[NET]: Add Sun Cassini driver.
David S. Miller [Tue, 27 Sep 2005 22:24:13 +0000 (15:24 -0700)]
Written by Adrian Sun (asun@darksunrising.com).
Ported to 2.6.x by Tom 'spot' Callaway <tcallawa@redhat.com>.
Further cleaned up and integrated by David S. Miller

Signed-off-by: David S. Miller <davem@davemloft.net>

drivers/net/Kconfig
drivers/net/Makefile
drivers/net/cassini.c [new file with mode: 0644]
drivers/net/cassini.h [new file with mode: 0644]
include/linux/pci_ids.h

index 96f14ab..2a908c4 100644 (file)
@@ -548,6 +548,14 @@ config SUNGEM
          Support for the Sun GEM chip, aka Sun GigabitEthernet/P 2.0.  See also
          <http://www.sun.com/products-n-solutions/hardware/docs/pdf/806-3985-10.pdf>.
 
+config CASSINI
+       tristate "Sun Cassini support"
+       depends on NET_ETHERNET && PCI
+       select CRC32
+       help
+         Support for the Sun Cassini chip, aka Sun GigaSwift Ethernet. See also
+         <http://www.sun.com/products-n-solutions/hardware/docs/pdf/817-4341-10.pdf>
+
 config NET_VENDOR_3COM
        bool "3COM cards"
        depends on NET_ETHERNET && (ISA || EISA || MCA || PCI)
index 8645c84..8aeec9f 100644 (file)
@@ -28,6 +28,7 @@ obj-$(CONFIG_SUNQE) += sunqe.o
 obj-$(CONFIG_SUNBMAC) += sunbmac.o
 obj-$(CONFIG_MYRI_SBUS) += myri_sbus.o
 obj-$(CONFIG_SUNGEM) += sungem.o sungem_phy.o
+obj-$(CONFIG_CASSINI) += cassini.o
 
 obj-$(CONFIG_MACE) += mace.o
 obj-$(CONFIG_BMAC) += bmac.o
diff --git a/drivers/net/cassini.c b/drivers/net/cassini.c
new file mode 100644 (file)
index 0000000..69cb368
--- /dev/null
@@ -0,0 +1,5311 @@
+/* cassini.c: Sun Microsystems Cassini(+) ethernet driver.
+ *
+ * Copyright (C) 2004 Sun Microsystems Inc.
+ * Copyright (C) 2003 Adrian Sun (asun@darksunrising.com)
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License as
+ * published by the Free Software Foundation; either version 2 of the
+ * License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA
+ * 02111-1307, USA.
+ *
+ * This driver uses the sungem driver (c) David Miller
+ * (davem@redhat.com) as its basis.
+ *
+ * The cassini chip has a number of features that distinguish it from
+ * the gem chip:
+ *  4 transmit descriptor rings that are used for either QoS (VLAN) or
+ *      load balancing (non-VLAN mode)
+ *  batching of multiple packets
+ *  multiple CPU dispatching
+ *  page-based RX descriptor engine with separate completion rings
+ *  Gigabit support (GMII and PCS interface)
+ *  MIF link up/down detection works
+ *
+ * RX is handled by page sized buffers that are attached as fragments to
+ * the skb. here's what's done:
+ *  -- driver allocates pages at a time and keeps reference counts
+ *     on them.
+ *  -- the upper protocol layers assume that the header is in the skb
+ *     itself. as a result, cassini will copy a small amount (64 bytes)
+ *     to make them happy.
+ *  -- driver appends the rest of the data pages as frags to skbuffs
+ *     and increments the reference count
+ *  -- on page reclamation, the driver swaps the page with a spare page.
+ *     if that page is still in use, it frees its reference to that page,
+ *     and allocates a new page for use. otherwise, it just recycles the
+ *     the page. 
+ *
+ * NOTE: cassini can parse the header. however, it's not worth it
+ *       as long as the network stack requires a header copy.
+ *
+ * TX has 4 queues. currently these queues are used in a round-robin
+ * fashion for load balancing. They can also be used for QoS. for that
+ * to work, however, QoS information needs to be exposed down to the driver
+ * level so that subqueues get targetted to particular transmit rings.
+ * alternatively, the queues can be configured via use of the all-purpose
+ * ioctl.
+ *
+ * RX DATA: the rx completion ring has all the info, but the rx desc
+ * ring has all of the data. RX can conceivably come in under multiple
+ * interrupts, but the INT# assignment needs to be set up properly by
+ * the BIOS and conveyed to the driver. PCI BIOSes don't know how to do
+ * that. also, the two descriptor rings are designed to distinguish between
+ * encrypted and non-encrypted packets, but we use them for buffering 
+ * instead.
+ *
+ * by default, the selective clear mask is set up to process rx packets.  
+ */
+
+#include <linux/config.h>
+#include <linux/version.h>
+
+#include <linux/module.h>
+#include <linux/kernel.h>
+#include <linux/types.h>
+#include <linux/compiler.h>
+#include <linux/slab.h>
+#include <linux/delay.h>
+#include <linux/init.h>
+#include <linux/ioport.h>
+#include <linux/pci.h>
+#include <linux/mm.h>
+#include <linux/highmem.h>
+#include <linux/list.h>
+#include <linux/dma-mapping.h>
+
+#include <linux/netdevice.h>
+#include <linux/etherdevice.h>
+#include <linux/skbuff.h>
+#include <linux/ethtool.h>
+#include <linux/crc32.h>
+#include <linux/random.h>
+#include <linux/mii.h>
+#include <linux/ip.h>
+#include <linux/tcp.h>
+
+#include <net/checksum.h>
+
+#include <asm/atomic.h>
+#include <asm/system.h>
+#include <asm/io.h>
+#include <asm/byteorder.h>
+#include <asm/uaccess.h>
+
+#define cas_page_map(x)      kmap_atomic((x), KM_SKB_DATA_SOFTIRQ)
+#define cas_page_unmap(x)    kunmap_atomic((x), KM_SKB_DATA_SOFTIRQ)
+#define CAS_NCPUS            num_online_cpus()
+
+#if defined(CONFIG_CASSINI_NAPI) && defined(HAVE_NETDEV_POLL)
+#define USE_NAPI
+#define cas_skb_release(x)  netif_receive_skb(x)
+#else
+#define cas_skb_release(x)  netif_rx(x)
+#endif
+
+/* select which firmware to use */
+#define USE_HP_WORKAROUND     
+#define HP_WORKAROUND_DEFAULT /* select which firmware to use as default */
+#define CAS_HP_ALT_FIRMWARE   cas_prog_null /* alternate firmware */
+
+#include "cassini.h"
+
+#define USE_TX_COMPWB      /* use completion writeback registers */
+#define USE_CSMA_CD_PROTO  /* standard CSMA/CD */
+#define USE_RX_BLANK       /* hw interrupt mitigation */
+#undef USE_ENTROPY_DEV     /* don't test for entropy device */
+
+/* NOTE: these aren't useable unless PCI interrupts can be assigned.
+ * also, we need to make cp->lock finer-grained.
+ */
+#undef  USE_PCI_INTB
+#undef  USE_PCI_INTC
+#undef  USE_PCI_INTD
+#undef  USE_QOS
+
+#undef  USE_VPD_DEBUG       /* debug vpd information if defined */
+
+/* rx processing options */
+#define USE_PAGE_ORDER      /* specify to allocate large rx pages */
+#define RX_DONT_BATCH  0    /* if 1, don't batch flows */
+#define RX_COPY_ALWAYS 0    /* if 0, use frags */
+#define RX_COPY_MIN    64   /* copy a little to make upper layers happy */
+#undef  RX_COUNT_BUFFERS    /* define to calculate RX buffer stats */
+
+#define DRV_MODULE_NAME                "cassini"
+#define PFX DRV_MODULE_NAME    ": "
+#define DRV_MODULE_VERSION     "1.4"
+#define DRV_MODULE_RELDATE     "1 July 2004"
+
+#define CAS_DEF_MSG_ENABLE       \
+       (NETIF_MSG_DRV          | \
+        NETIF_MSG_PROBE        | \
+        NETIF_MSG_LINK         | \
+        NETIF_MSG_TIMER        | \
+        NETIF_MSG_IFDOWN       | \
+        NETIF_MSG_IFUP         | \
+        NETIF_MSG_RX_ERR       | \
+        NETIF_MSG_TX_ERR)
+
+/* length of time before we decide the hardware is borked,
+ * and dev->tx_timeout() should be called to fix the problem
+ */
+#define CAS_TX_TIMEOUT                 (HZ)
+#define CAS_LINK_TIMEOUT                (22*HZ/10)
+#define CAS_LINK_FAST_TIMEOUT           (1)
+
+/* timeout values for state changing. these specify the number
+ * of 10us delays to be used before giving up.
+ */
+#define STOP_TRIES_PHY 1000
+#define STOP_TRIES     5000
+
+/* specify a minimum frame size to deal with some fifo issues 
+ * max mtu == 2 * page size - ethernet header - 64 - swivel =
+ *            2 * page_size - 0x50
+ */
+#define CAS_MIN_FRAME                  97
+#define CAS_1000MB_MIN_FRAME            255
+#define CAS_MIN_MTU                     60
+#define CAS_MAX_MTU                     min(((cp->page_size << 1) - 0x50), 9000)
+
+#if 1
+/*
+ * Eliminate these and use separate atomic counters for each, to
+ * avoid a race condition.
+ */
+#else
+#define CAS_RESET_MTU                   1
+#define CAS_RESET_ALL                   2
+#define CAS_RESET_SPARE                 3
+#endif
+
+static char version[] __devinitdata =
+       DRV_MODULE_NAME ".c:v" DRV_MODULE_VERSION " (" DRV_MODULE_RELDATE ")\n";
+
+MODULE_AUTHOR("Adrian Sun (asun@darksunrising.com)");
+MODULE_DESCRIPTION("Sun Cassini(+) ethernet driver");
+MODULE_LICENSE("GPL");
+MODULE_PARM(cassini_debug, "i");
+MODULE_PARM_DESC(cassini_debug, "Cassini bitmapped debugging message enable value");
+MODULE_PARM(link_mode, "i");
+MODULE_PARM_DESC(link_mode, "default link mode");
+
+/*
+ * Work around for a PCS bug in which the link goes down due to the chip
+ * being confused and never showing a link status of "up."
+ */
+#define DEFAULT_LINKDOWN_TIMEOUT 5
+/* 
+ * Value in seconds, for user input.
+ */
+static int linkdown_timeout = DEFAULT_LINKDOWN_TIMEOUT;
+MODULE_PARM(linkdown_timeout, "i");
+MODULE_PARM_DESC(linkdown_timeout,
+"min reset interval in sec. for PCS linkdown issue; disabled if not positive");
+
+/*
+ * value in 'ticks' (units used by jiffies). Set when we init the
+ * module because 'HZ' in actually a function call on some flavors of
+ * Linux.  This will default to DEFAULT_LINKDOWN_TIMEOUT * HZ.
+ */
+static int link_transition_timeout;
+
+
+static int cassini_debug = -1; /* -1 == use CAS_DEF_MSG_ENABLE as value */
+static int link_mode;
+
+static u16 link_modes[] __devinitdata = {
+       BMCR_ANENABLE,                   /* 0 : autoneg */
+       0,                               /* 1 : 10bt half duplex */
+       BMCR_SPEED100,                   /* 2 : 100bt half duplex */
+       BMCR_FULLDPLX,                   /* 3 : 10bt full duplex */
+       BMCR_SPEED100|BMCR_FULLDPLX,     /* 4 : 100bt full duplex */
+       CAS_BMCR_SPEED1000|BMCR_FULLDPLX /* 5 : 1000bt full duplex */
+};
+
+static struct pci_device_id cas_pci_tbl[] __devinitdata = {
+       { PCI_VENDOR_ID_SUN, PCI_DEVICE_ID_SUN_CASSINI,
+         PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0UL },
+       { PCI_VENDOR_ID_NS, PCI_DEVICE_ID_NS_SATURN,
+         PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0UL },
+       { 0, }
+};
+
+MODULE_DEVICE_TABLE(pci, cas_pci_tbl);
+
+static void cas_set_link_modes(struct cas *cp);
+
+static inline void cas_lock_tx(struct cas *cp)
+{
+       int i;
+
+       for (i = 0; i < N_TX_RINGS; i++)  
+               spin_lock(&cp->tx_lock[i]);
+}
+
+static inline void cas_lock_all(struct cas *cp)
+{
+       spin_lock_irq(&cp->lock);
+       cas_lock_tx(cp);
+}
+
+/* WTZ: QA was finding deadlock problems with the previous
+ * versions after long test runs with multiple cards per machine.
+ * See if replacing cas_lock_all with safer versions helps. The
+ * symptoms QA is reporting match those we'd expect if interrupts
+ * aren't being properly restored, and we fixed a previous deadlock
+ * with similar symptoms by using save/restore versions in other
+ * places.
+ */
+#define cas_lock_all_save(cp, flags) \
+do { \
+       struct cas *xxxcp = (cp); \
+       spin_lock_irqsave(&xxxcp->lock, flags); \
+       cas_lock_tx(xxxcp); \
+} while (0)
+
+static inline void cas_unlock_tx(struct cas *cp)
+{
+       int i;
+
+       for (i = N_TX_RINGS; i > 0; i--)  
+               spin_unlock(&cp->tx_lock[i - 1]);  
+}
+
+static inline void cas_unlock_all(struct cas *cp)
+{
+       cas_unlock_tx(cp);
+       spin_unlock_irq(&cp->lock);
+}
+
+#define cas_unlock_all_restore(cp, flags) \
+do { \
+       struct cas *xxxcp = (cp); \
+       cas_unlock_tx(xxxcp); \
+       spin_unlock_irqrestore(&xxxcp->lock, flags); \
+} while (0)
+
+static void cas_disable_irq(struct cas *cp, const int ring)
+{
+       /* Make sure we won't get any more interrupts */
+       if (ring == 0) {
+               writel(0xFFFFFFFF, cp->regs + REG_INTR_MASK);
+               return;
+       }
+
+       /* disable completion interrupts and selectively mask */
+       if (cp->cas_flags & CAS_FLAG_REG_PLUS) {
+               switch (ring) {
+#if defined (USE_PCI_INTB) || defined(USE_PCI_INTC) || defined(USE_PCI_INTD)
+#ifdef USE_PCI_INTB
+               case 1:
+#endif
+#ifdef USE_PCI_INTC
+               case 2:
+#endif
+#ifdef USE_PCI_INTD
+               case 3:
+#endif
+                       writel(INTRN_MASK_CLEAR_ALL | INTRN_MASK_RX_EN, 
+                              cp->regs + REG_PLUS_INTRN_MASK(ring));
+                       break;
+#endif
+               default:
+                       writel(INTRN_MASK_CLEAR_ALL, cp->regs +
+                              REG_PLUS_INTRN_MASK(ring));
+                       break;
+               }
+       }
+}
+
+static inline void cas_mask_intr(struct cas *cp)
+{
+       int i;
+
+       for (i = 0; i < N_RX_COMP_RINGS; i++)
+               cas_disable_irq(cp, i);
+}
+
+static void cas_enable_irq(struct cas *cp, const int ring)
+{
+       if (ring == 0) { /* all but TX_DONE */
+               writel(INTR_TX_DONE, cp->regs + REG_INTR_MASK);
+               return;
+       }
+
+       if (cp->cas_flags & CAS_FLAG_REG_PLUS) {
+               switch (ring) {
+#if defined (USE_PCI_INTB) || defined(USE_PCI_INTC) || defined(USE_PCI_INTD)
+#ifdef USE_PCI_INTB
+               case 1:
+#endif
+#ifdef USE_PCI_INTC
+               case 2:
+#endif
+#ifdef USE_PCI_INTD
+               case 3:
+#endif
+                       writel(INTRN_MASK_RX_EN, cp->regs +
+                              REG_PLUS_INTRN_MASK(ring));
+                       break;
+#endif
+               default:
+                       break;
+               }
+       }
+}
+
+static inline void cas_unmask_intr(struct cas *cp)
+{
+       int i;
+
+       for (i = 0; i < N_RX_COMP_RINGS; i++)
+               cas_enable_irq(cp, i);
+}
+
+static inline void cas_entropy_gather(struct cas *cp)
+{
+#ifdef USE_ENTROPY_DEV
+       if ((cp->cas_flags & CAS_FLAG_ENTROPY_DEV) == 0)
+               return;
+
+       batch_entropy_store(readl(cp->regs + REG_ENTROPY_IV),
+                           readl(cp->regs + REG_ENTROPY_IV),
+                           sizeof(uint64_t)*8);
+#endif
+}
+
+static inline void cas_entropy_reset(struct cas *cp)
+{
+#ifdef USE_ENTROPY_DEV
+       if ((cp->cas_flags & CAS_FLAG_ENTROPY_DEV) == 0)
+               return;
+
+       writel(BIM_LOCAL_DEV_PAD | BIM_LOCAL_DEV_PROM | BIM_LOCAL_DEV_EXT, 
+              cp->regs + REG_BIM_LOCAL_DEV_EN);
+       writeb(ENTROPY_RESET_STC_MODE, cp->regs + REG_ENTROPY_RESET);
+       writeb(0x55, cp->regs + REG_ENTROPY_RAND_REG);
+
+       /* if we read back 0x0, we don't have an entropy device */
+       if (readb(cp->regs + REG_ENTROPY_RAND_REG) == 0)
+               cp->cas_flags &= ~CAS_FLAG_ENTROPY_DEV;
+#endif
+}
+
+/* access to the phy. the following assumes that we've initialized the MIF to 
+ * be in frame rather than bit-bang mode
+ */
+static u16 cas_phy_read(struct cas *cp, int reg)
+{
+       u32 cmd;
+       int limit = STOP_TRIES_PHY;
+
+       cmd = MIF_FRAME_ST | MIF_FRAME_OP_READ;
+       cmd |= CAS_BASE(MIF_FRAME_PHY_ADDR, cp->phy_addr);
+       cmd |= CAS_BASE(MIF_FRAME_REG_ADDR, reg);
+       cmd |= MIF_FRAME_TURN_AROUND_MSB;
+       writel(cmd, cp->regs + REG_MIF_FRAME);
+       
+       /* poll for completion */
+       while (limit-- > 0) {
+               udelay(10);
+               cmd = readl(cp->regs + REG_MIF_FRAME);
+               if (cmd & MIF_FRAME_TURN_AROUND_LSB)
+                       return (cmd & MIF_FRAME_DATA_MASK);
+       }
+       return 0xFFFF; /* -1 */
+}
+
+static int cas_phy_write(struct cas *cp, int reg, u16 val)
+{
+       int limit = STOP_TRIES_PHY;
+       u32 cmd;
+
+       cmd = MIF_FRAME_ST | MIF_FRAME_OP_WRITE;
+       cmd |= CAS_BASE(MIF_FRAME_PHY_ADDR, cp->phy_addr);
+       cmd |= CAS_BASE(MIF_FRAME_REG_ADDR, reg);
+       cmd |= MIF_FRAME_TURN_AROUND_MSB;
+       cmd |= val & MIF_FRAME_DATA_MASK;
+       writel(cmd, cp->regs + REG_MIF_FRAME);
+       
+       /* poll for completion */
+       while (limit-- > 0) {
+               udelay(10);
+               cmd = readl(cp->regs + REG_MIF_FRAME);
+               if (cmd & MIF_FRAME_TURN_AROUND_LSB)
+                       return 0;
+       }
+       return -1;
+}
+
+static void cas_phy_powerup(struct cas *cp)
+{
+       u16 ctl = cas_phy_read(cp, MII_BMCR);   
+
+       if ((ctl & BMCR_PDOWN) == 0)
+               return;
+       ctl &= ~BMCR_PDOWN;
+       cas_phy_write(cp, MII_BMCR, ctl);
+}
+
+static void cas_phy_powerdown(struct cas *cp)
+{
+       u16 ctl = cas_phy_read(cp, MII_BMCR);   
+
+       if (ctl & BMCR_PDOWN)
+               return;
+       ctl |= BMCR_PDOWN;
+       cas_phy_write(cp, MII_BMCR, ctl);
+}
+
+/* cp->lock held. note: the last put_page will free the buffer */
+static int cas_page_free(struct cas *cp, cas_page_t *page)
+{
+       pci_unmap_page(cp->pdev, page->dma_addr, cp->page_size, 
+                      PCI_DMA_FROMDEVICE);
+       __free_pages(page->buffer, cp->page_order);
+       kfree(page);
+       return 0;
+}
+
+#ifdef RX_COUNT_BUFFERS
+#define RX_USED_ADD(x, y)       ((x)->used += (y))
+#define RX_USED_SET(x, y)       ((x)->used  = (y))
+#else
+#define RX_USED_ADD(x, y) 
+#define RX_USED_SET(x, y)
+#endif
+
+/* local page allocation routines for the receive buffers. jumbo pages
+ * require at least 8K contiguous and 8K aligned buffers.
+ */
+static cas_page_t *cas_page_alloc(struct cas *cp, const int flags)
+{
+       cas_page_t *page;
+
+       page = kmalloc(sizeof(cas_page_t), flags);
+       if (!page)
+               return NULL;
+
+       INIT_LIST_HEAD(&page->list);
+       RX_USED_SET(page, 0);
+       page->buffer = alloc_pages(flags, cp->page_order);
+       if (!page->buffer)
+               goto page_err;
+       page->dma_addr = pci_map_page(cp->pdev, page->buffer, 0,
+                                     cp->page_size, PCI_DMA_FROMDEVICE);
+       return page;
+
+page_err:
+       kfree(page);
+       return NULL;
+}
+
+/* initialize spare pool of rx buffers, but allocate during the open */
+static void cas_spare_init(struct cas *cp)
+{
+       spin_lock(&cp->rx_inuse_lock);
+       INIT_LIST_HEAD(&cp->rx_inuse_list);
+       spin_unlock(&cp->rx_inuse_lock);
+
+       spin_lock(&cp->rx_spare_lock);
+       INIT_LIST_HEAD(&cp->rx_spare_list);
+       cp->rx_spares_needed = RX_SPARE_COUNT;
+       spin_unlock(&cp->rx_spare_lock);
+}
+
+/* used on close. free all the spare buffers. */
+static void cas_spare_free(struct cas *cp)
+{
+       struct list_head list, *elem, *tmp;
+
+       /* free spare buffers */
+       INIT_LIST_HEAD(&list);
+       spin_lock(&cp->rx_spare_lock);
+       list_splice(&cp->rx_spare_list, &list);
+       INIT_LIST_HEAD(&cp->rx_spare_list);
+       spin_unlock(&cp->rx_spare_lock);
+       list_for_each_safe(elem, tmp, &list) {
+               cas_page_free(cp, list_entry(elem, cas_page_t, list));
+       }
+
+       INIT_LIST_HEAD(&list);
+#if 1
+       /*
+        * Looks like Adrian had protected this with a different
+        * lock than used everywhere else to manipulate this list.
+        */
+       spin_lock(&cp->rx_inuse_lock);
+       list_splice(&cp->rx_inuse_list, &list);
+       INIT_LIST_HEAD(&cp->rx_inuse_list);
+       spin_unlock(&cp->rx_inuse_lock);
+#else
+       spin_lock(&cp->rx_spare_lock);
+       list_splice(&cp->rx_inuse_list, &list);
+       INIT_LIST_HEAD(&cp->rx_inuse_list);
+       spin_unlock(&cp->rx_spare_lock);
+#endif
+       list_for_each_safe(elem, tmp, &list) {
+               cas_page_free(cp, list_entry(elem, cas_page_t, list));
+       }
+}
+
+/* replenish spares if needed */
+static void cas_spare_recover(struct cas *cp, const int flags)
+{
+       struct list_head list, *elem, *tmp;
+       int needed, i;
+
+       /* check inuse list. if we don't need any more free buffers,
+        * just free it
+        */
+
+       /* make a local copy of the list */
+       INIT_LIST_HEAD(&list);
+       spin_lock(&cp->rx_inuse_lock);
+       list_splice(&cp->rx_inuse_list, &list);
+       INIT_LIST_HEAD(&cp->rx_inuse_list);
+       spin_unlock(&cp->rx_inuse_lock);
+       
+       list_for_each_safe(elem, tmp, &list) {
+               cas_page_t *page = list_entry(elem, cas_page_t, list);
+
+               if (page_count(page->buffer) > 1) 
+                       continue;
+
+               list_del(elem);
+               spin_lock(&cp->rx_spare_lock);
+               if (cp->rx_spares_needed > 0) {
+                       list_add(elem, &cp->rx_spare_list);
+                       cp->rx_spares_needed--;
+                       spin_unlock(&cp->rx_spare_lock);
+               } else {
+                       spin_unlock(&cp->rx_spare_lock);
+                       cas_page_free(cp, page);
+               }
+       }
+
+       /* put any inuse buffers back on the list */
+       if (!list_empty(&list)) {
+               spin_lock(&cp->rx_inuse_lock);
+               list_splice(&list, &cp->rx_inuse_list);
+               spin_unlock(&cp->rx_inuse_lock);
+       }
+       
+       spin_lock(&cp->rx_spare_lock);
+       needed = cp->rx_spares_needed;
+       spin_unlock(&cp->rx_spare_lock);
+       if (!needed)
+               return;
+
+       /* we still need spares, so try to allocate some */
+       INIT_LIST_HEAD(&list);
+       i = 0;
+       while (i < needed) {
+               cas_page_t *spare = cas_page_alloc(cp, flags);
+               if (!spare) 
+                       break;
+               list_add(&spare->list, &list);
+               i++;
+       }
+
+       spin_lock(&cp->rx_spare_lock);
+       list_splice(&list, &cp->rx_spare_list);
+       cp->rx_spares_needed -= i;
+       spin_unlock(&cp->rx_spare_lock);
+}
+
+/* pull a page from the list. */
+static cas_page_t *cas_page_dequeue(struct cas *cp)
+{
+       struct list_head *entry;
+       int recover;
+
+       spin_lock(&cp->rx_spare_lock);
+       if (list_empty(&cp->rx_spare_list)) {
+               /* try to do a quick recovery */
+               spin_unlock(&cp->rx_spare_lock);
+               cas_spare_recover(cp, GFP_ATOMIC);
+               spin_lock(&cp->rx_spare_lock);
+               if (list_empty(&cp->rx_spare_list)) {
+                       if (netif_msg_rx_err(cp))
+                               printk(KERN_ERR "%s: no spare buffers "
+                                      "available.\n", cp->dev->name);
+                       spin_unlock(&cp->rx_spare_lock);
+                       return NULL;
+               }
+       }
+
+       entry = cp->rx_spare_list.next;
+       list_del(entry);
+       recover = ++cp->rx_spares_needed;
+       spin_unlock(&cp->rx_spare_lock);
+
+       /* trigger the timer to do the recovery */
+       if ((recover & (RX_SPARE_RECOVER_VAL - 1)) == 0) {
+#if 1
+               atomic_inc(&cp->reset_task_pending);
+               atomic_inc(&cp->reset_task_pending_spare);
+               schedule_work(&cp->reset_task);
+#else
+               atomic_set(&cp->reset_task_pending, CAS_RESET_SPARE);
+               schedule_work(&cp->reset_task);
+#endif
+       }
+       return list_entry(entry, cas_page_t, list);
+}
+
+
+static void cas_mif_poll(struct cas *cp, const int enable)
+{
+       u32 cfg;
+       
+       cfg  = readl(cp->regs + REG_MIF_CFG); 
+       cfg &= (MIF_CFG_MDIO_0 | MIF_CFG_MDIO_1);
+
+       if (cp->phy_type & CAS_PHY_MII_MDIO1)
+               cfg |= MIF_CFG_PHY_SELECT; 
+
+       /* poll and interrupt on link status change. */
+       if (enable) {
+               cfg |= MIF_CFG_POLL_EN;
+               cfg |= CAS_BASE(MIF_CFG_POLL_REG, MII_BMSR);
+               cfg |= CAS_BASE(MIF_CFG_POLL_PHY, cp->phy_addr);
+       }
+       writel((enable) ? ~(BMSR_LSTATUS | BMSR_ANEGCOMPLETE) : 0xFFFF, 
+              cp->regs + REG_MIF_MASK); 
+       writel(cfg, cp->regs + REG_MIF_CFG);
+}
+
+/* Must be invoked under cp->lock */
+static void cas_begin_auto_negotiation(struct cas *cp, struct ethtool_cmd *ep)
+{
+       u16 ctl;
+#if 1
+       int lcntl;
+       int changed = 0;
+       int oldstate = cp->lstate;
+       int link_was_not_down = !(oldstate == link_down);
+#endif
+       /* Setup link parameters */
+       if (!ep)
+               goto start_aneg;
+       lcntl = cp->link_cntl;
+       if (ep->autoneg == AUTONEG_ENABLE)
+               cp->link_cntl = BMCR_ANENABLE;
+       else {
+               cp->link_cntl = 0;
+               if (ep->speed == SPEED_100)
+                       cp->link_cntl |= BMCR_SPEED100;
+               else if (ep->speed == SPEED_1000)
+                       cp->link_cntl |= CAS_BMCR_SPEED1000;
+               if (ep->duplex == DUPLEX_FULL)
+                       cp->link_cntl |= BMCR_FULLDPLX;
+       }
+#if 1
+       changed = (lcntl != cp->link_cntl);
+#endif
+start_aneg:
+       if (cp->lstate == link_up) {
+               printk(KERN_INFO "%s: PCS link down.\n",
+                      cp->dev->name);
+       } else {
+               if (changed) {
+                       printk(KERN_INFO "%s: link configuration changed\n",
+                              cp->dev->name);
+               }
+       }
+       cp->lstate = link_down;
+       cp->link_transition = LINK_TRANSITION_LINK_DOWN;
+       if (!cp->hw_running)
+               return;
+#if 1
+       /*
+        * WTZ: If the old state was link_up, we turn off the carrier
+        * to replicate everything we do elsewhere on a link-down
+        * event when we were already in a link-up state..  
+        */
+       if (oldstate == link_up)
+               netif_carrier_off(cp->dev);
+       if (changed  && link_was_not_down) {
+               /*
+                * WTZ: This branch will simply schedule a full reset after
+                * we explicitly changed link modes in an ioctl. See if this
+                * fixes the link-problems we were having for forced mode. 
+                */
+               atomic_inc(&cp->reset_task_pending);
+               atomic_inc(&cp->reset_task_pending_all);
+               schedule_work(&cp->reset_task);
+               cp->timer_ticks = 0;
+               mod_timer(&cp->link_timer, jiffies + CAS_LINK_TIMEOUT);
+               return;
+       }
+#endif
+       if (cp->phy_type & CAS_PHY_SERDES) {
+               u32 val = readl(cp->regs + REG_PCS_MII_CTRL);
+
+               if (cp->link_cntl & BMCR_ANENABLE) {
+                       val |= (PCS_MII_RESTART_AUTONEG | PCS_MII_AUTONEG_EN);
+                       cp->lstate = link_aneg;
+               } else {
+                       if (cp->link_cntl & BMCR_FULLDPLX)
+                               val |= PCS_MII_CTRL_DUPLEX;
+                       val &= ~PCS_MII_AUTONEG_EN;
+                       cp->lstate = link_force_ok;
+               }
+               cp->link_transition = LINK_TRANSITION_LINK_CONFIG;
+               writel(val, cp->regs + REG_PCS_MII_CTRL);
+
+       } else {
+               cas_mif_poll(cp, 0);
+               ctl = cas_phy_read(cp, MII_BMCR);
+               ctl &= ~(BMCR_FULLDPLX | BMCR_SPEED100 | 
+                        CAS_BMCR_SPEED1000 | BMCR_ANENABLE);
+               ctl |= cp->link_cntl;
+               if (ctl & BMCR_ANENABLE) {
+                       ctl |= BMCR_ANRESTART;
+                       cp->lstate = link_aneg;
+               } else {
+                       cp->lstate = link_force_ok;
+               }
+               cp->link_transition = LINK_TRANSITION_LINK_CONFIG;
+               cas_phy_write(cp, MII_BMCR, ctl);
+               cas_mif_poll(cp, 1);
+       }
+
+       cp->timer_ticks = 0;
+       mod_timer(&cp->link_timer, jiffies + CAS_LINK_TIMEOUT);
+}
+
+/* Must be invoked under cp->lock. */
+static int cas_reset_mii_phy(struct cas *cp)
+{
+       int limit = STOP_TRIES_PHY;
+       u16 val;
+       
+       cas_phy_write(cp, MII_BMCR, BMCR_RESET);
+       udelay(100);
+       while (limit--) {
+               val = cas_phy_read(cp, MII_BMCR);
+               if ((val & BMCR_RESET) == 0)
+                       break;
+               udelay(10);
+       }
+       return (limit <= 0);
+}
+
+static void cas_saturn_firmware_load(struct cas *cp)
+{
+       cas_saturn_patch_t *patch = cas_saturn_patch;
+
+       cas_phy_powerdown(cp);
+
+       /* expanded memory access mode */
+       cas_phy_write(cp, DP83065_MII_MEM, 0x0);
+
+       /* pointer configuration for new firmware */
+       cas_phy_write(cp, DP83065_MII_REGE, 0x8ff9);
+       cas_phy_write(cp, DP83065_MII_REGD, 0xbd);
+       cas_phy_write(cp, DP83065_MII_REGE, 0x8ffa);
+       cas_phy_write(cp, DP83065_MII_REGD, 0x82);
+       cas_phy_write(cp, DP83065_MII_REGE, 0x8ffb);
+       cas_phy_write(cp, DP83065_MII_REGD, 0x0);
+       cas_phy_write(cp, DP83065_MII_REGE, 0x8ffc);
+       cas_phy_write(cp, DP83065_MII_REGD, 0x39);
+
+       /* download new firmware */
+       cas_phy_write(cp, DP83065_MII_MEM, 0x1);
+       cas_phy_write(cp, DP83065_MII_REGE, patch->addr);
+       while (patch->addr) {
+               cas_phy_write(cp, DP83065_MII_REGD, patch->val);
+               patch++;
+       }
+
+       /* enable firmware */
+       cas_phy_write(cp, DP83065_MII_REGE, 0x8ff8);
+       cas_phy_write(cp, DP83065_MII_REGD, 0x1);
+}
+
+
+/* phy initialization */
+static void cas_phy_init(struct cas *cp)
+{
+       u16 val;
+
+       /* if we're in MII/GMII mode, set up phy */
+       if (CAS_PHY_MII(cp->phy_type)) {
+               writel(PCS_DATAPATH_MODE_MII,
+                      cp->regs + REG_PCS_DATAPATH_MODE);
+
+               cas_mif_poll(cp, 0);
+               cas_reset_mii_phy(cp); /* take out of isolate mode */
+
+               if (PHY_LUCENT_B0 == cp->phy_id) {
+                       /* workaround link up/down issue with lucent */
+                       cas_phy_write(cp, LUCENT_MII_REG, 0x8000);
+                       cas_phy_write(cp, MII_BMCR, 0x00f1);
+                       cas_phy_write(cp, LUCENT_MII_REG, 0x0);
+
+               } else if (PHY_BROADCOM_B0 == (cp->phy_id & 0xFFFFFFFC)) {
+                       /* workarounds for broadcom phy */
+                       cas_phy_write(cp, BROADCOM_MII_REG8, 0x0C20);
+                       cas_phy_write(cp, BROADCOM_MII_REG7, 0x0012);
+                       cas_phy_write(cp, BROADCOM_MII_REG5, 0x1804);
+                       cas_phy_write(cp, BROADCOM_MII_REG7, 0x0013);
+                       cas_phy_write(cp, BROADCOM_MII_REG5, 0x1204);
+                       cas_phy_write(cp, BROADCOM_MII_REG7, 0x8006);
+                       cas_phy_write(cp, BROADCOM_MII_REG5, 0x0132);
+                       cas_phy_write(cp, BROADCOM_MII_REG7, 0x8006);
+                       cas_phy_write(cp, BROADCOM_MII_REG5, 0x0232);
+                       cas_phy_write(cp, BROADCOM_MII_REG7, 0x201F);
+                       cas_phy_write(cp, BROADCOM_MII_REG5, 0x0A20);
+
+               } else if (PHY_BROADCOM_5411 == cp->phy_id) {
+                       val = cas_phy_read(cp, BROADCOM_MII_REG4);
+                       val = cas_phy_read(cp, BROADCOM_MII_REG4);
+                       if (val & 0x0080) {
+                               /* link workaround */
+                               cas_phy_write(cp, BROADCOM_MII_REG4, 
+                                             val & ~0x0080);
+                       }
+                       
+               } else if (cp->cas_flags & CAS_FLAG_SATURN) {
+                       writel((cp->phy_type & CAS_PHY_MII_MDIO0) ? 
+                              SATURN_PCFG_FSI : 0x0, 
+                              cp->regs + REG_SATURN_PCFG);
+
+                       /* load firmware to address 10Mbps auto-negotiation
+                        * issue. NOTE: this will need to be changed if the 
+                        * default firmware gets fixed.
+                        */
+                       if (PHY_NS_DP83065 == cp->phy_id) {
+                               cas_saturn_firmware_load(cp);
+                       }
+                       cas_phy_powerup(cp);
+               }
+
+               /* advertise capabilities */
+               val = cas_phy_read(cp, MII_BMCR);
+               val &= ~BMCR_ANENABLE;
+               cas_phy_write(cp, MII_BMCR, val);
+               udelay(10);
+
+               cas_phy_write(cp, MII_ADVERTISE,
+                             cas_phy_read(cp, MII_ADVERTISE) |
+                             (ADVERTISE_10HALF | ADVERTISE_10FULL |
+                              ADVERTISE_100HALF | ADVERTISE_100FULL |
+                              CAS_ADVERTISE_PAUSE | 
+                              CAS_ADVERTISE_ASYM_PAUSE));
+               
+               if (cp->cas_flags & CAS_FLAG_1000MB_CAP) {
+                       /* make sure that we don't advertise half
+                        * duplex to avoid a chip issue
+                        */
+                       val  = cas_phy_read(cp, CAS_MII_1000_CTRL);
+                       val &= ~CAS_ADVERTISE_1000HALF;
+                       val |= CAS_ADVERTISE_1000FULL;
+                       cas_phy_write(cp, CAS_MII_1000_CTRL, val);
+               }
+
+       } else {
+               /* reset pcs for serdes */
+               u32 val;
+               int limit;
+
+               writel(PCS_DATAPATH_MODE_SERDES,
+                      cp->regs + REG_PCS_DATAPATH_MODE);
+
+               /* enable serdes pins on saturn */
+               if (cp->cas_flags & CAS_FLAG_SATURN)
+                       writel(0, cp->regs + REG_SATURN_PCFG);
+
+               /* Reset PCS unit. */
+               val = readl(cp->regs + REG_PCS_MII_CTRL);
+               val |= PCS_MII_RESET;
+               writel(val, cp->regs + REG_PCS_MII_CTRL);
+
+               limit = STOP_TRIES;
+               while (limit-- > 0) {
+                       udelay(10);
+                       if ((readl(cp->regs + REG_PCS_MII_CTRL) & 
+                            PCS_MII_RESET) == 0)
+                               break;
+               }
+               if (limit <= 0)
+                       printk(KERN_WARNING "%s: PCS reset bit would not "
+                              "clear [%08x].\n", cp->dev->name,
+                              readl(cp->regs + REG_PCS_STATE_MACHINE));
+
+               /* Make sure PCS is disabled while changing advertisement
+                * configuration.
+                */
+               writel(0x0, cp->regs + REG_PCS_CFG);
+
+               /* Advertise all capabilities except half-duplex. */
+               val  = readl(cp->regs + REG_PCS_MII_ADVERT);
+               val &= ~PCS_MII_ADVERT_HD;
+               val |= (PCS_MII_ADVERT_FD | PCS_MII_ADVERT_SYM_PAUSE | 
+                       PCS_MII_ADVERT_ASYM_PAUSE);
+               writel(val, cp->regs + REG_PCS_MII_ADVERT);
+
+               /* enable PCS */
+               writel(PCS_CFG_EN, cp->regs + REG_PCS_CFG);
+
+               /* pcs workaround: enable sync detect */
+               writel(PCS_SERDES_CTRL_SYNCD_EN,
+                      cp->regs + REG_PCS_SERDES_CTRL);
+       }
+}
+
+
+static int cas_pcs_link_check(struct cas *cp)
+{
+       u32 stat, state_machine;
+       int retval = 0;
+
+       /* The link status bit latches on zero, so you must
+        * read it twice in such a case to see a transition
+        * to the link being up.
+        */
+       stat = readl(cp->regs + REG_PCS_MII_STATUS);
+       if ((stat & PCS_MII_STATUS_LINK_STATUS) == 0)
+               stat = readl(cp->regs + REG_PCS_MII_STATUS);
+
+       /* The remote-fault indication is only valid
+        * when autoneg has completed.
+        */
+       if ((stat & (PCS_MII_STATUS_AUTONEG_COMP |
+                    PCS_MII_STATUS_REMOTE_FAULT)) ==
+           (PCS_MII_STATUS_AUTONEG_COMP | PCS_MII_STATUS_REMOTE_FAULT)) {
+               if (netif_msg_link(cp))
+                       printk(KERN_INFO "%s: PCS RemoteFault\n", 
+                              cp->dev->name);
+       }
+
+       /* work around link detection issue by querying the PCS state
+        * machine directly.
+        */
+       state_machine = readl(cp->regs + REG_PCS_STATE_MACHINE);
+       if ((state_machine & PCS_SM_LINK_STATE_MASK) != SM_LINK_STATE_UP) {
+               stat &= ~PCS_MII_STATUS_LINK_STATUS;
+       } else if (state_machine & PCS_SM_WORD_SYNC_STATE_MASK) {
+               stat |= PCS_MII_STATUS_LINK_STATUS;
+       }
+
+       if (stat & PCS_MII_STATUS_LINK_STATUS) {
+               if (cp->lstate != link_up) {
+                       if (cp->opened) {
+                               cp->lstate = link_up;
+                               cp->link_transition = LINK_TRANSITION_LINK_UP;
+                               
+                               cas_set_link_modes(cp);
+                               netif_carrier_on(cp->dev);
+                       }
+               }
+       } else if (cp->lstate == link_up) {
+               cp->lstate = link_down;
+               if (link_transition_timeout != 0 &&
+                   cp->link_transition != LINK_TRANSITION_REQUESTED_RESET &&
+                   !cp->link_transition_jiffies_valid) {
+                       /*
+                        * force a reset, as a workaround for the 
+                        * link-failure problem. May want to move this to a 
+                        * point a bit earlier in the sequence. If we had
+                        * generated a reset a short time ago, we'll wait for
+                        * the link timer to check the status until a
+                        * timer expires (link_transistion_jiffies_valid is
+                        * true when the timer is running.)  Instead of using
+                        * a system timer, we just do a check whenever the
+                        * link timer is running - this clears the flag after
+                        * a suitable delay.
+                        */
+                       retval = 1;
+                       cp->link_transition = LINK_TRANSITION_REQUESTED_RESET;
+                       cp->link_transition_jiffies = jiffies;
+                       cp->link_transition_jiffies_valid = 1;
+               } else {
+                       cp->link_transition = LINK_TRANSITION_ON_FAILURE;
+               }
+               netif_carrier_off(cp->dev);
+               if (cp->opened && netif_msg_link(cp)) {
+                       printk(KERN_INFO "%s: PCS link down.\n",
+                              cp->dev->name);
+               }
+
+               /* Cassini only: if you force a mode, there can be
+                * sync problems on link down. to fix that, the following
+                * things need to be checked:
+                * 1) read serialink state register
+                * 2) read pcs status register to verify link down.
+                * 3) if link down and serial link == 0x03, then you need
+                *    to global reset the chip.
+                */
+               if ((cp->cas_flags & CAS_FLAG_REG_PLUS) == 0) {
+                       /* should check to see if we're in a forced mode */
+                       stat = readl(cp->regs + REG_PCS_SERDES_STATE);
+                       if (stat == 0x03)
+                               return 1;
+               }
+       } else if (cp->lstate == link_down) {
+               if (link_transition_timeout != 0 &&
+                   cp->link_transition != LINK_TRANSITION_REQUESTED_RESET &&
+                   !cp->link_transition_jiffies_valid) {
+                       /* force a reset, as a workaround for the
+                        * link-failure problem.  May want to move
+                        * this to a point a bit earlier in the
+                        * sequence.
+                        */
+                       retval = 1;
+                       cp->link_transition = LINK_TRANSITION_REQUESTED_RESET;
+                       cp->link_transition_jiffies = jiffies;
+                       cp->link_transition_jiffies_valid = 1;
+               } else {
+                       cp->link_transition = LINK_TRANSITION_STILL_FAILED;
+               }
+       }
+
+       return retval;
+}
+
+static int cas_pcs_interrupt(struct net_device *dev, 
+                            struct cas *cp, u32 status)
+{
+       u32 stat = readl(cp->regs + REG_PCS_INTR_STATUS);
+
+       if ((stat & PCS_INTR_STATUS_LINK_CHANGE) == 0) 
+               return 0;
+       return cas_pcs_link_check(cp);
+}
+
+static int cas_txmac_interrupt(struct net_device *dev, 
+                              struct cas *cp, u32 status)
+{
+       u32 txmac_stat = readl(cp->regs + REG_MAC_TX_STATUS);
+
+       if (!txmac_stat)
+               return 0;
+
+       if (netif_msg_intr(cp))
+               printk(KERN_DEBUG "%s: txmac interrupt, txmac_stat: 0x%x\n",
+                       cp->dev->name, txmac_stat);
+
+       /* Defer timer expiration is quite normal,
+        * don't even log the event.
+        */
+       if ((txmac_stat & MAC_TX_DEFER_TIMER) &&
+           !(txmac_stat & ~MAC_TX_DEFER_TIMER))
+               return 0;
+
+       spin_lock(&cp->stat_lock[0]);
+       if (txmac_stat & MAC_TX_UNDERRUN) {
+               printk(KERN_ERR "%s: TX MAC xmit underrun.\n",
+                      dev->name);
+               cp->net_stats[0].tx_fifo_errors++;
+       }
+
+       if (txmac_stat & MAC_TX_MAX_PACKET_ERR) {
+               printk(KERN_ERR "%s: TX MAC max packet size error.\n",
+                      dev->name);
+               cp->net_stats[0].tx_errors++;
+       }
+
+       /* The rest are all cases of one of the 16-bit TX
+        * counters expiring.
+        */
+       if (txmac_stat & MAC_TX_COLL_NORMAL)
+               cp->net_stats[0].collisions += 0x10000;
+
+       if (txmac_stat & MAC_TX_COLL_EXCESS) {
+               cp->net_stats[0].tx_aborted_errors += 0x10000;
+               cp->net_stats[0].collisions += 0x10000;
+       }
+
+       if (txmac_stat & MAC_TX_COLL_LATE) {
+               cp->net_stats[0].tx_aborted_errors += 0x10000;
+               cp->net_stats[0].collisions += 0x10000;
+       }
+       spin_unlock(&cp->stat_lock[0]);
+
+       /* We do not keep track of MAC_TX_COLL_FIRST and
+        * MAC_TX_PEAK_ATTEMPTS events.
+        */
+       return 0;
+}
+
+static void cas_load_firmware(struct cas *cp, cas_hp_inst_t *firmware) 
+{
+       cas_hp_inst_t *inst;
+       u32 val;
+       int i;
+
+       i = 0;
+       while ((inst = firmware) && inst->note) {
+               writel(i, cp->regs + REG_HP_INSTR_RAM_ADDR);
+
+               val = CAS_BASE(HP_INSTR_RAM_HI_VAL, inst->val);
+               val |= CAS_BASE(HP_INSTR_RAM_HI_MASK, inst->mask);
+               writel(val, cp->regs + REG_HP_INSTR_RAM_DATA_HI);
+
+               val = CAS_BASE(HP_INSTR_RAM_MID_OUTARG, inst->outarg >> 10);
+               val |= CAS_BASE(HP_INSTR_RAM_MID_OUTOP, inst->outop);
+               val |= CAS_BASE(HP_INSTR_RAM_MID_FNEXT, inst->fnext);
+               val |= CAS_BASE(HP_INSTR_RAM_MID_FOFF, inst->foff);
+               val |= CAS_BASE(HP_INSTR_RAM_MID_SNEXT, inst->snext);
+               val |= CAS_BASE(HP_INSTR_RAM_MID_SOFF, inst->soff);
+               val |= CAS_BASE(HP_INSTR_RAM_MID_OP, inst->op);
+               writel(val, cp->regs + REG_HP_INSTR_RAM_DATA_MID);
+
+               val = CAS_BASE(HP_INSTR_RAM_LOW_OUTMASK, inst->outmask);
+               val |= CAS_BASE(HP_INSTR_RAM_LOW_OUTSHIFT, inst->outshift);
+               val |= CAS_BASE(HP_INSTR_RAM_LOW_OUTEN, inst->outenab);
+               val |= CAS_BASE(HP_INSTR_RAM_LOW_OUTARG, inst->outarg);
+               writel(val, cp->regs + REG_HP_INSTR_RAM_DATA_LOW);
+               ++firmware;
+               ++i;
+       }
+}
+
+static void cas_init_rx_dma(struct cas *cp)
+{
+       u64 desc_dma = cp->block_dvma; 
+       u32 val;
+       int i, size;
+
+       /* rx free descriptors */
+       val = CAS_BASE(RX_CFG_SWIVEL, RX_SWIVEL_OFF_VAL); 
+       val |= CAS_BASE(RX_CFG_DESC_RING, RX_DESC_RINGN_INDEX(0));
+       val |= CAS_BASE(RX_CFG_COMP_RING, RX_COMP_RINGN_INDEX(0));
+       if ((N_RX_DESC_RINGS > 1) &&
+           (cp->cas_flags & CAS_FLAG_REG_PLUS))  /* do desc 2 */
+               val |= CAS_BASE(RX_CFG_DESC_RING1, RX_DESC_RINGN_INDEX(1));
+       writel(val, cp->regs + REG_RX_CFG);
+
+       val = (unsigned long) cp->init_rxds[0] - 
+               (unsigned long) cp->init_block;
+       writel((desc_dma + val) >> 32, cp->regs + REG_RX_DB_HI);
+       writel((desc_dma + val) & 0xffffffff, cp->regs + REG_RX_DB_LOW);
+       writel(RX_DESC_RINGN_SIZE(0) - 4, cp->regs + REG_RX_KICK);
+
+       if (cp->cas_flags & CAS_FLAG_REG_PLUS) {
+               /* rx desc 2 is for IPSEC packets. however, 
+                * we don't it that for that purpose.
+                */
+               val = (unsigned long) cp->init_rxds[1] - 
+                       (unsigned long) cp->init_block;
+               writel((desc_dma + val) >> 32, cp->regs + REG_PLUS_RX_DB1_HI);
+               writel((desc_dma + val) & 0xffffffff, cp->regs + 
+                      REG_PLUS_RX_DB1_LOW);
+               writel(RX_DESC_RINGN_SIZE(1) - 4, cp->regs + 
+                      REG_PLUS_RX_KICK1);
+       }
+       
+       /* rx completion registers */
+       val = (unsigned long) cp->init_rxcs[0] - 
+               (unsigned long) cp->init_block;
+       writel((desc_dma + val) >> 32, cp->regs + REG_RX_CB_HI);
+       writel((desc_dma + val) & 0xffffffff, cp->regs + REG_RX_CB_LOW);
+
+       if (cp->cas_flags & CAS_FLAG_REG_PLUS) {
+               /* rx comp 2-4 */
+               for (i = 1; i < MAX_RX_COMP_RINGS; i++) {
+                       val = (unsigned long) cp->init_rxcs[i] - 
+                               (unsigned long) cp->init_block;
+                       writel((desc_dma + val) >> 32, cp->regs + 
+                              REG_PLUS_RX_CBN_HI(i));
+                       writel((desc_dma + val) & 0xffffffff, cp->regs + 
+                              REG_PLUS_RX_CBN_LOW(i));
+               }
+       }
+
+       /* read selective clear regs to prevent spurious interrupts
+        * on reset because complete == kick.
+        * selective clear set up to prevent interrupts on resets
+        */
+       readl(cp->regs + REG_INTR_STATUS_ALIAS);
+       writel(INTR_RX_DONE | INTR_RX_BUF_UNAVAIL, cp->regs + REG_ALIAS_CLEAR);
+       if (cp->cas_flags & CAS_FLAG_REG_PLUS) {
+               for (i = 1; i < N_RX_COMP_RINGS; i++)
+                       readl(cp->regs + REG_PLUS_INTRN_STATUS_ALIAS(i));
+
+               /* 2 is different from 3 and 4 */
+               if (N_RX_COMP_RINGS > 1)
+                       writel(INTR_RX_DONE_ALT | INTR_RX_BUF_UNAVAIL_1, 
+                              cp->regs + REG_PLUS_ALIASN_CLEAR(1));
+
+               for (i = 2; i < N_RX_COMP_RINGS; i++) 
+                       writel(INTR_RX_DONE_ALT, 
+                              cp->regs + REG_PLUS_ALIASN_CLEAR(i));
+       }
+
+       /* set up pause thresholds */
+       val  = CAS_BASE(RX_PAUSE_THRESH_OFF,
+                       cp->rx_pause_off / RX_PAUSE_THRESH_QUANTUM);
+       val |= CAS_BASE(RX_PAUSE_THRESH_ON, 
+                       cp->rx_pause_on / RX_PAUSE_THRESH_QUANTUM);
+       writel(val, cp->regs + REG_RX_PAUSE_THRESH);
+       
+       /* zero out dma reassembly buffers */
+       for (i = 0; i < 64; i++) {
+               writel(i, cp->regs + REG_RX_TABLE_ADDR);
+               writel(0x0, cp->regs + REG_RX_TABLE_DATA_LOW);
+               writel(0x0, cp->regs + REG_RX_TABLE_DATA_MID);
+               writel(0x0, cp->regs + REG_RX_TABLE_DATA_HI);
+       }
+
+       /* make sure address register is 0 for normal operation */
+       writel(0x0, cp->regs + REG_RX_CTRL_FIFO_ADDR);
+       writel(0x0, cp->regs + REG_RX_IPP_FIFO_ADDR);
+
+       /* interrupt mitigation */
+#ifdef USE_RX_BLANK
+       val = CAS_BASE(RX_BLANK_INTR_TIME, RX_BLANK_INTR_TIME_VAL);
+       val |= CAS_BASE(RX_BLANK_INTR_PKT, RX_BLANK_INTR_PKT_VAL);
+       writel(val, cp->regs + REG_RX_BLANK);
+#else
+       writel(0x0, cp->regs + REG_RX_BLANK);
+#endif
+
+       /* interrupt generation as a function of low water marks for
+        * free desc and completion entries. these are used to trigger
+        * housekeeping for rx descs. we don't use the free interrupt
+        * as it's not very useful
+        */
+       /* val = CAS_BASE(RX_AE_THRESH_FREE, RX_AE_FREEN_VAL(0)); */
+       val = CAS_BASE(RX_AE_THRESH_COMP, RX_AE_COMP_VAL);
+       writel(val, cp->regs + REG_RX_AE_THRESH);
+       if (cp->cas_flags & CAS_FLAG_REG_PLUS) {
+               val = CAS_BASE(RX_AE1_THRESH_FREE, RX_AE_FREEN_VAL(1));
+               writel(val, cp->regs + REG_PLUS_RX_AE1_THRESH);
+       }
+
+       /* Random early detect registers. useful for congestion avoidance.
+        * this should be tunable.
+        */
+       writel(0x0, cp->regs + REG_RX_RED);
+       
+       /* receive page sizes. default == 2K (0x800) */
+       val = 0;
+       if (cp->page_size == 0x1000)
+               val = 0x1;
+       else if (cp->page_size == 0x2000)
+               val = 0x2;
+       else if (cp->page_size == 0x4000)
+               val = 0x3;
+       
+       /* round mtu + offset. constrain to page size. */
+       size = cp->dev->mtu + 64;
+       if (size > cp->page_size)
+               size = cp->page_size;
+
+       if (size <= 0x400)
+               i = 0x0;
+       else if (size <= 0x800)
+               i = 0x1;
+       else if (size <= 0x1000)
+               i = 0x2;
+       else
+               i = 0x3;
+
+       cp->mtu_stride = 1 << (i + 10);
+       val  = CAS_BASE(RX_PAGE_SIZE, val);
+       val |= CAS_BASE(RX_PAGE_SIZE_MTU_STRIDE, i); 
+       val |= CAS_BASE(RX_PAGE_SIZE_MTU_COUNT, cp->page_size >> (i + 10));
+       val |= CAS_BASE(RX_PAGE_SIZE_MTU_OFF, 0x1);
+       writel(val, cp->regs + REG_RX_PAGE_SIZE);
+       
+       /* enable the header parser if desired */
+       if (CAS_HP_FIRMWARE == cas_prog_null)
+               return;
+
+       val = CAS_BASE(HP_CFG_NUM_CPU, CAS_NCPUS > 63 ? 0 : CAS_NCPUS);
+       val |= HP_CFG_PARSE_EN | HP_CFG_SYN_INC_MASK;
+       val |= CAS_BASE(HP_CFG_TCP_THRESH, HP_TCP_THRESH_VAL);
+       writel(val, cp->regs + REG_HP_CFG);
+}
+
+static inline void cas_rxc_init(struct cas_rx_comp *rxc)
+{
+       memset(rxc, 0, sizeof(*rxc));
+       rxc->word4 = cpu_to_le64(RX_COMP4_ZERO); 
+}
+
+/* NOTE: we use the ENC RX DESC ring for spares. the rx_page[0,1]
+ * flipping is protected by the fact that the chip will not
+ * hand back the same page index while it's being processed.
+ */
+static inline cas_page_t *cas_page_spare(struct cas *cp, const int index)
+{
+       cas_page_t *page = cp->rx_pages[1][index];
+       cas_page_t *new;
+
+       if (page_count(page->buffer) == 1)
+               return page;
+
+       new = cas_page_dequeue(cp);
+       if (new) {
+               spin_lock(&cp->rx_inuse_lock);
+               list_add(&page->list, &cp->rx_inuse_list);
+               spin_unlock(&cp->rx_inuse_lock);
+       }
+       return new;
+}
+                                  
+/* this needs to be changed if we actually use the ENC RX DESC ring */
+static cas_page_t *cas_page_swap(struct cas *cp, const int ring, 
+                                const int index)
+{
+       cas_page_t **page0 = cp->rx_pages[0];
+       cas_page_t **page1 = cp->rx_pages[1];
+
+       /* swap if buffer is in use */
+       if (page_count(page0[index]->buffer) > 1) {
+               cas_page_t *new = cas_page_spare(cp, index);
+               if (new) {
+                       page1[index] = page0[index];
+                       page0[index] = new;
+               }
+       } 
+       RX_USED_SET(page0[index], 0);
+       return page0[index];
+}
+
+static void cas_clean_rxds(struct cas *cp)
+{
+       /* only clean ring 0 as ring 1 is used for spare buffers */
+        struct cas_rx_desc *rxd = cp->init_rxds[0];
+       int i, size;
+
+       /* release all rx flows */
+       for (i = 0; i < N_RX_FLOWS; i++) {
+               struct sk_buff *skb;
+               while ((skb = __skb_dequeue(&cp->rx_flows[i]))) {
+                       cas_skb_release(skb);
+               }
+       }
+
+       /* initialize descriptors */
+       size = RX_DESC_RINGN_SIZE(0);
+       for (i = 0; i < size; i++) {
+               cas_page_t *page = cas_page_swap(cp, 0, i);
+               rxd[i].buffer = cpu_to_le64(page->dma_addr);
+               rxd[i].index  = cpu_to_le64(CAS_BASE(RX_INDEX_NUM, i) | 
+                                           CAS_BASE(RX_INDEX_RING, 0));
+       }
+
+       cp->rx_old[0]  = RX_DESC_RINGN_SIZE(0) - 4; 
+       cp->rx_last[0] = 0;
+       cp->cas_flags &= ~CAS_FLAG_RXD_POST(0);
+}
+
+static void cas_clean_rxcs(struct cas *cp)
+{
+       int i, j;
+
+       /* take ownership of rx comp descriptors */
+       memset(cp->rx_cur, 0, sizeof(*cp->rx_cur)*N_RX_COMP_RINGS);
+       memset(cp->rx_new, 0, sizeof(*cp->rx_new)*N_RX_COMP_RINGS);
+       for (i = 0; i < N_RX_COMP_RINGS; i++) {
+               struct cas_rx_comp *rxc = cp->init_rxcs[i];
+               for (j = 0; j < RX_COMP_RINGN_SIZE(i); j++) {
+                       cas_rxc_init(rxc + j);
+               }
+       }
+}
+
+#if 0
+/* When we get a RX fifo overflow, the RX unit is probably hung
+ * so we do the following.
+ *
+ * If any part of the reset goes wrong, we return 1 and that causes the
+ * whole chip to be reset.
+ */
+static int cas_rxmac_reset(struct cas *cp)
+{
+       struct net_device *dev = cp->dev;
+       int limit;
+       u32 val;
+
+       /* First, reset MAC RX. */
+       writel(cp->mac_rx_cfg & ~MAC_RX_CFG_EN, cp->regs + REG_MAC_RX_CFG);
+       for (limit = 0; limit < STOP_TRIES; limit++) {
+               if (!(readl(cp->regs + REG_MAC_RX_CFG) & MAC_RX_CFG_EN))
+                       break;
+               udelay(10);
+       }
+       if (limit == STOP_TRIES) {
+               printk(KERN_ERR "%s: RX MAC will not disable, resetting whole "
+                      "chip.\n", dev->name);
+               return 1;
+       }
+
+       /* Second, disable RX DMA. */
+       writel(0, cp->regs + REG_RX_CFG);
+       for (limit = 0; limit < STOP_TRIES; limit++) {
+               if (!(readl(cp->regs + REG_RX_CFG) & RX_CFG_DMA_EN))
+                       break;
+               udelay(10);
+       }
+       if (limit == STOP_TRIES) {
+               printk(KERN_ERR "%s: RX DMA will not disable, resetting whole "
+                      "chip.\n", dev->name);
+               return 1;
+       }
+
+       mdelay(5);
+
+       /* Execute RX reset command. */
+       writel(SW_RESET_RX, cp->regs + REG_SW_RESET);
+       for (limit = 0; limit < STOP_TRIES; limit++) {
+               if (!(readl(cp->regs + REG_SW_RESET) & SW_RESET_RX))
+                       break;
+               udelay(10);
+       }
+       if (limit == STOP_TRIES) {
+               printk(KERN_ERR "%s: RX reset command will not execute, "
+                      "resetting whole chip.\n", dev->name);
+               return 1;
+       }
+
+       /* reset driver rx state */
+       cas_clean_rxds(cp);
+       cas_clean_rxcs(cp);
+
+       /* Now, reprogram the rest of RX unit. */
+       cas_init_rx_dma(cp);
+
+       /* re-enable */
+       val = readl(cp->regs + REG_RX_CFG);
+       writel(val | RX_CFG_DMA_EN, cp->regs + REG_RX_CFG);
+       writel(MAC_RX_FRAME_RECV, cp->regs + REG_MAC_RX_MASK);
+       val = readl(cp->regs + REG_MAC_RX_CFG);
+       writel(val | MAC_RX_CFG_EN, cp->regs + REG_MAC_RX_CFG);
+       return 0;
+}
+#endif
+
+static int cas_rxmac_interrupt(struct net_device *dev, struct cas *cp,
+                              u32 status)
+{
+       u32 stat = readl(cp->regs + REG_MAC_RX_STATUS);
+
+       if (!stat)
+               return 0;
+
+       if (netif_msg_intr(cp))
+               printk(KERN_DEBUG "%s: rxmac interrupt, stat: 0x%x\n",
+                       cp->dev->name, stat);
+
+       /* these are all rollovers */
+       spin_lock(&cp->stat_lock[0]);
+       if (stat & MAC_RX_ALIGN_ERR) 
+               cp->net_stats[0].rx_frame_errors += 0x10000;
+
+       if (stat & MAC_RX_CRC_ERR)
+               cp->net_stats[0].rx_crc_errors += 0x10000;
+
+       if (stat & MAC_RX_LEN_ERR)
+               cp->net_stats[0].rx_length_errors += 0x10000;
+
+       if (stat & MAC_RX_OVERFLOW) {
+               cp->net_stats[0].rx_over_errors++;
+               cp->net_stats[0].rx_fifo_errors++;
+       }
+
+       /* We do not track MAC_RX_FRAME_COUNT and MAC_RX_VIOL_ERR
+        * events.
+        */
+       spin_unlock(&cp->stat_lock[0]);
+       return 0;
+}
+
+static int cas_mac_interrupt(struct net_device *dev, struct cas *cp,
+                            u32 status)
+{
+       u32 stat = readl(cp->regs + REG_MAC_CTRL_STATUS);
+
+       if (!stat)
+               return 0;
+
+       if (netif_msg_intr(cp))
+               printk(KERN_DEBUG "%s: mac interrupt, stat: 0x%x\n",
+                       cp->dev->name, stat);
+
+       /* This interrupt is just for pause frame and pause
+        * tracking.  It is useful for diagnostics and debug
+        * but probably by default we will mask these events.
+        */
+       if (stat & MAC_CTRL_PAUSE_STATE)
+               cp->pause_entered++;
+
+       if (stat & MAC_CTRL_PAUSE_RECEIVED)
+               cp->pause_last_time_recvd = (stat >> 16);
+
+       return 0;
+}
+
+       
+/* Must be invoked under cp->lock. */
+static inline int cas_mdio_link_not_up(struct cas *cp)
+{
+       u16 val;
+       
+       switch (cp->lstate) {
+       case link_force_ret:
+               if (netif_msg_link(cp))
+                       printk(KERN_INFO "%s: Autoneg failed again, keeping"
+                               " forced mode\n", cp->dev->name);
+               cas_phy_write(cp, MII_BMCR, cp->link_fcntl);
+               cp->timer_ticks = 5;
+               cp->lstate = link_force_ok;
+               cp->link_transition = LINK_TRANSITION_LINK_CONFIG;
+               break;
+               
+       case link_aneg:
+               val = cas_phy_read(cp, MII_BMCR);
+
+               /* Try forced modes. we try things in the following order:
+                * 1000 full -> 100 full/half -> 10 half
+                */
+               val &= ~(BMCR_ANRESTART | BMCR_ANENABLE);
+               val |= BMCR_FULLDPLX;
+               val |= (cp->cas_flags & CAS_FLAG_1000MB_CAP) ? 
+                       CAS_BMCR_SPEED1000 : BMCR_SPEED100;
+               cas_phy_write(cp, MII_BMCR, val);
+               cp->timer_ticks = 5;
+               cp->lstate = link_force_try;
+               cp->link_transition = LINK_TRANSITION_LINK_CONFIG;
+               break;
+
+       case link_force_try:
+               /* Downgrade from 1000 to 100 to 10 Mbps if necessary. */
+               val = cas_phy_read(cp, MII_BMCR);
+               cp->timer_ticks = 5;
+               if (val & CAS_BMCR_SPEED1000) { /* gigabit */
+                       val &= ~CAS_BMCR_SPEED1000;
+                       val |= (BMCR_SPEED100 | BMCR_FULLDPLX);
+                       cas_phy_write(cp, MII_BMCR, val);
+                       break;
+               }
+
+               if (val & BMCR_SPEED100) {
+                       if (val & BMCR_FULLDPLX) /* fd failed */
+                               val &= ~BMCR_FULLDPLX;
+                       else { /* 100Mbps failed */
+                               val &= ~BMCR_SPEED100;
+                       }
+                       cas_phy_write(cp, MII_BMCR, val);
+                       break;
+               }
+       default:
+               break;
+       }
+       return 0;
+}
+
+
+/* must be invoked with cp->lock held */
+static int cas_mii_link_check(struct cas *cp, const u16 bmsr)
+{
+       int restart;
+
+       if (bmsr & BMSR_LSTATUS) {
+               /* Ok, here we got a link. If we had it due to a forced
+                * fallback, and we were configured for autoneg, we 
+                * retry a short autoneg pass. If you know your hub is
+                * broken, use ethtool ;)
+                */
+               if ((cp->lstate == link_force_try) && 
+                   (cp->link_cntl & BMCR_ANENABLE)) {
+                       cp->lstate = link_force_ret;
+                       cp->link_transition = LINK_TRANSITION_LINK_CONFIG;
+                       cas_mif_poll(cp, 0);
+                       cp->link_fcntl = cas_phy_read(cp, MII_BMCR);
+                       cp->timer_ticks = 5;
+                       if (cp->opened && netif_msg_link(cp))
+                               printk(KERN_INFO "%s: Got link after fallback, retrying"
+                                      " autoneg once...\n", cp->dev->name);
+                       cas_phy_write(cp, MII_BMCR,
+                                     cp->link_fcntl | BMCR_ANENABLE |
+                                     BMCR_ANRESTART);
+                       cas_mif_poll(cp, 1);
+
+               } else if (cp->lstate != link_up) {
+                       cp->lstate = link_up;
+                       cp->link_transition = LINK_TRANSITION_LINK_UP;
+
+                       if (cp->opened) {
+                               cas_set_link_modes(cp);
+                               netif_carrier_on(cp->dev);
+                       }
+               }
+               return 0;
+       }
+
+       /* link not up. if the link was previously up, we restart the
+        * whole process
+        */
+       restart = 0;
+       if (cp->lstate == link_up) {
+               cp->lstate = link_down;
+               cp->link_transition = LINK_TRANSITION_LINK_DOWN;
+
+               netif_carrier_off(cp->dev);
+               if (cp->opened && netif_msg_link(cp))
+                       printk(KERN_INFO "%s: Link down\n",
+                              cp->dev->name);
+               restart = 1;
+               
+       } else if (++cp->timer_ticks > 10)
+               cas_mdio_link_not_up(cp);
+               
+       return restart;
+}
+
+static int cas_mif_interrupt(struct net_device *dev, struct cas *cp,
+                            u32 status)
+{
+       u32 stat = readl(cp->regs + REG_MIF_STATUS);
+       u16 bmsr;
+
+       /* check for a link change */
+       if (CAS_VAL(MIF_STATUS_POLL_STATUS, stat) == 0)
+               return 0;
+
+       bmsr = CAS_VAL(MIF_STATUS_POLL_DATA, stat);
+       return cas_mii_link_check(cp, bmsr);
+}
+
+static int cas_pci_interrupt(struct net_device *dev, struct cas *cp,
+                            u32 status)
+{
+       u32 stat = readl(cp->regs + REG_PCI_ERR_STATUS);
+
+       if (!stat)
+               return 0;
+
+       printk(KERN_ERR "%s: PCI error [%04x:%04x] ", dev->name, stat,
+              readl(cp->regs + REG_BIM_DIAG));
+
+       /* cassini+ has this reserved */
+       if ((stat & PCI_ERR_BADACK) &&
+           ((cp->cas_flags & CAS_FLAG_REG_PLUS) == 0))
+               printk("<No ACK64# during ABS64 cycle> ");
+
+       if (stat & PCI_ERR_DTRTO)
+               printk("<Delayed transaction timeout> ");
+       if (stat & PCI_ERR_OTHER)
+               printk("<other> ");
+       if (stat & PCI_ERR_BIM_DMA_WRITE)
+               printk("<BIM DMA 0 write req> ");
+       if (stat & PCI_ERR_BIM_DMA_READ)
+               printk("<BIM DMA 0 read req> ");
+       printk("\n");
+
+       if (stat & PCI_ERR_OTHER) {
+               u16 cfg;
+
+               /* Interrogate PCI config space for the
+                * true cause.
+                */
+               pci_read_config_word(cp->pdev, PCI_STATUS, &cfg);
+               printk(KERN_ERR "%s: Read PCI cfg space status [%04x]\n",
+                      dev->name, cfg);
+               if (cfg & PCI_STATUS_PARITY)
+                       printk(KERN_ERR "%s: PCI parity error detected.\n",
+                              dev->name);
+               if (cfg & PCI_STATUS_SIG_TARGET_ABORT)
+                       printk(KERN_ERR "%s: PCI target abort.\n",
+                              dev->name);
+               if (cfg & PCI_STATUS_REC_TARGET_ABORT)
+                       printk(KERN_ERR "%s: PCI master acks target abort.\n",
+                              dev->name);
+               if (cfg & PCI_STATUS_REC_MASTER_ABORT)
+                       printk(KERN_ERR "%s: PCI master abort.\n", dev->name);
+               if (cfg & PCI_STATUS_SIG_SYSTEM_ERROR)
+                       printk(KERN_ERR "%s: PCI system error SERR#.\n",
+                              dev->name);
+               if (cfg & PCI_STATUS_DETECTED_PARITY)
+                       printk(KERN_ERR "%s: PCI parity error.\n",
+                              dev->name);
+
+               /* Write the error bits back to clear them. */
+               cfg &= (PCI_STATUS_PARITY |
+                       PCI_STATUS_SIG_TARGET_ABORT |
+                       PCI_STATUS_REC_TARGET_ABORT |
+                       PCI_STATUS_REC_MASTER_ABORT |
+                       PCI_STATUS_SIG_SYSTEM_ERROR |
+                       PCI_STATUS_DETECTED_PARITY);
+               pci_write_config_word(cp->pdev, PCI_STATUS, cfg);
+       }
+
+       /* For all PCI errors, we should reset the chip. */
+       return 1;
+}
+
+/* All non-normal interrupt conditions get serviced here.
+ * Returns non-zero if we should just exit the interrupt
+ * handler right now (ie. if we reset the card which invalidates
+ * all of the other original irq status bits).
+ */
+static int cas_abnormal_irq(struct net_device *dev, struct cas *cp,
+                           u32 status)
+{
+       if (status & INTR_RX_TAG_ERROR) {
+               /* corrupt RX tag framing */
+               if (netif_msg_rx_err(cp))
+                       printk(KERN_DEBUG "%s: corrupt rx tag framing\n",
+                               cp->dev->name);
+               spin_lock(&cp->stat_lock[0]);
+               cp->net_stats[0].rx_errors++;
+               spin_unlock(&cp->stat_lock[0]);
+               goto do_reset;
+       }
+
+       if (status & INTR_RX_LEN_MISMATCH) {
+               /* length mismatch. */
+               if (netif_msg_rx_err(cp))
+                       printk(KERN_DEBUG "%s: length mismatch for rx frame\n",
+                               cp->dev->name);
+               spin_lock(&cp->stat_lock[0]);
+               cp->net_stats[0].rx_errors++;
+               spin_unlock(&cp->stat_lock[0]);
+               goto do_reset;
+       }
+
+       if (status & INTR_PCS_STATUS) {
+               if (cas_pcs_interrupt(dev, cp, status))
+                       goto do_reset;
+       }
+
+       if (status & INTR_TX_MAC_STATUS) {
+               if (cas_txmac_interrupt(dev, cp, status))
+                       goto do_reset;
+       }
+
+       if (status & INTR_RX_MAC_STATUS) {
+               if (cas_rxmac_interrupt(dev, cp, status))
+                       goto do_reset;
+       }
+
+       if (status & INTR_MAC_CTRL_STATUS) {
+               if (cas_mac_interrupt(dev, cp, status))
+                       goto do_reset;
+       }
+
+       if (status & INTR_MIF_STATUS) {
+               if (cas_mif_interrupt(dev, cp, status))
+                       goto do_reset;
+       }
+
+       if (status & INTR_PCI_ERROR_STATUS) {
+               if (cas_pci_interrupt(dev, cp, status))
+                       goto do_reset;
+       }
+       return 0;
+
+do_reset:
+#if 1
+       atomic_inc(&cp->reset_task_pending);
+       atomic_inc(&cp->reset_task_pending_all);
+       printk(KERN_ERR "%s:reset called in cas_abnormal_irq [0x%x]\n",
+              dev->name, status);
+       schedule_work(&cp->reset_task);
+#else
+       atomic_set(&cp->reset_task_pending, CAS_RESET_ALL);
+       printk(KERN_ERR "reset called in cas_abnormal_irq\n");
+       schedule_work(&cp->reset_task);
+#endif
+       return 1;
+}
+
+/* NOTE: CAS_TABORT returns 1 or 2 so that it can be used when
+ *       determining whether to do a netif_stop/wakeup
+ */
+#define CAS_TABORT(x)      (((x)->cas_flags & CAS_FLAG_TARGET_ABORT) ? 2 : 1)
+#define CAS_ROUND_PAGE(x)  (((x) + PAGE_SIZE - 1) & PAGE_MASK)
+static inline int cas_calc_tabort(struct cas *cp, const unsigned long addr,
+                                 const int len)
+{
+       unsigned long off = addr + len;
+
+       if (CAS_TABORT(cp) == 1)
+               return 0;
+       if ((CAS_ROUND_PAGE(off) - off) > TX_TARGET_ABORT_LEN)
+               return 0;
+       return TX_TARGET_ABORT_LEN;
+}
+
+static inline void cas_tx_ringN(struct cas *cp, int ring, int limit)
+{
+       struct cas_tx_desc *txds;
+       struct sk_buff **skbs;
+       struct net_device *dev = cp->dev;
+       int entry, count;
+
+       spin_lock(&cp->tx_lock[ring]);
+       txds = cp->init_txds[ring];
+       skbs = cp->tx_skbs[ring];
+       entry = cp->tx_old[ring];
+
+       count = TX_BUFF_COUNT(ring, entry, limit);
+       while (entry != limit) {
+               struct sk_buff *skb = skbs[entry];
+               dma_addr_t daddr;
+               u32 dlen;
+               int frag;
+
+               if (!skb) {
+                       /* this should never occur */
+                       entry = TX_DESC_NEXT(ring, entry);
+                       continue;
+               }
+
+               /* however, we might get only a partial skb release. */
+               count -= skb_shinfo(skb)->nr_frags +
+                       + cp->tx_tiny_use[ring][entry].nbufs + 1;
+               if (count < 0)
+                       break;
+
+               if (netif_msg_tx_done(cp))
+                       printk(KERN_DEBUG "%s: tx[%d] done, slot %d\n",
+                              cp->dev->name, ring, entry);
+
+               skbs[entry] = NULL;
+               cp->tx_tiny_use[ring][entry].nbufs = 0;
+               
+               for (frag = 0; frag <= skb_shinfo(skb)->nr_frags; frag++) {
+                       struct cas_tx_desc *txd = txds + entry;
+
+                       daddr = le64_to_cpu(txd->buffer);
+                       dlen = CAS_VAL(TX_DESC_BUFLEN,
+                                      le64_to_cpu(txd->control));
+                       pci_unmap_page(cp->pdev, daddr, dlen,
+                                      PCI_DMA_TODEVICE);
+                       entry = TX_DESC_NEXT(ring, entry);
+
+                       /* tiny buffer may follow */
+                       if (cp->tx_tiny_use[ring][entry].used) {
+                               cp->tx_tiny_use[ring][entry].used = 0;
+                               entry = TX_DESC_NEXT(ring, entry);
+                       } 
+               }
+
+               spin_lock(&cp->stat_lock[ring]);
+               cp->net_stats[ring].tx_packets++;
+               cp->net_stats[ring].tx_bytes += skb->len;
+               spin_unlock(&cp->stat_lock[ring]);
+               dev_kfree_skb_irq(skb);
+       }
+       cp->tx_old[ring] = entry;
+
+       /* this is wrong for multiple tx rings. the net device needs
+        * multiple queues for this to do the right thing.  we wait
+        * for 2*packets to be available when using tiny buffers
+        */
+       if (netif_queue_stopped(dev) &&
+           (TX_BUFFS_AVAIL(cp, ring) > CAS_TABORT(cp)*(MAX_SKB_FRAGS + 1)))
+               netif_wake_queue(dev);
+       spin_unlock(&cp->tx_lock[ring]);
+}
+
+static void cas_tx(struct net_device *dev, struct cas *cp,
+                  u32 status)
+{
+        int limit, ring;
+#ifdef USE_TX_COMPWB
+       u64 compwb = le64_to_cpu(cp->init_block->tx_compwb);
+#endif
+       if (netif_msg_intr(cp))
+               printk(KERN_DEBUG "%s: tx interrupt, status: 0x%x, %lx\n",
+                       cp->dev->name, status, compwb);
+       /* process all the rings */
+       for (ring = 0; ring < N_TX_RINGS; ring++) {
+#ifdef USE_TX_COMPWB
+               /* use the completion writeback registers */
+               limit = (CAS_VAL(TX_COMPWB_MSB, compwb) << 8) |
+                       CAS_VAL(TX_COMPWB_LSB, compwb);
+               compwb = TX_COMPWB_NEXT(compwb);
+#else
+               limit = readl(cp->regs + REG_TX_COMPN(ring));
+#endif
+               if (cp->tx_old[ring] != limit) 
+                       cas_tx_ringN(cp, ring, limit);
+       }
+}
+
+
+static int cas_rx_process_pkt(struct cas *cp, struct cas_rx_comp *rxc, 
+                             int entry, const u64 *words, 
+                             struct sk_buff **skbref)
+{
+       int dlen, hlen, len, i, alloclen;
+       int off, swivel = RX_SWIVEL_OFF_VAL;
+       struct cas_page *page;
+       struct sk_buff *skb;
+       void *addr, *crcaddr;
+       char *p; 
+
+       hlen = CAS_VAL(RX_COMP2_HDR_SIZE, words[1]);
+       dlen = CAS_VAL(RX_COMP1_DATA_SIZE, words[0]);
+       len  = hlen + dlen;
+
+       if (RX_COPY_ALWAYS || (words[2] & RX_COMP3_SMALL_PKT)) 
+               alloclen = len;
+       else 
+               alloclen = max(hlen, RX_COPY_MIN);
+
+       skb = dev_alloc_skb(alloclen + swivel + cp->crc_size);
+       if (skb == NULL) 
+               return -1;
+
+       *skbref = skb;
+       skb->dev = cp->dev;
+       skb_reserve(skb, swivel);
+
+       p = skb->data;
+       addr = crcaddr = NULL;
+       if (hlen) { /* always copy header pages */
+               i = CAS_VAL(RX_COMP2_HDR_INDEX, words[1]);
+               page = cp->rx_pages[CAS_VAL(RX_INDEX_RING, i)][CAS_VAL(RX_INDEX_NUM, i)];
+               off = CAS_VAL(RX_COMP2_HDR_OFF, words[1]) * 0x100 + 
+                       swivel;
+
+               i = hlen;
+               if (!dlen) /* attach FCS */
+                       i += cp->crc_size;
+               pci_dma_sync_single_for_cpu(cp->pdev, page->dma_addr + off, i,
+                                   PCI_DMA_FROMDEVICE);
+               addr = cas_page_map(page->buffer);
+               memcpy(p, addr + off, i);
+               pci_dma_sync_single_for_device(cp->pdev, page->dma_addr + off, i,
+                                   PCI_DMA_FROMDEVICE);
+               cas_page_unmap(addr);
+               RX_USED_ADD(page, 0x100);
+               p += hlen;
+               swivel = 0;
+       } 
+
+
+       if (alloclen < (hlen + dlen)) {
+               skb_frag_t *frag = skb_shinfo(skb)->frags;
+
+               /* normal or jumbo packets. we use frags */
+               i = CAS_VAL(RX_COMP1_DATA_INDEX, words[0]);
+               page = cp->rx_pages[CAS_VAL(RX_INDEX_RING, i)][CAS_VAL(RX_INDEX_NUM, i)];
+               off = CAS_VAL(RX_COMP1_DATA_OFF, words[0]) + swivel;
+
+               hlen = min(cp->page_size - off, dlen);
+               if (hlen < 0) {
+                       if (netif_msg_rx_err(cp)) {
+                               printk(KERN_DEBUG "%s: rx page overflow: "
+                                      "%d\n", cp->dev->name, hlen);
+                       }
+                       dev_kfree_skb_irq(skb);
+                       return -1;
+               }
+               i = hlen;
+               if (i == dlen)  /* attach FCS */
+                       i += cp->crc_size;
+               pci_dma_sync_single_for_cpu(cp->pdev, page->dma_addr + off, i,
+                                   PCI_DMA_FROMDEVICE);
+
+               /* make sure we always copy a header */
+               swivel = 0;
+               if (p == (char *) skb->data) { /* not split */
+                       addr = cas_page_map(page->buffer);
+                       memcpy(p, addr + off, RX_COPY_MIN);
+                       pci_dma_sync_single_for_device(cp->pdev, page->dma_addr + off, i,
+                                       PCI_DMA_FROMDEVICE);
+                       cas_page_unmap(addr);
+                       off += RX_COPY_MIN;
+                       swivel = RX_COPY_MIN;
+                       RX_USED_ADD(page, cp->mtu_stride);
+               } else {
+                       RX_USED_ADD(page, hlen);
+               }
+               skb_put(skb, alloclen);
+
+               skb_shinfo(skb)->nr_frags++;
+               skb->data_len += hlen - swivel;
+               skb->len      += hlen - swivel;
+
+               get_page(page->buffer);
+               frag->page = page->buffer;
+               frag->page_offset = off;
+               frag->size = hlen - swivel;
+               
+               /* any more data? */
+               if ((words[0] & RX_COMP1_SPLIT_PKT) && ((dlen -= hlen) > 0)) {
+                       hlen = dlen;
+                       off = 0;
+
+                       i = CAS_VAL(RX_COMP2_NEXT_INDEX, words[1]);
+                       page = cp->rx_pages[CAS_VAL(RX_INDEX_RING, i)][CAS_VAL(RX_INDEX_NUM, i)];
+                       pci_dma_sync_single_for_cpu(cp->pdev, page->dma_addr, 
+                                           hlen + cp->crc_size, 
+                                           PCI_DMA_FROMDEVICE);
+                       pci_dma_sync_single_for_device(cp->pdev, page->dma_addr,
+                                           hlen + cp->crc_size,
+                                           PCI_DMA_FROMDEVICE);
+
+                       skb_shinfo(skb)->nr_frags++;
+                       skb->data_len += hlen;
+                       skb->len      += hlen; 
+                       frag++;
+
+                       get_page(page->buffer);
+                       frag->page = page->buffer;
+                       frag->page_offset = 0;
+                       frag->size = hlen;
+                       RX_USED_ADD(page, hlen + cp->crc_size);
+               }
+
+               if (cp->crc_size) {
+                       addr = cas_page_map(page->buffer);
+                       crcaddr  = addr + off + hlen;
+               }
+
+       } else {
+               /* copying packet */
+               if (!dlen)
+                       goto end_copy_pkt;
+
+               i = CAS_VAL(RX_COMP1_DATA_INDEX, words[0]);
+               page = cp->rx_pages[CAS_VAL(RX_INDEX_RING, i)][CAS_VAL(RX_INDEX_NUM, i)];
+               off = CAS_VAL(RX_COMP1_DATA_OFF, words[0]) + swivel;
+               hlen = min(cp->page_size - off, dlen);
+               if (hlen < 0) {
+                       if (netif_msg_rx_err(cp)) {
+                               printk(KERN_DEBUG "%s: rx page overflow: "
+                                      "%d\n", cp->dev->name, hlen);
+                       }
+                       dev_kfree_skb_irq(skb);
+                       return -1;
+               }
+               i = hlen;
+               if (i == dlen) /* attach FCS */
+                       i += cp->crc_size;
+               pci_dma_sync_single_for_cpu(cp->pdev, page->dma_addr + off, i,
+                                   PCI_DMA_FROMDEVICE);
+               addr = cas_page_map(page->buffer);
+               memcpy(p, addr + off, i);
+               pci_dma_sync_single_for_device(cp->pdev, page->dma_addr + off, i,
+                                   PCI_DMA_FROMDEVICE);
+               cas_page_unmap(addr);
+               if (p == (char *) skb->data) /* not split */
+                       RX_USED_ADD(page, cp->mtu_stride);
+               else
+                       RX_USED_ADD(page, i);
+       
+               /* any more data? */
+               if ((words[0] & RX_COMP1_SPLIT_PKT) && ((dlen -= hlen) > 0)) {
+                       p += hlen;
+                       i = CAS_VAL(RX_COMP2_NEXT_INDEX, words[1]);
+                       page = cp->rx_pages[CAS_VAL(RX_INDEX_RING, i)][CAS_VAL(RX_INDEX_NUM, i)];
+                       pci_dma_sync_single_for_cpu(cp->pdev, page->dma_addr, 
+                                           dlen + cp->crc_size, 
+                                           PCI_DMA_FROMDEVICE);
+                       addr = cas_page_map(page->buffer);
+                       memcpy(p, addr, dlen + cp->crc_size);
+                       pci_dma_sync_single_for_device(cp->pdev, page->dma_addr,
+                                           dlen + cp->crc_size,
+                                           PCI_DMA_FROMDEVICE);
+                       cas_page_unmap(addr);
+                       RX_USED_ADD(page, dlen + cp->crc_size); 
+               }
+end_copy_pkt:
+               if (cp->crc_size) {
+                       addr    = NULL;
+                       crcaddr = skb->data + alloclen;
+               }
+               skb_put(skb, alloclen);
+       }
+
+       i = CAS_VAL(RX_COMP4_TCP_CSUM, words[3]);
+       if (cp->crc_size) {
+               /* checksum includes FCS. strip it out. */
+               i = csum_fold(csum_partial(crcaddr, cp->crc_size, i));
+               if (addr)
+                       cas_page_unmap(addr);
+       }
+       skb->csum = ntohs(i ^ 0xffff);
+       skb->ip_summed = CHECKSUM_HW;
+       skb->protocol = eth_type_trans(skb, cp->dev);
+       return len;
+}
+
+
+/* we can handle up to 64 rx flows at a time. we do the same thing
+ * as nonreassm except that we batch up the buffers. 
+ * NOTE: we currently just treat each flow as a bunch of packets that
+ *       we pass up. a better way would be to coalesce the packets
+ *       into a jumbo packet. to do that, we need to do the following:
+ *       1) the first packet will have a clean split between header and
+ *          data. save both.
+ *       2) each time the next flow packet comes in, extend the
+ *          data length and merge the checksums.
+ *       3) on flow release, fix up the header.
+ *       4) make sure the higher layer doesn't care.
+ * because packets get coalesced, we shouldn't run into fragment count 
+ * issues.
+ */
+static inline void cas_rx_flow_pkt(struct cas *cp, const u64 *words,
+                                  struct sk_buff *skb)
+{
+       int flowid = CAS_VAL(RX_COMP3_FLOWID, words[2]) & (N_RX_FLOWS - 1);
+       struct sk_buff_head *flow = &cp->rx_flows[flowid];
+       
+       /* this is protected at a higher layer, so no need to 
+        * do any additional locking here. stick the buffer
+        * at the end.
+        */
+       __skb_insert(skb, flow->prev, (struct sk_buff *) flow, flow);
+       if (words[0] & RX_COMP1_RELEASE_FLOW) {
+               while ((skb = __skb_dequeue(flow))) {
+                       cas_skb_release(skb);
+               }
+       }
+}
+
+/* put rx descriptor back on ring. if a buffer is in use by a higher
+ * layer, this will need to put in a replacement.
+ */
+static void cas_post_page(struct cas *cp, const int ring, const int index)
+{
+       cas_page_t *new;
+       int entry;
+
+       entry = cp->rx_old[ring];
+
+       new = cas_page_swap(cp, ring, index);
+       cp->init_rxds[ring][entry].buffer = cpu_to_le64(new->dma_addr);
+       cp->init_rxds[ring][entry].index  =
+               cpu_to_le64(CAS_BASE(RX_INDEX_NUM, index) | 
+                           CAS_BASE(RX_INDEX_RING, ring));
+
+       entry = RX_DESC_ENTRY(ring, entry + 1);
+       cp->rx_old[ring] = entry;
+       
+       if (entry % 4)
+               return;
+
+       if (ring == 0)
+               writel(entry, cp->regs + REG_RX_KICK);
+       else if ((N_RX_DESC_RINGS > 1) &&
+                (cp->cas_flags & CAS_FLAG_REG_PLUS)) 
+               writel(entry, cp->regs + REG_PLUS_RX_KICK1);
+}
+
+
+/* only when things are bad */
+static int cas_post_rxds_ringN(struct cas *cp, int ring, int num)
+{
+       unsigned int entry, last, count, released;
+       int cluster;
+       cas_page_t **page = cp->rx_pages[ring];
+
+       entry = cp->rx_old[ring];
+
+       if (netif_msg_intr(cp))
+               printk(KERN_DEBUG "%s: rxd[%d] interrupt, done: %d\n",
+                      cp->dev->name, ring, entry);
+
+       cluster = -1;
+       count = entry & 0x3; 
+       last = RX_DESC_ENTRY(ring, num ? entry + num - 4: entry - 4);
+       released = 0;
+       while (entry != last) {
+               /* make a new buffer if it's still in use */
+               if (page_count(page[entry]->buffer) > 1) {
+                       cas_page_t *new = cas_page_dequeue(cp);
+                       if (!new) {
+                               /* let the timer know that we need to 
+                                * do this again
+                                */
+                               cp->cas_flags |= CAS_FLAG_RXD_POST(ring);
+                               if (!timer_pending(&cp->link_timer))
+                                       mod_timer(&cp->link_timer, jiffies + 
+                                                 CAS_LINK_FAST_TIMEOUT);
+                               cp->rx_old[ring]  = entry;
+                               cp->rx_last[ring] = num ? num - released : 0;
+                               return -ENOMEM;
+                       }
+                       spin_lock(&cp->rx_inuse_lock);
+                       list_add(&page[entry]->list, &cp->rx_inuse_list);
+                       spin_unlock(&cp->rx_inuse_lock);
+                       cp->init_rxds[ring][entry].buffer = 
+                               cpu_to_le64(new->dma_addr);
+                       page[entry] = new;
+                       
+               }
+
+               if (++count == 4) {
+                       cluster = entry;
+                       count = 0;
+               }
+               released++;
+               entry = RX_DESC_ENTRY(ring, entry + 1);
+       }
+       cp->rx_old[ring] = entry;
+
+       if (cluster < 0) 
+               return 0;
+
+       if (ring == 0)
+               writel(cluster, cp->regs + REG_RX_KICK);
+       else if ((N_RX_DESC_RINGS > 1) &&
+                (cp->cas_flags & CAS_FLAG_REG_PLUS)) 
+               writel(cluster, cp->regs + REG_PLUS_RX_KICK1);
+       return 0;
+}
+
+
+/* process a completion ring. packets are set up in three basic ways:
+ * small packets: should be copied header + data in single buffer.
+ * large packets: header and data in a single buffer.
+ * split packets: header in a separate buffer from data. 
+ *                data may be in multiple pages. data may be > 256
+ *                bytes but in a single page. 
+ *
+ * NOTE: RX page posting is done in this routine as well. while there's
+ *       the capability of using multiple RX completion rings, it isn't
+ *       really worthwhile due to the fact that the page posting will
+ *       force serialization on the single descriptor ring. 
+ */
+static int cas_rx_ringN(struct cas *cp, int ring, int budget)
+{
+       struct cas_rx_comp *rxcs = cp->init_rxcs[ring];
+       int entry, drops;
+       int npackets = 0;
+
+       if (netif_msg_intr(cp))
+               printk(KERN_DEBUG "%s: rx[%d] interrupt, done: %d/%d\n",
+                      cp->dev->name, ring,
+                      readl(cp->regs + REG_RX_COMP_HEAD), 
+                      cp->rx_new[ring]);
+
+       entry = cp->rx_new[ring];
+       drops = 0;
+       while (1) {
+               struct cas_rx_comp *rxc = rxcs + entry;
+               struct sk_buff *skb;
+               int type, len;
+               u64 words[4];
+               int i, dring;
+
+               words[0] = le64_to_cpu(rxc->word1);
+               words[1] = le64_to_cpu(rxc->word2);
+               words[2] = le64_to_cpu(rxc->word3);
+               words[3] = le64_to_cpu(rxc->word4);
+
+               /* don't touch if still owned by hw */
+               type = CAS_VAL(RX_COMP1_TYPE, words[0]);
+               if (type == 0)
+                       break;
+
+               /* hw hasn't cleared the zero bit yet */
+               if (words[3] & RX_COMP4_ZERO) {
+                       break;
+               }
+
+               /* get info on the packet */
+               if (words[3] & (RX_COMP4_LEN_MISMATCH | RX_COMP4_BAD)) {
+                       spin_lock(&cp->stat_lock[ring]);
+                       cp->net_stats[ring].rx_errors++;
+                       if (words[3] & RX_COMP4_LEN_MISMATCH)
+                               cp->net_stats[ring].rx_length_errors++;
+                       if (words[3] & RX_COMP4_BAD)
+                               cp->net_stats[ring].rx_crc_errors++;
+                       spin_unlock(&cp->stat_lock[ring]);
+
+                       /* We'll just return it to Cassini. */
+               drop_it:
+                       spin_lock(&cp->stat_lock[ring]);
+                       ++cp->net_stats[ring].rx_dropped;
+                       spin_unlock(&cp->stat_lock[ring]);
+                       goto next;
+               }
+
+               len = cas_rx_process_pkt(cp, rxc, entry, words, &skb);
+               if (len < 0) {
+                       ++drops;
+                       goto drop_it;
+               }
+
+               /* see if it's a flow re-assembly or not. the driver
+                * itself handles release back up.
+                */
+               if (RX_DONT_BATCH || (type == 0x2)) {
+                       /* non-reassm: these always get released */
+                       cas_skb_release(skb); 
+               } else {
+                       cas_rx_flow_pkt(cp, words, skb);
+               }
+
+               spin_lock(&cp->stat_lock[ring]);
+               cp->net_stats[ring].rx_packets++;
+               cp->net_stats[ring].rx_bytes += len;
+               spin_unlock(&cp->stat_lock[ring]);
+               cp->dev->last_rx = jiffies;
+
+       next:
+               npackets++;
+
+               /* should it be released? */
+               if (words[0] & RX_COMP1_RELEASE_HDR) {
+                       i = CAS_VAL(RX_COMP2_HDR_INDEX, words[1]);
+                       dring = CAS_VAL(RX_INDEX_RING, i);
+                       i = CAS_VAL(RX_INDEX_NUM, i);
+                       cas_post_page(cp, dring, i);
+               }
+               
+               if (words[0] & RX_COMP1_RELEASE_DATA) {
+                       i = CAS_VAL(RX_COMP1_DATA_INDEX, words[0]);
+                       dring = CAS_VAL(RX_INDEX_RING, i);
+                       i = CAS_VAL(RX_INDEX_NUM, i);
+                       cas_post_page(cp, dring, i);
+               }
+
+               if (words[0] & RX_COMP1_RELEASE_NEXT) {
+                       i = CAS_VAL(RX_COMP2_NEXT_INDEX, words[1]);
+                       dring = CAS_VAL(RX_INDEX_RING, i);
+                       i = CAS_VAL(RX_INDEX_NUM, i);
+                       cas_post_page(cp, dring, i);
+               }
+
+               /* skip to the next entry */
+               entry = RX_COMP_ENTRY(ring, entry + 1 + 
+                                     CAS_VAL(RX_COMP1_SKIP, words[0]));
+#ifdef USE_NAPI
+               if (budget && (npackets >= budget))
+                       break;
+#endif
+       }
+       cp->rx_new[ring] = entry;
+
+       if (drops)
+               printk(KERN_INFO "%s: Memory squeeze, deferring packet.\n",
+                      cp->dev->name);
+       return npackets;
+}
+
+
+/* put completion entries back on the ring */
+static void cas_post_rxcs_ringN(struct net_device *dev,
+                               struct cas *cp, int ring)
+{
+       struct cas_rx_comp *rxc = cp->init_rxcs[ring];
+       int last, entry;
+
+       last = cp->rx_cur[ring];
+       entry = cp->rx_new[ring]; 
+       if (netif_msg_intr(cp))
+               printk(KERN_DEBUG "%s: rxc[%d] interrupt, done: %d/%d\n",
+                      dev->name, ring, readl(cp->regs + REG_RX_COMP_HEAD),
+                      entry);
+       
+       /* zero and re-mark descriptors */
+       while (last != entry) {
+               cas_rxc_init(rxc + last);
+               last = RX_COMP_ENTRY(ring, last + 1);
+       }
+       cp->rx_cur[ring] = last;
+
+       if (ring == 0)
+               writel(last, cp->regs + REG_RX_COMP_TAIL);
+       else if (cp->cas_flags & CAS_FLAG_REG_PLUS) 
+               writel(last, cp->regs + REG_PLUS_RX_COMPN_TAIL(ring));
+}
+
+
+
+/* cassini can use all four PCI interrupts for the completion ring. 
+ * rings 3 and 4 are identical
+ */
+#if defined(USE_PCI_INTC) || defined(USE_PCI_INTD)
+static inline void cas_handle_irqN(struct net_device *dev, 
+                                  struct cas *cp, const u32 status,
+                                  const int ring)
+{
+       if (status & (INTR_RX_COMP_FULL_ALT | INTR_RX_COMP_AF_ALT)) 
+               cas_post_rxcs_ringN(dev, cp, ring);
+}
+
+static irqreturn_t cas_interruptN(int irq, void *dev_id, struct pt_regs *regs)
+{
+       struct net_device *dev = dev_id;
+       struct cas *cp = netdev_priv(dev);
+       unsigned long flags;
+       int ring;
+       u32 status = readl(cp->regs + REG_PLUS_INTRN_STATUS(ring));
+
+       /* check for shared irq */
+       if (status == 0)
+               return IRQ_NONE;
+
+       ring = (irq == cp->pci_irq_INTC) ? 2 : 3;
+       spin_lock_irqsave(&cp->lock, flags);
+       if (status & INTR_RX_DONE_ALT) { /* handle rx separately */
+#ifdef USE_NAPI
+               cas_mask_intr(cp);
+               netif_rx_schedule(dev);
+#else
+               cas_rx_ringN(cp, ring, 0);
+#endif
+               status &= ~INTR_RX_DONE_ALT;
+       }
+
+       if (status)
+               cas_handle_irqN(dev, cp, status, ring);
+       spin_unlock_irqrestore(&cp->lock, flags);
+       return IRQ_HANDLED;
+}
+#endif
+
+#ifdef USE_PCI_INTB
+/* everything but rx packets */
+static inline void cas_handle_irq1(struct cas *cp, const u32 status)
+{
+       if (status & INTR_RX_BUF_UNAVAIL_1) {
+               /* Frame arrived, no free RX buffers available. 
+                * NOTE: we can get this on a link transition. */
+               cas_post_rxds_ringN(cp, 1, 0);
+               spin_lock(&cp->stat_lock[1]);
+               cp->net_stats[1].rx_dropped++;
+               spin_unlock(&cp->stat_lock[1]);
+       }
+
+       if (status & INTR_RX_BUF_AE_1) 
+               cas_post_rxds_ringN(cp, 1, RX_DESC_RINGN_SIZE(1) - 
+                                   RX_AE_FREEN_VAL(1));
+
+       if (status & (INTR_RX_COMP_AF | INTR_RX_COMP_FULL))
+               cas_post_rxcs_ringN(cp, 1);
+}
+
+/* ring 2 handles a few more events than 3 and 4 */
+static irqreturn_t cas_interrupt1(int irq, void *dev_id, struct pt_regs *regs)
+{
+       struct net_device *dev = dev_id;
+       struct cas *cp = netdev_priv(dev);
+       unsigned long flags;
+       u32 status = readl(cp->regs + REG_PLUS_INTRN_STATUS(1));
+
+       /* check for shared interrupt */
+       if (status == 0)
+               return IRQ_NONE;
+
+       spin_lock_irqsave(&cp->lock, flags);
+       if (status & INTR_RX_DONE_ALT) { /* handle rx separately */
+#ifdef USE_NAPI
+               cas_mask_intr(cp);
+               netif_rx_schedule(dev);
+#else
+               cas_rx_ringN(cp, 1, 0);
+#endif
+               status &= ~INTR_RX_DONE_ALT;
+       }
+       if (status)
+               cas_handle_irq1(cp, status);
+       spin_unlock_irqrestore(&cp->lock, flags);
+       return IRQ_HANDLED;
+}
+#endif
+
+static inline void cas_handle_irq(struct net_device *dev,
+                                 struct cas *cp, const u32 status)
+{
+       /* housekeeping interrupts */
+       if (status & INTR_ERROR_MASK)
+               cas_abnormal_irq(dev, cp, status);
+
+       if (status & INTR_RX_BUF_UNAVAIL) {
+               /* Frame arrived, no free RX buffers available. 
+                * NOTE: we can get this on a link transition.
+                */
+               cas_post_rxds_ringN(cp, 0, 0);
+               spin_lock(&cp->stat_lock[0]);
+               cp->net_stats[0].rx_dropped++;
+               spin_unlock(&cp->stat_lock[0]);
+       } else if (status & INTR_RX_BUF_AE) {
+               cas_post_rxds_ringN(cp, 0, RX_DESC_RINGN_SIZE(0) -
+                                   RX_AE_FREEN_VAL(0));
+       }
+
+       if (status & (INTR_RX_COMP_AF | INTR_RX_COMP_FULL))
+               cas_post_rxcs_ringN(dev, cp, 0);
+}
+
+static irqreturn_t cas_interrupt(int irq, void *dev_id, struct pt_regs *regs)
+{
+       struct net_device *dev = dev_id;
+       struct cas *cp = netdev_priv(dev);
+       unsigned long flags;
+       u32 status = readl(cp->regs + REG_INTR_STATUS);
+
+       if (status == 0)
+               return IRQ_NONE;
+
+       spin_lock_irqsave(&cp->lock, flags);
+       if (status & (INTR_TX_ALL | INTR_TX_INTME)) {
+               cas_tx(dev, cp, status);
+               status &= ~(INTR_TX_ALL | INTR_TX_INTME);
+       }
+
+       if (status & INTR_RX_DONE) {
+#ifdef USE_NAPI
+               cas_mask_intr(cp);
+               netif_rx_schedule(dev);
+#else
+               cas_rx_ringN(cp, 0, 0);
+#endif
+               status &= ~INTR_RX_DONE;
+       }
+
+       if (status)
+               cas_handle_irq(dev, cp, status);
+       spin_unlock_irqrestore(&cp->lock, flags);
+       return IRQ_HANDLED;
+}
+
+
+#ifdef USE_NAPI
+static int cas_poll(struct net_device *dev, int *budget)
+{
+       struct cas *cp = netdev_priv(dev);
+       int i, enable_intr, todo, credits;
+       u32 status = readl(cp->regs + REG_INTR_STATUS);
+       unsigned long flags;
+
+       spin_lock_irqsave(&cp->lock, flags);
+       cas_tx(dev, cp, status);
+       spin_unlock_irqrestore(&cp->lock, flags);
+
+       /* NAPI rx packets. we spread the credits across all of the
+        * rxc rings
+        */
+       todo = min(*budget, dev->quota);
+
+       /* to make sure we're fair with the work we loop through each
+        * ring N_RX_COMP_RING times with a request of 
+        * todo / N_RX_COMP_RINGS
+        */
+       enable_intr = 1;
+       credits = 0;
+       for (i = 0; i < N_RX_COMP_RINGS; i++) {
+               int j;
+               for (j = 0; j < N_RX_COMP_RINGS; j++) {
+                       credits += cas_rx_ringN(cp, j, todo / N_RX_COMP_RINGS);
+                       if (credits >= todo) {
+                               enable_intr = 0;
+                               goto rx_comp;
+                       }
+               }
+       }
+
+rx_comp:
+       *budget    -= credits;
+       dev->quota -= credits;
+
+       /* final rx completion */
+       spin_lock_irqsave(&cp->lock, flags);
+       if (status)
+               cas_handle_irq(dev, cp, status);
+
+#ifdef USE_PCI_INTB
+       if (N_RX_COMP_RINGS > 1) {
+               status = readl(cp->regs + REG_PLUS_INTRN_STATUS(1));
+               if (status)
+                       cas_handle_irq1(dev, cp, status);
+       }
+#endif
+
+#ifdef USE_PCI_INTC
+       if (N_RX_COMP_RINGS > 2) {
+               status = readl(cp->regs + REG_PLUS_INTRN_STATUS(2));
+               if (status)
+                       cas_handle_irqN(dev, cp, status, 2);
+       }
+#endif
+
+#ifdef USE_PCI_INTD
+       if (N_RX_COMP_RINGS > 3) {
+               status = readl(cp->regs + REG_PLUS_INTRN_STATUS(3));
+               if (status)
+                       cas_handle_irqN(dev, cp, status, 3);
+       }
+#endif
+       spin_unlock_irqrestore(&cp->lock, flags);
+       if (enable_intr) {
+               netif_rx_complete(dev);
+               cas_unmask_intr(cp);
+               return 0;
+       }
+       return 1;
+}
+#endif
+
+#ifdef CONFIG_NET_POLL_CONTROLLER
+static void cas_netpoll(struct net_device *dev)
+{
+       struct cas *cp = netdev_priv(dev);
+
+       cas_disable_irq(cp, 0);
+       cas_interrupt(cp->pdev->irq, dev, NULL);
+       cas_enable_irq(cp, 0);
+
+#ifdef USE_PCI_INTB
+       if (N_RX_COMP_RINGS > 1) {
+               /* cas_interrupt1(); */
+       }
+#endif
+#ifdef USE_PCI_INTC
+       if (N_RX_COMP_RINGS > 2) {
+               /* cas_interruptN(); */
+       }
+#endif
+#ifdef USE_PCI_INTD
+       if (N_RX_COMP_RINGS > 3) {
+               /* cas_interruptN(); */
+       }
+#endif
+}
+#endif
+
+static void cas_tx_timeout(struct net_device *dev)
+{
+       struct cas *cp = netdev_priv(dev);
+
+       printk(KERN_ERR "%s: transmit timed out, resetting\n", dev->name);
+       if (!cp->hw_running) {
+               printk("%s: hrm.. hw not running!\n", dev->name);
+               return;
+       }
+
+       printk(KERN_ERR "%s: MIF_STATE[%08x]\n",
+              dev->name, readl(cp->regs + REG_MIF_STATE_MACHINE));
+
+       printk(KERN_ERR "%s: MAC_STATE[%08x]\n",
+              dev->name, readl(cp->regs + REG_MAC_STATE_MACHINE));
+
+       printk(KERN_ERR "%s: TX_STATE[%08x:%08x:%08x] "
+              "FIFO[%08x:%08x:%08x] SM1[%08x] SM2[%08x]\n",
+              dev->name,
+              readl(cp->regs + REG_TX_CFG),
+              readl(cp->regs + REG_MAC_TX_STATUS),
+              readl(cp->regs + REG_MAC_TX_CFG),
+              readl(cp->regs + REG_TX_FIFO_PKT_CNT),
+              readl(cp->regs + REG_TX_FIFO_WRITE_PTR),
+              readl(cp->regs + REG_TX_FIFO_READ_PTR),
+              readl(cp->regs + REG_TX_SM_1),
+              readl(cp->regs + REG_TX_SM_2));
+
+       printk(KERN_ERR "%s: RX_STATE[%08x:%08x:%08x]\n",
+              dev->name,
+              readl(cp->regs + REG_RX_CFG),
+              readl(cp->regs + REG_MAC_RX_STATUS),
+              readl(cp->regs + REG_MAC_RX_CFG));
+
+       printk(KERN_ERR "%s: HP_STATE[%08x:%08x:%08x:%08x]\n",
+              dev->name,
+              readl(cp->regs + REG_HP_STATE_MACHINE),
+              readl(cp->regs + REG_HP_STATUS0),
+              readl(cp->regs + REG_HP_STATUS1),
+              readl(cp->regs + REG_HP_STATUS2));
+
+#if 1
+       atomic_inc(&cp->reset_task_pending);
+       atomic_inc(&cp->reset_task_pending_all);
+       schedule_work(&cp->reset_task);
+#else
+       atomic_set(&cp->reset_task_pending, CAS_RESET_ALL);
+       schedule_work(&cp->reset_task);
+#endif
+}
+
+static inline int cas_intme(int ring, int entry)
+{
+       /* Algorithm: IRQ every 1/2 of descriptors. */
+       if (!(entry & ((TX_DESC_RINGN_SIZE(ring) >> 1) - 1)))
+               return 1;
+       return 0;
+}
+
+
+static void cas_write_txd(struct cas *cp, int ring, int entry,
+                         dma_addr_t mapping, int len, u64 ctrl, int last)
+{
+       struct cas_tx_desc *txd = cp->init_txds[ring] + entry;
+
+       ctrl |= CAS_BASE(TX_DESC_BUFLEN, len);
+       if (cas_intme(ring, entry))
+               ctrl |= TX_DESC_INTME;
+       if (last)
+               ctrl |= TX_DESC_EOF;
+       txd->control = cpu_to_le64(ctrl);
+       txd->buffer = cpu_to_le64(mapping);
+}
+
+static inline void *tx_tiny_buf(struct cas *cp, const int ring, 
+                               const int entry)
+{
+       return cp->tx_tiny_bufs[ring] + TX_TINY_BUF_LEN*entry;
+}
+
+static inline dma_addr_t tx_tiny_map(struct cas *cp, const int ring, 
+                                    const int entry, const int tentry)
+{
+       cp->tx_tiny_use[ring][tentry].nbufs++;
+       cp->tx_tiny_use[ring][entry].used = 1;
+       return cp->tx_tiny_dvma[ring] + TX_TINY_BUF_LEN*entry;
+}
+
+static inline int cas_xmit_tx_ringN(struct cas *cp, int ring, 
+                                   struct sk_buff *skb)
+{
+       struct net_device *dev = cp->dev;
+       int entry, nr_frags, frag, tabort, tentry;
+       dma_addr_t mapping;
+       unsigned long flags;
+       u64 ctrl;
+       u32 len;
+
+       spin_lock_irqsave(&cp->tx_lock[ring], flags);
+
+       /* This is a hard error, log it. */
+       if (TX_BUFFS_AVAIL(cp, ring) <= 
+           CAS_TABORT(cp)*(skb_shinfo(skb)->nr_frags + 1)) {
+               netif_stop_queue(dev);
+               spin_unlock_irqrestore(&cp->tx_lock[ring], flags);
+               printk(KERN_ERR PFX "%s: BUG! Tx Ring full when "
+                      "queue awake!\n", dev->name);
+               return 1;
+       }
+
+       ctrl = 0;
+       if (skb->ip_summed == CHECKSUM_HW) {
+               u64 csum_start_off, csum_stuff_off;
+
+               csum_start_off = (u64) (skb->h.raw - skb->data);
+               csum_stuff_off = (u64) ((skb->h.raw + skb->csum) - skb->data);
+
+               ctrl =  TX_DESC_CSUM_EN | 
+                       CAS_BASE(TX_DESC_CSUM_START, csum_start_off) |
+                       CAS_BASE(TX_DESC_CSUM_STUFF, csum_stuff_off);
+       }
+
+       entry = cp->tx_new[ring];
+       cp->tx_skbs[ring][entry] = skb;
+
+       nr_frags = skb_shinfo(skb)->nr_frags;
+       len = skb_headlen(skb);
+       mapping = pci_map_page(cp->pdev, virt_to_page(skb->data),
+                              offset_in_page(skb->data), len,
+                              PCI_DMA_TODEVICE);
+
+       tentry = entry;
+       tabort = cas_calc_tabort(cp, (unsigned long) skb->data, len);
+       if (unlikely(tabort)) {
+               /* NOTE: len is always >  tabort */
+               cas_write_txd(cp, ring, entry, mapping, len - tabort, 
+                             ctrl | TX_DESC_SOF, 0);
+               entry = TX_DESC_NEXT(ring, entry);
+
+               memcpy(tx_tiny_buf(cp, ring, entry), skb->data + 
+                      len - tabort, tabort);
+               mapping = tx_tiny_map(cp, ring, entry, tentry);
+               cas_write_txd(cp, ring, entry, mapping, tabort, ctrl,
+                             (nr_frags == 0));
+       } else {
+               cas_write_txd(cp, ring, entry, mapping, len, ctrl | 
+                             TX_DESC_SOF, (nr_frags == 0));
+       }
+       entry = TX_DESC_NEXT(ring, entry);
+
+       for (frag = 0; frag < nr_frags; frag++) {
+               skb_frag_t *fragp = &skb_shinfo(skb)->frags[frag];
+
+               len = fragp->size;
+               mapping = pci_map_page(cp->pdev, fragp->page,
+                                      fragp->page_offset, len,
+                                      PCI_DMA_TODEVICE);
+
+               tabort = cas_calc_tabort(cp, fragp->page_offset, len);
+               if (unlikely(tabort)) {
+                       void *addr;
+
+                       /* NOTE: len is always > tabort */
+                       cas_write_txd(cp, ring, entry, mapping, len - tabort,
+                                     ctrl, 0);
+                       entry = TX_DESC_NEXT(ring, entry);
+                       
+                       addr = cas_page_map(fragp->page);
+                       memcpy(tx_tiny_buf(cp, ring, entry),
+                              addr + fragp->page_offset + len - tabort, 
+                              tabort);
+                       cas_page_unmap(addr);
+                       mapping = tx_tiny_map(cp, ring, entry, tentry);
+                       len     = tabort;
+               }
+
+               cas_write_txd(cp, ring, entry, mapping, len, ctrl,
+                             (frag + 1 == nr_frags));
+               entry = TX_DESC_NEXT(ring, entry);
+       }
+
+       cp->tx_new[ring] = entry;
+       if (TX_BUFFS_AVAIL(cp, ring) <= CAS_TABORT(cp)*(MAX_SKB_FRAGS + 1))
+               netif_stop_queue(dev);
+
+       if (netif_msg_tx_queued(cp))
+               printk(KERN_DEBUG "%s: tx[%d] queued, slot %d, skblen %d, "
+                      "avail %d\n",
+                      dev->name, ring, entry, skb->len, 
+                      TX_BUFFS_AVAIL(cp, ring));
+       writel(entry, cp->regs + REG_TX_KICKN(ring));
+       spin_unlock_irqrestore(&cp->tx_lock[ring], flags);
+       return 0;
+} 
+
+static int cas_start_xmit(struct sk_buff *skb, struct net_device *dev)
+{
+       struct cas *cp = netdev_priv(dev);
+
+       /* this is only used as a load-balancing hint, so it doesn't
+        * need to be SMP safe
+        */
+       static int ring; 
+
+       skb = skb_padto(skb, cp->min_frame_size);
+       if (!skb)
+               return 0;
+
+       /* XXX: we need some higher-level QoS hooks to steer packets to
+        *      individual queues.
+        */
+       if (cas_xmit_tx_ringN(cp, ring++ & N_TX_RINGS_MASK, skb))
+               return 1;
+       dev->trans_start = jiffies;
+       return 0;
+}
+
+static void cas_init_tx_dma(struct cas *cp)
+{
+       u64 desc_dma = cp->block_dvma;
+       unsigned long off;
+       u32 val;
+       int i;
+
+       /* set up tx completion writeback registers. must be 8-byte aligned */
+#ifdef USE_TX_COMPWB
+       off = offsetof(struct cas_init_block, tx_compwb);
+       writel((desc_dma + off) >> 32, cp->regs + REG_TX_COMPWB_DB_HI);
+       writel((desc_dma + off) & 0xffffffff, cp->regs + REG_TX_COMPWB_DB_LOW);
+#endif
+
+       /* enable completion writebacks, enable paced mode,
+        * disable read pipe, and disable pre-interrupt compwbs
+        */
+       val =   TX_CFG_COMPWB_Q1 | TX_CFG_COMPWB_Q2 | 
+               TX_CFG_COMPWB_Q3 | TX_CFG_COMPWB_Q4 |
+               TX_CFG_DMA_RDPIPE_DIS | TX_CFG_PACED_MODE | 
+               TX_CFG_INTR_COMPWB_DIS;
+
+       /* write out tx ring info and tx desc bases */
+       for (i = 0; i < MAX_TX_RINGS; i++) {
+               off = (unsigned long) cp->init_txds[i] - 
+                       (unsigned long) cp->init_block;
+
+               val |= CAS_TX_RINGN_BASE(i);
+               writel((desc_dma + off) >> 32, cp->regs + REG_TX_DBN_HI(i));
+               writel((desc_dma + off) & 0xffffffff, cp->regs +
+                      REG_TX_DBN_LOW(i));
+               /* don't zero out the kick register here as the system
+                * will wedge
+                */
+       }
+       writel(val, cp->regs + REG_TX_CFG);
+
+       /* program max burst sizes. these numbers should be different
+        * if doing QoS.
+        */
+#ifdef USE_QOS
+       writel(0x800, cp->regs + REG_TX_MAXBURST_0);
+       writel(0x1600, cp->regs + REG_TX_MAXBURST_1);
+       writel(0x2400, cp->regs + REG_TX_MAXBURST_2);
+       writel(0x4800, cp->regs + REG_TX_MAXBURST_3);
+#else
+       writel(0x800, cp->regs + REG_TX_MAXBURST_0);
+       writel(0x800, cp->regs + REG_TX_MAXBURST_1);
+       writel(0x800, cp->regs + REG_TX_MAXBURST_2);
+       writel(0x800, cp->regs + REG_TX_MAXBURST_3);
+#endif
+}
+
+/* Must be invoked under cp->lock. */
+static inline void cas_init_dma(struct cas *cp)
+{
+       cas_init_tx_dma(cp);
+       cas_init_rx_dma(cp);
+}
+
+/* Must be invoked under cp->lock. */
+static u32 cas_setup_multicast(struct cas *cp)
+{
+       u32 rxcfg = 0;
+       int i;
+       
+       if (cp->dev->flags & IFF_PROMISC) {
+               rxcfg |= MAC_RX_CFG_PROMISC_EN;
+
+       } else if (cp->dev->flags & IFF_ALLMULTI) {
+               for (i=0; i < 16; i++)
+                       writel(0xFFFF, cp->regs + REG_MAC_HASH_TABLEN(i));
+               rxcfg |= MAC_RX_CFG_HASH_FILTER_EN;
+
+       } else {
+               u16 hash_table[16];
+               u32 crc;
+               struct dev_mc_list *dmi = cp->dev->mc_list;
+               int i;
+
+               /* use the alternate mac address registers for the
+                * first 15 multicast addresses
+                */
+               for (i = 1; i <= CAS_MC_EXACT_MATCH_SIZE; i++) {
+                       if (!dmi) {
+                               writel(0x0, cp->regs + REG_MAC_ADDRN(i*3 + 0));
+                               writel(0x0, cp->regs + REG_MAC_ADDRN(i*3 + 1));
+                               writel(0x0, cp->regs + REG_MAC_ADDRN(i*3 + 2));
+                               continue;
+                       }
+                       writel((dmi->dmi_addr[4] << 8) | dmi->dmi_addr[5], 
+                              cp->regs + REG_MAC_ADDRN(i*3 + 0));
+                       writel((dmi->dmi_addr[2] << 8) | dmi->dmi_addr[3], 
+                              cp->regs + REG_MAC_ADDRN(i*3 + 1));
+                       writel((dmi->dmi_addr[0] << 8) | dmi->dmi_addr[1], 
+                              cp->regs + REG_MAC_ADDRN(i*3 + 2));
+                       dmi = dmi->next;
+               }
+
+               /* use hw hash table for the next series of 
+                * multicast addresses
+                */
+               memset(hash_table, 0, sizeof(hash_table));
+               while (dmi) {
+                       crc = ether_crc_le(ETH_ALEN, dmi->dmi_addr);
+                       crc >>= 24;
+                       hash_table[crc >> 4] |= 1 << (15 - (crc & 0xf));
+                       dmi = dmi->next;
+               }
+               for (i=0; i < 16; i++)
+                       writel(hash_table[i], cp->regs + 
+                              REG_MAC_HASH_TABLEN(i));
+               rxcfg |= MAC_RX_CFG_HASH_FILTER_EN;
+       }
+
+       return rxcfg;
+}
+
+/* must be invoked under cp->stat_lock[N_TX_RINGS] */
+static void cas_clear_mac_err(struct cas *cp)
+{
+       writel(0, cp->regs + REG_MAC_COLL_NORMAL);
+       writel(0, cp->regs + REG_MAC_COLL_FIRST);
+       writel(0, cp->regs + REG_MAC_COLL_EXCESS);
+       writel(0, cp->regs + REG_MAC_COLL_LATE);
+       writel(0, cp->regs + REG_MAC_TIMER_DEFER);
+       writel(0, cp->regs + REG_MAC_ATTEMPTS_PEAK);
+       writel(0, cp->regs + REG_MAC_RECV_FRAME);
+       writel(0, cp->regs + REG_MAC_LEN_ERR);
+       writel(0, cp->regs + REG_MAC_ALIGN_ERR);
+       writel(0, cp->regs + REG_MAC_FCS_ERR);
+       writel(0, cp->regs + REG_MAC_RX_CODE_ERR);
+}
+
+
+static void cas_mac_reset(struct cas *cp)
+{
+       int i;
+
+       /* do both TX and RX reset */
+       writel(0x1, cp->regs + REG_MAC_TX_RESET);
+       writel(0x1, cp->regs + REG_MAC_RX_RESET);
+
+       /* wait for TX */
+       i = STOP_TRIES;
+       while (i-- > 0) {
+               if (readl(cp->regs + REG_MAC_TX_RESET) == 0)
+                       break;
+               udelay(10);
+       }
+
+       /* wait for RX */
+       i = STOP_TRIES;
+       while (i-- > 0) {
+               if (readl(cp->regs + REG_MAC_RX_RESET) == 0)
+                       break;
+               udelay(10);
+       }
+
+       if (readl(cp->regs + REG_MAC_TX_RESET) |
+           readl(cp->regs + REG_MAC_RX_RESET))
+               printk(KERN_ERR "%s: mac tx[%d]/rx[%d] reset failed [%08x]\n",
+                      cp->dev->name, readl(cp->regs + REG_MAC_TX_RESET),
+                      readl(cp->regs + REG_MAC_RX_RESET),
+                      readl(cp->regs + REG_MAC_STATE_MACHINE));
+}
+
+
+/* Must be invoked under cp->lock. */
+static void cas_init_mac(struct cas *cp)
+{
+       unsigned char *e = &cp->dev->dev_addr[0];
+       int i;
+#ifdef CONFIG_CASSINI_MULTICAST_REG_WRITE
+       u32 rxcfg;
+#endif
+       cas_mac_reset(cp);
+
+       /* setup core arbitration weight register */
+       writel(CAWR_RR_DIS, cp->regs + REG_CAWR);
+
+       /* XXX Use pci_dma_burst_advice() */
+#if !defined(CONFIG_SPARC64) && !defined(CONFIG_ALPHA)
+       /* set the infinite burst register for chips that don't have
+        * pci issues.
+        */
+       if ((cp->cas_flags & CAS_FLAG_TARGET_ABORT) == 0)
+               writel(INF_BURST_EN, cp->regs + REG_INF_BURST);
+#endif
+
+       writel(0x1BF0, cp->regs + REG_MAC_SEND_PAUSE);
+
+       writel(0x00, cp->regs + REG_MAC_IPG0);
+       writel(0x08, cp->regs + REG_MAC_IPG1);
+       writel(0x04, cp->regs + REG_MAC_IPG2);
+       
+       /* change later for 802.3z */
+       writel(0x40, cp->regs + REG_MAC_SLOT_TIME); 
+
+       /* min frame + FCS */
+       writel(ETH_ZLEN + 4, cp->regs + REG_MAC_FRAMESIZE_MIN);
+
+       /* Ethernet payload + header + FCS + optional VLAN tag. NOTE: we
+        * specify the maximum frame size to prevent RX tag errors on 
+        * oversized frames.
+        */
+       writel(CAS_BASE(MAC_FRAMESIZE_MAX_BURST, 0x2000) |
+              CAS_BASE(MAC_FRAMESIZE_MAX_FRAME, 
+                       (CAS_MAX_MTU + ETH_HLEN + 4 + 4)), 
+              cp->regs + REG_MAC_FRAMESIZE_MAX);
+
+       /* NOTE: crc_size is used as a surrogate for half-duplex. 
+        * workaround saturn half-duplex issue by increasing preamble
+        * size to 65 bytes.
+        */
+       if ((cp->cas_flags & CAS_FLAG_SATURN) && cp->crc_size)
+               writel(0x41, cp->regs + REG_MAC_PA_SIZE);
+       else
+               writel(0x07, cp->regs + REG_MAC_PA_SIZE);
+       writel(0x04, cp->regs + REG_MAC_JAM_SIZE);
+       writel(0x10, cp->regs + REG_MAC_ATTEMPT_LIMIT);
+       writel(0x8808, cp->regs + REG_MAC_CTRL_TYPE);
+
+       writel((e[5] | (e[4] << 8)) & 0x3ff, cp->regs + REG_MAC_RANDOM_SEED);
+
+       writel(0, cp->regs + REG_MAC_ADDR_FILTER0);
+       writel(0, cp->regs + REG_MAC_ADDR_FILTER1);
+       writel(0, cp->regs + REG_MAC_ADDR_FILTER2);
+       writel(0, cp->regs + REG_MAC_ADDR_FILTER2_1_MASK);
+       writel(0, cp->regs + REG_MAC_ADDR_FILTER0_MASK);
+
+       /* setup mac address in perfect filter array */
+       for (i = 0; i < 45; i++)
+               writel(0x0, cp->regs + REG_MAC_ADDRN(i));
+
+       writel((e[4] << 8) | e[5], cp->regs + REG_MAC_ADDRN(0));
+       writel((e[2] << 8) | e[3], cp->regs + REG_MAC_ADDRN(1));
+       writel((e[0] << 8) | e[1], cp->regs + REG_MAC_ADDRN(2));
+
+       writel(0x0001, cp->regs + REG_MAC_ADDRN(42));
+       writel(0xc200, cp->regs + REG_MAC_ADDRN(43));
+       writel(0x0180, cp->regs + REG_MAC_ADDRN(44));
+
+#ifndef CONFIG_CASSINI_MULTICAST_REG_WRITE
+       cp->mac_rx_cfg = cas_setup_multicast(cp);
+#else
+       /* WTZ: Do what Adrian did in cas_set_multicast. Doing
+        * a writel does not seem to be necessary because Cassini
+        * seems to preserve the configuration when we do the reset.
+        * If the chip is in trouble, though, it is not clear if we
+        * can really count on this behavior. cas_set_multicast uses
+        * spin_lock_irqsave, but we are called only in cas_init_hw and
+        * cas_init_hw is protected by cas_lock_all, which calls
+        * spin_lock_irq (so it doesn't need to save the flags, and
+        * we should be OK for the writel, as that is the only 
+        * difference).
+        */
+       cp->mac_rx_cfg = rxcfg = cas_setup_multicast(cp);
+       writel(rxcfg, cp->regs + REG_MAC_RX_CFG);
+#endif
+       spin_lock(&cp->stat_lock[N_TX_RINGS]);
+       cas_clear_mac_err(cp);
+       spin_unlock(&cp->stat_lock[N_TX_RINGS]);
+
+       /* Setup MAC interrupts.  We want to get all of the interesting
+        * counter expiration events, but we do not want to hear about
+        * normal rx/tx as the DMA engine tells us that.
+        */
+       writel(MAC_TX_FRAME_XMIT, cp->regs + REG_MAC_TX_MASK);
+       writel(MAC_RX_FRAME_RECV, cp->regs + REG_MAC_RX_MASK);
+
+       /* Don't enable even the PAUSE interrupts for now, we
+        * make no use of those events other than to record them.
+        */
+       writel(0xffffffff, cp->regs + REG_MAC_CTRL_MASK);
+}
+
+/* Must be invoked under cp->lock. */
+static void cas_init_pause_thresholds(struct cas *cp)
+{
+       /* Calculate pause thresholds.  Setting the OFF threshold to the
+        * full RX fifo size effectively disables PAUSE generation
+        */
+       if (cp->rx_fifo_size <= (2 * 1024)) {
+               cp->rx_pause_off = cp->rx_pause_on = cp->rx_fifo_size;
+       } else {
+               int max_frame = (cp->dev->mtu + ETH_HLEN + 4 + 4 + 64) & ~63;
+               if (max_frame * 3 > cp->rx_fifo_size) {
+                       cp->rx_pause_off = 7104;
+                       cp->rx_pause_on  = 960;
+               } else {
+                       int off = (cp->rx_fifo_size - (max_frame * 2));
+                       int on = off - max_frame;
+                       cp->rx_pause_off = off;
+                       cp->rx_pause_on = on;
+               }
+       }
+}
+
+static int cas_vpd_match(const void __iomem *p, const char *str)
+{
+       int len = strlen(str) + 1;
+       int i;
+       
+       for (i = 0; i < len; i++) {
+               if (readb(p + i) != str[i])
+                       return 0;
+       }
+       return 1;
+}
+
+
+/* get the mac address by reading the vpd information in the rom.
+ * also get the phy type and determine if there's an entropy generator.
+ * NOTE: this is a bit convoluted for the following reasons:
+ *  1) vpd info has order-dependent mac addresses for multinic cards
+ *  2) the only way to determine the nic order is to use the slot
+ *     number.
+ *  3) fiber cards don't have bridges, so their slot numbers don't
+ *     mean anything.
+ *  4) we don't actually know we have a fiber card until after 
+ *     the mac addresses are parsed.
+ */
+static int cas_get_vpd_info(struct cas *cp, unsigned char *dev_addr,
+                           const int offset)
+{
+       void __iomem *p = cp->regs + REG_EXPANSION_ROM_RUN_START;
+       void __iomem *base, *kstart;
+       int i, len;
+       int found = 0;
+#define VPD_FOUND_MAC        0x01
+#define VPD_FOUND_PHY        0x02
+
+       int phy_type = CAS_PHY_MII_MDIO0; /* default phy type */
+       int mac_off  = 0;
+
+       /* give us access to the PROM */
+       writel(BIM_LOCAL_DEV_PROM | BIM_LOCAL_DEV_PAD,
+              cp->regs + REG_BIM_LOCAL_DEV_EN);
+
+       /* check for an expansion rom */
+       if (readb(p) != 0x55 || readb(p + 1) != 0xaa)
+               goto use_random_mac_addr;
+
+       /* search for beginning of vpd */
+       base = 0;
+       for (i = 2; i < EXPANSION_ROM_SIZE; i++) {
+               /* check for PCIR */
+               if ((readb(p + i + 0) == 0x50) &&
+                   (readb(p + i + 1) == 0x43) &&
+                   (readb(p + i + 2) == 0x49) &&
+                   (readb(p + i + 3) == 0x52)) {
+                       base = p + (readb(p + i + 8) | 
+                                   (readb(p + i + 9) << 8));
+                       break;
+               }               
+       }
+
+       if (!base || (readb(base) != 0x82))
+               goto use_random_mac_addr;
+       
+       i = (readb(base + 1) | (readb(base + 2) << 8)) + 3;
+       while (i < EXPANSION_ROM_SIZE) {
+               if (readb(base + i) != 0x90) /* no vpd found */
+                       goto use_random_mac_addr;
+
+               /* found a vpd field */
+               len = readb(base + i + 1) | (readb(base + i + 2) << 8);
+
+               /* extract keywords */
+               kstart = base + i + 3;
+               p = kstart;
+               while ((p - kstart) < len) {
+                       int klen = readb(p + 2);
+                       int j;
+                       char type;
+
+                       p += 3;
+                       
+                       /* look for the following things:
+                        * -- correct length == 29
+                        * 3 (type) + 2 (size) + 
+                        * 18 (strlen("local-mac-address") + 1) + 
+                        * 6 (mac addr) 
+                        * -- VPD Instance 'I'
+                        * -- VPD Type Bytes 'B'
+                        * -- VPD data length == 6
+                        * -- property string == local-mac-address
+                        * 
+                        * -- correct length == 24
+                        * 3 (type) + 2 (size) + 
+                        * 12 (strlen("entropy-dev") + 1) + 
+                        * 7 (strlen("vms110") + 1)
+                        * -- VPD Instance 'I'
+                        * -- VPD Type String 'B'
+                        * -- VPD data length == 7
+                        * -- property string == entropy-dev
+                        *
+                        * -- correct length == 18
+                        * 3 (type) + 2 (size) + 
+                        * 9 (strlen("phy-type") + 1) + 
+                        * 4 (strlen("pcs") + 1)
+                        * -- VPD Instance 'I'
+                        * -- VPD Type String 'S'
+                        * -- VPD data length == 4
+                        * -- property string == phy-type
+                        * 
+                        * -- correct length == 23
+                        * 3 (type) + 2 (size) + 
+                        * 14 (strlen("phy-interface") + 1) + 
+                        * 4 (strlen("pcs") + 1)
+                        * -- VPD Instance 'I'
+                        * -- VPD Type String 'S'
+                        * -- VPD data length == 4
+                        * -- property string == phy-interface
+                        */
+                       if (readb(p) != 'I')
+                               goto next;
+
+                       /* finally, check string and length */
+                       type = readb(p + 3);
+                       if (type == 'B') {
+                               if ((klen == 29) && readb(p + 4) == 6 &&
+                                   cas_vpd_match(p + 5, 
+                                                 "local-mac-address")) {
+                                       if (mac_off++ > offset) 
+                                               goto next;
+
+                                       /* set mac address */
+                                       for (j = 0; j < 6; j++) 
+                                               dev_addr[j] = 
+                                                       readb(p + 23 + j);
+                                       goto found_mac;
+                               }
+                       }
+
+                       if (type != 'S')
+                               goto next;
+
+#ifdef USE_ENTROPY_DEV
+                       if ((klen == 24) && 
+                           cas_vpd_match(p + 5, "entropy-dev") &&
+                           cas_vpd_match(p + 17, "vms110")) {
+                               cp->cas_flags |= CAS_FLAG_ENTROPY_DEV;
+                               goto next;
+                       }
+#endif
+
+                       if (found & VPD_FOUND_PHY)
+                               goto next;
+
+                       if ((klen == 18) && readb(p + 4) == 4 &&
+                           cas_vpd_match(p + 5, "phy-type")) {
+                               if (cas_vpd_match(p + 14, "pcs")) {
+                                       phy_type = CAS_PHY_SERDES;
+                                       goto found_phy;
+                               }
+                       }
+                       
+                       if ((klen == 23) && readb(p + 4) == 4 &&
+                           cas_vpd_match(p + 5, "phy-interface")) {
+                               if (cas_vpd_match(p + 19, "pcs")) {
+                                       phy_type = CAS_PHY_SERDES;
+                                       goto found_phy;
+                               }
+                       }
+found_mac:
+                       found |= VPD_FOUND_MAC;
+                       goto next;
+
+found_phy:
+                       found |= VPD_FOUND_PHY;
+
+next:
+                       p += klen;
+               }
+               i += len + 3;
+       }
+
+use_random_mac_addr:
+       if (found & VPD_FOUND_MAC)
+               goto done;
+
+       /* Sun MAC prefix then 3 random bytes. */
+       printk(PFX "MAC address not found in ROM VPD\n");
+       dev_addr[0] = 0x08;
+       dev_addr[1] = 0x00;
+       dev_addr[2] = 0x20;
+       get_random_bytes(dev_addr + 3, 3);
+
+done:
+       writel(0, cp->regs + REG_BIM_LOCAL_DEV_EN);
+       return phy_type;
+}
+
+/* check pci invariants */
+static void cas_check_pci_invariants(struct cas *cp)
+{
+       struct pci_dev *pdev = cp->pdev;
+       u8 rev;
+
+       cp->cas_flags = 0;
+       pci_read_config_byte(pdev, PCI_REVISION_ID, &rev);
+       if ((pdev->vendor == PCI_VENDOR_ID_SUN) &&
+           (pdev->device == PCI_DEVICE_ID_SUN_CASSINI)) {
+               if (rev >= CAS_ID_REVPLUS)
+                       cp->cas_flags |= CAS_FLAG_REG_PLUS;
+               if (rev < CAS_ID_REVPLUS02u)
+                       cp->cas_flags |= CAS_FLAG_TARGET_ABORT;
+
+               /* Original Cassini supports HW CSUM, but it's not
+                * enabled by default as it can trigger TX hangs.
+                */
+               if (rev < CAS_ID_REV2)
+                       cp->cas_flags |= CAS_FLAG_NO_HW_CSUM;
+       } else {
+               /* Only sun has original cassini chips.  */
+               cp->cas_flags |= CAS_FLAG_REG_PLUS;
+
+               /* We use a flag because the same phy might be externally
+                * connected.
+                */
+               if ((pdev->vendor == PCI_VENDOR_ID_NS) &&
+                   (pdev->device == PCI_DEVICE_ID_NS_SATURN))
+                       cp->cas_flags |= CAS_FLAG_SATURN;
+       }
+}
+
+
+static int cas_check_invariants(struct cas *cp)
+{
+       struct pci_dev *pdev = cp->pdev;
+       u32 cfg;
+       int i;
+
+       /* get page size for rx buffers. */
+       cp->page_order = 0; 
+#ifdef USE_PAGE_ORDER
+       if (PAGE_SHIFT < CAS_JUMBO_PAGE_SHIFT) {
+               /* see if we can allocate larger pages */
+               struct page *page = alloc_pages(GFP_ATOMIC, 
+                                               CAS_JUMBO_PAGE_SHIFT - 
+                                               PAGE_SHIFT);
+               if (page) {
+                       __free_pages(page, CAS_JUMBO_PAGE_SHIFT - PAGE_SHIFT);
+                       cp->page_order = CAS_JUMBO_PAGE_SHIFT - PAGE_SHIFT;
+               } else {
+                       printk(PFX "MTU limited to %d bytes\n", CAS_MAX_MTU);
+               }
+       }
+#endif
+       cp->page_size = (PAGE_SIZE << cp->page_order);
+
+       /* Fetch the FIFO configurations. */
+       cp->tx_fifo_size = readl(cp->regs + REG_TX_FIFO_SIZE) * 64;
+       cp->rx_fifo_size = RX_FIFO_SIZE;
+
+       /* finish phy determination. MDIO1 takes precedence over MDIO0 if 
+        * they're both connected.
+        */
+       cp->phy_type = cas_get_vpd_info(cp, cp->dev->dev_addr, 
+                                       PCI_SLOT(pdev->devfn));
+       if (cp->phy_type & CAS_PHY_SERDES) {
+               cp->cas_flags |= CAS_FLAG_1000MB_CAP;
+               return 0; /* no more checking needed */
+       } 
+
+       /* MII */
+       cfg = readl(cp->regs + REG_MIF_CFG);
+       if (cfg & MIF_CFG_MDIO_1) {
+               cp->phy_type = CAS_PHY_MII_MDIO1;
+       } else if (cfg & MIF_CFG_MDIO_0) {
+               cp->phy_type = CAS_PHY_MII_MDIO0;
+       }
+
+       cas_mif_poll(cp, 0);
+       writel(PCS_DATAPATH_MODE_MII, cp->regs + REG_PCS_DATAPATH_MODE);
+
+       for (i = 0; i < 32; i++) {
+               u32 phy_id;
+               int j;
+
+               for (j = 0; j < 3; j++) {
+                       cp->phy_addr = i;
+                       phy_id = cas_phy_read(cp, MII_PHYSID1) << 16;
+                       phy_id |= cas_phy_read(cp, MII_PHYSID2);
+                       if (phy_id && (phy_id != 0xFFFFFFFF)) {
+                               cp->phy_id = phy_id;
+                               goto done;
+                       }
+               }
+       }
+       printk(KERN_ERR PFX "MII phy did not respond [%08x]\n",
+              readl(cp->regs + REG_MIF_STATE_MACHINE));
+       return -1;
+
+done:
+       /* see if we can do gigabit */
+       cfg = cas_phy_read(cp, MII_BMSR);
+       if ((cfg & CAS_BMSR_1000_EXTEND) && 
+           cas_phy_read(cp, CAS_MII_1000_EXTEND))
+               cp->cas_flags |= CAS_FLAG_1000MB_CAP;
+       return 0;
+}
+
+/* Must be invoked under cp->lock. */
+static inline void cas_start_dma(struct cas *cp)
+{
+       int i;
+       u32 val;
+       int txfailed = 0;
+       
+       /* enable dma */
+       val = readl(cp->regs + REG_TX_CFG) | TX_CFG_DMA_EN;
+       writel(val, cp->regs + REG_TX_CFG);
+       val = readl(cp->regs + REG_RX_CFG) | RX_CFG_DMA_EN;
+       writel(val, cp->regs + REG_RX_CFG);
+
+       /* enable the mac */
+       val = readl(cp->regs + REG_MAC_TX_CFG) | MAC_TX_CFG_EN;
+       writel(val, cp->regs + REG_MAC_TX_CFG);
+       val = readl(cp->regs + REG_MAC_RX_CFG) | MAC_RX_CFG_EN;
+       writel(val, cp->regs + REG_MAC_RX_CFG);
+
+       i = STOP_TRIES;
+       while (i-- > 0) {
+               val = readl(cp->regs + REG_MAC_TX_CFG);
+               if ((val & MAC_TX_CFG_EN))
+                       break;
+               udelay(10);
+       }
+       if (i < 0) txfailed = 1;
+       i = STOP_TRIES;
+       while (i-- > 0) {
+               val = readl(cp->regs + REG_MAC_RX_CFG);
+               if ((val & MAC_RX_CFG_EN)) {
+                       if (txfailed) {
+                         printk(KERN_ERR 
+                                "%s: enabling mac failed [tx:%08x:%08x].\n", 
+                                cp->dev->name,
+                                readl(cp->regs + REG_MIF_STATE_MACHINE),
+                                readl(cp->regs + REG_MAC_STATE_MACHINE));
+                       }
+                       goto enable_rx_done;
+               }
+               udelay(10);
+       }
+       printk(KERN_ERR "%s: enabling mac failed [%s:%08x:%08x].\n", 
+              cp->dev->name,
+              (txfailed? "tx,rx":"rx"),
+              readl(cp->regs + REG_MIF_STATE_MACHINE),
+              readl(cp->regs + REG_MAC_STATE_MACHINE));
+
+enable_rx_done:
+       cas_unmask_intr(cp); /* enable interrupts */
+       writel(RX_DESC_RINGN_SIZE(0) - 4, cp->regs + REG_RX_KICK);
+       writel(0, cp->regs + REG_RX_COMP_TAIL);
+
+       if (cp->cas_flags & CAS_FLAG_REG_PLUS) {
+               if (N_RX_DESC_RINGS > 1) 
+                       writel(RX_DESC_RINGN_SIZE(1) - 4, 
+                              cp->regs + REG_PLUS_RX_KICK1);
+
+               for (i = 1; i < N_RX_COMP_RINGS; i++) 
+                       writel(0, cp->regs + REG_PLUS_RX_COMPN_TAIL(i));
+       }
+}
+
+/* Must be invoked under cp->lock. */
+static void cas_read_pcs_link_mode(struct cas *cp, int *fd, int *spd,
+                                  int *pause)
+{
+       u32 val = readl(cp->regs + REG_PCS_MII_LPA);
+       *fd     = (val & PCS_MII_LPA_FD) ? 1 : 0;
+       *pause  = (val & PCS_MII_LPA_SYM_PAUSE) ? 0x01 : 0x00;
+       if (val & PCS_MII_LPA_ASYM_PAUSE)
+               *pause |= 0x10;
+       *spd = 1000;
+}
+
+/* Must be invoked under cp->lock. */
+static void cas_read_mii_link_mode(struct cas *cp, int *fd, int *spd,
+                                  int *pause)
+{
+       u32 val;
+
+       *fd = 0;
+       *spd = 10;
+       *pause = 0;
+       
+       /* use GMII registers */
+       val = cas_phy_read(cp, MII_LPA);
+       if (val & CAS_LPA_PAUSE)
+               *pause = 0x01;
+
+       if (val & CAS_LPA_ASYM_PAUSE)
+               *pause |= 0x10;
+
+       if (val & LPA_DUPLEX)
+               *fd = 1;
+       if (val & LPA_100)
+               *spd = 100;
+
+       if (cp->cas_flags & CAS_FLAG_1000MB_CAP) {
+               val = cas_phy_read(cp, CAS_MII_1000_STATUS);
+               if (val & (CAS_LPA_1000FULL | CAS_LPA_1000HALF))
+                       *spd = 1000;
+               if (val & CAS_LPA_1000FULL)
+                       *fd = 1;
+       }
+}
+
+/* A link-up condition has occurred, initialize and enable the
+ * rest of the chip.
+ *
+ * Must be invoked under cp->lock.
+ */
+static void cas_set_link_modes(struct cas *cp)
+{
+       u32 val;
+       int full_duplex, speed, pause;
+
+       full_duplex = 0;
+       speed = 10;
+       pause = 0;
+
+       if (CAS_PHY_MII(cp->phy_type)) {
+               cas_mif_poll(cp, 0);
+               val = cas_phy_read(cp, MII_BMCR);
+               if (val & BMCR_ANENABLE) {
+                       cas_read_mii_link_mode(cp, &full_duplex, &speed, 
+                                              &pause);
+               } else {
+                       if (val & BMCR_FULLDPLX)
+                               full_duplex = 1;
+
+                       if (val & BMCR_SPEED100)
+                               speed = 100;
+                       else if (val & CAS_BMCR_SPEED1000)
+                               speed = (cp->cas_flags & CAS_FLAG_1000MB_CAP) ?
+                                       1000 : 100;
+               }
+               cas_mif_poll(cp, 1);
+
+       } else {
+               val = readl(cp->regs + REG_PCS_MII_CTRL);
+               cas_read_pcs_link_mode(cp, &full_duplex, &speed, &pause);
+               if ((val & PCS_MII_AUTONEG_EN) == 0) {
+                       if (val & PCS_MII_CTRL_DUPLEX)
+                               full_duplex = 1;
+               }
+       }
+
+       if (netif_msg_link(cp))
+               printk(KERN_INFO "%s: Link up at %d Mbps, %s-duplex.\n",
+                      cp->dev->name, speed, (full_duplex ? "full" : "half"));
+
+       val = MAC_XIF_TX_MII_OUTPUT_EN | MAC_XIF_LINK_LED;
+       if (CAS_PHY_MII(cp->phy_type)) {
+               val |= MAC_XIF_MII_BUFFER_OUTPUT_EN;
+               if (!full_duplex)
+                       val |= MAC_XIF_DISABLE_ECHO;
+       }
+       if (full_duplex) 
+               val |= MAC_XIF_FDPLX_LED;
+       if (speed == 1000)
+               val |= MAC_XIF_GMII_MODE;
+       writel(val, cp->regs + REG_MAC_XIF_CFG);
+
+       /* deal with carrier and collision detect. */
+       val = MAC_TX_CFG_IPG_EN;
+       if (full_duplex) {
+               val |= MAC_TX_CFG_IGNORE_CARRIER;
+               val |= MAC_TX_CFG_IGNORE_COLL;
+       } else {
+#ifndef USE_CSMA_CD_PROTO
+               val |= MAC_TX_CFG_NEVER_GIVE_UP_EN;
+               val |= MAC_TX_CFG_NEVER_GIVE_UP_LIM;
+#endif
+       }
+       /* val now set up for REG_MAC_TX_CFG */
+
+       /* If gigabit and half-duplex, enable carrier extension
+        * mode.  increase slot time to 512 bytes as well. 
+        * else, disable it and make sure slot time is 64 bytes.
+        * also activate checksum bug workaround
+        */
+       if ((speed == 1000) && !full_duplex) {
+               writel(val | MAC_TX_CFG_CARRIER_EXTEND, 
+                      cp->regs + REG_MAC_TX_CFG);
+
+               val = readl(cp->regs + REG_MAC_RX_CFG);
+               val &= ~MAC_RX_CFG_STRIP_FCS; /* checksum workaround */
+               writel(val | MAC_RX_CFG_CARRIER_EXTEND, 
+                      cp->regs + REG_MAC_RX_CFG);
+
+               writel(0x200, cp->regs + REG_MAC_SLOT_TIME);
+
+               cp->crc_size = 4;
+               /* minimum size gigabit frame at half duplex */
+               cp->min_frame_size = CAS_1000MB_MIN_FRAME;
+
+       } else {
+               writel(val, cp->regs + REG_MAC_TX_CFG);
+
+               /* checksum bug workaround. don't strip FCS when in 
+                * half-duplex mode
+                */
+               val = readl(cp->regs + REG_MAC_RX_CFG);
+               if (full_duplex) {
+                       val |= MAC_RX_CFG_STRIP_FCS;
+                       cp->crc_size = 0;
+                       cp->min_frame_size = CAS_MIN_MTU;
+               } else {
+                       val &= ~MAC_RX_CFG_STRIP_FCS;
+                       cp->crc_size = 4;
+                       cp->min_frame_size = CAS_MIN_FRAME;
+               }
+               writel(val & ~MAC_RX_CFG_CARRIER_EXTEND, 
+                      cp->regs + REG_MAC_RX_CFG);
+               writel(0x40, cp->regs + REG_MAC_SLOT_TIME);
+       }
+
+       if (netif_msg_link(cp)) {
+               if (pause & 0x01) {
+                       printk(KERN_INFO "%s: Pause is enabled "
+                              "(rxfifo: %d off: %d on: %d)\n",
+                              cp->dev->name,
+                              cp->rx_fifo_size,
+                              cp->rx_pause_off,
+                              cp->rx_pause_on);
+               } else if (pause & 0x10) {
+                       printk(KERN_INFO "%s: TX pause enabled\n",
+                              cp->dev->name);
+               } else {
+                       printk(KERN_INFO "%s: Pause is disabled\n",
+                              cp->dev->name);
+               }
+       }
+
+       val = readl(cp->regs + REG_MAC_CTRL_CFG);
+       val &= ~(MAC_CTRL_CFG_SEND_PAUSE_EN | MAC_CTRL_CFG_RECV_PAUSE_EN);
+       if (pause) { /* symmetric or asymmetric pause */
+               val |= MAC_CTRL_CFG_SEND_PAUSE_EN;
+               if (pause & 0x01) { /* symmetric pause */
+                       val |= MAC_CTRL_CFG_RECV_PAUSE_EN;
+               } 
+       }
+       writel(val, cp->regs + REG_MAC_CTRL_CFG);
+       cas_start_dma(cp);
+}
+
+/* Must be invoked under cp->lock. */
+static void cas_init_hw(struct cas *cp, int restart_link)
+{
+       if (restart_link)
+               cas_phy_init(cp);
+
+       cas_init_pause_thresholds(cp);
+       cas_init_mac(cp);
+       cas_init_dma(cp);
+
+       if (restart_link) {
+               /* Default aneg parameters */
+               cp->timer_ticks = 0;
+               cas_begin_auto_negotiation(cp, NULL);
+       } else if (cp->lstate == link_up) {
+               cas_set_link_modes(cp);
+               netif_carrier_on(cp->dev);
+       }
+}
+
+/* Must be invoked under cp->lock. on earlier cassini boards,
+ * SOFT_0 is tied to PCI reset. we use this to force a pci reset,
+ * let it settle out, and then restore pci state.
+ */
+static void cas_hard_reset(struct cas *cp)
+{
+       writel(BIM_LOCAL_DEV_SOFT_0, cp->regs + REG_BIM_LOCAL_DEV_EN); 
+       udelay(20);
+       pci_restore_state(cp->pdev);
+}
+
+
+static void cas_global_reset(struct cas *cp, int blkflag)
+{
+       int limit;
+
+       /* issue a global reset. don't use RSTOUT. */
+       if (blkflag && !CAS_PHY_MII(cp->phy_type)) {
+               /* For PCS, when the blkflag is set, we should set the
+                * SW_REST_BLOCK_PCS_SLINK bit to prevent the results of
+                * the last autonegotiation from being cleared.  We'll
+                * need some special handling if the chip is set into a
+                * loopback mode.
+                */
+               writel((SW_RESET_TX | SW_RESET_RX | SW_RESET_BLOCK_PCS_SLINK), 
+                      cp->regs + REG_SW_RESET);
+       } else {
+               writel(SW_RESET_TX | SW_RESET_RX, cp->regs + REG_SW_RESET);
+       }
+
+       /* need to wait at least 3ms before polling register */
+       mdelay(3);
+
+       limit = STOP_TRIES;
+       while (limit-- > 0) {
+               u32 val = readl(cp->regs + REG_SW_RESET);
+               if ((val & (SW_RESET_TX | SW_RESET_RX)) == 0)
+                       goto done;
+               udelay(10);
+       }
+       printk(KERN_ERR "%s: sw reset failed.\n", cp->dev->name);
+
+done:
+       /* enable various BIM interrupts */
+       writel(BIM_CFG_DPAR_INTR_ENABLE | BIM_CFG_RMA_INTR_ENABLE | 
+              BIM_CFG_RTA_INTR_ENABLE, cp->regs + REG_BIM_CFG);
+
+       /* clear out pci error status mask for handled errors.
+        * we don't deal with DMA counter overflows as they happen
+        * all the time.
+        */
+       writel(0xFFFFFFFFU & ~(PCI_ERR_BADACK | PCI_ERR_DTRTO | 
+                              PCI_ERR_OTHER | PCI_ERR_BIM_DMA_WRITE | 
+                              PCI_ERR_BIM_DMA_READ), cp->regs + 
+              REG_PCI_ERR_STATUS_MASK);
+
+       /* set up for MII by default to address mac rx reset timeout
+        * issue
+        */
+       writel(PCS_DATAPATH_MODE_MII, cp->regs + REG_PCS_DATAPATH_MODE);
+}
+
+static void cas_reset(struct cas *cp, int blkflag)
+{
+       u32 val;
+
+       cas_mask_intr(cp);
+       cas_global_reset(cp, blkflag);
+       cas_mac_reset(cp);
+       cas_entropy_reset(cp);
+
+       /* disable dma engines. */
+       val = readl(cp->regs + REG_TX_CFG);
+       val &= ~TX_CFG_DMA_EN;
+       writel(val, cp->regs + REG_TX_CFG);
+
+       val = readl(cp->regs + REG_RX_CFG);
+       val &= ~RX_CFG_DMA_EN;
+       writel(val, cp->regs + REG_RX_CFG);
+
+       /* program header parser */
+       if ((cp->cas_flags & CAS_FLAG_TARGET_ABORT) ||
+           (CAS_HP_ALT_FIRMWARE == cas_prog_null)) {
+               cas_load_firmware(cp, CAS_HP_FIRMWARE);
+       } else {
+               cas_load_firmware(cp, CAS_HP_ALT_FIRMWARE);
+       }
+
+       /* clear out error registers */
+       spin_lock(&cp->stat_lock[N_TX_RINGS]);
+       cas_clear_mac_err(cp);
+       spin_unlock(&cp->stat_lock[N_TX_RINGS]);
+}
+
+/* Shut down the chip, must be called with pm_sem held.  */
+static void cas_shutdown(struct cas *cp)
+{
+       unsigned long flags;
+
+       /* Make us not-running to avoid timers respawning */
+       cp->hw_running = 0;
+
+       del_timer_sync(&cp->link_timer);
+
+       /* Stop the reset task */
+#if 0
+       while (atomic_read(&cp->reset_task_pending_mtu) ||
+              atomic_read(&cp->reset_task_pending_spare) ||
+              atomic_read(&cp->reset_task_pending_all))
+               schedule();
+
+#else
+       while (atomic_read(&cp->reset_task_pending))
+               schedule();
+#endif 
+       /* Actually stop the chip */
+       cas_lock_all_save(cp, flags);
+       cas_reset(cp, 0);
+       if (cp->cas_flags & CAS_FLAG_SATURN)
+               cas_phy_powerdown(cp);
+       cas_unlock_all_restore(cp, flags);
+}
+
+static int cas_change_mtu(struct net_device *dev, int new_mtu)
+{
+       struct cas *cp = netdev_priv(dev);
+
+       if (new_mtu < CAS_MIN_MTU || new_mtu > CAS_MAX_MTU)
+               return -EINVAL;
+
+       dev->mtu = new_mtu;
+       if (!netif_running(dev) || !netif_device_present(dev))
+               return 0;
+
+       /* let the reset task handle it */
+#if 1
+       atomic_inc(&cp->reset_task_pending);
+       if ((cp->phy_type & CAS_PHY_SERDES)) {
+               atomic_inc(&cp->reset_task_pending_all);
+       } else {
+               atomic_inc(&cp->reset_task_pending_mtu);
+       }
+       schedule_work(&cp->reset_task);
+#else
+       atomic_set(&cp->reset_task_pending, (cp->phy_type & CAS_PHY_SERDES) ? 
+                  CAS_RESET_ALL : CAS_RESET_MTU);
+       printk(KERN_ERR "reset called in cas_change_mtu\n");
+       schedule_work(&cp->reset_task);
+#endif
+
+       flush_scheduled_work();
+       return 0;
+}
+
+static void cas_clean_txd(struct cas *cp, int ring)
+{
+       struct cas_tx_desc *txd = cp->init_txds[ring];
+       struct sk_buff *skb, **skbs = cp->tx_skbs[ring];
+       u64 daddr, dlen;
+       int i, size;
+
+       size = TX_DESC_RINGN_SIZE(ring);
+       for (i = 0; i < size; i++) {
+               int frag;
+
+               if (skbs[i] == NULL)
+                       continue;
+
+               skb = skbs[i];
+               skbs[i] = NULL;
+
+               for (frag = 0; frag <= skb_shinfo(skb)->nr_frags;  frag++) {
+                       int ent = i & (size - 1);
+
+                       /* first buffer is never a tiny buffer and so
+                        * needs to be unmapped.
+                        */
+                       daddr = le64_to_cpu(txd[ent].buffer);
+                       dlen  =  CAS_VAL(TX_DESC_BUFLEN, 
+                                        le64_to_cpu(txd[ent].control));
+                       pci_unmap_page(cp->pdev, daddr, dlen,
+                                      PCI_DMA_TODEVICE);
+
+                       if (frag != skb_shinfo(skb)->nr_frags) {
+                               i++;
+
+                               /* next buffer might by a tiny buffer.
+                                * skip past it.
+                                */
+                               ent = i & (size - 1);
+                               if (cp->tx_tiny_use[ring][ent].used)
+                                       i++;
+                       }
+               }
+               dev_kfree_skb_any(skb);
+       }
+
+       /* zero out tiny buf usage */
+       memset(cp->tx_tiny_use[ring], 0, size*sizeof(*cp->tx_tiny_use[ring]));
+}
+
+/* freed on close */
+static inline void cas_free_rx_desc(struct cas *cp, int ring)
+{
+       cas_page_t **page = cp->rx_pages[ring];
+       int i, size;
+
+       size = RX_DESC_RINGN_SIZE(ring);
+       for (i = 0; i < size; i++) {
+               if (page[i]) {
+                       cas_page_free(cp, page[i]);
+                       page[i] = NULL;
+               }
+       }
+}
+
+static void cas_free_rxds(struct cas *cp)
+{
+       int i;
+
+       for (i = 0; i < N_RX_DESC_RINGS; i++)
+               cas_free_rx_desc(cp, i);
+}
+
+/* Must be invoked under cp->lock. */
+static void cas_clean_rings(struct cas *cp)
+{
+       int i;
+
+       /* need to clean all tx rings */
+       memset(cp->tx_old, 0, sizeof(*cp->tx_old)*N_TX_RINGS);
+       memset(cp->tx_new, 0, sizeof(*cp->tx_new)*N_TX_RINGS);
+       for (i = 0; i < N_TX_RINGS; i++)
+               cas_clean_txd(cp, i);
+
+       /* zero out init block */
+       memset(cp->init_block, 0, sizeof(struct cas_init_block));
+       cas_clean_rxds(cp);
+       cas_clean_rxcs(cp);
+}
+
+/* allocated on open */
+static inline int cas_alloc_rx_desc(struct cas *cp, int ring)
+{
+       cas_page_t **page = cp->rx_pages[ring];
+       int size, i = 0;
+
+       size = RX_DESC_RINGN_SIZE(ring);
+       for (i = 0; i < size; i++) {
+               if ((page[i] = cas_page_alloc(cp, GFP_KERNEL)) == NULL) 
+                       return -1;
+       }
+       return 0;
+}
+
+static int cas_alloc_rxds(struct cas *cp)
+{
+       int i;
+
+       for (i = 0; i < N_RX_DESC_RINGS; i++) {
+               if (cas_alloc_rx_desc(cp, i) < 0) {
+                       cas_free_rxds(cp);
+                       return -1;
+               }
+       }
+       return 0;
+}
+
+static void cas_reset_task(void *data)
+{
+       struct cas *cp = (struct cas *) data;
+#if 0
+       int pending = atomic_read(&cp->reset_task_pending);
+#else
+       int pending_all = atomic_read(&cp->reset_task_pending_all);
+       int pending_spare = atomic_read(&cp->reset_task_pending_spare);
+       int pending_mtu = atomic_read(&cp->reset_task_pending_mtu);
+
+       if (pending_all == 0 && pending_spare == 0 && pending_mtu == 0) {
+               /* We can have more tasks scheduled than actually
+                * needed.
+                */
+               atomic_dec(&cp->reset_task_pending);
+               return;
+       }
+#endif
+       /* The link went down, we reset the ring, but keep
+        * DMA stopped. Use this function for reset
+        * on error as well.
+        */
+       if (cp->hw_running) {
+               unsigned long flags;
+
+               /* Make sure we don't get interrupts or tx packets */
+               netif_device_detach(cp->dev);
+               cas_lock_all_save(cp, flags);
+
+               if (cp->opened) {
+                       /* We call cas_spare_recover when we call cas_open.
+                        * but we do not initialize the lists cas_spare_recover
+                        * uses until cas_open is called.
+                        */
+                       cas_spare_recover(cp, GFP_ATOMIC);
+               }
+#if 1
+               /* test => only pending_spare set */
+               if (!pending_all && !pending_mtu)
+                       goto done;
+#else
+               if (pending == CAS_RESET_SPARE)
+                       goto done;
+#endif
+               /* when pending == CAS_RESET_ALL, the following
+                * call to cas_init_hw will restart auto negotiation.
+                * Setting the second argument of cas_reset to
+                * !(pending == CAS_RESET_ALL) will set this argument
+                * to 1 (avoiding reinitializing the PHY for the normal 
+                * PCS case) when auto negotiation is not restarted.
+                */
+#if 1
+               cas_reset(cp, !(pending_all > 0));
+               if (cp->opened)
+                       cas_clean_rings(cp);
+               cas_init_hw(cp, (pending_all > 0));
+#else
+               cas_reset(cp, !(pending == CAS_RESET_ALL));
+               if (cp->opened)
+                       cas_clean_rings(cp);
+               cas_init_hw(cp, pending == CAS_RESET_ALL);
+#endif
+
+done:
+               cas_unlock_all_restore(cp, flags);
+               netif_device_attach(cp->dev);
+       }
+#if 1
+       atomic_sub(pending_all, &cp->reset_task_pending_all);
+       atomic_sub(pending_spare, &cp->reset_task_pending_spare);
+       atomic_sub(pending_mtu, &cp->reset_task_pending_mtu);
+       atomic_dec(&cp->reset_task_pending);
+#else
+       atomic_set(&cp->reset_task_pending, 0);
+#endif
+}
+
+static void cas_link_timer(unsigned long data)
+{
+       struct cas *cp = (struct cas *) data;
+       int mask, pending = 0, reset = 0;
+       unsigned long flags;
+
+       if (link_transition_timeout != 0 &&
+           cp->link_transition_jiffies_valid &&
+           ((jiffies - cp->link_transition_jiffies) > 
+             (link_transition_timeout))) {
+               /* One-second counter so link-down workaround doesn't 
+                * cause resets to occur so fast as to fool the switch
+                * into thinking the link is down.
+                */
+               cp->link_transition_jiffies_valid = 0;
+       }
+
+       if (!cp->hw_running)
+               return;
+
+       spin_lock_irqsave(&cp->lock, flags);
+       cas_lock_tx(cp);
+       cas_entropy_gather(cp);
+
+       /* If the link task is still pending, we just
+        * reschedule the link timer
+        */
+#if 1
+       if (atomic_read(&cp->reset_task_pending_all) ||
+           atomic_read(&cp->reset_task_pending_spare) ||
+           atomic_read(&cp->reset_task_pending_mtu)) 
+               goto done;
+#else
+       if (atomic_read(&cp->reset_task_pending)) 
+               goto done;
+#endif
+
+       /* check for rx cleaning */
+       if ((mask = (cp->cas_flags & CAS_FLAG_RXD_POST_MASK))) {
+               int i, rmask;
+
+               for (i = 0; i < MAX_RX_DESC_RINGS; i++) {
+                       rmask = CAS_FLAG_RXD_POST(i);
+                       if ((mask & rmask) == 0)
+                               continue;
+
+                       /* post_rxds will do a mod_timer */
+                       if (cas_post_rxds_ringN(cp, i, cp->rx_last[i]) < 0) {
+                               pending = 1;
+                               continue;
+                       }
+                       cp->cas_flags &= ~rmask;
+               }
+       }
+
+       if (CAS_PHY_MII(cp->phy_type)) {
+               u16 bmsr;
+               cas_mif_poll(cp, 0);
+               bmsr = cas_phy_read(cp, MII_BMSR);
+               /* WTZ: Solaris driver reads this twice, but that
+                * may be due to the PCS case and the use of a
+                * common implementation. Read it twice here to be
+                * safe.
+                */
+               bmsr = cas_phy_read(cp, MII_BMSR);
+               cas_mif_poll(cp, 1);
+               readl(cp->regs + REG_MIF_STATUS); /* avoid dups */
+               reset = cas_mii_link_check(cp, bmsr);
+       } else {
+               reset = cas_pcs_link_check(cp);
+       }
+
+       if (reset)
+               goto done;
+
+       /* check for tx state machine confusion */
+       if ((readl(cp->regs + REG_MAC_TX_STATUS) & MAC_TX_FRAME_XMIT) == 0) {
+               u32 val = readl(cp->regs + REG_MAC_STATE_MACHINE);
+               u32 wptr, rptr;
+               int tlm  = CAS_VAL(MAC_SM_TLM, val);
+
+               if (((tlm == 0x5) || (tlm == 0x3)) &&
+                   (CAS_VAL(MAC_SM_ENCAP_SM, val) == 0)) {
+                       if (netif_msg_tx_err(cp))
+                               printk(KERN_DEBUG "%s: tx err: "
+                                      "MAC_STATE[%08x]\n",
+                                      cp->dev->name, val);
+                       reset = 1;
+                       goto done;
+               }
+
+               val  = readl(cp->regs + REG_TX_FIFO_PKT_CNT);
+               wptr = readl(cp->regs + REG_TX_FIFO_WRITE_PTR);
+               rptr = readl(cp->regs + REG_TX_FIFO_READ_PTR);
+               if ((val == 0) && (wptr != rptr)) {
+                       if (netif_msg_tx_err(cp))
+                               printk(KERN_DEBUG "%s: tx err: "
+                                      "TX_FIFO[%08x:%08x:%08x]\n",
+                                      cp->dev->name, val, wptr, rptr);
+                       reset = 1;
+               }
+
+               if (reset)
+                       cas_hard_reset(cp);
+       }
+
+done:
+       if (reset) {
+#if 1
+               atomic_inc(&cp->reset_task_pending);
+               atomic_inc(&cp->reset_task_pending_all);
+               schedule_work(&cp->reset_task);
+#else
+               atomic_set(&cp->reset_task_pending, CAS_RESET_ALL);
+               printk(KERN_ERR "reset called in cas_link_timer\n");
+               schedule_work(&cp->reset_task);
+#endif
+       }
+
+       if (!pending)
+               mod_timer(&cp->link_timer, jiffies + CAS_LINK_TIMEOUT);
+       cas_unlock_tx(cp);
+       spin_unlock_irqrestore(&cp->lock, flags);
+}
+
+/* tiny buffers are used to avoid target abort issues with 
+ * older cassini's
+ */
+static void cas_tx_tiny_free(struct cas *cp)
+{
+       struct pci_dev *pdev = cp->pdev;
+       int i;
+
+       for (i = 0; i < N_TX_RINGS; i++) {
+               if (!cp->tx_tiny_bufs[i])
+                       continue;
+
+               pci_free_consistent(pdev, TX_TINY_BUF_BLOCK, 
+                                   cp->tx_tiny_bufs[i],
+                                   cp->tx_tiny_dvma[i]);
+               cp->tx_tiny_bufs[i] = NULL;
+       }
+}
+
+static int cas_tx_tiny_alloc(struct cas *cp)
+{
+       struct pci_dev *pdev = cp->pdev;
+       int i;
+
+       for (i = 0; i < N_TX_RINGS; i++) {
+               cp->tx_tiny_bufs[i] = 
+                       pci_alloc_consistent(pdev, TX_TINY_BUF_BLOCK,
+                                            &cp->tx_tiny_dvma[i]);
+               if (!cp->tx_tiny_bufs[i]) {
+                       cas_tx_tiny_free(cp);
+                       return -1;
+               }
+       }
+       return 0;
+}
+
+
+static int cas_open(struct net_device *dev)
+{
+       struct cas *cp = netdev_priv(dev);
+       int hw_was_up, err;
+       unsigned long flags;
+
+       down(&cp->pm_sem);
+
+       hw_was_up = cp->hw_running;
+
+       /* The power-management semaphore protects the hw_running
+        * etc. state so it is safe to do this bit without cp->lock
+        */
+       if (!cp->hw_running) {
+               /* Reset the chip */
+               cas_lock_all_save(cp, flags);
+               /* We set the second arg to cas_reset to zero
+                * because cas_init_hw below will have its second 
+                * argument set to non-zero, which will force
+                * autonegotiation to start.
+                */
+               cas_reset(cp, 0);
+               cp->hw_running = 1;
+               cas_unlock_all_restore(cp, flags);
+       }
+
+       if (cas_tx_tiny_alloc(cp) < 0)
+               return -ENOMEM;
+
+       /* alloc rx descriptors */
+       err = -ENOMEM;
+       if (cas_alloc_rxds(cp) < 0)
+               goto err_tx_tiny;
+       
+       /* allocate spares */
+       cas_spare_init(cp);
+       cas_spare_recover(cp, GFP_KERNEL);
+
+       /* We can now request the interrupt as we know it's masked
+        * on the controller. cassini+ has up to 4 interrupts
+        * that can be used, but you need to do explicit pci interrupt 
+        * mapping to expose them
+        */
+       if (request_irq(cp->pdev->irq, cas_interrupt,
+                       SA_SHIRQ, dev->name, (void *) dev)) {
+               printk(KERN_ERR "%s: failed to request irq !\n", 
+                      cp->dev->name);
+               err = -EAGAIN;
+               goto err_spare;
+       }
+
+       /* init hw */
+       cas_lock_all_save(cp, flags);
+       cas_clean_rings(cp);
+       cas_init_hw(cp, !hw_was_up);
+       cp->opened = 1;
+       cas_unlock_all_restore(cp, flags);
+
+       netif_start_queue(dev);
+       up(&cp->pm_sem);
+       return 0;
+
+err_spare:
+       cas_spare_free(cp);
+       cas_free_rxds(cp);
+err_tx_tiny:
+       cas_tx_tiny_free(cp);
+       up(&cp->pm_sem);
+       return err;
+}
+
+static int cas_close(struct net_device *dev)
+{
+       unsigned long flags;
+       struct cas *cp = netdev_priv(dev);
+
+       /* Make sure we don't get distracted by suspend/resume */
+       down(&cp->pm_sem);
+
+       netif_stop_queue(dev);
+
+       /* Stop traffic, mark us closed */
+       cas_lock_all_save(cp, flags);
+       cp->opened = 0; 
+       cas_reset(cp, 0);
+       cas_phy_init(cp); 
+       cas_begin_auto_negotiation(cp, NULL);
+       cas_clean_rings(cp);
+       cas_unlock_all_restore(cp, flags);
+
+       free_irq(cp->pdev->irq, (void *) dev);
+       cas_spare_free(cp);
+       cas_free_rxds(cp);
+       cas_tx_tiny_free(cp);
+       up(&cp->pm_sem);
+       return 0;
+}
+
+static struct {
+       const char name[ETH_GSTRING_LEN];
+} ethtool_cassini_statnames[] = {
+       {"collisions"},
+       {"rx_bytes"},
+       {"rx_crc_errors"},
+       {"rx_dropped"},
+       {"rx_errors"},
+       {"rx_fifo_errors"},
+       {"rx_frame_errors"},
+       {"rx_length_errors"},
+       {"rx_over_errors"},
+       {"rx_packets"},
+       {"tx_aborted_errors"},
+       {"tx_bytes"},
+       {"tx_dropped"},
+       {"tx_errors"},
+       {"tx_fifo_errors"},
+       {"tx_packets"}
+};
+#define CAS_NUM_STAT_KEYS (sizeof(ethtool_cassini_statnames)/ETH_GSTRING_LEN)
+
+static struct {
+       const int offsets;      /* neg. values for 2nd arg to cas_read_phy */
+} ethtool_register_table[] = {
+       {-MII_BMSR},
+       {-MII_BMCR},
+       {REG_CAWR},
+       {REG_INF_BURST},
+       {REG_BIM_CFG},
+       {REG_RX_CFG},
+       {REG_HP_CFG},
+       {REG_MAC_TX_CFG},
+       {REG_MAC_RX_CFG},
+       {REG_MAC_CTRL_CFG},
+       {REG_MAC_XIF_CFG},
+       {REG_MIF_CFG},
+       {REG_PCS_CFG},
+       {REG_SATURN_PCFG},
+       {REG_PCS_MII_STATUS},
+       {REG_PCS_STATE_MACHINE},
+       {REG_MAC_COLL_EXCESS},
+       {REG_MAC_COLL_LATE}
+};
+#define CAS_REG_LEN    (sizeof(ethtool_register_table)/sizeof(int))
+#define CAS_MAX_REGS   (sizeof (u32)*CAS_REG_LEN)
+
+static u8 *cas_get_regs(struct cas *cp)
+{
+       u8 *ptr = kmalloc(CAS_MAX_REGS, GFP_KERNEL);
+       u8 *p;
+       int i;
+       unsigned long flags;
+
+       if (!ptr)
+               return NULL;
+
+       spin_lock_irqsave(&cp->lock, flags);
+       for (i = 0, p = ptr; i < CAS_REG_LEN ; i ++, p += sizeof(u32)) {
+               u16 hval;
+               u32 val;
+               if (ethtool_register_table[i].offsets < 0) {
+                       hval = cas_phy_read(cp,
+                                   -ethtool_register_table[i].offsets);
+                       val = hval;
+               } else {
+                       val= readl(cp->regs+ethtool_register_table[i].offsets);
+               }
+               memcpy(p, (u8 *)&val, sizeof(u32));
+       }
+       spin_unlock_irqrestore(&cp->lock, flags);
+
+       return ptr;
+}
+
+static struct net_device_stats *cas_get_stats(struct net_device *dev)
+{
+       struct cas *cp = netdev_priv(dev);
+       struct net_device_stats *stats = cp->net_stats;
+       unsigned long flags;
+       int i;
+       unsigned long tmp;
+
+       /* we collate all of the stats into net_stats[N_TX_RING] */
+       if (!cp->hw_running)
+               return stats + N_TX_RINGS;
+       
+       /* collect outstanding stats */
+       /* WTZ: the Cassini spec gives these as 16 bit counters but
+        * stored in 32-bit words.  Added a mask of 0xffff to be safe,
+        * in case the chip somehow puts any garbage in the other bits.
+        * Also, counter usage didn't seem to mach what Adrian did
+        * in the parts of the code that set these quantities. Made
+        * that consistent.
+        */
+       spin_lock_irqsave(&cp->stat_lock[N_TX_RINGS], flags);
+       stats[N_TX_RINGS].rx_crc_errors += 
+         readl(cp->regs + REG_MAC_FCS_ERR) & 0xffff;
+       stats[N_TX_RINGS].rx_frame_errors += 
+               readl(cp->regs + REG_MAC_ALIGN_ERR) &0xffff;
+       stats[N_TX_RINGS].rx_length_errors += 
+               readl(cp->regs + REG_MAC_LEN_ERR) & 0xffff;
+#if 1
+       tmp = (readl(cp->regs + REG_MAC_COLL_EXCESS) & 0xffff) +
+               (readl(cp->regs + REG_MAC_COLL_LATE) & 0xffff);
+       stats[N_TX_RINGS].tx_aborted_errors += tmp;
+       stats[N_TX_RINGS].collisions +=
+         tmp + (readl(cp->regs + REG_MAC_COLL_NORMAL) & 0xffff);
+#else
+       stats[N_TX_RINGS].tx_aborted_errors += 
+               readl(cp->regs + REG_MAC_COLL_EXCESS);
+       stats[N_TX_RINGS].collisions += readl(cp->regs + REG_MAC_COLL_EXCESS) +
+               readl(cp->regs + REG_MAC_COLL_LATE);
+#endif
+       cas_clear_mac_err(cp);
+
+       /* saved bits that are unique to ring 0 */
+       spin_lock(&cp->stat_lock[0]);
+       stats[N_TX_RINGS].collisions        += stats[0].collisions;
+       stats[N_TX_RINGS].rx_over_errors    += stats[0].rx_over_errors;
+       stats[N_TX_RINGS].rx_frame_errors   += stats[0].rx_frame_errors;
+       stats[N_TX_RINGS].rx_fifo_errors    += stats[0].rx_fifo_errors;
+       stats[N_TX_RINGS].tx_aborted_errors += stats[0].tx_aborted_errors;
+       stats[N_TX_RINGS].tx_fifo_errors    += stats[0].tx_fifo_errors;
+       spin_unlock(&cp->stat_lock[0]);
+
+       for (i = 0; i < N_TX_RINGS; i++) {
+               spin_lock(&cp->stat_lock[i]);
+               stats[N_TX_RINGS].rx_length_errors += 
+                       stats[i].rx_length_errors;
+               stats[N_TX_RINGS].rx_crc_errors += stats[i].rx_crc_errors;
+               stats[N_TX_RINGS].rx_packets    += stats[i].rx_packets;
+               stats[N_TX_RINGS].tx_packets    += stats[i].tx_packets;
+               stats[N_TX_RINGS].rx_bytes      += stats[i].rx_bytes;
+               stats[N_TX_RINGS].tx_bytes      += stats[i].tx_bytes;
+               stats[N_TX_RINGS].rx_errors     += stats[i].rx_errors;
+               stats[N_TX_RINGS].tx_errors     += stats[i].tx_errors;
+               stats[N_TX_RINGS].rx_dropped    += stats[i].rx_dropped;
+               stats[N_TX_RINGS].tx_dropped    += stats[i].tx_dropped;
+               memset(stats + i, 0, sizeof(struct net_device_stats));
+               spin_unlock(&cp->stat_lock[i]);
+       }
+       spin_unlock_irqrestore(&cp->stat_lock[N_TX_RINGS], flags);
+       return stats + N_TX_RINGS;
+}
+
+
+static void cas_set_multicast(struct net_device *dev)
+{
+       struct cas *cp = netdev_priv(dev);
+       u32 rxcfg, rxcfg_new;
+       unsigned long flags;
+       int limit = STOP_TRIES;
+       
+       if (!cp->hw_running)
+               return;
+               
+       spin_lock_irqsave(&cp->lock, flags);
+       rxcfg = readl(cp->regs + REG_MAC_RX_CFG);
+
+       /* disable RX MAC and wait for completion */
+       writel(rxcfg & ~MAC_RX_CFG_EN, cp->regs + REG_MAC_RX_CFG);
+       while (readl(cp->regs + REG_MAC_RX_CFG) & MAC_RX_CFG_EN) {
+               if (!limit--)
+                       break;
+               udelay(10);
+       }
+
+       /* disable hash filter and wait for completion */
+       limit = STOP_TRIES;
+       rxcfg &= ~(MAC_RX_CFG_PROMISC_EN | MAC_RX_CFG_HASH_FILTER_EN);
+       writel(rxcfg & ~MAC_RX_CFG_EN, cp->regs + REG_MAC_RX_CFG);
+       while (readl(cp->regs + REG_MAC_RX_CFG) & MAC_RX_CFG_HASH_FILTER_EN) {
+               if (!limit--)
+                       break;
+               udelay(10);
+       }
+
+       /* program hash filters */
+       cp->mac_rx_cfg = rxcfg_new = cas_setup_multicast(cp);
+       rxcfg |= rxcfg_new;
+       writel(rxcfg, cp->regs + REG_MAC_RX_CFG);
+       spin_unlock_irqrestore(&cp->lock, flags);
+}
+
+/* Eventually add support for changing the advertisement
+ * on autoneg.
+ */
+static int cas_ethtool_ioctl(struct net_device *dev, void *ep_user)
+{
+       struct cas *cp = netdev_priv(dev);
+       u16 bmcr;
+       int full_duplex, speed, pause;
+       struct ethtool_cmd ecmd;
+       unsigned long flags;
+       enum link_state linkstate = link_up;
+
+       if (copy_from_user(&ecmd, ep_user, sizeof(ecmd)))
+               return -EFAULT;
+               
+       switch(ecmd.cmd) {
+        case ETHTOOL_GDRVINFO: {
+               struct ethtool_drvinfo info = { cmd: ETHTOOL_GDRVINFO };
+
+               strncpy(info.driver, DRV_MODULE_NAME,
+                       ETHTOOL_BUSINFO_LEN);
+               strncpy(info.version, DRV_MODULE_VERSION,
+                       ETHTOOL_BUSINFO_LEN);
+               info.fw_version[0] = '\0';
+               strncpy(info.bus_info, pci_name(cp->pdev),
+                       ETHTOOL_BUSINFO_LEN);
+               info.regdump_len = cp->casreg_len < CAS_MAX_REGS ?
+                       cp->casreg_len : CAS_MAX_REGS;
+               info.n_stats = CAS_NUM_STAT_KEYS;
+               if (copy_to_user(ep_user, &info, sizeof(info)))
+                       return -EFAULT;
+
+               return 0;
+       }
+
+       case ETHTOOL_GSET:
+               ecmd.advertising = 0;
+               ecmd.supported = SUPPORTED_Autoneg;
+               if (cp->cas_flags & CAS_FLAG_1000MB_CAP) {
+                       ecmd.supported |= SUPPORTED_1000baseT_Full;
+                       ecmd.advertising |= ADVERTISED_1000baseT_Full;
+               }
+
+               /* Record PHY settings if HW is on. */
+               spin_lock_irqsave(&cp->lock, flags);
+               bmcr = 0;
+               linkstate = cp->lstate;
+               if (CAS_PHY_MII(cp->phy_type)) {
+                       ecmd.port = PORT_MII;
+                       ecmd.transceiver = (cp->cas_flags & CAS_FLAG_SATURN) ?
+                               XCVR_INTERNAL : XCVR_EXTERNAL;
+                       ecmd.phy_address = cp->phy_addr;
+                       ecmd.advertising |= ADVERTISED_TP | ADVERTISED_MII |
+                               ADVERTISED_10baseT_Half | 
+                               ADVERTISED_10baseT_Full | 
+                               ADVERTISED_100baseT_Half | 
+                               ADVERTISED_100baseT_Full;
+
+                       ecmd.supported |=
+                               (SUPPORTED_10baseT_Half | 
+                                SUPPORTED_10baseT_Full |
+                                SUPPORTED_100baseT_Half | 
+                                SUPPORTED_100baseT_Full |
+                                SUPPORTED_TP | SUPPORTED_MII);
+
+                       if (cp->hw_running) {
+                               cas_mif_poll(cp, 0);
+                               bmcr = cas_phy_read(cp, MII_BMCR);
+                               cas_read_mii_link_mode(cp, &full_duplex, 
+                                                      &speed, &pause);
+                               cas_mif_poll(cp, 1);
+                       }
+
+               } else {
+                       ecmd.port = PORT_FIBRE;
+                       ecmd.transceiver = XCVR_INTERNAL;
+                       ecmd.phy_address = 0;
+                       ecmd.supported   |= SUPPORTED_FIBRE;
+                       ecmd.advertising |= ADVERTISED_FIBRE;
+
+                       if (cp->hw_running) {
+                               /* pcs uses the same bits as mii */ 
+                               bmcr = readl(cp->regs + REG_PCS_MII_CTRL);
+                               cas_read_pcs_link_mode(cp, &full_duplex, 
+                                                      &speed, &pause);
+                       }
+               }
+               spin_unlock_irqrestore(&cp->lock, flags);
+
+               if (bmcr & BMCR_ANENABLE) {
+                       ecmd.advertising |= ADVERTISED_Autoneg;
+                       ecmd.autoneg = AUTONEG_ENABLE;
+                       ecmd.speed = ((speed == 10) ?
+                                     SPEED_10 :
+                                     ((speed == 1000) ?
+                                      SPEED_1000 : SPEED_100));
+                       ecmd.duplex = full_duplex ? DUPLEX_FULL : DUPLEX_HALF;
+               } else {
+                       ecmd.autoneg = AUTONEG_DISABLE;
+                       ecmd.speed =
+                               (bmcr & CAS_BMCR_SPEED1000) ?
+                               SPEED_1000 : 
+                               ((bmcr & BMCR_SPEED100) ? SPEED_100: 
+                                SPEED_10);
+                       ecmd.duplex =
+                               (bmcr & BMCR_FULLDPLX) ?
+                               DUPLEX_FULL : DUPLEX_HALF;
+               }
+               if (linkstate != link_up) {
+                       /* Force these to "unknown" if the link is not up and
+                        * autonogotiation in enabled. We can set the link 
+                        * speed to 0, but not ecmd.duplex,
+                        * because its legal values are 0 and 1.  Ethtool will
+                        * print the value reported in parentheses after the
+                        * word "Unknown" for unrecognized values.
+                        *
+                        * If in forced mode, we report the speed and duplex
+                        * settings that we configured.
+                        */
+                       if (cp->link_cntl & BMCR_ANENABLE) {
+                               ecmd.speed = 0;
+                               ecmd.duplex = 0xff;
+                       } else {
+                               ecmd.speed = SPEED_10;
+                               if (cp->link_cntl & BMCR_SPEED100) {
+                                       ecmd.speed = SPEED_100;
+                               } else if (cp->link_cntl & CAS_BMCR_SPEED1000) {
+                                       ecmd.speed = SPEED_1000;
+                               }
+                               ecmd.duplex = (cp->link_cntl & BMCR_FULLDPLX)?
+                                       DUPLEX_FULL : DUPLEX_HALF;
+                       }
+               }
+               if (copy_to_user(ep_user, &ecmd, sizeof(ecmd)))
+                       return -EFAULT;
+               return 0;
+
+       case ETHTOOL_SSET:
+               if (!capable(CAP_NET_ADMIN))
+                       return -EPERM;
+
+               /* Verify the settings we care about. */
+               if (ecmd.autoneg != AUTONEG_ENABLE &&
+                   ecmd.autoneg != AUTONEG_DISABLE)
+                       return -EINVAL;
+
+               if (ecmd.autoneg == AUTONEG_DISABLE &&
+                   ((ecmd.speed != SPEED_1000 &&
+                     ecmd.speed != SPEED_100 &&
+                     ecmd.speed != SPEED_10) ||
+                    (ecmd.duplex != DUPLEX_HALF &&
+                     ecmd.duplex != DUPLEX_FULL)))
+                       return -EINVAL;
+
+               /* Apply settings and restart link process. */
+               spin_lock_irqsave(&cp->lock, flags);
+               cas_begin_auto_negotiation(cp, &ecmd);
+               spin_unlock_irqrestore(&cp->lock, flags);
+               return 0;
+
+       case ETHTOOL_NWAY_RST:
+               if ((cp->link_cntl & BMCR_ANENABLE) == 0)
+                       return -EINVAL;
+
+               /* Restart link process. */
+               spin_lock_irqsave(&cp->lock, flags);
+               cas_begin_auto_negotiation(cp, NULL);
+               spin_unlock_irqrestore(&cp->lock, flags);
+
+               return 0;
+
+       case ETHTOOL_GWOL:
+       case ETHTOOL_SWOL:
+               break; /* doesn't exist */
+
+       /* get link status */
+       case ETHTOOL_GLINK: {
+               struct ethtool_value edata = { cmd: ETHTOOL_GLINK };
+
+               edata.data = (cp->lstate == link_up);
+               if (copy_to_user(ep_user, &edata, sizeof(edata)))
+                       return -EFAULT;
+               return 0;
+       }
+
+       /* get message-level */
+       case ETHTOOL_GMSGLVL: {
+               struct ethtool_value edata = { cmd: ETHTOOL_GMSGLVL };
+
+               edata.data = cp->msg_enable;
+               if (copy_to_user(ep_user, &edata, sizeof(edata)))
+                       return -EFAULT;
+               return 0;
+       }
+
+       /* set message-level */
+       case ETHTOOL_SMSGLVL: {
+               struct ethtool_value edata;
+
+               if (!capable(CAP_NET_ADMIN)) {
+                       return (-EPERM);
+               }
+               if (copy_from_user(&edata, ep_user, sizeof(edata)))
+                       return -EFAULT;
+               cp->msg_enable = edata.data;
+               return 0;
+       }
+
+       case ETHTOOL_GREGS: {
+               struct ethtool_regs edata;
+               u8 *ptr;
+               int len = cp->casreg_len < CAS_MAX_REGS ?
+                       cp->casreg_len: CAS_MAX_REGS;
+
+               if (copy_from_user(&edata, ep_user, sizeof (edata)))
+                       return -EFAULT;
+
+               if (edata.len > len)
+                       edata.len = len;
+               edata.version = 0;
+               if (copy_to_user (ep_user, &edata, sizeof(edata)))
+                       return -EFAULT;
+
+               /* cas_get_regs handles locks (cp->lock).  */
+               ptr = cas_get_regs(cp);
+               if (ptr == NULL)
+                       return -ENOMEM;
+               if (copy_to_user(ep_user + sizeof (edata), ptr, edata.len))
+                       return -EFAULT;
+
+               kfree(ptr);
+               return (0);
+       }
+       case ETHTOOL_GSTRINGS: {
+               struct ethtool_gstrings edata;
+               int len;
+
+               if (copy_from_user(&edata, ep_user, sizeof(edata)))
+                       return -EFAULT;
+
+               len = edata.len;
+               switch(edata.string_set) {
+               case ETH_SS_STATS:
+                       edata.len = (len < CAS_NUM_STAT_KEYS) ?
+                               len : CAS_NUM_STAT_KEYS;
+                       if (copy_to_user(ep_user, &edata, sizeof(edata)))
+                               return -EFAULT;
+
+                       if (copy_to_user(ep_user + sizeof(edata),
+                                        &ethtool_cassini_statnames, 
+                                        (edata.len * ETH_GSTRING_LEN)))
+                               return -EFAULT;
+                       return 0;
+               default:
+                       return -EINVAL;
+               }
+       }
+       case ETHTOOL_GSTATS: {
+               int i = 0;
+               u64 *tmp;
+               struct ethtool_stats edata;
+               struct net_device_stats *stats;
+               int len;
+
+               if (copy_from_user(&edata, ep_user, sizeof(edata)))
+                       return -EFAULT;
+
+               len = edata.n_stats;
+               stats = cas_get_stats(cp->dev);
+               edata.cmd = ETHTOOL_GSTATS;
+               edata.n_stats = (len < CAS_NUM_STAT_KEYS) ?
+                       len : CAS_NUM_STAT_KEYS;
+               if (copy_to_user(ep_user, &edata, sizeof (edata)))
+                       return -EFAULT;
+
+               tmp = kmalloc(sizeof(u64)*CAS_NUM_STAT_KEYS, GFP_KERNEL);
+               if (tmp) {
+                       tmp[i++] = stats->collisions;
+                       tmp[i++] = stats->rx_bytes;
+                       tmp[i++] = stats->rx_crc_errors;
+                       tmp[i++] = stats->rx_dropped;
+                       tmp[i++] = stats->rx_errors;
+                       tmp[i++] = stats->rx_fifo_errors;
+                       tmp[i++] = stats->rx_frame_errors;
+                       tmp[i++] = stats->rx_length_errors;
+                       tmp[i++] = stats->rx_over_errors;
+                       tmp[i++] = stats->rx_packets;
+                       tmp[i++] = stats->tx_aborted_errors;
+                       tmp[i++] = stats->tx_bytes;
+                       tmp[i++] = stats->tx_dropped;
+                       tmp[i++] = stats->tx_errors;
+                       tmp[i++] = stats->tx_fifo_errors;
+                       tmp[i++] = stats->tx_packets;
+                       BUG_ON(i != CAS_NUM_STAT_KEYS);
+
+                       i = copy_to_user(ep_user + sizeof(edata),
+                                        tmp, sizeof(u64)*edata.n_stats);
+                       kfree(tmp);
+               } else {
+                       return -ENOMEM;
+               }
+               if (i)
+                       return -EFAULT;
+               return 0;
+       }
+       }
+
+       return -EOPNOTSUPP;
+}
+
+static int cas_ioctl(struct net_device *dev, struct ifreq *ifr, int cmd)
+{
+       struct cas *cp = netdev_priv(dev);
+       struct mii_ioctl_data *data = (struct mii_ioctl_data *)&ifr->ifr_data;
+       unsigned long flags;
+       int rc = -EOPNOTSUPP;
+       
+       /* Hold the PM semaphore while doing ioctl's or we may collide
+        * with open/close and power management and oops.
+        */
+       down(&cp->pm_sem);
+       switch (cmd) {
+       case SIOCETHTOOL:
+               rc = cas_ethtool_ioctl(dev, ifr->ifr_data);
+               break;
+
+       case SIOCGMIIPHY:               /* Get address of MII PHY in use. */
+               data->phy_id = cp->phy_addr;
+               /* Fallthrough... */
+
+       case SIOCGMIIREG:               /* Read MII PHY register. */
+               spin_lock_irqsave(&cp->lock, flags);
+               cas_mif_poll(cp, 0);
+               data->val_out = cas_phy_read(cp, data->reg_num & 0x1f);
+               cas_mif_poll(cp, 1);
+               spin_unlock_irqrestore(&cp->lock, flags);
+               rc = 0;
+               break;
+
+       case SIOCSMIIREG:               /* Write MII PHY register. */
+               if (!capable(CAP_NET_ADMIN)) {
+                       rc = -EPERM;
+                       break;
+               }
+               spin_lock_irqsave(&cp->lock, flags);
+               cas_mif_poll(cp, 0);
+               rc = cas_phy_write(cp, data->reg_num & 0x1f, data->val_in);
+               cas_mif_poll(cp, 1);
+               spin_unlock_irqrestore(&cp->lock, flags);
+               break;
+       default:
+               break;
+       };
+
+       up(&cp->pm_sem);
+       return rc;
+}
+
+static int __devinit cas_init_one(struct pci_dev *pdev,
+                                 const struct pci_device_id *ent)
+{
+       static int cas_version_printed = 0;
+       unsigned long casreg_base, casreg_len;
+       struct net_device *dev;
+       struct cas *cp;
+       int i, err, pci_using_dac;
+       u16 pci_cmd;
+       u8 orig_cacheline_size = 0, cas_cacheline_size = 0;
+
+       if (cas_version_printed++ == 0)
+               printk(KERN_INFO "%s", version);
+
+       err = pci_enable_device(pdev);
+       if (err) {
+               printk(KERN_ERR PFX "Cannot enable PCI device, "
+                      "aborting.\n");
+               return err;
+       }
+
+       if (!(pci_resource_flags(pdev, 0) & IORESOURCE_MEM)) {
+               printk(KERN_ERR PFX "Cannot find proper PCI device "
+                      "base address, aborting.\n");
+               err = -ENODEV;
+               goto err_out_disable_pdev;
+       }
+
+       dev = alloc_etherdev(sizeof(*cp));
+       if (!dev) {
+               printk(KERN_ERR PFX "Etherdev alloc failed, aborting.\n");
+               err = -ENOMEM;
+               goto err_out_disable_pdev;
+       }
+       SET_MODULE_OWNER(dev);
+       SET_NETDEV_DEV(dev, &pdev->dev);
+
+       err = pci_request_regions(pdev, dev->name);
+       if (err) {
+               printk(KERN_ERR PFX "Cannot obtain PCI resources, "
+                      "aborting.\n");
+               goto err_out_free_netdev;
+       }
+       pci_set_master(pdev);
+
+       /* we must always turn on parity response or else parity
+        * doesn't get generated properly. disable SERR/PERR as well.
+        * in addition, we want to turn MWI on.
+        */
+       pci_read_config_word(pdev, PCI_COMMAND, &pci_cmd);
+       pci_cmd &= ~PCI_COMMAND_SERR;
+       pci_cmd |= PCI_COMMAND_PARITY;
+       pci_write_config_word(pdev, PCI_COMMAND, pci_cmd);
+       pci_set_mwi(pdev);
+       /*
+        * On some architectures, the default cache line size set
+        * by pci_set_mwi reduces perforamnce.  We have to increase
+        * it for this case.  To start, we'll print some configuration
+        * data.
+        */
+#if 1
+       pci_read_config_byte(pdev, PCI_CACHE_LINE_SIZE,
+                            &orig_cacheline_size);
+       if (orig_cacheline_size < CAS_PREF_CACHELINE_SIZE) {
+               cas_cacheline_size = 
+                       (CAS_PREF_CACHELINE_SIZE < SMP_CACHE_BYTES) ? 
+                       CAS_PREF_CACHELINE_SIZE : SMP_CACHE_BYTES;
+               if (pci_write_config_byte(pdev, 
+                                         PCI_CACHE_LINE_SIZE, 
+                                         cas_cacheline_size)) {
+                       printk(KERN_ERR PFX "Could not set PCI cache "
+                              "line size\n");
+                       goto err_write_cacheline;
+               }
+       }
+#endif
+
+
+       /* Configure DMA attributes. */
+       if (!pci_set_dma_mask(pdev, DMA_64BIT_MASK)) {
+               pci_using_dac = 1;
+               err = pci_set_consistent_dma_mask(pdev,
+                                                 DMA_64BIT_MASK);
+               if (err < 0) {
+                       printk(KERN_ERR PFX "Unable to obtain 64-bit DMA "
+                              "for consistent allocations\n");
+                       goto err_out_free_res;
+               }
+
+       } else {
+               err = pci_set_dma_mask(pdev, DMA_32BIT_MASK);
+               if (err) {
+                       printk(KERN_ERR PFX "No usable DMA configuration, "
+                              "aborting.\n");
+                       goto err_out_free_res;
+               }
+               pci_using_dac = 0;
+       }
+
+       casreg_base = pci_resource_start(pdev, 0);
+       casreg_len = pci_resource_len(pdev, 0);
+
+       cp = netdev_priv(dev);
+       cp->pdev = pdev;
+#if 1
+       /* A value of 0 indicates we never explicitly set it */
+       cp->orig_cacheline_size = cas_cacheline_size ? orig_cacheline_size: 0;
+#endif
+       cp->dev = dev;
+       cp->msg_enable = (cassini_debug < 0) ? CAS_DEF_MSG_ENABLE : 
+         cassini_debug;
+
+       cp->link_transition = LINK_TRANSITION_UNKNOWN;
+       cp->link_transition_jiffies_valid = 0;
+
+       spin_lock_init(&cp->lock);
+       spin_lock_init(&cp->rx_inuse_lock);
+       spin_lock_init(&cp->rx_spare_lock);
+       for (i = 0; i < N_TX_RINGS; i++) {
+               spin_lock_init(&cp->stat_lock[i]);
+               spin_lock_init(&cp->tx_lock[i]);
+       }
+       spin_lock_init(&cp->stat_lock[N_TX_RINGS]);
+       init_MUTEX(&cp->pm_sem);
+
+       init_timer(&cp->link_timer);
+       cp->link_timer.function = cas_link_timer;
+       cp->link_timer.data = (unsigned long) cp;
+
+#if 1
+       /* Just in case the implementation of atomic operations
+        * change so that an explicit initialization is necessary.
+        */
+       atomic_set(&cp->reset_task_pending, 0);
+       atomic_set(&cp->reset_task_pending_all, 0);
+       atomic_set(&cp->reset_task_pending_spare, 0);
+       atomic_set(&cp->reset_task_pending_mtu, 0);
+#endif
+       INIT_WORK(&cp->reset_task, cas_reset_task, cp);
+
+       /* Default link parameters */
+       if (link_mode >= 0 && link_mode <= 6)
+               cp->link_cntl = link_modes[link_mode];
+       else
+               cp->link_cntl = BMCR_ANENABLE;
+       cp->lstate = link_down;
+       cp->link_transition = LINK_TRANSITION_LINK_DOWN;
+       netif_carrier_off(cp->dev);
+       cp->timer_ticks = 0;
+
+       /* give us access to cassini registers */
+       cp->regs = ioremap(casreg_base, casreg_len);
+       if (cp->regs == 0UL) {
+               printk(KERN_ERR PFX "Cannot map device registers, "
+                      "aborting.\n");
+               goto err_out_free_res;
+       }
+       cp->casreg_len = casreg_len;
+
+       pci_save_state(pdev);
+       cas_check_pci_invariants(cp);
+       cas_hard_reset(cp);
+       cas_reset(cp, 0);
+       if (cas_check_invariants(cp))
+               goto err_out_iounmap;
+
+       cp->init_block = (struct cas_init_block *)
+               pci_alloc_consistent(pdev, sizeof(struct cas_init_block),
+                                    &cp->block_dvma);
+       if (!cp->init_block) {
+               printk(KERN_ERR PFX "Cannot allocate init block, "
+                      "aborting.\n");
+               goto err_out_iounmap;
+       }
+
+       for (i = 0; i < N_TX_RINGS; i++) 
+               cp->init_txds[i] = cp->init_block->txds[i];
+
+       for (i = 0; i < N_RX_DESC_RINGS; i++) 
+               cp->init_rxds[i] = cp->init_block->rxds[i];
+
+       for (i = 0; i < N_RX_COMP_RINGS; i++) 
+               cp->init_rxcs[i] = cp->init_block->rxcs[i];
+
+       for (i = 0; i < N_RX_FLOWS; i++)
+               skb_queue_head_init(&cp->rx_flows[i]);
+
+       dev->open = cas_open;
+       dev->stop = cas_close;
+       dev->hard_start_xmit = cas_start_xmit;
+       dev->get_stats = cas_get_stats;
+       dev->set_multicast_list = cas_set_multicast;
+       dev->do_ioctl = cas_ioctl;
+       dev->tx_timeout = cas_tx_timeout;
+       dev->watchdog_timeo = CAS_TX_TIMEOUT;
+       dev->change_mtu = cas_change_mtu;
+#ifdef USE_NAPI
+       dev->poll = cas_poll;
+       dev->weight = 64;
+#endif
+#ifdef CONFIG_NET_POLL_CONTROLLER
+       dev->poll_controller = cas_netpoll;
+#endif
+       dev->irq = pdev->irq;
+       dev->dma = 0;
+
+       /* Cassini features. */
+       if ((cp->cas_flags & CAS_FLAG_NO_HW_CSUM) == 0)
+               dev->features |= NETIF_F_HW_CSUM | NETIF_F_SG;
+
+       if (pci_using_dac)
+               dev->features |= NETIF_F_HIGHDMA;
+
+       if (register_netdev(dev)) {
+               printk(KERN_ERR PFX "Cannot register net device, "
+                      "aborting.\n");
+               goto err_out_free_consistent;
+       }
+
+       i = readl(cp->regs + REG_BIM_CFG);
+       printk(KERN_INFO "%s: Sun Cassini%s (%sbit/%sMHz PCI/%s) "
+              "Ethernet[%d] ",  dev->name, 
+              (cp->cas_flags & CAS_FLAG_REG_PLUS) ? "+" : "", 
+              (i & BIM_CFG_32BIT) ? "32" : "64",
+              (i & BIM_CFG_66MHZ) ? "66" : "33",
+              (cp->phy_type == CAS_PHY_SERDES) ? "Fi" : "Cu", pdev->irq); 
+
+       for (i = 0; i < 6; i++)
+               printk("%2.2x%c", dev->dev_addr[i],
+                      i == 5 ? ' ' : ':');
+       printk("\n");
+
+       pci_set_drvdata(pdev, dev);
+       cp->hw_running = 1;
+       cas_entropy_reset(cp);
+       cas_phy_init(cp);
+       cas_begin_auto_negotiation(cp, NULL);
+       return 0;
+
+err_out_free_consistent:
+       pci_free_consistent(pdev, sizeof(struct cas_init_block),
+                           cp->init_block, cp->block_dvma);
+
+err_out_iounmap:
+       down(&cp->pm_sem);
+       if (cp->hw_running)
+               cas_shutdown(cp);
+       up(&cp->pm_sem);
+
+       iounmap((void *) cp->regs);
+
+
+err_out_free_res:
+       pci_release_regions(pdev);
+
+err_write_cacheline:
+       /* Try to restore it in case the error occured after we
+        * set it. 
+        */
+       pci_write_config_byte(pdev, PCI_CACHE_LINE_SIZE, orig_cacheline_size);
+
+err_out_free_netdev:
+       free_netdev(dev);
+
+err_out_disable_pdev:
+       pci_disable_device(pdev);
+       pci_set_drvdata(pdev, NULL);
+       return -ENODEV;
+}
+
+static void __devexit cas_remove_one(struct pci_dev *pdev)
+{
+       struct net_device *dev = pci_get_drvdata(pdev);
+       struct cas *cp;
+       if (!dev)
+               return;
+
+       cp = netdev_priv(dev);
+       unregister_netdev(dev);
+
+       down(&cp->pm_sem);
+       flush_scheduled_work();
+       if (cp->hw_running)
+               cas_shutdown(cp);
+       up(&cp->pm_sem);
+
+#if 1
+       if (cp->orig_cacheline_size) {
+               /* Restore the cache line size if we had modified
+                * it.
+                */
+               pci_write_config_byte(pdev, PCI_CACHE_LINE_SIZE, 
+                                     cp->orig_cacheline_size);
+       }
+#endif
+       pci_free_consistent(pdev, sizeof(struct cas_init_block),
+                           cp->init_block, cp->block_dvma);
+       iounmap((void *) cp->regs);
+       free_netdev(dev);
+       pci_release_regions(pdev);
+       pci_disable_device(pdev);
+       pci_set_drvdata(pdev, NULL);
+}
+
+#ifdef CONFIG_PM
+static int cas_suspend(struct pci_dev *pdev, u32 state)
+{
+       struct net_device *dev = pci_get_drvdata(pdev);
+       struct cas *cp = netdev_priv(dev);
+       unsigned long flags;
+
+       /* We hold the PM semaphore during entire driver
+        * sleep time
+        */
+       down(&cp->pm_sem);
+       
+       /* If the driver is opened, we stop the DMA */
+       if (cp->opened) {
+               netif_device_detach(dev);
+
+               cas_lock_all_save(cp, flags);
+
+               /* We can set the second arg of cas_reset to 0
+                * because on resume, we'll call cas_init_hw with
+                * its second arg set so that autonegotiation is
+                * restarted.
+                */
+               cas_reset(cp, 0);
+               cas_clean_rings(cp);
+               cas_unlock_all_restore(cp, flags);
+       }
+
+       if (cp->hw_running)
+               cas_shutdown(cp);
+
+       return 0;
+}
+
+static int cas_resume(struct pci_dev *pdev)
+{
+       struct net_device *dev = pci_get_drvdata(pdev);
+       struct cas *cp = netdev_priv(dev);
+
+       printk(KERN_INFO "%s: resuming\n", dev->name);
+
+       cas_hard_reset(cp);
+       if (cp->opened) {
+               unsigned long flags;
+               cas_lock_all_save(cp, flags);
+               cas_reset(cp, 0);
+               cp->hw_running = 1;
+               cas_clean_rings(cp);
+               cas_init_hw(cp, 1);
+               cas_unlock_all_restore(cp, flags);
+
+               netif_device_attach(dev);
+       }
+       up(&cp->pm_sem);
+       return 0;
+}
+#endif /* CONFIG_PM */
+
+static struct pci_driver cas_driver = {
+       .name           = DRV_MODULE_NAME,
+       .id_table       = cas_pci_tbl,
+       .probe          = cas_init_one,
+       .remove         = __devexit_p(cas_remove_one),
+#ifdef CONFIG_PM
+       .suspend        = cas_suspend,
+       .resume         = cas_resume
+#endif
+};
+
+static int __init cas_init(void)
+{
+       if (linkdown_timeout > 0)
+               link_transition_timeout = linkdown_timeout * HZ;
+       else
+               link_transition_timeout = 0;
+
+       return pci_module_init(&cas_driver);
+}
+
+static void __exit cas_cleanup(void)
+{
+       pci_unregister_driver(&cas_driver);
+}
+
+module_init(cas_init);
+module_exit(cas_cleanup);
diff --git a/drivers/net/cassini.h b/drivers/net/cassini.h
new file mode 100644 (file)
index 0000000..88063ef
--- /dev/null
@@ -0,0 +1,4425 @@
+/* $Id: cassini.h,v 1.16 2004/08/17 21:15:16 zaumen Exp $
+ * cassini.h: Definitions for Sun Microsystems Cassini(+) ethernet driver.
+ *
+ * Copyright (C) 2004 Sun Microsystems Inc.
+ * Copyright (c) 2003 Adrian Sun (asun@darksunrising.com)
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License as
+ * published by the Free Software Foundation; either version 2 of the
+ * License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA
+ * 02111-1307, USA.
+ *
+ * vendor id: 0x108E (Sun Microsystems, Inc.)
+ * device id: 0xabba (Cassini)
+ * revision ids: 0x01 = Cassini 
+ *               0x02 = Cassini rev 2
+ *               0x10 = Cassini+
+ *               0x11 = Cassini+ 0.2u
+ *
+ * vendor id: 0x100b (National Semiconductor)
+ * device id: 0x0035 (DP83065/Saturn)
+ * revision ids: 0x30 = Saturn B2
+ *
+ * rings are all offset from 0.
+ *
+ * there are two clock domains:
+ * PCI:  33/66MHz clock
+ * chip: 125MHz clock
+ */
+
+#ifndef _CASSINI_H
+#define _CASSINI_H
+
+/* cassini register map: 2M memory mapped in 32-bit memory space accessible as
+ * 32-bit words. there is no i/o port access. REG_ addresses are
+ * shared between cassini and cassini+. REG_PLUS_ addresses only
+ * appear in cassini+. REG_MINUS_ addresses only appear in cassini.
+ */
+#define CAS_ID_REV2          0x02
+#define CAS_ID_REVPLUS       0x10 
+#define CAS_ID_REVPLUS02u    0x11 
+#define CAS_ID_REVSATURNB2   0x30
+
+/** global resources **/
+
+/* this register sets the weights for the weighted round robin arbiter. e.g.,
+ * if rx weight == 1 and tx weight == 0, rx == 2x tx transfer credit
+ * for its next turn to access the pci bus. 
+ * map: 0x0 = x1, 0x1 = x2, 0x2 = x4, 0x3 = x8 
+ * DEFAULT: 0x0, SIZE: 5 bits
+ */
+#define  REG_CAWR                     0x0004  /* core arbitration weight */
+#define    CAWR_RX_DMA_WEIGHT_SHIFT    0
+#define    CAWR_RX_DMA_WEIGHT_MASK     0x03    /* [0:1] */
+#define    CAWR_TX_DMA_WEIGHT_SHIFT    2
+#define    CAWR_TX_DMA_WEIGHT_MASK     0x0C    /* [3:2] */
+#define    CAWR_RR_DIS                 0x10    /* [4] */
+
+/* if enabled, BIM can send bursts across PCI bus > cacheline size. burst
+ * sizes determined by length of packet or descriptor transfer and the 
+ * max length allowed by the target. 
+ * DEFAULT: 0x0, SIZE: 1 bit
+ */
+#define  REG_INF_BURST                 0x0008  /* infinite burst enable reg */
+#define    INF_BURST_EN                0x1     /* enable */
+
+/* top level interrupts [0-9] are auto-cleared to 0 when the status
+ * register is read. second level interrupts [13 - 18] are cleared at
+ * the source. tx completion register 3 is replicated in [19 - 31] 
+ * DEFAULT: 0x00000000, SIZE: 29 bits
+ */
+#define  REG_INTR_STATUS               0x000C  /* interrupt status register */
+#define    INTR_TX_INTME               0x00000001  /* frame w/ INT ME desc bit set 
+                                                     xferred from host queue to
+                                                     TX FIFO */
+#define    INTR_TX_ALL                 0x00000002  /* all xmit frames xferred into
+                                                     TX FIFO. i.e.,
+                                                     TX Kick == TX complete. if 
+                                                     PACED_MODE set, then TX FIFO
+                                                     also empty */
+#define    INTR_TX_DONE                0x00000004  /* any frame xferred into tx 
+                                                     FIFO */
+#define    INTR_TX_TAG_ERROR           0x00000008  /* TX FIFO tag framing 
+                                                     corrupted. FATAL ERROR */
+#define    INTR_RX_DONE                0x00000010  /* at least 1 frame xferred
+                                                     from RX FIFO to host mem.
+                                                     RX completion reg updated.
+                                                     may be delayed by recv
+                                                     intr blanking. */
+#define    INTR_RX_BUF_UNAVAIL         0x00000020  /* no more receive buffers.
+                                                     RX Kick == RX complete */
+#define    INTR_RX_TAG_ERROR           0x00000040  /* RX FIFO tag framing 
+                                                     corrupted. FATAL ERROR */
+#define    INTR_RX_COMP_FULL           0x00000080  /* no more room in completion
+                                                     ring to post descriptors.
+                                                     RX complete head incr to
+                                                     almost reach RX complete
+                                                     tail */
+#define    INTR_RX_BUF_AE              0x00000100  /* less than the 
+                                                     programmable threshold #
+                                                     of free descr avail for
+                                                     hw use */
+#define    INTR_RX_COMP_AF             0x00000200  /* less than the 
+                                                     programmable threshold #
+                                                     of descr spaces for hw
+                                                     use in completion descr
+                                                     ring */
+#define    INTR_RX_LEN_MISMATCH        0x00000400  /* len field from MAC !=
+                                                     len of non-reassembly pkt
+                                                     from fifo during DMA or
+                                                     header parser provides TCP
+                                                     header and payload size >
+                                                     MAC packet size. 
+                                                     FATAL ERROR */
+#define    INTR_SUMMARY                0x00001000  /* summary interrupt bit. this
+                                                     bit will be set if an interrupt 
+                                                     generated on the pci bus. useful
+                                                     when driver is polling for 
+                                                     interrupts */
+#define    INTR_PCS_STATUS             0x00002000  /* PCS interrupt status register */
+#define    INTR_TX_MAC_STATUS          0x00004000  /* TX MAC status register has at 
+                                                     least 1 unmasked interrupt set */
+#define    INTR_RX_MAC_STATUS          0x00008000  /* RX MAC status register has at 
+                                                     least 1 unmasked interrupt set */
+#define    INTR_MAC_CTRL_STATUS        0x00010000  /* MAC control status register has
+                                                     at least 1 unmasked interrupt
+                                                     set */
+#define    INTR_MIF_STATUS             0x00020000  /* MIF status register has at least
+                                                     1 unmasked interrupt set */
+#define    INTR_PCI_ERROR_STATUS       0x00040000  /* PCI error status register in the
+                                                     BIF has at least 1 unmasked 
+                                                     interrupt set */
+#define    INTR_TX_COMP_3_MASK         0xFFF80000  /* mask for TX completion 
+                                                     3 reg data */
+#define    INTR_TX_COMP_3_SHIFT        19
+#define    INTR_ERROR_MASK (INTR_MIF_STATUS | INTR_PCI_ERROR_STATUS | \
+                            INTR_PCS_STATUS | INTR_RX_LEN_MISMATCH | \
+                            INTR_TX_MAC_STATUS | INTR_RX_MAC_STATUS | \
+                            INTR_TX_TAG_ERROR | INTR_RX_TAG_ERROR | \
+                            INTR_MAC_CTRL_STATUS)
+
+/* determines which status events will cause an interrupt. layout same
+ * as REG_INTR_STATUS. 
+ * DEFAULT: 0xFFFFFFFF, SIZE: 16 bits
+ */
+#define  REG_INTR_MASK                 0x0010  /* Interrupt mask */
+
+/* top level interrupt bits that are cleared during read of REG_INTR_STATUS_ALIAS.
+ * useful when driver is polling for interrupts. layout same as REG_INTR_MASK.
+ * DEFAULT: 0x00000000, SIZE: 12 bits
+ */
+#define  REG_ALIAS_CLEAR               0x0014  /* alias clear mask 
+                                                 (used w/ status alias) */
+/* same as REG_INTR_STATUS except that only bits cleared are those selected by
+ * REG_ALIAS_CLEAR 
+ * DEFAULT: 0x00000000, SIZE: 29 bits
+ */
+#define  REG_INTR_STATUS_ALIAS         0x001C  /* interrupt status alias 
+                                                 (selective clear) */
+
+/* DEFAULT: 0x0, SIZE: 3 bits */
+#define  REG_PCI_ERR_STATUS            0x1000  /* PCI error status */
+#define    PCI_ERR_BADACK              0x01    /* reserved in Cassini+. 
+                                                 set if no ACK64# during ABS64 cycle
+                                                 in Cassini. */
+#define    PCI_ERR_DTRTO               0x02    /* delayed xaction timeout. set if
+                                                 no read retry after 2^15 clocks */
+#define    PCI_ERR_OTHER               0x04    /* other PCI errors */
+#define    PCI_ERR_BIM_DMA_WRITE       0x08    /* BIM received 0 count DMA write req.
+                                                 unused in Cassini. */
+#define    PCI_ERR_BIM_DMA_READ        0x10    /* BIM received 0 count DMA read req.
+                                                 unused in Cassini. */
+#define    PCI_ERR_BIM_DMA_TIMEOUT     0x20    /* BIM received 255 retries during 
+                                                 DMA. unused in cassini. */
+
+/* mask for PCI status events that will set PCI_ERR_STATUS. if cleared, event
+ * causes an interrupt to be generated. 
+ * DEFAULT: 0x7, SIZE: 3 bits
+ */
+#define  REG_PCI_ERR_STATUS_MASK       0x1004  /* PCI Error status mask */
+
+/* used to configure PCI related parameters that are not in PCI config space. 
+ * DEFAULT: 0bxx000, SIZE: 5 bits
+ */
+#define  REG_BIM_CFG                0x1008  /* BIM Configuration */
+#define    BIM_CFG_RESERVED0        0x001   /* reserved */
+#define    BIM_CFG_RESERVED1        0x002   /* reserved */
+#define    BIM_CFG_64BIT_DISABLE    0x004   /* disable 64-bit mode */
+#define    BIM_CFG_66MHZ            0x008   /* (ro) 1 = 66MHz, 0 = < 66MHz */
+#define    BIM_CFG_32BIT            0x010   /* (ro) 1 = 32-bit slot, 0 = 64-bit */
+#define    BIM_CFG_DPAR_INTR_ENABLE 0x020   /* detected parity err enable */
+#define    BIM_CFG_RMA_INTR_ENABLE  0x040   /* master abort intr enable */
+#define    BIM_CFG_RTA_INTR_ENABLE  0x080   /* target abort intr enable */
+#define    BIM_CFG_RESERVED2        0x100   /* reserved */
+#define    BIM_CFG_BIM_DISABLE      0x200   /* stop BIM DMA. use before global 
+                                              reset. reserved in Cassini. */
+#define    BIM_CFG_BIM_STATUS       0x400   /* (ro) 1 = BIM DMA suspended.
+                                                 reserved in Cassini. */
+#define    BIM_CFG_PERROR_BLOCK     0x800  /* block PERR# to pci bus. def: 0.
+                                                reserved in Cassini. */
+
+/* DEFAULT: 0x00000000, SIZE: 32 bits */
+#define  REG_BIM_DIAG                  0x100C  /* BIM Diagnostic */
+#define    BIM_DIAG_MSTR_SM_MASK       0x3FFFFF00 /* PCI master controller state
+                                                    machine bits [21:0] */
+#define    BIM_DIAG_BRST_SM_MASK       0x7F    /* PCI burst controller state 
+                                                 machine bits [6:0] */
+
+/* writing to SW_RESET_TX and SW_RESET_RX will issue a global
+ * reset. poll until TX and RX read back as 0's for completion.
+ */
+#define  REG_SW_RESET                  0x1010  /* Software reset */
+#define    SW_RESET_TX                 0x00000001  /* reset TX DMA engine. poll until
+                                                     cleared to 0.  */
+#define    SW_RESET_RX                 0x00000002  /* reset RX DMA engine. poll until
+                                                     cleared to 0. */
+#define    SW_RESET_RSTOUT             0x00000004  /* force RSTOUT# pin active (low).
+                                                     resets PHY and anything else 
+                                                     connected to RSTOUT#. RSTOUT#
+                                                     is also activated by local PCI
+                                                     reset when hot-swap is being 
+                                                     done. */
+#define    SW_RESET_BLOCK_PCS_SLINK    0x00000008  /* if a global reset is done with 
+                                                     this bit set, PCS and SLINK 
+                                                     modules won't be reset. 
+                                                     i.e., link won't drop. */
+#define    SW_RESET_BREQ_SM_MASK       0x00007F00  /* breq state machine [6:0] */
+#define    SW_RESET_PCIARB_SM_MASK     0x00070000  /* pci arbitration state bits:
+                                                     0b000: ARB_IDLE1
+                                                     0b001: ARB_IDLE2
+                                                     0b010: ARB_WB_ACK
+                                                     0b011: ARB_WB_WAT
+                                                     0b100: ARB_RB_ACK
+                                                     0b101: ARB_RB_WAT
+                                                     0b110: ARB_RB_END
+                                                     0b111: ARB_WB_END */
+#define    SW_RESET_RDPCI_SM_MASK      0x00300000  /* read pci state bits:
+                                                     0b00: RD_PCI_WAT
+                                                     0b01: RD_PCI_RDY
+                                                     0b11: RD_PCI_ACK */
+#define    SW_RESET_RDARB_SM_MASK      0x00C00000  /* read arbitration state bits:
+                                                     0b00: AD_IDL_RX
+                                                     0b01: AD_ACK_RX
+                                                     0b10: AD_ACK_TX
+                                                     0b11: AD_IDL_TX */
+#define    SW_RESET_WRPCI_SM_MASK      0x06000000  /* write pci state bits 
+                                                     0b00: WR_PCI_WAT
+                                                     0b01: WR_PCI_RDY
+                                                     0b11: WR_PCI_ACK */
+#define    SW_RESET_WRARB_SM_MASK      0x38000000  /* write arbitration state bits:
+                                                     0b000: ARB_IDLE1
+                                                     0b001: ARB_IDLE2
+                                                     0b010: ARB_TX_ACK
+                                                     0b011: ARB_TX_WAT
+                                                     0b100: ARB_RX_ACK
+                                                     0b110: ARB_RX_WAT */
+
+/* Cassini only. 64-bit register used to check PCI datapath. when read,
+ * value written has both lower and upper 32-bit halves rotated to the right
+ * one bit position. e.g., FFFFFFFF FFFFFFFF -> 7FFFFFFF 7FFFFFFF
+ */
+#define  REG_MINUS_BIM_DATAPATH_TEST   0x1018  /* Cassini: BIM datapath test 
+                                                 Cassini+: reserved */
+
+/* output enables are provided for each device's chip select and for the rest
+ * of the outputs from cassini to its local bus devices. two sw programmable
+ * bits are connected to general purpus control/status bits.
+ * DEFAULT: 0x7
+ */
+#define  REG_BIM_LOCAL_DEV_EN          0x1020  /* BIM local device 
+                                                 output EN. default: 0x7 */
+#define    BIM_LOCAL_DEV_PAD           0x01    /* address bus, RW signal, and
+                                                 OE signal output enable on the
+                                                 local bus interface. these
+                                                 are shared between both local 
+                                                 bus devices. tristate when 0. */
+#define    BIM_LOCAL_DEV_PROM          0x02    /* PROM chip select */
+#define    BIM_LOCAL_DEV_EXT           0x04    /* secondary local bus device chip
+                                                 select output enable */
+#define    BIM_LOCAL_DEV_SOFT_0        0x08    /* sw programmable ctrl bit 0 */
+#define    BIM_LOCAL_DEV_SOFT_1        0x10    /* sw programmable ctrl bit 1 */
+#define    BIM_LOCAL_DEV_HW_RESET      0x20    /* internal hw reset. Cassini+ only. */
+
+/* access 24 entry BIM read and write buffers. put address in REG_BIM_BUFFER_ADDR
+ * and read/write from/to it REG_BIM_BUFFER_DATA_LOW and _DATA_HI. 
+ * _DATA_HI should be the last access of the sequence. 
+ * DEFAULT: undefined
+ */
+#define  REG_BIM_BUFFER_ADDR           0x1024  /* BIM buffer address. for
+                                                 purposes. */
+#define    BIM_BUFFER_ADDR_MASK        0x3F    /* index (0 - 23) of buffer  */
+#define    BIM_BUFFER_WR_SELECT        0x40    /* write buffer access = 1
+                                                 read buffer access = 0 */
+/* DEFAULT: undefined */
+#define  REG_BIM_BUFFER_DATA_LOW       0x1028  /* BIM buffer data low */
+#define  REG_BIM_BUFFER_DATA_HI        0x102C  /* BIM buffer data high */
+
+/* set BIM_RAM_BIST_START to start built-in self test for BIM read buffer. 
+ * bit auto-clears when done with status read from _SUMMARY and _PASS bits.
+ */
+#define  REG_BIM_RAM_BIST              0x102C  /* BIM RAM (read buffer) BIST 
+                                                 control/status */
+#define    BIM_RAM_BIST_RD_START       0x01    /* start BIST for BIM read buffer */
+#define    BIM_RAM_BIST_WR_START       0x02    /* start BIST for BIM write buffer.
+                                                 Cassini only. reserved in
+                                                 Cassini+. */
+#define    BIM_RAM_BIST_RD_PASS        0x04    /* summary BIST pass status for read
+                                                 buffer. */
+#define    BIM_RAM_BIST_WR_PASS        0x08    /* summary BIST pass status for write
+                                                 buffer. Cassini only. reserved
+                                                 in Cassini+. */
+#define    BIM_RAM_BIST_RD_LOW_PASS    0x10    /* read low bank passes BIST */
+#define    BIM_RAM_BIST_RD_HI_PASS     0x20    /* read high bank passes BIST */
+#define    BIM_RAM_BIST_WR_LOW_PASS    0x40    /* write low bank passes BIST.
+                                                 Cassini only. reserved in 
+                                                 Cassini+. */
+#define    BIM_RAM_BIST_WR_HI_PASS     0x80    /* write high bank passes BIST.
+                                                 Cassini only. reserved in
+                                                 Cassini+. */
+
+/* ASUN: i'm not sure what this does as it's not in the spec.
+ * DEFAULT: 0xFC
+ */
+#define  REG_BIM_DIAG_MUX              0x1030  /* BIM diagnostic probe mux
+                                                 select register */
+
+/* enable probe monitoring mode and select data appearing on the P_A* bus. bit 
+ * values for _SEL_HI_MASK and _SEL_LOW_MASK:
+ * 0x0: internal probe[7:0] (pci arb state, wtc empty w, wtc full w, wtc empty w,
+ *                           wtc empty r, post pci)
+ * 0x1: internal probe[15:8] (pci wbuf comp, pci wpkt comp, pci rbuf comp,
+ *                            pci rpkt comp, txdma wr req, txdma wr ack,
+ *                           txdma wr rdy, txdma wr xfr done)
+ * 0x2: internal probe[23:16] (txdma rd req, txdma rd ack, txdma rd rdy, rxdma rd,
+ *                             rd arb state, rd pci state)
+ * 0x3: internal probe[31:24] (rxdma req, rxdma ack, rxdma rdy, wrarb state,
+ *                             wrpci state)
+ * 0x4: pci io probe[7:0]     0x5: pci io probe[15:8]
+ * 0x6: pci io probe[23:16]   0x7: pci io probe[31:24]
+ * 0x8: pci io probe[39:32]   0x9: pci io probe[47:40]
+ * 0xa: pci io probe[55:48]   0xb: pci io probe[63:56]
+ * the following are not available in Cassini:
+ * 0xc: rx probe[7:0]         0xd: tx probe[7:0]
+ * 0xe: hp probe[7:0]        0xf: mac probe[7:0]
+ */
+#define  REG_PLUS_PROBE_MUX_SELECT     0x1034 /* Cassini+: PROBE MUX SELECT */
+#define    PROBE_MUX_EN                0x80000000 /* allow probe signals to be 
+                                                    driven on local bus P_A[15:0]
+                                                    for debugging */
+#define    PROBE_MUX_SUB_MUX_MASK      0x0000FF00 /* select sub module probe signals:
+                                                    0x03 = mac[1:0]
+                                                    0x0C = rx[1:0]
+                                                    0x30 = tx[1:0]
+                                                    0xC0 = hp[1:0] */
+#define    PROBE_MUX_SEL_HI_MASK       0x000000F0 /* select which module to appear
+                                                    on P_A[15:8]. see above for 
+                                                    values. */
+#define    PROBE_MUX_SEL_LOW_MASK      0x0000000F /* select which module to appear
+                                                    on P_A[7:0]. see above for 
+                                                    values. */
+
+/* values mean the same thing as REG_INTR_MASK excep that it's for INTB. 
+ DEFAULT: 0x1F */
+#define  REG_PLUS_INTR_MASK_1          0x1038 /* Cassini+: interrupt mask
+                                                register 2 for INTB */
+#define  REG_PLUS_INTRN_MASK(x)       (REG_PLUS_INTR_MASK_1 + ((x) - 1)*16)
+/* bits correspond to both _MASK and _STATUS registers. _ALT corresponds to 
+ * all of the alternate (2-4) INTR registers while _1 corresponds to only 
+ * _MASK_1 and _STATUS_1 registers. 
+ * DEFAULT: 0x7 for MASK registers, 0x0 for ALIAS_CLEAR registers
+ */
+#define    INTR_RX_DONE_ALT              0x01  
+#define    INTR_RX_COMP_FULL_ALT         0x02
+#define    INTR_RX_COMP_AF_ALT           0x04
+#define    INTR_RX_BUF_UNAVAIL_1         0x08
+#define    INTR_RX_BUF_AE_1              0x10 /* almost empty */
+#define    INTRN_MASK_RX_EN              0x80     
+#define    INTRN_MASK_CLEAR_ALL          (INTR_RX_DONE_ALT | \
+                                          INTR_RX_COMP_FULL_ALT | \
+                                          INTR_RX_COMP_AF_ALT | \
+                                          INTR_RX_BUF_UNAVAIL_1 | \
+                                          INTR_RX_BUF_AE_1)
+#define  REG_PLUS_INTR_STATUS_1        0x103C /* Cassini+: interrupt status
+                                                register 2 for INTB. default: 0x1F */
+#define  REG_PLUS_INTRN_STATUS(x)       (REG_PLUS_INTR_STATUS_1 + ((x) - 1)*16)
+#define    INTR_STATUS_ALT_INTX_EN     0x80   /* generate INTX when one of the
+                                                flags are set. enables desc ring. */
+
+#define  REG_PLUS_ALIAS_CLEAR_1        0x1040 /* Cassini+: alias clear mask
+                                                register 2 for INTB */
+#define  REG_PLUS_ALIASN_CLEAR(x)      (REG_PLUS_ALIAS_CLEAR_1 + ((x) - 1)*16)
+
+#define  REG_PLUS_INTR_STATUS_ALIAS_1  0x1044 /* Cassini+: interrupt status 
+                                                register alias 2 for INTB */
+#define  REG_PLUS_INTRN_STATUS_ALIAS(x) (REG_PLUS_INTR_STATUS_ALIAS_1 + ((x) - 1)*16)
+
+#define REG_SATURN_PCFG               0x106c /* pin configuration register for
+                                               integrated macphy */
+
+#define   SATURN_PCFG_TLA             0x00000001 /* 1 = phy actled */
+#define   SATURN_PCFG_FLA             0x00000002 /* 1 = phy link10led */
+#define   SATURN_PCFG_CLA             0x00000004 /* 1 = phy link100led */
+#define   SATURN_PCFG_LLA             0x00000008 /* 1 = phy link1000led */
+#define   SATURN_PCFG_RLA             0x00000010 /* 1 = phy duplexled */
+#define   SATURN_PCFG_PDS             0x00000020 /* phy debug mode. 
+                                                   0 = normal */
+#define   SATURN_PCFG_MTP             0x00000080 /* test point select */ 
+#define   SATURN_PCFG_GMO             0x00000100 /* GMII observe. 1 = 
+                                                   GMII on SERDES pins for
+                                                   monitoring. */
+#define   SATURN_PCFG_FSI             0x00000200 /* 1 = freeze serdes/gmii. all
+                                                   pins configed as outputs.
+                                                   for power saving when using
+                                                   internal phy. */
+#define   SATURN_PCFG_LAD             0x00000800 /* 0 = mac core led ctrl 
+                                                   polarity from strapping 
+                                                   value.
+                                                   1 = mac core led ctrl
+                                                   polarity active low. */
+
+
+/** transmit dma registers **/
+#define MAX_TX_RINGS_SHIFT            2
+#define MAX_TX_RINGS                  (1 << MAX_TX_RINGS_SHIFT)
+#define MAX_TX_RINGS_MASK             (MAX_TX_RINGS - 1)
+
+/* TX configuration. 
+ * descr ring sizes size = 32 * (1 << n), n < 9. e.g., 0x8 = 8k. default: 0x8 
+ * DEFAULT: 0x3F000001
+ */
+#define  REG_TX_CFG                    0x2004  /* TX config */
+#define    TX_CFG_DMA_EN               0x00000001  /* enable TX DMA. if cleared, DMA
+                                                     will stop after xfer of current
+                                                     buffer has been completed. */
+#define    TX_CFG_FIFO_PIO_SEL         0x00000002  /* TX DMA FIFO can be 
+                                                     accessed w/ FIFO addr 
+                                                     and data registers. 
+                                                     TX DMA should be 
+                                                     disabled. */
+#define    TX_CFG_DESC_RING0_MASK      0x0000003C  /* # desc entries in
+                                                     ring 1. */
+#define    TX_CFG_DESC_RING0_SHIFT     2
+#define    TX_CFG_DESC_RINGN_MASK(a)   (TX_CFG_DESC_RING0_MASK << (a)*4)
+#define    TX_CFG_DESC_RINGN_SHIFT(a)  (TX_CFG_DESC_RING0_SHIFT + (a)*4)
+#define    TX_CFG_PACED_MODE           0x00100000  /* TX_ALL only set after 
+                                                     TX FIFO becomes empty. 
+                                                     if 0, TX_ALL set
+                                                     if descr queue empty. */
+#define    TX_CFG_DMA_RDPIPE_DIS       0x01000000  /* always set to 1 */
+#define    TX_CFG_COMPWB_Q1            0x02000000  /* completion writeback happens at
+                                                     the end of every packet kicked
+                                                     through Q1. */
+#define    TX_CFG_COMPWB_Q2            0x04000000  /* completion writeback happens at
+                                                     the end of every packet kicked
+                                                     through Q2. */
+#define    TX_CFG_COMPWB_Q3            0x08000000  /* completion writeback happens at
+                                                     the end of every packet kicked
+                                                     through Q3 */
+#define    TX_CFG_COMPWB_Q4            0x10000000  /* completion writeback happens at
+                                                     the end of every packet kicked
+                                                     through Q4 */
+#define    TX_CFG_INTR_COMPWB_DIS      0x20000000  /* disable pre-interrupt completion
+                                                     writeback */
+#define    TX_CFG_CTX_SEL_MASK         0xC0000000  /* selects tx test port 
+                                                     connection
+                                                     0b00: tx mac req, 
+                                                           tx mac retry req,
+                                                           tx ack and tx tag.
+                                                     0b01: txdma rd req, 
+                                                           txdma rd ack,
+                                                           txdma rd rdy,
+                                                           txdma rd type0
+                                                     0b11: txdma wr req, 
+                                                           txdma wr ack,
+                                                           txdma wr rdy,
+                                                           txdma wr xfr done. */
+#define    TX_CFG_CTX_SEL_SHIFT        30
+                                                     
+/* 11-bit counters that point to next location in FIFO to be loaded/retrieved.
+ * used for diagnostics only.
+ */
+#define  REG_TX_FIFO_WRITE_PTR         0x2014  /* TX FIFO write pointer */
+#define  REG_TX_FIFO_SHADOW_WRITE_PTR  0x2018  /* TX FIFO shadow write 
+                                                 pointer. temp hold reg.
+                                                 diagnostics only. */
+#define  REG_TX_FIFO_READ_PTR          0x201C  /* TX FIFO read pointer */
+#define  REG_TX_FIFO_SHADOW_READ_PTR   0x2020  /* TX FIFO shadow read
+                                                 pointer */
+
+/* (ro) 11-bit up/down counter w/ # of frames currently in TX FIFO */
+#define  REG_TX_FIFO_PKT_CNT           0x2024  /* TX FIFO packet counter */
+
+/* current state of all state machines in TX */
+#define  REG_TX_SM_1                   0x2028  /* TX state machine reg #1 */
+#define    TX_SM_1_CHAIN_MASK          0x000003FF   /* chaining state machine */
+#define    TX_SM_1_CSUM_MASK           0x00000C00   /* checksum state machine */
+#define    TX_SM_1_FIFO_LOAD_MASK      0x0003F000   /* FIFO load state machine.
+                                                      = 0x01 when TX disabled. */
+#define    TX_SM_1_FIFO_UNLOAD_MASK    0x003C0000   /* FIFO unload state machine */
+#define    TX_SM_1_CACHE_MASK          0x03C00000   /* desc. prefetch cache controller
+                                                      state machine */
+#define    TX_SM_1_CBQ_ARB_MASK        0xF8000000   /* CBQ arbiter state machine */
+                                                        
+#define  REG_TX_SM_2                   0x202C  /* TX state machine reg #2 */
+#define    TX_SM_2_COMP_WB_MASK        0x07    /* completion writeback sm */
+#define           TX_SM_2_SUB_LOAD_MASK       0x38    /* sub load state machine */
+#define           TX_SM_2_KICK_MASK           0xC0    /* kick state machine */
+
+/* 64-bit pointer to the transmit data buffer. only the 50 LSB are incremented
+ * while the upper 23 bits are taken from the TX descriptor
+ */
+#define  REG_TX_DATA_PTR_LOW           0x2030  /* TX data pointer low */
+#define  REG_TX_DATA_PTR_HI            0x2034  /* TX data pointer high */
+
+/* 13 bit registers written by driver w/ descriptor value that follows 
+ * last valid xmit descriptor. kick # and complete # values are used by
+ * the xmit dma engine to control tx descr fetching. if > 1 valid 
+ * tx descr is available within the cache line being read, cassini will
+ * internally cache up to 4 of them. 0 on reset. _KICK = rw, _COMP = ro.
+ */
+#define  REG_TX_KICK0                  0x2038  /* TX kick reg #1 */
+#define  REG_TX_KICKN(x)               (REG_TX_KICK0 + (x)*4)
+#define  REG_TX_COMP0                  0x2048  /* TX completion reg #1 */
+#define  REG_TX_COMPN(x)               (REG_TX_COMP0 + (x)*4)
+
+/* values of TX_COMPLETE_1-4 are written. each completion register 
+ * is 2bytes in size and contiguous. 8B allocation w/ 8B alignment. 
+ * NOTE: completion reg values are only written back prior to TX_INTME and
+ * TX_ALL interrupts. at all other times, the most up-to-date index values 
+ * should be obtained from the REG_TX_COMPLETE_# registers. 
+ * here's the layout: 
+ * offset from base addr      completion # byte
+ *           0                TX_COMPLETE_1_MSB
+ *          1                TX_COMPLETE_1_LSB
+ *           2                TX_COMPLETE_2_MSB
+ *          3                TX_COMPLETE_2_LSB
+ *           4                TX_COMPLETE_3_MSB
+ *          5                TX_COMPLETE_3_LSB
+ *           6                TX_COMPLETE_4_MSB
+ *          7                TX_COMPLETE_4_LSB
+ */
+#define  TX_COMPWB_SIZE             8
+#define  REG_TX_COMPWB_DB_LOW       0x2058  /* TX completion write back
+                                              base low */
+#define  REG_TX_COMPWB_DB_HI        0x205C  /* TX completion write back
+                                              base high */
+#define    TX_COMPWB_MSB_MASK       0x00000000000000FFULL
+#define    TX_COMPWB_MSB_SHIFT      0
+#define    TX_COMPWB_LSB_MASK       0x000000000000FF00ULL
+#define    TX_COMPWB_LSB_SHIFT      8
+#define    TX_COMPWB_NEXT(x)        ((x) >> 16)
+                                                     
+/* 53 MSB used as base address. 11 LSB assumed to be 0. TX desc pointer must
+ * be 2KB-aligned. */
+#define  REG_TX_DB0_LOW         0x2060  /* TX descriptor base low #1 */
+#define  REG_TX_DB0_HI          0x2064  /* TX descriptor base hi #1 */
+#define  REG_TX_DBN_LOW(x)      (REG_TX_DB0_LOW + (x)*8)
+#define  REG_TX_DBN_HI(x)       (REG_TX_DB0_HI + (x)*8)
+
+/* 16-bit registers hold weights for the weighted round-robin of the
+ * four CBQ TX descr rings. weights correspond to # bytes xferred from
+ * host to TXFIFO in a round of WRR arbitration. can be set
+ * dynamically with new weights set upon completion of the current
+ * packet transfer from host memory to TXFIFO. a dummy write to any of
+ * these registers causes a queue1 pre-emption with all historical bw
+ * deficit data reset to 0 (useful when congestion requires a
+ * pre-emption/re-allocation of network bandwidth
+ */
+#define  REG_TX_MAXBURST_0             0x2080  /* TX MaxBurst #1 */
+#define  REG_TX_MAXBURST_1             0x2084  /* TX MaxBurst #2 */
+#define  REG_TX_MAXBURST_2             0x2088  /* TX MaxBurst #3 */
+#define  REG_TX_MAXBURST_3             0x208C  /* TX MaxBurst #4 */
+
+/* diagnostics access to any TX FIFO location. every access is 65
+ * bits.  _DATA_LOW = 32 LSB, _DATA_HI_T1/T0 = 32 MSB. _TAG = tag bit.
+ * writing _DATA_HI_T0 sets tag bit low, writing _DATA_HI_T1 sets tag
+ * bit high.  TX_FIFO_PIO_SEL must be set for TX FIFO PIO access. if
+ * TX FIFO data integrity is desired, TX DMA should be
+ * disabled. _DATA_HI_Tx should be the last access of the sequence.
+ */
+#define  REG_TX_FIFO_ADDR              0x2104  /* TX FIFO address */
+#define  REG_TX_FIFO_TAG               0x2108  /* TX FIFO tag */
+#define  REG_TX_FIFO_DATA_LOW          0x210C  /* TX FIFO data low */
+#define  REG_TX_FIFO_DATA_HI_T1        0x2110  /* TX FIFO data high t1 */
+#define  REG_TX_FIFO_DATA_HI_T0        0x2114  /* TX FIFO data high t0 */
+#define  REG_TX_FIFO_SIZE              0x2118  /* (ro) TX FIFO size = 0x090 = 9KB */
+
+/* 9-bit register controls BIST of TX FIFO. bit set indicates that the BIST 
+ * passed for the specified memory
+ */
+#define  REG_TX_RAMBIST                0x211C /* TX RAMBIST control/status */
+#define    TX_RAMBIST_STATE            0x01C0 /* progress state of RAMBIST 
+                                                controller state machine */
+#define    TX_RAMBIST_RAM33A_PASS      0x0020 /* RAM33A passed */
+#define    TX_RAMBIST_RAM32A_PASS      0x0010 /* RAM32A passed */
+#define    TX_RAMBIST_RAM33B_PASS      0x0008 /* RAM33B passed */
+#define    TX_RAMBIST_RAM32B_PASS      0x0004 /* RAM32B passed */
+#define    TX_RAMBIST_SUMMARY          0x0002 /* all RAM passed */
+#define    TX_RAMBIST_START            0x0001 /* write 1 to start BIST. self
+                                                clears on completion. */
+
+/** receive dma registers **/
+#define MAX_RX_DESC_RINGS              2
+#define MAX_RX_COMP_RINGS              4
+
+/* receive DMA channel configuration. default: 0x80910 
+ * free ring size       = (1 << n)*32  -> [32 - 8k]
+ * completion ring size = (1 << n)*128 -> [128 - 32k], n < 9 
+ * DEFAULT: 0x80910
+ */
+#define  REG_RX_CFG                     0x4000  /* RX config */
+#define    RX_CFG_DMA_EN                0x00000001 /* enable RX DMA. 0 stops
+                                                        channel as soon as current
+                                                        frame xfer has completed.
+                                                        driver should disable MAC 
+                                                        for 200ms before disabling 
+                                                        RX */
+#define    RX_CFG_DESC_RING_MASK        0x0000001E /* # desc entries in RX 
+                                                        free desc ring. 
+                                                        def: 0x8 = 8k */
+#define    RX_CFG_DESC_RING_SHIFT       1
+#define    RX_CFG_COMP_RING_MASK        0x000001E0 /* # desc entries in RX complete
+                                                        ring. def: 0x8 = 32k */
+#define    RX_CFG_COMP_RING_SHIFT       5
+#define    RX_CFG_BATCH_DIS             0x00000200 /* disable receive desc 
+                                                     batching. def: 0x0 =
+                                                     enabled */
+#define    RX_CFG_SWIVEL_MASK           0x00001C00 /* byte offset of the 1st 
+                                                     data byte of the packet 
+                                                     w/in 8 byte boundares.
+                                                     this swivels the data 
+                                                     DMA'ed to header 
+                                                     buffers, jumbo buffers
+                                                     when header split is not
+                                                     requested and MTU sized
+                                                     buffers. def: 0x2 */
+#define    RX_CFG_SWIVEL_SHIFT          10
+
+/* cassini+ only */
+#define    RX_CFG_DESC_RING1_MASK       0x000F0000 /* # of desc entries in
+                                                        RX free desc ring 2. 
+                                                        def: 0x8 = 8k */
+#define    RX_CFG_DESC_RING1_SHIFT      16
+
+
+/* the page size register allows cassini chips to do the following with 
+ * received data:
+ * [--------------------------------------------------------------] page
+ * [off][buf1][pad][off][buf2][pad][off][buf3][pad][off][buf4][pad]
+ * |--------------| = PAGE_SIZE_BUFFER_STRIDE
+ * page = PAGE_SIZE 
+ * offset = PAGE_SIZE_MTU_OFF
+ * for the above example, MTU_BUFFER_COUNT = 4.
+ * NOTE: as is apparent, you need to ensure that the following holds:
+ * MTU_BUFFER_COUNT <= PAGE_SIZE/PAGE_SIZE_BUFFER_STRIDE
+ * DEFAULT: 0x48002002 (8k pages)
+ */
+#define  REG_RX_PAGE_SIZE               0x4004  /* RX page size */
+#define    RX_PAGE_SIZE_MASK            0x00000003 /* size of pages pointed to
+                                                     by receive descriptors.
+                                                     if jumbo buffers are 
+                                                     supported the page size 
+                                                     should not be < 8k.
+                                                     0b00 = 2k, 0b01 = 4k
+                                                     0b10 = 8k, 0b11 = 16k
+                                                     DEFAULT: 8k */
+#define    RX_PAGE_SIZE_SHIFT           0
+#define    RX_PAGE_SIZE_MTU_COUNT_MASK  0x00007800 /* # of MTU buffers the hw
+                                                     packs into a page. 
+                                                     DEFAULT: 4 */
+#define    RX_PAGE_SIZE_MTU_COUNT_SHIFT 11
+#define    RX_PAGE_SIZE_MTU_STRIDE_MASK 0x18000000 /* # of bytes that separate
+                                                        each MTU buffer + 
+                                                        offset from each 
+                                                        other.
+                                                        0b00 = 1k, 0b01 = 2k
+                                                        0b10 = 4k, 0b11 = 8k
+                                                        DEFAULT: 0x1 */
+#define    RX_PAGE_SIZE_MTU_STRIDE_SHIFT 27
+#define    RX_PAGE_SIZE_MTU_OFF_MASK    0xC0000000 /* offset in each page that
+                                                     hw writes the MTU buffer
+                                                     into. 
+                                                     0b00 = 0,  
+                                                     0b01 = 64 bytes
+                                                     0b10 = 96, 0b11 = 128
+                                                     DEFAULT: 0x1 */
+#define    RX_PAGE_SIZE_MTU_OFF_SHIFT   30
+                                                        
+/* 11-bit counter points to next location in RX FIFO to be loaded/read. 
+ * shadow write pointers enable retries in case of early receive aborts.
+ * DEFAULT: 0x0. generated on 64-bit boundaries.
+ */
+#define  REG_RX_FIFO_WRITE_PTR             0x4008  /* RX FIFO write pointer */
+#define  REG_RX_FIFO_READ_PTR              0x400C  /* RX FIFO read pointer */
+#define  REG_RX_IPP_FIFO_SHADOW_WRITE_PTR  0x4010  /* RX IPP FIFO shadow write 
+                                                     pointer */
+#define  REG_RX_IPP_FIFO_SHADOW_READ_PTR   0x4014  /* RX IPP FIFO shadow read
+                                                     pointer */
+#define  REG_RX_IPP_FIFO_READ_PTR          0x400C  /* RX IPP FIFO read 
+                                                     pointer. (8-bit counter) */
+
+/* current state of RX DMA state engines + other info
+ * DEFAULT: 0x0
+ */
+#define  REG_RX_DEBUG                      0x401C  /* RX debug */
+#define    RX_DEBUG_LOAD_STATE_MASK        0x0000000F /* load state machine w/ MAC:
+                                                        0x0 = idle,   0x1 = load_bop
+                                                        0x2 = load 1, 0x3 = load 2
+                                                        0x4 = load 3, 0x5 = load 4
+                                                        0x6 = last detect
+                                                        0x7 = wait req
+                                                        0x8 = wait req statuss 1st
+                                                        0x9 = load st
+                                                        0xa = bubble mac
+                                                        0xb = error */
+#define    RX_DEBUG_LM_STATE_MASK          0x00000070 /* load state machine w/ HP and
+                                                        RX FIFO:
+                                                        0x0 = idle,   0x1 = hp xfr
+                                                        0x2 = wait hp ready
+                                                        0x3 = wait flow code
+                                                        0x4 = fifo xfer
+                                                        0x5 = make status
+                                                        0x6 = csum ready
+                                                        0x7 = error */
+#define    RX_DEBUG_FC_STATE_MASK          0x000000180 /* flow control state machine
+                                                        w/ MAC:
+                                                        0x0 = idle
+                                                        0x1 = wait xoff ack
+                                                        0x2 = wait xon
+                                                        0x3 = wait xon ack */
+#define    RX_DEBUG_DATA_STATE_MASK        0x000001E00 /* unload data state machine
+                                                        states: 
+                                                        0x0 = idle data
+                                                        0x1 = header begin
+                                                        0x2 = xfer header
+                                                        0x3 = xfer header ld
+                                                        0x4 = mtu begin
+                                                        0x5 = xfer mtu
+                                                        0x6 = xfer mtu ld
+                                                        0x7 = jumbo begin
+                                                        0x8 = xfer jumbo 
+                                                        0x9 = xfer jumbo ld
+                                                        0xa = reas begin
+                                                        0xb = xfer reas
+                                                        0xc = flush tag
+                                                        0xd = xfer reas ld
+                                                        0xe = error
+                                                        0xf = bubble idle */
+#define    RX_DEBUG_DESC_STATE_MASK        0x0001E000 /* unload desc state machine
+                                                        states:
+                                                        0x0 = idle desc
+                                                        0x1 = wait ack
+                                                        0x9 = wait ack 2
+                                                        0x2 = fetch desc 1
+                                                        0xa = fetch desc 2
+                                                        0x3 = load ptrs
+                                                        0x4 = wait dma
+                                                        0x5 = wait ack batch
+                                                        0x6 = post batch
+                                                        0x7 = xfr done */
+#define    RX_DEBUG_INTR_READ_PTR_MASK     0x30000000 /* interrupt read ptr of the
+                                                        interrupt queue */
+#define    RX_DEBUG_INTR_WRITE_PTR_MASK    0xC0000000 /* interrupt write pointer
+                                                        of the interrupt queue */
+
+/* flow control frames are emmitted using two PAUSE thresholds:
+ * XOFF PAUSE uses pause time value pre-programmed in the Send PAUSE MAC reg
+ * XON PAUSE uses a pause time of 0. granularity of threshold is 64bytes.
+ * PAUSE thresholds defined in terms of FIFO occupancy and may be translated
+ * into FIFO vacancy using RX_FIFO_SIZE. setting ON will trigger XON frames 
+ * when FIFO reaches 0. OFF threshold should not be > size of RX FIFO. max
+ * value is is 0x6F. 
+ * DEFAULT: 0x00078
+ */
+#define  REG_RX_PAUSE_THRESH               0x4020  /* RX pause thresholds */
+#define    RX_PAUSE_THRESH_QUANTUM         64
+#define    RX_PAUSE_THRESH_OFF_MASK        0x000001FF /* XOFF PAUSE emitted when
+                                                        RX FIFO occupancy > 
+                                                        value*64B */
+#define    RX_PAUSE_THRESH_OFF_SHIFT       0
+#define    RX_PAUSE_THRESH_ON_MASK         0x001FF000 /* XON PAUSE emitted after
+                                                        emitting XOFF PAUSE when RX
+                                                        FIFO occupancy falls below
+                                                        this value*64B. must be
+                                                        < XOFF threshold. if =
+                                                        RX_FIFO_SIZE< XON frames are
+                                                        never emitted. */
+#define    RX_PAUSE_THRESH_ON_SHIFT        12
+
+/* 13-bit register used to control RX desc fetching and intr generation. if 4+
+ * valid RX descriptors are available, Cassini will read 4 at a time. 
+ * writing N means that all desc up to *but* excluding N are available. N must
+ * be a multiple of 4 (N % 4 = 0). first desc should be cache-line aligned. 
+ * DEFAULT: 0 on reset
+ */
+#define  REG_RX_KICK                    0x4024  /* RX kick reg */
+
+/* 8KB aligned 64-bit pointer to the base of the RX free/completion rings.
+ * lower 13 bits of the low register are hard-wired to 0.
+ */
+#define  REG_RX_DB_LOW                     0x4028  /* RX descriptor ring 
+                                                        base low */
+#define  REG_RX_DB_HI                      0x402C  /* RX descriptor ring
+                                                        base hi */
+#define  REG_RX_CB_LOW                     0x4030  /* RX completion ring
+                                                        base low */
+#define  REG_RX_CB_HI                      0x4034  /* RX completion ring 
+                                                        base hi */
+/* 13-bit register indicate desc used by cassini for receive frames. used
+ * for diagnostic purposes. 
+ * DEFAULT: 0 on reset
+ */
+#define  REG_RX_COMP                       0x4038  /* (ro) RX completion */
+
+/* HEAD and TAIL are used to control RX desc posting and interrupt
+ * generation.  hw moves the head register to pass ownership to sw. sw
+ * moves the tail register to pass ownership back to hw. to give all
+ * entries to hw, set TAIL = HEAD.  if HEAD and TAIL indicate that no
+ * more entries are available, DMA will pause and an interrupt will be
+ * generated to indicate no more entries are available.  sw can use
+ * this interrupt to reduce the # of times it must update the
+ * completion tail register.
+ * DEFAULT: 0 on reset
+ */
+#define  REG_RX_COMP_HEAD                  0x403C  /* RX completion head */
+#define  REG_RX_COMP_TAIL                  0x4040  /* RX completion tail */
+
+/* values used for receive interrupt blanking. loaded each time the ISR is read
+ * DEFAULT: 0x00000000
+ */
+#define  REG_RX_BLANK                      0x4044  /* RX blanking register 
+                                                        for ISR read */
+#define    RX_BLANK_INTR_PKT_MASK          0x000001FF /* RX_DONE intr asserted if 
+                                                        this many sets of completion
+                                                        writebacks (up to 2 packets)
+                                                        occur since the last time
+                                                        the ISR was read. 0 = no
+                                                        packet blanking */
+#define    RX_BLANK_INTR_PKT_SHIFT         0
+#define    RX_BLANK_INTR_TIME_MASK         0x3FFFF000 /* RX_DONE interrupt asserted
+                                                        if that many clocks were
+                                                        counted since last time the
+                                                        ISR was read. 
+                                                        each count is 512 core
+                                                        clocks (125MHz). 0 = no
+                                                        time blanking */
+#define    RX_BLANK_INTR_TIME_SHIFT        12
+
+/* values used for interrupt generation based on threshold values of how 
+ * many free desc and completion entries are available for hw use.
+ * DEFAULT: 0x00000000
+ */
+#define  REG_RX_AE_THRESH                  0x4048  /* RX almost empty 
+                                                        thresholds */
+#define    RX_AE_THRESH_FREE_MASK          0x00001FFF /* RX_BUF_AE will be 
+                                                        generated if # desc
+                                                        avail for hw use <= 
+                                                        # */
+#define    RX_AE_THRESH_FREE_SHIFT         0
+#define    RX_AE_THRESH_COMP_MASK          0x0FFFE000 /* RX_COMP_AE will be
+                                                        generated if # of 
+                                                        completion entries
+                                                        avail for hw use <= 
+                                                        # */
+#define    RX_AE_THRESH_COMP_SHIFT         13
+
+/* probabilities for random early drop (RED) thresholds on a FIFO threshold 
+ * basis. probability should increase when the FIFO level increases. control 
+ * packets are never dropped and not counted in stats. probability programmed 
+ * on a 12.5% granularity. e.g., 0x1 = 1/8 packets dropped.
+ * DEFAULT: 0x00000000
+ */
+#define  REG_RX_RED                      0x404C  /* RX random early detect enable */
+#define    RX_RED_4K_6K_FIFO_MASK        0x000000FF /*  4KB < FIFO thresh < 6KB */
+#define    RX_RED_6K_8K_FIFO_MASK        0x0000FF00 /*  6KB < FIFO thresh < 8KB */
+#define    RX_RED_8K_10K_FIFO_MASK       0x00FF0000 /*  8KB < FIFO thresh < 10KB */
+#define    RX_RED_10K_12K_FIFO_MASK      0xFF000000 /* 10KB < FIFO thresh < 12KB */
+
+/* FIFO fullness levels for RX FIFO, RX control FIFO, and RX IPP FIFO. 
+ * RX control FIFO = # of packets in RX FIFO. 
+ * DEFAULT: 0x0
+ */
+#define  REG_RX_FIFO_FULLNESS              0x4050  /* (ro) RX FIFO fullness */
+#define    RX_FIFO_FULLNESS_RX_FIFO_MASK   0x3FF80000 /* level w/ 8B granularity */
+#define    RX_FIFO_FULLNESS_IPP_FIFO_MASK  0x0007FF00 /* level w/ 8B granularity */
+#define    RX_FIFO_FULLNESS_RX_PKT_MASK    0x000000FF /* # packets in RX FIFO */
+#define  REG_RX_IPP_PACKET_COUNT           0x4054  /* RX IPP packet counter */
+#define  REG_RX_WORK_DMA_PTR_LOW           0x4058  /* RX working DMA ptr low */
+#define  REG_RX_WORK_DMA_PTR_HI            0x405C  /* RX working DMA ptr 
+                                                     high */
+
+/* BIST testing ro RX FIFO, RX control FIFO, and RX IPP FIFO. only RX BIST
+ * START/COMPLETE is writeable. START will clear when the BIST has completed
+ * checking all 17 RAMS. 
+ * DEFAULT: 0bxxxx xxxxx xxxx xxxx xxxx x000 0000 0000 00x0
+ */
+#define  REG_RX_BIST                       0x4060  /* (ro) RX BIST */
+#define    RX_BIST_32A_PASS                0x80000000 /* RX FIFO 32A passed */
+#define    RX_BIST_33A_PASS                0x40000000 /* RX FIFO 33A passed */
+#define    RX_BIST_32B_PASS                0x20000000 /* RX FIFO 32B passed */
+#define    RX_BIST_33B_PASS                0x10000000 /* RX FIFO 33B passed */
+#define    RX_BIST_32C_PASS                0x08000000 /* RX FIFO 32C passed */
+#define    RX_BIST_33C_PASS                0x04000000 /* RX FIFO 33C passed */
+#define    RX_BIST_IPP_32A_PASS            0x02000000 /* RX IPP FIFO 33B passed */
+#define    RX_BIST_IPP_33A_PASS            0x01000000 /* RX IPP FIFO 33A passed */
+#define    RX_BIST_IPP_32B_PASS            0x00800000 /* RX IPP FIFO 32B passed */
+#define    RX_BIST_IPP_33B_PASS            0x00400000 /* RX IPP FIFO 33B passed */
+#define    RX_BIST_IPP_32C_PASS            0x00200000 /* RX IPP FIFO 32C passed */
+#define    RX_BIST_IPP_33C_PASS            0x00100000 /* RX IPP FIFO 33C passed */
+#define    RX_BIST_CTRL_32_PASS            0x00800000 /* RX CTRL FIFO 32 passed */
+#define    RX_BIST_CTRL_33_PASS            0x00400000 /* RX CTRL FIFO 33 passed */
+#define    RX_BIST_REAS_26A_PASS           0x00200000 /* RX Reas 26A passed */
+#define    RX_BIST_REAS_26B_PASS           0x00100000 /* RX Reas 26B passed */
+#define    RX_BIST_REAS_27_PASS            0x00080000 /* RX Reas 27 passed */
+#define    RX_BIST_STATE_MASK              0x00078000 /* BIST state machine */
+#define    RX_BIST_SUMMARY                 0x00000002 /* when BIST complete,
+                                                        summary pass bit 
+                                                        contains AND of BIST
+                                                        results of all 16
+                                                        RAMS */
+#define    RX_BIST_START                   0x00000001 /* write 1 to start 
+                                                        BIST. self clears
+                                                        on completion. */
+
+/* next location in RX CTRL FIFO that will be loaded w/ data from RX IPP/read
+ * from to retrieve packet control info. 
+ * DEFAULT: 0
+ */
+#define  REG_RX_CTRL_FIFO_WRITE_PTR        0x4064  /* (ro) RX control FIFO 
+                                                     write ptr */
+#define  REG_RX_CTRL_FIFO_READ_PTR         0x4068  /* (ro) RX control FIFO read
+                                                     ptr */
+
+/* receive interrupt blanking. loaded each time interrupt alias register is
+ * read. 
+ * DEFAULT: 0x0
+ */
+#define  REG_RX_BLANK_ALIAS_READ           0x406C  /* RX blanking register for
+                                                     alias read */
+#define    RX_BAR_INTR_PACKET_MASK         0x000001FF /* assert RX_DONE if # 
+                                                        completion writebacks 
+                                                        > # since last ISR 
+                                                        read. 0 = no 
+                                                        blanking. up to 2 
+                                                        packets per 
+                                                        completion wb. */
+#define    RX_BAR_INTR_TIME_MASK           0x3FFFF000 /* assert RX_DONE if #
+                                                        clocks > # since last
+                                                        ISR read. each count
+                                                        is 512 core clocks
+                                                        (125MHz). 0 = no 
+                                                        blanking. */
+
+/* diagnostic access to RX FIFO. 32 LSB accessed via DATA_LOW. 32 MSB accessed
+ * via DATA_HI_T0 or DATA_HI_T1. TAG reads the tag bit. writing HI_T0
+ * will unset the tag bit while writing HI_T1 will set the tag bit. to reset
+ * to normal operation after diagnostics, write to address location 0x0.
+ * RX_DMA_EN bit must be set to 0x0 for RX FIFO PIO access. DATA_HI should
+ * be the last write access of a write sequence.
+ * DEFAULT: undefined
+ */
+#define  REG_RX_FIFO_ADDR                  0x4080  /* RX FIFO address */
+#define  REG_RX_FIFO_TAG                   0x4084  /* RX FIFO tag */
+#define  REG_RX_FIFO_DATA_LOW              0x4088  /* RX FIFO data low */
+#define  REG_RX_FIFO_DATA_HI_T0            0x408C  /* RX FIFO data high T0 */
+#define  REG_RX_FIFO_DATA_HI_T1            0x4090  /* RX FIFO data high T1 */
+
+/* diagnostic assess to RX CTRL FIFO. 8-bit FIFO_ADDR holds address of
+ * 81 bit control entry and 6 bit flow id. LOW and MID are both 32-bit
+ * accesses. HI is 7-bits with 6-bit flow id and 1 bit control
+ * word. RX_DMA_EN must be 0 for RX CTRL FIFO PIO access. DATA_HI
+ * should be last write access of the write sequence.
+ * DEFAULT: undefined
+ */
+#define  REG_RX_CTRL_FIFO_ADDR             0x4094  /* RX Control FIFO and 
+                                                     Batching FIFO addr */
+#define  REG_RX_CTRL_FIFO_DATA_LOW         0x4098  /* RX Control FIFO data 
+                                                     low */
+#define  REG_RX_CTRL_FIFO_DATA_MID         0x409C  /* RX Control FIFO data 
+                                                     mid */
+#define  REG_RX_CTRL_FIFO_DATA_HI          0x4100  /* RX Control FIFO data 
+                                                     hi and flow id */
+#define    RX_CTRL_FIFO_DATA_HI_CTRL       0x0001  /* upper bit of ctrl word */
+#define    RX_CTRL_FIFO_DATA_HI_FLOW_MASK  0x007E  /* flow id */
+
+/* diagnostic access to RX IPP FIFO. same semantics as RX_FIFO.
+ * DEFAULT: undefined
+ */
+#define  REG_RX_IPP_FIFO_ADDR              0x4104  /* RX IPP FIFO address */
+#define  REG_RX_IPP_FIFO_TAG               0x4108  /* RX IPP FIFO tag */
+#define  REG_RX_IPP_FIFO_DATA_LOW          0x410C  /* RX IPP FIFO data low */
+#define  REG_RX_IPP_FIFO_DATA_HI_T0        0x4110  /* RX IPP FIFO data high
+                                                     T0 */
+#define  REG_RX_IPP_FIFO_DATA_HI_T1        0x4114  /* RX IPP FIFO data high
+                                                     T1 */
+
+/* 64-bit pointer to receive data buffer in host memory used for headers and
+ * small packets. MSB in high register. loaded by DMA state machine and 
+ * increments as DMA writes receive data. only 50 LSB are incremented. top
+ * 13 bits taken from RX descriptor.
+ * DEFAULT: undefined
+ */
+#define  REG_RX_HEADER_PAGE_PTR_LOW        0x4118  /* (ro) RX header page ptr
+                                                     low */
+#define  REG_RX_HEADER_PAGE_PTR_HI         0x411C  /* (ro) RX header page ptr
+                                                     high */
+#define  REG_RX_MTU_PAGE_PTR_LOW           0x4120  /* (ro) RX MTU page pointer 
+                                                     low */
+#define  REG_RX_MTU_PAGE_PTR_HI            0x4124  /* (ro) RX MTU page pointer 
+                                                     high */
+
+/* PIO diagnostic access to RX reassembly DMA Table RAM. 6-bit register holds
+ * one of 64 79-bit locations in the RX Reassembly DMA table and the addr of
+ * one of the 64 byte locations in the Batching table. LOW holds 32 LSB. 
+ * MID holds the next 32 LSB. HIGH holds the 15 MSB. RX_DMA_EN must be set
+ * to 0 for PIO access. DATA_HIGH should be last write of write sequence.
+ * layout:  
+ * reassmbl ptr [78:15] | reassmbl index [14:1] | reassmbl entry valid [0]
+ * DEFAULT: undefined
+ */
+#define  REG_RX_TABLE_ADDR             0x4128  /* RX reassembly DMA table
+                                                 address */
+#define    RX_TABLE_ADDR_MASK          0x0000003F /* address mask */
+
+#define  REG_RX_TABLE_DATA_LOW         0x412C  /* RX reassembly DMA table
+                                                 data low */
+#define  REG_RX_TABLE_DATA_MID         0x4130  /* RX reassembly DMA table 
+                                                 data mid */
+#define  REG_RX_TABLE_DATA_HI          0x4134  /* RX reassembly DMA table
+                                                 data high */
+
+/* cassini+ only */
+/* 8KB aligned 64-bit pointer to base of RX rings. lower 13 bits hardwired to
+ * 0. same semantics as primary desc/complete rings.
+ */
+#define  REG_PLUS_RX_DB1_LOW            0x4200  /* RX descriptor ring
+                                                  2 base low */
+#define  REG_PLUS_RX_DB1_HI             0x4204  /* RX descriptor ring
+                                                  2 base high */
+#define  REG_PLUS_RX_CB1_LOW            0x4208  /* RX completion ring
+                                                  2 base low. 4 total */
+#define  REG_PLUS_RX_CB1_HI             0x420C  /* RX completion ring
+                                                  2 base high. 4 total */
+#define  REG_PLUS_RX_CBN_LOW(x)        (REG_PLUS_RX_CB1_LOW + 8*((x) - 1))
+#define  REG_PLUS_RX_CBN_HI(x)         (REG_PLUS_RX_CB1_HI + 8*((x) - 1))
+#define  REG_PLUS_RX_KICK1             0x4220  /* RX Kick 2 register */
+#define  REG_PLUS_RX_COMP1             0x4224  /* (ro) RX completion 2 
+                                                 reg */
+#define  REG_PLUS_RX_COMP1_HEAD        0x4228  /* (ro) RX completion 2 
+                                                 head reg. 4 total. */
+#define  REG_PLUS_RX_COMP1_TAIL        0x422C  /* RX completion 2 
+                                                 tail reg. 4 total. */
+#define  REG_PLUS_RX_COMPN_HEAD(x)    (REG_PLUS_RX_COMP1_HEAD + 8*((x) - 1))
+#define  REG_PLUS_RX_COMPN_TAIL(x)    (REG_PLUS_RX_COMP1_TAIL + 8*((x) - 1))
+#define  REG_PLUS_RX_AE1_THRESH        0x4240  /* RX almost empty 2
+                                                 thresholds */
+#define    RX_AE1_THRESH_FREE_MASK     RX_AE_THRESH_FREE_MASK
+#define    RX_AE1_THRESH_FREE_SHIFT    RX_AE_THRESH_FREE_SHIFT
+
+/** header parser registers **/
+
+/* RX parser configuration register. 
+ * DEFAULT: 0x1651004
+ */
+#define  REG_HP_CFG                       0x4140  /* header parser 
+                                                    configuration reg */
+#define    HP_CFG_PARSE_EN                0x00000001 /* enab header parsing */
+#define    HP_CFG_NUM_CPU_MASK            0x000000FC /* # processors 
+                                                     0 = 64. 0x3f = 63 */
+#define    HP_CFG_NUM_CPU_SHIFT           2
+#define    HP_CFG_SYN_INC_MASK            0x00000100 /* SYN bit won't increment
+                                                       TCP seq # by one when
+                                                       stored in FDBM */
+#define    HP_CFG_TCP_THRESH_MASK         0x000FFE00 /* # bytes of TCP data
+                                                       needed to be considered
+                                                       for reassembly */
+#define    HP_CFG_TCP_THRESH_SHIFT        9
+
+/* access to RX Instruction RAM. 5-bit register/counter holds addr
+ * of 39 bit entry to be read/written. 32 LSB in _DATA_LOW. 7 MSB in _DATA_HI.
+ * RX_DMA_EN must be 0 for RX instr PIO access. DATA_HI should be last access
+ * of sequence. 
+ * DEFAULT: undefined
+ */
+#define  REG_HP_INSTR_RAM_ADDR             0x4144  /* HP instruction RAM
+                                                     address */
+#define    HP_INSTR_RAM_ADDR_MASK          0x01F   /* 5-bit mask */
+#define  REG_HP_INSTR_RAM_DATA_LOW         0x4148  /* HP instruction RAM
+                                                     data low */
+#define    HP_INSTR_RAM_LOW_OUTMASK_MASK   0x0000FFFF
+#define    HP_INSTR_RAM_LOW_OUTMASK_SHIFT  0
+#define    HP_INSTR_RAM_LOW_OUTSHIFT_MASK  0x000F0000
+#define    HP_INSTR_RAM_LOW_OUTSHIFT_SHIFT 16
+#define    HP_INSTR_RAM_LOW_OUTEN_MASK     0x00300000
+#define    HP_INSTR_RAM_LOW_OUTEN_SHIFT    20
+#define    HP_INSTR_RAM_LOW_OUTARG_MASK    0xFFC00000
+#define    HP_INSTR_RAM_LOW_OUTARG_SHIFT   22
+#define  REG_HP_INSTR_RAM_DATA_MID         0x414C  /* HP instruction RAM 
+                                                     data mid */
+#define    HP_INSTR_RAM_MID_OUTARG_MASK    0x00000003
+#define    HP_INSTR_RAM_MID_OUTARG_SHIFT   0
+#define    HP_INSTR_RAM_MID_OUTOP_MASK     0x0000003C
+#define    HP_INSTR_RAM_MID_OUTOP_SHIFT    2
+#define    HP_INSTR_RAM_MID_FNEXT_MASK     0x000007C0
+#define    HP_INSTR_RAM_MID_FNEXT_SHIFT    6
+#define    HP_INSTR_RAM_MID_FOFF_MASK      0x0003F800
+#define    HP_INSTR_RAM_MID_FOFF_SHIFT     11
+#define    HP_INSTR_RAM_MID_SNEXT_MASK     0x007C0000
+#define    HP_INSTR_RAM_MID_SNEXT_SHIFT    18
+#define    HP_INSTR_RAM_MID_SOFF_MASK      0x3F800000
+#define    HP_INSTR_RAM_MID_SOFF_SHIFT     23
+#define    HP_INSTR_RAM_MID_OP_MASK        0xC0000000
+#define    HP_INSTR_RAM_MID_OP_SHIFT       30
+#define  REG_HP_INSTR_RAM_DATA_HI          0x4150  /* HP instruction RAM
+                                                     data high */
+#define    HP_INSTR_RAM_HI_VAL_MASK        0x0000FFFF
+#define    HP_INSTR_RAM_HI_VAL_SHIFT       0
+#define    HP_INSTR_RAM_HI_MASK_MASK       0xFFFF0000
+#define    HP_INSTR_RAM_HI_MASK_SHIFT      16
+
+/* PIO access into RX Header parser data RAM and flow database.
+ * 11-bit register. Data fills the LSB portion of bus if less than 32 bits.
+ * DATA_RAM: write RAM_FDB_DATA with index to access DATA_RAM.
+ * RAM bytes = 4*(x - 1) + [3:0]. e.g., 0 -> [3:0], 31 -> [123:120]
+ * FLOWDB: write DATA_RAM_FDB register and then read/write FDB1-12 to access 
+ * flow database.
+ * RX_DMA_EN must be 0 for RX parser RAM PIO access. RX Parser RAM data reg
+ * should be the last write access of the write sequence.
+ * DEFAULT: undefined
+ */
+#define  REG_HP_DATA_RAM_FDB_ADDR          0x4154  /* HP data and FDB
+                                                     RAM address */
+#define    HP_DATA_RAM_FDB_DATA_MASK       0x001F  /* select 1 of 86 byte 
+                                                     locations in header 
+                                                     parser data ram to 
+                                                     read/write */
+#define    HP_DATA_RAM_FDB_FDB_MASK        0x3F00  /* 1 of 64 353-bit locations
+                                                     in the flow database */
+#define  REG_HP_DATA_RAM_DATA              0x4158  /* HP data RAM data */
+
+/* HP flow database registers: 1 - 12, 0x415C - 0x4188, 4 8-bit bytes 
+ * FLOW_DB(1) = IP_SA[127:96], FLOW_DB(2) = IP_SA[95:64]
+ * FLOW_DB(3) = IP_SA[63:32],  FLOW_DB(4) = IP_SA[31:0] 
+ * FLOW_DB(5) = IP_DA[127:96], FLOW_DB(6) = IP_DA[95:64]
+ * FLOW_DB(7) = IP_DA[63:32],  FLOW_DB(8) = IP_DA[31:0]
+ * FLOW_DB(9) = {TCP_SP[15:0],TCP_DP[15:0]}
+ * FLOW_DB(10) = bit 0 has value for flow valid
+ * FLOW_DB(11) = TCP_SEQ[63:32], FLOW_DB(12) = TCP_SEQ[31:0]
+ */
+#define  REG_HP_FLOW_DB0                   0x415C  /* HP flow database 1 reg */
+#define  REG_HP_FLOW_DBN(x)                (REG_HP_FLOW_DB0 + (x)*4)
+
+/* diagnostics for RX Header Parser block. 
+ * ASUN: the header parser state machine register is used for diagnostics
+ * purposes. however, the spec doesn't have any details on it.
+ */
+#define  REG_HP_STATE_MACHINE              0x418C  /* (ro) HP state machine */
+#define  REG_HP_STATUS0                    0x4190  /* (ro) HP status 1 */
+#define    HP_STATUS0_SAP_MASK             0xFFFF0000 /* SAP */
+#define    HP_STATUS0_L3_OFF_MASK          0x0000FE00 /* L3 offset */
+#define    HP_STATUS0_LB_CPUNUM_MASK       0x000001F8 /* load balancing CPU 
+                                                        number */
+#define    HP_STATUS0_HRP_OPCODE_MASK      0x00000007 /* HRP opcode */
+
+#define  REG_HP_STATUS1                    0x4194  /* (ro) HP status 2 */
+#define    HP_STATUS1_ACCUR2_MASK          0xE0000000 /* accu R2[6:4] */
+#define    HP_STATUS1_FLOWID_MASK          0x1F800000 /* flow id */
+#define    HP_STATUS1_TCP_OFF_MASK         0x007F0000 /* tcp payload offset */
+#define    HP_STATUS1_TCP_SIZE_MASK        0x0000FFFF /* tcp payload size */
+
+#define  REG_HP_STATUS2                    0x4198  /* (ro) HP status 3 */
+#define    HP_STATUS2_ACCUR2_MASK          0xF0000000 /* accu R2[3:0] */
+#define    HP_STATUS2_CSUM_OFF_MASK        0x07F00000 /* checksum start 
+                                                        start offset */
+#define    HP_STATUS2_ACCUR1_MASK          0x000FE000 /* accu R1 */
+#define    HP_STATUS2_FORCE_DROP           0x00001000 /* force drop */
+#define    HP_STATUS2_BWO_REASSM           0x00000800 /* batching w/o 
+                                                        reassembly */
+#define    HP_STATUS2_JH_SPLIT_EN          0x00000400 /* jumbo header split
+                                                        enable */
+#define    HP_STATUS2_FORCE_TCP_NOCHECK    0x00000200 /* force tcp no payload
+                                                        check */
+#define    HP_STATUS2_DATA_MASK_ZERO       0x00000100 /* mask of data length
+                                                        equal to zero */
+#define    HP_STATUS2_FORCE_TCP_CHECK      0x00000080 /* force tcp payload 
+                                                        chk */
+#define    HP_STATUS2_MASK_TCP_THRESH      0x00000040 /* mask of payload 
+                                                        threshold */
+#define    HP_STATUS2_NO_ASSIST            0x00000020 /* no assist */
+#define    HP_STATUS2_CTRL_PACKET_FLAG     0x00000010 /* control packet flag */
+#define    HP_STATUS2_TCP_FLAG_CHECK       0x00000008 /* tcp flag check */
+#define    HP_STATUS2_SYN_FLAG             0x00000004 /* syn flag */
+#define    HP_STATUS2_TCP_CHECK            0x00000002 /* tcp payload chk */
+#define    HP_STATUS2_TCP_NOCHECK          0x00000001 /* tcp no payload chk */
+
+/* BIST for header parser(HP) and flow database memories (FDBM). set _START
+ * to start BIST. controller clears _START on completion. _START can also
+ * be cleared to force termination of BIST. a bit set indicates that that
+ * memory passed its BIST.
+ */
+#define  REG_HP_RAM_BIST                   0x419C  /* HP RAM BIST reg */
+#define    HP_RAM_BIST_HP_DATA_PASS        0x80000000 /* HP data ram */
+#define    HP_RAM_BIST_HP_INSTR0_PASS      0x40000000 /* HP instr ram 0 */
+#define    HP_RAM_BIST_HP_INSTR1_PASS      0x20000000 /* HP instr ram 1 */
+#define    HP_RAM_BIST_HP_INSTR2_PASS      0x10000000 /* HP instr ram 2 */
+#define    HP_RAM_BIST_FDBM_AGE0_PASS      0x08000000 /* FDBM aging RAM0 */
+#define    HP_RAM_BIST_FDBM_AGE1_PASS      0x04000000 /* FDBM aging RAM1 */
+#define    HP_RAM_BIST_FDBM_FLOWID00_PASS  0x02000000 /* FDBM flowid RAM0 
+                                                        bank 0 */
+#define    HP_RAM_BIST_FDBM_FLOWID10_PASS  0x01000000 /* FDBM flowid RAM1
+                                                        bank 0 */
+#define    HP_RAM_BIST_FDBM_FLOWID20_PASS  0x00800000 /* FDBM flowid RAM2
+                                                        bank 0 */
+#define    HP_RAM_BIST_FDBM_FLOWID30_PASS  0x00400000 /* FDBM flowid RAM3
+                                                        bank 0 */
+#define    HP_RAM_BIST_FDBM_FLOWID01_PASS  0x00200000 /* FDBM flowid RAM0
+                                                        bank 1 */
+#define    HP_RAM_BIST_FDBM_FLOWID11_PASS  0x00100000 /* FDBM flowid RAM1
+                                                        bank 2 */
+#define    HP_RAM_BIST_FDBM_FLOWID21_PASS  0x00080000 /* FDBM flowid RAM2
+                                                        bank 1 */
+#define    HP_RAM_BIST_FDBM_FLOWID31_PASS  0x00040000 /* FDBM flowid RAM3
+                                                        bank 1 */
+#define    HP_RAM_BIST_FDBM_TCPSEQ_PASS    0x00020000 /* FDBM tcp sequence
+                                                        RAM */
+#define    HP_RAM_BIST_SUMMARY             0x00000002 /* all BIST tests */
+#define    HP_RAM_BIST_START               0x00000001 /* start/stop BIST */
+
+
+/** MAC registers.  **/
+/* reset bits are set using a PIO write and self-cleared after the command
+ * execution has completed.
+ */
+#define  REG_MAC_TX_RESET                  0x6000  /* TX MAC software reset
+                                                     command (default: 0x0) */
+#define  REG_MAC_RX_RESET                  0x6004  /* RX MAC software reset
+                                                     command (default: 0x0) */
+/* execute a pause flow control frame transmission
+ DEFAULT: 0x0XXXX */
+#define  REG_MAC_SEND_PAUSE                0x6008  /* send pause command reg */
+#define    MAC_SEND_PAUSE_TIME_MASK        0x0000FFFF /* value of pause time 
+                                                        to be sent on network
+                                                        in units of slot 
+                                                        times */
+#define    MAC_SEND_PAUSE_SEND             0x00010000 /* send pause flow ctrl
+                                                        frame on network */
+
+/* bit set indicates that event occurred. auto-cleared when status register
+ * is read and have corresponding mask bits in mask register. events will 
+ * trigger an interrupt if the corresponding mask bit is 0. 
+ * status register default: 0x00000000
+ * mask register default = 0xFFFFFFFF on reset
+ */
+#define  REG_MAC_TX_STATUS                 0x6010  /* TX MAC status reg */
+#define    MAC_TX_FRAME_XMIT               0x0001  /* successful frame 
+                                                     transmision */
+#define    MAC_TX_UNDERRUN                 0x0002  /* terminated frame 
+                                                     transmission due to
+                                                     data starvation in the 
+                                                     xmit data path */
+#define    MAC_TX_MAX_PACKET_ERR           0x0004  /* frame exceeds max allowed
+                                                     length passed to TX MAC
+                                                     by the DMA engine */
+#define    MAC_TX_COLL_NORMAL              0x0008  /* rollover of the normal
+                                                     collision counter */
+#define    MAC_TX_COLL_EXCESS              0x0010  /* rollover of the excessive
+                                                     collision counter */
+#define    MAC_TX_COLL_LATE                0x0020  /* rollover of the late
+                                                     collision counter */
+#define    MAC_TX_COLL_FIRST               0x0040  /* rollover of the first
+                                                     collision counter */
+#define    MAC_TX_DEFER_TIMER              0x0080  /* rollover of the defer
+                                                     timer */
+#define    MAC_TX_PEAK_ATTEMPTS            0x0100  /* rollover of the peak
+                                                     attempts counter */
+
+#define  REG_MAC_RX_STATUS                 0x6014  /* RX MAC status reg */
+#define    MAC_RX_FRAME_RECV               0x0001  /* successful receipt of
+                                                     a frame */
+#define    MAC_RX_OVERFLOW                 0x0002  /* dropped frame due to 
+                                                     RX FIFO overflow */
+#define    MAC_RX_FRAME_COUNT              0x0004  /* rollover of receive frame
+                                                     counter */
+#define    MAC_RX_ALIGN_ERR                0x0008  /* rollover of alignment
+                                                     error counter */
+#define    MAC_RX_CRC_ERR                  0x0010  /* rollover of crc error
+                                                     counter */
+#define    MAC_RX_LEN_ERR                  0x0020  /* rollover of length 
+                                                     error counter */
+#define    MAC_RX_VIOL_ERR                 0x0040  /* rollover of code 
+                                                     violation error */
+
+/* DEFAULT: 0xXXXX0000 on reset */
+#define  REG_MAC_CTRL_STATUS               0x6018  /* MAC control status reg */
+#define    MAC_CTRL_PAUSE_RECEIVED         0x00000001  /* successful 
+                                                         reception of a 
+                                                         pause control 
+                                                         frame */
+#define    MAC_CTRL_PAUSE_STATE            0x00000002  /* MAC has made a 
+                                                         transition from 
+                                                         "not paused" to 
+                                                         "paused" */
+#define    MAC_CTRL_NOPAUSE_STATE          0x00000004  /* MAC has made a 
+                                                         transition from 
+                                                         "paused" to "not
+                                                         paused" */
+#define    MAC_CTRL_PAUSE_TIME_MASK        0xFFFF0000  /* value of pause time
+                                                         operand that was 
+                                                         received in the last
+                                                         pause flow control
+                                                         frame */
+
+/* layout identical to TX MAC[8:0] */
+#define  REG_MAC_TX_MASK                   0x6020  /* TX MAC mask reg */
+/* layout identical to RX MAC[6:0] */
+#define  REG_MAC_RX_MASK                   0x6024  /* RX MAC mask reg */
+/* layout identical to CTRL MAC[2:0] */
+#define  REG_MAC_CTRL_MASK                 0x6028  /* MAC control mask reg */
+
+/* to ensure proper operation, CFG_EN must be cleared to 0 and a delay 
+ * imposed before writes to other bits in the TX_MAC_CFG register or any of
+ * the MAC parameters is performed. delay dependent upon time required to
+ * transmit a maximum size frame (= MAC_FRAMESIZE_MAX*8/Mbps). e.g.,
+ * the delay for a 1518-byte frame on a 100Mbps network is 125us. 
+ * alternatively, just poll TX_CFG_EN until it reads back as 0. 
+ * NOTE: on half-duplex 1Gbps, TX_CFG_CARRIER_EXTEND and 
+ * RX_CFG_CARRIER_EXTEND should be set and the SLOT_TIME register should
+ * be 0x200 (slot time of 512 bytes)
+ */
+#define  REG_MAC_TX_CFG                 0x6030  /* TX MAC config reg */
+#define    MAC_TX_CFG_EN                0x0001  /* enable TX MAC. 0 will
+                                                     force TXMAC state
+                                                     machine to remain in
+                                                     idle state or to 
+                                                     transition to idle state
+                                                     on completion of an
+                                                     ongoing packet. */
+#define    MAC_TX_CFG_IGNORE_CARRIER    0x0002  /* disable CSMA/CD deferral
+                                                  process. set to 1 when 
+                                                  full duplex and 0 when
+                                                  half duplex */
+#define    MAC_TX_CFG_IGNORE_COLL       0x0004  /* disable CSMA/CD backoff
+                                                  algorithm. set to 1 when
+                                                  full duplex and 0 when
+                                                  half duplex */
+#define    MAC_TX_CFG_IPG_EN            0x0008  /* enable extension of the
+                                                  Rx-to-TX IPG. after 
+                                                  receiving a frame, TX 
+                                                  MAC will reset its 
+                                                  deferral process to 
+                                                  carrier sense for the
+                                                  amount of time = IPG0 +
+                                                  IPG1 and commit to 
+                                                  transmission for time
+                                                  specified in IPG2. when
+                                                  0 or when xmitting frames
+                                                  back-to-pack (Tx-to-Tx
+                                                  IPG), TX MAC ignores 
+                                                  IPG0 and will only use
+                                                  IPG1 for deferral time.
+                                                  IPG2 still used. */
+#define    MAC_TX_CFG_NEVER_GIVE_UP_EN  0x0010  /* TX MAC will not easily
+                                                  give up on frame 
+                                                  xmission. if backoff 
+                                                  algorithm reaches the
+                                                  ATTEMPT_LIMIT, it will
+                                                  clear attempts counter
+                                                  and continue trying to
+                                                  send the frame as 
+                                                  specified by 
+                                                  GIVE_UP_LIM. when 0,
+                                                  TX MAC will execute 
+                                                  standard CSMA/CD prot. */
+#define    MAC_TX_CFG_NEVER_GIVE_UP_LIM 0x0020  /* when set, TX MAC will
+                                                  continue to try to xmit
+                                                  until successful. when
+                                                  0, TX MAC will continue
+                                                  to try xmitting until
+                                                  successful or backoff
+                                                  algorithm reaches 
+                                                  ATTEMPT_LIMIT*16 */
+#define    MAC_TX_CFG_NO_BACKOFF        0x0040  /* modify CSMA/CD to disable
+                                                  backoff algorithm. TX
+                                                  MAC will not back off
+                                                  after a xmission attempt
+                                                  that resulted in a 
+                                                  collision. */
+#define    MAC_TX_CFG_SLOW_DOWN         0x0080  /* modify CSMA/CD so that
+                                                  deferral process is reset
+                                                  in response to carrier
+                                                  sense during the entire
+                                                  duration of IPG. TX MAC
+                                                  will only commit to frame
+                                                  xmission after frame
+                                                  xmission has actually
+                                                  begun. */
+#define    MAC_TX_CFG_NO_FCS            0x0100  /* TX MAC will not generate
+                                                  CRC for all xmitted
+                                                  packets. when clear, CRC
+                                                  generation is dependent
+                                                  upon NO_CRC bit in the
+                                                  xmit control word from 
+                                                  TX DMA */
+#define    MAC_TX_CFG_CARRIER_EXTEND    0x0200  /* enables xmit part of the
+                                                  carrier extension 
+                                                  feature. this allows for 
+                                                  longer collision domains
+                                                  by extending the carrier
+                                                  and collision window
+                                                  from the end of FCS until
+                                                  the end of the slot time
+                                                  if necessary. Required
+                                                  for half-duplex at 1Gbps,
+                                                  clear otherwise. */
+
+/* when CRC is not stripped, reassembly packets will not contain the CRC. 
+ * these will be stripped by HRP because it reassembles layer 4 data, and the
+ * CRC is layer 2. however, non-reassembly packets will still contain the CRC 
+ * when passed to the host. to ensure proper operation, need to wait 3.2ms
+ * after clearing RX_CFG_EN before writing to any other RX MAC registers
+ * or other MAC parameters. alternatively, poll RX_CFG_EN until it clears
+ * to 0. similary, HASH_FILTER_EN and ADDR_FILTER_EN have the same 
+ * restrictions as CFG_EN.
+ */
+#define  REG_MAC_RX_CFG                 0x6034  /* RX MAC config reg */
+#define    MAC_RX_CFG_EN                0x0001  /* enable RX MAC */
+#define    MAC_RX_CFG_STRIP_PAD         0x0002  /* always program to 0.
+                                                  feature not supported */
+#define    MAC_RX_CFG_STRIP_FCS         0x0004  /* RX MAC will strip the 
+                                                  last 4 bytes of a 
+                                                  received frame. */
+#define    MAC_RX_CFG_PROMISC_EN        0x0008  /* promiscuous mode */
+#define    MAC_RX_CFG_PROMISC_GROUP_EN  0x0010  /* accept all valid 
+                                                  multicast frames (group
+                                                  bit in DA field set) */
+#define    MAC_RX_CFG_HASH_FILTER_EN    0x0020  /* use hash table to filter
+                                                  multicast addresses */
+#define    MAC_RX_CFG_ADDR_FILTER_EN    0x0040  /* cause RX MAC to use 
+                                                  address filtering regs 
+                                                  to filter both unicast
+                                                  and multicast 
+                                                  addresses */
+#define    MAC_RX_CFG_DISABLE_DISCARD   0x0080  /* pass errored frames to
+                                                  RX DMA by setting BAD
+                                                  bit but not Abort bit
+                                                  in the status. CRC, 
+                                                  framing, and length errs
+                                                  will not increment 
+                                                  error counters. frames
+                                                  which don't match dest
+                                                  addr will be passed up
+                                                  w/ BAD bit set. */
+#define    MAC_RX_CFG_CARRIER_EXTEND    0x0100  /* enable reception of 
+                                                  packet bursts generated
+                                                  by carrier extension
+                                                  with packet bursting
+                                                  senders. only applies
+                                                  to half-duplex 1Gbps */
+
+/* DEFAULT: 0x0 */
+#define  REG_MAC_CTRL_CFG               0x6038  /* MAC control config reg */
+#define    MAC_CTRL_CFG_SEND_PAUSE_EN   0x0001  /* respond to requests for 
+                                                  sending pause flow ctrl 
+                                                  frames */
+#define    MAC_CTRL_CFG_RECV_PAUSE_EN   0x0002  /* respond to received 
+                                                  pause flow ctrl frames */
+#define    MAC_CTRL_CFG_PASS_CTRL       0x0004  /* pass valid MAC ctrl
+                                                  packets to RX DMA */
+
+/* to ensure proper operation, a global initialization sequence should be
+ * performed when a loopback config is entered or exited. if programmed after
+ * a hw or global sw reset, RX/TX MAC software reset and initialization 
+ * should be done to ensure stable clocking. 
+ * DEFAULT: 0x0
+ */
+#define  REG_MAC_XIF_CFG                0x603C  /* XIF config reg */
+#define    MAC_XIF_TX_MII_OUTPUT_EN        0x0001  /* enable output drivers
+                                                     on MII xmit bus */
+#define    MAC_XIF_MII_INT_LOOPBACK        0x0002  /* loopback GMII xmit data
+                                                     path to GMII recv data
+                                                     path. phy mode register
+                                                     clock selection must be
+                                                     set to GMII mode and 
+                                                     GMII_MODE should be set
+                                                     to 1. in loopback mode,
+                                                &nbs