xref: /titanic_52/usr/src/uts/common/io/bge/bge_chip2.c (revision d6bca47d04aa5f30dbe79ba4691488f5f26f631e)
1 /*
2  * CDDL HEADER START
3  *
4  * The contents of this file are subject to the terms of the
5  * Common Development and Distribution License (the "License").
6  * You may not use this file except in compliance with the License.
7  *
8  * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
9  * or http://www.opensolaris.org/os/licensing.
10  * See the License for the specific language governing permissions
11  * and limitations under the License.
12  *
13  * When distributing Covered Code, include this CDDL HEADER in each
14  * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
15  * If applicable, add the following below this CDDL HEADER, with the
16  * fields enclosed by brackets "[]" replaced with your own identifying
17  * information: Portions Copyright [yyyy] [name of copyright owner]
18  *
19  * CDDL HEADER END
20  */
21 
22 /*
23  * Copyright 2006 Sun Microsystems, Inc.  All rights reserved.
24  * Use is subject to license terms.
25  */
26 
27 #pragma ident	"%Z%%M%	%I%	%E% SMI"
28 
29 #include "sys/bge_impl2.h"
30 
31 #define	PIO_ADDR(bgep, offset)	((void *)((caddr_t)(bgep)->io_regs+(offset)))
32 
33 /*
34  * Future features ... ?
35  */
36 #define	BGE_CFG_IO8	0	/* 8/16-bit cfg space BIS/BIC	*/
37 #define	BGE_IND_IO32	0	/* indirect access code		*/
38 #define	BGE_SEE_IO32	1	/* SEEPROM access code		*/
39 #define	BGE_FLASH_IO32	1	/* FLASH access code		*/
40 
41 /*
42  * BGE MSI tunable:
43  *
44  * By default MSI is enabled on all supported platforms but it is disabled
45  * for some Broadcom chips due to known MSI hardware issues. Currently MSI
46  * is enabled only for 5714C A2 and 5715C A2 broadcom chips.
47  */
48 #if defined(__sparc)
49 boolean_t bge_enable_msi = B_TRUE;
50 #else
51 boolean_t bge_enable_msi = B_FALSE;
52 #endif
53 
54 /*
55  * Property names
56  */
57 static char knownids_propname[] = "bge-known-subsystems";
58 
59 /*
60  * Patchable globals:
61  *
62  *	bge_autorecover
63  *		Enables/disables automatic recovery after fault detection
64  *
65  *	bge_mlcr_default
66  *		Value to program into the MLCR; controls the chip's GPIO pins
67  *
68  *	bge_dma_{rd,wr}prio
69  *		Relative priorities of DMA reads & DMA writes respectively.
70  *		These may each be patched to any value 0-3.  Equal values
71  *		will give "fair" (round-robin) arbitration for PCI access.
72  *		Unequal values will give one or the other function priority.
73  *
74  *	bge_dma_rwctrl
75  *		Value to put in the Read/Write DMA control register.  See
76  *	        the Broadcom PRM for things you can fiddle with in this
77  *		register ...
78  *
79  *	bge_{tx,rx}_{count,ticks}_{norm,intr}
80  *		Send/receive interrupt coalescing parameters.  Counts are
81  *		#s of descriptors, ticks are in microseconds.  *norm* values
82  *		apply between status updates/interrupts; the *intr* values
83  *		refer to the 'during-interrupt' versions - see the PRM.
84  *
85  *		NOTE: these values have been determined by measurement. They
86  *		differ significantly from the values recommended in the PRM.
87  */
88 static uint32_t bge_autorecover = 1;
89 static uint32_t bge_mlcr_default = MLCR_DEFAULT;
90 static uint32_t bge_mlcr_default_5714 = MLCR_DEFAULT_5714;
91 
92 static uint32_t bge_dma_rdprio = 1;
93 static uint32_t bge_dma_wrprio = 0;
94 static uint32_t bge_dma_rwctrl = PDRWCR_VAR_DEFAULT;
95 static uint32_t bge_dma_rwctrl_5721 = PDRWCR_VAR_5721;
96 static uint32_t bge_dma_rwctrl_5714 = PDRWCR_VAR_5714;
97 static uint32_t bge_dma_rwctrl_5715 = PDRWCR_VAR_5715;
98 
99 uint32_t bge_rx_ticks_norm = 128;
100 uint32_t bge_tx_ticks_norm = 2048;		/* 8 for FJ2+ !?!?	*/
101 uint32_t bge_rx_count_norm = 8;
102 uint32_t bge_tx_count_norm = 128;
103 
104 static uint32_t bge_rx_ticks_intr = 128;
105 static uint32_t bge_tx_ticks_intr = 0;		/* 8 for FJ2+ !?!?	*/
106 static uint32_t bge_rx_count_intr = 2;
107 static uint32_t bge_tx_count_intr = 0;
108 
109 /*
110  * Memory pool configuration parameters.
111  *
112  * These are generally specific to each member of the chip family, since
113  * each one may have a different memory size/configuration.
114  *
115  * Setting the mbuf pool length for a specific type of chip to 0 inhibits
116  * the driver from programming the various registers; instead they are left
117  * at their hardware defaults.  This is the preferred option for later chips
118  * (5705+), whereas the older chips *required* these registers to be set,
119  * since the h/w default was 0 ;-(
120  */
121 static uint32_t bge_mbuf_pool_base	= MBUF_POOL_BASE_DEFAULT;
122 static uint32_t bge_mbuf_pool_base_5704	= MBUF_POOL_BASE_5704;
123 static uint32_t bge_mbuf_pool_base_5705	= MBUF_POOL_BASE_5705;
124 static uint32_t bge_mbuf_pool_base_5721 = MBUF_POOL_BASE_5721;
125 static uint32_t bge_mbuf_pool_len	= MBUF_POOL_LENGTH_DEFAULT;
126 static uint32_t bge_mbuf_pool_len_5704	= MBUF_POOL_LENGTH_5704;
127 static uint32_t bge_mbuf_pool_len_5705	= 0;	/* use h/w default	*/
128 static uint32_t bge_mbuf_pool_len_5721	= 0;
129 
130 /*
131  * Various high and low water marks, thresholds, etc ...
132  *
133  * Note: these are taken from revision 7 of the PRM, and some are different
134  * from both the values in earlier PRMs *and* those determined experimentally
135  * and used in earlier versions of this driver ...
136  */
137 static uint32_t bge_mbuf_hi_water	= MBUF_HIWAT_DEFAULT;
138 static uint32_t bge_mbuf_lo_water_rmac	= MAC_RX_MBUF_LOWAT_DEFAULT;
139 static uint32_t bge_mbuf_lo_water_rdma	= RDMA_MBUF_LOWAT_DEFAULT;
140 
141 static uint32_t bge_dmad_lo_water	= DMAD_POOL_LOWAT_DEFAULT;
142 static uint32_t bge_dmad_hi_water	= DMAD_POOL_HIWAT_DEFAULT;
143 static uint32_t bge_lowat_recv_frames	= LOWAT_MAX_RECV_FRAMES_DEFAULT;
144 
145 static uint32_t bge_replenish_std	= STD_RCV_BD_REPLENISH_DEFAULT;
146 static uint32_t bge_replenish_mini	= MINI_RCV_BD_REPLENISH_DEFAULT;
147 static uint32_t bge_replenish_jumbo	= JUMBO_RCV_BD_REPLENISH_DEFAULT;
148 
149 static uint32_t	bge_watchdog_count	= 1 << 16;
150 static uint16_t bge_dma_miss_limit	= 20;
151 
152 static uint32_t bge_stop_start_on_sync	= 0;
153 
154 boolean_t bge_jumbo_enable		= B_TRUE;
155 static uint32_t bge_default_jumbo_size	= BGE_JUMBO_BUFF_SIZE;
156 
157 /*
158  * ========== Low-level chip & ring buffer manipulation ==========
159  */
160 
161 #define	BGE_DBG		BGE_DBG_REGS	/* debug flag for this code	*/
162 
163 
164 /*
165  * Config space read-modify-write routines
166  */
167 
168 #if	BGE_CFG_IO8
169 
170 /*
171  * 8- and 16-bit set/clr operations are not used; all the config registers
172  * that we need to do bit-twiddling on are 32 bits wide.  I'll leave the
173  * code here, though, in case we ever find that we do want it after all ...
174  */
175 
176 static void bge_cfg_set8(bge_t *bgep, bge_regno_t regno, uint8_t bits);
177 #pragma	inline(bge_cfg_set8)
178 
179 static void
180 bge_cfg_set8(bge_t *bgep, bge_regno_t regno, uint8_t bits)
181 {
182 	uint8_t regval;
183 
184 	BGE_TRACE(("bge_cfg_set8($%p, 0x%lx, 0x%x)",
185 		(void *)bgep, regno, bits));
186 
187 	regval = pci_config_get8(bgep->cfg_handle, regno);
188 
189 	BGE_DEBUG(("bge_cfg_set8($%p, 0x%lx, 0x%x): 0x%x => 0x%x",
190 		(void *)bgep, regno, bits, regval, regval | bits));
191 
192 	regval |= bits;
193 	pci_config_put8(bgep->cfg_handle, regno, regval);
194 }
195 
196 static void bge_cfg_clr8(bge_t *bgep, bge_regno_t regno, uint8_t bits);
197 #pragma	inline(bge_cfg_clr8)
198 
199 static void
200 bge_cfg_clr8(bge_t *bgep, bge_regno_t regno, uint8_t bits)
201 {
202 	uint8_t regval;
203 
204 	BGE_TRACE(("bge_cfg_clr8($%p, 0x%lx, 0x%x)",
205 		(void *)bgep, regno, bits));
206 
207 	regval = pci_config_get8(bgep->cfg_handle, regno);
208 
209 	BGE_DEBUG(("bge_cfg_clr8($%p, 0x%lx, 0x%x): 0x%x => 0x%x",
210 		(void *)bgep, regno, bits, regval, regval & ~bits));
211 
212 	regval &= ~bits;
213 	pci_config_put8(bgep->cfg_handle, regno, regval);
214 }
215 
216 static void bge_cfg_set16(bge_t *bgep, bge_regno_t regno, uint16_t bits);
217 #pragma	inline(bge_cfg_set16)
218 
219 static void
220 bge_cfg_set16(bge_t *bgep, bge_regno_t regno, uint16_t bits)
221 {
222 	uint16_t regval;
223 
224 	BGE_TRACE(("bge_cfg_set16($%p, 0x%lx, 0x%x)",
225 		(void *)bgep, regno, bits));
226 
227 	regval = pci_config_get16(bgep->cfg_handle, regno);
228 
229 	BGE_DEBUG(("bge_cfg_set16($%p, 0x%lx, 0x%x): 0x%x => 0x%x",
230 		(void *)bgep, regno, bits, regval, regval | bits));
231 
232 	regval |= bits;
233 	pci_config_put16(bgep->cfg_handle, regno, regval);
234 }
235 
236 static void bge_cfg_clr16(bge_t *bgep, bge_regno_t regno, uint16_t bits);
237 #pragma	inline(bge_cfg_clr16)
238 
239 static void
240 bge_cfg_clr16(bge_t *bgep, bge_regno_t regno, uint16_t bits)
241 {
242 	uint16_t regval;
243 
244 	BGE_TRACE(("bge_cfg_clr16($%p, 0x%lx, 0x%x)",
245 		(void *)bgep, regno, bits));
246 
247 	regval = pci_config_get16(bgep->cfg_handle, regno);
248 
249 	BGE_DEBUG(("bge_cfg_clr16($%p, 0x%lx, 0x%x): 0x%x => 0x%x",
250 		(void *)bgep, regno, bits, regval, regval & ~bits));
251 
252 	regval &= ~bits;
253 	pci_config_put16(bgep->cfg_handle, regno, regval);
254 }
255 
256 #endif	/* BGE_CFG_IO8 */
257 
258 static void bge_cfg_set32(bge_t *bgep, bge_regno_t regno, uint32_t bits);
259 #pragma	inline(bge_cfg_set32)
260 
261 static void
262 bge_cfg_set32(bge_t *bgep, bge_regno_t regno, uint32_t bits)
263 {
264 	uint32_t regval;
265 
266 	BGE_TRACE(("bge_cfg_set32($%p, 0x%lx, 0x%x)",
267 		(void *)bgep, regno, bits));
268 
269 	regval = pci_config_get32(bgep->cfg_handle, regno);
270 
271 	BGE_DEBUG(("bge_cfg_set32($%p, 0x%lx, 0x%x): 0x%x => 0x%x",
272 		(void *)bgep, regno, bits, regval, regval | bits));
273 
274 	regval |= bits;
275 	pci_config_put32(bgep->cfg_handle, regno, regval);
276 }
277 
278 static void bge_cfg_clr32(bge_t *bgep, bge_regno_t regno, uint32_t bits);
279 #pragma	inline(bge_cfg_clr32)
280 
281 static void
282 bge_cfg_clr32(bge_t *bgep, bge_regno_t regno, uint32_t bits)
283 {
284 	uint32_t regval;
285 
286 	BGE_TRACE(("bge_cfg_clr32($%p, 0x%lx, 0x%x)",
287 		(void *)bgep, regno, bits));
288 
289 	regval = pci_config_get32(bgep->cfg_handle, regno);
290 
291 	BGE_DEBUG(("bge_cfg_clr32($%p, 0x%lx, 0x%x): 0x%x => 0x%x",
292 		(void *)bgep, regno, bits, regval, regval & ~bits));
293 
294 	regval &= ~bits;
295 	pci_config_put32(bgep->cfg_handle, regno, regval);
296 }
297 
298 #if	BGE_IND_IO32
299 
300 /*
301  * Indirect access to registers & RISC scratchpads, using config space
302  * accesses only.
303  *
304  * This isn't currently used, but someday we might want to use it for
305  * restoring the Subsystem Device/Vendor registers (which aren't directly
306  * writable in Config Space), or for downloading firmware into the RISCs
307  *
308  * In any case there are endian issues to be resolved before this code is
309  * enabled; the bizarre way that bytes get twisted by this chip AND by
310  * the PCI bridge in SPARC systems mean that we shouldn't enable it until
311  * it's been thoroughly tested for all access sizes on all supported
312  * architectures (SPARC *and* x86!).
313  */
314 static uint32_t bge_ind_get32(bge_t *bgep, bge_regno_t regno);
315 #pragma	inline(bge_ind_get32)
316 
317 static uint32_t
318 bge_ind_get32(bge_t *bgep, bge_regno_t regno)
319 {
320 	uint32_t val;
321 
322 	BGE_TRACE(("bge_ind_get32($%p, 0x%lx)", (void *)bgep, regno));
323 
324 	ASSERT(mutex_owned(bgep->genlock));
325 
326 	pci_config_put32(bgep->cfg_handle, PCI_CONF_BGE_RIAAR, regno);
327 	val = pci_config_get32(bgep->cfg_handle, PCI_CONF_BGE_RIADR);
328 
329 	BGE_DEBUG(("bge_ind_get32($%p, 0x%lx) => 0x%x",
330 		(void *)bgep, regno, val));
331 
332 	return (val);
333 }
334 
335 static void bge_ind_put32(bge_t *bgep, bge_regno_t regno, uint32_t val);
336 #pragma	inline(bge_ind_put32)
337 
338 static void
339 bge_ind_put32(bge_t *bgep, bge_regno_t regno, uint32_t val)
340 {
341 	BGE_TRACE(("bge_ind_put32($%p, 0x%lx, 0x%x)",
342 		(void *)bgep, regno, val));
343 
344 	ASSERT(mutex_owned(bgep->genlock));
345 
346 	pci_config_put32(bgep->cfg_handle, PCI_CONF_BGE_RIAAR, regno);
347 	pci_config_put32(bgep->cfg_handle, PCI_CONF_BGE_RIADR, val);
348 }
349 
350 #endif	/* BGE_IND_IO32 */
351 
352 #if	BGE_DEBUGGING
353 
354 static void bge_pci_check(bge_t *bgep);
355 #pragma	no_inline(bge_pci_check)
356 
357 static void
358 bge_pci_check(bge_t *bgep)
359 {
360 	uint16_t pcistatus;
361 
362 	pcistatus = pci_config_get16(bgep->cfg_handle, PCI_CONF_STAT);
363 	if ((pcistatus & (PCI_STAT_R_MAST_AB | PCI_STAT_R_TARG_AB)) != 0)
364 		BGE_DEBUG(("bge_pci_check($%p): PCI status 0x%x",
365 			(void *)bgep, pcistatus));
366 }
367 
368 #endif	/* BGE_DEBUGGING */
369 
370 /*
371  * Perform first-stage chip (re-)initialisation, using only config-space
372  * accesses:
373  *
374  * + Read the vendor/device/revision/subsystem/cache-line-size registers,
375  *   returning the data in the structure pointed to by <idp>.
376  * + Configure the target-mode endianness (swap) options.
377  * + Disable interrupts and enable Memory Space accesses.
378  * + Enable or disable Bus Mastering according to the <enable_dma> flag.
379  *
380  * This sequence is adapted from Broadcom document 570X-PG102-R,
381  * page 102, steps 1-3, 6-8 and 11-13.  The omitted parts of the sequence
382  * are 4 and 5 (Reset Core and wait) which are handled elsewhere.
383  *
384  * This function MUST be called before any non-config-space accesses
385  * are made; on this first call <enable_dma> is B_FALSE, and it
386  * effectively performs steps 3-1(!) of the initialisation sequence
387  * (the rest are not required but should be harmless).
388  *
389  * It MUST also be called also after a chip reset, as this disables
390  * Memory Space cycles!  In this case, <enable_dma> is B_TRUE, and
391  * it is effectively performing steps 6-8.
392  */
393 void bge_chip_cfg_init(bge_t *bgep, chip_id_t *cidp, boolean_t enable_dma);
394 #pragma	no_inline(bge_chip_cfg_init)
395 
396 void
397 bge_chip_cfg_init(bge_t *bgep, chip_id_t *cidp, boolean_t enable_dma)
398 {
399 	ddi_acc_handle_t handle;
400 	uint16_t command;
401 	uint32_t mhcr;
402 	uint16_t value16;
403 	int i;
404 
405 	BGE_TRACE(("bge_chip_cfg_init($%p, $%p, %d)",
406 		(void *)bgep, (void *)cidp, enable_dma));
407 
408 	/*
409 	 * Step 3: save PCI cache line size and subsystem vendor ID
410 	 *
411 	 * Read all the config-space registers that characterise the
412 	 * chip, specifically vendor/device/revision/subsystem vendor
413 	 * and subsystem device id.  We expect (but don't check) that
414 	 * (vendor == VENDOR_ID_BROADCOM) && (device == DEVICE_ID_5704)
415 	 *
416 	 * Also save all bus-transation related registers (cache-line
417 	 * size, bus-grant/latency parameters, etc).  Some of these are
418 	 * cleared by reset, so we'll have to restore them later.  This
419 	 * comes from the Broadcom document 570X-PG102-R ...
420 	 *
421 	 * Note: Broadcom document 570X-PG102-R seems to be in error
422 	 * here w.r.t. the offsets of the Subsystem Vendor ID and
423 	 * Subsystem (Device) ID registers, which are the opposite way
424 	 * round according to the PCI standard.  For good measure, we
425 	 * save/restore both anyway.
426 	 */
427 	handle = bgep->cfg_handle;
428 
429 	mhcr = pci_config_get32(handle, PCI_CONF_BGE_MHCR);
430 	cidp->asic_rev = mhcr & MHCR_CHIP_REV_MASK;
431 	cidp->businfo = pci_config_get32(handle, PCI_CONF_BGE_PCISTATE);
432 	cidp->command = pci_config_get16(handle, PCI_CONF_COMM);
433 
434 	cidp->vendor = pci_config_get16(handle, PCI_CONF_VENID);
435 	cidp->device = pci_config_get16(handle, PCI_CONF_DEVID);
436 	cidp->subven = pci_config_get16(handle, PCI_CONF_SUBVENID);
437 	cidp->subdev = pci_config_get16(handle, PCI_CONF_SUBSYSID);
438 	cidp->revision = pci_config_get8(handle, PCI_CONF_REVID);
439 	cidp->clsize = pci_config_get8(handle, PCI_CONF_CACHE_LINESZ);
440 	cidp->latency = pci_config_get8(handle, PCI_CONF_LATENCY_TIMER);
441 
442 	BGE_DEBUG(("bge_chip_cfg_init: %s bus is %s and %s; #INTA is %s",
443 		cidp->businfo & PCISTATE_BUS_IS_PCI ? "PCI" : "PCI-X",
444 		cidp->businfo & PCISTATE_BUS_IS_FAST ? "fast" : "slow",
445 		cidp->businfo & PCISTATE_BUS_IS_32_BIT ? "narrow" : "wide",
446 		cidp->businfo & PCISTATE_INTA_STATE ? "high" : "low"));
447 	BGE_DEBUG(("bge_chip_cfg_init: vendor 0x%x device 0x%x revision 0x%x",
448 		cidp->vendor, cidp->device, cidp->revision));
449 	BGE_DEBUG(("bge_chip_cfg_init: subven 0x%x subdev 0x%x asic_rev 0x%x",
450 		cidp->subven, cidp->subdev, cidp->asic_rev));
451 	BGE_DEBUG(("bge_chip_cfg_init: clsize %d latency %d command 0x%x",
452 		cidp->clsize, cidp->latency, cidp->command));
453 
454 	/*
455 	 * Step 2 (also step 6): disable and clear interrupts.
456 	 * Steps 11-13: configure PIO endianness options, and enable
457 	 * indirect register access.  We'll also select any other
458 	 * options controlled by the MHCR (eg tagged status, mask
459 	 * interrupt mode) at this stage ...
460 	 *
461 	 * Note: internally, the chip is 64-bit and BIG-endian, but
462 	 * since it talks to the host over a (LITTLE-endian) PCI bus,
463 	 * it normally swaps bytes around at the PCI interface.
464 	 * However, the PCI host bridge on SPARC systems normally
465 	 * swaps the byte lanes around too, since SPARCs are also
466 	 * BIG-endian.  So it turns out that on SPARC, the right
467 	 * option is to tell the chip to swap (and the host bridge
468 	 * will swap back again), whereas on x86 we ask the chip
469 	 * NOT to swap, so the natural little-endianness of the
470 	 * PCI bus is assumed.  Then the only thing that doesn't
471 	 * automatically work right is access to an 8-byte register
472 	 * by a little-endian host; but we don't want to set the
473 	 * MHCR_ENABLE_REGISTER_WORD_SWAP bit because then 4-byte
474 	 * accesses don't go where expected ;-(  So we live with
475 	 * that, and perform word-swaps in software in the few cases
476 	 * where a chip register is defined as an 8-byte value --
477 	 * see the code below for details ...
478 	 *
479 	 * Note: the meaning of the 'MASK_INTERRUPT_MODE' bit isn't
480 	 * very clear in the register description in the PRM, but
481 	 * Broadcom document 570X-PG104-R page 248 explains a little
482 	 * more (under "Broadcom Mask Mode").  The bit changes the way
483 	 * the MASK_PCI_INT_OUTPUT bit works: with MASK_INTERRUPT_MODE
484 	 * clear, the chip interprets MASK_PCI_INT_OUTPUT in the same
485 	 * way as the 5700 did, which isn't very convenient.  Setting
486 	 * the MASK_INTERRUPT_MODE bit makes the MASK_PCI_INT_OUTPUT
487 	 * bit do just what its name says -- MASK the PCI #INTA output
488 	 * (i.e. deassert the signal at the pin) leaving all internal
489 	 * state unchanged.  This is much more convenient for our
490 	 * interrupt handler, so we set MASK_INTERRUPT_MODE here.
491 	 *
492 	 * Note: the inconvenient semantics of the interrupt mailbox
493 	 * (nonzero disables and acknowledges/clears the interrupt,
494 	 * zero enables AND CLEARS it) would make race conditions
495 	 * likely in the interrupt handler:
496 	 *
497 	 * (1)	acknowledge & disable interrupts
498 	 * (2)	while (more to do)
499 	 * 		process packets
500 	 * (3)	enable interrupts -- also clears pending
501 	 *
502 	 * If the chip received more packets and internally generated
503 	 * an interrupt between the check at (2) and the mbox write
504 	 * at (3), this interrupt would be lost :-(
505 	 *
506 	 * The best way to avoid this is to use TAGGED STATUS mode,
507 	 * where the chip includes a unique tag in each status block
508 	 * update, and the host, when re-enabling interrupts, passes
509 	 * the last tag it saw back to the chip; then the chip can
510 	 * see whether the host is truly up to date, and regenerate
511 	 * its interrupt if not.
512 	 */
513 	mhcr =	MHCR_ENABLE_INDIRECT_ACCESS |
514 		MHCR_ENABLE_TAGGED_STATUS_MODE |
515 		MHCR_MASK_INTERRUPT_MODE |
516 		MHCR_CLEAR_INTERRUPT_INTA;
517 
518 	if (bgep->intr_type == DDI_INTR_TYPE_FIXED)
519 		mhcr |= MHCR_MASK_PCI_INT_OUTPUT;
520 
521 #ifdef	_BIG_ENDIAN
522 	mhcr |= MHCR_ENABLE_ENDIAN_WORD_SWAP | MHCR_ENABLE_ENDIAN_BYTE_SWAP;
523 #endif	/* _BIG_ENDIAN */
524 
525 	pci_config_put32(handle, PCI_CONF_BGE_MHCR, mhcr);
526 
527 #ifdef BGE_IPMI_ASF
528 	bgep->asf_wordswapped = B_FALSE;
529 #endif
530 	/*
531 	 * Step 1 (also step 7): Enable PCI Memory Space accesses
532 	 *			 Disable Memory Write/Invalidate
533 	 *			 Enable or disable Bus Mastering
534 	 *
535 	 * Note that all other bits are taken from the original value saved
536 	 * the first time through here, rather than from the current register
537 	 * value, 'cos that will have been cleared by a soft RESET since.
538 	 * In this way we preserve the OBP/nexus-parent's preferred settings
539 	 * of the parity-error and system-error enable bits across multiple
540 	 * chip RESETs.
541 	 *
542 	 * Step 8: Disable PCI-X Relaxed Ordering -- doesn't apply
543 	 */
544 	command = bgep->chipid.command | PCI_COMM_MAE;
545 	command &= ~(PCI_COMM_ME|PCI_COMM_MEMWR_INVAL);
546 	if (enable_dma)
547 		command |= PCI_COMM_ME;
548 	/*
549 	 * on BCM5714 revision A0, false parity error gets generated
550 	 * due to a logic bug. Provide a workaround by disabling parrity
551 	 * error.
552 	 */
553 	if (((cidp->device == DEVICE_ID_5714C) ||
554 	    (cidp->device == DEVICE_ID_5714S)) &&
555 	    (cidp->revision == REVISION_ID_5714_A0)) {
556 		command &= ~PCI_COMM_PARITY_DETECT;
557 	}
558 	pci_config_put16(handle, PCI_CONF_COMM, command);
559 
560 	/*
561 	 * On some PCI-E device, there were instances when
562 	 * the device was still link training.
563 	 */
564 	if (bgep->chipid.pci_type == BGE_PCI_E) {
565 		i = 0;
566 		value16 = pci_config_get16(handle, PCI_CONF_COMM);
567 		while ((value16 != command) && (i < 100)) {
568 			drv_usecwait(200);
569 			value16 = pci_config_get16(handle, PCI_CONF_COMM);
570 			++i;
571 		}
572 	}
573 
574 	/*
575 	 * Clear any remaining error status bits
576 	 */
577 	pci_config_put16(handle, PCI_CONF_STAT, ~0);
578 
579 	/*
580 	 * Do following if and only if the device is NOT BCM5714C OR
581 	 * BCM5715C
582 	 */
583 
584 	if (!((cidp->device == DEVICE_ID_5714C) ||
585 		(cidp->device == DEVICE_ID_5715C))) {
586 		/*
587 		 * Make sure these indirect-access registers are sane
588 		 * rather than random after power-up or reset
589 		 */
590 		pci_config_put32(handle, PCI_CONF_BGE_RIAAR, 0);
591 		pci_config_put32(handle, PCI_CONF_BGE_MWBAR, 0);
592 	}
593 }
594 
595 #ifdef __amd64
596 /*
597  * Distinguish CPU types
598  *
599  * These use to  distinguish AMD64 or Intel EM64T of CPU running mode.
600  * If CPU runs on Intel EM64T mode,the 64bit operation cannot works fine
601  * for PCI-Express based network interface card. This is the work-around
602  * for those nics.
603  */
604 static boolean_t bge_get_em64t_type(void);
605 #pragma	inline(bge_get_em64t_type)
606 
607 static boolean_t
608 bge_get_em64t_type(void)
609 {
610 
611 	return (x86_vendor == X86_VENDOR_Intel);
612 }
613 #endif
614 
615 /*
616  * Operating register get/set access routines
617  */
618 
619 uint32_t bge_reg_get32(bge_t *bgep, bge_regno_t regno);
620 #pragma	inline(bge_reg_get32)
621 
622 uint32_t
623 bge_reg_get32(bge_t *bgep, bge_regno_t regno)
624 {
625 	BGE_TRACE(("bge_reg_get32($%p, 0x%lx)",
626 		(void *)bgep, regno));
627 
628 	return (ddi_get32(bgep->io_handle, PIO_ADDR(bgep, regno)));
629 }
630 
631 void bge_reg_put32(bge_t *bgep, bge_regno_t regno, uint32_t data);
632 #pragma	inline(bge_reg_put32)
633 
634 void
635 bge_reg_put32(bge_t *bgep, bge_regno_t regno, uint32_t data)
636 {
637 	BGE_TRACE(("bge_reg_put32($%p, 0x%lx, 0x%x)",
638 		(void *)bgep, regno, data));
639 
640 	ddi_put32(bgep->io_handle, PIO_ADDR(bgep, regno), data);
641 	BGE_PCICHK(bgep);
642 }
643 
644 void bge_reg_set32(bge_t *bgep, bge_regno_t regno, uint32_t bits);
645 #pragma	inline(bge_reg_set32)
646 
647 void
648 bge_reg_set32(bge_t *bgep, bge_regno_t regno, uint32_t bits)
649 {
650 	uint32_t regval;
651 
652 	BGE_TRACE(("bge_reg_set32($%p, 0x%lx, 0x%x)",
653 		(void *)bgep, regno, bits));
654 
655 	regval = bge_reg_get32(bgep, regno);
656 	regval |= bits;
657 	bge_reg_put32(bgep, regno, regval);
658 }
659 
660 void bge_reg_clr32(bge_t *bgep, bge_regno_t regno, uint32_t bits);
661 #pragma	inline(bge_reg_clr32)
662 
663 void
664 bge_reg_clr32(bge_t *bgep, bge_regno_t regno, uint32_t bits)
665 {
666 	uint32_t regval;
667 
668 	BGE_TRACE(("bge_reg_clr32($%p, 0x%lx, 0x%x)",
669 		(void *)bgep, regno, bits));
670 
671 	regval = bge_reg_get32(bgep, regno);
672 	regval &= ~bits;
673 	bge_reg_put32(bgep, regno, regval);
674 }
675 
676 static uint64_t bge_reg_get64(bge_t *bgep, bge_regno_t regno);
677 #pragma	inline(bge_reg_get64)
678 
679 static uint64_t
680 bge_reg_get64(bge_t *bgep, bge_regno_t regno)
681 {
682 	uint64_t regval;
683 
684 #ifdef	__amd64
685 	if (bge_get_em64t_type()) {
686 		regval = ddi_get32(bgep->io_handle, PIO_ADDR(bgep, regno + 4));
687 		regval <<= 32;
688 		regval |= ddi_get32(bgep->io_handle, PIO_ADDR(bgep, regno));
689 	} else {
690 		regval = ddi_get64(bgep->io_handle, PIO_ADDR(bgep, regno));
691 	}
692 #else
693 	regval = ddi_get64(bgep->io_handle, PIO_ADDR(bgep, regno));
694 #endif
695 
696 #ifdef	_LITTLE_ENDIAN
697 	regval = (regval >> 32) | (regval << 32);
698 #endif	/* _LITTLE_ENDIAN */
699 
700 	BGE_TRACE(("bge_reg_get64($%p, 0x%lx) = 0x%016llx",
701 		(void *)bgep, regno, regval));
702 
703 	return (regval);
704 }
705 
706 static void bge_reg_put64(bge_t *bgep, bge_regno_t regno, uint64_t data);
707 #pragma	inline(bge_reg_put64)
708 
709 static void
710 bge_reg_put64(bge_t *bgep, bge_regno_t regno, uint64_t data)
711 {
712 	BGE_TRACE(("bge_reg_put64($%p, 0x%lx, 0x%016llx)",
713 		(void *)bgep, regno, data));
714 
715 #ifdef	_LITTLE_ENDIAN
716 	data = ((data >> 32) | (data << 32));
717 #endif	/* _LITTLE_ENDIAN */
718 
719 #ifdef	__amd64
720 	if (bge_get_em64t_type()) {
721 		ddi_put32(bgep->io_handle,
722 			PIO_ADDR(bgep, regno), (uint32_t)data);
723 		BGE_PCICHK(bgep);
724 		ddi_put32(bgep->io_handle,
725 			PIO_ADDR(bgep, regno + 4), (uint32_t)(data >> 32));
726 
727 	} else {
728 		ddi_put64(bgep->io_handle, PIO_ADDR(bgep, regno), data);
729 	}
730 #else
731 	ddi_put64(bgep->io_handle, PIO_ADDR(bgep, regno), data);
732 #endif
733 
734 	BGE_PCICHK(bgep);
735 }
736 
737 /*
738  * The DDI doesn't provide get/put functions for 128 bit data
739  * so we put RCBs out as two 64-bit chunks instead.
740  */
741 static void bge_reg_putrcb(bge_t *bgep, bge_regno_t addr, bge_rcb_t *rcbp);
742 #pragma	inline(bge_reg_putrcb)
743 
744 static void
745 bge_reg_putrcb(bge_t *bgep, bge_regno_t addr, bge_rcb_t *rcbp)
746 {
747 	uint64_t *p;
748 
749 	BGE_TRACE(("bge_reg_putrcb($%p, 0x%lx, 0x%016llx:%04x:%04x:%08x)",
750 		(void *)bgep, addr, rcbp->host_ring_addr,
751 		rcbp->max_len, rcbp->flags, rcbp->nic_ring_addr));
752 
753 	ASSERT((addr % sizeof (*rcbp)) == 0);
754 
755 	p = (void *)rcbp;
756 	bge_reg_put64(bgep, addr, *p++);
757 	bge_reg_put64(bgep, addr+8, *p);
758 }
759 
760 void bge_mbx_put(bge_t *bgep, bge_regno_t regno, uint64_t data);
761 #pragma	inline(bge_mbx_put)
762 
763 void
764 bge_mbx_put(bge_t *bgep, bge_regno_t regno, uint64_t data)
765 {
766 	BGE_TRACE(("bge_mbx_put($%p, 0x%lx, 0x%016llx)",
767 		(void *)bgep, regno, data));
768 
769 	/*
770 	 * Mailbox registers are nominally 64 bits on the 5701, but
771 	 * the MSW isn't used.  On the 5703, they're only 32 bits
772 	 * anyway.  So here we just write the lower(!) 32 bits -
773 	 * remembering that the chip is big-endian, even though the
774 	 * PCI bus is little-endian ...
775 	 */
776 #ifdef	_BIG_ENDIAN
777 	ddi_put32(bgep->io_handle, PIO_ADDR(bgep, regno+4), (uint32_t)data);
778 #else
779 	ddi_put32(bgep->io_handle, PIO_ADDR(bgep, regno), (uint32_t)data);
780 #endif	/* _BIG_ENDIAN */
781 	BGE_PCICHK(bgep);
782 }
783 
784 #if	BGE_DEBUGGING
785 
786 void bge_led_mark(bge_t *bgep);
787 #pragma	no_inline(bge_led_mark)
788 
789 void
790 bge_led_mark(bge_t *bgep)
791 {
792 	uint32_t led_ctrl = LED_CONTROL_OVERRIDE_LINK |
793 			    LED_CONTROL_1000MBPS_LED |
794 			    LED_CONTROL_100MBPS_LED |
795 			    LED_CONTROL_10MBPS_LED;
796 
797 	/*
798 	 * Blink all three LINK LEDs on simultaneously, then all off,
799 	 * then restore to automatic hardware control.  This is used
800 	 * in laboratory testing to trigger a logic analyser or scope.
801 	 */
802 	bge_reg_set32(bgep, ETHERNET_MAC_LED_CONTROL_REG, led_ctrl);
803 	led_ctrl ^= LED_CONTROL_OVERRIDE_LINK;
804 	bge_reg_clr32(bgep, ETHERNET_MAC_LED_CONTROL_REG, led_ctrl);
805 	led_ctrl = LED_CONTROL_OVERRIDE_LINK;
806 	bge_reg_clr32(bgep, ETHERNET_MAC_LED_CONTROL_REG, led_ctrl);
807 }
808 
809 #endif	/* BGE_DEBUGGING */
810 
811 /*
812  * NIC on-chip memory access routines
813  *
814  * Only 32K of NIC memory is visible at a time, controlled by the
815  * Memory Window Base Address Register (in PCI config space).  Once
816  * this is set, the 32K region of NIC-local memory that it refers
817  * to can be directly addressed in the upper 32K of the 64K of PCI
818  * memory space used for the device.
819  */
820 
821 static void bge_nic_setwin(bge_t *bgep, bge_regno_t base);
822 #pragma	inline(bge_nic_setwin)
823 
824 static void
825 bge_nic_setwin(bge_t *bgep, bge_regno_t base)
826 {
827 	chip_id_t *cidp;
828 
829 	BGE_TRACE(("bge_nic_setwin($%p, 0x%lx)",
830 		(void *)bgep, base));
831 
832 	ASSERT((base & MWBAR_GRANULE_MASK) == 0);
833 
834 	/*
835 	 * Don't do repeated zero data writes,
836 	 * if the device is BCM5714C/15C.
837 	 */
838 	cidp = &bgep->chipid;
839 	if ((cidp->device == DEVICE_ID_5714C) ||
840 		(cidp->device == DEVICE_ID_5715C)) {
841 		if (bgep->lastWriteZeroData && (base == (bge_regno_t)0))
842 			return;
843 		/* Adjust lastWriteZeroData */
844 		bgep->lastWriteZeroData = ((base == (bge_regno_t)0) ?
845 			B_TRUE : B_FALSE);
846 	}
847 	pci_config_put32(bgep->cfg_handle, PCI_CONF_BGE_MWBAR, base);
848 }
849 
850 
851 static uint32_t bge_nic_get32(bge_t *bgep, bge_regno_t addr);
852 #pragma	inline(bge_nic_get32)
853 
854 static uint32_t
855 bge_nic_get32(bge_t *bgep, bge_regno_t addr)
856 {
857 	uint32_t data;
858 
859 #ifdef BGE_IPMI_ASF
860 	if (bgep->asf_enabled && !bgep->asf_wordswapped) {
861 		/* workaround for word swap error */
862 		if (addr & 4)
863 			addr = addr - 4;
864 		else
865 			addr = addr + 4;
866 	}
867 #endif
868 
869 	bge_nic_setwin(bgep, addr & ~MWBAR_GRANULE_MASK);
870 	addr &= MWBAR_GRANULE_MASK;
871 	addr += NIC_MEM_WINDOW_OFFSET;
872 
873 	data = ddi_get32(bgep->io_handle, PIO_ADDR(bgep, addr));
874 
875 	BGE_TRACE(("bge_nic_get32($%p, 0x%lx) = 0x%08x",
876 		(void *)bgep, addr, data));
877 
878 	return (data);
879 }
880 
881 void bge_nic_put32(bge_t *bgep, bge_regno_t addr, uint32_t data);
882 #pragma inline(bge_nic_put32)
883 
884 void
885 bge_nic_put32(bge_t *bgep, bge_regno_t addr, uint32_t data)
886 {
887 	BGE_TRACE(("bge_nic_put32($%p, 0x%lx, 0x%08x)",
888 		(void *)bgep, addr, data));
889 
890 #ifdef BGE_IPMI_ASF
891 	if (bgep->asf_enabled && !bgep->asf_wordswapped) {
892 		/* workaround for word swap error */
893 		if (addr & 4)
894 			addr = addr - 4;
895 		else
896 			addr = addr + 4;
897 	}
898 #endif
899 
900 	bge_nic_setwin(bgep, addr & ~MWBAR_GRANULE_MASK);
901 	addr &= MWBAR_GRANULE_MASK;
902 	addr += NIC_MEM_WINDOW_OFFSET;
903 	ddi_put32(bgep->io_handle, PIO_ADDR(bgep, addr), data);
904 	BGE_PCICHK(bgep);
905 }
906 
907 
908 static uint64_t bge_nic_get64(bge_t *bgep, bge_regno_t addr);
909 #pragma	inline(bge_nic_get64)
910 
911 static uint64_t
912 bge_nic_get64(bge_t *bgep, bge_regno_t addr)
913 {
914 	uint64_t data;
915 
916 	bge_nic_setwin(bgep, addr & ~MWBAR_GRANULE_MASK);
917 	addr &= MWBAR_GRANULE_MASK;
918 	addr += NIC_MEM_WINDOW_OFFSET;
919 
920 #ifdef	__amd64
921 		if (bge_get_em64t_type()) {
922 			data = ddi_get32(bgep->io_handle, PIO_ADDR(bgep, addr));
923 			data <<= 32;
924 			data |= ddi_get32(bgep->io_handle,
925 				PIO_ADDR(bgep, addr + 4));
926 		} else {
927 			data = ddi_get64(bgep->io_handle, PIO_ADDR(bgep, addr));
928 		}
929 #else
930 		data = ddi_get64(bgep->io_handle, PIO_ADDR(bgep, addr));
931 #endif
932 
933 	BGE_TRACE(("bge_nic_get64($%p, 0x%lx) = 0x%016llx",
934 		(void *)bgep, addr, data));
935 
936 	return (data);
937 }
938 
939 static void bge_nic_put64(bge_t *bgep, bge_regno_t addr, uint64_t data);
940 #pragma	inline(bge_nic_put64)
941 
942 static void
943 bge_nic_put64(bge_t *bgep, bge_regno_t addr, uint64_t data)
944 {
945 	BGE_TRACE(("bge_nic_put64($%p, 0x%lx, 0x%016llx)",
946 		(void *)bgep, addr, data));
947 
948 	bge_nic_setwin(bgep, addr & ~MWBAR_GRANULE_MASK);
949 	addr &= MWBAR_GRANULE_MASK;
950 	addr += NIC_MEM_WINDOW_OFFSET;
951 
952 #ifdef	__amd64
953 	if (bge_get_em64t_type()) {
954 		ddi_put32(bgep->io_handle,
955 			PIO_ADDR(bgep, addr), (uint32_t)data);
956 		BGE_PCICHK(bgep);
957 		ddi_put32(bgep->io_handle,
958 			PIO_ADDR(bgep, addr + 4), (uint32_t)(data >> 32));
959 	} else {
960 		ddi_put64(bgep->io_handle, PIO_ADDR(bgep, addr), data);
961 	}
962 #else
963 	ddi_put64(bgep->io_handle, PIO_ADDR(bgep, addr), data);
964 #endif
965 
966 	BGE_PCICHK(bgep);
967 }
968 
969 /*
970  * The DDI doesn't provide get/put functions for 128 bit data
971  * so we put RCBs out as two 64-bit chunks instead.
972  */
973 static void bge_nic_putrcb(bge_t *bgep, bge_regno_t addr, bge_rcb_t *rcbp);
974 #pragma	inline(bge_nic_putrcb)
975 
976 static void
977 bge_nic_putrcb(bge_t *bgep, bge_regno_t addr, bge_rcb_t *rcbp)
978 {
979 	uint64_t *p;
980 
981 	BGE_TRACE(("bge_nic_putrcb($%p, 0x%lx, 0x%016llx:%04x:%04x:%08x)",
982 		(void *)bgep, addr, rcbp->host_ring_addr,
983 		rcbp->max_len, rcbp->flags, rcbp->nic_ring_addr));
984 
985 	ASSERT((addr % sizeof (*rcbp)) == 0);
986 
987 	bge_nic_setwin(bgep, addr & ~MWBAR_GRANULE_MASK);
988 	addr &= MWBAR_GRANULE_MASK;
989 	addr += NIC_MEM_WINDOW_OFFSET;
990 
991 	p = (void *)rcbp;
992 #ifdef	__amd64
993 	if (bge_get_em64t_type()) {
994 		ddi_put32(bgep->io_handle, PIO_ADDR(bgep, addr),
995 			(uint32_t)(*p));
996 		ddi_put32(bgep->io_handle, PIO_ADDR(bgep, addr + 4),
997 			(uint32_t)(*p >> 32));
998 		ddi_put32(bgep->io_handle, PIO_ADDR(bgep, addr + 8),
999 			(uint32_t)(*(p + 1)));
1000 		ddi_put32(bgep->io_handle, PIO_ADDR(bgep, addr + 12),
1001 			(uint32_t)(*p >> 32));
1002 
1003 	} else {
1004 		ddi_put64(bgep->io_handle, PIO_ADDR(bgep, addr), *p++);
1005 		ddi_put64(bgep->io_handle, PIO_ADDR(bgep, addr+8), *p);
1006 	}
1007 #else
1008 	ddi_put64(bgep->io_handle, PIO_ADDR(bgep, addr), *p++);
1009 	ddi_put64(bgep->io_handle, PIO_ADDR(bgep, addr + 8), *p);
1010 #endif
1011 
1012 	BGE_PCICHK(bgep);
1013 }
1014 
1015 static void bge_nic_zero(bge_t *bgep, bge_regno_t addr, uint32_t nbytes);
1016 #pragma	inline(bge_nic_zero)
1017 
1018 static void
1019 bge_nic_zero(bge_t *bgep, bge_regno_t addr, uint32_t nbytes)
1020 {
1021 	BGE_TRACE(("bge_nic_zero($%p, 0x%lx, 0x%x)",
1022 		(void *)bgep, addr, nbytes));
1023 
1024 	ASSERT((addr & ~MWBAR_GRANULE_MASK) ==
1025 		((addr+nbytes) & ~MWBAR_GRANULE_MASK));
1026 
1027 	bge_nic_setwin(bgep, addr & ~MWBAR_GRANULE_MASK);
1028 	addr &= MWBAR_GRANULE_MASK;
1029 	addr += NIC_MEM_WINDOW_OFFSET;
1030 
1031 	(void) ddi_device_zero(bgep->io_handle, PIO_ADDR(bgep, addr),
1032 		nbytes, 1, DDI_DATA_SZ08_ACC);
1033 	BGE_PCICHK(bgep);
1034 }
1035 
1036 /*
1037  * MII (PHY) register get/set access routines
1038  *
1039  * These use the chip's MII auto-access method, controlled by the
1040  * MII Communication register at 0x044c, so the CPU doesn't have
1041  * to fiddle with the individual bits.
1042  */
1043 
1044 #undef	BGE_DBG
1045 #define	BGE_DBG		BGE_DBG_MII	/* debug flag for this code	*/
1046 
1047 static uint16_t bge_mii_access(bge_t *bgep, bge_regno_t regno,
1048 				uint16_t data, uint32_t cmd);
1049 #pragma	no_inline(bge_mii_access)
1050 
1051 static uint16_t
1052 bge_mii_access(bge_t *bgep, bge_regno_t regno, uint16_t data, uint32_t cmd)
1053 {
1054 	uint32_t timeout;
1055 	uint32_t regval1;
1056 	uint32_t regval2;
1057 
1058 	BGE_TRACE(("bge_mii_access($%p, 0x%lx, 0x%x, 0x%x)",
1059 		(void *)bgep, regno, data, cmd));
1060 
1061 	ASSERT(mutex_owned(bgep->genlock));
1062 
1063 	/*
1064 	 * Assemble the command ...
1065 	 */
1066 	cmd |= data << MI_COMMS_DATA_SHIFT;
1067 	cmd |= regno << MI_COMMS_REGISTER_SHIFT;
1068 	cmd |= bgep->phy_mii_addr << MI_COMMS_ADDRESS_SHIFT;
1069 	cmd |= MI_COMMS_START;
1070 
1071 	/*
1072 	 * Wait for any command already in progress ...
1073 	 *
1074 	 * Note: this *shouldn't* ever find that there is a command
1075 	 * in progress, because we already hold the <genlock> mutex.
1076 	 * Nonetheless, we have sometimes seen the MI_COMMS_START
1077 	 * bit set here -- it seems that the chip can initiate MII
1078 	 * accesses internally, even with polling OFF.
1079 	 */
1080 	regval1 = regval2 = bge_reg_get32(bgep, MI_COMMS_REG);
1081 	for (timeout = 100; ; ) {
1082 		if ((regval2 & MI_COMMS_START) == 0) {
1083 			bge_reg_put32(bgep, MI_COMMS_REG, cmd);
1084 			break;
1085 		}
1086 		if (--timeout == 0)
1087 			break;
1088 		drv_usecwait(10);
1089 		regval2 = bge_reg_get32(bgep, MI_COMMS_REG);
1090 	}
1091 
1092 	if (timeout == 0)
1093 		return ((uint16_t)~0u);
1094 
1095 	if (timeout != 100)
1096 		BGE_REPORT((bgep, "bge_mii_access: cmd 0x%x -- "
1097 			"MI_COMMS_START set for %d us; 0x%x->0x%x",
1098 			cmd, 10*(100-timeout), regval1, regval2));
1099 
1100 	regval1 = bge_reg_get32(bgep, MI_COMMS_REG);
1101 	for (timeout = 1000; ; ) {
1102 		if ((regval1 & MI_COMMS_START) == 0)
1103 			break;
1104 		if (--timeout == 0)
1105 			break;
1106 		drv_usecwait(10);
1107 		regval1 = bge_reg_get32(bgep, MI_COMMS_REG);
1108 	}
1109 
1110 	/*
1111 	 * Drop out early if the READ FAILED bit is set -- this chip
1112 	 * could be a 5703/4S, with a SerDes instead of a PHY!
1113 	 */
1114 	if (regval2 & MI_COMMS_READ_FAILED)
1115 		return ((uint16_t)~0u);
1116 
1117 	if (timeout == 0)
1118 		return ((uint16_t)~0u);
1119 
1120 	/*
1121 	 * The PRM says to wait 5us after seeing the START bit clear
1122 	 * and then re-read the register to get the final value of the
1123 	 * data field, in order to avoid a race condition where the
1124 	 * START bit is clear but the data field isn't yet valid.
1125 	 *
1126 	 * Note: we don't actually seem to be encounter this race;
1127 	 * except when the START bit is seen set again (see below),
1128 	 * the data field doesn't change during this 5us interval.
1129 	 */
1130 	drv_usecwait(5);
1131 	regval2 = bge_reg_get32(bgep, MI_COMMS_REG);
1132 
1133 	/*
1134 	 * Unfortunately, when following the PRMs instructions above,
1135 	 * we have occasionally seen the START bit set again(!) in the
1136 	 * value read after the 5us delay. This seems to be due to the
1137 	 * chip autonomously starting another MII access internally.
1138 	 * In such cases, the command/data/etc fields relate to the
1139 	 * internal command, rather than the one that we thought had
1140 	 * just finished.  So in this case, we fall back to returning
1141 	 * the data from the original read that showed START clear.
1142 	 */
1143 	if (regval2 & MI_COMMS_START) {
1144 		BGE_REPORT((bgep, "bge_mii_access: cmd 0x%x -- "
1145 			"MI_COMMS_START set after transaction; 0x%x->0x%x",
1146 			cmd, regval1, regval2));
1147 		regval2 = regval1;
1148 	}
1149 
1150 	if (regval2 & MI_COMMS_START)
1151 		return ((uint16_t)~0u);
1152 
1153 	if (regval2 & MI_COMMS_READ_FAILED)
1154 		return ((uint16_t)~0u);
1155 
1156 	return ((regval2 & MI_COMMS_DATA_MASK) >> MI_COMMS_DATA_SHIFT);
1157 }
1158 
1159 uint16_t bge_mii_get16(bge_t *bgep, bge_regno_t regno);
1160 #pragma	no_inline(bge_mii_get16)
1161 
1162 uint16_t
1163 bge_mii_get16(bge_t *bgep, bge_regno_t regno)
1164 {
1165 	BGE_TRACE(("bge_mii_get16($%p, 0x%lx)",
1166 		(void *)bgep, regno));
1167 
1168 	ASSERT(mutex_owned(bgep->genlock));
1169 
1170 	return (bge_mii_access(bgep, regno, 0, MI_COMMS_COMMAND_READ));
1171 }
1172 
1173 void bge_mii_put16(bge_t *bgep, bge_regno_t regno, uint16_t data);
1174 #pragma	no_inline(bge_mii_put16)
1175 
1176 void
1177 bge_mii_put16(bge_t *bgep, bge_regno_t regno, uint16_t data)
1178 {
1179 	BGE_TRACE(("bge_mii_put16($%p, 0x%lx, 0x%x)",
1180 		(void *)bgep, regno, data));
1181 
1182 	ASSERT(mutex_owned(bgep->genlock));
1183 
1184 	(void) bge_mii_access(bgep, regno, data, MI_COMMS_COMMAND_WRITE);
1185 }
1186 
1187 #undef	BGE_DBG
1188 #define	BGE_DBG		BGE_DBG_SEEPROM	/* debug flag for this code	*/
1189 
1190 #if	BGE_SEE_IO32 || BGE_FLASH_IO32
1191 
1192 /*
1193  * Basic SEEPROM get/set access routine
1194  *
1195  * This uses the chip's SEEPROM auto-access method, controlled by the
1196  * Serial EEPROM Address/Data Registers at 0x6838/683c, so the CPU
1197  * doesn't have to fiddle with the individual bits.
1198  *
1199  * The caller should hold <genlock> and *also* have already acquired
1200  * the right to access the SEEPROM, via bge_nvmem_acquire() above.
1201  *
1202  * Return value:
1203  *	0 on success,
1204  *	ENODATA on access timeout (maybe retryable: device may just be busy)
1205  *	EPROTO on other h/w or s/w errors.
1206  *
1207  * <*dp> is an input to a SEEPROM_ACCESS_WRITE operation, or an output
1208  * from a (successful) SEEPROM_ACCESS_READ.
1209  */
1210 static int bge_seeprom_access(bge_t *bgep, uint32_t cmd, bge_regno_t addr,
1211 				uint32_t *dp);
1212 #pragma	no_inline(bge_seeprom_access)
1213 
1214 static int
1215 bge_seeprom_access(bge_t *bgep, uint32_t cmd, bge_regno_t addr, uint32_t *dp)
1216 {
1217 	uint32_t tries;
1218 	uint32_t regval;
1219 
1220 	ASSERT(mutex_owned(bgep->genlock));
1221 
1222 	/*
1223 	 * On the newer chips that support both SEEPROM & Flash, we need
1224 	 * to specifically enable SEEPROM access (Flash is the default).
1225 	 * On older chips, we don't; SEEPROM is the only NVtype supported,
1226 	 * and the NVM control registers don't exist ...
1227 	 */
1228 	switch (bgep->chipid.nvtype) {
1229 	case BGE_NVTYPE_NONE:
1230 	case BGE_NVTYPE_UNKNOWN:
1231 		_NOTE(NOTREACHED)
1232 	case BGE_NVTYPE_SEEPROM:
1233 		break;
1234 
1235 	case BGE_NVTYPE_LEGACY_SEEPROM:
1236 	case BGE_NVTYPE_UNBUFFERED_FLASH:
1237 	case BGE_NVTYPE_BUFFERED_FLASH:
1238 	default:
1239 		bge_reg_set32(bgep, NVM_CONFIG1_REG,
1240 				NVM_CFG1_LEGACY_SEEPROM_MODE);
1241 		break;
1242 	}
1243 
1244 	/*
1245 	 * Check there's no command in progress.
1246 	 *
1247 	 * Note: this *shouldn't* ever find that there is a command
1248 	 * in progress, because we already hold the <genlock> mutex.
1249 	 * Also, to ensure we don't have a conflict with the chip's
1250 	 * internal firmware or a process accessing the same (shared)
1251 	 * SEEPROM through the other port of a 5704, we've already
1252 	 * been through the "software arbitration" protocol.
1253 	 * So this is just a final consistency check: we shouldn't
1254 	 * see EITHER the START bit (command started but not complete)
1255 	 * OR the COMPLETE bit (command completed but not cleared).
1256 	 */
1257 	regval = bge_reg_get32(bgep, SERIAL_EEPROM_ADDRESS_REG);
1258 	if (regval & SEEPROM_ACCESS_START)
1259 		return (EPROTO);
1260 	if (regval & SEEPROM_ACCESS_COMPLETE)
1261 		return (EPROTO);
1262 
1263 	/*
1264 	 * Assemble the command ...
1265 	 */
1266 	cmd |= addr & SEEPROM_ACCESS_ADDRESS_MASK;
1267 	addr >>= SEEPROM_ACCESS_ADDRESS_SIZE;
1268 	addr <<= SEEPROM_ACCESS_DEVID_SHIFT;
1269 	cmd |= addr & SEEPROM_ACCESS_DEVID_MASK;
1270 	cmd |= SEEPROM_ACCESS_START;
1271 	cmd |= SEEPROM_ACCESS_COMPLETE;
1272 	cmd |= regval & SEEPROM_ACCESS_HALFCLOCK_MASK;
1273 
1274 	bge_reg_put32(bgep, SERIAL_EEPROM_DATA_REG, *dp);
1275 	bge_reg_put32(bgep, SERIAL_EEPROM_ADDRESS_REG, cmd);
1276 
1277 	/*
1278 	 * By observation, a successful access takes ~20us on a 5703/4,
1279 	 * but apparently much longer (up to 1000us) on the obsolescent
1280 	 * BCM5700/BCM5701.  We want to be sure we don't get any false
1281 	 * timeouts here; but OTOH, we don't want a bogus access to lock
1282 	 * out interrupts for longer than necessary. So we'll allow up
1283 	 * to 1000us ...
1284 	 */
1285 	for (tries = 0; tries < 1000; ++tries) {
1286 		regval = bge_reg_get32(bgep, SERIAL_EEPROM_ADDRESS_REG);
1287 		if (regval & SEEPROM_ACCESS_COMPLETE)
1288 			break;
1289 		drv_usecwait(1);
1290 	}
1291 
1292 	if (regval & SEEPROM_ACCESS_COMPLETE) {
1293 		/*
1294 		 * All OK; read the SEEPROM data register, then write back
1295 		 * the value read from the address register in order to
1296 		 * clear the <complete> bit and leave the SEEPROM access
1297 		 * state machine idle, ready for the next access ...
1298 		 */
1299 		BGE_DEBUG(("bge_seeprom_access: complete after %d us", tries));
1300 		*dp = bge_reg_get32(bgep, SERIAL_EEPROM_DATA_REG);
1301 		bge_reg_put32(bgep, SERIAL_EEPROM_ADDRESS_REG, regval);
1302 		return (0);
1303 	}
1304 
1305 	/*
1306 	 * Hmm ... what happened here?
1307 	 *
1308 	 * Most likely, the user addressed an non-existent SEEPROM. Or
1309 	 * maybe the SEEPROM was busy internally (e.g. processing a write)
1310 	 * and didn't respond to being addressed. Either way, it's left
1311 	 * the SEEPROM access state machine wedged. So we'll reset it
1312 	 * before we leave, so it's ready for next time ...
1313 	 */
1314 	BGE_DEBUG(("bge_seeprom_access: timed out after %d us", tries));
1315 	bge_reg_set32(bgep, SERIAL_EEPROM_ADDRESS_REG, SEEPROM_ACCESS_INIT);
1316 	return (ENODATA);
1317 }
1318 
1319 /*
1320  * Basic Flash get/set access routine
1321  *
1322  * These use the chip's Flash auto-access method, controlled by the
1323  * Flash Access Registers at 0x7000-701c, so the CPU doesn't have to
1324  * fiddle with the individual bits.
1325  *
1326  * The caller should hold <genlock> and *also* have already acquired
1327  * the right to access the Flash, via bge_nvmem_acquire() above.
1328  *
1329  * Return value:
1330  *	0 on success,
1331  *	ENODATA on access timeout (maybe retryable: device may just be busy)
1332  *	ENODEV if the NVmem device is missing or otherwise unusable
1333  *
1334  * <*dp> is an input to a NVM_FLASH_CMD_WR operation, or an output
1335  * from a (successful) NVM_FLASH_CMD_RD.
1336  */
1337 static int bge_flash_access(bge_t *bgep, uint32_t cmd, bge_regno_t addr,
1338 				uint32_t *dp);
1339 #pragma	no_inline(bge_flash_access)
1340 
1341 static int
1342 bge_flash_access(bge_t *bgep, uint32_t cmd, bge_regno_t addr, uint32_t *dp)
1343 {
1344 	uint32_t tries;
1345 	uint32_t regval;
1346 
1347 	ASSERT(mutex_owned(bgep->genlock));
1348 
1349 	/*
1350 	 * On the newer chips that support both SEEPROM & Flash, we need
1351 	 * to specifically disable SEEPROM access while accessing Flash.
1352 	 * The older chips don't support Flash, and the NVM registers don't
1353 	 * exist, so we shouldn't be here at all!
1354 	 */
1355 	switch (bgep->chipid.nvtype) {
1356 	case BGE_NVTYPE_NONE:
1357 	case BGE_NVTYPE_UNKNOWN:
1358 		_NOTE(NOTREACHED)
1359 	case BGE_NVTYPE_SEEPROM:
1360 		return (ENODEV);
1361 
1362 	case BGE_NVTYPE_LEGACY_SEEPROM:
1363 	case BGE_NVTYPE_UNBUFFERED_FLASH:
1364 	case BGE_NVTYPE_BUFFERED_FLASH:
1365 	default:
1366 		bge_reg_clr32(bgep, NVM_CONFIG1_REG,
1367 				NVM_CFG1_LEGACY_SEEPROM_MODE);
1368 		break;
1369 	}
1370 
1371 	/*
1372 	 * Assemble the command ...
1373 	 */
1374 	addr &= NVM_FLASH_ADDR_MASK;
1375 	cmd |= NVM_FLASH_CMD_DOIT;
1376 	cmd |= NVM_FLASH_CMD_FIRST;
1377 	cmd |= NVM_FLASH_CMD_LAST;
1378 	cmd |= NVM_FLASH_CMD_DONE;
1379 
1380 	bge_reg_put32(bgep, NVM_FLASH_WRITE_REG, *dp);
1381 	bge_reg_put32(bgep, NVM_FLASH_ADDR_REG, addr);
1382 	bge_reg_put32(bgep, NVM_FLASH_CMD_REG, cmd);
1383 
1384 	/*
1385 	 * Allow up to 1000ms ...
1386 	 */
1387 	for (tries = 0; tries < 1000; ++tries) {
1388 		regval = bge_reg_get32(bgep, NVM_FLASH_CMD_REG);
1389 		if (regval & NVM_FLASH_CMD_DONE)
1390 			break;
1391 		drv_usecwait(1);
1392 	}
1393 
1394 	if (regval & NVM_FLASH_CMD_DONE) {
1395 		/*
1396 		 * All OK; read the data from the Flash read register
1397 		 */
1398 		BGE_DEBUG(("bge_flash_access: complete after %d us", tries));
1399 		*dp = bge_reg_get32(bgep, NVM_FLASH_READ_REG);
1400 		return (0);
1401 	}
1402 
1403 	/*
1404 	 * Hmm ... what happened here?
1405 	 *
1406 	 * Most likely, the user addressed an non-existent Flash. Or
1407 	 * maybe the Flash was busy internally (e.g. processing a write)
1408 	 * and didn't respond to being addressed. Either way, there's
1409 	 * nothing we can here ...
1410 	 */
1411 	BGE_DEBUG(("bge_flash_access: timed out after %d us", tries));
1412 	return (ENODATA);
1413 }
1414 
1415 /*
1416  * The next two functions regulate access to the NVram (if fitted).
1417  *
1418  * On a 5704 (dual core) chip, there's only one SEEPROM and one Flash
1419  * (SPI) interface, but they can be accessed through either port. These
1420  * are managed by different instance of this driver and have no software
1421  * state in common.
1422  *
1423  * In addition (and even on a single core chip) the chip's internal
1424  * firmware can access the SEEPROM/Flash, most notably after a RESET
1425  * when it may download code to run internally.
1426  *
1427  * So we need to arbitrate between these various software agents.  For
1428  * this purpose, the chip provides the Software Arbitration Register,
1429  * which implements hardware(!) arbitration.
1430  *
1431  * This functionality didn't exist on older (5700/5701) chips, so there's
1432  * nothing we can do by way of arbitration on those; also, if there's no
1433  * SEEPROM/Flash fitted (or we couldn't determine what type), there's also
1434  * nothing to do.
1435  *
1436  * The internal firmware appears to use Request 0, which is the highest
1437  * priority.  So we'd like to use Request 2, leaving one higher and one
1438  * lower for any future developments ... but apparently this doesn't
1439  * always work.  So for now, the code uses Request 1 ;-(
1440  */
1441 
1442 #define	NVM_READ_REQ	NVM_READ_REQ1
1443 #define	NVM_RESET_REQ	NVM_RESET_REQ1
1444 #define	NVM_SET_REQ	NVM_SET_REQ1
1445 
1446 static void bge_nvmem_relinquish(bge_t *bgep);
1447 #pragma	no_inline(bge_nvmem_relinquish)
1448 
1449 static void
1450 bge_nvmem_relinquish(bge_t *bgep)
1451 {
1452 	ASSERT(mutex_owned(bgep->genlock));
1453 
1454 	switch (bgep->chipid.nvtype) {
1455 	case BGE_NVTYPE_NONE:
1456 	case BGE_NVTYPE_UNKNOWN:
1457 		_NOTE(NOTREACHED)
1458 		return;
1459 
1460 	case BGE_NVTYPE_SEEPROM:
1461 		/*
1462 		 * No arbitration performed, no release needed
1463 		 */
1464 		return;
1465 
1466 	case BGE_NVTYPE_LEGACY_SEEPROM:
1467 	case BGE_NVTYPE_UNBUFFERED_FLASH:
1468 	case BGE_NVTYPE_BUFFERED_FLASH:
1469 	default:
1470 		break;
1471 	}
1472 
1473 	/*
1474 	 * Our own request should be present (whether or not granted) ...
1475 	 */
1476 	(void) bge_reg_get32(bgep, NVM_SW_ARBITRATION_REG);
1477 
1478 	/*
1479 	 * ... this will make it go away.
1480 	 */
1481 	bge_reg_put32(bgep, NVM_SW_ARBITRATION_REG, NVM_RESET_REQ);
1482 	(void) bge_reg_get32(bgep, NVM_SW_ARBITRATION_REG);
1483 }
1484 
1485 /*
1486  * Arbitrate for access to the NVmem, if necessary
1487  *
1488  * Return value:
1489  *	0 on success
1490  *	EAGAIN if the device is in use (retryable)
1491  *	ENODEV if the NVmem device is missing or otherwise unusable
1492  */
1493 static int bge_nvmem_acquire(bge_t *bgep);
1494 #pragma	no_inline(bge_nvmem_acquire)
1495 
1496 static int
1497 bge_nvmem_acquire(bge_t *bgep)
1498 {
1499 	uint32_t regval;
1500 	uint32_t tries;
1501 
1502 	ASSERT(mutex_owned(bgep->genlock));
1503 
1504 	switch (bgep->chipid.nvtype) {
1505 	case BGE_NVTYPE_NONE:
1506 	case BGE_NVTYPE_UNKNOWN:
1507 		/*
1508 		 * Access denied: no (recognisable) device fitted
1509 		 */
1510 		return (ENODEV);
1511 
1512 	case BGE_NVTYPE_SEEPROM:
1513 		/*
1514 		 * Access granted: no arbitration needed (or possible)
1515 		 */
1516 		return (0);
1517 
1518 	case BGE_NVTYPE_LEGACY_SEEPROM:
1519 	case BGE_NVTYPE_UNBUFFERED_FLASH:
1520 	case BGE_NVTYPE_BUFFERED_FLASH:
1521 	default:
1522 		/*
1523 		 * Access conditional: conduct arbitration protocol
1524 		 */
1525 		break;
1526 	}
1527 
1528 	/*
1529 	 * We're holding the per-port mutex <genlock>, so no-one other
1530 	 * threads can be attempting to access the NVmem through *this*
1531 	 * port. But it could be in use by the *other* port (of a 5704),
1532 	 * or by the chip's internal firmware, so we have to go through
1533 	 * the full (hardware) arbitration protocol ...
1534 	 *
1535 	 * Note that *because* we're holding <genlock>, the interrupt handler
1536 	 * won't be able to progress.  So we're only willing to spin for a
1537 	 * fairly short time.  Specifically:
1538 	 *
1539 	 *	We *must* wait long enough for the hardware to resolve all
1540 	 *	requests and determine the winner.  Fortunately, this is
1541 	 *	"almost instantaneous", even as observed by GHz CPUs.
1542 	 *
1543 	 *	A successful access by another Solaris thread (via either
1544 	 *	port) typically takes ~20us.  So waiting a bit longer than
1545 	 *	that will give a good chance of success, if the other user
1546 	 *	*is* another thread on the other port.
1547 	 *
1548 	 *	However, the internal firmware can hold on to the NVmem
1549 	 *	for *much* longer: at least 10 milliseconds just after a
1550 	 *	RESET, and maybe even longer if the NVmem actually contains
1551 	 *	code to download and run on the internal CPUs.
1552 	 *
1553 	 * So, we'll allow 50us; if that's not enough then it's up to the
1554 	 * caller to retry later (hence the choice of return code EAGAIN).
1555 	 */
1556 	regval = bge_reg_get32(bgep, NVM_SW_ARBITRATION_REG);
1557 	bge_reg_put32(bgep, NVM_SW_ARBITRATION_REG, NVM_SET_REQ);
1558 
1559 	for (tries = 0; tries < 50; ++tries) {
1560 		regval = bge_reg_get32(bgep, NVM_SW_ARBITRATION_REG);
1561 		if (regval & NVM_WON_REQ1)
1562 			break;
1563 		drv_usecwait(1);
1564 	}
1565 
1566 	if (regval & NVM_WON_REQ1) {
1567 		BGE_DEBUG(("bge_nvmem_acquire: won after %d us", tries));
1568 		return (0);
1569 	}
1570 
1571 	/*
1572 	 * Somebody else must be accessing the NVmem, so abandon our
1573 	 * attempt take control of it.  The caller can try again later ...
1574 	 */
1575 	BGE_DEBUG(("bge_nvmem_acquire: lost after %d us", tries));
1576 	bge_nvmem_relinquish(bgep);
1577 	return (EAGAIN);
1578 }
1579 
1580 /*
1581  * This code assumes that the GPIO1 bit has been wired up to the NVmem
1582  * write protect line in such a way that the NVmem is protected when
1583  * GPIO1 is an input, or is an output but driven high.  Thus, to make the
1584  * NVmem writable we have to change GPIO1 to an output AND drive it low.
1585  *
1586  * Note: there's only one set of GPIO pins on a 5704, even though they
1587  * can be accessed through either port.  So the chip has to resolve what
1588  * happens if the two ports program a single pin differently ... the rule
1589  * it uses is that if the ports disagree about the *direction* of a pin,
1590  * "output" wins over "input", but if they disagree about its *value* as
1591  * an output, then the pin is TRISTATED instead!  In such a case, no-one
1592  * wins, and the external signal does whatever the external circuitry
1593  * defines as the default -- which we've assumed is the PROTECTED state.
1594  * So, we always change GPIO1 back to being an *input* whenever we're not
1595  * specifically using it to unprotect the NVmem. This allows either port
1596  * to update the NVmem, although obviously only one at a a time!
1597  *
1598  * The caller should hold <genlock> and *also* have already acquired the
1599  * right to access the NVmem, via bge_nvmem_acquire() above.
1600  */
1601 static void bge_nvmem_protect(bge_t *bgep, boolean_t protect);
1602 #pragma	inline(bge_nvmem_protect)
1603 
1604 static void
1605 bge_nvmem_protect(bge_t *bgep, boolean_t protect)
1606 {
1607 	uint32_t regval;
1608 
1609 	ASSERT(mutex_owned(bgep->genlock));
1610 
1611 	regval = bge_reg_get32(bgep, MISC_LOCAL_CONTROL_REG);
1612 	if (protect) {
1613 		regval |= MLCR_MISC_PINS_OUTPUT_1;
1614 		regval &= ~MLCR_MISC_PINS_OUTPUT_ENABLE_1;
1615 	} else {
1616 		regval &= ~MLCR_MISC_PINS_OUTPUT_1;
1617 		regval |= MLCR_MISC_PINS_OUTPUT_ENABLE_1;
1618 	}
1619 	bge_reg_put32(bgep, MISC_LOCAL_CONTROL_REG, regval);
1620 }
1621 
1622 /*
1623  * Now put it all together ...
1624  *
1625  * Try to acquire control of the NVmem; if successful, then:
1626  *	unprotect it (if we want to write to it)
1627  *	perform the requested access
1628  *	reprotect it (after a write)
1629  *	relinquish control
1630  *
1631  * Return value:
1632  *	0 on success,
1633  *	EAGAIN if the device is in use (retryable)
1634  *	ENODATA on access timeout (maybe retryable: device may just be busy)
1635  *	ENODEV if the NVmem device is missing or otherwise unusable
1636  *	EPROTO on other h/w or s/w errors.
1637  */
1638 static int
1639 bge_nvmem_rw32(bge_t *bgep, uint32_t cmd, bge_regno_t addr, uint32_t *dp)
1640 {
1641 	int err;
1642 
1643 	if ((err = bge_nvmem_acquire(bgep)) == 0) {
1644 		switch (cmd) {
1645 		case BGE_SEE_READ:
1646 			err = bge_seeprom_access(bgep,
1647 			    SEEPROM_ACCESS_READ, addr, dp);
1648 			break;
1649 
1650 		case BGE_SEE_WRITE:
1651 			bge_nvmem_protect(bgep, B_FALSE);
1652 			err = bge_seeprom_access(bgep,
1653 			    SEEPROM_ACCESS_WRITE, addr, dp);
1654 			bge_nvmem_protect(bgep, B_TRUE);
1655 			break;
1656 
1657 		case BGE_FLASH_READ:
1658 			if (DEVICE_5721_SERIES_CHIPSETS(bgep) ||
1659 			    DEVICE_5714_SERIES_CHIPSETS(bgep)) {
1660 				bge_reg_set32(bgep, NVM_ACCESS_REG,
1661 				    NVM_ACCESS_ENABLE);
1662 			}
1663 			err = bge_flash_access(bgep,
1664 			    NVM_FLASH_CMD_RD, addr, dp);
1665 			if (DEVICE_5721_SERIES_CHIPSETS(bgep) ||
1666 			    DEVICE_5714_SERIES_CHIPSETS(bgep)) {
1667 				bge_reg_clr32(bgep, NVM_ACCESS_REG,
1668 				    NVM_ACCESS_ENABLE);
1669 			}
1670 			break;
1671 
1672 		case BGE_FLASH_WRITE:
1673 			if (DEVICE_5721_SERIES_CHIPSETS(bgep) ||
1674 			    DEVICE_5714_SERIES_CHIPSETS(bgep)) {
1675 				bge_reg_set32(bgep, NVM_ACCESS_REG,
1676 				    NVM_WRITE_ENABLE|NVM_ACCESS_ENABLE);
1677 			}
1678 			bge_nvmem_protect(bgep, B_FALSE);
1679 			err = bge_flash_access(bgep,
1680 			    NVM_FLASH_CMD_WR, addr, dp);
1681 			bge_nvmem_protect(bgep, B_TRUE);
1682 			if (DEVICE_5721_SERIES_CHIPSETS(bgep) ||
1683 			    DEVICE_5714_SERIES_CHIPSETS(bgep)) {
1684 				bge_reg_clr32(bgep, NVM_ACCESS_REG,
1685 				    NVM_WRITE_ENABLE|NVM_ACCESS_ENABLE);
1686 			}
1687 
1688 			break;
1689 
1690 		default:
1691 			_NOTE(NOTREACHED)
1692 			break;
1693 		}
1694 		bge_nvmem_relinquish(bgep);
1695 	}
1696 
1697 	BGE_DEBUG(("bge_nvmem_rw32: err %d", err));
1698 	return (err);
1699 }
1700 
1701 /*
1702  * Attempt to get a MAC address from the SEEPROM or Flash, if any
1703  */
1704 static uint64_t bge_get_nvmac(bge_t *bgep);
1705 #pragma no_inline(bge_get_nvmac)
1706 
1707 static uint64_t
1708 bge_get_nvmac(bge_t *bgep)
1709 {
1710 	uint32_t mac_high;
1711 	uint32_t mac_low;
1712 	uint32_t addr;
1713 	uint32_t cmd;
1714 	uint64_t mac;
1715 
1716 	BGE_TRACE(("bge_get_nvmac($%p)",
1717 		(void *)bgep));
1718 
1719 	switch (bgep->chipid.nvtype) {
1720 	case BGE_NVTYPE_NONE:
1721 	case BGE_NVTYPE_UNKNOWN:
1722 	default:
1723 		return (0ULL);
1724 
1725 	case BGE_NVTYPE_SEEPROM:
1726 	case BGE_NVTYPE_LEGACY_SEEPROM:
1727 		cmd = BGE_SEE_READ;
1728 		break;
1729 
1730 	case BGE_NVTYPE_UNBUFFERED_FLASH:
1731 	case BGE_NVTYPE_BUFFERED_FLASH:
1732 		cmd = BGE_FLASH_READ;
1733 		break;
1734 	}
1735 
1736 	addr = NVMEM_DATA_MAC_ADDRESS;
1737 	if (bge_nvmem_rw32(bgep, cmd, addr, &mac_high))
1738 		return (0ULL);
1739 	addr += 4;
1740 	if (bge_nvmem_rw32(bgep, cmd, addr, &mac_low))
1741 		return (0ULL);
1742 
1743 	/*
1744 	 * The Broadcom chip is natively BIG-endian, so that's how the
1745 	 * MAC address is represented in NVmem.  We may need to swap it
1746 	 * around on a little-endian host ...
1747 	 */
1748 #ifdef	_BIG_ENDIAN
1749 	mac = mac_high;
1750 	mac = mac << 32;
1751 	mac |= mac_low;
1752 #else
1753 	mac = BGE_BSWAP_32(mac_high);
1754 	mac = mac << 32;
1755 	mac |= BGE_BSWAP_32(mac_low);
1756 #endif	/* _BIG_ENDIAN */
1757 
1758 	return (mac);
1759 }
1760 
1761 #else	/* BGE_SEE_IO32 || BGE_FLASH_IO32 */
1762 
1763 /*
1764  * Dummy version for when we're not supporting NVmem access
1765  */
1766 static uint64_t bge_get_nvmac(bge_t *bgep);
1767 #pragma inline(bge_get_nvmac)
1768 
1769 static uint64_t
1770 bge_get_nvmac(bge_t *bgep)
1771 {
1772 	_NOTE(ARGUNUSED(bgep))
1773 	return (0ULL);
1774 }
1775 
1776 #endif	/* BGE_SEE_IO32 || BGE_FLASH_IO32 */
1777 
1778 /*
1779  * Determine the type of NVmem that is (or may be) attached to this chip,
1780  */
1781 static enum bge_nvmem_type bge_nvmem_id(bge_t *bgep);
1782 #pragma no_inline(bge_nvmem_id)
1783 
1784 static enum bge_nvmem_type
1785 bge_nvmem_id(bge_t *bgep)
1786 {
1787 	enum bge_nvmem_type nvtype;
1788 	uint32_t config1;
1789 
1790 	BGE_TRACE(("bge_nvmem_id($%p)",
1791 		(void *)bgep));
1792 
1793 	switch (bgep->chipid.device) {
1794 	default:
1795 		/*
1796 		 * We shouldn't get here; it means we don't recognise
1797 		 * the chip, which means we don't know how to determine
1798 		 * what sort of NVmem (if any) it has.  So we'll say
1799 		 * NONE, to disable the NVmem access code ...
1800 		 */
1801 		nvtype = BGE_NVTYPE_NONE;
1802 		break;
1803 
1804 	case DEVICE_ID_5700:
1805 	case DEVICE_ID_5700x:
1806 	case DEVICE_ID_5701:
1807 		/*
1808 		 * These devices support *only* SEEPROMs
1809 		 */
1810 		nvtype = BGE_NVTYPE_SEEPROM;
1811 		break;
1812 
1813 	case DEVICE_ID_5702:
1814 	case DEVICE_ID_5702fe:
1815 	case DEVICE_ID_5703C:
1816 	case DEVICE_ID_5703S:
1817 	case DEVICE_ID_5704C:
1818 	case DEVICE_ID_5704S:
1819 	case DEVICE_ID_5704:
1820 	case DEVICE_ID_5705M:
1821 	case DEVICE_ID_5705C:
1822 	case DEVICE_ID_5706:
1823 	case DEVICE_ID_5782:
1824 	case DEVICE_ID_5788:
1825 	case DEVICE_ID_5751:
1826 	case DEVICE_ID_5751M:
1827 	case DEVICE_ID_5721:
1828 	case DEVICE_ID_5714C:
1829 	case DEVICE_ID_5714S:
1830 	case DEVICE_ID_5715C:
1831 		config1 = bge_reg_get32(bgep, NVM_CONFIG1_REG);
1832 		if (config1 & NVM_CFG1_FLASH_MODE)
1833 			if (config1 & NVM_CFG1_BUFFERED_MODE)
1834 				nvtype = BGE_NVTYPE_BUFFERED_FLASH;
1835 			else
1836 				nvtype = BGE_NVTYPE_UNBUFFERED_FLASH;
1837 		else
1838 			nvtype = BGE_NVTYPE_LEGACY_SEEPROM;
1839 		break;
1840 	}
1841 
1842 	return (nvtype);
1843 }
1844 
1845 #undef	BGE_DBG
1846 #define	BGE_DBG		BGE_DBG_CHIP	/* debug flag for this code	*/
1847 
1848 static void
1849 bge_init_recv_rule(bge_t *bgep)
1850 {
1851 	bge_recv_rule_t *rulep;
1852 	uint32_t i;
1853 
1854 	/*
1855 	 * receive rule: direct all TCP traffic to ring RULE_MATCH_TO_RING
1856 	 * 1. to direct UDP traffic, set:
1857 	 * 	rulep->control = RULE_PROTO_CONTROL;
1858 	 * 	rulep->mask_value = RULE_UDP_MASK_VALUE;
1859 	 * 2. to direct ICMP traffic, set:
1860 	 * 	rulep->control = RULE_PROTO_CONTROL;
1861 	 * 	rulep->mask_value = RULE_ICMP_MASK_VALUE;
1862 	 * 3. to direct traffic by source ip, set:
1863 	 * 	rulep->control = RULE_SIP_CONTROL;
1864 	 * 	rulep->mask_value = RULE_SIP_MASK_VALUE;
1865 	 */
1866 	rulep = bgep->recv_rules;
1867 	rulep->control = RULE_PROTO_CONTROL;
1868 	rulep->mask_value = RULE_TCP_MASK_VALUE;
1869 
1870 	/*
1871 	 * set receive rule registers
1872 	 */
1873 	rulep = bgep->recv_rules;
1874 	for (i = 0; i < RECV_RULES_NUM_MAX; i++, rulep++) {
1875 		bge_reg_put32(bgep, RECV_RULE_MASK_REG(i), rulep->mask_value);
1876 		bge_reg_put32(bgep, RECV_RULE_CONTROL_REG(i), rulep->control);
1877 	}
1878 }
1879 
1880 /*
1881  * Using the values captured by bge_chip_cfg_init(), and additional probes
1882  * as required, characterise the chip fully: determine the label by which
1883  * to refer to this chip, the correct settings for various registers, and
1884  * of course whether the device and/or subsystem are supported!
1885  */
1886 int bge_chip_id_init(bge_t *bgep);
1887 #pragma	no_inline(bge_chip_id_init)
1888 
1889 int
1890 bge_chip_id_init(bge_t *bgep)
1891 {
1892 	char buf[MAXPATHLEN];		/* any risk of stack overflow?	*/
1893 	boolean_t sys_ok;
1894 	boolean_t dev_ok;
1895 	chip_id_t *cidp;
1896 	uint32_t subid;
1897 	char *devname;
1898 	char *sysname;
1899 	int *ids;
1900 	int err;
1901 	uint_t i;
1902 
1903 	ASSERT(bgep->bge_chip_state == BGE_CHIP_INITIAL);
1904 
1905 	sys_ok = dev_ok = B_FALSE;
1906 	cidp = &bgep->chipid;
1907 
1908 	/*
1909 	 * Check the PCI device ID to determine the generic chip type and
1910 	 * select parameters that depend on this.
1911 	 *
1912 	 * Note: because the SPARC platforms in general don't fit the
1913 	 * SEEPROM 'behind' the chip, the PCI revision ID register reads
1914 	 * as zero - which is why we use <asic_rev> rather than <revision>
1915 	 * below ...
1916 	 *
1917 	 * Note: in general we can't distinguish between the Copper/SerDes
1918 	 * versions by ID alone, as some Copper devices (e.g. some but not
1919 	 * all 5703Cs) have the same ID as the SerDes equivalents.  So we
1920 	 * treat them the same here, and the MII code works out the media
1921 	 * type later on ...
1922 	 */
1923 	cidp->mbuf_base = bge_mbuf_pool_base;
1924 	cidp->mbuf_length = bge_mbuf_pool_len;
1925 	cidp->recv_slots = BGE_RECV_SLOTS_USED;
1926 	cidp->bge_dma_rwctrl = bge_dma_rwctrl;
1927 	cidp->pci_type = BGE_PCI_X;
1928 	cidp->statistic_type = BGE_STAT_BLK;
1929 	cidp->mbuf_lo_water_rdma = bge_mbuf_lo_water_rdma;
1930 	cidp->mbuf_lo_water_rmac = bge_mbuf_lo_water_rmac;
1931 	cidp->mbuf_hi_water = bge_mbuf_hi_water;
1932 
1933 	if (cidp->rx_rings == 0 || cidp->rx_rings > BGE_RECV_RINGS_MAX)
1934 		cidp->rx_rings = BGE_RECV_RINGS_DEFAULT;
1935 	if (cidp->tx_rings == 0 || cidp->tx_rings > BGE_SEND_RINGS_MAX)
1936 		cidp->tx_rings = BGE_SEND_RINGS_DEFAULT;
1937 
1938 	cidp->msi_enabled = B_FALSE;
1939 
1940 	switch (cidp->device) {
1941 	case DEVICE_ID_5700:
1942 	case DEVICE_ID_5700x:
1943 		cidp->chip_label = 5700;
1944 		cidp->flags |= CHIP_FLAG_NO_CSUM;
1945 		break;
1946 
1947 	case DEVICE_ID_5701:
1948 		cidp->chip_label = 5701;
1949 		dev_ok = B_TRUE;
1950 		cidp->flags |= CHIP_FLAG_NO_CSUM;
1951 		break;
1952 
1953 	case DEVICE_ID_5702:
1954 	case DEVICE_ID_5702fe:
1955 		cidp->chip_label = 5702;
1956 		dev_ok = B_TRUE;
1957 		cidp->flags |= CHIP_FLAG_NO_CSUM;	/* for now	*/
1958 		break;
1959 
1960 	case DEVICE_ID_5703C:
1961 	case DEVICE_ID_5703S:
1962 	case DEVICE_ID_5703:
1963 		/*
1964 		 * Revision A0 of the 5703/5793 had various errata
1965 		 * that we can't or don't work around, so it's not
1966 		 * supported, but all later versions are
1967 		 */
1968 		cidp->chip_label = cidp->subven == VENDOR_ID_SUN ? 5793 : 5703;
1969 		if (bgep->chipid.asic_rev != MHCR_CHIP_REV_5703_A0)
1970 			dev_ok = B_TRUE;
1971 		break;
1972 
1973 	case DEVICE_ID_5704C:
1974 	case DEVICE_ID_5704S:
1975 	case DEVICE_ID_5704:
1976 		/*
1977 		 * Revision A0 of the 5704/5794 had various errata
1978 		 * but we have workarounds, so it *is* supported.
1979 		 */
1980 		cidp->chip_label = cidp->subven == VENDOR_ID_SUN ? 5794 : 5704;
1981 		cidp->mbuf_base = bge_mbuf_pool_base_5704;
1982 		cidp->mbuf_length = bge_mbuf_pool_len_5704;
1983 		dev_ok = B_TRUE;
1984 		break;
1985 
1986 	case DEVICE_ID_5705C:
1987 	case DEVICE_ID_5705M:
1988 	case DEVICE_ID_5705MA3:
1989 	case DEVICE_ID_5705F:
1990 		cidp->chip_label = 5705;
1991 		cidp->mbuf_lo_water_rdma = RDMA_MBUF_LOWAT_5705;
1992 		cidp->mbuf_lo_water_rmac = MAC_RX_MBUF_LOWAT_5705;
1993 		cidp->mbuf_hi_water = MBUF_HIWAT_5705;
1994 		cidp->mbuf_base = bge_mbuf_pool_base_5705;
1995 		cidp->mbuf_length = bge_mbuf_pool_len_5705;
1996 		cidp->recv_slots = BGE_RECV_SLOTS_5705;
1997 		cidp->rx_rings = BGE_RECV_RINGS_MAX_5705;
1998 		cidp->tx_rings = BGE_SEND_RINGS_MAX_5705;
1999 		cidp->flags |= CHIP_FLAG_NO_JUMBO;
2000 		cidp->statistic_type = BGE_STAT_REG;
2001 		dev_ok = B_TRUE;
2002 		break;
2003 
2004 	case DEVICE_ID_5706:
2005 		cidp->chip_label = 5706;
2006 		cidp->flags |= CHIP_FLAG_NO_JUMBO;
2007 		cidp->flags |= CHIP_FLAG_NO_CSUM;	/* for now	*/
2008 		break;
2009 
2010 	case DEVICE_ID_5782:
2011 		/*
2012 		 * Apart from the label, we treat this as a 5705(?)
2013 		 */
2014 		cidp->chip_label = 5782;
2015 		cidp->mbuf_lo_water_rdma = RDMA_MBUF_LOWAT_5705;
2016 		cidp->mbuf_lo_water_rmac = MAC_RX_MBUF_LOWAT_5705;
2017 		cidp->mbuf_hi_water = MBUF_HIWAT_5705;
2018 		cidp->mbuf_base = bge_mbuf_pool_base_5705;
2019 		cidp->mbuf_length = bge_mbuf_pool_len_5705;
2020 		cidp->recv_slots = BGE_RECV_SLOTS_5705;
2021 		cidp->rx_rings = BGE_RECV_RINGS_MAX_5705;
2022 		cidp->tx_rings = BGE_SEND_RINGS_MAX_5705;
2023 		cidp->flags |= CHIP_FLAG_NO_JUMBO;
2024 		cidp->statistic_type = BGE_STAT_REG;
2025 		dev_ok = B_TRUE;
2026 		break;
2027 
2028 	case DEVICE_ID_5788:
2029 		/*
2030 		 * Apart from the label, we treat this as a 5705(?)
2031 		 */
2032 		cidp->chip_label = 5788;
2033 		cidp->mbuf_lo_water_rdma = RDMA_MBUF_LOWAT_5705;
2034 		cidp->mbuf_lo_water_rmac = MAC_RX_MBUF_LOWAT_5705;
2035 		cidp->mbuf_hi_water = MBUF_HIWAT_5705;
2036 		cidp->mbuf_base = bge_mbuf_pool_base_5705;
2037 		cidp->mbuf_length = bge_mbuf_pool_len_5705;
2038 		cidp->recv_slots = BGE_RECV_SLOTS_5705;
2039 		cidp->rx_rings = BGE_RECV_RINGS_MAX_5705;
2040 		cidp->tx_rings = BGE_SEND_RINGS_MAX_5705;
2041 		cidp->statistic_type = BGE_STAT_REG;
2042 		cidp->flags |= CHIP_FLAG_NO_JUMBO;
2043 		dev_ok = B_TRUE;
2044 		break;
2045 
2046 	case DEVICE_ID_5714C:
2047 		if (cidp->revision >= REVISION_ID_5714_A2)
2048 			cidp->msi_enabled = bge_enable_msi;
2049 		/* FALLTHRU */
2050 	case DEVICE_ID_5714S:
2051 		cidp->chip_label = 5714;
2052 		cidp->mbuf_lo_water_rdma = RDMA_MBUF_LOWAT_5705;
2053 		cidp->mbuf_lo_water_rmac = MAC_RX_MBUF_LOWAT_5705;
2054 		cidp->mbuf_hi_water = MBUF_HIWAT_5705;
2055 		cidp->mbuf_base = bge_mbuf_pool_base_5721;
2056 		cidp->mbuf_length = bge_mbuf_pool_len_5721;
2057 		cidp->recv_slots = BGE_RECV_SLOTS_5721;
2058 		cidp->bge_dma_rwctrl = bge_dma_rwctrl_5714;
2059 		cidp->bge_mlcr_default = bge_mlcr_default_5714;
2060 		cidp->rx_rings = BGE_RECV_RINGS_MAX_5705;
2061 		cidp->tx_rings = BGE_SEND_RINGS_MAX_5705;
2062 		cidp->pci_type = BGE_PCI_E;
2063 		cidp->statistic_type = BGE_STAT_REG;
2064 		dev_ok = B_TRUE;
2065 		break;
2066 
2067 	case DEVICE_ID_5715C:
2068 		cidp->chip_label = 5715;
2069 		cidp->mbuf_lo_water_rdma = RDMA_MBUF_LOWAT_5705;
2070 		cidp->mbuf_lo_water_rmac = MAC_RX_MBUF_LOWAT_5705;
2071 		cidp->mbuf_hi_water = MBUF_HIWAT_5705;
2072 		cidp->mbuf_base = bge_mbuf_pool_base_5721;
2073 		cidp->mbuf_length = bge_mbuf_pool_len_5721;
2074 		cidp->recv_slots = BGE_RECV_SLOTS_5721;
2075 		cidp->bge_dma_rwctrl = bge_dma_rwctrl_5715;
2076 		cidp->bge_mlcr_default = bge_mlcr_default_5714;
2077 		cidp->rx_rings = BGE_RECV_RINGS_MAX_5705;
2078 		cidp->tx_rings = BGE_SEND_RINGS_MAX_5705;
2079 		cidp->pci_type = BGE_PCI_E;
2080 		cidp->statistic_type = BGE_STAT_REG;
2081 		if (cidp->revision >= REVISION_ID_5715_A2)
2082 			cidp->msi_enabled = bge_enable_msi;
2083 		dev_ok = B_TRUE;
2084 		break;
2085 
2086 	case DEVICE_ID_5721:
2087 		cidp->chip_label = 5721;
2088 		cidp->mbuf_lo_water_rdma = RDMA_MBUF_LOWAT_5705;
2089 		cidp->mbuf_lo_water_rmac = MAC_RX_MBUF_LOWAT_5705;
2090 		cidp->mbuf_hi_water = MBUF_HIWAT_5705;
2091 		cidp->mbuf_base = bge_mbuf_pool_base_5721;
2092 		cidp->mbuf_length = bge_mbuf_pool_len_5721;
2093 		cidp->recv_slots = BGE_RECV_SLOTS_5721;
2094 		cidp->bge_dma_rwctrl = bge_dma_rwctrl_5721;
2095 		cidp->rx_rings = BGE_RECV_RINGS_MAX_5705;
2096 		cidp->tx_rings = BGE_SEND_RINGS_MAX_5705;
2097 		cidp->pci_type = BGE_PCI_E;
2098 		cidp->statistic_type = BGE_STAT_REG;
2099 		cidp->flags |= CHIP_FLAG_NO_JUMBO;
2100 		dev_ok = B_TRUE;
2101 		break;
2102 
2103 	case DEVICE_ID_5751:
2104 	case DEVICE_ID_5751M:
2105 		cidp->chip_label = 5751;
2106 		cidp->mbuf_lo_water_rdma = RDMA_MBUF_LOWAT_5705;
2107 		cidp->mbuf_lo_water_rmac = MAC_RX_MBUF_LOWAT_5705;
2108 		cidp->mbuf_hi_water = MBUF_HIWAT_5705;
2109 		cidp->mbuf_base = bge_mbuf_pool_base_5721;
2110 		cidp->mbuf_length = bge_mbuf_pool_len_5721;
2111 		cidp->recv_slots = BGE_RECV_SLOTS_5721;
2112 		cidp->bge_dma_rwctrl = bge_dma_rwctrl_5721;
2113 		cidp->rx_rings = BGE_RECV_RINGS_MAX_5705;
2114 		cidp->tx_rings = BGE_SEND_RINGS_MAX_5705;
2115 		cidp->pci_type = BGE_PCI_E;
2116 		cidp->statistic_type = BGE_STAT_REG;
2117 		cidp->flags |= CHIP_FLAG_NO_JUMBO;
2118 		dev_ok = B_TRUE;
2119 		break;
2120 
2121 	}
2122 
2123 	/*
2124 	 * Setup the default jumbo parameter.
2125 	 */
2126 	cidp->ethmax_size = ETHERMAX;
2127 	cidp->snd_buff_size = BGE_SEND_BUFF_SIZE_DEFAULT;
2128 	cidp->std_buf_size = BGE_STD_BUFF_SIZE;
2129 
2130 	/*
2131 	 * If jumbo is enabled and this kind of chipset supports jumbo feature,
2132 	 * setup below jumbo specific parameters.
2133 	 *
2134 	 * For BCM5714/5715, there is only one standard receive ring. So the
2135 	 * std buffer size should be set to BGE_JUMBO_BUFF_SIZE when jumbo
2136 	 * feature is enabled.
2137 	 */
2138 	if (bge_jumbo_enable &&
2139 	    !(cidp->flags & CHIP_FLAG_NO_JUMBO) &&
2140 	    (cidp->default_mtu > BGE_DEFAULT_MTU) &&
2141 	    (cidp->default_mtu <= BGE_MAXIMUM_MTU)) {
2142 	    if (DEVICE_5714_SERIES_CHIPSETS(bgep)) {
2143 			cidp->mbuf_lo_water_rdma =
2144 			    RDMA_MBUF_LOWAT_5714_JUMBO;
2145 			cidp->mbuf_lo_water_rmac =
2146 			    MAC_RX_MBUF_LOWAT_5714_JUMBO;
2147 			cidp->mbuf_hi_water = MBUF_HIWAT_5714_JUMBO;
2148 			cidp->jumbo_slots = 0;
2149 			cidp->std_buf_size = BGE_JUMBO_BUFF_SIZE;
2150 	    } else {
2151 			cidp->mbuf_lo_water_rdma =
2152 			    RDMA_MBUF_LOWAT_JUMBO;
2153 			cidp->mbuf_lo_water_rmac =
2154 			    MAC_RX_MBUF_LOWAT_JUMBO;
2155 			cidp->mbuf_hi_water = MBUF_HIWAT_JUMBO;
2156 			cidp->jumbo_slots = BGE_JUMBO_SLOTS_USED;
2157 		}
2158 		cidp->recv_jumbo_size = BGE_JUMBO_BUFF_SIZE;
2159 		cidp->snd_buff_size = BGE_SEND_BUFF_SIZE_JUMBO;
2160 		cidp->ethmax_size = cidp->default_mtu +
2161 		    sizeof (struct ether_header);
2162 	}
2163 
2164 	/*
2165 	 * Identify the NV memory type: SEEPROM or Flash?
2166 	 */
2167 	cidp->nvtype = bge_nvmem_id(bgep);
2168 
2169 	/*
2170 	 * Now, we want to check whether this device is part of a
2171 	 * supported subsystem (e.g., on the motherboard of a Sun
2172 	 * branded platform).
2173 	 *
2174 	 * Rule 1: If the Subsystem Vendor ID is "Sun", then it's OK ;-)
2175 	 */
2176 	if (cidp->subven == VENDOR_ID_SUN)
2177 		sys_ok = B_TRUE;
2178 
2179 	/*
2180 	 * Rule 2: If it's on the list on known subsystems, then it's OK.
2181 	 * Note: 0x14e41647 should *not* appear in the list, but the code
2182 	 * doesn't enforce that.
2183 	 */
2184 	err = ddi_prop_lookup_int_array(DDI_DEV_T_ANY, bgep->devinfo,
2185 		DDI_PROP_DONTPASS, knownids_propname, &ids, &i);
2186 	if (err == DDI_PROP_SUCCESS) {
2187 		/*
2188 		 * Got the list; scan for a matching subsystem vendor/device
2189 		 */
2190 		subid = (cidp->subven << 16) | cidp->subdev;
2191 		while (i--)
2192 			if (ids[i] == subid)
2193 				sys_ok = B_TRUE;
2194 		ddi_prop_free(ids);
2195 	}
2196 
2197 	/*
2198 	 * Rule 3: If it's a Taco/ENWS motherboard device, then it's OK
2199 	 *
2200 	 * Unfortunately, early SunBlade 1500s and 2500s didn't reprogram
2201 	 * the Subsystem Vendor ID, so it defaults to Broadcom.  Therefore,
2202 	 * we have to check specially for the exact device paths to the
2203 	 * motherboard devices on those platforms ;-(
2204 	 *
2205 	 * Note: we can't just use the "supported-subsystems" mechanism
2206 	 * above, because the entry would have to be 0x14e41647 -- which
2207 	 * would then accept *any* plugin card that *didn't* contain a
2208 	 * (valid) SEEPROM ;-(
2209 	 */
2210 	sysname = ddi_node_name(ddi_root_node());
2211 	devname = ddi_pathname(bgep->devinfo, buf);
2212 	ASSERT(strlen(devname) > 0);
2213 	if (strcmp(sysname, "SUNW,Sun-Blade-1500") == 0)	/* Taco */
2214 		if (strcmp(devname, "/pci@1f,700000/network@2") == 0)
2215 			sys_ok = B_TRUE;
2216 	if (strcmp(sysname, "SUNW,Sun-Blade-2500") == 0)	/* ENWS */
2217 		if (strcmp(devname, "/pci@1c,600000/network@3") == 0)
2218 			sys_ok = B_TRUE;
2219 
2220 	/*
2221 	 * Now check what we've discovered: is this truly a supported
2222 	 * chip on (the motherboard of) a supported platform?
2223 	 *
2224 	 * Possible problems here:
2225 	 * 1)	it's a completely unheard-of chip (e.g. 5761)
2226 	 * 2)	it's a recognised but unsupported chip (e.g. 5701, 5703C-A0)
2227 	 * 3)	it's a chip we would support if it were on the motherboard
2228 	 *	of a Sun platform, but this one isn't ;-(
2229 	 */
2230 	if (cidp->chip_label == 0)
2231 		bge_problem(bgep,
2232 			"Device 'pci%04x,%04x' not recognized (%d?)",
2233 			cidp->vendor, cidp->device, cidp->device);
2234 	else if (!dev_ok)
2235 		bge_problem(bgep,
2236 			"Device 'pci%04x,%04x' (%d) revision %d not supported",
2237 			cidp->vendor, cidp->device, cidp->chip_label,
2238 			cidp->revision);
2239 #if	BGE_DEBUGGING
2240 	else if (!sys_ok)
2241 		bge_problem(bgep,
2242 			"%d-based subsystem 'pci%04x,%04x' not validated",
2243 			cidp->chip_label, cidp->subven, cidp->subdev);
2244 #endif
2245 	else
2246 		cidp->flags |= CHIP_FLAG_SUPPORTED;
2247 	if (bge_check_acc_handle(bgep, bgep->io_handle) != DDI_FM_OK)
2248 		return (EIO);
2249 	return (0);
2250 }
2251 
2252 void
2253 bge_chip_msi_trig(bge_t *bgep)
2254 {
2255 	uint32_t	regval;
2256 
2257 	regval = bgep->param_msi_cnt<<4;
2258 	bge_reg_set32(bgep, HOST_COALESCE_MODE_REG, regval);
2259 	BGE_DEBUG(("bge_chip_msi_trig:data = %d", regval));
2260 }
2261 
2262 /*
2263  * Various registers that control the chip's internal engines (state
2264  * machines) have a <reset> and <enable> bits (fortunately, in the
2265  * same place in each such register :-).
2266  *
2267  * To reset the state machine, the <reset> bit must be written with 1;
2268  * it will then read back as 1 while the reset is in progress, but
2269  * self-clear to 0 when the reset completes.
2270  *
2271  * To enable a state machine, one must set the <enable> bit, which
2272  * will continue to read back as 0 until the state machine is running.
2273  *
2274  * To disable a state machine, the <enable> bit must be cleared, but
2275  * it will continue to read back as 1 until the state machine actually
2276  * stops.
2277  *
2278  * This routine implements polling for completion of a reset, enable
2279  * or disable operation, returning B_TRUE on success (bit reached the
2280  * required state) or B_FALSE on timeout (200*100us == 20ms).
2281  */
2282 static boolean_t bge_chip_poll_engine(bge_t *bgep, bge_regno_t regno,
2283 					uint32_t mask, uint32_t val);
2284 #pragma	no_inline(bge_chip_poll_engine)
2285 
2286 static boolean_t
2287 bge_chip_poll_engine(bge_t *bgep, bge_regno_t regno,
2288 	uint32_t mask, uint32_t val)
2289 {
2290 	uint32_t regval;
2291 	uint32_t n;
2292 
2293 	BGE_TRACE(("bge_chip_poll_engine($%p, 0x%lx, 0x%x, 0x%x)",
2294 		(void *)bgep, regno, mask, val));
2295 
2296 	for (n = 200; n; --n) {
2297 		regval = bge_reg_get32(bgep, regno);
2298 		if ((regval & mask) == val)
2299 			return (B_TRUE);
2300 		drv_usecwait(100);
2301 	}
2302 
2303 	bge_fm_ereport(bgep, DDI_FM_DEVICE_NO_RESPONSE);
2304 	return (B_FALSE);
2305 }
2306 
2307 /*
2308  * Various registers that control the chip's internal engines (state
2309  * machines) have a <reset> bit (fortunately, in the same place in
2310  * each such register :-).  To reset the state machine, this bit must
2311  * be written with 1; it will then read back as 1 while the reset is
2312  * in progress, but self-clear to 0 when the reset completes.
2313  *
2314  * This code sets the bit, then polls for it to read back as zero.
2315  * The return value is B_TRUE on success (reset bit cleared itself),
2316  * or B_FALSE if the state machine didn't recover :(
2317  *
2318  * NOTE: the Core reset is similar to other resets, except that we
2319  * can't poll for completion, since the Core reset disables memory
2320  * access!  So we just have to assume that it will all complete in
2321  * 100us.  See Broadcom document 570X-PG102-R, p102, steps 4-5.
2322  */
2323 static boolean_t bge_chip_reset_engine(bge_t *bgep, bge_regno_t regno);
2324 #pragma	no_inline(bge_chip_reset_engine)
2325 
2326 static boolean_t
2327 bge_chip_reset_engine(bge_t *bgep, bge_regno_t regno)
2328 {
2329 	uint32_t regval;
2330 	uint32_t val32;
2331 
2332 	regval = bge_reg_get32(bgep, regno);
2333 
2334 	BGE_TRACE(("bge_chip_reset_engine($%p, 0x%lx)",
2335 		(void *)bgep, regno));
2336 	BGE_DEBUG(("bge_chip_reset_engine: 0x%lx before reset = 0x%08x",
2337 		regno, regval));
2338 
2339 	regval |= STATE_MACHINE_RESET_BIT;
2340 
2341 	switch (regno) {
2342 	case MISC_CONFIG_REG:
2343 		/*
2344 		 * BCM5714/5721/5751 pcie chip special case. In order to avoid
2345 		 * resetting PCIE block and bringing PCIE link down, bit 29
2346 		 * in the register needs to be set first, and then set it again
2347 		 * while the reset bit is written.
2348 		 * See:P500 of 57xx-PG102-RDS.pdf.
2349 		 */
2350 		if (DEVICE_5705_SERIES_CHIPSETS(bgep)||
2351 		    DEVICE_5721_SERIES_CHIPSETS(bgep)||
2352 		    DEVICE_5714_SERIES_CHIPSETS(bgep)) {
2353 			regval |= MISC_CONFIG_GPHY_POWERDOWN_OVERRIDE;
2354 			if (bgep->chipid.pci_type == BGE_PCI_E) {
2355 				if (bgep->chipid.asic_rev ==
2356 				    MHCR_CHIP_REV_5751_A0 ||
2357 				    bgep->chipid.asic_rev ==
2358 				    MHCR_CHIP_REV_5721_A0) {
2359 					val32 = bge_reg_get32(bgep,
2360 					    PHY_TEST_CTRL_REG);
2361 					if (val32 == (PHY_PCIE_SCRAM_MODE |
2362 					    PHY_PCIE_LTASS_MODE))
2363 						bge_reg_put32(bgep,
2364 						    PHY_TEST_CTRL_REG,
2365 						    PHY_PCIE_SCRAM_MODE);
2366 					val32 = pci_config_get32
2367 					    (bgep->cfg_handle,
2368 					    PCI_CONF_BGE_CLKCTL);
2369 					val32 |= CLKCTL_PCIE_A0_FIX;
2370 					pci_config_put32(bgep->cfg_handle,
2371 					    PCI_CONF_BGE_CLKCTL, val32);
2372 				}
2373 				bge_reg_set32(bgep, regno,
2374 					MISC_CONFIG_GRC_RESET_DISABLE);
2375 				regval |= MISC_CONFIG_GRC_RESET_DISABLE;
2376 			}
2377 		}
2378 
2379 		/*
2380 		 * Special case - causes Core reset
2381 		 *
2382 		 * On SPARC v9 we want to ensure that we don't start
2383 		 * timing until the I/O access has actually reached
2384 		 * the chip, otherwise we might make the next access
2385 		 * too early.  And we can't just force the write out
2386 		 * by following it with a read (even to config space)
2387 		 * because that would cause the fault we're trying
2388 		 * to avoid.  Hence the need for membar_sync() here.
2389 		 */
2390 		ddi_put32(bgep->io_handle, PIO_ADDR(bgep, regno), regval);
2391 #ifdef	__sparcv9
2392 		membar_sync();
2393 #endif	/* __sparcv9 */
2394 		/*
2395 		 * On some platforms,system need about 300us for
2396 		 * link setup.
2397 		 */
2398 		drv_usecwait(300);
2399 
2400 		if (bgep->chipid.pci_type == BGE_PCI_E) {
2401 			/* PCI-E device need more reset time */
2402 			drv_usecwait(120000);
2403 
2404 			/* Set PCIE max payload size and clear error status. */
2405 			if (bgep->chipid.chip_label == 5721 ||
2406 			    bgep->chipid.chip_label == 5751) {
2407 				pci_config_put16(bgep->cfg_handle,
2408 					PCI_CONF_DEV_CTRL, READ_REQ_SIZE_MAX);
2409 				pci_config_put16(bgep->cfg_handle,
2410 					PCI_CONF_DEV_STUS, DEVICE_ERROR_STUS);
2411 			}
2412 		}
2413 
2414 		BGE_PCICHK(bgep);
2415 		return (B_TRUE);
2416 
2417 	default:
2418 		bge_reg_put32(bgep, regno, regval);
2419 		return (bge_chip_poll_engine(bgep, regno,
2420 		    STATE_MACHINE_RESET_BIT, 0));
2421 	}
2422 }
2423 
2424 /*
2425  * Various registers that control the chip's internal engines (state
2426  * machines) have an <enable> bit (fortunately, in the same place in
2427  * each such register :-).  To stop the state machine, this bit must
2428  * be written with 0, then polled to see when the state machine has
2429  * actually stopped.
2430  *
2431  * The return value is B_TRUE on success (enable bit cleared), or
2432  * B_FALSE if the state machine didn't stop :(
2433  */
2434 static boolean_t bge_chip_disable_engine(bge_t *bgep, bge_regno_t regno,
2435 						uint32_t morebits);
2436 #pragma	no_inline(bge_chip_disable_engine)
2437 
2438 static boolean_t
2439 bge_chip_disable_engine(bge_t *bgep, bge_regno_t regno, uint32_t morebits)
2440 {
2441 	uint32_t regval;
2442 
2443 	BGE_TRACE(("bge_chip_disable_engine($%p, 0x%lx, 0x%x)",
2444 		(void *)bgep, regno, morebits));
2445 
2446 	switch (regno) {
2447 	case FTQ_RESET_REG:
2448 		/*
2449 		 * Not quite like the others; it doesn't
2450 		 * have an <enable> bit, but instead we
2451 		 * have to set and then clear all the bits
2452 		 */
2453 		bge_reg_put32(bgep, regno, ~(uint32_t)0);
2454 		drv_usecwait(100);
2455 		bge_reg_put32(bgep, regno, 0);
2456 		return (B_TRUE);
2457 
2458 	default:
2459 		regval = bge_reg_get32(bgep, regno);
2460 		regval &= ~STATE_MACHINE_ENABLE_BIT;
2461 		regval &= ~morebits;
2462 		bge_reg_put32(bgep, regno, regval);
2463 		return (bge_chip_poll_engine(bgep, regno,
2464 		    STATE_MACHINE_ENABLE_BIT, 0));
2465 	}
2466 }
2467 
2468 /*
2469  * Various registers that control the chip's internal engines (state
2470  * machines) have an <enable> bit (fortunately, in the same place in
2471  * each such register :-).  To start the state machine, this bit must
2472  * be written with 1, then polled to see when the state machine has
2473  * actually started.
2474  *
2475  * The return value is B_TRUE on success (enable bit set), or
2476  * B_FALSE if the state machine didn't start :(
2477  */
2478 static boolean_t bge_chip_enable_engine(bge_t *bgep, bge_regno_t regno,
2479 					uint32_t morebits);
2480 #pragma	no_inline(bge_chip_enable_engine)
2481 
2482 static boolean_t
2483 bge_chip_enable_engine(bge_t *bgep, bge_regno_t regno, uint32_t morebits)
2484 {
2485 	uint32_t regval;
2486 
2487 	BGE_TRACE(("bge_chip_enable_engine($%p, 0x%lx, 0x%x)",
2488 		(void *)bgep, regno, morebits));
2489 
2490 	switch (regno) {
2491 	case FTQ_RESET_REG:
2492 		/*
2493 		 * Not quite like the others; it doesn't
2494 		 * have an <enable> bit, but instead we
2495 		 * have to set and then clear all the bits
2496 		 */
2497 		bge_reg_put32(bgep, regno, ~(uint32_t)0);
2498 		drv_usecwait(100);
2499 		bge_reg_put32(bgep, regno, 0);
2500 		return (B_TRUE);
2501 
2502 	default:
2503 		regval = bge_reg_get32(bgep, regno);
2504 		regval |= STATE_MACHINE_ENABLE_BIT;
2505 		regval |= morebits;
2506 		bge_reg_put32(bgep, regno, regval);
2507 		return (bge_chip_poll_engine(bgep, regno,
2508 		    STATE_MACHINE_ENABLE_BIT, STATE_MACHINE_ENABLE_BIT));
2509 	}
2510 }
2511 
2512 /*
2513  * Reprogram the Ethernet, Transmit, and Receive MAC
2514  * modes to match the param_* variables
2515  */
2516 static void bge_sync_mac_modes(bge_t *bgep);
2517 #pragma	no_inline(bge_sync_mac_modes)
2518 
2519 static void
2520 bge_sync_mac_modes(bge_t *bgep)
2521 {
2522 	uint32_t macmode;
2523 	uint32_t regval;
2524 
2525 	ASSERT(mutex_owned(bgep->genlock));
2526 
2527 	/*
2528 	 * Reprogram the Ethernet MAC mode ...
2529 	 */
2530 	macmode = regval = bge_reg_get32(bgep, ETHERNET_MAC_MODE_REG);
2531 	if ((bgep->chipid.flags & CHIP_FLAG_SERDES) &&
2532 		(bgep->param_loop_mode != BGE_LOOP_INTERNAL_MAC))
2533 		macmode &= ~ETHERNET_MODE_LINK_POLARITY;
2534 	else
2535 		macmode |= ETHERNET_MODE_LINK_POLARITY;
2536 	macmode &= ~ETHERNET_MODE_PORTMODE_MASK;
2537 	if ((bgep->chipid.flags & CHIP_FLAG_SERDES) &&
2538 		(bgep->param_loop_mode != BGE_LOOP_INTERNAL_MAC))
2539 		macmode |= ETHERNET_MODE_PORTMODE_TBI;
2540 	else if (bgep->param_link_speed == 10 || bgep->param_link_speed == 100)
2541 		macmode |= ETHERNET_MODE_PORTMODE_MII;
2542 	else
2543 		macmode |= ETHERNET_MODE_PORTMODE_GMII;
2544 	if (bgep->param_link_duplex == LINK_DUPLEX_HALF)
2545 		macmode |= ETHERNET_MODE_HALF_DUPLEX;
2546 	else
2547 		macmode &= ~ETHERNET_MODE_HALF_DUPLEX;
2548 	if (bgep->param_loop_mode == BGE_LOOP_INTERNAL_MAC)
2549 		macmode |= ETHERNET_MODE_MAC_LOOPBACK;
2550 	else
2551 		macmode &= ~ETHERNET_MODE_MAC_LOOPBACK;
2552 	bge_reg_put32(bgep, ETHERNET_MAC_MODE_REG, macmode);
2553 	BGE_DEBUG(("bge_sync_mac_modes($%p) Ethernet MAC mode 0x%x => 0x%x",
2554 		(void *)bgep, regval, macmode));
2555 
2556 	/*
2557 	 * ... the Transmit MAC mode ...
2558 	 */
2559 	macmode = regval = bge_reg_get32(bgep, TRANSMIT_MAC_MODE_REG);
2560 	if (bgep->param_link_tx_pause)
2561 		macmode |= TRANSMIT_MODE_FLOW_CONTROL;
2562 	else
2563 		macmode &= ~TRANSMIT_MODE_FLOW_CONTROL;
2564 	bge_reg_put32(bgep, TRANSMIT_MAC_MODE_REG, macmode);
2565 	BGE_DEBUG(("bge_sync_mac_modes($%p) Transmit MAC mode 0x%x => 0x%x",
2566 		(void *)bgep, regval, macmode));
2567 
2568 	/*
2569 	 * ... and the Receive MAC mode
2570 	 */
2571 	macmode = regval = bge_reg_get32(bgep, RECEIVE_MAC_MODE_REG);
2572 	if (bgep->param_link_rx_pause)
2573 		macmode |= RECEIVE_MODE_FLOW_CONTROL;
2574 	else
2575 		macmode &= ~RECEIVE_MODE_FLOW_CONTROL;
2576 	bge_reg_put32(bgep, RECEIVE_MAC_MODE_REG, macmode);
2577 	BGE_DEBUG(("bge_sync_mac_modes($%p) Receive MAC mode 0x%x => 0x%x",
2578 		(void *)bgep, regval, macmode));
2579 }
2580 
2581 /*
2582  * bge_chip_sync() -- program the chip with the unicast MAC address,
2583  * the multicast hash table, the required level of promiscuity, and
2584  * the current loopback mode ...
2585  */
2586 #ifdef BGE_IPMI_ASF
2587 int bge_chip_sync(bge_t *bgep, boolean_t asf_keeplive);
2588 #else
2589 int bge_chip_sync(bge_t *bgep);
2590 #endif
2591 #pragma	no_inline(bge_chip_sync)
2592 
2593 int
2594 #ifdef BGE_IPMI_ASF
2595 bge_chip_sync(bge_t *bgep, boolean_t asf_keeplive)
2596 #else
2597 bge_chip_sync(bge_t *bgep)
2598 #endif
2599 {
2600 	void (*opfn)(bge_t *bgep, bge_regno_t reg, uint32_t bits);
2601 	boolean_t promisc;
2602 	uint64_t macaddr;
2603 	uint32_t fill;
2604 	int i;
2605 	int retval = DDI_SUCCESS;
2606 
2607 	BGE_TRACE(("bge_chip_sync($%p)",
2608 		(void *)bgep));
2609 
2610 	ASSERT(mutex_owned(bgep->genlock));
2611 
2612 	promisc = B_FALSE;
2613 	fill = ~(uint32_t)0;
2614 
2615 	if (bgep->promisc)
2616 		promisc = B_TRUE;
2617 	else
2618 		fill = (uint32_t)0;
2619 
2620 	/*
2621 	 * If the TX/RX MAC engines are already running, we should stop
2622 	 * them (and reset the RX engine) before changing the parameters.
2623 	 * If they're not running, this will have no effect ...
2624 	 *
2625 	 * NOTE: this is currently disabled by default because stopping
2626 	 * and restarting the Tx engine may cause an outgoing packet in
2627 	 * transit to be truncated.  Also, stopping and restarting the
2628 	 * Rx engine seems to not work correctly on the 5705.  Testing
2629 	 * has not (yet!) revealed any problems with NOT stopping and
2630 	 * restarting these engines (and Broadcom say their drivers don't
2631 	 * do this), but if it is found to cause problems, this variable
2632 	 * can be patched to re-enable the old behaviour ...
2633 	 */
2634 	if (bge_stop_start_on_sync) {
2635 #ifdef BGE_IPMI_ASF
2636 		if (!bgep->asf_enabled) {
2637 			if (!bge_chip_disable_engine(bgep,
2638 			    RECEIVE_MAC_MODE_REG, RECEIVE_MODE_KEEP_VLAN_TAG))
2639 				retval = DDI_FAILURE;
2640 		} else {
2641 			if (!bge_chip_disable_engine(bgep,
2642 			    RECEIVE_MAC_MODE_REG, 0))
2643 				retval = DDI_FAILURE;
2644 		}
2645 #else
2646 		if (!bge_chip_disable_engine(bgep, RECEIVE_MAC_MODE_REG,
2647 		    RECEIVE_MODE_KEEP_VLAN_TAG))
2648 			retval = DDI_FAILURE;
2649 #endif
2650 		if (!bge_chip_disable_engine(bgep, TRANSMIT_MAC_MODE_REG, 0))
2651 			retval = DDI_FAILURE;
2652 		if (!bge_chip_reset_engine(bgep, RECEIVE_MAC_MODE_REG))
2653 			retval = DDI_FAILURE;
2654 	}
2655 
2656 	/*
2657 	 * Reprogram the hashed multicast address table ...
2658 	 */
2659 	for (i = 0; i < BGE_HASH_TABLE_SIZE/32; ++i)
2660 		bge_reg_put32(bgep, MAC_HASH_REG(i),
2661 			bgep->mcast_hash[i] | fill);
2662 
2663 #ifdef BGE_IPMI_ASF
2664 	if (!bgep->asf_enabled || !asf_keeplive) {
2665 #endif
2666 		/*
2667 		 * Transform the MAC address from host to chip format, then
2668 		 * reprogram the transmit random backoff seed and the unicast
2669 		 * MAC address(es) ...
2670 		 */
2671 		for (i = 0, fill = 0, macaddr = 0ull; i < ETHERADDRL; ++i) {
2672 			macaddr <<= 8;
2673 			macaddr |= bgep->curr_addr.addr[i];
2674 			fill += bgep->curr_addr.addr[i];
2675 		}
2676 		bge_reg_put32(bgep, MAC_TX_RANDOM_BACKOFF_REG, fill);
2677 		for (i = 0; i < MAC_ADDRESS_REGS_MAX; ++i)
2678 			bge_reg_put64(bgep, MAC_ADDRESS_REG(i), macaddr);
2679 
2680 		BGE_DEBUG(("bge_chip_sync($%p) setting MAC address %012llx",
2681 			(void *)bgep, macaddr));
2682 #ifdef BGE_IPMI_ASF
2683 	}
2684 #endif
2685 
2686 	/*
2687 	 * Set or clear the PROMISCUOUS mode bit
2688 	 */
2689 	opfn = promisc ? bge_reg_set32 : bge_reg_clr32;
2690 	(*opfn)(bgep, RECEIVE_MAC_MODE_REG, RECEIVE_MODE_PROMISCUOUS);
2691 
2692 	/*
2693 	 * Sync the rest of the MAC modes too ...
2694 	 */
2695 	bge_sync_mac_modes(bgep);
2696 
2697 	/*
2698 	 * Restart RX/TX MAC engines if required ...
2699 	 */
2700 	if (bgep->bge_chip_state == BGE_CHIP_RUNNING) {
2701 		if (!bge_chip_enable_engine(bgep, TRANSMIT_MAC_MODE_REG, 0))
2702 			retval = DDI_FAILURE;
2703 #ifdef BGE_IPMI_ASF
2704 		if (!bgep->asf_enabled) {
2705 			if (!bge_chip_enable_engine(bgep,
2706 			    RECEIVE_MAC_MODE_REG, RECEIVE_MODE_KEEP_VLAN_TAG))
2707 				retval = DDI_FAILURE;
2708 		} else {
2709 			if (!bge_chip_enable_engine(bgep,
2710 			    RECEIVE_MAC_MODE_REG, 0))
2711 				retval = DDI_FAILURE;
2712 		}
2713 #else
2714 		if (!bge_chip_enable_engine(bgep, RECEIVE_MAC_MODE_REG,
2715 		    RECEIVE_MODE_KEEP_VLAN_TAG))
2716 			retval = DDI_FAILURE;
2717 #endif
2718 	}
2719 	return (retval);
2720 }
2721 
2722 /*
2723  * This array defines the sequence of state machine control registers
2724  * in which the <enable> bit must be cleared to bring the chip to a
2725  * clean stop.  Taken from Broadcom document 570X-PG102-R, p116.
2726  */
2727 static bge_regno_t shutdown_engine_regs[] = {
2728 	RECEIVE_MAC_MODE_REG,
2729 	RCV_BD_INITIATOR_MODE_REG,
2730 	RCV_LIST_PLACEMENT_MODE_REG,
2731 	RCV_LIST_SELECTOR_MODE_REG,		/* BCM5704 series only	*/
2732 	RCV_DATA_BD_INITIATOR_MODE_REG,
2733 	RCV_DATA_COMPLETION_MODE_REG,
2734 	RCV_BD_COMPLETION_MODE_REG,
2735 
2736 	SEND_BD_SELECTOR_MODE_REG,
2737 	SEND_BD_INITIATOR_MODE_REG,
2738 	SEND_DATA_INITIATOR_MODE_REG,
2739 	READ_DMA_MODE_REG,
2740 	SEND_DATA_COMPLETION_MODE_REG,
2741 	DMA_COMPLETION_MODE_REG,		/* BCM5704 series only	*/
2742 	SEND_BD_COMPLETION_MODE_REG,
2743 	TRANSMIT_MAC_MODE_REG,
2744 
2745 	HOST_COALESCE_MODE_REG,
2746 	WRITE_DMA_MODE_REG,
2747 	MBUF_CLUSTER_FREE_MODE_REG,		/* BCM5704 series only	*/
2748 	FTQ_RESET_REG,		/* special - see code	*/
2749 	BUFFER_MANAGER_MODE_REG,		/* BCM5704 series only	*/
2750 	MEMORY_ARBITER_MODE_REG,		/* BCM5704 series only	*/
2751 	BGE_REGNO_NONE		/* terminator		*/
2752 };
2753 
2754 /*
2755  * bge_chip_stop() -- stop all chip processing
2756  *
2757  * If the <fault> parameter is B_TRUE, we're stopping the chip because
2758  * we've detected a problem internally; otherwise, this is a normal
2759  * (clean) stop (at user request i.e. the last STREAM has been closed).
2760  */
2761 void bge_chip_stop(bge_t *bgep, boolean_t fault);
2762 #pragma	no_inline(bge_chip_stop)
2763 
2764 void
2765 bge_chip_stop(bge_t *bgep, boolean_t fault)
2766 {
2767 	bge_regno_t regno;
2768 	bge_regno_t *rbp;
2769 	boolean_t ok;
2770 
2771 	BGE_TRACE(("bge_chip_stop($%p)",
2772 		(void *)bgep));
2773 
2774 	ASSERT(mutex_owned(bgep->genlock));
2775 
2776 	rbp = shutdown_engine_regs;
2777 	/*
2778 	 * When driver try to shutdown the BCM5705/5788/5721/5751/
2779 	 * 5752/5714 and 5715 chipsets,the buffer manager and the mem
2780 	 * -ory arbiter should not be disabled.
2781 	 */
2782 	for (ok = B_TRUE; (regno = *rbp) != BGE_REGNO_NONE; ++rbp) {
2783 			if (DEVICE_5704_SERIES_CHIPSETS(bgep))
2784 			    ok &= bge_chip_disable_engine(bgep, regno, 0);
2785 			else if ((regno != RCV_LIST_SELECTOR_MODE_REG) &&
2786 				    (regno != DMA_COMPLETION_MODE_REG) &&
2787 				    (regno != MBUF_CLUSTER_FREE_MODE_REG)&&
2788 				    (regno != BUFFER_MANAGER_MODE_REG) &&
2789 				    (regno != MEMORY_ARBITER_MODE_REG))
2790 					ok &= bge_chip_disable_engine(bgep,
2791 					    regno, 0);
2792 	}
2793 
2794 	if (!ok && !fault)
2795 		ddi_fm_service_impact(bgep->devinfo, DDI_SERVICE_UNAFFECTED);
2796 
2797 	/*
2798 	 * Finally, disable (all) MAC events & clear the MAC status
2799 	 */
2800 	bge_reg_put32(bgep, ETHERNET_MAC_EVENT_ENABLE_REG, 0);
2801 	bge_reg_put32(bgep, ETHERNET_MAC_STATUS_REG, ~0);
2802 
2803 	/*
2804 	 * if we're stopping the chip because of a detected fault then do
2805 	 * appropriate actions
2806 	 */
2807 	if (fault) {
2808 		if (bgep->bge_chip_state != BGE_CHIP_FAULT) {
2809 			bgep->bge_chip_state = BGE_CHIP_FAULT;
2810 			ddi_fm_service_impact(bgep->devinfo, DDI_SERVICE_LOST);
2811 			if (bgep->bge_dma_error) {
2812 				/*
2813 				 * need to free buffers in case the fault was
2814 				 * due to a memory error in a buffer - got to
2815 				 * do a fair bit of tidying first
2816 				 */
2817 				if (bgep->progress & PROGRESS_KSTATS) {
2818 					bge_fini_kstats(bgep);
2819 					bgep->progress &= ~PROGRESS_KSTATS;
2820 				}
2821 				if (bgep->progress & PROGRESS_INTR) {
2822 					bge_intr_disable(bgep);
2823 					rw_enter(bgep->errlock, RW_WRITER);
2824 					bge_fini_rings(bgep);
2825 					rw_exit(bgep->errlock);
2826 					bgep->progress &= ~PROGRESS_INTR;
2827 				}
2828 				if (bgep->progress & PROGRESS_BUFS) {
2829 					bge_free_bufs(bgep);
2830 					bgep->progress &= ~PROGRESS_BUFS;
2831 				}
2832 				bgep->bge_dma_error = B_FALSE;
2833 			}
2834 		}
2835 	} else
2836 		bgep->bge_chip_state = BGE_CHIP_STOPPED;
2837 }
2838 
2839 /*
2840  * Poll for completion of chip's ROM firmware; also, at least on the
2841  * first time through, find and return the hardware MAC address, if any.
2842  */
2843 static uint64_t bge_poll_firmware(bge_t *bgep);
2844 #pragma	no_inline(bge_poll_firmware)
2845 
2846 static uint64_t
2847 bge_poll_firmware(bge_t *bgep)
2848 {
2849 	uint64_t magic;
2850 	uint64_t mac;
2851 	uint32_t gen;
2852 	uint32_t i;
2853 
2854 	/*
2855 	 * Step 19: poll for firmware completion (GENCOMM port set
2856 	 * to the ones complement of T3_MAGIC_NUMBER).
2857 	 *
2858 	 * While we're at it, we also read the MAC address register;
2859 	 * at some stage the the firmware will load this with the
2860 	 * factory-set value.
2861 	 *
2862 	 * When both the magic number and the MAC address are set,
2863 	 * we're done; but we impose a time limit of one second
2864 	 * (1000*1000us) in case the firmware fails in some fashion
2865 	 * or the SEEPROM that provides that MAC address isn't fitted.
2866 	 *
2867 	 * After the first time through (chip state != INITIAL), we
2868 	 * don't need the MAC address to be set (we've already got it
2869 	 * or not, from the first time), so we don't wait for it, but
2870 	 * we still have to wait for the T3_MAGIC_NUMBER.
2871 	 *
2872 	 * Note: the magic number is only a 32-bit quantity, but the NIC
2873 	 * memory is 64-bit (and big-endian) internally.  Addressing the
2874 	 * GENCOMM word as "the upper half of a 64-bit quantity" makes
2875 	 * it work correctly on both big- and little-endian hosts.
2876 	 */
2877 	for (i = 0; i < 1000; ++i) {
2878 		drv_usecwait(1000);
2879 		gen = bge_nic_get64(bgep, NIC_MEM_GENCOMM) >> 32;
2880 		mac = bge_reg_get64(bgep, MAC_ADDRESS_REG(0));
2881 #ifdef BGE_IPMI_ASF
2882 		if (!bgep->asf_enabled) {
2883 #endif
2884 			if (gen != ~T3_MAGIC_NUMBER)
2885 				continue;
2886 #ifdef BGE_IPMI_ASF
2887 		}
2888 #endif
2889 		if (mac != 0ULL)
2890 			break;
2891 		if (bgep->bge_chip_state != BGE_CHIP_INITIAL)
2892 			break;
2893 	}
2894 
2895 	magic = bge_nic_get64(bgep, NIC_MEM_GENCOMM);
2896 	BGE_DEBUG(("bge_poll_firmware($%p): PXE magic 0x%x after %d loops",
2897 		(void *)bgep, gen, i));
2898 	BGE_DEBUG(("bge_poll_firmware: MAC %016llx, GENCOMM %016llx",
2899 		mac, magic));
2900 
2901 	return (mac);
2902 }
2903 
2904 #ifdef BGE_IPMI_ASF
2905 int bge_chip_reset(bge_t *bgep, boolean_t enable_dma, uint_t asf_mode);
2906 #else
2907 int bge_chip_reset(bge_t *bgep, boolean_t enable_dma);
2908 #endif
2909 #pragma	no_inline(bge_chip_reset)
2910 
2911 int
2912 #ifdef BGE_IPMI_ASF
2913 bge_chip_reset(bge_t *bgep, boolean_t enable_dma, uint_t asf_mode)
2914 #else
2915 bge_chip_reset(bge_t *bgep, boolean_t enable_dma)
2916 #endif
2917 {
2918 	chip_id_t chipid;
2919 	uint64_t mac;
2920 	uint64_t magic;
2921 	uint32_t modeflags;
2922 	uint32_t mhcr;
2923 	uint32_t sx0;
2924 	uint32_t i;
2925 #ifdef BGE_IPMI_ASF
2926 	uint32_t mailbox;
2927 #endif
2928 	int retval = DDI_SUCCESS;
2929 
2930 	BGE_TRACE(("bge_chip_reset($%p, %d)",
2931 		(void *)bgep, enable_dma));
2932 
2933 	ASSERT(mutex_owned(bgep->genlock));
2934 
2935 	BGE_DEBUG(("bge_chip_reset($%p, %d): current state is %d",
2936 		(void *)bgep, enable_dma, bgep->bge_chip_state));
2937 
2938 	/*
2939 	 * Do we need to stop the chip cleanly before resetting?
2940 	 */
2941 	switch (bgep->bge_chip_state) {
2942 	default:
2943 		_NOTE(NOTREACHED)
2944 		return (DDI_FAILURE);
2945 
2946 	case BGE_CHIP_INITIAL:
2947 	case BGE_CHIP_STOPPED:
2948 	case BGE_CHIP_RESET:
2949 		break;
2950 
2951 	case BGE_CHIP_RUNNING:
2952 	case BGE_CHIP_ERROR:
2953 	case BGE_CHIP_FAULT:
2954 		bge_chip_stop(bgep, B_FALSE);
2955 		break;
2956 	}
2957 
2958 #ifdef BGE_IPMI_ASF
2959 	if (bgep->asf_enabled) {
2960 		if (asf_mode == ASF_MODE_INIT) {
2961 			bge_asf_pre_reset_operations(bgep, BGE_INIT_RESET);
2962 		} else if (asf_mode == ASF_MODE_SHUTDOWN) {
2963 			bge_asf_pre_reset_operations(bgep, BGE_SHUTDOWN_RESET);
2964 		}
2965 	}
2966 #endif
2967 	/*
2968 	 * Adapted from Broadcom document 570X-PG102-R, pp 102-116.
2969 	 * Updated to reflect Broadcom document 570X-PG104-R, pp 146-159.
2970 	 *
2971 	 * Before reset Core clock,it is
2972 	 * also required to initialize the Memory Arbiter as specified in step9
2973 	 * and Misc Host Control Register as specified in step-13
2974 	 * Step 4-5: reset Core clock & wait for completion
2975 	 * Steps 6-8: are done by bge_chip_cfg_init()
2976 	 * put the T3_MAGIC_NUMBER into the GENCOMM port before reset
2977 	 */
2978 	if (!bge_chip_enable_engine(bgep, MEMORY_ARBITER_MODE_REG, 0))
2979 		retval = DDI_FAILURE;
2980 
2981 	mhcr = MHCR_ENABLE_INDIRECT_ACCESS |
2982 	    MHCR_ENABLE_TAGGED_STATUS_MODE |
2983 	    MHCR_MASK_INTERRUPT_MODE |
2984 	    MHCR_MASK_PCI_INT_OUTPUT |
2985 	    MHCR_CLEAR_INTERRUPT_INTA;
2986 #ifdef  _BIG_ENDIAN
2987 	mhcr |= MHCR_ENABLE_ENDIAN_WORD_SWAP | MHCR_ENABLE_ENDIAN_BYTE_SWAP;
2988 #endif  /* _BIG_ENDIAN */
2989 	pci_config_put32(bgep->cfg_handle, PCI_CONF_BGE_MHCR, mhcr);
2990 #ifdef BGE_IPMI_ASF
2991 	if (bgep->asf_enabled)
2992 		bgep->asf_wordswapped = B_FALSE;
2993 #endif
2994 #ifdef BGE_IPMI_ASF
2995 	if (!bgep->asf_enabled) {
2996 #endif
2997 		magic = (uint64_t)T3_MAGIC_NUMBER << 32;
2998 		bge_nic_put64(bgep, NIC_MEM_GENCOMM, magic);
2999 #ifdef BGE_IPMI_ASF
3000 	}
3001 #endif
3002 
3003 	if (!bge_chip_reset_engine(bgep, MISC_CONFIG_REG))
3004 		retval = DDI_FAILURE;
3005 	bge_chip_cfg_init(bgep, &chipid, enable_dma);
3006 
3007 	/*
3008 	 * Step 8a: This may belong elsewhere, but BCM5721 needs
3009 	 * a bit set to avoid a fifo overflow/underflow bug.
3010 	 */
3011 	if (bgep->chipid.chip_label == 5721 || bgep->chipid.chip_label == 5751)
3012 		bge_reg_set32(bgep, TLP_CONTROL_REG, TLP_DATA_FIFO_PROTECT);
3013 
3014 
3015 	/*
3016 	 * Step 9: enable MAC memory arbiter,bit30 and bit31 of 5714/5715 should
3017 	 * not be changed.
3018 	 */
3019 	if (!bge_chip_enable_engine(bgep, MEMORY_ARBITER_MODE_REG, 0))
3020 		retval = DDI_FAILURE;
3021 
3022 	/*
3023 	 * Steps 10-11: configure PIO endianness options and
3024 	 * enable indirect register access -- already done
3025 	 * Steps 12-13: enable writing to the PCI state & clock
3026 	 * control registers -- not required; we aren't going to
3027 	 * use those features.
3028 	 * Steps 14-15: Configure DMA endianness options.  See
3029 	 * the comments on the setting of the MHCR above.
3030 	 */
3031 #ifdef	_BIG_ENDIAN
3032 	modeflags = MODE_WORD_SWAP_FRAME | MODE_BYTE_SWAP_FRAME |
3033 		    MODE_WORD_SWAP_NONFRAME | MODE_BYTE_SWAP_NONFRAME;
3034 #else
3035 	modeflags = MODE_WORD_SWAP_FRAME | MODE_BYTE_SWAP_FRAME;
3036 #endif	/* _BIG_ENDIAN */
3037 #ifdef BGE_IPMI_ASF
3038 	if (bgep->asf_enabled)
3039 		modeflags |= MODE_HOST_STACK_UP;
3040 #endif
3041 	bge_reg_put32(bgep, MODE_CONTROL_REG, modeflags);
3042 
3043 #ifdef BGE_IPMI_ASF
3044 	if (bgep->asf_enabled) {
3045 		if (asf_mode != ASF_MODE_NONE) {
3046 			/* Wait for NVRAM init */
3047 			i = 0;
3048 			drv_usecwait(5000);
3049 			mailbox = bge_nic_get32(bgep, BGE_FIRMWARE_MAILBOX);
3050 			while ((mailbox != (uint32_t)
3051 				~BGE_MAGIC_NUM_FIRMWARE_INIT_DONE) &&
3052 				(i < 10000)) {
3053 				drv_usecwait(100);
3054 				mailbox = bge_nic_get32(bgep,
3055 					BGE_FIRMWARE_MAILBOX);
3056 				i++;
3057 			}
3058 			if (!bgep->asf_newhandshake) {
3059 				if ((asf_mode == ASF_MODE_INIT) ||
3060 					(asf_mode == ASF_MODE_POST_INIT)) {
3061 
3062 					bge_asf_post_reset_old_mode(bgep,
3063 						BGE_INIT_RESET);
3064 				} else {
3065 					bge_asf_post_reset_old_mode(bgep,
3066 						BGE_SHUTDOWN_RESET);
3067 				}
3068 			}
3069 		}
3070 	}
3071 #endif
3072 	/*
3073 	 * Steps 16-17: poll for firmware completion
3074 	 */
3075 	mac = bge_poll_firmware(bgep);
3076 
3077 	/*
3078 	 * Step 18: enable external memory -- doesn't apply.
3079 	 *
3080 	 * However we take the opportunity to set the MLCR anyway, as
3081 	 * this register also controls the SEEPROM auto-access method
3082 	 * which we may want to use later ...
3083 	 *
3084 	 * The proper value here depends on the way the chip is wired
3085 	 * into the circuit board, as this register *also* controls which
3086 	 * of the "Miscellaneous I/O" pins are driven as outputs and the
3087 	 * values driven onto those pins!
3088 	 *
3089 	 * See also step 74 in the PRM ...
3090 	 */
3091 	bge_reg_put32(bgep, MISC_LOCAL_CONTROL_REG,
3092 	    bgep->chipid.bge_mlcr_default);
3093 	bge_reg_set32(bgep, SERIAL_EEPROM_ADDRESS_REG, SEEPROM_ACCESS_INIT);
3094 
3095 	/*
3096 	 * Step 20: clear the Ethernet MAC mode register
3097 	 */
3098 	bge_reg_put32(bgep, ETHERNET_MAC_MODE_REG, 0);
3099 
3100 	/*
3101 	 * Step 21: restore cache-line-size, latency timer, and
3102 	 * subsystem ID registers to their original values (not
3103 	 * those read into the local structure <chipid>, 'cos
3104 	 * that was after they were cleared by the RESET).
3105 	 *
3106 	 * Note: the Subsystem Vendor/Device ID registers are not
3107 	 * directly writable in config space, so we use the shadow
3108 	 * copy in "Page Zero" of register space to restore them
3109 	 * both in one go ...
3110 	 */
3111 	pci_config_put8(bgep->cfg_handle, PCI_CONF_CACHE_LINESZ,
3112 		bgep->chipid.clsize);
3113 	pci_config_put8(bgep->cfg_handle, PCI_CONF_LATENCY_TIMER,
3114 		bgep->chipid.latency);
3115 	bge_reg_put32(bgep, PCI_CONF_SUBVENID,
3116 		(bgep->chipid.subdev << 16) | bgep->chipid.subven);
3117 
3118 	/*
3119 	 * The SEND INDEX registers should be reset to zero by the
3120 	 * global chip reset; if they're not, there'll be trouble
3121 	 * later on.
3122 	 */
3123 	sx0 = bge_reg_get32(bgep, NIC_DIAG_SEND_INDEX_REG(0));
3124 	if (sx0 != 0) {
3125 		BGE_REPORT((bgep, "SEND INDEX - device didn't RESET"));
3126 		bge_fm_ereport(bgep, DDI_FM_DEVICE_INVAL_STATE);
3127 		return (DDI_FAILURE);
3128 	}
3129 
3130 	/* Enable MSI code */
3131 	if (bgep->intr_type == DDI_INTR_TYPE_MSI)
3132 		bge_reg_set32(bgep, MSI_MODE_REG,
3133 		    MSI_PRI_HIGHEST|MSI_MSI_ENABLE);
3134 
3135 	/*
3136 	 * On the first time through, save the factory-set MAC address
3137 	 * (if any).  If bge_poll_firmware() above didn't return one
3138 	 * (from a chip register) consider looking in the attached NV
3139 	 * memory device, if any.  Once we have it, we save it in both
3140 	 * register-image (64-bit) and byte-array forms.  All-zero and
3141 	 * all-one addresses are not valid, and we refuse to stash those.
3142 	 */
3143 	if (bgep->bge_chip_state == BGE_CHIP_INITIAL) {
3144 		if (mac == 0ULL)
3145 			mac = bge_get_nvmac(bgep);
3146 		if (mac != 0ULL && mac != ~0ULL) {
3147 			bgep->chipid.hw_mac_addr = mac;
3148 			for (i = ETHERADDRL; i-- != 0; ) {
3149 				bgep->chipid.vendor_addr.addr[i] = (uchar_t)mac;
3150 				mac >>= 8;
3151 			}
3152 			bgep->chipid.vendor_addr.set = 1;
3153 		}
3154 	}
3155 
3156 #ifdef BGE_IPMI_ASF
3157 	if (bgep->asf_enabled && bgep->asf_newhandshake) {
3158 		if (asf_mode != ASF_MODE_NONE) {
3159 			if ((asf_mode == ASF_MODE_INIT) ||
3160 				(asf_mode == ASF_MODE_POST_INIT)) {
3161 
3162 				bge_asf_post_reset_new_mode(bgep,
3163 					BGE_INIT_RESET);
3164 			} else {
3165 				bge_asf_post_reset_new_mode(bgep,
3166 					BGE_SHUTDOWN_RESET);
3167 			}
3168 		}
3169 	}
3170 #endif
3171 
3172 	/*
3173 	 * Record the new state
3174 	 */
3175 	bgep->chip_resets += 1;
3176 	bgep->bge_chip_state = BGE_CHIP_RESET;
3177 	return (retval);
3178 }
3179 
3180 /*
3181  * bge_chip_start() -- start the chip transmitting and/or receiving,
3182  * including enabling interrupts
3183  */
3184 int bge_chip_start(bge_t *bgep, boolean_t reset_phys);
3185 #pragma	no_inline(bge_chip_start)
3186 
3187 int
3188 bge_chip_start(bge_t *bgep, boolean_t reset_phys)
3189 {
3190 	uint32_t coalmode;
3191 	uint32_t ledctl;
3192 	uint32_t mtu;
3193 	uint32_t maxring;
3194 	uint64_t ring;
3195 	int retval = DDI_SUCCESS;
3196 
3197 	BGE_TRACE(("bge_chip_start($%p)",
3198 		(void *)bgep));
3199 
3200 	ASSERT(mutex_owned(bgep->genlock));
3201 	ASSERT(bgep->bge_chip_state == BGE_CHIP_RESET);
3202 
3203 	/*
3204 	 * Taken from Broadcom document 570X-PG102-R, pp 102-116.
3205 	 * The document specifies 95 separate steps to fully
3206 	 * initialise the chip!!!!
3207 	 *
3208 	 * The reset code above has already got us as far as step
3209 	 * 21, so we continue with ...
3210 	 *
3211 	 * Step 22: clear the MAC statistics block
3212 	 * (0x0300-0x0aff in NIC-local memory)
3213 	 */
3214 	if (bgep->chipid.statistic_type == BGE_STAT_BLK)
3215 		bge_nic_zero(bgep, NIC_MEM_STATISTICS,
3216 		    NIC_MEM_STATISTICS_SIZE);
3217 
3218 	/*
3219 	 * Step 23: clear the status block (in host memory)
3220 	 */
3221 	DMA_ZERO(bgep->status_block);
3222 
3223 	/*
3224 	 * Step 24: set DMA read/write control register
3225 	 */
3226 	pci_config_put32(bgep->cfg_handle, PCI_CONF_BGE_PDRWCR,
3227 		bgep->chipid.bge_dma_rwctrl);
3228 
3229 	/*
3230 	 * Step 25: Configure DMA endianness -- already done (16/17)
3231 	 * Step 26: Configure Host-Based Send Rings
3232 	 * Step 27: Indicate Host Stack Up
3233 	 */
3234 	bge_reg_set32(bgep, MODE_CONTROL_REG,
3235 		MODE_HOST_SEND_BDS |
3236 		MODE_HOST_STACK_UP);
3237 
3238 	/*
3239 	 * Step 28: Configure checksum options:
3240 	 *	Solaris supports the hardware default checksum options.
3241 	 *
3242 	 *	Workaround for Incorrect pseudo-header checksum calculation.
3243 	 */
3244 	if (bgep->macp->m_info.mi_cksum & HCKSUM_INET_PARTIAL)
3245 		bge_reg_set32(bgep, MODE_CONTROL_REG,
3246 			MODE_SEND_NO_PSEUDO_HDR_CSUM);
3247 
3248 	/*
3249 	 * Step 29: configure Timer Prescaler.  The value is always the
3250 	 * same: the Core Clock frequency in MHz (66), minus 1, shifted
3251 	 * into bits 7-1.  Don't set bit 0, 'cos that's the RESET bit
3252 	 * for the whole chip!
3253 	 */
3254 	bge_reg_put32(bgep, MISC_CONFIG_REG, MISC_CONFIG_DEFAULT);
3255 
3256 	/*
3257 	 * Steps 30-31: Configure MAC local memory pool & DMA pool registers
3258 	 *
3259 	 * If the mbuf_length is specified as 0, we just leave these at
3260 	 * their hardware defaults, rather than explicitly setting them.
3261 	 * As the Broadcom HRM,driver better not change the parameters
3262 	 * when the chipsets is 5705/5788/5721/5751/5714 and 5715.
3263 	 */
3264 	if ((bgep->chipid.mbuf_length != 0) &&
3265 		(DEVICE_5704_SERIES_CHIPSETS(bgep))) {
3266 			bge_reg_put32(bgep, MBUF_POOL_BASE_REG,
3267 				bgep->chipid.mbuf_base);
3268 			bge_reg_put32(bgep, MBUF_POOL_LENGTH_REG,
3269 				bgep->chipid.mbuf_length);
3270 			bge_reg_put32(bgep, DMAD_POOL_BASE_REG,
3271 				DMAD_POOL_BASE_DEFAULT);
3272 			bge_reg_put32(bgep, DMAD_POOL_LENGTH_REG,
3273 				DMAD_POOL_LENGTH_DEFAULT);
3274 	}
3275 
3276 	/*
3277 	 * Step 32: configure MAC memory pool watermarks
3278 	 */
3279 	bge_reg_put32(bgep, RDMA_MBUF_LOWAT_REG,
3280 		bgep->chipid.mbuf_lo_water_rdma);
3281 	bge_reg_put32(bgep, MAC_RX_MBUF_LOWAT_REG,
3282 		bgep->chipid.mbuf_lo_water_rmac);
3283 	bge_reg_put32(bgep, MBUF_HIWAT_REG,
3284 		bgep->chipid.mbuf_hi_water);
3285 
3286 	/*
3287 	 * Step 33: configure DMA resource watermarks
3288 	 */
3289 	if (DEVICE_5704_SERIES_CHIPSETS(bgep)) {
3290 		bge_reg_put32(bgep, DMAD_POOL_LOWAT_REG,
3291 		    bge_dmad_lo_water);
3292 		bge_reg_put32(bgep, DMAD_POOL_HIWAT_REG,
3293 		    bge_dmad_hi_water);
3294 	}
3295 	bge_reg_put32(bgep, LOWAT_MAX_RECV_FRAMES_REG, bge_lowat_recv_frames);
3296 
3297 	/*
3298 	 * Steps 34-36: enable buffer manager & internal h/w queues
3299 	 */
3300 	if (!bge_chip_enable_engine(bgep, BUFFER_MANAGER_MODE_REG,
3301 	    STATE_MACHINE_ATTN_ENABLE_BIT))
3302 		retval = DDI_FAILURE;
3303 	if (!bge_chip_enable_engine(bgep, FTQ_RESET_REG, 0))
3304 		retval = DDI_FAILURE;
3305 
3306 	/*
3307 	 * Steps 37-39: initialise Receive Buffer (Producer) RCBs
3308 	 */
3309 	bge_reg_putrcb(bgep, STD_RCV_BD_RING_RCB_REG,
3310 		&bgep->buff[BGE_STD_BUFF_RING].hw_rcb);
3311 	if (DEVICE_5704_SERIES_CHIPSETS(bgep)) {
3312 		bge_reg_putrcb(bgep, JUMBO_RCV_BD_RING_RCB_REG,
3313 			&bgep->buff[BGE_JUMBO_BUFF_RING].hw_rcb);
3314 		bge_reg_putrcb(bgep, MINI_RCV_BD_RING_RCB_REG,
3315 			&bgep->buff[BGE_MINI_BUFF_RING].hw_rcb);
3316 	}
3317 
3318 	/*
3319 	 * Step 40: set Receive Buffer Descriptor Ring replenish thresholds
3320 	 */
3321 	bge_reg_put32(bgep, STD_RCV_BD_REPLENISH_REG, bge_replenish_std);
3322 	if (DEVICE_5704_SERIES_CHIPSETS(bgep)) {
3323 		bge_reg_put32(bgep, JUMBO_RCV_BD_REPLENISH_REG,
3324 		    bge_replenish_jumbo);
3325 		bge_reg_put32(bgep, MINI_RCV_BD_REPLENISH_REG,
3326 		    bge_replenish_mini);
3327 	}
3328 
3329 	/*
3330 	 * Steps 41-43: clear Send Ring Producer Indices and initialise
3331 	 * Send Producer Rings (0x0100-0x01ff in NIC-local memory)
3332 	 */
3333 	if (DEVICE_5704_SERIES_CHIPSETS(bgep))
3334 		maxring = BGE_SEND_RINGS_MAX;
3335 	else
3336 		maxring = BGE_SEND_RINGS_MAX_5705;
3337 	for (ring = 0; ring < maxring; ++ring) {
3338 		bge_mbx_put(bgep, SEND_RING_HOST_INDEX_REG(ring), 0);
3339 		bge_mbx_put(bgep, SEND_RING_NIC_INDEX_REG(ring), 0);
3340 		bge_nic_putrcb(bgep, NIC_MEM_SEND_RING(ring),
3341 			&bgep->send[ring].hw_rcb);
3342 	}
3343 
3344 	/*
3345 	 * Steps 44-45: initialise Receive Return Rings
3346 	 * (0x0200-0x02ff in NIC-local memory)
3347 	 */
3348 	if (DEVICE_5704_SERIES_CHIPSETS(bgep))
3349 		maxring = BGE_RECV_RINGS_MAX;
3350 	else
3351 		maxring = BGE_RECV_RINGS_MAX_5705;
3352 	for (ring = 0; ring < maxring; ++ring)
3353 		bge_nic_putrcb(bgep, NIC_MEM_RECV_RING(ring),
3354 			&bgep->recv[ring].hw_rcb);
3355 
3356 	/*
3357 	 * Step 46: initialise Receive Buffer (Producer) Ring indexes
3358 	 */
3359 	bge_mbx_put(bgep, RECV_STD_PROD_INDEX_REG, 0);
3360 	if (DEVICE_5704_SERIES_CHIPSETS(bgep)) {
3361 		bge_mbx_put(bgep, RECV_JUMBO_PROD_INDEX_REG, 0);
3362 		bge_mbx_put(bgep, RECV_MINI_PROD_INDEX_REG, 0);
3363 	}
3364 	/*
3365 	 * Step 47: configure the MAC unicast address
3366 	 * Step 48: configure the random backoff seed
3367 	 * Step 96: set up multicast filters
3368 	 */
3369 #ifdef BGE_IPMI_ASF
3370 	if (bge_chip_sync(bgep, B_FALSE) == DDI_FAILURE)
3371 #else
3372 	if (bge_chip_sync(bgep) == DDI_FAILURE)
3373 #endif
3374 		retval = DDI_FAILURE;
3375 
3376 	/*
3377 	 * Step 49: configure the MTU
3378 	 */
3379 	mtu = bgep->chipid.ethmax_size+ETHERFCSL+VLAN_TAGSZ;
3380 	bge_reg_put32(bgep, MAC_RX_MTU_SIZE_REG, mtu);
3381 
3382 	/*
3383 	 * Step 50: configure the IPG et al
3384 	 */
3385 	bge_reg_put32(bgep, MAC_TX_LENGTHS_REG, MAC_TX_LENGTHS_DEFAULT);
3386 
3387 	/*
3388 	 * Step 51: configure the default Rx Return Ring
3389 	 */
3390 	bge_reg_put32(bgep, RCV_RULES_CONFIG_REG, RCV_RULES_CONFIG_DEFAULT);
3391 
3392 	/*
3393 	 * Steps 52-54: configure Receive List Placement,
3394 	 * and enable Receive List Placement Statistics
3395 	 */
3396 	bge_reg_put32(bgep, RCV_LP_CONFIG_REG,
3397 		RCV_LP_CONFIG(bgep->chipid.rx_rings));
3398 	bge_reg_put32(bgep, RCV_LP_STATS_ENABLE_MASK_REG, ~0);
3399 	bge_reg_set32(bgep, RCV_LP_STATS_CONTROL_REG, RCV_LP_STATS_ENABLE);
3400 
3401 	if (bgep->chipid.rx_rings > 1)
3402 		bge_init_recv_rule(bgep);
3403 
3404 	/*
3405 	 * Steps 55-56: enable Send Data Initiator Statistics
3406 	 */
3407 	bge_reg_put32(bgep, SEND_INIT_STATS_ENABLE_MASK_REG, ~0);
3408 	if (DEVICE_5704_SERIES_CHIPSETS(bgep)) {
3409 		bge_reg_put32(bgep, SEND_INIT_STATS_CONTROL_REG,
3410 		    SEND_INIT_STATS_ENABLE | SEND_INIT_STATS_FASTER);
3411 	} else {
3412 		bge_reg_put32(bgep, SEND_INIT_STATS_CONTROL_REG,
3413 		    SEND_INIT_STATS_ENABLE);
3414 	}
3415 	/*
3416 	 * Steps 57-58: stop (?) the Host Coalescing Engine
3417 	 */
3418 	if (!bge_chip_disable_engine(bgep, HOST_COALESCE_MODE_REG, ~0))
3419 		retval = DDI_FAILURE;
3420 
3421 	/*
3422 	 * Steps 59-62: initialise Host Coalescing parameters
3423 	 */
3424 	bge_reg_put32(bgep, SEND_COALESCE_MAX_BD_REG, bge_tx_count_norm);
3425 	bge_reg_put32(bgep, SEND_COALESCE_TICKS_REG, bge_tx_ticks_norm);
3426 	bge_reg_put32(bgep, RCV_COALESCE_MAX_BD_REG, bge_rx_count_norm);
3427 	bge_reg_put32(bgep, RCV_COALESCE_TICKS_REG, bge_rx_ticks_norm);
3428 	if (DEVICE_5704_SERIES_CHIPSETS(bgep)) {
3429 		bge_reg_put32(bgep, SEND_COALESCE_INT_BD_REG,
3430 		    bge_tx_count_intr);
3431 		bge_reg_put32(bgep, SEND_COALESCE_INT_TICKS_REG,
3432 		    bge_tx_ticks_intr);
3433 		bge_reg_put32(bgep, RCV_COALESCE_INT_BD_REG,
3434 		    bge_rx_count_intr);
3435 		bge_reg_put32(bgep, RCV_COALESCE_INT_TICKS_REG,
3436 		    bge_rx_ticks_intr);
3437 	}
3438 
3439 	/*
3440 	 * Steps 63-64: initialise status block & statistics
3441 	 * host memory addresses
3442 	 * The statistic block does not exist in some chipsets
3443 	 * Step 65: initialise Statistics Coalescing Tick Counter
3444 	 */
3445 	bge_reg_put64(bgep, STATUS_BLOCK_HOST_ADDR_REG,
3446 		bgep->status_block.cookie.dmac_laddress);
3447 
3448 	/*
3449 	 * Steps 66-67: initialise status block & statistics
3450 	 * NIC-local memory addresses
3451 	 */
3452 	if (DEVICE_5704_SERIES_CHIPSETS(bgep)) {
3453 		bge_reg_put64(bgep, STATISTICS_HOST_ADDR_REG,
3454 		    bgep->statistics.cookie.dmac_laddress);
3455 		bge_reg_put32(bgep, STATISTICS_TICKS_REG,
3456 		    STATISTICS_TICKS_DEFAULT);
3457 		bge_reg_put32(bgep, STATUS_BLOCK_BASE_ADDR_REG,
3458 		    NIC_MEM_STATUS_BLOCK);
3459 		bge_reg_put32(bgep, STATISTICS_BASE_ADDR_REG,
3460 		    NIC_MEM_STATISTICS);
3461 	}
3462 
3463 	/*
3464 	 * Steps 68-71: start the Host Coalescing Engine, the Receive BD
3465 	 * Completion Engine, the Receive List Placement Engine, and the
3466 	 * Receive List selector.Pay attention:0x3400 is not exist in BCM5714
3467 	 * and BCM5715.
3468 	 */
3469 	if (bgep->chipid.tx_rings <= COALESCE_64_BYTE_RINGS &&
3470 	    bgep->chipid.rx_rings <= COALESCE_64_BYTE_RINGS)
3471 		coalmode = COALESCE_64_BYTE_STATUS;
3472 	else
3473 		coalmode = 0;
3474 	if (!bge_chip_enable_engine(bgep, HOST_COALESCE_MODE_REG, coalmode))
3475 		retval = DDI_FAILURE;
3476 	if (!bge_chip_enable_engine(bgep, RCV_BD_COMPLETION_MODE_REG,
3477 	    STATE_MACHINE_ATTN_ENABLE_BIT))
3478 		retval = DDI_FAILURE;
3479 	if (!bge_chip_enable_engine(bgep, RCV_LIST_PLACEMENT_MODE_REG, 0))
3480 		retval = DDI_FAILURE;
3481 
3482 	if (DEVICE_5704_SERIES_CHIPSETS(bgep))
3483 		if (!bge_chip_enable_engine(bgep, RCV_LIST_SELECTOR_MODE_REG,
3484 		    STATE_MACHINE_ATTN_ENABLE_BIT))
3485 			retval = DDI_FAILURE;
3486 
3487 	/*
3488 	 * Step 72: Enable MAC DMA engines
3489 	 * Step 73: Clear & enable MAC statistics
3490 	 */
3491 	bge_reg_set32(bgep, ETHERNET_MAC_MODE_REG,
3492 		ETHERNET_MODE_ENABLE_FHDE |
3493 		ETHERNET_MODE_ENABLE_RDE |
3494 		ETHERNET_MODE_ENABLE_TDE);
3495 	bge_reg_set32(bgep, ETHERNET_MAC_MODE_REG,
3496 		ETHERNET_MODE_ENABLE_TX_STATS |
3497 		ETHERNET_MODE_ENABLE_RX_STATS |
3498 		ETHERNET_MODE_CLEAR_TX_STATS |
3499 		ETHERNET_MODE_CLEAR_RX_STATS);
3500 
3501 	/*
3502 	 * Step 74: configure the MLCR (Miscellaneous Local Control
3503 	 * Register); not required, as we set up the MLCR in step 10
3504 	 * (part of the reset code) above.
3505 	 *
3506 	 * Step 75: clear Interrupt Mailbox 0
3507 	 */
3508 	bge_mbx_put(bgep, INTERRUPT_MBOX_0_REG, 0);
3509 
3510 	/*
3511 	 * Steps 76-87: Gentlemen, start your engines ...
3512 	 *
3513 	 * Enable the DMA Completion Engine, the Write DMA Engine,
3514 	 * the Read DMA Engine, Receive Data Completion Engine,
3515 	 * the MBuf Cluster Free Engine, the Send Data Completion Engine,
3516 	 * the Send BD Completion Engine, the Receive BD Initiator Engine,
3517 	 * the Receive Data Initiator Engine, the Send Data Initiator Engine,
3518 	 * the Send BD Initiator Engine, and the Send BD Selector Engine.
3519 	 *
3520 	 * Beware exhaust fumes?
3521 	 */
3522 	if (DEVICE_5704_SERIES_CHIPSETS(bgep))
3523 		if (!bge_chip_enable_engine(bgep, DMA_COMPLETION_MODE_REG, 0))
3524 			retval = DDI_FAILURE;
3525 	if (!bge_chip_enable_engine(bgep, WRITE_DMA_MODE_REG,
3526 	    (bge_dma_wrprio << DMA_PRIORITY_SHIFT) | ALL_DMA_ATTN_BITS))
3527 		retval = DDI_FAILURE;
3528 	if (!bge_chip_enable_engine(bgep, READ_DMA_MODE_REG,
3529 	    (bge_dma_rdprio << DMA_PRIORITY_SHIFT) | ALL_DMA_ATTN_BITS))
3530 		retval = DDI_FAILURE;
3531 	if (!bge_chip_enable_engine(bgep, RCV_DATA_COMPLETION_MODE_REG,
3532 	    STATE_MACHINE_ATTN_ENABLE_BIT))
3533 		retval = DDI_FAILURE;
3534 	if (DEVICE_5704_SERIES_CHIPSETS(bgep))
3535 		if (!bge_chip_enable_engine(bgep,
3536 		    MBUF_CLUSTER_FREE_MODE_REG, 0))
3537 			retval = DDI_FAILURE;
3538 	if (!bge_chip_enable_engine(bgep, SEND_DATA_COMPLETION_MODE_REG, 0))
3539 		retval = DDI_FAILURE;
3540 	if (!bge_chip_enable_engine(bgep, SEND_BD_COMPLETION_MODE_REG,
3541 	    STATE_MACHINE_ATTN_ENABLE_BIT))
3542 		retval = DDI_FAILURE;
3543 	if (!bge_chip_enable_engine(bgep, RCV_BD_INITIATOR_MODE_REG,
3544 	    RCV_BD_DISABLED_RING_ATTN))
3545 		retval = DDI_FAILURE;
3546 	if (!bge_chip_enable_engine(bgep, RCV_DATA_BD_INITIATOR_MODE_REG,
3547 	    RCV_DATA_BD_ILL_RING_ATTN))
3548 		retval = DDI_FAILURE;
3549 	if (!bge_chip_enable_engine(bgep, SEND_DATA_INITIATOR_MODE_REG, 0))
3550 		retval = DDI_FAILURE;
3551 	if (!bge_chip_enable_engine(bgep, SEND_BD_INITIATOR_MODE_REG,
3552 	    STATE_MACHINE_ATTN_ENABLE_BIT))
3553 		retval = DDI_FAILURE;
3554 	if (!bge_chip_enable_engine(bgep, SEND_BD_SELECTOR_MODE_REG,
3555 	    STATE_MACHINE_ATTN_ENABLE_BIT))
3556 		retval = DDI_FAILURE;
3557 
3558 	/*
3559 	 * Step 88: download firmware -- doesn't apply
3560 	 * Steps 89-90: enable Transmit & Receive MAC Engines
3561 	 */
3562 	if (!bge_chip_enable_engine(bgep, TRANSMIT_MAC_MODE_REG, 0))
3563 		retval = DDI_FAILURE;
3564 #ifdef BGE_IPMI_ASF
3565 	if (!bgep->asf_enabled) {
3566 		if (!bge_chip_enable_engine(bgep, RECEIVE_MAC_MODE_REG,
3567 		    RECEIVE_MODE_KEEP_VLAN_TAG))
3568 			retval = DDI_FAILURE;
3569 	} else {
3570 		if (!bge_chip_enable_engine(bgep, RECEIVE_MAC_MODE_REG, 0))
3571 			retval = DDI_FAILURE;
3572 	}
3573 #else
3574 	if (!bge_chip_enable_engine(bgep, RECEIVE_MAC_MODE_REG,
3575 	    RECEIVE_MODE_KEEP_VLAN_TAG))
3576 		retval = DDI_FAILURE;
3577 #endif
3578 
3579 	/*
3580 	 * Step 91: disable auto-polling of PHY status
3581 	 */
3582 	bge_reg_put32(bgep, MI_MODE_REG, MI_MODE_DEFAULT);
3583 
3584 	/*
3585 	 * Step 92: configure D0 power state (not required)
3586 	 * Step 93: initialise LED control register ()
3587 	 */
3588 	ledctl = LED_CONTROL_DEFAULT;
3589 	switch (bgep->chipid.device) {
3590 	case DEVICE_ID_5700:
3591 	case DEVICE_ID_5700x:
3592 	case DEVICE_ID_5701:
3593 		/*
3594 		 * Switch to 5700 (MAC) mode on these older chips
3595 		 */
3596 		ledctl &= ~LED_CONTROL_LED_MODE_MASK;
3597 		ledctl |= LED_CONTROL_LED_MODE_5700;
3598 		break;
3599 
3600 	default:
3601 		break;
3602 	}
3603 	bge_reg_put32(bgep, ETHERNET_MAC_LED_CONTROL_REG, ledctl);
3604 
3605 	/*
3606 	 * Step 94: activate link
3607 	 */
3608 	bge_reg_put32(bgep, MI_STATUS_REG, MI_STATUS_LINK);
3609 
3610 	/*
3611 	 * Step 95: set up physical layer (PHY/SerDes)
3612 	 * restart autoneg (if required)
3613 	 */
3614 	if (reset_phys)
3615 		if (bge_phys_update(bgep) == DDI_FAILURE)
3616 			retval = DDI_FAILURE;
3617 
3618 	/*
3619 	 * Extra step (DSG): hand over all the Receive Buffers to the chip
3620 	 */
3621 	for (ring = 0; ring < BGE_BUFF_RINGS_USED; ++ring)
3622 		bge_mbx_put(bgep, bgep->buff[ring].chip_mbx_reg,
3623 			bgep->buff[ring].rf_next);
3624 
3625 	/*
3626 	 * MSI bits:The least significant MSI 16-bit word.
3627 	 * ISR will be triggered different.
3628 	 */
3629 	if (bgep->intr_type == DDI_INTR_TYPE_MSI)
3630 		bge_reg_set32(bgep, HOST_COALESCE_MODE_REG, 0x70);
3631 
3632 	/*
3633 	 * Extra step (DSG): select which interrupts are enabled
3634 	 *
3635 	 * Program the Ethernet MAC engine to signal attention on
3636 	 * Link Change events, then enable interrupts on MAC, DMA,
3637 	 * and FLOW attention signals.
3638 	 */
3639 	bge_reg_set32(bgep, ETHERNET_MAC_EVENT_ENABLE_REG,
3640 		ETHERNET_EVENT_LINK_INT |
3641 		ETHERNET_STATUS_PCS_ERROR_INT);
3642 #ifdef BGE_IPMI_ASF
3643 	if (bgep->asf_enabled) {
3644 		bge_reg_set32(bgep, MODE_CONTROL_REG,
3645 			MODE_INT_ON_FLOW_ATTN |
3646 			MODE_INT_ON_DMA_ATTN |
3647 			MODE_HOST_STACK_UP|
3648 			MODE_INT_ON_MAC_ATTN);
3649 	} else {
3650 #endif
3651 		bge_reg_set32(bgep, MODE_CONTROL_REG,
3652 			MODE_INT_ON_FLOW_ATTN |
3653 			MODE_INT_ON_DMA_ATTN |
3654 			MODE_INT_ON_MAC_ATTN);
3655 #ifdef BGE_IPMI_ASF
3656 	}
3657 #endif
3658 
3659 	/*
3660 	 * Step 97: enable PCI interrupts!!!
3661 	 */
3662 	if (bgep->intr_type == DDI_INTR_TYPE_FIXED)
3663 		bge_cfg_clr32(bgep, PCI_CONF_BGE_MHCR,
3664 		    MHCR_MASK_PCI_INT_OUTPUT);
3665 
3666 	/*
3667 	 * All done!
3668 	 */
3669 	bgep->bge_chip_state = BGE_CHIP_RUNNING;
3670 	return (retval);
3671 }
3672 
3673 
3674 /*
3675  * ========== Hardware interrupt handler ==========
3676  */
3677 
3678 #undef	BGE_DBG
3679 #define	BGE_DBG		BGE_DBG_INT	/* debug flag for this code	*/
3680 
3681 /*
3682  * Sync the status block, then atomically clear the specified bits in
3683  * the <flags-and-tag> field of the status block.
3684  * the <flags> word of the status block, returning the value of the
3685  * <tag> and the <flags> before the bits were cleared.
3686  */
3687 static int bge_status_sync(bge_t *bgep, uint64_t bits, uint64_t *flags);
3688 #pragma	inline(bge_status_sync)
3689 
3690 static int
3691 bge_status_sync(bge_t *bgep, uint64_t bits, uint64_t *flags)
3692 {
3693 	bge_status_t *bsp;
3694 	int retval;
3695 
3696 	BGE_TRACE(("bge_status_sync($%p, 0x%llx)",
3697 		(void *)bgep, bits));
3698 
3699 	ASSERT(bgep->bge_guard == BGE_GUARD);
3700 
3701 	DMA_SYNC(bgep->status_block, DDI_DMA_SYNC_FORKERNEL);
3702 	retval = bge_check_dma_handle(bgep, bgep->status_block.dma_hdl);
3703 	if (retval != DDI_FM_OK)
3704 		return (retval);
3705 
3706 	bsp = DMA_VPTR(bgep->status_block);
3707 	*flags = bge_atomic_clr64(&bsp->flags_n_tag, bits);
3708 
3709 	BGE_DEBUG(("bge_status_sync($%p, 0x%llx) returning 0x%llx",
3710 		(void *)bgep, bits, *flags));
3711 
3712 	return (retval);
3713 }
3714 
3715 static void bge_wake_factotum(bge_t *bgep);
3716 #pragma	inline(bge_wake_factotum)
3717 
3718 static void
3719 bge_wake_factotum(bge_t *bgep)
3720 {
3721 	mutex_enter(bgep->softintrlock);
3722 	if (bgep->factotum_flag == 0) {
3723 		bgep->factotum_flag = 1;
3724 		ddi_trigger_softintr(bgep->factotum_id);
3725 	}
3726 	mutex_exit(bgep->softintrlock);
3727 }
3728 
3729 /*
3730  *	bge_intr() -- handle chip interrupts
3731  */
3732 uint_t bge_intr(caddr_t arg1, caddr_t arg2);
3733 #pragma	no_inline(bge_intr)
3734 
3735 uint_t
3736 bge_intr(caddr_t arg1, caddr_t arg2)
3737 {
3738 	bge_t *bgep = (bge_t *)arg1;		/* private device info	*/
3739 	bge_status_t *bsp;
3740 	uint64_t flags;
3741 	uint32_t mlcr = 0;
3742 	uint_t result;
3743 	int retval;
3744 
3745 	BGE_TRACE(("bge_intr($%p) ($%p)", arg1, arg2));
3746 
3747 	/*
3748 	 * GLD v2 checks that s/w setup is complete before passing
3749 	 * interrupts to this routine, thus eliminating the old
3750 	 * (and well-known) race condition around ddi_add_intr()
3751 	 */
3752 	ASSERT(bgep->progress & PROGRESS_HWINT);
3753 
3754 	/*
3755 	 * Check whether chip's says it's asserting #INTA;
3756 	 * if not, don't process or claim the interrupt.
3757 	 *
3758 	 * Note that the PCI signal is active low, so the
3759 	 * bit is *zero* when the interrupt is asserted.
3760 	 */
3761 	result = DDI_INTR_UNCLAIMED;
3762 	mutex_enter(bgep->genlock);
3763 
3764 	if (bgep->intr_type == DDI_INTR_TYPE_FIXED)
3765 		mlcr = bge_reg_get32(bgep, MISC_LOCAL_CONTROL_REG);
3766 
3767 	BGE_DEBUG(("bge_intr($%p) ($%p) mlcr 0x%08x", arg1, arg2, mlcr));
3768 
3769 	if ((mlcr & MLCR_INTA_STATE) == 0) {
3770 		/*
3771 		 * Block further PCI interrupts ...
3772 		 */
3773 		result = DDI_INTR_CLAIMED;
3774 
3775 		if (bgep->intr_type == DDI_INTR_TYPE_FIXED) {
3776 			bge_reg_set32(bgep, PCI_CONF_BGE_MHCR,
3777 				MHCR_MASK_PCI_INT_OUTPUT);
3778 			if (bge_check_acc_handle(bgep, bgep->cfg_handle) !=
3779 			    DDI_FM_OK)
3780 				goto chip_stop;
3781 		}
3782 
3783 		/*
3784 		 * Sync the status block and grab the flags-n-tag from it.
3785 		 * We count the number of interrupts where there doesn't
3786 		 * seem to have been a DMA update of the status block; if
3787 		 * it *has* been updated, the counter will be cleared in
3788 		 * the while() loop below ...
3789 		 */
3790 		bgep->missed_dmas += 1;
3791 		bsp = DMA_VPTR(bgep->status_block);
3792 		for (;;) {
3793 			if (bgep->bge_chip_state != BGE_CHIP_RUNNING) {
3794 				/*
3795 				 * bge_chip_stop() may have freed dma area etc
3796 				 * while we were in this interrupt handler -
3797 				 * better not call bge_status_sync()
3798 				 */
3799 				(void) bge_check_acc_handle(bgep,
3800 				    bgep->io_handle);
3801 				mutex_exit(bgep->genlock);
3802 				return (DDI_INTR_CLAIMED);
3803 			}
3804 			retval = bge_status_sync(bgep, STATUS_FLAG_UPDATED,
3805 			    &flags);
3806 			if (retval != DDI_FM_OK) {
3807 				bgep->bge_dma_error = B_TRUE;
3808 				goto chip_stop;
3809 			}
3810 
3811 			if (!(flags & STATUS_FLAG_UPDATED))
3812 				break;
3813 
3814 			/*
3815 			 * Tell the chip that we're processing the interrupt
3816 			 */
3817 			bge_mbx_put(bgep, INTERRUPT_MBOX_0_REG,
3818 				INTERRUPT_MBOX_DISABLE(flags));
3819 			if (bge_check_acc_handle(bgep, bgep->io_handle) !=
3820 			    DDI_FM_OK)
3821 				goto chip_stop;
3822 
3823 			/*
3824 			 * Drop the mutex while we:
3825 			 * 	Receive any newly-arrived packets
3826 			 *	Recycle any newly-finished send buffers
3827 			 */
3828 			bgep->bge_intr_running = B_TRUE;
3829 			mutex_exit(bgep->genlock);
3830 			bge_receive(bgep, bsp);
3831 			bge_recycle(bgep, bsp);
3832 			mutex_enter(bgep->genlock);
3833 			bgep->bge_intr_running = B_FALSE;
3834 
3835 			/*
3836 			 * Tell the chip we've finished processing, and
3837 			 * give it the tag that we got from the status
3838 			 * block earlier, so that it knows just how far
3839 			 * we've gone.  If it's got more for us to do,
3840 			 * it will now update the status block and try
3841 			 * to assert an interrupt (but we've got the
3842 			 * #INTA blocked at present).  If we see the
3843 			 * update, we'll loop around to do some more.
3844 			 * Eventually we'll get out of here ...
3845 			 */
3846 			bge_mbx_put(bgep, INTERRUPT_MBOX_0_REG,
3847 				INTERRUPT_MBOX_ENABLE(flags));
3848 			bgep->missed_dmas = 0;
3849 		}
3850 
3851 		/*
3852 		 * Check for exceptional conditions that we need to handle
3853 		 *
3854 		 * Link status changed
3855 		 * Status block not updated
3856 		 */
3857 		if (flags & STATUS_FLAG_LINK_CHANGED)
3858 			bge_wake_factotum(bgep);
3859 
3860 		if (bgep->missed_dmas) {
3861 			/*
3862 			 * Probably due to the internal status tag not
3863 			 * being reset.  Force a status block update now;
3864 			 * this should ensure that we get an update and
3865 			 * a new interrupt.  After that, we should be in
3866 			 * sync again ...
3867 			 */
3868 			BGE_REPORT((bgep, "interrupt: flags 0x%llx - "
3869 				"not updated?", flags));
3870 			bge_reg_set32(bgep, HOST_COALESCE_MODE_REG,
3871 				COALESCE_NOW);
3872 
3873 			if (bgep->missed_dmas >= bge_dma_miss_limit) {
3874 				/*
3875 				 * If this happens multiple times in a row,
3876 				 * it means DMA is just not working.  Maybe
3877 				 * the chip's failed, or maybe there's a
3878 				 * problem on the PCI bus or in the host-PCI
3879 				 * bridge (Tomatillo).
3880 				 *
3881 				 * At all events, we want to stop further
3882 				 * interrupts and let the recovery code take
3883 				 * over to see whether anything can be done
3884 				 * about it ...
3885 				 */
3886 				bge_fm_ereport(bgep,
3887 				    DDI_FM_DEVICE_BADINT_LIMIT);
3888 				goto chip_stop;
3889 			}
3890 		}
3891 
3892 		/*
3893 		 * Reenable assertion of #INTA, unless there's a DMA fault
3894 		 */
3895 		if (result == DDI_INTR_CLAIMED) {
3896 			if (bgep->intr_type == DDI_INTR_TYPE_FIXED) {
3897 				bge_reg_clr32(bgep, PCI_CONF_BGE_MHCR,
3898 					MHCR_MASK_PCI_INT_OUTPUT);
3899 				if (bge_check_acc_handle(bgep,
3900 				    bgep->cfg_handle) != DDI_FM_OK)
3901 					goto chip_stop;
3902 			}
3903 		}
3904 	}
3905 
3906 	if (bge_check_acc_handle(bgep, bgep->io_handle) != DDI_FM_OK)
3907 		goto chip_stop;
3908 
3909 	mutex_exit(bgep->genlock);
3910 	return (result);
3911 
3912 chip_stop:
3913 #ifdef BGE_IPMI_ASF
3914 	if (bgep->asf_enabled && bgep->asf_status == ASF_STAT_RUN) {
3915 		/*
3916 		 * We must stop ASF heart beat before
3917 		 * bge_chip_stop(), otherwise some
3918 		 * computers (ex. IBM HS20 blade
3919 		 * server) may crash.
3920 		 */
3921 		bge_asf_update_status(bgep);
3922 		bge_asf_stop_timer(bgep);
3923 		bgep->asf_status = ASF_STAT_STOP;
3924 
3925 		bge_asf_pre_reset_operations(bgep, BGE_INIT_RESET);
3926 		(void) bge_check_acc_handle(bgep, bgep->cfg_handle);
3927 	}
3928 #endif
3929 	bge_chip_stop(bgep, B_TRUE);
3930 	(void) bge_check_acc_handle(bgep, bgep->io_handle);
3931 	mutex_exit(bgep->genlock);
3932 	return (result);
3933 }
3934 
3935 /*
3936  * ========== Factotum, implemented as a softint handler ==========
3937  */
3938 
3939 #undef	BGE_DBG
3940 #define	BGE_DBG		BGE_DBG_FACT	/* debug flag for this code	*/
3941 
3942 static void bge_factotum_error_handler(bge_t *bgep);
3943 #pragma	no_inline(bge_factotum_error_handler)
3944 
3945 static void
3946 bge_factotum_error_handler(bge_t *bgep)
3947 {
3948 	uint32_t flow;
3949 	uint32_t rdma;
3950 	uint32_t wdma;
3951 	uint32_t tmac;
3952 	uint32_t rmac;
3953 	uint32_t rxrs;
3954 	uint32_t txrs = 0;
3955 
3956 	ASSERT(mutex_owned(bgep->genlock));
3957 
3958 	/*
3959 	 * Read all the registers that show the possible
3960 	 * reasons for the ERROR bit to be asserted
3961 	 */
3962 	flow = bge_reg_get32(bgep, FLOW_ATTN_REG);
3963 	rdma = bge_reg_get32(bgep, READ_DMA_STATUS_REG);
3964 	wdma = bge_reg_get32(bgep, WRITE_DMA_STATUS_REG);
3965 	tmac = bge_reg_get32(bgep, TRANSMIT_MAC_STATUS_REG);
3966 	rmac = bge_reg_get32(bgep, RECEIVE_MAC_STATUS_REG);
3967 	rxrs = bge_reg_get32(bgep, RX_RISC_STATE_REG);
3968 	if (DEVICE_5704_SERIES_CHIPSETS(bgep))
3969 		txrs = bge_reg_get32(bgep, TX_RISC_STATE_REG);
3970 
3971 	BGE_DEBUG(("factotum($%p) flow 0x%x rdma 0x%x wdma 0x%x",
3972 		(void *)bgep, flow, rdma, wdma));
3973 	BGE_DEBUG(("factotum($%p) tmac 0x%x rmac 0x%x rxrs 0x%08x txrs 0x%08x",
3974 		(void *)bgep, tmac, rmac, rxrs, txrs));
3975 
3976 	/*
3977 	 * For now, just clear all the errors ...
3978 	 */
3979 	if (DEVICE_5704_SERIES_CHIPSETS(bgep))
3980 		bge_reg_put32(bgep, TX_RISC_STATE_REG, ~0);
3981 	bge_reg_put32(bgep, RX_RISC_STATE_REG, ~0);
3982 	bge_reg_put32(bgep, RECEIVE_MAC_STATUS_REG, ~0);
3983 	bge_reg_put32(bgep, WRITE_DMA_STATUS_REG, ~0);
3984 	bge_reg_put32(bgep, READ_DMA_STATUS_REG, ~0);
3985 	bge_reg_put32(bgep, FLOW_ATTN_REG, ~0);
3986 }
3987 
3988 /*
3989  * Handler for hardware link state change.
3990  *
3991  * When this routine is called, the hardware link state has changed
3992  * and the new state is reflected in the param_* variables.  Here
3993  * we must update the softstate, reprogram the MAC to match, and
3994  * record the change in the log and/or on the console.
3995  */
3996 static void bge_factotum_link_handler(bge_t *bgep);
3997 #pragma	no_inline(bge_factotum_link_handler)
3998 
3999 static void
4000 bge_factotum_link_handler(bge_t *bgep)
4001 {
4002 	void (*logfn)(bge_t *bgep, const char *fmt, ...);
4003 	const char *msg;
4004 	hrtime_t deltat;
4005 
4006 	ASSERT(mutex_owned(bgep->genlock));
4007 
4008 	/*
4009 	 * Update the s/w link_state
4010 	 */
4011 	if (bgep->param_link_up)
4012 		bgep->link_state = LINK_STATE_UP;
4013 	else
4014 		bgep->link_state = LINK_STATE_DOWN;
4015 
4016 	/*
4017 	 * Reprogram the MAC modes to match
4018 	 */
4019 	bge_sync_mac_modes(bgep);
4020 
4021 	/*
4022 	 * Finally, we have to decide whether to write a message
4023 	 * on the console or only in the log.  If the PHY has
4024 	 * been reprogrammed (at user request) "recently", then
4025 	 * the message only goes in the log.  Otherwise it's an
4026 	 * "unexpected" event, and it goes on the console as well.
4027 	 */
4028 	deltat = bgep->phys_event_time - bgep->phys_write_time;
4029 	if (deltat > BGE_LINK_SETTLE_TIME)
4030 		msg = "";
4031 	else if (bgep->param_link_up)
4032 		msg = bgep->link_up_msg;
4033 	else
4034 		msg = bgep->link_down_msg;
4035 
4036 	logfn = (msg == NULL || *msg == '\0') ? bge_notice : bge_log;
4037 	(*logfn)(bgep, "link %s%s", bgep->link_mode_msg, msg);
4038 }
4039 
4040 static boolean_t bge_factotum_link_check(bge_t *bgep, int *dma_state);
4041 #pragma	no_inline(bge_factotum_link_check)
4042 
4043 static boolean_t
4044 bge_factotum_link_check(bge_t *bgep, int *dma_state)
4045 {
4046 	boolean_t check;
4047 	uint64_t flags;
4048 	uint32_t tmac_status;
4049 
4050 	ASSERT(mutex_owned(bgep->genlock));
4051 
4052 	/*
4053 	 * Get & clear the writable status bits in the Tx status register
4054 	 * (some bits are write-1-to-clear, others are just readonly).
4055 	 */
4056 	tmac_status = bge_reg_get32(bgep, TRANSMIT_MAC_STATUS_REG);
4057 	bge_reg_put32(bgep, TRANSMIT_MAC_STATUS_REG, tmac_status);
4058 
4059 	/*
4060 	 * Get & clear the ERROR and LINK_CHANGED bits from the status block
4061 	 */
4062 	*dma_state = bge_status_sync(bgep, STATUS_FLAG_ERROR |
4063 	    STATUS_FLAG_LINK_CHANGED, &flags);
4064 	if (*dma_state != DDI_FM_OK)
4065 		return (B_FALSE);
4066 
4067 	/*
4068 	 * Clear any errors flagged in the status block ...
4069 	 */
4070 	if (flags & STATUS_FLAG_ERROR)
4071 		bge_factotum_error_handler(bgep);
4072 
4073 	/*
4074 	 * We need to check the link status if:
4075 	 *	the status block says there's been a link change
4076 	 *	or there's any discrepancy between the various
4077 	 *	flags indicating the link state (link_state,
4078 	 *	param_link_up, and the LINK STATE bit in the
4079 	 *	Transmit MAC status register).
4080 	 */
4081 	check = (flags & STATUS_FLAG_LINK_CHANGED) != 0;
4082 	switch (bgep->link_state) {
4083 	case LINK_STATE_UP:
4084 		check |= (bgep->param_link_up == B_FALSE);
4085 		check |= ((tmac_status & TRANSMIT_STATUS_LINK_UP) == 0);
4086 		break;
4087 
4088 	case LINK_STATE_DOWN:
4089 		check |= (bgep->param_link_up != B_FALSE);
4090 		check |= ((tmac_status & TRANSMIT_STATUS_LINK_UP) != 0);
4091 		break;
4092 
4093 	default:
4094 		check = B_TRUE;
4095 		break;
4096 	}
4097 
4098 	/*
4099 	 * If <check> is false, we're sure the link hasn't changed.
4100 	 * If true, however, it's not yet definitive; we have to call
4101 	 * bge_phys_check() to determine whether the link has settled
4102 	 * into a new state yet ... and if it has, then call the link
4103 	 * state change handler.But when the chip is 5700 in Dell 6650
4104 	 * ,even if check is false, the link may have changed.So we
4105 	 * have to call bge_phys_check() to determine the link state.
4106 	 */
4107 	if (check || bgep->chipid.device == DEVICE_ID_5700) {
4108 		check = bge_phys_check(bgep);
4109 		if (check)
4110 			bge_factotum_link_handler(bgep);
4111 	}
4112 
4113 	return (check);
4114 }
4115 
4116 /*
4117  * Factotum routine to check for Tx stall, using the 'watchdog' counter
4118  */
4119 static boolean_t bge_factotum_stall_check(bge_t *bgep);
4120 #pragma	no_inline(bge_factotum_stall_check)
4121 
4122 static boolean_t
4123 bge_factotum_stall_check(bge_t *bgep)
4124 {
4125 	uint32_t dogval;
4126 
4127 	ASSERT(mutex_owned(bgep->genlock));
4128 
4129 	/*
4130 	 * Specific check for Tx stall ...
4131 	 *
4132 	 * The 'watchdog' counter is incremented whenever a packet
4133 	 * is queued, reset to 1 when some (but not all) buffers
4134 	 * are reclaimed, reset to 0 (disabled) when all buffers
4135 	 * are reclaimed, and shifted left here.  If it exceeds the
4136 	 * threshold value, the chip is assumed to have stalled and
4137 	 * is put into the ERROR state.  The factotum will then reset
4138 	 * it on the next pass.
4139 	 *
4140 	 * All of which should ensure that we don't get into a state
4141 	 * where packets are left pending indefinitely!
4142 	 */
4143 	dogval = bge_atomic_shl32(&bgep->watchdog, 1);
4144 	if (dogval < bge_watchdog_count)
4145 		return (B_FALSE);
4146 
4147 	BGE_REPORT((bgep, "Tx stall detected, watchdog code 0x%x", dogval));
4148 	bge_fm_ereport(bgep, DDI_FM_DEVICE_STALL);
4149 	return (B_TRUE);
4150 }
4151 
4152 /*
4153  * The factotum is woken up when there's something to do that we'd rather
4154  * not do from inside a hardware interrupt handler or high-level cyclic.
4155  * Its two main tasks are:
4156  *	reset & restart the chip after an error
4157  *	check the link status whenever necessary
4158  */
4159 uint_t bge_chip_factotum(caddr_t arg);
4160 #pragma	no_inline(bge_chip_factotum)
4161 
4162 uint_t
4163 bge_chip_factotum(caddr_t arg)
4164 {
4165 	bge_t *bgep;
4166 	uint_t result;
4167 	boolean_t error;
4168 	boolean_t linkchg;
4169 	int dma_state;
4170 
4171 	bgep = (bge_t *)arg;
4172 
4173 	BGE_TRACE(("bge_chip_factotum($%p)", (void *)bgep));
4174 
4175 	mutex_enter(bgep->softintrlock);
4176 	if (bgep->factotum_flag == 0) {
4177 		mutex_exit(bgep->softintrlock);
4178 		return (DDI_INTR_UNCLAIMED);
4179 	}
4180 	bgep->factotum_flag = 0;
4181 	mutex_exit(bgep->softintrlock);
4182 
4183 	result = DDI_INTR_CLAIMED;
4184 	error = B_FALSE;
4185 	linkchg = B_FALSE;
4186 
4187 	mutex_enter(bgep->genlock);
4188 	switch (bgep->bge_chip_state) {
4189 	default:
4190 		break;
4191 
4192 	case BGE_CHIP_RUNNING:
4193 		linkchg = bge_factotum_link_check(bgep, &dma_state);
4194 		error = bge_factotum_stall_check(bgep);
4195 		if (dma_state != DDI_FM_OK) {
4196 			bgep->bge_dma_error = B_TRUE;
4197 			error = B_TRUE;
4198 		}
4199 		if (bge_check_acc_handle(bgep, bgep->io_handle) != DDI_FM_OK)
4200 			error = B_TRUE;
4201 		if (error)
4202 			bgep->bge_chip_state = BGE_CHIP_ERROR;
4203 		break;
4204 
4205 	case BGE_CHIP_ERROR:
4206 		error = B_TRUE;
4207 		break;
4208 
4209 	case BGE_CHIP_FAULT:
4210 		/*
4211 		 * Fault detected, time to reset ...
4212 		 */
4213 		if (bge_autorecover) {
4214 			if (!(bgep->progress & PROGRESS_BUFS)) {
4215 				/*
4216 				 * if we can't allocate the ring buffers,
4217 				 * try later
4218 				 */
4219 				if (bge_alloc_bufs(bgep) != DDI_SUCCESS) {
4220 					mutex_exit(bgep->genlock);
4221 					return (result);
4222 				}
4223 				bgep->progress |= PROGRESS_BUFS;
4224 			}
4225 			if (!(bgep->progress & PROGRESS_INTR)) {
4226 				bge_init_rings(bgep);
4227 				bge_intr_enable(bgep);
4228 				bgep->progress |= PROGRESS_INTR;
4229 			}
4230 			if (!(bgep->progress & PROGRESS_KSTATS)) {
4231 				bge_init_kstats(bgep,
4232 				    ddi_get_instance(bgep->devinfo));
4233 				bgep->progress |= PROGRESS_KSTATS;
4234 			}
4235 
4236 			BGE_REPORT((bgep, "automatic recovery activated"));
4237 
4238 			if (bge_restart(bgep, B_FALSE) != DDI_SUCCESS) {
4239 				bgep->bge_chip_state = BGE_CHIP_ERROR;
4240 				error = B_TRUE;
4241 			}
4242 			if (bge_check_acc_handle(bgep, bgep->cfg_handle) !=
4243 			    DDI_FM_OK) {
4244 				bgep->bge_chip_state = BGE_CHIP_ERROR;
4245 				error = B_TRUE;
4246 			}
4247 			if (bge_check_acc_handle(bgep, bgep->io_handle) !=
4248 			    DDI_FM_OK) {
4249 				bgep->bge_chip_state = BGE_CHIP_ERROR;
4250 				error = B_TRUE;
4251 			}
4252 			if (error == B_FALSE) {
4253 #ifdef BGE_IPMI_ASF
4254 				if (bgep->asf_enabled &&
4255 				    bgep->asf_status != ASF_STAT_RUN) {
4256 					bgep->asf_timeout_id = timeout(
4257 					    bge_asf_heartbeat, (void *)bgep,
4258 					    drv_usectohz(
4259 					    BGE_ASF_HEARTBEAT_INTERVAL));
4260 					bgep->asf_status = ASF_STAT_RUN;
4261 				}
4262 #endif
4263 				ddi_fm_service_impact(bgep->devinfo,
4264 				    DDI_SERVICE_RESTORED);
4265 			}
4266 		}
4267 		break;
4268 	}
4269 
4270 
4271 	/*
4272 	 * If an error is detected, stop the chip now, marking it as
4273 	 * faulty, so that it will be reset next time through ...
4274 	 *
4275 	 * Note that if intr_running is set, then bge_intr() has dropped
4276 	 * genlock to call bge_receive/bge_recycle. Can't stop the chip at
4277 	 * this point so have to wait until the next time the factotum runs.
4278 	 */
4279 	if (error && !bgep->bge_intr_running) {
4280 #ifdef BGE_IPMI_ASF
4281 		if (bgep->asf_enabled && (bgep->asf_status == ASF_STAT_RUN)) {
4282 			/*
4283 			 * We must stop ASF heart beat before bge_chip_stop(),
4284 			 * otherwise some computers (ex. IBM HS20 blade server)
4285 			 * may crash.
4286 			 */
4287 			bge_asf_update_status(bgep);
4288 			bge_asf_stop_timer(bgep);
4289 			bgep->asf_status = ASF_STAT_STOP;
4290 
4291 			bge_asf_pre_reset_operations(bgep, BGE_INIT_RESET);
4292 			(void) bge_check_acc_handle(bgep, bgep->cfg_handle);
4293 		}
4294 #endif
4295 		bge_chip_stop(bgep, B_TRUE);
4296 		(void) bge_check_acc_handle(bgep, bgep->io_handle);
4297 	}
4298 	mutex_exit(bgep->genlock);
4299 
4300 	/*
4301 	 * If the link state changed, tell the world about it.
4302 	 * Note: can't do this while still holding the mutex.
4303 	 */
4304 	if (linkchg)
4305 		mac_link_update(bgep->macp, bgep->link_state);
4306 
4307 	return (result);
4308 }
4309 
4310 /*
4311  * High-level cyclic handler
4312  *
4313  * This routine schedules a (low-level) softint callback to the
4314  * factotum, and prods the chip to update the status block (which
4315  * will cause a hardware interrupt when complete).
4316  */
4317 void bge_chip_cyclic(void *arg);
4318 #pragma	no_inline(bge_chip_cyclic)
4319 
4320 void
4321 bge_chip_cyclic(void *arg)
4322 {
4323 	bge_t *bgep;
4324 
4325 	bgep = arg;
4326 
4327 	switch (bgep->bge_chip_state) {
4328 	default:
4329 		return;
4330 
4331 	case BGE_CHIP_RUNNING:
4332 		bge_reg_set32(bgep, HOST_COALESCE_MODE_REG, COALESCE_NOW);
4333 		if (bge_check_acc_handle(bgep, bgep->io_handle) != DDI_FM_OK)
4334 			ddi_fm_service_impact(bgep->devinfo,
4335 			    DDI_SERVICE_UNAFFECTED);
4336 		break;
4337 
4338 	case BGE_CHIP_FAULT:
4339 	case BGE_CHIP_ERROR:
4340 		break;
4341 	}
4342 
4343 	bge_wake_factotum(bgep);
4344 }
4345 
4346 
4347 /*
4348  * ========== Ioctl subfunctions ==========
4349  */
4350 
4351 #undef	BGE_DBG
4352 #define	BGE_DBG		BGE_DBG_PPIO	/* debug flag for this code	*/
4353 
4354 #if	BGE_DEBUGGING || BGE_DO_PPIO
4355 
4356 static void bge_chip_peek_cfg(bge_t *bgep, bge_peekpoke_t *ppd);
4357 #pragma	no_inline(bge_chip_peek_cfg)
4358 
4359 static void
4360 bge_chip_peek_cfg(bge_t *bgep, bge_peekpoke_t *ppd)
4361 {
4362 	uint64_t regval;
4363 	uint64_t regno;
4364 
4365 	BGE_TRACE(("bge_chip_peek_cfg($%p, $%p)",
4366 		(void *)bgep, (void *)ppd));
4367 
4368 	regno = ppd->pp_acc_offset;
4369 
4370 	switch (ppd->pp_acc_size) {
4371 	case 1:
4372 		regval = pci_config_get8(bgep->cfg_handle, regno);
4373 		break;
4374 
4375 	case 2:
4376 		regval = pci_config_get16(bgep->cfg_handle, regno);
4377 		break;
4378 
4379 	case 4:
4380 		regval = pci_config_get32(bgep->cfg_handle, regno);
4381 		break;
4382 
4383 	case 8:
4384 		regval = pci_config_get64(bgep->cfg_handle, regno);
4385 		break;
4386 	}
4387 
4388 	ppd->pp_acc_data = regval;
4389 }
4390 
4391 static void bge_chip_poke_cfg(bge_t *bgep, bge_peekpoke_t *ppd);
4392 #pragma	no_inline(bge_chip_poke_cfg)
4393 
4394 static void
4395 bge_chip_poke_cfg(bge_t *bgep, bge_peekpoke_t *ppd)
4396 {
4397 	uint64_t regval;
4398 	uint64_t regno;
4399 
4400 	BGE_TRACE(("bge_chip_poke_cfg($%p, $%p)",
4401 		(void *)bgep, (void *)ppd));
4402 
4403 	regno = ppd->pp_acc_offset;
4404 	regval = ppd->pp_acc_data;
4405 
4406 	switch (ppd->pp_acc_size) {
4407 	case 1:
4408 		pci_config_put8(bgep->cfg_handle, regno, regval);
4409 		break;
4410 
4411 	case 2:
4412 		pci_config_put16(bgep->cfg_handle, regno, regval);
4413 		break;
4414 
4415 	case 4:
4416 		pci_config_put32(bgep->cfg_handle, regno, regval);
4417 		break;
4418 
4419 	case 8:
4420 		pci_config_put64(bgep->cfg_handle, regno, regval);
4421 		break;
4422 	}
4423 }
4424 
4425 static void bge_chip_peek_reg(bge_t *bgep, bge_peekpoke_t *ppd);
4426 #pragma	no_inline(bge_chip_peek_reg)
4427 
4428 static void
4429 bge_chip_peek_reg(bge_t *bgep, bge_peekpoke_t *ppd)
4430 {
4431 	uint64_t regval;
4432 	void *regaddr;
4433 
4434 	BGE_TRACE(("bge_chip_peek_reg($%p, $%p)",
4435 		(void *)bgep, (void *)ppd));
4436 
4437 	regaddr = PIO_ADDR(bgep, ppd->pp_acc_offset);
4438 
4439 	switch (ppd->pp_acc_size) {
4440 	case 1:
4441 		regval = ddi_get8(bgep->io_handle, regaddr);
4442 		break;
4443 
4444 	case 2:
4445 		regval = ddi_get16(bgep->io_handle, regaddr);
4446 		break;
4447 
4448 	case 4:
4449 		regval = ddi_get32(bgep->io_handle, regaddr);
4450 		break;
4451 
4452 	case 8:
4453 		regval = ddi_get64(bgep->io_handle, regaddr);
4454 		break;
4455 	}
4456 
4457 	ppd->pp_acc_data = regval;
4458 }
4459 
4460 static void bge_chip_poke_reg(bge_t *bgep, bge_peekpoke_t *ppd);
4461 #pragma	no_inline(bge_chip_peek_reg)
4462 
4463 static void
4464 bge_chip_poke_reg(bge_t *bgep, bge_peekpoke_t *ppd)
4465 {
4466 	uint64_t regval;
4467 	void *regaddr;
4468 
4469 	BGE_TRACE(("bge_chip_poke_reg($%p, $%p)",
4470 		(void *)bgep, (void *)ppd));
4471 
4472 	regaddr = PIO_ADDR(bgep, ppd->pp_acc_offset);
4473 	regval = ppd->pp_acc_data;
4474 
4475 	switch (ppd->pp_acc_size) {
4476 	case 1:
4477 		ddi_put8(bgep->io_handle, regaddr, regval);
4478 		break;
4479 
4480 	case 2:
4481 		ddi_put16(bgep->io_handle, regaddr, regval);
4482 		break;
4483 
4484 	case 4:
4485 		ddi_put32(bgep->io_handle, regaddr, regval);
4486 		break;
4487 
4488 	case 8:
4489 		ddi_put64(bgep->io_handle, regaddr, regval);
4490 		break;
4491 	}
4492 	BGE_PCICHK(bgep);
4493 }
4494 
4495 static void bge_chip_peek_nic(bge_t *bgep, bge_peekpoke_t *ppd);
4496 #pragma	no_inline(bge_chip_peek_nic)
4497 
4498 static void
4499 bge_chip_peek_nic(bge_t *bgep, bge_peekpoke_t *ppd)
4500 {
4501 	uint64_t regoff;
4502 	uint64_t regval;
4503 	void *regaddr;
4504 
4505 	BGE_TRACE(("bge_chip_peek_nic($%p, $%p)",
4506 		(void *)bgep, (void *)ppd));
4507 
4508 	regoff = ppd->pp_acc_offset;
4509 	bge_nic_setwin(bgep, regoff & ~MWBAR_GRANULE_MASK);
4510 	regoff &= MWBAR_GRANULE_MASK;
4511 	regoff += NIC_MEM_WINDOW_OFFSET;
4512 	regaddr = PIO_ADDR(bgep, regoff);
4513 
4514 	switch (ppd->pp_acc_size) {
4515 	case 1:
4516 		regval = ddi_get8(bgep->io_handle, regaddr);
4517 		break;
4518 
4519 	case 2:
4520 		regval = ddi_get16(bgep->io_handle, regaddr);
4521 		break;
4522 
4523 	case 4:
4524 		regval = ddi_get32(bgep->io_handle, regaddr);
4525 		break;
4526 
4527 	case 8:
4528 		regval = ddi_get64(bgep->io_handle, regaddr);
4529 		break;
4530 	}
4531 
4532 	ppd->pp_acc_data = regval;
4533 }
4534 
4535 static void bge_chip_poke_nic(bge_t *bgep, bge_peekpoke_t *ppd);
4536 #pragma	no_inline(bge_chip_poke_nic)
4537 
4538 static void
4539 bge_chip_poke_nic(bge_t *bgep, bge_peekpoke_t *ppd)
4540 {
4541 	uint64_t regoff;
4542 	uint64_t regval;
4543 	void *regaddr;
4544 
4545 	BGE_TRACE(("bge_chip_poke_nic($%p, $%p)",
4546 		(void *)bgep, (void *)ppd));
4547 
4548 	regoff = ppd->pp_acc_offset;
4549 	bge_nic_setwin(bgep, regoff & ~MWBAR_GRANULE_MASK);
4550 	regoff &= MWBAR_GRANULE_MASK;
4551 	regoff += NIC_MEM_WINDOW_OFFSET;
4552 	regaddr = PIO_ADDR(bgep, regoff);
4553 	regval = ppd->pp_acc_data;
4554 
4555 	switch (ppd->pp_acc_size) {
4556 	case 1:
4557 		ddi_put8(bgep->io_handle, regaddr, regval);
4558 		break;
4559 
4560 	case 2:
4561 		ddi_put16(bgep->io_handle, regaddr, regval);
4562 		break;
4563 
4564 	case 4:
4565 		ddi_put32(bgep->io_handle, regaddr, regval);
4566 		break;
4567 
4568 	case 8:
4569 		ddi_put64(bgep->io_handle, regaddr, regval);
4570 		break;
4571 	}
4572 	BGE_PCICHK(bgep);
4573 }
4574 
4575 static void bge_chip_peek_mii(bge_t *bgep, bge_peekpoke_t *ppd);
4576 #pragma	no_inline(bge_chip_peek_mii)
4577 
4578 static void
4579 bge_chip_peek_mii(bge_t *bgep, bge_peekpoke_t *ppd)
4580 {
4581 	BGE_TRACE(("bge_chip_peek_mii($%p, $%p)",
4582 		(void *)bgep, (void *)ppd));
4583 
4584 	ppd->pp_acc_data = bge_mii_get16(bgep, ppd->pp_acc_offset/2);
4585 }
4586 
4587 static void bge_chip_poke_mii(bge_t *bgep, bge_peekpoke_t *ppd);
4588 #pragma	no_inline(bge_chip_poke_mii)
4589 
4590 static void
4591 bge_chip_poke_mii(bge_t *bgep, bge_peekpoke_t *ppd)
4592 {
4593 	BGE_TRACE(("bge_chip_poke_mii($%p, $%p)",
4594 		(void *)bgep, (void *)ppd));
4595 
4596 	bge_mii_put16(bgep, ppd->pp_acc_offset/2, ppd->pp_acc_data);
4597 }
4598 
4599 #if	BGE_SEE_IO32
4600 
4601 static void bge_chip_peek_seeprom(bge_t *bgep, bge_peekpoke_t *ppd);
4602 #pragma	no_inline(bge_chip_peek_seeprom)
4603 
4604 static void
4605 bge_chip_peek_seeprom(bge_t *bgep, bge_peekpoke_t *ppd)
4606 {
4607 	uint32_t data;
4608 	int err;
4609 
4610 	BGE_TRACE(("bge_chip_peek_seeprom($%p, $%p)",
4611 		(void *)bgep, (void *)ppd));
4612 
4613 	err = bge_nvmem_rw32(bgep, BGE_SEE_READ, ppd->pp_acc_offset, &data);
4614 	ppd->pp_acc_data = err ? ~0ull : data;
4615 }
4616 
4617 static void bge_chip_poke_seeprom(bge_t *bgep, bge_peekpoke_t *ppd);
4618 #pragma	no_inline(bge_chip_poke_seeprom)
4619 
4620 static void
4621 bge_chip_poke_seeprom(bge_t *bgep, bge_peekpoke_t *ppd)
4622 {
4623 	uint32_t data;
4624 
4625 	BGE_TRACE(("bge_chip_poke_seeprom($%p, $%p)",
4626 		(void *)bgep, (void *)ppd));
4627 
4628 	data = ppd->pp_acc_data;
4629 	(void) bge_nvmem_rw32(bgep, BGE_SEE_WRITE, ppd->pp_acc_offset, &data);
4630 }
4631 #endif	/* BGE_SEE_IO32 */
4632 
4633 #if	BGE_FLASH_IO32
4634 
4635 static void bge_chip_peek_flash(bge_t *bgep, bge_peekpoke_t *ppd);
4636 #pragma	no_inline(bge_chip_peek_flash)
4637 
4638 static void
4639 bge_chip_peek_flash(bge_t *bgep, bge_peekpoke_t *ppd)
4640 {
4641 	uint32_t data;
4642 	int err;
4643 
4644 	BGE_TRACE(("bge_chip_peek_flash($%p, $%p)",
4645 		(void *)bgep, (void *)ppd));
4646 
4647 	err = bge_nvmem_rw32(bgep, BGE_FLASH_READ, ppd->pp_acc_offset, &data);
4648 	ppd->pp_acc_data = err ? ~0ull : data;
4649 }
4650 
4651 static void bge_chip_poke_flash(bge_t *bgep, bge_peekpoke_t *ppd);
4652 #pragma	no_inline(bge_chip_poke_flash)
4653 
4654 static void
4655 bge_chip_poke_flash(bge_t *bgep, bge_peekpoke_t *ppd)
4656 {
4657 	uint32_t data;
4658 
4659 	BGE_TRACE(("bge_chip_poke_flash($%p, $%p)",
4660 		(void *)bgep, (void *)ppd));
4661 
4662 	data = ppd->pp_acc_data;
4663 	(void) bge_nvmem_rw32(bgep, BGE_FLASH_WRITE,
4664 	    ppd->pp_acc_offset, &data);
4665 }
4666 #endif	/* BGE_FLASH_IO32 */
4667 
4668 static void bge_chip_peek_mem(bge_t *bgep, bge_peekpoke_t *ppd);
4669 #pragma	no_inline(bge_chip_peek_mem)
4670 
4671 static void
4672 bge_chip_peek_mem(bge_t *bgep, bge_peekpoke_t *ppd)
4673 {
4674 	uint64_t regval;
4675 	void *vaddr;
4676 
4677 	BGE_TRACE(("bge_chip_peek_bge($%p, $%p)",
4678 		(void *)bgep, (void *)ppd));
4679 
4680 	vaddr = (void *)(uintptr_t)ppd->pp_acc_offset;
4681 
4682 	switch (ppd->pp_acc_size) {
4683 	case 1:
4684 		regval = *(uint8_t *)vaddr;
4685 		break;
4686 
4687 	case 2:
4688 		regval = *(uint16_t *)vaddr;
4689 		break;
4690 
4691 	case 4:
4692 		regval = *(uint32_t *)vaddr;
4693 		break;
4694 
4695 	case 8:
4696 		regval = *(uint64_t *)vaddr;
4697 		break;
4698 	}
4699 
4700 	BGE_DEBUG(("bge_chip_peek_mem($%p, $%p) peeked 0x%llx from $%p",
4701 		(void *)bgep, (void *)ppd, regval, vaddr));
4702 
4703 	ppd->pp_acc_data = regval;
4704 }
4705 
4706 static void bge_chip_poke_mem(bge_t *bgep, bge_peekpoke_t *ppd);
4707 #pragma	no_inline(bge_chip_poke_mem)
4708 
4709 static void
4710 bge_chip_poke_mem(bge_t *bgep, bge_peekpoke_t *ppd)
4711 {
4712 	uint64_t regval;
4713 	void *vaddr;
4714 
4715 	BGE_TRACE(("bge_chip_poke_mem($%p, $%p)",
4716 		(void *)bgep, (void *)ppd));
4717 
4718 	vaddr = (void *)(uintptr_t)ppd->pp_acc_offset;
4719 	regval = ppd->pp_acc_data;
4720 
4721 	BGE_DEBUG(("bge_chip_poke_mem($%p, $%p) poking 0x%llx at $%p",
4722 		(void *)bgep, (void *)ppd, regval, vaddr));
4723 
4724 	switch (ppd->pp_acc_size) {
4725 	case 1:
4726 		*(uint8_t *)vaddr = (uint8_t)regval;
4727 		break;
4728 
4729 	case 2:
4730 		*(uint16_t *)vaddr = (uint16_t)regval;
4731 		break;
4732 
4733 	case 4:
4734 		*(uint32_t *)vaddr = (uint32_t)regval;
4735 		break;
4736 
4737 	case 8:
4738 		*(uint64_t *)vaddr = (uint64_t)regval;
4739 		break;
4740 	}
4741 }
4742 
4743 static enum ioc_reply bge_pp_ioctl(bge_t *bgep, int cmd, mblk_t *mp,
4744 					struct iocblk *iocp);
4745 #pragma	no_inline(bge_pp_ioctl)
4746 
4747 static enum ioc_reply
4748 bge_pp_ioctl(bge_t *bgep, int cmd, mblk_t *mp, struct iocblk *iocp)
4749 {
4750 	void (*ppfn)(bge_t *bgep, bge_peekpoke_t *ppd);
4751 	bge_peekpoke_t *ppd;
4752 	dma_area_t *areap;
4753 	uint64_t sizemask;
4754 	uint64_t mem_va;
4755 	uint64_t maxoff;
4756 	boolean_t peek;
4757 
4758 	switch (cmd) {
4759 	default:
4760 		/* NOTREACHED */
4761 		bge_error(bgep, "bge_pp_ioctl: invalid cmd 0x%x", cmd);
4762 		return (IOC_INVAL);
4763 
4764 	case BGE_PEEK:
4765 		peek = B_TRUE;
4766 		break;
4767 
4768 	case BGE_POKE:
4769 		peek = B_FALSE;
4770 		break;
4771 	}
4772 
4773 	/*
4774 	 * Validate format of ioctl
4775 	 */
4776 	if (iocp->ioc_count != sizeof (bge_peekpoke_t))
4777 		return (IOC_INVAL);
4778 	if (mp->b_cont == NULL)
4779 		return (IOC_INVAL);
4780 	ppd = (bge_peekpoke_t *)mp->b_cont->b_rptr;
4781 
4782 	/*
4783 	 * Validate request parameters
4784 	 */
4785 	switch (ppd->pp_acc_space) {
4786 	default:
4787 		return (IOC_INVAL);
4788 
4789 	case BGE_PP_SPACE_CFG:
4790 		/*
4791 		 * Config space
4792 		 */
4793 		sizemask = 8|4|2|1;
4794 		mem_va = 0;
4795 		maxoff = PCI_CONF_HDR_SIZE;
4796 		ppfn = peek ? bge_chip_peek_cfg : bge_chip_poke_cfg;
4797 		break;
4798 
4799 	case BGE_PP_SPACE_REG:
4800 		/*
4801 		 * Memory-mapped I/O space
4802 		 */
4803 		sizemask = 8|4|2|1;
4804 		mem_va = 0;
4805 		maxoff = RIAAR_REGISTER_MAX;
4806 		ppfn = peek ? bge_chip_peek_reg : bge_chip_poke_reg;
4807 		break;
4808 
4809 	case BGE_PP_SPACE_NIC:
4810 		/*
4811 		 * NIC on-chip memory
4812 		 */
4813 		sizemask = 8|4|2|1;
4814 		mem_va = 0;
4815 		maxoff = MWBAR_ONCHIP_MAX;
4816 		ppfn = peek ? bge_chip_peek_nic : bge_chip_poke_nic;
4817 		break;
4818 
4819 	case BGE_PP_SPACE_MII:
4820 		/*
4821 		 * PHY's MII registers
4822 		 * NB: all PHY registers are two bytes, but the
4823 		 * addresses increment in ones (word addressing).
4824 		 * So we scale the address here, then undo the
4825 		 * transformation inside the peek/poke functions.
4826 		 */
4827 		ppd->pp_acc_offset *= 2;
4828 		sizemask = 2;
4829 		mem_va = 0;
4830 		maxoff = (MII_MAXREG+1)*2;
4831 		ppfn = peek ? bge_chip_peek_mii : bge_chip_poke_mii;
4832 		break;
4833 
4834 #if	BGE_SEE_IO32
4835 	case BGE_PP_SPACE_SEEPROM:
4836 		/*
4837 		 * Attached SEEPROM(s), if any.
4838 		 * NB: we use the high-order bits of the 'address' as
4839 		 * a device select to accommodate multiple SEEPROMS,
4840 		 * If each one is the maximum size (64kbytes), this
4841 		 * makes them appear contiguous.  Otherwise, there may
4842 		 * be holes in the mapping.  ENxS doesn't have any
4843 		 * SEEPROMs anyway ...
4844 		 */
4845 		sizemask = 4;
4846 		mem_va = 0;
4847 		maxoff = SEEPROM_DEV_AND_ADDR_MASK;
4848 		ppfn = peek ? bge_chip_peek_seeprom : bge_chip_poke_seeprom;
4849 		break;
4850 #endif	/* BGE_SEE_IO32 */
4851 
4852 #if	BGE_FLASH_IO32
4853 	case BGE_PP_SPACE_FLASH:
4854 		/*
4855 		 * Attached Flash device (if any); a maximum of one device
4856 		 * is currently supported.  But it can be up to 1MB (unlike
4857 		 * the 64k limit on SEEPROMs) so why would you need more ;-)
4858 		 */
4859 		sizemask = 4;
4860 		mem_va = 0;
4861 		maxoff = NVM_FLASH_ADDR_MASK;
4862 		ppfn = peek ? bge_chip_peek_flash : bge_chip_poke_flash;
4863 		break;
4864 #endif	/* BGE_FLASH_IO32 */
4865 
4866 	case BGE_PP_SPACE_BGE:
4867 		/*
4868 		 * BGE data structure!
4869 		 */
4870 		sizemask = 8|4|2|1;
4871 		mem_va = (uintptr_t)bgep;
4872 		maxoff = sizeof (*bgep);
4873 		ppfn = peek ? bge_chip_peek_mem : bge_chip_poke_mem;
4874 		break;
4875 
4876 	case BGE_PP_SPACE_STATUS:
4877 	case BGE_PP_SPACE_STATISTICS:
4878 	case BGE_PP_SPACE_TXDESC:
4879 	case BGE_PP_SPACE_TXBUFF:
4880 	case BGE_PP_SPACE_RXDESC:
4881 	case BGE_PP_SPACE_RXBUFF:
4882 		/*
4883 		 * Various DMA_AREAs
4884 		 */
4885 		switch (ppd->pp_acc_space) {
4886 		case BGE_PP_SPACE_TXDESC:
4887 			areap = &bgep->tx_desc;
4888 			break;
4889 		case BGE_PP_SPACE_TXBUFF:
4890 			areap = &bgep->tx_buff[0];
4891 			break;
4892 		case BGE_PP_SPACE_RXDESC:
4893 			areap = &bgep->rx_desc[0];
4894 			break;
4895 		case BGE_PP_SPACE_RXBUFF:
4896 			areap = &bgep->rx_buff[0];
4897 			break;
4898 		case BGE_PP_SPACE_STATUS:
4899 			areap = &bgep->status_block;
4900 			break;
4901 		case BGE_PP_SPACE_STATISTICS:
4902 			if (bgep->chipid.statistic_type == BGE_STAT_BLK)
4903 				areap = &bgep->statistics;
4904 			break;
4905 		}
4906 
4907 		sizemask = 8|4|2|1;
4908 		mem_va = (uintptr_t)areap->mem_va;
4909 		maxoff = areap->alength;
4910 		ppfn = peek ? bge_chip_peek_mem : bge_chip_poke_mem;
4911 		break;
4912 	}
4913 
4914 	switch (ppd->pp_acc_size) {
4915 	default:
4916 		return (IOC_INVAL);
4917 
4918 	case 8:
4919 	case 4:
4920 	case 2:
4921 	case 1:
4922 		if ((ppd->pp_acc_size & sizemask) == 0)
4923 			return (IOC_INVAL);
4924 		break;
4925 	}
4926 
4927 	if ((ppd->pp_acc_offset % ppd->pp_acc_size) != 0)
4928 		return (IOC_INVAL);
4929 
4930 	if (ppd->pp_acc_offset >= maxoff)
4931 		return (IOC_INVAL);
4932 
4933 	if (ppd->pp_acc_offset+ppd->pp_acc_size > maxoff)
4934 		return (IOC_INVAL);
4935 
4936 	/*
4937 	 * All OK - go do it!
4938 	 */
4939 	ppd->pp_acc_offset += mem_va;
4940 	(*ppfn)(bgep, ppd);
4941 	return (peek ? IOC_REPLY : IOC_ACK);
4942 }
4943 
4944 static enum ioc_reply bge_diag_ioctl(bge_t *bgep, int cmd, mblk_t *mp,
4945 					struct iocblk *iocp);
4946 #pragma	no_inline(bge_diag_ioctl)
4947 
4948 static enum ioc_reply
4949 bge_diag_ioctl(bge_t *bgep, int cmd, mblk_t *mp, struct iocblk *iocp)
4950 {
4951 	ASSERT(mutex_owned(bgep->genlock));
4952 
4953 	switch (cmd) {
4954 	default:
4955 		/* NOTREACHED */
4956 		bge_error(bgep, "bge_diag_ioctl: invalid cmd 0x%x", cmd);
4957 		return (IOC_INVAL);
4958 
4959 	case BGE_DIAG:
4960 		/*
4961 		 * Currently a no-op
4962 		 */
4963 		return (IOC_ACK);
4964 
4965 	case BGE_PEEK:
4966 	case BGE_POKE:
4967 		return (bge_pp_ioctl(bgep, cmd, mp, iocp));
4968 
4969 	case BGE_PHY_RESET:
4970 		return (IOC_RESTART_ACK);
4971 
4972 	case BGE_SOFT_RESET:
4973 	case BGE_HARD_RESET:
4974 		/*
4975 		 * Reset and reinitialise the 570x hardware
4976 		 */
4977 		(void) bge_restart(bgep, cmd == BGE_HARD_RESET);
4978 		return (IOC_ACK);
4979 	}
4980 
4981 	/* NOTREACHED */
4982 }
4983 
4984 #endif	/* BGE_DEBUGGING || BGE_DO_PPIO */
4985 
4986 static enum ioc_reply bge_mii_ioctl(bge_t *bgep, int cmd, mblk_t *mp,
4987 				    struct iocblk *iocp);
4988 #pragma	no_inline(bge_mii_ioctl)
4989 
4990 static enum ioc_reply
4991 bge_mii_ioctl(bge_t *bgep, int cmd, mblk_t *mp, struct iocblk *iocp)
4992 {
4993 	struct bge_mii_rw *miirwp;
4994 
4995 	/*
4996 	 * Validate format of ioctl
4997 	 */
4998 	if (iocp->ioc_count != sizeof (struct bge_mii_rw))
4999 		return (IOC_INVAL);
5000 	if (mp->b_cont == NULL)
5001 		return (IOC_INVAL);
5002 	miirwp = (struct bge_mii_rw *)mp->b_cont->b_rptr;
5003 
5004 	/*
5005 	 * Validate request parameters ...
5006 	 */
5007 	if (miirwp->mii_reg > MII_MAXREG)
5008 		return (IOC_INVAL);
5009 
5010 	switch (cmd) {
5011 	default:
5012 		/* NOTREACHED */
5013 		bge_error(bgep, "bge_mii_ioctl: invalid cmd 0x%x", cmd);
5014 		return (IOC_INVAL);
5015 
5016 	case BGE_MII_READ:
5017 		miirwp->mii_data = bge_mii_get16(bgep, miirwp->mii_reg);
5018 		return (IOC_REPLY);
5019 
5020 	case BGE_MII_WRITE:
5021 		bge_mii_put16(bgep, miirwp->mii_reg, miirwp->mii_data);
5022 		return (IOC_ACK);
5023 	}
5024 
5025 	/* NOTREACHED */
5026 }
5027 
5028 #if	BGE_SEE_IO32
5029 
5030 static enum ioc_reply bge_see_ioctl(bge_t *bgep, int cmd, mblk_t *mp,
5031 				    struct iocblk *iocp);
5032 #pragma	no_inline(bge_see_ioctl)
5033 
5034 static enum ioc_reply
5035 bge_see_ioctl(bge_t *bgep, int cmd, mblk_t *mp, struct iocblk *iocp)
5036 {
5037 	struct bge_see_rw *seerwp;
5038 
5039 	/*
5040 	 * Validate format of ioctl
5041 	 */
5042 	if (iocp->ioc_count != sizeof (struct bge_see_rw))
5043 		return (IOC_INVAL);
5044 	if (mp->b_cont == NULL)
5045 		return (IOC_INVAL);
5046 	seerwp = (struct bge_see_rw *)mp->b_cont->b_rptr;
5047 
5048 	/*
5049 	 * Validate request parameters ...
5050 	 */
5051 	if (seerwp->see_addr & ~SEEPROM_DEV_AND_ADDR_MASK)
5052 		return (IOC_INVAL);
5053 
5054 	switch (cmd) {
5055 	default:
5056 		/* NOTREACHED */
5057 		bge_error(bgep, "bge_see_ioctl: invalid cmd 0x%x", cmd);
5058 		return (IOC_INVAL);
5059 
5060 	case BGE_SEE_READ:
5061 	case BGE_SEE_WRITE:
5062 		iocp->ioc_error = bge_nvmem_rw32(bgep, cmd,
5063 		    seerwp->see_addr, &seerwp->see_data);
5064 		return (IOC_REPLY);
5065 	}
5066 
5067 	/* NOTREACHED */
5068 }
5069 
5070 #endif	/* BGE_SEE_IO32 */
5071 
5072 #if	BGE_FLASH_IO32
5073 
5074 static enum ioc_reply bge_flash_ioctl(bge_t *bgep, int cmd, mblk_t *mp,
5075 				    struct iocblk *iocp);
5076 #pragma	no_inline(bge_flash_ioctl)
5077 
5078 static enum ioc_reply
5079 bge_flash_ioctl(bge_t *bgep, int cmd, mblk_t *mp, struct iocblk *iocp)
5080 {
5081 	struct bge_flash_rw *flashrwp;
5082 
5083 	/*
5084 	 * Validate format of ioctl
5085 	 */
5086 	if (iocp->ioc_count != sizeof (struct bge_flash_rw))
5087 		return (IOC_INVAL);
5088 	if (mp->b_cont == NULL)
5089 		return (IOC_INVAL);
5090 	flashrwp = (struct bge_flash_rw *)mp->b_cont->b_rptr;
5091 
5092 	/*
5093 	 * Validate request parameters ...
5094 	 */
5095 	if (flashrwp->flash_addr & ~NVM_FLASH_ADDR_MASK)
5096 		return (IOC_INVAL);
5097 
5098 	switch (cmd) {
5099 	default:
5100 		/* NOTREACHED */
5101 		bge_error(bgep, "bge_flash_ioctl: invalid cmd 0x%x", cmd);
5102 		return (IOC_INVAL);
5103 
5104 	case BGE_FLASH_READ:
5105 	case BGE_FLASH_WRITE:
5106 		iocp->ioc_error = bge_nvmem_rw32(bgep, cmd,
5107 		    flashrwp->flash_addr, &flashrwp->flash_data);
5108 		return (IOC_REPLY);
5109 	}
5110 
5111 	/* NOTREACHED */
5112 }
5113 
5114 #endif	/* BGE_FLASH_IO32 */
5115 
5116 enum ioc_reply bge_chip_ioctl(bge_t *bgep, queue_t *wq, mblk_t *mp,
5117 				struct iocblk *iocp);
5118 #pragma	no_inline(bge_chip_ioctl)
5119 
5120 enum ioc_reply
5121 bge_chip_ioctl(bge_t *bgep, queue_t *wq, mblk_t *mp, struct iocblk *iocp)
5122 {
5123 	int cmd;
5124 
5125 	BGE_TRACE(("bge_chip_ioctl($%p, $%p, $%p, $%p)",
5126 		(void *)bgep, (void *)wq, (void *)mp, (void *)iocp));
5127 
5128 	ASSERT(mutex_owned(bgep->genlock));
5129 
5130 	cmd = iocp->ioc_cmd;
5131 	switch (cmd) {
5132 	default:
5133 		/* NOTREACHED */
5134 		bge_error(bgep, "bge_chip_ioctl: invalid cmd 0x%x", cmd);
5135 		return (IOC_INVAL);
5136 
5137 	case BGE_DIAG:
5138 	case BGE_PEEK:
5139 	case BGE_POKE:
5140 	case BGE_PHY_RESET:
5141 	case BGE_SOFT_RESET:
5142 	case BGE_HARD_RESET:
5143 #if	BGE_DEBUGGING || BGE_DO_PPIO
5144 		return (bge_diag_ioctl(bgep, cmd, mp, iocp));
5145 #else
5146 		return (IOC_INVAL);
5147 #endif	/* BGE_DEBUGGING || BGE_DO_PPIO */
5148 
5149 	case BGE_MII_READ:
5150 	case BGE_MII_WRITE:
5151 		return (bge_mii_ioctl(bgep, cmd, mp, iocp));
5152 
5153 #if	BGE_SEE_IO32
5154 	case BGE_SEE_READ:
5155 	case BGE_SEE_WRITE:
5156 		return (bge_see_ioctl(bgep, cmd, mp, iocp));
5157 #endif	/* BGE_SEE_IO32 */
5158 
5159 #if	BGE_FLASH_IO32
5160 	case BGE_FLASH_READ:
5161 	case BGE_FLASH_WRITE:
5162 		return (bge_flash_ioctl(bgep, cmd, mp, iocp));
5163 #endif	/* BGE_FLASH_IO32 */
5164 	}
5165 
5166 	/* NOTREACHED */
5167 }
5168 
5169 void
5170 bge_chip_blank(void *arg, time_t ticks, uint_t count)
5171 {
5172 	bge_t *bgep = arg;
5173 
5174 	mutex_enter(bgep->genlock);
5175 	bge_reg_put32(bgep, RCV_COALESCE_TICKS_REG, ticks);
5176 	bge_reg_put32(bgep, RCV_COALESCE_MAX_BD_REG, count);
5177 	if (bge_check_acc_handle(bgep, bgep->io_handle) != DDI_FM_OK)
5178 		ddi_fm_service_impact(bgep->devinfo, DDI_SERVICE_UNAFFECTED);
5179 	mutex_exit(bgep->genlock);
5180 }
5181 
5182 #ifdef BGE_IPMI_ASF
5183 
5184 uint32_t
5185 bge_nic_read32(bge_t *bgep, bge_regno_t addr)
5186 {
5187 	uint32_t data;
5188 
5189 	if (!bgep->asf_wordswapped) {
5190 		/* a workaround word swap error */
5191 		if (addr & 4)
5192 			addr = addr - 4;
5193 		else
5194 			addr = addr + 4;
5195 	}
5196 
5197 	pci_config_put32(bgep->cfg_handle, PCI_CONF_BGE_MWBAR, addr);
5198 	data = pci_config_get32(bgep->cfg_handle, PCI_CONF_BGE_MWDAR);
5199 	pci_config_put32(bgep->cfg_handle, PCI_CONF_BGE_MWBAR, 0);
5200 
5201 	return (data);
5202 }
5203 
5204 
5205 void
5206 bge_asf_update_status(bge_t *bgep)
5207 {
5208 	uint32_t event;
5209 
5210 	bge_nic_put32(bgep, BGE_CMD_MAILBOX, BGE_CMD_NICDRV_ALIVE);
5211 	bge_nic_put32(bgep, BGE_CMD_LENGTH_MAILBOX, 4);
5212 	bge_nic_put32(bgep, BGE_CMD_DATA_MAILBOX,   3);
5213 
5214 	event = bge_reg_get32(bgep, RX_RISC_EVENT_REG);
5215 	bge_reg_put32(bgep, RX_RISC_EVENT_REG, event | RRER_ASF_EVENT);
5216 }
5217 
5218 
5219 /*
5220  * The driver is supposed to notify ASF that the OS is still running
5221  * every three seconds, otherwise the management server may attempt
5222  * to reboot the machine.  If it hasn't actually failed, this is
5223  * not a desireable result.  However, this isn't running as a real-time
5224  * thread, and even if it were, it might not be able to generate the
5225  * heartbeat in a timely manner due to system load.  As it isn't a
5226  * significant strain on the machine, we will set the interval to half
5227  * of the required value.
5228  */
5229 void
5230 bge_asf_heartbeat(void *arg)
5231 {
5232 	bge_t *bgep = (bge_t *)arg;
5233 
5234 	mutex_enter(bgep->genlock);
5235 	bge_asf_update_status((bge_t *)bgep);
5236 	if (bge_check_acc_handle(bgep, bgep->io_handle) != DDI_FM_OK)
5237 		ddi_fm_service_impact(bgep->devinfo, DDI_SERVICE_DEGRADED);
5238 	if (bge_check_acc_handle(bgep, bgep->cfg_handle) != DDI_FM_OK)
5239 		ddi_fm_service_impact(bgep->devinfo, DDI_SERVICE_DEGRADED);
5240 	mutex_exit(bgep->genlock);
5241 	((bge_t *)bgep)->asf_timeout_id = timeout(bge_asf_heartbeat, bgep,
5242 		drv_usectohz(BGE_ASF_HEARTBEAT_INTERVAL));
5243 }
5244 
5245 
5246 void
5247 bge_asf_stop_timer(bge_t *bgep)
5248 {
5249 	timeout_id_t tmp_id = 0;
5250 
5251 	while ((bgep->asf_timeout_id != 0) &&
5252 		(tmp_id != bgep->asf_timeout_id)) {
5253 		tmp_id = bgep->asf_timeout_id;
5254 		(void) untimeout(tmp_id);
5255 	}
5256 	bgep->asf_timeout_id = 0;
5257 }
5258 
5259 
5260 
5261 /*
5262  * This function should be placed at the earliest postion of bge_attach().
5263  */
5264 void
5265 bge_asf_get_config(bge_t *bgep)
5266 {
5267 	uint32_t nicsig;
5268 	uint32_t niccfg;
5269 
5270 	nicsig = bge_nic_read32(bgep, BGE_NIC_DATA_SIG_ADDR);
5271 	if (nicsig == BGE_NIC_DATA_SIG) {
5272 		niccfg = bge_nic_read32(bgep, BGE_NIC_DATA_NIC_CFG_ADDR);
5273 		if (niccfg & BGE_NIC_CFG_ENABLE_ASF)
5274 			/*
5275 			 * Here, we don't consider BAXTER, because BGE haven't
5276 			 * supported BAXTER (that is 5752). Also, as I know,
5277 			 * BAXTER doesn't support ASF feature.
5278 			 */
5279 			bgep->asf_enabled = B_TRUE;
5280 		else
5281 			bgep->asf_enabled = B_FALSE;
5282 	} else
5283 		bgep->asf_enabled = B_FALSE;
5284 }
5285 
5286 
5287 void
5288 bge_asf_pre_reset_operations(bge_t *bgep, uint32_t mode)
5289 {
5290 	uint32_t tries;
5291 	uint32_t event;
5292 
5293 	ASSERT(bgep->asf_enabled);
5294 
5295 	/* Issues "pause firmware" command and wait for ACK */
5296 	bge_nic_put32(bgep, BGE_CMD_MAILBOX, BGE_CMD_NICDRV_PAUSE_FW);
5297 	event = bge_reg_get32(bgep, RX_RISC_EVENT_REG);
5298 	bge_reg_put32(bgep, RX_RISC_EVENT_REG, event | RRER_ASF_EVENT);
5299 
5300 	event = bge_reg_get32(bgep, RX_RISC_EVENT_REG);
5301 	tries = 0;
5302 	while ((event & RRER_ASF_EVENT) && (tries < 100)) {
5303 		drv_usecwait(1);
5304 		tries ++;
5305 		event = bge_reg_get32(bgep, RX_RISC_EVENT_REG);
5306 	}
5307 
5308 	bge_nic_put32(bgep, BGE_FIRMWARE_MAILBOX,
5309 		BGE_MAGIC_NUM_FIRMWARE_INIT_DONE);
5310 
5311 	if (bgep->asf_newhandshake) {
5312 		switch (mode) {
5313 		case BGE_INIT_RESET:
5314 			bge_nic_put32(bgep, BGE_DRV_STATE_MAILBOX,
5315 				BGE_DRV_STATE_START);
5316 			break;
5317 		case BGE_SHUTDOWN_RESET:
5318 			bge_nic_put32(bgep, BGE_DRV_STATE_MAILBOX,
5319 				BGE_DRV_STATE_UNLOAD);
5320 			break;
5321 		case BGE_SUSPEND_RESET:
5322 			bge_nic_put32(bgep, BGE_DRV_STATE_MAILBOX,
5323 				BGE_DRV_STATE_SUSPEND);
5324 			break;
5325 		default:
5326 			break;
5327 		}
5328 	}
5329 }
5330 
5331 
5332 void
5333 bge_asf_post_reset_old_mode(bge_t *bgep, uint32_t mode)
5334 {
5335 	switch (mode) {
5336 	case BGE_INIT_RESET:
5337 		bge_nic_put32(bgep, BGE_DRV_STATE_MAILBOX,
5338 			BGE_DRV_STATE_START);
5339 		break;
5340 	case BGE_SHUTDOWN_RESET:
5341 		bge_nic_put32(bgep, BGE_DRV_STATE_MAILBOX,
5342 			BGE_DRV_STATE_UNLOAD);
5343 		break;
5344 	case BGE_SUSPEND_RESET:
5345 		bge_nic_put32(bgep, BGE_DRV_STATE_MAILBOX,
5346 			BGE_DRV_STATE_SUSPEND);
5347 		break;
5348 	default:
5349 		break;
5350 	}
5351 }
5352 
5353 
5354 void
5355 bge_asf_post_reset_new_mode(bge_t *bgep, uint32_t mode)
5356 {
5357 	switch (mode) {
5358 	case BGE_INIT_RESET:
5359 		bge_nic_put32(bgep, BGE_DRV_STATE_MAILBOX,
5360 			BGE_DRV_STATE_START_DONE);
5361 		break;
5362 	case BGE_SHUTDOWN_RESET:
5363 		bge_nic_put32(bgep, BGE_DRV_STATE_MAILBOX,
5364 			BGE_DRV_STATE_UNLOAD_DONE);
5365 		break;
5366 	default:
5367 		break;
5368 	}
5369 }
5370 
5371 #endif /* BGE_IPMI_ASF */
5372