xref: /freebsd/sys/dev/bge/if_bge.c (revision e17f5b1d)
1 /*-
2  * SPDX-License-Identifier: BSD-4-Clause
3  *
4  * Copyright (c) 2001 Wind River Systems
5  * Copyright (c) 1997, 1998, 1999, 2001
6  *	Bill Paul <wpaul@windriver.com>.  All rights reserved.
7  *
8  * Redistribution and use in source and binary forms, with or without
9  * modification, are permitted provided that the following conditions
10  * are met:
11  * 1. Redistributions of source code must retain the above copyright
12  *    notice, this list of conditions and the following disclaimer.
13  * 2. Redistributions in binary form must reproduce the above copyright
14  *    notice, this list of conditions and the following disclaimer in the
15  *    documentation and/or other materials provided with the distribution.
16  * 3. All advertising materials mentioning features or use of this software
17  *    must display the following acknowledgement:
18  *	This product includes software developed by Bill Paul.
19  * 4. Neither the name of the author nor the names of any co-contributors
20  *    may be used to endorse or promote products derived from this software
21  *    without specific prior written permission.
22  *
23  * THIS SOFTWARE IS PROVIDED BY Bill Paul AND CONTRIBUTORS ``AS IS'' AND
24  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
25  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
26  * ARE DISCLAIMED.  IN NO EVENT SHALL Bill Paul OR THE VOICES IN HIS HEAD
27  * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
28  * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
29  * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
30  * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
31  * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
32  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
33  * THE POSSIBILITY OF SUCH DAMAGE.
34  */
35 
36 #include <sys/cdefs.h>
37 __FBSDID("$FreeBSD$");
38 
39 /*
40  * Broadcom BCM57xx(x)/BCM590x NetXtreme and NetLink family Ethernet driver
41  *
42  * The Broadcom BCM5700 is based on technology originally developed by
43  * Alteon Networks as part of the Tigon I and Tigon II Gigabit Ethernet
44  * MAC chips. The BCM5700, sometimes referred to as the Tigon III, has
45  * two on-board MIPS R4000 CPUs and can have as much as 16MB of external
46  * SSRAM. The BCM5700 supports TCP, UDP and IP checksum offload, jumbo
47  * frames, highly configurable RX filtering, and 16 RX and TX queues
48  * (which, along with RX filter rules, can be used for QOS applications).
49  * Other features, such as TCP segmentation, may be available as part
50  * of value-added firmware updates. Unlike the Tigon I and Tigon II,
51  * firmware images can be stored in hardware and need not be compiled
52  * into the driver.
53  *
54  * The BCM5700 supports the PCI v2.2 and PCI-X v1.0 standards, and will
55  * function in a 32-bit/64-bit 33/66Mhz bus, or a 64-bit/133Mhz bus.
56  *
57  * The BCM5701 is a single-chip solution incorporating both the BCM5700
58  * MAC and a BCM5401 10/100/1000 PHY. Unlike the BCM5700, the BCM5701
59  * does not support external SSRAM.
60  *
61  * Broadcom also produces a variation of the BCM5700 under the "Altima"
62  * brand name, which is functionally similar but lacks PCI-X support.
63  *
64  * Without external SSRAM, you can only have at most 4 TX rings,
65  * and the use of the mini RX ring is disabled. This seems to imply
66  * that these features are simply not available on the BCM5701. As a
67  * result, this driver does not implement any support for the mini RX
68  * ring.
69  */
70 
71 #ifdef HAVE_KERNEL_OPTION_HEADERS
72 #include "opt_device_polling.h"
73 #endif
74 
75 #include <sys/param.h>
76 #include <sys/endian.h>
77 #include <sys/systm.h>
78 #include <sys/sockio.h>
79 #include <sys/mbuf.h>
80 #include <sys/malloc.h>
81 #include <sys/kernel.h>
82 #include <sys/module.h>
83 #include <sys/socket.h>
84 #include <sys/sysctl.h>
85 #include <sys/taskqueue.h>
86 
87 #include <net/debugnet.h>
88 #include <net/if.h>
89 #include <net/if_var.h>
90 #include <net/if_arp.h>
91 #include <net/ethernet.h>
92 #include <net/if_dl.h>
93 #include <net/if_media.h>
94 
95 #include <net/bpf.h>
96 
97 #include <net/if_types.h>
98 #include <net/if_vlan_var.h>
99 
100 #include <netinet/in_systm.h>
101 #include <netinet/in.h>
102 #include <netinet/ip.h>
103 #include <netinet/tcp.h>
104 
105 #include <machine/bus.h>
106 #include <machine/resource.h>
107 #include <sys/bus.h>
108 #include <sys/rman.h>
109 
110 #include <dev/mii/mii.h>
111 #include <dev/mii/miivar.h>
112 #include "miidevs.h"
113 #include <dev/mii/brgphyreg.h>
114 
115 #include <dev/pci/pcireg.h>
116 #include <dev/pci/pcivar.h>
117 
118 #include <dev/bge/if_bgereg.h>
119 
120 #define	BGE_CSUM_FEATURES	(CSUM_IP | CSUM_TCP)
121 #define	ETHER_MIN_NOPAD		(ETHER_MIN_LEN - ETHER_CRC_LEN) /* i.e., 60 */
122 
123 MODULE_DEPEND(bge, pci, 1, 1, 1);
124 MODULE_DEPEND(bge, ether, 1, 1, 1);
125 MODULE_DEPEND(bge, miibus, 1, 1, 1);
126 
127 /* "device miibus" required.  See GENERIC if you get errors here. */
128 #include "miibus_if.h"
129 
130 /*
131  * Various supported device vendors/types and their names. Note: the
132  * spec seems to indicate that the hardware still has Alteon's vendor
133  * ID burned into it, though it will always be overriden by the vendor
134  * ID in the EEPROM. Just to be safe, we cover all possibilities.
135  */
136 static const struct bge_type {
137 	uint16_t	bge_vid;
138 	uint16_t	bge_did;
139 } bge_devs[] = {
140 	{ ALTEON_VENDORID,	ALTEON_DEVICEID_BCM5700 },
141 	{ ALTEON_VENDORID,	ALTEON_DEVICEID_BCM5701 },
142 
143 	{ ALTIMA_VENDORID,	ALTIMA_DEVICE_AC1000 },
144 	{ ALTIMA_VENDORID,	ALTIMA_DEVICE_AC1002 },
145 	{ ALTIMA_VENDORID,	ALTIMA_DEVICE_AC9100 },
146 
147 	{ APPLE_VENDORID,	APPLE_DEVICE_BCM5701 },
148 
149 	{ BCOM_VENDORID,	BCOM_DEVICEID_BCM5700 },
150 	{ BCOM_VENDORID,	BCOM_DEVICEID_BCM5701 },
151 	{ BCOM_VENDORID,	BCOM_DEVICEID_BCM5702 },
152 	{ BCOM_VENDORID,	BCOM_DEVICEID_BCM5702_ALT },
153 	{ BCOM_VENDORID,	BCOM_DEVICEID_BCM5702X },
154 	{ BCOM_VENDORID,	BCOM_DEVICEID_BCM5703 },
155 	{ BCOM_VENDORID,	BCOM_DEVICEID_BCM5703_ALT },
156 	{ BCOM_VENDORID,	BCOM_DEVICEID_BCM5703X },
157 	{ BCOM_VENDORID,	BCOM_DEVICEID_BCM5704C },
158 	{ BCOM_VENDORID,	BCOM_DEVICEID_BCM5704S },
159 	{ BCOM_VENDORID,	BCOM_DEVICEID_BCM5704S_ALT },
160 	{ BCOM_VENDORID,	BCOM_DEVICEID_BCM5705 },
161 	{ BCOM_VENDORID,	BCOM_DEVICEID_BCM5705F },
162 	{ BCOM_VENDORID,	BCOM_DEVICEID_BCM5705K },
163 	{ BCOM_VENDORID,	BCOM_DEVICEID_BCM5705M },
164 	{ BCOM_VENDORID,	BCOM_DEVICEID_BCM5705M_ALT },
165 	{ BCOM_VENDORID,	BCOM_DEVICEID_BCM5714C },
166 	{ BCOM_VENDORID,	BCOM_DEVICEID_BCM5714S },
167 	{ BCOM_VENDORID,	BCOM_DEVICEID_BCM5715 },
168 	{ BCOM_VENDORID,	BCOM_DEVICEID_BCM5715S },
169 	{ BCOM_VENDORID,	BCOM_DEVICEID_BCM5717 },
170 	{ BCOM_VENDORID,	BCOM_DEVICEID_BCM5717C },
171 	{ BCOM_VENDORID,	BCOM_DEVICEID_BCM5718 },
172 	{ BCOM_VENDORID,	BCOM_DEVICEID_BCM5719 },
173 	{ BCOM_VENDORID,	BCOM_DEVICEID_BCM5720 },
174 	{ BCOM_VENDORID,	BCOM_DEVICEID_BCM5721 },
175 	{ BCOM_VENDORID,	BCOM_DEVICEID_BCM5722 },
176 	{ BCOM_VENDORID,	BCOM_DEVICEID_BCM5723 },
177 	{ BCOM_VENDORID,	BCOM_DEVICEID_BCM5725 },
178 	{ BCOM_VENDORID,	BCOM_DEVICEID_BCM5727 },
179 	{ BCOM_VENDORID,	BCOM_DEVICEID_BCM5750 },
180 	{ BCOM_VENDORID,	BCOM_DEVICEID_BCM5750M },
181 	{ BCOM_VENDORID,	BCOM_DEVICEID_BCM5751 },
182 	{ BCOM_VENDORID,	BCOM_DEVICEID_BCM5751F },
183 	{ BCOM_VENDORID,	BCOM_DEVICEID_BCM5751M },
184 	{ BCOM_VENDORID,	BCOM_DEVICEID_BCM5752 },
185 	{ BCOM_VENDORID,	BCOM_DEVICEID_BCM5752M },
186 	{ BCOM_VENDORID,	BCOM_DEVICEID_BCM5753 },
187 	{ BCOM_VENDORID,	BCOM_DEVICEID_BCM5753F },
188 	{ BCOM_VENDORID,	BCOM_DEVICEID_BCM5753M },
189 	{ BCOM_VENDORID,	BCOM_DEVICEID_BCM5754 },
190 	{ BCOM_VENDORID,	BCOM_DEVICEID_BCM5754M },
191 	{ BCOM_VENDORID,	BCOM_DEVICEID_BCM5755 },
192 	{ BCOM_VENDORID,	BCOM_DEVICEID_BCM5755M },
193 	{ BCOM_VENDORID,	BCOM_DEVICEID_BCM5756 },
194 	{ BCOM_VENDORID,	BCOM_DEVICEID_BCM5761 },
195 	{ BCOM_VENDORID,	BCOM_DEVICEID_BCM5761E },
196 	{ BCOM_VENDORID,	BCOM_DEVICEID_BCM5761S },
197 	{ BCOM_VENDORID,	BCOM_DEVICEID_BCM5761SE },
198 	{ BCOM_VENDORID,	BCOM_DEVICEID_BCM5762 },
199 	{ BCOM_VENDORID,	BCOM_DEVICEID_BCM5764 },
200 	{ BCOM_VENDORID,	BCOM_DEVICEID_BCM5780 },
201 	{ BCOM_VENDORID,	BCOM_DEVICEID_BCM5780S },
202 	{ BCOM_VENDORID,	BCOM_DEVICEID_BCM5781 },
203 	{ BCOM_VENDORID,	BCOM_DEVICEID_BCM5782 },
204 	{ BCOM_VENDORID,	BCOM_DEVICEID_BCM5784 },
205 	{ BCOM_VENDORID,	BCOM_DEVICEID_BCM5785F },
206 	{ BCOM_VENDORID,	BCOM_DEVICEID_BCM5785G },
207 	{ BCOM_VENDORID,	BCOM_DEVICEID_BCM5786 },
208 	{ BCOM_VENDORID,	BCOM_DEVICEID_BCM5787 },
209 	{ BCOM_VENDORID,	BCOM_DEVICEID_BCM5787F },
210 	{ BCOM_VENDORID,	BCOM_DEVICEID_BCM5787M },
211 	{ BCOM_VENDORID,	BCOM_DEVICEID_BCM5788 },
212 	{ BCOM_VENDORID,	BCOM_DEVICEID_BCM5789 },
213 	{ BCOM_VENDORID,	BCOM_DEVICEID_BCM5901 },
214 	{ BCOM_VENDORID,	BCOM_DEVICEID_BCM5901A2 },
215 	{ BCOM_VENDORID,	BCOM_DEVICEID_BCM5903M },
216 	{ BCOM_VENDORID,	BCOM_DEVICEID_BCM5906 },
217 	{ BCOM_VENDORID,	BCOM_DEVICEID_BCM5906M },
218 	{ BCOM_VENDORID,	BCOM_DEVICEID_BCM57760 },
219 	{ BCOM_VENDORID,	BCOM_DEVICEID_BCM57761 },
220 	{ BCOM_VENDORID,	BCOM_DEVICEID_BCM57762 },
221 	{ BCOM_VENDORID,	BCOM_DEVICEID_BCM57764 },
222 	{ BCOM_VENDORID,	BCOM_DEVICEID_BCM57765 },
223 	{ BCOM_VENDORID,	BCOM_DEVICEID_BCM57766 },
224 	{ BCOM_VENDORID,	BCOM_DEVICEID_BCM57767 },
225 	{ BCOM_VENDORID,	BCOM_DEVICEID_BCM57780 },
226 	{ BCOM_VENDORID,	BCOM_DEVICEID_BCM57781 },
227 	{ BCOM_VENDORID,	BCOM_DEVICEID_BCM57782 },
228 	{ BCOM_VENDORID,	BCOM_DEVICEID_BCM57785 },
229 	{ BCOM_VENDORID,	BCOM_DEVICEID_BCM57786 },
230 	{ BCOM_VENDORID,	BCOM_DEVICEID_BCM57787 },
231 	{ BCOM_VENDORID,	BCOM_DEVICEID_BCM57788 },
232 	{ BCOM_VENDORID,	BCOM_DEVICEID_BCM57790 },
233 	{ BCOM_VENDORID,	BCOM_DEVICEID_BCM57791 },
234 	{ BCOM_VENDORID,	BCOM_DEVICEID_BCM57795 },
235 
236 	{ SK_VENDORID,		SK_DEVICEID_ALTIMA },
237 
238 	{ TC_VENDORID,		TC_DEVICEID_3C996 },
239 
240 	{ FJTSU_VENDORID,	FJTSU_DEVICEID_PW008GE4 },
241 	{ FJTSU_VENDORID,	FJTSU_DEVICEID_PW008GE5 },
242 	{ FJTSU_VENDORID,	FJTSU_DEVICEID_PP250450 },
243 
244 	{ 0, 0 }
245 };
246 
247 static const struct bge_vendor {
248 	uint16_t	v_id;
249 	const char	*v_name;
250 } bge_vendors[] = {
251 	{ ALTEON_VENDORID,	"Alteon" },
252 	{ ALTIMA_VENDORID,	"Altima" },
253 	{ APPLE_VENDORID,	"Apple" },
254 	{ BCOM_VENDORID,	"Broadcom" },
255 	{ SK_VENDORID,		"SysKonnect" },
256 	{ TC_VENDORID,		"3Com" },
257 	{ FJTSU_VENDORID,	"Fujitsu" },
258 
259 	{ 0, NULL }
260 };
261 
262 static const struct bge_revision {
263 	uint32_t	br_chipid;
264 	const char	*br_name;
265 } bge_revisions[] = {
266 	{ BGE_CHIPID_BCM5700_A0,	"BCM5700 A0" },
267 	{ BGE_CHIPID_BCM5700_A1,	"BCM5700 A1" },
268 	{ BGE_CHIPID_BCM5700_B0,	"BCM5700 B0" },
269 	{ BGE_CHIPID_BCM5700_B1,	"BCM5700 B1" },
270 	{ BGE_CHIPID_BCM5700_B2,	"BCM5700 B2" },
271 	{ BGE_CHIPID_BCM5700_B3,	"BCM5700 B3" },
272 	{ BGE_CHIPID_BCM5700_ALTIMA,	"BCM5700 Altima" },
273 	{ BGE_CHIPID_BCM5700_C0,	"BCM5700 C0" },
274 	{ BGE_CHIPID_BCM5701_A0,	"BCM5701 A0" },
275 	{ BGE_CHIPID_BCM5701_B0,	"BCM5701 B0" },
276 	{ BGE_CHIPID_BCM5701_B2,	"BCM5701 B2" },
277 	{ BGE_CHIPID_BCM5701_B5,	"BCM5701 B5" },
278 	{ BGE_CHIPID_BCM5703_A0,	"BCM5703 A0" },
279 	{ BGE_CHIPID_BCM5703_A1,	"BCM5703 A1" },
280 	{ BGE_CHIPID_BCM5703_A2,	"BCM5703 A2" },
281 	{ BGE_CHIPID_BCM5703_A3,	"BCM5703 A3" },
282 	{ BGE_CHIPID_BCM5703_B0,	"BCM5703 B0" },
283 	{ BGE_CHIPID_BCM5704_A0,	"BCM5704 A0" },
284 	{ BGE_CHIPID_BCM5704_A1,	"BCM5704 A1" },
285 	{ BGE_CHIPID_BCM5704_A2,	"BCM5704 A2" },
286 	{ BGE_CHIPID_BCM5704_A3,	"BCM5704 A3" },
287 	{ BGE_CHIPID_BCM5704_B0,	"BCM5704 B0" },
288 	{ BGE_CHIPID_BCM5705_A0,	"BCM5705 A0" },
289 	{ BGE_CHIPID_BCM5705_A1,	"BCM5705 A1" },
290 	{ BGE_CHIPID_BCM5705_A2,	"BCM5705 A2" },
291 	{ BGE_CHIPID_BCM5705_A3,	"BCM5705 A3" },
292 	{ BGE_CHIPID_BCM5750_A0,	"BCM5750 A0" },
293 	{ BGE_CHIPID_BCM5750_A1,	"BCM5750 A1" },
294 	{ BGE_CHIPID_BCM5750_A3,	"BCM5750 A3" },
295 	{ BGE_CHIPID_BCM5750_B0,	"BCM5750 B0" },
296 	{ BGE_CHIPID_BCM5750_B1,	"BCM5750 B1" },
297 	{ BGE_CHIPID_BCM5750_C0,	"BCM5750 C0" },
298 	{ BGE_CHIPID_BCM5750_C1,	"BCM5750 C1" },
299 	{ BGE_CHIPID_BCM5750_C2,	"BCM5750 C2" },
300 	{ BGE_CHIPID_BCM5714_A0,	"BCM5714 A0" },
301 	{ BGE_CHIPID_BCM5752_A0,	"BCM5752 A0" },
302 	{ BGE_CHIPID_BCM5752_A1,	"BCM5752 A1" },
303 	{ BGE_CHIPID_BCM5752_A2,	"BCM5752 A2" },
304 	{ BGE_CHIPID_BCM5714_B0,	"BCM5714 B0" },
305 	{ BGE_CHIPID_BCM5714_B3,	"BCM5714 B3" },
306 	{ BGE_CHIPID_BCM5715_A0,	"BCM5715 A0" },
307 	{ BGE_CHIPID_BCM5715_A1,	"BCM5715 A1" },
308 	{ BGE_CHIPID_BCM5715_A3,	"BCM5715 A3" },
309 	{ BGE_CHIPID_BCM5717_A0,	"BCM5717 A0" },
310 	{ BGE_CHIPID_BCM5717_B0,	"BCM5717 B0" },
311 	{ BGE_CHIPID_BCM5717_C0,	"BCM5717 C0" },
312 	{ BGE_CHIPID_BCM5719_A0,	"BCM5719 A0" },
313 	{ BGE_CHIPID_BCM5720_A0,	"BCM5720 A0" },
314 	{ BGE_CHIPID_BCM5755_A0,	"BCM5755 A0" },
315 	{ BGE_CHIPID_BCM5755_A1,	"BCM5755 A1" },
316 	{ BGE_CHIPID_BCM5755_A2,	"BCM5755 A2" },
317 	{ BGE_CHIPID_BCM5722_A0,	"BCM5722 A0" },
318 	{ BGE_CHIPID_BCM5761_A0,	"BCM5761 A0" },
319 	{ BGE_CHIPID_BCM5761_A1,	"BCM5761 A1" },
320 	{ BGE_CHIPID_BCM5762_A0,	"BCM5762 A0" },
321 	{ BGE_CHIPID_BCM5784_A0,	"BCM5784 A0" },
322 	{ BGE_CHIPID_BCM5784_A1,	"BCM5784 A1" },
323 	/* 5754 and 5787 share the same ASIC ID */
324 	{ BGE_CHIPID_BCM5787_A0,	"BCM5754/5787 A0" },
325 	{ BGE_CHIPID_BCM5787_A1,	"BCM5754/5787 A1" },
326 	{ BGE_CHIPID_BCM5787_A2,	"BCM5754/5787 A2" },
327 	{ BGE_CHIPID_BCM5906_A1,	"BCM5906 A1" },
328 	{ BGE_CHIPID_BCM5906_A2,	"BCM5906 A2" },
329 	{ BGE_CHIPID_BCM57765_A0,	"BCM57765 A0" },
330 	{ BGE_CHIPID_BCM57765_B0,	"BCM57765 B0" },
331 	{ BGE_CHIPID_BCM57780_A0,	"BCM57780 A0" },
332 	{ BGE_CHIPID_BCM57780_A1,	"BCM57780 A1" },
333 
334 	{ 0, NULL }
335 };
336 
337 /*
338  * Some defaults for major revisions, so that newer steppings
339  * that we don't know about have a shot at working.
340  */
341 static const struct bge_revision bge_majorrevs[] = {
342 	{ BGE_ASICREV_BCM5700,		"unknown BCM5700" },
343 	{ BGE_ASICREV_BCM5701,		"unknown BCM5701" },
344 	{ BGE_ASICREV_BCM5703,		"unknown BCM5703" },
345 	{ BGE_ASICREV_BCM5704,		"unknown BCM5704" },
346 	{ BGE_ASICREV_BCM5705,		"unknown BCM5705" },
347 	{ BGE_ASICREV_BCM5750,		"unknown BCM5750" },
348 	{ BGE_ASICREV_BCM5714_A0,	"unknown BCM5714" },
349 	{ BGE_ASICREV_BCM5752,		"unknown BCM5752" },
350 	{ BGE_ASICREV_BCM5780,		"unknown BCM5780" },
351 	{ BGE_ASICREV_BCM5714,		"unknown BCM5714" },
352 	{ BGE_ASICREV_BCM5755,		"unknown BCM5755" },
353 	{ BGE_ASICREV_BCM5761,		"unknown BCM5761" },
354 	{ BGE_ASICREV_BCM5784,		"unknown BCM5784" },
355 	{ BGE_ASICREV_BCM5785,		"unknown BCM5785" },
356 	/* 5754 and 5787 share the same ASIC ID */
357 	{ BGE_ASICREV_BCM5787,		"unknown BCM5754/5787" },
358 	{ BGE_ASICREV_BCM5906,		"unknown BCM5906" },
359 	{ BGE_ASICREV_BCM57765,		"unknown BCM57765" },
360 	{ BGE_ASICREV_BCM57766,		"unknown BCM57766" },
361 	{ BGE_ASICREV_BCM57780,		"unknown BCM57780" },
362 	{ BGE_ASICREV_BCM5717,		"unknown BCM5717" },
363 	{ BGE_ASICREV_BCM5719,		"unknown BCM5719" },
364 	{ BGE_ASICREV_BCM5720,		"unknown BCM5720" },
365 	{ BGE_ASICREV_BCM5762,		"unknown BCM5762" },
366 
367 	{ 0, NULL }
368 };
369 
370 #define	BGE_IS_JUMBO_CAPABLE(sc)	((sc)->bge_flags & BGE_FLAG_JUMBO)
371 #define	BGE_IS_5700_FAMILY(sc)		((sc)->bge_flags & BGE_FLAG_5700_FAMILY)
372 #define	BGE_IS_5705_PLUS(sc)		((sc)->bge_flags & BGE_FLAG_5705_PLUS)
373 #define	BGE_IS_5714_FAMILY(sc)		((sc)->bge_flags & BGE_FLAG_5714_FAMILY)
374 #define	BGE_IS_575X_PLUS(sc)		((sc)->bge_flags & BGE_FLAG_575X_PLUS)
375 #define	BGE_IS_5755_PLUS(sc)		((sc)->bge_flags & BGE_FLAG_5755_PLUS)
376 #define	BGE_IS_5717_PLUS(sc)		((sc)->bge_flags & BGE_FLAG_5717_PLUS)
377 #define	BGE_IS_57765_PLUS(sc)		((sc)->bge_flags & BGE_FLAG_57765_PLUS)
378 
379 static uint32_t bge_chipid(device_t);
380 static const struct bge_vendor * bge_lookup_vendor(uint16_t);
381 static const struct bge_revision * bge_lookup_rev(uint32_t);
382 
383 typedef int	(*bge_eaddr_fcn_t)(struct bge_softc *, uint8_t[]);
384 
385 static int bge_probe(device_t);
386 static int bge_attach(device_t);
387 static int bge_detach(device_t);
388 static int bge_suspend(device_t);
389 static int bge_resume(device_t);
390 static void bge_release_resources(struct bge_softc *);
391 static void bge_dma_map_addr(void *, bus_dma_segment_t *, int, int);
392 static int bge_dma_alloc(struct bge_softc *);
393 static void bge_dma_free(struct bge_softc *);
394 static int bge_dma_ring_alloc(struct bge_softc *, bus_size_t, bus_size_t,
395     bus_dma_tag_t *, uint8_t **, bus_dmamap_t *, bus_addr_t *, const char *);
396 
397 static void bge_devinfo(struct bge_softc *);
398 static int bge_mbox_reorder(struct bge_softc *);
399 
400 static int bge_get_eaddr_fw(struct bge_softc *sc, uint8_t ether_addr[]);
401 static int bge_get_eaddr_mem(struct bge_softc *, uint8_t[]);
402 static int bge_get_eaddr_nvram(struct bge_softc *, uint8_t[]);
403 static int bge_get_eaddr_eeprom(struct bge_softc *, uint8_t[]);
404 static int bge_get_eaddr(struct bge_softc *, uint8_t[]);
405 
406 static void bge_txeof(struct bge_softc *, uint16_t);
407 static void bge_rxcsum(struct bge_softc *, struct bge_rx_bd *, struct mbuf *);
408 static int bge_rxeof(struct bge_softc *, uint16_t, int);
409 
410 static void bge_asf_driver_up (struct bge_softc *);
411 static void bge_tick(void *);
412 static void bge_stats_clear_regs(struct bge_softc *);
413 static void bge_stats_update(struct bge_softc *);
414 static void bge_stats_update_regs(struct bge_softc *);
415 static struct mbuf *bge_check_short_dma(struct mbuf *);
416 static struct mbuf *bge_setup_tso(struct bge_softc *, struct mbuf *,
417     uint16_t *, uint16_t *);
418 static int bge_encap(struct bge_softc *, struct mbuf **, uint32_t *);
419 
420 static void bge_intr(void *);
421 static int bge_msi_intr(void *);
422 static void bge_intr_task(void *, int);
423 static void bge_start(if_t);
424 static void bge_start_locked(if_t);
425 static void bge_start_tx(struct bge_softc *, uint32_t);
426 static int bge_ioctl(if_t, u_long, caddr_t);
427 static void bge_init_locked(struct bge_softc *);
428 static void bge_init(void *);
429 static void bge_stop_block(struct bge_softc *, bus_size_t, uint32_t);
430 static void bge_stop(struct bge_softc *);
431 static void bge_watchdog(struct bge_softc *);
432 static int bge_shutdown(device_t);
433 static int bge_ifmedia_upd_locked(if_t);
434 static int bge_ifmedia_upd(if_t);
435 static void bge_ifmedia_sts(if_t, struct ifmediareq *);
436 static uint64_t bge_get_counter(if_t, ift_counter);
437 
438 static uint8_t bge_nvram_getbyte(struct bge_softc *, int, uint8_t *);
439 static int bge_read_nvram(struct bge_softc *, caddr_t, int, int);
440 
441 static uint8_t bge_eeprom_getbyte(struct bge_softc *, int, uint8_t *);
442 static int bge_read_eeprom(struct bge_softc *, caddr_t, int, int);
443 
444 static void bge_setpromisc(struct bge_softc *);
445 static void bge_setmulti(struct bge_softc *);
446 static void bge_setvlan(struct bge_softc *);
447 
448 static __inline void bge_rxreuse_std(struct bge_softc *, int);
449 static __inline void bge_rxreuse_jumbo(struct bge_softc *, int);
450 static int bge_newbuf_std(struct bge_softc *, int);
451 static int bge_newbuf_jumbo(struct bge_softc *, int);
452 static int bge_init_rx_ring_std(struct bge_softc *);
453 static void bge_free_rx_ring_std(struct bge_softc *);
454 static int bge_init_rx_ring_jumbo(struct bge_softc *);
455 static void bge_free_rx_ring_jumbo(struct bge_softc *);
456 static void bge_free_tx_ring(struct bge_softc *);
457 static int bge_init_tx_ring(struct bge_softc *);
458 
459 static int bge_chipinit(struct bge_softc *);
460 static int bge_blockinit(struct bge_softc *);
461 static uint32_t bge_dma_swap_options(struct bge_softc *);
462 
463 static int bge_has_eaddr(struct bge_softc *);
464 static uint32_t bge_readmem_ind(struct bge_softc *, int);
465 static void bge_writemem_ind(struct bge_softc *, int, int);
466 static void bge_writembx(struct bge_softc *, int, int);
467 #ifdef notdef
468 static uint32_t bge_readreg_ind(struct bge_softc *, int);
469 #endif
470 static void bge_writemem_direct(struct bge_softc *, int, int);
471 static void bge_writereg_ind(struct bge_softc *, int, int);
472 
473 static int bge_miibus_readreg(device_t, int, int);
474 static int bge_miibus_writereg(device_t, int, int, int);
475 static void bge_miibus_statchg(device_t);
476 #ifdef DEVICE_POLLING
477 static int bge_poll(if_t ifp, enum poll_cmd cmd, int count);
478 #endif
479 
480 #define	BGE_RESET_SHUTDOWN	0
481 #define	BGE_RESET_START		1
482 #define	BGE_RESET_SUSPEND	2
483 static void bge_sig_post_reset(struct bge_softc *, int);
484 static void bge_sig_legacy(struct bge_softc *, int);
485 static void bge_sig_pre_reset(struct bge_softc *, int);
486 static void bge_stop_fw(struct bge_softc *);
487 static int bge_reset(struct bge_softc *);
488 static void bge_link_upd(struct bge_softc *);
489 
490 static void bge_ape_lock_init(struct bge_softc *);
491 static void bge_ape_read_fw_ver(struct bge_softc *);
492 static int bge_ape_lock(struct bge_softc *, int);
493 static void bge_ape_unlock(struct bge_softc *, int);
494 static void bge_ape_send_event(struct bge_softc *, uint32_t);
495 static void bge_ape_driver_state_change(struct bge_softc *, int);
496 
497 /*
498  * The BGE_REGISTER_DEBUG option is only for low-level debugging.  It may
499  * leak information to untrusted users.  It is also known to cause alignment
500  * traps on certain architectures.
501  */
502 #ifdef BGE_REGISTER_DEBUG
503 static int bge_sysctl_debug_info(SYSCTL_HANDLER_ARGS);
504 static int bge_sysctl_reg_read(SYSCTL_HANDLER_ARGS);
505 static int bge_sysctl_ape_read(SYSCTL_HANDLER_ARGS);
506 static int bge_sysctl_mem_read(SYSCTL_HANDLER_ARGS);
507 #endif
508 static void bge_add_sysctls(struct bge_softc *);
509 static void bge_add_sysctl_stats_regs(struct bge_softc *,
510     struct sysctl_ctx_list *, struct sysctl_oid_list *);
511 static void bge_add_sysctl_stats(struct bge_softc *, struct sysctl_ctx_list *,
512     struct sysctl_oid_list *);
513 static int bge_sysctl_stats(SYSCTL_HANDLER_ARGS);
514 
515 DEBUGNET_DEFINE(bge);
516 
517 static device_method_t bge_methods[] = {
518 	/* Device interface */
519 	DEVMETHOD(device_probe,		bge_probe),
520 	DEVMETHOD(device_attach,	bge_attach),
521 	DEVMETHOD(device_detach,	bge_detach),
522 	DEVMETHOD(device_shutdown,	bge_shutdown),
523 	DEVMETHOD(device_suspend,	bge_suspend),
524 	DEVMETHOD(device_resume,	bge_resume),
525 
526 	/* MII interface */
527 	DEVMETHOD(miibus_readreg,	bge_miibus_readreg),
528 	DEVMETHOD(miibus_writereg,	bge_miibus_writereg),
529 	DEVMETHOD(miibus_statchg,	bge_miibus_statchg),
530 
531 	DEVMETHOD_END
532 };
533 
534 static driver_t bge_driver = {
535 	"bge",
536 	bge_methods,
537 	sizeof(struct bge_softc)
538 };
539 
540 static devclass_t bge_devclass;
541 
542 DRIVER_MODULE(bge, pci, bge_driver, bge_devclass, 0, 0);
543 MODULE_PNP_INFO("U16:vendor;U16:device", pci, bge, bge_devs,
544     nitems(bge_devs) - 1);
545 DRIVER_MODULE(miibus, bge, miibus_driver, miibus_devclass, 0, 0);
546 
547 static int bge_allow_asf = 1;
548 
549 static SYSCTL_NODE(_hw, OID_AUTO, bge, CTLFLAG_RD | CTLFLAG_MPSAFE, 0,
550     "BGE driver parameters");
551 SYSCTL_INT(_hw_bge, OID_AUTO, allow_asf, CTLFLAG_RDTUN, &bge_allow_asf, 0,
552 	"Allow ASF mode if available");
553 
554 static int
555 bge_has_eaddr(struct bge_softc *sc)
556 {
557 	return (1);
558 }
559 
560 static uint32_t
561 bge_readmem_ind(struct bge_softc *sc, int off)
562 {
563 	device_t dev;
564 	uint32_t val;
565 
566 	if (sc->bge_asicrev == BGE_ASICREV_BCM5906 &&
567 	    off >= BGE_STATS_BLOCK && off < BGE_SEND_RING_1_TO_4)
568 		return (0);
569 
570 	dev = sc->bge_dev;
571 
572 	pci_write_config(dev, BGE_PCI_MEMWIN_BASEADDR, off, 4);
573 	val = pci_read_config(dev, BGE_PCI_MEMWIN_DATA, 4);
574 	pci_write_config(dev, BGE_PCI_MEMWIN_BASEADDR, 0, 4);
575 	return (val);
576 }
577 
578 static void
579 bge_writemem_ind(struct bge_softc *sc, int off, int val)
580 {
581 	device_t dev;
582 
583 	if (sc->bge_asicrev == BGE_ASICREV_BCM5906 &&
584 	    off >= BGE_STATS_BLOCK && off < BGE_SEND_RING_1_TO_4)
585 		return;
586 
587 	dev = sc->bge_dev;
588 
589 	pci_write_config(dev, BGE_PCI_MEMWIN_BASEADDR, off, 4);
590 	pci_write_config(dev, BGE_PCI_MEMWIN_DATA, val, 4);
591 	pci_write_config(dev, BGE_PCI_MEMWIN_BASEADDR, 0, 4);
592 }
593 
594 #ifdef notdef
595 static uint32_t
596 bge_readreg_ind(struct bge_softc *sc, int off)
597 {
598 	device_t dev;
599 
600 	dev = sc->bge_dev;
601 
602 	pci_write_config(dev, BGE_PCI_REG_BASEADDR, off, 4);
603 	return (pci_read_config(dev, BGE_PCI_REG_DATA, 4));
604 }
605 #endif
606 
607 static void
608 bge_writereg_ind(struct bge_softc *sc, int off, int val)
609 {
610 	device_t dev;
611 
612 	dev = sc->bge_dev;
613 
614 	pci_write_config(dev, BGE_PCI_REG_BASEADDR, off, 4);
615 	pci_write_config(dev, BGE_PCI_REG_DATA, val, 4);
616 }
617 
618 static void
619 bge_writemem_direct(struct bge_softc *sc, int off, int val)
620 {
621 	CSR_WRITE_4(sc, off, val);
622 }
623 
624 static void
625 bge_writembx(struct bge_softc *sc, int off, int val)
626 {
627 	if (sc->bge_asicrev == BGE_ASICREV_BCM5906)
628 		off += BGE_LPMBX_IRQ0_HI - BGE_MBX_IRQ0_HI;
629 
630 	CSR_WRITE_4(sc, off, val);
631 	if ((sc->bge_flags & BGE_FLAG_MBOX_REORDER) != 0)
632 		CSR_READ_4(sc, off);
633 }
634 
635 /*
636  * Clear all stale locks and select the lock for this driver instance.
637  */
638 static void
639 bge_ape_lock_init(struct bge_softc *sc)
640 {
641 	uint32_t bit, regbase;
642 	int i;
643 
644 	if (sc->bge_asicrev == BGE_ASICREV_BCM5761)
645 		regbase = BGE_APE_LOCK_GRANT;
646 	else
647 		regbase = BGE_APE_PER_LOCK_GRANT;
648 
649 	/* Clear any stale locks. */
650 	for (i = BGE_APE_LOCK_PHY0; i <= BGE_APE_LOCK_GPIO; i++) {
651 		switch (i) {
652 		case BGE_APE_LOCK_PHY0:
653 		case BGE_APE_LOCK_PHY1:
654 		case BGE_APE_LOCK_PHY2:
655 		case BGE_APE_LOCK_PHY3:
656 			bit = BGE_APE_LOCK_GRANT_DRIVER0;
657 			break;
658 		default:
659 			if (sc->bge_func_addr == 0)
660 				bit = BGE_APE_LOCK_GRANT_DRIVER0;
661 			else
662 				bit = (1 << sc->bge_func_addr);
663 		}
664 		APE_WRITE_4(sc, regbase + 4 * i, bit);
665 	}
666 
667 	/* Select the PHY lock based on the device's function number. */
668 	switch (sc->bge_func_addr) {
669 	case 0:
670 		sc->bge_phy_ape_lock = BGE_APE_LOCK_PHY0;
671 		break;
672 	case 1:
673 		sc->bge_phy_ape_lock = BGE_APE_LOCK_PHY1;
674 		break;
675 	case 2:
676 		sc->bge_phy_ape_lock = BGE_APE_LOCK_PHY2;
677 		break;
678 	case 3:
679 		sc->bge_phy_ape_lock = BGE_APE_LOCK_PHY3;
680 		break;
681 	default:
682 		device_printf(sc->bge_dev,
683 		    "PHY lock not supported on this function\n");
684 	}
685 }
686 
687 /*
688  * Check for APE firmware, set flags, and print version info.
689  */
690 static void
691 bge_ape_read_fw_ver(struct bge_softc *sc)
692 {
693 	const char *fwtype;
694 	uint32_t apedata, features;
695 
696 	/* Check for a valid APE signature in shared memory. */
697 	apedata = APE_READ_4(sc, BGE_APE_SEG_SIG);
698 	if (apedata != BGE_APE_SEG_SIG_MAGIC) {
699 		sc->bge_mfw_flags &= ~ BGE_MFW_ON_APE;
700 		return;
701 	}
702 
703 	/* Check if APE firmware is running. */
704 	apedata = APE_READ_4(sc, BGE_APE_FW_STATUS);
705 	if ((apedata & BGE_APE_FW_STATUS_READY) == 0) {
706 		device_printf(sc->bge_dev, "APE signature found "
707 		    "but FW status not ready! 0x%08x\n", apedata);
708 		return;
709 	}
710 
711 	sc->bge_mfw_flags |= BGE_MFW_ON_APE;
712 
713 	/* Fetch the APE firwmare type and version. */
714 	apedata = APE_READ_4(sc, BGE_APE_FW_VERSION);
715 	features = APE_READ_4(sc, BGE_APE_FW_FEATURES);
716 	if ((features & BGE_APE_FW_FEATURE_NCSI) != 0) {
717 		sc->bge_mfw_flags |= BGE_MFW_TYPE_NCSI;
718 		fwtype = "NCSI";
719 	} else if ((features & BGE_APE_FW_FEATURE_DASH) != 0) {
720 		sc->bge_mfw_flags |= BGE_MFW_TYPE_DASH;
721 		fwtype = "DASH";
722 	} else
723 		fwtype = "UNKN";
724 
725 	/* Print the APE firmware version. */
726 	device_printf(sc->bge_dev, "APE FW version: %s v%d.%d.%d.%d\n",
727 	    fwtype,
728 	    (apedata & BGE_APE_FW_VERSION_MAJMSK) >> BGE_APE_FW_VERSION_MAJSFT,
729 	    (apedata & BGE_APE_FW_VERSION_MINMSK) >> BGE_APE_FW_VERSION_MINSFT,
730 	    (apedata & BGE_APE_FW_VERSION_REVMSK) >> BGE_APE_FW_VERSION_REVSFT,
731 	    (apedata & BGE_APE_FW_VERSION_BLDMSK));
732 }
733 
734 static int
735 bge_ape_lock(struct bge_softc *sc, int locknum)
736 {
737 	uint32_t bit, gnt, req, status;
738 	int i, off;
739 
740 	if ((sc->bge_mfw_flags & BGE_MFW_ON_APE) == 0)
741 		return (0);
742 
743 	/* Lock request/grant registers have different bases. */
744 	if (sc->bge_asicrev == BGE_ASICREV_BCM5761) {
745 		req = BGE_APE_LOCK_REQ;
746 		gnt = BGE_APE_LOCK_GRANT;
747 	} else {
748 		req = BGE_APE_PER_LOCK_REQ;
749 		gnt = BGE_APE_PER_LOCK_GRANT;
750 	}
751 
752 	off = 4 * locknum;
753 
754 	switch (locknum) {
755 	case BGE_APE_LOCK_GPIO:
756 		/* Lock required when using GPIO. */
757 		if (sc->bge_asicrev == BGE_ASICREV_BCM5761)
758 			return (0);
759 		if (sc->bge_func_addr == 0)
760 			bit = BGE_APE_LOCK_REQ_DRIVER0;
761 		else
762 			bit = (1 << sc->bge_func_addr);
763 		break;
764 	case BGE_APE_LOCK_GRC:
765 		/* Lock required to reset the device. */
766 		if (sc->bge_func_addr == 0)
767 			bit = BGE_APE_LOCK_REQ_DRIVER0;
768 		else
769 			bit = (1 << sc->bge_func_addr);
770 		break;
771 	case BGE_APE_LOCK_MEM:
772 		/* Lock required when accessing certain APE memory. */
773 		if (sc->bge_func_addr == 0)
774 			bit = BGE_APE_LOCK_REQ_DRIVER0;
775 		else
776 			bit = (1 << sc->bge_func_addr);
777 		break;
778 	case BGE_APE_LOCK_PHY0:
779 	case BGE_APE_LOCK_PHY1:
780 	case BGE_APE_LOCK_PHY2:
781 	case BGE_APE_LOCK_PHY3:
782 		/* Lock required when accessing PHYs. */
783 		bit = BGE_APE_LOCK_REQ_DRIVER0;
784 		break;
785 	default:
786 		return (EINVAL);
787 	}
788 
789 	/* Request a lock. */
790 	APE_WRITE_4(sc, req + off, bit);
791 
792 	/* Wait up to 1 second to acquire lock. */
793 	for (i = 0; i < 20000; i++) {
794 		status = APE_READ_4(sc, gnt + off);
795 		if (status == bit)
796 			break;
797 		DELAY(50);
798 	}
799 
800 	/* Handle any errors. */
801 	if (status != bit) {
802 		device_printf(sc->bge_dev, "APE lock %d request failed! "
803 		    "request = 0x%04x[0x%04x], status = 0x%04x[0x%04x]\n",
804 		    locknum, req + off, bit & 0xFFFF, gnt + off,
805 		    status & 0xFFFF);
806 		/* Revoke the lock request. */
807 		APE_WRITE_4(sc, gnt + off, bit);
808 		return (EBUSY);
809 	}
810 
811 	return (0);
812 }
813 
814 static void
815 bge_ape_unlock(struct bge_softc *sc, int locknum)
816 {
817 	uint32_t bit, gnt;
818 	int off;
819 
820 	if ((sc->bge_mfw_flags & BGE_MFW_ON_APE) == 0)
821 		return;
822 
823 	if (sc->bge_asicrev == BGE_ASICREV_BCM5761)
824 		gnt = BGE_APE_LOCK_GRANT;
825 	else
826 		gnt = BGE_APE_PER_LOCK_GRANT;
827 
828 	off = 4 * locknum;
829 
830 	switch (locknum) {
831 	case BGE_APE_LOCK_GPIO:
832 		if (sc->bge_asicrev == BGE_ASICREV_BCM5761)
833 			return;
834 		if (sc->bge_func_addr == 0)
835 			bit = BGE_APE_LOCK_GRANT_DRIVER0;
836 		else
837 			bit = (1 << sc->bge_func_addr);
838 		break;
839 	case BGE_APE_LOCK_GRC:
840 		if (sc->bge_func_addr == 0)
841 			bit = BGE_APE_LOCK_GRANT_DRIVER0;
842 		else
843 			bit = (1 << sc->bge_func_addr);
844 		break;
845 	case BGE_APE_LOCK_MEM:
846 		if (sc->bge_func_addr == 0)
847 			bit = BGE_APE_LOCK_GRANT_DRIVER0;
848 		else
849 			bit = (1 << sc->bge_func_addr);
850 		break;
851 	case BGE_APE_LOCK_PHY0:
852 	case BGE_APE_LOCK_PHY1:
853 	case BGE_APE_LOCK_PHY2:
854 	case BGE_APE_LOCK_PHY3:
855 		bit = BGE_APE_LOCK_GRANT_DRIVER0;
856 		break;
857 	default:
858 		return;
859 	}
860 
861 	APE_WRITE_4(sc, gnt + off, bit);
862 }
863 
864 /*
865  * Send an event to the APE firmware.
866  */
867 static void
868 bge_ape_send_event(struct bge_softc *sc, uint32_t event)
869 {
870 	uint32_t apedata;
871 	int i;
872 
873 	/* NCSI does not support APE events. */
874 	if ((sc->bge_mfw_flags & BGE_MFW_ON_APE) == 0)
875 		return;
876 
877 	/* Wait up to 1ms for APE to service previous event. */
878 	for (i = 10; i > 0; i--) {
879 		if (bge_ape_lock(sc, BGE_APE_LOCK_MEM) != 0)
880 			break;
881 		apedata = APE_READ_4(sc, BGE_APE_EVENT_STATUS);
882 		if ((apedata & BGE_APE_EVENT_STATUS_EVENT_PENDING) == 0) {
883 			APE_WRITE_4(sc, BGE_APE_EVENT_STATUS, event |
884 			    BGE_APE_EVENT_STATUS_EVENT_PENDING);
885 			bge_ape_unlock(sc, BGE_APE_LOCK_MEM);
886 			APE_WRITE_4(sc, BGE_APE_EVENT, BGE_APE_EVENT_1);
887 			break;
888 		}
889 		bge_ape_unlock(sc, BGE_APE_LOCK_MEM);
890 		DELAY(100);
891 	}
892 	if (i == 0)
893 		device_printf(sc->bge_dev, "APE event 0x%08x send timed out\n",
894 		    event);
895 }
896 
897 static void
898 bge_ape_driver_state_change(struct bge_softc *sc, int kind)
899 {
900 	uint32_t apedata, event;
901 
902 	if ((sc->bge_mfw_flags & BGE_MFW_ON_APE) == 0)
903 		return;
904 
905 	switch (kind) {
906 	case BGE_RESET_START:
907 		/* If this is the first load, clear the load counter. */
908 		apedata = APE_READ_4(sc, BGE_APE_HOST_SEG_SIG);
909 		if (apedata != BGE_APE_HOST_SEG_SIG_MAGIC)
910 			APE_WRITE_4(sc, BGE_APE_HOST_INIT_COUNT, 0);
911 		else {
912 			apedata = APE_READ_4(sc, BGE_APE_HOST_INIT_COUNT);
913 			APE_WRITE_4(sc, BGE_APE_HOST_INIT_COUNT, ++apedata);
914 		}
915 		APE_WRITE_4(sc, BGE_APE_HOST_SEG_SIG,
916 		    BGE_APE_HOST_SEG_SIG_MAGIC);
917 		APE_WRITE_4(sc, BGE_APE_HOST_SEG_LEN,
918 		    BGE_APE_HOST_SEG_LEN_MAGIC);
919 
920 		/* Add some version info if bge(4) supports it. */
921 		APE_WRITE_4(sc, BGE_APE_HOST_DRIVER_ID,
922 		    BGE_APE_HOST_DRIVER_ID_MAGIC(1, 0));
923 		APE_WRITE_4(sc, BGE_APE_HOST_BEHAVIOR,
924 		    BGE_APE_HOST_BEHAV_NO_PHYLOCK);
925 		APE_WRITE_4(sc, BGE_APE_HOST_HEARTBEAT_INT_MS,
926 		    BGE_APE_HOST_HEARTBEAT_INT_DISABLE);
927 		APE_WRITE_4(sc, BGE_APE_HOST_DRVR_STATE,
928 		    BGE_APE_HOST_DRVR_STATE_START);
929 		event = BGE_APE_EVENT_STATUS_STATE_START;
930 		break;
931 	case BGE_RESET_SHUTDOWN:
932 		APE_WRITE_4(sc, BGE_APE_HOST_DRVR_STATE,
933 		    BGE_APE_HOST_DRVR_STATE_UNLOAD);
934 		event = BGE_APE_EVENT_STATUS_STATE_UNLOAD;
935 		break;
936 	case BGE_RESET_SUSPEND:
937 		event = BGE_APE_EVENT_STATUS_STATE_SUSPEND;
938 		break;
939 	default:
940 		return;
941 	}
942 
943 	bge_ape_send_event(sc, event | BGE_APE_EVENT_STATUS_DRIVER_EVNT |
944 	    BGE_APE_EVENT_STATUS_STATE_CHNGE);
945 }
946 
947 /*
948  * Map a single buffer address.
949  */
950 
951 static void
952 bge_dma_map_addr(void *arg, bus_dma_segment_t *segs, int nseg, int error)
953 {
954 	struct bge_dmamap_arg *ctx;
955 
956 	if (error)
957 		return;
958 
959 	KASSERT(nseg == 1, ("%s: %d segments returned!", __func__, nseg));
960 
961 	ctx = arg;
962 	ctx->bge_busaddr = segs->ds_addr;
963 }
964 
965 static uint8_t
966 bge_nvram_getbyte(struct bge_softc *sc, int addr, uint8_t *dest)
967 {
968 	uint32_t access, byte = 0;
969 	int i;
970 
971 	/* Lock. */
972 	CSR_WRITE_4(sc, BGE_NVRAM_SWARB, BGE_NVRAMSWARB_SET1);
973 	for (i = 0; i < 8000; i++) {
974 		if (CSR_READ_4(sc, BGE_NVRAM_SWARB) & BGE_NVRAMSWARB_GNT1)
975 			break;
976 		DELAY(20);
977 	}
978 	if (i == 8000)
979 		return (1);
980 
981 	/* Enable access. */
982 	access = CSR_READ_4(sc, BGE_NVRAM_ACCESS);
983 	CSR_WRITE_4(sc, BGE_NVRAM_ACCESS, access | BGE_NVRAMACC_ENABLE);
984 
985 	CSR_WRITE_4(sc, BGE_NVRAM_ADDR, addr & 0xfffffffc);
986 	CSR_WRITE_4(sc, BGE_NVRAM_CMD, BGE_NVRAM_READCMD);
987 	for (i = 0; i < BGE_TIMEOUT * 10; i++) {
988 		DELAY(10);
989 		if (CSR_READ_4(sc, BGE_NVRAM_CMD) & BGE_NVRAMCMD_DONE) {
990 			DELAY(10);
991 			break;
992 		}
993 	}
994 
995 	if (i == BGE_TIMEOUT * 10) {
996 		if_printf(sc->bge_ifp, "nvram read timed out\n");
997 		return (1);
998 	}
999 
1000 	/* Get result. */
1001 	byte = CSR_READ_4(sc, BGE_NVRAM_RDDATA);
1002 
1003 	*dest = (bswap32(byte) >> ((addr % 4) * 8)) & 0xFF;
1004 
1005 	/* Disable access. */
1006 	CSR_WRITE_4(sc, BGE_NVRAM_ACCESS, access);
1007 
1008 	/* Unlock. */
1009 	CSR_WRITE_4(sc, BGE_NVRAM_SWARB, BGE_NVRAMSWARB_CLR1);
1010 	CSR_READ_4(sc, BGE_NVRAM_SWARB);
1011 
1012 	return (0);
1013 }
1014 
1015 /*
1016  * Read a sequence of bytes from NVRAM.
1017  */
1018 static int
1019 bge_read_nvram(struct bge_softc *sc, caddr_t dest, int off, int cnt)
1020 {
1021 	int err = 0, i;
1022 	uint8_t byte = 0;
1023 
1024 	if (sc->bge_asicrev != BGE_ASICREV_BCM5906)
1025 		return (1);
1026 
1027 	for (i = 0; i < cnt; i++) {
1028 		err = bge_nvram_getbyte(sc, off + i, &byte);
1029 		if (err)
1030 			break;
1031 		*(dest + i) = byte;
1032 	}
1033 
1034 	return (err ? 1 : 0);
1035 }
1036 
1037 /*
1038  * Read a byte of data stored in the EEPROM at address 'addr.' The
1039  * BCM570x supports both the traditional bitbang interface and an
1040  * auto access interface for reading the EEPROM. We use the auto
1041  * access method.
1042  */
1043 static uint8_t
1044 bge_eeprom_getbyte(struct bge_softc *sc, int addr, uint8_t *dest)
1045 {
1046 	int i;
1047 	uint32_t byte = 0;
1048 
1049 	/*
1050 	 * Enable use of auto EEPROM access so we can avoid
1051 	 * having to use the bitbang method.
1052 	 */
1053 	BGE_SETBIT(sc, BGE_MISC_LOCAL_CTL, BGE_MLC_AUTO_EEPROM);
1054 
1055 	/* Reset the EEPROM, load the clock period. */
1056 	CSR_WRITE_4(sc, BGE_EE_ADDR,
1057 	    BGE_EEADDR_RESET | BGE_EEHALFCLK(BGE_HALFCLK_384SCL));
1058 	DELAY(20);
1059 
1060 	/* Issue the read EEPROM command. */
1061 	CSR_WRITE_4(sc, BGE_EE_ADDR, BGE_EE_READCMD | addr);
1062 
1063 	/* Wait for completion */
1064 	for(i = 0; i < BGE_TIMEOUT * 10; i++) {
1065 		DELAY(10);
1066 		if (CSR_READ_4(sc, BGE_EE_ADDR) & BGE_EEADDR_DONE)
1067 			break;
1068 	}
1069 
1070 	if (i == BGE_TIMEOUT * 10) {
1071 		device_printf(sc->bge_dev, "EEPROM read timed out\n");
1072 		return (1);
1073 	}
1074 
1075 	/* Get result. */
1076 	byte = CSR_READ_4(sc, BGE_EE_DATA);
1077 
1078 	*dest = (byte >> ((addr % 4) * 8)) & 0xFF;
1079 
1080 	return (0);
1081 }
1082 
1083 /*
1084  * Read a sequence of bytes from the EEPROM.
1085  */
1086 static int
1087 bge_read_eeprom(struct bge_softc *sc, caddr_t dest, int off, int cnt)
1088 {
1089 	int i, error = 0;
1090 	uint8_t byte = 0;
1091 
1092 	for (i = 0; i < cnt; i++) {
1093 		error = bge_eeprom_getbyte(sc, off + i, &byte);
1094 		if (error)
1095 			break;
1096 		*(dest + i) = byte;
1097 	}
1098 
1099 	return (error ? 1 : 0);
1100 }
1101 
1102 static int
1103 bge_miibus_readreg(device_t dev, int phy, int reg)
1104 {
1105 	struct bge_softc *sc;
1106 	uint32_t val;
1107 	int i;
1108 
1109 	sc = device_get_softc(dev);
1110 
1111 	if (bge_ape_lock(sc, sc->bge_phy_ape_lock) != 0)
1112 		return (0);
1113 
1114 	/* Clear the autopoll bit if set, otherwise may trigger PCI errors. */
1115 	if ((sc->bge_mi_mode & BGE_MIMODE_AUTOPOLL) != 0) {
1116 		CSR_WRITE_4(sc, BGE_MI_MODE,
1117 		    sc->bge_mi_mode & ~BGE_MIMODE_AUTOPOLL);
1118 		DELAY(80);
1119 	}
1120 
1121 	CSR_WRITE_4(sc, BGE_MI_COMM, BGE_MICMD_READ | BGE_MICOMM_BUSY |
1122 	    BGE_MIPHY(phy) | BGE_MIREG(reg));
1123 
1124 	/* Poll for the PHY register access to complete. */
1125 	for (i = 0; i < BGE_TIMEOUT; i++) {
1126 		DELAY(10);
1127 		val = CSR_READ_4(sc, BGE_MI_COMM);
1128 		if ((val & BGE_MICOMM_BUSY) == 0) {
1129 			DELAY(5);
1130 			val = CSR_READ_4(sc, BGE_MI_COMM);
1131 			break;
1132 		}
1133 	}
1134 
1135 	if (i == BGE_TIMEOUT) {
1136 		device_printf(sc->bge_dev,
1137 		    "PHY read timed out (phy %d, reg %d, val 0x%08x)\n",
1138 		    phy, reg, val);
1139 		val = 0;
1140 	}
1141 
1142 	/* Restore the autopoll bit if necessary. */
1143 	if ((sc->bge_mi_mode & BGE_MIMODE_AUTOPOLL) != 0) {
1144 		CSR_WRITE_4(sc, BGE_MI_MODE, sc->bge_mi_mode);
1145 		DELAY(80);
1146 	}
1147 
1148 	bge_ape_unlock(sc, sc->bge_phy_ape_lock);
1149 
1150 	if (val & BGE_MICOMM_READFAIL)
1151 		return (0);
1152 
1153 	return (val & 0xFFFF);
1154 }
1155 
1156 static int
1157 bge_miibus_writereg(device_t dev, int phy, int reg, int val)
1158 {
1159 	struct bge_softc *sc;
1160 	int i;
1161 
1162 	sc = device_get_softc(dev);
1163 
1164 	if (sc->bge_asicrev == BGE_ASICREV_BCM5906 &&
1165 	    (reg == BRGPHY_MII_1000CTL || reg == BRGPHY_MII_AUXCTL))
1166 		return (0);
1167 
1168 	if (bge_ape_lock(sc, sc->bge_phy_ape_lock) != 0)
1169 		return (0);
1170 
1171 	/* Clear the autopoll bit if set, otherwise may trigger PCI errors. */
1172 	if ((sc->bge_mi_mode & BGE_MIMODE_AUTOPOLL) != 0) {
1173 		CSR_WRITE_4(sc, BGE_MI_MODE,
1174 		    sc->bge_mi_mode & ~BGE_MIMODE_AUTOPOLL);
1175 		DELAY(80);
1176 	}
1177 
1178 	CSR_WRITE_4(sc, BGE_MI_COMM, BGE_MICMD_WRITE | BGE_MICOMM_BUSY |
1179 	    BGE_MIPHY(phy) | BGE_MIREG(reg) | val);
1180 
1181 	for (i = 0; i < BGE_TIMEOUT; i++) {
1182 		DELAY(10);
1183 		if (!(CSR_READ_4(sc, BGE_MI_COMM) & BGE_MICOMM_BUSY)) {
1184 			DELAY(5);
1185 			CSR_READ_4(sc, BGE_MI_COMM); /* dummy read */
1186 			break;
1187 		}
1188 	}
1189 
1190 	/* Restore the autopoll bit if necessary. */
1191 	if ((sc->bge_mi_mode & BGE_MIMODE_AUTOPOLL) != 0) {
1192 		CSR_WRITE_4(sc, BGE_MI_MODE, sc->bge_mi_mode);
1193 		DELAY(80);
1194 	}
1195 
1196 	bge_ape_unlock(sc, sc->bge_phy_ape_lock);
1197 
1198 	if (i == BGE_TIMEOUT)
1199 		device_printf(sc->bge_dev,
1200 		    "PHY write timed out (phy %d, reg %d, val 0x%04x)\n",
1201 		    phy, reg, val);
1202 
1203 	return (0);
1204 }
1205 
1206 static void
1207 bge_miibus_statchg(device_t dev)
1208 {
1209 	struct bge_softc *sc;
1210 	struct mii_data *mii;
1211 	uint32_t mac_mode, rx_mode, tx_mode;
1212 
1213 	sc = device_get_softc(dev);
1214 	if ((if_getdrvflags(sc->bge_ifp) & IFF_DRV_RUNNING) == 0)
1215 		return;
1216 	mii = device_get_softc(sc->bge_miibus);
1217 
1218 	if ((mii->mii_media_status & (IFM_ACTIVE | IFM_AVALID)) ==
1219 	    (IFM_ACTIVE | IFM_AVALID)) {
1220 		switch (IFM_SUBTYPE(mii->mii_media_active)) {
1221 		case IFM_10_T:
1222 		case IFM_100_TX:
1223 			sc->bge_link = 1;
1224 			break;
1225 		case IFM_1000_T:
1226 		case IFM_1000_SX:
1227 		case IFM_2500_SX:
1228 			if (sc->bge_asicrev != BGE_ASICREV_BCM5906)
1229 				sc->bge_link = 1;
1230 			else
1231 				sc->bge_link = 0;
1232 			break;
1233 		default:
1234 			sc->bge_link = 0;
1235 			break;
1236 		}
1237 	} else
1238 		sc->bge_link = 0;
1239 	if (sc->bge_link == 0)
1240 		return;
1241 
1242 	/*
1243 	 * APE firmware touches these registers to keep the MAC
1244 	 * connected to the outside world.  Try to keep the
1245 	 * accesses atomic.
1246 	 */
1247 
1248 	/* Set the port mode (MII/GMII) to match the link speed. */
1249 	mac_mode = CSR_READ_4(sc, BGE_MAC_MODE) &
1250 	    ~(BGE_MACMODE_PORTMODE | BGE_MACMODE_HALF_DUPLEX);
1251 	tx_mode = CSR_READ_4(sc, BGE_TX_MODE);
1252 	rx_mode = CSR_READ_4(sc, BGE_RX_MODE);
1253 
1254 	if (IFM_SUBTYPE(mii->mii_media_active) == IFM_1000_T ||
1255 	    IFM_SUBTYPE(mii->mii_media_active) == IFM_1000_SX)
1256 		mac_mode |= BGE_PORTMODE_GMII;
1257 	else
1258 		mac_mode |= BGE_PORTMODE_MII;
1259 
1260 	/* Set MAC flow control behavior to match link flow control settings. */
1261 	tx_mode &= ~BGE_TXMODE_FLOWCTL_ENABLE;
1262 	rx_mode &= ~BGE_RXMODE_FLOWCTL_ENABLE;
1263 	if ((IFM_OPTIONS(mii->mii_media_active) & IFM_FDX) != 0) {
1264 		if ((IFM_OPTIONS(mii->mii_media_active) & IFM_ETH_TXPAUSE) != 0)
1265 			tx_mode |= BGE_TXMODE_FLOWCTL_ENABLE;
1266 		if ((IFM_OPTIONS(mii->mii_media_active) & IFM_ETH_RXPAUSE) != 0)
1267 			rx_mode |= BGE_RXMODE_FLOWCTL_ENABLE;
1268 	} else
1269 		mac_mode |= BGE_MACMODE_HALF_DUPLEX;
1270 
1271 	CSR_WRITE_4(sc, BGE_MAC_MODE, mac_mode);
1272 	DELAY(40);
1273 	CSR_WRITE_4(sc, BGE_TX_MODE, tx_mode);
1274 	CSR_WRITE_4(sc, BGE_RX_MODE, rx_mode);
1275 }
1276 
1277 /*
1278  * Intialize a standard receive ring descriptor.
1279  */
1280 static int
1281 bge_newbuf_std(struct bge_softc *sc, int i)
1282 {
1283 	struct mbuf *m;
1284 	struct bge_rx_bd *r;
1285 	bus_dma_segment_t segs[1];
1286 	bus_dmamap_t map;
1287 	int error, nsegs;
1288 
1289 	if (sc->bge_flags & BGE_FLAG_JUMBO_STD &&
1290 	    (if_getmtu(sc->bge_ifp) + ETHER_HDR_LEN + ETHER_CRC_LEN +
1291 	    ETHER_VLAN_ENCAP_LEN > (MCLBYTES - ETHER_ALIGN))) {
1292 		m = m_getjcl(M_NOWAIT, MT_DATA, M_PKTHDR, MJUM9BYTES);
1293 		if (m == NULL)
1294 			return (ENOBUFS);
1295 		m->m_len = m->m_pkthdr.len = MJUM9BYTES;
1296 	} else {
1297 		m = m_getcl(M_NOWAIT, MT_DATA, M_PKTHDR);
1298 		if (m == NULL)
1299 			return (ENOBUFS);
1300 		m->m_len = m->m_pkthdr.len = MCLBYTES;
1301 	}
1302 	if ((sc->bge_flags & BGE_FLAG_RX_ALIGNBUG) == 0)
1303 		m_adj(m, ETHER_ALIGN);
1304 
1305 	error = bus_dmamap_load_mbuf_sg(sc->bge_cdata.bge_rx_mtag,
1306 	    sc->bge_cdata.bge_rx_std_sparemap, m, segs, &nsegs, 0);
1307 	if (error != 0) {
1308 		m_freem(m);
1309 		return (error);
1310 	}
1311 	if (sc->bge_cdata.bge_rx_std_chain[i] != NULL) {
1312 		bus_dmamap_sync(sc->bge_cdata.bge_rx_mtag,
1313 		    sc->bge_cdata.bge_rx_std_dmamap[i], BUS_DMASYNC_POSTREAD);
1314 		bus_dmamap_unload(sc->bge_cdata.bge_rx_mtag,
1315 		    sc->bge_cdata.bge_rx_std_dmamap[i]);
1316 	}
1317 	map = sc->bge_cdata.bge_rx_std_dmamap[i];
1318 	sc->bge_cdata.bge_rx_std_dmamap[i] = sc->bge_cdata.bge_rx_std_sparemap;
1319 	sc->bge_cdata.bge_rx_std_sparemap = map;
1320 	sc->bge_cdata.bge_rx_std_chain[i] = m;
1321 	sc->bge_cdata.bge_rx_std_seglen[i] = segs[0].ds_len;
1322 	r = &sc->bge_ldata.bge_rx_std_ring[sc->bge_std];
1323 	r->bge_addr.bge_addr_lo = BGE_ADDR_LO(segs[0].ds_addr);
1324 	r->bge_addr.bge_addr_hi = BGE_ADDR_HI(segs[0].ds_addr);
1325 	r->bge_flags = BGE_RXBDFLAG_END;
1326 	r->bge_len = segs[0].ds_len;
1327 	r->bge_idx = i;
1328 
1329 	bus_dmamap_sync(sc->bge_cdata.bge_rx_mtag,
1330 	    sc->bge_cdata.bge_rx_std_dmamap[i], BUS_DMASYNC_PREREAD);
1331 
1332 	return (0);
1333 }
1334 
1335 /*
1336  * Initialize a jumbo receive ring descriptor. This allocates
1337  * a jumbo buffer from the pool managed internally by the driver.
1338  */
1339 static int
1340 bge_newbuf_jumbo(struct bge_softc *sc, int i)
1341 {
1342 	bus_dma_segment_t segs[BGE_NSEG_JUMBO];
1343 	bus_dmamap_t map;
1344 	struct bge_extrx_bd *r;
1345 	struct mbuf *m;
1346 	int error, nsegs;
1347 
1348 	MGETHDR(m, M_NOWAIT, MT_DATA);
1349 	if (m == NULL)
1350 		return (ENOBUFS);
1351 
1352 	if (m_cljget(m, M_NOWAIT, MJUM9BYTES) == NULL) {
1353 		m_freem(m);
1354 		return (ENOBUFS);
1355 	}
1356 	m->m_len = m->m_pkthdr.len = MJUM9BYTES;
1357 	if ((sc->bge_flags & BGE_FLAG_RX_ALIGNBUG) == 0)
1358 		m_adj(m, ETHER_ALIGN);
1359 
1360 	error = bus_dmamap_load_mbuf_sg(sc->bge_cdata.bge_mtag_jumbo,
1361 	    sc->bge_cdata.bge_rx_jumbo_sparemap, m, segs, &nsegs, 0);
1362 	if (error != 0) {
1363 		m_freem(m);
1364 		return (error);
1365 	}
1366 
1367 	if (sc->bge_cdata.bge_rx_jumbo_chain[i] != NULL) {
1368 		bus_dmamap_sync(sc->bge_cdata.bge_mtag_jumbo,
1369 		    sc->bge_cdata.bge_rx_jumbo_dmamap[i], BUS_DMASYNC_POSTREAD);
1370 		bus_dmamap_unload(sc->bge_cdata.bge_mtag_jumbo,
1371 		    sc->bge_cdata.bge_rx_jumbo_dmamap[i]);
1372 	}
1373 	map = sc->bge_cdata.bge_rx_jumbo_dmamap[i];
1374 	sc->bge_cdata.bge_rx_jumbo_dmamap[i] =
1375 	    sc->bge_cdata.bge_rx_jumbo_sparemap;
1376 	sc->bge_cdata.bge_rx_jumbo_sparemap = map;
1377 	sc->bge_cdata.bge_rx_jumbo_chain[i] = m;
1378 	sc->bge_cdata.bge_rx_jumbo_seglen[i][0] = 0;
1379 	sc->bge_cdata.bge_rx_jumbo_seglen[i][1] = 0;
1380 	sc->bge_cdata.bge_rx_jumbo_seglen[i][2] = 0;
1381 	sc->bge_cdata.bge_rx_jumbo_seglen[i][3] = 0;
1382 
1383 	/*
1384 	 * Fill in the extended RX buffer descriptor.
1385 	 */
1386 	r = &sc->bge_ldata.bge_rx_jumbo_ring[sc->bge_jumbo];
1387 	r->bge_flags = BGE_RXBDFLAG_JUMBO_RING | BGE_RXBDFLAG_END;
1388 	r->bge_idx = i;
1389 	r->bge_len3 = r->bge_len2 = r->bge_len1 = 0;
1390 	switch (nsegs) {
1391 	case 4:
1392 		r->bge_addr3.bge_addr_lo = BGE_ADDR_LO(segs[3].ds_addr);
1393 		r->bge_addr3.bge_addr_hi = BGE_ADDR_HI(segs[3].ds_addr);
1394 		r->bge_len3 = segs[3].ds_len;
1395 		sc->bge_cdata.bge_rx_jumbo_seglen[i][3] = segs[3].ds_len;
1396 	case 3:
1397 		r->bge_addr2.bge_addr_lo = BGE_ADDR_LO(segs[2].ds_addr);
1398 		r->bge_addr2.bge_addr_hi = BGE_ADDR_HI(segs[2].ds_addr);
1399 		r->bge_len2 = segs[2].ds_len;
1400 		sc->bge_cdata.bge_rx_jumbo_seglen[i][2] = segs[2].ds_len;
1401 	case 2:
1402 		r->bge_addr1.bge_addr_lo = BGE_ADDR_LO(segs[1].ds_addr);
1403 		r->bge_addr1.bge_addr_hi = BGE_ADDR_HI(segs[1].ds_addr);
1404 		r->bge_len1 = segs[1].ds_len;
1405 		sc->bge_cdata.bge_rx_jumbo_seglen[i][1] = segs[1].ds_len;
1406 	case 1:
1407 		r->bge_addr0.bge_addr_lo = BGE_ADDR_LO(segs[0].ds_addr);
1408 		r->bge_addr0.bge_addr_hi = BGE_ADDR_HI(segs[0].ds_addr);
1409 		r->bge_len0 = segs[0].ds_len;
1410 		sc->bge_cdata.bge_rx_jumbo_seglen[i][0] = segs[0].ds_len;
1411 		break;
1412 	default:
1413 		panic("%s: %d segments\n", __func__, nsegs);
1414 	}
1415 
1416 	bus_dmamap_sync(sc->bge_cdata.bge_mtag_jumbo,
1417 	    sc->bge_cdata.bge_rx_jumbo_dmamap[i], BUS_DMASYNC_PREREAD);
1418 
1419 	return (0);
1420 }
1421 
1422 static int
1423 bge_init_rx_ring_std(struct bge_softc *sc)
1424 {
1425 	int error, i;
1426 
1427 	bzero(sc->bge_ldata.bge_rx_std_ring, BGE_STD_RX_RING_SZ);
1428 	sc->bge_std = 0;
1429 	for (i = 0; i < BGE_STD_RX_RING_CNT; i++) {
1430 		if ((error = bge_newbuf_std(sc, i)) != 0)
1431 			return (error);
1432 		BGE_INC(sc->bge_std, BGE_STD_RX_RING_CNT);
1433 	}
1434 
1435 	bus_dmamap_sync(sc->bge_cdata.bge_rx_std_ring_tag,
1436 	    sc->bge_cdata.bge_rx_std_ring_map, BUS_DMASYNC_PREWRITE);
1437 
1438 	sc->bge_std = 0;
1439 	bge_writembx(sc, BGE_MBX_RX_STD_PROD_LO, BGE_STD_RX_RING_CNT - 1);
1440 
1441 	return (0);
1442 }
1443 
1444 static void
1445 bge_free_rx_ring_std(struct bge_softc *sc)
1446 {
1447 	int i;
1448 
1449 	for (i = 0; i < BGE_STD_RX_RING_CNT; i++) {
1450 		if (sc->bge_cdata.bge_rx_std_chain[i] != NULL) {
1451 			bus_dmamap_sync(sc->bge_cdata.bge_rx_mtag,
1452 			    sc->bge_cdata.bge_rx_std_dmamap[i],
1453 			    BUS_DMASYNC_POSTREAD);
1454 			bus_dmamap_unload(sc->bge_cdata.bge_rx_mtag,
1455 			    sc->bge_cdata.bge_rx_std_dmamap[i]);
1456 			m_freem(sc->bge_cdata.bge_rx_std_chain[i]);
1457 			sc->bge_cdata.bge_rx_std_chain[i] = NULL;
1458 		}
1459 		bzero((char *)&sc->bge_ldata.bge_rx_std_ring[i],
1460 		    sizeof(struct bge_rx_bd));
1461 	}
1462 }
1463 
1464 static int
1465 bge_init_rx_ring_jumbo(struct bge_softc *sc)
1466 {
1467 	struct bge_rcb *rcb;
1468 	int error, i;
1469 
1470 	bzero(sc->bge_ldata.bge_rx_jumbo_ring, BGE_JUMBO_RX_RING_SZ);
1471 	sc->bge_jumbo = 0;
1472 	for (i = 0; i < BGE_JUMBO_RX_RING_CNT; i++) {
1473 		if ((error = bge_newbuf_jumbo(sc, i)) != 0)
1474 			return (error);
1475 		BGE_INC(sc->bge_jumbo, BGE_JUMBO_RX_RING_CNT);
1476 	}
1477 
1478 	bus_dmamap_sync(sc->bge_cdata.bge_rx_jumbo_ring_tag,
1479 	    sc->bge_cdata.bge_rx_jumbo_ring_map, BUS_DMASYNC_PREWRITE);
1480 
1481 	sc->bge_jumbo = 0;
1482 
1483 	/* Enable the jumbo receive producer ring. */
1484 	rcb = &sc->bge_ldata.bge_info.bge_jumbo_rx_rcb;
1485 	rcb->bge_maxlen_flags =
1486 	    BGE_RCB_MAXLEN_FLAGS(0, BGE_RCB_FLAG_USE_EXT_RX_BD);
1487 	CSR_WRITE_4(sc, BGE_RX_JUMBO_RCB_MAXLEN_FLAGS, rcb->bge_maxlen_flags);
1488 
1489 	bge_writembx(sc, BGE_MBX_RX_JUMBO_PROD_LO, BGE_JUMBO_RX_RING_CNT - 1);
1490 
1491 	return (0);
1492 }
1493 
1494 static void
1495 bge_free_rx_ring_jumbo(struct bge_softc *sc)
1496 {
1497 	int i;
1498 
1499 	for (i = 0; i < BGE_JUMBO_RX_RING_CNT; i++) {
1500 		if (sc->bge_cdata.bge_rx_jumbo_chain[i] != NULL) {
1501 			bus_dmamap_sync(sc->bge_cdata.bge_mtag_jumbo,
1502 			    sc->bge_cdata.bge_rx_jumbo_dmamap[i],
1503 			    BUS_DMASYNC_POSTREAD);
1504 			bus_dmamap_unload(sc->bge_cdata.bge_mtag_jumbo,
1505 			    sc->bge_cdata.bge_rx_jumbo_dmamap[i]);
1506 			m_freem(sc->bge_cdata.bge_rx_jumbo_chain[i]);
1507 			sc->bge_cdata.bge_rx_jumbo_chain[i] = NULL;
1508 		}
1509 		bzero((char *)&sc->bge_ldata.bge_rx_jumbo_ring[i],
1510 		    sizeof(struct bge_extrx_bd));
1511 	}
1512 }
1513 
1514 static void
1515 bge_free_tx_ring(struct bge_softc *sc)
1516 {
1517 	int i;
1518 
1519 	if (sc->bge_ldata.bge_tx_ring == NULL)
1520 		return;
1521 
1522 	for (i = 0; i < BGE_TX_RING_CNT; i++) {
1523 		if (sc->bge_cdata.bge_tx_chain[i] != NULL) {
1524 			bus_dmamap_sync(sc->bge_cdata.bge_tx_mtag,
1525 			    sc->bge_cdata.bge_tx_dmamap[i],
1526 			    BUS_DMASYNC_POSTWRITE);
1527 			bus_dmamap_unload(sc->bge_cdata.bge_tx_mtag,
1528 			    sc->bge_cdata.bge_tx_dmamap[i]);
1529 			m_freem(sc->bge_cdata.bge_tx_chain[i]);
1530 			sc->bge_cdata.bge_tx_chain[i] = NULL;
1531 		}
1532 		bzero((char *)&sc->bge_ldata.bge_tx_ring[i],
1533 		    sizeof(struct bge_tx_bd));
1534 	}
1535 }
1536 
1537 static int
1538 bge_init_tx_ring(struct bge_softc *sc)
1539 {
1540 	sc->bge_txcnt = 0;
1541 	sc->bge_tx_saved_considx = 0;
1542 
1543 	bzero(sc->bge_ldata.bge_tx_ring, BGE_TX_RING_SZ);
1544 	bus_dmamap_sync(sc->bge_cdata.bge_tx_ring_tag,
1545 	    sc->bge_cdata.bge_tx_ring_map, BUS_DMASYNC_PREWRITE);
1546 
1547 	/* Initialize transmit producer index for host-memory send ring. */
1548 	sc->bge_tx_prodidx = 0;
1549 	bge_writembx(sc, BGE_MBX_TX_HOST_PROD0_LO, sc->bge_tx_prodidx);
1550 
1551 	/* 5700 b2 errata */
1552 	if (sc->bge_chiprev == BGE_CHIPREV_5700_BX)
1553 		bge_writembx(sc, BGE_MBX_TX_HOST_PROD0_LO, sc->bge_tx_prodidx);
1554 
1555 	/* NIC-memory send ring not used; initialize to zero. */
1556 	bge_writembx(sc, BGE_MBX_TX_NIC_PROD0_LO, 0);
1557 	/* 5700 b2 errata */
1558 	if (sc->bge_chiprev == BGE_CHIPREV_5700_BX)
1559 		bge_writembx(sc, BGE_MBX_TX_NIC_PROD0_LO, 0);
1560 
1561 	return (0);
1562 }
1563 
1564 static void
1565 bge_setpromisc(struct bge_softc *sc)
1566 {
1567 	if_t ifp;
1568 
1569 	BGE_LOCK_ASSERT(sc);
1570 
1571 	ifp = sc->bge_ifp;
1572 
1573 	/* Enable or disable promiscuous mode as needed. */
1574 	if (if_getflags(ifp) & IFF_PROMISC)
1575 		BGE_SETBIT(sc, BGE_RX_MODE, BGE_RXMODE_RX_PROMISC);
1576 	else
1577 		BGE_CLRBIT(sc, BGE_RX_MODE, BGE_RXMODE_RX_PROMISC);
1578 }
1579 
1580 static u_int
1581 bge_hash_maddr(void *arg, struct sockaddr_dl *sdl, u_int cnt)
1582 {
1583 	uint32_t *hashes = arg;
1584 	int h;
1585 
1586 	h = ether_crc32_le(LLADDR(sdl), ETHER_ADDR_LEN) & 0x7F;
1587 	hashes[(h & 0x60) >> 5] |= 1 << (h & 0x1F);
1588 
1589 	return (1);
1590 }
1591 
1592 static void
1593 bge_setmulti(struct bge_softc *sc)
1594 {
1595 	if_t ifp;
1596 	uint32_t hashes[4] = { 0, 0, 0, 0 };
1597 	int i;
1598 
1599 	BGE_LOCK_ASSERT(sc);
1600 
1601 	ifp = sc->bge_ifp;
1602 
1603 	if (if_getflags(ifp) & IFF_ALLMULTI || if_getflags(ifp) & IFF_PROMISC) {
1604 		for (i = 0; i < 4; i++)
1605 			CSR_WRITE_4(sc, BGE_MAR0 + (i * 4), 0xFFFFFFFF);
1606 		return;
1607 	}
1608 
1609 	/* First, zot all the existing filters. */
1610 	for (i = 0; i < 4; i++)
1611 		CSR_WRITE_4(sc, BGE_MAR0 + (i * 4), 0);
1612 
1613 	if_foreach_llmaddr(ifp, bge_hash_maddr, hashes);
1614 
1615 	for (i = 0; i < 4; i++)
1616 		CSR_WRITE_4(sc, BGE_MAR0 + (i * 4), hashes[i]);
1617 }
1618 
1619 static void
1620 bge_setvlan(struct bge_softc *sc)
1621 {
1622 	if_t ifp;
1623 
1624 	BGE_LOCK_ASSERT(sc);
1625 
1626 	ifp = sc->bge_ifp;
1627 
1628 	/* Enable or disable VLAN tag stripping as needed. */
1629 	if (if_getcapenable(ifp) & IFCAP_VLAN_HWTAGGING)
1630 		BGE_CLRBIT(sc, BGE_RX_MODE, BGE_RXMODE_RX_KEEP_VLAN_DIAG);
1631 	else
1632 		BGE_SETBIT(sc, BGE_RX_MODE, BGE_RXMODE_RX_KEEP_VLAN_DIAG);
1633 }
1634 
1635 static void
1636 bge_sig_pre_reset(struct bge_softc *sc, int type)
1637 {
1638 
1639 	/*
1640 	 * Some chips don't like this so only do this if ASF is enabled
1641 	 */
1642 	if (sc->bge_asf_mode)
1643 		bge_writemem_ind(sc, BGE_SRAM_FW_MB, BGE_SRAM_FW_MB_MAGIC);
1644 
1645 	if (sc->bge_asf_mode & ASF_NEW_HANDSHAKE) {
1646 		switch (type) {
1647 		case BGE_RESET_START:
1648 			bge_writemem_ind(sc, BGE_SRAM_FW_DRV_STATE_MB,
1649 			    BGE_FW_DRV_STATE_START);
1650 			break;
1651 		case BGE_RESET_SHUTDOWN:
1652 			bge_writemem_ind(sc, BGE_SRAM_FW_DRV_STATE_MB,
1653 			    BGE_FW_DRV_STATE_UNLOAD);
1654 			break;
1655 		case BGE_RESET_SUSPEND:
1656 			bge_writemem_ind(sc, BGE_SRAM_FW_DRV_STATE_MB,
1657 			    BGE_FW_DRV_STATE_SUSPEND);
1658 			break;
1659 		}
1660 	}
1661 
1662 	if (type == BGE_RESET_START || type == BGE_RESET_SUSPEND)
1663 		bge_ape_driver_state_change(sc, type);
1664 }
1665 
1666 static void
1667 bge_sig_post_reset(struct bge_softc *sc, int type)
1668 {
1669 
1670 	if (sc->bge_asf_mode & ASF_NEW_HANDSHAKE) {
1671 		switch (type) {
1672 		case BGE_RESET_START:
1673 			bge_writemem_ind(sc, BGE_SRAM_FW_DRV_STATE_MB,
1674 			    BGE_FW_DRV_STATE_START_DONE);
1675 			/* START DONE */
1676 			break;
1677 		case BGE_RESET_SHUTDOWN:
1678 			bge_writemem_ind(sc, BGE_SRAM_FW_DRV_STATE_MB,
1679 			    BGE_FW_DRV_STATE_UNLOAD_DONE);
1680 			break;
1681 		}
1682 	}
1683 	if (type == BGE_RESET_SHUTDOWN)
1684 		bge_ape_driver_state_change(sc, type);
1685 }
1686 
1687 static void
1688 bge_sig_legacy(struct bge_softc *sc, int type)
1689 {
1690 
1691 	if (sc->bge_asf_mode) {
1692 		switch (type) {
1693 		case BGE_RESET_START:
1694 			bge_writemem_ind(sc, BGE_SRAM_FW_DRV_STATE_MB,
1695 			    BGE_FW_DRV_STATE_START);
1696 			break;
1697 		case BGE_RESET_SHUTDOWN:
1698 			bge_writemem_ind(sc, BGE_SRAM_FW_DRV_STATE_MB,
1699 			    BGE_FW_DRV_STATE_UNLOAD);
1700 			break;
1701 		}
1702 	}
1703 }
1704 
1705 static void
1706 bge_stop_fw(struct bge_softc *sc)
1707 {
1708 	int i;
1709 
1710 	if (sc->bge_asf_mode) {
1711 		bge_writemem_ind(sc, BGE_SRAM_FW_CMD_MB, BGE_FW_CMD_PAUSE);
1712 		CSR_WRITE_4(sc, BGE_RX_CPU_EVENT,
1713 		    CSR_READ_4(sc, BGE_RX_CPU_EVENT) | BGE_RX_CPU_DRV_EVENT);
1714 
1715 		for (i = 0; i < 100; i++ ) {
1716 			if (!(CSR_READ_4(sc, BGE_RX_CPU_EVENT) &
1717 			    BGE_RX_CPU_DRV_EVENT))
1718 				break;
1719 			DELAY(10);
1720 		}
1721 	}
1722 }
1723 
1724 static uint32_t
1725 bge_dma_swap_options(struct bge_softc *sc)
1726 {
1727 	uint32_t dma_options;
1728 
1729 	dma_options = BGE_MODECTL_WORDSWAP_NONFRAME |
1730 	    BGE_MODECTL_BYTESWAP_DATA | BGE_MODECTL_WORDSWAP_DATA;
1731 #if BYTE_ORDER == BIG_ENDIAN
1732 	dma_options |= BGE_MODECTL_BYTESWAP_NONFRAME;
1733 #endif
1734 	return (dma_options);
1735 }
1736 
1737 /*
1738  * Do endian, PCI and DMA initialization.
1739  */
1740 static int
1741 bge_chipinit(struct bge_softc *sc)
1742 {
1743 	uint32_t dma_rw_ctl, misc_ctl, mode_ctl;
1744 	uint16_t val;
1745 	int i;
1746 
1747 	/* Set endianness before we access any non-PCI registers. */
1748 	misc_ctl = BGE_INIT;
1749 	if (sc->bge_flags & BGE_FLAG_TAGGED_STATUS)
1750 		misc_ctl |= BGE_PCIMISCCTL_TAGGED_STATUS;
1751 	pci_write_config(sc->bge_dev, BGE_PCI_MISC_CTL, misc_ctl, 4);
1752 
1753 	/*
1754 	 * Clear the MAC statistics block in the NIC's
1755 	 * internal memory.
1756 	 */
1757 	for (i = BGE_STATS_BLOCK;
1758 	    i < BGE_STATS_BLOCK_END + 1; i += sizeof(uint32_t))
1759 		BGE_MEMWIN_WRITE(sc, i, 0);
1760 
1761 	for (i = BGE_STATUS_BLOCK;
1762 	    i < BGE_STATUS_BLOCK_END + 1; i += sizeof(uint32_t))
1763 		BGE_MEMWIN_WRITE(sc, i, 0);
1764 
1765 	if (sc->bge_chiprev == BGE_CHIPREV_5704_BX) {
1766 		/*
1767 		 *  Fix data corruption caused by non-qword write with WB.
1768 		 *  Fix master abort in PCI mode.
1769 		 *  Fix PCI latency timer.
1770 		 */
1771 		val = pci_read_config(sc->bge_dev, BGE_PCI_MSI_DATA + 2, 2);
1772 		val |= (1 << 10) | (1 << 12) | (1 << 13);
1773 		pci_write_config(sc->bge_dev, BGE_PCI_MSI_DATA + 2, val, 2);
1774 	}
1775 
1776 	if (sc->bge_asicrev == BGE_ASICREV_BCM57765 ||
1777 	    sc->bge_asicrev == BGE_ASICREV_BCM57766) {
1778 		/*
1779 		 * For the 57766 and non Ax versions of 57765, bootcode
1780 		 * needs to setup the PCIE Fast Training Sequence (FTS)
1781 		 * value to prevent transmit hangs.
1782 		 */
1783 		if (sc->bge_chiprev != BGE_CHIPREV_57765_AX) {
1784 			CSR_WRITE_4(sc, BGE_CPMU_PADRNG_CTL,
1785 			    CSR_READ_4(sc, BGE_CPMU_PADRNG_CTL) |
1786 			    BGE_CPMU_PADRNG_CTL_RDIV2);
1787 		}
1788 	}
1789 
1790 	/*
1791 	 * Set up the PCI DMA control register.
1792 	 */
1793 	dma_rw_ctl = BGE_PCIDMARWCTL_RD_CMD_SHIFT(6) |
1794 	    BGE_PCIDMARWCTL_WR_CMD_SHIFT(7);
1795 	if (sc->bge_flags & BGE_FLAG_PCIE) {
1796 		if (sc->bge_mps >= 256)
1797 			dma_rw_ctl |= BGE_PCIDMARWCTL_WR_WAT_SHIFT(7);
1798 		else
1799 			dma_rw_ctl |= BGE_PCIDMARWCTL_WR_WAT_SHIFT(3);
1800 	} else if (sc->bge_flags & BGE_FLAG_PCIX) {
1801 		if (BGE_IS_5714_FAMILY(sc)) {
1802 			/* 256 bytes for read and write. */
1803 			dma_rw_ctl |= BGE_PCIDMARWCTL_RD_WAT_SHIFT(2) |
1804 			    BGE_PCIDMARWCTL_WR_WAT_SHIFT(2);
1805 			dma_rw_ctl |= (sc->bge_asicrev == BGE_ASICREV_BCM5780) ?
1806 			    BGE_PCIDMARWCTL_ONEDMA_ATONCE_GLOBAL :
1807 			    BGE_PCIDMARWCTL_ONEDMA_ATONCE_LOCAL;
1808 		} else if (sc->bge_asicrev == BGE_ASICREV_BCM5703) {
1809 			/*
1810 			 * In the BCM5703, the DMA read watermark should
1811 			 * be set to less than or equal to the maximum
1812 			 * memory read byte count of the PCI-X command
1813 			 * register.
1814 			 */
1815 			dma_rw_ctl |= BGE_PCIDMARWCTL_RD_WAT_SHIFT(4) |
1816 			    BGE_PCIDMARWCTL_WR_WAT_SHIFT(3);
1817 		} else if (sc->bge_asicrev == BGE_ASICREV_BCM5704) {
1818 			/* 1536 bytes for read, 384 bytes for write. */
1819 			dma_rw_ctl |= BGE_PCIDMARWCTL_RD_WAT_SHIFT(7) |
1820 			    BGE_PCIDMARWCTL_WR_WAT_SHIFT(3);
1821 		} else {
1822 			/* 384 bytes for read and write. */
1823 			dma_rw_ctl |= BGE_PCIDMARWCTL_RD_WAT_SHIFT(3) |
1824 			    BGE_PCIDMARWCTL_WR_WAT_SHIFT(3) |
1825 			    0x0F;
1826 		}
1827 		if (sc->bge_asicrev == BGE_ASICREV_BCM5703 ||
1828 		    sc->bge_asicrev == BGE_ASICREV_BCM5704) {
1829 			uint32_t tmp;
1830 
1831 			/* Set ONE_DMA_AT_ONCE for hardware workaround. */
1832 			tmp = CSR_READ_4(sc, BGE_PCI_CLKCTL) & 0x1F;
1833 			if (tmp == 6 || tmp == 7)
1834 				dma_rw_ctl |=
1835 				    BGE_PCIDMARWCTL_ONEDMA_ATONCE_GLOBAL;
1836 
1837 			/* Set PCI-X DMA write workaround. */
1838 			dma_rw_ctl |= BGE_PCIDMARWCTL_ASRT_ALL_BE;
1839 		}
1840 	} else {
1841 		/* Conventional PCI bus: 256 bytes for read and write. */
1842 		dma_rw_ctl |= BGE_PCIDMARWCTL_RD_WAT_SHIFT(7) |
1843 		    BGE_PCIDMARWCTL_WR_WAT_SHIFT(7);
1844 
1845 		if (sc->bge_asicrev != BGE_ASICREV_BCM5705 &&
1846 		    sc->bge_asicrev != BGE_ASICREV_BCM5750)
1847 			dma_rw_ctl |= 0x0F;
1848 	}
1849 	if (sc->bge_asicrev == BGE_ASICREV_BCM5700 ||
1850 	    sc->bge_asicrev == BGE_ASICREV_BCM5701)
1851 		dma_rw_ctl |= BGE_PCIDMARWCTL_USE_MRM |
1852 		    BGE_PCIDMARWCTL_ASRT_ALL_BE;
1853 	if (sc->bge_asicrev == BGE_ASICREV_BCM5703 ||
1854 	    sc->bge_asicrev == BGE_ASICREV_BCM5704)
1855 		dma_rw_ctl &= ~BGE_PCIDMARWCTL_MINDMA;
1856 	if (BGE_IS_5717_PLUS(sc)) {
1857 		dma_rw_ctl &= ~BGE_PCIDMARWCTL_DIS_CACHE_ALIGNMENT;
1858 		if (sc->bge_chipid == BGE_CHIPID_BCM57765_A0)
1859 			dma_rw_ctl &= ~BGE_PCIDMARWCTL_CRDRDR_RDMA_MRRS_MSK;
1860 		/*
1861 		 * Enable HW workaround for controllers that misinterpret
1862 		 * a status tag update and leave interrupts permanently
1863 		 * disabled.
1864 		 */
1865 		if (!BGE_IS_57765_PLUS(sc) &&
1866 		    sc->bge_asicrev != BGE_ASICREV_BCM5717 &&
1867 		    sc->bge_asicrev != BGE_ASICREV_BCM5762)
1868 			dma_rw_ctl |= BGE_PCIDMARWCTL_TAGGED_STATUS_WA;
1869 	}
1870 	pci_write_config(sc->bge_dev, BGE_PCI_DMA_RW_CTL, dma_rw_ctl, 4);
1871 
1872 	/*
1873 	 * Set up general mode register.
1874 	 */
1875 	mode_ctl = bge_dma_swap_options(sc);
1876 	if (sc->bge_asicrev == BGE_ASICREV_BCM5720 ||
1877 	    sc->bge_asicrev == BGE_ASICREV_BCM5762) {
1878 		/* Retain Host-2-BMC settings written by APE firmware. */
1879 		mode_ctl |= CSR_READ_4(sc, BGE_MODE_CTL) &
1880 		    (BGE_MODECTL_BYTESWAP_B2HRX_DATA |
1881 		    BGE_MODECTL_WORDSWAP_B2HRX_DATA |
1882 		    BGE_MODECTL_B2HRX_ENABLE | BGE_MODECTL_HTX2B_ENABLE);
1883 	}
1884 	mode_ctl |= BGE_MODECTL_MAC_ATTN_INTR | BGE_MODECTL_HOST_SEND_BDS |
1885 	    BGE_MODECTL_TX_NO_PHDR_CSUM;
1886 
1887 	/*
1888 	 * BCM5701 B5 have a bug causing data corruption when using
1889 	 * 64-bit DMA reads, which can be terminated early and then
1890 	 * completed later as 32-bit accesses, in combination with
1891 	 * certain bridges.
1892 	 */
1893 	if (sc->bge_asicrev == BGE_ASICREV_BCM5701 &&
1894 	    sc->bge_chipid == BGE_CHIPID_BCM5701_B5)
1895 		mode_ctl |= BGE_MODECTL_FORCE_PCI32;
1896 
1897 	/*
1898 	 * Tell the firmware the driver is running
1899 	 */
1900 	if (sc->bge_asf_mode & ASF_STACKUP)
1901 		mode_ctl |= BGE_MODECTL_STACKUP;
1902 
1903 	CSR_WRITE_4(sc, BGE_MODE_CTL, mode_ctl);
1904 
1905 	/*
1906 	 * Disable memory write invalidate.  Apparently it is not supported
1907 	 * properly by these devices.
1908 	 */
1909 	PCI_CLRBIT(sc->bge_dev, BGE_PCI_CMD, PCIM_CMD_MWIEN, 4);
1910 
1911 	/* Set the timer prescaler (always 66 MHz). */
1912 	CSR_WRITE_4(sc, BGE_MISC_CFG, BGE_32BITTIME_66MHZ);
1913 
1914 	/* XXX: The Linux tg3 driver does this at the start of brgphy_reset. */
1915 	if (sc->bge_asicrev == BGE_ASICREV_BCM5906) {
1916 		DELAY(40);	/* XXX */
1917 
1918 		/* Put PHY into ready state */
1919 		BGE_CLRBIT(sc, BGE_MISC_CFG, BGE_MISCCFG_EPHY_IDDQ);
1920 		CSR_READ_4(sc, BGE_MISC_CFG); /* Flush */
1921 		DELAY(40);
1922 	}
1923 
1924 	return (0);
1925 }
1926 
1927 static int
1928 bge_blockinit(struct bge_softc *sc)
1929 {
1930 	struct bge_rcb *rcb;
1931 	bus_size_t vrcb;
1932 	bge_hostaddr taddr;
1933 	uint32_t dmactl, rdmareg, val;
1934 	int i, limit;
1935 
1936 	/*
1937 	 * Initialize the memory window pointer register so that
1938 	 * we can access the first 32K of internal NIC RAM. This will
1939 	 * allow us to set up the TX send ring RCBs and the RX return
1940 	 * ring RCBs, plus other things which live in NIC memory.
1941 	 */
1942 	CSR_WRITE_4(sc, BGE_PCI_MEMWIN_BASEADDR, 0);
1943 
1944 	/* Note: the BCM5704 has a smaller mbuf space than other chips. */
1945 
1946 	if (!(BGE_IS_5705_PLUS(sc))) {
1947 		/* Configure mbuf memory pool */
1948 		CSR_WRITE_4(sc, BGE_BMAN_MBUFPOOL_BASEADDR, BGE_BUFFPOOL_1);
1949 		if (sc->bge_asicrev == BGE_ASICREV_BCM5704)
1950 			CSR_WRITE_4(sc, BGE_BMAN_MBUFPOOL_LEN, 0x10000);
1951 		else
1952 			CSR_WRITE_4(sc, BGE_BMAN_MBUFPOOL_LEN, 0x18000);
1953 
1954 		/* Configure DMA resource pool */
1955 		CSR_WRITE_4(sc, BGE_BMAN_DMA_DESCPOOL_BASEADDR,
1956 		    BGE_DMA_DESCRIPTORS);
1957 		CSR_WRITE_4(sc, BGE_BMAN_DMA_DESCPOOL_LEN, 0x2000);
1958 	}
1959 
1960 	/* Configure mbuf pool watermarks */
1961 	if (BGE_IS_5717_PLUS(sc)) {
1962 		CSR_WRITE_4(sc, BGE_BMAN_MBUFPOOL_READDMA_LOWAT, 0x0);
1963 		if (if_getmtu(sc->bge_ifp) > ETHERMTU) {
1964 			CSR_WRITE_4(sc, BGE_BMAN_MBUFPOOL_MACRX_LOWAT, 0x7e);
1965 			CSR_WRITE_4(sc, BGE_BMAN_MBUFPOOL_HIWAT, 0xea);
1966 		} else {
1967 			CSR_WRITE_4(sc, BGE_BMAN_MBUFPOOL_MACRX_LOWAT, 0x2a);
1968 			CSR_WRITE_4(sc, BGE_BMAN_MBUFPOOL_HIWAT, 0xa0);
1969 		}
1970 	} else if (!BGE_IS_5705_PLUS(sc)) {
1971 		CSR_WRITE_4(sc, BGE_BMAN_MBUFPOOL_READDMA_LOWAT, 0x50);
1972 		CSR_WRITE_4(sc, BGE_BMAN_MBUFPOOL_MACRX_LOWAT, 0x20);
1973 		CSR_WRITE_4(sc, BGE_BMAN_MBUFPOOL_HIWAT, 0x60);
1974 	} else if (sc->bge_asicrev == BGE_ASICREV_BCM5906) {
1975 		CSR_WRITE_4(sc, BGE_BMAN_MBUFPOOL_READDMA_LOWAT, 0x0);
1976 		CSR_WRITE_4(sc, BGE_BMAN_MBUFPOOL_MACRX_LOWAT, 0x04);
1977 		CSR_WRITE_4(sc, BGE_BMAN_MBUFPOOL_HIWAT, 0x10);
1978 	} else {
1979 		CSR_WRITE_4(sc, BGE_BMAN_MBUFPOOL_READDMA_LOWAT, 0x0);
1980 		CSR_WRITE_4(sc, BGE_BMAN_MBUFPOOL_MACRX_LOWAT, 0x10);
1981 		CSR_WRITE_4(sc, BGE_BMAN_MBUFPOOL_HIWAT, 0x60);
1982 	}
1983 
1984 	/* Configure DMA resource watermarks */
1985 	CSR_WRITE_4(sc, BGE_BMAN_DMA_DESCPOOL_LOWAT, 5);
1986 	CSR_WRITE_4(sc, BGE_BMAN_DMA_DESCPOOL_HIWAT, 10);
1987 
1988 	/* Enable buffer manager */
1989 	val = BGE_BMANMODE_ENABLE | BGE_BMANMODE_LOMBUF_ATTN;
1990 	/*
1991 	 * Change the arbitration algorithm of TXMBUF read request to
1992 	 * round-robin instead of priority based for BCM5719.  When
1993 	 * TXFIFO is almost empty, RDMA will hold its request until
1994 	 * TXFIFO is not almost empty.
1995 	 */
1996 	if (sc->bge_asicrev == BGE_ASICREV_BCM5719)
1997 		val |= BGE_BMANMODE_NO_TX_UNDERRUN;
1998 	CSR_WRITE_4(sc, BGE_BMAN_MODE, val);
1999 
2000 	/* Poll for buffer manager start indication */
2001 	for (i = 0; i < BGE_TIMEOUT; i++) {
2002 		DELAY(10);
2003 		if (CSR_READ_4(sc, BGE_BMAN_MODE) & BGE_BMANMODE_ENABLE)
2004 			break;
2005 	}
2006 
2007 	if (i == BGE_TIMEOUT) {
2008 		device_printf(sc->bge_dev, "buffer manager failed to start\n");
2009 		return (ENXIO);
2010 	}
2011 
2012 	/* Enable flow-through queues */
2013 	CSR_WRITE_4(sc, BGE_FTQ_RESET, 0xFFFFFFFF);
2014 	CSR_WRITE_4(sc, BGE_FTQ_RESET, 0);
2015 
2016 	/* Wait until queue initialization is complete */
2017 	for (i = 0; i < BGE_TIMEOUT; i++) {
2018 		DELAY(10);
2019 		if (CSR_READ_4(sc, BGE_FTQ_RESET) == 0)
2020 			break;
2021 	}
2022 
2023 	if (i == BGE_TIMEOUT) {
2024 		device_printf(sc->bge_dev, "flow-through queue init failed\n");
2025 		return (ENXIO);
2026 	}
2027 
2028 	/*
2029 	 * Summary of rings supported by the controller:
2030 	 *
2031 	 * Standard Receive Producer Ring
2032 	 * - This ring is used to feed receive buffers for "standard"
2033 	 *   sized frames (typically 1536 bytes) to the controller.
2034 	 *
2035 	 * Jumbo Receive Producer Ring
2036 	 * - This ring is used to feed receive buffers for jumbo sized
2037 	 *   frames (i.e. anything bigger than the "standard" frames)
2038 	 *   to the controller.
2039 	 *
2040 	 * Mini Receive Producer Ring
2041 	 * - This ring is used to feed receive buffers for "mini"
2042 	 *   sized frames to the controller.
2043 	 * - This feature required external memory for the controller
2044 	 *   but was never used in a production system.  Should always
2045 	 *   be disabled.
2046 	 *
2047 	 * Receive Return Ring
2048 	 * - After the controller has placed an incoming frame into a
2049 	 *   receive buffer that buffer is moved into a receive return
2050 	 *   ring.  The driver is then responsible to passing the
2051 	 *   buffer up to the stack.  Many versions of the controller
2052 	 *   support multiple RR rings.
2053 	 *
2054 	 * Send Ring
2055 	 * - This ring is used for outgoing frames.  Many versions of
2056 	 *   the controller support multiple send rings.
2057 	 */
2058 
2059 	/* Initialize the standard receive producer ring control block. */
2060 	rcb = &sc->bge_ldata.bge_info.bge_std_rx_rcb;
2061 	rcb->bge_hostaddr.bge_addr_lo =
2062 	    BGE_ADDR_LO(sc->bge_ldata.bge_rx_std_ring_paddr);
2063 	rcb->bge_hostaddr.bge_addr_hi =
2064 	    BGE_ADDR_HI(sc->bge_ldata.bge_rx_std_ring_paddr);
2065 	bus_dmamap_sync(sc->bge_cdata.bge_rx_std_ring_tag,
2066 	    sc->bge_cdata.bge_rx_std_ring_map, BUS_DMASYNC_PREREAD);
2067 	if (BGE_IS_5717_PLUS(sc)) {
2068 		/*
2069 		 * Bits 31-16: Programmable ring size (2048, 1024, 512, .., 32)
2070 		 * Bits 15-2 : Maximum RX frame size
2071 		 * Bit 1     : 1 = Ring Disabled, 0 = Ring ENabled
2072 		 * Bit 0     : Reserved
2073 		 */
2074 		rcb->bge_maxlen_flags =
2075 		    BGE_RCB_MAXLEN_FLAGS(512, BGE_MAX_FRAMELEN << 2);
2076 	} else if (BGE_IS_5705_PLUS(sc)) {
2077 		/*
2078 		 * Bits 31-16: Programmable ring size (512, 256, 128, 64, 32)
2079 		 * Bits 15-2 : Reserved (should be 0)
2080 		 * Bit 1     : 1 = Ring Disabled, 0 = Ring Enabled
2081 		 * Bit 0     : Reserved
2082 		 */
2083 		rcb->bge_maxlen_flags = BGE_RCB_MAXLEN_FLAGS(512, 0);
2084 	} else {
2085 		/*
2086 		 * Ring size is always XXX entries
2087 		 * Bits 31-16: Maximum RX frame size
2088 		 * Bits 15-2 : Reserved (should be 0)
2089 		 * Bit 1     : 1 = Ring Disabled, 0 = Ring Enabled
2090 		 * Bit 0     : Reserved
2091 		 */
2092 		rcb->bge_maxlen_flags =
2093 		    BGE_RCB_MAXLEN_FLAGS(BGE_MAX_FRAMELEN, 0);
2094 	}
2095 	if (sc->bge_asicrev == BGE_ASICREV_BCM5717 ||
2096 	    sc->bge_asicrev == BGE_ASICREV_BCM5719 ||
2097 	    sc->bge_asicrev == BGE_ASICREV_BCM5720)
2098 		rcb->bge_nicaddr = BGE_STD_RX_RINGS_5717;
2099 	else
2100 		rcb->bge_nicaddr = BGE_STD_RX_RINGS;
2101 	/* Write the standard receive producer ring control block. */
2102 	CSR_WRITE_4(sc, BGE_RX_STD_RCB_HADDR_HI, rcb->bge_hostaddr.bge_addr_hi);
2103 	CSR_WRITE_4(sc, BGE_RX_STD_RCB_HADDR_LO, rcb->bge_hostaddr.bge_addr_lo);
2104 	CSR_WRITE_4(sc, BGE_RX_STD_RCB_MAXLEN_FLAGS, rcb->bge_maxlen_flags);
2105 	CSR_WRITE_4(sc, BGE_RX_STD_RCB_NICADDR, rcb->bge_nicaddr);
2106 
2107 	/* Reset the standard receive producer ring producer index. */
2108 	bge_writembx(sc, BGE_MBX_RX_STD_PROD_LO, 0);
2109 
2110 	/*
2111 	 * Initialize the jumbo RX producer ring control
2112 	 * block.  We set the 'ring disabled' bit in the
2113 	 * flags field until we're actually ready to start
2114 	 * using this ring (i.e. once we set the MTU
2115 	 * high enough to require it).
2116 	 */
2117 	if (BGE_IS_JUMBO_CAPABLE(sc)) {
2118 		rcb = &sc->bge_ldata.bge_info.bge_jumbo_rx_rcb;
2119 		/* Get the jumbo receive producer ring RCB parameters. */
2120 		rcb->bge_hostaddr.bge_addr_lo =
2121 		    BGE_ADDR_LO(sc->bge_ldata.bge_rx_jumbo_ring_paddr);
2122 		rcb->bge_hostaddr.bge_addr_hi =
2123 		    BGE_ADDR_HI(sc->bge_ldata.bge_rx_jumbo_ring_paddr);
2124 		bus_dmamap_sync(sc->bge_cdata.bge_rx_jumbo_ring_tag,
2125 		    sc->bge_cdata.bge_rx_jumbo_ring_map,
2126 		    BUS_DMASYNC_PREREAD);
2127 		rcb->bge_maxlen_flags = BGE_RCB_MAXLEN_FLAGS(0,
2128 		    BGE_RCB_FLAG_USE_EXT_RX_BD | BGE_RCB_FLAG_RING_DISABLED);
2129 		if (sc->bge_asicrev == BGE_ASICREV_BCM5717 ||
2130 		    sc->bge_asicrev == BGE_ASICREV_BCM5719 ||
2131 		    sc->bge_asicrev == BGE_ASICREV_BCM5720)
2132 			rcb->bge_nicaddr = BGE_JUMBO_RX_RINGS_5717;
2133 		else
2134 			rcb->bge_nicaddr = BGE_JUMBO_RX_RINGS;
2135 		CSR_WRITE_4(sc, BGE_RX_JUMBO_RCB_HADDR_HI,
2136 		    rcb->bge_hostaddr.bge_addr_hi);
2137 		CSR_WRITE_4(sc, BGE_RX_JUMBO_RCB_HADDR_LO,
2138 		    rcb->bge_hostaddr.bge_addr_lo);
2139 		/* Program the jumbo receive producer ring RCB parameters. */
2140 		CSR_WRITE_4(sc, BGE_RX_JUMBO_RCB_MAXLEN_FLAGS,
2141 		    rcb->bge_maxlen_flags);
2142 		CSR_WRITE_4(sc, BGE_RX_JUMBO_RCB_NICADDR, rcb->bge_nicaddr);
2143 		/* Reset the jumbo receive producer ring producer index. */
2144 		bge_writembx(sc, BGE_MBX_RX_JUMBO_PROD_LO, 0);
2145 	}
2146 
2147 	/* Disable the mini receive producer ring RCB. */
2148 	if (BGE_IS_5700_FAMILY(sc)) {
2149 		rcb = &sc->bge_ldata.bge_info.bge_mini_rx_rcb;
2150 		rcb->bge_maxlen_flags =
2151 		    BGE_RCB_MAXLEN_FLAGS(0, BGE_RCB_FLAG_RING_DISABLED);
2152 		CSR_WRITE_4(sc, BGE_RX_MINI_RCB_MAXLEN_FLAGS,
2153 		    rcb->bge_maxlen_flags);
2154 		/* Reset the mini receive producer ring producer index. */
2155 		bge_writembx(sc, BGE_MBX_RX_MINI_PROD_LO, 0);
2156 	}
2157 
2158 	/* Choose de-pipeline mode for BCM5906 A0, A1 and A2. */
2159 	if (sc->bge_asicrev == BGE_ASICREV_BCM5906) {
2160 		if (sc->bge_chipid == BGE_CHIPID_BCM5906_A0 ||
2161 		    sc->bge_chipid == BGE_CHIPID_BCM5906_A1 ||
2162 		    sc->bge_chipid == BGE_CHIPID_BCM5906_A2)
2163 			CSR_WRITE_4(sc, BGE_ISO_PKT_TX,
2164 			    (CSR_READ_4(sc, BGE_ISO_PKT_TX) & ~3) | 2);
2165 	}
2166 	/*
2167 	 * The BD ring replenish thresholds control how often the
2168 	 * hardware fetches new BD's from the producer rings in host
2169 	 * memory.  Setting the value too low on a busy system can
2170 	 * starve the hardware and recue the throughpout.
2171 	 *
2172 	 * Set the BD ring replentish thresholds. The recommended
2173 	 * values are 1/8th the number of descriptors allocated to
2174 	 * each ring.
2175 	 * XXX The 5754 requires a lower threshold, so it might be a
2176 	 * requirement of all 575x family chips.  The Linux driver sets
2177 	 * the lower threshold for all 5705 family chips as well, but there
2178 	 * are reports that it might not need to be so strict.
2179 	 *
2180 	 * XXX Linux does some extra fiddling here for the 5906 parts as
2181 	 * well.
2182 	 */
2183 	if (BGE_IS_5705_PLUS(sc))
2184 		val = 8;
2185 	else
2186 		val = BGE_STD_RX_RING_CNT / 8;
2187 	CSR_WRITE_4(sc, BGE_RBDI_STD_REPL_THRESH, val);
2188 	if (BGE_IS_JUMBO_CAPABLE(sc))
2189 		CSR_WRITE_4(sc, BGE_RBDI_JUMBO_REPL_THRESH,
2190 		    BGE_JUMBO_RX_RING_CNT/8);
2191 	if (BGE_IS_5717_PLUS(sc)) {
2192 		CSR_WRITE_4(sc, BGE_STD_REPLENISH_LWM, 32);
2193 		CSR_WRITE_4(sc, BGE_JMB_REPLENISH_LWM, 16);
2194 	}
2195 
2196 	/*
2197 	 * Disable all send rings by setting the 'ring disabled' bit
2198 	 * in the flags field of all the TX send ring control blocks,
2199 	 * located in NIC memory.
2200 	 */
2201 	if (!BGE_IS_5705_PLUS(sc))
2202 		/* 5700 to 5704 had 16 send rings. */
2203 		limit = BGE_TX_RINGS_EXTSSRAM_MAX;
2204 	else if (BGE_IS_57765_PLUS(sc) ||
2205 	    sc->bge_asicrev == BGE_ASICREV_BCM5762)
2206 		limit = 2;
2207 	else if (BGE_IS_5717_PLUS(sc))
2208 		limit = 4;
2209 	else
2210 		limit = 1;
2211 	vrcb = BGE_MEMWIN_START + BGE_SEND_RING_RCB;
2212 	for (i = 0; i < limit; i++) {
2213 		RCB_WRITE_4(sc, vrcb, bge_maxlen_flags,
2214 		    BGE_RCB_MAXLEN_FLAGS(0, BGE_RCB_FLAG_RING_DISABLED));
2215 		RCB_WRITE_4(sc, vrcb, bge_nicaddr, 0);
2216 		vrcb += sizeof(struct bge_rcb);
2217 	}
2218 
2219 	/* Configure send ring RCB 0 (we use only the first ring) */
2220 	vrcb = BGE_MEMWIN_START + BGE_SEND_RING_RCB;
2221 	BGE_HOSTADDR(taddr, sc->bge_ldata.bge_tx_ring_paddr);
2222 	RCB_WRITE_4(sc, vrcb, bge_hostaddr.bge_addr_hi, taddr.bge_addr_hi);
2223 	RCB_WRITE_4(sc, vrcb, bge_hostaddr.bge_addr_lo, taddr.bge_addr_lo);
2224 	if (sc->bge_asicrev == BGE_ASICREV_BCM5717 ||
2225 	    sc->bge_asicrev == BGE_ASICREV_BCM5719 ||
2226 	    sc->bge_asicrev == BGE_ASICREV_BCM5720)
2227 		RCB_WRITE_4(sc, vrcb, bge_nicaddr, BGE_SEND_RING_5717);
2228 	else
2229 		RCB_WRITE_4(sc, vrcb, bge_nicaddr,
2230 		    BGE_NIC_TXRING_ADDR(0, BGE_TX_RING_CNT));
2231 	RCB_WRITE_4(sc, vrcb, bge_maxlen_flags,
2232 	    BGE_RCB_MAXLEN_FLAGS(BGE_TX_RING_CNT, 0));
2233 
2234 	/*
2235 	 * Disable all receive return rings by setting the
2236 	 * 'ring diabled' bit in the flags field of all the receive
2237 	 * return ring control blocks, located in NIC memory.
2238 	 */
2239 	if (sc->bge_asicrev == BGE_ASICREV_BCM5717 ||
2240 	    sc->bge_asicrev == BGE_ASICREV_BCM5719 ||
2241 	    sc->bge_asicrev == BGE_ASICREV_BCM5720) {
2242 		/* Should be 17, use 16 until we get an SRAM map. */
2243 		limit = 16;
2244 	} else if (!BGE_IS_5705_PLUS(sc))
2245 		limit = BGE_RX_RINGS_MAX;
2246 	else if (sc->bge_asicrev == BGE_ASICREV_BCM5755 ||
2247 	    sc->bge_asicrev == BGE_ASICREV_BCM5762 ||
2248 	    BGE_IS_57765_PLUS(sc))
2249 		limit = 4;
2250 	else
2251 		limit = 1;
2252 	/* Disable all receive return rings. */
2253 	vrcb = BGE_MEMWIN_START + BGE_RX_RETURN_RING_RCB;
2254 	for (i = 0; i < limit; i++) {
2255 		RCB_WRITE_4(sc, vrcb, bge_hostaddr.bge_addr_hi, 0);
2256 		RCB_WRITE_4(sc, vrcb, bge_hostaddr.bge_addr_lo, 0);
2257 		RCB_WRITE_4(sc, vrcb, bge_maxlen_flags,
2258 		    BGE_RCB_FLAG_RING_DISABLED);
2259 		RCB_WRITE_4(sc, vrcb, bge_nicaddr, 0);
2260 		bge_writembx(sc, BGE_MBX_RX_CONS0_LO +
2261 		    (i * (sizeof(uint64_t))), 0);
2262 		vrcb += sizeof(struct bge_rcb);
2263 	}
2264 
2265 	/*
2266 	 * Set up receive return ring 0.  Note that the NIC address
2267 	 * for RX return rings is 0x0.  The return rings live entirely
2268 	 * within the host, so the nicaddr field in the RCB isn't used.
2269 	 */
2270 	vrcb = BGE_MEMWIN_START + BGE_RX_RETURN_RING_RCB;
2271 	BGE_HOSTADDR(taddr, sc->bge_ldata.bge_rx_return_ring_paddr);
2272 	RCB_WRITE_4(sc, vrcb, bge_hostaddr.bge_addr_hi, taddr.bge_addr_hi);
2273 	RCB_WRITE_4(sc, vrcb, bge_hostaddr.bge_addr_lo, taddr.bge_addr_lo);
2274 	RCB_WRITE_4(sc, vrcb, bge_nicaddr, 0);
2275 	RCB_WRITE_4(sc, vrcb, bge_maxlen_flags,
2276 	    BGE_RCB_MAXLEN_FLAGS(sc->bge_return_ring_cnt, 0));
2277 
2278 	/* Set random backoff seed for TX */
2279 	CSR_WRITE_4(sc, BGE_TX_RANDOM_BACKOFF,
2280 	    (IF_LLADDR(sc->bge_ifp)[0] + IF_LLADDR(sc->bge_ifp)[1] +
2281 	    IF_LLADDR(sc->bge_ifp)[2] + IF_LLADDR(sc->bge_ifp)[3] +
2282 	    IF_LLADDR(sc->bge_ifp)[4] + IF_LLADDR(sc->bge_ifp)[5]) &
2283 	    BGE_TX_BACKOFF_SEED_MASK);
2284 
2285 	/* Set inter-packet gap */
2286 	val = 0x2620;
2287 	if (sc->bge_asicrev == BGE_ASICREV_BCM5720 ||
2288 	    sc->bge_asicrev == BGE_ASICREV_BCM5762)
2289 		val |= CSR_READ_4(sc, BGE_TX_LENGTHS) &
2290 		    (BGE_TXLEN_JMB_FRM_LEN_MSK | BGE_TXLEN_CNT_DN_VAL_MSK);
2291 	CSR_WRITE_4(sc, BGE_TX_LENGTHS, val);
2292 
2293 	/*
2294 	 * Specify which ring to use for packets that don't match
2295 	 * any RX rules.
2296 	 */
2297 	CSR_WRITE_4(sc, BGE_RX_RULES_CFG, 0x08);
2298 
2299 	/*
2300 	 * Configure number of RX lists. One interrupt distribution
2301 	 * list, sixteen active lists, one bad frames class.
2302 	 */
2303 	CSR_WRITE_4(sc, BGE_RXLP_CFG, 0x181);
2304 
2305 	/* Inialize RX list placement stats mask. */
2306 	CSR_WRITE_4(sc, BGE_RXLP_STATS_ENABLE_MASK, 0x007FFFFF);
2307 	CSR_WRITE_4(sc, BGE_RXLP_STATS_CTL, 0x1);
2308 
2309 	/* Disable host coalescing until we get it set up */
2310 	CSR_WRITE_4(sc, BGE_HCC_MODE, 0x00000000);
2311 
2312 	/* Poll to make sure it's shut down. */
2313 	for (i = 0; i < BGE_TIMEOUT; i++) {
2314 		DELAY(10);
2315 		if (!(CSR_READ_4(sc, BGE_HCC_MODE) & BGE_HCCMODE_ENABLE))
2316 			break;
2317 	}
2318 
2319 	if (i == BGE_TIMEOUT) {
2320 		device_printf(sc->bge_dev,
2321 		    "host coalescing engine failed to idle\n");
2322 		return (ENXIO);
2323 	}
2324 
2325 	/* Set up host coalescing defaults */
2326 	CSR_WRITE_4(sc, BGE_HCC_RX_COAL_TICKS, sc->bge_rx_coal_ticks);
2327 	CSR_WRITE_4(sc, BGE_HCC_TX_COAL_TICKS, sc->bge_tx_coal_ticks);
2328 	CSR_WRITE_4(sc, BGE_HCC_RX_MAX_COAL_BDS, sc->bge_rx_max_coal_bds);
2329 	CSR_WRITE_4(sc, BGE_HCC_TX_MAX_COAL_BDS, sc->bge_tx_max_coal_bds);
2330 	if (!(BGE_IS_5705_PLUS(sc))) {
2331 		CSR_WRITE_4(sc, BGE_HCC_RX_COAL_TICKS_INT, 0);
2332 		CSR_WRITE_4(sc, BGE_HCC_TX_COAL_TICKS_INT, 0);
2333 	}
2334 	CSR_WRITE_4(sc, BGE_HCC_RX_MAX_COAL_BDS_INT, 1);
2335 	CSR_WRITE_4(sc, BGE_HCC_TX_MAX_COAL_BDS_INT, 1);
2336 
2337 	/* Set up address of statistics block */
2338 	if (!(BGE_IS_5705_PLUS(sc))) {
2339 		CSR_WRITE_4(sc, BGE_HCC_STATS_ADDR_HI,
2340 		    BGE_ADDR_HI(sc->bge_ldata.bge_stats_paddr));
2341 		CSR_WRITE_4(sc, BGE_HCC_STATS_ADDR_LO,
2342 		    BGE_ADDR_LO(sc->bge_ldata.bge_stats_paddr));
2343 		CSR_WRITE_4(sc, BGE_HCC_STATS_BASEADDR, BGE_STATS_BLOCK);
2344 		CSR_WRITE_4(sc, BGE_HCC_STATUSBLK_BASEADDR, BGE_STATUS_BLOCK);
2345 		CSR_WRITE_4(sc, BGE_HCC_STATS_TICKS, sc->bge_stat_ticks);
2346 	}
2347 
2348 	/* Set up address of status block */
2349 	CSR_WRITE_4(sc, BGE_HCC_STATUSBLK_ADDR_HI,
2350 	    BGE_ADDR_HI(sc->bge_ldata.bge_status_block_paddr));
2351 	CSR_WRITE_4(sc, BGE_HCC_STATUSBLK_ADDR_LO,
2352 	    BGE_ADDR_LO(sc->bge_ldata.bge_status_block_paddr));
2353 
2354 	/* Set up status block size. */
2355 	if (sc->bge_asicrev == BGE_ASICREV_BCM5700 &&
2356 	    sc->bge_chipid != BGE_CHIPID_BCM5700_C0) {
2357 		val = BGE_STATBLKSZ_FULL;
2358 		bzero(sc->bge_ldata.bge_status_block, BGE_STATUS_BLK_SZ);
2359 	} else {
2360 		val = BGE_STATBLKSZ_32BYTE;
2361 		bzero(sc->bge_ldata.bge_status_block, 32);
2362 	}
2363 	bus_dmamap_sync(sc->bge_cdata.bge_status_tag,
2364 	    sc->bge_cdata.bge_status_map,
2365 	    BUS_DMASYNC_PREREAD | BUS_DMASYNC_PREWRITE);
2366 
2367 	/* Turn on host coalescing state machine */
2368 	CSR_WRITE_4(sc, BGE_HCC_MODE, val | BGE_HCCMODE_ENABLE);
2369 
2370 	/* Turn on RX BD completion state machine and enable attentions */
2371 	CSR_WRITE_4(sc, BGE_RBDC_MODE,
2372 	    BGE_RBDCMODE_ENABLE | BGE_RBDCMODE_ATTN);
2373 
2374 	/* Turn on RX list placement state machine */
2375 	CSR_WRITE_4(sc, BGE_RXLP_MODE, BGE_RXLPMODE_ENABLE);
2376 
2377 	/* Turn on RX list selector state machine. */
2378 	if (!(BGE_IS_5705_PLUS(sc)))
2379 		CSR_WRITE_4(sc, BGE_RXLS_MODE, BGE_RXLSMODE_ENABLE);
2380 
2381 	/* Turn on DMA, clear stats. */
2382 	val = BGE_MACMODE_TXDMA_ENB | BGE_MACMODE_RXDMA_ENB |
2383 	    BGE_MACMODE_RX_STATS_CLEAR | BGE_MACMODE_TX_STATS_CLEAR |
2384 	    BGE_MACMODE_RX_STATS_ENB | BGE_MACMODE_TX_STATS_ENB |
2385 	    BGE_MACMODE_FRMHDR_DMA_ENB;
2386 
2387 	if (sc->bge_flags & BGE_FLAG_TBI)
2388 		val |= BGE_PORTMODE_TBI;
2389 	else if (sc->bge_flags & BGE_FLAG_MII_SERDES)
2390 		val |= BGE_PORTMODE_GMII;
2391 	else
2392 		val |= BGE_PORTMODE_MII;
2393 
2394 	/* Allow APE to send/receive frames. */
2395 	if ((sc->bge_mfw_flags & BGE_MFW_ON_APE) != 0)
2396 		val |= BGE_MACMODE_APE_RX_EN | BGE_MACMODE_APE_TX_EN;
2397 
2398 	CSR_WRITE_4(sc, BGE_MAC_MODE, val);
2399 	DELAY(40);
2400 
2401 	/* Set misc. local control, enable interrupts on attentions */
2402 	BGE_SETBIT(sc, BGE_MISC_LOCAL_CTL, BGE_MLC_INTR_ONATTN);
2403 
2404 #ifdef notdef
2405 	/* Assert GPIO pins for PHY reset */
2406 	BGE_SETBIT(sc, BGE_MISC_LOCAL_CTL, BGE_MLC_MISCIO_OUT0 |
2407 	    BGE_MLC_MISCIO_OUT1 | BGE_MLC_MISCIO_OUT2);
2408 	BGE_SETBIT(sc, BGE_MISC_LOCAL_CTL, BGE_MLC_MISCIO_OUTEN0 |
2409 	    BGE_MLC_MISCIO_OUTEN1 | BGE_MLC_MISCIO_OUTEN2);
2410 #endif
2411 
2412 	/* Turn on DMA completion state machine */
2413 	if (!(BGE_IS_5705_PLUS(sc)))
2414 		CSR_WRITE_4(sc, BGE_DMAC_MODE, BGE_DMACMODE_ENABLE);
2415 
2416 	val = BGE_WDMAMODE_ENABLE | BGE_WDMAMODE_ALL_ATTNS;
2417 
2418 	/* Enable host coalescing bug fix. */
2419 	if (BGE_IS_5755_PLUS(sc))
2420 		val |= BGE_WDMAMODE_STATUS_TAG_FIX;
2421 
2422 	/* Request larger DMA burst size to get better performance. */
2423 	if (sc->bge_asicrev == BGE_ASICREV_BCM5785)
2424 		val |= BGE_WDMAMODE_BURST_ALL_DATA;
2425 
2426 	/* Turn on write DMA state machine */
2427 	CSR_WRITE_4(sc, BGE_WDMA_MODE, val);
2428 	DELAY(40);
2429 
2430 	/* Turn on read DMA state machine */
2431 	val = BGE_RDMAMODE_ENABLE | BGE_RDMAMODE_ALL_ATTNS;
2432 
2433 	if (sc->bge_asicrev == BGE_ASICREV_BCM5717)
2434 		val |= BGE_RDMAMODE_MULT_DMA_RD_DIS;
2435 
2436 	if (sc->bge_asicrev == BGE_ASICREV_BCM5784 ||
2437 	    sc->bge_asicrev == BGE_ASICREV_BCM5785 ||
2438 	    sc->bge_asicrev == BGE_ASICREV_BCM57780)
2439 		val |= BGE_RDMAMODE_BD_SBD_CRPT_ATTN |
2440 		    BGE_RDMAMODE_MBUF_RBD_CRPT_ATTN |
2441 		    BGE_RDMAMODE_MBUF_SBD_CRPT_ATTN;
2442 	if (sc->bge_flags & BGE_FLAG_PCIE)
2443 		val |= BGE_RDMAMODE_FIFO_LONG_BURST;
2444 	if (sc->bge_flags & (BGE_FLAG_TSO | BGE_FLAG_TSO3)) {
2445 		val |= BGE_RDMAMODE_TSO4_ENABLE;
2446 		if (sc->bge_flags & BGE_FLAG_TSO3 ||
2447 		    sc->bge_asicrev == BGE_ASICREV_BCM5785 ||
2448 		    sc->bge_asicrev == BGE_ASICREV_BCM57780)
2449 			val |= BGE_RDMAMODE_TSO6_ENABLE;
2450 	}
2451 
2452 	if (sc->bge_asicrev == BGE_ASICREV_BCM5720 ||
2453 	    sc->bge_asicrev == BGE_ASICREV_BCM5762) {
2454 		val |= CSR_READ_4(sc, BGE_RDMA_MODE) &
2455 			BGE_RDMAMODE_H2BNC_VLAN_DET;
2456 		/*
2457 		 * Allow multiple outstanding read requests from
2458 		 * non-LSO read DMA engine.
2459 		 */
2460 		val &= ~BGE_RDMAMODE_MULT_DMA_RD_DIS;
2461 	}
2462 
2463 	if (sc->bge_asicrev == BGE_ASICREV_BCM5761 ||
2464 	    sc->bge_asicrev == BGE_ASICREV_BCM5784 ||
2465 	    sc->bge_asicrev == BGE_ASICREV_BCM5785 ||
2466 	    sc->bge_asicrev == BGE_ASICREV_BCM57780 ||
2467 	    BGE_IS_5717_PLUS(sc) || BGE_IS_57765_PLUS(sc)) {
2468 		if (sc->bge_asicrev == BGE_ASICREV_BCM5762)
2469 			rdmareg = BGE_RDMA_RSRVCTRL_REG2;
2470 		else
2471 			rdmareg = BGE_RDMA_RSRVCTRL;
2472 		dmactl = CSR_READ_4(sc, rdmareg);
2473 		/*
2474 		 * Adjust tx margin to prevent TX data corruption and
2475 		 * fix internal FIFO overflow.
2476 		 */
2477 		if (sc->bge_chipid == BGE_CHIPID_BCM5719_A0 ||
2478 		    sc->bge_asicrev == BGE_ASICREV_BCM5762) {
2479 			dmactl &= ~(BGE_RDMA_RSRVCTRL_FIFO_LWM_MASK |
2480 			    BGE_RDMA_RSRVCTRL_FIFO_HWM_MASK |
2481 			    BGE_RDMA_RSRVCTRL_TXMRGN_MASK);
2482 			dmactl |= BGE_RDMA_RSRVCTRL_FIFO_LWM_1_5K |
2483 			    BGE_RDMA_RSRVCTRL_FIFO_HWM_1_5K |
2484 			    BGE_RDMA_RSRVCTRL_TXMRGN_320B;
2485 		}
2486 		/*
2487 		 * Enable fix for read DMA FIFO overruns.
2488 		 * The fix is to limit the number of RX BDs
2489 		 * the hardware would fetch at a fime.
2490 		 */
2491 		CSR_WRITE_4(sc, rdmareg, dmactl |
2492 		    BGE_RDMA_RSRVCTRL_FIFO_OFLW_FIX);
2493 	}
2494 
2495 	if (sc->bge_asicrev == BGE_ASICREV_BCM5719) {
2496 		CSR_WRITE_4(sc, BGE_RDMA_LSO_CRPTEN_CTRL,
2497 		    CSR_READ_4(sc, BGE_RDMA_LSO_CRPTEN_CTRL) |
2498 		    BGE_RDMA_LSO_CRPTEN_CTRL_BLEN_BD_4K |
2499 		    BGE_RDMA_LSO_CRPTEN_CTRL_BLEN_LSO_4K);
2500 	} else if (sc->bge_asicrev == BGE_ASICREV_BCM5720) {
2501 		/*
2502 		 * Allow 4KB burst length reads for non-LSO frames.
2503 		 * Enable 512B burst length reads for buffer descriptors.
2504 		 */
2505 		CSR_WRITE_4(sc, BGE_RDMA_LSO_CRPTEN_CTRL,
2506 		    CSR_READ_4(sc, BGE_RDMA_LSO_CRPTEN_CTRL) |
2507 		    BGE_RDMA_LSO_CRPTEN_CTRL_BLEN_BD_512 |
2508 		    BGE_RDMA_LSO_CRPTEN_CTRL_BLEN_LSO_4K);
2509 	} else if (sc->bge_asicrev == BGE_ASICREV_BCM5762) {
2510 		CSR_WRITE_4(sc, BGE_RDMA_LSO_CRPTEN_CTRL_REG2,
2511 		    CSR_READ_4(sc, BGE_RDMA_LSO_CRPTEN_CTRL_REG2) |
2512 		    BGE_RDMA_LSO_CRPTEN_CTRL_BLEN_BD_4K |
2513 		    BGE_RDMA_LSO_CRPTEN_CTRL_BLEN_LSO_4K);
2514 	}
2515 
2516 	CSR_WRITE_4(sc, BGE_RDMA_MODE, val);
2517 	DELAY(40);
2518 
2519 	if (sc->bge_flags & BGE_FLAG_RDMA_BUG) {
2520 		for (i = 0; i < BGE_NUM_RDMA_CHANNELS / 2; i++) {
2521 			val = CSR_READ_4(sc, BGE_RDMA_LENGTH + i * 4);
2522 			if ((val & 0xFFFF) > BGE_FRAMELEN)
2523 				break;
2524 			if (((val >> 16) & 0xFFFF) > BGE_FRAMELEN)
2525 				break;
2526 		}
2527 		if (i != BGE_NUM_RDMA_CHANNELS / 2) {
2528 			val = CSR_READ_4(sc, BGE_RDMA_LSO_CRPTEN_CTRL);
2529 			if (sc->bge_asicrev == BGE_ASICREV_BCM5719)
2530 				val |= BGE_RDMA_TX_LENGTH_WA_5719;
2531 			else
2532 				val |= BGE_RDMA_TX_LENGTH_WA_5720;
2533 			CSR_WRITE_4(sc, BGE_RDMA_LSO_CRPTEN_CTRL, val);
2534 		}
2535 	}
2536 
2537 	/* Turn on RX data completion state machine */
2538 	CSR_WRITE_4(sc, BGE_RDC_MODE, BGE_RDCMODE_ENABLE);
2539 
2540 	/* Turn on RX BD initiator state machine */
2541 	CSR_WRITE_4(sc, BGE_RBDI_MODE, BGE_RBDIMODE_ENABLE);
2542 
2543 	/* Turn on RX data and RX BD initiator state machine */
2544 	CSR_WRITE_4(sc, BGE_RDBDI_MODE, BGE_RDBDIMODE_ENABLE);
2545 
2546 	/* Turn on Mbuf cluster free state machine */
2547 	if (!(BGE_IS_5705_PLUS(sc)))
2548 		CSR_WRITE_4(sc, BGE_MBCF_MODE, BGE_MBCFMODE_ENABLE);
2549 
2550 	/* Turn on send BD completion state machine */
2551 	CSR_WRITE_4(sc, BGE_SBDC_MODE, BGE_SBDCMODE_ENABLE);
2552 
2553 	/* Turn on send data completion state machine */
2554 	val = BGE_SDCMODE_ENABLE;
2555 	if (sc->bge_asicrev == BGE_ASICREV_BCM5761)
2556 		val |= BGE_SDCMODE_CDELAY;
2557 	CSR_WRITE_4(sc, BGE_SDC_MODE, val);
2558 
2559 	/* Turn on send data initiator state machine */
2560 	if (sc->bge_flags & (BGE_FLAG_TSO | BGE_FLAG_TSO3))
2561 		CSR_WRITE_4(sc, BGE_SDI_MODE, BGE_SDIMODE_ENABLE |
2562 		    BGE_SDIMODE_HW_LSO_PRE_DMA);
2563 	else
2564 		CSR_WRITE_4(sc, BGE_SDI_MODE, BGE_SDIMODE_ENABLE);
2565 
2566 	/* Turn on send BD initiator state machine */
2567 	CSR_WRITE_4(sc, BGE_SBDI_MODE, BGE_SBDIMODE_ENABLE);
2568 
2569 	/* Turn on send BD selector state machine */
2570 	CSR_WRITE_4(sc, BGE_SRS_MODE, BGE_SRSMODE_ENABLE);
2571 
2572 	CSR_WRITE_4(sc, BGE_SDI_STATS_ENABLE_MASK, 0x007FFFFF);
2573 	CSR_WRITE_4(sc, BGE_SDI_STATS_CTL,
2574 	    BGE_SDISTATSCTL_ENABLE | BGE_SDISTATSCTL_FASTER);
2575 
2576 	/* ack/clear link change events */
2577 	CSR_WRITE_4(sc, BGE_MAC_STS, BGE_MACSTAT_SYNC_CHANGED |
2578 	    BGE_MACSTAT_CFG_CHANGED | BGE_MACSTAT_MI_COMPLETE |
2579 	    BGE_MACSTAT_LINK_CHANGED);
2580 	CSR_WRITE_4(sc, BGE_MI_STS, 0);
2581 
2582 	/*
2583 	 * Enable attention when the link has changed state for
2584 	 * devices that use auto polling.
2585 	 */
2586 	if (sc->bge_flags & BGE_FLAG_TBI) {
2587 		CSR_WRITE_4(sc, BGE_MI_STS, BGE_MISTS_LINK);
2588 	} else {
2589 		if (sc->bge_mi_mode & BGE_MIMODE_AUTOPOLL) {
2590 			CSR_WRITE_4(sc, BGE_MI_MODE, sc->bge_mi_mode);
2591 			DELAY(80);
2592 		}
2593 		if (sc->bge_asicrev == BGE_ASICREV_BCM5700 &&
2594 		    sc->bge_chipid != BGE_CHIPID_BCM5700_B2)
2595 			CSR_WRITE_4(sc, BGE_MAC_EVT_ENB,
2596 			    BGE_EVTENB_MI_INTERRUPT);
2597 	}
2598 
2599 	/*
2600 	 * Clear any pending link state attention.
2601 	 * Otherwise some link state change events may be lost until attention
2602 	 * is cleared by bge_intr() -> bge_link_upd() sequence.
2603 	 * It's not necessary on newer BCM chips - perhaps enabling link
2604 	 * state change attentions implies clearing pending attention.
2605 	 */
2606 	CSR_WRITE_4(sc, BGE_MAC_STS, BGE_MACSTAT_SYNC_CHANGED |
2607 	    BGE_MACSTAT_CFG_CHANGED | BGE_MACSTAT_MI_COMPLETE |
2608 	    BGE_MACSTAT_LINK_CHANGED);
2609 
2610 	/* Enable link state change attentions. */
2611 	BGE_SETBIT(sc, BGE_MAC_EVT_ENB, BGE_EVTENB_LINK_CHANGED);
2612 
2613 	return (0);
2614 }
2615 
2616 static const struct bge_revision *
2617 bge_lookup_rev(uint32_t chipid)
2618 {
2619 	const struct bge_revision *br;
2620 
2621 	for (br = bge_revisions; br->br_name != NULL; br++) {
2622 		if (br->br_chipid == chipid)
2623 			return (br);
2624 	}
2625 
2626 	for (br = bge_majorrevs; br->br_name != NULL; br++) {
2627 		if (br->br_chipid == BGE_ASICREV(chipid))
2628 			return (br);
2629 	}
2630 
2631 	return (NULL);
2632 }
2633 
2634 static const struct bge_vendor *
2635 bge_lookup_vendor(uint16_t vid)
2636 {
2637 	const struct bge_vendor *v;
2638 
2639 	for (v = bge_vendors; v->v_name != NULL; v++)
2640 		if (v->v_id == vid)
2641 			return (v);
2642 
2643 	return (NULL);
2644 }
2645 
2646 static uint32_t
2647 bge_chipid(device_t dev)
2648 {
2649 	uint32_t id;
2650 
2651 	id = pci_read_config(dev, BGE_PCI_MISC_CTL, 4) >>
2652 	    BGE_PCIMISCCTL_ASICREV_SHIFT;
2653 	if (BGE_ASICREV(id) == BGE_ASICREV_USE_PRODID_REG) {
2654 		/*
2655 		 * Find the ASCI revision.  Different chips use different
2656 		 * registers.
2657 		 */
2658 		switch (pci_get_device(dev)) {
2659 		case BCOM_DEVICEID_BCM5717C:
2660 			/* 5717 C0 seems to belong to 5720 line. */
2661 			id = BGE_CHIPID_BCM5720_A0;
2662 			break;
2663 		case BCOM_DEVICEID_BCM5717:
2664 		case BCOM_DEVICEID_BCM5718:
2665 		case BCOM_DEVICEID_BCM5719:
2666 		case BCOM_DEVICEID_BCM5720:
2667 		case BCOM_DEVICEID_BCM5725:
2668 		case BCOM_DEVICEID_BCM5727:
2669 		case BCOM_DEVICEID_BCM5762:
2670 		case BCOM_DEVICEID_BCM57764:
2671 		case BCOM_DEVICEID_BCM57767:
2672 		case BCOM_DEVICEID_BCM57787:
2673 			id = pci_read_config(dev,
2674 			    BGE_PCI_GEN2_PRODID_ASICREV, 4);
2675 			break;
2676 		case BCOM_DEVICEID_BCM57761:
2677 		case BCOM_DEVICEID_BCM57762:
2678 		case BCOM_DEVICEID_BCM57765:
2679 		case BCOM_DEVICEID_BCM57766:
2680 		case BCOM_DEVICEID_BCM57781:
2681 		case BCOM_DEVICEID_BCM57782:
2682 		case BCOM_DEVICEID_BCM57785:
2683 		case BCOM_DEVICEID_BCM57786:
2684 		case BCOM_DEVICEID_BCM57791:
2685 		case BCOM_DEVICEID_BCM57795:
2686 			id = pci_read_config(dev,
2687 			    BGE_PCI_GEN15_PRODID_ASICREV, 4);
2688 			break;
2689 		default:
2690 			id = pci_read_config(dev, BGE_PCI_PRODID_ASICREV, 4);
2691 		}
2692 	}
2693 	return (id);
2694 }
2695 
2696 /*
2697  * Probe for a Broadcom chip. Check the PCI vendor and device IDs
2698  * against our list and return its name if we find a match.
2699  *
2700  * Note that since the Broadcom controller contains VPD support, we
2701  * try to get the device name string from the controller itself instead
2702  * of the compiled-in string. It guarantees we'll always announce the
2703  * right product name. We fall back to the compiled-in string when
2704  * VPD is unavailable or corrupt.
2705  */
2706 static int
2707 bge_probe(device_t dev)
2708 {
2709 	char buf[96];
2710 	char model[64];
2711 	const struct bge_revision *br;
2712 	const char *pname;
2713 	struct bge_softc *sc;
2714 	const struct bge_type *t = bge_devs;
2715 	const struct bge_vendor *v;
2716 	uint32_t id;
2717 	uint16_t did, vid;
2718 
2719 	sc = device_get_softc(dev);
2720 	sc->bge_dev = dev;
2721 	vid = pci_get_vendor(dev);
2722 	did = pci_get_device(dev);
2723 	while(t->bge_vid != 0) {
2724 		if ((vid == t->bge_vid) && (did == t->bge_did)) {
2725 			id = bge_chipid(dev);
2726 			br = bge_lookup_rev(id);
2727 			if (bge_has_eaddr(sc) &&
2728 			    pci_get_vpd_ident(dev, &pname) == 0)
2729 				snprintf(model, sizeof(model), "%s", pname);
2730 			else {
2731 				v = bge_lookup_vendor(vid);
2732 				snprintf(model, sizeof(model), "%s %s",
2733 				    v != NULL ? v->v_name : "Unknown",
2734 				    br != NULL ? br->br_name :
2735 				    "NetXtreme/NetLink Ethernet Controller");
2736 			}
2737 			snprintf(buf, sizeof(buf), "%s, %sASIC rev. %#08x",
2738 			    model, br != NULL ? "" : "unknown ", id);
2739 			device_set_desc_copy(dev, buf);
2740 			return (BUS_PROBE_DEFAULT);
2741 		}
2742 		t++;
2743 	}
2744 
2745 	return (ENXIO);
2746 }
2747 
2748 static void
2749 bge_dma_free(struct bge_softc *sc)
2750 {
2751 	int i;
2752 
2753 	/* Destroy DMA maps for RX buffers. */
2754 	for (i = 0; i < BGE_STD_RX_RING_CNT; i++) {
2755 		if (sc->bge_cdata.bge_rx_std_dmamap[i])
2756 			bus_dmamap_destroy(sc->bge_cdata.bge_rx_mtag,
2757 			    sc->bge_cdata.bge_rx_std_dmamap[i]);
2758 	}
2759 	if (sc->bge_cdata.bge_rx_std_sparemap)
2760 		bus_dmamap_destroy(sc->bge_cdata.bge_rx_mtag,
2761 		    sc->bge_cdata.bge_rx_std_sparemap);
2762 
2763 	/* Destroy DMA maps for jumbo RX buffers. */
2764 	for (i = 0; i < BGE_JUMBO_RX_RING_CNT; i++) {
2765 		if (sc->bge_cdata.bge_rx_jumbo_dmamap[i])
2766 			bus_dmamap_destroy(sc->bge_cdata.bge_mtag_jumbo,
2767 			    sc->bge_cdata.bge_rx_jumbo_dmamap[i]);
2768 	}
2769 	if (sc->bge_cdata.bge_rx_jumbo_sparemap)
2770 		bus_dmamap_destroy(sc->bge_cdata.bge_mtag_jumbo,
2771 		    sc->bge_cdata.bge_rx_jumbo_sparemap);
2772 
2773 	/* Destroy DMA maps for TX buffers. */
2774 	for (i = 0; i < BGE_TX_RING_CNT; i++) {
2775 		if (sc->bge_cdata.bge_tx_dmamap[i])
2776 			bus_dmamap_destroy(sc->bge_cdata.bge_tx_mtag,
2777 			    sc->bge_cdata.bge_tx_dmamap[i]);
2778 	}
2779 
2780 	if (sc->bge_cdata.bge_rx_mtag)
2781 		bus_dma_tag_destroy(sc->bge_cdata.bge_rx_mtag);
2782 	if (sc->bge_cdata.bge_mtag_jumbo)
2783 		bus_dma_tag_destroy(sc->bge_cdata.bge_mtag_jumbo);
2784 	if (sc->bge_cdata.bge_tx_mtag)
2785 		bus_dma_tag_destroy(sc->bge_cdata.bge_tx_mtag);
2786 
2787 	/* Destroy standard RX ring. */
2788 	if (sc->bge_ldata.bge_rx_std_ring_paddr)
2789 		bus_dmamap_unload(sc->bge_cdata.bge_rx_std_ring_tag,
2790 		    sc->bge_cdata.bge_rx_std_ring_map);
2791 	if (sc->bge_ldata.bge_rx_std_ring)
2792 		bus_dmamem_free(sc->bge_cdata.bge_rx_std_ring_tag,
2793 		    sc->bge_ldata.bge_rx_std_ring,
2794 		    sc->bge_cdata.bge_rx_std_ring_map);
2795 
2796 	if (sc->bge_cdata.bge_rx_std_ring_tag)
2797 		bus_dma_tag_destroy(sc->bge_cdata.bge_rx_std_ring_tag);
2798 
2799 	/* Destroy jumbo RX ring. */
2800 	if (sc->bge_ldata.bge_rx_jumbo_ring_paddr)
2801 		bus_dmamap_unload(sc->bge_cdata.bge_rx_jumbo_ring_tag,
2802 		    sc->bge_cdata.bge_rx_jumbo_ring_map);
2803 
2804 	if (sc->bge_ldata.bge_rx_jumbo_ring)
2805 		bus_dmamem_free(sc->bge_cdata.bge_rx_jumbo_ring_tag,
2806 		    sc->bge_ldata.bge_rx_jumbo_ring,
2807 		    sc->bge_cdata.bge_rx_jumbo_ring_map);
2808 
2809 	if (sc->bge_cdata.bge_rx_jumbo_ring_tag)
2810 		bus_dma_tag_destroy(sc->bge_cdata.bge_rx_jumbo_ring_tag);
2811 
2812 	/* Destroy RX return ring. */
2813 	if (sc->bge_ldata.bge_rx_return_ring_paddr)
2814 		bus_dmamap_unload(sc->bge_cdata.bge_rx_return_ring_tag,
2815 		    sc->bge_cdata.bge_rx_return_ring_map);
2816 
2817 	if (sc->bge_ldata.bge_rx_return_ring)
2818 		bus_dmamem_free(sc->bge_cdata.bge_rx_return_ring_tag,
2819 		    sc->bge_ldata.bge_rx_return_ring,
2820 		    sc->bge_cdata.bge_rx_return_ring_map);
2821 
2822 	if (sc->bge_cdata.bge_rx_return_ring_tag)
2823 		bus_dma_tag_destroy(sc->bge_cdata.bge_rx_return_ring_tag);
2824 
2825 	/* Destroy TX ring. */
2826 	if (sc->bge_ldata.bge_tx_ring_paddr)
2827 		bus_dmamap_unload(sc->bge_cdata.bge_tx_ring_tag,
2828 		    sc->bge_cdata.bge_tx_ring_map);
2829 
2830 	if (sc->bge_ldata.bge_tx_ring)
2831 		bus_dmamem_free(sc->bge_cdata.bge_tx_ring_tag,
2832 		    sc->bge_ldata.bge_tx_ring,
2833 		    sc->bge_cdata.bge_tx_ring_map);
2834 
2835 	if (sc->bge_cdata.bge_tx_ring_tag)
2836 		bus_dma_tag_destroy(sc->bge_cdata.bge_tx_ring_tag);
2837 
2838 	/* Destroy status block. */
2839 	if (sc->bge_ldata.bge_status_block_paddr)
2840 		bus_dmamap_unload(sc->bge_cdata.bge_status_tag,
2841 		    sc->bge_cdata.bge_status_map);
2842 
2843 	if (sc->bge_ldata.bge_status_block)
2844 		bus_dmamem_free(sc->bge_cdata.bge_status_tag,
2845 		    sc->bge_ldata.bge_status_block,
2846 		    sc->bge_cdata.bge_status_map);
2847 
2848 	if (sc->bge_cdata.bge_status_tag)
2849 		bus_dma_tag_destroy(sc->bge_cdata.bge_status_tag);
2850 
2851 	/* Destroy statistics block. */
2852 	if (sc->bge_ldata.bge_stats_paddr)
2853 		bus_dmamap_unload(sc->bge_cdata.bge_stats_tag,
2854 		    sc->bge_cdata.bge_stats_map);
2855 
2856 	if (sc->bge_ldata.bge_stats)
2857 		bus_dmamem_free(sc->bge_cdata.bge_stats_tag,
2858 		    sc->bge_ldata.bge_stats,
2859 		    sc->bge_cdata.bge_stats_map);
2860 
2861 	if (sc->bge_cdata.bge_stats_tag)
2862 		bus_dma_tag_destroy(sc->bge_cdata.bge_stats_tag);
2863 
2864 	if (sc->bge_cdata.bge_buffer_tag)
2865 		bus_dma_tag_destroy(sc->bge_cdata.bge_buffer_tag);
2866 
2867 	/* Destroy the parent tag. */
2868 	if (sc->bge_cdata.bge_parent_tag)
2869 		bus_dma_tag_destroy(sc->bge_cdata.bge_parent_tag);
2870 }
2871 
2872 static int
2873 bge_dma_ring_alloc(struct bge_softc *sc, bus_size_t alignment,
2874     bus_size_t maxsize, bus_dma_tag_t *tag, uint8_t **ring, bus_dmamap_t *map,
2875     bus_addr_t *paddr, const char *msg)
2876 {
2877 	struct bge_dmamap_arg ctx;
2878 	bus_addr_t lowaddr;
2879 	bus_size_t ring_end;
2880 	int error;
2881 
2882 	lowaddr = BUS_SPACE_MAXADDR;
2883 again:
2884 	error = bus_dma_tag_create(sc->bge_cdata.bge_parent_tag,
2885 	    alignment, 0, lowaddr, BUS_SPACE_MAXADDR, NULL,
2886 	    NULL, maxsize, 1, maxsize, 0, NULL, NULL, tag);
2887 	if (error != 0) {
2888 		device_printf(sc->bge_dev,
2889 		    "could not create %s dma tag\n", msg);
2890 		return (ENOMEM);
2891 	}
2892 	/* Allocate DMA'able memory for ring. */
2893 	error = bus_dmamem_alloc(*tag, (void **)ring,
2894 	    BUS_DMA_NOWAIT | BUS_DMA_ZERO | BUS_DMA_COHERENT, map);
2895 	if (error != 0) {
2896 		device_printf(sc->bge_dev,
2897 		    "could not allocate DMA'able memory for %s\n", msg);
2898 		return (ENOMEM);
2899 	}
2900 	/* Load the address of the ring. */
2901 	ctx.bge_busaddr = 0;
2902 	error = bus_dmamap_load(*tag, *map, *ring, maxsize, bge_dma_map_addr,
2903 	    &ctx, BUS_DMA_NOWAIT);
2904 	if (error != 0) {
2905 		device_printf(sc->bge_dev,
2906 		    "could not load DMA'able memory for %s\n", msg);
2907 		return (ENOMEM);
2908 	}
2909 	*paddr = ctx.bge_busaddr;
2910 	ring_end = *paddr + maxsize;
2911 	if ((sc->bge_flags & BGE_FLAG_4G_BNDRY_BUG) != 0 &&
2912 	    BGE_ADDR_HI(*paddr) != BGE_ADDR_HI(ring_end)) {
2913 		/*
2914 		 * 4GB boundary crossed.  Limit maximum allowable DMA
2915 		 * address space to 32bit and try again.
2916 		 */
2917 		bus_dmamap_unload(*tag, *map);
2918 		bus_dmamem_free(*tag, *ring, *map);
2919 		bus_dma_tag_destroy(*tag);
2920 		if (bootverbose)
2921 			device_printf(sc->bge_dev, "4GB boundary crossed, "
2922 			    "limit DMA address space to 32bit for %s\n", msg);
2923 		*ring = NULL;
2924 		*tag = NULL;
2925 		*map = NULL;
2926 		lowaddr = BUS_SPACE_MAXADDR_32BIT;
2927 		goto again;
2928 	}
2929 	return (0);
2930 }
2931 
2932 static int
2933 bge_dma_alloc(struct bge_softc *sc)
2934 {
2935 	bus_addr_t lowaddr;
2936 	bus_size_t boundary, sbsz, rxmaxsegsz, txsegsz, txmaxsegsz;
2937 	int i, error;
2938 
2939 	lowaddr = BUS_SPACE_MAXADDR;
2940 	if ((sc->bge_flags & BGE_FLAG_40BIT_BUG) != 0)
2941 		lowaddr = BGE_DMA_MAXADDR;
2942 	/*
2943 	 * Allocate the parent bus DMA tag appropriate for PCI.
2944 	 */
2945 	error = bus_dma_tag_create(bus_get_dma_tag(sc->bge_dev),
2946 	    1, 0, lowaddr, BUS_SPACE_MAXADDR, NULL,
2947 	    NULL, BUS_SPACE_MAXSIZE_32BIT, 0, BUS_SPACE_MAXSIZE_32BIT,
2948 	    0, NULL, NULL, &sc->bge_cdata.bge_parent_tag);
2949 	if (error != 0) {
2950 		device_printf(sc->bge_dev,
2951 		    "could not allocate parent dma tag\n");
2952 		return (ENOMEM);
2953 	}
2954 
2955 	/* Create tag for standard RX ring. */
2956 	error = bge_dma_ring_alloc(sc, PAGE_SIZE, BGE_STD_RX_RING_SZ,
2957 	    &sc->bge_cdata.bge_rx_std_ring_tag,
2958 	    (uint8_t **)&sc->bge_ldata.bge_rx_std_ring,
2959 	    &sc->bge_cdata.bge_rx_std_ring_map,
2960 	    &sc->bge_ldata.bge_rx_std_ring_paddr, "RX ring");
2961 	if (error)
2962 		return (error);
2963 
2964 	/* Create tag for RX return ring. */
2965 	error = bge_dma_ring_alloc(sc, PAGE_SIZE, BGE_RX_RTN_RING_SZ(sc),
2966 	    &sc->bge_cdata.bge_rx_return_ring_tag,
2967 	    (uint8_t **)&sc->bge_ldata.bge_rx_return_ring,
2968 	    &sc->bge_cdata.bge_rx_return_ring_map,
2969 	    &sc->bge_ldata.bge_rx_return_ring_paddr, "RX return ring");
2970 	if (error)
2971 		return (error);
2972 
2973 	/* Create tag for TX ring. */
2974 	error = bge_dma_ring_alloc(sc, PAGE_SIZE, BGE_TX_RING_SZ,
2975 	    &sc->bge_cdata.bge_tx_ring_tag,
2976 	    (uint8_t **)&sc->bge_ldata.bge_tx_ring,
2977 	    &sc->bge_cdata.bge_tx_ring_map,
2978 	    &sc->bge_ldata.bge_tx_ring_paddr, "TX ring");
2979 	if (error)
2980 		return (error);
2981 
2982 	/*
2983 	 * Create tag for status block.
2984 	 * Because we only use single Tx/Rx/Rx return ring, use
2985 	 * minimum status block size except BCM5700 AX/BX which
2986 	 * seems to want to see full status block size regardless
2987 	 * of configured number of ring.
2988 	 */
2989 	if (sc->bge_asicrev == BGE_ASICREV_BCM5700 &&
2990 	    sc->bge_chipid != BGE_CHIPID_BCM5700_C0)
2991 		sbsz = BGE_STATUS_BLK_SZ;
2992 	else
2993 		sbsz = 32;
2994 	error = bge_dma_ring_alloc(sc, PAGE_SIZE, sbsz,
2995 	    &sc->bge_cdata.bge_status_tag,
2996 	    (uint8_t **)&sc->bge_ldata.bge_status_block,
2997 	    &sc->bge_cdata.bge_status_map,
2998 	    &sc->bge_ldata.bge_status_block_paddr, "status block");
2999 	if (error)
3000 		return (error);
3001 
3002 	/* Create tag for statistics block. */
3003 	error = bge_dma_ring_alloc(sc, PAGE_SIZE, BGE_STATS_SZ,
3004 	    &sc->bge_cdata.bge_stats_tag,
3005 	    (uint8_t **)&sc->bge_ldata.bge_stats,
3006 	    &sc->bge_cdata.bge_stats_map,
3007 	    &sc->bge_ldata.bge_stats_paddr, "statistics block");
3008 	if (error)
3009 		return (error);
3010 
3011 	/* Create tag for jumbo RX ring. */
3012 	if (BGE_IS_JUMBO_CAPABLE(sc)) {
3013 		error = bge_dma_ring_alloc(sc, PAGE_SIZE, BGE_JUMBO_RX_RING_SZ,
3014 		    &sc->bge_cdata.bge_rx_jumbo_ring_tag,
3015 		    (uint8_t **)&sc->bge_ldata.bge_rx_jumbo_ring,
3016 		    &sc->bge_cdata.bge_rx_jumbo_ring_map,
3017 		    &sc->bge_ldata.bge_rx_jumbo_ring_paddr, "jumbo RX ring");
3018 		if (error)
3019 			return (error);
3020 	}
3021 
3022 	/* Create parent tag for buffers. */
3023 	boundary = 0;
3024 	if ((sc->bge_flags & BGE_FLAG_4G_BNDRY_BUG) != 0) {
3025 		boundary = BGE_DMA_BNDRY;
3026 		/*
3027 		 * XXX
3028 		 * watchdog timeout issue was observed on BCM5704 which
3029 		 * lives behind PCI-X bridge(e.g AMD 8131 PCI-X bridge).
3030 		 * Both limiting DMA address space to 32bits and flushing
3031 		 * mailbox write seem to address the issue.
3032 		 */
3033 		if (sc->bge_pcixcap != 0)
3034 			lowaddr = BUS_SPACE_MAXADDR_32BIT;
3035 	}
3036 	error = bus_dma_tag_create(bus_get_dma_tag(sc->bge_dev),
3037 	    1, boundary, lowaddr, BUS_SPACE_MAXADDR, NULL,
3038 	    NULL, BUS_SPACE_MAXSIZE_32BIT, 0, BUS_SPACE_MAXSIZE_32BIT,
3039 	    0, NULL, NULL, &sc->bge_cdata.bge_buffer_tag);
3040 	if (error != 0) {
3041 		device_printf(sc->bge_dev,
3042 		    "could not allocate buffer dma tag\n");
3043 		return (ENOMEM);
3044 	}
3045 	/* Create tag for Tx mbufs. */
3046 	if (sc->bge_flags & (BGE_FLAG_TSO | BGE_FLAG_TSO3)) {
3047 		txsegsz = BGE_TSOSEG_SZ;
3048 		txmaxsegsz = 65535 + sizeof(struct ether_vlan_header);
3049 	} else {
3050 		txsegsz = MCLBYTES;
3051 		txmaxsegsz = MCLBYTES * BGE_NSEG_NEW;
3052 	}
3053 	error = bus_dma_tag_create(sc->bge_cdata.bge_buffer_tag, 1,
3054 	    0, BUS_SPACE_MAXADDR, BUS_SPACE_MAXADDR, NULL, NULL,
3055 	    txmaxsegsz, BGE_NSEG_NEW, txsegsz, 0, NULL, NULL,
3056 	    &sc->bge_cdata.bge_tx_mtag);
3057 
3058 	if (error) {
3059 		device_printf(sc->bge_dev, "could not allocate TX dma tag\n");
3060 		return (ENOMEM);
3061 	}
3062 
3063 	/* Create tag for Rx mbufs. */
3064 	if (sc->bge_flags & BGE_FLAG_JUMBO_STD)
3065 		rxmaxsegsz = MJUM9BYTES;
3066 	else
3067 		rxmaxsegsz = MCLBYTES;
3068 	error = bus_dma_tag_create(sc->bge_cdata.bge_buffer_tag, 1, 0,
3069 	    BUS_SPACE_MAXADDR, BUS_SPACE_MAXADDR, NULL, NULL, rxmaxsegsz, 1,
3070 	    rxmaxsegsz, 0, NULL, NULL, &sc->bge_cdata.bge_rx_mtag);
3071 
3072 	if (error) {
3073 		device_printf(sc->bge_dev, "could not allocate RX dma tag\n");
3074 		return (ENOMEM);
3075 	}
3076 
3077 	/* Create DMA maps for RX buffers. */
3078 	error = bus_dmamap_create(sc->bge_cdata.bge_rx_mtag, 0,
3079 	    &sc->bge_cdata.bge_rx_std_sparemap);
3080 	if (error) {
3081 		device_printf(sc->bge_dev,
3082 		    "can't create spare DMA map for RX\n");
3083 		return (ENOMEM);
3084 	}
3085 	for (i = 0; i < BGE_STD_RX_RING_CNT; i++) {
3086 		error = bus_dmamap_create(sc->bge_cdata.bge_rx_mtag, 0,
3087 			    &sc->bge_cdata.bge_rx_std_dmamap[i]);
3088 		if (error) {
3089 			device_printf(sc->bge_dev,
3090 			    "can't create DMA map for RX\n");
3091 			return (ENOMEM);
3092 		}
3093 	}
3094 
3095 	/* Create DMA maps for TX buffers. */
3096 	for (i = 0; i < BGE_TX_RING_CNT; i++) {
3097 		error = bus_dmamap_create(sc->bge_cdata.bge_tx_mtag, 0,
3098 			    &sc->bge_cdata.bge_tx_dmamap[i]);
3099 		if (error) {
3100 			device_printf(sc->bge_dev,
3101 			    "can't create DMA map for TX\n");
3102 			return (ENOMEM);
3103 		}
3104 	}
3105 
3106 	/* Create tags for jumbo RX buffers. */
3107 	if (BGE_IS_JUMBO_CAPABLE(sc)) {
3108 		error = bus_dma_tag_create(sc->bge_cdata.bge_buffer_tag,
3109 		    1, 0, BUS_SPACE_MAXADDR, BUS_SPACE_MAXADDR, NULL,
3110 		    NULL, MJUM9BYTES, BGE_NSEG_JUMBO, PAGE_SIZE,
3111 		    0, NULL, NULL, &sc->bge_cdata.bge_mtag_jumbo);
3112 		if (error) {
3113 			device_printf(sc->bge_dev,
3114 			    "could not allocate jumbo dma tag\n");
3115 			return (ENOMEM);
3116 		}
3117 		/* Create DMA maps for jumbo RX buffers. */
3118 		error = bus_dmamap_create(sc->bge_cdata.bge_mtag_jumbo,
3119 		    0, &sc->bge_cdata.bge_rx_jumbo_sparemap);
3120 		if (error) {
3121 			device_printf(sc->bge_dev,
3122 			    "can't create spare DMA map for jumbo RX\n");
3123 			return (ENOMEM);
3124 		}
3125 		for (i = 0; i < BGE_JUMBO_RX_RING_CNT; i++) {
3126 			error = bus_dmamap_create(sc->bge_cdata.bge_mtag_jumbo,
3127 				    0, &sc->bge_cdata.bge_rx_jumbo_dmamap[i]);
3128 			if (error) {
3129 				device_printf(sc->bge_dev,
3130 				    "can't create DMA map for jumbo RX\n");
3131 				return (ENOMEM);
3132 			}
3133 		}
3134 	}
3135 
3136 	return (0);
3137 }
3138 
3139 /*
3140  * Return true if this device has more than one port.
3141  */
3142 static int
3143 bge_has_multiple_ports(struct bge_softc *sc)
3144 {
3145 	device_t dev = sc->bge_dev;
3146 	u_int b, d, f, fscan, s;
3147 
3148 	d = pci_get_domain(dev);
3149 	b = pci_get_bus(dev);
3150 	s = pci_get_slot(dev);
3151 	f = pci_get_function(dev);
3152 	for (fscan = 0; fscan <= PCI_FUNCMAX; fscan++)
3153 		if (fscan != f && pci_find_dbsf(d, b, s, fscan) != NULL)
3154 			return (1);
3155 	return (0);
3156 }
3157 
3158 /*
3159  * Return true if MSI can be used with this device.
3160  */
3161 static int
3162 bge_can_use_msi(struct bge_softc *sc)
3163 {
3164 	int can_use_msi = 0;
3165 
3166 	if (sc->bge_msi == 0)
3167 		return (0);
3168 
3169 	/* Disable MSI for polling(4). */
3170 #ifdef DEVICE_POLLING
3171 	return (0);
3172 #endif
3173 	switch (sc->bge_asicrev) {
3174 	case BGE_ASICREV_BCM5714_A0:
3175 	case BGE_ASICREV_BCM5714:
3176 		/*
3177 		 * Apparently, MSI doesn't work when these chips are
3178 		 * configured in single-port mode.
3179 		 */
3180 		if (bge_has_multiple_ports(sc))
3181 			can_use_msi = 1;
3182 		break;
3183 	case BGE_ASICREV_BCM5750:
3184 		if (sc->bge_chiprev != BGE_CHIPREV_5750_AX &&
3185 		    sc->bge_chiprev != BGE_CHIPREV_5750_BX)
3186 			can_use_msi = 1;
3187 		break;
3188 	case BGE_ASICREV_BCM5784:
3189 		/*
3190 		 * Prevent infinite "watchdog timeout" errors
3191 		 * in some MacBook Pro and make it work out-of-the-box.
3192 		 */
3193 		if (sc->bge_chiprev == BGE_CHIPREV_5784_AX)
3194 			break;
3195 		/* FALLTHROUGH */
3196 	default:
3197 		if (BGE_IS_575X_PLUS(sc))
3198 			can_use_msi = 1;
3199 	}
3200 	return (can_use_msi);
3201 }
3202 
3203 static int
3204 bge_mbox_reorder(struct bge_softc *sc)
3205 {
3206 	/* Lists of PCI bridges that are known to reorder mailbox writes. */
3207 	static const struct mbox_reorder {
3208 		const uint16_t vendor;
3209 		const uint16_t device;
3210 		const char *desc;
3211 	} mbox_reorder_lists[] = {
3212 		{ 0x1022, 0x7450, "AMD-8131 PCI-X Bridge" },
3213 	};
3214 	devclass_t pci, pcib;
3215 	device_t bus, dev;
3216 	int i;
3217 
3218 	pci = devclass_find("pci");
3219 	pcib = devclass_find("pcib");
3220 	dev = sc->bge_dev;
3221 	bus = device_get_parent(dev);
3222 	for (;;) {
3223 		dev = device_get_parent(bus);
3224 		bus = device_get_parent(dev);
3225 		if (device_get_devclass(dev) != pcib)
3226 			break;
3227 		if (device_get_devclass(bus) != pci)
3228 			break;
3229 		for (i = 0; i < nitems(mbox_reorder_lists); i++) {
3230 			if (pci_get_vendor(dev) ==
3231 			    mbox_reorder_lists[i].vendor &&
3232 			    pci_get_device(dev) ==
3233 			    mbox_reorder_lists[i].device) {
3234 				device_printf(sc->bge_dev,
3235 				    "enabling MBOX workaround for %s\n",
3236 				    mbox_reorder_lists[i].desc);
3237 				return (1);
3238 			}
3239 		}
3240 	}
3241 	return (0);
3242 }
3243 
3244 static void
3245 bge_devinfo(struct bge_softc *sc)
3246 {
3247 	uint32_t cfg, clk;
3248 
3249 	device_printf(sc->bge_dev,
3250 	    "CHIP ID 0x%08x; ASIC REV 0x%02x; CHIP REV 0x%02x; ",
3251 	    sc->bge_chipid, sc->bge_asicrev, sc->bge_chiprev);
3252 	if (sc->bge_flags & BGE_FLAG_PCIE)
3253 		printf("PCI-E\n");
3254 	else if (sc->bge_flags & BGE_FLAG_PCIX) {
3255 		printf("PCI-X ");
3256 		cfg = CSR_READ_4(sc, BGE_MISC_CFG) & BGE_MISCCFG_BOARD_ID_MASK;
3257 		if (cfg == BGE_MISCCFG_BOARD_ID_5704CIOBE)
3258 			clk = 133;
3259 		else {
3260 			clk = CSR_READ_4(sc, BGE_PCI_CLKCTL) & 0x1F;
3261 			switch (clk) {
3262 			case 0:
3263 				clk = 33;
3264 				break;
3265 			case 2:
3266 				clk = 50;
3267 				break;
3268 			case 4:
3269 				clk = 66;
3270 				break;
3271 			case 6:
3272 				clk = 100;
3273 				break;
3274 			case 7:
3275 				clk = 133;
3276 				break;
3277 			}
3278 		}
3279 		printf("%u MHz\n", clk);
3280 	} else {
3281 		if (sc->bge_pcixcap != 0)
3282 			printf("PCI on PCI-X ");
3283 		else
3284 			printf("PCI ");
3285 		cfg = pci_read_config(sc->bge_dev, BGE_PCI_PCISTATE, 4);
3286 		if (cfg & BGE_PCISTATE_PCI_BUSSPEED)
3287 			clk = 66;
3288 		else
3289 			clk = 33;
3290 		if (cfg & BGE_PCISTATE_32BIT_BUS)
3291 			printf("%u MHz; 32bit\n", clk);
3292 		else
3293 			printf("%u MHz; 64bit\n", clk);
3294 	}
3295 }
3296 
3297 static int
3298 bge_attach(device_t dev)
3299 {
3300 	if_t ifp;
3301 	struct bge_softc *sc;
3302 	uint32_t hwcfg = 0, misccfg, pcistate;
3303 	u_char eaddr[ETHER_ADDR_LEN];
3304 	int capmask, error, reg, rid, trys;
3305 
3306 	sc = device_get_softc(dev);
3307 	sc->bge_dev = dev;
3308 
3309 	BGE_LOCK_INIT(sc, device_get_nameunit(dev));
3310 	NET_TASK_INIT(&sc->bge_intr_task, 0, bge_intr_task, sc);
3311 	callout_init_mtx(&sc->bge_stat_ch, &sc->bge_mtx, 0);
3312 
3313 	pci_enable_busmaster(dev);
3314 
3315 	/*
3316 	 * Allocate control/status registers.
3317 	 */
3318 	rid = PCIR_BAR(0);
3319 	sc->bge_res = bus_alloc_resource_any(dev, SYS_RES_MEMORY, &rid,
3320 	    RF_ACTIVE);
3321 
3322 	if (sc->bge_res == NULL) {
3323 		device_printf (sc->bge_dev, "couldn't map BAR0 memory\n");
3324 		error = ENXIO;
3325 		goto fail;
3326 	}
3327 
3328 	/* Save various chip information. */
3329 	sc->bge_func_addr = pci_get_function(dev);
3330 	sc->bge_chipid = bge_chipid(dev);
3331 	sc->bge_asicrev = BGE_ASICREV(sc->bge_chipid);
3332 	sc->bge_chiprev = BGE_CHIPREV(sc->bge_chipid);
3333 
3334 	/* Set default PHY address. */
3335 	sc->bge_phy_addr = 1;
3336 	 /*
3337 	  * PHY address mapping for various devices.
3338 	  *
3339 	  *          | F0 Cu | F0 Sr | F1 Cu | F1 Sr |
3340 	  * ---------+-------+-------+-------+-------+
3341 	  * BCM57XX  |   1   |   X   |   X   |   X   |
3342 	  * BCM5704  |   1   |   X   |   1   |   X   |
3343 	  * BCM5717  |   1   |   8   |   2   |   9   |
3344 	  * BCM5719  |   1   |   8   |   2   |   9   |
3345 	  * BCM5720  |   1   |   8   |   2   |   9   |
3346 	  *
3347 	  *          | F2 Cu | F2 Sr | F3 Cu | F3 Sr |
3348 	  * ---------+-------+-------+-------+-------+
3349 	  * BCM57XX  |   X   |   X   |   X   |   X   |
3350 	  * BCM5704  |   X   |   X   |   X   |   X   |
3351 	  * BCM5717  |   X   |   X   |   X   |   X   |
3352 	  * BCM5719  |   3   |   10  |   4   |   11  |
3353 	  * BCM5720  |   X   |   X   |   X   |   X   |
3354 	  *
3355 	  * Other addresses may respond but they are not
3356 	  * IEEE compliant PHYs and should be ignored.
3357 	  */
3358 	if (sc->bge_asicrev == BGE_ASICREV_BCM5717 ||
3359 	    sc->bge_asicrev == BGE_ASICREV_BCM5719 ||
3360 	    sc->bge_asicrev == BGE_ASICREV_BCM5720) {
3361 		if (sc->bge_chipid != BGE_CHIPID_BCM5717_A0) {
3362 			if (CSR_READ_4(sc, BGE_SGDIG_STS) &
3363 			    BGE_SGDIGSTS_IS_SERDES)
3364 				sc->bge_phy_addr = sc->bge_func_addr + 8;
3365 			else
3366 				sc->bge_phy_addr = sc->bge_func_addr + 1;
3367 		} else {
3368 			if (CSR_READ_4(sc, BGE_CPMU_PHY_STRAP) &
3369 			    BGE_CPMU_PHY_STRAP_IS_SERDES)
3370 				sc->bge_phy_addr = sc->bge_func_addr + 8;
3371 			else
3372 				sc->bge_phy_addr = sc->bge_func_addr + 1;
3373 		}
3374 	}
3375 
3376 	if (bge_has_eaddr(sc))
3377 		sc->bge_flags |= BGE_FLAG_EADDR;
3378 
3379 	/* Save chipset family. */
3380 	switch (sc->bge_asicrev) {
3381 	case BGE_ASICREV_BCM5762:
3382 	case BGE_ASICREV_BCM57765:
3383 	case BGE_ASICREV_BCM57766:
3384 		sc->bge_flags |= BGE_FLAG_57765_PLUS;
3385 		/* FALLTHROUGH */
3386 	case BGE_ASICREV_BCM5717:
3387 	case BGE_ASICREV_BCM5719:
3388 	case BGE_ASICREV_BCM5720:
3389 		sc->bge_flags |= BGE_FLAG_5717_PLUS | BGE_FLAG_5755_PLUS |
3390 		    BGE_FLAG_575X_PLUS | BGE_FLAG_5705_PLUS | BGE_FLAG_JUMBO |
3391 		    BGE_FLAG_JUMBO_FRAME;
3392 		if (sc->bge_asicrev == BGE_ASICREV_BCM5719 ||
3393 		    sc->bge_asicrev == BGE_ASICREV_BCM5720) {
3394 			/*
3395 			 * Enable work around for DMA engine miscalculation
3396 			 * of TXMBUF available space.
3397 			 */
3398 			sc->bge_flags |= BGE_FLAG_RDMA_BUG;
3399 			if (sc->bge_asicrev == BGE_ASICREV_BCM5719 &&
3400 			    sc->bge_chipid == BGE_CHIPID_BCM5719_A0) {
3401 				/* Jumbo frame on BCM5719 A0 does not work. */
3402 				sc->bge_flags &= ~BGE_FLAG_JUMBO;
3403 			}
3404 		}
3405 		break;
3406 	case BGE_ASICREV_BCM5755:
3407 	case BGE_ASICREV_BCM5761:
3408 	case BGE_ASICREV_BCM5784:
3409 	case BGE_ASICREV_BCM5785:
3410 	case BGE_ASICREV_BCM5787:
3411 	case BGE_ASICREV_BCM57780:
3412 		sc->bge_flags |= BGE_FLAG_5755_PLUS | BGE_FLAG_575X_PLUS |
3413 		    BGE_FLAG_5705_PLUS;
3414 		break;
3415 	case BGE_ASICREV_BCM5700:
3416 	case BGE_ASICREV_BCM5701:
3417 	case BGE_ASICREV_BCM5703:
3418 	case BGE_ASICREV_BCM5704:
3419 		sc->bge_flags |= BGE_FLAG_5700_FAMILY | BGE_FLAG_JUMBO;
3420 		break;
3421 	case BGE_ASICREV_BCM5714_A0:
3422 	case BGE_ASICREV_BCM5780:
3423 	case BGE_ASICREV_BCM5714:
3424 		sc->bge_flags |= BGE_FLAG_5714_FAMILY | BGE_FLAG_JUMBO_STD;
3425 		/* FALLTHROUGH */
3426 	case BGE_ASICREV_BCM5750:
3427 	case BGE_ASICREV_BCM5752:
3428 	case BGE_ASICREV_BCM5906:
3429 		sc->bge_flags |= BGE_FLAG_575X_PLUS;
3430 		/* FALLTHROUGH */
3431 	case BGE_ASICREV_BCM5705:
3432 		sc->bge_flags |= BGE_FLAG_5705_PLUS;
3433 		break;
3434 	}
3435 
3436 	/* Identify chips with APE processor. */
3437 	switch (sc->bge_asicrev) {
3438 	case BGE_ASICREV_BCM5717:
3439 	case BGE_ASICREV_BCM5719:
3440 	case BGE_ASICREV_BCM5720:
3441 	case BGE_ASICREV_BCM5761:
3442 	case BGE_ASICREV_BCM5762:
3443 		sc->bge_flags |= BGE_FLAG_APE;
3444 		break;
3445 	}
3446 
3447 	/* Chips with APE need BAR2 access for APE registers/memory. */
3448 	if ((sc->bge_flags & BGE_FLAG_APE) != 0) {
3449 		rid = PCIR_BAR(2);
3450 		sc->bge_res2 = bus_alloc_resource_any(dev, SYS_RES_MEMORY, &rid,
3451 		    RF_ACTIVE);
3452 		if (sc->bge_res2 == NULL) {
3453 			device_printf (sc->bge_dev,
3454 			    "couldn't map BAR2 memory\n");
3455 			error = ENXIO;
3456 			goto fail;
3457 		}
3458 
3459 		/* Enable APE register/memory access by host driver. */
3460 		pcistate = pci_read_config(dev, BGE_PCI_PCISTATE, 4);
3461 		pcistate |= BGE_PCISTATE_ALLOW_APE_CTLSPC_WR |
3462 		    BGE_PCISTATE_ALLOW_APE_SHMEM_WR |
3463 		    BGE_PCISTATE_ALLOW_APE_PSPACE_WR;
3464 		pci_write_config(dev, BGE_PCI_PCISTATE, pcistate, 4);
3465 
3466 		bge_ape_lock_init(sc);
3467 		bge_ape_read_fw_ver(sc);
3468 	}
3469 
3470 	/* Add SYSCTLs, requires the chipset family to be set. */
3471 	bge_add_sysctls(sc);
3472 
3473 	/* Identify the chips that use an CPMU. */
3474 	if (BGE_IS_5717_PLUS(sc) ||
3475 	    sc->bge_asicrev == BGE_ASICREV_BCM5784 ||
3476 	    sc->bge_asicrev == BGE_ASICREV_BCM5761 ||
3477 	    sc->bge_asicrev == BGE_ASICREV_BCM5785 ||
3478 	    sc->bge_asicrev == BGE_ASICREV_BCM57780)
3479 		sc->bge_flags |= BGE_FLAG_CPMU_PRESENT;
3480 	if ((sc->bge_flags & BGE_FLAG_CPMU_PRESENT) != 0)
3481 		sc->bge_mi_mode = BGE_MIMODE_500KHZ_CONST;
3482 	else
3483 		sc->bge_mi_mode = BGE_MIMODE_BASE;
3484 	/* Enable auto polling for BCM570[0-5]. */
3485 	if (BGE_IS_5700_FAMILY(sc) || sc->bge_asicrev == BGE_ASICREV_BCM5705)
3486 		sc->bge_mi_mode |= BGE_MIMODE_AUTOPOLL;
3487 
3488 	/*
3489 	 * All Broadcom controllers have 4GB boundary DMA bug.
3490 	 * Whenever an address crosses a multiple of the 4GB boundary
3491 	 * (including 4GB, 8Gb, 12Gb, etc.) and makes the transition
3492 	 * from 0xX_FFFF_FFFF to 0x(X+1)_0000_0000 an internal DMA
3493 	 * state machine will lockup and cause the device to hang.
3494 	 */
3495 	sc->bge_flags |= BGE_FLAG_4G_BNDRY_BUG;
3496 
3497 	/* BCM5755 or higher and BCM5906 have short DMA bug. */
3498 	if (BGE_IS_5755_PLUS(sc) || sc->bge_asicrev == BGE_ASICREV_BCM5906)
3499 		sc->bge_flags |= BGE_FLAG_SHORT_DMA_BUG;
3500 
3501 	/*
3502 	 * BCM5719 cannot handle DMA requests for DMA segments that
3503 	 * have larger than 4KB in size.  However the maximum DMA
3504 	 * segment size created in DMA tag is 4KB for TSO, so we
3505 	 * wouldn't encounter the issue here.
3506 	 */
3507 	if (sc->bge_asicrev == BGE_ASICREV_BCM5719)
3508 		sc->bge_flags |= BGE_FLAG_4K_RDMA_BUG;
3509 
3510 	misccfg = CSR_READ_4(sc, BGE_MISC_CFG) & BGE_MISCCFG_BOARD_ID_MASK;
3511 	if (sc->bge_asicrev == BGE_ASICREV_BCM5705) {
3512 		if (misccfg == BGE_MISCCFG_BOARD_ID_5788 ||
3513 		    misccfg == BGE_MISCCFG_BOARD_ID_5788M)
3514 			sc->bge_flags |= BGE_FLAG_5788;
3515 	}
3516 
3517 	capmask = BMSR_DEFCAPMASK;
3518 	if ((sc->bge_asicrev == BGE_ASICREV_BCM5703 &&
3519 	    (misccfg == 0x4000 || misccfg == 0x8000)) ||
3520 	    (sc->bge_asicrev == BGE_ASICREV_BCM5705 &&
3521 	    pci_get_vendor(dev) == BCOM_VENDORID &&
3522 	    (pci_get_device(dev) == BCOM_DEVICEID_BCM5901 ||
3523 	    pci_get_device(dev) == BCOM_DEVICEID_BCM5901A2 ||
3524 	    pci_get_device(dev) == BCOM_DEVICEID_BCM5705F)) ||
3525 	    (pci_get_vendor(dev) == BCOM_VENDORID &&
3526 	    (pci_get_device(dev) == BCOM_DEVICEID_BCM5751F ||
3527 	    pci_get_device(dev) == BCOM_DEVICEID_BCM5753F ||
3528 	    pci_get_device(dev) == BCOM_DEVICEID_BCM5787F)) ||
3529 	    pci_get_device(dev) == BCOM_DEVICEID_BCM57790 ||
3530 	    pci_get_device(dev) == BCOM_DEVICEID_BCM57791 ||
3531 	    pci_get_device(dev) == BCOM_DEVICEID_BCM57795 ||
3532 	    sc->bge_asicrev == BGE_ASICREV_BCM5906) {
3533 		/* These chips are 10/100 only. */
3534 		capmask &= ~BMSR_EXTSTAT;
3535 		sc->bge_phy_flags |= BGE_PHY_NO_WIRESPEED;
3536 	}
3537 
3538 	/*
3539 	 * Some controllers seem to require a special firmware to use
3540 	 * TSO. But the firmware is not available to FreeBSD and Linux
3541 	 * claims that the TSO performed by the firmware is slower than
3542 	 * hardware based TSO. Moreover the firmware based TSO has one
3543 	 * known bug which can't handle TSO if Ethernet header + IP/TCP
3544 	 * header is greater than 80 bytes. A workaround for the TSO
3545 	 * bug exist but it seems it's too expensive than not using
3546 	 * TSO at all. Some hardwares also have the TSO bug so limit
3547 	 * the TSO to the controllers that are not affected TSO issues
3548 	 * (e.g. 5755 or higher).
3549 	 */
3550 	if (BGE_IS_5717_PLUS(sc)) {
3551 		/* BCM5717 requires different TSO configuration. */
3552 		sc->bge_flags |= BGE_FLAG_TSO3;
3553 		if (sc->bge_asicrev == BGE_ASICREV_BCM5719 &&
3554 		    sc->bge_chipid == BGE_CHIPID_BCM5719_A0) {
3555 			/* TSO on BCM5719 A0 does not work. */
3556 			sc->bge_flags &= ~BGE_FLAG_TSO3;
3557 		}
3558 	} else if (BGE_IS_5755_PLUS(sc)) {
3559 		/*
3560 		 * BCM5754 and BCM5787 shares the same ASIC id so
3561 		 * explicit device id check is required.
3562 		 * Due to unknown reason TSO does not work on BCM5755M.
3563 		 */
3564 		if (pci_get_device(dev) != BCOM_DEVICEID_BCM5754 &&
3565 		    pci_get_device(dev) != BCOM_DEVICEID_BCM5754M &&
3566 		    pci_get_device(dev) != BCOM_DEVICEID_BCM5755M)
3567 			sc->bge_flags |= BGE_FLAG_TSO;
3568 	}
3569 
3570 	/*
3571 	 * Check if this is a PCI-X or PCI Express device.
3572 	 */
3573 	if (pci_find_cap(dev, PCIY_EXPRESS, &reg) == 0) {
3574 		/*
3575 		 * Found a PCI Express capabilities register, this
3576 		 * must be a PCI Express device.
3577 		 */
3578 		sc->bge_flags |= BGE_FLAG_PCIE;
3579 		sc->bge_expcap = reg;
3580 		/* Extract supported maximum payload size. */
3581 		sc->bge_mps = pci_read_config(dev, sc->bge_expcap +
3582 		    PCIER_DEVICE_CAP, 2);
3583 		sc->bge_mps = 128 << (sc->bge_mps & PCIEM_CAP_MAX_PAYLOAD);
3584 		if (sc->bge_asicrev == BGE_ASICREV_BCM5719 ||
3585 		    sc->bge_asicrev == BGE_ASICREV_BCM5720)
3586 			sc->bge_expmrq = 2048;
3587 		else
3588 			sc->bge_expmrq = 4096;
3589 		pci_set_max_read_req(dev, sc->bge_expmrq);
3590 	} else {
3591 		/*
3592 		 * Check if the device is in PCI-X Mode.
3593 		 * (This bit is not valid on PCI Express controllers.)
3594 		 */
3595 		if (pci_find_cap(dev, PCIY_PCIX, &reg) == 0)
3596 			sc->bge_pcixcap = reg;
3597 		if ((pci_read_config(dev, BGE_PCI_PCISTATE, 4) &
3598 		    BGE_PCISTATE_PCI_BUSMODE) == 0)
3599 			sc->bge_flags |= BGE_FLAG_PCIX;
3600 	}
3601 
3602 	/*
3603 	 * The 40bit DMA bug applies to the 5714/5715 controllers and is
3604 	 * not actually a MAC controller bug but an issue with the embedded
3605 	 * PCIe to PCI-X bridge in the device. Use 40bit DMA workaround.
3606 	 */
3607 	if (BGE_IS_5714_FAMILY(sc) && (sc->bge_flags & BGE_FLAG_PCIX))
3608 		sc->bge_flags |= BGE_FLAG_40BIT_BUG;
3609 	/*
3610 	 * Some PCI-X bridges are known to trigger write reordering to
3611 	 * the mailbox registers. Typical phenomena is watchdog timeouts
3612 	 * caused by out-of-order TX completions.  Enable workaround for
3613 	 * PCI-X devices that live behind these bridges.
3614 	 * Note, PCI-X controllers can run in PCI mode so we can't use
3615 	 * BGE_FLAG_PCIX flag to detect PCI-X controllers.
3616 	 */
3617 	if (sc->bge_pcixcap != 0 && bge_mbox_reorder(sc) != 0)
3618 		sc->bge_flags |= BGE_FLAG_MBOX_REORDER;
3619 	/*
3620 	 * Allocate the interrupt, using MSI if possible.  These devices
3621 	 * support 8 MSI messages, but only the first one is used in
3622 	 * normal operation.
3623 	 */
3624 	rid = 0;
3625 	if (pci_find_cap(sc->bge_dev, PCIY_MSI, &reg) == 0) {
3626 		sc->bge_msicap = reg;
3627 		reg = 1;
3628 		if (bge_can_use_msi(sc) && pci_alloc_msi(dev, &reg) == 0) {
3629 			rid = 1;
3630 			sc->bge_flags |= BGE_FLAG_MSI;
3631 		}
3632 	}
3633 
3634 	/*
3635 	 * All controllers except BCM5700 supports tagged status but
3636 	 * we use tagged status only for MSI case on BCM5717. Otherwise
3637 	 * MSI on BCM5717 does not work.
3638 	 */
3639 #ifndef DEVICE_POLLING
3640 	if (sc->bge_flags & BGE_FLAG_MSI && BGE_IS_5717_PLUS(sc))
3641 		sc->bge_flags |= BGE_FLAG_TAGGED_STATUS;
3642 #endif
3643 
3644 	sc->bge_irq = bus_alloc_resource_any(dev, SYS_RES_IRQ, &rid,
3645 	    RF_ACTIVE | (rid != 0 ? 0 : RF_SHAREABLE));
3646 
3647 	if (sc->bge_irq == NULL) {
3648 		device_printf(sc->bge_dev, "couldn't map interrupt\n");
3649 		error = ENXIO;
3650 		goto fail;
3651 	}
3652 
3653 	bge_devinfo(sc);
3654 
3655 	sc->bge_asf_mode = 0;
3656 	/* No ASF if APE present. */
3657 	if ((sc->bge_flags & BGE_FLAG_APE) == 0) {
3658 		if (bge_allow_asf && (bge_readmem_ind(sc, BGE_SRAM_DATA_SIG) ==
3659 		    BGE_SRAM_DATA_SIG_MAGIC)) {
3660 			if (bge_readmem_ind(sc, BGE_SRAM_DATA_CFG) &
3661 			    BGE_HWCFG_ASF) {
3662 				sc->bge_asf_mode |= ASF_ENABLE;
3663 				sc->bge_asf_mode |= ASF_STACKUP;
3664 				if (BGE_IS_575X_PLUS(sc))
3665 					sc->bge_asf_mode |= ASF_NEW_HANDSHAKE;
3666 			}
3667 		}
3668 	}
3669 
3670 	bge_stop_fw(sc);
3671 	bge_sig_pre_reset(sc, BGE_RESET_SHUTDOWN);
3672 	if (bge_reset(sc)) {
3673 		device_printf(sc->bge_dev, "chip reset failed\n");
3674 		error = ENXIO;
3675 		goto fail;
3676 	}
3677 
3678 	bge_sig_legacy(sc, BGE_RESET_SHUTDOWN);
3679 	bge_sig_post_reset(sc, BGE_RESET_SHUTDOWN);
3680 
3681 	if (bge_chipinit(sc)) {
3682 		device_printf(sc->bge_dev, "chip initialization failed\n");
3683 		error = ENXIO;
3684 		goto fail;
3685 	}
3686 
3687 	error = bge_get_eaddr(sc, eaddr);
3688 	if (error) {
3689 		device_printf(sc->bge_dev,
3690 		    "failed to read station address\n");
3691 		error = ENXIO;
3692 		goto fail;
3693 	}
3694 
3695 	/* 5705 limits RX return ring to 512 entries. */
3696 	if (BGE_IS_5717_PLUS(sc))
3697 		sc->bge_return_ring_cnt = BGE_RETURN_RING_CNT;
3698 	else if (BGE_IS_5705_PLUS(sc))
3699 		sc->bge_return_ring_cnt = BGE_RETURN_RING_CNT_5705;
3700 	else
3701 		sc->bge_return_ring_cnt = BGE_RETURN_RING_CNT;
3702 
3703 	if (bge_dma_alloc(sc)) {
3704 		device_printf(sc->bge_dev,
3705 		    "failed to allocate DMA resources\n");
3706 		error = ENXIO;
3707 		goto fail;
3708 	}
3709 
3710 	/* Set default tuneable values. */
3711 	sc->bge_stat_ticks = BGE_TICKS_PER_SEC;
3712 	sc->bge_rx_coal_ticks = 150;
3713 	sc->bge_tx_coal_ticks = 150;
3714 	sc->bge_rx_max_coal_bds = 10;
3715 	sc->bge_tx_max_coal_bds = 10;
3716 
3717 	/* Initialize checksum features to use. */
3718 	sc->bge_csum_features = BGE_CSUM_FEATURES;
3719 	if (sc->bge_forced_udpcsum != 0)
3720 		sc->bge_csum_features |= CSUM_UDP;
3721 
3722 	/* Set up ifnet structure */
3723 	ifp = sc->bge_ifp = if_alloc(IFT_ETHER);
3724 	if (ifp == NULL) {
3725 		device_printf(sc->bge_dev, "failed to if_alloc()\n");
3726 		error = ENXIO;
3727 		goto fail;
3728 	}
3729 	if_setsoftc(ifp, sc);
3730 	if_initname(ifp, device_get_name(dev), device_get_unit(dev));
3731 	if_setflags(ifp, IFF_BROADCAST | IFF_SIMPLEX | IFF_MULTICAST);
3732 	if_setioctlfn(ifp, bge_ioctl);
3733 	if_setstartfn(ifp, bge_start);
3734 	if_setinitfn(ifp, bge_init);
3735 	if_setgetcounterfn(ifp, bge_get_counter);
3736 	if_setsendqlen(ifp, BGE_TX_RING_CNT - 1);
3737 	if_setsendqready(ifp);
3738 	if_sethwassist(ifp, sc->bge_csum_features);
3739 	if_setcapabilities(ifp, IFCAP_HWCSUM | IFCAP_VLAN_HWTAGGING |
3740 	    IFCAP_VLAN_MTU);
3741 	if ((sc->bge_flags & (BGE_FLAG_TSO | BGE_FLAG_TSO3)) != 0) {
3742 		if_sethwassistbits(ifp, CSUM_TSO, 0);
3743 		if_setcapabilitiesbit(ifp, IFCAP_TSO4 | IFCAP_VLAN_HWTSO, 0);
3744 	}
3745 #ifdef IFCAP_VLAN_HWCSUM
3746 	if_setcapabilitiesbit(ifp, IFCAP_VLAN_HWCSUM, 0);
3747 #endif
3748 	if_setcapenable(ifp, if_getcapabilities(ifp));
3749 #ifdef DEVICE_POLLING
3750 	if_setcapabilitiesbit(ifp, IFCAP_POLLING, 0);
3751 #endif
3752 
3753 	/*
3754 	 * 5700 B0 chips do not support checksumming correctly due
3755 	 * to hardware bugs.
3756 	 */
3757 	if (sc->bge_chipid == BGE_CHIPID_BCM5700_B0) {
3758 		if_setcapabilitiesbit(ifp, 0, IFCAP_HWCSUM);
3759 		if_setcapenablebit(ifp, 0, IFCAP_HWCSUM);
3760 		if_sethwassist(ifp, 0);
3761 	}
3762 
3763 	/*
3764 	 * Figure out what sort of media we have by checking the
3765 	 * hardware config word in the first 32k of NIC internal memory,
3766 	 * or fall back to examining the EEPROM if necessary.
3767 	 * Note: on some BCM5700 cards, this value appears to be unset.
3768 	 * If that's the case, we have to rely on identifying the NIC
3769 	 * by its PCI subsystem ID, as we do below for the SysKonnect
3770 	 * SK-9D41.
3771 	 */
3772 	if (bge_readmem_ind(sc, BGE_SRAM_DATA_SIG) == BGE_SRAM_DATA_SIG_MAGIC)
3773 		hwcfg = bge_readmem_ind(sc, BGE_SRAM_DATA_CFG);
3774 	else if ((sc->bge_flags & BGE_FLAG_EADDR) &&
3775 	    (sc->bge_asicrev != BGE_ASICREV_BCM5906)) {
3776 		if (bge_read_eeprom(sc, (caddr_t)&hwcfg, BGE_EE_HWCFG_OFFSET,
3777 		    sizeof(hwcfg))) {
3778 			device_printf(sc->bge_dev, "failed to read EEPROM\n");
3779 			error = ENXIO;
3780 			goto fail;
3781 		}
3782 		hwcfg = ntohl(hwcfg);
3783 	}
3784 
3785 	/* The SysKonnect SK-9D41 is a 1000baseSX card. */
3786 	if ((pci_read_config(dev, BGE_PCI_SUBSYS, 4) >> 16) ==
3787 	    SK_SUBSYSID_9D41 || (hwcfg & BGE_HWCFG_MEDIA) == BGE_MEDIA_FIBER) {
3788 		if (BGE_IS_5705_PLUS(sc)) {
3789 			sc->bge_flags |= BGE_FLAG_MII_SERDES;
3790 			sc->bge_phy_flags |= BGE_PHY_NO_WIRESPEED;
3791 		} else
3792 			sc->bge_flags |= BGE_FLAG_TBI;
3793 	}
3794 
3795 	/* Set various PHY bug flags. */
3796 	if (sc->bge_chipid == BGE_CHIPID_BCM5701_A0 ||
3797 	    sc->bge_chipid == BGE_CHIPID_BCM5701_B0)
3798 		sc->bge_phy_flags |= BGE_PHY_CRC_BUG;
3799 	if (sc->bge_chiprev == BGE_CHIPREV_5703_AX ||
3800 	    sc->bge_chiprev == BGE_CHIPREV_5704_AX)
3801 		sc->bge_phy_flags |= BGE_PHY_ADC_BUG;
3802 	if (sc->bge_chipid == BGE_CHIPID_BCM5704_A0)
3803 		sc->bge_phy_flags |= BGE_PHY_5704_A0_BUG;
3804 	if (pci_get_subvendor(dev) == DELL_VENDORID)
3805 		sc->bge_phy_flags |= BGE_PHY_NO_3LED;
3806 	if ((BGE_IS_5705_PLUS(sc)) &&
3807 	    sc->bge_asicrev != BGE_ASICREV_BCM5906 &&
3808 	    sc->bge_asicrev != BGE_ASICREV_BCM5785 &&
3809 	    sc->bge_asicrev != BGE_ASICREV_BCM57780 &&
3810 	    !BGE_IS_5717_PLUS(sc)) {
3811 		if (sc->bge_asicrev == BGE_ASICREV_BCM5755 ||
3812 		    sc->bge_asicrev == BGE_ASICREV_BCM5761 ||
3813 		    sc->bge_asicrev == BGE_ASICREV_BCM5784 ||
3814 		    sc->bge_asicrev == BGE_ASICREV_BCM5787) {
3815 			if (pci_get_device(dev) != BCOM_DEVICEID_BCM5722 &&
3816 			    pci_get_device(dev) != BCOM_DEVICEID_BCM5756)
3817 				sc->bge_phy_flags |= BGE_PHY_JITTER_BUG;
3818 			if (pci_get_device(dev) == BCOM_DEVICEID_BCM5755M)
3819 				sc->bge_phy_flags |= BGE_PHY_ADJUST_TRIM;
3820 		} else
3821 			sc->bge_phy_flags |= BGE_PHY_BER_BUG;
3822 	}
3823 
3824 	/*
3825 	 * Don't enable Ethernet@WireSpeed for the 5700 or the
3826 	 * 5705 A0 and A1 chips.
3827 	 */
3828 	if (sc->bge_asicrev == BGE_ASICREV_BCM5700 ||
3829 	    (sc->bge_asicrev == BGE_ASICREV_BCM5705 &&
3830 	    (sc->bge_chipid != BGE_CHIPID_BCM5705_A0 &&
3831 	    sc->bge_chipid != BGE_CHIPID_BCM5705_A1)))
3832 		sc->bge_phy_flags |= BGE_PHY_NO_WIRESPEED;
3833 
3834 	if (sc->bge_flags & BGE_FLAG_TBI) {
3835 		ifmedia_init(&sc->bge_ifmedia, IFM_IMASK, bge_ifmedia_upd,
3836 		    bge_ifmedia_sts);
3837 		ifmedia_add(&sc->bge_ifmedia, IFM_ETHER | IFM_1000_SX, 0, NULL);
3838 		ifmedia_add(&sc->bge_ifmedia, IFM_ETHER | IFM_1000_SX | IFM_FDX,
3839 		    0, NULL);
3840 		ifmedia_add(&sc->bge_ifmedia, IFM_ETHER | IFM_AUTO, 0, NULL);
3841 		ifmedia_set(&sc->bge_ifmedia, IFM_ETHER | IFM_AUTO);
3842 		sc->bge_ifmedia.ifm_media = sc->bge_ifmedia.ifm_cur->ifm_media;
3843 	} else {
3844 		/*
3845 		 * Do transceiver setup and tell the firmware the
3846 		 * driver is down so we can try to get access the
3847 		 * probe if ASF is running.  Retry a couple of times
3848 		 * if we get a conflict with the ASF firmware accessing
3849 		 * the PHY.
3850 		 */
3851 		trys = 0;
3852 		BGE_CLRBIT(sc, BGE_MODE_CTL, BGE_MODECTL_STACKUP);
3853 again:
3854 		bge_asf_driver_up(sc);
3855 
3856 		error = mii_attach(dev, &sc->bge_miibus, ifp,
3857 		    (ifm_change_cb_t)bge_ifmedia_upd,
3858 		    (ifm_stat_cb_t)bge_ifmedia_sts, capmask, sc->bge_phy_addr,
3859 		    MII_OFFSET_ANY, MIIF_DOPAUSE);
3860 		if (error != 0) {
3861 			if (trys++ < 4) {
3862 				device_printf(sc->bge_dev, "Try again\n");
3863 				bge_miibus_writereg(sc->bge_dev,
3864 				    sc->bge_phy_addr, MII_BMCR, BMCR_RESET);
3865 				goto again;
3866 			}
3867 			device_printf(sc->bge_dev, "attaching PHYs failed\n");
3868 			goto fail;
3869 		}
3870 
3871 		/*
3872 		 * Now tell the firmware we are going up after probing the PHY
3873 		 */
3874 		if (sc->bge_asf_mode & ASF_STACKUP)
3875 			BGE_SETBIT(sc, BGE_MODE_CTL, BGE_MODECTL_STACKUP);
3876 	}
3877 
3878 	/*
3879 	 * When using the BCM5701 in PCI-X mode, data corruption has
3880 	 * been observed in the first few bytes of some received packets.
3881 	 * Aligning the packet buffer in memory eliminates the corruption.
3882 	 * Unfortunately, this misaligns the packet payloads.  On platforms
3883 	 * which do not support unaligned accesses, we will realign the
3884 	 * payloads by copying the received packets.
3885 	 */
3886 	if (sc->bge_asicrev == BGE_ASICREV_BCM5701 &&
3887 	    sc->bge_flags & BGE_FLAG_PCIX)
3888                 sc->bge_flags |= BGE_FLAG_RX_ALIGNBUG;
3889 
3890 	/*
3891 	 * Call MI attach routine.
3892 	 */
3893 	ether_ifattach(ifp, eaddr);
3894 
3895 	/* Tell upper layer we support long frames. */
3896 	if_setifheaderlen(ifp, sizeof(struct ether_vlan_header));
3897 
3898 	/*
3899 	 * Hookup IRQ last.
3900 	 */
3901 	if (BGE_IS_5755_PLUS(sc) && sc->bge_flags & BGE_FLAG_MSI) {
3902 		/* Take advantage of single-shot MSI. */
3903 		CSR_WRITE_4(sc, BGE_MSI_MODE, CSR_READ_4(sc, BGE_MSI_MODE) &
3904 		    ~BGE_MSIMODE_ONE_SHOT_DISABLE);
3905 		sc->bge_tq = taskqueue_create_fast("bge_taskq", M_WAITOK,
3906 		    taskqueue_thread_enqueue, &sc->bge_tq);
3907 		if (sc->bge_tq == NULL) {
3908 			device_printf(dev, "could not create taskqueue.\n");
3909 			ether_ifdetach(ifp);
3910 			error = ENOMEM;
3911 			goto fail;
3912 		}
3913 		error = taskqueue_start_threads(&sc->bge_tq, 1, PI_NET,
3914 		    "%s taskq", device_get_nameunit(sc->bge_dev));
3915 		if (error != 0) {
3916 			device_printf(dev, "could not start threads.\n");
3917 			ether_ifdetach(ifp);
3918 			goto fail;
3919 		}
3920 		error = bus_setup_intr(dev, sc->bge_irq,
3921 		    INTR_TYPE_NET | INTR_MPSAFE, bge_msi_intr, NULL, sc,
3922 		    &sc->bge_intrhand);
3923 	} else
3924 		error = bus_setup_intr(dev, sc->bge_irq,
3925 		    INTR_TYPE_NET | INTR_MPSAFE, NULL, bge_intr, sc,
3926 		    &sc->bge_intrhand);
3927 
3928 	if (error) {
3929 		ether_ifdetach(ifp);
3930 		device_printf(sc->bge_dev, "couldn't set up irq\n");
3931 		goto fail;
3932 	}
3933 
3934 	/* Attach driver debugnet methods. */
3935 	DEBUGNET_SET(ifp, bge);
3936 
3937 fail:
3938 	if (error)
3939 		bge_detach(dev);
3940 	return (error);
3941 }
3942 
3943 static int
3944 bge_detach(device_t dev)
3945 {
3946 	struct bge_softc *sc;
3947 	if_t ifp;
3948 
3949 	sc = device_get_softc(dev);
3950 	ifp = sc->bge_ifp;
3951 
3952 #ifdef DEVICE_POLLING
3953 	if (if_getcapenable(ifp) & IFCAP_POLLING)
3954 		ether_poll_deregister(ifp);
3955 #endif
3956 
3957 	if (device_is_attached(dev)) {
3958 		ether_ifdetach(ifp);
3959 		BGE_LOCK(sc);
3960 		bge_stop(sc);
3961 		BGE_UNLOCK(sc);
3962 		callout_drain(&sc->bge_stat_ch);
3963 	}
3964 
3965 	if (sc->bge_tq)
3966 		taskqueue_drain(sc->bge_tq, &sc->bge_intr_task);
3967 
3968 	if (sc->bge_flags & BGE_FLAG_TBI)
3969 		ifmedia_removeall(&sc->bge_ifmedia);
3970 	else if (sc->bge_miibus != NULL) {
3971 		bus_generic_detach(dev);
3972 		device_delete_child(dev, sc->bge_miibus);
3973 	}
3974 
3975 	bge_release_resources(sc);
3976 
3977 	return (0);
3978 }
3979 
3980 static void
3981 bge_release_resources(struct bge_softc *sc)
3982 {
3983 	device_t dev;
3984 
3985 	dev = sc->bge_dev;
3986 
3987 	if (sc->bge_tq != NULL)
3988 		taskqueue_free(sc->bge_tq);
3989 
3990 	if (sc->bge_intrhand != NULL)
3991 		bus_teardown_intr(dev, sc->bge_irq, sc->bge_intrhand);
3992 
3993 	if (sc->bge_irq != NULL) {
3994 		bus_release_resource(dev, SYS_RES_IRQ,
3995 		    rman_get_rid(sc->bge_irq), sc->bge_irq);
3996 		pci_release_msi(dev);
3997 	}
3998 
3999 	if (sc->bge_res != NULL)
4000 		bus_release_resource(dev, SYS_RES_MEMORY,
4001 		    rman_get_rid(sc->bge_res), sc->bge_res);
4002 
4003 	if (sc->bge_res2 != NULL)
4004 		bus_release_resource(dev, SYS_RES_MEMORY,
4005 		    rman_get_rid(sc->bge_res2), sc->bge_res2);
4006 
4007 	if (sc->bge_ifp != NULL)
4008 		if_free(sc->bge_ifp);
4009 
4010 	bge_dma_free(sc);
4011 
4012 	if (mtx_initialized(&sc->bge_mtx))	/* XXX */
4013 		BGE_LOCK_DESTROY(sc);
4014 }
4015 
4016 static int
4017 bge_reset(struct bge_softc *sc)
4018 {
4019 	device_t dev;
4020 	uint32_t cachesize, command, mac_mode, mac_mode_mask, reset, val;
4021 	void (*write_op)(struct bge_softc *, int, int);
4022 	uint16_t devctl;
4023 	int i;
4024 
4025 	dev = sc->bge_dev;
4026 
4027 	mac_mode_mask = BGE_MACMODE_HALF_DUPLEX | BGE_MACMODE_PORTMODE;
4028 	if ((sc->bge_mfw_flags & BGE_MFW_ON_APE) != 0)
4029 		mac_mode_mask |= BGE_MACMODE_APE_RX_EN | BGE_MACMODE_APE_TX_EN;
4030 	mac_mode = CSR_READ_4(sc, BGE_MAC_MODE) & mac_mode_mask;
4031 
4032 	if (BGE_IS_575X_PLUS(sc) && !BGE_IS_5714_FAMILY(sc) &&
4033 	    (sc->bge_asicrev != BGE_ASICREV_BCM5906)) {
4034 		if (sc->bge_flags & BGE_FLAG_PCIE)
4035 			write_op = bge_writemem_direct;
4036 		else
4037 			write_op = bge_writemem_ind;
4038 	} else
4039 		write_op = bge_writereg_ind;
4040 
4041 	if (sc->bge_asicrev != BGE_ASICREV_BCM5700 &&
4042 	    sc->bge_asicrev != BGE_ASICREV_BCM5701) {
4043 		CSR_WRITE_4(sc, BGE_NVRAM_SWARB, BGE_NVRAMSWARB_SET1);
4044 		for (i = 0; i < 8000; i++) {
4045 			if (CSR_READ_4(sc, BGE_NVRAM_SWARB) &
4046 			    BGE_NVRAMSWARB_GNT1)
4047 				break;
4048 			DELAY(20);
4049 		}
4050 		if (i == 8000) {
4051 			if (bootverbose)
4052 				device_printf(dev, "NVRAM lock timedout!\n");
4053 		}
4054 	}
4055 	/* Take APE lock when performing reset. */
4056 	bge_ape_lock(sc, BGE_APE_LOCK_GRC);
4057 
4058 	/* Save some important PCI state. */
4059 	cachesize = pci_read_config(dev, BGE_PCI_CACHESZ, 4);
4060 	command = pci_read_config(dev, BGE_PCI_CMD, 4);
4061 
4062 	pci_write_config(dev, BGE_PCI_MISC_CTL,
4063 	    BGE_PCIMISCCTL_INDIRECT_ACCESS | BGE_PCIMISCCTL_MASK_PCI_INTR |
4064 	    BGE_HIF_SWAP_OPTIONS | BGE_PCIMISCCTL_PCISTATE_RW, 4);
4065 
4066 	/* Disable fastboot on controllers that support it. */
4067 	if (sc->bge_asicrev == BGE_ASICREV_BCM5752 ||
4068 	    BGE_IS_5755_PLUS(sc)) {
4069 		if (bootverbose)
4070 			device_printf(dev, "Disabling fastboot\n");
4071 		CSR_WRITE_4(sc, BGE_FASTBOOT_PC, 0x0);
4072 	}
4073 
4074 	/*
4075 	 * Write the magic number to SRAM at offset 0xB50.
4076 	 * When firmware finishes its initialization it will
4077 	 * write ~BGE_SRAM_FW_MB_MAGIC to the same location.
4078 	 */
4079 	bge_writemem_ind(sc, BGE_SRAM_FW_MB, BGE_SRAM_FW_MB_MAGIC);
4080 
4081 	reset = BGE_MISCCFG_RESET_CORE_CLOCKS | BGE_32BITTIME_66MHZ;
4082 
4083 	/* XXX: Broadcom Linux driver. */
4084 	if (sc->bge_flags & BGE_FLAG_PCIE) {
4085 		if (sc->bge_asicrev != BGE_ASICREV_BCM5785 &&
4086 		    (sc->bge_flags & BGE_FLAG_5717_PLUS) == 0) {
4087 			if (CSR_READ_4(sc, 0x7E2C) == 0x60)	/* PCIE 1.0 */
4088 				CSR_WRITE_4(sc, 0x7E2C, 0x20);
4089 		}
4090 		if (sc->bge_chipid != BGE_CHIPID_BCM5750_A0) {
4091 			/* Prevent PCIE link training during global reset */
4092 			CSR_WRITE_4(sc, BGE_MISC_CFG, 1 << 29);
4093 			reset |= 1 << 29;
4094 		}
4095 	}
4096 
4097 	if (sc->bge_asicrev == BGE_ASICREV_BCM5906) {
4098 		val = CSR_READ_4(sc, BGE_VCPU_STATUS);
4099 		CSR_WRITE_4(sc, BGE_VCPU_STATUS,
4100 		    val | BGE_VCPU_STATUS_DRV_RESET);
4101 		val = CSR_READ_4(sc, BGE_VCPU_EXT_CTRL);
4102 		CSR_WRITE_4(sc, BGE_VCPU_EXT_CTRL,
4103 		    val & ~BGE_VCPU_EXT_CTRL_HALT_CPU);
4104 	}
4105 
4106 	/*
4107 	 * Set GPHY Power Down Override to leave GPHY
4108 	 * powered up in D0 uninitialized.
4109 	 */
4110 	if (BGE_IS_5705_PLUS(sc) &&
4111 	    (sc->bge_flags & BGE_FLAG_CPMU_PRESENT) == 0)
4112 		reset |= BGE_MISCCFG_GPHY_PD_OVERRIDE;
4113 
4114 	/* Issue global reset */
4115 	write_op(sc, BGE_MISC_CFG, reset);
4116 
4117 	if (sc->bge_flags & BGE_FLAG_PCIE)
4118 		DELAY(100 * 1000);
4119 	else
4120 		DELAY(1000);
4121 
4122 	/* XXX: Broadcom Linux driver. */
4123 	if (sc->bge_flags & BGE_FLAG_PCIE) {
4124 		if (sc->bge_chipid == BGE_CHIPID_BCM5750_A0) {
4125 			DELAY(500000); /* wait for link training to complete */
4126 			val = pci_read_config(dev, 0xC4, 4);
4127 			pci_write_config(dev, 0xC4, val | (1 << 15), 4);
4128 		}
4129 		devctl = pci_read_config(dev,
4130 		    sc->bge_expcap + PCIER_DEVICE_CTL, 2);
4131 		/* Clear enable no snoop and disable relaxed ordering. */
4132 		devctl &= ~(PCIEM_CTL_RELAXED_ORD_ENABLE |
4133 		    PCIEM_CTL_NOSNOOP_ENABLE);
4134 		pci_write_config(dev, sc->bge_expcap + PCIER_DEVICE_CTL,
4135 		    devctl, 2);
4136 		pci_set_max_read_req(dev, sc->bge_expmrq);
4137 		/* Clear error status. */
4138 		pci_write_config(dev, sc->bge_expcap + PCIER_DEVICE_STA,
4139 		    PCIEM_STA_CORRECTABLE_ERROR |
4140 		    PCIEM_STA_NON_FATAL_ERROR | PCIEM_STA_FATAL_ERROR |
4141 		    PCIEM_STA_UNSUPPORTED_REQ, 2);
4142 	}
4143 
4144 	/* Reset some of the PCI state that got zapped by reset. */
4145 	pci_write_config(dev, BGE_PCI_MISC_CTL,
4146 	    BGE_PCIMISCCTL_INDIRECT_ACCESS | BGE_PCIMISCCTL_MASK_PCI_INTR |
4147 	    BGE_HIF_SWAP_OPTIONS | BGE_PCIMISCCTL_PCISTATE_RW, 4);
4148 	val = BGE_PCISTATE_ROM_ENABLE | BGE_PCISTATE_ROM_RETRY_ENABLE;
4149 	if (sc->bge_chipid == BGE_CHIPID_BCM5704_A0 &&
4150 	    (sc->bge_flags & BGE_FLAG_PCIX) != 0)
4151 		val |= BGE_PCISTATE_RETRY_SAME_DMA;
4152 	if ((sc->bge_mfw_flags & BGE_MFW_ON_APE) != 0)
4153 		val |= BGE_PCISTATE_ALLOW_APE_CTLSPC_WR |
4154 		    BGE_PCISTATE_ALLOW_APE_SHMEM_WR |
4155 		    BGE_PCISTATE_ALLOW_APE_PSPACE_WR;
4156 	pci_write_config(dev, BGE_PCI_PCISTATE, val, 4);
4157 	pci_write_config(dev, BGE_PCI_CACHESZ, cachesize, 4);
4158 	pci_write_config(dev, BGE_PCI_CMD, command, 4);
4159 	/*
4160 	 * Disable PCI-X relaxed ordering to ensure status block update
4161 	 * comes first then packet buffer DMA. Otherwise driver may
4162 	 * read stale status block.
4163 	 */
4164 	if (sc->bge_flags & BGE_FLAG_PCIX) {
4165 		devctl = pci_read_config(dev,
4166 		    sc->bge_pcixcap + PCIXR_COMMAND, 2);
4167 		devctl &= ~PCIXM_COMMAND_ERO;
4168 		if (sc->bge_asicrev == BGE_ASICREV_BCM5703) {
4169 			devctl &= ~PCIXM_COMMAND_MAX_READ;
4170 			devctl |= PCIXM_COMMAND_MAX_READ_2048;
4171 		} else if (sc->bge_asicrev == BGE_ASICREV_BCM5704) {
4172 			devctl &= ~(PCIXM_COMMAND_MAX_SPLITS |
4173 			    PCIXM_COMMAND_MAX_READ);
4174 			devctl |= PCIXM_COMMAND_MAX_READ_2048;
4175 		}
4176 		pci_write_config(dev, sc->bge_pcixcap + PCIXR_COMMAND,
4177 		    devctl, 2);
4178 	}
4179 	/* Re-enable MSI, if necessary, and enable the memory arbiter. */
4180 	if (BGE_IS_5714_FAMILY(sc)) {
4181 		/* This chip disables MSI on reset. */
4182 		if (sc->bge_flags & BGE_FLAG_MSI) {
4183 			val = pci_read_config(dev,
4184 			    sc->bge_msicap + PCIR_MSI_CTRL, 2);
4185 			pci_write_config(dev,
4186 			    sc->bge_msicap + PCIR_MSI_CTRL,
4187 			    val | PCIM_MSICTRL_MSI_ENABLE, 2);
4188 			val = CSR_READ_4(sc, BGE_MSI_MODE);
4189 			CSR_WRITE_4(sc, BGE_MSI_MODE,
4190 			    val | BGE_MSIMODE_ENABLE);
4191 		}
4192 		val = CSR_READ_4(sc, BGE_MARB_MODE);
4193 		CSR_WRITE_4(sc, BGE_MARB_MODE, BGE_MARBMODE_ENABLE | val);
4194 	} else
4195 		CSR_WRITE_4(sc, BGE_MARB_MODE, BGE_MARBMODE_ENABLE);
4196 
4197 	/* Fix up byte swapping. */
4198 	CSR_WRITE_4(sc, BGE_MODE_CTL, bge_dma_swap_options(sc));
4199 
4200 	val = CSR_READ_4(sc, BGE_MAC_MODE);
4201 	val = (val & ~mac_mode_mask) | mac_mode;
4202 	CSR_WRITE_4(sc, BGE_MAC_MODE, val);
4203 	DELAY(40);
4204 
4205 	bge_ape_unlock(sc, BGE_APE_LOCK_GRC);
4206 
4207 	if (sc->bge_asicrev == BGE_ASICREV_BCM5906) {
4208 		for (i = 0; i < BGE_TIMEOUT; i++) {
4209 			val = CSR_READ_4(sc, BGE_VCPU_STATUS);
4210 			if (val & BGE_VCPU_STATUS_INIT_DONE)
4211 				break;
4212 			DELAY(100);
4213 		}
4214 		if (i == BGE_TIMEOUT) {
4215 			device_printf(dev, "reset timed out\n");
4216 			return (1);
4217 		}
4218 	} else {
4219 		/*
4220 		 * Poll until we see the 1's complement of the magic number.
4221 		 * This indicates that the firmware initialization is complete.
4222 		 * We expect this to fail if no chip containing the Ethernet
4223 		 * address is fitted though.
4224 		 */
4225 		for (i = 0; i < BGE_TIMEOUT; i++) {
4226 			DELAY(10);
4227 			val = bge_readmem_ind(sc, BGE_SRAM_FW_MB);
4228 			if (val == ~BGE_SRAM_FW_MB_MAGIC)
4229 				break;
4230 		}
4231 
4232 		if ((sc->bge_flags & BGE_FLAG_EADDR) && i == BGE_TIMEOUT)
4233 			device_printf(dev,
4234 			    "firmware handshake timed out, found 0x%08x\n",
4235 			    val);
4236 		/* BCM57765 A0 needs additional time before accessing. */
4237 		if (sc->bge_chipid == BGE_CHIPID_BCM57765_A0)
4238 			DELAY(10 * 1000);	/* XXX */
4239 	}
4240 
4241 	/*
4242 	 * The 5704 in TBI mode apparently needs some special
4243 	 * adjustment to insure the SERDES drive level is set
4244 	 * to 1.2V.
4245 	 */
4246 	if (sc->bge_asicrev == BGE_ASICREV_BCM5704 &&
4247 	    sc->bge_flags & BGE_FLAG_TBI) {
4248 		val = CSR_READ_4(sc, BGE_SERDES_CFG);
4249 		val = (val & ~0xFFF) | 0x880;
4250 		CSR_WRITE_4(sc, BGE_SERDES_CFG, val);
4251 	}
4252 
4253 	/* XXX: Broadcom Linux driver. */
4254 	if (sc->bge_flags & BGE_FLAG_PCIE &&
4255 	    !BGE_IS_5717_PLUS(sc) &&
4256 	    sc->bge_chipid != BGE_CHIPID_BCM5750_A0 &&
4257 	    sc->bge_asicrev != BGE_ASICREV_BCM5785) {
4258 		/* Enable Data FIFO protection. */
4259 		val = CSR_READ_4(sc, 0x7C00);
4260 		CSR_WRITE_4(sc, 0x7C00, val | (1 << 25));
4261 	}
4262 
4263 	if (sc->bge_asicrev == BGE_ASICREV_BCM5720)
4264 		BGE_CLRBIT(sc, BGE_CPMU_CLCK_ORIDE,
4265 		    CPMU_CLCK_ORIDE_MAC_ORIDE_EN);
4266 
4267 	return (0);
4268 }
4269 
4270 static __inline void
4271 bge_rxreuse_std(struct bge_softc *sc, int i)
4272 {
4273 	struct bge_rx_bd *r;
4274 
4275 	r = &sc->bge_ldata.bge_rx_std_ring[sc->bge_std];
4276 	r->bge_flags = BGE_RXBDFLAG_END;
4277 	r->bge_len = sc->bge_cdata.bge_rx_std_seglen[i];
4278 	r->bge_idx = i;
4279 	BGE_INC(sc->bge_std, BGE_STD_RX_RING_CNT);
4280 }
4281 
4282 static __inline void
4283 bge_rxreuse_jumbo(struct bge_softc *sc, int i)
4284 {
4285 	struct bge_extrx_bd *r;
4286 
4287 	r = &sc->bge_ldata.bge_rx_jumbo_ring[sc->bge_jumbo];
4288 	r->bge_flags = BGE_RXBDFLAG_JUMBO_RING | BGE_RXBDFLAG_END;
4289 	r->bge_len0 = sc->bge_cdata.bge_rx_jumbo_seglen[i][0];
4290 	r->bge_len1 = sc->bge_cdata.bge_rx_jumbo_seglen[i][1];
4291 	r->bge_len2 = sc->bge_cdata.bge_rx_jumbo_seglen[i][2];
4292 	r->bge_len3 = sc->bge_cdata.bge_rx_jumbo_seglen[i][3];
4293 	r->bge_idx = i;
4294 	BGE_INC(sc->bge_jumbo, BGE_JUMBO_RX_RING_CNT);
4295 }
4296 
4297 /*
4298  * Frame reception handling. This is called if there's a frame
4299  * on the receive return list.
4300  *
4301  * Note: we have to be able to handle two possibilities here:
4302  * 1) the frame is from the jumbo receive ring
4303  * 2) the frame is from the standard receive ring
4304  */
4305 
4306 static int
4307 bge_rxeof(struct bge_softc *sc, uint16_t rx_prod, int holdlck)
4308 {
4309 	if_t ifp;
4310 	int rx_npkts = 0, stdcnt = 0, jumbocnt = 0;
4311 	uint16_t rx_cons;
4312 
4313 	rx_cons = sc->bge_rx_saved_considx;
4314 
4315 	/* Nothing to do. */
4316 	if (rx_cons == rx_prod)
4317 		return (rx_npkts);
4318 
4319 	ifp = sc->bge_ifp;
4320 
4321 	bus_dmamap_sync(sc->bge_cdata.bge_rx_return_ring_tag,
4322 	    sc->bge_cdata.bge_rx_return_ring_map, BUS_DMASYNC_POSTREAD);
4323 	bus_dmamap_sync(sc->bge_cdata.bge_rx_std_ring_tag,
4324 	    sc->bge_cdata.bge_rx_std_ring_map, BUS_DMASYNC_POSTWRITE);
4325 	if (BGE_IS_JUMBO_CAPABLE(sc) &&
4326 	    if_getmtu(ifp) + ETHER_HDR_LEN + ETHER_CRC_LEN +
4327 	    ETHER_VLAN_ENCAP_LEN > (MCLBYTES - ETHER_ALIGN))
4328 		bus_dmamap_sync(sc->bge_cdata.bge_rx_jumbo_ring_tag,
4329 		    sc->bge_cdata.bge_rx_jumbo_ring_map, BUS_DMASYNC_POSTWRITE);
4330 
4331 	while (rx_cons != rx_prod) {
4332 		struct bge_rx_bd	*cur_rx;
4333 		uint32_t		rxidx;
4334 		struct mbuf		*m = NULL;
4335 		uint16_t		vlan_tag = 0;
4336 		int			have_tag = 0;
4337 
4338 #ifdef DEVICE_POLLING
4339 		if (if_getcapenable(ifp) & IFCAP_POLLING) {
4340 			if (sc->rxcycles <= 0)
4341 				break;
4342 			sc->rxcycles--;
4343 		}
4344 #endif
4345 
4346 		cur_rx = &sc->bge_ldata.bge_rx_return_ring[rx_cons];
4347 
4348 		rxidx = cur_rx->bge_idx;
4349 		BGE_INC(rx_cons, sc->bge_return_ring_cnt);
4350 
4351 		if (if_getcapenable(ifp) & IFCAP_VLAN_HWTAGGING &&
4352 		    cur_rx->bge_flags & BGE_RXBDFLAG_VLAN_TAG) {
4353 			have_tag = 1;
4354 			vlan_tag = cur_rx->bge_vlan_tag;
4355 		}
4356 
4357 		if (cur_rx->bge_flags & BGE_RXBDFLAG_JUMBO_RING) {
4358 			jumbocnt++;
4359 			m = sc->bge_cdata.bge_rx_jumbo_chain[rxidx];
4360 			if (cur_rx->bge_flags & BGE_RXBDFLAG_ERROR) {
4361 				bge_rxreuse_jumbo(sc, rxidx);
4362 				continue;
4363 			}
4364 			if (bge_newbuf_jumbo(sc, rxidx) != 0) {
4365 				bge_rxreuse_jumbo(sc, rxidx);
4366 				if_inc_counter(ifp, IFCOUNTER_IQDROPS, 1);
4367 				continue;
4368 			}
4369 			BGE_INC(sc->bge_jumbo, BGE_JUMBO_RX_RING_CNT);
4370 		} else {
4371 			stdcnt++;
4372 			m = sc->bge_cdata.bge_rx_std_chain[rxidx];
4373 			if (cur_rx->bge_flags & BGE_RXBDFLAG_ERROR) {
4374 				bge_rxreuse_std(sc, rxidx);
4375 				continue;
4376 			}
4377 			if (bge_newbuf_std(sc, rxidx) != 0) {
4378 				bge_rxreuse_std(sc, rxidx);
4379 				if_inc_counter(ifp, IFCOUNTER_IQDROPS, 1);
4380 				continue;
4381 			}
4382 			BGE_INC(sc->bge_std, BGE_STD_RX_RING_CNT);
4383 		}
4384 
4385 		if_inc_counter(ifp, IFCOUNTER_IPACKETS, 1);
4386 #ifndef __NO_STRICT_ALIGNMENT
4387 		/*
4388 		 * For architectures with strict alignment we must make sure
4389 		 * the payload is aligned.
4390 		 */
4391 		if (sc->bge_flags & BGE_FLAG_RX_ALIGNBUG) {
4392 			bcopy(m->m_data, m->m_data + ETHER_ALIGN,
4393 			    cur_rx->bge_len);
4394 			m->m_data += ETHER_ALIGN;
4395 		}
4396 #endif
4397 		m->m_pkthdr.len = m->m_len = cur_rx->bge_len - ETHER_CRC_LEN;
4398 		m->m_pkthdr.rcvif = ifp;
4399 
4400 		if (if_getcapenable(ifp) & IFCAP_RXCSUM)
4401 			bge_rxcsum(sc, cur_rx, m);
4402 
4403 		/*
4404 		 * If we received a packet with a vlan tag,
4405 		 * attach that information to the packet.
4406 		 */
4407 		if (have_tag) {
4408 			m->m_pkthdr.ether_vtag = vlan_tag;
4409 			m->m_flags |= M_VLANTAG;
4410 		}
4411 
4412 		if (holdlck != 0) {
4413 			BGE_UNLOCK(sc);
4414 			if_input(ifp, m);
4415 			BGE_LOCK(sc);
4416 		} else
4417 			if_input(ifp, m);
4418 		rx_npkts++;
4419 
4420 		if (!(if_getdrvflags(ifp) & IFF_DRV_RUNNING))
4421 			return (rx_npkts);
4422 	}
4423 
4424 	bus_dmamap_sync(sc->bge_cdata.bge_rx_return_ring_tag,
4425 	    sc->bge_cdata.bge_rx_return_ring_map, BUS_DMASYNC_PREREAD);
4426 	if (stdcnt > 0)
4427 		bus_dmamap_sync(sc->bge_cdata.bge_rx_std_ring_tag,
4428 		    sc->bge_cdata.bge_rx_std_ring_map, BUS_DMASYNC_PREWRITE);
4429 
4430 	if (jumbocnt > 0)
4431 		bus_dmamap_sync(sc->bge_cdata.bge_rx_jumbo_ring_tag,
4432 		    sc->bge_cdata.bge_rx_jumbo_ring_map, BUS_DMASYNC_PREWRITE);
4433 
4434 	sc->bge_rx_saved_considx = rx_cons;
4435 	bge_writembx(sc, BGE_MBX_RX_CONS0_LO, sc->bge_rx_saved_considx);
4436 	if (stdcnt)
4437 		bge_writembx(sc, BGE_MBX_RX_STD_PROD_LO, (sc->bge_std +
4438 		    BGE_STD_RX_RING_CNT - 1) % BGE_STD_RX_RING_CNT);
4439 	if (jumbocnt)
4440 		bge_writembx(sc, BGE_MBX_RX_JUMBO_PROD_LO, (sc->bge_jumbo +
4441 		    BGE_JUMBO_RX_RING_CNT - 1) % BGE_JUMBO_RX_RING_CNT);
4442 #ifdef notyet
4443 	/*
4444 	 * This register wraps very quickly under heavy packet drops.
4445 	 * If you need correct statistics, you can enable this check.
4446 	 */
4447 	if (BGE_IS_5705_PLUS(sc))
4448 		if_incierrors(ifp, CSR_READ_4(sc, BGE_RXLP_LOCSTAT_IFIN_DROPS));
4449 #endif
4450 	return (rx_npkts);
4451 }
4452 
4453 static void
4454 bge_rxcsum(struct bge_softc *sc, struct bge_rx_bd *cur_rx, struct mbuf *m)
4455 {
4456 
4457 	if (BGE_IS_5717_PLUS(sc)) {
4458 		if ((cur_rx->bge_flags & BGE_RXBDFLAG_IPV6) == 0) {
4459 			if (cur_rx->bge_flags & BGE_RXBDFLAG_IP_CSUM) {
4460 				m->m_pkthdr.csum_flags |= CSUM_IP_CHECKED;
4461 				if ((cur_rx->bge_error_flag &
4462 				    BGE_RXERRFLAG_IP_CSUM_NOK) == 0)
4463 					m->m_pkthdr.csum_flags |= CSUM_IP_VALID;
4464 			}
4465 			if (cur_rx->bge_flags & BGE_RXBDFLAG_TCP_UDP_CSUM) {
4466 				m->m_pkthdr.csum_data =
4467 				    cur_rx->bge_tcp_udp_csum;
4468 				m->m_pkthdr.csum_flags |= CSUM_DATA_VALID |
4469 				    CSUM_PSEUDO_HDR;
4470 			}
4471 		}
4472 	} else {
4473 		if (cur_rx->bge_flags & BGE_RXBDFLAG_IP_CSUM) {
4474 			m->m_pkthdr.csum_flags |= CSUM_IP_CHECKED;
4475 			if ((cur_rx->bge_ip_csum ^ 0xFFFF) == 0)
4476 				m->m_pkthdr.csum_flags |= CSUM_IP_VALID;
4477 		}
4478 		if (cur_rx->bge_flags & BGE_RXBDFLAG_TCP_UDP_CSUM &&
4479 		    m->m_pkthdr.len >= ETHER_MIN_NOPAD) {
4480 			m->m_pkthdr.csum_data =
4481 			    cur_rx->bge_tcp_udp_csum;
4482 			m->m_pkthdr.csum_flags |= CSUM_DATA_VALID |
4483 			    CSUM_PSEUDO_HDR;
4484 		}
4485 	}
4486 }
4487 
4488 static void
4489 bge_txeof(struct bge_softc *sc, uint16_t tx_cons)
4490 {
4491 	struct bge_tx_bd *cur_tx;
4492 	if_t ifp;
4493 
4494 	BGE_LOCK_ASSERT(sc);
4495 
4496 	/* Nothing to do. */
4497 	if (sc->bge_tx_saved_considx == tx_cons)
4498 		return;
4499 
4500 	ifp = sc->bge_ifp;
4501 
4502 	bus_dmamap_sync(sc->bge_cdata.bge_tx_ring_tag,
4503 	    sc->bge_cdata.bge_tx_ring_map, BUS_DMASYNC_POSTWRITE);
4504 	/*
4505 	 * Go through our tx ring and free mbufs for those
4506 	 * frames that have been sent.
4507 	 */
4508 	while (sc->bge_tx_saved_considx != tx_cons) {
4509 		uint32_t		idx;
4510 
4511 		idx = sc->bge_tx_saved_considx;
4512 		cur_tx = &sc->bge_ldata.bge_tx_ring[idx];
4513 		if (cur_tx->bge_flags & BGE_TXBDFLAG_END)
4514 			if_inc_counter(ifp, IFCOUNTER_OPACKETS, 1);
4515 		if (sc->bge_cdata.bge_tx_chain[idx] != NULL) {
4516 			bus_dmamap_sync(sc->bge_cdata.bge_tx_mtag,
4517 			    sc->bge_cdata.bge_tx_dmamap[idx],
4518 			    BUS_DMASYNC_POSTWRITE);
4519 			bus_dmamap_unload(sc->bge_cdata.bge_tx_mtag,
4520 			    sc->bge_cdata.bge_tx_dmamap[idx]);
4521 			m_freem(sc->bge_cdata.bge_tx_chain[idx]);
4522 			sc->bge_cdata.bge_tx_chain[idx] = NULL;
4523 		}
4524 		sc->bge_txcnt--;
4525 		BGE_INC(sc->bge_tx_saved_considx, BGE_TX_RING_CNT);
4526 	}
4527 
4528 	if_setdrvflagbits(ifp, 0, IFF_DRV_OACTIVE);
4529 	if (sc->bge_txcnt == 0)
4530 		sc->bge_timer = 0;
4531 }
4532 
4533 #ifdef DEVICE_POLLING
4534 static int
4535 bge_poll(if_t ifp, enum poll_cmd cmd, int count)
4536 {
4537 	struct bge_softc *sc = if_getsoftc(ifp);
4538 	uint16_t rx_prod, tx_cons;
4539 	uint32_t statusword;
4540 	int rx_npkts = 0;
4541 
4542 	BGE_LOCK(sc);
4543 	if (!(if_getdrvflags(ifp) & IFF_DRV_RUNNING)) {
4544 		BGE_UNLOCK(sc);
4545 		return (rx_npkts);
4546 	}
4547 
4548 	bus_dmamap_sync(sc->bge_cdata.bge_status_tag,
4549 	    sc->bge_cdata.bge_status_map,
4550 	    BUS_DMASYNC_POSTREAD | BUS_DMASYNC_POSTWRITE);
4551 	/* Fetch updates from the status block. */
4552 	rx_prod = sc->bge_ldata.bge_status_block->bge_idx[0].bge_rx_prod_idx;
4553 	tx_cons = sc->bge_ldata.bge_status_block->bge_idx[0].bge_tx_cons_idx;
4554 
4555 	statusword = sc->bge_ldata.bge_status_block->bge_status;
4556 	/* Clear the status so the next pass only sees the changes. */
4557 	sc->bge_ldata.bge_status_block->bge_status = 0;
4558 
4559 	bus_dmamap_sync(sc->bge_cdata.bge_status_tag,
4560 	    sc->bge_cdata.bge_status_map,
4561 	    BUS_DMASYNC_PREREAD | BUS_DMASYNC_PREWRITE);
4562 
4563 	/* Note link event. It will be processed by POLL_AND_CHECK_STATUS. */
4564 	if (statusword & BGE_STATFLAG_LINKSTATE_CHANGED)
4565 		sc->bge_link_evt++;
4566 
4567 	if (cmd == POLL_AND_CHECK_STATUS)
4568 		if ((sc->bge_asicrev == BGE_ASICREV_BCM5700 &&
4569 		    sc->bge_chipid != BGE_CHIPID_BCM5700_B2) ||
4570 		    sc->bge_link_evt || (sc->bge_flags & BGE_FLAG_TBI))
4571 			bge_link_upd(sc);
4572 
4573 	sc->rxcycles = count;
4574 	rx_npkts = bge_rxeof(sc, rx_prod, 1);
4575 	if (!(if_getdrvflags(ifp) & IFF_DRV_RUNNING)) {
4576 		BGE_UNLOCK(sc);
4577 		return (rx_npkts);
4578 	}
4579 	bge_txeof(sc, tx_cons);
4580 	if (!if_sendq_empty(ifp))
4581 		bge_start_locked(ifp);
4582 
4583 	BGE_UNLOCK(sc);
4584 	return (rx_npkts);
4585 }
4586 #endif /* DEVICE_POLLING */
4587 
4588 static int
4589 bge_msi_intr(void *arg)
4590 {
4591 	struct bge_softc *sc;
4592 
4593 	sc = (struct bge_softc *)arg;
4594 	/*
4595 	 * This interrupt is not shared and controller already
4596 	 * disabled further interrupt.
4597 	 */
4598 	taskqueue_enqueue(sc->bge_tq, &sc->bge_intr_task);
4599 	return (FILTER_HANDLED);
4600 }
4601 
4602 static void
4603 bge_intr_task(void *arg, int pending)
4604 {
4605 	struct bge_softc *sc;
4606 	if_t ifp;
4607 	uint32_t status, status_tag;
4608 	uint16_t rx_prod, tx_cons;
4609 
4610 	sc = (struct bge_softc *)arg;
4611 	ifp = sc->bge_ifp;
4612 
4613 	BGE_LOCK(sc);
4614 	if ((if_getdrvflags(ifp) & IFF_DRV_RUNNING) == 0) {
4615 		BGE_UNLOCK(sc);
4616 		return;
4617 	}
4618 
4619 	/* Get updated status block. */
4620 	bus_dmamap_sync(sc->bge_cdata.bge_status_tag,
4621 	    sc->bge_cdata.bge_status_map,
4622 	    BUS_DMASYNC_POSTREAD | BUS_DMASYNC_POSTWRITE);
4623 
4624 	/* Save producer/consumer indices. */
4625 	rx_prod = sc->bge_ldata.bge_status_block->bge_idx[0].bge_rx_prod_idx;
4626 	tx_cons = sc->bge_ldata.bge_status_block->bge_idx[0].bge_tx_cons_idx;
4627 	status = sc->bge_ldata.bge_status_block->bge_status;
4628 	status_tag = sc->bge_ldata.bge_status_block->bge_status_tag << 24;
4629 	/* Dirty the status flag. */
4630 	sc->bge_ldata.bge_status_block->bge_status = 0;
4631 	bus_dmamap_sync(sc->bge_cdata.bge_status_tag,
4632 	    sc->bge_cdata.bge_status_map,
4633 	    BUS_DMASYNC_PREREAD | BUS_DMASYNC_PREWRITE);
4634 	if ((sc->bge_flags & BGE_FLAG_TAGGED_STATUS) == 0)
4635 		status_tag = 0;
4636 
4637 	if ((status & BGE_STATFLAG_LINKSTATE_CHANGED) != 0)
4638 		bge_link_upd(sc);
4639 
4640 	/* Let controller work. */
4641 	bge_writembx(sc, BGE_MBX_IRQ0_LO, status_tag);
4642 
4643 	if (if_getdrvflags(ifp) & IFF_DRV_RUNNING &&
4644 	    sc->bge_rx_saved_considx != rx_prod) {
4645 		/* Check RX return ring producer/consumer. */
4646 		BGE_UNLOCK(sc);
4647 		bge_rxeof(sc, rx_prod, 0);
4648 		BGE_LOCK(sc);
4649 	}
4650 	if (if_getdrvflags(ifp) & IFF_DRV_RUNNING) {
4651 		/* Check TX ring producer/consumer. */
4652 		bge_txeof(sc, tx_cons);
4653 		if (!if_sendq_empty(ifp))
4654 			bge_start_locked(ifp);
4655 	}
4656 	BGE_UNLOCK(sc);
4657 }
4658 
4659 static void
4660 bge_intr(void *xsc)
4661 {
4662 	struct bge_softc *sc;
4663 	if_t ifp;
4664 	uint32_t statusword;
4665 	uint16_t rx_prod, tx_cons;
4666 
4667 	sc = xsc;
4668 
4669 	BGE_LOCK(sc);
4670 
4671 	ifp = sc->bge_ifp;
4672 
4673 #ifdef DEVICE_POLLING
4674 	if (if_getcapenable(ifp) & IFCAP_POLLING) {
4675 		BGE_UNLOCK(sc);
4676 		return;
4677 	}
4678 #endif
4679 
4680 	/*
4681 	 * Ack the interrupt by writing something to BGE_MBX_IRQ0_LO.  Don't
4682 	 * disable interrupts by writing nonzero like we used to, since with
4683 	 * our current organization this just gives complications and
4684 	 * pessimizations for re-enabling interrupts.  We used to have races
4685 	 * instead of the necessary complications.  Disabling interrupts
4686 	 * would just reduce the chance of a status update while we are
4687 	 * running (by switching to the interrupt-mode coalescence
4688 	 * parameters), but this chance is already very low so it is more
4689 	 * efficient to get another interrupt than prevent it.
4690 	 *
4691 	 * We do the ack first to ensure another interrupt if there is a
4692 	 * status update after the ack.  We don't check for the status
4693 	 * changing later because it is more efficient to get another
4694 	 * interrupt than prevent it, not quite as above (not checking is
4695 	 * a smaller optimization than not toggling the interrupt enable,
4696 	 * since checking doesn't involve PCI accesses and toggling require
4697 	 * the status check).  So toggling would probably be a pessimization
4698 	 * even with MSI.  It would only be needed for using a task queue.
4699 	 */
4700 	bge_writembx(sc, BGE_MBX_IRQ0_LO, 0);
4701 
4702 	/*
4703 	 * Do the mandatory PCI flush as well as get the link status.
4704 	 */
4705 	statusword = CSR_READ_4(sc, BGE_MAC_STS) & BGE_MACSTAT_LINK_CHANGED;
4706 
4707 	/* Make sure the descriptor ring indexes are coherent. */
4708 	bus_dmamap_sync(sc->bge_cdata.bge_status_tag,
4709 	    sc->bge_cdata.bge_status_map,
4710 	    BUS_DMASYNC_POSTREAD | BUS_DMASYNC_POSTWRITE);
4711 	rx_prod = sc->bge_ldata.bge_status_block->bge_idx[0].bge_rx_prod_idx;
4712 	tx_cons = sc->bge_ldata.bge_status_block->bge_idx[0].bge_tx_cons_idx;
4713 	sc->bge_ldata.bge_status_block->bge_status = 0;
4714 	bus_dmamap_sync(sc->bge_cdata.bge_status_tag,
4715 	    sc->bge_cdata.bge_status_map,
4716 	    BUS_DMASYNC_PREREAD | BUS_DMASYNC_PREWRITE);
4717 
4718 	if ((sc->bge_asicrev == BGE_ASICREV_BCM5700 &&
4719 	    sc->bge_chipid != BGE_CHIPID_BCM5700_B2) ||
4720 	    statusword || sc->bge_link_evt)
4721 		bge_link_upd(sc);
4722 
4723 	if (if_getdrvflags(ifp) & IFF_DRV_RUNNING) {
4724 		/* Check RX return ring producer/consumer. */
4725 		bge_rxeof(sc, rx_prod, 1);
4726 	}
4727 
4728 	if (if_getdrvflags(ifp) & IFF_DRV_RUNNING) {
4729 		/* Check TX ring producer/consumer. */
4730 		bge_txeof(sc, tx_cons);
4731 	}
4732 
4733 	if (if_getdrvflags(ifp) & IFF_DRV_RUNNING &&
4734 	    !if_sendq_empty(ifp))
4735 		bge_start_locked(ifp);
4736 
4737 	BGE_UNLOCK(sc);
4738 }
4739 
4740 static void
4741 bge_asf_driver_up(struct bge_softc *sc)
4742 {
4743 	if (sc->bge_asf_mode & ASF_STACKUP) {
4744 		/* Send ASF heartbeat aprox. every 2s */
4745 		if (sc->bge_asf_count)
4746 			sc->bge_asf_count --;
4747 		else {
4748 			sc->bge_asf_count = 2;
4749 			bge_writemem_ind(sc, BGE_SRAM_FW_CMD_MB,
4750 			    BGE_FW_CMD_DRV_ALIVE);
4751 			bge_writemem_ind(sc, BGE_SRAM_FW_CMD_LEN_MB, 4);
4752 			bge_writemem_ind(sc, BGE_SRAM_FW_CMD_DATA_MB,
4753 			    BGE_FW_HB_TIMEOUT_SEC);
4754 			CSR_WRITE_4(sc, BGE_RX_CPU_EVENT,
4755 			    CSR_READ_4(sc, BGE_RX_CPU_EVENT) |
4756 			    BGE_RX_CPU_DRV_EVENT);
4757 		}
4758 	}
4759 }
4760 
4761 static void
4762 bge_tick(void *xsc)
4763 {
4764 	struct bge_softc *sc = xsc;
4765 	struct mii_data *mii = NULL;
4766 
4767 	BGE_LOCK_ASSERT(sc);
4768 
4769 	/* Synchronize with possible callout reset/stop. */
4770 	if (callout_pending(&sc->bge_stat_ch) ||
4771 	    !callout_active(&sc->bge_stat_ch))
4772 		return;
4773 
4774 	if (BGE_IS_5705_PLUS(sc))
4775 		bge_stats_update_regs(sc);
4776 	else
4777 		bge_stats_update(sc);
4778 
4779 	/* XXX Add APE heartbeat check here? */
4780 
4781 	if ((sc->bge_flags & BGE_FLAG_TBI) == 0) {
4782 		mii = device_get_softc(sc->bge_miibus);
4783 		/*
4784 		 * Do not touch PHY if we have link up. This could break
4785 		 * IPMI/ASF mode or produce extra input errors
4786 		 * (extra errors was reported for bcm5701 & bcm5704).
4787 		 */
4788 		if (!sc->bge_link)
4789 			mii_tick(mii);
4790 	} else {
4791 		/*
4792 		 * Since in TBI mode auto-polling can't be used we should poll
4793 		 * link status manually. Here we register pending link event
4794 		 * and trigger interrupt.
4795 		 */
4796 #ifdef DEVICE_POLLING
4797 		/* In polling mode we poll link state in bge_poll(). */
4798 		if (!(if_getcapenable(sc->bge_ifp) & IFCAP_POLLING))
4799 #endif
4800 		{
4801 		sc->bge_link_evt++;
4802 		if (sc->bge_asicrev == BGE_ASICREV_BCM5700 ||
4803 		    sc->bge_flags & BGE_FLAG_5788)
4804 			BGE_SETBIT(sc, BGE_MISC_LOCAL_CTL, BGE_MLC_INTR_SET);
4805 		else
4806 			BGE_SETBIT(sc, BGE_HCC_MODE, BGE_HCCMODE_COAL_NOW);
4807 		}
4808 	}
4809 
4810 	bge_asf_driver_up(sc);
4811 	bge_watchdog(sc);
4812 
4813 	callout_reset(&sc->bge_stat_ch, hz, bge_tick, sc);
4814 }
4815 
4816 static void
4817 bge_stats_update_regs(struct bge_softc *sc)
4818 {
4819 	if_t ifp;
4820 	struct bge_mac_stats *stats;
4821 	uint32_t val;
4822 
4823 	ifp = sc->bge_ifp;
4824 	stats = &sc->bge_mac_stats;
4825 
4826 	stats->ifHCOutOctets +=
4827 	    CSR_READ_4(sc, BGE_TX_MAC_STATS_OCTETS);
4828 	stats->etherStatsCollisions +=
4829 	    CSR_READ_4(sc, BGE_TX_MAC_STATS_COLLS);
4830 	stats->outXonSent +=
4831 	    CSR_READ_4(sc, BGE_TX_MAC_STATS_XON_SENT);
4832 	stats->outXoffSent +=
4833 	    CSR_READ_4(sc, BGE_TX_MAC_STATS_XOFF_SENT);
4834 	stats->dot3StatsInternalMacTransmitErrors +=
4835 	    CSR_READ_4(sc, BGE_TX_MAC_STATS_ERRORS);
4836 	stats->dot3StatsSingleCollisionFrames +=
4837 	    CSR_READ_4(sc, BGE_TX_MAC_STATS_SINGLE_COLL);
4838 	stats->dot3StatsMultipleCollisionFrames +=
4839 	    CSR_READ_4(sc, BGE_TX_MAC_STATS_MULTI_COLL);
4840 	stats->dot3StatsDeferredTransmissions +=
4841 	    CSR_READ_4(sc, BGE_TX_MAC_STATS_DEFERRED);
4842 	stats->dot3StatsExcessiveCollisions +=
4843 	    CSR_READ_4(sc, BGE_TX_MAC_STATS_EXCESS_COLL);
4844 	stats->dot3StatsLateCollisions +=
4845 	    CSR_READ_4(sc, BGE_TX_MAC_STATS_LATE_COLL);
4846 	stats->ifHCOutUcastPkts +=
4847 	    CSR_READ_4(sc, BGE_TX_MAC_STATS_UCAST);
4848 	stats->ifHCOutMulticastPkts +=
4849 	    CSR_READ_4(sc, BGE_TX_MAC_STATS_MCAST);
4850 	stats->ifHCOutBroadcastPkts +=
4851 	    CSR_READ_4(sc, BGE_TX_MAC_STATS_BCAST);
4852 
4853 	stats->ifHCInOctets +=
4854 	    CSR_READ_4(sc, BGE_RX_MAC_STATS_OCTESTS);
4855 	stats->etherStatsFragments +=
4856 	    CSR_READ_4(sc, BGE_RX_MAC_STATS_FRAGMENTS);
4857 	stats->ifHCInUcastPkts +=
4858 	    CSR_READ_4(sc, BGE_RX_MAC_STATS_UCAST);
4859 	stats->ifHCInMulticastPkts +=
4860 	    CSR_READ_4(sc, BGE_RX_MAC_STATS_MCAST);
4861 	stats->ifHCInBroadcastPkts +=
4862 	    CSR_READ_4(sc, BGE_RX_MAC_STATS_BCAST);
4863 	stats->dot3StatsFCSErrors +=
4864 	    CSR_READ_4(sc, BGE_RX_MAC_STATS_FCS_ERRORS);
4865 	stats->dot3StatsAlignmentErrors +=
4866 	    CSR_READ_4(sc, BGE_RX_MAC_STATS_ALGIN_ERRORS);
4867 	stats->xonPauseFramesReceived +=
4868 	    CSR_READ_4(sc, BGE_RX_MAC_STATS_XON_RCVD);
4869 	stats->xoffPauseFramesReceived +=
4870 	    CSR_READ_4(sc, BGE_RX_MAC_STATS_XOFF_RCVD);
4871 	stats->macControlFramesReceived +=
4872 	    CSR_READ_4(sc, BGE_RX_MAC_STATS_CTRL_RCVD);
4873 	stats->xoffStateEntered +=
4874 	    CSR_READ_4(sc, BGE_RX_MAC_STATS_XOFF_ENTERED);
4875 	stats->dot3StatsFramesTooLong +=
4876 	    CSR_READ_4(sc, BGE_RX_MAC_STATS_FRAME_TOO_LONG);
4877 	stats->etherStatsJabbers +=
4878 	    CSR_READ_4(sc, BGE_RX_MAC_STATS_JABBERS);
4879 	stats->etherStatsUndersizePkts +=
4880 	    CSR_READ_4(sc, BGE_RX_MAC_STATS_UNDERSIZE);
4881 
4882 	stats->FramesDroppedDueToFilters +=
4883 	    CSR_READ_4(sc, BGE_RXLP_LOCSTAT_FILTDROP);
4884 	stats->DmaWriteQueueFull +=
4885 	    CSR_READ_4(sc, BGE_RXLP_LOCSTAT_DMA_WRQ_FULL);
4886 	stats->DmaWriteHighPriQueueFull +=
4887 	    CSR_READ_4(sc, BGE_RXLP_LOCSTAT_DMA_HPWRQ_FULL);
4888 	stats->NoMoreRxBDs +=
4889 	    CSR_READ_4(sc, BGE_RXLP_LOCSTAT_OUT_OF_BDS);
4890 	/*
4891 	 * XXX
4892 	 * Unlike other controllers, BGE_RXLP_LOCSTAT_IFIN_DROPS
4893 	 * counter of BCM5717, BCM5718, BCM5719 A0 and BCM5720 A0
4894 	 * includes number of unwanted multicast frames.  This comes
4895 	 * from silicon bug and known workaround to get rough(not
4896 	 * exact) counter is to enable interrupt on MBUF low water
4897 	 * attention.  This can be accomplished by setting
4898 	 * BGE_HCCMODE_ATTN bit of BGE_HCC_MODE,
4899 	 * BGE_BMANMODE_LOMBUF_ATTN bit of BGE_BMAN_MODE and
4900 	 * BGE_MODECTL_FLOWCTL_ATTN_INTR bit of BGE_MODE_CTL.
4901 	 * However that change would generate more interrupts and
4902 	 * there are still possibilities of losing multiple frames
4903 	 * during BGE_MODECTL_FLOWCTL_ATTN_INTR interrupt handling.
4904 	 * Given that the workaround still would not get correct
4905 	 * counter I don't think it's worth to implement it.  So
4906 	 * ignore reading the counter on controllers that have the
4907 	 * silicon bug.
4908 	 */
4909 	if (sc->bge_asicrev != BGE_ASICREV_BCM5717 &&
4910 	    sc->bge_chipid != BGE_CHIPID_BCM5719_A0 &&
4911 	    sc->bge_chipid != BGE_CHIPID_BCM5720_A0)
4912 		stats->InputDiscards +=
4913 		    CSR_READ_4(sc, BGE_RXLP_LOCSTAT_IFIN_DROPS);
4914 	stats->InputErrors +=
4915 	    CSR_READ_4(sc, BGE_RXLP_LOCSTAT_IFIN_ERRORS);
4916 	stats->RecvThresholdHit +=
4917 	    CSR_READ_4(sc, BGE_RXLP_LOCSTAT_RXTHRESH_HIT);
4918 
4919 	if (sc->bge_flags & BGE_FLAG_RDMA_BUG) {
4920 		/*
4921 		 * If controller transmitted more than BGE_NUM_RDMA_CHANNELS
4922 		 * frames, it's safe to disable workaround for DMA engine's
4923 		 * miscalculation of TXMBUF space.
4924 		 */
4925 		if (stats->ifHCOutUcastPkts + stats->ifHCOutMulticastPkts +
4926 		    stats->ifHCOutBroadcastPkts > BGE_NUM_RDMA_CHANNELS) {
4927 			val = CSR_READ_4(sc, BGE_RDMA_LSO_CRPTEN_CTRL);
4928 			if (sc->bge_asicrev == BGE_ASICREV_BCM5719)
4929 				val &= ~BGE_RDMA_TX_LENGTH_WA_5719;
4930 			else
4931 				val &= ~BGE_RDMA_TX_LENGTH_WA_5720;
4932 			CSR_WRITE_4(sc, BGE_RDMA_LSO_CRPTEN_CTRL, val);
4933 			sc->bge_flags &= ~BGE_FLAG_RDMA_BUG;
4934 		}
4935 	}
4936 }
4937 
4938 static void
4939 bge_stats_clear_regs(struct bge_softc *sc)
4940 {
4941 
4942 	CSR_READ_4(sc, BGE_TX_MAC_STATS_OCTETS);
4943 	CSR_READ_4(sc, BGE_TX_MAC_STATS_COLLS);
4944 	CSR_READ_4(sc, BGE_TX_MAC_STATS_XON_SENT);
4945 	CSR_READ_4(sc, BGE_TX_MAC_STATS_XOFF_SENT);
4946 	CSR_READ_4(sc, BGE_TX_MAC_STATS_ERRORS);
4947 	CSR_READ_4(sc, BGE_TX_MAC_STATS_SINGLE_COLL);
4948 	CSR_READ_4(sc, BGE_TX_MAC_STATS_MULTI_COLL);
4949 	CSR_READ_4(sc, BGE_TX_MAC_STATS_DEFERRED);
4950 	CSR_READ_4(sc, BGE_TX_MAC_STATS_EXCESS_COLL);
4951 	CSR_READ_4(sc, BGE_TX_MAC_STATS_LATE_COLL);
4952 	CSR_READ_4(sc, BGE_TX_MAC_STATS_UCAST);
4953 	CSR_READ_4(sc, BGE_TX_MAC_STATS_MCAST);
4954 	CSR_READ_4(sc, BGE_TX_MAC_STATS_BCAST);
4955 
4956 	CSR_READ_4(sc, BGE_RX_MAC_STATS_OCTESTS);
4957 	CSR_READ_4(sc, BGE_RX_MAC_STATS_FRAGMENTS);
4958 	CSR_READ_4(sc, BGE_RX_MAC_STATS_UCAST);
4959 	CSR_READ_4(sc, BGE_RX_MAC_STATS_MCAST);
4960 	CSR_READ_4(sc, BGE_RX_MAC_STATS_BCAST);
4961 	CSR_READ_4(sc, BGE_RX_MAC_STATS_FCS_ERRORS);
4962 	CSR_READ_4(sc, BGE_RX_MAC_STATS_ALGIN_ERRORS);
4963 	CSR_READ_4(sc, BGE_RX_MAC_STATS_XON_RCVD);
4964 	CSR_READ_4(sc, BGE_RX_MAC_STATS_XOFF_RCVD);
4965 	CSR_READ_4(sc, BGE_RX_MAC_STATS_CTRL_RCVD);
4966 	CSR_READ_4(sc, BGE_RX_MAC_STATS_XOFF_ENTERED);
4967 	CSR_READ_4(sc, BGE_RX_MAC_STATS_FRAME_TOO_LONG);
4968 	CSR_READ_4(sc, BGE_RX_MAC_STATS_JABBERS);
4969 	CSR_READ_4(sc, BGE_RX_MAC_STATS_UNDERSIZE);
4970 
4971 	CSR_READ_4(sc, BGE_RXLP_LOCSTAT_FILTDROP);
4972 	CSR_READ_4(sc, BGE_RXLP_LOCSTAT_DMA_WRQ_FULL);
4973 	CSR_READ_4(sc, BGE_RXLP_LOCSTAT_DMA_HPWRQ_FULL);
4974 	CSR_READ_4(sc, BGE_RXLP_LOCSTAT_OUT_OF_BDS);
4975 	CSR_READ_4(sc, BGE_RXLP_LOCSTAT_IFIN_DROPS);
4976 	CSR_READ_4(sc, BGE_RXLP_LOCSTAT_IFIN_ERRORS);
4977 	CSR_READ_4(sc, BGE_RXLP_LOCSTAT_RXTHRESH_HIT);
4978 }
4979 
4980 static void
4981 bge_stats_update(struct bge_softc *sc)
4982 {
4983 	if_t ifp;
4984 	bus_size_t stats;
4985 	uint32_t cnt;	/* current register value */
4986 
4987 	ifp = sc->bge_ifp;
4988 
4989 	stats = BGE_MEMWIN_START + BGE_STATS_BLOCK;
4990 
4991 #define	READ_STAT(sc, stats, stat) \
4992 	CSR_READ_4(sc, stats + offsetof(struct bge_stats, stat))
4993 
4994 	cnt = READ_STAT(sc, stats, txstats.etherStatsCollisions.bge_addr_lo);
4995 	if_inc_counter(ifp, IFCOUNTER_COLLISIONS, cnt - sc->bge_tx_collisions);
4996 	sc->bge_tx_collisions = cnt;
4997 
4998 	cnt = READ_STAT(sc, stats, nicNoMoreRxBDs.bge_addr_lo);
4999 	if_inc_counter(ifp, IFCOUNTER_IERRORS, cnt - sc->bge_rx_nobds);
5000 	sc->bge_rx_nobds = cnt;
5001 	cnt = READ_STAT(sc, stats, ifInErrors.bge_addr_lo);
5002 	if_inc_counter(ifp, IFCOUNTER_IERRORS, cnt - sc->bge_rx_inerrs);
5003 	sc->bge_rx_inerrs = cnt;
5004 	cnt = READ_STAT(sc, stats, ifInDiscards.bge_addr_lo);
5005 	if_inc_counter(ifp, IFCOUNTER_IERRORS, cnt - sc->bge_rx_discards);
5006 	sc->bge_rx_discards = cnt;
5007 
5008 	cnt = READ_STAT(sc, stats, txstats.ifOutDiscards.bge_addr_lo);
5009 	if_inc_counter(ifp, IFCOUNTER_OERRORS, cnt - sc->bge_tx_discards);
5010 	sc->bge_tx_discards = cnt;
5011 
5012 #undef	READ_STAT
5013 }
5014 
5015 /*
5016  * Pad outbound frame to ETHER_MIN_NOPAD for an unusual reason.
5017  * The bge hardware will pad out Tx runts to ETHER_MIN_NOPAD,
5018  * but when such padded frames employ the bge IP/TCP checksum offload,
5019  * the hardware checksum assist gives incorrect results (possibly
5020  * from incorporating its own padding into the UDP/TCP checksum; who knows).
5021  * If we pad such runts with zeros, the onboard checksum comes out correct.
5022  */
5023 static __inline int
5024 bge_cksum_pad(struct mbuf *m)
5025 {
5026 	int padlen = ETHER_MIN_NOPAD - m->m_pkthdr.len;
5027 	struct mbuf *last;
5028 
5029 	/* If there's only the packet-header and we can pad there, use it. */
5030 	if (m->m_pkthdr.len == m->m_len && M_WRITABLE(m) &&
5031 	    M_TRAILINGSPACE(m) >= padlen) {
5032 		last = m;
5033 	} else {
5034 		/*
5035 		 * Walk packet chain to find last mbuf. We will either
5036 		 * pad there, or append a new mbuf and pad it.
5037 		 */
5038 		for (last = m; last->m_next != NULL; last = last->m_next);
5039 		if (!(M_WRITABLE(last) && M_TRAILINGSPACE(last) >= padlen)) {
5040 			/* Allocate new empty mbuf, pad it. Compact later. */
5041 			struct mbuf *n;
5042 
5043 			MGET(n, M_NOWAIT, MT_DATA);
5044 			if (n == NULL)
5045 				return (ENOBUFS);
5046 			n->m_len = 0;
5047 			last->m_next = n;
5048 			last = n;
5049 		}
5050 	}
5051 
5052 	/* Now zero the pad area, to avoid the bge cksum-assist bug. */
5053 	memset(mtod(last, caddr_t) + last->m_len, 0, padlen);
5054 	last->m_len += padlen;
5055 	m->m_pkthdr.len += padlen;
5056 
5057 	return (0);
5058 }
5059 
5060 static struct mbuf *
5061 bge_check_short_dma(struct mbuf *m)
5062 {
5063 	struct mbuf *n;
5064 	int found;
5065 
5066 	/*
5067 	 * If device receive two back-to-back send BDs with less than
5068 	 * or equal to 8 total bytes then the device may hang.  The two
5069 	 * back-to-back send BDs must in the same frame for this failure
5070 	 * to occur.  Scan mbuf chains and see whether two back-to-back
5071 	 * send BDs are there. If this is the case, allocate new mbuf
5072 	 * and copy the frame to workaround the silicon bug.
5073 	 */
5074 	for (n = m, found = 0; n != NULL; n = n->m_next) {
5075 		if (n->m_len < 8) {
5076 			found++;
5077 			if (found > 1)
5078 				break;
5079 			continue;
5080 		}
5081 		found = 0;
5082 	}
5083 
5084 	if (found > 1) {
5085 		n = m_defrag(m, M_NOWAIT);
5086 		if (n == NULL)
5087 			m_freem(m);
5088 	} else
5089 		n = m;
5090 	return (n);
5091 }
5092 
5093 static struct mbuf *
5094 bge_setup_tso(struct bge_softc *sc, struct mbuf *m, uint16_t *mss,
5095     uint16_t *flags)
5096 {
5097 	struct ip *ip;
5098 	struct tcphdr *tcp;
5099 	struct mbuf *n;
5100 	uint16_t hlen;
5101 	uint32_t poff;
5102 
5103 	if (M_WRITABLE(m) == 0) {
5104 		/* Get a writable copy. */
5105 		n = m_dup(m, M_NOWAIT);
5106 		m_freem(m);
5107 		if (n == NULL)
5108 			return (NULL);
5109 		m = n;
5110 	}
5111 	m = m_pullup(m, sizeof(struct ether_header) + sizeof(struct ip));
5112 	if (m == NULL)
5113 		return (NULL);
5114 	ip = (struct ip *)(mtod(m, char *) + sizeof(struct ether_header));
5115 	poff = sizeof(struct ether_header) + (ip->ip_hl << 2);
5116 	m = m_pullup(m, poff + sizeof(struct tcphdr));
5117 	if (m == NULL)
5118 		return (NULL);
5119 	tcp = (struct tcphdr *)(mtod(m, char *) + poff);
5120 	m = m_pullup(m, poff + (tcp->th_off << 2));
5121 	if (m == NULL)
5122 		return (NULL);
5123 	/*
5124 	 * It seems controller doesn't modify IP length and TCP pseudo
5125 	 * checksum. These checksum computed by upper stack should be 0.
5126 	 */
5127 	*mss = m->m_pkthdr.tso_segsz;
5128 	ip = (struct ip *)(mtod(m, char *) + sizeof(struct ether_header));
5129 	ip->ip_sum = 0;
5130 	ip->ip_len = htons(*mss + (ip->ip_hl << 2) + (tcp->th_off << 2));
5131 	/* Clear pseudo checksum computed by TCP stack. */
5132 	tcp = (struct tcphdr *)(mtod(m, char *) + poff);
5133 	tcp->th_sum = 0;
5134 	/*
5135 	 * Broadcom controllers uses different descriptor format for
5136 	 * TSO depending on ASIC revision. Due to TSO-capable firmware
5137 	 * license issue and lower performance of firmware based TSO
5138 	 * we only support hardware based TSO.
5139 	 */
5140 	/* Calculate header length, incl. TCP/IP options, in 32 bit units. */
5141 	hlen = ((ip->ip_hl << 2) + (tcp->th_off << 2)) >> 2;
5142 	if (sc->bge_flags & BGE_FLAG_TSO3) {
5143 		/*
5144 		 * For BCM5717 and newer controllers, hardware based TSO
5145 		 * uses the 14 lower bits of the bge_mss field to store the
5146 		 * MSS and the upper 2 bits to store the lowest 2 bits of
5147 		 * the IP/TCP header length.  The upper 6 bits of the header
5148 		 * length are stored in the bge_flags[14:10,4] field.  Jumbo
5149 		 * frames are supported.
5150 		 */
5151 		*mss |= ((hlen & 0x3) << 14);
5152 		*flags |= ((hlen & 0xF8) << 7) | ((hlen & 0x4) << 2);
5153 	} else {
5154 		/*
5155 		 * For BCM5755 and newer controllers, hardware based TSO uses
5156 		 * the lower 11	bits to store the MSS and the upper 5 bits to
5157 		 * store the IP/TCP header length. Jumbo frames are not
5158 		 * supported.
5159 		 */
5160 		*mss |= (hlen << 11);
5161 	}
5162 	return (m);
5163 }
5164 
5165 /*
5166  * Encapsulate an mbuf chain in the tx ring  by coupling the mbuf data
5167  * pointers to descriptors.
5168  */
5169 static int
5170 bge_encap(struct bge_softc *sc, struct mbuf **m_head, uint32_t *txidx)
5171 {
5172 	bus_dma_segment_t	segs[BGE_NSEG_NEW];
5173 	bus_dmamap_t		map;
5174 	struct bge_tx_bd	*d;
5175 	struct mbuf		*m = *m_head;
5176 	uint32_t		idx = *txidx;
5177 	uint16_t		csum_flags, mss, vlan_tag;
5178 	int			nsegs, i, error;
5179 
5180 	csum_flags = 0;
5181 	mss = 0;
5182 	vlan_tag = 0;
5183 	if ((sc->bge_flags & BGE_FLAG_SHORT_DMA_BUG) != 0 &&
5184 	    m->m_next != NULL) {
5185 		*m_head = bge_check_short_dma(m);
5186 		if (*m_head == NULL)
5187 			return (ENOBUFS);
5188 		m = *m_head;
5189 	}
5190 	if ((m->m_pkthdr.csum_flags & CSUM_TSO) != 0) {
5191 		*m_head = m = bge_setup_tso(sc, m, &mss, &csum_flags);
5192 		if (*m_head == NULL)
5193 			return (ENOBUFS);
5194 		csum_flags |= BGE_TXBDFLAG_CPU_PRE_DMA |
5195 		    BGE_TXBDFLAG_CPU_POST_DMA;
5196 	} else if ((m->m_pkthdr.csum_flags & sc->bge_csum_features) != 0) {
5197 		if (m->m_pkthdr.csum_flags & CSUM_IP)
5198 			csum_flags |= BGE_TXBDFLAG_IP_CSUM;
5199 		if (m->m_pkthdr.csum_flags & (CSUM_TCP | CSUM_UDP)) {
5200 			csum_flags |= BGE_TXBDFLAG_TCP_UDP_CSUM;
5201 			if (m->m_pkthdr.len < ETHER_MIN_NOPAD &&
5202 			    (error = bge_cksum_pad(m)) != 0) {
5203 				m_freem(m);
5204 				*m_head = NULL;
5205 				return (error);
5206 			}
5207 		}
5208 	}
5209 
5210 	if ((m->m_pkthdr.csum_flags & CSUM_TSO) == 0) {
5211 		if (sc->bge_flags & BGE_FLAG_JUMBO_FRAME &&
5212 		    m->m_pkthdr.len > ETHER_MAX_LEN)
5213 			csum_flags |= BGE_TXBDFLAG_JUMBO_FRAME;
5214 		if (sc->bge_forced_collapse > 0 &&
5215 		    (sc->bge_flags & BGE_FLAG_PCIE) != 0 && m->m_next != NULL) {
5216 			/*
5217 			 * Forcedly collapse mbuf chains to overcome hardware
5218 			 * limitation which only support a single outstanding
5219 			 * DMA read operation.
5220 			 */
5221 			if (sc->bge_forced_collapse == 1)
5222 				m = m_defrag(m, M_NOWAIT);
5223 			else
5224 				m = m_collapse(m, M_NOWAIT,
5225 				    sc->bge_forced_collapse);
5226 			if (m == NULL)
5227 				m = *m_head;
5228 			*m_head = m;
5229 		}
5230 	}
5231 
5232 	map = sc->bge_cdata.bge_tx_dmamap[idx];
5233 	error = bus_dmamap_load_mbuf_sg(sc->bge_cdata.bge_tx_mtag, map, m, segs,
5234 	    &nsegs, BUS_DMA_NOWAIT);
5235 	if (error == EFBIG) {
5236 		m = m_collapse(m, M_NOWAIT, BGE_NSEG_NEW);
5237 		if (m == NULL) {
5238 			m_freem(*m_head);
5239 			*m_head = NULL;
5240 			return (ENOBUFS);
5241 		}
5242 		*m_head = m;
5243 		error = bus_dmamap_load_mbuf_sg(sc->bge_cdata.bge_tx_mtag, map,
5244 		    m, segs, &nsegs, BUS_DMA_NOWAIT);
5245 		if (error) {
5246 			m_freem(m);
5247 			*m_head = NULL;
5248 			return (error);
5249 		}
5250 	} else if (error != 0)
5251 		return (error);
5252 
5253 	/* Check if we have enough free send BDs. */
5254 	if (sc->bge_txcnt + nsegs >= BGE_TX_RING_CNT) {
5255 		bus_dmamap_unload(sc->bge_cdata.bge_tx_mtag, map);
5256 		return (ENOBUFS);
5257 	}
5258 
5259 	bus_dmamap_sync(sc->bge_cdata.bge_tx_mtag, map, BUS_DMASYNC_PREWRITE);
5260 
5261 	if (m->m_flags & M_VLANTAG) {
5262 		csum_flags |= BGE_TXBDFLAG_VLAN_TAG;
5263 		vlan_tag = m->m_pkthdr.ether_vtag;
5264 	}
5265 
5266 	if (sc->bge_asicrev == BGE_ASICREV_BCM5762 &&
5267 	    (m->m_pkthdr.csum_flags & CSUM_TSO) != 0) {
5268 		/*
5269 		 * 5725 family of devices corrupts TSO packets when TSO DMA
5270 		 * buffers cross into regions which are within MSS bytes of
5271 		 * a 4GB boundary.  If we encounter the condition, drop the
5272 		 * packet.
5273 		 */
5274 		for (i = 0; ; i++) {
5275 			d = &sc->bge_ldata.bge_tx_ring[idx];
5276 			d->bge_addr.bge_addr_lo = BGE_ADDR_LO(segs[i].ds_addr);
5277 			d->bge_addr.bge_addr_hi = BGE_ADDR_HI(segs[i].ds_addr);
5278 			d->bge_len = segs[i].ds_len;
5279 			if (d->bge_addr.bge_addr_lo + segs[i].ds_len + mss <
5280 			    d->bge_addr.bge_addr_lo)
5281 				break;
5282 			d->bge_flags = csum_flags;
5283 			d->bge_vlan_tag = vlan_tag;
5284 			d->bge_mss = mss;
5285 			if (i == nsegs - 1)
5286 				break;
5287 			BGE_INC(idx, BGE_TX_RING_CNT);
5288 		}
5289 		if (i != nsegs - 1) {
5290 			bus_dmamap_sync(sc->bge_cdata.bge_tx_mtag, map,
5291 			    BUS_DMASYNC_POSTWRITE);
5292 			bus_dmamap_unload(sc->bge_cdata.bge_tx_mtag, map);
5293 			m_freem(*m_head);
5294 			*m_head = NULL;
5295 			return (EIO);
5296 		}
5297 	} else {
5298 		for (i = 0; ; i++) {
5299 			d = &sc->bge_ldata.bge_tx_ring[idx];
5300 			d->bge_addr.bge_addr_lo = BGE_ADDR_LO(segs[i].ds_addr);
5301 			d->bge_addr.bge_addr_hi = BGE_ADDR_HI(segs[i].ds_addr);
5302 			d->bge_len = segs[i].ds_len;
5303 			d->bge_flags = csum_flags;
5304 			d->bge_vlan_tag = vlan_tag;
5305 			d->bge_mss = mss;
5306 			if (i == nsegs - 1)
5307 				break;
5308 			BGE_INC(idx, BGE_TX_RING_CNT);
5309 		}
5310 	}
5311 
5312 	/* Mark the last segment as end of packet... */
5313 	d->bge_flags |= BGE_TXBDFLAG_END;
5314 
5315 	/*
5316 	 * Insure that the map for this transmission
5317 	 * is placed at the array index of the last descriptor
5318 	 * in this chain.
5319 	 */
5320 	sc->bge_cdata.bge_tx_dmamap[*txidx] = sc->bge_cdata.bge_tx_dmamap[idx];
5321 	sc->bge_cdata.bge_tx_dmamap[idx] = map;
5322 	sc->bge_cdata.bge_tx_chain[idx] = m;
5323 	sc->bge_txcnt += nsegs;
5324 
5325 	BGE_INC(idx, BGE_TX_RING_CNT);
5326 	*txidx = idx;
5327 
5328 	return (0);
5329 }
5330 
5331 /*
5332  * Main transmit routine. To avoid having to do mbuf copies, we put pointers
5333  * to the mbuf data regions directly in the transmit descriptors.
5334  */
5335 static void
5336 bge_start_locked(if_t ifp)
5337 {
5338 	struct bge_softc *sc;
5339 	struct mbuf *m_head;
5340 	uint32_t prodidx;
5341 	int count;
5342 
5343 	sc = if_getsoftc(ifp);
5344 	BGE_LOCK_ASSERT(sc);
5345 
5346 	if (!sc->bge_link ||
5347 	    (if_getdrvflags(ifp) & (IFF_DRV_RUNNING | IFF_DRV_OACTIVE)) !=
5348 	    IFF_DRV_RUNNING)
5349 		return;
5350 
5351 	prodidx = sc->bge_tx_prodidx;
5352 
5353 	for (count = 0; !if_sendq_empty(ifp);) {
5354 		if (sc->bge_txcnt > BGE_TX_RING_CNT - 16) {
5355 			if_setdrvflagbits(ifp, IFF_DRV_OACTIVE, 0);
5356 			break;
5357 		}
5358 		m_head = if_dequeue(ifp);
5359 		if (m_head == NULL)
5360 			break;
5361 
5362 		/*
5363 		 * Pack the data into the transmit ring. If we
5364 		 * don't have room, set the OACTIVE flag and wait
5365 		 * for the NIC to drain the ring.
5366 		 */
5367 		if (bge_encap(sc, &m_head, &prodidx)) {
5368 			if (m_head == NULL)
5369 				break;
5370 			if_sendq_prepend(ifp, m_head);
5371 			if_setdrvflagbits(ifp, IFF_DRV_OACTIVE, 0);
5372 			break;
5373 		}
5374 		++count;
5375 
5376 		/*
5377 		 * If there's a BPF listener, bounce a copy of this frame
5378 		 * to him.
5379 		 */
5380 		if_bpfmtap(ifp, m_head);
5381 	}
5382 
5383 	if (count > 0)
5384 		bge_start_tx(sc, prodidx);
5385 }
5386 
5387 static void
5388 bge_start_tx(struct bge_softc *sc, uint32_t prodidx)
5389 {
5390 
5391 	bus_dmamap_sync(sc->bge_cdata.bge_tx_ring_tag,
5392 	    sc->bge_cdata.bge_tx_ring_map, BUS_DMASYNC_PREWRITE);
5393 	/* Transmit. */
5394 	bge_writembx(sc, BGE_MBX_TX_HOST_PROD0_LO, prodidx);
5395 	/* 5700 b2 errata */
5396 	if (sc->bge_chiprev == BGE_CHIPREV_5700_BX)
5397 		bge_writembx(sc, BGE_MBX_TX_HOST_PROD0_LO, prodidx);
5398 
5399 	sc->bge_tx_prodidx = prodidx;
5400 
5401 	/* Set a timeout in case the chip goes out to lunch. */
5402 	sc->bge_timer = BGE_TX_TIMEOUT;
5403 }
5404 
5405 /*
5406  * Main transmit routine. To avoid having to do mbuf copies, we put pointers
5407  * to the mbuf data regions directly in the transmit descriptors.
5408  */
5409 static void
5410 bge_start(if_t ifp)
5411 {
5412 	struct bge_softc *sc;
5413 
5414 	sc = if_getsoftc(ifp);
5415 	BGE_LOCK(sc);
5416 	bge_start_locked(ifp);
5417 	BGE_UNLOCK(sc);
5418 }
5419 
5420 static void
5421 bge_init_locked(struct bge_softc *sc)
5422 {
5423 	if_t ifp;
5424 	uint16_t *m;
5425 	uint32_t mode;
5426 
5427 	BGE_LOCK_ASSERT(sc);
5428 
5429 	ifp = sc->bge_ifp;
5430 
5431 	if (if_getdrvflags(ifp) & IFF_DRV_RUNNING)
5432 		return;
5433 
5434 	/* Cancel pending I/O and flush buffers. */
5435 	bge_stop(sc);
5436 
5437 	bge_stop_fw(sc);
5438 	bge_sig_pre_reset(sc, BGE_RESET_START);
5439 	bge_reset(sc);
5440 	bge_sig_legacy(sc, BGE_RESET_START);
5441 	bge_sig_post_reset(sc, BGE_RESET_START);
5442 
5443 	bge_chipinit(sc);
5444 
5445 	/*
5446 	 * Init the various state machines, ring
5447 	 * control blocks and firmware.
5448 	 */
5449 	if (bge_blockinit(sc)) {
5450 		device_printf(sc->bge_dev, "initialization failure\n");
5451 		return;
5452 	}
5453 
5454 	ifp = sc->bge_ifp;
5455 
5456 	/* Specify MTU. */
5457 	CSR_WRITE_4(sc, BGE_RX_MTU, if_getmtu(ifp) +
5458 	    ETHER_HDR_LEN + ETHER_CRC_LEN +
5459 	    (if_getcapenable(ifp) & IFCAP_VLAN_MTU ? ETHER_VLAN_ENCAP_LEN : 0));
5460 
5461 	/* Load our MAC address. */
5462 	m = (uint16_t *)IF_LLADDR(sc->bge_ifp);
5463 	CSR_WRITE_4(sc, BGE_MAC_ADDR1_LO, htons(m[0]));
5464 	CSR_WRITE_4(sc, BGE_MAC_ADDR1_HI, (htons(m[1]) << 16) | htons(m[2]));
5465 
5466 	/* Program promiscuous mode. */
5467 	bge_setpromisc(sc);
5468 
5469 	/* Program multicast filter. */
5470 	bge_setmulti(sc);
5471 
5472 	/* Program VLAN tag stripping. */
5473 	bge_setvlan(sc);
5474 
5475 	/* Override UDP checksum offloading. */
5476 	if (sc->bge_forced_udpcsum == 0)
5477 		sc->bge_csum_features &= ~CSUM_UDP;
5478 	else
5479 		sc->bge_csum_features |= CSUM_UDP;
5480 	if (if_getcapabilities(ifp) & IFCAP_TXCSUM &&
5481 	    if_getcapenable(ifp) & IFCAP_TXCSUM) {
5482 		if_sethwassistbits(ifp, 0, (BGE_CSUM_FEATURES | CSUM_UDP));
5483 		if_sethwassistbits(ifp, sc->bge_csum_features, 0);
5484 	}
5485 
5486 	/* Init RX ring. */
5487 	if (bge_init_rx_ring_std(sc) != 0) {
5488 		device_printf(sc->bge_dev, "no memory for std Rx buffers.\n");
5489 		bge_stop(sc);
5490 		return;
5491 	}
5492 
5493 	/*
5494 	 * Workaround for a bug in 5705 ASIC rev A0. Poll the NIC's
5495 	 * memory to insure that the chip has in fact read the first
5496 	 * entry of the ring.
5497 	 */
5498 	if (sc->bge_chipid == BGE_CHIPID_BCM5705_A0) {
5499 		uint32_t		v, i;
5500 		for (i = 0; i < 10; i++) {
5501 			DELAY(20);
5502 			v = bge_readmem_ind(sc, BGE_STD_RX_RINGS + 8);
5503 			if (v == (MCLBYTES - ETHER_ALIGN))
5504 				break;
5505 		}
5506 		if (i == 10)
5507 			device_printf (sc->bge_dev,
5508 			    "5705 A0 chip failed to load RX ring\n");
5509 	}
5510 
5511 	/* Init jumbo RX ring. */
5512 	if (BGE_IS_JUMBO_CAPABLE(sc) &&
5513 	    if_getmtu(ifp) + ETHER_HDR_LEN + ETHER_CRC_LEN +
5514      	    ETHER_VLAN_ENCAP_LEN > (MCLBYTES - ETHER_ALIGN)) {
5515 		if (bge_init_rx_ring_jumbo(sc) != 0) {
5516 			device_printf(sc->bge_dev,
5517 			    "no memory for jumbo Rx buffers.\n");
5518 			bge_stop(sc);
5519 			return;
5520 		}
5521 	}
5522 
5523 	/* Init our RX return ring index. */
5524 	sc->bge_rx_saved_considx = 0;
5525 
5526 	/* Init our RX/TX stat counters. */
5527 	sc->bge_rx_discards = sc->bge_tx_discards = sc->bge_tx_collisions = 0;
5528 
5529 	/* Init TX ring. */
5530 	bge_init_tx_ring(sc);
5531 
5532 	/* Enable TX MAC state machine lockup fix. */
5533 	mode = CSR_READ_4(sc, BGE_TX_MODE);
5534 	if (BGE_IS_5755_PLUS(sc) || sc->bge_asicrev == BGE_ASICREV_BCM5906)
5535 		mode |= BGE_TXMODE_MBUF_LOCKUP_FIX;
5536 	if (sc->bge_asicrev == BGE_ASICREV_BCM5720 ||
5537 	    sc->bge_asicrev == BGE_ASICREV_BCM5762) {
5538 		mode &= ~(BGE_TXMODE_JMB_FRM_LEN | BGE_TXMODE_CNT_DN_MODE);
5539 		mode |= CSR_READ_4(sc, BGE_TX_MODE) &
5540 		    (BGE_TXMODE_JMB_FRM_LEN | BGE_TXMODE_CNT_DN_MODE);
5541 	}
5542 	/* Turn on transmitter. */
5543 	CSR_WRITE_4(sc, BGE_TX_MODE, mode | BGE_TXMODE_ENABLE);
5544 	DELAY(100);
5545 
5546 	/* Turn on receiver. */
5547 	mode = CSR_READ_4(sc, BGE_RX_MODE);
5548 	if (BGE_IS_5755_PLUS(sc))
5549 		mode |= BGE_RXMODE_IPV6_ENABLE;
5550 	if (sc->bge_asicrev == BGE_ASICREV_BCM5762)
5551 		mode |= BGE_RXMODE_IPV4_FRAG_FIX;
5552 	CSR_WRITE_4(sc,BGE_RX_MODE, mode | BGE_RXMODE_ENABLE);
5553 	DELAY(10);
5554 
5555 	/*
5556 	 * Set the number of good frames to receive after RX MBUF
5557 	 * Low Watermark has been reached. After the RX MAC receives
5558 	 * this number of frames, it will drop subsequent incoming
5559 	 * frames until the MBUF High Watermark is reached.
5560 	 */
5561 	if (BGE_IS_57765_PLUS(sc))
5562 		CSR_WRITE_4(sc, BGE_MAX_RX_FRAME_LOWAT, 1);
5563 	else
5564 		CSR_WRITE_4(sc, BGE_MAX_RX_FRAME_LOWAT, 2);
5565 
5566 	/* Clear MAC statistics. */
5567 	if (BGE_IS_5705_PLUS(sc))
5568 		bge_stats_clear_regs(sc);
5569 
5570 	/* Tell firmware we're alive. */
5571 	BGE_SETBIT(sc, BGE_MODE_CTL, BGE_MODECTL_STACKUP);
5572 
5573 #ifdef DEVICE_POLLING
5574 	/* Disable interrupts if we are polling. */
5575 	if (if_getcapenable(ifp) & IFCAP_POLLING) {
5576 		BGE_SETBIT(sc, BGE_PCI_MISC_CTL,
5577 		    BGE_PCIMISCCTL_MASK_PCI_INTR);
5578 		bge_writembx(sc, BGE_MBX_IRQ0_LO, 1);
5579 	} else
5580 #endif
5581 
5582 	/* Enable host interrupts. */
5583 	{
5584 	BGE_SETBIT(sc, BGE_PCI_MISC_CTL, BGE_PCIMISCCTL_CLEAR_INTA);
5585 	BGE_CLRBIT(sc, BGE_PCI_MISC_CTL, BGE_PCIMISCCTL_MASK_PCI_INTR);
5586 	bge_writembx(sc, BGE_MBX_IRQ0_LO, 0);
5587 	}
5588 
5589 	if_setdrvflagbits(ifp, IFF_DRV_RUNNING, 0);
5590 	if_setdrvflagbits(ifp, 0, IFF_DRV_OACTIVE);
5591 
5592 	bge_ifmedia_upd_locked(ifp);
5593 
5594 	callout_reset(&sc->bge_stat_ch, hz, bge_tick, sc);
5595 }
5596 
5597 static void
5598 bge_init(void *xsc)
5599 {
5600 	struct bge_softc *sc = xsc;
5601 
5602 	BGE_LOCK(sc);
5603 	bge_init_locked(sc);
5604 	BGE_UNLOCK(sc);
5605 }
5606 
5607 /*
5608  * Set media options.
5609  */
5610 static int
5611 bge_ifmedia_upd(if_t ifp)
5612 {
5613 	struct bge_softc *sc = if_getsoftc(ifp);
5614 	int res;
5615 
5616 	BGE_LOCK(sc);
5617 	res = bge_ifmedia_upd_locked(ifp);
5618 	BGE_UNLOCK(sc);
5619 
5620 	return (res);
5621 }
5622 
5623 static int
5624 bge_ifmedia_upd_locked(if_t ifp)
5625 {
5626 	struct bge_softc *sc = if_getsoftc(ifp);
5627 	struct mii_data *mii;
5628 	struct mii_softc *miisc;
5629 	struct ifmedia *ifm;
5630 
5631 	BGE_LOCK_ASSERT(sc);
5632 
5633 	ifm = &sc->bge_ifmedia;
5634 
5635 	/* If this is a 1000baseX NIC, enable the TBI port. */
5636 	if (sc->bge_flags & BGE_FLAG_TBI) {
5637 		if (IFM_TYPE(ifm->ifm_media) != IFM_ETHER)
5638 			return (EINVAL);
5639 		switch(IFM_SUBTYPE(ifm->ifm_media)) {
5640 		case IFM_AUTO:
5641 			/*
5642 			 * The BCM5704 ASIC appears to have a special
5643 			 * mechanism for programming the autoneg
5644 			 * advertisement registers in TBI mode.
5645 			 */
5646 			if (sc->bge_asicrev == BGE_ASICREV_BCM5704) {
5647 				uint32_t sgdig;
5648 				sgdig = CSR_READ_4(sc, BGE_SGDIG_STS);
5649 				if (sgdig & BGE_SGDIGSTS_DONE) {
5650 					CSR_WRITE_4(sc, BGE_TX_TBI_AUTONEG, 0);
5651 					sgdig = CSR_READ_4(sc, BGE_SGDIG_CFG);
5652 					sgdig |= BGE_SGDIGCFG_AUTO |
5653 					    BGE_SGDIGCFG_PAUSE_CAP |
5654 					    BGE_SGDIGCFG_ASYM_PAUSE;
5655 					CSR_WRITE_4(sc, BGE_SGDIG_CFG,
5656 					    sgdig | BGE_SGDIGCFG_SEND);
5657 					DELAY(5);
5658 					CSR_WRITE_4(sc, BGE_SGDIG_CFG, sgdig);
5659 				}
5660 			}
5661 			break;
5662 		case IFM_1000_SX:
5663 			if ((ifm->ifm_media & IFM_GMASK) == IFM_FDX) {
5664 				BGE_CLRBIT(sc, BGE_MAC_MODE,
5665 				    BGE_MACMODE_HALF_DUPLEX);
5666 			} else {
5667 				BGE_SETBIT(sc, BGE_MAC_MODE,
5668 				    BGE_MACMODE_HALF_DUPLEX);
5669 			}
5670 			DELAY(40);
5671 			break;
5672 		default:
5673 			return (EINVAL);
5674 		}
5675 		return (0);
5676 	}
5677 
5678 	sc->bge_link_evt++;
5679 	mii = device_get_softc(sc->bge_miibus);
5680 	LIST_FOREACH(miisc, &mii->mii_phys, mii_list)
5681 		PHY_RESET(miisc);
5682 	mii_mediachg(mii);
5683 
5684 	/*
5685 	 * Force an interrupt so that we will call bge_link_upd
5686 	 * if needed and clear any pending link state attention.
5687 	 * Without this we are not getting any further interrupts
5688 	 * for link state changes and thus will not UP the link and
5689 	 * not be able to send in bge_start_locked. The only
5690 	 * way to get things working was to receive a packet and
5691 	 * get an RX intr.
5692 	 * bge_tick should help for fiber cards and we might not
5693 	 * need to do this here if BGE_FLAG_TBI is set but as
5694 	 * we poll for fiber anyway it should not harm.
5695 	 */
5696 	if (sc->bge_asicrev == BGE_ASICREV_BCM5700 ||
5697 	    sc->bge_flags & BGE_FLAG_5788)
5698 		BGE_SETBIT(sc, BGE_MISC_LOCAL_CTL, BGE_MLC_INTR_SET);
5699 	else
5700 		BGE_SETBIT(sc, BGE_HCC_MODE, BGE_HCCMODE_COAL_NOW);
5701 
5702 	return (0);
5703 }
5704 
5705 /*
5706  * Report current media status.
5707  */
5708 static void
5709 bge_ifmedia_sts(if_t ifp, struct ifmediareq *ifmr)
5710 {
5711 	struct bge_softc *sc = if_getsoftc(ifp);
5712 	struct mii_data *mii;
5713 
5714 	BGE_LOCK(sc);
5715 
5716 	if ((if_getflags(ifp) & IFF_UP) == 0) {
5717 		BGE_UNLOCK(sc);
5718 		return;
5719 	}
5720 	if (sc->bge_flags & BGE_FLAG_TBI) {
5721 		ifmr->ifm_status = IFM_AVALID;
5722 		ifmr->ifm_active = IFM_ETHER;
5723 		if (CSR_READ_4(sc, BGE_MAC_STS) &
5724 		    BGE_MACSTAT_TBI_PCS_SYNCHED)
5725 			ifmr->ifm_status |= IFM_ACTIVE;
5726 		else {
5727 			ifmr->ifm_active |= IFM_NONE;
5728 			BGE_UNLOCK(sc);
5729 			return;
5730 		}
5731 		ifmr->ifm_active |= IFM_1000_SX;
5732 		if (CSR_READ_4(sc, BGE_MAC_MODE) & BGE_MACMODE_HALF_DUPLEX)
5733 			ifmr->ifm_active |= IFM_HDX;
5734 		else
5735 			ifmr->ifm_active |= IFM_FDX;
5736 		BGE_UNLOCK(sc);
5737 		return;
5738 	}
5739 
5740 	mii = device_get_softc(sc->bge_miibus);
5741 	mii_pollstat(mii);
5742 	ifmr->ifm_active = mii->mii_media_active;
5743 	ifmr->ifm_status = mii->mii_media_status;
5744 
5745 	BGE_UNLOCK(sc);
5746 }
5747 
5748 static int
5749 bge_ioctl(if_t ifp, u_long command, caddr_t data)
5750 {
5751 	struct bge_softc *sc = if_getsoftc(ifp);
5752 	struct ifreq *ifr = (struct ifreq *) data;
5753 	struct mii_data *mii;
5754 	int flags, mask, error = 0;
5755 
5756 	switch (command) {
5757 	case SIOCSIFMTU:
5758 		if (BGE_IS_JUMBO_CAPABLE(sc) ||
5759 		    (sc->bge_flags & BGE_FLAG_JUMBO_STD)) {
5760 			if (ifr->ifr_mtu < ETHERMIN ||
5761 			    ifr->ifr_mtu > BGE_JUMBO_MTU) {
5762 				error = EINVAL;
5763 				break;
5764 			}
5765 		} else if (ifr->ifr_mtu < ETHERMIN || ifr->ifr_mtu > ETHERMTU) {
5766 			error = EINVAL;
5767 			break;
5768 		}
5769 		BGE_LOCK(sc);
5770 		if (if_getmtu(ifp) != ifr->ifr_mtu) {
5771 			if_setmtu(ifp, ifr->ifr_mtu);
5772 			if (if_getdrvflags(ifp) & IFF_DRV_RUNNING) {
5773 				if_setdrvflagbits(ifp, 0, IFF_DRV_RUNNING);
5774 				bge_init_locked(sc);
5775 			}
5776 		}
5777 		BGE_UNLOCK(sc);
5778 		break;
5779 	case SIOCSIFFLAGS:
5780 		BGE_LOCK(sc);
5781 		if (if_getflags(ifp) & IFF_UP) {
5782 			/*
5783 			 * If only the state of the PROMISC flag changed,
5784 			 * then just use the 'set promisc mode' command
5785 			 * instead of reinitializing the entire NIC. Doing
5786 			 * a full re-init means reloading the firmware and
5787 			 * waiting for it to start up, which may take a
5788 			 * second or two.  Similarly for ALLMULTI.
5789 			 */
5790 			if (if_getdrvflags(ifp) & IFF_DRV_RUNNING) {
5791 				flags = if_getflags(ifp) ^ sc->bge_if_flags;
5792 				if (flags & IFF_PROMISC)
5793 					bge_setpromisc(sc);
5794 				if (flags & IFF_ALLMULTI)
5795 					bge_setmulti(sc);
5796 			} else
5797 				bge_init_locked(sc);
5798 		} else {
5799 			if (if_getdrvflags(ifp) & IFF_DRV_RUNNING) {
5800 				bge_stop(sc);
5801 			}
5802 		}
5803 		sc->bge_if_flags = if_getflags(ifp);
5804 		BGE_UNLOCK(sc);
5805 		error = 0;
5806 		break;
5807 	case SIOCADDMULTI:
5808 	case SIOCDELMULTI:
5809 		if (if_getdrvflags(ifp) & IFF_DRV_RUNNING) {
5810 			BGE_LOCK(sc);
5811 			bge_setmulti(sc);
5812 			BGE_UNLOCK(sc);
5813 			error = 0;
5814 		}
5815 		break;
5816 	case SIOCSIFMEDIA:
5817 	case SIOCGIFMEDIA:
5818 		if (sc->bge_flags & BGE_FLAG_TBI) {
5819 			error = ifmedia_ioctl(ifp, ifr,
5820 			    &sc->bge_ifmedia, command);
5821 		} else {
5822 			mii = device_get_softc(sc->bge_miibus);
5823 			error = ifmedia_ioctl(ifp, ifr,
5824 			    &mii->mii_media, command);
5825 		}
5826 		break;
5827 	case SIOCSIFCAP:
5828 		mask = ifr->ifr_reqcap ^ if_getcapenable(ifp);
5829 #ifdef DEVICE_POLLING
5830 		if (mask & IFCAP_POLLING) {
5831 			if (ifr->ifr_reqcap & IFCAP_POLLING) {
5832 				error = ether_poll_register(bge_poll, ifp);
5833 				if (error)
5834 					return (error);
5835 				BGE_LOCK(sc);
5836 				BGE_SETBIT(sc, BGE_PCI_MISC_CTL,
5837 				    BGE_PCIMISCCTL_MASK_PCI_INTR);
5838 				bge_writembx(sc, BGE_MBX_IRQ0_LO, 1);
5839 				if_setcapenablebit(ifp, IFCAP_POLLING, 0);
5840 				BGE_UNLOCK(sc);
5841 			} else {
5842 				error = ether_poll_deregister(ifp);
5843 				/* Enable interrupt even in error case */
5844 				BGE_LOCK(sc);
5845 				BGE_CLRBIT(sc, BGE_PCI_MISC_CTL,
5846 				    BGE_PCIMISCCTL_MASK_PCI_INTR);
5847 				bge_writembx(sc, BGE_MBX_IRQ0_LO, 0);
5848 				if_setcapenablebit(ifp, 0, IFCAP_POLLING);
5849 				BGE_UNLOCK(sc);
5850 			}
5851 		}
5852 #endif
5853 		if ((mask & IFCAP_TXCSUM) != 0 &&
5854 		    (if_getcapabilities(ifp) & IFCAP_TXCSUM) != 0) {
5855 			if_togglecapenable(ifp, IFCAP_TXCSUM);
5856 			if ((if_getcapenable(ifp) & IFCAP_TXCSUM) != 0)
5857 				if_sethwassistbits(ifp,
5858 				    sc->bge_csum_features, 0);
5859 			else
5860 				if_sethwassistbits(ifp, 0,
5861 				    sc->bge_csum_features);
5862 		}
5863 
5864 		if ((mask & IFCAP_RXCSUM) != 0 &&
5865 		    (if_getcapabilities(ifp) & IFCAP_RXCSUM) != 0)
5866 			if_togglecapenable(ifp, IFCAP_RXCSUM);
5867 
5868 		if ((mask & IFCAP_TSO4) != 0 &&
5869 		    (if_getcapabilities(ifp) & IFCAP_TSO4) != 0) {
5870 			if_togglecapenable(ifp, IFCAP_TSO4);
5871 			if ((if_getcapenable(ifp) & IFCAP_TSO4) != 0)
5872 				if_sethwassistbits(ifp, CSUM_TSO, 0);
5873 			else
5874 				if_sethwassistbits(ifp, 0, CSUM_TSO);
5875 		}
5876 
5877 		if (mask & IFCAP_VLAN_MTU) {
5878 			if_togglecapenable(ifp, IFCAP_VLAN_MTU);
5879 			if_setdrvflagbits(ifp, 0, IFF_DRV_RUNNING);
5880 			bge_init(sc);
5881 		}
5882 
5883 		if ((mask & IFCAP_VLAN_HWTSO) != 0 &&
5884 		    (if_getcapabilities(ifp) & IFCAP_VLAN_HWTSO) != 0)
5885 			if_togglecapenable(ifp, IFCAP_VLAN_HWTSO);
5886 		if ((mask & IFCAP_VLAN_HWTAGGING) != 0 &&
5887 		    (if_getcapabilities(ifp) & IFCAP_VLAN_HWTAGGING) != 0) {
5888 			if_togglecapenable(ifp, IFCAP_VLAN_HWTAGGING);
5889 			if ((if_getcapenable(ifp) & IFCAP_VLAN_HWTAGGING) == 0)
5890 				if_setcapenablebit(ifp, 0, IFCAP_VLAN_HWTSO);
5891 			BGE_LOCK(sc);
5892 			bge_setvlan(sc);
5893 			BGE_UNLOCK(sc);
5894 		}
5895 #ifdef VLAN_CAPABILITIES
5896 		if_vlancap(ifp);
5897 #endif
5898 		break;
5899 	default:
5900 		error = ether_ioctl(ifp, command, data);
5901 		break;
5902 	}
5903 
5904 	return (error);
5905 }
5906 
5907 static void
5908 bge_watchdog(struct bge_softc *sc)
5909 {
5910 	if_t ifp;
5911 	uint32_t status;
5912 
5913 	BGE_LOCK_ASSERT(sc);
5914 
5915 	if (sc->bge_timer == 0 || --sc->bge_timer)
5916 		return;
5917 
5918 	/* If pause frames are active then don't reset the hardware. */
5919 	if ((CSR_READ_4(sc, BGE_RX_MODE) & BGE_RXMODE_FLOWCTL_ENABLE) != 0) {
5920 		status = CSR_READ_4(sc, BGE_RX_STS);
5921 		if ((status & BGE_RXSTAT_REMOTE_XOFFED) != 0) {
5922 			/*
5923 			 * If link partner has us in XOFF state then wait for
5924 			 * the condition to clear.
5925 			 */
5926 			CSR_WRITE_4(sc, BGE_RX_STS, status);
5927 			sc->bge_timer = BGE_TX_TIMEOUT;
5928 			return;
5929 		} else if ((status & BGE_RXSTAT_RCVD_XOFF) != 0 &&
5930 		    (status & BGE_RXSTAT_RCVD_XON) != 0) {
5931 			/*
5932 			 * If link partner has us in XOFF state then wait for
5933 			 * the condition to clear.
5934 			 */
5935 			CSR_WRITE_4(sc, BGE_RX_STS, status);
5936 			sc->bge_timer = BGE_TX_TIMEOUT;
5937 			return;
5938 		}
5939 		/*
5940 		 * Any other condition is unexpected and the controller
5941 		 * should be reset.
5942 		 */
5943 	}
5944 
5945 	ifp = sc->bge_ifp;
5946 
5947 	if_printf(ifp, "watchdog timeout -- resetting\n");
5948 
5949 	if_setdrvflagbits(ifp, 0, IFF_DRV_RUNNING);
5950 	bge_init_locked(sc);
5951 
5952 	if_inc_counter(ifp, IFCOUNTER_OERRORS, 1);
5953 }
5954 
5955 static void
5956 bge_stop_block(struct bge_softc *sc, bus_size_t reg, uint32_t bit)
5957 {
5958 	int i;
5959 
5960 	BGE_CLRBIT(sc, reg, bit);
5961 
5962 	for (i = 0; i < BGE_TIMEOUT; i++) {
5963 		if ((CSR_READ_4(sc, reg) & bit) == 0)
5964 			return;
5965 		DELAY(100);
5966         }
5967 }
5968 
5969 /*
5970  * Stop the adapter and free any mbufs allocated to the
5971  * RX and TX lists.
5972  */
5973 static void
5974 bge_stop(struct bge_softc *sc)
5975 {
5976 	if_t ifp;
5977 
5978 	BGE_LOCK_ASSERT(sc);
5979 
5980 	ifp = sc->bge_ifp;
5981 
5982 	callout_stop(&sc->bge_stat_ch);
5983 
5984 	/* Disable host interrupts. */
5985 	BGE_SETBIT(sc, BGE_PCI_MISC_CTL, BGE_PCIMISCCTL_MASK_PCI_INTR);
5986 	bge_writembx(sc, BGE_MBX_IRQ0_LO, 1);
5987 
5988 	/*
5989 	 * Tell firmware we're shutting down.
5990 	 */
5991 	bge_stop_fw(sc);
5992 	bge_sig_pre_reset(sc, BGE_RESET_SHUTDOWN);
5993 
5994 	/*
5995 	 * Disable all of the receiver blocks.
5996 	 */
5997 	bge_stop_block(sc, BGE_RX_MODE, BGE_RXMODE_ENABLE);
5998 	bge_stop_block(sc, BGE_RBDI_MODE, BGE_RBDIMODE_ENABLE);
5999 	bge_stop_block(sc, BGE_RXLP_MODE, BGE_RXLPMODE_ENABLE);
6000 	if (BGE_IS_5700_FAMILY(sc))
6001 		bge_stop_block(sc, BGE_RXLS_MODE, BGE_RXLSMODE_ENABLE);
6002 	bge_stop_block(sc, BGE_RDBDI_MODE, BGE_RBDIMODE_ENABLE);
6003 	bge_stop_block(sc, BGE_RDC_MODE, BGE_RDCMODE_ENABLE);
6004 	bge_stop_block(sc, BGE_RBDC_MODE, BGE_RBDCMODE_ENABLE);
6005 
6006 	/*
6007 	 * Disable all of the transmit blocks.
6008 	 */
6009 	bge_stop_block(sc, BGE_SRS_MODE, BGE_SRSMODE_ENABLE);
6010 	bge_stop_block(sc, BGE_SBDI_MODE, BGE_SBDIMODE_ENABLE);
6011 	bge_stop_block(sc, BGE_SDI_MODE, BGE_SDIMODE_ENABLE);
6012 	bge_stop_block(sc, BGE_RDMA_MODE, BGE_RDMAMODE_ENABLE);
6013 	bge_stop_block(sc, BGE_SDC_MODE, BGE_SDCMODE_ENABLE);
6014 	if (BGE_IS_5700_FAMILY(sc))
6015 		bge_stop_block(sc, BGE_DMAC_MODE, BGE_DMACMODE_ENABLE);
6016 	bge_stop_block(sc, BGE_SBDC_MODE, BGE_SBDCMODE_ENABLE);
6017 
6018 	/*
6019 	 * Shut down all of the memory managers and related
6020 	 * state machines.
6021 	 */
6022 	bge_stop_block(sc, BGE_HCC_MODE, BGE_HCCMODE_ENABLE);
6023 	bge_stop_block(sc, BGE_WDMA_MODE, BGE_WDMAMODE_ENABLE);
6024 	if (BGE_IS_5700_FAMILY(sc))
6025 		bge_stop_block(sc, BGE_MBCF_MODE, BGE_MBCFMODE_ENABLE);
6026 
6027 	CSR_WRITE_4(sc, BGE_FTQ_RESET, 0xFFFFFFFF);
6028 	CSR_WRITE_4(sc, BGE_FTQ_RESET, 0);
6029 	if (!(BGE_IS_5705_PLUS(sc))) {
6030 		BGE_CLRBIT(sc, BGE_BMAN_MODE, BGE_BMANMODE_ENABLE);
6031 		BGE_CLRBIT(sc, BGE_MARB_MODE, BGE_MARBMODE_ENABLE);
6032 	}
6033 	/* Update MAC statistics. */
6034 	if (BGE_IS_5705_PLUS(sc))
6035 		bge_stats_update_regs(sc);
6036 
6037 	bge_reset(sc);
6038 	bge_sig_legacy(sc, BGE_RESET_SHUTDOWN);
6039 	bge_sig_post_reset(sc, BGE_RESET_SHUTDOWN);
6040 
6041 	/*
6042 	 * Keep the ASF firmware running if up.
6043 	 */
6044 	if (sc->bge_asf_mode & ASF_STACKUP)
6045 		BGE_SETBIT(sc, BGE_MODE_CTL, BGE_MODECTL_STACKUP);
6046 	else
6047 		BGE_CLRBIT(sc, BGE_MODE_CTL, BGE_MODECTL_STACKUP);
6048 
6049 	/* Free the RX lists. */
6050 	bge_free_rx_ring_std(sc);
6051 
6052 	/* Free jumbo RX list. */
6053 	if (BGE_IS_JUMBO_CAPABLE(sc))
6054 		bge_free_rx_ring_jumbo(sc);
6055 
6056 	/* Free TX buffers. */
6057 	bge_free_tx_ring(sc);
6058 
6059 	sc->bge_tx_saved_considx = BGE_TXCONS_UNSET;
6060 
6061 	/* Clear MAC's link state (PHY may still have link UP). */
6062 	if (bootverbose && sc->bge_link)
6063 		if_printf(sc->bge_ifp, "link DOWN\n");
6064 	sc->bge_link = 0;
6065 
6066 	if_setdrvflagbits(ifp, 0, (IFF_DRV_RUNNING | IFF_DRV_OACTIVE));
6067 }
6068 
6069 /*
6070  * Stop all chip I/O so that the kernel's probe routines don't
6071  * get confused by errant DMAs when rebooting.
6072  */
6073 static int
6074 bge_shutdown(device_t dev)
6075 {
6076 	struct bge_softc *sc;
6077 
6078 	sc = device_get_softc(dev);
6079 	BGE_LOCK(sc);
6080 	bge_stop(sc);
6081 	BGE_UNLOCK(sc);
6082 
6083 	return (0);
6084 }
6085 
6086 static int
6087 bge_suspend(device_t dev)
6088 {
6089 	struct bge_softc *sc;
6090 
6091 	sc = device_get_softc(dev);
6092 	BGE_LOCK(sc);
6093 	bge_stop(sc);
6094 	BGE_UNLOCK(sc);
6095 
6096 	return (0);
6097 }
6098 
6099 static int
6100 bge_resume(device_t dev)
6101 {
6102 	struct bge_softc *sc;
6103 	if_t ifp;
6104 
6105 	sc = device_get_softc(dev);
6106 	BGE_LOCK(sc);
6107 	ifp = sc->bge_ifp;
6108 	if (if_getflags(ifp) & IFF_UP) {
6109 		bge_init_locked(sc);
6110 		if (if_getdrvflags(ifp) & IFF_DRV_RUNNING)
6111 			bge_start_locked(ifp);
6112 	}
6113 	BGE_UNLOCK(sc);
6114 
6115 	return (0);
6116 }
6117 
6118 static void
6119 bge_link_upd(struct bge_softc *sc)
6120 {
6121 	struct mii_data *mii;
6122 	uint32_t link, status;
6123 
6124 	BGE_LOCK_ASSERT(sc);
6125 
6126 	/* Clear 'pending link event' flag. */
6127 	sc->bge_link_evt = 0;
6128 
6129 	/*
6130 	 * Process link state changes.
6131 	 * Grrr. The link status word in the status block does
6132 	 * not work correctly on the BCM5700 rev AX and BX chips,
6133 	 * according to all available information. Hence, we have
6134 	 * to enable MII interrupts in order to properly obtain
6135 	 * async link changes. Unfortunately, this also means that
6136 	 * we have to read the MAC status register to detect link
6137 	 * changes, thereby adding an additional register access to
6138 	 * the interrupt handler.
6139 	 *
6140 	 * XXX: perhaps link state detection procedure used for
6141 	 * BGE_CHIPID_BCM5700_B2 can be used for others BCM5700 revisions.
6142 	 */
6143 
6144 	if (sc->bge_asicrev == BGE_ASICREV_BCM5700 &&
6145 	    sc->bge_chipid != BGE_CHIPID_BCM5700_B2) {
6146 		status = CSR_READ_4(sc, BGE_MAC_STS);
6147 		if (status & BGE_MACSTAT_MI_INTERRUPT) {
6148 			mii = device_get_softc(sc->bge_miibus);
6149 			mii_pollstat(mii);
6150 			if (!sc->bge_link &&
6151 			    mii->mii_media_status & IFM_ACTIVE &&
6152 			    IFM_SUBTYPE(mii->mii_media_active) != IFM_NONE) {
6153 				sc->bge_link++;
6154 				if (bootverbose)
6155 					if_printf(sc->bge_ifp, "link UP\n");
6156 			} else if (sc->bge_link &&
6157 			    (!(mii->mii_media_status & IFM_ACTIVE) ||
6158 			    IFM_SUBTYPE(mii->mii_media_active) == IFM_NONE)) {
6159 				sc->bge_link = 0;
6160 				if (bootverbose)
6161 					if_printf(sc->bge_ifp, "link DOWN\n");
6162 			}
6163 
6164 			/* Clear the interrupt. */
6165 			CSR_WRITE_4(sc, BGE_MAC_EVT_ENB,
6166 			    BGE_EVTENB_MI_INTERRUPT);
6167 			bge_miibus_readreg(sc->bge_dev, sc->bge_phy_addr,
6168 			    BRGPHY_MII_ISR);
6169 			bge_miibus_writereg(sc->bge_dev, sc->bge_phy_addr,
6170 			    BRGPHY_MII_IMR, BRGPHY_INTRS);
6171 		}
6172 		return;
6173 	}
6174 
6175 	if (sc->bge_flags & BGE_FLAG_TBI) {
6176 		status = CSR_READ_4(sc, BGE_MAC_STS);
6177 		if (status & BGE_MACSTAT_TBI_PCS_SYNCHED) {
6178 			if (!sc->bge_link) {
6179 				sc->bge_link++;
6180 				if (sc->bge_asicrev == BGE_ASICREV_BCM5704) {
6181 					BGE_CLRBIT(sc, BGE_MAC_MODE,
6182 					    BGE_MACMODE_TBI_SEND_CFGS);
6183 					DELAY(40);
6184 				}
6185 				CSR_WRITE_4(sc, BGE_MAC_STS, 0xFFFFFFFF);
6186 				if (bootverbose)
6187 					if_printf(sc->bge_ifp, "link UP\n");
6188 				if_link_state_change(sc->bge_ifp,
6189 				    LINK_STATE_UP);
6190 			}
6191 		} else if (sc->bge_link) {
6192 			sc->bge_link = 0;
6193 			if (bootverbose)
6194 				if_printf(sc->bge_ifp, "link DOWN\n");
6195 			if_link_state_change(sc->bge_ifp, LINK_STATE_DOWN);
6196 		}
6197 	} else if ((sc->bge_mi_mode & BGE_MIMODE_AUTOPOLL) != 0) {
6198 		/*
6199 		 * Some broken BCM chips have BGE_STATFLAG_LINKSTATE_CHANGED bit
6200 		 * in status word always set. Workaround this bug by reading
6201 		 * PHY link status directly.
6202 		 */
6203 		link = (CSR_READ_4(sc, BGE_MI_STS) & BGE_MISTS_LINK) ? 1 : 0;
6204 
6205 		if (link != sc->bge_link ||
6206 		    sc->bge_asicrev == BGE_ASICREV_BCM5700) {
6207 			mii = device_get_softc(sc->bge_miibus);
6208 			mii_pollstat(mii);
6209 			if (!sc->bge_link &&
6210 			    mii->mii_media_status & IFM_ACTIVE &&
6211 			    IFM_SUBTYPE(mii->mii_media_active) != IFM_NONE) {
6212 				sc->bge_link++;
6213 				if (bootverbose)
6214 					if_printf(sc->bge_ifp, "link UP\n");
6215 			} else if (sc->bge_link &&
6216 			    (!(mii->mii_media_status & IFM_ACTIVE) ||
6217 			    IFM_SUBTYPE(mii->mii_media_active) == IFM_NONE)) {
6218 				sc->bge_link = 0;
6219 				if (bootverbose)
6220 					if_printf(sc->bge_ifp, "link DOWN\n");
6221 			}
6222 		}
6223 	} else {
6224 		/*
6225 		 * For controllers that call mii_tick, we have to poll
6226 		 * link status.
6227 		 */
6228 		mii = device_get_softc(sc->bge_miibus);
6229 		mii_pollstat(mii);
6230 		bge_miibus_statchg(sc->bge_dev);
6231 	}
6232 
6233 	/* Disable MAC attention when link is up. */
6234 	CSR_WRITE_4(sc, BGE_MAC_STS, BGE_MACSTAT_SYNC_CHANGED |
6235 	    BGE_MACSTAT_CFG_CHANGED | BGE_MACSTAT_MI_COMPLETE |
6236 	    BGE_MACSTAT_LINK_CHANGED);
6237 }
6238 
6239 static void
6240 bge_add_sysctls(struct bge_softc *sc)
6241 {
6242 	struct sysctl_ctx_list *ctx;
6243 	struct sysctl_oid_list *children;
6244 	int unit;
6245 
6246 	ctx = device_get_sysctl_ctx(sc->bge_dev);
6247 	children = SYSCTL_CHILDREN(device_get_sysctl_tree(sc->bge_dev));
6248 
6249 #ifdef BGE_REGISTER_DEBUG
6250 	SYSCTL_ADD_PROC(ctx, children, OID_AUTO, "debug_info",
6251 	    CTLTYPE_INT | CTLFLAG_RW | CTLFLAG_NEEDGIANT, sc, 0,
6252 	    bge_sysctl_debug_info, "I", "Debug Information");
6253 
6254 	SYSCTL_ADD_PROC(ctx, children, OID_AUTO, "reg_read",
6255 	    CTLTYPE_INT | CTLFLAG_RW | CTLFLAG_NEEDGIANT, sc, 0,
6256 	    bge_sysctl_reg_read, "I", "MAC Register Read");
6257 
6258 	SYSCTL_ADD_PROC(ctx, children, OID_AUTO, "ape_read",
6259 	    CTLTYPE_INT | CTLFLAG_RW | CTLFLAG_NEEDGIANT, sc, 0,
6260 	    bge_sysctl_ape_read, "I", "APE Register Read");
6261 
6262 	SYSCTL_ADD_PROC(ctx, children, OID_AUTO, "mem_read",
6263 	    CTLTYPE_INT | CTLFLAG_RW | CTLFLAG_NEEDGIANT, sc, 0,
6264 	    bge_sysctl_mem_read, "I", "Memory Read");
6265 
6266 #endif
6267 
6268 	unit = device_get_unit(sc->bge_dev);
6269 	/*
6270 	 * A common design characteristic for many Broadcom client controllers
6271 	 * is that they only support a single outstanding DMA read operation
6272 	 * on the PCIe bus. This means that it will take twice as long to fetch
6273 	 * a TX frame that is split into header and payload buffers as it does
6274 	 * to fetch a single, contiguous TX frame (2 reads vs. 1 read). For
6275 	 * these controllers, coalescing buffers to reduce the number of memory
6276 	 * reads is effective way to get maximum performance(about 940Mbps).
6277 	 * Without collapsing TX buffers the maximum TCP bulk transfer
6278 	 * performance is about 850Mbps. However forcing coalescing mbufs
6279 	 * consumes a lot of CPU cycles, so leave it off by default.
6280 	 */
6281 	sc->bge_forced_collapse = 0;
6282 	SYSCTL_ADD_INT(ctx, children, OID_AUTO, "forced_collapse",
6283 	    CTLFLAG_RWTUN, &sc->bge_forced_collapse, 0,
6284 	    "Number of fragmented TX buffers of a frame allowed before "
6285 	    "forced collapsing");
6286 
6287 	sc->bge_msi = 1;
6288 	SYSCTL_ADD_INT(ctx, children, OID_AUTO, "msi",
6289 	    CTLFLAG_RDTUN, &sc->bge_msi, 0, "Enable MSI");
6290 
6291 	/*
6292 	 * It seems all Broadcom controllers have a bug that can generate UDP
6293 	 * datagrams with checksum value 0 when TX UDP checksum offloading is
6294 	 * enabled.  Generating UDP checksum value 0 is RFC 768 violation.
6295 	 * Even though the probability of generating such UDP datagrams is
6296 	 * low, I don't want to see FreeBSD boxes to inject such datagrams
6297 	 * into network so disable UDP checksum offloading by default.  Users
6298 	 * still override this behavior by setting a sysctl variable,
6299 	 * dev.bge.0.forced_udpcsum.
6300 	 */
6301 	sc->bge_forced_udpcsum = 0;
6302 	SYSCTL_ADD_INT(ctx, children, OID_AUTO, "forced_udpcsum",
6303 	    CTLFLAG_RWTUN, &sc->bge_forced_udpcsum, 0,
6304 	    "Enable UDP checksum offloading even if controller can "
6305 	    "generate UDP checksum value 0");
6306 
6307 	if (BGE_IS_5705_PLUS(sc))
6308 		bge_add_sysctl_stats_regs(sc, ctx, children);
6309 	else
6310 		bge_add_sysctl_stats(sc, ctx, children);
6311 }
6312 
6313 #define BGE_SYSCTL_STAT(sc, ctx, desc, parent, node, oid) \
6314     SYSCTL_ADD_PROC(ctx, parent, OID_AUTO, oid, \
6315         CTLTYPE_UINT | CTLFLAG_RD | CTLFLAG_NEEDGIANT, sc, \
6316 	offsetof(struct bge_stats, node), bge_sysctl_stats, "IU", desc)
6317 
6318 static void
6319 bge_add_sysctl_stats(struct bge_softc *sc, struct sysctl_ctx_list *ctx,
6320     struct sysctl_oid_list *parent)
6321 {
6322 	struct sysctl_oid *tree;
6323 	struct sysctl_oid_list *children, *schildren;
6324 
6325 	tree = SYSCTL_ADD_NODE(ctx, parent, OID_AUTO, "stats",
6326 	    CTLFLAG_RD | CTLFLAG_MPSAFE, NULL, "BGE Statistics");
6327 	schildren = children = SYSCTL_CHILDREN(tree);
6328 	BGE_SYSCTL_STAT(sc, ctx, "Frames Dropped Due To Filters",
6329 	    children, COSFramesDroppedDueToFilters,
6330 	    "FramesDroppedDueToFilters");
6331 	BGE_SYSCTL_STAT(sc, ctx, "NIC DMA Write Queue Full",
6332 	    children, nicDmaWriteQueueFull, "DmaWriteQueueFull");
6333 	BGE_SYSCTL_STAT(sc, ctx, "NIC DMA Write High Priority Queue Full",
6334 	    children, nicDmaWriteHighPriQueueFull, "DmaWriteHighPriQueueFull");
6335 	BGE_SYSCTL_STAT(sc, ctx, "NIC No More RX Buffer Descriptors",
6336 	    children, nicNoMoreRxBDs, "NoMoreRxBDs");
6337 	BGE_SYSCTL_STAT(sc, ctx, "Discarded Input Frames",
6338 	    children, ifInDiscards, "InputDiscards");
6339 	BGE_SYSCTL_STAT(sc, ctx, "Input Errors",
6340 	    children, ifInErrors, "InputErrors");
6341 	BGE_SYSCTL_STAT(sc, ctx, "NIC Recv Threshold Hit",
6342 	    children, nicRecvThresholdHit, "RecvThresholdHit");
6343 	BGE_SYSCTL_STAT(sc, ctx, "NIC DMA Read Queue Full",
6344 	    children, nicDmaReadQueueFull, "DmaReadQueueFull");
6345 	BGE_SYSCTL_STAT(sc, ctx, "NIC DMA Read High Priority Queue Full",
6346 	    children, nicDmaReadHighPriQueueFull, "DmaReadHighPriQueueFull");
6347 	BGE_SYSCTL_STAT(sc, ctx, "NIC Send Data Complete Queue Full",
6348 	    children, nicSendDataCompQueueFull, "SendDataCompQueueFull");
6349 	BGE_SYSCTL_STAT(sc, ctx, "NIC Ring Set Send Producer Index",
6350 	    children, nicRingSetSendProdIndex, "RingSetSendProdIndex");
6351 	BGE_SYSCTL_STAT(sc, ctx, "NIC Ring Status Update",
6352 	    children, nicRingStatusUpdate, "RingStatusUpdate");
6353 	BGE_SYSCTL_STAT(sc, ctx, "NIC Interrupts",
6354 	    children, nicInterrupts, "Interrupts");
6355 	BGE_SYSCTL_STAT(sc, ctx, "NIC Avoided Interrupts",
6356 	    children, nicAvoidedInterrupts, "AvoidedInterrupts");
6357 	BGE_SYSCTL_STAT(sc, ctx, "NIC Send Threshold Hit",
6358 	    children, nicSendThresholdHit, "SendThresholdHit");
6359 
6360 	tree = SYSCTL_ADD_NODE(ctx, schildren, OID_AUTO, "rx",
6361 	    CTLFLAG_RD | CTLFLAG_MPSAFE, NULL, "BGE RX Statistics");
6362 	children = SYSCTL_CHILDREN(tree);
6363 	BGE_SYSCTL_STAT(sc, ctx, "Inbound Octets",
6364 	    children, rxstats.ifHCInOctets, "ifHCInOctets");
6365 	BGE_SYSCTL_STAT(sc, ctx, "Fragments",
6366 	    children, rxstats.etherStatsFragments, "Fragments");
6367 	BGE_SYSCTL_STAT(sc, ctx, "Inbound Unicast Packets",
6368 	    children, rxstats.ifHCInUcastPkts, "UnicastPkts");
6369 	BGE_SYSCTL_STAT(sc, ctx, "Inbound Multicast Packets",
6370 	    children, rxstats.ifHCInMulticastPkts, "MulticastPkts");
6371 	BGE_SYSCTL_STAT(sc, ctx, "FCS Errors",
6372 	    children, rxstats.dot3StatsFCSErrors, "FCSErrors");
6373 	BGE_SYSCTL_STAT(sc, ctx, "Alignment Errors",
6374 	    children, rxstats.dot3StatsAlignmentErrors, "AlignmentErrors");
6375 	BGE_SYSCTL_STAT(sc, ctx, "XON Pause Frames Received",
6376 	    children, rxstats.xonPauseFramesReceived, "xonPauseFramesReceived");
6377 	BGE_SYSCTL_STAT(sc, ctx, "XOFF Pause Frames Received",
6378 	    children, rxstats.xoffPauseFramesReceived,
6379 	    "xoffPauseFramesReceived");
6380 	BGE_SYSCTL_STAT(sc, ctx, "MAC Control Frames Received",
6381 	    children, rxstats.macControlFramesReceived,
6382 	    "ControlFramesReceived");
6383 	BGE_SYSCTL_STAT(sc, ctx, "XOFF State Entered",
6384 	    children, rxstats.xoffStateEntered, "xoffStateEntered");
6385 	BGE_SYSCTL_STAT(sc, ctx, "Frames Too Long",
6386 	    children, rxstats.dot3StatsFramesTooLong, "FramesTooLong");
6387 	BGE_SYSCTL_STAT(sc, ctx, "Jabbers",
6388 	    children, rxstats.etherStatsJabbers, "Jabbers");
6389 	BGE_SYSCTL_STAT(sc, ctx, "Undersized Packets",
6390 	    children, rxstats.etherStatsUndersizePkts, "UndersizePkts");
6391 	BGE_SYSCTL_STAT(sc, ctx, "Inbound Range Length Errors",
6392 	    children, rxstats.inRangeLengthError, "inRangeLengthError");
6393 	BGE_SYSCTL_STAT(sc, ctx, "Outbound Range Length Errors",
6394 	    children, rxstats.outRangeLengthError, "outRangeLengthError");
6395 
6396 	tree = SYSCTL_ADD_NODE(ctx, schildren, OID_AUTO, "tx",
6397 	    CTLFLAG_RD | CTLFLAG_MPSAFE, NULL, "BGE TX Statistics");
6398 	children = SYSCTL_CHILDREN(tree);
6399 	BGE_SYSCTL_STAT(sc, ctx, "Outbound Octets",
6400 	    children, txstats.ifHCOutOctets, "ifHCOutOctets");
6401 	BGE_SYSCTL_STAT(sc, ctx, "TX Collisions",
6402 	    children, txstats.etherStatsCollisions, "Collisions");
6403 	BGE_SYSCTL_STAT(sc, ctx, "XON Sent",
6404 	    children, txstats.outXonSent, "XonSent");
6405 	BGE_SYSCTL_STAT(sc, ctx, "XOFF Sent",
6406 	    children, txstats.outXoffSent, "XoffSent");
6407 	BGE_SYSCTL_STAT(sc, ctx, "Flow Control Done",
6408 	    children, txstats.flowControlDone, "flowControlDone");
6409 	BGE_SYSCTL_STAT(sc, ctx, "Internal MAC TX errors",
6410 	    children, txstats.dot3StatsInternalMacTransmitErrors,
6411 	    "InternalMacTransmitErrors");
6412 	BGE_SYSCTL_STAT(sc, ctx, "Single Collision Frames",
6413 	    children, txstats.dot3StatsSingleCollisionFrames,
6414 	    "SingleCollisionFrames");
6415 	BGE_SYSCTL_STAT(sc, ctx, "Multiple Collision Frames",
6416 	    children, txstats.dot3StatsMultipleCollisionFrames,
6417 	    "MultipleCollisionFrames");
6418 	BGE_SYSCTL_STAT(sc, ctx, "Deferred Transmissions",
6419 	    children, txstats.dot3StatsDeferredTransmissions,
6420 	    "DeferredTransmissions");
6421 	BGE_SYSCTL_STAT(sc, ctx, "Excessive Collisions",
6422 	    children, txstats.dot3StatsExcessiveCollisions,
6423 	    "ExcessiveCollisions");
6424 	BGE_SYSCTL_STAT(sc, ctx, "Late Collisions",
6425 	    children, txstats.dot3StatsLateCollisions,
6426 	    "LateCollisions");
6427 	BGE_SYSCTL_STAT(sc, ctx, "Outbound Unicast Packets",
6428 	    children, txstats.ifHCOutUcastPkts, "UnicastPkts");
6429 	BGE_SYSCTL_STAT(sc, ctx, "Outbound Multicast Packets",
6430 	    children, txstats.ifHCOutMulticastPkts, "MulticastPkts");
6431 	BGE_SYSCTL_STAT(sc, ctx, "Outbound Broadcast Packets",
6432 	    children, txstats.ifHCOutBroadcastPkts, "BroadcastPkts");
6433 	BGE_SYSCTL_STAT(sc, ctx, "Carrier Sense Errors",
6434 	    children, txstats.dot3StatsCarrierSenseErrors,
6435 	    "CarrierSenseErrors");
6436 	BGE_SYSCTL_STAT(sc, ctx, "Outbound Discards",
6437 	    children, txstats.ifOutDiscards, "Discards");
6438 	BGE_SYSCTL_STAT(sc, ctx, "Outbound Errors",
6439 	    children, txstats.ifOutErrors, "Errors");
6440 }
6441 
6442 #undef BGE_SYSCTL_STAT
6443 
6444 #define	BGE_SYSCTL_STAT_ADD64(c, h, n, p, d)	\
6445 	    SYSCTL_ADD_UQUAD(c, h, OID_AUTO, n, CTLFLAG_RD, p, d)
6446 
6447 static void
6448 bge_add_sysctl_stats_regs(struct bge_softc *sc, struct sysctl_ctx_list *ctx,
6449     struct sysctl_oid_list *parent)
6450 {
6451 	struct sysctl_oid *tree;
6452 	struct sysctl_oid_list *child, *schild;
6453 	struct bge_mac_stats *stats;
6454 
6455 	stats = &sc->bge_mac_stats;
6456 	tree = SYSCTL_ADD_NODE(ctx, parent, OID_AUTO, "stats",
6457 	    CTLFLAG_RD | CTLFLAG_MPSAFE, NULL, "BGE Statistics");
6458 	schild = child = SYSCTL_CHILDREN(tree);
6459 	BGE_SYSCTL_STAT_ADD64(ctx, child, "FramesDroppedDueToFilters",
6460 	    &stats->FramesDroppedDueToFilters, "Frames Dropped Due to Filters");
6461 	BGE_SYSCTL_STAT_ADD64(ctx, child, "DmaWriteQueueFull",
6462 	    &stats->DmaWriteQueueFull, "NIC DMA Write Queue Full");
6463 	BGE_SYSCTL_STAT_ADD64(ctx, child, "DmaWriteHighPriQueueFull",
6464 	    &stats->DmaWriteHighPriQueueFull,
6465 	    "NIC DMA Write High Priority Queue Full");
6466 	BGE_SYSCTL_STAT_ADD64(ctx, child, "NoMoreRxBDs",
6467 	    &stats->NoMoreRxBDs, "NIC No More RX Buffer Descriptors");
6468 	BGE_SYSCTL_STAT_ADD64(ctx, child, "InputDiscards",
6469 	    &stats->InputDiscards, "Discarded Input Frames");
6470 	BGE_SYSCTL_STAT_ADD64(ctx, child, "InputErrors",
6471 	    &stats->InputErrors, "Input Errors");
6472 	BGE_SYSCTL_STAT_ADD64(ctx, child, "RecvThresholdHit",
6473 	    &stats->RecvThresholdHit, "NIC Recv Threshold Hit");
6474 
6475 	tree = SYSCTL_ADD_NODE(ctx, schild, OID_AUTO, "rx",
6476 	    CTLFLAG_RD | CTLFLAG_MPSAFE, NULL, "BGE RX Statistics");
6477 	child = SYSCTL_CHILDREN(tree);
6478 	BGE_SYSCTL_STAT_ADD64(ctx, child, "ifHCInOctets",
6479 	    &stats->ifHCInOctets, "Inbound Octets");
6480 	BGE_SYSCTL_STAT_ADD64(ctx, child, "Fragments",
6481 	    &stats->etherStatsFragments, "Fragments");
6482 	BGE_SYSCTL_STAT_ADD64(ctx, child, "UnicastPkts",
6483 	    &stats->ifHCInUcastPkts, "Inbound Unicast Packets");
6484 	BGE_SYSCTL_STAT_ADD64(ctx, child, "MulticastPkts",
6485 	    &stats->ifHCInMulticastPkts, "Inbound Multicast Packets");
6486 	BGE_SYSCTL_STAT_ADD64(ctx, child, "BroadcastPkts",
6487 	    &stats->ifHCInBroadcastPkts, "Inbound Broadcast Packets");
6488 	BGE_SYSCTL_STAT_ADD64(ctx, child, "FCSErrors",
6489 	    &stats->dot3StatsFCSErrors, "FCS Errors");
6490 	BGE_SYSCTL_STAT_ADD64(ctx, child, "AlignmentErrors",
6491 	    &stats->dot3StatsAlignmentErrors, "Alignment Errors");
6492 	BGE_SYSCTL_STAT_ADD64(ctx, child, "xonPauseFramesReceived",
6493 	    &stats->xonPauseFramesReceived, "XON Pause Frames Received");
6494 	BGE_SYSCTL_STAT_ADD64(ctx, child, "xoffPauseFramesReceived",
6495 	    &stats->xoffPauseFramesReceived, "XOFF Pause Frames Received");
6496 	BGE_SYSCTL_STAT_ADD64(ctx, child, "ControlFramesReceived",
6497 	    &stats->macControlFramesReceived, "MAC Control Frames Received");
6498 	BGE_SYSCTL_STAT_ADD64(ctx, child, "xoffStateEntered",
6499 	    &stats->xoffStateEntered, "XOFF State Entered");
6500 	BGE_SYSCTL_STAT_ADD64(ctx, child, "FramesTooLong",
6501 	    &stats->dot3StatsFramesTooLong, "Frames Too Long");
6502 	BGE_SYSCTL_STAT_ADD64(ctx, child, "Jabbers",
6503 	    &stats->etherStatsJabbers, "Jabbers");
6504 	BGE_SYSCTL_STAT_ADD64(ctx, child, "UndersizePkts",
6505 	    &stats->etherStatsUndersizePkts, "Undersized Packets");
6506 
6507 	tree = SYSCTL_ADD_NODE(ctx, schild, OID_AUTO, "tx",
6508 	    CTLFLAG_RD | CTLFLAG_MPSAFE, NULL, "BGE TX Statistics");
6509 	child = SYSCTL_CHILDREN(tree);
6510 	BGE_SYSCTL_STAT_ADD64(ctx, child, "ifHCOutOctets",
6511 	    &stats->ifHCOutOctets, "Outbound Octets");
6512 	BGE_SYSCTL_STAT_ADD64(ctx, child, "Collisions",
6513 	    &stats->etherStatsCollisions, "TX Collisions");
6514 	BGE_SYSCTL_STAT_ADD64(ctx, child, "XonSent",
6515 	    &stats->outXonSent, "XON Sent");
6516 	BGE_SYSCTL_STAT_ADD64(ctx, child, "XoffSent",
6517 	    &stats->outXoffSent, "XOFF Sent");
6518 	BGE_SYSCTL_STAT_ADD64(ctx, child, "InternalMacTransmitErrors",
6519 	    &stats->dot3StatsInternalMacTransmitErrors,
6520 	    "Internal MAC TX Errors");
6521 	BGE_SYSCTL_STAT_ADD64(ctx, child, "SingleCollisionFrames",
6522 	    &stats->dot3StatsSingleCollisionFrames, "Single Collision Frames");
6523 	BGE_SYSCTL_STAT_ADD64(ctx, child, "MultipleCollisionFrames",
6524 	    &stats->dot3StatsMultipleCollisionFrames,
6525 	    "Multiple Collision Frames");
6526 	BGE_SYSCTL_STAT_ADD64(ctx, child, "DeferredTransmissions",
6527 	    &stats->dot3StatsDeferredTransmissions, "Deferred Transmissions");
6528 	BGE_SYSCTL_STAT_ADD64(ctx, child, "ExcessiveCollisions",
6529 	    &stats->dot3StatsExcessiveCollisions, "Excessive Collisions");
6530 	BGE_SYSCTL_STAT_ADD64(ctx, child, "LateCollisions",
6531 	    &stats->dot3StatsLateCollisions, "Late Collisions");
6532 	BGE_SYSCTL_STAT_ADD64(ctx, child, "UnicastPkts",
6533 	    &stats->ifHCOutUcastPkts, "Outbound Unicast Packets");
6534 	BGE_SYSCTL_STAT_ADD64(ctx, child, "MulticastPkts",
6535 	    &stats->ifHCOutMulticastPkts, "Outbound Multicast Packets");
6536 	BGE_SYSCTL_STAT_ADD64(ctx, child, "BroadcastPkts",
6537 	    &stats->ifHCOutBroadcastPkts, "Outbound Broadcast Packets");
6538 }
6539 
6540 #undef	BGE_SYSCTL_STAT_ADD64
6541 
6542 static int
6543 bge_sysctl_stats(SYSCTL_HANDLER_ARGS)
6544 {
6545 	struct bge_softc *sc;
6546 	uint32_t result;
6547 	int offset;
6548 
6549 	sc = (struct bge_softc *)arg1;
6550 	offset = arg2;
6551 	result = CSR_READ_4(sc, BGE_MEMWIN_START + BGE_STATS_BLOCK + offset +
6552 	    offsetof(bge_hostaddr, bge_addr_lo));
6553 	return (sysctl_handle_int(oidp, &result, 0, req));
6554 }
6555 
6556 #ifdef BGE_REGISTER_DEBUG
6557 static int
6558 bge_sysctl_debug_info(SYSCTL_HANDLER_ARGS)
6559 {
6560 	struct bge_softc *sc;
6561 	uint16_t *sbdata;
6562 	int error, result, sbsz;
6563 	int i, j;
6564 
6565 	result = -1;
6566 	error = sysctl_handle_int(oidp, &result, 0, req);
6567 	if (error || (req->newptr == NULL))
6568 		return (error);
6569 
6570 	if (result == 1) {
6571 		sc = (struct bge_softc *)arg1;
6572 
6573 		if (sc->bge_asicrev == BGE_ASICREV_BCM5700 &&
6574 		    sc->bge_chipid != BGE_CHIPID_BCM5700_C0)
6575 			sbsz = BGE_STATUS_BLK_SZ;
6576 		else
6577 			sbsz = 32;
6578 		sbdata = (uint16_t *)sc->bge_ldata.bge_status_block;
6579 		printf("Status Block:\n");
6580 		BGE_LOCK(sc);
6581 		bus_dmamap_sync(sc->bge_cdata.bge_status_tag,
6582 		    sc->bge_cdata.bge_status_map,
6583 		    BUS_DMASYNC_POSTREAD | BUS_DMASYNC_POSTWRITE);
6584 		for (i = 0x0; i < sbsz / sizeof(uint16_t); ) {
6585 			printf("%06x:", i);
6586 			for (j = 0; j < 8; j++)
6587 				printf(" %04x", sbdata[i++]);
6588 			printf("\n");
6589 		}
6590 
6591 		printf("Registers:\n");
6592 		for (i = 0x800; i < 0xA00; ) {
6593 			printf("%06x:", i);
6594 			for (j = 0; j < 8; j++) {
6595 				printf(" %08x", CSR_READ_4(sc, i));
6596 				i += 4;
6597 			}
6598 			printf("\n");
6599 		}
6600 		BGE_UNLOCK(sc);
6601 
6602 		printf("Hardware Flags:\n");
6603 		if (BGE_IS_5717_PLUS(sc))
6604 			printf(" - 5717 Plus\n");
6605 		if (BGE_IS_5755_PLUS(sc))
6606 			printf(" - 5755 Plus\n");
6607 		if (BGE_IS_575X_PLUS(sc))
6608 			printf(" - 575X Plus\n");
6609 		if (BGE_IS_5705_PLUS(sc))
6610 			printf(" - 5705 Plus\n");
6611 		if (BGE_IS_5714_FAMILY(sc))
6612 			printf(" - 5714 Family\n");
6613 		if (BGE_IS_5700_FAMILY(sc))
6614 			printf(" - 5700 Family\n");
6615 		if (sc->bge_flags & BGE_FLAG_JUMBO)
6616 			printf(" - Supports Jumbo Frames\n");
6617 		if (sc->bge_flags & BGE_FLAG_PCIX)
6618 			printf(" - PCI-X Bus\n");
6619 		if (sc->bge_flags & BGE_FLAG_PCIE)
6620 			printf(" - PCI Express Bus\n");
6621 		if (sc->bge_phy_flags & BGE_PHY_NO_3LED)
6622 			printf(" - No 3 LEDs\n");
6623 		if (sc->bge_flags & BGE_FLAG_RX_ALIGNBUG)
6624 			printf(" - RX Alignment Bug\n");
6625 	}
6626 
6627 	return (error);
6628 }
6629 
6630 static int
6631 bge_sysctl_reg_read(SYSCTL_HANDLER_ARGS)
6632 {
6633 	struct bge_softc *sc;
6634 	int error;
6635 	uint16_t result;
6636 	uint32_t val;
6637 
6638 	result = -1;
6639 	error = sysctl_handle_int(oidp, &result, 0, req);
6640 	if (error || (req->newptr == NULL))
6641 		return (error);
6642 
6643 	if (result < 0x8000) {
6644 		sc = (struct bge_softc *)arg1;
6645 		val = CSR_READ_4(sc, result);
6646 		printf("reg 0x%06X = 0x%08X\n", result, val);
6647 	}
6648 
6649 	return (error);
6650 }
6651 
6652 static int
6653 bge_sysctl_ape_read(SYSCTL_HANDLER_ARGS)
6654 {
6655 	struct bge_softc *sc;
6656 	int error;
6657 	uint16_t result;
6658 	uint32_t val;
6659 
6660 	result = -1;
6661 	error = sysctl_handle_int(oidp, &result, 0, req);
6662 	if (error || (req->newptr == NULL))
6663 		return (error);
6664 
6665 	if (result < 0x8000) {
6666 		sc = (struct bge_softc *)arg1;
6667 		val = APE_READ_4(sc, result);
6668 		printf("reg 0x%06X = 0x%08X\n", result, val);
6669 	}
6670 
6671 	return (error);
6672 }
6673 
6674 static int
6675 bge_sysctl_mem_read(SYSCTL_HANDLER_ARGS)
6676 {
6677 	struct bge_softc *sc;
6678 	int error;
6679 	uint16_t result;
6680 	uint32_t val;
6681 
6682 	result = -1;
6683 	error = sysctl_handle_int(oidp, &result, 0, req);
6684 	if (error || (req->newptr == NULL))
6685 		return (error);
6686 
6687 	if (result < 0x8000) {
6688 		sc = (struct bge_softc *)arg1;
6689 		val = bge_readmem_ind(sc, result);
6690 		printf("mem 0x%06X = 0x%08X\n", result, val);
6691 	}
6692 
6693 	return (error);
6694 }
6695 #endif
6696 
6697 static int
6698 bge_get_eaddr_fw(struct bge_softc *sc, uint8_t ether_addr[])
6699 {
6700 	return (1);
6701 }
6702 
6703 static int
6704 bge_get_eaddr_mem(struct bge_softc *sc, uint8_t ether_addr[])
6705 {
6706 	uint32_t mac_addr;
6707 
6708 	mac_addr = bge_readmem_ind(sc, BGE_SRAM_MAC_ADDR_HIGH_MB);
6709 	if ((mac_addr >> 16) == 0x484b) {
6710 		ether_addr[0] = (uint8_t)(mac_addr >> 8);
6711 		ether_addr[1] = (uint8_t)mac_addr;
6712 		mac_addr = bge_readmem_ind(sc, BGE_SRAM_MAC_ADDR_LOW_MB);
6713 		ether_addr[2] = (uint8_t)(mac_addr >> 24);
6714 		ether_addr[3] = (uint8_t)(mac_addr >> 16);
6715 		ether_addr[4] = (uint8_t)(mac_addr >> 8);
6716 		ether_addr[5] = (uint8_t)mac_addr;
6717 		return (0);
6718 	}
6719 	return (1);
6720 }
6721 
6722 static int
6723 bge_get_eaddr_nvram(struct bge_softc *sc, uint8_t ether_addr[])
6724 {
6725 	int mac_offset = BGE_EE_MAC_OFFSET;
6726 
6727 	if (sc->bge_asicrev == BGE_ASICREV_BCM5906)
6728 		mac_offset = BGE_EE_MAC_OFFSET_5906;
6729 
6730 	return (bge_read_nvram(sc, ether_addr, mac_offset + 2,
6731 	    ETHER_ADDR_LEN));
6732 }
6733 
6734 static int
6735 bge_get_eaddr_eeprom(struct bge_softc *sc, uint8_t ether_addr[])
6736 {
6737 
6738 	if (sc->bge_asicrev == BGE_ASICREV_BCM5906)
6739 		return (1);
6740 
6741 	return (bge_read_eeprom(sc, ether_addr, BGE_EE_MAC_OFFSET + 2,
6742 	   ETHER_ADDR_LEN));
6743 }
6744 
6745 static int
6746 bge_get_eaddr(struct bge_softc *sc, uint8_t eaddr[])
6747 {
6748 	static const bge_eaddr_fcn_t bge_eaddr_funcs[] = {
6749 		/* NOTE: Order is critical */
6750 		bge_get_eaddr_fw,
6751 		bge_get_eaddr_mem,
6752 		bge_get_eaddr_nvram,
6753 		bge_get_eaddr_eeprom,
6754 		NULL
6755 	};
6756 	const bge_eaddr_fcn_t *func;
6757 
6758 	for (func = bge_eaddr_funcs; *func != NULL; ++func) {
6759 		if ((*func)(sc, eaddr) == 0)
6760 			break;
6761 	}
6762 	return (*func == NULL ? ENXIO : 0);
6763 }
6764 
6765 static uint64_t
6766 bge_get_counter(if_t ifp, ift_counter cnt)
6767 {
6768 	struct bge_softc *sc;
6769 	struct bge_mac_stats *stats;
6770 
6771 	sc = if_getsoftc(ifp);
6772 	if (!BGE_IS_5705_PLUS(sc))
6773 		return (if_get_counter_default(ifp, cnt));
6774 	stats = &sc->bge_mac_stats;
6775 
6776 	switch (cnt) {
6777 	case IFCOUNTER_IERRORS:
6778 		return (stats->NoMoreRxBDs + stats->InputDiscards +
6779 		    stats->InputErrors);
6780 	case IFCOUNTER_COLLISIONS:
6781 		return (stats->etherStatsCollisions);
6782 	default:
6783 		return (if_get_counter_default(ifp, cnt));
6784 	}
6785 }
6786 
6787 #ifdef DEBUGNET
6788 static void
6789 bge_debugnet_init(if_t ifp, int *nrxr, int *ncl, int *clsize)
6790 {
6791 	struct bge_softc *sc;
6792 
6793 	sc = if_getsoftc(ifp);
6794 	BGE_LOCK(sc);
6795 	*nrxr = sc->bge_return_ring_cnt;
6796 	*ncl = DEBUGNET_MAX_IN_FLIGHT;
6797 	if ((sc->bge_flags & BGE_FLAG_JUMBO_STD) != 0 &&
6798 	    (if_getmtu(sc->bge_ifp) + ETHER_HDR_LEN + ETHER_CRC_LEN +
6799 	    ETHER_VLAN_ENCAP_LEN > (MCLBYTES - ETHER_ALIGN)))
6800 		*clsize = MJUM9BYTES;
6801 	else
6802 		*clsize = MCLBYTES;
6803 	BGE_UNLOCK(sc);
6804 }
6805 
6806 static void
6807 bge_debugnet_event(if_t ifp __unused, enum debugnet_ev event __unused)
6808 {
6809 }
6810 
6811 static int
6812 bge_debugnet_transmit(if_t ifp, struct mbuf *m)
6813 {
6814 	struct bge_softc *sc;
6815 	uint32_t prodidx;
6816 	int error;
6817 
6818 	sc = if_getsoftc(ifp);
6819 	if ((if_getdrvflags(ifp) & (IFF_DRV_RUNNING | IFF_DRV_OACTIVE)) !=
6820 	    IFF_DRV_RUNNING)
6821 		return (1);
6822 
6823 	prodidx = sc->bge_tx_prodidx;
6824 	error = bge_encap(sc, &m, &prodidx);
6825 	if (error == 0)
6826 		bge_start_tx(sc, prodidx);
6827 	return (error);
6828 }
6829 
6830 static int
6831 bge_debugnet_poll(if_t ifp, int count)
6832 {
6833 	struct bge_softc *sc;
6834 	uint32_t rx_prod, tx_cons;
6835 
6836 	sc = if_getsoftc(ifp);
6837 	if ((if_getdrvflags(ifp) & (IFF_DRV_RUNNING | IFF_DRV_OACTIVE)) !=
6838 	    IFF_DRV_RUNNING)
6839 		return (1);
6840 
6841 	bus_dmamap_sync(sc->bge_cdata.bge_status_tag,
6842 	    sc->bge_cdata.bge_status_map,
6843 	    BUS_DMASYNC_POSTREAD | BUS_DMASYNC_POSTWRITE);
6844 
6845 	rx_prod = sc->bge_ldata.bge_status_block->bge_idx[0].bge_rx_prod_idx;
6846 	tx_cons = sc->bge_ldata.bge_status_block->bge_idx[0].bge_tx_cons_idx;
6847 
6848 	bus_dmamap_sync(sc->bge_cdata.bge_status_tag,
6849 	    sc->bge_cdata.bge_status_map,
6850 	    BUS_DMASYNC_PREREAD | BUS_DMASYNC_PREWRITE);
6851 
6852 	(void)bge_rxeof(sc, rx_prod, 0);
6853 	bge_txeof(sc, tx_cons);
6854 	return (0);
6855 }
6856 #endif /* DEBUGNET */
6857