xscale: Move the Intel XScale IXP drivers

Move the Intel XScale IXP drivers into drivers/net/ethernet/xscale/
and make the necessary Kconfig and Makefile changes.

CC: Krzysztof Halasa <khc@pm.waw.pl>
CC: Lennert Buytenhek <kernel@wantstofly.org>
Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>

21 files changed, 4068 insertions, 0 deletions

diff --git a/drivers/net/ethernet/Kconfig b/drivers/net/ethernet/Kconfig
index efc36651a2b9..45d3eff86baa 100644
--- a/drivers/net/ethernet/Kconfig
+++ b/drivers/net/ethernet/Kconfig
@@ -23,6 +23,7 @@ source "drivers/net/ethernet/neterion/Kconfig"
 source "drivers/net/ethernet/ibm/Kconfig"
 source "drivers/net/ethernet/intel/Kconfig"
 source "drivers/net/ethernet/i825xx/Kconfig"
+source "drivers/net/ethernet/xscale/Kconfig"
 source "drivers/net/ethernet/mellanox/Kconfig"
 source "drivers/net/ethernet/myricom/Kconfig"
 source "drivers/net/ethernet/natsemi/Kconfig"
diff --git a/drivers/net/ethernet/Makefile b/drivers/net/ethernet/Makefile
index 668ca92b4863..09536de3a366 100644
--- a/drivers/net/ethernet/Makefile
+++ b/drivers/net/ethernet/Makefile
@@ -15,6 +15,7 @@ obj-$(CONFIG_NET_VENDOR_EXAR) += neterion/
 obj-$(CONFIG_NET_VENDOR_IBM) += ibm/
 obj-$(CONFIG_NET_VENDOR_INTEL) += intel/
 obj-$(CONFIG_NET_VENDOR_I825XX) += i825xx/
+obj-$(CONFIG_NET_VENDOR_XSCALE) += xscale/
 obj-$(CONFIG_NET_VENDOR_MELLANOX) += mellanox/
 obj-$(CONFIG_NET_VENDOR_MYRI) += myricom/
 obj-$(CONFIG_NET_VENDOR_NATSEMI) += natsemi/
diff --git a/drivers/net/ethernet/xscale/Kconfig b/drivers/net/ethernet/xscale/Kconfig
new file mode 100644
index 000000000000..6bbcc54d6ce7
--- /dev/null
+++ b/drivers/net/ethernet/xscale/Kconfig
@@ -0,0 +1,31 @@
+#
+# Intel XScale IXP device configuration
+#
+
+config NET_VENDOR_XSCALE
+	bool "Intel XScale IXP devices"
+	depends on NET_VENDOR_INTEL && ((ARM && ARCH_IXP4XX && \
+		   IXP4XX_NPE && IXP4XX_QMGR) || ARCH_ENP2611)
+	---help---
+	  If you have a network (Ethernet) card belonging to this class, say Y
+	  and read the Ethernet-HOWTO, available from
+	  <http://www.tldp.org/docs.html#howto>.
+
+	  Note that the answer to this question does not directly affect the
+	  kernel: saying N will just cause the configurator to skip all
+	  the questions about XSacle IXP devices. If you say Y, you will be
+	  asked for your specific card in the following questions.
+
+if NET_VENDOR_XSCALE
+
+config IXP4XX_ETH
+	tristate "Intel IXP4xx Ethernet support"
+	depends on ARM && ARCH_IXP4XX && IXP4XX_NPE && IXP4XX_QMGR
+	select PHYLIB
+	---help---
+	  Say Y here if you want to use built-in Ethernet ports
+	  on IXP4xx processor.
+
+source "drivers/net/ethernet/xscale/ixp2000/Kconfig"
+
+endif # NET_VENDOR_XSCALE
diff --git a/drivers/net/ethernet/xscale/Makefile b/drivers/net/ethernet/xscale/Makefile
new file mode 100644
index 000000000000..b195b9d7fe81
--- /dev/null
+++ b/drivers/net/ethernet/xscale/Makefile
@@ -0,0 +1,6 @@
+#
+# Makefile for the Intel XScale IXP device drivers.
+#
+
+obj-$(CONFIG_ENP2611_MSF_NET) += ixp2000/
+obj-$(CONFIG_IXP4XX_ETH) += ixp4xx_eth.o
diff --git a/drivers/net/ethernet/xscale/ixp2000/Kconfig b/drivers/net/ethernet/xscale/ixp2000/Kconfig
new file mode 100644
index 000000000000..58dbc5b876bc
--- /dev/null
+++ b/drivers/net/ethernet/xscale/ixp2000/Kconfig
@@ -0,0 +1,6 @@
+config ENP2611_MSF_NET
+	tristate "Radisys ENP2611 MSF network interface support"
+	depends on ARCH_ENP2611
+	---help---
+	  This is a driver for the MSF network interface unit in
+	  the IXP2400 on the Radisys ENP2611 platform.
diff --git a/drivers/net/ethernet/xscale/ixp2000/Makefile b/drivers/net/ethernet/xscale/ixp2000/Makefile
new file mode 100644
index 000000000000..fd38351ceaa7
--- /dev/null
+++ b/drivers/net/ethernet/xscale/ixp2000/Makefile
@@ -0,0 +1,3 @@
+obj-$(CONFIG_ENP2611_MSF_NET) += enp2611_mod.o
+
+enp2611_mod-objs := caleb.o enp2611.o ixp2400-msf.o ixpdev.o pm3386.o
diff --git a/drivers/net/ethernet/xscale/ixp2000/caleb.c b/drivers/net/ethernet/xscale/ixp2000/caleb.c
new file mode 100644
index 000000000000..7dea5b95012c
--- /dev/null
+++ b/drivers/net/ethernet/xscale/ixp2000/caleb.c
@@ -0,0 +1,136 @@
+/*
+ * Helper functions for the SPI-3 bridge FPGA on the Radisys ENP2611
+ * Copyright (C) 2004, 2005 Lennert Buytenhek <buytenh@wantstofly.org>
+ * Dedicated to Marija Kulikova.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ */
+
+#include <linux/module.h>
+#include <linux/delay.h>
+#include <asm/io.h>
+#include "caleb.h"
+
+#define CALEB_IDLO		0x00
+#define CALEB_IDHI		0x01
+#define CALEB_RID		0x02
+#define CALEB_RESET		0x03
+#define CALEB_INTREN0		0x04
+#define CALEB_INTREN1		0x05
+#define CALEB_INTRSTAT0		0x06
+#define CALEB_INTRSTAT1		0x07
+#define CALEB_PORTEN		0x08
+#define CALEB_BURST		0x09
+#define CALEB_PORTPAUS		0x0A
+#define CALEB_PORTPAUSD		0x0B
+#define CALEB_PHY0RX		0x10
+#define CALEB_PHY1RX		0x11
+#define CALEB_PHY0TX		0x12
+#define CALEB_PHY1TX		0x13
+#define CALEB_IXPRX_HI_CNTR	0x15
+#define CALEB_PHY0RX_HI_CNTR	0x16
+#define CALEB_PHY1RX_HI_CNTR	0x17
+#define CALEB_IXPRX_CNTR	0x18
+#define CALEB_PHY0RX_CNTR	0x19
+#define CALEB_PHY1RX_CNTR	0x1A
+#define CALEB_IXPTX_CNTR	0x1B
+#define CALEB_PHY0TX_CNTR	0x1C
+#define CALEB_PHY1TX_CNTR	0x1D
+#define CALEB_DEBUG0		0x1E
+#define CALEB_DEBUG1		0x1F
+
+
+static u8 caleb_reg_read(int reg)
+{
+	u8 value;
+
+	value = *((volatile u8 *)(ENP2611_CALEB_VIRT_BASE + reg));
+
+//	printk(KERN_INFO "caleb_reg_read(%d) = %.2x\n", reg, value);
+
+	return value;
+}
+
+static void caleb_reg_write(int reg, u8 value)
+{
+	u8 dummy;
+
+//	printk(KERN_INFO "caleb_reg_write(%d, %.2x)\n", reg, value);
+
+	*((volatile u8 *)(ENP2611_CALEB_VIRT_BASE + reg)) = value;
+
+	dummy = *((volatile u8 *)ENP2611_CALEB_VIRT_BASE);
+	__asm__ __volatile__("mov %0, %0" : "+r" (dummy));
+}
+
+
+void caleb_reset(void)
+{
+	/*
+	 * Perform a chip reset.
+	 */
+	caleb_reg_write(CALEB_RESET, 0x02);
+	udelay(1);
+
+	/*
+	 * Enable all interrupt sources.  This is needed to get
+	 * meaningful results out of the status bits (register 6
+	 * and 7.)
+	 */
+	caleb_reg_write(CALEB_INTREN0, 0xff);
+	caleb_reg_write(CALEB_INTREN1, 0x07);
+
+	/*
+	 * Set RX and TX FIFO thresholds to 1.5kb.
+	 */
+	caleb_reg_write(CALEB_PHY0RX, 0x11);
+	caleb_reg_write(CALEB_PHY1RX, 0x11);
+	caleb_reg_write(CALEB_PHY0TX, 0x11);
+	caleb_reg_write(CALEB_PHY1TX, 0x11);
+
+	/*
+	 * Program SPI-3 burst size.
+	 */
+	caleb_reg_write(CALEB_BURST, 0);	// 64-byte RBUF mpackets
+//	caleb_reg_write(CALEB_BURST, 1);	// 128-byte RBUF mpackets
+//	caleb_reg_write(CALEB_BURST, 2);	// 256-byte RBUF mpackets
+}
+
+void caleb_enable_rx(int port)
+{
+	u8 temp;
+
+	temp = caleb_reg_read(CALEB_PORTEN);
+	temp |= 1 << port;
+	caleb_reg_write(CALEB_PORTEN, temp);
+}
+
+void caleb_disable_rx(int port)
+{
+	u8 temp;
+
+	temp = caleb_reg_read(CALEB_PORTEN);
+	temp &= ~(1 << port);
+	caleb_reg_write(CALEB_PORTEN, temp);
+}
+
+void caleb_enable_tx(int port)
+{
+	u8 temp;
+
+	temp = caleb_reg_read(CALEB_PORTEN);
+	temp |= 1 << (port + 4);
+	caleb_reg_write(CALEB_PORTEN, temp);
+}
+
+void caleb_disable_tx(int port)
+{
+	u8 temp;
+
+	temp = caleb_reg_read(CALEB_PORTEN);
+	temp &= ~(1 << (port + 4));
+	caleb_reg_write(CALEB_PORTEN, temp);
+}
diff --git a/drivers/net/ethernet/xscale/ixp2000/caleb.h b/drivers/net/ethernet/xscale/ixp2000/caleb.h
new file mode 100644
index 000000000000..e93a1ef5b8a3
--- /dev/null
+++ b/drivers/net/ethernet/xscale/ixp2000/caleb.h
@@ -0,0 +1,22 @@
+/*
+ * Helper functions for the SPI-3 bridge FPGA on the Radisys ENP2611
+ * Copyright (C) 2004, 2005 Lennert Buytenhek <buytenh@wantstofly.org>
+ * Dedicated to Marija Kulikova.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ */
+
+#ifndef __CALEB_H
+#define __CALEB_H
+
+void caleb_reset(void);
+void caleb_enable_rx(int port);
+void caleb_disable_rx(int port);
+void caleb_enable_tx(int port);
+void caleb_disable_tx(int port);
+
+
+#endif
diff --git a/drivers/net/ethernet/xscale/ixp2000/enp2611.c b/drivers/net/ethernet/xscale/ixp2000/enp2611.c
new file mode 100644
index 000000000000..34a6cfd17930
--- /dev/null
+++ b/drivers/net/ethernet/xscale/ixp2000/enp2611.c
@@ -0,0 +1,232 @@
+/*
+ * IXP2400 MSF network device driver for the Radisys ENP2611
+ * Copyright (C) 2004, 2005 Lennert Buytenhek <buytenh@wantstofly.org>
+ * Dedicated to Marija Kulikova.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ */
+
+#include <linux/module.h>
+#include <linux/kernel.h>
+#include <linux/netdevice.h>
+#include <linux/etherdevice.h>
+#include <linux/init.h>
+#include <linux/moduleparam.h>
+#include <asm/hardware/uengine.h>
+#include <asm/mach-types.h>
+#include <asm/io.h>
+#include "ixpdev.h"
+#include "caleb.h"
+#include "ixp2400-msf.h"
+#include "pm3386.h"
+
+/***********************************************************************
+ * The Radisys ENP2611 is a PCI form factor board with three SFP GBIC
+ * slots, connected via two PMC/Sierra 3386s and an SPI-3 bridge FPGA
+ * to the IXP2400.
+ *
+ *                +-------------+
+ * SFP GBIC #0 ---+             |       +---------+
+ *                |  PM3386 #0  +-------+         |
+ * SFP GBIC #1 ---+             |       | "Caleb" |         +---------+
+ *                +-------------+       |         |         |         |
+ *                                      | SPI-3   +---------+ IXP2400 |
+ *                +-------------+       | bridge  |         |         |
+ * SFP GBIC #2 ---+             |       | FPGA    |         +---------+
+ *                |  PM3386 #1  +-------+         |
+ *                |             |       +---------+
+ *                +-------------+
+ *              ^                   ^                  ^
+ *              | 1.25Gbaud         | 104MHz           | 104MHz
+ *              | SERDES ea.        | SPI-3 ea.        | SPI-3
+ *
+ ***********************************************************************/
+static struct ixp2400_msf_parameters enp2611_msf_parameters =
+{
+	.rx_mode =		IXP2400_RX_MODE_UTOPIA_POS |
+				IXP2400_RX_MODE_1x32 |
+				IXP2400_RX_MODE_MPHY |
+				IXP2400_RX_MODE_MPHY_32 |
+				IXP2400_RX_MODE_MPHY_POLLED_STATUS |
+				IXP2400_RX_MODE_MPHY_LEVEL3 |
+				IXP2400_RX_MODE_RBUF_SIZE_64,
+
+	.rxclk01_multiplier =	IXP2400_PLL_MULTIPLIER_16,
+
+	.rx_poll_ports =	3,
+
+	.rx_channel_mode = {
+		IXP2400_PORT_RX_MODE_MASTER |
+		IXP2400_PORT_RX_MODE_POS_PHY |
+		IXP2400_PORT_RX_MODE_POS_PHY_L3 |
+		IXP2400_PORT_RX_MODE_ODD_PARITY |
+		IXP2400_PORT_RX_MODE_2_CYCLE_DECODE,
+
+		IXP2400_PORT_RX_MODE_MASTER |
+		IXP2400_PORT_RX_MODE_POS_PHY |
+		IXP2400_PORT_RX_MODE_POS_PHY_L3 |
+		IXP2400_PORT_RX_MODE_ODD_PARITY |
+		IXP2400_PORT_RX_MODE_2_CYCLE_DECODE,
+
+		IXP2400_PORT_RX_MODE_MASTER |
+		IXP2400_PORT_RX_MODE_POS_PHY |
+		IXP2400_PORT_RX_MODE_POS_PHY_L3 |
+		IXP2400_PORT_RX_MODE_ODD_PARITY |
+		IXP2400_PORT_RX_MODE_2_CYCLE_DECODE,
+
+		IXP2400_PORT_RX_MODE_MASTER |
+		IXP2400_PORT_RX_MODE_POS_PHY |
+		IXP2400_PORT_RX_MODE_POS_PHY_L3 |
+		IXP2400_PORT_RX_MODE_ODD_PARITY |
+		IXP2400_PORT_RX_MODE_2_CYCLE_DECODE
+	},
+
+	.tx_mode =		IXP2400_TX_MODE_UTOPIA_POS |
+				IXP2400_TX_MODE_1x32 |
+				IXP2400_TX_MODE_MPHY |
+				IXP2400_TX_MODE_MPHY_32 |
+				IXP2400_TX_MODE_MPHY_POLLED_STATUS |
+				IXP2400_TX_MODE_MPHY_LEVEL3 |
+				IXP2400_TX_MODE_TBUF_SIZE_64,
+
+	.txclk01_multiplier =	IXP2400_PLL_MULTIPLIER_16,
+
+	.tx_poll_ports =	3,
+
+	.tx_channel_mode = {
+		IXP2400_PORT_TX_MODE_MASTER |
+		IXP2400_PORT_TX_MODE_POS_PHY |
+		IXP2400_PORT_TX_MODE_ODD_PARITY |
+		IXP2400_PORT_TX_MODE_2_CYCLE_DECODE,
+
+		IXP2400_PORT_TX_MODE_MASTER |
+		IXP2400_PORT_TX_MODE_POS_PHY |
+		IXP2400_PORT_TX_MODE_ODD_PARITY |
+		IXP2400_PORT_TX_MODE_2_CYCLE_DECODE,
+
+		IXP2400_PORT_TX_MODE_MASTER |
+		IXP2400_PORT_TX_MODE_POS_PHY |
+		IXP2400_PORT_TX_MODE_ODD_PARITY |
+		IXP2400_PORT_TX_MODE_2_CYCLE_DECODE,
+
+		IXP2400_PORT_TX_MODE_MASTER |
+		IXP2400_PORT_TX_MODE_POS_PHY |
+		IXP2400_PORT_TX_MODE_ODD_PARITY |
+		IXP2400_PORT_TX_MODE_2_CYCLE_DECODE
+	}
+};
+
+static struct net_device *nds[3];
+static struct timer_list link_check_timer;
+
+/* @@@ Poll the SFP moddef0 line too.  */
+/* @@@ Try to use the pm3386 DOOL interrupt as well.  */
+static void enp2611_check_link_status(unsigned long __dummy)
+{
+	int i;
+
+	for (i = 0; i < 3; i++) {
+		struct net_device *dev;
+		int status;
+
+		dev = nds[i];
+		if (dev == NULL)
+			continue;
+
+		status = pm3386_is_link_up(i);
+		if (status && !netif_carrier_ok(dev)) {
+			/* @@@ Should report autonegotiation status.  */
+			printk(KERN_INFO "%s: NIC Link is Up\n", dev->name);
+
+			pm3386_enable_tx(i);
+			caleb_enable_tx(i);
+			netif_carrier_on(dev);
+		} else if (!status && netif_carrier_ok(dev)) {
+			printk(KERN_INFO "%s: NIC Link is Down\n", dev->name);
+
+			netif_carrier_off(dev);
+			caleb_disable_tx(i);
+			pm3386_disable_tx(i);
+		}
+	}
+
+	link_check_timer.expires = jiffies + HZ / 10;
+	add_timer(&link_check_timer);
+}
+
+static void enp2611_set_port_admin_status(int port, int up)
+{
+	if (up) {
+		caleb_enable_rx(port);
+
+		pm3386_set_carrier(port, 1);
+		pm3386_enable_rx(port);
+	} else {
+		caleb_disable_tx(port);
+		pm3386_disable_tx(port);
+		/* @@@ Flush out pending packets.  */
+		pm3386_set_carrier(port, 0);
+
+		pm3386_disable_rx(port);
+		caleb_disable_rx(port);
+	}
+}
+
+static int __init enp2611_init_module(void)
+{ 
+	int ports;
+	int i;
+
+	if (!machine_is_enp2611())
+		return -ENODEV;
+
+	caleb_reset();
+	pm3386_reset();
+
+	ports = pm3386_port_count();
+	for (i = 0; i < ports; i++) {
+		nds[i] = ixpdev_alloc(i, sizeof(struct ixpdev_priv));
+		if (nds[i] == NULL) {
+			while (--i >= 0)
+				free_netdev(nds[i]);
+			return -ENOMEM;
+		}
+
+		pm3386_init_port(i);
+		pm3386_get_mac(i, nds[i]->dev_addr);
+	}
+
+	ixp2400_msf_init(&enp2611_msf_parameters);
+
+	if (ixpdev_init(ports, nds, enp2611_set_port_admin_status)) {
+		for (i = 0; i < ports; i++)
+			if (nds[i])
+				free_netdev(nds[i]);
+		return -EINVAL;
+	}
+
+	init_timer(&link_check_timer);
+	link_check_timer.function = enp2611_check_link_status;
+	link_check_timer.expires = jiffies;
+	add_timer(&link_check_timer);
+
+	return 0;
+}
+
+static void __exit enp2611_cleanup_module(void)
+{
+	int i;
+
+	del_timer_sync(&link_check_timer);
+
+	ixpdev_deinit();
+	for (i = 0; i < 3; i++)
+		free_netdev(nds[i]);
+}
+
+module_init(enp2611_init_module);
+module_exit(enp2611_cleanup_module);
+MODULE_LICENSE("GPL");
diff --git a/drivers/net/ethernet/xscale/ixp2000/ixp2400-msf.c b/drivers/net/ethernet/xscale/ixp2000/ixp2400-msf.c
new file mode 100644
index 000000000000..f5ffd7e05d26
--- /dev/null
+++ b/drivers/net/ethernet/xscale/ixp2000/ixp2400-msf.c
@@ -0,0 +1,212 @@
+/*
+ * Generic library functions for the MSF (Media and Switch Fabric) unit
+ * found on the Intel IXP2400 network processor.
+ *
+ * Copyright (C) 2004, 2005 Lennert Buytenhek <buytenh@wantstofly.org>
+ * Dedicated to Marija Kulikova.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU Lesser General Public License as
+ * published by the Free Software Foundation; either version 2.1 of the
+ * License, or (at your option) any later version.
+ */
+
+#include <linux/kernel.h>
+#include <linux/init.h>
+#include <mach/hardware.h>
+#include <mach/ixp2000-regs.h>
+#include <asm/delay.h>
+#include <asm/io.h>
+#include "ixp2400-msf.h"
+
+/*
+ * This is the Intel recommended PLL init procedure as described on
+ * page 340 of the IXP2400/IXP2800 Programmer's Reference Manual.
+ */
+static void ixp2400_pll_init(struct ixp2400_msf_parameters *mp)
+{
+	int rx_dual_clock;
+	int tx_dual_clock;
+	u32 value;
+
+	/*
+	 * If the RX mode is not 1x32, we have to enable both RX PLLs
+	 * (#0 and #1.)  The same thing for the TX direction.
+	 */
+	rx_dual_clock = !!(mp->rx_mode & IXP2400_RX_MODE_WIDTH_MASK);
+	tx_dual_clock = !!(mp->tx_mode & IXP2400_TX_MODE_WIDTH_MASK);
+
+	/*
+	 * Read initial value.
+	 */
+	value = ixp2000_reg_read(IXP2000_MSF_CLK_CNTRL);
+
+	/*
+	 * Put PLLs in powerdown and bypass mode.
+	 */
+	value |= 0x0000f0f0;
+	ixp2000_reg_write(IXP2000_MSF_CLK_CNTRL, value);
+
+	/*
+	 * Set single or dual clock mode bits.
+	 */
+	value &= ~0x03000000;
+	value |= (rx_dual_clock << 24) | (tx_dual_clock << 25);
+
+	/*
+	 * Set multipliers.
+	 */
+	value &= ~0x00ff0000;
+	value |= mp->rxclk01_multiplier << 16;
+	value |= mp->rxclk23_multiplier << 18;
+	value |= mp->txclk01_multiplier << 20;
+	value |= mp->txclk23_multiplier << 22;
+
+	/*
+	 * And write value.
+	 */
+	ixp2000_reg_write(IXP2000_MSF_CLK_CNTRL, value);
+
+	/*
+	 * Disable PLL bypass mode.
+	 */
+	value &= ~(0x00005000 | rx_dual_clock << 13 | tx_dual_clock << 15);
+	ixp2000_reg_write(IXP2000_MSF_CLK_CNTRL, value);
+
+	/*
+	 * Turn on PLLs.
+	 */
+	value &= ~(0x00000050 | rx_dual_clock << 5 | tx_dual_clock << 7);
+	ixp2000_reg_write(IXP2000_MSF_CLK_CNTRL, value);
+
+	/*
+	 * Wait for PLLs to lock.  There are lock status bits, but IXP2400
+	 * erratum #65 says that these lock bits should not be relied upon
+	 * as they might not accurately reflect the true state of the PLLs.
+	 */
+	udelay(100);
+}
+
+/*
+ * Needed according to p480 of Programmer's Reference Manual.
+ */
+static void ixp2400_msf_free_rbuf_entries(struct ixp2400_msf_parameters *mp)
+{
+	int size_bits;
+	int i;
+
+	/*
+	 * Work around IXP2400 erratum #69 (silent RBUF-to-DRAM transfer
+	 * corruption) in the Intel-recommended way: do not add the RBUF
+	 * elements susceptible to corruption to the freelist.
+	 */
+	size_bits = mp->rx_mode & IXP2400_RX_MODE_RBUF_SIZE_MASK;
+	if (size_bits == IXP2400_RX_MODE_RBUF_SIZE_64) {
+		for (i = 1; i < 128; i++) {
+			if (i == 9 || i == 18 || i == 27)
+				continue;
+			ixp2000_reg_write(IXP2000_MSF_RBUF_ELEMENT_DONE, i);
+		}
+	} else if (size_bits == IXP2400_RX_MODE_RBUF_SIZE_128) {
+		for (i = 1; i < 64; i++) {
+			if (i == 4 || i == 9 || i == 13)
+				continue;
+			ixp2000_reg_write(IXP2000_MSF_RBUF_ELEMENT_DONE, i);
+		}
+	} else if (size_bits == IXP2400_RX_MODE_RBUF_SIZE_256) {
+		for (i = 1; i < 32; i++) {
+			if (i == 2 || i == 4 || i == 6)
+				continue;
+			ixp2000_reg_write(IXP2000_MSF_RBUF_ELEMENT_DONE, i);
+		}
+	}
+}
+
+static u32 ixp2400_msf_valid_channels(u32 reg)
+{
+	u32 channels;
+
+	channels = 0;
+	switch (reg & IXP2400_RX_MODE_WIDTH_MASK) {
+	case IXP2400_RX_MODE_1x32:
+		channels = 0x1;
+		if (reg & IXP2400_RX_MODE_MPHY &&
+		    !(reg & IXP2400_RX_MODE_MPHY_32))
+			channels = 0xf;
+		break;
+
+	case IXP2400_RX_MODE_2x16:
+		channels = 0x5;
+		break;
+
+	case IXP2400_RX_MODE_4x8:
+		channels = 0xf;
+		break;
+
+	case IXP2400_RX_MODE_1x16_2x8:
+		channels = 0xd;
+		break;
+	}
+
+	return channels;
+}
+
+static void ixp2400_msf_enable_rx(struct ixp2400_msf_parameters *mp)
+{
+	u32 value;
+
+	value = ixp2000_reg_read(IXP2000_MSF_RX_CONTROL) & 0x0fffffff;
+	value |= ixp2400_msf_valid_channels(mp->rx_mode) << 28;
+	ixp2000_reg_write(IXP2000_MSF_RX_CONTROL, value);
+}
+
+static void ixp2400_msf_enable_tx(struct ixp2400_msf_parameters *mp)
+{
+	u32 value;
+
+	value = ixp2000_reg_read(IXP2000_MSF_TX_CONTROL) & 0x0fffffff;
+	value |= ixp2400_msf_valid_channels(mp->tx_mode) << 28;
+	ixp2000_reg_write(IXP2000_MSF_TX_CONTROL, value);
+}
+
+
+void ixp2400_msf_init(struct ixp2400_msf_parameters *mp)
+{
+	u32 value;
+	int i;
+
+	/*
+	 * Init the RX/TX PLLs based on the passed parameter block.
+	 */
+	ixp2400_pll_init(mp);
+
+	/*
+	 * Reset MSF.  Bit 7 in IXP_RESET_0 resets the MSF.
+	 */
+	value = ixp2000_reg_read(IXP2000_RESET0);
+	ixp2000_reg_write(IXP2000_RESET0, value | 0x80);
+	ixp2000_reg_write(IXP2000_RESET0, value & ~0x80);
+
+	/*
+	 * Initialise the RX section.
+	 */
+	ixp2000_reg_write(IXP2000_MSF_RX_MPHY_POLL_LIMIT, mp->rx_poll_ports - 1);
+	ixp2000_reg_write(IXP2000_MSF_RX_CONTROL, mp->rx_mode);
+	for (i = 0; i < 4; i++) {
+		ixp2000_reg_write(IXP2000_MSF_RX_UP_CONTROL_0 + i,
+						mp->rx_channel_mode[i]);
+	}
+	ixp2400_msf_free_rbuf_entries(mp);
+	ixp2400_msf_enable_rx(mp);
+
+	/*
+	 * Initialise the TX section.
+	 */
+	ixp2000_reg_write(IXP2000_MSF_TX_MPHY_POLL_LIMIT, mp->tx_poll_ports - 1);
+	ixp2000_reg_write(IXP2000_MSF_TX_CONTROL, mp->tx_mode);
+	for (i = 0; i < 4; i++) {
+		ixp2000_reg_write(IXP2000_MSF_TX_UP_CONTROL_0 + i,
+						mp->tx_channel_mode[i]);
+	}
+	ixp2400_msf_enable_tx(mp);
+}
diff --git a/drivers/net/ethernet/xscale/ixp2000/ixp2400-msf.h b/drivers/net/ethernet/xscale/ixp2000/ixp2400-msf.h
new file mode 100644
index 000000000000..3ac1af2771da
--- /dev/null
+++ b/drivers/net/ethernet/xscale/ixp2000/ixp2400-msf.h
@@ -0,0 +1,115 @@
+/*
+ * Generic library functions for the MSF (Media and Switch Fabric) unit
+ * found on the Intel IXP2400 network processor.
+ *
+ * Copyright (C) 2004, 2005 Lennert Buytenhek <buytenh@wantstofly.org>
+ * Dedicated to Marija Kulikova.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU Lesser General Public License as
+ * published by the Free Software Foundation; either version 2.1 of the
+ * License, or (at your option) any later version.
+ */
+
+#ifndef __IXP2400_MSF_H
+#define __IXP2400_MSF_H
+
+struct ixp2400_msf_parameters
+{
+	u32				rx_mode;
+	unsigned			rxclk01_multiplier:2;
+	unsigned			rxclk23_multiplier:2;
+	unsigned			rx_poll_ports:6;
+	u32				rx_channel_mode[4];
+
+	u32				tx_mode;
+	unsigned			txclk01_multiplier:2;
+	unsigned			txclk23_multiplier:2;
+	unsigned			tx_poll_ports:6;
+	u32				tx_channel_mode[4];
+};
+
+void ixp2400_msf_init(struct ixp2400_msf_parameters *mp);
+
+#define IXP2400_PLL_MULTIPLIER_48		0x00
+#define IXP2400_PLL_MULTIPLIER_24		0x01
+#define IXP2400_PLL_MULTIPLIER_16		0x02
+#define IXP2400_PLL_MULTIPLIER_12		0x03
+
+#define IXP2400_RX_MODE_CSIX			0x00400000
+#define IXP2400_RX_MODE_UTOPIA_POS		0x00000000
+#define IXP2400_RX_MODE_WIDTH_MASK		0x00300000
+#define IXP2400_RX_MODE_1x16_2x8		0x00300000
+#define IXP2400_RX_MODE_4x8			0x00200000
+#define IXP2400_RX_MODE_2x16			0x00100000
+#define IXP2400_RX_MODE_1x32			0x00000000
+#define IXP2400_RX_MODE_MPHY			0x00080000
+#define IXP2400_RX_MODE_SPHY			0x00000000
+#define IXP2400_RX_MODE_MPHY_32			0x00040000
+#define IXP2400_RX_MODE_MPHY_4			0x00000000
+#define IXP2400_RX_MODE_MPHY_POLLED_STATUS	0x00020000
+#define IXP2400_RX_MODE_MPHY_DIRECT_STATUS	0x00000000
+#define IXP2400_RX_MODE_CBUS_FULL_DUPLEX	0x00010000
+#define IXP2400_RX_MODE_CBUS_SIMPLEX		0x00000000
+#define IXP2400_RX_MODE_MPHY_LEVEL2		0x00004000
+#define IXP2400_RX_MODE_MPHY_LEVEL3		0x00000000
+#define IXP2400_RX_MODE_CBUS_8BIT		0x00002000
+#define IXP2400_RX_MODE_CBUS_4BIT		0x00000000
+#define IXP2400_RX_MODE_CSIX_SINGLE_FREELIST	0x00000200
+#define IXP2400_RX_MODE_CSIX_SPLIT_FREELISTS	0x00000000
+#define IXP2400_RX_MODE_RBUF_SIZE_MASK		0x0000000c
+#define IXP2400_RX_MODE_RBUF_SIZE_256		0x00000008
+#define IXP2400_RX_MODE_RBUF_SIZE_128		0x00000004
+#define IXP2400_RX_MODE_RBUF_SIZE_64		0x00000000
+
+#define IXP2400_PORT_RX_MODE_SLAVE		0x00000040
+#define IXP2400_PORT_RX_MODE_MASTER		0x00000000
+#define IXP2400_PORT_RX_MODE_POS_PHY_L3		0x00000020
+#define IXP2400_PORT_RX_MODE_POS_PHY_L2		0x00000000
+#define IXP2400_PORT_RX_MODE_POS_PHY		0x00000010
+#define IXP2400_PORT_RX_MODE_UTOPIA		0x00000000
+#define IXP2400_PORT_RX_MODE_EVEN_PARITY	0x0000000c
+#define IXP2400_PORT_RX_MODE_ODD_PARITY		0x00000008
+#define IXP2400_PORT_RX_MODE_NO_PARITY		0x00000000
+#define IXP2400_PORT_RX_MODE_UTOPIA_BIG_CELLS	0x00000002
+#define IXP2400_PORT_RX_MODE_UTOPIA_NORMAL_CELLS	0x00000000
+#define IXP2400_PORT_RX_MODE_2_CYCLE_DECODE	0x00000001
+#define IXP2400_PORT_RX_MODE_1_CYCLE_DECODE	0x00000000
+
+#define IXP2400_TX_MODE_CSIX			0x00400000
+#define IXP2400_TX_MODE_UTOPIA_POS		0x00000000
+#define IXP2400_TX_MODE_WIDTH_MASK		0x00300000
+#define IXP2400_TX_MODE_1x16_2x8		0x00300000
+#define IXP2400_TX_MODE_4x8			0x00200000
+#define IXP2400_TX_MODE_2x16			0x00100000
+#define IXP2400_TX_MODE_1x32			0x00000000
+#define IXP2400_TX_MODE_MPHY			0x00080000
+#define IXP2400_TX_MODE_SPHY			0x00000000
+#define IXP2400_TX_MODE_MPHY_32			0x00040000
+#define IXP2400_TX_MODE_MPHY_4			0x00000000
+#define IXP2400_TX_MODE_MPHY_POLLED_STATUS	0x00020000
+#define IXP2400_TX_MODE_MPHY_DIRECT_STATUS	0x00000000
+#define IXP2400_TX_MODE_CBUS_FULL_DUPLEX	0x00010000
+#define IXP2400_TX_MODE_CBUS_SIMPLEX		0x00000000
+#define IXP2400_TX_MODE_MPHY_LEVEL2		0x00004000
+#define IXP2400_TX_MODE_MPHY_LEVEL3		0x00000000
+#define IXP2400_TX_MODE_CBUS_8BIT		0x00002000
+#define IXP2400_TX_MODE_CBUS_4BIT		0x00000000
+#define IXP2400_TX_MODE_TBUF_SIZE_MASK		0x0000000c
+#define IXP2400_TX_MODE_TBUF_SIZE_256		0x00000008
+#define IXP2400_TX_MODE_TBUF_SIZE_128		0x00000004
+#define IXP2400_TX_MODE_TBUF_SIZE_64		0x00000000
+
+#define IXP2400_PORT_TX_MODE_SLAVE		0x00000040
+#define IXP2400_PORT_TX_MODE_MASTER		0x00000000
+#define IXP2400_PORT_TX_MODE_POS_PHY		0x00000010
+#define IXP2400_PORT_TX_MODE_UTOPIA		0x00000000
+#define IXP2400_PORT_TX_MODE_EVEN_PARITY	0x0000000c
+#define IXP2400_PORT_TX_MODE_ODD_PARITY		0x00000008
+#define IXP2400_PORT_TX_MODE_NO_PARITY		0x00000000
+#define IXP2400_PORT_TX_MODE_UTOPIA_BIG_CELLS	0x00000002
+#define IXP2400_PORT_TX_MODE_2_CYCLE_DECODE	0x00000001
+#define IXP2400_PORT_TX_MODE_1_CYCLE_DECODE	0x00000000
+
+
+#endif
diff --git a/drivers/net/ethernet/xscale/ixp2000/ixp2400_rx.uc b/drivers/net/ethernet/xscale/ixp2000/ixp2400_rx.uc
new file mode 100644
index 000000000000..42a73e357afa
--- /dev/null
+++ b/drivers/net/ethernet/xscale/ixp2000/ixp2400_rx.uc
@@ -0,0 +1,408 @@
+/*
+ * RX ucode for the Intel IXP2400 in POS-PHY mode.
+ * Copyright (C) 2004, 2005 Lennert Buytenhek
+ * Dedicated to Marija Kulikova.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * Assumptions made in this code:
+ * - The IXP2400 MSF is configured for POS-PHY mode, in a mode where
+ *   only one full element list is used.  This includes, for example,
+ *   1x32 SPHY and 1x32 MPHY32, but not 4x8 SPHY or 1x32 MPHY4.  (This
+ *   is not an exhaustive list.)
+ * - The RBUF uses 64-byte mpackets.
+ * - RX descriptors reside in SRAM, and have the following format:
+ *	struct rx_desc
+ *	{
+ *	// to uengine
+ *		u32	buf_phys_addr;
+ *		u32	buf_length;
+ *
+ *	// from uengine
+ *		u32	channel;
+ *		u32	pkt_length;
+ *	};
+ * - Packet data resides in DRAM.
+ * - Packet buffer addresses are 8-byte aligned.
+ * - Scratch ring 0 is rx_pending.
+ * - Scratch ring 1 is rx_done, and has status condition 'full'.
+ * - The host triggers rx_done flush and rx_pending refill on seeing INTA.
+ * - This code is run on all eight threads of the microengine it runs on.
+ *
+ * Local memory is used for per-channel RX state.
+ */
+
+#define RX_THREAD_FREELIST_0		0x0030
+#define RBUF_ELEMENT_DONE		0x0044
+
+#define CHANNEL_FLAGS			*l$index0[0]
+#define CHANNEL_FLAG_RECEIVING		1
+#define PACKET_LENGTH			*l$index0[1]
+#define PACKET_CHECKSUM			*l$index0[2]
+#define BUFFER_HANDLE			*l$index0[3]
+#define BUFFER_START			*l$index0[4]
+#define BUFFER_LENGTH			*l$index0[5]
+
+#define CHANNEL_STATE_SIZE		24	// in bytes
+#define CHANNEL_STATE_SHIFT		5	// ceil(log2(state size))
+
+
+	.sig volatile sig1
+	.sig volatile sig2
+	.sig volatile sig3
+
+	.sig mpacket_arrived
+	.reg add_to_rx_freelist
+	.reg read $rsw0, $rsw1
+	.xfer_order $rsw0 $rsw1
+
+	.reg zero
+
+	/*
+	 * Initialise add_to_rx_freelist.
+	 */
+	.begin
+		.reg temp
+		.reg temp2
+
+		immed[add_to_rx_freelist, RX_THREAD_FREELIST_0]
+		immed_w1[add_to_rx_freelist, (&$rsw0 | (&mpacket_arrived << 12))]
+
+		local_csr_rd[ACTIVE_CTX_STS]
+		immed[temp, 0]
+		alu[temp2, temp, and, 0x1f]
+		alu_shf[add_to_rx_freelist, add_to_rx_freelist, or, temp2, <<20]
+		alu[temp2, temp, and, 0x80]
+		alu_shf[add_to_rx_freelist, add_to_rx_freelist, or, temp2, <<18]
+	.end
+
+	immed[zero, 0]
+
+	/*
+	 * Skip context 0 initialisation?
+	 */
+	.begin
+		br!=ctx[0, mpacket_receive_loop#]
+	.end
+
+	/*
+	 * Initialise local memory.
+	 */
+	.begin
+		.reg addr
+		.reg temp
+
+		immed[temp, 0]
+	init_local_mem_loop#:
+		alu_shf[addr, --, b, temp, <<CHANNEL_STATE_SHIFT]
+		local_csr_wr[ACTIVE_LM_ADDR_0, addr]
+		nop
+		nop
+		nop
+
+		immed[CHANNEL_FLAGS, 0]
+
+		alu[temp, temp, +, 1]
+		alu[--, temp, and, 0x20]
+		beq[init_local_mem_loop#]
+	.end
+
+	/*
+	 * Initialise signal pipeline.
+	 */
+	.begin
+		local_csr_wr[SAME_ME_SIGNAL, (&sig1 << 3)]
+		.set_sig sig1
+
+		local_csr_wr[SAME_ME_SIGNAL, (&sig2 << 3)]
+		.set_sig sig2
+
+		local_csr_wr[SAME_ME_SIGNAL, (&sig3 << 3)]
+		.set_sig sig3
+	.end
+
+mpacket_receive_loop#:
+	/*
+	 * Synchronise and wait for mpacket.
+	 */
+	.begin
+		ctx_arb[sig1]
+		local_csr_wr[SAME_ME_SIGNAL, (0x80 | (&sig1 << 3))]
+
+		msf[fast_wr, --, add_to_rx_freelist, 0]
+		.set_sig mpacket_arrived
+		ctx_arb[mpacket_arrived]
+		.set $rsw0 $rsw1
+	.end
+
+	/*
+	 * We halt if we see {inbparerr,parerr,null,soperror}.
+	 */
+	.begin
+		alu_shf[--, 0x1b, and, $rsw0, >>8]
+		bne[abort_rswerr#]
+	.end
+
+	/*
+	 * Point local memory pointer to this channel's state area.
+	 */
+	.begin
+		.reg chanaddr
+
+		alu[chanaddr, $rsw0, and, 0x1f]
+		alu_shf[chanaddr, --, b, chanaddr, <<CHANNEL_STATE_SHIFT]
+		local_csr_wr[ACTIVE_LM_ADDR_0, chanaddr]
+		nop
+		nop
+		nop
+	.end
+
+	/*
+	 * Check whether we received a SOP mpacket while we were already
+	 * working on a packet, or a non-SOP mpacket while there was no
+	 * packet pending.  (SOP == RECEIVING -> abort)  If everything's
+	 * okay, update the RECEIVING flag to reflect our new state.
+	 */
+	.begin
+		.reg temp
+		.reg eop
+
+		#if CHANNEL_FLAG_RECEIVING != 1
+		#error CHANNEL_FLAG_RECEIVING is not 1
+		#endif
+
+		alu_shf[temp, 1, and, $rsw0, >>15]
+		alu[temp, temp, xor, CHANNEL_FLAGS]
+		alu[--, temp, and, CHANNEL_FLAG_RECEIVING]
+		beq[abort_proterr#]
+
+		alu_shf[eop, 1, and, $rsw0, >>14]
+		alu[CHANNEL_FLAGS, temp, xor, eop]
+	.end
+
+	/*
+	 * Copy the mpacket into the right spot, and in case of EOP,
+	 * write back the descriptor and pass the packet on.
+	 */
+	.begin
+		.reg buffer_offset
+		.reg _packet_length
+		.reg _packet_checksum
+		.reg _buffer_handle
+		.reg _buffer_start
+		.reg _buffer_length
+
+		/*
+		 * Determine buffer_offset, _packet_length and
+		 * _packet_checksum.
+		 */
+		.begin
+			.reg temp
+
+			alu[--, 1, and, $rsw0, >>15]
+			beq[not_sop#]
+
+			immed[PACKET_LENGTH, 0]
+			immed[PACKET_CHECKSUM, 0]
+
+		not_sop#:
+			alu[buffer_offset, --, b, PACKET_LENGTH]
+			alu_shf[temp, 0xff, and, $rsw0, >>16]
+			alu[_packet_length, buffer_offset, +, temp]
+			alu[PACKET_LENGTH, --, b, _packet_length]
+
+			immed[temp, 0xffff]
+			alu[temp, $rsw1, and, temp]
+			alu[_packet_checksum, PACKET_CHECKSUM, +, temp]
+			alu[PACKET_CHECKSUM, --, b, _packet_checksum]
+		.end
+
+		/*
+		 * Allocate buffer in case of SOP.
+		 */
+		.begin
+			.reg temp
+
+			alu[temp, 1, and, $rsw0, >>15]
+			beq[skip_buffer_alloc#]
+
+			.begin
+				.sig zzz
+				.reg read $stemp $stemp2
+				.xfer_order $stemp $stemp2
+
+			rx_nobufs#:
+				scratch[get, $stemp, zero, 0, 1], ctx_swap[zzz]
+				alu[_buffer_handle, --, b, $stemp]
+				beq[rx_nobufs#]
+
+				sram[read, $stemp, _buffer_handle, 0, 2],
+								ctx_swap[zzz]
+				alu[_buffer_start, --, b, $stemp]
+				alu[_buffer_length, --, b, $stemp2]
+			.end
+
+		skip_buffer_alloc#:
+		.end
+
+		/*
+		 * Resynchronise.
+		 */
+		.begin
+			ctx_arb[sig2]
+			local_csr_wr[SAME_ME_SIGNAL, (0x80 | (&sig2 << 3))]
+		.end
+
+		/*
+		 * Synchronise buffer state.
+		 */
+		.begin
+			.reg temp
+
+			alu[temp, 1, and, $rsw0, >>15]
+			beq[copy_from_local_mem#]
+
+			alu[BUFFER_HANDLE, --, b, _buffer_handle]
+			alu[BUFFER_START, --, b, _buffer_start]
+			alu[BUFFER_LENGTH, --, b, _buffer_length]
+			br[sync_state_done#]
+
+		copy_from_local_mem#:
+			alu[_buffer_handle, --, b, BUFFER_HANDLE]
+			alu[_buffer_start, --, b, BUFFER_START]
+			alu[_buffer_length, --, b, BUFFER_LENGTH]
+
+		sync_state_done#:
+		.end
+
+#if 0
+		/*
+		 * Debug buffer state management.
+		 */
+		.begin
+			.reg temp
+
+			alu[temp, 1, and, $rsw0, >>14]
+			beq[no_poison#]
+			immed[BUFFER_HANDLE, 0xdead]
+			immed[BUFFER_START, 0xdead]
+			immed[BUFFER_LENGTH, 0xdead]
+		no_poison#:
+
+			immed[temp, 0xdead]
+			alu[--, _buffer_handle, -, temp]
+			beq[state_corrupted#]
+			alu[--, _buffer_start, -, temp]
+			beq[state_corrupted#]
+			alu[--, _buffer_length, -, temp]
+			beq[state_corrupted#]
+		.end
+#endif
+
+		/*
+		 * Check buffer length.
+		 */
+		.begin
+			alu[--, _buffer_length, -, _packet_length]
+			blo[buffer_overflow#]
+		.end
+
+		/*
+		 * Copy the mpacket and give back the RBUF element.
+		 */
+		.begin
+			.reg element
+			.reg xfer_size
+			.reg temp
+			.sig copy_sig
+
+			alu_shf[element, 0x7f, and, $rsw0, >>24]
+			alu_shf[xfer_size, 0xff, and, $rsw0, >>16]
+
+			alu[xfer_size, xfer_size, -, 1]
+			alu_shf[xfer_size, 0x10, or, xfer_size, >>3]
+			alu_shf[temp, 0x10, or, xfer_size, <<21]
+			alu_shf[temp, temp, or, element, <<11]
+			alu_shf[--, temp, or, 1, <<18]
+
+			dram[rbuf_rd, --, _buffer_start, buffer_offset, max_8],
+						indirect_ref, sig_done[copy_sig]
+			ctx_arb[copy_sig]
+
+			alu[temp, RBUF_ELEMENT_DONE, or, element, <<16]
+			msf[fast_wr, --, temp, 0]
+		.end
+
+		/*
+		 * If EOP, write back the packet descriptor.
+		 */
+		.begin
+			.reg write $stemp $stemp2
+			.xfer_order $stemp $stemp2
+			.sig zzz
+
+			alu_shf[--, 1, and, $rsw0, >>14]
+			beq[no_writeback#]
+
+			alu[$stemp, $rsw0, and, 0x1f]
+			alu[$stemp2, --, b, _packet_length]
+			sram[write, $stemp, _buffer_handle, 8, 2], ctx_swap[zzz]
+
+		no_writeback#:
+		.end
+
+		/*
+		 * Resynchronise.
+		 */
+		.begin
+			ctx_arb[sig3]
+			local_csr_wr[SAME_ME_SIGNAL, (0x80 | (&sig3 << 3))]
+		.end
+
+		/*
+		 * If EOP, put the buffer back onto the scratch ring.
+		 */
+		.begin
+			.reg write $stemp
+			.sig zzz
+
+			br_inp_state[SCR_Ring1_Status, rx_done_ring_overflow#]
+
+			alu_shf[--, 1, and, $rsw0, >>14]
+			beq[mpacket_receive_loop#]
+
+			alu[--, 1, and, $rsw0, >>10]
+			bne[rxerr#]
+
+			alu[$stemp, --, b, _buffer_handle]
+			scratch[put, $stemp, zero, 4, 1], ctx_swap[zzz]
+			cap[fast_wr, 0, XSCALE_INT_A]
+			br[mpacket_receive_loop#]
+
+		rxerr#:
+			alu[$stemp, --, b, _buffer_handle]
+			scratch[put, $stemp, zero, 0, 1], ctx_swap[zzz]
+			br[mpacket_receive_loop#]
+		.end
+	.end
+
+
+abort_rswerr#:
+	halt
+
+abort_proterr#:
+	halt
+
+state_corrupted#:
+	halt
+
+buffer_overflow#:
+	halt
+
+rx_done_ring_overflow#:
+	halt
+
+
diff --git a/drivers/net/ethernet/xscale/ixp2000/ixp2400_rx.ucode b/drivers/net/ethernet/xscale/ixp2000/ixp2400_rx.ucode
new file mode 100644
index 000000000000..e8aee2f81aad
--- /dev/null
+++ b/drivers/net/ethernet/xscale/ixp2000/ixp2400_rx.ucode
@@ -0,0 +1,130 @@
+static struct ixp2000_uengine_code ixp2400_rx =
+{
+	.cpu_model_bitmask	= 0x000003fe,
+	.cpu_min_revision	= 0,
+	.cpu_max_revision	= 255,
+
+	.uengine_parameters	= IXP2000_UENGINE_8_CONTEXTS |
+				  IXP2000_UENGINE_PRN_UPDATE_EVERY |
+				  IXP2000_UENGINE_NN_FROM_PREVIOUS |
+				  IXP2000_UENGINE_ASSERT_EMPTY_AT_0 |
+				  IXP2000_UENGINE_LM_ADDR1_PER_CONTEXT |
+				  IXP2000_UENGINE_LM_ADDR0_PER_CONTEXT,
+
+	.initial_reg_values	= (struct ixp2000_reg_value []) {
+		{ -1, -1 }
+	},
+
+	.num_insns		= 109,
+	.insns			= (u8 []) {
+		0xf0, 0x00, 0x0c, 0xc0, 0x05,
+		0xf4, 0x44, 0x0c, 0x00, 0x05,
+		0xfc, 0x04, 0x4c, 0x00, 0x00,
+		0xf0, 0x00, 0x00, 0x3b, 0x00,
+		0xb4, 0x40, 0xf0, 0x3b, 0x1f,
+		0x8a, 0xc0, 0x50, 0x3e, 0x05,
+		0xb4, 0x40, 0xf0, 0x3b, 0x80,
+		0x9a, 0xe0, 0x00, 0x3e, 0x05,
+		0xf0, 0x00, 0x00, 0x07, 0x00,
+		0xd8, 0x05, 0xc0, 0x00, 0x11,
+		0xf0, 0x00, 0x00, 0x0f, 0x00,
+		0x91, 0xb0, 0x20, 0x0e, 0x00,
+		0xfc, 0x06, 0x60, 0x0b, 0x00,
+		0xf0, 0x00, 0x0c, 0x03, 0x00,
+		0xf0, 0x00, 0x0c, 0x03, 0x00,
+		0xf0, 0x00, 0x0c, 0x03, 0x00,
+		0xf0, 0x00, 0x0c, 0x02, 0x00,
+		0xb0, 0xc0, 0x30, 0x0f, 0x01,
+		0xa4, 0x70, 0x00, 0x0f, 0x20,
+		0xd8, 0x02, 0xc0, 0x01, 0x00,
+		0xfc, 0x10, 0xac, 0x23, 0x08,
+		0xfc, 0x10, 0xac, 0x43, 0x10,
+		0xfc, 0x10, 0xac, 0x63, 0x18,
+		0xe0, 0x00, 0x00, 0x00, 0x02,
+		0xfc, 0x10, 0xae, 0x23, 0x88,
+		0x3d, 0x00, 0x04, 0x03, 0x20,
+		0xe0, 0x00, 0x00, 0x00, 0x10,
+		0x84, 0x82, 0x02, 0x01, 0x3b,
+		0xd8, 0x1a, 0x00, 0x01, 0x01,
+		0xb4, 0x00, 0x8c, 0x7d, 0x80,
+		0x91, 0xb0, 0x80, 0x22, 0x00,
+		0xfc, 0x06, 0x60, 0x23, 0x00,
+		0xf0, 0x00, 0x0c, 0x03, 0x00,
+		0xf0, 0x00, 0x0c, 0x03, 0x00,
+		0xf0, 0x00, 0x0c, 0x03, 0x00,
+		0x94, 0xf0, 0x92, 0x01, 0x21,
+		0xac, 0x40, 0x60, 0x26, 0x00,
+		0xa4, 0x30, 0x0c, 0x04, 0x06,
+		0xd8, 0x1a, 0x40, 0x01, 0x00,
+		0x94, 0xe0, 0xa2, 0x01, 0x21,
+		0xac, 0x20, 0x00, 0x28, 0x06,
+		0x84, 0xf2, 0x02, 0x01, 0x21,
+		0xd8, 0x0b, 0x40, 0x01, 0x00,
+		0xf0, 0x00, 0x0c, 0x02, 0x01,
+		0xf0, 0x00, 0x0c, 0x02, 0x02,
+		0xa0, 0x00, 0x08, 0x04, 0x00,
+		0x95, 0x00, 0xc6, 0x01, 0xff,
+		0xa0, 0x80, 0x10, 0x30, 0x00,
+		0xa0, 0x60, 0x1c, 0x00, 0x01,
+		0xf0, 0x0f, 0xf0, 0x33, 0xff,
+		0xb4, 0x00, 0xc0, 0x31, 0x81,
+		0xb0, 0x80, 0xb0, 0x32, 0x02,
+		0xa0, 0x20, 0x20, 0x2c, 0x00,
+		0x94, 0xf0, 0xd2, 0x01, 0x21,
+		0xd8, 0x0f, 0x40, 0x01, 0x00,
+		0x19, 0x40, 0x10, 0x04, 0x20,
+		0xa0, 0x00, 0x26, 0x04, 0x00,
+		0xd8, 0x0d, 0xc0, 0x01, 0x00,
+		0x00, 0x42, 0x10, 0x80, 0x02,
+		0xb0, 0x00, 0x46, 0x04, 0x00,
+		0xb0, 0x00, 0x56, 0x08, 0x00,
+		0xe0, 0x00, 0x00, 0x00, 0x04,
+		0xfc, 0x10, 0xae, 0x43, 0x90,
+		0x84, 0xf0, 0x32, 0x01, 0x21,
+		0xd8, 0x11, 0x40, 0x01, 0x00,
+		0xa0, 0x60, 0x3c, 0x00, 0x02,
+		0xa0, 0x20, 0x40, 0x10, 0x00,
+		0xa0, 0x20, 0x50, 0x14, 0x00,
+		0xd8, 0x12, 0x00, 0x00, 0x18,
+		0xa0, 0x00, 0x28, 0x0c, 0x00,
+		0xb0, 0x00, 0x48, 0x10, 0x00,
+		0xb0, 0x00, 0x58, 0x14, 0x00,
+		0xaa, 0xf0, 0x00, 0x14, 0x01,
+		0xd8, 0x1a, 0xc0, 0x01, 0x05,
+		0x85, 0x80, 0x42, 0x01, 0xff,
+		0x95, 0x00, 0x66, 0x01, 0xff,
+		0xba, 0xc0, 0x60, 0x1b, 0x01,
+		0x9a, 0x30, 0x60, 0x19, 0x30,
+		0x9a, 0xb0, 0x70, 0x1a, 0x30,
+		0x9b, 0x50, 0x78, 0x1e, 0x04,
+		0x8a, 0xe2, 0x08, 0x1e, 0x21,
+		0x6a, 0x4e, 0x00, 0x13, 0x00,
+		0xe0, 0x00, 0x00, 0x00, 0x30,
+		0x9b, 0x00, 0x7a, 0x92, 0x04,
+		0x3d, 0x00, 0x04, 0x1f, 0x20,
+		0x84, 0xe2, 0x02, 0x01, 0x21,
+		0xd8, 0x16, 0x80, 0x01, 0x00,
+		0xa4, 0x18, 0x0c, 0x7d, 0x80,
+		0xa0, 0x58, 0x1c, 0x00, 0x01,
+		0x01, 0x42, 0x00, 0xa0, 0x02,
+		0xe0, 0x00, 0x00, 0x00, 0x08,
+		0xfc, 0x10, 0xae, 0x63, 0x98,
+		0xd8, 0x1b, 0x00, 0xc2, 0x14,
+		0x84, 0xe2, 0x02, 0x01, 0x21,
+		0xd8, 0x05, 0xc0, 0x01, 0x00,
+		0x84, 0xa2, 0x02, 0x01, 0x21,
+		0xd8, 0x19, 0x40, 0x01, 0x01,
+		0xa0, 0x58, 0x0c, 0x00, 0x02,
+		0x1a, 0x40, 0x00, 0x04, 0x24,
+		0x33, 0x00, 0x01, 0x2f, 0x20,
+		0xd8, 0x05, 0xc0, 0x00, 0x18,
+		0xa0, 0x58, 0x0c, 0x00, 0x02,
+		0x1a, 0x40, 0x00, 0x04, 0x20,
+		0xd8, 0x05, 0xc0, 0x00, 0x18,
+		0xe0, 0x00, 0x02, 0x00, 0x00,
+		0xe0, 0x00, 0x02, 0x00, 0x00,
+		0xe0, 0x00, 0x02, 0x00, 0x00,
+		0xe0, 0x00, 0x02, 0x00, 0x00,
+		0xe0, 0x00, 0x02, 0x00, 0x00,
+	}
+};
diff --git a/drivers/net/ethernet/xscale/ixp2000/ixp2400_tx.uc b/drivers/net/ethernet/xscale/ixp2000/ixp2400_tx.uc
new file mode 100644
index 000000000000..d090d1884fb7
--- /dev/null
+++ b/drivers/net/ethernet/xscale/ixp2000/ixp2400_tx.uc
@@ -0,0 +1,272 @@
+/*
+ * TX ucode for the Intel IXP2400 in POS-PHY mode.
+ * Copyright (C) 2004, 2005 Lennert Buytenhek
+ * Dedicated to Marija Kulikova.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * Assumptions made in this code:
+ * - The IXP2400 MSF is configured for POS-PHY mode, in a mode where
+ *   only one TBUF partition is used.  This includes, for example,
+ *   1x32 SPHY and 1x32 MPHY32, but not 4x8 SPHY or 1x32 MPHY4. (This
+ *   is not an exhaustive list.)
+ * - The TBUF uses 64-byte mpackets.
+ * - TX descriptors reside in SRAM, and have the following format:
+ *	struct tx_desc
+ *	{
+ *	// to uengine
+ *		u32	buf_phys_addr;
+ *		u32	pkt_length;
+ *		u32	channel;
+ *	};
+ * - Packet data resides in DRAM.
+ * - Packet buffer addresses are 8-byte aligned.
+ * - Scratch ring 2 is tx_pending.
+ * - Scratch ring 3 is tx_done, and has status condition 'full'.
+ * - This code is run on all eight threads of the microengine it runs on.
+ */
+
+#define TX_SEQUENCE_0		0x0060
+#define TBUF_CTRL		0x1800
+
+#define PARTITION_SIZE		128
+#define PARTITION_THRESH	96
+
+
+	.sig volatile sig1
+	.sig volatile sig2
+	.sig volatile sig3
+
+	.reg @old_tx_seq_0
+	.reg @mpkts_in_flight
+	.reg @next_tbuf_mpacket
+
+	.reg @buffer_handle
+	.reg @buffer_start
+	.reg @packet_length
+	.reg @channel
+	.reg @packet_offset
+
+	.reg zero
+
+	immed[zero, 0]
+
+	/*
+	 * Skip context 0 initialisation?
+	 */
+	.begin
+		br!=ctx[0, mpacket_tx_loop#]
+	.end
+
+	/*
+	 * Wait until all pending TBUF elements have been transmitted.
+	 */
+	.begin
+		.reg read $tx
+		.sig zzz
+
+	loop_empty#:
+		msf[read, $tx, zero, TX_SEQUENCE_0, 1], ctx_swap[zzz]
+		alu_shf[--, --, b, $tx, >>31]
+		beq[loop_empty#]
+
+		alu[@old_tx_seq_0, --, b, $tx]
+	.end
+
+	immed[@mpkts_in_flight, 0]
+	alu[@next_tbuf_mpacket, @old_tx_seq_0, and, (PARTITION_SIZE - 1)]
+
+	immed[@buffer_handle, 0]
+
+	/*
+	 * Initialise signal pipeline.
+	 */
+	.begin
+		local_csr_wr[SAME_ME_SIGNAL, (&sig1 << 3)]
+		.set_sig sig1
+
+		local_csr_wr[SAME_ME_SIGNAL, (&sig2 << 3)]
+		.set_sig sig2
+
+		local_csr_wr[SAME_ME_SIGNAL, (&sig3 << 3)]
+		.set_sig sig3
+	.end
+
+mpacket_tx_loop#:
+	.begin
+		.reg tbuf_element_index
+		.reg buffer_handle
+		.reg sop_eop
+		.reg packet_data
+		.reg channel
+		.reg mpacket_size
+
+		/*
+		 * If there is no packet currently being transmitted,
+		 * dequeue the next TX descriptor, and fetch the buffer
+		 * address, packet length and destination channel number.
+		 */
+		.begin
+			.reg read $stemp $stemp2 $stemp3
+			.xfer_order $stemp $stemp2 $stemp3
+			.sig zzz
+
+			ctx_arb[sig1]
+
+			alu[--, --, b, @buffer_handle]
+			bne[already_got_packet#]
+
+		tx_nobufs#:
+			scratch[get, $stemp, zero, 8, 1], ctx_swap[zzz]
+			alu[@buffer_handle, --, b, $stemp]
+			beq[tx_nobufs#]
+
+			sram[read, $stemp, $stemp, 0, 3], ctx_swap[zzz]
+			alu[@buffer_start, --, b, $stemp]
+			alu[@packet_length, --, b, $stemp2]
+			beq[zero_byte_packet#]
+			alu[@channel, --, b, $stemp3]
+			immed[@packet_offset, 0]
+
+		already_got_packet#:
+			local_csr_wr[SAME_ME_SIGNAL, (0x80 | (&sig1 << 3))]
+		.end
+
+		/*
+		 * Determine tbuf element index, SOP/EOP flags, mpacket
+		 * offset and mpacket size and cache buffer_handle and
+		 * channel number.
+		 */
+		.begin
+			alu[tbuf_element_index, --, b, @next_tbuf_mpacket]
+			alu[@next_tbuf_mpacket, @next_tbuf_mpacket, +, 1]
+			alu[@next_tbuf_mpacket, @next_tbuf_mpacket, and,
+							(PARTITION_SIZE - 1)]
+
+			alu[buffer_handle, --, b, @buffer_handle]
+			immed[@buffer_handle, 0]
+
+			immed[sop_eop, 1]
+
+			alu[packet_data, --, b, @packet_offset]
+			bne[no_sop#]
+			alu[sop_eop, sop_eop, or, 2]
+		no_sop#:
+			alu[packet_data, packet_data, +, @buffer_start]
+
+			alu[channel, --, b, @channel]
+
+			alu[mpacket_size, @packet_length, -, @packet_offset]
+			alu[--, 64, -, mpacket_size]
+			bhs[eop#]
+			alu[@buffer_handle, --, b, buffer_handle]
+			immed[mpacket_size, 64]
+			alu[sop_eop, sop_eop, and, 2]
+		eop#:
+
+			alu[@packet_offset, @packet_offset, +, mpacket_size]
+		.end
+
+		/*
+		 * Wait until there's enough space in the TBUF.
+		 */
+		.begin
+			.reg read $tx
+			.reg temp
+			.sig zzz
+
+			ctx_arb[sig2]
+
+			br[test_space#]
+
+		loop_space#:
+			msf[read, $tx, zero, TX_SEQUENCE_0, 1], ctx_swap[zzz]
+
+			alu[temp, $tx, -, @old_tx_seq_0]
+			alu[temp, temp, and, 0xff]
+			alu[@mpkts_in_flight, @mpkts_in_flight, -, temp]
+
+			alu[@old_tx_seq_0, --, b, $tx]
+
+		test_space#:
+			alu[--, PARTITION_THRESH, -, @mpkts_in_flight]
+			blo[loop_space#]
+
+			alu[@mpkts_in_flight, @mpkts_in_flight, +, 1]
+
+			local_csr_wr[SAME_ME_SIGNAL, (0x80 | (&sig2 << 3))]
+		.end
+
+		/*
+		 * Copy the packet data to the TBUF.
+		 */
+		.begin
+			.reg temp
+			.sig copy_sig
+
+			alu[temp, mpacket_size, -, 1]
+			alu_shf[temp, 0x10, or, temp, >>3]
+			alu_shf[temp, 0x10, or, temp, <<21]
+			alu_shf[temp, temp, or, tbuf_element_index, <<11]
+			alu_shf[--, temp, or, 1, <<18]
+
+			dram[tbuf_wr, --, packet_data, 0, max_8],
+					indirect_ref, sig_done[copy_sig]
+			ctx_arb[copy_sig]
+		.end
+
+		/*
+		 * Mark TBUF element as ready-to-be-transmitted.
+		 */
+		.begin
+			.reg write $tsw $tsw2
+			.xfer_order $tsw $tsw2
+			.reg temp
+			.sig zzz
+
+			alu_shf[temp, channel, or, mpacket_size, <<24]
+			alu_shf[$tsw, temp, or, sop_eop, <<8]
+			immed[$tsw2, 0]
+
+			immed[temp, TBUF_CTRL]
+			alu_shf[temp, temp, or, tbuf_element_index, <<3]
+			msf[write, $tsw, temp, 0, 2], ctx_swap[zzz]
+		.end
+
+		/*
+		 * Resynchronise.
+		 */
+		.begin
+			ctx_arb[sig3]
+			local_csr_wr[SAME_ME_SIGNAL, (0x80 | (&sig3 << 3))]
+		.end
+
+		/*
+		 * If this was an EOP mpacket, recycle the TX buffer
+	 	 * and signal the host.
+		 */
+		.begin
+			.reg write $stemp
+			.sig zzz
+
+			alu[--, sop_eop, and, 1]
+			beq[mpacket_tx_loop#]
+
+		tx_done_ring_full#:
+			br_inp_state[SCR_Ring3_Status, tx_done_ring_full#]
+
+			alu[$stemp, --, b, buffer_handle]
+			scratch[put, $stemp, zero, 12, 1], ctx_swap[zzz]
+			cap[fast_wr, 0, XSCALE_INT_A]
+			br[mpacket_tx_loop#]
+		.end
+	.end
+
+
+zero_byte_packet#:
+	halt
+
+
diff --git a/drivers/net/ethernet/xscale/ixp2000/ixp2400_tx.ucode b/drivers/net/ethernet/xscale/ixp2000/ixp2400_tx.ucode
new file mode 100644
index 000000000000..a433e24b0a51
--- /dev/null
+++ b/drivers/net/ethernet/xscale/ixp2000/ixp2400_tx.ucode
@@ -0,0 +1,98 @@
+static struct ixp2000_uengine_code ixp2400_tx =
+{
+	.cpu_model_bitmask	= 0x000003fe,
+	.cpu_min_revision	= 0,
+	.cpu_max_revision	= 255,
+
+	.uengine_parameters	= IXP2000_UENGINE_8_CONTEXTS |
+				  IXP2000_UENGINE_PRN_UPDATE_EVERY |
+				  IXP2000_UENGINE_NN_FROM_PREVIOUS |
+				  IXP2000_UENGINE_ASSERT_EMPTY_AT_0 |
+				  IXP2000_UENGINE_LM_ADDR1_PER_CONTEXT |
+				  IXP2000_UENGINE_LM_ADDR0_PER_CONTEXT,
+
+	.initial_reg_values	= (struct ixp2000_reg_value []) {
+		{ -1, -1 }
+	},
+
+	.num_insns		= 77,
+	.insns			= (u8 []) {
+		0xf0, 0x00, 0x00, 0x07, 0x00,
+		0xd8, 0x03, 0x00, 0x00, 0x11,
+		0x3c, 0x40, 0x00, 0x04, 0xe0,
+		0x81, 0xf2, 0x02, 0x01, 0x00,
+		0xd8, 0x00, 0x80, 0x01, 0x00,
+		0xb0, 0x08, 0x06, 0x00, 0x00,
+		0xf0, 0x00, 0x0c, 0x00, 0x80,
+		0xb4, 0x49, 0x02, 0x03, 0x7f,
+		0xf0, 0x00, 0x02, 0x83, 0x00,
+		0xfc, 0x10, 0xac, 0x23, 0x08,
+		0xfc, 0x10, 0xac, 0x43, 0x10,
+		0xfc, 0x10, 0xac, 0x63, 0x18,
+		0xe0, 0x00, 0x00, 0x00, 0x02,
+		0xa0, 0x30, 0x02, 0x80, 0x00,
+		0xd8, 0x06, 0x00, 0x01, 0x01,
+		0x19, 0x40, 0x00, 0x04, 0x28,
+		0xb0, 0x0a, 0x06, 0x00, 0x00,
+		0xd8, 0x03, 0xc0, 0x01, 0x00,
+		0x00, 0x44, 0x00, 0x80, 0x80,
+		0xa0, 0x09, 0x06, 0x00, 0x00,
+		0xb0, 0x0b, 0x06, 0x04, 0x00,
+		0xd8, 0x13, 0x00, 0x01, 0x00,
+		0xb0, 0x0c, 0x06, 0x08, 0x00,
+		0xf0, 0x00, 0x0c, 0x00, 0xa0,
+		0xfc, 0x10, 0xae, 0x23, 0x88,
+		0xa0, 0x00, 0x12, 0x40, 0x00,
+		0xb0, 0xc9, 0x02, 0x43, 0x01,
+		0xb4, 0x49, 0x02, 0x43, 0x7f,
+		0xb0, 0x00, 0x22, 0x80, 0x00,
+		0xf0, 0x00, 0x02, 0x83, 0x00,
+		0xf0, 0x00, 0x0c, 0x04, 0x02,
+		0xb0, 0x40, 0x6c, 0x00, 0xa0,
+		0xd8, 0x08, 0x80, 0x01, 0x01,
+		0xaa, 0x00, 0x2c, 0x08, 0x02,
+		0xa0, 0xc0, 0x30, 0x18, 0x90,
+		0xa0, 0x00, 0x43, 0x00, 0x00,
+		0xba, 0xc0, 0x32, 0xc0, 0xa0,
+		0xaa, 0xb0, 0x00, 0x0f, 0x40,
+		0xd8, 0x0a, 0x80, 0x01, 0x04,
+		0xb0, 0x0a, 0x00, 0x08, 0x00,
+		0xf0, 0x00, 0x00, 0x0f, 0x40,
+		0xa4, 0x00, 0x2c, 0x08, 0x02,
+		0xa0, 0x8a, 0x00, 0x0c, 0xa0,
+		0xe0, 0x00, 0x00, 0x00, 0x04,
+		0xd8, 0x0c, 0x80, 0x00, 0x18,
+		0x3c, 0x40, 0x00, 0x04, 0xe0,
+		0xba, 0x80, 0x42, 0x01, 0x80,
+		0xb4, 0x40, 0x40, 0x13, 0xff,
+		0xaa, 0x88, 0x00, 0x10, 0x80,
+		0xb0, 0x08, 0x06, 0x00, 0x00,
+		0xaa, 0xf0, 0x0d, 0x80, 0x80,
+		0xd8, 0x0b, 0x40, 0x01, 0x05,
+		0xa0, 0x88, 0x0c, 0x04, 0x80,
+		0xfc, 0x10, 0xae, 0x43, 0x90,
+		0xba, 0xc0, 0x50, 0x0f, 0x01,
+		0x9a, 0x30, 0x50, 0x15, 0x30,
+		0x9a, 0xb0, 0x50, 0x16, 0x30,
+		0x9b, 0x50, 0x58, 0x16, 0x01,
+		0x8a, 0xe2, 0x08, 0x16, 0x21,
+		0x6b, 0x4e, 0x00, 0x83, 0x03,
+		0xe0, 0x00, 0x00, 0x00, 0x30,
+		0x9a, 0x80, 0x70, 0x0e, 0x04,
+		0x8b, 0x88, 0x08, 0x1e, 0x02,
+		0xf0, 0x00, 0x0c, 0x01, 0x81,
+		0xf0, 0x01, 0x80, 0x1f, 0x00,
+		0x9b, 0xd0, 0x78, 0x1e, 0x01,
+		0x3d, 0x42, 0x00, 0x1c, 0x20,
+		0xe0, 0x00, 0x00, 0x00, 0x08,
+		0xfc, 0x10, 0xae, 0x63, 0x98,
+		0xa4, 0x30, 0x0c, 0x04, 0x02,
+		0xd8, 0x03, 0x00, 0x01, 0x00,
+		0xd8, 0x11, 0xc1, 0x42, 0x14,
+		0xa0, 0x18, 0x00, 0x08, 0x00,
+		0x1a, 0x40, 0x00, 0x04, 0x2c,
+		0x33, 0x00, 0x01, 0x2f, 0x20,
+		0xd8, 0x03, 0x00, 0x00, 0x18,
+		0xe0, 0x00, 0x02, 0x00, 0x00,
+	}
+};
diff --git a/drivers/net/ethernet/xscale/ixp2000/ixpdev.c b/drivers/net/ethernet/xscale/ixp2000/ixpdev.c
new file mode 100644
index 000000000000..e122493ab70e
--- /dev/null
+++ b/drivers/net/ethernet/xscale/ixp2000/ixpdev.c
@@ -0,0 +1,440 @@
+/*
+ * IXP2000 MSF network device driver
+ * Copyright (C) 2004, 2005 Lennert Buytenhek <buytenh@wantstofly.org>
+ * Dedicated to Marija Kulikova.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ */
+
+#include <linux/module.h>
+#include <linux/kernel.h>
+#include <linux/netdevice.h>
+#include <linux/etherdevice.h>
+#include <linux/init.h>
+#include <linux/interrupt.h>
+#include <linux/moduleparam.h>
+#include <linux/gfp.h>
+#include <asm/hardware/uengine.h>
+#include <asm/io.h>
+#include "ixp2400_rx.ucode"
+#include "ixp2400_tx.ucode"
+#include "ixpdev_priv.h"
+#include "ixpdev.h"
+#include "pm3386.h"
+
+#define DRV_MODULE_VERSION	"0.2"
+
+static int nds_count;
+static struct net_device **nds;
+static int nds_open;
+static void (*set_port_admin_status)(int port, int up);
+
+static struct ixpdev_rx_desc * const rx_desc =
+	(struct ixpdev_rx_desc *)(IXP2000_SRAM0_VIRT_BASE + RX_BUF_DESC_BASE);
+static struct ixpdev_tx_desc * const tx_desc =
+	(struct ixpdev_tx_desc *)(IXP2000_SRAM0_VIRT_BASE + TX_BUF_DESC_BASE);
+static int tx_pointer;
+
+
+static int ixpdev_xmit(struct sk_buff *skb, struct net_device *dev)
+{
+	struct ixpdev_priv *ip = netdev_priv(dev);
+	struct ixpdev_tx_desc *desc;
+	int entry;
+	unsigned long flags;
+
+	if (unlikely(skb->len > PAGE_SIZE)) {
+		/* @@@ Count drops.  */
+		dev_kfree_skb(skb);
+		return NETDEV_TX_OK;
+	}
+
+	entry = tx_pointer;
+	tx_pointer = (tx_pointer + 1) % TX_BUF_COUNT;
+
+	desc = tx_desc + entry;
+	desc->pkt_length = skb->len;
+	desc->channel = ip->channel;
+
+	skb_copy_and_csum_dev(skb, phys_to_virt(desc->buf_addr));
+	dev_kfree_skb(skb);
+
+	ixp2000_reg_write(RING_TX_PENDING,
+		TX_BUF_DESC_BASE + (entry * sizeof(struct ixpdev_tx_desc)));
+
+	local_irq_save(flags);
+	ip->tx_queue_entries++;
+	if (ip->tx_queue_entries == TX_BUF_COUNT_PER_CHAN)
+		netif_stop_queue(dev);
+	local_irq_restore(flags);
+
+	return NETDEV_TX_OK;
+}
+
+
+static int ixpdev_rx(struct net_device *dev, int processed, int budget)
+{
+	while (processed < budget) {
+		struct ixpdev_rx_desc *desc;
+		struct sk_buff *skb;
+		void *buf;
+		u32 _desc;
+
+		_desc = ixp2000_reg_read(RING_RX_DONE);
+		if (_desc == 0)
+			return 0;
+
+		desc = rx_desc +
+			((_desc - RX_BUF_DESC_BASE) / sizeof(struct ixpdev_rx_desc));
+		buf = phys_to_virt(desc->buf_addr);
+
+		if (desc->pkt_length < 4 || desc->pkt_length > PAGE_SIZE) {
+			printk(KERN_ERR "ixp2000: rx err, length %d\n",
+					desc->pkt_length);
+			goto err;
+		}
+
+		if (desc->channel < 0 || desc->channel >= nds_count) {
+			printk(KERN_ERR "ixp2000: rx err, channel %d\n",
+					desc->channel);
+			goto err;
+		}
+
+		/* @@@ Make FCS stripping configurable.  */
+		desc->pkt_length -= 4;
+
+		if (unlikely(!netif_running(nds[desc->channel])))
+			goto err;
+
+		skb = netdev_alloc_skb_ip_align(dev, desc->pkt_length);
+		if (likely(skb != NULL)) {
+			skb_copy_to_linear_data(skb, buf, desc->pkt_length);
+			skb_put(skb, desc->pkt_length);
+			skb->protocol = eth_type_trans(skb, nds[desc->channel]);
+
+			netif_receive_skb(skb);
+		}
+
+err:
+		ixp2000_reg_write(RING_RX_PENDING, _desc);
+		processed++;
+	}
+
+	return processed;
+}
+
+/* dev always points to nds[0].  */
+static int ixpdev_poll(struct napi_struct *napi, int budget)
+{
+	struct ixpdev_priv *ip = container_of(napi, struct ixpdev_priv, napi);
+	struct net_device *dev = ip->dev;
+	int rx;
+
+	rx = 0;
+	do {
+		ixp2000_reg_write(IXP2000_IRQ_THD_RAW_STATUS_A_0, 0x00ff);
+
+		rx = ixpdev_rx(dev, rx, budget);
+		if (rx >= budget)
+			break;
+	} while (ixp2000_reg_read(IXP2000_IRQ_THD_RAW_STATUS_A_0) & 0x00ff);
+
+	napi_complete(napi);
+	ixp2000_reg_write(IXP2000_IRQ_THD_ENABLE_SET_A_0, 0x00ff);
+
+	return rx;
+}
+
+static void ixpdev_tx_complete(void)
+{
+	int channel;
+	u32 wake;
+
+	wake = 0;
+	while (1) {
+		struct ixpdev_priv *ip;
+		u32 desc;
+		int entry;
+
+		desc = ixp2000_reg_read(RING_TX_DONE);
+		if (desc == 0)
+			break;
+
+		/* @@@ Check whether entries come back in order.  */
+		entry = (desc - TX_BUF_DESC_BASE) / sizeof(struct ixpdev_tx_desc);
+		channel = tx_desc[entry].channel;
+
+		if (channel < 0 || channel >= nds_count) {
+			printk(KERN_ERR "ixp2000: txcomp channel index "
+					"out of bounds (%d, %.8i, %d)\n",
+					channel, (unsigned int)desc, entry);
+			continue;
+		}
+
+		ip = netdev_priv(nds[channel]);
+		if (ip->tx_queue_entries == TX_BUF_COUNT_PER_CHAN)
+			wake |= 1 << channel;
+		ip->tx_queue_entries--;
+	}
+
+	for (channel = 0; wake != 0; channel++) {
+		if (wake & (1 << channel)) {
+			netif_wake_queue(nds[channel]);
+			wake &= ~(1 << channel);
+		}
+	}
+}
+
+static irqreturn_t ixpdev_interrupt(int irq, void *dev_id)
+{
+	u32 status;
+
+	status = ixp2000_reg_read(IXP2000_IRQ_THD_STATUS_A_0);
+	if (status == 0)
+		return IRQ_NONE;
+
+	/*
+	 * Any of the eight receive units signaled RX?
+	 */
+	if (status & 0x00ff) {
+		struct net_device *dev = nds[0];
+		struct ixpdev_priv *ip = netdev_priv(dev);
+
+		ixp2000_reg_wrb(IXP2000_IRQ_THD_ENABLE_CLEAR_A_0, 0x00ff);
+		if (likely(napi_schedule_prep(&ip->napi))) {
+			__napi_schedule(&ip->napi);
+		} else {
+			printk(KERN_CRIT "ixp2000: irq while polling!!\n");
+		}
+	}
+
+	/*
+	 * Any of the eight transmit units signaled TXdone?
+	 */
+	if (status & 0xff00) {
+		ixp2000_reg_wrb(IXP2000_IRQ_THD_RAW_STATUS_A_0, 0xff00);
+		ixpdev_tx_complete();
+	}
+
+	return IRQ_HANDLED;
+}
+
+#ifdef CONFIG_NET_POLL_CONTROLLER
+static void ixpdev_poll_controller(struct net_device *dev)
+{
+	disable_irq(IRQ_IXP2000_THDA0);
+	ixpdev_interrupt(IRQ_IXP2000_THDA0, dev);
+	enable_irq(IRQ_IXP2000_THDA0);
+}
+#endif
+
+static int ixpdev_open(struct net_device *dev)
+{
+	struct ixpdev_priv *ip = netdev_priv(dev);
+	int err;
+
+	napi_enable(&ip->napi);
+	if (!nds_open++) {
+		err = request_irq(IRQ_IXP2000_THDA0, ixpdev_interrupt,
+					IRQF_SHARED, "ixp2000_eth", nds);
+		if (err) {
+			nds_open--;
+			napi_disable(&ip->napi);
+			return err;
+		}
+
+		ixp2000_reg_write(IXP2000_IRQ_THD_ENABLE_SET_A_0, 0xffff);
+	}
+
+	set_port_admin_status(ip->channel, 1);
+	netif_start_queue(dev);
+
+	return 0;
+}
+
+static int ixpdev_close(struct net_device *dev)
+{
+	struct ixpdev_priv *ip = netdev_priv(dev);
+
+	netif_stop_queue(dev);
+	napi_disable(&ip->napi);
+	set_port_admin_status(ip->channel, 0);
+
+	if (!--nds_open) {
+		ixp2000_reg_write(IXP2000_IRQ_THD_ENABLE_CLEAR_A_0, 0xffff);
+		free_irq(IRQ_IXP2000_THDA0, nds);
+	}
+
+	return 0;
+}
+
+static struct net_device_stats *ixpdev_get_stats(struct net_device *dev)
+{
+	struct ixpdev_priv *ip = netdev_priv(dev);
+
+	pm3386_get_stats(ip->channel, &(dev->stats));
+
+	return &(dev->stats);
+}
+
+static const struct net_device_ops ixpdev_netdev_ops = {
+	.ndo_open		= ixpdev_open,
+	.ndo_stop		= ixpdev_close,
+	.ndo_start_xmit		= ixpdev_xmit,
+	.ndo_change_mtu		= eth_change_mtu,
+	.ndo_validate_addr	= eth_validate_addr,
+	.ndo_set_mac_address	= eth_mac_addr,
+	.ndo_get_stats		= ixpdev_get_stats,
+#ifdef CONFIG_NET_POLL_CONTROLLER
+	.ndo_poll_controller	= ixpdev_poll_controller,
+#endif
+};
+
+struct net_device *ixpdev_alloc(int channel, int sizeof_priv)
+{
+	struct net_device *dev;
+	struct ixpdev_priv *ip;
+
+	dev = alloc_etherdev(sizeof_priv);
+	if (dev == NULL)
+		return NULL;
+
+	dev->netdev_ops = &ixpdev_netdev_ops;
+
+	dev->features |= NETIF_F_SG | NETIF_F_HW_CSUM;
+
+	ip = netdev_priv(dev);
+	ip->dev = dev;
+	netif_napi_add(dev, &ip->napi, ixpdev_poll, 64);
+	ip->channel = channel;
+	ip->tx_queue_entries = 0;
+
+	return dev;
+}
+
+int ixpdev_init(int __nds_count, struct net_device **__nds,
+		void (*__set_port_admin_status)(int port, int up))
+{
+	int i;
+	int err;
+
+	BUILD_BUG_ON(RX_BUF_COUNT > 192 || TX_BUF_COUNT > 192);
+
+	printk(KERN_INFO "IXP2000 MSF ethernet driver %s\n", DRV_MODULE_VERSION);
+
+	nds_count = __nds_count;
+	nds = __nds;
+	set_port_admin_status = __set_port_admin_status;
+
+	for (i = 0; i < RX_BUF_COUNT; i++) {
+		void *buf;
+
+		buf = (void *)get_zeroed_page(GFP_KERNEL);
+		if (buf == NULL) {
+			err = -ENOMEM;
+			while (--i >= 0)
+				free_page((unsigned long)phys_to_virt(rx_desc[i].buf_addr));
+			goto err_out;
+		}
+		rx_desc[i].buf_addr = virt_to_phys(buf);
+		rx_desc[i].buf_length = PAGE_SIZE;
+	}
+
+	/* @@@ Maybe we shouldn't be preallocating TX buffers.  */
+	for (i = 0; i < TX_BUF_COUNT; i++) {
+		void *buf;
+
+		buf = (void *)get_zeroed_page(GFP_KERNEL);
+		if (buf == NULL) {
+			err = -ENOMEM;
+			while (--i >= 0)
+				free_page((unsigned long)phys_to_virt(tx_desc[i].buf_addr));
+			goto err_free_rx;
+		}
+		tx_desc[i].buf_addr = virt_to_phys(buf);
+	}
+
+	/* 256 entries, ring status set means 'empty', base address 0x0000.  */
+	ixp2000_reg_write(RING_RX_PENDING_BASE, 0x44000000);
+	ixp2000_reg_write(RING_RX_PENDING_HEAD, 0x00000000);
+	ixp2000_reg_write(RING_RX_PENDING_TAIL, 0x00000000);
+
+	/* 256 entries, ring status set means 'full', base address 0x0400.  */
+	ixp2000_reg_write(RING_RX_DONE_BASE, 0x40000400);
+	ixp2000_reg_write(RING_RX_DONE_HEAD, 0x00000000);
+	ixp2000_reg_write(RING_RX_DONE_TAIL, 0x00000000);
+
+	for (i = 0; i < RX_BUF_COUNT; i++) {
+		ixp2000_reg_write(RING_RX_PENDING,
+			RX_BUF_DESC_BASE + (i * sizeof(struct ixpdev_rx_desc)));
+	}
+
+	ixp2000_uengine_load(0, &ixp2400_rx);
+	ixp2000_uengine_start_contexts(0, 0xff);
+
+	/* 256 entries, ring status set means 'empty', base address 0x0800.  */
+	ixp2000_reg_write(RING_TX_PENDING_BASE, 0x44000800);
+	ixp2000_reg_write(RING_TX_PENDING_HEAD, 0x00000000);
+	ixp2000_reg_write(RING_TX_PENDING_TAIL, 0x00000000);
+
+	/* 256 entries, ring status set means 'full', base address 0x0c00.  */
+	ixp2000_reg_write(RING_TX_DONE_BASE, 0x40000c00);
+	ixp2000_reg_write(RING_TX_DONE_HEAD, 0x00000000);
+	ixp2000_reg_write(RING_TX_DONE_TAIL, 0x00000000);
+
+	ixp2000_uengine_load(1, &ixp2400_tx);
+	ixp2000_uengine_start_contexts(1, 0xff);
+
+	for (i = 0; i < nds_count; i++) {
+		err = register_netdev(nds[i]);
+		if (err) {
+			while (--i >= 0)
+				unregister_netdev(nds[i]);
+			goto err_free_tx;
+		}
+	}
+
+	for (i = 0; i < nds_count; i++) {
+		printk(KERN_INFO "%s: IXP2000 MSF ethernet (port %d), "
+			"%.2x:%.2x:%.2x:%.2x:%.2x:%.2x.\n", nds[i]->name, i,
+			nds[i]->dev_addr[0], nds[i]->dev_addr[1],
+			nds[i]->dev_addr[2], nds[i]->dev_addr[3],
+			nds[i]->dev_addr[4], nds[i]->dev_addr[5]);
+	}
+
+	return 0;
+
+err_free_tx:
+	for (i = 0; i < TX_BUF_COUNT; i++)
+		free_page((unsigned long)phys_to_virt(tx_desc[i].buf_addr));
+
+err_free_rx:
+	for (i = 0; i < RX_BUF_COUNT; i++)
+		free_page((unsigned long)phys_to_virt(rx_desc[i].buf_addr));
+
+err_out:
+	return err;
+} 
+
+void ixpdev_deinit(void)
+{
+	int i;
+
+	/* @@@ Flush out pending packets.  */
+
+	for (i = 0; i < nds_count; i++)
+		unregister_netdev(nds[i]);
+
+	ixp2000_uengine_stop_contexts(1, 0xff);
+	ixp2000_uengine_stop_contexts(0, 0xff);
+	ixp2000_uengine_reset(0x3);
+
+	for (i = 0; i < TX_BUF_COUNT; i++)
+		free_page((unsigned long)phys_to_virt(tx_desc[i].buf_addr));
+
+	for (i = 0; i < RX_BUF_COUNT; i++)
+		free_page((unsigned long)phys_to_virt(rx_desc[i].buf_addr));
+}
diff --git a/drivers/net/ethernet/xscale/ixp2000/ixpdev.h b/drivers/net/ethernet/xscale/ixp2000/ixpdev.h
new file mode 100644
index 000000000000..391ece623243
--- /dev/null
+++ b/drivers/net/ethernet/xscale/ixp2000/ixpdev.h
@@ -0,0 +1,29 @@
+/*
+ * IXP2000 MSF network device driver
+ * Copyright (C) 2004, 2005 Lennert Buytenhek <buytenh@wantstofly.org>
+ * Dedicated to Marija Kulikova.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ */
+
+#ifndef __IXPDEV_H
+#define __IXPDEV_H
+
+struct ixpdev_priv
+{
+	struct net_device *dev;
+	struct napi_struct napi;
+	int	channel;
+	int	tx_queue_entries;
+};
+
+struct net_device *ixpdev_alloc(int channel, int sizeof_priv);
+int ixpdev_init(int num_ports, struct net_device **nds,
+		void (*set_port_admin_status)(int port, int up));
+void ixpdev_deinit(void);
+
+
+#endif
diff --git a/drivers/net/ethernet/xscale/ixp2000/ixpdev_priv.h b/drivers/net/ethernet/xscale/ixp2000/ixpdev_priv.h
new file mode 100644
index 000000000000..86aa08ea0c33
--- /dev/null
+++ b/drivers/net/ethernet/xscale/ixp2000/ixpdev_priv.h
@@ -0,0 +1,57 @@
+/*
+ * IXP2000 MSF network device driver
+ * Copyright (C) 2004, 2005 Lennert Buytenhek <buytenh@wantstofly.org>
+ * Dedicated to Marija Kulikova.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ */
+
+#ifndef __IXPDEV_PRIV_H
+#define __IXPDEV_PRIV_H
+
+#define RX_BUF_DESC_BASE	0x00001000
+#define RX_BUF_COUNT		((3 * PAGE_SIZE) / (4 * sizeof(struct ixpdev_rx_desc)))
+#define TX_BUF_DESC_BASE	0x00002000
+#define TX_BUF_COUNT		((3 * PAGE_SIZE) / (4 * sizeof(struct ixpdev_tx_desc)))
+#define TX_BUF_COUNT_PER_CHAN	(TX_BUF_COUNT / 4)
+
+#define RING_RX_PENDING		((u32 *)IXP2000_SCRATCH_RING_VIRT_BASE)
+#define RING_RX_DONE		((u32 *)(IXP2000_SCRATCH_RING_VIRT_BASE + 4))
+#define RING_TX_PENDING		((u32 *)(IXP2000_SCRATCH_RING_VIRT_BASE + 8))
+#define RING_TX_DONE		((u32 *)(IXP2000_SCRATCH_RING_VIRT_BASE + 12))
+
+#define SCRATCH_REG(x)		((u32 *)(IXP2000_GLOBAL_REG_VIRT_BASE | 0x0800 | (x)))
+#define RING_RX_PENDING_BASE	SCRATCH_REG(0x00)
+#define RING_RX_PENDING_HEAD	SCRATCH_REG(0x04)
+#define RING_RX_PENDING_TAIL	SCRATCH_REG(0x08)
+#define RING_RX_DONE_BASE	SCRATCH_REG(0x10)
+#define RING_RX_DONE_HEAD	SCRATCH_REG(0x14)
+#define RING_RX_DONE_TAIL	SCRATCH_REG(0x18)
+#define RING_TX_PENDING_BASE	SCRATCH_REG(0x20)
+#define RING_TX_PENDING_HEAD	SCRATCH_REG(0x24)
+#define RING_TX_PENDING_TAIL	SCRATCH_REG(0x28)
+#define RING_TX_DONE_BASE	SCRATCH_REG(0x30)
+#define RING_TX_DONE_HEAD	SCRATCH_REG(0x34)
+#define RING_TX_DONE_TAIL	SCRATCH_REG(0x38)
+
+struct ixpdev_rx_desc
+{
+	u32	buf_addr;
+	u32	buf_length;
+	u32	channel;
+	u32	pkt_length;
+};
+
+struct ixpdev_tx_desc
+{
+	u32	buf_addr;
+	u32	pkt_length;
+	u32	channel;
+	u32	unused;
+};
+
+
+#endif
diff --git a/drivers/net/ethernet/xscale/ixp2000/pm3386.c b/drivers/net/ethernet/xscale/ixp2000/pm3386.c
new file mode 100644
index 000000000000..e08d3f9863b8
--- /dev/null
+++ b/drivers/net/ethernet/xscale/ixp2000/pm3386.c
@@ -0,0 +1,351 @@
+/*
+ * Helper functions for the PM3386s on the Radisys ENP2611
+ * Copyright (C) 2004, 2005 Lennert Buytenhek <buytenh@wantstofly.org>
+ * Dedicated to Marija Kulikova.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ */
+
+#include <linux/module.h>
+#include <linux/delay.h>
+#include <linux/netdevice.h>
+#include <asm/io.h>
+#include "pm3386.h"
+
+/*
+ * Read from register 'reg' of PM3386 device 'pm'.
+ */
+static u16 pm3386_reg_read(int pm, int reg)
+{
+	void *_reg;
+	u16 value;
+
+	_reg = (void *)ENP2611_PM3386_0_VIRT_BASE;
+	if (pm == 1)
+		_reg = (void *)ENP2611_PM3386_1_VIRT_BASE;
+
+	value = *((volatile u16 *)(_reg + (reg << 1)));
+
+//	printk(KERN_INFO "pm3386_reg_read(%d, %.3x) = %.8x\n", pm, reg, value);
+
+	return value;
+}
+
+/*
+ * Write to register 'reg' of PM3386 device 'pm', and perform
+ * a readback from the identification register.
+ */
+static void pm3386_reg_write(int pm, int reg, u16 value)
+{
+	void *_reg;
+	u16 dummy;
+
+//	printk(KERN_INFO "pm3386_reg_write(%d, %.3x, %.8x)\n", pm, reg, value);
+
+	_reg = (void *)ENP2611_PM3386_0_VIRT_BASE;
+	if (pm == 1)
+		_reg = (void *)ENP2611_PM3386_1_VIRT_BASE;
+
+	*((volatile u16 *)(_reg + (reg << 1))) = value;
+
+	dummy = *((volatile u16 *)_reg);
+	__asm__ __volatile__("mov %0, %0" : "+r" (dummy));
+}
+
+/*
+ * Read from port 'port' register 'reg', where the registers
+ * for the different ports are 'spacing' registers apart.
+ */
+static u16 pm3386_port_reg_read(int port, int _reg, int spacing)
+{
+	int reg;
+
+	reg = _reg;
+	if (port & 1)
+		reg += spacing;
+
+	return pm3386_reg_read(port >> 1, reg);
+}
+
+/*
+ * Write to port 'port' register 'reg', where the registers
+ * for the different ports are 'spacing' registers apart.
+ */
+static void pm3386_port_reg_write(int port, int _reg, int spacing, u16 value)
+{
+	int reg;
+
+	reg = _reg;
+	if (port & 1)
+		reg += spacing;
+
+	pm3386_reg_write(port >> 1, reg, value);
+}
+
+int pm3386_secondary_present(void)
+{
+	return pm3386_reg_read(1, 0) == 0x3386;
+}
+
+void pm3386_reset(void)
+{
+	u8 mac[3][6];
+	int secondary;
+
+	secondary = pm3386_secondary_present();
+
+	/* Save programmed MAC addresses.  */
+	pm3386_get_mac(0, mac[0]);
+	pm3386_get_mac(1, mac[1]);
+	if (secondary)
+		pm3386_get_mac(2, mac[2]);
+
+	/* Assert analog and digital reset.  */
+	pm3386_reg_write(0, 0x002, 0x0060);
+	if (secondary)
+		pm3386_reg_write(1, 0x002, 0x0060);
+	mdelay(1);
+
+	/* Deassert analog reset.  */
+	pm3386_reg_write(0, 0x002, 0x0062);
+	if (secondary)
+		pm3386_reg_write(1, 0x002, 0x0062);
+	mdelay(10);
+
+	/* Deassert digital reset.  */
+	pm3386_reg_write(0, 0x002, 0x0063);
+	if (secondary)
+		pm3386_reg_write(1, 0x002, 0x0063);
+	mdelay(10);
+
+	/* Restore programmed MAC addresses.  */
+	pm3386_set_mac(0, mac[0]);
+	pm3386_set_mac(1, mac[1]);
+	if (secondary)
+		pm3386_set_mac(2, mac[2]);
+
+	/* Disable carrier on all ports.  */
+	pm3386_set_carrier(0, 0);
+	pm3386_set_carrier(1, 0);
+	if (secondary)
+		pm3386_set_carrier(2, 0);
+}
+
+static u16 swaph(u16 x)
+{
+	return ((x << 8) | (x >> 8)) & 0xffff;
+}
+
+int pm3386_port_count(void)
+{
+	return 2 + pm3386_secondary_present();
+}
+
+void pm3386_init_port(int port)
+{
+	int pm = port >> 1;
+
+	/*
+	 * Work around ENP2611 bootloader programming MAC address
+	 * in reverse.
+	 */
+	if (pm3386_port_reg_read(port, 0x30a, 0x100) == 0x0000 &&
+	    (pm3386_port_reg_read(port, 0x309, 0x100) & 0xff00) == 0x5000) {
+		u16 temp[3];
+
+		temp[0] = pm3386_port_reg_read(port, 0x308, 0x100);
+		temp[1] = pm3386_port_reg_read(port, 0x309, 0x100);
+		temp[2] = pm3386_port_reg_read(port, 0x30a, 0x100);
+		pm3386_port_reg_write(port, 0x308, 0x100, swaph(temp[2]));
+		pm3386_port_reg_write(port, 0x309, 0x100, swaph(temp[1]));
+		pm3386_port_reg_write(port, 0x30a, 0x100, swaph(temp[0]));
+	}
+
+	/*
+	 * Initialise narrowbanding mode.  See application note 2010486
+	 * for more information.  (@@@ We also need to issue a reset
+	 * when ROOL or DOOL are detected.)
+	 */
+	pm3386_port_reg_write(port, 0x708, 0x10, 0xd055);
+	udelay(500);
+	pm3386_port_reg_write(port, 0x708, 0x10, 0x5055);
+
+	/*
+	 * SPI-3 ingress block.  Set 64 bytes SPI-3 burst size
+	 * towards SPI-3 bridge.
+	 */
+	pm3386_port_reg_write(port, 0x122, 0x20, 0x0002);
+
+	/*
+	 * Enable ingress protocol checking, and soft reset the
+	 * SPI-3 ingress block.
+	 */
+	pm3386_reg_write(pm, 0x103, 0x0003);
+	while (!(pm3386_reg_read(pm, 0x103) & 0x80))
+		;
+
+	/*
+	 * SPI-3 egress block.  Gather 12288 bytes of the current
+	 * packet in the TX fifo before initiating transmit on the
+	 * SERDES interface.  (Prevents TX underflows.)
+	 */
+	pm3386_port_reg_write(port, 0x221, 0x20, 0x0007);
+
+	/*
+	 * Enforce odd parity from the SPI-3 bridge, and soft reset
+	 * the SPI-3 egress block.
+	 */
+	pm3386_reg_write(pm, 0x203, 0x000d & ~(4 << (port & 1)));
+	while ((pm3386_reg_read(pm, 0x203) & 0x000c) != 0x000c)
+		;
+
+	/*
+	 * EGMAC block.  Set this channels to reject long preambles,
+	 * not send or transmit PAUSE frames, enable preamble checking,
+	 * disable frame length checking, enable FCS appending, enable
+	 * TX frame padding.
+	 */
+	pm3386_port_reg_write(port, 0x302, 0x100, 0x0113);
+
+	/*
+	 * Soft reset the EGMAC block.
+	 */
+	pm3386_port_reg_write(port, 0x301, 0x100, 0x8000);
+	pm3386_port_reg_write(port, 0x301, 0x100, 0x0000);
+
+	/*
+	 * Auto-sense autonegotiation status.
+	 */
+	pm3386_port_reg_write(port, 0x306, 0x100, 0x0100);
+
+	/*
+	 * Allow reception of jumbo frames.
+	 */
+	pm3386_port_reg_write(port, 0x310, 0x100, 9018);
+
+	/*
+	 * Allow transmission of jumbo frames.
+	 */
+	pm3386_port_reg_write(port, 0x336, 0x100, 9018);
+
+	/* @@@ Should set 0x337/0x437 (RX forwarding threshold.)  */
+
+	/*
+	 * Set autonegotiation parameters to 'no PAUSE, full duplex.'
+	 */
+	pm3386_port_reg_write(port, 0x31c, 0x100, 0x0020);
+
+	/*
+	 * Enable and restart autonegotiation.
+	 */
+	pm3386_port_reg_write(port, 0x318, 0x100, 0x0003);
+	pm3386_port_reg_write(port, 0x318, 0x100, 0x0002);
+}
+
+void pm3386_get_mac(int port, u8 *mac)
+{
+	u16 temp;
+
+	temp = pm3386_port_reg_read(port, 0x308, 0x100);
+	mac[0] = temp & 0xff;
+	mac[1] = (temp >> 8) & 0xff;
+
+	temp = pm3386_port_reg_read(port, 0x309, 0x100);
+	mac[2] = temp & 0xff;
+	mac[3] = (temp >> 8) & 0xff;
+
+	temp = pm3386_port_reg_read(port, 0x30a, 0x100);
+	mac[4] = temp & 0xff;
+	mac[5] = (temp >> 8) & 0xff;
+}
+
+void pm3386_set_mac(int port, u8 *mac)
+{
+	pm3386_port_reg_write(port, 0x308, 0x100, (mac[1] << 8) | mac[0]);
+	pm3386_port_reg_write(port, 0x309, 0x100, (mac[3] << 8) | mac[2]);
+	pm3386_port_reg_write(port, 0x30a, 0x100, (mac[5] << 8) | mac[4]);
+}
+
+static u32 pm3386_get_stat(int port, u16 base)
+{
+	u32 value;
+
+	value = pm3386_port_reg_read(port, base, 0x100);
+	value |= pm3386_port_reg_read(port, base + 1, 0x100) << 16;
+
+	return value;
+}
+
+void pm3386_get_stats(int port, struct net_device_stats *stats)
+{
+	/*
+	 * Snapshot statistics counters.
+	 */
+	pm3386_port_reg_write(port, 0x500, 0x100, 0x0001);
+	while (pm3386_port_reg_read(port, 0x500, 0x100) & 0x0001)
+		;
+
+	memset(stats, 0, sizeof(*stats));
+
+	stats->rx_packets = pm3386_get_stat(port, 0x510);
+	stats->tx_packets = pm3386_get_stat(port, 0x590);
+	stats->rx_bytes = pm3386_get_stat(port, 0x514);
+	stats->tx_bytes = pm3386_get_stat(port, 0x594);
+	/* @@@ Add other stats.  */
+}
+
+void pm3386_set_carrier(int port, int state)
+{
+	pm3386_port_reg_write(port, 0x703, 0x10, state ? 0x1001 : 0x0000);
+}
+
+int pm3386_is_link_up(int port)
+{
+	u16 temp;
+
+	temp = pm3386_port_reg_read(port, 0x31a, 0x100);
+	temp = pm3386_port_reg_read(port, 0x31a, 0x100);
+
+	return !!(temp & 0x0002);
+}
+
+void pm3386_enable_rx(int port)
+{
+	u16 temp;
+
+	temp = pm3386_port_reg_read(port, 0x303, 0x100);
+	temp |= 0x1000;
+	pm3386_port_reg_write(port, 0x303, 0x100, temp);
+}
+
+void pm3386_disable_rx(int port)
+{
+	u16 temp;
+
+	temp = pm3386_port_reg_read(port, 0x303, 0x100);
+	temp &= 0xefff;
+	pm3386_port_reg_write(port, 0x303, 0x100, temp);
+}
+
+void pm3386_enable_tx(int port)
+{
+	u16 temp;
+
+	temp = pm3386_port_reg_read(port, 0x303, 0x100);
+	temp |= 0x4000;
+	pm3386_port_reg_write(port, 0x303, 0x100, temp);
+}
+
+void pm3386_disable_tx(int port)
+{
+	u16 temp;
+
+	temp = pm3386_port_reg_read(port, 0x303, 0x100);
+	temp &= 0xbfff;
+	pm3386_port_reg_write(port, 0x303, 0x100, temp);
+}
+
+MODULE_LICENSE("GPL");
diff --git a/drivers/net/ethernet/xscale/ixp2000/pm3386.h b/drivers/net/ethernet/xscale/ixp2000/pm3386.h
new file mode 100644
index 000000000000..cc4183dca911
--- /dev/null
+++ b/drivers/net/ethernet/xscale/ixp2000/pm3386.h
@@ -0,0 +1,29 @@
+/*
+ * Helper functions for the PM3386s on the Radisys ENP2611
+ * Copyright (C) 2004, 2005 Lennert Buytenhek <buytenh@wantstofly.org>
+ * Dedicated to Marija Kulikova.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ */
+
+#ifndef __PM3386_H
+#define __PM3386_H
+
+void pm3386_reset(void);
+int pm3386_port_count(void);
+void pm3386_init_port(int port);
+void pm3386_get_mac(int port, u8 *mac);
+void pm3386_set_mac(int port, u8 *mac);
+void pm3386_get_stats(int port, struct net_device_stats *stats);
+void pm3386_set_carrier(int port, int state);
+int pm3386_is_link_up(int port);
+void pm3386_enable_rx(int port);
+void pm3386_disable_rx(int port);
+void pm3386_enable_tx(int port);
+void pm3386_disable_tx(int port);
+
+
+#endif
diff --git a/drivers/net/ethernet/xscale/ixp4xx_eth.c b/drivers/net/ethernet/xscale/ixp4xx_eth.c
new file mode 100644
index 000000000000..de51e8453c13
--- /dev/null
+++ b/drivers/net/ethernet/xscale/ixp4xx_eth.c
@@ -0,0 +1,1489 @@
+/*
+ * Intel IXP4xx Ethernet driver for Linux
+ *
+ * Copyright (C) 2007 Krzysztof Halasa <khc@pm.waw.pl>
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of version 2 of the GNU General Public License
+ * as published by the Free Software Foundation.
+ *
+ * Ethernet port config (0x00 is not present on IXP42X):
+ *
+ * logical port		0x00		0x10		0x20
+ * NPE			0 (NPE-A)	1 (NPE-B)	2 (NPE-C)
+ * physical PortId	2		0		1
+ * TX queue		23		24		25
+ * RX-free queue	26		27		28
+ * TX-done queue is always 31, per-port RX and TX-ready queues are configurable
+ *
+ *
+ * Queue entries:
+ * bits 0 -> 1	- NPE ID (RX and TX-done)
+ * bits 0 -> 2	- priority (TX, per 802.1D)
+ * bits 3 -> 4	- port ID (user-set?)
+ * bits 5 -> 31	- physical descriptor address
+ */
+
+#include <linux/delay.h>
+#include <linux/dma-mapping.h>
+#include <linux/dmapool.h>
+#include <linux/etherdevice.h>
+#include <linux/io.h>
+#include <linux/kernel.h>
+#include <linux/net_tstamp.h>
+#include <linux/phy.h>
+#include <linux/platform_device.h>
+#include <linux/ptp_classify.h>
+#include <linux/slab.h>
+#include <mach/ixp46x_ts.h>
+#include <mach/npe.h>
+#include <mach/qmgr.h>
+
+#define DEBUG_DESC		0
+#define DEBUG_RX		0
+#define DEBUG_TX		0
+#define DEBUG_PKT_BYTES		0
+#define DEBUG_MDIO		0
+#define DEBUG_CLOSE		0
+
+#define DRV_NAME		"ixp4xx_eth"
+
+#define MAX_NPES		3
+
+#define RX_DESCS		64 /* also length of all RX queues */
+#define TX_DESCS		16 /* also length of all TX queues */
+#define TXDONE_QUEUE_LEN	64 /* dwords */
+
+#define POOL_ALLOC_SIZE		(sizeof(struct desc) * (RX_DESCS + TX_DESCS))
+#define REGS_SIZE		0x1000
+#define MAX_MRU			1536 /* 0x600 */
+#define RX_BUFF_SIZE		ALIGN((NET_IP_ALIGN) + MAX_MRU, 4)
+
+#define NAPI_WEIGHT		16
+#define MDIO_INTERVAL		(3 * HZ)
+#define MAX_MDIO_RETRIES	100 /* microseconds, typically 30 cycles */
+#define MAX_CLOSE_WAIT		1000 /* microseconds, typically 2-3 cycles */
+
+#define NPE_ID(port_id)		((port_id) >> 4)
+#define PHYSICAL_ID(port_id)	((NPE_ID(port_id) + 2) % 3)
+#define TX_QUEUE(port_id)	(NPE_ID(port_id) + 23)
+#define RXFREE_QUEUE(port_id)	(NPE_ID(port_id) + 26)
+#define TXDONE_QUEUE		31
+
+#define PTP_SLAVE_MODE		1
+#define PTP_MASTER_MODE		2
+#define PORT2CHANNEL(p)		NPE_ID(p->id)
+
+/* TX Control Registers */
+#define TX_CNTRL0_TX_EN		0x01
+#define TX_CNTRL0_HALFDUPLEX	0x02
+#define TX_CNTRL0_RETRY		0x04
+#define TX_CNTRL0_PAD_EN	0x08
+#define TX_CNTRL0_APPEND_FCS	0x10
+#define TX_CNTRL0_2DEFER	0x20
+#define TX_CNTRL0_RMII		0x40 /* reduced MII */
+#define TX_CNTRL1_RETRIES	0x0F /* 4 bits */
+
+/* RX Control Registers */
+#define RX_CNTRL0_RX_EN		0x01
+#define RX_CNTRL0_PADSTRIP_EN	0x02
+#define RX_CNTRL0_SEND_FCS	0x04
+#define RX_CNTRL0_PAUSE_EN	0x08
+#define RX_CNTRL0_LOOP_EN	0x10
+#define RX_CNTRL0_ADDR_FLTR_EN	0x20
+#define RX_CNTRL0_RX_RUNT_EN	0x40
+#define RX_CNTRL0_BCAST_DIS	0x80
+#define RX_CNTRL1_DEFER_EN	0x01
+
+/* Core Control Register */
+#define CORE_RESET		0x01
+#define CORE_RX_FIFO_FLUSH	0x02
+#define CORE_TX_FIFO_FLUSH	0x04
+#define CORE_SEND_JAM		0x08
+#define CORE_MDC_EN		0x10 /* MDIO using NPE-B ETH-0 only */
+
+#define DEFAULT_TX_CNTRL0	(TX_CNTRL0_TX_EN | TX_CNTRL0_RETRY |	\
+				 TX_CNTRL0_PAD_EN | TX_CNTRL0_APPEND_FCS | \
+				 TX_CNTRL0_2DEFER)
+#define DEFAULT_RX_CNTRL0	RX_CNTRL0_RX_EN
+#define DEFAULT_CORE_CNTRL	CORE_MDC_EN
+
+
+/* NPE message codes */
+#define NPE_GETSTATUS			0x00
+#define NPE_EDB_SETPORTADDRESS		0x01
+#define NPE_EDB_GETMACADDRESSDATABASE	0x02
+#define NPE_EDB_SETMACADDRESSSDATABASE	0x03
+#define NPE_GETSTATS			0x04
+#define NPE_RESETSTATS			0x05
+#define NPE_SETMAXFRAMELENGTHS		0x06
+#define NPE_VLAN_SETRXTAGMODE		0x07
+#define NPE_VLAN_SETDEFAULTRXVID	0x08
+#define NPE_VLAN_SETPORTVLANTABLEENTRY	0x09
+#define NPE_VLAN_SETPORTVLANTABLERANGE	0x0A
+#define NPE_VLAN_SETRXQOSENTRY		0x0B
+#define NPE_VLAN_SETPORTIDEXTRACTIONMODE 0x0C
+#define NPE_STP_SETBLOCKINGSTATE	0x0D
+#define NPE_FW_SETFIREWALLMODE		0x0E
+#define NPE_PC_SETFRAMECONTROLDURATIONID 0x0F
+#define NPE_PC_SETAPMACTABLE		0x11
+#define NPE_SETLOOPBACK_MODE		0x12
+#define NPE_PC_SETBSSIDTABLE		0x13
+#define NPE_ADDRESS_FILTER_CONFIG	0x14
+#define NPE_APPENDFCSCONFIG		0x15
+#define NPE_NOTIFY_MAC_RECOVERY_DONE	0x16
+#define NPE_MAC_RECOVERY_START		0x17
+
+
+#ifdef __ARMEB__
+typedef struct sk_buff buffer_t;
+#define free_buffer dev_kfree_skb
+#define free_buffer_irq dev_kfree_skb_irq
+#else
+typedef void buffer_t;
+#define free_buffer kfree
+#define free_buffer_irq kfree
+#endif
+
+struct eth_regs {
+	u32 tx_control[2], __res1[2];		/* 000 */
+	u32 rx_control[2], __res2[2];		/* 010 */
+	u32 random_seed, __res3[3];		/* 020 */
+	u32 partial_empty_threshold, __res4;	/* 030 */
+	u32 partial_full_threshold, __res5;	/* 038 */
+	u32 tx_start_bytes, __res6[3];		/* 040 */
+	u32 tx_deferral, rx_deferral, __res7[2];/* 050 */
+	u32 tx_2part_deferral[2], __res8[2];	/* 060 */
+	u32 slot_time, __res9[3];		/* 070 */
+	u32 mdio_command[4];			/* 080 */
+	u32 mdio_status[4];			/* 090 */
+	u32 mcast_mask[6], __res10[2];		/* 0A0 */
+	u32 mcast_addr[6], __res11[2];		/* 0C0 */
+	u32 int_clock_threshold, __res12[3];	/* 0E0 */
+	u32 hw_addr[6], __res13[61];		/* 0F0 */
+	u32 core_control;			/* 1FC */
+};
+
+struct port {
+	struct resource *mem_res;
+	struct eth_regs __iomem *regs;
+	struct npe *npe;
+	struct net_device *netdev;
+	struct napi_struct napi;
+	struct phy_device *phydev;
+	struct eth_plat_info *plat;
+	buffer_t *rx_buff_tab[RX_DESCS], *tx_buff_tab[TX_DESCS];
+	struct desc *desc_tab;	/* coherent */
+	u32 desc_tab_phys;
+	int id;			/* logical port ID */
+	int speed, duplex;
+	u8 firmware[4];
+	int hwts_tx_en;
+	int hwts_rx_en;
+};
+
+/* NPE message structure */
+struct msg {
+#ifdef __ARMEB__
+	u8 cmd, eth_id, byte2, byte3;
+	u8 byte4, byte5, byte6, byte7;
+#else
+	u8 byte3, byte2, eth_id, cmd;
+	u8 byte7, byte6, byte5, byte4;
+#endif
+};
+
+/* Ethernet packet descriptor */
+struct desc {
+	u32 next;		/* pointer to next buffer, unused */
+
+#ifdef __ARMEB__
+	u16 buf_len;		/* buffer length */
+	u16 pkt_len;		/* packet length */
+	u32 data;		/* pointer to data buffer in RAM */
+	u8 dest_id;
+	u8 src_id;
+	u16 flags;
+	u8 qos;
+	u8 padlen;
+	u16 vlan_tci;
+#else
+	u16 pkt_len;		/* packet length */
+	u16 buf_len;		/* buffer length */
+	u32 data;		/* pointer to data buffer in RAM */
+	u16 flags;
+	u8 src_id;
+	u8 dest_id;
+	u16 vlan_tci;
+	u8 padlen;
+	u8 qos;
+#endif
+
+#ifdef __ARMEB__
+	u8 dst_mac_0, dst_mac_1, dst_mac_2, dst_mac_3;
+	u8 dst_mac_4, dst_mac_5, src_mac_0, src_mac_1;
+	u8 src_mac_2, src_mac_3, src_mac_4, src_mac_5;
+#else
+	u8 dst_mac_3, dst_mac_2, dst_mac_1, dst_mac_0;
+	u8 src_mac_1, src_mac_0, dst_mac_5, dst_mac_4;
+	u8 src_mac_5, src_mac_4, src_mac_3, src_mac_2;
+#endif
+};
+
+
+#define rx_desc_phys(port, n)	((port)->desc_tab_phys +		\
+				 (n) * sizeof(struct desc))
+#define rx_desc_ptr(port, n)	(&(port)->desc_tab[n])
+
+#define tx_desc_phys(port, n)	((port)->desc_tab_phys +		\
+				 ((n) + RX_DESCS) * sizeof(struct desc))
+#define tx_desc_ptr(port, n)	(&(port)->desc_tab[(n) + RX_DESCS])
+
+#ifndef __ARMEB__
+static inline void memcpy_swab32(u32 *dest, u32 *src, int cnt)
+{
+	int i;
+	for (i = 0; i < cnt; i++)
+		dest[i] = swab32(src[i]);
+}
+#endif
+
+static spinlock_t mdio_lock;
+static struct eth_regs __iomem *mdio_regs; /* mdio command and status only */
+static struct mii_bus *mdio_bus;
+static int ports_open;
+static struct port *npe_port_tab[MAX_NPES];
+static struct dma_pool *dma_pool;
+
+static struct sock_filter ptp_filter[] = {
+	PTP_FILTER
+};
+
+static int ixp_ptp_match(struct sk_buff *skb, u16 uid_hi, u32 uid_lo, u16 seqid)
+{
+	u8 *data = skb->data;
+	unsigned int offset;
+	u16 *hi, *id;
+	u32 lo;
+
+	if (sk_run_filter(skb, ptp_filter) != PTP_CLASS_V1_IPV4)
+		return 0;
+
+	offset = ETH_HLEN + IPV4_HLEN(data) + UDP_HLEN;
+
+	if (skb->len < offset + OFF_PTP_SEQUENCE_ID + sizeof(seqid))
+		return 0;
+
+	hi = (u16 *)(data + offset + OFF_PTP_SOURCE_UUID);
+	id = (u16 *)(data + offset + OFF_PTP_SEQUENCE_ID);
+
+	memcpy(&lo, &hi[1], sizeof(lo));
+
+	return (uid_hi == ntohs(*hi) &&
+		uid_lo == ntohl(lo) &&
+		seqid  == ntohs(*id));
+}
+
+static void ixp_rx_timestamp(struct port *port, struct sk_buff *skb)
+{
+	struct skb_shared_hwtstamps *shhwtstamps;
+	struct ixp46x_ts_regs *regs;
+	u64 ns;
+	u32 ch, hi, lo, val;
+	u16 uid, seq;
+
+	if (!port->hwts_rx_en)
+		return;
+
+	ch = PORT2CHANNEL(port);
+
+	regs = (struct ixp46x_ts_regs __iomem *) IXP4XX_TIMESYNC_BASE_VIRT;
+
+	val = __raw_readl(&regs->channel[ch].ch_event);
+
+	if (!(val & RX_SNAPSHOT_LOCKED))
+		return;
+
+	lo = __raw_readl(&regs->channel[ch].src_uuid_lo);
+	hi = __raw_readl(&regs->channel[ch].src_uuid_hi);
+
+	uid = hi & 0xffff;
+	seq = (hi >> 16) & 0xffff;
+
+	if (!ixp_ptp_match(skb, htons(uid), htonl(lo), htons(seq)))
+		goto out;
+
+	lo = __raw_readl(&regs->channel[ch].rx_snap_lo);
+	hi = __raw_readl(&regs->channel[ch].rx_snap_hi);
+	ns = ((u64) hi) << 32;
+	ns |= lo;
+	ns <<= TICKS_NS_SHIFT;
+
+	shhwtstamps = skb_hwtstamps(skb);
+	memset(shhwtstamps, 0, sizeof(*shhwtstamps));
+	shhwtstamps->hwtstamp = ns_to_ktime(ns);
+out:
+	__raw_writel(RX_SNAPSHOT_LOCKED, &regs->channel[ch].ch_event);
+}
+
+static void ixp_tx_timestamp(struct port *port, struct sk_buff *skb)
+{
+	struct skb_shared_hwtstamps shhwtstamps;
+	struct ixp46x_ts_regs *regs;
+	struct skb_shared_info *shtx;
+	u64 ns;
+	u32 ch, cnt, hi, lo, val;
+
+	shtx = skb_shinfo(skb);
+	if (unlikely(shtx->tx_flags & SKBTX_HW_TSTAMP && port->hwts_tx_en))
+		shtx->tx_flags |= SKBTX_IN_PROGRESS;
+	else
+		return;
+
+	ch = PORT2CHANNEL(port);
+
+	regs = (struct ixp46x_ts_regs __iomem *) IXP4XX_TIMESYNC_BASE_VIRT;
+
+	/*
+	 * This really stinks, but we have to poll for the Tx time stamp.
+	 * Usually, the time stamp is ready after 4 to 6 microseconds.
+	 */
+	for (cnt = 0; cnt < 100; cnt++) {
+		val = __raw_readl(&regs->channel[ch].ch_event);
+		if (val & TX_SNAPSHOT_LOCKED)
+			break;
+		udelay(1);
+	}
+	if (!(val & TX_SNAPSHOT_LOCKED)) {
+		shtx->tx_flags &= ~SKBTX_IN_PROGRESS;
+		return;
+	}
+
+	lo = __raw_readl(&regs->channel[ch].tx_snap_lo);
+	hi = __raw_readl(&regs->channel[ch].tx_snap_hi);
+	ns = ((u64) hi) << 32;
+	ns |= lo;
+	ns <<= TICKS_NS_SHIFT;
+
+	memset(&shhwtstamps, 0, sizeof(shhwtstamps));
+	shhwtstamps.hwtstamp = ns_to_ktime(ns);
+	skb_tstamp_tx(skb, &shhwtstamps);
+
+	__raw_writel(TX_SNAPSHOT_LOCKED, &regs->channel[ch].ch_event);
+}
+
+static int hwtstamp_ioctl(struct net_device *netdev, struct ifreq *ifr, int cmd)
+{
+	struct hwtstamp_config cfg;
+	struct ixp46x_ts_regs *regs;
+	struct port *port = netdev_priv(netdev);
+	int ch;
+
+	if (copy_from_user(&cfg, ifr->ifr_data, sizeof(cfg)))
+		return -EFAULT;
+
+	if (cfg.flags) /* reserved for future extensions */
+		return -EINVAL;
+
+	ch = PORT2CHANNEL(port);
+	regs = (struct ixp46x_ts_regs __iomem *) IXP4XX_TIMESYNC_BASE_VIRT;
+
+	switch (cfg.tx_type) {
+	case HWTSTAMP_TX_OFF:
+		port->hwts_tx_en = 0;
+		break;
+	case HWTSTAMP_TX_ON:
+		port->hwts_tx_en = 1;
+		break;
+	default:
+		return -ERANGE;
+	}
+
+	switch (cfg.rx_filter) {
+	case HWTSTAMP_FILTER_NONE:
+		port->hwts_rx_en = 0;
+		break;
+	case HWTSTAMP_FILTER_PTP_V1_L4_SYNC:
+		port->hwts_rx_en = PTP_SLAVE_MODE;
+		__raw_writel(0, &regs->channel[ch].ch_control);
+		break;
+	case HWTSTAMP_FILTER_PTP_V1_L4_DELAY_REQ:
+		port->hwts_rx_en = PTP_MASTER_MODE;
+		__raw_writel(MASTER_MODE, &regs->channel[ch].ch_control);
+		break;
+	default:
+		return -ERANGE;
+	}
+
+	/* Clear out any old time stamps. */
+	__raw_writel(TX_SNAPSHOT_LOCKED | RX_SNAPSHOT_LOCKED,
+		     &regs->channel[ch].ch_event);
+
+	return copy_to_user(ifr->ifr_data, &cfg, sizeof(cfg)) ? -EFAULT : 0;
+}
+
+static int ixp4xx_mdio_cmd(struct mii_bus *bus, int phy_id, int location,
+			   int write, u16 cmd)
+{
+	int cycles = 0;
+
+	if (__raw_readl(&mdio_regs->mdio_command[3]) & 0x80) {
+		printk(KERN_ERR "%s: MII not ready to transmit\n", bus->name);
+		return -1;
+	}
+
+	if (write) {
+		__raw_writel(cmd & 0xFF, &mdio_regs->mdio_command[0]);
+		__raw_writel(cmd >> 8, &mdio_regs->mdio_command[1]);
+	}
+	__raw_writel(((phy_id << 5) | location) & 0xFF,
+		     &mdio_regs->mdio_command[2]);
+	__raw_writel((phy_id >> 3) | (write << 2) | 0x80 /* GO */,
+		     &mdio_regs->mdio_command[3]);
+
+	while ((cycles < MAX_MDIO_RETRIES) &&
+	       (__raw_readl(&mdio_regs->mdio_command[3]) & 0x80)) {
+		udelay(1);
+		cycles++;
+	}
+
+	if (cycles == MAX_MDIO_RETRIES) {
+		printk(KERN_ERR "%s #%i: MII write failed\n", bus->name,
+		       phy_id);
+		return -1;
+	}
+
+#if DEBUG_MDIO
+	printk(KERN_DEBUG "%s #%i: mdio_%s() took %i cycles\n", bus->name,
+	       phy_id, write ? "write" : "read", cycles);
+#endif
+
+	if (write)
+		return 0;
+
+	if (__raw_readl(&mdio_regs->mdio_status[3]) & 0x80) {
+#if DEBUG_MDIO
+		printk(KERN_DEBUG "%s #%i: MII read failed\n", bus->name,
+		       phy_id);
+#endif
+		return 0xFFFF; /* don't return error */
+	}
+
+	return (__raw_readl(&mdio_regs->mdio_status[0]) & 0xFF) |
+		((__raw_readl(&mdio_regs->mdio_status[1]) & 0xFF) << 8);
+}
+
+static int ixp4xx_mdio_read(struct mii_bus *bus, int phy_id, int location)
+{
+	unsigned long flags;
+	int ret;
+
+	spin_lock_irqsave(&mdio_lock, flags);
+	ret = ixp4xx_mdio_cmd(bus, phy_id, location, 0, 0);
+	spin_unlock_irqrestore(&mdio_lock, flags);
+#if DEBUG_MDIO
+	printk(KERN_DEBUG "%s #%i: MII read [%i] -> 0x%X\n", bus->name,
+	       phy_id, location, ret);
+#endif
+	return ret;
+}
+
+static int ixp4xx_mdio_write(struct mii_bus *bus, int phy_id, int location,
+			     u16 val)
+{
+	unsigned long flags;
+	int ret;
+
+	spin_lock_irqsave(&mdio_lock, flags);
+	ret = ixp4xx_mdio_cmd(bus, phy_id, location, 1, val);
+	spin_unlock_irqrestore(&mdio_lock, flags);
+#if DEBUG_MDIO
+	printk(KERN_DEBUG "%s #%i: MII write [%i] <- 0x%X, err = %i\n",
+	       bus->name, phy_id, location, val, ret);
+#endif
+	return ret;
+}
+
+static int ixp4xx_mdio_register(void)
+{
+	int err;
+
+	if (!(mdio_bus = mdiobus_alloc()))
+		return -ENOMEM;
+
+	if (cpu_is_ixp43x()) {
+		/* IXP43x lacks NPE-B and uses NPE-C for MII PHY access */
+		if (!(ixp4xx_read_feature_bits() & IXP4XX_FEATURE_NPEC_ETH))
+			return -ENODEV;
+		mdio_regs = (struct eth_regs __iomem *)IXP4XX_EthC_BASE_VIRT;
+	} else {
+		/* All MII PHY accesses use NPE-B Ethernet registers */
+		if (!(ixp4xx_read_feature_bits() & IXP4XX_FEATURE_NPEB_ETH0))
+			return -ENODEV;
+		mdio_regs = (struct eth_regs __iomem *)IXP4XX_EthB_BASE_VIRT;
+	}
+
+	__raw_writel(DEFAULT_CORE_CNTRL, &mdio_regs->core_control);
+	spin_lock_init(&mdio_lock);
+	mdio_bus->name = "IXP4xx MII Bus";
+	mdio_bus->read = &ixp4xx_mdio_read;
+	mdio_bus->write = &ixp4xx_mdio_write;
+	strcpy(mdio_bus->id, "0");
+
+	if ((err = mdiobus_register(mdio_bus)))
+		mdiobus_free(mdio_bus);
+	return err;
+}
+
+static void ixp4xx_mdio_remove(void)
+{
+	mdiobus_unregister(mdio_bus);
+	mdiobus_free(mdio_bus);
+}
+
+
+static void ixp4xx_adjust_link(struct net_device *dev)
+{
+	struct port *port = netdev_priv(dev);
+	struct phy_device *phydev = port->phydev;
+
+	if (!phydev->link) {
+		if (port->speed) {
+			port->speed = 0;
+			printk(KERN_INFO "%s: link down\n", dev->name);
+		}
+		return;
+	}
+
+	if (port->speed == phydev->speed && port->duplex == phydev->duplex)
+		return;
+
+	port->speed = phydev->speed;
+	port->duplex = phydev->duplex;
+
+	if (port->duplex)
+		__raw_writel(DEFAULT_TX_CNTRL0 & ~TX_CNTRL0_HALFDUPLEX,
+			     &port->regs->tx_control[0]);
+	else
+		__raw_writel(DEFAULT_TX_CNTRL0 | TX_CNTRL0_HALFDUPLEX,
+			     &port->regs->tx_control[0]);
+
+	printk(KERN_INFO "%s: link up, speed %u Mb/s, %s duplex\n",
+	       dev->name, port->speed, port->duplex ? "full" : "half");
+}
+
+
+static inline void debug_pkt(struct net_device *dev, const char *func,
+			     u8 *data, int len)
+{
+#if DEBUG_PKT_BYTES
+	int i;
+
+	printk(KERN_DEBUG "%s: %s(%i) ", dev->name, func, len);
+	for (i = 0; i < len; i++) {
+		if (i >= DEBUG_PKT_BYTES)
+			break;
+		printk("%s%02X",
+		       ((i == 6) || (i == 12) || (i >= 14)) ? " " : "",
+		       data[i]);
+	}
+	printk("\n");
+#endif
+}
+
+
+static inline void debug_desc(u32 phys, struct desc *desc)
+{
+#if DEBUG_DESC
+	printk(KERN_DEBUG "%X: %X %3X %3X %08X %2X < %2X %4X %X"
+	       " %X %X %02X%02X%02X%02X%02X%02X < %02X%02X%02X%02X%02X%02X\n",
+	       phys, desc->next, desc->buf_len, desc->pkt_len,
+	       desc->data, desc->dest_id, desc->src_id, desc->flags,
+	       desc->qos, desc->padlen, desc->vlan_tci,
+	       desc->dst_mac_0, desc->dst_mac_1, desc->dst_mac_2,
+	       desc->dst_mac_3, desc->dst_mac_4, desc->dst_mac_5,
+	       desc->src_mac_0, desc->src_mac_1, desc->src_mac_2,
+	       desc->src_mac_3, desc->src_mac_4, desc->src_mac_5);
+#endif
+}
+
+static inline int queue_get_desc(unsigned int queue, struct port *port,
+				 int is_tx)
+{
+	u32 phys, tab_phys, n_desc;
+	struct desc *tab;
+
+	if (!(phys = qmgr_get_entry(queue)))
+		return -1;
+
+	phys &= ~0x1F; /* mask out non-address bits */
+	tab_phys = is_tx ? tx_desc_phys(port, 0) : rx_desc_phys(port, 0);
+	tab = is_tx ? tx_desc_ptr(port, 0) : rx_desc_ptr(port, 0);
+	n_desc = (phys - tab_phys) / sizeof(struct desc);
+	BUG_ON(n_desc >= (is_tx ? TX_DESCS : RX_DESCS));
+	debug_desc(phys, &tab[n_desc]);
+	BUG_ON(tab[n_desc].next);
+	return n_desc;
+}
+
+static inline void queue_put_desc(unsigned int queue, u32 phys,
+				  struct desc *desc)
+{
+	debug_desc(phys, desc);
+	BUG_ON(phys & 0x1F);
+	qmgr_put_entry(queue, phys);
+	/* Don't check for queue overflow here, we've allocated sufficient
+	   length and queues >= 32 don't support this check anyway. */
+}
+
+
+static inline void dma_unmap_tx(struct port *port, struct desc *desc)
+{
+#ifdef __ARMEB__
+	dma_unmap_single(&port->netdev->dev, desc->data,
+			 desc->buf_len, DMA_TO_DEVICE);
+#else
+	dma_unmap_single(&port->netdev->dev, desc->data & ~3,
+			 ALIGN((desc->data & 3) + desc->buf_len, 4),
+			 DMA_TO_DEVICE);
+#endif
+}
+
+
+static void eth_rx_irq(void *pdev)
+{
+	struct net_device *dev = pdev;
+	struct port *port = netdev_priv(dev);
+
+#if DEBUG_RX
+	printk(KERN_DEBUG "%s: eth_rx_irq\n", dev->name);
+#endif
+	qmgr_disable_irq(port->plat->rxq);
+	napi_schedule(&port->napi);
+}
+
+static int eth_poll(struct napi_struct *napi, int budget)
+{
+	struct port *port = container_of(napi, struct port, napi);
+	struct net_device *dev = port->netdev;
+	unsigned int rxq = port->plat->rxq, rxfreeq = RXFREE_QUEUE(port->id);
+	int received = 0;
+
+#if DEBUG_RX
+	printk(KERN_DEBUG "%s: eth_poll\n", dev->name);
+#endif
+
+	while (received < budget) {
+		struct sk_buff *skb;
+		struct desc *desc;
+		int n;
+#ifdef __ARMEB__
+		struct sk_buff *temp;
+		u32 phys;
+#endif
+
+		if ((n = queue_get_desc(rxq, port, 0)) < 0) {
+#if DEBUG_RX
+			printk(KERN_DEBUG "%s: eth_poll napi_complete\n",
+			       dev->name);
+#endif
+			napi_complete(napi);
+			qmgr_enable_irq(rxq);
+			if (!qmgr_stat_below_low_watermark(rxq) &&
+			    napi_reschedule(napi)) { /* not empty again */
+#if DEBUG_RX
+				printk(KERN_DEBUG "%s: eth_poll"
+				       " napi_reschedule successed\n",
+				       dev->name);
+#endif
+				qmgr_disable_irq(rxq);
+				continue;
+			}
+#if DEBUG_RX
+			printk(KERN_DEBUG "%s: eth_poll all done\n",
+			       dev->name);
+#endif
+			return received; /* all work done */
+		}
+
+		desc = rx_desc_ptr(port, n);
+
+#ifdef __ARMEB__
+		if ((skb = netdev_alloc_skb(dev, RX_BUFF_SIZE))) {
+			phys = dma_map_single(&dev->dev, skb->data,
+					      RX_BUFF_SIZE, DMA_FROM_DEVICE);
+			if (dma_mapping_error(&dev->dev, phys)) {
+				dev_kfree_skb(skb);
+				skb = NULL;
+			}
+		}
+#else
+		skb = netdev_alloc_skb(dev,
+				       ALIGN(NET_IP_ALIGN + desc->pkt_len, 4));
+#endif
+
+		if (!skb) {
+			dev->stats.rx_dropped++;
+			/* put the desc back on RX-ready queue */
+			desc->buf_len = MAX_MRU;
+			desc->pkt_len = 0;
+			queue_put_desc(rxfreeq, rx_desc_phys(port, n), desc);
+			continue;
+		}
+
+		/* process received frame */
+#ifdef __ARMEB__
+		temp = skb;
+		skb = port->rx_buff_tab[n];
+		dma_unmap_single(&dev->dev, desc->data - NET_IP_ALIGN,
+				 RX_BUFF_SIZE, DMA_FROM_DEVICE);
+#else
+		dma_sync_single_for_cpu(&dev->dev, desc->data - NET_IP_ALIGN,
+					RX_BUFF_SIZE, DMA_FROM_DEVICE);
+		memcpy_swab32((u32 *)skb->data, (u32 *)port->rx_buff_tab[n],
+			      ALIGN(NET_IP_ALIGN + desc->pkt_len, 4) / 4);
+#endif
+		skb_reserve(skb, NET_IP_ALIGN);
+		skb_put(skb, desc->pkt_len);
+
+		debug_pkt(dev, "eth_poll", skb->data, skb->len);
+
+		ixp_rx_timestamp(port, skb);
+		skb->protocol = eth_type_trans(skb, dev);
+		dev->stats.rx_packets++;
+		dev->stats.rx_bytes += skb->len;
+		netif_receive_skb(skb);
+
+		/* put the new buffer on RX-free queue */
+#ifdef __ARMEB__
+		port->rx_buff_tab[n] = temp;
+		desc->data = phys + NET_IP_ALIGN;
+#endif
+		desc->buf_len = MAX_MRU;
+		desc->pkt_len = 0;
+		queue_put_desc(rxfreeq, rx_desc_phys(port, n), desc);
+		received++;
+	}
+
+#if DEBUG_RX
+	printk(KERN_DEBUG "eth_poll(): end, not all work done\n");
+#endif
+	return received;		/* not all work done */
+}
+
+
+static void eth_txdone_irq(void *unused)
+{
+	u32 phys;
+
+#if DEBUG_TX
+	printk(KERN_DEBUG DRV_NAME ": eth_txdone_irq\n");
+#endif
+	while ((phys = qmgr_get_entry(TXDONE_QUEUE)) != 0) {
+		u32 npe_id, n_desc;
+		struct port *port;
+		struct desc *desc;
+		int start;
+
+		npe_id = phys & 3;
+		BUG_ON(npe_id >= MAX_NPES);
+		port = npe_port_tab[npe_id];
+		BUG_ON(!port);
+		phys &= ~0x1F; /* mask out non-address bits */
+		n_desc = (phys - tx_desc_phys(port, 0)) / sizeof(struct desc);
+		BUG_ON(n_desc >= TX_DESCS);
+		desc = tx_desc_ptr(port, n_desc);
+		debug_desc(phys, desc);
+
+		if (port->tx_buff_tab[n_desc]) { /* not the draining packet */
+			port->netdev->stats.tx_packets++;
+			port->netdev->stats.tx_bytes += desc->pkt_len;
+
+			dma_unmap_tx(port, desc);
+#if DEBUG_TX
+			printk(KERN_DEBUG "%s: eth_txdone_irq free %p\n",
+			       port->netdev->name, port->tx_buff_tab[n_desc]);
+#endif
+			free_buffer_irq(port->tx_buff_tab[n_desc]);
+			port->tx_buff_tab[n_desc] = NULL;
+		}
+
+		start = qmgr_stat_below_low_watermark(port->plat->txreadyq);
+		queue_put_desc(port->plat->txreadyq, phys, desc);
+		if (start) { /* TX-ready queue was empty */
+#if DEBUG_TX
+			printk(KERN_DEBUG "%s: eth_txdone_irq xmit ready\n",
+			       port->netdev->name);
+#endif
+			netif_wake_queue(port->netdev);
+		}
+	}
+}
+
+static int eth_xmit(struct sk_buff *skb, struct net_device *dev)
+{
+	struct port *port = netdev_priv(dev);
+	unsigned int txreadyq = port->plat->txreadyq;
+	int len, offset, bytes, n;
+	void *mem;
+	u32 phys;
+	struct desc *desc;
+
+#if DEBUG_TX
+	printk(KERN_DEBUG "%s: eth_xmit\n", dev->name);
+#endif
+
+	if (unlikely(skb->len > MAX_MRU)) {
+		dev_kfree_skb(skb);
+		dev->stats.tx_errors++;
+		return NETDEV_TX_OK;
+	}
+
+	debug_pkt(dev, "eth_xmit", skb->data, skb->len);
+
+	len = skb->len;
+#ifdef __ARMEB__
+	offset = 0; /* no need to keep alignment */
+	bytes = len;
+	mem = skb->data;
+#else
+	offset = (int)skb->data & 3; /* keep 32-bit alignment */
+	bytes = ALIGN(offset + len, 4);
+	if (!(mem = kmalloc(bytes, GFP_ATOMIC))) {
+		dev_kfree_skb(skb);
+		dev->stats.tx_dropped++;
+		return NETDEV_TX_OK;
+	}
+	memcpy_swab32(mem, (u32 *)((int)skb->data & ~3), bytes / 4);
+#endif
+
+	phys = dma_map_single(&dev->dev, mem, bytes, DMA_TO_DEVICE);
+	if (dma_mapping_error(&dev->dev, phys)) {
+		dev_kfree_skb(skb);
+#ifndef __ARMEB__
+		kfree(mem);
+#endif
+		dev->stats.tx_dropped++;
+		return NETDEV_TX_OK;
+	}
+
+	n = queue_get_desc(txreadyq, port, 1);
+	BUG_ON(n < 0);
+	desc = tx_desc_ptr(port, n);
+
+#ifdef __ARMEB__
+	port->tx_buff_tab[n] = skb;
+#else
+	port->tx_buff_tab[n] = mem;
+#endif
+	desc->data = phys + offset;
+	desc->buf_len = desc->pkt_len = len;
+
+	/* NPE firmware pads short frames with zeros internally */
+	wmb();
+	queue_put_desc(TX_QUEUE(port->id), tx_desc_phys(port, n), desc);
+
+	if (qmgr_stat_below_low_watermark(txreadyq)) { /* empty */
+#if DEBUG_TX
+		printk(KERN_DEBUG "%s: eth_xmit queue full\n", dev->name);
+#endif
+		netif_stop_queue(dev);
+		/* we could miss TX ready interrupt */
+		/* really empty in fact */
+		if (!qmgr_stat_below_low_watermark(txreadyq)) {
+#if DEBUG_TX
+			printk(KERN_DEBUG "%s: eth_xmit ready again\n",
+			       dev->name);
+#endif
+			netif_wake_queue(dev);
+		}
+	}
+
+#if DEBUG_TX
+	printk(KERN_DEBUG "%s: eth_xmit end\n", dev->name);
+#endif
+
+	ixp_tx_timestamp(port, skb);
+	skb_tx_timestamp(skb);
+
+#ifndef __ARMEB__
+	dev_kfree_skb(skb);
+#endif
+	return NETDEV_TX_OK;
+}
+
+
+static void eth_set_mcast_list(struct net_device *dev)
+{
+	struct port *port = netdev_priv(dev);
+	struct netdev_hw_addr *ha;
+	u8 diffs[ETH_ALEN], *addr;
+	int i;
+	static const u8 allmulti[] = { 0x01, 0x00, 0x00, 0x00, 0x00, 0x00 };
+
+	if (dev->flags & IFF_ALLMULTI) {
+		for (i = 0; i < ETH_ALEN; i++) {
+			__raw_writel(allmulti[i], &port->regs->mcast_addr[i]);
+			__raw_writel(allmulti[i], &port->regs->mcast_mask[i]);
+		}
+		__raw_writel(DEFAULT_RX_CNTRL0 | RX_CNTRL0_ADDR_FLTR_EN,
+			&port->regs->rx_control[0]);
+		return;
+	}
+
+	if ((dev->flags & IFF_PROMISC) || netdev_mc_empty(dev)) {
+		__raw_writel(DEFAULT_RX_CNTRL0 & ~RX_CNTRL0_ADDR_FLTR_EN,
+			     &port->regs->rx_control[0]);
+		return;
+	}
+
+	memset(diffs, 0, ETH_ALEN);
+
+	addr = NULL;
+	netdev_for_each_mc_addr(ha, dev) {
+		if (!addr)
+			addr = ha->addr; /* first MAC address */
+		for (i = 0; i < ETH_ALEN; i++)
+			diffs[i] |= addr[i] ^ ha->addr[i];
+	}
+
+	for (i = 0; i < ETH_ALEN; i++) {
+		__raw_writel(addr[i], &port->regs->mcast_addr[i]);
+		__raw_writel(~diffs[i], &port->regs->mcast_mask[i]);
+	}
+
+	__raw_writel(DEFAULT_RX_CNTRL0 | RX_CNTRL0_ADDR_FLTR_EN,
+		     &port->regs->rx_control[0]);
+}
+
+
+static int eth_ioctl(struct net_device *dev, struct ifreq *req, int cmd)
+{
+	struct port *port = netdev_priv(dev);
+
+	if (!netif_running(dev))
+		return -EINVAL;
+
+	if (cpu_is_ixp46x() && cmd == SIOCSHWTSTAMP)
+		return hwtstamp_ioctl(dev, req, cmd);
+
+	return phy_mii_ioctl(port->phydev, req, cmd);
+}
+
+/* ethtool support */
+
+static void ixp4xx_get_drvinfo(struct net_device *dev,
+			       struct ethtool_drvinfo *info)
+{
+	struct port *port = netdev_priv(dev);
+	strcpy(info->driver, DRV_NAME);
+	snprintf(info->fw_version, sizeof(info->fw_version), "%u:%u:%u:%u",
+		 port->firmware[0], port->firmware[1],
+		 port->firmware[2], port->firmware[3]);
+	strcpy(info->bus_info, "internal");
+}
+
+static int ixp4xx_get_settings(struct net_device *dev, struct ethtool_cmd *cmd)
+{
+	struct port *port = netdev_priv(dev);
+	return phy_ethtool_gset(port->phydev, cmd);
+}
+
+static int ixp4xx_set_settings(struct net_device *dev, struct ethtool_cmd *cmd)
+{
+	struct port *port = netdev_priv(dev);
+	return phy_ethtool_sset(port->phydev, cmd);
+}
+
+static int ixp4xx_nway_reset(struct net_device *dev)
+{
+	struct port *port = netdev_priv(dev);
+	return phy_start_aneg(port->phydev);
+}
+
+static const struct ethtool_ops ixp4xx_ethtool_ops = {
+	.get_drvinfo = ixp4xx_get_drvinfo,
+	.get_settings = ixp4xx_get_settings,
+	.set_settings = ixp4xx_set_settings,
+	.nway_reset = ixp4xx_nway_reset,
+	.get_link = ethtool_op_get_link,
+};
+
+
+static int request_queues(struct port *port)
+{
+	int err;
+
+	err = qmgr_request_queue(RXFREE_QUEUE(port->id), RX_DESCS, 0, 0,
+				 "%s:RX-free", port->netdev->name);
+	if (err)
+		return err;
+
+	err = qmgr_request_queue(port->plat->rxq, RX_DESCS, 0, 0,
+				 "%s:RX", port->netdev->name);
+	if (err)
+		goto rel_rxfree;
+
+	err = qmgr_request_queue(TX_QUEUE(port->id), TX_DESCS, 0, 0,
+				 "%s:TX", port->netdev->name);
+	if (err)
+		goto rel_rx;
+
+	err = qmgr_request_queue(port->plat->txreadyq, TX_DESCS, 0, 0,
+				 "%s:TX-ready", port->netdev->name);
+	if (err)
+		goto rel_tx;
+
+	/* TX-done queue handles skbs sent out by the NPEs */
+	if (!ports_open) {
+		err = qmgr_request_queue(TXDONE_QUEUE, TXDONE_QUEUE_LEN, 0, 0,
+					 "%s:TX-done", DRV_NAME);
+		if (err)
+			goto rel_txready;
+	}
+	return 0;
+
+rel_txready:
+	qmgr_release_queue(port->plat->txreadyq);
+rel_tx:
+	qmgr_release_queue(TX_QUEUE(port->id));
+rel_rx:
+	qmgr_release_queue(port->plat->rxq);
+rel_rxfree:
+	qmgr_release_queue(RXFREE_QUEUE(port->id));
+	printk(KERN_DEBUG "%s: unable to request hardware queues\n",
+	       port->netdev->name);
+	return err;
+}
+
+static void release_queues(struct port *port)
+{
+	qmgr_release_queue(RXFREE_QUEUE(port->id));
+	qmgr_release_queue(port->plat->rxq);
+	qmgr_release_queue(TX_QUEUE(port->id));
+	qmgr_release_queue(port->plat->txreadyq);
+
+	if (!ports_open)
+		qmgr_release_queue(TXDONE_QUEUE);
+}
+
+static int init_queues(struct port *port)
+{
+	int i;
+
+	if (!ports_open)
+		if (!(dma_pool = dma_pool_create(DRV_NAME, NULL,
+						 POOL_ALLOC_SIZE, 32, 0)))
+			return -ENOMEM;
+
+	if (!(port->desc_tab = dma_pool_alloc(dma_pool, GFP_KERNEL,
+					      &port->desc_tab_phys)))
+		return -ENOMEM;
+	memset(port->desc_tab, 0, POOL_ALLOC_SIZE);
+	memset(port->rx_buff_tab, 0, sizeof(port->rx_buff_tab)); /* tables */
+	memset(port->tx_buff_tab, 0, sizeof(port->tx_buff_tab));
+
+	/* Setup RX buffers */
+	for (i = 0; i < RX_DESCS; i++) {
+		struct desc *desc = rx_desc_ptr(port, i);
+		buffer_t *buff; /* skb or kmalloc()ated memory */
+		void *data;
+#ifdef __ARMEB__
+		if (!(buff = netdev_alloc_skb(port->netdev, RX_BUFF_SIZE)))
+			return -ENOMEM;
+		data = buff->data;
+#else
+		if (!(buff = kmalloc(RX_BUFF_SIZE, GFP_KERNEL)))
+			return -ENOMEM;
+		data = buff;
+#endif
+		desc->buf_len = MAX_MRU;
+		desc->data = dma_map_single(&port->netdev->dev, data,
+					    RX_BUFF_SIZE, DMA_FROM_DEVICE);
+		if (dma_mapping_error(&port->netdev->dev, desc->data)) {
+			free_buffer(buff);
+			return -EIO;
+		}
+		desc->data += NET_IP_ALIGN;
+		port->rx_buff_tab[i] = buff;
+	}
+
+	return 0;
+}
+
+static void destroy_queues(struct port *port)
+{
+	int i;
+
+	if (port->desc_tab) {
+		for (i = 0; i < RX_DESCS; i++) {
+			struct desc *desc = rx_desc_ptr(port, i);
+			buffer_t *buff = port->rx_buff_tab[i];
+			if (buff) {
+				dma_unmap_single(&port->netdev->dev,
+						 desc->data - NET_IP_ALIGN,
+						 RX_BUFF_SIZE, DMA_FROM_DEVICE);
+				free_buffer(buff);
+			}
+		}
+		for (i = 0; i < TX_DESCS; i++) {
+			struct desc *desc = tx_desc_ptr(port, i);
+			buffer_t *buff = port->tx_buff_tab[i];
+			if (buff) {
+				dma_unmap_tx(port, desc);
+				free_buffer(buff);
+			}
+		}
+		dma_pool_free(dma_pool, port->desc_tab, port->desc_tab_phys);
+		port->desc_tab = NULL;
+	}
+
+	if (!ports_open && dma_pool) {
+		dma_pool_destroy(dma_pool);
+		dma_pool = NULL;
+	}
+}
+
+static int eth_open(struct net_device *dev)
+{
+	struct port *port = netdev_priv(dev);
+	struct npe *npe = port->npe;
+	struct msg msg;
+	int i, err;
+
+	if (!npe_running(npe)) {
+		err = npe_load_firmware(npe, npe_name(npe), &dev->dev);
+		if (err)
+			return err;
+
+		if (npe_recv_message(npe, &msg, "ETH_GET_STATUS")) {
+			printk(KERN_ERR "%s: %s not responding\n", dev->name,
+			       npe_name(npe));
+			return -EIO;
+		}
+		port->firmware[0] = msg.byte4;
+		port->firmware[1] = msg.byte5;
+		port->firmware[2] = msg.byte6;
+		port->firmware[3] = msg.byte7;
+	}
+
+	memset(&msg, 0, sizeof(msg));
+	msg.cmd = NPE_VLAN_SETRXQOSENTRY;
+	msg.eth_id = port->id;
+	msg.byte5 = port->plat->rxq | 0x80;
+	msg.byte7 = port->plat->rxq << 4;
+	for (i = 0; i < 8; i++) {
+		msg.byte3 = i;
+		if (npe_send_recv_message(port->npe, &msg, "ETH_SET_RXQ"))
+			return -EIO;
+	}
+
+	msg.cmd = NPE_EDB_SETPORTADDRESS;
+	msg.eth_id = PHYSICAL_ID(port->id);
+	msg.byte2 = dev->dev_addr[0];
+	msg.byte3 = dev->dev_addr[1];
+	msg.byte4 = dev->dev_addr[2];
+	msg.byte5 = dev->dev_addr[3];
+	msg.byte6 = dev->dev_addr[4];
+	msg.byte7 = dev->dev_addr[5];
+	if (npe_send_recv_message(port->npe, &msg, "ETH_SET_MAC"))
+		return -EIO;
+
+	memset(&msg, 0, sizeof(msg));
+	msg.cmd = NPE_FW_SETFIREWALLMODE;
+	msg.eth_id = port->id;
+	if (npe_send_recv_message(port->npe, &msg, "ETH_SET_FIREWALL_MODE"))
+		return -EIO;
+
+	if ((err = request_queues(port)) != 0)
+		return err;
+
+	if ((err = init_queues(port)) != 0) {
+		destroy_queues(port);
+		release_queues(port);
+		return err;
+	}
+
+	port->speed = 0;	/* force "link up" message */
+	phy_start(port->phydev);
+
+	for (i = 0; i < ETH_ALEN; i++)
+		__raw_writel(dev->dev_addr[i], &port->regs->hw_addr[i]);
+	__raw_writel(0x08, &port->regs->random_seed);
+	__raw_writel(0x12, &port->regs->partial_empty_threshold);
+	__raw_writel(0x30, &port->regs->partial_full_threshold);
+	__raw_writel(0x08, &port->regs->tx_start_bytes);
+	__raw_writel(0x15, &port->regs->tx_deferral);
+	__raw_writel(0x08, &port->regs->tx_2part_deferral[0]);
+	__raw_writel(0x07, &port->regs->tx_2part_deferral[1]);
+	__raw_writel(0x80, &port->regs->slot_time);
+	__raw_writel(0x01, &port->regs->int_clock_threshold);
+
+	/* Populate queues with buffers, no failure after this point */
+	for (i = 0; i < TX_DESCS; i++)
+		queue_put_desc(port->plat->txreadyq,
+			       tx_desc_phys(port, i), tx_desc_ptr(port, i));
+
+	for (i = 0; i < RX_DESCS; i++)
+		queue_put_desc(RXFREE_QUEUE(port->id),
+			       rx_desc_phys(port, i), rx_desc_ptr(port, i));
+
+	__raw_writel(TX_CNTRL1_RETRIES, &port->regs->tx_control[1]);
+	__raw_writel(DEFAULT_TX_CNTRL0, &port->regs->tx_control[0]);
+	__raw_writel(0, &port->regs->rx_control[1]);
+	__raw_writel(DEFAULT_RX_CNTRL0, &port->regs->rx_control[0]);
+
+	napi_enable(&port->napi);
+	eth_set_mcast_list(dev);
+	netif_start_queue(dev);
+
+	qmgr_set_irq(port->plat->rxq, QUEUE_IRQ_SRC_NOT_EMPTY,
+		     eth_rx_irq, dev);
+	if (!ports_open) {
+		qmgr_set_irq(TXDONE_QUEUE, QUEUE_IRQ_SRC_NOT_EMPTY,
+			     eth_txdone_irq, NULL);
+		qmgr_enable_irq(TXDONE_QUEUE);
+	}
+	ports_open++;
+	/* we may already have RX data, enables IRQ */
+	napi_schedule(&port->napi);
+	return 0;
+}
+
+static int eth_close(struct net_device *dev)
+{
+	struct port *port = netdev_priv(dev);
+	struct msg msg;
+	int buffs = RX_DESCS; /* allocated RX buffers */
+	int i;
+
+	ports_open--;
+	qmgr_disable_irq(port->plat->rxq);
+	napi_disable(&port->napi);
+	netif_stop_queue(dev);
+
+	while (queue_get_desc(RXFREE_QUEUE(port->id), port, 0) >= 0)
+		buffs--;
+
+	memset(&msg, 0, sizeof(msg));
+	msg.cmd = NPE_SETLOOPBACK_MODE;
+	msg.eth_id = port->id;
+	msg.byte3 = 1;
+	if (npe_send_recv_message(port->npe, &msg, "ETH_ENABLE_LOOPBACK"))
+		printk(KERN_CRIT "%s: unable to enable loopback\n", dev->name);
+
+	i = 0;
+	do {			/* drain RX buffers */
+		while (queue_get_desc(port->plat->rxq, port, 0) >= 0)
+			buffs--;
+		if (!buffs)
+			break;
+		if (qmgr_stat_empty(TX_QUEUE(port->id))) {
+			/* we have to inject some packet */
+			struct desc *desc;
+			u32 phys;
+			int n = queue_get_desc(port->plat->txreadyq, port, 1);
+			BUG_ON(n < 0);
+			desc = tx_desc_ptr(port, n);
+			phys = tx_desc_phys(port, n);
+			desc->buf_len = desc->pkt_len = 1;
+			wmb();
+			queue_put_desc(TX_QUEUE(port->id), phys, desc);
+		}
+		udelay(1);
+	} while (++i < MAX_CLOSE_WAIT);
+
+	if (buffs)
+		printk(KERN_CRIT "%s: unable to drain RX queue, %i buffer(s)"
+		       " left in NPE\n", dev->name, buffs);
+#if DEBUG_CLOSE
+	if (!buffs)
+		printk(KERN_DEBUG "Draining RX queue took %i cycles\n", i);
+#endif
+
+	buffs = TX_DESCS;
+	while (queue_get_desc(TX_QUEUE(port->id), port, 1) >= 0)
+		buffs--; /* cancel TX */
+
+	i = 0;
+	do {
+		while (queue_get_desc(port->plat->txreadyq, port, 1) >= 0)
+			buffs--;
+		if (!buffs)
+			break;
+	} while (++i < MAX_CLOSE_WAIT);
+
+	if (buffs)
+		printk(KERN_CRIT "%s: unable to drain TX queue, %i buffer(s) "
+		       "left in NPE\n", dev->name, buffs);
+#if DEBUG_CLOSE
+	if (!buffs)
+		printk(KERN_DEBUG "Draining TX queues took %i cycles\n", i);
+#endif
+
+	msg.byte3 = 0;
+	if (npe_send_recv_message(port->npe, &msg, "ETH_DISABLE_LOOPBACK"))
+		printk(KERN_CRIT "%s: unable to disable loopback\n",
+		       dev->name);
+
+	phy_stop(port->phydev);
+
+	if (!ports_open)
+		qmgr_disable_irq(TXDONE_QUEUE);
+	destroy_queues(port);
+	release_queues(port);
+	return 0;
+}
+
+static const struct net_device_ops ixp4xx_netdev_ops = {
+	.ndo_open = eth_open,
+	.ndo_stop = eth_close,
+	.ndo_start_xmit = eth_xmit,
+	.ndo_set_multicast_list = eth_set_mcast_list,
+	.ndo_do_ioctl = eth_ioctl,
+	.ndo_change_mtu = eth_change_mtu,
+	.ndo_set_mac_address = eth_mac_addr,
+	.ndo_validate_addr = eth_validate_addr,
+};
+
+static int __devinit eth_init_one(struct platform_device *pdev)
+{
+	struct port *port;
+	struct net_device *dev;
+	struct eth_plat_info *plat = pdev->dev.platform_data;
+	u32 regs_phys;
+	char phy_id[MII_BUS_ID_SIZE + 3];
+	int err;
+
+	if (ptp_filter_init(ptp_filter, ARRAY_SIZE(ptp_filter))) {
+		pr_err("ixp4xx_eth: bad ptp filter\n");
+		return -EINVAL;
+	}
+
+	if (!(dev = alloc_etherdev(sizeof(struct port))))
+		return -ENOMEM;
+
+	SET_NETDEV_DEV(dev, &pdev->dev);
+	port = netdev_priv(dev);
+	port->netdev = dev;
+	port->id = pdev->id;
+
+	switch (port->id) {
+	case IXP4XX_ETH_NPEA:
+		port->regs = (struct eth_regs __iomem *)IXP4XX_EthA_BASE_VIRT;
+		regs_phys  = IXP4XX_EthA_BASE_PHYS;
+		break;
+	case IXP4XX_ETH_NPEB:
+		port->regs = (struct eth_regs __iomem *)IXP4XX_EthB_BASE_VIRT;
+		regs_phys  = IXP4XX_EthB_BASE_PHYS;
+		break;
+	case IXP4XX_ETH_NPEC:
+		port->regs = (struct eth_regs __iomem *)IXP4XX_EthC_BASE_VIRT;
+		regs_phys  = IXP4XX_EthC_BASE_PHYS;
+		break;
+	default:
+		err = -ENODEV;
+		goto err_free;
+	}
+
+	dev->netdev_ops = &ixp4xx_netdev_ops;
+	dev->ethtool_ops = &ixp4xx_ethtool_ops;
+	dev->tx_queue_len = 100;
+
+	netif_napi_add(dev, &port->napi, eth_poll, NAPI_WEIGHT);
+
+	if (!(port->npe = npe_request(NPE_ID(port->id)))) {
+		err = -EIO;
+		goto err_free;
+	}
+
+	port->mem_res = request_mem_region(regs_phys, REGS_SIZE, dev->name);
+	if (!port->mem_res) {
+		err = -EBUSY;
+		goto err_npe_rel;
+	}
+
+	port->plat = plat;
+	npe_port_tab[NPE_ID(port->id)] = port;
+	memcpy(dev->dev_addr, plat->hwaddr, ETH_ALEN);
+
+	platform_set_drvdata(pdev, dev);
+
+	__raw_writel(DEFAULT_CORE_CNTRL | CORE_RESET,
+		     &port->regs->core_control);
+	udelay(50);
+	__raw_writel(DEFAULT_CORE_CNTRL, &port->regs->core_control);
+	udelay(50);
+
+	snprintf(phy_id, MII_BUS_ID_SIZE + 3, PHY_ID_FMT, "0", plat->phy);
+	port->phydev = phy_connect(dev, phy_id, &ixp4xx_adjust_link, 0,
+				   PHY_INTERFACE_MODE_MII);
+	if (IS_ERR(port->phydev)) {
+		err = PTR_ERR(port->phydev);
+		goto err_free_mem;
+	}
+
+	port->phydev->irq = PHY_POLL;
+
+	if ((err = register_netdev(dev)))
+		goto err_phy_dis;
+
+	printk(KERN_INFO "%s: MII PHY %i on %s\n", dev->name, plat->phy,
+	       npe_name(port->npe));
+
+	return 0;
+
+err_phy_dis:
+	phy_disconnect(port->phydev);
+err_free_mem:
+	npe_port_tab[NPE_ID(port->id)] = NULL;
+	platform_set_drvdata(pdev, NULL);
+	release_resource(port->mem_res);
+err_npe_rel:
+	npe_release(port->npe);
+err_free:
+	free_netdev(dev);
+	return err;
+}
+
+static int __devexit eth_remove_one(struct platform_device *pdev)
+{
+	struct net_device *dev = platform_get_drvdata(pdev);
+	struct port *port = netdev_priv(dev);
+
+	unregister_netdev(dev);
+	phy_disconnect(port->phydev);
+	npe_port_tab[NPE_ID(port->id)] = NULL;
+	platform_set_drvdata(pdev, NULL);
+	npe_release(port->npe);
+	release_resource(port->mem_res);
+	free_netdev(dev);
+	return 0;
+}
+
+static struct platform_driver ixp4xx_eth_driver = {
+	.driver.name	= DRV_NAME,
+	.probe		= eth_init_one,
+	.remove		= eth_remove_one,
+};
+
+static int __init eth_init_module(void)
+{
+	int err;
+	if ((err = ixp4xx_mdio_register()))
+		return err;
+	return platform_driver_register(&ixp4xx_eth_driver);
+}
+
+static void __exit eth_cleanup_module(void)
+{
+	platform_driver_unregister(&ixp4xx_eth_driver);
+	ixp4xx_mdio_remove();
+}
+
+MODULE_AUTHOR("Krzysztof Halasa");
+MODULE_DESCRIPTION("Intel IXP4xx Ethernet driver");
+MODULE_LICENSE("GPL v2");
+MODULE_ALIAS("platform:ixp4xx_eth");
+module_init(eth_init_module);
+module_exit(eth_cleanup_module);