LAN91C94

PRELIMINARY

ISA/PCMCIA

Single-Chip Ethernet Controller with RAM

FEATURES

ISA/PCMCIA Single-Chip Ethernet
Controller

4608 Bytes of On-Chip RAM

Supports IEEE 802.3 (ANSI 8802-3)
Ethernet Standards

Simultasking

- Early Transmit and Early

Receive Functions

Hardware Memory Management Unit

Optional Configuration via Serial EEPROM
Interface (Jumperless)

Single +5V Power Supply

Low Power CMOS Design

100 Pin QFP, TQFP and VTQFP Package

Bus Interface

Direct Interface to ISA and PCMCIA with No
Wait States

Flexible Bus Interface

16-Bit Data and Control Paths

Fast Access Time (40 ns)

Pipelined Data Path

Handles Block Word Transfers for Any
Alignment

High Performance Chained ("Back-to-
Back") Transmit and Receive

Pin Compatible with LAN91C92 (in ISA
mode)

Flat Memory Structure for Low CPU
Overhead

Dynamic Memory Allocation Between
Transmit and Receive

Buffered Architecture, Insensitive to Bus
Latencies (No Overruns/Underruns)

Supports Boot PROM for Diskless ISA
Applications

Network Interface

Integrates 10BASE-T Transceiver
Functions:
-

Driver and Receiver

Link Integrity Test

Receive Polarity Detection and
Correction

Integrates AUI Interface

Implements 10 Mbps Manchester
Encoding/Decoding and Clock Recovery

Automatic Retransmission, Bad Packet
Rejection, and Transmit Padding

External and Internal Loopback Modes

Four Direct Driven LEDs for Status/
Diagnostics

Software Drivers

Uses Certified LAN9000 Drivers Which
Operate with Every Major Network
Operating System

Software Driver Compatible with LAN91C92
and LAN91C100 (100 Mbps) Controllers in
ISA Mode

Software Driver Utilizes Full Capability of 32
Bit Microprocessor

Simultasking is a trademark and SMSC is a registered trademark of Standard Microsystems Corporation

TABLE OF CONTENTS

FEATURES ........................................................................................................................................1

PIN CONFIGURATION.......................................................................................................................3

GENERAL DESCRIPTION..................................................................................................................5

OVERVIEW........................................................................................................................................5

DESCRIPTION OF PIN FUNCTIONS .................................................................................................8

FUNCTIONAL DESCRIPTION ..........................................................................................................20

THEORY OF OPERATION ...............................................................................................................66

FUNCTIONAL DESCRIPTION OF THE BLOCKS..............................................................................78

BOARD SETUP INFORMATION.......................................................................................................87

OPERATIONAL DESCRIPTION........................................................................................................91

MAXIMUM GUARANTEED RATINGS ........................................................................................91

DC ELECTRICAL CHARACTERISTICS .....................................................................................91

AC PARAMETERS ....................................................................................................................94

TIMING DIAGRAMS .........................................................................................................................95
ERRATA SHEET ............................................................................................................................119

80 Arkay Drive
Hauppauge, NY. 11788
(516) 435-6000
FAX (516) 273-3123

PIN CONFIGURATION

AVDD
COLN

COLP

RECN
RECP

TPERXN

TPERXP

AVSS
AVSS

RBIAS

AVDD

nXENDEC

nEN16

VSS

nROM/nPCMCIA

XTAL1
XTAL2

IOS0
IOS1

VDD

81
82

83
84
85

86
87
88
89
90
91
92

93
94
95

96
97
98
99
100

RAMVDD
A19/nCE1
A18
A17
A16
A15
A14
A13
A12
A11/nFCS
VDD
A10/nFWE
A9
A8
A7
A6
A5
A4
A3
VSS

50
49
48
47
46
45
44
43
42
41
40
39
38
37
36
35
34
33
32
31

LAN91C94

100 Pin QFP

/
n

/
T

I
O

/
n

I
O

/
n

I
T

/
R

/
T

/
R

/
n

I
O

/
n

I
O

I
S

/
n

I
N

/
n

I
N

/
S

I
O

I
N

/
n

I
R

ENEEP

EEDO/SDOUT

EEDI

EECS

EESK

VSS

D8
D9

D10
D11

VDD

D12
D13
D14
D15

VSS

INTR0/nIREQ

INTR1/nINPACK

VDD

INTR2
INTR3

RAMVSS

nIOCS16

nSBHE/nCE2

BALE/nWE

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25

/
n

I
O

TPETXP
TPETXDN
TPETXN
TPETXDP
AVDD
nTXLED/nTXEN
nRXLED/RXCLK
nLNKLED/TXD
nBSELED/RXD
PWRDWN/TXCLK
RESET
VSS
D7
D6
D5
D4
VDD
D3
D2
D1
D0
VSS
IOCHRDY/nWAIT
AEN/nREG
nMEMR/OE

75
74
73
72
71
70
69
68
67
66
65
64
63
62
61
60
59
58
57
56
55
54
53
52
51

I
O

/
n

I
A

/
n

LAN91C94

100 Pin TQFP

and VTQFP

GENERAL DESCRIPTION

The LAN91C94 is a VLSI Ethernet Controller
that combines ISA and PCMCIA interfaces in
one chip. LAN91C94 integrates all the MAC and
physical layer functions, as well as the packet
RAM, needed to implement a high performance
10BASE-T (twisted pair) node. For 10BASE5
(thick coax), 10BASE2 (thin coax), and
10BASE-F (fiber) implementations, the
LAN91C94 interfaces to external transceivers
via its AUI port. Only one additional IC is
required on most applications. The LAN91C94
occupies 16 I/0 locations and no memory space
except for PCMCIA attribute memory space. The
same I/O space is used for both ISA and
PCMCIA operations. The LAN91C94 can
directly interface the ISA and PCMCIA buses

and deliver no wait state operation. Its shared
memory is sequentially accessed with 40ns
access times to any of its registers, including its
packet memory. No DMA services are used by
the LAN91C94, virtually decoupling network
traffic from local or system bus utilization. For
packet memory management, the LAN91C94
integrates a unique hardware Memory
Management Unit (MMU) with enhanced
performance and decreased software overhead
when compared to ring buffer and linked list
architectures. The LAN91C94 is portable to
different CPU and bus platforms due to its
flexible bus interface, flat memory structure (no
pointers), and its loosely coupled buffered
architecture (not sensitive to latency).

OVERVIEW

A unique architecture allows the LAN91C94 to
combine high performance, flexibility, high
integration and simple software interface.

The LAN91C94 incorporates the LAN91C92
functionality for ISA environments, as well as a
PCMCIA interface and attribute registers. Mode
selection between ISA and PCMCIA is static and
is done only once at the end of a reset. The
LAN91C94 consists of the same logical I/O
register structure in ISA and PCMCIA modes.
However, some of the signals used to access
the PCMCIA differ from the ISA mode.

The MMU (Memory Management Unit)
architecture used by the LAN91C94 combines
the simplicity and low overhead of fixed areas
with the flexibility of linked lists providing
improved performance over other methods.

Packet reception and transmission are
determined by memory availability. All other
resources are always available if memory is

available. To complement this flexible
architecture, all ISA bus interface functions are
incorporated in the LAN91C94, as well as a
4608 byte packet RAM and serial EEPROM-
based setup. The user can select or modify
configuration choices.

The LAN91C94 integrates most of the 802.3
functionality, incorporating the MAC layer
protocol, the physical layer encoding and
decoding functions with the ability to handle the
AUI interface. For twisted pair networks,
LAN91C94 integrates the twisted pair
transceiver as well as the link integrity test
functions.

The LAN91C94 is a true 10BASE-T single chip
able to interface a system or a local bus.

Directly-driven LEDs for installation and run-
time diagnostics are provided, as well as 802.3
statistics gathering to facilitate network
management.

The LAN91C94 offers:

High integration:

Single chip adapter including:

Packet RAM
ISA bus interface
PCMCIA interface
EEPROM interface
Encoder decoder with AUI interface
10BASE-T transceiver

High performance:

Chained ("Back-to-back") packet handling
with no CPU intervention:

Queues transmit packets
Queues receive packets
Stores results in memory along with
packet
Queues interrupts
Optional single interrupt upon
completion of transmit chain.

Fast block move operation for load/unload:

CPU sees packet bytes as if stored
contiguously.
Handles 16 bit transfers regardless of
address alignment.
Access to packet through fixed window.

Fast bus interface:

Compatible with ISA type and faster buses.

Flexibility:

Flexible packet and header processing:

Can be set to Simultasking - Early
Receive and Transmit modes.

Can access any byte in the packet.

Can immediately remove undesired
packets from queue.
Can move packets from receive to
transmit queue.
Can alter receive processing order
without copying data.
Can discard or enqueue again a failed
transmission.

Resource allocation:

Memory dynamically allocated for transmit
and receive.
Can automatically release memory on
successful transmission.

Configuration:

ISA:

Uses non-volatile jumperless setup via
serial EEPROM.

PCMCIA:

Uses ROM or Flash ROM for attribute
memory storage and optional serial
EEPROM for IEEE address storage.
PCMCIA I/O ignores address lines A4-
A15 and relies on the PCMCIA host,
decoding for the slot.

nROM/nPCMCIA, on LAN91C94, is left
open with a pullup for ISA mode. This
pin is sampled at the end of RESET. If
found low, the LAN91C94 is configured
for PCMCIA mode.

ISA vs. PCMCIA PIN GROUPS

FUNCTION

ISA

PCMCIA

SYSTEM ADDRESS BUS

A0-9

A10
A11

A12-14

A15

A16-18

A19

AEN

A0-9

nFWE

nFCS

A15

nCE1

nREG

SYSTEM DATA BUS

D0-15

SYSTEM CONTROL BUS

RESET

BALE

nIORD

IOWR

MEMR

IOCHRDY

nIOCS16

SBHE

INTR0
INTR1
INTR2
INTR3

RESET

nWE

nIORD

nIOWR

nOE

nWAIT

nIOIS16

nCE2
IREQ

INPACK

SERIAL EEPROM

EEDI

EEDO

EECS
EESK

ENEEP

IOS0
IOS1
IOS2

EEDI

EEDO

EECS
EESK

ENEEP

IOS0
IOS1
IOS2

CRYSTAL OSC.

XTAL1
XTAL2

POWER

VDD

AVDD

VDD

AVDD

GROUND

GND

AGND

GND

AGND

10BASE-T interface

TPERXP
TPERXN
TPETXP
TPETXN

TPETXDP
TPETXDN

TPERXP
TPERXN
TPETXP
TPETXN

TPETXDP
TPETXDN

ISA vs. PCMCIA PIN GROUPS

FUNCTION

ISA

PCMCIA

AUI interface

RECP
RECN
COLP
COLN

TXP/nCOLL

TXN/nCRS

RECP
RECN
COLP
COLN

TXP/nCOLL

TXN/nCRS

LEDs

nLNKLED/TXD

nRXLED/RXCLK

nBSELED/RXD

nTXLED/nTXEN

nLNKLED/TXD

nRXLED/RXCLK

nBSELED/RXD

nTXLED/nTXEN

MISC.

RBIAS

PWRDWN/TXCLK

nXENDEC

EN16

ROM

RBIAS

PWRDWN/TXCLK

nXENDEC

EN16

PCMCIA

DESCRIPTION OF PIN FUNCTIONS

PIN NUMBER

QFP

VTQFP/

TQFP

NAME

SYMBOL

BUFFER

TYPE

DESCRIPTION

nROM/
nPCMCIA

nROM

I/O4 with

pullup

This pin is sampled at the end of
RESET. When sampled low, the
LAN91C94 is configured for PCMCIA
operation and all pin definitions
correspond to the PCMCIA mode. For
ISA operation, this pin is left open and
is used as a ROM chip select output. It
turns active when MEMR* is low and
the address bus contains a valid ROM
address. In ISA mode the LAN91C94
is pin compatible with the LAN91C92

28-30
32-38

26-28
30-36

Address

A0-9

Input - Input address lines 0 through 9

A10/nFWE

ISA - Input - Input address line 10

PCMCIA - Output - Flash Memory
Write Enable used for programming
attribute memory. Is active (low) when
nWE=0 and COR2=1

PIN NUMBER

QFP

VTQFP/

TQFP

NAME

SYMBOL

BUFFER

TYPE

DESCRIPTION

A11/nFCS

ISA - Input - Input address line 11

PCMCIA - Output - Flash Memory Chip
Select used to access attribute
memory. Is active (low) when nREG=0,
nCE1=0 and A15=0

42-48

40-46

Address

A12-18

Input - Input address lines 12 through
18

A19/nCE1

I with

pullup

ISA - Input - Input address line 19

PCMCIA - Card Enable 1 input. Used
to select card on even byte accesses

Address
Enable

AEN/nREG

I with

pullup

ISA - Address enable input. Used as
an address qualifier. Address decoding
is enabled only when AEN is low

PCMCIA - Attribute memory and IO
select input. Asserted when the card
attribute space or IO space is being
accessed

nByte High

nSBHE/

nCE2

I with

pullup

ISA - Byte High Enable input. Asserted
(low) by the system to indicate a data
transfer on the upper data byte

PCMCIA - Card Enable 2 input. To
select card on odd byte accesses

Ready

IOCHRDY/

nWAIT

OD24 with

pullup

ISA - Output - Optionally used by the
LAN91C94 to extend host cycles

PCMCIA - Output - Optionally used by
the LAN91C94 to extend host cycles

57-60
62-65

9-12

14-17

55-58
60-63

7-10

12-15

Data Bus

D0-15

I/O24

Bidirectional - 16 bit data bus to
access the LAN91C94 internal
registers. The data bus has weak
internal pullups. Supports direct
connection to the system bus without
external buffering

PIN NUMBER

QFP

VTQFP/

TQFP

NAME

SYMBOL

BUFFER

TYPE

DESCRIPTION

Reset

RESET

IS with

pullup

Input - Active high Reset. This input is
not considered active (except in
powerdown mode) unless it is active
for at least 100ns to filter narrow
glitches

Address
Latch

BALE/nWE

IS with

pullup

ISA - Input - Address strobe. For
systems that require address latching.
The falling edge of BALE latches
address lines and nSBHE

PCMCIA - Write Enable input. For
writing into COR and CSR registers as
well as attribute memory space

Interrupt

INTR0/

nIREQ

O24

ISA - Active high interrupt signal. The
interrupt line selection is determined by
the value of INT SEL1-0 bits in the
Configuration Register. This interrupt is
tri-stated when not selected

PCMCIA - Active low interrupt request
output

INTR1/

nINPACK

O24

ISA - Output - Active high interrupt
signal. The interrupt line selection is
determined by the value of INT SEL1-0
bits in the Configuration Register. This
interrupt is tri-stated when not selected

PCMCIA - Output asserted to
acknowledge read cycles when the
card is enabled

22,23

20,21

Interrupt

INTR2-3

O24

ISA - Outputs - Active high interrupt
signals. The interrupt line selection is
determined by the value of INT SEL1-0
bits in the Configuration Register.
These interrupts are tri-stated when not
selected

PIN NUMBER

QFP

VTQFP/

TQFP

NAME

SYMBOL

BUFFER

TYPE

DESCRIPTION

nI/O 16

nIOCS16/

nIOIS16

OD24

ISA - Active low output asserted in 16
bit mode when AEN is low and A4-A15
decode to the LAN91C94 address
programmed into the high byte of the
Base Address Register
PCMCIA - Active low output asserted
whenever the LAN91C94 is in 16 bit
mode, COR0 bit is high, and REG* is
low

nI/O Read

nIORD

IS with

pullup

Input - Active low read strobe to
access the LAN91C94 IO space

nIOWR

IS with

pullup

Input - Active low write strobe to
access the LAN91C94 IO space

nMEMR/

nOE

IS with

pullup

ISA - Active low signal used by the
host processor to read from the
external ROM.
PCMCIA - Output Enable input used to
read from the COR, CSR, and attribute
memory

EEPROM
Clock

EESK

Output - 4usec clock used to shift data
in and out of a serial EEPROM

EEPROM
Select

EECS

Output - Serial EEPROM chip select

EEPROM
Data Out

EEDO/

SDOUT

Output - Connected to the DI input of
the serial EEPROM

EEPROM
Data In

EEDI

I with pull-

down

Input - Connected to the DO output of
the serial EEPROM

98,

99,1

96,97

I/O Base

IOS0-2

I with

pullup

Input - External switches can be
connected to these lines to select
between predefined EEPROM
configurations. The values of these
pins are readable

nTransmit
Led/
nTransmit
Enable

nTXLED/

nTXEN

OD16

O162

INTERNAL ENDEC - Transmit LED
output

EXTERNAL ENDEC - Active low
Transmit Enable output

PIN NUMBER

QFP

VTQFP/

TQFP

NAME

SYMBOL

BUFFER

TYPE

DESCRIPTION

nBoard
Select Led

nBSELED/

RXD

OD16

I with

pullup

INTERNAL ENDEC - Board Select LED
activated by accesses to I/O space
(nIORD or nIOWR active with AEN low
and valid address decode for ISA, and
with nREG low and COR0 high for
PCMCIA). The pulse is stretched
beyond the access duration to make
the LED visible

EXTERNAL ENDEC - NRZ receive
data input

nReceive
Led/
nReceive
Clock

nRXLED/

nRXCLK

OD16

I with

pullup

INTERNAL ENDEC - Receive LED
output

EXTERNAL ENDEC - Receive clock
input

nLink LED

nLNKLED/

TXD

OD16

O162

INTERNAL ENDEC - Link LED output .
Note: The output will not be driven
low during a reset

EXTERNAL ENDEC - Transmit Data
output.

Enable
EEPROM

ENEEP

I with

pullup

Input - This active high input enables
the EEPROM to be read or written by
the LAN91C94. Internally pulled up.
Must be connected to ground if no
serial EEPROM is used

nEnable 16
Bit

nEN16

I with

pullup

Input - When low the LAN91C94 is
configured for 16 bit bus operation. If
left open the LAN91C94 works in 8 bit
bus mode. 16 bit configuration can
also be programmed via serial
EEPROM, software initialization of the
CONFIGURATION REGISTER, and
PCMCIA configuration space

PIN NUMBER

QFP

VTQFP/

TQFP

NAME

SYMBOL

BUFFER

TYPE

DESCRIPTION

96
97

94
95

Crystal 1
Crystal 2

XTAL1
XTAL2

Iclk

An external parallel resonance 20MHz
crystal should be connected across
these pins. If an external clock source
is used, it should be connected to
XTAL1 and XTAL2 should be left open

85
84

83
82

AUI Receive

RECP
RECN

Diff. Input

AUI receive differential inputs

79
78

77
76

AUI
Transmit

TXP/

nCOLL

TXN/nCRS

Diff.

Output

INTERNAL ENDEC - (nXENDEC pin
open). In this mode, TXP and TXN are
the AUI transmit differential outputs.
They must be externally pulled up
using 150 ohm resistors

EXTERNAL ENDEC - (nXENDEC pin
tied low). In this mode the pins are
inputs used for collision and carrier
sense functions

83
82

81
80

AUI
Collision

COLP
COLN

Diff.

Input

AUI collision differential inputs. A
collision is indicated by a 10MHz signal
at this input pair

87
86

85
84

TPE
Receive

TPERXP
TPERXN

Diff.

Input

10BASE-T receive differential inputs

77
75

75
73

TPE
Transmit

TPETXP
TPETXN

Diff.

Output

INTERNAL ENDEC - 10BASE-T
transmit differential outputs

74
76

72
74

TPE
Transmit
Delayed

TPETXDP
TPETXDN

Diff.

Output

10BASE-T delayed transmit differential
outputs. Used in combination with
TPETXP and TPETXN to generate the
10BASE-T transmit pre-distortion

Transmit
Clock

PWRDWN/

TXCLK

I with

pullup

INTERNAL ENDEC - Powerdown
input. It keeps the LAN91C94 in
powerdown mode when high (open).
Must be low for normal operation

EXTERNAL ENDEC - Transmit clock
input from external ENDEC.

Bias
Resistor

RBIAS

Analog

Input

A 22kohm 1% resistor should be
connected between this pin and analog
ground

PIN NUMBER

QFP

VTQFP/

TQFP

NAME

SYMBOL

BUFFER

TYPE

DESCRIPTION

nExternal
Endec

nXENDEC

I with

pullup

When tied low, the LAN91C94 is
configured for EXTERNAL ENDEC.
When tied high or left open, the
LAN91C94 uses its internal
encoder/decoder

13,21
40,50

61,100

11,19
48,59
98,38

VDD

+5V power supply pins

73,81

71,79

Analog
Power

AVDD

+5V analog power supply pins

2,8

18,24

31,56,6

6,94

100,6

16,22,

29,54,

64,92

Ground

GND

Ground pins

80,88

78,86

Analog
Ground

AGND

Analog ground pins

BUFFER SYMBOLS

Output buffer with 2mA source and 4mA sink.

O162

Output buffer with 2mA source and 16mA sink.

O24

Output buffer with 12mA source and 24mA sink.

OD16

Open drain buffer with 16mA sink.

OD24

Open drain buffer with 24mA sink.

I/O24

Bidirectional buffer with 12mA source and 24mA sink.

Input buffer with TTL levels

Input buffer with Schmitt Trigger Hysteresis

Iclk

Clock input buffer

DC levels and conditions defined in the DC Electrical Characteristics section.

Table 1 - Bus Transactions in ISA Mode

nSBHE

D0-7

D8-15

8 BIT MODE
((nEN16=1) (16BIT=0))

even byte

odd byte

16 BIT MODE

otherwise

even byte

odd byte

even byte

odd byte

invalid cycle

Table 2 - Bus Transactions in PCMCIA Mode

nCE1

nCE2

D0-7

D8-15

8 BIT MODE

((IOis8=1) +
(nEN16=1).(16BIT=0))

even byte

odd byte

NO CYCLE

16 BIT MODE

otherwise

even byte

odd byte

even byte

odd byte

NO CYCLE

16BIT: CONFIGURATION REGISTER bit 7
IOis8: CSR register bit 5
nEN16: pin nEN16

FIGURE 1 SYSTEM DIAGRAM FOR ISA BUS WITH BOOT PROM

I
O

,

n

I
O

-
1

I
O

I
N

-
3

I
D

I
A

I
C

I
A

I
R

/
C

I
A

FUNCTIONAL DESCRIPTION

Except for the bus interface, the functional
behavior of the LAN91C94 after initial
configuration is identical for ISA and PCMCIA
modes.

The LAN91C94 includes an arbitrated shared
memory of 4608 bytes, accessed by the CPU
through two sequential access regions of 2
kbytes each, as well as a register area.

The MMU unit allocates RAM memory to be
used for transmit and receive packets, using
256 byte pages.

The arbitration is transparent to the CPU in
every sense. There is no speed penalty for ISA
type of machines due to arbitration. There are
no restrictions on what locations can be
accessed at any time. RAM accesses as well as
MMU requests are arbitrated.

The RAM is accessed by mapping it into I/O
space for sequential access. Except for the
RAM accesses and the MMU request/release
commands, I/O accesses are not arbitrated.

The I/O space is 16 bits wide. Provisions for 8
bit systems are handled by the bus interface.

In the system memory space, up to 64 kbytes
are decoded by the LAN91C94 as expansion
ROM. The ROM expansion area is 8 bits wide.

Device configuration is done using a serial
EEPROM, with support for modifications to the
EEPROM at installation time. A Flash ROM is
supported for PCMCIA attribute memory.

The CSMA/CD core implements the 802.3 MAC
layer protocol. It has two independent
interfaces, the data path and the control path.
Both interfaces are 16 bits wide.

The control path provides a set of registers used
to configure and control the block. These
registers are accessible by the CPU through the
LAN91C94 I/O space. The data path is of
sequential access nature and typically works in
one direction at any given time. An internal
DMA type of interface connects the data path to
the device RAM through the arbiter and MMU.

The CSMA/CD data path interface is not
accessible to the host CPU.

The internal DMA interface can arbitrate for
RAM access and request memory from the
MMU when necessary.

An encoder/decoder block interfaces the
CSMA/CD block on the serial side. The encoder
will do the Manchester encoding of the transmit
data at 10 Mbit/s, while the decoder will recover
the receive clock, and decode received data.

Carrier and Collision detection signals are also
handled by this block and relayed to the
CSMA/CD block.

The encoder/decoder block can interface the
network through the AUI interface pairs, or it can
be programmed to use the internal 10BASE-T
transceiver and connect to a twisted pair
network.

The twisted pair interface takes care of the
medium dependent signaling for 10BASE-T type
of networks. It is responsible for line interface
(with external pulse transformers and pre-
distortion resistors), collision detection as well
as the link integrity test function.

The LAN91C94 provides a 16 bit data path into
RAM. The RAM is private and can only be
accessed by the system via the arbiter. RAM
memory is managed by the MMU. Byte and
word accesses to the RAM are supported.

If the system to SRAM bandwidth is insufficient
the LAN91C94 will automatically use its
IOCHRDY line for flow control. However, for
ISA buses, IOCHRDY will never be negated.

BUFFER MEMORY

The logical addresses for RAM access are
divided into TX area and RX area. Each one of
the areas is 2 kbytes long and accommodates
one maximum size Ethernet packet.

The TX area is seen by the CPU as a window
through which packets can be loaded into
memory before queuing them in the TX FIFO of
packets. The TX area can also be used to
examine the transmit completion status after
packet transmission.

The RX area is associated to the output of the
RX FIFO of packets, and is used to access
receive packet data and status information.

The logical address is specified by loading the
address pointer register. The pointer can
automatically increment on accesses.

All accesses to the RAM are done via I/O space.
A bit in the address pointer also specifies if the
address refers to the TX or RX area.

In the TX area, the host CPU has access to the
next transmit packet being prepared for
transmission. In the RX area, it has access to
the first receive packet not processed by the
CPU yet.

The FIFO of packets, existing beneath the TX
and RX areas, is managed by the MMU. The
MMU dynamically allocates and releases
memory to be used by the transmit and receive
functions.

The MMU related parameters for the LAN91C94
are:

RAM size

4608 bytes (internal)

Max. number of packets

Max. pages per packet

Page size

256 bytes

FIGURE 8 LOGICAL ADDRESS GENERATION AND RELEVENT REGISTERS

I
F

L
E

I
O

I
F

(
P

)

I
N

I
S

I
N

I
F

I
N

I
S

/
C

(
F

I
T

)

I
C

I
T

T
A

I
S

(
F

I
F

)

/
n

PACKET FORMAT IN BUFFER MEMORY

The packet format in memory is similar for the
TRANSMIT and RECEIVE areas. The first word
is reserved for the status word, the next

word is used to specify the total number of
bytes, and that in turn is followed by the data
area. The data area holds the packet itself, and
its length is determined by the byte count. The
packet memory format is word oriented.

FIGURE 9 DATA PACKET FORMAT

TRANSMIT PACKET

RECEIVE PACKET

STATUS WORD

Written by CSMA upon transmit
completion (see Status
Register).

Written by CSMA upon receive
completion (see RX Frame
Status Word).

BYTE COUNT

Written by CPU.

Written by CSMA.

DATA AREA

Written/modified by CPU.

Written by CSMA.

CONTROL BYTE

Written by CPU to control
ODD/EVEN data bytes.

Written by CSMA. Also has
ODD/EVEN bit.

RESERVED

BYTE COUNT (always even)

STATUS WORD

DATA AREA

LAST DATA BYTE (if odd)

bit0

bit15

RAM

OFFSET

(DECIMAL)

2046 Max

CONTROL BYTE

BYTE COUNT - Divided by two, it defines the
total number of words, including the STATUS
WORD, the BYTE COUNT WORD, the DATA
AREA and the CONTROL BYTE. The receive
byte count always appears as even, the
ODDFRM bit of the receive status word
indicates if the low byte of the last word is
relevant. The transmit byte count least
significant bit will be assumed 0 by the
controller regardless of the value written in
memory.

DATA AREA

The data area starts at offset 4 of the packet
structure, and it can extend for up to 2043 bytes.
The data area contains six bytes of
DESTINATION ADDRESS followed by six bytes
of SOURCE ADDRESS, followed by a variable
length number of bytes.

On transmit, all bytes are provided by the CPU,
including the source address. The LAN91C94
does not insert its own source address. On
receive, all bytes are provided by the CSMA
side.

The 802.3 Frame Length word (Frame Type in
Ethernet) is not interpreted by the LAN91C94. It
is treated transparently as data for both transmit
and receive operations.

CONTROL BYTE

The CONTROL BYTE always resides on the
high byte of the last word. For transmit packets
the CONTROL BYTE is written by the CPU as:

ODD - If set, indicates an odd number of bytes,
with the last byte being right before the
CONTROL BYTE. If clear, the number of data
bytes is even and the byte before the CONTROL
BYTE is not transmitted.

CRC - When set, CRC will be appended to the
frame. This bit has only meaning if the NOCRC
bit in the TCR is set.

For receive packets the CONTROL BYTE is

written by the controller as:

ODD - If set, indicates an odd number of bytes,
with the last byte being right before the
CONTROL BYTE. If clear, the number of data
bytes is even and the byte before the CONTROL
BYTE should be ignored.

ODD

CRC

ODD

RECEIVE FRAME STATUS WORD

This word is written at the beginning of each receive frame in memory. It is not available as a register.

HIGH

BYTE

ALGN

ERR

BROD

CAST

BADCRC

ODDFRM

TOOLNG

TOO

SHORT

LOW

BYTE

HASH VALUE

MULT
CAST

ALGNERR Frame had alignment error.

BRODCAST Receive frame was broadcast.

BADCRC Frame had CRC error.

ODDFRM This bit when set indicates that the
received frame had an odd number of bytes.

TOOLNG The received frame is longer than the
802.3 maximum size (1518 bytes on the cable).

TOOSHORT The received frame is shorter than
the 802.3 minimum size (64 bytes on the cable).

HASH VALUE Provides the hash value used to
index the Multicast Registers. Can be used by
receive routines to speed up the group address
search. The hash value consists of the six most
significant bits of the CRC calculated on the
Destination Address, and maps into the 64 bit
multicast table. Bits 5,4,3 of the hash value
select a byte of the multicast table, while bits
2,1,0 determine the bit within the byte selected.

Examples of the address mapping:

ADDRESS

HASH VALUE 5-0

MULTICAST TABLE BIT

ED 00 00 00 00 00

0D 00 00 00 00 00

01 00 00 00 00 00
2F 00 00 00 00 00

000 000
010 000
100 111
111 111

MT-0 bit 0
MT-2 bit 0
MT-4 bit 7
MT-7 bit 7

MULTCAST Receive frame was multicast. If
hash value corresponds to a multicast table bit
that is set, and the address was a multicast,

the packet will pass address filtering regardless
of other filtering criteria.

ATTRIBUTE MEMORY SPACE
(PCMCIA mode only)

In PCMCIA mode, the attribute memory space is
an eight bit space decoded by the LAN91C94
using addresses A0-9, A15 along

with the following control signals: nREG, nCE1,
nWE, nOE.

The LAN91C94 has the following two registers
in memory space:

OFFSET

8000

NAME

CARD OPTION REGISTER

TYPE

READ/WRITE

SYMBOL

COR

This register is used to enable the PCMCIA card, allow programming of the external attribute memory,
and to generate soft reset.

SRESET

LEVIRQ

(read only)

COR2

COR0

SRESET - This bit, when set will reset the
LAN91C94. It is valid in PCMCIA mode only.
The bit does not sample the ISA/PCMCIA mode.
The bit is cleared writing it low or by a hardware
reset. It does not preserve any register. It
resembles a hardware reset, including the
PWRDWN gating.

LEVIRQ - This bit reads always high to indicate
that the LAN91C94 uses level mode interrupts.

COR2 - This bit, when set, allows writing into
the external attribute memory.

COR0 - This bit, when clear, disables the
LAN91C94 I/O space and forces nIREQ
inactive. This bit defaults low and will be set by
the host PCMCIA system to configure the card
for I/O operation.

I/O SPACE
(ISA and PCMCIA mode)

In ISA mode, the base I/O space is determined
by the IOS0-2 inputs and the EEPROM
contents. A4-15 are compared against the base
I/O address for I/O space accesses.

In PCMCIA mode nREG (along with nIORD or
nIOWR) defines an I/O access regardless of the
A4-15 value.

To limit the I/O space requirements to 16
locations, the registers are assigned to different
banks. The last word of the I/O area is shared
by all banks and can be used to change the
bank in use.

Registers are 16 bits wide and are described
using the following convention:

OFFSET

NAME

TYPE

SYMBOL

HIGH

BYTE

BIT 15

BIT 14

BIT 13

BIT 12

BIT 11

BIT 10

BIT 9

BIT 8

LOW

BYTE

BIT 7

BIT 6

BIT 5

BIT 4

BIT 3

BIT 2

BIT 1

BIT 0

OFFSET - Defines the address offset within the
IOBASE where the register can be accessed at,
provided the bank select has the appropriate
value. The offset specifies the address of the
even byte (bits 0-7) or the address of the
complete word. The odd byte can be accessed
using address (offset + 1).

Some registers (like the Interrupt Ack., or like
Interrupt Mask) are functionally described as

two eight bit registers, in that case the offset of
each one is independently specified.

Regardless of the functional description, when
the LAN91C94 is in 16 bit mode, all registers
can be accessed as words or bytes.

The default bit values upon hard reset are
highlighted below each register.

BANK SELECT REGISTER

OFFSET

NAME

BANK SELECT REGISTER

TYPE

READ/WRITE

SYMBOL

BSR

HIGH

BYTE

LOW

BYTE

BS2

BS1

BS0

BS2, BS1, BS0 - Determine the bank presently
in use.

This register is always accessible and is used to
select the register bank in use.

The upper byte always reads as 33h and can be
used to help determine the I/O location of the
LAN91C94.

The BANK SELECT REGISTER is always
accessible regardless of the value of BS0-2.

The LAN91C94 implements only 4 banks,
therefore accesses to non-existing banks
(BS2=1) are ignored. BS1 and BS0 determine
the bank presently in use.

BS2

BS1

BS0

BANK#

0
0
0
0
1

0
0
1
1

0
1
0
1

0
1
2
3

None

I/O SPACE - BANK0

OFFSET

NAME

TRANSMIT CONTROL REGISTER

TYPE

READ/WRITE

SYMBOL

TCR

This register holds bits programmed by the CPU to control some of the protocol transmit options.

HIGH

BYTE

EPH

LOOP

STP

SQET

FDUPLX

MON_

CSN

NOCRC

LOW

BYTE

PAD_EN

FORCOL

LOOP

TXENA

EPH_LOOP - Internal loopback at the EPH
block. Does not exercise the encoder decoder.
Serial data is looped back when set. Defaults
low. Note:

After exiting the loopback test,

SRESET in Card Option Register or SOFT_RST
in RCR must be set before returning to normal
operation.

STP_SQET - Stop transmission on SQET error.
If set, stops and disables transmitter on SQE
test error. Does not stop on SQET error and
transmits next frame if clear. Defaults low.

FDUPLX - When set it enables full duplex
operation. This will cause frames to be received
if they pass the address filter regardless of the
source for the frame. When clear the node will
not receive a frame sourced by itself.

MON_CSN - When set the LAN91C94 monitors
carrier while transmitting. It must see its own
carrier by the end of the preamble. If it is not
seen, or if carrier is lost during transmission, the
transmitter aborts the frame without CRC and

turns itself off. When this bit is clear the
transmitter ignores its own carrier. Defaults low.

NOCRC - Does not append CRC to transmitted
frames when set, allows software to insert the
desired CRC. Defaults to zero, namely CRC
inserted.

PAD_EN - When set, the LAN91C94 will pad
transmit frames shorter than 64 bytes with 00.
Does not pad frames when reset.

FORCOL - When set the transmitter will force
a collision by not deferring deliberately. This bit
is set and cleared only by the CPU. When
TXENA is enabled with no packets in the queue
and while the FORCOL bit is set, the LAN91C94
will transmit a preamble pattern the next time a
carrier is seen on the line. If a packet is queued,
a preamble and SFD will be transmitted.

FORCOL defaults low to normal operation.
NOTE: The LATCOL bit in EPHSR, setting up
as a result of FORCOL, will reset TXENA to 0.

In order to force another collision, TXENA must
be set to 1 again.

LOOP - Local Loopback. When set, transmit
frames are internally looped to the receiver after
the encoder/decoder. Collision and Carrier
Sense are ignored. No data is sent out. Defaults
low to normal mode.

TXENA - Transmit enabled when set. Transmit
is disabled if clear. When the bit is cleared the
LAN91C94 will complete the current
transmission before stopping. When stopping
due to an error, this bit is automatically cleared.

LOOPBACK MODES

AUI

EPH LOOP

LOOP

FDUPLX

LOOPS AT

TRANSMITS TO

NETWORK

X
X

1
0

1
0
0
0
0

1
0
0
0

1
1
1
0

EPH Block

ENDEC

Cable

10BASE-T Driver

Normal CSMA/CD - No

Loopback

N
N
Y
Y
Y

I/O SPACE - BANK0

OFFSET

NAME

EPH STATUS REGISTER

TYPE

READ ONLY

SYMBOL

EPHSR

This register stores the status of the last transmitted frame. This register value, upon individual
transmit packet completion, is stored as the first word in the memory area allocated to the packet.
Packet interrupt processing should use the copy in memory as the register itself will be updated by
subsequent packet transmissions. The register can be used for real time values (like TXENA and
LINK OK). If TXENA is cleared the register holds the last packet completion status.

HIGH

BYTE

TXUNRN

LINK_OK

RX_OVRN

CTR_ROL

EXC_DEF

LOST

CAR

LATCOL

LOW

BYTE

TX DEFR

LTX BRD

SQET

16COL

LTX MULT

MULCOL

SNGLCOL

TX_SUC

TXUNRN - Transmit Underrun. Set if underrun
occurs, it also clears TXENA bit in TCR. Cleared
by setting TXENA high. This bit should never be
set under normal operation.

LINK_OK - State of the 10BASE-T Link Integrity
Test. A transition on the value of this bit
generates an interrupt when the LE ENABLE bit
in the Control Register is set.

RX_OVRN - Upon receive overrun, the receiver
temporarily asserts this bit. The receiver stays
enabled and subsequent frames will be received
normally if memory becomes available. The
RX_OVRN INT bit in the Interrupt Status
Register will also be set and stay set until
cleared by the CPU. Note that receive overruns
could occur only if receive memory allocations
fail.

CTR_ROL - Counter Roll over. When set one or
more 4 bit counters have reached maximum
count (15). Cleared by reading the ECR register.

EXC_DEF - Excessive deferral. When set
last/current transmit was deferred for more than
1518 * 2 byte times. Cleared at the end of every
packet sent.

LOST_CARR - Lost carrier sense. When set
indicates that Carrier Sense was not present at
end of preamble. Valid only if MON_CSN is
enabled. This condition causes TXENA bit in
TCR to be reset. Cleared by setting TXENA bit
in TCR.

LATCOL - Late collision detected on last
transmit frame. If set a late collision was
detected (later than 64 byte times into the

frame) or FORCOL in TCR was set to 1 by the
CPU. When detected the transmitter jams and
turns itself off clearing the TXENA bit in TCR.
Cleared by setting TXENA in TCR.

TX_DEFR - Transmit Deferred. When set,
carrier was detected during the first 6.4 usec of
the inter frame gap. Cleared at the end of every
packet sent.

LTX_BRD - Last transmit frame was a
broadcast. Set if frame was broadcast. Cleared
at the start of every transmit frame.

SQET

- Signal Quality Error Test. The

transmitter opens a 1.6 us window 0.8 us after
transmission is completed and the receiver
returns inactive. During this window, the
transmitter expects to see the SQET signal from
the transceiver. The absence of this signal is a
'Signal Quality Error' and is reported in this
status bit. Transmission stops and EPH INT is
set if STP_SQET is in the TCR is also set when
SQET is set. This bit is cleared by setting
TXENA high.

16COL - 16 collisions reached. Set when 16
collisions are detected for a transmit frame.

TXENA bit in TCR is reset. Cleared when
TXENA is set high.

LTX_MULT - Last transmit frame was a
multicast. Set if frame was a multicast.
Cleared at the start of every transmit frame.

MULCOL - Multiple collision detected for the last
transmit frame. Set when more than one
collision was experienced. Cleared when
TX_SUC is high at the end of the packet being
sent.

SNGLCOL - Single collision detected for the last
transmit frame. Set when a collision is detected.
Cleared when TX_SUC is high at the end of the
packet being sent.

TX_SUC - Last transmit was successful. Set if
transmit completes without a fatal error. This bit
is cleared by the start of a new frame
transmission or when TXENA is set high.

Fatal errors are:

16 collisions
SQET fail and STP_SQET = 1
FIFO Underrun
Carrier lost and MON_CSN = 1
Late collision

I/O SPACE - BANK0

OFFSET

NAME

RECEIVE CONTROL REGISTER

TYPE

READ/WRITE

SYMBOL

RCR

HIGH BYTE

SOFT RST

FILT_CAR

STRIP CRC

RXEN

LOW BYTE

ALMUL

PRMS

RX_

ABORT

SOFT_RST - Software activated Reset. Active
high. Valid for ISA and PCMCIA. Initiated by
writing this bit high and terminated by writing the
bit low. LAN91C94 configuration is not
preserved, except for Configuration, Base, IA0-
5, COR, and CSR Registers. EEPROM is not
reloaded after software reset.

FILT_CAR - Filter Carrier. When set filters
leading edge of carrier sense for 12 bit times.
Otherwise recognizes a receive frame as soon
as carrier sense is active.

STRIP_CRC - When set it strips the CRC on
received frames. When clear the CRC is stored
in memory following the packet. Defaults low.

RXEN - Enables the receiver when set. If
cleared, completes receiving current frame and
then goes idle. Defaults low on reset.

ALMUL - When set accepts all multicast frames
(frames in which the first bit of DA is '1'). When
clear accepts only the multicast frames that
match the multicast table setting. Defaults low.

PRMS - Promiscuous mode. When set receives
all frames, regardless of their destination
address. Does not receive its own transmission
unless FDUPX = 1.

RX_ABORT - This bit is set if a receive frame
was aborted due to length longer than 1532
bytes. The frame will not be received. The bit is
cleared by RESET or by the CPU writing it low.

RX_ABORT

RX_OVRN_ INT

Packet Too Long

Run out of Memory
During Receive

I/O SPACE - BANK0

OFFSET

NAME

COUNTER REGISTER

TYPE

READ ONLY

SYMBOL

ECR

Counts four parameters for MAC statistics. When any counter reaches 15 an interrupt is issued. All
counters are cleared when reading the register and do no wrap around beyond 15.

HIGH

BYTE

NUMBER OF EXCESS DEFERRED TX

NUMBER OF DEFERRED TX

LOW

BYTE

MULTIPLE COLLISION COUNT

SINGLE COLLISION COUNT

Each four bit counter is incremented every time
the corresponding event, as defined in the EPH
STATUS REGISTER bit description, occurs.
Note that the counters can only increment once
per enqueued transmit packet, never faster,
limiting the rate of interrupts that can be
generated by the counters. For example if a
packet is successfully transmitted after one
collision the SINGLE COLLISION COUNT field
is incremented by one. If a packet experiences
between 2 to 16 collisions, the MULTIPLE
COLLISION COUNT field is incremented by

one. If a packet experiences deferral the
NUMBER OF DEFERRED TX field is
incremented by one, even if the packet
experienced multiple deferrals during its
collision retries.

The COUNTER REGISTER facilitates
maintaining statistics in the AUTO RELEASE
mode where no transmit interrupts are
generated on successful transmissions.

Reading the register in the transmit service
routine will be enough to maintain statistics.

I/O SPACE - BANK0

OFFSET

NAME

MEMORY INFORMATION REGISTER

TYPE

READ ONLY

SYMBOL

MIR

For software compatibility with other LAN9000 parts all memory-related information is represented
in 256 x M byte units, where the multiplier M is determined by the MCR upper byte. M equals 1 for
the LAN91C94.

HIGH

BYTE

FREE MEMORY AVAILABLE (in bytes x 256 x M)

LOW

BYTE

MEMORY SIZE (in bytes x 256 x M)

FREE MEMORY AVAILABLE - This register can
be read at any time to determine the amount of
free memory. The register defaults to the
MEMORY SIZE upon reset or upon the RESET
MMU command.

MEMORY SIZE - This register can be read to
determine the total memory size, and will
always read 12H (4608 bytes) for the
LAN91C94.

MEMORY SIZE

REGISTER

ACTUAL

MEMORY

LAN91C90

FFH

64 Kbytes

LAN91C90

40H

16 Kbytes

LAN91C92/4

12H

4608 bytes

LAN91C100

FFH

128 kbytes

I/O SPACE - BANK0

OFFSET

NAME

MEMORY CONFIGURATION

REGISTER

TYPE

Lower Byte - READ/WRITE

Upper Byte - READ ONLY

SYMBOL

MCR

HIGH

BYTE

MEMORY SIZE MULTIPLIER M

LOW

BYTE

MEMORY RESERVED FOR TRANSMIT (in bytes x 256 x M)

MEMORY RESERVED FOR TRANSMIT -
Programming this value allows the host CPU to
reserve memory to be used later for transmit,
limiting the amount of memory that receive
packets can use up.

When programmed for zero, the memory
allocation between transmit and receive is
completely dynamic.

When programmed for a non-zero value, the
allocation is dynamic if the free memory
exceeds the programmed value, while receive
allocation requests are denied if the free
memory is less or equal to the programmed
value.

This register defaults to zero upon reset. It is not
affected by the RESET MMU command.

The value written to the MCR is a reserved
memory space IN ADDITION TO ANY
MEMORY CURRENTLY IN USE. If the memory
allocated for transmit plus the reserved space
for transmit is required to be constant (rather
than grow with transmit allocations) the CPU
should update the value of this register after
allocating or releasing memory.

The contents of MIR as well as the low byte of
MCR are specified in 256 x M bytes. The
multiplier M is determined by bits 11,10,and 9
as follows. Bits 11,10 and 9 are read only bits
used by the software driver to transparently run
on different controllers of the LAN9000 family:

DEVICE

BIT 11

BIT 10

BIT 9

MAX MEMORY SIZE

LAN91C100

256 x 256 x 2=128k

LAN91C90

256 x 256 x 1 =64k

FUTURE

256k

" "

512k

" "

I/O SPACE - BANK1

OFFSET

NAME

CONFIGURATION REGISTER

TYPE

READ/WRITE

SYMBOL

The Configuration Register holds bits that define the device configuration and are not expected to
change during run-time. This register is part of the EEPROM saved setup.

HIGH

BYTE

NO WAIT

FULL

STEP

SET

SQLCH

AUI

SELECT

LOW

BYTE

16 BIT

DIS LINK

RESERVED

INT SEL1

INT SEL0

Function of

nEN16 pin

NO WAIT - When set, does not request
additional wait states. An exception to this are
accesses to the Data Register if not ready for a
transfer. When clear, negates IOCHRDY for two
to three 20MHz clocks on any cycle to the
LAN91C94.

FULL STEP - This bit is used to select the
signaling mode for the AUI port. When set the
AUI port uses full step signaling. Defaults low to
half step signaling. This bit is only meaningful
when AUI SELECT is high.

SET SQLCH - When set, the squelch level used
for the 10BASE-T receive signal is 240mV.
When clear the receive squelch level is
400mV.Defaults low.

AUI SELECT - When set the AUI interface is
used, when clear the 10BASE-T interface is
used. Defaults low.

16BIT - Used in conjunction with nEN16 and

IOis8 (in PCMCIA mode only) to define the
width of the system bus. If the nEN16 pin is low,
this bit is forced high. Otherwise the bit defaults
low and can be programmed by the host CPU.

DIS LINK - This bit is used to disable the
10BASE-T link test functions. When this bit is
high the LAN91C94 disables link test functions
by not generating nor monitoring the network for
link pulses. In this mode the LAN91C94 will
transmit packets regardless of the link test, the
EPHSR LINK_OK bit will be set and the LINK
LED will stay on. When low the link test
functions are enabled. If the link status indicates
FAIL, the EPHSR LINK_OK bit will be low, while
transmit packets enqueued will be processed by
the LAN91C94, transmit data will not be sent
out to the cable.

INT SEL1-0 - Used to select one out of four
interrupt pins. The three unused interrupts are
tristated.

I/O SPACE - BANK1

OFFSET

NAME

BASE ADDRESS REGISTER

TYPE

READ/WRITE

SYMBOL

BAR

In ISA mode, this register holds the address decode options chosen for the I/O and ROM spaces. It
is part of the EEPROM saved setup and is not usually modified during run-time.

HIGH

BYTE

A15

A14

A13

LOW

BYTE

ROM SIZE

RA18

RA17

RA16

RA15

RA14

A15 - A13 and A9 - A5 - These bits are
compared in ISA mode against the I/O address
on the bus to determine the IOBASE for
LAN91C94 registers. The 64k I/O space is fully
decoded by the LAN91C94 down to a 16
location space, therefore the unspecified
address lines A4, A10, A11 and A12 must be all
zeros.

ROM SIZE - Determines the ROM decode area
in ISA mode memory space as follows:

00 = ROM disable
01 = 16k: RA14-18 define ROM select.
10 = 32k: RA15-18 define ROM select.
11 = 64k: RA16-18 define ROM select.

RA18-RA14 - These bits are compared against
the memory address on the bus to determine

if the ROM is being accessed, as a function of
the ROM SIZE. ROM accesses are read only
memory accesses defined by nMEMRD going
low.

For a full decode of the address space
unspecified upper address lines have to be:

A19 = "1" , A20-A23 lines are not directly
decoded, however ISA systems will only activate
nSMEMRD only when A20-A23=0.

All bits in this register are loaded from the serial
EEPROM. The I/O base decode defaults to
300h (namely, the high byte defaults to 18h).
ROM SIZE defaults to 01. ROM decode defaults
to CC000 (namely the low byte defaults to 67h).
As an example:

I/O SPACE - BANK1

OFFSET

4 THROUGH 9

NAME

INDIVIDUAL ADDRESS REGISTERS

TYPE

READ/WRITE

SYMBOL

IAR

These registers are loaded starting at word location 20h of the EEPROM upon hardware reset or
EEPROM reload. The registers can be modified by the software driver, but a STORE operation will
not modify the EEPROM Individual Address contents.

Bit 0 of Individual Address 0 register corresponds to the first bit of the address on the cable.

LOW

BYTE

ADDRESS 0

HIGH

BYTE

ADDRESS 1

LOW

BYTE

ADDRESS 2

HIGH

BYTE

ADDRESS 3

LOW

BYTE

ADDRESS 4

HIGH

BYTE

ADDRESS 5

I/O SPACE - BANK1

OFFSET

NAME

GENERAL PURPOSE REGISTER

TYPE

READ/WRITE

SYMBOL

GPR

HIGH

BYTE

HIGH DATA BYTE

LOW

BYTE

LOW DATA BYTE

This register can be used as a way of storing
and retrieving non-volatile information in the
EEPROM to be used by the software driver. The
storage is word oriented, and the EEPROM
word address to be read or written is specified
using the six lowest bits of the Pointer Register.

This register can also be used to sequentially
program the Individual Address area of the

EEPROM, that is normally protected from
accidental Store operations.

This register will be used for EEPROM read and
write only when the EEPROM SELECT bit in the
Control Register is set. This allows generic
EEPROM read and write routines that do not
affect the basic setup of the LAN91C94.

I/O SPACE - BANK1

OFFSET

NAME

CONTROL REGISTER

TYPE

READ/WRITE

SYMBOL

CTR

HIGH

BYTE

RCV_BAD

PWRDN

AUTO

RELEASE

LOW

BYTE

ENABLE

EEPROM

SELECT

RELOAD

STORE

RCV_BAD - When set, bad CRC packets are
received. When clear bad CRC packets do not
generate interrupts and their memory is
released.

PWRDN - Active high bit used to enter power
down mode. Cleared by a write to any register in
the LAN91C94 I/O space or by hardware reset.

AUTO RELEASE - When set, transmit pages
are released by transmit completion if the
transmission was successful (when TX_SUC is
set). In that case there is no status word
associated with its packet number, and
successful packet numbers are not even written
into the TX COMPLETION FIFO.

A sequence of transmit packets will only
generate an interrupt when the sequence is
completely transmitted (TX EMPTY INT will be
set), or when a packet in the sequence
experiences a fatal error (TX INT will be set).

Upon a fatal error TXENA is cleared and the
transmission sequence stops. The packet
number that failed is the present in the FIFO
PORTS register, and its pages are not
released,

allowing the CPU to restart the sequence after
corrective action is taken.

LE ENABLE - Link Error Enable. When set it
enables the LINK_OK bit transition as one of the
interrupts merged into the EPH INT bit. Defaults
low (disabled). Writing this bit also serves as the
acknowledge by clearing previous LINK interrupt
conditions.

CR ENABLE - Counter Roll over Enable. When
set it enables the CTR_ROL bit as one of the
interrupts merged into the EPH INT bit. Defaults
low (disabled).

TE ENABLE - Transmit Error Enable. When set
it enables Transmit Error as one of the
interrupts merged into the EPH INT bit. Defaults
low (disabled). Transmit Error is any condition
that clears TXENA with TX_SUC staying low as
described in the EPHSR register.

EEPROM SELECT - This bit allows the CPU to
specify which registers the EEPROM RELOAD
or STORE refers to. When high, the General
Purpose Register is the only register read or
written. When low, RELOAD reads
Configuration, Base and Individual Address,

and STORE writes the Configuration and Base
registers.

RELOAD - When set it will read the EEPROM
and update relevant registers with its contents.
Clears upon completing the operation.

STORE - When set, stores the contents of all
relevant registers in the serial EEPROM. Clears
upon completing the operation.

Note: When an EEPROM access is in progress
the STORE and RELOAD bits will be read back
as high. The remaining 14 bits of this register will
be invalid. During this time attempted read/write
operations, other than polling the EEPROM
status, will NOT have any effect on the internal
registers. The CPU can resume accesses to the
LAN91C94 after both bits are low. A worst case
RELOAD operation initiated by RESET or by
software takes less than 750usec.

I/O SPACE - BANK2

OFFSET

NAME

MMU COMMAND REGISTER

TYPE

WRITE ONLY

BUSY bit

readable

SYMBOL

MMUCR

This register is used by the CPU to control the memory allocation, de-allocation, TX FIFO and RX
FIFO control. The three command bits determine the command issued as described below:

HIGH

BYTE

LOW

BYTE

COMMAND

N0/BUSY

COMMAND SET:

xyz

000 0)

NOOP - NO OPERATION

001 1)

ALLOCATE MEMORY FOR TX - N2,N1,N0 defines the amount of memory requested as
(value + 1) x 256 bytes. Namely N2,N1,N0 = 1 will request 2 x 256 = 512 bytes. Valid range
for N2,N1,N0 is 0 through 5. A shift-based divide by 256 of the packet length yields the
appropriate value to be used as N2,N1,N0. Immediately generates a completion code at the
ALLOCATION RESULT REGISTER. Can optionally generate an interrupt on successful
completion. The allocation time can take worst case (N2,N1,N0 + 2) x 200ns.

010 2)

RESET MMU TO INITIAL STATE - Frees all memory allocations, clears relevant interrupts,
resets packet FIFO pointers.

011 3)

REMOVE FRAME FROM TOP OF RX FIFO - To be issued after CPU has completed
processing of present receive frame. This command removes the receive packet number
from the RX FIFO and brings the next receive frame (if any) to the RX area (output of RX
FIFO).

100 4)

REMOVE AND RELEASE TOP OF RX FIFO - Like 3) but also releases all memory used by
the packet presently at the RX FIFO output.

101 5)

RELEASE SPECIFIC PACKET - Frees all pages allocated to the packet specified in the
PACKET NUMBER REGISTER. Should not be used for frames pending transmission.
Typically used to remove transmitted frames, after reading their completion status. Can be
used following 3) to release receive packet memory in a more flexible way than 4).

110 6)

ENQUEUE PACKET NUMBER INTO TX FIFO - This is the normal method of transmitting a
packet just loaded into RAM. The packet number to be enqueued is taken from the PACKET
NUMBER REGISTER.

111

RESET TX FIFOs - This command will reset both TX FIFOs: The TX FIFO holding the
packet numbers awaiting transmission and the TX Completion FIFO. This command
provides a mechanism for canceling packet transmissions, and reordering or bypassing
the transmit queue. The RESET TX FIFOs command should only be used when the
transmitter is disabled. Unlike the RESET MMU command, the RESET TX FIFOs does
not release any memory.

Note 1: Only command 1) uses N2,N1,N0.

Note 2: When using the RESET TX FIFOS command, the CPU is responsible for releasing the

memory associated with outstanding packets, or re-enqueuing them. Packet numbers in the
completion FIFO can be read via the FIFO ports register before issuing the command.

Note 3: MMU commands releasing memory (commands 4 and 5) should only be issued if the

corresponding packet number has memory allocated to it.

COMMAND SEQUENCING

A second allocate command (command 1)
should not be issued until the present one has
completed. Completion is determined by reading
the FAILED bit of the allocation result register or
through the allocation interrupt.

A second release command (commands 4, 5)
should not be issued if the previous one is still
being processed. The BUSY bit indicates that a
release command is in progress. After issuing

command 5, the contents of the PNR should not
be changed until BUSY goes low. After issuing
command 4, command 3 should not be issued
until BUSY goes low.

BUSY BIT - Readable at bit 0 of the MMU
command register address. When set indicates
that MMU is still processing a release
command. When clear, MMU has already
completed last release command. BUSY and
FAILED bits are set upon the trailing edge of
command.

I/O SPACE - BANK2

OFFSET

NAME

PACKET NUMBER REGISTER

TYPE

READ/WRITE

SYMBOL

PNR

PACKET NUMBER AT TX AREA

PACKET NUMBER AT TX AREA The value
written into this register determines which
packet number is accessible through the TX
area. Some MMU commands use the number

stored in this register as the packet number
parameter. This register is cleared by a RESET
or a RESET MMU Command.

I/O BANK - SPACE2

OFFSET

NAME

ALLOCATION RESULT REGISTER

TYPE

READ ONLY

SYMBOL

ARR

This register is updated upon an ALLOCATE MEMORY MMU command.

FAILED

ALLOCATED PACKET NUMBER

FAILED A zero indicates a successful allocation
completion. If the allocation fails the bit is set
and only cleared when the pending allocation is
satisfied. Defaults high upon reset and reset
MMU command. For polling purposes, the
ALLOC_INT in the Interrupt Status Register
should be used because it is synchronized to the
read operation. Sequence:

1) Allocate Command
2) Poll ALLOC_INT bit until set
3) Read Allocation Result Register

ALLOCATED PACKET NUMBER Packet
number associated with the last memory
allocation request. The value is only valid if the
FAILED bit is clear.

Note: For software compatibility with future
versions, the value read from the ARR after an
allocation request is intended to be written into
the PNR as is, without masking higher bits
(provided FAILED = 0).

I/O SPACE - BANK2

OFFSET

NAME

FIFO PORTS REGISTER

TYPE

READ ONLY

SYMBOL

FIFO

This register provides access to the read ports of the Receive FIFO and the Transmit completion
FIFO. The packet numbers to be processed by the interrupt service routines are read from this
register.

HIGH

BYTE

REMPTY

RX FIFO PACKET NUMBER

LOW

BYTE

TEMPTY

TX DONE PACKET NUMBER

REMPTY No receive packets queued in the RX
FIFO. For polling purposes, use the RCV_INT
bit in the Interrupt Status Register.

TOP OF RX FIFO PACKET NUMBER Packet
number presently at the output of the RX FIFO.
Only valid if REMPTY is clear. The packet is
removed from the RX FIFO using MMU
Commands 3) or 4).

TEMPTY No transmit packets in TX completion
queue. For polling purposes, use the TX_INT
bit in the Interrupt Status Register.

TX DONE PACKET NUMBER Packet number
presently at the output of the TX Completion
FIFO. Only valid if TEMPTY is clear. The
packet is removed when a TX INT acknowledge
is issued.

Note: For software compatibility with future
versions, the value read from each FIFO register
is intended to be written into the PNR as is,
without masking higher bits (provided TEMPTY
and REMPTY = 0 respectively).

I/O SPACE - BANK2

OFFSET

NAME

POINTER REGISTER

TYPE

READ/WRITE

SYMBOL

PTR

HIGH

BYTE

RCV

AUTO
INCR.

READ

ETEN

POINTER HIGH

LOW

BYTE

POINTER LOW

POINTER REGISTER: The value of this
register determines the address to be accessed
within the transmit or receive areas. It will auto-
increment on accesses to the data register when
AUTO INCR. is set. The increment is by one for
every byte access, and by two for every word
access.

When RCV is set the address refers to the
receive area and uses the output of RX FIFO as
the packet number; when RCV is clear the
address refers to the transmit area and uses the
packet number at the Packet Number Register.

READ bit determines the type of access to
follow. If the READ bit is high the operation
intended is a read. If the READ bit is low the
operation is a write. Loading a new pointer
value, with the READ bit high, generates a pre-
fetch into the Data Register for read purposes.

Readback of the pointer will indicate the value of
the address last accessed by the CPU
(rather than the last pre-fetched). This allows
any interrupt routine that uses the pointer to
save it and restore it without affecting the
process being interrupted.

The Pointer Register should not be loaded until
400ns after the last write operation to the Data
Register to ensure that the Data Register FIFO
is empty.

On reads, if IOCHRDY is not connected to the
host, the Data Register should not be read
before 400ns after the pointer was loaded to
allow the Data Register FIFO to fill.

If the pointer is loaded using 8 bit writes, the low
byte should be loaded first and the high byte
last.

ETEN bit When set, enables Early Transmit
underrun detection. Normal operation when
clear.

Note: If AUTO INCR. is not set, the pointer must
be loaded with an even value.

I/O SPACE - BANK2

OFFSET

8 & A

NAME

DATA REGISTER

TYPE

READ/WRITE

SYMBOL

DATA

HIGH

BYTE

DATA HIGH

LOW

BYTE

DATA LOW

DATA REGISTER - Used to read or write the
data buffer byte/word presently addressed by
the pointer register.

This register is mapped into two uni-directional
FIFOs that allow moving words to and from the
LAN91C94 regardless of whether the pointer
address is even or odd. Data goes through the
write FIFO into memory, and is pre-fetched from
memory into the read FIFO. If byte accesses
are used, the appropriate (next) byte can be
accessed through the Data Low or

Data High registers. The order to and from the
FIFO is preserved. Byte and word accesses can
be mixed on the fly in any order.

This register is mapped into two consecutive
word locations to facilitate the usage of double
word move instructions. The DATA register is
accessible at any address in the 8 through Ah
range, while the number of bytes being
transferred are determined by A0 and nSBHE in
ISA mode, and by A0, nCE1 and nCE2 in
PCMCIA mode.

I/O SPACE - BANK2

OFFSET

NAME

INTERRUPT STATUS REGISTER

TYPE

READ ONLY

SYMBOL

IST

ERCV INT

EPH INT

RX_OVRN

INT

ALLOC

INT

TX EMPTY

INT

TX INT

RCV INT

OFFSET

NAME

INTERRUPT ACKNOWLEDGE

REGISTER

TYPE

WRITE ONLY

SYMBOL

ACK

ERCV INT

RX_OVRN

INT

TX EMPTY

INT

TX INT

OFFSET

NAME

INTERRUPT MASK REGISTER

TYPE

READ/WRITE

SYMBOL

MSK

ERCV INT

EPH INT

RX_OVRN

INT

ALLOC

INT

TX EMPTY

INT

TX INT

RCV INT

This register can be read and written as a word
or as two individual bytes.

The Interrupt Mask Register bits enable the
appropriate bits when high and disable them
when low. An enabled bit being set will cause a
hardware interrupt.

EPH INT - Set when the Ethernet Protocol
Handler section indicates one out of various
possible special conditions. This bit merges
exception type of interrupt sources, whose
service time is not critical to the execution speed
of the low level drivers. The exact nature of the
interrupt can be obtained from the EPH

Status Register (EPHSR), and enabling of these
sources can be done via the Control Register.
The possible sources are:
LINK_OK transition.
CTR_ROL - Statistics counter roll over.

TXENA cleared - A fatal transmit error occurred
forcing TXENA to be cleared. TX_SUC will be
low and the specific reason will be reflected by
the bits:

TXUNRN - Transmit underrun
SQET - SQE Error
LOST CARR - Lost Carrier
LATCOL - Late Collision
16COL - 16 collisions

RX_OVRN INT - Set when the receiver overruns
due to a failed memory allocation or when a
packet exceeding 1536 bytes is received, or
when a packet reception is stopped on-the-fly by
setting the RCV_DISCRD bit in the ERCV
register. The RX_OVRN bit of the EPHSR will
also be briefly set. The RX_OVRN INT bit,
however, latches the overrun condition for the
purpose of being polled or generating an
interrupt, and will only be cleared by writing the
acknowledge register with the RX_OVRN INT bit
set.

ALLOC INT - Set when an MMU request for TX
pages allocation is completed. This bit is the
complement of the FAILED bit in the
ALLOCATION RESULT register. The ALLOC
INT ENABLE bit should only be set following an
allocation command, and cleared upon servicing
the interrupt.

TX EMPTY INT - Set if the TX FIFO goes
empty, can be used to generate a single
interrupt at the end of a sequence of packets
enqueued for transmission. This bit latches the
empty condition, and the bit will stay set until it
is specifically cleared by writing the
acknowledge register with the TX EMPTY INT
bit set. If a real time reading of the FIFO empty
is desired, the bit should be first cleared and
then read.

The TX EMPTY INT ENABLE should only be set
after the following steps:

A packet is enqueued for transmission

The previous empty condition is cleared
(acknowledged).

TX INT - Set when at least one packet
transmission was completed. The first packet
number to be serviced can be read from the
FIFO PORTS register. The TX INT bit is always
the logic complement of the TEMPTY bit in the
FIFO PORTS register. After servicing a packet
number, its TX INT interrupt is removed by
writing the Interrupt Acknowledge Register with
the TX INT bit set.

RCV INT - Set when a receive interrupt is
generated. The first packet number to be
serviced can be read from the FIFO PORTS
register. The RCV INT bit is always the logic
complement of the REMPTY bit in the FIFO
PORTS register.

ERCV INT - Early receive interrupt. Set
whenever a receive packet is being received,
and the number of bytes received into memory
exceeds the value programmed as ERCV
THRESHOLD (Bank 3, Offset Ch). ERCV INT
stays set until acknowledged by writing the
INTERRUPT ACKNOWLEDGE REGISTER with
the ERCV INT bit set.

Note: If the driver uses AUTO RELEASE mode
it should enable TX EMPTY INT as well as TX
INT. TX EMPTY INT will be set when the
complete sequence of packets is transmitted.
TX INT will be set if the sequence stops due to a
fatal error on any of the packets in the
sequence.

Note: For edge triggered systems, the Interrupt
Service Routine should clear the Interrupt Mask
Register, and only enable the appropriate
interrupts after the interrupt source is serviced
(acknowledged).

FIGURE 11 INTERRUPT STRUCTURE

I
N

I
S

I
N

I
S

T
A

-
7

-
1

I
N

I
F

(
E

)

F
A

I
L

I
O

I
F

I
N

L
O

I
N

HIGH

BYTE

MULTICAST TABLE 7

The 64 bit multicast table is used for group
address filtering. The hash value is defined as
the six most significant bits of the CRC of the
destination addresses. The three msb's
determine the register to be used (MT0-7), while
the other three determine the bit within the
register.

If the appropriate bit in the table is set, the
packet is received.

If the ALMUL bit in the RCR register is set, all
multicast addresses are received regardless of
the multicast table values.

Hashing is only a partial group addressing
filtering scheme, but being the hash value
available as part of the receive status word, the
receive routine can reduce the search time
significantly. With the proper memory structure,
the search is limited to comparing only the
multicast addresses that have the actual hash
value in question.

I/O SPACE - BANK3

OFFSET

NAME

MANAGEMENT INTERFACE

TYPE

READ/WRITE

SYMBOL

MGMT

This register contains status bits and control bits for management of different transceivers modules.
Some of the pins are shared with the serial EEPROM interface. Management is software controlled,
and does not use the serial EEPROM and the transceiver management functions at the same time.

HIGH

BYTE

nXNDEC

IOS2

IOS1

IOS0

LOW

BYTE

MDOE

MCLK

Reserved

MD0

nXNDEC - Read only bit reflecting the status of
the nXENDEC pin.

IOS0-2 - Read only bits reflecting the status of
the IOS0-2 pins.

MDO - The value of this bit drives the EEDO pin
when MDOE=1.

MDCLK - The value of this bit drives the EESK
pin when MDOE=1.

MDOE - When this bit is high pins EEDO EECS
and EESK will be used for transceiver
management functions, otherwise the pins
assume the EEPROM values.

MDOE=0

MDOE=1

EEDO

Serial EEPROM Data Out

Bit MDO

EESK

Serial EEPROM Clock

Bit MCLK

EECS

Serial EEPROM Chip Select

I/O SPACE - BANK3

OFFSET

NAME

EARLY RCV REGISTER

TYPE

READ/WRITE

SYMBOL

ERCV

HIGH

BYTE

LOW

BYTE

RCV

DISCRD

ERCV THRESHOLD

RCV DISCRD - Set to discard a packet being
received. This bit can be used in conjunction
with ERCV THRESHOLD and ERCV INT to
process a packet header while it is being
received and discard it if the packet is not
desired. Setting this bit will only discard packets
that are still in the process of being received.

If the RCV DISCRD bit is set prior to the end of
a receive packet, RXOVRN bit in the Interrupt
Status Register will be set to indicate that the
packet was discarded and its memory

released. If the receive packet is complete prior
to the RCV DISCARD bit being set, the packet is
received normally and RCV INT bit is set in the
Interrupt Status Register. The RCV DISCARD
bit is self-clearing.

ERCV THRESHOLD - Threshold for ERCV
interrupt. Specified in 64 byte multiples.
Whenever the number of bytes written in
memory for the presently received packet
exceeds the ERCV THRESHOLD, ERCV INT bit
of the INTERRUPT STATUS REGISTER is set.

THEORY OF OPERATION

The concept of presenting the shared RAM as a
FIFO of packets, with a memory management
unit allocating memory on a per packet basis
responds to the following needs:

Memory allocation for receive vs. transmit - A
fixed partition between receive and transmit area
would not be efficient. Being able to
dynamically allocate it to transmit and receive
represents almost the equivalent of duplicating
the memory size for some workstation type of
drivers.

Software overhead - By presenting a FIFO of
packets, the software driver does not have to
waste any time in calculating pointers for the
different buffers that make up different packets.
The driver usually deals with one packet at a
time. With this approach, packets are
accessible always at the same fixed address,
and access is provided to any byte of the
packet.

Headers can be analyzed without reading out
the entire packet. The packet can be moved in
or out with a block move operation.

Multiple upper layer support - The LAN91C94
facilitates interfacing to multiple upper layer
protocols because of the receive packet
processing flexibility. A receive lookahead
scheme like ODI or NDIS drivers is supported
by copying a small part of the received packet
and letting the upper layer provide a pointer for
the rest of the data. If the upper layer indicates
it does not want the packet, it can be removed
upon a single command. If the upper layer
wants a specific part of the packet, a block
move operation starting at any particular offset
can be done. Out of order receive processing is
also supported: if memory for one packet is not
yet available, receive packet processing can
continue.

Efficiency - Lacking any level of indirection or
linked lists of pointers, virtually all the memory
is used for data. There are no descriptors,
forward links and pointers at all. This simplicity
and memory efficiency is accomplished without
giving up the benefits of linked lists which is
unlimited back-to-back transmission and
reception without CPU intervention for as long
as memory is available.

TYPICAL FLOW OF EVENTS FOR TRANSMIT

S/W DRIVER

CSMA/CD SIDE

ISSUE ALLOCATE MEMORY FOR TX - N
BYTES - the MMU attempts to allocate N
bytes of RAM.

WAIT FOR SUCCESSFUL COMPLETION
CODE - Poll until the ALLOC INT bit is set or
enable its mask bit and wait for the interrupt.
The TX packet number is now at the Allocation
Result Register.

LOAD TRANSMIT DATA - Copy the TX packet
number into the Packet Number Register.
Write the Pointer Register, then use a block
move operation from the upper layer transmit
queue into the Data Register.

ISSUE "ENQUEUE PACKET NUMBER TO TX
FIFO" - This command writes the number
present in the Packet Number Register into the
TX FIFO. The transmission is now enqueued.
No further CPU intervention is needed until a
transmit interrupt is generated.

The enqueued packet will be transferred to the
CSMA/CD block as a function of TXENA (in
TCR) bit and of the deferral process state.

Upon transmit completion the first word in
memory is written with the status word. The
packet number is moved from the TX FIFO
into the TX completion FIFO. Interrupt is
generated by the TX completion FIFO being
not empty.

SERVICE INTERRUPT - Read Interrupt Status
Register. If it is a transmit interrupt, read the
TX Done Packet Number from the Fifo Ports
Register. Write the packet number into the
Packet Number Register. The corresponding
status word is now readable from memory. If
status word shows successful transmission,
issue RELEASE packet number command to
free up the memory used by this packet.
Remove packet number from completion FIFO
by writing TX INT Acknowledge Register.

TYPICAL FLOW OF EVENTS FOR RECEIVE

S/W DRIVER

CSMA/CD SIDE

ENABLE RECEPTION - By setting the RXEN
bit.

A packet is received with matching address.
Memory is requested from MMU. A packet
number is assigned to it. Additional memory
is requested if more pages are needed.

The internal DMA logic generates sequential
addresses and writes the receive words into
memory. The MMU does the sequential to
physical address translation. If overrun,
packet is dropped and memory is released.

When the end of packet is detected, the status
word is placed at the beginning of the receive
packet in memory. Byte count is placed at the
second word. If the CRC checks correctly the
packet number is written into the RX FIFO.
The RX FIFO being not empty causes RCV
INT (interrupt) to be set. If CRC is incorrect
the packet memory is released and no
interrupt will occur.

SERVICE INTERRUPT - Read the Interrupt
Status Register and determine if RCV INT is
set. The next receive packet is at receive area.
(Its packet number can be read from the FIFO
Ports Register). The software driver can
process the packet by accessing the RX area,
and can move it out to system memory if
desired. When processing is complete the
CPU issues the REMOVE AND RELEASE
FROM TOP OF RX command to have the
MMU free up the used memory and packet
number.

FIGURE 12 INTERRUPT SERVICE ROUTINE

IS R

S ave Bank Sel ect & Addre ss

Ptr R egisters

Mas k 9 1 C94 Interrupts

Read Interrup t Regist er

C all TX INTR or TXEMPTY

IN TR

TX INTR?

Ge t N ext TX

RX INTR?

Yes

Call RXIN T R

ALLOC INTR?

Yes

Write Allocated Pk t # into

Packet Number Reg.

Writ e Ad Ptr Reg. & Co py Data

& Sour ce Add r ess

Enqu e ue Pac ket

Pac ket

Av ailable for

Tra ns mis sion?

Yes

Call A LLOCATE

EPH INTR?

Yes

C all E PH IN T R

Set "Ready for Packet" Flag

Return Buffers to Up per Lay er

Disa ble Allocation I nte rr u pt

Mask

R est or e Address Pointer &

Bank Selec t R egisters

U nmas k 9 1 C94 I nterrupts

Ex it ISR

FIGURE 16 DRIVER SEND AND ALLOCATE ROUTINES

ALLOCATE

I ssue "Alloca te Memory "

Comman d t o MMU

R ead Int er rupt Status R egister

Enqu eue Pack et

Set "Ready for Packet" Flag

Ret urn

C opy Remaining TX Dat a

Packet int o R AM

R et urn Buff ers to U pper L ayer

Write Allocated Packet int o

Packet # Register

Wr ite Address Pointer

R egister

Copy Pa r t of TX Data Packet

into RAM

Write Sourc e Add re ss int o

Proper L ocation

Store Data Buf fer Pointer

Clear "Ready for Packet" Flag

Enable Allocat ion Interrupt

Allocation

Pass ed ?

Yes

D RIVER SEND

Ch oo se Bank Select

R egist er 2

Call ALLOCATE

Exit Driver Send

Read Allocat ion Result

R egister

MEMORY PARTITIONING

Unlike other controllers, the LAN91C94 does not
require a fixed memory partitioning between
transmit and receive resources. The MMU
allocates and de-allocates memory upon
different events. An additional mechanism
allows the CPU to prevent the receive process
from starving the transmit memory allocation.

Memory is always requested by the side that
needs to write into it, that is: the CPU for
transmit or the CSMA/CD for receive. The CPU
can control the number of bytes it requests for
transmit but it cannot determine the number of
bytes the receive process is going to demand.
Furthermore, the receive process requests will
be dependent on network traffic, in particular on
the arrival of broadcast and multicast packets
that might not be for the node, and that are not
subject to upper layer software flow control.

In order to prevent unwanted traffic from using
too much memory, the CPU can program a
"memory reserved for transmit" parameter. If
the free memory falls below the "memory
reserved for transmit" value, MMU requests
from the CSMA/CD block will fail and the
packets will overrun and be ignored. Whenever
enough memory is released, packets can be
received again. If the reserved value is too
large, the node might lose data which is an
abnormal condition. If the value is kept at zero,
memory allocation is handled on first-come first-
served basis for the entire memory capacity.

Note that with the memory management built
into the LAN91C94, the CPU can dynamically
program this parameter. For instance, when the
driver does not need to enqueue transmissions,
it can allow more memory to be allocated for
receive (by reducing the value of the reserved
memory). Whenever the driver needs to burst
transmissions it can reduce the receive memory
allocation. The driver program the parameter as
a function of the following variables:
1)

Free memory (read only register)

Memory size (read only register)

The reserved memory value can be changed on
the fly. If the MEMORY RESERVED FOR TX
value is increased above the FREE MEMORY,
receive packets in progress are still received,
but no new packets are accepted until the FREE
MEMORY increases above the MEMORY
RESERVED value.

INTERRUPT GENERATION

The interrupt strategy for the transmit and
receive processes is such that it does not
represent the bottleneck in the transmit and
receive queue management between the
software driver and the controller. For that
purpose there is no register reading necessary
before the next element in the queue (namely
transmit or receive packet) can be handled by
the controller. The transmit and receive results
are placed in memory.

The receive interrupt will be generated when the
receive queue (FIFO of packets) is not empty
and receive interrupts are enabled. This allows
the interrupt service routine to process many
receive packets without exiting, or one at a time
if the ISR just returns after processing and
removing one.

There are two types of transmit interrupt
strategies:

One interrupt per packet.

One interrupt per sequence of packets.

The strategy is determined by how the transmit
interrupt bits and the AUTO RELEASE bit are
used.

TX INT bit - Set whenever the TX completion
FIFO is not empty.

TX EMPTY INT bit - Set whenever the TX FIFO
is empty.

AUTO RELEASE - When set, successful
transmit packets are not written into completion
FIFO, and their memory is released
automatically.

One interrupt per packet: enable TX INT,

set AUTO RELEASE=0. The software driver
can find the completion result in memory and
process the interrupt one packet at a time.
Depending on the completion code the driver
will take different actions. Note that the transmit
process is working in parallel and other
transmissions might be taking place. The
LAN91C94 is virtually queuing the packet
numbers and their status words.

In this case, the transmit interrupt service
routine can find the next packet number to be
serviced by reading the TX DONE PACKET
NUMBER at the FIFO PORTS register. This
eliminates the need for the driver to keep a list
of packet numbers being transmitted. The
numbers are queued by the LAN91C94 and
provided back to the CPU as their transmission
completes.

One interrupt per sequence of packets:

Enable TX EMPTY INT and TX INT, set AUTO
RELEASE=1. TX EMPTY INT is generated only
after transmitting the last packet in the FIFO.

TX INT will be set on a fatal transmit error
allowing the CPU to know that the transmit
process has stopped and therefore the FIFO will
not be emptied.

This mode has the advantage of a smaller CPU
overhead, and faster memory de-allocation.
Note that when AUTO RELEASE=1 the CPU is
not provided with the packet numbers that
completed successfully.

Note: The pointer register is shared by any
process accessing the LAN91C94 memory. In
order to allow processes to be interruptable,

the interrupting process is responsible for
reading the pointer value before modifying it,
saving it, and restoring it before returning from
the interrupt.

Typically there would be three processes using
the pointer:

Transmit loading (sometimes interrupt
driven)

Receive unloading (interrupt driven)

Transmit Status reading (interrupt driven).

1) and 3) also share the usage of the Packet
Number Register. Therefore saving and
restoring the PNR is also required from interrupt
service routines.

POWER DOWN

The LAN91C94 can enter power down mode by
means of the PWRDWN pin (pin 68) or the
PWRDN bit (Control Register, bit 13). The
power down current is 8 mA. When in power
down mode, the LAN91C94 will:

- Stop the crystal oscillator
- Tristate:

Data Bus
Interrupts
nIOCS16
10BASE-T and AUI outputs

Turn off analog bias currents

- Drive the EEPROM and ROM outputs inactive
- Preserve contents of registers and memory

The PWRDWN pin is internally gated with the
RESET (RESET pin before de-glitching) and
with the SRESET bit (COR bit 7). This gating
function internally negates power down
whenever RESET is high or SRESET is high to
allow the oscillator to run during RESET. Except
for this gating function, all other uses of the
RESET pin use a de-glitched version of the
signal as defined in the pin description section.

FIGURE 17 INTERRUPT GENERATION FOR TRANSMIT, RECEIVE and MMU

I
F

I
O

I
F

/
C

S
I
C

I
F

.
S

.

B

L
Y

'
E

'
N

I
N

I
S

I
N

T
I

FUNCTIONAL DESCRIPTION OF THE BLOCKS

MEMORY MANAGEMENT UNIT

The MMU interfaces the on-chip RAM on one
side and the arbiter on the other for address and
data flow purposes. For allocation and de-
allocation, it interfaces the arbiter only.

The MMU deals with a single ported memory
and is not aware of the fact that there are two
entities requesting allocation and actually
accessing memory. The mapping function done
by the MMU is only a function of the packet
number accessed and of the offset within that
packet being accessed. It is not a function of
who is requesting the access or the direction of
the access.

To accomplish that, memory accesses as well
as MMU allocation and de-allocation requests
are arbitrated by the arbiter block before
reaching the MMU.

Memory allocation could take some time, but
the ALLOC INT bit in Interrupt Status Register is
negated immediately upon allocation request,
allowing the system to poll that register at any
time. Memory de-allocation command
completion indication is provided via the BUSY
bit, readable through the MMU command
register.

The mapping and queuing functions of the MMU
rely on the uniqueness of the packet number
assigned to the requester. For that purpose the
packet number assignment is centralized at the
MMU, and a number will not be reused until the
memory associated with it is released. It is
clear that a packet number should not be
released while the number is in the TX or RX
packet queue.

The TX and RCV FIFOs are deep enough to
handle the total number of packets the MMU

can allocate, therefore there is no need for the
programmer or the hardware to check FIFO full
conditions.

ARBITER

The function of the arbiter is to sequence packet
RAM accesses as well as MMU requests in such
a way that the on-chip single ported RAM and a
single MMU can be shared by two parties. One
party is the host CPU and the other party is the
CSMA/CD block.

The arbiter is address transparent, namely, any
address can be accessed at any time. In order
to exploit the sequential nature of the access,
and minimize the access time on the system
side, the CPU cycle is buffered by the Data
Register rather than go directly to and from
memory. Whenever a write cycle is performed,
the data is written into the Data Register and will
be written into memory as a result of that
operation, allowing the CPU cycle to complete
before the arbitration and memory cycle are
complete. Whenever a read cycle is performed,
the data is provided immediately from the Data
Register, without having to arbitrate and
complete a memory cycle. The present cycle
results in an arbitration request for the next data
location. Loading the pointer causes a similar
pre-fetch request.

This type of read-ahead and write-behind
arbitration allows the controller to have a very
fast access time, and would work without wait
states for as long as the cycle time spec. is
satisfied. The values are 40ns access time, and
185ns cycle time.

By the same token, CSMA/CD cycles might be
postponed. The worst case CSMA/CD latency
for arbiter service is one memory cycle.

The arbiter uses the pointer register as the CPU
provided address, and the internal DMA address
from the CSMA/CD side as the addresses to be
provided to the MMU.

The data path routed by the arbiter goes
between memory (the data path does not go
through the MMU) on one side and either the
CPU side bus or the data path of the CSMA/CD
core.

The data path between memory and the Data
Register is in fact buffered by a small FIFO in
each direction. The FIFOs beneath the Data
Register can be read and written as bytes or
words, in any sequential combination. The
presence of these FIFOs makes sure that word
transfers are possible on the system bus even if
the address loaded into the pointer is odd.

BUS INTERFACE

The bus interface handles the data, address and
control interfaces as a superset of the ISA and
PCMCIA specifications and allows 8 or 16 bit
adapters to be designed with the LAN91C94
with no glue to interface the ISA or PCMCIA
bus.

The functions done in this block are address
decoding for I/O and ROM memory (including
address relocation support) for ISA, data path
routing, sequential memory address support,
optional wait state generation, boot ROM
support, EEPROM setup function, bus
transceiver control, and interrupt
generation/selection.

For ISA, I/O address decoding is done by
comparing A15-A4 to the I/O BASE address
determined in part by the upper byte of the
BASE ADDRESS REGISTER, and also
requiring that AEN be low. If the above address
comparison is satisfied and the LAN91C94 is in
16 bit mode, nIOCS16 will be asserted (low).

A valid comparison does not yet indicate a valid

I/O cycle is in progress, as the addresses could
be used for a memory cycle, or could even
glitch through a valid value. Only when nIORD
or nIOWR are activated the I/O cycle begins.

In PCMCIA mode, A4-A15 are ignored for I/O
decodes, which rely on the PCMCIA host,
decoding for the slot. Input A10 for ISA is used
as an output (nFWE) for PCMCIA to enable
Flash Memory Write for programming the
attribute memory. It is valid only when nWE is
0 and COR2 is 1. nA11/nFCS is used to select
the Flash Memory Chip.

WAIT STATE POLICY

The LAN91C94 can work on most system buses
without having to add wait states. The two
parameters that determine the memory access
profile are the read access time and the cycle
time into the Data Register.

The read access time is 40ns and the cycle time
is 185ns. If any one of them does not satisfy
the application requirements, wait states should
be added.

If the access time is the problem, IOCHRDY
should be negated for all accesses to the
LAN91C94. This can be achieved by
programming the NO WAIT ST bit in the
configuration register to 0. The LAN91C94 will
negate IOCHRDY for 100ns to 150ns on every
access to any register.

If the cycle time is the problem, programming
NO WAIT ST as described before will solve it
but at the expense of slowing down all
accesses. The alternative is to let the
LAN91C94 negate IOCHRDY only when the
Data Register FIFOs require so. Namely, if NO
WAIT ST is set, IOCHRDY will only be negated
if a Data Register read cycle starts and there is
less than a full word in the read FIFO, or if a
write cycle starts and there is more than two
bytes in the write FIFO.

The cycle time is defined as the time between
leading edges of read from the Data Register, or
equivalently between trailing edges of write to
the Data Register. For example, in an ISA
system the cycle time of a 16 bit transfer will be
at least 2 clocks for the I/O access to the
LAN91C94 + one clock for the memory cycle) =
3 clocks. In absolute time it means 375ns for a
8MHz bus, and 240ns for a 12.5 MHz bus.

The cycle time will not increase when configured
for full duplex mode, because the CSMA/CD
memory arbitration requests are sequenced by
the DMA logic and never overlap.

DMA BLOCK

The DMA block resides between the CSMA/CD
block and the arbiter. It can interface both the
data path and the control path of the CSMA/CD
block for different operations.

Its functions include the following:

Start transmission process into the
CSMA/CD block.

Generate CSMA/CD side addresses for
accessing memory during transmit and
receive operations.

Generate MMU memory requests and verify
success.

Compute byte count and write it in first
locations of receive packet.

Write transmit status word in first locations
of transmit packet.

Determine if enough memory is available
for reception.

De-allocate transmit memory after suitable
completion.

De-allocate receive memory upon error
conditions.

Initiate retransmissions upon collisions (if
less than 16 retries).

Terminate reception and release memory if
packet is too long.

The specific nature of each operation and its
trigger event are:

TX operations will begin if TXENA is set
and TX FIFO is not empty. The DMA logic
does not need to use the TX PACKET
NUMBER, it goes directly from the FIFO to
the MMU. However the DMA logic controls
the removal of the PACKET NUMBER from
the FIFO.

Generation of CSMA/CD side addresses
into memory: Independent 11 bit counters
are kept for transmit and receive in order to
allow full-duplex operation.

MMU requests for allocation are generated
by the DMA logic upon reception. The
initial allocation request is issued when the
CSMA block indicates an active reception. If
allocation succeeds, the DMA block stores
the packet number assigned to it, and
generates write arbitration requests for as
long as the CSMA/CD FIFO is not empty.
In parallel the CSMA/CD completes the
address filtering and notifies the DMA of an
address match. If there is no address
match, the DMA logic will release the
allocated memory and stop reception.

When the CSMA/CD block notifies the DMA
logic that a receive packet was completed,
if the CRC is OK, the DMA will either write
the previously stored packet number into
the RX PACKET NUMBER FIFO (to be
processed by the CPU), or if the CRC is
bad the DMA will just issue a release
command to the MMU (and the CPU will
never see that packet).

Packets with bad CRC can be received if
the RCV_BAD bit in the configuration
register is set.

If AUTO_RELEASE is set, a release is
issued by the DMA block to the MMU after a
successful transmission (TX_SUCC set),
and the TX completion FIFO is clocked
together with the TX FIFO preventing the
packet number from moving into the TX
completion FIFO.

Based on the RX counter value, if a receive
packet exceeds 1532 bytes, reception is
stopped by the DMA and the RX ABORT bit
in the Receive Control Register is set. The
memory allocated to the packet is
automatically released.

If an allocation fails, the CSMA/CD block
will activate RX_OVRN upon detecting a
FIFO full condition. RXEN will stay active to
allow reception of subsequent packets if
memory becomes available. The
CSMA/CD block will flush the FIFO upon
the new frame arrival.

PACKET NUMBER FIFOS

The transmit packet FIFO stores the packet
numbers awaiting transmission, in the order
they were enqueued. The FIFO is advanced
(written) when the CPU issues the "enqueue
packet number command", the packet number
to be written is provided by the CPU via the
Packet Number Register. The number was
previously obtained by requesting memory
allocation from the MMU. The FIFO is read by
the DMA block when the CSMA/CD block is
ready to proceed on to the next transmission.
By reading the TX EMPTY INT bit the CPU can
determine if this FIFO is empty.

The transmit completion FIFO stores the packet
numbers that were already transmitted but not
yet acknowledged by the CPU. The CPU can
read the next packet number in this FIFO from
the Fifo Ports Register. The CPU can remove a
packet number from this FIFO by issuing a TX
INT acknowledge. The CPU can determine if

this FIFO is empty by reading the TX INT bit or
the FIFO Ports Register.

The receive packet FIFO stores the packet
numbers already received into memory, in the
order they were received. The FIFO is
advanced (written) by the DMA block upon
reception of a complete valid packet into
memory. The number is determined the
moment the DMA block first requests memory
from the MMU for that packet. The first receive
packet number in the FIFO can be read via the
Fifo Ports Register, and the data associated
with it can be accessed through the receive
area. The packet number can be removed
from the FIFO with or without an automatic
release of its associated memory.

The FIFO is read out upon CPU command
(remove packet from top of RX FIFO, or remove
and release command) after processing the
receive packet in the receive area.

The width of each FIFO is 5 bits per packet
number. The depth of each FIFO equals the
number of packets the LAN91C94 can handle
(18).

The guideline is software transparency; the
software driver should not be aware of different
devices or FIFO depths. If the MMU memory
allocation succeeded, there will be room in the
transmit FIFO for enqueuing the packet.
Conversely if there is free memory for receive,
there should be room in the receive FIFO for
storing the packet number.

Note that the CPU can enqueue a transmit
command with a packet number that does not
follow the sequence in which the MMU assigned
packet numbers. For example, when a
transmission failed and it is retried in software,
or when a receive packet is modified and sent
back to the network.

FIGURE 18 MMU PACKET NUMBER FLOW AND REVELANT REGISTERS

I
F

I
O

I
F

/
C

I
C

I
F

I
S

I
O

I
S

CSMA BLOCK

The CSMA/CD block is first interfaced via its
control registers in order to define its operational
configuration. From then on, the DMA interface
between the CSMA/CD block and memory is
used to transfer data to and from its data path
interface.

For transmit, the CSMA/CD block will be asked
to transmit frames as soon as they are ready in
memory. It will continue transmissions until any
of the following transmit error occurs:

a) 16 collisions on same frame
b) Late collision
c) Lost Carrier sense and MON_CSN set.
d) Transmit Under run.
e) SQET error and STP_SQET set.

In that case TXENA will be cleared and the CPU
should restart the transmission by setting it
again. If a transmission is successful, TXENA
stays set and the CSMA/CD is provided by the
DMA block with the next packet to be
transmitted.

For receive, the CPU sets RXEN as a way of
starting the CSMA/CD block receive process.
The CSMA/CD block will send data after
address filtering through the data path to the
DMA block. Data is transferred into memory as
it is received, and the final check on data
acceptance is the CRC checking done by the
CSMA/CD block. In any case, the DMA takes
care of requesting/releasing memory for receive
packets, as well as generating the byte count.

The receive status word is provided by the
CSMA/CD block and written in the first location
of the receive structure by the DMA block. If
configured for storing CRC in memory, the
CSMA/CD unit will transfer the CRC bytes
through the DMA interface, and then will be
treated like regular data bytes.

Note that the receive status word of any packet
is available only through memory and is not
readable through any other register. In order to
let the CPU know about receive overruns, the
RX_OVRN bit is latched into the Interrupt Status
Register, which is readable by the CPU at any
time.

The address filtering is done inside the
CSMA/CD block. A packet will be received if the
destination address is broadcast, or if it is
addressed to the individual address of the
LAN91C94, or if it is a multicast address and
ALMUL bit is set, or if it is a multicast address
matching one of the multicast table entries. If
the PRMS bit is set, all packets are received.

The CSMA/CD block is a full duplex machine,
and when working in full duplex mode, the
CSMA/CD block will be simultaneously using its
data path transmit and receive interfaces.

Statistical counters are kept by the CSMA/CD
block, and are readable through the appropriate
register. The counters are four bits each, and
can generate an interrupt when reaching their
maximum values. Software can use that
interrupt to update statistics in memory, or it can
keep the counter interrupt disabled, while relying
on the transmit interrupt routine reading the
counters. Given that the counters can
increment only once per transmit, this technique
is a good complement for the single interrupt
per sequence strategy.

The interface between the CSMA/CD block and
memory is word oriented. Two bi-directional
FIFOs make the data path interface.

Whenever a normal collision occurs (less than
16 retries), the CSMA/CD will trigger the backoff
logic and will indicate the DMA logic of the
collision. The DMA is responsible for restarting
the data transfer into the CSMA/CD block
regardless of whether the collision happened on
the preamble or not.

Only when 16 retries are reached, the CSMA/CD
block will clear the TXENA bit, and CPU
intervention is required. The DMA will not
automatically restart data transfer in this case,
nor will it transmit the next enqueued packet
until TXENA is set by the CPU. The DMA will
move the packet number in question from the
TX FIFO into the TX completion FIFO.

NETWORK INTERFACE

The LAN91C94 includes both an AUI interface
for thick and thin coax applications and a
10BASE-T interface for twisted pair applications.
Functions common to both are:

Manchester encoder/decoder to convert
NRZ data to Manchester encoded data and
back.

A 32 ms jabber timer to prevent
inadvertently long transmissions. When
'jabbing' occurs, the transmitter is disabled,
automatic loopback is disabled (in 10BASE-
T mode), and a collision indication is given
to the controller. The interface 'unjabs'
when the transmitter has been idle for a
minimum of 256 ms.

A phase-lock loop to recover data and clock
from the Manchester data stream with up to
plus or minus 18ns of jitter.

Diagnostic loopback capability.

LED drivers for collision, transmission,
reception, and jabber.

10BASE-T

The 10BASE-T interface conforms to the twisted
pair MAU addendum to the 802.3 specification.
On the transmission side, it converts the NRZ
data from the controller to Manchester data and
provides the appropriate signal level for driving
the media. Signal are predistorted before
transmission to minimize ISI. The collision
detection circuitry monitors the simultaneous
occurrence of received signals and transmitted
data on the media. During transmission,

data is automatically looped back to the receiver
except during collision periods, in which case
the input to the receiver is network data. During
collisions, should the receive input go idle prior
to the transmitter going idle, input to the receiver
switches back to the transmitter within 9 bit
times. Following transmission, the transmitter
performs a SQE test. This test exercises the
collision detection circuitry within the 10BASE-T
interface.

The receiver monitors the media at all times. It
recovers the clock and data and passes it along
to the controller. In the absence of any receive
activity, the transmitter is looped back to the
receiver. In addition, the receiver performs
automatic polarity correction. The 10BASE-T
interface performs link integrity tests per section
14.2.1.7 of 802.3, using the following values:

1. Link_loss_timer: 64 ms
2. Link_test_min_timer: 4 ms
3. Link_count: 2
4. Link_test_max_timer: 64 ms

The state of the link is reflected in the EPHSR.

AUI

The LAN91C94 also provides a standard 6 wire
AUI interface to a coax transceiver.

PHYSICAL INTERFACE

The internal physical interface (PHY) consists of
an encoder/decoder (ENDEC) and an internal
10BASE-T transceiver. The ENDEC also
provides a standard 6-pin AUI interface to an
external coax transceiver for 10BASE-T and
10BASE-5 applications. The signals between
MAC and the PHY can be routed to pins by
asserting the nXENDEC pin low. This
feature allows the interface to an external
ENDEC and transceiver. The PHY functions
can be divided into transmit and receive
functions.

Transmit Functions

Manchester Encoding

The PHY encodes the transmit data received
from the MAC. The encoded data is directed
internally to the selected output driver for
transmission over the twisted-pair network or
the AUI cable. Data transmission and encoding
is initiated by the Transmit Enable input, TXE,
going low.

Transmit Drivers

The encoded transmit data passes through to
the transmit driver pair, TPETXP(N), and its
complement, TPETXDP(N). Each output of the
transmit driver pair has a source resistance of
10 ohms maximum and a current rating of 25
mA maximum. The degree of predistortion is
determined by the termination resistors; the
equivalent resistance should be 100 ohms.

Jabber Function

This integrated function prevents the DTE from
locking into a continuous transmit state. In
10BASE-T mode, if transmission continues
beyond the specified time limit, the jabber
function inhibits further transmission and
asserts the collision indicator nCOLL. The limits
for jabber transmission are 20 to 15 ms in
10BASE-T mode. In the AUI mode, the jabber
function is performed by the external
transceiver.

SQE Function

In the 10BASE-T mode, the PHY supports the
signal quality error (SQE) function. At the end
of a transmission, the PHY asserts the nCOLL
signal for 10+/-5 bit times beginning 0.6 to
1.6ms after the last positive transition of a
transmitted frame. In the AUI mode, the SQE
function is performed by the external
transceiver.

Receive Functions

Receive Drivers

Differential signals received off the twisted-pair
network or AUI cable are directed to the internal
clock recovery circuit prior to being decoded for
the MAC.

Manchester Decoder and Clock Recovery

The PHY performs timing recovery and
Manchester decoding of incoming differential
signals in 10BASE-T or AUI modes, with its
built-in phase-lock loop (PLL). The decoded
(NRZ) data, RXD, and the recovered clock,
RXCLK, becomes available to the MAC,
typically within 9 bit times (5 for AUI) after the
assertion of nCRS. The receive clock, RXCLK,
is phase-locked to the transmit clock in the
absence of a received signal (idle).

Squelch Function

The integrated smart squelch circuit employs a
combination of amplitude and timing
measurements to determine the validity of data
received off the network. It prevents noise at the
differential inputs from falsely triggering the
decoder in the absence of valid data or link test
pulses. Signal levels below 300mV (180mV for
AUI) or pulse widths less than 15ns at the
differential inputs are rejected. Signals above
585mV (300mV for AUI) and pulse widths
greater than 30ns will be accepted. When using
the extended cable mode with 10BASE-T media
which extends beyond the standard limit of 100
meters, the squelch level can optionally be set
to reject signals below 180mV and accept
signals above 300mV. If the input signal
exceeds the squelch requirements, the carrier
sense output, nCRS, is asserted.

Reverse Polarity Function

In the 10BASE-T mode, the PHY monitors for
receiver polarity reversal due to crossed wires
and corrects by reversing the signal internally.
Collision Detection Function

In the 10BASE-T mode, a collision state is
indicated when there are simultaneous
transmissions and receptions on the twisted pair
link. During a collision state, the nCOLL signal
is asserted. If the received data ends and the
transmit control signal is still active, the transmit
data is sent to the MAC within 9 bit times. The
nCOLL signal is de-asserted within 9 bit times
after the collision terminates. In

the AUI mode, the external transceiver sends a
10MHz signal to the PHY upon detection of a
collision.

Link Integrity

The PHY test for a faulty twisted-pair link. In the
absence of transmit data, link test pulses are
transmitted every 16+/-18ms after the end of the
last transmission or link pulse on the twisted
pair medium. If neither valid data nor link test
pulses are received within 10 to 150ms, the link
is declared bad and both data transmission as
well as the operational loopback function are
disabled. The Link Integrity function can be
disabled for pre-10BASE-T twisted-pair
networks.

BOARD SETUP INFORMATION

The following parameters are obtained from the
EEPROM as board setup information:

ETHERNET INDIVIDUAL ADDRESS
I/O BASE ADDRESS
ROM BASE ADDRESS
8/16 BIT ADAPTER
10BASE-T or AUI INTERFACE
INTERRUPT LINE SELECTION

All the above mentioned values are read from
the EEPROM upon hardware reset. Except for
the INDIVIDUAL ADDRESS, the value of the
IOS switches determines the offset within the
EEPROM for these parameters, in such a way
that many identical boards can be plugged into
the same system by just changing the IOS
jumpers.

In order to support a software utility based
installation, even if the EEPROM was never
programmed, the EEPROM can be written using
the LAN91C94. One of the IOS combination is
associated with a fixed default value for the key
parameters (I/O BASE, ROM BASE,
INTERRUPT) that can always be used
regardless of the EEPROM based value being
programmed. This value will be used if all IOS
pins are left open or pulled high.

The EEPROM is arranged as a 64 x 16 array.
The specific target device is the 9346 1024-bit
Serial EEPROM. All EEPROM accesses are
done in words. All EEPROM addresses shown
are specified as word addresses.

INDIVIDUAL ADDRESS

20-22 hex

If IOS2-0 = 7 , only the INDIVIDUAL ADDRESS
is read from the EEPROM. Currently assigned
values are assumed for the other registers.
These values are default if the EEPROM read
operation follows hardware reset.

The EEPROM SELECT bit is used to determine
the type of EEPROM operation: a) normal or b)
general purpose register.

NORMAL EEPROM OPERATION -
EEPROM SELECT bit = 0

On EEPROM read operations (after reset or
after setting RELOAD high) the
CONFIGURATION REGISTER and BASE
REGISTER are updated with the EEPROM
values at locations defined by the IOS2-0 pins.
The INDIVIDUAL ADDRESS registers are
updated with the values stored in the
INDIVIDUAL ADDRESS area of the EEPROM.

REGISTER

EEPROM WORD

ADDRESS

Configuration
Register

Base Register

IOS Value * 4

(IOS Value *4) + 1

On EEPROM write operations (after setting the
STORE bit) the values of the CONFIGURATION
REGISTER and BASE REGISTER are written in
the EEPROM locations defined by the IOS2-0
pins.

The three least significant bits of the CONTROL
REGISTER (EEPROM SELECT, RELOAD and
STORE) are used to control the EEPROM. Their
values are not stored nor loaded from the
EEPROM.

GENERAL PURPOSE REGISTER -
EEPROM SELECT bit = 1

On EEPROM read operations (after setting
RELOAD high) the EEPROM word address
defined by the POINTER REGISTER 6 least
significant bits is read into the GENERAL
PURPOSE REGISTER.

On EEPROM write operations (after setting the
STORE bit) the value of the GENERAL
PURPOSE REGISTER is written at the
EEPROM word address defined by the
POINTER REGISTER 6 least significant bits.

RELOAD and STORE are set by the user to
initiate read and write operations respectively.
Polling the value until read low is used to
determine completion. When an EEPROM
access is in progress the STORE and RELOAD
bits of CTR will readback as both bits high. No
other bits of the LAN91C94 can be read or
written until the EEPROM operation completes
and both bits are clear. This mechanism is also
valid for reset initiated reloads. Note: If no
EEPROM is connected to the LAN91C94, for
example for some embedded applications, the
ENEEP pin should be grounded and no
accesses to the EEPROM will be attempted.
Configuration, Base, and Individual Address
assume their default values upon hardware
reset and the CPU is responsible for
programming them for their final value.

DIAGNOSTIC LEDs

The following LED drive signals are available for
diagnostic and installation aid purposes:

nTXLED - Activated by transmit activity.

nBSELED - Board select LED. Activated when
the board space is accessed, namely on
accesses to the LAN91C94 register space or the
ROM area decoded by the LAN91C94. The
signal is stretched to 125 msec.

nRXLED - Activated by receive activity.

nLINKLED - Reflects the link integrity status.

ARBITRATION CONSIDERATIONS

The arbiter exploits the sequential nature of the
CPU accesses to provide a very fast access
time. Memory bandwidth considerations will
have an effect on the CPU cycle time but no
effect on access time.

For normal 8 MHz, 10 MHz and 12.5 MHz ISA
buses as well as EISA normal cycles the
LAN91C94 can be accessed without negating
ready.

When write operations occur, the data is written
into a FIFO. The CPU cycle can complete
immediately, and the buffered data will be
written into memory later. The memory
arbitration request is generated as a function of
that FIFO being not empty. The nature of the
cycle requested (byte/word) is determined by the
lsb of the pointer and the number of bytes in the
FIFO.

When read operations occur, words are pre-
fetched upon pointer loading in order to have at
least a word ready in the FIFO to be read. New
pre-fetch cycles are requested as a function of
the number of bytes in the FIFO.

For example, if an odd pointer value is loaded,
first a byte is pre-fetched into the FIFO, and
immediately a full word is pre-fetched
completing three bytes into the FIFO. If the CPU
reads a word, one byte will be left again a new
word is pre-fetched.

In the case of write, if an odd pointer value is
loaded, and a full word is written, the FIFO
holds two bytes, the first of which is immediately
written into an odd memory location. If by that
time another byte or word

was written, there will be two or three bytes in
the FIFO and a full word can be written into the
now even memory address.

When a CSMA/CD cycle begins, the arbiter will
route the CSMA/CD DMA addresses to the MMU
as well as the packet number associated with
the operation in progress. In full-duplex mode,
receive and transmit requests are alternated in
such a way that the CPU arbitration cycle time
is not affected.

OPERATIONAL DESCRIPTION

MAXIMUM GUARANTEED RATINGS*

Operating Temperature Range .......................................................................................... 0°C to 70°C
Storage Temperature Range ...................................................................................... -55°C to +150°C
Lead Temperature Range (soldering, 10 seconds) ................................................................... +325°C
Positive Voltage on any pin, with respect to Ground ............................................................V

+ 0.3V

Negative Voltage on any pin, with respect to Ground ................................................................... -0.3V
Maximum V

............................................................................................................................... +7V

*Stresses above those listed above could cause permanent damage to the device. This is a stress
rating only and functional operation of the device at any other condition above those indicated in the
operation sections of this specification is not implied.

Note: When powering this device from laboratory or system power supplies, it is important that the
Absolute Maximum Ratings not be exceeded or device failure can result. Some power supplies exhibit
voltage spikes on their outputs when the AC power is switched on or off. In addition, voltage
transients on the AC power line may appear on the DC output. If this possibility exists, it is suggested
that a clamp circuit be used.

DC ELECTRICAL CHARACTERISTICS (T

= 0°C to 70°C, V

= +5.0 V ± 10%)

PARAMETER

SYMBOL

MIN

TYP

MAX

UNITS

COMMENTS

I Type Input Buffer

Low Input Level

High Input Level

ILI

IHI

2.0

0.8

TTL Levels

IS Type Input Buffer

Low Input Level

High Input Level

Schmitt Trigger Hysteresis

ILIS

IHIS

HYS

2.2

250

0.8

Schmitt Trigger

CLK

Input Buffer

Low Input Level

High Input Level

ILCK

IHCK

3.0

0.4

PARAMETER

SYMBOL

MIN

TYP

MAX

UNITS

COMMENTS

Input Leakage
(All I and IS buffers except
pins with pullups/pulldowns)

Low Input Leakage

High Input Leakage

-10

+10

µA

= 0

= V

IP Type Buffers

Input Current

-150

-75

µA

= 0

ID Type Buffers

Input Current

+75

+150

µA

= V

I/O4 Type Buffer

Low Output Level

High Output Level

Output Leakage

2.4

-10

0.4

+10

µA

= 4 mA

= -2 mA

= 0 to V

I/O24 Type Buffer

Low Output Level

High Output Level

Output Leakage

2.4

-10

0.5

+10

µA

= 24 mA

= -12 mA

= 0 to V

O24 Type Buffer

Low Output Level

High Output Level

Output Leakage

2.4

-10

0.5

+10

µA

= 24 mA

= -12 mA

= 0 to V

O4 Type Buffer

Low Output Level

High Output Level

Output Leakage

2.4

-10

0.4

+10

µA

= 4 mA

= -2 mA

= 0 to V

PARAMETER

SYMBOL

MIN

TYP

MAX

UNITS

COMMENTS

OD16 Type Buffer

Low Output Level

Output Leakage

-10

0.5

+10

µA

= 16 mA

= 0 to V

OD162 Type Buffer

Low Output Level

High Output Level

Output Leakage

2.4

-10

0.5

+10

µA

= 16 mA

= -2 mA

= 0 to V

OD24 Type Buffer

Low Output Level

Output Leakage

-10

0.5

+10

µA

= 24 mA

= 0 to V

Supply Current Active

Supply Current Standby

CSBY

All outputs open.

CAPACITANCE T

= 25°C; fc = 1MHz; V

= 5V

LIMITS

PARAMETER

SYMBOL

MIN

TYP

MAX

UNIT

TEST CONDITION

Clock Input Capacitance

Input Capacitance

Output Capacitance

OUT

All pins except pin
under test tied to AC
ground

PARAMETER

MIN

TYP

MAX

UNITS

10BASE-T

Receiver Threshold Voltage

100

Receiver Squelch

300

400

585

Receiver Common Mode Range

Transmitter Output:

Voltage
Source Resistance

±2

±2.5

±3
10

ohms

Transmitter Output DC Offset

Transmitter Backswing Voltage to Idle

100

Differential Input Voltage

±0.585

±3

AUI

Receiver Threshold Voltage

Receiver Squelch

180

240

300

Receiver Common Mode Range

Transmitter Output Voltage (R=78

)

±0.45

±0.85

±1.2

Transmitter Backswing Voltage to Idle

100

Input Differential Voltage

±0.3

±1.2

Output Short Circuit (to V

or GND) Current

±150

Differential Idle Voltage (measured 8.0 µs after
last positive transition of data frame)

±40

CAPACITIVE LOAD ON OUTPUTS

nIOCS16, IOCHRDY

240 pF

INTR0-3

120 pF

All other outputs

45 pF

FIGURE 21 - ISA CONSECUTIVE READ CYCLES

VALID ADDRE SS

VALID DATA

OUT

VALID DATA

OUT

t15

t20

A0-15
AEN, nSB HE

nIOCS16

nIORD

D0-15

t3
t4

t5
t6

t15

t20

Address, nSB HE , AEN Setup to Control Acti ve
Address, nSBHE, AEN Hol d after Control
Inacti ve
nIORD Low to Valid Data
nIORD High to Data Fl oating
A 4-A15, AEN Low, B ALE High to nIOCS16
Low
Cycl e ti me*

Parameter

m in

typ

max

units

25
20

185

40
30
25

ns
ns

ns
ns
ns

B ALE T ied High

IOCHRDY not used - t20 has to be met

*Note: The cycle time is defined only for consecutive accesses to the Data Register. These values assume
that IOCHRDY is not used.

FIGURE 23 - ISA CONSECUTIVE WRITE CYCLES

VALID ADDRESS

t15

t20

A0-15
AEN, nSBHE

nIOCS16

nIOWR

D0-15

VALID DATA IN

VALID DATA

ns
ns

ns
ns
ns

t3
t4

t7
t8

t15

t20

Address, nSBHE, AEN Setup to Control Acti ve
Address, nSBHE, AEN Hol d after Control
Inacti ve
Data Setup to nIOWR Rising
Data Hold after nIOWR Rising
A4-A15, AEN Low, B ALE High to nIOCS16
Low
Cycle time*

Parameter

min

typ

max

uni ts

25
20

185

IOCHRDY not used - t20 has to be met

BALE T ied High

*Note: The cycle ti me i s defined onl y for consecuti ve accesses to the Data Register. These values assume
that IOCHRDY is not used.

103

FIGURE 28 8 BIT MODE REGISTER CYCLES

FIGURE 29 EXTERNAL ROM READ ACCESS

A0-15
(IS A)
AEN

nIORD

D0-7

nIOWR

VALID DATA OUT

VALID DATA IN

VALID ADDRE SS

t3
t5
t7
t8

Address, nS B HE , AEN Setup to Control Acti ve
nIORD Low to Valid Data
Data Setup to nIOWR Rising
Data Hold after nIOWR Rising

Parameter

m in

typ

max

uni ts

ns
ns
ns
ns

VALID ADDRE SS

A0-19

nMEMRD

ADDRESS VALID

D0-15

t3
t4

t16
t17

Address Setup to Control Act ive
Address Hold after Control Inactive
nMEMRD Low to nROM Low
nMEM RD High to nROM High

Parameter

min

typ

max

units

25
20

0
0

25
30

ns
ns
ns
ns

BALE tied high

116

FIGURE 44 - 100 PIN QFP PACKAGE OUTLINE

0.10

-C -

TD/TE

D 1

D IM

A1
A2

D 1

e
0

TD(1 )
TE(1)
TD(2 )
TE(2)

MIN
2.80

0. 1

2.57
23. 4
19. 9
17. 4
13. 9

0. 1

0.65

1. 8

MAX

3.15
0.45
2.87

24.15

20. 1

18.15

14. 1

0. 2

0.95

2. 6

MIN
. 11 0
. 00 4
. 10 1
. 92 1
. 78 3
. 68 5
. 54 7
. 00 4
. 02 6
. 07 1

MAX

. 12 4
. 01 8
. 11 3
. 95 1
. 79 1
. 71 5
. 55 5
. 00 8
. 03 7
. 10 2

0°

. 2

21. 8
15. 8

22.21
16.27

12°

. 4

22. 2
16. 2

22.76
16.82

0.65 BSC

0°

. 00 8
. 85 8
. 62 2
. 87 4
. 64 1

12°

. 01 6
. 87 4
. 63 8
. 89 6
. 66 2

.0256 BSC

No te s:
1) Coplana rit y is 0 .10 0 mm (.004 ") maximum.
2) Toler ance on t he p os ition of the lead s is
0.200mm (.008") maximum.
3) Package b od y dimen sions D1 and E1 do not
inc lude the mold pr otrusion. Max imum mold
pro tr usion is 0.2 5mm (.010").
4) D imensions T D a nd TE are impor tant for t est ing
by robot ic h andler. O nly a bo ve combinations of (1)
or (2 ) ar e ac ceptable.
5) C on tr olling dimension: mil limeter. Dimensions
in i nches for reference only and not necessarily
acc urate .

Mi ll imete rs

Inches

117

FIGURE 45 - 100 PIN TQFP PACKAGE OUTLINE

Not es :
C oplanarity is 0.08mm or 3. 2 mils maximum.
Toleranc e on the po sition of the lea ds is 0.080mm max imum.
Package body dimensions D1 and E1 do not include the mold p rotrusion. Maximum mold prot ru sion is 0 .2 5mm.
Dimension for foot length L are measured at the g auge plane 0 .25mm abov e the s ea ting plane.
Details of pin 1 ide nt ifier are optional but must be locat ed wit hin the zone indic ated.
6. Controlling dimension: millimeter

E1/4

D1 /4

0. 10

-C-

SEE DETA IL "A"

DETAI L "A"

D IM

A1
A2

e
0

cc c

MIN

0. 05
0. 95

15. 90
13. 90
15. 90
13. 90

0. 09
0. 45

NOM

0. 10
1. 00

16. 00
14. 00
16. 00
14. 00

0. 60
1. 00

MA X

1. 20

. 15

1. 05

16. 10
14. 10
16. 10
14. 10

0. 20
0. 75

0°

0. 17

0. 22

0.50 B SC

7°

0. 27
0. 08

1
2
3
4
5

118

FIGURE 46 100 PIN VTQFP PACKAGE OUTLINE

E1/4

D1 /4

0. 10

-C-

S EE DETA IL "A"

DETAI L "A"

Not es :
C oplan arity is 0.0 8 mm or 3. 2 mils m aximum.
Tolera nc e on th e p o sition of th e lea ds is 0.0 80mm maximum.
Pac ka ge bod y dimen sions D1 a nd E1 do n ot inclu de the mold protru sio n. M a ximum mold pr otrusion is 0 .25mm.
Dimension for foot length L are mea su re d at the g au g e plane 0.25mm ab ov e t he s ea ting plane .
De tai ls of pin 1 ide nt ifier are optional bu t must be locat ed wit hin th e zo ne indic ate d .
6. Co n trolling dimen sion: millimeter

1
2
3
4
5

A1
A2

MIN

0. 05
0. 95

1 5. 90
1 3. 90
1 5. 90
1 3. 90

NOM

0. 10
1. 00

1 6. 00
1 4. 00
1 6. 00
1 4. 00

MA X

1. 20
0. 15
1. 05

1 6. 10
1 4. 10
1 6. 10
1 4. 10

e
0

cc c

NOM

0. 60
1. 00

0 .5 0 B SC

0. 22

MIN
0. 09
0. 45

0. 17

MA X

0. 20
0. 75

0. 27
0. 08

119

LAN91C94 ERRATA SHEET

PAGE

SECTION/FIGURE/ENTRY

CORRECTION

DATE

REVISED

Software Drivers and following text

Changed from "Software
Compatibility" See Italicized Text

4/17/96

General Description

See Italicized Text

4/17/96

Overview

See Italicized Text

4/17/96

Pin Number/TQFP

See Italicized Text

4/17/96

EPH_LOOP

*Refer to Note/See Italicized Text

4/17/96

116

100 Pin TQFP/Refer to Table

See Italicized Text

4/17/96

"ETEN" bit

Last two sentences above "Note"
have been removed

10/31/96

MAXIMUM GUARANTEED
RATINGS/Operating Temperature
Range

See Italicized Text

6/9/97

DC ELECTRICAL
CHARACTERISTICS

See Italicized Text

6/9/97

118

Figure 46 100 Pin VTQFP Package
Outline

Added to Data Sheet

9/26/97

*Note: After exiting the loopback test, SRESET in Card Option Register or SOFT_RST in RCR must
be set before returning to normal operation.

1997 STANDARD MICROSYSTEMS

CORP.

Circuit diagrams utilizing SMSC products are included as a means of illustrating
typical applications; consequently complete information sufficient for construction
purposes is not necessarily given. The information has been carefully checked and
is believed to be entirely reliable. However, no responsibility is assumed for
inaccuracies. Furthermore, such information does not convey to the purchaser of the
semiconductor devices described any licenses under the patent rights of SMSC or
others. SMSC reserves the right to make changes at any time in order to improve
design and supply the best product possible. SMSC products are not designed,
intended, authorized or warranted for use in any life support or other application
where product failure could cause or contribute to personal injury or severe property
damage. Any and all such uses without prior written approval of an Officer of SMSC
and further testing and/or modification will be fully at the risk of the customer.

LAN91C94 Rev. 9/26/97

Ð­Ð»ÐµÐºÑ‚Ñ€Ð¾Ð½Ð½Ñ‹Ð¹ ÐºÐ¾Ð¼Ð¿Ð¾Ð½ÐµÐ½Ñ‚: LAN91C94

ÐÐ»ÐµÐºÑ‚Ñ€Ð¾Ð½Ð½Ñ‹Ð¹ ÐºÐ¾Ð¼Ð¿Ð¾Ð½ÐµÐ½Ñ‚: LAN91C94