,
110 CSR1 = 0x08,
111 CSR2 = 0x10,
112 CSR3 = 0x18,
113 CSR4 = 0x20,
114 CSR5 = 0x28,
115 CSR6 = 0x30,
116 CSR7 = 0x38,
117 CSR8 = 0x40,
118 CSR9 = 0x48,
119 CSR10 = 0x50,
120 CSR11 = 0x58,
121 CSR12 = 0x60,
122 CSR13 = 0x68,
123 CSR14 = 0x70,
124 CSR15 = 0x78,
125 CSR18 = 0x88,
126 CSR19 = 0x8c,
127 CSR20 = 0x90,
128 CSR27 = 0xAC,
129 CSR28 = 0xB0,
132 /* register offset and bits for CFDD PCI config reg */
133 enum pci_cfg_driver_reg {
134 CFDD = 0x40,
135 CFDD_Sleep = (1 << 31),
136 CFDD_Snooze = (1 << 30),
139 #define RxPollInt (RxIntr|RxNoBuf|RxDied|RxJabber)
141 /* The bits in the CSR5 status registers, mostly interrupt sources. */
142 enum status_bits {
143 TimerInt = 0x800,
144 SystemError = 0x2000,
145 TPLnkFail = 0x1000,
146 TPLnkPass = 0x10,
147 NormalIntr = 0x10000,
148 AbnormalIntr = 0x8000,
149 RxJabber = 0x200,
150 RxDied = 0x100,
151 RxNoBuf = 0x80,
152 RxIntr = 0x40,
153 TxFIFOUnderflow = 0x20,
154 RxErrIntr = 0x10,
155 TxJabber = 0x08,
156 TxNoBuf = 0x04,
157 TxDied = 0x02,
158 TxIntr = 0x01,
161 /* bit mask for CSR5 TX/RX process state */
162 #define CSR5_TS 0x00700000
163 #define CSR5_RS 0x000e0000
165 enum tulip_mode_bits {
166 TxThreshold = (1 << 22),
167 FullDuplex = (1 << 9),
168 TxOn = 0x2000,
169 AcceptBroadcast = 0x0100,
170 AcceptAllMulticast = 0x0080,
171 AcceptAllPhys = 0x0040,
172 AcceptRunt = 0x0008,
173 RxOn = 0x0002,
174 RxTx = (TxOn | RxOn),
178 enum tulip_busconfig_bits {
179 MWI = (1 << 24),
180 MRL = (1 << 23),
181 MRM = (1 << 21),
182 CALShift = 14,
183 BurstLenShift = 8,
187 /* The Tulip Rx and Tx buffer descriptors. */
188 struct tulip_rx_desc {
189 __le32 status;
190 __le32 length;
191 __le32 buffer1;
192 __le32 buffer2;
196 struct tulip_tx_desc {
197 __le32 status;
198 __le32 length;
199 __le32 buffer1;
200 __le32 buffer2; /* We use only buffer 1. */
204 enum desc_status_bits {
205 DescOwned = 0x80000000,
206 DescWholePkt = 0x60000000,
207 DescEndPkt = 0x40000000,
208 DescStartPkt = 0x20000000,
209 DescEndRing = 0x02000000,
210 DescUseLink = 0x01000000,
213 * Error summary flag is logical or of 'CRC Error', 'Collision Seen',
214 * 'Frame Too Long', 'Runt' and 'Descriptor Error' flags generated
215 * within tulip chip.
217 RxDescErrorSummary = 0x8000,
218 RxDescCRCError = 0x0002,
219 RxDescCollisionSeen = 0x0040,
222 * 'Frame Too Long' flag is set if packet length including CRC exceeds
223 * 1518. However, a full sized VLAN tagged frame is 1522 bytes
224 * including CRC.
226 * The tulip chip does not block oversized frames, and if this flag is
227 * set on a receive descriptor it does not indicate the frame has been
228 * truncated. The receive descriptor also includes the actual length.
229 * Therefore we can safety ignore this flag and check the length
230 * ourselves.
232 RxDescFrameTooLong = 0x0080,
233 RxDescRunt = 0x0800,
234 RxDescDescErr = 0x4000,
235 RxWholePkt = 0x00000300,
237 * Top three bits of 14 bit frame length (status bits 27-29) should
238 * never be set as that would make frame over 2047 bytes. The Receive
239 * Watchdog flag (bit 4) may indicate the length is over 2048 and the
240 * length field is invalid.
242 RxLengthOver2047 = 0x38000010
246 enum t21143_csr6_bits {
247 csr6_sc = (1<<31),
248 csr6_ra = (1<<30),
249 csr6_ign_dest_msb = (1<<26),
250 csr6_mbo = (1<<25),
251 csr6_scr = (1<<24), /* scramble mode flag: can't be set */
252 csr6_pcs = (1<<23), /* Enables PCS functions (symbol mode requires csr6_ps be set) default is set */
253 csr6_ttm = (1<<22), /* Transmit Threshold Mode, set for 10baseT, 0 for 100BaseTX */
254 csr6_sf = (1<<21), /* Store and forward. If set ignores TR bits */
255 csr6_hbd = (1<<19), /* Heart beat disable. Disables SQE function in 10baseT */
256 csr6_ps = (1<<18), /* Port Select. 0 (defualt) = 10baseT, 1 = 100baseTX: can't be set */
257 csr6_ca = (1<<17), /* Collision Offset Enable. If set uses special algorithm in low collision situations */
258 csr6_trh = (1<<15), /* Transmit Threshold high bit */
259 csr6_trl = (1<<14), /* Transmit Threshold low bit */
261 /***************************************************************
262 * This table shows transmit threshold values based on media *
263 * and these two registers (from PNIC1 & 2 docs) Note: this is *
264 * all meaningless if sf is set. *
265 ***************************************************************/
267 /***********************************
268 * (trh,trl) * 100BaseTX * 10BaseT *
269 ***********************************
270 * (0,0) * 128 * 72 *
271 * (0,1) * 256 * 96 *
272 * (1,0) * 512 * 128 *
273 * (1,1) * 1024 * 160 *
274 ***********************************/
276 csr6_fc = (1<<12), /* Forces a collision in next transmission (for testing in loopback mode) */
277 csr6_om_int_loop = (1<<10), /* internal (FIFO) loopback flag */
278 csr6_om_ext_loop = (1<<11), /* external (PMD) loopback flag */
279 /* set both and you get (PHY) loopback */
280 csr6_fd = (1<<9), /* Full duplex mode, disables hearbeat, no loopback */
281 csr6_pm = (1<<7), /* Pass All Multicast */
282 csr6_pr = (1<<6), /* Promiscuous mode */
283 csr6_sb = (1<<5), /* Start(1)/Stop(0) backoff counter */
284 csr6_if = (1<<4), /* Inverse Filtering, rejects only addresses in address table: can't be set */
285 csr6_pb = (1<<3), /* Pass Bad Frames, (1) causes even bad frames to be passed on */
286 csr6_ho = (1<<2), /* Hash-only filtering mode: can't be set */
287 csr6_hp = (1<<0), /* Hash/Perfect Receive Filtering Mode: can't be set */
289 csr6_mask_capture = (csr6_sc | csr6_ca),
290 csr6_mask_defstate = (csr6_mask_capture | csr6_mbo),
291 csr6_mask_hdcap = (csr6_mask_defstate | csr6_hbd | csr6_ps),
292 csr6_mask_hdcaptt = (csr6_mask_hdcap | csr6_trh | csr6_trl),
293 csr6_mask_fullcap = (csr6_mask_hdcaptt | csr6_fd),
294 csr6_mask_fullpromisc = (csr6_pr | csr6_pm),
295 csr6_mask_filters = (csr6_hp | csr6_ho | csr6_if),
296 csr6_mask_100bt = (csr6_scr | csr6_pcs | csr6_hbd),
299 enum tulip_comet_csr13_bits {
300 /* The LINKOFFE and LINKONE work in conjunction with LSCE, i.e. they
301 * determine which link status transition wakes up if LSCE is
302 * enabled */
303 comet_csr13_linkoffe = (1 << 17),
304 comet_csr13_linkone = (1 << 16),
305 comet_csr13_wfre = (1 << 10),
306 comet_csr13_mpre = (1 << 9),
307 comet_csr13_lsce = (1 << 8),
308 comet_csr13_wfr = (1 << 2),
309 comet_csr13_mpr = (1 << 1),
310 comet_csr13_lsc = (1 << 0),
313 enum tulip_comet_csr18_bits {
314 comet_csr18_pmes_sticky = (1 << 24),
315 comet_csr18_pm_mode = (1 << 19),
316 comet_csr18_apm_mode = (1 << 18),
317 comet_csr18_d3a = (1 << 7)
320 enum tulip_comet_csr20_bits {
321 comet_csr20_pmes = (1 << 15),
324 /* Keep the ring sizes a power of two for efficiency.
325 Making the Tx ring too large decreases the effectiveness of channel
326 bonding and packet priority.
327 There are no ill effects from too-large receive rings. */
329 #define TX_RING_SIZE 32
330 #define RX_RING_SIZE 128
331 #define MEDIA_MASK 31
333 /* The receiver on the DC21143 rev 65 can fail to close the last
334 * receive descriptor in certain circumstances (see errata) when
335 * using MWI. This can only occur if the receive buffer ends on
336 * a cache line boundary, so the "+ 4" below ensures it doesn't.
338 #define PKT_BUF_SZ (1536 + 4) /* Size of each temporary Rx buffer. */
340 #define TULIP_MIN_CACHE_LINE 8 /* in units of 32-bit words */
342 #if defined(__sparc__) || defined(__hppa__)
343 /* The UltraSparc PCI controllers will disconnect at every 64-byte
344 * crossing anyways so it makes no sense to tell Tulip to burst
345 * any more than that.
347 #define TULIP_MAX_CACHE_LINE 16 /* in units of 32-bit words */
348 #else
349 #define TULIP_MAX_CACHE_LINE 32 /* in units of 32-bit words */
350 #endif
353 /* Ring-wrap flag in length field, use for last ring entry.
354 0x01000000 means chain on buffer2 address,
355 0x02000000 means use the ring start address in CSR2/3.
356 Note: Some work-alike chips do not function correctly in chained mode.
357 The ASIX chip works only in chained mode.
358 Thus we indicates ring mode, but always write the 'next' field for
359 chained mode as well.
361 #define DESC_RING_WRAP 0x02000000
364 #define EEPROM_SIZE 512 /* 2 << EEPROM_ADDRLEN */
367 #define RUN_AT(x) (jiffies + (x))
369 #define get_u16(ptr) get_unaligned_le16((ptr))
371 struct medialeaf {
372 u8 type;
373 u8 media;
374 unsigned char *leafdata;
378 struct mediatable {
379 u16 defaultmedia;
380 u8 leafcount;
381 u8 csr12dir; /* General purpose pin directions. */
382 unsigned has_mii:1;
383 unsigned has_nonmii:1;
384 unsigned has_reset:6;
385 u32 csr15dir;
386 u32 csr15val; /* 21143 NWay setting. */
387 struct medialeaf mleaf[0];
391 struct mediainfo {
392 struct mediainfo *next;
393 int info_type;
394 int index;
395 unsigned char *info;
398 struct ring_info {
399 struct sk_buff *skb;
400 dma_addr_t mapping;
404 struct tulip_private {
405 const char *product_name;
406 struct net_device *next_module;
407 struct tulip_rx_desc *rx_ring;
408 struct tulip_tx_desc *tx_ring;
409 dma_addr_t rx_ring_dma;
410 dma_addr_t tx_ring_dma;
411 /* The saved address of a sent-in-place packet/buffer, for skfree(). */
412 struct ring_info tx_buffers[TX_RING_SIZE];
413 /* The addresses of receive-in-place skbuffs. */
414 struct ring_info rx_buffers[RX_RING_SIZE];
415 u16 setup_frame[96]; /* Pseudo-Tx frame to init address table. */
416 int chip_id;
417 int revision;
418 int flags;
419 struct napi_struct napi;
420 struct timer_list timer; /* Media selection timer. */
421 struct timer_list oom_timer; /* Out of memory timer. */
422 u32 mc_filter[2];
423 spinlock_t lock;
424 spinlock_t mii_lock;
425 unsigned int cur_rx, cur_tx; /* The next free ring entry */
426 unsigned int dirty_rx, dirty_tx; /* The ring entries to be free()ed. */
428 #ifdef CONFIG_TULIP_NAPI_HW_MITIGATION
429 int mit_on;
430 #endif
431 unsigned int full_duplex:1; /* Full-duplex operation requested. */
432 unsigned int full_duplex_lock:1;
433 unsigned int fake_addr:1; /* Multiport board faked address. */
434 unsigned int default_port:4; /* Last dev->if_port value. */
435 unsigned int media2:4; /* Secondary monitored media port. */
436 unsigned int medialock:1; /* Don't sense media type. */
437 unsigned int mediasense:1; /* Media sensing in progress. */
438 unsigned int nway:1, nwayset:1; /* 21143 internal NWay. */
439 unsigned int timeout_recovery:1;
440 unsigned int csr0; /* CSR0 setting. */
441 unsigned int csr6; /* Current CSR6 control settings. */
442 unsigned char eeprom[EEPROM_SIZE]; /* Serial EEPROM contents. */
443 void (*link_change) (struct net_device * dev, int csr5);
444 struct ethtool_wolinfo wolinfo; /* WOL settings */
445 u16 sym_advertise, mii_advertise; /* NWay capabilities advertised. */
446 u16 lpar; /* 21143 Link partner ability. */
447 u16 advertising[4];
448 signed char phys[4], mii_cnt; /* MII device addresses. */
449 struct mediatable *mtable;
450 int cur_index; /* Current media index. */
451 int saved_if_port;
452 struct pci_dev *pdev;
453 int ttimer;
454 int susp_rx;
455 unsigned long nir;
456 void __iomem *base_addr;
457 int csr12_shadow;
458 int pad0; /* Used for 8-byte alignment */
459 struct work_struct media_work;
460 struct net_device *dev;
464 struct eeprom_fixup {
465 char *name;
466 unsigned char addr0;
467 unsigned char addr1;
468 unsigned char addr2;
469 u16 newtable[32]; /* Max length below. */
473 /* 21142.c */
474 extern u16 t21142_csr14[];
475 void t21142_media_task(struct work_struct *work);
476 void t21142_start_nway(struct net_device *dev);
477 void t21142_lnk_change(struct net_device *dev, int csr5);
480 /* PNIC2.c */
481 void pnic2_lnk_change(struct net_device *dev, int csr5);
482 void pnic2_timer(unsigned long data);
483 void pnic2_start_nway(struct net_device *dev);
484 void pnic2_lnk_change(struct net_device *dev, int csr5);
486 /* eeprom.c */
487 void tulip_parse_eeprom(struct net_device *dev);
488 int tulip_read_eeprom(struct net_device *dev, int location, int addr_len);
490 /* interrupt.c */
491 extern unsigned int tulip_max_interrupt_work;
492 extern int tulip_rx_copybreak;
493 irqreturn_t tulip_interrupt(int irq, void *dev_instance);
494 int tulip_refill_rx(struct net_device *dev);
495 #ifdef CONFIG_TULIP_NAPI
496 int tulip_poll(struct napi_struct *napi, int budget);
497 #endif
500 /* media.c */
501 int tulip_mdio_read(struct net_device *dev, int phy_id, int location);
502 void tulip_mdio_write(struct net_device *dev, int phy_id, int location, int value);
503 void tulip_select_media(struct net_device *dev, int startup);
504 int tulip_check_duplex(struct net_device *dev);
505 void tulip_find_mii (struct net_device *dev, int board_idx);
507 /* pnic.c */
508 void pnic_do_nway(struct net_device *dev);
509 void pnic_lnk_change(struct net_device *dev, int csr5);
510 void pnic_timer(unsigned long data);
512 /* timer.c */
513 void tulip_media_task(struct work_struct *work);
514 void mxic_timer(unsigned long data);
515 void comet_timer(unsigned long data);
517 /* tulip_core.c */
518 extern int tulip_debug;
519 extern const char * const medianame[];
520 extern const char tulip_media_cap[];
521 extern struct tulip_chip_table tulip_tbl[];
522 void oom_timer(unsigned long data);
523 extern u8 t21040_csr13[];
525 static inline void tulip_start_rxtx(struct tulip_private *tp)
527 void __iomem *ioaddr = tp->base_addr;
528 iowrite32(tp->csr6 | RxTx, ioaddr + CSR6);
529 barrier();
530 (void) ioread32(ioaddr + CSR6); /* mmio sync */
533 static inline void tulip_stop_rxtx(struct tulip_private *tp)
535 void __iomem *ioaddr = tp->base_addr;
536 u32 csr6 = ioread32(ioaddr + CSR6);
538 if (csr6 & RxTx) {
539 unsigned i=1300/10;
540 iowrite32(csr6 & ~RxTx, ioaddr + CSR6);
541 barrier();
542 /* wait until in-flight frame completes.
543 * Max time @ 10BT: 1500*8b/10Mbps == 1200us (+ 100us margin)
544 * Typically expect this loop to end in < 50 us on 100BT.
546 while (--i && (ioread32(ioaddr + CSR5) & (CSR5_TS|CSR5_RS)))
547 udelay(10);
549 if (!i)
550 printk(KERN_DEBUG "%s: tulip_stop_rxtx() failed"
551 " (CSR5 0x%x CSR6 0x%x)\n",
552 pci_name(tp->pdev),
553 ioread32(ioaddr + CSR5),
554 ioread32(ioaddr + CSR6));
558 static inline void tulip_restart_rxtx(struct tulip_private *tp)
560 tulip_stop_rxtx(tp);
561 udelay(5);
562 tulip_start_rxtx(tp);
565 static inline void tulip_tx_timeout_complete(struct tulip_private *tp, void __iomem *ioaddr)
567 /* Stop and restart the chip's Tx processes. */
568 tulip_restart_rxtx(tp);
569 /* Trigger an immediate transmit demand. */
570 iowrite32(0, ioaddr + CSR1);
572 tp->dev->stats.tx_errors++;
575 #endif /* __NET_TULIP_H__ */