91C94

91C94 SMSC | Alldatasheet

Document overview

• Manufacturer or author: Provided By ALLDATASHEET.COM(FREE DATASHEET DOWNLOAD SITE)
• PDF pages: 120

Technical content

Single-Chip Ethernet Controller with RAM

FEATURES

• ISA/PCMCIA Single-Chip Ethernet Controller
• 4608 Bytes of On-Chip RAM
• Supports IEEE 802.3 (ANSI 8802-3 ) Ethernet Standards
• Simultasking TM - Early Transmit and Early Receive Functions
• Hardware Memory Management Unit
• Optional Configuration via Serial EEPROM Interface ( Jumperless)
• Single +5V Power Supply
• Low Power CMOS Design
• 100 Pin QFP, TQFP and VTQFP Pac kage Bus Interface
• Direct Interface to ISA and PCMCIA with No Wait States
• Flexible Bus Interface
• 16-Bit Data and Control Paths
• Fast Access Time (40 ns)
• Pipelined Data Path
• Handles Block Word Transfers for Any Alignment
• High Performance Chained ("Back-to- Back") Transmit and Receive
• Pin Compatible with LAN91C92 (in ISA mode)
• Flat Memory Structure for Low CPU Overhead
• Dynamic Memory Allocation Between Transmit and Receive
• Buffered Architecture, Insensitive to Bus Latencies (No Overruns/ Underruns)
• Supports Boot PROM for Diskless ISA

Applications

• Integrates 10BASE-T Transceiver Functions: - Driver and Receiver - Link Integrity Test - Receive Polarit y Detection and Correction
• Integrates AUI Interface
• Implements 10 Mbps Manchester Encoding/Decoding and Clock Recovery
• Automatic Retransmission, Bad Packet Rejection, and Transmit Padding
• External and Internal Loopback Modes
• Four Direct Driven LEDs for Status/ Diagnostics Software Drivers
• Uses Certified LAN9000 Drivers Which Operate with Every Major Network Operating System
• Software Driver Compatible with LAN91C92 and LAN91C100 (100 Mbps) Controllers in ISA Mode
• Softwa re Driver Utilizes Full Capability of 32 Bit Microprocessor Simultasking is a trademark and SMSC is a registered trademark of Standard Microsystems Corporation

80 Arkay Drive

Hauppauge , NY. 11788 (516) 435-6000 FAX (516) 273-3123

100 Pin QFP

100 Pin TQFP

The LAN91C94 is a VLSI Ethernet Controller that combines ISA and PCMCIA interfaces in one chip. LAN91C94 integrates all the MAC and physical layer functions, as well as the packet RAM, needed to implement a high performance 10BASE-T (twisted pair) node. For 10BASE5 (thick coax), 10BASE2 (thin coax), and 10BASE-F (fiber) implementations, the LAN91C94 interfaces to external transceivers via its AUI port. Only one additional IC is required on most applications. The LAN91C94 occupies 16 I/0 locations and no memory space except for PCMCIA attribute memory space. The same I/O space is used for both ISA and PCMCIA operations. The LAN91C94 can directly interface the ISA and PCMCIA buses and deliver no wait state operation. Its shared memory is sequentially accessed with 40ns access times to any of its registers, including its packet memory. No DMA services are used by the LAN91C94, virtually decoupling network traffic from local or system bus utilization. For packet memory management, the LAN91C94 integrates a unique hardware Memory Management Unit (MMU) with enhanced performance and decreased software overhead when compared to ring buffer and linked list architectures. The LAN91C94 is portable to different CPU and bus platforms due to its flexible bus interface, flat memory structure (no pointers), and its loosely coupled buffered architecture (not sensitive to latency). OVERVIEW A unique architecture allows the LAN91C94 to combine high performance, flexibility, high integration and simple software interface. The LAN91C94 incorporates the LAN91C92 functionality for ISA environments, as well as a PCMCIA interface and attribute registers. Mode selection between ISA and PCMCIA is static and is done only once at the end of a reset. The LAN91C94 consists of the same logical I/O register structure in ISA and PCMCIA modes. However, some of the signals used to access the PCMCIA differ from the ISA mode. The MMU (Memory Management Unit) architecture used by the LAN91C94 combines the simplicity and low overhead of fixed areas with the flexibility of linked lists providing improved performance over other methods. Packet reception and transmission are determined by memory availability. All other resources are always available if memory is available. To complement this flexible architecture , all ISA bus interface functions are incorporated in the LAN91C94, as well as a 4608 byte packet RAM and serial EEPROM- based setup. The user can select or modify configuration choices. The LAN91C94 integrates most of the 802.3 functionality, incorporating the MAC layer protocol, the physical layer encoding and decoding functions with the ability to handle the AUI interface. For twisted pair networks, LAN91C94 integrates the twisted pair transceiver as well as the link integrity test functions. The LAN91C94 is a true 10BASE-T single chip able to interface a system or a local bus. Directly-driven LEDs for installation and run- time diagnostics are provided, as well as 802.3 statistics gathering to facilitate network management.

The LAN91C94 offers: High integration: Single chip adapter including: Packet RAM ISA bus interface PCMCIA interface EEPROM interface Encoder decoder with AUI interface 10BASE-T transceiver High performance: Chained ("Back-to-back") packet handling with no CPU intervention: Queues transmit packets Queues receive packets Stores results in memory along with packet Queues interrupts Optional single interrupt upon completion of transmit chain. Fast block move operation for load/unload: CPU sees packet bytes as if stored contiguously. Handles 16 bit transfers regardless of address alignment. Access to packet through fixed window. Fast bus interface: Compatible with ISA type and faster buses. Flexibility: Flexible packet and header processing: Can be set to Simultasking - Early Receive and Transmit modes. Can access any byte in the packet. Can immediately remove undesired packets from queue. Can move packets from receive to transmit queue . Can alter receive processing order without copying data. Can discard or enqueue again a failed transmission. Resource allocation: Memory dynamically allocated for transmit and receive. Can automatically release memory on successful transmission. Configuration: ISA: Uses non-volatile jumperless setup via serial EEPROM. PCMCIA: Uses ROM or Flash ROM for attribute memory storage and optional serial EEPROM for IEEE address storage. PCMCIA I/O ignores address lines A4- A15 and relies on the PCMCIA host, decoding for the slot. nROM/ nPCMCIA, on LAN91C94, is left open with a pullup for ISA mode. This pin is sampled at the end of RESET. If found low, the LAN91C94 is configured for PCMCIA mode.

ISA vs. PCMCIA PIN GROUPS FUNCTION ISA PCMCIA SYSTEM ADDRESS BUS A0-9 A10 A11 A12-14 A15 A16-18 A19 AEN A0-9 nFWE nFCS A15 nCE1 nREG SYSTEM DATA BUS D0-15 D0-15 SYSTEM CONTROL BUS RESET BALE nIORD IOWR MEMR IOCHRDY nIOCS16 SBHE INTR0 INTR1 INTR2 INTR3 RESET nWE nIORD nIOWR nOE nWAIT nIOIS16 nCE2 IREQ INPACK SERIAL EEPROM EEDI EEDO EECS EESK ENEEP IOS0 IOS1 IOS2 EEDI EEDO EECS EESK ENEEP IOS0 IOS1 IOS2 CRYSTAL OSC. XTAL1 XTAL2 XTAL1 XTAL2 POWER VDD AVDD VDD AVDD GROUND GND AGND GND AGND 10BASE-T interface TPERXP TPERXN TPETXP TPETXN TPETXDP TPETXDN TPERXP TPERXN TPETXP TPETXN TPETXDP TPETXDN

ISA vs. PCMCIA PIN GROUPS FUNCTION ISA PCMCIA AUI interface RECP RECN COLP COLN TXP/ nCOLL TXN/ nCRS RECP RECN COLP COLN TXP/ nCOLL TXN/ nCRS LEDs nLNKLED/TXD nRXLED/RXCLK nBSELED/RXD nTXLED/ nTXEN nLNKLED/TXD nRXLED/RXCLK nBSELED/RXD nTXLED/ nTXEN MISC. RBIAS PWRDWN/TXCLK nXENDEC EN16 ROM RBIAS PWRDWN/TXCLK nXENDEC EN16 PCMCIA DESCRIPTION OF PIN FUNCTIONS PIN NUMBER QFP VTQFP/ TQFP NAME SYMBOL BUFFER TYPE DESCRIPTION 95 93 nROM/ nPCMCIA nROM I/O4 with pullup This pin is sampled at the end of RESET. When sampled low, the LAN91C94 is configured for PCMCIA operation and all pin definitions correspond to the PCMCIA mode. For ISA operation, this pin is left open and is used as a ROM chip select output. It turns active when MEMR* is low and the address bus contains a valid ROM address. In ISA mode the LAN91C94 is pin compatible with the LAN91C92 28-30 32-38 26-28 30-36 Address A0-9 I Input - Input address lines 0 through 9 39 37 A10/nFWE I ISA - Input - Input address line 10 PCMCIA - Output - Flash Memory Write Enable used for programming attribute memory. Is active (low) when nWE=0 and COR2=1

ISA - Input - Input address line 11 PCMCIA - Output - Flash Memory Chip Select used to access attribute memory. Is active (low) when nREG=0, nCE1=0 and A15=0 42-48 40-46 Address A12-18 I Input - Input address lines 12 through 49 47 A19/nCE1 I with pullup ISA - Input - Input address line 19 PCMCIA - Card Enable 1 input. Used to select card on even byte accesses 54 52 Address Enable AEN/ nREG I with pullup ISA - Address enable input. Used as an address qualifier. Address decoding is enabled only when AEN is low PCMCIA - Attribute memory and IO select input. Asserted when the card attribute space or IO space is being accessed 26 24 nByte High nSBHE/ nCE2 I with pullup ISA - Byte High Enable input. Asserted (low) by the system to indicate a data transfer on the upper data byte PCMCIA - Card Enable 2 input. To select card on odd byte accesses 55 53 Ready IOCHRDY/ nWAIT OD24 with pullup ISA - Output - Optionally used by the LAN91C94 to extend host cycles PCMCIA - Output - Optionally used by the LAN91C94 to extend host cycles 57-60 62-65 9-12 14-17 55-58 60-63 7-10 12-15 Data Bus D0-15 I/O24 Bidirectional - 16 bit data bus to access the LAN91C94 internal registers. The data bus has weak internal pullups. Supports direct connection to the system bus without external buffering

Input - Active high Reset. This input is not considered active (except in powerdown mode) unless it is active for at least 100ns to filter narrow glitches 27 25 Address Latch BALE/ nWE IS with pullup ISA - Input - Address strobe. For systems that require address latching. The falling edge of BALE latches address lines and nSBHE PCMCIA - Write Enable input. For writing into COR and CSR registers as well as attribute memory space 19 17 Interrupt INTR0/ nIREQ O24 ISA - Active high interrupt signal. The interrupt line selection is determined by the value of INT SEL1-0 bits in the Configuration Register. This interrupt is tri-stated when not selected PCMCIA - Active low interrupt request output 20 18 INTR1/ nINPACK O24 ISA - Output - Active high interrupt signal. The interrupt line selection is determined by the value of INT SEL1-0 bits in the Configuration Register. This interrupt is tri-stated when not selected PCMCIA - Output asserted to acknowledge read cycles when the card is enabled 22,23 20,21 Interrupt INTR2-3 O24 ISA - Outputs - Active high interrupt signals. The interrupt line selection is determined by the value of INT SEL1-0 bits in the Configuration Register. These interrupts are tri-stated when not selected

OD24 ISA - Active low output asserted in 16 bit mode when AEN is low and A4-A15 decode to the LAN91C94 address programmed into the high byte of the Base Address Register PCMCIA - Active low output asserted whenever the LAN91C94 is in 16 bit mode, COR0 bit is high, and REG* is low 51 49 nI/O Read nIORD IS with pullup Input - Active low read strobe to access the LAN91C94 IO space 52 50 nIOWR IS with pullup Input - Active low write strobe to access the LAN91C94 IO space 53 51 nMEMR/ nOE IS with pullup ISA - Active low signal used by the host processor to read from the external ROM. PCMCIA - Output Enable input used to read from the COR, CSR, and attribute memory 7 5 EEPROM Clock EESK O4 Output - 4usec clock used to shift data in and out of a serial EEPROM 6 4 EEPROM Select EECS O4 Output - Serial EEPROM chip select 4 2 EEPROM Data Out EEDO/ SDOUT O4 Output - Connected to the DI input of the serial EEPROM 5 3 EEPROM Data In EEDI I with pull- down Input - Connected to the DO output of the serial EEPROM 98, 99,1 96,97 I/O Base IOS0-2 I with pullup Input - External switches can be connected to these lines to select between predefined EEPROM configurations. The values of these pins are readable 72 70 nTransmit Led/ nTransmit Enable nTXLED/ nTXEN OD16 O162 INTERNAL ENDEC - Transmit LED output EXTERNAL ENDEC - Active low Transmit Enable output

INTERNAL ENDEC - Board Select LED activated by accesses to I/O space ( nIORD or nIOWR active with AEN low and valid address decode for ISA, and with nREG low and COR0 high for PCMCIA). The pulse is stretched beyond the access duration to make the LED visible EXTERNAL ENDEC - NRZ receive data input 71 69 nReceive Led/ nReceive Clock nRXLED/ nRXCLK OD16 I with pullup INTERNAL ENDEC - Receive LED output EXTERNAL ENDEC - Receive clock input 70 68 nLink LED nLNKLED/ TXD OD16 O162 INTERNAL ENDEC - Link LED output . Note: The output will not be driven low during a reset EXTERNAL ENDEC - Transmit Data output. 3 1 Enable EEPROM ENEEP I with pullup Input - This active high input enables the EEPROM to be read or written by the LAN91C94. Internally pulled up. Must be connected to ground if no serial EEPROM is used 93 91 nEnable 16 Bit nEN16 I with pullup Input - When low the LAN91C94 is configured for 16 bit bus operation. If left open the LAN91C94 works in 8 bit bus mode. 16 bit configuration can also be programmed via serial EEPROM, software initialization of the CONFIGURATION REGISTER, and PCMCIA configuration space

Iclk An external parallel resonance 20MHz crystal should be connected across these pins. If an external clock source is used, it should be connected to XTAL1 and XTAL2 should be left open AUI Receive RECP RECN Diff. Input AUI receive differential inputs AUI Transmit TXP/ nCOLL TXN/ nCRS Diff. Output I INTERNAL ENDEC - ( nXENDEC pin open). In this mode, TXP and TXN are the AUI transmit differential outputs. They must be externally pulled up using 150 ohm resistors EXTERNAL ENDEC - ( nXENDEC pin tied low). In this mode the pins are inputs used for collision and carrier sense functions AUI Collision COLP COLN Diff. Input AUI collision differential inputs. A collision is indicated by a 10MHz signal at this input pair TPE Receive TPERXP TPERXN Diff. Input 10BASE-T receive differential inputs TPE Transmit TPETXP TPETXN Diff. Output INTERNAL ENDEC - 10BASE-T transmit differential outputs TPE Transmit Delayed TPETXDP TPETXDN Diff. Output 10BASE-T delayed transmit differential outputs. Used in combination with TPETXP and TPETXN to generate the 10BASE-T transmit pre-distortion 68 66 Transmit Clock PWRDWN/ TXCLK I with pullup INTERNAL ENDEC - Powerdown input. It keeps the LAN91C94 in powerdown mode when high (open). Must be low for normal operation EXTERNAL ENDEC - Transmit clock input from external ENDEC. 90 88 Bias Resistor RBIAS Analog Input A 22kohm 1% resistor should be connected between this pin and analog ground

When tied low, the LAN91C94 is configured for EXTERNAL ENDEC. When tied high or left open, the LAN91C94 uses its internal encoder/decoder 13,21 40,50 61,100 11,19 48,59 98, 38 VDD +5V power supply pins 73,81 71,79 Analog Power AVDD +5V analog power supply pins 2,8 18,24 31,56,6 6,94 100,6 16,22, 29,54, 64,92 Ground GND Ground pins 80,88 78,86 Analog Ground AGND Analog ground pins BUFFER SYMBOLS O4 Output buffer with 2mA source and 4mA sink. O162 Output buffer with 2mA source and 16mA sink. O24 Output buffer with 12mA source and 24mA sink. OD16 Open drain buffer with 16mA sink. OD24 Open drain buffer with 24mA sink. I/O24 Bidirectional buffer with 12mA source and 24mA sink. I Input buffer with TTL levels IS Input buffer with Schmitt Trigger Hysteresis Iclk Clock input buffer DC levels and conditions defined in the DC Electrical Characteristics section.

Table 1 - Bus Transactions in ISA Mode A0 nSBHE D0-7 D8-15

8 BIT MODE

((nEN16=1) (16BIT=0))

0 X even byte -

1 X odd byte -

16 BIT MODE

Table 2 - Bus Transactions in PCMCIA Mode A0 nCE1 nCE2 D0-7 D8-15 ((IOis8=1) + (nEN16=1).(16BIT=0)) 0 0 X even byte - 1 0 X odd byte - X 1 X NO CYCLE 16BIT: CONFIGURATION REGISTER bit 7 IOis8: CSR register bit 5 nEN16: pin nEN16

FIGURE 1 – SYSTEM DIAGRAM FOR ISA BUS WITH BOOT PROM TPETXP TPETXN TPETXDP TPETXDN TPERXP TPERXN TXP TXN RECP RECN COLP COLN XTAL1 XTAL2 EEDI EECS EEDO EESK IOS0 IOS1 IOS2 nEN16 ENEEP AEN BALE RESET nSBHE nIORD, nIOW nMEMR D0-15 A0-19 nROM nIOCS16 IOCHRDY INTR0-3 10BASET AUI CABLE SIDE DIAGNOSTIC LEDs SERIAL EEPROM 4 20 M Hz SYSTEM BUS ADDRESS PROM DATA nIRQ LAN91C94 N/C RBIAS BUFFER

FIGURE 2 – LAN91C94 INTERNAL BLOCK DIAGRAM DATA BUS ADDRESS BUS CONTROL BUS INTERFACE ARBITER CSMA/CD ENDEC AUI MMU TWISTED PAIR TRANSCEIVER 10BASE-T RAM

FIGURE 3A - LAN91C94 PCMCIA 10BASE-T/AUI SCHEMATIC

LAN91C94 ISA 10BASE-T/COAX SCHEMATIC

Except for the bus interface, the functional behavior of the LAN91C94 after initial configuration is identical for ISA and PCMCIA modes. The LAN91C94 includes an arbitrated shared memory of 4608 bytes, accessed by the CPU through two sequential access regions of 2 kbytes each, as well as a register area. The MMU unit allocates RAM memory to be used for transmit and receive packets, using 256 byte pages. The arbitration is transparent to the CPU in every sense. There is no speed penalty for ISA type of machines due to arbitration. There are no restrictions on what locations can be accessed at any time. RAM accesses as well as MMU requests are arbitrated. The RAM is accessed by mapping it into I/O space for sequential access. Except for the RAM accesses and the MMU request/release commands, I/O accesses are not arbitrated. The I/O space is 16 bits wide. Provisions for 8 bit systems are handled by the bus interface. In the system memory space, up to 64 kbytes are decoded by the LAN91C94 as expansion ROM. The ROM expansion area is 8 bits wide. Device configuration is done using a serial EEPROM, with support for modifications to the EEPROM at installation time. A Flash ROM is supported for PCMCIA attribute memory. The CSMA/CD core implements the 802.3 MAC layer protocol. It has two independent interfaces, the data path and the control path. Both interfaces are 16 bits wide. The control path provides a set of registers used to configure and control the block. These registers are accessible by the CPU through the LAN91C94 I/O space. The data path is of sequential access nature and typically works in one direction at any given time. An internal DMA type of interface connects the data path to the device RAM through the arbiter and MMU. The CSMA/CD data path interface is not accessible to the host CPU. The internal DMA interface can arbitrate for RAM access and request memory from the MMU when necessary. An encoder/decoder block interfaces the CSMA/CD block on the serial side. The encoder will do the Manchester encoding of the transmit data at 10 Mbit/s, while the decoder will recover the receive clock, and decode received data. Carrier and Collision detection signals are also handled by this block and relayed to the CSMA/CD block. The encoder/decoder block can interface the network through the AUI interface pairs, or it can be programmed to use the internal 10BASE-T transceiver and connect to a twisted pair network. The twisted pair interface takes care of the medium dependent signaling for 10BASE-T type of networks. It is responsible for line interface (with external pulse transformers and pre- distortion resistors), collision detection as well as the link integrity test function.

The LAN91C94 provides a 16 bit data path into RAM. The RAM is private and can only be accessed by the system via the arbiter. RAM memory is managed by the MMU. Byte and word accesses to the RAM are supported. If the system to SRAM bandwidth is insufficient the LAN91C94 will automatically use its IOCHRDY line for flow control. However, for ISA buses, IOCHRDY will never be negated. BUFFER MEMORY The logical addresses for RAM access are divided into TX area and RX area. Each one of the areas is 2 kbytes long and accommodates one maximum size Ethernet packet. The TX area is seen by the CPU as a window through which packets can be loaded into memory before queuing them in the TX FIFO of packets. The TX area can also be used to examine the transmit completion status after packet transmission. The RX area is associated to the output of the RX FIFO of packets, and is used to access receive packet data and status information. The logical address is specified by loading the address pointer register. The pointer can automatically increment on accesses. All accesses to the RAM are done via I/O space. A bit in the address pointer also specifies if the address refers to the TX or RX area. In the TX area, the host CPU has access to the next transmit packet being prepared for transmission. In the RX area, it has access to the first receive packet not processed by the CPU yet. The FIFO of packets, existing beneath the TX and RX areas, is managed by the MMU. The MMU dynamically allocates and releases memory to be used by the transmit and receive functions. The MMU related parameters for the LAN91C94 are: RAM size 4608 bytes (internal) Max. number of packets 18 Max. pages per packet 6 Page size 256 bytes

FIGURE 4 – MAPPING AND PAGING VS. RECEIVE AND TX AREA PAGE = 256 bytes PHYSICAL MEMORY TX PACKET NUMBER RX PACKET NUMBER MMU MMU 2K TX AREA 2K RX AREA 11-BIT LOGICAL ADDRESS POINTER REGISTER RCV BIT RCV VS. TX AREA SELECTION

FIGURE 5 – TRANSMIT QUEUES AND MAPPING B A B C STATUS COUNT DATA STATUS COUNT DATA PACKET #A PACKET #B PACKET NUMBER REGISTER TX FIFO TO CSMA LINEAR ADDRESS MMU MAPPING MEMORY CPU SIDE STATUS COUNT DATA PACKET #C TX COMPLETION FIFO FIFO PORTS REGISTER C

FIGURE 6 – RECEIVE QUEUE AND MAPPING D E D E STATUS COUNT DATA STATUS COUNT DATA PACKET #D PACKET #E FIFO PORTS REGIST ER RX FIF O FROM CSMA LINEAR ADDRESS MMU MAPPING MEMORY CPU SIDE

FIGURE 7 – LAN91C94 INTERNAL BLOCK DIAGRAM WITH DATA PATH BUS INTERFACE ARBITER MMU BUFFER RAM CSMA/CD ENDEC TWISTED PAIR TRANSCEIVER AUI 10BASET DATA BUS ADDRESS BUS CONTROL EEPROM EEPROM WRITE DATA REG. READ DATA REG. TX FIFO TX COMPL FIFO RX FIFO DMA INTERFACE ADDRESSDATA

FIGURE 8 – LOGICAL ADDRESS GENERATION AND RELEVENT REGISTERS TX FIFO TX CO M PLETIO N FIFO PNR RX FIFO PACKET NUMBER TX (PACKET NUMBER REG) RCV POINTER REGISTER & COUNTER LOAD INC R X FIFO READ PO INTER LATCH PO INTER REG ISTER PACKET # ADDRESSDM A DATA CSM A/CD CPU/nLAN (FROM ARBITER) LO GICAL ADDRESS PACKET # M M U PHYSICAL ADDRESS DATA ADDRESS W RITE R EG READ R EG WRITE DATA RAM DATA REG ISTER (FIFO READ DATA T/nR

PACKET FORMAT IN BUFFER MEMORY The packet format in memory is similar for the TRANSMIT and RECEIVE areas. The first word is reserved for the status word, the next word is used to specify the total number of bytes, and that in turn is followed by the data area. The data area holds the packet itself, and its length is determined by the byte count. The packet memory format is word oriented. FIGURE 9 – DATA PACKET FORMAT TRANSMIT PACKET RECEIVE PACKET STATUS WORD Written by CSMA upon transmit completion (see Status Register). Written by CSMA upon receive completion (see RX Frame Status Word). BYTE COUNT Written by CPU. Written by CSMA. DATA AREA Written/modified by CPU. Written by CSMA. CONTROL BYTE Written by CPU to control ODD/EVEN data bytes. Written by CSMA. Also has ODD/EVEN bit. RESERVED BYTE COUNT (always even) STATUS WORD DATA AREA LAST DATA BYTE (if odd) bit0bit15 RAM OFFSET (DECIMAL)

2046 Max

BYTE COUNT - Divided by two, it defines the total number of words, including the STATUS WORD, the BYTE COUNT WORD, the DATA AREA and the CONTROL BYTE. The receive byte count always appears as even, the ODDFRM bit of the receive status word indicates if the low byte of the last word is relevant. The transmit byte count least significant bit will be assumed 0 by the controller regardless of the value written in memory. DATA AREA The data area starts at offset 4 of the packet structure, and it can extend for up to 2043 bytes. The data area contains six bytes of DESTINATION ADDRESS followed by six bytes of SOURCE ADDRESS, followed by a variable length number of bytes. On transmit, all bytes are provided by the CPU, including the source address. The LAN91C94 does not insert its own source address. On receive, all bytes are provided by the CSMA side. The 802.3 Frame Length word (Frame Type in Ethernet) is not interpreted by the LAN91C94. It is treated transparently as data for both transmit and receive operations. CONTROL BYTE The CONTROL BYTE always resides on the high byte of the last word. For transmit packets the CONTROL BYTE is written by the CPU as: ODD - If set, indicates an odd number of bytes, with the last byte being right before the CONTROL BYTE. If clear, the number of data bytes is even and the byte before the CONTROL BYTE is not transmitted. CRC - When set, CRC will be appended to the frame. This bit has only meaning if the NOCRC bit in the TCR is set. For receive packets the CONTROL BYTE is written by the controller as: ODD - If set, indicates an odd number of bytes, with the last byte being right before the CONTROL BYTE. If clear, the number of data bytes is even and the byte before the CONTROL BYTE should be ignored. X X ODD CRC 0 0 0 0 0 1 ODD 0 0 0 0 0

This word is written at the beginning of each receive frame in memory. It is not available as a register. HIGH BYTE ALGN ERR BROD CAST BADCRC ODDFRM TOOLNG TOO SHORT LOW BYTE HASH VALUE MULT CAST 5 4 3 2 1 0 ALGNERR Frame had alignment error. BRODCAST Receive frame was broadcast. BADCRC Frame had CRC error. ODDFRM This bit when set indicates that the received frame had an odd number of bytes. TOOLNG The received frame is longer than the 802.3 maximum size (1518 bytes on the cable). TOOSHORT The received frame is shorter than the 802.3 minimum size (64 bytes on the cable). HASH VALUE Provides the hash value used to index the Multicast Registers. Can be used by receive routines to speed up the group address search. The hash value consists of the six most significant bits of the CRC calculated on the Destination Address, and maps into the 64 bit multicast table. Bits 5,4,3 of the hash value select a byte of the multicast table, while bits 2,1,0 determine the bit within the byte selected. Examples of the address mapping: ADDRESS HASH VALUE 5-0 MULTICAST TABLE BIT ED 00 00 00 00 00 0D 00 00 00 00 00 01 00 00 00 00 00 2F 00 00 00 00 00 000 000 010 000 100 111 111 111 MT-0 bit 0 MT-2 bit 0 MT-4 bit 7 MT-7 bit 7 MULTCAST Receive frame was multicast. If hash value corresponds to a multicast table bit that is set, and the address was a multicast, the packet will pass address filtering regardless of other filtering criteria.

FIGURE 10 – LAN91C94 REGISTERS BANK0 BANK1 BANK2 BANK3 A C E TCR EPH STATUS RCR COUNTER MIR MCR BANK SELECT REGISTER CONFIG BASE INDIVIDUAL ADDRESS GENERAL PURPOSE CONTROL MMU COMMAND PNR ARR FIFO PORTS POINTER DATA DATA INTERRUPT MULTICAST TABLE Non volatile, stored in EEPROM. BANK2 Register used during run time.

16 Bit Registers 16 Bit Registers 16 Bit Registers 16 Bit Registers

(PCMCIA mode only) In PCMCIA mode, the attribute memory space is an eight bit space decoded by the LAN91C94 using addresses A0-9, A15 along with the following control signals: nREG, nCE1, nWE, nOE. The LAN91C94 has the following two registers in memory space: OFFSET 8000 NAME CARD OPTION REGISTER TYPE READ/WRITE SYMBOL COR This register is used to enable the PCMCIA card, allow programming of the external attribute memory, and to generate soft reset. SRESET LEVIRQ (read only) 0 0 0 COR2 0 COR0 0 1 0 0 0 0 0 0 SRESET - This bit, when set will reset the LAN91C94. It is valid in PCMCIA mode only. The bit does not sample the ISA/PCMCIA mode. The bit is cleared writing it low or by a hardware reset. It does not preserve any register. It resembles a hardware reset, including the PWRDWN gating. LEVIRQ - This bit reads always high to indicate that the LAN91C94 uses level mode interrupts. COR2 - This bit, when set, allows writing into the external attribute memory. COR0 - This bit, when clear, disables the LAN91C94 I/O space and forces nIREQ inactive. This bit defaults low and will be set by the host PCMCIA system to configure the card for I/O operation.

(PCMCIA mode only) OFFSET 8002 NAME CONFIGURATION/STATUS REGISTER TYPE READ/WRITE SYMBOL CSR 0 0 IOis8 0 0 0 INTR 0 0 0 0 0 0 0 0 0 IOis8 - This bit when set, indicates to the LAN91C94 that the host is limited to 8 bit interface. In PCMCIA mode the LAN91C94 will operate in 8 bit mode whenever ((IOis8= 1) + (nEN16 = 1 ) . (16BIT = 0)). Otherwise the LAN91C94 operates in 16 bit mode. INTR - This read only bit reflects the status of the nIREQ pin. The INTR bit is set when nIREQ is low, and clear when nIREQ is high. NOTE: The COR and CSR bits have no effect on ISA mode.

(ISA and PCMCIA mode) In ISA mode, the base I/O space is determined by the IOS0-2 inputs and the EEPROM contents. A4-15 are compared against the base I/O address for I/O space accesses. In PCMCIA mode nREG (along with nIORD or nIOWR) defines an I/O access regardless of the A4-15 value. To limit the I/O space requirements to 16 locations, the registers are assigned to different banks. The last word of the I/O area is shared by all banks and can be used to change the bank in use. Registers are 16 bits wide and are described using the following convention: OFFSET NAME TYPE SYMBOL HIGH BYTE BIT 15 BIT 14 BIT 13 BIT 12 BIT 11 BIT 10 BIT 9 BIT 8 X X X X X X X X LOW BYTE BIT 7 BIT 6 BIT 5 BIT 4 BIT 3 BIT 2 BIT 1 BIT 0 X X X X X X X X OFFSET - Defines the address offset within the IOBASE where the register can be accessed at, provided the bank select has the appropriate value. The offset specifies the address of the even byte (bits 0-7) or the address of the complete word. The odd byte can be accessed using address (offset + 1). Some registers (like the Interrupt Ack., or like Interrupt Mask) are functionally described as two eight bit registers, in that case the offset of each one is independently specified. Regardless of the functional description, when the LAN91C94 is in 16 bit mode, all registers can be accessed as words or bytes. The default bit values upon hard reset are highlighted below each register.

Table 3 - Internal I/O Space Mapping BANK0 BANK1 BANK2 BANK3

0 TCR CONFIG MMU COMMAND MT0-1

2 EPH STATUS BASE PNR ARR MT2-3

4 RCR IA0-1 FIFO PORTS MT4-5

6 COUNTER IA2-3 POINTER MT6-7

8 MIR IA4-5 DATA MGMT

A MCR GENERAL PURPOSE DATA REVISION C RESERVED (0) CONTROL INTERRUPT ERCV E BANK SELECT BANK SELECT BANK SELECT BANK SELECT

E NAME BANK SELECT REGISTER TYPE READ/WRITE SYMBOL BSR HIGH BYTE 0 0 1 1 0 0 1 1 0 0 1 1 0 0 1 1 LOW BYTE BS2 BS1 BS0 X X X X X 0 0 0 BS2, BS1, BS0 - Determine the bank presently in use. This register is always accessible and is used to select the register bank in use. The upper byte always reads as 33h and can be used to help determine the I/O location of the LAN91C94. The BANK SELECT REGISTER is always accessible regardless of the value of BS0-2. The LAN91C94 implements only 4 banks, therefore accesses to non-existing banks (BS2=1) are ignored. BS1 and BS0 determine the bank presently in use. BS2 BS1 BS0 BANK# X X None

This register holds bits programmed by the CPU to control some of the protocol transmit options. HIGH BYTE 0 EPH LOOP STP SQET FDUPLX MON_ CSN NOCRC

0 X 0 0 0 0 X 0

BYTE PAD_EN FORCOL LOOP TXENA

0 X X X X 0 0 0

EPH_LOOP - Internal loopback at the EPH block. Does not exercise the encoder decoder. Serial data is looped back when set. Defaults low. Note: After exiting the loopback test, SRESET in Card Option Register or SOFT_RST in RCR must be set before returning to normal operation. STP_SQET - Stop transmission on SQET error. If set, stops and disables transmitter on SQE test error. Does not stop on SQET error and transmits next frame if clear. Defaults low. FDUPLX - When set it enables full duplex operation. This will cause frames to be received if they pass the address filter regardless of the source for the frame. When clear the node will not receive a frame sourced by itself. MON_CSN - When set the LAN91C94 monitors carrier while transmitting. It must see its own carrier by the end of the preamble. If it is not seen, or if carrier is lost during transmission, the transmitter aborts the frame without CRC and turns itself off. When this bit is clear the transmitter ignores its own carrier. Defaults low. NOCRC - Does not append CRC to transmitted frames when set, allows software to insert the desired CRC. Defaults to zero, namely CRC inserted. PAD_EN - When set, the LAN91C94 will pad transmit frames shorter than 64 bytes with 00. Does not pad frames when reset. FORCOL - When set the transmitter will force a collision by not deferring deliberately. This bit is set and cleared only by the CPU. When TXENA is enabled with no packets in the queue and while the FORCOL bit is set, the LAN91C94 will transmit a preamble pattern the next time a carrier is seen on the line. If a packet is queued, a preamble and SFD will be transmitted. FORCOL defaults low to normal operation. NOTE: The LATCOL bit in EPHSR, setting up as a result of FORCOL, will reset TXENA to 0.

In order to force another collision, TXENA must be set to 1 again. LOOP - Local Loopback. When set, transmit frames are internally looped to the receiver after the encoder/decoder. Collision and Carrier Sense are ignored. No data is sent out. Defaults low to normal mode. TXENA - Transmit enabled when set. Transmit is disabled if clear. When the bit is cleared the LAN91C94 will complete the current transmission before stopping. When stopping due to an error, this bit is automatically cleared. LOOPBACK MODES AUI EPH LOOP LOOP FDUPLX LOOPS AT TRANSMITS TO NETWORK X X X X X EPH Block ENDEC Cable 10BASE-T Driver Normal CSMA/CD - No Loopback N N Y Y Y

This register stores the status of the last transmitted frame. This register value, upon individual transmit packet completion, is stored as the first word in the memory area allocated to the packet. Packet interrupt processing should use the copy in memory as the register itself will be updated by subsequent packet transmissions. The register can be used for real time values (like TXENA and LINK OK). If TXENA is cleared the register holds the last packet completion status. HIGH BYTE TXUNRN LINK_OK RX_OVRN CTR_ROL EXC_DEF LOST CAR LATCOL 0 0 0 0 0 0 0 X LOW BYTE TX DEFR LTX BRD SQET 16COL LTX MULT MULCOL SNGLCOL TX_SUC 0 0 0 0 0 0 0 0 TXUNRN - Transmit Underrun . Set if underrun occurs, it also clears TXENA bit in TCR. Cleared by setting TXENA high. This bit should never be set under normal operation. LINK_OK - State of the 10BASE-T Link Integrity Test. A transition on the value of this bit generates an interrupt when the LE ENABLE bit in the Control Register is set. RX_OVRN - Upon receive overrun, the receiver temporarily asserts this bit. The receiver stays enabled and subsequent frames will be received normally if memory becomes available. The RX_OVRN INT bit in the Interrupt Status Register will also be set and stay set until cleared by the CPU. Note that receive overruns could occur only if receive memory allocations fail. CTR_ROL - Counter Roll over. When set one or more 4 bit counters have reached maximum count (15). Cleared by reading the ECR register. EXC_DEF - Excessive deferral. When set last/current transmit was deferred for more than 1518 * 2 byte times. Cleared at the end of every packet sent. LOST_CARR - Lost carrier sense. When set indicates that Carrier Sense was not present at end of preamble. Valid only if MON_CSN is enabled. This condition causes TXENA bit in TCR to be reset. Cleared by setting TXENA bit in TCR. LATCOL - Late collision detected on last transmit frame. If set a late collision was detected ( later than 64 byte times into the

frame) or FORCOL in TCR was set to 1 by the CPU. When detected the transmitter jams and turns itself off clearing the TXENA bit in TCR. Cleared by setting TXENA in TCR. TX_DEFR - Transmit Deferred. When set, carrier was detected during the first 6.4 usec of the inter frame gap. Cleared at the end of every packet sent. LTX_BRD - Last transmit frame was a broadcast. Set if frame was broadcast. Cleared at the start of every transmit frame. SQET - Signal Quality Error Test. The transmitter opens a 1.6 us window 0.8 us after transmission is completed and the receiver returns inactive. During this window, the transmitter expects to see the SQET signal from the transceiver. The absence of this signal is a 'Signal Quality Error' and is reported in this status bit. Transmission stops and EPH INT is set if STP_SQET is in the TCR is also set when SQET is set. This bit is cleared by setting TXENA high. 16COL - 16 collisions reached. Set when 16 collisions are detected for a transmit frame. TXENA bit in TCR is reset. Cleared when TXENA is set high. LTX_MULT - Last transmit frame was a multicast. Set if frame was a multicast. Cleared at the start of every transmit frame. MULCOL - Multiple collision detected for the last transmit frame. Set when more than one collision was experienced. Cleared when TX_SUC is high at the end of the packet being sent. SNGLCOL - Single collision detected for the last transmit frame. Set when a collision is detected. Cleared when TX_SUC is high at the end of the packet being sent. TX_SUC - Last transmit was successful. Set if transmit completes without a fatal error. This bit is cleared by the start of a new frame transmission or when TXENA is set high. Fatal errors are: 16 collisions SQET fail and STP_SQET = 1 FIFO Underrun Carrier lost and MON_CSN = 1 Late collision

SOFT RST FILT_CAR 0 0 0 0 STRIP CRC RXEN 0 0 0 0 0 0 0 0 LOW BYTE ALMUL PRMS RX_ ABORT 0 0 0 0 0 0 0 0 SOFT_RST - Software activated Reset. Active high. Valid for ISA and PCMCIA. Initiated by writing this bit high and terminated by writing the bit low. LAN91C94 configuration is not preserved, except for Configuration, Base, IA0- 5, COR, and CSR Registers. EEPROM is not reloaded after software reset. FILT_CAR - Filter Carrier. When set filters leading edge of carrier sense for 12 bit times. Otherwise recognizes a receive frame as soon as carrier sense is active. STRIP_CRC - When set it strips the CRC on received frames. When clear the CRC is stored in memory following the packet. Defaults low. RXEN - Enables the receiver when set. If cleared, completes receiving current frame and then goes idle. Defaults low on reset. ALMUL - When set accepts all multicast frames (frames in which the first bit of DA is '1'). When clear accepts only the multicast frames that match the multicast table setting. Defaults low. PRMS - Promiscuous mode. When set receives all frames, regardless of their destination address. Does not receive its own transmission unless FDUPX = 1. RX_ABORT - This bit is set if a receive frame was aborted due to length longer than 1532 bytes. The frame will not be received. The bit is cleared by RESET or by the CPU writing it low. RX_ABORT RX_OVRN_ INT Packet Too Long Run out of Memory During Receive

Counts four parameters for MAC statistics. When any counter reaches 15 an interrupt is issued. All counters are cleared when reading the register and do no wrap around beyond 15. HIGH BYTE NUMBER OF EXCESS DEFERRED TX NUMBER OF DEFERRED TX 0 0 0 0 0 0 0 0 LOW BYTE MULTIPLE COLLISION COUNT SINGLE COLLISION COUNT 0 0 0 0 0 0 0 0 Each four bit counter is incremented every time the corresponding event, as defined in the EPH STATUS REGISTER bit description, occurs. Note that the counters can only increment once per enqueued transmit packet, never faster, limiting the rate of interrupts that can be generated by the counters. For example if a packet is successfully transmitted after one collision the SINGLE COLLISION COUNT field is incremented by one. If a packet experiences between 2 to 16 collisions, the MULTIPLE COLLISION COUNT field is incremented by one. If a packet experiences deferral the NUMBER OF DEFERRED TX field is incremented by one, even if the packet experienced multiple deferrals during its collision retries. The COUNTER REGISTER facilitates maintaining statistics in the AUTO RELEASE mode where no transmit interrupts are generated on successful transmissions. Reading the register in the transmit service routine will be enough to maintain statistics.

MEMORY INFORMATION REGISTER TYPE READ ONLY SYMBOL MIR For software compatibility with other LAN9000 parts all memory-related information is represented in 256 x M byte units, where the multiplier M is determined by the MCR upper byte. M equals 1 for the LAN91C94. HIGH BYTE FREE MEMORY AVAILABLE (in bytes x 256 x M) 0 0 0 1 0 0 1 0 LOW BYTE MEMORY SIZE (in bytes x 256 x M) 0 0 0 1 0 0 1 0 FREE MEMORY AVAILABLE - This register can be read at any time to determine the amount of free memory. The register defaults to the MEMORY SIZE upon reset or upon the RESET MMU command. MEMORY SIZE - This register can be read to determine the total memory size, and will always read 12H (4608 bytes) for the LAN91C94. MEMORY SIZE REGISTER M ACTUAL MEMORY LAN91C90 FFH 1 64 Kbytes LAN91C90 40H 1 16 Kbytes LAN91C92/4 12H 1 4608 bytes LAN91C100 FFH 2 128 kbytes

A NAME MEMORY CONFIGURATION REGISTER TYPE Lower Byte - READ/WRITE Upper Byte - READ ONLY SYMBOL MCR HIGH BYTE MEMORY SIZE MULTIPLIER M 0 0 1 1 0 0 1 1 LOW BYTE MEMORY RESERVED FOR TRANSMIT (in bytes x 256 x M) 0 0 0 0 0 0 0 0 MEMORY RESERVED FOR TRANSMIT - Programming this value allows the host CPU to reserve memory to be used later for transmit, limiting the amount of memory that receive packets can use up. When programmed for zero, the memory allocation between transmit and receive is completely dynamic. When programmed for a non-zero value, the allocation is dynamic if the free memory exceeds the programmed value, while receive allocation requests are denied if the free memory is less or equal to the programmed value. This register defaults to zero upon reset. It is not affected by the RESET MMU command. The value written to the MCR is a reserved memory space IN ADDITION TO ANY MEMORY CURRENTLY IN USE. If the memory allocated for transmit plus the reserved space for transmit is required to be constant (rather than grow with transmit allocations) the CPU should update the value of this register after allocating or releasing memory. The contents of MIR as well as the low byte of MCR are specified in 256 x M bytes. The multiplier M is determined by bits 11,10,and 9 as follows. Bits 11,10 and 9 are read only bits used by the software driver to transparently run on different controllers of the LAN9000 family: DEVICE BIT 11 BIT 10 BIT 9 M MAX MEMORY SIZE LAN91C100 0 1 0 2 256 x 256 x 2=128k LAN91C90 0 0 1 1 256 x 256 x 1 =64k FUTURE 0 1 1 4 256k " " 1 0 0 8 512k " " 1 0 1 16 1M

The Configuration Register holds bits that define the device configuration and are not expected to change during run-time. This register is part of the EEPROM saved setup. HIGH BYTE 0 NO WAIT FULL STEP SET SQLCH AUI SELECT

0 X X 0 X 0 0 0

BYTE 16 BIT DIS LINK RESERVED INT SEL1 INT SEL0 Function of nEN16 pin 0 1 1 0 0 0 X NO WAIT - When set, does not request additional wait states. An exception to this are accesses to the Data Register if not ready for a transfer. When clear, negates IOCHRDY for two to three 20MHz clocks on any cycle to the LAN91C94. FULL STEP - This bit is used to select the signaling mode for the AUI port. When set the AUI port uses full step signaling. Defaults low to half step signaling. This bit is only meaningful when AUI SELECT is high. SET SQLCH - When set, the squelch level used for the 10BASE-T receive signal is 240mV. When clear the receive squelch level is 400mV.Defaults low. AUI SELECT - When set the AUI interface is used, when clear the 10BASE-T interface is used. Defaults low. 16BIT - Used in conjunction with nEN16 and IOis8 (in PCMCIA mode only) to define the width of the system bus. If the nEN16 pin is low, this bit is forced high. Otherwise the bit defaults low and can be programmed by the host CPU. DIS LINK - This bit is used to disable the 10BASE-T link test functions. When this bit is high the LAN91C94 disables link test functions by not generating nor monitoring the network for link pulses. In this mode the LAN91C94 will transmit packets regardless of the link test, the EPHSR LINK_OK bit will be set and the LINK LED will stay on. When low the link test functions are enabled. If the link status indicates FAIL, the EPHSR LINK_OK bit will be low, while transmit packets enqueued will be processed by the LAN91C94, transmit data will not be sent out to the cable. INT SEL1-0 - Used to select one out of four interrupt pins. The three unused interrupts are tristated.

In ISA mode, this register holds the address decode options chosen for the I/O and ROM spaces. It is part of the EEPROM saved setup and is not usually modified during run-time. HIGH BYTE A15 A14 A13 A9 A8 A7 A6 A5 0 0 0 1 1 0 0 0 LOW BYTE ROM SIZE RA18 RA17 RA16 RA15 RA14 0 1 1 0 0 1 1 X A15 - A13 and A9 - A5 - These bits are compared in ISA mode against the I/O address on the bus to determine the IOBASE for LAN91C94 registers. The 64k I/O space is fully decoded by the LAN91C94 down to a 16 location space, therefore the unspecified address lines A4, A10, A11 and A12 must be all zeros. ROM SIZE - Determines the ROM decode area in ISA mode memory space as follows: 00 = ROM disable 01 = 16k: RA14-18 define ROM select. 10 = 32k: RA15-18 define ROM select. 11 = 64k: RA16-18 define ROM select. RA18-RA14 - These bits are compared against the memory address on the bus to determine if the ROM is being accessed, as a function of the ROM SIZE. ROM accesses are read only memory accesses defined by nMEMRD going low. For a full decode of the address space unspecified upper address lines have to be: A19 = "1 " , A20-A23 lines are not directly decoded, however ISA systems will only activate nSMEMRD only when A20-A23=0. All bits in this register are loaded from the serial EEPROM. The I/O base decode defaults to 300h (namely, the high byte defaults to 18h). ROM SIZE defaults to 01. ROM decode defaults to CC000 (namely the low byte defaults to 67h). As an example:

A15 A14 A13 A9 A8 A7 A6 A5 I/O ADDRESS 280h 2E0h 300h 320h 340h 360h 380h 3A0h

4 THROUGH 9

INDIVIDUAL ADDRESS REGISTERS TYPE READ/WRITE SYMBOL IAR These registers are loaded starting at word location 20h of the EEPROM upon hardware reset or EEPROM reload. The registers can be modified by the software driver, but a STORE operation will not modify the EEPROM Individual Address contents. Bit 0 of Individual Address 0 register corresponds to the first bit of the address on the cable. LOW BYTE ADDRESS 0 0 0 0 0 0 0 0 0 HIGH BYTE ADDRESS 1 0 0 0 0 0 0 0 0 LOW BYTE ADDRESS 2 0 0 0 0 0 0 0 0 HIGH BYTE ADDRESS 3 0 0 0 0 0 0 0 0 LOW BYTE ADDRESS 4 0 0 0 0 0 0 0 0 HIGH BYTE ADDRESS 5 0 0 0 0 0 0 0 0

A NAME GENERAL PURPOSE REGISTER TYPE READ/WRITE SYMBOL GPR HIGH BYTE HIGH DATA BYTE 0 0 0 0 0 0 0 0 LOW BYTE LOW DATA BYTE 0 0 0 0 0 0 0 0 This register can be used as a way of storing and retrieving non-volatile information in the EEPROM to be used by the software driver. The storage is word oriented, and the EEPROM word address to be read or written is specified using the six lowest bits of the Pointer Register. This register can also be used to sequentially program the Individual Address area of the EEPROM, that is normally protected from accidental Store operations. This register will be used for EEPROM read and write only when the EEPROM SELECT bit in the Control Register is set. This allows generic EEPROM read and write routines that do not affect the basic setup of the LAN91C94.

C NAME CONTROL REGISTER TYPE READ/WRITE SYMBOL CTR HIGH BYTE 0 RCV_BAD PWRDN AUTO RELEASE 1 0 0 0 X 0 X X 1 LOW BYTE LE ENABLE CR ENABLE TE ENABLE EEPROM SELECT RELOAD STORE 0 0 0 X X 0 0 0 RCV_BAD - When set, bad CRC packets are received. When clear bad CRC packets do not generate interrupts and their memory is released. PWRDN - Active high bit used to enter power down mode. Cleared by a write to any register in the LAN91C94 I/O space or by hardware reset. AUTO RELEASE - When set, transmit pages are released by transmit completion if the transmission was successful (when TX_SUC is set). In that case there is no status word associated with its packet number, and successful packet numbers are not even written into the TX COMPLETION FIFO. A sequence of transmit packets will only generate an interrupt when the sequence is completely transmitted (TX EMPTY INT will be set), or when a packet in the sequence experiences a fatal error (TX INT will be set). Upon a fatal error TXENA is cleared and the transmission sequence stops. The packet number that failed is the present in the FIFO PORTS register, and its pages are not released, allowing the CPU to restart the sequence after corrective action is taken. LE ENABLE - Link Error Enable. When set it enables the LINK_OK bit transition as one of the interrupts merged into the EPH INT bit. Defaults low (disabled). Writing this bit also serves as the acknowledge by clearing previous LINK interrupt conditions. CR ENABLE - Counter Roll over Enable. When set it enables the CTR_ROL bit as one of the interrupts merged into the EPH INT bit. Defaults low (disabled). TE ENABLE - Transmit Error Enable. When set it enables Transmit Error as one of the interrupts merged into the EPH INT bit. Defaults low (disabled). Transmit Error is any condition that clears TXENA with TX_SUC staying low as described in the EPHSR register. EEPROM SELECT - This bit allows the CPU to specify which registers the EEPROM RELOAD or STORE refers to. When high, the General Purpose Register is the only register read or written. When low, RELOAD reads Configuration , Base and Individual Address,

and STORE writes the Configuration and Base registers. RELOAD - When set it will read the EEPROM and update relevant registers with its contents. Clears upon completing the operation. STORE - When set, stores the contents of all relevant registers in the serial EEPROM. Clears upon completing the operation. Note: When an EEPROM access is in progress the STORE and RELOAD bits will be read back as high. The remaining 14 bits of this register will be invalid. During this time attempted read/write operations, other than polling the EEPROM status, will NOT have any effect on the internal registers. The CPU can resume accesses to the LAN91C94 after both bits are low. A worst case RELOAD operation initiated by RESET or by software takes less than 750usec.

This register is used by the CPU to control the memory allocation, de-allocation, TX FIFO and RX FIFO control. The three command bits determine the command issued as described below: HIGH BYTE LOW BYTE COMMAND 0 0 N2 N1 N0/BUSY x y z COMMAND SET: xyz 000 0) NOOP - NO OPERATION 001 1) ALLOCATE MEMORY FOR TX - N2 ,N1,N0 defines the amount of memory requested as (value + 1) x 256 bytes. Namely N2 ,N1,N0 = 1 will request 2 x 256 = 512 bytes. Valid range for N2 ,N1,N0 is 0 through 5. A shift-based divide by 256 of the packet length yields the appropriate value to be used as N2 ,N1,N0. Immediately generates a completion code at the ALLOCATION RESULT REGISTER. Can optionally generate an interrupt on successful completion. The allocation time can take worst case (N2 ,N1,N0 + 2) x 200ns. 010 2) RESET MMU TO INITIAL STATE - Frees all memory allocations, clears relevant interrupts, resets packet FIFO pointers. 011 3) REMOVE FRAME FROM TOP OF RX FIFO - To be issued after CPU has completed processing of present receive frame. This command removes the receive packet number from the RX FIFO and brings the next receive frame (if any) to the RX area (output of RX FIFO). 100 4) REMOVE AND RELEASE TOP OF RX FIFO - Like 3) but also releases all memory used by the packet presently at the RX FIFO output.

101 5) RELEASE SPECIFIC PACKET - Frees all pages allocated to the packet specified in the PACKET NUMBER REGISTER. Should not be used for frames pending transmission. Typically used to remove transmitted frames, after reading their completion status. Can be used following 3) to release receive packet memory in a more flexible way than 4). 110 6) ENQUEUE PACKET NUMBER INTO TX FIF O - This is the normal method of transmitting a packet just loaded into RAM. The packet number to be enqueued is taken from the PACKET NUMBER REGISTER. 111 7) RESET TX FIFOs - This command will reset both TX FIFOs: The TX FIFO holding the packet numbers awaiting transmission and the TX Completion FIFO. This command provides a mechanism for canceling packet transmissions, and reordering or bypassing the transmit queue. The RESET TX FIFOs command should only be used when the transmitter is disabled. Unlike the RESET MMU command, the RESET TX FIFOs does not release any memory. Note 1: Only command 1) uses N2 ,N1,N0. Note 2: When using the RESET TX FIFOS command, the CPU is responsible for releasing the memory associated with outstanding packets, or re- enqueuing them. Packet numbers in the completion FIFO can be read via the FIFO ports register before issuing the command. Note 3: MMU commands releasing memory (commands 4 and 5) should only be issued if the corresponding packet number has memory allocated to it. COMMAND SEQUENCING A second allocate command (command 1) should not be issued until the present one has completed. Completion is determined by reading the FAILED bit of the allocation result register or through the allocation interrupt. A second release command (commands 4, 5) should not be issued if the previous one is still being processed. The BUSY bit indicates that a release command is in progress. After issuing command 5, the contents of the PNR should not be changed until BUSY goes low. After issuing command 4, command 3 should not be issued until BUSY goes low. BUSY BIT - Readable at bit 0 of the MMU command register address. When set indicates that MMU is still processing a release command. When clear, MMU has already completed last release command. BUSY and FAILED bits are set upon the trailing edge of command.

PACKET NUMBER AT TX AREA The value written into this register determines which packet number is accessible through the TX area. Some MMU commands use the number stored in this register as the packet number parameter. This register is cleared by a RESET or a RESET MMU Command. I/O BANK - SPACE2 OFFSET NAME ALLOCATION RESULT REGISTER TYPE READ ONLY SYMBOL ARR This register is updated upon an ALLOCATE MEMORY MMU command. FAILED ALLOCATED PACKET NUMBER 1 0 0 0 0 0 0 0 FAILED A zero indicates a successful allocation completion. If the allocation fails the bit is set and only cleared when the pending allocation is satisfied. Defaults high upon reset and reset MMU command. For polling purposes, the ALLOC_INT in the Interrupt Status Register should be used because it is synchronized to the read operation. Sequence: 1) Allocate Command 2) Poll ALLOC_INT bit until set 3) Read Allocation Result Register ALLOCATED PACKET NUMBER Packet number associated with the last memory allocation request. The value is only valid if the FAILED bit is clear. Note: For software compatibility with future versions, the value read from the ARR after an allocation request is intended to be written into the PNR as is, without masking higher bits ( provided FAILED = 0).

This register provides access to the read ports of the Receive FIFO and the Transmit completion FIFO. The packet numbers to be processed by the interrupt service routines are read from this register. HIGH BYTE REMPTY RX FIFO PACKET NUMBER 1 0 0 0 0 0 0 0 LOW BYTE TEMPTY TX DONE PACKET NUMBER 1 0 0 0 0 0 0 0 REMPTY No receive packets queued in the RX FIFO. For polling purposes, use the RCV_INT bit in the Interrupt Status Register. TOP OF RX FIFO PACKET NUMBER Packet number presently at the output of the RX FIFO. Only valid if REMPTY is clear. The packet is removed from the RX FIFO using MMU Commands 3) or 4). TEMPTY No transmit packets in TX completion queue. For polling purposes, use the TX_INT bit in the Interrupt Status Register. TX DONE PACKET NUMBER Packet number presently at the output of the TX Completion FIFO. Only valid if TEMPTY is clear. The packet is removed when a TX INT acknowledge is issued. Note: For software compatibility with future versions, the value read from each FIFO register is intended to be written into the PNR as is, without masking higher bits (provided TEMPTY and REMPTY = 0 respectively).

INCR. READ ETEN 0 POINTER HIGH 0 0 0 0 0 0 0 0 LOW BYTE POINTER LOW 0 0 0 0 0 0 0 0 POINTER REGISTER : The value of this register determines the address to be accessed within the transmit or receive areas. It will auto- increment on accesses to the data register when AUTO INCR. is set. The increment is by one for every byte access, and by two for every word access. When RCV is set the address refers to the receive area and uses the output of RX FIFO as the packet number ; when RCV is clear the address refers to the transmit area and uses the packet number at the Packet Number Register. READ bit determines the type of access to follow. If the READ bit is high the operation intended is a read. If the READ bit is low the operation is a write. Loading a new pointer value, with the READ bit high, generates a pre- fetch into the Data Register for read purposes. Readback of the pointer will indicate the value of the address last accessed by the CPU (rather than the last pre-fetched). This allows any interrupt routine that uses the pointer to save it and restore it without affecting the process being interrupted. The Pointer Register should not be loaded until 400ns after the last write operation to the Data Register to ensure that the Data Register FIFO is empty. On reads, if IOCHRDY is not connected to the host, the Data Register should not be read before 400ns after the pointer was loaded to allow the Data Register FIFO to fill. If the pointer is loaded using 8 bit writes , the low byte should be loaded first and the high byte last. ETEN bit When set, enables Early Transmit underrun detection. Normal operation when clear. Note: If AUTO INCR. is not set, the pointer must be loaded with an even value.

8 & A NAME DATA REGISTER TYPE READ/WRITE SYMBOL DATA HIGH BYTE DATA HIGH LOW BYTE DATA LOW DATA REGISTER - Used to read or write the data buffer byte/word presently addressed by the pointer register. This register is mapped into two uni -directional FIFOs that allow moving words to and from the LAN91C94 regardless of whether the pointer address is even or odd. Data goes through the write FIFO into memory, and is pre-fetched from memory into the read FIFO. If byte accesses are used, the appropriate (next) byte can be accessed through the Data Low or Data High registers. The order to and from the FIFO is preserved. Byte and word accesses can be mixed on the fly in any order. This register is mapped into two consecutive word locations to facilitate the usage of double word move instructions. The DATA register is accessible at any address in the 8 through Ah range, while the number of bytes being transferred are determined by A0 and nSBHE in ISA mode, and by A0, nCE1 and nCE2 in PCMCIA mode.

C NAME INTERRUPT STATUS REGISTER TYPE READ ONLY SYMBOL IST ERCV INT EPH INT RX_OVRN INT ALLOC INT TX EMPTY INT TX INT RCV INT X 0 0 0 0 1 0 0 OFFSET C NAME INTERRUPT ACKNOWLEDGE REGISTER TYPE WRITE ONLY SYMBOL ACK ERCV INT RX_OVRN INT TX EMPTY INT TX INT OFFSET D NAME INTERRUPT MASK REGISTER TYPE READ/WRITE SYMBOL MSK ERCV INT EPH INT RX_OVRN INT ALLOC INT TX EMPTY INT TX INT RCV INT X 0 0 0 0 0 0 0 This register can be read and written as a word or as two individual bytes. The Interrupt Mask Register bits enable the appropriate bits when high and disable them when low. An enabled bit being set will cause a hardware interrupt. EPH INT - Set when the Ethernet Protocol Handler section indicates one out of various possible special conditions. This bit merges exception type of interrupt sources, whose service time is not critical to the execution speed of the low level drivers. The exact nature of the interrupt can be obtained from the EPH

Status Register (EPHSR), and enabling of these sources can be done via the Control Register. The possible sources are: LINK_OK transition. CTR_ROL - Statistics counter roll over. TXENA cleared - A fatal transmit error occurred forcing TXENA to be cleared. TX_SUC will be low and the specific reason will be reflected by the bits: TXUNRN - Transmit underrun SQET - SQE Error LOST CARR - Lost Carrier LATCOL - Late Collision 16COL - 16 collisions RX_OVRN INT - Set when the receiver overruns due to a failed memory allocation or when a packet exceeding 1536 bytes is received, or when a packet reception is stopped on-the-fly by setting the RCV_DISCRD bit in the ERCV register. The RX_OVRN bit of the EPHSR will also be briefly set. The RX_OVRN INT bit, however, latches the overrun condition for the purpose of being polled or generating an interrupt, and will only be cleared by writing the acknowledge register with the RX_OVRN INT bit set. ALLOC INT - Set when an MMU request for TX pages allocation is completed. This bit is the complement of the FAILED bit in the ALLOCATION RESULT register. The ALLOC INT ENABLE bit should only be set following an allocation command, and cleared upon servicing the interrupt. TX EMPTY INT - Set if the TX FIFO goes empty, can be used to generate a single interrupt at the end of a sequence of packets enqueued for transmission. This bit latches the empty condition, and the bit will stay set until it is specifically cleared by writing the acknowledge register with the TX EMPTY INT bit set. If a real time reading of the FIFO empty is desired, the bit should be first cleared and then read. The TX EMPTY INT ENABLE should only be set after the following steps: a) A packet is enqueued for transmission b) T he previous empty condition is cleared (acknowledged). TX INT - Set when at least one packet transmission was completed. The first packet number to be serviced can be read from the FIFO PORTS register. The TX INT bit is always the logic complement of the TEMPTY bit in the FIFO PORTS register. After servicing a packet number, its TX INT interrupt is removed by writing the Interrupt Acknowledge Register with the TX INT bit set. RCV INT - Set when a receive interrupt is generated. The first packet number to be serviced can be read from the FIFO PORTS register. The RCV INT bit is always the logic complement of the REMPTY bit in the FIFO PORTS register. ERCV INT - Early receive interrupt. Set whenever a receive packet is being received, and the number of bytes received into memory exceeds the value programmed as ERCV THRESHOLD (Bank 3, Offset Ch). ERCV INT stays set until acknowledged by writing the INTERRUPT ACKNOWLEDGE REGISTER with the ERCV INT bit set. Note: If the driver uses AUTO RELEASE mode it should enable TX EMPTY INT as well as TX INT. TX EMPTY INT will be set when the complete sequence of packets is transmitted. TX INT will be set if the sequence stops due to a fatal error on any of the packets in the sequence. Note: For edge triggered systems, the Interrupt Service Routine should clear the Interrupt Mask Register, and only enable the appropriate interrupts after the interrupt source is serviced (acknowledged).

FIGURE 11 – INTERRUPT STRUCTURE INTE RRUP T STATUS REGISTER INTE RRUP T M ASK REGISTER OE OE nRDIST DATA BUS D0-7 D 8-15 EDG E D ETEC TOR ON LIN K E RR LEM ASK C TR-RO L CRM ASK TEM ASK TXENA TX_SVC EPHS R INTER RU PTS MERG ED INTO EPH INT D2 D4 D S Q nQ TX FIFO EMPTY nWR ACK D S Q Q R X_O VRN (E PHSR) ALLOCATION FA ILED TX COMP LETIO N FIFO NOT EM PTY RCV FIFO NOT EM PTY RCV IN T TX INT TX EMPTY IN T ALLOC IN T RX_OV RN IN T EPH IN T IN T M AIN IN TERRU PTS

0 THROUGH 7

The 64 bit multicast table is used for group address filtering. The hash value is defined as the six most significant bits of the CRC of the destination addresses. The three msb's determine the register to be used (MT0-7), while the other three determine the bit within the register. If the appropriate bit in the table is set, the packet is received. If the ALMUL bit in the RCR register is set , all multicast addresses are received regardless of the multicast table values. Hashing is only a partial group addressing filtering scheme, but being the hash value available as part of the receive status word, the receive routine can reduce the search time significantly. With the proper memory structure, the search is limited to comparing only the multicast addresses that have the actual hash value in question.

This register contains status bits and control bits for management of different transceivers modules. Some of the pins are shared with the serial EEPROM interface. Management is software controlled, and does not use the serial EEPROM and the transceiver management functions at the same time. HIGH BYTE nXNDEC IOS2 IOS1 IOS0 0 0 1 1 LOW BYTE MDOE MCLK Reserved MD0 0 0 1 1 0 0 0 0 nXNDEC - Read only bit reflecting the status of the nXENDEC pin. IOS0-2 - Read only bits reflecting the status of the IOS0-2 pins. MDO - The value of this bit drives the EEDO pin when MDOE=1. MDCLK - The value of this bit drives the EESK pin when MDOE=1. MDOE - When this bit is high pins EEDO EECS and EESK will be used for transceiver management functions, otherwise the pins assume the EEPROM values. MDOE=0 MDOE=1 EEDO Serial EEPROM Data Out Bit MDO EESK Serial EEPROM Clock Bit MCLK EECS Serial EEPROM Chip Select 0

A NAME REVISION REGISTER TYPE READ ONLY SYMBOL REV HIGH BYTE 0 0 1 1 0 0 1 1 LOW BYTE CHIP REV 0 1 0 0 0 0 0 0 CHIP - Chip ID. Can be used by software drivers to identify the device used. CHIP ID VALUE DEVICE

3 LAN91C90/91C92

4 LAN91C94

5 LAN91C95

7 LAN91C100

C NAME EARLY RCV REGISTER TYPE READ/WRITE SYMBOL ERCV HIGH BYTE 0 0 1 1 0 0 1 1 LOW BYTE RCV DISCRD ERCV THRESHOLD 0 0 0 1 1 1 1 1 RCV DISCRD - Set to discard a packet being received. This bit can be used in conjunction with ERCV THRESHOLD and ERCV INT to process a packet header while it is being received and discard it if the packet is not desired. Setting this bit will only discard packets that are still in the process of being received. If the RCV DISCRD bit is set prior to the end of a receive packet, RXOVRN bit in the Interrupt Status Register will be set to indicate that the packet was discarded and its memory released. If the receive packet is complete prior to the RCV DISCARD bit being set, the packet is received normally and RCV INT bit is set in the Interrupt Status Register. The RCV DISCARD bit is self-clearing. ERCV THRESHOLD - Threshold for ERCV interrupt. Specified in 64 byte multiples. Whenever the number of bytes written in memory for the presently received packet exceeds the ERCV THRESHOLD, ERCV INT bit of the INTERRUPT STATUS REGISTER is set.

The concept of presenting the shared RAM as a FIFO of packets, with a memory management unit allocating memory on a per packet basis responds to the following needs: Memory allocation for receive vs. transmit - A fixed partition between receive and transmit area would not be efficient. Being able to dynamically allocate it to transmit and receive represents almost the equivalent of duplicating the memory size for some workstation type of drivers. Software overhead - By presenting a FIFO of packets, the software driver does not have to waste any time in calculating pointers for the different buffers that make up different packets. The driver usually deals with one packet at a time. With this approach, packets are accessible always at the same fixed address, and access is provided to any byte of the packet. Headers can be analyzed without reading out the entire packet. The packet can be moved in or out with a block move operation. Multiple upper layer support - The LAN91C94 facilitates interfacing to multiple upper layer protocols because of the receive packet processing flexibility. A receive lookahead scheme like ODI or NDIS drivers is supported by copying a small part of the received packet and letting the upper layer provide a pointer for the rest of the data. If the upper layer indicates it does not want the packet, it can be removed upon a single command. If the upper layer wants a specific part of the packet, a block move operation starting at any particular offset can be done. Out of order receive processing is also supported : if memory for one packet is not yet available, receive packet processing can continue. Efficiency - Lacking any level of indirection or linked lists of pointers, virtually all the memory is used for data. There are no descriptors, forward links and pointers at all. This simplicity and memory efficiency is accomplished without giving up the benefits of linked lists which is unlimited back-to-back transmission and reception without CPU intervention for as long as memory is available.

TYPICAL FLOW OF EVENTS FOR TRANSMIT S/W DRIVER CSMA/CD SIDE

1 ISSUE ALLOCATE MEMORY FOR TX - N

BYTES - the MMU attempts to allocate N bytes of RAM.

2 WAIT FOR SUCCESSFUL COMPLETION

CODE - Poll until the ALLOC INT bit is set or enable its mask bit and wait for the interrupt. The TX packet number is now at the Allocation Result Register.

3 LOAD TRANSMIT DATA - Copy the TX packet

number into the Packet Number Register. Write the Pointer Register, then use a block move operation from the upper layer transmit queue into the Data Register.

4 ISSUE "ENQUEUE PACKET NUMBER TO TX

FIFO" - This command writes the number present in the Packet Number Register into the TX FIFO. The transmission is now enqueued. No further CPU intervention is needed until a transmit interrupt is generated.

5 The enqueued packet will be transferred to the

CSMA/CD block as a function of TXENA (in TCR) bit and of the deferral process state.

6 Upon transmit completion the first word in

memory is written with the status word. The packet number is moved from the TX FIFO into the TX completion FIFO. Interrupt is generated by the TX completion FIFO being not empty.

7 SERVICE INTERRUPT - Read Interrupt Status

Register. If it is a transmit interrupt, read the TX Done Packet Number from the Fifo Ports Register. Write the packet number into the Packet Number Register. The corresponding status word is now readable from memory. If status word shows successful transmission, issue RELEASE packet number command to free up the memory used by this packet. Remove packet number from completion FIFO by writing TX INT Acknowledge Register.

TYPICAL FLOW OF EVENTS FOR RECEIVE S/W DRIVER CSMA/CD SIDE

1 ENABLE RECEPTION - By setting the RXEN

bit. 2 A packet is received with matching address. Memory is requested from MMU. A packet number is assigned to it. Additional memory is requested if more pages are needed.

3 The internal DMA logic generates sequential

addresses and writes the receive words into memory. The MMU does the sequential to physical address translation. If overrun, packet is dropped and memory is released.

4 When the end of packet is detected, the status

word is placed at the beginning of the receive packet in memory. Byte count is placed at the second word. If the CRC checks correctly the packet number is written into the RX FIFO. The RX FIFO being not empty causes RCV INT (interrupt) to be set. If CRC is incorrect the packet memory is released and no interrupt will occur.

5 SERVICE INTERRUPT - Read the Interrupt

Status Register and determine if RCV INT is set. The next receive packet is at receive area. (Its packet number can be read from the FIFO Ports Register). The software driver can process the packet by accessing the RX area, and can move it out to system memory if desired. When processing is complete the CPU issues the REMOVE AND RELEASE FROM TOP OF RX command to have the MMU free up the used memory and packet number.

FIGURE 12 – INTERRUPT SERVICE ROUTINE ISR Save Bank Select & Address Ptr Registers Mask 91C94 Interrupts Read Interrupt Register Call TX INTR or TXEMPTY INTR TX INTR? Get Next TX RX INTR? Yes No No Yes Call RXINTR ALLOC INTR? No Yes Write Allocated Pkt # into Packet Number Reg. Write Ad Ptr Reg. & Copy Data & Source Address Enqueue Packet Packet Available for Transmission?Yes No Call ALLOCATE EPH INTR? NoYes Call EPH INTR Set "Ready for Packet" Flag Return Buffers to Upper Layer Disable Allocation Interrupt Mask Restore Address Pointer & Bank Select Registers Unmask 91C94 Interrupts Exit ISR

FIGURE 13 – RX INTR RX INTR Write Ad. Ptr. Reg. & Read Word 0 from RAM Destination Multicast? Read Words 2, 3, 4 from RAM for Address Filtering Address Filtering Pass? Status Word OK? Do Receive Lookahead Get Copy Specs from Upper Layer Okay to Copy? Copy Data Per Upper Layer Specs Issue "Remove and Release" Command Return to ISR Yes No YesNo No Yes No Yes

FIGURE 14 – TX INTR Write Into Packet Number Register TX Status OK? TX INTR Save Pkt Number Register Read TXDONE Pkt # from FIFO Ports Reg. Immediately Issue "Release" Command Acknowledge TXINTR Read TX INT Again Return to ISR NoYes Read Status Word from RAM Update Statistics Re-Enable TXENA Update Variables TX INT = 0? Restore Packet Number Yes No Write Address Pointer Register

FIGURE 15 – TXEMPTY INTR (Assumes Auto Release Option Selected) TXEMPTY INTR Write Acknowledge Reg. with TXEMPTY Bit Set Read TXEMPTY & TX INTR Acknowledge TXINTR Re-Enable TXENA Return to ISR Issue "Release" Command Restore Packet Number TXEMPTY = 0 TXINT = 0 (Waiting for Completion) TXEMPTY = X TXINT = 1 (Transmission Failed) TXEMPTY = 1 TXINT = 0 (Everything went through successfully) Read Pkt. # Register & Save Write Address Pointer Register Read Status Word from RAM Update Statistics Update Variables

FIGURE 16 – DRIVER SEND AND ALLOCATE ROUTINES ALLOCATE Issue "Allocate Memory" Command to MMU Read Interrupt Status Register Enqueue Packet Set "Ready for Packet" Flag Return Copy Remaining TX Data Packet into RAM Return Buffers to Upper Layer Write Allocated Packet into Packet # Register Write Address Pointer Register Copy Part of TX Data Packet into RAM Write Source Address into Proper Location Store Data Buffer Pointer Clear "Ready for Packet" Flag Enable Allocation Interrupt Allocation Passed? Yes No DRIVER SEND Choose Bank Select Register 2 Call ALLOCATE Exit Driver Send Read Allocation Result Register

Unlike other controllers, the LAN91C94 does not require a fixed memory partitioning between transmit and receive resources. The MMU allocates and de-allocates memory upon different events. An additional mechanism allows the CPU to prevent the receive process from starving the transmit memory allocation. Memory is always requested by the side that needs to write into it, that is: the CPU for transmit or the CSMA/CD for receive. The CPU can control the number of bytes it requests for transmit but it cannot determine the number of bytes the receive process is going to demand. Furthermore, the receive process requests will be dependent on network traffic, in particular on the arrival of broadcast and multicast packets that might not be for the node, and that are not subject to upper layer software flow control. In order to prevent unwanted traffic from using too much memory, the CPU can program a "memory reserved for transmit" parameter. If the free memory falls below the "memory reserved for transmit" value, MMU requests from the CSMA/CD block will fail and the packets will overrun and be ignored. Whenever enough memory is released, packets can be received again. If the reserved value is too large, the node might lose data which is an abnormal condition. If the value is kept at zero, memory allocation is handled on first-come first- served basis for the entire memory capacity. Note that with the memory management built into the LAN91C94, the CPU can dynamically program this parameter. For instance, when the driver does not need to enqueue transmissions, it can allow more memory to be allocated for receive (by reducing the value of the reserved memory). Whenever the driver needs to burst transmissions it can reduce the receive memory allocation. The driver program the parameter as a function of the following variables: 1) Free memory (read only register) 2) Memory size (read only register) The reserved memory value can be changed on the fly. If the MEMORY RESERVED FOR TX value is increased above the FREE MEMORY, receive packets in progress are still received, but no new packets are accepted until the FREE MEMORY increases above the MEMORY RESERVED value. INTERRUPT GENERATION The interrupt strategy for the transmit and receive processes is such that it does not represent the bottleneck in the transmit and receive queue management between the software driver and the controller. For that purpose there is no register reading necessary before the next element in the queue (namely transmit or receive packet) can be handled by the controller. The transmit and receive results are placed in memory. The receive interrupt will be generated when the receive queue (FIFO of packets) is not empty and receive interrupts are enabled. This allows the interrupt service routine to process many receive packets without exiting, or one at a time if the ISR just returns after processing and removing one. There are two types of transmit interrupt strategies: 1) One interrupt per packet. 2) One interrupt per sequence of packets. The strategy is determined by how the transmit interrupt bits and the AUTO RELEASE bit are used. TX INT bit - Set whenever the TX completion FIFO is not empty. TX EMPTY INT bit - Set whenever the TX FIFO is empty.

AUTO RELEASE - When set, successful transmit packets are not written into completion FIFO, and their memory is released automatically. 1) One interrupt per packet: enable TX INT, set AUTO RELEASE=0. The software driver can find the completion result in memory and process the interrupt one packet at a time. Depending on the completion code the driver will take different actions. Note that the transmit process is working in parallel and other transmissions might be taking place. The LAN91C94 is virtually queuing the packet numbers and their status words. In this case, the transmit interrupt service routine can find the next packet number to be serviced by reading the TX DONE PACKET NUMBER at the FIFO PORTS register. This eliminates the need for the driver to keep a list of packet numbers being transmitted. The numbers are queued by the LAN91C94 and provided back to the CPU as their transmission completes. 2) One interrupt per sequence of packets: Enable TX EMPTY INT and TX INT, set AUTO RELEASE=1. TX EMPTY INT is generated only after transmitting the last packet in the FIFO. TX INT will be set on a fatal transmit error allowing the CPU to know that the transmit process has stopped and therefore the FIFO will not be emptied. This mode has the advantage of a smaller CPU overhead, and faster memory de-allocation. Note that when AUTO RELEASE=1 the CPU is not provided with the packet numbers that completed successfully. Note: The pointer register is shared by any process accessing the LAN91C94 memory. In order to allow processes to be interruptable, the interrupting process is responsible for reading the pointer value before modifying it, saving it, and restoring it before returning from the interrupt. Typically there would be three processes using the pointer: 1) Transmit loading (sometimes interrupt driven) 2) Receive unloading (interrupt driven) 3) Transmit Status reading (interrupt driven). 1) and 3) also share the usage of the Packet Number Register. Therefore saving and restoring the PNR is also required from interrupt service routines. POWER DOWN The LAN91C94 can enter power down mode by means of the PWRDWN pin (pin 68) or the PWRDN bit (Control Register, bit 13). The power down current is 8 mA. When in power down mode, the LAN91C94 will: - Stop the crystal oscillator - Tristate: Data Bus Interrupts nIOCS16 10BASE-T and AUI outputs Turn off analog bias currents - Drive the EEPROM and ROM outputs inactive - Preserve contents of registers and memory The PWRDWN pin is internally gated with the RESET (RESET pin before de- glitching) and with the SRESET bit (COR bit 7). This gating function internally negates power down whenever RESET is high or SRESET is high to allow the oscillator to run during RESET. Except for this gating function, all other uses of the RESET pin use a de- glitched version of the signal as defined in the pin description section.

nXENDEC PIN PWRDN PIN PWRDN BIT X X X Normal external ENDEC operation Normal internal ENDEC operation Powerdown - Normal mode restored by PWRDWN pin going low Powerdown - Bit is cleared by a write access to any LAN91C94 register or by hardware reset

FIGURE 17 – INTERRUPT GENERATION FOR TRANSMIT, RECEIVE and MMU TX FIFO TX COMPLETION FIFO RX FIFO CSM A/CD LOGICAL ADDRESS PACKET # M M U PHYSICAL ADDRESS RAM CPU ADDRESS CSMA ADDRESS RX PACKET NUMBER RX F IFO PACKET NUMBER PACKET NUMBER REGI ST ER PACK # OUTM.S. BI T ONLY 'EM PTY' 'NOT EM PTY' TX DONE PACKET NUMBER 'NOT EM PTY'INTERRUPT STATUS REG ISTER RCV INT TX EMPTYINT TX INT ALLOC INT TWO OPTI ONS

FUNCTIONAL DESCRIPTION OF THE BLOCKS MEMORY MANAGEMENT UNIT The MMU interfaces the on-chip RAM on one side and the arbiter on the other for address and data flow purposes. For allocation and de- allocation, it interfaces the arbiter only. The MMU deals with a single ported memory and is not aware of the fact that there are two entities requesting allocation and actually accessing memory. The mapping function done by the MMU is only a function of the packet number accessed and of the offset within that packet being accessed. It is not a function of who is requesting the access or the direction of the access. To accomplish that, memory accesses as well as MMU allocation and de-allocation requests are arbitrated by the arbiter block before reaching the MMU. Memory allocation could take some time, but the ALLOC INT bit in Interrupt Status Register is negated immediately upon allocation request, allowing the system to poll that register at any time. Memory de-allocation command completion indication is provided via the BUSY bit, readable through the MMU command register. The mapping and queuing functions of the MMU rely on the uniqueness of the packet number assigned to the requester. For that purpose the packet number assignment is centralized at the MMU, and a number will not be reused until the memory associated with it is released. It is clear that a packet number should not be released while the number is in the TX or RX packet queue. The TX and RCV FIFOs are deep enough to handle the total number of packets the MMU can allocate , therefore there is no need for the programmer or the hardware to check FIFO full conditions. ARBITER The function of the arbiter is to sequence packet RAM accesses as well as MMU requests in such a way that the on-chip single ported RAM and a single MMU can be shared by two parties. One party is the host CPU and the other party is the CSMA/CD block. The arbiter is address transparent , namely, any address can be accessed at any time. In order to exploit the sequential nature of the access, and minimize the access time on the system side, the CPU cycle is buffered by the Data Register rather than go directly to and from memory. Whenever a write cycle is performed, the data is written into the Data Register and will be written into memory as a result of that operation, allowing the CPU cycle to complete before the arbitration and memory cycle are complete. Whenever a read cycle is performed, the data is provided immediately from the Data Register, without having to arbitrate and complete a memory cycle. The present cycle results in an arbitration request for the next data location. Loading the pointer causes a similar pre-fetch request. This type of read-ahead and write-behind arbitration allows the controller to have a very fast access time, and would work without wait states for as long as the cycle time spec. is satisfied. The values are 40ns access time, and 185ns cycle time. By the same token, CSMA/CD cycles might be postponed. The worst case CSMA/CD latency for arbiter service is one memory cycle.

The arbiter uses the pointer register as the CPU provided address, and the internal DMA address from the CSMA/CD side as the addresses to be provided to the MMU. The data path routed by the arbiter goes between memory (the data path does not go through the MMU) on one side and either the CPU side bus or the data path of the CSMA/CD core. The data path between memory and the Data Register is in fact buffered by a small FIFO in each direction. The FIFOs beneath the Data Register can be read and written as bytes or words, in any sequential combination. The presence of these FIFOs makes sure that word transfers are possible on the system bus even if the address loaded into the pointer is odd. BUS INTERFACE The bus interface handles the data, address and control interfaces as a superset of the ISA and PCMCIA specifications and allows 8 or 16 bit adapters to be designed with the LAN91C94 with no glue to interface the ISA or PCMCIA bus. The functions done in this block are address decoding for I/O and ROM memory (including address relocation support) for ISA, data path routing, sequential memory address support, optional wait state generation, boot ROM support, EEPROM setup function, bus transceiver control, and interrupt generation/selection. For ISA, I/O address decoding is done by comparing A15-A4 to the I/O BASE address determined in part by the upper byte of the BASE ADDRESS REGISTER, and also requiring that AEN be low. If the above address comparison is satisfied and the LAN91C94 is in 16 bit mode, nIOCS16 will be asserted (low). A valid comparison does not yet indicate a valid I/O cycle is in progress, as the addresses could be used for a memory cycle, or could even glitch through a valid value. Only when nIORD or nIOWR are activated the I/O cycle begins. In PCMCIA mode, A4-A15 are ignored for I/O decodes, which rely on the PCMCIA host, decoding for the slot. Input A10 for ISA is used as an output ( nFWE) for PCMCIA to enable Flash Memory Write for programming the attribute memory. It is valid only when nWE is 0 and COR2 is 1. nA11/nFCS is used to select the Flash Memory Chip. WAIT STATE POLICY The LAN91C94 can work on most system buses without having to add wait states. The two parameters that determine the memory access profile are the read access time and the cycle time into the Data Register. The read access time is 40ns and the cycle time is 185ns. If any one of them does not satisfy the application requirements, wait states should be added. If the access time is the problem, IOCHRDY should be negated for all accesses to the LAN91C94. This can be achieved by programming the NO WAIT ST bit in the configuration register to 0. The LAN91C94 will negate IOCHRDY for 100ns to 150ns on every access to any register. If the cycle time is the problem, programming NO WAIT ST as described before will solve it but at the expense of slowing down all accesses. The alternative is to let the LAN91C94 negate IOCHRDY only when the Data Register FIFOs require so. Namely, if NO WAIT ST is set, IOCHRDY will only be negated if a Data Register read cycle starts and there is less than a full word in the read FIFO, or if a write cycle starts and there is more than two bytes in the write FIFO.

The cycle time is defined as the time between leading edges of read from the Data Register, or equivalently between trailing edges of write to the Data Register. For example, in an ISA system the cycle time of a 16 bit transfer will be at least 2 clocks for the I/O access to the LAN91C94 + one clock for the memory cycle) = 3 clocks. In absolute time it means 375ns for a 8MHz bus, and 240ns for a 12.5 MHz bus. The cycle time will not increase when configured for full duplex mode, because the CSMA/CD memory arbitration requests are sequenced by the DMA logic and never overlap. DMA BLOCK The DMA block resides between the CSMA/CD block and the arbiter. It can interface both the data path and the control path of the CSMA/CD block for different operations. Its functions include the following:

• Start transmission process into the CSMA/CD block.
• Generate CSMA/CD side addresses for accessing memory during transmit and receive operations.
• Generate MMU memory requests and verify success.
• Compute byte count and write it in first locations of receive packet.
• Write transmit status word in first lo cations of transmit packet.
• Determine if enough memory is available for reception.
• De-allocate transmit memory after suitable completion.
• De-allocate receive memory upon error conditions.
• Initiate retransmissions upon collisions (if less than 16 retries).
• Terminate reception and release memory if packet is too long. The specific nature of each operation and its trigger event are: 1) TX operations will begin if TXENA is set and TX FIFO is not empty. The DMA logic does not need to use the TX PACKET NUMBER , it goes directly from the FIFO to the MMU. However the DMA logic controls the removal of the PACKET NUMBER from the FIFO. 2) Generation of CSMA/CD side addresses into memory : Independent 11 bit counters are kept for transmit and receive in order to allow full-duplex operation. 3) MMU requests for allocation are generated by the DMA logic upon reception. The initial allocation request is issued when the CSMA block indicates an active reception. If allocation succeeds, the DMA block stores the packet number assigned to it, and generates write arbitration requests for as long as the CSMA/CD FIFO is not empty. In parallel the CSMA/CD completes the address filtering and notifies the DMA of an address match. If there is no address match, the DMA logic will release the allocated memory and stop reception. 4) When the CSMA/CD block notifies the DMA logic that a receive packet was completed, if the CRC is OK, the DMA will either write the previously stored packet number into the RX PACKET NUMBER FIFO (to be processed by the CPU), or if the CRC is bad the DMA will just issue a release command to the MMU (and the CPU will never see that packet). Packets with bad CRC can be received if the RCV_BAD bit in the configuration register is set.

5) If AUTO_ RELEASE is set, a release is issued by the DMA block to the MMU after a successful transmission (TX_SUCC set), and the TX completion FIFO is clocked together with the TX FIFO preventing the packet number from moving into the TX completion FIFO. 6) Based o n the RX counter value, if a receive packet exceeds 1532 bytes, reception is stopped by the DMA and the RX ABORT bit in the Receive Control Register is set. The memory allocated to the packet is automatically released. 7) If an allocation fails, the CSMA/CD block will activate RX_OVRN upon detecting a FIFO full condition. RXEN will stay active to allow reception of subsequent packets if memory becomes available. The CSMA/CD block will flush the FIFO upon the new frame arrival. PACKET NUMBER FIFOS The transmit packet FIFO stores the packet numbers awaiting transmission, in the order they were enqueued. The FIFO is advanced (written) when the CPU issues the " enqueue packet number command" , the packet number to be written is provided by the CPU via the Packet Number Register. The number was previously obtained by requesting memory allocation from the MMU. The FIFO is read by the DMA block when the CSMA/CD block is ready to proceed on to the next transmission. By reading the TX EMPTY INT bit the CPU can determine if this FIFO is empty. The transmit completion FIFO stores the packet numbers that were already transmitted but not yet acknowledged by the CPU. The CPU can read the next packet number in this FIFO from the Fifo Ports Register. The CPU can remove a packet number from this FIFO by issuing a TX INT acknowledge. The CPU can determine if this FIFO is empty by reading the TX INT bit or the FIFO Ports Register. The receive packet FIFO stores the packet numbers already received into memory, in the order they were received. The FIFO is advanced (written) by the DMA block upon reception of a complete valid packet into memory. The number is determined the moment the DMA block first requests memory from the MMU for that packet. The first receive packet number in the FIFO can be read via the Fifo Ports Register, and the data associated with it can be accessed through the receive area. The packet number can be removed from the FIFO with or without an automatic release of its associated memory. The FIFO is read out upon CPU command (remove packet from top of RX FIFO, or remove and release command) after processing the receive packet in the receive area. The width of each FIFO is 5 bits per packet number. The depth of each FIFO equals the number of packets the LAN91C94 can handle (18). The guideline is software transparency; the software driver should not be aware of different devices or FIFO depths. If the MMU memory allocation succeeded, there will be room in the transmit FIFO for enqueuing the packet. Conversely if there is free memory for receive, there should be room in the receive FIFO for storing the packet number. Note that the CPU can enqueue a transmit command with a packet number that does not follow the sequence in which the MMU assigned packet numbers. For example, when a transmission failed and it is retried in software, or when a receive packet is modified and sent back to the network.

FIGURE 18 – MMU PACKET NUMBER FLOW AND REVELANT REGISTERS TX FIFO COMPLETION FIFO RX FIFO CSM A/C D LOGICAL ADDRESS PACKET # M M U PHYSICAL ADDRESS RAM CPU ADDRESS CSMA ADDRESS RX PACKET NUMBER RX FIFO PACKET NUM BER PACKET NUM BER REGISTER PACK # OUT TX DONE PACKET NUM BER ALLOCATION RESULT REGISTER AL LOCATE RELEASE PACK # OUT DMA RDWR TX DECODER M MU COMM AND REGISTER AL LOCATE RELEASE

The CSMA/CD block is first interfaced via its control registers in order to define its operational configuration. From then on, the DMA interface between the CSMA/CD block and memory is used to transfer data to and from its data path interface. For transmit, the CSMA/CD block will be asked to transmit frames as soon as they are ready in memory. It will continue transmissions until any of the following transmit error occurs: a) 16 collisions on same frame b) Late collision c) Lost Carrier sense and MON_CSN set. d) Transmit Under run. e) SQET error and STP_SQET set. In that case TXENA will be cleared and the CPU should restart the transmission by setting it again. If a transmission is successful, TXENA stays set and the CSMA/CD is provided by the DMA block with the next packet to be transmitted. For receive, the CPU sets RXEN as a way of starting the CSMA/CD block receive process. The CSMA/CD block will send data after address filtering through the data path to the DMA block. Data is transferred into memory as it is received, and the final check on data acceptance is the CRC checking done by the CSMA/CD block. In any case, the DMA takes care of requesting/releasing memory for receive packets, as well as generating the byte count. The receive status word is provided by the CSMA/CD block and written in the first location of the receive structure by the DMA block. If configured for storing CRC in memory, the CSMA/CD unit will transfer the CRC bytes through the DMA interface, and then will be treated like regular data bytes. Note that the receive status word of any packet is available only through memory and is not readable through any other register. In order to let the CPU know about receive overruns, the RX_OVRN bit is latched into the Interrupt Status Register, which is readable by the CPU at any time. The address filtering is done inside the CSMA/CD block. A packet will be received if the destination address is broadcast, or if it is addressed to the individual address of the LAN91C94, or if it is a multicast address and ALMUL bit is set, or if it is a multicast address matching one of the multicast table entries. If the PRMS bit is set, all packets are received. The CSMA/CD block is a full duplex machine, and when working in full duplex mode, the CSMA/CD block will be simultaneously using its data path transmit and receive interfaces. Statistical counters are kept by the CSMA/CD block, and are readable through the appropriate register. The counters are four bits each, and can generate an interrupt when reaching their maximum values. Software can use that interrupt to update statistics in memory, or it can keep the counter interrupt disabled, while relying on the transmit interrupt routine reading the counters. Given that the counters can increment only once per transmit, this technique is a good complement for the single interrupt per sequence strategy. The interface between the CSMA/CD block and memory is word oriented. Two bi-directional FIFOs make the data path interface. Whenever a normal collision occurs (less than 16 retries), the CSMA/CD will trigger the backoff logic and will indicate the DMA logic of the collision. The DMA is responsible for restarting the data transfer into the CSMA/CD block regardless of whether the collision happened on the preamble or not.

Only when 16 retries are reached, the CSMA/CD block will clear the TXENA bit, and CPU intervention is required. The DMA will not automatically restart data transfer in this case, nor will it transmit the next enqueued packet until TXENA is set by the CPU. The DMA will move the packet number in question from the TX FIFO into the TX completion FIFO. NETWORK INTERFACE The LAN91C94 includes both an AUI interface for thick and thin coax applications and a 10BASE-T interface for twisted pair applications. Functions common to both are: 1. Manche ster encoder/decoder to convert NRZ data to Manchester encoded data and back. 2. A 32 ms jabber timer to prevent inadvertently long transmissions. When 'jabbing' occurs, the transmitter is disabled, automatic loopback is disabled (in 10BASE- T mode), and a collision indication is given to the controller. The interface ' unjabs' when the transmitter has been idle for a minimum of 256 ms. 3. A phase-lock loop to recover data and clock from the Manchester data stream with up to plus or minus 18ns of jitter. 4. Diagnostic loopback capability. 5. LED drivers for collision, transmission, reception, and jabber. 10BASE-T The 10BASE-T interface conforms to the twisted pair MAU addendum to the 802.3 specification. On the transmission side, it converts the NRZ data from the controller to Manchester data and provides the appropriate signal level for driving the media. Signal are predistorted before transmission to minimize ISI. The collision detection circuitry monitors the simultaneous occurrence of received signals and transmitted data on the media. During transmission, data is automatically looped back to the receiver except during collision periods, in which case the input to the receiver is network data. During collisions, should the receive input go idle prior to the transmitter going idle, input to the receiver switches back to the transmitter within 9 bit times. Following transmission, the transmitter performs a SQE test. This test exercises the collision detection circuitry within the 10BASE-T interface. The receiver monitors the media at all times. It recovers the clock and data and passes it along to the controller. In the absence of any receive activity, the transmitter is looped back to the receiver. In addition, the receiver performs automatic polarity correction. The 10BASE-T interface performs link integrity tests per section 14.2.1.7 of 802.3, using the following values: 1. Link_loss_timer: 64 ms 2. Link_test_min_timer: 4 ms 3. Link_count: 2 4. Link_test_max_timer: 64 ms The state of the link is reflected in the EPHSR. AUI The LAN91C94 also provides a standard 6 wire AUI interface to a coax transceiver. PHYSICAL INTERFACE The internal physical interface (PHY) consists of an encoder/decoder (ENDEC) and an internal 10BASE-T transceiver. The ENDEC also provides a standard 6-pin AUI interface to an external coax transceiver for 10BASE-T and 10BASE-5 applications. The signals between MAC and the PHY can be routed to pins by asserting the nXENDEC pin low. This feature allows the interface to an external ENDEC and transceiver. The PHY functions can be divided into transmit and receive functions.

The PHY encodes the transmit data received from the MAC. The encoded data is directed internally to the selected output driver for transmission over the twisted-pair network or the AUI cable. Data transmission and encoding is initiated by the Transmit Enable input, TXE, going low. Transmit Drivers The encoded transmit data passes through to the transmit driver pair, TPETXP(N), and its complement, TPETXDP(N). Each output of the transmit driver pair has a source resistance of 10 ohms maximum and a current rating of 25 mA maximum. The degree of predistortion is determined by the termination resistors; the equivalent resistance should be 100 ohms. Jabber Function This integrated function prevents the DTE from locking into a continuous transmit state. In 10BASE-T mode, if transmission continues beyond the specified time limit, the jabber function inhibits further transmission and asserts the collision indicator nCOLL. The limits for jabber transmission are 20 to 15 ms in 10BASE-T mode. In the AUI mode, the jabber function is performed by the external transceiver. SQE Function In the 10BASE-T mode, the PHY supports the signal quality error (SQE) function. At the end of a transmission, the PHY asserts the nCOLL signal for 10+/-5 bit times beginning 0.6 to 1.6ms after the last positive transition of a transmitted frame. In the AUI mode, the SQE function is performed by the external transceiver. Receive Functions Receive Drivers Differential signals received off the twisted-pair network or AUI cable are directed to the internal clock recovery circuit prior to being decoded for the MAC. Manchester Decoder and Clock Recovery The PHY performs timing recovery and Manchester decoding of incoming differential signals in 10BASE-T or AUI modes, with its built-in phase-lock loop (PLL). The decoded (NRZ) data, RXD, and the recovered clock, RXCLK, becomes available to the MAC, typically within 9 bit times (5 for AUI) after the assertion of nCRS. The receive clock, RXCLK, is phase-locked to the transmit clock in the absence of a received signal (idle). Squelch Function The integrated smart squelch circuit employs a combination of amplitude and timing measurements to determine the validity of data received off the network. It prevents noise at the differential inputs from falsely triggering the decoder in the absence of valid data or link test pulses. Signal levels below 300mV (180mV for AUI) or pulse widths less than 15ns at the differential inputs are rejected. Signals above 585mV (300mV for AUI) and pulse widths greater than 30ns will be accepted. When using the extended cable mode with 10BASE-T media which extends beyond the standard limit of 100 meters, the squelch level can optionally be set to reject signals below 180mV and accept signals above 300mV. If the input signal exceeds the squelch requirements, the carrier sense output, nCRS , is asserted.

In the 10BASE-T mode, the PHY monitors for receiver polarity reversal due to crossed wires and corrects by reversing the signal internally. Collision Detection Function In the 10BASE-T mode, a collision state is indicated when there are simultaneous transmissions and receptions on the twisted pair link. During a collision state, the nCOLL signal is asserted. If the received data ends and the transmit control signal is still active, the transmit data is sent to the MAC within 9 bit times. The nCOLL signal is de-asserted within 9 bit times after the collision terminates. In the AUI mode, the external transceiver sends a 10MHz signal to the PHY upon detection of a collision. Link Integrity The PHY test for a faulty twisted-pair link. In the absence of transmit data, link test pulses are transmitted every 16+/-18ms after the end of the last transmission or link pulse on the twisted pair medium. If neither valid data nor link test pulses are received within 10 to 150ms, the link is declared bad and both data transmission as well as the operational loopback function are disabled. The Link Integrity function can be disabled for pre-10BASE-T twisted-pair networks.

The following parameters are obtained from the EEPROM as board setup information: ETHERNET INDIVIDUAL ADDRESS I/O BASE ADDRESS ROM BASE ADDRESS 8/16 BIT ADAPTER 10BASE-T or AUI INTERFACE INTERRUPT LINE SELECTION All the above mentioned values are read from the EEPROM upon hardware reset. Except for the INDIVIDUAL ADDRESS, the value of the IOS switches determines the offset within the EEPROM for these parameters, in such a way that many identical boards can be plugged into the same system by just changing the IOS jumpers. In order to support a software utility based installation, even if the EEPROM was never programmed, the EEPROM can be written using the LAN91C94. One of the IOS combination is associated with a fixed default value for the key parameters (I/O BASE, ROM BASE, INTERRUPT) that can always be used regardless of the EEPROM based value being programmed. This value will be used if all IOS pins are left open or pulled high. The EEPROM is arranged as a 64 x 16 array. The specific target device is the 9346 1024-bit Serial EEPROM. All EEPROM accesses are done in words. All EEPROM addresses shown are specified as word addresses. INDIVIDUAL ADDRESS 20-22 hex If IOS2-0 = 7 , only the INDIVIDUAL ADDRESS is read from the EEPROM. Currently assigned values are assumed for the other registers. These values are default if the EEPROM read operation follows hardware reset. The EEPROM SELECT bit is used to determine the type of EEPROM operation : a) normal or b) general purpose register. a) NORMAL EEPROM OPERATION - EEPROM SELECT bit = 0 On EEPROM read operations (after reset or after setting RELOAD high) the CONFIGURATION REGISTER and BASE REGISTER are updated with the EEPROM values at locations defined by the IOS2-0 pins. The INDIVIDUAL ADDRESS registers are updated with the values stored in the INDIVIDUAL ADDRESS area of the EEPROM. REGISTER EEPROM WORD ADDRESS Configuration Register Base Register IOS Value * 4 (IOS Value *4) + 1

On EEPROM write operations (after setting the STORE bit) the values of the CONFIGURATION REGISTER and BASE REGISTER are written in the EEPROM locations defined by the IOS2-0 pins. The three least significant bits of the CONTROL REGISTER (EEPROM SELECT, RELOAD and STORE) are used to control the EEPROM. Their values are not stored nor loaded from the EEPROM. b) GENERAL PURPOSE REGISTER - EEPROM SELECT bit = 1 On EEPROM read operations (after setting RELOAD high) the EEPROM word address defined by the POINTER REGISTER 6 least significant bits is read into the GENERAL PURPOSE REGISTER. On EEPROM write operations (after setting the STORE bit) the value of the GENERAL PURPOSE REGISTER is written at the EEPROM word address defined by the POINTER REGISTER 6 least significant bits. RELOAD and STORE are set by the user to initiate read and write operations respectively. Polling the value until read low is used to determine completion. When an EEPROM access is in progress the STORE and RELOAD bits of CTR will readback as both bits high. No other bits of the LAN91C94 can be read or written until the EEPROM operation completes and both bits are clear. This mechanism is also valid for reset initiated reloads. Note: If no EEPROM is connected to the LAN91C94, for example for some embedded applications, the ENEEP pin should be grounded and no accesses to the EEPROM will be attempted. Configuration, Base, and Individual Address assume their default values upon hardware reset and the CPU is responsible for programming them for their final value. DIAGNOSTIC LEDs The following LED drive signals are available for diagnostic and installation aid purposes: nTXLED - Activated by transmit activity. nBSELED - Board select LED. Activated when the board space is accessed, namely on accesses to the LAN91C94 register space or the ROM area decoded by the LAN91C94. The signal is stretched to 125 msec. nRXLED - Activated by receive activity. nLINKLED - Reflects the link integrity status. ARBITRATION CONSIDERATIONS The arbiter exploits the sequential nature of the CPU accesses to provide a very fast access time. Memory bandwidth considerations will have an effect on the CPU cycle time but no effect on access time. For normal 8 MHz, 10 MHz and 12.5 MHz ISA buses as well as EISA normal cycles the LAN91C94 can be accessed without negating ready. When write operations occur, the data is written into a FIFO. The CPU cycle can complete immediately, and the buffered data will be written into memory later. The memory arbitration request is generated as a function of that FIFO being not empty. The nature of the cycle requested (byte/word) is determined by the lsb of the pointer and the number of bytes in the FIFO. When read operations occur, words are pre- fetched upon pointer loading in order to have at least a word ready in the FIFO to be read. New pre-fetch cycles are requested as a function of the number of bytes in the FIFO.

FIGURE 19 – 64 X 16 SERIAL EEPROM MAP CONFIGURATION REG. BASE REG. CONFIGURATION REG. BASE REG. CONFIGURATION REG. BASE REG. CONFIGURATION REG. BASE REG. CONFIGURATION REG. BASE REG. CONFIGURATION REG. BASE REG. CONFIGURATION REG. BASE REG. IA0-1 IA2-3 IA4-5 IOS2-0 WORD ADDRESS 000 0h Ch Dh 10h 11h 14h 15h 18h 19h 20h 21h 22h 001 010 011 100 101 110 XXX

16 BITS

For example, if an odd pointer value is loaded, first a byte is pre-fetched into the FIFO, and immediately a full word is pre-fetched completing three bytes into the FIFO. If the CPU reads a word, one byte will be left again a new word is pre-fetched. In the case of write, if an odd pointer value is loaded , and a full word is written, the FIFO holds two bytes, the first of which is immediately written into an odd memory location. If by that time another byte or word was written, there will be two or three bytes in the FIFO and a full word can be written into the now even memory address. When a CSMA/CD cycle begins, the arbiter will route the CSMA/CD DMA addresses to the MMU as well as the packet number associated with the operation in progress. In full-duplex mode, receive and transmit requests are alternated in such a way that the CPU arbitration cycle time is not affected.

MAXIMUM GUARANTEED RATINGS* *Stresses above those listed above could cause permanent damage to the device. This is a stress rating only and functional operation of the device at any other condition above those indicated in the operation sections of this specification is not implied. Note: When powering this device from laboratory or system power supplies, it is important that the Absolute Maximum Ratings not be exceeded or device failure can result. Some power supplies exhibit voltage spikes on their outputs when the AC power is switched on or off. In addition, voltage transients on the AC power line may appear on the DC output. If this possibility exists, it is suggested that a clamp circuit be used. DC ELECTRICAL CHARACTERISTICS (T A = 0°C to 70°C, V CC = +5.0 V ± 10%) PARAMETER SYMBOL MIN TYP MAX UNITS COMMENTS I Type Input Buffer Low Input Level High Input Level V ILI V IHI 2.0 0.8 V V TTL Levels IS Type Input Buffer Low Input Level High Input Level Schmitt Trigger Hysteresis V ILIS V IHIS V HYS 2.2 250 0.8 V V mV Schmitt Trigger Schmitt Trigger ICLK Input Buffer Low Input Level High Input Level V ILCK V IHCK 3.0 0.4 V V

PARAMETER SYMBOL MIN TYP MAX UNITS COMMENTS Input Leakage (All I and IS buffers except pins with pullups/ pulldowns) Low Input Leakage High Input Leakage IIL IIH -10 -10 +10 +10 µA µA V IN = 0 V IN = V CC IP Type Buffers Input Current IIL -150 -75 µA V IN = 0 ID Type Buffers Input Current IIH +75 +150 µA V IN = V CC I/O4 Type Buffer Low Output Level High Output Level Output Leakage V OL V OH IOL 2.4 -10 0.4 +10 V V µA IOL = 4 mA IOH = -2 mA V IN = 0 to V CC I/O24 Type Buffer Low Output Level High Output Level Output Leakage V OL V OH IOL 2.4 -10 0.5 +10 V V µA IOL = 24 mA IOH = -12 mA V IN = 0 to V CC O24 Type Buffer Low Output Level High Output Level Output Leakage V OL V OH IOL 2.4 -10 0.5 +10 V V µA IOL = 24 mA IOH = -12 mA V IN = 0 to V CC O4 Type Buffer Low Output Level High Output Level Output Leakage V OL V OH IOL 2.4 -10 0.4 +10 V V µA IOL = 4 mA IOH = -2 mA V IN = 0 to V CC

PARAMETER SYMBOL MIN TYP MAX UNITS COMMENTS OD16 Type Buffer Low Output Level Output Leakage V OL IOL -10 0.5 +10 V µA IOL = 16 mA V IN = 0 to V CC OD162 Type Buffer Low Output Level High Output Level Output Leakage V OL V OH IOL 2.4 -10 0.5 +10 V V µA IOL = 16 mA IOH = -2 mA V IN = 0 to V CC OD24 Type Buffer Low Output Level Output Leakage V OL IOL -10 0.5 +10 V µA IOL = 24 mA V IN = 0 to V CC Supply Current Active Supply Current Standby ICC ICSBY 95 mA mA All outputs open. CAPACITANCE T A = 25°C; fc = 1MHz; V CC = 5V LIMITS PARAMETER SYMBOL MIN TYP MAX UNIT TEST CONDITION Clock Input Capacitance C IN 20 pF Input Capacitance C IN 10 pF Output Capacitance C OUT 20 pF All pins except pin under test tied to AC ground

PARAMETER MIN TYP MAX UNITS 10BASE-T Receiver Threshold Voltage 100 mV Receiver Squelch 300 400 585 mV Receiver Common Mode Range 0 V DD Transmitter Output: Voltage Source Resistance ±2 ±2.5 ±3 V ohms Transmitter Output DC Offset 50 mV Transmitter Backswing Voltage to Idle 100 mV Differential Input Voltage ±0.585 ±3 V AUI Receiver Threshold Voltage 60 mV Receiver Squelch 180 240 300 mV Receiver Common Mode Range 0 V DD Transmitter Output Voltage (R=78 Ω ) ±0.45 ±0.85 ±1.2 V Transmitter Backswing Voltage to Idle 100 mV Input Differential Voltage ±0.3 ±1.2 V Output Short Circuit (to V CC or GND) Current ±150 mA Differential Idle Voltage (measured 8.0 µs after last positive transition of data frame) ±40 mV CAPACITIVE LOAD ON OUTPUTS nIOCS16, IOCHRDY 240 pF INTR0-3 120 pF All other outputs 45 pF

FIGURE 20 - CARD CONFIGURATION REGISTERS-READ/WRITE-PCMCIA MODE (A15=1) ns ns ns ns ns ns ns ns ns t57 t58 t59 t60 t61 t62 t63 t64 t65 Write Data Setup to nWE Rising Write Data Hold after nWE Rising nOE Low to Valid Data Address, nREG Setup to nWE Active Address, nREG Hold after nOE Inactive Address, nREG Setup to nOE Active Address, nREG Hold after Control Inactive nCE1 Setup to nWE Rising nCE1 Low to Valid Data Parameter min typ max units t60 t63 t60 t61 t62 t64 t57 t58 t59 t65 valid valid valid valid A0-9,A15 nREG nCE1 nWE nOE D0-7

FIGURE 21 - ISA CONSECUTIVE READ CYCLES VALID ADDRESS VALID ADDRESS VALID DATA OUT VALID DATA OUT t15 t4 t3 t20 t5 t6 Z Z A0-15 AEN, nSBHE nIOCS16 nIORD D0-15 t15 t20 Address, nSBHE, AEN Setup to Control Active Address, nSBHE, AEN Hold after Control Inactive nIORD Low to Valid Data nIORD High to Data Floating A4-A15, AEN Low, BALE High to nIOCS16 Low Cycle time* Parameter min typ max units 185 ns ns ns ns ns ns BALE Tied High IOCHRDY not used - t20 has to be met *Note: The cycle time is defined only for consecutive accesses to the Data Register. These values assume that IOCHRDY is not used.

FIGURE 22 - PCMCIA CONSECUTIVE READ CYCLES ns ns ns ns ns ns ns ns ns 185 Parameter t46 t47 t48 t20 t49 t50 t51 t52 t53 nIORD Delay to INPACK nREG Low to Control Active nCE1,nCE2 Setup to Control Active Cycle Time (No Wait States) nREG Hold after Control Active nCE1,nCE2 Hold after Control Inactive Address Setup to Control Active Address Hold after Control Inactive nIORD Active to Data Valid min typ max units t51 t52 t48 t20 t49 t50 t53 t47 t46 t46 valid valid A0-9,A15 nREG nCE1,nCE2 nIORD D0-15 nINPACK

FIGURE 23 - ISA CONSECUTIVE WRITE CYCLES VALID ADDRESS VALID ADDRESS t15 t4 t3 t20 A0-15 AEN, nSBHE nIOCS16 nIOWR D0-15 VALID DATA IN VALID DATA ns ns ns ns ns ns t15 t20 Address, nSBHE, AEN Setup to Control Active Address, nSBHE, AEN Hold after Control Inactive Data Setup to nIOWR Rising Data Hold after nIOWR Rising A4-A15, AEN Low, BALE High to nIOCS16 Low Cycle time* Parameter min typ max units 185 IOCHRDY not used - t20 has to be met BALE Tied High *Note: The cycle time is defined only for consecutive accesses to the Data Register. These values assume that IOCHRDY is not used.

FIGURE 24 - CONSECUTIVE PCMCIA WRITE CYCLES t51 t52 t47 t49 t48 t50 t20 t54 t55 valid valid A0-9,A15 nREG nCE1,nCE2 nIOWR D0-15 185 t47 t48 t49 t50 t51 t52 t20 t54 t55 ns ns ns ns ns ns ns ns ns nREG Low Setup to Control Active nCE1,nCE2 Setup to Control Active nREG Hold after Control Inactive nCE1,nCE2 Hold after Control Inactive Address Setup to Control Active Address Hold after Control Inactive Cycle Time (No Wait States) Write Data Setup to nIOWR Rising Write Data Hold after nIOWR Rising Parameter min typ max units

FIGURE 25 - ISA CONSECUTIVE READ AND WRITE CYCLES t20 A0-15 AEN, nSBHE nIOCS16 nIOWR D0-D15 VALID ADDRESS VALID ADDRESS nIORD t10 Z Z ZVALID DATA VALID DATA IOCHRDY ZZ Control Active to IOCHRDY Low IOCHRDY Low Pulse Width* Cycle time** Parameter min typ max units 100 185 150 ns ns ns t10 t20 *Note: Assuming NO WAIT ST = 0 in configuration register and cycle time observed. **Note: The cycle time is defined only for accesses to the Data Register as follows: For Data Register Read - From nIORD falling to next nIORD falling For Data Register Write - From nIOWR rising to next nIOWR rising

FIGURE 26 - DATA REGISTER SPECIAL READ ACCESS A0-15 (ISA) AEN, nSBHE nIOCS16 D0-D15 nIORD VALID DATA VALID ADDRESS IOCHRDY OUT t9 t18 t19 Z Z Parameter min typ max units 575 225 ns ns ns t18 t19 Control Active to IOCHRDY Low IOCHRDY Width when Data is Unavailable at Data Register Valid Data to IOCHRDY Inactive IOCHRDY is used instead of meeting t20 and t44. "No Wait St' bit is 1 - IOCHRDY only negated if needed and only for Data Register access.

FIGURE 27 - DATA REGISTER SPECIAL WRITE ACCESS A0-15 (ISA) AEN, nSBHE nIOWR VALID DATA IN IOCHRDY t18Z Z Parameter min typ max units 425 t18 Control Active to IOCHRDY Low IOCHRDY Width when Data Register is Full IOCHRDY is used instead of meeting t20 and t44. 'No Wait St' bit is 1 - IOCHRDY only negated if needed and only for Data Register access. ns ns VALID ADDRESS nIOCS16 D0-D15

FIGURE 30 - ISA REGISTER ACCESS WHEN USING BALE AEN nIOCS16 A0-15, nSBHE nIORD BALE nIOWR VALID t1 t2 t15 t15 Address, nSBHE Setup to BALE Falling Address, nSBHE Hold after BALE Falling Address, nSBHE, AEN Setup to Control Active AEN Hold after Control Inactive A4-A15, AEN Low, BALE High to nIOCS16 Low Parameter min typ max units ns ns ns ns ns t4 not needed. nIOCS16 not relevant in 8-bit mode.

FIGURE 31 - EXTERNAL ROM READ ACCESS USING BALE nMEMRD A0-19 nROM BALE VALID t16 t17 Address Setup to BALE Falling Address Hold after BALE Falling Address Setup to Control Active nMEMRD Low to nROM Low nMEMRD High to nROM High t16 t17 Parameter min typ max units ns ns ns ns ns

EESK Falling to EEDO, EECS Changingt21 Parameter min typ max units 100 ns t21 t21 9346 is typically the serial EEPROM used.

EESK Falling to EEDO, EECS Changingt21 Parameter min typ max units 100 ns t21 t21 9346 is typically the serial EEPROM used.

FIGURE 34 - PCMCIA ATTRIBUTE MEMORY READ/WRITE (A15=0) t67 t67 t67 t67 t67 t67 t67 t67 t67 t67 t67 t67 t66 t66 valid validA0-9,A15 nREG nCE1 nFCS nWE nFWE nOE ns ns nWE to nFWE Delay Address, nREG, nCE1 Delay to nFCS t66 t67 Parameter min typ max units

FIGURE 37 - DIFFERENTIAL OUTPUT SIGNAL TIMING (10BASE-T AND AUI) TPETXP TPETXN TPETXDN TPETXDP TXP TXN t31 t32 t33 t34 TPETXP to TPETXN Skew TPETXP(N) to TPETXDP(N) Delay TPETXDN to TPETXDP Skew TXP to TXN Skew Parameter min typ max units -1.5 1.5 ns ns ns ns t31 t31 t32 t32 t33 t33 t34 t34 TWISTED PAIR DRIVERS AUI DRIVERS

FIGURE 38 - RECEIVE TIMING - START OF FRAME (AUI AND 10BASE-T) 1 1 0 11 0 1 0 1 00 first bit decoded t35 t36 1 1 0 11 0 1 0 1 00 t37 first bit decoded t38 RECP RECN nCRS (internal) TPERXP(N) nCRS (internal) t35 t36 t37 t38 Noise Pulse Width Reject (AUI) Carrier Sense Turn On Delay (AUI) Noise Sense Pulse Width Reject (10BASE-T) Carrier Sense Turn On Delay (10BASE-T) Parameter min typ max units 450 100 550 ns ns ns ns 500

FIGURE 39 - RECEIVE TIMING - END OF FRAME (AUI AND 10BASE-T) b a 1/0 last bit TPERXP TPERXN RECP RECN nCRS (internal) t39 t39 Receiver Turn Off Delay Parameter min typ max units 200 300 ns

FIGURE 40 - TRANSMIT TIMING - END OF FRAME (AUI AND 10BASE-T) b a 1/0 last bit TPETXP TPETXN TXP TXN t40 t41 Transmit Output High to Idle in Half-Step Mode Transmit Output High before Idle in Half-Step Mode Parameter min typ max units 200 800 ns ns t40 t41

FIGURE 41 - COLLISION TIMING (AUI) t42 t43 COLLP COLLN COL (internal) t42 t43 Collision Turn On Delay Collision Turn Off Delay Parameter min typ max units 350 ns ns

FIGURE 44 - 100 PIN QFP PACKAGE OUTLINE 0.10 -C- H A A2 TD/TE L E1E D e W DIM A D E H L e W TD(1) TE(1) TD(2) TE(2) MIN 2.80 0.1 2.57 23.4 19.9 17.4 13.9 0.1 0.65 1.8 MAX 3.15 0.45 2.87 24.15 20.1 18.15 14.1 0.2 0.95 2.6 MIN .110 .004 .101 .921 .783 .685 .547 .004 .026 .071 MAX .124 .018 .113 .951 .791 .715 .555 .008 .037 .102 21.8 15.8 22.21 16.27 12° 22.2 16.2 22.76 16.82

0.65 BSC

.008 .858 .622 .874 .641 12° .016 .874 .638 .896 .662 .0256 BSC Notes: 1) Coplanarity is 0.100mm (.004") maximum. 2) Tolerance on the position of the leads is 0.200mm (.008") maximum. 3) Package body dimensions D1 and E1 do not include the mold protrusion. Maximum mold protrusion is 0.25mm (.010"). 4) Dimensions TD and TE are important for testing by robotic handler. Only above combinations of (1) or (2) are acceptable. 5) Controlling dimension: millimeter. Dimensions in inches for reference only and not necessarily accurate. Millimeters Inches

FIGURE 45 - 100 PIN TQFP PACKAGE OUTLINE L Notes: Coplanarity is 0.08mm or 3.2 mils maximum. Tolerance on the position of the leads is 0.080mm maximum. Package body dimensions D1 and E1 do not include the mold protrusion. Maximum mold protrusion is 0.25mm. Dimension for foot length L are measured at the gauge plane 0.25mm above the seating plane. Details of pin 1 identifier are optional but must be located within the zone indicated. 6. Controlling dimension: millimeter E1E D e W E1/4 D1/4 0.10 -C- H A SEE DETAIL "A" DETAIL "A" DIM A D E H L e W ccc MIN 0.05 0.95 15.90 13.90 15.90 13.90 0.09 0.45 NOM 0.10 1.00 16.00 14.00 16.00 14.00 0.60 1.00 MAX 1.20 .15 1.05 16.10 14.10 16.10 14.10 0.20 0.75 0.17 0.22

0.50 BSC

0.27 0.08

FIGURE 46 – 100 PIN VTQFP PACKAGE OUTLINE E1E D e W E1/4 D1/4 0.10 -C- H A SEE DETAIL "A" L DETAIL "A" Notes: Coplanarity is 0.08mm or 3.2 mils maximum. Tolerance on the position of the leads is 0.080mm maximum. Package body dimensions D1 and E1 do not include the mold protrusion. Maximum mold protrusion is 0.25mm. Dimension for foot length L are measured at the gauge plane 0.25mm above the seating plane. Details of pin 1 identifier are optional but must be located within the zone indicated. 6. Controlling dimension: millimeter A D E MIN 0.05 0.95 15.90 13.90 15.90 13.90 NOM 0.10 1.00 16.00 14.00 16.00 14.00 MAX 1.20 0.15 1.05 16.10 14.10 16.10 14.10 H L e W ccc NOM 0.60 1.00 0.22 MIN 0.09 0.45 0.17 MAX 0.20 0.75 0.27 0.08

PAGE SECTION/FIGURE/ENTRY CORRECTION DATE REVISED

1 Software Drivers and following text Changed from "Software

Compatibility" See Italicized Text 4/17/96

4 General Description See Italicized Text 4/17/96

4 Overview See Italicized Text 4/17/96

13 Pin Number/TQFP See Italicized Text 4/17/96

35 EPH_LOOP *Refer to Note/See Italicized Text 4/17/96

116 100 Pin TQFP/Refer to Table See Italicized Text 4/17/96 55 "ETEN" bit Last two sentences above "Note" have been removed 10/31/96

90 MAXIMUM GUARANTEED

RATINGS/Operating Temperature Range See Italicized Text 6/9/97

90 DC ELECTRICAL

See Italicized Text 6/9/97

118 Figure 46 – 100 Pin VTQFP Package

Added to Data Sheet 9/26/97 *Note: After exiting the loopback test, SRESET in Card Option Register or SOFT_RST in RCR must be set before returning to normal operation.

 1997 STANDARD MICROSYS TEMS CORP. Circuit diagrams utilizing SMSC products are included as a means of illustrating typical applications; consequently complete information sufficient for construction purposes is not necessarily given. The information has been carefully checked and is believed to be entirely reliable. However, no responsibility is assumed for inaccuracies. Furthermore, such information does not convey to the purchaser of the semiconduc tor devices described any licenses under the patent rights of SMSC or others. SMSC reserves the right to make changes at any time in order to improve design and supply the best product possible. SMSC products are not designed, intended, authorized or warranted for use in any life support or other application where product failure could cause or contribute to personal injury or severe property damage. Any and all such uses without prior written approval of an Officer of SMSC and further testing and/or modification will be fully at the risk of the customer. LAN91C94 Rev. 9/26/97