xref: /dflybsd-src/sys/dev/netif/bge/if_bge.c (revision 41871674d0079dec70d55eb824f39d07dc7b3310)
1 /*
2  * Copyright (c) 2001 Wind River Systems
3  * Copyright (c) 1997, 1998, 1999, 2001
4  *	Bill Paul <wpaul@windriver.com>.  All rights reserved.
5  *
6  * Redistribution and use in source and binary forms, with or without
7  * modification, are permitted provided that the following conditions
8  * are met:
9  * 1. Redistributions of source code must retain the above copyright
10  *    notice, this list of conditions and the following disclaimer.
11  * 2. Redistributions in binary form must reproduce the above copyright
12  *    notice, this list of conditions and the following disclaimer in the
13  *    documentation and/or other materials provided with the distribution.
14  * 3. All advertising materials mentioning features or use of this software
15  *    must display the following acknowledgement:
16  *	This product includes software developed by Bill Paul.
17  * 4. Neither the name of the author nor the names of any co-contributors
18  *    may be used to endorse or promote products derived from this software
19  *    without specific prior written permission.
20  *
21  * THIS SOFTWARE IS PROVIDED BY Bill Paul AND CONTRIBUTORS ``AS IS'' AND
22  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
23  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
24  * ARE DISCLAIMED.  IN NO EVENT SHALL Bill Paul OR THE VOICES IN HIS HEAD
25  * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
26  * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
27  * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
28  * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
29  * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
30  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
31  * THE POSSIBILITY OF SUCH DAMAGE.
32  *
33  * $FreeBSD: src/sys/dev/bge/if_bge.c,v 1.3.2.29 2003/12/01 21:06:59 ambrisko Exp $
34  * $DragonFly: src/sys/dev/netif/bge/if_bge.c,v 1.53 2006/03/23 13:45:12 sephe Exp $
35  *
36  */
37 
38 /*
39  * Broadcom BCM570x family gigabit ethernet driver for FreeBSD.
40  *
41  * Written by Bill Paul <wpaul@windriver.com>
42  * Senior Engineer, Wind River Systems
43  */
44 
45 /*
46  * The Broadcom BCM5700 is based on technology originally developed by
47  * Alteon Networks as part of the Tigon I and Tigon II gigabit ethernet
48  * MAC chips. The BCM5700, sometimes refered to as the Tigon III, has
49  * two on-board MIPS R4000 CPUs and can have as much as 16MB of external
50  * SSRAM. The BCM5700 supports TCP, UDP and IP checksum offload, jumbo
51  * frames, highly configurable RX filtering, and 16 RX and TX queues
52  * (which, along with RX filter rules, can be used for QOS applications).
53  * Other features, such as TCP segmentation, may be available as part
54  * of value-added firmware updates. Unlike the Tigon I and Tigon II,
55  * firmware images can be stored in hardware and need not be compiled
56  * into the driver.
57  *
58  * The BCM5700 supports the PCI v2.2 and PCI-X v1.0 standards, and will
59  * function in a 32-bit/64-bit 33/66Mhz bus, or a 64-bit/133Mhz bus.
60  *
61  * The BCM5701 is a single-chip solution incorporating both the BCM5700
62  * MAC and a BCM5401 10/100/1000 PHY. Unlike the BCM5700, the BCM5701
63  * does not support external SSRAM.
64  *
65  * Broadcom also produces a variation of the BCM5700 under the "Altima"
66  * brand name, which is functionally similar but lacks PCI-X support.
67  *
68  * Without external SSRAM, you can only have at most 4 TX rings,
69  * and the use of the mini RX ring is disabled. This seems to imply
70  * that these features are simply not available on the BCM5701. As a
71  * result, this driver does not implement any support for the mini RX
72  * ring.
73  */
74 
75 #include <sys/param.h>
76 #include <sys/systm.h>
77 #include <sys/sockio.h>
78 #include <sys/mbuf.h>
79 #include <sys/malloc.h>
80 #include <sys/kernel.h>
81 #include <sys/socket.h>
82 #include <sys/queue.h>
83 #include <sys/serialize.h>
84 #include <sys/thread2.h>
85 
86 #include <net/if.h>
87 #include <net/ifq_var.h>
88 #include <net/if_arp.h>
89 #include <net/ethernet.h>
90 #include <net/if_dl.h>
91 #include <net/if_media.h>
92 
93 #include <net/bpf.h>
94 
95 #include <net/if_types.h>
96 #include <net/vlan/if_vlan_var.h>
97 
98 #include <netinet/in_systm.h>
99 #include <netinet/in.h>
100 #include <netinet/ip.h>
101 
102 #include <vm/vm.h>              /* for vtophys */
103 #include <vm/pmap.h>            /* for vtophys */
104 #include <machine/resource.h>
105 #include <sys/bus.h>
106 #include <sys/rman.h>
107 
108 #include <dev/netif/mii_layer/mii.h>
109 #include <dev/netif/mii_layer/miivar.h>
110 #include <dev/netif/mii_layer/miidevs.h>
111 #include <dev/netif/mii_layer/brgphyreg.h>
112 
113 #include <bus/pci/pcidevs.h>
114 #include <bus/pci/pcireg.h>
115 #include <bus/pci/pcivar.h>
116 
117 #include "if_bgereg.h"
118 
119 #define BGE_CSUM_FEATURES	(CSUM_IP | CSUM_TCP | CSUM_UDP)
120 
121 /* "controller miibus0" required.  See GENERIC if you get errors here. */
122 #include "miibus_if.h"
123 
124 /*
125  * Various supported device vendors/types and their names. Note: the
126  * spec seems to indicate that the hardware still has Alteon's vendor
127  * ID burned into it, though it will always be overriden by the vendor
128  * ID in the EEPROM. Just to be safe, we cover all possibilities.
129  */
130 #define BGE_DEVDESC_MAX		64	/* Maximum device description length */
131 
132 static struct bge_type bge_devs[] = {
133 	{ PCI_VENDOR_ALTEON, PCI_PRODUCT_ALTEON_BCM5700,
134 		"Alteon BCM5700 Gigabit Ethernet" },
135 	{ PCI_VENDOR_ALTEON, PCI_PRODUCT_ALTEON_BCM5701,
136 		"Alteon BCM5701 Gigabit Ethernet" },
137 	{ PCI_VENDOR_BROADCOM, PCI_PRODUCT_BROADCOM_BCM5700,
138 		"Broadcom BCM5700 Gigabit Ethernet" },
139 	{ PCI_VENDOR_BROADCOM, PCI_PRODUCT_BROADCOM_BCM5701,
140 		"Broadcom BCM5701 Gigabit Ethernet" },
141 	{ PCI_VENDOR_BROADCOM, PCI_PRODUCT_BROADCOM_BCM5702X,
142 		"Broadcom BCM5702X Gigabit Ethernet" },
143 	{ PCI_VENDOR_BROADCOM, PCI_PRODUCT_BROADCOM_BCM5702_ALT,
144 		"Broadcom BCM5702 Gigabit Ethernet" },
145 	{ PCI_VENDOR_BROADCOM, PCI_PRODUCT_BROADCOM_BCM5703X,
146 		"Broadcom BCM5703X Gigabit Ethernet" },
147 	{ PCI_VENDOR_BROADCOM, PCI_PRODUCT_BROADCOM_BCM5703A3,
148 		"Broadcom BCM5703 Gigabit Ethernet" },
149 	{ PCI_VENDOR_BROADCOM, PCI_PRODUCT_BROADCOM_BCM5704C,
150 		"Broadcom BCM5704C Dual Gigabit Ethernet" },
151 	{ PCI_VENDOR_BROADCOM, PCI_PRODUCT_BROADCOM_BCM5704S,
152 		"Broadcom BCM5704S Dual Gigabit Ethernet" },
153 	{ PCI_VENDOR_BROADCOM, PCI_PRODUCT_BROADCOM_BCM5705,
154 		"Broadcom BCM5705 Gigabit Ethernet" },
155 	{ PCI_VENDOR_BROADCOM, PCI_PRODUCT_BROADCOM_BCM5705K,
156 		"Broadcom BCM5705K Gigabit Ethernet" },
157 	{ PCI_VENDOR_BROADCOM, PCI_PRODUCT_BROADCOM_BCM5705M,
158 		"Broadcom BCM5705M Gigabit Ethernet" },
159 	{ PCI_VENDOR_BROADCOM, PCI_PRODUCT_BROADCOM_BCM5705M_ALT,
160 		"Broadcom BCM5705M Gigabit Ethernet" },
161 	{ PCI_VENDOR_BROADCOM, BCOM_DEVICEID_BCM5714C,
162 		"Broadcom BCM5714C Gigabit Ethernet" },
163 	{ PCI_VENDOR_BROADCOM, PCI_PRODUCT_BROADCOM_BCM5721,
164 		"Broadcom BCM5721 Gigabit Ethernet" },
165 	{ PCI_VENDOR_BROADCOM, PCI_PRODUCT_BROADCOM_BCM5750,
166 		"Broadcom BCM5750 Gigabit Ethernet" },
167 	{ PCI_VENDOR_BROADCOM, PCI_PRODUCT_BROADCOM_BCM5750M,
168 		"Broadcom BCM5750M Gigabit Ethernet" },
169 	{ PCI_VENDOR_BROADCOM, PCI_PRODUCT_BROADCOM_BCM5751,
170 		"Broadcom BCM5751 Gigabit Ethernet" },
171 	{ PCI_VENDOR_BROADCOM, PCI_PRODUCT_BROADCOM_BCM5751M,
172 		"Broadcom BCM5751M Gigabit Ethernet" },
173 	{ PCI_VENDOR_BROADCOM, PCI_PRODUCT_BROADCOM_BCM5782,
174 		"Broadcom BCM5782 Gigabit Ethernet" },
175 	{ PCI_VENDOR_BROADCOM, PCI_PRODUCT_BROADCOM_BCM5788,
176 		"Broadcom BCM5788 Gigabit Ethernet" },
177 	{ PCI_VENDOR_BROADCOM, PCI_PRODUCT_BROADCOM_BCM5789,
178 		"Broadcom BCM5789 Gigabit Ethernet" },
179 	{ PCI_VENDOR_BROADCOM, PCI_PRODUCT_BROADCOM_BCM5901,
180 		"Broadcom BCM5901 Fast Ethernet" },
181 	{ PCI_VENDOR_BROADCOM, PCI_PRODUCT_BROADCOM_BCM5901A2,
182 		"Broadcom BCM5901A2 Fast Ethernet" },
183 	{ PCI_VENDOR_SCHNEIDERKOCH, PCI_PRODUCT_SCHNEIDERKOCH_SK_9DX1,
184 		"SysKonnect Gigabit Ethernet" },
185 	{ PCI_VENDOR_ALTIMA, PCI_PRODUCT_ALTIMA_AC1000,
186 		"Altima AC1000 Gigabit Ethernet" },
187 	{ PCI_VENDOR_ALTIMA, PCI_PRODUCT_ALTIMA_AC1001,
188 		"Altima AC1002 Gigabit Ethernet" },
189 	{ PCI_VENDOR_ALTIMA, PCI_PRODUCT_ALTIMA_AC9100,
190 		"Altima AC9100 Gigabit Ethernet" },
191 	{ 0, 0, NULL }
192 };
193 
194 static int	bge_probe(device_t);
195 static int	bge_attach(device_t);
196 static int	bge_detach(device_t);
197 static void	bge_release_resources(struct bge_softc *);
198 static void	bge_txeof(struct bge_softc *);
199 static void	bge_rxeof(struct bge_softc *);
200 
201 static void	bge_tick(void *);
202 static void	bge_tick_serialized(void *);
203 static void	bge_stats_update(struct bge_softc *);
204 static void	bge_stats_update_regs(struct bge_softc *);
205 static int	bge_encap(struct bge_softc *, struct mbuf *, uint32_t *);
206 
207 static void	bge_intr(void *);
208 static void	bge_start(struct ifnet *);
209 static int	bge_ioctl(struct ifnet *, u_long, caddr_t, struct ucred *);
210 static void	bge_init(void *);
211 static void	bge_stop(struct bge_softc *);
212 static void	bge_watchdog(struct ifnet *);
213 static void	bge_shutdown(device_t);
214 static int	bge_ifmedia_upd(struct ifnet *);
215 static void	bge_ifmedia_sts(struct ifnet *, struct ifmediareq *);
216 
217 static uint8_t	bge_eeprom_getbyte(struct bge_softc *, uint32_t, uint8_t *);
218 static int	bge_read_eeprom(struct bge_softc *, caddr_t, uint32_t, size_t);
219 
220 static void	bge_setmulti(struct bge_softc *);
221 
222 static void	bge_handle_events(struct bge_softc *);
223 static int	bge_alloc_jumbo_mem(struct bge_softc *);
224 static void	bge_free_jumbo_mem(struct bge_softc *);
225 static struct bge_jslot
226 		*bge_jalloc(struct bge_softc *);
227 static void	bge_jfree(void *);
228 static void	bge_jref(void *);
229 static int	bge_newbuf_std(struct bge_softc *, int, struct mbuf *);
230 static int	bge_newbuf_jumbo(struct bge_softc *, int, struct mbuf *);
231 static int	bge_init_rx_ring_std(struct bge_softc *);
232 static void	bge_free_rx_ring_std(struct bge_softc *);
233 static int	bge_init_rx_ring_jumbo(struct bge_softc *);
234 static void	bge_free_rx_ring_jumbo(struct bge_softc *);
235 static void	bge_free_tx_ring(struct bge_softc *);
236 static int	bge_init_tx_ring(struct bge_softc *);
237 
238 static int	bge_chipinit(struct bge_softc *);
239 static int	bge_blockinit(struct bge_softc *);
240 
241 #ifdef notdef
242 static uint8_t	bge_vpd_readbyte(struct bge_softc *, uint32_t);
243 static void	bge_vpd_read_res(struct bge_softc *, struct vpd_res *, uint32_t);
244 static void	bge_vpd_read(struct bge_softc *);
245 #endif
246 
247 static uint32_t	bge_readmem_ind(struct bge_softc *, uint32_t);
248 static void	bge_writemem_ind(struct bge_softc *, uint32_t, uint32_t);
249 #ifdef notdef
250 static uint32_t	bge_readreg_ind(struct bge_softc *, uint32_t);
251 #endif
252 static void	bge_writereg_ind(struct bge_softc *, uint32_t, uint32_t);
253 
254 static int	bge_miibus_readreg(device_t, int, int);
255 static int	bge_miibus_writereg(device_t, int, int, int);
256 static void	bge_miibus_statchg(device_t);
257 
258 static void	bge_reset(struct bge_softc *);
259 
260 /*
261  * Set following tunable to 1 for some IBM blade servers with the DNLK
262  * switch module. Auto negotiation is broken for those configurations.
263  */
264 static int	bge_fake_autoneg = 0;
265 TUNABLE_INT("hw.bge.fake_autoneg", &bge_fake_autoneg);
266 
267 static device_method_t bge_methods[] = {
268 	/* Device interface */
269 	DEVMETHOD(device_probe,		bge_probe),
270 	DEVMETHOD(device_attach,	bge_attach),
271 	DEVMETHOD(device_detach,	bge_detach),
272 	DEVMETHOD(device_shutdown,	bge_shutdown),
273 
274 	/* bus interface */
275 	DEVMETHOD(bus_print_child,	bus_generic_print_child),
276 	DEVMETHOD(bus_driver_added,	bus_generic_driver_added),
277 
278 	/* MII interface */
279 	DEVMETHOD(miibus_readreg,	bge_miibus_readreg),
280 	DEVMETHOD(miibus_writereg,	bge_miibus_writereg),
281 	DEVMETHOD(miibus_statchg,	bge_miibus_statchg),
282 
283 	{ 0, 0 }
284 };
285 
286 static DEFINE_CLASS_0(bge, bge_driver, bge_methods, sizeof(struct bge_softc));
287 static devclass_t bge_devclass;
288 
289 DECLARE_DUMMY_MODULE(if_bge);
290 DRIVER_MODULE(if_bge, pci, bge_driver, bge_devclass, 0, 0);
291 DRIVER_MODULE(miibus, bge, miibus_driver, miibus_devclass, 0, 0);
292 
293 static uint32_t
294 bge_readmem_ind(struct bge_softc *sc, uint32_t off)
295 {
296 	device_t dev = sc->bge_dev;
297 
298 	pci_write_config(dev, BGE_PCI_MEMWIN_BASEADDR, off, 4);
299 	return(pci_read_config(dev, BGE_PCI_MEMWIN_DATA, 4));
300 }
301 
302 static void
303 bge_writemem_ind(struct bge_softc *sc, uint32_t off, uint32_t val)
304 {
305 	device_t dev = sc->bge_dev;
306 
307 	pci_write_config(dev, BGE_PCI_MEMWIN_BASEADDR, off, 4);
308 	pci_write_config(dev, BGE_PCI_MEMWIN_DATA, val, 4);
309 }
310 
311 #ifdef notdef
312 static uint32_t
313 bge_readreg_ind(struct bge_softc *sc, uin32_t off)
314 {
315 	device_t dev = sc->bge_dev;
316 
317 	pci_write_config(dev, BGE_PCI_REG_BASEADDR, off, 4);
318 	return(pci_read_config(dev, BGE_PCI_REG_DATA, 4));
319 }
320 #endif
321 
322 static void
323 bge_writereg_ind(struct bge_softc *sc, uint32_t off, uint32_t val)
324 {
325 	device_t dev = sc->bge_dev;
326 
327 	pci_write_config(dev, BGE_PCI_REG_BASEADDR, off, 4);
328 	pci_write_config(dev, BGE_PCI_REG_DATA, val, 4);
329 }
330 
331 #ifdef notdef
332 static uint8_t
333 bge_vpd_readbyte(struct bge_softc *sc, uint32_t addr)
334 {
335 	device_t dev = sc->bge_dev;
336 	uint32_t val;
337 	int i;
338 
339 	pci_write_config(dev, BGE_PCI_VPD_ADDR, addr, 2);
340 	for (i = 0; i < BGE_TIMEOUT * 10; i++) {
341 		DELAY(10);
342 		if (pci_read_config(dev, BGE_PCI_VPD_ADDR, 2) & BGE_VPD_FLAG)
343 			break;
344 	}
345 
346 	if (i == BGE_TIMEOUT) {
347 		device_printf(sc->bge_dev, "VPD read timed out\n");
348 		return(0);
349 	}
350 
351 	val = pci_read_config(dev, BGE_PCI_VPD_DATA, 4);
352 
353 	return((val >> ((addr % 4) * 8)) & 0xFF);
354 }
355 
356 static void
357 bge_vpd_read_res(struct bge_softc *sc, struct vpd_res *res, uint32_t addr)
358 {
359 	size_t i;
360 	uint8_t *ptr;
361 
362 	ptr = (uint8_t *)res;
363 	for (i = 0; i < sizeof(struct vpd_res); i++)
364 		ptr[i] = bge_vpd_readbyte(sc, i + addr);
365 
366 	return;
367 }
368 
369 static void
370 bge_vpd_read(struct bge_softc *sc)
371 {
372 	int pos = 0, i;
373 	struct vpd_res res;
374 
375 	if (sc->bge_vpd_prodname != NULL)
376 		free(sc->bge_vpd_prodname, M_DEVBUF);
377 	if (sc->bge_vpd_readonly != NULL)
378 		free(sc->bge_vpd_readonly, M_DEVBUF);
379 	sc->bge_vpd_prodname = NULL;
380 	sc->bge_vpd_readonly = NULL;
381 
382 	bge_vpd_read_res(sc, &res, pos);
383 
384 	if (res.vr_id != VPD_RES_ID) {
385 		device_printf(sc->bge_dev,
386 			      "bad VPD resource id: expected %x got %x\n",
387 			      VPD_RES_ID, res.vr_id);
388                 return;
389         }
390 
391 	pos += sizeof(res);
392 	sc->bge_vpd_prodname = malloc(res.vr_len + 1, M_DEVBUF, M_INTWAIT);
393 	for (i = 0; i < res.vr_len; i++)
394 		sc->bge_vpd_prodname[i] = bge_vpd_readbyte(sc, i + pos);
395 	sc->bge_vpd_prodname[i] = '\0';
396 	pos += i;
397 
398 	bge_vpd_read_res(sc, &res, pos);
399 
400 	if (res.vr_id != VPD_RES_READ) {
401 		device_printf(sc->bge_dev,
402 			      "bad VPD resource id: expected %x got %x\n",
403 			      VPD_RES_READ, res.vr_id);
404 		return;
405 	}
406 
407 	pos += sizeof(res);
408 	sc->bge_vpd_readonly = malloc(res.vr_len, M_DEVBUF, M_INTWAIT);
409 	for (i = 0; i < res.vr_len + 1; i++)
410 		sc->bge_vpd_readonly[i] = bge_vpd_readbyte(sc, i + pos);
411 }
412 #endif
413 
414 /*
415  * Read a byte of data stored in the EEPROM at address 'addr.' The
416  * BCM570x supports both the traditional bitbang interface and an
417  * auto access interface for reading the EEPROM. We use the auto
418  * access method.
419  */
420 static uint8_t
421 bge_eeprom_getbyte(struct bge_softc *sc, uint32_t addr, uint8_t *dest)
422 {
423 	int i;
424 	uint32_t byte = 0;
425 
426 	/*
427 	 * Enable use of auto EEPROM access so we can avoid
428 	 * having to use the bitbang method.
429 	 */
430 	BGE_SETBIT(sc, BGE_MISC_LOCAL_CTL, BGE_MLC_AUTO_EEPROM);
431 
432 	/* Reset the EEPROM, load the clock period. */
433 	CSR_WRITE_4(sc, BGE_EE_ADDR,
434 	    BGE_EEADDR_RESET|BGE_EEHALFCLK(BGE_HALFCLK_384SCL));
435 	DELAY(20);
436 
437 	/* Issue the read EEPROM command. */
438 	CSR_WRITE_4(sc, BGE_EE_ADDR, BGE_EE_READCMD | addr);
439 
440 	/* Wait for completion */
441 	for(i = 0; i < BGE_TIMEOUT * 10; i++) {
442 		DELAY(10);
443 		if (CSR_READ_4(sc, BGE_EE_ADDR) & BGE_EEADDR_DONE)
444 			break;
445 	}
446 
447 	if (i == BGE_TIMEOUT) {
448 		if_printf(&sc->arpcom.ac_if, "eeprom read timed out\n");
449 		return(0);
450 	}
451 
452 	/* Get result. */
453 	byte = CSR_READ_4(sc, BGE_EE_DATA);
454 
455         *dest = (byte >> ((addr % 4) * 8)) & 0xFF;
456 
457 	return(0);
458 }
459 
460 /*
461  * Read a sequence of bytes from the EEPROM.
462  */
463 static int
464 bge_read_eeprom(struct bge_softc *sc, caddr_t dest, uint32_t off, size_t len)
465 {
466 	size_t i;
467 	int err;
468 	uint8_t byte;
469 
470 	for (byte = 0, err = 0, i = 0; i < len; i++) {
471 		err = bge_eeprom_getbyte(sc, off + i, &byte);
472 		if (err)
473 			break;
474 		*(dest + i) = byte;
475 	}
476 
477 	return(err ? 1 : 0);
478 }
479 
480 static int
481 bge_miibus_readreg(device_t dev, int phy, int reg)
482 {
483 	struct bge_softc *sc;
484 	struct ifnet *ifp;
485 	uint32_t val, autopoll;
486 	int i;
487 
488 	sc = device_get_softc(dev);
489 	ifp = &sc->arpcom.ac_if;
490 
491 	/*
492 	 * Broadcom's own driver always assumes the internal
493 	 * PHY is at GMII address 1. On some chips, the PHY responds
494 	 * to accesses at all addresses, which could cause us to
495 	 * bogusly attach the PHY 32 times at probe type. Always
496 	 * restricting the lookup to address 1 is simpler than
497 	 * trying to figure out which chips revisions should be
498 	 * special-cased.
499 	 */
500 	if (phy != 1)
501 		return(0);
502 
503 	/* Reading with autopolling on may trigger PCI errors */
504 	autopoll = CSR_READ_4(sc, BGE_MI_MODE);
505 	if (autopoll & BGE_MIMODE_AUTOPOLL) {
506 		BGE_CLRBIT(sc, BGE_MI_MODE, BGE_MIMODE_AUTOPOLL);
507 		DELAY(40);
508 	}
509 
510 	CSR_WRITE_4(sc, BGE_MI_COMM, BGE_MICMD_READ|BGE_MICOMM_BUSY|
511 	    BGE_MIPHY(phy)|BGE_MIREG(reg));
512 
513 	for (i = 0; i < BGE_TIMEOUT; i++) {
514 		val = CSR_READ_4(sc, BGE_MI_COMM);
515 		if (!(val & BGE_MICOMM_BUSY))
516 			break;
517 	}
518 
519 	if (i == BGE_TIMEOUT) {
520 		if_printf(ifp, "PHY read timed out\n");
521 		val = 0;
522 		goto done;
523 	}
524 
525 	val = CSR_READ_4(sc, BGE_MI_COMM);
526 
527 done:
528 	if (autopoll & BGE_MIMODE_AUTOPOLL) {
529 		BGE_SETBIT(sc, BGE_MI_MODE, BGE_MIMODE_AUTOPOLL);
530 		DELAY(40);
531 	}
532 
533 	if (val & BGE_MICOMM_READFAIL)
534 		return(0);
535 
536 	return(val & 0xFFFF);
537 }
538 
539 static int
540 bge_miibus_writereg(device_t dev, int phy, int reg, int val)
541 {
542 	struct bge_softc *sc;
543 	uint32_t autopoll;
544 	int i;
545 
546 	sc = device_get_softc(dev);
547 
548 	/* Reading with autopolling on may trigger PCI errors */
549 	autopoll = CSR_READ_4(sc, BGE_MI_MODE);
550 	if (autopoll & BGE_MIMODE_AUTOPOLL) {
551 		BGE_CLRBIT(sc, BGE_MI_MODE, BGE_MIMODE_AUTOPOLL);
552 		DELAY(40);
553 	}
554 
555 	CSR_WRITE_4(sc, BGE_MI_COMM, BGE_MICMD_WRITE|BGE_MICOMM_BUSY|
556 	    BGE_MIPHY(phy)|BGE_MIREG(reg)|val);
557 
558 	for (i = 0; i < BGE_TIMEOUT; i++) {
559 		if (!(CSR_READ_4(sc, BGE_MI_COMM) & BGE_MICOMM_BUSY))
560 			break;
561 	}
562 
563 	if (autopoll & BGE_MIMODE_AUTOPOLL) {
564 		BGE_SETBIT(sc, BGE_MI_MODE, BGE_MIMODE_AUTOPOLL);
565 		DELAY(40);
566 	}
567 
568 	if (i == BGE_TIMEOUT) {
569 		if_printf(&sc->arpcom.ac_if, "PHY read timed out\n");
570 		return(0);
571 	}
572 
573 	return(0);
574 }
575 
576 static void
577 bge_miibus_statchg(device_t dev)
578 {
579 	struct bge_softc *sc;
580 	struct mii_data *mii;
581 
582 	sc = device_get_softc(dev);
583 	mii = device_get_softc(sc->bge_miibus);
584 
585 	BGE_CLRBIT(sc, BGE_MAC_MODE, BGE_MACMODE_PORTMODE);
586 	if (IFM_SUBTYPE(mii->mii_media_active) == IFM_1000_T) {
587 		BGE_SETBIT(sc, BGE_MAC_MODE, BGE_PORTMODE_GMII);
588 	} else {
589 		BGE_SETBIT(sc, BGE_MAC_MODE, BGE_PORTMODE_MII);
590 	}
591 
592 	if ((mii->mii_media_active & IFM_GMASK) == IFM_FDX) {
593 		BGE_CLRBIT(sc, BGE_MAC_MODE, BGE_MACMODE_HALF_DUPLEX);
594 	} else {
595 		BGE_SETBIT(sc, BGE_MAC_MODE, BGE_MACMODE_HALF_DUPLEX);
596 	}
597 }
598 
599 /*
600  * Handle events that have triggered interrupts.
601  */
602 static void
603 bge_handle_events(struct bge_softc *sc)
604 {
605 }
606 
607 /*
608  * Memory management for jumbo frames.
609  */
610 static int
611 bge_alloc_jumbo_mem(struct bge_softc *sc)
612 {
613 	struct bge_jslot *entry;
614 	caddr_t ptr;
615 	int i;
616 
617 	/* Grab a big chunk o' storage. */
618 	sc->bge_cdata.bge_jumbo_buf = contigmalloc(BGE_JMEM, M_DEVBUF,
619 		M_WAITOK, 0, 0xffffffff, PAGE_SIZE, 0);
620 
621 	if (sc->bge_cdata.bge_jumbo_buf == NULL) {
622 		if_printf(&sc->arpcom.ac_if, "no memory for jumbo buffers!\n");
623 		return(ENOBUFS);
624 	}
625 
626 	SLIST_INIT(&sc->bge_jfree_listhead);
627 
628 	/*
629 	 * Now divide it up into 9K pieces and save the addresses
630 	 * in an array. Note that we play an evil trick here by using
631 	 * the first few bytes in the buffer to hold the the address
632 	 * of the softc structure for this interface. This is because
633 	 * bge_jfree() needs it, but it is called by the mbuf management
634 	 * code which will not pass it to us explicitly.
635 	 */
636 	ptr = sc->bge_cdata.bge_jumbo_buf;
637 	for (i = 0; i < BGE_JSLOTS; i++) {
638 		entry = &sc->bge_cdata.bge_jslots[i];
639 		entry->bge_sc = sc;
640 		entry->bge_buf = ptr;
641 		entry->bge_inuse = 0;
642 		entry->bge_slot = i;
643 		SLIST_INSERT_HEAD(&sc->bge_jfree_listhead, entry, jslot_link);
644 		ptr += BGE_JLEN;
645 	}
646 
647 	return(0);
648 }
649 
650 static void
651 bge_free_jumbo_mem(struct bge_softc *sc)
652 {
653 	if (sc->bge_cdata.bge_jumbo_buf)
654 		contigfree(sc->bge_cdata.bge_jumbo_buf, BGE_JMEM, M_DEVBUF);
655 }
656 
657 /*
658  * Allocate a jumbo buffer.
659  */
660 static struct bge_jslot *
661 bge_jalloc(struct bge_softc *sc)
662 {
663 	struct bge_jslot *entry;
664 
665 	lwkt_serialize_enter(&sc->bge_jslot_serializer);
666 	entry = SLIST_FIRST(&sc->bge_jfree_listhead);
667 	if (entry) {
668 		SLIST_REMOVE_HEAD(&sc->bge_jfree_listhead, jslot_link);
669 		entry->bge_inuse = 1;
670 	} else {
671 		if_printf(&sc->arpcom.ac_if, "no free jumbo buffers\n");
672 	}
673 	lwkt_serialize_exit(&sc->bge_jslot_serializer);
674 	return(entry);
675 }
676 
677 /*
678  * Adjust usage count on a jumbo buffer.
679  */
680 static void
681 bge_jref(void *arg)
682 {
683 	struct bge_jslot *entry = (struct bge_jslot *)arg;
684 	struct bge_softc *sc = entry->bge_sc;
685 
686 	if (sc == NULL)
687 		panic("bge_jref: can't find softc pointer!");
688 
689 	if (&sc->bge_cdata.bge_jslots[entry->bge_slot] != entry) {
690 		panic("bge_jref: asked to reference buffer "
691 		    "that we don't manage!");
692 	} else if (entry->bge_inuse == 0) {
693 		panic("bge_jref: buffer already free!");
694 	} else {
695 		atomic_add_int(&entry->bge_inuse, 1);
696 	}
697 }
698 
699 /*
700  * Release a jumbo buffer.
701  */
702 static void
703 bge_jfree(void *arg)
704 {
705 	struct bge_jslot *entry = (struct bge_jslot *)arg;
706 	struct bge_softc *sc = entry->bge_sc;
707 
708 	if (sc == NULL)
709 		panic("bge_jfree: can't find softc pointer!");
710 
711 	if (&sc->bge_cdata.bge_jslots[entry->bge_slot] != entry) {
712 		panic("bge_jfree: asked to free buffer that we don't manage!");
713 	} else if (entry->bge_inuse == 0) {
714 		panic("bge_jfree: buffer already free!");
715 	} else {
716 		/*
717 		 * Possible MP race to 0, use the serializer.  The atomic insn
718 		 * is still needed for races against bge_jref().
719 		 */
720 		lwkt_serialize_enter(&sc->bge_jslot_serializer);
721 		atomic_subtract_int(&entry->bge_inuse, 1);
722 		if (entry->bge_inuse == 0) {
723 			SLIST_INSERT_HEAD(&sc->bge_jfree_listhead,
724 					  entry, jslot_link);
725 		}
726 		lwkt_serialize_exit(&sc->bge_jslot_serializer);
727 	}
728 }
729 
730 
731 /*
732  * Intialize a standard receive ring descriptor.
733  */
734 static int
735 bge_newbuf_std(struct bge_softc *sc, int i, struct mbuf *m)
736 {
737 	struct mbuf *m_new = NULL;
738 	struct bge_rx_bd *r;
739 
740 	if (m == NULL) {
741 		m_new = m_getcl(MB_DONTWAIT, MT_DATA, M_PKTHDR);
742 		if (m_new == NULL)
743 			return (ENOBUFS);
744 		m_new->m_len = m_new->m_pkthdr.len = MCLBYTES;
745 	} else {
746 		m_new = m;
747 		m_new->m_len = m_new->m_pkthdr.len = MCLBYTES;
748 		m_new->m_data = m_new->m_ext.ext_buf;
749 	}
750 
751 	if (!sc->bge_rx_alignment_bug)
752 		m_adj(m_new, ETHER_ALIGN);
753 	sc->bge_cdata.bge_rx_std_chain[i] = m_new;
754 	r = &sc->bge_rdata->bge_rx_std_ring[i];
755 	BGE_HOSTADDR(r->bge_addr, vtophys(mtod(m_new, caddr_t)));
756 	r->bge_flags = BGE_RXBDFLAG_END;
757 	r->bge_len = m_new->m_len;
758 	r->bge_idx = i;
759 
760 	return(0);
761 }
762 
763 /*
764  * Initialize a jumbo receive ring descriptor. This allocates
765  * a jumbo buffer from the pool managed internally by the driver.
766  */
767 static int
768 bge_newbuf_jumbo(struct bge_softc *sc, int i, struct mbuf *m)
769 {
770 	struct mbuf *m_new = NULL;
771 	struct bge_rx_bd *r;
772 
773 	if (m == NULL) {
774 		struct bge_jslot *buf;
775 
776 		/* Allocate the mbuf. */
777 		MGETHDR(m_new, MB_DONTWAIT, MT_DATA);
778 		if (m_new == NULL)
779 			return(ENOBUFS);
780 
781 		/* Allocate the jumbo buffer */
782 		buf = bge_jalloc(sc);
783 		if (buf == NULL) {
784 			m_freem(m_new);
785 			if_printf(&sc->arpcom.ac_if, "jumbo allocation failed "
786 			    "-- packet dropped!\n");
787 			return(ENOBUFS);
788 		}
789 
790 		/* Attach the buffer to the mbuf. */
791 		m_new->m_ext.ext_arg = buf;
792 		m_new->m_ext.ext_buf = buf->bge_buf;
793 		m_new->m_ext.ext_free = bge_jfree;
794 		m_new->m_ext.ext_ref = bge_jref;
795 		m_new->m_ext.ext_size = BGE_JUMBO_FRAMELEN;
796 
797 		m_new->m_data = m_new->m_ext.ext_buf;
798 		m_new->m_flags |= M_EXT;
799 		m_new->m_len = m_new->m_pkthdr.len = m_new->m_ext.ext_size;
800 	} else {
801 		m_new = m;
802 		m_new->m_data = m_new->m_ext.ext_buf;
803 		m_new->m_ext.ext_size = BGE_JUMBO_FRAMELEN;
804 	}
805 
806 	if (!sc->bge_rx_alignment_bug)
807 		m_adj(m_new, ETHER_ALIGN);
808 	/* Set up the descriptor. */
809 	r = &sc->bge_rdata->bge_rx_jumbo_ring[i];
810 	sc->bge_cdata.bge_rx_jumbo_chain[i] = m_new;
811 	BGE_HOSTADDR(r->bge_addr, vtophys(mtod(m_new, caddr_t)));
812 	r->bge_flags = BGE_RXBDFLAG_END|BGE_RXBDFLAG_JUMBO_RING;
813 	r->bge_len = m_new->m_len;
814 	r->bge_idx = i;
815 
816 	return(0);
817 }
818 
819 /*
820  * The standard receive ring has 512 entries in it. At 2K per mbuf cluster,
821  * that's 1MB or memory, which is a lot. For now, we fill only the first
822  * 256 ring entries and hope that our CPU is fast enough to keep up with
823  * the NIC.
824  */
825 static int
826 bge_init_rx_ring_std(struct bge_softc *sc)
827 {
828 	int i;
829 
830 	for (i = 0; i < BGE_SSLOTS; i++) {
831 		if (bge_newbuf_std(sc, i, NULL) == ENOBUFS)
832 			return(ENOBUFS);
833 	};
834 
835 	sc->bge_std = i - 1;
836 	CSR_WRITE_4(sc, BGE_MBX_RX_STD_PROD_LO, sc->bge_std);
837 
838 	return(0);
839 }
840 
841 static void
842 bge_free_rx_ring_std(struct bge_softc *sc)
843 {
844 	int i;
845 
846 	for (i = 0; i < BGE_STD_RX_RING_CNT; i++) {
847 		if (sc->bge_cdata.bge_rx_std_chain[i] != NULL) {
848 			m_freem(sc->bge_cdata.bge_rx_std_chain[i]);
849 			sc->bge_cdata.bge_rx_std_chain[i] = NULL;
850 		}
851 		bzero(&sc->bge_rdata->bge_rx_std_ring[i],
852 		    sizeof(struct bge_rx_bd));
853 	}
854 }
855 
856 static int
857 bge_init_rx_ring_jumbo(struct bge_softc *sc)
858 {
859 	int i;
860 	struct bge_rcb *rcb;
861 
862 	for (i = 0; i < BGE_JUMBO_RX_RING_CNT; i++) {
863 		if (bge_newbuf_jumbo(sc, i, NULL) == ENOBUFS)
864 			return(ENOBUFS);
865 	};
866 
867 	sc->bge_jumbo = i - 1;
868 
869 	rcb = &sc->bge_rdata->bge_info.bge_jumbo_rx_rcb;
870 	rcb->bge_maxlen_flags = BGE_RCB_MAXLEN_FLAGS(0, 0);
871 	CSR_WRITE_4(sc, BGE_RX_JUMBO_RCB_MAXLEN_FLAGS, rcb->bge_maxlen_flags);
872 
873 	CSR_WRITE_4(sc, BGE_MBX_RX_JUMBO_PROD_LO, sc->bge_jumbo);
874 
875 	return(0);
876 }
877 
878 static void
879 bge_free_rx_ring_jumbo(struct bge_softc *sc)
880 {
881 	int i;
882 
883 	for (i = 0; i < BGE_JUMBO_RX_RING_CNT; i++) {
884 		if (sc->bge_cdata.bge_rx_jumbo_chain[i] != NULL) {
885 			m_freem(sc->bge_cdata.bge_rx_jumbo_chain[i]);
886 			sc->bge_cdata.bge_rx_jumbo_chain[i] = NULL;
887 		}
888 		bzero(&sc->bge_rdata->bge_rx_jumbo_ring[i],
889 		    sizeof(struct bge_rx_bd));
890 	}
891 }
892 
893 static void
894 bge_free_tx_ring(struct bge_softc *sc)
895 {
896 	int i;
897 
898 	if (sc->bge_rdata->bge_tx_ring == NULL)
899 		return;
900 
901 	for (i = 0; i < BGE_TX_RING_CNT; i++) {
902 		if (sc->bge_cdata.bge_tx_chain[i] != NULL) {
903 			m_freem(sc->bge_cdata.bge_tx_chain[i]);
904 			sc->bge_cdata.bge_tx_chain[i] = NULL;
905 		}
906 		bzero(&sc->bge_rdata->bge_tx_ring[i],
907 		    sizeof(struct bge_tx_bd));
908 	}
909 }
910 
911 static int
912 bge_init_tx_ring(struct bge_softc *sc)
913 {
914 	sc->bge_txcnt = 0;
915 	sc->bge_tx_saved_considx = 0;
916 
917 	CSR_WRITE_4(sc, BGE_MBX_TX_HOST_PROD0_LO, 0);
918 	/* 5700 b2 errata */
919 	if (sc->bge_chiprev == BGE_CHIPREV_5700_BX)
920 		CSR_WRITE_4(sc, BGE_MBX_TX_HOST_PROD0_LO, 0);
921 
922 	CSR_WRITE_4(sc, BGE_MBX_TX_NIC_PROD0_LO, 0);
923 	/* 5700 b2 errata */
924 	if (sc->bge_chiprev == BGE_CHIPREV_5700_BX)
925 		CSR_WRITE_4(sc, BGE_MBX_TX_NIC_PROD0_LO, 0);
926 
927 	return(0);
928 }
929 
930 static void
931 bge_setmulti(struct bge_softc *sc)
932 {
933 	struct ifnet *ifp;
934 	struct ifmultiaddr *ifma;
935 	uint32_t hashes[4] = { 0, 0, 0, 0 };
936 	int h, i;
937 
938 	ifp = &sc->arpcom.ac_if;
939 
940 	if (ifp->if_flags & IFF_ALLMULTI || ifp->if_flags & IFF_PROMISC) {
941 		for (i = 0; i < 4; i++)
942 			CSR_WRITE_4(sc, BGE_MAR0 + (i * 4), 0xFFFFFFFF);
943 		return;
944 	}
945 
946 	/* First, zot all the existing filters. */
947 	for (i = 0; i < 4; i++)
948 		CSR_WRITE_4(sc, BGE_MAR0 + (i * 4), 0);
949 
950 	/* Now program new ones. */
951 	LIST_FOREACH(ifma, &ifp->if_multiaddrs, ifma_link) {
952 		if (ifma->ifma_addr->sa_family != AF_LINK)
953 			continue;
954 		h = ether_crc32_le(
955 		    LLADDR((struct sockaddr_dl *)ifma->ifma_addr),
956 		    ETHER_ADDR_LEN) & 0x7f;
957 		hashes[(h & 0x60) >> 5] |= 1 << (h & 0x1F);
958 	}
959 
960 	for (i = 0; i < 4; i++)
961 		CSR_WRITE_4(sc, BGE_MAR0 + (i * 4), hashes[i]);
962 }
963 
964 /*
965  * Do endian, PCI and DMA initialization. Also check the on-board ROM
966  * self-test results.
967  */
968 static int
969 bge_chipinit(struct bge_softc *sc)
970 {
971 	int i;
972 	uint32_t dma_rw_ctl;
973 
974 	/* Set endianness before we access any non-PCI registers. */
975 #if BYTE_ORDER == BIG_ENDIAN
976 	pci_write_config(sc->bge_dev, BGE_PCI_MISC_CTL,
977 	    BGE_BIGENDIAN_INIT, 4);
978 #else
979 	pci_write_config(sc->bge_dev, BGE_PCI_MISC_CTL,
980 	    BGE_LITTLEENDIAN_INIT, 4);
981 #endif
982 
983 	/*
984 	 * Check the 'ROM failed' bit on the RX CPU to see if
985 	 * self-tests passed.
986 	 */
987 	if (CSR_READ_4(sc, BGE_RXCPU_MODE) & BGE_RXCPUMODE_ROMFAIL) {
988 		if_printf(&sc->arpcom.ac_if,
989 			  "RX CPU self-diagnostics failed!\n");
990 		return(ENODEV);
991 	}
992 
993 	/* Clear the MAC control register */
994 	CSR_WRITE_4(sc, BGE_MAC_MODE, 0);
995 
996 	/*
997 	 * Clear the MAC statistics block in the NIC's
998 	 * internal memory.
999 	 */
1000 	for (i = BGE_STATS_BLOCK;
1001 	    i < BGE_STATS_BLOCK_END + 1; i += sizeof(uint32_t))
1002 		BGE_MEMWIN_WRITE(sc, i, 0);
1003 
1004 	for (i = BGE_STATUS_BLOCK;
1005 	    i < BGE_STATUS_BLOCK_END + 1; i += sizeof(uint32_t))
1006 		BGE_MEMWIN_WRITE(sc, i, 0);
1007 
1008 	/* Set up the PCI DMA control register. */
1009 	if (sc->bge_pcie) {
1010 		/* PCI Express */
1011 		dma_rw_ctl = BGE_PCI_READ_CMD|BGE_PCI_WRITE_CMD |
1012 		    (0xf << BGE_PCIDMARWCTL_RD_WAT_SHIFT) |
1013 		    (0x2 << BGE_PCIDMARWCTL_WR_WAT_SHIFT);
1014 	} else if (pci_read_config(sc->bge_dev, BGE_PCI_PCISTATE, 4) &
1015 		   BGE_PCISTATE_PCI_BUSMODE) {
1016 		/* Conventional PCI bus */
1017 		dma_rw_ctl = BGE_PCI_READ_CMD|BGE_PCI_WRITE_CMD |
1018 		    (0x7 << BGE_PCIDMARWCTL_RD_WAT_SHIFT) |
1019 		    (0x7 << BGE_PCIDMARWCTL_WR_WAT_SHIFT) |
1020 		    (0x0F);
1021 	} else {
1022 		/* PCI-X bus */
1023 		/*
1024 		 * The 5704 uses a different encoding of read/write
1025 		 * watermarks.
1026 		 */
1027 		if (sc->bge_asicrev == BGE_ASICREV_BCM5704)
1028 			dma_rw_ctl = BGE_PCI_READ_CMD|BGE_PCI_WRITE_CMD |
1029 			    (0x7 << BGE_PCIDMARWCTL_RD_WAT_SHIFT) |
1030 			    (0x3 << BGE_PCIDMARWCTL_WR_WAT_SHIFT);
1031 		else
1032 			dma_rw_ctl = BGE_PCI_READ_CMD|BGE_PCI_WRITE_CMD |
1033 			    (0x3 << BGE_PCIDMARWCTL_RD_WAT_SHIFT) |
1034 			    (0x3 << BGE_PCIDMARWCTL_WR_WAT_SHIFT) |
1035 			    (0x0F);
1036 
1037 		/*
1038 		 * 5703 and 5704 need ONEDMA_AT_ONCE as a workaround
1039 		 * for hardware bugs.
1040 		 */
1041 		if (sc->bge_asicrev == BGE_ASICREV_BCM5703 ||
1042 		    sc->bge_asicrev == BGE_ASICREV_BCM5704) {
1043 			uint32_t tmp;
1044 
1045 			tmp = CSR_READ_4(sc, BGE_PCI_CLKCTL) & 0x1f;
1046 			if (tmp == 0x6 || tmp == 0x7)
1047 				dma_rw_ctl |= BGE_PCIDMARWCTL_ONEDMA_ATONCE;
1048 		}
1049 	}
1050 
1051 	if (sc->bge_asicrev == BGE_ASICREV_BCM5703 ||
1052 	    sc->bge_asicrev == BGE_ASICREV_BCM5704 ||
1053 	    sc->bge_asicrev == BGE_ASICREV_BCM5705 ||
1054 	    sc->bge_asicrev == BGE_ASICREV_BCM5750)
1055 		dma_rw_ctl &= ~BGE_PCIDMARWCTL_MINDMA;
1056 	pci_write_config(sc->bge_dev, BGE_PCI_DMA_RW_CTL, dma_rw_ctl, 4);
1057 
1058 	/*
1059 	 * Set up general mode register.
1060 	 */
1061 	CSR_WRITE_4(sc, BGE_MODE_CTL, BGE_MODECTL_WORDSWAP_NONFRAME|
1062 	    BGE_MODECTL_BYTESWAP_DATA|BGE_MODECTL_WORDSWAP_DATA|
1063 	    BGE_MODECTL_MAC_ATTN_INTR|BGE_MODECTL_HOST_SEND_BDS|
1064 	    BGE_MODECTL_TX_NO_PHDR_CSUM|BGE_MODECTL_RX_NO_PHDR_CSUM);
1065 
1066 	/*
1067 	 * Disable memory write invalidate.  Apparently it is not supported
1068 	 * properly by these devices.
1069 	 */
1070 	PCI_CLRBIT(sc->bge_dev, BGE_PCI_CMD, PCIM_CMD_MWIEN, 4);
1071 
1072 	/* Set the timer prescaler (always 66Mhz) */
1073 	CSR_WRITE_4(sc, BGE_MISC_CFG, 65 << 1/*BGE_32BITTIME_66MHZ*/);
1074 
1075 	return(0);
1076 }
1077 
1078 static int
1079 bge_blockinit(struct bge_softc *sc)
1080 {
1081 	struct bge_rcb *rcb;
1082 	volatile struct bge_rcb *vrcb;
1083 	int i;
1084 
1085 	/*
1086 	 * Initialize the memory window pointer register so that
1087 	 * we can access the first 32K of internal NIC RAM. This will
1088 	 * allow us to set up the TX send ring RCBs and the RX return
1089 	 * ring RCBs, plus other things which live in NIC memory.
1090 	 */
1091 	CSR_WRITE_4(sc, BGE_PCI_MEMWIN_BASEADDR, 0);
1092 
1093 	/* Note: the BCM5704 has a smaller mbuf space than other chips. */
1094 
1095 	if (sc->bge_asicrev != BGE_ASICREV_BCM5705 &&
1096 	    sc->bge_asicrev != BGE_ASICREV_BCM5750) {
1097 		/* Configure mbuf memory pool */
1098 		if (sc->bge_extram) {
1099 			CSR_WRITE_4(sc, BGE_BMAN_MBUFPOOL_BASEADDR,
1100 			    BGE_EXT_SSRAM);
1101 			if (sc->bge_asicrev == BGE_ASICREV_BCM5704)
1102 				CSR_WRITE_4(sc, BGE_BMAN_MBUFPOOL_LEN, 0x10000);
1103 			else
1104 				CSR_WRITE_4(sc, BGE_BMAN_MBUFPOOL_LEN, 0x18000);
1105 		} else {
1106 			CSR_WRITE_4(sc, BGE_BMAN_MBUFPOOL_BASEADDR,
1107 			    BGE_BUFFPOOL_1);
1108 			if (sc->bge_asicrev == BGE_ASICREV_BCM5704)
1109 				CSR_WRITE_4(sc, BGE_BMAN_MBUFPOOL_LEN, 0x10000);
1110 			else
1111 				CSR_WRITE_4(sc, BGE_BMAN_MBUFPOOL_LEN, 0x18000);
1112 		}
1113 
1114 		/* Configure DMA resource pool */
1115 		CSR_WRITE_4(sc, BGE_BMAN_DMA_DESCPOOL_BASEADDR,
1116 		    BGE_DMA_DESCRIPTORS);
1117 		CSR_WRITE_4(sc, BGE_BMAN_DMA_DESCPOOL_LEN, 0x2000);
1118 	}
1119 
1120 	/* Configure mbuf pool watermarks */
1121 	if (sc->bge_asicrev == BGE_ASICREV_BCM5705 ||
1122 	    sc->bge_asicrev == BGE_ASICREV_BCM5750) {
1123 		CSR_WRITE_4(sc, BGE_BMAN_MBUFPOOL_READDMA_LOWAT, 0x0);
1124 		CSR_WRITE_4(sc, BGE_BMAN_MBUFPOOL_MACRX_LOWAT, 0x10);
1125 	} else {
1126 		CSR_WRITE_4(sc, BGE_BMAN_MBUFPOOL_READDMA_LOWAT, 0x50);
1127 		CSR_WRITE_4(sc, BGE_BMAN_MBUFPOOL_MACRX_LOWAT, 0x20);
1128 	}
1129 	CSR_WRITE_4(sc, BGE_BMAN_MBUFPOOL_HIWAT, 0x60);
1130 
1131 	/* Configure DMA resource watermarks */
1132 	CSR_WRITE_4(sc, BGE_BMAN_DMA_DESCPOOL_LOWAT, 5);
1133 	CSR_WRITE_4(sc, BGE_BMAN_DMA_DESCPOOL_HIWAT, 10);
1134 
1135 	/* Enable buffer manager */
1136 	if (sc->bge_asicrev != BGE_ASICREV_BCM5705 &&
1137 	    sc->bge_asicrev != BGE_ASICREV_BCM5750) {
1138 		CSR_WRITE_4(sc, BGE_BMAN_MODE,
1139 		    BGE_BMANMODE_ENABLE|BGE_BMANMODE_LOMBUF_ATTN);
1140 
1141 		/* Poll for buffer manager start indication */
1142 		for (i = 0; i < BGE_TIMEOUT; i++) {
1143 			if (CSR_READ_4(sc, BGE_BMAN_MODE) & BGE_BMANMODE_ENABLE)
1144 				break;
1145 			DELAY(10);
1146 		}
1147 
1148 		if (i == BGE_TIMEOUT) {
1149 			if_printf(&sc->arpcom.ac_if,
1150 				  "buffer manager failed to start\n");
1151 			return(ENXIO);
1152 		}
1153 	}
1154 
1155 	/* Enable flow-through queues */
1156 	CSR_WRITE_4(sc, BGE_FTQ_RESET, 0xFFFFFFFF);
1157 	CSR_WRITE_4(sc, BGE_FTQ_RESET, 0);
1158 
1159 	/* Wait until queue initialization is complete */
1160 	for (i = 0; i < BGE_TIMEOUT; i++) {
1161 		if (CSR_READ_4(sc, BGE_FTQ_RESET) == 0)
1162 			break;
1163 		DELAY(10);
1164 	}
1165 
1166 	if (i == BGE_TIMEOUT) {
1167 		if_printf(&sc->arpcom.ac_if,
1168 			  "flow-through queue init failed\n");
1169 		return(ENXIO);
1170 	}
1171 
1172 	/* Initialize the standard RX ring control block */
1173 	rcb = &sc->bge_rdata->bge_info.bge_std_rx_rcb;
1174 	BGE_HOSTADDR(rcb->bge_hostaddr,
1175 	    vtophys(&sc->bge_rdata->bge_rx_std_ring));
1176 	if (sc->bge_asicrev == BGE_ASICREV_BCM5705 ||
1177 	    sc->bge_asicrev == BGE_ASICREV_BCM5750)
1178 		rcb->bge_maxlen_flags = BGE_RCB_MAXLEN_FLAGS(512, 0);
1179 	else
1180 		rcb->bge_maxlen_flags =
1181 		    BGE_RCB_MAXLEN_FLAGS(BGE_MAX_FRAMELEN, 0);
1182 	if (sc->bge_extram)
1183 		rcb->bge_nicaddr = BGE_EXT_STD_RX_RINGS;
1184 	else
1185 		rcb->bge_nicaddr = BGE_STD_RX_RINGS;
1186 	CSR_WRITE_4(sc, BGE_RX_STD_RCB_HADDR_HI, rcb->bge_hostaddr.bge_addr_hi);
1187 	CSR_WRITE_4(sc, BGE_RX_STD_RCB_HADDR_LO, rcb->bge_hostaddr.bge_addr_lo);
1188 	CSR_WRITE_4(sc, BGE_RX_STD_RCB_MAXLEN_FLAGS, rcb->bge_maxlen_flags);
1189 	CSR_WRITE_4(sc, BGE_RX_STD_RCB_NICADDR, rcb->bge_nicaddr);
1190 
1191 	/*
1192 	 * Initialize the jumbo RX ring control block
1193 	 * We set the 'ring disabled' bit in the flags
1194 	 * field until we're actually ready to start
1195 	 * using this ring (i.e. once we set the MTU
1196 	 * high enough to require it).
1197 	 */
1198 	if (sc->bge_asicrev != BGE_ASICREV_BCM5705 &&
1199 	    sc->bge_asicrev != BGE_ASICREV_BCM5750) {
1200 		rcb = &sc->bge_rdata->bge_info.bge_jumbo_rx_rcb;
1201 		BGE_HOSTADDR(rcb->bge_hostaddr,
1202 		    vtophys(&sc->bge_rdata->bge_rx_jumbo_ring));
1203 		rcb->bge_maxlen_flags =
1204 		    BGE_RCB_MAXLEN_FLAGS(BGE_MAX_FRAMELEN,
1205 		    BGE_RCB_FLAG_RING_DISABLED);
1206 		if (sc->bge_extram)
1207 			rcb->bge_nicaddr = BGE_EXT_JUMBO_RX_RINGS;
1208 		else
1209 			rcb->bge_nicaddr = BGE_JUMBO_RX_RINGS;
1210 		CSR_WRITE_4(sc, BGE_RX_JUMBO_RCB_HADDR_HI,
1211 		    rcb->bge_hostaddr.bge_addr_hi);
1212 		CSR_WRITE_4(sc, BGE_RX_JUMBO_RCB_HADDR_LO,
1213 		    rcb->bge_hostaddr.bge_addr_lo);
1214 		CSR_WRITE_4(sc, BGE_RX_JUMBO_RCB_MAXLEN_FLAGS,
1215 		    rcb->bge_maxlen_flags);
1216 		CSR_WRITE_4(sc, BGE_RX_JUMBO_RCB_NICADDR, rcb->bge_nicaddr);
1217 
1218 		/* Set up dummy disabled mini ring RCB */
1219 		rcb = &sc->bge_rdata->bge_info.bge_mini_rx_rcb;
1220 		rcb->bge_maxlen_flags =
1221 		    BGE_RCB_MAXLEN_FLAGS(0, BGE_RCB_FLAG_RING_DISABLED);
1222 		CSR_WRITE_4(sc, BGE_RX_MINI_RCB_MAXLEN_FLAGS,
1223 		    rcb->bge_maxlen_flags);
1224 	}
1225 
1226 	/*
1227 	 * Set the BD ring replentish thresholds. The recommended
1228 	 * values are 1/8th the number of descriptors allocated to
1229 	 * each ring.
1230 	 */
1231 	CSR_WRITE_4(sc, BGE_RBDI_STD_REPL_THRESH, BGE_STD_RX_RING_CNT/8);
1232 	CSR_WRITE_4(sc, BGE_RBDI_JUMBO_REPL_THRESH, BGE_JUMBO_RX_RING_CNT/8);
1233 
1234 	/*
1235 	 * Disable all unused send rings by setting the 'ring disabled'
1236 	 * bit in the flags field of all the TX send ring control blocks.
1237 	 * These are located in NIC memory.
1238 	 */
1239 	vrcb = (volatile struct bge_rcb *)(sc->bge_vhandle + BGE_MEMWIN_START +
1240 	    BGE_SEND_RING_RCB);
1241 	for (i = 0; i < BGE_TX_RINGS_EXTSSRAM_MAX; i++) {
1242 		vrcb->bge_maxlen_flags =
1243 		    BGE_RCB_MAXLEN_FLAGS(0, BGE_RCB_FLAG_RING_DISABLED);
1244 		vrcb->bge_nicaddr = 0;
1245 		vrcb++;
1246 	}
1247 
1248 	/* Configure TX RCB 0 (we use only the first ring) */
1249 	vrcb = (volatile struct bge_rcb *)(sc->bge_vhandle + BGE_MEMWIN_START +
1250 	    BGE_SEND_RING_RCB);
1251 	vrcb->bge_hostaddr.bge_addr_hi = 0;
1252 	BGE_HOSTADDR(vrcb->bge_hostaddr, vtophys(&sc->bge_rdata->bge_tx_ring));
1253 	vrcb->bge_nicaddr = BGE_NIC_TXRING_ADDR(0, BGE_TX_RING_CNT);
1254 	if (sc->bge_asicrev != BGE_ASICREV_BCM5705 &&
1255 	    sc->bge_asicrev != BGE_ASICREV_BCM5750)
1256 		vrcb->bge_maxlen_flags =
1257 		    BGE_RCB_MAXLEN_FLAGS(BGE_TX_RING_CNT, 0);
1258 
1259 	/* Disable all unused RX return rings */
1260 	vrcb = (volatile struct bge_rcb *)(sc->bge_vhandle + BGE_MEMWIN_START +
1261 	    BGE_RX_RETURN_RING_RCB);
1262 	for (i = 0; i < BGE_RX_RINGS_MAX; i++) {
1263 		vrcb->bge_hostaddr.bge_addr_hi = 0;
1264 		vrcb->bge_hostaddr.bge_addr_lo = 0;
1265 		vrcb->bge_maxlen_flags =
1266 		    BGE_RCB_MAXLEN_FLAGS(sc->bge_return_ring_cnt,
1267 		    BGE_RCB_FLAG_RING_DISABLED);
1268 		vrcb->bge_nicaddr = 0;
1269 		CSR_WRITE_4(sc, BGE_MBX_RX_CONS0_LO +
1270 		    (i * (sizeof(uint64_t))), 0);
1271 		vrcb++;
1272 	}
1273 
1274 	/* Initialize RX ring indexes */
1275 	CSR_WRITE_4(sc, BGE_MBX_RX_STD_PROD_LO, 0);
1276 	CSR_WRITE_4(sc, BGE_MBX_RX_JUMBO_PROD_LO, 0);
1277 	CSR_WRITE_4(sc, BGE_MBX_RX_MINI_PROD_LO, 0);
1278 
1279 	/*
1280 	 * Set up RX return ring 0
1281 	 * Note that the NIC address for RX return rings is 0x00000000.
1282 	 * The return rings live entirely within the host, so the
1283 	 * nicaddr field in the RCB isn't used.
1284 	 */
1285 	vrcb = (volatile struct bge_rcb *)(sc->bge_vhandle + BGE_MEMWIN_START +
1286 	    BGE_RX_RETURN_RING_RCB);
1287 	vrcb->bge_hostaddr.bge_addr_hi = 0;
1288 	BGE_HOSTADDR(vrcb->bge_hostaddr,
1289 	    vtophys(&sc->bge_rdata->bge_rx_return_ring));
1290 	vrcb->bge_nicaddr = 0x00000000;
1291 	vrcb->bge_maxlen_flags =
1292 	    BGE_RCB_MAXLEN_FLAGS(sc->bge_return_ring_cnt, 0);
1293 
1294 	/* Set random backoff seed for TX */
1295 	CSR_WRITE_4(sc, BGE_TX_RANDOM_BACKOFF,
1296 	    sc->arpcom.ac_enaddr[0] + sc->arpcom.ac_enaddr[1] +
1297 	    sc->arpcom.ac_enaddr[2] + sc->arpcom.ac_enaddr[3] +
1298 	    sc->arpcom.ac_enaddr[4] + sc->arpcom.ac_enaddr[5] +
1299 	    BGE_TX_BACKOFF_SEED_MASK);
1300 
1301 	/* Set inter-packet gap */
1302 	CSR_WRITE_4(sc, BGE_TX_LENGTHS, 0x2620);
1303 
1304 	/*
1305 	 * Specify which ring to use for packets that don't match
1306 	 * any RX rules.
1307 	 */
1308 	CSR_WRITE_4(sc, BGE_RX_RULES_CFG, 0x08);
1309 
1310 	/*
1311 	 * Configure number of RX lists. One interrupt distribution
1312 	 * list, sixteen active lists, one bad frames class.
1313 	 */
1314 	CSR_WRITE_4(sc, BGE_RXLP_CFG, 0x181);
1315 
1316 	/* Inialize RX list placement stats mask. */
1317 	CSR_WRITE_4(sc, BGE_RXLP_STATS_ENABLE_MASK, 0x007FFFFF);
1318 	CSR_WRITE_4(sc, BGE_RXLP_STATS_CTL, 0x1);
1319 
1320 	/* Disable host coalescing until we get it set up */
1321 	CSR_WRITE_4(sc, BGE_HCC_MODE, 0x00000000);
1322 
1323 	/* Poll to make sure it's shut down. */
1324 	for (i = 0; i < BGE_TIMEOUT; i++) {
1325 		if (!(CSR_READ_4(sc, BGE_HCC_MODE) & BGE_HCCMODE_ENABLE))
1326 			break;
1327 		DELAY(10);
1328 	}
1329 
1330 	if (i == BGE_TIMEOUT) {
1331 		if_printf(&sc->arpcom.ac_if,
1332 			  "host coalescing engine failed to idle\n");
1333 		return(ENXIO);
1334 	}
1335 
1336 	/* Set up host coalescing defaults */
1337 	CSR_WRITE_4(sc, BGE_HCC_RX_COAL_TICKS, sc->bge_rx_coal_ticks);
1338 	CSR_WRITE_4(sc, BGE_HCC_TX_COAL_TICKS, sc->bge_tx_coal_ticks);
1339 	CSR_WRITE_4(sc, BGE_HCC_RX_MAX_COAL_BDS, sc->bge_rx_max_coal_bds);
1340 	CSR_WRITE_4(sc, BGE_HCC_TX_MAX_COAL_BDS, sc->bge_tx_max_coal_bds);
1341 	if (sc->bge_asicrev != BGE_ASICREV_BCM5705 &&
1342 	    sc->bge_asicrev != BGE_ASICREV_BCM5750) {
1343 		CSR_WRITE_4(sc, BGE_HCC_RX_COAL_TICKS_INT, 0);
1344 		CSR_WRITE_4(sc, BGE_HCC_TX_COAL_TICKS_INT, 0);
1345 	}
1346 	CSR_WRITE_4(sc, BGE_HCC_RX_MAX_COAL_BDS_INT, 0);
1347 	CSR_WRITE_4(sc, BGE_HCC_TX_MAX_COAL_BDS_INT, 0);
1348 
1349 	/* Set up address of statistics block */
1350 	if (sc->bge_asicrev != BGE_ASICREV_BCM5705 &&
1351 	    sc->bge_asicrev != BGE_ASICREV_BCM5750) {
1352 		CSR_WRITE_4(sc, BGE_HCC_STATS_ADDR_HI, 0);
1353 		CSR_WRITE_4(sc, BGE_HCC_STATS_ADDR_LO,
1354 		    vtophys(&sc->bge_rdata->bge_info.bge_stats));
1355 
1356 		CSR_WRITE_4(sc, BGE_HCC_STATS_BASEADDR, BGE_STATS_BLOCK);
1357 		CSR_WRITE_4(sc, BGE_HCC_STATUSBLK_BASEADDR, BGE_STATUS_BLOCK);
1358 		CSR_WRITE_4(sc, BGE_HCC_STATS_TICKS, sc->bge_stat_ticks);
1359 	}
1360 
1361 	/* Set up address of status block */
1362 	CSR_WRITE_4(sc, BGE_HCC_STATUSBLK_ADDR_HI, 0);
1363 	CSR_WRITE_4(sc, BGE_HCC_STATUSBLK_ADDR_LO,
1364 	    vtophys(&sc->bge_rdata->bge_status_block));
1365 
1366 	sc->bge_rdata->bge_status_block.bge_idx[0].bge_rx_prod_idx = 0;
1367 	sc->bge_rdata->bge_status_block.bge_idx[0].bge_tx_cons_idx = 0;
1368 
1369 	/* Turn on host coalescing state machine */
1370 	CSR_WRITE_4(sc, BGE_HCC_MODE, BGE_HCCMODE_ENABLE);
1371 
1372 	/* Turn on RX BD completion state machine and enable attentions */
1373 	CSR_WRITE_4(sc, BGE_RBDC_MODE,
1374 	    BGE_RBDCMODE_ENABLE|BGE_RBDCMODE_ATTN);
1375 
1376 	/* Turn on RX list placement state machine */
1377 	CSR_WRITE_4(sc, BGE_RXLP_MODE, BGE_RXLPMODE_ENABLE);
1378 
1379 	/* Turn on RX list selector state machine. */
1380 	if (sc->bge_asicrev != BGE_ASICREV_BCM5705 &&
1381 	    sc->bge_asicrev != BGE_ASICREV_BCM5750)
1382 		CSR_WRITE_4(sc, BGE_RXLS_MODE, BGE_RXLSMODE_ENABLE);
1383 
1384 	/* Turn on DMA, clear stats */
1385 	CSR_WRITE_4(sc, BGE_MAC_MODE, BGE_MACMODE_TXDMA_ENB|
1386 	    BGE_MACMODE_RXDMA_ENB|BGE_MACMODE_RX_STATS_CLEAR|
1387 	    BGE_MACMODE_TX_STATS_CLEAR|BGE_MACMODE_RX_STATS_ENB|
1388 	    BGE_MACMODE_TX_STATS_ENB|BGE_MACMODE_FRMHDR_DMA_ENB|
1389 	    (sc->bge_tbi ? BGE_PORTMODE_TBI : BGE_PORTMODE_MII));
1390 
1391 	/* Set misc. local control, enable interrupts on attentions */
1392 	CSR_WRITE_4(sc, BGE_MISC_LOCAL_CTL, BGE_MLC_INTR_ONATTN);
1393 
1394 #ifdef notdef
1395 	/* Assert GPIO pins for PHY reset */
1396 	BGE_SETBIT(sc, BGE_MISC_LOCAL_CTL, BGE_MLC_MISCIO_OUT0|
1397 	    BGE_MLC_MISCIO_OUT1|BGE_MLC_MISCIO_OUT2);
1398 	BGE_SETBIT(sc, BGE_MISC_LOCAL_CTL, BGE_MLC_MISCIO_OUTEN0|
1399 	    BGE_MLC_MISCIO_OUTEN1|BGE_MLC_MISCIO_OUTEN2);
1400 #endif
1401 
1402 	/* Turn on DMA completion state machine */
1403 	if (sc->bge_asicrev != BGE_ASICREV_BCM5705 &&
1404 	    sc->bge_asicrev != BGE_ASICREV_BCM5750)
1405 		CSR_WRITE_4(sc, BGE_DMAC_MODE, BGE_DMACMODE_ENABLE);
1406 
1407 	/* Turn on write DMA state machine */
1408 	CSR_WRITE_4(sc, BGE_WDMA_MODE,
1409 	    BGE_WDMAMODE_ENABLE|BGE_WDMAMODE_ALL_ATTNS);
1410 
1411 	/* Turn on read DMA state machine */
1412 	CSR_WRITE_4(sc, BGE_RDMA_MODE,
1413 	    BGE_RDMAMODE_ENABLE|BGE_RDMAMODE_ALL_ATTNS);
1414 
1415 	/* Turn on RX data completion state machine */
1416 	CSR_WRITE_4(sc, BGE_RDC_MODE, BGE_RDCMODE_ENABLE);
1417 
1418 	/* Turn on RX BD initiator state machine */
1419 	CSR_WRITE_4(sc, BGE_RBDI_MODE, BGE_RBDIMODE_ENABLE);
1420 
1421 	/* Turn on RX data and RX BD initiator state machine */
1422 	CSR_WRITE_4(sc, BGE_RDBDI_MODE, BGE_RDBDIMODE_ENABLE);
1423 
1424 	/* Turn on Mbuf cluster free state machine */
1425 	if (sc->bge_asicrev != BGE_ASICREV_BCM5705 &&
1426 	    sc->bge_asicrev != BGE_ASICREV_BCM5750)
1427 		CSR_WRITE_4(sc, BGE_MBCF_MODE, BGE_MBCFMODE_ENABLE);
1428 
1429 	/* Turn on send BD completion state machine */
1430 	CSR_WRITE_4(sc, BGE_SBDC_MODE, BGE_SBDCMODE_ENABLE);
1431 
1432 	/* Turn on send data completion state machine */
1433 	CSR_WRITE_4(sc, BGE_SDC_MODE, BGE_SDCMODE_ENABLE);
1434 
1435 	/* Turn on send data initiator state machine */
1436 	CSR_WRITE_4(sc, BGE_SDI_MODE, BGE_SDIMODE_ENABLE);
1437 
1438 	/* Turn on send BD initiator state machine */
1439 	CSR_WRITE_4(sc, BGE_SBDI_MODE, BGE_SBDIMODE_ENABLE);
1440 
1441 	/* Turn on send BD selector state machine */
1442 	CSR_WRITE_4(sc, BGE_SRS_MODE, BGE_SRSMODE_ENABLE);
1443 
1444 	CSR_WRITE_4(sc, BGE_SDI_STATS_ENABLE_MASK, 0x007FFFFF);
1445 	CSR_WRITE_4(sc, BGE_SDI_STATS_CTL,
1446 	    BGE_SDISTATSCTL_ENABLE|BGE_SDISTATSCTL_FASTER);
1447 
1448 	/* ack/clear link change events */
1449 	CSR_WRITE_4(sc, BGE_MAC_STS, BGE_MACSTAT_SYNC_CHANGED|
1450 	    BGE_MACSTAT_CFG_CHANGED|BGE_MACSTAT_MI_COMPLETE|
1451 	    BGE_MACSTAT_LINK_CHANGED);
1452 
1453 	/* Enable PHY auto polling (for MII/GMII only) */
1454 	if (sc->bge_tbi) {
1455 		CSR_WRITE_4(sc, BGE_MI_STS, BGE_MISTS_LINK);
1456  	} else {
1457 		BGE_SETBIT(sc, BGE_MI_MODE, BGE_MIMODE_AUTOPOLL|10<<16);
1458 		if (sc->bge_asicrev == BGE_ASICREV_BCM5700)
1459 			CSR_WRITE_4(sc, BGE_MAC_EVT_ENB,
1460 			    BGE_EVTENB_MI_INTERRUPT);
1461 	}
1462 
1463 	/* Enable link state change attentions. */
1464 	BGE_SETBIT(sc, BGE_MAC_EVT_ENB, BGE_EVTENB_LINK_CHANGED);
1465 
1466 	return(0);
1467 }
1468 
1469 /*
1470  * Probe for a Broadcom chip. Check the PCI vendor and device IDs
1471  * against our list and return its name if we find a match. Note
1472  * that since the Broadcom controller contains VPD support, we
1473  * can get the device name string from the controller itself instead
1474  * of the compiled-in string. This is a little slow, but it guarantees
1475  * we'll always announce the right product name.
1476  */
1477 static int
1478 bge_probe(device_t dev)
1479 {
1480 	struct bge_softc *sc;
1481 	struct bge_type *t;
1482 	char *descbuf;
1483 	uint16_t product, vendor;
1484 
1485 	product = pci_get_device(dev);
1486 	vendor = pci_get_vendor(dev);
1487 
1488 	for (t = bge_devs; t->bge_name != NULL; t++) {
1489 		if (vendor == t->bge_vid && product == t->bge_did)
1490 			break;
1491 	}
1492 
1493 	if (t->bge_name == NULL)
1494 		return(ENXIO);
1495 
1496 	sc = device_get_softc(dev);
1497 #ifdef notdef
1498 	sc->bge_dev = dev;
1499 
1500 	bge_vpd_read(sc);
1501 	device_set_desc(dev, sc->bge_vpd_prodname);
1502 #endif
1503 	descbuf = malloc(BGE_DEVDESC_MAX, M_TEMP, M_WAITOK);
1504 	snprintf(descbuf, BGE_DEVDESC_MAX, "%s, ASIC rev. %#04x", t->bge_name,
1505 	    pci_read_config(dev, BGE_PCI_MISC_CTL, 4) >> 16);
1506 	device_set_desc_copy(dev, descbuf);
1507 	if (pci_get_subvendor(dev) == PCI_VENDOR_DELL)
1508 		sc->bge_no_3_led = 1;
1509 	free(descbuf, M_TEMP);
1510 	return(0);
1511 }
1512 
1513 static int
1514 bge_attach(device_t dev)
1515 {
1516 	struct ifnet *ifp;
1517 	struct bge_softc *sc;
1518 	uint32_t hwcfg = 0;
1519 	uint32_t mac_addr = 0;
1520 	int error = 0, rid;
1521 	uint8_t ether_addr[ETHER_ADDR_LEN];
1522 
1523 	sc = device_get_softc(dev);
1524 	sc->bge_dev = dev;
1525 	callout_init(&sc->bge_stat_timer);
1526 	lwkt_serialize_init(&sc->bge_jslot_serializer);
1527 
1528 	/*
1529 	 * Map control/status registers.
1530 	 */
1531 	pci_enable_busmaster(dev);
1532 
1533 	rid = BGE_PCI_BAR0;
1534 	sc->bge_res = bus_alloc_resource_any(dev, SYS_RES_MEMORY, &rid,
1535 	    RF_ACTIVE);
1536 
1537 	if (sc->bge_res == NULL) {
1538 		device_printf(dev, "couldn't map memory\n");
1539 		error = ENXIO;
1540 		return(error);
1541 	}
1542 
1543 	sc->bge_btag = rman_get_bustag(sc->bge_res);
1544 	sc->bge_bhandle = rman_get_bushandle(sc->bge_res);
1545 	sc->bge_vhandle = (vm_offset_t)rman_get_virtual(sc->bge_res);
1546 
1547 	/* Allocate interrupt */
1548 	rid = 0;
1549 
1550 	sc->bge_irq = bus_alloc_resource_any(dev, SYS_RES_IRQ, &rid,
1551 	    RF_SHAREABLE | RF_ACTIVE);
1552 
1553 	if (sc->bge_irq == NULL) {
1554 		device_printf(dev, "couldn't map interrupt\n");
1555 		error = ENXIO;
1556 		goto fail;
1557 	}
1558 
1559 	/* Save ASIC rev. */
1560 	sc->bge_chipid =
1561 	    pci_read_config(dev, BGE_PCI_MISC_CTL, 4) &
1562 	    BGE_PCIMISCCTL_ASICREV;
1563 	sc->bge_asicrev = BGE_ASICREV(sc->bge_chipid);
1564 	sc->bge_chiprev = BGE_CHIPREV(sc->bge_chipid);
1565 
1566 	/*
1567 	 * Treat the 5714 like the 5750 until we have more info
1568 	 * on this chip.
1569 	 */
1570 	if (sc->bge_asicrev == BGE_ASICREV_BCM5714)
1571 		sc->bge_asicrev = BGE_ASICREV_BCM5750;
1572 
1573 	/*
1574 	 * XXX: Broadcom Linux driver.  Not in specs or eratta.
1575 	 * PCI-Express?
1576 	 */
1577 	if (sc->bge_asicrev == BGE_ASICREV_BCM5750) {
1578 		uint32_t v;
1579 
1580 		v = pci_read_config(dev, BGE_PCI_MSI_CAPID, 4);
1581 		if (((v >> 8) & 0xff) == BGE_PCIE_MSI_CAPID) {
1582 			v = pci_read_config(dev, BGE_PCIE_MSI_CAPID, 4);
1583 			if ((v & 0xff) == BGE_PCIE_MSI_CAPID_VAL)
1584 				sc->bge_pcie = 1;
1585 		}
1586 	}
1587 
1588 	ifp = &sc->arpcom.ac_if;
1589 	if_initname(ifp, device_get_name(dev), device_get_unit(dev));
1590 
1591 	/* Try to reset the chip. */
1592 	bge_reset(sc);
1593 
1594 	if (bge_chipinit(sc)) {
1595 		device_printf(dev, "chip initialization failed\n");
1596 		error = ENXIO;
1597 		goto fail;
1598 	}
1599 
1600 	/*
1601 	 * Get station address from the EEPROM.
1602 	 */
1603 	mac_addr = bge_readmem_ind(sc, 0x0c14);
1604 	if ((mac_addr >> 16) == 0x484b) {
1605 		ether_addr[0] = (uint8_t)(mac_addr >> 8);
1606 		ether_addr[1] = (uint8_t)mac_addr;
1607 		mac_addr = bge_readmem_ind(sc, 0x0c18);
1608 		ether_addr[2] = (uint8_t)(mac_addr >> 24);
1609 		ether_addr[3] = (uint8_t)(mac_addr >> 16);
1610 		ether_addr[4] = (uint8_t)(mac_addr >> 8);
1611 		ether_addr[5] = (uint8_t)mac_addr;
1612 	} else if (bge_read_eeprom(sc, ether_addr,
1613 	    BGE_EE_MAC_OFFSET + 2, ETHER_ADDR_LEN)) {
1614 		device_printf(dev, "failed to read station address\n");
1615 		error = ENXIO;
1616 		goto fail;
1617 	}
1618 
1619 	/* Allocate the general information block and ring buffers. */
1620 	sc->bge_rdata = contigmalloc(sizeof(struct bge_ring_data), M_DEVBUF,
1621 	    M_WAITOK, 0, 0xffffffff, PAGE_SIZE, 0);
1622 
1623 	if (sc->bge_rdata == NULL) {
1624 		error = ENXIO;
1625 		device_printf(dev, "no memory for list buffers!\n");
1626 		goto fail;
1627 	}
1628 
1629 	bzero(sc->bge_rdata, sizeof(struct bge_ring_data));
1630 
1631 	/*
1632 	 * Try to allocate memory for jumbo buffers.
1633 	 * The 5705/5750 does not appear to support jumbo frames.
1634 	 */
1635 	if (sc->bge_asicrev != BGE_ASICREV_BCM5705 &&
1636 	    sc->bge_asicrev != BGE_ASICREV_BCM5750) {
1637 		if (bge_alloc_jumbo_mem(sc)) {
1638 			device_printf(dev, "jumbo buffer allocation failed\n");
1639 			error = ENXIO;
1640 			goto fail;
1641 		}
1642 	}
1643 
1644 	/* Set default tuneable values. */
1645 	sc->bge_stat_ticks = BGE_TICKS_PER_SEC;
1646 	sc->bge_rx_coal_ticks = 150;
1647 	sc->bge_tx_coal_ticks = 150;
1648 	sc->bge_rx_max_coal_bds = 64;
1649 	sc->bge_tx_max_coal_bds = 128;
1650 
1651 	/* 5705/5750 limits RX return ring to 512 entries. */
1652 	if (sc->bge_asicrev == BGE_ASICREV_BCM5705 ||
1653 	    sc->bge_asicrev == BGE_ASICREV_BCM5750)
1654 		sc->bge_return_ring_cnt = BGE_RETURN_RING_CNT_5705;
1655 	else
1656 		sc->bge_return_ring_cnt = BGE_RETURN_RING_CNT;
1657 
1658 	/* Set up ifnet structure */
1659 	ifp->if_softc = sc;
1660 	ifp->if_flags = IFF_BROADCAST | IFF_SIMPLEX | IFF_MULTICAST;
1661 	ifp->if_ioctl = bge_ioctl;
1662 	ifp->if_start = bge_start;
1663 	ifp->if_watchdog = bge_watchdog;
1664 	ifp->if_init = bge_init;
1665 	ifp->if_mtu = ETHERMTU;
1666 	ifq_set_maxlen(&ifp->if_snd, BGE_TX_RING_CNT - 1);
1667 	ifq_set_ready(&ifp->if_snd);
1668 	ifp->if_hwassist = BGE_CSUM_FEATURES;
1669 	ifp->if_capabilities = IFCAP_HWCSUM;
1670 	ifp->if_capenable = ifp->if_capabilities;
1671 
1672 	/*
1673 	 * Figure out what sort of media we have by checking the
1674 	 * hardware config word in the first 32k of NIC internal memory,
1675 	 * or fall back to examining the EEPROM if necessary.
1676 	 * Note: on some BCM5700 cards, this value appears to be unset.
1677 	 * If that's the case, we have to rely on identifying the NIC
1678 	 * by its PCI subsystem ID, as we do below for the SysKonnect
1679 	 * SK-9D41.
1680 	 */
1681 	if (bge_readmem_ind(sc, BGE_SOFTWARE_GENCOMM_SIG) == BGE_MAGIC_NUMBER)
1682 		hwcfg = bge_readmem_ind(sc, BGE_SOFTWARE_GENCOMM_NICCFG);
1683 	else {
1684 		bge_read_eeprom(sc, (caddr_t)&hwcfg,
1685 				BGE_EE_HWCFG_OFFSET, sizeof(hwcfg));
1686 		hwcfg = ntohl(hwcfg);
1687 	}
1688 
1689 	if ((hwcfg & BGE_HWCFG_MEDIA) == BGE_MEDIA_FIBER)
1690 		sc->bge_tbi = 1;
1691 
1692 	/* The SysKonnect SK-9D41 is a 1000baseSX card. */
1693 	if (pci_get_subvendor(dev) == PCI_PRODUCT_SCHNEIDERKOCH_SK_9D41)
1694 		sc->bge_tbi = 1;
1695 
1696 	if (sc->bge_tbi) {
1697 		ifmedia_init(&sc->bge_ifmedia, IFM_IMASK,
1698 		    bge_ifmedia_upd, bge_ifmedia_sts);
1699 		ifmedia_add(&sc->bge_ifmedia, IFM_ETHER|IFM_1000_SX, 0, NULL);
1700 		ifmedia_add(&sc->bge_ifmedia,
1701 		    IFM_ETHER|IFM_1000_SX|IFM_FDX, 0, NULL);
1702 		ifmedia_add(&sc->bge_ifmedia, IFM_ETHER|IFM_AUTO, 0, NULL);
1703 		ifmedia_set(&sc->bge_ifmedia, IFM_ETHER|IFM_AUTO);
1704 		sc->bge_ifmedia.ifm_media = sc->bge_ifmedia.ifm_cur->ifm_media;
1705 	} else {
1706 		/*
1707 		 * Do transceiver setup.
1708 		 */
1709 		if (mii_phy_probe(dev, &sc->bge_miibus,
1710 		    bge_ifmedia_upd, bge_ifmedia_sts)) {
1711 			device_printf(dev, "MII without any PHY!\n");
1712 			error = ENXIO;
1713 			goto fail;
1714 		}
1715 	}
1716 
1717 	/*
1718 	 * When using the BCM5701 in PCI-X mode, data corruption has
1719 	 * been observed in the first few bytes of some received packets.
1720 	 * Aligning the packet buffer in memory eliminates the corruption.
1721 	 * Unfortunately, this misaligns the packet payloads.  On platforms
1722 	 * which do not support unaligned accesses, we will realign the
1723 	 * payloads by copying the received packets.
1724 	 */
1725 	switch (sc->bge_chipid) {
1726 	case BGE_CHIPID_BCM5701_A0:
1727 	case BGE_CHIPID_BCM5701_B0:
1728 	case BGE_CHIPID_BCM5701_B2:
1729 	case BGE_CHIPID_BCM5701_B5:
1730 		/* If in PCI-X mode, work around the alignment bug. */
1731 		if ((pci_read_config(dev, BGE_PCI_PCISTATE, 4) &
1732 		    (BGE_PCISTATE_PCI_BUSMODE | BGE_PCISTATE_PCI_BUSSPEED)) ==
1733 		    BGE_PCISTATE_PCI_BUSSPEED)
1734 			sc->bge_rx_alignment_bug = 1;
1735 		break;
1736 	}
1737 
1738 	/*
1739 	 * Call MI attach routine.
1740 	 */
1741 	ether_ifattach(ifp, ether_addr, NULL);
1742 
1743 	error = bus_setup_intr(dev, sc->bge_irq, INTR_NETSAFE,
1744 			       bge_intr, sc, &sc->bge_intrhand,
1745 			       ifp->if_serializer);
1746 	if (error) {
1747 		ether_ifdetach(ifp);
1748 		device_printf(dev, "couldn't set up irq\n");
1749 		goto fail;
1750 	}
1751 
1752 	return(0);
1753 
1754 fail:
1755 	bge_detach(dev);
1756 
1757 	return(error);
1758 }
1759 
1760 static int
1761 bge_detach(device_t dev)
1762 {
1763 	struct bge_softc *sc = device_get_softc(dev);
1764 	struct ifnet *ifp = &sc->arpcom.ac_if;
1765 
1766 	if (device_is_attached(dev)) {
1767 		lwkt_serialize_enter(ifp->if_serializer);
1768 		bge_stop(sc);
1769 		bge_reset(sc);
1770 		bus_teardown_intr(dev, sc->bge_irq, sc->bge_intrhand);
1771 		lwkt_serialize_exit(ifp->if_serializer);
1772 
1773 		ether_ifdetach(ifp);
1774 	}
1775 	if (sc->bge_tbi)
1776 		ifmedia_removeall(&sc->bge_ifmedia);
1777 	if (sc->bge_miibus);
1778 		device_delete_child(dev, sc->bge_miibus);
1779 	bus_generic_detach(dev);
1780 
1781 	bge_release_resources(sc);
1782 
1783 	if (sc->bge_asicrev != BGE_ASICREV_BCM5705 &&
1784 	    sc->bge_asicrev != BGE_ASICREV_BCM5750)
1785 		bge_free_jumbo_mem(sc);
1786 
1787 	return(0);
1788 }
1789 
1790 static void
1791 bge_release_resources(struct bge_softc *sc)
1792 {
1793         device_t dev;
1794 
1795         dev = sc->bge_dev;
1796 
1797 	if (sc->bge_vpd_prodname != NULL)
1798 		free(sc->bge_vpd_prodname, M_DEVBUF);
1799 
1800 	if (sc->bge_vpd_readonly != NULL)
1801 		free(sc->bge_vpd_readonly, M_DEVBUF);
1802 
1803         if (sc->bge_irq != NULL)
1804 		bus_release_resource(dev, SYS_RES_IRQ, 0, sc->bge_irq);
1805 
1806         if (sc->bge_res != NULL)
1807 		bus_release_resource(dev, SYS_RES_MEMORY,
1808 		    BGE_PCI_BAR0, sc->bge_res);
1809 
1810         if (sc->bge_rdata != NULL)
1811 		contigfree(sc->bge_rdata, sizeof(struct bge_ring_data),
1812 			   M_DEVBUF);
1813 
1814         return;
1815 }
1816 
1817 static void
1818 bge_reset(struct bge_softc *sc)
1819 {
1820 	device_t dev;
1821 	uint32_t cachesize, command, pcistate, reset;
1822 	int i, val = 0;
1823 
1824 	dev = sc->bge_dev;
1825 
1826 	/* Save some important PCI state. */
1827 	cachesize = pci_read_config(dev, BGE_PCI_CACHESZ, 4);
1828 	command = pci_read_config(dev, BGE_PCI_CMD, 4);
1829 	pcistate = pci_read_config(dev, BGE_PCI_PCISTATE, 4);
1830 
1831 	pci_write_config(dev, BGE_PCI_MISC_CTL,
1832 	    BGE_PCIMISCCTL_INDIRECT_ACCESS|BGE_PCIMISCCTL_MASK_PCI_INTR|
1833 	    BGE_PCIMISCCTL_ENDIAN_WORDSWAP|BGE_PCIMISCCTL_PCISTATE_RW, 4);
1834 
1835 	reset = BGE_MISCCFG_RESET_CORE_CLOCKS|(65<<1);
1836 
1837 	/* XXX: Broadcom Linux driver. */
1838 	if (sc->bge_pcie) {
1839 		if (CSR_READ_4(sc, 0x7e2c) == 0x60)	/* PCIE 1.0 */
1840 			CSR_WRITE_4(sc, 0x7e2c, 0x20);
1841 		if (sc->bge_chipid != BGE_CHIPID_BCM5750_A0) {
1842 			/* Prevent PCIE link training during global reset */
1843 			CSR_WRITE_4(sc, BGE_MISC_CFG, (1<<29));
1844 			reset |= (1<<29);
1845 		}
1846 	}
1847 
1848 	/* Issue global reset */
1849 	bge_writereg_ind(sc, BGE_MISC_CFG, reset);
1850 
1851 	DELAY(1000);
1852 
1853 	/* XXX: Broadcom Linux driver. */
1854 	if (sc->bge_pcie) {
1855 		if (sc->bge_chipid == BGE_CHIPID_BCM5750_A0) {
1856 			uint32_t v;
1857 
1858 			DELAY(500000); /* wait for link training to complete */
1859 			v = pci_read_config(dev, 0xc4, 4);
1860 			pci_write_config(dev, 0xc4, v | (1<<15), 4);
1861 		}
1862 		/* Set PCIE max payload size and clear error status. */
1863 		pci_write_config(dev, 0xd8, 0xf5000, 4);
1864 	}
1865 
1866 	/* Reset some of the PCI state that got zapped by reset */
1867 	pci_write_config(dev, BGE_PCI_MISC_CTL,
1868 	    BGE_PCIMISCCTL_INDIRECT_ACCESS|BGE_PCIMISCCTL_MASK_PCI_INTR|
1869 	    BGE_PCIMISCCTL_ENDIAN_WORDSWAP|BGE_PCIMISCCTL_PCISTATE_RW, 4);
1870 	pci_write_config(dev, BGE_PCI_CACHESZ, cachesize, 4);
1871 	pci_write_config(dev, BGE_PCI_CMD, command, 4);
1872 	bge_writereg_ind(sc, BGE_MISC_CFG, (65 << 1));
1873 
1874 	/* Enable memory arbiter. */
1875 	if (sc->bge_asicrev != BGE_ASICREV_BCM5705)
1876 		CSR_WRITE_4(sc, BGE_MARB_MODE, BGE_MARBMODE_ENABLE);
1877 
1878 	/*
1879 	 * Prevent PXE restart: write a magic number to the
1880 	 * general communications memory at 0xB50.
1881 	 */
1882 	bge_writemem_ind(sc, BGE_SOFTWARE_GENCOMM, BGE_MAGIC_NUMBER);
1883 	/*
1884 	 * Poll the value location we just wrote until
1885 	 * we see the 1's complement of the magic number.
1886 	 * This indicates that the firmware initialization
1887 	 * is complete.
1888 	 */
1889 	for (i = 0; i < BGE_TIMEOUT; i++) {
1890 		val = bge_readmem_ind(sc, BGE_SOFTWARE_GENCOMM);
1891 		if (val == ~BGE_MAGIC_NUMBER)
1892 			break;
1893 		DELAY(10);
1894 	}
1895 
1896 	if (i == BGE_TIMEOUT) {
1897 		if_printf(&sc->arpcom.ac_if, "firmware handshake timed out\n");
1898 		return;
1899 	}
1900 
1901 	/*
1902 	 * XXX Wait for the value of the PCISTATE register to
1903 	 * return to its original pre-reset state. This is a
1904 	 * fairly good indicator of reset completion. If we don't
1905 	 * wait for the reset to fully complete, trying to read
1906 	 * from the device's non-PCI registers may yield garbage
1907 	 * results.
1908 	 */
1909 	for (i = 0; i < BGE_TIMEOUT; i++) {
1910 		if (pci_read_config(dev, BGE_PCI_PCISTATE, 4) == pcistate)
1911 			break;
1912 		DELAY(10);
1913 	}
1914 
1915 	/* Fix up byte swapping */
1916 	CSR_WRITE_4(sc, BGE_MODE_CTL, BGE_MODECTL_BYTESWAP_NONFRAME|
1917 	    BGE_MODECTL_BYTESWAP_DATA);
1918 
1919 	CSR_WRITE_4(sc, BGE_MAC_MODE, 0);
1920 
1921 	/*
1922 	 * The 5704 in TBI mode apparently needs some special
1923 	 * adjustment to insure the SERDES drive level is set
1924 	 * to 1.2V.
1925 	 */
1926 	if (sc->bge_asicrev == BGE_ASICREV_BCM5704 && sc->bge_tbi) {
1927 		uint32_t serdescfg;
1928 
1929 		serdescfg = CSR_READ_4(sc, BGE_SERDES_CFG);
1930 		serdescfg = (serdescfg & ~0xFFF) | 0x880;
1931 		CSR_WRITE_4(sc, BGE_SERDES_CFG, serdescfg);
1932 	}
1933 
1934 	/* XXX: Broadcom Linux driver. */
1935 	if (sc->bge_pcie && sc->bge_chipid != BGE_CHIPID_BCM5750_A0) {
1936 		uint32_t v;
1937 
1938 		v = CSR_READ_4(sc, 0x7c00);
1939 		CSR_WRITE_4(sc, 0x7c00, v | (1<<25));
1940 	}
1941 
1942 	DELAY(10000);
1943 }
1944 
1945 /*
1946  * Frame reception handling. This is called if there's a frame
1947  * on the receive return list.
1948  *
1949  * Note: we have to be able to handle two possibilities here:
1950  * 1) the frame is from the jumbo recieve ring
1951  * 2) the frame is from the standard receive ring
1952  */
1953 
1954 static void
1955 bge_rxeof(struct bge_softc *sc)
1956 {
1957 	struct ifnet *ifp;
1958 	int stdcnt = 0, jumbocnt = 0;
1959 
1960 	ifp = &sc->arpcom.ac_if;
1961 
1962 	while(sc->bge_rx_saved_considx !=
1963 	    sc->bge_rdata->bge_status_block.bge_idx[0].bge_rx_prod_idx) {
1964 		struct bge_rx_bd	*cur_rx;
1965 		uint32_t		rxidx;
1966 		struct mbuf		*m = NULL;
1967 		uint16_t		vlan_tag = 0;
1968 		int			have_tag = 0;
1969 
1970 		cur_rx =
1971 	    &sc->bge_rdata->bge_rx_return_ring[sc->bge_rx_saved_considx];
1972 
1973 		rxidx = cur_rx->bge_idx;
1974 		BGE_INC(sc->bge_rx_saved_considx, sc->bge_return_ring_cnt);
1975 
1976 		if (cur_rx->bge_flags & BGE_RXBDFLAG_VLAN_TAG) {
1977 			have_tag = 1;
1978 			vlan_tag = cur_rx->bge_vlan_tag;
1979 		}
1980 
1981 		if (cur_rx->bge_flags & BGE_RXBDFLAG_JUMBO_RING) {
1982 			BGE_INC(sc->bge_jumbo, BGE_JUMBO_RX_RING_CNT);
1983 			m = sc->bge_cdata.bge_rx_jumbo_chain[rxidx];
1984 			sc->bge_cdata.bge_rx_jumbo_chain[rxidx] = NULL;
1985 			jumbocnt++;
1986 			if (cur_rx->bge_flags & BGE_RXBDFLAG_ERROR) {
1987 				ifp->if_ierrors++;
1988 				bge_newbuf_jumbo(sc, sc->bge_jumbo, m);
1989 				continue;
1990 			}
1991 			if (bge_newbuf_jumbo(sc,
1992 			    sc->bge_jumbo, NULL) == ENOBUFS) {
1993 				ifp->if_ierrors++;
1994 				bge_newbuf_jumbo(sc, sc->bge_jumbo, m);
1995 				continue;
1996 			}
1997 		} else {
1998 			BGE_INC(sc->bge_std, BGE_STD_RX_RING_CNT);
1999 			m = sc->bge_cdata.bge_rx_std_chain[rxidx];
2000 			sc->bge_cdata.bge_rx_std_chain[rxidx] = NULL;
2001 			stdcnt++;
2002 			if (cur_rx->bge_flags & BGE_RXBDFLAG_ERROR) {
2003 				ifp->if_ierrors++;
2004 				bge_newbuf_std(sc, sc->bge_std, m);
2005 				continue;
2006 			}
2007 			if (bge_newbuf_std(sc, sc->bge_std,
2008 			    NULL) == ENOBUFS) {
2009 				ifp->if_ierrors++;
2010 				bge_newbuf_std(sc, sc->bge_std, m);
2011 				continue;
2012 			}
2013 		}
2014 
2015 		ifp->if_ipackets++;
2016 #ifndef __i386__
2017 		/*
2018 		 * The i386 allows unaligned accesses, but for other
2019 		 * platforms we must make sure the payload is aligned.
2020 		 */
2021 		if (sc->bge_rx_alignment_bug) {
2022 			bcopy(m->m_data, m->m_data + ETHER_ALIGN,
2023 			    cur_rx->bge_len);
2024 			m->m_data += ETHER_ALIGN;
2025 		}
2026 #endif
2027 		m->m_pkthdr.len = m->m_len = cur_rx->bge_len - ETHER_CRC_LEN;
2028 		m->m_pkthdr.rcvif = ifp;
2029 
2030 #if 0 /* currently broken for some packets, possibly related to TCP options */
2031 		if (ifp->if_hwassist) {
2032 			m->m_pkthdr.csum_flags |= CSUM_IP_CHECKED;
2033 			if ((cur_rx->bge_ip_csum ^ 0xffff) == 0)
2034 				m->m_pkthdr.csum_flags |= CSUM_IP_VALID;
2035 			if (cur_rx->bge_flags & BGE_RXBDFLAG_TCP_UDP_CSUM) {
2036 				m->m_pkthdr.csum_data =
2037 				    cur_rx->bge_tcp_udp_csum;
2038 				m->m_pkthdr.csum_flags |= CSUM_DATA_VALID;
2039 			}
2040 		}
2041 #endif
2042 
2043 		/*
2044 		 * If we received a packet with a vlan tag, pass it
2045 		 * to vlan_input() instead of ether_input().
2046 		 */
2047 		if (have_tag) {
2048 			VLAN_INPUT_TAG(m, vlan_tag);
2049 			have_tag = vlan_tag = 0;
2050 		} else {
2051 			ifp->if_input(ifp, m);
2052 		}
2053 	}
2054 
2055 	CSR_WRITE_4(sc, BGE_MBX_RX_CONS0_LO, sc->bge_rx_saved_considx);
2056 	if (stdcnt)
2057 		CSR_WRITE_4(sc, BGE_MBX_RX_STD_PROD_LO, sc->bge_std);
2058 	if (jumbocnt)
2059 		CSR_WRITE_4(sc, BGE_MBX_RX_JUMBO_PROD_LO, sc->bge_jumbo);
2060 }
2061 
2062 static void
2063 bge_txeof(struct bge_softc *sc)
2064 {
2065 	struct bge_tx_bd *cur_tx = NULL;
2066 	struct ifnet *ifp;
2067 
2068 	ifp = &sc->arpcom.ac_if;
2069 
2070 	/*
2071 	 * Go through our tx ring and free mbufs for those
2072 	 * frames that have been sent.
2073 	 */
2074 	while (sc->bge_tx_saved_considx !=
2075 	    sc->bge_rdata->bge_status_block.bge_idx[0].bge_tx_cons_idx) {
2076 		uint32_t		idx = 0;
2077 
2078 		idx = sc->bge_tx_saved_considx;
2079 		cur_tx = &sc->bge_rdata->bge_tx_ring[idx];
2080 		if (cur_tx->bge_flags & BGE_TXBDFLAG_END)
2081 			ifp->if_opackets++;
2082 		if (sc->bge_cdata.bge_tx_chain[idx] != NULL) {
2083 			m_freem(sc->bge_cdata.bge_tx_chain[idx]);
2084 			sc->bge_cdata.bge_tx_chain[idx] = NULL;
2085 		}
2086 		sc->bge_txcnt--;
2087 		BGE_INC(sc->bge_tx_saved_considx, BGE_TX_RING_CNT);
2088 		ifp->if_timer = 0;
2089 	}
2090 
2091 	if (cur_tx != NULL)
2092 		ifp->if_flags &= ~IFF_OACTIVE;
2093 }
2094 
2095 static void
2096 bge_intr(void *xsc)
2097 {
2098 	struct bge_softc *sc = xsc;
2099 	struct ifnet *ifp = &sc->arpcom.ac_if;
2100  	uint32_t status, statusword, mimode;
2101 
2102 	/* XXX */
2103 	statusword = loadandclear(&sc->bge_rdata->bge_status_block.bge_status);
2104 
2105 #ifdef notdef
2106 	/* Avoid this for now -- checking this register is expensive. */
2107 	/* Make sure this is really our interrupt. */
2108 	if (!(CSR_READ_4(sc, BGE_MISC_LOCAL_CTL) & BGE_MLC_INTR_STATE))
2109 		return;
2110 #endif
2111 	/* Ack interrupt and stop others from occuring. */
2112 	CSR_WRITE_4(sc, BGE_MBX_IRQ0_LO, 1);
2113 
2114 	/*
2115 	 * Process link state changes.
2116 	 * Grrr. The link status word in the status block does
2117 	 * not work correctly on the BCM5700 rev AX and BX chips,
2118 	 * according to all available information. Hence, we have
2119 	 * to enable MII interrupts in order to properly obtain
2120 	 * async link changes. Unfortunately, this also means that
2121 	 * we have to read the MAC status register to detect link
2122 	 * changes, thereby adding an additional register access to
2123 	 * the interrupt handler.
2124 	 */
2125 
2126 	if (sc->bge_asicrev == BGE_ASICREV_BCM5700) {
2127 		status = CSR_READ_4(sc, BGE_MAC_STS);
2128 		if (status & BGE_MACSTAT_MI_INTERRUPT) {
2129 			sc->bge_link = 0;
2130 			callout_stop(&sc->bge_stat_timer);
2131 			bge_tick_serialized(sc);
2132 			/* Clear the interrupt */
2133 			CSR_WRITE_4(sc, BGE_MAC_EVT_ENB,
2134 			    BGE_EVTENB_MI_INTERRUPT);
2135 			bge_miibus_readreg(sc->bge_dev, 1, BRGPHY_MII_ISR);
2136 			bge_miibus_writereg(sc->bge_dev, 1, BRGPHY_MII_IMR,
2137 			    BRGPHY_INTRS);
2138 		}
2139 	} else {
2140 		if (statusword & BGE_STATFLAG_LINKSTATE_CHANGED) {
2141 			/*
2142 			 * Sometimes PCS encoding errors are detected in
2143 			 * TBI mode (on fiber NICs), and for some reason
2144 			 * the chip will signal them as link changes.
2145 			 * If we get a link change event, but the 'PCS
2146 			 * encoding error' bit in the MAC status register
2147 			 * is set, don't bother doing a link check.
2148 			 * This avoids spurious "gigabit link up" messages
2149 			 * that sometimes appear on fiber NICs during
2150 			 * periods of heavy traffic. (There should be no
2151 			 * effect on copper NICs.)
2152 			 *
2153 			 * If we do have a copper NIC (bge_tbi == 0) then
2154 			 * check that the AUTOPOLL bit is set before
2155 			 * processing the event as a real link change.
2156 			 * Turning AUTOPOLL on and off in the MII read/write
2157 			 * functions will often trigger a link status
2158 			 * interrupt for no reason.
2159 			 */
2160 			status = CSR_READ_4(sc, BGE_MAC_STS);
2161 			mimode = CSR_READ_4(sc, BGE_MI_MODE);
2162 			if (!(status & (BGE_MACSTAT_PORT_DECODE_ERROR |
2163 					BGE_MACSTAT_MI_COMPLETE)) &&
2164 			    (!sc->bge_tbi && (mimode & BGE_MIMODE_AUTOPOLL))) {
2165 				sc->bge_link = 0;
2166 				callout_stop(&sc->bge_stat_timer);
2167 				bge_tick_serialized(sc);
2168 			}
2169 			sc->bge_link = 0;
2170 			callout_stop(&sc->bge_stat_timer);
2171 			bge_tick_serialized(sc);
2172 			/* Clear the interrupt */
2173 			CSR_WRITE_4(sc, BGE_MAC_STS, BGE_MACSTAT_SYNC_CHANGED|
2174 			    BGE_MACSTAT_CFG_CHANGED|BGE_MACSTAT_MI_COMPLETE|
2175 			    BGE_MACSTAT_LINK_CHANGED);
2176 
2177 			/* Force flush the status block cached by PCI bridge */
2178 			CSR_READ_4(sc, BGE_MBX_IRQ0_LO);
2179 		}
2180 	}
2181 
2182 	if (ifp->if_flags & IFF_RUNNING) {
2183 		/* Check RX return ring producer/consumer */
2184 		bge_rxeof(sc);
2185 
2186 		/* Check TX ring producer/consumer */
2187 		bge_txeof(sc);
2188 	}
2189 
2190 	bge_handle_events(sc);
2191 
2192 	/* Re-enable interrupts. */
2193 	CSR_WRITE_4(sc, BGE_MBX_IRQ0_LO, 0);
2194 
2195 	if ((ifp->if_flags & IFF_RUNNING) && !ifq_is_empty(&ifp->if_snd))
2196 		(*ifp->if_start)(ifp);
2197 }
2198 
2199 static void
2200 bge_tick(void *xsc)
2201 {
2202 	struct bge_softc *sc = xsc;
2203 	struct ifnet *ifp = &sc->arpcom.ac_if;
2204 
2205 	lwkt_serialize_enter(ifp->if_serializer);
2206 	bge_tick_serialized(xsc);
2207 	lwkt_serialize_exit(ifp->if_serializer);
2208 }
2209 
2210 static void
2211 bge_tick_serialized(void *xsc)
2212 {
2213 	struct bge_softc *sc = xsc;
2214 	struct ifnet *ifp = &sc->arpcom.ac_if;
2215 	struct mii_data *mii = NULL;
2216 	struct ifmedia *ifm = NULL;
2217 
2218 	if (sc->bge_asicrev == BGE_ASICREV_BCM5705 ||
2219 	    sc->bge_asicrev == BGE_ASICREV_BCM5750)
2220 		bge_stats_update_regs(sc);
2221 	else
2222 		bge_stats_update(sc);
2223 
2224 	callout_reset(&sc->bge_stat_timer, hz, bge_tick, sc);
2225 
2226 	if (sc->bge_link) {
2227 		return;
2228 	}
2229 
2230 	if (sc->bge_tbi) {
2231 		ifm = &sc->bge_ifmedia;
2232 		if (CSR_READ_4(sc, BGE_MAC_STS) &
2233 		    BGE_MACSTAT_TBI_PCS_SYNCHED) {
2234 			sc->bge_link++;
2235 			if (sc->bge_asicrev == BGE_ASICREV_BCM5704) {
2236 				BGE_CLRBIT(sc, BGE_MAC_MODE,
2237 					   BGE_MACMODE_TBI_SEND_CFGS);
2238 			}
2239 			CSR_WRITE_4(sc, BGE_MAC_STS, 0xFFFFFFFF);
2240 			if_printf(ifp, "gigabit link up\n");
2241 			if (!ifq_is_empty(&ifp->if_snd))
2242 				(*ifp->if_start)(ifp);
2243 		}
2244 		return;
2245 	}
2246 
2247 	mii = device_get_softc(sc->bge_miibus);
2248 	mii_tick(mii);
2249 
2250 	if (!sc->bge_link) {
2251 		mii_pollstat(mii);
2252 		if (mii->mii_media_status & IFM_ACTIVE &&
2253 		    IFM_SUBTYPE(mii->mii_media_active) != IFM_NONE) {
2254 			sc->bge_link++;
2255 			if (IFM_SUBTYPE(mii->mii_media_active) == IFM_1000_T ||
2256 			    IFM_SUBTYPE(mii->mii_media_active) == IFM_1000_SX)
2257 				if_printf(ifp, "gigabit link up\n");
2258 			if (!ifq_is_empty(&ifp->if_snd))
2259 				(*ifp->if_start)(ifp);
2260 		}
2261 	}
2262 }
2263 
2264 static void
2265 bge_stats_update_regs(struct bge_softc *sc)
2266 {
2267 	struct ifnet *ifp = &sc->arpcom.ac_if;
2268 	struct bge_mac_stats_regs stats;
2269 	uint32_t *s;
2270 	int i;
2271 
2272 	s = (uint32_t *)&stats;
2273 	for (i = 0; i < sizeof(struct bge_mac_stats_regs); i += 4) {
2274 		*s = CSR_READ_4(sc, BGE_RX_STATS + i);
2275 		s++;
2276 	}
2277 
2278 	ifp->if_collisions +=
2279 	   (stats.dot3StatsSingleCollisionFrames +
2280 	   stats.dot3StatsMultipleCollisionFrames +
2281 	   stats.dot3StatsExcessiveCollisions +
2282 	   stats.dot3StatsLateCollisions) -
2283 	   ifp->if_collisions;
2284 }
2285 
2286 static void
2287 bge_stats_update(struct bge_softc *sc)
2288 {
2289 	struct ifnet *ifp = &sc->arpcom.ac_if;
2290 	struct bge_stats *stats;
2291 
2292 	stats = (struct bge_stats *)(sc->bge_vhandle +
2293 	    BGE_MEMWIN_START + BGE_STATS_BLOCK);
2294 
2295 	ifp->if_collisions +=
2296 	   (stats->txstats.dot3StatsSingleCollisionFrames.bge_addr_lo +
2297 	   stats->txstats.dot3StatsMultipleCollisionFrames.bge_addr_lo +
2298 	   stats->txstats.dot3StatsExcessiveCollisions.bge_addr_lo +
2299 	   stats->txstats.dot3StatsLateCollisions.bge_addr_lo) -
2300 	   ifp->if_collisions;
2301 
2302 #ifdef notdef
2303 	ifp->if_collisions +=
2304 	   (sc->bge_rdata->bge_info.bge_stats.dot3StatsSingleCollisionFrames +
2305 	   sc->bge_rdata->bge_info.bge_stats.dot3StatsMultipleCollisionFrames +
2306 	   sc->bge_rdata->bge_info.bge_stats.dot3StatsExcessiveCollisions +
2307 	   sc->bge_rdata->bge_info.bge_stats.dot3StatsLateCollisions) -
2308 	   ifp->if_collisions;
2309 #endif
2310 }
2311 
2312 /*
2313  * Encapsulate an mbuf chain in the tx ring  by coupling the mbuf data
2314  * pointers to descriptors.
2315  */
2316 static int
2317 bge_encap(struct bge_softc *sc, struct mbuf *m_head, uint32_t *txidx)
2318 {
2319 	struct bge_tx_bd *f = NULL;
2320 	struct mbuf *m;
2321 	uint32_t frag, cur, cnt = 0;
2322 	uint16_t csum_flags = 0;
2323 	struct ifvlan *ifv = NULL;
2324 
2325 	if ((m_head->m_flags & (M_PROTO1|M_PKTHDR)) == (M_PROTO1|M_PKTHDR) &&
2326 	    m_head->m_pkthdr.rcvif != NULL &&
2327 	    m_head->m_pkthdr.rcvif->if_type == IFT_L2VLAN)
2328 		ifv = m_head->m_pkthdr.rcvif->if_softc;
2329 
2330 	m = m_head;
2331 	cur = frag = *txidx;
2332 
2333 	if (m_head->m_pkthdr.csum_flags) {
2334 		if (m_head->m_pkthdr.csum_flags & CSUM_IP)
2335 			csum_flags |= BGE_TXBDFLAG_IP_CSUM;
2336 		if (m_head->m_pkthdr.csum_flags & (CSUM_TCP | CSUM_UDP))
2337 			csum_flags |= BGE_TXBDFLAG_TCP_UDP_CSUM;
2338 		if (m_head->m_flags & M_LASTFRAG)
2339 			csum_flags |= BGE_TXBDFLAG_IP_FRAG_END;
2340 		else if (m_head->m_flags & M_FRAG)
2341 			csum_flags |= BGE_TXBDFLAG_IP_FRAG;
2342 	}
2343 	/*
2344  	 * Start packing the mbufs in this chain into
2345 	 * the fragment pointers. Stop when we run out
2346  	 * of fragments or hit the end of the mbuf chain.
2347 	 */
2348 	for (m = m_head; m != NULL; m = m->m_next) {
2349 		if (m->m_len != 0) {
2350 			f = &sc->bge_rdata->bge_tx_ring[frag];
2351 			if (sc->bge_cdata.bge_tx_chain[frag] != NULL)
2352 				break;
2353 			BGE_HOSTADDR(f->bge_addr,
2354 			    vtophys(mtod(m, vm_offset_t)));
2355 			f->bge_len = m->m_len;
2356 			f->bge_flags = csum_flags;
2357 			if (ifv != NULL) {
2358 				f->bge_flags |= BGE_TXBDFLAG_VLAN_TAG;
2359 				f->bge_vlan_tag = ifv->ifv_tag;
2360 			} else {
2361 				f->bge_vlan_tag = 0;
2362 			}
2363 			/*
2364 			 * Sanity check: avoid coming within 16 descriptors
2365 			 * of the end of the ring.
2366 			 */
2367 			if ((BGE_TX_RING_CNT - (sc->bge_txcnt + cnt)) < 16)
2368 				return(ENOBUFS);
2369 			cur = frag;
2370 			BGE_INC(frag, BGE_TX_RING_CNT);
2371 			cnt++;
2372 		}
2373 	}
2374 
2375 	if (m != NULL)
2376 		return(ENOBUFS);
2377 
2378 	if (frag == sc->bge_tx_saved_considx)
2379 		return(ENOBUFS);
2380 
2381 	sc->bge_rdata->bge_tx_ring[cur].bge_flags |= BGE_TXBDFLAG_END;
2382 	sc->bge_cdata.bge_tx_chain[cur] = m_head;
2383 	sc->bge_txcnt += cnt;
2384 
2385 	*txidx = frag;
2386 
2387 	return(0);
2388 }
2389 
2390 /*
2391  * Main transmit routine. To avoid having to do mbuf copies, we put pointers
2392  * to the mbuf data regions directly in the transmit descriptors.
2393  */
2394 static void
2395 bge_start(struct ifnet *ifp)
2396 {
2397 	struct bge_softc *sc;
2398 	struct mbuf *m_head = NULL;
2399 	uint32_t prodidx = 0;
2400 	int need_trans;
2401 
2402 	sc = ifp->if_softc;
2403 
2404 	if (!sc->bge_link)
2405 		return;
2406 
2407 	prodidx = CSR_READ_4(sc, BGE_MBX_TX_HOST_PROD0_LO);
2408 
2409 	need_trans = 0;
2410 	while(sc->bge_cdata.bge_tx_chain[prodidx] == NULL) {
2411 		m_head = ifq_poll(&ifp->if_snd);
2412 		if (m_head == NULL)
2413 			break;
2414 
2415 		/*
2416 		 * XXX
2417 		 * safety overkill.  If this is a fragmented packet chain
2418 		 * with delayed TCP/UDP checksums, then only encapsulate
2419 		 * it if we have enough descriptors to handle the entire
2420 		 * chain at once.
2421 		 * (paranoia -- may not actually be needed)
2422 		 */
2423 		if (m_head->m_flags & M_FIRSTFRAG &&
2424 		    m_head->m_pkthdr.csum_flags & (CSUM_DELAY_DATA)) {
2425 			if ((BGE_TX_RING_CNT - sc->bge_txcnt) <
2426 			    m_head->m_pkthdr.csum_data + 16) {
2427 				ifp->if_flags |= IFF_OACTIVE;
2428 				break;
2429 			}
2430 		}
2431 
2432 		/*
2433 		 * Pack the data into the transmit ring. If we
2434 		 * don't have room, set the OACTIVE flag and wait
2435 		 * for the NIC to drain the ring.
2436 		 */
2437 		if (bge_encap(sc, m_head, &prodidx)) {
2438 			ifp->if_flags |= IFF_OACTIVE;
2439 			break;
2440 		}
2441 		ifq_dequeue(&ifp->if_snd, m_head);
2442 		need_trans = 1;
2443 
2444 		BPF_MTAP(ifp, m_head);
2445 	}
2446 
2447 	if (!need_trans)
2448 		return;
2449 
2450 	/* Transmit */
2451 	CSR_WRITE_4(sc, BGE_MBX_TX_HOST_PROD0_LO, prodidx);
2452 	/* 5700 b2 errata */
2453 	if (sc->bge_chiprev == BGE_CHIPREV_5700_BX)
2454 		CSR_WRITE_4(sc, BGE_MBX_TX_HOST_PROD0_LO, prodidx);
2455 
2456 	/*
2457 	 * Set a timeout in case the chip goes out to lunch.
2458 	 */
2459 	ifp->if_timer = 5;
2460 }
2461 
2462 static void
2463 bge_init(void *xsc)
2464 {
2465 	struct bge_softc *sc = xsc;
2466 	struct ifnet *ifp = &sc->arpcom.ac_if;
2467 	uint16_t *m;
2468 
2469 	if (ifp->if_flags & IFF_RUNNING) {
2470 		return;
2471 	}
2472 
2473 	/* Cancel pending I/O and flush buffers. */
2474 	bge_stop(sc);
2475 	bge_reset(sc);
2476 	bge_chipinit(sc);
2477 
2478 	/*
2479 	 * Init the various state machines, ring
2480 	 * control blocks and firmware.
2481 	 */
2482 	if (bge_blockinit(sc)) {
2483 		if_printf(ifp, "initialization failure\n");
2484 		return;
2485 	}
2486 
2487 	/* Specify MTU. */
2488 	CSR_WRITE_4(sc, BGE_RX_MTU, ifp->if_mtu +
2489 	    ETHER_HDR_LEN + ETHER_CRC_LEN);
2490 
2491 	/* Load our MAC address. */
2492 	m = (uint16_t *)&sc->arpcom.ac_enaddr[0];
2493 	CSR_WRITE_4(sc, BGE_MAC_ADDR1_LO, htons(m[0]));
2494 	CSR_WRITE_4(sc, BGE_MAC_ADDR1_HI, (htons(m[1]) << 16) | htons(m[2]));
2495 
2496 	/* Enable or disable promiscuous mode as needed. */
2497 	if (ifp->if_flags & IFF_PROMISC) {
2498 		BGE_SETBIT(sc, BGE_RX_MODE, BGE_RXMODE_RX_PROMISC);
2499 	} else {
2500 		BGE_CLRBIT(sc, BGE_RX_MODE, BGE_RXMODE_RX_PROMISC);
2501 	}
2502 
2503 	/* Program multicast filter. */
2504 	bge_setmulti(sc);
2505 
2506 	/* Init RX ring. */
2507 	bge_init_rx_ring_std(sc);
2508 
2509 	/*
2510 	 * Workaround for a bug in 5705 ASIC rev A0. Poll the NIC's
2511 	 * memory to insure that the chip has in fact read the first
2512 	 * entry of the ring.
2513 	 */
2514 	if (sc->bge_chipid == BGE_CHIPID_BCM5705_A0) {
2515 		uint32_t		v, i;
2516 		for (i = 0; i < 10; i++) {
2517 			DELAY(20);
2518 			v = bge_readmem_ind(sc, BGE_STD_RX_RINGS + 8);
2519 			if (v == (MCLBYTES - ETHER_ALIGN))
2520 				break;
2521 		}
2522 		if (i == 10)
2523 			if_printf(ifp, "5705 A0 chip failed to load RX ring\n");
2524 	}
2525 
2526 	/* Init jumbo RX ring. */
2527 	if (ifp->if_mtu > (ETHERMTU + ETHER_HDR_LEN + ETHER_CRC_LEN))
2528 		bge_init_rx_ring_jumbo(sc);
2529 
2530 	/* Init our RX return ring index */
2531 	sc->bge_rx_saved_considx = 0;
2532 
2533 	/* Init TX ring. */
2534 	bge_init_tx_ring(sc);
2535 
2536 	/* Turn on transmitter */
2537 	BGE_SETBIT(sc, BGE_TX_MODE, BGE_TXMODE_ENABLE);
2538 
2539 	/* Turn on receiver */
2540 	BGE_SETBIT(sc, BGE_RX_MODE, BGE_RXMODE_ENABLE);
2541 
2542 	/* Tell firmware we're alive. */
2543 	BGE_SETBIT(sc, BGE_MODE_CTL, BGE_MODECTL_STACKUP);
2544 
2545 	/* Enable host interrupts. */
2546 	BGE_SETBIT(sc, BGE_PCI_MISC_CTL, BGE_PCIMISCCTL_CLEAR_INTA);
2547 	BGE_CLRBIT(sc, BGE_PCI_MISC_CTL, BGE_PCIMISCCTL_MASK_PCI_INTR);
2548 	CSR_WRITE_4(sc, BGE_MBX_IRQ0_LO, 0);
2549 
2550 	bge_ifmedia_upd(ifp);
2551 
2552 	ifp->if_flags |= IFF_RUNNING;
2553 	ifp->if_flags &= ~IFF_OACTIVE;
2554 
2555 	callout_reset(&sc->bge_stat_timer, hz, bge_tick, sc);
2556 }
2557 
2558 /*
2559  * Set media options.
2560  */
2561 static int
2562 bge_ifmedia_upd(struct ifnet *ifp)
2563 {
2564 	struct bge_softc *sc = ifp->if_softc;
2565 	struct ifmedia *ifm = &sc->bge_ifmedia;
2566 	struct mii_data *mii;
2567 
2568 	/* If this is a 1000baseX NIC, enable the TBI port. */
2569 	if (sc->bge_tbi) {
2570 		if (IFM_TYPE(ifm->ifm_media) != IFM_ETHER)
2571 			return(EINVAL);
2572 		switch(IFM_SUBTYPE(ifm->ifm_media)) {
2573 		case IFM_AUTO:
2574 			/*
2575 			 * The BCM5704 ASIC appears to have a special
2576 			 * mechanism for programming the autoneg
2577 			 * advertisement registers in TBI mode.
2578 			 */
2579 			if (!bge_fake_autoneg &&
2580 			    sc->bge_asicrev == BGE_ASICREV_BCM5704) {
2581 				uint32_t sgdig;
2582 
2583 				CSR_WRITE_4(sc, BGE_TX_TBI_AUTONEG, 0);
2584 				sgdig = CSR_READ_4(sc, BGE_SGDIG_CFG);
2585 				sgdig |= BGE_SGDIGCFG_AUTO |
2586 					 BGE_SGDIGCFG_PAUSE_CAP |
2587 					 BGE_SGDIGCFG_ASYM_PAUSE;
2588 				CSR_WRITE_4(sc, BGE_SGDIG_CFG,
2589 					    sgdig | BGE_SGDIGCFG_SEND);
2590 				DELAY(5);
2591 				CSR_WRITE_4(sc, BGE_SGDIG_CFG, sgdig);
2592 			}
2593 			break;
2594 		case IFM_1000_SX:
2595 			if ((ifm->ifm_media & IFM_GMASK) == IFM_FDX) {
2596 				BGE_CLRBIT(sc, BGE_MAC_MODE,
2597 				    BGE_MACMODE_HALF_DUPLEX);
2598 			} else {
2599 				BGE_SETBIT(sc, BGE_MAC_MODE,
2600 				    BGE_MACMODE_HALF_DUPLEX);
2601 			}
2602 			break;
2603 		default:
2604 			return(EINVAL);
2605 		}
2606 		return(0);
2607 	}
2608 
2609 	mii = device_get_softc(sc->bge_miibus);
2610 	sc->bge_link = 0;
2611 	if (mii->mii_instance) {
2612 		struct mii_softc *miisc;
2613 		for (miisc = LIST_FIRST(&mii->mii_phys); miisc != NULL;
2614 		    miisc = LIST_NEXT(miisc, mii_list))
2615 			mii_phy_reset(miisc);
2616 	}
2617 	mii_mediachg(mii);
2618 
2619 	return(0);
2620 }
2621 
2622 /*
2623  * Report current media status.
2624  */
2625 static void
2626 bge_ifmedia_sts(struct ifnet *ifp, struct ifmediareq *ifmr)
2627 {
2628 	struct bge_softc *sc = ifp->if_softc;
2629 	struct mii_data *mii;
2630 
2631 	if (sc->bge_tbi) {
2632 		ifmr->ifm_status = IFM_AVALID;
2633 		ifmr->ifm_active = IFM_ETHER;
2634 		if (CSR_READ_4(sc, BGE_MAC_STS) &
2635 		    BGE_MACSTAT_TBI_PCS_SYNCHED)
2636 			ifmr->ifm_status |= IFM_ACTIVE;
2637 		ifmr->ifm_active |= IFM_1000_SX;
2638 		if (CSR_READ_4(sc, BGE_MAC_MODE) & BGE_MACMODE_HALF_DUPLEX)
2639 			ifmr->ifm_active |= IFM_HDX;
2640 		else
2641 			ifmr->ifm_active |= IFM_FDX;
2642 		return;
2643 	}
2644 
2645 	mii = device_get_softc(sc->bge_miibus);
2646 	mii_pollstat(mii);
2647 	ifmr->ifm_active = mii->mii_media_active;
2648 	ifmr->ifm_status = mii->mii_media_status;
2649 }
2650 
2651 static int
2652 bge_ioctl(struct ifnet *ifp, u_long command, caddr_t data, struct ucred *cr)
2653 {
2654 	struct bge_softc *sc = ifp->if_softc;
2655 	struct ifreq *ifr = (struct ifreq *) data;
2656 	int mask, error = 0;
2657 	struct mii_data *mii;
2658 
2659 	switch(command) {
2660 	case SIOCSIFMTU:
2661 		/* Disallow jumbo frames on 5705/5750. */
2662 		if (((sc->bge_asicrev == BGE_ASICREV_BCM5705 ||
2663 		      sc->bge_asicrev == BGE_ASICREV_BCM5750) &&
2664 		     ifr->ifr_mtu > ETHERMTU) || ifr->ifr_mtu > BGE_JUMBO_MTU)
2665 			error = EINVAL;
2666 		else {
2667 			ifp->if_mtu = ifr->ifr_mtu;
2668 			ifp->if_flags &= ~IFF_RUNNING;
2669 			bge_init(sc);
2670 		}
2671 		break;
2672 	case SIOCSIFFLAGS:
2673 		if (ifp->if_flags & IFF_UP) {
2674 			/*
2675 			 * If only the state of the PROMISC flag changed,
2676 			 * then just use the 'set promisc mode' command
2677 			 * instead of reinitializing the entire NIC. Doing
2678 			 * a full re-init means reloading the firmware and
2679 			 * waiting for it to start up, which may take a
2680 			 * second or two.
2681 			 */
2682 			if (ifp->if_flags & IFF_RUNNING &&
2683 			    ifp->if_flags & IFF_PROMISC &&
2684 			    !(sc->bge_if_flags & IFF_PROMISC)) {
2685 				BGE_SETBIT(sc, BGE_RX_MODE,
2686 				    BGE_RXMODE_RX_PROMISC);
2687 			} else if (ifp->if_flags & IFF_RUNNING &&
2688 			    !(ifp->if_flags & IFF_PROMISC) &&
2689 			    sc->bge_if_flags & IFF_PROMISC) {
2690 				BGE_CLRBIT(sc, BGE_RX_MODE,
2691 				    BGE_RXMODE_RX_PROMISC);
2692 			} else
2693 				bge_init(sc);
2694 		} else {
2695 			if (ifp->if_flags & IFF_RUNNING) {
2696 				bge_stop(sc);
2697 			}
2698 		}
2699 		sc->bge_if_flags = ifp->if_flags;
2700 		error = 0;
2701 		break;
2702 	case SIOCADDMULTI:
2703 	case SIOCDELMULTI:
2704 		if (ifp->if_flags & IFF_RUNNING) {
2705 			bge_setmulti(sc);
2706 			error = 0;
2707 		}
2708 		break;
2709 	case SIOCSIFMEDIA:
2710 	case SIOCGIFMEDIA:
2711 		if (sc->bge_tbi) {
2712 			error = ifmedia_ioctl(ifp, ifr,
2713 			    &sc->bge_ifmedia, command);
2714 		} else {
2715 			mii = device_get_softc(sc->bge_miibus);
2716 			error = ifmedia_ioctl(ifp, ifr,
2717 			    &mii->mii_media, command);
2718 		}
2719 		break;
2720         case SIOCSIFCAP:
2721 		mask = ifr->ifr_reqcap ^ ifp->if_capenable;
2722 		if (mask & IFCAP_HWCSUM) {
2723 			if (IFCAP_HWCSUM & ifp->if_capenable)
2724 				ifp->if_capenable &= ~IFCAP_HWCSUM;
2725 			else
2726 				ifp->if_capenable |= IFCAP_HWCSUM;
2727 		}
2728 		error = 0;
2729 		break;
2730 	default:
2731 		error = ether_ioctl(ifp, command, data);
2732 		break;
2733 	}
2734 	return(error);
2735 }
2736 
2737 static void
2738 bge_watchdog(struct ifnet *ifp)
2739 {
2740 	struct bge_softc *sc = ifp->if_softc;
2741 
2742 	if_printf(ifp, "watchdog timeout -- resetting\n");
2743 
2744 	ifp->if_flags &= ~IFF_RUNNING;
2745 	bge_init(sc);
2746 
2747 	ifp->if_oerrors++;
2748 
2749 	if (!ifq_is_empty(&ifp->if_snd))
2750 		ifp->if_start(ifp);
2751 }
2752 
2753 /*
2754  * Stop the adapter and free any mbufs allocated to the
2755  * RX and TX lists.
2756  */
2757 static void
2758 bge_stop(struct bge_softc *sc)
2759 {
2760 	struct ifnet *ifp = &sc->arpcom.ac_if;
2761 	struct ifmedia_entry *ifm;
2762 	struct mii_data *mii = NULL;
2763 	int mtmp, itmp;
2764 
2765 	if (!sc->bge_tbi)
2766 		mii = device_get_softc(sc->bge_miibus);
2767 
2768 	callout_stop(&sc->bge_stat_timer);
2769 
2770 	/*
2771 	 * Disable all of the receiver blocks
2772 	 */
2773 	BGE_CLRBIT(sc, BGE_RX_MODE, BGE_RXMODE_ENABLE);
2774 	BGE_CLRBIT(sc, BGE_RBDI_MODE, BGE_RBDIMODE_ENABLE);
2775 	BGE_CLRBIT(sc, BGE_RXLP_MODE, BGE_RXLPMODE_ENABLE);
2776 	if (sc->bge_asicrev != BGE_ASICREV_BCM5705 &&
2777 	    sc->bge_asicrev != BGE_ASICREV_BCM5750)
2778 		BGE_CLRBIT(sc, BGE_RXLS_MODE, BGE_RXLSMODE_ENABLE);
2779 	BGE_CLRBIT(sc, BGE_RDBDI_MODE, BGE_RBDIMODE_ENABLE);
2780 	BGE_CLRBIT(sc, BGE_RDC_MODE, BGE_RDCMODE_ENABLE);
2781 	BGE_CLRBIT(sc, BGE_RBDC_MODE, BGE_RBDCMODE_ENABLE);
2782 
2783 	/*
2784 	 * Disable all of the transmit blocks
2785 	 */
2786 	BGE_CLRBIT(sc, BGE_SRS_MODE, BGE_SRSMODE_ENABLE);
2787 	BGE_CLRBIT(sc, BGE_SBDI_MODE, BGE_SBDIMODE_ENABLE);
2788 	BGE_CLRBIT(sc, BGE_SDI_MODE, BGE_SDIMODE_ENABLE);
2789 	BGE_CLRBIT(sc, BGE_RDMA_MODE, BGE_RDMAMODE_ENABLE);
2790 	BGE_CLRBIT(sc, BGE_SDC_MODE, BGE_SDCMODE_ENABLE);
2791 	if (sc->bge_asicrev != BGE_ASICREV_BCM5705 &&
2792 	    sc->bge_asicrev != BGE_ASICREV_BCM5750)
2793 		BGE_CLRBIT(sc, BGE_DMAC_MODE, BGE_DMACMODE_ENABLE);
2794 	BGE_CLRBIT(sc, BGE_SBDC_MODE, BGE_SBDCMODE_ENABLE);
2795 
2796 	/*
2797 	 * Shut down all of the memory managers and related
2798 	 * state machines.
2799 	 */
2800 	BGE_CLRBIT(sc, BGE_HCC_MODE, BGE_HCCMODE_ENABLE);
2801 	BGE_CLRBIT(sc, BGE_WDMA_MODE, BGE_WDMAMODE_ENABLE);
2802 	if (sc->bge_asicrev != BGE_ASICREV_BCM5705 &&
2803 	    sc->bge_asicrev != BGE_ASICREV_BCM5750)
2804 		BGE_CLRBIT(sc, BGE_MBCF_MODE, BGE_MBCFMODE_ENABLE);
2805 	CSR_WRITE_4(sc, BGE_FTQ_RESET, 0xFFFFFFFF);
2806 	CSR_WRITE_4(sc, BGE_FTQ_RESET, 0);
2807 	if (sc->bge_asicrev != BGE_ASICREV_BCM5705 &&
2808 	    sc->bge_asicrev != BGE_ASICREV_BCM5750) {
2809 		BGE_CLRBIT(sc, BGE_BMAN_MODE, BGE_BMANMODE_ENABLE);
2810 		BGE_CLRBIT(sc, BGE_MARB_MODE, BGE_MARBMODE_ENABLE);
2811 	}
2812 
2813 	/* Disable host interrupts. */
2814 	BGE_SETBIT(sc, BGE_PCI_MISC_CTL, BGE_PCIMISCCTL_MASK_PCI_INTR);
2815 	CSR_WRITE_4(sc, BGE_MBX_IRQ0_LO, 1);
2816 
2817 	/*
2818 	 * Tell firmware we're shutting down.
2819 	 */
2820 	BGE_CLRBIT(sc, BGE_MODE_CTL, BGE_MODECTL_STACKUP);
2821 
2822 	/* Free the RX lists. */
2823 	bge_free_rx_ring_std(sc);
2824 
2825 	/* Free jumbo RX list. */
2826 	if (sc->bge_asicrev != BGE_ASICREV_BCM5705 &&
2827 	    sc->bge_asicrev != BGE_ASICREV_BCM5750)
2828 		bge_free_rx_ring_jumbo(sc);
2829 
2830 	/* Free TX buffers. */
2831 	bge_free_tx_ring(sc);
2832 
2833 	/*
2834 	 * Isolate/power down the PHY, but leave the media selection
2835 	 * unchanged so that things will be put back to normal when
2836 	 * we bring the interface back up.
2837 	 */
2838 	if (!sc->bge_tbi) {
2839 		itmp = ifp->if_flags;
2840 		ifp->if_flags |= IFF_UP;
2841 		ifm = mii->mii_media.ifm_cur;
2842 		mtmp = ifm->ifm_media;
2843 		ifm->ifm_media = IFM_ETHER|IFM_NONE;
2844 		mii_mediachg(mii);
2845 		ifm->ifm_media = mtmp;
2846 		ifp->if_flags = itmp;
2847 	}
2848 
2849 	sc->bge_link = 0;
2850 
2851 	sc->bge_tx_saved_considx = BGE_TXCONS_UNSET;
2852 
2853 	ifp->if_flags &= ~(IFF_RUNNING | IFF_OACTIVE);
2854 }
2855 
2856 /*
2857  * Stop all chip I/O so that the kernel's probe routines don't
2858  * get confused by errant DMAs when rebooting.
2859  */
2860 static void
2861 bge_shutdown(device_t dev)
2862 {
2863 	struct bge_softc *sc = device_get_softc(dev);
2864 
2865 	bge_stop(sc);
2866 	bge_reset(sc);
2867 }
2868