xref: /titanic_44/usr/src/uts/common/io/bge/bge_chip2.c (revision 28167c24ba5be8b7c1d05e02d053f4a55cd21cc9)
1 /*
2  * CDDL HEADER START
3  *
4  * The contents of this file are subject to the terms of the
5  * Common Development and Distribution License (the "License").
6  * You may not use this file except in compliance with the License.
7  *
8  * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
9  * or http://www.opensolaris.org/os/licensing.
10  * See the License for the specific language governing permissions
11  * and limitations under the License.
12  *
13  * When distributing Covered Code, include this CDDL HEADER in each
14  * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
15  * If applicable, add the following below this CDDL HEADER, with the
16  * fields enclosed by brackets "[]" replaced with your own identifying
17  * information: Portions Copyright [yyyy] [name of copyright owner]
18  *
19  * CDDL HEADER END
20  */
21 
22 /*
23  * Copyright 2006 Sun Microsystems, Inc.  All rights reserved.
24  * Use is subject to license terms.
25  */
26 
27 #pragma ident	"%Z%%M%	%I%	%E% SMI"
28 
29 #include "sys/bge_impl2.h"
30 
31 #define	PIO_ADDR(bgep, offset)	((void *)((caddr_t)(bgep)->io_regs+(offset)))
32 
33 /*
34  * Future features ... ?
35  */
36 #define	BGE_CFG_IO8	0	/* 8/16-bit cfg space BIS/BIC	*/
37 #define	BGE_NIC_IO32	0	/* NIC memory 32-bit accesses	*/
38 #define	BGE_IND_IO32	0	/* indirect access code		*/
39 #define	BGE_SEE_IO32	1	/* SEEPROM access code		*/
40 #define	BGE_FLASH_IO32	1	/* FLASH access code		*/
41 
42 /*
43  * BGE MSI tunable:
44  *
45  * By default MSI is enabled on all supported platforms but it is disabled
46  * for some Broadcom chips due to known MSI hardware issues. Currently MSI
47  * is enabled only for 5714C A2 and 5715C A2 broadcom chips.
48  */
49 #if defined(__sparc)
50 boolean_t bge_enable_msi = B_TRUE;
51 #else
52 boolean_t bge_enable_msi = B_FALSE;
53 #endif
54 
55 /*
56  * Property names
57  */
58 static char knownids_propname[] = "bge-known-subsystems";
59 
60 /*
61  * Patchable globals:
62  *
63  *	bge_autorecover
64  *		Enables/disables automatic recovery after fault detection
65  *
66  *	bge_mlcr_default
67  *		Value to program into the MLCR; controls the chip's GPIO pins
68  *
69  *	bge_dma_{rd,wr}prio
70  *		Relative priorities of DMA reads & DMA writes respectively.
71  *		These may each be patched to any value 0-3.  Equal values
72  *		will give "fair" (round-robin) arbitration for PCI access.
73  *		Unequal values will give one or the other function priority.
74  *
75  *	bge_dma_rwctrl
76  *		Value to put in the Read/Write DMA control register.  See
77  *	        the Broadcom PRM for things you can fiddle with in this
78  *		register ...
79  *
80  *	bge_{tx,rx}_{count,ticks}_{norm,intr}
81  *		Send/receive interrupt coalescing parameters.  Counts are
82  *		#s of descriptors, ticks are in microseconds.  *norm* values
83  *		apply between status updates/interrupts; the *intr* values
84  *		refer to the 'during-interrupt' versions - see the PRM.
85  *
86  *		NOTE: these values have been determined by measurement. They
87  *		differ significantly from the values recommended in the PRM.
88  */
89 static uint32_t bge_autorecover = 1;
90 static uint32_t bge_mlcr_default = MLCR_DEFAULT;
91 static uint32_t bge_mlcr_default_5714 = MLCR_DEFAULT_5714;
92 
93 static uint32_t bge_dma_rdprio = 1;
94 static uint32_t bge_dma_wrprio = 0;
95 static uint32_t bge_dma_rwctrl = PDRWCR_VAR_DEFAULT;
96 static uint32_t bge_dma_rwctrl_5721 = PDRWCR_VAR_5721;
97 static uint32_t bge_dma_rwctrl_5714 = PDRWCR_VAR_5714;
98 static uint32_t bge_dma_rwctrl_5715 = PDRWCR_VAR_5715;
99 
100 uint32_t bge_rx_ticks_norm = 128;
101 uint32_t bge_tx_ticks_norm = 2048;		/* 8 for FJ2+ !?!?	*/
102 uint32_t bge_rx_count_norm = 8;
103 uint32_t bge_tx_count_norm = 128;
104 
105 static uint32_t bge_rx_ticks_intr = 128;
106 static uint32_t bge_tx_ticks_intr = 0;		/* 8 for FJ2+ !?!?	*/
107 static uint32_t bge_rx_count_intr = 2;
108 static uint32_t bge_tx_count_intr = 0;
109 
110 /*
111  * Memory pool configuration parameters.
112  *
113  * These are generally specific to each member of the chip family, since
114  * each one may have a different memory size/configuration.
115  *
116  * Setting the mbuf pool length for a specific type of chip to 0 inhibits
117  * the driver from programming the various registers; instead they are left
118  * at their hardware defaults.  This is the preferred option for later chips
119  * (5705+), whereas the older chips *required* these registers to be set,
120  * since the h/w default was 0 ;-(
121  */
122 static uint32_t bge_mbuf_pool_base	= MBUF_POOL_BASE_DEFAULT;
123 static uint32_t bge_mbuf_pool_base_5704	= MBUF_POOL_BASE_5704;
124 static uint32_t bge_mbuf_pool_base_5705	= MBUF_POOL_BASE_5705;
125 static uint32_t bge_mbuf_pool_base_5721 = MBUF_POOL_BASE_5721;
126 static uint32_t bge_mbuf_pool_len	= MBUF_POOL_LENGTH_DEFAULT;
127 static uint32_t bge_mbuf_pool_len_5704	= MBUF_POOL_LENGTH_5704;
128 static uint32_t bge_mbuf_pool_len_5705	= 0;	/* use h/w default	*/
129 static uint32_t bge_mbuf_pool_len_5721	= 0;
130 
131 /*
132  * Various high and low water marks, thresholds, etc ...
133  *
134  * Note: these are taken from revision 7 of the PRM, and some are different
135  * from both the values in earlier PRMs *and* those determined experimentally
136  * and used in earlier versions of this driver ...
137  */
138 static uint32_t bge_mbuf_hi_water	= MBUF_HIWAT_DEFAULT;
139 static uint32_t bge_mbuf_lo_water_rmac	= MAC_RX_MBUF_LOWAT_DEFAULT;
140 static uint32_t bge_mbuf_lo_water_rdma	= RDMA_MBUF_LOWAT_DEFAULT;
141 
142 static uint32_t bge_dmad_lo_water	= DMAD_POOL_LOWAT_DEFAULT;
143 static uint32_t bge_dmad_hi_water	= DMAD_POOL_HIWAT_DEFAULT;
144 static uint32_t bge_lowat_recv_frames	= LOWAT_MAX_RECV_FRAMES_DEFAULT;
145 
146 static uint32_t bge_replenish_std	= STD_RCV_BD_REPLENISH_DEFAULT;
147 static uint32_t bge_replenish_mini	= MINI_RCV_BD_REPLENISH_DEFAULT;
148 static uint32_t bge_replenish_jumbo	= JUMBO_RCV_BD_REPLENISH_DEFAULT;
149 
150 static uint32_t	bge_watchdog_count	= 1 << 16;
151 static uint16_t bge_dma_miss_limit	= 20;
152 
153 static uint32_t bge_stop_start_on_sync	= 0;
154 
155 boolean_t bge_jumbo_enable		= B_TRUE;
156 static uint32_t bge_default_jumbo_size	= BGE_JUMBO_BUFF_SIZE;
157 
158 /*
159  * ========== Low-level chip & ring buffer manipulation ==========
160  */
161 
162 #define	BGE_DBG		BGE_DBG_REGS	/* debug flag for this code	*/
163 
164 
165 /*
166  * Config space read-modify-write routines
167  */
168 
169 #if	BGE_CFG_IO8
170 
171 /*
172  * 8- and 16-bit set/clr operations are not used; all the config registers
173  * that we need to do bit-twiddling on are 32 bits wide.  I'll leave the
174  * code here, though, in case we ever find that we do want it after all ...
175  */
176 
177 static void bge_cfg_set8(bge_t *bgep, bge_regno_t regno, uint8_t bits);
178 #pragma	inline(bge_cfg_set8)
179 
180 static void
181 bge_cfg_set8(bge_t *bgep, bge_regno_t regno, uint8_t bits)
182 {
183 	uint8_t regval;
184 
185 	BGE_TRACE(("bge_cfg_set8($%p, 0x%lx, 0x%x)",
186 		(void *)bgep, regno, bits));
187 
188 	regval = pci_config_get8(bgep->cfg_handle, regno);
189 
190 	BGE_DEBUG(("bge_cfg_set8($%p, 0x%lx, 0x%x): 0x%x => 0x%x",
191 		(void *)bgep, regno, bits, regval, regval | bits));
192 
193 	regval |= bits;
194 	pci_config_put8(bgep->cfg_handle, regno, regval);
195 }
196 
197 static void bge_cfg_clr8(bge_t *bgep, bge_regno_t regno, uint8_t bits);
198 #pragma	inline(bge_cfg_clr8)
199 
200 static void
201 bge_cfg_clr8(bge_t *bgep, bge_regno_t regno, uint8_t bits)
202 {
203 	uint8_t regval;
204 
205 	BGE_TRACE(("bge_cfg_clr8($%p, 0x%lx, 0x%x)",
206 		(void *)bgep, regno, bits));
207 
208 	regval = pci_config_get8(bgep->cfg_handle, regno);
209 
210 	BGE_DEBUG(("bge_cfg_clr8($%p, 0x%lx, 0x%x): 0x%x => 0x%x",
211 		(void *)bgep, regno, bits, regval, regval & ~bits));
212 
213 	regval &= ~bits;
214 	pci_config_put8(bgep->cfg_handle, regno, regval);
215 }
216 
217 static void bge_cfg_set16(bge_t *bgep, bge_regno_t regno, uint16_t bits);
218 #pragma	inline(bge_cfg_set16)
219 
220 static void
221 bge_cfg_set16(bge_t *bgep, bge_regno_t regno, uint16_t bits)
222 {
223 	uint16_t regval;
224 
225 	BGE_TRACE(("bge_cfg_set16($%p, 0x%lx, 0x%x)",
226 		(void *)bgep, regno, bits));
227 
228 	regval = pci_config_get16(bgep->cfg_handle, regno);
229 
230 	BGE_DEBUG(("bge_cfg_set16($%p, 0x%lx, 0x%x): 0x%x => 0x%x",
231 		(void *)bgep, regno, bits, regval, regval | bits));
232 
233 	regval |= bits;
234 	pci_config_put16(bgep->cfg_handle, regno, regval);
235 }
236 
237 static void bge_cfg_clr16(bge_t *bgep, bge_regno_t regno, uint16_t bits);
238 #pragma	inline(bge_cfg_clr16)
239 
240 static void
241 bge_cfg_clr16(bge_t *bgep, bge_regno_t regno, uint16_t bits)
242 {
243 	uint16_t regval;
244 
245 	BGE_TRACE(("bge_cfg_clr16($%p, 0x%lx, 0x%x)",
246 		(void *)bgep, regno, bits));
247 
248 	regval = pci_config_get16(bgep->cfg_handle, regno);
249 
250 	BGE_DEBUG(("bge_cfg_clr16($%p, 0x%lx, 0x%x): 0x%x => 0x%x",
251 		(void *)bgep, regno, bits, regval, regval & ~bits));
252 
253 	regval &= ~bits;
254 	pci_config_put16(bgep->cfg_handle, regno, regval);
255 }
256 
257 #endif	/* BGE_CFG_IO8 */
258 
259 static void bge_cfg_set32(bge_t *bgep, bge_regno_t regno, uint32_t bits);
260 #pragma	inline(bge_cfg_set32)
261 
262 static void
263 bge_cfg_set32(bge_t *bgep, bge_regno_t regno, uint32_t bits)
264 {
265 	uint32_t regval;
266 
267 	BGE_TRACE(("bge_cfg_set32($%p, 0x%lx, 0x%x)",
268 		(void *)bgep, regno, bits));
269 
270 	regval = pci_config_get32(bgep->cfg_handle, regno);
271 
272 	BGE_DEBUG(("bge_cfg_set32($%p, 0x%lx, 0x%x): 0x%x => 0x%x",
273 		(void *)bgep, regno, bits, regval, regval | bits));
274 
275 	regval |= bits;
276 	pci_config_put32(bgep->cfg_handle, regno, regval);
277 }
278 
279 static void bge_cfg_clr32(bge_t *bgep, bge_regno_t regno, uint32_t bits);
280 #pragma	inline(bge_cfg_clr32)
281 
282 static void
283 bge_cfg_clr32(bge_t *bgep, bge_regno_t regno, uint32_t bits)
284 {
285 	uint32_t regval;
286 
287 	BGE_TRACE(("bge_cfg_clr32($%p, 0x%lx, 0x%x)",
288 		(void *)bgep, regno, bits));
289 
290 	regval = pci_config_get32(bgep->cfg_handle, regno);
291 
292 	BGE_DEBUG(("bge_cfg_clr32($%p, 0x%lx, 0x%x): 0x%x => 0x%x",
293 		(void *)bgep, regno, bits, regval, regval & ~bits));
294 
295 	regval &= ~bits;
296 	pci_config_put32(bgep->cfg_handle, regno, regval);
297 }
298 
299 #if	BGE_IND_IO32
300 
301 /*
302  * Indirect access to registers & RISC scratchpads, using config space
303  * accesses only.
304  *
305  * This isn't currently used, but someday we might want to use it for
306  * restoring the Subsystem Device/Vendor registers (which aren't directly
307  * writable in Config Space), or for downloading firmware into the RISCs
308  *
309  * In any case there are endian issues to be resolved before this code is
310  * enabled; the bizarre way that bytes get twisted by this chip AND by
311  * the PCI bridge in SPARC systems mean that we shouldn't enable it until
312  * it's been thoroughly tested for all access sizes on all supported
313  * architectures (SPARC *and* x86!).
314  */
315 static uint32_t bge_ind_get32(bge_t *bgep, bge_regno_t regno);
316 #pragma	inline(bge_ind_get32)
317 
318 static uint32_t
319 bge_ind_get32(bge_t *bgep, bge_regno_t regno)
320 {
321 	uint32_t val;
322 
323 	BGE_TRACE(("bge_ind_get32($%p, 0x%lx)", (void *)bgep, regno));
324 
325 	ASSERT(mutex_owned(bgep->genlock));
326 
327 	pci_config_put32(bgep->cfg_handle, PCI_CONF_BGE_RIAAR, regno);
328 	val = pci_config_get32(bgep->cfg_handle, PCI_CONF_BGE_RIADR);
329 
330 	BGE_DEBUG(("bge_ind_get32($%p, 0x%lx) => 0x%x",
331 		(void *)bgep, regno, val));
332 
333 	return (val);
334 }
335 
336 static void bge_ind_put32(bge_t *bgep, bge_regno_t regno, uint32_t val);
337 #pragma	inline(bge_ind_put32)
338 
339 static void
340 bge_ind_put32(bge_t *bgep, bge_regno_t regno, uint32_t val)
341 {
342 	BGE_TRACE(("bge_ind_put32($%p, 0x%lx, 0x%x)",
343 		(void *)bgep, regno, val));
344 
345 	ASSERT(mutex_owned(bgep->genlock));
346 
347 	pci_config_put32(bgep->cfg_handle, PCI_CONF_BGE_RIAAR, regno);
348 	pci_config_put32(bgep->cfg_handle, PCI_CONF_BGE_RIADR, val);
349 }
350 
351 #endif	/* BGE_IND_IO32 */
352 
353 #if	BGE_DEBUGGING
354 
355 static void bge_pci_check(bge_t *bgep);
356 #pragma	no_inline(bge_pci_check)
357 
358 static void
359 bge_pci_check(bge_t *bgep)
360 {
361 	uint16_t pcistatus;
362 
363 	pcistatus = pci_config_get16(bgep->cfg_handle, PCI_CONF_STAT);
364 	if ((pcistatus & (PCI_STAT_R_MAST_AB | PCI_STAT_R_TARG_AB)) != 0)
365 		BGE_DEBUG(("bge_pci_check($%p): PCI status 0x%x",
366 			(void *)bgep, pcistatus));
367 }
368 
369 #endif	/* BGE_DEBUGGING */
370 
371 /*
372  * Perform first-stage chip (re-)initialisation, using only config-space
373  * accesses:
374  *
375  * + Read the vendor/device/revision/subsystem/cache-line-size registers,
376  *   returning the data in the structure pointed to by <idp>.
377  * + Configure the target-mode endianness (swap) options.
378  * + Disable interrupts and enable Memory Space accesses.
379  * + Enable or disable Bus Mastering according to the <enable_dma> flag.
380  *
381  * This sequence is adapted from Broadcom document 570X-PG102-R,
382  * page 102, steps 1-3, 6-8 and 11-13.  The omitted parts of the sequence
383  * are 4 and 5 (Reset Core and wait) which are handled elsewhere.
384  *
385  * This function MUST be called before any non-config-space accesses
386  * are made; on this first call <enable_dma> is B_FALSE, and it
387  * effectively performs steps 3-1(!) of the initialisation sequence
388  * (the rest are not required but should be harmless).
389  *
390  * It MUST also be called also after a chip reset, as this disables
391  * Memory Space cycles!  In this case, <enable_dma> is B_TRUE, and
392  * it is effectively performing steps 6-8.
393  */
394 void bge_chip_cfg_init(bge_t *bgep, chip_id_t *cidp, boolean_t enable_dma);
395 #pragma	no_inline(bge_chip_cfg_init)
396 
397 void
398 bge_chip_cfg_init(bge_t *bgep, chip_id_t *cidp, boolean_t enable_dma)
399 {
400 	ddi_acc_handle_t handle;
401 	uint16_t command;
402 	uint32_t mhcr;
403 	uint16_t value16;
404 	int i;
405 
406 	BGE_TRACE(("bge_chip_cfg_init($%p, $%p, %d)",
407 		(void *)bgep, (void *)cidp, enable_dma));
408 
409 	/*
410 	 * Step 3: save PCI cache line size and subsystem vendor ID
411 	 *
412 	 * Read all the config-space registers that characterise the
413 	 * chip, specifically vendor/device/revision/subsystem vendor
414 	 * and subsystem device id.  We expect (but don't check) that
415 	 * (vendor == VENDOR_ID_BROADCOM) && (device == DEVICE_ID_5704)
416 	 *
417 	 * Also save all bus-transation related registers (cache-line
418 	 * size, bus-grant/latency parameters, etc).  Some of these are
419 	 * cleared by reset, so we'll have to restore them later.  This
420 	 * comes from the Broadcom document 570X-PG102-R ...
421 	 *
422 	 * Note: Broadcom document 570X-PG102-R seems to be in error
423 	 * here w.r.t. the offsets of the Subsystem Vendor ID and
424 	 * Subsystem (Device) ID registers, which are the opposite way
425 	 * round according to the PCI standard.  For good measure, we
426 	 * save/restore both anyway.
427 	 */
428 	handle = bgep->cfg_handle;
429 
430 	mhcr = pci_config_get32(handle, PCI_CONF_BGE_MHCR);
431 	cidp->asic_rev = mhcr & MHCR_CHIP_REV_MASK;
432 	cidp->businfo = pci_config_get32(handle, PCI_CONF_BGE_PCISTATE);
433 	cidp->command = pci_config_get16(handle, PCI_CONF_COMM);
434 
435 	cidp->vendor = pci_config_get16(handle, PCI_CONF_VENID);
436 	cidp->device = pci_config_get16(handle, PCI_CONF_DEVID);
437 	cidp->subven = pci_config_get16(handle, PCI_CONF_SUBVENID);
438 	cidp->subdev = pci_config_get16(handle, PCI_CONF_SUBSYSID);
439 	cidp->revision = pci_config_get8(handle, PCI_CONF_REVID);
440 	cidp->clsize = pci_config_get8(handle, PCI_CONF_CACHE_LINESZ);
441 	cidp->latency = pci_config_get8(handle, PCI_CONF_LATENCY_TIMER);
442 
443 	BGE_DEBUG(("bge_chip_cfg_init: %s bus is %s and %s; #INTA is %s",
444 		cidp->businfo & PCISTATE_BUS_IS_PCI ? "PCI" : "PCI-X",
445 		cidp->businfo & PCISTATE_BUS_IS_FAST ? "fast" : "slow",
446 		cidp->businfo & PCISTATE_BUS_IS_32_BIT ? "narrow" : "wide",
447 		cidp->businfo & PCISTATE_INTA_STATE ? "high" : "low"));
448 	BGE_DEBUG(("bge_chip_cfg_init: vendor 0x%x device 0x%x revision 0x%x",
449 		cidp->vendor, cidp->device, cidp->revision));
450 	BGE_DEBUG(("bge_chip_cfg_init: subven 0x%x subdev 0x%x asic_rev 0x%x",
451 		cidp->subven, cidp->subdev, cidp->asic_rev));
452 	BGE_DEBUG(("bge_chip_cfg_init: clsize %d latency %d command 0x%x",
453 		cidp->clsize, cidp->latency, cidp->command));
454 
455 	/*
456 	 * Step 2 (also step 6): disable and clear interrupts.
457 	 * Steps 11-13: configure PIO endianness options, and enable
458 	 * indirect register access.  We'll also select any other
459 	 * options controlled by the MHCR (eg tagged status, mask
460 	 * interrupt mode) at this stage ...
461 	 *
462 	 * Note: internally, the chip is 64-bit and BIG-endian, but
463 	 * since it talks to the host over a (LITTLE-endian) PCI bus,
464 	 * it normally swaps bytes around at the PCI interface.
465 	 * However, the PCI host bridge on SPARC systems normally
466 	 * swaps the byte lanes around too, since SPARCs are also
467 	 * BIG-endian.  So it turns out that on SPARC, the right
468 	 * option is to tell the chip to swap (and the host bridge
469 	 * will swap back again), whereas on x86 we ask the chip
470 	 * NOT to swap, so the natural little-endianness of the
471 	 * PCI bus is assumed.  Then the only thing that doesn't
472 	 * automatically work right is access to an 8-byte register
473 	 * by a little-endian host; but we don't want to set the
474 	 * MHCR_ENABLE_REGISTER_WORD_SWAP bit because then 4-byte
475 	 * accesses don't go where expected ;-(  So we live with
476 	 * that, and perform word-swaps in software in the few cases
477 	 * where a chip register is defined as an 8-byte value --
478 	 * see the code below for details ...
479 	 *
480 	 * Note: the meaning of the 'MASK_INTERRUPT_MODE' bit isn't
481 	 * very clear in the register description in the PRM, but
482 	 * Broadcom document 570X-PG104-R page 248 explains a little
483 	 * more (under "Broadcom Mask Mode").  The bit changes the way
484 	 * the MASK_PCI_INT_OUTPUT bit works: with MASK_INTERRUPT_MODE
485 	 * clear, the chip interprets MASK_PCI_INT_OUTPUT in the same
486 	 * way as the 5700 did, which isn't very convenient.  Setting
487 	 * the MASK_INTERRUPT_MODE bit makes the MASK_PCI_INT_OUTPUT
488 	 * bit do just what its name says -- MASK the PCI #INTA output
489 	 * (i.e. deassert the signal at the pin) leaving all internal
490 	 * state unchanged.  This is much more convenient for our
491 	 * interrupt handler, so we set MASK_INTERRUPT_MODE here.
492 	 *
493 	 * Note: the inconvenient semantics of the interrupt mailbox
494 	 * (nonzero disables and acknowledges/clears the interrupt,
495 	 * zero enables AND CLEARS it) would make race conditions
496 	 * likely in the interrupt handler:
497 	 *
498 	 * (1)	acknowledge & disable interrupts
499 	 * (2)	while (more to do)
500 	 * 		process packets
501 	 * (3)	enable interrupts -- also clears pending
502 	 *
503 	 * If the chip received more packets and internally generated
504 	 * an interrupt between the check at (2) and the mbox write
505 	 * at (3), this interrupt would be lost :-(
506 	 *
507 	 * The best way to avoid this is to use TAGGED STATUS mode,
508 	 * where the chip includes a unique tag in each status block
509 	 * update, and the host, when re-enabling interrupts, passes
510 	 * the last tag it saw back to the chip; then the chip can
511 	 * see whether the host is truly up to date, and regenerate
512 	 * its interrupt if not.
513 	 */
514 	mhcr =	MHCR_ENABLE_INDIRECT_ACCESS |
515 		MHCR_ENABLE_TAGGED_STATUS_MODE |
516 		MHCR_MASK_INTERRUPT_MODE |
517 		MHCR_CLEAR_INTERRUPT_INTA;
518 
519 	if (bgep->intr_type == DDI_INTR_TYPE_FIXED)
520 		mhcr |= MHCR_MASK_PCI_INT_OUTPUT;
521 
522 #ifdef	_BIG_ENDIAN
523 	mhcr |= MHCR_ENABLE_ENDIAN_WORD_SWAP | MHCR_ENABLE_ENDIAN_BYTE_SWAP;
524 #endif	/* _BIG_ENDIAN */
525 
526 	pci_config_put32(handle, PCI_CONF_BGE_MHCR, mhcr);
527 
528 	/*
529 	 * Step 1 (also step 7): Enable PCI Memory Space accesses
530 	 *			 Disable Memory Write/Invalidate
531 	 *			 Enable or disable Bus Mastering
532 	 *
533 	 * Note that all other bits are taken from the original value saved
534 	 * the first time through here, rather than from the current register
535 	 * value, 'cos that will have been cleared by a soft RESET since.
536 	 * In this way we preserve the OBP/nexus-parent's preferred settings
537 	 * of the parity-error and system-error enable bits across multiple
538 	 * chip RESETs.
539 	 *
540 	 * Step 8: Disable PCI-X Relaxed Ordering -- doesn't apply
541 	 */
542 	command = bgep->chipid.command | PCI_COMM_MAE;
543 	command &= ~(PCI_COMM_ME|PCI_COMM_MEMWR_INVAL);
544 	if (enable_dma)
545 		command |= PCI_COMM_ME;
546 	/*
547 	 * on BCM5714 revision A0, false parity error gets generated
548 	 * due to a logic bug. Provide a workaround by disabling parrity
549 	 * error.
550 	 */
551 	if (((cidp->device == DEVICE_ID_5714C) ||
552 	    (cidp->device == DEVICE_ID_5714S)) &&
553 	    (cidp->revision == REVISION_ID_5714_A0)) {
554 		command &= ~PCI_COMM_PARITY_DETECT;
555 	}
556 	pci_config_put16(handle, PCI_CONF_COMM, command);
557 
558 	/*
559 	 * On some PCI-E device, there were instances when
560 	 * the device was still link training.
561 	 */
562 	if (bgep->chipid.pci_type == BGE_PCI_E) {
563 		i = 0;
564 		value16 = pci_config_get16(handle, PCI_CONF_COMM);
565 		while ((value16 != command) && (i < 100)) {
566 			drv_usecwait(200);
567 			value16 = pci_config_get16(handle, PCI_CONF_COMM);
568 			++i;
569 		}
570 	}
571 
572 	/*
573 	 * Clear any remaining error status bits
574 	 */
575 	pci_config_put16(handle, PCI_CONF_STAT, ~0);
576 
577 	/*
578 	 * Make sure these indirect-access registers are sane
579 	 * rather than random after power-up or reset
580 	 */
581 	pci_config_put32(handle, PCI_CONF_BGE_RIAAR, 0);
582 	pci_config_put32(handle, PCI_CONF_BGE_MWBAR, 0);
583 }
584 
585 #ifdef __amd64
586 /*
587  * Distinguish CPU types
588  *
589  * These use to  distinguish AMD64 or Intel EM64T of CPU running mode.
590  * If CPU runs on Intel EM64T mode,the 64bit operation cannot works fine
591  * for PCI-Express based network interface card. This is the work-around
592  * for those nics.
593  */
594 static boolean_t bge_get_em64t_type(void);
595 #pragma	inline(bge_get_em64t_type)
596 
597 static boolean_t
598 bge_get_em64t_type(void)
599 {
600 
601 	return (x86_vendor == X86_VENDOR_Intel);
602 }
603 #endif
604 
605 /*
606  * Operating register get/set access routines
607  */
608 
609 uint32_t bge_reg_get32(bge_t *bgep, bge_regno_t regno);
610 #pragma	inline(bge_reg_get32)
611 
612 uint32_t
613 bge_reg_get32(bge_t *bgep, bge_regno_t regno)
614 {
615 	BGE_TRACE(("bge_reg_get32($%p, 0x%lx)",
616 		(void *)bgep, regno));
617 
618 	return (ddi_get32(bgep->io_handle, PIO_ADDR(bgep, regno)));
619 }
620 
621 void bge_reg_put32(bge_t *bgep, bge_regno_t regno, uint32_t data);
622 #pragma	inline(bge_reg_put32)
623 
624 void
625 bge_reg_put32(bge_t *bgep, bge_regno_t regno, uint32_t data)
626 {
627 	BGE_TRACE(("bge_reg_put32($%p, 0x%lx, 0x%x)",
628 		(void *)bgep, regno, data));
629 
630 	ddi_put32(bgep->io_handle, PIO_ADDR(bgep, regno), data);
631 	BGE_PCICHK(bgep);
632 }
633 
634 void bge_reg_set32(bge_t *bgep, bge_regno_t regno, uint32_t bits);
635 #pragma	inline(bge_reg_set32)
636 
637 void
638 bge_reg_set32(bge_t *bgep, bge_regno_t regno, uint32_t bits)
639 {
640 	uint32_t regval;
641 
642 	BGE_TRACE(("bge_reg_set32($%p, 0x%lx, 0x%x)",
643 		(void *)bgep, regno, bits));
644 
645 	regval = bge_reg_get32(bgep, regno);
646 	regval |= bits;
647 	bge_reg_put32(bgep, regno, regval);
648 }
649 
650 void bge_reg_clr32(bge_t *bgep, bge_regno_t regno, uint32_t bits);
651 #pragma	inline(bge_reg_clr32)
652 
653 void
654 bge_reg_clr32(bge_t *bgep, bge_regno_t regno, uint32_t bits)
655 {
656 	uint32_t regval;
657 
658 	BGE_TRACE(("bge_reg_clr32($%p, 0x%lx, 0x%x)",
659 		(void *)bgep, regno, bits));
660 
661 	regval = bge_reg_get32(bgep, regno);
662 	regval &= ~bits;
663 	bge_reg_put32(bgep, regno, regval);
664 }
665 
666 static uint64_t bge_reg_get64(bge_t *bgep, bge_regno_t regno);
667 #pragma	inline(bge_reg_get64)
668 
669 static uint64_t
670 bge_reg_get64(bge_t *bgep, bge_regno_t regno)
671 {
672 	uint64_t regval;
673 
674 #ifdef	__amd64
675 	if (bge_get_em64t_type()) {
676 		regval = ddi_get32(bgep->io_handle, PIO_ADDR(bgep, regno + 4));
677 		regval <<= 32;
678 		regval |= ddi_get32(bgep->io_handle, PIO_ADDR(bgep, regno));
679 	} else {
680 		regval = ddi_get64(bgep->io_handle, PIO_ADDR(bgep, regno));
681 	}
682 #else
683 	regval = ddi_get64(bgep->io_handle, PIO_ADDR(bgep, regno));
684 #endif
685 
686 #ifdef	_LITTLE_ENDIAN
687 	regval = (regval >> 32) | (regval << 32);
688 #endif	/* _LITTLE_ENDIAN */
689 
690 	BGE_TRACE(("bge_reg_get64($%p, 0x%lx) = 0x%016llx",
691 		(void *)bgep, regno, regval));
692 
693 	return (regval);
694 }
695 
696 static void bge_reg_put64(bge_t *bgep, bge_regno_t regno, uint64_t data);
697 #pragma	inline(bge_reg_put64)
698 
699 static void
700 bge_reg_put64(bge_t *bgep, bge_regno_t regno, uint64_t data)
701 {
702 	BGE_TRACE(("bge_reg_put64($%p, 0x%lx, 0x%016llx)",
703 		(void *)bgep, regno, data));
704 
705 #ifdef	_LITTLE_ENDIAN
706 	data = ((data >> 32) | (data << 32));
707 #endif	/* _LITTLE_ENDIAN */
708 
709 #ifdef	__amd64
710 	if (bge_get_em64t_type()) {
711 		ddi_put32(bgep->io_handle,
712 			PIO_ADDR(bgep, regno), (uint32_t)data);
713 		BGE_PCICHK(bgep);
714 		ddi_put32(bgep->io_handle,
715 			PIO_ADDR(bgep, regno + 4), (uint32_t)(data >> 32));
716 
717 	} else {
718 		ddi_put64(bgep->io_handle, PIO_ADDR(bgep, regno), data);
719 	}
720 #else
721 	ddi_put64(bgep->io_handle, PIO_ADDR(bgep, regno), data);
722 #endif
723 
724 	BGE_PCICHK(bgep);
725 }
726 
727 /*
728  * The DDI doesn't provide get/put functions for 128 bit data
729  * so we put RCBs out as two 64-bit chunks instead.
730  */
731 static void bge_reg_putrcb(bge_t *bgep, bge_regno_t addr, bge_rcb_t *rcbp);
732 #pragma	inline(bge_reg_putrcb)
733 
734 static void
735 bge_reg_putrcb(bge_t *bgep, bge_regno_t addr, bge_rcb_t *rcbp)
736 {
737 	uint64_t *p;
738 
739 	BGE_TRACE(("bge_reg_putrcb($%p, 0x%lx, 0x%016llx:%04x:%04x:%08x)",
740 		(void *)bgep, addr, rcbp->host_ring_addr,
741 		rcbp->max_len, rcbp->flags, rcbp->nic_ring_addr));
742 
743 	ASSERT((addr % sizeof (*rcbp)) == 0);
744 
745 	p = (void *)rcbp;
746 	bge_reg_put64(bgep, addr, *p++);
747 	bge_reg_put64(bgep, addr+8, *p);
748 }
749 
750 void bge_mbx_put(bge_t *bgep, bge_regno_t regno, uint64_t data);
751 #pragma	inline(bge_mbx_put)
752 
753 void
754 bge_mbx_put(bge_t *bgep, bge_regno_t regno, uint64_t data)
755 {
756 	BGE_TRACE(("bge_mbx_put($%p, 0x%lx, 0x%016llx)",
757 		(void *)bgep, regno, data));
758 
759 	/*
760 	 * Mailbox registers are nominally 64 bits on the 5701, but
761 	 * the MSW isn't used.  On the 5703, they're only 32 bits
762 	 * anyway.  So here we just write the lower(!) 32 bits -
763 	 * remembering that the chip is big-endian, even though the
764 	 * PCI bus is little-endian ...
765 	 */
766 #ifdef	_BIG_ENDIAN
767 	ddi_put32(bgep->io_handle, PIO_ADDR(bgep, regno+4), (uint32_t)data);
768 #else
769 	ddi_put32(bgep->io_handle, PIO_ADDR(bgep, regno), (uint32_t)data);
770 #endif	/* _BIG_ENDIAN */
771 	BGE_PCICHK(bgep);
772 }
773 
774 #if	BGE_DEBUGGING
775 
776 void bge_led_mark(bge_t *bgep);
777 #pragma	no_inline(bge_led_mark)
778 
779 void
780 bge_led_mark(bge_t *bgep)
781 {
782 	uint32_t led_ctrl = LED_CONTROL_OVERRIDE_LINK |
783 			    LED_CONTROL_1000MBPS_LED |
784 			    LED_CONTROL_100MBPS_LED |
785 			    LED_CONTROL_10MBPS_LED;
786 
787 	/*
788 	 * Blink all three LINK LEDs on simultaneously, then all off,
789 	 * then restore to automatic hardware control.  This is used
790 	 * in laboratory testing to trigger a logic analyser or scope.
791 	 */
792 	bge_reg_set32(bgep, ETHERNET_MAC_LED_CONTROL_REG, led_ctrl);
793 	led_ctrl ^= LED_CONTROL_OVERRIDE_LINK;
794 	bge_reg_clr32(bgep, ETHERNET_MAC_LED_CONTROL_REG, led_ctrl);
795 	led_ctrl = LED_CONTROL_OVERRIDE_LINK;
796 	bge_reg_clr32(bgep, ETHERNET_MAC_LED_CONTROL_REG, led_ctrl);
797 }
798 
799 #endif	/* BGE_DEBUGGING */
800 
801 /*
802  * NIC on-chip memory access routines
803  *
804  * Only 32K of NIC memory is visible at a time, controlled by the
805  * Memory Window Base Address Register (in PCI config space).  Once
806  * this is set, the 32K region of NIC-local memory that it refers
807  * to can be directly addressed in the upper 32K of the 64K of PCI
808  * memory space used for the device.
809  */
810 
811 static void bge_nic_setwin(bge_t *bgep, bge_regno_t base);
812 #pragma	inline(bge_nic_setwin)
813 
814 static void
815 bge_nic_setwin(bge_t *bgep, bge_regno_t base)
816 {
817 	BGE_TRACE(("bge_nic_setwin($%p, 0x%lx)",
818 		(void *)bgep, base));
819 
820 	ASSERT((base & MWBAR_GRANULE_MASK) == 0);
821 	pci_config_put32(bgep->cfg_handle, PCI_CONF_BGE_MWBAR, base);
822 }
823 
824 #if	BGE_NIC_IO32
825 
826 static uint32_t bge_nic_get32(bge_t *bgep, bge_regno_t addr);
827 #pragma	inline(bge_nic_get32)
828 
829 static uint32_t
830 bge_nic_get32(bge_t *bgep, bge_regno_t addr)
831 {
832 	uint32_t data;
833 
834 	bge_nic_setwin(bgep, addr & ~MWBAR_GRANULE_MASK);
835 	addr &= MWBAR_GRANULE_MASK;
836 	addr += NIC_MEM_WINDOW_OFFSET;
837 
838 	data = ddi_get32(bgep->io_handle, PIO_ADDR(bgep, addr));
839 
840 	BGE_TRACE(("bge_nic_get32($%p, 0x%lx) = 0x%08x",
841 		(void *)bgep, addr, data));
842 
843 	return (data);
844 }
845 
846 static void bge_nic_put32(bge_t *bgep, bge_regno_t addr, uint32_t data);
847 #pragma	inline(bge_nic_put32)
848 
849 static void
850 bge_nic_put32(bge_t *bgep, bge_regno_t addr, uint32_t data)
851 {
852 	BGE_TRACE(("bge_nic_put32($%p, 0x%lx, 0x%08x)",
853 		(void *)bgep, addr, data));
854 
855 	bge_nic_setwin(bgep, addr & ~MWBAR_GRANULE_MASK);
856 	addr &= MWBAR_GRANULE_MASK;
857 	addr += NIC_MEM_WINDOW_OFFSET;
858 	ddi_put32(bgep->io_handle, PIO_ADDR(bgep, addr), data);
859 	BGE_PCICHK(bgep);
860 }
861 
862 #endif	/* BGE_NIC_IO32 */
863 
864 static uint64_t bge_nic_get64(bge_t *bgep, bge_regno_t addr);
865 #pragma	inline(bge_nic_get64)
866 
867 static uint64_t
868 bge_nic_get64(bge_t *bgep, bge_regno_t addr)
869 {
870 	uint64_t data;
871 
872 	bge_nic_setwin(bgep, addr & ~MWBAR_GRANULE_MASK);
873 	addr &= MWBAR_GRANULE_MASK;
874 	addr += NIC_MEM_WINDOW_OFFSET;
875 
876 #ifdef	__amd64
877 		if (bge_get_em64t_type()) {
878 			data = ddi_get32(bgep->io_handle, PIO_ADDR(bgep, addr));
879 			data <<= 32;
880 			data |= ddi_get32(bgep->io_handle,
881 				PIO_ADDR(bgep, addr + 4));
882 		} else {
883 			data = ddi_get64(bgep->io_handle, PIO_ADDR(bgep, addr));
884 		}
885 #else
886 		data = ddi_get64(bgep->io_handle, PIO_ADDR(bgep, addr));
887 #endif
888 
889 	BGE_TRACE(("bge_nic_get64($%p, 0x%lx) = 0x%016llx",
890 		(void *)bgep, addr, data));
891 
892 	return (data);
893 }
894 
895 static void bge_nic_put64(bge_t *bgep, bge_regno_t addr, uint64_t data);
896 #pragma	inline(bge_nic_put64)
897 
898 static void
899 bge_nic_put64(bge_t *bgep, bge_regno_t addr, uint64_t data)
900 {
901 	BGE_TRACE(("bge_nic_put64($%p, 0x%lx, 0x%016llx)",
902 		(void *)bgep, addr, data));
903 
904 	bge_nic_setwin(bgep, addr & ~MWBAR_GRANULE_MASK);
905 	addr &= MWBAR_GRANULE_MASK;
906 	addr += NIC_MEM_WINDOW_OFFSET;
907 
908 #ifdef	__amd64
909 	if (bge_get_em64t_type()) {
910 		ddi_put32(bgep->io_handle,
911 			PIO_ADDR(bgep, addr), (uint32_t)data);
912 		BGE_PCICHK(bgep);
913 		ddi_put32(bgep->io_handle,
914 			PIO_ADDR(bgep, addr + 4), (uint32_t)(data >> 32));
915 	} else {
916 		ddi_put64(bgep->io_handle, PIO_ADDR(bgep, addr), data);
917 	}
918 #else
919 	ddi_put64(bgep->io_handle, PIO_ADDR(bgep, addr), data);
920 #endif
921 
922 	BGE_PCICHK(bgep);
923 }
924 
925 /*
926  * The DDI doesn't provide get/put functions for 128 bit data
927  * so we put RCBs out as two 64-bit chunks instead.
928  */
929 static void bge_nic_putrcb(bge_t *bgep, bge_regno_t addr, bge_rcb_t *rcbp);
930 #pragma	inline(bge_nic_putrcb)
931 
932 static void
933 bge_nic_putrcb(bge_t *bgep, bge_regno_t addr, bge_rcb_t *rcbp)
934 {
935 	uint64_t *p;
936 
937 	BGE_TRACE(("bge_nic_putrcb($%p, 0x%lx, 0x%016llx:%04x:%04x:%08x)",
938 		(void *)bgep, addr, rcbp->host_ring_addr,
939 		rcbp->max_len, rcbp->flags, rcbp->nic_ring_addr));
940 
941 	ASSERT((addr % sizeof (*rcbp)) == 0);
942 
943 	bge_nic_setwin(bgep, addr & ~MWBAR_GRANULE_MASK);
944 	addr &= MWBAR_GRANULE_MASK;
945 	addr += NIC_MEM_WINDOW_OFFSET;
946 
947 	p = (void *)rcbp;
948 #ifdef	__amd64
949 	if (bge_get_em64t_type()) {
950 		ddi_put32(bgep->io_handle, PIO_ADDR(bgep, addr),
951 			(uint32_t)(*p));
952 		ddi_put32(bgep->io_handle, PIO_ADDR(bgep, addr + 4),
953 			(uint32_t)(*p >> 32));
954 		ddi_put32(bgep->io_handle, PIO_ADDR(bgep, addr + 8),
955 			(uint32_t)(*(p + 1)));
956 		ddi_put32(bgep->io_handle, PIO_ADDR(bgep, addr + 12),
957 			(uint32_t)(*p >> 32));
958 
959 	} else {
960 		ddi_put64(bgep->io_handle, PIO_ADDR(bgep, addr), *p++);
961 		ddi_put64(bgep->io_handle, PIO_ADDR(bgep, addr+8), *p);
962 	}
963 #else
964 	ddi_put64(bgep->io_handle, PIO_ADDR(bgep, addr), *p++);
965 	ddi_put64(bgep->io_handle, PIO_ADDR(bgep, addr + 8), *p);
966 #endif
967 
968 	BGE_PCICHK(bgep);
969 }
970 
971 static void bge_nic_zero(bge_t *bgep, bge_regno_t addr, uint32_t nbytes);
972 #pragma	inline(bge_nic_zero)
973 
974 static void
975 bge_nic_zero(bge_t *bgep, bge_regno_t addr, uint32_t nbytes)
976 {
977 	BGE_TRACE(("bge_nic_zero($%p, 0x%lx, 0x%x)",
978 		(void *)bgep, addr, nbytes));
979 
980 	ASSERT((addr & ~MWBAR_GRANULE_MASK) ==
981 		((addr+nbytes) & ~MWBAR_GRANULE_MASK));
982 
983 	bge_nic_setwin(bgep, addr & ~MWBAR_GRANULE_MASK);
984 	addr &= MWBAR_GRANULE_MASK;
985 	addr += NIC_MEM_WINDOW_OFFSET;
986 
987 	(void) ddi_device_zero(bgep->io_handle, PIO_ADDR(bgep, addr),
988 		nbytes, 1, DDI_DATA_SZ08_ACC);
989 	BGE_PCICHK(bgep);
990 }
991 
992 /*
993  * MII (PHY) register get/set access routines
994  *
995  * These use the chip's MII auto-access method, controlled by the
996  * MII Communication register at 0x044c, so the CPU doesn't have
997  * to fiddle with the individual bits.
998  */
999 
1000 #undef	BGE_DBG
1001 #define	BGE_DBG		BGE_DBG_MII	/* debug flag for this code	*/
1002 
1003 static uint16_t bge_mii_access(bge_t *bgep, bge_regno_t regno,
1004 				uint16_t data, uint32_t cmd);
1005 #pragma	no_inline(bge_mii_access)
1006 
1007 static uint16_t
1008 bge_mii_access(bge_t *bgep, bge_regno_t regno, uint16_t data, uint32_t cmd)
1009 {
1010 	uint32_t timeout;
1011 	uint32_t regval1;
1012 	uint32_t regval2;
1013 
1014 	BGE_TRACE(("bge_mii_access($%p, 0x%lx, 0x%x, 0x%x)",
1015 		(void *)bgep, regno, data, cmd));
1016 
1017 	ASSERT(mutex_owned(bgep->genlock));
1018 
1019 	/*
1020 	 * Assemble the command ...
1021 	 */
1022 	cmd |= data << MI_COMMS_DATA_SHIFT;
1023 	cmd |= regno << MI_COMMS_REGISTER_SHIFT;
1024 	cmd |= bgep->phy_mii_addr << MI_COMMS_ADDRESS_SHIFT;
1025 	cmd |= MI_COMMS_START;
1026 
1027 	/*
1028 	 * Wait for any command already in progress ...
1029 	 *
1030 	 * Note: this *shouldn't* ever find that there is a command
1031 	 * in progress, because we already hold the <genlock> mutex.
1032 	 * Nonetheless, we have sometimes seen the MI_COMMS_START
1033 	 * bit set here -- it seems that the chip can initiate MII
1034 	 * accesses internally, even with polling OFF.
1035 	 */
1036 	regval1 = regval2 = bge_reg_get32(bgep, MI_COMMS_REG);
1037 	for (timeout = 1000; ; ) {
1038 		if ((regval2 & MI_COMMS_START) == 0) {
1039 			bge_reg_put32(bgep, MI_COMMS_REG, cmd);
1040 			break;
1041 		}
1042 		if (--timeout == 0)
1043 			break;
1044 		drv_usecwait(10);
1045 		regval2 = bge_reg_get32(bgep, MI_COMMS_REG);
1046 	}
1047 
1048 	if (timeout != 1000)
1049 		BGE_REPORT((bgep, "bge_mii_access: cmd 0x%x -- "
1050 			"MI_COMMS_START set for %d us; 0x%x->0x%x",
1051 			cmd, 10*(1000-timeout), regval1, regval2));
1052 
1053 	ASSERT(timeout != 0);
1054 	if (timeout == 0)
1055 		return ((uint16_t)~0u);
1056 
1057 	regval1 = bge_reg_get32(bgep, MI_COMMS_REG);
1058 	for (timeout = 1000; ; ) {
1059 		if ((regval1 & MI_COMMS_START) == 0)
1060 			break;
1061 		if (--timeout == 0)
1062 			break;
1063 		drv_usecwait(10);
1064 		regval1 = bge_reg_get32(bgep, MI_COMMS_REG);
1065 	}
1066 
1067 	/*
1068 	 * Drop out early if the READ FAILED bit is set -- this chip
1069 	 * could be a 5703/4S, with a SerDes instead of a PHY!
1070 	 */
1071 	if (regval2 & MI_COMMS_READ_FAILED)
1072 		return ((uint16_t)~0u);
1073 
1074 	ASSERT(timeout != 0);
1075 	if (timeout == 0)
1076 		return ((uint16_t)~0u);
1077 
1078 	/*
1079 	 * The PRM says to wait 5us after seeing the START bit clear
1080 	 * and then re-read the register to get the final value of the
1081 	 * data field, in order to avoid a race condition where the
1082 	 * START bit is clear but the data field isn't yet valid.
1083 	 *
1084 	 * Note: we don't actually seem to be encounter this race;
1085 	 * except when the START bit is seen set again (see below),
1086 	 * the data field doesn't change during this 5us interval.
1087 	 */
1088 	drv_usecwait(5);
1089 	regval2 = bge_reg_get32(bgep, MI_COMMS_REG);
1090 
1091 	/*
1092 	 * Unfortunately, when following the PRMs instructions above,
1093 	 * we have occasionally seen the START bit set again(!) in the
1094 	 * value read after the 5us delay. This seems to be due to the
1095 	 * chip autonomously starting another MII access internally.
1096 	 * In such cases, the command/data/etc fields relate to the
1097 	 * internal command, rather than the one that we thought had
1098 	 * just finished.  So in this case, we fall back to returning
1099 	 * the data from the original read that showed START clear.
1100 	 */
1101 	if (regval2 & MI_COMMS_START) {
1102 		BGE_REPORT((bgep, "bge_mii_access: cmd 0x%x -- "
1103 			"MI_COMMS_START set after transaction; 0x%x->0x%x",
1104 			cmd, regval1, regval2));
1105 		regval2 = regval1;
1106 	}
1107 
1108 	ASSERT((regval2 & MI_COMMS_START) == 0);
1109 	if (regval2 & MI_COMMS_START)
1110 		return ((uint16_t)~0u);
1111 
1112 	ASSERT((regval2 & MI_COMMS_READ_FAILED) == 0);
1113 	if (regval2 & MI_COMMS_READ_FAILED)
1114 		return ((uint16_t)~0u);
1115 
1116 	return ((regval2 & MI_COMMS_DATA_MASK) >> MI_COMMS_DATA_SHIFT);
1117 }
1118 
1119 uint16_t bge_mii_get16(bge_t *bgep, bge_regno_t regno);
1120 #pragma	no_inline(bge_mii_get16)
1121 
1122 uint16_t
1123 bge_mii_get16(bge_t *bgep, bge_regno_t regno)
1124 {
1125 	BGE_TRACE(("bge_mii_get16($%p, 0x%lx)",
1126 		(void *)bgep, regno));
1127 
1128 	ASSERT(mutex_owned(bgep->genlock));
1129 
1130 	return (bge_mii_access(bgep, regno, 0, MI_COMMS_COMMAND_READ));
1131 }
1132 
1133 void bge_mii_put16(bge_t *bgep, bge_regno_t regno, uint16_t data);
1134 #pragma	no_inline(bge_mii_put16)
1135 
1136 void
1137 bge_mii_put16(bge_t *bgep, bge_regno_t regno, uint16_t data)
1138 {
1139 	BGE_TRACE(("bge_mii_put16($%p, 0x%lx, 0x%x)",
1140 		(void *)bgep, regno, data));
1141 
1142 	ASSERT(mutex_owned(bgep->genlock));
1143 
1144 	(void) bge_mii_access(bgep, regno, data, MI_COMMS_COMMAND_WRITE);
1145 }
1146 
1147 #undef	BGE_DBG
1148 #define	BGE_DBG		BGE_DBG_SEEPROM	/* debug flag for this code	*/
1149 
1150 #if	BGE_SEE_IO32 || BGE_FLASH_IO32
1151 
1152 /*
1153  * Basic SEEPROM get/set access routine
1154  *
1155  * This uses the chip's SEEPROM auto-access method, controlled by the
1156  * Serial EEPROM Address/Data Registers at 0x6838/683c, so the CPU
1157  * doesn't have to fiddle with the individual bits.
1158  *
1159  * The caller should hold <genlock> and *also* have already acquired
1160  * the right to access the SEEPROM, via bge_nvmem_acquire() above.
1161  *
1162  * Return value:
1163  *	0 on success,
1164  *	ENODATA on access timeout (maybe retryable: device may just be busy)
1165  *	EPROTO on other h/w or s/w errors.
1166  *
1167  * <*dp> is an input to a SEEPROM_ACCESS_WRITE operation, or an output
1168  * from a (successful) SEEPROM_ACCESS_READ.
1169  */
1170 static int bge_seeprom_access(bge_t *bgep, uint32_t cmd, bge_regno_t addr,
1171 				uint32_t *dp);
1172 #pragma	no_inline(bge_seeprom_access)
1173 
1174 static int
1175 bge_seeprom_access(bge_t *bgep, uint32_t cmd, bge_regno_t addr, uint32_t *dp)
1176 {
1177 	uint32_t tries;
1178 	uint32_t regval;
1179 
1180 	ASSERT(mutex_owned(bgep->genlock));
1181 
1182 	/*
1183 	 * On the newer chips that support both SEEPROM & Flash, we need
1184 	 * to specifically enable SEEPROM access (Flash is the default).
1185 	 * On older chips, we don't; SEEPROM is the only NVtype supported,
1186 	 * and the NVM control registers don't exist ...
1187 	 */
1188 	switch (bgep->chipid.nvtype) {
1189 	case BGE_NVTYPE_NONE:
1190 	case BGE_NVTYPE_UNKNOWN:
1191 		_NOTE(NOTREACHED)
1192 	case BGE_NVTYPE_SEEPROM:
1193 		break;
1194 
1195 	case BGE_NVTYPE_LEGACY_SEEPROM:
1196 	case BGE_NVTYPE_UNBUFFERED_FLASH:
1197 	case BGE_NVTYPE_BUFFERED_FLASH:
1198 	default:
1199 		bge_reg_set32(bgep, NVM_CONFIG1_REG,
1200 				NVM_CFG1_LEGACY_SEEPROM_MODE);
1201 		break;
1202 	}
1203 
1204 	/*
1205 	 * Check there's no command in progress.
1206 	 *
1207 	 * Note: this *shouldn't* ever find that there is a command
1208 	 * in progress, because we already hold the <genlock> mutex.
1209 	 * Also, to ensure we don't have a conflict with the chip's
1210 	 * internal firmware or a process accessing the same (shared)
1211 	 * SEEPROM through the other port of a 5704, we've already
1212 	 * been through the "software arbitration" protocol.
1213 	 * So this is just a final consistency check: we shouldn't
1214 	 * see EITHER the START bit (command started but not complete)
1215 	 * OR the COMPLETE bit (command completed but not cleared).
1216 	 */
1217 	regval = bge_reg_get32(bgep, SERIAL_EEPROM_ADDRESS_REG);
1218 	if (regval & SEEPROM_ACCESS_START)
1219 		return (EPROTO);
1220 	if (regval & SEEPROM_ACCESS_COMPLETE)
1221 		return (EPROTO);
1222 
1223 	/*
1224 	 * Assemble the command ...
1225 	 */
1226 	cmd |= addr & SEEPROM_ACCESS_ADDRESS_MASK;
1227 	addr >>= SEEPROM_ACCESS_ADDRESS_SIZE;
1228 	addr <<= SEEPROM_ACCESS_DEVID_SHIFT;
1229 	cmd |= addr & SEEPROM_ACCESS_DEVID_MASK;
1230 	cmd |= SEEPROM_ACCESS_START;
1231 	cmd |= SEEPROM_ACCESS_COMPLETE;
1232 	cmd |= regval & SEEPROM_ACCESS_HALFCLOCK_MASK;
1233 
1234 	bge_reg_put32(bgep, SERIAL_EEPROM_DATA_REG, *dp);
1235 	bge_reg_put32(bgep, SERIAL_EEPROM_ADDRESS_REG, cmd);
1236 
1237 	/*
1238 	 * By observation, a successful access takes ~20us on a 5703/4,
1239 	 * but apparently much longer (up to 1000us) on the obsolescent
1240 	 * BCM5700/BCM5701.  We want to be sure we don't get any false
1241 	 * timeouts here; but OTOH, we don't want a bogus access to lock
1242 	 * out interrupts for longer than necessary. So we'll allow up
1243 	 * to 1000us ...
1244 	 */
1245 	for (tries = 0; tries < 1000; ++tries) {
1246 		regval = bge_reg_get32(bgep, SERIAL_EEPROM_ADDRESS_REG);
1247 		if (regval & SEEPROM_ACCESS_COMPLETE)
1248 			break;
1249 		drv_usecwait(1);
1250 	}
1251 
1252 	ASSERT((regval & SEEPROM_ACCESS_START) == 0);
1253 	if (regval & SEEPROM_ACCESS_COMPLETE) {
1254 		/*
1255 		 * All OK; read the SEEPROM data register, then write back
1256 		 * the value read from the address register in order to
1257 		 * clear the <complete> bit and leave the SEEPROM access
1258 		 * state machine idle, ready for the next access ...
1259 		 */
1260 		BGE_DEBUG(("bge_seeprom_access: complete after %d us", tries));
1261 		*dp = bge_reg_get32(bgep, SERIAL_EEPROM_DATA_REG);
1262 		bge_reg_put32(bgep, SERIAL_EEPROM_ADDRESS_REG, regval);
1263 		return (0);
1264 	}
1265 
1266 	/*
1267 	 * Hmm ... what happened here?
1268 	 *
1269 	 * Most likely, the user addressed an non-existent SEEPROM. Or
1270 	 * maybe the SEEPROM was busy internally (e.g. processing a write)
1271 	 * and didn't respond to being addressed. Either way, it's left
1272 	 * the SEEPROM access state machine wedged. So we'll reset it
1273 	 * before we leave, so it's ready for next time ...
1274 	 */
1275 	BGE_DEBUG(("bge_seeprom_access: timed out after %d us", tries));
1276 	bge_reg_set32(bgep, SERIAL_EEPROM_ADDRESS_REG, SEEPROM_ACCESS_INIT);
1277 	return (ENODATA);
1278 }
1279 
1280 /*
1281  * Basic Flash get/set access routine
1282  *
1283  * These use the chip's Flash auto-access method, controlled by the
1284  * Flash Access Registers at 0x7000-701c, so the CPU doesn't have to
1285  * fiddle with the individual bits.
1286  *
1287  * The caller should hold <genlock> and *also* have already acquired
1288  * the right to access the Flash, via bge_nvmem_acquire() above.
1289  *
1290  * Return value:
1291  *	0 on success,
1292  *	ENODATA on access timeout (maybe retryable: device may just be busy)
1293  *	ENODEV if the NVmem device is missing or otherwise unusable
1294  *
1295  * <*dp> is an input to a NVM_FLASH_CMD_WR operation, or an output
1296  * from a (successful) NVM_FLASH_CMD_RD.
1297  */
1298 static int bge_flash_access(bge_t *bgep, uint32_t cmd, bge_regno_t addr,
1299 				uint32_t *dp);
1300 #pragma	no_inline(bge_flash_access)
1301 
1302 static int
1303 bge_flash_access(bge_t *bgep, uint32_t cmd, bge_regno_t addr, uint32_t *dp)
1304 {
1305 	uint32_t tries;
1306 	uint32_t regval;
1307 
1308 	ASSERT(mutex_owned(bgep->genlock));
1309 
1310 	/*
1311 	 * On the newer chips that support both SEEPROM & Flash, we need
1312 	 * to specifically disable SEEPROM access while accessing Flash.
1313 	 * The older chips don't support Flash, and the NVM registers don't
1314 	 * exist, so we shouldn't be here at all!
1315 	 */
1316 	switch (bgep->chipid.nvtype) {
1317 	case BGE_NVTYPE_NONE:
1318 	case BGE_NVTYPE_UNKNOWN:
1319 		_NOTE(NOTREACHED)
1320 	case BGE_NVTYPE_SEEPROM:
1321 		return (ENODEV);
1322 
1323 	case BGE_NVTYPE_LEGACY_SEEPROM:
1324 	case BGE_NVTYPE_UNBUFFERED_FLASH:
1325 	case BGE_NVTYPE_BUFFERED_FLASH:
1326 	default:
1327 		bge_reg_clr32(bgep, NVM_CONFIG1_REG,
1328 				NVM_CFG1_LEGACY_SEEPROM_MODE);
1329 		break;
1330 	}
1331 
1332 	/*
1333 	 * Assemble the command ...
1334 	 */
1335 	addr &= NVM_FLASH_ADDR_MASK;
1336 	cmd |= NVM_FLASH_CMD_DOIT;
1337 	cmd |= NVM_FLASH_CMD_FIRST;
1338 	cmd |= NVM_FLASH_CMD_LAST;
1339 	cmd |= NVM_FLASH_CMD_DONE;
1340 
1341 	bge_reg_put32(bgep, NVM_FLASH_WRITE_REG, *dp);
1342 	bge_reg_put32(bgep, NVM_FLASH_ADDR_REG, addr);
1343 	bge_reg_put32(bgep, NVM_FLASH_CMD_REG, cmd);
1344 
1345 	/*
1346 	 * Allow up to 1000ms ...
1347 	 */
1348 	for (tries = 0; tries < 1000; ++tries) {
1349 		regval = bge_reg_get32(bgep, NVM_FLASH_CMD_REG);
1350 		if (regval & NVM_FLASH_CMD_DONE)
1351 			break;
1352 		drv_usecwait(1);
1353 	}
1354 
1355 	if (regval & NVM_FLASH_CMD_DONE) {
1356 		/*
1357 		 * All OK; read the data from the Flash read register
1358 		 */
1359 		BGE_DEBUG(("bge_flash_access: complete after %d us", tries));
1360 		*dp = bge_reg_get32(bgep, NVM_FLASH_READ_REG);
1361 		return (0);
1362 	}
1363 
1364 	/*
1365 	 * Hmm ... what happened here?
1366 	 *
1367 	 * Most likely, the user addressed an non-existent Flash. Or
1368 	 * maybe the Flash was busy internally (e.g. processing a write)
1369 	 * and didn't respond to being addressed. Either way, there's
1370 	 * nothing we can here ...
1371 	 */
1372 	BGE_DEBUG(("bge_flash_access: timed out after %d us", tries));
1373 	return (ENODATA);
1374 }
1375 
1376 /*
1377  * The next two functions regulate access to the NVram (if fitted).
1378  *
1379  * On a 5704 (dual core) chip, there's only one SEEPROM and one Flash
1380  * (SPI) interface, but they can be accessed through either port. These
1381  * are managed by different instance of this driver and have no software
1382  * state in common.
1383  *
1384  * In addition (and even on a single core chip) the chip's internal
1385  * firmware can access the SEEPROM/Flash, most notably after a RESET
1386  * when it may download code to run internally.
1387  *
1388  * So we need to arbitrate between these various software agents.  For
1389  * this purpose, the chip provides the Software Arbitration Register,
1390  * which implements hardware(!) arbitration.
1391  *
1392  * This functionality didn't exist on older (5700/5701) chips, so there's
1393  * nothing we can do by way of arbitration on those; also, if there's no
1394  * SEEPROM/Flash fitted (or we couldn't determine what type), there's also
1395  * nothing to do.
1396  *
1397  * The internal firmware appears to use Request 0, which is the highest
1398  * priority.  So we'd like to use Request 2, leaving one higher and one
1399  * lower for any future developments ... but apparently this doesn't
1400  * always work.  So for now, the code uses Request 1 ;-(
1401  */
1402 
1403 #define	NVM_READ_REQ	NVM_READ_REQ1
1404 #define	NVM_RESET_REQ	NVM_RESET_REQ1
1405 #define	NVM_SET_REQ	NVM_SET_REQ1
1406 
1407 static void bge_nvmem_relinquish(bge_t *bgep);
1408 #pragma	no_inline(bge_nvmem_relinquish)
1409 
1410 static void
1411 bge_nvmem_relinquish(bge_t *bgep)
1412 {
1413 	uint32_t regval;
1414 
1415 	ASSERT(mutex_owned(bgep->genlock));
1416 
1417 	switch (bgep->chipid.nvtype) {
1418 	case BGE_NVTYPE_NONE:
1419 	case BGE_NVTYPE_UNKNOWN:
1420 		_NOTE(NOTREACHED)
1421 		return;
1422 
1423 	case BGE_NVTYPE_SEEPROM:
1424 		/*
1425 		 * No arbitration performed, no release needed
1426 		 */
1427 		return;
1428 
1429 	case BGE_NVTYPE_LEGACY_SEEPROM:
1430 	case BGE_NVTYPE_UNBUFFERED_FLASH:
1431 	case BGE_NVTYPE_BUFFERED_FLASH:
1432 	default:
1433 		break;
1434 	}
1435 
1436 	/*
1437 	 * Our own request should be present (whether or not granted) ...
1438 	 */
1439 	regval = bge_reg_get32(bgep, NVM_SW_ARBITRATION_REG);
1440 	ASSERT((regval & NVM_READ_REQ) != 0);
1441 
1442 	/*
1443 	 * ... this will make it go away.
1444 	 */
1445 	bge_reg_put32(bgep, NVM_SW_ARBITRATION_REG, NVM_RESET_REQ);
1446 	regval = bge_reg_get32(bgep, NVM_SW_ARBITRATION_REG);
1447 	ASSERT((regval & NVM_READ_REQ) == 0);
1448 }
1449 
1450 /*
1451  * Arbitrate for access to the NVmem, if necessary
1452  *
1453  * Return value:
1454  *	0 on success
1455  *	EAGAIN if the device is in use (retryable)
1456  *	ENODEV if the NVmem device is missing or otherwise unusable
1457  */
1458 static int bge_nvmem_acquire(bge_t *bgep);
1459 #pragma	no_inline(bge_nvmem_acquire)
1460 
1461 static int
1462 bge_nvmem_acquire(bge_t *bgep)
1463 {
1464 	uint32_t regval;
1465 	uint32_t tries;
1466 
1467 	ASSERT(mutex_owned(bgep->genlock));
1468 
1469 	switch (bgep->chipid.nvtype) {
1470 	case BGE_NVTYPE_NONE:
1471 	case BGE_NVTYPE_UNKNOWN:
1472 		/*
1473 		 * Access denied: no (recognisable) device fitted
1474 		 */
1475 		return (ENODEV);
1476 
1477 	case BGE_NVTYPE_SEEPROM:
1478 		/*
1479 		 * Access granted: no arbitration needed (or possible)
1480 		 */
1481 		return (0);
1482 
1483 	case BGE_NVTYPE_LEGACY_SEEPROM:
1484 	case BGE_NVTYPE_UNBUFFERED_FLASH:
1485 	case BGE_NVTYPE_BUFFERED_FLASH:
1486 	default:
1487 		/*
1488 		 * Access conditional: conduct arbitration protocol
1489 		 */
1490 		break;
1491 	}
1492 
1493 	/*
1494 	 * We're holding the per-port mutex <genlock>, so no-one other
1495 	 * threads can be attempting to access the NVmem through *this*
1496 	 * port. But it could be in use by the *other* port (of a 5704),
1497 	 * or by the chip's internal firmware, so we have to go through
1498 	 * the full (hardware) arbitration protocol ...
1499 	 *
1500 	 * Note that *because* we're holding <genlock>, the interrupt handler
1501 	 * won't be able to progress.  So we're only willing to spin for a
1502 	 * fairly short time.  Specifically:
1503 	 *
1504 	 *	We *must* wait long enough for the hardware to resolve all
1505 	 *	requests and determine the winner.  Fortunately, this is
1506 	 *	"almost instantaneous", even as observed by GHz CPUs.
1507 	 *
1508 	 *	A successful access by another Solaris thread (via either
1509 	 *	port) typically takes ~20us.  So waiting a bit longer than
1510 	 *	that will give a good chance of success, if the other user
1511 	 *	*is* another thread on the other port.
1512 	 *
1513 	 *	However, the internal firmware can hold on to the NVmem
1514 	 *	for *much* longer: at least 10 milliseconds just after a
1515 	 *	RESET, and maybe even longer if the NVmem actually contains
1516 	 *	code to download and run on the internal CPUs.
1517 	 *
1518 	 * So, we'll allow 50us; if that's not enough then it's up to the
1519 	 * caller to retry later (hence the choice of return code EAGAIN).
1520 	 */
1521 	regval = bge_reg_get32(bgep, NVM_SW_ARBITRATION_REG);
1522 	ASSERT((regval & NVM_READ_REQ) == 0);
1523 	bge_reg_put32(bgep, NVM_SW_ARBITRATION_REG, NVM_SET_REQ);
1524 
1525 	for (tries = 0; tries < 50; ++tries) {
1526 		regval = bge_reg_get32(bgep, NVM_SW_ARBITRATION_REG);
1527 		ASSERT((regval & NVM_READ_REQ) != 0);
1528 		if (regval & NVM_WON_REQ1)
1529 			break;
1530 		drv_usecwait(1);
1531 	}
1532 
1533 	if (regval & NVM_WON_REQ1) {
1534 		BGE_DEBUG(("bge_nvmem_acquire: won after %d us", tries));
1535 		return (0);
1536 	}
1537 
1538 	/*
1539 	 * Somebody else must be accessing the NVmem, so abandon our
1540 	 * attempt take control of it.  The caller can try again later ...
1541 	 */
1542 	BGE_DEBUG(("bge_nvmem_acquire: lost after %d us", tries));
1543 	bge_nvmem_relinquish(bgep);
1544 	return (EAGAIN);
1545 }
1546 
1547 /*
1548  * This code assumes that the GPIO1 bit has been wired up to the NVmem
1549  * write protect line in such a way that the NVmem is protected when
1550  * GPIO1 is an input, or is an output but driven high.  Thus, to make the
1551  * NVmem writable we have to change GPIO1 to an output AND drive it low.
1552  *
1553  * Note: there's only one set of GPIO pins on a 5704, even though they
1554  * can be accessed through either port.  So the chip has to resolve what
1555  * happens if the two ports program a single pin differently ... the rule
1556  * it uses is that if the ports disagree about the *direction* of a pin,
1557  * "output" wins over "input", but if they disagree about its *value* as
1558  * an output, then the pin is TRISTATED instead!  In such a case, no-one
1559  * wins, and the external signal does whatever the external circuitry
1560  * defines as the default -- which we've assumed is the PROTECTED state.
1561  * So, we always change GPIO1 back to being an *input* whenever we're not
1562  * specifically using it to unprotect the NVmem. This allows either port
1563  * to update the NVmem, although obviously only one at a a time!
1564  *
1565  * The caller should hold <genlock> and *also* have already acquired the
1566  * right to access the NVmem, via bge_nvmem_acquire() above.
1567  */
1568 static void bge_nvmem_protect(bge_t *bgep, boolean_t protect);
1569 #pragma	inline(bge_nvmem_protect)
1570 
1571 static void
1572 bge_nvmem_protect(bge_t *bgep, boolean_t protect)
1573 {
1574 	uint32_t regval;
1575 
1576 	ASSERT(mutex_owned(bgep->genlock));
1577 
1578 	regval = bge_reg_get32(bgep, MISC_LOCAL_CONTROL_REG);
1579 	if (protect) {
1580 		regval |= MLCR_MISC_PINS_OUTPUT_1;
1581 		regval &= ~MLCR_MISC_PINS_OUTPUT_ENABLE_1;
1582 	} else {
1583 		regval &= ~MLCR_MISC_PINS_OUTPUT_1;
1584 		regval |= MLCR_MISC_PINS_OUTPUT_ENABLE_1;
1585 	}
1586 	bge_reg_put32(bgep, MISC_LOCAL_CONTROL_REG, regval);
1587 }
1588 
1589 /*
1590  * Now put it all together ...
1591  *
1592  * Try to acquire control of the NVmem; if successful, then:
1593  *	unprotect it (if we want to write to it)
1594  *	perform the requested access
1595  *	reprotect it (after a write)
1596  *	relinquish control
1597  *
1598  * Return value:
1599  *	0 on success,
1600  *	EAGAIN if the device is in use (retryable)
1601  *	ENODATA on access timeout (maybe retryable: device may just be busy)
1602  *	ENODEV if the NVmem device is missing or otherwise unusable
1603  *	EPROTO on other h/w or s/w errors.
1604  */
1605 static int
1606 bge_nvmem_rw32(bge_t *bgep, uint32_t cmd, bge_regno_t addr, uint32_t *dp)
1607 {
1608 	int err;
1609 
1610 	if ((err = bge_nvmem_acquire(bgep)) == 0) {
1611 		switch (cmd) {
1612 		case BGE_SEE_READ:
1613 			err = bge_seeprom_access(bgep,
1614 			    SEEPROM_ACCESS_READ, addr, dp);
1615 			break;
1616 
1617 		case BGE_SEE_WRITE:
1618 			bge_nvmem_protect(bgep, B_FALSE);
1619 			err = bge_seeprom_access(bgep,
1620 			    SEEPROM_ACCESS_WRITE, addr, dp);
1621 			bge_nvmem_protect(bgep, B_TRUE);
1622 			break;
1623 
1624 		case BGE_FLASH_READ:
1625 			if (DEVICE_5721_SERIES_CHIPSETS(bgep) ||
1626 			    DEVICE_5714_SERIES_CHIPSETS(bgep)) {
1627 				bge_reg_set32(bgep, NVM_ACCESS_REG,
1628 				    NVM_ACCESS_ENABLE);
1629 			}
1630 			err = bge_flash_access(bgep,
1631 			    NVM_FLASH_CMD_RD, addr, dp);
1632 			if (DEVICE_5721_SERIES_CHIPSETS(bgep) ||
1633 			    DEVICE_5714_SERIES_CHIPSETS(bgep)) {
1634 				bge_reg_clr32(bgep, NVM_ACCESS_REG,
1635 				    NVM_ACCESS_ENABLE);
1636 			}
1637 			break;
1638 
1639 		case BGE_FLASH_WRITE:
1640 			if (DEVICE_5721_SERIES_CHIPSETS(bgep) ||
1641 			    DEVICE_5714_SERIES_CHIPSETS(bgep)) {
1642 				bge_reg_set32(bgep, NVM_ACCESS_REG,
1643 				    NVM_WRITE_ENABLE|NVM_ACCESS_ENABLE);
1644 			}
1645 			bge_nvmem_protect(bgep, B_FALSE);
1646 			err = bge_flash_access(bgep,
1647 			    NVM_FLASH_CMD_WR, addr, dp);
1648 			bge_nvmem_protect(bgep, B_TRUE);
1649 			if (DEVICE_5721_SERIES_CHIPSETS(bgep) ||
1650 			    DEVICE_5714_SERIES_CHIPSETS(bgep)) {
1651 				bge_reg_clr32(bgep, NVM_ACCESS_REG,
1652 				    NVM_WRITE_ENABLE|NVM_ACCESS_ENABLE);
1653 			}
1654 
1655 			break;
1656 
1657 		default:
1658 			_NOTE(NOTREACHED)
1659 			break;
1660 		}
1661 		bge_nvmem_relinquish(bgep);
1662 	}
1663 
1664 	BGE_DEBUG(("bge_nvmem_rw32: err %d", err));
1665 	return (err);
1666 }
1667 
1668 /*
1669  * Attempt to get a MAC address from the SEEPROM or Flash, if any
1670  */
1671 static uint64_t bge_get_nvmac(bge_t *bgep);
1672 #pragma no_inline(bge_get_nvmac)
1673 
1674 static uint64_t
1675 bge_get_nvmac(bge_t *bgep)
1676 {
1677 	uint32_t mac_high;
1678 	uint32_t mac_low;
1679 	uint32_t addr;
1680 	uint32_t cmd;
1681 	uint64_t mac;
1682 
1683 	BGE_TRACE(("bge_get_nvmac($%p)",
1684 		(void *)bgep));
1685 
1686 	switch (bgep->chipid.nvtype) {
1687 	case BGE_NVTYPE_NONE:
1688 	case BGE_NVTYPE_UNKNOWN:
1689 	default:
1690 		return (0ULL);
1691 
1692 	case BGE_NVTYPE_SEEPROM:
1693 	case BGE_NVTYPE_LEGACY_SEEPROM:
1694 		cmd = BGE_SEE_READ;
1695 		break;
1696 
1697 	case BGE_NVTYPE_UNBUFFERED_FLASH:
1698 	case BGE_NVTYPE_BUFFERED_FLASH:
1699 		cmd = BGE_FLASH_READ;
1700 		break;
1701 	}
1702 
1703 	addr = NVMEM_DATA_MAC_ADDRESS;
1704 	if (bge_nvmem_rw32(bgep, cmd, addr, &mac_high))
1705 		return (0ULL);
1706 	addr += 4;
1707 	if (bge_nvmem_rw32(bgep, cmd, addr, &mac_low))
1708 		return (0ULL);
1709 
1710 	/*
1711 	 * The Broadcom chip is natively BIG-endian, so that's how the
1712 	 * MAC address is represented in NVmem.  We may need to swap it
1713 	 * around on a little-endian host ...
1714 	 */
1715 #ifdef	_BIG_ENDIAN
1716 	mac = mac_high;
1717 	mac = mac << 32;
1718 	mac |= mac_low;
1719 #else
1720 	mac = BGE_BSWAP_32(mac_high);
1721 	mac = mac << 32;
1722 	mac |= BGE_BSWAP_32(mac_low);
1723 #endif	/* _BIG_ENDIAN */
1724 
1725 	return (mac);
1726 }
1727 
1728 #else	/* BGE_SEE_IO32 || BGE_FLASH_IO32 */
1729 
1730 /*
1731  * Dummy version for when we're not supporting NVmem access
1732  */
1733 static uint64_t bge_get_nvmac(bge_t *bgep);
1734 #pragma inline(bge_get_nvmac)
1735 
1736 static uint64_t
1737 bge_get_nvmac(bge_t *bgep)
1738 {
1739 	_NOTE(ARGUNUSED(bgep))
1740 	return (0ULL);
1741 }
1742 
1743 #endif	/* BGE_SEE_IO32 || BGE_FLASH_IO32 */
1744 
1745 /*
1746  * Determine the type of NVmem that is (or may be) attached to this chip,
1747  */
1748 static enum bge_nvmem_type bge_nvmem_id(bge_t *bgep);
1749 #pragma no_inline(bge_nvmem_id)
1750 
1751 static enum bge_nvmem_type
1752 bge_nvmem_id(bge_t *bgep)
1753 {
1754 	enum bge_nvmem_type nvtype;
1755 	uint32_t config1;
1756 
1757 	BGE_TRACE(("bge_nvmem_id($%p)",
1758 		(void *)bgep));
1759 
1760 	switch (bgep->chipid.device) {
1761 	default:
1762 		/*
1763 		 * We shouldn't get here; it means we don't recognise
1764 		 * the chip, which means we don't know how to determine
1765 		 * what sort of NVmem (if any) it has.  So we'll say
1766 		 * NONE, to disable the NVmem access code ...
1767 		 */
1768 		nvtype = BGE_NVTYPE_NONE;
1769 		break;
1770 
1771 	case DEVICE_ID_5700:
1772 	case DEVICE_ID_5700x:
1773 	case DEVICE_ID_5701:
1774 		/*
1775 		 * These devices support *only* SEEPROMs
1776 		 */
1777 		nvtype = BGE_NVTYPE_SEEPROM;
1778 		break;
1779 
1780 	case DEVICE_ID_5702:
1781 	case DEVICE_ID_5702fe:
1782 	case DEVICE_ID_5703C:
1783 	case DEVICE_ID_5703S:
1784 	case DEVICE_ID_5704C:
1785 	case DEVICE_ID_5704S:
1786 	case DEVICE_ID_5704:
1787 	case DEVICE_ID_5705M:
1788 	case DEVICE_ID_5705C:
1789 	case DEVICE_ID_5706:
1790 	case DEVICE_ID_5782:
1791 	case DEVICE_ID_5788:
1792 	case DEVICE_ID_5751:
1793 	case DEVICE_ID_5751M:
1794 	case DEVICE_ID_5721:
1795 	case DEVICE_ID_5714C:
1796 	case DEVICE_ID_5714S:
1797 	case DEVICE_ID_5715C:
1798 		config1 = bge_reg_get32(bgep, NVM_CONFIG1_REG);
1799 		if (config1 & NVM_CFG1_FLASH_MODE)
1800 			if (config1 & NVM_CFG1_BUFFERED_MODE)
1801 				nvtype = BGE_NVTYPE_BUFFERED_FLASH;
1802 			else
1803 				nvtype = BGE_NVTYPE_UNBUFFERED_FLASH;
1804 		else
1805 			nvtype = BGE_NVTYPE_LEGACY_SEEPROM;
1806 		break;
1807 	}
1808 
1809 	return (nvtype);
1810 }
1811 
1812 #undef	BGE_DBG
1813 #define	BGE_DBG		BGE_DBG_CHIP	/* debug flag for this code	*/
1814 
1815 static void
1816 bge_init_recv_rule(bge_t *bgep)
1817 {
1818 	bge_recv_rule_t *rulep;
1819 	uint32_t i;
1820 
1821 	/*
1822 	 * receive rule: direct all TCP traffic to ring RULE_MATCH_TO_RING
1823 	 * 1. to direct UDP traffic, set:
1824 	 * 	rulep->control = RULE_PROTO_CONTROL;
1825 	 * 	rulep->mask_value = RULE_UDP_MASK_VALUE;
1826 	 * 2. to direct ICMP traffic, set:
1827 	 * 	rulep->control = RULE_PROTO_CONTROL;
1828 	 * 	rulep->mask_value = RULE_ICMP_MASK_VALUE;
1829 	 * 3. to direct traffic by source ip, set:
1830 	 * 	rulep->control = RULE_SIP_CONTROL;
1831 	 * 	rulep->mask_value = RULE_SIP_MASK_VALUE;
1832 	 */
1833 	rulep = bgep->recv_rules;
1834 	rulep->control = RULE_PROTO_CONTROL;
1835 	rulep->mask_value = RULE_TCP_MASK_VALUE;
1836 
1837 	/*
1838 	 * set receive rule registers
1839 	 */
1840 	rulep = bgep->recv_rules;
1841 	for (i = 0; i < RECV_RULES_NUM_MAX; i++, rulep++) {
1842 		bge_reg_put32(bgep, RECV_RULE_MASK_REG(i), rulep->mask_value);
1843 		bge_reg_put32(bgep, RECV_RULE_CONTROL_REG(i), rulep->control);
1844 	}
1845 }
1846 
1847 /*
1848  * Using the values captured by bge_chip_cfg_init(), and additional probes
1849  * as required, characterise the chip fully: determine the label by which
1850  * to refer to this chip, the correct settings for various registers, and
1851  * of course whether the device and/or subsystem are supported!
1852  */
1853 void bge_chip_id_init(bge_t *bgep);
1854 #pragma	no_inline(bge_chip_id_init)
1855 
1856 void
1857 bge_chip_id_init(bge_t *bgep)
1858 {
1859 	char buf[MAXPATHLEN];		/* any risk of stack overflow?	*/
1860 	boolean_t sys_ok;
1861 	boolean_t dev_ok;
1862 	chip_id_t *cidp;
1863 	uint32_t subid;
1864 	char *devname;
1865 	char *sysname;
1866 	int *ids;
1867 	int err;
1868 	uint_t i;
1869 
1870 	ASSERT(bgep->bge_chip_state == BGE_CHIP_INITIAL);
1871 
1872 	sys_ok = dev_ok = B_FALSE;
1873 	cidp = &bgep->chipid;
1874 
1875 	/*
1876 	 * Check the PCI device ID to determine the generic chip type and
1877 	 * select parameters that depend on this.
1878 	 *
1879 	 * Note: because the SPARC platforms in general don't fit the
1880 	 * SEEPROM 'behind' the chip, the PCI revision ID register reads
1881 	 * as zero - which is why we use <asic_rev> rather than <revision>
1882 	 * below ...
1883 	 *
1884 	 * Note: in general we can't distinguish between the Copper/SerDes
1885 	 * versions by ID alone, as some Copper devices (e.g. some but not
1886 	 * all 5703Cs) have the same ID as the SerDes equivalents.  So we
1887 	 * treat them the same here, and the MII code works out the media
1888 	 * type later on ...
1889 	 */
1890 	cidp->mbuf_base = bge_mbuf_pool_base;
1891 	cidp->mbuf_length = bge_mbuf_pool_len;
1892 	cidp->recv_slots = BGE_RECV_SLOTS_USED;
1893 	cidp->bge_dma_rwctrl = bge_dma_rwctrl;
1894 	cidp->pci_type = BGE_PCI_X;
1895 	cidp->statistic_type = BGE_STAT_BLK;
1896 
1897 	if (cidp->rx_rings == 0 || cidp->rx_rings > BGE_RECV_RINGS_MAX)
1898 		cidp->rx_rings = BGE_RECV_RINGS_DEFAULT;
1899 	if (cidp->tx_rings == 0 || cidp->tx_rings > BGE_SEND_RINGS_MAX)
1900 		cidp->tx_rings = BGE_SEND_RINGS_DEFAULT;
1901 
1902 	cidp->msi_enabled = B_FALSE;
1903 
1904 	switch (cidp->device) {
1905 	case DEVICE_ID_5700:
1906 	case DEVICE_ID_5700x:
1907 		cidp->chip_label = 5700;
1908 		cidp->flags |= CHIP_FLAG_NO_CSUM;
1909 		break;
1910 
1911 	case DEVICE_ID_5701:
1912 		cidp->chip_label = 5701;
1913 		dev_ok = B_TRUE;
1914 		cidp->flags |= CHIP_FLAG_NO_CSUM;
1915 		break;
1916 
1917 	case DEVICE_ID_5702:
1918 	case DEVICE_ID_5702fe:
1919 		cidp->chip_label = 5702;
1920 		dev_ok = B_TRUE;
1921 		cidp->flags |= CHIP_FLAG_NO_CSUM;	/* for now	*/
1922 		break;
1923 
1924 	case DEVICE_ID_5703C:
1925 	case DEVICE_ID_5703S:
1926 	case DEVICE_ID_5703:
1927 		/*
1928 		 * Revision A0 of the 5703/5793 had various errata
1929 		 * that we can't or don't work around, so it's not
1930 		 * supported, but all later versions are
1931 		 */
1932 		cidp->chip_label = cidp->subven == VENDOR_ID_SUN ? 5793 : 5703;
1933 		if (bgep->chipid.asic_rev != MHCR_CHIP_REV_5703_A0)
1934 			dev_ok = B_TRUE;
1935 		break;
1936 
1937 	case DEVICE_ID_5704C:
1938 	case DEVICE_ID_5704S:
1939 	case DEVICE_ID_5704:
1940 		/*
1941 		 * Revision A0 of the 5704/5794 had various errata
1942 		 * but we have workarounds, so it *is* supported.
1943 		 */
1944 		cidp->chip_label = cidp->subven == VENDOR_ID_SUN ? 5794 : 5704;
1945 		cidp->mbuf_base = bge_mbuf_pool_base_5704;
1946 		cidp->mbuf_length = bge_mbuf_pool_len_5704;
1947 		dev_ok = B_TRUE;
1948 		break;
1949 
1950 	case DEVICE_ID_5705C:
1951 	case DEVICE_ID_5705M:
1952 	case DEVICE_ID_5705MA3:
1953 	case DEVICE_ID_5705F:
1954 		cidp->chip_label = 5705;
1955 		cidp->mbuf_base = bge_mbuf_pool_base_5705;
1956 		cidp->mbuf_length = bge_mbuf_pool_len_5705;
1957 		cidp->recv_slots = BGE_RECV_SLOTS_5705;
1958 		cidp->rx_rings = BGE_RECV_RINGS_MAX_5705;
1959 		cidp->tx_rings = BGE_RECV_RINGS_MAX_5705;
1960 		cidp->flags |= CHIP_FLAG_NO_JUMBO;
1961 		cidp->statistic_type = BGE_STAT_REG;
1962 		dev_ok = B_TRUE;
1963 		break;
1964 
1965 	case DEVICE_ID_5706:
1966 		cidp->chip_label = 5706;
1967 		cidp->flags |= CHIP_FLAG_NO_JUMBO;
1968 		cidp->flags |= CHIP_FLAG_NO_CSUM;	/* for now	*/
1969 		break;
1970 
1971 	case DEVICE_ID_5782:
1972 		/*
1973 		 * Apart from the label, we treat this as a 5705(?)
1974 		 */
1975 		cidp->chip_label = 5782;
1976 		cidp->mbuf_base = bge_mbuf_pool_base_5705;
1977 		cidp->mbuf_length = bge_mbuf_pool_len_5705;
1978 		cidp->recv_slots = BGE_RECV_SLOTS_5705;
1979 		cidp->rx_rings = BGE_RECV_RINGS_MAX_5705;
1980 		cidp->tx_rings = BGE_RECV_RINGS_MAX_5705;
1981 		cidp->flags |= CHIP_FLAG_NO_JUMBO;
1982 		cidp->statistic_type = BGE_STAT_REG;
1983 		dev_ok = B_TRUE;
1984 		break;
1985 
1986 	case DEVICE_ID_5788:
1987 		/*
1988 		 * Apart from the label, we treat this as a 5705(?)
1989 		 */
1990 		cidp->chip_label = 5788;
1991 		cidp->mbuf_base = bge_mbuf_pool_base_5705;
1992 		cidp->mbuf_length = bge_mbuf_pool_len_5705;
1993 		cidp->recv_slots = BGE_RECV_SLOTS_5705;
1994 		cidp->rx_rings = BGE_RECV_RINGS_MAX_5705;
1995 		cidp->tx_rings = BGE_RECV_RINGS_MAX_5705;
1996 		cidp->statistic_type = BGE_STAT_REG;
1997 		cidp->flags |= CHIP_FLAG_NO_JUMBO;
1998 		dev_ok = B_TRUE;
1999 		break;
2000 
2001 	case DEVICE_ID_5714C:
2002 		if (cidp->revision >= REVISION_ID_5714_A2)
2003 			cidp->msi_enabled = bge_enable_msi;
2004 		/* FALLTHRU */
2005 	case DEVICE_ID_5714S:
2006 		cidp->chip_label = 5714;
2007 		cidp->mbuf_base = bge_mbuf_pool_base_5721;
2008 		cidp->mbuf_length = bge_mbuf_pool_len_5721;
2009 		cidp->recv_slots = BGE_RECV_SLOTS_5721;
2010 		cidp->bge_dma_rwctrl = bge_dma_rwctrl_5714;
2011 		cidp->bge_mlcr_default = bge_mlcr_default_5714;
2012 		cidp->rx_rings = BGE_RECV_RINGS_MAX_5705;
2013 		cidp->tx_rings = BGE_RECV_RINGS_MAX_5705;
2014 		cidp->pci_type = BGE_PCI_E;
2015 		cidp->statistic_type = BGE_STAT_REG;
2016 		cidp->flags |= CHIP_FLAG_NO_JUMBO;
2017 		dev_ok = B_TRUE;
2018 		break;
2019 
2020 	case DEVICE_ID_5715C:
2021 		cidp->chip_label = 5715;
2022 		cidp->mbuf_base = bge_mbuf_pool_base_5721;
2023 		cidp->mbuf_length = bge_mbuf_pool_len_5721;
2024 		cidp->recv_slots = BGE_RECV_SLOTS_5721;
2025 		cidp->bge_dma_rwctrl = bge_dma_rwctrl_5715;
2026 		cidp->bge_mlcr_default = bge_mlcr_default_5714;
2027 		cidp->rx_rings = BGE_RECV_RINGS_MAX_5705;
2028 		cidp->tx_rings = BGE_RECV_RINGS_MAX_5705;
2029 		cidp->pci_type = BGE_PCI_E;
2030 		cidp->statistic_type = BGE_STAT_REG;
2031 		cidp->flags |= CHIP_FLAG_NO_JUMBO;
2032 		dev_ok = B_TRUE;
2033 		break;
2034 
2035 	case DEVICE_ID_5721:
2036 		cidp->chip_label = 5721;
2037 		cidp->mbuf_base = bge_mbuf_pool_base_5721;
2038 		cidp->mbuf_length = bge_mbuf_pool_len_5721;
2039 		cidp->recv_slots = BGE_RECV_SLOTS_5721;
2040 		cidp->bge_dma_rwctrl = bge_dma_rwctrl_5721;
2041 		cidp->rx_rings = BGE_RECV_RINGS_MAX_5705;
2042 		cidp->tx_rings = BGE_RECV_RINGS_MAX_5705;
2043 		cidp->pci_type = BGE_PCI_E;
2044 		cidp->statistic_type = BGE_STAT_REG;
2045 		cidp->flags |= CHIP_FLAG_NO_JUMBO;
2046 		dev_ok = B_TRUE;
2047 		break;
2048 
2049 	case DEVICE_ID_5751:
2050 	case DEVICE_ID_5751M:
2051 		cidp->chip_label = 5751;
2052 		cidp->mbuf_base = bge_mbuf_pool_base_5721;
2053 		cidp->mbuf_length = bge_mbuf_pool_len_5721;
2054 		cidp->recv_slots = BGE_RECV_SLOTS_5721;
2055 		cidp->bge_dma_rwctrl = bge_dma_rwctrl_5721;
2056 		cidp->rx_rings = BGE_RECV_RINGS_MAX_5705;
2057 		cidp->tx_rings = BGE_RECV_RINGS_MAX_5705;
2058 		cidp->pci_type = BGE_PCI_E;
2059 		cidp->statistic_type = BGE_STAT_REG;
2060 		cidp->flags |= CHIP_FLAG_NO_JUMBO;
2061 		dev_ok = B_TRUE;
2062 		break;
2063 
2064 	}
2065 
2066 	/*
2067 	 * Setup the default jumbo parameter.
2068 	 */
2069 	cidp->mbuf_lo_water_rdma = bge_mbuf_lo_water_rdma;
2070 	cidp->mbuf_lo_water_rmac = bge_mbuf_lo_water_rmac;
2071 	cidp->mbuf_hi_water = bge_mbuf_hi_water;
2072 	cidp->ethmax_size = ETHERMAX;
2073 	cidp->snd_buff_size = BGE_SEND_BUFF_SIZE_DEFAULT;
2074 
2075 	/*
2076 	 * If jumbo is enabled and this kind of chipset supports jumbo feature,
2077 	 * setup below jumbo specific parameters.
2078 	 */
2079 	if (bge_jumbo_enable &&
2080 	    !(cidp->flags & CHIP_FLAG_NO_JUMBO) &&
2081 	    (cidp->default_mtu > BGE_DEFAULT_MTU) &&
2082 	    (cidp->default_mtu <= BGE_MAXIMUM_MTU)) {
2083 		cidp->mbuf_lo_water_rdma = RDMA_MBUF_LOWAT_JUMBO;
2084 		cidp->mbuf_lo_water_rmac = MAC_RX_MBUF_LOWAT_JUMBO;
2085 		cidp->mbuf_hi_water = MBUF_HIWAT_JUMBO;
2086 		cidp->recv_jumbo_size = BGE_JUMBO_BUFF_SIZE;
2087 		cidp->snd_buff_size = BGE_SEND_BUFF_SIZE_JUMBO;
2088 		cidp->jumbo_slots = BGE_JUMBO_SLOTS_USED;
2089 		cidp->ethmax_size = cidp->default_mtu +
2090 		    sizeof (struct ether_header);
2091 	}
2092 
2093 	/*
2094 	 * Identify the NV memory type: SEEPROM or Flash?
2095 	 */
2096 	cidp->nvtype = bge_nvmem_id(bgep);
2097 
2098 	/*
2099 	 * Now, we want to check whether this device is part of a
2100 	 * supported subsystem (e.g., on the motherboard of a Sun
2101 	 * branded platform).
2102 	 *
2103 	 * Rule 1: If the Subsystem Vendor ID is "Sun", then it's OK ;-)
2104 	 */
2105 	if (cidp->subven == VENDOR_ID_SUN)
2106 		sys_ok = B_TRUE;
2107 
2108 	/*
2109 	 * Rule 2: If it's on the list on known subsystems, then it's OK.
2110 	 * Note: 0x14e41647 should *not* appear in the list, but the code
2111 	 * doesn't enforce that.
2112 	 */
2113 	err = ddi_prop_lookup_int_array(DDI_DEV_T_ANY, bgep->devinfo,
2114 		DDI_PROP_DONTPASS, knownids_propname, &ids, &i);
2115 	if (err == DDI_PROP_SUCCESS) {
2116 		/*
2117 		 * Got the list; scan for a matching subsystem vendor/device
2118 		 */
2119 		subid = (cidp->subven << 16) | cidp->subdev;
2120 		while (i--)
2121 			if (ids[i] == subid)
2122 				sys_ok = B_TRUE;
2123 		ddi_prop_free(ids);
2124 	}
2125 
2126 	/*
2127 	 * Rule 3: If it's a Taco/ENWS motherboard device, then it's OK
2128 	 *
2129 	 * Unfortunately, early SunBlade 1500s and 2500s didn't reprogram
2130 	 * the Subsystem Vendor ID, so it defaults to Broadcom.  Therefore,
2131 	 * we have to check specially for the exact device paths to the
2132 	 * motherboard devices on those platforms ;-(
2133 	 *
2134 	 * Note: we can't just use the "supported-subsystems" mechanism
2135 	 * above, because the entry would have to be 0x14e41647 -- which
2136 	 * would then accept *any* plugin card that *didn't* contain a
2137 	 * (valid) SEEPROM ;-(
2138 	 */
2139 	sysname = ddi_node_name(ddi_root_node());
2140 	devname = ddi_pathname(bgep->devinfo, buf);
2141 	ASSERT(strlen(devname) > 0);
2142 	if (strcmp(sysname, "SUNW,Sun-Blade-1500") == 0)	/* Taco */
2143 		if (strcmp(devname, "/pci@1f,700000/network@2") == 0)
2144 			sys_ok = B_TRUE;
2145 	if (strcmp(sysname, "SUNW,Sun-Blade-2500") == 0)	/* ENWS */
2146 		if (strcmp(devname, "/pci@1c,600000/network@3") == 0)
2147 			sys_ok = B_TRUE;
2148 
2149 	/*
2150 	 * Now check what we've discovered: is this truly a supported
2151 	 * chip on (the motherboard of) a supported platform?
2152 	 *
2153 	 * Possible problems here:
2154 	 * 1)	it's a completely unheard-of chip (e.g. 5761)
2155 	 * 2)	it's a recognised but unsupported chip (e.g. 5701, 5703C-A0)
2156 	 * 3)	it's a chip we would support if it were on the motherboard
2157 	 *	of a Sun platform, but this one isn't ;-(
2158 	 */
2159 	if (cidp->chip_label == 0)
2160 		bge_problem(bgep,
2161 			"Device 'pci%04x,%04x' not recognized (%d?)",
2162 			cidp->vendor, cidp->device, cidp->device);
2163 	else if (!dev_ok)
2164 		bge_problem(bgep,
2165 			"Device 'pci%04x,%04x' (%d) revision %d not supported",
2166 			cidp->vendor, cidp->device, cidp->chip_label,
2167 			cidp->revision);
2168 #if	BGE_DEBUGGING
2169 	else if (!sys_ok)
2170 		bge_problem(bgep,
2171 			"%d-based subsystem 'pci%04x,%04x' not validated",
2172 			cidp->chip_label, cidp->subven, cidp->subdev);
2173 #endif
2174 	else
2175 		cidp->flags |= CHIP_FLAG_SUPPORTED;
2176 }
2177 
2178 void
2179 bge_chip_msi_trig(bge_t *bgep)
2180 {
2181 	uint32_t	regval;
2182 
2183 	regval = bgep->param_msi_cnt<<4;
2184 	bge_reg_set32(bgep, HOST_COALESCE_MODE_REG, regval);
2185 	BGE_DEBUG(("bge_chip_msi_trig:data = %d", regval));
2186 }
2187 
2188 /*
2189  * Various registers that control the chip's internal engines (state
2190  * machines) have a <reset> and <enable> bits (fortunately, in the
2191  * same place in each such register :-).
2192  *
2193  * To reset the state machine, the <reset> bit must be written with 1;
2194  * it will then read back as 1 while the reset is in progress, but
2195  * self-clear to 0 when the reset completes.
2196  *
2197  * To enable a state machine, one must set the <enable> bit, which
2198  * will continue to read back as 0 until the state machine is running.
2199  *
2200  * To disable a state machine, the <enable> bit must be cleared, but
2201  * it will continue to read back as 1 until the state machine actually
2202  * stops.
2203  *
2204  * This routine implements polling for completion of a reset, enable
2205  * or disable operation, returning B_TRUE on success (bit reached the
2206  * required state) or B_FALSE on timeout (200*100us == 20ms).
2207  */
2208 static boolean_t bge_chip_poll_engine(bge_t *bgep, bge_regno_t regno,
2209 					uint32_t mask, uint32_t val);
2210 #pragma	no_inline(bge_chip_poll_engine)
2211 
2212 static boolean_t
2213 bge_chip_poll_engine(bge_t *bgep, bge_regno_t regno,
2214 	uint32_t mask, uint32_t val)
2215 {
2216 	uint32_t regval;
2217 	uint32_t n;
2218 
2219 	BGE_TRACE(("bge_chip_poll_engine($%p, 0x%lx, 0x%x, 0x%x)",
2220 		(void *)bgep, regno, mask, val));
2221 
2222 	for (n = 200; n; --n) {
2223 		regval = bge_reg_get32(bgep, regno);
2224 		if ((regval & mask) == val)
2225 			return (B_TRUE);
2226 		drv_usecwait(100);
2227 	}
2228 
2229 	return (B_FALSE);
2230 }
2231 
2232 /*
2233  * Various registers that control the chip's internal engines (state
2234  * machines) have a <reset> bit (fortunately, in the same place in
2235  * each such register :-).  To reset the state machine, this bit must
2236  * be written with 1; it will then read back as 1 while the reset is
2237  * in progress, but self-clear to 0 when the reset completes.
2238  *
2239  * This code sets the bit, then polls for it to read back as zero.
2240  * The return value is B_TRUE on success (reset bit cleared itself),
2241  * or B_FALSE if the state machine didn't recover :(
2242  *
2243  * NOTE: the Core reset is similar to other resets, except that we
2244  * can't poll for completion, since the Core reset disables memory
2245  * access!  So we just have to assume that it will all complete in
2246  * 100us.  See Broadcom document 570X-PG102-R, p102, steps 4-5.
2247  */
2248 static boolean_t bge_chip_reset_engine(bge_t *bgep, bge_regno_t regno);
2249 #pragma	no_inline(bge_chip_reset_engine)
2250 
2251 static boolean_t
2252 bge_chip_reset_engine(bge_t *bgep, bge_regno_t regno)
2253 {
2254 	uint32_t regval;
2255 	uint32_t val32;
2256 
2257 	regval = bge_reg_get32(bgep, regno);
2258 
2259 	BGE_TRACE(("bge_chip_reset_engine($%p, 0x%lx)",
2260 		(void *)bgep, regno));
2261 	BGE_DEBUG(("bge_chip_reset_engine: 0x%lx before reset = 0x%08x",
2262 		regno, regval));
2263 
2264 	regval |= STATE_MACHINE_RESET_BIT;
2265 
2266 	switch (regno) {
2267 	case MISC_CONFIG_REG:
2268 		/*
2269 		 * BCM5714/5721/5751 pcie chip special case. In order to avoid
2270 		 * resetting PCIE block and bringing PCIE link down, bit 29
2271 		 * in the register needs to be set first, and then set it again
2272 		 * while the reset bit is written.
2273 		 * See:P500 of 57xx-PG102-RDS.pdf.
2274 		 */
2275 		if (DEVICE_5705_SERIES_CHIPSETS(bgep)||
2276 		    DEVICE_5721_SERIES_CHIPSETS(bgep)||
2277 		    DEVICE_5714_SERIES_CHIPSETS(bgep)) {
2278 			regval |= MISC_CONFIG_GPHY_POWERDOWN_OVERRIDE;
2279 			if (bgep->chipid.pci_type == BGE_PCI_E) {
2280 				if (bgep->chipid.asic_rev ==
2281 				    MHCR_CHIP_REV_5751_A0 ||
2282 				    bgep->chipid.asic_rev ==
2283 				    MHCR_CHIP_REV_5721_A0) {
2284 					val32 = bge_reg_get32(bgep,
2285 					    PHY_TEST_CTRL_REG);
2286 					if (val32 == (PHY_PCIE_SCRAM_MODE |
2287 					    PHY_PCIE_LTASS_MODE))
2288 						bge_reg_put32(bgep,
2289 						    PHY_TEST_CTRL_REG,
2290 						    PHY_PCIE_SCRAM_MODE);
2291 					val32 = pci_config_get32
2292 					    (bgep->cfg_handle,
2293 					    PCI_CONF_BGE_CLKCTL);
2294 					val32 |= CLKCTL_PCIE_A0_FIX;
2295 					pci_config_put32(bgep->cfg_handle,
2296 					    PCI_CONF_BGE_CLKCTL, val32);
2297 				}
2298 				bge_reg_set32(bgep, regno,
2299 					MISC_CONFIG_GRC_RESET_DISABLE);
2300 				regval |= MISC_CONFIG_GRC_RESET_DISABLE;
2301 			}
2302 		}
2303 
2304 		/*
2305 		 * Special case - causes Core reset
2306 		 *
2307 		 * On SPARC v9 we want to ensure that we don't start
2308 		 * timing until the I/O access has actually reached
2309 		 * the chip, otherwise we might make the next access
2310 		 * too early.  And we can't just force the write out
2311 		 * by following it with a read (even to config space)
2312 		 * because that would cause the fault we're trying
2313 		 * to avoid.  Hence the need for membar_sync() here.
2314 		 */
2315 		ddi_put32(bgep->io_handle, PIO_ADDR(bgep, regno), regval);
2316 #ifdef	__sparcv9
2317 		membar_sync();
2318 #endif	/* __sparcv9 */
2319 		/*
2320 		 * On some platforms,system need about 300us for
2321 		 * link setup.
2322 		 */
2323 		drv_usecwait(300);
2324 
2325 		if (bgep->chipid.pci_type == BGE_PCI_E) {
2326 			/* PCI-E device need more reset time */
2327 			drv_usecwait(120000);
2328 
2329 			/* Set PCIE max payload size and clear error status. */
2330 			if (bgep->chipid.chip_label == 5721 ||
2331 			    bgep->chipid.chip_label == 5751) {
2332 				pci_config_put16(bgep->cfg_handle,
2333 					PCI_CONF_DEV_CTRL, READ_REQ_SIZE_MAX);
2334 				pci_config_put16(bgep->cfg_handle,
2335 					PCI_CONF_DEV_STUS, DEVICE_ERROR_STUS);
2336 			}
2337 		}
2338 
2339 		BGE_PCICHK(bgep);
2340 		return (B_TRUE);
2341 
2342 	default:
2343 		bge_reg_put32(bgep, regno, regval);
2344 		return (bge_chip_poll_engine(bgep, regno,
2345 			STATE_MACHINE_RESET_BIT, 0));
2346 	}
2347 }
2348 
2349 /*
2350  * Various registers that control the chip's internal engines (state
2351  * machines) have an <enable> bit (fortunately, in the same place in
2352  * each such register :-).  To stop the state machine, this bit must
2353  * be written with 0, then polled to see when the state machine has
2354  * actually stopped.
2355  *
2356  * The return value is B_TRUE on success (enable bit cleared), or
2357  * B_FALSE if the state machine didn't stop :(
2358  */
2359 static boolean_t bge_chip_disable_engine(bge_t *bgep, bge_regno_t regno,
2360 						uint32_t morebits);
2361 #pragma	no_inline(bge_chip_disable_engine)
2362 
2363 static boolean_t
2364 bge_chip_disable_engine(bge_t *bgep, bge_regno_t regno, uint32_t morebits)
2365 {
2366 	uint32_t regval;
2367 
2368 	BGE_TRACE(("bge_chip_disable_engine($%p, 0x%lx, 0x%x)",
2369 		(void *)bgep, regno, morebits));
2370 
2371 	switch (regno) {
2372 	case FTQ_RESET_REG:
2373 		/*
2374 		 * Not quite like the others; it doesn't
2375 		 * have an <enable> bit, but instead we
2376 		 * have to set and then clear all the bits
2377 		 */
2378 		bge_reg_put32(bgep, regno, ~(uint32_t)0);
2379 		drv_usecwait(100);
2380 		bge_reg_put32(bgep, regno, 0);
2381 		return (B_TRUE);
2382 
2383 	default:
2384 		regval = bge_reg_get32(bgep, regno);
2385 		regval &= ~STATE_MACHINE_ENABLE_BIT;
2386 		regval &= ~morebits;
2387 		bge_reg_put32(bgep, regno, regval);
2388 		return (bge_chip_poll_engine(bgep, regno,
2389 			STATE_MACHINE_ENABLE_BIT, 0));
2390 	}
2391 }
2392 
2393 /*
2394  * Various registers that control the chip's internal engines (state
2395  * machines) have an <enable> bit (fortunately, in the same place in
2396  * each such register :-).  To start the state machine, this bit must
2397  * be written with 1, then polled to see when the state machine has
2398  * actually started.
2399  *
2400  * The return value is B_TRUE on success (enable bit set), or
2401  * B_FALSE if the state machine didn't start :(
2402  */
2403 static boolean_t bge_chip_enable_engine(bge_t *bgep, bge_regno_t regno,
2404 					uint32_t morebits);
2405 #pragma	no_inline(bge_chip_enable_engine)
2406 
2407 static boolean_t
2408 bge_chip_enable_engine(bge_t *bgep, bge_regno_t regno, uint32_t morebits)
2409 {
2410 	uint32_t regval;
2411 
2412 	BGE_TRACE(("bge_chip_enable_engine($%p, 0x%lx, 0x%x)",
2413 		(void *)bgep, regno, morebits));
2414 
2415 	switch (regno) {
2416 	case FTQ_RESET_REG:
2417 		/*
2418 		 * Not quite like the others; it doesn't
2419 		 * have an <enable> bit, but instead we
2420 		 * have to set and then clear all the bits
2421 		 */
2422 		bge_reg_put32(bgep, regno, ~(uint32_t)0);
2423 		drv_usecwait(100);
2424 		bge_reg_put32(bgep, regno, 0);
2425 		return (B_TRUE);
2426 
2427 	default:
2428 		regval = bge_reg_get32(bgep, regno);
2429 		regval |= STATE_MACHINE_ENABLE_BIT;
2430 		regval |= morebits;
2431 		bge_reg_put32(bgep, regno, regval);
2432 		return (bge_chip_poll_engine(bgep, regno,
2433 			STATE_MACHINE_ENABLE_BIT, STATE_MACHINE_ENABLE_BIT));
2434 	}
2435 }
2436 
2437 /*
2438  * Reprogram the Ethernet, Transmit, and Receive MAC
2439  * modes to match the param_* variables
2440  */
2441 static void bge_sync_mac_modes(bge_t *bgep);
2442 #pragma	no_inline(bge_sync_mac_modes)
2443 
2444 static void
2445 bge_sync_mac_modes(bge_t *bgep)
2446 {
2447 	uint32_t macmode;
2448 	uint32_t regval;
2449 
2450 	ASSERT(mutex_owned(bgep->genlock));
2451 
2452 	/*
2453 	 * Reprogram the Ethernet MAC mode ...
2454 	 */
2455 	macmode = regval = bge_reg_get32(bgep, ETHERNET_MAC_MODE_REG);
2456 	if ((bgep->chipid.flags & CHIP_FLAG_SERDES) &&
2457 		(bgep->param_loop_mode != BGE_LOOP_INTERNAL_MAC))
2458 		macmode &= ~ETHERNET_MODE_LINK_POLARITY;
2459 	else
2460 		macmode |= ETHERNET_MODE_LINK_POLARITY;
2461 	macmode &= ~ETHERNET_MODE_PORTMODE_MASK;
2462 	if ((bgep->chipid.flags & CHIP_FLAG_SERDES) &&
2463 		(bgep->param_loop_mode != BGE_LOOP_INTERNAL_MAC))
2464 		macmode |= ETHERNET_MODE_PORTMODE_TBI;
2465 	else if (bgep->param_link_speed == 10 || bgep->param_link_speed == 100)
2466 		macmode |= ETHERNET_MODE_PORTMODE_MII;
2467 	else
2468 		macmode |= ETHERNET_MODE_PORTMODE_GMII;
2469 	if (bgep->param_link_duplex == LINK_DUPLEX_HALF)
2470 		macmode |= ETHERNET_MODE_HALF_DUPLEX;
2471 	else
2472 		macmode &= ~ETHERNET_MODE_HALF_DUPLEX;
2473 	if (bgep->param_loop_mode == BGE_LOOP_INTERNAL_MAC)
2474 		macmode |= ETHERNET_MODE_MAC_LOOPBACK;
2475 	else
2476 		macmode &= ~ETHERNET_MODE_MAC_LOOPBACK;
2477 	bge_reg_put32(bgep, ETHERNET_MAC_MODE_REG, macmode);
2478 	BGE_DEBUG(("bge_sync_mac_modes($%p) Ethernet MAC mode 0x%x => 0x%x",
2479 		(void *)bgep, regval, macmode));
2480 
2481 	/*
2482 	 * ... the Transmit MAC mode ...
2483 	 */
2484 	macmode = regval = bge_reg_get32(bgep, TRANSMIT_MAC_MODE_REG);
2485 	if (bgep->param_link_tx_pause)
2486 		macmode |= TRANSMIT_MODE_FLOW_CONTROL;
2487 	else
2488 		macmode &= ~TRANSMIT_MODE_FLOW_CONTROL;
2489 	bge_reg_put32(bgep, TRANSMIT_MAC_MODE_REG, macmode);
2490 	BGE_DEBUG(("bge_sync_mac_modes($%p) Transmit MAC mode 0x%x => 0x%x",
2491 		(void *)bgep, regval, macmode));
2492 
2493 	/*
2494 	 * ... and the Receive MAC mode
2495 	 */
2496 	macmode = regval = bge_reg_get32(bgep, RECEIVE_MAC_MODE_REG);
2497 	if (bgep->param_link_rx_pause)
2498 		macmode |= RECEIVE_MODE_FLOW_CONTROL;
2499 	else
2500 		macmode &= ~RECEIVE_MODE_FLOW_CONTROL;
2501 	bge_reg_put32(bgep, RECEIVE_MAC_MODE_REG, macmode);
2502 	BGE_DEBUG(("bge_sync_mac_modes($%p) Receive MAC mode 0x%x => 0x%x",
2503 		(void *)bgep, regval, macmode));
2504 }
2505 
2506 /*
2507  * bge_chip_sync() -- program the chip with the unicast MAC address,
2508  * the multicast hash table, the required level of promiscuity, and
2509  * the current loopback mode ...
2510  */
2511 void bge_chip_sync(bge_t *bgep);
2512 #pragma	no_inline(bge_chip_sync)
2513 
2514 void
2515 bge_chip_sync(bge_t *bgep)
2516 {
2517 	void (*opfn)(bge_t *bgep, bge_regno_t reg, uint32_t bits);
2518 	boolean_t promisc;
2519 	uint64_t macaddr;
2520 	uint32_t fill;
2521 	int i;
2522 
2523 	BGE_TRACE(("bge_chip_sync($%p)",
2524 		(void *)bgep));
2525 
2526 	ASSERT(mutex_owned(bgep->genlock));
2527 
2528 	promisc = B_FALSE;
2529 	fill = ~(uint32_t)0;
2530 
2531 	if (bgep->promisc)
2532 		promisc = B_TRUE;
2533 	else
2534 		fill = (uint32_t)0;
2535 
2536 	/*
2537 	 * If the TX/RX MAC engines are already running, we should stop
2538 	 * them (and reset the RX engine) before changing the parameters.
2539 	 * If they're not running, this will have no effect ...
2540 	 *
2541 	 * NOTE: this is currently disabled by default because stopping
2542 	 * and restarting the Tx engine may cause an outgoing packet in
2543 	 * transit to be truncated.  Also, stopping and restarting the
2544 	 * Rx engine seems to not work correctly on the 5705.  Testing
2545 	 * has not (yet!) revealed any problems with NOT stopping and
2546 	 * restarting these engines (and Broadcom say their drivers don't
2547 	 * do this), but if it is found to cause problems, this variable
2548 	 * can be patched to re-enable the old behaviour ...
2549 	 */
2550 	if (bge_stop_start_on_sync) {
2551 		(void) bge_chip_disable_engine(bgep, RECEIVE_MAC_MODE_REG,
2552 		    RECEIVE_MODE_KEEP_VLAN_TAG);
2553 		(void) bge_chip_disable_engine(bgep, TRANSMIT_MAC_MODE_REG, 0);
2554 		(void) bge_chip_reset_engine(bgep, RECEIVE_MAC_MODE_REG);
2555 	}
2556 
2557 	/*
2558 	 * Reprogram the hashed multicast address table ...
2559 	 */
2560 	for (i = 0; i < BGE_HASH_TABLE_SIZE/32; ++i)
2561 		bge_reg_put32(bgep, MAC_HASH_REG(i),
2562 			bgep->mcast_hash[i] | fill);
2563 
2564 	/*
2565 	 * Transform the MAC address from host to chip format, then
2566 	 * reprogram the transmit random backoff seed and the unicast
2567 	 * MAC address(es) ...
2568 	 */
2569 	for (i = 0, fill = 0, macaddr = 0ull; i < ETHERADDRL; ++i) {
2570 		macaddr <<= 8;
2571 		macaddr |= bgep->curr_addr.addr[i];
2572 		fill += bgep->curr_addr.addr[i];
2573 	}
2574 	bge_reg_put32(bgep, MAC_TX_RANDOM_BACKOFF_REG, fill);
2575 	for (i = 0; i < MAC_ADDRESS_REGS_MAX; ++i)
2576 		bge_reg_put64(bgep, MAC_ADDRESS_REG(i), macaddr);
2577 
2578 	BGE_DEBUG(("bge_chip_sync($%p) setting MAC address %012llx",
2579 		(void *)bgep, macaddr));
2580 
2581 	/*
2582 	 * Set or clear the PROMISCUOUS mode bit
2583 	 */
2584 	opfn = promisc ? bge_reg_set32 : bge_reg_clr32;
2585 	(*opfn)(bgep, RECEIVE_MAC_MODE_REG, RECEIVE_MODE_PROMISCUOUS);
2586 
2587 	/*
2588 	 * Sync the rest of the MAC modes too ...
2589 	 */
2590 	bge_sync_mac_modes(bgep);
2591 
2592 	/*
2593 	 * Restart RX/TX MAC engines if required ...
2594 	 */
2595 	if (bgep->bge_chip_state == BGE_CHIP_RUNNING) {
2596 		(void) bge_chip_enable_engine(bgep, TRANSMIT_MAC_MODE_REG, 0);
2597 		(void) bge_chip_enable_engine(bgep, RECEIVE_MAC_MODE_REG,
2598 		    RECEIVE_MODE_KEEP_VLAN_TAG);
2599 	}
2600 }
2601 
2602 /*
2603  * This array defines the sequence of state machine control registers
2604  * in which the <enable> bit must be cleared to bring the chip to a
2605  * clean stop.  Taken from Broadcom document 570X-PG102-R, p116.
2606  */
2607 static bge_regno_t shutdown_engine_regs[] = {
2608 	RECEIVE_MAC_MODE_REG,
2609 	RCV_BD_INITIATOR_MODE_REG,
2610 	RCV_LIST_PLACEMENT_MODE_REG,
2611 	RCV_LIST_SELECTOR_MODE_REG,		/* BCM5704 series only	*/
2612 	RCV_DATA_BD_INITIATOR_MODE_REG,
2613 	RCV_DATA_COMPLETION_MODE_REG,
2614 	RCV_BD_COMPLETION_MODE_REG,
2615 
2616 	SEND_BD_SELECTOR_MODE_REG,
2617 	SEND_BD_INITIATOR_MODE_REG,
2618 	SEND_DATA_INITIATOR_MODE_REG,
2619 	READ_DMA_MODE_REG,
2620 	SEND_DATA_COMPLETION_MODE_REG,
2621 	DMA_COMPLETION_MODE_REG,		/* BCM5704 series only	*/
2622 	SEND_BD_COMPLETION_MODE_REG,
2623 	TRANSMIT_MAC_MODE_REG,
2624 
2625 	HOST_COALESCE_MODE_REG,
2626 	WRITE_DMA_MODE_REG,
2627 	MBUF_CLUSTER_FREE_MODE_REG,		/* BCM5704 series only	*/
2628 	FTQ_RESET_REG,		/* special - see code	*/
2629 	BUFFER_MANAGER_MODE_REG,		/* BCM5704 series only	*/
2630 	MEMORY_ARBITER_MODE_REG,		/* BCM5704 series only	*/
2631 	BGE_REGNO_NONE		/* terminator		*/
2632 };
2633 
2634 /*
2635  * bge_chip_stop() -- stop all chip processing
2636  *
2637  * If the <fault> parameter is B_TRUE, we're stopping the chip because
2638  * we've detected a problem internally; otherwise, this is a normal
2639  * (clean) stop (at user request i.e. the last STREAM has been closed).
2640  */
2641 void bge_chip_stop(bge_t *bgep, boolean_t fault);
2642 #pragma	no_inline(bge_chip_stop)
2643 
2644 void
2645 bge_chip_stop(bge_t *bgep, boolean_t fault)
2646 {
2647 	bge_regno_t regno;
2648 	bge_regno_t *rbp;
2649 	boolean_t ok;
2650 
2651 	BGE_TRACE(("bge_chip_stop($%p)",
2652 		(void *)bgep));
2653 
2654 	ASSERT(mutex_owned(bgep->genlock));
2655 
2656 	rbp = shutdown_engine_regs;
2657 	/*
2658 	 * When driver try to shutdown the BCM5705/5788/5721/5751/
2659 	 * 5752/5714 and 5715 chipsets,the buffer manager and the mem
2660 	 * -ory arbiter should not be disabled.
2661 	 */
2662 	for (ok = B_TRUE; (regno = *rbp) != BGE_REGNO_NONE; ++rbp) {
2663 			if (DEVICE_5704_SERIES_CHIPSETS(bgep))
2664 			    ok &= bge_chip_disable_engine(bgep, regno, 0);
2665 			else if ((regno != RCV_LIST_SELECTOR_MODE_REG) &&
2666 				    (regno != DMA_COMPLETION_MODE_REG) &&
2667 				    (regno != MBUF_CLUSTER_FREE_MODE_REG)&&
2668 				    (regno != BUFFER_MANAGER_MODE_REG) &&
2669 				    (regno != MEMORY_ARBITER_MODE_REG))
2670 					ok &= bge_chip_disable_engine(bgep,
2671 					    regno, 0);
2672 	}
2673 
2674 	/*
2675 	 * Finally, disable (all) MAC events & clear the MAC status
2676 	 */
2677 	bge_reg_put32(bgep, ETHERNET_MAC_EVENT_ENABLE_REG, 0);
2678 	bge_reg_put32(bgep, ETHERNET_MAC_STATUS_REG, ~0);
2679 
2680 	/*
2681 	 * Do we need to check whether everything completed OK?
2682 	 * Probably not ... it always works anyway.
2683 	 */
2684 
2685 	if (fault)
2686 		bgep->bge_chip_state = BGE_CHIP_FAULT;
2687 	else
2688 		bgep->bge_chip_state = BGE_CHIP_STOPPED;
2689 }
2690 
2691 /*
2692  * Poll for completion of chip's ROM firmware; also, at least on the
2693  * first time through, find and return the hardware MAC address, if any.
2694  */
2695 static uint64_t bge_poll_firmware(bge_t *bgep);
2696 #pragma	no_inline(bge_poll_firmware)
2697 
2698 static uint64_t
2699 bge_poll_firmware(bge_t *bgep)
2700 {
2701 	uint64_t magic;
2702 	uint64_t mac;
2703 	uint32_t gen;
2704 	uint32_t i;
2705 
2706 	/*
2707 	 * Step 18: put the T3_MAGIC_NUMBER into the GENCOMM port
2708 	 *
2709 	 * Step 19: poll for firmware completion (GENCOMM port set
2710 	 * to the ones complement of T3_MAGIC_NUMBER).
2711 	 *
2712 	 * While we're at it, we also read the MAC address register;
2713 	 * at some stage the the firmware will load this with the
2714 	 * factory-set value.
2715 	 *
2716 	 * When both the magic number and the MAC address are set,
2717 	 * we're done; but we impose a time limit of one second
2718 	 * (1000*1000us) in case the firmware fails in some fashion
2719 	 * or the SEEPROM that provides that MAC address isn't fitted.
2720 	 *
2721 	 * After the first time through (chip state != INITIAL), we
2722 	 * don't need the MAC address to be set (we've already got it
2723 	 * or not, from the first time), so we don't wait for it, but
2724 	 * we still have to wait for the T3_MAGIC_NUMBER.
2725 	 *
2726 	 * Note: the magic number is only a 32-bit quantity, but the NIC
2727 	 * memory is 64-bit (and big-endian) internally.  Addressing the
2728 	 * GENCOMM word as "the upper half of a 64-bit quantity" makes
2729 	 * it work correctly on both big- and little-endian hosts.
2730 	 */
2731 	magic = (uint64_t)T3_MAGIC_NUMBER << 32;
2732 	bge_nic_put64(bgep, NIC_MEM_GENCOMM, magic);
2733 	BGE_DEBUG(("bge_poll_firmware: put T3 magic 0x%llx in GENCOMM 0x%lx",
2734 		magic, NIC_MEM_GENCOMM));
2735 
2736 	for (i = 0; i < 1000; ++i) {
2737 		drv_usecwait(1000);
2738 		gen = bge_nic_get64(bgep, NIC_MEM_GENCOMM) >> 32;
2739 		mac = bge_reg_get64(bgep, MAC_ADDRESS_REG(0));
2740 		if (gen != ~T3_MAGIC_NUMBER)
2741 			continue;
2742 		if (mac != 0ULL)
2743 			break;
2744 		if (bgep->bge_chip_state != BGE_CHIP_INITIAL)
2745 			break;
2746 	}
2747 
2748 	magic = bge_nic_get64(bgep, NIC_MEM_GENCOMM);
2749 	BGE_DEBUG(("bge_poll_firmware($%p): PXE magic 0x%x after %d loops",
2750 		(void *)bgep, gen, i));
2751 	BGE_DEBUG(("bge_poll_firmware: MAC %016llx, GENCOMM %016llx",
2752 		mac, magic));
2753 
2754 	return (mac);
2755 }
2756 
2757 void bge_chip_reset(bge_t *bgep, boolean_t enable_dma);
2758 #pragma	no_inline(bge_chip_reset)
2759 
2760 void
2761 bge_chip_reset(bge_t *bgep, boolean_t enable_dma)
2762 {
2763 	chip_id_t chipid;
2764 	uint64_t mac;
2765 	uint32_t modeflags;
2766 	uint32_t mhcr;
2767 	uint32_t sx0;
2768 	uint32_t i;
2769 
2770 	BGE_TRACE(("bge_chip_reset($%p, %d)",
2771 		(void *)bgep, enable_dma));
2772 
2773 	ASSERT(mutex_owned(bgep->genlock));
2774 
2775 	BGE_DEBUG(("bge_chip_reset($%p, %d): current state is %d",
2776 		(void *)bgep, enable_dma, bgep->bge_chip_state));
2777 
2778 	/*
2779 	 * Do we need to stop the chip cleanly before resetting?
2780 	 */
2781 	switch (bgep->bge_chip_state) {
2782 	default:
2783 		ASSERT(!"can't get here");
2784 		_NOTE(NOTREACHED)
2785 		return;
2786 
2787 	case BGE_CHIP_INITIAL:
2788 	case BGE_CHIP_STOPPED:
2789 	case BGE_CHIP_RESET:
2790 		break;
2791 
2792 	case BGE_CHIP_RUNNING:
2793 	case BGE_CHIP_ERROR:
2794 	case BGE_CHIP_FAULT:
2795 		bge_chip_stop(bgep, B_FALSE);
2796 		break;
2797 	}
2798 
2799 	/*
2800 	 * Adapted from Broadcom document 570X-PG102-R, pp 102-116.
2801 	 * Updated to reflect Broadcom document 570X-PG104-R, pp 146-159.
2802 	 *
2803 	 * Before reset Core clock,it is
2804 	 * also required to initialize the Memory Arbiter as specified in step9
2805 	 * and Misc Host Control Register as specified in step-13
2806 	 * Step 4-5: reset Core clock & wait for completion
2807 	 * Steps 6-8: are done by bge_chip_cfg_init()
2808 	 */
2809 	(void) bge_chip_enable_engine(bgep, MEMORY_ARBITER_MODE_REG, 0);
2810 
2811 	mhcr = MHCR_ENABLE_INDIRECT_ACCESS |
2812 	    MHCR_ENABLE_TAGGED_STATUS_MODE |
2813 	    MHCR_MASK_INTERRUPT_MODE |
2814 	    MHCR_MASK_PCI_INT_OUTPUT |
2815 	    MHCR_CLEAR_INTERRUPT_INTA;
2816 #ifdef  _BIG_ENDIAN
2817 	mhcr |= MHCR_ENABLE_ENDIAN_WORD_SWAP | MHCR_ENABLE_ENDIAN_BYTE_SWAP;
2818 #endif  /* _BIG_ENDIAN */
2819 	pci_config_put32(bgep->cfg_handle, PCI_CONF_BGE_MHCR, mhcr);
2820 
2821 	(void) bge_chip_reset_engine(bgep, MISC_CONFIG_REG);
2822 	bge_chip_cfg_init(bgep, &chipid, enable_dma);
2823 
2824 	/*
2825 	 * Step 8a: This may belong elsewhere, but BCM5721 needs
2826 	 * a bit set to avoid a fifo overflow/underflow bug.
2827 	 */
2828 	if (bgep->chipid.chip_label == 5721 || bgep->chipid.chip_label == 5751)
2829 		bge_reg_set32(bgep, TLP_CONTROL_REG, TLP_DATA_FIFO_PROTECT);
2830 
2831 
2832 	/*
2833 	 * Step 9: enable MAC memory arbiter,bit30 and bit31 of 5714/5715 should
2834 	 * not be changed.
2835 	 */
2836 	(void) bge_chip_enable_engine(bgep, MEMORY_ARBITER_MODE_REG, 0);
2837 
2838 	/*
2839 	 * Steps 10-11: configure PIO endianness options and
2840 	 * enable indirect register access -- already done
2841 	 * Steps 12-13: enable writing to the PCI state & clock
2842 	 * control registers -- not required; we aren't going to
2843 	 * use those features.
2844 	 * Steps 14-15: Configure DMA endianness options.  See
2845 	 * the comments on the setting of the MHCR above.
2846 	 */
2847 #ifdef	_BIG_ENDIAN
2848 	modeflags = MODE_WORD_SWAP_FRAME | MODE_BYTE_SWAP_FRAME |
2849 		    MODE_WORD_SWAP_NONFRAME | MODE_BYTE_SWAP_NONFRAME;
2850 #else
2851 	modeflags = MODE_WORD_SWAP_FRAME | MODE_BYTE_SWAP_FRAME;
2852 #endif	/* _BIG_ENDIAN */
2853 	bge_reg_put32(bgep, MODE_CONTROL_REG, modeflags);
2854 
2855 	/*
2856 	 * Steps 16-17: poll for firmware completion
2857 	 */
2858 	mac = bge_poll_firmware(bgep);
2859 
2860 	/*
2861 	 * Step 18: enable external memory -- doesn't apply.
2862 	 *
2863 	 * However we take the opportunity to set the MLCR anyway, as
2864 	 * this register also controls the SEEPROM auto-access method
2865 	 * which we may want to use later ...
2866 	 *
2867 	 * The proper value here depends on the way the chip is wired
2868 	 * into the circuit board, as this register *also* controls which
2869 	 * of the "Miscellaneous I/O" pins are driven as outputs and the
2870 	 * values driven onto those pins!
2871 	 *
2872 	 * See also step 74 in the PRM ...
2873 	 */
2874 	bge_reg_put32(bgep, MISC_LOCAL_CONTROL_REG,
2875 	    bgep->chipid.bge_mlcr_default);
2876 	bge_reg_set32(bgep, SERIAL_EEPROM_ADDRESS_REG, SEEPROM_ACCESS_INIT);
2877 
2878 	/*
2879 	 * Step 20: clear the Ethernet MAC mode register
2880 	 */
2881 	bge_reg_put32(bgep, ETHERNET_MAC_MODE_REG, 0);
2882 
2883 	/*
2884 	 * Step 21: restore cache-line-size, latency timer, and
2885 	 * subsystem ID registers to their original values (not
2886 	 * those read into the local structure <chipid>, 'cos
2887 	 * that was after they were cleared by the RESET).
2888 	 *
2889 	 * Note: the Subsystem Vendor/Device ID registers are not
2890 	 * directly writable in config space, so we use the shadow
2891 	 * copy in "Page Zero" of register space to restore them
2892 	 * both in one go ...
2893 	 */
2894 	pci_config_put8(bgep->cfg_handle, PCI_CONF_CACHE_LINESZ,
2895 		bgep->chipid.clsize);
2896 	pci_config_put8(bgep->cfg_handle, PCI_CONF_LATENCY_TIMER,
2897 		bgep->chipid.latency);
2898 	bge_reg_put32(bgep, PCI_CONF_SUBVENID,
2899 		(bgep->chipid.subdev << 16) | bgep->chipid.subven);
2900 
2901 	/*
2902 	 * The SEND INDEX registers should be reset to zero by the
2903 	 * global chip reset; if they're not, there'll be trouble
2904 	 * later on -- usually in the form of an ASSERTion failure
2905 	 * in bge_send.c.  So let's catch it early ...
2906 	 */
2907 	sx0 = bge_reg_get32(bgep, NIC_DIAG_SEND_INDEX_REG(0));
2908 	if (sx0 != 0)
2909 		bge_problem(bgep, "send index %d: device didn't RESET!", sx0);
2910 	ASSERT(sx0 == 0);
2911 
2912 	/* Enable MSI code */
2913 	if (bgep->intr_type == DDI_INTR_TYPE_MSI)
2914 		bge_reg_set32(bgep, MSI_MODE_REG,
2915 		    MSI_PRI_HIGHEST|MSI_MSI_ENABLE);
2916 
2917 	/*
2918 	 * On the first time through, save the factory-set MAC address
2919 	 * (if any).  If bge_poll_firmware() above didn't return one
2920 	 * (from a chip register) consider looking in the attached NV
2921 	 * memory device, if any.  Once we have it, we save it in both
2922 	 * register-image (64-bit) and byte-array forms.  All-zero and
2923 	 * all-one addresses are not valid, and we refuse to stash those.
2924 	 */
2925 	if (bgep->bge_chip_state == BGE_CHIP_INITIAL) {
2926 		if (mac == 0ULL)
2927 			mac = bge_get_nvmac(bgep);
2928 		if (mac != 0ULL && mac != ~0ULL) {
2929 			bgep->chipid.hw_mac_addr = mac;
2930 			for (i = ETHERADDRL; i-- != 0; ) {
2931 				bgep->chipid.vendor_addr.addr[i] = (uchar_t)mac;
2932 				mac >>= 8;
2933 			}
2934 			bgep->chipid.vendor_addr.set = 1;
2935 		}
2936 	}
2937 
2938 	/*
2939 	 * Record the new state
2940 	 */
2941 	bgep->chip_resets += 1;
2942 	bgep->bge_chip_state = BGE_CHIP_RESET;
2943 }
2944 
2945 /*
2946  * bge_chip_start() -- start the chip transmitting and/or receiving,
2947  * including enabling interrupts
2948  */
2949 void bge_chip_start(bge_t *bgep, boolean_t reset_phys);
2950 #pragma	no_inline(bge_chip_start)
2951 
2952 void
2953 bge_chip_start(bge_t *bgep, boolean_t reset_phys)
2954 {
2955 	uint32_t coalmode;
2956 	uint32_t ledctl;
2957 	uint32_t mtu;
2958 	uint32_t maxring;
2959 	uint64_t ring;
2960 
2961 	BGE_TRACE(("bge_chip_start($%p)",
2962 		(void *)bgep));
2963 
2964 	ASSERT(mutex_owned(bgep->genlock));
2965 	ASSERT(bgep->bge_chip_state == BGE_CHIP_RESET);
2966 	ASSERT(bge_reg_get32(bgep, NIC_DIAG_SEND_INDEX_REG(0)) == 0);
2967 
2968 	/*
2969 	 * Taken from Broadcom document 570X-PG102-R, pp 102-116.
2970 	 * The document specifies 95 separate steps to fully
2971 	 * initialise the chip!!!!
2972 	 *
2973 	 * The reset code above has already got us as far as step
2974 	 * 21, so we continue with ...
2975 	 *
2976 	 * Step 22: clear the MAC statistics block
2977 	 * (0x0300-0x0aff in NIC-local memory)
2978 	 */
2979 	if (bgep->chipid.statistic_type == BGE_STAT_BLK)
2980 		bge_nic_zero(bgep, NIC_MEM_STATISTICS,
2981 		    NIC_MEM_STATISTICS_SIZE);
2982 
2983 	/*
2984 	 * Step 23: clear the status block (in host memory)
2985 	 */
2986 	DMA_ZERO(bgep->status_block);
2987 
2988 	/*
2989 	 * Step 24: set DMA read/write control register
2990 	 */
2991 	pci_config_put32(bgep->cfg_handle, PCI_CONF_BGE_PDRWCR,
2992 		bgep->chipid.bge_dma_rwctrl);
2993 
2994 	/*
2995 	 * Step 25: Configure DMA endianness -- already done (16/17)
2996 	 * Step 26: Configure Host-Based Send Rings
2997 	 * Step 27: Indicate Host Stack Up
2998 	 */
2999 	bge_reg_set32(bgep, MODE_CONTROL_REG,
3000 		MODE_HOST_SEND_BDS |
3001 		MODE_HOST_STACK_UP);
3002 
3003 	/*
3004 	 * Step 28: Configure checksum options:
3005 	 *	Solaris supports the hardware default checksum options
3006 	 *	so there's nothing to do here.
3007 	 */
3008 
3009 	/*
3010 	 * Step 29: configure Timer Prescaler.  The value is always the
3011 	 * same: the Core Clock frequency in MHz (66), minus 1, shifted
3012 	 * into bits 7-1.  Don't set bit 0, 'cos that's the RESET bit
3013 	 * for the whole chip!
3014 	 */
3015 	bge_reg_put32(bgep, MISC_CONFIG_REG, MISC_CONFIG_DEFAULT);
3016 
3017 	/*
3018 	 * Steps 30-31: Configure MAC local memory pool & DMA pool registers
3019 	 *
3020 	 * If the mbuf_length is specified as 0, we just leave these at
3021 	 * their hardware defaults, rather than explicitly setting them.
3022 	 * As the Broadcom HRM,driver better not change the parameters
3023 	 * when the chipsets is 5705/5788/5721/5751/5714 and 5715.
3024 	 */
3025 	if ((bgep->chipid.mbuf_length != 0) &&
3026 		(DEVICE_5704_SERIES_CHIPSETS(bgep))) {
3027 			bge_reg_put32(bgep, MBUF_POOL_BASE_REG,
3028 				bgep->chipid.mbuf_base);
3029 			bge_reg_put32(bgep, MBUF_POOL_LENGTH_REG,
3030 				bgep->chipid.mbuf_length);
3031 			bge_reg_put32(bgep, DMAD_POOL_BASE_REG,
3032 				DMAD_POOL_BASE_DEFAULT);
3033 			bge_reg_put32(bgep, DMAD_POOL_LENGTH_REG,
3034 				DMAD_POOL_LENGTH_DEFAULT);
3035 	}
3036 
3037 	/*
3038 	 * Step 32: configure MAC memory pool watermarks
3039 	 */
3040 	bge_reg_put32(bgep, RDMA_MBUF_LOWAT_REG,
3041 		bgep->chipid.mbuf_lo_water_rdma);
3042 	bge_reg_put32(bgep, MAC_RX_MBUF_LOWAT_REG,
3043 		bgep->chipid.mbuf_lo_water_rmac);
3044 	bge_reg_put32(bgep, MBUF_HIWAT_REG,
3045 		bgep->chipid.mbuf_hi_water);
3046 
3047 	/*
3048 	 * Step 33: configure DMA resource watermarks
3049 	 */
3050 	if (DEVICE_5704_SERIES_CHIPSETS(bgep)) {
3051 		bge_reg_put32(bgep, DMAD_POOL_LOWAT_REG,
3052 		    bge_dmad_lo_water);
3053 		bge_reg_put32(bgep, DMAD_POOL_HIWAT_REG,
3054 		    bge_dmad_hi_water);
3055 	}
3056 	bge_reg_put32(bgep, LOWAT_MAX_RECV_FRAMES_REG, bge_lowat_recv_frames);
3057 
3058 	/*
3059 	 * Steps 34-36: enable buffer manager & internal h/w queues
3060 	 */
3061 	(void) bge_chip_enable_engine(bgep, BUFFER_MANAGER_MODE_REG,
3062 		STATE_MACHINE_ATTN_ENABLE_BIT);
3063 	(void) bge_chip_enable_engine(bgep, FTQ_RESET_REG, 0);
3064 
3065 	/*
3066 	 * Steps 37-39: initialise Receive Buffer (Producer) RCBs
3067 	 */
3068 	bge_reg_putrcb(bgep, STD_RCV_BD_RING_RCB_REG,
3069 		&bgep->buff[BGE_STD_BUFF_RING].hw_rcb);
3070 	if (DEVICE_5704_SERIES_CHIPSETS(bgep)) {
3071 		bge_reg_putrcb(bgep, JUMBO_RCV_BD_RING_RCB_REG,
3072 			&bgep->buff[BGE_JUMBO_BUFF_RING].hw_rcb);
3073 		bge_reg_putrcb(bgep, MINI_RCV_BD_RING_RCB_REG,
3074 			&bgep->buff[BGE_MINI_BUFF_RING].hw_rcb);
3075 	}
3076 
3077 	/*
3078 	 * Step 40: set Receive Buffer Descriptor Ring replenish thresholds
3079 	 */
3080 	bge_reg_put32(bgep, STD_RCV_BD_REPLENISH_REG, bge_replenish_std);
3081 	if (DEVICE_5704_SERIES_CHIPSETS(bgep)) {
3082 		bge_reg_put32(bgep, JUMBO_RCV_BD_REPLENISH_REG,
3083 		    bge_replenish_jumbo);
3084 		bge_reg_put32(bgep, MINI_RCV_BD_REPLENISH_REG,
3085 		    bge_replenish_mini);
3086 	}
3087 
3088 	/*
3089 	 * Steps 41-43: clear Send Ring Producer Indices and initialise
3090 	 * Send Producer Rings (0x0100-0x01ff in NIC-local memory)
3091 	 */
3092 	if (DEVICE_5704_SERIES_CHIPSETS(bgep))
3093 		maxring = BGE_SEND_RINGS_MAX;
3094 	else
3095 		maxring = BGE_SEND_RINGS_MAX_5705;
3096 	for (ring = 0; ring < maxring; ++ring) {
3097 		bge_mbx_put(bgep, SEND_RING_HOST_INDEX_REG(ring), 0);
3098 		bge_mbx_put(bgep, SEND_RING_NIC_INDEX_REG(ring), 0);
3099 		bge_nic_putrcb(bgep, NIC_MEM_SEND_RING(ring),
3100 			&bgep->send[ring].hw_rcb);
3101 	}
3102 
3103 	/*
3104 	 * Steps 44-45: initialise Receive Return Rings
3105 	 * (0x0200-0x02ff in NIC-local memory)
3106 	 */
3107 	if (DEVICE_5704_SERIES_CHIPSETS(bgep))
3108 		maxring = BGE_RECV_RINGS_MAX;
3109 	else
3110 		maxring = BGE_RECV_RINGS_MAX_5705;
3111 	for (ring = 0; ring < maxring; ++ring)
3112 		bge_nic_putrcb(bgep, NIC_MEM_RECV_RING(ring),
3113 			&bgep->recv[ring].hw_rcb);
3114 
3115 	/*
3116 	 * Step 46: initialise Receive Buffer (Producer) Ring indexes
3117 	 */
3118 	bge_mbx_put(bgep, RECV_STD_PROD_INDEX_REG, 0);
3119 	if (DEVICE_5704_SERIES_CHIPSETS(bgep)) {
3120 		bge_mbx_put(bgep, RECV_JUMBO_PROD_INDEX_REG, 0);
3121 		bge_mbx_put(bgep, RECV_MINI_PROD_INDEX_REG, 0);
3122 	}
3123 	/*
3124 	 * Step 47: configure the MAC unicast address
3125 	 * Step 48: configure the random backoff seed
3126 	 * Step 96: set up multicast filters
3127 	 */
3128 	bge_chip_sync(bgep);
3129 
3130 	/*
3131 	 * Step 49: configure the MTU
3132 	 */
3133 	mtu = bgep->chipid.ethmax_size+ETHERFCSL+VLAN_TAGSZ;
3134 	bge_reg_put32(bgep, MAC_RX_MTU_SIZE_REG, mtu);
3135 
3136 	/*
3137 	 * Step 50: configure the IPG et al
3138 	 */
3139 	bge_reg_put32(bgep, MAC_TX_LENGTHS_REG, MAC_TX_LENGTHS_DEFAULT);
3140 
3141 	/*
3142 	 * Step 51: configure the default Rx Return Ring
3143 	 */
3144 	bge_reg_put32(bgep, RCV_RULES_CONFIG_REG, RCV_RULES_CONFIG_DEFAULT);
3145 
3146 	/*
3147 	 * Steps 52-54: configure Receive List Placement,
3148 	 * and enable Receive List Placement Statistics
3149 	 */
3150 	bge_reg_put32(bgep, RCV_LP_CONFIG_REG,
3151 		RCV_LP_CONFIG(bgep->chipid.rx_rings));
3152 	bge_reg_put32(bgep, RCV_LP_STATS_ENABLE_MASK_REG, ~0);
3153 	bge_reg_set32(bgep, RCV_LP_STATS_CONTROL_REG, RCV_LP_STATS_ENABLE);
3154 
3155 	if (bgep->chipid.rx_rings > 1)
3156 		bge_init_recv_rule(bgep);
3157 
3158 	/*
3159 	 * Steps 55-56: enable Send Data Initiator Statistics
3160 	 */
3161 	bge_reg_put32(bgep, SEND_INIT_STATS_ENABLE_MASK_REG, ~0);
3162 	if (DEVICE_5704_SERIES_CHIPSETS(bgep)) {
3163 		bge_reg_put32(bgep, SEND_INIT_STATS_CONTROL_REG,
3164 		    SEND_INIT_STATS_ENABLE | SEND_INIT_STATS_FASTER);
3165 	} else {
3166 		bge_reg_put32(bgep, SEND_INIT_STATS_CONTROL_REG,
3167 		    SEND_INIT_STATS_ENABLE);
3168 	}
3169 	/*
3170 	 * Steps 57-58: stop (?) the Host Coalescing Engine
3171 	 */
3172 	(void) bge_chip_disable_engine(bgep, HOST_COALESCE_MODE_REG, ~0);
3173 
3174 	/*
3175 	 * Steps 59-62: initialise Host Coalescing parameters
3176 	 */
3177 	bge_reg_put32(bgep, SEND_COALESCE_MAX_BD_REG, bge_tx_count_norm);
3178 	bge_reg_put32(bgep, SEND_COALESCE_TICKS_REG, bge_tx_ticks_norm);
3179 	bge_reg_put32(bgep, RCV_COALESCE_MAX_BD_REG, bge_rx_count_norm);
3180 	bge_reg_put32(bgep, RCV_COALESCE_TICKS_REG, bge_rx_ticks_norm);
3181 	if (DEVICE_5704_SERIES_CHIPSETS(bgep)) {
3182 		bge_reg_put32(bgep, SEND_COALESCE_INT_BD_REG,
3183 		    bge_tx_count_intr);
3184 		bge_reg_put32(bgep, SEND_COALESCE_INT_TICKS_REG,
3185 		    bge_tx_ticks_intr);
3186 		bge_reg_put32(bgep, RCV_COALESCE_INT_BD_REG,
3187 		    bge_rx_count_intr);
3188 		bge_reg_put32(bgep, RCV_COALESCE_INT_TICKS_REG,
3189 		    bge_rx_ticks_intr);
3190 	}
3191 
3192 	/*
3193 	 * Steps 63-64: initialise status block & statistics
3194 	 * host memory addresses
3195 	 * The statistic block does not exist in some chipsets
3196 	 * Step 65: initialise Statistics Coalescing Tick Counter
3197 	 */
3198 	bge_reg_put64(bgep, STATUS_BLOCK_HOST_ADDR_REG,
3199 		bgep->status_block.cookie.dmac_laddress);
3200 
3201 	/*
3202 	 * Steps 66-67: initialise status block & statistics
3203 	 * NIC-local memory addresses
3204 	 */
3205 	if (DEVICE_5704_SERIES_CHIPSETS(bgep)) {
3206 		bge_reg_put64(bgep, STATISTICS_HOST_ADDR_REG,
3207 		    bgep->statistics.cookie.dmac_laddress);
3208 		bge_reg_put32(bgep, STATISTICS_TICKS_REG,
3209 		    STATISTICS_TICKS_DEFAULT);
3210 		bge_reg_put32(bgep, STATUS_BLOCK_BASE_ADDR_REG,
3211 		    NIC_MEM_STATUS_BLOCK);
3212 		bge_reg_put32(bgep, STATISTICS_BASE_ADDR_REG,
3213 		    NIC_MEM_STATISTICS);
3214 	}
3215 
3216 	/*
3217 	 * Steps 68-71: start the Host Coalescing Engine, the Receive BD
3218 	 * Completion Engine, the Receive List Placement Engine, and the
3219 	 * Receive List selector.Pay attention:0x3400 is not exist in BCM5714
3220 	 * and BCM5715.
3221 	 */
3222 	if (bgep->chipid.tx_rings <= COALESCE_64_BYTE_RINGS &&
3223 	    bgep->chipid.rx_rings <= COALESCE_64_BYTE_RINGS)
3224 		coalmode = COALESCE_64_BYTE_STATUS;
3225 	else
3226 		coalmode = 0;
3227 	(void) bge_chip_enable_engine(bgep, HOST_COALESCE_MODE_REG, coalmode);
3228 	(void) bge_chip_enable_engine(bgep, RCV_BD_COMPLETION_MODE_REG,
3229 	    STATE_MACHINE_ATTN_ENABLE_BIT);
3230 	(void) bge_chip_enable_engine(bgep, RCV_LIST_PLACEMENT_MODE_REG, 0);
3231 
3232 	if (DEVICE_5704_SERIES_CHIPSETS(bgep))
3233 		(void) bge_chip_enable_engine(bgep, RCV_LIST_SELECTOR_MODE_REG,
3234 		    STATE_MACHINE_ATTN_ENABLE_BIT);
3235 
3236 	/*
3237 	 * Step 72: Enable MAC DMA engines
3238 	 * Step 73: Clear & enable MAC statistics
3239 	 */
3240 	bge_reg_set32(bgep, ETHERNET_MAC_MODE_REG,
3241 		ETHERNET_MODE_ENABLE_FHDE |
3242 		ETHERNET_MODE_ENABLE_RDE |
3243 		ETHERNET_MODE_ENABLE_TDE);
3244 	bge_reg_set32(bgep, ETHERNET_MAC_MODE_REG,
3245 		ETHERNET_MODE_ENABLE_TX_STATS |
3246 		ETHERNET_MODE_ENABLE_RX_STATS |
3247 		ETHERNET_MODE_CLEAR_TX_STATS |
3248 		ETHERNET_MODE_CLEAR_RX_STATS);
3249 
3250 	/*
3251 	 * Step 74: configure the MLCR (Miscellaneous Local Control
3252 	 * Register); not required, as we set up the MLCR in step 10
3253 	 * (part of the reset code) above.
3254 	 *
3255 	 * Step 75: clear Interrupt Mailbox 0
3256 	 */
3257 	bge_mbx_put(bgep, INTERRUPT_MBOX_0_REG, 0);
3258 
3259 	/*
3260 	 * Steps 76-87: Gentlemen, start your engines ...
3261 	 *
3262 	 * Enable the DMA Completion Engine, the Write DMA Engine,
3263 	 * the Read DMA Engine, Receive Data Completion Engine,
3264 	 * the MBuf Cluster Free Engine, the Send Data Completion Engine,
3265 	 * the Send BD Completion Engine, the Receive BD Initiator Engine,
3266 	 * the Receive Data Initiator Engine, the Send Data Initiator Engine,
3267 	 * the Send BD Initiator Engine, and the Send BD Selector Engine.
3268 	 *
3269 	 * Beware exhaust fumes?
3270 	 */
3271 	if (DEVICE_5704_SERIES_CHIPSETS(bgep))
3272 		(void) bge_chip_enable_engine(bgep, DMA_COMPLETION_MODE_REG, 0);
3273 	(void) bge_chip_enable_engine(bgep, WRITE_DMA_MODE_REG,
3274 		(bge_dma_wrprio << DMA_PRIORITY_SHIFT) | ALL_DMA_ATTN_BITS);
3275 	(void) bge_chip_enable_engine(bgep, READ_DMA_MODE_REG,
3276 		(bge_dma_rdprio << DMA_PRIORITY_SHIFT) | ALL_DMA_ATTN_BITS);
3277 	(void) bge_chip_enable_engine(bgep, RCV_DATA_COMPLETION_MODE_REG,
3278 		STATE_MACHINE_ATTN_ENABLE_BIT);
3279 	if (DEVICE_5704_SERIES_CHIPSETS(bgep))
3280 		(void) bge_chip_enable_engine(bgep,
3281 		    MBUF_CLUSTER_FREE_MODE_REG, 0);
3282 	(void) bge_chip_enable_engine(bgep, SEND_DATA_COMPLETION_MODE_REG, 0);
3283 	(void) bge_chip_enable_engine(bgep, SEND_BD_COMPLETION_MODE_REG,
3284 		STATE_MACHINE_ATTN_ENABLE_BIT);
3285 	(void) bge_chip_enable_engine(bgep, RCV_BD_INITIATOR_MODE_REG,
3286 		RCV_BD_DISABLED_RING_ATTN);
3287 	(void) bge_chip_enable_engine(bgep, RCV_DATA_BD_INITIATOR_MODE_REG,
3288 		RCV_DATA_BD_ILL_RING_ATTN);
3289 	(void) bge_chip_enable_engine(bgep, SEND_DATA_INITIATOR_MODE_REG, 0);
3290 	(void) bge_chip_enable_engine(bgep, SEND_BD_INITIATOR_MODE_REG,
3291 		STATE_MACHINE_ATTN_ENABLE_BIT);
3292 	(void) bge_chip_enable_engine(bgep, SEND_BD_SELECTOR_MODE_REG,
3293 		STATE_MACHINE_ATTN_ENABLE_BIT);
3294 
3295 	/*
3296 	 * Step 88: download firmware -- doesn't apply
3297 	 * Steps 89-90: enable Transmit & Receive MAC Engines
3298 	 */
3299 	(void) bge_chip_enable_engine(bgep, TRANSMIT_MAC_MODE_REG, 0);
3300 	(void) bge_chip_enable_engine(bgep, RECEIVE_MAC_MODE_REG,
3301 	    RECEIVE_MODE_KEEP_VLAN_TAG);
3302 
3303 	/*
3304 	 * Step 91: disable auto-polling of PHY status
3305 	 */
3306 	bge_reg_put32(bgep, MI_MODE_REG, MI_MODE_DEFAULT);
3307 
3308 	/*
3309 	 * Step 92: configure D0 power state (not required)
3310 	 * Step 93: initialise LED control register ()
3311 	 */
3312 	ledctl = LED_CONTROL_DEFAULT;
3313 	switch (bgep->chipid.device) {
3314 	case DEVICE_ID_5700:
3315 	case DEVICE_ID_5700x:
3316 	case DEVICE_ID_5701:
3317 		/*
3318 		 * Switch to 5700 (MAC) mode on these older chips
3319 		 */
3320 		ledctl &= ~LED_CONTROL_LED_MODE_MASK;
3321 		ledctl |= LED_CONTROL_LED_MODE_5700;
3322 		break;
3323 
3324 	default:
3325 		break;
3326 	}
3327 	bge_reg_put32(bgep, ETHERNET_MAC_LED_CONTROL_REG, ledctl);
3328 
3329 	/*
3330 	 * Step 94: activate link
3331 	 */
3332 	bge_reg_put32(bgep, MI_STATUS_REG, MI_STATUS_LINK);
3333 
3334 	/*
3335 	 * Step 95: set up physical layer (PHY/SerDes)
3336 	 * restart autoneg (if required)
3337 	 */
3338 	if (reset_phys)
3339 		bge_phys_update(bgep);
3340 
3341 	/*
3342 	 * Extra step (DSG): hand over all the Receive Buffers to the chip
3343 	 */
3344 	for (ring = 0; ring < BGE_BUFF_RINGS_USED; ++ring)
3345 		bge_mbx_put(bgep, bgep->buff[ring].chip_mbx_reg,
3346 			bgep->buff[ring].rf_next);
3347 
3348 	/*
3349 	 * MSI bits:The least significant MSI 16-bit word.
3350 	 * ISR will be triggered different.
3351 	 */
3352 	if (bgep->intr_type == DDI_INTR_TYPE_MSI)
3353 		bge_reg_set32(bgep, HOST_COALESCE_MODE_REG, 0x70);
3354 
3355 	/*
3356 	 * Extra step (DSG): select which interrupts are enabled
3357 	 *
3358 	 * Program the Ethernet MAC engine to signal attention on
3359 	 * Link Change events, then enable interrupts on MAC, DMA,
3360 	 * and FLOW attention signals.
3361 	 */
3362 	bge_reg_set32(bgep, ETHERNET_MAC_EVENT_ENABLE_REG,
3363 		ETHERNET_EVENT_LINK_INT |
3364 		ETHERNET_STATUS_PCS_ERROR_INT);
3365 	bge_reg_set32(bgep, MODE_CONTROL_REG,
3366 		MODE_INT_ON_FLOW_ATTN |
3367 		MODE_INT_ON_DMA_ATTN |
3368 		MODE_INT_ON_MAC_ATTN);
3369 
3370 	/*
3371 	 * Step 97: enable PCI interrupts!!!
3372 	 */
3373 	if (bgep->intr_type == DDI_INTR_TYPE_FIXED)
3374 		bge_cfg_clr32(bgep, PCI_CONF_BGE_MHCR,
3375 		    MHCR_MASK_PCI_INT_OUTPUT);
3376 
3377 	/*
3378 	 * All done!
3379 	 */
3380 	bgep->bge_chip_state = BGE_CHIP_RUNNING;
3381 }
3382 
3383 
3384 /*
3385  * ========== Hardware interrupt handler ==========
3386  */
3387 
3388 #undef	BGE_DBG
3389 #define	BGE_DBG		BGE_DBG_INT	/* debug flag for this code	*/
3390 
3391 /*
3392  * Sync the status block, then atomically clear the specified bits in
3393  * the <flags-and-tag> field of the status block.
3394  * the <flags> word of the status block, returning the value of the
3395  * <tag> and the <flags> before the bits were cleared.
3396  */
3397 static uint64_t bge_status_sync(bge_t *bgep, uint64_t bits);
3398 #pragma	inline(bge_status_sync)
3399 
3400 static uint64_t
3401 bge_status_sync(bge_t *bgep, uint64_t bits)
3402 {
3403 	bge_status_t *bsp;
3404 	uint64_t flags;
3405 
3406 	BGE_TRACE(("bge_status_sync($%p, 0x%llx)",
3407 		(void *)bgep, bits));
3408 
3409 	ASSERT(bgep->bge_guard == BGE_GUARD);
3410 
3411 	DMA_SYNC(bgep->status_block, DDI_DMA_SYNC_FORKERNEL);
3412 	bsp = DMA_VPTR(bgep->status_block);
3413 	flags = bge_atomic_clr64(&bsp->flags_n_tag, bits);
3414 
3415 	BGE_DEBUG(("bge_status_sync($%p, 0x%llx) returning 0x%llx",
3416 		(void *)bgep, bits, flags));
3417 
3418 	return (flags);
3419 }
3420 
3421 static void bge_wake_factotum(bge_t *bgep);
3422 #pragma	inline(bge_wake_factotum)
3423 
3424 static void
3425 bge_wake_factotum(bge_t *bgep)
3426 {
3427 	mutex_enter(bgep->softintrlock);
3428 	if (bgep->factotum_flag == 0) {
3429 		bgep->factotum_flag = 1;
3430 		ddi_trigger_softintr(bgep->factotum_id);
3431 	}
3432 	mutex_exit(bgep->softintrlock);
3433 }
3434 
3435 /*
3436  *	bge_intr() -- handle chip interrupts
3437  */
3438 uint_t bge_intr(caddr_t arg1, caddr_t arg2);
3439 #pragma	no_inline(bge_intr)
3440 
3441 uint_t
3442 bge_intr(caddr_t arg1, caddr_t arg2)
3443 {
3444 	bge_t *bgep = (bge_t *)arg1;		/* private device info	*/
3445 	bge_status_t *bsp;
3446 	uint64_t flags;
3447 	uint32_t mlcr = 0;
3448 	uint_t result;
3449 
3450 	BGE_TRACE(("bge_intr($%p) ($%p)", arg1, arg2));
3451 
3452 	/*
3453 	 * GLD v2 checks that s/w setup is complete before passing
3454 	 * interrupts to this routine, thus eliminating the old
3455 	 * (and well-known) race condition around ddi_add_intr()
3456 	 */
3457 	ASSERT(bgep->progress & PROGRESS_HWINT);
3458 
3459 	/*
3460 	 * Check whether chip's says it's asserting #INTA;
3461 	 * if not, don't process or claim the interrupt.
3462 	 *
3463 	 * Note that the PCI signal is active low, so the
3464 	 * bit is *zero* when the interrupt is asserted.
3465 	 */
3466 	result = DDI_INTR_UNCLAIMED;
3467 	mutex_enter(bgep->genlock);
3468 
3469 	if (bgep->intr_type == DDI_INTR_TYPE_FIXED)
3470 		mlcr = bge_reg_get32(bgep, MISC_LOCAL_CONTROL_REG);
3471 
3472 	BGE_DEBUG(("bge_intr($%p) ($%p) mlcr 0x%08x", arg1, arg2, mlcr));
3473 
3474 	if ((mlcr & MLCR_INTA_STATE) == 0) {
3475 		/*
3476 		 * Block further PCI interrupts ...
3477 		 */
3478 		result = DDI_INTR_CLAIMED;
3479 
3480 		if (bgep->intr_type == DDI_INTR_TYPE_FIXED)
3481 			bge_cfg_set32(bgep, PCI_CONF_BGE_MHCR,
3482 				MHCR_MASK_PCI_INT_OUTPUT);
3483 
3484 		/*
3485 		 * Sync the status block and grab the flags-n-tag from it.
3486 		 * We count the number of interrupts where there doesn't
3487 		 * seem to have been a DMA update of the status block; if
3488 		 * it *has* been updated, the counter will be cleared in
3489 		 * the while() loop below ...
3490 		 */
3491 		bgep->missed_dmas += 1;
3492 		bsp = DMA_VPTR(bgep->status_block);
3493 		flags = bge_status_sync(bgep, STATUS_FLAG_UPDATED);
3494 
3495 		while (flags & STATUS_FLAG_UPDATED) {
3496 			/*
3497 			 * Tell the chip that we're processing the interrupt
3498 			 */
3499 			bge_mbx_put(bgep, INTERRUPT_MBOX_0_REG,
3500 				INTERRUPT_MBOX_DISABLE(flags));
3501 
3502 			/*
3503 			 * Drop the mutex while we:
3504 			 * 	Receive any newly-arrived packets
3505 			 *	Recycle any newly-finished send buffers
3506 			 */
3507 			mutex_exit(bgep->genlock);
3508 			bge_receive(bgep, bsp);
3509 			bge_recycle(bgep, bsp);
3510 			mutex_enter(bgep->genlock);
3511 
3512 			/*
3513 			 * Tell the chip we've finished processing, and
3514 			 * give it the tag that we got from the status
3515 			 * block earlier, so that it knows just how far
3516 			 * we've gone.  If it's got more for us to do,
3517 			 * it will now update the status block and try
3518 			 * to assert an interrupt (but we've got the
3519 			 * #INTA blocked at present).  If we see the
3520 			 * update, we'll loop around to do some more.
3521 			 * Eventually we'll get out of here ...
3522 			 */
3523 			bge_mbx_put(bgep, INTERRUPT_MBOX_0_REG,
3524 				INTERRUPT_MBOX_ENABLE(flags));
3525 			bgep->missed_dmas = 0;
3526 			flags = bge_status_sync(bgep, STATUS_FLAG_UPDATED);
3527 		}
3528 
3529 		/*
3530 		 * Check for exceptional conditions that we need to handle
3531 		 *
3532 		 * Link status changed
3533 		 * Status block not updated
3534 		 */
3535 		if (flags & STATUS_FLAG_LINK_CHANGED)
3536 			bge_wake_factotum(bgep);
3537 
3538 		if (bgep->missed_dmas) {
3539 			/*
3540 			 * Probably due to the internal status tag not
3541 			 * being reset.  Force a status block update now;
3542 			 * this should ensure that we get an update and
3543 			 * a new interrupt.  After that, we should be in
3544 			 * sync again ...
3545 			 */
3546 			BGE_REPORT((bgep, "interrupt: flags 0x%llx - "
3547 				"not updated?", flags));
3548 			bge_reg_set32(bgep, HOST_COALESCE_MODE_REG,
3549 				COALESCE_NOW);
3550 
3551 			if (bgep->missed_dmas >= bge_dma_miss_limit) {
3552 				/*
3553 				 * If this happens multiple times in a row,
3554 				 * it means DMA is just not working.  Maybe
3555 				 * the chip's failed, or maybe there's a
3556 				 * problem on the PCI bus or in the host-PCI
3557 				 * bridge (Tomatillo).
3558 				 *
3559 				 * At all events, we want to stop further
3560 				 * interrupts and let the recovery code take
3561 				 * over to see whether anything can be done
3562 				 * about it ...
3563 				 */
3564 				bge_chip_stop(bgep, B_TRUE);
3565 				result = DDI_INTR_UNCLAIMED;
3566 			}
3567 		}
3568 
3569 		/*
3570 		 * Reenable assertion of #INTA, unless there's a DMA fault
3571 		 */
3572 		if (result == DDI_INTR_CLAIMED) {
3573 			if (bgep->intr_type == DDI_INTR_TYPE_FIXED)
3574 				bge_cfg_clr32(bgep, PCI_CONF_BGE_MHCR,
3575 					MHCR_MASK_PCI_INT_OUTPUT);
3576 		}
3577 	}
3578 
3579 	mutex_exit(bgep->genlock);
3580 	return (result);
3581 }
3582 
3583 /*
3584  * ========== Factotum, implemented as a softint handler ==========
3585  */
3586 
3587 #undef	BGE_DBG
3588 #define	BGE_DBG		BGE_DBG_FACT	/* debug flag for this code	*/
3589 
3590 static void bge_factotum_error_handler(bge_t *bgep);
3591 #pragma	no_inline(bge_factotum_error_handler)
3592 
3593 static void
3594 bge_factotum_error_handler(bge_t *bgep)
3595 {
3596 	uint32_t flow;
3597 	uint32_t rdma;
3598 	uint32_t wdma;
3599 	uint32_t tmac;
3600 	uint32_t rmac;
3601 	uint32_t rxrs;
3602 	uint32_t txrs = 0;
3603 
3604 	ASSERT(mutex_owned(bgep->genlock));
3605 
3606 	/*
3607 	 * Read all the registers that show the possible
3608 	 * reasons for the ERROR bit to be asserted
3609 	 */
3610 	flow = bge_reg_get32(bgep, FLOW_ATTN_REG);
3611 	rdma = bge_reg_get32(bgep, READ_DMA_STATUS_REG);
3612 	wdma = bge_reg_get32(bgep, WRITE_DMA_STATUS_REG);
3613 	tmac = bge_reg_get32(bgep, TRANSMIT_MAC_STATUS_REG);
3614 	rmac = bge_reg_get32(bgep, RECEIVE_MAC_STATUS_REG);
3615 	rxrs = bge_reg_get32(bgep, RX_RISC_STATE_REG);
3616 	if (DEVICE_5704_SERIES_CHIPSETS(bgep))
3617 		txrs = bge_reg_get32(bgep, TX_RISC_STATE_REG);
3618 
3619 	BGE_DEBUG(("factotum($%p) flow 0x%x rdma 0x%x wdma 0x%x",
3620 		(void *)bgep, flow, rdma, wdma));
3621 	BGE_DEBUG(("factotum($%p) tmac 0x%x rmac 0x%x rxrs 0x%08x txrs 0x%08x",
3622 		(void *)bgep, tmac, rmac, rxrs, txrs));
3623 
3624 	/*
3625 	 * For now, just clear all the errors ...
3626 	 */
3627 	if (DEVICE_5704_SERIES_CHIPSETS(bgep))
3628 		bge_reg_put32(bgep, TX_RISC_STATE_REG, ~0);
3629 	bge_reg_put32(bgep, RX_RISC_STATE_REG, ~0);
3630 	bge_reg_put32(bgep, RECEIVE_MAC_STATUS_REG, ~0);
3631 	bge_reg_put32(bgep, WRITE_DMA_STATUS_REG, ~0);
3632 	bge_reg_put32(bgep, READ_DMA_STATUS_REG, ~0);
3633 	bge_reg_put32(bgep, FLOW_ATTN_REG, ~0);
3634 }
3635 
3636 /*
3637  * Handler for hardware link state change.
3638  *
3639  * When this routine is called, the hardware link state has changed
3640  * and the new state is reflected in the param_* variables.  Here
3641  * we must update the softstate, reprogram the MAC to match, and
3642  * record the change in the log and/or on the console.
3643  */
3644 static void bge_factotum_link_handler(bge_t *bgep);
3645 #pragma	no_inline(bge_factotum_link_handler)
3646 
3647 static void
3648 bge_factotum_link_handler(bge_t *bgep)
3649 {
3650 	void (*logfn)(bge_t *bgep, const char *fmt, ...);
3651 	const char *msg;
3652 	hrtime_t deltat;
3653 
3654 	ASSERT(mutex_owned(bgep->genlock));
3655 
3656 	/*
3657 	 * Update the s/w link_state
3658 	 */
3659 	if (bgep->param_link_up)
3660 		bgep->link_state = LINK_STATE_UP;
3661 	else
3662 		bgep->link_state = LINK_STATE_DOWN;
3663 
3664 	/*
3665 	 * Reprogram the MAC modes to match
3666 	 */
3667 	bge_sync_mac_modes(bgep);
3668 
3669 	/*
3670 	 * Finally, we have to decide whether to write a message
3671 	 * on the console or only in the log.  If the PHY has
3672 	 * been reprogrammed (at user request) "recently", then
3673 	 * the message only goes in the log.  Otherwise it's an
3674 	 * "unexpected" event, and it goes on the console as well.
3675 	 */
3676 	deltat = bgep->phys_event_time - bgep->phys_write_time;
3677 	if (deltat > BGE_LINK_SETTLE_TIME)
3678 		msg = "";
3679 	else if (bgep->param_link_up)
3680 		msg = bgep->link_up_msg;
3681 	else
3682 		msg = bgep->link_down_msg;
3683 
3684 	logfn = (msg == NULL || *msg == '\0') ? bge_notice : bge_log;
3685 	(*logfn)(bgep, "link %s%s", bgep->link_mode_msg, msg);
3686 }
3687 
3688 static boolean_t bge_factotum_link_check(bge_t *bgep);
3689 #pragma	no_inline(bge_factotum_link_check)
3690 
3691 static boolean_t
3692 bge_factotum_link_check(bge_t *bgep)
3693 {
3694 	boolean_t check;
3695 	uint64_t flags;
3696 	uint32_t tmac_status;
3697 
3698 	ASSERT(mutex_owned(bgep->genlock));
3699 
3700 	/*
3701 	 * Get & clear the writable status bits in the Tx status register
3702 	 * (some bits are write-1-to-clear, others are just readonly).
3703 	 */
3704 	tmac_status = bge_reg_get32(bgep, TRANSMIT_MAC_STATUS_REG);
3705 	bge_reg_put32(bgep, TRANSMIT_MAC_STATUS_REG, tmac_status);
3706 
3707 	/*
3708 	 * Get & clear the ERROR and LINK_CHANGED bits from the status block
3709 	 */
3710 	flags = STATUS_FLAG_ERROR | STATUS_FLAG_LINK_CHANGED;
3711 	flags = bge_status_sync(bgep, flags);
3712 
3713 	/*
3714 	 * Clear any errors flagged in the status block ...
3715 	 */
3716 	if (flags & STATUS_FLAG_ERROR)
3717 		bge_factotum_error_handler(bgep);
3718 
3719 	/*
3720 	 * We need to check the link status if:
3721 	 *	the status block says there's been a link change
3722 	 *	or there's any discrepancy between the various
3723 	 *	flags indicating the link state (link_state,
3724 	 *	param_link_up, and the LINK STATE bit in the
3725 	 *	Transmit MAC status register).
3726 	 */
3727 	check = (flags & STATUS_FLAG_LINK_CHANGED) != 0;
3728 	switch (bgep->link_state) {
3729 	case LINK_STATE_UP:
3730 		check |= (bgep->param_link_up == B_FALSE);
3731 		check |= ((tmac_status & TRANSMIT_STATUS_LINK_UP) == 0);
3732 		break;
3733 
3734 	case LINK_STATE_DOWN:
3735 		check |= (bgep->param_link_up != B_FALSE);
3736 		check |= ((tmac_status & TRANSMIT_STATUS_LINK_UP) != 0);
3737 		break;
3738 
3739 	default:
3740 		check = B_TRUE;
3741 		break;
3742 	}
3743 
3744 	/*
3745 	 * If <check> is false, we're sure the link hasn't changed.
3746 	 * If true, however, it's not yet definitive; we have to call
3747 	 * bge_phys_check() to determine whether the link has settled
3748 	 * into a new state yet ... and if it has, then call the link
3749 	 * state change handler.But when the chip is 5700 in Dell 6650
3750 	 * ,even if check is false, the link may have changed.So we
3751 	 * have to call bge_phys_check() to determine the link state.
3752 	 */
3753 	if (check || bgep->chipid.device == DEVICE_ID_5700) {
3754 		check = bge_phys_check(bgep);
3755 		if (check)
3756 			bge_factotum_link_handler(bgep);
3757 	}
3758 
3759 	return (check);
3760 }
3761 
3762 /*
3763  * Factotum routine to check for Tx stall, using the 'watchdog' counter
3764  */
3765 static boolean_t bge_factotum_stall_check(bge_t *bgep);
3766 #pragma	no_inline(bge_factotum_stall_check)
3767 
3768 static boolean_t
3769 bge_factotum_stall_check(bge_t *bgep)
3770 {
3771 	uint32_t dogval;
3772 
3773 	ASSERT(mutex_owned(bgep->genlock));
3774 
3775 	/*
3776 	 * Specific check for Tx stall ...
3777 	 *
3778 	 * The 'watchdog' counter is incremented whenever a packet
3779 	 * is queued, reset to 1 when some (but not all) buffers
3780 	 * are reclaimed, reset to 0 (disabled) when all buffers
3781 	 * are reclaimed, and shifted left here.  If it exceeds the
3782 	 * threshold value, the chip is assumed to have stalled and
3783 	 * is put into the ERROR state.  The factotum will then reset
3784 	 * it on the next pass.
3785 	 *
3786 	 * All of which should ensure that we don't get into a state
3787 	 * where packets are left pending indefinitely!
3788 	 */
3789 	dogval = bge_atomic_shl32(&bgep->watchdog, 1);
3790 	if (dogval < bge_watchdog_count)
3791 		return (B_FALSE);
3792 
3793 	BGE_REPORT((bgep, "Tx stall detected, watchdog code 0x%x", dogval));
3794 	return (B_TRUE);
3795 }
3796 
3797 /*
3798  * The factotum is woken up when there's something to do that we'd rather
3799  * not do from inside a hardware interrupt handler or high-level cyclic.
3800  * Its two main tasks are:
3801  *	reset & restart the chip after an error
3802  *	check the link status whenever necessary
3803  */
3804 uint_t bge_chip_factotum(caddr_t arg);
3805 #pragma	no_inline(bge_chip_factotum)
3806 
3807 uint_t
3808 bge_chip_factotum(caddr_t arg)
3809 {
3810 	bge_t *bgep;
3811 	uint_t result;
3812 	boolean_t error;
3813 	boolean_t linkchg;
3814 
3815 	bgep = (bge_t *)arg;
3816 
3817 	BGE_TRACE(("bge_chip_factotum($%p)", (void *)bgep));
3818 
3819 	mutex_enter(bgep->softintrlock);
3820 	if (bgep->factotum_flag == 0) {
3821 		mutex_exit(bgep->softintrlock);
3822 		return (DDI_INTR_UNCLAIMED);
3823 	}
3824 	mutex_exit(bgep->softintrlock);
3825 
3826 	bgep->factotum_flag = 0;
3827 	result = DDI_INTR_CLAIMED;
3828 	error = B_FALSE;
3829 	linkchg = B_FALSE;
3830 
3831 	mutex_enter(bgep->genlock);
3832 	switch (bgep->bge_chip_state) {
3833 	default:
3834 		break;
3835 
3836 	case BGE_CHIP_RUNNING:
3837 		linkchg = bge_factotum_link_check(bgep);
3838 		error = bge_factotum_stall_check(bgep);
3839 		break;
3840 
3841 	case BGE_CHIP_ERROR:
3842 		error = B_TRUE;
3843 		break;
3844 
3845 	case BGE_CHIP_FAULT:
3846 		/*
3847 		 * Fault detected, time to reset ...
3848 		 */
3849 		if (bge_autorecover) {
3850 			BGE_REPORT((bgep, "automatic recovery activated"));
3851 			bge_restart(bgep, B_FALSE);
3852 		}
3853 		break;
3854 	}
3855 
3856 	/*
3857 	 * If an error is detected, stop the chip now, marking it as
3858 	 * faulty, so that it will be reset next time through ...
3859 	 */
3860 	if (error)
3861 		bge_chip_stop(bgep, B_TRUE);
3862 	mutex_exit(bgep->genlock);
3863 
3864 	/*
3865 	 * If the link state changed, tell the world about it.
3866 	 * Note: can't do this while still holding the mutex.
3867 	 */
3868 	if (linkchg)
3869 		mac_link_update(bgep->macp, bgep->link_state);
3870 
3871 	return (result);
3872 }
3873 
3874 /*
3875  * High-level cyclic handler
3876  *
3877  * This routine schedules a (low-level) softint callback to the
3878  * factotum, and prods the chip to update the status block (which
3879  * will cause a hardware interrupt when complete).
3880  */
3881 void bge_chip_cyclic(void *arg);
3882 #pragma	no_inline(bge_chip_cyclic)
3883 
3884 void
3885 bge_chip_cyclic(void *arg)
3886 {
3887 	bge_t *bgep;
3888 
3889 	bgep = arg;
3890 
3891 	switch (bgep->bge_chip_state) {
3892 	default:
3893 		return;
3894 
3895 	case BGE_CHIP_RUNNING:
3896 		bge_reg_set32(bgep, HOST_COALESCE_MODE_REG, COALESCE_NOW);
3897 		break;
3898 
3899 	case BGE_CHIP_FAULT:
3900 	case BGE_CHIP_ERROR:
3901 		break;
3902 	}
3903 
3904 	bge_wake_factotum(bgep);
3905 }
3906 
3907 
3908 /*
3909  * ========== Ioctl subfunctions ==========
3910  */
3911 
3912 #undef	BGE_DBG
3913 #define	BGE_DBG		BGE_DBG_PPIO	/* debug flag for this code	*/
3914 
3915 #if	BGE_DEBUGGING || BGE_DO_PPIO
3916 
3917 static void bge_chip_peek_cfg(bge_t *bgep, bge_peekpoke_t *ppd);
3918 #pragma	no_inline(bge_chip_peek_cfg)
3919 
3920 static void
3921 bge_chip_peek_cfg(bge_t *bgep, bge_peekpoke_t *ppd)
3922 {
3923 	uint64_t regval;
3924 	uint64_t regno;
3925 
3926 	BGE_TRACE(("bge_chip_peek_cfg($%p, $%p)",
3927 		(void *)bgep, (void *)ppd));
3928 
3929 	regno = ppd->pp_acc_offset;
3930 
3931 	switch (ppd->pp_acc_size) {
3932 	case 1:
3933 		regval = pci_config_get8(bgep->cfg_handle, regno);
3934 		break;
3935 
3936 	case 2:
3937 		regval = pci_config_get16(bgep->cfg_handle, regno);
3938 		break;
3939 
3940 	case 4:
3941 		regval = pci_config_get32(bgep->cfg_handle, regno);
3942 		break;
3943 
3944 	case 8:
3945 		regval = pci_config_get64(bgep->cfg_handle, regno);
3946 		break;
3947 	}
3948 
3949 	ppd->pp_acc_data = regval;
3950 }
3951 
3952 static void bge_chip_poke_cfg(bge_t *bgep, bge_peekpoke_t *ppd);
3953 #pragma	no_inline(bge_chip_poke_cfg)
3954 
3955 static void
3956 bge_chip_poke_cfg(bge_t *bgep, bge_peekpoke_t *ppd)
3957 {
3958 	uint64_t regval;
3959 	uint64_t regno;
3960 
3961 	BGE_TRACE(("bge_chip_poke_cfg($%p, $%p)",
3962 		(void *)bgep, (void *)ppd));
3963 
3964 	regno = ppd->pp_acc_offset;
3965 	regval = ppd->pp_acc_data;
3966 
3967 	switch (ppd->pp_acc_size) {
3968 	case 1:
3969 		pci_config_put8(bgep->cfg_handle, regno, regval);
3970 		break;
3971 
3972 	case 2:
3973 		pci_config_put16(bgep->cfg_handle, regno, regval);
3974 		break;
3975 
3976 	case 4:
3977 		pci_config_put32(bgep->cfg_handle, regno, regval);
3978 		break;
3979 
3980 	case 8:
3981 		pci_config_put64(bgep->cfg_handle, regno, regval);
3982 		break;
3983 	}
3984 }
3985 
3986 static void bge_chip_peek_reg(bge_t *bgep, bge_peekpoke_t *ppd);
3987 #pragma	no_inline(bge_chip_peek_reg)
3988 
3989 static void
3990 bge_chip_peek_reg(bge_t *bgep, bge_peekpoke_t *ppd)
3991 {
3992 	uint64_t regval;
3993 	void *regaddr;
3994 
3995 	BGE_TRACE(("bge_chip_peek_reg($%p, $%p)",
3996 		(void *)bgep, (void *)ppd));
3997 
3998 	regaddr = PIO_ADDR(bgep, ppd->pp_acc_offset);
3999 
4000 	switch (ppd->pp_acc_size) {
4001 	case 1:
4002 		regval = ddi_get8(bgep->io_handle, regaddr);
4003 		break;
4004 
4005 	case 2:
4006 		regval = ddi_get16(bgep->io_handle, regaddr);
4007 		break;
4008 
4009 	case 4:
4010 		regval = ddi_get32(bgep->io_handle, regaddr);
4011 		break;
4012 
4013 	case 8:
4014 		regval = ddi_get64(bgep->io_handle, regaddr);
4015 		break;
4016 	}
4017 
4018 	ppd->pp_acc_data = regval;
4019 }
4020 
4021 static void bge_chip_poke_reg(bge_t *bgep, bge_peekpoke_t *ppd);
4022 #pragma	no_inline(bge_chip_peek_reg)
4023 
4024 static void
4025 bge_chip_poke_reg(bge_t *bgep, bge_peekpoke_t *ppd)
4026 {
4027 	uint64_t regval;
4028 	void *regaddr;
4029 
4030 	BGE_TRACE(("bge_chip_poke_reg($%p, $%p)",
4031 		(void *)bgep, (void *)ppd));
4032 
4033 	regaddr = PIO_ADDR(bgep, ppd->pp_acc_offset);
4034 	regval = ppd->pp_acc_data;
4035 
4036 	switch (ppd->pp_acc_size) {
4037 	case 1:
4038 		ddi_put8(bgep->io_handle, regaddr, regval);
4039 		break;
4040 
4041 	case 2:
4042 		ddi_put16(bgep->io_handle, regaddr, regval);
4043 		break;
4044 
4045 	case 4:
4046 		ddi_put32(bgep->io_handle, regaddr, regval);
4047 		break;
4048 
4049 	case 8:
4050 		ddi_put64(bgep->io_handle, regaddr, regval);
4051 		break;
4052 	}
4053 	BGE_PCICHK(bgep);
4054 }
4055 
4056 static void bge_chip_peek_nic(bge_t *bgep, bge_peekpoke_t *ppd);
4057 #pragma	no_inline(bge_chip_peek_nic)
4058 
4059 static void
4060 bge_chip_peek_nic(bge_t *bgep, bge_peekpoke_t *ppd)
4061 {
4062 	uint64_t regoff;
4063 	uint64_t regval;
4064 	void *regaddr;
4065 
4066 	BGE_TRACE(("bge_chip_peek_nic($%p, $%p)",
4067 		(void *)bgep, (void *)ppd));
4068 
4069 	regoff = ppd->pp_acc_offset;
4070 	bge_nic_setwin(bgep, regoff & ~MWBAR_GRANULE_MASK);
4071 	regoff &= MWBAR_GRANULE_MASK;
4072 	regoff += NIC_MEM_WINDOW_OFFSET;
4073 	regaddr = PIO_ADDR(bgep, regoff);
4074 
4075 	switch (ppd->pp_acc_size) {
4076 	case 1:
4077 		regval = ddi_get8(bgep->io_handle, regaddr);
4078 		break;
4079 
4080 	case 2:
4081 		regval = ddi_get16(bgep->io_handle, regaddr);
4082 		break;
4083 
4084 	case 4:
4085 		regval = ddi_get32(bgep->io_handle, regaddr);
4086 		break;
4087 
4088 	case 8:
4089 		regval = ddi_get64(bgep->io_handle, regaddr);
4090 		break;
4091 	}
4092 
4093 	ppd->pp_acc_data = regval;
4094 }
4095 
4096 static void bge_chip_poke_nic(bge_t *bgep, bge_peekpoke_t *ppd);
4097 #pragma	no_inline(bge_chip_poke_nic)
4098 
4099 static void
4100 bge_chip_poke_nic(bge_t *bgep, bge_peekpoke_t *ppd)
4101 {
4102 	uint64_t regoff;
4103 	uint64_t regval;
4104 	void *regaddr;
4105 
4106 	BGE_TRACE(("bge_chip_poke_nic($%p, $%p)",
4107 		(void *)bgep, (void *)ppd));
4108 
4109 	regoff = ppd->pp_acc_offset;
4110 	bge_nic_setwin(bgep, regoff & ~MWBAR_GRANULE_MASK);
4111 	regoff &= MWBAR_GRANULE_MASK;
4112 	regoff += NIC_MEM_WINDOW_OFFSET;
4113 	regaddr = PIO_ADDR(bgep, regoff);
4114 	regval = ppd->pp_acc_data;
4115 
4116 	switch (ppd->pp_acc_size) {
4117 	case 1:
4118 		ddi_put8(bgep->io_handle, regaddr, regval);
4119 		break;
4120 
4121 	case 2:
4122 		ddi_put16(bgep->io_handle, regaddr, regval);
4123 		break;
4124 
4125 	case 4:
4126 		ddi_put32(bgep->io_handle, regaddr, regval);
4127 		break;
4128 
4129 	case 8:
4130 		ddi_put64(bgep->io_handle, regaddr, regval);
4131 		break;
4132 	}
4133 	BGE_PCICHK(bgep);
4134 }
4135 
4136 static void bge_chip_peek_mii(bge_t *bgep, bge_peekpoke_t *ppd);
4137 #pragma	no_inline(bge_chip_peek_mii)
4138 
4139 static void
4140 bge_chip_peek_mii(bge_t *bgep, bge_peekpoke_t *ppd)
4141 {
4142 	BGE_TRACE(("bge_chip_peek_mii($%p, $%p)",
4143 		(void *)bgep, (void *)ppd));
4144 
4145 	ppd->pp_acc_data = bge_mii_get16(bgep, ppd->pp_acc_offset/2);
4146 }
4147 
4148 static void bge_chip_poke_mii(bge_t *bgep, bge_peekpoke_t *ppd);
4149 #pragma	no_inline(bge_chip_poke_mii)
4150 
4151 static void
4152 bge_chip_poke_mii(bge_t *bgep, bge_peekpoke_t *ppd)
4153 {
4154 	BGE_TRACE(("bge_chip_poke_mii($%p, $%p)",
4155 		(void *)bgep, (void *)ppd));
4156 
4157 	bge_mii_put16(bgep, ppd->pp_acc_offset/2, ppd->pp_acc_data);
4158 }
4159 
4160 #if	BGE_SEE_IO32
4161 
4162 static void bge_chip_peek_seeprom(bge_t *bgep, bge_peekpoke_t *ppd);
4163 #pragma	no_inline(bge_chip_peek_seeprom)
4164 
4165 static void
4166 bge_chip_peek_seeprom(bge_t *bgep, bge_peekpoke_t *ppd)
4167 {
4168 	uint32_t data;
4169 	int err;
4170 
4171 	BGE_TRACE(("bge_chip_peek_seeprom($%p, $%p)",
4172 		(void *)bgep, (void *)ppd));
4173 
4174 	err = bge_nvmem_rw32(bgep, BGE_SEE_READ, ppd->pp_acc_offset, &data);
4175 	ppd->pp_acc_data = err ? ~0ull : data;
4176 }
4177 
4178 static void bge_chip_poke_seeprom(bge_t *bgep, bge_peekpoke_t *ppd);
4179 #pragma	no_inline(bge_chip_poke_seeprom)
4180 
4181 static void
4182 bge_chip_poke_seeprom(bge_t *bgep, bge_peekpoke_t *ppd)
4183 {
4184 	uint32_t data;
4185 
4186 	BGE_TRACE(("bge_chip_poke_seeprom($%p, $%p)",
4187 		(void *)bgep, (void *)ppd));
4188 
4189 	data = ppd->pp_acc_data;
4190 	(void) bge_nvmem_rw32(bgep, BGE_SEE_WRITE, ppd->pp_acc_offset, &data);
4191 }
4192 #endif	/* BGE_SEE_IO32 */
4193 
4194 #if	BGE_FLASH_IO32
4195 
4196 static void bge_chip_peek_flash(bge_t *bgep, bge_peekpoke_t *ppd);
4197 #pragma	no_inline(bge_chip_peek_flash)
4198 
4199 static void
4200 bge_chip_peek_flash(bge_t *bgep, bge_peekpoke_t *ppd)
4201 {
4202 	uint32_t data;
4203 	int err;
4204 
4205 	BGE_TRACE(("bge_chip_peek_flash($%p, $%p)",
4206 		(void *)bgep, (void *)ppd));
4207 
4208 	err = bge_nvmem_rw32(bgep, BGE_FLASH_READ, ppd->pp_acc_offset, &data);
4209 	ppd->pp_acc_data = err ? ~0ull : data;
4210 }
4211 
4212 static void bge_chip_poke_flash(bge_t *bgep, bge_peekpoke_t *ppd);
4213 #pragma	no_inline(bge_chip_poke_flash)
4214 
4215 static void
4216 bge_chip_poke_flash(bge_t *bgep, bge_peekpoke_t *ppd)
4217 {
4218 	uint32_t data;
4219 
4220 	BGE_TRACE(("bge_chip_poke_flash($%p, $%p)",
4221 		(void *)bgep, (void *)ppd));
4222 
4223 	data = ppd->pp_acc_data;
4224 	(void) bge_nvmem_rw32(bgep, BGE_FLASH_WRITE,
4225 	    ppd->pp_acc_offset, &data);
4226 }
4227 #endif	/* BGE_FLASH_IO32 */
4228 
4229 static void bge_chip_peek_mem(bge_t *bgep, bge_peekpoke_t *ppd);
4230 #pragma	no_inline(bge_chip_peek_mem)
4231 
4232 static void
4233 bge_chip_peek_mem(bge_t *bgep, bge_peekpoke_t *ppd)
4234 {
4235 	uint64_t regval;
4236 	void *vaddr;
4237 
4238 	BGE_TRACE(("bge_chip_peek_bge($%p, $%p)",
4239 		(void *)bgep, (void *)ppd));
4240 
4241 	vaddr = (void *)(uintptr_t)ppd->pp_acc_offset;
4242 
4243 	switch (ppd->pp_acc_size) {
4244 	case 1:
4245 		regval = *(uint8_t *)vaddr;
4246 		break;
4247 
4248 	case 2:
4249 		regval = *(uint16_t *)vaddr;
4250 		break;
4251 
4252 	case 4:
4253 		regval = *(uint32_t *)vaddr;
4254 		break;
4255 
4256 	case 8:
4257 		regval = *(uint64_t *)vaddr;
4258 		break;
4259 	}
4260 
4261 	BGE_DEBUG(("bge_chip_peek_mem($%p, $%p) peeked 0x%llx from $%p",
4262 		(void *)bgep, (void *)ppd, regval, vaddr));
4263 
4264 	ppd->pp_acc_data = regval;
4265 }
4266 
4267 static void bge_chip_poke_mem(bge_t *bgep, bge_peekpoke_t *ppd);
4268 #pragma	no_inline(bge_chip_poke_mem)
4269 
4270 static void
4271 bge_chip_poke_mem(bge_t *bgep, bge_peekpoke_t *ppd)
4272 {
4273 	uint64_t regval;
4274 	void *vaddr;
4275 
4276 	BGE_TRACE(("bge_chip_poke_mem($%p, $%p)",
4277 		(void *)bgep, (void *)ppd));
4278 
4279 	vaddr = (void *)(uintptr_t)ppd->pp_acc_offset;
4280 	regval = ppd->pp_acc_data;
4281 
4282 	BGE_DEBUG(("bge_chip_poke_mem($%p, $%p) poking 0x%llx at $%p",
4283 		(void *)bgep, (void *)ppd, regval, vaddr));
4284 
4285 	switch (ppd->pp_acc_size) {
4286 	case 1:
4287 		*(uint8_t *)vaddr = (uint8_t)regval;
4288 		break;
4289 
4290 	case 2:
4291 		*(uint16_t *)vaddr = (uint16_t)regval;
4292 		break;
4293 
4294 	case 4:
4295 		*(uint32_t *)vaddr = (uint32_t)regval;
4296 		break;
4297 
4298 	case 8:
4299 		*(uint64_t *)vaddr = (uint64_t)regval;
4300 		break;
4301 	}
4302 }
4303 
4304 static enum ioc_reply bge_pp_ioctl(bge_t *bgep, int cmd, mblk_t *mp,
4305 					struct iocblk *iocp);
4306 #pragma	no_inline(bge_pp_ioctl)
4307 
4308 static enum ioc_reply
4309 bge_pp_ioctl(bge_t *bgep, int cmd, mblk_t *mp, struct iocblk *iocp)
4310 {
4311 	void (*ppfn)(bge_t *bgep, bge_peekpoke_t *ppd);
4312 	bge_peekpoke_t *ppd;
4313 	dma_area_t *areap;
4314 	uint64_t sizemask;
4315 	uint64_t mem_va;
4316 	uint64_t maxoff;
4317 	boolean_t peek;
4318 
4319 	switch (cmd) {
4320 	default:
4321 		/* NOTREACHED */
4322 		bge_error(bgep, "bge_pp_ioctl: invalid cmd 0x%x", cmd);
4323 		return (IOC_INVAL);
4324 
4325 	case BGE_PEEK:
4326 		peek = B_TRUE;
4327 		break;
4328 
4329 	case BGE_POKE:
4330 		peek = B_FALSE;
4331 		break;
4332 	}
4333 
4334 	/*
4335 	 * Validate format of ioctl
4336 	 */
4337 	if (iocp->ioc_count != sizeof (bge_peekpoke_t))
4338 		return (IOC_INVAL);
4339 	if (mp->b_cont == NULL)
4340 		return (IOC_INVAL);
4341 	ppd = (bge_peekpoke_t *)mp->b_cont->b_rptr;
4342 
4343 	/*
4344 	 * Validate request parameters
4345 	 */
4346 	switch (ppd->pp_acc_space) {
4347 	default:
4348 		return (IOC_INVAL);
4349 
4350 	case BGE_PP_SPACE_CFG:
4351 		/*
4352 		 * Config space
4353 		 */
4354 		sizemask = 8|4|2|1;
4355 		mem_va = 0;
4356 		maxoff = PCI_CONF_HDR_SIZE;
4357 		ppfn = peek ? bge_chip_peek_cfg : bge_chip_poke_cfg;
4358 		break;
4359 
4360 	case BGE_PP_SPACE_REG:
4361 		/*
4362 		 * Memory-mapped I/O space
4363 		 */
4364 		sizemask = 8|4|2|1;
4365 		mem_va = 0;
4366 		maxoff = RIAAR_REGISTER_MAX;
4367 		ppfn = peek ? bge_chip_peek_reg : bge_chip_poke_reg;
4368 		break;
4369 
4370 	case BGE_PP_SPACE_NIC:
4371 		/*
4372 		 * NIC on-chip memory
4373 		 */
4374 		sizemask = 8|4|2|1;
4375 		mem_va = 0;
4376 		maxoff = MWBAR_ONCHIP_MAX;
4377 		ppfn = peek ? bge_chip_peek_nic : bge_chip_poke_nic;
4378 		break;
4379 
4380 	case BGE_PP_SPACE_MII:
4381 		/*
4382 		 * PHY's MII registers
4383 		 * NB: all PHY registers are two bytes, but the
4384 		 * addresses increment in ones (word addressing).
4385 		 * So we scale the address here, then undo the
4386 		 * transformation inside the peek/poke functions.
4387 		 */
4388 		ppd->pp_acc_offset *= 2;
4389 		sizemask = 2;
4390 		mem_va = 0;
4391 		maxoff = (MII_MAXREG+1)*2;
4392 		ppfn = peek ? bge_chip_peek_mii : bge_chip_poke_mii;
4393 		break;
4394 
4395 #if	BGE_SEE_IO32
4396 	case BGE_PP_SPACE_SEEPROM:
4397 		/*
4398 		 * Attached SEEPROM(s), if any.
4399 		 * NB: we use the high-order bits of the 'address' as
4400 		 * a device select to accommodate multiple SEEPROMS,
4401 		 * If each one is the maximum size (64kbytes), this
4402 		 * makes them appear contiguous.  Otherwise, there may
4403 		 * be holes in the mapping.  ENxS doesn't have any
4404 		 * SEEPROMs anyway ...
4405 		 */
4406 		sizemask = 4;
4407 		mem_va = 0;
4408 		maxoff = SEEPROM_DEV_AND_ADDR_MASK;
4409 		ppfn = peek ? bge_chip_peek_seeprom : bge_chip_poke_seeprom;
4410 		break;
4411 #endif	/* BGE_SEE_IO32 */
4412 
4413 #if	BGE_FLASH_IO32
4414 	case BGE_PP_SPACE_FLASH:
4415 		/*
4416 		 * Attached Flash device (if any); a maximum of one device
4417 		 * is currently supported.  But it can be up to 1MB (unlike
4418 		 * the 64k limit on SEEPROMs) so why would you need more ;-)
4419 		 */
4420 		sizemask = 4;
4421 		mem_va = 0;
4422 		maxoff = NVM_FLASH_ADDR_MASK;
4423 		ppfn = peek ? bge_chip_peek_flash : bge_chip_poke_flash;
4424 		break;
4425 #endif	/* BGE_FLASH_IO32 */
4426 
4427 	case BGE_PP_SPACE_BGE:
4428 		/*
4429 		 * BGE data structure!
4430 		 */
4431 		sizemask = 8|4|2|1;
4432 		mem_va = (uintptr_t)bgep;
4433 		maxoff = sizeof (*bgep);
4434 		ppfn = peek ? bge_chip_peek_mem : bge_chip_poke_mem;
4435 		break;
4436 
4437 	case BGE_PP_SPACE_STATUS:
4438 	case BGE_PP_SPACE_STATISTICS:
4439 	case BGE_PP_SPACE_TXDESC:
4440 	case BGE_PP_SPACE_TXBUFF:
4441 	case BGE_PP_SPACE_RXDESC:
4442 	case BGE_PP_SPACE_RXBUFF:
4443 		/*
4444 		 * Various DMA_AREAs
4445 		 */
4446 		switch (ppd->pp_acc_space) {
4447 		case BGE_PP_SPACE_TXDESC:
4448 			areap = &bgep->tx_desc;
4449 			break;
4450 		case BGE_PP_SPACE_TXBUFF:
4451 			areap = &bgep->tx_buff[0];
4452 			break;
4453 		case BGE_PP_SPACE_RXDESC:
4454 			areap = &bgep->rx_desc[0];
4455 			break;
4456 		case BGE_PP_SPACE_RXBUFF:
4457 			areap = &bgep->rx_buff[0];
4458 			break;
4459 		case BGE_PP_SPACE_STATUS:
4460 			areap = &bgep->status_block;
4461 			break;
4462 		case BGE_PP_SPACE_STATISTICS:
4463 			if (bgep->chipid.statistic_type == BGE_STAT_BLK)
4464 				areap = &bgep->statistics;
4465 			break;
4466 		}
4467 
4468 		sizemask = 8|4|2|1;
4469 		mem_va = (uintptr_t)areap->mem_va;
4470 		maxoff = areap->alength;
4471 		ppfn = peek ? bge_chip_peek_mem : bge_chip_poke_mem;
4472 		break;
4473 	}
4474 
4475 	switch (ppd->pp_acc_size) {
4476 	default:
4477 		return (IOC_INVAL);
4478 
4479 	case 8:
4480 	case 4:
4481 	case 2:
4482 	case 1:
4483 		if ((ppd->pp_acc_size & sizemask) == 0)
4484 			return (IOC_INVAL);
4485 		break;
4486 	}
4487 
4488 	if ((ppd->pp_acc_offset % ppd->pp_acc_size) != 0)
4489 		return (IOC_INVAL);
4490 
4491 	if (ppd->pp_acc_offset >= maxoff)
4492 		return (IOC_INVAL);
4493 
4494 	if (ppd->pp_acc_offset+ppd->pp_acc_size > maxoff)
4495 		return (IOC_INVAL);
4496 
4497 	/*
4498 	 * All OK - go do it!
4499 	 */
4500 	ppd->pp_acc_offset += mem_va;
4501 	(*ppfn)(bgep, ppd);
4502 	return (peek ? IOC_REPLY : IOC_ACK);
4503 }
4504 
4505 static enum ioc_reply bge_diag_ioctl(bge_t *bgep, int cmd, mblk_t *mp,
4506 					struct iocblk *iocp);
4507 #pragma	no_inline(bge_diag_ioctl)
4508 
4509 static enum ioc_reply
4510 bge_diag_ioctl(bge_t *bgep, int cmd, mblk_t *mp, struct iocblk *iocp)
4511 {
4512 	ASSERT(mutex_owned(bgep->genlock));
4513 
4514 	switch (cmd) {
4515 	default:
4516 		/* NOTREACHED */
4517 		bge_error(bgep, "bge_diag_ioctl: invalid cmd 0x%x", cmd);
4518 		return (IOC_INVAL);
4519 
4520 	case BGE_DIAG:
4521 		/*
4522 		 * Currently a no-op
4523 		 */
4524 		return (IOC_ACK);
4525 
4526 	case BGE_PEEK:
4527 	case BGE_POKE:
4528 		return (bge_pp_ioctl(bgep, cmd, mp, iocp));
4529 
4530 	case BGE_PHY_RESET:
4531 		return (IOC_RESTART_ACK);
4532 
4533 	case BGE_SOFT_RESET:
4534 	case BGE_HARD_RESET:
4535 		/*
4536 		 * Reset and reinitialise the 570x hardware
4537 		 */
4538 		bge_restart(bgep, cmd == BGE_HARD_RESET);
4539 		return (IOC_ACK);
4540 	}
4541 
4542 	/* NOTREACHED */
4543 }
4544 
4545 #endif	/* BGE_DEBUGGING || BGE_DO_PPIO */
4546 
4547 static enum ioc_reply bge_mii_ioctl(bge_t *bgep, int cmd, mblk_t *mp,
4548 				    struct iocblk *iocp);
4549 #pragma	no_inline(bge_mii_ioctl)
4550 
4551 static enum ioc_reply
4552 bge_mii_ioctl(bge_t *bgep, int cmd, mblk_t *mp, struct iocblk *iocp)
4553 {
4554 	struct bge_mii_rw *miirwp;
4555 
4556 	/*
4557 	 * Validate format of ioctl
4558 	 */
4559 	if (iocp->ioc_count != sizeof (struct bge_mii_rw))
4560 		return (IOC_INVAL);
4561 	if (mp->b_cont == NULL)
4562 		return (IOC_INVAL);
4563 	miirwp = (struct bge_mii_rw *)mp->b_cont->b_rptr;
4564 
4565 	/*
4566 	 * Validate request parameters ...
4567 	 */
4568 	if (miirwp->mii_reg > MII_MAXREG)
4569 		return (IOC_INVAL);
4570 
4571 	switch (cmd) {
4572 	default:
4573 		/* NOTREACHED */
4574 		bge_error(bgep, "bge_mii_ioctl: invalid cmd 0x%x", cmd);
4575 		return (IOC_INVAL);
4576 
4577 	case BGE_MII_READ:
4578 		miirwp->mii_data = bge_mii_get16(bgep, miirwp->mii_reg);
4579 		return (IOC_REPLY);
4580 
4581 	case BGE_MII_WRITE:
4582 		bge_mii_put16(bgep, miirwp->mii_reg, miirwp->mii_data);
4583 		return (IOC_ACK);
4584 	}
4585 
4586 	/* NOTREACHED */
4587 }
4588 
4589 #if	BGE_SEE_IO32
4590 
4591 static enum ioc_reply bge_see_ioctl(bge_t *bgep, int cmd, mblk_t *mp,
4592 				    struct iocblk *iocp);
4593 #pragma	no_inline(bge_see_ioctl)
4594 
4595 static enum ioc_reply
4596 bge_see_ioctl(bge_t *bgep, int cmd, mblk_t *mp, struct iocblk *iocp)
4597 {
4598 	struct bge_see_rw *seerwp;
4599 
4600 	/*
4601 	 * Validate format of ioctl
4602 	 */
4603 	if (iocp->ioc_count != sizeof (struct bge_see_rw))
4604 		return (IOC_INVAL);
4605 	if (mp->b_cont == NULL)
4606 		return (IOC_INVAL);
4607 	seerwp = (struct bge_see_rw *)mp->b_cont->b_rptr;
4608 
4609 	/*
4610 	 * Validate request parameters ...
4611 	 */
4612 	if (seerwp->see_addr & ~SEEPROM_DEV_AND_ADDR_MASK)
4613 		return (IOC_INVAL);
4614 
4615 	switch (cmd) {
4616 	default:
4617 		/* NOTREACHED */
4618 		bge_error(bgep, "bge_see_ioctl: invalid cmd 0x%x", cmd);
4619 		return (IOC_INVAL);
4620 
4621 	case BGE_SEE_READ:
4622 	case BGE_SEE_WRITE:
4623 		iocp->ioc_error = bge_nvmem_rw32(bgep, cmd,
4624 		    seerwp->see_addr, &seerwp->see_data);
4625 		return (IOC_REPLY);
4626 	}
4627 
4628 	/* NOTREACHED */
4629 }
4630 
4631 #endif	/* BGE_SEE_IO32 */
4632 
4633 #if	BGE_FLASH_IO32
4634 
4635 static enum ioc_reply bge_flash_ioctl(bge_t *bgep, int cmd, mblk_t *mp,
4636 				    struct iocblk *iocp);
4637 #pragma	no_inline(bge_flash_ioctl)
4638 
4639 static enum ioc_reply
4640 bge_flash_ioctl(bge_t *bgep, int cmd, mblk_t *mp, struct iocblk *iocp)
4641 {
4642 	struct bge_flash_rw *flashrwp;
4643 
4644 	/*
4645 	 * Validate format of ioctl
4646 	 */
4647 	if (iocp->ioc_count != sizeof (struct bge_flash_rw))
4648 		return (IOC_INVAL);
4649 	if (mp->b_cont == NULL)
4650 		return (IOC_INVAL);
4651 	flashrwp = (struct bge_flash_rw *)mp->b_cont->b_rptr;
4652 
4653 	/*
4654 	 * Validate request parameters ...
4655 	 */
4656 	if (flashrwp->flash_addr & ~NVM_FLASH_ADDR_MASK)
4657 		return (IOC_INVAL);
4658 
4659 	switch (cmd) {
4660 	default:
4661 		/* NOTREACHED */
4662 		bge_error(bgep, "bge_flash_ioctl: invalid cmd 0x%x", cmd);
4663 		return (IOC_INVAL);
4664 
4665 	case BGE_FLASH_READ:
4666 	case BGE_FLASH_WRITE:
4667 		iocp->ioc_error = bge_nvmem_rw32(bgep, cmd,
4668 		    flashrwp->flash_addr, &flashrwp->flash_data);
4669 		return (IOC_REPLY);
4670 	}
4671 
4672 	/* NOTREACHED */
4673 }
4674 
4675 #endif	/* BGE_FLASH_IO32 */
4676 
4677 enum ioc_reply bge_chip_ioctl(bge_t *bgep, queue_t *wq, mblk_t *mp,
4678 				struct iocblk *iocp);
4679 #pragma	no_inline(bge_chip_ioctl)
4680 
4681 enum ioc_reply
4682 bge_chip_ioctl(bge_t *bgep, queue_t *wq, mblk_t *mp, struct iocblk *iocp)
4683 {
4684 	int cmd;
4685 
4686 	BGE_TRACE(("bge_chip_ioctl($%p, $%p, $%p, $%p)",
4687 		(void *)bgep, (void *)wq, (void *)mp, (void *)iocp));
4688 
4689 	ASSERT(mutex_owned(bgep->genlock));
4690 
4691 	cmd = iocp->ioc_cmd;
4692 	switch (cmd) {
4693 	default:
4694 		/* NOTREACHED */
4695 		bge_error(bgep, "bge_chip_ioctl: invalid cmd 0x%x", cmd);
4696 		return (IOC_INVAL);
4697 
4698 	case BGE_DIAG:
4699 	case BGE_PEEK:
4700 	case BGE_POKE:
4701 	case BGE_PHY_RESET:
4702 	case BGE_SOFT_RESET:
4703 	case BGE_HARD_RESET:
4704 #if	BGE_DEBUGGING || BGE_DO_PPIO
4705 		return (bge_diag_ioctl(bgep, cmd, mp, iocp));
4706 #else
4707 		return (IOC_INVAL);
4708 #endif	/* BGE_DEBUGGING || BGE_DO_PPIO */
4709 
4710 	case BGE_MII_READ:
4711 	case BGE_MII_WRITE:
4712 		return (bge_mii_ioctl(bgep, cmd, mp, iocp));
4713 
4714 #if	BGE_SEE_IO32
4715 	case BGE_SEE_READ:
4716 	case BGE_SEE_WRITE:
4717 		return (bge_see_ioctl(bgep, cmd, mp, iocp));
4718 #endif	/* BGE_SEE_IO32 */
4719 
4720 #if	BGE_FLASH_IO32
4721 	case BGE_FLASH_READ:
4722 	case BGE_FLASH_WRITE:
4723 		return (bge_flash_ioctl(bgep, cmd, mp, iocp));
4724 #endif	/* BGE_FLASH_IO32 */
4725 	}
4726 
4727 	/* NOTREACHED */
4728 }
4729 
4730 void
4731 bge_chip_blank(void *arg, time_t ticks, uint_t count)
4732 {
4733 	bge_t *bgep = arg;
4734 
4735 	bge_reg_put32(bgep, RCV_COALESCE_TICKS_REG, ticks);
4736 	bge_reg_put32(bgep, RCV_COALESCE_MAX_BD_REG, count);
4737 }
4738