xref: /titanic_44/usr/src/uts/common/io/bge/bge_chip2.c (revision 587032cf0967234b39ccb50adca936a367841063)
1 /*
2  * CDDL HEADER START
3  *
4  * The contents of this file are subject to the terms of the
5  * Common Development and Distribution License (the "License").
6  * You may not use this file except in compliance with the License.
7  *
8  * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
9  * or http://www.opensolaris.org/os/licensing.
10  * See the License for the specific language governing permissions
11  * and limitations under the License.
12  *
13  * When distributing Covered Code, include this CDDL HEADER in each
14  * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
15  * If applicable, add the following below this CDDL HEADER, with the
16  * fields enclosed by brackets "[]" replaced with your own identifying
17  * information: Portions Copyright [yyyy] [name of copyright owner]
18  *
19  * CDDL HEADER END
20  */
21 
22 /*
23  * Copyright 2006 Sun Microsystems, Inc.  All rights reserved.
24  * Use is subject to license terms.
25  */
26 
27 #pragma ident	"%Z%%M%	%I%	%E% SMI"
28 
29 #include "sys/bge_impl2.h"
30 
31 #define	PIO_ADDR(bgep, offset)	((void *)((caddr_t)(bgep)->io_regs+(offset)))
32 
33 /*
34  * Future features ... ?
35  */
36 #define	BGE_CFG_IO8	0	/* 8/16-bit cfg space BIS/BIC	*/
37 #define	BGE_IND_IO32	0	/* indirect access code		*/
38 #define	BGE_SEE_IO32	1	/* SEEPROM access code		*/
39 #define	BGE_FLASH_IO32	1	/* FLASH access code		*/
40 
41 /*
42  * BGE MSI tunable:
43  *
44  * By default MSI is enabled on all supported platforms but it is disabled
45  * for some Broadcom chips due to known MSI hardware issues. Currently MSI
46  * is enabled only for 5714C A2 and 5715C A2 broadcom chips.
47  */
48 #if defined(__sparc)
49 boolean_t bge_enable_msi = B_TRUE;
50 #else
51 boolean_t bge_enable_msi = B_FALSE;
52 #endif
53 
54 /*
55  * Property names
56  */
57 static char knownids_propname[] = "bge-known-subsystems";
58 
59 /*
60  * Patchable globals:
61  *
62  *	bge_autorecover
63  *		Enables/disables automatic recovery after fault detection
64  *
65  *	bge_mlcr_default
66  *		Value to program into the MLCR; controls the chip's GPIO pins
67  *
68  *	bge_dma_{rd,wr}prio
69  *		Relative priorities of DMA reads & DMA writes respectively.
70  *		These may each be patched to any value 0-3.  Equal values
71  *		will give "fair" (round-robin) arbitration for PCI access.
72  *		Unequal values will give one or the other function priority.
73  *
74  *	bge_dma_rwctrl
75  *		Value to put in the Read/Write DMA control register.  See
76  *	        the Broadcom PRM for things you can fiddle with in this
77  *		register ...
78  *
79  *	bge_{tx,rx}_{count,ticks}_{norm,intr}
80  *		Send/receive interrupt coalescing parameters.  Counts are
81  *		#s of descriptors, ticks are in microseconds.  *norm* values
82  *		apply between status updates/interrupts; the *intr* values
83  *		refer to the 'during-interrupt' versions - see the PRM.
84  *
85  *		NOTE: these values have been determined by measurement. They
86  *		differ significantly from the values recommended in the PRM.
87  */
88 static uint32_t bge_autorecover = 1;
89 static uint32_t bge_mlcr_default = MLCR_DEFAULT;
90 static uint32_t bge_mlcr_default_5714 = MLCR_DEFAULT_5714;
91 
92 static uint32_t bge_dma_rdprio = 1;
93 static uint32_t bge_dma_wrprio = 0;
94 static uint32_t bge_dma_rwctrl = PDRWCR_VAR_DEFAULT;
95 static uint32_t bge_dma_rwctrl_5721 = PDRWCR_VAR_5721;
96 static uint32_t bge_dma_rwctrl_5714 = PDRWCR_VAR_5714;
97 static uint32_t bge_dma_rwctrl_5715 = PDRWCR_VAR_5715;
98 
99 uint32_t bge_rx_ticks_norm = 128;
100 uint32_t bge_tx_ticks_norm = 2048;		/* 8 for FJ2+ !?!?	*/
101 uint32_t bge_rx_count_norm = 8;
102 uint32_t bge_tx_count_norm = 128;
103 
104 static uint32_t bge_rx_ticks_intr = 128;
105 static uint32_t bge_tx_ticks_intr = 0;		/* 8 for FJ2+ !?!?	*/
106 static uint32_t bge_rx_count_intr = 2;
107 static uint32_t bge_tx_count_intr = 0;
108 
109 /*
110  * Memory pool configuration parameters.
111  *
112  * These are generally specific to each member of the chip family, since
113  * each one may have a different memory size/configuration.
114  *
115  * Setting the mbuf pool length for a specific type of chip to 0 inhibits
116  * the driver from programming the various registers; instead they are left
117  * at their hardware defaults.  This is the preferred option for later chips
118  * (5705+), whereas the older chips *required* these registers to be set,
119  * since the h/w default was 0 ;-(
120  */
121 static uint32_t bge_mbuf_pool_base	= MBUF_POOL_BASE_DEFAULT;
122 static uint32_t bge_mbuf_pool_base_5704	= MBUF_POOL_BASE_5704;
123 static uint32_t bge_mbuf_pool_base_5705	= MBUF_POOL_BASE_5705;
124 static uint32_t bge_mbuf_pool_base_5721 = MBUF_POOL_BASE_5721;
125 static uint32_t bge_mbuf_pool_len	= MBUF_POOL_LENGTH_DEFAULT;
126 static uint32_t bge_mbuf_pool_len_5704	= MBUF_POOL_LENGTH_5704;
127 static uint32_t bge_mbuf_pool_len_5705	= 0;	/* use h/w default	*/
128 static uint32_t bge_mbuf_pool_len_5721	= 0;
129 
130 /*
131  * Various high and low water marks, thresholds, etc ...
132  *
133  * Note: these are taken from revision 7 of the PRM, and some are different
134  * from both the values in earlier PRMs *and* those determined experimentally
135  * and used in earlier versions of this driver ...
136  */
137 static uint32_t bge_mbuf_hi_water	= MBUF_HIWAT_DEFAULT;
138 static uint32_t bge_mbuf_lo_water_rmac	= MAC_RX_MBUF_LOWAT_DEFAULT;
139 static uint32_t bge_mbuf_lo_water_rdma	= RDMA_MBUF_LOWAT_DEFAULT;
140 
141 static uint32_t bge_dmad_lo_water	= DMAD_POOL_LOWAT_DEFAULT;
142 static uint32_t bge_dmad_hi_water	= DMAD_POOL_HIWAT_DEFAULT;
143 static uint32_t bge_lowat_recv_frames	= LOWAT_MAX_RECV_FRAMES_DEFAULT;
144 
145 static uint32_t bge_replenish_std	= STD_RCV_BD_REPLENISH_DEFAULT;
146 static uint32_t bge_replenish_mini	= MINI_RCV_BD_REPLENISH_DEFAULT;
147 static uint32_t bge_replenish_jumbo	= JUMBO_RCV_BD_REPLENISH_DEFAULT;
148 
149 static uint32_t	bge_watchdog_count	= 1 << 16;
150 static uint16_t bge_dma_miss_limit	= 20;
151 
152 static uint32_t bge_stop_start_on_sync	= 0;
153 
154 boolean_t bge_jumbo_enable		= B_TRUE;
155 static uint32_t bge_default_jumbo_size	= BGE_JUMBO_BUFF_SIZE;
156 
157 /*
158  * ========== Low-level chip & ring buffer manipulation ==========
159  */
160 
161 #define	BGE_DBG		BGE_DBG_REGS	/* debug flag for this code	*/
162 
163 
164 /*
165  * Config space read-modify-write routines
166  */
167 
168 #if	BGE_CFG_IO8
169 
170 /*
171  * 8- and 16-bit set/clr operations are not used; all the config registers
172  * that we need to do bit-twiddling on are 32 bits wide.  I'll leave the
173  * code here, though, in case we ever find that we do want it after all ...
174  */
175 
176 static void bge_cfg_set8(bge_t *bgep, bge_regno_t regno, uint8_t bits);
177 #pragma	inline(bge_cfg_set8)
178 
179 static void
180 bge_cfg_set8(bge_t *bgep, bge_regno_t regno, uint8_t bits)
181 {
182 	uint8_t regval;
183 
184 	BGE_TRACE(("bge_cfg_set8($%p, 0x%lx, 0x%x)",
185 		(void *)bgep, regno, bits));
186 
187 	regval = pci_config_get8(bgep->cfg_handle, regno);
188 
189 	BGE_DEBUG(("bge_cfg_set8($%p, 0x%lx, 0x%x): 0x%x => 0x%x",
190 		(void *)bgep, regno, bits, regval, regval | bits));
191 
192 	regval |= bits;
193 	pci_config_put8(bgep->cfg_handle, regno, regval);
194 }
195 
196 static void bge_cfg_clr8(bge_t *bgep, bge_regno_t regno, uint8_t bits);
197 #pragma	inline(bge_cfg_clr8)
198 
199 static void
200 bge_cfg_clr8(bge_t *bgep, bge_regno_t regno, uint8_t bits)
201 {
202 	uint8_t regval;
203 
204 	BGE_TRACE(("bge_cfg_clr8($%p, 0x%lx, 0x%x)",
205 		(void *)bgep, regno, bits));
206 
207 	regval = pci_config_get8(bgep->cfg_handle, regno);
208 
209 	BGE_DEBUG(("bge_cfg_clr8($%p, 0x%lx, 0x%x): 0x%x => 0x%x",
210 		(void *)bgep, regno, bits, regval, regval & ~bits));
211 
212 	regval &= ~bits;
213 	pci_config_put8(bgep->cfg_handle, regno, regval);
214 }
215 
216 static void bge_cfg_set16(bge_t *bgep, bge_regno_t regno, uint16_t bits);
217 #pragma	inline(bge_cfg_set16)
218 
219 static void
220 bge_cfg_set16(bge_t *bgep, bge_regno_t regno, uint16_t bits)
221 {
222 	uint16_t regval;
223 
224 	BGE_TRACE(("bge_cfg_set16($%p, 0x%lx, 0x%x)",
225 		(void *)bgep, regno, bits));
226 
227 	regval = pci_config_get16(bgep->cfg_handle, regno);
228 
229 	BGE_DEBUG(("bge_cfg_set16($%p, 0x%lx, 0x%x): 0x%x => 0x%x",
230 		(void *)bgep, regno, bits, regval, regval | bits));
231 
232 	regval |= bits;
233 	pci_config_put16(bgep->cfg_handle, regno, regval);
234 }
235 
236 static void bge_cfg_clr16(bge_t *bgep, bge_regno_t regno, uint16_t bits);
237 #pragma	inline(bge_cfg_clr16)
238 
239 static void
240 bge_cfg_clr16(bge_t *bgep, bge_regno_t regno, uint16_t bits)
241 {
242 	uint16_t regval;
243 
244 	BGE_TRACE(("bge_cfg_clr16($%p, 0x%lx, 0x%x)",
245 		(void *)bgep, regno, bits));
246 
247 	regval = pci_config_get16(bgep->cfg_handle, regno);
248 
249 	BGE_DEBUG(("bge_cfg_clr16($%p, 0x%lx, 0x%x): 0x%x => 0x%x",
250 		(void *)bgep, regno, bits, regval, regval & ~bits));
251 
252 	regval &= ~bits;
253 	pci_config_put16(bgep->cfg_handle, regno, regval);
254 }
255 
256 #endif	/* BGE_CFG_IO8 */
257 
258 static void bge_cfg_set32(bge_t *bgep, bge_regno_t regno, uint32_t bits);
259 #pragma	inline(bge_cfg_set32)
260 
261 static void
262 bge_cfg_set32(bge_t *bgep, bge_regno_t regno, uint32_t bits)
263 {
264 	uint32_t regval;
265 
266 	BGE_TRACE(("bge_cfg_set32($%p, 0x%lx, 0x%x)",
267 		(void *)bgep, regno, bits));
268 
269 	regval = pci_config_get32(bgep->cfg_handle, regno);
270 
271 	BGE_DEBUG(("bge_cfg_set32($%p, 0x%lx, 0x%x): 0x%x => 0x%x",
272 		(void *)bgep, regno, bits, regval, regval | bits));
273 
274 	regval |= bits;
275 	pci_config_put32(bgep->cfg_handle, regno, regval);
276 }
277 
278 static void bge_cfg_clr32(bge_t *bgep, bge_regno_t regno, uint32_t bits);
279 #pragma	inline(bge_cfg_clr32)
280 
281 static void
282 bge_cfg_clr32(bge_t *bgep, bge_regno_t regno, uint32_t bits)
283 {
284 	uint32_t regval;
285 
286 	BGE_TRACE(("bge_cfg_clr32($%p, 0x%lx, 0x%x)",
287 		(void *)bgep, regno, bits));
288 
289 	regval = pci_config_get32(bgep->cfg_handle, regno);
290 
291 	BGE_DEBUG(("bge_cfg_clr32($%p, 0x%lx, 0x%x): 0x%x => 0x%x",
292 		(void *)bgep, regno, bits, regval, regval & ~bits));
293 
294 	regval &= ~bits;
295 	pci_config_put32(bgep->cfg_handle, regno, regval);
296 }
297 
298 #if	BGE_IND_IO32
299 
300 /*
301  * Indirect access to registers & RISC scratchpads, using config space
302  * accesses only.
303  *
304  * This isn't currently used, but someday we might want to use it for
305  * restoring the Subsystem Device/Vendor registers (which aren't directly
306  * writable in Config Space), or for downloading firmware into the RISCs
307  *
308  * In any case there are endian issues to be resolved before this code is
309  * enabled; the bizarre way that bytes get twisted by this chip AND by
310  * the PCI bridge in SPARC systems mean that we shouldn't enable it until
311  * it's been thoroughly tested for all access sizes on all supported
312  * architectures (SPARC *and* x86!).
313  */
314 static uint32_t bge_ind_get32(bge_t *bgep, bge_regno_t regno);
315 #pragma	inline(bge_ind_get32)
316 
317 static uint32_t
318 bge_ind_get32(bge_t *bgep, bge_regno_t regno)
319 {
320 	uint32_t val;
321 
322 	BGE_TRACE(("bge_ind_get32($%p, 0x%lx)", (void *)bgep, regno));
323 
324 	ASSERT(mutex_owned(bgep->genlock));
325 
326 	pci_config_put32(bgep->cfg_handle, PCI_CONF_BGE_RIAAR, regno);
327 	val = pci_config_get32(bgep->cfg_handle, PCI_CONF_BGE_RIADR);
328 
329 	BGE_DEBUG(("bge_ind_get32($%p, 0x%lx) => 0x%x",
330 		(void *)bgep, regno, val));
331 
332 	return (val);
333 }
334 
335 static void bge_ind_put32(bge_t *bgep, bge_regno_t regno, uint32_t val);
336 #pragma	inline(bge_ind_put32)
337 
338 static void
339 bge_ind_put32(bge_t *bgep, bge_regno_t regno, uint32_t val)
340 {
341 	BGE_TRACE(("bge_ind_put32($%p, 0x%lx, 0x%x)",
342 		(void *)bgep, regno, val));
343 
344 	ASSERT(mutex_owned(bgep->genlock));
345 
346 	pci_config_put32(bgep->cfg_handle, PCI_CONF_BGE_RIAAR, regno);
347 	pci_config_put32(bgep->cfg_handle, PCI_CONF_BGE_RIADR, val);
348 }
349 
350 #endif	/* BGE_IND_IO32 */
351 
352 #if	BGE_DEBUGGING
353 
354 static void bge_pci_check(bge_t *bgep);
355 #pragma	no_inline(bge_pci_check)
356 
357 static void
358 bge_pci_check(bge_t *bgep)
359 {
360 	uint16_t pcistatus;
361 
362 	pcistatus = pci_config_get16(bgep->cfg_handle, PCI_CONF_STAT);
363 	if ((pcistatus & (PCI_STAT_R_MAST_AB | PCI_STAT_R_TARG_AB)) != 0)
364 		BGE_DEBUG(("bge_pci_check($%p): PCI status 0x%x",
365 			(void *)bgep, pcistatus));
366 }
367 
368 #endif	/* BGE_DEBUGGING */
369 
370 /*
371  * Perform first-stage chip (re-)initialisation, using only config-space
372  * accesses:
373  *
374  * + Read the vendor/device/revision/subsystem/cache-line-size registers,
375  *   returning the data in the structure pointed to by <idp>.
376  * + Configure the target-mode endianness (swap) options.
377  * + Disable interrupts and enable Memory Space accesses.
378  * + Enable or disable Bus Mastering according to the <enable_dma> flag.
379  *
380  * This sequence is adapted from Broadcom document 570X-PG102-R,
381  * page 102, steps 1-3, 6-8 and 11-13.  The omitted parts of the sequence
382  * are 4 and 5 (Reset Core and wait) which are handled elsewhere.
383  *
384  * This function MUST be called before any non-config-space accesses
385  * are made; on this first call <enable_dma> is B_FALSE, and it
386  * effectively performs steps 3-1(!) of the initialisation sequence
387  * (the rest are not required but should be harmless).
388  *
389  * It MUST also be called also after a chip reset, as this disables
390  * Memory Space cycles!  In this case, <enable_dma> is B_TRUE, and
391  * it is effectively performing steps 6-8.
392  */
393 void bge_chip_cfg_init(bge_t *bgep, chip_id_t *cidp, boolean_t enable_dma);
394 #pragma	no_inline(bge_chip_cfg_init)
395 
396 void
397 bge_chip_cfg_init(bge_t *bgep, chip_id_t *cidp, boolean_t enable_dma)
398 {
399 	ddi_acc_handle_t handle;
400 	uint16_t command;
401 	uint32_t mhcr;
402 	uint16_t value16;
403 	int i;
404 
405 	BGE_TRACE(("bge_chip_cfg_init($%p, $%p, %d)",
406 		(void *)bgep, (void *)cidp, enable_dma));
407 
408 	/*
409 	 * Step 3: save PCI cache line size and subsystem vendor ID
410 	 *
411 	 * Read all the config-space registers that characterise the
412 	 * chip, specifically vendor/device/revision/subsystem vendor
413 	 * and subsystem device id.  We expect (but don't check) that
414 	 * (vendor == VENDOR_ID_BROADCOM) && (device == DEVICE_ID_5704)
415 	 *
416 	 * Also save all bus-transation related registers (cache-line
417 	 * size, bus-grant/latency parameters, etc).  Some of these are
418 	 * cleared by reset, so we'll have to restore them later.  This
419 	 * comes from the Broadcom document 570X-PG102-R ...
420 	 *
421 	 * Note: Broadcom document 570X-PG102-R seems to be in error
422 	 * here w.r.t. the offsets of the Subsystem Vendor ID and
423 	 * Subsystem (Device) ID registers, which are the opposite way
424 	 * round according to the PCI standard.  For good measure, we
425 	 * save/restore both anyway.
426 	 */
427 	handle = bgep->cfg_handle;
428 
429 	mhcr = pci_config_get32(handle, PCI_CONF_BGE_MHCR);
430 	cidp->asic_rev = mhcr & MHCR_CHIP_REV_MASK;
431 	cidp->businfo = pci_config_get32(handle, PCI_CONF_BGE_PCISTATE);
432 	cidp->command = pci_config_get16(handle, PCI_CONF_COMM);
433 
434 	cidp->vendor = pci_config_get16(handle, PCI_CONF_VENID);
435 	cidp->device = pci_config_get16(handle, PCI_CONF_DEVID);
436 	cidp->subven = pci_config_get16(handle, PCI_CONF_SUBVENID);
437 	cidp->subdev = pci_config_get16(handle, PCI_CONF_SUBSYSID);
438 	cidp->revision = pci_config_get8(handle, PCI_CONF_REVID);
439 	cidp->clsize = pci_config_get8(handle, PCI_CONF_CACHE_LINESZ);
440 	cidp->latency = pci_config_get8(handle, PCI_CONF_LATENCY_TIMER);
441 
442 	BGE_DEBUG(("bge_chip_cfg_init: %s bus is %s and %s; #INTA is %s",
443 		cidp->businfo & PCISTATE_BUS_IS_PCI ? "PCI" : "PCI-X",
444 		cidp->businfo & PCISTATE_BUS_IS_FAST ? "fast" : "slow",
445 		cidp->businfo & PCISTATE_BUS_IS_32_BIT ? "narrow" : "wide",
446 		cidp->businfo & PCISTATE_INTA_STATE ? "high" : "low"));
447 	BGE_DEBUG(("bge_chip_cfg_init: vendor 0x%x device 0x%x revision 0x%x",
448 		cidp->vendor, cidp->device, cidp->revision));
449 	BGE_DEBUG(("bge_chip_cfg_init: subven 0x%x subdev 0x%x asic_rev 0x%x",
450 		cidp->subven, cidp->subdev, cidp->asic_rev));
451 	BGE_DEBUG(("bge_chip_cfg_init: clsize %d latency %d command 0x%x",
452 		cidp->clsize, cidp->latency, cidp->command));
453 
454 	/*
455 	 * Step 2 (also step 6): disable and clear interrupts.
456 	 * Steps 11-13: configure PIO endianness options, and enable
457 	 * indirect register access.  We'll also select any other
458 	 * options controlled by the MHCR (eg tagged status, mask
459 	 * interrupt mode) at this stage ...
460 	 *
461 	 * Note: internally, the chip is 64-bit and BIG-endian, but
462 	 * since it talks to the host over a (LITTLE-endian) PCI bus,
463 	 * it normally swaps bytes around at the PCI interface.
464 	 * However, the PCI host bridge on SPARC systems normally
465 	 * swaps the byte lanes around too, since SPARCs are also
466 	 * BIG-endian.  So it turns out that on SPARC, the right
467 	 * option is to tell the chip to swap (and the host bridge
468 	 * will swap back again), whereas on x86 we ask the chip
469 	 * NOT to swap, so the natural little-endianness of the
470 	 * PCI bus is assumed.  Then the only thing that doesn't
471 	 * automatically work right is access to an 8-byte register
472 	 * by a little-endian host; but we don't want to set the
473 	 * MHCR_ENABLE_REGISTER_WORD_SWAP bit because then 4-byte
474 	 * accesses don't go where expected ;-(  So we live with
475 	 * that, and perform word-swaps in software in the few cases
476 	 * where a chip register is defined as an 8-byte value --
477 	 * see the code below for details ...
478 	 *
479 	 * Note: the meaning of the 'MASK_INTERRUPT_MODE' bit isn't
480 	 * very clear in the register description in the PRM, but
481 	 * Broadcom document 570X-PG104-R page 248 explains a little
482 	 * more (under "Broadcom Mask Mode").  The bit changes the way
483 	 * the MASK_PCI_INT_OUTPUT bit works: with MASK_INTERRUPT_MODE
484 	 * clear, the chip interprets MASK_PCI_INT_OUTPUT in the same
485 	 * way as the 5700 did, which isn't very convenient.  Setting
486 	 * the MASK_INTERRUPT_MODE bit makes the MASK_PCI_INT_OUTPUT
487 	 * bit do just what its name says -- MASK the PCI #INTA output
488 	 * (i.e. deassert the signal at the pin) leaving all internal
489 	 * state unchanged.  This is much more convenient for our
490 	 * interrupt handler, so we set MASK_INTERRUPT_MODE here.
491 	 *
492 	 * Note: the inconvenient semantics of the interrupt mailbox
493 	 * (nonzero disables and acknowledges/clears the interrupt,
494 	 * zero enables AND CLEARS it) would make race conditions
495 	 * likely in the interrupt handler:
496 	 *
497 	 * (1)	acknowledge & disable interrupts
498 	 * (2)	while (more to do)
499 	 * 		process packets
500 	 * (3)	enable interrupts -- also clears pending
501 	 *
502 	 * If the chip received more packets and internally generated
503 	 * an interrupt between the check at (2) and the mbox write
504 	 * at (3), this interrupt would be lost :-(
505 	 *
506 	 * The best way to avoid this is to use TAGGED STATUS mode,
507 	 * where the chip includes a unique tag in each status block
508 	 * update, and the host, when re-enabling interrupts, passes
509 	 * the last tag it saw back to the chip; then the chip can
510 	 * see whether the host is truly up to date, and regenerate
511 	 * its interrupt if not.
512 	 */
513 	mhcr =	MHCR_ENABLE_INDIRECT_ACCESS |
514 		MHCR_ENABLE_TAGGED_STATUS_MODE |
515 		MHCR_MASK_INTERRUPT_MODE |
516 		MHCR_CLEAR_INTERRUPT_INTA;
517 
518 	if (bgep->intr_type == DDI_INTR_TYPE_FIXED)
519 		mhcr |= MHCR_MASK_PCI_INT_OUTPUT;
520 
521 #ifdef	_BIG_ENDIAN
522 	mhcr |= MHCR_ENABLE_ENDIAN_WORD_SWAP | MHCR_ENABLE_ENDIAN_BYTE_SWAP;
523 #endif	/* _BIG_ENDIAN */
524 
525 	pci_config_put32(handle, PCI_CONF_BGE_MHCR, mhcr);
526 
527 #ifdef BGE_IPMI_ASF
528 	bgep->asf_wordswapped = B_FALSE;
529 #endif
530 	/*
531 	 * Step 1 (also step 7): Enable PCI Memory Space accesses
532 	 *			 Disable Memory Write/Invalidate
533 	 *			 Enable or disable Bus Mastering
534 	 *
535 	 * Note that all other bits are taken from the original value saved
536 	 * the first time through here, rather than from the current register
537 	 * value, 'cos that will have been cleared by a soft RESET since.
538 	 * In this way we preserve the OBP/nexus-parent's preferred settings
539 	 * of the parity-error and system-error enable bits across multiple
540 	 * chip RESETs.
541 	 *
542 	 * Step 8: Disable PCI-X Relaxed Ordering -- doesn't apply
543 	 */
544 	command = bgep->chipid.command | PCI_COMM_MAE;
545 	command &= ~(PCI_COMM_ME|PCI_COMM_MEMWR_INVAL);
546 	if (enable_dma)
547 		command |= PCI_COMM_ME;
548 	/*
549 	 * on BCM5714 revision A0, false parity error gets generated
550 	 * due to a logic bug. Provide a workaround by disabling parrity
551 	 * error.
552 	 */
553 	if (((cidp->device == DEVICE_ID_5714C) ||
554 	    (cidp->device == DEVICE_ID_5714S)) &&
555 	    (cidp->revision == REVISION_ID_5714_A0)) {
556 		command &= ~PCI_COMM_PARITY_DETECT;
557 	}
558 	pci_config_put16(handle, PCI_CONF_COMM, command);
559 
560 	/*
561 	 * On some PCI-E device, there were instances when
562 	 * the device was still link training.
563 	 */
564 	if (bgep->chipid.pci_type == BGE_PCI_E) {
565 		i = 0;
566 		value16 = pci_config_get16(handle, PCI_CONF_COMM);
567 		while ((value16 != command) && (i < 100)) {
568 			drv_usecwait(200);
569 			value16 = pci_config_get16(handle, PCI_CONF_COMM);
570 			++i;
571 		}
572 	}
573 
574 	/*
575 	 * Clear any remaining error status bits
576 	 */
577 	pci_config_put16(handle, PCI_CONF_STAT, ~0);
578 
579 	/*
580 	 * Make sure these indirect-access registers are sane
581 	 * rather than random after power-up or reset
582 	 */
583 	pci_config_put32(handle, PCI_CONF_BGE_RIAAR, 0);
584 	pci_config_put32(handle, PCI_CONF_BGE_MWBAR, 0);
585 }
586 
587 #ifdef __amd64
588 /*
589  * Distinguish CPU types
590  *
591  * These use to  distinguish AMD64 or Intel EM64T of CPU running mode.
592  * If CPU runs on Intel EM64T mode,the 64bit operation cannot works fine
593  * for PCI-Express based network interface card. This is the work-around
594  * for those nics.
595  */
596 static boolean_t bge_get_em64t_type(void);
597 #pragma	inline(bge_get_em64t_type)
598 
599 static boolean_t
600 bge_get_em64t_type(void)
601 {
602 
603 	return (x86_vendor == X86_VENDOR_Intel);
604 }
605 #endif
606 
607 /*
608  * Operating register get/set access routines
609  */
610 
611 uint32_t bge_reg_get32(bge_t *bgep, bge_regno_t regno);
612 #pragma	inline(bge_reg_get32)
613 
614 uint32_t
615 bge_reg_get32(bge_t *bgep, bge_regno_t regno)
616 {
617 	BGE_TRACE(("bge_reg_get32($%p, 0x%lx)",
618 		(void *)bgep, regno));
619 
620 	return (ddi_get32(bgep->io_handle, PIO_ADDR(bgep, regno)));
621 }
622 
623 void bge_reg_put32(bge_t *bgep, bge_regno_t regno, uint32_t data);
624 #pragma	inline(bge_reg_put32)
625 
626 void
627 bge_reg_put32(bge_t *bgep, bge_regno_t regno, uint32_t data)
628 {
629 	BGE_TRACE(("bge_reg_put32($%p, 0x%lx, 0x%x)",
630 		(void *)bgep, regno, data));
631 
632 	ddi_put32(bgep->io_handle, PIO_ADDR(bgep, regno), data);
633 	BGE_PCICHK(bgep);
634 }
635 
636 void bge_reg_set32(bge_t *bgep, bge_regno_t regno, uint32_t bits);
637 #pragma	inline(bge_reg_set32)
638 
639 void
640 bge_reg_set32(bge_t *bgep, bge_regno_t regno, uint32_t bits)
641 {
642 	uint32_t regval;
643 
644 	BGE_TRACE(("bge_reg_set32($%p, 0x%lx, 0x%x)",
645 		(void *)bgep, regno, bits));
646 
647 	regval = bge_reg_get32(bgep, regno);
648 	regval |= bits;
649 	bge_reg_put32(bgep, regno, regval);
650 }
651 
652 void bge_reg_clr32(bge_t *bgep, bge_regno_t regno, uint32_t bits);
653 #pragma	inline(bge_reg_clr32)
654 
655 void
656 bge_reg_clr32(bge_t *bgep, bge_regno_t regno, uint32_t bits)
657 {
658 	uint32_t regval;
659 
660 	BGE_TRACE(("bge_reg_clr32($%p, 0x%lx, 0x%x)",
661 		(void *)bgep, regno, bits));
662 
663 	regval = bge_reg_get32(bgep, regno);
664 	regval &= ~bits;
665 	bge_reg_put32(bgep, regno, regval);
666 }
667 
668 static uint64_t bge_reg_get64(bge_t *bgep, bge_regno_t regno);
669 #pragma	inline(bge_reg_get64)
670 
671 static uint64_t
672 bge_reg_get64(bge_t *bgep, bge_regno_t regno)
673 {
674 	uint64_t regval;
675 
676 #ifdef	__amd64
677 	if (bge_get_em64t_type()) {
678 		regval = ddi_get32(bgep->io_handle, PIO_ADDR(bgep, regno + 4));
679 		regval <<= 32;
680 		regval |= ddi_get32(bgep->io_handle, PIO_ADDR(bgep, regno));
681 	} else {
682 		regval = ddi_get64(bgep->io_handle, PIO_ADDR(bgep, regno));
683 	}
684 #else
685 	regval = ddi_get64(bgep->io_handle, PIO_ADDR(bgep, regno));
686 #endif
687 
688 #ifdef	_LITTLE_ENDIAN
689 	regval = (regval >> 32) | (regval << 32);
690 #endif	/* _LITTLE_ENDIAN */
691 
692 	BGE_TRACE(("bge_reg_get64($%p, 0x%lx) = 0x%016llx",
693 		(void *)bgep, regno, regval));
694 
695 	return (regval);
696 }
697 
698 static void bge_reg_put64(bge_t *bgep, bge_regno_t regno, uint64_t data);
699 #pragma	inline(bge_reg_put64)
700 
701 static void
702 bge_reg_put64(bge_t *bgep, bge_regno_t regno, uint64_t data)
703 {
704 	BGE_TRACE(("bge_reg_put64($%p, 0x%lx, 0x%016llx)",
705 		(void *)bgep, regno, data));
706 
707 #ifdef	_LITTLE_ENDIAN
708 	data = ((data >> 32) | (data << 32));
709 #endif	/* _LITTLE_ENDIAN */
710 
711 #ifdef	__amd64
712 	if (bge_get_em64t_type()) {
713 		ddi_put32(bgep->io_handle,
714 			PIO_ADDR(bgep, regno), (uint32_t)data);
715 		BGE_PCICHK(bgep);
716 		ddi_put32(bgep->io_handle,
717 			PIO_ADDR(bgep, regno + 4), (uint32_t)(data >> 32));
718 
719 	} else {
720 		ddi_put64(bgep->io_handle, PIO_ADDR(bgep, regno), data);
721 	}
722 #else
723 	ddi_put64(bgep->io_handle, PIO_ADDR(bgep, regno), data);
724 #endif
725 
726 	BGE_PCICHK(bgep);
727 }
728 
729 /*
730  * The DDI doesn't provide get/put functions for 128 bit data
731  * so we put RCBs out as two 64-bit chunks instead.
732  */
733 static void bge_reg_putrcb(bge_t *bgep, bge_regno_t addr, bge_rcb_t *rcbp);
734 #pragma	inline(bge_reg_putrcb)
735 
736 static void
737 bge_reg_putrcb(bge_t *bgep, bge_regno_t addr, bge_rcb_t *rcbp)
738 {
739 	uint64_t *p;
740 
741 	BGE_TRACE(("bge_reg_putrcb($%p, 0x%lx, 0x%016llx:%04x:%04x:%08x)",
742 		(void *)bgep, addr, rcbp->host_ring_addr,
743 		rcbp->max_len, rcbp->flags, rcbp->nic_ring_addr));
744 
745 	ASSERT((addr % sizeof (*rcbp)) == 0);
746 
747 	p = (void *)rcbp;
748 	bge_reg_put64(bgep, addr, *p++);
749 	bge_reg_put64(bgep, addr+8, *p);
750 }
751 
752 void bge_mbx_put(bge_t *bgep, bge_regno_t regno, uint64_t data);
753 #pragma	inline(bge_mbx_put)
754 
755 void
756 bge_mbx_put(bge_t *bgep, bge_regno_t regno, uint64_t data)
757 {
758 	BGE_TRACE(("bge_mbx_put($%p, 0x%lx, 0x%016llx)",
759 		(void *)bgep, regno, data));
760 
761 	/*
762 	 * Mailbox registers are nominally 64 bits on the 5701, but
763 	 * the MSW isn't used.  On the 5703, they're only 32 bits
764 	 * anyway.  So here we just write the lower(!) 32 bits -
765 	 * remembering that the chip is big-endian, even though the
766 	 * PCI bus is little-endian ...
767 	 */
768 #ifdef	_BIG_ENDIAN
769 	ddi_put32(bgep->io_handle, PIO_ADDR(bgep, regno+4), (uint32_t)data);
770 #else
771 	ddi_put32(bgep->io_handle, PIO_ADDR(bgep, regno), (uint32_t)data);
772 #endif	/* _BIG_ENDIAN */
773 	BGE_PCICHK(bgep);
774 }
775 
776 #if	BGE_DEBUGGING
777 
778 void bge_led_mark(bge_t *bgep);
779 #pragma	no_inline(bge_led_mark)
780 
781 void
782 bge_led_mark(bge_t *bgep)
783 {
784 	uint32_t led_ctrl = LED_CONTROL_OVERRIDE_LINK |
785 			    LED_CONTROL_1000MBPS_LED |
786 			    LED_CONTROL_100MBPS_LED |
787 			    LED_CONTROL_10MBPS_LED;
788 
789 	/*
790 	 * Blink all three LINK LEDs on simultaneously, then all off,
791 	 * then restore to automatic hardware control.  This is used
792 	 * in laboratory testing to trigger a logic analyser or scope.
793 	 */
794 	bge_reg_set32(bgep, ETHERNET_MAC_LED_CONTROL_REG, led_ctrl);
795 	led_ctrl ^= LED_CONTROL_OVERRIDE_LINK;
796 	bge_reg_clr32(bgep, ETHERNET_MAC_LED_CONTROL_REG, led_ctrl);
797 	led_ctrl = LED_CONTROL_OVERRIDE_LINK;
798 	bge_reg_clr32(bgep, ETHERNET_MAC_LED_CONTROL_REG, led_ctrl);
799 }
800 
801 #endif	/* BGE_DEBUGGING */
802 
803 /*
804  * NIC on-chip memory access routines
805  *
806  * Only 32K of NIC memory is visible at a time, controlled by the
807  * Memory Window Base Address Register (in PCI config space).  Once
808  * this is set, the 32K region of NIC-local memory that it refers
809  * to can be directly addressed in the upper 32K of the 64K of PCI
810  * memory space used for the device.
811  */
812 
813 static void bge_nic_setwin(bge_t *bgep, bge_regno_t base);
814 #pragma	inline(bge_nic_setwin)
815 
816 static void
817 bge_nic_setwin(bge_t *bgep, bge_regno_t base)
818 {
819 	BGE_TRACE(("bge_nic_setwin($%p, 0x%lx)",
820 		(void *)bgep, base));
821 
822 	ASSERT((base & MWBAR_GRANULE_MASK) == 0);
823 	pci_config_put32(bgep->cfg_handle, PCI_CONF_BGE_MWBAR, base);
824 }
825 
826 
827 static uint32_t bge_nic_get32(bge_t *bgep, bge_regno_t addr);
828 #pragma	inline(bge_nic_get32)
829 
830 static uint32_t
831 bge_nic_get32(bge_t *bgep, bge_regno_t addr)
832 {
833 	uint32_t data;
834 
835 #ifdef BGE_IPMI_ASF
836 	if (bgep->asf_enabled && !bgep->asf_wordswapped) {
837 		/* workaround for word swap error */
838 		if (addr & 4)
839 			addr = addr - 4;
840 		else
841 			addr = addr + 4;
842 	}
843 #endif
844 
845 	bge_nic_setwin(bgep, addr & ~MWBAR_GRANULE_MASK);
846 	addr &= MWBAR_GRANULE_MASK;
847 	addr += NIC_MEM_WINDOW_OFFSET;
848 
849 	data = ddi_get32(bgep->io_handle, PIO_ADDR(bgep, addr));
850 
851 	BGE_TRACE(("bge_nic_get32($%p, 0x%lx) = 0x%08x",
852 		(void *)bgep, addr, data));
853 
854 	return (data);
855 }
856 
857 void bge_nic_put32(bge_t *bgep, bge_regno_t addr, uint32_t data);
858 #pragma inline(bge_nic_put32)
859 
860 void
861 bge_nic_put32(bge_t *bgep, bge_regno_t addr, uint32_t data)
862 {
863 	BGE_TRACE(("bge_nic_put32($%p, 0x%lx, 0x%08x)",
864 		(void *)bgep, addr, data));
865 
866 #ifdef BGE_IPMI_ASF
867 	if (bgep->asf_enabled && !bgep->asf_wordswapped) {
868 		/* workaround for word swap error */
869 		if (addr & 4)
870 			addr = addr - 4;
871 		else
872 			addr = addr + 4;
873 	}
874 #endif
875 
876 	bge_nic_setwin(bgep, addr & ~MWBAR_GRANULE_MASK);
877 	addr &= MWBAR_GRANULE_MASK;
878 	addr += NIC_MEM_WINDOW_OFFSET;
879 	ddi_put32(bgep->io_handle, PIO_ADDR(bgep, addr), data);
880 	BGE_PCICHK(bgep);
881 }
882 
883 
884 static uint64_t bge_nic_get64(bge_t *bgep, bge_regno_t addr);
885 #pragma	inline(bge_nic_get64)
886 
887 static uint64_t
888 bge_nic_get64(bge_t *bgep, bge_regno_t addr)
889 {
890 	uint64_t data;
891 
892 	bge_nic_setwin(bgep, addr & ~MWBAR_GRANULE_MASK);
893 	addr &= MWBAR_GRANULE_MASK;
894 	addr += NIC_MEM_WINDOW_OFFSET;
895 
896 #ifdef	__amd64
897 		if (bge_get_em64t_type()) {
898 			data = ddi_get32(bgep->io_handle, PIO_ADDR(bgep, addr));
899 			data <<= 32;
900 			data |= ddi_get32(bgep->io_handle,
901 				PIO_ADDR(bgep, addr + 4));
902 		} else {
903 			data = ddi_get64(bgep->io_handle, PIO_ADDR(bgep, addr));
904 		}
905 #else
906 		data = ddi_get64(bgep->io_handle, PIO_ADDR(bgep, addr));
907 #endif
908 
909 	BGE_TRACE(("bge_nic_get64($%p, 0x%lx) = 0x%016llx",
910 		(void *)bgep, addr, data));
911 
912 	return (data);
913 }
914 
915 static void bge_nic_put64(bge_t *bgep, bge_regno_t addr, uint64_t data);
916 #pragma	inline(bge_nic_put64)
917 
918 static void
919 bge_nic_put64(bge_t *bgep, bge_regno_t addr, uint64_t data)
920 {
921 	BGE_TRACE(("bge_nic_put64($%p, 0x%lx, 0x%016llx)",
922 		(void *)bgep, addr, data));
923 
924 	bge_nic_setwin(bgep, addr & ~MWBAR_GRANULE_MASK);
925 	addr &= MWBAR_GRANULE_MASK;
926 	addr += NIC_MEM_WINDOW_OFFSET;
927 
928 #ifdef	__amd64
929 	if (bge_get_em64t_type()) {
930 		ddi_put32(bgep->io_handle,
931 			PIO_ADDR(bgep, addr), (uint32_t)data);
932 		BGE_PCICHK(bgep);
933 		ddi_put32(bgep->io_handle,
934 			PIO_ADDR(bgep, addr + 4), (uint32_t)(data >> 32));
935 	} else {
936 		ddi_put64(bgep->io_handle, PIO_ADDR(bgep, addr), data);
937 	}
938 #else
939 	ddi_put64(bgep->io_handle, PIO_ADDR(bgep, addr), data);
940 #endif
941 
942 	BGE_PCICHK(bgep);
943 }
944 
945 /*
946  * The DDI doesn't provide get/put functions for 128 bit data
947  * so we put RCBs out as two 64-bit chunks instead.
948  */
949 static void bge_nic_putrcb(bge_t *bgep, bge_regno_t addr, bge_rcb_t *rcbp);
950 #pragma	inline(bge_nic_putrcb)
951 
952 static void
953 bge_nic_putrcb(bge_t *bgep, bge_regno_t addr, bge_rcb_t *rcbp)
954 {
955 	uint64_t *p;
956 
957 	BGE_TRACE(("bge_nic_putrcb($%p, 0x%lx, 0x%016llx:%04x:%04x:%08x)",
958 		(void *)bgep, addr, rcbp->host_ring_addr,
959 		rcbp->max_len, rcbp->flags, rcbp->nic_ring_addr));
960 
961 	ASSERT((addr % sizeof (*rcbp)) == 0);
962 
963 	bge_nic_setwin(bgep, addr & ~MWBAR_GRANULE_MASK);
964 	addr &= MWBAR_GRANULE_MASK;
965 	addr += NIC_MEM_WINDOW_OFFSET;
966 
967 	p = (void *)rcbp;
968 #ifdef	__amd64
969 	if (bge_get_em64t_type()) {
970 		ddi_put32(bgep->io_handle, PIO_ADDR(bgep, addr),
971 			(uint32_t)(*p));
972 		ddi_put32(bgep->io_handle, PIO_ADDR(bgep, addr + 4),
973 			(uint32_t)(*p >> 32));
974 		ddi_put32(bgep->io_handle, PIO_ADDR(bgep, addr + 8),
975 			(uint32_t)(*(p + 1)));
976 		ddi_put32(bgep->io_handle, PIO_ADDR(bgep, addr + 12),
977 			(uint32_t)(*p >> 32));
978 
979 	} else {
980 		ddi_put64(bgep->io_handle, PIO_ADDR(bgep, addr), *p++);
981 		ddi_put64(bgep->io_handle, PIO_ADDR(bgep, addr+8), *p);
982 	}
983 #else
984 	ddi_put64(bgep->io_handle, PIO_ADDR(bgep, addr), *p++);
985 	ddi_put64(bgep->io_handle, PIO_ADDR(bgep, addr + 8), *p);
986 #endif
987 
988 	BGE_PCICHK(bgep);
989 }
990 
991 static void bge_nic_zero(bge_t *bgep, bge_regno_t addr, uint32_t nbytes);
992 #pragma	inline(bge_nic_zero)
993 
994 static void
995 bge_nic_zero(bge_t *bgep, bge_regno_t addr, uint32_t nbytes)
996 {
997 	BGE_TRACE(("bge_nic_zero($%p, 0x%lx, 0x%x)",
998 		(void *)bgep, addr, nbytes));
999 
1000 	ASSERT((addr & ~MWBAR_GRANULE_MASK) ==
1001 		((addr+nbytes) & ~MWBAR_GRANULE_MASK));
1002 
1003 	bge_nic_setwin(bgep, addr & ~MWBAR_GRANULE_MASK);
1004 	addr &= MWBAR_GRANULE_MASK;
1005 	addr += NIC_MEM_WINDOW_OFFSET;
1006 
1007 	(void) ddi_device_zero(bgep->io_handle, PIO_ADDR(bgep, addr),
1008 		nbytes, 1, DDI_DATA_SZ08_ACC);
1009 	BGE_PCICHK(bgep);
1010 }
1011 
1012 /*
1013  * MII (PHY) register get/set access routines
1014  *
1015  * These use the chip's MII auto-access method, controlled by the
1016  * MII Communication register at 0x044c, so the CPU doesn't have
1017  * to fiddle with the individual bits.
1018  */
1019 
1020 #undef	BGE_DBG
1021 #define	BGE_DBG		BGE_DBG_MII	/* debug flag for this code	*/
1022 
1023 static uint16_t bge_mii_access(bge_t *bgep, bge_regno_t regno,
1024 				uint16_t data, uint32_t cmd);
1025 #pragma	no_inline(bge_mii_access)
1026 
1027 static uint16_t
1028 bge_mii_access(bge_t *bgep, bge_regno_t regno, uint16_t data, uint32_t cmd)
1029 {
1030 	uint32_t timeout;
1031 	uint32_t regval1;
1032 	uint32_t regval2;
1033 
1034 	BGE_TRACE(("bge_mii_access($%p, 0x%lx, 0x%x, 0x%x)",
1035 		(void *)bgep, regno, data, cmd));
1036 
1037 	ASSERT(mutex_owned(bgep->genlock));
1038 
1039 	/*
1040 	 * Assemble the command ...
1041 	 */
1042 	cmd |= data << MI_COMMS_DATA_SHIFT;
1043 	cmd |= regno << MI_COMMS_REGISTER_SHIFT;
1044 	cmd |= bgep->phy_mii_addr << MI_COMMS_ADDRESS_SHIFT;
1045 	cmd |= MI_COMMS_START;
1046 
1047 	/*
1048 	 * Wait for any command already in progress ...
1049 	 *
1050 	 * Note: this *shouldn't* ever find that there is a command
1051 	 * in progress, because we already hold the <genlock> mutex.
1052 	 * Nonetheless, we have sometimes seen the MI_COMMS_START
1053 	 * bit set here -- it seems that the chip can initiate MII
1054 	 * accesses internally, even with polling OFF.
1055 	 */
1056 	regval1 = regval2 = bge_reg_get32(bgep, MI_COMMS_REG);
1057 	for (timeout = 100; ; ) {
1058 		if ((regval2 & MI_COMMS_START) == 0) {
1059 			bge_reg_put32(bgep, MI_COMMS_REG, cmd);
1060 			break;
1061 		}
1062 		if (--timeout == 0)
1063 			break;
1064 		drv_usecwait(10);
1065 		regval2 = bge_reg_get32(bgep, MI_COMMS_REG);
1066 	}
1067 
1068 	if (timeout == 0)
1069 		return ((uint16_t)~0u);
1070 
1071 	if (timeout != 100)
1072 		BGE_REPORT((bgep, "bge_mii_access: cmd 0x%x -- "
1073 			"MI_COMMS_START set for %d us; 0x%x->0x%x",
1074 			cmd, 10*(100-timeout), regval1, regval2));
1075 
1076 	regval1 = bge_reg_get32(bgep, MI_COMMS_REG);
1077 	for (timeout = 1000; ; ) {
1078 		if ((regval1 & MI_COMMS_START) == 0)
1079 			break;
1080 		if (--timeout == 0)
1081 			break;
1082 		drv_usecwait(10);
1083 		regval1 = bge_reg_get32(bgep, MI_COMMS_REG);
1084 	}
1085 
1086 	/*
1087 	 * Drop out early if the READ FAILED bit is set -- this chip
1088 	 * could be a 5703/4S, with a SerDes instead of a PHY!
1089 	 */
1090 	if (regval2 & MI_COMMS_READ_FAILED)
1091 		return ((uint16_t)~0u);
1092 
1093 	if (timeout == 0)
1094 		return ((uint16_t)~0u);
1095 
1096 	/*
1097 	 * The PRM says to wait 5us after seeing the START bit clear
1098 	 * and then re-read the register to get the final value of the
1099 	 * data field, in order to avoid a race condition where the
1100 	 * START bit is clear but the data field isn't yet valid.
1101 	 *
1102 	 * Note: we don't actually seem to be encounter this race;
1103 	 * except when the START bit is seen set again (see below),
1104 	 * the data field doesn't change during this 5us interval.
1105 	 */
1106 	drv_usecwait(5);
1107 	regval2 = bge_reg_get32(bgep, MI_COMMS_REG);
1108 
1109 	/*
1110 	 * Unfortunately, when following the PRMs instructions above,
1111 	 * we have occasionally seen the START bit set again(!) in the
1112 	 * value read after the 5us delay. This seems to be due to the
1113 	 * chip autonomously starting another MII access internally.
1114 	 * In such cases, the command/data/etc fields relate to the
1115 	 * internal command, rather than the one that we thought had
1116 	 * just finished.  So in this case, we fall back to returning
1117 	 * the data from the original read that showed START clear.
1118 	 */
1119 	if (regval2 & MI_COMMS_START) {
1120 		BGE_REPORT((bgep, "bge_mii_access: cmd 0x%x -- "
1121 			"MI_COMMS_START set after transaction; 0x%x->0x%x",
1122 			cmd, regval1, regval2));
1123 		regval2 = regval1;
1124 	}
1125 
1126 	if (regval2 & MI_COMMS_START)
1127 		return ((uint16_t)~0u);
1128 
1129 	if (regval2 & MI_COMMS_READ_FAILED)
1130 		return ((uint16_t)~0u);
1131 
1132 	return ((regval2 & MI_COMMS_DATA_MASK) >> MI_COMMS_DATA_SHIFT);
1133 }
1134 
1135 uint16_t bge_mii_get16(bge_t *bgep, bge_regno_t regno);
1136 #pragma	no_inline(bge_mii_get16)
1137 
1138 uint16_t
1139 bge_mii_get16(bge_t *bgep, bge_regno_t regno)
1140 {
1141 	BGE_TRACE(("bge_mii_get16($%p, 0x%lx)",
1142 		(void *)bgep, regno));
1143 
1144 	ASSERT(mutex_owned(bgep->genlock));
1145 
1146 	return (bge_mii_access(bgep, regno, 0, MI_COMMS_COMMAND_READ));
1147 }
1148 
1149 void bge_mii_put16(bge_t *bgep, bge_regno_t regno, uint16_t data);
1150 #pragma	no_inline(bge_mii_put16)
1151 
1152 void
1153 bge_mii_put16(bge_t *bgep, bge_regno_t regno, uint16_t data)
1154 {
1155 	BGE_TRACE(("bge_mii_put16($%p, 0x%lx, 0x%x)",
1156 		(void *)bgep, regno, data));
1157 
1158 	ASSERT(mutex_owned(bgep->genlock));
1159 
1160 	(void) bge_mii_access(bgep, regno, data, MI_COMMS_COMMAND_WRITE);
1161 }
1162 
1163 #undef	BGE_DBG
1164 #define	BGE_DBG		BGE_DBG_SEEPROM	/* debug flag for this code	*/
1165 
1166 #if	BGE_SEE_IO32 || BGE_FLASH_IO32
1167 
1168 /*
1169  * Basic SEEPROM get/set access routine
1170  *
1171  * This uses the chip's SEEPROM auto-access method, controlled by the
1172  * Serial EEPROM Address/Data Registers at 0x6838/683c, so the CPU
1173  * doesn't have to fiddle with the individual bits.
1174  *
1175  * The caller should hold <genlock> and *also* have already acquired
1176  * the right to access the SEEPROM, via bge_nvmem_acquire() above.
1177  *
1178  * Return value:
1179  *	0 on success,
1180  *	ENODATA on access timeout (maybe retryable: device may just be busy)
1181  *	EPROTO on other h/w or s/w errors.
1182  *
1183  * <*dp> is an input to a SEEPROM_ACCESS_WRITE operation, or an output
1184  * from a (successful) SEEPROM_ACCESS_READ.
1185  */
1186 static int bge_seeprom_access(bge_t *bgep, uint32_t cmd, bge_regno_t addr,
1187 				uint32_t *dp);
1188 #pragma	no_inline(bge_seeprom_access)
1189 
1190 static int
1191 bge_seeprom_access(bge_t *bgep, uint32_t cmd, bge_regno_t addr, uint32_t *dp)
1192 {
1193 	uint32_t tries;
1194 	uint32_t regval;
1195 
1196 	ASSERT(mutex_owned(bgep->genlock));
1197 
1198 	/*
1199 	 * On the newer chips that support both SEEPROM & Flash, we need
1200 	 * to specifically enable SEEPROM access (Flash is the default).
1201 	 * On older chips, we don't; SEEPROM is the only NVtype supported,
1202 	 * and the NVM control registers don't exist ...
1203 	 */
1204 	switch (bgep->chipid.nvtype) {
1205 	case BGE_NVTYPE_NONE:
1206 	case BGE_NVTYPE_UNKNOWN:
1207 		_NOTE(NOTREACHED)
1208 	case BGE_NVTYPE_SEEPROM:
1209 		break;
1210 
1211 	case BGE_NVTYPE_LEGACY_SEEPROM:
1212 	case BGE_NVTYPE_UNBUFFERED_FLASH:
1213 	case BGE_NVTYPE_BUFFERED_FLASH:
1214 	default:
1215 		bge_reg_set32(bgep, NVM_CONFIG1_REG,
1216 				NVM_CFG1_LEGACY_SEEPROM_MODE);
1217 		break;
1218 	}
1219 
1220 	/*
1221 	 * Check there's no command in progress.
1222 	 *
1223 	 * Note: this *shouldn't* ever find that there is a command
1224 	 * in progress, because we already hold the <genlock> mutex.
1225 	 * Also, to ensure we don't have a conflict with the chip's
1226 	 * internal firmware or a process accessing the same (shared)
1227 	 * SEEPROM through the other port of a 5704, we've already
1228 	 * been through the "software arbitration" protocol.
1229 	 * So this is just a final consistency check: we shouldn't
1230 	 * see EITHER the START bit (command started but not complete)
1231 	 * OR the COMPLETE bit (command completed but not cleared).
1232 	 */
1233 	regval = bge_reg_get32(bgep, SERIAL_EEPROM_ADDRESS_REG);
1234 	if (regval & SEEPROM_ACCESS_START)
1235 		return (EPROTO);
1236 	if (regval & SEEPROM_ACCESS_COMPLETE)
1237 		return (EPROTO);
1238 
1239 	/*
1240 	 * Assemble the command ...
1241 	 */
1242 	cmd |= addr & SEEPROM_ACCESS_ADDRESS_MASK;
1243 	addr >>= SEEPROM_ACCESS_ADDRESS_SIZE;
1244 	addr <<= SEEPROM_ACCESS_DEVID_SHIFT;
1245 	cmd |= addr & SEEPROM_ACCESS_DEVID_MASK;
1246 	cmd |= SEEPROM_ACCESS_START;
1247 	cmd |= SEEPROM_ACCESS_COMPLETE;
1248 	cmd |= regval & SEEPROM_ACCESS_HALFCLOCK_MASK;
1249 
1250 	bge_reg_put32(bgep, SERIAL_EEPROM_DATA_REG, *dp);
1251 	bge_reg_put32(bgep, SERIAL_EEPROM_ADDRESS_REG, cmd);
1252 
1253 	/*
1254 	 * By observation, a successful access takes ~20us on a 5703/4,
1255 	 * but apparently much longer (up to 1000us) on the obsolescent
1256 	 * BCM5700/BCM5701.  We want to be sure we don't get any false
1257 	 * timeouts here; but OTOH, we don't want a bogus access to lock
1258 	 * out interrupts for longer than necessary. So we'll allow up
1259 	 * to 1000us ...
1260 	 */
1261 	for (tries = 0; tries < 1000; ++tries) {
1262 		regval = bge_reg_get32(bgep, SERIAL_EEPROM_ADDRESS_REG);
1263 		if (regval & SEEPROM_ACCESS_COMPLETE)
1264 			break;
1265 		drv_usecwait(1);
1266 	}
1267 
1268 	if (regval & SEEPROM_ACCESS_COMPLETE) {
1269 		/*
1270 		 * All OK; read the SEEPROM data register, then write back
1271 		 * the value read from the address register in order to
1272 		 * clear the <complete> bit and leave the SEEPROM access
1273 		 * state machine idle, ready for the next access ...
1274 		 */
1275 		BGE_DEBUG(("bge_seeprom_access: complete after %d us", tries));
1276 		*dp = bge_reg_get32(bgep, SERIAL_EEPROM_DATA_REG);
1277 		bge_reg_put32(bgep, SERIAL_EEPROM_ADDRESS_REG, regval);
1278 		return (0);
1279 	}
1280 
1281 	/*
1282 	 * Hmm ... what happened here?
1283 	 *
1284 	 * Most likely, the user addressed an non-existent SEEPROM. Or
1285 	 * maybe the SEEPROM was busy internally (e.g. processing a write)
1286 	 * and didn't respond to being addressed. Either way, it's left
1287 	 * the SEEPROM access state machine wedged. So we'll reset it
1288 	 * before we leave, so it's ready for next time ...
1289 	 */
1290 	BGE_DEBUG(("bge_seeprom_access: timed out after %d us", tries));
1291 	bge_reg_set32(bgep, SERIAL_EEPROM_ADDRESS_REG, SEEPROM_ACCESS_INIT);
1292 	return (ENODATA);
1293 }
1294 
1295 /*
1296  * Basic Flash get/set access routine
1297  *
1298  * These use the chip's Flash auto-access method, controlled by the
1299  * Flash Access Registers at 0x7000-701c, so the CPU doesn't have to
1300  * fiddle with the individual bits.
1301  *
1302  * The caller should hold <genlock> and *also* have already acquired
1303  * the right to access the Flash, via bge_nvmem_acquire() above.
1304  *
1305  * Return value:
1306  *	0 on success,
1307  *	ENODATA on access timeout (maybe retryable: device may just be busy)
1308  *	ENODEV if the NVmem device is missing or otherwise unusable
1309  *
1310  * <*dp> is an input to a NVM_FLASH_CMD_WR operation, or an output
1311  * from a (successful) NVM_FLASH_CMD_RD.
1312  */
1313 static int bge_flash_access(bge_t *bgep, uint32_t cmd, bge_regno_t addr,
1314 				uint32_t *dp);
1315 #pragma	no_inline(bge_flash_access)
1316 
1317 static int
1318 bge_flash_access(bge_t *bgep, uint32_t cmd, bge_regno_t addr, uint32_t *dp)
1319 {
1320 	uint32_t tries;
1321 	uint32_t regval;
1322 
1323 	ASSERT(mutex_owned(bgep->genlock));
1324 
1325 	/*
1326 	 * On the newer chips that support both SEEPROM & Flash, we need
1327 	 * to specifically disable SEEPROM access while accessing Flash.
1328 	 * The older chips don't support Flash, and the NVM registers don't
1329 	 * exist, so we shouldn't be here at all!
1330 	 */
1331 	switch (bgep->chipid.nvtype) {
1332 	case BGE_NVTYPE_NONE:
1333 	case BGE_NVTYPE_UNKNOWN:
1334 		_NOTE(NOTREACHED)
1335 	case BGE_NVTYPE_SEEPROM:
1336 		return (ENODEV);
1337 
1338 	case BGE_NVTYPE_LEGACY_SEEPROM:
1339 	case BGE_NVTYPE_UNBUFFERED_FLASH:
1340 	case BGE_NVTYPE_BUFFERED_FLASH:
1341 	default:
1342 		bge_reg_clr32(bgep, NVM_CONFIG1_REG,
1343 				NVM_CFG1_LEGACY_SEEPROM_MODE);
1344 		break;
1345 	}
1346 
1347 	/*
1348 	 * Assemble the command ...
1349 	 */
1350 	addr &= NVM_FLASH_ADDR_MASK;
1351 	cmd |= NVM_FLASH_CMD_DOIT;
1352 	cmd |= NVM_FLASH_CMD_FIRST;
1353 	cmd |= NVM_FLASH_CMD_LAST;
1354 	cmd |= NVM_FLASH_CMD_DONE;
1355 
1356 	bge_reg_put32(bgep, NVM_FLASH_WRITE_REG, *dp);
1357 	bge_reg_put32(bgep, NVM_FLASH_ADDR_REG, addr);
1358 	bge_reg_put32(bgep, NVM_FLASH_CMD_REG, cmd);
1359 
1360 	/*
1361 	 * Allow up to 1000ms ...
1362 	 */
1363 	for (tries = 0; tries < 1000; ++tries) {
1364 		regval = bge_reg_get32(bgep, NVM_FLASH_CMD_REG);
1365 		if (regval & NVM_FLASH_CMD_DONE)
1366 			break;
1367 		drv_usecwait(1);
1368 	}
1369 
1370 	if (regval & NVM_FLASH_CMD_DONE) {
1371 		/*
1372 		 * All OK; read the data from the Flash read register
1373 		 */
1374 		BGE_DEBUG(("bge_flash_access: complete after %d us", tries));
1375 		*dp = bge_reg_get32(bgep, NVM_FLASH_READ_REG);
1376 		return (0);
1377 	}
1378 
1379 	/*
1380 	 * Hmm ... what happened here?
1381 	 *
1382 	 * Most likely, the user addressed an non-existent Flash. Or
1383 	 * maybe the Flash was busy internally (e.g. processing a write)
1384 	 * and didn't respond to being addressed. Either way, there's
1385 	 * nothing we can here ...
1386 	 */
1387 	BGE_DEBUG(("bge_flash_access: timed out after %d us", tries));
1388 	return (ENODATA);
1389 }
1390 
1391 /*
1392  * The next two functions regulate access to the NVram (if fitted).
1393  *
1394  * On a 5704 (dual core) chip, there's only one SEEPROM and one Flash
1395  * (SPI) interface, but they can be accessed through either port. These
1396  * are managed by different instance of this driver and have no software
1397  * state in common.
1398  *
1399  * In addition (and even on a single core chip) the chip's internal
1400  * firmware can access the SEEPROM/Flash, most notably after a RESET
1401  * when it may download code to run internally.
1402  *
1403  * So we need to arbitrate between these various software agents.  For
1404  * this purpose, the chip provides the Software Arbitration Register,
1405  * which implements hardware(!) arbitration.
1406  *
1407  * This functionality didn't exist on older (5700/5701) chips, so there's
1408  * nothing we can do by way of arbitration on those; also, if there's no
1409  * SEEPROM/Flash fitted (or we couldn't determine what type), there's also
1410  * nothing to do.
1411  *
1412  * The internal firmware appears to use Request 0, which is the highest
1413  * priority.  So we'd like to use Request 2, leaving one higher and one
1414  * lower for any future developments ... but apparently this doesn't
1415  * always work.  So for now, the code uses Request 1 ;-(
1416  */
1417 
1418 #define	NVM_READ_REQ	NVM_READ_REQ1
1419 #define	NVM_RESET_REQ	NVM_RESET_REQ1
1420 #define	NVM_SET_REQ	NVM_SET_REQ1
1421 
1422 static void bge_nvmem_relinquish(bge_t *bgep);
1423 #pragma	no_inline(bge_nvmem_relinquish)
1424 
1425 static void
1426 bge_nvmem_relinquish(bge_t *bgep)
1427 {
1428 	ASSERT(mutex_owned(bgep->genlock));
1429 
1430 	switch (bgep->chipid.nvtype) {
1431 	case BGE_NVTYPE_NONE:
1432 	case BGE_NVTYPE_UNKNOWN:
1433 		_NOTE(NOTREACHED)
1434 		return;
1435 
1436 	case BGE_NVTYPE_SEEPROM:
1437 		/*
1438 		 * No arbitration performed, no release needed
1439 		 */
1440 		return;
1441 
1442 	case BGE_NVTYPE_LEGACY_SEEPROM:
1443 	case BGE_NVTYPE_UNBUFFERED_FLASH:
1444 	case BGE_NVTYPE_BUFFERED_FLASH:
1445 	default:
1446 		break;
1447 	}
1448 
1449 	/*
1450 	 * Our own request should be present (whether or not granted) ...
1451 	 */
1452 	(void) bge_reg_get32(bgep, NVM_SW_ARBITRATION_REG);
1453 
1454 	/*
1455 	 * ... this will make it go away.
1456 	 */
1457 	bge_reg_put32(bgep, NVM_SW_ARBITRATION_REG, NVM_RESET_REQ);
1458 	(void) bge_reg_get32(bgep, NVM_SW_ARBITRATION_REG);
1459 }
1460 
1461 /*
1462  * Arbitrate for access to the NVmem, if necessary
1463  *
1464  * Return value:
1465  *	0 on success
1466  *	EAGAIN if the device is in use (retryable)
1467  *	ENODEV if the NVmem device is missing or otherwise unusable
1468  */
1469 static int bge_nvmem_acquire(bge_t *bgep);
1470 #pragma	no_inline(bge_nvmem_acquire)
1471 
1472 static int
1473 bge_nvmem_acquire(bge_t *bgep)
1474 {
1475 	uint32_t regval;
1476 	uint32_t tries;
1477 
1478 	ASSERT(mutex_owned(bgep->genlock));
1479 
1480 	switch (bgep->chipid.nvtype) {
1481 	case BGE_NVTYPE_NONE:
1482 	case BGE_NVTYPE_UNKNOWN:
1483 		/*
1484 		 * Access denied: no (recognisable) device fitted
1485 		 */
1486 		return (ENODEV);
1487 
1488 	case BGE_NVTYPE_SEEPROM:
1489 		/*
1490 		 * Access granted: no arbitration needed (or possible)
1491 		 */
1492 		return (0);
1493 
1494 	case BGE_NVTYPE_LEGACY_SEEPROM:
1495 	case BGE_NVTYPE_UNBUFFERED_FLASH:
1496 	case BGE_NVTYPE_BUFFERED_FLASH:
1497 	default:
1498 		/*
1499 		 * Access conditional: conduct arbitration protocol
1500 		 */
1501 		break;
1502 	}
1503 
1504 	/*
1505 	 * We're holding the per-port mutex <genlock>, so no-one other
1506 	 * threads can be attempting to access the NVmem through *this*
1507 	 * port. But it could be in use by the *other* port (of a 5704),
1508 	 * or by the chip's internal firmware, so we have to go through
1509 	 * the full (hardware) arbitration protocol ...
1510 	 *
1511 	 * Note that *because* we're holding <genlock>, the interrupt handler
1512 	 * won't be able to progress.  So we're only willing to spin for a
1513 	 * fairly short time.  Specifically:
1514 	 *
1515 	 *	We *must* wait long enough for the hardware to resolve all
1516 	 *	requests and determine the winner.  Fortunately, this is
1517 	 *	"almost instantaneous", even as observed by GHz CPUs.
1518 	 *
1519 	 *	A successful access by another Solaris thread (via either
1520 	 *	port) typically takes ~20us.  So waiting a bit longer than
1521 	 *	that will give a good chance of success, if the other user
1522 	 *	*is* another thread on the other port.
1523 	 *
1524 	 *	However, the internal firmware can hold on to the NVmem
1525 	 *	for *much* longer: at least 10 milliseconds just after a
1526 	 *	RESET, and maybe even longer if the NVmem actually contains
1527 	 *	code to download and run on the internal CPUs.
1528 	 *
1529 	 * So, we'll allow 50us; if that's not enough then it's up to the
1530 	 * caller to retry later (hence the choice of return code EAGAIN).
1531 	 */
1532 	regval = bge_reg_get32(bgep, NVM_SW_ARBITRATION_REG);
1533 	bge_reg_put32(bgep, NVM_SW_ARBITRATION_REG, NVM_SET_REQ);
1534 
1535 	for (tries = 0; tries < 50; ++tries) {
1536 		regval = bge_reg_get32(bgep, NVM_SW_ARBITRATION_REG);
1537 		if (regval & NVM_WON_REQ1)
1538 			break;
1539 		drv_usecwait(1);
1540 	}
1541 
1542 	if (regval & NVM_WON_REQ1) {
1543 		BGE_DEBUG(("bge_nvmem_acquire: won after %d us", tries));
1544 		return (0);
1545 	}
1546 
1547 	/*
1548 	 * Somebody else must be accessing the NVmem, so abandon our
1549 	 * attempt take control of it.  The caller can try again later ...
1550 	 */
1551 	BGE_DEBUG(("bge_nvmem_acquire: lost after %d us", tries));
1552 	bge_nvmem_relinquish(bgep);
1553 	return (EAGAIN);
1554 }
1555 
1556 /*
1557  * This code assumes that the GPIO1 bit has been wired up to the NVmem
1558  * write protect line in such a way that the NVmem is protected when
1559  * GPIO1 is an input, or is an output but driven high.  Thus, to make the
1560  * NVmem writable we have to change GPIO1 to an output AND drive it low.
1561  *
1562  * Note: there's only one set of GPIO pins on a 5704, even though they
1563  * can be accessed through either port.  So the chip has to resolve what
1564  * happens if the two ports program a single pin differently ... the rule
1565  * it uses is that if the ports disagree about the *direction* of a pin,
1566  * "output" wins over "input", but if they disagree about its *value* as
1567  * an output, then the pin is TRISTATED instead!  In such a case, no-one
1568  * wins, and the external signal does whatever the external circuitry
1569  * defines as the default -- which we've assumed is the PROTECTED state.
1570  * So, we always change GPIO1 back to being an *input* whenever we're not
1571  * specifically using it to unprotect the NVmem. This allows either port
1572  * to update the NVmem, although obviously only one at a a time!
1573  *
1574  * The caller should hold <genlock> and *also* have already acquired the
1575  * right to access the NVmem, via bge_nvmem_acquire() above.
1576  */
1577 static void bge_nvmem_protect(bge_t *bgep, boolean_t protect);
1578 #pragma	inline(bge_nvmem_protect)
1579 
1580 static void
1581 bge_nvmem_protect(bge_t *bgep, boolean_t protect)
1582 {
1583 	uint32_t regval;
1584 
1585 	ASSERT(mutex_owned(bgep->genlock));
1586 
1587 	regval = bge_reg_get32(bgep, MISC_LOCAL_CONTROL_REG);
1588 	if (protect) {
1589 		regval |= MLCR_MISC_PINS_OUTPUT_1;
1590 		regval &= ~MLCR_MISC_PINS_OUTPUT_ENABLE_1;
1591 	} else {
1592 		regval &= ~MLCR_MISC_PINS_OUTPUT_1;
1593 		regval |= MLCR_MISC_PINS_OUTPUT_ENABLE_1;
1594 	}
1595 	bge_reg_put32(bgep, MISC_LOCAL_CONTROL_REG, regval);
1596 }
1597 
1598 /*
1599  * Now put it all together ...
1600  *
1601  * Try to acquire control of the NVmem; if successful, then:
1602  *	unprotect it (if we want to write to it)
1603  *	perform the requested access
1604  *	reprotect it (after a write)
1605  *	relinquish control
1606  *
1607  * Return value:
1608  *	0 on success,
1609  *	EAGAIN if the device is in use (retryable)
1610  *	ENODATA on access timeout (maybe retryable: device may just be busy)
1611  *	ENODEV if the NVmem device is missing or otherwise unusable
1612  *	EPROTO on other h/w or s/w errors.
1613  */
1614 static int
1615 bge_nvmem_rw32(bge_t *bgep, uint32_t cmd, bge_regno_t addr, uint32_t *dp)
1616 {
1617 	int err;
1618 
1619 	if ((err = bge_nvmem_acquire(bgep)) == 0) {
1620 		switch (cmd) {
1621 		case BGE_SEE_READ:
1622 			err = bge_seeprom_access(bgep,
1623 			    SEEPROM_ACCESS_READ, addr, dp);
1624 			break;
1625 
1626 		case BGE_SEE_WRITE:
1627 			bge_nvmem_protect(bgep, B_FALSE);
1628 			err = bge_seeprom_access(bgep,
1629 			    SEEPROM_ACCESS_WRITE, addr, dp);
1630 			bge_nvmem_protect(bgep, B_TRUE);
1631 			break;
1632 
1633 		case BGE_FLASH_READ:
1634 			if (DEVICE_5721_SERIES_CHIPSETS(bgep) ||
1635 			    DEVICE_5714_SERIES_CHIPSETS(bgep)) {
1636 				bge_reg_set32(bgep, NVM_ACCESS_REG,
1637 				    NVM_ACCESS_ENABLE);
1638 			}
1639 			err = bge_flash_access(bgep,
1640 			    NVM_FLASH_CMD_RD, addr, dp);
1641 			if (DEVICE_5721_SERIES_CHIPSETS(bgep) ||
1642 			    DEVICE_5714_SERIES_CHIPSETS(bgep)) {
1643 				bge_reg_clr32(bgep, NVM_ACCESS_REG,
1644 				    NVM_ACCESS_ENABLE);
1645 			}
1646 			break;
1647 
1648 		case BGE_FLASH_WRITE:
1649 			if (DEVICE_5721_SERIES_CHIPSETS(bgep) ||
1650 			    DEVICE_5714_SERIES_CHIPSETS(bgep)) {
1651 				bge_reg_set32(bgep, NVM_ACCESS_REG,
1652 				    NVM_WRITE_ENABLE|NVM_ACCESS_ENABLE);
1653 			}
1654 			bge_nvmem_protect(bgep, B_FALSE);
1655 			err = bge_flash_access(bgep,
1656 			    NVM_FLASH_CMD_WR, addr, dp);
1657 			bge_nvmem_protect(bgep, B_TRUE);
1658 			if (DEVICE_5721_SERIES_CHIPSETS(bgep) ||
1659 			    DEVICE_5714_SERIES_CHIPSETS(bgep)) {
1660 				bge_reg_clr32(bgep, NVM_ACCESS_REG,
1661 				    NVM_WRITE_ENABLE|NVM_ACCESS_ENABLE);
1662 			}
1663 
1664 			break;
1665 
1666 		default:
1667 			_NOTE(NOTREACHED)
1668 			break;
1669 		}
1670 		bge_nvmem_relinquish(bgep);
1671 	}
1672 
1673 	BGE_DEBUG(("bge_nvmem_rw32: err %d", err));
1674 	return (err);
1675 }
1676 
1677 /*
1678  * Attempt to get a MAC address from the SEEPROM or Flash, if any
1679  */
1680 static uint64_t bge_get_nvmac(bge_t *bgep);
1681 #pragma no_inline(bge_get_nvmac)
1682 
1683 static uint64_t
1684 bge_get_nvmac(bge_t *bgep)
1685 {
1686 	uint32_t mac_high;
1687 	uint32_t mac_low;
1688 	uint32_t addr;
1689 	uint32_t cmd;
1690 	uint64_t mac;
1691 
1692 	BGE_TRACE(("bge_get_nvmac($%p)",
1693 		(void *)bgep));
1694 
1695 	switch (bgep->chipid.nvtype) {
1696 	case BGE_NVTYPE_NONE:
1697 	case BGE_NVTYPE_UNKNOWN:
1698 	default:
1699 		return (0ULL);
1700 
1701 	case BGE_NVTYPE_SEEPROM:
1702 	case BGE_NVTYPE_LEGACY_SEEPROM:
1703 		cmd = BGE_SEE_READ;
1704 		break;
1705 
1706 	case BGE_NVTYPE_UNBUFFERED_FLASH:
1707 	case BGE_NVTYPE_BUFFERED_FLASH:
1708 		cmd = BGE_FLASH_READ;
1709 		break;
1710 	}
1711 
1712 	addr = NVMEM_DATA_MAC_ADDRESS;
1713 	if (bge_nvmem_rw32(bgep, cmd, addr, &mac_high))
1714 		return (0ULL);
1715 	addr += 4;
1716 	if (bge_nvmem_rw32(bgep, cmd, addr, &mac_low))
1717 		return (0ULL);
1718 
1719 	/*
1720 	 * The Broadcom chip is natively BIG-endian, so that's how the
1721 	 * MAC address is represented in NVmem.  We may need to swap it
1722 	 * around on a little-endian host ...
1723 	 */
1724 #ifdef	_BIG_ENDIAN
1725 	mac = mac_high;
1726 	mac = mac << 32;
1727 	mac |= mac_low;
1728 #else
1729 	mac = BGE_BSWAP_32(mac_high);
1730 	mac = mac << 32;
1731 	mac |= BGE_BSWAP_32(mac_low);
1732 #endif	/* _BIG_ENDIAN */
1733 
1734 	return (mac);
1735 }
1736 
1737 #else	/* BGE_SEE_IO32 || BGE_FLASH_IO32 */
1738 
1739 /*
1740  * Dummy version for when we're not supporting NVmem access
1741  */
1742 static uint64_t bge_get_nvmac(bge_t *bgep);
1743 #pragma inline(bge_get_nvmac)
1744 
1745 static uint64_t
1746 bge_get_nvmac(bge_t *bgep)
1747 {
1748 	_NOTE(ARGUNUSED(bgep))
1749 	return (0ULL);
1750 }
1751 
1752 #endif	/* BGE_SEE_IO32 || BGE_FLASH_IO32 */
1753 
1754 /*
1755  * Determine the type of NVmem that is (or may be) attached to this chip,
1756  */
1757 static enum bge_nvmem_type bge_nvmem_id(bge_t *bgep);
1758 #pragma no_inline(bge_nvmem_id)
1759 
1760 static enum bge_nvmem_type
1761 bge_nvmem_id(bge_t *bgep)
1762 {
1763 	enum bge_nvmem_type nvtype;
1764 	uint32_t config1;
1765 
1766 	BGE_TRACE(("bge_nvmem_id($%p)",
1767 		(void *)bgep));
1768 
1769 	switch (bgep->chipid.device) {
1770 	default:
1771 		/*
1772 		 * We shouldn't get here; it means we don't recognise
1773 		 * the chip, which means we don't know how to determine
1774 		 * what sort of NVmem (if any) it has.  So we'll say
1775 		 * NONE, to disable the NVmem access code ...
1776 		 */
1777 		nvtype = BGE_NVTYPE_NONE;
1778 		break;
1779 
1780 	case DEVICE_ID_5700:
1781 	case DEVICE_ID_5700x:
1782 	case DEVICE_ID_5701:
1783 		/*
1784 		 * These devices support *only* SEEPROMs
1785 		 */
1786 		nvtype = BGE_NVTYPE_SEEPROM;
1787 		break;
1788 
1789 	case DEVICE_ID_5702:
1790 	case DEVICE_ID_5702fe:
1791 	case DEVICE_ID_5703C:
1792 	case DEVICE_ID_5703S:
1793 	case DEVICE_ID_5704C:
1794 	case DEVICE_ID_5704S:
1795 	case DEVICE_ID_5704:
1796 	case DEVICE_ID_5705M:
1797 	case DEVICE_ID_5705C:
1798 	case DEVICE_ID_5706:
1799 	case DEVICE_ID_5782:
1800 	case DEVICE_ID_5788:
1801 	case DEVICE_ID_5751:
1802 	case DEVICE_ID_5751M:
1803 	case DEVICE_ID_5721:
1804 	case DEVICE_ID_5714C:
1805 	case DEVICE_ID_5714S:
1806 	case DEVICE_ID_5715C:
1807 		config1 = bge_reg_get32(bgep, NVM_CONFIG1_REG);
1808 		if (config1 & NVM_CFG1_FLASH_MODE)
1809 			if (config1 & NVM_CFG1_BUFFERED_MODE)
1810 				nvtype = BGE_NVTYPE_BUFFERED_FLASH;
1811 			else
1812 				nvtype = BGE_NVTYPE_UNBUFFERED_FLASH;
1813 		else
1814 			nvtype = BGE_NVTYPE_LEGACY_SEEPROM;
1815 		break;
1816 	}
1817 
1818 	return (nvtype);
1819 }
1820 
1821 #undef	BGE_DBG
1822 #define	BGE_DBG		BGE_DBG_CHIP	/* debug flag for this code	*/
1823 
1824 static void
1825 bge_init_recv_rule(bge_t *bgep)
1826 {
1827 	bge_recv_rule_t *rulep;
1828 	uint32_t i;
1829 
1830 	/*
1831 	 * receive rule: direct all TCP traffic to ring RULE_MATCH_TO_RING
1832 	 * 1. to direct UDP traffic, set:
1833 	 * 	rulep->control = RULE_PROTO_CONTROL;
1834 	 * 	rulep->mask_value = RULE_UDP_MASK_VALUE;
1835 	 * 2. to direct ICMP traffic, set:
1836 	 * 	rulep->control = RULE_PROTO_CONTROL;
1837 	 * 	rulep->mask_value = RULE_ICMP_MASK_VALUE;
1838 	 * 3. to direct traffic by source ip, set:
1839 	 * 	rulep->control = RULE_SIP_CONTROL;
1840 	 * 	rulep->mask_value = RULE_SIP_MASK_VALUE;
1841 	 */
1842 	rulep = bgep->recv_rules;
1843 	rulep->control = RULE_PROTO_CONTROL;
1844 	rulep->mask_value = RULE_TCP_MASK_VALUE;
1845 
1846 	/*
1847 	 * set receive rule registers
1848 	 */
1849 	rulep = bgep->recv_rules;
1850 	for (i = 0; i < RECV_RULES_NUM_MAX; i++, rulep++) {
1851 		bge_reg_put32(bgep, RECV_RULE_MASK_REG(i), rulep->mask_value);
1852 		bge_reg_put32(bgep, RECV_RULE_CONTROL_REG(i), rulep->control);
1853 	}
1854 }
1855 
1856 /*
1857  * Using the values captured by bge_chip_cfg_init(), and additional probes
1858  * as required, characterise the chip fully: determine the label by which
1859  * to refer to this chip, the correct settings for various registers, and
1860  * of course whether the device and/or subsystem are supported!
1861  */
1862 int bge_chip_id_init(bge_t *bgep);
1863 #pragma	no_inline(bge_chip_id_init)
1864 
1865 int
1866 bge_chip_id_init(bge_t *bgep)
1867 {
1868 	char buf[MAXPATHLEN];		/* any risk of stack overflow?	*/
1869 	boolean_t sys_ok;
1870 	boolean_t dev_ok;
1871 	chip_id_t *cidp;
1872 	uint32_t subid;
1873 	char *devname;
1874 	char *sysname;
1875 	int *ids;
1876 	int err;
1877 	uint_t i;
1878 
1879 	ASSERT(bgep->bge_chip_state == BGE_CHIP_INITIAL);
1880 
1881 	sys_ok = dev_ok = B_FALSE;
1882 	cidp = &bgep->chipid;
1883 
1884 	/*
1885 	 * Check the PCI device ID to determine the generic chip type and
1886 	 * select parameters that depend on this.
1887 	 *
1888 	 * Note: because the SPARC platforms in general don't fit the
1889 	 * SEEPROM 'behind' the chip, the PCI revision ID register reads
1890 	 * as zero - which is why we use <asic_rev> rather than <revision>
1891 	 * below ...
1892 	 *
1893 	 * Note: in general we can't distinguish between the Copper/SerDes
1894 	 * versions by ID alone, as some Copper devices (e.g. some but not
1895 	 * all 5703Cs) have the same ID as the SerDes equivalents.  So we
1896 	 * treat them the same here, and the MII code works out the media
1897 	 * type later on ...
1898 	 */
1899 	cidp->mbuf_base = bge_mbuf_pool_base;
1900 	cidp->mbuf_length = bge_mbuf_pool_len;
1901 	cidp->recv_slots = BGE_RECV_SLOTS_USED;
1902 	cidp->bge_dma_rwctrl = bge_dma_rwctrl;
1903 	cidp->pci_type = BGE_PCI_X;
1904 	cidp->statistic_type = BGE_STAT_BLK;
1905 	cidp->mbuf_lo_water_rdma = bge_mbuf_lo_water_rdma;
1906 	cidp->mbuf_lo_water_rmac = bge_mbuf_lo_water_rmac;
1907 	cidp->mbuf_hi_water = bge_mbuf_hi_water;
1908 
1909 	if (cidp->rx_rings == 0 || cidp->rx_rings > BGE_RECV_RINGS_MAX)
1910 		cidp->rx_rings = BGE_RECV_RINGS_DEFAULT;
1911 	if (cidp->tx_rings == 0 || cidp->tx_rings > BGE_SEND_RINGS_MAX)
1912 		cidp->tx_rings = BGE_SEND_RINGS_DEFAULT;
1913 
1914 	cidp->msi_enabled = B_FALSE;
1915 
1916 	switch (cidp->device) {
1917 	case DEVICE_ID_5700:
1918 	case DEVICE_ID_5700x:
1919 		cidp->chip_label = 5700;
1920 		cidp->flags |= CHIP_FLAG_NO_CSUM;
1921 		break;
1922 
1923 	case DEVICE_ID_5701:
1924 		cidp->chip_label = 5701;
1925 		dev_ok = B_TRUE;
1926 		cidp->flags |= CHIP_FLAG_NO_CSUM;
1927 		break;
1928 
1929 	case DEVICE_ID_5702:
1930 	case DEVICE_ID_5702fe:
1931 		cidp->chip_label = 5702;
1932 		dev_ok = B_TRUE;
1933 		cidp->flags |= CHIP_FLAG_NO_CSUM;	/* for now	*/
1934 		break;
1935 
1936 	case DEVICE_ID_5703C:
1937 	case DEVICE_ID_5703S:
1938 	case DEVICE_ID_5703:
1939 		/*
1940 		 * Revision A0 of the 5703/5793 had various errata
1941 		 * that we can't or don't work around, so it's not
1942 		 * supported, but all later versions are
1943 		 */
1944 		cidp->chip_label = cidp->subven == VENDOR_ID_SUN ? 5793 : 5703;
1945 		if (bgep->chipid.asic_rev != MHCR_CHIP_REV_5703_A0)
1946 			dev_ok = B_TRUE;
1947 		break;
1948 
1949 	case DEVICE_ID_5704C:
1950 	case DEVICE_ID_5704S:
1951 	case DEVICE_ID_5704:
1952 		/*
1953 		 * Revision A0 of the 5704/5794 had various errata
1954 		 * but we have workarounds, so it *is* supported.
1955 		 */
1956 		cidp->chip_label = cidp->subven == VENDOR_ID_SUN ? 5794 : 5704;
1957 		cidp->mbuf_base = bge_mbuf_pool_base_5704;
1958 		cidp->mbuf_length = bge_mbuf_pool_len_5704;
1959 		dev_ok = B_TRUE;
1960 		break;
1961 
1962 	case DEVICE_ID_5705C:
1963 	case DEVICE_ID_5705M:
1964 	case DEVICE_ID_5705MA3:
1965 	case DEVICE_ID_5705F:
1966 		cidp->chip_label = 5705;
1967 		cidp->mbuf_lo_water_rdma = RDMA_MBUF_LOWAT_5705;
1968 		cidp->mbuf_lo_water_rmac = MAC_RX_MBUF_LOWAT_5705;
1969 		cidp->mbuf_hi_water = MBUF_HIWAT_5705;
1970 		cidp->mbuf_base = bge_mbuf_pool_base_5705;
1971 		cidp->mbuf_length = bge_mbuf_pool_len_5705;
1972 		cidp->recv_slots = BGE_RECV_SLOTS_5705;
1973 		cidp->rx_rings = BGE_RECV_RINGS_MAX_5705;
1974 		cidp->tx_rings = BGE_SEND_RINGS_MAX_5705;
1975 		cidp->flags |= CHIP_FLAG_NO_JUMBO;
1976 		cidp->statistic_type = BGE_STAT_REG;
1977 		dev_ok = B_TRUE;
1978 		break;
1979 
1980 	case DEVICE_ID_5706:
1981 		cidp->chip_label = 5706;
1982 		cidp->flags |= CHIP_FLAG_NO_JUMBO;
1983 		cidp->flags |= CHIP_FLAG_NO_CSUM;	/* for now	*/
1984 		break;
1985 
1986 	case DEVICE_ID_5782:
1987 		/*
1988 		 * Apart from the label, we treat this as a 5705(?)
1989 		 */
1990 		cidp->chip_label = 5782;
1991 		cidp->mbuf_lo_water_rdma = RDMA_MBUF_LOWAT_5705;
1992 		cidp->mbuf_lo_water_rmac = MAC_RX_MBUF_LOWAT_5705;
1993 		cidp->mbuf_hi_water = MBUF_HIWAT_5705;
1994 		cidp->mbuf_base = bge_mbuf_pool_base_5705;
1995 		cidp->mbuf_length = bge_mbuf_pool_len_5705;
1996 		cidp->recv_slots = BGE_RECV_SLOTS_5705;
1997 		cidp->rx_rings = BGE_RECV_RINGS_MAX_5705;
1998 		cidp->tx_rings = BGE_SEND_RINGS_MAX_5705;
1999 		cidp->flags |= CHIP_FLAG_NO_JUMBO;
2000 		cidp->statistic_type = BGE_STAT_REG;
2001 		dev_ok = B_TRUE;
2002 		break;
2003 
2004 	case DEVICE_ID_5788:
2005 		/*
2006 		 * Apart from the label, we treat this as a 5705(?)
2007 		 */
2008 		cidp->chip_label = 5788;
2009 		cidp->mbuf_lo_water_rdma = RDMA_MBUF_LOWAT_5705;
2010 		cidp->mbuf_lo_water_rmac = MAC_RX_MBUF_LOWAT_5705;
2011 		cidp->mbuf_hi_water = MBUF_HIWAT_5705;
2012 		cidp->mbuf_base = bge_mbuf_pool_base_5705;
2013 		cidp->mbuf_length = bge_mbuf_pool_len_5705;
2014 		cidp->recv_slots = BGE_RECV_SLOTS_5705;
2015 		cidp->rx_rings = BGE_RECV_RINGS_MAX_5705;
2016 		cidp->tx_rings = BGE_SEND_RINGS_MAX_5705;
2017 		cidp->statistic_type = BGE_STAT_REG;
2018 		cidp->flags |= CHIP_FLAG_NO_JUMBO;
2019 		dev_ok = B_TRUE;
2020 		break;
2021 
2022 	case DEVICE_ID_5714C:
2023 		if (cidp->revision >= REVISION_ID_5714_A2)
2024 			cidp->msi_enabled = bge_enable_msi;
2025 		/* FALLTHRU */
2026 	case DEVICE_ID_5714S:
2027 		cidp->chip_label = 5714;
2028 		cidp->mbuf_lo_water_rdma = RDMA_MBUF_LOWAT_5705;
2029 		cidp->mbuf_lo_water_rmac = MAC_RX_MBUF_LOWAT_5705;
2030 		cidp->mbuf_hi_water = MBUF_HIWAT_5705;
2031 		cidp->mbuf_base = bge_mbuf_pool_base_5721;
2032 		cidp->mbuf_length = bge_mbuf_pool_len_5721;
2033 		cidp->recv_slots = BGE_RECV_SLOTS_5721;
2034 		cidp->bge_dma_rwctrl = bge_dma_rwctrl_5714;
2035 		cidp->bge_mlcr_default = bge_mlcr_default_5714;
2036 		cidp->rx_rings = BGE_RECV_RINGS_MAX_5705;
2037 		cidp->tx_rings = BGE_SEND_RINGS_MAX_5705;
2038 		cidp->pci_type = BGE_PCI_E;
2039 		cidp->statistic_type = BGE_STAT_REG;
2040 		dev_ok = B_TRUE;
2041 		break;
2042 
2043 	case DEVICE_ID_5715C:
2044 		cidp->chip_label = 5715;
2045 		cidp->mbuf_lo_water_rdma = RDMA_MBUF_LOWAT_5705;
2046 		cidp->mbuf_lo_water_rmac = MAC_RX_MBUF_LOWAT_5705;
2047 		cidp->mbuf_hi_water = MBUF_HIWAT_5705;
2048 		cidp->mbuf_base = bge_mbuf_pool_base_5721;
2049 		cidp->mbuf_length = bge_mbuf_pool_len_5721;
2050 		cidp->recv_slots = BGE_RECV_SLOTS_5721;
2051 		cidp->bge_dma_rwctrl = bge_dma_rwctrl_5715;
2052 		cidp->bge_mlcr_default = bge_mlcr_default_5714;
2053 		cidp->rx_rings = BGE_RECV_RINGS_MAX_5705;
2054 		cidp->tx_rings = BGE_SEND_RINGS_MAX_5705;
2055 		cidp->pci_type = BGE_PCI_E;
2056 		cidp->statistic_type = BGE_STAT_REG;
2057 		if (cidp->revision >= REVISION_ID_5715_A2)
2058 			cidp->msi_enabled = bge_enable_msi;
2059 		dev_ok = B_TRUE;
2060 		break;
2061 
2062 	case DEVICE_ID_5721:
2063 		cidp->chip_label = 5721;
2064 		cidp->mbuf_lo_water_rdma = RDMA_MBUF_LOWAT_5705;
2065 		cidp->mbuf_lo_water_rmac = MAC_RX_MBUF_LOWAT_5705;
2066 		cidp->mbuf_hi_water = MBUF_HIWAT_5705;
2067 		cidp->mbuf_base = bge_mbuf_pool_base_5721;
2068 		cidp->mbuf_length = bge_mbuf_pool_len_5721;
2069 		cidp->recv_slots = BGE_RECV_SLOTS_5721;
2070 		cidp->bge_dma_rwctrl = bge_dma_rwctrl_5721;
2071 		cidp->rx_rings = BGE_RECV_RINGS_MAX_5705;
2072 		cidp->tx_rings = BGE_SEND_RINGS_MAX_5705;
2073 		cidp->pci_type = BGE_PCI_E;
2074 		cidp->statistic_type = BGE_STAT_REG;
2075 		cidp->flags |= CHIP_FLAG_NO_JUMBO;
2076 		dev_ok = B_TRUE;
2077 		break;
2078 
2079 	case DEVICE_ID_5751:
2080 	case DEVICE_ID_5751M:
2081 		cidp->chip_label = 5751;
2082 		cidp->mbuf_lo_water_rdma = RDMA_MBUF_LOWAT_5705;
2083 		cidp->mbuf_lo_water_rmac = MAC_RX_MBUF_LOWAT_5705;
2084 		cidp->mbuf_hi_water = MBUF_HIWAT_5705;
2085 		cidp->mbuf_base = bge_mbuf_pool_base_5721;
2086 		cidp->mbuf_length = bge_mbuf_pool_len_5721;
2087 		cidp->recv_slots = BGE_RECV_SLOTS_5721;
2088 		cidp->bge_dma_rwctrl = bge_dma_rwctrl_5721;
2089 		cidp->rx_rings = BGE_RECV_RINGS_MAX_5705;
2090 		cidp->tx_rings = BGE_SEND_RINGS_MAX_5705;
2091 		cidp->pci_type = BGE_PCI_E;
2092 		cidp->statistic_type = BGE_STAT_REG;
2093 		cidp->flags |= CHIP_FLAG_NO_JUMBO;
2094 		dev_ok = B_TRUE;
2095 		break;
2096 
2097 	}
2098 
2099 	/*
2100 	 * Setup the default jumbo parameter.
2101 	 */
2102 	cidp->ethmax_size = ETHERMAX;
2103 	cidp->snd_buff_size = BGE_SEND_BUFF_SIZE_DEFAULT;
2104 	cidp->std_buf_size = BGE_STD_BUFF_SIZE;
2105 
2106 	/*
2107 	 * If jumbo is enabled and this kind of chipset supports jumbo feature,
2108 	 * setup below jumbo specific parameters.
2109 	 *
2110 	 * For BCM5714/5715, there is only one standard receive ring. So the
2111 	 * std buffer size should be set to BGE_JUMBO_BUFF_SIZE when jumbo
2112 	 * feature is enabled.
2113 	 */
2114 	if (bge_jumbo_enable &&
2115 	    !(cidp->flags & CHIP_FLAG_NO_JUMBO) &&
2116 	    (cidp->default_mtu > BGE_DEFAULT_MTU) &&
2117 	    (cidp->default_mtu <= BGE_MAXIMUM_MTU)) {
2118 	    if (DEVICE_5714_SERIES_CHIPSETS(bgep)) {
2119 			cidp->mbuf_lo_water_rdma =
2120 			    RDMA_MBUF_LOWAT_5714_JUMBO;
2121 			cidp->mbuf_lo_water_rmac =
2122 			    MAC_RX_MBUF_LOWAT_5714_JUMBO;
2123 			cidp->mbuf_hi_water = MBUF_HIWAT_5714_JUMBO;
2124 			cidp->jumbo_slots = 0;
2125 			cidp->std_buf_size = BGE_JUMBO_BUFF_SIZE;
2126 	    } else {
2127 			cidp->mbuf_lo_water_rdma =
2128 			    RDMA_MBUF_LOWAT_JUMBO;
2129 			cidp->mbuf_lo_water_rmac =
2130 			    MAC_RX_MBUF_LOWAT_JUMBO;
2131 			cidp->mbuf_hi_water = MBUF_HIWAT_JUMBO;
2132 			cidp->jumbo_slots = BGE_JUMBO_SLOTS_USED;
2133 		}
2134 		cidp->recv_jumbo_size = BGE_JUMBO_BUFF_SIZE;
2135 		cidp->snd_buff_size = BGE_SEND_BUFF_SIZE_JUMBO;
2136 		cidp->ethmax_size = cidp->default_mtu +
2137 		    sizeof (struct ether_header);
2138 	}
2139 
2140 	/*
2141 	 * Identify the NV memory type: SEEPROM or Flash?
2142 	 */
2143 	cidp->nvtype = bge_nvmem_id(bgep);
2144 
2145 	/*
2146 	 * Now, we want to check whether this device is part of a
2147 	 * supported subsystem (e.g., on the motherboard of a Sun
2148 	 * branded platform).
2149 	 *
2150 	 * Rule 1: If the Subsystem Vendor ID is "Sun", then it's OK ;-)
2151 	 */
2152 	if (cidp->subven == VENDOR_ID_SUN)
2153 		sys_ok = B_TRUE;
2154 
2155 	/*
2156 	 * Rule 2: If it's on the list on known subsystems, then it's OK.
2157 	 * Note: 0x14e41647 should *not* appear in the list, but the code
2158 	 * doesn't enforce that.
2159 	 */
2160 	err = ddi_prop_lookup_int_array(DDI_DEV_T_ANY, bgep->devinfo,
2161 		DDI_PROP_DONTPASS, knownids_propname, &ids, &i);
2162 	if (err == DDI_PROP_SUCCESS) {
2163 		/*
2164 		 * Got the list; scan for a matching subsystem vendor/device
2165 		 */
2166 		subid = (cidp->subven << 16) | cidp->subdev;
2167 		while (i--)
2168 			if (ids[i] == subid)
2169 				sys_ok = B_TRUE;
2170 		ddi_prop_free(ids);
2171 	}
2172 
2173 	/*
2174 	 * Rule 3: If it's a Taco/ENWS motherboard device, then it's OK
2175 	 *
2176 	 * Unfortunately, early SunBlade 1500s and 2500s didn't reprogram
2177 	 * the Subsystem Vendor ID, so it defaults to Broadcom.  Therefore,
2178 	 * we have to check specially for the exact device paths to the
2179 	 * motherboard devices on those platforms ;-(
2180 	 *
2181 	 * Note: we can't just use the "supported-subsystems" mechanism
2182 	 * above, because the entry would have to be 0x14e41647 -- which
2183 	 * would then accept *any* plugin card that *didn't* contain a
2184 	 * (valid) SEEPROM ;-(
2185 	 */
2186 	sysname = ddi_node_name(ddi_root_node());
2187 	devname = ddi_pathname(bgep->devinfo, buf);
2188 	ASSERT(strlen(devname) > 0);
2189 	if (strcmp(sysname, "SUNW,Sun-Blade-1500") == 0)	/* Taco */
2190 		if (strcmp(devname, "/pci@1f,700000/network@2") == 0)
2191 			sys_ok = B_TRUE;
2192 	if (strcmp(sysname, "SUNW,Sun-Blade-2500") == 0)	/* ENWS */
2193 		if (strcmp(devname, "/pci@1c,600000/network@3") == 0)
2194 			sys_ok = B_TRUE;
2195 
2196 	/*
2197 	 * Now check what we've discovered: is this truly a supported
2198 	 * chip on (the motherboard of) a supported platform?
2199 	 *
2200 	 * Possible problems here:
2201 	 * 1)	it's a completely unheard-of chip (e.g. 5761)
2202 	 * 2)	it's a recognised but unsupported chip (e.g. 5701, 5703C-A0)
2203 	 * 3)	it's a chip we would support if it were on the motherboard
2204 	 *	of a Sun platform, but this one isn't ;-(
2205 	 */
2206 	if (cidp->chip_label == 0)
2207 		bge_problem(bgep,
2208 			"Device 'pci%04x,%04x' not recognized (%d?)",
2209 			cidp->vendor, cidp->device, cidp->device);
2210 	else if (!dev_ok)
2211 		bge_problem(bgep,
2212 			"Device 'pci%04x,%04x' (%d) revision %d not supported",
2213 			cidp->vendor, cidp->device, cidp->chip_label,
2214 			cidp->revision);
2215 #if	BGE_DEBUGGING
2216 	else if (!sys_ok)
2217 		bge_problem(bgep,
2218 			"%d-based subsystem 'pci%04x,%04x' not validated",
2219 			cidp->chip_label, cidp->subven, cidp->subdev);
2220 #endif
2221 	else
2222 		cidp->flags |= CHIP_FLAG_SUPPORTED;
2223 	if (bge_check_acc_handle(bgep, bgep->io_handle) != DDI_FM_OK)
2224 		return (EIO);
2225 	return (0);
2226 }
2227 
2228 void
2229 bge_chip_msi_trig(bge_t *bgep)
2230 {
2231 	uint32_t	regval;
2232 
2233 	regval = bgep->param_msi_cnt<<4;
2234 	bge_reg_set32(bgep, HOST_COALESCE_MODE_REG, regval);
2235 	BGE_DEBUG(("bge_chip_msi_trig:data = %d", regval));
2236 }
2237 
2238 /*
2239  * Various registers that control the chip's internal engines (state
2240  * machines) have a <reset> and <enable> bits (fortunately, in the
2241  * same place in each such register :-).
2242  *
2243  * To reset the state machine, the <reset> bit must be written with 1;
2244  * it will then read back as 1 while the reset is in progress, but
2245  * self-clear to 0 when the reset completes.
2246  *
2247  * To enable a state machine, one must set the <enable> bit, which
2248  * will continue to read back as 0 until the state machine is running.
2249  *
2250  * To disable a state machine, the <enable> bit must be cleared, but
2251  * it will continue to read back as 1 until the state machine actually
2252  * stops.
2253  *
2254  * This routine implements polling for completion of a reset, enable
2255  * or disable operation, returning B_TRUE on success (bit reached the
2256  * required state) or B_FALSE on timeout (200*100us == 20ms).
2257  */
2258 static boolean_t bge_chip_poll_engine(bge_t *bgep, bge_regno_t regno,
2259 					uint32_t mask, uint32_t val);
2260 #pragma	no_inline(bge_chip_poll_engine)
2261 
2262 static boolean_t
2263 bge_chip_poll_engine(bge_t *bgep, bge_regno_t regno,
2264 	uint32_t mask, uint32_t val)
2265 {
2266 	uint32_t regval;
2267 	uint32_t n;
2268 
2269 	BGE_TRACE(("bge_chip_poll_engine($%p, 0x%lx, 0x%x, 0x%x)",
2270 		(void *)bgep, regno, mask, val));
2271 
2272 	for (n = 200; n; --n) {
2273 		regval = bge_reg_get32(bgep, regno);
2274 		if ((regval & mask) == val)
2275 			return (B_TRUE);
2276 		drv_usecwait(100);
2277 	}
2278 
2279 	bge_fm_ereport(bgep, DDI_FM_DEVICE_NO_RESPONSE);
2280 	return (B_FALSE);
2281 }
2282 
2283 /*
2284  * Various registers that control the chip's internal engines (state
2285  * machines) have a <reset> bit (fortunately, in the same place in
2286  * each such register :-).  To reset the state machine, this bit must
2287  * be written with 1; it will then read back as 1 while the reset is
2288  * in progress, but self-clear to 0 when the reset completes.
2289  *
2290  * This code sets the bit, then polls for it to read back as zero.
2291  * The return value is B_TRUE on success (reset bit cleared itself),
2292  * or B_FALSE if the state machine didn't recover :(
2293  *
2294  * NOTE: the Core reset is similar to other resets, except that we
2295  * can't poll for completion, since the Core reset disables memory
2296  * access!  So we just have to assume that it will all complete in
2297  * 100us.  See Broadcom document 570X-PG102-R, p102, steps 4-5.
2298  */
2299 static boolean_t bge_chip_reset_engine(bge_t *bgep, bge_regno_t regno);
2300 #pragma	no_inline(bge_chip_reset_engine)
2301 
2302 static boolean_t
2303 bge_chip_reset_engine(bge_t *bgep, bge_regno_t regno)
2304 {
2305 	uint32_t regval;
2306 	uint32_t val32;
2307 
2308 	regval = bge_reg_get32(bgep, regno);
2309 
2310 	BGE_TRACE(("bge_chip_reset_engine($%p, 0x%lx)",
2311 		(void *)bgep, regno));
2312 	BGE_DEBUG(("bge_chip_reset_engine: 0x%lx before reset = 0x%08x",
2313 		regno, regval));
2314 
2315 	regval |= STATE_MACHINE_RESET_BIT;
2316 
2317 	switch (regno) {
2318 	case MISC_CONFIG_REG:
2319 		/*
2320 		 * BCM5714/5721/5751 pcie chip special case. In order to avoid
2321 		 * resetting PCIE block and bringing PCIE link down, bit 29
2322 		 * in the register needs to be set first, and then set it again
2323 		 * while the reset bit is written.
2324 		 * See:P500 of 57xx-PG102-RDS.pdf.
2325 		 */
2326 		if (DEVICE_5705_SERIES_CHIPSETS(bgep)||
2327 		    DEVICE_5721_SERIES_CHIPSETS(bgep)||
2328 		    DEVICE_5714_SERIES_CHIPSETS(bgep)) {
2329 			regval |= MISC_CONFIG_GPHY_POWERDOWN_OVERRIDE;
2330 			if (bgep->chipid.pci_type == BGE_PCI_E) {
2331 				if (bgep->chipid.asic_rev ==
2332 				    MHCR_CHIP_REV_5751_A0 ||
2333 				    bgep->chipid.asic_rev ==
2334 				    MHCR_CHIP_REV_5721_A0) {
2335 					val32 = bge_reg_get32(bgep,
2336 					    PHY_TEST_CTRL_REG);
2337 					if (val32 == (PHY_PCIE_SCRAM_MODE |
2338 					    PHY_PCIE_LTASS_MODE))
2339 						bge_reg_put32(bgep,
2340 						    PHY_TEST_CTRL_REG,
2341 						    PHY_PCIE_SCRAM_MODE);
2342 					val32 = pci_config_get32
2343 					    (bgep->cfg_handle,
2344 					    PCI_CONF_BGE_CLKCTL);
2345 					val32 |= CLKCTL_PCIE_A0_FIX;
2346 					pci_config_put32(bgep->cfg_handle,
2347 					    PCI_CONF_BGE_CLKCTL, val32);
2348 				}
2349 				bge_reg_set32(bgep, regno,
2350 					MISC_CONFIG_GRC_RESET_DISABLE);
2351 				regval |= MISC_CONFIG_GRC_RESET_DISABLE;
2352 			}
2353 		}
2354 
2355 		/*
2356 		 * Special case - causes Core reset
2357 		 *
2358 		 * On SPARC v9 we want to ensure that we don't start
2359 		 * timing until the I/O access has actually reached
2360 		 * the chip, otherwise we might make the next access
2361 		 * too early.  And we can't just force the write out
2362 		 * by following it with a read (even to config space)
2363 		 * because that would cause the fault we're trying
2364 		 * to avoid.  Hence the need for membar_sync() here.
2365 		 */
2366 		ddi_put32(bgep->io_handle, PIO_ADDR(bgep, regno), regval);
2367 #ifdef	__sparcv9
2368 		membar_sync();
2369 #endif	/* __sparcv9 */
2370 		/*
2371 		 * On some platforms,system need about 300us for
2372 		 * link setup.
2373 		 */
2374 		drv_usecwait(300);
2375 
2376 		if (bgep->chipid.pci_type == BGE_PCI_E) {
2377 			/* PCI-E device need more reset time */
2378 			drv_usecwait(120000);
2379 
2380 			/* Set PCIE max payload size and clear error status. */
2381 			if (bgep->chipid.chip_label == 5721 ||
2382 			    bgep->chipid.chip_label == 5751) {
2383 				pci_config_put16(bgep->cfg_handle,
2384 					PCI_CONF_DEV_CTRL, READ_REQ_SIZE_MAX);
2385 				pci_config_put16(bgep->cfg_handle,
2386 					PCI_CONF_DEV_STUS, DEVICE_ERROR_STUS);
2387 			}
2388 		}
2389 
2390 		BGE_PCICHK(bgep);
2391 		return (B_TRUE);
2392 
2393 	default:
2394 		bge_reg_put32(bgep, regno, regval);
2395 		return (bge_chip_poll_engine(bgep, regno,
2396 		    STATE_MACHINE_RESET_BIT, 0));
2397 	}
2398 }
2399 
2400 /*
2401  * Various registers that control the chip's internal engines (state
2402  * machines) have an <enable> bit (fortunately, in the same place in
2403  * each such register :-).  To stop the state machine, this bit must
2404  * be written with 0, then polled to see when the state machine has
2405  * actually stopped.
2406  *
2407  * The return value is B_TRUE on success (enable bit cleared), or
2408  * B_FALSE if the state machine didn't stop :(
2409  */
2410 static boolean_t bge_chip_disable_engine(bge_t *bgep, bge_regno_t regno,
2411 						uint32_t morebits);
2412 #pragma	no_inline(bge_chip_disable_engine)
2413 
2414 static boolean_t
2415 bge_chip_disable_engine(bge_t *bgep, bge_regno_t regno, uint32_t morebits)
2416 {
2417 	uint32_t regval;
2418 
2419 	BGE_TRACE(("bge_chip_disable_engine($%p, 0x%lx, 0x%x)",
2420 		(void *)bgep, regno, morebits));
2421 
2422 	switch (regno) {
2423 	case FTQ_RESET_REG:
2424 		/*
2425 		 * Not quite like the others; it doesn't
2426 		 * have an <enable> bit, but instead we
2427 		 * have to set and then clear all the bits
2428 		 */
2429 		bge_reg_put32(bgep, regno, ~(uint32_t)0);
2430 		drv_usecwait(100);
2431 		bge_reg_put32(bgep, regno, 0);
2432 		return (B_TRUE);
2433 
2434 	default:
2435 		regval = bge_reg_get32(bgep, regno);
2436 		regval &= ~STATE_MACHINE_ENABLE_BIT;
2437 		regval &= ~morebits;
2438 		bge_reg_put32(bgep, regno, regval);
2439 		return (bge_chip_poll_engine(bgep, regno,
2440 		    STATE_MACHINE_ENABLE_BIT, 0));
2441 	}
2442 }
2443 
2444 /*
2445  * Various registers that control the chip's internal engines (state
2446  * machines) have an <enable> bit (fortunately, in the same place in
2447  * each such register :-).  To start the state machine, this bit must
2448  * be written with 1, then polled to see when the state machine has
2449  * actually started.
2450  *
2451  * The return value is B_TRUE on success (enable bit set), or
2452  * B_FALSE if the state machine didn't start :(
2453  */
2454 static boolean_t bge_chip_enable_engine(bge_t *bgep, bge_regno_t regno,
2455 					uint32_t morebits);
2456 #pragma	no_inline(bge_chip_enable_engine)
2457 
2458 static boolean_t
2459 bge_chip_enable_engine(bge_t *bgep, bge_regno_t regno, uint32_t morebits)
2460 {
2461 	uint32_t regval;
2462 
2463 	BGE_TRACE(("bge_chip_enable_engine($%p, 0x%lx, 0x%x)",
2464 		(void *)bgep, regno, morebits));
2465 
2466 	switch (regno) {
2467 	case FTQ_RESET_REG:
2468 		/*
2469 		 * Not quite like the others; it doesn't
2470 		 * have an <enable> bit, but instead we
2471 		 * have to set and then clear all the bits
2472 		 */
2473 		bge_reg_put32(bgep, regno, ~(uint32_t)0);
2474 		drv_usecwait(100);
2475 		bge_reg_put32(bgep, regno, 0);
2476 		return (B_TRUE);
2477 
2478 	default:
2479 		regval = bge_reg_get32(bgep, regno);
2480 		regval |= STATE_MACHINE_ENABLE_BIT;
2481 		regval |= morebits;
2482 		bge_reg_put32(bgep, regno, regval);
2483 		return (bge_chip_poll_engine(bgep, regno,
2484 		    STATE_MACHINE_ENABLE_BIT, STATE_MACHINE_ENABLE_BIT));
2485 	}
2486 }
2487 
2488 /*
2489  * Reprogram the Ethernet, Transmit, and Receive MAC
2490  * modes to match the param_* variables
2491  */
2492 static void bge_sync_mac_modes(bge_t *bgep);
2493 #pragma	no_inline(bge_sync_mac_modes)
2494 
2495 static void
2496 bge_sync_mac_modes(bge_t *bgep)
2497 {
2498 	uint32_t macmode;
2499 	uint32_t regval;
2500 
2501 	ASSERT(mutex_owned(bgep->genlock));
2502 
2503 	/*
2504 	 * Reprogram the Ethernet MAC mode ...
2505 	 */
2506 	macmode = regval = bge_reg_get32(bgep, ETHERNET_MAC_MODE_REG);
2507 	if ((bgep->chipid.flags & CHIP_FLAG_SERDES) &&
2508 		(bgep->param_loop_mode != BGE_LOOP_INTERNAL_MAC))
2509 		macmode &= ~ETHERNET_MODE_LINK_POLARITY;
2510 	else
2511 		macmode |= ETHERNET_MODE_LINK_POLARITY;
2512 	macmode &= ~ETHERNET_MODE_PORTMODE_MASK;
2513 	if ((bgep->chipid.flags & CHIP_FLAG_SERDES) &&
2514 		(bgep->param_loop_mode != BGE_LOOP_INTERNAL_MAC))
2515 		macmode |= ETHERNET_MODE_PORTMODE_TBI;
2516 	else if (bgep->param_link_speed == 10 || bgep->param_link_speed == 100)
2517 		macmode |= ETHERNET_MODE_PORTMODE_MII;
2518 	else
2519 		macmode |= ETHERNET_MODE_PORTMODE_GMII;
2520 	if (bgep->param_link_duplex == LINK_DUPLEX_HALF)
2521 		macmode |= ETHERNET_MODE_HALF_DUPLEX;
2522 	else
2523 		macmode &= ~ETHERNET_MODE_HALF_DUPLEX;
2524 	if (bgep->param_loop_mode == BGE_LOOP_INTERNAL_MAC)
2525 		macmode |= ETHERNET_MODE_MAC_LOOPBACK;
2526 	else
2527 		macmode &= ~ETHERNET_MODE_MAC_LOOPBACK;
2528 	bge_reg_put32(bgep, ETHERNET_MAC_MODE_REG, macmode);
2529 	BGE_DEBUG(("bge_sync_mac_modes($%p) Ethernet MAC mode 0x%x => 0x%x",
2530 		(void *)bgep, regval, macmode));
2531 
2532 	/*
2533 	 * ... the Transmit MAC mode ...
2534 	 */
2535 	macmode = regval = bge_reg_get32(bgep, TRANSMIT_MAC_MODE_REG);
2536 	if (bgep->param_link_tx_pause)
2537 		macmode |= TRANSMIT_MODE_FLOW_CONTROL;
2538 	else
2539 		macmode &= ~TRANSMIT_MODE_FLOW_CONTROL;
2540 	bge_reg_put32(bgep, TRANSMIT_MAC_MODE_REG, macmode);
2541 	BGE_DEBUG(("bge_sync_mac_modes($%p) Transmit MAC mode 0x%x => 0x%x",
2542 		(void *)bgep, regval, macmode));
2543 
2544 	/*
2545 	 * ... and the Receive MAC mode
2546 	 */
2547 	macmode = regval = bge_reg_get32(bgep, RECEIVE_MAC_MODE_REG);
2548 	if (bgep->param_link_rx_pause)
2549 		macmode |= RECEIVE_MODE_FLOW_CONTROL;
2550 	else
2551 		macmode &= ~RECEIVE_MODE_FLOW_CONTROL;
2552 	bge_reg_put32(bgep, RECEIVE_MAC_MODE_REG, macmode);
2553 	BGE_DEBUG(("bge_sync_mac_modes($%p) Receive MAC mode 0x%x => 0x%x",
2554 		(void *)bgep, regval, macmode));
2555 }
2556 
2557 /*
2558  * bge_chip_sync() -- program the chip with the unicast MAC address,
2559  * the multicast hash table, the required level of promiscuity, and
2560  * the current loopback mode ...
2561  */
2562 #ifdef BGE_IPMI_ASF
2563 int bge_chip_sync(bge_t *bgep, boolean_t asf_keeplive);
2564 #else
2565 int bge_chip_sync(bge_t *bgep);
2566 #endif
2567 #pragma	no_inline(bge_chip_sync)
2568 
2569 int
2570 #ifdef BGE_IPMI_ASF
2571 bge_chip_sync(bge_t *bgep, boolean_t asf_keeplive)
2572 #else
2573 bge_chip_sync(bge_t *bgep)
2574 #endif
2575 {
2576 	void (*opfn)(bge_t *bgep, bge_regno_t reg, uint32_t bits);
2577 	boolean_t promisc;
2578 	uint64_t macaddr;
2579 	uint32_t fill;
2580 	int i;
2581 	int retval = DDI_SUCCESS;
2582 
2583 	BGE_TRACE(("bge_chip_sync($%p)",
2584 		(void *)bgep));
2585 
2586 	ASSERT(mutex_owned(bgep->genlock));
2587 
2588 	promisc = B_FALSE;
2589 	fill = ~(uint32_t)0;
2590 
2591 	if (bgep->promisc)
2592 		promisc = B_TRUE;
2593 	else
2594 		fill = (uint32_t)0;
2595 
2596 	/*
2597 	 * If the TX/RX MAC engines are already running, we should stop
2598 	 * them (and reset the RX engine) before changing the parameters.
2599 	 * If they're not running, this will have no effect ...
2600 	 *
2601 	 * NOTE: this is currently disabled by default because stopping
2602 	 * and restarting the Tx engine may cause an outgoing packet in
2603 	 * transit to be truncated.  Also, stopping and restarting the
2604 	 * Rx engine seems to not work correctly on the 5705.  Testing
2605 	 * has not (yet!) revealed any problems with NOT stopping and
2606 	 * restarting these engines (and Broadcom say their drivers don't
2607 	 * do this), but if it is found to cause problems, this variable
2608 	 * can be patched to re-enable the old behaviour ...
2609 	 */
2610 	if (bge_stop_start_on_sync) {
2611 #ifdef BGE_IPMI_ASF
2612 		if (!bgep->asf_enabled) {
2613 			if (!bge_chip_disable_engine(bgep,
2614 			    RECEIVE_MAC_MODE_REG, RECEIVE_MODE_KEEP_VLAN_TAG))
2615 				retval = DDI_FAILURE;
2616 		} else {
2617 			if (!bge_chip_disable_engine(bgep,
2618 			    RECEIVE_MAC_MODE_REG, 0))
2619 				retval = DDI_FAILURE;
2620 		}
2621 #else
2622 		if (!bge_chip_disable_engine(bgep, RECEIVE_MAC_MODE_REG,
2623 		    RECEIVE_MODE_KEEP_VLAN_TAG))
2624 			retval = DDI_FAILURE;
2625 #endif
2626 		if (!bge_chip_disable_engine(bgep, TRANSMIT_MAC_MODE_REG, 0))
2627 			retval = DDI_FAILURE;
2628 		if (!bge_chip_reset_engine(bgep, RECEIVE_MAC_MODE_REG))
2629 			retval = DDI_FAILURE;
2630 	}
2631 
2632 	/*
2633 	 * Reprogram the hashed multicast address table ...
2634 	 */
2635 	for (i = 0; i < BGE_HASH_TABLE_SIZE/32; ++i)
2636 		bge_reg_put32(bgep, MAC_HASH_REG(i),
2637 			bgep->mcast_hash[i] | fill);
2638 
2639 #ifdef BGE_IPMI_ASF
2640 	if (!bgep->asf_enabled || !asf_keeplive) {
2641 #endif
2642 		/*
2643 		 * Transform the MAC address from host to chip format, then
2644 		 * reprogram the transmit random backoff seed and the unicast
2645 		 * MAC address(es) ...
2646 		 */
2647 		for (i = 0, fill = 0, macaddr = 0ull; i < ETHERADDRL; ++i) {
2648 			macaddr <<= 8;
2649 			macaddr |= bgep->curr_addr.addr[i];
2650 			fill += bgep->curr_addr.addr[i];
2651 		}
2652 		bge_reg_put32(bgep, MAC_TX_RANDOM_BACKOFF_REG, fill);
2653 		for (i = 0; i < MAC_ADDRESS_REGS_MAX; ++i)
2654 			bge_reg_put64(bgep, MAC_ADDRESS_REG(i), macaddr);
2655 
2656 		BGE_DEBUG(("bge_chip_sync($%p) setting MAC address %012llx",
2657 			(void *)bgep, macaddr));
2658 #ifdef BGE_IPMI_ASF
2659 	}
2660 #endif
2661 
2662 	/*
2663 	 * Set or clear the PROMISCUOUS mode bit
2664 	 */
2665 	opfn = promisc ? bge_reg_set32 : bge_reg_clr32;
2666 	(*opfn)(bgep, RECEIVE_MAC_MODE_REG, RECEIVE_MODE_PROMISCUOUS);
2667 
2668 	/*
2669 	 * Sync the rest of the MAC modes too ...
2670 	 */
2671 	bge_sync_mac_modes(bgep);
2672 
2673 	/*
2674 	 * Restart RX/TX MAC engines if required ...
2675 	 */
2676 	if (bgep->bge_chip_state == BGE_CHIP_RUNNING) {
2677 		if (!bge_chip_enable_engine(bgep, TRANSMIT_MAC_MODE_REG, 0))
2678 			retval = DDI_FAILURE;
2679 #ifdef BGE_IPMI_ASF
2680 		if (!bgep->asf_enabled) {
2681 			if (!bge_chip_enable_engine(bgep,
2682 			    RECEIVE_MAC_MODE_REG, RECEIVE_MODE_KEEP_VLAN_TAG))
2683 				retval = DDI_FAILURE;
2684 		} else {
2685 			if (!bge_chip_enable_engine(bgep,
2686 			    RECEIVE_MAC_MODE_REG, 0))
2687 				retval = DDI_FAILURE;
2688 		}
2689 #else
2690 		if (!bge_chip_enable_engine(bgep, RECEIVE_MAC_MODE_REG,
2691 		    RECEIVE_MODE_KEEP_VLAN_TAG))
2692 			retval = DDI_FAILURE;
2693 #endif
2694 	}
2695 	return (retval);
2696 }
2697 
2698 /*
2699  * This array defines the sequence of state machine control registers
2700  * in which the <enable> bit must be cleared to bring the chip to a
2701  * clean stop.  Taken from Broadcom document 570X-PG102-R, p116.
2702  */
2703 static bge_regno_t shutdown_engine_regs[] = {
2704 	RECEIVE_MAC_MODE_REG,
2705 	RCV_BD_INITIATOR_MODE_REG,
2706 	RCV_LIST_PLACEMENT_MODE_REG,
2707 	RCV_LIST_SELECTOR_MODE_REG,		/* BCM5704 series only	*/
2708 	RCV_DATA_BD_INITIATOR_MODE_REG,
2709 	RCV_DATA_COMPLETION_MODE_REG,
2710 	RCV_BD_COMPLETION_MODE_REG,
2711 
2712 	SEND_BD_SELECTOR_MODE_REG,
2713 	SEND_BD_INITIATOR_MODE_REG,
2714 	SEND_DATA_INITIATOR_MODE_REG,
2715 	READ_DMA_MODE_REG,
2716 	SEND_DATA_COMPLETION_MODE_REG,
2717 	DMA_COMPLETION_MODE_REG,		/* BCM5704 series only	*/
2718 	SEND_BD_COMPLETION_MODE_REG,
2719 	TRANSMIT_MAC_MODE_REG,
2720 
2721 	HOST_COALESCE_MODE_REG,
2722 	WRITE_DMA_MODE_REG,
2723 	MBUF_CLUSTER_FREE_MODE_REG,		/* BCM5704 series only	*/
2724 	FTQ_RESET_REG,		/* special - see code	*/
2725 	BUFFER_MANAGER_MODE_REG,		/* BCM5704 series only	*/
2726 	MEMORY_ARBITER_MODE_REG,		/* BCM5704 series only	*/
2727 	BGE_REGNO_NONE		/* terminator		*/
2728 };
2729 
2730 /*
2731  * bge_chip_stop() -- stop all chip processing
2732  *
2733  * If the <fault> parameter is B_TRUE, we're stopping the chip because
2734  * we've detected a problem internally; otherwise, this is a normal
2735  * (clean) stop (at user request i.e. the last STREAM has been closed).
2736  */
2737 void bge_chip_stop(bge_t *bgep, boolean_t fault);
2738 #pragma	no_inline(bge_chip_stop)
2739 
2740 void
2741 bge_chip_stop(bge_t *bgep, boolean_t fault)
2742 {
2743 	bge_regno_t regno;
2744 	bge_regno_t *rbp;
2745 	boolean_t ok;
2746 
2747 	BGE_TRACE(("bge_chip_stop($%p)",
2748 		(void *)bgep));
2749 
2750 	ASSERT(mutex_owned(bgep->genlock));
2751 
2752 	rbp = shutdown_engine_regs;
2753 	/*
2754 	 * When driver try to shutdown the BCM5705/5788/5721/5751/
2755 	 * 5752/5714 and 5715 chipsets,the buffer manager and the mem
2756 	 * -ory arbiter should not be disabled.
2757 	 */
2758 	for (ok = B_TRUE; (regno = *rbp) != BGE_REGNO_NONE; ++rbp) {
2759 			if (DEVICE_5704_SERIES_CHIPSETS(bgep))
2760 			    ok &= bge_chip_disable_engine(bgep, regno, 0);
2761 			else if ((regno != RCV_LIST_SELECTOR_MODE_REG) &&
2762 				    (regno != DMA_COMPLETION_MODE_REG) &&
2763 				    (regno != MBUF_CLUSTER_FREE_MODE_REG)&&
2764 				    (regno != BUFFER_MANAGER_MODE_REG) &&
2765 				    (regno != MEMORY_ARBITER_MODE_REG))
2766 					ok &= bge_chip_disable_engine(bgep,
2767 					    regno, 0);
2768 	}
2769 
2770 	if (!ok && !fault)
2771 		ddi_fm_service_impact(bgep->devinfo, DDI_SERVICE_UNAFFECTED);
2772 
2773 	/*
2774 	 * Finally, disable (all) MAC events & clear the MAC status
2775 	 */
2776 	bge_reg_put32(bgep, ETHERNET_MAC_EVENT_ENABLE_REG, 0);
2777 	bge_reg_put32(bgep, ETHERNET_MAC_STATUS_REG, ~0);
2778 
2779 	/*
2780 	 * if we're stopping the chip because of a detected fault then do
2781 	 * appropriate actions
2782 	 */
2783 	if (fault) {
2784 		if (bgep->bge_chip_state != BGE_CHIP_FAULT) {
2785 			bgep->bge_chip_state = BGE_CHIP_FAULT;
2786 			ddi_fm_service_impact(bgep->devinfo, DDI_SERVICE_LOST);
2787 			if (bgep->bge_dma_error) {
2788 				/*
2789 				 * need to free buffers in case the fault was
2790 				 * due to a memory error in a buffer - got to
2791 				 * do a fair bit of tidying first
2792 				 */
2793 				if (bgep->progress & PROGRESS_KSTATS) {
2794 					bge_fini_kstats(bgep);
2795 					bgep->progress &= ~PROGRESS_KSTATS;
2796 				}
2797 				if (bgep->progress & PROGRESS_INTR) {
2798 					bge_intr_disable(bgep);
2799 					rw_enter(bgep->errlock, RW_WRITER);
2800 					bge_fini_rings(bgep);
2801 					rw_exit(bgep->errlock);
2802 					bgep->progress &= ~PROGRESS_INTR;
2803 				}
2804 				if (bgep->progress & PROGRESS_BUFS) {
2805 					bge_free_bufs(bgep);
2806 					bgep->progress &= ~PROGRESS_BUFS;
2807 				}
2808 				bgep->bge_dma_error = B_FALSE;
2809 			}
2810 		}
2811 	} else
2812 		bgep->bge_chip_state = BGE_CHIP_STOPPED;
2813 }
2814 
2815 /*
2816  * Poll for completion of chip's ROM firmware; also, at least on the
2817  * first time through, find and return the hardware MAC address, if any.
2818  */
2819 static uint64_t bge_poll_firmware(bge_t *bgep);
2820 #pragma	no_inline(bge_poll_firmware)
2821 
2822 static uint64_t
2823 bge_poll_firmware(bge_t *bgep)
2824 {
2825 	uint64_t magic;
2826 	uint64_t mac;
2827 	uint32_t gen;
2828 	uint32_t i;
2829 
2830 	/*
2831 	 * Step 19: poll for firmware completion (GENCOMM port set
2832 	 * to the ones complement of T3_MAGIC_NUMBER).
2833 	 *
2834 	 * While we're at it, we also read the MAC address register;
2835 	 * at some stage the the firmware will load this with the
2836 	 * factory-set value.
2837 	 *
2838 	 * When both the magic number and the MAC address are set,
2839 	 * we're done; but we impose a time limit of one second
2840 	 * (1000*1000us) in case the firmware fails in some fashion
2841 	 * or the SEEPROM that provides that MAC address isn't fitted.
2842 	 *
2843 	 * After the first time through (chip state != INITIAL), we
2844 	 * don't need the MAC address to be set (we've already got it
2845 	 * or not, from the first time), so we don't wait for it, but
2846 	 * we still have to wait for the T3_MAGIC_NUMBER.
2847 	 *
2848 	 * Note: the magic number is only a 32-bit quantity, but the NIC
2849 	 * memory is 64-bit (and big-endian) internally.  Addressing the
2850 	 * GENCOMM word as "the upper half of a 64-bit quantity" makes
2851 	 * it work correctly on both big- and little-endian hosts.
2852 	 */
2853 	for (i = 0; i < 1000; ++i) {
2854 		drv_usecwait(1000);
2855 		gen = bge_nic_get64(bgep, NIC_MEM_GENCOMM) >> 32;
2856 		mac = bge_reg_get64(bgep, MAC_ADDRESS_REG(0));
2857 #ifdef BGE_IPMI_ASF
2858 		if (!bgep->asf_enabled) {
2859 #endif
2860 			if (gen != ~T3_MAGIC_NUMBER)
2861 				continue;
2862 #ifdef BGE_IPMI_ASF
2863 		}
2864 #endif
2865 		if (mac != 0ULL)
2866 			break;
2867 		if (bgep->bge_chip_state != BGE_CHIP_INITIAL)
2868 			break;
2869 	}
2870 
2871 	magic = bge_nic_get64(bgep, NIC_MEM_GENCOMM);
2872 	BGE_DEBUG(("bge_poll_firmware($%p): PXE magic 0x%x after %d loops",
2873 		(void *)bgep, gen, i));
2874 	BGE_DEBUG(("bge_poll_firmware: MAC %016llx, GENCOMM %016llx",
2875 		mac, magic));
2876 
2877 	return (mac);
2878 }
2879 
2880 #ifdef BGE_IPMI_ASF
2881 int bge_chip_reset(bge_t *bgep, boolean_t enable_dma, uint_t asf_mode);
2882 #else
2883 int bge_chip_reset(bge_t *bgep, boolean_t enable_dma);
2884 #endif
2885 #pragma	no_inline(bge_chip_reset)
2886 
2887 int
2888 #ifdef BGE_IPMI_ASF
2889 bge_chip_reset(bge_t *bgep, boolean_t enable_dma, uint_t asf_mode)
2890 #else
2891 bge_chip_reset(bge_t *bgep, boolean_t enable_dma)
2892 #endif
2893 {
2894 	chip_id_t chipid;
2895 	uint64_t mac;
2896 	uint64_t magic;
2897 	uint32_t modeflags;
2898 	uint32_t mhcr;
2899 	uint32_t sx0;
2900 	uint32_t i;
2901 #ifdef BGE_IPMI_ASF
2902 	uint32_t mailbox;
2903 #endif
2904 	int retval = DDI_SUCCESS;
2905 
2906 	BGE_TRACE(("bge_chip_reset($%p, %d)",
2907 		(void *)bgep, enable_dma));
2908 
2909 	ASSERT(mutex_owned(bgep->genlock));
2910 
2911 	BGE_DEBUG(("bge_chip_reset($%p, %d): current state is %d",
2912 		(void *)bgep, enable_dma, bgep->bge_chip_state));
2913 
2914 	/*
2915 	 * Do we need to stop the chip cleanly before resetting?
2916 	 */
2917 	switch (bgep->bge_chip_state) {
2918 	default:
2919 		_NOTE(NOTREACHED)
2920 		return (DDI_FAILURE);
2921 
2922 	case BGE_CHIP_INITIAL:
2923 	case BGE_CHIP_STOPPED:
2924 	case BGE_CHIP_RESET:
2925 		break;
2926 
2927 	case BGE_CHIP_RUNNING:
2928 	case BGE_CHIP_ERROR:
2929 	case BGE_CHIP_FAULT:
2930 		bge_chip_stop(bgep, B_FALSE);
2931 		break;
2932 	}
2933 
2934 #ifdef BGE_IPMI_ASF
2935 	if (bgep->asf_enabled) {
2936 		if (asf_mode == ASF_MODE_INIT) {
2937 			bge_asf_pre_reset_operations(bgep, BGE_INIT_RESET);
2938 		} else if (asf_mode == ASF_MODE_SHUTDOWN) {
2939 			bge_asf_pre_reset_operations(bgep, BGE_SHUTDOWN_RESET);
2940 		}
2941 	}
2942 #endif
2943 	/*
2944 	 * Adapted from Broadcom document 570X-PG102-R, pp 102-116.
2945 	 * Updated to reflect Broadcom document 570X-PG104-R, pp 146-159.
2946 	 *
2947 	 * Before reset Core clock,it is
2948 	 * also required to initialize the Memory Arbiter as specified in step9
2949 	 * and Misc Host Control Register as specified in step-13
2950 	 * Step 4-5: reset Core clock & wait for completion
2951 	 * Steps 6-8: are done by bge_chip_cfg_init()
2952 	 * put the T3_MAGIC_NUMBER into the GENCOMM port before reset
2953 	 */
2954 	if (!bge_chip_enable_engine(bgep, MEMORY_ARBITER_MODE_REG, 0))
2955 		retval = DDI_FAILURE;
2956 
2957 	mhcr = MHCR_ENABLE_INDIRECT_ACCESS |
2958 	    MHCR_ENABLE_TAGGED_STATUS_MODE |
2959 	    MHCR_MASK_INTERRUPT_MODE |
2960 	    MHCR_MASK_PCI_INT_OUTPUT |
2961 	    MHCR_CLEAR_INTERRUPT_INTA;
2962 #ifdef  _BIG_ENDIAN
2963 	mhcr |= MHCR_ENABLE_ENDIAN_WORD_SWAP | MHCR_ENABLE_ENDIAN_BYTE_SWAP;
2964 #endif  /* _BIG_ENDIAN */
2965 	pci_config_put32(bgep->cfg_handle, PCI_CONF_BGE_MHCR, mhcr);
2966 #ifdef BGE_IPMI_ASF
2967 	if (bgep->asf_enabled)
2968 		bgep->asf_wordswapped = B_FALSE;
2969 #endif
2970 #ifdef BGE_IPMI_ASF
2971 	if (!bgep->asf_enabled) {
2972 #endif
2973 		magic = (uint64_t)T3_MAGIC_NUMBER << 32;
2974 		bge_nic_put64(bgep, NIC_MEM_GENCOMM, magic);
2975 #ifdef BGE_IPMI_ASF
2976 	}
2977 #endif
2978 
2979 	if (!bge_chip_reset_engine(bgep, MISC_CONFIG_REG))
2980 		retval = DDI_FAILURE;
2981 	bge_chip_cfg_init(bgep, &chipid, enable_dma);
2982 
2983 	/*
2984 	 * Step 8a: This may belong elsewhere, but BCM5721 needs
2985 	 * a bit set to avoid a fifo overflow/underflow bug.
2986 	 */
2987 	if (bgep->chipid.chip_label == 5721 || bgep->chipid.chip_label == 5751)
2988 		bge_reg_set32(bgep, TLP_CONTROL_REG, TLP_DATA_FIFO_PROTECT);
2989 
2990 
2991 	/*
2992 	 * Step 9: enable MAC memory arbiter,bit30 and bit31 of 5714/5715 should
2993 	 * not be changed.
2994 	 */
2995 	if (!bge_chip_enable_engine(bgep, MEMORY_ARBITER_MODE_REG, 0))
2996 		retval = DDI_FAILURE;
2997 
2998 	/*
2999 	 * Steps 10-11: configure PIO endianness options and
3000 	 * enable indirect register access -- already done
3001 	 * Steps 12-13: enable writing to the PCI state & clock
3002 	 * control registers -- not required; we aren't going to
3003 	 * use those features.
3004 	 * Steps 14-15: Configure DMA endianness options.  See
3005 	 * the comments on the setting of the MHCR above.
3006 	 */
3007 #ifdef	_BIG_ENDIAN
3008 	modeflags = MODE_WORD_SWAP_FRAME | MODE_BYTE_SWAP_FRAME |
3009 		    MODE_WORD_SWAP_NONFRAME | MODE_BYTE_SWAP_NONFRAME;
3010 #else
3011 	modeflags = MODE_WORD_SWAP_FRAME | MODE_BYTE_SWAP_FRAME;
3012 #endif	/* _BIG_ENDIAN */
3013 #ifdef BGE_IPMI_ASF
3014 	if (bgep->asf_enabled)
3015 		modeflags |= MODE_HOST_STACK_UP;
3016 #endif
3017 	bge_reg_put32(bgep, MODE_CONTROL_REG, modeflags);
3018 
3019 #ifdef BGE_IPMI_ASF
3020 	if (bgep->asf_enabled) {
3021 		if (asf_mode != ASF_MODE_NONE) {
3022 			/* Wait for NVRAM init */
3023 			i = 0;
3024 			drv_usecwait(5000);
3025 			mailbox = bge_nic_get32(bgep, BGE_FIRMWARE_MAILBOX);
3026 			while ((mailbox != (uint32_t)
3027 				~BGE_MAGIC_NUM_FIRMWARE_INIT_DONE) &&
3028 				(i < 10000)) {
3029 				drv_usecwait(100);
3030 				mailbox = bge_nic_get32(bgep,
3031 					BGE_FIRMWARE_MAILBOX);
3032 				i++;
3033 			}
3034 			if (!bgep->asf_newhandshake) {
3035 				if ((asf_mode == ASF_MODE_INIT) ||
3036 					(asf_mode == ASF_MODE_POST_INIT)) {
3037 
3038 					bge_asf_post_reset_old_mode(bgep,
3039 						BGE_INIT_RESET);
3040 				} else {
3041 					bge_asf_post_reset_old_mode(bgep,
3042 						BGE_SHUTDOWN_RESET);
3043 				}
3044 			}
3045 		}
3046 	}
3047 #endif
3048 	/*
3049 	 * Steps 16-17: poll for firmware completion
3050 	 */
3051 	mac = bge_poll_firmware(bgep);
3052 
3053 	/*
3054 	 * Step 18: enable external memory -- doesn't apply.
3055 	 *
3056 	 * However we take the opportunity to set the MLCR anyway, as
3057 	 * this register also controls the SEEPROM auto-access method
3058 	 * which we may want to use later ...
3059 	 *
3060 	 * The proper value here depends on the way the chip is wired
3061 	 * into the circuit board, as this register *also* controls which
3062 	 * of the "Miscellaneous I/O" pins are driven as outputs and the
3063 	 * values driven onto those pins!
3064 	 *
3065 	 * See also step 74 in the PRM ...
3066 	 */
3067 	bge_reg_put32(bgep, MISC_LOCAL_CONTROL_REG,
3068 	    bgep->chipid.bge_mlcr_default);
3069 	bge_reg_set32(bgep, SERIAL_EEPROM_ADDRESS_REG, SEEPROM_ACCESS_INIT);
3070 
3071 	/*
3072 	 * Step 20: clear the Ethernet MAC mode register
3073 	 */
3074 	bge_reg_put32(bgep, ETHERNET_MAC_MODE_REG, 0);
3075 
3076 	/*
3077 	 * Step 21: restore cache-line-size, latency timer, and
3078 	 * subsystem ID registers to their original values (not
3079 	 * those read into the local structure <chipid>, 'cos
3080 	 * that was after they were cleared by the RESET).
3081 	 *
3082 	 * Note: the Subsystem Vendor/Device ID registers are not
3083 	 * directly writable in config space, so we use the shadow
3084 	 * copy in "Page Zero" of register space to restore them
3085 	 * both in one go ...
3086 	 */
3087 	pci_config_put8(bgep->cfg_handle, PCI_CONF_CACHE_LINESZ,
3088 		bgep->chipid.clsize);
3089 	pci_config_put8(bgep->cfg_handle, PCI_CONF_LATENCY_TIMER,
3090 		bgep->chipid.latency);
3091 	bge_reg_put32(bgep, PCI_CONF_SUBVENID,
3092 		(bgep->chipid.subdev << 16) | bgep->chipid.subven);
3093 
3094 	/*
3095 	 * The SEND INDEX registers should be reset to zero by the
3096 	 * global chip reset; if they're not, there'll be trouble
3097 	 * later on.
3098 	 */
3099 	sx0 = bge_reg_get32(bgep, NIC_DIAG_SEND_INDEX_REG(0));
3100 	if (sx0 != 0) {
3101 		BGE_REPORT((bgep, "SEND INDEX - device didn't RESET"));
3102 		bge_fm_ereport(bgep, DDI_FM_DEVICE_INVAL_STATE);
3103 		return (DDI_FAILURE);
3104 	}
3105 
3106 	/* Enable MSI code */
3107 	if (bgep->intr_type == DDI_INTR_TYPE_MSI)
3108 		bge_reg_set32(bgep, MSI_MODE_REG,
3109 		    MSI_PRI_HIGHEST|MSI_MSI_ENABLE);
3110 
3111 	/*
3112 	 * On the first time through, save the factory-set MAC address
3113 	 * (if any).  If bge_poll_firmware() above didn't return one
3114 	 * (from a chip register) consider looking in the attached NV
3115 	 * memory device, if any.  Once we have it, we save it in both
3116 	 * register-image (64-bit) and byte-array forms.  All-zero and
3117 	 * all-one addresses are not valid, and we refuse to stash those.
3118 	 */
3119 	if (bgep->bge_chip_state == BGE_CHIP_INITIAL) {
3120 		if (mac == 0ULL)
3121 			mac = bge_get_nvmac(bgep);
3122 		if (mac != 0ULL && mac != ~0ULL) {
3123 			bgep->chipid.hw_mac_addr = mac;
3124 			for (i = ETHERADDRL; i-- != 0; ) {
3125 				bgep->chipid.vendor_addr.addr[i] = (uchar_t)mac;
3126 				mac >>= 8;
3127 			}
3128 			bgep->chipid.vendor_addr.set = 1;
3129 		}
3130 	}
3131 
3132 #ifdef BGE_IPMI_ASF
3133 	if (bgep->asf_enabled && bgep->asf_newhandshake) {
3134 		if (asf_mode != ASF_MODE_NONE) {
3135 			if ((asf_mode == ASF_MODE_INIT) ||
3136 				(asf_mode == ASF_MODE_POST_INIT)) {
3137 
3138 				bge_asf_post_reset_new_mode(bgep,
3139 					BGE_INIT_RESET);
3140 			} else {
3141 				bge_asf_post_reset_new_mode(bgep,
3142 					BGE_SHUTDOWN_RESET);
3143 			}
3144 		}
3145 	}
3146 #endif
3147 
3148 	/*
3149 	 * Record the new state
3150 	 */
3151 	bgep->chip_resets += 1;
3152 	bgep->bge_chip_state = BGE_CHIP_RESET;
3153 	return (retval);
3154 }
3155 
3156 /*
3157  * bge_chip_start() -- start the chip transmitting and/or receiving,
3158  * including enabling interrupts
3159  */
3160 int bge_chip_start(bge_t *bgep, boolean_t reset_phys);
3161 #pragma	no_inline(bge_chip_start)
3162 
3163 int
3164 bge_chip_start(bge_t *bgep, boolean_t reset_phys)
3165 {
3166 	uint32_t coalmode;
3167 	uint32_t ledctl;
3168 	uint32_t mtu;
3169 	uint32_t maxring;
3170 	uint64_t ring;
3171 	int retval = DDI_SUCCESS;
3172 
3173 	BGE_TRACE(("bge_chip_start($%p)",
3174 		(void *)bgep));
3175 
3176 	ASSERT(mutex_owned(bgep->genlock));
3177 	ASSERT(bgep->bge_chip_state == BGE_CHIP_RESET);
3178 
3179 	/*
3180 	 * Taken from Broadcom document 570X-PG102-R, pp 102-116.
3181 	 * The document specifies 95 separate steps to fully
3182 	 * initialise the chip!!!!
3183 	 *
3184 	 * The reset code above has already got us as far as step
3185 	 * 21, so we continue with ...
3186 	 *
3187 	 * Step 22: clear the MAC statistics block
3188 	 * (0x0300-0x0aff in NIC-local memory)
3189 	 */
3190 	if (bgep->chipid.statistic_type == BGE_STAT_BLK)
3191 		bge_nic_zero(bgep, NIC_MEM_STATISTICS,
3192 		    NIC_MEM_STATISTICS_SIZE);
3193 
3194 	/*
3195 	 * Step 23: clear the status block (in host memory)
3196 	 */
3197 	DMA_ZERO(bgep->status_block);
3198 
3199 	/*
3200 	 * Step 24: set DMA read/write control register
3201 	 */
3202 	pci_config_put32(bgep->cfg_handle, PCI_CONF_BGE_PDRWCR,
3203 		bgep->chipid.bge_dma_rwctrl);
3204 
3205 	/*
3206 	 * Step 25: Configure DMA endianness -- already done (16/17)
3207 	 * Step 26: Configure Host-Based Send Rings
3208 	 * Step 27: Indicate Host Stack Up
3209 	 */
3210 	bge_reg_set32(bgep, MODE_CONTROL_REG,
3211 		MODE_HOST_SEND_BDS |
3212 		MODE_HOST_STACK_UP);
3213 
3214 	/*
3215 	 * Step 28: Configure checksum options:
3216 	 *	Solaris supports the hardware default checksum options.
3217 	 *
3218 	 *	Workaround for Incorrect pseudo-header checksum calculation.
3219 	 */
3220 	if (bgep->macp->m_info.mi_cksum & HCKSUM_INET_PARTIAL)
3221 		bge_reg_set32(bgep, MODE_CONTROL_REG,
3222 			MODE_SEND_NO_PSEUDO_HDR_CSUM);
3223 
3224 	/*
3225 	 * Step 29: configure Timer Prescaler.  The value is always the
3226 	 * same: the Core Clock frequency in MHz (66), minus 1, shifted
3227 	 * into bits 7-1.  Don't set bit 0, 'cos that's the RESET bit
3228 	 * for the whole chip!
3229 	 */
3230 	bge_reg_put32(bgep, MISC_CONFIG_REG, MISC_CONFIG_DEFAULT);
3231 
3232 	/*
3233 	 * Steps 30-31: Configure MAC local memory pool & DMA pool registers
3234 	 *
3235 	 * If the mbuf_length is specified as 0, we just leave these at
3236 	 * their hardware defaults, rather than explicitly setting them.
3237 	 * As the Broadcom HRM,driver better not change the parameters
3238 	 * when the chipsets is 5705/5788/5721/5751/5714 and 5715.
3239 	 */
3240 	if ((bgep->chipid.mbuf_length != 0) &&
3241 		(DEVICE_5704_SERIES_CHIPSETS(bgep))) {
3242 			bge_reg_put32(bgep, MBUF_POOL_BASE_REG,
3243 				bgep->chipid.mbuf_base);
3244 			bge_reg_put32(bgep, MBUF_POOL_LENGTH_REG,
3245 				bgep->chipid.mbuf_length);
3246 			bge_reg_put32(bgep, DMAD_POOL_BASE_REG,
3247 				DMAD_POOL_BASE_DEFAULT);
3248 			bge_reg_put32(bgep, DMAD_POOL_LENGTH_REG,
3249 				DMAD_POOL_LENGTH_DEFAULT);
3250 	}
3251 
3252 	/*
3253 	 * Step 32: configure MAC memory pool watermarks
3254 	 */
3255 	bge_reg_put32(bgep, RDMA_MBUF_LOWAT_REG,
3256 		bgep->chipid.mbuf_lo_water_rdma);
3257 	bge_reg_put32(bgep, MAC_RX_MBUF_LOWAT_REG,
3258 		bgep->chipid.mbuf_lo_water_rmac);
3259 	bge_reg_put32(bgep, MBUF_HIWAT_REG,
3260 		bgep->chipid.mbuf_hi_water);
3261 
3262 	/*
3263 	 * Step 33: configure DMA resource watermarks
3264 	 */
3265 	if (DEVICE_5704_SERIES_CHIPSETS(bgep)) {
3266 		bge_reg_put32(bgep, DMAD_POOL_LOWAT_REG,
3267 		    bge_dmad_lo_water);
3268 		bge_reg_put32(bgep, DMAD_POOL_HIWAT_REG,
3269 		    bge_dmad_hi_water);
3270 	}
3271 	bge_reg_put32(bgep, LOWAT_MAX_RECV_FRAMES_REG, bge_lowat_recv_frames);
3272 
3273 	/*
3274 	 * Steps 34-36: enable buffer manager & internal h/w queues
3275 	 */
3276 	if (!bge_chip_enable_engine(bgep, BUFFER_MANAGER_MODE_REG,
3277 	    STATE_MACHINE_ATTN_ENABLE_BIT))
3278 		retval = DDI_FAILURE;
3279 	if (!bge_chip_enable_engine(bgep, FTQ_RESET_REG, 0))
3280 		retval = DDI_FAILURE;
3281 
3282 	/*
3283 	 * Steps 37-39: initialise Receive Buffer (Producer) RCBs
3284 	 */
3285 	bge_reg_putrcb(bgep, STD_RCV_BD_RING_RCB_REG,
3286 		&bgep->buff[BGE_STD_BUFF_RING].hw_rcb);
3287 	if (DEVICE_5704_SERIES_CHIPSETS(bgep)) {
3288 		bge_reg_putrcb(bgep, JUMBO_RCV_BD_RING_RCB_REG,
3289 			&bgep->buff[BGE_JUMBO_BUFF_RING].hw_rcb);
3290 		bge_reg_putrcb(bgep, MINI_RCV_BD_RING_RCB_REG,
3291 			&bgep->buff[BGE_MINI_BUFF_RING].hw_rcb);
3292 	}
3293 
3294 	/*
3295 	 * Step 40: set Receive Buffer Descriptor Ring replenish thresholds
3296 	 */
3297 	bge_reg_put32(bgep, STD_RCV_BD_REPLENISH_REG, bge_replenish_std);
3298 	if (DEVICE_5704_SERIES_CHIPSETS(bgep)) {
3299 		bge_reg_put32(bgep, JUMBO_RCV_BD_REPLENISH_REG,
3300 		    bge_replenish_jumbo);
3301 		bge_reg_put32(bgep, MINI_RCV_BD_REPLENISH_REG,
3302 		    bge_replenish_mini);
3303 	}
3304 
3305 	/*
3306 	 * Steps 41-43: clear Send Ring Producer Indices and initialise
3307 	 * Send Producer Rings (0x0100-0x01ff in NIC-local memory)
3308 	 */
3309 	if (DEVICE_5704_SERIES_CHIPSETS(bgep))
3310 		maxring = BGE_SEND_RINGS_MAX;
3311 	else
3312 		maxring = BGE_SEND_RINGS_MAX_5705;
3313 	for (ring = 0; ring < maxring; ++ring) {
3314 		bge_mbx_put(bgep, SEND_RING_HOST_INDEX_REG(ring), 0);
3315 		bge_mbx_put(bgep, SEND_RING_NIC_INDEX_REG(ring), 0);
3316 		bge_nic_putrcb(bgep, NIC_MEM_SEND_RING(ring),
3317 			&bgep->send[ring].hw_rcb);
3318 	}
3319 
3320 	/*
3321 	 * Steps 44-45: initialise Receive Return Rings
3322 	 * (0x0200-0x02ff in NIC-local memory)
3323 	 */
3324 	if (DEVICE_5704_SERIES_CHIPSETS(bgep))
3325 		maxring = BGE_RECV_RINGS_MAX;
3326 	else
3327 		maxring = BGE_RECV_RINGS_MAX_5705;
3328 	for (ring = 0; ring < maxring; ++ring)
3329 		bge_nic_putrcb(bgep, NIC_MEM_RECV_RING(ring),
3330 			&bgep->recv[ring].hw_rcb);
3331 
3332 	/*
3333 	 * Step 46: initialise Receive Buffer (Producer) Ring indexes
3334 	 */
3335 	bge_mbx_put(bgep, RECV_STD_PROD_INDEX_REG, 0);
3336 	if (DEVICE_5704_SERIES_CHIPSETS(bgep)) {
3337 		bge_mbx_put(bgep, RECV_JUMBO_PROD_INDEX_REG, 0);
3338 		bge_mbx_put(bgep, RECV_MINI_PROD_INDEX_REG, 0);
3339 	}
3340 	/*
3341 	 * Step 47: configure the MAC unicast address
3342 	 * Step 48: configure the random backoff seed
3343 	 * Step 96: set up multicast filters
3344 	 */
3345 #ifdef BGE_IPMI_ASF
3346 	if (bge_chip_sync(bgep, B_FALSE) == DDI_FAILURE)
3347 #else
3348 	if (bge_chip_sync(bgep) == DDI_FAILURE)
3349 #endif
3350 		retval = DDI_FAILURE;
3351 
3352 	/*
3353 	 * Step 49: configure the MTU
3354 	 */
3355 	mtu = bgep->chipid.ethmax_size+ETHERFCSL+VLAN_TAGSZ;
3356 	bge_reg_put32(bgep, MAC_RX_MTU_SIZE_REG, mtu);
3357 
3358 	/*
3359 	 * Step 50: configure the IPG et al
3360 	 */
3361 	bge_reg_put32(bgep, MAC_TX_LENGTHS_REG, MAC_TX_LENGTHS_DEFAULT);
3362 
3363 	/*
3364 	 * Step 51: configure the default Rx Return Ring
3365 	 */
3366 	bge_reg_put32(bgep, RCV_RULES_CONFIG_REG, RCV_RULES_CONFIG_DEFAULT);
3367 
3368 	/*
3369 	 * Steps 52-54: configure Receive List Placement,
3370 	 * and enable Receive List Placement Statistics
3371 	 */
3372 	bge_reg_put32(bgep, RCV_LP_CONFIG_REG,
3373 		RCV_LP_CONFIG(bgep->chipid.rx_rings));
3374 	bge_reg_put32(bgep, RCV_LP_STATS_ENABLE_MASK_REG, ~0);
3375 	bge_reg_set32(bgep, RCV_LP_STATS_CONTROL_REG, RCV_LP_STATS_ENABLE);
3376 
3377 	if (bgep->chipid.rx_rings > 1)
3378 		bge_init_recv_rule(bgep);
3379 
3380 	/*
3381 	 * Steps 55-56: enable Send Data Initiator Statistics
3382 	 */
3383 	bge_reg_put32(bgep, SEND_INIT_STATS_ENABLE_MASK_REG, ~0);
3384 	if (DEVICE_5704_SERIES_CHIPSETS(bgep)) {
3385 		bge_reg_put32(bgep, SEND_INIT_STATS_CONTROL_REG,
3386 		    SEND_INIT_STATS_ENABLE | SEND_INIT_STATS_FASTER);
3387 	} else {
3388 		bge_reg_put32(bgep, SEND_INIT_STATS_CONTROL_REG,
3389 		    SEND_INIT_STATS_ENABLE);
3390 	}
3391 	/*
3392 	 * Steps 57-58: stop (?) the Host Coalescing Engine
3393 	 */
3394 	if (!bge_chip_disable_engine(bgep, HOST_COALESCE_MODE_REG, ~0))
3395 		retval = DDI_FAILURE;
3396 
3397 	/*
3398 	 * Steps 59-62: initialise Host Coalescing parameters
3399 	 */
3400 	bge_reg_put32(bgep, SEND_COALESCE_MAX_BD_REG, bge_tx_count_norm);
3401 	bge_reg_put32(bgep, SEND_COALESCE_TICKS_REG, bge_tx_ticks_norm);
3402 	bge_reg_put32(bgep, RCV_COALESCE_MAX_BD_REG, bge_rx_count_norm);
3403 	bge_reg_put32(bgep, RCV_COALESCE_TICKS_REG, bge_rx_ticks_norm);
3404 	if (DEVICE_5704_SERIES_CHIPSETS(bgep)) {
3405 		bge_reg_put32(bgep, SEND_COALESCE_INT_BD_REG,
3406 		    bge_tx_count_intr);
3407 		bge_reg_put32(bgep, SEND_COALESCE_INT_TICKS_REG,
3408 		    bge_tx_ticks_intr);
3409 		bge_reg_put32(bgep, RCV_COALESCE_INT_BD_REG,
3410 		    bge_rx_count_intr);
3411 		bge_reg_put32(bgep, RCV_COALESCE_INT_TICKS_REG,
3412 		    bge_rx_ticks_intr);
3413 	}
3414 
3415 	/*
3416 	 * Steps 63-64: initialise status block & statistics
3417 	 * host memory addresses
3418 	 * The statistic block does not exist in some chipsets
3419 	 * Step 65: initialise Statistics Coalescing Tick Counter
3420 	 */
3421 	bge_reg_put64(bgep, STATUS_BLOCK_HOST_ADDR_REG,
3422 		bgep->status_block.cookie.dmac_laddress);
3423 
3424 	/*
3425 	 * Steps 66-67: initialise status block & statistics
3426 	 * NIC-local memory addresses
3427 	 */
3428 	if (DEVICE_5704_SERIES_CHIPSETS(bgep)) {
3429 		bge_reg_put64(bgep, STATISTICS_HOST_ADDR_REG,
3430 		    bgep->statistics.cookie.dmac_laddress);
3431 		bge_reg_put32(bgep, STATISTICS_TICKS_REG,
3432 		    STATISTICS_TICKS_DEFAULT);
3433 		bge_reg_put32(bgep, STATUS_BLOCK_BASE_ADDR_REG,
3434 		    NIC_MEM_STATUS_BLOCK);
3435 		bge_reg_put32(bgep, STATISTICS_BASE_ADDR_REG,
3436 		    NIC_MEM_STATISTICS);
3437 	}
3438 
3439 	/*
3440 	 * Steps 68-71: start the Host Coalescing Engine, the Receive BD
3441 	 * Completion Engine, the Receive List Placement Engine, and the
3442 	 * Receive List selector.Pay attention:0x3400 is not exist in BCM5714
3443 	 * and BCM5715.
3444 	 */
3445 	if (bgep->chipid.tx_rings <= COALESCE_64_BYTE_RINGS &&
3446 	    bgep->chipid.rx_rings <= COALESCE_64_BYTE_RINGS)
3447 		coalmode = COALESCE_64_BYTE_STATUS;
3448 	else
3449 		coalmode = 0;
3450 	if (!bge_chip_enable_engine(bgep, HOST_COALESCE_MODE_REG, coalmode))
3451 		retval = DDI_FAILURE;
3452 	if (!bge_chip_enable_engine(bgep, RCV_BD_COMPLETION_MODE_REG,
3453 	    STATE_MACHINE_ATTN_ENABLE_BIT))
3454 		retval = DDI_FAILURE;
3455 	if (!bge_chip_enable_engine(bgep, RCV_LIST_PLACEMENT_MODE_REG, 0))
3456 		retval = DDI_FAILURE;
3457 
3458 	if (DEVICE_5704_SERIES_CHIPSETS(bgep))
3459 		if (!bge_chip_enable_engine(bgep, RCV_LIST_SELECTOR_MODE_REG,
3460 		    STATE_MACHINE_ATTN_ENABLE_BIT))
3461 			retval = DDI_FAILURE;
3462 
3463 	/*
3464 	 * Step 72: Enable MAC DMA engines
3465 	 * Step 73: Clear & enable MAC statistics
3466 	 */
3467 	bge_reg_set32(bgep, ETHERNET_MAC_MODE_REG,
3468 		ETHERNET_MODE_ENABLE_FHDE |
3469 		ETHERNET_MODE_ENABLE_RDE |
3470 		ETHERNET_MODE_ENABLE_TDE);
3471 	bge_reg_set32(bgep, ETHERNET_MAC_MODE_REG,
3472 		ETHERNET_MODE_ENABLE_TX_STATS |
3473 		ETHERNET_MODE_ENABLE_RX_STATS |
3474 		ETHERNET_MODE_CLEAR_TX_STATS |
3475 		ETHERNET_MODE_CLEAR_RX_STATS);
3476 
3477 	/*
3478 	 * Step 74: configure the MLCR (Miscellaneous Local Control
3479 	 * Register); not required, as we set up the MLCR in step 10
3480 	 * (part of the reset code) above.
3481 	 *
3482 	 * Step 75: clear Interrupt Mailbox 0
3483 	 */
3484 	bge_mbx_put(bgep, INTERRUPT_MBOX_0_REG, 0);
3485 
3486 	/*
3487 	 * Steps 76-87: Gentlemen, start your engines ...
3488 	 *
3489 	 * Enable the DMA Completion Engine, the Write DMA Engine,
3490 	 * the Read DMA Engine, Receive Data Completion Engine,
3491 	 * the MBuf Cluster Free Engine, the Send Data Completion Engine,
3492 	 * the Send BD Completion Engine, the Receive BD Initiator Engine,
3493 	 * the Receive Data Initiator Engine, the Send Data Initiator Engine,
3494 	 * the Send BD Initiator Engine, and the Send BD Selector Engine.
3495 	 *
3496 	 * Beware exhaust fumes?
3497 	 */
3498 	if (DEVICE_5704_SERIES_CHIPSETS(bgep))
3499 		if (!bge_chip_enable_engine(bgep, DMA_COMPLETION_MODE_REG, 0))
3500 			retval = DDI_FAILURE;
3501 	if (!bge_chip_enable_engine(bgep, WRITE_DMA_MODE_REG,
3502 	    (bge_dma_wrprio << DMA_PRIORITY_SHIFT) | ALL_DMA_ATTN_BITS))
3503 		retval = DDI_FAILURE;
3504 	if (!bge_chip_enable_engine(bgep, READ_DMA_MODE_REG,
3505 	    (bge_dma_rdprio << DMA_PRIORITY_SHIFT) | ALL_DMA_ATTN_BITS))
3506 		retval = DDI_FAILURE;
3507 	if (!bge_chip_enable_engine(bgep, RCV_DATA_COMPLETION_MODE_REG,
3508 	    STATE_MACHINE_ATTN_ENABLE_BIT))
3509 		retval = DDI_FAILURE;
3510 	if (DEVICE_5704_SERIES_CHIPSETS(bgep))
3511 		if (!bge_chip_enable_engine(bgep,
3512 		    MBUF_CLUSTER_FREE_MODE_REG, 0))
3513 			retval = DDI_FAILURE;
3514 	if (!bge_chip_enable_engine(bgep, SEND_DATA_COMPLETION_MODE_REG, 0))
3515 		retval = DDI_FAILURE;
3516 	if (!bge_chip_enable_engine(bgep, SEND_BD_COMPLETION_MODE_REG,
3517 	    STATE_MACHINE_ATTN_ENABLE_BIT))
3518 		retval = DDI_FAILURE;
3519 	if (!bge_chip_enable_engine(bgep, RCV_BD_INITIATOR_MODE_REG,
3520 	    RCV_BD_DISABLED_RING_ATTN))
3521 		retval = DDI_FAILURE;
3522 	if (!bge_chip_enable_engine(bgep, RCV_DATA_BD_INITIATOR_MODE_REG,
3523 	    RCV_DATA_BD_ILL_RING_ATTN))
3524 		retval = DDI_FAILURE;
3525 	if (!bge_chip_enable_engine(bgep, SEND_DATA_INITIATOR_MODE_REG, 0))
3526 		retval = DDI_FAILURE;
3527 	if (!bge_chip_enable_engine(bgep, SEND_BD_INITIATOR_MODE_REG,
3528 	    STATE_MACHINE_ATTN_ENABLE_BIT))
3529 		retval = DDI_FAILURE;
3530 	if (!bge_chip_enable_engine(bgep, SEND_BD_SELECTOR_MODE_REG,
3531 	    STATE_MACHINE_ATTN_ENABLE_BIT))
3532 		retval = DDI_FAILURE;
3533 
3534 	/*
3535 	 * Step 88: download firmware -- doesn't apply
3536 	 * Steps 89-90: enable Transmit & Receive MAC Engines
3537 	 */
3538 	if (!bge_chip_enable_engine(bgep, TRANSMIT_MAC_MODE_REG, 0))
3539 		retval = DDI_FAILURE;
3540 #ifdef BGE_IPMI_ASF
3541 	if (!bgep->asf_enabled) {
3542 		if (!bge_chip_enable_engine(bgep, RECEIVE_MAC_MODE_REG,
3543 		    RECEIVE_MODE_KEEP_VLAN_TAG))
3544 			retval = DDI_FAILURE;
3545 	} else {
3546 		if (!bge_chip_enable_engine(bgep, RECEIVE_MAC_MODE_REG, 0))
3547 			retval = DDI_FAILURE;
3548 	}
3549 #else
3550 	if (!bge_chip_enable_engine(bgep, RECEIVE_MAC_MODE_REG,
3551 	    RECEIVE_MODE_KEEP_VLAN_TAG))
3552 		retval = DDI_FAILURE;
3553 #endif
3554 
3555 	/*
3556 	 * Step 91: disable auto-polling of PHY status
3557 	 */
3558 	bge_reg_put32(bgep, MI_MODE_REG, MI_MODE_DEFAULT);
3559 
3560 	/*
3561 	 * Step 92: configure D0 power state (not required)
3562 	 * Step 93: initialise LED control register ()
3563 	 */
3564 	ledctl = LED_CONTROL_DEFAULT;
3565 	switch (bgep->chipid.device) {
3566 	case DEVICE_ID_5700:
3567 	case DEVICE_ID_5700x:
3568 	case DEVICE_ID_5701:
3569 		/*
3570 		 * Switch to 5700 (MAC) mode on these older chips
3571 		 */
3572 		ledctl &= ~LED_CONTROL_LED_MODE_MASK;
3573 		ledctl |= LED_CONTROL_LED_MODE_5700;
3574 		break;
3575 
3576 	default:
3577 		break;
3578 	}
3579 	bge_reg_put32(bgep, ETHERNET_MAC_LED_CONTROL_REG, ledctl);
3580 
3581 	/*
3582 	 * Step 94: activate link
3583 	 */
3584 	bge_reg_put32(bgep, MI_STATUS_REG, MI_STATUS_LINK);
3585 
3586 	/*
3587 	 * Step 95: set up physical layer (PHY/SerDes)
3588 	 * restart autoneg (if required)
3589 	 */
3590 	if (reset_phys)
3591 		if (bge_phys_update(bgep) == DDI_FAILURE)
3592 			retval = DDI_FAILURE;
3593 
3594 	/*
3595 	 * Extra step (DSG): hand over all the Receive Buffers to the chip
3596 	 */
3597 	for (ring = 0; ring < BGE_BUFF_RINGS_USED; ++ring)
3598 		bge_mbx_put(bgep, bgep->buff[ring].chip_mbx_reg,
3599 			bgep->buff[ring].rf_next);
3600 
3601 	/*
3602 	 * MSI bits:The least significant MSI 16-bit word.
3603 	 * ISR will be triggered different.
3604 	 */
3605 	if (bgep->intr_type == DDI_INTR_TYPE_MSI)
3606 		bge_reg_set32(bgep, HOST_COALESCE_MODE_REG, 0x70);
3607 
3608 	/*
3609 	 * Extra step (DSG): select which interrupts are enabled
3610 	 *
3611 	 * Program the Ethernet MAC engine to signal attention on
3612 	 * Link Change events, then enable interrupts on MAC, DMA,
3613 	 * and FLOW attention signals.
3614 	 */
3615 	bge_reg_set32(bgep, ETHERNET_MAC_EVENT_ENABLE_REG,
3616 		ETHERNET_EVENT_LINK_INT |
3617 		ETHERNET_STATUS_PCS_ERROR_INT);
3618 #ifdef BGE_IPMI_ASF
3619 	if (bgep->asf_enabled) {
3620 		bge_reg_set32(bgep, MODE_CONTROL_REG,
3621 			MODE_INT_ON_FLOW_ATTN |
3622 			MODE_INT_ON_DMA_ATTN |
3623 			MODE_HOST_STACK_UP|
3624 			MODE_INT_ON_MAC_ATTN);
3625 	} else {
3626 #endif
3627 		bge_reg_set32(bgep, MODE_CONTROL_REG,
3628 			MODE_INT_ON_FLOW_ATTN |
3629 			MODE_INT_ON_DMA_ATTN |
3630 			MODE_INT_ON_MAC_ATTN);
3631 #ifdef BGE_IPMI_ASF
3632 	}
3633 #endif
3634 
3635 	/*
3636 	 * Step 97: enable PCI interrupts!!!
3637 	 */
3638 	if (bgep->intr_type == DDI_INTR_TYPE_FIXED)
3639 		bge_cfg_clr32(bgep, PCI_CONF_BGE_MHCR,
3640 		    MHCR_MASK_PCI_INT_OUTPUT);
3641 
3642 	/*
3643 	 * All done!
3644 	 */
3645 	bgep->bge_chip_state = BGE_CHIP_RUNNING;
3646 	return (retval);
3647 }
3648 
3649 
3650 /*
3651  * ========== Hardware interrupt handler ==========
3652  */
3653 
3654 #undef	BGE_DBG
3655 #define	BGE_DBG		BGE_DBG_INT	/* debug flag for this code	*/
3656 
3657 /*
3658  * Sync the status block, then atomically clear the specified bits in
3659  * the <flags-and-tag> field of the status block.
3660  * the <flags> word of the status block, returning the value of the
3661  * <tag> and the <flags> before the bits were cleared.
3662  */
3663 static int bge_status_sync(bge_t *bgep, uint64_t bits, uint64_t *flags);
3664 #pragma	inline(bge_status_sync)
3665 
3666 static int
3667 bge_status_sync(bge_t *bgep, uint64_t bits, uint64_t *flags)
3668 {
3669 	bge_status_t *bsp;
3670 	int retval;
3671 
3672 	BGE_TRACE(("bge_status_sync($%p, 0x%llx)",
3673 		(void *)bgep, bits));
3674 
3675 	ASSERT(bgep->bge_guard == BGE_GUARD);
3676 
3677 	DMA_SYNC(bgep->status_block, DDI_DMA_SYNC_FORKERNEL);
3678 	retval = bge_check_dma_handle(bgep, bgep->status_block.dma_hdl);
3679 	if (retval != DDI_FM_OK)
3680 		return (retval);
3681 
3682 	bsp = DMA_VPTR(bgep->status_block);
3683 	*flags = bge_atomic_clr64(&bsp->flags_n_tag, bits);
3684 
3685 	BGE_DEBUG(("bge_status_sync($%p, 0x%llx) returning 0x%llx",
3686 		(void *)bgep, bits, *flags));
3687 
3688 	return (retval);
3689 }
3690 
3691 static void bge_wake_factotum(bge_t *bgep);
3692 #pragma	inline(bge_wake_factotum)
3693 
3694 static void
3695 bge_wake_factotum(bge_t *bgep)
3696 {
3697 	mutex_enter(bgep->softintrlock);
3698 	if (bgep->factotum_flag == 0) {
3699 		bgep->factotum_flag = 1;
3700 		ddi_trigger_softintr(bgep->factotum_id);
3701 	}
3702 	mutex_exit(bgep->softintrlock);
3703 }
3704 
3705 /*
3706  *	bge_intr() -- handle chip interrupts
3707  */
3708 uint_t bge_intr(caddr_t arg1, caddr_t arg2);
3709 #pragma	no_inline(bge_intr)
3710 
3711 uint_t
3712 bge_intr(caddr_t arg1, caddr_t arg2)
3713 {
3714 	bge_t *bgep = (bge_t *)arg1;		/* private device info	*/
3715 	bge_status_t *bsp;
3716 	uint64_t flags;
3717 	uint32_t mlcr = 0;
3718 	uint_t result;
3719 	int retval;
3720 
3721 	BGE_TRACE(("bge_intr($%p) ($%p)", arg1, arg2));
3722 
3723 	/*
3724 	 * GLD v2 checks that s/w setup is complete before passing
3725 	 * interrupts to this routine, thus eliminating the old
3726 	 * (and well-known) race condition around ddi_add_intr()
3727 	 */
3728 	ASSERT(bgep->progress & PROGRESS_HWINT);
3729 
3730 	/*
3731 	 * Check whether chip's says it's asserting #INTA;
3732 	 * if not, don't process or claim the interrupt.
3733 	 *
3734 	 * Note that the PCI signal is active low, so the
3735 	 * bit is *zero* when the interrupt is asserted.
3736 	 */
3737 	result = DDI_INTR_UNCLAIMED;
3738 	mutex_enter(bgep->genlock);
3739 
3740 	if (bgep->intr_type == DDI_INTR_TYPE_FIXED)
3741 		mlcr = bge_reg_get32(bgep, MISC_LOCAL_CONTROL_REG);
3742 
3743 	BGE_DEBUG(("bge_intr($%p) ($%p) mlcr 0x%08x", arg1, arg2, mlcr));
3744 
3745 	if ((mlcr & MLCR_INTA_STATE) == 0) {
3746 		/*
3747 		 * Block further PCI interrupts ...
3748 		 */
3749 		result = DDI_INTR_CLAIMED;
3750 
3751 		if (bgep->intr_type == DDI_INTR_TYPE_FIXED) {
3752 			bge_reg_set32(bgep, PCI_CONF_BGE_MHCR,
3753 				MHCR_MASK_PCI_INT_OUTPUT);
3754 			if (bge_check_acc_handle(bgep, bgep->cfg_handle) !=
3755 			    DDI_FM_OK)
3756 				goto chip_stop;
3757 		}
3758 
3759 		/*
3760 		 * Sync the status block and grab the flags-n-tag from it.
3761 		 * We count the number of interrupts where there doesn't
3762 		 * seem to have been a DMA update of the status block; if
3763 		 * it *has* been updated, the counter will be cleared in
3764 		 * the while() loop below ...
3765 		 */
3766 		bgep->missed_dmas += 1;
3767 		bsp = DMA_VPTR(bgep->status_block);
3768 		for (;;) {
3769 			if (bgep->bge_chip_state != BGE_CHIP_RUNNING) {
3770 				/*
3771 				 * bge_chip_stop() may have freed dma area etc
3772 				 * while we were in this interrupt handler -
3773 				 * better not call bge_status_sync()
3774 				 */
3775 				(void) bge_check_acc_handle(bgep,
3776 				    bgep->io_handle);
3777 				mutex_exit(bgep->genlock);
3778 				return (DDI_INTR_CLAIMED);
3779 			}
3780 			retval = bge_status_sync(bgep, STATUS_FLAG_UPDATED,
3781 			    &flags);
3782 			if (retval != DDI_FM_OK) {
3783 				bgep->bge_dma_error = B_TRUE;
3784 				goto chip_stop;
3785 			}
3786 
3787 			if (!(flags & STATUS_FLAG_UPDATED))
3788 				break;
3789 
3790 			/*
3791 			 * Tell the chip that we're processing the interrupt
3792 			 */
3793 			bge_mbx_put(bgep, INTERRUPT_MBOX_0_REG,
3794 				INTERRUPT_MBOX_DISABLE(flags));
3795 			if (bge_check_acc_handle(bgep, bgep->io_handle) !=
3796 			    DDI_FM_OK)
3797 				goto chip_stop;
3798 
3799 			/*
3800 			 * Drop the mutex while we:
3801 			 * 	Receive any newly-arrived packets
3802 			 *	Recycle any newly-finished send buffers
3803 			 */
3804 			bgep->bge_intr_running = B_TRUE;
3805 			mutex_exit(bgep->genlock);
3806 			bge_receive(bgep, bsp);
3807 			bge_recycle(bgep, bsp);
3808 			mutex_enter(bgep->genlock);
3809 			bgep->bge_intr_running = B_FALSE;
3810 
3811 			/*
3812 			 * Tell the chip we've finished processing, and
3813 			 * give it the tag that we got from the status
3814 			 * block earlier, so that it knows just how far
3815 			 * we've gone.  If it's got more for us to do,
3816 			 * it will now update the status block and try
3817 			 * to assert an interrupt (but we've got the
3818 			 * #INTA blocked at present).  If we see the
3819 			 * update, we'll loop around to do some more.
3820 			 * Eventually we'll get out of here ...
3821 			 */
3822 			bge_mbx_put(bgep, INTERRUPT_MBOX_0_REG,
3823 				INTERRUPT_MBOX_ENABLE(flags));
3824 			bgep->missed_dmas = 0;
3825 		}
3826 
3827 		/*
3828 		 * Check for exceptional conditions that we need to handle
3829 		 *
3830 		 * Link status changed
3831 		 * Status block not updated
3832 		 */
3833 		if (flags & STATUS_FLAG_LINK_CHANGED)
3834 			bge_wake_factotum(bgep);
3835 
3836 		if (bgep->missed_dmas) {
3837 			/*
3838 			 * Probably due to the internal status tag not
3839 			 * being reset.  Force a status block update now;
3840 			 * this should ensure that we get an update and
3841 			 * a new interrupt.  After that, we should be in
3842 			 * sync again ...
3843 			 */
3844 			BGE_REPORT((bgep, "interrupt: flags 0x%llx - "
3845 				"not updated?", flags));
3846 			bge_reg_set32(bgep, HOST_COALESCE_MODE_REG,
3847 				COALESCE_NOW);
3848 
3849 			if (bgep->missed_dmas >= bge_dma_miss_limit) {
3850 				/*
3851 				 * If this happens multiple times in a row,
3852 				 * it means DMA is just not working.  Maybe
3853 				 * the chip's failed, or maybe there's a
3854 				 * problem on the PCI bus or in the host-PCI
3855 				 * bridge (Tomatillo).
3856 				 *
3857 				 * At all events, we want to stop further
3858 				 * interrupts and let the recovery code take
3859 				 * over to see whether anything can be done
3860 				 * about it ...
3861 				 */
3862 				bge_fm_ereport(bgep,
3863 				    DDI_FM_DEVICE_BADINT_LIMIT);
3864 				goto chip_stop;
3865 			}
3866 		}
3867 
3868 		/*
3869 		 * Reenable assertion of #INTA, unless there's a DMA fault
3870 		 */
3871 		if (result == DDI_INTR_CLAIMED) {
3872 			if (bgep->intr_type == DDI_INTR_TYPE_FIXED) {
3873 				bge_reg_clr32(bgep, PCI_CONF_BGE_MHCR,
3874 					MHCR_MASK_PCI_INT_OUTPUT);
3875 				if (bge_check_acc_handle(bgep,
3876 				    bgep->cfg_handle) != DDI_FM_OK)
3877 					goto chip_stop;
3878 			}
3879 		}
3880 	}
3881 
3882 	if (bge_check_acc_handle(bgep, bgep->io_handle) != DDI_FM_OK)
3883 		goto chip_stop;
3884 
3885 	mutex_exit(bgep->genlock);
3886 	return (result);
3887 
3888 chip_stop:
3889 #ifdef BGE_IPMI_ASF
3890 	if (bgep->asf_enabled && bgep->asf_status == ASF_STAT_RUN) {
3891 		/*
3892 		 * We must stop ASF heart beat before
3893 		 * bge_chip_stop(), otherwise some
3894 		 * computers (ex. IBM HS20 blade
3895 		 * server) may crash.
3896 		 */
3897 		bge_asf_update_status(bgep);
3898 		bge_asf_stop_timer(bgep);
3899 		bgep->asf_status = ASF_STAT_STOP;
3900 
3901 		bge_asf_pre_reset_operations(bgep, BGE_INIT_RESET);
3902 		(void) bge_check_acc_handle(bgep, bgep->cfg_handle);
3903 	}
3904 #endif
3905 	bge_chip_stop(bgep, B_TRUE);
3906 	(void) bge_check_acc_handle(bgep, bgep->io_handle);
3907 	mutex_exit(bgep->genlock);
3908 	return (result);
3909 }
3910 
3911 /*
3912  * ========== Factotum, implemented as a softint handler ==========
3913  */
3914 
3915 #undef	BGE_DBG
3916 #define	BGE_DBG		BGE_DBG_FACT	/* debug flag for this code	*/
3917 
3918 static void bge_factotum_error_handler(bge_t *bgep);
3919 #pragma	no_inline(bge_factotum_error_handler)
3920 
3921 static void
3922 bge_factotum_error_handler(bge_t *bgep)
3923 {
3924 	uint32_t flow;
3925 	uint32_t rdma;
3926 	uint32_t wdma;
3927 	uint32_t tmac;
3928 	uint32_t rmac;
3929 	uint32_t rxrs;
3930 	uint32_t txrs = 0;
3931 
3932 	ASSERT(mutex_owned(bgep->genlock));
3933 
3934 	/*
3935 	 * Read all the registers that show the possible
3936 	 * reasons for the ERROR bit to be asserted
3937 	 */
3938 	flow = bge_reg_get32(bgep, FLOW_ATTN_REG);
3939 	rdma = bge_reg_get32(bgep, READ_DMA_STATUS_REG);
3940 	wdma = bge_reg_get32(bgep, WRITE_DMA_STATUS_REG);
3941 	tmac = bge_reg_get32(bgep, TRANSMIT_MAC_STATUS_REG);
3942 	rmac = bge_reg_get32(bgep, RECEIVE_MAC_STATUS_REG);
3943 	rxrs = bge_reg_get32(bgep, RX_RISC_STATE_REG);
3944 	if (DEVICE_5704_SERIES_CHIPSETS(bgep))
3945 		txrs = bge_reg_get32(bgep, TX_RISC_STATE_REG);
3946 
3947 	BGE_DEBUG(("factotum($%p) flow 0x%x rdma 0x%x wdma 0x%x",
3948 		(void *)bgep, flow, rdma, wdma));
3949 	BGE_DEBUG(("factotum($%p) tmac 0x%x rmac 0x%x rxrs 0x%08x txrs 0x%08x",
3950 		(void *)bgep, tmac, rmac, rxrs, txrs));
3951 
3952 	/*
3953 	 * For now, just clear all the errors ...
3954 	 */
3955 	if (DEVICE_5704_SERIES_CHIPSETS(bgep))
3956 		bge_reg_put32(bgep, TX_RISC_STATE_REG, ~0);
3957 	bge_reg_put32(bgep, RX_RISC_STATE_REG, ~0);
3958 	bge_reg_put32(bgep, RECEIVE_MAC_STATUS_REG, ~0);
3959 	bge_reg_put32(bgep, WRITE_DMA_STATUS_REG, ~0);
3960 	bge_reg_put32(bgep, READ_DMA_STATUS_REG, ~0);
3961 	bge_reg_put32(bgep, FLOW_ATTN_REG, ~0);
3962 }
3963 
3964 /*
3965  * Handler for hardware link state change.
3966  *
3967  * When this routine is called, the hardware link state has changed
3968  * and the new state is reflected in the param_* variables.  Here
3969  * we must update the softstate, reprogram the MAC to match, and
3970  * record the change in the log and/or on the console.
3971  */
3972 static void bge_factotum_link_handler(bge_t *bgep);
3973 #pragma	no_inline(bge_factotum_link_handler)
3974 
3975 static void
3976 bge_factotum_link_handler(bge_t *bgep)
3977 {
3978 	void (*logfn)(bge_t *bgep, const char *fmt, ...);
3979 	const char *msg;
3980 	hrtime_t deltat;
3981 
3982 	ASSERT(mutex_owned(bgep->genlock));
3983 
3984 	/*
3985 	 * Update the s/w link_state
3986 	 */
3987 	if (bgep->param_link_up)
3988 		bgep->link_state = LINK_STATE_UP;
3989 	else
3990 		bgep->link_state = LINK_STATE_DOWN;
3991 
3992 	/*
3993 	 * Reprogram the MAC modes to match
3994 	 */
3995 	bge_sync_mac_modes(bgep);
3996 
3997 	/*
3998 	 * Finally, we have to decide whether to write a message
3999 	 * on the console or only in the log.  If the PHY has
4000 	 * been reprogrammed (at user request) "recently", then
4001 	 * the message only goes in the log.  Otherwise it's an
4002 	 * "unexpected" event, and it goes on the console as well.
4003 	 */
4004 	deltat = bgep->phys_event_time - bgep->phys_write_time;
4005 	if (deltat > BGE_LINK_SETTLE_TIME)
4006 		msg = "";
4007 	else if (bgep->param_link_up)
4008 		msg = bgep->link_up_msg;
4009 	else
4010 		msg = bgep->link_down_msg;
4011 
4012 	logfn = (msg == NULL || *msg == '\0') ? bge_notice : bge_log;
4013 	(*logfn)(bgep, "link %s%s", bgep->link_mode_msg, msg);
4014 }
4015 
4016 static boolean_t bge_factotum_link_check(bge_t *bgep, int *dma_state);
4017 #pragma	no_inline(bge_factotum_link_check)
4018 
4019 static boolean_t
4020 bge_factotum_link_check(bge_t *bgep, int *dma_state)
4021 {
4022 	boolean_t check;
4023 	uint64_t flags;
4024 	uint32_t tmac_status;
4025 
4026 	ASSERT(mutex_owned(bgep->genlock));
4027 
4028 	/*
4029 	 * Get & clear the writable status bits in the Tx status register
4030 	 * (some bits are write-1-to-clear, others are just readonly).
4031 	 */
4032 	tmac_status = bge_reg_get32(bgep, TRANSMIT_MAC_STATUS_REG);
4033 	bge_reg_put32(bgep, TRANSMIT_MAC_STATUS_REG, tmac_status);
4034 
4035 	/*
4036 	 * Get & clear the ERROR and LINK_CHANGED bits from the status block
4037 	 */
4038 	*dma_state = bge_status_sync(bgep, STATUS_FLAG_ERROR |
4039 	    STATUS_FLAG_LINK_CHANGED, &flags);
4040 	if (*dma_state != DDI_FM_OK)
4041 		return (B_FALSE);
4042 
4043 	/*
4044 	 * Clear any errors flagged in the status block ...
4045 	 */
4046 	if (flags & STATUS_FLAG_ERROR)
4047 		bge_factotum_error_handler(bgep);
4048 
4049 	/*
4050 	 * We need to check the link status if:
4051 	 *	the status block says there's been a link change
4052 	 *	or there's any discrepancy between the various
4053 	 *	flags indicating the link state (link_state,
4054 	 *	param_link_up, and the LINK STATE bit in the
4055 	 *	Transmit MAC status register).
4056 	 */
4057 	check = (flags & STATUS_FLAG_LINK_CHANGED) != 0;
4058 	switch (bgep->link_state) {
4059 	case LINK_STATE_UP:
4060 		check |= (bgep->param_link_up == B_FALSE);
4061 		check |= ((tmac_status & TRANSMIT_STATUS_LINK_UP) == 0);
4062 		break;
4063 
4064 	case LINK_STATE_DOWN:
4065 		check |= (bgep->param_link_up != B_FALSE);
4066 		check |= ((tmac_status & TRANSMIT_STATUS_LINK_UP) != 0);
4067 		break;
4068 
4069 	default:
4070 		check = B_TRUE;
4071 		break;
4072 	}
4073 
4074 	/*
4075 	 * If <check> is false, we're sure the link hasn't changed.
4076 	 * If true, however, it's not yet definitive; we have to call
4077 	 * bge_phys_check() to determine whether the link has settled
4078 	 * into a new state yet ... and if it has, then call the link
4079 	 * state change handler.But when the chip is 5700 in Dell 6650
4080 	 * ,even if check is false, the link may have changed.So we
4081 	 * have to call bge_phys_check() to determine the link state.
4082 	 */
4083 	if (check || bgep->chipid.device == DEVICE_ID_5700) {
4084 		check = bge_phys_check(bgep);
4085 		if (check)
4086 			bge_factotum_link_handler(bgep);
4087 	}
4088 
4089 	return (check);
4090 }
4091 
4092 /*
4093  * Factotum routine to check for Tx stall, using the 'watchdog' counter
4094  */
4095 static boolean_t bge_factotum_stall_check(bge_t *bgep);
4096 #pragma	no_inline(bge_factotum_stall_check)
4097 
4098 static boolean_t
4099 bge_factotum_stall_check(bge_t *bgep)
4100 {
4101 	uint32_t dogval;
4102 
4103 	ASSERT(mutex_owned(bgep->genlock));
4104 
4105 	/*
4106 	 * Specific check for Tx stall ...
4107 	 *
4108 	 * The 'watchdog' counter is incremented whenever a packet
4109 	 * is queued, reset to 1 when some (but not all) buffers
4110 	 * are reclaimed, reset to 0 (disabled) when all buffers
4111 	 * are reclaimed, and shifted left here.  If it exceeds the
4112 	 * threshold value, the chip is assumed to have stalled and
4113 	 * is put into the ERROR state.  The factotum will then reset
4114 	 * it on the next pass.
4115 	 *
4116 	 * All of which should ensure that we don't get into a state
4117 	 * where packets are left pending indefinitely!
4118 	 */
4119 	dogval = bge_atomic_shl32(&bgep->watchdog, 1);
4120 	if (dogval < bge_watchdog_count)
4121 		return (B_FALSE);
4122 
4123 	BGE_REPORT((bgep, "Tx stall detected, watchdog code 0x%x", dogval));
4124 	bge_fm_ereport(bgep, DDI_FM_DEVICE_STALL);
4125 	return (B_TRUE);
4126 }
4127 
4128 /*
4129  * The factotum is woken up when there's something to do that we'd rather
4130  * not do from inside a hardware interrupt handler or high-level cyclic.
4131  * Its two main tasks are:
4132  *	reset & restart the chip after an error
4133  *	check the link status whenever necessary
4134  */
4135 uint_t bge_chip_factotum(caddr_t arg);
4136 #pragma	no_inline(bge_chip_factotum)
4137 
4138 uint_t
4139 bge_chip_factotum(caddr_t arg)
4140 {
4141 	bge_t *bgep;
4142 	uint_t result;
4143 	boolean_t error;
4144 	boolean_t linkchg;
4145 	int dma_state;
4146 
4147 	bgep = (bge_t *)arg;
4148 
4149 	BGE_TRACE(("bge_chip_factotum($%p)", (void *)bgep));
4150 
4151 	mutex_enter(bgep->softintrlock);
4152 	if (bgep->factotum_flag == 0) {
4153 		mutex_exit(bgep->softintrlock);
4154 		return (DDI_INTR_UNCLAIMED);
4155 	}
4156 	bgep->factotum_flag = 0;
4157 	mutex_exit(bgep->softintrlock);
4158 
4159 	result = DDI_INTR_CLAIMED;
4160 	error = B_FALSE;
4161 	linkchg = B_FALSE;
4162 
4163 	mutex_enter(bgep->genlock);
4164 	switch (bgep->bge_chip_state) {
4165 	default:
4166 		break;
4167 
4168 	case BGE_CHIP_RUNNING:
4169 		linkchg = bge_factotum_link_check(bgep, &dma_state);
4170 		error = bge_factotum_stall_check(bgep);
4171 		if (dma_state != DDI_FM_OK) {
4172 			bgep->bge_dma_error = B_TRUE;
4173 			error = B_TRUE;
4174 		}
4175 		if (bge_check_acc_handle(bgep, bgep->io_handle) != DDI_FM_OK)
4176 			error = B_TRUE;
4177 		if (error)
4178 			bgep->bge_chip_state = BGE_CHIP_ERROR;
4179 		break;
4180 
4181 	case BGE_CHIP_ERROR:
4182 		error = B_TRUE;
4183 		break;
4184 
4185 	case BGE_CHIP_FAULT:
4186 		/*
4187 		 * Fault detected, time to reset ...
4188 		 */
4189 		if (bge_autorecover) {
4190 			if (!(bgep->progress & PROGRESS_BUFS)) {
4191 				/*
4192 				 * if we can't allocate the ring buffers,
4193 				 * try later
4194 				 */
4195 				if (bge_alloc_bufs(bgep) != DDI_SUCCESS) {
4196 					mutex_exit(bgep->genlock);
4197 					return (result);
4198 				}
4199 				bgep->progress |= PROGRESS_BUFS;
4200 			}
4201 			if (!(bgep->progress & PROGRESS_INTR)) {
4202 				bge_init_rings(bgep);
4203 				bge_intr_enable(bgep);
4204 				bgep->progress |= PROGRESS_INTR;
4205 			}
4206 			if (!(bgep->progress & PROGRESS_KSTATS)) {
4207 				bge_init_kstats(bgep,
4208 				    ddi_get_instance(bgep->devinfo));
4209 				bgep->progress |= PROGRESS_KSTATS;
4210 			}
4211 
4212 			BGE_REPORT((bgep, "automatic recovery activated"));
4213 
4214 			if (bge_restart(bgep, B_FALSE) != DDI_SUCCESS) {
4215 				bgep->bge_chip_state = BGE_CHIP_ERROR;
4216 				error = B_TRUE;
4217 			}
4218 			if (bge_check_acc_handle(bgep, bgep->cfg_handle) !=
4219 			    DDI_FM_OK) {
4220 				bgep->bge_chip_state = BGE_CHIP_ERROR;
4221 				error = B_TRUE;
4222 			}
4223 			if (bge_check_acc_handle(bgep, bgep->io_handle) !=
4224 			    DDI_FM_OK) {
4225 				bgep->bge_chip_state = BGE_CHIP_ERROR;
4226 				error = B_TRUE;
4227 			}
4228 			if (error == B_FALSE) {
4229 #ifdef BGE_IPMI_ASF
4230 				if (bgep->asf_enabled &&
4231 				    bgep->asf_status != ASF_STAT_RUN) {
4232 					bgep->asf_timeout_id = timeout(
4233 					    bge_asf_heartbeat, (void *)bgep,
4234 					    drv_usectohz(
4235 					    BGE_ASF_HEARTBEAT_INTERVAL));
4236 					bgep->asf_status = ASF_STAT_RUN;
4237 				}
4238 #endif
4239 				ddi_fm_service_impact(bgep->devinfo,
4240 				    DDI_SERVICE_RESTORED);
4241 			}
4242 		}
4243 		break;
4244 	}
4245 
4246 
4247 	/*
4248 	 * If an error is detected, stop the chip now, marking it as
4249 	 * faulty, so that it will be reset next time through ...
4250 	 *
4251 	 * Note that if intr_running is set, then bge_intr() has dropped
4252 	 * genlock to call bge_receive/bge_recycle. Can't stop the chip at
4253 	 * this point so have to wait until the next time the factotum runs.
4254 	 */
4255 	if (error && !bgep->bge_intr_running) {
4256 #ifdef BGE_IPMI_ASF
4257 		if (bgep->asf_enabled && (bgep->asf_status == ASF_STAT_RUN)) {
4258 			/*
4259 			 * We must stop ASF heart beat before bge_chip_stop(),
4260 			 * otherwise some computers (ex. IBM HS20 blade server)
4261 			 * may crash.
4262 			 */
4263 			bge_asf_update_status(bgep);
4264 			bge_asf_stop_timer(bgep);
4265 			bgep->asf_status = ASF_STAT_STOP;
4266 
4267 			bge_asf_pre_reset_operations(bgep, BGE_INIT_RESET);
4268 			(void) bge_check_acc_handle(bgep, bgep->cfg_handle);
4269 		}
4270 #endif
4271 		bge_chip_stop(bgep, B_TRUE);
4272 		(void) bge_check_acc_handle(bgep, bgep->io_handle);
4273 	}
4274 	mutex_exit(bgep->genlock);
4275 
4276 	/*
4277 	 * If the link state changed, tell the world about it.
4278 	 * Note: can't do this while still holding the mutex.
4279 	 */
4280 	if (linkchg)
4281 		mac_link_update(bgep->macp, bgep->link_state);
4282 
4283 	return (result);
4284 }
4285 
4286 /*
4287  * High-level cyclic handler
4288  *
4289  * This routine schedules a (low-level) softint callback to the
4290  * factotum, and prods the chip to update the status block (which
4291  * will cause a hardware interrupt when complete).
4292  */
4293 void bge_chip_cyclic(void *arg);
4294 #pragma	no_inline(bge_chip_cyclic)
4295 
4296 void
4297 bge_chip_cyclic(void *arg)
4298 {
4299 	bge_t *bgep;
4300 
4301 	bgep = arg;
4302 
4303 	switch (bgep->bge_chip_state) {
4304 	default:
4305 		return;
4306 
4307 	case BGE_CHIP_RUNNING:
4308 		bge_reg_set32(bgep, HOST_COALESCE_MODE_REG, COALESCE_NOW);
4309 		if (bge_check_acc_handle(bgep, bgep->io_handle) != DDI_FM_OK)
4310 			ddi_fm_service_impact(bgep->devinfo,
4311 			    DDI_SERVICE_UNAFFECTED);
4312 		break;
4313 
4314 	case BGE_CHIP_FAULT:
4315 	case BGE_CHIP_ERROR:
4316 		break;
4317 	}
4318 
4319 	bge_wake_factotum(bgep);
4320 }
4321 
4322 
4323 /*
4324  * ========== Ioctl subfunctions ==========
4325  */
4326 
4327 #undef	BGE_DBG
4328 #define	BGE_DBG		BGE_DBG_PPIO	/* debug flag for this code	*/
4329 
4330 #if	BGE_DEBUGGING || BGE_DO_PPIO
4331 
4332 static void bge_chip_peek_cfg(bge_t *bgep, bge_peekpoke_t *ppd);
4333 #pragma	no_inline(bge_chip_peek_cfg)
4334 
4335 static void
4336 bge_chip_peek_cfg(bge_t *bgep, bge_peekpoke_t *ppd)
4337 {
4338 	uint64_t regval;
4339 	uint64_t regno;
4340 
4341 	BGE_TRACE(("bge_chip_peek_cfg($%p, $%p)",
4342 		(void *)bgep, (void *)ppd));
4343 
4344 	regno = ppd->pp_acc_offset;
4345 
4346 	switch (ppd->pp_acc_size) {
4347 	case 1:
4348 		regval = pci_config_get8(bgep->cfg_handle, regno);
4349 		break;
4350 
4351 	case 2:
4352 		regval = pci_config_get16(bgep->cfg_handle, regno);
4353 		break;
4354 
4355 	case 4:
4356 		regval = pci_config_get32(bgep->cfg_handle, regno);
4357 		break;
4358 
4359 	case 8:
4360 		regval = pci_config_get64(bgep->cfg_handle, regno);
4361 		break;
4362 	}
4363 
4364 	ppd->pp_acc_data = regval;
4365 }
4366 
4367 static void bge_chip_poke_cfg(bge_t *bgep, bge_peekpoke_t *ppd);
4368 #pragma	no_inline(bge_chip_poke_cfg)
4369 
4370 static void
4371 bge_chip_poke_cfg(bge_t *bgep, bge_peekpoke_t *ppd)
4372 {
4373 	uint64_t regval;
4374 	uint64_t regno;
4375 
4376 	BGE_TRACE(("bge_chip_poke_cfg($%p, $%p)",
4377 		(void *)bgep, (void *)ppd));
4378 
4379 	regno = ppd->pp_acc_offset;
4380 	regval = ppd->pp_acc_data;
4381 
4382 	switch (ppd->pp_acc_size) {
4383 	case 1:
4384 		pci_config_put8(bgep->cfg_handle, regno, regval);
4385 		break;
4386 
4387 	case 2:
4388 		pci_config_put16(bgep->cfg_handle, regno, regval);
4389 		break;
4390 
4391 	case 4:
4392 		pci_config_put32(bgep->cfg_handle, regno, regval);
4393 		break;
4394 
4395 	case 8:
4396 		pci_config_put64(bgep->cfg_handle, regno, regval);
4397 		break;
4398 	}
4399 }
4400 
4401 static void bge_chip_peek_reg(bge_t *bgep, bge_peekpoke_t *ppd);
4402 #pragma	no_inline(bge_chip_peek_reg)
4403 
4404 static void
4405 bge_chip_peek_reg(bge_t *bgep, bge_peekpoke_t *ppd)
4406 {
4407 	uint64_t regval;
4408 	void *regaddr;
4409 
4410 	BGE_TRACE(("bge_chip_peek_reg($%p, $%p)",
4411 		(void *)bgep, (void *)ppd));
4412 
4413 	regaddr = PIO_ADDR(bgep, ppd->pp_acc_offset);
4414 
4415 	switch (ppd->pp_acc_size) {
4416 	case 1:
4417 		regval = ddi_get8(bgep->io_handle, regaddr);
4418 		break;
4419 
4420 	case 2:
4421 		regval = ddi_get16(bgep->io_handle, regaddr);
4422 		break;
4423 
4424 	case 4:
4425 		regval = ddi_get32(bgep->io_handle, regaddr);
4426 		break;
4427 
4428 	case 8:
4429 		regval = ddi_get64(bgep->io_handle, regaddr);
4430 		break;
4431 	}
4432 
4433 	ppd->pp_acc_data = regval;
4434 }
4435 
4436 static void bge_chip_poke_reg(bge_t *bgep, bge_peekpoke_t *ppd);
4437 #pragma	no_inline(bge_chip_peek_reg)
4438 
4439 static void
4440 bge_chip_poke_reg(bge_t *bgep, bge_peekpoke_t *ppd)
4441 {
4442 	uint64_t regval;
4443 	void *regaddr;
4444 
4445 	BGE_TRACE(("bge_chip_poke_reg($%p, $%p)",
4446 		(void *)bgep, (void *)ppd));
4447 
4448 	regaddr = PIO_ADDR(bgep, ppd->pp_acc_offset);
4449 	regval = ppd->pp_acc_data;
4450 
4451 	switch (ppd->pp_acc_size) {
4452 	case 1:
4453 		ddi_put8(bgep->io_handle, regaddr, regval);
4454 		break;
4455 
4456 	case 2:
4457 		ddi_put16(bgep->io_handle, regaddr, regval);
4458 		break;
4459 
4460 	case 4:
4461 		ddi_put32(bgep->io_handle, regaddr, regval);
4462 		break;
4463 
4464 	case 8:
4465 		ddi_put64(bgep->io_handle, regaddr, regval);
4466 		break;
4467 	}
4468 	BGE_PCICHK(bgep);
4469 }
4470 
4471 static void bge_chip_peek_nic(bge_t *bgep, bge_peekpoke_t *ppd);
4472 #pragma	no_inline(bge_chip_peek_nic)
4473 
4474 static void
4475 bge_chip_peek_nic(bge_t *bgep, bge_peekpoke_t *ppd)
4476 {
4477 	uint64_t regoff;
4478 	uint64_t regval;
4479 	void *regaddr;
4480 
4481 	BGE_TRACE(("bge_chip_peek_nic($%p, $%p)",
4482 		(void *)bgep, (void *)ppd));
4483 
4484 	regoff = ppd->pp_acc_offset;
4485 	bge_nic_setwin(bgep, regoff & ~MWBAR_GRANULE_MASK);
4486 	regoff &= MWBAR_GRANULE_MASK;
4487 	regoff += NIC_MEM_WINDOW_OFFSET;
4488 	regaddr = PIO_ADDR(bgep, regoff);
4489 
4490 	switch (ppd->pp_acc_size) {
4491 	case 1:
4492 		regval = ddi_get8(bgep->io_handle, regaddr);
4493 		break;
4494 
4495 	case 2:
4496 		regval = ddi_get16(bgep->io_handle, regaddr);
4497 		break;
4498 
4499 	case 4:
4500 		regval = ddi_get32(bgep->io_handle, regaddr);
4501 		break;
4502 
4503 	case 8:
4504 		regval = ddi_get64(bgep->io_handle, regaddr);
4505 		break;
4506 	}
4507 
4508 	ppd->pp_acc_data = regval;
4509 }
4510 
4511 static void bge_chip_poke_nic(bge_t *bgep, bge_peekpoke_t *ppd);
4512 #pragma	no_inline(bge_chip_poke_nic)
4513 
4514 static void
4515 bge_chip_poke_nic(bge_t *bgep, bge_peekpoke_t *ppd)
4516 {
4517 	uint64_t regoff;
4518 	uint64_t regval;
4519 	void *regaddr;
4520 
4521 	BGE_TRACE(("bge_chip_poke_nic($%p, $%p)",
4522 		(void *)bgep, (void *)ppd));
4523 
4524 	regoff = ppd->pp_acc_offset;
4525 	bge_nic_setwin(bgep, regoff & ~MWBAR_GRANULE_MASK);
4526 	regoff &= MWBAR_GRANULE_MASK;
4527 	regoff += NIC_MEM_WINDOW_OFFSET;
4528 	regaddr = PIO_ADDR(bgep, regoff);
4529 	regval = ppd->pp_acc_data;
4530 
4531 	switch (ppd->pp_acc_size) {
4532 	case 1:
4533 		ddi_put8(bgep->io_handle, regaddr, regval);
4534 		break;
4535 
4536 	case 2:
4537 		ddi_put16(bgep->io_handle, regaddr, regval);
4538 		break;
4539 
4540 	case 4:
4541 		ddi_put32(bgep->io_handle, regaddr, regval);
4542 		break;
4543 
4544 	case 8:
4545 		ddi_put64(bgep->io_handle, regaddr, regval);
4546 		break;
4547 	}
4548 	BGE_PCICHK(bgep);
4549 }
4550 
4551 static void bge_chip_peek_mii(bge_t *bgep, bge_peekpoke_t *ppd);
4552 #pragma	no_inline(bge_chip_peek_mii)
4553 
4554 static void
4555 bge_chip_peek_mii(bge_t *bgep, bge_peekpoke_t *ppd)
4556 {
4557 	BGE_TRACE(("bge_chip_peek_mii($%p, $%p)",
4558 		(void *)bgep, (void *)ppd));
4559 
4560 	ppd->pp_acc_data = bge_mii_get16(bgep, ppd->pp_acc_offset/2);
4561 }
4562 
4563 static void bge_chip_poke_mii(bge_t *bgep, bge_peekpoke_t *ppd);
4564 #pragma	no_inline(bge_chip_poke_mii)
4565 
4566 static void
4567 bge_chip_poke_mii(bge_t *bgep, bge_peekpoke_t *ppd)
4568 {
4569 	BGE_TRACE(("bge_chip_poke_mii($%p, $%p)",
4570 		(void *)bgep, (void *)ppd));
4571 
4572 	bge_mii_put16(bgep, ppd->pp_acc_offset/2, ppd->pp_acc_data);
4573 }
4574 
4575 #if	BGE_SEE_IO32
4576 
4577 static void bge_chip_peek_seeprom(bge_t *bgep, bge_peekpoke_t *ppd);
4578 #pragma	no_inline(bge_chip_peek_seeprom)
4579 
4580 static void
4581 bge_chip_peek_seeprom(bge_t *bgep, bge_peekpoke_t *ppd)
4582 {
4583 	uint32_t data;
4584 	int err;
4585 
4586 	BGE_TRACE(("bge_chip_peek_seeprom($%p, $%p)",
4587 		(void *)bgep, (void *)ppd));
4588 
4589 	err = bge_nvmem_rw32(bgep, BGE_SEE_READ, ppd->pp_acc_offset, &data);
4590 	ppd->pp_acc_data = err ? ~0ull : data;
4591 }
4592 
4593 static void bge_chip_poke_seeprom(bge_t *bgep, bge_peekpoke_t *ppd);
4594 #pragma	no_inline(bge_chip_poke_seeprom)
4595 
4596 static void
4597 bge_chip_poke_seeprom(bge_t *bgep, bge_peekpoke_t *ppd)
4598 {
4599 	uint32_t data;
4600 
4601 	BGE_TRACE(("bge_chip_poke_seeprom($%p, $%p)",
4602 		(void *)bgep, (void *)ppd));
4603 
4604 	data = ppd->pp_acc_data;
4605 	(void) bge_nvmem_rw32(bgep, BGE_SEE_WRITE, ppd->pp_acc_offset, &data);
4606 }
4607 #endif	/* BGE_SEE_IO32 */
4608 
4609 #if	BGE_FLASH_IO32
4610 
4611 static void bge_chip_peek_flash(bge_t *bgep, bge_peekpoke_t *ppd);
4612 #pragma	no_inline(bge_chip_peek_flash)
4613 
4614 static void
4615 bge_chip_peek_flash(bge_t *bgep, bge_peekpoke_t *ppd)
4616 {
4617 	uint32_t data;
4618 	int err;
4619 
4620 	BGE_TRACE(("bge_chip_peek_flash($%p, $%p)",
4621 		(void *)bgep, (void *)ppd));
4622 
4623 	err = bge_nvmem_rw32(bgep, BGE_FLASH_READ, ppd->pp_acc_offset, &data);
4624 	ppd->pp_acc_data = err ? ~0ull : data;
4625 }
4626 
4627 static void bge_chip_poke_flash(bge_t *bgep, bge_peekpoke_t *ppd);
4628 #pragma	no_inline(bge_chip_poke_flash)
4629 
4630 static void
4631 bge_chip_poke_flash(bge_t *bgep, bge_peekpoke_t *ppd)
4632 {
4633 	uint32_t data;
4634 
4635 	BGE_TRACE(("bge_chip_poke_flash($%p, $%p)",
4636 		(void *)bgep, (void *)ppd));
4637 
4638 	data = ppd->pp_acc_data;
4639 	(void) bge_nvmem_rw32(bgep, BGE_FLASH_WRITE,
4640 	    ppd->pp_acc_offset, &data);
4641 }
4642 #endif	/* BGE_FLASH_IO32 */
4643 
4644 static void bge_chip_peek_mem(bge_t *bgep, bge_peekpoke_t *ppd);
4645 #pragma	no_inline(bge_chip_peek_mem)
4646 
4647 static void
4648 bge_chip_peek_mem(bge_t *bgep, bge_peekpoke_t *ppd)
4649 {
4650 	uint64_t regval;
4651 	void *vaddr;
4652 
4653 	BGE_TRACE(("bge_chip_peek_bge($%p, $%p)",
4654 		(void *)bgep, (void *)ppd));
4655 
4656 	vaddr = (void *)(uintptr_t)ppd->pp_acc_offset;
4657 
4658 	switch (ppd->pp_acc_size) {
4659 	case 1:
4660 		regval = *(uint8_t *)vaddr;
4661 		break;
4662 
4663 	case 2:
4664 		regval = *(uint16_t *)vaddr;
4665 		break;
4666 
4667 	case 4:
4668 		regval = *(uint32_t *)vaddr;
4669 		break;
4670 
4671 	case 8:
4672 		regval = *(uint64_t *)vaddr;
4673 		break;
4674 	}
4675 
4676 	BGE_DEBUG(("bge_chip_peek_mem($%p, $%p) peeked 0x%llx from $%p",
4677 		(void *)bgep, (void *)ppd, regval, vaddr));
4678 
4679 	ppd->pp_acc_data = regval;
4680 }
4681 
4682 static void bge_chip_poke_mem(bge_t *bgep, bge_peekpoke_t *ppd);
4683 #pragma	no_inline(bge_chip_poke_mem)
4684 
4685 static void
4686 bge_chip_poke_mem(bge_t *bgep, bge_peekpoke_t *ppd)
4687 {
4688 	uint64_t regval;
4689 	void *vaddr;
4690 
4691 	BGE_TRACE(("bge_chip_poke_mem($%p, $%p)",
4692 		(void *)bgep, (void *)ppd));
4693 
4694 	vaddr = (void *)(uintptr_t)ppd->pp_acc_offset;
4695 	regval = ppd->pp_acc_data;
4696 
4697 	BGE_DEBUG(("bge_chip_poke_mem($%p, $%p) poking 0x%llx at $%p",
4698 		(void *)bgep, (void *)ppd, regval, vaddr));
4699 
4700 	switch (ppd->pp_acc_size) {
4701 	case 1:
4702 		*(uint8_t *)vaddr = (uint8_t)regval;
4703 		break;
4704 
4705 	case 2:
4706 		*(uint16_t *)vaddr = (uint16_t)regval;
4707 		break;
4708 
4709 	case 4:
4710 		*(uint32_t *)vaddr = (uint32_t)regval;
4711 		break;
4712 
4713 	case 8:
4714 		*(uint64_t *)vaddr = (uint64_t)regval;
4715 		break;
4716 	}
4717 }
4718 
4719 static enum ioc_reply bge_pp_ioctl(bge_t *bgep, int cmd, mblk_t *mp,
4720 					struct iocblk *iocp);
4721 #pragma	no_inline(bge_pp_ioctl)
4722 
4723 static enum ioc_reply
4724 bge_pp_ioctl(bge_t *bgep, int cmd, mblk_t *mp, struct iocblk *iocp)
4725 {
4726 	void (*ppfn)(bge_t *bgep, bge_peekpoke_t *ppd);
4727 	bge_peekpoke_t *ppd;
4728 	dma_area_t *areap;
4729 	uint64_t sizemask;
4730 	uint64_t mem_va;
4731 	uint64_t maxoff;
4732 	boolean_t peek;
4733 
4734 	switch (cmd) {
4735 	default:
4736 		/* NOTREACHED */
4737 		bge_error(bgep, "bge_pp_ioctl: invalid cmd 0x%x", cmd);
4738 		return (IOC_INVAL);
4739 
4740 	case BGE_PEEK:
4741 		peek = B_TRUE;
4742 		break;
4743 
4744 	case BGE_POKE:
4745 		peek = B_FALSE;
4746 		break;
4747 	}
4748 
4749 	/*
4750 	 * Validate format of ioctl
4751 	 */
4752 	if (iocp->ioc_count != sizeof (bge_peekpoke_t))
4753 		return (IOC_INVAL);
4754 	if (mp->b_cont == NULL)
4755 		return (IOC_INVAL);
4756 	ppd = (bge_peekpoke_t *)mp->b_cont->b_rptr;
4757 
4758 	/*
4759 	 * Validate request parameters
4760 	 */
4761 	switch (ppd->pp_acc_space) {
4762 	default:
4763 		return (IOC_INVAL);
4764 
4765 	case BGE_PP_SPACE_CFG:
4766 		/*
4767 		 * Config space
4768 		 */
4769 		sizemask = 8|4|2|1;
4770 		mem_va = 0;
4771 		maxoff = PCI_CONF_HDR_SIZE;
4772 		ppfn = peek ? bge_chip_peek_cfg : bge_chip_poke_cfg;
4773 		break;
4774 
4775 	case BGE_PP_SPACE_REG:
4776 		/*
4777 		 * Memory-mapped I/O space
4778 		 */
4779 		sizemask = 8|4|2|1;
4780 		mem_va = 0;
4781 		maxoff = RIAAR_REGISTER_MAX;
4782 		ppfn = peek ? bge_chip_peek_reg : bge_chip_poke_reg;
4783 		break;
4784 
4785 	case BGE_PP_SPACE_NIC:
4786 		/*
4787 		 * NIC on-chip memory
4788 		 */
4789 		sizemask = 8|4|2|1;
4790 		mem_va = 0;
4791 		maxoff = MWBAR_ONCHIP_MAX;
4792 		ppfn = peek ? bge_chip_peek_nic : bge_chip_poke_nic;
4793 		break;
4794 
4795 	case BGE_PP_SPACE_MII:
4796 		/*
4797 		 * PHY's MII registers
4798 		 * NB: all PHY registers are two bytes, but the
4799 		 * addresses increment in ones (word addressing).
4800 		 * So we scale the address here, then undo the
4801 		 * transformation inside the peek/poke functions.
4802 		 */
4803 		ppd->pp_acc_offset *= 2;
4804 		sizemask = 2;
4805 		mem_va = 0;
4806 		maxoff = (MII_MAXREG+1)*2;
4807 		ppfn = peek ? bge_chip_peek_mii : bge_chip_poke_mii;
4808 		break;
4809 
4810 #if	BGE_SEE_IO32
4811 	case BGE_PP_SPACE_SEEPROM:
4812 		/*
4813 		 * Attached SEEPROM(s), if any.
4814 		 * NB: we use the high-order bits of the 'address' as
4815 		 * a device select to accommodate multiple SEEPROMS,
4816 		 * If each one is the maximum size (64kbytes), this
4817 		 * makes them appear contiguous.  Otherwise, there may
4818 		 * be holes in the mapping.  ENxS doesn't have any
4819 		 * SEEPROMs anyway ...
4820 		 */
4821 		sizemask = 4;
4822 		mem_va = 0;
4823 		maxoff = SEEPROM_DEV_AND_ADDR_MASK;
4824 		ppfn = peek ? bge_chip_peek_seeprom : bge_chip_poke_seeprom;
4825 		break;
4826 #endif	/* BGE_SEE_IO32 */
4827 
4828 #if	BGE_FLASH_IO32
4829 	case BGE_PP_SPACE_FLASH:
4830 		/*
4831 		 * Attached Flash device (if any); a maximum of one device
4832 		 * is currently supported.  But it can be up to 1MB (unlike
4833 		 * the 64k limit on SEEPROMs) so why would you need more ;-)
4834 		 */
4835 		sizemask = 4;
4836 		mem_va = 0;
4837 		maxoff = NVM_FLASH_ADDR_MASK;
4838 		ppfn = peek ? bge_chip_peek_flash : bge_chip_poke_flash;
4839 		break;
4840 #endif	/* BGE_FLASH_IO32 */
4841 
4842 	case BGE_PP_SPACE_BGE:
4843 		/*
4844 		 * BGE data structure!
4845 		 */
4846 		sizemask = 8|4|2|1;
4847 		mem_va = (uintptr_t)bgep;
4848 		maxoff = sizeof (*bgep);
4849 		ppfn = peek ? bge_chip_peek_mem : bge_chip_poke_mem;
4850 		break;
4851 
4852 	case BGE_PP_SPACE_STATUS:
4853 	case BGE_PP_SPACE_STATISTICS:
4854 	case BGE_PP_SPACE_TXDESC:
4855 	case BGE_PP_SPACE_TXBUFF:
4856 	case BGE_PP_SPACE_RXDESC:
4857 	case BGE_PP_SPACE_RXBUFF:
4858 		/*
4859 		 * Various DMA_AREAs
4860 		 */
4861 		switch (ppd->pp_acc_space) {
4862 		case BGE_PP_SPACE_TXDESC:
4863 			areap = &bgep->tx_desc;
4864 			break;
4865 		case BGE_PP_SPACE_TXBUFF:
4866 			areap = &bgep->tx_buff[0];
4867 			break;
4868 		case BGE_PP_SPACE_RXDESC:
4869 			areap = &bgep->rx_desc[0];
4870 			break;
4871 		case BGE_PP_SPACE_RXBUFF:
4872 			areap = &bgep->rx_buff[0];
4873 			break;
4874 		case BGE_PP_SPACE_STATUS:
4875 			areap = &bgep->status_block;
4876 			break;
4877 		case BGE_PP_SPACE_STATISTICS:
4878 			if (bgep->chipid.statistic_type == BGE_STAT_BLK)
4879 				areap = &bgep->statistics;
4880 			break;
4881 		}
4882 
4883 		sizemask = 8|4|2|1;
4884 		mem_va = (uintptr_t)areap->mem_va;
4885 		maxoff = areap->alength;
4886 		ppfn = peek ? bge_chip_peek_mem : bge_chip_poke_mem;
4887 		break;
4888 	}
4889 
4890 	switch (ppd->pp_acc_size) {
4891 	default:
4892 		return (IOC_INVAL);
4893 
4894 	case 8:
4895 	case 4:
4896 	case 2:
4897 	case 1:
4898 		if ((ppd->pp_acc_size & sizemask) == 0)
4899 			return (IOC_INVAL);
4900 		break;
4901 	}
4902 
4903 	if ((ppd->pp_acc_offset % ppd->pp_acc_size) != 0)
4904 		return (IOC_INVAL);
4905 
4906 	if (ppd->pp_acc_offset >= maxoff)
4907 		return (IOC_INVAL);
4908 
4909 	if (ppd->pp_acc_offset+ppd->pp_acc_size > maxoff)
4910 		return (IOC_INVAL);
4911 
4912 	/*
4913 	 * All OK - go do it!
4914 	 */
4915 	ppd->pp_acc_offset += mem_va;
4916 	(*ppfn)(bgep, ppd);
4917 	return (peek ? IOC_REPLY : IOC_ACK);
4918 }
4919 
4920 static enum ioc_reply bge_diag_ioctl(bge_t *bgep, int cmd, mblk_t *mp,
4921 					struct iocblk *iocp);
4922 #pragma	no_inline(bge_diag_ioctl)
4923 
4924 static enum ioc_reply
4925 bge_diag_ioctl(bge_t *bgep, int cmd, mblk_t *mp, struct iocblk *iocp)
4926 {
4927 	ASSERT(mutex_owned(bgep->genlock));
4928 
4929 	switch (cmd) {
4930 	default:
4931 		/* NOTREACHED */
4932 		bge_error(bgep, "bge_diag_ioctl: invalid cmd 0x%x", cmd);
4933 		return (IOC_INVAL);
4934 
4935 	case BGE_DIAG:
4936 		/*
4937 		 * Currently a no-op
4938 		 */
4939 		return (IOC_ACK);
4940 
4941 	case BGE_PEEK:
4942 	case BGE_POKE:
4943 		return (bge_pp_ioctl(bgep, cmd, mp, iocp));
4944 
4945 	case BGE_PHY_RESET:
4946 		return (IOC_RESTART_ACK);
4947 
4948 	case BGE_SOFT_RESET:
4949 	case BGE_HARD_RESET:
4950 		/*
4951 		 * Reset and reinitialise the 570x hardware
4952 		 */
4953 		(void) bge_restart(bgep, cmd == BGE_HARD_RESET);
4954 		return (IOC_ACK);
4955 	}
4956 
4957 	/* NOTREACHED */
4958 }
4959 
4960 #endif	/* BGE_DEBUGGING || BGE_DO_PPIO */
4961 
4962 static enum ioc_reply bge_mii_ioctl(bge_t *bgep, int cmd, mblk_t *mp,
4963 				    struct iocblk *iocp);
4964 #pragma	no_inline(bge_mii_ioctl)
4965 
4966 static enum ioc_reply
4967 bge_mii_ioctl(bge_t *bgep, int cmd, mblk_t *mp, struct iocblk *iocp)
4968 {
4969 	struct bge_mii_rw *miirwp;
4970 
4971 	/*
4972 	 * Validate format of ioctl
4973 	 */
4974 	if (iocp->ioc_count != sizeof (struct bge_mii_rw))
4975 		return (IOC_INVAL);
4976 	if (mp->b_cont == NULL)
4977 		return (IOC_INVAL);
4978 	miirwp = (struct bge_mii_rw *)mp->b_cont->b_rptr;
4979 
4980 	/*
4981 	 * Validate request parameters ...
4982 	 */
4983 	if (miirwp->mii_reg > MII_MAXREG)
4984 		return (IOC_INVAL);
4985 
4986 	switch (cmd) {
4987 	default:
4988 		/* NOTREACHED */
4989 		bge_error(bgep, "bge_mii_ioctl: invalid cmd 0x%x", cmd);
4990 		return (IOC_INVAL);
4991 
4992 	case BGE_MII_READ:
4993 		miirwp->mii_data = bge_mii_get16(bgep, miirwp->mii_reg);
4994 		return (IOC_REPLY);
4995 
4996 	case BGE_MII_WRITE:
4997 		bge_mii_put16(bgep, miirwp->mii_reg, miirwp->mii_data);
4998 		return (IOC_ACK);
4999 	}
5000 
5001 	/* NOTREACHED */
5002 }
5003 
5004 #if	BGE_SEE_IO32
5005 
5006 static enum ioc_reply bge_see_ioctl(bge_t *bgep, int cmd, mblk_t *mp,
5007 				    struct iocblk *iocp);
5008 #pragma	no_inline(bge_see_ioctl)
5009 
5010 static enum ioc_reply
5011 bge_see_ioctl(bge_t *bgep, int cmd, mblk_t *mp, struct iocblk *iocp)
5012 {
5013 	struct bge_see_rw *seerwp;
5014 
5015 	/*
5016 	 * Validate format of ioctl
5017 	 */
5018 	if (iocp->ioc_count != sizeof (struct bge_see_rw))
5019 		return (IOC_INVAL);
5020 	if (mp->b_cont == NULL)
5021 		return (IOC_INVAL);
5022 	seerwp = (struct bge_see_rw *)mp->b_cont->b_rptr;
5023 
5024 	/*
5025 	 * Validate request parameters ...
5026 	 */
5027 	if (seerwp->see_addr & ~SEEPROM_DEV_AND_ADDR_MASK)
5028 		return (IOC_INVAL);
5029 
5030 	switch (cmd) {
5031 	default:
5032 		/* NOTREACHED */
5033 		bge_error(bgep, "bge_see_ioctl: invalid cmd 0x%x", cmd);
5034 		return (IOC_INVAL);
5035 
5036 	case BGE_SEE_READ:
5037 	case BGE_SEE_WRITE:
5038 		iocp->ioc_error = bge_nvmem_rw32(bgep, cmd,
5039 		    seerwp->see_addr, &seerwp->see_data);
5040 		return (IOC_REPLY);
5041 	}
5042 
5043 	/* NOTREACHED */
5044 }
5045 
5046 #endif	/* BGE_SEE_IO32 */
5047 
5048 #if	BGE_FLASH_IO32
5049 
5050 static enum ioc_reply bge_flash_ioctl(bge_t *bgep, int cmd, mblk_t *mp,
5051 				    struct iocblk *iocp);
5052 #pragma	no_inline(bge_flash_ioctl)
5053 
5054 static enum ioc_reply
5055 bge_flash_ioctl(bge_t *bgep, int cmd, mblk_t *mp, struct iocblk *iocp)
5056 {
5057 	struct bge_flash_rw *flashrwp;
5058 
5059 	/*
5060 	 * Validate format of ioctl
5061 	 */
5062 	if (iocp->ioc_count != sizeof (struct bge_flash_rw))
5063 		return (IOC_INVAL);
5064 	if (mp->b_cont == NULL)
5065 		return (IOC_INVAL);
5066 	flashrwp = (struct bge_flash_rw *)mp->b_cont->b_rptr;
5067 
5068 	/*
5069 	 * Validate request parameters ...
5070 	 */
5071 	if (flashrwp->flash_addr & ~NVM_FLASH_ADDR_MASK)
5072 		return (IOC_INVAL);
5073 
5074 	switch (cmd) {
5075 	default:
5076 		/* NOTREACHED */
5077 		bge_error(bgep, "bge_flash_ioctl: invalid cmd 0x%x", cmd);
5078 		return (IOC_INVAL);
5079 
5080 	case BGE_FLASH_READ:
5081 	case BGE_FLASH_WRITE:
5082 		iocp->ioc_error = bge_nvmem_rw32(bgep, cmd,
5083 		    flashrwp->flash_addr, &flashrwp->flash_data);
5084 		return (IOC_REPLY);
5085 	}
5086 
5087 	/* NOTREACHED */
5088 }
5089 
5090 #endif	/* BGE_FLASH_IO32 */
5091 
5092 enum ioc_reply bge_chip_ioctl(bge_t *bgep, queue_t *wq, mblk_t *mp,
5093 				struct iocblk *iocp);
5094 #pragma	no_inline(bge_chip_ioctl)
5095 
5096 enum ioc_reply
5097 bge_chip_ioctl(bge_t *bgep, queue_t *wq, mblk_t *mp, struct iocblk *iocp)
5098 {
5099 	int cmd;
5100 
5101 	BGE_TRACE(("bge_chip_ioctl($%p, $%p, $%p, $%p)",
5102 		(void *)bgep, (void *)wq, (void *)mp, (void *)iocp));
5103 
5104 	ASSERT(mutex_owned(bgep->genlock));
5105 
5106 	cmd = iocp->ioc_cmd;
5107 	switch (cmd) {
5108 	default:
5109 		/* NOTREACHED */
5110 		bge_error(bgep, "bge_chip_ioctl: invalid cmd 0x%x", cmd);
5111 		return (IOC_INVAL);
5112 
5113 	case BGE_DIAG:
5114 	case BGE_PEEK:
5115 	case BGE_POKE:
5116 	case BGE_PHY_RESET:
5117 	case BGE_SOFT_RESET:
5118 	case BGE_HARD_RESET:
5119 #if	BGE_DEBUGGING || BGE_DO_PPIO
5120 		return (bge_diag_ioctl(bgep, cmd, mp, iocp));
5121 #else
5122 		return (IOC_INVAL);
5123 #endif	/* BGE_DEBUGGING || BGE_DO_PPIO */
5124 
5125 	case BGE_MII_READ:
5126 	case BGE_MII_WRITE:
5127 		return (bge_mii_ioctl(bgep, cmd, mp, iocp));
5128 
5129 #if	BGE_SEE_IO32
5130 	case BGE_SEE_READ:
5131 	case BGE_SEE_WRITE:
5132 		return (bge_see_ioctl(bgep, cmd, mp, iocp));
5133 #endif	/* BGE_SEE_IO32 */
5134 
5135 #if	BGE_FLASH_IO32
5136 	case BGE_FLASH_READ:
5137 	case BGE_FLASH_WRITE:
5138 		return (bge_flash_ioctl(bgep, cmd, mp, iocp));
5139 #endif	/* BGE_FLASH_IO32 */
5140 	}
5141 
5142 	/* NOTREACHED */
5143 }
5144 
5145 void
5146 bge_chip_blank(void *arg, time_t ticks, uint_t count)
5147 {
5148 	bge_t *bgep = arg;
5149 
5150 	mutex_enter(bgep->genlock);
5151 	bge_reg_put32(bgep, RCV_COALESCE_TICKS_REG, ticks);
5152 	bge_reg_put32(bgep, RCV_COALESCE_MAX_BD_REG, count);
5153 	if (bge_check_acc_handle(bgep, bgep->io_handle) != DDI_FM_OK)
5154 		ddi_fm_service_impact(bgep->devinfo, DDI_SERVICE_UNAFFECTED);
5155 	mutex_exit(bgep->genlock);
5156 }
5157 
5158 #ifdef BGE_IPMI_ASF
5159 
5160 uint32_t
5161 bge_nic_read32(bge_t *bgep, bge_regno_t addr)
5162 {
5163 	uint32_t data;
5164 
5165 	if (!bgep->asf_wordswapped) {
5166 		/* a workaround word swap error */
5167 		if (addr & 4)
5168 			addr = addr - 4;
5169 		else
5170 			addr = addr + 4;
5171 	}
5172 
5173 	pci_config_put32(bgep->cfg_handle, PCI_CONF_BGE_MWBAR, addr);
5174 	data = pci_config_get32(bgep->cfg_handle, PCI_CONF_BGE_MWDAR);
5175 	pci_config_put32(bgep->cfg_handle, PCI_CONF_BGE_MWBAR, 0);
5176 
5177 	return (data);
5178 }
5179 
5180 
5181 void
5182 bge_asf_update_status(bge_t *bgep)
5183 {
5184 	uint32_t event;
5185 
5186 	bge_nic_put32(bgep, BGE_CMD_MAILBOX, BGE_CMD_NICDRV_ALIVE);
5187 	bge_nic_put32(bgep, BGE_CMD_LENGTH_MAILBOX, 4);
5188 	bge_nic_put32(bgep, BGE_CMD_DATA_MAILBOX,   3);
5189 
5190 	event = bge_reg_get32(bgep, RX_RISC_EVENT_REG);
5191 	bge_reg_put32(bgep, RX_RISC_EVENT_REG, event | RRER_ASF_EVENT);
5192 }
5193 
5194 
5195 /*
5196  * The driver is supposed to notify ASF that the OS is still running
5197  * every three seconds, otherwise the management server may attempt
5198  * to reboot the machine.  If it hasn't actually failed, this is
5199  * not a desireable result.  However, this isn't running as a real-time
5200  * thread, and even if it were, it might not be able to generate the
5201  * heartbeat in a timely manner due to system load.  As it isn't a
5202  * significant strain on the machine, we will set the interval to half
5203  * of the required value.
5204  */
5205 void
5206 bge_asf_heartbeat(void *arg)
5207 {
5208 	bge_t *bgep = (bge_t *)arg;
5209 
5210 	mutex_enter(bgep->genlock);
5211 	bge_asf_update_status((bge_t *)bgep);
5212 	if (bge_check_acc_handle(bgep, bgep->io_handle) != DDI_FM_OK)
5213 		ddi_fm_service_impact(bgep->devinfo, DDI_SERVICE_DEGRADED);
5214 	if (bge_check_acc_handle(bgep, bgep->cfg_handle) != DDI_FM_OK)
5215 		ddi_fm_service_impact(bgep->devinfo, DDI_SERVICE_DEGRADED);
5216 	mutex_exit(bgep->genlock);
5217 	((bge_t *)bgep)->asf_timeout_id = timeout(bge_asf_heartbeat, bgep,
5218 		drv_usectohz(BGE_ASF_HEARTBEAT_INTERVAL));
5219 }
5220 
5221 
5222 void
5223 bge_asf_stop_timer(bge_t *bgep)
5224 {
5225 	timeout_id_t tmp_id = 0;
5226 
5227 	while ((bgep->asf_timeout_id != 0) &&
5228 		(tmp_id != bgep->asf_timeout_id)) {
5229 		tmp_id = bgep->asf_timeout_id;
5230 		(void) untimeout(tmp_id);
5231 	}
5232 	bgep->asf_timeout_id = 0;
5233 }
5234 
5235 
5236 
5237 /*
5238  * This function should be placed at the earliest postion of bge_attach().
5239  */
5240 void
5241 bge_asf_get_config(bge_t *bgep)
5242 {
5243 	uint32_t nicsig;
5244 	uint32_t niccfg;
5245 
5246 	nicsig = bge_nic_read32(bgep, BGE_NIC_DATA_SIG_ADDR);
5247 	if (nicsig == BGE_NIC_DATA_SIG) {
5248 		niccfg = bge_nic_read32(bgep, BGE_NIC_DATA_NIC_CFG_ADDR);
5249 		if (niccfg & BGE_NIC_CFG_ENABLE_ASF)
5250 			/*
5251 			 * Here, we don't consider BAXTER, because BGE haven't
5252 			 * supported BAXTER (that is 5752). Also, as I know,
5253 			 * BAXTER doesn't support ASF feature.
5254 			 */
5255 			bgep->asf_enabled = B_TRUE;
5256 		else
5257 			bgep->asf_enabled = B_FALSE;
5258 	} else
5259 		bgep->asf_enabled = B_FALSE;
5260 }
5261 
5262 
5263 void
5264 bge_asf_pre_reset_operations(bge_t *bgep, uint32_t mode)
5265 {
5266 	uint32_t tries;
5267 	uint32_t event;
5268 
5269 	ASSERT(bgep->asf_enabled);
5270 
5271 	/* Issues "pause firmware" command and wait for ACK */
5272 	bge_nic_put32(bgep, BGE_CMD_MAILBOX, BGE_CMD_NICDRV_PAUSE_FW);
5273 	event = bge_reg_get32(bgep, RX_RISC_EVENT_REG);
5274 	bge_reg_put32(bgep, RX_RISC_EVENT_REG, event | RRER_ASF_EVENT);
5275 
5276 	event = bge_reg_get32(bgep, RX_RISC_EVENT_REG);
5277 	tries = 0;
5278 	while ((event & RRER_ASF_EVENT) && (tries < 100)) {
5279 		drv_usecwait(1);
5280 		tries ++;
5281 		event = bge_reg_get32(bgep, RX_RISC_EVENT_REG);
5282 	}
5283 
5284 	bge_nic_put32(bgep, BGE_FIRMWARE_MAILBOX,
5285 		BGE_MAGIC_NUM_FIRMWARE_INIT_DONE);
5286 
5287 	if (bgep->asf_newhandshake) {
5288 		switch (mode) {
5289 		case BGE_INIT_RESET:
5290 			bge_nic_put32(bgep, BGE_DRV_STATE_MAILBOX,
5291 				BGE_DRV_STATE_START);
5292 			break;
5293 		case BGE_SHUTDOWN_RESET:
5294 			bge_nic_put32(bgep, BGE_DRV_STATE_MAILBOX,
5295 				BGE_DRV_STATE_UNLOAD);
5296 			break;
5297 		case BGE_SUSPEND_RESET:
5298 			bge_nic_put32(bgep, BGE_DRV_STATE_MAILBOX,
5299 				BGE_DRV_STATE_SUSPEND);
5300 			break;
5301 		default:
5302 			break;
5303 		}
5304 	}
5305 }
5306 
5307 
5308 void
5309 bge_asf_post_reset_old_mode(bge_t *bgep, uint32_t mode)
5310 {
5311 	switch (mode) {
5312 	case BGE_INIT_RESET:
5313 		bge_nic_put32(bgep, BGE_DRV_STATE_MAILBOX,
5314 			BGE_DRV_STATE_START);
5315 		break;
5316 	case BGE_SHUTDOWN_RESET:
5317 		bge_nic_put32(bgep, BGE_DRV_STATE_MAILBOX,
5318 			BGE_DRV_STATE_UNLOAD);
5319 		break;
5320 	case BGE_SUSPEND_RESET:
5321 		bge_nic_put32(bgep, BGE_DRV_STATE_MAILBOX,
5322 			BGE_DRV_STATE_SUSPEND);
5323 		break;
5324 	default:
5325 		break;
5326 	}
5327 }
5328 
5329 
5330 void
5331 bge_asf_post_reset_new_mode(bge_t *bgep, uint32_t mode)
5332 {
5333 	switch (mode) {
5334 	case BGE_INIT_RESET:
5335 		bge_nic_put32(bgep, BGE_DRV_STATE_MAILBOX,
5336 			BGE_DRV_STATE_START_DONE);
5337 		break;
5338 	case BGE_SHUTDOWN_RESET:
5339 		bge_nic_put32(bgep, BGE_DRV_STATE_MAILBOX,
5340 			BGE_DRV_STATE_UNLOAD_DONE);
5341 		break;
5342 	default:
5343 		break;
5344 	}
5345 }
5346 
5347 #endif /* BGE_IPMI_ASF */
5348