 |
|
| If you can't view the Datasheet, Please click here to try to view without PDF Reader . |
|
|
|
| If you can't view the Datasheet, Please click here to try to view without PDF Reader . |
|
|
| Datasheet File OCR Text: |
| 57xx-pg105-r 5300 california avenue ? irvine, ca 92617 ? phone: 949-926-5000 ? fax: 949-926-5203 01/29/08 programmer?s guide bcm57xx host programmer interface specification for the netxtreme ? family of highly integrated media access controllers www.datasheet.in
bcm57xx programmer?s guide 01/29/08 broadcom corporation page ii document 57xx-pg105-r r evision h istory revision date description 57xx-pg105-r 01/29/08 updated: ? bus interfaces in table 1: ?family features,? on page 2 ? ?nvram configuration? on page 88 ? step 4 in ?initialization procedure? on page 146 ? added notes to ?indirect register access? on page 186 and ?indirect memory access? on page 188 removed: ? ?nvram control? 57xx-pg104-r 07/13/06 updated: ? asf support parameters for dual mac transceivers in table 1: ?family features,? on page 2. ? BCM5703c and BCM5703s mac transceiver rows in table 2: ?family revision levels,? on page 4. ? ?pseudocode to access nvram in auto access mode? on page 108. ? unique identifier information for bcm5715c and bcm5715s in table 144: ?device id register (offset 0x02),? on page 330. ? bit 9 information in table 184: ?miscellaneous host control register (offset 0x68),? on page 355. ? updated bits 21-31 in table 191: ?pci clock control register definition for bcm5714, and bcm5715 devices,? on page 369. ? bit 5 information table 295: ?hardware auto-negotiation control register (offset 0x5b0, bcm5704s only),? on page 438. ? table 311: ?statistics registers,? on page 445. ? bit 18 information in table 349: ?receive list placement statistics enable mask register (offset 0x2018),? on page 473. ? bits17-16 in table 423: ?read dma mode register (offset 0x4800),? on page 519. ? bit 10 information table 426: ?write dma mode register (offset 0x4c00),? on page 523. ? bits 6-8 in table 450: ?mode control register (offset 0x6800),? on page 545. ? bits 4-6 in table 452: ?miscellaneous local control register (offset 0x6808),? on page 551. ? descriptive text in table 524: ?nvm write register (offset 0x7008),? on page 603. ? descriptive text in table 525: ?nvm address register (offset 0x700c),? on page 603. ? descriptive text in table 526: ?nvm read register (offset 0x7010),? on page 604. ? bit 19, 15, 14, and 13 descriptive text in table 530: ?software arbitration register (offset 0x7020),? on page 607. ? access information in table 627: ?phy receive error counter (offset 0x7e20),? on page 652. ? table 628: ?phy receive framing error counter (offset 0x7e24),? on page 652. ? bit 1 and 2 information in table 657: ?phy extended control register (phy_addr = 0x1, reg_addr = 10h),? on page 678. www.datasheet.in programmer?s guide bcm57xx 01/29/08 broadcom corporation document 57xx-pg105-r page iii ? bit 14 and 15 information in table 658: ?phy extended status register (phy_addr = 0x1, reg_addr = 11h),? on page 681. ? bits 1-5 in table 666: ?expansion register 01h: expansion interrupt status,? on page 686. ? bit 3-5 information in table 675: ?18h: auxiliary control register (shadow register selector = "000"; bcm5714 and bcm5715 only),? on page 695. ? bits 8:7 and bit 3 information in table 676: ?18h: 10base-t register (shadow register selector = "001"; bcm5714 and bcm5715 only),? on page 696. ? bit 5 information in table 678: ?18h: miscellaneous test register 1 (shadow register selector = "100"; bcm5714 and bcm5715 only),? on page 699. ? bit 14:12 and bit 10:5 information table 679: ?18h: miscellaneous test register 2 (shadow register selector = "101"; bcm5714 and bcm5715 only),? on page 700. ? bit 15 information in table 682: ?auxiliary control register (phy_addr = 0x1, reg_addr = 18h, shadow = 001, 10base-t),? on page 704. ? bit 6 information in table 695: ?auto power-down register (address 1ch, shadow value 01010),? on page 724. ? bit 7:4 and bit 3:0 information in table 709: ?led gpio control/status register (address 1ch, shadow value 01111),? on page 741. ? bit 8:3 information in table 710: ?autodetect sgmii/media converter register (address 1ch, shadow value 11000),? on page 742. ? bits 5-8 and bit 3 information in table 713: ?auxiliary 1000base-x status register (address 1ch, shadow value 11100),? on page 746. ? bit 7:6 information in table 714: ?miscellaneous 1000base-x status register (address 1ch, shadow value 11101),? on page 749. ? bit 9:8 and bit 5 information in table 715: ?autodetect medium register (address 1ch, shadow value 11110),? on page 751. ? bit 3 information table 716: ?mode control register (address 1ch, shadow value 11111),? on page 753. ? bit 14:13 and bit 12 information in table 717: ?hcd status register (phy_addr = 0x1, reg_addr = 1dh, bit 15 = 1),? on page 755. ? note to table 26: ?boot strap region,? on page 91. ? offset 9c, 9e, ac and b4 values to table 28: ?manufacturing information region,? on page 93. ? bit 28 and bit 29 to table 28: ?manufacturing information region,? on page 93. ? bits 7-31 to offset dc table 28: ?manufacturing information region,? on page 93. ? procedural steps to ?initialization procedure? on page 174. ? note in ?register definitions? on page 327. ? descriptive note to table 216: ?device control register (offset 0xd8),? on page 386. ? ?00-0fh 1000bt/100btx/10bt registers? on page 658. ? ?expansion registers (bcm5705, bcm5721, bcm5751, bcm5752, bcm5714, and bcm5715 only)? on page 685. ? ?auxiliary control register (bcm5714 and bcm5715 devices only)? on page 695 revision date description www.datasheet.in bcm57xx programmer?s guide 01/29/08 broadcom corporation page iv document 57xx-pg105-r 57xx-pg104-r 07/13/06 added: ? table 675: ?18h: auxiliary control register (shadow register selector = "000"; bcm5714 and bcm5715 only),? on page 695. ? table 676: ?18h: 10base-t register (shadow register selector = "001"; bcm5714 and bcm5715 only),? on page 696. ? table 677: ?18h: power/mii control register (shadow register selector = "010"; bcm5714 and bcm5715 only),? on page 698. ? table 678: ?18h: miscellaneous test register 1 (shadow register selector = "100"; bcm5714 and bcm5715 only),? on page 699. ? table 679: ?18h: miscellaneous test register 2 (shadow register selector = "101"; bcm5714 and bcm5715 only),? on page 700. ? table 680: ?18h: miscellaneous control register (shadow register selector = "111"),? on page 700. ? table 690: ?spare control register 1 (address 1ch, enable by register 1ch bits[14:10] = 00010),? on page 718. ? ?misc shadow registers (phy_addr = 0x1, reg_addr = 1ch; bcm5702, BCM5703, and bcm5704 only)? on page 718. ? table 691: ?spare control register 2 (address 1ch, shadow value 00100),? on page 719. ? ?misc shadow registers (phy_addr = 0x1, reg_addr = 1ch; bcm5705, bcm5721, bcm5751, bcm5752, bcm5714, and bcm5715 only)? on page 725. ? table 699: ?clock alignment control register (shadow register selector = "00011"),? on page 728. ? table 702: ?spare control 3 register (address 1ch, shadow value 00101),? on page 730. ? table 703: ?1ch: spare control 3 register (shadow register selector = "00100"),? on page 732. ? table 721: ?1fh: test register 2,? on page 758. revision date description www.datasheet.in programmer?s guide bcm57xx 01/29/08 broadcom corporation document 57xx-pg105-r page v 57xx-pg103-r 08/18/05 updated: ? table 2: ?family revision levels,? on page 5. ? figure 15: ?typical bcm5714c-based lom design block diagram,? on page 39. ? figure 16: ?typical bcm5714s-based lom design block diagram,? on page 41. ? figure 17: ?typical bcm5715c-based lom design block diagram,? on page 43. ? figure 18: ?typical bcm5715s-based lom design block diagram,? on page 45. ? figure 19: ?typical bcm5751-based nic board block diagram,? on page 47. ? figure 20: ?functional block diagram,? on page 49. ? intelligent management device (imd) to baseboard management controller (bmc) in ?universal management port (applicable to bcm5714c/bcm5714s/ bcm5715c/bcm5715s only)? on page 78. ? init for bit 8 in table 171: ?power management control/status register (offset 0x4c),? on page 347. ? table 185: ?dma read/write control register (offset 0x6c),? on page 357. ? table 349: ?receive list placement statistics enable mask register (offset 0x2018),? on page 471. ? 15-1 to 15-2 in table 351: ?receive list placement statistics increment mask register (offset 0x201c),? on page 472. ? bits 31-30?s field in table 423: ?read dma mode register (offset 0x4800),? on page 516. ? bits 31-30?s field in table 426: ?write dma mode register (offset 0x4c00),? on page 519. ? bit 5?s description in table 429: ?rx risc mode register fields (offset 0x5000),? on page 522. ? bit 5?s description in table 433: ?tx risc mode register fields (offset 0x5400),? on page 526. ? bits 27-24?s field in table 495: ?auxiliary smbus master control register (offset 0x6c44),? on page 579. ? bit 0?s description in table 498: ?auxiliary smbus slave address/control register (offset 0x6c50),? on page 581. ? 0x6c60 to 0x6ce0 in: - ?smbus address resolution protocol registers (offset 0x6ce0)? on page 584. - table 501: ?smbus arp command register (offset 0x6ce0),? on page 584. ? 0x6c64 to 0x6ce4 in: - ?smbus arp status register (offset0x6ce4)? on page 585. - table 502: ?smbus arp status register (offset 0x6ce4),? on page 585. ? 0x6c68 to 0x6ce8 in: - ?udid register 0 (offset 0x6ce8)? on page 586. - table 503: ?udid register 0 (offset 0x6ce8),? on page 586. ? 0x6c6c to 0x6cec in: - ?udid register 1 (offset 0x6cec)? on page 586. - table 504: ?udid register 1 (offset 0x6cec),? on page 586. revision date description www.datasheet.in bcm57xx programmer?s guide 01/29/08 broadcom corporation page vi document 57xx-pg105-r 57xx-pg103-r (cont.) 08/18/05 updated (cont): ? 0x6c70 to 0x6cf0 in: - ?udid register 2 (offset 0x6cf0)? on page 586. - table 505: ?udid register 2 (offset 0x6cf0),? on page 586. ? 0x6c74 to 0x6cf4 in: - ?udid register 3 (offset 0x6cf4)? on page 586. - table 506: ?udid register 3 (offset 0x6cf4),? on page 586. ? in table 573: ?tlp workaround register (offset 0x7c04, bcm5752 only),? on page 624: - bit 8 bit?s field and description. - bit 7?s field and description. - bit 3?s field. - bit 2?s field. - bit 1?s field. - bit 0?s field and description. ? bit 18?24?s fields and descriptions in table 598: ?data link control register (offset 0x7d00),? on page 633. ? descriptions for bits 16?23 in table 608: ?power management threshold register (offset 0x7d28),? on page 638. ? descriptions for bits 8, 9, and 11 in table 630: ?phy test control register (offset 0x7e2c),? on page 647. added: ? note below table 1: ?family features,? on page 2. ? ?bcm5714c dual-mac chip with integrated transceiver? on page 38. ? ?bcm5714s dual-mac chip with integrated fiber transceiver? on page 40. ? bcm5715 support to ?rdi timer attention? on page 82. ? note at the end of ?nvram access methods? on page 102. ? table 187: ?pci clock control register (offset 0x74),? on page 364. ? table 189: ?pci clock control register definition for bcm5705 device,? on page 367 through table 191: ?pci clock control register definition for bcm5714, and bcm5715 devices,? on page 369. ? note to ?mac function register (0xb8h)? on page 378. ? table 206: ?mac message exchange output register (offset 0xbc),? on page 378. ? table 228: ?virtual channel enhanced capability header (offset 0x13c),? on page 393 through table 250: ?firmware power budgeting register 8 (offset 0x18a),? on page 402. ? bcm5705 and bcm5788 access for bit 12 in table 256: ?ethernet mac status register (offset 0x404),? on page 413. ? table 262: ?wol pattern pointer register (offset 0x430, rest of bcm57xxct family),? on page 419. ? table 264: ?wol pattern configuration register (offset 0x434, rest of bcm57xxct family),? on page 420. ? table 291: ?serdes receive control register (offset 0x594, bcm5704s only),? on page 435. ? table 298: ?serdes transmit control register (0x5b4, bcm5714 and bcm5715 only),? on page 440 through table 311: ?statistics registers,? on page 444. revision date description www.datasheet.in programmer?s guide bcm57xx 01/29/08 broadcom corporation document 57xx-pg105-r page vii 57xx-pg103-r (cont.) 08/18/05 added (cont): ? in table 349: ?receive list placement statistics enable mask register (offset 0x2018),? on page 471: - disable mactq double ack issue fix to bit 18 - disable asf lockup fix to bit 1 ? table 360: ?receive producer ring nic address (offset 0x244c),? on page 476. ? these registers are applicable to bcm5700, bcm5701, bcm5702, BCM5703c, BCM5703s, bcm5704c, and bcm5704s devices only in ?mbuf cluster free registers? on page 486. ? ?dbu registers? on page 487. ? to table 452: ?miscellaneous local control register (offset 0x6808),? on page 546: - grc alt clock enable to bit 31. - grc alt clock select to bit 30. ? table 492: ?tpm command register (0x6c30, for bcm5714 and bcm5715 only),? on page 577. ? table 493: ?tpm data register (0x6c34),? on page 577. ? table 523: ?nvm status register (0x7004h),? on page 597. ? table 539: ?bist status register (offset 0x7404, bcm5721, bcm5751, and bcm5752 only),? on page 606 through table 543: ?uart register map summary,? on page 609. ? table 556: ?ump registers (applicable to bcm5714 and bcm5715 only),? on page 614. ? table 572: ?tlp control register (offset 0x7c00, bcm5721, bcm5751, and bcm5752 only),? on page 623. ? ?00h-0fh 1000base-x register map detailed description? on page 667. ? table 412: ?tx risc mbuf allocation request register (offset 0x4424),? on page 511 through table 414: ?hardware diagnostic 1 register (0x444ch, 5714 only),? on page 513. ? table 416: ?bm hardware diagnostic 2 register (offset 0x4450),? on page 513. ? table 417: ?hardware diagnostic 2 register (0x4450h, 5714 only),? on page 514. ? ?rx risc hardware breakpoint register (offset 0x5034)? on page 525. ? table 468: ?gig serdes prbs control register (0x6850, bcm5714 only),? on page 563 through table 471: ?grc message exchange in register (0x6874h, bcm5714 only),? on page 563. removed: ? in table 185: ?dma read/write control register (offset 0x6c),? on page 357: - bit 31: error forwarding error enable - bit 28: byte count check ? bcm5714 only support in table 205: ?mac function register (0xb8h),? on page 378. ? in table 351: ?receive list placement statistics increment mask register (offset 0x201c),? on page 472: - bit 18: disable mactq double ack issue fix - bit 1: enable asf lockup fix revision date description www.datasheet.in broadcom ? , the pulse logo, connecting everything ? , the connecting everything logo, netxtreme ? , and netxtreme ii? are among the trademarks of broadcom corporation and/or it s affiliates in the united states, certain other countries and/or the eu. any other trademarks or trade names mentioned are the property of their respective owners. broadcom corporation 5300 california avenue irvine, ca 92617 ? 2008 by broadcom corporation all rights reserved printed in the u.s.a. 57xx-pg102-r 09/30/04 updated: ? table 216: ?ethernet mac status register (offset 0x404)? ? table 382: ?rx risc registers? ? table 405: ?miscellaneous configuration register (offset 0x6804)? ? table 406: ?miscellaneous local control register (offset 0x6808)? ? table 409: ?rx-risc timer reference register (offset 0x6814)? ? table 417: ?serial eeprom address register (offset 0x6838)? ? table 449: ?auxiliary smbus master control register (offset 0x6c44)? through table 454: ?auxiliary smbus slave data register (offset 0x6c58)? ? table 476: ?nvm command register (offset 0x7000)? ? table 592: ?phy identifier registers (phy_addr = 0x1, reg_addresses 02h and 03h)? 57xx-pg101-r 02/04/04 updated: ? the bcm5721/bcm5751 registers to engineering register specification 2.6. 57xx-pg100-r 11/03/03 initial release. revision date description www.datasheet.in programmer?s guide bcm57xxct 01/29/08 broadcom corporation document 57xxct-pgxx2-ri page ix t able of c ontents section 1: introduction ........................................................................................................ 1 introduction ............................................................................................................................... ................... 1 feature comparison ............................................................................................................................... ..... 2 revision levels ............................................................................................................................... ............. 5 programming the bcm57xx family ........................................................................................................... 7 about this manual ............................................................................................................................... ........ 8 related documentation ............................................................................................................................... 8 notational conventions ............................................................................................................................... 8 registers and bits............................................................................................................. ...................... 8 functional overview ............................................................................................................ ................... 9 operational characteristics.................................................................................................... ................. 9 pseudocode ..................................................................................................................... ....................... 9 section 2: features ............................................................................................................ 11 bcm5700 mac ............................................................................................................................... ............. 11 typical application (copper-based layout)...................................................................................... .... 12 typical application (fiber-optic layout) ....................................................................................... ........ 13 programming aspects............................................................................................................ ............... 14 bcm5701 mac with integrated transceiver ............................................................................................ 15 typical application ............................................................................................................ .................... 16 programming aspects............................................................................................................ ............... 17 bcm5702 mac with integrated transceiver ............................................................................................ 17 typical application ............................................................................................................ .................... 18 programming aspects............................................................................................................ ............... 19 BCM5703c mac with integrated transceiver .......................................................................................... 19 typical application ............................................................................................................ .................... 20 programming aspects............................................................................................................ ............... 21 BCM5703s mac with integrated serdes transceiver ............................................................................ 21 typical application ............................................................................................................ .................... 22 programming aspects............................................................................................................ ............... 23 bcm5704c dual-mac with integrated transceivers ............................................................................... 23 typical application ............................................................................................................ .................... 24 programming aspects............................................................................................................ ............... 25 www.datasheet.in broadcom corporation page x document 57xxct-pgxx2-ri dual mac modes of operation .................................................................................................... ..25 gpio ........................................................................................................................... ...................26 wol ............................................................................................................................ ...................27 pme , inta ............................................................................................................................... ...... 27 nvram .......................................................................................................................... ................28 initialization................................................................................................................. ....................28 bcm5704s dual-mac with integrated serdes transceivers .................................................................. 29 typical application............................................................................................................ .....................30 programming aspects ............................................................................................................ ...............31 dual mac modes of operation .................................................................................................... ..31 gpio ........................................................................................................................... ...................31 wol ............................................................................................................................ ...................31 pme , inta ............................................................................................................................... ...... 31 nvram .......................................................................................................................... ................31 initialization................................................................................................................. ....................31 bcm5705 and bcm5788 macs with integrated transceivers ................................................................32 lower power state for nic or mobile applicationstypical application ...................................................33 programming aspects ............................................................................................................ ...............34 bcm5721 mac with integrated transceiver ............................................................................................. 34 typical application............................................................................................................ .....................35 programming aspects ............................................................................................................ ...............36 bcm5751 mac with integrated transceiver ............................................................................................. 36 typical application............................................................................................................ .....................37 programming aspects ............................................................................................................ ...............38 bcm5714c dual-mac chip with integrated transceiver ........................................................................ 38 typical application............................................................................................................ .....................39 bcm5714s dual-mac chip with integrated fiber transceiver ...............................................................40 typical application............................................................................................................ .....................41 bcm5715c dual-mac chip with integrated transceiver ........................................................................ 42 typical application............................................................................................................ .....................43 bcm5715s dual-mac chip with integrated fiber transceiver ..............................................................44 typical application............................................................................................................ .....................45 bcm5752 mac device with integrated transceiver ................................................................................46 typical application............................................................................................................ .....................47 programming aspects ............................................................................................................ ...............48 www.datasheet.in programmer?s guide bcm57xxct 01/29/08 broadcom corporation document 57xxct-pgxx2-ri page xi section 3: hardware architecture .................................................................................... 49 theory of operation ............................................................................................................................... .... 49 receive data path ............................................................................................................................... ....... 50 rx engine...................................................................................................................... ....................... 50 rx fifo ........................................................................................................................ ........................ 51 rules checker .................................................................................................................. .................... 51 rx list placement .............................................................................................................. .................. 51 rx list initiator.............................................................................................................. ........................ 51 transmit data path ............................................................................................................................... ..... 52 tx mac ......................................................................................................................... ....................... 52 tx fifo ........................................................................................................................ ........................ 53 tx priority ring selector...................................................................................................... ................. 53 dma read ............................................................................................................................... .................... 53 read engine .................................................................................................................... ..................... 53 read fifo ...................................................................................................................... ...................... 54 buffer manager ................................................................................................................. .................... 54 dma write ............................................................................................................................... .................... 54 write engine ................................................................................................................... ...................... 54 write fifo ..................................................................................................................... ....................... 55 buffer manager ................................................................................................................. .................... 55 system management bus (not applicable to bcm5700) ........................................................................ 56 overview ....................................................................................................................... ........................ 57 timers ......................................................................................................................... .......................... 57 smbus interface................................................................................................................ .................... 57 smbus connector................................................................................................................ .......... 58 smbus data link ................................................................................................................ ........... 58 smbus clock .................................................................................................................... ............. 60 events ......................................................................................................................... .......................... 60 other asf actions .............................................................................................................. .................. 61 led control ............................................................................................................................... ................. 61 memory arbiter ............................................................................................................................... ............ 61 host coalescing ............................................................................................................................... .......... 62 host coalescing engine......................................................................................................... ............... 62 msi fifo ....................................................................................................................... ....................... 63 www.datasheet.in broadcom corporation page xii document 57xxct-pgxx2-ri status block................................................................................................................... ........................63 10/100/1000base-t transceiver (not applicable to bcm5700) .............................................................64 encoder ........................................................................................................................ .........................64 decoder ........................................................................................................................ .........................64 carrier sense .................................................................................................................. ......................65 link monitor ................................................................................................................... ........................65 digital adaptive equalizer..................................................................................................... .................65 echo canceller ................................................................................................................. .....................65 crosstalk cancellers........................................................................................................... ...................66 analog-to-digital converter .................................................................................................... ...............66 clock recovery/generator ....................................................................................................... .............66 baseline wander correction..................................................................................................... .............66 multimode tx dac............................................................................................................... .................66 stream cipher .................................................................................................................. .....................67 wire map and pair skew correction .............................................................................................. .......67 auto-negotiation............................................................................................................... .....................68 automatic mdi crossover........................................................................................................ ..............68 wire speed..................................................................................................................... .......................68 phy control ............................................................................................................................... ..................69 mii block...................................................................................................................... ..........................69 gmii block ..................................................................................................................... ........................70 tbi block ...................................................................................................................... .........................72 mdio register interface........................................................................................................ ................73 management data clock.......................................................................................................... ......73 management data input/output ................................................................................................... ..73 management data interrupt ...................................................................................................... .....73 management register block ...................................................................................................... ....73 universal management port (applicable to bcm5714c/bcm5714s/bcm5715c/bcm5715s only) ..... 74 ump receive data path.......................................................................................................... ..............77 ump transmit data path......................................................................................................... ..............77 ump programming details ........................................................................................................ ............77 ump filter module.............................................................................................................. ...................77 rdi timer attention ............................................................................................................ ...................78 pci/pci-x interface ............................................................................................................................... ......79 dual address cycle ............................................................................................................. ..................80 www.datasheet.in programmer?s guide bcm57xxct 01/29/08 broadcom corporation document 57xxct-pgxx2-ri page xiii target read/write bursts ....................................................................................................... .............. 81 pci host bus interface (not applicable to bcm5721, bcm5751, bcm5752, bcm5714c, bcm5714s, bcm5715c, and bcm5715s) ........................................................................................................ ....... 82 pci-x host bus interface (applicable to bcm5700, bcm5701, BCM5703c, BCM5703s, bcm5704c, and bcm5704s) .................................................................................................................. ................. 83 initialization and reset....................................................................................................... ................... 85 termination of pcsxcap signal .............................................................................................................. 86 self-test ............................................................................................................................... ....................... 87 bist ........................................................................................................................... ........................... 87 jtag........................................................................................................................... .......................... 87 section 4: nvram configuration ..................................................................................... 88 section 5: common data structures ............................................................................... 89 theory of operation ............................................................................................................................... .... 89 descriptor rings ............................................................................................................................... ......... 89 producer and consumer indices .................................................................................................. ........ 90 ring control blocks ............................................................................................................ .................. 91 send rings ..................................................................................................................... ...................... 92 send buffer descriptors........................................................................................................ ......... 94 receive rings.................................................................................................................. ..................... 95 receive producer rings ......................................................................................................... ....... 97 receive return rings ........................................................................................................... ......... 99 receive buffer descriptors ..................................................................................................... ..... 100 status block ............................................................................................................................... .............. 103 status block format............................................................................................................ ................ 104 statistics block ............................................................................................................................... ......... 107 mac statistics................................................................................................................. .................... 107 interface statistics........................................................................................................... .................... 108 mib network interface card statistics .......................................................................................... ...... 109 host interrupts ................................................................................................................ ............. 109 nic bd coalescing thresholds ................................................................................................... 109 dma resources.................................................................................................................. ......... 110 mac resources.................................................................................................................. ......... 110 internal mac receive statistics ................................................................................................ .. 111 internal mac transmit statistics............................................................................................... ... 113 www.datasheet.in broadcom corporation page xiv document 57xxct-pgxx2-ri class of service statistics .................................................................................................... ........113 statistics memory block ........................................................................................................ ..............114 section 6: receive data flow ......................................................................................... 116 introduction ............................................................................................................................... ................ 116 receive producer ring ............................................................................................................................118 set up of producer rings using rcbs ............................................................................................ ...119 other considerations relating to producer ring setup...............................................................119 rcb setup pseudo code.......................................................................................................... ...119 receive buffer descriptors..................................................................................................... .............121 extended receive buffer descriptor ............................................................................................. ......122 management of rx producer rings with mailbox registers and status block ...................................123 status block ................................................................................................................... ..............123 mailbox ........................................................................................................................ .................123 receive return rings ............................................................................................................................... 125 management of return rings with mailbox registers and status block.............................................125 host buffer allocation ......................................................................................................... .................126 receive rules setup and frame classification ..................................................................................1 26 receive rules configuration register .........................................................................................12 6 receive list placement rules array ............................................................................................1 27 class of service example ....................................................................................................... .....129 checksum calculation .............................................................................................................................13 0 vlan tag strip ............................................................................................................................... .......... 130 rx data flow diagram .............................................................................................................................13 1 receiving jumbo frames ........................................................................................................................133 section 7: transmit data flow ....................................................................................... 134 introduction ............................................................................................................................... ................ 134 send rings ............................................................................................................................... .................135 ring control block............................................................................................................. ..................136 nic-based send ring ............................................................................................................ .............138 host-based send ring ........................................................................................................... .............139 checksum offload ............................................................................................................................... ..... 140 scatter/gather ............................................................................................................................... ............141 vlan tag insertion ............................................................................................................................... ...142 tx data flow diagram .............................................................................................................................. 142 www.datasheet.in programmer?s guide bcm57xxct 01/29/08 broadcom corporation document 57xxct-pgxx2-ri page xv transmitting jumbo frames ................................................................................................................... 145 section 8: device control ............................................................................................... 146 initialization ............................................................................................................................... ............... 146 description .................................................................................................................... ...................... 146 initialization procedure....................................................................................................... ................. 146 shutdown ............................................................................................................................... ................... 160 reset ............................................................................................................................... .......................... 161 firmware download ............................................................................................................................... .. 162 firmware binary image .......................................................................................................... ............. 162 reset risc processor ........................................................................................................... ............. 163 halt risc procedure ............................................................................................................ .............. 164 start risc procedure ........................................................................................................... .............. 164 firmware download procedure .................................................................................................... ...... 165 example code snippet (from asf firmware).............................................................................. 167 mac address setup/configuration ........................................................................................................ 167 packet filtering ............................................................................................................................... ......... 168 multicast hash table setup/configuration....................................................................................... ... 168 ethernet crc calculation....................................................................................................... ............ 168 generating crc ................................................................................................................. ................ 168 checking crc ................................................................................................................... ................. 169 initializing the mac hash registers............................................................................................ ........ 169 promiscuous mode setup/configuration ........................................................................................... .170 broadcast setup/configuration .................................................................................................. ......... 171 memory maps and pool configuration ................................................................................................... 171 section 9: pci ................................................................................................................... 178 configuration space ............................................................................................................................... . 178 description .................................................................................................................... ...................... 178 functional overview ............................................................................................................ ............... 180 pci configuration space registers ............................................................................................. 1 80 pci required header region ..................................................................................................... .180 pci device-specific region..................................................................................................... .... 183 indirect mode .................................................................................................................. ............. 185 indirect register access ....................................................................................................... ....... 186 indirect memory access ......................................................................................................... ..... 188 www.datasheet.in broadcom corporation page xvi document 57xxct-pgxx2-ri undi mailbox access............................................................................................................ .......190 standard mode.................................................................................................................. ...........192 flat mode ...................................................................................................................... ...............195 memory mapped i/o registers.................................................................................................... ........202 pci command register ........................................................................................................... ....202 pci state register............................................................................................................. ...........202 pci base address register...................................................................................................... ....203 register quick cross reference ................................................................................................. ........204 bcm57xx family ................................................................................................................. ........204 pseudocode..................................................................................................................... ....................205 memory window read in standard mode....................................................................................205 memory window write in standard mode....................................................................................205 register read in standard mode ................................................................................................. 205 register write in standard mode ................................................................................................ .205 memory read in flat mode ....................................................................................................... ...205 memory write in flat mode1 ..................................................................................................... ...205 register read in flat mode..................................................................................................... .....205 register write in flat mode.................................................................................................... ......205 memory read using indirect mode..............................................................................................20 5 memory write using indirect mode ..............................................................................................2 05 register read using indirect mode .............................................................................................2 06 register write using indirect mode............................................................................................. .206 bus interface ............................................................................................................................... .............. 206 description.................................................................................................................... .......................206 operational characteristics .................................................................................................... .............207 bus mode detection ............................................................................................................. ........207 pci command usage .............................................................................................................. ....209 read/write dma engines ......................................................................................................... ...212 parity errors .................................................................................................................. ...............215 pci-x command usage............................................................................................................ ...217 register quick cross reference ................................................................................................. ........222 bcm57xx family ................................................................................................................. ........222 expansion rom ............................................................................................................................... ......... 223 description.................................................................................................................... .......................223 operational characteristics .................................................................................................... .............223 www.datasheet.in programmer?s guide bcm57xxct 01/29/08 broadcom corporation document 57xxct-pgxx2-ri page xvii bios ........................................................................................................................... ........................ 224 pxe (preboot execution environment)........................................................................................ 224 reset and timing considerations (bcm5700 and bcm5701 only) ............................................ 224 power management ............................................................................................................................... .. 225 description .................................................................................................................... ...................... 225 operational characteristics.................................................................................................... ............. 226 device state d0 (uninitialized) ................................................................................................ .... 226 device state d0 (active)....................................................................................................... ....... 226 device state d1 ................................................................................................................ ........... 227 device state d2 ................................................................................................................ ........... 227 device state d3 (hot) .......................................................................................................... ........ 227 device state d3 (cold) ......................................................................................................... ....... 227 wake on lan .................................................................................................................... ................. 228 gpio ........................................................................................................................... ........................ 228 power supply in d3 state ....................................................................................................... ............ 228 clock control .................................................................................................................. .................... 229 device acpi transitions ........................................................................................................ ............. 229 disable device through bios .................................................................................................... ........ 229 register quick cross reference ................................................................................................. ....... 230 byte swapping ............................................................................................................................... .......... 231 background..................................................................................................................... .................... 231 architecture ................................................................................................................... ...................... 232 enable endian word swap and enable endian byte swap bits ........................................................ 232 word swap data and byte swap data bits ........................................................................................ 2 35 word swap data = 0, and byte swap data = 0........................................................................... 235 word swap data = 0, and byte swap data = 1........................................................................... 236 word swap data = 1, and byte swap data = 0........................................................................... 237 word swap data = 1, and byte swap data = 1........................................................................... 237 word swap non-frame data and byte swap non-frame data bits.................................................. 238 word swap non-frame data = 0 and byte swap non-frame data = 0 ..................................... 239 word swap non-frame data = 1 and byte swap non-frame data = 0 ..................................... 239 word swap non-frame data = 0 and byte swap non-frame data = 1 ..................................... 239 word swap non-frame data = 1 and byte swap non-frame data = 1 ..................................... 240 www.datasheet.in broadcom corporation page xviii document 57xxct-pgxx2-ri section 10: ethernet link configuration ....................................................................... 241 overview ............................................................................................................................... ..................... 241 gmii/mii ............................................................................................................................... ....................... 241 configuring the bcm57xx family for gmii/mii and tbi modes .........................................................241 configuring link up/down....................................................................................................... ............242 link status change indications ................................................................................................. ..........242 configuring the gmii/mii phy ................................................................................................... ..........242 reading a phy register ......................................................................................................... .....243 writing a phy register ......................................................................................................... .......244 tbi mode ............................................................................................................................... .....................245 configuring the bcm57xx family for tbi mode .................................................................................245 1000base-x auto-negotiation.................................................................................................... ........245 1000base-x auto-negotiation in firmware........................................................................................ 246 shared memory mailbox, signatures, and bit definitions ............................................................246 mdi register access ............................................................................................................................... . 247 operational characteristics .................................................................................................... .............247 access methods ................................................................................................................. .................248 traditional bit-bang method.................................................................................................... .....248 auto-access method............................................................................................................. ........248 phy setup and initialization ....................................................................................................................250 bcm5700 mac and bcm5401 phy (example)..................................................................................250 setup and initialization procedure............................................................................................. ...252 pseudocode to set up fiber auto-negotiation ............................................................................254 wake-on lan mode/low-power .............................................................................................................. 268 description.................................................................................................................... .......................268 functional overview ............................................................................................................ ................269 operational characteristics .................................................................................................... .............270 internal memory ................................................................................................................ ...........270 wol pattern configuration register............................................................................................2 70 wol streams.................................................................................................................... ...........271 pattern data structure......................................................................................................... .........273 firmware mailbox ............................................................................................................... ..........275 bcm5401 auto-negotiation ....................................................................................................... ...275 bcm5401 power management (bcm5700 only) ........................................................................276 www.datasheet.in programmer?s guide bcm57xxct 01/29/08 broadcom corporation document 57xxct-pgxx2-ri page xix bcm57xx power management ................................................................................................... 276 register quick cross reference ................................................................................................. ....... 277 bcm5401 and bcm57xx integrated phys................................................................................. 277 integrated macs ................................................................................................................ .......... 278 wol data flow diagram .......................................................................................................... .......... 279 flow control ............................................................................................................................... .............. 280 description .................................................................................................................... ...................... 280 operational characteristics.................................................................................................... ............. 281 transmit mac ................................................................................................................... ........... 281 receive mac .................................................................................................................... ........... 282 statistics block............................................................................................................... .............. 282 phy auto-negotiation........................................................................................................... ....... 283 register quick cross reference ................................................................................................. ....... 283 bcm5401 and bcm57xx integrated phys................................................................................. 283 integrated macs ................................................................................................................ .......... 284 flow control initialization pseudocode ......................................................................................... ...... 285 section 11: inte rrupt processing .................................................................................... 287 host coalescing ............................................................................................................................... ........ 287 description .................................................................................................................... ...................... 287 operational characteristics.................................................................................................... ............. 287 registers...................................................................................................................... ....................... 288 msi ............................................................................................................................... .............................. 289 traditional interrupt scheme................................................................................................... ............ 289 message signaled interrupt ..................................................................................................... ........... 290 pci configuration registers .................................................................................................... ........... 291 msi address .................................................................................................................... ............ 291 msi data ....................................................................................................................... ............... 291 host coalescing engine......................................................................................................... ............. 292 firmware ....................................................................................................................... ...................... 292 basic driver interrupt processing flow ................................................................................................. 293 flowchart for servicing an interrupt ........................................................................................... ......... 293 interrupt procedure (bcm5700 only) ............................................................................................. .... 294 interrupt procedure (bcm5701 and later) ........................................................................................ .295 interrupt processing (not applicable to bcm5700) .............................................................................. 296 www.datasheet.in broadcom corporation page xx document 57xxct-pgxx2-ri broadcom mask mode............................................................................................................. ............296 broadcom tagged status mode.................................................................................................... ......296 clear ticks on bd events mode.................................................................................................. ........296 no interrupt on force update................................................................................................... ...........296 no interrupt on dmad force..................................................................................................... ..........297 section 12: register definitions .................................................................................... 298 pci configuration registers .................................................................................................................... 298 vendor id register (offset 0x00) ............................................................................................... .........300 device id register (offset 0x02)............................................................................................... ..........301 command register (offset 0x04)................................................................................................. .......302 status register (offset 0x06) .................................................................................................. ............303 revision id register (offset 0x08) ............................................................................................. .........304 class code register (offset 0x09).............................................................................................. ........305 cache line size register (offset 0x0c)......................................................................................... .....305 latency timer register (offset 0x0d) ........................................................................................... ......305 header type register (offset 0x0e) ............................................................................................. ......306 bist register (offset 0x0f) .................................................................................................... ............306 base address register 1/2 register (offset 0x10-0x17).....................................................................306 mac 0 xbar register (offset 0x18).............................................................................................. .....307 mac 0 xbar register (upper) (offset 0x1c) ....................................................................................30 7 subsystem vendor id register (offset 0x2c)..................................................................................... 307 subsystem id register (offset 0x2e)............................................................................................ ......309 expansion rom base address register (offset 0x30).......................................................................310 capabilities pointer register (offset 0x34) .................................................................................... .....310 interrupt line register (offset 0x3c).......................................................................................... .........310 interrupt pin register (offset 0x3d) ........................................................................................... .........311 minimum grant register (offset 0x3e) ........................................................................................... ....311 maximum latency register (offset 0x3f) ......................................................................................... ..311 pci-x capabilities ............................................................................................................................... ......312 pci-x capability id register (offset 0x40) ..................................................................................... ....312 pci-x next capabilities pointer register (offset 0x41) ......................................................................312 pci-x command register (offset 0x42) ........................................................................................... ..312 pci-x status register (offset 0x44)............................................................................................ ........314 pci power management capabilities ......................................................................................................316 www.datasheet.in programmer?s guide bcm57xxct 01/29/08 broadcom corporation document 57xxct-pgxx2-ri page xxi power management capability id register (offset 0x48) .................................................................. 316 pm next capabilities pointer register (offset 0x49) .......................................................................... 31 6 power management capabilities register (offset 0x4a).................................................................... 317 power management control/status register (offset 0x4c) ............................................................... 318 pmcsr-bse register (offset 0x4e) ............................................................................................... ... 318 power management data register (offset 0x4f) ............................................................................... 319 vital product data capabilities ............................................................................................................... 320 vpd capability id register (offset 0x50) ....................................................................................... .... 320 vpd next capabilities pointer register (offset 0x51) ........................................................................ 320 vpd flag and address register (offset 0x52) ................................................................................... 3 20 vpd data register (offset 0x54) ................................................................................................ ........ 321 message signaled interrupts capabilities ............................................................................................. 321 msi capability id register (offset 0x58) ....................................................................................... ..... 321 msi next capabilities pointer register (offset 0x59) ......................................................................... 32 1 message control register (offset 0x5a) ......................................................................................... ... 322 message address register (offset 0x5c)......................................................................................... .. 323 message data register (offset 0x64)............................................................................................ ..... 323 hardware fix register (offset 0x66)............................................................................................ ....... 323 pci-x split latency timer register (offset 0x66, bcm5714c, bcm5714s, bcm5715c, and bcm5715s only) .......................................................................................................................... ......................... 324 private pci configuration registers ...................................................................................................... 325 miscellaneous host control register (offset 0x68) ............................................................................ 32 5 dma read/write control register (offset 0x6c)................................................................................ 32 7 pci state register (offset 0x70) ............................................................................................... ......... 332 pci clock control register (offset 0x74) ....................................................................................... .... 334 register base address register (offset 0x78) ................................................................................... 340 memory window base address register (offset 0x7c) ..................................................................... 341 register data register (offset 0x80) ........................................................................................... ....... 342 memory window data register (offset 0x84)..................................................................................... 3 42 mode control register (offset 0x88, host cpu view) ........................................................................ 342 miscellaneous configuration register (offset 0x8c, host cpu view) ................................................ 342 miscellaneous local control register (offset 0x90, host cpu view)................................................. 342 expansion rom registers (internal risc cpu view only) ................................................................... 343 expansion rom bar size register (offset 0x88) ............................................................................. 343 expansion rom address register (offset 0x8c) ............................................................................... 343 www.datasheet.in broadcom corporation page xxii document 57xxct-pgxx2-ri expansion rom data register (offset 0x90)...................................................................................... 344 vpd config register ............................................................................................................................... .. 344 vpd interface register (offset 0x94) ........................................................................................... .......344 undi mailbox registers ...........................................................................................................................345 undi receive bd standard producer ring producer index mailbox (offset 0x98)............................345 undi receive return ring consumer index mailbox (offset 0xa0)...................................................345 undi send bd producer index mailbox (offset 0xa8) .......................................................................345 dual-mac control registers ...................................................................................................................346 dual-mac control register (offset 0xb8)........................................................................................ ...346 mac function register (0xb8h).................................................................................................. .......347 mac message exchange output register (offset 0xbc) ...................................................................347 mac message exchange input register (offset 0xc0) ......................................................................348 cardbus pc card function register (offset 0xc0) ............................................................................348 cardbus pc card function event mask register (offset 0xc4) ........................................................348 cardbus pc card function present state register (offset 0xc8) .....................................................349 cardbus pc card function force event state register (offset 0xcc)..............................................349 pcie capabilities ............................................................................................................................... ........350 pcie capability list register (offset 0xd0) .................................................................................... ....350 pcie next capabilities pointer register (offset 0xd1) .......................................................................350 pcie capabilities register (offset 0xd2) ....................................................................................... .....350 device capabilities register (offset 0xd4) ..................................................................................... ....351 device control register (offset 0xd8) .......................................................................................... ......352 device status register (offset 0xda) ........................................................................................... ......353 link capabilities register (offset 0xdc) ....................................................................................... ......354 link control register (offset 0xe0)............................................................................................ .........355 link status command register (offset 0xe2)..................................................................................... 355 pcie enhanced capabilities ....................................................................................................................356 advanced error reporting enhanced capability header register (offset 0x100) ..............................356 uncorrectable error status register (offset 0x104)............................................................................3 56 uncorrectable error mask register (offset 0x108) .............................................................................35 7 uncorrectable error severity register (offset 0x10c) ........................................................................358 correctable error status register (offset 0x110)............................................................................... .359 correctable error mask register (offset 0x114) ................................................................................. 359 advanced error capabilities and control register (offset 0x118) ......................................................360 header log register (offset 0x118-0x12b)....................................................................................... ..360 www.datasheet.in programmer?s guide bcm57xxct 01/29/08 broadcom corporation document 57xxct-pgxx2-ri page xxiii virtual channel enhanced capability header (offset 0x13c) ............................................................. 360 port vc capability register (offset 0x140)..................................................................................... .... 361 port vc capability register 2 (offset 0x144)................................................................................... ... 361 port vc control register (offset 0x148)........................................................................................ ..... 361 port vc status register (offset 0x14a) ......................................................................................... ..... 362 vc resource capability register (offset 0x14c) ................................................................................ 3 62 vc resource control register (offset 0x150) .................................................................................... 362 vc resource status register (offset 0x156) ..................................................................................... 363 device serial no enhanced capability header register (offset 0x160) ............................................ 363 device serial no lower dw register (offset 0x164) ......................................................................... 363 device serial no upper dw register (offset 0x168) ......................................................................... 364 power budgeting enhanced capability header register (offset 0x16c) ........................................... 364 power budgeting data register (offset 0x174) .................................................................................. 3 65 power budgeting capability register (offset 0x178).......................................................................... 365 firmware power budgeting register 1 (offset 0x17c) ....................................................................... 366 firmware power budgeting register 2 (offset 0x17d) ....................................................................... 366 firmware power budgeting register 3 (offset 0x180)........................................................................ 367 firmware power budgeting register 4 (offset 0x182)........................................................................ 367 firmware power budgeting register 5 (offset 0x184)........................................................................ 368 firmware power budgeting register 6 (offset 0x186)........................................................................ 368 firmware power budgeting register 7 (offset 0x188)........................................................................ 369 firmware power budgeting register 8 (offset 0x18a) ....................................................................... 369 reset count register (offset 0x158) ............................................................................................ ...... 370 high-priority mailboxes ........................................................................................................................... 370 interrupt mailbox 0 register (offset 0x200) .................................................................................... .... 372 other interrupt mailbox registers (offset 0x208-0x218) .................................................................... 373 general mailbox registers 1-8 (offset 0x220-0x258)......................................................................... 373 receive bd standard producer ring index register (offset 0x268).................................................. 373 receive bd jumbo producer ring index register (offset 0x270) ..................................................... 373 receive bd mini producer ring index register (offset 0x278).......................................................... 373 receive bd return ring 1-16 consumer indices registers (offset 0x280-0x2f8)............................ 373 send bd ring 1-16 host producer indices registers (offset 0x300-0x378)...................................... 374 send bd ring 1-16 nic producer indices registers (offset 0x380-0x3f8)....................................... 374 ethernet mac control registers ............................................................................................................ 375 ethernet mac mode register (offset 0x400) ..................................................................................... 3 77 www.datasheet.in broadcom corporation page xxiv document 57xxct-pgxx2-ri ethernet mac status register (offset 0x404).................................................................................... .379 ethernet mac event enable register (offset 0x408) .........................................................................381 led control register (offset 0x40c) ............................................................................................ ......382 ethernet mac addresses registers (offset 0x410-0x42c) ................................................................384 wol pattern pointer register (offset 0x430) .................................................................................... .385 rest of bcm57xx family......................................................................................................... ....385 wol pattern configuration register (offset 0x434) ...........................................................................386 rest of bcm57xx family......................................................................................................... ....386 ethernet transmit random backoff register (offset 0x438) ..............................................................386 receive mtu size register (offset 0x43c) ....................................................................................... .387 gigabit pcs test register (offset 0x440)....................................................................................... ....387 transmit 1000base-x auto-negotiation register (offset 0x444) ......................................................387 receive 1000base-x auto-negotiation register (offset 0x448) .......................................................388 mi communication register (offset 0x44c)....................................................................................... .388 mi status register (offset 0x450) .............................................................................................. .........389 mi mode register (offset 0x454) ................................................................................................ ........389 autopolling status register (offset 0x458) ..................................................................................... ....389 transmit mac mode register (offset 0x45c).....................................................................................3 90 transmit mac status register (offset 0x460) .................................................................................... 390 transmit mac lengths register (offset 0x464)..................................................................................3 91 receive mac mode register (offset 0x468) ......................................................................................3 91 receive mac status register (offset 0x46c)..................................................................................... 392 mac hash register 0-3 (offset 0x470-0x47c) ...................................................................................39 2 receive rules control registers (offset rule n: 0x480 + 8*n)..........................................................393 receive rules value/mask registers (offset rule n: 0x484 + 8*n) ..................................................394 receive rules configuration register (offset 0x500).........................................................................394 low watermark maximum receive frames register (offset 0x504) .................................................394 mac hash table registers (offset 0x520-0x52f) ................................................................................... 395 ethernet mac perfect address registers (offset 0x530-0x58f) .......................................................... 395 serdes registers ............................................................................................................................... .......396 serdes control register (offset 0x590)......................................................................................... .....396 serdes status register (offset 0x594) .......................................................................................... .....400 serdes receive control register (offset 0x594)................................................................................4 01 serdes phase control register (offset 0x598)................................................................................... 401 serdes pll control register (offset 0x59c)..................................................................................... .402 www.datasheet.in programmer?s guide bcm57xxct 01/29/08 broadcom corporation document 57xxct-pgxx2-ri page xxv serdes phase status register (offset 0x5a0) ................................................................................... 4 02 hardware auto-negotiation control register (offset 0x5b0).............................................................. 403 serdes receive control register (0x5b0, bcm5714 and bcm5715 only)......................................... 404 hardware auto-negotiation status register (offset 0x5b4) ............................................................... 404 serdes transmit control register (0x5b4)....................................................................................... .. 405 ump multicast match address mask register (0x5e4) ...................................................................... 405 ump vlan match register (0x5e8) ................................................................................................ ... 406 ump emac control register (0x5f0) .............................................................................................. .. 406 statistics registers ............................................................................................................................... ... 407 transmit mac statistic counters ................................................................................................ ........ 408 ifhcoutoctets (offset 0x0800) .................................................................................................. .. 408 etherstatscollisions (offset 0x0808) ........................................................................................... 408 outxonsent (offset 0x080c)..................................................................................................... ... 408 outxoffsent (offset 0x0810) .................................................................................................... .... 408 dot3statsinternalmactransmiterrors (offset 0x0818) ................................................................. 408 dot3statssinglecollisionframes (offset 0x081c)........................................................................ 408 dot3statsmultiplecollisionframes (offset 0x0820)...................................................................... 408 dot3statsdeferredtransmissions (offset 0x0824)....................................................................... 408 dot3statsexcessivecollisions (offset 0x082c)............................................................................ 408 dot3statslatecollisions (offset 0x0830) ..................................................................................... 408 ifhcoutucastpkts (offset 0x086c).............................................................................................. 4 08 ifhcoutmulticastpkts (offset 0x0870) ......................................................................................... 40 8 ifhcoutbroadcastpkts (offset 0x0874) ....................................................................................... 409 receive mac statistic counters ................................................................................................. ........ 409 ifhcinoctets (offset 0x0880)................................................................................................... .... 409 etherstatsfragments (offset 0x0888) ......................................................................................... 409 ifhcinucastpkts (offset 0x088c) ................................................................................................ 409 ifhcinmulticastpkts (offset 0x0890) ............................................................................................ 409 ifhcinbroadcastpkts (offset 0x0894) .......................................................................................... 40 9 dot3statsfcserrors (offset 0x0898) ........................................................................................... 40 9 dot3statsalignmenterrors (offset 0x089c).................................................................................. 409 xonpauseframesreceived (offset 0x08a0)................................................................................ 409 xoffpauseframesreceived (offset 0x08a4)................................................................................ 409 maccontrolframesreceived (offset 0x08a8) ............................................................................. 409 xoffstateentered (offset 0x08ac) ............................................................................................... 410 www.datasheet.in broadcom corporation page xxvi document 57xxct-pgxx2-ri dot3statsframestoolongs (offset 0x08b0)................................................................................410 etherstatsjabbers (offset 0x08b4) .............................................................................................. 410 etherstatsundersizepkts (0x08b8) ..............................................................................................4 10 send data initiator control registers .....................................................................................................411 send data initiator mode register (offset 0x0c00) ............................................................................41 2 send data initiator status register (offset 0x0c04)...........................................................................4 12 send data initiator statistics control register (offset 0x0c08) ..........................................................413 send data initiator statistics enable mask register (offset 0x0c0c) ................................................414 rest of bcm57xx family......................................................................................................... ....414 send data initiator statistics increment mask register (offset 0x0c10) ............................................415 rest of bcm57xx family......................................................................................................... ....415 local statistics counters (offset 0x0c80-0x0cdf) ............................................................................415 tcp segmentation control registers .....................................................................................................416 lower host address register for tcp segmentation (offset 0xce0) ................................................416 upper host address register for tcp segmentation (offset 0xce4) ................................................416 length/offset register for tcp segmentation (offset 0xce8) ...........................................................417 dma flags register for tcp segmentation (offset 0xcec) ..............................................................417 vlan tag register for tcp segmentation (offset 0xcf0) ................................................................418 pre-dma command exchange register for tcp segmentation (offset 0xcf4)................................419 send data completion control registers ..............................................................................................420 send data completion mode register (offset 0x1000) ......................................................................420 post-dma command exchange register for tcp segmentation (offset 0x1008).............................420 send bd ring selector control registers .............................................................................................421 send bd ring selector mode register (offset 0x1400) .....................................................................422 send bd ring selector status register (offset 0x1404) ....................................................................422 send bd ring selector hardware diagnostics register (offset 0x1408) ...........................................422 rest of bcm57xx family......................................................................................................... ....422 send bd diagnostic ring selector local nic send bd consumer index registers (offset 0x1440-0x147c) ......................................................................................................... .............423 send bd initiator control registers ....................................................................................................... 423 send bd initiator mode register (offset 0x1800) ...............................................................................4 24 send bd initiator status register (offset 0x1804) .............................................................................. 424 send bd diagnostic initiator local nic send bd n producer index registers (offset 0x1808-0x1844)......................................................................................................... ..............424 send bd completion control registers .................................................................................................425 www.datasheet.in programmer?s guide bcm57xxct 01/29/08 broadcom corporation document 57xxct-pgxx2-ri page xxvii send bd completion mode register (offset 0x1c00)........................................................................ 425 receive list placement control registers ............................................................................................ 426 receive list placement mode register (offset 0x2000) .................................................................... 429 receive list placement status register (offset 0x2004) ................................................................... 429 receive selector list lock register (offset 0x2008).......................................................................... 43 0 receive selector non-empty bits register (offset 0x200c) .............................................................. 430 receive list placement configuration register (offset 0x2010) ........................................................ 431 receive list placement statistics control register (offset 0x2014) .................................................. 432 receive list placement statistics enable mask register (offset 0x2018) ......................................... 433 rest of bcm57xx family ......................................................................................................... ... 434 receive list placement statistics increment mask register (offset 0x201c).................................... 434 rest of bcm57xx family ......................................................................................................... ... 434 receive selector list head and tail pointers (offsets starting at 0x2100)........................................ 435 receive selector list count registers (offset of list n: 0x2108 + 16*[n-1]) ..................................... 435 local statistics counter register (offset 0x2200-0x2258) ................................................................. 435 receive data and receive bd initiator control registers ................................................................... 436 receive data and receive bd initiator mode register (offset 0x2400)............................................. 437 receive data and receive bd initiator status register (offset 0x2404) ........................................... 437 jumbo receive bd ring rcb register (offset 0x2440) .................................................................... 438 standard receive bd ring rcb register (offset 0x2450) ................................................................ 439 mini receive bd ring rcb register (offset 0x2460) ........................................................................ 439 receive diagnostic data and receive bd ring initiator local nic jumbo receive bd consumer index (offset 0x2470) .............................................................................................. .... 439 receive diagnostic data and receive bd ring initiator local nic standard receive bd consumer index (offset 0x2474) .................................................................................... 43 9 receive diagnostic data and receive bd ring initiator local nic mini receive bd consumer index (offset 0x2478) ................................................................................................. ....... 439 receive data and receive diagnostic bd initiator local receive return producer index register (offset 0x2480-0x24bc) .......................................................................................... ... 439 receive data and receive bd initiator hardware diagnostic register (offset 0x24c0).................... 440 rdi timer mode register (0x024f0h) ............................................................................................. ... 440 receive data completion control registers ......................................................................................... 441 receive data completion mode register (offset 0x2800) ................................................................. 441 receive bd initiator control registers .................................................................................................. 442 receive bd initiator mode register (offset 0x2c00).......................................................................... 442 receive bd initiator status register (offset 0x2c04) ........................................................................ 442 www.datasheet.in broadcom corporation page xxviii document 57xxct-pgxx2-ri receive bd initiator local nic receive bd producer index registers (offset 0x2c08-0x2c13) ......442 mini receive bd producer ring replenish threshold register (offset 0x2c14) ...............................443 standard receive bd producer ring replenish threshold register (offset 0x2c18) .......................443 jumbo receive bd producer ring replenish threshold register (offset 0x2c1c) ..........................443 receive bd completion control registers ............................................................................................444 receive bd completion mode register (offset 0x3000) ....................................................................444 receive bd completion status register (offset 0x3004) ...................................................................444 nic jumbo receive bd producer index register (offset 0x3008) .....................................................445 nic standard receive bd producer index register (offset 0x300c).................................................445 nic mini receive bd producer index register (offset 0x3010) .........................................................445 receive list selector control registers ................................................................................................446 receive list selector mode register (offset 0x3400).........................................................................446 receive list selector status register (offset 0x3404) .......................................................................446 mbuf cluster free registers ..................................................................................................................447 mbuf cluster free mode register (offset 0x3800) ...........................................................................447 mbuf cluster free status register (offset 0x3804) ..........................................................................447 dbu registers ............................................................................................................................... ............448 host coalescing control registers ........................................................................................................450 host coalescing mode register (offset 0x3c00)................................................................................45 2 host coalescing status register (offset 0x3c04) ..............................................................................45 2 receive coalescing ticks registers (offset 0x3c08).........................................................................453 send coalescing ticks register (offset 0x3c0c)...............................................................................45 3 receive max coalesced bd count (offset 0x3c10)...........................................................................454 send max coalesced bd count (offset 0x3c14) ...............................................................................454 receive coalescing ticks during interrupt register (offset 0x3c18).................................................455 send coalescing ticks during interrupt register (offset 0x3c1c).....................................................455 receive max coalesced bd count during interrupt (offset 0x3c20).................................................456 send max coalesced bd count during interrupt (offset 0x3c24) .....................................................456 statistics ticks counter register (offset 0x3c28) .............................................................................. 456 statistics host address register (offset 0x3c30)............................................................................... 456 status block host address register (offset 0x3c38) .........................................................................457 statistics base address register (offset 0x3c40) ..............................................................................4 57 status block base address register (offset 0x3c44) ........................................................................457 flow attention register (offset 0x3c48) ........................................................................................ .....457 nic receive bd consumer index registers (offset 0x3c50-0x3c58)...............................................458 www.datasheet.in programmer?s guide bcm57xxct 01/29/08 broadcom corporation document 57xxct-pgxx2-ri page xxix nic diagnostic return rings producer index registers 1-16 (offset 0x3c80-0x3cbc) ................... 458 nic diagnostic send bd consumer index registers 1-16 (offset 0x3cc0-0x3cfc)........................ 459 memory arbiter registers ....................................................................................................................... 460 memory arbiter mode register (offset 0x4000) ................................................................................. 46 0 memory arbiter status register (offset 0x4004) ................................................................................ 4 63 memory arbiter trap address low register (offset 0x4008) ............................................................. 465 memory arbiter trap address high register (offset 0x400c)............................................................ 465 buffer manager control registers .......................................................................................................... 466 buffer manager mode register (offset 0x4400) ................................................................................. 46 7 buffer manager status register (offset 0x4404) ................................................................................ 4 67 mbuf pool base address register (offset 0x4408) .......................................................................... 468 bcm5705, bcm5714, bcm5721, and bcm5751 mac transceivers only ................................. 468 rest of bcm57xx family ......................................................................................................... ... 468 mbuf pool length register (offset 0x440c) ..................................................................................... 4 69 bcm5705, bcm5714, bcm5721, and bcm5751 mac transceivers only ................................. 469 rest of bcm57xx family ......................................................................................................... ... 469 read dma mbuf low watermark register (offset 0x4410) ............................................................. 469 mac rx mbuf low watermark register (offset 0x4414)................................................................. 470 mbuf high watermark register (offset 0x4418)............................................................................... 470 rx risc mbuf cluster allocation request register (offset 0x441c) .............................................. 470 rx risc mbuf allocation response register (offset 0x4420) ........................................................ 471 rx cpu mbuf allocation response register (0x4420h, bcm5714 and bcm5715 only)................ 471 tx risc mbuf allocation response register (offset 0x4424)......................................................... 472 tx risc mbuf allocation response register (offset 0x4428)......................................................... 472 dma descriptor pool initialization register (offset 0x442c-0x4433) ................................................. 472 dma descriptor pool low watermark register (offset 0x4434) ........................................................ 473 dma descriptor pool high watermark register (offset 0x4438) ....................................................... 473 bm hardware diagnostic 1 register (offset 0x444c)......................................................................... 473 bcm5705, bcm5788, bcm5721, bcm5751, and bcm5752 devices only................................ 473 rest of bcm57xx family ......................................................................................................... ... 474 bm hardware diagnostic 2 register (offset 0x4450) ......................................................................... 474 bcm5705, bcm5788, bcm5721, bcm5751, and bcm5752 devices only................................ 474 rest of bcm57xx family ......................................................................................................... ... 475 bm hardware diagnostic 3 register (offset 0x4454) ......................................................................... 475 bcm5705, bcm5788, bcm5721, bcm5751, bcm5752, bcm5714, and bcm5715 www.datasheet.in broadcom corporation page xxx document 57xxct-pgxx2-ri devices only ................................................................................................................... .............475 rest of bcm57xx family......................................................................................................... ....476 receive flow threshold register (offset 0x4458)..............................................................................47 6 read dma control registers ...................................................................................................................477 read dma mode register (offset 0x4800)......................................................................................... 477 read dma status register (offset 0x4804)....................................................................................... .479 write dma control registers ..................................................................................................................480 write dma mode register (offset 0x4c00) ........................................................................................ 480 write dma status register (offset 0x4c04) ...................................................................................... .482 rx risc registers ............................................................................................................................... ..... 483 rx risc mode register (offset 0x5000).......................................................................................... ..483 rx risc state register (offset 0x5004) ......................................................................................... ...485 rx risc program counter (offset 0x501c) .......................................................................................4 86 rx risc hardware breakpoint register (offset 0x5034) ...................................................................486 tx risc registers ............................................................................................................................... ..... 487 tx risc mode register (offset 0x5400) .......................................................................................... ..487 tx risc state register (offset 0x5404)......................................................................................... ....488 tx risc program counter (offset 0x541c) .......................................................................................4 89 low-priority mailboxes ............................................................................................................................490 interrupt mailbox 0 register (offset 0x5800)................................................................................... ....492 other interrupt mailbox registers (offset 0x5808-0x5818).................................................................492 general mailbox registers 1-8 (offset 0x5820-0x5858) .....................................................................492 receive bd standard producer ring index register (offset 0x5868) ................................................492 receive bd jumbo producer ring index register (offset 0x5870)....................................................492 receive bd mini producer ring index register (offset 0x5878, bcm5700 and bcm5701 only)......492 receive bd return ring 1-16 consumer indices registers (offset 0x5880-0x58f8) ........................492 send bd ring 1-4 host producer indices registers (offset 0x5900-0x5918) ....................................493 send bd ring 5-16 host producer indices registers (offset 0x5920-0x5978, bcm5700 and bcm5701 only) .......................................................................................................................... ..........................493 send bd ring 1-16 nic producer indices registers (offset 0x5980-0x59f8, bcm5700 and bcm5701 only) .......................................................................................................................... ..........................493 flow-through queues ..............................................................................................................................4 94 ftq reset register (offset 0x5c00) ............................................................................................. .....494 mac tx fifo enqueue register (offset 0x5cb8) .............................................................................496 rxmbuf cluster free enqueue register (offset 0x5cc8)................................................................496 www.datasheet.in programmer?s guide bcm57xxct 01/29/08 broadcom corporation document 57xxct-pgxx2-ri page xxxi rdiq ftq write/peek register (offset 0x5cfc)............................................................................... 497 message signaled interrupt registers ................................................................................................... 498 msi mode register (offset 0x6000) .............................................................................................. ..... 498 msi status register (offset 0x6004) ............................................................................................ ...... 499 msi fifo access register (offset 0x6008)....................................................................................... .499 dma completion registers ..................................................................................................................... 500 dma completion mode register (offset 0x6400)............................................................................... 500 general control registers ....................................................................................................................... 501 mode control register (offset 0x6800) .......................................................................................... .... 502 miscellaneous configuration register (offset 0x6804)....................................................................... 504 miscellaneous local control register (offset 0x6808) ....................................................................... 507 timer register (offset 0x680c) ................................................................................................. ......... 510 rx-risc event register (offset 0x6810) ......................................................................................... .. 510 rx-risc timer reference register (offset 0x6814) ......................................................................... 511 rx-risc semaphore register (offset 0x6818).................................................................................. 511 remote rx-risc attention register (offset 0x681c)........................................................................ 512 tx-risc event register (offset 0x6820) ......................................................................................... .. 512 tx-risc timer reference register (offset 0x6824).......................................................................... 513 tx-risc semaphore register (offset 0x6828) .................................................................................. 513 remote tx-risc attention register (offset 0x682c) ........................................................................ 514 serial eeprom address register (offset 0x6838) ............................................................................ 514 serial eeprom data register (offset 0x683c) ................................................................................. 515 serial eeprom control register (offset 0x6840).............................................................................. 515 mdi control register (offset 0x6844)........................................................................................... ...... 515 serial eeprom delay register (offset 0x6848) ................................................................................ 516 rx cpu event enable register (offset 0x684c) ............................................................................... 516 gig serdes prbs control register (0x6850, bcm5714 and bcm5715 only) .................................. 517 gig serdes prbs status register (0x6854, bcm5714 and bcm5715 only).................................... 517 grc message exchange out register (0x6870h, bcm5714 and bcm5715 only) .......................... 517 grc message exchange in register (0x6874h, bcm5714 and bcm5715 only) ............................. 517 wake-on lan registers .......................................................................................................................... 518 wol mode register (offset 0x6880).............................................................................................. .... 518 wol config register (offset 0x6884) ............................................................................................ .... 519 wol state machine status register (offset 0x6888)......................................................................... 519 miscellaneous tpm register ................................................................................................................... 520 www.datasheet.in broadcom corporation page xxxii document 57xxct-pgxx2-ri miscellaneous tpm register (offset 0x6890) ..................................................................................... 520 fast boot program counter register ..................................................................................................... 520 fast boot program counter register (offset 0x6894) ........................................................................520 asf support registers (not applicable to bcm5700) ..........................................................................521 asf control register (offset 0x6c00) ........................................................................................... .....522 smbus input register (offset 0x6c04) ........................................................................................... ....524 smbus output register (offset 0x6c08) .......................................................................................... ..524 asf watchdog timer register (offset 0x6c0c).................................................................................526 asf heartbeat timer register (offset 0x6c10)..................................................................................5 26 poll asf timer register (offset 0x6c14)........................................................................................ ....526 poll legacy timer register (offset 0x6c18) ..................................................................................... ..527 retransmission timer register (offset 0x6c1c) ................................................................................52 7 time stamp counter register (offset 0x6c20)...................................................................................5 27 smbus driver select register (offset 0x6c24)................................................................................... 528 rest of bcm57xx family......................................................................................................... ....528 bcm5721, bcm5751, and bcm5752 tpm interface registers ..............................................................529 tpm command register (offset 0x6c30)........................................................................................... 529 tpm data register (offset 0x6c34).............................................................................................. ......529 bcm5714 and bcm5715 tpm interface registers .................................................................................530 tpm command register (0x6c30) .................................................................................................. ....530 tpm data register (0x6c34) ..................................................................................................... .........530 auxiliary smbus master status register (offset 0x6c40) ..................................................................531 auxiliary smbus master control register (offset 0x6c44)...................................................................532 auxiliary smbus master command register (offset 0x6c48) ............................................................533 auxiliary smbus block data register (offset 0x6c4c).......................................................................534 auxiliary smbus slave address/control register (offset 0x6c50).....................................................534 auxiliary smbus slave status register (offset 0x6c54) ....................................................................535 auxiliary smbus slave data register (offset 0x6c58) .......................................................................536 smbus address resolution protocol registers (offset 0x6ce0)........................................................537 smbus arp status register (offset0x6ce4) .....................................................................................53 8 udid register 0 (offset 0x6ce8)................................................................................................ ........539 udid register 1 (offset 0x6cec) ................................................................................................ .......539 udid register 2 (offset 0x6cf0)................................................................................................ ........539 udid register 3 (offset 0x6cf4)................................................................................................ ........539 auxiliary smbus master status channel 1 register (offset 0x6c80) .................................................540 www.datasheet.in programmer?s guide bcm57xxct 01/29/08 broadcom corporation document 57xxct-pgxx2-ri page xxxiii auxiliary smbus master control channel 1 register (offset 0x6c84) ............................................... 541 auxiliary smbus master command channel 1 register (offset 0x6c88) .......................................... 542 auxiliary smbus block data channel 1 register (offset 0x6c8c)..................................................... 542 auxiliary smbus slave address/control channel 1 register (offset 0x6c90) ................................... 543 auxiliary smbus slave status channel 1 register (offset 0x6c94)................................................... 543 auxiliary smbus slave data channel 1 register (offset 0x6c98) ..................................................... 544 auxiliary smbus master status channel 2 register (offset 0x6cc0) ................................................ 544 auxiliary smbus master control channel 2 register (offset 0x6cc4)............................................... 545 auxiliary smbus master command channel 2 register (offset 0x6cc8).......................................... 546 auxiliary smbus block data channel 2 register (offset 0x6ccc) .................................................... 547 auxiliary smbus slave address/control channel 2 register (offset 0x6cd0) .................................. 547 auxiliary smbus slave status channel 2 register (offset 0x6cd4) .................................................. 547 auxiliary smbus slave data channel 2 register (offset 0x6cd8)..................................................... 548 non-volatile memory interface registers (not applicable to bcm5700 or bcm5701) ...................... 549 nvm command register (offset 0x7000) .......................................................................................... 5 50 nvm status register (0x7004h).................................................................................................. ....... 551 nvm write register (offset 0x7008)............................................................................................. ...... 551 nvm address register (offset 0x700c) ........................................................................................... .. 551 nvm read register (offset 0x7010) .............................................................................................. .... 552 nvm config 1 register (offset 0x7014) .......................................................................................... ... 552 nvm config 2 register (offset 0x7018) .......................................................................................... ... 554 nvm config 3 register (offset 0x701c) .......................................................................................... ... 554 software arbitration register (offset 0x7020) .................................................................................. .. 555 nvm access register (offset 0x7024) ............................................................................................ ... 556 nvm write1 register (offset 0x7028)............................................................................................ ..... 557 nvm arbitration watchdog timer register (offset 0x702c)............................................................... 557 address lockout boundary register (offset 0x7030)......................................................................... 558 bist registers ............................................................................................................................... ........... 558 bist control register (offset 0x7400) .......................................................................................... ..... 559 bist status register (offset 0x7404)........................................................................................... ...... 559 bist mode register (0x7400h) .................................................................................................. ....... 560 bist status register (0x7404h)................................................................................................. ........ 560 bist control register (0x7408h) ................................................................................................ ....... 561 uart registers ............................................................................................................................... ......... 562 uart receive buffer (dlab=0, r/o) register (offset 0x7800) ........................................................ 562 www.datasheet.in broadcom corporation page xxxiv document 57xxct-pgxx2-ri uart transmit holding (dlab=0, w/o) register (offset 0x7800) ....................................................563 uart divisor latch (low) (dlab=1) register (offset 0x7800) ..........................................................563 uart interrupt enable (dlab=0) registers (offset 0x7804) .............................................................563 uart divisor latch high (dlab=1) register (offset 0x7804) ...........................................................563 uart interrupt identity register (offset 0x7808, r/o) .......................................................................564 uart fifo control register (offset 0x7808, w/o)............................................................................564 uart line control register (offset 0x780c)..................................................................................... .565 uart modem control register (offset 0x7810) .................................................................................565 uart line status register (offset 0x7814)...................................................................................... ..565 uart modem status register (offset 0x7818) ..................................................................................566 uart scratch register (offset 0x781c).......................................................................................... ...566 ump registers ............................................................................................................................... ...........567 ump attention enable register (offset 0x7800) ................................................................................5 67 ump attention status register (offset 0x7804) .................................................................................. 567 ump debug1 register (offset 0x7808)............................................................................................ ...568 ump command register (offset 0x7810)........................................................................................... 568 ump status register (offset 0x7814) ............................................................................................ .....570 ump frame read status register (offset 0x7818) ............................................................................571 ump frame read data register (offset 0x781c) ..............................................................................571 ump frame write control register (offset 0x7820) ...........................................................................572 ump frame write data register (offset 0x7824) ...............................................................................572 ump frame pre-fetch register (offset 0x7828) ................................................................................573 ump fifo remain register (offset 0x782c) .....................................................................................57 3 pcie registers ............................................................................................................................... ...........574 tlp control register (offset 0x7c00)........................................................................................... ......576 tlp workaround register (offset 0x7c04)........................................................................................ .577 write dma request upper address diagnostic register (offset 0x7c10) .........................................578 write dma request lower address diagnostic register (offset 0x7c14) .........................................578 write dma length/byte enable and request diagnostic register (offset 0x7c18)...........................578 read dma request upper address diagnostic register (offset 0x7c1c) ........................................578 read dma request lower address diagnostic register (offset 0x7c20) .........................................579 read dma length and request diagnostic register (offset 0x7c24) ...............................................579 msi dma request upper address diagnostic register (offset 0x7c28) ...........................................579 msi dma request lower address diagnostic register (offset 0x7c2c)...........................................579 msi dma length and request diagnostic register (offset 0x7c30) .................................................580 www.datasheet.in programmer?s guide bcm57xxct 01/29/08 broadcom corporation document 57xxct-pgxx2-ri page xxxv slave request length and type diagnostic register (offset 0x7c34) .............................................. 580 flow control inputs diagnostic register (offset 0x7c38)................................................................... 580 xmt state machines and gated requests diagnostic register (offset 0x7c3c).............................. 581 address ack xfer count and arb length diagnostic register (offset 0x7c40) .............................. 581 dma completion header diagnostic register 0 (offset 0x7c44)....................................................... 581 dma completion header diagnostic register 1 (offset 0x7c48)....................................................... 581 dma completion header diagnostic register 2 (offset 0x7c4c) ...................................................... 582 dma completion misc diagnostic register (offset 0x7c50) .............................................................. 582 dma completion misc diagnostic register (offset 0x7c54) .............................................................. 582 dma completion misc diagnostic register (offset 0x7c58) .............................................................. 583 split controller requested length and address ack remaining diagnostic register (offset 0x7c5c)....................................................................................................... ............. 583 split controller misc 0 register diagnostic register (offset 0x7c60) ................................................ 583 split controller misc 1 register diagnostic register (offset 0x7c64) ................................................ 584 tlp bus, dev, and func number register (offset 0x7c68, bcm5721, bcm5751, and bcm5752 only) .............................................................................................................. ............. 584 tlp debug register (offset 0x7c6c, bcm5721, and bcm5751 only) ............................................. 584 data link control register (offset 0x7d00)..................................................................................... ... 585 data link status register (offset 0x7d04) ...................................................................................... ... 587 data link attention register (offset 0x7d08) ................................................................................... .. 588 data link attention mask register (offset 0x7d0c)........................................................................... 588 next transmit sequence number debug register (offset 0x7d10) .................................................. 589 acked transmit sequence number debug register (offset 0x7d14) .............................................. 589 purged transmit sequence number debug register (offset 0x7d18) .............................................. 589 receive sequence number debug register (offset 0x7d1c) ........................................................... 589 data link replay register (offset 0x7d20) ...................................................................................... .. 590 data link ack timeout register (offset 0x7d24).............................................................................. 590 power management threshold register (offset 0x7d28) .................................................................. 590 retry buffer write pointer debug register (offset 0x7d2c) .............................................................. 591 retry buffer read pointer debug register (offset 0x7d30)............................................................... 591 retry buffer purged pointer debug register (offset 0x7d34)............................................................ 591 retry buffer read/write debug port (offset 0x7d38) ........................................................................ 591 error count threshold register (offset 0x7d3c) ............................................................................... 59 2 tlp error counter register (offset 0x7d40) ..................................................................................... .592 dllp error counter (offset 0x7d44) ............................................................................................. ..... 592 www.datasheet.in broadcom corporation page xxxvi document 57xxct-pgxx2-ri nak received counter (offset 0x7d48) ........................................................................................... ..593 data link test register (offset 0x7d4c) ........................................................................................ ....593 packet bist register (offset 0x7d50)........................................................................................... .....594 phy mode register (offset 0x7e00).............................................................................................. .....594 phy/link status register (offset 0x7e04)....................................................................................... ...595 phy/link ltssm control register (offset 0x7e08) ...........................................................................595 phy/link training link number (offset 0x7e0c) ...............................................................................596 phy/link training lane number (offset 0x7e10)...............................................................................596 phy/link training n_fts (offset 0x7e14) ........................................................................................ .596 phy attention register (offset 0x7e18) ......................................................................................... ....597 phy attention mask register (offset 0x7e1c) ...................................................................................5 97 phy receive error counter (offset 0x7e20) ...................................................................................... 598 phy receive framing error counter (offset 0x7e24) ........................................................................598 phy receive error threshold register (offset 0x7e28).....................................................................598 phy test control register (offset 0x7e2c) ...................................................................................... .599 phy/serdes control override register (offset 0x7e30) ....................................................................600 phy timing parameter override register (offset 0x7e34) ................................................................601 phy hardware diagnostic 1 register (offset 0x7e38) .......................................................................601 phy hardware diagnostic 2 register (offset 0x7e3c).......................................................................602 transceiver registers ..............................................................................................................................6 03 00-0fh 1000bt/100btx/10bt registers ...........................................................................................6 04 mii control register (phy_addr = 0x1, reg_addr = 00h)...........................................................604 mii status register (phy_addr = 0x1, reg_addr = 01h) ............................................................606 phy identifier registers (phy_addr = 0x1, reg_addresses 02h and 03h) ................................608 auto-negotiation advertisement register (phy_addr = 0x1, reg_addr = 04h)..........................608 auto-negotiation link partner ability register (phy_addr = 0x1, reg_addr = 05h)...................610 auto-negotiation expansion register (phy_addr = 0x1, reg_addr = 06h)................................612 next page transmit register (phy_addr = 0x1, reg_addr = 07h).............................................613 link partner received next page register (phy_addr = 0x1, reg_addr = 08h) .......................614 1000base-t control register (phy_addr = 0x1, reg_addr = 09h)...........................................615 1000base-t status register (phy_addr = 0x1, reg_addr = 0ah)............................................616 ieee extended status register (phy_addr = 0x1, reg_addr = 0fh).........................................617 00h-0fh 1000base-x register map detailed description .................................................................618 00h: 1000-x mii control register............................................................................................... ..618 01h: 1000-x mii status register ................................................................................................ ..619 www.datasheet.in programmer?s guide bcm57xxct 01/29/08 broadcom corporation document 57xxct-pgxx2-ri page xxxvii 04h: 1000-x auto-negotiation advertisement register ............................................................... 620 05h: 1000-x auto-negotiation link partner ability register (base page) ................................... 621 06h: 1000-x auto-negotiation expansion register ..................................................................... 621 07h: 1000-x auto-negotiation next page transmit register ...................................................... 622 08h: 1000-x auto-negotiation link partner ability register (next page) .................................... 622 09h: 1000-x reserved register .................................................................................................. 622 0ah: 1000-x reserved register .................................................................................................. 622 0fh: 1000-x extended status register ....................................................................................... 623 phy extended control register (phy_addr = 0x1, reg_addr = 10h) ............................................... 623 phy extended status register (phy_addr = 0x1, reg_addr = 11h) ................................................ 626 receive error counter (phy_addr = 0x1, reg_addr = 12h).............................................................. 628 false carrier sense counter (phy_addr = 0x1, reg_addr = 13h).................................................... 628 receiver not_ok counters (phy_addr = 0x1, reg_addr = 14h) .................................................... 629 normal operation (crc count visibility = 0)............................................................................... 629 crc error count operation (crc count visibility = 1)............................................................... 629 expansion registers (bcm5705, bcm5721, bcm5751, bcm5752, bcm5714, and bcm5715 only) .... 630 expansion register access data (phy_addr = 01h, reg_addr = 15h) ............................... 630 expansion register access register (phy_addr = 0x1, reg_addr = 17h).............................. 630 expansion register 00h: receive/transmit packet counter ....................................................... 631 expansion register 01h: expansion interrupt status .................................................................. 631 expansion register 03h: serdes control .................................................................................... 632 expansion register 04h: multicolor led selector ....................................................................... 633 expansion register 05h: multicolor led flash rate controls..................................................... 634 expansion register 06h: multicolor led programmable blink controls...................................... 635 expansion register 10h: cable diagnostic controls ................................................................... 636 expansion register 11h: cable diagnostic results..................................................................... 637 expansion register 12h: cable diagnostic lengths channels 1/2.............................................. 638 expansion register 13h: cable diagnostic lengths channels 3/4.............................................. 639 auxiliary control register (bcm5714 and bcm5715 devices only).................................................. 640 auxiliary control register (shadow register selector = 000) ..................................................... 640 10base-t register (shadow register selector = 001)................................................................ 641 power/mii control register (shadow register selector = 010)................................................... 642 miscellaneous test register 1 (shadow register selector = 100).............................................. 643 miscellaneous test register 2 (shadow register selector = 101).............................................. 644 www.datasheet.in broadcom corporation page xxxviii document 57xxct-pgxx2-ri miscellaneous control register (shadow register selector = 111) ............................................644 auxiliary control register (except bcm5714 and bcm5715 devices) ..............................................645 auxiliary control register (phy_addr = 0x1, reg_addr = 18h, shadow = 000, normal)............645 auxiliary control register (phy_addr = 0x1, reg_addr = 18h, shadow = 001, 10base-t) ......648 auxiliary control register (phy_addr = 0x1, reg_addr = 18h, shadow = 010, power control) 651 auxiliary control register (phy_addr = 0x1, reg_addr = 18h, shadow = 100, misc test 1).....653 auxiliary control register (phy_addr = 0x1, reg_addr = 18h, shadow = 111, misc control) ...655 auxiliary status summary register (phy_addr = 0x1, reg_addr = 19h) ..........................................657 interrupt status register (phy_addr = 0x1, reg_addr = 1ah)...........................................................659 interrupt mask register (phy_addr = 0x1, reg_addr = 1bh) ............................................................661 misc shadow registers (phy_addr = 0x1, reg_addr = 1ch; bcm5702, BCM5703, and bcm5704 only) .......................................................................................................................... ..........................662 spare control register 1 (address 1ch, enable by register 1ch bits[14:10] = 00010) .............662 spare control register 2 (address 1ch, shadow value 00100) .................................................663 spare control register 3 (address 1ch, shadow value 00101) .................................................664 led status register (address 1ch, shadow register selector = 01000) ...................................665 led control register (address 1ch, shadow value 01001) .......................................................667 auto power-down register (address 1ch, shadow value 01010)..............................................668 misc shadow registers (phy_addr = 0x1, reg_addr = 1ch; bcm5705, bcm5721, bcm5751, bcm5752, bcm5714, and bcm5715 only) ........................................................................................669 spare control 1 ................................................................................................................ ............669 clock alignment control........................................................................................................ .......671 spare control 2 ................................................................................................................ ............673 spare control 3 ................................................................................................................ ............674 led status ..................................................................................................................... ..............676 led control.................................................................................................................... ..............678 auto power-down ................................................................................................................ ........679 led selector 1 ................................................................................................................. ............681 led selector 2 ................................................................................................................. ............682 led gpio control/status........................................................................................................ .....684 autodetect sgmii/media converter .............................................................................................68 5 1000base-x auto-negotiation debug.........................................................................................686 auxiliary 1000base-x control ................................................................................................... ..688 auxiliary 1000base-x status .................................................................................................... ..690 miscellaneous 1000base-x status .............................................................................................692 www.datasheet.in programmer?s guide bcm57xxct 01/29/08 broadcom corporation document 57xxct-pgxx2-ri page xxxix autodetect medium .............................................................................................................. ........ 694 mode control ................................................................................................................... ............ 696 hcd status register (phy_addr = 0x1, reg_addr = 1dh, bit 15 = 1) .............................................. 698 master/slave seed register (phy_addr = 0x1, reg_addr = 1dh, bit 15 = 0)................................... 699 phy test register 1 (phy_addr = 0x1, reg_addr = 1eh) .............................................................. 700 phy test register 2 (phy_addr = 0x1, reg_addr = 1fh) ......................................................... 701 notes ............................................................................................................................... .......................... 703 flow control scenario ............................................................................................................................. 703 file transfer .................................................................................................................. ...................... 704 speed mismatch ................................................................................................................. ................ 704 switch buffers run low ......................................................................................................... ............. 705 switch backpressure ............................................................................................................ .............. 706 switch flow control ............................................................................................................ ................ 706 file transfer complete ......................................................................................................... .............. 707 pause control frame ............................................................................................................................... 707 reference materials ............................................................................................................................... .. 708 apm ............................................................................................................................... ............................ 708 advanced configuration and power interface ...................................................................................... 712 pci ............................................................................................................................... .............................. 717 pme ............................................................................................................................ ........................ 717 3.3 vaux....................................................................................................................... ....................... 717 slot power..................................................................................................................... ...................... 717 smi/sci........................................................................................................................ ....................... 717 signal sampling to determine pci configuration ................................................................................. 720 determining slot type .......................................................................................................... .............. 720 determining pci clock.......................................................................................................... .............. 721 determining pci mode........................................................................................................... ............. 721 reset intervals ............................................................................................................................... ........... 722 gpio hold condition ............................................................................................................................... 723 www.datasheet.in broadcom corporation page xl document 57xxct-pgxx2-ri www.datasheet.in programmer?s guide bcm57xxct 01/29/08 broadcom corporation document 57xxct-pgxx2-ri page xli l ist of f igures figure 1: typical bcm5700-based nic board layout ............................................................................... ...... 12 figure 2: typical bcm5700-based fiber-optic board block diagram ............................................................. 13 figure 3: typical bcm5701-based nic board block diagram ........................................................................ 16 figure 4: typical bcm5702-based nic board block diagram ........................................................................ 18 figure 5: typical BCM5703c-based nic board block diagram...................................................................... 2 0 figure 6: typical BCM5703s-based nic board block diagram ...................................................................... 2 2 figure 7: typical bcm5704c-based nic board block diagram...................................................................... 2 4 figure 8: dual mac modes of operation .......................................................................................... ............... 25 figure 9: handshaking using power signal status signals ........................................................................ ..... 27 figure 10: daisy-chained arbiters .............................................................................................. ..................... 28 figure 11: typical bcm5704s-based nic board block diagram .................................................................... 30 figure 12: typical bcm5705-based nic board block diagram ...................................................................... 3 3 figure 13: typical bcm5721-based nic board block diagram ...................................................................... 3 5 figure 14: typical bcm5751-based nic board block diagram ...................................................................... 3 7 figure 15: typical bcm5714c-based lom design block diagram................................................................. 39 figure 16: typical bcm5714s-based lom design block diagram................................................................. 41 figure 17: typical bcm5715c-based lom design block diagram................................................................. 43 figure 18: typical bcm5715s-based lom design block diagram................................................................. 45 figure 19: typical bcm5751-based nic board block diagram ...................................................................... 4 7 figure 20: functional block diagram ............................................................................................ ................... 49 figure 21: receive data path ................................................................................................... ....................... 50 figure 22: transmit data path .................................................................................................. ....................... 52 figure 23: dma read engine..................................................................................................... ...................... 53 figure 24: dma write engine.................................................................................................... ....................... 54 figure 25: asf system architecture ............................................................................................. ................... 56 figure 26: smbus start and stop conditions..................................................................................... .............. 58 figure 27: two masters arbitrate for smbus ..................................................................................... .............. 59 figure 28: master stops transaction after slave naks........................................................................... ........ 59 figure 29: smbus transaction phases ............................................................................................ ................ 60 figure 30: smb_clock period (master mode) ...................................................................................... ........ 60 figure 31: host coalescing engine .............................................................................................. .................... 62 figure 32: media independent interface......................................................................................... .................. 69 figure 33: gmii block.......................................................................................................... ............................. 71 www.datasheet.in programmer?s guide bcm57xxct 01/29/08 broadcom corporation document 57xxct-pgxx2-ri page xlii figure 34: tbi block ........................................................................................................... .............................. 72 figure 35: mdi register interface .............................................................................................. ...................... 73 figure 36: ump mii connections between bmc and ump supported bcm57xx devices ............................ 75 figure 37: ump rmii connections between bmc and ump supported bcm57xx devices.......................... 76 figure 38: pci/pci-x bus interface............................................................................................. ..................... 79 figure 39: read transaction based on target type ............................................................................... ........ 80 figure 40: single data phase disconnect........................................................................................ ................ 81 figure 41: split memory real timeline .......................................................................................... .................. 84 figure 42: terminating pcixcap to determine pci-x operation.................................................................... 86 figure 43: generic ring diagram................................................................................................ ..................... 90 figure 44: transmit ring data structure architecture diagram ................................................................... .... 93 figure 45: receive return ring memory architecture diagram ..................................................................... .96 figure 46: partial status block updates........................................................................................ ................. 103 figure 47: receive buffer descriptor cycle ..................................................................................... .............. 117 figure 48: standard ring rcb for setup of a host-based standard producer ring ..................................... 120 figure 49: frame sizes ......................................................................................................... ......................... 121 figure 50: receive buffer descriptor and extended buffer descriptor .......................................................... 12 2 figure 51: mailbox registers................................................................................................... ....................... 124 figure 52: class of service example ............................................................................................ ................. 129 figure 53: overview diagram of rx flow ......................................................................................... ............. 131 figure 54: relationships between all components of a send ring............................................................... 13 5 figure 55: nic send ring ....................................................................................................... ....................... 136 figure 56: combining nic local rings ........................................................................................... ............... 137 figure 57: max_len field in ring control block ................................................................................. ........... 137 figure 58: relationship between send buffer descriptors ........................................................................ .... 139 figure 59: scatter gather of frame fragments ................................................................................... .......... 141 figure 60: transmit data flow .................................................................................................. ..................... 143 figure 61: basic driver flow to send a packet .................................................................................. ............ 144 figure 62: firmware image moved to scratchpad/rxmbuf ......................................................................... 16 2 figure 63: local contexts...................................................................................................... ......................... 179 figure 64: header type register 0xe ............................................................................................ ................ 180 figure 65: header region registers ............................................................................................. ................. 181 figure 66: device-specific registers ........................................................................................... .................. 184 figure 67: register indirect access............................................................................................ .................... 187 figure 68: indirect memory access .............................................................................................. .................. 189 www.datasheet.in programmer?s guide bcm57xxct 01/29/08 broadcom corporation document 57xxct-pgxx2-ri page xliii figure 69: low-priority mailbox access for indirect mode ....................................................................... ...... 191 figure 70: standard memory mapped i/o mode ..................................................................................... ....... 192 figure 71: memory window base address register ................................................................................. ..... 193 figure 72: standard mode memory window ......................................................................................... ......... 194 figure 73: flat mode memory map ................................................................................................ ................ 196 figure 74: flat mode memory map ................................................................................................ ................ 200 figure 75: techniques for accessing bcm57xx local memory.................................................................... 201 figure 76: pci command register ................................................................................................ ................ 202 figure 77: pci base address register........................................................................................... ................ 203 figure 78: pci base address register bits read in standard mode............................................................. 203 figure 79: pci base address register bits read in flat mode .................................................................... .204 figure 80: read and write channels of dma engine ............................................................................... ..... 206 figure 81: 32_bit_pci_bus bit affects the req64 and ack64 signals........................................................ 208 figure 82: host software can override default pci command encoding .................................................... 209 figure 83: all c/be [0..3] lines asserted and all data lines valid ................................................................. 211 figure 84: watermark levels for pci and pci-x queued data ..................................................................... 2 14 figure 85: bus masters drive par and par64 on pci transactions............................................................ 215 figure 86: pci-x transaction includes attribute phase .......................................................................... ....... 217 figure 87: relaxed ordered transactions ........................................................................................ ............. 218 figure 88: out-of-order memory writes .......................................................................................... ............... 219 figure 89: mapping expansion rom space into internal memory (bcm5700 & bcm5701 only) ................. 223 figure 90: power state transition diagram ...................................................................................... ............. 226 figure 91: default translation (no swapping) on 64-bit pci ..................................................................... .... 233 figure 92: default translation (no swapping) on 32-bit pci ..................................................................... .... 233 figure 93: word swap enable translation on 32-bit pci (no byte swap) ...................................................... 234 figure 94: byte swap enable translation on 32-bit pci (no word swap)....................................................... 234 figure 95: byte and word swap enable translation on 32-bit pci................................................................ 2 34 figure 96: auto-negotiation configuration word encoding........................................................................ .... 245 figure 97: trace routed between phy intr and mac mdint pins ........................................................... 250 figure 98: polling the phy?s mdi status register ............................................................................... .......... 251 figure 99: routing the link ready signal ....................................................................................... ............... 251 figure 100: lnkrdy pin programming (active high or active low)............................................................. 252 figure 101: wol functional block diagram ....................................................................................... ........... 269 figure 102: comparing ethernet frames against available patterns (10/100 ethernet wol) ...................... 272 figure 103: unused rows and rules must be initialized with zeros ............................................................. 27 3 www.datasheet.in programmer?s guide bcm57xxct 01/29/08 broadcom corporation document 57xxct-pgxx2-ri page xliv figure 104: traditional interrupt scheme ....................................................................................... ................ 289 figure 105: message-signaled interrupt scheme .................................................................................. ........ 290 figure 106: msi data field ..................................................................................................... ....................... 291 figure 107: basic driver interrupt service routine flow........................................................................ ........ 293 figure 108: bcm5700/5701/5702/5703/5704 clock control logic ................................................................ 336 figure 109: file transfer scenario: ftp session begins ......................................................................... ..... 704 figure 110: file transfer scenario: speed mismatch ............................................................................. ....... 704 figure 111: file transfer scenario: speed buffers run low ...................................................................... ... 705 figure 112: file transfer scenario: switch backpressure ........................................................................ ..... 706 figure 113: file transfer scenario: switch flow control ........................................................................ ....... 706 figure 114: file transfer scenario: file transfer complete ..................................................................... ..... 707 figure 115: pause control frame ................................................................................................ .................. 707 figure 116: apm architecture ................................................................................................... ..................... 709 figure 117: states for power consumption management............................................................................ .. 710 figure 118: advanced configuration and power interface (acpi) components............................................ 713 figure 119: os power management (ospm) global states ......................................................................... 71 4 figure 120: acpi sleep states.................................................................................................. ..................... 715 figure 121: power management configuration during post ....................................................................... 71 8 figure 122: general purpose event block ........................................................................................ ............. 719 figure 123: sampling signals to determine whether the nic is in a pci or pci-x slot................................ 720 figure 124: sampling m66en to determine 66 mhz?start software pci operation ................................... 721 figure 125: sampling req64 to determine 64-bit pci mode ........................................................................ 721 figure 126: pci-specified reset interval ....................................................................................... ................ 722 figure 127: gpio hold condition................................................................................................ ................... 723 www.datasheet.in programmer?s guide bcm57xxct 01/29/08 broadcom corporation document 57xxct-pgxx2-ri page xlv l ist of t ables table 1: family features....................................................................................................... ............................. 2 table 2: family revision levels................................................................................................ ......................... 5 table 3: pseudocode............................................................................................................ .............................. 9 table 4: bcm5700 nic part component breakdown .................................................................................. .... 12 table 5: bcm5700 fiber-optic part component breakdown.......................................................................... .14 table 6: bcm5701 nic part component breakdown .................................................................................. .... 16 table 7: bcm5702 nic part component breakdown .................................................................................. .... 18 table 8: BCM5703c nic part component breakdown................................................................................. ... 20 table 9: BCM5703s nic part component breakdown................................................................................. ... 22 table 10: bcm5704c nic part component breakdown................................................................................ .. 24 table 11: dual mac modes of operation.......................................................................................... ............... 26 table 12: dual-mac control register channel control bits ....................................................................... ..... 26 table 13: software arbitration register bits................................................................................... .................. 28 table 14: bcm5704s nic part component breakdown................................................................................ .. 30 table 15: bcm5705 nic part component breakdown ................................................................................. ... 33 table 16: bcm5721 nic part component breakdown ................................................................................. ... 35 table 17: bcm5751 nic part component breakdown ................................................................................. ... 37 table 18: bcm5714c nic part component breakdown................................................................................ .. 39 table 19: bcm5714s nic part component breakdown................................................................................ .. 41 table 20: bcm5715c nic part component breakdown................................................................................ .. 43 table 21: bcm5715s nic part component breakdown................................................................................ .. 45 table 22: bcm5751 nic part component breakdown ................................................................................. ... 47 table 23: pci commands supported by the bcm57xx family ...................................................................... 82 table 24: pci-x bus speeds and loads........................................................................................... ............... 83 table 25: pci-x commands supported by the bcm57xx family ................................................................... 85 table 26: ring control block format ............................................................................................ ................... 91 table 27: flag fields for a ring ............................................................................................... ........................ 91 table 28: send rings in bcm5700/5701/5702/5703c/5703s/5704c/5704s devices .................................... 92 table 29: send buffer descriptors format ....................................................................................... ................ 94 table 30: defined flags for send buffer descriptors ............................................................................ ........... 94 table 31: mini receive producer ring(bcm5700 mac only) ......................................................................... 97 table 32: standard receive producer ring ....................................................................................... .............. 98 table 33: jumbo receive producer ring (bcm5700/5701/5702/5703c/5703s/5704c/5704s only) ............. 98 www.datasheet.in programmer?s guide bcm57xxct 01/29/08 broadcom corporation document 57xxct-pgxx2-ri page xlvi table 34: receive return rings................................................................................................. ...................... 99 table 35: receive descriptors format ........................................................................................... ................ 100 table 36: defined flags for receive buffers.................................................................................... .............. 100 table 37: defined error flags for receive buffers.............................................................................. ........... 102 table 38: status block format: bcm5705/5788/5721/5751/5752/5714/5715 ............................................... 104 table 39: status block format (all others) ..................................................................................... ................ 105 table 40: status word flags .................................................................................................... ...................... 106 table 41: mac statistics ....................................................................................................... ......................... 107 table 42: interface statistics ................................................................................................. ......................... 108 table 43: send data initiator host interrupts statistics....................................................................... ........... 109 table 44: send data initiator nic bd coalescing thresholds statistics........................................................ 10 9 table 45: receive list placement nic bd coalescing thresholds statistics ................................................ 109 table 46: send data initiator dma resources statistics ......................................................................... ...... 110 table 47: receive list placement dma resources statistics ...................................................................... .110 table 48: send data initiator mac resources statistics ......................................................................... ...... 110 table 49: receive list placement mac resources statistics ...................................................................... .110 table 50: internal mac receive statistics ...................................................................................... ............... 111 table 51: internal mac transmit statistics ..................................................................................... ............... 113 table 52: send data initiator class of service statistics ...................................................................... ......... 113 table 53: receive list placement class of service statistics................................................................... ..... 113 table 54: statistics block memory .............................................................................................. ................... 114 table 55: receiver producer rings supported by bcm57xx family ............................................................ 118 table 56: receive rules configuration register................................................................................. ........... 126 table 57: receive bd rules control register .................................................................................... ........... 127 table 58: receive bd rules value/mask register ................................................................................. ....... 128 table 59: frame format with 802.1q vlan tag inserted ........................................................................... .. 130 table 60: combining send rings................................................................................................. .................. 138 table 61: recommended bcm57xx setting for the dma read/write control register ............................... 149 table 62: recommended bcm57xx internal memory-only memory pool settings...................................... 150 table 63: recommended bcm5700 external ssram memory pool settings .............................................. 150 table 64: recommended bcm57xx dma resource pool settings.............................................................. 151 table 65: recommended bcm57xx mac memory pool watermark settings.............................................. 151 table 66: recommended bcm57xx dma memory pool watermark settings.............................................. 151 table 67: recommended bcm57xx low watermark maximum receive frames settings ......................... 152 table 68: recommended bcm57xx standard ring initialization settings for internal memory only ........... 152 www.datasheet.in programmer?s guide bcm57xxct 01/29/08 broadcom corporation document 57xxct-pgxx2-ri page xlvii table 69: recommended bcm5700 standard ring initialization settings for external ssram .................. 152 table 70: recommended bcm57xx jumbo ring initialization settings for internal memory only ............... 153 table 71: recommended bcm5700 jumbo ring initialization settings for external ssram ....................... 153 table 72: recommended bcm5700 mini ring initialization settings for external ssram ........................... 153 table 73: examples of bcm57xx replenish threshold settings .................................................................. 154 table 74: recommended bcm57xx host coalescing tick counter settings ............................................... 156 table 75: recommended bcm57xx host coalescing frame counter settings ........................................... 156 table 76: recommended bcm57xx interrupt tick counter settings............................................................ 157 table 77: recommended bcm57xx max coalesced frames during interrupt counter settings................. 157 table 78: recommended bcm57xx statistics tick setting .......................................................................... 157 table 79: addressing perspectives .............................................................................................. .................. 163 table 80: mac address registers ................................................................................................ .................. 167 table 81: multicast hash table registers....................................................................................... ............... 169 table 82: netxtreme mem. map (5700 (int. sram)/5701/5702/5703c/5703s/5704c/5704s mac only)..... 171 table 83: bcm5705, bcm5788, bcm5721, bcm5751, and bcm5752 address map .................................. 172 table 84: bcm5714c, bcm5714s, bcm5715c, bcm5715s memory map.................................................. 174 table 85: bcm5700-(external sram only) memory map ............................................................................. 1 75 table 86: header region registers .............................................................................................. ................. 182 table 87: device-specific registers............................................................................................ ................... 185 table 88: pci address map standard view ........................................................................................ ........... 193 table 89: pci address map flat view............................................................................................ ................ 197 table 90: bcm57xx pci registers................................................................................................ ................ 204 table 91: recommended setting for pci command encoding ..................................................................... 210 table 92: pci -x registers..................................................................................................... ........................ 222 table 93: gpio usage for bcm5700/bcm5701 power management for broadcom drivers ........................ 228 table 94: gpio usage for BCM5703c/BCM5703s and later power management for broadcom drivers... 228 table 95: bcm57xx power pins................................................................................................... ................. 228 table 96: bcm57xx power management registers ................................................................................... .. 230 table 97: endian example ....................................................................................................... ...................... 231 table 98: storage of big-endian data........................................................................................... ................. 231 table 99: storage of little-endian data ........................................................................................ ................. 231 table 100: rcb (big endian 32-bit format) ...................................................................................... .............. 233 table 101: big-endian internal packet data format .............................................................................. ........ 235 table 102: 64-bit pci bus (wsd = 0, bsd = 0) ................................................................................... .......... 235 table 103: 32-bit pci bus (wsd = 0, bsd = 0) ................................................................................... .......... 236 www.datasheet.in programmer?s guide bcm57xxct 01/29/08 broadcom corporation document 57xxct-pgxx2-ri page xlviii table 104: 64-bit pci bus (wsd = 0, bsd = 1) ................................................................................... .......... 236 table 105: 32-bit pci bus (wsd = 0, bsd = 1) ................................................................................... .......... 236 table 106: 64-bit pci bus (wsd = 1, bsd = 0) ................................................................................... .......... 237 table 107: 32-bit pci bus (wsd = 1, bsd = 0) ................................................................................... .......... 237 table 108: 64-bit pci bus (wsd = 1, bsd = 1) ................................................................................... .......... 237 table 109: 32-bit pci bus (wsd = 1, bsd = 1) ................................................................................... .......... 237 table 110: send buffer descriptor (big-endian 64-bit format) ................................................................... .... 238 table 111: send buffer descriptor (big-endian 32-bit format) ................................................................... .... 238 table 112: send buffer descriptor (little-endian 32-bit format) with no swapping....................................... 239 table 113: send buffer descriptor (little-endian 32-bit format) with word swapping................................... 239 table 114: send buffer descriptor (big-endian 32-bit format) with byte swapping....................................... 239 table 115: send buffer descriptor (big-endian 32-bit format) with word and byte swapping ...................... 240 table 116: required memory regions for wol pattern............................................................................. ... 270 table 117: 10/100 mbps mode frame patterns memory .............................................................................. .273 table 118: frame control field for 10/100 mbps mode............................................................................ ..... 274 table 119: example of splitting 10/100 mbps frame data in pattern data structure ................................... 274 table 120: firmware mailbox initialization ..................................................................................... ................ 275 table 121: recommended settings for phy auto-negotiation...................................................................... 2 75 table 122: wol mode configuration .............................................................................................. ............... 276 table 123: wol mode clock inputs............................................................................................... ................ 276 table 124: magic packet detection logic enable ................................................................................. ......... 276 table 125: phy wol mode control registers ...................................................................................... ........ 277 table 126: integrated mac wol mode control registers ........................................................................... .278 table 127: transmit mac watermark recommendation............................................................................... 281 table 128: pause quanta........................................................................................................ ....................... 281 table 129: keep_pause recommended value ........................................................................................ ..... 282 table 130: statistic block ..................................................................................................... .......................... 282 table 131: phy flow control registers.......................................................................................... ............... 283 table 132: integrated mac flow control registers ............................................................................... ........ 284 table 133: interrupt-related registers......................................................................................... ................... 288 table 134: pci configuration register summary .................................................................................. ........ 298 table 135: vendor id register (offset 0x00) .................................................................................... ............. 300 table 136: device id register (offset 0x02).................................................................................... .............. 301 table 137: command register (offset 0x04)...................................................................................... ........... 302 table 138: status register (offset 0x06) ....................................................................................... ................ 303 www.datasheet.in programmer?s guide bcm57xxct 01/29/08 broadcom corporation document 57xxct-pgxx2-ri page xlix table 139: revision id register (offset 0x08) .................................................................................. ............. 304 table 140: class code register (offset 0x09)................................................................................... ............ 305 table 141: cache line size register (offset 0x0c).............................................................................. ......... 305 table 142: latency timer register (offset 0x0d) ................................................................................ .......... 305 table 143: header type register (offset 0x0e) .................................................................................. .......... 306 table 144: bist register (offset 0x0f) ......................................................................................... ................ 306 table 145: base address register 1/2 (offset 0x10) ............................................................................. ........ 306 table 146: mac 0 xbar register (offset 0x18)................................................................................... ......... 307 table 147: mac 0 xbar register (upper) (offset 0x1c)........................................................................... ... 307 table 148: subsystem vendor id register (offset 0x2c).......................................................................... .... 308 table 149: subsystem id register (offset 0x2e)................................................................................. .......... 309 table 150: expansion rom base address register (offset 0x30)................................................................ 310 table 151: capabilities pointer register (offset 0x34) ......................................................................... ......... 310 table 152: interrupt line register (offset 0x3c)............................................................................... ............. 310 table 153: minimum grant register (offset 0x3e) ................................................................................ ........ 311 table 154: maximum latency register (offset 0x3f) .............................................................................. ...... 311 table 155: pci-x capability id register (offset 0x40) .......................................................................... ........ 312 table 156: pci-x next capabilities pointer register (offset 0x41) .............................................................. .312 table 157: pci-x command register (offset 0x42) ................................................................................ ...... 312 table 158: pci-x status register (offset 0x44)................................................................................. ............ 314 table 159: power management capability register (offset 0x48) ................................................................ 31 6 table 160: pm next capabilities pointer register (offset 0x49)................................................................. ... 316 table 161: power management capabilities register (offset 0x4a) ............................................................. 317 table 162: power management control/status register (offset 0x4c)......................................................... 318 table 163: power management data register (offset 0x4f) ........................................................................ 319 table 164: vpd capability id register (offset 0x50)............................................................................ ......... 320 table 165: vpd next capabilities pointer register (offset 0x51)................................................................ .. 320 table 166: vpd flag and address register (offset 0x52)......................................................................... .... 320 table 167: vpd data register (offset 0x54) ..................................................................................... ............ 321 table 168: msi capability id register (offset 0x58)............................................................................ .......... 321 table 169: msi next capabilities pointer register (offset 0x59)................................................................ ... 321 table 170: message control register (offset 0x5a).............................................................................. ........ 322 table 171: message address register (offset 0x5c) .............................................................................. ...... 323 table 172: message data register (offset 0x64) ................................................................................. ......... 323 table 173: hardware fix register (offset 0x66) ................................................................................. ........... 323 www.datasheet.in programmer?s guide bcm57xxct 01/29/08 broadcom corporation document 57xxct-pgxx2-ri page l table 174: pci-x split latency timer register (offset 0x66, for bcm5714 only) ........................................ 324 table 175: miscellaneous host control register (offset 0x68)................................................................... ... 325 table 176: dma read/write control register (offset 0x6c) ....................................................................... .. 327 table 177: pci state register (offset 0x70) .................................................................................... .............. 332 table 178: pci clock control register (offset 0x74)............................................................................ ......... 334 table 179: clock source and core_clk speed (bcm5704) ...................................................................... 336 table 180: pci clock control register definition for bcm5705 device ........................................................ 337 table 181: pci clock control register definition for bcm5751, bcm5721, and bcm5752 devices............ 338 table 182: pci clock control register definition for bcm5714, and bcm5715 devices.............................. 339 table 183: register base address register (offset 0x78)........................................................................ ..... 340 table 184: memory window base address register (offset 0x7c)............................................................... 341 table 185: register data register (offset 0x80) ................................................................................ ........... 342 table 186: memory window data register (offset 0x84) ........................................................................... ... 342 table 187: expansion rom bar size register (0x88) .............................................................................. ... 343 table 188: expansion rom address register (offset 0x8c) ........................................................................ 343 table 189: expansion rom data register (0x90) .................................................................................. ....... 344 table 190: vpd interface register (offset 0x94) ................................................................................ ........... 344 table 191: undi receive bd standard producer ring producer index mailbox (offset 0x98)..................... 345 table 192: undi receive return ring consumer index mailbox (offset 0xa0)............................................ 345 table 193: undi send bd producer index mailbox (offset 0xa8) ................................................................ 345 table 194: dual-mac control register (offset 0xb8)............................................................................. ....... 346 table 195: pci function number ................................................................................................. .................. 346 table 196: mac function register (0xb8h)....................................................................................... ........... 347 table 197: mac message exchange output register (offset 0xbc) ............................................................ 347 table 198: mac message exchange input register (offset 0xc0) ............................................................... 348 table 199: cardbus pc card function event register (offset 0xc0)............................................................ 348 table 200: cardbus pc card function event mask register (offset 0xc4) .................................................. 348 table 201: cardbus pc card function present state register (offset 0xc8) ............................................... 349 table 202: cardbus pc card function force event state register (offset 0xcc) ........................................ 349 table 203: pcie capability id register (offset 0xd0) ........................................................................... ........ 350 table 204: pcie next capabilities pointer register (offset 0xd1) ............................................................... .350 table 205: pcie capabilities register (offset 0xd2) ............................................................................ ......... 350 table 206: device capabilities register (offset 0xd4) .......................................................................... ........ 351 table 207: device control register (offset 0xd8) ............................................................................... .......... 352 table 208: device status register (offset 0xda) ................................................................................ .......... 353 www.datasheet.in programmer?s guide bcm57xxct 01/29/08 broadcom corporation document 57xxct-pgxx2-ri page li table 209: link capabilities register (offset 0xdc) ............................................................................ .......... 354 table 210: link control register (offset 0xe0)................................................................................. ............. 355 table 211: link status command register (offset 0xe2).......................................................................... .... 355 table 212: advanced error reporting enhanced capability header register (offset 0x100) ....................... 356 table 213: uncorrectable error status register (offset 0x104).................................................................. ... 356 table 214: uncorrectable error mask register (offset 0x108) .................................................................... .. 357 table 215: uncorrectable error severity register (offset 0x10c) ................................................................ .358 table 216: correctable error status register (offset 0x110).................................................................... ..... 359 table 217: correctable error mask register (offset 0x114) ...................................................................... .... 359 table 218: advanced error capabilities and control register (offset 0x118) ............................................... 360 table 219: virtual channel enhanced capability header (offset 0x13c)....................................................... 360 table 220: port vc capability register (offset 0x140) .......................................................................... ........ 361 table 221: port vc capability register 2 (offset 0x144) ........................................................................ ....... 361 table 222: port vc control register (offset 0x148) ............................................................................. ......... 361 table 223: port vc status register (offset 0x14a).............................................................................. .......... 362 table 224: vc resource capability register (offset 0x14c) ...................................................................... ... 362 table 225: vc resource control register (offset 0x150) ......................................................................... .... 362 table 226: vc resource status register (offset 0x156).......................................................................... ..... 363 table 227: device serial no enhanced capability header register (offset 0x160)...................................... 363 table 228: device serial no lower dw register (offset 0x164)................................................................... 363 table 229: device serial no upper dw register (offset 0x168)................................................................... 364 table 230: power budgeting enhanced capability header register (offset 0x16c)..................................... 364 table 231: power budgeting data select register (offset 0x170) ................................................................ 3 64 table 232: power budgeting data register (offset 0x174) ........................................................................ ... 365 table 233: power budgeting capability register (offset 0x178) .................................................................. .365 table 234: firmware power budgeting register 1 (offset 0x17c) ................................................................ 36 6 table 235: firmware power budgeting register 2 (offset 0x17d) ................................................................ 36 6 table 236: firmware power budgeting register 3 (offset 0x180) ................................................................. 3 67 table 237: firmware power budgeting register 4 (offset 0x182) ................................................................. 3 67 table 238: firmware power budgeting register 5 (offset 0x184) ................................................................. 3 68 table 239: firmware power budgeting register 6 (offset 0x186) ................................................................. 3 68 table 240: firmware power budgeting register 7 (offset 0x188) ................................................................. 3 69 table 241: firmware power budgeting register 8 (offset 0x18a)................................................................. 3 69 table 242: reset count register (offset 0x158) ................................................................................. .......... 370 table 243: high-priority mailbox structure..................................................................................... ................ 370 www.datasheet.in programmer?s guide bcm57xxct 01/29/08 broadcom corporation document 57xxct-pgxx2-ri page lii table 244: high-priority mailbox registers ..................................................................................... ............... 370 table 245: ethernet mac control registers ...................................................................................... ............ 375 table 246: ethernet mac mode register (offset 0x400)........................................................................... .... 377 table 247: ethernet mac status register (offset 0x404)......................................................................... ..... 379 table 248: ethernet mac event enable register (offset 0x408) .................................................................. 3 81 table 249: led control register (offset 0x40c) ................................................................................. .......... 382 table 250: ethernet mac address high register (offset 0x410) .................................................................. 3 84 table 251: ethernet mac address low register (offset 0x414) ................................................................... 3 84 table 252: wol pattern pointer register (offset 0x430) ......................................................................... ..... 385 table 253: wol pattern pointer register (offset 0x430, rest of bcm57xx family) ................................... 385 table 254: wol pattern configuration register (offset 0x434) ................................................................... .386 table 255: wol pattern configuration register (offset 0x434, rest of bcm57xx family) ......................... 386 table 256: ethernet transmit random backup register (offset 0x438) ....................................................... 386 table 257: receive mtu size register (offset 0x43c) ............................................................................ ..... 387 table 258: gigabit pcs test register (offset 0x440)............................................................................ ........ 387 table 259: transmit 1000base-x auto-negotiation register (offset 0x444) ............................................... 387 table 260: receive 1000base-x auto-negotiation register (offset 0x448) ................................................ 388 table 261: mi communication register (offset 0x44c)............................................................................ ..... 388 table 262: mi status register (offset 0x450) ................................................................................... ............. 389 table 263: mi mode register (offset 0x454) ..................................................................................... ............ 389 table 264: autopolling status register (offset 0x458) .......................................................................... ........ 389 table 265: transmit mac mode register (offset 0x45c)........................................................................... ... 390 table 266: transmit mac status register (offset 0x460) ......................................................................... .... 390 table 267: transmit mac lengths register (offset 0x464)........................................................................ ... 391 table 268: receive mac mode register (offset 0x468) ............................................................................ ... 391 table 269: receive mac status register (offset 0x46c).......................................................................... .... 392 table 270: mac hash register 0-3 (offset 0x470)................................................................................ ........ 392 table 271: receive rules control register (offset 0x480)....................................................................... ..... 393 table 272: receive rules value/mask register (offset 0x484) .................................................................... 394 table 273: receive rules configuration register (offset 0x500)................................................................. .394 table 274: low watermark maximum receive frames register (offset 0x504) .......................................... 394 table 275: ethernet mac perfect address registers (offset 0x530-0x58f) ................................................. 395 table 276: serdes control register (offset 0x590, 5703s only) .................................................................. 396 table 277: serdes control register (offset 0x590, bcm5704c) .................................................................. 39 7 table 278: serdes control register (offset 0x590, 5704s only) .................................................................. 397 www.datasheet.in programmer?s guide bcm57xxct 01/29/08 broadcom corporation document 57xxct-pgxx2-ri page liii table 279: serdes control register (offset 0x590, bcm5705 and bcm5788 only) .................................... 399 table 280: serdes control register (offset 0x590, bcm5721, bcm5751, and bcm5752 only) ................. 399 table 281: serdes status register (offset 0x594, BCM5703s only) ........................................................... 400 table 282: serdes receive control register (offset 0x594, bcm5704s only) ............................................ 401 table 283: serdes phase control register (offset 0x598, bcm5704s only)............................................... 401 table 284: serdes pll control register (offset 0x59c, bcm5704s only) .................................................. 402 table 285: serdes phase status register (offset 0x5a0, bcm5704s only)................................................ 402 table 286: hardware auto-negotiation control register (offset 0x5b0, bcm5704s only) .......................... 403 table 287: serdes receive control register (0x5b0, bcm5714 and bcm5715 only)................................. 404 table 288: hardware auto-negotiation status register (offset 0x5b4) ........................................................ 404 table 289: serdes transmit control register (0x5b4, bcm5714 and bcm5715 only)................................ 405 table 290: ump multicast match address mask register (0x5e4, bcm5714 only) ..................................... 405 table 291: ump vlan match register (0x5e8, bcm5714 and bcm5715 only) .......................................... 406 table 292: ump emac control register (0x5f0, bcm5714 and bcm5715 only) ....................................... 406 table 293: statistics registers ................................................................................................ ....................... 407 table 294: send data initiator control registers ............................................................................... ............ 411 table 295: send data initiator mode register (offset 0x0c00) ................................................................... .. 412 table 296: send data initiator status register (offset 0x0c04)................................................................. ... 412 table 297: send data initiator statistics control register (offset 0x0c08) ................................................... 41 3 table 298: send data initiator statistics enable mask register (offset 0x0c0c) ......................................... 414 table 299: send data init. stat. enable mask register (offset 0x0c0c, rest of bcm57xx family) ........... 414 table 300: send data initiator statistics increment mask register (offset 0x0c10) ..................................... 415 table 301: send data init. stat. increment mask register (offset 0x0c10, rest of bcm57xx family) ....... 415 table 302: local statistics counters (offset 0x0c80-0x0cdf) .................................................................... .415 table 303: tcp segmentation control registers .................................................................................. ........ 416 table 304: lower host address register for tcp segmentation (offset 0xce0) ......................................... 416 table 305: upper host address register for tcp segmentation (offset 0xce4) ......................................... 416 table 306: length/offset register for tcp segmentation (offset 0xce8) .................................................... 417 table 307: dma flags register for tcp segmentation (offset 0xcec) ....................................................... 417 table 308: vlan tag register for tcp segmentation (offset 0xcf0) ......................................................... 418 table 309: vlan tag register for tcp segmentation (offset 0xcf0) ......................................................... 419 table 310: send data completion control registers.............................................................................. ....... 420 table 311: send data completion mode register (offset 0x1000) ............................................................... 420 table 312: post-dma command exchange register for tcp segmentation (offset 0x1008)...................... 420 table 313: send bd ring selector control registers............................................................................. ....... 421 www.datasheet.in programmer?s guide bcm57xxct 01/29/08 broadcom corporation document 57xxct-pgxx2-ri page liv table 314: send bd ring selector mode register (offset 0x1400) .............................................................. 422 table 315: send bd ring selector status register (offset 0x1404) ............................................................. 42 2 table 316: send bd ring selector hardware diagnostics register (offset 0x1408) .................................... 422 table 317: send bd ring selector hw diag. register (offset 0x1408, rest of bcm57xx family) ............. 422 table 318: send bd diag. ring selector local nic send bd consumer index registers (offset 0x1440).. 423 table 319: send bd ring selector control registers............................................................................. ....... 423 table 320: send bd initiator mode register (offset 0x1800) ..................................................................... ... 424 table 321: send bd initiator status register (offset 0x1804) ................................................................... .... 424 table 322: send bd completion control registers ................................................................................ ....... 425 table 323: send bd completion mode register (offset 0x1c00) ................................................................. 425 table 324: receive list placement control registers ............................................................................ ....... 426 table 325: receive list placement mode register (offset 0x2000).............................................................. 42 9 table 326: receive list placement status register (offset 0x2004)............................................................. 4 29 table 327: receive selector list lock register (offset 0x2008) ................................................................. .. 430 table 328: receive selector non-empty bits register (offset 0x200c)........................................................ 430 table 329: receive list placement configuration register (offset 0x2010) ................................................. 431 table 330: receive list placement statistics control register (offset 0x2014)............................................ 432 table 331: receive list placement statistics enable mask register (offset 0x2018)................................... 433 table 332: receive list placement stat. enable mask (offset 0x2018, rest of bcm57xx family) ............. 434 table 333: receive list placement statistics increment mask register (offset 0x201c) ............................. 434 table 334: receive list placement stat. increment mask (offset 0x201c, rest of bcm57xx fam.) .......... 434 table 335: local statistics counter (offset 0x2200) ............................................................................ .......... 435 table 336: receive data and receive bd initiator control registers ........................................................... 43 6 table 337: receive data and receive bd initiator mode register (offset 0x2400) ...................................... 437 table 338: receive data and receive bd initiator status register (offset 0x2404)..................................... 437 table 339: receive producer ring host address high register (offset 0x2440) ......................................... 438 table 340: receive producer ring host address low register (offset 0x2444) .......................................... 438 table 341: receive producer length/flags register (offset 0x2448) ........................................................... 438 table 342: receive producer ring nic address (offset 0x244c)................................................................. 43 8 table 343: receive data and receive bd initiator hardware diagnostic register (offset 0x24c0) ............. 440 table 344: rdi timer mode register (0x024f0h, bcm5714 and bcm5715 only) ....................................... 440 table 345: receive data completion control registers ........................................................................... ..... 441 table 346: receive data completion mode register (offset 0x2800)........................................................... 441 table 347: receive bd initiator control registers .............................................................................. ........... 442 table 348: receive data initiator mode register (offset 0x2c00) ................................................................ 442 www.datasheet.in programmer?s guide bcm57xxct 01/29/08 broadcom corporation document 57xxct-pgxx2-ri page lv table 349: receive bd initiator status register (offset 0x2c04)................................................................ .. 442 table 350: mini receive bd producer ring replenish threshold register (offset 0x2c14) ........................ 443 table 351: standard receive bd producer ring replenish threshold register (offset 0x2c18) ................ 443 table 352: jumbo receive bd producer ring replenish threshold register (offset 0x2c1c) ................... 443 table 353: receive bd completion control registers............................................................................. ...... 444 table 354: receive bd completion mode register (offset 0x3000) ............................................................. 444 table 355: receive bd completion status register (offset 0x3004) ............................................................ 444 table 356: nic jumbo receive bd producer index (offset 0x3008) ............................................................ 445 table 357: nic standard receive bd producer index (offset 0x300c) ........................................................ 445 table 358: nic mini receive bd producer index (offset 0x3010)................................................................. 4 45 table 359: receive list selector control registers ............................................................................. .......... 446 table 360: receive list selector mode register (offset 0x3400)................................................................. .446 table 361: receive list selector status register (offset 0x3404) ............................................................... .446 table 362: mbuf cluster free registers ......................................................................................... ............. 447 table 363: mbuf cluster free mode register (offset 0x3800) .................................................................... 4 47 table 364: mbuf cluster free status register (offset 0x3804) ................................................................... 447 table 365: dbu command register (0x3800)....................................................................................... ........ 448 table 366: dbu status register (0x3804) ........................................................................................ ............. 448 table 367: dbu configuration register (0x3808) ................................................................................. ......... 448 table 368: dbu timing register (0x380c) ........................................................................................ ............ 449 table 369: dbu rx data register (0x3810)....................................................................................... ........... 449 table 370: dbu tx data register (0x3814) ....................................................................................... ........... 449 table 371: host coalescing control registers................................................................................... ............ 450 table 372: host coalescing mode register (offset 0x3c00)....................................................................... .. 452 table 373: host coalescing status register (offset 0x3c04) ..................................................................... .. 452 table 374: flow attention register (offset 0x3c48) ............................................................................. ......... 457 table 375: nic return rings producer index (offset 0x3c80)..................................................................... .458 table 376: nic send bd consumer index (offset 0x3cc0).......................................................................... 459 table 377: memory arbiter registers............................................................................................ ................. 460 table 378: memory arbiter mode register (offset 0x4000)........................................................................ ... 460 table 379: memory arbiter status register (offset 0x4004)...................................................................... .... 463 table 380: memory arbiter trap address low register (offset 0x4008)....................................................... 465 table 381: memory arbiter trap address high register (offset 0x400c) ..................................................... 465 table 382: buffer manager control registers .................................................................................... ............ 466 table 383: buffer manager mode register (offset 0x4400)........................................................................ ... 467 www.datasheet.in programmer?s guide bcm57xxct 01/29/08 broadcom corporation document 57xxct-pgxx2-ri page lvi table 384: buffer manager status register (offset 0x4404) ...................................................................... ... 467 table 385: mbuf pool base address register (offset 0x4408).................................................................... 4 68 table 386: mbuf pool base address register (offset 0x4408, rest of bcm57xx family)......................... 468 table 387: mbuf pool length register (offset 0x440c) ........................................................................... ... 469 table 388: mbuf pool length register (offset 0x440c, rest of bcm57xx family).................................... 469 table 389: rx risc mbuf allocation request register (offset 0x441c) .................................................... 470 table 390: rx cpu mbuf allocation response register (0x4420h, bcm5714 and bcm5715 only) ......... 471 table 391: tx risc mbuf allocation request register (offset 0x4424) ..................................................... 472 table 392: bm hardware diagnostic 1 register (offset 0x444c) .................................................................. 4 73 table 393: hardware diagnostic 1 register (0x444ch, 5714 only) ............................................................... 47 4 table 394: bm hardware diagnostic 1 register (offset 0x444c) .................................................................. 4 74 table 395: bm hardware diagnostic 2 register (offset 0x4450)................................................................... 474 table 396: hardware diagnostic 2 register (0x4450h, 5714 only) ................................................................ 4 75 table 397: bm hardware diagnostic 2 register (offset 0x4450)................................................................... 475 table 398: bm hardware diagnostic 3 register (offset 0x4454)................................................................... 475 table 399: bm hardware diagnostic 3 register (offset 0x4454)................................................................... 476 table 400: receive flow threshold register (offset 0x4458)..................................................................... .. 476 table 401: read dma control registers .......................................................................................... ............. 477 table 402: read dma mode register (offset 0x4800).............................................................................. .... 477 table 403: read dma status register (offset 0x4804)............................................................................ ..... 479 table 404: write dma control registers ......................................................................................... .............. 480 table 405: write dma mode register (offset 0x4c00) ............................................................................. .... 480 table 406: write dma status register (offset 0x4c04) ........................................................................... ..... 482 table 407: rx risc registers................................................................................................... .................... 483 table 408: rx risc mode register fields (offset 0x5000) ........................................................................ .. 483 table 409: rx risc state fields (offset 0x5004) ................................................................................ ......... 485 table 410: rx risc hardware breakpoint register (offset 0x5034)............................................................. 486 table 411: tx risc registers ................................................................................................... .................... 487 table 412: tx risc mode register fields (offset 0x5400)........................................................................ ... 487 table 413: tx risc state fields (offset 0x5404)................................................................................ .......... 488 table 414: low-priority mailbox structure...................................................................................... ................ 490 table 415: low-priority mailbox registers ...................................................................................... ............... 490 table 416: flow-through queues registers....................................................................................... ........... 494 table 417: ftq reset register (offset 0x5c00) .................................................................................. ......... 494 table 418: mac tx fifo enqueue register (offset 0x5cb8) ...................................................................... 49 6 www.datasheet.in programmer?s guide bcm57xxct 01/29/08 broadcom corporation document 57xxct-pgxx2-ri page lvii table 419: rxmbuf cluster free enqueue register (offset 0x5cc8)......................................................... 496 table 420: rdiq ftq write/peek register (offset 0x5cfc) ........................................................................ 497 table 421: functional truth table for the combination of the valid, skip, and pass bits ............................. 497 table 422: message signaled registers.......................................................................................... .............. 498 table 423: msi mode register (offset 0x6000) ................................................................................... .......... 498 table 424: msi status register (offset 0x6004)................................................................................. ........... 499 table 425: msi fifo access register (offset 0x6008) ............................................................................ ..... 499 table 426: dma completion registers ............................................................................................ .............. 500 table 427: msi fifo access register (offset 0x6400) ............................................................................ ..... 500 table 428: general control registers ........................................................................................... ................. 501 table 429: mode control register (offset 0x6800)............................................................................... ......... 502 table 430: miscellaneous configuration register (offset 0x6804) ................................................................ 504 table 431: miscellaneous local control register (offset 0x6808) ................................................................ 507 table 432: timer register (offset 0x680c)...................................................................................... .............. 510 table 433: rx-risc event register (offset 0x6810) .............................................................................. ...... 510 table 434: rx-risc timer reference register (offset 0x6814)................................................................... 5 11 table 435: rx-risc semaphore register (offset 0x6818) .......................................................................... .511 table 436: remote rx-risc attention register (offset 0x681c) ................................................................. 51 2 table 437: tx-risc event register (offset 0x6820).............................................................................. ....... 512 table 438: tx-risc timer reference register (offset 0x6824) ................................................................... 5 13 table 439: tx-risc semaphore register (offset 0x6828) .......................................................................... .513 table 440: tx-risc attention register (offset 0x682c) .......................................................................... ..... 514 table 441: serial eeprom address register (offset 0x6838) ..................................................................... 5 14 table 442: serial eeprom data register (offset 0x683c) ......................................................................... .515 table 443: serial eeprom control register (offset 0x6840) ...................................................................... .515 table 444: mdi control register (offset 0x6844) ................................................................................ .......... 515 table 445: rx cpu event enable register (offset 0x684c)........................................................................ .516 table 446: gig serdes prbs control register (0x6850, bcm5714 only) .................................................... 517 table 447: gig serdes prbs status register (0x6854, bcm5714 only)...................................................... 517 table 448: grc message exchange out register (0x6870h, bcm5714 only) ............................................ 517 table 449: grc message exchange in register (0x6874h, bcm5714 only) ............................................... 517 table 450: wake-on-lan registers ............................................................................................... ............... 518 table 451: wol mode register (offset 0x6880) ................................................................................... ........ 518 table 452: wol config register (offset 0x6884)................................................................................. ......... 519 table 453: wol state machine status register (offset 0x6888) .................................................................. 5 19 www.datasheet.in programmer?s guide bcm57xxct 01/29/08 broadcom corporation document 57xxct-pgxx2-ri page lviii table 454: miscellaneous tpm register (offset 0x6890) .......................................................................... .... 520 table 455: fast boot program counter register (offset 0x6890) ................................................................. 5 20 table 456: asf support registers............................................................................................... .................. 521 table 457: asf control register (offset 0x6c00) ................................................................................ ......... 522 table 458: smbus input register (offset 0x6c04) ................................................................................ ........ 524 table 459: smbus output register (offset 0x6c08) ............................................................................... ...... 524 table 460: asf watchdog timer register (offset 0x6c0c)......................................................................... .526 table 461: asf heartbeat timer register (offset 0x6c10)........................................................................ ... 526 table 462: poll asf timer register (offset 0x6c14)............................................................................. ........ 526 table 463: poll legacy timer register (offset 0x6c18) .......................................................................... ...... 527 table 464: retransmission timer register (offset 0x6c1c) ....................................................................... .. 527 table 465: time stamp counter register (offset 0x6c20)......................................................................... ... 527 table 466: smbus driver select register (offset 0x6c24)........................................................................ .... 528 table 467: smbus driver select reg. (offset 0x6c24, rest of bcm57xx fam. (except bcm5700 mac) .. 528 table 468: tpm command register (offset 0x6c30)................................................................................ .... 529 table 469: tpm data register (offset 0x6c34)................................................................................... .......... 529 table 470: tpm command register (0x6c30, for bcm5714 and bcm5715 only) ...................................... 530 table 471: tpm data register (0x6c34) .......................................................................................... ............. 530 table 472: auxiliary smbus master status register (offset 0x6c40) ........................................................... 531 table 473: auxiliary smbus master control register (offset 0x6c44) .......................................................... 532 table 474: auxiliary smbus master command register (offset 0x6c48) ..................................................... 533 table 475: auxiliary smbus block data register (offset 0x6c4c)................................................................ 5 34 table 476: auxiliary smbus slave address/control register (offset 0x6c50).............................................. 534 table 477: auxiliary smbus slave status register (offset 0x6c54) ............................................................. 53 5 table 478: auxiliary smbus slave data register (offset 0x6c58) ................................................................ 5 36 table 479: smbus arp command register (offset 0x6ce0)....................................................................... 537 table 480: smbus arp status register (offset 0x6ce4) ........................................................................... .. 538 table 481: udid register 0 (offset 0x6ce8)..................................................................................... ............ 539 table 482: udid register 1 (offset 0x6cec) ..................................................................................... ........... 539 table 483: udid register 2 (offset 0x6cf0)..................................................................................... ............ 539 table 484: udid register 3 (offset 0x6cf4)..................................................................................... ............ 539 table 485: auxiliary smbus master status channel 1 register (offset 0x6c80, bcm5704 only)................ 540 table 486: auxiliary smbus master control channel 1 register (offset 0x6c84, bcm5704 only) .............. 541 table 487: auxiliary smbus master command channel 1 register (offset 0x6c88, bcm5704 only) ......... 542 table 488: auxiliary smbus block data channel 1 register (offset 0x6c8c, bcm5704 only).................... 542 www.datasheet.in programmer?s guide bcm57xxct 01/29/08 broadcom corporation document 57xxct-pgxx2-ri page lix table 489: auxiliary smbus slave address/control channel 1 register (offset 0x6c90, bcm5704 only) .. 543 table 490: auxiliary smbus slave status channel 1 register (offset 0x6c94, bcm5704 only).................. 543 table 491: auxiliary smbus slave data channel 1 register (offset 0x6c98, bcm5704 only) .................... 544 table 492: auxiliary smbus master status channel 2 register (offset 0x6cc0, bcm5704 only) ............... 544 table 493: auxiliary smbus master control channel 2 register (offset 0x6cc4, bcm5704 only).............. 545 table 494: auxiliary smbus master command channel 2 register (offset 0x6cc8, bcm5704 only)......... 546 table 495: auxiliary smbus block data channel 2 register (offset 0x6ccc, bcm5704 only) ................... 547 table 496: auxiliary smbus slave address/control channel 2 register (offset 0x6cd0, bcm5704 only) . 547 table 497: auxiliary smbus slave status channel 2 register (offset 0x6cd4, bcm5704 only) ................. 547 table 498: auxiliary smbus slave data channel 2 register (offset 0x6cd8, bcm5704 only).................... 548 table 499: non-volatile memory interface registers............................................................................. ........ 549 table 500: nvm command register (offset 0x7000)................................................................................ .... 550 table 501: nvm status register (0x7004h) ....................................................................................... ........... 551 table 502: nvm write register (offset 0x7008) .................................................................................. .......... 551 table 503: nvm address register (offset 0x700c)................................................................................ ....... 551 table 504: nvm read register (offset 0x7010)................................................................................... ......... 552 table 505: nvm config 1 register (offset 0x7014) ............................................................................... ........ 552 table 506: nvm config 2 register (offset 0x7018) ............................................................................... ........ 554 table 507: nvm config 3 register (offset 0x701c) ............................................................................... ....... 554 table 508: software arbitration register (offset 0x7020)....................................................................... ....... 555 table 509: nvm access register (offset 0x7024)................................................................................. ........ 556 table 510: nvm write1 register (offset 0x7028) ................................................................................. ......... 557 table 511: nvm arbitration watchdog timer register (offset 0x702c) ........................................................ 557 table 512: address lockout boundary register (offset 0x7030) .................................................................. 5 58 table 513: bist registers (applicable to bcm5721, bcm5751, and bcm5752 only).................................. 558 table 514: bist registers (applicable to the bcm5714 and bcm5715 only) .............................................. 558 table 515: bist control register (offset 0x7400, bcm5721, bcm5751, and bcm5752 only) ................... 559 table 516: bist status register (offset 0x7404, bcm5721, bcm5751, and bcm5752 only)..................... 559 table 517: bist mode register (0x7400h, bcm5714c and bcm5714s only) ........................................... 560 table 518: bist status register (0x7404h, bcm5714 and bcm5715 only)................................................ 560 table 519: bist control register (0x7408h, bcm5714 and bcm5715 only) .............................................. 561 table 520: uart register map summary ........................................................................................... .......... 562 table 521: uart receive buffer (dlab=0) register (offset 0x7800) .......................................................... 562 table 522: uart transmit holding (dlab=0) register (offset 0x7800)....................................................... 563 table 523: uart divisor latch (low) (dlab=1) register (offset 0x7800) ................................................... 563 www.datasheet.in programmer?s guide bcm57xxct 01/29/08 broadcom corporation document 57xxct-pgxx2-ri page lx table 524: uart interrupt enable (dlab=0) register (offset 0x7804) ........................................................ 563 table 525: uart divisor latch high (dlab=1) register (offset 0x7804)..................................................... 563 table 526: uart interrupt identity register (offset 0x7808).................................................................... ..... 564 table 527: uart fifo control register (offset 0x7808).......................................................................... .... 564 table 528: uart line control register (offset 0x780c).......................................................................... ..... 565 table 529: uart modem control register (offset 0x7810) ......................................................................... .565 table 530: uart line status register (offset 0x7814)........................................................................... ...... 565 table 531: uart modem status register (offset 0x7818) .......................................................................... .566 table 532: uart scratch register (offset 0x781c)............................................................................... ....... 566 table 533: ump registers (applicable to bcm5714 and bcm5715 only) .................................................... 567 table 534: ump attention enable register (offset 0x7800, bcm5714 and bcm5715 only) ....................... 567 table 535: ump attention status register (offset 0x7804, bcm5714 and bcm5715 only)......................... 567 table 536: ump debug1 register (offset 0x7808, bcm5714 and bcm5715 only) ..................................... 568 table 537: ump command register (offset 0x7810, bcm5714 and bcm5715 only) ................................. 568 table 538: ump status register (offset 0x7814, bcm5714 and bcm5715 only)........................................ 570 table 539: ump frame read status register (offset 0x7818, bcm5714 and bcm5715 only)................... 571 table 540: ump frame read data register (offset 0x781c, bcm5714 and bcm5715 only)..................... 571 table 541: ump frame write control register (offset 0x7820, bcm5714 and bcm5715 only).................. 572 table 542: ump frame write data register (offset 0x7824, bcm5714 and bcm5715 only)...................... 572 table 543: ump frame pre-fetch register (offset 0x7828, bcm5714 and bcm5715 only) ........................ 573 table 544: ump fifo remain register (offset 0x782c, bcm5714 and bcm5715 only)............................ 573 table 545: pcie registers ...................................................................................................... ....................... 574 table 546: tlp control register (offset 0x7c00, bcm5721, bcm5751, and bcm5752 only) .................... 576 table 547: tlp workaround register (offset 0x7c04, bcm5752 only) ....................................................... 577 table 548: write dma request upper address diagnostic register (offset 0x7c10) .................................. 578 table 549: write dma request lower address diagnostic register (offset 0x7c14) .................................. 578 table 550: write dma length/byte enable and request diagnostic register (offset 0x7c18).................... 578 table 551: read dma request upper address diagnostic register (offset 0x7c1c) ................................. 578 table 552: read dma request lower address diagnostic register (offset 0x7c20) .................................. 579 table 553: read dma length and request diagnostic register (offset 0x7c24) ........................................ 579 table 554: msi dma request upper address diagnostic register (offset 0x7c28) .................................... 579 table 555: msi dma request lower address diagnostic register (offset 0x7c2c).................................... 579 table 556: msi dma length and request diagnostic register (offset 0x7c30) .......................................... 580 table 557: slave request length and type diagnostic register (offset 0x7c34)........................................ 580 table 558: flow control inputs diagnostic register (offset 0x7c38) ............................................................ 5 80 www.datasheet.in programmer?s guide bcm57xxct 01/29/08 broadcom corporation document 57xxct-pgxx2-ri page lxi table 559: xmt state machines and gated requests diagnostic register (offset 0x7c3c) ....................... 581 table 560: address ack xfer count and arb length diagnostic register (offset 0x7c40)........................ 581 table 561: dma completion header diagnostic register 0 (offset 0x7c44) ................................................ 581 table 562: dma completion header diagnostic register 1 (offset 0x7c48) ................................................ 581 table 563: dma completion header diagnostic register 2 (offset 0x7c4c) ............................................... 582 table 564: dma completion misc. diagnostic register (offset 0x7c50) ...................................................... 582 table 565: dma completion misc. diagnostic register (offset 0x7c54) ...................................................... 582 table 566: dma completion misc. diagnostic register (offset 0x7c58) ...................................................... 583 table 567: split controller requested length and address ack remaining diag. reg. (offset 0x7c5c)... 583 table 568: split controller misc 0 register diagnostic register (offset 0x7c60).......................................... 583 table 569: split controller misc 1 register diagnostic register (offset 0x7c64).......................................... 584 table 570: tlp status register (offset 0x7c60) ................................................................................. .......... 584 table 571: tlp status register (offset 0x7c60) ................................................................................. .......... 584 table 572: data link control register (offset 0x7d00) .......................................................................... ....... 585 table 573: data link status register (offset 0x7d04) ........................................................................... ....... 587 table 574: data link attention register (offset 0x7d08) ........................................................................ ...... 588 table 575: data link attention mask register (offset 0x7d0c) ................................................................... .588 table 576: next transmit sequence number debug register (offset 0x7d10)............................................ 589 table 577: acked transmit sequence number debug register (offset 0x7d14)........................................ 589 table 578: purged transmit sequence number debug register (offset 0x7d18)........................................ 589 table 579: receive sequence number debug register (offset 0x7d1c)..................................................... 589 table 580: data link replay register (offset 0x7d20) ........................................................................... ...... 590 table 581: data link ack timeout register (offset 0x7d24) ...................................................................... .590 table 582: power management threshold register (offset 0x7d28)............................................................ 590 table 583: retry buffer write pointer debug register (offset 0x7d2c)........................................................ 591 table 584: retry buffer read pointer debug register (offset 0x7d30) ........................................................ 591 table 585: retry buffer purged pointer debug register (offset 0x7d34) ..................................................... 591 table 586: retry buffer read/write debug port (offset 0x7d38).................................................................. 591 table 587: error count threshold register (offset 0x7d3c)...................................................................... ... 592 table 588: tlp error counter register (offset 0x7d40) .......................................................................... ..... 592 table 589: dllp error counter (offset 0x7d44) .................................................................................. ......... 592 table 590: nak received counter (offset 0x7d48) ................................................................................ ...... 593 table 591: data link test register (offset 0x7d4c) ............................................................................. ........ 593 table 592: packet bist register (offset 0x7d50)................................................................................ ......... 594 table 593: phy mode register (offset 0x7e00)................................................................................... ......... 594 www.datasheet.in programmer?s guide bcm57xxct 01/29/08 broadcom corporation document 57xxct-pgxx2-ri page lxii table 594: phy/link status register (offset 0x7e04)............................................................................ ....... 595 table 595: phy/link ltssm control register (offset 0x7e08) .................................................................... 5 95 table 596: phy/link training link number (offset 0x7e0c) ....................................................................... .596 table 597: phy/link training lane number (offset 0x7e10)....................................................................... .596 table 598: phy/link training n_fts (offset 0x7e14) ............................................................................. ..... 596 table 599: phy attention register (offset 0x7e18) .............................................................................. ........ 597 table 600: phy attention mask register (offset 0x7e1c) ......................................................................... ... 597 table 601: phy receive error counter (offset 0x7e20) ........................................................................... .... 598 table 602: phy receive framing error counter (offset 0x7e24) ................................................................. 59 8 table 603: phy receive error threshold register (offset 0x7e28).............................................................. 59 8 table 604: phy test control register (offset 0x7e2c) ........................................................................... ..... 599 table 605: phy/serdes control override register (offset 0x7e30) ............................................................. 600 table 606: phy timing parameter override register (offset 0x7e34) ......................................................... 601 table 607: phy hardware diagnostic 1 register (offset 0x7e38) ................................................................ 60 1 table 608: phy hardware diagnostic 2 register (offset 0x7e3c)................................................................ 60 2 table 609: transceiver register map ............................................................................................ ................ 603 table 610: mii control register (phy_addr = 0x1, reg_addr = 00h) ........................................................... 604 table 611: mii status register (phy_addr = 0x1, reg_addr = 01h) ............................................................ 606 table 612: phy identifier registers (phy_addr = 0x1, reg_addresses 02h and 03h) ................................ 608 table 613: auto-negotiation advertisement register (phy_addr = 0x1, reg_addr = 04h).......................... 608 table 614: auto-negotiation link partner ability register (phy_addr = 0x1, reg_addr = 05h)................... 610 table 615: auto-negotiation expansion register (phy_addr = 0x1, reg_addr = 06h) ................................ 612 table 616: next page transmit register (phy_addr = 0x1, reg_addr = 07h)............................................. 613 table 617: link partner received next page register (phy_addr = 0x1, reg_addr = 08h) ....................... 614 table 618: 1000base-t control register (phy_addr = 0x1, reg_addr = 09h) ........................................... 615 table 619: 1000base-t status register (phy_addr = 0x1, reg_addr = 0ah) ............................................ 616 table 620: ieee extended status register (phy_addr = 0x1, reg_addr = 0fh)......................................... 617 table 621: 00h: 1000-x mii control register .................................................................................... ............. 618 table 622: 01h: 1000-x mii status register ..................................................................................... ............. 619 table 623: 04h: 1000-x auto-negotiation advertisement register................................................................ 6 20 table 624: 05h: 1000-x auto-negotiation link partner ability register (base page).................................... 621 table 625: 06h: 1000-x auto-negotiation expansion register ..................................................................... .621 table 626: 07h: 1000-x auto-negotiation next page transmit register ....................................................... 622 table 627: 08h: 1000-x auto-negotiation link partner ability register (next page)..................................... 622 table 628: 09h: 1000-x reserved register ....................................................................................... ............ 622 www.datasheet.in programmer?s guide bcm57xxct 01/29/08 broadcom corporation document 57xxct-pgxx2-ri page lxiii table 629: 0ah: 1000-x reserved register....................................................................................... ............ 622 table 630: 0fh: 1000-x extended status register ................................................................................ ........ 623 table 631: phy extended control register (phy_addr = 0x1, reg_addr = 10h) ........................................ 623 table 632: phy extended status register (phy_addr = 0x1, reg_addr = 11h).......................................... 626 table 633: receive error counter (phy_addr = 0x1, reg_addr = 12h) ....................................................... 628 table 634: false carrier sense counter (phy_addr = 0x1, reg_addr = 13h) ............................................. 628 table 635: receiver not_ok counters (phy_addr = 0x1, reg_addr = 14h, normal operation) ............... 629 table 636: receiver not_ok counters (phy_addr = 0x1, reg_addr = 14h, crc error count operation) 629 table 637: expansion register access register (phy_addr = 0x1, reg_addr = 17h) .............................. 630 table 638: expansion register select values .................................................................................... ........... 630 table 639: expansion register 00h: receive/transmit packet counter........................................................ 631 table 640: expansion register 01h: expansion interrupt status .................................................................. .631 table 641: expansion register 03h: serdes control .............................................................................. ........ 632 table 642: expansion register 04h: multicolor led selector..................................................................... ... 633 table 643: expansion register 05h: multicolor led flash rate controls ..................................................... 634 table 644: expansion register 06h: multicolor led programmable blink controls ...................................... 635 table 645: expansion register 10h: cable diagnostic controls................................................................... .636 table 646: expansion register 11h: cable diagnostic results .................................................................... .637 table 647: expansion register 12h: cable diagnostic lengths channels1/2 ............................................... 638 table 648: expansion register 13h: cable diagnostic lengths channels 3/4 .............................................. 639 table 649: 18h: aux. control reg. (shadow reg. selector = 000; bcm5714 and bcm5715 only).............. 640 table 650: 18h: 10base-t register (shadow register selector = 001; bcm5714 and bcm5715 only)..... 641 table 651: 18h: power/mii control reg. (shadow reg. selector = 010; bcm5714 and bcm5715 only)..... 642 table 652: 18h: misc. test register 1 (shadow register selector = 100; bcm5714 and bcm5715 only) .. 643 table 653: 18h: misc. test register 2 (shadow register selector = 101; bcm5714 and bcm5715 only) .. 644 table 654: 18h: miscellaneous control register (shadow register selector = 111)..................................... 644 table 655: auxiliary control register (phy_addr = 0x1, reg_addr = 18h, shadow = 000, normal)............ 646 table 656: auxiliary control register (phy_addr = 0x1, reg_addr = 18h, shadow = 001, 10base-t) ...... 648 table 657: aux. reg. (phy_addr=0x1, reg_addr=18h, shadow=010, pwr cont., 5705/5721/5751 only)... 651 table 658: aux. cont. (phy_addr=0x1, reg_addr=18h, shadow=010, pwr cont., other bcm57xx fam.) 652 table 659: auxiliary control register (phy_addr = 0x1, reg_addr = 18h, shadow = 100, misc test 1) ..... 653 table 660: auxiliary control register (phy_addr = 0x1, reg_addr = 18h, shadow = 111, misc control) ... 655 table 661: auxiliary status summary register (phy_addr = 0x1, reg_addr = 19h) ................................... 657 table 662: interrupt status register (phy_addr = 0x1, reg_addr = 1ah).................................................... 659 table 663: interrupt mask register (phy_addr = 0x1, reg_addr = 1bh) ..................................................... 661 www.datasheet.in programmer?s guide bcm57xxct 01/29/08 broadcom corporation document 57xxct-pgxx2-ri page lxiv table 664: spare control register 1 (address 1ch, enable by register 1ch bits[14:10] = 00010).............. 662 table 665: spare control register 2 (address 1ch, shadow value 00100).................................................. 663 table 666: spare control register 3 (address 1ch, shadow value 00101).................................................. 664 table 667: led status register (address 1ch, shadow register selector = 01000) ................................... 665 table 668: led control register (address 1ch, shadow value 01001) ....................................................... 667 table 669: auto power-down register (address 1ch, shadow value 01010).............................................. 668 table 670: spare control 1 register (address 1ch, shadow value 00010).................................................. 669 table 671: spare control 1 register (shadow register selector = 00010) ................................................... 670 table 672: clock alignment control register (address 1ch, shadow value 00011) .................................... 671 table 673: clock alignment control register (shadow register selector = 00011)...................................... 672 table 674: spare control 2 register (address 1ch, shadow value 00100).................................................. 673 table 675: spare control 2 register (shadow register selector = 00100) ................................................... 674 table 676: spare control 3 register (address 1ch, shadow value 00101).................................................. 674 table 677: 1ch: spare control 3 register (shadow register selector = 00100) .......................................... 675 table 678: led status register (address 1ch, shadow value 01000)......................................................... 676 table 679: led control register (address 1ch, shadow value 01001) ....................................................... 678 table 680: auto power-down register (address 1ch, shadow value 01010).............................................. 679 table 681: led selector 1 register (address 1ch, shadow value 01101)................................................... 681 table 682: led selector 2 register (address 1ch, shadow value 01110)................................................... 682 table 683: led gpio control/status register (address 1ch, shadow value 01111) .................................. 684 table 684: autodetect sgmii/media converter register (address 1ch, shadow value 11000)................... 685 table 685: 1000base-x auto-negotiation debug register (address 1ch, shadow value 11010) .............. 686 table 686: auxiliary 1000base-x control register (address 1ch, shadow value 11011) .......................... 688 table 687: auxiliary 1000base-x status register (address 1ch, shadow value 11100)............................ 690 table 688: miscellaneous 1000base-x status register (address 1ch, shadow value 11101)................... 692 table 689: autodetect medium register (address 1ch, shadow value 11110)............................................ 694 table 690: mode control register (address 1ch, shadow value 11111) ..................................................... 696 table 691: hcd status register (phy_addr = 0x1, reg_addr = 1dh, bit 15 = 1)........................................ 698 table 692: master/slave seed register (phy_addr = 0x1, reg_addr = 1dh, bit 15 = 0) ............................ 699 table 693: phy test register 1 (phy_addr = 0x1, reg_addr = 1eh).......................................................... 700 table 694: phy test register 1 (phy_addr = 0x1, reg_addr = 1eh).......................................................... 701 table 695: 1fh: test register 2 ................................................................................................ ..................... 701 table 696: function codes quick reference...................................................................................... ........... 711 table 697: event codes quick reference ......................................................................................... ............ 712 table 698: power management behavior for the network device class....................................................... 716 www.datasheet.in programmer?s guide bcm57xxct 01/29/08 broadcom corporation document 57xxct-pgxx2-ri page lxv table 699: power management policy for the network class ....................................................................... 716 table 700: terminology......................................................................................................... ......................... 724 www.datasheet.in programmer?s guide bcm57xx 01/29/08 broadcom corporation document 57xx-pg105-r introduction page 1 section 1: introduction i ntroduction the bcm57xx netxtreme ? family is a family of triple-speed 10/100/1000base-t copper and gigabit 1000base-x fiber ethernet lan controller solutions for high-performance network applications. the devices are a highly-integrated solution combining the following functions: ? triple-speed ieee 802.3 compliant media access controller (mac) functions ? peripheral component interconnect (pci), pci-x ? , and pci express ? (pcie?) bus interfaces ? 10/100/1000base-t ethernet transceiver ? 10/100/1000base-t ethernet transceiver with serdes ? on-chip packet buffer memory ? on-chip risc processors for custom frame processing ? universal management port (ump) and smbus interfaces for alert specification function (asf) and remote system management traffic ? nvram (seeprom and flash) interface members of the netxtreme bcm57xx family include: ? bcm5700 mac ? bcm5701 mac transceiver ? bcm5702 mac transceiver ? BCM5703c mac transceiver ? BCM5703s mac transceiver serdes ? bcm5704c dual-mac transceiver ? bcm5704s dual-mac transceiver serdes ? bcm5705 mac transceiver ? bcm5788 mac transceiver ? bcm5721 mac transceiver ? bcm5751 mac transceiver ? bcm5714c dual-mac transceiver ? bcm5714s dual-mac transceiver serdes ? bcm5715c dual-mac transceiver ? bcm5715s dual-mac transceiver serdes ? bcm5752 mac transceiver typical applications for the bcm57xx family include network interface cards (nics) and lan-on-motherboard (lom). note: refer to the netxtreme ii? programmer's guide for bcm5706c, bcm5706s, and bcm5708 programming details. www.datasheet.in programmer?s guide bcm57xx 01/29/08 broadcom corporation document 57xx-pg105-r page 2feature comparison f eature c omparison table 1 shows the features of the members of the bcm57xx family. see ?features? on page 11 for a more detailed description of the bcm57xx features. table 1: family features feature mac only single mac transceivers dual mac transceivers bcm5700 bcm5701 bcm5702 BCM5703c BCM5703s bcm5705/ bcm5788 bcm5721 bcm5751 bcm5752 bcm5704c bcm5704s bcm5714c/ bcm5715c bcm5714s/ bcm5715s data management vlan tag support (ieee 802.1q) yes yes yes yes yes yes yes yes yes yes yes yes yes layer 2 priority encoding (802.1p) yes yes yes yes yes yes yes yes yes yes yes yes yes link aggregation (ieee 802.3ad) yes yes yes yes yes yes yes yes yes yes yes yes yes full-duplex flow control (ieee 802.3x) yes yes yes yes yes yes yes yes yes yes yes yes yes programmable rules checker for advanced packet filtering and classification yes yes yes yes yes yes yes yes yes yes yes yes yes frame/packet buffer memory a 96 kb 96 kb 96 kb 96 kb 96 kb 56 kb rx, 8 kb tx 64 kb rx, 8kb tx 64 kb rx, 8kb tx 64 kb rx, 8kb tx 64 kb 64 kb 32 kb rx, 22 kb tx 32 kb rx, 22 kb tx jumbo frame support 9 kb 9 kb 9 kb 9 kb 9 kb none none none none 9 kb 9 kb 9 kb 9 kb calculation and verification of tcp, udp, and ip checksums yes yes yes yes yes yes yes yes yes yes yes yes yes multiple transmit and receive descriptor queues yes yes yes yes yes no no no no yes yes no no scatter/gather bus mastering architecture yes yes yes yes yes yes yes yes yes yes yes yes yes auto-negotiation for 1000base-sx designs yes yes yes yes yes yes yes yes yes yes yes yes yes statistics for snmp mib ii, ethernet like mib, and ethernet mib (802.3z, clause 30) yes yes yes yes yes yes yes yes yes yes yes yes yes www.datasheet.in bcm57xx programmer?s guide 01/29/08 broadcom corporation page 3 feature comparison document 57xx-pg105-r ipmi support no no no yes j, k yes j, k no yes k no no yes k yes k yes k yes k asf support no no no yes l yes i no yes m yes m yes m no no no no trusted platform module support no no no no no no no yes n yes no no no no ump interface no no no no no no no no no no no yes yes bus interfaces pci v2.2 32-bit/64-bit, 33-mhz/66-mhz bus interface yes yes 32 bits only yes yes 32 bits only o no no no yes yes no no pci-x v1.0 64-bit 100-mhz/133-mhz bus interface yes yes no yes yes no no no no yes yes no no cardbus interface no no no no no yes no no no no no no no pcie v1.0a x1 bus interface no no no no no no yes yes yes no no no no pcie v1.0a x4 bus interface no no no no no no no no no no no yes yes pcie v1.0a x2 bus interface no no no no no no no no no no no yes yes lan interfaces 10/100/1000base-t full- duplex/half-duplex mac yes yes yes yes yes yes yes yes yes yes yes yes yes integrated 10/100/1000base-t transceiver no c yes e yes e yes e yes e yes e yes e yes e yes e yes e yes e yes e yes e internal mii/gmii yes yes yes f yes f no yes f yes f yes f yes f yes f no yes no internal gmii/mii yes yes yes g yes g yes g yes g yes g yes g yes g yes g yes g yes g yes tbi (serdes) yes yes no no yes no no no no no yes no yes self-test test modes (bist, scan, and so on) yes yes yes yes yes yes yes yes yes yes yes yes yes table 1: family features (cont.) feature mac only single mac transceivers dual mac transceivers bcm5700 bcm5701 bcm5702 BCM5703c BCM5703s bcm5705/ bcm5788 bcm5721 bcm5751 bcm5752 bcm5704c bcm5704s bcm5714c/ bcm5715c bcm5714s/ bcm5715s www.datasheet.in programmer?s guide bcm57xx 01/29/08 broadcom corporation document 57xx-pg105-r page 4feature comparison factory-level jtag support yes yes yes h yes h yes h yes h yes h yes h yes h yes h yes h yes h yes h firmware smbus 2.0 interface no yes yes yes yes yes yes yes yes yes yes yes yes interface to flash memory no no yes i yes i yes i yes i yes i yes i yes i yes i yes i yes i yes i interface to serial eeprom yes yes yes yes yes yes yes yes yes yes yes yes yes firmware tcp segmentation yes yes yes yes yes yes yes yes yes yes yes yes yes technology high-performance, low overhead, sw/hw interface yes yes yes yes yes yes yes yes yes yes yes yes yes high speed on-chip risc processors b dual dual dual dual dual single single single single dual dual single single wol support meeting the acpi requirements yes d yes d yes d yes d yes d yes d yes d yes d yes d yes d yes d yes d yes d maximum external ssram 16 mb none none none none none none none none none none none none process voltage 3.3v/1.8 v 3.3 v/1.8 v 1.2v 1.2v 1.2v 1.2v 1.2v 1.2v 1.2v 1.2v 1.2v 1.2v 1.2v cmos linewidth 0.18 m 0.18 m 0.13 m 0.13 m 0.13 m 0.13 m 0.13 m 0.13 m 0.13 m 0.13 m 0.13 m 0.13 m 0.13 m 5v tolerant pci i/os yes yes yes yes yes yes yes yes yes yes yes yes yes a. memory amount given is per pci function. b. indicates the number of processors per port. example: each port of the bcm5704c has two risc proces sors, for a total of four risc processors. c. separate phy required (bcm5401 phy). d. conformance to pci power management specification v1.1, supporting: - magic packet wake-up - wake-up on interesting packet table 1: family features (cont.) feature mac only single mac transceivers dual mac transceivers bcm5700 bcm5701 bcm5702 BCM5703c BCM5703s bcm5705/ bcm5788 bcm5721 bcm5751 bcm5752 bcm5704c bcm5704s bcm5714c/ bcm5715c bcm5714s/ bcm5715s www.datasheet.in programmer?s guide bcm57xx 01/29/08 broadcom corporation document 57xx-pg105-r revision levels page 5 r evision l evels see table 2 for the revision levels of the bcm57xx family. ho st software can use the pci revision id and chip id information in the pci configuration registers to determine the revision level of the bcm57xx chip on the board to load the appropriate workaround described in the errata sheets. the broadcom pci vendor id is 0x14e4. table 2 shows the default values of pci device ids. these values may be modified by firmware in accordance with the manufacturing information supplied in nvram (see section 4: ?nvram configuration? on page 88 for more details). e. automatic mdi crossover function - automatic detection and correction of pair swaps, pair skew, and pair polarity; - auto-negotiation with next page capability f. these devices have internal phys, with the mii/gmii internal between the macs and phys. there is no external mii/gmii between the macs and phys. g. the gmii/mii management interface is managed internally using indirect register access via the mac (see ?transceiver registers? on page 603 ). there are no mdio, mdc, or mdint ports. h. since these chips use 0.13 m process silicon, the jtag is only 3.3v tolerant. i. up to 16 mb of flash memory supported. j. requires revision b0 silicon or later. k. supports ipmi 1.5 specification through optional firmware. l. supports asf 1.03 specification through optional firmware. m. supports asf 2.0 specification through optional firmware. n. supported on bcm5751t and bcm5751tm parts. o. the bcm5705 supports dual addressing as per pci specific ation, whereby a type of 64-bit addressing is possible. the bcm5788 does not support dual addressing. note: the bcm5752 does not support vpd writes. table 2: family revision levels family member device id a revision level pci revision id b chip id c phy core errata sheet d bcm5700 mac 0x1644 b0 0x10 0x7100xxxx n/a 5700-es3xx-r 0x1644 b1 0x11 0x7101xxxx n/a 5700-es3xx-r 0x1644 b2 0x12 0x7102xxxx n/a 5700-es1xx-r 5700-es8xx-r 0x1644 b3 0x13 0x7103xxxx n/a 5700-es4xx-r 0x1644 c0 0x20 0x7200xxxx n/a 5700-es5xx-r 0x1644 c1 0x21 0x7201xxxx n/a 5700-es6xx-r 0x1644 c2 0x22 0x7202xxxx n/a 5700-es7xx-r bcm5701 mac transceiver 0x1645 a0 0x08 0x0000xxxx bcm5402 c0 5701-es1xx-r 0x1645 a2 0x12 0x0002xxxx bcm5402 c0 5701-es2xx-r 0x1645 a3 0x15 0x0003xxxx bcm5402 c0 5701-es3xx-r 0x1645 b5 0x25 0x0105xxxx bcm5402 c2 ? bcm5702 mac transceiver 0x16a6 a0 0x00 0x1000xxxx bcm5421 a1 5702-es1xx-r 0x16a6 a1 0x01 0x1001xxxx bcm5421 a2 ? 0x16a6 a2 0x02 0x1002xxxx bcm5421 a2 5702-es3xx-r www.datasheet.in bcm57xx programmer?s guide 01/29/08 broadcom corporation page 6 revision levels document 57xx-pg105-r BCM5703c mac transceiver 0x16a7 a0 0x00 0x1000xxxx bcm5421 a1 5703c-es1xx-r 0x16a7 a1 0x01 0x1001xxxx bcm5421 a2 ? 0x16a7 a2 0x02 0x1002xxxx bcm5421 a2 5703c-es3xx-r 0x16c7 b0 0x10 0x1100xxxx bcm5421 a3 5703c-es4 xx -r 0x16a7 b1 0x02 0x1002xxxx bcm5421 a3 ? BCM5703s mac transceiver serdes 0x16a7 a0 0x00 0x1000xxxx n/a 5703s-es1xx-r 0x16a7 a1 0x01 0x1001xxxx n/a ? 0x16a7 a2 0x02 0x1002xxxx n/a 5703s-es3xx-r 0x16c7 b0 0x10 0x1100xxxx n/a 5703s-es4 xx -r 0x16a7 b1 0x02 0x1002xxxx n/a ? bcm5704c dual mac transceiver 0x1648 a0 0x00 0x2000xxxx bcm5421 a1 5704c-es1xx-r 0x1648 a1 0x01 0x2001xxxx bcm5421 a1 5704c-es2xx-r 0x1648 a2 0x02 0x2002xxxx bcm5421 a1 5407c-es3xx-r 0x1648 a3 0x03 0x2003xxxx bcm5421 a1 5704c-es4xx-r 0x1648 b0 0x10 0x2100xxxx bcm5421 a1 5704c-es5xx-r bcm5704s dual mac transceiver serdes 0x16a8 e a0 0x00 0x2000xxxx n/a ? 0x16a8 e a1 0x01 0x2001xxxx n/a 5704s-es1xx-r 0x16a8 e a2 0x02 0x2002xxxx n/a 5704s-es2xx-r 0x16a8 e a3 0x03 0x2003xxxx n/a 5704s-es2xx-r 0x16a8 e b0 0x10 0x2100xxxx n/a 5704s-es3xx-r bcm5705 mac transceiver 0x1653 a0 0x00 0x3000xxxx bcm5464 a0 5705-es1xx-r 0x1653 a1 0x01 0x3001xxxx bcm5464 a0 5705-es2xx-r 0x1653 a2 0x02 0x3002xxxx bcm5464 a0 ? 0x1653 a3 0x03 0x3003xxxx bcm5464 a0 5705-es3xx-r 0x1653 a5 0x05 0x3005xxx bcm5464 a0 5705-es3xx-r bcm5705m mac transceiver 0x165d a1 0x01 0x3001xxxx bcm5464 a0 5705m-es2xx-r 0x165e a2 0x02 0x3002xxxx bcm5464 a0 ? 0x165e a3 0x03 0x3003xxxx bcm5464 a0 5705m-es3xx-r 0x165e a5 0x05 0x3005xxxx bcm5464 a0 5705m-es4xx-r bcm5788 mac transceiver 0x169c a5 0x05 0x3005xxxx bcm5464 a0 5788-es2xx-r bcm5721 mac transceiver 0x1659 a0 0x00 0x4000xxxx bcm5464 egphy_core_hd-a103 5721-es1xx-r 0x1659 a1 0x01 0x4001xxxx bcm5464 egphy_core_hd-a103 5721-es2xx-r bcm5751 mac transceiver 0x1677 a0 0x00 0x4000xxxx bcm5464 egphy_core_hd-a103 5751-es1xx-r 0x1677 a1 0x01 0x4001xxxx bcm5464 egphy_core_hd-a103 5751-es2xx-r bcm5751m mac transceiver 0x167d a0 0x00 0x4000xxxx bcm5464 egphy_core_hd-a103 5751m-es1xx-r 0x167d a1 0x01 0x4001xxxx bcm5464 egphy_core_hd-a103 5751m-es2xx-r table 2: family revision levels (cont.) family member device id a revision level pci revision id b chip id c phy core errata sheet d www.datasheet.in programmer?s guide bcm57xx 01/29/08 broadcom corporation document 57xx-pg105-r programming the bcm57xx family page 7 p rogramming the bcm57xx f amily the reference documents for bcm57xx software development include this manual and the errata documentation (see ?revision levels? on page 5 ) that provide the necessary information for writing a host-based device driver. the programming model for the bcm57xx mac does not have interdependency upon os or processor instruction sets. programmers using motorola ? 68000, intel ? x86, or dec alpha host instruction sets will be able to leverage this document to aid and assist in device driver development. additionally, concepts provided in this document are applicable to device drivers native to any operating system (i.e., dos, unix ? , microsoft ? , or novell ? ). bcm5752 mac transceiver 0x1600 a0 0x00 0x5000xxxx bcm5464 gphy_core_hd-a104 0x1600 a1 0x01 0x6001xxxx bcm5464 gphy_core_hd-a104 5752-es2xx-r bcm5752m mac transceiver 0x1601 a0 0x00 0x5000xxxx bcm5464 gphy_core_hd-a104 0x1601 a1 0x01 0x6001xxxx bcm5464 gphy_core_hd-a104 5752m-es2xx-r bcm5714c mac transceiver 0x1668 a0 0x00 0x5000xxxx bcm5464 gphy_core_hd-a104 5714c-es02-r 0x1668 a1 0x01 0x9001xxxx bcm5464 gphy_core_hd-a104 5714c-es2xx-r bcm5714s mac transceiver 0x1669 a0 0x00 0x5000xxxx bcm5464 gphy_core_hd-a104 5714s-es02-r 0x1669 a1 0x01 0x9001xxxx bcm5464 gphy_core_hd-a104 5714s-es2xx-r bcm5715c mac transceiver 0x1678 a0 0x00 0x5000xxxx bcm5464 gphy_core_hd-a104 5715c-es02-r 0x1678 a1 0x01 0x9001xxxx bcm5464 gphy_core_hd-a104 5715c-es2xx-r bcm5715s mac transceiver 0x1679 a0 0x00 0x5000xxxx bcm5464 gphy_core_hd-a104 5715s-es02-r 0x1679 a1 0x01 0x9001xxxx bcm5464 gphy_core_hd-a104 5715s-es2xx-r a. see ?device id register (offset 0x02)? on page 301 . b. see ?revision id register (offset 0x08)? on page 304 . broadcom firmware programs this value after device reset. the hardware default is 0x00. c. see ?miscellaneous host control register (offset 0x68)? on page 325 . the lower 16 bits are don?t cares. d. see the appropriate errata documentation for the errata information and resolutions. e. the device id is 0x16a8 if boot code is v3.04 or later; otherwise it is 0x1648. table 2: family revision levels (cont.) family member device id a revision level pci revision id b chip id c phy core errata sheet d www.datasheet.in bcm57xx programmer?s guide 01/29/08 broadcom corporation page 8 about this manual document 57xx-pg105-r a bout t his m anual the host programmer reference manual provides information on how to write device drivers for the bcm57xx netxtreme family. this manual focuses on the registers, control blocks, and software interfaces necessary for host software programming. this document is intended to complement the data sheet for the appropriate member of the bcm57xx family. the errata documentation (see ?revision levels? on page 5 ) complements this manual. r elated d ocumentation data sheets, application notes, and errata documentation for: ? bcm5700 ? bcm5701 ? bcm5702 ? BCM5703c ? BCM5703s ? bcm5704c ? bcm5704s ? bcm5705 ? bcm5788 ? bcm5721 ? bcm5751 ? bcm5714c ? bcm5714s ? bcm5715c ? bcm5715s ? bcm5752 n otational c onventions r egisters and b its register and bit names are concatenated with underscores: ? mac_mode (register) ? enable_tde (bit) periods separate a register and bit pair: ? register.bit ? mac_mode.enable_tde documentation generally avoids referencing bits by offset; the register definition section provides register and bit offsets. www.datasheet.in programmer?s guide bcm57xx 01/29/08 broadcom corporation document 57xx-pg105-r notational conventions page 9 f unctional o verview functional descriptions provide high level overviews of the bcm57xx architectural blocks. the black box inputs/outputs from block diagrams aid software developers with programming the device. o perational c haracteristics this section describes how software programs or interfaces with a hardware block. p seudocode table 3 defines the c style pseudocode that is used throughout this document. pseudocode is an informal syntax intended to explain complex algorithms. the methods used to program the bcm57xx family and companion silicon may be defined using pseudocode. table 3 is not meant to restrict algorithmic representations, but help define a structure used throughout the document. this pseudocode is not a formal language and does not have a formal grammar. when appropriate, pseudocode may deviate from these notations. table 3: pseudocode definition notation notes register and bit field register.bit bold variable variable italics pointer variableptr italics + ptr constant constant_definition capitalization bcm57xx programmer?s guide 01/29/08 broadcom corporation page 10 notational conventions document 57xx-pg105-r programmer?s guide bcm57xx 01/29/08 broadcom corporation document 57xx-pg105-r features page 11 section 2: features typical applications for the bcm57xx netxtreme family include nics and a lom. bcm5700 mac the bcm5700 is the first generation gigabit ethernet cont roller device with a 10/100/1000 mbps ethernet mac that supports full-duplex/half-duplex capability at all speeds. th e mac interfaces with the external transceiver via the gigabit media independent interface (gmii) in 1000base-t mode, the media independent interface (mii) in 10/100base-t mode, and 10-bit interface (tbi) in serdes mode. the device provides both pci v2.2 and pci-x v1.0 bus interfaces. the bcm5700 mac provides large on-chip buffer memory for stand-alone operation and optionally supports up to 16 mb of external memory. dual on-chip high-performance risc processors enable custom frame processing features including tcp segmentation, ip fragmentation, and ip reassembly. the device is fabricated in a low-voltage 1.8v cmos process providing a low-power system solution. following are the important features of bcm5700 mac device. ? pci-v2.2 32-bit/64-bit, 33-mhz/66-mhz bus interface ? pci-x v1.0 64-bit, 133-mhz bus interface ? dual high-speed on-chip risc processors ? 10/100/1000base-t full-duplex and half-duplex mac ? mii/gmii and tbi mac-phy interfaces ? ieee 802.1q vlan tag support ? ieee 802.1p layer2 priority encoding ? wol support meeting acpi requirements ? ieee 802.3x flow control ? integrated 96-kb packet buffer memory ? programmable receive rule checker ? 9kb jumbo frame support ? statistics for snmp mib ii, ethernet-like mib, and ethernet mib (802.3z clause 30) ? 16-mb external synchronous static ram (ssram) support ? mdio management interface ? serial eeprom interface ? jtag support ? 3.3v/1.8v cmos with 5v tolerant pci i/os ? 388 pbga package a complete nic or lom solution for gigabit ethernet is achieved by combining the bcm5700 mac with the bcm5401 single- chip gigabit ethernet transceiver (see figure 1 ). www.datasheet.in bcm57xx programmer?s guide 01/29/08 broadcom corporation page 12 bcm5700 mac document 57xx-pg105-r t ypical a pplication (c opper -b ased l ayout ) the following figure shows a typical bcm5700-based nic board layout. figure 1: typical bcm5700-based nic board layout the following table lists the part component breakdown. table 4: bcm5700 nic part component breakdown part component description rj45 the physical connector for category 5 twisted-pair cabling magnetics the pulse h5001 isolates the physical layer from voltage events such as sags, swells, and transients. the magnetics module also compensates for impedance mismatches between the cabling and physical layer. phy the bcm5401 physical layer (phy) component converts analog waveforms to digital signals. a dsp processes analog signals and compensates for return loss, cable loss, far-end cross talk, and near- end cross-talk. the digital data is passed to the mac via the gmii or mii connection. clock source a crystal oscillator generates a 25-mhz clocking signal. this clock is an input to the physical layer component. a pll in the phy drives a 125-mhz gmii clock to the mac. voltage regulators the bcm95700 reference design provides three voltage sources for the mac and phy components. the bcm5700 mac uses a 3.3v power rail for pci i/o drivers and a 1.8v power rail for core logic. the phy uses all 3.3v, 2.5v, and 1.8v power rails. the voltage regulators will step voltage down from 5v or 3.3v slot sources to the three respective levels. rj-45 bcm5401 phy pulse h5001 at24c64 two-wire not a pcb layout (educational only) activity 10 mbps 100 mbps 1000 mbps four rx/tx pairs data/addr line s la3-23, and ld0-63 64k, 128k, 256k, or 512k serial eeproms for firmware, mac address, and vendor information /4 ssram ssram ssram ssram 64-bit pci extension bcm5700 c/be, stop, devsel, frame, irdy, trdy, ad00-64,... pci and pci-x interface mii or gmii interface clock source optional ssram www.datasheet.in programmer?s guide bcm57xx 01/29/08 broadcom corporation document 57xx-pg105-r bcm5700 mac page 13 t ypical a pplication (f iber -o ptic l ayout ) the following figure shows a typical bcm5700-based serdes board layout. figure 2: typical bcm5700-based fiber-optic board block diagram mac the bcm5700 mac. gmii/mii ? gmii is an 8-bit wide interface that is clocked at 125 mhz. the resultant bandwidth is 1 gbps. ? mii is 4 bits wide and clocks at 25 mhz. ssram external ssram is optional. applications may attach 16 mb of external ssram to the bcm5700 mac. 8 mb can be made available to packet rx/tx pools and 8 mb for risc addressable memory. the ssram banks must be 133-mhz pipelined ssram with a 5-ns maximum access time. pci/pci-x the pci specification defines a protocol for bus master controller and target data movement. the mac is a bus master controller and may move data without cpu intervention. the bcm5700 mac supports both the pci v2.2 and the pci-x v1.0 specifications. eeprom the non-volatile storage for firmware boot code, mac address, vpd, and pxe code. the eeprom is read after the bcm5700 mac is reset. table 4: bcm5700 nic part component breakdown (cont.) part component description pci and pci-x interface agilent serdes at24c64 2 wire activity 10 mbps 100 mbps 1000 mbps 64k, 128k, 256k, or 512k serial eeproms for firmware, mac address, and vendor information /4 25 mhz mac clock source power regulators bcm570x infineon optics module tx/10 txdn ten-bit interface (tbi) 125 mhz serdes clock source rx/10 clk/3 rxdn 1.25 ghz pecl 64-bit pci extension c/be, stop, devsel, frame, irdy, trdy, ad00-64, etc... www.datasheet.in bcm57xx programmer?s guide 01/29/08 broadcom corporation page 14 bcm5700 mac document 57xx-pg105-r the following table lists the part component breakdown. p rogramming a spects see table 2: ?family revision levels,? on page 5 for the revision levels of the bcm57xx family. host software can use the pci revision id and chip id information in the pci configuration registers to determine the revision level of the bcm57xx chip on the board to load the appropriate workarounds described in the errata sheets. choice of host access mode determines mailbox priority (see ?configuration space? on page 178 in section 9: ?pci? ): ? host standard or flat mode uses the high-priority mailboxes (see ?high-priority mailboxes? on page 370 ). ? indirect mode uses the low-priority mailboxes (see ?low-priority mailboxes? on page 490 ). mini rings require the presence of external ssram. exter nal ssram is option for the bcm5700 mac, but external ssram must be present for the bcm5700 mac to support mini rings. see ?device control? on page 146 for the procedure to initialize this device. table 5: bcm5700 fiber-optic part component breakdown part component description optics module multimode or single-mode fiber optic physical layer. serdes the serializer-deserializer accepts tbi input and outputs a 1.25-ghz pecl output. clock source two clock sources are used in the fiber application: a 125-mhz clock for the tbi interface and a 25- mhz clock for core mac functionality (i.e., rx, tx, pci). voltage regulators three external voltage regulators for 3.3v, 2.5v, and 1.8v (the agilent serdes chip uses 3.3v power source). mac the bcm5700 mac. pci/pci-x the pci specification defines a protocol for bus master controller and target data movement. the mac is a bus master controller and may move data without cpu intervention. the bcm5700 mac supports both the pci v2.2 and the pci-x v1.0 specifications. eeprom the non-volatile storage for firmware boot code, mac address, vpd, and pxe code. the eeprom is read after the bcm5700 mac is reset. www.datasheet.in programmer?s guide bcm57xx 01/29/08 broadcom corporation document 57xx-pg105-r bcm5701 mac with integrated transceiver page 15 bcm5701 mac with i ntegrated t ransceiver the bcm5701 is the second generation gigabit ethernet controller that integrates the triple speed mac and 10/100/ 1000base-t ethernet transceiver into one device. the integrated ethernet phy transceiver performs all the physical layer functions for 1000base-t, 100base-t, and 10base-t ethernet on standard category 5 utp. the bcm5701 mac also supports a tbi for 1000base-sx connections. based on broadcom ?s proven dsp technology, the integrated ethernet phy transceiver device is a highly integrated solution combining digital adaptive equalizers, adcs, plls, line drivers, echo cancellers, crosstalk cancellers, and all other required support circuitry. the bcm5701 mac provides both pci v2.2 and pci-x v1.0 bus interfaces, as well as a large on-chip buffer memory. dual on-chip high-performance processors enable custom frame processing features such as tcp segmentation. a full-featured mac provides full-duplex/half-duplex capability at all speeds. the device is fabricated in a low-voltage 1.8v cmos process providing a low-power system solution. ? pci-v2.2 32-bit/64-bit, 33-mhz/66-mhz bus interface ? pci-x v1.0 64-bit, 133mhz bus interface ? dual high-speed on-chip risc processors ? 10/100/1000base-t full-duplex and half-duplex mac ? 10/100/1000base-t ethernet phy transceiver ? tbi mac-phy interface for 1000-base sx connections ? ieee 802.1q vlan tag support ? ieee 802.1p layer2 priority encoding ? wol support meeting acpi requirements ? ieee 802.3x flow control ? integrated 96-kb packet buffer memory ? programmable receive rule checker ? 9kb jumbo frame support ? statistics for snmp mib ii, ethernet-like mib, and ethernet mib (802.3z clause 30) ? serial eeprom interface ? jtag support ? 1.8v cmos with 5v tolerant pci i/os ? 300 bga and 304 pbga packages the bcm5701 mac transceiver provides a complete nic or lom solution for gigabit ethernet (see figure 3 ). note: the bcm5701 and later mac transceivers include an integrated mac and phy. host driver software can program the integrated phy just as if it were an external discrete chip. host software can use the traditional bit- bang method or auto-access methods to access phy mdi register space (see ?access methods? on page 248 ). to create the broadcom one-chip solution, different phy cores have been integrated with different bcm57xx parts as listed in table 2 on page 5 . the bcm57xx mac and phy cores will be enhanced and changed independently of their respective baseline parts. www.datasheet.in bcm57xx programmer?s guide 01/29/08 broadcom corporation page 16 bcm5701 mac with integrated transceiver document 57xx-pg105-r t ypical a pplication the following figure shows a typical bcm5701-based nic board layout. figure 3: typical bcm5701-based nic board block diagram the following table lists the part component breakdown. table 6: bcm5701 nic part component breakdown part component description rj45 the physical connector for category 5 twisted-pair cabling. magnetics the pulse h5001 isolates the physical layer from voltage events such as sags, swells, and transients. the magnetics module also compensates for impedance mismatches between the cabling and physical layer. clock source a crystal oscillator generates a 25-mhz clocking signal. voltage regulators the bcm95701 reference design provides three voltage sources for the bcm5701 mac- transceiver: 3.3v, 2.5v, and 1.8v. the voltage regulato rs will step voltage down from 5v or 3.3v slot sources to the three respective levels. mac the bcm5701 mac. pci/pci-x the pci specification defines a protocol for bus master controller and target data movement. the mac is a bus master controller and may move data without cpu intervention. the bcm5701 mac supports both the pci v2.2 and the pci-x v1.0 specifications. eeprom the non-volatile storage for firmware boot code, mac address, vpd, and pxe code. the eeprom is read after the mac is reset. rj-45 pci and pci-x interface pulse h5001 at24c64 2-wire activity 10 mbps 100 mbps 1000 mbps 64k, 128k, 256k, or 512k serial eeproms for firmware, mac address, and vendor information c/be, stop, devsel, frame, irdy, trdy, ad00-64,... /4 clock source power regulator + heat sink bcm5701 64-bit pci extension media interface transmitt/receive pairs www.datasheet.in programmer?s guide bcm57xx 01/29/08 broadcom corporation document 57xx-pg105-r bcm5702 mac with integrated transceiver page 17 p rogramming a spects see table 2: ?family revision levels,? on page 5 for the revision levels of the bcm57xx family. host software can use the pci revision id and chip id information in the pci configuration registers to determine the revision level of the bcm57xx chip on the board to load the appropriate workarounds described in the errata sheets. the bcm5701 mac-controller is an integrated mac and phy. the bcm5402 phy was integrated together with the triple speed bcm5700 mac core to create the broadcom one-chip solution?the bcm5701 mac transceiver. the bcm5701 mac core and bcm5402 phy cores will be enhanced/changed independently of their respective baseline parts (bcm5402 phy and bcm5700 mac). host driver software can program the integrated phy just as if it were an external discrete/chip. host software can use the traditional bit-bang method or auto-access methods to access phy mdi register space (see ?access methods? on page 248 ). choice of host access mode determines mailbox priority (see ?configuration space? on page 178 in section 9: ?pci? ): ? host standard or flat mode uses the high-priority mailboxes (see ?high-priority mailboxes? on page 370 ). ? indirect mode uses the low-priority mailboxes (see ?low-priority mailboxes? on page 490 ). mini rings require the presence of external ssram. since exte rnal ssram is not supported by the bcm57xx family except for the bcm5700 mac, mini rings are not supported on this version of the chip. see ?device control? on page 146 for the procedure to initialize this device. bcm5702 mac with i ntegrated t ransceiver the bcm5702 is a third generation device that combines a trip le speed mac with a triple speed ethernet transceiver, a 32- bit pci, and 96kb frame buffer memory. following are the important features of bcm5702 device. ? pci-v2.2 32-bits, 33-mhz/66-mhz bus interface ? dual high-speed on-chip risc processors ? 10/100/1000base-t full-duplex and half-duplex mac ? 10/100/1000base-t ethernet phy transceiver ? ieee 802.1q vlan tag support ? ieee 802.1p layer2 priority encoding ? wol support meeting acpi requirements ? ieee 802.3x flow control ? integrated 96-kb packet buffer memory ? programmable receive rule checker ? 9kb jumbo frame support ? statistics for snmp mib ii, ethernet-like mib, and ethernet mib (802.3z clause 30) ? serial eeprom and serial flash support ? jtag support ? 1.2v cmos with 5v tolerant pci i/os ? available in a 196 fpbga package www.datasheet.in bcm57xx programmer?s guide 01/29/08 broadcom corporation page 18 bcm5702 mac with integrated transceiver document 57xx-pg105-r t ypical a pplication the following figure shows a typical bcm5702-based nic board layout. figure 4: typical bcm5702-based nic board block diagram table 7: bcm5702 nic part component breakdown part component description rj45 the physical connector for category 5 twisted-pair cabling. magnetics the pulse h5007 isolates the physical layer from voltage events such as sags, swells, and transients. the magnetics module also compensates for impedance mismatches between the cabling and physical layer. clock source a crystal oscillator generates a 25-mhz clocking signal. voltage regulators internal voltage regulator controllers provide control for external pnp controlled supplies for 2.5v and 1.2v. mac the bcm5702 mac. pci the pci specification defines a protocol for bus master controller and target data movement. the mac is a bus master controller and may move data without cpu intervention. the bcm5702 mac supports only the pci v2.2 specifications. eeprom/flash the non-volatile storage for firmware boot code, mac address, vpd, and pxe code. the eeprom is read after the mac is reset. spi pci interface at24c64 2 wire activity 10 mbps 100 mbps 1000 mbps 64, 128, 256 or 512kbit serial eeproms for firmware, mac address, & vendor information pci interface c/be#, stop#, devsel#, frame#, irdy#, trdy#, etc. /4 25mhz mac clock source bcm5702 1.2v flash up to 16 mbytes of flash supported (i.e. atmel p/n at45db011b) 2.5v external pnps; internal 1.2v and 2.5v regulator control external power regulators (optional) rj-45 pca epg40 01s gige mag media interface transmitt/receive pairs or 64, 128, 256 or 512 kbit serial eeprom or flash for firmware, mac address, and vendor information www.datasheet.in programmer?s guide bcm57xx 01/29/08 broadcom corporation document 57xx-pg105-r BCM5703c mac with integrated transceiver page 19 p rogramming a spects see table 2 on page 5 for the revision levels of the bcm57xx family. host software can use the pci revision id and chip id information in the pci configuration registers to determine the revision level of the bcm57xx chip on the board to load the appropriate workarounds described in the errata sheets. choice of host access mode determines mailbox priority (see ?configuration space? on page 178 in section 9: ?pci? ): ? host standard or flat mode uses the high-priority mailboxes (see ?high-priority mailboxes? on page 370 ). ? indirect mode uses the low-priority mailboxes (see ?low-priority mailboxes? on page 490 ). see ?device control? on page 146 for the procedure to initialize this device. BCM5703c mac with i ntegrated t ransceiver the BCM5703c device is a third-generation triple speed 10/100/1000base-t mac device. the integrated 10/100/ 1000base-t ethernet phy device performs all the physical layer functions for 1000base-t, 100base-t, and 10base-t ethernet on standard category 5 utp. this device is backward-compatible with bcm5701 mac transceiver. following are the important features of BCM5703c mac. ? pci-v2.2 32-bits, 33-mhz/66-mhz bus interface ? pci-x 64-bits, 133mhz bus interface ? dual high-speed on-chip risc processors ? 10/100/1000base-t full-duplex and half-duplex mac ? 10/100/1000base-t ethernet phy transceiver ? ieee 802.1q vlan tag support ? ieee 802.1p layer2 priority encoding ? wol support meeting acpi requirements ? ieee 802.3x flow control ? integrated 96-kb packet buffer memory ? programmable receive rule checker ? 9kb jumbo frame support ? statistics for snmp mib ii, ethernet-like mib, and ethernet mib (802.3z clause 30) ? smbus interface supporting asf 1.0 ? serial eeprom and serial flash support ? jtag support ? 1.2v cmos with 5v tolerant pci i/os ? available in a 400-fbga package following features are the improvements over bcm5701 mac-controller. ? lower power consumption ? an additional 128 address hash table entries ? support for 16 mac-perfect filtered addresses ? comprehensive non-volatile memory interface supporting both serial flash and serial eeprom www.datasheet.in bcm57xx programmer?s guide 01/29/08 broadcom corporation page 20 BCM5703c mac with integrated transceiver document 57xx-pg105-r t ypical a pplication the following figure shows a typical BCM5703c-based nic board layout. figure 5: typical BCM5703c-based nic board block diagram table 8: BCM5703c nic part component breakdown part component description rj45 the physical connector for category 5 twisted-pair cabling. magnetics the pulse h5007 isolates the physical layer from voltage events such as sags, swells, and transients. the magnetics module also compensates for impedance mismatches between the cabling and physical layer. clock source a crystal oscillator generates a 25-mhz clocking signal. voltage regulators internal voltage regulator controllers provide control for external pnp controlled supplies for 2.5v and 1.2v. mac the BCM5703c mac. pci/pci-x the pci specification defines a protocol for bus master controller and target data movement. the mac is a bus master controller and may move data without cpu intervention. the BCM5703c mac supports both the pci v2.2 and the pci-x v1.0 specifications. eeprom/flash the non-volatile storage for firmware boot code, mac address, vpd, and pxe code. the nvram is read after the mac is reset. spi pci & pci-x interface at24c64 2 wire activity 10 mbps 100 mbps 1000 mbps 64, 128, 256 or 512 kbit serial eeproms for firmware, mac address, & vendor information pci interface c/be#, stop#, devsel#, frame#, irdy#, trdy#, ad00-64, etc. /4 25 mhz mac clock source BCM5703c 1.2v 64 bit pci extension flash up to 16 mbytes of flash supported (i.e. atmel p/n at45db011b) 2.5v external pnps; internal 1.2v and 2.5v regulator control external power regulators (optional) rj-45 pulse h5007 gige mag media interface transmitt/receive pairs or 64, 128, 256 or 512 kbit serial eeprom or flash for firmware, mac address, and ven- dor information www.datasheet.in programmer?s guide bcm57xx 01/29/08 broadcom corporation document 57xx-pg105-r BCM5703s mac with integrated serdes transceiver page 21 p rogramming a spects see table 2 on page 5 for the revision levels of the bcm57xx family. host software can use the pci revision id and chip id information in the pci configuration registers to determine the revision level of the bcm57xx chip on the board to load the appropriate workarounds described in the errata sheets. choice of host access mode determines mailbox priority (see ?configuration space? on page 178 in section 9: ?pci? ): ? host standard or flat mode uses the high-priority mailboxes (see ?high-priority mailboxes? on page 370 ). ? indirect mode uses the low-priority mailboxes (see ?low-priority mailboxes? on page 490 ). see ?device control? on page 146 for the procedure to initialize this device. BCM5703s mac with i ntegrated s er d es t ransceiver the BCM5703s mac with integrated serdes transceiver supports a tbi for 1000base-sx connections. based on broadcom?s proven dsp technology, the integrated serdes transceiver device is a highly integrated solution combining digital adaptive equalizers, adcs, plls, line drivers, echo cancellers, crosstalk cancellers, and all other required support circuitry. following are the important features of BCM5703s device. ? pci-v2.2 32-bits, 33-mhz/66-mhz bus interface ? pci-x 64-bits, 133mhz bus interface ? dual high-speed on-chip risc processors ? 10/100/1000base-t full-duplex and half-duplex mac ? 1000base sx serdes transceiver ? ieee 802.1q vlan tag support ? ieee 802.1p layer2 priority encoding ? wol support meeting acpi requirements ? ieee 802.3x flow control ? integrated 96-kb packet buffer memory ? programmable receive rule checker ? 9kb jumbo frame support ? statistics for snmp mib ii, ethernet-like mib, and ethernet mib (802.3z clause 30) ? smbus interface supporting asf 1.0 ? serial eeprom and serial flash support ? jtag support ? 1.2v cmos with 5v tolerant pci i/os ? available in a 300 h2bga package www.datasheet.in bcm57xx programmer?s guide 01/29/08 broadcom corporation page 22 BCM5703s mac with integrated serdes transceiver document 57xx-pg105-r t ypical a pplication the following figure shows a typical BCM5703s-based nic board layout. figure 6: typical BCM5703s-based nic board block diagram table 9: BCM5703s nic part component breakdown part component description optics module multimode or single-mode fiber optic physical layer. serdes the serializer-deserializer accepts tbi input and outputs a 1.25-ghz pecl output. clock source two clock sources are used in the fiber application: a 125-mhz clock for the tbi interface and a 25- mhz clock for core mac functionality (i.e., rx, tx, pci). voltage regulators internal voltage regulator controllers provide control for external pnp controlled supplies for 2.5v and 1.2v. mac the BCM5703s mac. pci/pci-x the pci specification defines a protocol for bus master controller and target data movement. the mac is a bus master controller and may move data without cpu intervention. the mac supports both the pci v2.2 and the pci-x v1.0 specifications. eeprom/flash the non-volatile storage for firmware boot code, mac address, vpd, and pxe code. the nvram is read after the mac is reset. pci & pci-x interface at24c64 2 wire activity 10 mbps 100 mbps 1000 mbps 64, 128, 256 or 512kbit serial eeproms for firmware, mac address, & vendor information pci interface c/be#, stop#, devsel#, frame#, irdy#, trdy#, ad00-64, etc. /4 25 mhz mac clock source BCM5703s infineon optics module txdn rxdn 1.25 ghz pecl 64 bit pci extension flash spi up to 16 mbytes of flash supported (i.e. atmel p/n at45db011b) external power regulators (optional) 1.2v 2.5v external pnps; internal 1.2v and 2.5v regulator control or 64, 128, 256 or 512 kbit serial eeprom or flash for firmware, mac address, and ven- dor information www.datasheet.in programmer?s guide bcm57xx 01/29/08 broadcom corporation document 57xx-pg105-r bcm5704c dual-mac with integrated transceivers page 23 p rogramming a spects see table 2 on page 5 for the revision levels of the bcm57xx family. host software can use the pci revision id and chip id information in the pci configuration registers to determine the revision level of the bcm57xx chip on the board to load the appropriate workarounds described in the errata sheets. choice of host access mode determines mailbox priority (see ?configuration space? on page 178 in section 9: ?pci? ): ? host standard or flat mode uses the high-priority mailboxes (see ?high-priority mailboxes? on page 370 ). ? indirect mode uses the low-priority mailboxes (see ?low-priority mailboxes? on page 490 ). see ?device control? on page 146 for the procedure to initialize this device. bcm5704c d ual -mac with i ntegrated t ransceivers the bcm5704c is a fourth generation 10/100/1000base-t et hernet dual-port lan controller designed for high density server applications. the device combines two triple-speed (1000base-t/100base-tx/10base-t) macs with two triple- speed transceivers into one single monolithic cmos chip using 0.13 micron cmos technology. the bcm5704c device has two risc processors and 64 kb on chip buffer memory for each function. bridgeless arbitration architecture controls data flow between two independent pci functions, each is independently memory-mapped and pci configurable. ? pci-v2.2 32-bits, 33-mhz/66-mhz bus interface ? pci-x 32-bit/64-bit, 66/100/133mhz bus interface ? dual high-speed on-chip risc processors for each port (or pci function) ? two 10/100/1000base-t full-duplex and half-duplex macs ? two 10/100/1000base-t ethernet phy transceivers ? ieee 802.1q vlan tag support ? ieee 802.1p layer2 priority encoding ? wol support meeting acpi requirements ? ieee 802.3x flow control ? integrated 64-kb packet buffer memory for each port ? programmable receive rule checker ? 9kb jumbo frame support ? statistics for snmp mib ii, ethernet-like mib, and ethernet mib (802.3z clause 30) ? smbus interface supporting asf 1.0 and ipmi v1.5 ? serial eeprom and serial flash support ? jtag support ? 1.2v cmos with 5v tolerant pci i/os ? available in a 300 rbga and 400 fbga packages improvements over the third-generation integrated gigabit ethernet controller include the following: ? shared pci/pci-x interface bus across two internal pci functions with separate configuration space ? integrated dual 10/100/1000 mac and phy devices able to share the local bus via bridgeless arbitration ? comprehensive non-volatile memory interface supporting both serial flash and serial eeprom www.datasheet.in bcm57xx programmer?s guide 01/29/08 broadcom corporation page 24 bcm5704c dual-mac with integrated transceivers document 57xx-pg105-r t ypical a pplication the following figure shows a typical bcm5704c-based nic board layout. figure 7: typical bcm5704c-based nic board block diagram table 10: bcm5704c nic part component breakdown part component description rj45 the physical connector for category 5 twisted-pair cabling. magnetics the pulse h5007 isolates the physical layer from voltage events such as sags, swells, and transients. the magnetics module also compensates for impedance mismatches between the cabling and physical layer. clock source a crystal oscillator generates a 25-mhz clocking signal. voltage regulators internal voltage regulator controllers provide control for external pnp controlled supplies for 2.5v and 1.2v. mac the bcm5704c dual mac. pci/pci-x the pci specification defines a protocol for bus master controller and target data movement. the mac is a bus master controller and may move data without cpu intervention. the bcm5704c dual mac supports both the pci v2.2 and the pci-x v1.0 specifications. eeprom/flash the non-volatile storage for firmware boot code, mac address, vpd, and pxe code. the nvram is read after the mac is reset. spi pci & pci-x interface at24c64 2 wire activity 10 mbps 100 mbps 1000 mbps 64, 128, 256 or 512kbit serial eeproms for firmware, mac address, & vendor information pci interface c/be#, stop#, devsel#, frame#, irdy#, trdy#, ad00-64, etc. /4 25 mhz mac clock source bcm5704c 1.2v 64 bit pci extension flash up to 16 mbytes of flash supported (i.e. atmel p/n at45db011b) 2.5v external pnps; internal 1.2v and 2.5v regulator control external power regulators (optional) rj-45 media interface transmitt/receive pairs rj-45 or pulse h5007 gige mag pulse h5007 gige mag 64, 128, 256 or 512 kbit serial eeprom or flash for firmware, mac address, and vendor information www.datasheet.in programmer?s guide bcm57xx 01/29/08 broadcom corporation document 57xx-pg105-r bcm5704c dual-mac with integrated transceivers page 25 p rogramming a spects see table 2 on page 5 for the revision levels of the bcm57xx family. host software can use the pci revision id and chip id information in the pci configuration registers to determine the revision level of the bcm57xx chip on the board to load the appropriate workarounds described in the errata sheets. choice of host access mode determines mailbox priority (see ?configuration space? on page 178 in section 9: ?pci? ): ? host standard or flat mode uses the high-priority mailboxes (see ?high-priority mailboxes? on page 370 ). ? indirect mode uses the low-priority mailboxes (see ?low-priority mailboxes? on page 490 ). dual mac modes of operation in default mode, bcm5704c dual mac transceiver is considered as two independent devices. the host program can configure it to enable only one device or to configure two devices as one for teaming. in the two-function mode, each mac has its own pci configuratio n space registers. within this space, there is the base address register and the pci address range which the mac registers reside. the bcm5704c dual-mac transceiver can operate in the four different modes shown in figure 8 . figure 8: dual mac modes of operation function 0 bar function 1 bar function 0 bar function 0 bar mac a mac b both macs are enabled. only mac a is enabled. only mac b is enabled. as required by the spec, it responds as function 0. function 0 bar function 0 xbar only one config spac e is seen by the host, but there are two bar registers. www.datasheet.in bcm57xx programmer?s guide 01/29/08 broadcom corporation page 26 bcm5704c dual-mac with integrated transceivers document 57xx-pg105-r the following table describes the dual mac modes. the boot code reads nvram location 0xc8 (i.e., h/w configuration) for dual mac mode configuration and programs the dual mac control register (see ?dual-mac control register (offset 0xb8)? on page 346 ). the dual mac control register exists in both macs and must be written to the same value. gpio the BCM5703c mac-transceiver contains three gpio bits that can be controlled or observed through pci registers. the bcm5704c dual mac-transceiver also contains three gpio bits, but each mac contains a set of registers that control these bits. in order to let each of the macs control the gpio bits, use the following rules: ? if neither version of the gpio_oe is enabled, the gpio bit is tristated. ? if only one version of the gpio_oe is enabled, the gpio bit is driven with the value in the corresponding gpio_data bit. ? if both versions of the gpio_oe are enabled and the gpio_data bits are the same, that value is driven on the gpio bit. ? if both versions of the gpio_oe are enabled and the gpio_data bits are different, the gpio bit is tristated. table 11: dual mac modes of operation mode description both macs enabled this is the state of the bcm5704 in normal operation. each mac has its own config space and independent bar registers. mac a only enabled if mac b is disabled, it does not affect the operation of mac a, which continues to respond to config cycles to function 0. mac b only enabled since the pci spec requires all devices to contain a function 0, mac b will respond to function 0 config cycles. bar-xbar mode only mac a responds to config cycles, but mac a contains two base address registers. the second base address register (xbar) (see ?mac 0 xbar register (offset 0x18)? on page 307 ) is the location in pci space where mac b registers reside. in this state, mac b is still controlled by the mac b config registers, which are not accessible through config space. so bcm5704c software will be required to copy mac a config registers into mac b config space through memory write cycles. table 12: dual-mac control register channel control bits value mode 00 both macs enabled 01 mac b only 10 mac a only 11 bar-xbar mode www.datasheet.in programmer?s guide bcm57xx 01/29/08 broadcom corporation document 57xx-pg105-r bcm5704c dual-mac with integrated transceivers page 27 wol the gpio0, gpio1, and gpio2 are used to switch between vdd and vaux. in the bcm5704c/bcm5704s dual mac- controller, the shared gpios can be used for the same purpose by following these rules: ? on reset, oe is inactive. ? when the device is loaded, if wol is enabled, enable oe and drive out low. ? when the device is loaded, if wol is disabled, leave oe inactive. ? on wol, drive out high. to support the case where one device is not loaded, mac a and mac b must handshake to ensure both are ready for low- power mode before performing the gpio write that will switch the power source (see the following figure). figure 9: handshaking using power signal status signals the low__power_ack signals initialize inactive. if a port is disabled, low_power_ack will be driven high. when the first mac receives the low-power event, it asserts its low_power_req and low_power_ack. if the other mac has a device loaded, it will wait until receiving a low-power event and then assert its low_power_req and low_power_ack. if the other mac has no device loaded, it will go into low-power mode and then assert low_power_ack. a mac that is asserting low_power_req does not perform the gpio write until low_power_ack is returned active. this guarantees that we do not switch the vaux until both macs are in low-power mode. pme , inta each mac has a unique version of pme which are logically ored to generate pme on the pci bus. each mac has a unique version of inta . the mac a inta is mapped to inta . the mac b inta is mapped to intb . mac b lo_power_req_in lo_power_ack_out lo_power_req_out lo_power_ack_in mac a lo_power_req_in lo_power_ack_out lo_power_req_out lo_power_ack_in mac_b_lo_power_ack mac_a_lo_power_ack mac_a_lo_power_req mac_b_lo_power_req www.datasheet.in bcm57xx programmer?s guide 01/29/08 broadcom corporation page 28 bcm5704c dual-mac with integrated transceivers document 57xx-pg105-r nvram nvram accesses use the same software arbitration as the BCM5703c mac-transceiver. the arbiters are chained together as shown in the following figure. figure 10: daisy-chained arbiters req_out is the or of the local requests. gnt_out is the or of the local grants. mac a has higher priority, as mac_a_req will block a mac b request. once mac b has been granted the nvram, mac_b_gnt prevents mac a from being granted the bus until mac b has finished. the single mac nvram arbitration is implement ed through the software arbitration register (see ?software arbitration register (offset 0x7020)? on page 555 ). the following table defines the register bits. the arbitration is a simple priority scheme with bit 0 being the highest priority and bit 3 lowest priority. initialization see ?device control? on page 146 for the procedure to initialize this device. table 13: software arbitration register bits bit name description 3:0 set_req when this bit is written high, the corresponding request bit is set. 7:4 clr_req when this bit is written high, the corresponding request bit is cleared. 11:8 arb_won when this bit is read high, the corresponding requestor controls the nvram. once this bit is high, it will remain high until clr_req is written high. 15:12 sw_req this bit reflects the value of the corresponding request. req_in req_out gnt_out gnt_in req_in req_out gnt_out gnt_in mac a mac b mac_a_req mac_b_gnt www.datasheet.in programmer?s guide bcm57xx 01/29/08 broadcom corporation document 57xx-pg105-r bcm5704s dual-mac with integrated serdes transceivers page 29 bcm5704s d ual -mac with i ntegrated s er d es t ransceivers the bcm5704s is a fourth generation device that co mbines two triple-speed (1000base-t/100base-tx/10base-t) macs with two 1000base-x serdes transceivers into one single monolithic cmos chip using 0.13 micron cmos technology. the bcm5704s device has two risc processors and 64 kb on ch ip buffer memory for each function. bridgeless arbitration architecture controls data flow between two independent pci functions, each is independently memory-mapped and pci configurable. ? pci-v2.2 32-bits, 33-mhz/66-mhz bus interface ? pci-x 32-bit/64-bit, 66/100/133mhz bus interface ? dual high-speed on-chip risc processors for each port (or pci function) ? two 10/100/1000base-t full-duplex and half-duplex macs ? two 1000base-x serdes transceivers ? ieee 802.1q vlan tag support ? ieee 802.1p layer2 priority encoding ? wol support meeting acpi requirements ? ieee 802.3x flow control ? integrated 64-kb packet buffer memory for each port ? programmable receive rule checker ? 9kb jumbo frame support ? statistics for snmp mib ii, ethernet-like mib, and ethernet mib (802.3z clause 30) ? smbus interface supporting asf 1.0 and ipmi v1.5 ? serial eeprom and serial flash support ? jtag support ? 1.2v cmos with 5v tolerant pci i/os ? available in a 300 rbga and 400 fbga packages improvements over the third-generation integrated gigabit ethernet controller include the following: ? shared pci/pci-x interface bus across two internal pci functions with separate configuration space ? integrated dual 10/100/1000 mac and phy devices able to share the local bus via bridgeless arbitration ? comprehensive non-volatile memory interface supporting both serial flash and serial eeprom www.datasheet.in bcm57xx programmer?s guide 01/29/08 broadcom corporation page 30 bcm5704s dual-mac with integrated serdes transceivers document 57xx-pg105-r t ypical a pplication the following figure shows a typical bcm5704s-based nic board layout. figure 11: typical bcm5704s-based nic board block diagram table 14: bcm5704s nic part component breakdown part component description optics module multimode or single-mode fiber optic physical layer. serdes the serializer-deserializer accepts tbi input and outputs a 1.25-ghz pecl output. clock source two clock sources are used in the fiber application: a 125-mhz clock for the tbi interface and a 25 mhz clock for core mac functionality (i.e., rx, tx, pci). voltage regulators internal voltage regulator controllers provide control for external pnp controlled supplies for 2.5v and 1.2v. mac the bcm5704s dual mac. pci/pci-x the pci specification defines a protocol for bus master controller and target data movement. the mac is a bus master controller and may move data without cpu intervention. the bcm5704s mac supports both the pci v2.2 and the pci-x v1.0 specifications. eeprom/flash the non-volatile storage for firmware boot code, mac address, vpd, and pxe code. the nvram is read after the bcm5704s dual mac transceiver serdes is reset. pci & pci-x interface at24c64 2 wire activity 10 mbps 100 mbps 1000 mbps 64, 128, 256 or 512kbit serial eeproms for firmware, mac address, & vendor information pci interface c/be#, stop#, devsel#, frame#, irdy#, trdy#, ad00-64, etc. /4 25 mhz mac clock source bcm5704s infineon optics module txdn rxdn 1.25 ghz pecl 64 bit pci extension flash spi up to 16 mbytes of flash supported (i.e. atmel p/n at45db011b) external pnps; internal 1.2v and 2.5v regualtro control external power regulators (optional) infineon optics module txdn rxdn or 64, 128, 256 or 512 kbit serial eeprom or flash for firmware, mac address, and vendor information www.datasheet.in programmer?s guide bcm57xx 01/29/08 broadcom corporation document 57xx-pg105-r bcm5704s dual-mac with integrated serdes transceivers page 31 p rogramming a spects see table 2 on page 5 for the revision levels of the bcm57xx family. host software can use the pci revision id and chip id information in the pci configuration registers to determine the revision level of the bcm57xx chip on the board to load the appropriate workarounds described in the errata sheets. choice of host access mode determines mailbox priority (see ?configuration space? on page 178 in section 9: ?pci? ): ? host standard or flat mode uses the high-priority mailboxes (see ?high-priority mailboxes? on page 370 ). ? indirect mode uses the low-priority mailboxes (see ?low-priority mailboxes? on page 490 ). dual mac modes of operation this section for the bcm5704s dual-mac transceiver serdes is the same as ?dual mac modes of operation? on page 25 for the bcm5704c dual-mac transceiver. gpio this section for the bcm5704s dual-mac transceiver serdes is the same as ?gpio? on page 26 for the bcm5704c dual- mac transceiver. wol this section for the bcm5704s dual-mac transceiver serdes is the same as ?wol? on page 27 for the bcm5704c dual- mac transceiver. pme , inta this section for the bcm5704s dual-mac transceiver serdes is the same as ?pme, inta? on page 27 for the bcm5704c dual-mac transceiver. nvram this section for the bcm5704s dual-mac transceiver serdes is the same as ?nvram? on page 28 for the bcm5704c dual- mac transceiver. initialization see ?device control? on page 146 for the procedure to initialize this device. www.datasheet.in bcm57xx programmer?s guide 01/29/08 broadcom corporation page 32 bcm5705 and bcm5788 macs with inte grated transceivers document 57xx-pg105-r bcm5705 and bcm5788 mac s with i ntegrated t ransceivers the bcm5705 mac is a fourth generation device that includes a triple speed mac and a 10/100/1000base-t ethernet transceiver. the device is suited for applications such as low-cost nic, low cost lan on motherboard (lom), and other applications that support the cat 5 connection. following are the important features of bcm5705 and bcm5788 devices. the bcm5788 does not support 64-bit addressing capability and dac capability. ? pci-v2.3 32-bits, 33-mhz/66-mhz bus interface ? single high-speed on-chip risc processor ? 10bt/100btx/1000bt full-duplex and half-duplex mac ? 10bt/100btx/1000bt ethernet phy transceiver ? ieee 802.1q vlan tag support ? ieee 802.1p layer2 priority encoding ? wol support meeting acpi requirements ? ieee 802.3x flow control ? integrated 56-kb rx packet buffer memory and 8-kb tx packet buffer memory ? programmable receive rule checker ? smbus interface supporting asf 1.0 ? serial eeprom and serial flash support ? jtag support ? 1.2v cmos with 5v tolerant pci i/os ? available in a 196 fbga package the bcm5705 mac-transceiver is identical to the BCM5703c mac transceiver except: ? only pci-v2.3 32-bits, 33-mhz/66-mhz bus interface ? single internal cpu (rx cpu) ? 56 kb rxmbuf with configurable partition between receive data buffer and cpu scratchpad (one common configuration is 32 kb for receive frame buffer and 24 kb for cpu scratchpad memory) ? separate 8 kb txmbuf to store transmit data packets ? single send ring ? single receive return ring ? standard receive producer ring only ? only four receive rules registers ? no jumbo frame support ? host-based send bd only www.datasheet.in programmer?s guide bcm57xx 01/29/08 broadcom corporation document 57xx-pg105-r bcm5705 and bcm5788 macs with integrated transceivers page 33 lower power state for nic or mobile applications t ypical a pplication the following figure shows a typical bcm5705-based nic board layout. figure 12: typical bcm5705-based nic board block diagram table 15: bcm5705 nic part component breakdown part component description rj45 the physical connector for category 5 twisted-pair cabling. magnetics the pulse h5007 isolates the physical layer from voltage events such as sags, swells, and transients. the magnetics module also compensates for impedance mismatches between the cabling and physical layer. clock source a crystal oscillator generates a 25-mhz clocking signal. voltage regulators internal voltage regulator controllers provide control for external pnp controlled supplies for 2.5v and 1.2v. mac the bcm5705 mac. pci the pci specification defines a protocol for bus master controller and target data movement. the mac is a bus master controller and may move data without cpu intervention. the bcm5705 mac supports only the pci v2.3 specification. eeprom/flash the non-volatile storage for firmware boot code, mac address, vpd, and pxe code. the nvram is read after the bcm5705 mac transceiver is reset. spi pci interface at24c64 2 wire activity 10 mbps 100 mbps 1000 mbps 64, 128, 256 or 512kbit serial eeproms for firmware, mac address, & vendor information pci interface c/be#, stop#, devsel#, frame#, irdy#, trdy#, etc. /4 25 mhz mac clock source bcm5705 1.2v flash up to 16 mbytes of flash supported (i.e. atmel p/n at45db011b) 2.5v external pnps; internal 1.2v and 2.5v regulator control external power regulators (optional) rj-45 pca epg40 01s gige mag media interface transmitt/receive pairs or 64, 128, 256 or 512 kbit serial eeprom or flash for firmware, mac address, and vendor information www.datasheet.in bcm57xx programmer?s guide 01/29/08 broadcom corporation page 34 bcm5721 mac with integrated transceiver document 57xx-pg105-r p rogramming a spects see table 2 on page 5 for the revision levels of the bcm57xx family. host software can use the pci revision id and chip id information in the pci configuration registers to determine the revision level of the bcm57xx chip on the board to load the appropriate workarounds described in the errata sheets. choice of host access mode determines mailbox priority (see ?configuration space? on page 178 in section 9: ?pci? ): ? host standard or flat mode uses the high-priority mailboxes (see ?high-priority mailboxes? on page 370 ). ? indirect mode uses the low-priority mailboxes (see ?low-priority mailboxes? on page 490 ). see ?device control? on page 146 for the procedure to initialize this device. bcm5721 mac with i ntegrated t ransceiver the bcm5721 is a seventh-generation 10/100/1000base-t ethernet lan controller solution for high-performance server network applications. the device combines a triple-speed ieee 802.3 compliant mac with a triple-speed ethernet transceiver, a 1x pcie bus interface, and on-chip buffer memo ry in a single device. following are important features of bcm5721 device. ? pcie v1.0a, x1 link width interface ? single high-speed on-chip risc processor ? 10bt/100btx/1000bt full-duplex and half-duplex mac ? 10bt/100btx/1000bt ethernet phy transceiver ? ieee 802.1q vlan tag support ? ieee 802.1p layer2 priority encoding ? wol support meeting acpi requirements ? tcp segmentation support ? ieee 802.3x flow control ? integrated 64-kb rx packet buffer memory and 8-kb tx packet buffer memory ? programmable receive rule checker ? smbus interface supporting asf 2.0 and ipmi v1.5 ? failover and teaming capabilities ? serial eeprom and serial flash support ? jtag support ? 1.2v cmos with 5v tolerant pci i/os ? available in a 196 fbga and 400 fbga packages the bcm5721 mac-transceiver is identical to the BCM5703c mac transceiver except: ? pcie v1.0a, x1 link width interface ? single internal cpu (rx cpu) ? 64 kb rxmbuf with configurable partition between receive data buffer and cpu scratchpad ? 8 kb txmbuf to store transmit data packets ? single send ring ? single receive return ring ? standard receive producer ring only www.datasheet.in programmer?s guide bcm57xx 01/29/08 broadcom corporation document 57xx-pg105-r bcm5721 mac with integrated transceiver page 35 ? only four receive rules registers ? no kb jumbo frame support ? host base send bd only ? lower power state for nic or mobile applications t ypical a pplication the following figure shows a typical bcm5721-based nic board layout. figure 13: typical bcm5721-based nic board block diagram table 16: bcm5721 nic part component breakdown part component description rj45 the physical connector for category 5 twisted-pair cabling. magnetics the pulse h5007 isolates the physical layer from voltage events such as sags, swells, and transients. the magnetics module also compensates for impedance mismatches between the cabling and physical layer. clock source a crystal oscillator generates a 25-mhz clocking signal. voltage regulators internal voltage regulator controllers provide control for external pnp controlled supplies for 2.5v and 1.2v. mac the bcm5721 mac. pcie this specification defines a protocol for bus master controller and target data movement. the mac is a bus master controller and may move data without cpu intervention. eeprom/flash the non-volatile storage for firmware boot code, mac address, vpd, and pxe code. the nvram is read after the mac is reset. bcm5721 1000base-t link status led rj- 45 magnetic 64kb eeprom 25m hz crystal 100base-t link status led 10base-t link status led activity led media pci- e pnp for 1.2v regulator 64 kb serial eeprom or flash www.datasheet.in bcm57xx programmer?s guide 01/29/08 broadcom corporation page 36 bcm5751 mac with integrated transceiver document 57xx-pg105-r p rogramming a spects see table 2 on page 5 for the revision levels of the bcm57xx family. host software can use the pci revision id and chip id information in the pci configuration registers to determine the revision level of the bcm57xx chip on the board to load the appropriate workarounds described in the errata sheets. choice of host access mode determines mailbox priority (see ?configuration space? on page 178 in section 9: ?pci? ): ? host standard or flat mode uses the high-priority mailboxes (see ?high-priority mailboxes? on page 370 ). ? indirect mode uses the low-priority mailboxes (see ?low-priority mailboxes? on page 490 ). see ?device control? on page 146 for the procedure to initialize this device. bcm5751 mac with i ntegrated t ransceiver the bcm5751 is a fifth-generation 10/100/1000base-t ethernet lan controller solution for high-performance network applications. the device combines a triple-speed ieee 802.3 compliant mac with a triple-speed ethernet transceiver, a 1x pcie bus interface, and on-chip buffer memory in a single device. following are the important features of bcm5751 device. ? pcie v1.0a, x1 link width interface ? single high-speed on-chip risc processor ? 10bt/100btx/1000bt full-duplex and half-duplex mac ? 10bt/100btx/1000bt ethernet phy transceiver ? ieee 802.1q vlan tag support ? ieee 802.1p layer2 priority encoding ? wol support meeting acpi requirements ? tcp segmentation support ? ieee 802.3x flow control ? integrated 64-kb rx packet buffer memory and 8-kb tx packet buffer memory ? programmable receive rule checker ? smbus interface supporting asf 2.0 ? failover and teaming capabilities ? serial eeprom and serial flash support ? jtag support ? 1.2v cmos with 5v tolerant pci i/os ? available in a 196 fpbga package the bcm5751 mac transceiver is identical to the BCM5703c mac transceiver except: ? pcie v1.0a, x1 link width interface ? single internal cpu (rx cpu) ? 64 kb rxmbuf with configurable partition between receive data buffer and cpu scratchpad ? 8 kb txmbuf to store transmit data packets ? single send ring ? single receive return ring ? standard receive producer ring only www.datasheet.in programmer?s guide bcm57xx 01/29/08 broadcom corporation document 57xx-pg105-r bcm5751 mac with integrated transceiver page 37 ? only four receive rules registers ? no jumbo frame support ? host-based send bd only ? lower power state for nic or mobile application the bcm5751t and bcm5751tm macs also have an integrated trusted platform module (tpm) security processor. t ypical a pplication the following figure shows a typical bcm5751-based nic board layout. figure 14: typical bcm5751-based nic board block diagram table 17: bcm5751 nic part component breakdown part component description rj45 the physical connector for category 5 twisted-pair cabling. magnetics the pulse h5007 isolates the physical layer from voltage events such as sags, swells, and transients. the magnetics module also compensates for impedance mismatches between the cabling and physical layer. clock source a crystal oscillator generates a 25-mhz clocking signal. voltage regulators internal voltage regulator controllers provide control for external pnp controlled supplies for 2.5v and 1.2v. mac the bcm5721 mac. pcie this specification defines a protocol for bus master controller and target data movement. the mac is a bus master controller and may move data without cpu intervention. eeprom/flash the non-volatile storage for firmware boot code, mac address, vpd, and pxe code. the nvram is read after the mac is reset. bcm5751 1000base-t link status led rj-45 magnetic 64kb eeprom 25 mhz crystal 100base-t link status led 10base-t link status led activity led media pci-e pnp for 1.2v regulator 64 kb serial eeprom or flash www.datasheet.in bcm57xx programmer?s guide 01/29/08 broadcom corporation page 38 bcm5714c dual-mac chip with integrated transceiver document 57xx-pg105-r p rogramming a spects see table 2 on page 5 for the revision levels of the bcm57xx family. host software can use the pci revision id and chip id information in the pci configuration registers to determine the revision level of the bcm57xx chip on the board to load the appropriate workarounds described in the errata sheets. choice of host access mode determines mailbox priority (see ?configuration space? on page 178 in section 9: ?pci? ): ? host standard or flat mode uses the high-priority mailboxes (see ?high-priority mailboxes? on page 370 ). ? indirect mode uses the low-priority mailboxes (see ?low-priority mailboxes? on page 490 ). see ?device control? on page 146 for the procedure to initialize this device. bcm5714c d ual -mac c hip with i ntegrated t ransceiver the bcm5714c is a fourth-generation 10/100/1000base-t dual-port lan controller for high-performance server applications. the device combines dual triple-speed ieee 802.3 compliant macs with dual 10/100/1000 ethernet transceivers (phy), a pcie to pci-x internal bridge for conn ecting to the two macs, a pci-x internal to pci-x bridge for supporting pci/pci-x devices downstream, a ump, and on-chip frame buffer memory in a single device. the device is fabricated in a 1.2v cmos process providing a low-power system solution. the bcm5714c provides a single x4 pcie host interface and supports one pcie to pci-x internal bridge function, two gigabit ethernet controller functions, and one pci-x internal to pci-x v1.0 bridge function. each function has its own pci configuration space. the pci-x internal to pci-x 1.0 bridge supports a 64-bit bus operating at 133 mhz, 100 mhz, 66 mhz, or 33 mhz. in pci mode of this bridge, the bus is compliant with the pci v2.2 specification. each port has a dedicated on- chip high-performance risc processor for custom frame processing. the bcm5714c also supports a ump interface for high-speed system management traffic. following are the important features of bcm5714c device. ? dual 10base-t/100base-tx/1000base-t full-duplex/half-duplex macs ? dual 10base-t/100base-tx/1000base-t ethernet phy transceivers ? x4 pcie host interface with x4 pcie to pci-x internal bri dge for connecting to dual macs and pci-x internal to pci-x v1.0 bridge. ? pci-x internal to pci-x v1.0 internal bridge with pci-x v1.0 secondary interface supporting 32-bit/64-bit, 66-mhz/100- mhz/133-mhz bus interface and pci v2.2 32-bit/64-bit, 33-mhz/66-mhz ? ump ? tcp segmentation, ip fragmentation, and reassembly ? ieee 802.1q vlan tag support ? ieee 802.1p layer2 priority encoding ? ieee 802.3x flow control ? cpu offload functions: tcp, ip, udp checksum ? 32 kb dedicated receive buffer ? 22 kb transmit buffer to store tx packets and ipmi packets ? jumbo frame support (9 kb) ? asf 2.0 support ? ipmi pass-through support ? acpi 1.1 compliant ? 36 kb of scratch pad memory www.datasheet.in programmer?s guide bcm57xx 01/29/08 broadcom corporation document 57xx-pg105-r bcm5714c dual-mac chip with integrated transceiver page 39 ? one send ring, one receive return ring, and one standard receive producer ring ? smbus 2.0 controller ? out-of-box wol support ? pxe 2.0 remote boot support ? 484 pbga package t ypical a pplication the following figure shows a typical bcm5714c-based lom design. figure 15: typical bcm5714c-based lom design block diagram table 18: bcm5714c nic part component breakdown part component description rj45 the physical connector for category 5 twisted-pair cabling. magnetics the pulse h5007 isolates the physical layer from voltage events such as sags, swells, and transients. the magnetics module also compensates for impedance mismatches between the cabling and physical layer. clock source a crystal oscillator generates a 25-mhz clocking signal. voltage regulators internal voltage regulator controllers provide control for external pnp controlled supplies for 2.5v and 1.2v. mac the bcm5714c mac. eeprom/flash the non-volatile storage for firmware boot code, mac address, vpd, and pxe code. the nvram is read after the mac is reset. bcm5714c leds leds leds leds 2.5v regulator 1.2v regulator clock source flash pcie interface ump interface ump interface pci-x interface rj45 rj45 mag mag www.datasheet.in bcm57xx programmer?s guide 01/29/08 broadcom corporation page 40 bcm5714s dual-mac chip with integrated fiber transceiver document 57xx-pg105-r bcm5714s d ual -mac chip with i ntegrated f iber t ransceiver the bcm5714s is a fourth-generation 1000base-x dual-port lan controller for high performance server applications. the device combines dual triple-speed ieee 802.3 compliant macs with dual serdes transceivers, a pcie to pci-x internal bridge, pci-x internal to pci-x v1.0 bridge, a ump and an on-chip memory buffer in a single device. the device is fabricated in a 1.2v cmos process providing a low-power system solution. the bcm5714s device is same as bcm5714c device except that it has two integrated serdes transceivers instead of two 10/100/1000base-t transceivers. following are the important features of bcm5714s device. ? dual 10base-t/100base-tx/1000base-t full-duplex/half-duplex macs ? dual 1000base-x ethernet serdes transceiver ? x4 pcie host interface with x4 pcie to pci-x internal bri dge for connecting to dual macs and pci-x internal to pci-x v1.0 bridge. ? pci-x internal to pci-x v1.0 internal bridge with pci-x v1.0 secondary interface supporting 32-bit/64-bit, 66-mhz/100- mhz/133-mhz bus interface and pci v2.2 32/64-bit, 66-mhz/100-mhz/133-mhz ? ump ? tcp segmentation, ip fragmentation and reassembly ? ieee 802.1q vlan tag support ? ieee 802.1p layer2 priority encoding ? ieee 802.3x flow control ? cpu offload functions: tcp, ip, udp checksum ? 32 kb dedicated receive buffer ? 22 kb transmit buffer to store tx packets and ipmi packets ? jumbo frame support (9 kb) ? asf 2.0 support ? ipmi pass-through support ? acpi 1.1 compliant ? 36 kb of scratch pad memory ? one send ring, one receive return ring, and one standard receive producer ring ? smbus 2.0 controller ? out-of-box wol support ? pxe 2.0 remote boot support ? 484 pbga package www.datasheet.in programmer?s guide bcm57xx 01/29/08 broadcom corporation document 57xx-pg105-r bcm5714s dual-mac chip with integrated fiber transceiver page 41 t ypical a pplication the following figure shows a typical bcm5714s-based lom design. figure 16: typical bcm5714s-based lom design block diagram table 19: bcm5714s nic part component breakdown part component description optics module multimode or single mode fiber optic physical layer. clock source a crystal oscillator generates a 25-mhz clocking signal. voltage regulators internal voltage regulator controllers provide control for external pnp controlled supplies for 2.5v and 1.2v. mac the bcm5714s mac. eeprom/flash the non-volatile storage for firmware boot code, mac address, vpd, and pxe code. the nvram is read after the mac is reset. bcm5714s leds leds leds leds infineon optics module infineon optics module 2.5v regulator 1.2v regulator clock source flash pcie interface ump interface ump interface pci-x interface www.datasheet.in bcm57xx programmer?s guide 01/29/08 broadcom corporation page 42 bcm5715c dual-mac chip with integrated transceiver document 57xx-pg105-r bcm5715c d ual -mac c hip with i ntegrated t ransceiver the bcm5715c is a fourth-generation 10/100/1000base-t dual-port lan controller for high performance server applications. the device combines dual triple-speed ieee 802.3 compliant macs with dual 10/100/1000 ethernet transceivers (phy), a pcie to pci-x internal bridge for connecting to the two macs, a ump, and on-chip frame buffer memory in a single device. the device is fabricated in a 1.2v cmos process providing a low-power system solution. the bcm5715c provides a x4 pcie host interface and supports one pcie to pci-x internal bridge function, and two gigabit ethernet controller functions. each function has its own pci configuration space. each mac function has a dedicated on- chip high-performance risc processor for custom frame processing. the bcm5715c also supports a ump interface for high-speed system management traffic. following are the important features of bcm5715c device. ? dual 10base-t/100base-tx/1000base-t full/half-duplex macs ? dual 10base-t/100base-tx/1000base-t ethernet phy transceivers ? x4 pcie host interface with x4 pcie to pci-x internal brid ge for connecting to dual macs and pci-x internal to pci-x v1.0 bridge. ? ump ? tcp segmentation, ip fragmentation and reassembly ? ieee 802.1q vlan tag support ? ieee 802.1p layer2 priority encoding ? ieee 802.3x flow control ? cpu offload functions: tcp, ip, udp checksum ? 32 kb dedicated receive buffer ? 22 kb transmit buffer to store tx packets and ipmi packets ? jumbo frame support (9 kb) ? asf 2.0 support ? ipmi pass-through support ? acpi 1.1 compliant ? 36 kb of scratch pad memory ? one send ring, one receive return ring, and one standard receive producer ring ? smbus 2.0 controller ? out-of-box wake-on lan support ? pxe 2.0 remote boot support ? 484 pbga package www.datasheet.in programmer?s guide bcm57xx 01/29/08 broadcom corporation document 57xx-pg105-r bcm5715c dual-mac chip with integrated transceiver page 43 t ypical a pplication the following figure shows a typical bcm5715c-based lom design. figure 17: typical bcm5715c-based lom design block diagram table 20: bcm5715c nic part component breakdown part component description rj45 the physical connector for category 5 twisted-pair cabling. magnetics the pulse h5007 isolates the physical layer from voltage events such as sags, swells, and transients. the magnetics module also compensates for impedance mismatches between the cabling and physical layer. clock source a crystal oscillator generates a 25-mhz clocking signal. voltage regulators internal voltage regulator controllers provide control for external pnp controlled supplies for 2.5v and 1.2v. mac the bcm5715c mac. eeprom/flash the non-volatile storage for firmware boot code, mac address, vpd, and pxe code. the nvram is read after the mac is reset. bcm5715c leds leds leds leds 2.5v regulator 1.2v regulator clock source flash pcie interface ump interface ump interface pci-x interface rj45 rj45 mag mag www.datasheet.in bcm57xx programmer?s guide 01/29/08 broadcom corporation page 44 bcm5715s dual-mac chip with int egrated fiber transceiver document 57xx-pg105-r bcm5715s d ual -mac c hip with i ntegrated f iber t ransceiver the bcm5715s is a fourth-generation 1000base-x dual-port lan controller for high performance server applications. the device combines dual triple-speed ieee 802.3 compliant macs with dual serdes transceivers, a pcie to pci-x internal bridge, an ump and an on-chip frame buffer memory in a single device. the device is fabricated in a 1.2v cmos process providing a low-power system solution. the bcm5715s device is same as bcm5715c device except that it has two integrated serdes transceivers instead of two 10base-t/100base-tx/1000base-t transceivers. following are the important features of bcm5715s device. ? dual 10base-t/100base-tx/1000base-t full/half-duplex macs ? dual 1000base-x ethernet serdes transceivers ? x4 pcie host interface with x4 pcie to pci-x internal bri dge for connecting to dual macs and pci-x internal to pci-x v1.0 bridge. ? ump ? tcp segmentation, ip fragmentation and reassembly ? ieee 802.1q vlan tag support ? ieee 802.1p layer2 priority encoding ? ieee 802.3x flow control ? cpu offload functions: tcp, ip, udp checksum ? 32 kb dedicated receive buffer ? 22 kb transmit buffer to store tx packets and ipmi packets ? jumbo frame support (9 kb) ? asf 2.0 support ? ipmi pass-through support ? acpi 1.1 compliant ? 36 kb of scratch pad memory ? one send ring, one receive return ring, and one standard receive producer ring ? smbus 2.0 controller ? out-of-box wake-on lan support ? pxe 2.0 remote boot support ? 484 pbga package www.datasheet.in programmer?s guide bcm57xx 01/29/08 broadcom corporation document 57xx-pg105-r bcm5715s dual-mac chip with integrated fiber transceiver page 45 t ypical a pplication the following figure shows a typical bcm5715s-based lom design. figure 18: typical bcm5715s-based lom design block diagram table 21: bcm5715s nic part component breakdown part component description optics module multimode or single mode fiber optic physical layer. clock source a crystal oscillator generates a 25-mhz clocking signal. voltage regulators internal voltage regulator controllers provide control for external pnp controlled supplies for 2.5v and 1.2v. mac the bcm5715s dual-port mac. eeprom/flash the non-volatile storage for firmware boot code, mac address, vpd, and pxe code. the nvram is read after the mac is reset. bcm5715s leds leds leds leds infineon optics module infineon optics module 2.5v regulator 1.2v regulator clock source flash pcie interface ump interface ump interface pci-x interface www.datasheet.in bcm57xx programmer?s guide 01/29/08 broadcom corporation page 46 bcm5752 mac device with integrated transceiver document 57xx-pg105-r bcm5752 mac d evice with i ntegrated t ransceiver the bcm5752 is an eight generation 10/100/1000base-t ethernet lan controller solution for high-performance network applications. the device combines a triple-speed ieee 802.3 compliant mac with a triple-speed ethernet transceiver, a 1x pcie bus interface, and on-chip buffer memory in a single device. following are the important features of bcm5752 device. ? pcie v1.0a, x1 link width interface ? single high-speed on-chip risc processor ? 10bt/100btx/1000bt full-duplex and half-duplex mac ? 10bt/100btx/1000bt ethernet phy transceiver ? ieee 802.1q vlan tag support ? ieee 802.1p layer2 priority encoding ? wake on lan support meeting acpi requirements ? tcp segmentation support ? ieee 802.3x flow control ? integrated 64-kb rx packet buffer memory and 8-kb tx packet buffer memory ? programmable receive rule checker ? smbus interface supporting asf 2.0 ? failover and teaming capabilities ? serial eeprom and serial flash support ? jtag support ? integrated trusted platform module (tpm) security engine compliant with the trusted computing group main specification version 1.2 and low pin count interface support. ? 1.2v cmos with 5v tolerant pci i/os ? available in a 144 fpbga package (0.8 mm and 1mm pitch) www.datasheet.in programmer?s guide bcm57xx 01/29/08 broadcom corporation document 57xx-pg105-r bcm5752 mac device with integrated transceiver page 47 t ypical a pplication the following figure shows a typical bcm5752-based nic board layout. figure 19: typical bcm5751-based nic board block diagram table 22: bcm5751 nic part component breakdown part component description rj45 the physical connector for category 5 twisted-pair cabling. magnetics the pulse h5007 isolates the physical layer from voltage events such as sags, swells, and transients. the magnetics module also compensates for impedance mismatches between the cabling and physical layer. clock source a crystal oscillator generates a 25-mhz clocking signal. voltage regulators internal voltage regulator controllers provide control for external pnp controlled supplies for 2.5v and 1.2v. mac the bcm5752 mac. pcie this specification defines a protocol for bus master controller and target data movement. the mac is a bus master controller and may move data without cpu intervention. eeprom/flash the non-volatile storage for firmware boot code, mac address, vpd, and pxe code. the nvram is read after the mac is reset. bcm5752 1000base-t link status led rj-45 magnetic 64-kb serial eeprom or flash 25-mhz crystal 100base-t link status led 10base-t link status led activity led media pcie pnp for 1.2v regulator www.datasheet.in bcm57xx programmer?s guide 01/29/08 broadcom corporation page 48 bcm5752 mac device with integrated transceiver document 57xx-pg105-r p rogramming a spects see table 2 on page 5 for the revision levels of the bcm57xx family. host software can use the pci revision id and chip id information in the pci configuration registers to determine the revision level of the bcm57xx chip on the board to load the appropriate workarounds described in the errata sheets. choice of host access mode determines mailbox priority (see ?configuration space? on page 178 in section 9: ?pci? ): ? host standard or flat mode uses the high-priority mailboxes (see ?high-priority mailboxes? on page 370 ). ? indirect mode uses the low-priority mailboxes (see ?low-priority mailboxes? on page 490 ). see ?device control? on page 146 for the procedure to initialize this device. www.datasheet.in programmer?s guide bcm57xx 01/29/08 broadcom corporation document 57xx-pg105-r hardware architecture page 49 section 3: hardware architecture t heory of o peration the functional block diagram below in figure 20 shows the major functional blocks and interfaces of the bcm57xx netxtreme family of gigabit ethernet macs. there are two packet flows: mac-transmit and receive. the device?s dma engine will bus-master packets from host memory to device local storage, and vice-versa. the bcm57xx?s host bus interface is compliant with pci, pci-x, and pcie standards (depending on the particular bcm57xx product). the rx mac moves packets from the integrated phy into device internal memory. all incoming packets are checked against a set of qos rules and then categorized. when a packet is transmitted, the tx mac moves data from device internal memory to the phy. both flows operate independently of each other in full-duplex mode. on-chip risc processors are provided for running value-added firmware that may be used for custom frame processing. the on-chip riscs operate independently of all the architectural blocks; essentially, riscs are available for the auxiliary processing of data streams. see ?features? on page 11 for typical applications of the chips in the bcm57xx family. figure 20: functional block diagram receive mac rx fifo transmit mac tx fifo statistics rule check memory arbiter frame buffer memory send bd ring boot processor boot rom 16-kb scratchpad memory tx processor 16-kb scratchpad memory frame buffer manager queue memory read dma read fifo write dma write fifo registers ssram control ssram interface pci/pci-x / pcie bu s ring controllers host coalescing queue management receive gmii transmit gmii led control pll led signals 125-mhz clock receive bd ring dma descriptor config eeprom control nvram interface physical layer transceiver (not applicable to the bcm5700) system management control (bcm5701 only) smbus pci/ pci-x/ pcie www.datasheet.in bcm57xx programmer?s guide 01/29/08 broadcom corporation page 50 receive data path document 57xx-pg105-r r eceive d ata p ath rx e ngine the receive engine (see the following figure) activates whenever a packet arrives from the phy. figure 21: receive data path the receive engine performs the following four functions: ? moves the data from the phy to an internal fifo ? moves the data from the fifo to nic internal memory ? classifies the frame and checks it for rules matches ? performs the offloaded checksum calculations rx engine rules checker rx fifo frame buffers empty bd empty bd empty bd list placement selector lists nic rx producer rings mini std jumbo host rx return rings full bd list initiator 1 2 3 4 mini std mini jumbo jumbo mini std mini jumbo jumbo mini std mini jumbo jumbo mini std mini jumbo jumbo 1 2 3 4 priority selector host rx producer ring - jumbo dma dma www.datasheet.in programmer?s guide bcm57xx 01/29/08 broadcom corporation document 57xx-pg105-r receive data path page 51 rx fifo the rx fifo provides elasticity while data is read from phy transceiver and written into internal memory. there are no programmable settings for the rx fifo. this fifo?s operation is completely transparent to host software. r ules c hecker the rules checker will examine frames. once a frame has been examined, the appropriate classification bits are set in the buffer descriptor. the rules checker is part of the rx data path and the frames are classified during data movement to nic memory. the following frame positions may be established by the rules checker: ? ip header start pointer ? tcp/udp header start pointer ? data start pointer rx l ist p lacement the rx list placement function determines one of the 16 receive lists the frame should be placed on. then, the rx list placement block adds the frame to the appropriate list. the selection is done based on a class value in the frame descriptor. there are no configuration registers for this block beyond the mode control register (see ?mode control register (offset 0x6800)? on page 502 ). the bcm5705, bcm5788, bcm5721, bcm5751, bcm5714c, bcm5714s, bcm5715c, bcm5715s, and bcm5752 macs have only one receive list and hence all the received frames that are not discarded by rules checker are placed into this single receive list. rx l ist i nitiator the rx list initiator function activates whenever the receive producer index for any of receive buffer descriptor (bd) rings is written. this value is located in one of the receive bd producer mailboxes. the host software writes to the producer mailbox and causes the rx initiator function to enqueue an internal data structure/request, which initiates the dma of one or more new bds to the nic. the actual dmas generated depend on the comparison of the value of the received bd host producer index mailbox, the nic?s copy of the received bd consumer index, and the local copy of the received bd producer index. the rx list initiator will select the bd from either mini or standard or jumbo ring based on frame size. note that mini ring is supported only in bcm5700 mac device. also note that the jumbo ring is not supported in bcm5705, bcm5788, bcm5721, bcm5751, bcm5714c, bcm5714s, bcm5715c, bcm5715s, and bcm5752 macs www.datasheet.in bcm57xx programmer?s guide 01/29/08 broadcom corporation page 52 transmit data path document 57xx-pg105-r t ransmit d ata p ath tx mac the read dma engine moves packets from host memory and then into internal nic memory (see figure 22 ). once the entire packet is available, the transmit mac will be activated. figure 22: transmit data path the transmit mac is responsible for the following functions: ? moving data from nic internal memory into tx fifo ? moving data from tx fifo to phy ? checksum substitutions (not calculation) ? updating statistics tx mac consumer index update tx fifo send bd send bd send bd nic send producer rings ring1 ring2 ... select send bd from nic send rings (sbds) priority ring selector host send producer rings dma send bd ring16 dma tx data tx data tx data tx data tx data tx data tx data tx data buffer0 buffer1 buffer2 buffer3 buffer4 buffer5 www.datasheet.in programmer?s guide bcm57xx 01/29/08 broadcom corporation document 57xx-pg105-r dma read page 53 tx fifo the tx fifo provides elasticity, while data is moved from device internal memory to phy. there are no programmable settings for the tx fifo. this fifo?s operation is completely transparent to host software. tx p riority r ing s elector the tx priority ring selector chooses a send bd ring in accordance with a priority level. for the 16 send rings, ring 1 has the highest priority and ring 16 has the lowest priority. all buffer descriptors required to complete a single frame are consumed. at no time are portions of frames intermixed?only the buffer descriptor(s) associated with one frame are consumed. the bcm5705, bcm5788, bcm5721, bc m5751, bcm5714c, bcm5714s, bcm5715c, bcm5715s, and bcm5752 macs have only one send ring. dma r ead r ead e ngine the dma read engine (see the following figure) activates whenever a host read is initiated by the send or receive data paths. figure 23: dma read engine the dma read engine dequeues an internal data structure/request and performs the following functions: ? dmas the data from the host memory to an internal read dma fifo ? moves the data from the read dma fifo to nic internal memory ? classifies the frame ? performs checksum calculations ? copies the vlan tag field from the dma descriptor to the frame header text text dma bd packet#1 host send buffer descriptors packet data #1 host send buffer memory buffer manager bd packet#1 frame classify & checksum calculation text packet data #1 frame header #1 nic bd memory nic buffer memory tx fifo frame mod tx mac statistics tx pcs tx rmii tx gmii tx io 64 16 read fifo www.datasheet.in bcm57xx programmer?s guide 01/29/08 broadcom corporation page 54 dma write document 57xx-pg105-r r ead fifo the read fifo provides elasticity during data movement from host memory to device local memory. the bcm57xx memory arbiter is a gatekeeper for multiple internal blocks; several portions of the architecture may simultaneously request internal memory. the pci read fifo provides a small buffer for the data read from host memory while the read dma engine requests internal memory via the memory arbiter. the data is moved out of the read dma fifo into device local memory once a memory data path is available. the fifo isolates the pci clock domain from the device clock domain. this reduces latency internally and externally on the pci bus. the pci read dma fifo holds 512 bytes. the operation of the read dma fifo is transparent to host software. b uffer m anager the buffer manager maintains pools of internal memory used by transmit and receive engines. the buffer manager has logic blocks for allocation, free, control, and initialization of internal memory pools. the dma read engine requests internal memory for bds and frame data. figure 23 on page 53 shows the transmit data path using the dma read engine. the read dma engine will also fetch rx bds for the receive data path. dma w rite w rite e ngine the dma write engine (see the following figure) activates whenever a host write is initiated by the send or receive data paths. figure 24: dma write engine text rx pcs rx rmii rx gmii rx io rx mac frame mod wol filter rx fifo power management frame header #1 packet data #1 frame cracker checksum calculation rules checker statistics bd packet #1 nic bd memory nic buffermemory buffer manager dma packet data #1 bd packet #1 host receive buffe r descriptor ring host receive buffe r memory write fifo www.datasheet.in programmer?s guide bcm57xx 01/29/08 broadcom corporation document 57xx-pg105-r dma write page 55 the dma write engine dequeues an internal request and performs the following functions: ? gathers the data from device internal memory into the write dma fifo ? dmas the data to the host memory from the write fifo ? performs byte and word swapping ? interrupts the host using a line or message signaled interrupt w rite fifo the write fifo provides elasticity during data movement from device memory to the host memory. the write fifo absorbs small delays created by pci/pci-x/pcie bus arbitration. multiple devices may be granted pci bus cycles during a write dma operation. the bcm57xx family uses the write fifo to buffer data, so internal memory arbitration is efficient. additionally, the fifo isolates the pci clock domain from the device?s clock domain. this reduces latency on the pci bus during the write operation (wait states are not inserted while data is fetched from internal memory). the pci write dma fifo holds 512 bytes. the operation of the write dma fifo is transparent to host software. b uffer m anager the buffer manager maintains pools of internal memory used in transmit and receive functions. the buffer manager has logic blocks for allocation, free, control, and initialization of internal memory pools. the receive mac is given higher priority ove r the transmit mac internally; it is very costly to drop received packets. whereas, the transmit mac may be stalled temporarily until internal buffers become available. the receive mac will request nic memory so inbound frames can be buffered. the dma write engine requests a small amount of internal memory for dma and interrupt operations. the usage of this internal memory is transparent to host software, and does not affect device/system performance. www.datasheet.in bcm57xx programmer?s guide 01/29/08 broadcom corporation page 56 system management bus (not applicable to bcm5700) document 57xx-pg105-r s ystem m anagement b us (n ot a pplicable to bcm5700) figure 25 shows the architecture of the smbus and the location of the asf in the system. figure 25: asf system architecture processor local bus/front side pci bus nic bcm5701 (asf enabled) legacy alert devices alert asf devices remote control devices r pullup r pullup vbus smb_clock pin smbclk smbdat smb_data pin filter rj45 cat5 memory bus host pci bridge smbus controller pci/isa bridge memory (sdram) host cpu isa bus "north bridge " "sourth bridge" 4 rx/tx pairs asf system architecture www.datasheet.in programmer?s guide bcm57xx 01/29/08 broadcom corporation document 57xx-pg105-r system management bus (not applicable to bcm5700) page 57 o verview the system management block of the bcm57xx mac transceivers contains all of the hardware necessary to support a primarily firmware implementation of the asf protocol. this hardware includes six dedicated timers, a low-level smbus 2.0 compliant interface, registers for driving the smbus interface, and a global control and event register. the system management block can also be used to support additional (non-asf) management technologies such as ipmi. t imers the system management block contains five countdown timers that stop when they reach zero and one free-running timestamp counter. the countdown timers all have a corresponding event bit in the control and event register. the event bit is set when the counters transition from a value of one to a value of zero. the timestamp counter starts when its enable bit is set in the control register and rolls over when it reaches its maximum value. smb us interface the smbus interface provides a serial interface for byte-wide words and allows the firmware to directly control the operation of the bus. the smb enable bit (bit 12) in the asf control register (see ?asf control register (offset 0x6c00)? on page 522 ) enables the interface. the interface is capable of master and slave modes of operation. a master operation is initiated by writing the first byte of data to the smb output register (see ?smbus output register (offset 0x6c08)? on page 524 ), along with a start bit, a rdy bit, and any other desired control bits for that transaction. subsequent data bytes to be transmitted are then written to the same register with the rdy bit set. for the last transmit byte, the last bit and rdy bit are set. the transmit bytes are transferred from the smb output register to an internal fifo whenever there is space, and the rdy bit is cleared when this transfer takes place. therefore, the rdy bit is used to determine if there is space to write the next transmit byte. the start bit is cleared by the hardware when the transmit portion of the transfer is finished. at the same time, the status of the trans mit portion of the transfer is provided in the status field. the transmit portion of the transfer could end at any time due to arbitration loss, no-ack from the target, or assorted error conditions. if the transfer is a read transaction, then the read data can now be retrieved from the smb input register. the data field of this register is valid when the rdy bit is set. the input portion of the smbus interface also has an internal fif o, and data is transferred from this fifo to the smb input register (see ?smbus input register (offset 0x6c04)? on page 524 ) automatically whenever the rdy bit is clear. if the smb autor ead bit (bit 15) of the asf control register is set, then the rdy bit is cleared whenever the smb input register is read, thus allowing the next data byte to be loaded. the smb input register has a done bit that is set when the receive portion of the transfer is completed. a status field is also provided when the done bit is set. the done bit must be cleared by firmware after the status is retrieved. also, the firmware must flush all of the data out of the fifo. a slave mode operation starts whenever the smbus interface detec ts activity on the bus, or if a master operation loses arbitration during the first byte of the transfer. the interface does address filtering on the incoming data by looking at the first byte of the transfer (if the smb addr filter bit is set in the asf control register). the address is compared to two different fields in the asf control register, and to the value 0x00 if the smb enable addr zero bit is set. if an address match is found, then the interface acknowledges the incoming byte, and transfers the byte to the input fifo. the rdy and done bits in the smb input register behave in this mode basically the same as with master reads. if the slave access calls for read data, then the firmware would send data to the interface via the smb output register in a manner similar to master-write accesses. a bit-bang mode for this interface is also provided. to enable this mode, set the smb bit bang enable bit in the asf control register and clear the smb enable bit. control of the bus is accomplished by directly manipulating the smb bit bang bits in the smb output register as defined in the register definition. www.datasheet.in bcm57xx programmer?s guide 01/29/08 broadcom corporation page 58 system management bus (not applicable to bcm5700) document 57xx-pg105-r smbus connector the smbus signals were added to the pci physical connector with a pci v2.2 engineering change notification (ecn) titled addition of the smbus to the pci connector . prior to this ecn, network card vendors used a two-pin header and twisted management cable. this solution complicated installation and increased manufacturing costs. two pins previously marked reserved on the pci connector side-a have now been allocated for smbus signaling. pin #40 on pci side-a is now defined as the smbclk signal. pin #41 on pci side-a is now defined as the smbdata signal. these smbus signals are defined in both a 3.3v and 5.0v pci signaling application. the smbus signals are exempt from a few requirements regarding loading and pull-ups, and the programmer is encouraged to read the ecn on the pci siig website. the bcm57xx mac- transceiver?s smbus interface meets the high power requirements stated in the smbus 2.2 specification. smbus data link the bcm57xx mac transceiver?s smbus interface is compli ant with the smbus 2.0 specification. each transaction contains a start and stop delimiter. the smbus interface is very similar to i 2 c with a few differences. for example, smbus masters may enumerate the bus and begin a device address resolution; should two devices have a conflicting address. a start delimiter is detected when the smbclk is sampled high and the smbdata signal transitions from high to low. a stop delimiter is detected when the smbclk is sampled high and the smbdata signal transitions from low to high. see figure 26 . figure 26: smbus start and stop conditions a smbus transactions consist of several phases. a smbus master will start a transaction by driving smbdata low and keeping smbclk high?a start condition. if two masters are dr iving the smbus simultaneously, the masters must arbitrate for the bus. the programmer is encouraged to read section 4.3.2 in the smbus 2.0 specification. the master that drives smbdata high, yet detects smbdata driven low (contention condition) by a second master, loses bus arbitration. the arbitration may continue into the address/data phases and past the start condition. both masters may drive the bus low simultaneously for an indeterminate number of clocks until one master senses bus contention. see figure 27 on page 59 . next, a master must transmit the slave address?the target devices, which decode the read/write transaction. there are reserved slave addresses that should not be used by any smbus devices. the programmer is encouraged to look at table 4 in section 5.2 of the smbus 2.0 specification. after the slave address is driven on the bus, the master will indicate whether the transaction is a read or write. the slave device drives an ack or nak on the smbdata line for the transaction phase. the master will sample the ack or nak accordingly. if the master does sample a nak, then a stop condition must be generated. the master must stop/terminate the transaction. see figure 28 on page 59 . ... ... s mbdata smbclk smbclk sampled high smbclk sampled high smbdata low to high transitio n smbdata high to low transition start stop www.datasheet.in programmer?s guide bcm57xx 01/29/08 broadcom corporation document 57xx-pg105-r system management bus (not applicable to bcm5700) page 59 figure 27: two masters arbitrate for smbus figure 28: master stops transaction after slave naks depending on the type of transaction, the master sources the data byte on the smbdata lines: ? write transactions: the master sources the data byte and the slave sinks/latches the data. the slave must ack/nak write transactions. ? read transactions: the slave sources the data byte and the master sinks/latches the data. the master must ack/nak read transactions. also, the master must drive the stop delimiter, which releases the smbus and terminates the transaction. smbdata (master1) smbclk smbdata float high by master1 start smbdata sampled low by master1 (master1 backs off smbus) s mbdata (master2) both masters sample smbdata high (both masters continue) master1 quiesces ? arbitration los s master2 continues transaction smbdata smbclk slave device nak ( sampled high by master) smbclk sampled high stop smbdata low to high transitio n www.datasheet.in bcm57xx programmer?s guide 01/29/08 broadcom corporation page 60 system management bus (not applicable to bcm5700) document 57xx-pg105-r figure 29: smbus transaction phases smbus clock the bcm57xx smbus interface supports clock stretching. slave devices may clock low to extend the smb_clk signal, and the bcm57xx family absorbs the stretch latency. the programmer should refer to section 4.3.3 of the smbus 2.0 manual for further details on this technology. the bcm57xx will maintain a minimum compliant frequency of 10 khz when clock is low extending. the bcm57xx family?s clock period (master mode) is 11 s?a 90.9 khz frequency. the smb_clk signal is driven low t low for 5 s. the bcm57xx family floats the smb_clk high t high for a maximum of 6 s before the smb_clk is driven low again. the low and high times are not guaranteed symmetric, since the rise may vary due to external pull-up resistors or current sources. the rise time t r on smb_clk will vary from 300 ns to 1 s. the fall time t f is roughly 500 ns, but also may vary. see the following figure. figure 30: smb_clock period (master mode) e vents the smb attention bit and the five timeout bits in the asf control register are all ored together to form a single asf_attn signal. depending on the value of the asf attention location field, this signal may then be mapped into one of several bit positions in the rx cpu event or tx cpu event registers. start condition slave address read/write acknowledge stop conditio n 1 2 3 4 5 7 02 810 18 data byte acknowledge 6 20 s mb_clk 300 ns?1 s t r t f 500 ns t high,max t low 5 s 6 s www.datasheet.in programmer?s guide bcm57xx 01/29/08 broadcom corporation document 57xx-pg105-r led control page 61 o ther asf a ctions most of the asf required actions other than those described above are to be handled by the firmware in the chips internal riscs. one exception to this would be detection of the incoming rmcp packets, which would be handled by programming the appropriate rules into the mac receive rule checker. led c ontrol the bcm57xx family supports four leds?one for data tra ffic in either direction and three for 10/100/1000 mbps links established. the traffic led blinks dur ing transmit and receive data movement through the device. the blink rate is programmable with a default of approximately 15 hz. the link leds turn either on or off depending on the link established. all leds can be controlled directly by software via the override bits in led_control register (see ?led control register (offset 0x40c)? on page 382 ). when the override bit is off, the link leds are automatically set by the hardware as long as link is up: ? 10 mbps led?port mode is set to mii and mode 10 mbps in mi status register is set. ? 100 mbps led?port mode is set to mii and mode 10 mbps in mi status register is not set. ? 1000 mbps led?port mode is set to gmii or tbi. the link status information is obtained either from auto-polling the phy if bit 4 (port polling) of mi mode register (see ?mi mode register (offset 0x454)? on page 389 ) is set, or from the lnkrdy input pin if this bit is not set. the polarity of the lnkrdy signal can be toggled by setting bit 10 (link polarity) in the ethernet_mac_mode register (see ?ethernet mac mode register (offset 0x400)? on page 377 ). m emory a rbiter the memory arbiter (ma) is a gatekeeper for internal memory access. the ma is responsible for decoding the internal memory addresses that correspond to bcm57xx data structures and control maps. the ma is responsible for accessing both internal and external ssram. should a functional block fault or trap during access to internal/external memory, the ma will handle the failing condition and report the error in a status register. in addition to architectural blocks, the ma provid es a gateway for the risc processors to access local memory. each risc has a ma interface that pipelines up to three access requests. the ma negotiates local memory access, so all portions of the architecture are provided with fair access to memory resources. the ma prevents starvation and bounds access latency. host software may enable/disable/reset the ma, and there are no tunable parameters. www.datasheet.in bcm57xx programmer?s guide 01/29/08 broadcom corporation page 62 host coalescing document 57xx-pg105-r h ost c oalescing h ost c oalescing e ngine the host coalescing engine is responsible for pacing the rate at which the nic updates the send and receive ring indices located in host memory space. the completion of a nic update is reflected through an interrupt on the bcm57xx inta pin or a message signalled interrupt (msi). although update criteria are calculated separately, all updates occur at once. this is because all of the ring indices are in one status block, and any host update updates all ring indices simultaneously. the host coalescing engine will trigger based on a tick and/or a frame counter. figure 31: host coalescing engine ... dma write engine status block pci interface buffer manager host coalescing engine msi mailbox i/o driver host interrupt controlle r irq write fifo tick counter bd counter status memory host software may configure line irq or msi msi fifo www.datasheet.in programmer?s guide bcm57xx 01/29/08 broadcom corporation document 57xx-pg105-r host coalescing page 63 a host update occurs whenever one of the following criteria is met: ? the number of bds consumed for frames received, without updating receive indices on the host, is equal to or has exceeded the threshold set in the receive_max_coalesced_bd register (see ?receive max coalesced bd count (offset 0x3c10)? on page 454 ). ? the number of bds consumed for transmitting frames, without updating the send indices, on the host is equal to or has exceeded the threshold set in the send_max_coalesced_bd register (see ?send max coalesced bd count (offset 0x3c14)? on page 454 ). updates can occur when the number of bds ( not frames) meets the thresholds set in the various coalescing registers (see section 11: ?interrupt processing? on page 287 for more information). ? the receive coalescing timer has expired, and new frames have been received on any of the receive rings, and a host update has not occurred. the receive coalescing timer is then reset to the value in the receive_coalescing_ticks register (see ?receive coalescing ticks registers (offset 0x3c08)? on page 453 ). ? the send coalescing timer has expired, and new frames have been consumed from any send ring, and a host update has not occurred. the send coalescing timer is then reset to the value. msi fifo this fifo is eight entries deep and four bits wide. this fifo is used to send msis via the pci interface. the host coalescing engine uses this fifo to enqueue requests for the generation of msi. there are no configurable options for this fifo and this fifos operation is completely transparent to host software. s tatus b lock this data structure contains consumer and producer indices/values. host software reads this control block, to assess hardware updates in the send and receive rings. two copies of the status block exist. the local copy is dmaed to host memory by the dma write engine. host software does not want to generate pci transactions to read ring status; rather quicker memory bus transactions are desired. the host coalescing engine will enqueue a request to the dma write engine, so host software gets a refreshed copy of status. the status block is refreshed before a line irq or msi is generated. see ?status block format? on page 104 for a complete discussion of the status block. www.datasheet.in bcm57xx programmer?s guide 01/29/08 broadcom corporation page 64 10/100/1000base-t transceiver (not applicable to bcm5700) document 57xx-pg105-r 10/100/1000base-t t ransceiver (n ot a pplicable to bcm5700) e ncoder in 10base-t mode, manchester encoding is performed on the data stream and transmitted on one pair in the twisted pair cable. the multimode transmit dac performs pre-equalization for 100 meters of cat 3 cable. in 100base-tx mode, the bcm57xx mac-transceivers transmit a continuous data str eam on one pair in the twisted-pair cable, and receive a continuous data stream on another pair. the mac provides nibble-wide (4-bit) data which is encoded into 5-bit code groups and inserted into the transmit data stream. the transmit packet is encapsulated by replacing the first two preamble nibbles with a start of stream delimiter (ssd) (/j/k codes) and appending an end of stream delimiter (/t/r codes) to the end of the packet. when the mac indicates a transmit error, the transmit error code group (/h) is sent in place of the corresponding data code-group. the transmitter repeatedly sends the idle code-group between packets. the encoded data stream is serialized and then scrambled by the stream cipher block, as described later in this document. the scrambled data is then encoded into mlt3 signal levels. in 1000base-t mode, the bcm57xx mac transceivers simultaneously transmit and receive a continuous data stream on all four twisted pairs in the cat 5 cable. when a packet is pending transmission from the mac, byte-wide data from the mac is scrambled, trellis encoded into a four-dimensional code-group (a pam5 symbol on each of the four twisted pairs), and inserted into the transmit data stream. the transmit packet is encapsulated by replacing the first two bytes of preamble with a start-of-stream delimiter and appending an end-of-stream delimiter to the end of the packet. when the mac indicates a transmit error during a packet, a transmit error code-group is sent in place of the corresponding data code-group. the transmitter sends idle code-groups or carrier extend code-groups between packets. carrier extension is used by the mac to separate packets within a multiple packet burst. carrier extend error is indicated by replacing the transmit data input with 1fh during carrier extension. d ecoder in 10base-t mode, manchester decoding is performed on the data stream. in 100base-tx mode, the receive data stream, following equalization and clock recovery, is converted from mlt3 to serial nrz data. the nrz data is descrambled by the stream cipher block, as described later in this document. the descrambled data is then deserialized and aligned into 5-bit code-groups. the 5-bit code-groups are decoded into 4-bit data nibbles. the start-of-stream delimiter is replaced with preamble nibbles, and the end of stream delimiter and idle codes are replaced with 0h. the decoded data is provided to the mac. when an invalid code-group is detected in the data stream, the bcm57xx mac transceivers indicate a receive error to the mac. the receive error signal also asserts when the lin k fails, or when the descrambler loses lock during packet reception. in 1000base-t mode, the receive data stream passes through a viterbi decoder and descrambler and is translated back into byte wide data. the start of stream delimiter is replaced with preamble bytes and the end of stream delimiter and idle codes are replaced with 00h. carrier extend codes are replaced with 0fh or 1fh. the decoded data is provided to the mac. when an invalid code-group is detected in the data stream, the bcm57xx mac transceivers send an error condition to the mac. the device also indicates receive error when receiving carrier extend code-groups, or when the local receiver status becomes unreliable during packet reception. www.datasheet.in programmer?s guide bcm57xx 01/29/08 broadcom corporation document 57xx-pg105-r 10/100/1000base-t transceiver (not applicable to bcm5700) page 65 c arrier s ense in 10base-t mode, carrier sense is recognized when valid preamble activity is detected on the trd input pins. for 100/1000base-t operation, carrier sense is recognized as soon as activity is detected in the receive data stream. data valid is recognized as soon as a valid ssd is detected. the end of the valid data is detected by the end of stream delimiter or two consecutive idle code-groups in the receive data stream. if activity is detected and a valid ssd is not detected immediately, the packet will be received with an error indication. l ink m onitor in 10base-t mode, a link-pulse detection circuit constantly monitors the trd pins for the presence of valid link pulses. in 100base-tx mode, receive signal energy is detected by monitoring the receive pair for transitions in the signal level. signal levels are qualified using squelch detect circuits. when no signal is detected on the receive pair, the link monitor enters the link fail state, and transmission and reception of data packets is disabled. when a valid signal is detected on the receive pair for a minimum of one millisecond, the link moni tor enters the link pass state, and the transmit and receive functions are enabled. in 1000base-t mode, following auto-negotiation, the master tr ansceiver begins sending data on the twisted-pair link. when the slave transceiver has recovered the master?s timing, it also begins transmitting. each end of the link continuously monitors its local receiver status. when the local receiver status has been ok for at least 1 s, the link monitor enters the link pass state, and transmission and reception of data packets is enabled. when the local receiver status is not ok, and remains so for 750 ms, the link monitor enters the link fail state, and transmission and reception of data packets are disabled. d igital a daptive e qualizer the digital adaptive equalizer removes intersymbol interference created by the transmission channel media. the equalizer accepts sampled unequalized data from the adc on each c hannel and produces equalized data. the bcm57xx mac- transceivers achieve an optimum signal-to-noise ratio by us ing a combination of feed forward equalization (ffe) and decision feedback equalization (dfe). this powerful technique achieves a ber of less than 1 x 10 -12 for transmission up to 100 meters on cat 5 twisted-pair cable (100 meters on cat 3 for 10base-t), even in harsh noise environments. the all-digital nature of the design makes the performance very toler ant to chip noise. the filter coefficients are self-adapting t o any quality of cable or cable length. e cho c anceller because of the bidirectional nature of the channel in 1000base-t, an echo impairment is caused by each transmitter. the echo canceller removes the transmitted signal impairment from the incoming receive signals. the output of the echo filter is added to the ffe output to cancel the echo impairment. the echo canceller coefficients are self-adapting to manage the varying echo impulse responses caused by different channels, transmitters, and environmental conditions. www.datasheet.in bcm57xx programmer?s guide 01/29/08 broadcom corporation page 66 10/100/1000base-t transceiver (not applicable to bcm5700) document 57xx-pg105-r c rosstalk c ancellers because the bcm57xx mac transceivers transmit and receive a continuous data stream on all four twisted-pair strands, the symbols sent by the other three local transmitters cause impairments on the received signal for each channel through near-end-crosstalk (next) mechanism between the pairs. because each receiver has access to the data for the other three pairs that cause this interference, it is possible to cancel the effect. this is accomplished with three adaptive next cancelli ng filters. the outputs of these filters are added to the ffe output to cancel the next impairment. a nalog - to -d igital c onverter each receive channel has its own 125-mhz analog-to-digital converter (adc). the adc samples the incoming data on the receive channel and feeds the output to the digital adaptive equalizer. advanced analog circuit techniques achieve low offset, high-power supply noise rejection, fast settling time, and low bit-error rate. c lock r ecovery /g enerator the clock recovery and generator block creates the 125-mhz transmit and receive clocks for 1000base-t, 100base-tx, and 10base-t operation. in 10base-t or 100base-tx mode, the transmit clock is locked to the 25-mhz crystal input, and the receive clock is locked to the incoming data stream. in 1000base-t mode, the two ends of the link perform loop timing. one end of the link is configured as the master and the other end as the slave. the master transmit and receive clocks are locked to the 25-mhz crystal input. the slave transmit and receive clocks are locked to the incoming receive data stream. loop timing allows for cancellation of echo and next impairments by insuring that the transmitter and receiver at each end of the link are operating at the same frequency. the phase relationship between the transmit and receive clocks is determined by the round-trip delay of the loop. the bcm57xx mac transceiver timing recovery circuits track any changes in the relative transmit and receive phases caused by timing jitter. b aseline w ander c orrection the 1000base-t and the 100base-tx data streams are not always dc-balanced. because the receive signal must pass through a transformer, the dc offset of the differential receive input can wander. this effect, known as baseline wander, can greatly reduce the noise immunity of the receiver. the bcm57xx mac transceivers automatically compensate for baseline wander by removing the dc offset from the input signal and thereby significantly reducing the probability of a receive symbol error. in 10base-t mode, baseline wander correction is not perform ed because the manchester coding provides perfect dc balance. m ultimode tx dac the multimode transmit digital-to-analog converter (dac) transmits pam5, mlt3, and manchester coded symbols. the transmit dac performs signal wave shaping, which decreases the unwanted high-frequency signal components, thus reducing emi. the transmit dac utilizes a current drive output which is well-balanced and produces very low noise transmit signals. www.datasheet.in programmer?s guide bcm57xx 01/29/08 broadcom corporation document 57xx-pg105-r 10/100/1000base-t transceiver (not applicable to bcm5700) page 67 s tream c ipher in 1000base-t and 100base-tx modes, the transmit data stream is scrambled to reduce radiated emissions and to ensure that there is no correlation between symbols in the data stream. the 1000base-t scrambler also ensures that there is no correlation between symbols on the four different wire pairs, and that there is no correlation between symbols in the transmit and receive data streams. the scrambler reduces peak emissions by randomly spreading the signal energy over the transmit frequency range and eliminating peaks at certain frequencies. the randomization of the data stream also assists the digital adaptive equalizers and echo/crosstalk cancellers. the adaptive algo rithms in these circuits require that there to be no sequential or cross-channel correlation between symbols in the various data streams. in 100base-tx mode, the transmit data stream is scrambled by exclusive oring the encoded serial data stream with the output of an 11-bit wide linear feedback shift register (lfsr), which produces a 2047-bit non-repeating sequence. in 1000base-t mode, the gmii transmit data is scrambled by exclusive-oring the input data byte with an 8-bit wide cipher text word. the cipher text word is generated each symbol period from eight uncorrelated maximal length data sequences, which are produced by linear remappings of the output of a 33-bit wide lfsr. the scrambled data bytes are encoded, and then the sign of each transmitted symbol is again randomized by a 4-bit wide cipher text word, which is generated in the same manner as the 8-bit word. the master and slave transmitters use different scrambler sequences to generate the cipher text words. the receiver descrambles the incoming data stream by ex clusive-oring it with the same sequence generated at the transmitter. the descrambler detects the state of the transmit lfsr by seeking a sequence representing consecutive idle code-groups. the descrambler locks to the scrambler state after detecting a sufficient number of consecutive idle codes. the bcm57xx mac transceivers only enable transmission and reception of packet data when the descrambler is locked. the receiver continually monitors the input data stream to ensure that it has not lost synchronization by checking that inter- packet gaps containing idles or frame extensions are received at expected intervals. when the bcm57xx mac- transceivers detect loss of synchronization, it notifies the remote phy of the inability to receive packets (1000base-t mode only) and attempt to resynchronize to the received data stream. if the descrambler is unable to resynchronize for a period of 750 ms, the bcm57xx mac transceivers are forced into the link fail state. in 10base-t mode, scrambling is not required to reduce radiated emissions. w ire m ap and p air s kew c orrection during 1000base-t operation, the bcm57xx mac transceivers have the ability to automatically detect and correct some utp cable wiring errors. wiring errors caused by swapping of pairs within the utp cable, as well as polarity errors caused by swapping of the wires within a pair, are detected by the symbol decoder and compensated for internally to the bcm57xx mac transceivers. the bcm57xx mac transceivers also automatically compensate for differences in the arrival times of symbols on the four pairs of the utp cable. the varying arrival times are caused by differing propagation delays (commonly referred to as delay skew) between the wire pairs. the bcm57xx mac transceivers can tolerate delay skews up to 120 ns. during 10/100 operation, pair swaps are corrected. delay skew is not an issue because only one pair is used in each direction. www.datasheet.in bcm57xx programmer?s guide 01/29/08 broadcom corporation page 68 10/100/1000base-t transceiver (not applicable to bcm5700) document 57xx-pg105-r a uto -n egotiation the bcm57xx mac transceivers negotiate its mode of operation over the twisted-pair link using the auto-negotiation mechanism defined in the ieee 802.3u and 802.3ab specific ations. auto-negotiation can be enabled or disabled by hardware or software control. when the auto-negotiation function is enabled, the bcm57xx mac transceivers automatically choose the mode of operation by advertising its abilities and comparing them with those received from its link partner. the bcm57xx mac transceivers can be configured to advertise 1000base-t full-duplex and/or half-duplex, 100base-tx full-duplex and/or half-duplex, and 10base-t full-duplex and/or half-duplex. the transceiver negotiates with its link partner and chooses the highest operating speed. auto-negotiation can be disabled for testing or for 100base-tx or 10base-t operation, but is always required for normal 1000base-t operation. for details on auto-negotiation using next page exchange. a utomatic mdi c rossover during auto-negotiation, one end of the link must perform an mdi crossover so that each transceiver?s transmitter is connected to the other receiver. the bcm57xx mac transce ivers can perform an automatic mdi crossover when the disable automatic mdi crossover bit in the phy extended control register (see ?phy extended control register (phy_addr = 0x1, reg_addr = 10h)? on page 623 ) is disabled, thus eliminating the need for crossover cables or cross-wired (mdix) ports. during auto-negotiation, the bcm57xx mac transceivers normally transmit on trd {0} and receive on trd {1}. when connected to another device that does not perform the mdi crossover, the bcm5701 mac transceiver automatically switches its transmitter to trd {1} and its receiver to trd {0} to communicate with the remote device. if two devices that both have mdi crossover capability are connected, an algorithm determines which end performs the crossover function. during 1000base-t operation, the bcm57xx mac transceivers swap the transmit symbols on pairs 0 and 1 and pairs 2 and 3 if auto-negotiation completes in the mdi crossover state. the 1000base-t receiver automatically detects pair swaps on the receive inputs and aligns the symbols properly within the decoder. w ire s peed wire speed is a mode which controls the auto-negotiation advertising. at startup, all the 100base-t (tx) and 1000base- t (gigabit) modes selected in mii registers 4 and 9 are advertised. if the same hcd fails to link five consecutive times, then the highest ability not already masked out will be masked out. when both tx and gigabit abilities are masked out and the same hcd fails five consecutive times, then all the advertised abilities in mii register 4 and 9 are advertised. whenever tx and gigabit is masked out, then the wire speed down grade is active, indicating that not all the requested advertised abilities are actually advertised to the link partner. when wire speed mode is enabled, the hcd can be determined from mii register 19h bits 10:8 since not all of mii register 4 advertised abilities may be sent to the link partner when down grade is active as shown by a 1 in bit 14 of mii register 11h. note: the 10base-t is always advertised as requested per mii register 4 at all times and is not affected by the wire speed mode. also, the wire speed mode will never ma sk out gigabit or tx abilities unless there are other abilities available to advertise. www.datasheet.in programmer?s guide bcm57xx 01/29/08 broadcom corporation document 57xx-pg105-r phy control page 69 phy c ontrol the bcm57xx family supports three physical layer interfaces: ? the mii is used in conjunction with 10/100 mbps copper ethernet transceivers. ? gmii supports 1000 mbps copper ethernet transceivers. ? the tbi connects to a serializer/deserializer (serdes) for 1000 mbps optical transceivers. mii b lock the mii interconnects the mac and phy sublayers (see the following figure). figure 32: media independent interface rx i/o rxd /4 rx_clk1 rx_er rx_dv tx i/o txd /4 mii_txclk tx_er tx_en media status i/o col crs lnkrdy rx media access mgmnt rx mac rx data decapsulation tx media access mgmnt tx mac tx data encapsulation mac sublayer physical layer rx i/o symbol decoder tx i/o symbol encoder 4-bit data path 2.5 mhz at 10 mbps 25 mhz at 100 mbps 4-bit data path led control led i/o 2.5 mhz at 10 mbps 25 mhz at 100 mbps mii www.datasheet.in bcm57xx programmer?s guide 01/29/08 broadcom corporation page 70 phy control document 57xx-pg105-r the specifics of mii may be located in section 22 of the ieee 802.3 specification. rxd[0..3] are the receive data signals; txd[0..3] are the transmit data signals. mii operates at both 10 mbps and 100 mbps wire-speeds. (gigabit ethernet uses the gmii standard.) when mac and phy are configured for 10 mbps operation, the rx_clk1 and mii_txclk clocks run at 2.5 mhz. both rx_clk1 and mii_txclk are sourced by the phy. 100 mbps wire speed require rx_clk1 and mii_txclk to provide a 25-mhz reference clock. receive data valid (rx_dv) is asserted when valid frame data is received; at any point during data reception, the phy may assert receive error (rx_er) to indicate a receive error. the mac will record this error in the statistics block. the mac may discard a bad rx frame?exception being sniffer/ promiscuous modes (see allow_bad_frames bit in mac mode register). the transmit enable (tx_en) signal is asserted when the mac presents the phy with a valid frame for transmission. the mac may assert tx_er to indicate the remaining portion of frame is bad. the phy will insert bad code symbols into the remaining portion of the frame. a detected collision in half-duplex mode may be such a scenario where tx_er is asserted. the phy will assert col when a collision is detected. the col signal is routed to both the rx and tx macs. the transmit mac will back off transmission and the rx mac will throw away partial frames. the 10 mbps physical layer uses differential manchester encoding on the wire. manchester encoding uses two encoding levels: 0 and 1. 100 mbps ethernet requires mlt-3 waveshaping on the transmission media. mlt-3 uses three encoding levels: -1, 0, and 1. both physical signaling protocols are transparent to the mac sublayer and are digitized by the phy. the phy encodes/decodes analog waveforms at its lower edge while the phy presents digital data at its upper edge (mii). gmii b lock the gmii is full-duplex (see figure 33 on page 71 ); the send and receive data paths operate independently. the transmit signals txd[0..7] create a eight-bit wide data path. the txd[0..7] signals are synchronized to the reference clocktx_clk0. the tx_clk0 clock runs at 125 mhz and is sourced by the mac sublayer. transmit error (tx_er) is asserted by the mac sublayer. the phy will transmit a bad code until tx_er is de-asserted by the mac. tx_er is driven synchronously with tx_clk0. the transmit enable (tx_en) indicates that valid data is presented on the txd lines. the txd[0..7] data is framed on the rising edge of tx_en. the receive data path is also eight bits wide. rxd[0.7] are sourced by the phy. when valid data is presented to the mac sublayer, the phy will also assert receive data valid (rx_dv). the rising edge of rx_dv indicates the beginning of a frame sequence. the phy drives the reference clock rx_clk1, so the mac sublayer can synchronize data sampling on rxd[0..7]. the phy may assert rx_er to indicate frame data is invalid; the mac sublayer must consider frames in progress incomplete. when the mac operates in half-duplex mode, a switch or node may transmit a jamming pattern. the phy will drive the collision (col) signal so the mac may back off transmission and throw away partially received packet(s). the col signal will also cause the tx mac to stop the transmission of a packet. the col signal is not driven for full-duplex operation since collisions are undefined. the phy will drive carrier sense (crs) as a response to traffic being sent/received. the mac sublayer can monitor traffic and subsequently drive traffic le ds. finally, lnkrdy may be driven from the phy?s link leds. the routing of signals from the phy is application specific. the bcm57xx family reference nic routes the phy 10 mbps link signal to the lnkrdy pin on the bcm57xx family. the mac may poll lnkrdy in 10 mbps mode to determine if link is present. www.datasheet.in programmer?s guide bcm57xx 01/29/08 broadcom corporation document 57xx-pg105-r phy control page 71 pulse amplitude modulated symbol (pam5) encoding is leveraged for gigabit ethernet wire transmissions. pam5 uses five encoding levels: -2, -1, 0, 1, and 2. four symbols are transmitted in parallel on the four twisted-wire pairs. the four symbols create a code group (an eight-bit octet). the process of creating the code-group is called 4d-pam5. essentially, eight data bits are represented by four symbols. table 40-1 in the 802.3ab specification shows the data bit to symbol mapping. the code group representation is also referred to as a quartet of quinary symbols {ta, tb, tc, td}. the modulation rate on the wire is measured at 125 mbaud. the resultant bandwidth is calculated by multiplying 125 mhz by eight bits, for 1000 mbps wire speed. figure 33: gmii block rx i/o rxd /8 rx_clk1 rx_er rx_dv tx i/o txd /8 tx_clk0 tx_er tx_en media status i/o col crs lnkrdy rx media access mgmnt rx mac rx data decapsulation tx media access mgmnt tx mac tx data encapsulation mac sublayer physical layer rx i/o symbol decoder led control tx i/o symbol encoder 125-mhz ref clock 8-bit data path led i/o 8-bit data path 125-mhz ref clock gmii www.datasheet.in bcm57xx programmer?s guide 01/29/08 broadcom corporation page 72 phy control document 57xx-pg105-r tbi b lock the serializer deserializer (serdes) device bridges a parallel tbi to a serial pseudo emitter coupled logic (pecl) interface. gigabit optical transceivers convert multimode/single-mode laser energy to an electrical waveform?a 1.25-ghz pecl signal. the specifics of the gigabit fiber communications can be located in the ieee 802.3z specification. the pecl interface is full-duplex and the clocking is interleaved with data. in figure 34 , tdn represents the pecl transmit interface and rdn represents the pecl receive interface. again, tdn and rdn are 1.25-ghz serial pecl streams. the serdes device converts both tdn and rdn signals to the parallel tbi signals txd[0..9] and rxd[0..9]. tbi is commonly called 8b/10b encoding. tbi does not embed clocking in the data streams; rather transmit and receive data streams are synchronized with clocking signals?tx_clk0, rx_clk0, and rx_clk1. the transmit clock tx_clk0 runs at 125 mhz and is asymmetric to the receive clocking. the receive clocking mechanism is slightly different from the transmit side?two 62.5-mhz clocks are required. rx_clk0 runs at 62.5 mhz and is 180 degrees out of phase from the 62.5 rx_clk1 signal. the receive/transmit data paths are 10 bits wide, with a 125 mhz data transfer rate. the resultant bandwidth of each connection is 1.25 ghz. the rxd and txd connections are full-duplex. figure 34: tbi block serdes mac optical transciever tdn rdn txd /10 tx_clk0 rxd /10 rx_clk0 rx_clk1 10-bit data pa th 125-mhz clock 10-bit data path 62.5-mhz differential clock 62.5-mhz differential clock tbi www.datasheet.in programmer?s guide bcm57xx 01/29/08 broadcom corporation document 57xx-pg105-r phy control page 73 mdio r egister i nterface the following figure shows the mdi register interface. figure 35: mdi register interface management data clock the management data clock (mdc) is driven by the mac sublayer. the phy will sink this signal to synchronize data transfer on the mdio signal?mdc is a reference clock. this clock is not functionally associated to either rx_clk or tx_clk. the minimum period for this clock is 400 ns with high and low times having 160 ns duration. management data input/output the management data input/output (mdio) signal passes control and status data, between the mac and phy sublayers. mdio is a bidirectional signal, meaning both the phy and mac may transfer data. the mac typically transfers control information and polls status; whereas, the phy transfers status back to the mac, using mdio. management data interrupt the broadcom phy (i.e., bcm5401) may be programmed to generate interrupts. a phy status change initiates a management data interrupt (mdint). a mdi mask register allows host software to selectively enable/disable status types, which cause mdint notification. the phy will assert intr until software clears the interrupt. reading the status register will clear the interrupt. management register block the layout and configuration of mdi register block is device dependent. the mdi register block is the control/status access point, which host software may read/write. the ieee 802.3 specification defines a basic register block for mii and gmii; the basic register set contains control and status registers. gm ii also exposes an extended register set, used in 1000 mbps configuration/status. refer to the specific phy for details on the register layout (refer to the bcm5401 data sheet). the fundamentally point is to understand that the mdc and mdio signals are used to access the mdi register block. mac sublayer mgmnt i/o mgmnt control (mii & gmii) physical layer mgmnt i/o mgmnt control mdc mdio mdint mdi register block www.datasheet.in bcm57xx programmer?s guide 01/29/08 broadcom corporation page 74 universal management port (applicable to bcm5714c/bcm5714s/bcm5715c/b cm5715s only) document 57xx- u niversal m anagement p ort (a pplicable to bcm5714c/ bcm5714s/bcm5715c/bcm5715s o nly ) the bcm5714c/bcm5714s/bcm5715c/bcm5715s devices support a ump interface that allows devices such as the baseboard management controller (bmc) to send and rece ive system management information through the gigabit ethernet ports. this eliminates the need for a dedicated ethernet port and reduces system cost. the ump interface is a simple mii/rmii ethernet connection which always runs in full-duplex 100 mbit mode and uses pause frames to support flow control between the ump nodule and the baseboard management controller (bmc). the bcm5714 supports two umps which share the same physical interface to an external device such as a bmc. the ump interface on the bcm5714 functions similarly to a mii or a reduced mii (rmii), but does not support the same number of pins as in either interface. unless stated otherwise, the mii/rmii mentioned throughout this section refer to the ump interface unique to the bcm5714, not the standard mii/rmii commonly seen in a mac-to-phy interface. the ump interface is designed to support up to four umps. the ump address is selected by strapping the pwr_ind pin. the bmc addresses individual umps using the two id bits embedded in the control command. the ump passes data packets from the bmc to the ethernet mac for transmission. upon receiving packets addressed to the bmc, the ethernet mac routes the receive packets to the ump, which in turn forwards these packets to the bmc. each ump delivers 20 mbps or more sustained throughput when the physical layer is connected at 1 gbps and 8 mbps or more (typically 20 mbps) when the physical layer is connected at 100 mbps. since the signals from multiple ump devices are hardwired together, the output of the transmit signals are normally open- drained with a weak internal pull down resistor. the transmit signals are only driven when a ump device sends data. the mii contains all the signals required to transmit and re ceive at 100 mbps in full-duplex mode. the transmit signals include txd[3:0], tx_er, tx_en, and tx_clk. the receive signals include rxd[3:0], rx_dv, rx_er, and rx_clk. both tx_clk and rx_clk are clock input signals which operate at a maximum frequency of 25 mhz. the bcm5714c provides a 25-mhz clock signal (ck25), that can be used to drive tx_clk and rx_clk. any other clock frequency will require an external clock source. the rmii provides the same bandwidth as the mii, but uses half the number of pins. the rmii includes seven signals: txd[1:0], tx_en, rxd[1:0], rx_dv, and refclk. the reference clock (refclk) operates at any frequency between 2.5 mhz and 50 mhz. the bcm5714 provides a 25-mhz clock signal (clk25) that can be used to drive refclk. any other clock frequencies will require an external clock source. figure 36 and figure 37 show how two bcm5714cs are connected to one bmc via the mii and rmii. www.datasheet.in programmer?s guide bcm57xx 01/29/08 broadcom corporation document 57xx-pg105-runiversal management port (applicab le to bcm5714c/bcm5714s/bcm5715c/bcm5715s only) page 75 figure 36: ump mii connections between bmc and ump supported bcm57xx devices bmc tx_clk tx_er tx_en txd[3:0] rxd[3:0] rx_er rx_dv rx_clk bcm5714c ck25 tx_clk tx_er tx_en txd[3:0] rxd[3:0] rx_er rx_dv rx_clk bcm5714c (optional) tx_clk rx_er rx_dv rxd[3:0] txd[3:0] tx_er tx_en rx_clk pwr_ind vaux_33v pwr_ind ponreset # ponreset # www.datasheet.in bcm57xx programmer?s guide 01/29/08 broadcom corporation page 76 universal management port (applicable to bcm5714c/bcm5714s/bcm5715c/b cm5715s only) document 57xx- figure 37: ump rmii connections between bmc and ump supported bcm57xx devices bmc tx_en txd[1:0] rxd[1:0] rx_dv refclk bcm5714c ck25 tx_en txd[1:0] rxd[1:0] rx_dv refclk bcm5714c (optional) optional external clock if ck25 is not used tx_en txd[1:0] rxd[1:0] rx_dv refclk pwr_ind pwr_ind vaux_33v ponreset # ponreset # www.datasheet.in programmer?s guide bcm57xx 01/29/08 broadcom corporation document 57xx-pg105-runiversal management port (applicab le to bcm5714c/bcm5714s/bcm5715c/bcm5715s only) page 77 ump r eceive d ata p ath 1. all incoming frames on the ump interface are examined by the ump mac. invalid frames are discarded and valid frames are stored in the ump rx fifo. 2. the ump receive attention is generated to notify the cpu of the received packet. 3. the cpu examines the received packet and takes action if it is the addressee. the action taken depends on the command enclosed in the packet. if it must transfer the packet to the gigabit mac, the succeeding steps occur. 4. the cpu transfers the data into tx mbufs of the gigabit transmit path and writes an entry into gigabit tx mac. 5. the gigabit tx mac processes this entry and sends out the packet on gmii. ump t ransmit d ata p ath 1. the incoming frames on the gigabit interface are stored into rx mbufs. 2. the mac destination address of the received packet is compared with the addresses that are programmed in the ump filter module of the gigabit mac. if a match occurs, then the rdi module generates attention to the cpu. 3. the cpu queries the ump tx module to see if it can accept a new packet. if space is available, then it transfers the packet in to the ump transmit fifo. 4. the ump mac then transmits the frame to the imd through the ump transmit interface. ump p rogramming d etails the ump attention enable register 0x7800 allows us to enable various attentions (enable tx ready event, enable rx ready event,?) from ump module. when any of the enabled events happen, the ump module generates the attention through the ump attention status register 0x7804. the ump firmware which responds to the ump software commands uses the ump registers 0x7810-0x782c. the ump firmware confi gures the ump registers depending upon the configuration commands received from the bmc and maintains the configuration across device resets. refer to the ump specification application note for various ump commands supported by ump firmware. ump f ilter m odule any packet that is received on the gigabit interface and which is not filtered by the l2 address filter logic is examined by th e ump filter block. the function of the ump filter block is to check if the incoming packet matches the ump filter rules programmed by the cpu. if a match occurs, then the ump filter block resets the pass bit in the rdi ftq which results in rdi-ftq attention being generated to the cpu. the two fields in the incoming frame that are checked by the ump filter module are the destination address and vlan-id field. the algorithm that is used to filter the incoming packets and generate the attention to the cpu is described below. ump_rdi_attn = (((incoming_vlan_tag == ump_vlan_tag) && ump_vlan_cmp_en) || ! ump_vlan_cmp_en) && (incoming_mac_da == broadcast_addr && ump_bc_cmp_en) || (incoming_mac_da == ump_mc_addr && ump_mc_cmp_en) || (incoming_mac_da == gig_mac0_addr && mac0_cmp_en) || (incoming_mac_da == gig_mac1_addr && mac1_cmp_en) || (incoming_mac_da == gig_mac2_addr && mac2_cmp_en) || (incoming_mac_da == gig_mac4_addr && mac3_cmp_en); the ump_vlan_tag (register 0x5e8), the ump multicast address (ump_mc_addr, register 0x5d8, mc address mask register is 0x5e4) and the compare enable bits (register 0x5f0) are programmable. www.datasheet.in bcm57xx programmer?s guide 01/29/08 broadcom corporation page 78 universal management port (applicable to bcm5714c/bcm5714s/bcm5715c/b cm5715s only) document 57xx- the ump filter module has the lowest priority between the l2 address filter and the rule checker modules. if the ruler checker and the ump filter modules are programmed to have contradictory rules, then the ump filter output is overridden by the rule checker. for example, if rc is programmed to drop a broadcast frame and ump filter module is programmed to generate an attention for a broadcast frame then the broadcast frame is dropped. similarly, the l2 address filter has higher priority than the ump filter logic. for example, if the l2 address filter?s multicast hash table is programmed and if the ump filter module?s multicast frame address does not fall in the mc hash table, then the mc frame destined for the ump will not make it through. in order to overcome this limitation, the ump filter logic has control bit (bit 7 of register 0x5f0) to disable the mc hash function of the l2 address filter. rdi t imer a ttention the bcm5714 and bcm5715 devices support rdi timer attenti on to detect the condition of pci bus hung (driver blue screen scenario). the rdi timer module generates an attention if entries from the rdi ftq are not being de-queued for a certain period of time. enable the rdi timer attention by setting the bit 7 of rdi mode register (0x2400). program the time out value for generating rdi timer event attention in bits 5:4 of rdi timer mode register (x24f0). the fw can check the bit 7 of rdi status register (0x2404) for rdi timer attention to recognize the blue screen scenario and to take the appropriate action. www.datasheet.in programmer?s guide bcm57xx 01/29/08 broadcom corporation document 57xx-pg105-r pci/pci-x interface page 79 pci/pci-x i nterface the bcm57xx family has a pci v2.2 and pci-x v1.0 compliant bus interface (see the following figure). figure 38: pci/pci-x bus interface the remaining pins can be broken into the following categories: ? 32-bit interface?pins necessary for 32-bit pci compatibility ? 64-bit extension?pins necessary for 64-bit bus compatibility ? clock and reset?pins necessary for transaction timing and device reset ? interface control?pins necessary for pci bus master, configuration, and bus target transactions ? bus arbitration?pins necessary to request and grant pci bus ? control and interrupt?pins necessary to generate/sample interrupts, bus errors, and voltage levels pci interface write fifo read fifo msi fifo dma write engine dma read engine host coalescing engine pll memory arbiter a d[0..31] par frame trdy irdy stop devsel req gnt clk rst ad[32..63] cbe[4..7] par req64 ack64 m66en idsel inta serr 32-bit interface 64-bit 66-mhz interface interface control bus arbitration clock and reset control and interrupts vaux pcixcap .01 f programmed logic perr cbe[0..3] www.datasheet.in bcm57xx programmer?s guide 01/29/08 broadcom corporation page 80 pci/pci-x interface document 57xx-pg105-r d ual a ddress c ycle both the pci and pci-x bus interfaces support dual address cycle (dac). the bcm57xx family supports dac as both a master and a target. the device may bus-master data from physical addresses greater than 4 gigabytes using dac mode. the device will not generate a dac transaction unless a host programmed control block specifies a physical address greater than 4 gigabytes. for example, a send ring buffer descriptor located above 0xffffffff requires a dac read transaction (see ?common data structures? on page 89 for discussion of rings). dac is not used for an address of 0xffffffff. dac is used for addresses of 0x100000000 or higher. the address phase of a dac pci/pci-x transaction requires two address cycles to be driven on ad[0..31]. the bcm57xx family does not know if the target device supports 64-bit addressing; thus, the ad[0..31] are used to source a high and low address. if the target device does support 64-bit addressibility, the bcm57xx family still drives the high address on ad[32..64]. there is no penalty for sourcing a high and low address on ad[0..31] even if the target supports 64-bit addressing; the target still requires one pci_clk to decode the address driven on the bus. the decode clock cycle is used to drive the high address on ad[0..31] and on the next clock devsel is asserted. if the target is a 32-bit device, devsel will not be asserted until at least one clock after the high address is driven on ad[0..31]. the following figure shows a read transaction with the devsel being asserted based on target type (32 vs. 64 bit). figure 39: read transaction based on target type frame pci_clk ad[0..31] ad[32..63] c/be[3..0] c/be[4..7] low high dac cmd cmd high byte enables data data data data byte enables d ual address cycle 64-bit address still driven - no penalty irdy trdy devsel fast devsel decode (64-bit target device) dac devsel decod e (32-bit target) www.datasheet.in programmer?s guide bcm57xx 01/29/08 broadcom corporation document 57xx-pg105-r pci/pci-x interface page 81 t arget r ead /w rite b ursts when the bcm57xx family is a pci target, the pci and pci-x interfaces do not support burst read/write transactions. the device will claim the burst transaction, but will disconnect after the first data phase. the bcm57xx family will issue a single data phase disconnect; the transaction is subsequently terminated. devsel deasserted on the data phase. then trdy and stop will be asserted to indicate a single data phase disconnect. finally, the initiator (master) releases the bus by deasserting frame and irdy . refer to section 2.11.2.1 in the pci-x v1.0 specification. the pci v2.2 specification refers to this behavior as disconnect with data . the following figure shows a single data phase disconnect. figure 40: single data phase disconnect frame pci_clk bcm57xx d isconnects irdy trdy devsel bcm57xx deasser ts devsel stop initiator completes transaction www.datasheet.in bcm57xx programmer?s guide 01/29/08 broadcom corporation page 82 pci/pci-x interface document 57xx-pg105-r pci h ost b us i nterface (n ot a pplicable to bcm5721, bcm5751, bcm5752, bcm5714c, bcm5714s, bcm5715c, and bcm5715s) the bcm57xx family supports 32 and 64-bit pci transactions, and the pci interface runs at bus frequencies from 33 mhz to 66 mhz. the minimum tolerance for the pci clock is 27 mhz. the bcm57xx family isolates the pci clock from other chip clock domains and the mac core does not drive off the pci bus clock. a phased locked loop (pll) is embedded in the pci interface to match the pci bus frequency. this pll allows the device to meet the timing requirements for pci read/write transactions and minimize bus latency (wait states). when the device comes out of reset, the pll samples and matches the pci bus clock frequency. the pll?s configuration is also influenced by host software. the host programmable block affects the pll speed based on the configuration of the 32_bit_pci_bus and 33/66 mhz_pci_66/133 mhz_pcix bits in the pci_state register (see ?pci state register? on page 202 ). the host programmable block affects the pll speed?bcm57xx firmware may reprogram the bus speed of the device using the 33/66 mhz_pci_66/133 mhz_pcix bit in the pci_state register. the pci interface supports all transactions except i/o commands. the bcm57xx family does not have i/o mapped, thus the device will not respond to i/o read/write transactions. the following table lists the commands supported by the bcm57xx family. table 23: pci commands supported by the bcm57xx family command encoding description usage 0110 memory read bcm57xx family as pci master or target a a. when using the bcm57xx family as a pci target, break after one data cycle (i.e., for register space, a maximum of 32 bits; for memory and mailbox space, a maximum of 64 bits). 0111 memory write bcm57xx family as pci master or target 1010 configuration read bcm57xx family as pci target 1011 configuration write bcm57xx family as pci target 1100 memory read multiple bcm57xx family as pci master or target a 1101 dual address cycle bcm57xx family as pci master 1110 memory read line bcm57xx family as pci master or target www.datasheet.in programmer?s guide bcm57xx 01/29/08 broadcom corporation document 57xx-pg105-r pci/pci-x interface page 83 pci-x h ost b us i nterface (a pplicable to bcm5700, bcm5701, BCM5703c, BCM5703s, bcm5704c, and bcm5704s) the bcm57xx pci-x interface is pin for pin compatible with 64-bit pci connectors; the pci-x v1.0 specification is backward compatible with the pci v2.2 standard. the host chipset uses a three level comparator to sample the nic?s pcixcap pin. refer to table 6-1 in the pci-x v1.0 specification. the device pci-x interface supports bus speeds ranging from 66 mhz to 133 mhz. for example, the bcm57xx pci-x interface runs at 100-mhz bus frequency since some early pci-x chipsets drive pci_clk to 100 mhz. the pci-x interface will scale its clocking to 100 mhz, but the pci-x status registers will indicate a 133 mhz bus frequency. essentially, a pci-x bus speed greater than 66 mhz will be programmable via 133 mhz status and control. the number of physical connectors (loads) a host chipset can drive is scaled to bus frequency (see the following table). a pci-x split transaction consists of two parts: split request and split completion. split transactions may be used in conjunction with the following pci-x commands (bcm57xx family supported): ? memory read block ? memory read dword ? interrupt acknowledge ? configuration read ? configuration write there are two players in split transactions: requester and comp leter. the requester is typically a pci-x initiator (i.e., bcm57xx family) and the completer is the target device. the bcm57xx family can handle one outstanding split memory read at any time. two pci transactions may be outstanding at any point?one memory read and one memory write transaction. however, the pci interface does not support a split memory write transaction (not defined). figure 41 on page 84 shows a split memory read timeline. table 24: pci-x bus speeds and loads bus speed connectors (loads) 66 mhz 4 100 mhz 2 133 mhz 1 www.datasheet.in bcm57xx programmer?s guide 01/29/08 broadcom corporation page 84 pci/pci-x interface document 57xx-pg105-r figure 41: split memory real timeline pci-x target bcm57xx (pci-x master) pci-x command (ie read block) split requester split completor split response source th e read data split completion disconnect recalculat e address an d data lengt h split completion decode sink some read data sink the remaining read data the pci-x target m ay disconnect and resume the split memory read later split read timeline d1 d2 ... d3 dn dn+1 ... dn+2 dn+2 dn+y 10 9 8 7 6 5 4 3 2 1 www.datasheet.in programmer?s guide bcm57xx 01/29/08 broadcom corporation document 57xx-pg105-r pci/pci-x interface page 85 the phases of this split memory read example are as follows: 1. the bcm57xx family is the transaction initiator of a split memory block read command. the device is the split transaction requestor in this diagram. 2. the target device decodes the command and physical address. the target will claim this transaction by asserting devsel and trdy. 3. the target will issue a split response to defer the memory read. 4. the target will fetch the request memory from its local storage. 5. the target will issue a split completion transaction. the amount of bytes read and address will be included in the transaction message. 6. the bcm57xx family will sink the split completion data burst. 7. the bcm57xx family may disconnect after some amount of time. the target must still complete the split memory read. 8. the target must recalculate the number of bytes and physical address. the target does not need to transfer the same data contents again, and waste bandwidth. 9. the target issues another split completion data burst, with the remaining data sourced. 10. the bcm57xx family completes the split completion transaction normally. the split memory block read is completed?this transaction is no longer outstanding. the broadcom pci-x interface does not initiate split trans actions; the bcm57xx family will respond with a single data disconnect when another master attempts to initiate a block/read write. the bcm57xx family does not accept burst read/ write transactions as a target device. however, the device will complete split transactions. the following table shows the pci-x commands supported by the bcm57xx family. i nitialization and r eset see ?initialization and reset? on page 720 for information on bcm57xx initialization and reset. table 25: pci-x commands supported by the bcm57xx family command encoding description length usage 0110 memory read dword dword bcm57xx family as pci-x master or target a a. when using the bcm57xx family as a pci-x target, break after one data cycle (i.e., for register space, a maximum of 32 bits; for memory and mailbox space, a maximum of 64 bits). 0111 memory write burst bcm57xx family as pci-x master or target 1010 configuration read dword bcm57xx family as pci-x target 1011 configuration write dword bcm57xx family as pci-x target 1100 split completion burst bcm57xx family as pci-x target 1101 dual address cycle n/a bcm57xx family as pci-x master or target 1110 memory read block burst bcm57xx family as pci-x master or target a 1111 memory write block burst bcm57xx family as pci-x master or target a www.datasheet.in bcm57xx programmer?s guide 01/29/08 broadcom corporation page 86 termination of pcsxcap signal document 57xx-pg105-r t ermination of pcsxcap s ignal the termination used on the pcsxcap signal determines the pci-x operation of the bcm57xx family (see figure 42 ). the bcm57xx reference nic routes the pcixcap connector to a 0.01-f capacitor; this configuration indicates pci-x 133 mhz. refer to section 9.10 of the v1.0 pci-x specification for details on pcixcap. pcixcap is not routed to the bcm57xx packaging?discrete ac logic is required on the nic board layout. pxicap can also be tied to ground with a 10k resistor in parallel to a 0.01-f cap. this configuration indicates pci-x 66 mhz. the pci bridge/chipset will sample pcixcap to determine the bus speed and capabilities of the device. the chipset uses a three-level comparator to determine the lowest common denominator?a common bus frequency. figure 42: terminating pcixcap to determine pci-x operation pcixcap .01 f pcixcap .01 f pcixcap pci-x 133 mhz 10k pci-x 66 mhz conventiona l pci u nconnected 10k resistor common gnd www.datasheet.in programmer?s guide bcm57xx 01/29/08 broadcom corporation document 57xx-pg105-r self-test page 87 s elf -t est bist the bcm57xx netxtreme family supports a manually controlled bist function for use in manufacturing defect detection. this test is not intended for operation once the chip has been assembled into a nic application. the bist operation is controlled by the enable bist bit in the pci clock control register (see ?pci clock control register (offset 0x74)? on page 334 ). the bist operates only under specific chip conditions. the pci bist register (see ?bist register (offset 0x0f)? on page 306 ) cannot be written by host software?this register is read-only. jtag ieee 1149 compliant boundary scan jtag is supported by the bcm57xx netxtreme family. the idcode, bypass, extest, and sample instructions of the ieee standard are implemented. these instructions allow each pin on the part to be controlled and monitored from the jtag serial interface pins. this industry standard technique allows the connections between the component die and the circuit board to be tested once the assembly has been built. the standard packaging for the bcm57xx netxtreme family does not provide pinout for jtag. an industry standard bsdl definition of the jtag implementation is available from broadcom technical support. www.datasheet.in bcm57xx programmer?s guide 01/29/08 broadcom corporation page 88 nvram configuration document 57xx-pg105-r section 4: nvram configuration broadcom netxtreme controllers require the use of an external non-volatile memory (nvram) device (flash or seeprom), which contains a bootcode program that the controller's on-chip cpu core loads and executes upon release from reset. this external nvram device also contains many configuration item s that direct the behavior of the controller, enable/disable various management and/or value-add firmware components, etc. all configuration settings are default-configured in the official release binary image files provided in broadcom's cd software releases. however, the settings chosen as default by broadcom may not be what best suits a particular oem's application so may need to be changed by the oem. details relating to the nvram can be found in netxtreme/netlink nvram access broadcom application note (netxtreme- an500-r). some of the topics addressed by this application note include the following: ? programming nvram (sample c code, x86 assembly) ? nvram map ? configuration settings ? bootcode ? multiple boot agent (mba), pxe, etc. ? management firmware (asf) note: nvram crc-32: there are multiple distinct regions contained within the nvram map. each of these regions has its own crc-32 checksum value associated with it. if any data element contained within a region is modified, then that region's crc-32 value must also be updated. details relating to calculating the crc-32 can be found in calculating crc32 checksums for broadcom netlink, netxtreme, and netxtreme ii controllers broadcom application note (netxtreme_netxtremeii-an200-r). www.datasheet.in programmer?s guide bcm57xx 01/29/08 broadcom corporation document 57xx-pg105-r common data structures page 89 section 5: common data structures t heory of o peration several device data structures are common to the receive, tr ansmit, and interrupt processing routines. these data structures are hardware-related and are used by device drivers to read and update state information. d escriptor r ings in order to send and receive packets, the host and the controller use a series of shared buffer descriptor rings to communicate information back and forth. each ring is composed of an array of buffer descriptors that reside in host memory. these buffer descriptors point to either send or receive packet data buffers. the largest amount of data that a single buffer may contain is 65535 (64k-1) bytes (the length field in bd is 16 bits). multiple descriptors can be used per packet in order to achieve scatter-gather dma capabilities. there are three main types of descriptor rings: ? send rings (host based or controller based) ? receive producer rings ? receive return rings bcm5700 with external memory supports up to 16 host based or controller based send rings, mini receive producer ring, standard receive producer ring, jumbo receive producer ring, and 16 receive return rings. bcm5700 without external memory, bcm 5701, bcm5702, BCM5703c, BCM5703s, bcm5704c, and bcm5704s macs support up to 4 host based or controller based send rings, standard receive producer ring, jumbo receive producer ring, and 16 receive return rings. bcm5705, bcm5788, bcm5721, bcm5751, bcm5714c, bcm5714s, bcm5715c, bcm5715s, and bcm5752 macs support one host based send ring, one receive producer ring, and one receive return ring. www.datasheet.in bcm57xx programmer?s guide 01/29/08 broadcom corporation page 90 descriptor rings document 57xx-pg105-r p roducer and c onsumer i ndices the producer index and the consumer index control which descriptors are valid for a given ring. each ring will have its own separate producer and consumer indices. when incremented, the producer index can be used to add elements to the ring. conversely, when incremented, the consumer index is used to remove elements from the ring. the difference between the producer and consumer indices mark which descriptors are currently valid in the ring (see figure 43 ). when the producer and consumer index are equal, the ring is empty. when the producer is one behind the consumer, the ring is considered to be full. figure 43: generic ring diagram the drawing shows a generic host descriptor ring (could be either a send ring or a receiv e ring), and demonstrates how the consumer and producer indices are used to determine which descriptors in the ring are valid at any given moment in time. 1st cons prod t he delta between the producer and c onsumer indices is indicated by the shaded areas. these shaded descriptors are considered to be valid (non-empty) and thus need to be processed. www.datasheet.in programmer?s guide bcm57xx 01/29/08 broadcom corporation document 57xx-pg105-r descriptor rings page 91 r ing c ontrol b locks each ring (send or receive) has a ring control block (rcb) associated with it. each rcb has the format shown in table 26 . the fields are defined as follows: ? the host ring address field contains the 64-bit host address of the first element in the ring. basically, this field tells the controller precisely where in host memory the ring is located. this field only applies to rings that are located in host memory (i.e., for on-chip send rings this field is ignored). the host_ring_address field contains the 64-bit address, in big-endian ordering, of the first send bd in host memory. in nic-based send rings, the field is ignored. ? the flags field contains bits flags that contain control information about a given ring. the following table shows the two flags that are defined. ? the max_len field has a different meaning for different types of rings. - for send rings and receive return rings, this field indicates the number elements in the ring. - for host-based send rings, the size of the ring is fixed at 512 entries and thus this field should be set to 512. - for controller-based send rings, this field can be 128 or 512 depending on number of send rings configured. the device internal send bd memory can be used either as one 512 bd ring or four 128 bd rings. to configure one nic based send ring to use 512 bd entries of internal memory, set mode_control.4x_size_nic_based_send_rings (bit 29 of the mode control register, see ?mode control register (offset 0x6800)? on page 502 ) to 1. in order to configure four send rings, each with 128 bds, set mode_control.4x_size_nic_based_send_rings (bit 29 of the mode control register, see ?mode control register (offset 0x6800)? on page 502 ) to 0. when external memory is used with bcm5700 it is possible to configure up to 16 send rings, each with 512 bds. - for receive return rings, the only valid values are 1024 and 2048. it is very important to make sure that this value is set to 2048 when receive mini producer ring is enabled. this is because the receive return ring size should be larger than the sum of sizes of receive producer rings that are enabled. table 26: ring control block format offset (bytes) 31 16 15 0 0x00 host ring address 0x04 0x08 max_len flags 0x0c nic ring address (reserved in bcm5705) table 27: flag fields for a ring bits name description 0 rcb_flag_use_ext_recv_bd this bit should be used only for receive jumbo rings. this bit indicates that the ring will use extended receive buffer descriptors (see ?receive buffer descriptors? on page 100 ). 1 rcb_flag_ring_disabled indicates that the ring is not in use. 15-2 reserved reserved for future use. should be set to 0. note: configure the receive return ring max_len = 2048 when the receive mini producer ring is enabled. the receive mini ring is supported only with bcm5700 when external memory is used. www.datasheet.in bcm57xx programmer?s guide 01/29/08 broadcom corporation page 92 descriptor rings document 57xx-pg105-r - for receive producer rings, this field corresponds to the maximum size buffer associated with the elements in the ring. the received packets whose length is less than or equal to the max_len field of receive mini producer ring will consume a bd from receive mini producer ring. the received packets whose length is greater than the max_len field of receive mini producer ring but less than or equal to the max_len field of receive standard producer ring will consume a bd from receive standard producer ring. and the received packets whose length is greater than the max_len field of receive standard producer ring will consume a bd from receive jumbo producer ring. this max_len field is ignored in the receive jumbo producer ring. the bcm5705, bcm5788, bcm5721, bcm5751, bcm5714c, bcm5714s, bcm5715c, bcm5715s, and bcm5752 mac devices support only one receive producer ring. so for these controllers, this max_len field of the rcb indicates the number of elements in the ring. the maximum programmable value of max_len field is 512 for these controllers. ? the nic ring address field contains the address where the bd cache is located in the internal nic address space. this address is only valid for receive producer rings. the send rings and receive return rings do not require this field to be populated. the location within the nic address map for receive producer ring may be located in the memory maps and pool configuration section (see ?memory maps and pool configuration? on page 171 ). s end r ings the bcm5700 with external memory supports up to 16 host based or controller based send rings. the bcm5700 without external memory, bcm5701, bcm5702, BCM5703c, BCM5703s, bcm5704c, and bcm5704s macs support up to 4 host based or controller based send rings. multiple send rings can be utilized by host software to select varying levels of priority and thus support varying levels of quality of service. the bcm5705, bcm5788, bcm5721, bcm5751, bcm5714c, bcm5714s, bcm5715c, bcm5715s, and bcm5752 macs support only one host based send ring. normally the host driver software uses host based send rings. a copy of these host send rings will then be cached in the controller. it is possible for host software to bypass host-based send rings and directly manipulate the on-chip controller based send rings. however, this is normally not advisable because this mechanism would require more pci slave accesses to the controller, and that would put an unnecessary burden on the host cpu. the send ring producer index is incremented by host software to add descriptors to the send ring (see figure 44 ). by adding descriptors to the ring, the device is instructed to transmit packets that are composed of the buffers pointed to by the descriptors. a single transmit packet may be composed of multiple buffers that are pointed to by multiple send descriptors. there is no limit as to how many descriptors can be used per packet other than the limit on the number of descriptors in the ring itself. table 28: send rings in bcm5700/5701/5702/5703c/5703s/5704c/5704s devices description internal memory only external memory a a. only the bcm5700 mac supports external ssram memory. mode number of rings 4 16 buffer descriptor size(bytes) 16 16 host ring size (# of buffer descriptors) 512 512 host-based rings 0 0 nic-based rings nic ring size (# of buffer descriptors) 128 128 host-based rings 128 128 4x ring size = 0 and nic-based rings 512 (only one send ring is supported in this configuration) 512 4x ring size = 1 and nic-based rings www.datasheet.in programmer?s guide bcm57xx 01/29/08 broadcom corporation document 57xx-pg105-r page 93 descriptor rings figure 44: transmit ring data structure architecture diagram host memory 1-(64k-1) bytes host buffer send host bd ring control block 1st host ring address max_len nic ring address flags host send ring #1 host send ring #n 1st note: the rcb's host ring address field points to the first element of the ring in the host (valid only when host send ring s are used). for host based sen d rings, the length of the ring is fixed at 512 entries. the nic ring address points to the first element of the locally stored rin g (this will be a "copy" of the host send ring when host send rings are used). cons prod rcb #1 rcb #n status word unused rx prod #1 rx std cons rx prod #2 unused status block rx big cons rx mini cons tx cons #1 tx cons #2 rx prod #n tx cons #n prod cons mailbox registers tx host ring #1 prod tx host ring #2 prod tx host ring #n prod status block (80 bytes) the status block resides in the nic memory space and his periodically dma'd to the host whenever the t x/rx coalescing timers expire, or whenever the rx/tx max coalesced frames thresholds are met. sw can examine the tx consumer indices in the status block to determine which packets have been s ent by the hw. the mailbox registers reside on-chip starting at offset 0x300. each mailbox register is 64 bits wide. wrting the lower 32 bits, triggers and event in the hw. sw updates the tx host ring producer index to indicate that there are buffer descriptors ready for the hw to process. note: when external memory is used, 16 rings can be supported. when external memory is not present, only 4 rings are supported. host address length rsvd for firmware send buffer descriptor flags vlan tag data structures in the host data structures kept on-chip transmit ring data scructure is located in the host (as shown below), and the device will keep a local (not shown) copy of the rings. rings and buffer descriptors would be solely located in on-chip memory space. www.datasheet.in bcm57xx programmer?s guide 01/29/08 broadcom corporation page 94 descriptor rings document 57xx-pg105-r send buffer descriptors the format of an individual send buffer descriptor is shown in table 29 . the fields are defined as follows: ? the host address field contains the 64-bit host address of the buffer that the descriptor points to. a length of 0 indicates that the descriptor does not have a buffer associated with it. ? the flags field contains bits flags that contain control information for the device for transmitting the packets. the defined flags are listed in table 30 . table 29: send buffer descriptors format offset (bytes) 31 16 15 0 0x00 host address 0x04 0x08 length flags 0x0c reserved vlan tag table 30: defined flags for send buffer descriptors bits name description 0 tcp_udp_cksum a if set to 1, the controller replaces the tcp/udp checksum field of tcp/udp packets with the hardware calculated tcp/udp checksum for the packet associated with this descriptor. 1 ip_cksum if set to 1, the controller replaces the ip checksum field of tcp/udp packets with the hardware calculated ip checksum for the packet associated with this descriptor. this bit should only be set in the descriptor that points to the buffer that contains the ip header. it is assumed that the ip header is contained in a single buffer. 2 packet_end if set to 1, the packet ends with the data in the buffer pointed to by this descriptor. 3 ip_frag a if set to 1, it indicates to the controller that this bd is part of a frame that is fragmented at the ip layer. if multiple send rings are enabled, hardware completes the processing of all bds in the ip fragment chain, before moving to the next enabled send ring. 4 ip_frag_end if set to 1, it indicates to the controller that this bd is the last fragment in the last packet of a train of ip fragmented packets. if multiple send rings are enabled, hardware completes processing all bds in the ip fragment chain, before moving to the next enabled send ring. 5 reserved reserved for future use. should be set to 0. 6 vlan_tag a if set to 1, the device inserts an 802.1q vlan tag into the packet. the 16-bit tci (tag control information) field of four byte vlan tag comes from the vlan tag field in the descriptor. 7 coal_now if set to 1, the device immediately updates the send consumer index after the buffer associated with this descriptor has been transferred via dma to nic memory from host memory. an interrupt may or may not be generated according to the state of the interrupt avoidance mechanisms. if this bit is set to 0, then the consumer index is only updated as soon as one of the host interrupt coalescing conditions has been met. 8 cpu_pre_dma if set to 1, the controller?s internal cpu is required to act upon the packet before the packet is given to the internal send data initiator state machine. normally this bit should be set to 0. www.datasheet.in programmer?s guide bcm57xx 01/29/08 broadcom corporation document 57xx-pg105-r descriptor rings page 95 ? the length field specifies the length of the data buffer. the lengths for the buffers associated with a given packet will add up to the length of the packet. ? the vlan tag field is only valid when the vlan_tag bit of flags field is set. this vlan tag field contains the 16-bit vlan tag that is to be inserted into an 802.1q (and 802.3ac) compliant packet by the controller. if vlan tag insertion is desired, this field (and the flag) should be set in the first descriptor for that packet (i.e., the descriptor that points to t he buffer that contains the ethernet header). ? the reserved field of send bd provides a placeholder for future functionality. it could also be used by specialized firmware. r eceive r ings the bcm57xx netxtreme family of macs support two types of receive descriptor rings: producer rings and return rings (see figure 45 ). descriptors in the producer rings point to free buffers in the host. when the controller receives a packet and consumes a receive buffer, the controller will modify and writeback the descriptor for the consumed buffer into the given receive return ring. basically the producer rings contain descriptors that point to buffers that the controller is free to use, whereas the return rings contain descriptors that the device has used and await processing from host software. 9 cpu_post_dma a if set to 1, the controller?s internal cpu is required to act upon the packet before the packet is given to the internal send data completion state machine. normally this bit should be set to 0. 11-10 reserved reserved for future use. should be set to 0. 12 insert_src_addr a if set to 1, the controller should insert a source address into the packet?s ethernet header. normally, this bit is not set because host software already has built the packet to include the ethernet source address. 14-13 choose_src_addr a this two-bit field indicates which of the four mac addresses should be inserted as the source address for the packet. these bits are meaningful only when bit 12 is set. 15 don?t_gen_crc a if set to 1, the controller will not append an ethernet crc to the end of the frame. a. indicates that this bit should be set in all descriptors fo r a given packet if the desired capability is to be enabled for th at packet. note: the udp checksum engine does not span ip fragmented frames. the ip_frag and ip_frag_end flags do not enable udp checksum capability, when the ip layer has fragmented the udp message. note: the 57xx family does not validate the value of the length field and may generate an error on the pci bus if the length field has a value of 0. the host driver must ensure that the length field is nonzero before enqueueing the bd onto the send ring. table 30: defined flags for send buffer descriptors (cont.) bits name description www.datasheet.in bcm57xx programmer?s guide 01/29/08 broadcom corporation page 96 descriptor rings document 57xx-pg105-r figure 45: receive return ring memory architecture diagram host memory 1-(64k-1) bytes host buffer rx bd host address index type ip chksum error flag reserve d opaque receive buffer descriptor len flags tcp_udp_chsum vlan tag ring control block 1st host ring address max_len nic ring address flags receive ring #1 receive ring #16 1st the ring and gives the length of the ring . and configures the ring. the nic ring address is invalid for the receive return ring prod cons rcb #1 rcb #16 status word unused rx prod #1 rx std cons rx prod #2 unused status block rx big cons rx mini cons tx cons #1 rx prod #16 tx cons #16 con prod mailbox registers rx cons #1 rx cons #2 rx cons #16 note: the receiver return rings are always stored in host memory. status block (80 bytes) status block resides in the nic memory space and is periodically dma'd to the host based on the host coalescing timer. the nic is the producer of the receive return ring. it increments the internal producer index to add elements to the ring . www.datasheet.in programmer?s guide bcm57xx 01/29/08 broadcom corporation document 57xx-pg105-r descriptor rings page 97 receive producer rings there are three types of producer rings: the mini receive ring ( table 31 ), the standard receive ring ( table 32 ), and the jumbo receive ring ( table 33 ). the mini receive ring and the jumbo receive ring are optional. the producer rings reside in the host and point to empty host receive buffers that will later be filled with received packet data. the controller will internally cache a copy of the three rings. the three producer rings differ from each other in the size of receive buffers that they point to. the mini receive ring is intended to point to small buffers that can be used to store very small packets. the standard receive ring is intended to point to buffers that are large enough to store a standard-sized ethernet packet (1522 byte vlan tagged packets and/or 1518 byte untagged packets). the jumbo receive ring is intended to point to very large buffers that can store packets larger than 1522 byte standard ethernet packets (e.g., 9k jumbo frames). the rationale behind the three producer rings is the efficient host memory utilization by using small buffers for smaller packets and large buffers for large packets. when the host software driver has a free host receive packet buffer available for incoming packets, it will fill out a receive producer descriptor of appropriate producer ring depending on bu ffer size and have the descriptor point to the available buffer. host software will then update the producer index for that receive producer ring to indicate to the controller that the re is a newly available receive buffer. after the controller fetches and caches (e.g., consumes) this receive producer descriptor, the controller will update the consumer index for the appropriate receive producer ring. the external ssram memory has no effect on the size of the buffer descriptor. the standard producer ring and jumbo producer ring ( table 33 ) may be enabled with or without external memory. the mini producer ring ( table 31 ) can only be enabled when external ssram is present and hence is supported only on bcm5700 with external memory. there is an extended rx buffer descriptor that can be used only with jumbo producer ring. the extended rx bd supports scatter gather, so the entire 9k of physical memory does not need to be mapped into one contiguous host memory location. the extended rx producer bd is enabled by setting the rcb_flag_use_ext_recv_bd flag in the flags field of the rcb. the extended rx bd has fields for four host addresses and four lengths. the bcm5700 with external memory supports all three receive producer rings (mini producer ring, standard producer ring, and jumbo producer ring). the jumbo producer ring may use either standard rx bds or extended rx bds. the bcm5700 without external memory, bcm5701, bcm5702, BCM5703c, BCM5703s, bcm5704c, and bcm5704s devices support standard and jumbo producer rings. the jumbo producer ring may use either standard rx bds or extended rx bds. the bcm5705, bcm5788, bcm5721, bcm5751, bcm5714c, bcm5714s, bcm5715c, bcm5715s, and bcm5752 devices support only standard producer ring. the bcm5714c, bcm5714s, bcm5715c, and bcm5715s devices support a configuration option of using either the standard rx bds or extended rx bds. table 31: mini receive producer ring(bcm5700 mac only) description external memory mode a a. only the bcm5700 mac supports external ssram me mory so mini ring is supported only on bcm5700. number of rings 1 buffer descriptor size(bytes) 32 host ring size (# of buffer descriptors) 1024 nic cache size (# of buffer descriptors) 256 www.datasheet.in bcm57xx programmer?s guide 01/29/08 broadcom corporation page 98 descriptor rings document 57xx-pg105-r table 32: standard receive producer ring description internal memory mode external memory mode a a. only the bcm5700 mac supports external ssram memory. number of rings 1 1 buffer descriptor size(bytes) 32 32 host ring size (# of buffer descriptors) 512 512 nic cache size (# of buffer descriptors) 128 128 table 33: jumbo receive producer ring (bcm 5700/5701/5702/5703c/5703s/5704c/5704s only) description internal memory mode external memory mode a a. only the bcm5700 mac supports external ssram memory. mode number of rings 1 1 buffer descriptor size(bytes) 32 32 extended bd?s = 0 64 64 extended bd?s = 1 host ring size (# of buffer descriptors) 256 256 nic cache size (# of buffer descriptors) if standard rx bd is used, there are 128 entries in the nic ring. if extended rx bd is used, there are only 64 entries in the nic ring. if standard rx bd is used, there are 128 entries in the nic ring. if extended rx bd is used, there are only 64 entries in the nic ring. www.datasheet.in programmer?s guide bcm57xx 01/29/08 broadcom corporation document 57xx-pg105-r descriptor rings page 99 receive return rings the bcm57xx netxtreme family supports up to sixteen receive return rings. multiple rings can be utilized by host software to select varying levels of priority and thus support varying levels of quality of service. when the nic receives a packet, it will dma that packet to a host receive packet data buffer whose size is appropriate for the incoming packet (see section 6: ?receive data flow? on page 116 ). earlier the nic will have received ownership of that data buffer via an update of the producer index for one of the three receive producer rings. after the controller does the packet data write dma, it will dma a corresponding buffer descriptor into the appropriate receive return ring. the buffer descriptor that is returned in the receive return ring will be slightly modified from the original buffer descriptor that the controller fetched out of the receive producer ring. after the controller has completed the dma of the receive return ring descriptor, the controller will update its internal copy of the producer index for that particular receive return ring. that ne w value for that receive return ring producer index will be included in the next status block update that is made to the host. ho st software will know that new packets have been received when host software sees that a receive return ring producer index has updated. table 34: receive return rings description bcm5700 with external memory bcm5700 with internal memory/5701/5702/5703c/ 5703s/5704c/5704s devices bcm5705/5788/ 5721/5751/5752 devices bcm5714c/5714s/ 5715c/5715s devices number of rings 16 16 1 1 buffer descriptor size (bytes) 32 32 32 32 host ring size (# of buffer descriptors) 2048 if mini ring is enabled 1024 if mini ring is disabled 1024 512 512 if standard rx bds are used. 256 if extended rx bds are used nic cache size (# of buffer descriptors) 00 00 www.datasheet.in bcm57xx programmer?s guide 01/29/08 broadcom corporation page 100 descriptor rings document 57xx-pg105-r receive buffer descriptors the format of standard receive buffer descriptors (i n both producer rings and return rings) is shown in table 35 . see ?extended receive buffer descriptor? on page 122 for a description of the format of extended receive buffer descriptors that would be needed for support of jumbo frames. the fields are defined as follows: ? the host address field contains the 64-bit host address of the buffer that the descriptor points to. a length of 0 indicates that the descriptor does not have a buffer associated with it. ? the length field specifies the length of the data buffer. for producer rings this value is set by the host software to correspond to the size of the buffer that is available for a receive packet. once a packet has been received, the controller will modify this length field to correspond to the length of the packet received. a value of 0 indicates that there is no valid data in the buffer. ? the index field is set by host software in the descriptors in the producer rings. when the controller uses a given buffer descriptor, it will opaquely pass the index field for that buffer descriptor through to the corresponding descriptor in the return ring. this index field of the bd in return ring is then used by the host software to associate the bd in return ring with the bd in producer ring that points to the given receive buffer. ? the flags field contains bits flags that contain control information about a given descriptor. the defined flags are listed in ta bl e 3 6 . table 35: receive descriptors format offset (bytes) 31 16 15 0 0x00 host address 0x04 0x08 index length 0x0c type flags 0x10 ip_cksum tcp_udp_cksum 0x14 error_flags vlan tag 0x18 reserved 0x1c opaque table 36: defined flags for receive buffers bits name description 15 reserved reserved for future use. should be set to 0. 14 tcp_udp_is_tcp in producer rings this bit should be set to 0. in return rings this bit will be set to 1 by the controller if the controller calculated that the incoming packet was a tcp packet. if the packet is udp or a non ip frame, then this bit should be set to 0. 13 tcp_udp_checksum in producer rings this bit should be set to 0. in return rings this bit will be set to 1 by the controller if the controller calculated that the tcp or udp checksum in the corresponding incoming packet was correct. 12 ip_checksum in producer rings this bit should be set to 0. in return rings this bit will be set to 1 by the controller if the controller calculated that the ip checksum in the corresponding incoming packet was correct. 11 mini_ring the driver should set this to 1 for the descriptors in the mini receive ring. the controller will not actually do anything differently based on this bit, rather it will just copy this bit through to the receive return ring. thus, if the bit is set to 1 in the return ring, the host driver will know that the packet came from the mini receive ring rather than the standard return ring. www.datasheet.in programmer?s guide bcm57xx 01/29/08 broadcom corporation document 57xx-pg105-r descriptor rings page 101 ? the type field is used internally by the controller. in producer rings it should be set to 0, and in return rings it should be ignored by host software. ? the tcp_udp_cksum field holds the tcp/udp checksum that the controller calculated for all data following the ip header given the length defined in the ip header. if the receive no pseudo-header checksum bit is set (see ?mode control register (offset 0x6800)? on page 502 ) to 1, then the pseudo-header checksum value is not added to this value. otherwise, the tcp_udp_cksum field includes the pseudo-header in the controller?s calculation of the tcp or udp checksum. if the packet is not a tcp or udp packet, this field has no meaning. host software should zero this value in the producer ring descriptors. if the host is capable of tcp or udp checksum off load, then host software may examine this field in the return rings to determine if the tcp or udp checksum was correct. ? the ip_cksum field holds the ip checksum that the controller calculated for the ip header of the received packet. if the packet is not an ip packet, this field has no meaning. ho st software should zero this value in the producer ring descriptors. if the host is capable of ip checksum off load, then host software may examine this field in the return rings to determine if the ip was correct. a correct value would be 0 or 0xffff. ? the vlan tag field is only valid when the vlan_tag bit is set. this field contains the 16-bit vlan id that was extracted from an incoming packet that had an 802.1q (and 802.3ac) compliant header. ? the error_flags field contains bits flags that contain error information about an incoming packet that the descriptor is associated with. the bits in this field are only valid if the frame_has_error bit is set in the flags field in the descriptor. the defined error flags are listed in ta b l e 3 7 . 10 frame_has_error if set to 1 in a return ring, it indicates that the controller detected an error. the specific type of error is specified in the error_flag field of the receive return descriptor. 9-7 reserved reserved for future use. should be set to 0. 6 vlan_tag* if set to 1 in a return ring, it indicates that the packet associated with this buffer contained a four-byte 802.1q vlan tag. the 16 vlan id is stripped from the packet and located in the vlan tag field in the descriptor. 5 bd_flag_jumbo_ring indicates that this packet came from the jumbo receive ring, not the standard receive ring (for receive bds only). this must be set by the driver; it is just copied through opaquely by the nic firmware. 4-3 reserved reserved for future use. should be set to 0. 2 packet_end if set to 1, the packet ends with the data in the buffer pointed to by this descriptor. 1-0 reserved reserved for future use. should be set to 0. table 36: defined flags for receive buffers (cont.) bits name description www.datasheet.in bcm57xx programmer?s guide 01/29/08 broadcom corporation page 102 descriptor rings document 57xx-pg105-r ? the reserved field provides a placeholder for future functionality. it could also be used by specialized firmware. ? the opaque field is reserved for the host software driver. any data placed in this field in a producer ring descriptor will be passed through unchanged to the corresponding return ring descriptor. table 37: defined error flags for receive buffers bits name description 31-9 reserved reserved for future use. should be set to 0. 8 giant_pkt_rcvd if set to 1, the received packet was longer than the maximum packet length value set in the receive mtu size register (see ?receive mtu size register (offset 0x43c)? on page 387 ). the data in the received packet was truncated at the length specified in the receive mtu size register. 7 trunc_no_res if set to 1, the received packet was truncated because the controller did not have the resources to receive a packet of this length. 6 len_less_64 if set to 1, the received packet was less than the required 64 bytes in length. 5 mac_abort if set to 1, the mac aborted due to an unspecified internal error while receiving this packet. the packet could be corrupted. 4 odd_nibble_rx_mii if set to 1, the received packet contained an odd number of nibbles. thus, packet data could be corrupt. 3 phy_decode_err if set to 1, while receiving this packet the device encountered an unspecified frame decoding error. this packet could be corrupted. this bit is set for valid packets that are received with a dribble nibble. true alignment errors will be dropped by that mac and never show up to the driver. 2 link_lost if set to 1, link was lost while receiving this frame. therefore this packet is incomplete. 1 coll_detect if set to 1, a collision was encountered while receiving this packet. 0 bad_crc if set to 1, the received packet has a bad ethernet crc. www.datasheet.in programmer?s guide bcm57xx 01/29/08 broadcom corporation document 57xx-pg105-r status block page 103 s tatus b lock the status block is another shared memory data structure that is located in host memory. a copy of the status block is also kept in the controller (see ?status block base address register (offset 0x3c44)? on page 457 ). the full status block is 80 bytes in length, when all send and receive rings are enabled. host software will need to allocate up to 80 bytes of non- paged memory space for the full status block and set the status block host address register (see ?status block host address register (offset 0x3c38)? on page 457 ) to point to the host memory physical address reserved for this structure. if host software enables a subset of the total available send/receive rings, the bcm57xx may be configured to update a partial status block; the unused portions of the status block are subsequently not dma'd to host memory. partial status block updates better utilize pci bus bandwidth and decrease latency for other bcm57xx dma transactions. the controller will update the status block to host memory prior to a host coalescing interrupt or msi. the frequency of these status block updates is determined by the host coalescing logic (see ?host coalescing engine? on page 62 ). there are many software configurable coalescing parameters that a device driver can manipulate to optimize the frequency of status block updates for a particular application or operating system. the bcm57xx family supports partial status block updates to host memory (see figure 46 ), and the host driver must set the status block size bits in the host coalescing mode register (see ?host coalescing mode register (offset 0x3c00)? on page 452 ). figure 46: partial status block updates note: the bcm5700 mac prior to the c0 revision does not support partial status block updates to host memory. (see ?revision levels? on page 5 .) status block status word 0x00 0x20 0x40 0x50 full 32 bytes 64 bytes www.datasheet.in bcm57xx programmer?s guide 01/29/08 broadcom corporation page 104 status block document 57xx-pg105-r the status block contains some of the producer and consumer indices for the rings described in ?descriptor rings? on page 89 . these producer and consumer indices allow host software to know what the current status of the controller is regarding its processing of the various send and receive rings. from information in the status block a software driver can determine: ? whether the status block has been recently updated (via a bit in the status word). ? whether the link state has changed (via a bit in the status word). ? whether the controller has recently received a packet and deposited that packet into host memory for a given ring (via the receive return ring producer indices). ? which host receive descriptors that controller has fetched, and it will consume when future packets are received (via the receive producer ring consumer indices). ? whether the controller has recently completed a transmit descriptor buffer dma for a given ring (via the send ring consumer indices). s tatus b lock f ormat the bcm5705, bcm5788, bcm5721, bcm5751, bcm5752, bcm5714c, bcm5714s, bcm5715c, and bcm5715s devices support only one send ring, one receive producer ring, and one receive return ring. so the status block is always 20 bytes long for these devices and its format is show below. also the status block no longer exists in the controller memory space for these devices. the status block will still be dmaed to the host memory based on the host coalescing criteria. the host cpu can access the most current index through the register space. table 38: status block format: bcm5705/5788/5721/5751/5752/5714/5715 offset 31 16 15 0 0x00 status word 0x04 status tag 0x08 receive standard consumer index a a. the receive standard consumer index is also accessible at 0x3c54. unused 0x0c unused 0x10 send bd consumer index b b. the send bd consumer index is also accessible at 0x3cc0. receive return bd producer index c c. the receive return bd producer index is also accessible at 0x3c80. www.datasheet.in programmer?s guide bcm57xx 01/29/08 broadcom corporation document 57xx-pg105-r status block page 105 the bcm5700, bcm5701, bcm5702, BCM5703c, BCM5703s, bcm5704c, and bcm5704s support multiple send rings and receive rings. for these devices, the full status block is 80 bytes long and its format is shown in table 39 . table 39: status block format (all others) offset 31 16 15 0 0x00 status word 0x04 status tag 0x08 receive standard consumer index receive jumbo consumer index 0x0c reserved receive mini consumer index 0x10 send ring 1 consumer index receive return ring 1 producer index 0x14 send ring 2 consumer index receive return ring 2 producer index 0x18 send ring 3 consumer index receive return ring 3 producer index 0x1c send ring 4 consumer index receive return ring 4 producer index 0x20 send ring 5 consumer index receive return ring 5 producer index 0x24 send ring 6 consumer index receive return ring 6 producer index 0x28 send ring 7 consumer index receive return ring 7 producer index 0x2c send ring 8 consumer index receive return ring 8 producer index 0x30 send ring 9 consumer index receive return ring 9 producer index 0x34 send ring 10 consumer index receive return ring 10 producer index 0x38 send ring 11 consumer index receive return ring 11 producer index 0x3c send ring 12 consumer index receive return ring 12 producer index 0x40 send ring 13 consumer index receive return ring 13 producer index 0x44 send ring 14 consumer index receive return ring 14 producer index 0x48 send ring 15 consumer index receive return ring 15 producer index 0x4c send ring 16 consumer index receive return ring 16 producer index www.datasheet.in bcm57xx programmer?s guide 01/29/08 broadcom corporation page 106 status block document 57xx-pg105-r the fields are defined as follows: ? the status word field contains bit flags that contain error information about the status of the controller. the defined flags are listed in ta b l e 4 0 . ? the status tag field contains an unique eight-bit tag value in bits 7:0 when the status tagged status mode bit of the miscellaneous host control register (see ?miscellaneous host control register (offset 0x68)? on page 325 ) is set to 1. this status tag can be returned to the mailbox 0 register at location 31:24 (see ?interrupt mailbox 0 register (offset 0x200)? on page 372 ) by host driver. when the remaining mailbox 0 regist er bits 23:0 are written as 0, the tag field of the mailbox 0 register is compared with the tag field of the last status block to be dmaed to host. if the tag returned is not equivalent to the tag of the last status block dmaed to the host, the interrupt state is entered. ? the receive jumbo ring consumer index field contains the controller?s current consumer index value for the receive producer jumbo ring. this field indicates how many receive descriptors are in the jumbo ring that the controller has consumed. for more information regarding this ring, see ?receive producer rings? on page 97 . ? the receive standard ring consumer index field contains the controller?s current consumer index value for the receive producer standard ring. this field indicates how many receive descriptors are in the standard ring that the controller has consumed. for more information regarding this ring, see ?receive producer rings? on page 97 . ? the receive mini ring consumer index field contains the controller?s current consumer index value for the receive producer mini ring. this field indicates how many receive descriptors are in the mini ring that the controller has consumed. for more information regarding this ring, see ?receive producer rings? on page 97 . table 40: status word flags bit name description 0 updated this bit is always set to 1 each time the status block is updated in the host via dma. it is expected that host software would clear this bit in the status block each time it examines the status block. this provides the host driver with a way of knowing whether the status block has been updated since the last time the driver looked at the status block. 1 link state changed see ?phy setup and initialization? on page 250 for a description of phy setup required when link state changes. this method of determining link change status provides a small performance increase over doing a pio read of the ethernet mac status register (see ?ethernet mac status register (offset 0x404)? on page 379 ). ? bcm5700 mac pre-c0 revision: if set to 1, the state of the ethernet link has changed since the last status block update. this is really the link state rather than a link changed bit. ? bcm5700 mac since c0 revision and the rest of the bcm57xx family: if set to 1, the interrupt was asserted due to a link change event. 2 error when this bit is asserted by the chip, the following conditions may have occurred. bit 2 of the status word is the or of: ? all bits in flow attention register (0x3c48) (see ?flow attention register (offset 0x3c48)? on page 457 ). ? mac_attn?events from the mac block (see ?ethernet mac status register (offset 0x404)? on page 379 ). ? dma_event?events from the following blocks: - msi (see ?msi status register (offset 0x6004)? on page 499 ). - dma_rd (see ?read dma status register (offset 0x4804)? on page 479 ). - dma_wr (see ?write dma status register (offset 0x4c04)? on page 482 ). ? rxcp_attn?events from rx risc (see ?rx risc state register (offset 0x5004)? on page 485 ). ? txcp_attn?events from tx risc (see ?tx risc state register (offset 0x5404)? on page 488 ). www.datasheet.in programmer?s guide bcm57xx 01/29/08 broadcom corporation document 57xx-pg105-r statistics block page 107 ? the receive return rings 0-15 producer indices fields contain controller?s current producer index value for the each of the receive return rings. when the controller receives a packet and writes that packet data into host memory via dma, it will increment the producer index for the corresponding receive return ring. when a producer index is incremented, it is a signal to software that a newly arrived receive packet is ready to be processed. ? the send rings 0-15 consumer indices fields contain controller?s current consumer index value for the each of the send rings. when the controller completes the read dma of the host buffer associated with a send bd, the controller will update the corresponding send ring consumer index. this provides the host software with an indication that the controller has buffered this send data and, therefore, the host software may free the buffer that was just consumed by the device. s tatistics b lock statistics are maintained by the nic in statistics memory block and transferred to host memory (see ?statistics host address register (offset 0x3c30)? on page 456 ) periodically based on the statistics ticks counter register (see ?statistics ticks counter register (offset 0x3c28)? on page 456 ). all counters are cleared when a nic reset occurs. all statistics are eight bytes long unless specified differently. this statistics memory block does not exist in bcm5705, bcm5788, bcm5721, bcm5751, bcm5714c, bcm5714s, bcm5715c, bcm5715s, and bcm5752 macs. instead, these devices support the hardware statistics through ?statistics registers? on page 407 . in the device register space, these devices also support the statistics shown in table 43 on page 109 through table 49 on page 110 , and table 52 and table 53 on page 113 . mac s tatistics mib statistics are based on rfc 1643. these statistics are generated by the tx mac and the rx mac (see table 41 ). note: for these controllers, the statistics are not periodically dmaed to host memory. table 41: mac statistics mib definition description dot3statsalignmenterrors a count of frames received on a particular interface that are not an integral number of octets in length and do not pass the fcs check. dot3statsfcserrors a count of frames received on a particular interface that are an integral number of octets in length and do not pass the fcs check. dot3statssinglecollisionframes a count of successfully transmitted frames on a particular interface for which transmission is inhibited by exactly one collision. dot3statsmultiplecollisionframes a count of successfully transmitted frames on a particular interface for which transmission is inhibited by more than one collision. dot3statsdeferredtransmissions a count of frames for which the first transmission attempt on a particular interface is delayed because the medium is busy. dot3statslatecollisions the number of times that a collision is detected on a particular interface later than 512 bit-times into the transmission of a packet. dot3statsexcessivecollisions a count of frames for which transmission on a particular interface fails due to excessive collisions. dot3statsinternalmactransmiterrors a count of frames for which transmission on a particular interface fails due to an internal mac sublayer transmit error. www.datasheet.in bcm57xx programmer?s guide 01/29/08 broadcom corporation page 108 statistics block document 57xx-pg105-r i nterface s tatistics mib statistics are based on rfc 1213 and rfc 1573 interfaces group. these statistics are generated by the rx mac and the tx mac (see table 42 ). not all the statistics associated with the mibs exist here. in particular, items that the host/driver would better handle, such as ifindex are left for the driver to set and report. dot3statscarriersenseerrors the number of times that the carrier sense condition was lost or never asserted when condition was lost or never asserted when attempting to transmit a frame on a particular interface. dot3statsframetoolongs a count of frames received on a particular interface that exceed the maximum permitted frame size. table 42: interface statistics mib definition description ifindiscards the number of inbound packets which were chosen to be discarded even though no error has been detected to prevent their being deliverable to a higher-layer protocol. ifinerrors the number of inbound packets that contained errors prevent them from being deliverable to a higher-layer protocol. the ifinerror counter increments if any of the below conditions occur: ? packet with fcs error. ? packet with alignment error. ? packet size greater than and equal to 2^16 bytes long (causing the counter to overflow). ? packet with extension error. ? packet size greater than preprogrammed mtu and keep_oversize is not enabled in the receive mac mode register (see ?receive mac mode register (offset 0x468)? on page 391 ). ? packet size less than 64 bytes and accept_runts is not enabled in the receive mac mode register. ? packet with invalid 802.3 length field, if length checking is enabled in the receive mac mode register. note: a packet dropped due to: ? an emac internal error (e.g., fifo overflow) would not cause ifinerror to increment. ? address filtering would not cause ifinerror to increment. ifinunknownprotos the number of packets received via the interface, which were discarded because of an unknown or unsupported protocol. ifoutdiscards the number of outbound packets which were chosen to be discarded even though no errors had been detected to prevent their being transmitted. ifouterrors the number of outbound packets that could not be transmitted because of errors. ifhcinoctets (8 bytes) the number of octets received on the interface, including framing characters. ifhcinucastpkts (8 bytes) the number of packets delivered by this sublayer to a higher (sub)layer, which were not addressed to a multicast or broadcast address at this sublayer. ifhcinmulticastpkts (8 bytes) the number of packets delivered by this sublayer to a higher (sub)layer, which were addressed to a multicast address at this sublayer. ifhcinbroadcastpkts (8 bytes) the number of packets delivered by this sublayer to a higher (sub)layer, which were addressed to a broadcast address at this sublayer. ifhcoutoctets (8 bytes) the number of octets transmitted out of the interface, including framing characters. table 41: mac statistics (cont.) mib definition description www.datasheet.in programmer?s guide bcm57xx 01/29/08 broadcom corporation document 57xx-pg105-r statistics block page 109 mib n etwork i nterface c ard s tatistics host interrupts the statistics shown in table 43 are maintained by the send data initiator engine. nic bd coalescing thresholds the statistics shown in table 44 are maintained by the send data initiator engine. the statistics shown in table 45 are maintained by the receive list placement engine. ifhcoutucastpkts (8 bytes) the number of packets that higher-level protocols requested be transmitted and that were not addressed to a multicast or broadcast address at this sublayer, including those that were discarded or not sent. ifhcoutmulticastpkts (8 bytes) the number of packets that higher-level protocols requested be transmitted and that were addressed to a multicast address at this sublayer, including those that were discarded or not sent. ifhcoutbroadcastpkts (8 bytes) the number of packets that higher-level protocols requested be transmitted, and that were addressed to a broadcast address at this sublayer, including those that were discarded or not sent. table 43: send data initiator host interrupts statistics value name description nicringsetsendprodindex number of times the nic has seen updates to any send producer index. nicringstatusupdate number of times the status block was updated. nicinterrupts number of interrupts generated by nic. nicavoidedinterrupts number of interrupts avoided by nic. table 44: send data initiator nic bd coalescing thresholds statistics value name description nicsendthresholdhit number of times send max coalesce frames threshold hit. table 45: receive list placement nic bd coalescing thresholds statistics value name description nicrecvthresholdhit number of times recv max coalesce frames threshold hit. table 42: interface statistics (cont.) mib definition description www.datasheet.in bcm57xx programmer?s guide 01/29/08 broadcom corporation page 110 statistics block document 57xx-pg105-r dma resources these statistics are generated by ftq for monitoring any state machine which adds dma descriptors to the either dma engine. these state machines include the send bd initiator, the receive bd initiator, the send data initiator, the receive data and receive bd initiator, and the host coalescing state machines. the nicdmareadqueuefull statistics shown in table 46 are updated by the send data initiator state machine. the nicdmawritequeuefull statistics shown in table 47 are updated by the receive list placement state machine periodically. mac resources the nicsenddatacompqueuefull statistics shown in table 48 are updated by the send data initiator state machine. the nicnomorerxbds statistics shown in table 49 are updated by the receive list placement state machine periodically. table 46: send data initiator dma resources statistics value name description nicdmareadqueuefull number of times dma read queue was full. nicdmareadhighprioqueuefull number of times dma read high priority queue was full. table 47: receive list placement dma resources statistics value name description nicdmawritequeuefull number of times dma write queue was full. nicdmawritehighprioqueuefull number of times dma write high priority queue was full. table 48: send data initiator mac resources statistics value name description nicsenddatacompqueuefull number of times send data completion ftq was full. table 49: receive list placement mac resources statistics value name description nicnomorerxbds number of times nic ran out of the receive buffer descriptors. www.datasheet.in programmer?s guide bcm57xx 01/29/08 broadcom corporation document 57xx-pg105-r statistics block page 111 internal mac receive statistics the statistics shown in table 50 are maintained by the receive mac. table 50: internal mac receive statistics counter description dot3statsalignmenterrors a count of frames received on a particular interface that are not an integral number of octets in length and do not pass the fcs check. dot3statsfcserrors a count of frames received on a particular interface that are an integral number of octets in length and do not pass the fcs check. dot3statssinglecollisionframes a count of succesfully transmitted frames on a particular interface for which transmission is inhibited by exactly one collision. dot3statsmultiplecollisionframes a count of succesfully transmitted frames on a particular interface for which transmission is inhibited by more than one collision. dot3statsdeferredtransmssions a count of frames for which the first transmission attempt on a particular interface is delayed because the medium is busy. dot3statslatecollisions the number of times that a collision is detected on a particular interface later than 512 bit-times into the transmission of a packet. dot3statsexcessivecollisions a count of frames for which transmission on a particular interface fails due to excessive collisions. dot3statsinternalmactransmiterrors a count of frames for which transmission on a particular interface fails due to an internal mac sublayer transmit error. dot3statscarriersenseerrors the number of times that the carrier sense condition was lost or never asserted when attempting to transmit a frame on a particular interface. dot3statsframetoolongs a count of frames received on a particular interface that exceeds the maximum permitted frame size. ifindiscards the number of inbound packets that were chosen to be discarded even though no error has been detected to prevent their being deliverable to a higher-layer protocol. ifinerrors the number of inbound packets that contained errors prevent them from being deliverable to a higher-layer protocol. ifinunknownprotos the number of packets received via the interface which were discarded because of an unknown or unsupported protocol. ifoutdiscards the number of outbound packets which were chosen to be discarded even though no errors had been detected to prevent their being transmitted. ifouterrors the number of outbound packets that could not be transmitted because of errors. ifhcinoctets the number of octets received on the interface, including framing characters. ifhcinunicastpkts the number of packets, delivered by this sublayer to a higher (sub)layer, which were not addressed to a multicast or broadcast address at this sublayer. ifhcinmulticastpkts the number of packets, delivered by this sublayer to a higher (sub)layer, which were addressed to a multicast address at this sublayer. ifhcinbroadcastpkts the number of packets, delivered by this sublayer to a higher (sub)layer, which were addressed to a broadcast address at this sublayer. ifhcoutoctets the number of octets transmitted out of the interface, including framing characters. ifhcoutunicastpkts the number of packets that higher-level protocols requested be transmitted, and that were not addressed to a multicast or broadcast address at this sublayer, including those that were discarded or not sent. www.datasheet.in bcm57xx programmer?s guide 01/29/08 broadcom corporation page 112 statistics block document 57xx-pg105-r ifhcoutmulticastpkts the number of packets that higher-level protocols requested be transmitted, and that were addressed to a multicast address at this sublayer, including those that were discarded or not sent. ifhcoutbroadcastpkts the number of packets that higher-level protocols requested be transmitted, and that were addressed to a broadcast address at this sublayer, including those that were discarded or not sent. etherstatsfragments a frame size that is less than 64 bytes with a bad fcs. xonpauseframesreceived mac control frames with pause command and length equal to zero. xoffpauseframesreceived mac control frames with pause command and length greater than zero. maccontrolframesreceived mac control frames with no pause command. xoffstateentered transmitting is disabled. etherstatsjabbers frames exceed jabber time. etherstatsundersizepkts frames with size less than 64 bytes. inrangelengtherror frames with length not equal to actual bytes received. outrangelengtherror frames with type greater than 1522 or less than 1536. etherstatspkts64octets frames size equal to 64 bytes. etherstatspkts65to127octets frames size between 65 and 127 bytes inclusive. etherstatspkts128to255octets frames size between 128 and 255 bytes inclusive. etherstatspkts256to511octets frames size between 256 and 511bytes inclusive. etherstatspkts512to1023octets frames size between 512 and 1023 bytes inclusive. etherstatspkts1024to1518octets frames size between 1024 and 1518 bytes inclusive. etherstatspkts1519to2047octets frames size between 1519 and 2047 bytes inclusive. etherstatspkts2048to4095octets frames size between 2048 and 4095 bytes inclusive. etherstatspkts4096to8192octets frames size between 4096 and 8192 bytes inclusive. etherstatspkts8192to9022octets frames size between 8192 and 9022 bytes inclusive. table 50: internal mac receive statistics (cont.) counter description www.datasheet.in programmer?s guide bcm57xx 01/29/08 broadcom corporation document 57xx-pg105-r statistics block page 113 internal mac transmit statistics the statistics shown in table 51 are maintained by the transmit mac. class of service statistics the class of service statistics shown in table 52 are generated by the send data initiator state machine. the class of service statistics shown in table 53 are generated by the receive list placement state machine. table 51: internal mac transmit statistics value name description etherstatscollisions number of collisions experienced. outxonsent sent xon. outxoffsent sent xoff. flowcontrolactive currently flow controlled. dot3collided2times number of frames that experienced 2 collisions. dot3collided3times number of frames that experienced 3 collisions. dot3collided4times number of frames that experienced 4 collisions. dot3collided5times number of frames that experienced 5 collisions. dot3collided6times number of frames that experienced 6 collisions. dot3collided7times number of frames that experienced 7 collisions. dot3collided8times number of frames that experienced 8 collisions. dot3collided9times number of frames that experienced 9 collisions. dot3collided10times number of frames that experienced 10 collisions. dot3collided11times number of frames that experienced 11 collisions. dot3collided12times number of frames that experienced 12 collisions. dot3collided13times number of frames that experienced 13 collisions. dot3collided14times number of frames that experienced 14 collisions. dot3collided15times number of frames that experienced 15 collisions. table 52: send data initiator class of service statistics value name description cosifhcoutpkts[1-16] number of frames sent on each of the 16 send rings. table 53: receive list placement class of service statistics value name description cosframesdroppedduetofilters cosifhcinpkts[1-16] number of frames received and placed on each of the 16 receive return rings. www.datasheet.in bcm57xx programmer?s guide 01/29/08 broadcom corporation page 114 statistics block document 57xx-pg105-r s tatistics m emory b lock the statistics memory region between 0x300 and 0xaff in the nic local memory (see table 54 ) can be accessed from several modes: flat, standard, or indirect. for a discussion of these modes, see section 9: ?pci? on page 178 . this statistics memory block does not exist in the bcm5705, bcm5788, bcm5721, bcm5751, bcm5752, bcm5714, and bcm5715 controllers. table 54: statistics block memory offset description access 0x300-0x3ff reserved - 0x400 ifhcinoctets r/w 0x408 reserved r/w 0x410 etherstatsfragments r/w 0x418 ifhcinucastpkts r/w 0x420 ifhcinmulticastpkts r/w 0x428 ifhcinbroadcastpkts r/w 0x430 dot3statsfcserrors r/w 0x438 dot3statsalignmenterrors r/w 0x440 xonpauseframesreceived r/w 0x448 xoffpauseframesreceived r/w 0x450 maccontrolframesreceived r/w 0x458 xoffstateentered r/w 0x460 dot3statsframetoolongs r/w 0x468 etherstatsjabbers r/w 0x470 etherstatsundersizepkts r/w 0x478 inrangelengtherror r/w 0x480 outrangelengtherror r/w 0x488 etherstatspkts64octets r/w 0x490 etherstatspkts65octetsto127octets r/w 0x498 etherstatspkts128octetsto255octets r/w 0x4a0 etherstatspkts256octetsto511octets r/w 0x4a8 etherstatspkts512octetsto1023octets r/w 0x4b0 etherstatspkts1024octetsto1522octets r/w 0x4b8 etherstatspkts1523octetsto2047octets r/w 0x4c0 etherstatspkts2048octetsto4095octets r/w 0x4c8 etherstatspkts4096octetsto8191octets r/w 0x4d0 etherstatspkts8192octetsto9022octets r/w 0x4d8-0x5ff reserved - 0x600 ifhcoutoctets r/w 0x608 reserved - 0x610 etherstatscollisions r/w 0x618 outxonsent r/w 0x620 outxoffsent r/w 0x628 flowcontroldone r/w 0x630 dot3statsinternalmactransmiterrors r/w 0x638 dot3statssinglecollisionframes r/w 0x640 dot3statsmultiplecollisionframes r/w www.datasheet.in programmer?s guide bcm57xx 01/29/08 broadcom corporation document 57xx-pg105-r statistics block page 115 0x648 dot3statsdeferredtransmissions r/w 0x650 reserved - 0x658 dot3statsexcessivecollisions r/w 0x660 dot3statslatecollisions r/w 0x668 dot3collided2times r/w 0x670 dot3collided3times r/w 0x678 dot3collided4times r/w 0x680 dot3collided5times r/w 0x688 dot3collided6times r/w 0x690 dot3collided7times r/w 0x698 dot3collided8times r/w 0x6a0 dot3collided9times r/w 0x6a8 dot3collided10times r/w 0x6b0 dot3collided11times r/w 0x6b8 dot3collided12times r/w 0x6c0 dot3collided13times r/w 0x6c8 dot3collided14times r/w 0x6d0 dot3collided15times r/w 0x6d8 ifhcoutucastpkts r/w 0x6e0 ifhcoutmulticastpkts r/w 0x6e8 ifhcoutbroadcastpkts r/w 0x6f0 dot3statscarriersenseerrors r/w 0x6f8 ifoutdiscards r/w 0x700 ifouterrors r/w 0x708-0x7ff reserved - 0x800-0x87f cosifhcinpkts[1-16] r/w 0x880 cosframesdroppedduetofilters r/w 0x888 nicdmawritequeuefull r/w 0x890 nicdmawritehighpriqueuefull r/w 0x898 nicnomorerxbds r/w 0x8a0 ifindiscards r/w 0x8a8 ifinerrors r/w 0x8b0 nicrecvthresholdhit r/w 0x8b8-0x8ff reserved - 0x900-0x97f cosifhcoutpkts[1-16] r/w 0x980 nicdmareadqueuefull r/w 0x988 nicdmareadhighpriqueuefull r/w 0x990 nicsenddatacompqueuefull r/w 0x998 nicringsetsendprodindex r/w 0x9a0 nicringstatusupdate r/w 0x9a8 nicinterrupts r/w 0x9b0 nicavoidedinterrupts r/w 0x9b8 nicsendthresholdhit r/w 0x9c0-0xaff reserved - table 54: statistics block memory (cont.) offset description access www.datasheet.in bcm57xx programmer?s guide 01/29/08 broadcom corporation page 116 receive data flow document 57xx-pg105-r section 6: receive data flow i ntroduction the rx mac pulls bds from rx producer rings. the rx bd specifies the location(s) in host memory where packet data may be moved. figure 47 on page 117 shows the receive buffer descriptor cycle. all ingress ethernet frames are classified by the rx rules engine. a class id is associated to each frame based on qos rules setup in the rx mac (see ?receive rules setup and frame classification? on page 126 ). the receive list placement and receive list initiator portions of the mac architecture move bds to the rx return rings; the class id associated to the packet is examined to route the bd to a specific rx return ring. the bcm5700, bcm5701, bcm5702, BCM5703c, BCM5703s, bcm5704c, and bcm5704s devices support sixteen rx return rings. the sixteen rx return rings allow host software to categorize traffic groups based on the qos rules. the bcm5705, bcm5788, bcm5721, bcm5751, bcm5752, bcm5714c, bcm5714s, bcm5715c, and bcm5715c devices support only one rx return ring. once the packet is queued to the rx return ring, the device driver will wait for indication of the same through the status bloc k update and interrupt from the host coalescing engine. the host coalescing engine will update the status block and generate a line interrupt or msi (see ?host coalescing? on page 287 for further details regarding interrupts) when a specified host coalescence criteria is met. once the interrupt is generated, the host device driver will service the interrupt. the isr will determine if new bds have been completed on the rx return rings. next, the device driver will indicate to the network protocol that the completed rx packets are available. the network protocol will consume the packets and return physical buffers to the network driver at a later point. the bds may then be reused for new rx frames. the device driver must return the bd to an rx producer ring. for this purpose, the driver should fill out either the opaque field or index field of the rx bd when inserting/initializing the bd in a n rx producer ring. when the bd is returned by the device through return ring, the opaque or index data field of the bd will be used by the driver to identify the bd in producer ring that corresponds to the returned bd in return ring. the device driver will then reinitialize the identified bd in producer ring with a new allocated buffer and replenish the receive producer ring with this bd. www.datasheet.in programmer?s guide bcm57xx 01/29/08 broadcom corporation document 57xx-pg105-r introduction page 117 figure 47: receive buffer descriptor cycle rx mini producer ring rx standard producer ring rx jumbo producer ring rx return ring 1 rx return ring 2 rx return ring 3 rx return ring 4 rx return ring 16 ... dma read engine local memory list initiator dma write engine interrupt service routine rx indicate available rx mac rx return packet protocol interface (i.e. tcp/ip) device drive r mac only enabled with external ssram host coalescing engine www.datasheet.in bcm57xx programmer?s guide 01/29/08 broadcom corporation page 118 receive producer ring document 57xx-pg105-r r eceive p roducer r ing a receive producer ring is an array containing a series of receive buffer descriptors (bd). there are up to three receive producer rings (pr) supported by at least one member of the bcm57xx family (see table 55 ); the mini pr, the jumbo pr, and the standard pr. the three receive producer rings will help efficient host memory utilization by providing the device with buffers of three different sizes. the receive producer rings are host-based and 25% of the available buffer descriptors are cached in bcm57xx internal memory. the use of the mini and jumbo producer rings is optional; the standard is required. ? only bcm5700 with external ssram supports the mini ring. this is because a copy of each ring is cached in bcm5700 internal memory and the bcm5700 mac expects the mini producer ring addresses at a higher memory than is supported with internal memory. a receive producer ring contains a series of buffer descriptors which in turn contain information of host memory locations to where packets are placed by the bcm57xx family at reception. each receive producer ring has a limit to the amount of buffer descriptors it can contain as follows: ? standard producer ring is limited to a maximum capacity of 512 bds (see table 32 on page 98 ). ? mini producer ring is limited to a maximum of 1024 bds (see table 31 on page 97 ). ? jumbo producer ring is limited to a maximum of 256 bds (see table 33 on page 98 ). the receive producer rings cannot be concatenated and the number of buffer descriptors in each ring is limited to the maximum buffer descriptor capacity of that ring. the bcm57xx family keeps copies of 25% of the buffer descriptors of each ring in its internal memory. it is not possible to set up three rings of one type or use any different combination of return producer rings other than what has been specified. table 55: receiver producer rings supported by bcm57xx family standard ring jumbo ring mini ring bcm5700 with only internal ssram supported supported not supported bcm5700 with external ssram supported supported supported bcm5701, bcm5702, BCM5703c, BCM5703s, bcm5704c, and bcm5704s supported supported not supported bcm5705, bcm5788, bcm5721, bcm5751, bcm5752, bcm5714c, bcm5714s, bcm5715c, and bcm5715s supported not supported not supported www.datasheet.in programmer?s guide bcm57xx 01/29/08 broadcom corporation document 57xx-pg105-r receive producer ring page 119 s et u p of p roducer r ings u sing rcb s a ring control block (rcb) is used by the host software to set up the shared rings in host memory. in the context of producer rings, a rcb is a register that is used to define a single receive producer ring. each producer ring has a single rcb that corresponds to it, which describes the ring and is used during setup and initialization. the host software must initialize thes e registers for each producer ring. the jumbo, standard, and mini producer rings have a corresponding rcb register called: ? jumbo receive bd ring rcb?register offset 0x2440-0x244f ? standard receive bd ring rcb?register offset 0x2450-0x245f ? mini receive bd ring rcb?register offset 0x2460-0x246f each receive producer ring rcb register is 16 bytes long and is found in the receive bd initiator control registers?memory offset 0x2400 (see ?ring control blocks? on page 91 ). other considerations relating to producer ring setup other registers that affect the producer rings need to be initialized by the host software. these registers include the receive bd ring replenish threshold register, the receive mtu register, and the accept oversized bit (bit 5) in the receive mac mode register. ? receive bd producer ring replenish threshold registers: - ?mini receive bd producer ring replenish threshold register (offset 0x2c14)? on page 443 . - ?standard receive bd producer ring replenish threshold register (offset 0x2c18)? on page 443 . - ?jumbo receive bd producer ring replenish threshold register (offset 0x2c1c)? on page 443 . these registers are used for setting the number of bds the bcm57xx family can use up before requesting more bds be dmaed from a producer ring. in other words, the device will not initiate a dma for fetching the rx bds until the number of bds made available to the device by the host is at least the value programmed in this register. ? receive mtu register ( ?receive mtu size register (offset 0x43c)? on page 387 ). this 32-bit register is set to a value that is the maximum size of a packet that the bcm57xx family will receive. any packets above this size is labeled as an oversized packet. the value for this register is typically set to 1518, which is the standard producer ring rcb typical setting. if jumbo frames are supported, the mtu would be set to the maximum jumbo frame size. ? receive mac mode register ( ?receive mac mode register (offset 0x468)? on page 391 ). if the accept oversized bit (bit 5) of this register is set, the bcm57xx family accepts packets larger than specified in the mtu (up to 64k bytes). rcb setup pseudo code an example of setting up a standard receive producer ring using the rcb: content of pointer_to_std_rx_rcb + 0x00 = host address of standard receive producer ring high 32. content of pointer_to_std_rx_rcb + 0x04 = host address of standard receive producer ring low 32. content of pointer_to_std_rx_rcb + 0x0a = no flags. content of pointer_to_std_rx_rcb + 0x08 = max packet size of 1518. content of pointer_to_std_rx_rcb + 0x0c = internal memory address for device copy of ring. figure 48 on page 120 shows the standard ring rcb for the setup of a host-based standard producer ring. www.datasheet.in bcm57xx programmer?s guide 01/29/08 broadcom corporation page 120 receive producer ring document 57xx-pg105-r receive buffer descriptors (bds) begin on the receive producer rings. the host device driver will populate each ring with a specified number of bds supported by the ring type: jumbo, standard, or mini (see ?receive producer ring? on page 118 ). the mini producer ring is only available when external ssram is attached to the mac. when the host device driver enables the mini producer ring, the memory region for packet buffers must be moved to another location in external memory. the mini producer ring displaces internal packet buffers (see ?initialization? on page 146 ). when a packet is received, the rx mac moves the packet data into internal memory. the size of the packet will determine which rx producer ring is the bd source bucket. the ring control blocks (rcb) for the mini and standard rcb contain a bit field called max_len (see ?ring control blocks? on page 91 ). host software must program a threshold value into the max_len field. the threshold value specifies the appropriate ring that the rx mac must use to source a bd, based on ingress packet size. the jumbo rcb ignores the max_len field. the receive mtu size register (see ?receive mtu size register (offset 0x43c)? on page 387 ) specifies the largest packet accepted by the rx mac; packets larger than the receive mtu are marked oversized and are discarded. figure 49 on page 121 shows how rx producer rings can be programmed to associate to packet size. figure 48: standard ring rcb for setup of a host-based standard producer ring offset 0x00 0x04 0x08 0x0c 31 16 host ring address max_len flags nic ring address 15 0 std ring bd 1 512 511 bd 2 bd 3 standard producer ring rcb standard producer ring www.datasheet.in programmer?s guide bcm57xx 01/29/08 broadcom corporation document 57xx-pg105-r receive producer ring page 121 figure 49: frame sizes r eceive b uffer d escriptors the receive buffer descriptor is a data structure in host memory. it is the basic element that makes up each receive producer and receive return ring. the format of receive buffer descriptors can be seen in figure 50 . there is also an extended receive buffer descriptor format that is optionally used for supporting the jumbo frames. if the extended receive buffer descriptor is used, the device always returns only the non-extended portion of a receive buffer descriptor to the host in the receive return ring. a receive buffer descriptor has a 64-bit memory address and may be in any memory alignment and may point to any byte boundary. for performance and cpu efficiency reasons, it is recommended that memory be cache-aligned. the bcm57xx family supports cache line sizes of 8, 16, 32, 64, 128, 256, and 512 bytes. the cache line size value is important for the controller to determine when to use the pci memory write and invalidate command. there are no requirements for memory alignment or cache line integrity for the bcm570x. unlike send buffer descriptors, the receive buffer descriptors cannot be chained to support multiple fragments. multiple fragment support can only be accomplished by using extended buffer descriptors. offset 32 16 15 0 host ring address 0x00 0x04 flags 0x08 0x0c nic ring address offset 32 16 15 0 host ring address 0x00 0x04 flags 0x08 0x0c nic ring address 0x233a recieve mtu register max_len max_len mini ring control block standard ring control block enet header mini payload crc enet header standard payload crc enet header jumbo payload crc www.datasheet.in bcm57xx programmer?s guide 01/29/08 broadcom corporation page 122 receive producer ring document 57xx-pg105-r e xtended r eceive b uffer d escriptor the format of the extended receive buffer descriptor is shown in figure 50 . the only differences between the extended receive buffer descriptor and a normal receive buffer descriptor are the additional host address n fields that contain the address of the nth piece of a fragment in host memory and the corresponding len n field that holds the length of the data pointed to by the host address n. please see ?receiving jumbo frames? on page 133 for the description of how extended bds are used for receiving jumbo frames. figure 50: receive buffer descriptor and extended buffer descriptor in using the extended buffer descriptor, the host software can use multiple receive fragments to support jumbo-sized packets, up to 9 kb. the host software is responsible for keeping track of the fragment addresses and lengths because the bcm57xx family will return only the non-extended portion of the buffer descriptor to the return rings and the len 0 field will contain the total size of the packet. 0x00 host address 1 0x04 host address 2 host address 3 0x08 0x0c 0x10 0x14 0x00 offset 31 16 0x04 host address 0 0x18 0x1c len 1 len 2 len 3 reserved 0x08 0x0c index len 0 type flags 0x10 0x14 ip_cksum tcp_udp_ cksum error_flag vlan tag reserved opaque data area 0x18 0x1c 15 0 0x20 0x3c -extended buffer descriptor - buffer descriptor www.datasheet.in programmer?s guide bcm57xx 01/29/08 broadcom corporation document 57xx-pg105-r receive producer ring page 123 m anagement of r x p roducer r ings with m ailbox r egisters and s tatus b lock status block the host software manages the producer rings through the mailbox registers and by using the status block. it does this by writing to the mail box registers when a bd is available to dma to the bcm57xx family and reading the status block to see how many bds have been consumed by the bcm57xx family (see figure 51 on page 124 ). the status block can be seen in table 39 on page 105 . the status block is controlled and updated by the bcm57xx family. the status block in host memory is constantly updated through a dma copy by the bcm57xx family from an internal status block. the updates occur at specific intervals and host coalescence conditions that are specified by host software du ring initialization of the bcm57xx family. the registers for setting the intervals and conditions are in the host coalescing control registers (see ?host coalescing? on page 62 ) starting at memory offset 0x3c00. the bcm57xx family will dma an updated status block to the 32-bit address that is set by the host software in the host coalescing control registers, register 0x3c38. among other status, the status block displays the last 16-bit value, bd index that was dmaed to the bcm57xx family from each producer ring. the bcm57xx family updates these indices as the recipient or consumer of the bd from the producer rings. the updated indices for the standard, jumbo, and mini producer rings are the recv std cons, recv jumbo cons, and recv mini cons indices. mailbox the host software is responsible for writing to the mailbox registers (see figure 51 ) when a bd is available from the producer rings for use by the bcm57xx family. host software should use the high-priority mailbox region from 0x200 through 0x3ff for host standard and flat modes and the low-priority mailbox region from 0x5800 through 0x59ff for indirect register access mode. the mailbox registers (starting at memory offset 0x200 for host standard and flat modes and offset 0x5800 for indirect mode) contain the following indices: ? receive bd standard producer ring producer index - host standard and flat modes: memory offset 0x268?0x26f - indirect mode: memory offset 0x5868?0x586f ? receive bd jumbo producer ring producer index - host standard and flat modes: memory offset 0x270?0x277 - indirect mode: memory offset 0x5870?0x5877 ? receive bd mini producer ring index - host standard and flat modes: memory offset 0x278?0x27f - indirect mode: memory offset 0x5878?0x587f www.datasheet.in bcm57xx programmer?s guide 01/29/08 broadcom corporation page 124 receive producer ring document 57xx-pg105-r figure 51: mailbox registers each register contains the index value of the next buffer descriptor from the corresponding producer ring that is available for dma to the bcm57xx family from the host. when the host software updates one of these indices, the bcm57xx family is automatically signaled that a new bd is waiting for dma. at initialization time, these values must be initialized to zero. thes e indices are 64-bit wide; however, the highest index value is only 1024 for the mini producer ring. offset (high-priority mailboxes for host standard and flat modes) 0x200 - 0x207 0x208 - 0x20f 0x268 - 0x26f 0x270 - 0x277 0x278 - 0x27f 0x280 - 0x287 0x288 - 0x28f 0x290 - 0x297 register access interrupt mailbox 0 rw interrupt mailbox 1 rw receive bd standard producer ring producer index rw receive bd jumbo producer ring producer index rw receive bd mini producer ring producer index rw receive bd return ring 1 consumer index rw receive bd return ring 2 consumer index rw receive bd return ring consumer index rw offset (low-priority mailboxes for indirect mode) 0x5800 - 0x5807 0x5808 - 0x580f 0x5868 - 0x586f 0x5870 - 0x5877 0x5878 - 0x587f 0x5880 - 0x5887 0x5888 - 0x588f 0x5890 - 0x5897 www.datasheet.in programmer?s guide bcm57xx 01/29/08 broadcom corporation document 57xx-pg105-r receive return rings page 125 r eceive r eturn r ings receive return rings (rr) are host-based memory blocks that are used by host software to keep track of the where the bcm57xx family is putting the received packets related receive buffer descriptors. unlike the producer rings, the return rings reside only in host memory. the device supports 16 receive return rings regardless of whether external memory is present. the bcm57xx family uses the bds in the nic's memory that are previously copied from the producer rings to use when packets are received from the lan. it places the bds that correspond to received packets in the return rings. return rings are the exact opposite of producer rings, except that they are not categorized by the maximum length receive packets supported. they are actually categorized by priority or class of received packet. the highest priority return ring is ring 1, and the lowest priority is the last ring (return ring 2?return ring 16 depending on how many rings are set up by the host software). see receive rules setup and frame classification below. return rings come in only one of two maximum buffer descriptor capacity sizes: ? 1024 is valid only if rcb_flag_ring_disabled flag is set in mini producer ring rcb. ? 2048 buffer descriptors if the mini producer ring is supported. the bcm5705, bcm5788, bcm5721, bcm5751, bcm5752, bcm5714c, bcm5714s, bcm5715c, and bcm5715s devices support only one receive return ring and this ring size is configurable to a value of up to 512. rcbs are used to set up return rings in much the same way they are used to set up the producer rings. these rcbs for the return rings are set in the miscellaneous memory region (ssram) at offset 0x200 (this region should not be confused with the register space in the chip). the rcb max_len field is used to indicate the number of buffer descriptor entries in a return ring. if an invalid value is set, the bcm57xx family will indicate an attention error in the flow attention register. figure 45 on page 96 shows receive return rings. m anagement of r eturn r ings with m ailbox r egisters and s tatus b lock the return rings are managed by the host using the mailbox registers and status block. when a packet is received from the lan, the bcm57xx dmas the packet to a location in the host, and then dmas the related bd to a return ring. as the producer of this packet to the host, the bcm57xx family updates the status block producer indices for the related return ring (i.e., return ring 1 to return ring 16 that was dmaed the bd received packet). these return ring indices, rx return producer 1 to rx return producer 16 shown in table 39 on page 105 , can then be read by the host software to determine the last bd index value of a particular ring that has information of the last received packet. as the consumer of the received packet, the host software must update the return ring consumer indices in mailbox registers receive bd return ring 1 consumer index (memory offset 0x280?0x287 for host standard and flat modes and 0x5880? 0x5887 for indirect mode) through receive bd return ring 16 consumer index (memory offset 0x300?0x307 for host standard and flat modes and 0x5900?0x5907 for indirect mode). www.datasheet.in bcm57xx programmer?s guide 01/29/08 broadcom corporation page 126 receive return rings document 57xx-pg105-r h ost b uffer a llocation the allocation of memory in the host is dependent on the operating system in which the controller is being used. two things to remember are: ? the use of non-cached and physically contiguous memory is best for adapter performance. ? physical memory mapping is needed for the controllers internal copies of logical host memory. r eceive r ules s etup and f rame c lassification the bcm57xx family has a feature that allows for the classification of receive packets based on a set of rules. the rules are determined by the host software and then input into the bcm57xx family. a packet can be accepted or rejected based on the rules initialized into two rules register areas. the packets can also be classified into groups of packets of higher to lower priority using the rules registers. this occurs when the packet is directe d to a specific return ring. return rings 1-16 have an inherent priority associated with them. the priority is from lowest ring number to highest ring number; return ring 1 being the highes t priority ring and return ring 16 being the lowest. the implementation of priority class is based on how many rings the host software has initialized and made available to the bcm57xx family. as packets arrive, the bcm57xx family ma y classify each packet based on the rules. when the host services the receive packet, it can service the lower numbered rings first. a rule can be changed by first disabling it by setting 0 into enable bit (bit 31) in receive bd rules control register (see table 57 ). wait about 20 receive clocks (rx_clock) and then re-enable it when it is programmed with a new rule. otherwise, changing the rules dynamically during runtime may cause the rule checker to output erroneous results because the rule checker is a pipelined design and uses the various fields of the rules at different clock cycles. receive rules configuration register the receive rules configuration register (memory offset 0x500?0x503, see table 56 ) uses bits 3-7 to specify the ring where a received packet should be placed into if no rules are met, or if the rules have not been set up. a value of 0 means the received packet will be discarded. a value of 1-16 specifies a corresponding ring. this ring should be initialized to at least a value of 1 if the rules are not being used to ensure that all received packets will be dmaed to return ring 1. table 56: receive rules configuration register bits field access 31-8 reserved r/o 7-3 specifies the default class (ring) if no rules are matched r/w 2-0 reserved r/o www.datasheet.in programmer?s guide bcm57xx 01/29/08 broadcom corporation document 57xx-pg105-r receive return rings page 127 receive list placement rules array the receive list placement rules array (memory offset 0x480?0x4ff) is made up of 16 combined element registers. the combined element is actually two 32-bit registers called the receive bd rules control register (see table 57 ) and the receive bd rules value/mask register (see table 58 ). the element can be looked at as a single 64-bit entity with a control part and value/mask part since they use a single element. bit 26 of the control part determines how the value/mask part is used. the receive bd rules value/mask register, or value/mask can be used as either a 32-bit left-justified value or a 16- bit mask followed by a 16-bit value. note: receive rules cannot be used to match vlan headers because the vlan tag is stripped from the ethernet frame before the rule checker runs. table 57: receive bd rules control register 31 30 29 28 27 26 25 24 23 22 21 20 19 18 17 16 e & p1 p2 p3 m d map reserved op 1514131211109876543210 header class offset bit name r/w description default 31 e r/w enable. enabled if set to 1 - 30 & r/w and with next. this rule and next must both be true to match. the class fields must be the same. a disabled next rule is considered true. processor activation bits are specified in the first rule in a series. - 29 p1 r/w if the rule matches, the processor is activated in the queue descriptor for the receive list placement state machine. - 28 p2 r/w if the rule matches, the processor is activated in the queue descriptor for the receive data and receive bd initiator state machine. - 27 p3 r/w if the rule matches, the processor is activated in the queue descriptor for the receive data completion state machine. - 26 m r/w mask if set, specifies that the value/mask field is split into a 16-bit value and 16-bit mask instead of a 32-bit value. - 25 d r/w discard frame if it matches the rule. - 24 map r/w map use the masked value and map it to the class. - 23:18 reserved r/w reserved bits must be written to zero. 0 17:16 op r/w comparison operator specifies how to determine the match: ? 00 = equal ? 01 = not equal ? 10 = greater than ? 11 = less than - www.datasheet.in bcm57xx programmer?s guide 01/29/08 broadcom corporation page 128 receive return rings document 57xx-pg105-r 15:13 header r/w header type specifies which header the offset is for: ? 000: start of frame (always valid) ? 001: start of ip header (if present) ? 010: start of tcp header (if present) ? 011: start of udp header (if present) ? 100: start of data (always valid, context sensitive) ? 101?111: reserved - 12:8 class r/w the class this frame is placed into if the rule matches. 0- 16, where 0 means discard. the number of valid classes is the number of active queues divided by the number of interrupt distribution groups. ring 1 has the highest priority and ring 16 has the lowest priority. - 7:0 offset r/w number of bytes offset specified by the header type. - table 58: receive bd rules value/mask register 31 30 29 28 27 26 25 24 23 22 21 20 19 18 17 16 mask 1514131211109876543210 value bit name r/w description default 31:16 mask - - - 15:0 value - - - bit name r/w description default www.datasheet.in programmer?s guide bcm57xx 01/29/08 broadcom corporation document 57xx-pg105-r receive return rings page 129 class of service example if either start of ip header, start of tcp header, or start of udp header is specified, and the frame has no ip, tcp, or udp header, respectively, there is no frame match. the full set of rules provides a fairly rich selection and filtering criteria. example: if you wanted to set a class of service (cos) of 2 based on the eighth byte in the data portion of an encapsulated ipx frame using ethernet type 2 having a value greater than 6, you could set up the rules shown in figure 52 . figure 52: class of service example rule 1: control = 0xc400020c where: enable + and with next (chain with next rule) mask -value/mask is split into two 16-bit value s class -return ring 2 offset -12 bytes from start of frame mask/value = 0xffff 8137 where: mask ? 0xffff value - ipx rule 2: control = 0x84028207 where: enable mask ? value/mask split into two 16-bit values comparison operator ?greater than header type ? start of data offset ? 7 bytes from start of data mask/value =0xff00 0600 where: mask ? 0xff00 value ? 0600 header type ? start of data comparison operator ?equal class -return ring 2 www.datasheet.in bcm57xx programmer?s guide 01/29/08 broadcom corporation page 130 checksum calculation document 57xx-pg105-r c hecksum c alculation whether the host software nos supports checksum offload or not, the bcm57xx family automatically calculates the ip, tcp, and udp of received packets as described in rfc 791, rfc 793, and rfc 768 respectively. which protocol checksum value is produced can be determined by reading the status flag field in the receive return ring. the valid flag values in the status flag field are ip_checksum and tcp_udp_checksum. when a valid checksum is produced, the values of the checksums are found in the co rresponding receive buffer descriptor register. these values should be 0xffff for a valid checksum or any other value if the checksum was incorrectly calculated. assert the receive no pseudo-header checksum bit of the mode control register (see ?mode control register (offset 0x6800)? on page 502 ) to disable tcp/udp pseudo-header checksums. vlan t ag s trip receiving vlan-tagged (ieee 802.1q compliant) packets are automatically supported by the bcm57xx family. there is no register or setting needed to receive packets that are vlan-tagged. the vlan tag is automatically stripped from the 802.1q compliant packet at reception and then placed in a receive buffer descriptor?s two byte vlan tag field. the flag field has the bd_flags_vlan_tag bit set when a valid vlan packet is received. once the packet has been serviced by the host software, these fields should be zeroed out. in the receive mac mode register?memory offset 0x468?0x46b, the keep vlan tag diag mode bit (bit 10) can be set to force the bcm57xx family to not strip the vlan tag from the packet. this is only for diagnostic purposes. the following table shows the frame format with 802.1q vlan tag inserted. table 59: frame format with 802.1q vlan tag inserted offset description 0-5 mac destination address 6-11 mac source address 12-13 tag protocol id (tpid)?0x8100 14-15 tag control information (tci): ? bit 15-13: 802.1p priority ? bit 12: cfi bit ? bit 11-0: vlan id 16-17 the original ethertype 18-1517 payload www.datasheet.in programmer?s guide bcm57xx 01/29/08 broadcom corporation document 57xx-pg105-r rx data flow diagram page 131 rx d ata f low d iagram the receive data flow can be summarized in figure 53 . the receive producer rings, receive buffer descriptors, receive return rings, mailbox registers, and status block registers are the main areas of the receive data flow. figure 53: overview diagram of rx flow bcm570x family rcv bd std producer ring index rcv bd mini producer ring index rcv bd jumbo producer ring index mailbox registers status word rcv std cons unused rcv jbo cons unused rcv min cons status block standard, mini, and jumbo producer rings in host memory bd n buffer descriptor points to free rx buffer in host tx cons #1 rx prod #1 receive return rings 1-16 in host memory bd n used buffer descriptor points to host memory where packet was copied 1 2 3 4 6 5 host memory network www.datasheet.in bcm57xx programmer?s guide 01/29/08 broadcom corporation page 132 rx data flow diagram document 57xx-pg105-r the following steps describe the rx flow sequence. 1. the host software updates a receive producer ring index in the mailbox registers. 2. a receive bd or series of bds with the corresponding index is dmaed to bcm57xx family from the host-based receive producer ring. 3. the bcm57xx family updates the receive consumer index in the host block register and stores copy of the bd. 4. a valid ethernet packet is received from the network into the b5700. 5. the ethernet packet is dmaed to host memory using a bd previously dmaed from a receive producer ring. 6. the bd used for the received packet is dmaed from the bcm57xx family to one of the receive return rings, and the receive return ring producer index register in the host status block is updated by the bcm57xx family. the host software must create an array of bd structures in host memory, referred to as a receive producer ring. each receive buffer descriptor within a producer ring describes, among other things, the location of a host memory buffer that is used to store the packets received from the network. when the host software (as the producer) updates the mailbox register?s producer ring index that corresponds to the receive producer ring, the bcm57xx family automatically dmas the bd to itself (offset 0x6000 for standard bd and offset 0x7000 for jumbo bd) from the host. when the dma is completed, the bcm57xx family (as the consumer) updates the status block?s receive consumer ring index to signal it successfully consumed the bd. the bcm57xx family keeps this bd in internal memory to know where to put a packet that is received from the network. when a packet is received from the network, a bd gets updated with information regarding the received packet and the packet is dmaed to a location in host memory described by the bd. the bcm57xx family (as the producer) then updates the receive return ring producer index in the status block register corresponding to one of host memory?s receive return rings, and dmas the bd to that receive return ring. it is the responsibility of the host software to setup, initialize, and manage the data structures in host memory, namely the receive producer rings and the receive return rings. the producer/consumer indices in the mailbox and status block are read and updated by the host and bcm57xx family for this purpose. www.datasheet.in programmer?s guide bcm57xx 01/29/08 broadcom corporation document 57xx-pg105-r receiving jumbo frames page 133 r eceiving j umbo f rames the bcm5700, bcm5701, bcm5702, BCM5703c, BCM5703s, bcm5704c, and bcm5704s macs support jumbo ring for supporting jumbo frames. these devices also support the extended rx bds for supporting the use of up to 4 host buffers for receiving one packet. the jumbo frames can be supported on these devices with or without the use of extended rx bds. in order to support jumbo frames without extended rx bds, the jumbo ring should be programmed with the rx bds each pointing to large enough host buffer for receiving a jumbo frame. this method requires the host to allocate large buffers of contiguous memory. the use of extend rx bds in jumbo ring allows chaining of up to four host buffers for receiving a jumbo frame and hence the receive buffers need not be large buffers of contiguous memory. the rcb_flag_use_ext_recv_bd flag of jumbo ring rcb should be set to 1 for using the extended bds. the bcm5705, bcm5788, bcm5721, bcm5751, and bcm5752 devices do not support jumbo frames and hence both jumbo ring and extended rx bds are not supported. the bcm5714c, bcm5714s, bcm5715c, and bcm5715s devices support only one send ring, one standard receive producer ring, and one receive return ring. these devices also support extended rx bds for supporting chaining of up to 4 host buffers for a received packet. the bcm5714c, bcm5714s, bcm5715c, and bcm5715s devices also support jumbo frames. in order to support jumbo frames without extended rx bds, the standard receive ring should be programmed with the rx bds each pointing to large enough host buffer for receiving a jumbo frame. this method requires the host to allocate a large buffer of contiguous memory for receiving even a smallest sized ethernet packet. the use of extended rx bds in standard ring allows chaining of up to four host buffers for receiving a jumbo frame and hence the receive buffers need not be large buffers of contiguous memory. the rcb_flag_use_ext_recv_bd flag of standard ring rcb should be set to 1 for using the extended bds. please note the following for enabling the jumbo frame support of these devices with the use of extended bds. 1. enable the standard ring to support extended rx bds by setting the bit 29 of write dma engine mode register (offset 0x4c00). by default, the standard receive producer ring is enabled only fro normal rx bds and the bit 29 of wdma mode register is set to zero. 2. the extended bd is 64 bytes long and hence the maximum number of extended bds supported by standard receive producer ring and receive return ring is 256. 3. the reserved field in extended rx bd (offset 0x1c bits 15:0; please see ?extended receive buffer descriptor? on page 122 for extended bd format) is used by the rdi and write dma engine for saving length0. this is needed as the length0 field in extended rbd (offset 0x28 bits 15:0) is modified by the rdi (receive data initiator engine) with the total length of the incoming packet. www.datasheet.in bcm57xx programmer?s guide 01/29/08 broadcom corporation page 134 transmit data flow document 57xx-pg105-r section 7: transmit data flow i ntroduction send buffer descriptors (bds) begin on the send producer rings. the bcm5700 with external memory supports up to 16 host based or controller based send rings. the bcm5700 without external memory, bcm5701, bcm5702, BCM5703c, BCM5703s, bcm5704c, and bcm5704s macs support up to 4 host based or controller based send rings. multiple send rings can be utilized by host software to select varying levels of priority and thus support varying levels of quality of servi ce. the bcm5705, bcm5788, bcm5721, bcm5751, bcm5752, bcm5714c, bcm5714s, bcm5715c, bcm5715s devices support only one send ring. in bcm5700, enabling send producer rings 5 to 16 displaces the internal memory buffer pool for ethernet packets. the hardware application must make external memory available to provide packet buffer memory for rx/tx traffic. send producer ring 1 has the highest transmit priority and send producer ring 16 has the lowest priority. the mac selects send bds totally based on priority, and available bds on the higher priority ring are always selected first. the scheduling of the bds is priority-based and there is no fairness scheme to prevent starvation. the host device driver updates the mailbox to reflect available send bds. ? the mac moves the available send bds to device local memory?a cache. ? next, the mac selects a bd from the internal cache using priority scheduling. the physical address, programmed in the send bd by the host device driver prior to the mailbox update, contains the host memory location of the tx packet buffer. the mac reads the address from send bd and schedules a bus master dma for reading the packet data from host buffer. the packet data will be moved into device internal buffers from host buffers by read dma engine, and all the read buffers of 1 packet are chained together into a cluster. this cluster is then sent to the transmit mac which sends the packet data to the integrated phy for transmission on ethernet media. the write dma engine will subsequently update the status block to indicate that the send bd was consumed. the host driver normally returns the packet buffers to the nos/protocol so the next packet can reuse that host physical memory. the send bd is available for the next tx packet. www.datasheet.in programmer?s guide bcm57xx 01/29/08 broadcom corporation document 57xx-pg105-r send rings page 135 s end r ings the send rings are shared data structures that are used to describe a series of data buffers that will be transferred onto the network. the shared data structure is called the ring control block (rcb), and the entries within a ring for describing the data buffers are called the send buffer descriptors (send bds). associated with each ring are two indices that control its operation. these indices are the producer index and the consumer index, which are not shared between the host software and the bcm57xx family. in the case of send rings, the host software controls the producer index by adding elements (initializing a send bd) to the ring and incrementing the index. similarly, the bcm57xx family controls the consumer index by removing elements (processing a send bd) from the ring and incrementing the index. the host software is responsible for maintaining its producer index and updating it by writing to the appropriate send ring host/nic producer index mailbox register (starting at offset 0x200 through 0x3ff for host standard and flat modes and offset 0x5800 through 0x59ff for indirect mode). the mailbox registers are described in ?mailbox? on page 123 , ?high-priority mailboxes? on page 370 (for offsets 0x200 through 0x3ff), and ?low-priority mailboxes? on page 490 (for offsets 0x5800 through 0x59ff). the update actually triggers the bcm57xx family to process the send descriptors starting at its consumer index. as a descriptor is processed, the consumer index is incremented, and the new index is reflected in a new status block update. status block is described in ?status block? on page 103 . when the producer and consumer indices are equal, the ring is empty. when the producer index is one behind the consumer, the ring is full. because of this configuration, the producer index always points to an empty slot. thus, there will always be at least one empty slot in a ring. the bcm57xx family has two operating modes that determine the location of the send rings. with the nic-based send ring mode, the rings reside in nic memory (see ?nic-based send ring? on page 138 ). with the host-based send ring mode, the rings are located in host memory (see ?host-based send ring? on page 139 ). figure 54 illustrates the relationships between all the components of a send ring. figure 54: relationships between all components of a send ring send bd 1 send bd 2 send bd 3 send bd 4 buffer buffer buffer send rcb send bd 5 send bd 7 send bd 8 consumer producer ... send bd 6 send bd 512 www.datasheet.in bcm57xx programmer?s guide 01/29/08 broadcom corporation page 136 send rings document 57xx-pg105-r r ing c ontrol b lock each send ring has a ring control block (rcb) associated with it. the rcb contains a pointer to the first send bd in the device and host memory, number of send bds in the ring, and control flags (see ?send rings? on page 92 for a full discussion of the send rcb). all the fields are in big-endian ordering as required by the bcm57xx family. the rcbs of the send rings are located in the nic?s miscellaneous memory region at offset 0x0100. send rings may reside in either host or nic memory (the bcm5705, bcm5788, bcm5721, bcm5751, bcm5752, bcm5714c, bcm5714s, bcm5715c, and bcm5715s devices support only one host based send ring). when the ring is nic-based, the entire ring data structure resides in the nic local memory. a nic send ring contains 128 send bds by default (see figure 55 ). the host device driver must configure the max_len field of the value of 128. the host driver must configure the nic_ring_address to point a memory map region for the send bds (see ?memory maps and pool configuration? on page 171 ). figure 55: nic send ring offset 32 16 15 0 host ring address 0x00 0x04 flags 0x08 0x0c nic ring address max_len nic send ring control block 1st 1st ring element 128th ring element www.datasheet.in programmer?s guide bcm57xx 01/29/08 broadcom corporation document 57xx-pg105-r send rings page 137 nic local rings may be combined (see figure 56 ). when the rings are combined, the total size of the ring may be increased to 512 entries. the total number of nic based send rings decrease to one when the four adjacent nic based send rings are combined. the host device driver should set the max_len field to 512 when the four nic based send rings are combined. figure 56: combining nic local rings the send rings may be completely located in host memory. in case of host based send rings, the send bds will be bus- mastered from host memory into device local memory. the host device driver will program the bds directly in its memory space and avoid programmed i/o to the mac. the max_len field in the rcb (see figure 57 ) should be set to the value of 512 for all host-based send rings. figure 57: max_len field in ring control block 384th 256th 128th 1st offset 32 16 15 0 host ring address 0x00 0x04 flags 0x08 0x0c nic ring address max_len 4x nic send ring control block 1st ring element 512th ring element offset 32 16 15 0 host ring address 0x00 0x04 flags 0x08 0x0c nic ring address max_len host send ring control block 1st 1st ring element 512th ring element www.datasheet.in bcm57xx programmer?s guide 01/29/08 broadcom corporation page 138 send rings document 57xx-pg105-r nic-b ased s end r ing the send buffer descriptors of a send ring could reside in nic memory. this mode of operation is referred to as nic-based send ring. the host software configures the bcm57xx family to operate in this mode by clearing the mode_control.host_send_bds bit at offset 0x6800 and the rcbs of the send rings configured accordingly as described in the ?ring control block? on page 136 . the bcm5705, bcm5788, bcm5721, bcm5751, bcm5752, bcm5714c, bcm5714s, bcm5715c, and bcm5715s devices do not support nic based send rings. each nic-based send ring has 128 buffer descriptors. the location of these descriptors is located in the nic memory at offset 0x4000. this area is used as the staging area when the bcm57xx family is configured to operate in the host-based send ring mode. in the nic-based send ring mode, the host software initializes the buffer descriptors directly in the nic memory, and then increments the producer index by the number of initialized descriptors. the new index is then written to the corresponding send ring nic producer index mailbox register (starting at offset 0x380 for host standard and flat modes and offset 0x5980 for indirect mode?see ?send bd ring 1-16 nic producer indices registers (offset 0x380-0x3f8)? on page 374 and ?send bd ring 1-16 nic producer indices registers (offset 0x5980-0x59f8, bcm5700 and bcm5701 only)? on page 493 ), which may trigger an event for the bcm57xx family to process the descriptors. eventually, the data associated with descriptors are transferred onto the network. the bcm57xx family maintains the send ring consumer index, which is incremented as it processes the send ring buffer descriptors. the bcm57xx family informs the host software of its progress by updating the consumer index in the status block. the host software uses the consumer index and its producer index to determine the empty slots in the send ring. the bcm57xx family implements an algorithm that periodically dmas the status block to host memory in an efficient manner. there are 16 (4 if there is no external memory) nic-based send rings each containing 128 descriptors. the host software may extend the ring size to 512 descriptors by combining four adjacent send rings into one; however, the total ring count is reduced to four from sixteen when external ssram is present and to one from four when only device internal memory is used. the host device driver should assert the 4x_size_nic_based_send_ring bit in the mode control register (see ?mode control register (offset 0x6800)? on page 502 ) for extending the nic based send ring size. the rings are combined in the manner shown in table 60 . table 60: combining send rings ring offset description 1 0x4000 combine rings 1 - 4 2 0x6000 combine rings 5 - 8 (must have external memory) 3 0x8000 combine rings 9 - 12 (must have external memory) 4 0xa000 combine rings 13 - 16 (must have external memory) www.datasheet.in programmer?s guide bcm57xx 01/29/08 broadcom corporation document 57xx-pg105-r send rings page 139 h ost -b ased s end r ing the send buffer descriptors of a send ring could reside in host memory. this mode of operation is referred to as host-based send ring. the host software configures the bcm57xx family to operate in this mode by setting the mode_control.host_send_bds bit at offset 0x6800 and the rcbs of the send rings configured accordingly as described in ?ring control block? on page 136 . the bcm5700 with external memory supports up to 16 host based send rings. the bcm5700 with only internal memory, bcm5701, bcm5702, BCM5703c, BCM5703s, bcm5704c, and bcm5704s devices support up to 4 host based send rings. the bcm5705, bcm5788, bcm5721, bcm5751, bcm5752, bcm5714c, bcm5714s, bcm5715c, and bcm5715s devices support only one host based send ring. each host-based send ring has 512 buffer descriptors, which are periodically and transparently dmaed to a staging area inside the nic?s internal memory where they are waiting to be consumed. the staging area can hold up to 128 entries per- ring, and bcm57xx family will try to keep the staging area full at all times by constantly monitoring the consumer and producer index (the algorithm for accomplishing this is beyond the scope of this manual). the staging areas are located at a starting offset 0x4000 of nic memory. figure 58 illustrates the relationship between the send buffer descriptors in host memory and the staging area in nic memory. whenever the host software initializes new buffer descriptors, its send ring producer index is incremented by the number of descriptors. the new index is then written to the corresponding send ring host producer index mailbox register (starting at offset 0x300 for host standard and flat modes and offset 0x5900 for indirect mode?see ?send bd ring 1-16 host producer indices registers (offset 0x300-0x378)? on page 374 and ?send bd ring 1-4 host producer indices registers (offset 0x5900-0x5918)? on page 493 ), which may trigger the bcm57xx family to dma the descriptors to its staging area. eventually, the buffer descriptors are processed, and the dat a associated with these descriptors is transferred onto the network. figure 58: relationship between send buffer descriptors the bcm57xx family maintains the ring consumer index, wh ich is incremented as it processes the descriptors. the bcm57xx family informs the host software of its progress by updating the consumer index in the status block. the host software uses the consumer index and its producer index to determine the empty slots in the ring. the bcm57xx family implements an algorithm that periodically dmas the status block to host memory in an efficient manner. send bd 1 send bd 2 send bd 3 send bd 4 send bd 5 send bd 7 send bd 8 ... send bd 6 send bd 512 send bd 1 send bd 128 ... ... send buffer descriptors in host memory send buffer descriptors i n nic memory producer consumer send bd n+2 send bd n send bd n+1 dma www.datasheet.in bcm57xx programmer?s guide 01/29/08 broadcom corporation page 140 checksum offload document 57xx-pg105-r c hecksum o ffload as network speed increases, offloading is becoming an important feature, and the ability to offload tasks from the host processor aids in the efficiency of the host and in overall system performance. to achieve a significant performance boost, most operating systems now a days offer a mechanism for the tcp/ip protocol stack to offload checksum calculations to the device. the host software can configure the bcm57xx family to calculate ip, tcp, and udp checksum as described in rfc 791, rfc 793, and rfc 768 respectively. the first step in checksum calculation is determining the start of an ip and udp datagram and tcp segment within a frame, which could vary depending on whether the frame is tagged (vlan) or encapsulated with llc/snap header. then the checksum is computed from the start to the end of the datagram and inserted into the appropriate location in protocol header. bcm57xx family is designed to support checksum calculation on all frame types and also on ip datagram and tcp segments containing options. in order for the bcm57xx family to compute the checksum and insert it into the outgoing frame, the host software must set the appropriate control bits in the send buffer descriptors associated with the frame and seed the checksum field with zero or with the pseudo header checksum. the host software enables ip checksum calculation by setting the ip_chksum bits in all the send buffer descriptors associated with the frame. the bcm57xx family inserts the checksum into the checksum field of the ip header. to enable tcp or udp checksum calculation, the host software must set the tcp_udp_cksum bit in all the send buffer descriptors associated with the frame containing the entire udp datagram or tcp segment. however, if tcp segment is fragmented into ip fragments (each contained within a frame), all the send buffer descriptors of the ip fragments must also have the ip_frag bit set except for the last descriptor, which has the ip_frag_end bit set. also, the descriptors must be consecutive and in the correct order. the udp checksum engine does not span ip fragmented frames. the ip_frag and ip_frag_end flags do not enable udp checksum capability when the ip layer has fragmented the udp message. the host software can configure the bcm57xx family to disable tcp or udp pseudo-header checksum calculation by setting the mode_control.send_no_pseudo_header_checksum bit. when set, the host software must seed the checksum field in the tcp or udp header with the pseudo-header checksum. if the mode_control.send_no_pseudo_header_checksum is cleared, the bcm57xx family will compute the checksum including the pseudo header and insert it into the checksum field. www.datasheet.in programmer?s guide bcm57xx 01/29/08 broadcom corporation document 57xx-pg105-r scatter/gather page 141 s catter /g ather most often, the host software requests the nic to transmit a frame that spans several physical fragments that are arbitrary in size and buffer alignment. this requires the bcm57xx family to gather all these fragments during a dma process into a continuous data stream for transmission. on the other hand, the bcm57xx family is also capable of scattering incoming frame into several physical fragments. the ability to scatter/gather a frame lessens the restriction on the host software and increases overall system performance. for example, a tcp/ip protocol stack could preconstruct th e mac and ip headers in separate buffers that are combined with the payload to form a complete frame. since the header data are fairly constant during a tcp or udp session, the stack could use the same header buffers for the next frame. the bcm57xx family uses a buffer descriptor for describing a physical fragment. there are two types of buffer descriptors; the receive mac processes receive buffer descriptors (r eceive bd) and the transmit mac processes send buffer descriptors (send bd). figure 59 illustrates the relationship between a frame consisting of multiple fragments and their corresponding send buffer descriptors. figure 59: scatter gather of frame fragments to transmit a frame, the host software sets up consecutive buffer descriptors in a send ring. each buffer descriptor describes a physical fragment of a frame. as an example, the above figure illustrates a frame consisting of five fragments that are scattered throughout host memory. frag1, the first fragment, is at the start of the frame, and frag5, the last fragment, is at the end of a frame. for each fragment, there is a correspo nding buffer descriptor, sendbd1 through sendbd5. these buffer descriptors must be initialized in the send ring in a consecutiv e order, sendbd1 to sendbd5. the last send buffer descriptor of a frame must have the packet_end bit of send bd flags field set to indicate the end of a frame. send bd 3 frame fragments frag 2 frag 5 frag 4 frag 1 send bd 1 send bd 2 send bd 4 send bd 5 frag 3 send buffer descriptors buffers buffer 1 buffer 2 buffer 3 buffer 4 buffer 5 tx fifo tx mac dma www.datasheet.in bcm57xx programmer?s guide 01/29/08 broadcom corporation page 142 vlan tag insertion document 57xx-pg105-r vlan t ag i nsertion the bcm57xx family is capable of inserting 802.1q compliant vlan tags into transmitted frames and extracting the tags from received frames. a frame containing the 802.1q vlan tag has the value tpid (tag protocol identifier) value in the ethertype field followed by a 16-bit tci (tag control information) field, which is made up of one cfi bit, 3 802.1p priority bits, and a 12-bit vlan id. the original 16-bit ethertype/length field follows the tci field. table 59 on page 130 shows the frame format with 802.1q vlan tag inserted. the bcm57xx family allows the host software to enable or disable tag insertion on a per-packet basis. to send a frame with a vlan tag, the host software must initialize the first send buffer descriptor of a packet with the vlan tag value and set the vlan_tag bit of send bd flags field (see ?send rings? on page 135 ). tx d ata f low d iagram figure 60 on page 143 illustrates how a frame, consisting of several fragments, is sent from the host to the nic and onto the network. for simplicity, the diagram depicts the operation of a single ring. 1. the host software calls a system api to retrieve the three physical fragments of the frame. it initializes the next three send buffer descriptors to point to each fragment. the send buffer descriptors reside in host memory or nic memory depending on how the send rings are configured (see ?send rings? on page 135 ). internally, the host software maintains the ring?s producer index. in this case, the producer index is incremented by three because there are three fragments. 2. the host software updates the send producer index by writing the value to ring?s send producer index mailbox at offset 0x300 for host standard and flat modes and offset 0x5900 for indirect mode. the update triggers the bcm57xx family to process the send buffer descriptors. 3. if the bcm57xx family is operating the host-based send ring mode, three send buffer descriptors are dmaed to the ring?s staging area in nic memory as indicated in the rcb. 4. the bmc5700 dmas the frame (as described in the descriptors) to its internal memory for transmission. 5. internally, the bcm57xx family maintains the ring?s consumer index, which is incremented as it processes the descriptors. 6. the new consumer index is written to the status block in nic memory (see ?status block? on page 103 ). 7 the status block is dmaed to host memory. this dma is subject to host coalescing, and the nic may generate an in- terrupt at this point. www.datasheet.in programmer?s guide bcm57xx 01/29/08 broadcom corporation document 57xx-pg105-r tx data flow diagram page 143 the following figure shows the basic driver flow to send a packet. figure 60: transmit data flow nic memory host memory send bd 1 ... send bd 2 send bd 3 send bd 4 send bd 5 send bd 6 send bd 7 send bd 8 sendbd 512 frame buffer 1 buffer 2 buffer 3 send producer index buffer 3 buffer 2 buffer 1 tx info tx mac send consumer index status block status block 1 2 3 4 5 6 7 send bd 1 ... send bd n send bd n+1 send bd n+2 sendbd 128 ... fifo www.datasheet.in bcm57xx programmer?s guide 01/29/08 broadcom corporation page 144 tx data flow diagram document 57xx-pg105-r figure 61: basic driver flow to send a packet get the virtual address and length of the next buffer in packet is the nic enabled to send packets? does the nic have enough free send bd's to send the packet? get the virtual address and length of the first buffer in packet fill out a send bd with the info (address, length, flags) that corresponds to this physical host fragment update the send producer index. this tells the hw that a new packet is ready to be transmitted examine packet (if necessary) and decide which send ring to use. is this the last virtual buffer for this packet? set bd_flag_end bit in send bd make os call to lock down the virtual buffer in host memory and get the corresponding physical address(es) queue packet for later transmission. return appropriate status code to os return appropriate error code to os. allocate the next available send bd from a free list of pre-allocated send bds for a given send ring os asks nic driver to send a packet yes no no yes no yes is this the last physical fragment of the virtual buffer? yes get the physical address and length of the next physical fragment for the virtual buffer no www.datasheet.in programmer?s guide bcm57xx 01/29/08 broadcom corporation document 57xx-pg105-r transmitting jumbo frames page 145 t ransmitting j umbo f rames the mechanism to transmit a jumbo frame in bcm57xx netx treme devices is exactly same as transmitting a normal ethernet frame as described in ?tx data flow diagram? on page 142 . the bcm5700, bcm5701, bcm5702, BCM5703c, BCM5703s, bcm5704c, bcm5704s, bcm5714c, bcm5714s, bcm5715c, and bcm5715s support the jumbo frames. in bcm5714c, bcm5714s, bcm5715c, and bcm5715s devices, the following hardware modifications have been made in the transmit data path to be able to store up to two jumbo frames in the transmit mbuf memory. increased the tx mbuf to 22 kb (176 mbufs). this total of 176 mbufs can be configured as: ? 173 mbufs for tx packet + 3 mbufs for ipmi messages ? 163 mbufs for tx packet + 13 mbufs for ipmi messages ? 158 mbufs for tx packet + 18 mbufs for ipmi messages ? 141 mbufs for tx packet + 35 mbufs for ipmi messages note: the bcm5714c, bcm5714s, bcm5715c, and bcm5715s devices cannot transmit jumbo frames when large send offload (lso) feature of these devices is enabled. this is because the lso engine will always breakup up the large tcp segment into a normal sized ethernet frames for transmission on ethernet media. also, note that the cpu cannot transmit a jumbo frame using the mbufs reserved for asf/ipmi messages, since only a maximum of 35 mbufs can be reserved for asf/ipmi messages. www.datasheet.in bcm57xx programmer?s guide 01/29/08 broadcom corporation page 146 device control document 57xx-pg105-r section 8: device control i nitialization d escription this section provides programmers a procedure for initializing the netxtreme family of devices. there is a specific sequence of steps that must be taken to enable this device. this section assumes the host programmer can allocate physical memory for various control blocks using os/rtos specific methods. ring control blocks (rcbs) and buffer descriptors (bds) all require host physical addresses; the mac uses bus-master dma to move packet data to host memory. the methods for allocation and de-allocation of host physical memory are beyond this document?s scope. i nitialization p rocedure this section lists the initializing procedure for the mac portion of the netxtreme family of devices. 1. enable mac memory space decode and bus mastering (optional). if the device has not been initialized previously (power on reset), the host software must enable these bits to issue the core clock reset in step 7. set the bus_master and memory_space bits in the pci configuration space command register (see ?command register (offset 0x04)? on page 302 ). 2. disable interrupts (optional). if the device has not been initialized previously (power-on reset), the host software should disable and clear interrupts prior to the core_clock reset in step 7. set the mask_pci_interrupt_output and clear_interrupt_inta bits in the miscellaneous host control register (see ?miscellaneous host control register (offset 0x68)? on page 325 ). 3. save the pci cache line size register and pci subsystem vendor id registers (see ?cache line size register (offset 0x0c)? on page 305 and ?subsystem id register (offset 0x2e)? on page 309 ) in the pci configuration space to temporary variables. these registers must be restored after a core clock reset in step 7. 4. acquire the nvram lock for bcm5702 and later devices by setting the req_set1 bit of the software arbitration register (see ?software arbitration register (offset 0x7020)? on page 555 ) and then waiting for the arb_won1 bit to be set. 5 prepare the chip for writing t3_magic_number to device memory location 0xb50. a. set the enable bit in the memory arbiter mode register (see ?memory arbiter mode register (offset 0x4000)? on page 460 ). b. set the enable_indirect_access bit of the miscellaneous host control register (see ?miscellaneous host control register (offset 0x68)? on page 325 ). c. initialize the endian_word_swap and endian_byte_swap bits of miscellaneous host control register (offset 0x68) depending on the host platform endianness (this step is required only if indirect a ccess registers are accessed through memory mapped accesses). d. initialize the byte_swap_non_frame_data and word_swap_non_frame_data bits of mode control register (offset 0x6800) to the required values depending on the host platform endianness. 6. write the t3_magic_number (i.e., 0x4b657654) to the mac memory at 0xb50 to notify the bootcode that the following reset is a warm reset. www.datasheet.in programmer?s guide bcm57xx 01/29/08 broadcom corporation document 57xx-pg105-r initialization page 147 7. reset the core clocks. set the core_clock_blocks-reset bit in the general control miscellaneous configuration register (see ?miscellaneous configuration register (offset 0x6804)? on page 504 ). the gphy_power_down_override bit (bit-26) should also be set for the following macs: ? bcm5705 ? bcm5788 ? bcm5721 ? bcm5751 ? bcm5752 ? bcm5714c ? bcm5715c ? bcm5715s the disable_grc_reset_on_pci-e_block bit (bit-29) should also be set for the following pcie macs: ? bcm5721 ? bcm5751 ? bcm5752 8. wait for core-clock reset to complete. software should wait 100 s for pci and pci-x systems, and 100 ms for pcie systems. the core clock reset will disable indirect mode and flat/standard modes?software cannot poll the core-clock reset bit to de-assert, since the local memory interface is disabled by the reset. 9. disable interrupts. set the mask_pci_interrupt_output bit in the miscellaneous host control register (see ?miscellaneous host control register (offset 0x68)? on page 325 ). the bit was reset after the core_clock reset, and interrupts must be masked off again. 10. enable mac memory space decode and bus mastering. set the bus_master and memory_space bits in the pci configuration space command register (see ?command register (offset 0x04)? on page 302 ). 11. disable pci-x relaxed ordering. clear the enable_relax order bit in the pci-x command register (see ?command register (offset 0x04)? on page 302 ). 12. enable the mac memory arbiter. set the enable bit in the memory arbiter mode register (see ?memory arbiter mode register (offset 0x4000)? on page 460 ). make sure that no other bits of this register are modified in case of bcm5714c, bcm5714s, bcm5715c, and bcm5715s macs as these controllers use bits 31-30 of this register for configuration of number of txmbufs allocated for on-chip risc processor. 13. enable external memory (optional). this step is only necessary if your application uses external ssram (bcm5700 mac only). write the external_memory_enable, size of extra memory and, external_memory_bank_select bits to the miscellaneous local control register (see ?miscellaneous local control register (offset 0x6808)? on page 507 ). wait 10 ms for external memory to initialize (optional). polling is not required. 14. initialize the miscellaneous host control register (see ?miscellaneous host control register (offset 0x68)? on page 325 ): a. set endian word swap (optional). when the host processor architecture is big endian, the mac may wordswap data, when acting as a pci target device. set the enable_endian_word_swap bit in the miscellaneous host control register. b. set endian byte swap (optional). when the host processor architecture is big-endian, the mac may byteswap data, when acting as a pci target device. set the enable_e ndian_byte_swap bit in the miscellaneous host control register. c. enable the indirect register pairs (see ?indirect mode? on page 185 ). set the enable_indirect_access bit in the miscellaneous host control register. d. enable the pci state register to allow the device driver read/write access by setting the enable_pci_state_register bit in the miscellaneous host control register e. enable the pci clock control register (see ?pci clock control register (offset 0x74)? on page 334 ) to allow the device driver read/write access by setting the enable_clock_control_register bit in the miscellaneous host control www.datasheet.in bcm57xx programmer?s guide 01/29/08 broadcom corporation page 148 initialization document 57xx-pg105-r register (see ?miscellaneous host control register (offset 0x68)? on page 325 ). 15. set byte_swap_non_frame_data and byte_swap_data in the general mode control register (see ?mode control register (offset 0x6800)? on page 502 ). 16. set word_swap_data and word_swap_non_frame_data (optional). when the host processor architecture is little- endian, set these additional bits in the general mode control register (see ?mode control register (offset 0x6800)? on page 502 ). 17. poll for bootcode completion (optional for embedded applications that will not use the broadcom bootcode firmware). the device driver should poll the general communication memory at 0xb50 (see table 82 on page 171 in ?memory maps and pool configuration? on page 171 ) for the one?s complement of the t3_magic_number (i.e., 0xb49a89ab). the bootcode should complete initialization within 1000 ms for flash devices and 10000 ms for seeprom devices. 18 initialize the ethernet mac mode register (see ?ethernet mac mode register (offset 0x400)? on page 377 ). write the value 0x00000000 to this register for all copper controllers and write the value 0x0000000c for BCM5703s and bcm5704s serdes fiber controllers. the bcm5714s and bcm5715s use the gmii to talk to the integrated 1000-base- x phy and hence write 0x00000000 to mac mode register for these controllers also. 19. enable the pcie bug fix for bcm5721, bcm5751, and bcm5752 macs by setting the bits 25 and 29 of the tlp control register at offset 0x7c00 without modifying the other bits of this register. 20. enable data fifo protection for bcm5721, bcm5751, and bcm5752 pcie macs by setting the data_fifo_protect bit of the tlp control register (see ?tlp error counter register (offset 0x7d40)? on page 592 ). 21. enable the hardware fixes for the bcm5704 b0 and later versions by setting the bits 10, 12, and 13 of the hardware fix register at offset 0x66. 22. enable tagged status mode (optional) by setting the enable_tagged_status_mode bit of the miscellaneous host control register (see ?miscellaneous host control register (offset 0x68)? on page 325 ). (for further information on tagged status mode see ?interrupt processing? on page 287 ). 23. restore the pci cache line size and pci subsystem vendor id registers (see ?cache line size register (offset 0x0c)? on page 305 and ?subsystem vendor id register (offset 0x2c)? on page 307 ) in the pci configuration space. these registers were cleared by the core clock reset. 24. clear the mac statistics block for by writing zeros to the bar+0x300 to bar+0xb00 to clear the statistics block in mac local memory. this step is not required for bcm5705, bcm5788, bcm5721, bcm5751, bcm5752, bcm5714c, bcm5714s, bcm5715c, and bcm5715s macs as these devices support the statistics in register space (offset 0x800- 0x8ff) instead of device memory space. 25. clear the driver statistics memory region. write zeros to the host memory region where the statistics block will be dma'd (see ?statistics block? on page 107 ). this step is not required for bcm5705, bcm5788, bcm5721, bcm5751, bcm5752, bcm5714c, bcm5714s, bcm5715c, and bcm5715s macs as these devices do not support the dma of device statistics to host memory at regular intervals. 26. clear the driver status memory region. write zeros to the host memory region where the status block will be dmaed (see ?statistics block? on page 107 ). 27. set the default pci command encoding for read/write transactions (see ?pci command usage? on page 209 ). the default_pci_write_command and default_pci_read_command bi ts in the dma read/write control register (see ?dma read/write control register (offset 0x6c)? on page 327 ) must be initialized since they are zeroed after a device reset. also initialize the dma read and write watermarks. note: this register is not cleared by the core clock reset above. www.datasheet.in programmer?s guide bcm57xx 01/29/08 broadcom corporation document 57xx-pg105-r initialization page 149 28. set dma byte swapping (optional). if the host processor architecture is big-endian, the mac may byte swap both control and frame data, when acting as a pci dma master. set the byte_swap_non-frame_data, byte_swap_data and word_swap_data bits in the general mode control register (see ?mode control register (offset 0x6800)? on page 502 ). 29. configure the host-based send rings. if the device driver intends to keep the send ring(s) in host local storage rather mac memory, the host_send_bds bit in the general mode control register (see ?mode control register (offset 0x6800)? on page 502 ) should be set. the host_send_bds bit should be set for bcm5705, bcm5788, bcm5721, bcm5751, bcm5752, bcm5714c, bcm5714s, bcm5715c, and bcm5715s macs as these devices support only one send ring that is host based. 30. indicate driver is ready to rx traffic. set the host_stack_up bit in the general mode control register (see ?mode control register (offset 0x6800)? on page 502 ). 31. configure tcp/udp pseudo header checksum offloading. this step is relevant when tcp/udp checksum calculations are offloaded to the device. the device driver may optionally disable receive and transmit pseudo header checksum calculations by the device by setting the receive_no_pseudoheader_checksum and send_no_pseudoheader_checksum bits in the general mode control register (see ?mode control register (offset 0x6800)? on page 502 ). if the send_no_psuedoheader_checksum bit is set, the host software should make sure of seeding the correct pseudo header checksum value in tcp/udp checksum field. similarly if the receive_no_psuedoheader_checksum bit is set, the device driver should calculate the pseudo header checksum and add it to the tcp/udp checksum field of the received packet. table 61: recommended bcm57xx setting for the dma read/write control register broadcom mac recommended value bcm5700, bcm5701 0x763f000f in pci bus mode (i.e., if bit-2 of 0x70 is 0) 0x761b000f in pci-x bus mode (i.e., if bit-2 of 0x70 is 1) bcm5702 0x763f000f BCM5703c, BCM5703s, bcm5704c, and bcm5704s 0x763f0000 in pci bus mode (i.e., if bit-2 of 0x70 is 0) 0x769f0000 in pci-x 33-mhz/50-mhz/66-mhz bus modes (i.e., if bit 2 of 0x70 is 1, and bits 4?0 of 0x74 is 0, 2, or 4) 0x769f4000 in pci-x 100-mhz/133-mhz bus modes (i.e., if bit-2 of 0x70 is 1, and bits4?0 of 0x74 is 6 or 7) bcm5721, bcm5751, and bcm5752 0x76180000 if the maxpayloadsize is 128 (i.e., bits 7?5 of 0xd8 = 000) 0x76380000 if the maxpayloadsize is 256 (i.e., bits 7?5 of 0xd8 = 001) bcm5705, bcm5788 0x763f0000 bcm5714c, bcm5714s, bcm5715c, and bcm5715s 0x76144000 note: host software should be careful not to set the route_multicast_frames_to_risc core bit unless custom firmware has been developed for multicast frame handling. if this bit is set inadvertently, transmit frames (e.g., arp, broadcast) may be routed to the risc core and the data path will stall. host software will observe bd and frame buffers continue to dma, but frames will not go out to the wire. eventually, the mac will run out of internal memory and both rx/tx will stall. note: some 57xx family adapters may calculate an incorrect pseudo-header checksum if the send_no_pseudoheader_checksum is left at the default value of 0. check the latest chip errata for affected chips and suggested workarounds. broadcom's drivers will always set this bit. www.datasheet.in bcm57xx programmer?s guide 01/29/08 broadcom corporation page 150 initialization document 57xx-pg105-r 32. configure the frequency of mac?s free running 32-bit timer at offset 0x680c. the timer_prescaler bit field in the general control miscellaneous configuration register (see ?miscellaneous configuration register (offset 0x6804)? on page 504 ) sets the local frequency of this timer. this timer at 0x680c offset increments once every timer_prescalar number of core clock cycles. the core clock of the device runs at 66mhz and hence the device driver software should configure the timer_prescalar field with 0x41, or 65 decimal for the 0x680c timer to increment by one every 1 us. 33 configure mac local memory pool. the mac uses device local memory to buffer packets that will be dmaed to/from host memory. host software needs to program the pool address differently based on the capabilities of the device. for example, external ssram will influence the pool location and size of bcm5700 device. the mbuf pool base address and mbuf pool length registers (see ?memory maps and pool configuration? on page 171 ) must be configured during initialization. table 62 and table 63 show the recommended configurations for the bcm57xx internal and bcm5700 external memory pool settings. 34. configure mac dma resource pool (for bcm5700/5701/5702/5703/5704 only). the bcm5700, bcm5701, bcm5702, 5703c, 5703s, and 5704 macs use device local memory for dma resources. these resources are necessary for bus master dma to the host memory space. host software must configure the dma pool base address and dma pool length registers (see ?buffer manager control registers? on page 466 ) during initialization (see table 64 ). the device driver must allocate 8k for dma resources. table 62: recommended bcm57xx internal memory-only memory pool settings register bits recommended value mbuf pool base address all 0x8000 for bcm5700, bcm5701, bcm5702, and BCM5703 0x10000 for bcm5704c andbcm5704s do not overwrite the bootcode settings for bcm5705, bcm5788, bcm5721, bcm5751, bcm5714c, bcm5714s, bcm5715c, bcm5715s, and bcm5752 mbuf pool length all 0x18000 0x10000 for bcm5704c and bcm5704s do not overwrite the bootcode settings for bcm5705, bcm5788, bcm5721, bcm5751, bcm5714c, bcm5714s, bcm5715c, bcm5715s, and bcm5752 note: in the bcm5705, bcm5788, bcm5721, bcm5751, bcm5714c, bcm5714s, bcm5715c, bcm5715s, and bcm5752 mac-transceivers, the default initialization values after reset for the mbuf pool base address is 0x10000 and the mbuf pool length is 0x8000. the risc scratchpad memory needs to be reserved out of the rx mbuf for these macs and hence the bootcode calculates and sets the mbuf pool base address and mbuf pool length registers of these macs. so, broadcom recommends to not to change these mbuf pool registers from driver softwa re unless the driver software is loading a special firmware into the risc scratch pad memory that needs to be reserved out of the rx mbuf memory. for designs without nvram (and hence bootcode), broadcom recommends that the host driver use the default values of mbuf pool registers rather than setting these registers. if it is required to modify either of the mbuf pool registers, then driver software should clear the contents of rxmbuf memory and set the reset rxmbuf pointer bit of the buffer manager mode register (offset 0x4400) note: for external memory use with the bcm5700 mac, set enable_external_memory and sram_size in grc miscellaneous local control register (see ?miscellaneous local control register (offset 0x6808)? on page 507 ) before setting mbuf pool base address and mbuf pool length (see table 63 ). table 63: recommended bcm5700 external ssram memory pool settings register bits recommended value mbuf pool base address all 0x20000 mbuf pool length all pool size dependent on hardware application www.datasheet.in programmer?s guide bcm57xx 01/29/08 broadcom corporation document 57xx-pg105-r initialization page 151 35. configure mac memory pool watermarks. broadcom has run hardware simulations on the mbuf usage and strongly recommends the settings shown in table 65 . these settings/values will establish proper operation for 10/100/1000 speeds. host software must configure the read dma mbuf low watermark, mac rx mbuf low watermark, and mbuf high watermark registers (see ?read dma mbuf low watermark register (offset 0x4410)? on page 469 , ?mac rx mbuf low watermark register (offset 0x4414)? on page 470 , and ?mbuf high watermark register (offset 0x4418)? on page 470 ) during initialization. 36. configure dma resource watermarks. broadcom has run hardware simulations on the dma resource usage and the recommendations shown in table 66 are strongly encouraged. these settings/values will establish proper operation for 10/100/1000 speeds. host software must configure the dma descriptor low watermark and dma descriptor high watermark registers (see ?dma descriptor pool low waterm ark register (offset 0x4434)? on page 473 and ?dma descriptor pool high watermark register (offset 0x4438)? on page 473 ) during initialization. table 64: recommended bcm57xx dma resource pool settings register bits recommended value dma descriptor pool base address all 0x2000 dma descriptor pool length all 0x2000 table 65: recommended bcm57xx mac memory pool watermark settings register mini frames standard frames (bcm5700/5701/ 5702/5703/5704) standard frames (bcm5705/5788/ 5721/5751/5714/ 5715/5752) jumbo frames (bcm 5700/ 5701/5702/ 5703/5704) jumbo frames (5714c/5714s/ 5715c/5715s) read dma mbuf low watermark 0x0 0x50 0x00 0x130 0x00 mac rx mbuf low watermark 0x10 0x20 0x10 0x98 0x4b mbuf high watermark 0x60 0x60 0x60 0x17c 0x96 note: the low watermark max receive frames register (0x504) specifies the number of good frames to receive after rxmbuf low watermark has been reached. the driver software should make sure that the mac rxmbuf low watermark is greater than the number of mbufs required for receiving the number of frames as specified in 0x504. the first mbuf in the mbuf chain of a frame will have 80 bytes of packet data while each of the subsequent mbufs except the last mbuf will have 120 bytes for packet data. the last mbuf in the chain will have the rest of the packet data which can be up to 120 bytes. table 66: recommended bcm57xx dma memory pool watermark settings register bits recommended value dma descriptor low watermark all 5 dma descriptor high watermark all 10 www.datasheet.in bcm57xx programmer?s guide 01/29/08 broadcom corporation page 152 initialization document 57xx-pg105-r 37. configure flow control behavior when the low watermark level has been reached (see table 67 and ?low watermark maximum receive frames register (offset 0x504)? on page 394 ). please see the note above in step-35. 38. enable the buffer manager. the buffer manager handles the internal allocation of memory resources for send and receive traffic. the enable and attn_enable bits shou ld be set in the buffer manager mode register (see ?buffer manager mode register (offset 0x4400)? on page 467 ). 39 poll for successful start of buffer manager. poll the enable bit in the buffer manager mode register (see ?buffer manager mode register (offset 0x4400)? on page 467 ) for 10 ms. this test ensures the buffer manager successfully starts from the previous step. the enable bit will remain de-asserted until the buffer manager starts, at which point it will reflect an asserted state. 40. enable internal hardware queues. the mac architecture uses internal queues to pass messages between functional blocks. these messages coordinate rx/tx traffic flows. device drivers need to enable these queues so the hardware blocks can pass messages. host software must set and then reset the bits in the ftq reset register (see ?ftq reset register (offset 0x5c00)? on page 494 ) to start internal queues: a. first, host software should write 0xffffffff to the ftq reset register. b. second, host software should clear the ftq reset register by writing 0x00000000. 41. initialize the standard receive buffer ring. host software should write the ring control block structure (see ?ring control blocks? on page 91 ) to the standard receive bd ring rcb register (see ?standard receive bd ring rcb register (offset 0x2450)? on page 439 ). host software should be careful to initialize the host physical memory address based on allocation routines specific to the os/rtos. table 68 and table 69 show the recommended standard ring initialization settings. table 67: recommended bcm57xx low watermark maximum receive frames settings register bits recommended value low water mark maximum receive frames all 2 table 68: recommended bcm57xx standard ring initialization settings for internal memory only rcb data field recommended value notes nic ring address(32-bits) 0x6000 max_length 0x600 (for bcm5700/5701/5702/5703c/5703s/ 5704c/5704s) 0x200 (for bcm5705/5788/5721/5751/5752) 0x200 (for 5714c/5714s/5715c/5715s when standard rx bds are used) 0x100 (for 5714c/5714s/5715c/5715s when extended rx bds are used) max size enet frame + vlan tag number of elements in the ring valid maximum value is 0x200 number of elements in the ring table 69: recommended bcm5700 standard ring initialization settings for external ssram rcb data field recommended value notes nic ring address (32-bits) 0xc000 max_length 0x600 max size enet frame + vlan tag www.datasheet.in programmer?s guide bcm57xx 01/29/08 broadcom corporation document 57xx-pg105-r initialization page 153 42 initialize the jumbo receive buffer ring (optional?bcm5700/5701/5702/5703c/5703s/5704c/5704s only). host software should write the ring control block structure (see ?ring control blocks? on page 91 ) to the jumbo receive bd ring rcb register (see ?jumbo receive bd ring rcb register (offset 0x2440)? on page 438 ). host software should be careful to initialize the host physical memory address based on allocation routines specific to the os/rtos. table 70 and table 71 show the recommended jumbo ring initialization settings. 43. initialize the mini receive buffer ring (optional. bcm5700/5701/5702/5703c/5703s/5704c/5704s only). mini receive producer rings are only available to applications with external ssram. host software should write the ring control block structure (see ?ring control blocks? on page 91 ) to the mini receive bd ring rcb register (see ?mini receive bd ring rcb register (offset 0x2460)? on page 439 ). host software should be careful to initialize the host physical memory address based on allocation routines specific to the os/rtos. table 72 shows the recommended mini ring initialization settings. 44. set the bd ring replenish thresholds for mini, standard, and jumbo rx producer rings. the threshold values indicate the number of buffer descriptors that must be indicated by the host software before a dma is initiated to fetch additional receive descriptors in order to replenish used receive descriptors. software should configure the following registers: ? mini receive bd ring replenish threshold (see ?mini receive bd producer ring replenish threshold register (offset 0x2c14)? on page 443 ) note: host software must insure that on systems that support more than 4 gb of physical memory, send rings, receive return rings, producer rings, and packet buffers are not allocated across the 4 gb memory boundary. for example, if the starting memory address of the standard receive buffer ring is below 4 gb and the ending address is above 4 gb, a read dma pci host address overflow error may be generated (see ?read dma status register (offset 0x4804)? on page 479 ). table 70: recommended bcm57xx jumbo ring initialization settings for internal memory only rcb data field recommended value notes nic ring address (32-bits) 0x7000 flags rcb_use_ext_recv_bd extended buffer descriptors. flags rcb_flag_ring_disabled default the ring disabled until initialization is complete. table 71: recommended bcm5700 jumbo ring initialization settings for external ssram rcb data field recommended value notes nic ring address (32-bits) 0xd000 flags rcb_use_ext_recv_bd extended buffer descriptors. flags rcb_flag_ring_disabled default the ring disabled until initialization is complete. table 72: recommended bcm5700 mini ring initialization settings for external ssram rcb data field recommended value notes nic ring address (32-bits) 0xe000 flags rcb_flag_ring_disabled default the ring disabled until initialization is complete. www.datasheet.in bcm57xx programmer?s guide 01/29/08 broadcom corporation page 154 initialization document 57xx-pg105-r ? standard receive bd ring replenish threshold (see ?standard receive bd producer ring replenish threshold register (offset 0x2c18)? on page 443 ) ? jumbo receive bd ring replenish threshold (see ?jumbo receive bd producer ring replenish threshold register (offset 0x2c1c)? on page 443 ) broadcom suggests setting the rx jumbo and rx mini producer rings to 1/8 of the total ring size. table 73 shows some example replenish threshold settings based on the maximum number of bds allocated. 45. disable unused send producer rings (bcm5700/5701/5702/5703c/5703s/5704c/5704s only). host software should write the rcb flag bit rcb_flag_ring_disable for all send rings that will not be utilized in the implementation. a maximum of four send rings are available, when the application implements device internal memory only (no external ssram). the bcm5700 can support up to 16 send rings when external ssram is used. the send rcbs are located in the device miscellaneous memory region from 0x100 to 0x1ff. 46. initialize send producer index registers in mailbox. clear (i.e., zero) the send bd ring1-16 host producer index and send bd ring1-16 nic producer index registers (see ?send bd ring 1-16 nic producer indices registers (offset 0x380-0x3f8)? on page 374 and for host standard and flat modes). if host software is using register indirect mode, the send bd ring 1-16 producer indices registers (see ?send bd ring 1-4 host producer indices registers (offset 0x5900- 0x5918)? on page 493 and ?send bd ring 1-16 nic producer indices registers (offset 0x5980-0x59f8, bcm5700 and bcm5701 only)? on page 493 ) may be cleared. it is unnecessary to clear both the high and low-priority mailbox registers. 47. initialize send rings. the send rcbs are located in the miscellaneous memory region from 0x100 to 0x1ff. host software should be careful to initialize the host physical memory address, based on allocation routines specific to the os/rtos. the mac will cache ? of the available send bds in nic local memory, so the host driver must set up the nic local address. the following formula should be used to calculate the nic send ring address: nic ring address = 0x4000 + (ring_number * sizeof(send_buffer_descriptor) * no_bds_in_ring) / 4 48. disable unused receive return rings. host software should write the rcb_flag_ring_disabled bit to the flags field for each ring control block. there are 16 receive return rings in bcm5700/5701/5702/5703c/5703s/5704c/ 5704s macs. note: only the bcm5700 mac with external ssram can use mini rings. table 73: examples of bcm57xx replenish threshold settings ring total bds threshold value mini rx producer 1024 128 standard rx producer 512 25 jumbo rx producer 256 16 note: the standard rx producer threshold value should be set very low. some o/s may run short of memory resource, and the number of bds that are made available will decrease proportionally. www.datasheet.in programmer?s guide bcm57xx 01/29/08 broadcom corporation document 57xx-pg105-r initialization page 155 49. initialize receive return rings. the receive return rcbs are located in the miscellaneous memory region from 0x200 to 0x2ff. host software should be careful to initialize the host physical memory address, based on allocation routines specific to the os/rtos. in bcm5700, the max_len field of the rcb should be programmed to 2048 when mini receive producer ring is enabled. in bcm5700 without external ssram, bcm5701, bcm5702, BCM5703c, BCM5703s, bcm5704c, and bcm5704s devices, the max_len should be set to 1024. in bcm5705, bcm5788, bcm5721, bcm5751, and bcm5752 macs, the max_len field should be set to 512. in bcm5714c/5714s/5715c/5715s devices, the max_len should be set to 512 or 256 depending on whether standard rx bds are used or extended rx bds are used. 50. the nic ringaddress field of rcb is an invalid field for rx return rings and hence host driver should set nic ring address to 0x0000. 51 initialize the receive producer ring mailbox registers. the jumbo and mini rings are supported only in bcm5700/5701/ 5702/5703c/5703s/5704c/5704s macs. ? software should write the value 0x00000000 (clear) to the low 32 bits of the receive bd standard producer ring index mailbox (see ?receive bd standard producer ring index register (offset 0x268)? on page 373 for host standard and flat modes). if software is using register indirect mode, the receive bd standard producer ring index register (see ?receive bd standard producer ring index register (offset 0x5868)? on page 492 ) may be cleared. it is unnecessary to clear both the high- and low-priority mailbox registers. ? software should write the value 0x00000000 to the low 32 bits of the receive bd jumbo producer ring index mailbox (see ?receive bd jumbo producer ring index register (offset 0x270)? on page 373 for host standard and flat modes). if host software is using register indirect mode, the rx bd jumbo producer ring index register (see ?receive bd jumbo producer ring index register (offset 0x5870)? on page 492 ) may be cleared. it is unnecessary to clear both the high and low-priority mailbox registers. ? software should write the value 0x00000000 to the low 32 bits of the receive bd mini producer ring index mailbox (see ?receive bd mini producer ring index register (offset 0x278)? on page 373 for host standard and flat modes). if host software is using register indirect mode, the rx bd mini producer ring index register (see ?receive bd mini producer ring index register (offset 0x5878, bcm5700 and bcm5701 only)? on page 492 ) may be cleared. it is unnecessary to clear both the high and low-priority mailbox registers. 52. configure the mac unicast address. see ?mac address setup/configuration? on page 167 for a full description of unicast mac address initialization. 53. configure random backoff seed for transmit. see the ethernet transmit random backoff register (see ?ethernet transmit random backoff register (offset 0x438)? on page 386 ). broadcom recommends using the following algorithm: seed = (mac_addr[0] + mac_addr[1] + mac_addr[2] + mac_addr[3] + mac_addr[4] + mac_addr[5]) & 0x3ff 54. configure the message transfer unit mtu size. the mtu sets the upper boundary on rx packet size; packets larger than the mtu are marked oversized and discarded by the rx mac. the mtu bit field in the receive mtu size register (see ?receive mtu size register (offset 0x43c)? on page 387 ) must be configured before rx traffic is accepted. host software should account for the following variables when calculating the mtu: ?vlan tag ? crc ? jumbo frames enabled 55. configure ipg for transmit. the transmit mac lengths register (see ?transmit mac lengths register (offset 0x464)? on page 391 ) contains three bit fields: ipg_crs_length, ipg_length, and slot_time_length. the value the 0x2620 should be written into this register. note: only the bcm5700 mac with external ssram can use mini rings. note: an incorrectly configured ipg will introduce far end receive errors on the mac?s link partner. www.datasheet.in bcm57xx programmer?s guide 01/29/08 broadcom corporation page 156 initialization document 57xx-pg105-r 56. configure default rx return ring for non-matched packets. the mac has a rules checker, and packets do not always have a positive match. for this situation, host softwar e must specify a default location, where rx packet should be placed. the bcm5700/5701/5702/5703c/5703s/5704c/5704s macs support 16 rx return rings, and software must specify a value between one and sixteen. the bit field is located in the receive rules configuration register (see ?receive rules configuration register (offset 0x500)? on page 394 ). 57 configure the number of receive lists. the receive list placement configuration register (see ?receive list placement configuration register (offset 0x2010)? on page 431 ) allows host software to initialize qos rules checking. for example, a value of 0x181 breaks down as follows: ? one interrupt distribution list ? sixteen active lists ? one bad frames class 58. write the receive list placement statistics mask. write 0xffffff (24 bits) to the receive list placement stats enable mask register (see ?receive list placement statistics enable mask register (offset 0x2018)? on page 433 ). 59. enable rx statistics. assert the statistics_enable bit in the receive list placement control register (see ?receive list placement statistics control register (offset 0x2014)? on page 432 ). 60. enable the send data initiator mask. write 0xffffff (24 bits) to the send data initiator enable mask register (see ?send data initiator statistics enable mask register (offset 0x0c0c)? on page 414 ). 61. enable tx statistics. assert the statistics_enable and faster_statistics_update bits in the send data initiator control register (0x0c08) 62. disable the host coalescing engine. software needs to disable the host coalescing engine before configuring its parameters. write 0x0000 to the host coalescing mode register (see ?host coalescing mode register (offset 0x3c00)? on page 452 ). 63. poll 20 ms for the host coalescing engine to stop. read the host coalescing mode register (see ?host coalescing mode register (offset 0x3c00)? on page 452 ) and poll for 0x0000. the engine was stopped in the previous step. 64. configure the host coalescing tick count. the receive coalescing ticks and send coalescing ticks registers (see ?receive coalescing ticks registers (offset 0x3c08)? on page 453 and ?send coalescing ticks register (offset 0x3c0c)? on page 453 ) specify the number of clock ticks elapsed before an interrupt is driven. the clock begins ticking after rx/tx activity. broadcom recommends the settings shown in table 74 . 65. configure the host coalescing bd count. the receive max coalesced bd and send max coalesced bd registers (see ?receive max coalesced bd count (offset 0x3c10)? on page 454 and ?send max coalesced bd count (offset 0x3c14)? on page 454 ) specify the number of frames processed before an interrupt is driven. broadcom recommends the settings shown in table 75 . table 74: recommended bcm57xx host coalescing tick counter settings register recommended value receive coalescing ticks 150 send coalescing ticks 150 table 75: recommended bcm57xx host coalescing frame counter settings register recommended value receive max coalesced frames 10 send max coalesced frames 10 www.datasheet.in programmer?s guide bcm57xx 01/29/08 broadcom corporation document 57xx-pg105-r initialization page 157 66. configure during interrupt tick counter (bcm5700/5701/5702/5703c/5703s/5704c/5704s only). while host software processes interrupts, this value is used. see the receive coalescing ticks during interrupt and send coalescing ticks during interrupt registers (see ?receive coalescing ticks during interrupt register (offset 0x3c18)? on page 455 and ?send coalescing ticks during interrupt register (offset 0x3c1c)? on page 455 ) for further details. broadcom recommends the settings shown in table 76 . 67 configure the max-coalesced frames during interrupt counter. while host software processes interrupts, this value is used. see the receive max coalesced frames during inte rrupt and send max coalesced frames during interrupt registers (see ?receive max coalesced bd count during interrupt (offset 0x3c20)? on page 456 and ?send max coalesced bd count during interrupt (offset 0x3c24)? on page 456 ). broadcom recommends the settings shown in table 77 . 68. initialize host status block address. host software must write a physical address to the status block host address register (see ?status block host address register (offset 0x3c38)? on page 457 ), which is the location where the mac must dma status data. this register accepts a 64-bit value. 69. initialize host statistics block address (bcm5700/5701/5702/5703c/5703s/5704c/5704s only). host software must write a physical address to the statistics host address register (see ?statistics host address register (offset 0x3c30)? on page 456 ), which is the location where the mac must dma statistics data. this register accepts a 64-bit value. 70. set the statistics coalescing tick counter, which is the number of clock ticks before the mac must dma statistics to host physical memory (bcm5700/5701/5702/5703c/5703s/5704c/5704s only). see the statistics tick counter register (see ?statistics ticks counter register (offset 0x3c28)? on page 456 ). broadcom recommends the setting shown in table 78 . 71. configure the statistic block address in nic local memory (bcm5700/5701/5702/5703c/5703s/5704c/5704s only). host software should write 0x300 to the statistics base address register (see ?statistics base address register (offset 0x3c40)? on page 457 ). 72. configure the status block address in nic local memory (bcm5700/5701/5702/5703c/5703s/5704c/5704s only). host software should write 0xb00 to the status block base address register (see ?status block base address register (offset 0x3c44)? on page 457 ). 73. enable the host coalescing engine. set the enable bit in the host coalescing mode register. 74. enable the receive bd completion functional block. set the enable and attn_enable bits in the receive bd completion mode register (see ?receive bd completion mode register (offset 0x3000)? on page 444 ). table 76: recommended bcm57xx interrupt tick counter settings register recommended value receive coalescing ticks during interrupt 0 send coalescing ticks during interrupt 0 table 77: recommended bcm57xx max coalesced frames during interrupt counter settings register recommended value receive max coalesced frames during interrupt 0 send max coalesced frames during interrupt 0 table 78: recommended bcm57xx statistics tick setting register recommended value statistics tick 1000000 www.datasheet.in bcm57xx programmer?s guide 01/29/08 broadcom corporation page 158 initialization document 57xx-pg105-r 75. enable the receive list placement functional block. set the enable bit in the receive list placement mode register (see ?receive list placement mode register (offset 0x2000)? on page 429 ). 76. enable the receive list selector functional block (bcm5700/5701/5702/5703c/5703s/5704c/5704s only). set the enable and attn_enable bits in the receive list selector mode register (see ?receive list selector mode register (offset 0x3400)? on page 446 ). 77. enable dma engines. set the enable_fhde, enable_rde, and enable_tde bits in the ethernet mac mode register (see ?ethernet mac mode register (offset 0x400)? on page 377 ). 78. enable and clear statistics. set the clear_tx_statistics, enable_tx_statistics, clear_rx_statistics, and enable_tx_statistics bits in the ethernet mac mode register (see ?ethernet mac mode register (offset 0x400)? on page 377 ). 79 configure the general miscellaneous local control register (see ?miscellaneous local control register (offset 0x6808)? on page 507 ). set the interrupt_on_attention bit in order for mac to assert an interrupt whenever any of the attention bits in the cpu event register are asserted. also set the auto seeprom access bit for mac to access the seeprom through the seeprom address and data registers. the configuration of gpios is optional and is design specific. the bcm5700 evaluation board uses the gpio1 as a phy reset signal. so the gpio1 is enabled as output pin and the output on gpio1 is driven high by asserting the following bits of 0x6808. ? misc pin[1] output enable (bit 12) ? enable gpio1 as an output signal. ? misc pins[1] output (bit 15) ? drive a logic true on gpio_1 for phy reset logic. 80. write a value of zero to the interrupt mailbox 0 low word (see ?interrupt mailbox 0 register (offset 0x200)? on page 372 for the host standard and flat modes and ?interrupt mailbox 0 register (offset 0x5800)? on page 492 for the indirect mode). 81. enable dma completion functional block (bcm5700/5701/5702/5703c/5703s/5704c/5704s only). set the enable bit in the dma completion mode register (see ?dma completion mode register (offset 0x6400)? on page 500 ). 82. configure the write dma mode register (see ?write dma mode register (offset 0x4c00)? on page 480 ). the following bits are asserted: ? enable?starts the functional block ? write_dma_pci_target_abort_attention_enable ? write_dma_pci_master_abort_attention_enable ? write_dma_pci_parity_attention_enable ? write_dma_pci_host_address_overflow_attention_enable ? write_dma_pci_fifo_underrun_attention_enable ? write_dma_pci_fifo_overrun_attention_enable ? write_dma_pci_fifo_overread_attention_enable ? write_dma_local_memory_read_longer_than_dma_length 83. configure the read dma mode register (see ?read dma mode register (offset 0x4800)? on page 477 ). the following bits are asserted: ? enable?start functional block ? read_dma_pci_target_abort ? read_dma_pci_master_abort ? read_dma_pci_parity_error ? read_dma_pci_host_overflow_error ? read_dma_pci_fifo_overrun_error ? read_dma_pci_fifo_underrun_error ? read_dma_pci_fifo_overread_error ? read_dma_local_memory_write_longer_than_dma_length www.datasheet.in programmer?s guide bcm57xx 01/29/08 broadcom corporation document 57xx-pg105-r initialization page 159 84. enable the receive data completion functional block. set the enable and attn_enable bits in the receive data completion mode register (see ?receive data completion mode register (offset 0x2800)? on page 441 ). 85. enable the mbuf cluster free functional block (bcm5700/5701/5702/5703c/5703s/5704c/5704s only). set the enable bit in the mbuf cluster free mode register (see ?mbuf cluster free mode register (offset 0x3800)? on page 447 ). 86. enable the send data completion functional block. set the enable bit in the send data completion mode register (see ?send data completion mode register (offset 0x1000)? on page 420 ). 87. enable the send bd completion functional block. set the enable and attn_enable bits in the send bd completion mode register (see ?send bd completion mode register (offset 0x1c00)? on page 425 ). 88. enable the receive bd initiator functional block. set the enable and receive_bds_available_on_receive_bd_ring in the receive bd initiator mode register (see ?receive bd initiator mode register (offset 0x2c00)? on page 442 ). 89. enable the receive data and bd initiator functional block. set the enable and illegal_return_ring_size bits in the receive data and receive bd initiator mode register (see ?receive data and receive bd initiator mode register (offset 0x2400)? on page 437 ). 90. enable the send data initiator functional block. set the enable bit in the send data initiator mode register (see ?send data initiator mode register (offset 0x0c00)? on page 412 ). 91. enable the send bd initiator functional block. set the enable and attn_enable bits in the send bd initiator mode register (see ?send bd initiator mode register (offset 0x1800)? on page 424 ). 92. enable the send bd selector functional block. set the enable and attn_enable bits in the send bd selector mode register (see ?send bd ring selector mode register (offset 0x1400)? on page 422 ). 93. download firmware (optional). see ?firmware download? on page 162 . 94. enable the transmit mac. set the enable bit in the transmit mac mode register (see ?transmit mac mode register (offset 0x45c)? on page 390 ). optionally, software may set the enable_flow_control to enable 802.3x flow control. 95. enable the receive mac. set the enable bit in the receive mac mode register (see ?receive mac mode register (offset 0x468)? on page 391 ). optionally, software may set the following bits: ? enable_flow_control?enable 802.3x flow control ? accept_oversized?ignore rx mtu up to 64k maximum size ? promiscuous_mode?accept all packets regardless of dest address ? no_crc_check?rx mac will not check ethernet crc 96. disable auto-polling on the management interface (optional) by writing 0xc0000 to the mi mode register (see ?mi mode register (offset 0x454)? on page 389 ). 97. configure d0 power state in pmscr. see ?power management control/status register (offset 0x4c)? on page 318 . optional?the pmcsr register is reset to 0x00 after chip reset. software may optionally reconfigure this register if the device is being moved from d3 hot/cold. 98. program hardware to control leds. write 0x00 to led controls register. leds on the bcm57xx reference designs are tied to the physical layer. 99. activate link and enable mac functional blocks. set the link_status bit in the mi status register (see ?mi status register (offset 0x450)? on page 389 ) to generate a link attention. 100. setup the physical layer and restart auto-negotiation. for details on phy auto-negotiation, refer to the phy data sheet. (the phy core used in each mac is listed in table 2 on page 5 .). see ?phy setup and initialization? on page 250 for information on setting up and initializing the phy. 101. setup multicast filters. refer to ?packet filtering? on page 168 for details on multicast filter setup. 102. enable interrupts. clear the mask_pci_interrupt_output bit in the miscellaneous host control register (see ?miscellaneous host control register (offset 0x68)? on page 325 ). note: broadcom recommends using phy interrupts for link status change indications. auto-polling is another mechanism for determining link status change (see ?phy setup and initialization? on page 250 ). www.datasheet.in bcm57xx programmer?s guide 01/29/08 broadcom corporation page 160 shutdown document 57xx-pg105-r s hutdown to power down the bcm57xx family, its state machines must be disabled in specific sequence as shown below. the host software must clear the enable bit of each state machine and poll the bit until it is cleared. the maximum poll period that software must wait for the enable bits to clear is 2 ms; except, the read and write dma mode registers require a maximum timeout of 4 ms. // receive path shutdown sequence. receive_mac_mode.enable = 0 // 0x0468 receive_bd_initiator_mode.enable = 0 // 0x2c00 receive_list_placement_mode.enable = 0 // 0x2000 receive_list_selector_mode.enable = 0 (bcm5700/5701/5702/5703c/5703s/5704c/5704s only) // 0x3400 receive_data_bd_initiator_mode.enable = 0 // 0x2400 receive_data_completion_mode.enable = 0 // 0x2800 receive_bd_completion_mode.enable = 0 // 0x3000 // transmit path shutdown sequence. send_bd_selector_mode.enable = 0 // 0x1400 send_bd_initiator_mode.enable = 0 // 0x1800 send_data_initiator_mode.enable = 0 // 0x0c00 read_dma_mode.enable = 0 // 0x4800 send_data_completion_mode.enable = 0 // 0x1000 dma_completion_mode.enable = 0 (bcm5700/5701/5702/5703c/5703s/5704c/5704s only) // 0x6400 send_bd_completion_mode.enable = 0 // 0x1c00 mac_mode register tde bit (bit 21)= 0 // 0x0400 transmit_mac_mode.enable = 0 // 0x045c // memory related state machines shutdown. host_coalescing_mode.enable = 0 // 0x3c00 dma_write_mode.enable = 0 // 0x4c00 mbuf_cluster_free_mode.enable = 0 (bcm5700/5701/5702/5703c/5703s/5704c/5704s only) // 0x3800 ftq_reset = 0xffffffff // 0x5c00 ftq_reset = 0 // 0x5c00 buffer_manager_mode.enable = 0 (bcm5700/5701/5702/5703c/5703s/5704c/5704s only) // 0x4400 memory_arbiter_mode.enable = 0 (bcm5700/5701/5702/5703c/5703s/5704c/5704s only) // 0x4000 note: the buffer manager and memory arbiter should not be disabled as part of shutdown of bcm5705/5788/ 5721/5751/5714c/5714s/5715c/5715s/5752 macs. this is because the scratch pad memory for the on-chip risc processor of these macs is reserved out of the rxmbuf memory space. www.datasheet.in programmer?s guide bcm57xx 01/29/08 broadcom corporation document 57xx-pg105-r reset page 161 r eset a hardware reset can be initiated by the pci reset signal or by the host software via the core clock blocks reset bit. such a reset will initialize all pci configuration registers to their default values, though the boot code may then modify some valu es such as those listed below. the content of the device internal memory remains unchanged after reset. at the end of the reset, the rx risc executes a small on chip rom code. this code loads an executable image contained in an attached nvram and referred to as the bootcode. this bootcode allows at least the following fields to be initialized to different values to support product variations (for additional details, see ?nvram configuration? on page 88 ). ? vendor id ? device id ? subsystem vendor id ? subsystem device id ? possible phy initialization the bootcode may have additional functionalities such as pxe that must be acquiesced while the host software is running. for instance, an ndis driver issues a hardware reset via the core clock blocks reset bit. after the reset is completed, the rx risc begins executing the bootcode as if the power was first applied to the device. however, the ndis driver must have a mechanism to prevent the pxe driver from running and the bootcode must be able to distinguish between a power-on reset and a reset initiated by the host software. the host software and the bootcode could implement a reset handshake by using shared memory at offset 0x0b50 as a software mailbox (see ?firmware mailbox? on page 275 ). www.datasheet.in bcm57xx programmer?s guide 01/29/08 broadcom corporation page 162 firmware download document 57xx-pg105-r f irmware d ownload f irmware b inary i mage the risc cores in the bcm57xx family of chips execute the mips-2 instruction set. broadcom uses a gnu tool kit to create the firmware binary code. the output from the gnu build is a c language header file, which contains the machine code for the embedded risc cores. this manual does not cover the technology necessary to program the risc cores. however, programmers may need to download value-added firmware provided by broadcom. one example of value added firmware is tcp segmentation firmware that can be loaded from the host driver. this section provides the necessary understanding of the header file, created by the broadcom gnu tools. the programmer must understand the layout of the header file, to accomplish a firmware download. the following sections are located in the header file provided by broadcom: ? t3fwtext[]?array of 32-bit words. this section contains the machine code (opcodes/operands) executed by the risc cores. this is the text section in the binary file, output by the gnu build process. ? t3fwrodata[]?array of 32-bit words. this section contains the read-only data available to the code section of the firmware. ? t3fwdata[]?array of 32-bit words. this section contains the local variables available to the code section of the firmware. the programmer needs to move these sections to both the rx/tx scratchpads for the bcm5700 through bcm5704, and to the scratchpad that is reserved out of rxmbuf for the bcm5705, bcm5788, bcm5721, bcm5751, bcm5714c, bcm5714s, bcm5715c, bcm5715s, and bcm5752. this is the binary image that the risc core executes. the following figure shows a conceptual layout of the scratchpad/rxmbuf and how the header file sections are moved to the scratchpads/ rxmbuf. three sections are moved. figure 62: firmware image moved to scratchpad/rxmbuf risc scratchpad t3fwtext[ (t3fwtextlen/4) + 1 ] t3fwtextlen t3fwtextaddr t3fwrodata[ (t3fwrodatalen/4) + 1 ] t3fwrodatalen t3fwrodataaddr t3fwdata[ (t3fwdatalen/4) + 1 ] t3fwdatalen t3fwdataaddr #1 #2 #3 risc scratchpad/rxmbuf www.datasheet.in programmer?s guide bcm57xx 01/29/08 broadcom corporation document 57xx-pg105-r firmware download page 163 the programmer should be careful when moving the header file data to the scratchpad/rxmbuf. the variables t3fwdataaddr, t3fwrodataaddr, and t2fwtextaddr are all risc core relative addresses; the host must translate each address to a bcm57xx family?s register space region. the host programmer must use the address offset from 0x30000 (rx risc), the offset from 0x34000 (tx risc), or the offset from 0x10000 (rxmbuf). in summary, the address offsets in the header file are relative to the local memory address ranges specified in table 79 for the rx and tx risc respectively. the following formula may be used to convert address data: rx register address = 0x30000 + (fwheaderfileaddress & 0xffff) tx register address = 0x34000 + (fwheaderfileaddress & 0xffff) rxmbuf address = 0x10000 + (fwheaderfileaddress & 0xffff) r eset risc p rocessor the rx processor can be reset by setting the reset rx risc bit of the rx risc mode register (see ?rx risc mode register (offset 0x5000)? on page 483 ). similarly, the tx processor can be reset by setting the reset tx risc bit of the tx risc mode register (see ?tx risc mode register (offset 0x5400)? on page 487 ). this bit is self-clearing bit; it will be cleared once internal reset of processor is completed. for example, to reset rx risc, do the following: wr 5004, 0xffffffff /* clear all cpu state */ wr 0x5000, 0x1 wait until bit 0 of register at 0x5000 is cleared. to reset the tx risc, do the following: wr 5404, 0xffffffff /* clear all cpu state */ wr 0x5400, 0x1 wait until bit 0 of register at 0x5000 is cleared. table 79: addressing perspectives memory type host perspective rx risc perspective tx risc perspective rx risc scratchpad 0x30000?0x33fff 0x08000000?0x08003fff 0xc0030000?0xc0033fff tx risc scratchpad 0x34000?0x37fff 0xc0034000?0xc0037fff 0x080000000?0x08003fff rxmbuf 0x10000?0x1dfff 0x10000?0x1dfff n/a(a) (a) = devices that use rxmbuf memory do not have tx risc processors. internal memory 0x000000?0x01ffff 0x00000000?0x0001ffff 0x00000000?0x0001ffff external memory 0x020000?0xffffff 0x00020000?0x00ffffff 0x0020000?0x00ffffff www.datasheet.in bcm57xx programmer?s guide 01/29/08 broadcom corporation page 164 firmware download document 57xx-pg105-r h alt risc p rocedure 1. clear the rx/tx risc state register. write 0x ffffffff to the rx_risc_state register (see ?rx risc state register (offset 0x5004)? on page 485 ) or the tx_risc_state register (see ?tx risc state register (offset 0x5404)? on page 488 ) respectively. 2. issue rx/tx risc halt. write the risc_mode_halt bit to the rx_risc_mode register (see ?rx risc mode register (offset 0x5000)? on page 483 ) or the tx_risc_mode register (see ?tx risc mode register (offset 0x5400)? on page 487 ) respectively. 3. read/verify that the risc_mode_halt bit is set. read the rx/tx risc_mode_halt bit back from the rx_risc_mode or tx_risc_mode register respectively. break from procedure if bit is set. 4. delay 10 s and jump to step 1. repeat the procedure up to 10,000 times. s tart risc p rocedure this procedure stops the rx/tx risc cpus and modifies the program counter to begin executing firmware at a new address. 1. clear the rx/tx risc state register. write 0x ffffffff to the rx_risc_state register (see ?rx risc state register (offset 0x5004)? on page 485 ) or the tx_risc_state register (see ?tx risc state register (offset 0x5404)? on page 488 ) respectively. 2. set the rx/tx risc program counter. write t3fwtextaddr to the rx_risc_pc register (see ?rx risc program counter (offset 0x501c)? on page 486 ) or the tx_risc_pc register (see ?tx risc program counter (offset 0x541c)? on page 489 ) respectively. 3. read back the pc register. read the rx_risc_pc or tx_risc_pc register respectively and verify that t3fwtextaddr is set. if properly set, then jump to step 7. 4. clear the rx/tx risc state register. write 0xffffffff to the rx_risc_state or tx_risc_state register respectively. 5. halt the rx/tx risc. write the risc_mode_halt bit to the rx_risc_mode or tx_risc_mode register respectively. 6 delay one millisecond. jump to step 2 and repeat procedure. 7. clear the rx/tx risc state register. write 0xffffffff to the rx_risc_state or tx_risc_state register respectively. 8. clear the rx/tx risc mode register. write 0x00 to the rx_risc_mode register (see ?rx risc mode register (offset 0x5000)? on page 483 ) or the tx_risc_mode register (see ?tx risc mode register (offset 0x5400)? on page 487 ) respectively. note: the t3fwtextaddr should not be converted to a register relative address. the riscs execute from a local memory space. the conversion is only necessary for writing t3fwtext [] to the scratchpad using register space?the host view of the scratchpad region is different from the risc view. see table 79 on page 163 . www.datasheet.in programmer?s guide bcm57xx 01/29/08 broadcom corporation document 57xx-pg105-r firmware download page 165 f irmware d ownload p rocedure the host driver should use register indirect access to m odify both the scratchpad and risc register space. see ?pseudocode? on page 205 in section 9: ?pci? . 1. halt the rx rsic core (see ?halt risc procedure? on page 164 ). 2. optional for bcm5700, bcm5701, bcm5702, BCM5703c, BCM5703s, bcm5704c, and bcm5704s?clear the rx risc scratchpad. use register indirect access and write zero(s) starting at register address 0x30000 (see table 79 on page 163 ). the last address to clear is 0x33fff. the total length of the scratchpad is 0x4000 and the host driver should increment the target address by four (4), since each mips word is 32 bits (4 bytes). 3. convert variable t3fwrodataaddr to a register relative address for the rx risc. the register address is calculated as follows: ? for bcm5705, bcm5788, bcm5721, bcm5751, bcm5714c, bcm5714s, bcm5715c, bcm5715s, and bcm5752: regnormalized = 0x10000 + (t3fwtextaddr & 0xffff) ? for bcm5700, bcm5701, bcm5702, BCM5703c, 5703s, bcm5704c, and bcm5704s: regnormalized = 0x30000 + (t3fwtextaddr & 0xffff) ? for systems using rxmbuf memory for firmware, ensure that the downloaded firmware does not overlap the mbuf pool address. 4. write the array t3fwtext [] to the rx scratchpad/rxmbuf (see table 79 on page 163 ). use register indirect access and increment by four bytes for every 32-bit write. the last/limit address to write is calculated as follows: regnormalized (step 3. ) + t3fwtextlen 5. convert variable t3fwrodataaddr to a register relative address for the rx risc. the register address is calculated as follows: ? for bcm5705, bcm5788, bcm5721, bcm5751, bcm5714c, bcm5714s, bcm5715c, bcm5715s, and bcm5752: regnormalized = 0x10000 + (t3fwrodataaddr & 0xffff) ? for bcm5700, bcm5701, bcm5702, BCM5703c, 5703s, bcm5704c, and bcm5704s: regnormalized = 0x30000 + (t3fwrodataaddr & 0xffff) 6. write the array t3fwrodata [] to the rx scratchpad/rxmbuf (see table 79 on page 163 ). use register indirect access and increment by four bytes for every 32-bit write. the last/limit address to write is calculated as follows: regnormalized (from step 5. ) + t3fwrodatalen 7. convert variable t3fwdataaddr to a register relative address for the rx risc. the register address is calculated as follows: ? for bcm5705, bcm5788, bcm5721, bcm5751, bcm5714c, bcm5714s, bcm5715c, bcm5715s, and bcm5752: regnormalized = 0x10000 + (t3fwdataaddr & 0xffff) ? for bcm5700, bcm5701, bcm5702, BCM5703c, 5703s, bcm5704c, and bcm5704s: regnormalized = 0x30000 + (t3fwdataaddr & 0xffff) 8. write the array t3fwdata [] to the rx scratchpad/rxmbuf (see table 79 on page 163 ). use register indirect access and increment by four bytes for every 32-bit write. the last/limit address to write is calculated as follows: regnormalized (from step 7. ) + t3fwdatalen note: steps 9 through 18 are only required for firmware that runs on both the tx and rx cpus. the bcm5705, bcm5788, bcm5721, bcm5751, bcm5714c, bcm5714s, bcm5715c, bcm5715s, and bcm5752 macs have only rx risc and hence the steps 9 through 18 are not applicable. www.datasheet.in bcm57xx programmer?s guide 01/29/08 broadcom corporation page 166 firmware download document 57xx-pg105-r 9. reset the tx risc core (see table 79 on page 163 ). 10. clear the tx risc scratchpad. use register indirect access and write zero(s) starting at register address 0x34000 (see table 79 on page 163 ). the last address to clear is 0x37fff. the total length of the scratchpad is 0x4000 and the host driver should increment the target address by four (4), since each mips word is 32 bits (4 bytes). 11. clear the tx risc state register. use register indirect access and write 0xffffffff to the tx_risc_state_register (see ?tx risc state register (offset 0x5404)? on page 488 ). 12. halt the tx risc. assert the halt_tx_cpu bit in the tx_risc_mode register (see ?tx risc mode register (offset 0x5400)? on page 487 ). 13. convert variable t3fwrodataaddr to a register relative address for the tx risc. the register address is calculated as follows: regnormalized = 0x34000 + (t3fwtextaddr & 0xffff) 14. write the array t3fwtext [] to the tx scratchpad (see table 79 on page 163 ). use register indirect access and increment by four bytes for every 32-bit write. the last/limit address to write is calculated as follows: regnormalized (from step 13. ) + t3fwtextlen 15. convert variable t3fwrodataaddr to a register relative address for the tx risc. the register address is calculated as follows: regnormalized = 0x34000 + (t3fwrodataaddr & 0xffff) 16. write the array t3fwrodata [] to the tx scratchpad (see table 79 on page 163 ). use register indirect access and increment by four bytes for every 32-bit write. the last/limit address to write is calculated as follows: regnormalized (from step 15. ) + t3fwrodatalen 17. convert variable t3fwdataaddr to a register relative address for the tx risc. the register address is calculated as follows: regnormalized = 0x34000 + (t3fwdataaddr & 0xffff) 18. write the array t3fwdata [] to the tx scratchpad (see table 79 on page 163 ). use register indirect access, and increment by four bytes for every 32-bit write. the last/limit address to write is calculated as follows: regnormalized (from step 17. ) + t3fwdatalen 19. start the rx risc (see ?start risc procedure? on page 164 ). note: when enabled, the asf/ipmi fw needs to run even in the absence of os. the ipmi/asf fw is normally programmed into nvram and the boot code will load this fw into scratchpad/rxmbuf memory if the ipmi/asf feature is enabled. the size of ipmi/asf fw is larger than 16 kb (size of scratchpad memory area in bcm5700 through bcm5704 devices) and therefore it is run on both the tx and rx riscs for the bcm5700 through bcm5704 devices. it is only necessary to start the rx risc because the ipmi/asf firmware code executed by the rx risc starts the tx risc. in case of bcm5705/5788/5721/5751/5714c/ 5714s/5715c/5715s/5752 devices that have only one risc per port, the bootcode reserves enough memory out of rxmbuf as risc scratchpad for ipmi/asf firmware. the tcp segmentation (aka largesendoffload) fw can be loaded from the driver, but it cannot coexist with the ipmi/asf fw on a given port even in bcm5700 through bcm5704 devices that have two riscs per port because the ipmi/asf is run on both riscs of these devices. in case of dual-port macs like bcm5704, it should be possible to run lso on one port and ipmi/asf on another port. www.datasheet.in programmer?s guide bcm57xx 01/29/08 broadcom corporation document 57xx-pg105-r mac address setup/configuration page 167 when freeing received rxmbufs (e.g., received asf rmcp packets) from the mips cpu (running asf firmware or any other optional fw) while simultaneously receiving/freeing tcp traffic for the host device driver, a race condition can occur which causes subsequent receives to fail (no more rxmbufs get enqueued). to avoid this race condition, before freeing the rxmbuf chain (by writing to the mbufclustfreeftqfifoen queuedequeue register, 0x5cc8), the fw should poll the buffer manager hardware diagnostic 3 register (0x4454) until the des criptor in bits 25-16 matches the mbuf cluster at the beginning of the chain we're about to free. also, note that the hardware diagnostic register uses a cluster based on the offset from the top of the rxmbuf pool (e.g., 0x16000) and the firmware uses a cluster based on the offset from 0x10000, so some calculations must be performed to compare the proper pointer values. example code snippet (from asf firmware) /* poll buffer manager hardware diag register 3 (0x4454) for our mbuf pointer value */ while(trp->bufmgr.mbufpooladdr + (((trp->bufmgr.hwdiag[2]>>16) & 0x1ff) << 7) != (u32)pmbuf); mac a ddress s etup /c onfiguration the mac address registers, starting at offset 0x0410, contain the mac addresses of the nic. these registers are usually initialized with a default mac address extracted from the nic?s nvram when it is first powered up. the host software may overwrite the default mac address by writing to the mac registers with a new mac address. table 80 illustrates the mac register format. the bcm57xx family allows a nic to have up to four mac addresses (offset 0x410-0x42f) that are used for hardware packet reception filtering. however, most host software will initialize the registers of the four mac addresses to the same mac address since a nic usually has only one mac address. an additional 12 mac addresses are supported for the bcm5702, BCM5703c, BCM5703s, bcm5704c, and bcm5704s macs. they are accessed at registers 0x530 to 0x58f, and have the same format as registers 0x410 to 0x42f shown in table 80 below. the host software could set up the send buffer descriptors of a frame to overwrite the source address with one of the four mac addresses. ?send buffer descriptors? on page 94 for more details. when flow control is enabled on the bcm57xx family, the mac address 0 is used as the source address for sending pause frames (see ?pause control frame? on page 707 ). table 80: mac address registers register name offset 31 24 23 16 15 8 7 0 mac_address_0 0x0410 unused octet 0 octet 1 0x0414 octet 2 octet 3 octet 4 octet 5 mac_address_1 0x0418 unused octet 0 octet 1 0x041c octet 2 octet 3 octet 4 octet 5 mac_address_2 0x0420 unused octet 0 octet 1 0x0424 octet 2 octet 3 octet 4 octet 5 mac_address_3 0x0428 unused octet 0 octet 1 0x042c octet 2 octet 3 octet 4 octet 5 www.datasheet.in bcm57xx programmer?s guide 01/29/08 broadcom corporation page 168 packet filtering document 57xx-pg105-r p acket f iltering m ulticast h ash t able s etup /c onfiguration the mac hash registers are used to help discard unwanted multicast packets as they are received from the external media. the destination address is fed into the normal crc algorithm in order to generate a hash function. the most significant bits of the crc are then used without any inversion in reverse order to index into a hash table, which is comprised of these mac hash registers. if the crc is calculated by shifting right, then the right-most bits of the crc can be directly used with no additional inversion or bit swapping required. see ?ethernet crc calculation? for more details on the crc algorithm. all four mac hash registers are used so that register 1 bit-32 is the most significant hash table entry and register 4 bit-0 is the least significant hash table entry. this follows the normal big-endian ordering used throughout the bcm57xx family. since there are 128 hash table entries, 7 bits are used from the crc. the mac hash registers are ignored if the receive mac is in promiscuous mode. e thernet crc c alculation the bcm57xx family uses the standard 32-bit crc required by the ethernet specification as its fcs in all packets. the checksum is the 32-bit remainder of the polynomial division of the data taken as a bit stream of polynomial coefficients and a predefined constant, which also represents binary polynomial coefficients. the checksum is optionally appended most- significant bit first to a packet, which is to be sent down the wire. at the receiving side, the division is repeated on the en tire packet including the crc checksum. the remainder is compared to a known constant. for details on the mathematical basis for crc checksums, see tanenbaum's computer networks, third edition, c1996. the 32-bit crc polynomial divisor is shown below: x32 + x26 + x23 + x22 + x16 + x12 + x11 + x10 + x8 + x7 + x5 + x4 + x2 + x + 1 g enerating crc the following steps describe a method to calculate the crc with the resulting 32-bit quantity having reversed bit order (i.e., most significant bit x31 of the remainder is right-most bit). the data should be treated as a stream of bytes. set remainder to 0xffffffff. for each bit of data starting with least-significant bit of each byte: 1. if right-most bit (bit-0) of the current remainder xor'd with the data bit equal 1, then remainder = (remainder shifted right one bit) xor 0xedb88320, else remainder = (remainder shifted right one bit). 2. invert remainder such that remainder = ~remainder. remainder is crc checksum. right-most byte is the most significant and is to be sent first. swap bytes of crc if big-endian byte ordering is desired. www.datasheet.in programmer?s guide bcm57xx 01/29/08 broadcom corporation document 57xx-pg105-r packet filtering page 169 c hecking crc the following steps describe a method to check a stream of bytes, which has a crc appended . 1. set remainder to 0xffffffff. 2. for each bit of data starting with least-significant bit of each byte: if right-most bit (bit-0) of the current remainder xor'd with the data bit equal 1, then remainder = (remainder shifted right one bit) xor 0xedb88320, else remainder = (remainder shifted right one bit). 3. remainder should equal magic value 0xdebb20e3 if crc is correct. i nitializing the mac h ash r egisters the 128-bit multicast hash table is treated as a single object occupying four bcm57xx registers starting at offset 0x0470 (see table 81 ). the 128-bit value follows the big-endian ordering required by bcm57xx family. thus, the most significant 32-bit of the 128-bit value resides in mac_hash_register_0 at offset 0x0470 and the least significant 32-bit resides in mac_hash_register_3 at offset 0x047c. host software can enable the reception of all multicast frames including broadcast frames by setting all four multicast hash registers to 0xffffffff. the c code fragment below will illustrate how to initialize the multicast hash table registers. the code fragment computes the indices into hash table from a given list of multicast addresses and initializes the multicast hash registers. unsigned long hashreg[4]; unsigned long j, mcentrycnt; unsigned char mctable[32][6]; // list of multicast addresses to accept. // initialize the mctable here. mcentrycnt = 32; // initialize the multicast table registers. hashreg[0] = 0; // mac_hash_regsiter_0 at offset 0x0470. hashreg[1] = 0; // mac_hash_register_1 at offset 0x0474. hashreg[2] = 0; // mac_hash_register_2 at offset 0x0478. hashreg[3] = 0; // mac_hash_register_3 at offset 0x047c. for(j = 0; j < mcentrycnt; j++) { unsigned long regindex; unsigned long bitpos; unsigned long crc32; crc32 = computecrc32(mctable[j], 6); // the most significant 7 bits of the crc32 (no inversion), table 81: multicast hash table registers register name offset description mac_hash_register_0 0x0470 most significant 32-bit of the 128-bit hash table mac_hash_register_1 0x0474 bit 64-93 of the 128-bit hash table mac_hash_register_2 0x0478 bit 32-63 of the 128-bit hash table mac_hash_register_3 0x047c least significant 32-bit of the 128-bit hash table www.datasheet.in bcm57xx programmer?s guide 01/29/08 broadcom corporation page 170 packet filtering document 57xx-pg105-r // are used to index into one of the possible 128 bit positions. bitpos = ~crc32 & 0x7f; // hash register index. regindex = (bitpos & 0x60) >> 5; // bit to turn on within a hash register. bitpos &= 0x1f; // enable the multicast bit. hashreg[regindex] |= (1 << bitpos); } the c routine below computes the ethernet crc32 value from a given byte stream. the routine is called from the above code fragment. // routine for generating crc32. unsigned long computecrc32( unsigned char *pbuffer, // buffer containing the byte stream. unsigned long buffersize) // size of the buffer. { unsigned long reg; unsigned long tmp; unsigned long j, k; reg = 0xffffffff; for(j = 0; j < buffersize; j++) { reg ^= pbuffer[j]; for(k = 0; k < 8; k++) { tmp = reg & 0x01; reg >>= 1; if(tmp) { reg ^= 0xedb88320; } } } return ~reg; } p romiscuous m ode s etup /c onfiguration the host software may enable promiscuous mode by setting the promiscous_mode bit (bit 8) of the receive_mac_mode register (offset 0x468). the promiscous_mode bit defaults to disabled after reset, and host software must explicitly set this bit for promiscuous mode. in promiscuous mode of operation, the netxtreme bcm57xx family accepts all incoming frames that are not filtered by the active receive rules regardless of the destination mac address. in other words, the netxtreme bcm57xx mac operating in promiscuous mode ignores multicast and mac address filtering ( ?multicast hash table setup/ configuration? on page 168 and ?mac address setup/configuration? on page 167 ) but applies receive rules. www.datasheet.in programmer?s guide bcm57xx 01/29/08 broadcom corporation document 57xx-pg105-r memory maps and pool configuration page 171 b roadcast s etup /c onfiguration the host software may configure the bcm57xx family to discard the received broadcast frames by using two receive rules as defined below. the netxtreme bcm57xx family parses all incoming frames according to these receive rules and discards those frames that have a broadcast destination address (see ?receive rules setup and frame classification? on page 126 for more details on setting up the receive rules). below are the two receive rules for discarding broadcast frames. rule1 control: 0xc2000000 rule1 mask/value: 0xffffffff rule2 control: 0x86000004 rule2 mask/value: 0xffffffff m emory m aps and p ool c onfiguration the bcm57xx netxtreme family provides 128k of internal sram. the first 32k of internal sram is called miscellaneous memory and it is used internally by the device for ring buffers, statistics, and status block. the mac allocates the remaining sram as memory buffers (or mbufs) for packet buffers and firmware value-adds. (for the amount of mbuf space allocated for each member of the bcm57xx family, see table 1 on page 2 .). the bcm5700 netxtreme mac also supports external ssram option. the following configuration is possible when the bcm57xx hardware design/application provides only internal memory: ? receive standard producer ring enabled ? receive jumbo producer ring enabled ? send rings 0?3 enabled table 82: netxtreme mem. map (5700 (int. sram)/5701/5702/5703c/5703s/5704c/5704s mac only) region size nic risc processor view host flat view host standard view host undi view page zero 256b 0x00000000? 0x000000ff 0x01000000? 0x010000ff 0x00000000? a 0x000000ff 0x00000000? a 0x000000ff send ring rcb 256b 0x00000100? 0x000001ff 0x01000100? 0x010001ff 0x00000100? a 0x000001ff 0x00000100? a 0x000001ff receive return ring rcb 256b 0x00000200? 0x000002ff 0x01000200? 0x010002ff 0x00000200? a 0x000002ff 0x00000200? a 0x000002ff statistics block 2 kb 0x00000300? 0x00000aff 0x01000300? 0x01000aff 0x00000300? a 0x00000aff 0x00000300? a 0x00000aff status block 80b 0x00000b00? 0x00000b4f 0x01000b00? 0x01000b4f 0x00000b00? a 0x00000b4f 0x00000b00? a 0x00000b4f software gencomm 1 kb 0x00000b50? 0x00000fff 0x01000b50? 0x01000fff 0x00000b50? a 0x00000fff 0x00000b50? a 0x00000fff unmapped b 4 kb 0x00001000? 0x00001fff 0x01001000? 0x01001fff 0x00001000? a 0x00001fff 0x00001000? a 0x00001fff dma descriptors 8 kb 0x00002000? 0x00003fff 0x01002000? 0x01003fff 0x00002000? a 0x00003fff 0x00002000? a 0x00003fff www.datasheet.in bcm57xx programmer?s guide 01/29/08 broadcom corporation page 172 memory maps and pool configuration document 57xx-pg105-r send rings 1?4 8 kb 0x00004000? 0x00005fff 0x01004000? 0x01005fff 0x00004000? a 0x00005fff 0x00004000? a 0x00005fff standard receive rings 4 kb 0x00006000? 0x00006fff 0x01006000? 0x01006fff 0x00006000? a 0x00006fff 0x00006000? a 0x00006fff jumbo receive rings 4 kb 0x00007000? 0x00007fff 0x01007000? 0x01007fff 0x00007000? a 0x00007fff 0x00007000? a 0x00007fff buffer pool 1 c 32 kb 0x00008000? 0x0000ffff 0x01008000? 0x0100ffff 0x00008000? a 0x0000ffff 0x00008000? a 0x0000ffff buffer pool 2 or (expansion rom) d 32 kb 0x00010000? 0x00017fff 0x01010000? 0x01017fff 0x00010000? a 0x00017fff 0x00010000? a 0x00017fff buffer pool 3 e or (expansion rom) d 32 kb 0x00018000? 0x0001ffff 0x01018000? 0x0101ffff 0x00018000? a 0x0001ffff 0x00018000? a 0x0001ffff a. indirect access via memory window base address and memory window data registers pair. b. read access to unmapped memory returns unexpected data. write access to unmapped memory has no effect. c. three buffer pools span 96k total. the three pools must be a continuos allocation. d. pxe image is mapped into this region at boot. the host may access the pxe image at this location, 64k total memory is made av ailable. e. the buffer pool-3 is not available in bcm5704c and bcm5704s macs. table 83: bcm5705, bcm5788, bcm5721, bcm5751, and bcm5752 address map region size nic risc processor view host flat view host standard view host undi view unmapped 256b 0x00000000? 0x000000ff 0x01000000? 0x010000ff 0x00000000? a 0x000000ff 0x00000000? a 0x000000ff send ring rcb 16b 0x00000100? 0x0000010f 0x01000100? 0x0100010f 0x00000100? a 0x0000010f 0x00000100? a 0x0000010f unmapped 240b 0x00000110? 0x000001ff 0x01000110? 0x010001ff 0x00000110? 0x000001ff 0x00000110? 0x000001ff receive return ring rcb 16b 0x00000200? 0x0000020f 0x01000200? 0x0100020f 0x00000200? a 0x0000020f 0x00000200? a 0x0000020f unmapped 240b 0x00000210? 0x000002ff 0x01000210? 0x010002ff 0x00000210? 0x000002ff 0x00000210? 0x000002ff unmapped 2kb 0x00000300? 0x00000aff 0x01000300? 0x01000aff 0x00000300? a 0x00000aff 0x00000300? a 0x00000aff unmapped 80b 0x00000b00? 0x00000b4f 0x01000b14? 0x01000b4f 0x00000b14? 0x00000b4f 0x00000b14? 0x00000b4f software gencomm 1 kb 0x00000b50? 0x00000f4f 0x01000b50? 0x01000f4f 0x00000b50? a 0x00000f4f 0x00000b50? a 0x00000f4f unmapped 4 kb 0x00000f50? 0x00001fff 0x01000f50? 0x01001fff 0x00000f50? 0x00001fff 0x00000f50? 0x00001fff unmapped 8 kb 0x00002000? 0x00003fff 0x01002000? 0x01003fff 0x00002000? 0x00003fff 0x00002000? 0x00003fff table 82: netxtreme mem. map (5700 (int. sram)/5701/5702/5703c/5703s/5704c/5704s mac only) (cont.) region size nic risc processor view host flat view host standard view host undi view www.datasheet.in programmer?s guide bcm57xx 01/29/08 broadcom corporation document 57xx-pg105-r memory maps and pool configuration page 173 send ring 2 kb 0x00004000? 0x000047ff 0x01004000? 0x010047ff 0x00004000? a 0x000047ff 0x00004000? a 0x000047ff unmapped 6 kb 0x00004800? 0x00005fff 0x01004800? 0x01005fff 0x00004800? 0x00005fff 0x00004800? 0x00005fff standard receive ring 4 kb 0x00006000? 0x00006fff 0x01006000? 0x01006fff 0x00006000? a 0x00006fff 0x00006000? a 0x00006fff unmapped 4 kb 0x00007000? 0x00007fff 0x01007000? 0x01007fff 0x00007000? 0x00007fff 0x00007000? 0x00007fff txmbuf 8 kb 0x00008000? 0x00009fff 0x01008000? 0x01009fff 0x00008000? a 0x00009fff 0x00008000? a 0x00009fff unmapped 24 kb 0x0000a000? 0x0000ffff 0x0100a000? 0x0100ffff 0x0000a000? 0x0000ffff 0x0000a000? 0x0000ffff rxmbuf/scratch pad (bcm5705, bcm5705m only) 56 kb 0x00010000? 0x0001dfff 0x01010000? 0x0101dfff 0x00010000? a 0x0001dfff 0x00010000? a 0x0001dfff rxmbuf/scratch pad (bcm5721/ bcm5751 only) 64 kb 0x00010000? 0x0001ffff 0x01010000? 0x0101ffff 0x00010000? a 0x0001ffff 0x00010000? a 0x0001ffff unmapped (bcm5705, bcm5705m only) 15m+ 912 kb 0x0001e000? 0x00ffffff 0x0101e000? 0x01ffffff 0x0001e000? 0x00ffffff 0x0001e000? 0x00ffffff unmapped (bcm5721/bcm5751 only) 15m + 904 kb 0x00020000? 0x00ffffff 0x01020000? 0x00ffffff 0x00020000? 0x00ffffff 0x00020000? 0x00ffffff unmapped 16 kb 0x08000000? 0x08003fff ??? rxcpu rom 2 kb 0x40000000? 0x400007ff ??? pci configuration 256b 0xc0000400? 0xc00000ff 0x00000000? 0x000000ff 0x00000000? 0x000000ff 0x00000000? 0x000000ff high priority mailbox 512b ? 0x00000200? 0x000003ff 0x00000200? 0x000003ff 0x00005800? 0x000059ff b functional registers 31 kb 0xc0000400? 0xc0007fff 0x00000400? 0x00007fff 0x00000400? 0x00007fff 0x00000100? 0x00007fff b mailboxes 1 mb ? 0x00100000? 0x001fffff ?? unmapped 32 kb 0xc0030000? 0xc0037fff 0xc0030000? 0xc0037fff 0xc0030000? 0xc0037fff 0xc0030000? 0xc0037fff rxcpu rom slave access 2 kb 0xc0038000? 0xc00387ff 0xc0038000? 0xc00387ff 0xc0038000? 0xc00387ff 0xc0038000? 0xc00387ff b a. indirect access via memory window base address and memory window data registers pair. b. indirect access via register window base ad dress and register window data registers pair. table 83: bcm5705, bcm5788, bcm5721, bcm5751, and bcm5752 address map (cont.) region size nic risc processor view host flat view host standard view host undi view www.datasheet.in bcm57xx programmer?s guide 01/29/08 broadcom corporation page 174 memory maps and pool configuration document 57xx-pg105-r table 84: bcm5714c, bcm5714s, bcm5715c, bcm5715s memory map region size nic cpu view host flat view host standard view host undi view unmapped 256b 0x00000000? 0x000000ff 0x01000000? 0x010000ff 0x00000000?* 0x000000ff 0x00000000?* 0x000000ff send ring rcb 16b 0x00000100? 0x0000010f 0x01000100? 0x0100010f 0x00000100?* 0x0000010f 0x00000100?* 0x0000010f unmapped 240b 0x00000110? 0x000001ff 0x01000110? 0x010001ff 0x00000110? 0x000001ff 0x00000110? 0x000001ff receive return ring rcb 16b 0x00000200? 0x0000020f 0x01000200? 0x0100020f 0x00000200?* 0x0000020f 0x00000200?* 0x0000020f unmapped 240b 0x00000210? 0x000002ff 0x01000210? 0x010002ff 0x00000210? 0x000002ff 0x00000210? 0x000002ff unmapped 2 kb 0x00000300? 0x00000aff 0x01000300? 0x01000aff 0x00000300?* 0x00000aff 0x00000300?* 0x00000aff unmapped 80b 0x00000b00? 0x00000b4f 0x01000b14? 0x01000b4f 0x00000b14? 0x00000b4f 0x00000b14? 0x00000b4f software gencomm 1 kb 0x00000b50? 0x00000f4f 0x01000b50? 0x01000f4f 0x00000b50?* 0x00000f4f 0x00000b50?* 0x00000f4f unmapped 4 kb 0x00000f50? 0x00001fff 0x01000f50? 0x01001fff 0x00000f50? 0x00001fff 0x00000f50? 0x00001fff unmapped 8 kb 0x00002000? 0x00003fff 0x01002000? 0x01003fff 0x00002000? 0x00003fff 0x00002000? 0x00003fff send ring 2 kb 0x00004000? 0x000047ff 0x01004000? 0x010047ff 0x00004000?* 0x000047ff 0x00004000?* 0x000047ff unmapped 6 kb 0x00004800? 0x00005fff 0x01004800? 0x01005fff 0x00004800? 0x00005fff 0x00004800? 0x00005fff standard receive ring 4 kb 0x00006000? 0x00006fff 0x01006000? 0x01006fff 0x00006000?* 0x00006fff 0x00006000?* 0x00006fff unmapped 4 kb 0x00007000? 0x00007fff 0x01007000? 0x01007fff 0x00007000? 0x00007fff 0x00007000? 0x00007fff txmbuf 22 kb 0x00008000? 0x0000c7ff 0x01008000? 0x0100c7ff 0x00008000?* 0x0000c7ff 0x00008000?* 0x0000c7ff unmapped 10 kb 0x0000d800? 0x0000ffff 0x0100d800? 0x0100ffff 0x0000d800? 0x0000ffff 0x0000d800? 0x0000ffff rxmbuf 32 kb 0x00010000? 0x00017fff 0x01010000? 0x01017fff 0x00010000?* 0x00017fff 0x00010000?* 0x00017fff unmapped 15m+91 2 kb 0x00020000? 0x00ffffff 0x01020000? 0x01ffffff 0x00020000? 0x00ffffff 0x00020000? 0x00ffffff rx-cpu scratch pad memory 36 kb 0x08000000? 0x08008fff ?? ? rxcpu rom 2 kb 0x40000000? 0x400007ff ?? ? pci configuration 256b 0xc0000000? 0xc00000ff 0x00000000? 0x000000ff 0x00000000? 0x000000ff 0x00000000? 0x000000ff www.datasheet.in programmer?s guide bcm57xx 01/29/08 broadcom corporation document 57xx-pg105-r memory maps and pool configuration page 175 the bcm5700 mac supports up to 16 mb of external synchronous static memory (ssram). a 512k ssram 64x64 is an example of a smaller memory chip that is available commercially. when this ssram is attached to the bcm5700 mac, the maximum number of send rings may be increased from 4 to 16. additionally, the mini receive producer ring may be enabled. enabling these rings will displace the 96k allocated for packet buffers to an external ssram address range (see table 85 on page 175 ). the bcm5700 mac memory interface supports up to 16m of external ssram. software can allocate a maximum of 8m for buffer pools and 8m for firmware value adds. the hardware design must provide external memory for software to leverage extra features/capabilities in the mac. the following configuration is possible when external ssram is used with bcm5700: ? receive mini producer ring enabled ? receive standard producer ring enabled ? receive jumbo producer ring enabled ? send rings 0?15 enabled ? 96k?8m for packet buffers ? 0-8m addressable memory for firmware value-adds high priority mailbox 512b ? 0x00000200? 0x000003ff 0x00000200? 0x000003ff 0x00005800?** 0x000059ff functional registers 31 kb 0xc0000400? 0xc0007fff 0x00000400? 0x00007fff 0x00000400? 0x00007fff 0x00000100?** 0x00007fff mailboxes 1 mb ? 0x00100000? 0x001fffff ?? unmapped 32 kb 0xc0030000? 0xc0037fff 0xc0030000? 0xc0037fff 0xc0030000? 0xc0037fff 0xc0030000? 0xc0037fff rxcpu spad slave access 0 kb to 32 kb 0xc0030000? 0xc0037fff 0xc0030000?** 0xc0037fff 0xc0030000?** 0xc0037fff 0xc0030000?** 0xc0037fff rxcpu spad slave access 33 kb to 36 kb 0xc003c000? 0xc003cfff 0xc003c000?** 0xc003cfff 0xc003c000?** 0xc003cfff 0xc003c000?** 0xc003cfff rxcpu rom slave access 2 kb 0xc0038000? 0xc00387ff 0xc0038000?** 0xc00387ff 0xc0038000?** 0xc00387ff 0xc0038000?** 0xc00387ff * indirect access via memory window base address and memory window data register pair. ** indirect access via register window base address and register window data register pair. table 85: bcm5700-(external sram only) memory map region size nic risc processor view host flat view host standard view host undi view page zero 256b 0x00000000? 0x000000ff 0x01000000? 0x010000ff 0x00000000? a 0x000000ff 0x00000000? a 0x000000ff send ring rcb 256b 0x00000100? 0x000001ff 0x01000100? 0x010001ff 0x00000100? a 0x000001ff 0x00000100? a 0x000001ff receive return ring rcb 256b 0x00000200? 0x000002ff 0x01000200? 0x010002ff 0x00000200? a 0x000002ff 0x00000200? a 0x000002ff table 84: bcm5714c, bcm5714s, bcm5715c, bcm5715s memory map (cont.) region size nic cpu view host flat view host standard view host undi view www.datasheet.in bcm57xx programmer?s guide 01/29/08 broadcom corporation page 176 memory maps and pool configuration document 57xx-pg105-r the statistics block memory (see table 54 on page 114 ) includes mac statistics, interface statistics, and bcm57xx mib statistics. statistics block 2 kb 0x00000300? 0x00000aff 0x01000300? 0x01000aff 0x00000300? a 0x00000aff 0x00000300? a 0x00000aff status block 80b 0x00000b00? 0x00000b4f 0x01000b00? 0x01000b4f 0x00000b00? a 0x00000b4f 0x00000b00? a 0x00000b4f software gencomm 1 kb 0x00000b50? 0x00000fff 0x01000b50? 0x01000fff 0x00000b50? a 0x00000fff 0x00000b50? a 0x00000fff unmapped b 4 kb 0x00001000? 0x00001fff 0x01001000? 0x01001fff 0x00001000? a 0x00001fff 0x00001000? a 0x00001fff dma descriptors 8 kb 0x00002000? 0x00003fff 0x01002000? 0x01003fff 0x00002000? a 0x00003fff 0x00002000? a 0x00003fff send rings 1?4 8 kb 0x00004000? 0x00005fff 0x01004000? 0x01005fff 0x00004000? a 0x00005fff 0x00004000? a 0x00005fff send rings 5?6 4 kb 0x00006000? 0x00006fff 0x01006000? 0x01006fff 0x00006000? a 0x00006fff 0x00006000? a 0x00006fff send rings 7?8 4 kb 0x00007000? 0x00007fff 0x01007000? 0x01007fff 0x00007000? a 0x00007fff 0x00007000? a 0x00007fff send rings 9?16 16 kb 0x00008000? 0x0000bfff 0x01008000? 0x0100bfff 0x00008000? a 0x0000bfff 0x00008000? a 0x0000bfff standard receive rings 4 kb 0x0000c000? 0x0000cfff 0x0100c000? 0x0100cfff 0x0000c000? a 0x0000cfff 0x0000c000? a 0x0000cfff jumbo receive rings 4 kb 0x0000d000? 0x0000dfff 0x0100d000? 0x0100dfff 0x0000d000? a 0x0000dfff 0x0000d000? a 0x0000dfff mini receive rings 8 kb 0x0000e000? 0x0000ffff 0x0100e000? 0x0100ffff 0x0000e000? a 0x0000ffff 0x0000e000? a 0x0000ffff available region c or (expansion rom) d 32 kb 0x00010000? 0x00017fff 0x01010000? 0x01017fff 0x00010000? a 0x00017fff 0x00010000? a 0x00017fff available region or (expansion rom) 32 kb 0x00018000? 0x0001ffff 0x01018000? 0x0101ffff 0x00018000? a 0x0001ffff 0x00018000? a 0x0001ffff external memory (buffer pool) e 16 mb 0x00020000? 0x00ffffff 0x01020000? 0x01ffffff 0x00020000? a 0x00ffffff 0x00020000? a 0x00ffffff a. indirect access via memory window base address and memory window data registers pair. b. read access to unmapped memory returns unexpected data. write access to unmapped memory has no effect. c. this region is made available to firmware for value adds. d. pxe image is mapped into this region at boot. the host may access the pxe image at this location, 64k total memory is made av ailable e. the external ssram bank is available for packet buffers. a minimum of 96k should be made available. table 85: bcm5700-(external sram only) memory map (cont.) region size nic risc processor view host flat view host standard view host undi view www.datasheet.in programmer?s guide bcm57xx 01/29/08 broadcom corporation document 57xx-pg105-r memory maps and pool configuration page 177 host software should use nic local memory offsets when initializing bcm57xx registers. the indirect, flat, and standard modes are for host processor access to mac local resources. host software must initialize the pool for internal buffer allocation. the mbuf_pool_base_address register (see ?buffer manager control registers? on page 466 ) configures the base location where packet pool allocations are made. this location is different based on internal ssram or external ssram configurations (see the buffer pool memory offsets in table 82 on page 171 and table 85 on page 175 ). when send rings 4-15 are enabled, the entire buffer pool must be relocated to external ssram locations. once a base address is configured, the size of the pool is specified by writing a value to the mbuf_pool_length register (see ?buffer manager control registers? on page 466 ). when an internal memory configuration is programmed, the pool length should be set to 96k. an external memory configuration allows software to allocate a maximum of 8m of buffers. host software should determine the amount of external ssram provided in the hardware application, and then configure the pool length accordingly. both the rx and tx datapaths allocate from the same buffer pool. the receive datapath always has allocation priority over the tx datapath. the tx datapath can wait to complete sends, whereas the rx datapath must drop packets, which is costly. external memory extends the buffer pools from both rx/tx operations and provides packet elasticity for bursty wire traffic. the dma pool must also be configured for bcm5700 through bcm5704 macs. the dma pool provides internal resources for the mac to move buffer descriptors (bds) and frame buffers from/to host memory. the rx/tx mac will get allocations from the pool, so the read/write dma engines can complete a data transfer operation, over the pci bus. the dma_descriptor_pool_base_address (see ?buffer manager control registers? on page 466 ) should be configured using the memory locations specified in table 82 on page 171 and table 85 on page 175 . hardware applications using either internal or external ssram should configure this register to the value 0x2000. the dma descriptor pool length register (see ?buffer manager control registers? on page 466 ) should be configured to span the entire dma descriptor memory map of 8k. the bcm5705, bcm5788, bcm5721, bcm5751, bcm5714c, bcm5714s, bcm5715c, bcm5715s, and bcm5752 macs do not have a dma descriptor resource. the statistics_base_address register (see ?statistics base address register (offset 0x3c40)? on page 457 ) should be set to 0x300 on mac devices that support statistics memory block. the status_block_base_address register (see ?status block base address register (offset 0x3c44)? on page 457 ) should be set to 0xb00 in all netxtreme bcm57xx devices. the configuration of these registers is independent of internal and external ssram. reference the memory maps in table 82 on page 171 and table 85 on page 175 . the bcm5705, bcm5788, bcm5721, and bcm5751, bcm5714c, bcm5714s, bcm5715c, bcm5715s, and bcm5752 macs do not have statistics memory block. note: the buffer pool cannot be split across internal and external memory. www.datasheet.in bcm57xx programmer?s guide 01/29/08 broadcom corporation page 178 pci document 57xx-pg105-r section 9: pci c onfiguration s pace d escription pci, pci-x, and pcie devices must implement sixteen 32-bit pci registers. these registers are required for a device to have pci compliance. the format and layout of these registers is defined in the pci 2.2 specification. capability registers provide system bios and operating systems visibility into a set of optional features, which devices may implement. although the capability registers are not required, the structure and mechanism for chaining auxiliary capabilities is defined in the pci specification. both software and bios must implement algorithms to fetch and program capabilities fields accordingly. refer to section 6.7 of the pci siig 2.2 specification. additional pci configuration space may be used for device-specific registers. however, device-specific registers are not exposed to system software, according to a specification/standard. system software cannot probe device specific registers without a predetermined understanding of the device and its functionality. in summary, three types of pci configuration space registers may be exposed by any particular device: ? required ? optional capabilities ? device specific network devices implement large quantities of registers, and these registers could consume huge amounts of pci configuration space. pci configuration access is not very efficient, on a performance basis. for example, intel x86 architectures use two i/o mapped i/o addresses 0xcf8 and 0x cfc for host-based access to pci configuration space. should a host device driver access these i/o addresses on every device read/write, cpu overhead would grow greatly. generally, host device drivers should not use pci configuration space for standard i/o and control programming. there is one special case?universal network device interface (undi) drivers. undi drivers may not have access to host memory mapped registers when operating in real-mode; thus, an indirect mode of access is necessary. the bcm57xx family implements a pci indirect mode for memory, registers, and mailboxes access. a specific example of a device driver, which uses indirect mode, is the preboot execution (pxe) driver. pxe drivers may be stored in either option roms or directly in the system bios. most host device drivers use register blocks, which are mapped into host memory. memory mapped i/o is an efficient mechanism for pci devices to use system resources. the type and extent of this memory mapping depends upon the mac?s configuration (see the operational characteristics subsection). a typical pci device will decode a range of physical (bus) addresses, which do not conflict with physical memory or other pci devices. each device on the pci bus will request a range of physical memory, and the pnp bios will assign mutually exclusive resources to that device. the size and range of resource is based upon each device?s hardwired programming of the bar. the bcm57xx family implements two modes of memory mapped i/o?standard and flat. i/o mapped i/o is not supported by the bcm57xx family, and there are no i/o space registers. www.datasheet.in programmer?s guide bcm57xx 01/29/08 broadcom corporation document 57xx-pg105-r configuration space page 179 two programmable blocks expose bcm57xx family functionality to host software. the first is a register block. the second is a memory block. the register and memory blocks map into address spaces, based on processor context. for example, the bcm57xx family has two internal risc processors. both risc processors have an internal view of the register and memory blocks. this view is one large contiguous and addressable range, where the register block maps starting at offset 0xc0000000. on the other hand, host processors have two entirely different views. when the bcm57xx family is configured in standard mode, the register block is mapped into a 64k host memory range. the host processor must use a memory window or indirect mode to access the memory block. a flat mode configuration maps both the memory and register blocks into 32 mb of address space. flat mode ties up a much larger range of host memory addresses. it is fundamental to understand that the register and memory blocks are not necessarily tied together. the pci mode and processor context all affect how software views both blocks (see the following figure). figure 63: local contexts 0x00000000 0 xc0000000 0x00020000 internal memory pci configuration space shadow external ssram memory priority mailboxes 1 registers rx cpu scratchpad memory window tx cpu scratchpad rom rsvd 0xc0000400 1 0 xc0008000 0 xc0000100 0xc0000200 1 0 xc0010000 0 xc0030000 rsvd bcm570x family 0 xc0038000 local memory block register block 0x00fffff f 1. the high-priority mailboxes are at offset 0x200 through 0x3ff for host standard and flat modes, and the low-priority mailboxes are at offset 0x5800 through 0x59ff for indirect mode. 2. the local memory addresses in this diagram apply to standard and internal views only. flat mode decodes a different address range. refer to the section on memory maps and pool configuration. 2 2 2 www.datasheet.in bcm57xx programmer?s guide 01/29/08 broadcom corporation page 180 configuration space document 57xx-pg105-r the following components are involved in bcm57xx configuration space mapping: ? base address registers ? standard mode map mode ? flat memory map mode ? indirect access mode ? configuration space header ? host memory ? mac registers ? mac local memory f unctional o verview pci configuration space registers the bcm57xx configuration space can be broken into two regions: header and device specific. table 134: ?pci configuration register summary,? on page 298 shows the registers implemented to support both pci and pci-x functionality in the bcm57xx family. reserved fields in pci configuration registers will always return zero. pci required header region the bcm57xx chips are single function network devices?these chips contain a header type register (see figure 64 and ?header type register (offset 0x0e)? on page 306 ), which is part of the required pci configuration space. the header type register identifies single or multifunction devices by exposing a read-only status bit. bit_7 in the header space record is de- asserted/cleared for the single function bcm57xx chips, since only one pci function is exposed. the bcm57xx dual function devices like bcm5704, bcm 5714, and bcm5715 will have this bit set. figure 64: header type register 0xe single function pci devices may decode access to non-implemented device functions in two ways, per section 3.2.2.3.4 of the pci 2.2 specification: ? a single function device may optionally respond to all function numbers as the same. ? may decode the function number field and respond only to function 0. the bcm57xx single function chips follow the stated technique #1? bios code scanning multifunctions will get target response from function(s) 1-7, but t hese functions are essentially shadows of function 0. software that programs to function(s) 1-7 is re-mapped to function 0. note: bios programmers should take special care to read bit_7 in pci header type register 0xe before scanning the bcm57xx pci configuration space. func devicefunctions: single function = 0 multi-function = 1 header layout [0 ] [6] [7] www.datasheet.in programmer?s guide bcm57xx 01/29/08 broadcom corporation document 57xx-pg105-r configuration space page 181 the header region (see figure 65 ) is required by the pci 2.2 specification. these registers must be implemented. the capabilities registers are optional; however, they must adhere to section 6.7 of the pci siig 2.2 specification. each capabilit y has a unique id, which is well-defined. the capabilities are chained using the next caps field, in the capability register. the last capability will have a next caps field, which is zeroed. figure 65: header region registers device id (0x14e4) 0x00 vendor id 0x04 status register 0x08 class code rev id 0x0c 0x10 cache line size 0x14 bar 1 (lower 32 bits) bytes command register 00 01 02 03 latency timer hdr type bist bar 2 (upper 32 bits) bar 3 not implemented bar 4 not implemented 0x18 0x1c subsystem vendor id subsystem id expansion rom bar 0x20 0x24 bar 5 not implemented bar 6 not implemented cardbus cis ptr (bcm5705, bcm5750 only) 0x28 0x2c 0x30 caps ptr (0x40) reserved int line int pin min gnt max lat 0x34 0x38 reserved 0x3c pci-x caps next caps pci-x command power mgmt cap id next caps power mgmt control/status power mgmt capabilities rsvd power mgmt data vpd cap id next caps vpd addr/flag msi cap id next caps (null) msi control msi address (lower 32 bits) 0x40 msi address (upper 32 bits) 0x44 0x48 0x4c 0x50 0x54 0x58 pci-x status 0x5c capabilities required vpd data msi data 0x60 0x64 header region 0x68 0x00 device specific registers 0xff pci configuration registers 255 b ytes www.datasheet.in bcm57xx programmer?s guide 01/29/08 broadcom corporation page 182 configuration space document 57xx-pg105-r the header region registers are shown in table 86 . table 86: header region registers register cross reference vendor id register see ?vendor id register (offset 0x00)? on page 300 . device id register see ?device id register (offset 0x02)? on page 301 . command register see ?command register (offset 0x04)? on page 302 . status register see ?status register (offset 0x06)? on page 303 . revision id register see ?revision id register (offset 0x08)? on page 304 . class code register see ?class code register (offset 0x09)? on page 305 . cache line size register see ?cache line size register (offset 0x0c)? on page 305 . latency timer register see ?latency timer register (offset 0x0d)? on page 305 . header type register see ?header type register (offset 0x0e)? on page 306 . bist register see ?bist register (offset 0x0f)? on page 306 . base address register 1/2 register see ?base address register 1/2 register (offset 0x10-0x17)? on page 306 . subsystem vendor id register see ?subsystem vendor id register (offset 0x2c)? on page 307 . subsystem id register see ?subsystem id register (offset 0x2e)? on page 309 . expansion rom base address register see ?expansion rom base address register (offset 0x30)? on page 310 . capabilities pointer register see ?capabilities pointer register (offset 0x34)? on page 310 . interrupt line register see ?interrupt line register (offset 0x3c)? on page 310 . interrupt pin register see ?interrupt pin register (offset 0x3d)? on page 311 . minimum grant register see ?minimum grant register (offset 0x3e)? on page 311 . maximum latency register see ?maximum latency register (offset 0x3f)? on page 311 . pci-x capability id register see ?pci-x capability id register (offset 0x40)? on page 312 . pci-x next capabilities pointer register see ?pci-x next capabilities pointer register (offset 0x41)? on page 312 . pci-x command register see ?pci-x command register (offset 0x42)? on page 312 . pci-x status register see ?pci-x status register (offset 0x44)? on page 314 . power management capability id register see ?power management capability id register (offset 0x48)? on page 316 . pm next capabilities pointer register see ?pm next capabilities pointer register (offset 0x49)? on page 316 . power management capabilities (pmc) register see ?power management capabilities register (offset 0x4a)? on page 317 . power management control/status (pmcsr) register see ?power management control/status register (offset 0x4c)? on page 318 . pmcsr-bse register see ?pmcsr-bse register (offset 0x4e)? on page 318 . power management data register see ?power management data register (offset 0x4f)? on page 319 . vpd capability id register see ?vpd capability id register (offset 0x50)? on page 320 . vpd next capabilities (msi) pointer register see ?vpd next capabilities pointer register (offset 0x51)? on page 320 . vpd flag and address register see ?vpd flag and address register (offset 0x52)? on page 320 . vpd data register see ?vpd data register (offset 0x54)? on page 321 . msi capability id register see ?msi capability id register (offset 0x58)? on page 321 . www.datasheet.in programmer?s guide bcm57xx 01/29/08 broadcom corporation document 57xx-pg105-r configuration space page 183 pci device-specific region device-specific registers are not defined in the pci 2.2 specification and are exactly as the name implies?specific to the bcm57xx family. these registers may be used by host software to configure or change the operational state of the mac. the most notable feature exposed via the device specific regist ers is indirect mode. host or system software may use indirect mode to access bcm57xx local memory and register space; no memory mapped i/o is necessary in indirect mode. msi next capabilities (null) pointer register see ?msi next capabilities pointer register (offset 0x59)? on page 321 . message control register see ?message control register (offset 0x5a)? on page 322 . message address register see ?message address register (offset 0x5c)? on page 323 . message data register see ?message data register (offset 0x64)? on page 323 . table 86: header region registers (cont.) register cross reference www.datasheet.in bcm57xx programmer?s guide 01/29/08 broadcom corporation page 184 configuration space document 57xx-pg105-r figure 66: device-specific registers miscellaneous host control 0x68 0x6c dma read/write control 0x70 pci state 0x74 0x78 0x7c register base address bytes 00 01 02 03 memory window base addres s register data r/w 0x80 0x84 0x88 0x8c mode control (shadow register) header region 0x68 0x00 device specific registers 0xff pci configuration registers 255 b ytes clock control memory window data r/w misc configuration (shadow register) misc local control (shadow register) 0x90 reserved 0x94 undi receive bd std ring producer index mailbox undi receive return ring consumer index mailbox 0x98 0xa0 undi send bd ring producer index mailbox reserved 0xb0 0xa8 0xff www.datasheet.in programmer?s guide bcm57xx 01/29/08 broadcom corporation document 57xx-pg105-r configuration space page 185 the device-specific registers are shown in the following table. indirect mode host software may use indirect mode to access the bcm57xx resources, without using memory mapped i/o. indirect mode shadows mac resources to pci configuration space registers. these shadow registers can be read/written by system software through pci configuration space registers. the bcm57xx indirect mode registers expose the following mac resources: ? registers ? local memory ? mailboxes indirect mode access can be used in conjunction with standard or flat mode pci access. indirect mode has no interdependency on other pci access modes and is a mode in itself. table 87: device-specific registers register cross reference miscellaneous host control register see ?miscellaneous host control register (offset 0x68)? on page 325 . dma read/write control register see ?dma read/write control register (offset 0x6c)? on page 327 . pci state register see ?pci state register (offset 0x70)? on page 332 . register base address register see ?register base address register (offset 0x78)? on page 340 . memory window base address register see ?memory window base address register (offset 0x7c)? on page 341 . register data register see ?register data register (offset 0x80)? on page 342 . memory window data register see ?memory window data register (offset 0x84)? on page 342 . undi receive bd standard producer ring producer index mailbox see ?undi receive bd standard producer ring producer index mailbox (offset 0x98)? on page 345 . undi receive return ring consumer index mailbox see ?undi receive return ring consumer index mailbox (offset 0xa0)? on page 345 . undi send bd producer index mailbox see ?undi send bd producer index mailbox (offset 0xa8)? on page 345 . note: host software must assert the indirect_mode_access bit in the miscellaneous host control register (see ?miscellaneous host control register (offset 0x68)? on page 325 to enable indirect mode. www.datasheet.in bcm57xx programmer?s guide 01/29/08 broadcom corporation page 186 configuration space document 57xx-pg105-r indirect register access two pci configuration space register pairs give host so ftware access to the bcm57xx register block. the register_base_address register creates a position in the mac register block. valid positions range from 0x0000-0x8000 and 0x30000-0x38800 ranges. access to the register block from 0x8000-0x30000, should be avoided and is not necessary. the flat and standard modes do map a memory window into the 0x8000-0xffff ranges; however, the memory indirection register pair provides a more efficient mechanism to access the bcm57xx memory block. the register_data register allows host software to read/write, from the indirection position. the register_base_address register can be perceived as creating a cursor/pointer into the register block. the register_data register allows host software to read/write to the location, specified by the register_base_address. this register pair accesses the bcm57xx register block (see figure 67 ). note: if indirect register access is performed using memory write cycles (i.e., by accessing the register_base_address and register_data registers through memory mapped by the pci bar register), as opposed to pci configuration write cycles, the host software must insert a read command to the register_base_address register between two consec utive writes to the register_base_address and register_data registers. note: the pci bar 0 register is only reset to 0 after a hard reset; otherwise, it maintains its value over grc and pci resets. www.datasheet.in programmer?s guide bcm57xx 01/29/08 broadcom corporation document 57xx-pg105-r configuration space page 187 figure 67: register indirect access pci configuration space 0x00000000 bcm570x register block 0x00030000 busx devicey function z ... register base address register data register 0x00034000 tx scratch pad rx scratch pad 0x00038000 rx cpu rom 0x00038800 address may be located anywhere address may be located anywhere address may be located anywhere address may be located anywhere not accessible via register indirect mode bcm570 x registers 0x00008000 register indirect access 0x00000400 www.datasheet.in bcm57xx programmer?s guide 01/29/08 broadcom corporation page 188 configuration space document 57xx-pg105-r indirect memory access memory indirect mode operates in the same fashion to register indirect mode. there is a pci configuration space register pair, which is used to access the bcm57xx memory block. the memory_window_base_address register positions a pointer/cursor in the local memory block. unlike the register_base_address register, the memory_window_base_address register may position at any valid offset. access to ranges 0x00000-0x1ffff (internal memory) and 0x20000-0xffffff (external memory) is allowable. the obvious restriction on external memory access is both size and presence of external ssram (only the bcm5700 mac supports the presence of external ssram). the memory_window_data register is the read/write porthole for host software, using the previously positioned pointer/cursor. this register pair accesses the bcm57xx local memory block (see figure 68 ). note: if indirect memory access is performed using memory write cycles (i.e., by accessing the memory_window_base_address and memory_window_data registers through memory mapped by the pci bar register), as opposed to pci configuration write cycles, the host software must insert a read command to the memory_window_base_address register between two consecutive writes to the memory_window_base_address and memory_window_data registers. note: the pci bar 0 register is only reset to 0 after a hard reset; otherwise, it maintains its value over grc and pci resets. www.datasheet.in programmer?s guide bcm57xx 01/29/08 broadcom corporation document 57xx-pg105-r configuration space page 189 figure 68: indirect memory access pci configuration space 0x00000000 indirect memory access bcm570x memory block busx devicey function z ... memory data register 0x00020000 address may be located anywhere memory base address 0x00ffffff extern al memor y interna l memor y address may be located anywhere address may be located anywhere www.datasheet.in bcm57xx programmer?s guide 01/29/08 broadcom corporation page 190 configuration space document 57xx-pg105-r undi mailbox access the undi mailboxes are shadows of three bcm57xx mailbox registers. all three mailboxes reside in the bcm57xx register block, not memory block. unlike register and memory indirect access, the undi mailboxes shadows are mapped 1:1 to a bcm57xx register; these shadow registers do not have an address register. ? the undi_rx_bd_standard_ring_producer_index_mailbox register shadows a mailbox located at offset 0x5868 (see ?receive bd standard producer ring index register (offset 0x5868)? on page 492 ), in the bcm57xx register block. any index update (write) to the undi_rx_bd_standard_r ing_producer_index_mailbox will advance the standard producer ring index; software signals hardware that an rx buffer descriptor is available. ? the undi_rx_bd_return_ring_consumer_index_mailbox register corresponds to a mailbox located at offset 0x5880 (see ?receive bd return ring 1-16 consumer indices registers (offset 0x5880-0x58f8)? on page 492 ). a update (write) to this register indicates that host software has c onsumed a rx buffer descriptor(s); return rings contain filled enet frames, from the receive mac. ? finally, the undi_tx_bd_nic_producer_mailbox register maps to register offset 0x5980 in the bcm57xx register block (see ?send bd ring 1-16 nic producer indices registers (offset 0x5980-0x59f8, bcm5700 and bcm5701 only)? on page 493 ). host software writes to this register when ethernet frame(s) are ready to be transmitted. host software writes the index of buffer descriptor, which is ready for transmission. notice that all these undi shadows are the first or primary ring and not all the rings are shadowed into pci configuration space. for example, receive return rings 2-16 do not have shadow registers. undi drivers only require a minimal set of registers to provide basic network connectivity. functionality is the most important consideration. fifteen additional receive return rings would extend the size of the device specific portion of the pci configuration space registers. the undi shadow registers alias three registers in the bcm57xx register block (see figure 69 ). www.datasheet.in programmer?s guide bcm57xx 01/29/08 broadcom corporation document 57xx-pg105-r configuration space page 191 figure 69: low-priority mailbox access for indirect mode pci configuration space indirect mailbox access bcm570x register block busx devicey function z ... undi rx bd std ring producer index mailbox undi rx bd return ring consumer index mailbox undi tx bd nic producer index mailbox rx bd std ring producer index 0x00005bff not aliased not aliased 0x00000000 low priority mailbox region ... bcm570 x registers 0x00008000 0x00000400 0x00005800 0x00005868 0x0000586f 0x0005880 tx bd ring 1 nic producer index rx bd return ring 1 consumer index 0x0005980 0x000588f 0x00005987 www.datasheet.in bcm57xx programmer?s guide 01/29/08 broadcom corporation page 192 configuration space document 57xx-pg105-r standard mode standard mode is the most useful memory mapped i/o view provided by the bcm57xx family (see figure 70 ). 64k of host memory space must be made available. the pnp bios or os will program bar0 and bar1 with a base address where the 64k address region may be decoded. the bar registers point to the beginning of the host memory mapped regions where bcm57xx family can be accessed. figure 70: standard memory mapped i/o mode host memory address space bar0 bar1 pci configuration space physical memory busx devicey function z pci configuration space registers (shadow copy) access to this memor y region is remapped b y the hardware. high priority mailboxes bar + 0x00000000 bar + 0x000000ff reserved bar + 0x000001ff bar + 0x000003ff registers bar + 0x00007fff memory window bar + 0x0000ffff 64k ... www.datasheet.in programmer?s guide bcm57xx 01/29/08 broadcom corporation document 57xx-pg105-r configuration space page 193 the bcm57xx family resources listed in the following are decoded in the 64k address block. 32k is partitioned for mac control registers and 32k available for a memory access window. range 0x0000-0x00ff is a complete shadow of the pci configuration space registers?host software can also read/write to the bcm57xx family?s pci configuration space registers via the host memory map. host software may use the shadow registers to change pci register contents and avoid pci configuration cycles (transactions). again, using the host memory map is slightly more efficient. the mac?s control/status registers are mapped from 0x0400-0x8000. see ?register definitions? on page 298 for complete register and bit definitions. finally, the memory window range is 0x8000-0xffff. this 32k window is set in the pci configuration space using the memory_window_base_address register (see figure 71 ). bits 23-15 set the window aperture and bits 14-2 are effectively ignored/masked off. bits 14-2 are relevant when host software uses memory indirection and the memory_window_data register. figure 71: memory window base address register figure 72 shows how the 32k window can float in bcm57xx local memory. the window aligns on 32k boundaries. for example, the memory window may start on the following addresses: 0x8000, 0x10000, and 0x18000. the window aperture may be positioned in the internal memory range 0x00000000 to 0x0001ffff. if external ssram is present, the window aperture may be position in the external memory range 0x00020000 to 0x00ffffff. when host software reads/writes to pci_bar + 32k + offset in the host memory space, t he bcm57xx family translates this read/write access to memory_window_base_address + offset. host software must not read/write from any address greater than pci_bar + 64k, since this memory space is not decoded by the bcm57xx family. such an access may be decoded by another device, or simply go unclaimed on the pci bus. figure 72 shows the relationship between the memory_window_base_address register and the memory window. table 88: pci address map standard view offset name size 0x00000000-0x000000ff pci configuration space 256 bytes 0x00000200-0x000003ff high priority mailboxes 512 bytes 0x00000400-0x00007fff bcm57xx registers 31 kb 0x00008000-0x0000ffff memory window 32 kb rsvd window rsvd [31:24] [14:2] [1:0] xxxx (dont care) [23:15] window aprerature set by bits 23-15 these bits are ignored - 32k windo w position. www.datasheet.in bcm57xx programmer?s guide 01/29/08 broadcom corporation page 194 configuration space document 57xx-pg105-r figure 72: standard mode memory window host memory address space 32k 32k memory window 32k mem wnd base addr p ci configuration space window may be located anywhere window may be located anywhere local memory address space registers 32k physical memory busx devicey function z host software may access bcm570x local memory using this window standard mode memory window ... 0x00ffffff intern al 0x00020000 0x00000000 0x00000000 extern al www.datasheet.in programmer?s guide bcm57xx 01/29/08 broadcom corporation document 57xx-pg105-r configuration space page 195 flat mode flat mode requires 32m of memory (see figure 73 ). flat mode is useful when host software wants all bcm57xx resources host memory mapped; diagnostic software is an example application. mailboxes, send rings, receive rings, and local memory are directly mapped into the host memory space. unlike standard mode, the bcm57xx family?s local memory is addressable through host memory mapped i/o. flat mode should not be used when there are limitations on the amount of memory mapped i/o available. www.datasheet.in bcm57xx programmer?s guide 01/29/08 broadcom corporation page 196 configuration space document 57xx-pg105-r figure 73: flat mode memory map host memory address space bar0 bar1 pci configuration space physical memory busx devicey function z 0x00000000 pci cfg space registers (shadow copy) high priority mailboxes 0x00000400 0x00000200 0x00110000 registers memory window ... reserved irq mailbox 0-3 general mailbox 1-8 rx bd return ring 1-16 consumer index tx bd ring 1-16 host producer index tx bd ring 1-16 nic producer index memory 0x00008000 0x00100000 rx bd send producer index (jumbo, std, mini) 0x00130000 0x00180000 0x001c0000 0x01000000 0x01ffffff 3 2 m b reserved reserved reserved reserved reserved reserved reserved www.datasheet.in programmer?s guide bcm57xx 01/29/08 broadcom corporation document 57xx-pg105-r configuration space page 197 table 89 shows the offsets which are relative to the pci bar?all host address decodes are bar + offset. offsets 0x00- 0xff contain a shadow copy of the pci configuration space registers. host software may use this memory map to read/write to pci configuration space registers. address offsets 0x200-0x3ff are the high-priority mailboxes. table 89: pci address map flat view offset name size 0x00000000-0x000000ff pci configuration space 256 bytes 0x00000200-0x000003ff high priority mailboxes 512 bytes 0x00000400-0x00007fff bcm57xx registers 31 kb 0x00008000-0x0000ffff memory window 32 kb 0x00100000-0x00100007 interrupt mailbox 0 8 bytes 0x00104000-0x00104007 interrupt mailbox 1 8 bytes 0x00108000-0x00108007 interrupt mailbox 2 8 bytes 0x0010c000-0x0010c007 interrupt mailbox 3 8 bytes 0x00110000-0x00110007 general mailbox 1 8 bytes 0x00114000-0x00114007 general mailbox 2 8 bytes 0x00118000-0x00118007 general mailbox 3 8 bytes 0x0011c000-0x0011c007 general mailbox 4 8 bytes 0x00120000-0x00120007 general mailbox 5 8 bytes 0x00124000-0x00124007 general mailbox 6 8 bytes 0x00128000-0x00128007 general mailbox 7 8 bytes 0x0012c000-0x0012c007 general mailbox 8 8 bytes 0x00130000-0x00130007 reserved 8 bytes 0x00134000-0x00134007 receive bd standard producer ring producer index 8 bytes 0x00138000-0x00138007 receive bd jumbo producer ring producer index 8 bytes 0x0013c000-0x0013c007 receive bd mini producer ring producer index 8 bytes 0x00140000-0x00140007 receive bd return ring 1 consumer index 8 bytes 0x00144000-0x00144007 receive bd return ring 2 consumer index 8 bytes 0x00148000-0x00148007 receive bd return ring 3 consumer index 8 bytes 0x0014c000-0x0014c007 receive bd return ring 4 consumer index 8 bytes 0x00150000-0x00150007 receive bd return ring 5 consumer index 8 bytes 0x00154000-0x00154007 receive bd return ring 6 consumer index 8 bytes 0x00158000-0x00158007 receive bd return ring 7 consumer index 8 bytes 0x0015c000-0x0015c007 receive bd return ring 8 consumer index 8 bytes 0x00160000-0x00160007 receive bd return ring 9 consumer index 8 bytes 0x00164000-0x00164007 receive bd return ring 10 consumer index 8 bytes 0x00168000-0x00168007 receive bd return ring 11 consumer index 8 bytes 0x0016c000-0x0016c007 receive bd return ring 12 consumer index 8 bytes 0x00170000-0x00170007 receive bd return ring 13 consumer index 8 bytes 0x00174000-0x00174007 receive bd return ring 14 consumer index 8 bytes 0x00178000-0x00178007 receive bd return ring 15 consumer index 8 bytes 0x0017c000-0x0017c007 receive bd return ring 16 consumer index 8 bytes 0x00180000-0x00180007 send bd ring 1 host producer index 8 bytes 0x00184000-0x00184007 send bd ring 2 host producer index 8 bytes www.datasheet.in bcm57xx programmer?s guide 01/29/08 broadcom corporation page 198 configuration space document 57xx-pg105-r 0x00188000-0x00188007 send bd ring 3 host producer index 8 bytes 0x0018c000-0x0018c007 send bd ring 4 host producer index 8 bytes 0x00190000-0x00190007 send bd ring 5 host producer index 8 bytes 0x00194000-0x00194007 send bd ring 6 host producer index 8 bytes 0x00198000-0x00198007 send bd ring 7 host producer index 8 bytes 0x0019c000-0x0019c007 send bd ring 8 host producer index 8 bytes 0x001a0000-0x001a0007 send bd ring 9 host producer index 8 bytes 0x001a4000-0x001a4007 send bd ring 10 host producer index 8 bytes 0x001a8000-0x001a8007 send bd ring 11 host producer index 8 bytes 0x001ac000-0x001ac007 send bd ring 12 host producer index 8 bytes 0x001b0000-0x001b0007 send bd ring 13 host producer index 8 bytes 0x001b4000-0x001b4007 send bd ring 14 host producer index 8 bytes 0x001b8000-0x001b8007 send bd ring 15 host producer index 8 bytes 0x001bc000-0x001bc007 send bd ring 16 host producer index 8 bytes 0x001c0000-0x001c0007 send bd ring 1 nic producer index 8 bytes 0x001c4000-0x001c4007 send bd ring 2 nic producer index 8 bytes 0x001c8000-0x001c8007 send bd ring 3 nic producer index 8 bytes 0x001cc000-0x001cc007 send bd ring 4 nic producer index 8 bytes 0x001d0000-0x001d0007 send bd ring 5 nic producer index 8 bytes 0x001d4000-0x001d4007 send bd ring 6 nic producer index 8 bytes 0x001d8000-0x001d8007 send bd ring 7 nic producer index 8 bytes 0x001dc000-0x001dc007 send bd ring 8 nic producer index 8 bytes 0x001e0000-0x001e0007 send bd ring 9 nic producer index 8 bytes 0x001e4000-0x001e4007 send bd ring 10 nic producer index 8 bytes 0x001e8000-0x001e8007 send bd ring 11 nic producer index 8 bytes 0x001ec000-0x001ec007 send bd ring 12 nic producer index 8 bytes 0x001f0000-0x001f0007 send bd ring 13 nic producer index 8 bytes 0x001f4000-0x001f4007 send bd ring 14 nic producer index 8 bytes 0x001f8000-0x001f8007 send bd ring 15 nic producer index 8 bytes 0x001fc000-0x001fc007 send bd ring 16 nic producer index 8 bytes 0x01000000-0x01ffffff memory 16 mb table 89: pci address map flat view (cont.) offset name size www.datasheet.in programmer?s guide bcm57xx 01/29/08 broadcom corporation document 57xx-pg105-r configuration space page 199 the proceeding host memory ranges are relative to the bcm57xx pci bar?the address decodes are bar + offset. offsets 0x00-0xff contain a shadow copy of the pci configuration space registers. host software may use this memory map to read/ write to pci configuration space registers. address offsets 0x200-0x3ff are high priority mailboxes. there are several similarities to standard mode. first, bcm57xx registers are memory-mapped into the host offsets 0x400- 0x7fff. see ?register definitions? on page 298 for complete register and bit definitions. second, the 32k memory window is available in flat mode. however, host software should just use the direct memory map, at bar + offsets 0x01000000- 0x01ffffff. the direct memory map requires no setup (pci memory base address register), and is always available in flat mode. see ?standard mode? on page 192 for the discussion of the memory window in the standard mode. figure 74 on page 200 shows the flat mode memory map. the interrupt mailboxes are accessible from bar + offsets 0x00100000 to 0x0010c007. host software may use this memory map to access the interrupt mailboxes located in bcm57xx family?s register block (0x200-0x21f). the receive producer (mini, standard, jumbo) consumer index mailboxes are available at offsets 0x00130000-0x0013c0007. receive return ring mailboxes are shadowed at bar + offsets 0x00140000 to 0x00 17c007. the bcm57xx family receive return rings are located in register block range 0x280-0x2ff. host-based send rings are located at bar + offsets 0x001800000?0x001bc007. these sent mailbox es are mapped from the bcm57xx register block range 0x300-0x37f. finally, the nic-based send rings start at offset 0x001c0000 and end at offset 0x001fc007. again, the nic-based send rings are mapped from the bcm57xx register space addresses 0x380?0x3ff. the address ranges 0x01000000-0x01ffffff are aliases for the bcm57xx device local memory. this includes both internal and external memory?the entire device memory region. when host software reads/writes from address ranges starting at bar + 0x01000000, the address is normalized/mapped to a device local address starting at 0x00000000. for example, the host address 0x010000ff is translated to device local address 0x000000ff. figure 75 on page 201 shows the two mechanisms host software may use to access bcm57xx local memory (flat mode configuration). ? first, host software can use the memory window. ? second, host software may access the memory-mapped range 0x01000000 to 0x01ffffff. the second technique is preferable since flat mode has made 32m of host memory-mapped space available. software does not need to use the memory window since the bcm57xx family?s entire memory region is memory-mapped. www.datasheet.in bcm57xx programmer?s guide 01/29/08 broadcom corporation page 200 configuration space document 57xx-pg105-r figure 74: flat mode memory map host memory address space 0x00000000 pci cfg space registers (shadow copy) high priority mailboxes 0x00000100 0x00000400 0x00000200 0x00110000 registers memory window reserved irq mailbox 0-3 general mailbox 1-8 rx bd return ring 1-16 consumer index tx bd ring 1-16 host producer index tx bd ring 1-16 nic producer index memory 0x00008000 0x00010000 0x00100000 rx bd producer index (jumbo, std, mini) 0x00130000 0x00140000 0x00180000 0x001c0000 0x00100000 - 0x00100007 irq mb0 address range name 0x00104000 - 0x00104007 irq mb1 0x00108000 - 0x00108007 irq mb2 0x0010c000 - 0x0010c007 irq mb3 0x00110000 - 0x00110007 general mb1 address range name 0x00114000 - 0x00114007 general mb2 0x00118000 - 0x00118007 general mb3 0x0011c000 - 0x0011c007 general mb4 0x00120000 - 0x00120007 general mb5 0x00124000 - 0x00124007 general mb6 0x00128000 - 0x00128007 general mb7 0x0012c000 - 0x0012c007 general mb8 0x00134000 - 0x00134007 std ring address range name 0x00138000 - 0x00100007 jumbo ring 0x0013c000 - 0x0013c007 mini ring 0x00140000 - 0x00140007 rx ret ring1 address range name 0x00144000 - 0x00144007 rx ret ring2 0x00148000 - 0x00148007 rx ret ring3 0x0014c000 - 0x0014c007 rx ret ring4 0x00150000 - 0x00150007 rx ret ring5 0x00154000 - 0x00154007 rx ret ring6 0x00158000 - 0x00158007 rx ret ring7 0x0015c000 - 0x0015c007 rx ret ring8 0x00160000 - 0x00160007 rx ret ring9 0x00164000 - 0x00164007 rx ret ring10 0x00168000 - 0x00168007 rx ret ring11 0x0016c000 - 0x0016c007 rx ret ring12 0x00170000 - 0x00170007 rx ret ring13 0x00174000 - 0x00174007 rx ret ring14 0x00178000 - 0x00178007 rx ret ring15 0x0017c000 - 0x0017c007 rx ret ring16 0x00180000 - 0x00180007 tx host ring1 address range name 0x00184000 - 0x00184007 tx host ring2 0x00188000 - 0x00188007 tx host ring3 0x0018c000 - 0x0018c007 tx host ring4 0x00190000 - 0x00190007 tx host ring5 0x00194000 - 0x00194007 tx host ring6 0x00198000 - 0x00198007 tx host ring7 0x0019c000 - 0x0019c007 tx host ring8 0x001a0000 - 0x001a0007 tx host ring9 0x001a4000 - 0x001a4007 tx host ring10 0x001a8000 - 0x001a8007 tx host ring11 0x001ac000 - 0x001ac007 tx host ring12 0x001b0000 - 0x001b0007 tx host ring13 0x001b4000 - 0x001b4007 tx host ring14 0x001b8000 - 0x001b8007 tx host ring15 0x001bc000 - 0x001bc007 tx host ring16 0x01000000 0x00130000 - 0x00130007 reload stats 0x001c0000 - 0x001c0007 tx nic ring1 address range name 0x001c4000 - 0x001c4007 tx nic ring2 0x001c8000 - 0x001c8007 tx nic ring3 0x001cc000 - 0x001cc007 tx nic ring4 0x001d0000 - 0x001d0007 tx nic ring5 0x001d4000 - 0x001d4007 tx nic ring6 0x001d8000 - 0x001d8007 tx nic ring7 0x001dc000 - 0x001dc007 tx nic ring8 0x001e0000 - 0x001e0007 tx host ring9 0x001e4000 - 0x001e4007 tx host ring10 0x001e8000 - 0x001e8007 tx host ring11 0x001ec000 - 0x001ec007 tx host ring12 0x001f0000 - 0x001f0007 tx host ring13 0x001f4000 - 0x001f4007 tx host ring14 0x001f8000 - 0x001f8007 tx host ring15 0x001fc000 - 0x001fc007 tx host ring16 reserved reserved reserved reserved reserved reserved www.datasheet.in programmer?s guide bcm57xx 01/29/08 broadcom corporation document 57xx-pg105-r configuration space page 201 figure 75: techniques for accessing bcm57xx local memory host memory address space physical memory 0x00000000 pci cfg space registers (shadow copy) high priority mailboxes 0x00000400 0x00000200 0x00110000 general mailbox 1-8 rx bd return ring 1-16 consumer index tx bd ring 1-16 host p roducer index tx bd ring 1-16 nic producer index memory 0x00008000 0x00100000 rx bd send producer index (jumbo, std, mini) 0x00130000 0x00140000 0x00180000 0x001c0000 0x01000000 0 x01ffffff reserved reserved reserved reserved reserved reserved local memory address spac e 0x00ffffff 0x00020000 0x00000000 internal memory external memory registers reserved memory window reserved irq mailbox 0-3 memory window memory window window may be located anywhere window may be located anywhere www.datasheet.in bcm57xx programmer?s guide 01/29/08 broadcom corporation page 202 configuration space document 57xx-pg105-r m emory m apped i/o r egisters the following bcm57xx registers are used in the mode configuration of the pci memory-mapped i/o. pci command register the pci_command register is 16 bits wide (see figure 76 ). the bcm57xx family does not have i/o mapped i/o. the i/o_space bit is de-asserted by hardware. the bcm57xx family does support memory_mapped_memory and hardware will assert the memory_space bit. both these bits are read-only and are usually read by the pnp bios/os. the bios/os examines these bits to assign non-conflicting resources to pci devices. figure 76: pci command register pci state register the pci_state register is 32 bits wide. operating mode is set with the flat_view bit in the pci_state register. when the flat_view bit is asserted, the bcm57xx family decodes a 32m of block host memory. when the flat_view bit is de-asserted, the bcm57xx family decodes a 64k block of host memory. mem i/o i/o space read only always = 0 [0] bus mast spec cycle write invld vga snoop parity error step ctrl sys err fast back 2 back rsvd [1] [2] [3] [7] [6] [5] [4] [9] [8] [15:10] memory space read/write www.datasheet.in programmer?s guide bcm57xx 01/29/08 broadcom corporation document 57xx-pg105-r configuration space page 203 pci base address register the pci_base_address register (bar) specifies the location of a bcm57xx memory mapped i/o block. the bcm57xx mode configuration (flat vs. standard) affects how the bar is setup (see figure 77 ). ? bits 4-31 in the pci_base_address register are selectively programmable based on the amount of host memory requested. the pnp bios/os will use an algorithm to test the bar bits and determine the amount of physical memory requested. ? the memory_space_indicator bit designates whether the bar is memory or i/o mapped. the bcm57xx hard codes the memory_space_indicator bit to zero (de-asserted). ? the location/type bits specify locations in host memory space where a device can decode physical addresses. the bcm57xx memory mapped i/o range may be placed anywhere in 64-bit address space (type = 10). ? the bcm57xx family de-asserts the prefetchable bit to indicate that the memory range should not be cached. figure 77: pci base address register the bcm57xx 64k memory mapped i/o block is determined by the first programmable bit in the bar. when the mac is configured in standard mode, the mask 0xffff0000 identifies the bar bits, which are programmable. bit 16 is the first bit encountered in the scan upward, which is programmable; bits 0-3 are ignored. host software will read zero values from bits 4-16. figure 78 shows the bar register and the bits returned to the os/bios during resource allocation. figure 78: pci base address register bits read in standard mode base address p type m memory space indicator: i/o = 1 memory = 0 location: 00 = anywhere 01 = below 1 mb 10 = anywhere in 64-bit addr spac e 11 = reserved prefetchable: 0 = disabled 1 = enabled binary weighted value: the 1st programmable bit (ascending) indicates requested block size. [0] [2:1] [3] [31:4] xxxx xxxx xxxx xxx1 0000 0000 0000 0 11 0 [0 ] [2:1] [3] [31:4] binary weighted value: 0x00010000 = 64k x's are don't cares ignored: bits 0-3 www.datasheet.in bcm57xx programmer?s guide 01/29/08 broadcom corporation page 204 configuration space document 57xx-pg105-r when the bcm57xx mac is programmed in flat mode, a 32m region of memory mapped i/o needs to be made available. the pnp bios/os will probe the bar, and scan upwards looking for the first programmable bit. again, bits 0-3 are ignored. the mask 0xe000000 identifies the bar bits, which are programmable. bit 25 is the first bit encountered in the scan upward, which is programmable. host software will read zero values from bits 4-24. figure 79 shows the bar register and the bits returned to the os/bios during resource allocation. figure 79: pci base address register bits read in flat mode r egister q uick c ross r eference bcm57xx family the bcm57xx pci registers are listed in table 90 . table 90: bcm57xx pci registers register bit cross reference pci command memory_space see ?command register (offset 0x04)? on page 302 . pci command io_space see ?command register (offset 0x04)? on page 302 . pci state flat_view see ?pci state register (offset 0x70)? on page 332 . pci base address 1 all see ?base address register 1/2 register (offset 0x10-0x17)? on page 306 . pci base address 2 all see ?base address register 1/2 register (offset 0x10-0x17)? on page 306 . xxxx xx10 0000 0000 0000 0000 0000 0 11 0 [0 ] [2:1] [3] [31:4] binary weighted value: 0x02000000 = 2m x's are don't cares www.datasheet.in programmer?s guide bcm57xx 01/29/08 broadcom corporation document 57xx-pg105-r configuration space page 205 p seudocode ? variable bcm57xxmemaddr represents a local memory address. ? variable bcm57xxmembase represents a 32k aligned local memory address. ? variable bcm57xxmemoffset represents a byte offset. ? pci_cfg_write(address, value ) is a routine to write the device's pci configuration space register. ? pci_cfg_read(address) is a routine to return the contents of the device's pci configuration space register. memory window read in standard mode bcm57xxmembase = bcm57xxmemaddr & 0xffff0000 bcm57xxmemoffset = bcm57xxmemaddr & 0x0000ffff pci_cfg_write(memory_window_base_address, bcm57xxxmembase) value = *(pci_bar + 0x8000 + bcm57xxmemoffset) memory window write in standard mode bcm57xxmembase = bcm57xxmemaddr & 0xffff0000 bcm57xxmemoffset = bcm57xxmemaddr & 0x0000ffff pci_cfg_write(memory_window_base_address, bcm57xxxmembase) *(pci_bar + 0x8000 + bcm57xxmemoffset) = value register read in standard mode value = *(pci_bar + 0x400 + bcm57xx_register_offset) register write in standard mode *(pci_bar + 0x400 + bcm57xx_register_offset) = value memory read in flat mode 1 value = *(pci_bar + 0x01000000 + bcm57xxmemaddr) memory write in flat mode 1 *(pci_bar + 0x01000000 + bcm57xxmemaddr) = value register read in flat mode value = *(pci_bar + 0x400 + bcm57xx_register_offset) register write in flat mode *(pci_bar + 0x400 + bcm57xx_register_offset) = value memory read using indirect mode pci_cfg_write(memory_window_base_address, bcm57xxxmemaddr) value = pci_cfg_read(memory_window_data) memory write using indirect mode pci_cfg_write(memory_window_base_address, bcm57xxxmemaddr) pci_cfg_write(memory_window_data, value) 1. the scratchpad and rom regions must be accessed using indirect register pairs. www.datasheet.in bcm57xx programmer?s guide 01/29/08 broadcom corporation page 206 bus interface document 57xx-pg105-r register read using indirect mode pci_cfg_write(register_base_address, bcm57xxxregaddr) value = pci_cfg_read(register_data_register) register write using indirect mode pci_cfg_write(register_base_address, bcm57xxxregaddr) pci_cfg_write(register_data_register, value) b us i nterface d escription the read/write dma engines both drive the pci interface. normally, each dma engine alternates bursts to the pci bus, and both interfaces may have outstanding transactions on the pci bus. the bcm57xx architecture identifies two channels?a read dma channel and a write dma channel. each channel corresponds to the appropriate dma engine (see figure 80 ). the configuration of the dma engines and the pci interface is discussed in this section. figure 80: read and write channels of dma engine pci interface write fifo read fifo dma write engine dma read engine write channel read channel pci/pci-x bus www.datasheet.in programmer?s guide bcm57xx 01/29/08 broadcom corporation document 57xx-pg105-r bus interface page 207 the following architectural components are involved in the configuration of the pci/dma interface: ? dma read engine ? dma write engine ? dma read fifo ? dma write fifo ? pci interface and connector ? pci state register ? dma read/write register o perational c haracteristics bus mode detection the conventional_pci bit is for status and is located in the pci state register (see ?pci state register (offset 0x70)? on page 332 ). this bit reflects the operational mode of the pci/pci-x interface. software may read this bit to determine the operational state of the bcm57xx pci interface. when this bit is cleared, the bcm57xx family supports pci-x operation. the mac uses a standard pci protocol when this bit is asserted. host software should not set this bit and may read this bit to determine current pci/pci-x operational mode. a pci bus may be either 32 or 64 bits wide. the bcm57xx family will detect bus width and configure itself to use the widest bus topology available. the bcm57xx bus width is init ialized after device reset based on the sampling of req64 . the 32_bit_bus_mode bit is read only and is located in the pci state register. this bit reflects the bus width of the bcm57xx pci/pci-x interface. if a 32-bit bus mode is detected, the req64 signal is not asserted by the pci interface. when the req64 is asserted, 32_bit_pci_bus bit is clear. additionally, the pci interface will not assert ack64 as a transaction target response. the bcm57xx family will also drive the ack64 signal, when a target response is required. figure 81 shows a timing diagram where the 32_bit_pci_bus bit is shown to affect the req64 and ack64 signals. the bcm57xx family supports 33/66 mhz pci and 66/133 mhz pci-x bus speeds. the 33/66pci_66/133pcix_mode bit is read only and is also located in the pci state register. this bit reflects both pci and pci-x bus speeds. a deasserted bit indicates the pci interface operates at 33 mhz or the pci-x interface operates at 66 mhz. an asserted bit indicates the pci interface operates at 66 mhz or the pci-x interface operates between 66-133 mhz. host software may read this bit to determine the bus frequency sampled by the bcm57xx bus interface. www.datasheet.in bcm57xx programmer?s guide 01/29/08 broadcom corporation page 208 bus interface document 57xx-pg105-r figure 81: 32_bit_pci_bus bit affects the req64 and ack64 signals frame pci_clk ad[0..31] ad[32..63] c/be[3..0] c/be[4..7] low high dac cmd cmd high byte enables data data data data byte enables a ssert for 64-bit mode irdy trdy devsel req64 ack64 assert for 64-bit mode no assertion for 32-bit mode no assertion for 32-bit mod e www.datasheet.in programmer?s guide bcm57xx 01/29/08 broadcom corporation document 57xx-pg105-r bus interface page 209 pci command usage host software may override the default command encoding for pci read and write transactions. the bcm57xx family drives a command word onto the c/be lines during the address phase of a transaction (see figure 82 ). figure 82: host software can ov erride default pci command encoding frame pci_clk ad[0..31] ad[32..63] c/be[3..0] c/be[4..7] low high dac cmd cmd high byte enables data data data data byte enables pci read/write command e ncoding may be programmed irdy trdy devsel www.datasheet.in bcm57xx programmer?s guide 01/29/08 broadcom corporation page 210 bus interface document 57xx-pg105-r the default_pci_write_command and default_pci_read_command bits in the dma read/write control register (see ?dma read/write control register (offset 0x6c)? on page 327 ) are read/write. the mac defaults the default_pci_write_command bits to 0x00 on reset. the value 0x7 is the pci v2.2 specified encoding for a pci write. the default_pci_read_command bits default to 0x00 at device reset. the value 0x6 is the pci v2.2 specified encoding for a pci read. the bcm57xx family may align pci transactions using the command byte enable signals on the pci bus. the assert_all_be_on_dma_write bit is also located in the dma read/write control register and this bit is read/write. software may set this bit to force all c/be lines to be asserted during a pci write transaction. for example, the pci interface on the bcm57xx family may only need to write one byte to address 0x0003. when the bcm57xx family is operating in 32-bit mode, the pci interface will assert c/be [3] and drive valid data on ad[24..31]. t he master still needs to drive all 32-bit address lines (and parity) even though it only asserts one be. when this bet is set, the master will assert all c/be [0..3] lines (see figure 83 ). the address block 0x0000 to 0x0003 will be written. enabling the assert_all_bes_on_dma bit requires the bcm57xx family to drive valid data on ad[0..31]. note: for the bcm57xx family, it is recommended that host software use the following settings listed in table 91 for device initialization. any change to these register bits may seriously affect pci bus transactions; therefore, it is not recommended that host software use these values. table 91: recommended setting for pci command encoding register bit field name recommended value dma read/write control default_pci_write_command 0x07 dma read/write control default_pci_read_command 0x06 www.datasheet.in programmer?s guide bcm57xx 01/29/08 broadcom corporation document 57xx-pg105-r bus interface page 211 figure 83: all c/be [0..3] lines asserted and all data lines valid the memory write and invalidate (mwi) pci command requires the master to terminate all write transactions on cache line boundary. for example, the intel pentium iii architecture has a cache line size of 32 bytes. the dma write engine will terminate all memory write and invalidate transactions on a 32-byte boundary; the pci v2.2 specification states that mwi commands must terminate on a cache line. host software can enable mwi by setting the memory_write_and_invalidate bit in the pci configuration space command register (see ?command register (offset 0x04)? on page 302 ). this bit defaults to disabled after reset. the reader is strongly encouraged to reference broadcom errata notes for the device being used. the memory read (mr) command is used when a transaction data phase is two cycles or less. the mr command does not allow a host pci bridge to prefetch data. the pci interface may use the memory read line (mrl) command when a transaction data phase is between two cycles and one cache line long?the host pci bridge may prefetch up to a cache line worth of data. a transaction data phase that exceeds one cache line uses the memory read multiple (mrm) pci command. the host pci bridge will prefetch data for a mrm command while the master asserts frame . the mrm command provides the host pci bridge the performance gain of prefetching data beyond a cache line. both the mrl and mrm commands do not have to read an entire cache line, and the master may terminate the transaction before the entire cache line is read. pci_clk ad[24..31] d4 d8 the c/be lines all asserted an d all data lines valid irdy trdy devsel a4 a d[16..24] d3 d7 a3 ad[8..15] d2 d6 a2 c/be1 ad[0..7] d1 d5 a1 c/be0 legend: asserted (bit set) frame c/be3 c/be2 www.datasheet.in bcm57xx programmer?s guide 01/29/08 broadcom corporation page 212 bus interface document 57xx-pg105-r host software may configure the pci interface to use the memory read multiple in place of the memory read line command. the use_memrdmult_command bit is read/write and located in the dma read/write control register (see ?dma read/write control register (offset 0x6c)? on page 327 ). this bit defaults to zero after device reset. software can use this bit to disable the pci memory read multiple command on the bcm57xx family. read/write dma engines software must enable the bus master dma bit for the bcm57xx family. the bcm57xx family is a bus-mastering device and the pci interface requires that the bus_master enable bit be set by either the bios or host device driver. a bus master drives the transaction boundary signal frame and is responsible for sourcing the address phase of a transaction. the bus master is the pci transaction initiator. a pci target will claim the transaction driven by the bus master. the bus_master enable bit is located in the pci configuration space command register (see ?command register (offset 0x04)? on page 302 ) and this bit is read/write. the bit defaults to cleared/disabled after device reset. a pci bus master may terminate a transaction under two conditions: completion and timeout. a completion occurs when all the necessary data has been read/written to the pci target. a timeout occurs when the master latency timer (mlt) expires. the memory write and invalidate transaction may not be terminated immediately should the mlt expire. the memory write and invalidate must complete on a cache line boundary. the memory write and invalidate transaction is an exception to a mlt timeout. a pci master must normally terminate a transaction after its grant line (gnt ) and the mlt expire. the bcm57xx dma read/ write engines may be programmed to end transactions on a boundary address regardless of termination conditions. host software may align addresses for transaction termination for many reasons: ? the master may maximize the prefetch capability of a target device. only memory read line and memory read multiple pci transactions allow target prefetch. the pci target may prefetch data into a fifo, so the data may be burst efficiently on the pci bus. otherwise, a target device will insert wait states into the transaction. ? host software may need to program these registers should a transaction target be a streaming device. once data is prefetched into a read/write fifo, streaming data cannot be recovered. host software may need to write a certain number of bytes per dma without exception. both the dma_read_address_boundary and dma_write_address_boundary bit fields are located in the dma read write register (see ?dma read/write control register (offset 0x6c)? on page 327 ) and these bit fields are read/write. the bit fields are 3-bit encoded and default to 0x000 after power on reset. the bit field encodings have different meanings based on pci vs pci-x bus context. host software should be careful to check the detected bus configuration before programming these bit fields. otherwise, dma read/write transaction termination may not align on a desired boundary. by setting read/write dma boundary registers, the device will always terminate whenever it hits that boundary regardless of whether it still has more data it wants to dma, and regardless of whether its mlt has expired or whether it still has gnt . in general, broadcom does not recommend that software set these registers because they will usually result in shorter bursts that will hurt overall performance. the bcm57xx architecture defines two dma channels?a read and write channel. each dma engine must share a common pci interface and arbitrate for bus bandwidth accordingly. host software may prevent both the read and write dma engines from driving simultaneous transactions on the pci bus. a deferred pci transaction or a split pci-x transaction is a situation where both dma engines may drive simultaneous bus transactions. host software can serialize the dma engines so each engine must wait for the previous engine to complete deferred or split transactions. once a transaction completes, the waiting dma engine can initiate its burst transaction. the one_dma_at_once bit is read/write and is also located in the dma read write control register. this register defaults to a value of zero on reset; both engines may alternate bursts. www.datasheet.in programmer?s guide bcm57xx 01/29/08 broadcom corporation document 57xx-pg105-r bus interface page 213 the read and write engines may both access the pci interface. the pci interface normally alternates burst traffic between both engines. once the burst transaction is terminated, the other dma engine is granted access to the pci interface. each engine?s transaction may be either master or target terminated. a pci target may delay a pci transaction by terminating with a retry; the master may consider the transaction outstanding. a pci-x transaction may be terminated with a split completion and the target will burst data back to the master later (see ?pci-x host bus interface (applicable to bcm5700, bcm5701, BCM5703c, BCM5703s, bcm5704c, and bcm5704s)? on page 83 ). both scenarios allow the other dma engine to initiate a new transaction. the minimum_dma bit field is read/write and is also located in the dma read/write register. this register?s unit of measure is scaled to the pci bus width. a 32-bit bus associates pci word (32-bit) units to this bit field. a 64-bit bus associates pci dword (64-bit) units to this bit field. software should check the 32_bit_bus_mode bit in the pci_state register (see ?pci state register (offset 0x70)? on page 332 ) before programming the minimum_dma field. the minimum_dma bit field configures the minimum number of pci words burst before the pci/pci-x interface is relinquished to the other dma channel. this configuration allows one dma engine to complete a burst before preemption by the other dma engine. the preemption is for the physical pci interface since each dma channel is independently governed. only one channel can drive the physical pci interface at any moment. larger dma bursts generally utilize pci/ pci-x bandwidth more efficiently; however, software increases dma read/write latency (not pci transaction latency) by setting a larger value in the minimum_dma bit field. dma latency increases for each microsecond an engine must wait. the read and write dma channels use fifos to buffer small amounts of pci bus data. the fifos provide elasticity for data movement between internal memory and the pci interface. host software may configure dma watermarks?values where pci activity is enabled/disabled (see figure 84 ). when enqueued data is less than the watermark value, pci bus transactions are inhibited. the dma channel will wait until the fifo fills above the threshold before initiating pci transactions. host software may configure the dma_write_watermark bit fields to set the activity threshold in the write fifo. the dma_write_watermark bit field is read/ write and is also located in the dma read/write register. the dma_read_watermark is located in the dma read/write register and sets the activity threshold in the read fifo. the dma_read_watermark bit field is read/write. both the read and write watermark registers default to zero after power-on reset. when the bcm5704 performs a dma read to access a buffer descriptor that ends exactly on any multiple of 4 gb, the bcm5704 will generate a host address overflow error, even though the buffer descriptor does not actually cross over the 4 gb boundary. to avoid this fatal error, the host driver must ensure that all buffer descriptors do not end on any multiple of 4 gb. this is not an issue for bcm5704 b0 and later. www.datasheet.in bcm57xx programmer?s guide 01/29/08 broadcom corporation page 214 bus interface document 57xx-pg105-r figure 84: watermark levels for pci and pci-x queued data 512 b ytes d eep 32 64 96 128 160 192 224 256 entries above threshold intitiate pci activity 0 512 bytes deep 64 128 384 256 entries above threshold intitiate pci activity 0 pci thresholds pci-x thresholds watermark watermark www.datasheet.in programmer?s guide bcm57xx 01/29/08 broadcom corporation document 57xx-pg105-r bus interface page 215 parity errors bus masters are responsible for driving par and par64 on pci transactions (see figure 85 ). the par signal corresponds to ad[0..31] lines, and the par64 signal matches to the ad[32..63] lines. the bcm57xx family drives the parity signals on bus master initiated transactions. driving the par and par64 signals is required per section 3.7.1 in the pci v2.2 specification. a pci target device will assert perr when a data phase parity error is detected. figure 85: bus masters drive par and par64 on pci transactions parity_error_enable is a read/write bit in the pci configuration space command register (see ?command register (offset 0x04)? on page 302 ). host software should set this bit to enable the pci/pci-x interface reporting of parity errors for both bcm57xx pci target claim and master initiated transacti ons. the bcm57xx family (target) will assert the perr signal when the parity_error_enable bit is enabled. this bit is disabled on reset. the target of a pci transaction may assert the perr signal. the bcm57xx family (target) will detect parity errors and assert the perr signal if a data phase parity error is detected. software may still poll the pci configuration space status register (see ?status register (offset 0x06)? on page 303 ) and read the detected_parity_error bit. this bit will always be set regardless of whether the bcm57xx family asserts the perr signal. the parity_error_enable bit enables/disables the perr signal; whereas the status bit will always reflect parity error for target transactions. software must explicitly clear this bit to differentiate a subsequent transaction. frame pci_clk ad[0..31] a d[32..63] c/be[3..0] c/be[4..7] low high dac cmd cmd high byte enables d1 d2 d1 d2 byte enables par64 p1 p2 par p1 p2 perr e1 e2 bcm57xx drives par for ad[0..31] as a busmaster bcm57xx drives par64 fo r ad[32..63] as a busmaster bcm57xx asserts perr a s target (when bit enabled) www.datasheet.in bcm57xx programmer?s guide 01/29/08 broadcom corporation page 216 bus interface document 57xx-pg105-r the bcm57xx family (master) will assert the master_data_parity_error bit also in the pci configuration space status register when the transaction target asserts perr . the bcm57xx family (master) is responsible for driving par and par64 during the data phase of a transaction. the target device can detect a parity error, then respond with a perr assertion. the target will assert perr when the par/par64 signals do not match the parity of the data driven on the ad[31:0]/ad[63:32] lines. unlike the detected_parity_errors bit, the master_dat a_parity_error bit will only be asserted when parity error detection is enabled?see parity_error_detection bit in the pci command register (above). host software may query the read_dma_pci_parity_error bit in the read dma status register. this bit should be asserted when the bcm57xx family read channel encounters a parity error during a bus master read transaction. the assertion of this bit has a relationship to the assertion of the master_data_parity_error bit?both bits should assert on a read parity error . this bit reveals more details regarding the type of pci transaction on which the parity error surfaced. diagnostic software is an example host application interested in reading this bit. the dma write channel will also report parity errors to host software. the write_dma_pci_parity_error bit is set when the dma write engine encounters a parity error during a write transaction to a target device. the write_dma_pci_parity_error bit has a relationship to the master_data_parity_error bit; both bits are set on a write transaction parity error. the write_dma_pci_parity_error bit is located in the write dma status register and software must write to clear this bit. this bit defaults to zero after reset. this bit reflects pari ty errors for bcm57xx family (master) write transactions. the message signaled interrupt (msi) portion of the mac architecture uses the pci interface to write message values to a host mailbox (see ?msi? on page 289 ). the msi engine will record parity errors encountered during a pci write or pci-x write dword transaction. the pci_parity_error bit in the msi status register (see ?msi status register (offset 0x6004)? on page 499 ) reflects the detected parity error. the master_data_parity_error bit is also set when a bus master msi write detects the parity condition. the pci_parity_error bit is located in the msi status register, and software must write to clear this bit. the bit defaults to zero after reset. a parity error and recovery feature is available when the mac is operating in pci-x mode. the bcm57xx family will assert the serr signal when a parity error is detected. when the data_parity_error_recovery_enable bit is set, the mac will avoid the assertion of serr . host software may implement a recovery methodology. the bcm57xx architecture allows a host driver to reset the mac, under this scenario. the bcm57xx family will not retry the transaction. the data_parity_error_recovery_enable bit is located in the pci-x command register (see ?pci-x command register (offset 0x42)? on page 312 ); this bit is read write and defaults to zero after reset. note: most server chipsets are configured to assert a nmi when a parity error is first detected. the assertion of perr on such chipsets allows the bcm57xx family to master terminate a transaction; however, a nmi will be generated regardless. a parity nmi may result in an o/s fault. for example, a blue screen under microsoft ? windows. parity recovery requires the coordination of many system software components: o/s, bios, and device drivers. the configuration of the data_pci_p arity_error_recovery_enable bit must be coordinated as a system wide application. this configuration of this bit, by itself, is not sufficient to recover from pci parity errors. www.datasheet.in programmer?s guide bcm57xx 01/29/08 broadcom corporation document 57xx-pg105-r bus interface page 217 pci-x command usage a pci-x transaction includes an attribute phase between the address and data phases of a read/write transaction (see figure 86 ). the bcm57xx family will drive an attribute value to indicate that the transaction ordering may be relaxed. reference section 2.5 of the pci-x v1.0 specification for a discussion of the attribute bit assignments. figure 86: pci-x transaction includes attribute phase the pci-x specification allows initiators to insert a relaxed order flag in the attribute portion of a transaction. the benefit of relaxed ordered transactions is not apparent on the pci-x bu s; rather the host local memory bridge gets a performance benefit from this setting. for write transactions, relaxed orde red transactions are allowed to pass ordered write transactions that have been posted to the host bridge. host designs may have multiple memory controllers that service ranges of physical memory. additionally, memory controllers can interleave local memory transactions amongst several dram banks. these mechanisms provide the host bridge multiple paths to physical memory. the relaxed order bit allow the host bridge to forward transactions without serialization in the posted write buffer. on a pci-x bus, read transactions that have the relax order attribute may pass posted write transactions. a relax ordered read transaction must not reference an address that will be updated by a transaction in the posted write queue. the relax order read transaction must not have a relationship to any of the posted writes. there is significant performance degradation for memory reads that must wait for the completion of memory writes. relax order reads loosen the restriction that all reads must serialize behind writes on the pci bridge. reference section 11.2 in the pci-x v1.1 specification. see figure 87 . frame pci_clk ad c/be addr attr cmd d1 d2 a ttribute phase attr cbe cbe devsel irdy trdy attribute phase of pci-x write transaction www.datasheet.in bcm57xx programmer?s guide 01/29/08 broadcom corporation page 218 bus interface document 57xx-pg105-r figure 87: relaxed ordered transactions another benefit for pci-x write transactions with the relaxed order attribute is out of order memory writes (see figure 88 ). the memory controller may write pci-x transaction data to physical memory in any order/sequence. the memory controller benefits from the ability to gather physical address ranges based on memory bank addressibility. the exact mechanism for the write ordering is left to the memory controller. the only requisite is that the bytes written must route to the correct add ress ranges/groups. t4 t3 t2 local memory bus pci-x bus t1 t5 posted write queu e host bridge relaxed order transaction passes the posted write transactions pci-x transaction with relax order bit asserted www.datasheet.in programmer?s guide bcm57xx 01/29/08 broadcom corporation document 57xx-pg105-r bus interface page 219 figure 88: out-of-order memory writes the enable_relaxed_ordering bit in the pci-x command register (see ?pci-x command register (offset 0x42)? on page 312 ) will set/clear the relaxed order bit in the attribute portion of pci-x transactions. the bit defaults to enabled, after the device reset. host software may read and write the enabled_relaxed_ordering bit. note: the bcm57xx family does not differentiate pci-x write transactions from the host status block and packet buffer memory. if the enable_relaxed_ordering bit is enabled, the pci-x interface may tag both the status and packet write transactions with the relaxed ordering attribute. consequently, the status block transactions may not complete before packet buffer dma. system software may read stale under this scenario. system software should clear the enable_relaxed_orderi ng bit during initialization. this bit should not be enabled on the bcm57xx family. byte3 byte2 byte1 byte0 byte7 byte6 byte5 byte4 byte3 byte2 byte1 byte0 byte7 byte6 byte5 byte4 byte3 byte2 byte1 byte0 byte7 byte6 byte5 byte4 byte3 byte2 byte1 byte0 byte7 byte6 byte5 byte4 pci-x transactio n 64 bit data line host memory low high pci-x write transaction data with relaxed order bit set bytes may be updated in any order 2 1 4 3 www.datasheet.in bcm57xx programmer?s guide 01/29/08 broadcom corporation page 220 bus interface document 57xx-pg105-r the pci-x interface may insert the no snoop attribute into pci-x transactions. host processors will snoop transactions on the front side bus and then update their local caches. a master-initiated transaction from the nic to host memory controller will be snooped by the host processor. when the no snoop attribute is present, the range of addresses within the transaction should not be stored in a processor?s cache. the host software/driver must typically ensure that the address range is not cached through a buffer allocation or flush call. the no_snoop bit in the pci_state register (see ?pci state register (offset 0x70)? on page 332 ) is read/write and this bit defaults to zero after reset. if this bit is asserted, the ns attribute in the pci-x transaction is asserted. refer to section 2.5 in the pci-x v1.0 specification. the bcm57xx family can initiate memory read bursts on the pci-x bus. the pci-x interface may use commands such as memory read block when initiating a transaction with a target memory device. these commands allow the target device to stream data back to the master and increase bus utilization. overhead is associated with every pci or pci-x transaction; bus arbitration, address decode, and attribute phases all use pci-x clock cycles. each clock cycle that spent with protocol overhead reduces the effective bandwidth of the bus. a read data burst minimizes the protocol overhead associated with every memory read. the obvious downside to long data bursts is device latency?other peripherals must wait for bus access. the maximum_memory_read_byte_count bit in the pci-x command register is read/write and default to a value of zero after reset. bit name required value enable_relaxed_ordering 0 (disabled) note: the effectiveness of the no_snoop bit is dependent upon the processor front side bus architecture. architectures, such as mesi, maintain cache coherency between system memory and the l2 caches. any update from a pci-x master to main memory will be snooped by the processors and the cache line updated accordingly. the no snoop bit has no influence in architectures where host memory is always cache coherent. read/write transactions from the pci-x master will always be snooped to prevent an incoherency error on the local processors. note: the bcm57xx family is only capable of 512 byte data bursts; host software must set the maximum memory read count for the bcm57xx family accordingly. settings greater than 512 bytes are not valid for the bcm57xx family. bit name required value maximum memory read byte count 0 note: for BCM5703c/BCM5703s in pci-x mode, the dma read watermark bits in dma read/write control register (see ?dma read/write control register (offset 0x6c)? on page 327 ) should be programmed to less than or equal to maximum read byte count. www.datasheet.in programmer?s guide bcm57xx 01/29/08 broadcom corporation document 57xx-pg105-r bus interface page 221 the bcm57xx family supports pci-x split read transactions. see ?pci-x host bus interface (applicable to bcm5700, bcm5701, BCM5703c, BCM5703s, bcm5704c, and bcm5704s)? on page 83 . host software may program the maximum_outstanding_split_transaction bit field in the pci-x command register with a value that reflects the number of outstanding split memory reads. this register is read/write and defaults to zero after reset. system software may tune pci- x performance using the maximum_outstanding_split_transaction field. the pci-x interface does not support split memory write transactions; therefore, this register will only reflect the total number of split memory reads outstanding. if an error occurs on the pci-x bus during a split memory read transaction, the received_split_completion_error_message bit in the pci-x status register (see ?pci-x status register (offset 0x44)? on page 314 ) will be asserted. this bit is write to clear and will be initialized with zero after device reset. an error condition is returned in the attribute portion of the pci- x transaction. refer to section 5.4.6 of the pci-x v1.0 specification for error codes and class information. system (diagnostic) software may read the received_split_completion_error_mess age bit to determine if a split completion error has been detected by the mac. if system (diagnostic) software detects a split completion error by reading this flag, further information can be determined by reading class and index error codes in the pci state register. table 5-1 in the pci-x v1.1 specification contains the error message class and index codes; refer to the specification for the latest data. the split_completion_message_class bit field contains a value that identifies the class of split completion error. the errors are grouped/categorized by a class type. withi n each class, there are instances/types of errors. the split_completion_message_index bit field contains a value for a specific type of split completion error?an instance in the error class. both bit fields are located in the pci state register (see ?pci state register (offset 0x70)? on page 332 ). max read byte dma read watermark (allowed values) 00 (512 bytes) 000: 64 bytes 001: 128 bytes 010: 256 bytes 011: 384 bytes 100: 512 bytes 01 (1024 bytes) 000: 64 bytes 001: 128 bytes 010: 256 bytes 011: 384 bytes 100: 512 bytes 101: 1024 bytes note: the bcm57xx family can handle one outstanding split memory read. the dma write engine may have a pci-x write transaction outstanding, but it will not be a split transaction. two total transactions may be outstanding, but only the dma read engine may have a split transaction outstanding. host software should not modify this bit field for the bcm57xx family. bit name required value maximum outstanding split transactions 0 www.datasheet.in bcm57xx programmer?s guide 01/29/08 broadcom corporation page 222 bus interface document 57xx-pg105-r r egister q uick c ross r eference bcm57xx family the following table lists the bcm57xx pci-x registers. table 92: pci -x registers register bit cross reference dma read/write use_memrdmult_command see ?dma read/write control register (offset 0x6c)? on page 327 . dma read/write default_pci_write_command dma read/write default_pci_read_command dma read/write assert_all_be_on_dma_write dma read/write dma_read_watermark dma read/write dma_write_watermark dma read/write dma_read_address_boundary dma read/write dma_write_address_boundary dma read/write one_dma_at_once dma read/write minimum_dma pci command bus_master see ?command register (offset 0x04)? on page 302 . pci command memory_write_and_invalidate pci command parity_error_enable pci status detected_parity_error see ?status register (offset 0x06)? on page 303 . pci status master_data_parity_error write dma status write_dma_pci_parity_error see ?write dma status register (offset 0x4c04)? on page 482 . read dma status read_dma_pci_parity_error see ?read dma status register (offset 0x4804)? on page 479 . msi status pci_parity_error see ?msi mode register (offset 0x6000)? on page 498 . pci-x command data_parity_error_recovery_enable see ?pci-x command register (offset 0x42)? on page 312 . pci-x command maximum_outstanding_split_ transaction pci-x command maximum_memory_read_byte_count pci-x command enable_relaxed_ordering pci-x status received_split_completion_error_ message see ?pci-x status register (offset 0x44)? on page 314 . pci state conventional_pci see ?pci state register (offset 0x70)? on page 332 . pci state 33/66pci_66/133pcix_mode pci state no_snoop pci state split_completion_message_class pci state split_completion_message_index www.datasheet.in programmer?s guide bcm57xx 01/29/08 broadcom corporation document 57xx-pg105-r expansion rom page 223 e xpansion rom d escription the expansion rom on the bcm57xx family is intended for implementation of pxe (preboot execution environment). the bcm5700 and bcm5701 support up to 64 kb of expansion rom, while the other members of the bcm57xx family support up to 16 mb of expansion rom. o perational c haracteristics by default, the expansion rom is disabled and the firmware has to explicitly enable this feature by setting pci_state.pci_expansion_rom_desired bit to one (see ?pci state register (offset 0x70)? on page 332 ). once this bit is enabled, the bcm5700 and bcm5701 devices of bcm57xx netxtreme family will map expansion rom space to internal memory from 0x10000-0x1ffff (see figure 89 ). in other words, if the bios reads the first byte of the expansion rom, then the bcm57xx family will return the first byte at location 0x10000 of internal memory. in rest of the bcm57xx netxtreme devices, the bootcode firmware handles the expansion rom accesses of the device. figure 89: mapping expansion rom space into internal memory (bcm5700 & bcm5701 only) 64 kb expansion rom 64 kb internal memory 0x10000 0x1ffff e xpanded rom base www.datasheet.in bcm57xx programmer?s guide 01/29/08 broadcom corporation page 224 expansion rom document 57xx-pg105-r bios the bios detects if a pci device supports expansion rom or not by writing the value 0xfffffffe to expansion_rom_base_register (register 0x30 of pci configuration). the bios then reads back from this register. if the value is nonzero, then this pci device supports expansion rom; otherwise, it does not. in the case of the bcm57xx family, the bcm5700 and bcm5701 returns a value of 0xffff0000 if the pci_state.pci_expansion_rom_desired bit is set. this indicates either a 64-kb expansion rom, or a value appropriate for the expansion rom size selected in nvram (see ?nvram configuration? on page 88 ) for the other members of the bcm57xx family. on the other hand, if the pci_expansion_rom_desired bit cleared, then the bcm57xx family will return a value of 0x00000000. this indicates to the bios that no expansion rom is supported. if a pci device supports expansion rom, the bios will assign a expansion base address to the device. it then checks for a valid rom header (0x55 0xaa as first two bytes, and so forth) and checksum. if the rom header and image are valid, the bios will copy the expansion rom image to host?s upper memory block (umb) and invoke the initializing entry point. pxe (preboot execution environment) pxe is implemented as an expansion rom in the nic implementation. in the lom implementation, pxe should reside in the system bios. in the nic implementation, pxe image is st ored in the nvram. upon pow er on reset of the bcm57xx family, the rx risc will load the boot code from the nvram into rx risc scratchpad and execute. this boot code will program the device with programmable manufacturing information (such as mac address, pci vendor id/device id, etc.). if pxe is enabled, the boot code will read pxe image from the nvram and write to the internal memory of the bcm5700/ bcm5701 starting at 0x10000. reset and timing considerations (bcm5700 and bcm5701 only) since the expansion rom image (up to 64k bytes) is stored in the nvram, the amount of time to load this image to internal memory can be up to 3 or 4 seconds. this is due to slowness of the nvram device. based on the pci specification, the pci device should not be accessed in 2 25 clock cycles. if the pci clock is 133 mhz, the device can be accessed in 250 ms. it can be a potential problem if the bios accesses expansion rom when the expansion rom image is not completely copied to internal memory by the boot code firmware. the bcm57xx family provides a way to avoid this problem by forcing pci retry if the expansion rom is accessed when the content of expansion rom is not ready. the details of solving this problem are described as follows: 1. the the rx risc will load the boot code from the nvram into rx risc scratchpad and execute after the bcm57xx family is reset. it takes about 20 to 50 ms (depends on the boot code size) before the first instruction of the boot code is executed. 2. when pxe is enabled, the boot code first sets pci_state, pci_expansion_rom_retry, and pci_state.pci_expansion_rom_desired to 1 before moving the expansion rom image from the nvram to internal memory. 3. if the bios accesses expansion rom during this process, the bcm57xx family will force pci retry on this access. 4. when the expansion rom image is completely moved to internal memory, the boot code will clear pci_state.pci_expansion_rom_retry to zero. boot code is executed whenever the bcm57xx family is reset via pci reset or s/w device reset. pxe initialization should only be necessary after a pci reset. the boot code differentiates pci reset or s/w device reset by checking content in internal memory at 0xb50 when it is loaded and executed. if the content is 0x4b455654, then it is due to s/w reset. therefore, the device driver has to initialize 0xb50 with 0x4b455654 before issuing a s/w device reset. www.datasheet.in programmer?s guide bcm57xx 01/29/08 broadcom corporation document 57xx-pg105-r power management page 225 p ower m anagement d escription the bcm57xx family is compliant with the pci v1.1 power management specification. the mac is programmable to two acpi states: d0 and d3. the d0 state is a full power, operational mode?all the mac core functions run at the highest clocking frequency, and components are fully functional. the mac may be either initialized or un-initialized in the d0 acpi state. an un-initialized d0 state is entered through a device reset or pme event; the mac functional blocks are not started and initialized. host software must reset/initialize hardware blocks to transition the device to a d0 initialized (active) stat e. the d0 active state places the device into a full power /operational mode. receive and transmit data paths are fully operational, and the pci block is initialized for bus mastering dma. host device drivers do not differentiate between d3 hot and d3 cold states. acpi compliant device drivers are unloaded and quiescent in the d3 state and pci slot power state is transparent. when the mac is in d3 hot state, pci slot power (3.3v or 5.0v) is available to power the pci i/o pins. the pci configuration and memory space may be accessed in d3 hot state. the core clock must remain enabled, so the mac can respond to pci configuration and memory transactions. the disable_core_clock bit, in the pci clock control register (see ?pci clock control register (offset 0x74)? on page 334 ) enables/disables clocking in the core clock domain. a d3 cold state provides only the pci vaux supply?pci slot power is not present. the mac will consume a maximum of 375 ma in a d3 cold power management mode. the following functional blocks are integral to mac power management: ? pmscr register ? pci clock control register ? miscellaneous control register ? wol ? pci vaux supply ? pci slot power supply ? gpio www.datasheet.in bcm57xx programmer?s guide 01/29/08 broadcom corporation page 226 power management document 57xx-pg105-r o perational c haracteristics figure 90 applies to the bcm57xx family reference designs. t he mac gpio pins are available for application specific usage; however, broadcom encourages both software and har dware engineers to follow the broadcom design guidelines and application notes. nic and lom designs based on the bcm57xx family controller family use external board level logic to switch power regulators for d3 acpi mode. gpio pins 0, 1, and 2 are all used for external power switching and are programmed by host software. figure 90: power state transition diagram device state d0 (uninitialized) the d0 state is entered after a pci reset or device (software) reset. the assertion of pme will cause the pci bridge to drive rst . the mac hardware blocks are not initialized in this state. for example, the rx engine, tx engine, multicast filter, and memory arbiter are all uninitialized. all the mac functional blocks are powered. device state d0 (active) host software has initialized the mac hardware blocks. the rx and tx data paths are ready to send/receive ethernet packets. the pci block is available to dma packets to host memory. this is a full power acpi operational state. host software/drivers must follow the initialization procedure (see ?initialization? on page 146 ) to move the mac into a d0 active state. when the bcm5705, bcm5721, and bcm5751 mac transceivers detect that main power is lost and it's still in the d0 state, it will reset itself to the d3 (cold) state and then operate in 10/100 mode, like the oob wol state. d0 unitialized d3 cold (pme enabled) d3 hot d0 active pci slot (3.3v or 5.0v) power removed pme asserted or hardware reset pci i/o pins powered from pci vaux supply device driver initializes state machines, memory arbiter, and so on device driver sets pmcsr register to power state d3 and gpio0, 1, and 2 pme asserted or software reset pci i/o pins powered from pci slot supply other i/o functions and core logic powered from pci vaux device driver sets pmcsr register to power state d3 and gpio0, 1, and 2 www.datasheet.in programmer?s guide bcm57xx 01/29/08 broadcom corporation document 57xx-pg105-r power management page 227 device state d1 supported on bcm5705, bcm5721, and bcm5751 mac transceivers only. device state d2 supported on bcm5705, bcm5721, and bcm5751 mac transceivers only. device state d3 (hot) the mac?s configuration space and memory mapped i/o blocks are accessible in d3 hot state. the pci i/o drivers are still powered by slot power in this state. however, host software has switched the mac to use pci vaux for vdd_core and vdd_io. gpio pins 0, 1, and 2 are configured before the transition to this state. the rx and tx risc processor clocks have been stopped in this state. the core clock remains active so pci transactions may be processed by the mac (see ?pci clock control register (offset 0x74)? on page 334 ). this is a low-power state where some key components have been powered down. the physical layer auto-advertises 10 mbps capability in this state, and link is set to 10 mbps half or full- duplex. the phy is configured for wol mode. wol pattern filters are initialized and active; the mac will process magic packets?. the host chipset implements the power management policy for the pci bus; the mac driver does not influence the pci vaux nor slot power supply. device state d3 (cold) the mac is completed powered by pci vaux in d3 cold. pci configuration space and memory mapped i/o are not available. the only portion of the mac active is the wol pattern and magic packet filters 2 . the mac will assert a pme in this state and indicate to the host bridge that a wake up event has occurred. the host bridge will normally provide pci slot power and then reset the device. gpio pins 0, 1, and 2 are configured the same as d3 hot. host software does not differentiate between d3 hot/cold. the mac and phy will not consume more than 375 ma in this mode. the bcm5401 phy must negotiate for 10 mbps half/duplex speed. the phy wol mode is configured. note: for bcm5751 and bcm5721 devices with version a1 or later, the drivers should use configuration cycles (not the memory write cycles) to write to the pmcsr register at offset 0x4c for putting the device in d3 hot state. 2. magic packet? is a registered trade mark of amd. note: the bcm57xx pcie devices support the pcie power management which is compatible with pci bus power management. www.datasheet.in bcm57xx programmer?s guide 01/29/08 broadcom corporation page 228 power management document 57xx-pg105-r w ake o n lan see ?wake-on lan mode/low-power? on page 268 . gpio the use of gpio pins for power management is design-specific, though broadcom-delivered drivers use gpio pins in the manner listed in table 93 and table 94 . this usage is only applicable when the bcm57xx is configured for a nic design as specified in ?revision levels? on page 5 ; it is not applicable to lan-on-motherboard (lom) designs. p ower s upply in d3 s tate table 95 shows the power supply to various power pins on the bcm57xx family. this table assumes that host software has switched power regulators using gpio pins 0, 1, and 2. table 93: gpio usage for bcm5700/bcm5701 power management for broadcom drivers function description gpio0 gpio1 gpio2 vaux switches bcm5700/bcm5701 to use vaux power 1 1 0 table 94: gpio usage for BCM5703c/BCM5703s and later power management for broadcom drivers a a. x = don't care function description gpio0 gpio1 gpio2 vaux sequence for switching to vaux 0 0 1 111 110 vmain sequence for switching to vmain x 1 x x0x x1x table 95: bcm57xx power pins pin d3 normal d3 hot d3 cold vdd_core pci slot vaux vaux vdd_io pci slot vaux vaux vdd_io-pci pci slot pci slot no power www.datasheet.in programmer?s guide bcm57xx 01/29/08 broadcom corporation document 57xx-pg105-r power management page 229 c lock c ontrol certain functional blocks in the mac architecture should be powered down before a transition to d3 acpi state. mac clock generators/plls drive transistor level logic, which switch stat es on every clock pulse. transistor level switching consumes power (milliwatts). software should selectively disable clocking to non-essential functional blocks. software must set the enable_clock_control_register bit in the miscellaneous host control register; the assertion of this bit allows host software to configure the pci clock control register. the following clock bits should be configured in the pci clock control register (see ?pci clock control register (offset 0x74)? on page 334 ): ? tx risc clock disable ? rx risc clock disable ? select alternate clock?the 133-mhz pll is not used as reference clock. d evice acpi t ransitions host software must program the power management control/status (pmscr) register to transition the device between d0 and d3 acpi states. the power state bit field in the pmscr (see ?power management control/status register (offset 0x4c)? on page 318 ) may be programmed to d0, d1, d2, and d3 states. the pme signal is enabled in the pmscr by asserting the pme_enable bit. device drivers/bios may also read the pme_status bit to determine whether the event has been driven; pme_status is a write to clear bit. the type and supported power management features for the bcm57xx family are reported in the power management capabilities (pmc) register (see ?power management capabilities register (offset 0x4a)? on page 317 ). system software and bios may read this register to enumerate and detect the power management features supported by the nic/lom. for example, the bcm57xx family can assert pme from both d3 hot and cold states. the pme_support bit field in the pmc register will reflect this capability. d isable d evice t hrough bios the bcm5721 and bcm5751 devices with boot code v3.22 or later can be disabled through bios by writing the value of deaddeadh to shared memory location of b50h. this elim inates the need for bios to execute the device specific procedure for disabling the mac controller device. the bios must do the following steps to disable the bcm5751 device. 1. config cycle, write 88h to location 68h. 2. config cycle, write 0b50h to location 7ch. 3. config cycle, write deaddeadh to location 84h. note: the d1 and d2 configurations are not supported in the bcm57xx family. the d1 and d2 bit configurations are available for applications, where d1 and d2 states are introduced for board level designs?the bits provide flexibility to the application. the broadcom reference nic/lom designs do not use d1 and d2 states; therefore, host software should avoid setting these states. before the mac is moved into the d3 state, the clocks and gpio must be configured (see above sections). www.datasheet.in bcm57xx programmer?s guide 01/29/08 broadcom corporation page 230 power management document 57xx-pg105-r r egister q uick c ross r eference the bcm57xx power management registers are listed in table 96 . table 96: bcm57xx power management registers register bit description cross reference misc local control misc_pin_0_output gpio pin 0 see ?miscellaneous local control register (offset 0x6808)? on page 507 . misc local control misc_pin_0_output_enable when asserted, mac drives pin output misc local control misc_pin_1_output gpio pin 1 misc local control misc_pin_1_output_enable when asserted, mac drives pin output misc local control misc_pin_2_output gpio pin 2 misc local control misc_pin_2_output_enable when asserted, mac drives pin output misc host control enable_clock_control_register pci clock_control tx risc_clock_disable disable the clock to the transmit cpu see ?pci clock control register (offset 0x74)? on page 334 . pci clock_control rx risc_clock_disable disable the clock to the receive cpu pci clock_control select_alternate_clock use an alternate clock as a reference, rather than the pll 133 pci clock_control pll133 disable the 133 mhz phased locked loop pci power management control/status pme_enable see ?power management control/status register (offset 0x4c)? on page 318 . pci power management control/status power_state www.datasheet.in programmer?s guide bcm57xx 01/29/08 broadcom corporation document 57xx-pg105-r byte swapping page 231 b yte s wapping b ackground there are two basic formats for storing data in memory ? little-endian and big-endian. the endianess of a system is determined by how multibyte quantities are stored in memory. a big-endian architecture stores the most significant byte at the lowest address offset while little-endian architecture stores the least significant byte at the lowest address offset. for example, the 32-bit hex value 0x12345678 would be stored in memory as shown in the following table. another way of viewing how this data would be stored is shown in the following tables. examples of big-endian platforms include sgi irix, ibm rs6000, and sun. examples of little-endian platforms include intel x86 and dec alpha. pci assumes a little-endian memory model. pci configuration registers are organized so that the least significant portion of the data is assigned to the lower address. table 97: endian example address 00 01 02 03 big endian 12 34 56 78 little endian 78 56 34 12 table 98: storage of big-endian data storage byte 00 01 02 03 data contents12345678 table 99: storage of little-endian data storage byte 03 02 01 00 data contents12345678 www.datasheet.in bcm57xx programmer?s guide 01/29/08 broadcom corporation page 232 byte swapping document 57xx-pg105-r a rchitecture the bcm57xx family is internally a big-endian machine, and its internal processors are big-endian devices. the bcm57xx family stores data internally in big-endian format using a 64-bit memory subsystem. however, many hosts (e.g., x86 systems) use the little- endian format, and the pci bus uses the little-endian format. therefore the bcm57xx family has a number of byte swapping options that may be configured by software so that little or big endian hosts can interface as seamlessly as possible with bcm57xx family over pci. the bcm57xx family has the following bits that control byte and word swapping: ? enable endian word swap (bit 3, miscellaneous host control register (offset 0x68 into pci config register). if 1, this register enables 32-bit word swapping when accessing the bcm57xx family via the pci target interface. ? enable endian byte swap (bit 2, miscellaneous host control register (offset 0x68 into pci config register). if 1, this register enables byte swapping (within a 32-bit word) when accessing the bcm57xx family via the pci target interface. ? word swap data (bit 5, mode control register (offset 0x6800 into the bcm57xx registers). if 1, this register enables word swapping of frame data when it comes across the bus. ? byte swap data (bit 4, mode control register (offset 0x6800 into the bcm57xx registers). if 1, this register enables byte swapping of frame data when it comes across the bus. ? word swap non-frame data (bit 2, mode control register (offset 0x6800 into the bcm57xx registers). if 1, this register enables word swapping of non frame data (i.e,. buffer descriptors, statistics, etc.) when it comes across the bus. ? byte swap non-frame data (bit 1, mode control register (offset 0x6800 into the bcm57xx registers). if 1, this register enables byte swapping of non frame data (i.e., buffer descriptors, statistics, etc.) when it comes across the bus . the setting of the above swapping bits will affect the order of how data is represented when it is transferred across pci. since byte swapping is a confusing subject, examples will be shown that reflect how each byte swapping bit works e nable e ndian w ord s wap and e nable e ndian b yte s wap b its the enable endian word swap, and enable endian byte swap bits affect whether words or bytes are swapped during target pci accesses. thus, these bits affect the byte order when the host is directly reading/writing to registers or control structur es that are physically located on the bcm57xx family. these bits do not affect the byte ordering of packet data or other structures that are mastered (dmaed) by the bcm57xx family. when the bcm57xx family is accessed via pci (which is little endian) as a pci target, the bcm57xx family must implicitly map those accesses to internal structures that use a 64-bit big endian architecture. in the default case where no swap bits are set the bcm57xx family maps pci data to internal structures shown in figure 91 and figure 92 . www.datasheet.in programmer?s guide bcm57xx 01/29/08 broadcom corporation document 57xx-pg105-r byte swapping page 233 figure 91: default translation (no swapping) on 64-bit pci internal byte ordering pci byte ordering figure 92: default translation (no swapping) on 32-bit pci as illustrated above, because the bcm57xx family uses an internal 64-bit big endian architecture, it will map (by default) the most significant byte of an 8-byte (64-bit) internal quantity to the most significant byte on a 64-bit pci bus. this works nicely for quantities (fields) that are 64 bits in size (e.g., a host physical address). however, this can be confusing for quantities that are 32 bits in size. without word swapping enabled, the host could easily access the wrong 32-bit quantity when making a 32-bit access. take, for example, a ring control block (rcb). rcbs are on-chip structures and read/written by the host via pci target accesses. the table below shows the big-endian layout of an on-chip rcb: msb lsb internal byte # 01234567 internal bit # 63 48 47 32 31 16 15 0 example content 88 89 8a 8b 8c 8d 8e 8f msb lsb pci byte # 76543210 pci bit # 63 48 47 32 31 16 15 0 example content 88 89 8a 8b 8c 8d 8e 8f 31 1615 0 31 1615 0 0x00 88 89 8a 8b 8c 8d 8e 8f 0x00 0x04 8c 8d 8e 8f 88 89 8a 8b 0x04 table 100: rcb (big endian 32-bit format) byte # 0 1 2 3 bit # 31 16 15 0 msb host ring address 0x00 lsb 0x04 msb max_len lsb flags 0x08 nic ring address 0x0c www.datasheet.in bcm57xx programmer?s guide 01/29/08 broadcom corporation page 234 byte swapping document 57xx-pg105-r if word swapping is not enabled, and the host made a 32-bit read request to address 0x08, the four bytes of data returned on the pci bus would actually be the nic ring address rather than the max_len and flags fields. this initially might seem counter-intuitive, but is explained in figure 92 on page 233 . therefore, if a software driver running on an x86 host (little endian) referenced on-chip data structures as they are defined in the bcm57xx data sheet, the driver should set the enable endian word swap bit. by setting this bit, the translation would be as follows: internal byte ordering pci byte ordering figure 93: word swap enable translation on 32-bit pci (no byte swap) the only side effect for a little endian host that sets the enable endian word swap bit would be that the driver would have to perform an additional word swap on any 64-bit fields (e.g., a 64-bit physical address) that were given to the driver by the network operating system (nos). little-endian hosts will not want to set the enable endian byte swap bit for target accesses. this bit is intended to be used by big endian systems that needed pci data (little endian) translated back to big endian format. the following figures show the translation of data when the enable endian byte swap bit is set: internal byte ordering pci byte ordering figure 94: byte swap enable translation on 32-bit pci (no word swap) internal byte ordering pci byte ordering figure 95: byte and word swap enable translation on 32-bit pci 31 16 15 0 31 16 15 0 0x00 88 89 8a 8b 88 89 8a 8b 0x00 0x04 8c 8d 8e 8f 8c 8d 8e 8f 0x04 note: some big endian systems automatically already do this depending on the architecture of the hosts pci to memory interface. 31 16 15 0 31 16 15 0 0x00 88 89 8a 8b 8f 8e 8d 8c 0x00 0x04 8c 8d 8e 8f 8b 8a 89 88 0x04 31 16 15 0 31 16 15 0 0x00 88 89 8a 8b 8b 8a 89 88 0x00 0x04 8c 8d 8e 8f 8f 8e 8d 8c 0x04 www.datasheet.in programmer?s guide bcm57xx 01/29/08 broadcom corporation document 57xx-pg105-r byte swapping page 235 w ord s wap d ata and b yte s wap d ata b its the word swap data, and byte swap data bits effect how packet data is ordered on the pci bus. these only affect how packet data is ordered, and do not affect non-frame data (i.e., buffer descriptors, statistics block, etc.). in other words, th ese bits effect how data is transferred to/from host send/receive buffers. for example, if bcm57xx family were to receive a packet that had the following byte order: where: ? d1-d6 consists of the packet?s destination address (byte d0 is the first byte on the wire); ? s1-s6 is the source address; ? t1-t2 is the ethernet type/length field; ? ip1-ip2 are the first two bytes of the ip header which immediately follow the type/length field. the packet would be stored internally in big endian format: however, when the data gets transferred across pci, there could be confusion about the correct byte ordering because pci is little endian whereas bcm57xx family is a big endian device. so, in order to provide flexibility for different host processo r/ memory architectures, bcm57xx family can order this data on pci in four different ways depending on the settings of the word swap data, and byte swap data bits. the below figures illustrate how data would appear on the pci ad[63:0] pins depending on the settings of those swap bits: word swap data = 0, and byte swap data = 0 01 02 03 04 05 06 07 08 09 0a 0b 0c 0d 0e 0f 10 d1 d2 d3 d4 d5 d6 s1 s2 s3 s4 s5 s6 t1 t2 ip1 ip2 table 101: big-endian internal packet data format b0 b1 b2 b3 b4 b5 b6 b7 63-56 55-48 47-40 39-32 31-24 23-16 15-8 7-0 d1 d2 d3 d4 d5 d6 s1 s2 s3 s4 s5 s6 t1 t2 ip1 ip2 table 102: 64-bit pci bus (wsd = 0, bsd = 0) b7 7b6 b5 b4 b3 b2 b1 b0 63-56 55-48 47-40 39-32 31-24 23-16 15-8 7-0 d1 d2 d3 d4 d5 d6 s1 s2 s3 s4 s5 s6 t1 t2 ip1 ip2 www.datasheet.in bcm57xx programmer?s guide 01/29/08 broadcom corporation page 236 byte swapping document 57xx-pg105-r word swap data = 0, and byte swap data = 1 table 103: 32-bit pci bus (wsd = 0, bsd = 0) b3 b2 b1 b0 31-24 23-16 15-8 7-0 d5 d6 s1 s2 d1 d2 d3 d4 t1 t2 ip1 ip2 s3 s4 s5 s6 table 104: 64-bit pci bus (wsd = 0, bsd = 1) b7 b6 b5 b4 b3 b2 b1 b0 63-56 55-48 47-40 39-32 31-24 23-16 15-8 7-0 d4 d3 d2 d1 s2 s1 d6 d5 s6 s5 s4 s3 ip2 ip1 t2 t1 table 105: 32-bit pci bus (wsd = 0, bsd = 1) b3 b2 b1 b0 31-24 23-16 15-8 7-0 s2 s1 d6 d5 d4 d3 d2 d1 ip2 ip1 t2 t1 s6 s5 s4 s3 www.datasheet.in programmer?s guide bcm57xx 01/29/08 broadcom corporation document 57xx-pg105-r byte swapping page 237 word swap data = 1, and byte swap data = 0 word swap data = 1, and byte swap data = 1 so, for a little-endian (e.g., x86) host, software should se t both the word swap data, and byte swap data bits. this is because a little endian host will expect the first byte on the wire (byte d1) to be placed into memory at the least significant (starting) address of the packet data. table 106: 64-bit pci bus (wsd = 1, bsd = 0) b7 b6 b5 b4 b3 b2 b1 b0 63-56 55-48 47-40 39-32 31-24 23-16 15-8 7-0 d5 d6 s1 s2 d1 d2 d3 d4 t1 t2 ip1 ip2 s3 s4 s5 s6 table 107: 32-bit pci bus (wsd = 1, bsd = 0) b3 b2 b1 b0 31-24 23-16 15-8 7-0 d1 d2 d3 d4 d5 d6 s1 s2 s3 s4 s5 s6 t1 t2 ip1 ip2 table 108: 64-bit pci bus (wsd = 1, bsd = 1) b7 b6 b5 b4 b3 b2 b1 b0 63-56 55-48 47-40 39-32 31-24 23-16 15-8 7-0 s2 s1 d6 d5 d4 d3 d2 d1 ip2 ip1 t2 t1 s6 s5 s4 s3 table 109: 32-bit pci bus (wsd = 1, bsd = 1) b3 b2 b1 b0 31-24 23-16 15-8 7-0 d4 d3 d2 d1 s2 s1 d6 d5 s6 s5 s4 s3 ip2 ip1 t2 t1 www.datasheet.in bcm57xx programmer?s guide 01/29/08 broadcom corporation page 238 byte swapping document 57xx-pg105-r w ord s wap n on -f rame d ata and b yte s wap n on -f rame d ata b its the word swap non-frame data, and byte swap non-frame data bits affect the byte ordering of certain shared memory data structures (buffer descriptors, statistics block, etc.) when those structures are transferred across pci. for example, lets examine how a send buffer descriptor is stored internally in the bcm57xx family: since the bcm57xx family uses a 64-bit memory subsystem, the above diagram is shown in 64-bit format. furthermore, the table shows both the internal byte offset for each field and the bit position for each byte. in order to provide flexibility for different host processor/memory architectures, the bcm57xx family can order the data in memory in four different ways depending on the settings of the word swap non-frame data and byte swap non-frame data bits. the following tables show how data will appear depending on the settings of those swap bits: table 110: send buffer descriptor (big-endian 64-bit format) byte # 0 1 2 3 4 5 6 7 bit # 63 4847 3231 1615 0 msb host address lsb 0x00 msb length lsb flags reserved vlan 0x08 note: this may seem confusing because big-endian notation normally has the bit positions incrementing from left to right. however, in this case, the bit positions are relevant because they correspond to the bit positions on pci (ad[63:0]) if neither of the non-frame data swap bits ar e set. for clarification, the following table shows the same structure in 32-bit format. table 111: send buffer descriptor (big-endian 32-bit format) byte # 0 1 2 3 bit # 31 16 15 0 msb host address 0x00 lsb 0x04 msb length lsb flags 0x08 reserved vlan 0x0c www.datasheet.in programmer?s guide bcm57xx 01/29/08 broadcom corporation document 57xx-pg105-r byte swapping page 239 word swap non-frame data = 0 and byte swap non-frame data = 0 this would require the software to use the following little-endian data structure on the host: in this case, the data structure takes on a slightly new format because the words have been swapped. word swap non-frame data = 1 and byte swap non-frame data = 0 this would require the software to use the following little-endian data structure on the host: the disadvantage of this approach is if the host operating system supported a 64-bit data type for a physical address, the host device driver would have to swap the two 32-bit words that comprise the 64-bit address that the host operating system used. word swap non-frame data = 0 and byte swap non-frame data = 1 this would require the software to use the following big-endian data structure on the host: table 112: send buffer descriptor (little-endian 32-bit format) with no swapping byte # 3 2 1 0 bit # 31 16 15 0 host address lsb 0x00 msb 0x04 reserved vlan 0x08 msb length lsb flags 0x0c table 113: send buffer descriptor (little-endian 32-bit format) with word swapping byte # 3 2 1 0 bit # 31 16 15 0 msb host address 0x00 lsb 0x04 msb length lsb flags 0x08 reserved vlan 0x0c table 114: send buffer descriptor (big-e ndian 32-bit format) with byte swapping byte # 0 1 2 3 bit # 31 16 15 0 msb host address 0x00 lsb 0x04 reserved vlan 0x08 msb length lsb flags 0x0c www.datasheet.in bcm57xx programmer?s guide 01/29/08 broadcom corporation page 240 byte swapping document 57xx-pg105-r word swap non-frame data = 1 and byte swap non-frame data = 1 this would require the software to use the following big-endian data structure on the host: table 115: send buffer descriptor (big-endian 32-bit format) with word and byte swapping byte # 0 1 2 3 bit # 31 16 15 0 msb host address 0x00 lsb 0x04 msb length lsb flags 0x08 reserved vlan 0x0c www.datasheet.in programmer?s guide bcm57xx 01/29/08 broadcom corporation document 57xx-pg105-r ethernet link configuration page 241 section 10: ethernet link configuration o verview the bcm57xx family supports multiple link operating modes. it can operate at multiple link speeds: 10 mbps, 100 mbps, or 1000 mbps. it can also operate at half-duplex (iee802.3 csma/cd) or full-duplex. the bcm57xx family can be configured to use mii, gmii, or tbi modes to interface with physical layer transceiver devices (a.k.a. phys) that support ethernet networks that operate over either copper or fiber-optic wiring. the mac is compliant with ieee 802.3, 802.3u, 802.3x, and 802.3z specifications. gmii/mii the gigabit media independent interface (gmii) is normally used to interface the controller to a transceiver that supports gigabit ethernet over copper wiring (1000base-t). the media independent interface (mii) is used to interface the controller to a transceiver that is capable of 10/100 mbps ethernet. nics that support triple-speed operation (10/100/1000 mbps) will have the bcm5700 mac interface to a gmii/mii phy (e.g., the broadcom bcm5401 phy) that is capable of triple-speed operation. the rest of the bcm57xx family includes both a mac and phy on-chip. in order to operate a nic running in gmii/mii mode, driver software will need to configure both the bcm57xx controller and, if the bcm5700 mac is being used, the attached phy as described below. c onfiguring the bcm57xx f amily for gmii/mii and tbi m odes configuring the bcm57xx family to operate in gmii or mii mode is simple. during initialization, software should configure the ethernet_mac_mode.port_mode bits to a value that corresponds to the correct interface speed (01b for mii, 10b for gmii). the ethernet_mac_mode.port_mode bits of bcm5700 should be configured for gmii/mii mode when it is connected to the external phy through gmii/mii interface and for tbi mode when it is connected to the external serdes phy for 1000- base-x connections. the ethernet_mac_mode.port_mode bits of bcm5701 should be configured to gmii/mii when it is using the on-chip triple speed ethernet transceiver and to tbi when it is using the tbi interface to talk to an external serdes phy. the ethernet_mac_mode.port_mode bits of bcm5702, BCM5703c, bcm5704c, bcm5705, bcm5788, bcm5721, bcm5751, bcm5752, bcm5714c, bcm5714s, bcm5715c, and bcm5715s should be configured for gmii/mii as these devices interface with integrated on-chip phy through gmii/mii. note that the bcm5714s and bcm5715s macs interface with the on-chip 1000-base-x phy through the gmii interface. the ethernet_mac_mode.port_mode bits of BCM5703s and bcm5704s devices should be configured to tbi as these devices interface with integrated on-chip serdes phy through tbi. note: the bcm57xx controllers with an integrated transceiver (or phy) are hardwired with a phy address of 1. www.datasheet.in bcm57xx programmer?s guide 01/29/08 broadcom corporation page 242 gmii/mii document 57xx-pg105-r c onfiguring l ink u p /d own the bcm57xx family has two different methods that it can use to determine if the ethernet link is up or down. the link will be down if the ethernet cable is not properly attached at both ends of the network. link will be up only if the cable is proper ly attached and the devices at both ends of the cable recognize that link has been established. the device cannot successfully transfer packets on the link unless it determines that it has a valid link up. the first method for configuring link status is called auto-polling. software can enable auto-polling by setting the mi_mode.port_polling bit. if enabled, the bcm57xx family will periodically generate mdio cycles to read the phy?s link_status bit in mii status register (see ?mi status register (offset 0x450)? on page 389 ). the link status from the auto- polling operation is then reported in the mi_status_register.link_status and transmit_mac_status.link_up (see ?transmit mac status register (offset 0x460)? on page 390 ) bits. the second method for configuring link status involves using the bcm57xx family?s lnkrdy input pin. this method allows the bcm57xx family to determine the link status based on an input from an external source (i.e., a link status output from a phy). by default, the state of the linkrdy pin sets the transmit_mac_status.link up bit. the polarity of the lnkrdy signal can be programmed via the ethernet_mac_mode.link_polarity bit. lastly, the link state of the bcm57xx family can also be forced by disabling both the auto-polling function and the lnkrdy signal and forcing the link status by directly writing to the mi_status.link_status bit. l ink s tatus c hange i ndications it is often desirable for host software to know when the status of the ethernet link has changed. to generate an interrupt to the host when link status changes, software should set the ethernet_mac_event_enable.link_state_changed bit (see ?ethernet mac event enable register (offset 0x408)? on page 381 ) and the mode_control.interrupt_on_mac_attention bit (see ?mode control register (offset 0x6800)? on page 502 ). with this configuration, the ethernet_mac_status.link_state_changed bit and link_state_changed bit in the status block (see ?status block? on page 103 ) will be set when the link has changed state. c onfiguring the gmii/mii phy gmii/mii transceivers (phys) contain registers that a software driver can manipulate to change parameters in the phy. these parameters include the link speed or duplex that the phy is currently running at, or the speed/duplex options that the phy advertises during the auto-negotiation process. nic device drivers will typically access phy registers during the driver initialization process in order to configure the phys speed/duplex or to examine the results of the auto-negotiation process (if enabled). for more information about phy registers, refer to ?transceiver registers? on page 603 . these phy registers are accessed via a process called mdio. the phy will have two pins (mdio and mdc) that connect the bcm5700 mac to the phy (e.g., bcm5401 phy). software accesses a phy?s registers via mdio through the bcm5700?s mi_communication register (see ?mi communication register (offset 0x44c)? on page 388 ). by manipulating this register, software can read or write registers in a phy. the bcm5700 accesses the external phy through the external mdio interface while the bcm5701 and later devices access the on-chip phy through the internal mdio interface. the device driver accesses the phy registers through the mi_c ommunications registers of bcm57xx family and hence the driver software for accessing phy is same in accessing either the external phy of bcm5700 or internal on-chip phy of bcm5701 and later devices. the following pseudocode descr ibes accessing the phy registers through the mi_communications registers of the bcm57xx netxtreme family. www.datasheet.in programmer?s guide bcm57xx 01/29/08 broadcom corporation document 57xx-pg105-r gmii/mii page 243 reading a phy register // if auto-polling is enabled, temporarily disable it if (autopolling_enabled == true) then begin mi_mode.portpolling = 0 end // setup the value that we are going to write to mi communication register // set bit 27 to indicate a phy read. // set bit 29 to indicate the start of a mdio transaction value32 = ((phyaddress << 21) | (phyregoffset << 16) | 0x28000000) // write value to mi communication register mi_communication_register = value32 // now read back mi communication register until the start bit // has been cleared or we have timed out (>5000 reads) loopcount = 5000 while (loopcount > 0) begin value32 = mi_communication_register if (!(value32 | 0x20000000)) then break loop else loopcount-- end // print message if error if (value32 | 0x20000000) then begin // it a debug case ? cannot read phy procedure (print error message) value32 = 0 end // if auto-polling is enabled, turn it back on if (autopolling_enabled == true) then begin mi_mode.portpolling = 1 end // now return the value that we read (lower 16 bits of reg) return (value32 & 0xffff) www.datasheet.in bcm57xx programmer?s guide 01/29/08 broadcom corporation page 244 gmii/mii document 57xx-pg105-r writing a phy register // if auto-polling is enabled, temporarily disable it if (autopolling_enabled == true) then begin mi_mode.portpolling = 0 end // setup the value that we are going to write to mi communication register // set bit 26 set to indicate a phy write. // set bit 29 to indicate the start of a mdio transaction // the lower 16 bits equal the value we want to write to the phy register value32 = ((phyaddress << 21) | (phyregoffset << 16) | regvalue | 0x24000000) // write value to mi communication register mi_communication_register = value32 // now read back mi communication register until the start bit // has been cleared or we have timed out (>5000 reads) loopcount = 5000 while (loopcount > 0) begin value32 = mi_communication_register if (!(value32 | 0x20000000)) then break loop else loopcount-- end // print message if error if (value32 | 0x20000000) then begin // it a debug case ? can?t write phy procedure (print error message) value32 = 0 end // if auto-polling is enabled, turn it back on if (autopolling_enabled == true) then begin mi_mode.portpolling = 1 end www.datasheet.in programmer?s guide bcm57xx 01/29/08 broadcom corporation document 57xx-pg105-r tbi mode page 245 tbi m ode this mode is only applicable to the bcm5700, bcm5701, BCM5703s, and bcm5704s devices. the ten-bit interface (tbi) is used to interface the controller to a serdes device that provides transceiver function for a 1000base-sx connection. 1000base-sx is the most commonly used standard for gigabit ethernet functionality over networks that use fiber-optic cabling. nics that use the tbi interface run only at gigabit speeds. triple speed operation (10/ 100/1000 mbps) is not supported in tbi mode. however, auto-negotiation can still be performed in tbi mode. although the nic only supports a single speed in tbi mode, the level of flow control supported along with link status can be successfully negotiated with the link partner. unlike gmii/mi i phys though, serdes devices do not normally support the ieee 802.3z auto-negotiation protocol, and thus this function should be performed by the controller in concert with device driver software. c onfiguring the bcm57xx f amily for tbi mode to configure the bcm57xx family to operate in tbi mode, software must configure the ethernet_mac_mode.port_mode bits (see ?ethernet mac mode register (offset 0x400)? on page 377 ) to the value 11b during initialization. 1000base-x a uto -n egotiation the bcm57xx family provides the ability for the host soft ware to implement 1000base-x auto-negotiation function as described in ieee 802.3z. the basic mechanism to achieve auto-negotiation is to exchange configuration data with the link partner through the transmit_gigabit_auto_negotiation (at offset 0x444) and receive_gigabit_auto_negotiation (at offset 0x448) registers. these registers are only valid when the bcm57xx family is operating in tbi mode (see ?tbi block? on page 72 ). the host software sends configuration data by first initializing the transmit_gigabit_auto_negotiation with the data and then setting the ethernet_mac_mode.send_configs bit. the bcm57xx family will continuously send out the configuration data, with the most significant bit first, until the send_configs bit is cleared. the receive_gigabit_auto_negotiation register holds the received configuration data. when the bcm57xx family is receiving configuration data, the ethernet_mac_status.receiving_config bit is set. if new configuration data is received, the ethernet_mac_status.config_changed bit is set. the host so ftware will have to clear this bit after reading the new configuration data. figure 96 shows how the auto-negotiation configuration word is encoded into the receive_gigabit_auto_negotiation and transmit_gigabit_auto_negotiation registers. figure 96: auto-negotiation configuration word encoding msb lsb d7 d6 d5 d4 d3 d2 d1 d0 d15 d14 d13 d12 d11 d10 d9 d8 www.datasheet.in bcm57xx programmer?s guide 01/29/08 broadcom corporation page 246 tbi mode document 57xx-pg105-r 1000base-x a uto -n egotiation in f irmware the bcm5701 and BCM5703s controllers support firmware auto-negotiation for the tbi interface. the bcm5704s supports auto-negotiation in hardware or firmware. ? when the system begins in the cold boot state, firmware always tries to do auto-negotiation with link partner and set a result into the shared memory area between the host driver and firmware. ? in warm boot (device reset), the auto-negotiation can be done in either the driver or firmware. the integrated phy of bcm5714c, bcm5714s, bcm5715c, and bcm5715s devices supports the 1000base-x auto- negotiation in hardware. communication between the host driver and firmware is done through a dedicated shared memory location. shared memory mailbox, signatures, and bit definitions // local memory address for the fw_tbi_mailbox #define fw_tbi_mailbox 0xc1c // lower 16 bits are valid for driver with this signature in the upper 16 bits #define fw_tbi_sig 0x736b0000 // 1 = link is up and auto-negotiation was successful #define fw_tbi_link_ok bit_0 // 1 = link partner advertised symmetric pause capability #define fw_tbi_autoneg_lp_sym_pause bit_1 // 1 = link partner advertised asymmetric pause capability #define fw_tbi_autoneg_lp_asym_pause bit_2 // 1 = fallback to 1000fd #define fw_tbi_autoneg_fallbackbit_3 // lower 16 bits are valid for firmware with this signature in the upper 16 bits #define drv_tbi_sig 0x686b0000 // 1 = enable auto-negotiation in firmware #define drv_tbi_enable_autoneg bit_0 // 1 = advertise symmetric pause capability for auto-negotiation #define drv_tbi_adv_sym_pause bit_1 // 1 = advertise asymmetric pause capability for auto-negotiation #define drv_tbi_adv_asym_pause bit_2 // 1 = fallback to 100fd if auto-negotiation fails #define drv_tbi_autoneg_fallbackbit_3 if the link partner is not sending out configuration data for flow control during auto-negotiation, the auto-negotiation firmwa re tries to set the link to 1000 full-duplex (hd) mode with the link partner. firmware function during reset: ? from cold boot, the firmware always performs auto-negotiation and writes the fw_tbi_sig value, along with the results of auto-negotiation, to the fw_tbi_mailbox shared memory location. ? from warm boot (device reset), the firmware checks for drv_tbi_sig in the fw_tbi_mailbox. if this signature is not present, the firmware does not perform the auto-negotiation function and does not configure the tbi interface. this is necessary to allow legacy driver to operate normally. ? from warm boot, if the drv_tbi_sig value is present, the firmware only attempts auto-negotiation if the drv_tbi_enable_autoneg bit is set in the fw_tbi_mailbox shared memory location. otherwise, the firmware does not attempt auto-negotiation and the driver is expected to perform auto-negotiation. www.datasheet.in programmer?s guide bcm57xx 01/29/08 broadcom corporation document 57xx-pg105-r mdi register access page 247 host driver function: ? during host driver initialization, the driver checks for fw_tbi_sig at the mailbox location fw_tbi_mailbox in the shared memory area. if the signature is not present or link status is not successful, the driver performs the auto- negotiation function and tbi configuration. if the si gnature is present, the auto-negotiation function and tbi configuration are done by firmware. ? after device reset with the miscellaneous configuration register (see ?miscellaneous configuration register (offset 0x6804)? on page 504 ) core clock blocks reset bit and before setting the t3_magic_num (i.e., kevt) into shared memory location 0x0b50, the driver places drv_tbi_sig and auto-negotiation parameters in the mailbox location fw_tbi_mailbox. ? the host driver periodically polls the fw_tbi_mailbox for the auto-negotiation result from the firmware in the mailbox location. mdi r egister a ccess configuring physical devices (such as the bcm5401 phy, and so on) and querying the status of physical devices are done via the mdio interface (mdc and mdio). there are four modes in which the internal mii manag ement interface signals (mdc/mdio) can be controlled for communication with the internal transceiver registers. these modes are as follows: ? mode 1: autopolling mode. enabled by setting the enable bit in the mac ethernet mi mode register (see ?mi mode register (offset 0x454)? on page 389 ). the device will poll for the link status bit in the transceiver. ? mode 2: command control. writing to the mi communications register (see ?mi communication register (offset 0x44c)? on page 388 ) directly to either read or write the transceiver registers. ? mode 3: management interface program. by setting the enable_mip bit in the mac mode register (see ?ethernet mac mode register (offset 0x400)? on page 377 ) and programming the start/end memory area in the mbuf1 memory space that contain the register read/write commands. the chip will then transfer these commands one by one into the mi communications register to preform the actual read/write operations. ? mode 4: register control. when enabled, the host writes the mdc clock and data values into the mdi control register (see ?mdi control register (offset 0x6844)? on page 515 ). the values in the register directly control the interface signals. mode 1 has the lowest priority and it will be stalled any time there is an active operation through the mi communications register (mode 2). modes 3 and 4 have the highest priority. when mode 3 or 4 is enabled, the mi communications register cannot be read or written. mode 4 is enabled by setting the mdi select bit of the mdi control register. o perational c haracteristics the interface between the mac and physical devices is with two signals: mdio clock (mdc) and bidirectional serial data (mdio). the details of the mdio interface can be found in the physical device data sheet or ieee 802.3 specification. note: this procedure is phy-independent. the mac access to the phy is the same for the entire bcm57xx family. www.datasheet.in bcm57xx programmer?s guide 01/29/08 broadcom corporation page 248 mdi register access document 57xx-pg105-r a ccess m ethods the mac provides two methods to access the physical device registers via the mdio interface: ? traditional bit-bang method ? auto-access method traditional bit-bang method in this method, software has to toggle the mdc and mdio pins to access physical device registers. software is responsible for providing the proper delay to satisfy timing requirements such as setup time, hold time, clock frequency, etc. the mdi_control_register (see ?mdi control register (offset 0x6844)? on page 515 ) controls the mdc and mdio pins as follows: ? mdi_control_register.mdi_clock: is used to clock mdc pin. if this bit is set, mdc is logic high. otherwise, it is logic low. ? mdi_control_register.mdi_select: this bit is used to select either the traditional bit-bang method or auto-access method. this bit must be set to 1 when the traditional bit-bang method is used. ? mdi_control_register.mdi_enable: this bit is used to control bi-directional data pin. if this bit is set to 1, then mdi_control_register.mdi_data is output. otherwise, it is input. ? mdi_control_register.mdi_data: this is used to control bi-directional mdio pin. auto-access method the bcm57xx device has a built-in interface to access physical device registers without having to control mdc and mdio pins by software/firmware. it provides an easy way to access the physical device register. to use this mode, mdi_control_register.mdi_select has to be cleared to 0. the mi_communication_register (see ?mi communication register (offset 0x44c)? on page 388 ) is used to access physical device. for example, to read a 16-bit physical register at offset 0x2 from a physical device which is strapped to phy address 1, perform the following steps: 1. mi_communication_register.register_address is set to 0x2. 2. mi_communication_register.phy_addr is set to 1. 3. mi_communication_register.command is set to 0x2. 4. mi_communication_register.start_busy is set to 1. 5. poll until mi_communication_register.start_busy is cleared to 0. 6. mi_communication_register.transaction_data contains 16-bit physical register. refer to ?configuring the gmii/mii phy? on page 242 for example code. note: programmers must be careful to wait for the start _busy bit to clear. writing to the mi communication register (see ?mi communication register (offset 0x44c)? on page 388 ) prior to the completion of a previous mdi access will yield unpredictable mdi data. the previous access will not complete successfully. www.datasheet.in programmer?s guide bcm57xx 01/29/08 broadcom corporation document 57xx-pg105-r mdi register access page 249 to write a 16-bit physical register at offset 0x3 from a physical device which is strapped to phy address 1, perform the following steps: 1. mi_communication_register.register_address is set to 0x3. 2. mi_communication_register.phy_addr is set to 1. 3. mi_communication_register.command is set to 0x1. 4. mi_communication_register.start_busy is set to 1. 5. poll until mi_communication_register.start_busy is cleared to 0. refer to ?configuring the gmii/mii phy? on page 242 for example code. www.datasheet.in bcm57xx programmer?s guide 01/29/08 broadcom corporation page 250 phy setup and initialization document 57xx-pg105-r phy s etup and i nitialization physical layer link changes may be reflected to the mac through the following mechanisms: ? physical layer interrupts ? autopolling ? link ready signal from phy there are two methods of determining link change status from device driver: ? pio read to the ethernet mac status register 0x404 (see ?ethernet mac status register (offset 0x404)? on page 379 ). ? read the link_state_changed bit in the status block (see ?status block? on page 103 ). bcm5700 mac and bcm5401 phy (e xample ) host software may configure the physical layer to assert a phy interrupt when link state changes. the hardware design will have a trace routed between the phy intr and mac mdint pins (see figure 97 ). when the phy detects a change in link state, an interrupt signal is asserted. host software must configure the phy?s interrupt mask register so the appropriate event can be reflected/asserted. additionally, host software must configure the mac to reflect the assertion as a host line driven interrupt (inta ). figure 97: trace routed between phy intr and mac mdint pins note: refer to the application schematics for a det ailed understanding of the phy and mac connections. physical layer interrupts and link ready signals may be routed differently on pcb layouts. host software has dependency on the hardware implementation. programmers are strongly encouraged to reference the schematics for their board level application. mac physical layer intr_phy intr mdint www.datasheet.in programmer?s guide bcm57xx 01/29/08 broadcom corporation document 57xx-pg105-r phy setup and initialization page 251 the bcm5700 mac can poll the phy?s mdi status register 0x02 at physical layer address 0x01 (see figure 98 ). this mechanism is called auto-polling, since the mac will periodically check the mdi status register for changes in link state. when the mdi link status bit changes, the mac will assert an attention to the host using the inta signal. figure 98: polling the phy?s mdi status register for example, the link ready signal may be routed from the bcm5401 link10 pin to the lnkrdy pin on the mac (see figure 99 ). the bcm5401 link10 pin is active low and the mac lnkrdy pin is active high. host software must disable the bcm5401 three link led mode setting, so the link10 signal indicates link up for all wire speeds (10/100/1000 mbps). the link ready mode is mutually exclusive with phy interrupt mode, and the autopolling mode must be disabled. software must toggle polarity of the mac?s lnkrdy pin, since the pin is active high?reset default. figure 99: routing the link ready signal mac physical layer mdc mdi status register 0x01 mdio poll link status bit phy a0 phy a1 phy a2 phy a3 high low low low phy a4 low phy address 1 mac physical layer link_rdy lnkrdy pin link10 pin link connection led shared in 10, 100, & 1000 mode +vdd www.datasheet.in bcm57xx programmer?s guide 01/29/08 broadcom corporation page 252 phy setup and initialization document 57xx-pg105-r the bcm5700 mac?s lnkrdy pin can be programmed for active high or active low logic assertion (see figure 100 ). an active high signal is typically associated with a high voltage and an active low signal to a low voltage. board layouts may route different signals to the lnkrdy pin, and software must configure the logic level appropriately. software may set the logic level of the bcm5700 lnkrdy signal with the link_polarity bit in the ethernet mac mode register (see ?ethernet mac mode register (offset 0x400)? on page 377 ). figure 100: lnkrdy pin programming (active high or active low) setup and initialization procedure this section lists the initializing procedure for the bcm5401 phy. 1. disable link events. write the value 0x00 to ethernet mac event enable register (see ?ethernet mac event enable register (offset 0x408)? on page 381 ). this step de-asserts events for the mi_interrupt and link_state_changed. 2. clear link attentions. write the sync_changed and config_changed bits in the ethernet mac status register (see ?ethernet mac status register (offset 0x404)? on page 379 ) to clear pending attentions. 3. disable autopolling mode. write the value 0xc000 to the mi mode register (see ?mi mode register (offset 0x454)? on page 389 ). the port_polling bit will be de-asserted. 4. wait 40 s for the auto poll disable step to complete. 5. disable bcm5401 wol mode. write 0x02 to the phy?s mdi auxiliary control register. this value will enable the power control shadow register, disable wol, and configure normal operation. 6. the programmer is strongly encouraged to reference the errata sheet for the physical layer component. implement the appropriate workarounds. 7. acknowledge outstanding interrupts by reading the mdi interrupt_status register twice. there are sticky bits, which require host software to read the register twice, to clear values. 8. configure the phy interrupt mask. clear the link_status_change bit in the mdi interrupt_mask register. each bit in the mdi interrupt_status bit has a 1:1 mapping to bits in the mdi interrupt_mask register. assert all remaining bits to disable/ mask out other interrupt types. 9. configure the three link led mode bit (optional). the configuration of this bit is dependent on the board layout. this bit should be asserted when phy interrupts are enabled. this bit should be cleared under the following conditions: ? bcm5401 link10 (or similar signal) is routed to lnkrdy on mac ? phy interrupts are disabled ? autopolling is disabled. mac lnkrdy pin link_rdy link ready bit = 0 mac lnkrdy pin link_rdy link ready bit = 1 www.datasheet.in programmer?s guide bcm57xx 01/29/08 broadcom corporation document 57xx-pg105-r phy setup and initialization page 253 10. determine link status. read the mdi status register twice. there are sticky bits that must be cleared?second read clears bits latched high. 11. determine speed and duplex operation. read the mdi auxiliary_status register. the programmer may poll the mdi auxiliary_status register for 20 ms and check the link_status pass bit. 12. store speed/duplex settings in driver state variables. initialization complete if no link detected. 13. enable flow control. reference ?flow control? on page 280 . 14. configure mac port mode. the driver state variables from step 12 are used to configure the port_mode bit field in the ethernet mac mode register (see ?ethernet mac mode register (offset 0x400)? on page 377 ). this step should be completed each time link changes?the port mode does not reflect the type of phy attached to the mac, rather port_mode configures the hardware interface between mac and phy. 15. configure duplex mode. the driver state variables from step 12 are used to configure the half_duplex bit in the ethernet mac mode register (see ?ethernet mac mode register (offset 0x400)? on page 377 ). 16. configure link polarity (optional). software may configure the bcm5700 to indicate link status changes through the lnkrdy pin. the polarity of the signal routed from the phy may be toggled using the link_polarity bit in the ethernet mac mode register (see ?ethernet mac mode register (offset 0x400)? on page 377 ). 17. enable port polling (optional). software may set the port_polling bit in the mi_mode register (see ?mi mode register (offset 0x454)? on page 389 ). 18. enable link attentions. software should enable link attentions, so a host line interrupt is driven when link state changes. programmers may choose the type of attentions generated with the ethernet mac event enable register (see ?ethernet mac event enable register (offset 0x408)? on page 381 ): ? phy interrupt attentions are enabled by asserting the mi_interrupt bit. ? port polling attentions are enabled by asserting the link_state_changed bit. ? lnkrdy attentions are also enabled by asserting the link_state_changed bit. the bcm5464 phy core, used in bcm5751, bcm5721, and bcm5705, shows poor ber performance when the ethernet connection is linked at gigabit speed with a cable length of 70m of less. this is caused by the internal hybrid bias current level, which impacts the slew-rate of the transmitted signals. to work around this issue, the firmware and/or driver need to perform the following writes to the phy module immediately after the phy comes out of reset. the firmware v3.19a or later has this work around implemented. 1. write the value 0x0c00 to phy register at offset 0x18 2. write the value 0x000a to phy register at offset 0x17 3. write the value 0x310b to phy register at offset 0x15 4. write the value 0x201f to phy register at offset 0x17 5. write the value 0x9506 to phy register at offset 0x15 6. write the value 0x401f to phy register at offset 0x17 7. write the value 0x14e2 to phy register at offset 0x15 8. write the value 0x0400 to phy register at offset 0x18 www.datasheet.in bcm57xx programmer?s guide 01/29/08 broadcom corporation page 254 phy setup and initialization document 57xx-pg105-r pseudocode to set up fiber auto-negotiation the auto-negotiation-related attributes (e.g., mr_an_complete, mr_an_enable) are inherited from the 2000 edition ieee std 802.3 figure 37.6?auto-negotiation state diagram. hardware register read/write always uses an assignment expression with an identifier postfixed with _register. for example: ? register read: value32_variable = mac_status_register ? register write: mac_mode_register.send_configs = 1 transmit_1000base-x_an_register = 0 register reference documentation should be used to understand various register bit field manipulation. any identifiers without ending _register are software representation. they do not change any hardware registers. /* function forward declaration */ an_result_return_value autoneg8023z(input_parameter bcm570x_data.an_information) fc_return_value setup_flow_control(bcm570x_sw_representation bcm570x_data, input_unsigned_32bit_param localphyad_variable, input_unsigned_32bit_param remotephyad_variable) return_value indicate_status(bcm570x_sw_representation bcm570x_data, input_parameter status) setup_fiber_phy(bcm570x_sw_representation bcm570x_data) { local_unsigned_32bit_variable currentlinkstatus_variable ; local_unsigned_32bit_variable value32_variable ; local_unsigned_32bit_variable count_variable ; local_unsigned_32bit_variable j_variable ; local_unsigned_32bit_variable macmode ; local_enum_variable anstatus_variable ; /* enable full-duplex mode in mac mode register (offset 0x400) */ mac_mode_register.half_duplex = 0 ; /* enable tbi mode */ mac_mode_register.port_mode = tbi_mode ; /* fill transmit 1000base-x an register (offset 0x444) with zero */ transmit_1000base-x_an_register = 0 ; if (phy_device == bcm8002_serdes_phy) { initialize_bcm8002 ; } /* set link status change interrupt bit in mac event enable register (offset 0x408) */ mac_event_enable_register.link_state_changed = 1 ; /* assume current link status to be down */ currentlinkstatus_variable = link_down ; /* read the link status out of mac status register (offset 0x404) */ value32_variable = mac_status_register ; www.datasheet.in programmer?s guide bcm57xx 01/29/08 broadcom corporation document 57xx-pg105-r phy setup and initialization page 255 if ( ( pcs_synched_bit in value32_variable ) = 1 ) /* if link is up */ { /* if auto-negotiation(an) mode is intended, which should be default */ if (bcm570x_data.requested_media_type is media_type_an) { /* initialize the an default capabilities. */ bcm570x_data.an_infomation.full_duplex = enabled ; bcm570x_data.an_infomation.symmetrical_pause = enabled ; bcm570x_data.an_infomation.asymmetrical_pause = enabled ; bcm570x_data.an_infomation.autoneg = enabled ; /* get intended flow_control setting */ value32_variable = bcm570x_data.flow_control_setting ; /* bit 10 is the pause capable bit */ if (value32_variable.bit_10 is set) bcm570x_data.an_infomation.pause_capable = 1 ; else bcm570x_data.an_infomation.pause_capable = 0 ; /* bit 11 is the asymmetric pause bit */ if (value32_variable.bit_11 is set) bcm570x_data.an_infomation.asymmetric_pause = 1 ; else bcm570x_data.an_infomation.asymmetric_pause = 0 ; /* try to auto-negotiate up to four times. */ for_loop (count_variable from 1 to 4) { /* fill transmit 1000base-x an register with zero */ transmit_1000base-x_an_register = 0 ; /* write zero to the grc timer register (offset 0x680c) */ grc_timer_register = 0 ; /* initialize autoneg state to unknown state */ bcm570x_data.an_information.state = an_ unknown_state ; /* initialize current time to zero u-sec */ bcm570x_data.an_information.currenttime_us = 0 ; while_loop( bcm570x_data.an_information.currenttime_us < 55000 ) { /* call function autoneg8023z to do ieee802.3z auto negotiation */ anstatus_variable = autoneg8023z( bcm570x_data.an_information ) ; if ( anstatus_variable is an_done or an_failed ) break_out_of_while_loop ; /* update timer variable with hardware timer value */ bcm570x_data.an_information.currenttime_us = grc_timer_register ; } /* end of while_loop */ /* auto-negotiation finishes normally */ if ( anstatus_variable is an_done ) break_out_of_for_loop ; /* auto-negotiation finishes abnormally (cable may be disconnected) */ www.datasheet.in bcm57xx programmer?s guide 01/29/08 broadcom corporation page 256 phy setup and initialization document 57xx-pg105-r if ( anstatus_variable is an_failed ) break_out_of_for_loop ; /* break out the retry loop early, if there is no cable. */ if ( count_variable >= 1 ) { /* read mac status register (offset 0x404) into value32_variable */ value32_variable = mac_status_register ; /* if pcs_synced bit (bit 0) in value32_variable is 0, break out */ if ( value32_variable.pcs_synced is 0 ) break_out_of_for_loop ; } } /* end of for_loop */ /* write 0 to mac_mode_register.send_configs bit to stop sending configs */ mac_mode_register.send_configs = 0 ; /* resolve follow control settings. */ if ( (anstatus_variable is an_done ) and ( bcm570x_data.an_infomation.mr_an_complete bit is set ) and ( bcm570x_data.an_infomation.mr_link_ok bit is set ) and ( bcm570x_data.an_infomation.mr_lp_adv_full_duplex bit is set ) ) { local_unsigned_32bit_variable localphyad_variable ; local_unsigned_32bit_variable remotephyad_variable ; /* initialize local variable */ localphyad_variable = 0 ; remotephyad_variable = 0 ; if ( bcm570x_data.an_infomation.mr_adv_sym_pause bit is set ) localphyad_variable.bit_10 = 1 ; if ( bcm570x_data.an_infomation.mr_adv_asym_pause bit is set ) localphyad_variable.bit_11 = 1 ; if ( bcm570x_data.an_infomation.mr_lp_adv_sym_pause bit is set ) remotephyad_variable.bit_10 = 1 ; if ( bcm570x_data.an_infomation.mr_lp_adv_asym_pause bit is set ) remotephyad_variable_bit_11 = 1 ; /* call flow control function to set up flow control registers */ setup_flow_control( bcm57xx _data, localphyad_variable, remotephyad_variable ); currentlinkstatus_variable = link_active ; } /* clear the interrupt status. */ /* set bit 3 (config changed) and bit 4 (sync changed) of */ /* mac status register (offset 0x404) to 1 */ mac_status_register.bit_3 = 1 ; mac_status_register.bit_4 = 1 ; /* make sure we really acknowledge the interrupt, otherwise we */ www.datasheet.in programmer?s guide bcm57xx 01/29/08 broadcom corporation document 57xx-pg105-r phy setup and initialization page 257 /* will enter this routine again. to ensure that we can */ /* successfully clear the interrupt, we need to wait for the */ /* other side stop sending configs. this case will only occur */ /* when we are connected back-to-back. */ if ( anstatus_variable == an_done ) { /* wait for link partner to finish */ for_loop ( when j_variable is from 1 to 400 ) { wait_100_u-second ; /* read mac status register (offset 0x404) into value32_variable */ value32_variable = mac_status_register ; /* continue waiting until bit 2 (receiving config) is cleared */ if ( value32_variable.bit_2 is cleared ) break_out_of_for_loop; /* the interrupt will be cleared below */ } } } else /* end of if(bcm570x_data.requested_media_type is media_type_an) */ { /* we are forcing line speed 1000fd */ currentlinkstatus_variable = link_active ; } } /* end of if( (pcs_synched_bit in value32_variable) = 1 ) */ /* write 0 to ethernet mac mode register (offset 0x400) bit 10 */ /* to set the link polarity bit to positive polarity */ mac_mode_register.bit_10 = 0 ; /* clear the interrupt status again. */ /* write a 1 to bit 3 (config changed) and bit 4 (sync changed) */ /* to ethernet mac status register (offset 0x404) to clear interrupt */ mac_status_register.bit_3 = 1 ; mac_status_register.bit_4 = 1 ; /* update software flags to indicate link status change */ bcm570x_data.virtual_block.status.bit_0 = 1 ; /* status is now updated */ bcm570x_data.virtual_block.status.bit_1 = 0 ; /* link status change cleared */ /* initialize the current link status. */ if ( currentlinkstatus_variable == link_active ) { /* link is up, set software flagsto indicate it */ bcm570x_data.line_speed = line_speed_1000mbps ; bcm570x_data.duplex_mode = duplex_mode_full ; } else { /* link is down, set unknown state */ bcm570x_data.line_speed = line_speed_unknown ; bcm570x_data.duplex_mode = duplex_mode_unknown ; } /* indicate media type and link status. */ bcm570x_data.media_type = media_type_fiber ; bcm570x_data.link_status = currentlinkstatus_variable ; /* call indicate_status to notify os that fiber phy has been set up */ www.datasheet.in bcm57xx programmer?s guide 01/29/08 broadcom corporation page 258 phy setup and initialization document 57xx-pg105-r indicate_status(bcm570x_data, currentlinkstatus_variable) ; return success; } /* this function implements ieee 802.3z figure 37-6 auto-negotiation state diagram */ /* reference ieee 802.3 section 37 to get complete comprehension */ an_result_return_value autoneg8023z(input_parameter bcm570x_data.an_information) { local_unsigned_16bit_variable rxconfig_variable ; local_unsigned_32bit_variable delta_us_variable ; local_enum_variable an_result_variable ; /* an result/return variable */ /* initialize all an flags to default values */ if ( bcm570x_data.an_information.state is an_unknown_state ) { bcm570x_data.an_information.rxconfig = 0 ; bcm570x_data.an_information.currenttime_us = 0 ; bcm570x_data.an_information.linktime_us = 0 ; bcm570x_data.an_information.abilitymatchcfg = 0 ; bcm570x_data.an_information.abilitymatchcnt = 0 ; bcm570x_data.an_information.abilitymatch = an_fase ; bcm570x_data.an_information.idlematch = an_fase ; bcm570x_data.an_information.ackmatch = an_fase ; } /* set the abilitymatch, idlematch, and ackmatch flags if their */ /* corresponding conditions are satisfied. */ /* read receive_1000base-x_an_register (offset 0x448) to a local variable */ if ( reading receive_1000base-x_an_register to rxconfig_variable succeeds ) { if ( rxconfig_variable != bcm570x_data.an_information.abilitymatchcfg ) { bcm570x_data.an_information.abilitymatchcfg = rxconfig_variable ; bcm570x_data.an_information.abilitymatch = an_fase ; bcm570x_data.an_information.abilitymatchcnt = 0 ; } else { bcm570x_data.an_information.abilitymatchcnt++ ; if ( bcm570x_data.an_information.abilitymatchcnt > 1 ) { bcm570x_data.an_information.abilitymatch = an_true ; bcm570x_data.an_information.abilitymatchcfg = rxconfig_variable ; } } if ( rxconfig_variable.an_config_ack_bit is set ) bcm570x_data.an_information.ackmatch = an_true ; else bcm570x_data.an_information.ackmatch = an_fase ; bcm570x_data.an_information.idlematch = an_fase ; } else /* reading receive_1000base-x_an_register fails */ www.datasheet.in programmer?s guide bcm57xx 01/29/08 broadcom corporation document 57xx-pg105-r phy setup and initialization page 259 { bcm570x_data.an_information.idlematch = an_true ; bcm570x_data.an_information.abilitymatchcfg = 0 ; bcm570x_data.an_information.abilitymatchcnt = 0 ; bcm570x_data.an_information.abilitymatch = an_fase ; bcm570x_data.an_information.ackmatch = an_fase ; rxconfig_variable = 0 ; } /* save the last rx_config value */ bcm570x_data.an_information.rxconfig = rxconfig_variable ; /* default return code. */ an_result_variable = an_status_ok ; /* an state machine as defined in 802.3z/802.3 section 37.3.1.5. or fig. 37-6 */ switch( bcm570x_data.an_information.state ) { case an_unknown_state: /* check management register(mr) an flags */ if(bcm570x_data.an_information.mr_an_enable or bcm570x_data.an_information.mr_restart_an) { bcm570x_data.an_information.currenttime_us = 0 ; bcm570x_data.an_information.state = an_enable_state ; } /* fall through */ case an_enable_state: bcm570x_data.an_information.mr_an_complete = an_fase ; bcm570x_data.an_information.mr_page_rx = an_fase ; if ( bcm570x_data.an_information.mr_an_enable ) { bcm570x_data.an_information.linktime_us = 0 ; bcm570x_data.an_information.abilitymatchcfg = 0 ; bcm570x_data.an_information.abilitymatchcnt = 0 ; bcm570x_data.an_information.abilitymatch = an_fase ; bcm570x_data.an_information.idlematch = an_fase ; bcm570x_data.an_information.ackmatch = an_fase ; bcm570x_data.an_information.state = an_restart_init ; } else bcm570x_data.an_information.state = an_disable_link_ok ; break_out_of_switch ; case an_restart_init: bcm570x_data.an_information.linktime_us = bcm570x_data.an_information.currenttime_us ; bcm570x_data.an_information.mr_np_loaded = an_fase ; /* write 0 to a buffer (bcm570x_data.an_information.txconfig) */ www.datasheet.in bcm57xx programmer?s guide 01/29/08 broadcom corporation page 260 phy setup and initialization document 57xx-pg105-r bcm570x_data.an_information.txconfig = 0; /* copy buffer to transmit 1000base-x an register (offset 0x444) */ transmit_1000base-x_an_register = bcm570x_data.an_information.txconfig ; /* write 1 to mac_mode_register.send_configs bit to send data in tx register */ mac_mode_register.send_configs = 1 ; an_result_variable = an_timer_enabled ; bcm570x_data.an_information.state = an_restart ; /* fall through.*/ case an_restart: /* get the current time and compute the delta with the saved link timer */ delta_us_variable = bcm570x_data.an_information.currenttime_us - bcm570x_data.an_information.linktime_us ; if ( delta_us_variable > 9000 ) bcm570x_data.an_information.state = an_ability_detect_init ; else an_result_variable = an_timer_enabled ; break_out_of_switch ; case an_disable_link_ok: an_result_variable = an_done; break_out_of_switch ; case an_ability_detect_init: /* note: in the state diagram, this variable is set to */ /* mr_adv_ability<12>. is this right?. */ bcm570x_data.an_information.mr_toggle_tx = an_fase; /* the txconfig register is arranged as follows: */ /* */ /* msb lsb */ /* +---+---+---+---+---+---+---+---+---+---+---+---+---+---+---+---+ */ /* | d7| d6| d5| d4| d3| d2| d1| d0|d15|d14|d13|d12|d11|d10| d9| d8| */ /* +---+---+---+---+---+---+---+---+---+---+---+---+---+---+---+---+ */ /* fill buffer (bcm570x_data.an_information.txconfig) with */ /* desired data(advertisement) */ bcm570x_data.an_information.txconfig = 0; /* initialize buffer */ bcm570x_data.an_information.txconfig.d5 = bcm570x_data.an_information.mr_adv_full_duplex ; bcm570x_data.an_information.txconfig.d6 = bcm570x_data.an_information.mr_adv_half_duplex ; bcm570x_data.an_information.txconfig.d7 = bcm570x_data.an_information.mr_adv_sym_pause ; bcm570x_data.an_information.txconfig.d8 = bcm570x_data.an_information.mr_adv_asym_pause ; bcm570x_data.an_information.txconfig.d12 = bcm570x_data.an_information.mr_adv_remote_fault1 ; bcm570x_data.an_information.txconfig.d13 = bcm570x_data.an_information.mr_adv_remote_fault2 ; bcm570x_data.an_information.txconfig.d15 = bcm570x_data.an_information.mr_adv_next_page ; www.datasheet.in programmer?s guide bcm57xx 01/29/08 broadcom corporation document 57xx-pg105-r phy setup and initialization page 261 /* copy buffer to transmit 1000base-x an register (offset 0x444) */ transmit_1000base-x_an_register = bcm570x_data.an_information.txconfig ; /* write 1 to mac_mode_register.send_configs bit to send data in tx register */ /* send the config as advertised in the advertisement register */ mac_mode_register.send_configs = 1 ; bcm570x_data.an_information.state = an_ability_detect ; break_out_of_switch ; case an_ability_detect: if ( bcm570x_data.an_information.abilitymatch == an_true and bcm570x_data.an_information.rxconfig != 0 ) bcm570x_data.an_information.state = an_ack_detect_init ; break_out_of_switch ; case an_ack_detect_init: /* write 1 to a buffer (bcm570x_data.an_information.txconfig.bit14_ack) */ bcm570x_data.an_information.txconfig.bit14_ack = 1; /* copy buffer to transmit 1000base-x an register (offset 0x444) */ transmit_1000base-x_an_register = bcm570x_data.an_information.txconfig ; /* write 1 to mac_mode_register.send_configs bit to send data in tx register */ mac_mode_register.send_configs = 1 ; bcm570x_data.an_information.state = an_ack_detect ; /* fall through. */ case an_ ack_detect: if ( bcm570x_data.an_information.ackmatch == an_true ) { if ( ( bcm570x_data.an_information.rxconfig & 0xffbf ) == ( bcm570x_data.an_information.abilitymatchcfg & 0xffbf ) ) bcm570x_data.an_information.state = an_complete_ack_init ; else bcm570x_data.an_information.state = an_enable_state ; } else if ( bcm570x_data.an_information.abilitymatch == an_true and bcm570x_data.an_information.rxconfig == 0 ) { bcm570x_data.an_information.state = an_enable_state; } break_out_of_switch; case an_complete_ack_init: /* the rxconfig register is arranged as follows: */ /* */ /* msb lsb */ /* +---+---+---+---+---+---+---+---+---+---+---+---+---+---+---+---+ */ /* | d7| d6| d5| d4| d3| d2| d1| d0|d15|d14|d13|d12|d11|d10| d9| d8| */ /* +---+---+---+---+---+---+---+---+---+---+---+---+---+---+---+---+ */ /* make sure invalid bits are not set. */ if ( bcm570x_data.an_information.rxconfig.d0 or www.datasheet.in bcm57xx programmer?s guide 01/29/08 broadcom corporation page 262 phy setup and initialization document 57xx-pg105-r bcm570x_data.an_information.rxconfig.d1 or bcm570x_data.an_information.rxconfig.d2 or bcm570x_data.an_information.rxconfig.d3 or bcm570x_data.an_information.rxconfig.d4 or bcm570x_data.an_information.rxconfig.d9 or bcm570x_data.an_information.rxconfig.d10 or bcm570x_data.an_information.rxconfig.d11 ) { an_result_variable = an_failed ; break_out_of_switch; } /* set up the link partner advertisement register. */ bcm570x_data.an_information.mr_lp_adv_full_duplex = bcm570x_data.an_information.rxconfig.d5 ; bcm570x_data.an_information.mr_lp_adv_half_duplex = bcm570x_data.an_information.rxconfig.d6 ; bcm570x_data.an_information.mr_lp_adv_sym_pause = bcm570x_data.an_information.rxconfig.d7 ; bcm570x_data.an_information.mr_lp_adv_asym_pause = bcm570x_data.an_information.rxconfig.d8 ; bcm570x_data.an_information.mr_lp_adv_remote_fault1 = bcm570x_data.an_information.rxconfig.d12 ; bcm570x_data.an_information.mr_lp_adv_remote_fault2 = bcm570x_data.an_information.rxconfig.d13 ; bcm570x_data.an_information.mr_lp_adv_next_page = bcm570x_data.an_information.rxconfig.d15 ; bcm570x_data.an_information.linktime_us = bcm570x_data.an_information.currenttime_us ; bcm570x_data.an_information.mr_toggle_tx = bcm570x_data.an_information.mr_toggle_tx ; bcm570x_data.an_information.mr_toggle_rx = bcm570x_data.an_information.rxconfig.d11 ; bcm570x_data.an_information.mr_np_rx = bcm570x_data.an_information.rxconfig.d15 ; bcm570x_data.an_information.mr_page_rx = an_true ; bcm570x_data.an_information.state = an_complete_ack ; an_result_variable = an_timer_enabled ; break_out_of_switch ; case an_complete_ack: if ( bcm570x_data.an_information.abilitymatch == an_true and bcm570x_data.an_information.rxconfig == 0 ) { bcm570x_data.an_information.state = an_enable_state ; break_out_of_switch ; } delta_us_variable = bcm570x_data.an_information.currenttime_us - bcm570x_data.an_information.linktime_us ; if ( delta_us_variable > 9000 ) www.datasheet.in programmer?s guide bcm57xx 01/29/08 broadcom corporation document 57xx-pg105-r phy setup and initialization page 263 { if ( bcm570x_data.an_information.mr_adv_next_page == 0 or bcm570x_data.an_information.mr_lp_adv_next_page == 0 ) { bcm570x_data.an_information.state = an_idle_detect_init ; } else { if ( bcm570x_data.an_information.txconfig.d15 == 0 and bcm570x_data.an_information.mr_np_rx == 0 ) bcm570x_data.an_information.state = an_idle_detect_init; else an_result_variable = an_failed ; } } break_out_of_switch; case an_idle_detect_init: bcm570x_data.an_information.linktime_us = bcm570x_data.an_information.currenttime_us; /* write 0 to mac_mode_register.send_configs bit to stop sending configs */ mac_mode_register.send_configs = 0 ; bcm570x_data.an_information.state = an_idle_detect ; an_result_variable = an_timer_enabled ; break_out_of_switch ; case an_idle_detect: if ( bcm570x_data.an_information.abilitymatch == an_true and bcm570x_data.an_information.rxconfig == 0 ) { bcm570x_data.an_information.state = an_enable_state ; break_out_of_switch ; } delta_us_variable = bcm570x_data.an_information.currenttime_us - bcm570x_data.an_information.linktime_us ; if ( delta_us_variable > 9000 ) bcm570x_data.an_information.state = an_link_ok ; break_out_of_switch ; case an_link_ok: bcm570x_data.an_information.mr_an_complete = an_true ; bcm570x_data.an_information.mr_link_ok = an_true ; an_result_variable = an_done ; break_out_of_switch ; case an_next_page_wait_init: /* ieee 802.3 next_page_wait state is optional and not implemented */ www.datasheet.in bcm57xx programmer?s guide 01/29/08 broadcom corporation page 264 phy setup and initialization document 57xx-pg105-r break_out_of_switch; case an_ next_page_wait: /* ieee 802.3 next_page_wait state is optional and not implemented */ break_out_of_switch; default: /* invalid case, execution should never get here */ an_result_variable = an_failed ; break_out_of_switch; } return an_result_variable; } /* acronyms for following functions: */ /* fc = flow control, rx = receive, tx = transmit, */ /* an = auto-negotiation, lp = link partner */ fc_return_value setup_flow_control( bcm570x_sw_representation bcm570x_data, input_unsigned_32bit_param localphyad_variable, input_unsigned_32bit_param remotephyad_variable) { local_unsigned_32bit_variable flow_cap_variable ; flow_cap_variable = 0 ; /* initialization flow capability */ /* resolve flow control attributes */ /* see table 28b-3 of 802.3ab-1999 spec. */ /* msb(bit 31) of bcm570x_data.flowcontrolcap indicates */ /* if flow control auto pause mode turns on */ if ( bit_31 of bcm570x_data.flowcontrolcap is set ) { /* bit 10 of localphyad_variable indicates local phy auto- */ /* negotiation(an) advertisement register pause capability */ if ( localphyad_variable.bit_10 is set ) { /* localphyad_variable bit 11 indicates phy an asym pause */ if ( localphyad_variable.bit_11 is set ) { /* remotephyad_variable bit 10 indicates if an remote */ /* link partner pause capable turns on or not */ if ( remotephyad_variable.bit_10 is set ) { flow_cap_variable.bit_1 = 1 ; /* turn on fc rx pause */ flow_cap_variable.bit_2 = 1 ; /* turn on fc tx pause */ } /* bit 11 sets an remote link partner asymmetric pause */ else if ( remotephyad_variable.bit_11 is set ) { flow_cap_variable.bit_1 = 1 ; /* turn on fc rx pause */ } } www.datasheet.in programmer?s guide bcm57xx 01/29/08 broadcom corporation document 57xx-pg105-r phy setup and initialization page 265 else /* local an asymmetric pause mode turns off */ { /* if remote link partner pause capable turns on */ if ( remotephyad_variable.bit_10 is set ) { flow_cap_variable.bit_1 = 1 ; /* turn on fc rx pause */ flow_cap_variable.bit_2 = 1 ; /* turn on fc tx pause */ } } } /* local phy an advertisement asymmetric pause is turned on */ else if ( localphyad_variable.bit_11 is set ) { /* both pause capable and asymmetric pause modes of an */ /* remote link partner ability register are turned on */ if ( remotephyad_variable.bit_10 and bit_11 are both set ) flow_cap_variable.bit_2 = 1 ; /* turn on fc tx pause */ } } else /* if auto pause mode is turned off, none of fc mode is set */ flow_cap_variable = bcm570x_data.flowcontrolcap ; /* enable/disable rx pause. */ /* bit 2 of receive mac mode register (offset 0x468) determines */ /* flow control on or off. first, turn it off. */ bcm570x_data.rxmode.bit_2 = 0 ; if ( ( flow_cap_variable.bit_1 is set) and /* flow control rx pause is on */ ( bcm570x_data.flowcontrolcap.bit_31 is set or /* fc auto pause is on */ bcm570x_data.flowcontrolcap.bit_1 is set ) ) /* fc rx pause is on */ { bcm570x_data.flowcontrol.bit_1 = 1 ; /* turn on fc rx pause */ bcm570x_data.rxmode.bit_2 = 1 ; /* turn on flow control mode */ } /* write the data in bcm570x_data.rxmode into */ /* receive mac mode register (offset 0x468) */ receive_mac_mode_register = bcm570x_data.rxmode ; /* enable/disable tx pause. */ /* bit 4 of transmit mac mode register (offset 0x45c) determines */ /* flow control on or off. first, turn it off. */ bcm570x_data.txmode.bit_4 = 0 ; if ( ( flow_cap_variable.bit_2 is set) and /* flow control tx pause is on */ ( bcm570x_data.flowcontrolcap.bit_31 is set or /* fc auto pause is on */ bcm570x_data.flowcontrolcap.bit_2 is set ) ) /* fc tx pause is on */ { bcm570x_data.flowcontroli.bit_2 = 1 ; bcm570x_data.txmode.bit_4 = 1 ; } /* write the data in bcm570x_data.rxmode into */ /* transmit mac mode register (offset 0x45c) */ transmit_mac_mode_register = bcm570x_data.txmode ; return fc_success ; } www.datasheet.in bcm57xx programmer?s guide 01/29/08 broadcom corporation page 266 phy setup and initialization document 57xx-pg105-r return_value indicate_status( bcm570x_sw_representation bcm570x_data, input_parameter status) { local_boolean_variable timercancelled_variable; if ( bcm570x_data.requested_media_type is mac_loopback or phy_loopback ) { bcm570x_data.link_status = link_active ; /* os should not transmit packets if the link is down */ if ( bcm570x_data.initialization_done ) { /* if os link and status are not updated yet, do it now */ if ( bcm570x_data.os_link_indication_status != bcm570x_data.link_status ) { /* different os's handle resource access synchronization in */ /* different way, follow your os protocol to implement phy */ /* setup completion notification here. generally, there is */ /* a resource-take and resource-release pair for guarding. */ /* before entering here, os should lock resource already. */ os_specific_semaphore_release(input_parameters, ...) ; /* notify os of the current status - phy setup done */ os_specific_indicate_status(bcm570x_data.connected, bcm570x_data.handler); /* os should lock the resource again */ os_specific_semaphore_take(input_parameters, ...) ; } } bcm570x_data.os_link_indication_status = link_active ; return success ; } if ( bcm570x_data.drivr_state != normal_mode ) return success ; if ( bcm570x_data.os_link_indication_status == bcm570x_data.link_status ) { /* when the cable is plugged back, we may not finish auto-negotiation */ /* successfully due to signal stability. in this case we force */ /* an auto-negotiation retry 1 second later. */ if ( ( bcm570x_data.requested_media_type == media_type_an ) and ( bcm570x_data.enable_tbi is true ) and ( bcm570x_data.link_status == link_down ) and ( bcm570x_data.initialization_done is true ) ) { os_specific_cancel_current_timer(input_parameters, ...) ; os_specific_set_retry_after_1_sec(input_parameters, ...) ; } if ( ( bcm570x_data.link_status == link_down ) or ( bcm570x_data.link_status == link_active and www.datasheet.in programmer?s guide bcm57xx 01/29/08 broadcom corporation document 57xx-pg105-r phy setup and initialization page 267 bcm570x_data.os_line_speed_indication == bcm570x_data.line_speed ) ) return success ; } bcm570x_data.autoneg_retry_count = 0; if ( bcm570x_data.initialization_done ) { /* reset timer interval to fire a periodical signal */ os_specific_cancel_current_timer(input_parameters, ...) ; if ( bcm570x_data.link_status == link_active ) os_specific_set_timer_at_1.2_sec(input_parameters, ...) ; else os_specific_set_timer_at_0.02_sec(input_parameters, ...) ; } else { bcm570x_data.os_link_indication_status = bcm570x_data.device.link_status; bcm570x_data.os_line_speed_indication = bcm570x_data.device.line_speed; } return success ; } www.datasheet.in bcm57xx programmer?s guide 01/29/08 broadcom corporation page 268 wake-on lan mode/low-power document 57xx-pg105-r w ake - on lan m ode /l ow -p ower d escription the bcm57xx family uses the acpi d3 hot/cold (low-power) state to conserve energy. the os power management policy notifies device drivers to initiate power management transitions. the bcm57xx device driver should move the mac into the d3 hot/cold power state?a response to the power management request (see appendix b ?pc power management? on page 708 for more details on power management). while the bcm57xx family is in a d3 state, the rx mac will filter incoming packets. the rx mac compares incoming traffic for interesting packet pattern matches. the bcm57xx family asserts the pci pme signal, when a positive wol packet comparison is made. the pme signal notifies the operating system and host device driver to transition the mac into the d0 (high power) state. wol mode is a combination of phy and mac configurations. both the phy and mac must be configured correctly to enable broadcom?s wol technology. ? the bcm5700 and bcm5701 evaluation boards only support d3 cold wake-up at 10 mbps. the bcm5701 chip consumes roughly 325 ma and the board level design must conserve the remaining 50 ma. the pci power management specification does not allow devices to draw more than 375 ma in d3 states. ? while in the d3 hot state, the bcm5401 phy (bcm5700 mac only) and bcm57xx family can support wake-up while running at any line speed. the bcm57xx family supports both interesting packet pattern matching the amd magic packet proprietary technology for wol. the wol support for the amd magic packet format does not require host software to configure a pattern filter. the magic packet comparison is made in hardware and is enabled through a register interface. the amd magic packet can be either broadcast or directed, and must contain the receiver's mac address at least six times (repeating) in the packet. the magic packet wake-up is configured different from pattern match wake-up. the following components are involved in wol operation: ? internal memory ? wol pattern pointer register ? wol pattern configuration register ? wol streams ? pattern data structure ? gpio ? firmware mailbox ? phy auto-negotiation ? phy power management ? bcm57xx power management www.datasheet.in programmer?s guide bcm57xx 01/29/08 broadcom corporation document 57xx-pg105-r wake-on lan mode/low-power page 269 f unctional o verview the bcm57xx family is capable of wol in 10/100 mbps for copper-based controllers and 1000 mbps for fiber-based controllers. the bcm5700 evaluation nic and bcm5701 physical layer supports wol at 10 mbps wire speed so the host programmer should configure the mac accordingly. the bcm57xx family uses the tx fifo to store pattern data (see figure 101 ). during wol operation, the transmit engine is disabled and its fifo is free for use. the tde fetches data from the memory arbiter starting at a location specified in the wol_pattern_pointer register. the wol pattern checker pulls data off the tx fifo for packet comparisons. the rx mac will move incoming frame(s) to the pattern checker, and the remaining rx data path is not utilized. a state machine controls the magic packet comparisons. the wol state machine will move out of an idle state, when acpi power management is enabled. the wol state machine will clear the tx fifo and match register. the match register indicates a positive magic packet comparison(s) on a stream. in 10/100 mbit mode, data is received once every four clock cycles. the pattern checker compares the first three patterns in the first cycle, the second three patterns in the second cycle, and the third three patterns in the last cycle. it is idle d uring the fourth cycle. in gigabit mode, the pattern checker gets three pattern words from the fifo at one time. figure 101: wol functional block diagram note: when configured for wol in 1000-mbps mode, the bcm57xx family draws more than the 375 ma allowed by the pci specification. rx mac pattern checker tx fifo tde memory arbiter internal memory pattern data rx pcs rx rmii rx gmii rx io power managment www.datasheet.in bcm57xx programmer?s guide 01/29/08 broadcom corporation page 270 wake-on lan mode/low-power document 57xx-pg105-r o perational c haracteristics internal memory the wol pattern must be stored in the bcm57xx miscellaneous memory region. all memory locations require the host soft- ware to reinitialize the wol pattern before each d0 to d3 transition. the rx/tx mac places packets into this internal mem- ory and the wol pattern is overwritten during normal operation. when the bcm57xx family operates in d0 state, internal data structures use the same memory location as the wol pattern. host software should re-initialize the wol pattern before each wol sleep transition. table 116 shows the required memory regions for the wol pattern. wol pattern pointer register the wol_pattern_pointer specifies a location within bcm57xx address space where the pattern buffers reside (see ?wol pattern pointer register (offset 0x430)? on page 385 for the register definition). the internal memory subsection discusses how host programmers can choose an address range. the wol_pattern_pointer register uses a pointer value, not an in- ternal memory location. the pointer value is calculated by dividing an internal memory location by the value 8. do not pro- gram the wol_pattern_pointer register with the actual internal memory location. rather, host software must first convert the base address to a pointer value. here are example conversion from memory base to pointer values: ? 0x0000 (misc memory)/8 = 0x00 (required value) ? 0x400 (base addr)/8 = 0x80 (pointer value) ? 0x8000 (base addr)/8 = 0x1000 (pointer value) ? 0xf000 (base addr)/8 = 0x1e00 (pointer value) wol pattern configuration register the wol_pattern_configuration register contains two programmable data fields. both fields use different units of measure- ment, so the host programmer should be careful (see ?wol pattern configuration register (offset 0x434)? on page 386 for the register definition). this register is used to position and extract data from rx ethernet frames. ? offset field ?the offset field in the wol_pattern_configuration register specifies a position in rx ethernet frame(s), where comparisons for wol patterns should begin. this regist er uses a unit of measurement specified in terms of 2- byte chunks. software should not program this field with a byte value, but should first normalize to a 2-byte unit. hardware cannot begin wol comparisons on odd byte alignments (i.e., 3,5,7,9 offsets). host software must begin all pattern matching on even byte boundaries (i.e., 2,4,6,8 offsets). the 2 bytes per unit forces even byte alignment. for example: - 0x14 (byte offset)/2 = 0x0a (register ready) - 0x28 (byte offset)/2 = 0x14 (register ready) - 0xfc (byte offset)/2 = 0x7e (register ready) table 116: required memory regions for wol pattern internal address range size name cross-reference 0x8000?0x8fff 8 kb miscellaneous memory region table 82 on page 171 www.datasheet.in programmer?s guide bcm57xx 01/29/08 broadcom corporation document 57xx-pg105-r wake-on lan mode/low-power page 271 ? length field ?the length field in the wol_pattern_configuration register specifies the number of clock cycles required to compare a variable number of bytes, in the rx stream. the length field uses a unit of measurement specified in terms of memory arbiter clock cycles. software should not program this field with a byte value. the length field should be programmed with the maximum number of clocks required to compare the largest pattern size for the nine streams (10/100 mode only). the programmer must use the following equation to calculate the number of clock cycles required to match patterns at 10/100 wire-speed: (length/2) * 3 ma clocks. the equation breaks down as follows: - determine the number of bytes in the rx ethernet frame to compare. this value is a byte length. - the wol pattern checker can compare two bytes simultaneously. divide length by two bytes and round up to nearest integer value. - the bcm57xx family compares 2 bytes every three memory arbiter (ma) clock cycles. multiply (length/2) by three clock cycles. ? the following are example clock cycle calculations: - data stream length = 25 bytes - 25 bytes/2 = 12.5 byte-pairs - round(12.5) = 13 byte-pairs - 13 byte-pairs * 3 clocks/byte-pairs = 39 clocks (register ready) - data stream length = 83 bytes - 83 bytes/2 = 41.5 byte-pairs - round(41.5) = 42 byte-pairs - 42 byte-pairs * 3 clocks/byte-pair = 126 clocks (register ready) wol streams a stream is a comparison operation on rx frame(s). when the mac is running at 10/100 mbps wire speed, nine different patterns can be compared against the rx frame(s). the bcm57xx family moves rx frame(s) into nine parallel comparators, and the frame is matched simultaneously. the mac is capable of filtering nine different patterns in 10/100 modes. the wol pattern checker breaks frames into 2-byte pairs, so all nine comparators can begin matching data. in figure 102 , three ether- net frames are compared against the nine available patterns. note: the bcm57xx family only supports one pattern stream at gigabit wire speed, so the length field will always be the largest pattern size. www.datasheet.in bcm57xx programmer?s guide 01/29/08 broadcom corporation page 272 wake-on lan mode/low-power document 57xx-pg105-r figure 102: comparing ethernet frames against available patterns (10/100 ethernet wol) a0,a1,a2,a3,a4,a5 c0, c1,c2,c3 b0, b1, b2, b3, b4, b5 c0 s1 s2 s3 c0 s4 s5 s6 c0 s7 s8 s9 nine pattern streams for simultaneouswol compare acpi length field is the max pattern size 10/100 ethernet wol acpi offset field acpi mbuf pointer register length control acpi length offset register offset skip a0, a1 a2,a3 a4,a5 patterns base addr/8 b0, b1 b2, b3 b4, b5 c0, c1 00,00 c2, c3 skip skip stream 1 stream 2 frame 0 frame 1 frame 2 stream 3 www.datasheet.in programmer?s guide bcm57xx 01/29/08 broadcom corporation document 57xx-pg105-r wake-on lan mode/low-power page 273 pattern data structure the maximum number of entries in either 10/100 or 1000 mode is 128. the bcm57xx family cannot process a pattern that requires more than 128 entries. the size of an entry will vary based on 10/100 or 1000 mbps mode. additionally, all unused rows must be initialized with zeros. the wol hardware cannot process an entry unless unused rows and rules have been zeroed out (see figure 103 ). figure 103: unused rows and rules must be initialized with zeros frame patterns are stored as data structures in memory. a control word is always present in a 64 bit entry/row. the control word describes proceeding data fields in the entry. in 10/100 mbps mode, one wol entry requires three 64-bit wide rows (see table 117 ). the total length of an entry is 192 bits. each 64-bit row contains a 16-bit control word, which identifies byte enables (see table 118 ). the remaining 48-bits contains 2-byte rules. the 2-byte rules are distributed across three streams: s, s+1, and s+2. the next row?s 2-byte rules will correspond to three more streams: s+3, s+4, and s+5. both table 117 and table 118 use sx notation to denote separate comparison streams. the d0 notation indicates the first 2 bytes in the packet stream are compared. table 117: 10/100 mbps mode frame patterns memory 63 48 47 32 31 16 15 0 ctrl012 s0d0 s1d0 s2d0 ctrl345 s3d0 s4d0 s5d0 ctrl678 s6d0 s7d0 s8d0 used 00,00 00,00 00,00 00,00 00,00 00,00 control stream 1 stream 2 stream 3 00,00 00,00 unused rules are initialized with 0 www.datasheet.in bcm57xx programmer?s guide 01/29/08 broadcom corporation page 274 wake-on lan mode/low-power document 57xx-pg105-r table 119 shows an example of how 10/100 mbps frame data is split up in the pattern data structure. nine streams are compared simultaneously with three 64-bit rows comprising one wol entry. rows 0-2 compare frame data0 against the first 2 bytes of nine streams. rows 3-5 compare frame data1 against the next 2 bytes of nine pattern streams. rows 6-9 compare data2 against the last 2 bytes of nine pattern streams. the nine rules of each wol entry (three 64-bit rows) may be uniquely defined. table 118: frame control field for 10/100 mbps mode bits field description access 63-62 reserved 61 s0 high byte enable enable s0 higher byte for comparison r/w 60 s0 low byte enable enable s0 lower byte for comparison r/w 59 s1 high byte enable enable s1 higher byte for comparison r/w 58 s1 low byte enable enable s1 lower byte for comparison r/w 57 s2 high byte enable enable s2 higher byte for comparison r/w 56 s2 low byte enable enable s2 lower byte for comparison r/w 55-51 reserved 50 s0 done end of s0 stream r/w 49 s1 done end of s1 stream r/w 48 s2 done end of s2 stream r/w table 119: example of splitting 10/100 mbps frame data in pattern data structure data[63:48] data[47:32] data[31:16] data[15:0] control bits stream 0 data 0 stream 1 data 0 stream 2 data 0 control bits stream 3 data 0 stream 4 data 0 stream 5 data 0 control bits stream 6 data 0 stream 7 data 0 stream 8 data 0 control bits stream 0 data 1 stream 1 data 1 stream 2 data 1 control bits stream 3 data 1 stream 4 data 1 stream 5 data 1 control bits stream 6 data 1 stream 7 data 1 stream 8 data 1 control bits stream 0 data 2 stream 1 data 2 stream 2 data 2 control bits stream 3 data 2 stream 4 data 2 stream 5 data 2 control bits stream 6 data 2 stream 7 data 2 stream 8 data 2 www.datasheet.in programmer?s guide bcm57xx 01/29/08 broadcom corporation document 57xx-pg105-r wake-on lan mode/low-power page 275 firmware mailbox when the bcm57xx family initializes (the firmware bootcode is loaded from nvram when the chip powers on or when reset completes), the bcm57xx firmware bootcode checks the t3_firmware_mailbox in shared memory. when the t3_magic_num signature (0x4b455654) is present, the bootcode does not issue a hard reset to the phy. this is especially important in wol mode since the phy should not be reset. before the host software issues a reset to the bcm57xx, it must write the t3_magic_num to the shared memory address t3_firmware_mailbox (0xb50). this address is a software mailbox, which bootcode polls before it resets the phy. the bootcode will acknowledge the signature by writing the one?s complement of the t3_magic_num back into the t3_firmware_mailbox. if the t3_magic_num is present, the bootcode will not reset the phy. after resetting the bcm57xx, host software should poll for the one?s complement of the t3_magic_num before it proceeds, otherwise, bootcode initialization may interfere with the host software initialization. if the host software will be controlling the wol configuration, it should write the drv_wol_signature (0x474c0000) to the shared memory address drv_wol_mailbox (0xd30) so that the bootcode will not take over the wol initialization. if the drv_wol_signature is not present, and wol has been enabled, the bootcode will assume that the host software is a legacy driver and skip the wol initialization. if wol is disabled, the bootcode will take over the wol initialization base d on the nvram configuration. bcm5401 auto-negotiation the bcm5401 phy and bcm57xx integrated phy cores should be configured to auto-negotiate for a 10 mbps connection (see table 121 ). this step is required if the nic needs to be placed into a d3 cold state. half- or full-duplex operation is acceptable. software must modify auto-advertise configurations in the bcm5401?s mdi registers. the link partner will read advertisement settings to find a highest common capability. since wol requires 10 mbps wire speed, the two phys will effectively auto-negotiate for half- or full-duplex connection (see ?1000base-x auto-negotiation? on page 245 for a detailed discussion on auto-negotiation). table 120: firmware mailbox initialization name address recommended value t3_firmware_mailbox 0x0b50 0x4b455654 drv_wol_mailbox 0xd30 0x474c0000 table 121: recommended settings for phy auto-negotiation register bit recommended value auto_negotation_advertisement 10_base_tx_half_duplex enable auto_negotation_advertisement 10_base_tx_full_duplex enable auto_negotation_advertisement 100_base_tx_half_duplex disable auto_negotation_advertisement 100_base_tx_full_duplex disable 1000base-t_control 1000_base_tx_half_duplex disable 1000base-t_control 1000_base_tx_full_duplex disable www.datasheet.in bcm57xx programmer?s guide 01/29/08 broadcom corporation page 276 wake-on lan mode/low-power document 57xx-pg105-r bcm5401 power management (bcm5700 only) configurations for wol mode are listed in table 122 . bcm57xx power management the clocking inputs need to be modified for wol mode (see table 123 ). the rx and tx cpu are not required during wol operation, so their clocks can be disabled. the mac has an internal phase-locked loop that clocks internal logic at 133 mhz. software must select an alternate clocking source and then disable this pll. the settings shown in table 124 enable magic packet detection logic in the mac. these setting also enable the mac to assert pme on the pci bus. the rx mac should maintain the multicast and broadcast settings that were previously config- ured by the nos. the microsoft power management specification states: ?only a frame that passes the device?s mac, broadcast, or mu lticast address filter and matches on the previously loaded sample patterns will cause the wake-up signal to be asserted.? the acpi_power-on bit needs to be set for pattern match, but not for magic packet recognition. the magic packet detection mechanism is separate from the pattern match mechanism. host software may configure wol using four filter permutations: ? pattern match wol disabled. magic packet disabled. ? pattern match wol enabled. magic packet disabled. ? pattern match wol disabled. magic packet enabled. ? pattern match wol enabled. magic packet enabled. table 122: wol mode configuration register bit recommended value auxilary_control wake_on_lan enable table 123: wol mode clock inputs register bit recommended value pci clock_control tx risc_clock_disable enable pci clock_control rx risc_clock_disable enable pci clock_control select_alternate_clock enable pci clock_control pll133 enable table 124: magic packet detection logic enable register bit(s) recommended value pci power_management_control/status pme_enable enable pci power_management_control/status power_state 0x03 ethernet_mac_mode acpi_power-on see above ethernet_mac_mode magic_packet_detection see above www.datasheet.in programmer?s guide bcm57xx 01/29/08 broadcom corporation document 57xx-pg105-r wake-on lan mode/low-power page 277 r egister q uick c ross r eference bcm5401 and bcm57xx integrated phys table 125 lists the wol mode control registers in the bcm5401 and bcm57xx integrated phys. table 125: phy wol mode control registers mdi register bit(s) name description cross reference auto_negotation _advertisement 10_base_tx_half_ duplex advertise to link partner that local phy is capable of 10 mbps half-duplex operation. see bcm5401 data sheet or ?auto-negotiation advertisement register (phy_addr = 0x1, reg_addr = 04h)? on page 608 . 10_base_tx_full_ duplex advertise to link partner that local phy is capable of 10 mbps full-duplex operation. 100_base_tx_half_ duplex advertise to link partner that local phy is capable of 100 mbps half-duplex operation. 100_base_tx_full_ duplex advertise to link partner that local phy is capable of 100 mbps full-duplex operation. 1000base- t_control 1000_base_tx_half_ duplex advertise to link partner that local phy is capable of 1000 mbps half-duplex operation. see bcm5401 data sheet or ?1000base-t control register (phy_addr = 0x1, reg_addr = 09h)? on page 615 . 1000_base_tx_full_ duplex advertise to link partner that local phy is capable of 1000 mbps full-duplex operation. auxilary_control wake_on_lan enable wake on lan capability with low-power consumption. see bcm5401 data sheet or ?auxiliary control register (phy_addr = 0x1, reg_addr = 18h, shadow = 000, normal)? on page 645 . www.datasheet.in bcm57xx programmer?s guide 01/29/08 broadcom corporation page 278 wake-on lan mode/low-power document 57xx-pg105-r integrated macs table 126 lists the wol mode control registers in the bcm57xx integrated macs. table 126: integrated mac wol mode control registers register bit(s) name description cross reference wol_pattern_ pointer all this register points to an internal memory location. programmers should calculate pointer value by dividing a base address by 8. see ?wol pattern pointer register (offset 0x430)? on page 385 . wol_pattern_ configuration length the number of memory arbiter clock cycles needed to read x bytes in the rx stream/frame. see ?wol pattern configuration register (offset 0x434)? on page 386 . offset the number of bytes into the rx stream/frame to begin the pattern comparison. ethernet_mac_ mode port_mode this bit field specifies the type of interface the bcm57xx port is currently using: mii, gmii, tbi, or none. see ?ethernet mac mode register (offset 0x400)? on page 377 . link_polarity flip polarity of link inputs. magic_packet_ detection enable wol pattern filtering. promiscuous_mode all frames are forwarded, without any filtering, when this bit is enabled. pci clock_control tx risc_clock_disable disable the clock to the transmit cpu. see ?pci clock control register (offset 0x74)? on page 334 . rx risc_clock_disable disable the clock to the receive cpu. alternate_clock_source use an alternate clock as a reference, rather than the pll 133. pll133 disable the 133-mhz phase-locked loop. misc local control misc_pin_0_output gpio pin 0. see ?miscellaneous local control register (offset 0x6808)? on page 507 . misc_pin_0_output_ enable when asserted, mac drives pin output. misc_pin_1_output gpio pin 1. misc_pin_1_output_ enable when asserted, mac drives pin output. misc_pin_2_output gpio pin 2. misc_pin_2_output_ enable when asserted, mac drives pin output. power management control/status pme_enable enable the bcm57xx family to assert pme on pci bus. see ?power management control/status register (offset 0x4c)? on page 318 . power_state set the acpi power state: d0, d3. www.datasheet.in programmer?s guide bcm57xx 01/29/08 broadcom corporation document 57xx-pg105-r wake-on lan mode/low-power page 279 wol d ata f low d iagram the bcm57xx family and phy are both configured for wol mode. the process is as follows: 1. clear the pme_status bit in the ?pmcsr-bse register (offset 0x4e)? on page 318 . this bit must be cleared, so the pme interrupt is not immediately generated once the nic is moved to the d3 state. the bit could be asserted from a previous d3-d0 transition. 2. set the mask_pci_interrupt_output bit in the miscellaneous_host_control register (see ?miscellaneous host control register (offset 0x68)? on page 325 ). this bit should be set, so the bcm57xx family does not generate interrupts during the wol configuration of the phy. the device driver?s isr may attempt to reset and reconfigure the phy as part of an error recovery code path. 3. if host software needs to place the nic into d3 cold state, the following step is necessary. set the 10_base_tx_half_duplex and 10_base_tx_full_duplex capability bits, in the ?auto-negotiation advertisement register (phy_addr = 0x1, reg_addr = 04h)? on page 608 . clear the 100_base_tx_full_half_duplex and 100_base_tx_full_duplex capability bits, in the ?auto-negotiation advertisement register (phy_addr = 0x1, reg_addr = 04h)? on page 608 . clear the 1000_base_tx_half_duplex and 1000_base_tx_full_duplex capability bits, in the ?1000base-t control register (phy_addr = 0x1, reg_addr = 09h)? on page 615 . the bcm5401?s link partner will now only be able to auto-negotiate for 10 mbps speed full/half-duplex. 4. set the restart_auto_negotiation bit in the ?mii control register (phy_addr = 0x1, reg_addr = 00h)? on page 604 . the integrated phy and link partner will now reconfigure for 10 mbps wire speed. essentially, 10 mbps link must be auto- negotiated or forced. 5. disable the fhde, rde, tde bits of the ?ethernet mac mode register (offset 0x400)? on page 377 ?, and on-chip riscs. 6. host software must write the signature 0x4b455654 to internal memory address 0x0b50. check for one?s complement of 0x4b455654 7. enable the wake_on_lan bit in the ?auxiliary control register (phy_addr = 0x1, reg_addr = 18h, shadow = 010, power control)? on page 651 . 8. for interesting packet wol only: set up the interesting packet pattern in bcm57xx device local memory. 9. for interesting packet wol only: write a pointer value to the ?wol pattern pointer register (offset 0x430)? on page 385 . this register uses a normalized pointer value, not a device base address. the value written to this register is bcm5700_base_addr/8. the base address must be a specific location in local memory: 0x8000, 0xc000, or 0xd000. the choice of memory location depends upon other mac configurations, and the selection is not arbitrary. 10. for interesting packet wol only: write the offset field in the ?wol pattern configuration register (offset 0x434)? on page 386 . the wol pattern checker will position into received frames on two-byte intervals. the pattern checker compares two bytes in parallel, so host software should program the offset field accordingly. host software may perceive this unit as offset_byte/2 units. 11. for interesting packet wol only: write the length field in the ?wol pattern configuration register (offset 0x434)? on page 386 . the length value is specified in terms of memory arbiter clock cycles, not bytes/words/dwords. a comprehensive discussion of how the clock cycles are calculated will be presented. 12. set the port_mode field in the ?ethernet mac mode register (offset 0x400)? on page 377 to gmii mode. these bits enable the gmii between the bcm57xx family and the bcm5401 physical layer. enable the link_polarity bit in the ?ethernet mac mode register (offset 0x400)? on page 377 . this bit will set the polarity of the lnkrdy signal between the physical layer and mac. on the bcm57xx reference nic, lnkrdy is tied to the 10 mbps active low signal routed from the bcm5401 phy. host software should set this bit, so the mac may detect 10mpbs link. 13. for interesting packet wol only: enable the acpi_power-on bit in the ?ethernet mac mode register (offset 0x400)? on page 377 . this bit will enable logic for d3 hot/cold transitions to d0 acpi state. the mac will also be capable of asserting pme on the pci bus. 14. for magic packet wol only: enable the magic_packet_detection bit in the ?ethernet mac mode register (offset 0x400)? on page 377 . the wol logic will compare rx frames for magic packet patterns. www.datasheet.in bcm57xx programmer?s guide 01/29/08 broadcom corporation page 280 flow control document 57xx-pg105-r 15. set the rx risc_clock_disable bit in the pci clock_control register (see ?pci clock control register (offset 0x74)? on page 334 ). the receive cpu will be stopped, and the clocking circuitry disabled. set the tx risc_clock_disable bit in the ?pci clock control register (offset 0x74)? on page 334 . the transmit cpu will be stopped and the clocking circuitry disabled. 16. set the enable_alternate_clock bit in the pci clock_control register (see ?pci clock control register (offset 0x74)? on page 334 ). the bcm57xx family?s 133 mhz phase locked loop (pll) no longer clocks internal logic and an alternate clock reference is used. set the pll lowpowerclock bit while keeping the enable_alternate_clock bit set. wait at least 27 s and then clear the enable_alternate_clock bit. the bcm57xx family?s pll will be switched to its lower power consumption mode. 17. in nic applications, switch from vmain to vaux in order to prevent a grc reset. set the required gpios of bcm57xx if any of them are used for switching the power from vmain to vaux. 18. enable the rx mac by setting the enable bit of ?receive mac mode register (offset 0x468)? on page 391 ? and put it in promiscuous mode by setting the promiscuous mode bit of ?receive mac mode register (offset 0x468)? on page 391 ?. 19. enable the pme bit in the pci ?pmcsr-bse register (offset 0x4e)? on page 318 . set the power_state bits to d3 in the ?pmcsr-bse register (offset 0x4e)? on page 318 . f low c ontrol d escription the bcm57xx family supports ieee 802.3x flow control. flow control is a switched ethernet capability, where link partners may pause traffic. 802.3x flow control specifies that a mac sublayer may transmit pause frames. the pause frames instruct the mac?s link partner to wait a specified amount of time, before sending additional frames. this delay provides the mac time to free packet buffers. conversely, the mac sublayer must also accept/receive pause frames. flow control is used by switches and bridges to prevent clients of dissimilar speeds from exhausting switching packet buffers. clients and servers may use flow control for similar reasons. a very important requirement is that both link partners must share a full-duplex connection for flow control to be enabled. 802.3x flow control does not operate on a half-duplex connection. more information on flow control can be found in appendix a ?flow control? on page 703 . the following architectural blocks are integral to flow control: ? tr a n s m i t m ac ? receive mac ? statistics block ? phy auto-negotiation ? phy auto-advertise www.datasheet.in programmer?s guide bcm57xx 01/29/08 broadcom corporation document 57xx-pg105-r flow control page 281 o perational c haracteristics the bcm57xx family implements pause functionality using xon and xoff states. the mac will extract a pause quantum from a pause control frame. then, the mac will configure its inter nal timer with the pause_time specified by the link partner. frames that are currently in the transmit engine will be co mpleted before the transmit engine is inhibited. the mac has moved flow control into a xoff state once the transmit engine is inhibited. note that the transmit engine is not completely disabled since the ieee 802.3 specification stipulates that mac control frames should not be paused. one of the following conditions will move the bcm57xx family into a xon state: ? link partner sends a pause frame with pause_time = 0. ? internal pause timer expires. transmit mac the transmit mac is responsible for sending flow control frames. software enables the transmit mac to send flow control frames by setting the enable_flow_control bi t in the transmit_mac_mode register (see ?transmit mac mode register (offset 0x45c)? on page 390 ). when software clears the enable_flow_control bit, the transmit mac will not generate flow control frames. the mac_rx_mbuf_low_water_mark register value (see ?mac rx mbuf low watermark register (offset 0x4414)? on page 470 ) triggers pause frames to be transmitted when a threshold value is passed. software may alter the watermark to tune system performance. the watermark recommendation in table 127 assumes no external ssram. as soon as pause frame is transmitted, any incoming packet can be dropped, and the ifindiscard counter in statistics (see ?interface statistics? on page 108 ) will increase. when packet size is small (64 bytes) with 1000 mbps, more frames can be dropped. even if the pause frame is transmitted, pause frames cannot inhibit mac control frames. low water mark maximum receive frames register (see ?low watermark maximum receive frames register (offset 0x504)? on page 394 ) control the number of good frames to receive after the rx mbuf low water mark has been reached. after the rx mac receives this number of frames, it will drop subsequent incoming frames until the mbuf high water mark is reached. the 802.3 pause control frame contains a pause_time field. the bcm57xx transmit mac will insert a time quanta into the pause_time field. software should set the enable_long_pause bit in the transmit_mac_mode register to configure long pause quanta. clearing the enable_long_pause bit will default the pause_time back to the shorter quanta. table 128 shows the pause quanta based on the enable_long_pause bit setting. table 127: transmit mac watermark recommendation register recommended value mac_rx_mbuf_low_water_mark 24 table 128: pause quanta enable_long_pause bit pause_time disabled (0) 0x1fff enabled (1) 0xffff www.datasheet.in bcm57xx programmer?s guide 01/29/08 broadcom corporation page 282 flow control document 57xx-pg105-r receive mac the bcm57xx receive mac?s link partner may wish to i nhibit frame transmission until upstream resources become available. the receive mac must be configured to accept 802.3x pause frames (see table 129 ). software should set the enable_flow_control bit in the receive_mac_mode_control register to enable automatic processing of flow control frames. if software clears the enable_flow_control bit, 802.3x pause frames will be discarded. the keep_pause bit in the receive_mac_mode_control register will instruct the rx engine to forward pause frames to host memory. software may be interested in setting this bit for debugging or promiscuous/sniffer configurations. passing pause frames to the host will increase dma and protocol processing and consume available host buffers. the receive mac will filter pause control frames when the keep_pause bit is disabled. statistics block the statistic block shown in table 130 is a common data structure. the relationships of flow control statistics are discussed in this section. xon/xoff statistical counters are related to internal bcm57xx flow control states. xon is associated to transm it enabled state and xoff is associated to transmit disabled state. these xon/xoff states are not part of the ieee 802.3 specification; the bcm57xx family uses xon/xoff to manage flow control state and transitions. the xon/xoff statistics provide programmers with a high level of granularity for the measurement of bcm57xx flow control performance in a lan (see appendix a ?flow control? on page 703 ). table 129: keep_pause recommended value register.bit recommended value receive_mac_mode_control.keep_pause disabled table 130: statistic block statistic description xoffstateentered this counter is bumped under the following conditions: 1 802.3 mac flow control pause frame received with valid crc. 2 (pause_time > 0) the link partner requests transmission inhibit. the counter increments independently of the enabled/disabled state of receive_mac_mode_control.flow_enabled. xonpauseframesreceived this counter is incremented under the following conditions: 1 802.3 mac flow control pause frame received with valid crc. 2 (pause_time == 0) the link partner no longer requires the bcm57xx family to pause/ wait/delay outgoing packets. the counter increments independently of the enabled/disabled state of receive_mac_mode_control.flow_enabled. xoffpauseframesreceived this counter is incremented under the following conditions: 1 802.3 mac flow control pause frame received with valid crc. 2 (pause_time > 0) the link partner requires the bcm57xx family to pause/wait/delay outgoing packets. the counter increments independently of the enabled/disabled state of receive_mac_mode_control.flow_enabled. outxon this counter is incremented under the following conditions: 1 transmit_mac_mode_control.flow_enabled bit is set. 2 (mac_rx_mbuf_low_water_mark > threshold value mac resources are available. 3 (pause_time == 0) 802.3 mac flow control frame is sent. www.datasheet.in programmer?s guide bcm57xx 01/29/08 broadcom corporation document 57xx-pg105-r flow control page 283 phy auto-negotiation a full description of software's role in mac auto-negotiation can be found in ?1000base-x auto-negotiation? on page 245 . the phy encodes flow control capability into fast link pulse (flps) bursts. link partners will extract encoded flow control capability from flps and then create a link code word (lcw). the lcw is a message, which contains a selector and technology ability field. the technology ability field contains a bit called pause_operation_for full_duplex_link (a5). refer to annex 28-b of the 802.3 specifications. the a5 bit signifies that a link partner has implemented pause functionality. if bot h link partners support auto-negotiation, they will further exchange data regarding flow control, using the next page bit in the lcw. auto-advertise is integrally tied to auto-negotiation. if link partner does not support pause functionality, the phy auto_negotation_link_partner_ability_register will not have the pause_capable bit set. the bcm57xx family should not send pause frames to this link partner since flow control is not implemented or disabled. the bcm57xx family can still accept pause frames, but sending a pause frame will not yield a desired result. r egister q uick c ross r eference bcm5401 and bcm57xx integrated phys table 131 lists the flow control registers in the bcm5401 and bcm57xx integrated phys. outxoff this counter is incremented under the following conditions: 1 transmit_mac_mode_control.flow_enabled bit is set. 2 (mac_rx_mbuf_low_water_mark < threshold value) mac resources are running low and a pause is desired. 3 (pause_time > 0) 802.3 mac flow control frame is sent. table 131: phy flow control registers mdi register bit(s) name description cross reference mii_status link_status link pass state which indicates if a valid link has been established. bcm5401 data sheet or ?mii status register (phy_addr = 0x1, reg_addr = 01h)? on page 606 mii_auxiliary_status auto_negotation_hcd current operating mode and speed bcm5401 data sheet or ?auxiliary status summary register (phy_addr = 0x1, reg_addr = 19h)? on page 657 auto-negotiation advertisement asymetric_pause advertise to link partner, that asymmetric pause is desired. this bit works in conjunction with pause_capable bit. see bcm5401 data sheet or ?auto-negotiation advertisement register (phy_addr = 0x1, reg_addr = 04h)? on page 608 . pause_capable the pause capable bit indicates whether half/full-duplex pause is advertised. table 130: statistic block (cont.) statistic description www.datasheet.in bcm57xx programmer?s guide 01/29/08 broadcom corporation page 284 flow control document 57xx-pg105-r integrated macs table 132 lists the flow control registers in the bcm57xx integrated macs. auto-negotiation link partner ability asymetric_pause link partner capability?the partner desires asymmetric pause. see bcm5401 data sheet or ?auto-negotiation link partner ability register (phy_addr = 0x1, reg_addr = 05h)? on page 610 . pause_capable link partner capability?the partner is capable of full or half-duplex pause. table 132: integrated mac flow control registers register bit(s) name description cross reference receive mac mode enable_flow_control enable automatic processing of 802.3 flow control frames. see ?receive mac mode register (offset 0x468)? on page 391 . transmit mac mode enable_flow_control enable automatic processing of 802.3 flow control frames. see ?transmit mac mode register (offset 0x45c)? on page 390 . mac_rx_mbuf_l ow_water_mark all 32 bits the number of internal buffers that must be available before the rx engine can accept a frame from the wire. threshold value for initiating flow control see ?mac rx mbuf low watermark register (offset 0x4414)? on page 470 . table 131: phy flow control registers (cont.) mdi register bit(s) name description cross reference www.datasheet.in programmer?s guide bcm57xx 01/29/08 broadcom corporation document 57xx-pg105-r flow control page 285 f low c ontrol i nitialization p seudocode //check the link state if (mii_status_reg.link_status == true) then { //check phy status register for full-duplex configuration if (mii_aux_status_reg.auto_neg_hcd == (1000_full_duplex or 100_full_duplex or 10_full_duplex) ) then { //check if user has forced either auto-negotiation or auto-advertise if ( (driver_auto_neg_variable == enabled) and (driver_auto_advertise_variable != forced_speed_duplex )) then { // probe phy control registers for advertised flow control info // expected abilities should match the configured abilities. expected abilities // are based on the ieee 803.3ab flow control subsection. if ( (auto_neg_advertise_reg.asymetric_pause != 802.3ab_table_28b-3 ) and (auto_neg_advertise_reg.pause_capable != 802.3ab_table_28b-3 ) ) then { //the current advertised state does not match 802.3 specifications driver_ link__link_state = link_status_down } else { if (auto_neg_advertise_reg.pause_capable == enabled) { if ( auto_neg_advertise_reg.asymetric_pause == enabled) ) then { if (auto_neg_link_partner_ability_reg.pause_capable == enabled) then { driver_flow_capability = flow_control_transmit_pause \ | flow_control_receive_pause } else if (auto_neg_link_partner_ability_reg.asymetric_pause == \ enabled) then { driver_flow_capability = flow_control_receive_pause } else { driver_flow_capability = none } } //the local physical layer was not configured to advertise asymmetric pause else { if (auto_neg_link_partner_ability_reg.pause_capable == enabled) then { driver_flow_capability = flow_control_transmit_pause \ | flow_control_receive_pause } else { www.datasheet.in bcm57xx programmer?s guide 01/29/08 broadcom corporation page 286 flow control document 57xx-pg105-r driver_flow_capability = none } } } // the local physical layer was not configured to advertise pause capability else if (auto_neg_advertise_reg.asymetric_pause == enabled) then { if (auto_neg_link_partner_ability_reg.pause_capable == enabled) then { driver_flow_capability = flow_control_transmit_pause } else { driver_flow_capability = none } } } //link status is up } // auto negotiation was not disabled && speed duplex was not forced else { // the use forced speed/duplex, so the partner's flow control capabilities are // indeterminate - software cannot use the link_partner_abitity // registers. driver_flow_capability= disabled } } //the current link is full-duplex at 10/100/1000 wire speeds else { //full-duplex mode is not available or forced half-duplex //flow control is not available in half-duplex mode. driver_flow_capability = none } //configure mac flow control registers if ( driver_flow_capability & flow_control_receive_pause ) { receive_mac_mode_control_register.enable_flow_control = enabled } if ( driver_flow_capability & flow_control_transmit_pause ) then { transmit_mac_mode_control_register.enable_flow_control = enabled } } // link is up on the local phy www.datasheet.in programmer?s guide bcm57xx 01/29/08 broadcom corporation document 57xx-pg105-r interrupt processing page 287 section 11: interrupt processing h ost c oalescing it is well known that interrupt coalescing (or interrupt moderation) is a common technique that can be used by nic vendors to increase the performance of nic. some high-level descriptions of the benefits of interrupt coalescing can be found at: ? http://www.microsoft.com/hwdev/devdes/optinic.htm ? http://support.microsoft.com/support/kb/articles/q170/6/43.asp ? http://msdn.microsoft.com/library/books/serverdg/networkadapterrequirements.htm d escription the bcm57xx family supports the concept of host coalescing. host coalescing controls when status information is returned to the host, and when interrupts are generated. the bcm57xx family provides a number of sw configurable registers that control when/how the bcm57xx family updates the host with status information and how often the bcm57xx family asserts an interrupt. when the bcm57xx family has completed transmit or receive events, it will update a status block in host memory. this status block contains information that tells the host which transmit buffers have been dmaed by the nic, and which receive buffer descriptors (bds) have been consumed by a newly arrived received packet. normally, the host will check this status block whenever an interrupt is generated. in addition, the host could also poll the status block to determine whether or not it had been updated by the hardware since the last time the host had read the status block (this is called during interrupt processing). whenever the nic updates the status block, it will make a decision about whether to assert the interrupt line (inta ) or not. the bcm57xx family has special interrupt avoidance mechanisms that allow the host to tell the nic not to generate an interrupt when it writes a status block back to the host. in addition, there are also mechanisms that allow host sw to control when and how often the status block is updated. for instance, the host could configure the nic to only update status block after it receives two packets, as opposed to one packet. these mechanisms are documented in more detail below. o perational c haracteristics the bcm57xx family dmas the status block (see ?status block base address register (offset 0x3c44)? on page 457 ) to host memory before a line interrupt or msi is generated. the host isr reads the update bit at the top of the status block and checks whether this bit is set to 1 or not. when set to 1, the updated bit of status block indicates the host that the status b lock has been refreshed by the mac. the isr must then write to clear/de-assert this bit to dirty the status block, and then the isr may proceed to read the updated producer/consumer index pointers. this mechanism allows host system software to determine if the status block has been updated. due to various asynchronous timing issues (dependent upon platform) the isr may occasionally see stale data. the isr may either spin and wait for the status block dma to complete and explicitly flush the status block or just wait for the next line interrupt. www.datasheet.in bcm57xx programmer?s guide 01/29/08 broadcom corporation page 288 host coalescing document 57xx-pg105-r r egisters the bcm57xx family supports a variety of registers that affect status block updates and interrupt generation (see table 133 ). each bcm57xx data sheet defines the register layout and bit fields; however, software requires a robust description of the register functionality. table 133: interrupt-related registers register cross reference miscellaneous host control register. the two bits of this register that are related to interrupts are: ? mask pci interrupt output (aka mask interrupt) bit ? clear interrupt inta bit see ?miscellaneous host control register (offset 0x68)? on page 325 . miscellaneous local control register. the two bits of this register that are related to interrupts are: ? set interrupt bit ? clear interrupt bit see ?miscellaneous local control register (offset 0x6808)? on page 507 . interrupt mailbox 0 register see ?interrupt mailbox 0 register (offset 0x200)? on page 372 for host standard and flat modes and ?interrupt mailbox 0 register (offset 0x5800)? on page 492 for indirect mode. interrupt mailboxes 1-7 register see ?other interrupt mailbox registers (offset 0x208- 0x218)? on page 373 for host standard and flat modes and ?other interrupt mailbox registers (offset 0x5808-0x5818)? on page 492 for indirect mode. receive coalescing ticks register see ?receive coalescing ticks registers (offset 0x3c08)? on page 453 . send coalescing ticks register see ?send coalescing ticks register (offset 0x3c0c)? on page 453 . receive coalescing ticks during interrupt register see ?receive coalescing ticks during interrupt register (offset 0x3c18)? on page 455 . send coalescing ticks during interrupt register see ?send coalescing ticks during interrupt register (offset 0x3c1c)? on page 455 . receive max coalesced bd count register see ?receive max coalesced bd count (offset 0x3c10)? on page 454 . send max coalesced bd count register see ?send max coalesced bd count (offset 0x3c14)? on page 454 . receive max coalesced bd count during interrupt register see ?receive max coalesced bd count during interrupt (offset 0x3c20)? on page 456 . send max coalesced bd count during interrupt register see ?send max coalesced bd count during interrupt (offset 0x3c24)? on page 456 . www.datasheet.in programmer?s guide bcm57xx 01/29/08 broadcom corporation document 57xx-pg105-r msi page 289 msi pci specification 2.2 defines a new mechanism for a device to request services by its device driver. it is called message signaled interrupt (msi). msi will eventually deprecate traditional interrupt mechanism. in msi, device dmas a specified dword data to a specified host address if it needs to request services by its device driver. the msi state machine can be enabled/disabled by setting/resetting the enabl e bit of msi mode register (offset 0x6000). by default, this bit is set to 1 indicating that the msi state machine is enabled. the main advantages of msi generation versus using a traditional interrupt are as follows: ? eliminates the need for interrupt signal trace on the pci device. ? eliminates the need to perform a dummy read from the device by the device driver in its interrupt service routine. this is done to force all posted memory writes to be flushed to the host memory. t raditional i nterrupt s cheme a simplified block diagram showing traditional interrupt scheme is depicted in figure 104 . figure 104: traditional interrupt scheme bcm5700 pci host bridge host memory cpu interrupt interrupt a pci bus host bus bcm57xx family pci host bridge host memory cpu interrupt controller interrupt controller www.datasheet.in bcm57xx programmer?s guide 01/29/08 broadcom corporation page 290 msi document 57xx-pg105-r to clarify second issue in traditional interrupt scheme, an example is given. the bcm57xx family receives one or more packets from the networks. the bcm57xx family does the following: ? dmas data of received packets to the host. ? dmas receive buffer descriptors to receive return ring in the host memory. ? dmas status block to the host memory. ? generates an interrupt to request its device driver for processing. the writes are posted and are actually performed at some later time by the pci host bridge. when interrupt service routine of device driver is executed, the driver reads the status block from the host memory and finds that status block does not contain latest index information if the writes for status block are not performed by the pci host bridge yet. the scheme to resolve this problem is to do a dummy read of the bcm57xx family in the beginning of the interrupt service routine. the dummy read has to traverse the same bridge that memory writes from the bcm57xx family have to traverse to get to the host memory. the ordering rules for bridges dictate that the bridge must flush its posted write buffers before permitting a read to traverse the bridge. as a result, writes for status block are flushed to the host memory by the bridge before dummy read cycle is completed. m essage s ignaled i nterrupt a simplified block diagram showing a possible msi scheme is depicted in figure 105 . figure 105: message-signaled interrupt scheme bcm5700 pci host bridge host memory cpu interrupt controller pci bus host bus interrupt bcm57xx family pci host bridge host memory cpu interrupt controller www.datasheet.in programmer?s guide bcm57xx 01/29/08 broadcom corporation document 57xx-pg105-r msi page 291 similar example in traditional interrupt scheme is used again here to illustrate msi concept. the bcm57xx family receives one or more packets from the networks. the bcm57xx family does the following: ? dmas data of received packets to the host. ? dmas receive buffer descriptors to receive return ring in the host memory. ? dmas status block to the host memory. ? writes specified dword data to specified host address. in this mode, the bcm57xx family writes dword data to specified host address instead of generating an interrupt. the specified data and address are configurable. the specified address is typically a memory-mapped io port within the pci host bridge. the pci host bridge is the gateway to the main memory controller. this means that the dword data write (msi message) to pci host bridge is in the posted write buffers and was posted after the writes for the status block update. it is the rule that pci host bridge must perform posted writes in the same order that they were received. this means that by the time msi message arrives at the pci host bridge, the status block has already been posted to the host memory. upon receipt of the msi message write, the pci host bridge generates the interrupt request to the processor. interrupt service routine of the bcm57xx device driver is invoked. it is not necessary to do a dummy read because updated status block is already in the host memory. pci c onfiguration r egisters operation system/system software can configure the specified dword data and specified 64-bit host address for the device with msi_data (offset 0x64) and msi_address register (offset 0x5c), respectively. msi address this is a 64-bit field. msi address at offset 0x5c and 0x60 should be programmed with the low-order and high-order bits of the 64-bit physical address. if the host only supports 32-bit physical address, the high-order address should be programmed with zeros. msi data this is a 16-bit field. the least significant three bits can be modified by the bcm57xx family when it writes msi message to host. the dword data for the msi message is depicted as shown in figure 106 . figure 106: msi data field the bcm57xx family can support up to eight message types, and these msi messages can be generated by two sources: host coalescing engine or firmware. all 0?s 16-bit msi_data 31 16 15 0 the bcm5700 mac can only modify the three lsbs all zeros 16-bit msi_data www.datasheet.in bcm57xx programmer?s guide 01/29/08 broadcom corporation page 292 msi document 57xx-pg105-r h ost c oalescing e ngine after the host coalescing engine updates the status block on the host (due to receive indication, transmit completion, and so on), it either generates an interrupt or writes a msi mess age if msi is enabled. the least significant 3-bit of the msi message originating from host coalescing block is configurable and can be configured by programming bits 4, 5, and 6 of the host_coalesing_mode register. the default of these bits is zeros. f irmware the bcm57xx family provides a way for firmware executed by rx risc or tx risc to generate msi messages. firmware can generate msi messages by using msi_fifo_access regist er (offset 0x6008). for example, if firmware wants to generate an msi message with least significant 3-bit as 0x2, it will write 2 to msi_fifo_access register. it also needs to verify that the msi message is written successfully by reading back msi_fifo_access overflow. if this bit is zero, then the msi message is encoded successfully and will be sent to host. otherwise, the message is not encoded. www.datasheet.in programmer?s guide bcm57xx 01/29/08 broadcom corporation document 57xx-pg105-r basic driver interrupt processing flow page 293 b asic d river i nterrupt p rocessing f low f lowchart for s ervicing an i nterrupt the following figure shows the basic bcm57xx driver interrupt service routine flow. figure 107: basic driver interrupt service routine flow is the "updated bit" set in the status block? driver reads the "status word" field in the 570x's "status block" (located in host memory) no yes nic encounters an interrupt event and asserts in inta# line to interrupt host host os receives interrupt and calls nic driver's isr tell the os "not my interrupt", and return (this is important for interrupt- sharing environments) driver claims the interrupt and schedules a callback to handle the interrupt processing (many oses due this via a lower priority thread). allternatively, the driver could directl y invoke the interrupt processing code. driver writes a value of '"1" into the 570x's interrupt mailbox 0 register. while this register contains a nonzero value, it prevents future interrupt assertions from the 570x. driver clears the "updated" bit in the status block. process any link status change events. process any received packets (receive interrupts). process any completed transmits (transmit interrupts). read the, is the "updated bit" set in the status block? no yes read interrupt mailbox 0 in order to flush any posted writes in the pci chipset. enable interrupts by writing the interrupt mailbox 0 register to '0'. no more work to do. exit the dpc there is more work to do. force an interrupt by setting bit 2 in the misc local control regsiter (offset 0x6808) dpc code isr code www.datasheet.in bcm57xx programmer?s guide 01/29/08 broadcom corporation page 294 basic driver interrupt processing flow document 57xx-pg105-r i nterrupt p rocedure (bcm5700 o nly ) 1. acknowledge interrupt. write a nonzero value (i.e., value = 1) to the interrupt mailbox 0 (see ?interrupt mailbox 0 register (offset 0x200)? on page 372 for host standard and flat modes and ?interrupt mailbox 0 register (offset 0x5800)? on page 492 for indirect mode) to indicate that the driver is currently processing the interrupt. this step disables device interrupts except during interrupt feature. 2. claim interrupt. determine if bcm57xx action required. read the updated bit of the status word (see table 40 on page 106 ). if bit is asserted, then the host coalescing engine has updated the status block. 3. clear the updated bit of the status word (see table 40 on page 106 ). this indicates that the host driver either has or will touch the status block. if a during interrupt event is driven, the host driver can examine the updated bit to determine if a fresh status block has been moved to host memory space. 4. check for rx traffic. ? loop through enabled rx return rings (1 to 16). ? check for difference between rx return ring producer index (status block) and rx return ring consumer index (value written to mailbox on previous call) are the number of frames to process for rx return ring. ? process the packet. ? update the rx return ring consumer pointer in each mailbox for new rx frames. 5. check for tx completes. ? loop through enabled tx send rings. ? check for difference between previous consumer index (software kept) and current consumer index in the status block. these are the tx bds which can be made available to next send operation. ? update the previous consumer index (i.e., next call) to the value of the status block consumer index. 6. check the error bit in status word (optional, see table 40 on page 106 ). the driver may check the state machine/ftq status registers for various attentions. 7 enable interrupts. write a zero value (i.e., value = 0) to the interrupt mailbox 0 (see ?interrupt mailbox 0 register (offset 0x200)? on page 372 for host standard and flat modes and ?interrupt mailbox 0 register (offset 0x5800)? on page 492 for indirect mode) to indicate that the isr is done processing rx/tx. if running in indirect mode, it is also necessary to set the clear interrupt bit. 8 flush status block (i.e. force update of status blocks cached by pci bridge). ? read interrupt mailbox (see ?interrupt mailbox 0 register (offset 0x200)? on page 372 for host standard and flat modes and ?interrupt mailbox 0 register (offset 0x5800)? on page 492 for indirect mode). ? check the updated bit in the status word (see table 40 on page 106 ) located in the status block. if the updated bit is asserted, force a new interrupt by setting set interrupt bit of the miscellaneous local control register (see ?miscellaneous local control register (offset 0x6808)? on page 507 ). note: broadcom bootcode may place the rx and tx riscs in a halted state upon firmware completion. the halted state will assert the error bit, since a rxcp_attn and txcp_attn is generated. the host device driver will usually read the asserted error bit, during the normal operation of the controller. www.datasheet.in programmer?s guide bcm57xx 01/29/08 broadcom corporation document 57xx-pg105-r basic driver interrupt processing flow page 295 i nterrupt p rocedure (bcm5701 and l ater ) 1. acknowledge interrupt. write a nonzero value (i.e., value = 1) to the interrupt mailbox 0 (see ?interrupt mailbox 0 register (offset 0x200)? on page 372 for host standard and flat modes and ?interrupt mailbox 0 register (offset 0x5800)? on page 492 for indirect mode) to indicate that the driver is currently processing the interrupt. this step disables device interrupts except during interrupt feature. 2. read and save the value of the status tag field of the status block (see table 39 on page 105 ). 3. claim interrupt. determine if bcm57xx action required. read the updated bit of the status word (see table 40 on page 106 ). if the updated bit is asserted, then the host coalescing engine has updated the status block. 4. clear the updated bit of the status word (see table 40 on page 106 ). this indicates that the host driver either has or will touch the status block. if a during interrupt event is driven, the host driver can examine the updated bit to determine if a fresh status block has been moved to host memory space. 5. check for rx traffic. ? loop through enabled rx return rings (1 to 16). ? check for difference between rx return ring producer index (status block) and rx return ring consumer index (value written to mailbox on previous call) are the number of frames to process for rx return ring. ? process the packet. ? update the rx return ring consumer pointer in each mailbox for new rx frames. 6. check for tx completes. ? loop through enabled tx send rings. ? check for difference between previous consumer index (software kept) and current consumer index in the status block. these are the tx bds which can be made available to next send operation. ? update the previous consumer index (i.e., next call) to the value of the status block consumer index. 7. compare the current value of the status tag to the saved value of the status tag. flush status block (i.e., force update of status blocks cached by pci bridge). ? read interrupt mailbox (see ?interrupt mailbox 0 register (offset 0x200)? on page 372 for host standard and flat modes and ?interrupt mailbox 0 register (offset 0x5800)? on page 492 for indirect mode). ? check the updated bit in the status word (see table 40 on page 106 ) located in the status block. if the updated bit is asserted, then new data has been dmaed to the host. repeat steps 5 and 6. 8. check the error bit in status word (optional, see table 40 on page 106 ). the driver may check the state machine/ftq status registers for various attentions. 9. enable interrupts. write the saved status tag to the upper 8 bits of interrupt mailbox 0 (see ?interrupt mailbox 0 register (offset 0x200)? on page 372 for host standard and flat modes and ?interrupt mailbox 0 register (offset 0x5800)? on page 492 for indirect mode), and 0 to the remaining bits (23 down to 0) to indicate that the isr is done processing rx/ tx. this also clears existing interrupts. www.datasheet.in bcm57xx programmer?s guide 01/29/08 broadcom corporation page 296 interrupt processing (not applicable to bcm5700) document 57xx-pg105-r i nterrupt p rocessing (n ot a pplicable to bcm5700) the bcm5701 implements legacy support of the bcm5700 revision c0 interrupt mode plus five other optional modes. each mode can be enabled individually. b roadcom m ask m ode enabled by setting the mask_interrupt_mode bit (bit 8) of the miscellaneous host control register (see ?miscellaneous host control register (offset 0x68)? on page 325 ). when enabled, setting the mask bit of the miscellaneous host control register will mask (de-assert) the inta_l signal at the pin, but it will not clear the interrupt state and it will not latch the inta_l value. clearing the mask bit will enable the interrupt state to propagate to the inta_l signal. when the mask_interrupt_mode bit is cleared (by default), the mask_interrupt_mode bit will behave in the same manner as the bcm5700 revision c0. it should be noted that for the bcm5700 mac, when the mailbox 0 is nonzero or the mask interrupt bit is set, the during interrupt coalescing counters and timers are used for interrupt generation; but for the rest of the bcm57xx family, the during interrupt counters are only used when the mailbox 0 is set. b roadcom t agged s tatus m ode enabled by setting the status tagged status mode bit of the miscellaneous host control register (see ?miscellaneous host control register (offset 0x68)? on page 325 ). when enabled, a unique eight-bit tag value will be inserted into the status block status tag at location 7:0. the status tag can be returned to the mailbox 0 register at location 31:24 by the host driver . when the mailbox 0 register field 23:0 is written with a zero value, the tag field of the mailbox 0 register is compared with the tag field of the last status block to be dma'd to the host. if the tag returned is not equivalent to the tag of the first s tatus block dma'd, the interrupt status is entered. c lear t icks on bd e vents m ode enabled by setting the clear ticks mode on rx or the clear ticks mode on tx bits of the host coalescing mode register (see ?host coalescing mode register (offset 0x3c00)? on page 452 ). when enabled, the counters initialize to the idle state and begin counting only after a receive or transmit bd event is detected. the receive host coalescing tick counter ( ?receive coalescing ticks registers (offset 0x3c08)? on page 453 ) is reset when a receive bd event has caused the status block update, and the send host coalescing tick counter (see ?send coalescing ticks register (offset 0x3c0c)? on page 453 ) is reset when a send bd event has caused a status block update. additionally, the host coalescing ticks counters are reset when a buffer descriptor has been handled by the send data initiator state machine on the send side, or the receive data completion state machine has returned a buffer descriptor on the receive side for the send and receive ticks counters respectively. when disabled, the ticks counters behave as defined for the bcm5700 mac. n o i nterrupt on f orce u pdate enabled by setting the no interrupt on force bit of the host coalescing mode register (see ?host coalescing mode register (offset 0x3c00)? on page 452 ). when enabled, writing the force update bit of the host coalescing mode register will cause a status update without a corresponding interrupt event. www.datasheet.in programmer?s guide bcm57xx 01/29/08 broadcom corporation document 57xx-pg105-r interrupt processing (not applicable to bcm5700) page 297 n o i nterrupt on dmad f orce enabled by setting the no interrupt on dmad force bit of the host coalescing mode register (see ?host coalescing mode register (offset 0x3c00)? on page 452 ). when enabled, the bd_flag_coal_now bit of the buffer descriptor may be set to force a status block update without a corresponding interrupt. www.datasheet.in bcm57xx programmer?s guide 01/29/08 broadcom corporation page 298 register definitions document 57xx-pg105-r section 12: register definitions pci c onfiguration r egisters the following describes the registers required for configuration by the pci, pci-x, and pcie specifications. access to these registers can be obtained through either the pci configuration address space, or through the shared-memory region of the bcm57xx family. some registers must be defined as read-only in the pci configuration address space, but are allowed to be read/write when accessed by other means. a more detailed description of each register can be obtained from both the pci, pci-x, and pcie specifications. all reserved fields in the configuration region return a 0 value on a read operation. a write operation has no effect. note: all registers and bit fields in this section are applicable to all netxtreme devices described in this document unless otherwise noted. note: in the register description tables, the following notatio ns are used in the access column to describe the register read/write access capabilities. ? r/w = read/write ? ro = read only ? lh = latches high value (until read) ? ll = latches low value (until read) ? h = forced high ? l = forced low ? sc = self-clearing ? cr = clear on read table 134: pci configuration register summary offset register 0x00-0x01 vendor id 0x02-0x03 device id 0x04-0x05 command 0x06-0x07 status 0x08 revision id 0x09-0x0b class code 0x0c cache line size 0x0d latency timer 0x0e header type 0x0f bist 0x10-0x13 base address reg 1 (lower 32-bit) 0x14-0x17 base address reg 2 (upper 32-bit) 0x18-0x1b mac 0 xbar www.datasheet.in programmer?s guide bcm57xx 01/29/08 broadcom corporation document 57xx-pg105-r pci configuration registers page 299 0x1c-0x27 base address reg 4-6 (not supported) 0x2c-0x2d subsystem vendor id 0x2e-0x2f subsystem id 0x30-0x33 expansion rom base address 0x34 capabilities pointer 0x35-0x3b reserved 0x3c interrupt line 0x3d interrupt pin 0x3e min_gnt 0x3f max_lat 0x40 pci-x capabilities 0x41 next capability pointer (pm) 0x42-0x43 pci-x command 0x44-0x47 pci-x status 0x48 power management capability id 0x49 next capability pointer (vpd) 0x4a-0x4b power management capabilities 0x4c-0x4d power management control/status 0x4e reserved 0x4f power management data 0x50 vital product data capability id 0x51 next capability pointer (msi) 0x52-0x53 vpd address/flag 0x54-0x57 vpd data 0x58 msi capability id 0x59 next capability pointer (null) 0x5a-0x5b msi control 0x5c-0x63 msi address (64-bit) 0x64-0x65 msi data 0x66-0x67 hardware fix register 0x68-0x6b miscellaneous host control 0x6c-0x6f dma read/write control 0x70-0x73 pci state 0x74-0x77 pci clock control 0x78-0x7b register base address 0x7c-0x7f memory window base address 0x80-0x83 register data 1 0x84-0x87 memory window data 0x88-0x8b mode control table 134: pci configuration register summary (cont.) offset register www.datasheet.in bcm57xx programmer?s guide 01/29/08 broadcom corporation page 300 pci configuration registers document 57xx-pg105-r v endor id r egister (o ffset 0 x 00) the 16-bit vendor id register identifies the pci adapter manufacturer. valid vendor identifiers are allocated by the pci sig to ensure uniqueness. this register defaults to 0x12aeh at power-on reset for bcm5700. this register may be written by the internal riscs. normally, this register is loaded with the appropriate vendor id after reset by firmware that resides in th e nvram. broadcom?s vendor id is 0x14e4. a. value shown is after hardware reset. b. not writable by pci configuration access. 0x8c-0x8f miscellaneous configuration 0x90-0x93 miscellaneous local control 0x94-0x97 reserved 0x98-0x9f undi receive bd standard ring producer index mailbox 0xa0-0xa7 undi receive return ring consumer index mailbox 0xa8-0xaf undi send bd producer index mailbox 0xb0-0xb7 interrupt mailbox 0 (shadow, see ?interrupt mailbox 0 register (offset 0x200)? on page 372 for host standard and flat modes and ?interrupt mailbox 0 register (offset 0x5800)? on page 492 for indirect mode) 0xb8-0xbb dual mac control register 0xbc-0xbf mac message exchange output register 0xc0-0xc3 mac message exchange input register 0xc4-0xcf reserved 0xd0 pcie capability id (for bcm5721, bcm5751, and bcm5752 only) 0xd1 next capability pointer (for bcm5721, bcm5751, and bcm5752 only) 0xd2-0xd3 pcie capabilities (for bcm5721, bcm5751, and bcm5752 only) 0xd4-0xd7 device capabilities (for bcm5721, bcm5751, and bcm5752 only) 0xd8-0xd9 device control (for bcm5721, bcm5751, and bcm5752 only) 0xda-0xdb device status (for bcm5721, bcm5751, and bcm5752 only) 0xdc-0xdf link capabilities (for bcm5721, bcm5751, and bcm5752 only) 0xe0-0xe1 link control (for bcm5721, bcm5751, and bcm5752 only) 0xe2-0xe3 link status (for bcm5721, bcm5751, and bcm5752 only) 0xe4-0xff reserved 1. these registers are remapped by the pci block with the as sociated address upon host access. the cpu can only access these registers directly through the control registers. table 135: vendor id register (offset 0x00) bit field description init access 15-0 vendor id reflects manufacturer of the part. 0x14e4 a r/w b reflects manufacturer of the part (bcm5700 only). 0x12ae a r/w b reflects manufacturer of the part (bcm5788 only). 0x173b a r/w b table 134: pci configuration register summary (cont.) offset register www.datasheet.in programmer?s guide bcm57xx 01/29/08 broadcom corporation document 57xx-pg105-r pci configuration registers page 301 d evice id r egister (o ffset 0 x 02) the 16-bit device id register identifies the particular adapter within those made by the same manufacturer. this register defaults to the value specified in table 136 at power-on reset but will be modified by the bootcode firmware to match the values in table 2: ?family revision levels,? on page 5 . this register may be written by the internal riscs. table 136: device id register (offset 0x02) bit field description init access 15-0 device id unique identifier for the bcm5700 mac 0x0003 1 1. value shown is after hardware reset. r/w 2 2. not writable by pci configuration access. unique identifier for the bcm5701 mac transceiver 0x1645 1 r/w 2 unique identifier for the bcm5702 mac transceiver 0x16a6 1 r/w 2 unique identifier for the BCM5703c mac transceiver 0x16a7 1 r/w 2 unique identifier for the BCM5703s mac transceiver serdes 0x16a7 1 r/w 2 unique identifier for the bcm5704c dual-mac transceiver 0x1648 1 r/w 2 unique identifier for the bcm5704s dual-mac transceiver serdes 0x1649 1 r/w 2 unique identifier for the bcm5705m mac transceiver 0x165d 1 r/w 2 unique identifier for the bcm5705 mac transceiver 0x1653 1 r/w 2 unique identifier for the bcm5788 mac transceiver 0x03ed 1 r/w 2 unique identifier for the bcm5721 mac transceiver 0x1677 1 r/w 2 unique identifier for the bcm5751 mac transceiver 0x1677 1 r/w 2 unique identifier for the bcm5751m mac transceiver 0x167d 1 r/w 2 unique identifier for the bcm5752 mac transceiver 0x1600 1 r/w 2 unique identifier for the bcm5752m mac transceiver 0x1601 1 r/w 2 unique identifier for the bcm5714c dual-mac transceiver 0x1668 1 r/w 2 unique identifier for the bcm5714s dual-mac transceiver serdes 0x1669 1 r/w 2 unique identifier for the bcm5715c dual-mac transceiver 0x1678 1 r/w 2 unique identifier for the bcm5715s dual-mac transceiver serdes 0x1679 1 r/w 2 www.datasheet.in bcm57xx programmer?s guide 01/29/08 broadcom corporation page 302 pci configuration registers document 57xx-pg105-r c ommand r egister (o ffset 0 x 04) the 16-bit command register is used by the pci-based host to enable various features of the device. all of the bit positions are predefined by the pci specification. not all bits in this register are implemented. table 137: command register (offset 0x04) bit field description init access 15-11 reserved reserved. 0 r/o 10 interrupt disable (BCM5703 b0 or later, bcm5704 b0 or later, bcm5705, bcm5788, bcm5721, bcm5751, bcm5752, bcm5714, and bcm5715 only) setting this bit to 1 disables the device from asserting inta on the pci bus. this bit does not affect the internal state of the inta request. 0r/w reserved reserved. 0 r/o 9 fast back-to-back enable enables fast back-to-back transactions to different devices.this device does not support this capability, therefore, this bit is hardwired to 0. 0r/o 8 system error enable enables system error detection. the device reports address parity errors when this bit is set if parity error detection is enabled. 0r/w 7 stepping control controls whether address/data stepping is done. this device does not do stepping, therefore, this bit is hardwired to 0. 0r/o 6 parity error enable enables data parity error detection. the device reports data parity errors when this bit is set. 0r/w 5 vga palette snoop enables palette snoop on vga devices. this device does not support this capability, therefore, this bit is hardwired to 0. 0r/o 4 memory write and invalidate the bcm57xx family does not support the mwi command, therefore, this bit should remain cleared to 0. 0r/o (bcm5721, bcm5751, and bcm5752 only) r/w (others) 3 special cycles enables device to monitor special cycles operations. this device does not support special cycles, therefore, this bit is hardwired to 0. 0r/o 2 bus master enables bus mastering. the device will not act as a bus master until this bit is set. note: in pci-x mode, the device is permitted to initiate a split completion regardless of the state of this bit. 0r/w 1 memory space enables memory space accesses. the device will not respond to memory accesses until this bit is set. 0r/w 0 i/o space enables i/o space accesses. this device does not support i/o space, therefore, this bit is hardwired to 0. 0r/o www.datasheet.in programmer?s guide bcm57xx 01/29/08 broadcom corporation document 57xx-pg105-r pci configuration registers page 303 s tatus r egister (o ffset 0 x 06) the 16-bit status register is used to indicate status information to the pci-based host for pci bus-related events. all of the bit positions are predefined by the pci specification. not all bits in this register are implemented. table 138: status register (offset 0x06) bit field description init access 15 detected parity error indicates a data parity error was detected even if parity reporting was not enabled. 0r/w2c 14 signaled system error indicates this device asserted system error (serr ). 0 r/w2c 13 received master abort indicates this device was a bus master and the transaction was terminated with a master-abort. 0r/w2c 12 received target abort indicates this device was a bus master and received a target-abort. 0r/w2c 11 signaled target abort indicates this device initiated a target-abort. this bit is only set if an external master disappears during a target operation. 0r/w2c 10-9 devsel timing these bits encode the slowest timing of devsel , except for configuration cycles. valid entries are 00 for fast, 01 for medium, and 10 for slow. the device is capable of fast timing and these two bits are hardwired to 00. 00 (bcm5721, bcm5751, bcm5752, bcm5714, and bcm5715 only) r/o these bits encode the slowest timing of devsel , except for configuration cycles. valid entries are 00 for fast, 01 for medium, and 10 for slow. the device is capable of medium timing and these two bits are hardwired to 01. 01 r/o 8 master data parity error indicates that this device was a bus master when a parity error was detected and reporting of parity errors is enabled. the device is capable of operating with this bit set. 0r/w2c 7 fast back-to-back capable indicates whether fast back-to-back transactions can be accepted when transactions are not to the same agent. 0 (bcm5705, bcm5788, bcm5721, bcm5751, bcm5752, bcm5714, and bcm5715 only) r/o indicates whether fast back-to-back transactions can be accepted when transactions are not to the same agent. the device is capable of accepting fast back-to-back transactions, so this bit is hardwired to 1. 1r/o 6reserved 0r/o www.datasheet.in bcm57xx programmer?s guide 01/29/08 broadcom corporation page 304 pci configuration registers document 57xx-pg105-r to clear a particular bit position, a write must be performed with that bit being a 1 and all other bit positions being a 0. in this manner, bits can be set by hardware conditions and cleared by software. r evision id r egister (o ffset 0 x 08) the 8-bit revision id register is used by the manufacturer to identify the specific revision number of this adapter. any value is allowable. it is recommended that this field be initialized to the board revision level. this register defaults to 0x00 at p ower- on reset. this register may be written by the internal riscs but cannot be written via the host pci interface. normally, this register is loaded with the appropriate revision id after reset by firmware that resides in the nvram. 5 66 mhz capable indicates whether this device can operate on a 66-mhz pci bus. 0 (bcm5705, bcm5788, bcm5721, bcm5751, bcm5752, bcm5714, and bcm5715 only) r/o indicates whether this device can operate on a 66-mhz pci bus. the device is 66 mhz capable, so this bit is hardwired to 1. 1 (other devices) r/o 4 capabilities list indicates whether this device has a capabilities list. the device has a capabilities list, so this bit is hardwired to 1. 1r/o 3 interrupt status (bcm5704 b0 and later, bcm5705, bcm5788, bcm5721, bcm5751, bcm5752, bcm5714, and bcm5715 only) indicates this device has generated an interrupt. 0 r/o reserved (other devices) 0r/o 2-0 reserved. 0 r/o note: on a dual port devices such as the bcm5704, bits 8 and 11 to 15 of the status register (offset 0x06) are shared between the two pci functions. this means that if the detected parity error bit is set on pci function 0, it is also set on pci function 1. note: see the latest errata documentation for the latest part revision codes (see ?revision levels? on page 5 ). table 139: revision id register (offset 0x08) bit field description init access 8-0 revision id revision of this part. 0h r/w 1 1. not writable by pci configuration access. table 138: status register (offset 0x06) (cont.) bit field description init access www.datasheet.in programmer?s guide bcm57xx 01/29/08 broadcom corporation document 57xx-pg105-r pci configuration registers page 305 c lass c ode r egister (o ffset 0 x 09) the 24-bit class code register identifies the generic function of the device. all of the legal values are specific in the pci specification. this field is hardwired to the class code for an ethernet interface (0x020000). c ache l ine s ize r egister (o ffset 0 x 0c) the 8-bit cache line size register is used by the pci-based host to indicate the size of a cache line in 32-bit increments. this field affects how the memory write and invalidate command is utilized. if this register is zero, then the memory write and invalidate command will not be used by the device. this register may be written via either the host pci interface or the internal riscs. normally, this register will be set by the host pci bios during the boot up sequence. this register defaults to 0. the bcm57xx family supports cache line sizes of 8, 16, 32, 64, 128, and 512 bytes. this register does not apply in pcie systems and is implemented as a read-write field for legacy compatibility purposes only. it has no impact on any pcie device functionality. l atency t imer r egister (o ffset 0 x 0d) the 8-bit latency timer register is used by the pci-based host to indicate the number of pci clocks in which the device may own the bus before checking to see if the bus should be relinquished. the device will relinquish the bus if the latency timer expires and gnt has been revoked. only the upper 5-bits are usable as the lower 3 bits are hardwired to 0. this register may be written via either the host pci interface or the internal riscs. normally, this register will be set by the host pci bio s during the boot up sequence. after a reset, this register defaults to 0x0 or 0x40 for conventional pci or pci-x respectively. this register does not apply in pcie. table 140: class code register (offset 0x09) bit field description init access 23-0 class code pci class code for this device. 020000h r/o table 141: cache line size register (offset 0x0c) bit field description init access 7-0 reserved (bcm5721, bcm5751, and bcm5752 only) 0r/w cache line size (other devices) system cache line size. 0 r/w table 142: latency timer register (offset 0x0d) bit field description init access 7-0 reserved (bcm5721, bcm5751, and bcm5752 only) 0000h r/o latency timer (other devices) number of pci clocks in which the device may own the bus before checking to see if the bus should be relinquished. 0000h (pci) 0040h (pci-x) r/w www.datasheet.in bcm57xx programmer?s guide 01/29/08 broadcom corporation page 306 pci configuration registers document 57xx-pg105-r h eader t ype r egister (o ffset 0 x 0e) the 8-bit header type register identifies the layout of bytes 10h through 3fh of the configuration space, as well as whether this adapter contains multiple functions. this register is always 0x00, which indicates a single function device (type 0) using the format specified in the pci specification. bist r egister (o ffset 0 x 0f) the 8-bit bist register is used to initiate and report the results of any built-in self-test. this device does not export bist results to this register. therefore, this register defaults to 0x00 at power-on reset. optionally, firmware could be developed to execute a self-test and write the result into this register because this register may be written by the internal riscs. this register cannot be written via the host pci interface. b ase a ddress r egister 1/2 r egister (o ffset 0 x 10-0 x 17) the 64-bit base address register is used to establish the memory space that the adapter requires within the system. once the system has determined the needs of all of the adapters, the operating system can be booted. the device supports one 64-bit base address register which must be located in the host?s memory space. the other four 32-bit base address registers are not implemented and will each return 0x0000 when read. base address register 1/2 is required for the device to function. it provides either a 64 kb or a 32 mb control region from which the host can access the adapter. the size of the region is determined by the selected host view (bit 8 of pci state register). table 143: header type register (offset 0x0e) bit field description init access 7-0 header type identifies this device as having a single function. 0 r/o table 144: bist register (offset 0x0f) bit field description init access 7-0 bist built-in self-test. 0 r/w 1 1. not writable by pci configuration access. table 145: base address register 1/2 (offset 0x10) bit field description init access 63-32 extended base address high order address bits. x r/w 31-xx+1 base address low order address bits. 0 r/w xx-4 size indication portion of the address bits that are used to indicate the size of the pci address map. these are all set to 0. xx is equal to 15 for standard view, and to 24 for flat view. 0r/o 3 prefetchable indicates that there are no side effects on reads; the device returns all bytes regardless of byte enables, and processor writes can get merged. this bit is always 0. 0r/o www.datasheet.in programmer?s guide bcm57xx 01/29/08 broadcom corporation document 57xx-pg105-r pci configuration registers page 307 mac 0 xbar r egister (o ffset 0 x 18) this register is applicable to bcm5704c, bcm5704s, bcm5714c, bcm5714s, bcm5715c, and bcm5715s devices only. mac 0 xbar r egister (u pper ) (o ffset 0x1c) this register is applicable to bcm5704c, bcm5704s, bcm5714c, bcm5714s, bcm5715c, and bcm5715s devices only. s ubsystem v endor id r egister (o ffset 0 x 2c) the 16-bit subsystem vendor id register is used by the board manufacturer for identification. this register may differ from the vendor id if the board manufacturer is different than the chip manufacturer. this register defaults to 0x12ae at power- on reset. this register may be written by the internal riscs. no rmally, this register is loaded with the appropriate subsystem vendor id after reset by firmware that resides in the nvram and its value varies by board oem. 2-1 type encoded with the following values: 00: located anywhere in 32-bit address space 01: reserved 10: located anywhere in 64-bit address space 11: reserved the device is capable of being located anywhere within the 64-bit address space, so these bits are hard-coded to 10. 10 r/o 0 memory space indicator this bit is always 0. base address registers map to memory space. 0r/o table 146: mac 0 xbar register (offset 0x18) bit field description init access 31-0 xbar value this register is used to allow the host to access the mac1?s memory/register space via memory write/read command. the content of this register is not cleared by software or hardware reset. once programmed, the value remains the same until the next software write. xr/w table 147: mac 0 xbar register (upper) (offset 0x1c) bit field description init access 31-0 xbar value (upper 32 bits) this upper 32-bits of bar to access the mac 1's memory/register space. 0x0000 r/w table 145: base address register 1/2 (offset 0x10) (cont.) bit field description init access www.datasheet.in bcm57xx programmer?s guide 01/29/08 broadcom corporation page 308 pci configuration registers document 57xx-pg105-r table 148: subsystem vendor id register (offset 0x2c) bit field description init access 15-0 subvendor id identifies board manufacturer (bcm5700 mac) 0x12ae 1 1. value shown is after hardware reset. r/w 2 2. not writable by pci configuration access. identifies board manufacturer (bcm5701 mac transceiver) 0x14e4 1 r/w 2 identifies board manufacturer (bcm5702 mac transceiver) 0x14e4 1 r/w 2 identifies board manufacturer (BCM5703c mac transceiver) 0x14e4 1 r/w 2 identifies board manufacturer (BCM5703s mac transceiver serdes) 0x14e4 1 r/w 2 identifies board manufacturer (bcm5704c dual-mac transceiver) 0x14e4 1 r/w 2 identifies board manufacturer (bcm5704s dual-mac transceiver serdes) 0x14e4 1 r/w 2 identifies board manufacturer (bcm5705 mac transceiver) 0x14e4 1 r/w 2 identifies board manufacturer (bcm5705m mac transceiver) 0x14e4 1 r/w 2 identifies board manufacturer (bcm5788 mac transceiver) 0x173b 1 r/w 2 identifies board manufacturer (bcm5721 mac transceiver) 0x14e4 1 r/w 2 identifies board manufacturer (bcm5751 mac transceiver) 0x14e4 1 r/w 2 identifies board manufacturer (bcm5752 mac transceiver) 0x14e4 1 r/w 2 identifies board manufacturer (bcm5752m mac transceiver) 0x14e4 1 r/w 2 identifies board manufacturer (bcm5714c dual-mac transceiver) 0x14e4 1 r/w 2 identifies board manufacturer (bcm5714s dual-mac transceiver) 0x14e4 1 r/w 2 identifies board manufacturer (bcm5715c dual-mac transceiver) 0x14e4 1 r/w 2 identifies board manufacturer (bcm5715s dual-mac transceiver) 0x14e4 1 r/w 2 www.datasheet.in programmer?s guide bcm57xx 01/29/08 broadcom corporation document 57xx-pg105-r pci configuration registers page 309 s ubsystem id r egister (o ffset 0 x 2e) the 16-bit subsystem id register is used by the board manu facturer for identification. this register may be used to differentiate between different boards that use the same pci silicon component. this register may be written by the internal riscs. normally, this register is loaded with the appropriate subsystem device id after reset by boot code firmware and its value varies by board oem and nic/lom. table 149: subsystem id register (offset 0x2e) bit field description init access 15-0 subsystem id id assigned by board manufacturer (bcm5700 mac) 0x0003 1 1. value shown is after hardware reset. r/w 2 2. not writable by pci configuration access. id assigned by board manufacturer (bcm5701 mac transceiver) 0x1645 1 r/w 2 id assigned by board manufacturer (bcm5702 mac transceiver) 0x16a6 1 r/w 2 id assigned by board manufacturer (BCM5703c mac transceiver) 0x16a7 1 r/w 2 id assigned by board manufacturer (BCM5703s mac transceiver serdes) 0x16a7 1 r/w 2 id assigned by board manufacturer (bcm5704c dual-mac transceiver) 0x1648 1 r/w 2 id assigned by board manufacturer (bcm5704s dual-mac transceiver serdes) 0x1648 1 r/w 2 id assigned by board manufacturer (bcm5705 mac transceiver) 0x1653 1 r/w 2 id assigned by board manufacturer (bcm5705m mac transceiver) 0x165d 1 r/w 2 id assigned by board manufacturer (bcm5788 mac transceiver) 0x03ed 1 r/w 2 id assigned by board manufacturer (bcm5721 mac transceiver) 0x1659 1 r/w 2 id assigned by board manufacturer (bcm5751 mac transceiver) 0x1677 1 r/w 2 id assigned by board manufacturer (bcm5751m mac transceiver) 0x167d 1 r/w 2 id assigned by board manufacturer (bcm5752 mac transceiver) 0x1600 1 r/w 2 id assigned by board manufacturer (bcm5752m mac transceiver) 0x1601 1 r/w 2 id assigned by board manufacturer (bcm5714c mac transceiver) 0x1668 1 r/w 2 id assigned by board manufacturer (bcm5714s mac transceiver) 0x1669 1 r/w 2 id assigned by board manufacturer (bcm5715c mac transceiver) 0x1678 1 r/w 2 id assigned by board manufacturer (bcm5715s mac transceiver) 0x1679 1 r/w 2 www.datasheet.in bcm57xx programmer?s guide 01/29/08 broadcom corporation page 310 pci configuration registers document 57xx-pg105-r e xpansion rom b ase a ddress r egister (o ffset 0 x 30) the 32-bit expansion rom base address register is used to establish the location of a 64 kb rom region within the device?s memory space. this rom region is used for pxe support. c apabilities p ointer r egister (o ffset 0 x 34) the 8-bit capabilities pointer register specifies an offset in the pci address space of a linked list of new capabilities. the capabilities are pci-x, pci power management, vital product data (vpd), message signaled interrupts (msi), and pcie (pcie). i nterrupt l ine r egister (o ffset 0 x 3c) the 8-bit interrupt line register is used to communicate interrupt line routing information. this field is set after configurat ion by the host and later used by any driver which needs to know which physical interrupt on the system interrupt controller is assigned to this device. the device supports any value in this field. table 150: expansion rom base address register (offset 0x30) bit field comments init access 31-16 rom base address address bits. x r/o 1 1. r/o unless expansi on rom bit is enabled. 15-11 rom size indication hardwired to 0 for 64 kb. 00000 r/o 1 10-1 reserved 000h r/o 0 expansion rom enable set to a 1 to enable the use of this rom region (firmware only). 0 r/o 1 table 151: capabilities pointer register (offset 0x34) bit field description init access 7-0 capabilities pointer (bcm5705, bcm5788, bcm5721, bcm5751, and bcm5752 only) points to a linked list of new pci capabilities. 48h r/o capabilities pointer (other devices) points to a linked list of new pci capabilities. 40h r/o table 152: interrupt line register (offset 0x3c) bit field description init access 7-0 interrupt line identifies interrupt routing information. 0 r/w www.datasheet.in programmer?s guide bcm57xx 01/29/08 broadcom corporation document 57xx-pg105-r pci configuration registers page 311 i nterrupt p in r egister (o ffset 0 x 3d) the 8-bit interrupt pin register is used to indicate which interrupt pin the device uses. the bcm5704 device supports two pci functions and is hardwired for inta (0x01) on pci function 0 and intb (0x02) on pci function 1. all other bcm57xx devices support only one pci function, which is hardwired for inta (0x01). m inimum g rant r egister (o ffset 0 x 3e) the 8-bit minimum grant register is used to indicate the device's desired minimum grant period in units of 250 nanoseconds, assuming a pci clock rate of 33 mhz. devices should specify values that will allow them to most effectively use their internal resources as well as the pci bus. this register is set to 0x40 at reset. this register does not apply to pcie devices. m aximum l atency r egister (o ffset 0 x 3f) the 8-bit maximum latency register is used to indicate the device's desired maximum time between being granted the pci bus in units of 250 nanoseconds, assuming a pci clock rate of 33 mhz. devices should specify values that will allow them to most effectively use their internal resources. this register is set to 0x00 at reset. this register does not apply to pcie devices. table 153: minimum grant register (offset 0x3e) bit field description init access 7-0 reserved (bcm5721, bcm5751, and bcm5752 only) 0r/o minimum grant (other devices) indicates the desired minimum grant period. 40h r/w 1 1. not writable by pci configuration access. table 154: maximum latency register (offset 0x3f) bit field description init access 7-0 reserved (bcm5721, bcm5751, and bcm5752 only) 0r/o max latency indicates desired maximum grant latency. 0 r/w 1 1. not writable by pci configuration access. www.datasheet.in bcm57xx programmer?s guide 01/29/08 broadcom corporation page 312 pci-x capabilities document 57xx-pg105-r pci-x c apabilities the pci-x capabilities registers (offset 0x40 to 0x47) are not applicable to the bcm5705, bcm5788, bcm5721, bcm5751, and bcm5752 devices. pci-x devices include new status and control registers that are located in the capabilities list in the devices pci configuration space. these pci-x capabilities registers start at offset 0x40 of pci configuration space. these registers appear in configuration space regardless of whether the device is operating in pci or pci-x mode. pci-x c apability id r egister (o ffset 0 x 40) this 8-bit register identifies this item in the capabilities list as a pci-x register set. this value is hardwired to 0x07 to i ndicate the pci-x capabilities set. pci-x n ext c apabilities p ointer r egister (o ffset 0 x 41) this 8-bit register points to the next item in the capabilities list. this value is hard-wired to 0x48 and points to the power management register block. pci-x c ommand r egister (o ffset 0 x 42) this 16-bit register controls various modes and features of the pci-x device. table 155: pci-x capability id register (offset 0x40) bit field description init access 7-0 pci-x capability id identifies this item as pci-x capabilities. 07h r/o table 156: pci-x next capabilities pointer register (offset 0x41) bit field description init access 7-0 pci-x next capabilities points to the next capabilities block which is for power management (pm). 48h r/o table 157: pci-x command register (offset 0x42) bit field description init access 15-7 reserved reserved. 00h r/o www.datasheet.in programmer?s guide bcm57xx 01/29/08 broadcom corporation document 57xx-pg105-r pci-x capabilities page 313 6-4 maximum outstanding split transactions sets the maximum number of split transactions the device is permitted to have outstanding at one time. software may change this value at any time. the most recent value of the register is used each time the device prepares a new sequence. at reset, this value is set to 0 to indicate that it can have one split transactions outstanding when the maximum memory byte count is set to 0 (512-byte). register maximum outstanding 01 12 23 34 4 8 5 12 616 732 000 r/w 3-2 maximum memory read byte count indicates the maximum byte count the device uses when initiating a sequence with one of the burst memory read commands. at reset, these bits are set to 0. register maximum byte count 0512 1 1024 2 2048 3 4096 note: for BCM5703c/BCM5703s in pci-x mode, the dma read watermark in the dma read/write control register (see ?dma read/write control register (offset 0x6c)? on page 327 ) should be set to less than or equal to the maximum memory read byte count setting. for example, if maximum memory read byte count is set to 0 (i.e., 512), the allowable dma read watermarks are 0 to 4. 00 r/w 1 enable relaxed ordering when set, the device is permitted to set the relaxed ordering bit in the requestor attributes of transactions it initiates that do not require strong write ordering. at reset, this bit is set to 1. 1r/w 0 data parity error recovery enable when set, the device should attempt to recover from data parity errors. if this bit is 0 and the device is in pci- x mode, the device asserts serr (if enabled) whenever the master data parity error bit (bit 8 of status register) is set. at reset, this bit is set to 0. 0r/w table 157: pci-x command register (offset 0x42) (cont.) bit field description init access www.datasheet.in bcm57xx programmer?s guide 01/29/08 broadcom corporation page 314 pci-x capabilities document 57xx-pg105-r pci-x s tatus r egister (o ffset 0 x 44) table 158: pci-x status register (offset 0x44) bit field description init access 31-30 reserved 00 r/o 29 received split completion error message indicates that the device received a split completion message with the split completion error attribute set. at reset, this bit is set to 0. writing a 1 to this bit, will clear this bit. 0r/w2c 28-26 designed maximum cumulative read size indicates a number that is greater than or equal to the maximum cumulative size of all burst memory read transactions the device is designed to have at one time. the device hardwires this field to 0 to indicate it can have 1024 outstanding bytes. register maximum outstanding bytes 0 1 kb 1 2 kb 2 4 kb 3 8 kb 4 16 kb 5 32 kb 6 64 kb 7 128 kb 000 r/o 25-23 designed maximum outstanding split transactions indicates a number greater than or equal to the maximum number of split transactions the device is designed to have outstanding at one time. the device hardwires this field to 0 to indicate it can have one outstanding split transaction. if system configuration software were to set the value of the maximum outstanding split transactions register (in the pci- x command register) to a value different from this register, the device would have to use the smaller value. register maximum outstanding 0 1 1 2 2 3 3 4 4 8 5 12 6 16 7 32 000 r/o www.datasheet.in programmer?s guide bcm57xx 01/29/08 broadcom corporation document 57xx-pg105-r pci-x capabilities page 315 22-21 designed maximum memory read byte count indicates the number greater than or equal to the maximum byte count the device is designed to use when initiating a sequence with one of the burst memory commands. the device sets these bits to 00 to indicate it can support up to 512 bytes. if system configuration software was to set the value of the maximum memory read byte count register (in the pci- x command register) to a value different from this register, the device would have to use the smaller value. register maximum byte count 0 512 1 1024 2 2048 3 4096 00 r/o 20 device complexity this bit indicates whether this device is a simple device or a bridge device. since the device is a simple device, this bit is hardwired to 0. 0r/o 19 unexpected split completion this bit is set if an unexpected split completion with this device?s requester id is received. at reset, this bit is set to 0. 0r/o 18 split completion discarded this bit is set if the device discards a split completion because the requester would not accept it. at reset, this bit is set to 0. this bit will never be set, because the target logic never does a split response. 0r/w2c 17 133 mhz capable this bit indicates that the device is capable of 133-mhz operation in pci-x mode. this bit is hardwired to 1. 1r/o 16 64-bit device this bit indicates the size of the device?s ad bus. this bit is hardwired to 1 to indicate a 64-bit wide ad bus. 1r/o 15-8 bus number this field indicates the number of the bus segment for the device containing this function (there is only one function on the device). this field is read for diagnostic purposes only. at reset this field is set to 0xff. ffh r/o 7-3 device number this field indicates the number of the device containing this function; i.e., the number in device number field (ad[15:11]) of the address of a type 0 configuration transaction that is assigned to the connection of the system hardware. this field is read for diagnostic purposes only. at reset, this field is set to 0x1f. 11111 r/o 2-0 function number this field indicates the number of the function; i.e., the number in function number field (ad[10:08]) of the address of a type 0 configuration transaction to which this function responds. this field is read for diagnostic purposes only. at reset, this field is set to 001. 001 r/o table 158: pci-x status register (offset 0x44) (cont.) bit field description init access www.datasheet.in bcm57xx programmer?s guide 01/29/08 broadcom corporation page 316 pci power management capabilities document 57xx-pg105-r pci p ower m anagement c apabilities devices that support pci power management must support a block of registers that is part of the capabilities list in pci configuration space. the pci power management register block is located at offset 0x48. the device supports the following pci power management registers: p ower m anagement c apability id r egister (o ffset 0 x 48) this 8-bit register identifies this item in the capabilities list as a pci power management register set. pm n ext c apabilities p ointer r egister (o ffset 0 x 49) this register points to the next item in the capabilities list. table 159: power management capability register (offset 0x48) bit field description init access 7-0 pm capability id identifies this item as power management capabilities. 01h r/o table 160: pm next capabilities pointer register (offset 0x49) bit field description init access 7-0 pm next capabilities points to the next capabilities block which is for vital product data (vpd). 50h r/o www.datasheet.in programmer?s guide bcm57xx 01/29/08 broadcom corporation document 57xx-pg105-r pci power management capabilities page 317 p ower m anagement c apabilities r egister (o ffset 0 x 4a) this 16-bit register controls various modes and features of the pci-x device. table 161: power management capabilities register (offset 0x4a) bit field description init access 15-11 pme support indicates the power states in which the device may assert pme . a 0 for any bit indicates that the device is not capable of asserting the pme pin signal while in that power state. bit 11: pme can be asserted from d0. default is 0. bit 12: pme can be asserted from d1. default is 0. bit 13: pme can be asserted from d2. default is 0. bit 14: pme can be asserted from d3hot. default is 1. bit 15: pme can be asserted from d3cold. default depends on the presence of an aux power supply. auxiliary power is detected by the presence of power on the vaux_prsnt signal pin. 01000 if no aux 11000 if aux present r/o 10 d2 support indicates whether the device supports the d2 power management state. this device does not support d2, so this bit is hardwired to 0. 0r/o 9 d1 support indicates whether the device supports the d1 power management state. this device does not support d1, so this bit is hardwired to 0. 0r/o 8-6 aux current the device supports the data register for reporting aux current requirements so this field is not applicable. 000 r/o 5 dsi indicates that the device requires device specific initialization (beyond the pci configuration header) before the generic class device driver is able to use it. this device hardwires this bit to 0 to indicate that dsi is not necessary. 0r/o 4 reserved 0r/o 3 pme clock indicates that the device relies on the presence of the pci clock for pme operation. the device does not require the pci clock to generate pme , therefore, this bit is hardwired to 0. 0r/o 2-0 version a value of 010b indicates that this function complies with revision 1.1 of the pci power management interface spec. the device hardwires this value to 010. 010 r/o www.datasheet.in bcm57xx programmer?s guide 01/29/08 broadcom corporation page 318 pci power management capabilities document 57xx-pg105-r p ower m anagement c ontrol /s tatus r egister (o ffset 0 x 4c) this 16-bit register is used to manage the pci device?s power management state as well as to enable and monitor pme events. pmcsr-bse r egister (o ffset 0 x 4e) the pmcsr_bse (pmcsr pci to pci bridge support extens ions) register is not implemented in the device. table 162: power management control/status register (offset 0x4c) bit field description init access 15 pme status this bit is set when the device would normally assert the pme signal independent of the state of the pme enable bit. writing a 1 to this bit will clear it and cause the device to stop asserting pme (if enabled). 0r/w2c 14-13 data scale indicates the scaling factor that is used when interpreting the value of the data register (offset 7 in pm capability space). the device hardwires this value to 1 to indicate a scale of 1x. 1r/o 12-9 data select indicates which data is to be reported via the data register (offset 7 in pm capability space). 0h r/w 8 pme enable enables the device to generate pme when this bit is set to 1. when 0, pme generation is disabled. 1 in BCM5703 and later devices if vaux is present, and 0 all other cases r/w 7-2 reserved 00h r/o 1-0 power state indicates the current power state of the device when read. when written, it sets the device into the specified power state. ? 00: d0 ? 01: d1 ? 02: d2 ? 03: d3 if software attempts to write an unsupported, optional state to this field, the write operation must complete on the bus; however, the data is discarded and no state change occurs. 00 r/w www.datasheet.in programmer?s guide bcm57xx 01/29/08 broadcom corporation document 57xx-pg105-r pci power management capabilities page 319 p ower m anagement d ata r egister (o ffset 0 x 4f) this 8-bit register provides a mechanism for the device to report state dependent operating data such as power consumed or heat dissipation. typically, the data returned through this register is a static copy of the device?s worst case dc characteristics data sheet. this data, when made available to system software, could be used to intelligently make decisions about power budgeting, cooling requirements, etc. the type of data returned by this register is dependent on the data select field in the pmcsr. the data select field, could indicate that this register should return power consumption for states d0-d3 or power dissipation for states d0-d3. depending upon which data point is requested, the device will retrieve the corresponding information from its internal power dissipation or power consumption registers. these register s are programmed by the device cpu at boot time with the correct power values for the various states. the device boot cpu will retrieve this power information from the nvram at boot time. the value returned in this register is scaled by the data scale field in the pmcsr. the firmware returns the maximum wattage at gigabit speed. table 163: power management data register (offset 0x4f) bit field description init access 7-0 pm data register contains the power management data indicated by the data select field in the pmcsr. 0r/o www.datasheet.in bcm57xx programmer?s guide 01/29/08 broadcom corporation page 320 vital product data capabilities document 57xx-pg105-r v ital p roduct d ata c apabilities devices that support vital product data (vpd) management must support a block of registers that is part of the capabilities list in pci configuration space. the vpd register block is located at offset 0x50. the device supports the following vpd registers: vpd c apability id r egister (o ffset 0 x 50) this 8-bit register identifies this item in the capabilities list as a vital product data (vpd) register set. vpd n ext c apabilities p ointer r egister (o ffset 0 x 51) this register points to the next item in the capabilities list. vpd f lag and a ddress r egister (o ffset 0 x 52) the upper most bit (bit 15) of this register is a flag that indicates when the transfer between the vpd data register and the storage component is completed. the lower 15 bits (14-0) of the register contain the byte address of the vpd to be accessed. table 164: vpd capability id register (offset 0x50) bit field description init access 7-0 vpd capability id identifies this item as vital product data capabilities. 03h r/o table 165: vpd next capabilities pointer register (offset 0x51) bit field description init access 7-0 vpd next capabilities points to the next capabilities block which is for message signalled interrupts (msi). 58h r/o table 166: vpd flag and address register (offset 0x52) bit field description init access 15 flag indicates when the transfer between the vpd data register and the storage component is completed. to read vpd information, a 0 is written to the flag bit when the address is written to the vpd address register. the device will then set the flag bit to 1, once the four bytes of data from the storage component have been transferred to the vpd data register. to write vpd information, a 1 is written to the flag bit. the device will clear this bit when the data is written. xr/w 14-0 vpd address contains the byte address of the vpd to be accessed. since the data register is four bytes in size, the address must be aligned on a 32-bit boundary. xr/w www.datasheet.in programmer?s guide bcm57xx 01/29/08 broadcom corporation document 57xx-pg105-r message signaled interrupts capabilities page 321 vpd d ata r egister (o ffset 0 x 54) vpd data can be read through this register. m essage s ignaled i nterrupts c apabilities devices that support message signaled interrupts (msi) must support a block of registers that is part of the capabilities list in pci configuration space. the msi register block is located at offset 0x58. typical use of msi and, in particular, multiple msis is to allow multiple processors to receive interrupt information independently of the others. the actual use of these in conjunction with the various send and receive queues and status information is application dependent. the device supports the following msi registers: msi c apability id r egister (o ffset 0 x 58) this 8-bit register identifies this item in the capabilities list as a message signaled interrupt (msi) register set. msi n ext c apabilities p ointer r egister (o ffset 0 x 59) this register points to the next item in the capabilities list. table 167: vpd data register (offset 0x54) bit field description init access 31-0 vpd data the least significant byte of the register corresponds to the byte of vpd at the address specified by the vpd address register. four bytes are always transferred between this register and the vpd storage component. the vpd storage component is the nvram. vpd data is stored in the nvram at offset 0x100h-0x1ffh. refer to appendix i of the pci 2.2 specification more complete definition of vpd. xr/w table 168: msi capability id register (offset 0x58) bit field description init access 7-0 msi capability id identifies this item as message signaled interrupt capabilities. 05h r/o table 169: msi next capabilities pointer register (offset 0x59) bit field description init access 7-0 msi next capabilities (for bcm5721, bcm5751, and bcm5752 only) points to the next capabilities block that is pcie. 0xd0 r/o msi next capabilities (other devices) points to the next capabilities block that is null because this is the last item in the capabilities list. 0r/o www.datasheet.in bcm57xx programmer?s guide 01/29/08 broadcom corporation page 322 message signaled interrupts capabilities document 57xx-pg105-r m essage c ontrol r egister (o ffset 0 x 5a) this 16-bit register provides system software control over msi. after reset, msi is disabled (bit 0 is cleared) and the functio n requests servicing via its inta pin. system software can enable msi by setting bit 0 of this register to a 1. system software is permitted to modify the message control register?s read/write bits and fields. a device driver is not permitted to modify th e read/write bits and fields. table 170: message control register (offset 0x5a) bit field description init access 15-8 reserved 0r/o 7 64-bit address capable indicates that the device is capable of generating a 64-bit message address. this bit is hardwired to 1 because the device is 64-bit message address capable. 1r/o 6-4 multiple message enable system software writes to this field to indicate the number of allocated messages (equal to or less than the number of requested message). the number of allocated messages is aligned to a power of two. when msi is enabled, a device will be allocated at least one message. the encoding is as follows: encoding # messages allocated 000 1 001 2 010 4 011 8 100 16 101 32 110 rsvd 111 rsvd 000 r/w 3-1 multiple message capable system software reads this field to determine the number of requested messages. the number of requested messages must be aligned to a power of two. the encoding is as follows: encoding # messages allocated 000 1 001 2 010 4 011 8 100 16 101 32 110 rsvd 111 rsvd 011 r/o 0 msi enable if 1, the function is permitted to use msi to request service and is prohibited from using the inta pin. if 0, the device is prohibited from using msi. system software sets this bit to enable msi. a device driver is prohibited from writing to this bit. 0r/w www.datasheet.in programmer?s guide bcm57xx 01/29/08 broadcom corporation document 57xx-pg105-r message signaled interrupts capabilities page 323 m essage a ddress r egister (o ffset 0 x 5c) this 64-bit register contains the system-specified message address. if the message enable bit (bit 0 of the message control register) is set, the contents of this register specify a 32-bit aligned address for the msi write transaction. m essage d ata r egister (o ffset 0 x 64) this 16-bit registers contains a system-specified message. each msi function is allocated up to 32 unique messages. system architecture specifies the number of unique messages supported by the system. if the message enable bit (bit 0 in the message control register) is set, the message data is driven onto the lower word of the memory write transaction?s data phase. the upper 16 bits are driven to zero during the data phase. the multiple message enable field (bits 6-4 of the message control register) defines the number of low-order message data bits the function is permitted to modify to generate its system software allocated messages. for example, a multiple message enable encoding of 010 indicates the function has been allocated four messages and is permitted to modify message data bits 1 and 0 in order to generate up to four unique messages. this field is read/write. h ardware f ix r egister (o ffset 0 x 66) this 16-bit register enables fixes for certain hardware errata in the BCM5703 b0, bcm5704 b0, and later pci-x devices. table 171: message address register (offset 0x5c) bit field description init access 63-0 msi address register contains the system-specified message address. x r/w table 172: message data register (offset 0x64) bit field description init access 15-0 msi data register contains the system specified message. x r/w table 173: hardware fix register (offset 0x66) bit field description init access 15-14 reserved - 13 hw fix 4 setting this bit to 1 fixes a problem where pci latency timer does not follow the pci specification. 0r/w 12 hw fix 3 setting this bit to 1 fixes a problem where master abort in pci mode violate spec (frame and irdy deassert at the same time). 0r/w 11 hw fix 2 setting this bit to 1 fixes a problem where pcix latency limit up to eight clocks for signals split response or retry. 0r/w 10 hw fix 1 setting this bit and bit 11 to 1 fixes a problem where data corruption by non-quadword write with 64-bit pcix memory write block command. 0r/w 9-0 reserved - www.datasheet.in bcm57xx programmer?s guide 01/29/08 broadcom corporation page 324 message signaled interrupts capabilities document 57xx-pg105-r pci-x s plit l atency t imer r egister (o ffset 0 x 66, bcm5714c, bcm5714s, bcm5715c, and bcm5715s o nly ) table 174: pci-x split latency timer register (offset 0x66, for bcm5714 only) bit field description init access 15-10 reserved - 9-0 max_split_latency pci-x split latency timer value. 0 r/w www.datasheet.in programmer?s guide bcm57xx 01/29/08 broadcom corporation document 57xx-pg105-r private pci configuration registers page 325 p rivate pci c onfiguration r egisters m iscellaneous h ost c ontrol r egister (o ffset 0 x 68) the miscellaneous host control register is used to control various functions within the device normally controllable from the pci-based host. each bit has a separate function from any other bit in this register. note: see ?revision levels? on page 5 . also see the latest errata documentation for any known errata related to asic revision string information. table 175: miscellaneous host control register (offset 0x68) bit field description init access 31-16 asic revision asic revision string (see ?revision levels? on page 5 ). xxxxh r/o 15 enable tlp minor error tolerance (bcm5721, bcm5751, and bcm5752 only) set this bit to enable tlp minor error tolerance (attr/tc/ lock command). 0r/w reserved - 0 r/o 14 log header overflow (bcm5721, bcm5751, and bcm5752 only) set this bit to enable log header due to overflow. 0 r/w reserved - 0 r/o 13 boundary check (bcm5721, bcm5751, and bcm5752 only) set this bit to enable crossing 4 kb boundary check. 0 r/w reserved - 0 r/o 12 byte-enable rule check (bcm5721, bcm5751, and bcm5752 only) set this bit to enable the byte-enable rule check. 0 r/w reserved - 0 r/o 11 interrupt check (bcm5721, bcm5751, and bcm5752 only) set this bit to enable the interrupt check. 0 r/w reserved - 0 r/o 10 rcb check (bcm5721, bcm5751, and bcm5752 only) set this bit to enable rcb check. 0 r/w reserved - 0 r/o 9 enable tagged status mode (other devices) when set, a unique eight-bit tag value will be inserted into the status block status tag (see ?status block? on page 103 ). 0r/w reserved (bcm5788) - 0 r/o 8 mask_interrupt_mode when set, the inta_l signal is masked (de-asserted) at the chip's pin. however, the internal interrupt state (host coalescing event) will not be cleared. 0r/w 7 enable indirect access set bit to enable indirect addressing mode. 0 r/w www.datasheet.in bcm57xx programmer?s guide 01/29/08 broadcom corporation page 326 private pci configuration registers document 57xx-pg105-r 6 enable register word swap set bit to enable word swapping when accessing registers through the pci target interface. 0r/w 5 enable clock control register read/write capability set bit to enable clock control register read/write capability, otherwise, the clock control register is read only (see ?pci clock control register (offset 0x74)? on page 334 ). 0r/w 4 enable pci state register read/write capability set bit to enable pci state register read/write capability, otherwise, the pci state register is read only (see ?pci state register (offset 0x70)? on page 332 ). 0r/w 3 enable endian word swap set bit to enable endian word swapping when accessing through pci target interface. 0r/w 2 enable endian byte swap set bit to enable endian byte swapping when accessing through pci target interface. 0r/w 1 mask pci interrupt output setting this bit will mask (i.e., prevent) future interrupt events from causing inta to assert as long as this bit is set. setting this bit will not clear or de-assert the internal interrupt state, nor will it de-assert the external interrupt state on inta . in other words, setting this bit does not disable the interrupt line because inta will stay asserted if it was already asserted. however, if inta is not already asserted when this bit is set, inta will not be asserted if interrupt-causing event occurs later while this bit is still set. in that scenario, the interrupt will not be presented to inta until this bit is cleared. 0r/w 0 clear interrupt inta setting this bit will clear (de-assert) inta as long as the mask interrupt bit is not set. if the mask interrupt bit is set, then writing the clear interrupt bit to a 1 will not de-assert inta , however it will clear the internal unmasked interrupt state, so if inta is later unmasked, then the inta will de-assert. however, if the mask interrupt bit is then set again, then inta will be asserted again, because the internal masked state of the interrupt line cannot be cleared by writing to the clear interrupt bit. since this writing to this bit does not unconditionally clear interrupts, it is recommended that software drivers write to interrupt mailbox 0 (see ?interrupt mailbox 0 register (offset 0x200)? on page 372 for host standard and flat modes and ?interrupt mailbox 0 register (offset 0x5800)? on page 492 for indirect mode) in order to cleanly clear interrupts. 0w/o table 175: miscellaneous host control register (offset 0x68) (cont.) bit field description init access www.datasheet.in programmer?s guide bcm57xx 01/29/08 broadcom corporation document 57xx-pg105-r private pci configuration registers page 327 dma r ead /w rite c ontrol r egister (o ffset 0 x 6c) the dma read/write control register is used to control various dma and pci master functions of the device. table 176: dma read/write control register (offset 0x6c) bit field description init access 31-28 default pci write command (other devices) use this command for pci write transactions less than four words. 7h r/w 30-29: write control boundary (bcm5721, bcm5751, and bcm5752 only) this field sets the write control boundary and has the following values: ? 00 = break request on a multiple of a 64-byte boundary ? 01 = break request on a multiple of a 128-byte boundary ? 1x = no constraint 10b r/w 28: reserved (bcm5721, bcm5751, and bcm5752 only) ?0r/o 27-24 default pci read command (other devices) use this command for pci read transactions less than four words. 6h r/w reserved (bcm5721, bcm5751, and bcm5752) ? 0000 r/w 23 assert all bes on dma write (bcm5700, bcm5701, bcm5714, and bcm5715 only) during dma write operations, drive all byte enables. this forces word alignment without having to adjust the dma channel addresses and length. 0r/w pcix-32 dma write single disconnect fix (BCM5703 a3, bcm5704 a3, and later) setting this bit to 1 fixes the hardware errata for a dma write single cycle disconnect, followed by a split completion, followed by the continuation of dma write, which causes data duplication. 0r/w reserved (other devices) ? 0 r/o 22 use memrdmult command (bcm5700, bcm5701, bcm5714, and bcm5715 only) use the memory read multiple command in place of memory read line command for dma reads. 0r/w keep request on (bcm5702 and later) when this bit is set, the device continues asserting the pci req# signal until the master latency timer expires, even if gnt# is removed. this bit is used for hardware debugging only. 0r/w reserved (other devices) ? 0 r/o www.datasheet.in bcm57xx programmer?s guide 01/29/08 broadcom corporation page 328 private pci configuration registers document 57xx-pg105-r 21-19 dma write watermark encoded bits that prevents pci bus activity until the dma write fifo reaches certain watermarks. for pci: ? 0 = 32 ? 1 = 64 ? 2 = 96 ? 3 = 128 ? 4 = 160 ? 5 = 192 ? 6 = 224 ? 7 = 256 for pci-x: ? 0 = 64 ? 1 = 128 ? 2 = 256 ? 3 = 384 (uses only bits 19 and 20; bit 21must be 0) ? 4 = 512 (bcm5714 and bcm5715 only) for pcie: ? 0 = 32 ? 1 = 64 ? 2 = 96 ? 3 = 128 ? 4 = 160 ? 5 = 192 ? 6 = 224 ? 7 = 256 000 r/w 18-16 dma read watermark (bcm5700, bcm5701, and bcm5702 only) encoded bits that prevents pci bus activity until the dma read fifo reaches certain watermarks. for pci: ? 0 = 32 ? 1 = 64 ? 2 = 96 ? 3 = 128 ? 4 = 160 ? 5 = 192 ? 6 = 224 ? 7 = 256 for pci-x: ? 0 = 64 ? 1 = 128 ? 2 = 256 ? 3 = 384 (uses only bits 16 and 17; bit 18 must be 0) 000 r/w table 176: dma read/write control register (offset 0x6c) (cont.) bit field description init access www.datasheet.in programmer?s guide bcm57xx 01/29/08 broadcom corporation document 57xx-pg105-r private pci configuration registers page 329 18-16 (cont.) dma read watermark (BCM5703c, BCM5703s, bcm5704c, and bcm5704s only) encoded bits that prevents pci bus activity until the dma read fifo reaches certain watermarks. for pci: ? 0 = 32 ? 1 = 64 ? 2 = 96 ? 3 = 128 ? 4 = 160 ? 5 = 192 ? 6 = 224 ? 7 = 256 for pci-x: ? 0 = 64 ? 1 = 128 ? 2 = 256 ? 3 = 384 ? 4 = 512 ? 5 = 1024 ? 6 = 1536 ? 7 = 1536 note: in the BCM5703c/BCM5703s, the dma read watermark should be set to less than or equal to the maximum memory read byte count of the pci-x command register (see ?pci-x command register (offset 0x42)? on page 312 ). for example, if maximum memory read byte count is set to 0 (i.e., 512), the allowable dma read watermarks are 0 to 4. 000 r/w dma read watermark (bcm5705 and bcm5788 only) for pci: ? 0 = 32 ? 1 = 64 ? 2 = 96 ? 3 = 128 ? 4 = 160 ? 5 = 192 ? 6 = 224 ? 7 = 256 000 r/w dma read watermark (bcm5714c, bcm5714s, bcm5715c, and bcm5715s only) for pci-x: ? 0 = 64 ? 1 = 128 ? 2 = 256 ? 3 = reserved ? 4 = reserved ? 5 = reserved ? 6 = reserved ? 7 = reserved 000 r/w reserved (all other devices) ?000r/o table 176: dma read/write control register (offset 0x6c) (cont.) bit field description init access www.datasheet.in bcm57xx programmer?s guide 01/29/08 broadcom corporation page 330 private pci configuration registers document 57xx-pg105-r 15-14 15-14: one dma at once (bcm5704, bcm5714, and bcm5715 only) for bcm5704: ? 00: off (default) ? 01: service both channels requests when current dma request from this channel is completed ? 1x: service other channels request when non-idle termination code is detected for bcm5714 and bcm5715: ? 15 (one_dma_at_once_local): when set to 1, allows interleaving of dma requests from the other function, but does not allow any other dma request from the same function. the current dma must finish before any other request from the same function can have access. ? 14 (one_dma_at_once_global): when set to 1, allows only one dma channel to have access to the pci bus at a time. the current dma must finish before any other channel can have access. 00 r/w reserved (other devices) ? 0 r/o 13-11 dma write address boundary encoded bits which force termination of dma write operations at certain address byte boundaries. for pci: ? 0 = disable ? 1 = 16 ? 2 = 32 ? 3 = 64 ? 4 = 128 ? 5 = 256 ? 6 = 512 ? 7 = 1024 for pci-x: ? 0 = disable ? 1 = 128 ? 2 = 256 ? 3 = 384 (uses only bits 11 and 12) 000 r/w reserved (bcm5721, bcm5751, bcm5752, bcm5714, and bcm5715 only) ?0r/o table 176: dma read/write control register (offset 0x6c) (cont.) bit field description init access www.datasheet.in programmer?s guide bcm57xx 01/29/08 broadcom corporation document 57xx-pg105-r private pci configuration registers page 331 10-8 dma read address boundary encoded bits which force termination of dma read operations at certain address byte boundaries. for pci: ? 0 = disable ? 1 = 16 ? 2 = 32 ? 3 = 64 ? 4 = 128 ? 5 = 256 ? 6 = 512 ? 7 = 1024 for pci-x: ? 0 = disable ? 1 = 128 ? 2 = 256 ? 3 = 384 (uses only bits 8 and 9) 000 r/w reserved (bcm5721, bcm5751, bcm5752, bcm5714, and bcm5715 only) ?000r/o 7-0 reserved (bcm5721, bcm5751, and bcm5752 only) ?0r/w minimum dma (other devices) minimum number of pci words/double words that each dma channel is allowed to keep the pci bus without allowing accesses by the other dma channel. this guarantees a minimum pci usage rather than the usual alternate per burst behavior. 0r/w table 176: dma read/write control register (offset 0x6c) (cont.) bit field description init access www.datasheet.in bcm57xx programmer?s guide 01/29/08 broadcom corporation page 332 private pci configuration registers document 57xx-pg105-r pci s tate r egister (o ffset 0 x 70) the pci state register is used to control several functions within the device associated with the pci interface. note: the enable pci state register read/write capability bit of the miscellaneous host control register must be enabled to write the pci state register from the pci configuration cycle (see ?miscellaneous host control register (offset 0x68)? on page 325 ). table 177: pci state register (offset 0x70) bit field description init access 31-24 split completion message index this field returns the pci-x split completion message index, and is valid if the received split completion error message bit of the pci-x status register (see table 158 on page 314 ) is set. 0r/o reserved (bcm5721, bcm5751, and bcm5752 only) 0r/o 23-20 split completion message class this field returns the split completion message class, and is valid if the received split completion error message bit of the pci-x status register (see table 158 on page 314 ) is set. 0r/o reserved (bcm5721, bcm5751, and bcm5752 only) 0r/o 19-17 reserved - 0 r/o 16 no snoop set this bit to enable the pci-x no snoop attribute bit. 0 r/w reserved (bcm5721, bcm5751, and bcm5752 only) 0r/o 15 config retry (bcm5721, bcm5751, and bcm5752 only) when asserted, forces all config access to be retried. 1r/w reserved (other devices) 0 r/o 14 reserved - 0 r/o 13 reserved (bcm5700, bcm5701, bcm5721, bcm5751, bcm5752 only) -0r/o retry same dma (other devices) when set, prevents internal arbitration logic from switching to the other dma engine after a retry cycle. 0r/w 12 3.3vaux present this bit reads as 1 when the 3.3v auxiliary power source is present. 0r/o 11-9 max pci target retry (bcm5700, bcm5701, bcm5721, bcm5751, and bcm5752 only) indicates the number of pci clock cycles before retry occurs, in multiple of 8. at reset, this field is set to 001. 001 r/o 1 reserved (other devices) - 000 r/o 8 flat view asserted if the base address register presents a 32 mb pci address map flat view, otherwise, indicates a 64 kb pci address map standard view. 0 r/o 1 www.datasheet.in programmer?s guide bcm57xx 01/29/08 broadcom corporation document 57xx-pg105-r private pci configuration registers page 333 7 vpd available this bit reads as 1 if the vpd region of the nvram can be accessed by the host. 0r/o 6 pci expansion rom retry force pci retry for accesses to expansion rom region, if enabled. 0 r/o 1 5 pci expansion rom desired enable pci rom base address register to be visible to the pci host. 0 r/o 1 4 32-bit pci bus asserted if on a 32-bit pci bus, otherwise, indicates a 64-bit bus. writes to this bit will force true 32-bit pci operation even if pci host indicated 64-bit operation. will cause problems if this bit is asserted on a true 64-bit pci bus. depends r/o 1 reserved (bcm5721, bcm5751, and bcm5752 only) 0r/o 3 33 mhz/66 mhz pci bus 66 mhz/133 mhz pci-x bus asserted if conventional pci bus is operating between 33- 66 mhz, otherwise, indicates operation between 0-33 mhz. asserted if pci-x bus is operating in 66-133 mhz mode, otherwise, indicates operation in 50-66 mhz mode. depends r/o 1 reserved ((bcm5721, bcm5751, and bcm5752 only) 0r/o 2 pci bus mode asserted if pci bus is in pci bus mode, otherwise, indicates conventional pci-x bus. writes to this bit will force true pci bus operation even if pci host indicated conventional pci-x bus operation. depends r/o 1 reserved (bcm5721, bcm5751, and bcm5752 only) 0r/o 1 interrupt state this bit reflects the internal state of the pci inta signal. a value of 0 indicates that inta is internally asserted. assertion of the pci inta pin on the pci bus may be masked by setting the mask pci interrupt output bit of the ?miscellaneous host control register (offset 0x68)? on page 325 . 1 r/o 1 reserved (bcm5721, bcm5751, and bcm5752 only) 0r/o 0 force pci reset will force an immediate reset of the pci interface. all state information will be lost. this bit is self-clearing. 0 r/o 1 reserved (bcm5721, bcm5751, and bcm5752 only) 0r/o 1. bit-enabled r/w through pci configuration space. table 177: pci state register (offset 0x70) (cont.) bit field description init access www.datasheet.in bcm57xx programmer?s guide 01/29/08 broadcom corporation page 334 private pci configuration registers document 57xx-pg105-r pci c lock c ontrol r egister (o ffset 0 x 74) the below table is applicable to bcm5700, bcm5701, bcm5702, BCM5703, and bcm5704 devices only. note: the enable clock control register read/write capability bit of the miscellaneous host control register must be enabled to write the pci clock control register from the pci configuration cycle (see ?miscellaneous host control register (offset 0x68)? on page 325 ). table 178: pci clock control register (offset 0x74) bit description comments init access 31-20 reserved 0 r/o 19 power down (bcm5704 only) write 1 to power down the device. 0 r/w reserved (for other devices) 0r/o 18 low speed pll clock this bit along with the alternate clock control field controls the core and cpu clock source (see table 179 on page 336 ). set for entering a low-power wol mode. ? 0: 133/66 mhz mode. ? 1: 66/33 mhz mode the pll needs at least 27 s to stabilize after its speed is changed. see figure 108 on page 336 . 0 r/w 17 bist control (bcm5704 only) controls bist. 0 r/w reserved (for other devices) 0 r/o 16 enable bist asynchronous bist reset enable bist in manufacturing. resets bist 0 0 r/w r/w 15 disable system pll disable pci pll (bcm5704 only) 0 0 r/w r/w 14 disable pci pll disable ciob-e pll (bcm5704 only) when set, the pci pll is set into low-power mode and the output clock from the pll stops. to modify this bit, the enable alternate clock bit must first be set. when cleared, the pll resumes normal operation. when this bit is set, the ciob-e pll is disabled. 0 0 r/w r/w www.datasheet.in programmer?s guide bcm57xx 01/29/08 broadcom corporation document 57xx-pg105-r private pci configuration registers page 335 13 select source of alternate clock when clear, the alternate clock source is: ? ck25 = xtalin (for bcm5701, bcm5702, BCM5703, and bcm5704) ? ck25 = 125 mhz txclkin clock divided by 5 (for bcm5700). when set, the alternate clock source is: ? mii_txclk (for bcm5700, bcm5701, bcm5702, and BCM5703) ? ck12 = xtalin/2 (for bcm5704) see figure 108 on page 336 . 0 r/w 12 select alternate clock when clear, the system clock is sourced from the output of the system pll. when set, the system clock is sourced from the alternate clock source. this bit must be set before attempting to modify the pll disable bits of this register. see figure 108 on page 336 . 0 r/w 11 tx risc clock disable disable the clock to tx risc. when this bit is set, the clock to tx risc will be stopped. 0 r/w 10 rx risc clock disable disable the clock to rx risc. when this bit is set, the clock to rx risc will be stopped. 0 r/w 9 enable low-power clock mode when set, the device enters a low-power state by disabling the core clock to most of the functional blocks. this bit should be set for wake-on-lan mode. additional clocks should be disabled for the lowest power mode of operation. when set, register access to the general control registers will fail. 0 r/w 8 reserved 0 r/o 7 m66en value input from pin. if high, pci pll is being used. r/o a 6-5 reserved r/o 4-0 pci clock speed detected frequency of the pci clock speed detected: ? 0 = 33 mhz ? 2 = 50 mhz ? 4 = 66 mhz ? 6 = 100 mhz ? 7 = 133 mhz other values are undefined. r/o a a. bit-enabled r/w through pci configuration space. table 178: pci clock control register (offset 0x74) (cont.) bit description comments init access www.datasheet.in bcm57xx programmer?s guide 01/29/08 broadcom corporation page 336 private pci configuration registers document 57xx-pg105-r figure 108: bcm5700/5701/5702/5703/5704 clock control logic table 179: clock source and core_clk speed (bcm5704) bit 18 bit 13 bit 12 clock source core_clk speed (mhz) 0 x 0 ciobe pll 66 1 x 0 ciobe pll 33 x01 ck25 12.5 x11 ck12 6.25 select alternate clock dff cpu_clk core_c lk alternate clock source (bit 13) pll m ii_clk (for bcm5700/5701/5702/5703) xtal_in/2 (for bcm5704) ck25=tx_clk_in/5 (for bcm5700) c k25=xtalin (for bcm5701/02/03/04) mii_txclk pll_clk alt_clk 2 www.datasheet.in programmer?s guide bcm57xx 01/29/08 broadcom corporation document 57xx-pg105-r private pci configuration registers page 337 the below table is applicable to bcm5705 and bcm5788 only. table 180: pci clock control register definition for bcm5705 device bit description comments init access 31:27 reserved 0r/w 26 pci read too long bug fix enabled when this bit is 1, this bit enables the fix for the issue of pci read of 8 extra bytes during the slow core clock. this bit is valid for a2 only. in a3, this bit also enables the fix for the pci read 8 extra bytes during lso. 0r/w 25 pci write too long bug fix enabled when this bit is 1, this bit enables the fix for the issue of pci read of 8 extra bytes during the slow core clock. this bit is valid for a2 only. 0r/w 24 back to a0 pci bus arbitration when bus is parked. when the bit is 1, the arbitration timing will be back to a0 while the bus is parked on 5705. note that this will result in serr# for certain chip-set, and bits 24 and 23 cannot be set simultaneously. this bit is valid for a2 only. 0r/w 23 bus-parking save mode when the bit is 1, there will always be a 2-cycle turn- around-time when a target transaction is followed by a master transaction while bus is parked on the 5705. this bit is valid for a1 only. 0r/w 22 reserved this bit is changed to reserved in a3. clkrun# is now always enabled. 0r/w 21 force clkrun# to maintain pci clock when the bit is 1, the pci/cardbus clock will be forced to maintain. 0r/w 20 6.25 mhz select select the 6.25 mhz clock as the alternate clock (use in airplane mode). if this bit is 0, the alternate clock will be selected by bit 13. 0r/w 19 slow core clock mode set this bit to 1 when running a 10:1 pci to core clock ratio. for engineering debug only. 0r/w 18 led polarity when set to 1, it would change the polarity of the 4 leds. 0 r/w 17 bist control controls the bist 0 r/w 16 bist reset resets the bist 0 r/w 15:14 reserved 00 r/w 13 mii clock/ck25 use the mii clk input as the alternate clock for the internal clocks, rather than the xtal ck25 input as the alternate clock. 0r/w 12 select alternate clock use the alternate clock as the clock reference for the internal clocks, rather than the 62.5 mhz. 0r/w 11:10 reserved 00 r/w 9 core clock disable disable the core clk to all blocks. 0 r/w 8 reserved 0r/w 7 m66en value input from pin. r/o 6 reserved 0r/w 5 reserved 0r/w 4:0 pci clock speed detected frequency of the pci clock speed detected. r/o www.datasheet.in bcm57xx programmer?s guide 01/29/08 broadcom corporation page 338 private pci configuration registers document 57xx-pg105-r the below table is applicable to bcm5751, bcm5721, and bcm5752 only. table 181: pci clock control register definition for bcm5751, bcm5721, and bcm5752 devices bit description comments init access 31 plp clock disable when this bit is set to 1, pcie physical layer clock is disabled. n/a for pci device a 0 1 in cwol r/w 30 dlp clock disable when this bit is set to 1, pcie data link layer clock is disabled. n/a for pci device a 0 1 in cwol r/w 29 tlp clock disable when this bit is set to 1, pcie transaction layer clock is disabled once this bit is set, the fw can no longer access the pci config registers (including the clock control register), so it should be set only when the fw has no need to access the clock control and other pci config registers until next power cycle. n/a for pci device a 0 r/w 28 pcie clock to core clock when this bit is 1, the source of internal pcie clock is core_clk. n/a for pci device 1 0 1 in cwol r/w 27 reserved 0 r/o 26 pci read too long eco fix when this bit is 1, it enables the fix for the pci read 8 extra bytes during lso. 0 r/w 25 pci write too long eco fix when this bit is 1, it enables the fix for pci write 8 extra bytes during slow core clock. 0 r/w 24 select test clk source selects the following test clocks: 0: clk125 (125-mhz clock from gphypll). 1: tlp clk (/4 of the serdes clock). 0 r/w 23 select test clk when this bit is 1, the gphypll test clock is muxed out to the gpio0 pin. 0 r/w 22 tpm_core_clk disable when this bit is 1, the core_clk to tpm block is disabled. 0r/w 21 force clkrun when the bit is 1, the pci/cardbus clock will be forced to maintain the pci clock. n/a for pcie device. 0r/w 20 select final alt clock select the 6.25-mhz clock as the alternate clock (use in airplane mode). if this bit is 0, the alternate clock will be selected by bit 13. 0 r/w 19 slow core clock mode set this bit to 1 when running a 10:1 pci to core clock ratio. for engineering debug only. 0 r/w 18 led polarity when set to 1, it would change the polarity of the 4 leds. 0 r/w 17 bist function control controls the bist function. 0 r/w 16 asynchronous bist reset resets the bist. 0 r/w www.datasheet.in programmer?s guide bcm57xx 01/29/08 broadcom corporation document 57xx-pg105-r private pci configuration registers page 339 15:14 reserved 13 select alt clock source if set to: ? 0, then alternate clock source = ck25 = (xtal_in)/2. ? 1, then alternate clock source = ck25 = mii_clk/2. 0 r/w 12 select alt clock use the alternate clock as the clock reference for the internal clocks, rather than the 62.5 mhz. in bcm5752, this bit will have no effect if tpm is enabled. 0 r/w 11:10 reserved 9 core clock disable disable the core clk to all blocks. 0 r/w 8 reserved 7 m66en n/a for pcie device. 6:5 reserved 4:0 detected pci clock speed n/a for pcie device. 1. bit 28 applies to the pcie device only. in legacy pci mode, pc i registers are not accessible when the device is in the d3 cold state. table 182: pci clock control register definition for bcm5714, and bcm5715 devices bit description comments init access 31-27 reserved 0r/o 26 pci read too long eco fix when this bit is 1, it enables the fix for the pci read 8 extra bytes during lso. 0r/w 25 pci write too long eco fix when this bit is 1, it enables the fix for pci write 8 extra bytes during slow core clock. 0r/w 24-21 reserved 0r/o 20 select final alt. clock select the 6.25-mhz clock as the alternate clock (use in airplane mode). if this bit is 0, the alternate clock will be selected by bit 13. 0 r/w 19 slow core clock mode set this bit to 1 when running a 10:1 pci to core clock ratio. for engineering debug only. 0 r/w 18 led polarity when set to 1, it would change the polarity of the 4 leds. 0 r/w 17 bist function control controls the bist function. 0 r/w 16 asynchronous bist reset resets the bist. 0 r/w 15:14 reserved 0r/o 13 select alt clock source if set to: ? 0, then alternate clock source = ck25 = (xtal_in)/2. ? 1, then alternate clock source = ck25 = mii_clk/2. 0 r/w 12 select alt clock use the alternate clock as the clock reference for the internal clocks, rather than the 62.5 mhz. 0 r/w 11:10 reserved 0 r/o 9 core clock disable disable the core clk to all blocks. 0 r/w 8 reserved 0r/o table 181: pci clock control register definition for bcm5751, bcm5721, and bcm5752 devices (cont.) bit description comments init access www.datasheet.in bcm57xx programmer?s guide 01/29/08 broadcom corporation page 340 private pci configuration registers document 57xx-pg105-r r egister b ase a ddress r egister (o ffset 0 x 78) the register base address register defines the device local address of a register. the data pointed to by this location is read or written using the register data register. to use the register base address/register data registers: 1. enable indirect mode by setting the enable indirect access bit of the miscellaneous host control register (see ?miscellaneous host control register (offset 0x68)? on page 325 ). 2. write the address of the register that you would like to access to the register base address register (offset 0x78?0x7b). the least significant two bits of the register base address register will always be ignored since registers are naturally word (32-bit) aligned. to allow access to all of the bcm57xx registers, the range of the register base address register is [17:2]. 3. to write the register pointed to by the register base address register, write the 32-bit data to the register data register. at least one byte enable in the word to be written from the pci-based host must be asserted for the write to occur, otherwise, the write will be ignored. 4. to read the register pointed to by the register base address register, read the 32-bit data from the register data register. 7 m66en value input from pin. 0 r/w 6:5 reserved 0r/o 4:0 detected pci clock speed frequency of the pci clock speed detected 0 r/w table 183: register base address register (offset 0x78) bit field description init access 31-18 reserved reserved for testing or future use. x r/o 17-2 register base addr local controller address of a register than can be written or read by writing to the register data register. xr/w 1-0 reserved reserved for testing or future use. x r/o note: when using indirect register access, broadcom recommends that the host software access the register base address register (offset 0x78) and the register data register (offset 0x80) using pci configuration cycles rather than memory-mapped i/o (i.e., accessing the pci configuration registers at offsets 0x78 and 0x80 by memory addresses enabled through the pci bar registers). if memory-mapped i/o access is used, every register write must be followed by a read from the same register to guarantee that the posted write buffer is flushed. table 182: pci clock control register definition for bcm5714, and bcm5715 devices (cont.) www.datasheet.in programmer?s guide bcm57xx 01/29/08 broadcom corporation document 57xx-pg105-r private pci configuration registers page 341 m emory w indow b ase a ddress r egister (o ffset 0 x 7c) the memory window base address register defines the device local memory address which is to be the base address for the 32 kb memory window provided by the bcm57xx family. this register may contain any valid local memory address, but the usage of the least significant 15 bits varies depending on how the local memory is to be accessed. if the 32 kb memory window is used, then the least significant 15 bits are ignored. if the memory window data register is referenced, then the entire memory window base address register is used to indicate the specific local memory address of the operation. to use the memory window base address/memory window data registers: 1. enable indirect mode by setting the enable indirect access bit of the miscellaneous host control register (see ?miscellaneous host control register (offset 0x68)? on page 325 ). 2. write the address of the memory location that you would like to access to the memory window base address register (offset 0x7c?0x7f). the least significant two bits of the memory window base address register will always be ignored. additionally, if the access to memory is a 64-bit pci access, the least significant three bits will be ignored, since memory is naturally double word (64-bit) aligned. to allow access to all of the bcm57xx memory, the range of the memory window base address register is [23:2]. also note that target word swap applies to memory accesses. this needs to be taken into account when reading or writing from the memory window data register. 3. to write to the memory location pointed to by the memory window base address register, write the 32-bit or 64-bit data to the memory window data register. a 64-bit write to the memory window data register can only occur when using a pci memory command and not a pci config command. pci config commands only allow for 32-bit data transfers. also note that the particular bytes that are to be written must have their associated byte enables set. at least one byte enable in the word(s) to be written from the pci-based host must be asserted for the write to occur, otherwise, the write will be ignored. 4. to read the memory location pointed to by the memory window base address register, read the 32-bit or 64-bit data from the memory window data register. the value that is written to the memory window base address register is also used for the 32-kb memory window. the offset of the memory window into the memory space can be determined by zeroing memory window base address register bits[14:0]. table 184: memory window base address register (offset 0x7c) bit field description init access 31-24 reserved - 0 r/o 23-2 memory window base addr local controller memory address of the nic memory region that can be accessed via memory window data register. xr/w 1-0 reserved - 0 r/o www.datasheet.in bcm57xx programmer?s guide 01/29/08 broadcom corporation page 342 private pci configuration registers document 57xx-pg105-r r egister d ata r egister (o ffset 0 x 80) the register data register is used to access registers in the bcm57xx family. if this register is written to, the underlying register is also written. if this register is read, the current value of the underlying register is also read. m emory w indow d ata r egister (o ffset 0 x 84) the memory window data register is normally used to access locations in the local memory when the 32 kb memory window provided by the bcm57xx family is not accessible. an example of this state is during the preboot execution environment when a 64 kb memory mapping is not available, and all accesses to the device must be done through pci configuration space. this register combined with the memory window base address register (see ?memory window base address register (offset 0x7c)? on page 341 ) provides an indirect method to access the entire local memory address space. if this register is written to, the underlying memory location is also written. if this register is read, the current value of the underlying memor y location is also read. m ode c ontrol r egister (o ffset 0 x 88, h ost cpu view ) this register is a mirror of 0x6800 (see ?mode control register (offset 0x6800)? on page 502 . m iscellaneous c onfiguration r egister (o ffset 0 x 8c, h ost cpu view ) this register is a mirror of 0x6804 (see ?miscellaneous configuration register (offset 0x6804)? on page 504 . m iscellaneous l ocal c ontrol r egister (o ffset 0 x 90, h ost cpu view ) this register is a mirror of 0x6808 (see ?miscellaneous local control register (offset 0x6808)? on page 507 . table 185: register data register (offset 0x80) bit field description init access 31-0 register data register data at the location pointed to by the register base address register. xr/w table 186: memory window data register (offset 0x84) bit field description init access 31-0 memory window data memory value at the location pointed to by the memory window base address register. xr/w note: programmers should take special care not to read from the memory window data register if the value of the memory window base address register (see ?memory window base address register (offset 0x7c)? on page 341 ) is not set to a valid local memory address. doing so will cause the bcm57xx to hang. www.datasheet.in programmer?s guide bcm57xx 01/29/08 broadcom corporation document 57xx-pg105-r expansion rom registers (internal risc cpu view only) page 343 e xpansion rom r egisters (i nternal risc cpu view only ) e xpansion rom bar s ize r egister (o ffset 0 x 88) this register is not applicable to the bcm5700 or bcm5701 devices. this register is for internal cpu use only. e xpansion rom a ddress r egister (o ffset 0 x 8c) this register is not applicable to the bcm5700 or bcm5701 devices. this register is for internal cpu use only. table 187: expansion rom bar size register (0x88) bit field description init access 31-4 reserved reserved. 0 r/o 3-0 bar size 0000: 64 kb 0001: 128 kb 0010: 256 kb 0011: 512 kb 0100: 1 mb 0101: 2 mb 0110: 4 mb 0111: 8 mb 1000: 16 mb 0000 r/w? cpu none? pci table 188: expansion rom address register (offset 0x8c) bit field description init access 31 rom req. rom request. the pci interface block will set the rom req whenever it detects that the host is accessing the serial eprom memory space. 0r/ w?cpu 1 30-24 reserved reserved. 0 r/o 23-0 address expansion rom address. address field of the memory read transaction is loaded into this field if the address matches the expansion rom address space as defined by the expansion rom bar and size registers. the internal processors utilize this field to execute the rom read. 0r/ w?cpu 1 1. pci access via memory read command with the rom bar address. www.datasheet.in bcm57xx programmer?s guide 01/29/08 broadcom corporation page 344 vpd config register document 57xx-pg105-r e xpansion rom d ata r egister (o ffset 0 x 90) this register is not applicable to the bcm5700 or bcm5701 devices. this register is for internal cpu use only. vpd c onfig r egister vpd i nterface r egister (o ffset 0 x 94) this register is not applicable to the bcm5700 or bcm5701 devices. table 189: expansion rom data register (0x90) bit field description init access 31-0 data expansion rom data. loaded by the firmware after executing the rom read cycle. 0r/w? cpu table 190: vpd interface register (offset 0x94) bit field description init access 31-1 reserved reserved. 0 r/o 0 vpd req vpd request. set when the vpd flag/address register is written by the host. triggers a vpd event in the cpu event register in the grc. cleared by the internal cpu. writes by the host to the vpd flag register are not accepted while this bit is set. 0 r/w a a. not writable by pci configuration access. www.datasheet.in programmer?s guide bcm57xx 01/29/08 broadcom corporation document 57xx-pg105-r undi mailbox registers page 345 undi m ailbox r egisters undi r eceive bd s tandard p roducer r ing p roducer i ndex m ailbox (o ffset 0 x 98) this is an alternate view of the receive bd standard producer ring producer index mailbox from the mailboxes region. it is provided here to allow access from the pci configuration space. undi r eceive r eturn r ing c onsumer i ndex m ailbox (o ffset 0 x a0) this is an alternate view of the receive return ring 1 consumer index mailbox from the mailboxes region. it is provided here to allow access from the pci configuration space. undi s end bd p roducer i ndex m ailbox (o ffset 0 x a8) this is an alternate view of the send bd ring 1 nic producer index mailbox from the mailboxes region. it is provided here to allow access from the pci configuration space. table 191: undi receive bd standard producer ring producer index mailbox (offset 0x98) bit field description init access 63-0 undi rcv bd std. ring p_idx undi rcv bd std. ring producer index mailbox. 0h r/w table 192: undi receive return ring consumer index mailbox (offset 0xa0) bit field description init access 63-0 undi rcv return c_idx undi rcv return ring consumer index mailbox. 0h r/w table 193: undi send bd producer index mailbox (offset 0xa8) bit field description init access 63-0 undi send bd nic p_idx undi send bd nic producer index mailbox. 0h r/w www.datasheet.in bcm57xx programmer?s guide 01/29/08 broadcom corporation page 346 dual-mac control registers document 57xx-pg105-r d ual -mac c ontrol r egisters d ual -mac c ontrol r egister (o ffset 0 x b8) this register is applicable to the bcm5704c dual-mac transceiver and bcm5704s dual-mac transceiver serdes only. this register consists of three bits. bits 1-0 are used by the firmware to enable the bar and xbar registers in the each of the target blocks. in addition, these bits are used to determine the pci function number for each of the target blocks in the bcm5704c and bcm5704s. bit 2 is used to indicate the mac id. bits 1-0 of this register are also used in conjunction with the mac id (hardwired) to determine the pci function number for each of the mac?s target. this is shown in table 195 . table 194: dual-mac control register (offset 0xb8) bit field description init access 31-3 reserved 0 r/o 2 mac id ? 0: ch0 mac id ? 1: ch1 mac id hardwired value. r/o 1-0 channel ctl. ? 00: ch.0 and ch.1 enabled (default) ? 01: ch.1 enabled ? 10: ch. 0 enabled ? 11: ch 0 bar/xbar 00 r/w a a. not writable by pci configuration access. table 195: pci function number b2 b1 b0 mac0 func. no. mac1 func. no. function no. characteristic 0 0 0 0 - 0 mac0 and mac1 enabled 0 0 1 x - 1 mac0 disabled, mac1 enabled 0 1 0 0 - 0 mac1 disabled, mac0 enabled 0 1 1 0 - 0 mac0 and mac1 enabled but accessing to mac1 register/memory space using mac0?s xbar register 1 0 0 - 1 1 mac0 and mac1 enabled 1 0 1 - 0 0 mac0 disabled, mac1 enabled 1 1 0 - x 1 mac1 disabled, mac0 enabled 1 1 1 - x 1 mac0 and mac1 enabled but accessing to mac1 register/memory space using mac0?s xbar register www.datasheet.in programmer?s guide bcm57xx 01/29/08 broadcom corporation document 57xx-pg105-r dual-mac control registers page 347 mac f unction r egister (0xb8h) this register is applicable to the bcm5714 and bcm5715 devices only. this register is accessible to only internal cpu. mac m essage e xchange o utput r egister (o ffset 0 x bc) this register is applicable to the bcm5704, bcm5714, and bcm5715 devices only. note: when modified, this register should be written to same value in both the mac functions of the device. table 196: mac function register (0xb8h) bit field description init access 2-0 function select mac function modes: ? 000 = maca and macb enabled. ? 001 = macb enabled. ? 010 = maca enabled. ? 011 = maca enabled with xbar mode. ? 100 = maca and macb swapped. ? 111 = swapped turbo teaming mode. 0r/w table 197: mac message exchange output register (offset 0xbc) bit field description init access 31-0 msg out each mac consists of a 32-bit register that is used mainly to synchronize the macs during power-down operation. basically, mac0?s message exchange register is r/w from cpu0 and mac1?s message exchange register is r/w from cpu1. the output of the mac0?s message exchange register is sent to mac1 as a 32-bit discrete bus and vice versa. this is used mainly to enable each cpu to power down its mac based on the state of the mac message exchange input register from the other mac. - r/w 1 1. not writable by pci configuration access. www.datasheet.in bcm57xx programmer?s guide 01/29/08 broadcom corporation page 348 dual-mac control registers document 57xx-pg105-r mac m essage e xchange i nput r egister (o ffset 0 x c0) this register is applicable to the bcm5704, bcm5714, and bcm5715 mac controllers only. c ard b us pc c ard f unction r egister (o ffset 0 x c0) the following register is applicable to the bcm5721, bcm5751, and bcm5752 devices only. c ard b us pc c ard f unction e vent m ask r egister (o ffset 0 x c4) this register is applicable to the bcm5721, bcm5751, and bcm5752 devices only. table 198: mac message exchange input register (offset 0xc0) bit field description init access 31-0 msg in the content of the mac0 message exchange output register is sent to the mac1 as a discrete 32-bit bus input to the mac1. similarly, the content of the mac1 message exchange output register is sent to the mac0 as a discrete 32-bit bus input to the mac0. as a result, the content of the 32-bit input bus can be readable by the cpu. - r/w 1 1. not writable by pci configuration access. table 199: cardbus pc card function event register (offset 0xc0) bit field description init access 31-16 reserved - 0 r/o 15 intr this field is set to 1 whenever the interrupt field in the cardbus pc card function force event register (offset 0xcc) is set. 0w2c 14-5 reserved - 0 r/o 4 general wakeup this field is set to 1 whenever the general wakeup field in the cardbus pc card function present state register (offset 0xc8) changes its state from 0 to 1. 0w2c 3-0 reserved - 0 r/o table 200: cardbus pc card function event mask register (offset 0xc4) bit field description init access 31-16 reserved - 0 r/o 15 interrupt when this bit is set to 0, the device cannot assert cint# or wakeup. 0r/w 14 wakeup when this bit is set to 0, the device cannot assert wakeup. 0r/w 13-5 reserved - 0 r/o 4 general wakeup when this bit is set to 0, the device cannot assert wakeup. 0r/w 3-0 reserved - 0 r/o www.datasheet.in programmer?s guide bcm57xx 01/29/08 broadcom corporation document 57xx-pg105-r dual-mac control registers page 349 c ard b us pc c ard f unction p resent s tate r egister (o ffset 0 x c8) this register is applicable to the bcm5721, bcm5751, and bcm5752 devices only. c ard b us pc c ard f unction f orce e vent s tate r egister (o ffset 0 x cc) this register is applicable to the bcm5721, bcm5751, and bcm5752 devices only. table 201: cardbus pc card function present state register (offset 0xc8) bit field description init access 31-16 reserved - 0 r/o 15 interrupt this field reflects the internal state of a function specific interrupt request. 0r/o 14-5 reserved - 0 r/o 4 general wakeup this field reflects the current state of the wakeup event(s) that are not represented by interrupt, write protect, ready, or battery voltage detect fields. 0r/o 3-2 battery voltage detect this field reflects the current state of the card's battery. ? 11 = battery operational. ? 01 = battery needs to be replaced. ? 00, 01 = battery is not providing operational voltage. 11 r/o 1 ready when this field is read as: ? 1 = the function is ready to perform a new operation. ? 0 = the function is busy. 1r/o 0 write protect this field reflects the current state of the write protect switch. when this field is read as 1, the card is write protected. xr/o table 202: cardbus pc card function force event state register (offset 0xcc) bit field description init access 31-0 reserved - 0 r/o www.datasheet.in bcm57xx programmer?s guide 01/29/08 broadcom corporation page 350 pcie capabilities document 57xx-pg105-r pci e c apabilities this register is applicable to bcm5721, bcm5751, and bcm5752 devices only. pcie devices include new status and control registers that are located in the capabilities list in the device's pci configuration space. these pcie capabiliti es registers start at offset 0xd0 of pci configuration space. these registers appear in configuration space regardless of whether the device is operating in pcie mode. pci e c apability l ist r egister (o ffset 0 x d0) this eight-bit register identifies this item in the capabilities list as a pcie register set. this value is hardwired to 0x10 t o indicate the pcie capabilities set. this register is applicable to bcm5721, bcm5751, and bcm5752 devices only. pci e n ext c apabilities p ointer r egister (o ffset 0 x d1) this eight-bit register points to the next item in the capabilities list. this register is applicable to bcm5721, bcm5751, and bcm5752 devices only. pci e c apabilities r egister (o ffset 0 x d2) this register is applicable to bcm5721, bcm5751, and bcm5752 devices only. table 203: pcie capability id register (offset 0xd0) bit field description init access 7-0 pcie capability id identifies this item as pcie capabilities. 10h r/o table 204: pcie next capabilities pointer register (offset 0xd1) bit field description init access 7-0 pcie next capabilities points to the next capabilities block, which is null, because this is the last item in the capabilities list. 00h r/o table 205: pcie capabilities register (offset 0xd2) bit field description init access 15-14 reserved - 0 r/w 13-9 interrupt message number this register contains the msi data value that is written to the msi destination address when any status bit in either the slot status register or the root status register is set. 0 r/w 1 1. writable by internal processors. 8 slot implemented this register is hardwired to 0 because this is an endpoint device. 0 r/o 7-4 device/port type this register is hardwired to 0 because this is an endpoint device. 0 r/o 3-0 capability version this register indicates the version of the pcie capability structure. 1 r/o www.datasheet.in programmer?s guide bcm57xx 01/29/08 broadcom corporation document 57xx-pg105-r pcie capabilities page 351 d evice c apabilities r egister (o ffset 0 x d4) this register defines operational characteristics that are gl obally applicable to this device. this register is applicable to bcm5721, bcm5751, and bcm5752 devices only. table 206: device capabilities register (offset 0xd4) bit field description init access 31-28 reserved - 0r/o 27-26 captured slot power limit scale this value specifies the scale used for the power limit. ? 00 = 1.0x ? 01 = 0.1x ? 10 = 0.01x ? 11 = 0.001x 0r/o 25-18 captured slot power limit value this value specifies the upper limit on the power supplied for this device. 0 r/o 17-15 reserved - 0r/o 14 power indicator present when set to 1, this value indicates that a power indicator is implemented on this device. 0 r/w 1 13 attention indicator present when set to 1, this value indicates that an attention indicator is implemented for this device. 0r/w1 12 attention button present when set to 1, this value indicates that an attention button is implemented for this device. 0r/w1 11-9 endpoint l1 acceptable latency this value returns the latency that this device can accept when transitioning from the l1 to the l0 state. ? 000 = less than 1 s ? 001 = 1 s to less than 2 s ? 010 = 2 s to less than 4 s ? 011 = 4 s to less than 8 s ? 100 = 8 s to less than 16 s ? 101 = 16 s to less than 32 s ? 110 = 32 s to 64 s ? 111 = greater than 64 s 7h r/w1 8-6 endpoint l0s acceptable latency this value returns the total latency that this device can accept when transitioning from the l0s to l0 state. ? 000 = less than 64 ns ? 001 = 64 ns to less than 128 ns ? 010 = 128 ns to less than 256 ns ? 011 = 256 ns to less than 512 ns ? 100 = 512 ns to less than 1 s ? 101 = 1 s to less than 2 s ? 110 = 2 s to 4 s ? 111 = greater than 4 s 6h r/w1 5 extended tag field supported this value returns the maximum supported tag field size when this function acts as a requester. ? 0 = 5-bit tag field ? 1 = 8-bit tag field 1r/o 4-3 phantom functions supported this value is hardwired to 0 to indicate that this device only supports a single function. 0r/o www.datasheet.in bcm57xx programmer?s guide 01/29/08 broadcom corporation page 352 pcie capabilities document 57xx-pg105-r d evice c ontrol r egister (o ffset 0 x d8) this register is applicable to bcm5721, bcm5751, and bcm5752 devices only. 2-0 max payload size supported this value returns the maximum data payload size (in bytes) that this function supports for tlps. ? 0 = 128 ? 1 = 256 ? 2 = 512 ? 3 = 1024 ? 4 = 2048 ? 5 = 4096 ? 6,7 = reserved 5r/w1 1. writable by internal processors. table 207: device control register (offset 0xd8) bit field description init access 15 reserved - 0 r/w 14-12 max read request size this value controls the maximum read request size for this device when acting as the requester. 0x2 r/w 11 enable no snoop when this bit is set, the memory accessed by this device will not be cached by the processor. 1 0 (changed for a1) r/w 10 auxiliary power pm enable when this bit is set, this device is enabled to draw auxiliary power independent of pme power. 0r/o 9 phantom functions enable this bit is hardwired to 0 because this device does not support phantom functions. 0r/o 8 extended tag field enable when this bit is set, it enables this device to use an 8-bit tag field as a requester. 0r/w 7-5 max payload size 1 this value sets the maximum tlp data payload size (in bytes) for this device. ? 0 = 128 ? 1 = 256 ? 2 = 512 ? 3 = 1024 ? 4 = 2048 ? 5 = 4096 ? 6,7 = reserved 0r/w 4 enable relaxed ordering when this bit is set, this device is permitted to set the relaxed ordering bit. 1 0 (changed for a1) r/w 3 unsupported request reporting enable when this bit is set, unsupported request reporting is enabled. 0r/w 2 fatal error reporting enabled when this bit is set, fatal error reporting is enabled. 0 r/w table 206: device capabilities register (offset 0xd4) (cont.) bit field description init access www.datasheet.in programmer?s guide bcm57xx 01/29/08 broadcom corporation document 57xx-pg105-r pcie capabilities page 353 d evice s tatus r egister (o ffset 0 x da) this register is applicable to bcm5721, bcm5751, and bcm5752 devices only. 1 non-fatal error reporting enable when this bit is set, non-fatal error reporting is enabled. 0r/w 0 correctable error reporting enable when this bit is set, correctable error reporting is enabled. 0r/w 1. the host software should not set this field above the mps supported value of the device as advertised in bits 0-2 of register offset 0xd4. the bcm5721 and bcm5751 b1 (or previous chip versions) support only 128 mps bytes. the c0 (or later chip versions) of the bcm5721 and the bcm5751 support up to 512 bytes of mps. table 208: device status register (offset 0xda) bit field description init access 15-6 reserved - 0 r/w 5 transaction pending when this bit is set to 1, it indicates that this device has issued non-posted request packets which have not been completed. 0r/o 4 aux power detected when this bit is set, it indicates that aux power has been detected. r/o 3 unsupported request detected when this bit is set to 1, it indicates that an unsupported request has been received. 0w2c 2 fatal error detected when this bit is set to 1, it indicates that a fatal error has been detected. 0w2c 1 non-fatal error detected when this bit is set to 1, it indicates that a non-fatal error has been detected. 0w2c 0 correctable error detected when this bit is set to 1, it indicates that a correctable error has been detected. 0w2c table 207: device control register (offset 0xd8) (cont.) bit field description init access www.datasheet.in bcm57xx programmer?s guide 01/29/08 broadcom corporation page 354 pcie capabilities document 57xx-pg105-r l ink c apabilities r egister (o ffset 0 x dc) this register is applicable to bcm5721, bcm5751, and bcm5752 devices only. table 209: link capabilities register (offset 0xdc) bit field description init access 31-24 port number this value indicates the port number associated with this link. hwinit r/o 23-18 reserved ? 0 r/o 17-15 l1 exit latency this value returns the l1 exit latency for this link. 6 r/w 1 1. this register is writ able by the internal cpu. 14-12 l0s exit latency this value returns the l0s exit latency for this link. ? 0 = less that 64 ns ? 1 = less than 128 ns ? 2 = less than 256 ns ? 3 = less than 512 ns ? 4 = less than 1 s ? 5 = less than 2 s ? 6 = less than 4 s ? 7 = greater than 4 s 6r/w1 11-10 active state power management support this value returns the supported aspm states. ? 0 = reserved ? 1 = l0s supported ? 2 = reserved ? 3 = l0s and l1 supported 1r/w1 9-4 maximum link width this value returns the maximum link width. allowable values are 1, 2, 4, 8, 12, 16, and 32 only. all other values are reserved. 1r/w1 3-0 maximum link speed this value returns the maximum link speed. 1 = 2.5 gbps. all other values reserved. 1r/w1 www.datasheet.in programmer?s guide bcm57xx 01/29/08 broadcom corporation document 57xx-pg105-r pcie capabilities page 355 l ink c ontrol r egister (o ffset 0 x e0) this register is applicable to bcm5721, bcm5751, and bcm5752 devices only. l ink s tatus c ommand r egister (o ffset 0 x e2) this register is applicable to bcm5721, bcm5751, and bcm5752 devices only. table 210: link control register (offset 0xe0) bit field description init access 15-8 reserved - 0 r/o 7 extended synch when this bit is set, it forces extended sync which gives external devices (such as logic analyzers) additional time to achieve bit and symbol lock. 0r/w 6 common clock configuration when this bit is set, it indicates that the link partners are using a common reference clock. 0r/w 5-4 reserved - 0 r/o 3 read completion boundary this value indicates the read completion boundary value (in bytes) of the upstream root port. ? 0 = 64 ? 1 = 128 0r/w 2 reserved - 0 r/o 1-0 active state power management control this value controls the active state power management supported on this link. ? 0 = disabled ? 1 = l0s entry enabled ? 2 = l1 entry enabled ? 3 = l0s and l1 entry enabled 0r/w table 211: link status command register (offset 0xe2) bit field description init access 15-13 reserved - 0 r/o 12 slot clock configuration this value indicates that this device uses the same physical reference clock that the platform provides on the connector. r/o 11-10 reserved - 0 r/o 9-4 negotiated link width this value returns the negotiated link width. the only valid values are 1, 2, 4, 8, 12, 16, and 32. 1r/o 3-0 link speed this value returns the negotiated link speed. 1 = 2.5 gbps. 1 r/o www.datasheet.in bcm57xx programmer?s guide 01/29/08 broadcom corporation page 356 pcie enhanced capabilities document 57xx-pg105-r pci e e nhanced c apabilities these registers are applicable to bcm5721, bcm5751, and bcm5752 devices only. pcie devices may optionally support a new configuration space that provides an additional 4 kb of configuration registers per device. this enhanced configuration space is mapped into host memory through a 256 mb window (enabled through the root complex) that provides access to the 4 kb enhanced configuration space for each of the 64k possible pcie devices. refer to the pcie specification for additional details on how to access the enhanced configuration space. the offsets listed for the following registers indicate the offset from the beginning of the enhanced configuration space for that device. a dvanced e rror r eporting e nhanced c apability h eader r egister (o ffset 0 x 100) this register is applicable to bcm5721, bcm5751, and bcm5752 devices only. u ncorrectable e rror s tatus r egister (o ffset 0 x 104) this register is applicable to bcm5721, bcm5751, and bcm5752 devices only. table 212: advanced error reporting enhanced capability header register (offset 0x100) bit field description init access 31-20 next capability offset pointer to the virtual channel capability structure 0x13c r/o 19-16 capability version this value indicates the version of this enhanced capability header. 1r/o 15-0 extended capability id this value indicates the type of enhanced capability header for this block and is hard-wired to one to indicate the advanced error reporting capability. 1r/o table 213: uncorrectable error status register (offset 0x104) bit field description init access 31-21 reserved - 0 r/o 20 unsupported request error status this bit is set when an unsupported request error occurs. 0w2c 19 ecrc error status this bit is set when an ecrc error occurs. 0 w2c 18 malformed tlp status this bit is set when a malformed tlp error occurs. 0 w2c 17 receiver overflow status this bit is set when a receiver overflow error occurs. 0 w2c 16 unexpected completion status this bit is set when an unexpected completion error occurs. 0w2c 15 completer abort status this bit is set when a completer abort error occurs. 0 w2c 14 completion timeout status this bit is set when a completion timeout error occurs. 0 w2c www.datasheet.in programmer?s guide bcm57xx 01/29/08 broadcom corporation document 57xx-pg105-r pcie enhanced capabilities page 357 u ncorrectable e rror m ask r egister (o ffset 0 x 108) this register is applicable to bcm5721, bcm5751, and bcm5752 devices only. 13 flow control protocol error status this bit is set when a flow control protocol error occurs. 0 w2c 12 poisoned tlp status this bit is set when a poisoned tlp error occurs. 0 w2c 11-5 reserved - 0 r/o 4 data link protocol error status this bit is set when a data link protocol error occurs. 0 w2c 3-1 reserved - 0 r/o 0 training error status this bit is set when a training error occurs. 0 w2c table 214: uncorrectable error mask register (offset 0x108) bit field description init access 31-21 reserved 0r/o 20 unsupported request error mask setting this bit will mask unsupported request errors. 0 r/w 19 ecrc error mask setting this bit will mask ecrc errors. 0 r/w 18 malformed tlp mask setting this bit will mask malformed tlp errors. 0 w2c 17 receiver overflow mask setting this bit will mask receiver overflow errors. 0 r/w 16 unexpected completion mask setting this bit will mask unexpected completion errors. 0 r/w 15 completer abort mask setting this bit will mask completer abort errors. 0 r/w 14 completion timeout mask setting this bit will mask completion timeout errors. 0 r/w 13 flow control protocol error mask setting this bit will mask flow control protocol errors. 0 r/w 12 poisoned tlp mask setting this bit will mask poisoned tlp errors. 0 r/w 11-5 reserved - 0 r/o 4 data link protocol error mask setting this bit will mask data link protocol errors. 0 r/w 3-1 reserved - 0 r/o 0 training error mask setting this bit will mask training errors. 0 r/w table 213: uncorrectable error status register (offset 0x104) (cont.) bit field description init access www.datasheet.in bcm57xx programmer?s guide 01/29/08 broadcom corporation page 358 pcie enhanced capabilities document 57xx-pg105-r u ncorrectable e rror s everity r egister (o ffset 0 x 10c) this register is applicable to bcm5721, bcm5751, and bcm5752 devices only. table 215: uncorrectable error severity register (offset 0x10c) bit field description init access 31-21 reserved - 0 r/o 20 unsupported request error severity this bit controls the severity when an unsupported request error occurs. ? 0 = non-fatal ? 1 = fatal 0r/w 19 ecrc error status this bit controls the severity when an ecrc error occurs. ? 0 = non-fatal ? 1 = fatal 0r/w 18 malformed tlp status this bit controls the severity when a malformed tlp error occurs. ? 0 = non-fatal ? 1 = fatal 1w2c 17 receiver overflow status this bit controls the severity when a receiver overflow error occurs. ? 0 = non-fatal ? 1 = fatal 1r/w 16 unexpected completion status this bit controls the severity when an unexpected completion error occurs. ? 0 = non-fatal ? 1 = fatal 0r/w 15 completer abort status this bit controls the severity when a completer abort error occurs. ? 0 = non-fatal ? 1 = fatal 0r/w 14 completion timeout status this bit controls the severity when a completion timeout error occurs. ? 0 = non-fatal ? 1 = fatal 0r/w 13 flow control protocol error status this bit controls the severity when a flow control protocol error occurs. ? 0 = non-fatal ? 1 = fatal 1r/w 12 poisoned tlp status this bit controls the severity when a poisoned tlp error occurs. ? 0 = non-fatal ? 1 = fatal 0r/w 11-5 reserved - 0 r/o 4 data link protocol error status this bit controls the severity when a data link protocol error occurs. ? 0 = non-fatal ? 1 = fatal 1r/w www.datasheet.in programmer?s guide bcm57xx 01/29/08 broadcom corporation document 57xx-pg105-r pcie enhanced capabilities page 359 c orrectable e rror s tatus r egister (o ffset 0 x 110) this register is applicable to bcm5721, bcm5751, and bcm5752 devices only. c orrectable e rror m ask r egister (o ffset 0 x 114) this register is applicable to bcm5721, bcm5751, and bcm5752 devices only. 3-1 reserved - 0 r/o 0 training error status this bit controls the severity when a training error occurs. ? 0 = non-fatal ? 1 = fatal 1r/w table 216: correctable error status register (offset 0x110) bit field description init access 31-13 reserved - 0 r/o 12 replay timer timeout status this bit is set when a replay timer timeout error occurs. 0 w2c 11-9 reserved - 0 r/o 8 replay_num rollover status this bit is set when a replay_num rollover error occurs. 0w2c 7 bad dllp status this bit is set when a bad dllp error occurs. 0 w2c 6 bad tlp status this bit is set when a bad tlp error occurs. 0 w2c 5-1 reserved - 0 r/o 0 receiver error status this bit is set when a receiver error occurs. 0 w2c table 217: correctable error mask register (offset 0x114) bit field description init access 31-13 reserved - 0 r/o 12 replay timer timeout mask setting this bit will mask replay timer timeout errors. 0 r/w 11-9 reserved - 0 r/o 8 replay_num rollover mask setting this bit will mask replay_num rollover errors. 0 r/w 7 bad dllp mask setting this bit will mask bad dllp errors. 0 r/w 6 bad tlp mask setting this bit will mask bad tlp errors. 0 r/w 5-1 reserved - 0 r/o 0 receiver error mask setting this bit will mask receiver errors. 0 r/w table 215: uncorrectable error severity register (offset 0x10c) (cont.) bit field description init access www.datasheet.in bcm57xx programmer?s guide 01/29/08 broadcom corporation page 360 pcie enhanced capabilities document 57xx-pg105-r a dvanced e rror c apabilities and c ontrol r egister (o ffset 0 x 118) this register is applicable to bcm5721, bcm5751, and bcm5752 devices only. h eader l og r egister (o ffset 0 x 118-0 x 12 b ) these registers are applicable to bcm5721, bcm5751, and bcm5752 devices only. the header log register stores the tlp header of the transaction that has incurred a failure. v irtual c hannel e nhanced c apability h eader (o ffset 0 x 13 c ) table 218: advanced error capabilities and control register (offset 0x118) bit field description init access 31-9 reserved - 0 r/o 8 ecrc check enable setting this bit will enable ecrc checking. 0 r/w 7 ecrc check capable when this bit is set, it indicates that this device supports ecrc checking. 1r/o 6 ecrc generation enable setting this bit will enable ecrc generation. 0 r/w 5 ecrc generation capable when this bit is set, it indicates that this device supports ecrc generation. 1r/o 4-0 first error pointer this value indicates the bit position within the ?uncorrectable error status register (offset 0x104)? on page 356 corresponding to the first error detected. 0r/o table 219: virtual channel enhanced capability header (offset 0x13c) name bits access default value description pcie extended capability id 15:0 ro 0x0002 extended capability id for the virtual channel capability is 0002h capability version 19:16 ro 0x1 next capability offset 31:20 ro 0x160 note: this register is applicable to bcm5721, bcm5751, and bcm5752 devices only. www.datasheet.in programmer?s guide bcm57xx 01/29/08 broadcom corporation document 57xx-pg105-r pcie enhanced capabilities page 361 p ort vc c apability r egister (o ffset 0 x 140) p ort vc c apability r egister 2 (o ffset 0 x 144) p ort vc c ontrol r egister (o ffset 0 x 148) table 220: port vc capability register (offset 0x140) name bits access default value description extended vc count 2:0 ro 0x0 only default vc is supported low priority extended vc count 6:4 ro 0x0 only default vc is supported reference clock 9:8 ro 0x0 must be set to 0 for endpoint devices port arbitration table entry size 11:10 ro 0x0 must be set to 0 for endpoint devices note: this register is applicable to bcm5721, bcm5751, and bcm5752 devices only. table 221: port vc capability register 2 (offset 0x144) name bits access default value description vc arbitration capability 7:0 ro 0x00 field not valid when low priority extended vc count = 0. vc arbitration table offset 31:24 ro 0x00 table not present. note: this register is applicable to bcm5721, bcm5751, and bcm5752 devices only. table 222: port vc control register (offset 0x148) name bits access default value description load vc arbitration table 0 ro 0 not supported vc arbitration select 3:1 ro 0x0 not supported note: this register is applicable to bcm5721, bcm5751, and bcm5752 devices only. www.datasheet.in bcm57xx programmer?s guide 01/29/08 broadcom corporation page 362 pcie enhanced capabilities document 57xx-pg105-r p ort vc s tatus r egister (o ffset 0 x 14 a ) vc r esource c apability r egister (o ffset 0 x 14 c ) vc r esource c ontrol r egister (o ffset 0 x 150) table 223: port vc status register (offset 0x14a) name bits access default value description vc arbitration table status 0 ro 0 not supported note: this register is applicable to bcm5721, bcm5751, and bcm5752 devices only. table 224: vc resource capability register (offset 0x14c) name bits access default value description port arbitration capability 7:0 ro 0x00 must be set to 0 for endpoint devices advanced packet switching 14 ro 0 vc may be used for non-as packet traffic reject snoop transactions 15 ro 0 must be set to 0 for endpoint devices maximum time slots 22:16 ro 0x00 must be set to 0 for endpoint devices port arbitration table offset 31:24 ro 0x00 must be set to 0 for endpoint devices note: this register is applicable to bcm5721, bcm5751, and bcm5752 devices only. table 225: vc resource control register (offset 0x150) name bits access default value description tc/vc map 7:0 rw 0xff a 1 at bit n indicates that tc n is mapped to vc0 (bit 0 is read only and is hardwired to 1) load port arbitration table 16 ro 0 must be set to 0 for endpoint devices port arbitration select 19:17 ro 0x0 must be set to 0 for endpoint devices vc id 26:24 ro 0x0 default vc = 0 vc enable 31 ro 1 default vc is always enabled note: this register is applicable to bcm5721, bcm5751, and bcm5752 devices only. www.datasheet.in programmer?s guide bcm57xx 01/29/08 broadcom corporation document 57xx-pg105-r pcie enhanced capabilities page 363 vc r esource s tatus r egister (o ffset 0 x 156) d evice s erial n o e nhanced c apability h eader r egister (o ffset 0 x 160) d evice s erial n o l ower dw r egister (o ffset 0 x 164) table 226: vc resource status register (offset 0x156) name bits access default value description port arbitration table status 0 ro 0 must be set to 0 for endpoint devices vc negotiation pending 1 ro 0 1 = flow control initialization for default vc still in progress (this bit always returns 0) note: this register is applicable to bcm5721, bcm5751, and bcm5752 devices only. table 227: device serial no enhanced capability header register (offset 0x160) name bits access default value description next capability offset 31:20 ro 0x16c revision id 19:16 ro 0x1 pcie capability id 15:0 ro 0x0003 note: this register is applicable to bcm5721, bcm5751, and bcm5752 devices only. table 228: device serial no lower dw register (offset 0x164) name bits access default value description reserved 31:24 ro 0xfe lower mac address 23:0 ro 0xffffff mac address(23:0) note: this register is applicable to bcm5721, bcm5751, and bcm5752 devices only. www.datasheet.in bcm57xx programmer?s guide 01/29/08 broadcom corporation page 364 pcie enhanced capabilities document 57xx-pg105-r d evice s erial n o u pper dw r egister (o ffset 0 x 168) p ower b udgeting e nhanced c apability h eader r egister (o ffset 0 x 16c) power budgeting data select register (offset 0x170) table 229: device serial no upper dw register (offset 0x168) name bits access default value description upper mac address 31:8 ro 0xffffff mac address(47:24) reserved 7:0 ro 0xff note: this register is applicable to bcm5721, bcm5751, and bcm5752 devices only. table 230: power budgeting enhanced capability header register (offset 0x16c) name bits access default value description next capability offset 31:20 ro 0x000 revision id 19:16 ro 0x1 pcie capability id 15:0 ro 0x0004 note: this register is applicable to bcm5721, bcm5751, and bcm5752 devices only. table 231: power budgeting data select register (offset 0x170) name bits access default value description reserved 31:8 ro 0x000000 data select 31:0 rw from internal cpu 0x00 index power budgeting data reported through the data register note: this register is applicable to bcm5721, bcm5751, and bcm5752 devices only. www.datasheet.in programmer?s guide bcm57xx 01/29/08 broadcom corporation document 57xx-pg105-r pcie enhanced capabilities page 365 p ower b udgeting d ata r egister (o ffset 0 x 174) p ower b udgeting c apability r egister (o ffset 0 x 178) table 232: power budgeting data register (offset 0x174) name bits access default value description reserved 31:21 ro power rail 20:18 rw from internal cpu specifies the power rail of the operating condition 12v (000) 3.3v (001) 1.8v (010) thermal (111) type 17:15 rw from internal cpu specifies the type of the operating condition pme aux (000) auxiliary (001) idle (010) sustained (010) maximum (111) pm state 14:13 rw from internal cpu specifies the power management state of operating condition: d0, d3 pm sub state 12:10 ro 000 specifies the sub states of the operating condition data scale 9:8 ro 0x0 specifies the scale to apply to the base power value base power 7:0 rw from internal cpu specifies in watts the base power value in a given operating conditions note: this register is applicable to bcm5721, bcm5751, and bcm5752 devices only. table 233: power budgeting capability register (offset 0x178) name bits access default value description reserved 31:8 ro 0x000000 lom configuration 7:0 rw from internal cpu indicate that the power budget for the device is included within the system power budget derived from nvram configuration if configured as lom, then write 1 to bit 5 of 0x7c04 else write 0 note: this register is applicable to bcm5721, bcm5751, and bcm5752 devices only. www.datasheet.in bcm57xx programmer?s guide 01/29/08 broadcom corporation page 366 pcie enhanced capabilities document 57xx-pg105-r f irmware p ower b udgeting r egister 1 (o ffset 0 x 17c) f irmware p ower b udgeting r egister 2 (o ffset 0 x 17d) table 234: firmware power budgeting register 1 (offset 0x17c) name bits access default value description power rail 15:13 rw from internal cpu specifies the power rail of the operating condition 12v (000) 3.3v (001) 1.8v (010) thermal (111) type 12:10 rw from internal cpu specifies the type of the operating condition pme aux (000) auxiliary (001) idle (010) sustained (010) maximum (111) pm state 9:8 rw from internal cpu specifies the power management state of operating condition: d0, d3 base power 7:0 rw from internal cpu specifies in watts the base power value in a given operating conditions note: this register is applicable to bcm5721, bcm5751, and bcm5752 devices only. table 235: firmware power budgeting register 2 (offset 0x17d) name bits access default value description power rail 15:13 rw from internal cpu specifies the power rail of the operating condition 12v (000) 3.3v (001) 1.8v (010) thermal (111) type 12:10 rw from internal cpu specifies the type of the operating condition pme aux (000) auxiliary (001) idle (010) sustained (010) maximum (111) pm state 9:8 rw from internal cpu specifies the power management state of operating condition: d0, d3 base power 7:0 rw from internal cpu specifies in watts the base power value in a given operating conditions note: this register is applicable to bcm5721, bcm5751, and bcm5752 devices only. www.datasheet.in programmer?s guide bcm57xx 01/29/08 broadcom corporation document 57xx-pg105-r pcie enhanced capabilities page 367 f irmware p ower b udgeting r egister 3 (o ffset 0 x 180) f irmware p ower b udgeting r egister 4 (o ffset 0 x 182) table 236: firmware power budgeting register 3 (offset 0x180) name bits access default value description power rail 15:13 rw from internal cpu specifies the power rail of the operating condition 12v (000) 3.3v (001) 1.8v (010) thermal (111) type 12:10 rw from internal cpu specifies the type of the operating condition pme aux (000) auxiliary (001) idle (010) sustained (010) maximum (111) pm state 9:8 rw from internal cpu specifies the power management state of operating condition: d0, d3 base power 7:0 rw from internal cpu specifies in watts the base power value in a given operating conditions note: this register is applicable to bcm5721, bcm5751, and bcm5752 devices only. table 237: firmware power budgeting register 4 (offset 0x182) name bits access default value description power rail 15:13 rw from internal cpu specifies the power rail of the operating condition 12v (000) 3.3v (001) 1.8v (010) thermal (111) type 12:10 rw from internal cpu specifies the type of the operating condition pme aux (000) auxiliary (001) idle (010) sustained (010) maximum (111) pm state 9:8 rw from internal cpu specifies the power management state of operating condition: d0, d3 base power 7:0 rw from internal cpu specifies in watts the base power value in a given operating conditions note: this register is applicable to bcm5721, bcm5751, and bcm5752 devices only. www.datasheet.in bcm57xx programmer?s guide 01/29/08 broadcom corporation page 368 pcie enhanced capabilities document 57xx-pg105-r f irmware p ower b udgeting r egister 5 (o ffset 0 x 184) f irmware p ower b udgeting r egister 6 (o ffset 0 x 186) table 238: firmware power budgeting register 5 (offset 0x184) name bits access default value description power rail 15:13 rw from internal cpu specifies the power rail of the operating condition 12v (000) 3.3v (001) 1.8v (010) thermal (111) type 12:10 rw from internal cpu specifies the type of the operating condition pme aux (000) auxiliary (001) idle (010) sustained (010) maximum (111) pm state 9:8 rw from internal cpu specifies the power management state of operating condition: d0, d3 base power 7:0 rw from internal cpu specifies in watts the base power value in a given operating conditions note: this register is applicable to bcm5721, bcm5751, and bcm5752 devices only. table 239: firmware power budgeting register 6 (offset 0x186) name bits access default value description power rail 15:13 rw from internal cpu specifies the power rail of the operating condition 12v (000) 3.3v (001) 1.8v (010) thermal (111) type 12:10 rw from internal cpu specifies the type of the operating condition pme aux (000) auxiliary (001) idle (010) sustained (010) maximum (111) pm state 9:8 rw from internal cpu specifies the power management state of operating condition: d0, d3 base power 7:0 rw from internal cpu specifies in watts the base power value in a given operating conditions note: this register is applicable to bcm5721, bcm5751, and bcm5752 devices only. www.datasheet.in programmer?s guide bcm57xx 01/29/08 broadcom corporation document 57xx-pg105-r pcie enhanced capabilities page 369 f irmware p ower b udgeting r egister 7 (o ffset 0 x 188) f irmware p ower b udgeting r egister 8 (o ffset 0 x 18a) table 240: firmware power budgeting register 7 (offset 0x188) name bits access default value description power rail 15:13 rw from internal cpu specifies the power rail of the operating condition 12v (000) 3.3v (001) 1.8v (010) thermal (111) type 12:10 rw from internal cpu specifies the type of the operating condition pme aux (000) auxiliary (001) idle (010) sustained (010) maximum (111) pm state 9:8 rw from internal cpu specifies the power management state of operating condition: d0, d3 base power 7:0 rw from internal cpu specifies in watts the base power value in a given operating conditions note: this register is applicable to bcm5721, bcm5751, and bcm5752 devices only. table 241: firmware power budgeting register 8 (offset 0x18a) name bits access default value description power rail 15:13 rw from internal cpu specifies the power rail of the operating condition 12v (000) 3.3v (001) 1.8v (010) thermal (111) type 12:10 rw from internal cpu specifies the type of the operating condition pme aux (000) auxiliary (001) idle (010) sustained (010) maximum (111) pm state 9:8 rw from internal cpu specifies the power management state of operating condition: d0, d3 base power 7:0 rw from internal cpu specifies in watts the base power value in a given operating conditions note: this register is applicable to bcm5721, bcm5751, and bcm5752 devices only. www.datasheet.in bcm57xx programmer?s guide 01/29/08 broadcom corporation page 370 high-priority mailboxes document 57xx-pg105-r r eset c ount r egister (o ffset 0 x 158) this debug register is only applicable to bcm5752. h igh -p riority m ailboxes this is a 512-byte region that contains 64 registers. these mailbox registers are: ? 64 bits for the bcm5700 mac and bcm5701 mac transceivers. ? 32 bits for the rest of the bcm57xx family. these registers are called high-priority mailbox registers (or high-priority mailboxes). when a value is stored in the least significant 32 bits of these registers, an event (known as a high-priority mailbox event) is generated to the one of the rx risc or tx risc. to write 64 bits of a mailbox location, the upper 32 bits should be written to before the lower 32 bits. ? in bcm5702 and later devices, the upper 32 bits are not used. for compatibility across the bcm57xx family, access only the lower 32 bits. ? in bcm5705, bcm5788, bcm5721, bcm5751, bcm5752, bcm5714, and bcm5715 devices, only interrupt mailbox 0 is supported. these controllers support only one send ring, one receive producer ring, and one receive return ring. table 242: reset count register (offset 0x158) bit field description init access 31-24 link down reset counts link down reset events. n/a r/w\ 23-16 phy hot reset counts phy hot reset events n/a r/w 15-8 grc reset counts grc reset events n/a r/w 7-0 por reset counts por reset events n/a r/w table 243: high-priority mailbox structure offset 31 24 23 0 0x00 status tag in isr 0x04 not used in the bcm5702 mac transceiver and later note: the high-priority mailbox registers are for host standard and flat modes only. for the indirect register access mode, access the mailboxes via the low-priority mailboxes (see ?low-priority mailboxes? on page 490 ). table 244: high-priority mailbox registers offset registers 0x200-0x207 interrupt mailbox 0 0x208-0x20f interrupt mailbox 1 0x210-0x217 interrupt mailbox 2 0x218-0x21f interrupt mailbox 3 0x220-0x227 general mailbox 1 0x228-0x22f general mailbox 2 www.datasheet.in programmer?s guide bcm57xx 01/29/08 broadcom corporation document 57xx-pg105-r high-priority mailboxes page 371 0x230-0x237 general mailbox 3 0x238-0x23f general mailbox 4 0x240-0x247 general mailbox 5 0x248-0x24f general mailbox 6 0x250-0x257 general mailbox 7 0x258-0x25f general mailbox 8 0x260-0x267 reserved 0x268-0x26f receive bd standard producer ring producer index 0x270-0x277 receive bd jumbo producer ring producer index 0x278-0x27f receive bd mini producer ring producer index 0x280-0x287 receive bd return ring 1 consumer index 0x288-0x28f receive bd return ring 2 consumer index 0x290-0x297 receive bd return ring 3 consumer index 0x298-0x29f receive bd return ring 4 consumer index 0x2a0-0x2a7 receive bd return ring 5 consumer index 0x2a8-0x2af receive bd return ring 6 consumer index 0x2b0-0x2b7 receive bd return ring 7 consumer index 0x2b8-0x2bf receive bd return ring 8 consumer index 0x2c0-0x2c7 receive bd return ring 9 consumer index 0x2c8-0x2cf receive bd return ring 10 consumer index 0x2d0-0x2d7 receive bd return ring 11 consumer index 0x2d8-0x2df receive bd return ring 12 consumer index 0x2e0-0x2e7 receive bd return ring 13 consumer index 0x2e8-0x2ef receive bd return ring 14 consumer index 0x2f0-0x2f7 receive bd return ring 15 consumer index 0x2f8-0x2ff receive bd return ring 16 consumer index 0x300-0x307 send bd ring 1 host producer index 0x308-0x30f send bd ring 2 host producer index 0x310-0x317 send bd ring 3 host producer index 0x318-0x31f send bd ring 4 host producer index 0x320-0x327 send bd ring 5 host producer index 0x328-0x32f send bd ring 6 host producer index 0x330-0x337 send bd ring 7 host producer index 0x338-0x33f send bd ring 8 host producer index 0x340-0x347 send bd ring 9 host producer index 0x348-0x34f send bd ring 10 host producer index 0x350-0x357 send bd ring 11 host producer index 0x358-0x35f send bd ring 12 host producer index 0x360-0x367 send bd ring 13 host producer index table 244: high-priority mailbox registers (cont.) offset registers www.datasheet.in bcm57xx programmer?s guide 01/29/08 broadcom corporation page 372 high-priority mailboxes document 57xx-pg105-r i nterrupt m ailbox 0 r egister (o ffset 0 x 200) this mailbox register provides two functions: ? whenever the host writes to this register, the interrupt state is cleared, regardless of what value is written to this register. this applies to both the internal interrupt state, and the maskable external interrupt state (inta ). for instance, if an interrupt-causing event had previously occurred, but interrupts were masked (i.e., the mask interrupt bit in the miscellaneous host control register was set when the event occurred), an interrupt would be pending internally. however, writing any value to interrupt mailbox 0, would clear that internally pending interrupt. thus, when interrupts were later unmasked, inta would not be asserted due to that event, because the event would have been cleared by the write to this register. ? whenever in_isr bits in this register contain a nonzero value, it indicates to the bcm57xx family that host software is in its interrupt processing routine (isr). this causes t he device to use the during interrupt coalescing registers as opposed to the non-during interrupt coalescing registers. in addition, since the device thinks the host is running its isr, the device will not assert an interrupt if a status block is written back while this register contains a nonzero value. this provides host software with the flexibility of another mechanism to reduce interrupts (see ?host coalescing control registers? on page 450 ). since interrupts are prevented when this register is a nonzero value, and since interrupts are cleared whenever this register is written (even if it is written to 0), care must be taken by the host driver to ensure that events that normally cause interr upts are not lost. in other words, if this register is set to a nonzero value during the isr, and then set to 0 near the end of the isr, host software should ensure that any events that occurred while in the isr are noted. the host could do this by checking the status block again at the bottom of the isr and scheduling another interrupt processing routine if the status block was updated with events that had not been previously handled by the host driver (see ?interrupt processing (not applicable to bcm5700)? on page 296 ). 0x368-0x36f send bd ring 14 host producer index 0x370-0x377 send bd ring 15 host producer index 0x378-0x37f send bd ring 16 host producer index 0x380-0x387 send bd ring 1 nic producer index 0x388-0x38f send bd ring 2 nic producer index 0x390-0x397 send bd ring 3 nic producer index 0x398-0x39f send bd ring 4 nic producer index 0x3a0-0x3a7 send bd ring 5 nic producer index 0x3a8-0x3af send bd ring 6 nic producer index 0x3b0-0x3b7 send bd ring 7 nic producer index 0x3b8-0x3bf send bd ring 8 nic producer index 0x3c0-0x3c7 send bd ring 9 nic producer index 0x3c8-0x3cf send bd ring 10 nic producer index 0x3d0-0x3d7 send bd ring 11 nic producer index 0x3d8-0x3df send bd ring 12 nic producer index 0x3e0-0x3e7 send bd ring 13 nic producer index 0x3e8-0x3ef send bd ring 14 nic producer index 0x3f0-0x3f7 send bd ring 15 nic producer index 0x3f8-0x3ff send bd ring 16 nic producer index table 244: high-priority mailbox registers (cont.) offset registers www.datasheet.in programmer?s guide bcm57xx 01/29/08 broadcom corporation document 57xx-pg105-r high-priority mailboxes page 373 o ther i nterrupt m ailbox r egisters (o ffset 0 x 208-0 x 218) these registers are not applicable to the bcm5705, bcm5788, bcm5721, bcm5751, bcm5751, bcm5714, and bcm5715 devices. these registers provide one of the two pieces of functionality that interrupt mailbox 0 provides. specifically, if these registers are set to a nonzero value, they indicate to the device that host is in its isr. this has the same effect as when interrupt mailbox 0 is set to a nonzero value. however, writing any value to mailboxes 1-7 does not clear interrupts. if a mailbox is zero, however, this indicates the host is not in the interrupt handler. the host coalescing engine uses this information to determine which set of coalescing parameters it should use (see ?host coalescing control registers? on page 450 ). g eneral m ailbox r egisters 1-8 (o ffset 0 x 220-0 x 258) these registers are not applicable to the bcm5705, bcm5788, bcm5721, bcm5751, bcm5751, bcm5714, and bcm5715 devices. these are general-purpose mailboxes that are available for use by the riscs. r eceive bd s tandard p roducer r ing i ndex r egister (o ffset 0 x 268) the receive bd standard producer ring index register contains the index of the next buffer descriptor for the standard producer ring that will be produced in the host for the nic to dma into nic memory. host software writes this register whenever it updates the standard producer ring. this register must be initialized to 0. r eceive bd j umbo p roducer r ing i ndex r egister (o ffset 0 x 270) these registers are not applicable to the bcm5705, bcm5788, bcm5721, bcm5751, bcm5751, bcm5714, and bcm5715 devices. the receive bd jumbo producer ring index register contains the index of the next buffer descriptor for the jumbo producer ring that will be produced in the host for the nic to dma into nic memory. host software writes this register whenever it updates the jumbo producer ring. this register must be initialized to 0. r eceive bd m ini p roducer r ing i ndex r egister (o ffset 0 x 278) this is only applicable to bcm5700 device. the receive bd mini producer ring index register contains the index of the next buffer descriptor for the mini producer ring that will be produced in the host for the nic to dma into nic memory. host software writes this register whenever it updates the mini producer ring. this register must be initialized to 0. r eceive bd r eturn r ing 1-16 c onsumer i ndices r egisters (o ffset 0 x 280-0 x 2f8) the receive bd return ring index register contains the index of last the buffer descriptor for a given return ring that has been consumed. host software writes this register whenever it updates the given return ring. this register must be initialized to 0. because the bcm5705, bcm5788, bcm5721, bcm5751, bcm5752, bcm5714, and bcm5715 devices only support a single receive bd return ring, register offsets 0x288 to 0x2f8 are reserved for these controllers. www.datasheet.in bcm57xx programmer?s guide 01/29/08 broadcom corporation page 374 high-priority mailboxes document 57xx-pg105-r s end bd r ing 1-16 h ost p roducer i ndices r egisters (o ffset 0 x 300-0 x 378) the send bd ring host producer index register contains the index of the next buffer descriptor for a given send ring that will be produced in the host for the nic to dma into nic memory. host software writes this register whenever it updates the given send ring. this register must be initialized to 0. the host producer indices may not be used at the same time as the nic producer indices. because the bcm5705, bcm5788, bcm5721, bcm5751, bcm5752, bcm5714, and bcm5715 devices only support a single send ring, register offsets 0x308 to 0x378 are reserved for these controllers. s end bd r ing 1-16 nic p roducer i ndices r egisters (o ffset 0 x 380-0 x 3f8) the send bd ring nic producer index register contains the index of the next buffer descriptor for a given send ring that will be produced in the host directly into nic memory. host software writes this register whenever it updates the given send ring. this register must be initialized to 0. the host producer in dices may not be used at the same time as the nic producer indices. because the bcm5705, bcm5788, bcm5721, bcm5751, bcm5752, bcm5714, and bcm5715 devices only support a single send ring, register offsets 0x388 to 0x3f8 are reserved for these controllers. www.datasheet.in programmer?s guide bcm57xx 01/29/08 broadcom corporation document 57xx-pg105-r ethernet mac control registers page 375 e thernet mac c ontrol r egisters these registers are used to control the operation of the ethernet mac. there are several parameters which are available for performance and compatibility tuning. table 245: ethernet mac control registers offset registers init 0x400-0x403 ethernet mac mode 0x00000008 0x404-0x407 ethernet mac status 0x00000000 0x408-0x40b ethernet mac event enable 0x00000000 0x40c-0x40f led control 0x82000000 0x410-0x413 mac address high 1 0x00000000 0x414-0x417 mac address low 1 0x00000000 0x418-0x41b mac address high 2 0x00000000 0x41c-0x41f mac address low 2 0x00000000 0x420-0x423 mac address high 3 0x00000000 0x424-0x427 mac address low 3 0x00000000 0x428-0x42b mac address high 4 0x00000000 0x42c-0x42f mac address low 4 0x00000000 0x430-0x433 wol pattern pointer 0x00000000 0x434-0x437 wol pattern configuration 0x00000000 0x438-0x43b transmit random backoff 0x00000000 0x43c-0x43f receive mtu size register 0x000005f2 0x440-0x443 gigabit pcs test 0x00000000 0x444-0x447 transmit auto-negotiation 0x00000000 0x448-0x44b receive auto-negotiation 0x00000000 0x44c-0x44f mi communication 0x10000000 0x450-0x453 mi status 0x00000000 0x454-0x457 mi mode 0x000c0000 0x458-0x45b auto-poll status 0x00000000 0x45c-0x45f transmit mode 0x00000000 0x460-463 transmit status 0x00000000 0x464-0x467 transmit lengths 0x00000000 0x468-0x46b receive mode 0x00000000 0x46c-0x46f receive status 0x00000000 0x470-0x473 mac hash register 0 0x00000000 0x474-0x477 mac hash register 1 0x00000000 0x478-0x47b mac hash register 2 0x00000000 0x47c-0x47f mac hash register 3 0x00000000 0x480-04x483 recv bd rules control register 0 0x00000000 www.datasheet.in bcm57xx programmer?s guide 01/29/08 broadcom corporation page 376 ethernet mac control registers document 57xx-pg105-r 0x484-0x487 recv bd rules mask/value register 0 0x00000000 0x488-0x48b recv bd rules control register 1 0x00000000 0x48c-0x48f recv bd rules mask/value register 1 0x00000000 0x490-0x493 recv bd rules control register 2 0x00000000 0x494-0x497 recv bd rules mask/value register 2 0x00000000 0x498-0x49b recv bd rules control register 3 0x00000000 0x49c-0x49f recv bd rules mask/value register 3 0x00000000 0x4a0-9x4a3 recv bd rules control register 4 0x00000000 0x4a4-0x4a7 recv bd rules mask/value register 4 0x00000000 0x4a8-0x4ab recv bd rules control register 5 0x00000000 0x4ac-0x4af recv bd rules mask/value register 5 0x00000000 0x4b0-0x4b3 recv bd rules control register 6 0x00000000 0x4b4-0x4b7 recv bd rules mask/value register 6 0x00000000 0x4b8-0x4bb recv bd rules control register 7 0x00000000 0x4bc-0x4bf recv bd rules mask/value register 7 0x00000000 0x4c0-0x4c3 recv bd rules control register 8 0x00000000 0x4c4-0x4c7 recv bd rules mask/value register 8 0x00000000 0x4c8-0x4cb recv bd rules control register 9 0x00000000 0x4cc-0x4cf recv bd rules mask/value register 9 0x00000000 0x4d0-0x4d3 recv bd rules control register 10 0x00000000 0x4d4-0x4d7 recv bd rules mask/value register 10 0x00000000 0x4d8-0x4db recv bd rules control register 11 0x00000000 0x4dc-0x4df recv bd rules mask/value register 11 0x00000000 0x4e0-0x4e3 recv bd rules control register 12 0x00000000 0x4e4-0x4e7 recv bd rules mask/value register 12 0x00000000 0x4e8-0x4eb recv bd rules control register 13 0x00000000 0x4ec-0x4ef recv bd rules mask/value register 13 0x00000000 0x4f0-0x4f3 recv bd rules control register 14 0x00000000 0x4f4-0x4f7 recv bd rules mask/value register 14 0x00000000 0x4f8-0x4fb recv bd rules control register 15 0x00000000 0x4fc-0x4ff recv bd rules mask/value register 15 0x00000000 0x500-0x503 receive rules configuration register 0x00000000 0x504-0x507 low watermark maximum receive frames register 0x00000000 0x508-0x51f reserved x 0x520-0x52f mac hash table register 0 0x530-0x58f ethernet mac perfect address register 0 0x590-0x593 serdes control register 0 0x594-0x597 serdes status register 0 0x598-0x5ff reserved x table 245: ethernet mac control registers (cont.) offset registers init www.datasheet.in programmer?s guide bcm57xx 01/29/08 broadcom corporation document 57xx-pg105-r ethernet mac control registers page 377 e thernet mac m ode r egister (o ffset 0 x 400) 0x600-0x60f reserved x 0x610-0x623 reserved x 0x624-0x7ff reserved x 0x800-0x867 rx statistics memory 0x00000000 0x868-0x87f reserved x 0x880-0x8ef tx statistics memory 0x00000000 0x8f0-0xbff reserved 0x00000000 table 246: ethernet mac mode register (offset 0x400) bit field description init access 31-27 reserved - 0 r/o 26-25 26: free running acpi (bcm5721, bcm5751, bcm5752, bcm5714, and bcm5715 only) when this bit is set, the acpi state machine will continue running when a match is found. when this bit is clear, the acpi state machine will halt when a match is found. 0r/w 25: halt interesting packet pme (bcm5721, bcm5751, bcm5752, bcm5714, and bcm5715 only) when this bit is set, the wol signal will not be asserted on an interesting packet match. 0r/w 26-25: reserved (other devices) - 0 r/o 24 keep frame in wol (bcm5705, bcm5788, bcm5721, bcm5751, and bcm5752 only) - reserved (other devices) - 0 r/o 23 enable fhde enable the receive frame header dma engine. must be set for normal operation. 0r/w 22 enable rde enable the receive dma engine. must be set for normal operation. 0r/w 21 enable tde enable transmit dma engine. 0 r/w 20 reserved (bcm5705, bcm5788, bcm5721, bcm5751, bcm5752, bcm5714, and bcm5715 only) -0r/o enable mip enable management interface programming for phy. 0 r/w 19 acpi power-on enable enable wake on lan filters when in power-down mode. 0 r/w 18 magic packet detect enable enable magic packet detection. 0 r/w 17 send configs send config commands when in tbi mode. (see ?transmit 1000base-x auto-negotiation register (offset 0x444)? on page 387 .) 0r/w 16 flush tx statistics write transmit statistics to external memory. this bit is self-clearing. 0r/w 15 clear tx statistics clear transmit statistics internal ram. this bit is self- clearing. 0r/w table 245: ethernet mac control registers (cont.) offset registers init www.datasheet.in bcm57xx programmer?s guide 01/29/08 broadcom corporation page 378 ethernet mac control registers document 57xx-pg105-r 14 enable tx statistics enable transmit statistics external updates. 0 r/w 13 flush rx statistics write receive statistics to external memory. this bit is self-clearing. 0r/w 12 clear rx statistics clear receive statistics internal ram. this bit is self- clearing. 0r/w 11 enable rx statistics enable receive statistics external updates. 0 r/w 10 reserved (bcm5705, bcm5788, bcm5721, bcm5751, bcm5752, bcm5714, and bcm5715 only) -0r/o link polarity (other devices) when clear, the linkrdy signal has positive polarity. when set, the linkrdy signal has negative polarity. 0r/w 9 max defer enable max deferral checking statistic. 0 r/w 8 enable tx bursting enable transmit bursting in gigabit half-duplex mode. 0 r/w 7 tagged mac control allow the mac to receive tagged mac control packets. 0 r/w 6-5 reserved - 000 r/o 4 loopback mode when set, an internal loopback path is enabled from the transmit mac to the receive mac. this bit is provided for diagnostic purposes only. 3-2 port mode these bits determine what interface the port is running: ? 11: tbi (ten bit interface) ? 10: gmii ? 01: mii ? 00: none (default) 01 1 r/w 1 half-duplex when set, the mii/gmii interface is configured to operate in half-duplex mode and the csma/cd state machines in the mac are set to half-duplex mode. the default value is 0. 0r/w 0 global reset when this bit is set to 1 the mac state machine is reset. this is a self-clearing bit. the default value is 0. 0r/w 1. the default value after reset for the bcm5700 mac prior to the c 0 revision (see ?revision levels? on page 5 ) is 10. table 246: ethernet mac mode register (offset 0x400) (cont.) bit field description init access www.datasheet.in programmer?s guide bcm57xx 01/29/08 broadcom corporation document 57xx-pg105-r ethernet mac control registers page 379 e thernet mac s tatus r egister (o ffset 0 x 404) table 247: ethernet mac status register (offset 0x404) bit field description init access 31-29 reserved always 0. 0 r/o 28 interesting packet pme attention(bcm5721, bcm5751, bcm5752, bcm5714, and bcm5715 only) when this bit is set, the wol signal is asserted when an interesting packet is detected. 0w2c reserved always 0. 0 r/o 27 tx statistic overrun transmit statistics block has overrun. generates an attention when enabled. 0w2c 26 rx statistic overrun receive statistics block has overrun. generates an attention when enabled. 0w2c 25 odi error output data interface block has an overrun or underrun. will generate attention when enabled. clear this attention using the transmit status register. 0r/o 24 ap error auto-polling interface needs service. generates an attention when enabled. clear this attention using the auto-polling status register. 0r/o 23 mi interrupt management interface is signalling an interrupt. generates an attention when enabled. 0r/o 22 mi completion management interface transaction has completed. generates an attention when enabled. 0w2c 21-13 reserved - 0 r/o 12 link state changed set when the link state has changed. generates an attention when enabled by bit 12 of the ethernet mac event enable register (see ?ethernet mac event enable register (offset 0x408)? on page 381 ). clear this attention by writing 1 to sync changed (bit 4) and config changed (bit 3). 0r/o w2c (for bcm5705, bcm5714, bcm5715, bcm5721, bcm5751, bcm5752, and bcm5788 only) 11 reserved - 0 r/o 10 reserved (bcm5705, bcm5714, bcm5721 and bcm5751 only) -0r/o port decode error (other devices) pcs detected an encoding error. this can only occur in internal pcs mode. generates an attention when enabled. 0w2c 9-5 reserved - 0 r/o 4 reserved (bcm5705, bcm5788, bcm5721, bcm5751, bcm5752, bcm5714, and bcm5715 only) -0r/o sync changed (other devices) pcs sync state machine has changed state. 0 w2c www.datasheet.in bcm57xx programmer?s guide 01/29/08 broadcom corporation page 380 ethernet mac control registers document 57xx-pg105-r 3 reserved (bcm5705, bcm5788, bcm5721, bcm5751, bcm5752, bcm5714, and bcm5715 only) -0r/o config changed (other devices) gigabit port receive configuration data has changed. 0 w2c 2 reserved (bcm5705, bcm5788, bcm5721, bcm5751, bcm5752, bcm5714, and bcm5715 only) -0r/o receiving config (other devices) currently receiving configuration data on gigabit port. 0 r/o 1 reserved (bcm5705, bcm5788, bcm5721, bcm5751, bcm5752, bcm5714, and bcm5715 only) -0r/o signal detect (other devices) in tbi mode, contains the value of the linkrdy input pin controlled by the link polarity function. 0r/o 0 reserved (bcm5705, bcm5788, bcm5721, bcm5751, bcm5752, bcm5714, and bcm5715 only) -0r/o pcs synched (other devices) in tbi mode, indicates that the internal pcs function has synchronized to the data stream. the value is qualified with signal detect. 0r/o table 247: ethernet mac status register (offset 0x404) (cont.) bit field description init access www.datasheet.in programmer?s guide bcm57xx 01/29/08 broadcom corporation document 57xx-pg105-r ethernet mac control registers page 381 e thernet mac e vent e nable r egister (o ffset 0 x 408) table 248: ethernet mac event enable register (offset 0x408) bit field description init access 31-29 reserved always 0. 0 r/o 28 interesting packet pme attention enable (bcm5721, bcm5751, bcm5752, bcm5714, and bcm5715 only) when this bit is set, an attention will be asserted on an interesting packet match. 0r/w reserved always 0. 0 r/o 27 tx statistics overrun enable attention when transmit statistics block has overrun. 0 r/w 26 rx statistics overrun enable attention when receive statistics block has overrun. 0 r/w 25 odi error enable attention when an output data interface block has an overrun or underrun. 0r/w 24 ap error enable attention when the auto-polling interface has an error. 0 r/w 23 mi interrupt enable attention when the management interface is signaling an interrupt. 0r/w 22 mi completion enable attention when the management interface transaction has completed. 0r/w 21-13 reserved 0r/o 12 link state changed enable attention when the link has changed state. 0 r/w 11 reserved - 0 r/o 10 reserved (bcm5705, bcm5788, bcm5721, bcm5751, bcm5752, bcm5714, and bcm5715 only) -0r/o port decode error (other devices) enable attention when the pcs detected an encoding error and the device is in tbi mode. 0r/w 9-0 reserved always 0. 0 r/o www.datasheet.in bcm57xx programmer?s guide 01/29/08 broadcom corporation page 382 ethernet mac control registers document 57xx-pg105-r led c ontrol r egister (o ffset 0 x 40c) table 249: led control register (offset 0x40c) bit field description init access 31 override blink rate if set, the blink rate for the traffic led is determined by the blink period field (bit 30 to bit 9). this bit is reset to 1. if not set, the blink rate assumes a blink period of 0x040, corresponding to approximately 15.9 hz. 1r/w 30-19 blink period specifies the period of each blink cycle (on + off) for traffic led in milliseconds. must be a nonzero value. this 12-bit field is reset to 0x040, giving a default blink period of approximately 15.9 hz. 000001 000000 r/w 18-16 reserved - 0 r/o 15 wireless combo mode (bcm5721, bcm5751, bcm5752, bcm5714, and bcm5715 only) when this bit is set, the led pins can be shared with a wireless device which takes over when the link is lost. 0r/w reserved (other devices) - 0 r/o 14 shared traffic/link led mode (bcm5721, bcm5751, bcm5752, bcm5714, and bcm5715 only) (see note 1 below) when this bit is set, the link led is solid green when there is a link and blinks when there is traffic. (the led_mode field must be set to 00 before enabling this bit.) 1r/w reserved (other devices) - 0 r/o 13 mac mode (bcm5721, bcm5751, bcm5752, bcm5714, and bcm5715 only) (see note 1 below) when this bit is set, the traffic led blinks only when traffic is addressed for the device. (the led_mode field must be set to 00 before enabling this bit.) 0r/w reserved (other devices) - 0 r/o 12-11 led_mode ? 00: mac mode (default in bcm5700 and bcm5701)?led signal is in active low (on) when link is established and is in high (off) when link is not established. - linkledb = led10 (from mac core) - spd100ledb = led100 (from mac core) - spd1000ledb = led1000 (from mac core) - trafficledb = led_traffic (from mac core) 00 r/o ? 01: phy mode 1 (default in bcm5702 and later) ?led signal is in active low (on) when link is established and is in tristate (off) when link is not established. - linkledb = link 10 (open drain) (from phy core) - spd100ledb = link 100 (open drain) (from phy core) - spd1000ledb = link 1000(open drain) (from phy core) - trafficledb = phy rcvled or phy xmtled (from phy core) 01 www.datasheet.in programmer?s guide bcm57xx 01/29/08 broadcom corporation document 57xx-pg105-r ethernet mac control registers page 383 12-11 (contin ued) led_mode ? 10: phy mode 2?led signal is in active low (on) when link has a valid data or idle signal and is in high (off) when link is not established. - linkledb = link10 = link10 (from phy core) - spd100ledb = link100 = link100 and valid data or idle (from phy core) - spd1000ledb = link1000 = link1000 and valid data or idle (from phy core) - trafficledb = rcvled or xmtled (from phy core) ? 11: bcm5714, bcm5715, bcm5752, bcm 5721 a1 or later, and bcm5751 a1 or later only: same as phy mode 1 and is used for wireless combo mode (that is, when bit 15 of this register is set to 1). ? 11: reserved (for other devices). 10 traffic led status - 0 r/o 9 10mbps led status - 0 r/o 8 100mbps led status - 0 r/o 7 1000mbps led status - 0 r/o 6 traffic led if set along with the override traffic bit, the traffic led is turned on. if the blink traffic led bit is also set, the led will blink with blink rate specified in override blink rate (bit 31) and blink period (bit 30-19) fields. 0r/w 5 blink traffic led if set along with the override traffic bit and traffic led bit, the traffic led will blink with the blink rate specified in override blink rate (bit 31) and blink period (bit 30-19) fields. 0r/w 4 override traffic led if set, overrides hardware control of the traffic led. the traffic led will then be controlled via bit 6 and bit 5. 0r/w 3 10 mbps led if set along with the led override bit, turns on the 10 mbps led. 0r/w 2 100 mbps led if set along with the led override bit, turns on the 100 mbps led. 0r/w 1 1000 mbps led if set along with the led override bit, turns on the 1000 mbps led. 0r/w 0 override link leds if set, overrides hardware control of the three link leds. the leds will then be controlled via bits 3-1. 0r/w note: to enable either mac mode or shared traffic/link led mode, the led mode (bits 12:11) must be set to mac led mode (0x0). table 249: led control register (offset 0x40c) (cont.) bit field description init access www.datasheet.in bcm57xx programmer?s guide 01/29/08 broadcom corporation page 384 ethernet mac control registers document 57xx-pg105-r e thernet mac a ddresses r egisters (o ffset 0 x 410-0 x 42c) the ethernet mac needs to be initialized with up to four 6-byte mac addresses in order to perform hardware receive packet filtering. when operating the receive mac in promiscuous mode, no receive filtering is performed. mac address one is used as the source address for sending flow-control packets. the addresses are not synchronized, so they must not be set after initialization unless the mac block is reset. note: the bcm5702, BCM5703c, BCM5703s, bcm5704c, and bcm5704s support 12 additional ethernet mac address registers (see ?ethernet mac perfect address registers (offset 0x530-0x58f)? on page 395 ). table 250: ethernet mac address high register (offset 0x410) address offset mac address 0: 0x410 address offset mac address 1: 0x418 address offset mac address 2: 0x420 address offset mac address 3: 0x428 bit field description init access 31-16 reserved always 0. 0h r/o 15-0 mac address high upper 2-bytes of this node?s mac address. 0h r/w table 251: ethernet mac address low register (offset 0x414) address offset mac address 0: 0x414 address offset mac address 1: 0x41c address offset mac address 2: 0x424 address offset mac address 3: 0x42c bit field description init access 31-0 mac address low lower 4-byte of this node?s mac address. 0h r/w www.datasheet.in programmer?s guide bcm57xx 01/29/08 broadcom corporation document 57xx-pg105-r ethernet mac control registers page 385 wol p attern p ointer r egister (o ffset 0 x 430) this version of the wol pattern pointer register applies to the bcm5705, bcm5788, bcm5721, bcm5751, bcm5752, bcm5714, and bcm5715 devices only. rest of bcm57xx family this version of the wol pattern pointer register applies to the rest of the bcm57xx family. table 252: wol pattern pointer register (offset 0x430) bit field description init access 31-9 reserved - 8-0 acpi pointer specifies the offset into the 6 kb bd memory for frame comparison. (bits 3:0 are ignored to align the memory address to a natural 128-bit boundary.) 0x000 r/w table 253: wol pattern pointer register (offset 0x430, rest of bcm57xx family) bit field description init access 31-0 acpi pointer specifies the offset into memory for frame comparison. 0 r/w www.datasheet.in bcm57xx programmer?s guide 01/29/08 broadcom corporation page 386 ethernet mac control registers document 57xx-pg105-r wol p attern c onfiguration r egister (o ffset 0 x 434) this version of the wol pattern pointer register applies to the bcm5705, bcm5788, bcm5721, bcm5751, bcm5752, bcm5714, and bcm5715 devices only. rest of bcm57xx family this version of the wol pattern configuration register applies to the rest of the bcm57xx family. e thernet t ransmit r andom b ackoff r egister (o ffset 0 x 438) this register is used to initialize the random backoff interval generator. it is implemented as a 10-bit linear feedback shift register as follows: random[9:0] = (random srl 1) xor 32l when random 9 = 1 else (random srl 1) xor 0 if the random generator is initialized to zero, then it will always remain a zero indicating that a no backoff internal is alwa ys selected. it is recommended that this field be initialized with the same value that is written to the mac address low register in order to create additional randomness to the initial seed. table 254: wol pattern configuration register (offset 0x434) bit field description init access 31-28 reserved - 0 r/o 27-16 acpi offset offset of a frame where the pattern comparison starts. 0 r/w 15-10 reserved - 0 r/o 9-0 acpi length specifies the total number of 64-bit double words inside the misc_bd memory that are valid for acpi. for gmii, it should have a value of 2,4,6,... for mii, it should have a value of 3,6,9,.... 0x000 r/w table 255: wol pattern configuration register (offset 0x434, rest of bcm57xx family) bit field description init access 31 reserved (bcm5700 and bcm5701 only) -0r/o large burst dma write enable when set, 5701 mode is enabled, which requires a clock rate greater than 42 mhz to support interesting packet detection at 100base-tx speeds. 0r/w 30-28 reserved - 0 r/o 27-16 acpi offset offset of a frame where the patterns comparison starts. 0 r/w 15-0 acpi length specify the length of bytes for frame comparison. 0 r/w table 256: ethernet transmit random backup register (offset 0x438) bit field description init access 31-10 reserved always 0. 0 r/o 9-0 random backoff seed for half-duplex, initialize with any nonzero seed. 0 r/w www.datasheet.in programmer?s guide bcm57xx 01/29/08 broadcom corporation document 57xx-pg105-r ethernet mac control registers page 387 r eceive mtu s ize r egister (o ffset 0 x 43c) this register defines the threshold above which a frame will be marked as oversize. g igabit pcs t est r egister (o ffset 0 x 440) this register is not applicable to bcm5705, bcm5788, bcm5721, bcm5751, bcm5752, bcm5714, and bcm5715 devices. this register is used only during testing of the physical components of the gigabit ethernet interface. when enabled, the pcs (physical coding sublayer) continuously sends the 20-bit data pattern. this register must be initialized to zero for normal operation. it is reserved in 1000base-t, 100 mbps, and 10 mbps ethernet modes. t ransmit 1000base-x a uto -n egotiation r egister (o ffset 0 x 444) this register is not applicable to bcm5705, bcm5788, bcm5721, bcm5751, bcm5752, bcm5714, and bcm5715 devices. this register contains the data sent by the transmit phy during 1000base-x auto-negotiation. this register is unused in 1000base-t, 100base-t, and 10base-t ethernet modes. table 257: receive mtu size register (offset 0x43c) bit field description init access 31-16 reserved always 0. 0 r/o 15-0 mtu 2-byte field which is the largest size frame that will be accepted without being marked as oversize. 05f2h r/w table 258: gigabit pcs test register (offset 0x440) bit field description init access 31-21 reserved always 0. 0 r/o 20 enable phy test mode send 20-bit data pattern repeatedly. 0 r/w 19-0 phy test data pattern 20-bit pattern used during phy testing. 0 r/w table 259: transmit 1000base-x auto-negotiation register (offset 0x444) bit field description init access 31-16 reserved always 0. 0 r/o 15-0 transmit auto- negotiation data 2-byte field sent during auto-negotiation. most significant byte is sent first. 0r/w note: the send configs bit of the ethernet mac mode register (see table 246 on page 377 ) must be set to use this register. www.datasheet.in bcm57xx programmer?s guide 01/29/08 broadcom corporation page 388 ethernet mac control registers document 57xx-pg105-r r eceive 1000base-x a uto -n egotiation r egister (o ffset 0 x 448) this register is not applicable to bcm5705, bcm5788, bcm5721, bcm5751, bcm5752, bcm5714, and bcm5715 devices. this register contains the data received by the receive phy during 1000base-x auto-negotiation. this register is unused in 1000base-t, 100base-t, and 10base-t ethernet modes. mi c ommunication r egister (o ffset 0 x 44c) this register is used to communicate with a transceiver device through the mii/gmii management interface signals mdio and mdc. to complete a transaction, the register values are configured for the operation, and the start bit (bit 29) is set. when the transaction completes, the start bit will be cleared by the device. the read failed bit (bit 28) can be used to determine an incomplete read transaction. the transaction data field should be ignored when the read failed bit is set. table 260: receive 1000base-x auto-negotiation register (offset 0x448) bit field description init access 31-16 reserved always 0. 0 r/o 15-0 receive auto- negotiation data 2-byte field received during auto-negotiation. most significant byte is received first. 0r/o note: the send configs bit of the ethernet mac mode register (see table 246 on page 377 ) must be set to use this register. table 261: mi communication register (offset 0x44c) bit field description init access 31-30 reserved always 0. 0 r/o 29 start/busy set this bit to start a transaction. while it is high, it indicates that the current transaction is still ongoing. if enabled, generates an attention via the emac status register mi completion bit (bit 22). 0r/w 28 read failed when set, the transceiver device did not driver the bus during the attempted read transaction. valid after the start/busy bit is cleared. 0r/o 27-26 command these bits specify the transaction type: 11: undefined. 10: read command. 01: write command. 00: undefined. 00b r/w 25-21 phy addr phy address. 0000b r/w 20-16 register address address of the register to be read or written. 0000b r/w 15-0 transaction data when configured for a write command, the data stored at this location is written to the phy at the specified phy and register address. during a read command, the data returned by the phy is stored at this location. 0r/w www.datasheet.in programmer?s guide bcm57xx 01/29/08 broadcom corporation document 57xx-pg105-r ethernet mac control registers page 389 mi s tatus r egister (o ffset 0 x 450) this register contains status from a phy using the management interface. it is obtained during autopolling and will not be valid if autopolling is disabled. if auto-polling is not enabled, bit 0 must be set to enable link to the mac state machines. mi m ode r egister (o ffset 0 x 454) this register controls autopolling on the management interface. auto control mode sets the link state in the transmit state register. a utopolling s tatus r egister (o ffset 0 x 458) this register contains status of autopolling the management interface. table 262: mi status register (offset 0x450) bit field description init access 31-2 reserved always 0. 0 r/o 1 mode10 mbps when read, a value of 1 indicates the transceiver device is operating in 10 mbps mode. 0r/w 0 link status the bit will generate an attention if enabled. indicates status of the link on the transceiver device. when read, a value of 1 indicates the transceiver is linked. 0r/w table 263: mi mode register (offset 0x454) bit field description init access 31-21 reserved 0r/o 20-16 mi clock count counter to divide core_clk (i.e., 66 mhz) to generate the mi clock. the formula is: mi clock = core_clk/2/(mi clock count + 1) 0ch r/w 15-10 reserved - 0 r/o 9-5 phy address this field specifies the phy address. 00001 r/w 4 port polling set to enable autopolling of the transceiver link information from the mii management interface. if cleared, the device will obtain the link status information from the state of the lnkrdy input signal. 0r/w 3-2 reserved - 0 r/o 1 use short preamble use short preamble while polling, if set. 0 r/w 0 reserved - 0 r/o table 264: autopolling status register (offset 0x458) bit field description init access 31-1 reserved always 0. 0 r/o 0 auto-polling error indicates an autopolling error occurred if set. 0 w2c www.datasheet.in bcm57xx programmer?s guide 01/29/08 broadcom corporation page 390 ethernet mac control registers document 57xx-pg105-r t ransmit mac m ode r egister (o ffset 0 x 45c) this register controls the transmit ethernet interfaces. t ransmit mac s tatus r egister (o ffset 0 x 460) this register contains the status of the transmit ethernet interface. once the interface is initialized, this register is used to determine the cause of a transmit error event. bits 4 and 5 are ored together, and an attention is generated if the attention enable is set. table 265: transmit mac mode register (offset 0x45c) bit field description init access 31-7 reserved reserved for future use. x r/o 7 reserved (bcm5700 and bcm5701 only) reserved for future use. x r/o link aware enable when set, transmission of packets by the mac is enabled only when link is up (bcm5700, bcm5701 mode). 0r/w 6 enable long pause when set, the pause time value set in the transmitted pause frames is 0xffff. the default value for pause time is 0x1fff. 0r/w 5 enable big backoff mac will use larger than normal back-off algorithm. 0 r/w 4 enable flow control mac will send 802.3x flow control frames. 0 r/w 3-2 reserved - 0 r/o 1 enable this bit controls whether the transmit mac state machine is active or not. when set to 0, it completes the current operation and cleanly halts. until it is completely halted, it remains 1 when read. 0r/w 0 reset when this bit is set to 1, the transmit mac state machine will be reset. this is a self-clearing bit. 0r/w table 266: transmit mac status register (offset 0x460) bit field description init access 31-6 reserved - 0 r/o 5 odi overrun output data interface has overrun. 0 w2c 4 odi underrun output data interface has underrun. 0 w2c 3 link up link is up, if set. 0 r/o 2 sent xon an xon flow control frame was sent. 0 w2c 1 sent xoff an xoff flow control frame was sent. 0 w2c 0 rx currently xoffed received stopped due to flow control. 0 r/o www.datasheet.in programmer?s guide bcm57xx 01/29/08 broadcom corporation document 57xx-pg105-r ethernet mac control registers page 391 t ransmit mac l engths r egister (o ffset 0 x 464) this register contains various length fields that control the operation of the transmit mac. r eceive mac m ode r egister (o ffset 0 x 468) this register controls the receive ethernet interfaces. table 267: transmit mac lengths register (offset 0x464) bit field description init access 31-14 reserved - 0 r/o 13-12 ipg crs length when multiplied by 2, this field indicates the number of bytes from the end of the interpacket gap (ipg) during which incoming carrier is ignored. the ieee recommends ignoring carrier during the last 1/3 of the ipg. 00 r/w 11-8 ipg length when multiplied by 2, this field indicates the number of bytes in the entire ipg. 0h r/w 7-0 slot time length when multiplied by 2, this field indicates the number of bytes in the slot time. 00h r/w table 268: receive mac mode register (offset 0x468) bit field description init access 31- 13 reserved - 0 r/o 12 reserved (bcm5700 and bcm5701 only) -0r/o extended hash en enable extended hash table size of 256 entries. by default, the hash table supports 128 entries with a 7-bit crc value. this bit provides bcm5700 and bcm5701 legacy support by default. 0r/w 11 reserved (bcm5700 and bcm5701 only) -0r/o filt_broadcast when set, reception of broadcast frames is disabled. 0 r/w 10 keep vlan tag diag mode if set, forces receive mac to keep the vlan tag in the frame. this is for debugging purpose only and should be reset during normal operation. 0r/w 9 no_crc_check no crc check by receive mac on incoming frames. also, allows the reception of packets received with rxerr on the mii/gmii. 0r/w 8 promiscuous mode no source address or mc hashing checking will be performed on incoming frames. all frames will be accepted. 0r/w 7 length check if set, 802.2 length checking is done on llc frames. 0 r/w 6 accept runts if set, the mac accepts packets less than 64 bytes. 0 r/w 5 reserved (bcm5705, bcm5788, bcm5721, bcm5751, bcm5752, bcm5714, and bcm5715 only) -0r/w accept oversized (other devices) if set, the mac accepts packets larger than specified in the mtu (up to 64k bytes). 0r/w 4 keep pause if set, the mac forwards pause frame to host buffer. 0 r/w www.datasheet.in bcm57xx programmer?s guide 01/29/08 broadcom corporation page 392 ethernet mac control registers document 57xx-pg105-r r eceive mac s tatus r egister (o ffset 0 x 46c) this register contains the status of the receive ethernet interface. once the interface is initialized, this register is used t o determine the cause of a receive error event. mac h ash r egister 0-3 (o ffset 0 x 470-0 x 47c) the hash value provides a way for the mac to accept multicast frames through a hashing function. if the crc hash of a multicast destination address matches a bit in the hash registers, the frame is accepted (see ?packet filtering? on page 168 ). 3reserved - 0r/o 2 enable flow control enable automatic processing of 802.3x flow control frames. this bit is orthogonal to the keep pause bit. 0r/w 1 enable this bit controls whether the receive mac state machine is active or not. when set to 0, it completes the current operation and cleanly halts. until it is completely halted, it remains 1 when read. 0r/w 0 reset when this bit is set to 1, the receive mac state machine will be reset. this is a self-clearing bit. 0r/w table 269: receive mac status register (offset 0x46c) bit field description init access 31-4 reserved - 000000h r/o 3 rx fifo overrun the rx fifo has encountered an overrun condition. 0 w2c 2 xon received a mac control frame with the pause opcode was received with the pause time field set to zero. the bit is sticky and must be written to clear. 0w2c 1 xoff received a mac control frame with the pause opcode was received with the pause time field set to nonzero. the bit is sticky and must be written to clear. 0w2c 0 remote transmitter xoffed a previously received xoff timer has not expired yet. 0 r/o note: the bcm5702 mac transceiver and later support 128 additional hash table registers (see ?mac hash table registers (offset 0x520-0x52f)? on page 395 ). table 270: mac hash register 0-3 (offset 0x470) address offset mac hash register 0: 0x470 address offset mac hash register 1: 0x474 address offset mac hash register 2: 0x478 address offset mac hash register 3: 0x47c bit field description init access 31-0 hash value hash value for multicast destination address matching. 0 r/w table 268: receive mac mode register (offset 0x468) (cont.) bit field description init access www.datasheet.in programmer?s guide bcm57xx 01/29/08 broadcom corporation document 57xx-pg105-r ethernet mac control registers page 393 r eceive r ules c ontrol r egisters (o ffset r ule n: 0 x 480 + 8*n) the bcm5700, bcm5701, bcm5702, BCM5703, bcm5704, bcm5714, and bcm5715 controllers implement 16 receive rules (n = 0 to 15). the bcm5705, bcm5721, and bcm5751 controllers implement eight receive rules (n = 0 to 7). table 271: receive rules control register (offset 0x480) bit field description init access 31 enable corresponding rule is enabled when set. 0 r/w 30 and with next this rule and next must both be true to match. the class fields must be the same. a disabled next rule is considered true. processor activation bits are specified in the first rule in a series. 0r/w 29 activate processor 1 if the rule matches, the processor is activated in the queue descriptor for the receive queue placement state machine. 0r/w 28 reserved (bcm5705, bcm5788, bcm5721, bcm5751, and bcm5752 only) -0r/o activate processor 2 (other devices) if the rule matches, the processor is activated in the queue descriptor for the receive data and receive bd initiator state machine. 0r/w 27 reserved (bcm5705, bcm5788, bcm5721, bcm5751, and bcm5752 only) -0r/o activate processor 3 (other devices) if the rule matches, the processor is activated in the queue descriptor for the receive data completion state machine 0r/w 26 mask if set, specifies that the value/mask field is split into a 16- bit value and 16-bit mask instead of a 32-bit value. 0r/w 25 discard discard frame if it matches the rule. 0 r/w 24 map use the masked value and map it to the class. 0 r/w 17-16 comparison operator specifies how to determine the match: 00: equal. 01: not equal. 10: greater than. 11: less than. 00 r/w 15-13 header type specifies which header the offset is for: 000: start of frame (always valid). 001: start of ip header (if present). 010: start of tcp header (if present). 011: start of udp header (if present). 100: start of data (always valid, context sensitive). 000 r/w 12-8 class the class this frame is placed into if the rule matches. 0- 16 where 0 means discard. the number of valid classes is the number of active queues divided by the number of interrupt distribution groups. ring 1 has the highest priority and ring 16 has the lowest priority. 0r/w 7-0 offset number of bytes offset specified by the header type. 0 r/w www.datasheet.in bcm57xx programmer?s guide 01/29/08 broadcom corporation page 394 ethernet mac control registers document 57xx-pg105-r r eceive r ules v alue /m ask r egisters (o ffset r ule n: 0 x 484 + 8*n) the bcm5700, bcm5701, bcm5702, BCM5703, bcm5704, bcm5714, and bcm5715 mac controllers implement 16 receive rules (n = 0 to 15). the bcm5705,bcm5788, bcm5721,bcm5751, and bcm5752 mac controllers implement eight receive rules (n = 0 to 7). this register is either a 32-bit left justified value, or a 16-bit mask followed by a 16-bit value. the use of the field is determined by the mask bit of the corresponding rule. r eceive r ules c onfiguration r egister (o ffset 0 x 500) l ow w atermark m aximum r eceive f rames r egister (o ffset 0 x 504) this register is useful for flow control to prevent dropped packets. table 272: receive rules value/mask register (offset 0x484) bit field description init access 31-16 mask/value for each bit set, the corresponding bit in the value field is ignored during the rule match process. if bit 26 of the corresponding rule control register is set, the field is used as an additional 16-bit value for rule comparison. 0r/w 15-0 value this field specifies a 16-bit value for rules comparison. 0 r/w table 273: receive rules configuration register (offset 0x500) bit field description init access 31-8 reserved reserved. 0 r/o 7-3 no rules matches default class specifies the default class of service for the frame if no rules are matched. a value of 1 is the highest priority and a value of 16 is the lowest priority. a value of zero will cause the frame to be discarded. 0r/w 2-0 reserved reserved. 0 r/o table 274: low watermark maximum receive frames register (offset 0x504) bit field description init access 31-16 reserved reserved. 0 r/o 15-0 low watermark max receive frames specifies the number of good frames to receive after rx mbuf low watermark has been reached. after the rx mac receives this number of frames, it will drop subsequent incoming frames until the mbuf high watermark is reached. default to zero (i.e., drop frames once rx mbuf low watermark is reached). 0r/w note: the bcm57xx family generates a pause frame when the low watermark max receive frames value has been reached. when a pause frame has been generated, the tx data path also stalls (assuming it has not already reached the value specified by the ?read dma mbuf low watermark register (offset 0x4410)? on page 469 ), even though no pause frame was received from the ethernet link partner. www.datasheet.in programmer?s guide bcm57xx 01/29/08 broadcom corporation document 57xx-pg105-r mac hash table registers (offset 0x520-0x52f) page 395 mac h ash t able r egisters (o ffset 0 x 520-0 x 52 f ) these registers are not applicable to the bcm5700, bcm5701, bcm5705, bcm5788, bcm5721, bcm5751, bcm5752, bcm5714, and bcm5715 devices. the hash table can be increased to 256 indexes when the receive mac mode register extended hash enable bit (see ?receive mac mode register (offset 0x468)? on page 391 ) is set. e thernet mac p erfect a ddress r egisters (o ffset 0 x 530- 0 x 58f) these registers are not applicable to the bcm5700, bcm5701, bcm5705, bcm5788, bcm5721, bcm5751, bcm5752, bcm5714, and bcm5715 devices. table 275: ethernet mac perfect address registers (offset 0x530-0x58f) address description 0x530-0x537 mac perfect address 4 0x538-0x53f mac perfect address 5 0x540-0x547 mac perfect address 6 0x548-0x54f mac perfect address 7 0x550-0x557 mac perfect address 8 0x558-0x55f mac perfect address 9 0x560-0x567 mac perfect address 10 0x568-0x56f mac perfect address 11 0x570-0x577 mac perfect address 12 0x578-0x57f mac perfect address 13 0x580-0x587 mac perfect address 14 0x588-0x58f mac perfect address 15 www.datasheet.in bcm57xx programmer?s guide 01/29/08 broadcom corporation page 396 serdes registers document 57xx-pg105-r s er d es r egisters s er d es c ontrol r egister (o ffset 0 x 590) the below definition is applicable to BCM5703s only. table 276: serdes control register (offset 0x590, 5703s only) bit field description init access 31-24 reserved - 0 r/o 23-22 regctl control regulator voltages (mac1 only). possible values include: ? 00 = 2.6v (default) ? 01 = 2.4v ? 10 = 2.5v ? 11 = 2.7v note: although the power-on default is 2.6v, software needs to program the value to 2.5v. 00 r/w 21-20 regctl12 controls 1.2v regulator voltages (mac1 only). possible values include: ? 00 = 1.2v (default) ? 01 = 1.1v ? 10 = 1.3v ? 11 = 1.4v 00 r/w 19 rev_phase reverse 125-mhz receive clock phase from serdes output. 0 r/w 18 remote_lbk when set, loopback from serdes rd through serdes and back to td is enabled. 0r/w 17 tbi_lbk when set, loopback from transmit tbi to receive tbi is enabled. 0 r/w 16 cdet_en when set, comma detection is enabled. 1 r/w 15 plltest when set, the serdes pll test mode is enabled. 0 r/w 14 serdes_mode when set, txcp/txcn are disabled. 1 r/w 13 txedge when clear, transmit tbi data is captured on the falling edge of internal txwclk. when set, data is captured on the rising edge. 1r/w 12 txmode when set, the clock recovered from the receiver is driven on the txcp/txcn pins 0r/w 11 bgmin when set, the bias current is set to -25% 0 r/w 10 bgmax when set, the bias current is set to +25%. 0 r/w 9-7 txbias configures the txdac output swing: ? 000 = minimum ? 111 = maximum 000 r/w 6 rxcksel when clear, the receive data on the tbi is available on the rising edge of internal rxwclk. when set, data is available on the falling edge. 0r/w 5 reserved - 0 r/o 4-3 rxg receiver gain setting. 0 r/w 2-0 rxr phase interpolator bias setting. 0 r/w www.datasheet.in programmer?s guide bcm57xx 01/29/08 broadcom corporation document 57xx-pg105-r serdes registers page 397 the below definition is applicable to bcm5704c only. the below definition is applicable to bcm5704s only. table 277: serdes control register (offset 0x590, bcm5704c) bit field description init access 31-28 reserved - 0 r/o 27-24 27: tx reverse phase 2 tx reverse phase from serdes_if to serdes (rev. a1 and above); use the default value all the time. 1r/w 26: tx reverse phase 1 tx reverse phase from core to serdes_if (rev. a1 and above); use the default value all the time. 1r/w 25: rx reverse phase 1 rx reverse phase from serdes_if to emac (rev. a1 and above); use the default value all the time. 0r/w 24: rx reverse phase 2 rx reverse phase from serdes to serdes_if (rev. a1 and above); use the default value all the time. 0r/w reserved - 0 r/o 23-22 regctl control regulator voltages (mac1 only). possible values include: ? 00 = 2.6v (default) ? 01 = 2.4v ? 10 = 2.5v ? 11 = 2.7v note: although the power-on default is 2.6v, software needs to program the value to 2.5v. 00 r/w 21-20 regctl12 controls 1.2v regulator voltages (mac1 only). possible values include: ? 00 = 1.2v (default) ? 01 = 1.1v ? 10 = 1.3v ? 11 = 1.4v 00 r/w 19-0 reserved - 0 r/o table 278: serdes control register (offset 0x590, 5704s only) bit field description init access 31-28 reserved - 0 r/o 27-24 27: tx reverse phase 2 tx reverse phase from serdes_if to serdes (rev. a1 and above); use the default value all the time. 1r/w 26: tx reverse phase 1 tx reverse phase from core to serdes_if (rev. a1 and above); use the default value all the time. 1r/w 25: rx reverse phase 1 rx reverse phase from serdes_if to emac (rev. a1 and above); use the default value all the time. 0r/w 24: rx reverse phase 2 rx reverse phase from serdes to serdes_if (rev. a1 and above); use the default value all the time. 0r/w www.datasheet.in bcm57xx programmer?s guide 01/29/08 broadcom corporation page 398 serdes registers document 57xx-pg105-r 23-22 regctl control regulator voltages (mac1 only). possible values include: ? 00 = 2.6v (default) ? 01 = 2.4v ? 10 = 2.5v ? 11 = 2.7v note: although the power-on default is 2.6v, software needs to program the value to 2.5v. 00 r/w 21-20 regctl12 controls 1.2v regulator voltages (mac1 only). possible values include: ? 00 = 1.2v (default) ? 01 = 1.1v ? 10 = 1.3v ? 11 = 1.4v 00 r/w 19 reserved - 0 r/o 18 remove loopback remove loopback for serdes_if. 0 r/w 17 tbi_lbk when set, loopback from transmit tbi to receive tbi is enabled 0r/w 16 cdet_en when set, comma detection is enabled. 1 r/w 15 powerdown transmitter power down. 0 r/w 14 pre-emphasis enable pre-emphasis enable. 0 r/w 13 tx driver loopback tx driver loopback. 0 r/w 12 load clock edge select parallel load clock edge select. 0 r/w 11-8 predriver current predriver current (for hardware debug only). use the default of 675 mvpp only. 0x3 r/w 7-4 tx driver current tx driver current (for hardware debug only). use the default of 675 mvpp only. 0x3 r/w 3-0 pre-emphasis coefficient pre-emphasis coefficient (for hardware debug only). 0x0 r/w table 278: serdes control register (offset 0x590, 5704s only) (cont.) bit field description init access www.datasheet.in programmer?s guide bcm57xx 01/29/08 broadcom corporation document 57xx-pg105-r serdes registers page 399 the below definition is applicable to bcm5705 and bcm5788 only. the below definition is applicable to bcm5721, bcm5751, and bcm5752 only. table 279: serdes control register (offset 0x590, bcm5705 and bcm5788 only) bit field description init access 31-24 reserved - 0 r/o 23-22 regctl 2.5v control regulator voltages (mac1 only). possible values include: ? 00 = 2.6v (default) ? 01 = 2.4v ? 10 = 2.5v ? 11 = 2.7v note: although the power-on default is 2.6v, software needs to program the value to 2.5v. 00b r/w 21-20 regctl 1.2v controls 1.2v regulator voltages (mac1 only). possible values include: ? 00 = 1.2v (default) ? 01 = 1.1v ? 10 = 1.3v ? 11 = 1.4v 00b r/w 19-0 reserved - 0 r/o table 280: serdes control register (offset 0x590, bcm5721, bcm5751, and bcm5752 only) bit field description init access 31-28 reserved - 0 r/o 27-24 regctl 2.5v output voltage trim control. ? 0 = +0% ? 1 = +2% ? 2 = +4% ? 3 = +6% ? 4 = +8% ? 5 = +10% ? 6 = +12% ? 7 = +14% ? 8 = ?16% ? 9 = ?14% ? 10 = ?12% ? 11 = ?10% ? 12 = ?8% ? 13 = ?6% ? 14 = ?4% ? 15 = ?2% 0 1 (for c0) r/w www.datasheet.in bcm57xx programmer?s guide 01/29/08 broadcom corporation page 400 serdes registers document 57xx-pg105-r s er d es s tatus r egister (o ffset 0 x 594) the below definition is applicable to BCM5703s mac transceiver serdes only. 23-20 regctl 1.2v output voltage trim control. ? 0 = +0% ? 1 = +2% ? 2 = +4% ? 3 = +6% ? 4 = +8% ? 5 = +10% ? 6 = +12% ? 7 = +14% ? 8 = ?16% ? 9 = ?14% ? 10 = ?12% ? 11 = ?10% ? 12 = ?8% ? 13 = ?6% ? 14 = ?4% ? 15 = ?2% 1110b for a0. 0 otherwise r/w 19-0 reserved - 0 r/o table 281: serdes status register (offset 0x594, BCM5703s only) bit field description init access 31-9 reserved - 0 r/o 8 comma_det indicates that comma code is detected. 0 r/o 7-0 rxstat receiver status bits. xx r/o table 280: serdes control register (offset 0x590, bcm5721, bcm5751, and bcm5752 only) (cont.) bit field description init access www.datasheet.in programmer?s guide bcm57xx 01/29/08 broadcom corporation document 57xx-pg105-r serdes registers page 401 s er d es r eceive c ontrol r egister (o ffset 0 x 594) this below register definition is applicable to bcm5704s mac transceiver serdes only. s er d es p hase c ontrol r egister (o ffset 0 x 598) this register is applicable to the bcm5704s mac transceiver serdes only table 282: serdes receive control register (offset 0x594, bcm5704s only) bit field description init access 31-16 reserved - 0 r/o 15 power down receiver power down (active high). 0 r/w 14 bias control 1 bias generator control (refh). 0 r/w 13 bias control 2 bias generator control (refl). 0 r/w 12 clock phase load enable receiver clock phase load enable (active high). 0 r/w 11 clock edge select receiver clock edge select (0 = data synchronized with rising edge of rxwclk). 0r/w 10-9 loop bandwidth control loop bandwidth control (01 = 1/7, 11 = 1/63). 10 r/w 8-6 comparator current comparator current (for hardware diagnostics only). 0 r/w 5-3 interpolator current interpolator current (for hardware diagnostics only). 0 r/w 2-0 clock buffer current clock buffer current (for hardware diagnostics only). 0 r/w table 283: serdes phase control register (offset 0x598, bcm5704s only) bit field description init access 31-16 reserved - 0 r/o 15-0 receiver clock phase control receiver clock phase control (for hardware debug only). 0x3fff r/w www.datasheet.in bcm57xx programmer?s guide 01/29/08 broadcom corporation page 402 serdes registers document 57xx-pg105-r s er d es pll c ontrol r egister (o ffset 0 x 59c) this register is applicable to the bcm5704s mac transceiver serdes only. s er d es p hase s tatus r egister (o ffset 0 x 5a0) this register is applicable to the bcm5704s mac transceiver serdes only. table 284: serdes pll control register (offset 0x59c, bcm5704s only) bit field description init access 31-7 reserved 0 r/o 6 pll test pad enable pll test pad enable (for hardware diagnostics on port 1 only). 0r/w 5 pll test pad port select pll test pad port select (for hardware diagnostics on port 1 only). 0r/w 4 pll bypass enable pll bypass enable (for hardware diagnostics on port 1 only). 0r/w 3 pll bypass clock input pll bypass clock input (for hardware diagnostics on port 1 only). 0r/w 2 pll testpll enable pll test pll enable (for hardware diagnostics on port 1 only). 0r/w 1 pll reset pll reset (for hardware diagnostics on port 1 only). 0 r/w 0 pll power down pll power down (for hardware diagnostics on port 1 only). 0r/w table 285: serdes phase status register (offset 0x5a0, bcm5704s only) bit field description init access 31-18 reserved - 0 r/o 17 transmit data status transmit data (sigdet) status from hardware auto- negotiation (rev. a1 and above). 0r/o 16 comma detect status comma detect status from serdes_if. 0 r/o 15-0 receiver clock phase status receiver clock phase status. 0 r/o www.datasheet.in programmer?s guide bcm57xx 01/29/08 broadcom corporation document 57xx-pg105-r serdes registers page 403 h ardware a uto -n egotiation c ontrol r egister (o ffset 0 x 5b0) the below register definition is applicable to the bcm5704s mac transceiver serdes only. table 286: hardware auto-negotiation control register (offset 0x5b0, bcm5704s only) bit field description init access 31 autoneg enable when set, hardware auto-negotiation is enabled. 0 r/w 30 soft reset when set, a soft reset is performed. 0 r/w 29 disable link ready when set, disables link ready (xmit_data) check from hardware auto-negotiation. 0r/w 28-25 reserved - 0x0 r/o 24 crc16 clear clear crc16 bus. 1 r/w 23 en10b en10b 0 r/w 22 clear status when set, clears hardware auto-negotiation status. 0 r/w 21 duplex status local duplex status. 1 r/w 20 link status local link status. 1 r/w 19-18 speed status speed status. 10 r/w 17 jumbo packet disable when set, disables jumbo packets. 0 r/w 16 autoneg restart when set, restarts hardware auto-negotiation. 0 r/w 15 fiber mode fiber mode. 1 r/w 14-13 remote fault remote fault. 00 r/w 12 asymmetric pause capable when set, indicates that the local nic is asymmetric pause capable. 0r/w 11 pause capable when set, indicates that the local nic is pause capable. 0 r/w 10 gbic enable enable gbic. 1 r/w 9 check end enable enable check end in half-duplex mode. 0 r/w 8 error timer enable enable error timer for auto-negotiation in sgmii (not used in the bcm5704). 0r/w 7 half cycle clock phase half cycle clock phase select of sg_txclk_125. 0 r/w 6 gmii input select gmii input select from pad or from internal (not used in bcm5704). 0r/w 5 multiplexed status control select crc16_bus or mr_adv_ability (see ?hardware auto-negotiation status register (offset 0x5b4)? on page 404 ). ? 1 = sgmii crc16 bus ? 0 = mr_adv_ability 0r/w 4 comma detect enable when set, comma detection is enabled. 0 r/w 3 an reduce timer enable enable reduce timer of auto-negotiation. 0 r/w 2 auto-negotiation low enable enable auto-negotiation low enable. 0 r/w 1 remote loopback test remote loopback for testability. 0 r/w 0 loopback test loopback test. 0 r/w www.datasheet.in bcm57xx programmer?s guide 01/29/08 broadcom corporation page 404 serdes registers document 57xx-pg105-r s erdes r eceive c ontrol r egister (0 x 5b0, bcm5714 and bcm5715 only ) h ardware a uto -n egotiation s tatus r egister (o ffset 0 x 5b4) the below register definition is applicable to BCM5703s and bcm5704s devices only. table 287: serdes receive control register (0x5b0, bcm5714 and bcm5715 only) bits field description init access 31:10 reserved - - r/o 9 loopback enable - 0 r/w 8:0 reserved - 0 r/o table 288: hardware auto-negotiation status register (offset 0x5b4) bit field description init access 31-23 crc bit[15:7] of crc16 bus. 0x00 r/o 22-21 multiplexed status 1 ? link partner remote fault when multiplexed status control bit of ?hardware auto-negotiation control register (offset 0x5b0)? on page 403 = 0. ? crc16 bus(6:5) when multiplexed status control bit of ?hardware auto-negotiation control register (offset 0x5b0)? on page 403 = 1. 1r/o 20-19 multiplexed status 2 ? link partner pause bits when multiplexed status control bit of ?hardware auto-negotiation control register (offset 0x5b0)? on page 403 = 0. ? crc16(4:3) when multiplexed status control bit of ?hardware auto-negotiation control register (offset 0x5b0)? on page 403 = 1. 0r/o 18 multiplexed status 3 ? link partner half-duplex when multiplexed status control bit of ?hardware auto-negotiation control register (offset 0x5b0)? on page 403 = 0. ? crc16(2) when multiplexed status control bit of ?hardware auto-negotiation control register (offset 0x5b0)? on page 403 = 1. 0r/o 17 multiplexed status 4 ? link partner full-duplex when multiplexed status control bit of ?hardware auto-negotiation control register (offset 0x5b0)? on page 403 = 0. ? crc16(1) when multiplexed status control bit of ?hardware auto-negotiation control register (offset 0x5b0)? on page 403 = 1. 0r/o 16 multiplexed status 5 ? link partner next page when multiplexed status control bit of ?hardware auto-negotiation control register (offset 0x5b0)? on page 403 = 0. ? crc16(0) when multiplexed status control bit of ?hardware auto-negotiation control register (offset 0x5b0)? on page 403 = 1. 0r/o 15-12 reserved - 0 r/o 11-4 an states auto-negotiation state machine states (hardware debug use only). 0r/o 3 comma detector indicate comma detector. 0 r/o 2 mac ack status indicate mac acknowledge bit status. 0 r/o www.datasheet.in programmer?s guide bcm57xx 01/29/08 broadcom corporation document 57xx-pg105-r serdes registers page 405 s er d es t ransmit c ontrol r egister (0 x 5b4) the below register definition is applicable to bcm5714 and bcm5715 devices only. ump m ulticast m atch a ddress m ask r egister (0 x 5e4) 1 an complete auto-negotiation complete status (1 = complete). 0 r/o 0 an error auto-negotiation error status (1 = error). 0 r/o table 289: serdes transmit control register (0x5b4, bcm5714 and bcm5715 only) bits field description init access 31:28 reserved - 0 r/o 27 remote loopback en - 0 r/w 26 tbi_loopback_en - 0 r/w 25:16 reserved reserved 0 r/w 15:3 reserved - 0 r/o 2 loopback enable - 0 r/w 1:0 reserved - 0 r/o table 290: ump multicast match address mask register (0x5e4, bcm5714 only) bits field description init access 7:0 ump multicast mask mask a bit of ump multicast match address [47:40] during compare. bit 7: masks bit-47 bit 6: masks bit-46 bit 5: masks bit-45 bit 4: masks bit-44 bit 3: masks bit-43 bit 2: masks bit-42 bit 1: masks bit-41 bit 0: masks bit-40 0x00 r/w table 288: hardware auto-negotiation status register (offset 0x5b4) (cont.) bit field description init access www.datasheet.in bcm57xx programmer?s guide 01/29/08 broadcom corporation page 406 serdes registers document 57xx-pg105-r ump vlan m atch r egister (0 x 5e8) ump emac c ontrol r egister (0 x 5f0) table 291: ump vlan match register (0x5e8, bcm5714 and bcm5715 only) bits field description init access 11:0 ump match vlan vlan id value to be matched on an incoming packet to generate rdi cpu attention. 0x00 r/w table 292: ump emac control register (0x5f0, bcm5714 and bcm5715 only) bits field description init access 0 ump_vlan_match_en enable ump vlan id match 0 r/w 1 ump_bcast_match_en enable broadcast address match 0 r/w 2 ump_mcast_match_en enable multicast address match 0 r/w 3 ump_mac0_match_en enable mac0 address match 0 r/w 4 ump_mac1_match_en enable mac1 address match 0 r/w 5 ump_mac2_match_en enable mac2 address match 0 r/w 6 ump_mac3_match_en enable mac3 address match 0 r/w 7 disable_mc_hash disables the mc hash function in l2 address filter of the mac. 0r/w www.datasheet.in programmer?s guide bcm57xx 01/29/08 broadcom corporation document 57xx-pg105-r statistics registers page 407 s tatistics r egisters the following statistics registers are applicable only to bcm5705, bcm5788, bcm5721, bcm5751, bcm5752, bcm5714c, bcm5714s, bcm5715c, and bcm5715s devices. table 293: statistics registers address length description 0x0800-0x0803 bits 0:27 tx mac statistic counter?ifhcoutoctets 0x0804-0x0807 reserved 0x0808-0x080b bits 0:16 tx mac statistic counter?etherstatscollisions 0x080c-0x080f bits 0:16 tx mac statistic counter?outxonsent 0x0810-0x0813 bits 0:16 tx mac statistic counter?outxoffsent 0x0814-0x0817 reserved 0x0818-0x081b bits 0:16 tx mac statistic counter?dot3statsinternalmactransmiterrors 0x081c-0x081f bits 0:16 tx mac statistic counter?dot3statssinglecollisionframes 0x0820-0x0823 bits 0:16 tx mac statistic counter?dot3statsmultiplecollisionframes 0x0824-0x0827 bits 0:16 tx mac statistic counter?dot3statsdeferredtransmissions 0x0828-0x082b reserved 0x082c-0x082f bits 0:16 tx mac statistic counter?dot3statsexcessivecollisions 0x0830-0x0833 bits 0:16 tx mac statistic counter?dot3statslatecollisions 0x0834-0x086b reserved 0x086c-0x086f bits 0:27 tx mac statistic counter?ifhcoutucastpkts 0x0870-0x0873 bits 0:27 tx mac statistic counter?ifhcoutmulticastpkts 0x0874-0x0877 bits 0:27 tx mac statistic counter?ifhcoutbroadcastpkts 0x0878-0x087b bits 0:16 tx mac statistic counter?dot3statscarriersenseerrors 0x087c-0x087f bits 0:16 tx mac statistic counter?ifoutdiscards 0x0880-0x0883 bits 0:31 rx mac statistic counter?ifhcinoctets 0x0884-0x0887 reserved 0x0888-0x088b bits 0:16 rx mac statistic counter?etherstatsfragments 0x088c-0x088f bits 0:31 rx mac statistic counter?ifhcinucastpkts 0x0890-0x0893 bits 0:31 rx mac statistic counter?ifhcinmulticastpkts 0x0894-0x0897 bits 0:31 rx mac statistic counter?ifhcinbroadcastpkts 0x0898-0x089b bits 0:16 rx mac statistic counter?dot3statsfcserrors 0x089c-0x089f bits 0:16 rx mac statistic counter?dot3statsalignmenterrors 0x08a0-0x08a3 bits 0:16 rx mac statistic counter?xonpauseframesreceived 0x08a4-0x08a7 bits 0:16 rx mac statistic counter?xoffpauseframesreceived 0x08a8-0x08ab bits 0:16 rx mac statistic counter?maccontrolframesreceived 0x08ac-0x08af bits 0:16 rx mac statistic counter?xoffstateentered 0x08b0-0x08b3 bits 0:16 rx mac statistic counter?dot3statsframestoolong 0x08b4-0x08b7 bits 0:16 rx mac statistic counter?etherstatsjabbers 0x08b8-0x08bb bits 0:16 rx mac statistic counter?etherstatsundersizepkts 0x08bc-0x8ff reserved www.datasheet.in bcm57xx programmer?s guide 01/29/08 broadcom corporation page 408 statistics registers document 57xx-pg105-r t ransmit mac s tatistic c ounters ifhcoutoctets (offset 0x0800) the number of octets transmitted out of the interface, including framing characters. etherstatscollisions (offset 0x0808) the number of collisions experienced. outxonsent (offset 0x080c) sent xon. outxoffsent (offset 0x0810) sent xoff. dot3statsinternalmactransmiterrors (offset 0x0818) a count of frames for which transmission on a particular interface fails due to an internal mac sublayer transmit error. dot3statssinglecollisionframes (offset 0x081c) a count of successfully transmitted frames on a particular interface for which transmission is inhibited by exactly one collision. dot3statsmultiplecollisionframes (offset 0x0820) a count of successfully transmitted frames on a particular interface for which transmission is inhibited by more than one collision. dot3statsdeferredtransmissions (offset 0x0824) a count of frames for which the first transmission attempt on a particular interface is delayed because the medium is busy. dot3statsexcessivecollisions (offset 0x082c) a count of frames for which transmission on a particular interface fails due to excessive collisions. dot3statslatecollisions (offset 0x0830) the number of times that a collision is detected on a particular interface later than 512 bit-times into the transmission of a packet. ifhcoutucastpkts (offset 0x086c) the number of packets that higher-level protocols requested be transmitted, and that were not addressed to a multicast or broadcast address at this sublayer, including those that were discarded or not sent. ifhcoutmulticastpkts (offset 0x0870) the number of packets that higher-level protocols requested be transmitted, and that were addressed to a multicast address at this sublayer, including those that were discarded or not sent. www.datasheet.in programmer?s guide bcm57xx 01/29/08 broadcom corporation document 57xx-pg105-r statistics registers page 409 ifhcoutbroadcastpkts (offset 0x0874) the number of packets that higher-level protocols requested be transmitted, and that were addressed to a broadcast address at this sublayer, including those that were discarded or not sent. r eceive mac s tatistic c ounters ifhcinoctets (offset 0x0880) the number of octets received on the interface, including framing characters. etherstatsfragments (offset 0x0888) a frame size that is less than 64 bytes with a bad fcs. ifhcinucastpkts (offset 0x088c) the number of packets delivered by this sublayer to a higher (sub)layer, which were not addressed to a multicast or broadcast address at this sublayer. ifhcinmulticastpkts (offset 0x0890) the number of packets delivered by this sublayer to a higher (sub)layer, which were addressed to a multicast address at this sublayer. ifhcinbroadcastpkts (offset 0x0894) the number of packets delivered by this sublayer to a higher (sub)layer, which were addressed to a broadcast address at this sublayer. dot3statsfcserrors (offset 0x0898) a count of frames received on a particular interface that are an integral number of octets in length and do not pass the fcs check. dot3statsalignmenterrors (offset 0x089c) a count of frames received on a particular interface that are not an integral number of octets in length and do not pass the fcs check. xonpauseframesreceived (offset 0x08a0) mac control frames with pause command and length equal to zero. xoffpauseframesreceived (offset 0x08a4) mac control frames with pause command and length greater than zero. maccontrolframesreceived (offset 0x08a8) mac control frames with no pause command. www.datasheet.in bcm57xx programmer?s guide 01/29/08 broadcom corporation page 410 statistics registers document 57xx-pg105-r xoffstateentered (offset 0x08ac) transmitting is disabled. dot3statsframestoolongs (offset 0x08b0) a count of frames received on a particular interface that exceeds the maximum permitted frame size. etherstatsjabbers (offset 0x08b4) frames exceed jabber time. etherstatsundersizepkts (0x08b8) frames with a size less than 64 bytes. www.datasheet.in programmer?s guide bcm57xx 01/29/08 broadcom corporation document 57xx-pg105-r send data initiator control registers page 411 s end d ata i nitiator c ontrol r egisters table 294: send data initiator control registers offset registers 0x0c00-0x0c03 send data initiator mode 0x0c04-0x0c07 send data initiator status 0x0c08-0x0c0b send data initiator statistics control 0x0c0c-0x0c0f send data initiator statistics enable mask 0x0c10-0x0c13 send data initiator statistics increment mask 0x0c14-0x0c7f reserved 0x0c80-0x0c83 local statistics counter: class of service 1 0x0c84-0x0c87 local statistics counter: class of service 2 0x0c88-0x0c8b local statistics counter: class of service 3 0x0c8c-0x0c8f local statistics counter: class of service 4 0x0c90-0x0c93 local statistics counter: class of service 5 0x0c94-0x0c97 local statistics counter: class of service 6 0x0c98-0x0c9b local statistics counter: class of service 7 0x0c9c-0x0c9f local statistics counter: class of service 8 0x0ca0-0x0ca3 local statistics counter: class of service 9 0x0ca4-0x0ca7 local statistics counter: class of service 10 0x0ca8-0x0cab local statistics counter: class of service 11 0x0cac-0x0caf local statistics counter: class of service 12 0x0cb0-0x0cb3 local statistics counter: class of service 13 0x0cb4-0x0cb7 local statistics counter: class of service 14 0x0cb8-0x0cbb local statistics counter: class of service 15 0x0cbc-0x0cbf local statistics counter: class of service 16 0x0cc0-0x0cc3 local statistics counter: dma read queue full 0x0cc4-0x0cc7 local statistics counter: dma high priority read queue full 0x0cc8-0x0ccb local statistics counter: sdc queue full 0x0ccc-0x0ccf local statistics counter: nic ring set send producer index 0x0cd0-0x0cd3 local statistics counter: status updated 0x0cd4-0x0cd7 local statistics counter: interrupts 0x0cd8-0x0cdb local statistics counter: avoided interrupts 0x0cdc-0x0cdf local statistics counter: send threshold hit 0x0ce0-0x0fff reserved www.datasheet.in bcm57xx programmer?s guide 01/29/08 broadcom corporation page 412 send data initiator control registers document 57xx-pg105-r s end d ata i nitiator m ode r egister (o ffset 0 x 0c00) s end d ata i nitiator s tatus r egister (o ffset 0 x 0c04) table 295: send data initiator mode register (offset 0x0c00) bit field description init access 31-6 reserved - 0 r/o 5 multiple segment enable (bcm5721, bcm5751, bcm5752, bcm5714, and bcm5715 only) enable read dma to read multi-segment (up to four segments) in one dma request during tcp segmentation. 0r/w reserved (other devices) - 0 r/o 4 pre-dma debug enable(bcm5721, bcm5751, bcm5752, bcm5714, and bcm5715 only) when this bit is set, the send data initiator state machine will be halted if the pre-dma bit of the send bd is set. 0r/w reserved (other devices) - 0 r/o 3 hardware pre-dma enable (bcm5721, bcm5751, bcm5752, bcm5714, and bcm5715 only) enable hardware lso pre-dma processing. 0 r/w reserved (other devices) - 0 r/o 2 stats overflow attn enable enable attention for statistics overflow. 0 r/w 1 enable this bit controls whether the send data initiator state machine is active or not. when set to 0, it completes the current operation and cleanly halts. until it is completely halted, it remains one when read. 1r/w 0 reset when this bit is set to 1, the send data initiator state machine is reset. this is a self-clearing bit. 0r/w table 296: send data initiator status register (offset 0x0c04) bit field description init access 31-3 reserved - 0 r/o 2 stats overflow attn a statistics managed by send data initiator has overflowed. 0r/o 1-0 reserved - 0 r/o www.datasheet.in programmer?s guide bcm57xx 01/29/08 broadcom corporation document 57xx-pg105-r send data initiator control registers page 413 s end d ata i nitiator s tatistics c ontrol r egister (o ffset 0 x 0c08) table 297: send data initiator statistics control register (offset 0x0c08) bit field description init access 31-5 reserved - 0 r/o 4 reserved (bcm5705, bcm5788, bcm5721, bcm5751, bcm5752, bcm5714, and bcm5715 only) -0r/o force statistics zero (other devices) if set, forces the statistics in the nic memory to zeros. this should be done when statistics enable is low. only the masked statistics will be cleared. this is a self- clearing bit. 0r/w 3 reserved (bcm5705, bcm5788, bcm5721, bcm5751, bcm5752, bcm5714, and bcm5715 only) -0r/o force statistics flush (other devices) if set, forces a flush of the local statistics to the nic memory by doing a read-modify-write operation. this can be set only when statistics enable is low. only the masked statistics will be flushed. self-clearing when flush completes. 0r/w 2 statistics clear if set, resets local statistics counters to zero. clears only masked statistics. self-clearing when done. 0r/w 1 reserved (bcm5705, bcm5788, bcm5721, bcm5751, bcm5752, bcm5714, and bcm5715 only) -0r/o faster statistics update (other devices) allow a faster update of the statistics counters to the nic memory. when set, one statistics is updated every 15 us (or 998 clocks). when reset, one statistics is updated every 25 us (or 1662 clocks). 0r/w 0 statistics enable when set, allows the local statistics counters to increment. when reset, counters hold their values until next update to the nic memory. enables only masked statistics. 0r/w www.datasheet.in bcm57xx programmer?s guide 01/29/08 broadcom corporation page 414 send data initiator control registers document 57xx-pg105-r s end d ata i nitiator s tatistics e nable m ask r egister (o ffset 0 x 0c0c) this version of the send data initiator statistics enable mask register applies to the bcm5705, bcm5788, bcm5721, bcm5751, bcm5752, bcm5714, and bcm5715 devices only. rest of bcm57xx family this version of the send data initiator statistics enable mask register applies to the rest of the bcm57xx family. table 298: send data initiator statistics enable mask register (offset 0x0c0c) bit field description init access 31-19 reserved - 0 r/o 18-16 counters enable mask mask controls which statistics can be updated, cleared or flushed. bits 16-18 correspond to dma read queue full, dma high priority read queue full, and send data completion queue full respectively. 0r/w 15-1 reserved - 0 r/o 0 counters enable mask controls whether class of service 0 statistics can be updated, cleared, or flushed. 0r/w table 299: send data init. stat. enable mask register (offset 0x0c0c, rest of bcm57xx family) bit field description init access 31-24 reserved - 0 r/o 23-0 counters enable mask controls which statistics can be updated, cleared or flushed. ? bits 0-15 correspond to statistics for class of service 1-16. ? bits 16-23 correspond to dma read queue full, dma high priority read queue full, and send data completion queue full, set send producer index, status updated, interrupts, avoided interrupts, send threshold hit respectively. 0r/w www.datasheet.in programmer?s guide bcm57xx 01/29/08 broadcom corporation document 57xx-pg105-r send data initiator control registers page 415 s end d ata i nitiator s tatistics i ncrement m ask r egister (o ffset 0 x 0c10) this version of the send data initiator statistics enable mask register applies to the bcm5705, bcm5788, bcm5721, bcm5751, bcm5752, bcm5714, and bcm5715 devices only. rest of bcm57xx family this version of the send data initiator statistics increment mask register applies to the rest of the bcm57xx family. l ocal s tatistics c ounters (o ffset 0 x 0c80-0 x 0cdf) the registers 0xc84-0xcbf and 0x0ccc-0x0cdf are reserved in bcm5714 and bcm5715 devices. table 300: send data initiator statistics increment mask register (offset 0x0c10) bit field description init access 31-24 reserved - 0 r/o 23-19 counters increment mask writing a 1 to the bit position forces the corresponding statistics counter to increment by 1. not affected by statistics enable mask. bits 16-23 correspond to set send producer index, status updated, interrupts, avoided interrupts, send threshold hit respectively. 0w/o 18-16 reserved - 0 r/o 15-0 writing a 1 to the bit position forces the corresponding statistics counter to increment by 1. not affected by the statistics enable mask. bits 15-0 correspond to statistics for class of service 16-1. 0w/o table 301: send data init. stat. increment mask register (offset 0x0c10, rest of bcm57xx family) bit field description init access 31-24 reserved - 0 r/o 23-0 counters increment mask writing a 1 to the bit position forces the corresponding statistics counter to increment by 1. not affected by statistics enable mask. ? bits 0-15 correspond to statistics for class of service 1-16. ? bits 16-23 correspond to dma read queue full, dma high priority read queue full, and send data completion queue full, set send producer index, status updated, interrupts, avoided interrupts, send threshold hit respectively. 0w/o table 302: local statistics counters (offset 0x0c80-0x0cdf) bit field description init access 31-10 reserved - 0 r/o 9-0 counter value the current counter value for statistics kept by the send data initiator. r/o www.datasheet.in bcm57xx programmer?s guide 01/29/08 broadcom corporation page 416 tcp segmentation control registers document 57xx-pg105-r tcp s egmentation c ontrol r egisters these registers are applicable to the bcm5705, bcm5788, bcm5721, bcm5751, bcm5752, bcm5714, and bcm5715 devices only. l ower h ost a ddress r egister for tcp s egmentation (o ffset 0 x ce0) this register is applicable to the bcm5705, bcm5788, bcm5721, bcm5751, bcm5752, bcm5714, and bcm5715 devices only. u pper h ost a ddress r egister for tcp s egmentation (o ffset 0 x ce4) this register is applicable to the bcm5705, bcm5788, bcm5721, bcm5751, bcm5752, bcm5714, and bcm5715 devices only. table 303: tcp segmentation control registers offset registers 0x0ce0-0x0ce3 lower host address register for tcp segmentation 0x0ce4-0x0ce7 upper host address register for tcp segmentation 0x0ce8-0x0ceb length/offset register for tcp segmentation 0x0cec-0x0cef dma flags register for tcp segmentation 0x0cf0-0x0cf3 vlan tag register for tcp segmentation 0x0cf4-0x0cf7 pre-dma command exchange register for tcp segmentation table 304: lower host address register for tcp segmentation (offset 0xce0) bit field description init access 31-0 specifies the lower 32 bits of the starting address in host memory where the transmit data buffer resides. 0r/w table 305: upper host address register for tcp segmentation (offset 0xce4) bit field description init access 31-0 specifies the upper 32 bits of the starting address in host memory where the transmit data buffer resides. 0r/w www.datasheet.in programmer?s guide bcm57xx 01/29/08 broadcom corporation document 57xx-pg105-r tcp segmentation control registers page 417 l ength /o ffset r egister for tcp s egmentation (o ffset 0 x ce8) this register is applicable to the bcm5705, bcm5788, bcm5721, bcm5751, bcm5752, bcm5714, and bcm5715 devices only. dma f lags r egister for tcp s egmentation (o ffset 0 x cec) this register is applicable to the bcm5705, bcm5788, bcm5721, bcm5751, bcm5752, bcm5714, and bcm5715 devices only. table 306: length/offset register for tcp segmentation (offset 0xce8) bit field description init access 31-23 reserved the bits can be written/read, but has no chip impact. 0 r/o 22-16 mbuf offset mbuf offset. it specifies the offset of the first txmbuf at where the dma starts putting data. the valid value is between 48 and 128. 0r/w 15-0 specifies the length of data to be transmitted. although firmware can specify up to 64 kb, it should not attempt to program more than 8 kb because it would exceed the size of txmbuf. 0r/w table 307: dma flags register for tcp segmentation (offset 0xcec) bit field description init access 31-20 reserved - 0 r/o 19 mbuf offset valid mbuf offset valid. when this bit is set, the rdma engine will dma the data into the txmbuf starting at an offset specified in the length/offset register (see ?length/offset register for tcp segmentation (offset 0xce8)? on page 417 ). 0r/w 18 last fragment last fragment. this bit is passed transparently to the sdc. when this bit is set, the sdc will inform the hc to increment the send ring consumer index. ? the bit is always set by hardware if no firmware assisted tcp segmentation occurs. ? otherwise, firmware sets it at the end of fragmentation. 0r/w 17 no word swap no word swap. set to disable endian word swap on data from pci bus. 0r/w 16 reserved the bit can be written/read, but has no chip impact. 0 r/o 15-14 mac source address insertion mac source address insertion. this 2-bit field determines which of the four mac addresses should be inserted into the frame. 0r/w 13 mac source address insertion mac source address insertion. indicates that the predetermined source address is inserted into the ethernet header of the frame. 0r/w 12 tcp/udp checksum enable tcp/udp checksum enable. 0 r/w 11 ip checksum enable ip checksum enable. 0 r/w www.datasheet.in bcm57xx programmer?s guide 01/29/08 broadcom corporation page 418 tcp segmentation control registers document 57xx-pg105-r vlan t ag r egister for tcp s egmentation (o ffset 0 x cf0) this register is applicable to the bcm5705, bcm5788, bcm5721, bcm5751, bcm5752, bcm5714, and bcm5715 devices only. 10 force raw checksum enable force raw checksum enable. 0 r/w 9 checksum offset checksum offset. ? when bit 10 is set to 1 and this bit is 0, the checksum will start at offset of 14. ? when bit 10 is set to 1 and this bit is 1, the checksum will start at offset of 0 (i.e., checksum calculation will be performed on all data written into txmbuf). 0r/o 8 reserved the bit can be written/read, but has no chip impact. 0 r/w 7 vlan tag present vlan tag present. indicates that the vlan tag should be copied into the frame header by the dma engine. 0r/w 6 force interrupt force interrupt. following the completion of this dma, a host interrupt is generated. 0r/w 5 last bd in frame last bd in frame. 0 r/w 4 coalesce now coalesce now. pass through send buffer descriptor flag. 0r/w 3 reserved the bit can be written/read, but has no chip impact. 0 r/o 2 invoke processor invoke processor. clear the pass bit of the entry queued to the sdcq, so that sdc will invoke the cpu. ? if the packet is created by hardware, this bit will be the same as bit 9 (bd_flag_cpu_post_dma) of the flag field in the send bd. ? if the packet is created by firmware, it will be up to cpu whether it needs to post-process the data. 0r/w 1 don?t generate crc do not generate crc. pass through send buffer descriptor flag. 0r/w 0 no byte swap no byte swap. set to disable endian byte swap on data from pci bus. 0r/w table 308: vlan tag register for tcp segmentation (offset 0xcf0) bit field description init access 31-16 reserved - 0 r/o 15-0 vlan tag to be inserted into the frame header if bit 7 of dma flags register is set. 0r/w table 307: dma flags register for tcp segmentation (offset 0xcec) (cont.) bit field description init access www.datasheet.in programmer?s guide bcm57xx 01/29/08 broadcom corporation document 57xx-pg105-r tcp segmentation control registers page 419 p re -dma c ommand e xchange r egister for tcp s egmentation (o ffset 0 x cf4) this register is applicable to the bcm5705, bcm5788, bcm5721, bcm5751, bcm5752, bcm5714, and bcm5715 devices only. table 309: vlan tag register for tcp segmentation (offset 0xcf0) bit field description init access 31 ready the cpu sets this bit to tell the sdi that the dma address, length, flags, and vlan tag are valid and the request is ready to be go. the cpu polls this bit to be clear for the completion of the request. 0r/w 30 pass if this bit is set to 0, the cpu will be responsible for processing the buffer descriptor. 1r/w 29 skip the cpu sets this bit to 1 to inform the sdi that the tcp segmentation is completed, and the bd_index can be incremented. 0r/w 28-7 reserved - 0 r/o 6-0 bd_index the internal current buffer descriptor pointer that the hardware/firmware is servicing. 0r/w www.datasheet.in bcm57xx programmer?s guide 01/29/08 broadcom corporation page 420 send data completion control registers document 57xx-pg105-r s end d ata c ompletion c ontrol r egisters s end d ata c ompletion m ode r egister (o ffset 0 x 1000) p ost -dma c ommand e xchange r egister for tcp s egmentation (o ffset 0 x 1008) this register is applicable to bcm5705, bcm5788, bcm5721, bcm5751, bcm5752, bcm5714, and bcm5715 devices only. table 310: send data completion control registers offset registers 0x1000-0x1003 send data completion mode. 0x1004-0x1007 reserved. 0x1008-0x100b post-dma command exchange for tcp segmentation (bcm5705, bcm5714, bcm5721, and bcm5751 only). 0x100c-0x13ff reserved. table 311: send data completion mode register (offset 0x1000) bit field description init access 31-3 reserved - 0 r/o 2 long bd burst read fix (bcm5705 a2 only) when this bit is cleared and the device is operating in long burst mode (see table 402 on page 477 ), there is no requirement that the consumer and producer indices of the standard receive producer ring be less than 64. 0r/w reserved - 0 r/o 1 enable this bit controls whether the send data completion state machine is active or not. when set to 0, it completes the current operation and cleanly halts. until it is completely halted, it remains one when read. 1r/w 0 reset when this bit is set to 1, the send data completion state machine is reset. this is a self-clearing bit. 0r/w table 312: post-dma command exchange register for tcp segmentation (offset 0x1008) bit field description init access 31 pass if this bit is set to 0, the cpu will be invoked to process the txmbuf data. it is the same as sdcq bit 13. 1r/w 30 skip the cpu sets this bit to 1 to inform the sdc that the post-processing is completed and the hardware can resume operation. 0r/w 29 end of fragmentation end of fragmentation. if this bit is set to 1, the sdc will requests the hc to increment the send ring consumer index when the cpu sets the skip bit. it is the same as sdcq bit 12. 1r/w 28-12 reserved - 0 r/o 11-6 head txmbuf pointer head txmbuf pointer. they are the same as sdcq bits 11:6. 0 r/w 5-0 tail txmbuf pointer tail txmbuf pointer. they are the same as sdcq bits 5:0. 0 r/w www.datasheet.in programmer?s guide bcm57xx 01/29/08 broadcom corporation document 57xx-pg105-r send bd ring selector control registers page 421 s end bd r ing s elector c ontrol r egisters the following registers may be used by software for debug and diagnostic purposes. for example, host software could compare the send bd consumer index located in the status block (see ?status block? on page 103 ) to the registers located in this region. table 313: send bd ring selector control registers offset registers 0x1400-0x1403 send bd ring selector mode 0x1404-0x1407 send bd ring selector status 0x1408-0x140b send bd ring selector hardware diagnostics 0x140c-0x143f reserved 0x1440-0x1443 send bd diagnostic ring selector local nic send bd 1 consumer index 0x1444-0x1447 send bd diagnostic ring selector local nic send bd 2 consumer index 0x1448-0x144b send bd diagnostic ring selector local nic send bd 3 consumer index 0x144c-0x144f send bd diagnostic ring selector local nic send bd 4 consumer index 0x1450-0x1453 send bd diagnostic ring selector local nic send bd 5 consumer index 0x1454-0x1457 send bd diagnostic ring selector local nic send bd 6 consumer index 0x1458-0x145b send bd diagnostic ring selector local nic send bd 7 consumer index 0x145c-0x145f send bd diagnostic ring selector local nic send bd 8 consumer index 0x1460-0x1463 send bd diagnostic ring selector local nic send bd 9 consumer index 0x1464-0x1467 send bd diagnostic ring selector local nic send bd 10 consumer index 0x1468-0x146b send bd diagnostic ring selector local nic send bd 11 consumer index 0x146c-0x146f send bd diagnostic ring selector local nic send bd 12 consumer index 0x1470-0x1473 send bd diagnostic ring selector local nic send bd 13 consumer index 0x1474-0x1477 send bd diagnostic ring selector local nic send bd 14 consumer index 0x1478-0x147b send bd diagnostic ring selector local nic send bd 15 consumer index 0x147c-0x147f send bd diagnostic ring selector local nic send bd 16 consumer index 0x1480-0x17ff reserved www.datasheet.in bcm57xx programmer?s guide 01/29/08 broadcom corporation page 422 send bd ring selector control registers document 57xx-pg105-r s end bd r ing s elector m ode r egister (o ffset 0 x 1400) s end bd r ing s elector s tatus r egister (o ffset 0 x 1404) s end bd r ing s elector h ardware d iagnostics r egister (o ffset 0 x 1408) this version of the send bd ring selector hardware diagnostics register applies to bcm5705, bcm5788, bcm5721, bcm5751, bcm5752, bcm5714, and bcm5715 devices only. rest of bcm57xx family this version of the send bd ring selector hardware diagnostics register applies to the rest of the bcm57xx family. table 314: send bd ring selector mode register (offset 0x1400) bit field description init access 31-3 reserved - 0 r/o 2 attn_enable when this bit is set to 1, an internal attention is generated when an error occurs. r/w 1 enable this bit controls whether the send bd ring selector state machine is active or not. when set to 0, it completes the current operation and cleanly halts. until it is completely halted, it remains 1 when read. r/w 0 reset when this bit is set to 1, the send bd ring selector state machine is reset. this is a self-clearing bit. r/w table 315: send bd ring selector status register (offset 0x1404) bit field description init access 31-3 reserved - 0 r/o 2 error send bd ring selector error status. r/o 1-0 reserved - 0 r/o table 316: send bd ring selector hardware diagnostics register (offset 0x1408) bit field description init access 31-0 reserved - 0 r/o table 317: send bd ring selector hw diag. register (offset 0x1408, rest of bcm57xx family) bit field description init access 31-16 reserved - 0 r/o 15-12 sbds rnstms ring number sent to mailbox block. r/o 11-8 sbds srn send bd ring selector staged ring number. r/o 7-4 sbds crn current ring number. r/o 3-0 sbds state current send bd ring selector state. r/o www.datasheet.in programmer?s guide bcm57xx 01/29/08 broadcom corporation document 57xx-pg105-r send bd initiator control registers page 423 s end bd d iagnostic r ing s elector l ocal nic s end bd c onsumer i ndex r egisters (o ffset 0 x 1440-0 x 147c) this set of registers is used to keep track of the current dmas queued to move send data from the host to the nic. s end bd i nitiator c ontrol r egisters these registers are available for diagnostic and debug purposes. for example, host software may compare the value written to the high priority mailbox region (see ?high-priority mailboxes? on page 370 ) against the value the mac processes located in the send bd initiator control register region. table 318: send bd diag. ring selector local nic send bd consumer index registers (offset 0x1440) bit field description init access 31-9 reserved - 0 r/o 8-0 index these nine bits contain the current nic send bd index. r/o table 319: send bd ring selector control registers offset registers 0x1800-0x1803 send bd initiator mode 0x1804-0x1807 send bd initiator status 0x1808-0x180b send bd diagnostic initiator local nic send bd 1 producer index 0x180c-0x180f send bd diagnostic initiator local nic send bd 2 producer index 0x1810-0x1813 send bd diagnostic initiator local nic send bd 3 producer index 0x1814-0x1817 send bd diagnostic initiator local nic send bd 4 producer index 0x1818-0x181b send bd diagnostic initiator local nic send bd 5 producer index 0x181c-0x181f send bd diagnostic initiator local nic send bd 6 producer index 0x1820-0x1823 send bd diagnostic initiator local nic send bd 7 producer index 0x1824-0x1827 send bd diagnostic initiator local nic send bd 8 producer index 0x1828-0x182b send bd diagnostic initiator local nic send bd 9 producer index 0x182c-0x182f send bd diagnostic initiator local nic send bd 10 producer index 0x1830-0x1833 send bd diagnostic initiator local nic send bd 11 producer index 0x1834-0x1837 send bd diagnostic initiator local nic send bd 12 producer index 0x1838-0x183b send bd diagnostic initiator local nic send bd 13 producer index 0x183c-0x183f send bd diagnostic initiator local nic send bd 14 producer index 0x1840-0x1843 send bd diagnostic initiator local nic send bd 15 producer index 0x1844-0x1847 send bd diagnostic initiator local nic send bd 16 producer index 0x1848-0x1bff reserved www.datasheet.in bcm57xx programmer?s guide 01/29/08 broadcom corporation page 424 send bd initiator control registers document 57xx-pg105-r s end bd i nitiator m ode r egister (o ffset 0 x 1800) s end bd i nitiator s tatus r egister (o ffset 0 x 1804) s end bd d iagnostic i nitiator l ocal nic s end bd n p roducer i ndex r egisters (o ffset 0 x 1808-0 x 1844) this set of registers is used to keep track of the current dmas queued to move send bds from the host to the nic. table 320: send bd initiator mode register (offset 0x1800) bit field description init access 31-3 reserved - 0 r/o 2 attn_enable when this bit is set to 1, an internal attention is generated when an error occurs. -r/w 1 enable this bit controls whether the send bd initiator state machine is active or not. when set to 0, it completes the current operation and cleanly halts. until it is completely halted, it remains 1 when read. 1r/w 0 reset when this bit is set to 1, the send bd initiator state machine is reset. this is a self-clearing bit. 0r/w table 321: send bd initiator status register (offset 0x1804) bit field description init access 31-3 reserved - 0 r/o 2 error sends bd initiator error. - r/o 1-0 reserved - 0 r/o www.datasheet.in programmer?s guide bcm57xx 01/29/08 broadcom corporation document 57xx-pg105-r send bd completion control registers page 425 s end bd c ompletion c ontrol r egisters s end bd c ompletion m ode r egister (o ffset 0 x 1c00) table 322: send bd completion control registers offset registers 0x1c00-0x1c03 send bd completion mode. 0x1c04-0x1fff reserved. table 323: send bd completion mode register (offset 0x1c00) bit field description init access 31-3 reserved - 0 r/o 2 attn_enable when this bit is set to 1, an internal attention is generated when an error occurs. 0r/w 1 enable this bit controls whether the send bd completion state machine is active or not. when set to 0, it completes the current operation and cleanly halts. until it is completely halted, it remains one when read. 1r/w 0 reset when this bit is set to 1, the send bd completion state machine is reset. this is a self-clearing bit. 0r/w www.datasheet.in bcm57xx programmer?s guide 01/29/08 broadcom corporation page 426 receive list placement control registers document 57xx-pg105-r r eceive l ist p lacement c ontrol r egisters table 324: receive list placement control registers offset registers 0x2000-0x2003 receive list placement mode 0x2004-0x2007 receive list placement status 0x2008-0x200b receive selector list lock register 0x200c-0x200f receive selector non-empty bits register 0x2010-0x2013 receive list placement configuration register 0x2014-0x2017 receive list placement statistics control 0x2018-0x201b receive list placement statistics enable mask 0x201c-0x201f receive list placement statistics increment mask 0x2020-0x20ff reserved 0x2100-0x2103 receive selector list 1 head 0x2104-0x2107 receive selector list 1 tail 0x2108-0x210b receive selector list 1 count 0x210c-0x210f reserved 0x2110-0x2113 receive selector list 2 head 0x2114-0x2117 receive selector list 2 tail 0x2118-0x211b receive selector list 2 count 0x211c-0x211f reserved 0x2120-0x2123 receive selector list 3 head 0x2124-0x2127 receive selector list 3 tail 0x2128-0x212b receive selector list 3 count 0x212c-0x212f reserved 0x2130-0x2133 receive selector list 4 head 0x2134-0x2137 receive selector list 4 tail 0x2138-0x213b receive selector list 4 count 0x213c-0x213f reserved 0x2140-0x2143 receive selector list 5 head 0x2144-0x2147 receive selector list 5 tail 0x2148-0x214b receive selector list 5 count 0x214c-0x214f reserved 0x2150-0x2153 receive selector list 6 head 0x2154-0x2157 receive selector list 6 tail 0x2158-0x215b receive selector list 6 count 0x215c-0x215f reserved 0x2160-0x2163 receive selector list 7 head 0x2164-0x2167 receive selector list 7 tail www.datasheet.in programmer?s guide bcm57xx 01/29/08 broadcom corporation document 57xx-pg105-r receive list placement control registers page 427 0x2168-0x216b receive selector list 7 count 0x216c-0x216f reserved 0x2170-0x2173 receive selector list 8 head 0x2174-0x2177 receive selector list 8 tail 0x2178-0x217b receive selector list 8 count 0x217c-0x217f reserved 0x2180-0x2183 receive selector list 9 head 0x2184-0x2187 receive selector list 9 tail 0x2188-0x218b receive selector list 9 count 0x218c-0x218f reserved 0x2190-0x2193 receive selector list 10 head 0x2194-0x2197 receive selector list 10 tail 0x2198-0x219b receive selector list 10 count 0x219c-0x219f reserved 0x21a0-0x21a3 receive selector list 11 head 0x21a4-0x21a7 receive selector list 11 tail 0x21a8-0x21ab receive selector list 11 count 0x21ac-0x21af reserved 0x21b0-0x21b3 receive selector list 12 head 0x21b4-0x21b7 receive selector list 12 tail 0x21b8-0x21bb receive selector list 12 count 0x21bc-0x21bf reserved 0x21c0-0x21c3 receive selector list 13 head 0x21c4-0x21c7 receive selector list 13 tail 0x21c8-0x21cb receive selector list 13 count 0x21cc-0x21cf reserved 0x21d0-0x21d3 receive selector list 14 head 0x21d4-0x21d7 receive selector list 14 tail 0x21d8-0x21db receive selector list 14 count 0x21dc-0x21df reserved 0x21e0-0x21e3 receive selector list 15 head 0x21e4-0x21e7 receive selector list 15 tail 0x21e8-0x21eb receive selector list 15 count 0x21ec-0x21ef reserved 0x21f0-0x21f3 receive selector list 16 head 0x21f4-0x21f7 receive selector list 16 tail 0x21f8-0x21fb receive selector list 16 count 0x21fc-0x21ff reserved 0x2200-0x2203 local statistics counter: class of service 1 table 324: receive list placement control registers (cont.) offset registers www.datasheet.in bcm57xx programmer?s guide 01/29/08 broadcom corporation page 428 receive list placement control registers document 57xx-pg105-r 0x2204-0x2207 local statistics counter: class of service 2 0x2208-0x220b local statistics counter: class of service 3 0x220c-0x220f local statistics counter: class of service 4 0x2210-0x2213 local statistics counter: class of service 5 0x2214-0x2217 local statistics counter: class of service 6 0x2218-0x221b local statistics counter: class of service 7 0x221c-0x221f local statistics counter: class of service 8 0x2220-0x2223 local statistics counter: class of service 9 0x2224-0x2227 local statistics counter: class of service 10 0x2228-0x222b local statistics counter: class of service 11 0x222c-0x222f local statistics counter: class of service 12 0x2230-0x2233 local statistics counter: class of service 13 0x2234-0x2237 local statistics counter: class of service 14 0x2238-0x223b local statistics counter: class of service 15 0x223c-0x223f local statistics counter: class of service 16 0x2240-0x2243 local statistics counter: drop due to filter 0x2244-0x2247 local statistics counter: dma write queue full 0x2248-0x224b local statistics counter: dma high priority write queue full 0x224c-0x224f local statistics counter: no more receive bd 0x2250-0x2253 local statistics counter: ifindiscards 0x2254-0x2257 local statistics counter: ifinerrors 0x2258-0x225b local statistics counter: receive threshold hit 0x225c-0x23ff reserved table 324: receive list placement control registers (cont.) offset registers www.datasheet.in programmer?s guide bcm57xx 01/29/08 broadcom corporation document 57xx-pg105-r receive list placement control registers page 429 r eceive l ist p lacement m ode r egister (o ffset 0 x 2000) r eceive l ist p lacement s tatus r egister (o ffset 0 x 2004) table 325: receive list placement mode register (offset 0x2000) bit field description init access 31-5 reserved - 0 r/o 4 stats overflow attn enable enable attention for statistics overflow. - r/w 3 mapping out of range attn enable enable attention for mapping out of range error. - r/w 2 class zero attn enable enable attention for zero class field. - r/w 1 enable this bit controls whether the receive list placement state machine is active or not. when set to 0, it completes the current operation and cleanly halts. until it is completely halted, it remains one when read. 1r/w 0 reset when this bit is set to 1, the receive list placement state machine is reset. this is a self-clearing bit. 0r/w table 326: receive list placement status register (offset 0x2004) bit field description init access 31-5 reserved - 0 r/o 4 stats overflow attn a statistics managed by receive list placement has overflowed. -r/o 3 mapping out of range attn class of service mapping is out of the range of the active queue number. -r/o 2 class zero attn class field extracted from frame descriptor is zero. - r/o 1-0 reserved - 0 r/o www.datasheet.in bcm57xx programmer?s guide 01/29/08 broadcom corporation page 430 receive list placement control registers document 57xx-pg105-r r eceive s elector l ist l ock r egister (o ffset 0 x 2008) this 32-bit register is used by the riscs to obtain exclusive access to a selector list head, tail, and counter. bits 0 and 16 refer to receive selector list 1. bits 31 and 15 refer to receive selector list 16. to use this register, set the appropriate r equest bit and then read back the register checking the associated grant bit. if the grant bit is set, the lock has been obtained. to free the lock, reset the request bit. if the request bit is 1 but the grant bit is 0, then a request to lock that particular li st is pending. similarly, if the request bit is 0 but the grant bit is 1, then a request to free that particular list is pending. a r equest to lock a particular list is successful when both request and grant bits are 1. similarly, a request to free a particular list is successful when both request and grant bits are 0. r eceive s elector n on -e mpty b its r egister (o ffset 0 x 200c) this 32-bit register is used by the riscs to quickly determine the status of the receive selector. bit 0 refers to receive sele ctor list 1. bit 15 refers to receive selector list 16. if this register is nonzero the receive selector non-empty bit is set in the rx- cpu event register. table 327: receive selector list lock register (offset 0x2008) bit field description init access 31-16 grant bits each bit is mapped to indicate that a cpu currently has locked a particular selector list?s head, tail, and count register. -r/o 15-0 request bits each bit is mapped to allow a cpu to request a lock for a particular selector list?s head, tail, and count register. when a request bit is set, the hardware attempts to obtain the associated lock. when successful, the associated grant bit is set. when unsuccessful, the associated grant bit is not set. -r/w table 328: receive selector non-empty bits register (offset 0x200c) bit field description init access 31-16 reserved - 0 r/o 15-0 list non-empty bits if set, the bit indicates that the associated list is not empty (that is the counter is nonzero). r/o www.datasheet.in programmer?s guide bcm57xx 01/29/08 broadcom corporation document 57xx-pg105-r receive list placement control registers page 431 r eceive l ist p lacement c onfiguration r egister (o ffset 0 x 2010) table 329: receive list placement configuration register (offset 0x2010) bit field description init access 31-15 reserved - 0 r/o 14-13 default interrupt distribution queue default interrupt distribution queue. number within a class of service group when the frame has errors, is truncated, or is a non-ip frame. 00 r/w 12-8 bad frames class (bcm5705, bcm5788, bcm5721, bcm5751, bcm5752, bcm5714, and bcm5715 only) default class for error or truncated frames. these frames are placed in this class of service group when the allow bad frame bit (bit 11) is set in the mode control register. 00001 r/o bad frames class (other devices) default class for error or truncated frames. these frames are placed in this class of service group when the allow bad frame bit (bit 11) is set in the mode control register. 00000 r/w 7-3 number of active lists the total number of active receive lists. the value must be between 1 and 16. this value must be an integer multiple of the number of lists per distribution group value. 00000 r/w 2-0 number of lists per distribution group specifies the number of lists per interrupt distribution group. this register must always be a power of 2. for example, if the system wants four classes of service and four interrupt distribution lists per class of service, this value is set to four and the number of active lists value is set to 16. 000 r/w www.datasheet.in bcm57xx programmer?s guide 01/29/08 broadcom corporation page 432 receive list placement control registers document 57xx-pg105-r r eceive l ist p lacement s tatistics c ontrol r egister (o ffset 0 x 2014) table 330: receive list placement statistics control register (offset 0x2014) bit field description init access 31-5 reserved - 0 r/o 4 reserved (bcm5705, bcm5788, bcm5721, bcm5751, bcm5752, bcm5714, and bcm5715 only) -0r/o force statistics zero (other devices) if set, forces the statistics in nic memory to zeros. this should be done when statistics enable is low. only the masked statistics will be cleared. this is a self-clearing bit. 0r/w 3 reserved (bcm5705, bcm5788, bcm5721, bcm5751, bcm5752, bcm5714, and bcm5715 only) -0r/o force statistics flush (other devices) when set, forces a flush of the local statistics to the nic memory by doing a read-modify-write operation. this can be set only when statistics enable is low. flushes only masked statistics. self-clearing when flush completes. 0r/w 2 statistics clear when set, resets local statistics counters to zero. clears only masked statistics. self-clearing when done. 0r/w 1 reserved (bcm5705, bcm5788, bcm5721, bcm5751, bcm5752, bcm5714, and bcm5715 only) -0r/o faster statistics update (other devices) allows a faster update of the statistics counters to the nic memory. when set, one statistics is updated every 15 us (or 998 clocks). when not set, one statistics is updated every 25 us (or 1662 clocks). r/w 0 statistics enable when set, allow the local statistics counters to increment. when reset, counters hold their values until the next update to the nic memory. enables only masked statistics. 0r/w www.datasheet.in programmer?s guide bcm57xx 01/29/08 broadcom corporation document 57xx-pg105-r receive list placement control registers page 433 r eceive l ist p lacement s tatistics e nable m ask r egister (o ffset 0 x 2018) this version of the receive list placement statistics enable mask register applies to the bcm5705, bcm5788, bcm5721, bcm5751, bcm5752, bcm5714, and bcm5715 devices only. table 331: receive list placement statistics enable mask register (offset 0x2018) bit field description init access 31-23 reserved ? 0 r/o 22 dynamic switching lso during long burst read fix (bcm5751 and bcm5721 a2 versions only). dynamic switching lso during long burst read bug fix enable. set to 0 to enable the fix. this bit is valid for a2 only. r/w 21-19 reserved ? 0 r/o 18 static switching lso during long burst read fix (bcm5721 and bcm5751 a2 only) static switching lso during long burst read bug fix enable. set to 0 to enable the fix. this bit is valid for a2 only. 0r/w disable mactq double ack issue fix (bcm5752, bcm5714, bcm5715, b1 and later versions of bcm5751, and b1 and later versions of bcm5721 devices only) disable mactq double ack issue fix. ? 1: disabled ? 0: enabled 1r/w reserved (other devices) ? 0 r/o 17-2 bcm57xx asic revision id. the value is: ? 0x3001 for a1 ? 0x0000 for a0 note: see ?revision levels? on page 5 . r/w 1 keep clkrun behavior the same as a0 (bcm5721 and bcm5751 a1 version only) when this bit is set, the chip behaves the same as in a0. clkrun is not expected to work unless clock control register (see ?pci clock control register (offset 0x74)? on page 334 ) bit 21 is set. this bit is valid for a1 only. 1r/w disable asf lockup issue fix (b1 and later versions of bcm5751 and bcm5721 only) disable asf lockup fix. ? 1: disabled ? 0: enabled 1r/w 0 reserved ? 0 r/o www.datasheet.in bcm57xx programmer?s guide 01/29/08 broadcom corporation page 434 receive list placement control registers document 57xx-pg105-r rest of bcm57xx family this version of the receive list placement statistics enable mask register applies to the rest of the bcm57xx family. r eceive l ist p lacement s tatistics i ncrement m ask r egister (o ffset 0 x 201c) this version of the receive list placement statistics increment mask register applies to the bcm5705, bcm5788, bcm5721, bcm5751, bcm5752, bcm5714, and bcm5715 devices only. rest of bcm57xx family this version of the receive list placement statistics increment mask register applies to the rest of the bcm57xx family. table 332: receive list placement stat. enable mask (offset 0x2018, rest of bcm57xx family) bit field description init access 31-23 reserved ? 0 r/o 22-0 counters enable mask controls which statistics can be updated, cleared, or flushed. ? bit 0-15 corresponds to statistics for class of service 1-16. ? bit 16-22 correspond to statistics for drop due to filter, dma write queue full, dma high priority write queue full, no more receive bd, ifindiscards, ifinerrors, and receive threshold hit. ? 1 = inaccessible ? 0 = accessible r/w table 333: receive list placement statistics increment mask register (offset 0x201c) bit field description init access 31-22 reserved - 0 r/o 21-16 counters increment mask writing a 1 to a counters increment mask bit forces the corresponding statistics counter to increment by 1. not affected by statistics enable mask. bits 16-21 correspond to statistics for drop due to filter, dma write queue full, dma high priority write queue full, no more receive bd, ifindiscards, and ifinerrors. 0w/o 15-1 reserved ? 0 r/o 0 counters increment mask writing a 1 to a counters increment mask bit forces the corresponding statistics counter to increment by 1. not affected by statistics enable mask. bit 0 corresponds to statistics class of service 1. 0w/o table 334: receive list placement stat. increment mask (offset 0x201c, rest of bcm57xx fam.) bit field description init access 31-23 reserved - 0 r/o 22-0 counters increment mask writes a 1, to bit position forces the corresponding statistics counter to increment by 1. not affected by statistics enable mask. bits 0-15 correspond to statistics for class of service 1-16. bits 16-22 correspond to statistics for drop due to filter, dma write queue full, dma high priority write queue full, no more receive bd, ifindiscards, ifinerrors, and receive threshold hit. 0w/o www.datasheet.in programmer?s guide bcm57xx 01/29/08 broadcom corporation document 57xx-pg105-r receive list placement control registers page 435 r eceive s elector l ist h ead and t ail p ointers (o ffsets s tarting at 0 x 2100) the 16 receive selector lists head and tail pointers are mbuf cluster pointers. the selector list head pointer is the mbuf cluster pointer of the first frame queued in the associated selector list. similarly, the selector list tail pointer is the mbu f cluster pointer of the last frame queued in that selector list. r eceive s elector l ist c ount r egisters (o ffset of l ist n: 0 x 2108 + 16*[n-1]) these registers indicate how many frames are currently queued to the associated selector list. l ocal s tatistics c ounter r egister (o ffset 0 x 2200-0 x 2258) table 335: local statistics counter (offset 0x2200) bit field description init access 31-10 reserved - 0 r/o 9-0 counters value the current counter value for statistics kept by the receive list placement. r/o www.datasheet.in bcm57xx programmer?s guide 01/29/08 broadcom corporation page 436 receive data and receive bd initiator control registers document 57xx-pg105-r r eceive d ata and r eceive bd i nitiator c ontrol r egisters table 336: receive data and receive bd initiator control registers offset registers 0x2400-0x2403 receive data and receive bd ring initiator mode 0x2404-0x2407 receive data and receive bd ring initiator status 0x2408-0x240b reserved 0x240c-0x240f reserved 0x2440-0x244f jumbo receive bd ring rcb 0x2450-0x245f standard receive bd ring rcb 0x2460-0x246f mini receive bd ring rcb 0x2470-0x2473 receive diagnostic data and receive bd ring initiator local nic jumbo receive bd consumer index 0x2474-0x2477 receive diagnostic data and receive bd ring initiator local nic standard receive bd consumer index 0x2478-0x247b receive diagnostic data and receive bd ring initiator local nic mini receive bd consumer index 0x247c-0x247f reserved 0x2480-0x2483 receive diagnostic data and receive bd initiator local receive return 1 producer index 0x2484-0x2487 receive diagnostic data and receive bd initiator local receive return 2 producer index 0x2488-0x248b receive diagnostic data and receive bd initiator local receive return 3 producer index 0x248c-0x248f receive diagnostic data and receive bd initiator local receive return 4 producer index 0x2490-0x2493 receive diagnostic data and receive bd initiator local receive return 5 producer index 0x2494-0x2497 receive diagnostic data and receive bd initiator local receive return 6 producer index 0x2498-0x249b receive diagnostic data and receive bd initiator local receive return 7 producer index 0x249c-0x249f receive diagnostic data and receive bd initiator local receive return 8 producer index 0x24a0-0x24a3 receive diagnostic data and receive bd initiator local receive return 9 producer index 0x24a4-0x24a7 receive diagnostic data and receive bd initiator local receive return 10 producer index 0x24a8-0x24ab receive diagnostic data and receive bd initiator local receive return 11 producer index 0x24ac-0x24af receive diagnostic data and receive bd initiator local receive return 12 producer index 0x24b0-0x24b3 receive diagnostic data and receive bd initiator local receive return 13 producer index 0x24b4-0x24b7 receive diagnostic data and receive bd initiator local receive return 14 producer index 0x24b8-0x24bb receive diagnostic data and receive bd initiator local receive return 15 producer index 0x24bc-0x24bf receive diagnostic data and receive bd initiator local receive return 16 producer index 0x24c0-0x24c3 receive diagnostic data and receive bd initiator hardware diagnostic 0x24c4-0x27ff reserved www.datasheet.in programmer?s guide bcm57xx 01/29/08 broadcom corporation document 57xx-pg105-r receive data and receive bd initiator control registers page 437 r eceive d ata and r eceive bd i nitiator m ode r egister (o ffset 0 x 2400) r eceive d ata and r eceive bd i nitiator s tatus r egister (o ffset 0 x 2404) table 337: receive data and receive bd initiator mode register (offset 0x2400) bit field description init access 31-8 reserved - 0 r/o 7 rdi timer event enable (bcm5714 and bcm5715 only) enables the rdi timer attention. 0 r/w 6-5 reserved - 0 r/o 4 illegal return ring size enables illegal return ring size attention. r/w 3 frame size is too large to fit into one receive bd enables frame size is too large to fit into one receive bd attention. r/w 2 reserved (bcm5705, bcm5788, bcm5721, bcm5751, bcm5752, bcm5714, and bcm5715 only) -0r/o jumbo receive bd is needed and jumbo receive bd ring is disabled (other devices) enables jumbo receive bd is needed and jumbo receive bd ring is disabled attention. r/w 1 enable this bit controls whether the receive data and receive bd initiator state machine is active or not. when set to 0, it completes the current operation and cleanly halts. until it is completely halted, it remains one when read. r/w 0 reset when this bit is set to 1, the receive data and receive bd initiator state machine is reset. this is a self-clearing bit. r/w table 338: receive data and receive bd initiator status register (offset 0x2404) bit field description init access 31-8 reserved - 0 r/o 7 rdi timer attention (bcm5714 and bcm5715 only) this bit is asserted if the rdi module does not process an rdi- ftq entry within the time specified in the rdi timer mode register (0x24f0). this attention indicates that the receive data path is stalled. 0r/w 6-5 reserved - 0 r/o 4 illegal return ring size one of the return rings contains illegal ring size (e.g., only contains 1024 entries) r/o 3 frame size is too large to fit into one receive bd the received frame size is too big for the selected receive bd. r/o www.datasheet.in bcm57xx programmer?s guide 01/29/08 broadcom corporation page 438 receive data and receive bd initiator control registers document 57xx-pg105-r j umbo r eceive bd r ing rcb r egister (o ffset 0 x 2440) these registers are not applicable to bcm5705, bcm5788, bcm5721, bcm5751, bcm5752, bcm5714, and bcm5715 devices. 2 reserved (bcm5705 bcm5788, bcm5721, bcm5751, bcm5752, bcm5714, and bcm5715 only) -0r/o jumbo receive bd is needed and jumbo receive bd ring is disabled (other devices) the received frame?s size exceeds the capacity of the standard receive bd, and jumbo receive bd ring is disabled. r/o 1-0 reserved - table 339: receive producer ring host address high register (offset 0x2440) bit field description init access 31-0 host address high the host ring address is the host address of the first ring element. the host ring address is in host address format. 00000000h r/w table 340: receive producer ring host address low register (offset 0x2444) bit field description init access 31-0 host address low the host ring address is the host address of the first ring element. the host ring address is in host address format. 00000000h r/w table 341: receive producer lengt h/flags register (offset 0x2448) bit field description init access 31-16 max length unused for jumbo rings; otherwise, specifies the maximum size of an ethernet packet plus vlan tag. 00000000h r/w 15-2 reserved unused. 000h r/w 1 disable ring set to disable the use of the ring. 0 r/w 0 extended rx enable set to use the extended receive buffer descriptors. 0 r/w table 342: receive producer ring nic address (offset 0x244c) bit field description init access 31-0 nic address the nic ring address is the nic address of the first ring element. 00000000h r/w table 338: receive data and receive bd initiator status register (offset 0x2404) (cont.) bit field description init access www.datasheet.in programmer?s guide bcm57xx 01/29/08 broadcom corporation document 57xx-pg105-r receive data and receive bd initiator control registers page 439 s tandard r eceive bd r ing rcb r egister (o ffset 0 x 2450) same as above jumbo ring rcb with address offset from 0x2450?0x245fh. m ini r eceive bd r ing rcb r egister (o ffset 0 x 2460) same as above jumbo ring rcb with address offset from 0x2460?0x246fh. these registers are only applicable to bcm5700 device. r eceive d iagnostic d ata and r eceive bd r ing i nitiator l ocal nic j umbo r eceive bd c onsumer i ndex (o ffset 0 x 2470) this set of registers keeps track of the current dmas queued to move receive data from the nic to the host. this register is not applicable to bcm5705, bcm5788, bcm5721, bcm5751, bcm5752, bcm5714, and bcm5715 devices. the receive data and receive bd initiator maintains the state of the indices by keeping two local copies, a copy of the nic?s return ring producer index, and a copy of the nic?s receive bd consumer index. the local return ring producer index is set to the value placed in the dma descriptor. the local nic receive return consumer index is also set to the value placed in the dma descriptor. there is a local copy of each of the three receive bd producer indices. there is also a local copy of each of 16 nic receive return consumer indices. r eceive d iagnostic d ata and r eceive bd r ing i nitiator l ocal nic s tandard r eceive bd c onsumer i ndex (o ffset 0 x 2474) same as ?receive diagnostic data and receive bd ring initiator local nic jumbo receive bd consumer index (offset 0x2470)? on page 439 . r eceive d iagnostic d ata and r eceive bd r ing i nitiator l ocal nic m ini r eceive bd c onsumer i ndex (o ffset 0 x 2478) same as ?receive diagnostic data and receive bd ring initiator local nic jumbo receive bd consumer index (offset 0x2470)? on page 439 .this register is applicable to bcm5700 device only. r eceive d ata and r eceive d iagnostic bd i nitiator l ocal r eceive r eturn p roducer i ndex r egister (o ffset 0 x 2480-0 x 24bc) same as ?receive diagnostic data and receive bd ring initiator local nic jumbo receive bd consumer index (offset 0x2470)? on page 439 . the registers from 0x2484 to 0x24bc are not applicable to bcm5705, bcm5788, bcm5721, bcm5751, bcm5752, bcm5714, and bcm5715 devices. www.datasheet.in bcm57xx programmer?s guide 01/29/08 broadcom corporation page 440 receive data and receive bd initiator control registers document 57xx-pg105-r r eceive d ata and r eceive bd i nitiator h ardware d iagnostic r egister (o ffset 0 x 24c0) rdi t imer m ode r egister (0 x 024f0 h ) table 343: receive data and receive bd initiator hardware diagnostic register (offset 0x24c0) bit field description init access 31-0 diagnostics hardware diagnostics. 0 r/o table 344: rdi timer mode register (0x024f0h, bcm5714 and bcm5715 only) bit field description init access 0 rdi_timer_ctl_reset resets only the rdi_timer control module. 0 r/w 1 rdi_timer_ctl_en rdi timer module enable. 0 r/w 2 rdi_timer_cnt reset reset only the rdi_timer (debug only). 0 r/w 3 reserved - 0 r 5:4 rdi attn time out value the time an rdi ftq entry is not processed before generating rdi_timer_attn. ? 00 = 1s ? 01 = 2s ? 10 = 3s ? 11 = reserved 00 r/w 7:4 rdi timer clk sel debug purpose only. ? 00 = 640-ns clock ? 01 = 40-ns clock ? 10 = 10240-ns clock ? 11 = core clock 00 r/w www.datasheet.in programmer?s guide bcm57xx 01/29/08 broadcom corporation document 57xx-pg105-r receive data completion control registers page 441 r eceive d ata c ompletion c ontrol r egisters r eceive d ata c ompletion m ode r egister (o ffset 0 x 2800) table 345: receive data completion control registers offset registers 0x2800-0x2803 receive data completion mode 0x2804-0x2bff reserved table 346: receive data completion mode register (offset 0x2800) bit field description init access 31-3 reserved - 0 r/o 2 attn_enable when this bit is set to 1, an internal attention is generated when an error occurs. 0r/w 1 enable this bit controls whether the receive data completion state machine is active or not. when set to 0, it completes the current operation and cleanly halts. until it is completely halted, it remains one when read. 1r/w 0 reset when this bit is set to 1, the receive data completion state machine is reset. this is a self-clearing bit. 0r/w www.datasheet.in bcm57xx programmer?s guide 01/29/08 broadcom corporation page 442 receive bd initiator control registers document 57xx-pg105-r r eceive bd i nitiator c ontrol r egisters r eceive bd i nitiator m ode r egister (o ffset 0 x 2c00) r eceive bd i nitiator s tatus r egister (o ffset 0 x 2c04) r eceive bd i nitiator l ocal nic r eceive bd p roducer i ndex r egisters (o ffset 0 x 2c08-0 x 2c13) this set of registers is used to keep track of the current dmas queued to move receive bds from the host to the nic. table 347: receive bd initiator control registers offset registers 0x2c00-0x2c03 receive bd initiator mode 0x2c04-0x2c07 receive bd initiator status 0x2c08-0x2c0b receive bd initiator local nic jumbo receive bd producer index 0x2c0c-0x2c0f receive bd initiator local nic standard receive bd producer index 0x2c10-0x2c13 receive bd initiator local nic mini receive bd producer index 0x2c14-0x2c17 mini receive bd ring replenish threshold 0x2c18-0x2c1b standard receive bd ring replenish threshold 0x2c1c-0x2c1f jumbo receive bd ring replenish threshold 0x2c20-0x2fff reserved table 348: receive data initiator mode register (offset 0x2c00) bit field description init access 31-3 reserved - 0 r/o 2 receive bds available on a disabled receive bd ring enable attention enable for receive bds available on a disabled receive bd ring. r/w 1 enable this bit controls whether the receive bd initiator state machine is active or not. when set to 0, it completes the current operation and cleanly halts. until it is completely halted, it remains one when read. 1r/w 0 reset when this bit is set to 1, the receive bd initiator state machine is reset. this is a self-clearing bit. 0r/w table 349: receive bd initiator status register (offset 0x2c04) bit field description init access 31-3 reserved - 0 r/o 2 receive bds available on a disabled receive bd ring status host requests to dma receive bds to a disabled ring. r/o 1-0 reserved - 0 r/o www.datasheet.in programmer?s guide bcm57xx 01/29/08 broadcom corporation document 57xx-pg105-r receive bd initiator control registers page 443 m ini r eceive bd p roducer r ing r eplenish t hreshold r egister (o ffset 0 x 2c14) this set of registers is used to keep the receive initiator bd state machine from generating a large number of dma requests for receive buffer descriptors. each indicates the number of buffer descriptors that must be indicated before a dma is initiated. this register is applicable to bcm5700 device only. s tandard r eceive bd p roducer r ing r eplenish t hreshold r egister (o ffset 0 x 2c18) j umbo r eceive bd p roducer r ing r eplenish t hreshold r egister (o ffset 0 x 2c1c) this register is not applicable to bcm5705, bcm5788, bcm5721, bcm5751, bcm5752, bcm5714, and bcm5715 devices. table 350: mini receive bd producer ring re plenish threshold register (offset 0x2c14) bit field description init access 31-0 bd num number of buffer descriptors indicated by the receive producer index for the dma engine to initiate a transfer of buffer descriptors for replenishing the ring. 00000000h r/w table 351: standard receive bd producer ring replenish threshold register (offset 0x2c18) bit field description init access 31-0 bd num number of buffer descriptors indicated by the receive producer index for the dma engine to initiate a transfer of buffer descriptors for replenishing the ring. 00000000h r/w table 352: jumbo receive bd producer ring replenish threshold register (offset 0x2c1c) bit field description init access 31-0 bd num number of buffer descriptors indicated by the receive producer index for the dma engine to initiate a transfer of buffer descriptors for replenishing the ring. 00000000h r/w www.datasheet.in bcm57xx programmer?s guide 01/29/08 broadcom corporation page 444 receive bd completion control registers document 57xx-pg105-r r eceive bd c ompletion c ontrol r egisters r eceive bd c ompletion m ode r egister (o ffset 0 x 3000) r eceive bd c ompletion s tatus r egister (o ffset 0 x 3004) table 353: receive bd completion control registers offset registers 0x3000-0x3003 receive bd completion mode 0x3004-0x3007 receive bd completion status 0x3008-0x300b nic jumbo receive bd producer index 0x300c-0x300f nic standard receive bd producer index 0x3010-0x3013 nic mini receive bd producer index 0x3014-0x33ff reserved table 354: receive bd completion mode register (offset 0x3000) bit field description init access 31-3 reserved - 0 r/o 2 attn_enable when this bit is set to 1, an internal attention is generated when an error occurs. r/w 1 enable this bit controls whether the receive bd completion state machine is active or not. when set to 0, it completes the current operation and cleanly halts. until it is completely halted, it remains one when read. 1r/w 0 reset when this bit is set to 1, the receive bd completion state machine is reset. this is a self-clearing bit. 0r/w table 355: receive bd completion status register (offset 0x3004) bit field description init access 31-3 reserved - 0 r/o 2 error receive bd completion error status. r/o 1-0 reserved - 0 r/o www.datasheet.in programmer?s guide bcm57xx 01/29/08 broadcom corporation document 57xx-pg105-r receive bd completion control registers page 445 nic j umbo r eceive bd p roducer i ndex r egister (o ffset 0 x 3008) this register is not applicable to bcm5705, bcm5788, bcm5721, bcm5751, bcm5752, bcm5714, and bcm5715 devices. nic s tandard r eceive bd p roducer i ndex r egister (o ffset 0 x 300c) nic m ini r eceive bd p roducer i ndex r egister (o ffset 0 x 3010) this register is applicable to bcm5700 device only. table 356: nic jumbo receive bd producer index (offset 0x3008) bit field description init access 31-8 reserved - 0 r/o 7-0 nic jumbo receive bd producer index -r/w table 357: nic standard receive bd producer index (offset 0x300c) bit field description init access 31-9 reserved - 0 r/o 8-0 nic standard receive bd producer index --r/w table 358: nic mini receive bd producer index (offset 0x3010) bit field description init access 31-10 reserved - 0 r/o 9-0 nic mini receive bd producer index --r/w www.datasheet.in bcm57xx programmer?s guide 01/29/08 broadcom corporation page 446 receive list selector control registers document 57xx-pg105-r r eceive l ist s elector c ontrol r egisters r eceive l ist s elector m ode r egister (o ffset 0 x 3400) r eceive l ist s elector s tatus r egister (o ffset 0 x 3404) table 359: receive list selector control registers offset registers 0x3400-0x3403 receive list selector mode. 0x3404-0x3407 receive list selector status. 0x3408-0x37ff reserved. table 360: receive list selector mode register (offset 0x3400) bit field description init access 31-3 reserved - 0 r/o 2 attn_enable when this bit is set to 1, an internal attention is generated when an error occurs. r/w 1 enable this bit controls whether the receive list selector state machine is active or not. when set to 0, it completes the current operation and cleanly halts. until it is completely halted, it remains one when read. 1r/w 0 reset when this bit is set to 1, the receive list selector state machine is reset. this is a self-clearing bit. 0r/w table 361: receive list selector status register (offset 0x3404) bit field description init access 31-3 reserved - 0 r/o 2 error receive list selector error status. r/o 1-0 reserved - 0 r/o www.datasheet.in programmer?s guide bcm57xx 01/29/08 broadcom corporation document 57xx-pg105-r mbuf cluster free registers page 447 mbuf c luster f ree r egisters these registers are applicable to bcm5700, bcm5701, bcm5702, BCM5703c, BCM5703s, bcm5704c, and bcm5704s devices only. mbuf c luster f ree m ode r egister (o ffset 0 x 3800) mbuf c luster f ree s tatus r egister (o ffset 0 x 3804) table 362: mbuf cluster free registers offset registers 0x3800-0x3803 mbuf cluster free mode. 0x3804-0x3807 mbuf cluster free status. 0x3808-0x3bff reserved. table 363: mbuf cluster free mode register (offset 0x3800) bit field description init access 31-3 reserved - 0 r/o 2 attn_enable when this bit is set to 1, an internal attention is generated when an error occurs. r/w 1 enable this bit controls whether the mbuf cluster free state machine is active or not. when set to 0, it completes the current operation and cleanly halts. until it is completely halted, it remains one when read. 1r/w 0 reset when this bit is set to 1, the mbuf cluster free state machine is reset. this is a self-clearing bit. 0r/w table 364: mbuf cluster free status register (offset 0x3804) bit field description init access 31-3 reserved - 0 r/o 2 error mbuf cluster error status. r/o 1-0 reserved - 0 r/o www.datasheet.in bcm57xx programmer?s guide 01/29/08 broadcom corporation page 448 dbu registers document 57xx-pg105-r dbu r egisters these dbu registers are applicable only to the bcm5752. table 365: dbu command register (0x3800) bit field description init access 2 rx overflow rx overflow error. remains set until a 1 is written. 0 w2c 1 rx error rx framing error. remains set until a 1 is written. 0 w2c 0 enabled always reads 1 because the dbu cannot be disabled. 1 ro table 366: dbu status register (0x3804) field bit access init description tx data occupied 1 ro 0 this bit is set automatically when the tx data register is written, and remains set until the written character is transmitted, at which point it clears automatically. firmware can poll this bit to determine when it is acceptable to write the next tx character. rx data valid 0 ro 0 this bit is set automatically when a character is received, and remains set until the received character is read from the rx data register, at which point it clears automatically. firmware can poll this bit to determine when there is a received character to be retrieved. table 367: dbu configuration register (0x3808) bit field description init access 4 dbu ma bypass when this bit is set, the cdarb block is completely bypassed, causing the dbu to hang when trying to access memory space. this feature is included as a workaround in the event that there is a bug in cdarb. setting it should allow cp access to ma without interference. 0 rw 3 dbu ma transparent this bit places the cdarb in transparent mode. when set, the cdarb allows a read to start while a write is still in progress, or a write to start when a read is still in progress. if the bit is clear, then the cdarb waits until the current ma transaction is complete before starting a new transaction in a different direction. 1 rw 2 crlf enable when this bit is set, all transmitted line feeds are preceded by a carriage return. when it is clear, only the line feed is transmitted. 1 rw 1 debug state machine enable when this bit is set, the state machine debugger is enabled and responds to commands typed by echoing characters, initiating grc or memory read/write cycles, and responding with returned data. when this bit is clear, the debugger is disabled. this bit should only be cleared if firmware is running to respond to receive and transmit characters. important! if this bit is cleared via the debugger, there is no way to set it again via the debugger. 1 rw 0 timing override if this bit is cleared, then the baud rate is 19200 (assuming ck25 is 25 mhz). if the bit is set, then baud rate timing is set based on the values in the timing register. 0 rw www.datasheet.in programmer?s guide bcm57xx 01/29/08 broadcom corporation document 57xx-pg105-r dbu registers page 449 table 368: dbu timing register (0x380c) bit field description init access 31:16 bit interval this field sets the number of ck25 cycles between serial bits for both transmit and receive data. the default value results in a baud rate of 19200 for a 25-mhz ck25 clock. note: this value has no effect unless the timing override bit is set in the configuration register. 0x516 rw 15:0 first bit sample offset this field sets the number of ck25 cycles from the falling edge of serial in to the point where the start bit is sampled. the default value results in a baud rate of 19200 for a 25-mhz ck25 clock. note: this value has no effect unless the timing override bit is set in the configuration register. 0x28b rw table 369: dbu rx data register (0x3810) bit field description init access 8 rx data error this bit indicates that the data in bits 7:0 was received with a framing error. the value in this bit is valid only when the rx data valid bit is also set in table 366 on page 448 . the act of reading this register automatically clears the rx data valid bit in the status register. n/a ro 7:0 rx data these bits contain the last received serial character. the value in these bits is only valid when the rx data valid bit is also set in table 366 on page 448 . the act of reading this register automatically clears the rx data valid bit in the status register. n/a ro table 370: dbu tx data register (0x3814) bit field description init access 7:0 tx data these bits can be written with a character to be transmitted. when this register is written, transmission of a serial character commences. the act of writing this register automatically sets the txdata_occupied bit in the status register. the occupied bit remains set until the uart is ready to accept another character to transmit. firmware should always check the state of txdata_occupied before writing this register; otherwise, characters that have not yet been transmitted may be overwritten. this register reads back the last character that was written. n/a r/w www.datasheet.in bcm57xx programmer?s guide 01/29/08 broadcom corporation page 450 host coalescing control registers document 57xx-pg105-r h ost c oalescing c ontrol r egisters the host coalescing control registers are responsible for pacing the rate at which the nic updates the host?s transmit and receive buffer descriptor ring indices. although the host produces and receives frames in one or more buffer descriptors, the host coalescing state machine always updates the host on frame boundaries. additionally, the host coalescing state machine regulates the rate at which the statistics are updated in host memory. table 371: host coalescing control registers offset registers 0x3c00-0x3c03 host coalescing mode 0x3c04-0x3c07 host coalescing status 0x3c08-0x3c0b receive coalescing ticks 0x3c0c-0x3c0f send coalescing ticks 0x3c10-0x3c13 receive max coalesced bd count 0x3c14-0x3c17 send max coalesced bd count 0x3c18-0x3c1b receive coalescing ticks, during interrupt 0x3c1b-0x3c1f send coalescing ticks, during interrupt 0x3c20-0x3c23 receive max coalesced bd count, during interrupt 0x3c24-0x3c27 send max coalesced bd count, during interrupt 0x3c28-0x3c2b statistics ticks 0x3c2c-0x3c2f reserved 0x3c30-0x3c37 statistics host address 0x3c38-0x3c3f status block host address 0x3c40-0x3c43 statistics base address 0x3c44-0x3c47 status block base address 0x3c48-0x3c4b flow attention register 0x3c4c-0x3c4f reserved 0x3c50-0x3c53 nic jumbo receive bd consumer index 0x3c54-0x3c57 nic standard receive bd consumer index 0x3c58-0x3c5b nic mini receive bd consumer index 0x3c5c-0x3c7f reserved 0x3c80-0x3c83 nic diagnostic return ring producer index 1 0x3c84-0x3c87 nic diagnostic return ring producer index 2 0x3c88-0x3c8b nic diagnostic return ring producer index 3 0x3c8c-0x3c8f nic diagnostic return ring producer index 4 0x3c90-0x3c93 nic diagnostic return ring producer index 5 0x3c94-0x3c97 nic diagnostic return ring producer index 6 0x3c98-0x3c9b nic diagnostic return ring producer index 7 0x3c9c-0x3c9f nic diagnostic return ring producer index 8 0x3ca0-0x3ca3 nic diagnostic return ring producer index 9 www.datasheet.in programmer?s guide bcm57xx 01/29/08 broadcom corporation document 57xx-pg105-r host coalescing control registers page 451 0x3ca4-0x3ca7 nic diagnostic return ring producer index 10 0x3ca8-0x3cab nic diagnostic return ring producer index 11 0x3cac-0x3caf nic diagnostic return ring producer index 12 0x3cb0-0x3cb3 nic diagnostic return ring producer index 13 0x3cb4-0x3cb7 nic diagnostic return ring producer index 14 0x3cb8-0x3cbb nic diagnostic return ring producer index 15 0x3cbc-0x3cbf nic diagnostic return ring producer index 16 0x3cc0-0x3cc3 nic diagnostic send bd consumer index 1 0x3cc4-0x3cc7 nic diagnostic send bd consumer index 2 0x3cc8-0x3ccb nic diagnostic send bd consumer index 3 0x3ccc-0x3ccf nic diagnostic send bd consumer index 4 0x3cd0-0x3cd3 nic diagnostic send bd consumer index 5 0x3cd4-0x3cd7 nic diagnostic send bd consumer index 6 0x3cd8-0x3cdb nic diagnostic send bd consumer index 7 0x3cdc-0x3cdf nic diagnostic send bd consumer index 8 0x3ce0-0x3ce3 nic diagnostic send bd consumer index 9 0x3ce4-0x3ce7 nic diagnostic send bd consumer index 10 0x3ce8-0x3ceb nic diagnostic send bd consumer index 11 0x3cec-0x3cef nic diagnostic send bd consumer index 12 0x3cf0-0x3cf3 nic diagnostic send bd consumer index 13 0x3cf4-0x3cf7 nic diagnostic send bd consumer index 14 0x3cf8-0x3cfb nic diagnostic send bd consumer index 15 0x3cfc-0x3cff nic diagnostic send bd consumer index 16 0x3d00-0x3fff reserved table 371: host coalescing control registers (cont.) offset registers www.datasheet.in bcm57xx programmer?s guide 01/29/08 broadcom corporation page 452 host coalescing control registers document 57xx-pg105-r h ost c oalescing m ode r egister (o ffset 0 x 3c00) h ost c oalescing s tatus r egister (o ffset 0 x 3c04) table 372: host coalescing mode register (offset 0x3c00) bit field description init access 31-13 reserved - 0 r/w 12 no interrupt on force update when set, writing the coalesce now bit will cause a status without a corresponding interrupt event. r/w 11 no interrupt on dmad force when set, the coal_now bit of the buffer descriptor may be set to force a status block update without a corresponding interrupt (see ?send buffer descriptors? on page 94 ). r/w 10 clear ticks mode on tx when set, the tx host coalescing tick counter initializes to the idle state and begins counting only after a transmit bd event is detected. r/w 9 clear ticks mode on rx when set, the rx host coalescing tick counter initializes to the idle state and begins counting only after a receive bd event is detected. r/w 8-7 reserved (bcm5700, pre-c0 revision) -r/w status block size (bcm5700 since c0 revision and rest of bcm57xx family) status block size for partial status block updates (bcm5700 mac since c0 revision and the rest of the bcm57xx family, see ?status block? on page 103 ): ? 00: full status block ? 01: 64 byte ? 10: 32 byte ? 11: undefined r/w 6-4 msi bits the least significant msi 16-bit word is overwritten by these bits. defaults to 0. r/w 3 coalesce now if set, host coalescing updates the status block immediately and sends an interrupt to host. this is a self-clearing bit. (for debug purpose only.) r/w 2 attn_enable when this bit is set to 1, an internal attention is generated when an error occurs. r/w 1 enable this bit controls whether the host coalescing state machine is active or not. when set to 0, it completes the current operation and cleanly halts. until it is completely halted, it remains one when read. r/w 0 reset when this bit is set to 1, the host coalescing state machine is reset. this is a self-clearing bit. r/w table 373: host coalescing status register (offset 0x3c04) bit field description init access 31-3 reserved - 0 r/o 2 error host coalescing error status. r/o 1-0 reserved - 0 r/o www.datasheet.in programmer?s guide bcm57xx 01/29/08 broadcom corporation document 57xx-pg105-r host coalescing control registers page 453 r eceive c oalescing t icks r egisters (o ffset 0 x 3c08) the value in this register can be used to control how o ften the status block is updated (and how often interrupts are generated) due to receiving packets. the value in this register controls how many ticks, in units of 1 s each, get loaded in an internal receive tick timer register. the timer will be reset to the value of this register and will start counting down aft er every status block update (regardless of the reason for the status block update). the timer is only reset after status block updates, and is not reset after any given packet is received. when the timer reaches 0, it will be considered to be in the expired state. once the counter is in the expired state, a status block update will occur if a packet had been received and copied to host memory (via dma) since the last status block update. this register must be initialized by host software. a value of 0 in this register disables the receive tick coalescing logic. i n this case, status block updates will occur for receive event only if the receive max coalesced bd value is reached. of course, status block updates for other reasons (e.g., transmit events) will also include any updates to the receive indices. by setting the value in this register to a high number, a software device driver can reduce the number of status block updates and interrupts that occur due to receiving packets. this will generally increase performance in hosts that are under a high degree of stress and whose riscs are saturated due to handling a large number of interrupts from the network controller. for host environments where receive interrupt latency needs to be very low, and the host is not close to be saturated, it is recommended that this register be set to 1. s end c oalescing t icks r egister (o ffset 0 x 3c0c) the value in this register can be used to control how o ften the status block is updated (and how often interrupts are generated) according to the completion of transmit events. the value in this register controls how many ticks, in units of 1 s each, get loaded in an internal transmit tick timer register. the timer will be reset to the value of this register and will st art counting down, after every status block update (regardless of the reason for the status block update). the timer is only reset after status block updates, and is not reset after a transmit event completes. when the timer reaches 0, it will be considered to be in the expired state. once the counter is in the expired state, a status block update will occur if a transmit event has occurred since the last status block update. in this case, a transmit event is defined by an update to one of the device?s send bd consumer indices. it should be noted that a send consumer index increments whenever the data associated with a particular packet has been successfully moved (via dma) across the bus, rather than when the packet is actually transmitted over the ethernet wire. this register must be initialized by host software. a value of 0 in this register disables the transmit tick coalescing logic. in this case, status block updates will occur for transmit events only if the send max coalesced bd value is reached, or if the bd_flag_coal_now bit is set in a send bd. status block updates for other reasons (e.g., receive events) will also include any updates to the send indices. by setting the value in this register to a high number, a software device driver can reduce the number of status block updates, and interrupts, that occur due to transmit completions. this will generally increase performance in hosts that do not require their send buffers to be freed quickly. for host environments that do require their send buffers to be recovered quickly, it is recommended that this register be set to 0. www.datasheet.in bcm57xx programmer?s guide 01/29/08 broadcom corporation page 454 host coalescing control registers document 57xx-pg105-r r eceive m ax c oalesced bd c ount (o ffset 0 x 3c10) this register contains the maximum number of receive return ring bds that must filled in by the device before the device will update the status block due to a receive event. whenever the device completes the reception of a packet, it will fill in a receive return ring bd, and then increment an intern al receive coalesce bd counter. when this internal counter reaches the value in this register, a status block update will occur. this counter will be reset (i.e., zeroed) whenever a status block update occurs regardless of the reason for the status block update. this register must be initialized by host software. a value of 0 in this register disables the receive max bd coalescing logic. in this case, status block updates will occur for receive packets only via the receive coalescing ticks mechanism. status block updates for other reasons (e.g., transmit events) will also include any updates to the receive indices. for simplicity, if a host wanted to get a status block update for every received packet, the host driver should just set this register to a value of 1. on the other hand, by setting the value in this register to a high number, a software device driver c an reduce the number of status block updates and interrupts that occur due to receiving packets. this can increase performance in hosts that are under a high degree of stress and whose riscs are saturated due to handling a large number of interrupts from the network controller. however, in lower traffic environments, there is no guarantee that consecutive packets will be received in a timely manner. therefore, for those environments, it is recommended that the receive coalescing ticks register are used to make sure that status block updates due to receiving packets are not delayed for an infinite amount of time. s end m ax c oalesced bd c ount (o ffset 0 x 3c14) this register contains the maximum number of send bds that must be processed by the device before the device will update the status block due to the transmission of packets. whenever the device completes the dma of transmit packet buffer, it increments an internal send coalesce bd counter. when this internal counter reaches the value in this register, a status block update will occur. this counter will be reset (i. e. zeroed) whenever a status block update occurs regardless of the reason for the status block update. this register must be initialized by host software. a value of 0 in this register disables the send max bd coalescing logic. in this case, status block updates will occur for receive packets only via the send coalescing ticks mechanism. of course, status block updates for other reasons (e.g., receive events) will also include any updates to the send indices. for simplicity, if a host wanted to get a status block update for every transmitted packet, the host driver could just set this register to a value of 1. on the other hand, by setting the value in this register to a high number, a software device driver c an reduce the number of status block updates and interrupts that occur due to transmitting packets. this can increase performance in hosts that are under a high degree of stress and whose riscs are saturated due to handling a large number of interrupts from the network controller. however, in lower traffic environments, there is no guarantee that consecutive packets will be transmitted in a timely manner. therefor e, for those environments, it is recommended that the send coalescing ticks register are used to make sure that status block updates due to transmitting packets are not delayed for an infinite amount of time. www.datasheet.in programmer?s guide bcm57xx 01/29/08 broadcom corporation document 57xx-pg105-r host coalescing control registers page 455 r eceive c oalescing t icks d uring i nterrupt r egister (o ffset 0 x 3c18) this register is not applicable to bcm5705, bcm5788, bcm5721, bcm5751, bcm5752, bcm5714, and bcm5715 devices. this register is very similar to the receive coalescing ticks register (see ?receive coalescing ticks registers (offset 0x3c08)? on page 453 ). however, this register is used instead of the receive coalescing ticks register when the host is considered to be in its interrupt service routine (isr). in this case, the nic considers the host to be in its isr whenever either interrupt mailbox 0 (see ?interrupt mailbox 0 register (offset 0x200)? on page 372 for host standard and flat modes and ?interrupt mailbox 0 register (offset 0x5800)? on page 492 for indirect mode) is set to a nonzero value, or when the mask interrupt bit is set. when host software is in its isr, this register is used to control the reset value of receive coalescing tick timer instead of the timer?s reset value being determined by the non-during interrupt receive coalescing ticks register. furthermore, if the tick timer is set to the interrupt value in this register, and then later expires when the host is not in it isr, then the timer is reset to the non-during interrupt value and re-evaluated. if a host did not want to receive status block updates while its isr, then the host driver should set this register to 0. if th e host desired an immediate status block update after a packet was received and dmaed to the host, then the host driver could set this register to 1. if the host wanted delayed status block updates while in its isr, then this register could be set to a value greater then 1. s end c oalescing t icks d uring i nterrupt r egister (o ffset 0 x 3c1c) this register is not applicable to bcm5705, bcm5788, bcm5721, bcm5751, bcm5752, bcm5714, and bcm5715 devices. this register is very similar to the send coalescing ticks register (see ?send coalescing ticks register (offset 0x3c0c)? on page 453 ). however, this register is used instead of the send coalescing ticks register when the host is considered to be in its interrupt service routine (isr). in this case, the nic considers the host to be in its isr whenever either interrupt mailbox 0 (see ?interrupt mailbox 0 register (offset 0x200)? on page 372 for host standard and flat modes and ?interrupt mailbox 0 register (offset 0x5800)? on page 492 indirect mode) is set to a nonzero value, or the mask interrupt bit is set. when host software is in its isr, this register is used to control the reset value of transmit coalescing tick timer instead of the timer?s reset value being determined by the non-during interrupt send coalescing ticks register. furthermore, if the tick timer was set to the during interrupt value in this register, and then later expires when the host is not in it isr, then the t imer is reset to the non-during interrupt value and re-evaluated. if a host did not want to receive status block updates while its isr, then the host driver should set this register to 0. if th e host desired an immediate status block update after a send bd dma completion, then the host driver could set this register to 1. if the host wanted delayed status block updates while in its isr, then this register could be set to a value greater then 1. www.datasheet.in bcm57xx programmer?s guide 01/29/08 broadcom corporation page 456 host coalescing control registers document 57xx-pg105-r r eceive m ax c oalesced bd c ount d uring i nterrupt (o ffset 0 x 3c20) this register is not applicable to bcm5705, bcm5788, bcm5721, bcm5751, bcm5752, bcm5714, and bcm5715 devices. this register is very similar to the receive max coalesced bd count register. however, it is used instead of the receive max coalesced bd count register when the host is considered to be in its isr. in this case, the nic considers the host to be in its isr whenever either interrupt mailbox 0 (see ?interrupt mailbox 0 register (offset 0x200)? on page 372 for host standard and flat modes and ?interrupt mailbox 0 register (offset 0x5800)? on page 492 for indirect mode) is set to a nonzero value, or the mask interrupt bit is set. when host software is in its isr, this register is used instead of the receive max coalesced bd count register to determine how many receive return ring bds must be completed before a status block is written back. if a host did not want to get status block updates while its isr, then the host driver should set this register to 0. if the ho st desired an immediate status block update after a packet was received and dmaed to the host, then the host driver could set this register to 1. if the host, while in it isr, only wanted status block updates after handling multiple bds or packets, then this register could be set to a value greater then 1. s end m ax c oalesced bd c ount d uring i nterrupt (o ffset 0 x 3c24) this register is not applicable to bcm5705, bcm5788, bcm5721, bcm5751, bcm5752, bcm5714, and bcm5715 devices. this register is very similar to the send max coalesced bd count register. however, this register is used instead of the send max coalesced bd count register when the host is considered to be in its interrupt service routine (isr). in this case, the nic considers the host to be in its isr whenever either interrupt mailbox 0 (see ?interrupt mailbox 0 register (offset 0x200)? on page 372 for host standard and flat modes and ?interrupt mailbox 0 register (offset 0x5800)? on page 492 for indirect mode) is set to a nonzero value, or when the mask interrupt bit is set. when host software is in its isr, this register is used instead of the send max coalesced bd count register to determine how many send bds must be processed by the hardware before a status block is written back. if a host did not want to get status block updates while its isr, then the host driver should set this register to 0. if the ho st desired an immediate status block update after a send bd was processed by the hardware, then the host driver could set this register to 1. if the host, while in it isr, only wanted status block updates after handling multiple bds or packets, then this register could be set to a value greater then 1. s tatistics t icks c ounter r egister (o ffset 0 x 3c28) the statistics ticks register contains the number of clock ticks (of 1 s each) that must elapse before the nic dmas the statistics block to the host. if set to zero then statistics are never dmaed to the host. this register must be initialized by the host. this register is not applicable to bcm5705, bcm5788, bcm5721, bcm5751, bcm5752, bcm5714, and bcm5715 devices. s tatistics h ost a ddress r egister (o ffset 0 x 3c30) this 64-bit register is in host address format and tells the nic where to dma the statistics block. this register is not applicable to bcm5705, bcm5788, bcm5721, bcm5751, bcm5752, bcm5714, and bcm5715 devices. www.datasheet.in programmer?s guide bcm57xx 01/29/08 broadcom corporation document 57xx-pg105-r host coalescing control registers page 457 s tatus b lock h ost a ddress r egister (o ffset 0 x 3c38) this 64-bit register is in host address format and tells the nic where to dma the status block. s tatistics b ase a ddress r egister (o ffset 0 x 3c40) this 32-bit register is the location of the statistics struct ure in nic memory. this register is not applicable to bcm5705, bcm5788, bcm5721, bcm5751, bcm5752, bcm5714, and bcm5715 devices. s tatus b lock b ase a ddress r egister (o ffset 0 x 3c44) this 32-bit register is the location of the status block structure in nic memory. f low a ttention r egister (o ffset 0 x 3c48) the flow attention register reports attentions from the various transmit and receive state machines, flow-through queues and the mbuf allocator. whenever one of these blocks detects an attention situation, it sets the appropriate bit in the flow attention register. refer to the state machine causing the at tention to determine the exact cause. the attention bits are cleared by writing a one to the bit (w2c). if a bit is marked as fatal, it means that the associated state machine is halted, a nd that corrective action must be taken by a cpu. table 374: flow attention register (offset 0x3c48) bit field description init fatality 31 send bd initiator the send bd initiator state machine has caused an attention. fatal 30 send bd completion the send bd completion state machine has caused an attention. fatal 29 send bd ring selector the send bd ring selector state machine has caused an attention. fatal 28 send data initiator the send data initiator state machine has caused an attention. fatal 27 send data completion the send data completion state machine has caused an attention. fatal 26-24 reserved - 0 fatal 23 recv bd initiator the recv bd initiator state machine has caused an attention. fatal 22 recv bd completion the recv bd completion state machine has caused an attention. fatal 21 recv list placement the recv list placement state machine has caused an attention. fatal 20 recv list selector the recv list selector state machine has caused an attention. fatal 19 recv data and recv bd initiator the recv data and recv bd initiator state machine has caused an attention. fatal 18 recv data completion the recv data completion state machine has caused an attention. fatal www.datasheet.in bcm57xx programmer?s guide 01/29/08 broadcom corporation page 458 host coalescing control registers document 57xx-pg105-r nic r eceive bd c onsumer i ndex r egisters (o ffset 0 x 3c50-0 x 3c58) these three registers are shared by the receive bd completion and the receive data and receive bd initiator state machines. they are used to keep track of the receive bds that have been dmaed to the nic. nic d iagnostic r eturn r ings p roducer i ndex r egisters 1-16 (o ffset 0 x 3c80- 0 x 3cbc) these 16 registers keep track of the nic local copy of the return rings producer index (not the host copy which is dmaed by the host coalescing engine to the host). they are shared between the send bd initiator and the host coalescing state machines. 17 rcb incorrectly configured set if one of the rcbs is incorrectly configured based on the whole configuration. fatal 16 dma completion discard the dma completion discard state machine has caused an attention. fatal 15 host coalescing the host coalescing state machine has caused an attention. fatal 14-8 reserved - 0 7 memory arbiter the memory arbiter has caused an attention. fatal 6 mbuf low water the mbuf allocation state machine has reached the mbuf low water threshold. non-fatal 5-0 reserved - note: the equivalent on the send side are in mailboxes. this is because there is no equivalent to nic-based send rings on the receive side. note: the programmer should not write to these registers?they are for internal use only to aid with debugging and diagnostics. table 375: nic return rings producer index (offset 0x3c80) bit field description init access 31-11 reserved - 0 r/o 10-0 nic return rings producer index nic return rings producer index r/w table 374: flow attention register (offset 0x3c48) (cont.) bit field description init fatality www.datasheet.in programmer?s guide bcm57xx 01/29/08 broadcom corporation document 57xx-pg105-r host coalescing control registers page 459 nic d iagnostic s end bd c onsumer i ndex r egisters 1-16 (o ffset 0 x 3cc0-0 x 3cfc) these 16 registers keep track of the nic local copy of the send bd ring consumers (not the host copy which is dmaed by the host coalescing engine to the host). they are shared between the send bd initiator and the host coalescing state machines. note: the programmer should not write to these registers?they are for internal use only to aid with debugging and diagnostics. table 376: nic send bd consumer index (offset 0x3cc0) bit field description init access 31-16 reserved - 0 r/o 15-0 nic send bd consumer index nic send bd consumer index r/w www.datasheet.in bcm57xx programmer?s guide 01/29/08 broadcom corporation page 460 memory arbiter registers document 57xx-pg105-r m emory a rbiter r egisters m emory a rbiter m ode r egister (o ffset 0 x 4000) table 377: memory arbiter registers offset registers 0x4000-0x4003 memory arbiter mode 0x4004-0x4007 memory arbiter status 0x4008-0x400b memory arbiter trap address low 0x400c-0x400f memory arbiter trap address high 0x4010-0x43ff reserved table 378: memory arbiter mode register (offset 0x4000) bit field description init access 31-30 tx mbuf configuration (bcm5714 and bcm5715 only) ? 00 = 3 mbufs for cpu ? 01 = 13 mbufs for cpu ? 10 = 18 mbufs for cpu ? 11 = 35 mbufs for cpu 01 r/w 29 cpu pipeline request disable (bcm5705, bcm5788, bcm5721, bcm5751, bcm5752, bcm5714, and bcm5715 only) cpu pipeline request disable. when set to 1, the write/read requests from the internal cpu will be processed sequentially (i.e., no back to back data valid). r/w reserved (other devices) - 0 r/o 28 low latency enable (bcm5705, bcm5788, bcm5721, bcm5751, bcm5752, bcm5714, and bcm5715 only) low latency enable. ? when set to 1, the read from the cpu to the rxmbuf will take the original ma protocol, where data_rd_valid always goes after cmd_ack. ? if set to 0, the data_rd_valid overlaps at the same clock cycle as the cmd_ack. 0r/w reserved (other devices) - 0 r/o 27 fast path read disable (bcm5705, bcm5788, bcm5721, bcm5751, bcm5752, bcm5714, and bcm5715 only) fast path read disable. when set to 1, the read from the cpu to the rxmbuf will take the slow path that goes through the original memory arbitration logic. r/w reserved (other devices) - 0 r/o 26 reserved - 0 r/w www.datasheet.in programmer?s guide bcm57xx 01/29/08 broadcom corporation document 57xx-pg105-r memory arbiter registers page 461 25 reserved (bcm5705, bcm5788, bcm5721, bcm5751, bcm5752, bcm5714, and bcm5715 only) -0r/w ext ssram data read par err enable (other devices) external ssram data read parity error enable. r/w 24 reserved(bcm5705, bcm5788, bcm5721, bcm5751, bcm5752, bcm5714, and bcm5715 only) -0r/w ext ssram wfifo underrun enable (other devices) external ssram write fifo underrun enable. r/w 23 reserved (bcm5705, bcm5788, bcm5721, bcm5751, bcm5752, bcm5714, and bcm5715 only) -0r/w ext ssram wfifo overrun enable (other devices) external ssram write fifo overrun enable. r/w 22 reserved (bcm5705, bcm5788, bcm5721, bcm5751, bcm5752, bcm5714, and bcm5715 only) -0r/w ext ssram rfifo underrun enable (other devices) external ssram read fifo underrun enable r/w 21 ext ssram rfifo overrun. r/w 21 reserved (bcm5705, bcm5788, bcm5721, bcm5751, bcm5752, bcm5714, and bcm5715 only) -0r/w ext ssram rfifo overrun enable (other devices) external ssram read fifo overrun enable. r/w 20 dmaw2 addr trap enable dma write 2 memory arbiter request trap enable. r/w 19 reserved (bcm5705, bcm5788, bcm5721, bcm5751, bcm5752, bcm5714, and bcm5715 only) -0r/w bm addr trap enable (other devices) buffer manager memory arbiter request trap enable. r/w table 378: memory arbiter mode register (offset 0x4000) (cont.) bit field description init access www.datasheet.in bcm57xx programmer?s guide 01/29/08 broadcom corporation page 462 memory arbiter registers document 57xx-pg105-r 18 reserved (bcm5705, bcm5788, bcm5721, bcm5751, bcm5752, bcm5714, and bcm5715 only) -0r/w sbds addr trap enable (other devices) send bd ring selector memory arbiter request trap enable. r/w 17 reserved (bcm5705, bcm5788, bcm5721, bcm5751, bcm5752, bcm5714, and bcm5715 only) -0r/w sdc_dmac group addr trap enable (other devices) sdc_dmac group memory arbiter request trap enable. r/w 16 sdi addr trap enable send data initiator memory arbiter request trap enable. r/w 15 reserved (bcm5705, bcm5788, bcm5721, bcm5751, bcm5752, bcm5714, and bcm5715 only) -0r/w mcf addr trap enable (other devices) mbuf cluster free memory arbiter request trap enable. r/w 14 reserved (bcm5705, bcm5788, bcm5721, bcm5751, bcm5752, bcm5714, and bcm5715 only)) -0r/w hc addr trap enable (other devices) host coalescing memory arbiter request trap enable. r/w 13 reserved (bcm5705, bcm5788, bcm5721, bcm5751, bcm5752, bcm5714, and bcm5715 only) -0r/w dc group addr trap enable (other devices) dc group memory arbiter request trap enable. r/w 12 rdi2 addr trap enable receive data initiator 2 memory arbiter request trap enable. r/w 11 rdi1 addr trap enable receive data initiator 1 memory arbiter request trap enable. r/w 10 rq addr trap enable receive list placement memory arbiter request trap enable. r/w 9 reserved (bcm5705, bcm5788, bcm5721, bcm5751, bcm5752, bcm5714, and bcm5715 only) -0r/w dmar2 addr trap enable (other devices) dma read 2 memory arbiter request trap enable. r/w 8 pci addr trap enable pci memory arbiter request trap enable. r/w table 378: memory arbiter mode register (offset 0x4000) (cont.) bit field description init access www.datasheet.in programmer?s guide bcm57xx 01/29/08 broadcom corporation document 57xx-pg105-r memory arbiter registers page 463 m emory a rbiter s tatus r egister (o ffset 0 x 4004) 7 reserved (bcm5705, bcm5788, bcm5721, bcm5751, bcm5752, bcm5714, and bcm5715 only) -0r/w tx risc addr trap enable (other devices) tx risc memory arbiter request trap enable. r/w 6 rx risc addr trap enable rx risc memory arbiter request trap enable. r/w 5 dmar1 addr trap enable dma read 1 memory arbiter request trap enable. r/w 4 dmaw1 addr trap enable dma write 1 memory arbiter request trap enable. r/w 3 rx-mac addr trap enable receive mac memory arbiter request trap enable. r/w 2 tx-mac addr trap enable transmit mac memory arbiter request trap enable. r/w 1 enable this bit controls whether the memory arbiter is active or not. when set to 0, it completes the current operation and cleanly halts. until it is completely halted, it remains 1 when read. r/w 0 reset when this bit is set to 1, the memory arbiter state machine is reset. this is a self-clearing bit. r/w table 379: memory arbiter status register (offset 0x4004) bit field description init access 31-26 reserved - 0 r/o 25 reserved(bcm5705, bcm5788, bcm5721, bcm5751, bcm5752, bcm5714, and bcm5715 only) -0r/w ext ssram data read par err (other devices) external ssram data read parity error. w2c 24 reserved (bcm5705, bcm5788, bcm5721, bcm5751, bcm5752, bcm5714, and bcm5715 only) -0r/w ext ssram wfifo overrun (other devices) external ssram write fifo overrun. w2c 23 reserved (bcm5705, bcm5788, bcm5721, bcm5751, bcm5752, bcm5714, and bcm5715 only) -0r/w ext ssram wfifo overrun (other devices) external ssram write fifo overrun. w2c 22 reserved (bcm5705, bcm5788, bcm5721, bcm5751, bcm5752, bcm5714, and bcm5715 only) -0r/w ext ssram rfifo underrun (other devices) external ssram read fifo underrun. w2c table 378: memory arbiter mode register (offset 0x4000) (cont.) bit field description init access www.datasheet.in bcm57xx programmer?s guide 01/29/08 broadcom corporation page 464 memory arbiter registers document 57xx-pg105-r 21 reserved (bcm5705, bcm5788, bcm5721, bcm5751, bcm5752, bcm5714, and bcm5715 only) -0r/w ext ssram rfifo overrun external ssram read fifo overrun. w2c 20 dmaw 2 addr trap (other devices) dma write 2 memory arbiter request trap. w2c 19 reserved (bcm5705, bcm5788, bcm5721, bcm5751, bcm5752, bcm5714, and bcm5715 only) -0r/w bm addr trap (other devices) buffer manager memory arbiter request trap. w2c 18 reserved (bcm5705, bcm5788, bcm5721, bcm5751, bcm5752, bcm5714, and bcm5715 only) -0r/w sbds addr trap (other devices) send bd ring selector memory arbiter request trap. w2c 17 reserved (bcm5705, bcm5788, bcm5721, bcm5751, bcm5752, bcm5714, and bcm5715 only) -0r/w sdc_dmac group addr trap sdc_dmac group memory arbiter request trap. w2c 16 sdi addr trap (other devices) send data initiator memory arbiter request trap. w2c 15 reserved (bcm5705, bcm5788, bcm5721, bcm5751, bcm5752, bcm5714, and bcm5715 only) -0r/w mcf addr trap (other devices) mbuf cluster free memory arbiter request trap. w2c 14 reserved (bcm5705, bcm5788, bcm5721, bcm5751, bcm5752, bcm5714, and bcm5715 only) -0r/w hc addr trap (other devices) host coalescing memory arbiter request trap. w2c 13 reserved (bcm5705, bcm5788, bcm5721, bcm5751, bcm5752, bcm5714, and bcm5715 only) -0r/w dc group addr trap (other devices) dc group memory arbiter request trap. w2c 12 rdi2 addr trap receive data initiator 2 memory arbiter request trap. w2c 11 rdi1 addr trap receive data initiator 1 memory arbiter request trap. w2c 10 rq addr trap receive list placement memory arbiter request trap. w2c 9 reserved (bcm5705, bcm5788, bcm5721, bcm5751, bcm5752, bcm5714, and bcm5715 only) -0r/w dmar2 addr trap (other devices) dma read 2 memory arbiter request trap. w2c 8 pci addr trap pci memory arbiter request trap. w2c 7 reserved (bcm5705, bcm5788, bcm5721, bcm5751, bcm5752, bcm5714, and bcm5715 only) -0r/w tx risc addr trap (other devices) tx risc memory arbiter request trap. w2c table 379: memory arbiter status register (offset 0x4004) (cont.) bit field description init access www.datasheet.in programmer?s guide bcm57xx 01/29/08 broadcom corporation document 57xx-pg105-r memory arbiter registers page 465 m emory a rbiter t rap a ddress l ow r egister (o ffset 0 x 4008) m emory a rbiter t rap a ddress h igh r egister (o ffset 0 x 400c) 6 rx risc addr trap rx risc memory arbiter request trap. w2c 5 dmar1 addr trap dma read 1 memory arbiter request trap. w2c 4 dmaw 1 addr trap dma write 1 memory arbiter request trap. w2c 3 rx-mac addr trap receive mac memory arbiter request trap. w2c 2 tx-mac addr trap transmit mac memory arbiter request trap. w2c 1-0 reserved - r/o table 380: memory arbiter trap address low register (offset 0x4008) bit field description init access 31-21 reserved - 0 r/o 20-0 ma trap addr low memory arbiter trap address low. r/w table 381: memory arbiter trap address high register (offset 0x400c) bit field description init access 31-21 reserved - 0 r/o 20-0 ma trap addr high memory arbiter trap address high. r/w table 379: memory arbiter status register (offset 0x4004) (cont.) bit field description init access www.datasheet.in bcm57xx programmer?s guide 01/29/08 broadcom corporation page 466 buffer manager control registers document 57xx-pg105-r b uffer m anager c ontrol r egisters table 382: buffer manager control registers offset registers 0x4400-0x4403 buffer manager mode register 0x4404-0x4407 buffer manager status register 0x4408-0x440b mbuf pool base address 0x440c-0x440f mbuf pool length 0x4410-0x4413 mbuf pool read dma low watermark 0x4414-0x4417 mbuf pool mac rx low watermark 0x4418-0x441b mbuf pool high watermark 0x441c-0x441f rx risc mbuf allocation request register 0x4420-0x4423 rx risc mbuf allocation response register 0x4424-0x4427 reserved 0x4428-0x442b reserved 0x442c-0x442f dma descriptor pool base address 0x4430-0x4433 dma descriptor pool length 0x4434-0x4437 dma descriptor pool low watermark 0x4438-0x443b dma descriptor pool high watermark 0x443c-0x443f reserved 0x4440-0x4443 reserved 0x4444-0x4447 reserved 0x4448-0x444b reserved 0x444c-0x444f hardware diagnostic 1 register 0x4450-0x4453 hardware diagnostic 2 register 0x4454-0x4457 hardware diagnostic 3 register 0x4458-0x445b receive flow threshold register 0x445c-0x47ff reserved www.datasheet.in programmer?s guide bcm57xx 01/29/08 broadcom corporation document 57xx-pg105-r buffer manager control registers page 467 b uffer m anager m ode r egister (o ffset 0 x 4400) b uffer m anager s tatus r egister (o ffset 0 x 4404) table 383: buffer manager mode register (offset 0x4400) bit field description init access 31-6 reserved - 0 r/o 5 reset rxmbuf ptr (bcm5705, bcm5788, bcm5721, bcm5751, bcm5752, bcm5714, and bcm5715 only) when this bit is set, it will cause the rxmbuf allocation and deallocation pointer to reset back to the rxmbuf base. it will also cause the rxmac to drop the preallocated mbuf and request a new one. 0r/wc reserved (other devices) - 0 r/o 4 mbuf low attn enable mbuf low attn enable mbuf low attention enable. r/w 3 bm test mode buffer manager test mode. must be set to 0 for normal operation. r/w 2 attn_enable when this bit is set to 1, an internal attention is generated when an error occurs. r/w 1 enable this bit controls whether the buffer manager is active or not. when set to 0 it completes the current operation and cleanly halts. until it is completely halted, it remains one when read. r/w 0 reset when this bit is set to 1, the buffer manager state machine is reset. this is a self-clearing bit. r/w table 384: buffer manager status register (offset 0x4404) bit field description init access 31-5 bm test mode - r/o 4 mbuf low attn mbuf low attention status r/o 3 reserved - r/o 2 error buffer manager error status r/o 1-0 reserved - 0 r/o www.datasheet.in bcm57xx programmer?s guide 01/29/08 broadcom corporation page 468 buffer manager control registers document 57xx-pg105-r mbuf p ool b ase a ddress r egister (o ffset 0 x 4408) the mbuf pool base address specifies beginning of the mbuf. this register can point to either: ? internal memory (bcm5705, bcm5714, bcm5721, and bcm5751 only; see table 385 ). ? internal memory (rest of bcm57xx family except bcm5700; see table 386 ). bcm5705, bcm5714, bcm5721, and bcm5751 mac transceivers only this version of the mbuf pool base address register applies to the bcm5705, bcm5788, bcm5721, bcm5751, bcm5752, bcm5714, and bcm5715 devices only. rest of bcm57xx family this version of the mbuf pool base address register applies to the rest of the bcm57xx family (except for the bcm5700 mac). table 385: mbuf pool base address register (offset 0x4408) bit field description init access 31-24 reserved - 0 r/o 23-0 mbuf base address specifies beginning of the mbuf for receive packet. the base address will ignore the lower seven bits, thus aligning the beginning of the mbuf pool on a 128-byte boundary. 10000h r/w note: after modifying the value in this register, software should clear the contents of the rxmbuf memory and set the reset rxmbuf pointer bit of the buffer manger mode register (offset 0x4400). table 386: mbuf pool base address register (offset 0x4408, rest of bcm57xx family) bit field description init access 31-0 mbuf base address specifies beginning of the mbuf. the base address will ignore the lower seven bits, thus aligning the beginning of the mbuf pool on a 128-byte boundary. 0r/w www.datasheet.in programmer?s guide bcm57xx 01/29/08 broadcom corporation document 57xx-pg105-r buffer manager control registers page 469 mbuf p ool l ength r egister (o ffset 0 x 440c) this 32-bit register specifies the length of mbuf (see table 387 for the bcm5705, bcm5714, bcm5721, and bcm5751 and table 388 for the rest of the bcm57xx family). bcm5705, bcm5714, bcm5721, and bcm5751 mac transceivers only this version of the mbuf pool length address register applies to the bcm5705, bcm5714, bcm5721, and bcm5751 mac transceivers only. rest of bcm57xx family this version of the mbuf pool length address register applies to the rest of the bcm57xx family (except for the bcm5700 mac). r ead dma mbuf l ow w atermark r egister (o ffset 0 x 4410) this 32-bit register indicates the number of free mbufs that must be available for the read dma engine to dequeue a descriptor from the normal priority ftq. if the free mbuf count drops below this mark, it must go above the high watermark to resume normal operation. table 387: mbuf pool length register (offset 0x440c) bit field description init access 31-24 reserved - 0 r/o 23-0 mbuf length specifies the length of mbuf assigned for receive packet. the default is 32 kb. the lower seven bits should be ignored to align the mbuf pool on a 128-byte boundary. 0x8000 r/w note: after modifying the value in this register, software should clear the contents of the rxmbuf memory and set the reset rxmbuf pointer bit of the buffer manger mode register (offset 0x4400). table 388: mbuf pool length register (offset 0x440c, rest of bcm57xx family) bit field description init access 31-0 mbuf length specifies length of mbuf. the length register can be up to 8 mb if there is external memory (only for the bcm5700) available to support this size mbuf pool. it is invalid to point to areas outside of memory. 0r/w www.datasheet.in bcm57xx programmer?s guide 01/29/08 broadcom corporation page 470 buffer manager control registers document 57xx-pg105-r mac rx mbuf l ow w atermark r egister (o ffset 0 x 4414) this 32-bit register indicates the number of free mbufs that must be available for the rx mac to accept a frame. if the free mbuf count drops below this mark, it must go above the high watermark to resume normal operation. mbuf h igh w atermark r egister (o ffset 0 x 4418) this 32-bit register indicates the number of free mbufs that must be available before normal operation is restored to the read dma engine and/or the rx mac. rx risc mbuf c luster a llocation r equest r egister (o ffset 0 x 441c) the rx risc mbuf cluster allocation request register contains two fields: ? a requested size field which can be up to 64 kb long ? an allocation bit the allocation bit is used to control the access to the response register. use this register to set the size and allocation bit and then poll the register until the allocation bit is cleared. when the allocation bit is cleared, it is safe to read from the rx risc mbuf cluster allocation response register. note: when the mac rx mbuf low watermark has been reached, the rx mac continues to accept incoming frames as configured by the ?low watermark maximum receive frames register (offset 0x504)? on page 394 . if these additional incoming frames cause the mbuf free count to drop to 0, the buffer manager may stall and require a controller reset to recover. table 389: rx risc mbuf allocation request register (offset 0x441c) bit field description init access 31 allocation bit set this bit to 1 to request for the mbuf. when this bit is read as 0, then read the mbuf allocation response register (see ?rx risc mbuf allocation response register (offset 0x4420)? on page 471 ) for the txmbuf pointer. 0r/w 30-16 reserved - 0x0 r/o 15-0 requested mbuf cluster size (bcm5700, bcm5701, bcm5702, BCM5703, and bcm5704 only) this field controls the size of the mbuf cluster allocation and must include sufficient space for mbuf headers (8 bytes per mbuf) and frame descriptors (40 bytes per mbuf cluster). broadcom suggests the following formula: if (packet_size <= 80) request_size = packet_size + 48 else request_size = packet_size + 48 + (8 *(packet_size -48) / 120) 0r/w reserved - 0 r/o www.datasheet.in programmer?s guide bcm57xx 01/29/08 broadcom corporation document 57xx-pg105-r buffer manager control registers page 471 rx risc mbuf a llocation r esponse r egister (o ffset 0 x 4420) this register returns the mbuf cluster pointer of the specified size when the allocation bit is cleared. if a second mbuf cluster allocation request is made before this register is read, an mbuf memory leak may occur. (for bcm5700, bcm5701, bcm5702, BCM5703, and bcm5704 only.) this register is hardwired to 61, or 0x0000003d. the txmbuf that is dedicated for asf is the uppermost 384 bytes. the cpu should use 0x00009e80 as the starting address for asf. (applies to bcm5705, bcm5721, and bcm5751 only.) rx cpu mbuf a llocation r esponse r egister (0 x 4420 h , bcm5714 and bcm5715 o nly ) table 390: rx cpu mbuf allocation response register (0x4420h, bcm5714 and bcm5715 only) bit field description init access 31:0 tx mbuf number tx mbuf allocated to rx cpu. the response depends on the value bits 31:30 of register 4000h (memory arbiter mode register). ? 0xad if 4000[31:30] == 00 ? 0xa3 if 4000[31:30] == 01 ? 0x9e if 4000[31:30] == 10 ? 0x8d if 4000[31:30] == 11 0xa3 r www.datasheet.in bcm57xx programmer?s guide 01/29/08 broadcom corporation page 472 buffer manager control registers document 57xx-pg105-r tx risc mbuf a llocation r esponse r egister (o ffset 0 x 4424) this register is for bcm5700, bcm5701, bcm5702, BCM5703, and bcm5704 only. the tx risc mbuf cluster allocation request register contains two fields: ? a requested size field which can be up to 64 kb long ? an allocation bit the allocation bit is used to control the access to the response register. use this register to set the size and allocation bit and then poll the register until the allocation bit is cleared. when the allocation bit is cleared, it is safe to read from the tx risc mbuf cluster allocation response register. tx risc mbuf a llocation r esponse r egister (o ffset 0 x 4428) this register is for bcm5700, bcm5701, bcm5702, BCM5703, and bcm5704 only. this register returns the mbuf cluster pointer of the specified size when the allocation bit is cleared. if a second mbuf cluster allocation request is made before this register is read, an mbuf memory leak may occur. this register is hardwired to 61 or 0x0000003d. the txmbuf that is dedicated for asf is the uppermost 384 bytes. the cpu should use 0x00009e80 as the starting address for asf. dma d escriptor p ool i nitialization r egister (o ffset 0 x 442c-0 x 4433) this register is not applicable to bcm5705, bcm5788, bcm5721, bcm5751, bcm5752, bcm5714, and bcm5715 devices. there are two registers used to configure the dma descriptor pool. a base address and a length register. the base address register can only point to internal memory. the base address will ignore the lower five bits thus aligning the beginning of the dma descriptor pool on a 32-byte boundary. the length register can be up to 8 kb if there is memory available to support this size dma descriptor pool. it is invalid to point to areas outside of memory. table 391: tx risc mbuf allocation request register (offset 0x4424) bit field description init access 31 allocation bit set this bit to 1 to request for the mbuf. when this bit is read as 0, then read the mbuf allocation response register (see ?rx risc mbuf allocation response register (offset 0x4420)? on page 471 ) for the txmbuf pointer. 0r/w 30-16 reserved - 0x00000000 r/w 15-0 requested mbuf cluster size this field controls the size of the mbuf cluster allocation, and must include sufficient space for mbuf headers (8 bytes per mbuf) and frame descriptors (40 bytes per mbuf cluster). broadcom suggests the following formula: if (packet_size <= 80) request_size = packet_size + 48 else request_size = packet_size + 48 + (8 *(packet_size -48) / 120) 0r/w www.datasheet.in programmer?s guide bcm57xx 01/29/08 broadcom corporation document 57xx-pg105-r buffer manager control registers page 473 dma d escriptor p ool l ow w atermark r egister (o ffset 0 x 4434) this register is not applicable to bcm5705, bcm5788, bcm5721, bcm5751, bcm5752, bcm5714, and bcm5715 devices. this 32-bit register indicates the number of free dma descriptors that must be available for the send data initiator and send bd initiator state machines to generate dmas. dma d escriptor p ool h igh w atermark r egister (o ffset 0 x 4438) this register is not applicable to bcm5705, bcm5788, bcm5721, bcm5751, bcm5752, bcm5714, and bcm5715 devices. this 32-bit register indicates the number of free dma descriptors that must be available before normal operation is restored to the send data initiator and send bd initiator state machines. bm h ardware d iagnostic 1 r egister (o ffset 0 x 444c) this 32-bit register provides debugging information on the txmbuf pointer. bcm5705, bcm5788, bcm5721, bcm5751, and bcm5752 devices only this version of the bm hardware diagnostic 1 register applies to the bcm5705, bcm5788, bcm5721, bcm5751, and bcm5752 devices only. table 392: bm hardware diagnostic 1 register (offset 0x444c) bit field description init access 31-26 reserved - 0 r/w 25-20 last txmbuf deallocation head pointer captures the last deallocation head pointer of the txmbuf. 000000 r/o 19-16 reserved - 0000 r/w 15-10 last txmbuf deallocation tail pointer captures the last deallocation head pointer of the txmbuf. 000000 r/o 9-6 reserved - 0000 r/w 5-0 next txmbuf allocation pointer the value of the next txmbuf allocation pointer (should be between 0 and 60). 000000 r/o www.datasheet.in bcm57xx programmer?s guide 01/29/08 broadcom corporation page 474 buffer manager control registers document 57xx-pg105-r bcm5714 and bcm5715 devices only rest of bcm57xx family this version of the bm hardware diagnostic 1 register applies to the rest of the bcm57xx family. bm h ardware d iagnostic 2 r egister (o ffset 0 x 4450) this 32-bit register provides debug information on the txmbuf and rxmbuf counts. bcm5705, bcm5788, bcm5721, bcm5751, and bcm5752 devices only this version of the bm hardware diagnostic 2 register applies to the bcm5705, bcm5788, bcm5721, bcm5751, and bcm5752 devices only. table 393: hardware diagnostic 1 register (0x444ch, 5714 only) bits field description init access 31:28 reserved - 0 r 27:20 tx mbuf de-allocation pointer tx de-allocation head pointer - r 19:18 reserved - 0 r 17:10 tx mbuf de-allocation pointer tx de-allocation tail pointer - r 9:8 reserved - 0 r 7:0 tx mbuf allocation pointer tx allocation pointer - r table 394: bm hardware diagnostic 1 register (offset 0x444c) bit field description init access 31-0 reserved - 0 r/o table 395: bm hardware diagnostic 2 register (offset 0x4450) bit field description init access 31-25 reserved - 0000000 r/o 24-16 rxmbuf count the number of rxmbufs that were allocated. 000000000 r/o 15 reserved - 0 r/o 14-9 txmbuf count the number of txmbufs that were allocated. 000000 r/o 8-0 rxmbuf left the number of free rxmbufs. 000000000 r/o www.datasheet.in programmer?s guide bcm57xx 01/29/08 broadcom corporation document 57xx-pg105-r buffer manager control registers page 475 bcm5714 and bcm5715 devices only rest of bcm57xx family this version of the bm hardware diagnostic 2 register applies to the rest of the bcm57xx family. bm h ardware d iagnostic 3 r egister (o ffset 0 x 4454) this 32-bit register provides debug information on the rxmbuf pointer. bcm5705, bcm5788, bcm5721, bcm5751, bcm5752, bcm5714, and bcm5715 devices only this version of the bm hardware diagnostic 3 register applies to the bcm5705, bcm5788, bcm5721, bcm5751, bcm5752, bcm5714, and bcm5715 devices only. table 396: hardware diagnostic 2 register (0x4450h, 5714 only) bits field description init access 31:26 reserved - 0 r 25:17 rx mbuf count the number of rx mbufs that were allocated. - r 16:9 tx mbuf count the number of tx mbufs that were allocated. - r 8:0 rx mbuf count the number of free rx mbufs. - r table 397: bm hardware diagnostic 2 register (offset 0x4450) bit field description init access 31-24 reserved - 0 r/o 23-16 dma count free dma descriptor count 0 r/o 15-0 free mbuf count the number of free mbufs 0 r/o table 398: bm hardware diagnostic 3 register (offset 0x4454) bit field description init access 31-25 reserved - 0000000 r/o 24-16 next rxmbuf deallocation pointer the next rxmbuf that is to be deallocated. 000000000 r/o 15-9 reserved - 0000000 r/o 8-0 next rxmbuf allocation pointer the next rxmbuf that is to be allocated. 000000000 r/o www.datasheet.in bcm57xx programmer?s guide 01/29/08 broadcom corporation page 476 buffer manager control registers document 57xx-pg105-r rest of bcm57xx family this version of the bm hardware diagnostic 3 register applies to the rest of the bcm57xx family. r eceive f low t hreshold r egister (o ffset 0 x 4458) this register is not applicable to the bcm5700 mac or bcm5701 mac devices. table 399: bm hardware diagnostic 3 register (offset 0x4454) bit field description init access 31-16 mbuf free list head - 0 r/o 15-0 mbuf free list tail - 0 r/o table 400: receive flow threshold register (offset 0x4458) bit field description init access 31-16 reserved - 0 r/o 15-0 mbuf threshold defines the integer number of mbufs remaining before the receive mac will drop received frames. 0r/w www.datasheet.in programmer?s guide bcm57xx 01/29/08 broadcom corporation document 57xx-pg105-r read dma control registers page 477 r ead dma c ontrol r egisters r ead dma m ode r egister (o ffset 0 x 4800) table 401: read dma control registers offset registers 0x4800-0x4803 read dma mode 0x4804-0x4807 read dma status 0x4808-0x4bff reserved table 402: read dma mode register (offset 0x4800) bit field description init access 31-30 reserved (bcm5700, bcm5701, bcm5721, bcm5751, and bcm5752 only) ?0r/o priority (other devices) sets the priority of the dma read engine relative to the dma write engine and msi engine. equal settings result in fair round-robin arbitration. ? 00: lowest ? 01: low ? 10: high ? 11: highest 00 r/w 29-28 reserved ? 0 r/o 27 hardware post-dma enable (bcm5721, bcm5751, bcm5752, bcm5714, and bcm5715 only) enable hardware lso post-dma processing. 0 r/w reserved (other devices) ? 0 r/o 26 post-dma debug enable when this bit is set, the send data completion state machine will be halted if the post-dma bit of the send bd is set. 0r/w reserved ? 0 r/o 25-18 reserved ? 0 r/o www.datasheet.in bcm57xx programmer?s guide 01/29/08 broadcom corporation page 478 read dma control registers document 57xx-pg105-r 17-16 pci request burst length (bcm5705 and bcm5788 only) the two bits define the burst length that the rdma read engine would request to the pci block. ? 00 = fifo available ? 01 = 64 ? 10 = 128 ? 11 = bcm5705 only: long burst of up to 4k bytes. this setting can only be used for 33mhz pci and core clock speed of 62.5mhz. ? 11 = bcm5788 only: reserved 0r/w pci request burst length (bcm5721, bcm5751, and bcm5752 only) the two bits define the burst length that the rdma read engine would request to the pci block. ? 00 = 128 ? 01 = 256 ? 10 = 512 ? 11 = 4k bytes when slow core clock mode bit (bit-19 of 0x74 register) is 0; otherwise 512 bytes. 0r/w reserved (other devices) ? 0 r/o 15-13 reserved ? 0 r/o 12 multi-split reset (bcm5704c and bcm5704s only) when set, the multiple-split state machines are reset. this bit is self-clearing. 0r/w reserved (other devices) ? 0 r/o 11 multi-split enable (bcm5704c and bcm5704s only) multiple-split mode is enabled by writing a 1 to bit 10. note: for multiple split mode to work, the pcix target (io bridge) will always have to respond with either a split response or a retry. the target cannot give data directly in response to a read request for multiple split mode to work. also, the split completion data has to come back in order. this has to be documented in the register spec. note this requirement is supported by ciob. 0r/w reserved (other devices) ? 0 r/o 10 read dma pci-x split transaction timeout expired attention enable enable read dma pci-x split transaction timeout expired attention. 0r/w 9 read dma local memory write longer than dma length attention enable enable read dma local memory write longer than dma length attention. 0r/w 8 read dma pci fifo overread attention enable enable read dma pci fifo overread attention (pci read longer than dma length.) 0r/w 7 read dma pci fifo underrun attention enable enable read dma pci fifo underrun attention. 0 r/w 6 read dma pci fifo overrun attention enable enable read dma pci fifo overrun attention. 0 r/w 5 read dma pci host address overflow error attention enable enable read dma pci host address overflow error attention. a host address overflow occurs when a single dma read begins at an address below 4 gb and ends on an address above 4 gb. this is a fatal error. 0r/w 4 read dma pci parity error attention enable enable read dma pci parity error attention. 0 r/w table 402: read dma mode register (offset 0x4800) (cont.) bit field description init access www.datasheet.in programmer?s guide bcm57xx 01/29/08 broadcom corporation document 57xx-pg105-r read dma control registers page 479 r ead dma s tatus r egister (o ffset 0 x 4804) 3 read dma pci master abort attention enable enable read dma pci master abort attention. 0 r/w 2 read dma pci target abort attention enable enable read dma pci target abort attention. 0 r/w 1 enable this bit controls whether the read dma state machine is active or not. when set to 0, it completes the current operation and cleanly halts. until it is completely halted, it remains one when read. 1r/w 0 reset when this bit is set to 1, the read dma state machine is reset. this is a self-clearing bit. 0r/w table 403: read dma status register (offset 0x4804) bit field description init access 31-11 reserved - 0 r/o 10 read dma pci-x split transaction timeout expired read dma pci-x split transaction timeout expired. 0 w2c 9 read dma local memory write longer than dma length error read dma local memory write longer than dma length error. 0w2c 8 read dma pci fifo overread error read dma pci fifo overread error (pci read longer than dma length). 0w2c 7 read dma pci fifo underrun error read dma pci fifo underrun error. 0 w2c 6 read dma pci fifo overrun error read dma pci fifo overrun error. 0 w2c 5 read dma pci host address overflow error read dma pci host address overflow error. a host address overflow occurs when a single dma read begins at an address below a multiple of 4 gb and ends at an address above the same multiple of 4 gb (i.e., the host memory address transitions from 0xxxxxxxxx_ffffffff to 0xyyyyyyyy_00000000 in a single read). this is a fatal error. 0w2c 4 read dma pci parity error read dma pci parity error. 0 w2c 3 read dma pci master abort error read dma pci master abort error. 0 w2c 2 read dma pci target abort error read dma pci target abort error. 0 w2c 1-0 reserved - 0 w2c table 402: read dma mode register (offset 0x4800) (cont.) bit field description init access www.datasheet.in bcm57xx programmer?s guide 01/29/08 broadcom corporation page 480 write dma control registers document 57xx-pg105-r w rite dma c ontrol r egisters w rite dma m ode r egister (o ffset 0 x 4c00) table 404: write dma control registers offset registers 0x4c00-0x4c03 write dma mode 0x4c04-0x4c07 write dma status 0x4c08-0x4fff reserved table 405: write dma mode register (offset 0x4c00) bit field description init access 31-30 reserved (bcm5700, bcm5701, bcm5721, bcm5751, and bcm5752 only) -0r/o priority (other devices) sets the priority of the dma read engine relative to the dma write engine and msi engine. equal settings result in fair round-robin arbitration. ? 00 = lowest ? 01 = low ? 10 = high ? 11 = highest 00 r/w 29 extended bd enable (bcm5714 and bcm5715 only) set to 1 to enable the use of extended bds in standard receive ring. 0r/w reserved (rest of bcm57xx family) - 28-19 reserved - r/o 18 swap test enable (bcm5721, bcm5751, bcm5752, bcm5714, and bcm5715 only) when this bit is set, swap test mode will be enabled and bits 17 to 12 can be used to test different byte/word swap settings. 0r/w reserved (other devices) - r/o 17 hc byte swap (bcm5721, bcm5751, bcm5752, bcm5714, and bcm5715 only) byte swap control for status words. 0 r/w reserved (other devices) - r/o 16 hc word swap (bcm5721, bcm5751, bcm5752, bcm5714, and bcm5715 only) word swap control for status words. 0 r/w reserved (other devices) - r/o www.datasheet.in programmer?s guide bcm57xx 01/29/08 broadcom corporation document 57xx-pg105-r write dma control registers page 481 15 bd byte swap (bcm5721, bcm5751, bcm5752, bcm5714, and bcm5715 only) byte swap control for return bds. 0 r/w reserved (other devices) - r/o 14 bd word swap (bcm5721, bcm5751, bcm5752, bcm5714, and bcm5715 only) word swap control for return bds. 0 r/w reserved (other devices) - r/o 13 data byte swap (bcm5721, bcm5751, bcm5752, bcm5714, and bcm5715 only) byte swap control for data. 0 r/w reserved (other devices) - r/o 12 data word swap (bcm5721, bcm5751, bcm5752, bcm5714, and bcm5715 only) word swap control for data. 0 r/w reserved (other devices) - r/o 11 software byte swap control (bcm5721, bcm5751, bcm5752, bcm5714, and bcm5715 only) to override byte enables with all 1s. 0 r/w reserved (other devices) - r/o 10 reserved (other devices) - r/o receive accelerate mode (bcm5705, bcm5721, bcm5751, bcm5752, bcm5714, and bcm5715 only) the write dma-to-pci request length is the available data size in the pci rx fifo. set to 1: the write dma-to-pci request length is the maximum length of the current transaction, regardless of the available data size in pci rx fifo. this mode cannot be used in slow core clock environment. disable this mode before switching to slow core clock mode. 0r/w 9 write dma local memory read longer than dma length attention enable. enable write dma local memory read longer than dma length attention. 0r/w 8 write dma pci fifo overwrite attention enable enable write dma pci fifo overwrite attention (pci write longer than dma length). 0r/w 7 write dma pci fifo underrun attention enable enable write dma pci fifo underrun attention. 0 r/w 6 write dma pci fifo overrun attention enable enable write dma pci fifo overrun attention. 0 r/w 5 write dma pci host address overflow error attention enable enable write dma pci host address overflow error attention. 0r/w 4 write dma pci parity error attention enable enable write dma pci parity error attention. 0 r/w table 405: write dma mode register (offset 0x4c00) (cont.) bit field description init access www.datasheet.in bcm57xx programmer?s guide 01/29/08 broadcom corporation page 482 write dma control registers document 57xx-pg105-r w rite dma s tatus r egister (o ffset 0 x 4c04) 3 write dma pci master abort attention enable enable write dma pci master abort attention. 0 r/w 2 write dma pci target abort attention enable enable write dma pci target abort attention. 0 r/w 1 enable this bit controls whether the write dma state machine is active or not. when set to 0, it completes the current operation and cleanly halts. until it is completely halted, it remains 1 when read. 1r/w 0 reset when this bit is set to 1, the write dma state machine is reset. this is a self-clearing bit. 0r/w table 406: write dma status register (offset 0x4c04) bit field description init access 31-10 reserved - 0 r/o 9 write dma local memory read longer than dma length error write dma local memory read longer than dma length error. 0w2c 8 write dma pci fifo overread error write dma pci fifo overread error. (pci read longer than dma length) 0w2c 7 write dma pci fifo underrun error write dma pci fifo underrun error. 0 w2c 6 write dma pci fifo overrun error write dma pci fifo overrun error. 0 w2c 5 write dma pci host address overflow error write dma pci host address overflow error. a host address overflow occurs when a single dma write begins at an address below a multiple of 4 gb and ends at an address above the same multiple of 4 gb (i.e., the host memory address transitions from 0xxxxxxxxx_ffffffff to 0xyyyyyyyy_00000000 in a single write). this is a fatal error. 0w2c 4 write dma pci parity error write dma pci parity error. 0 w2c 3 write dma pci master abort error write dma pci master abort error. 0 w2c 2 write dma pci target abort error write dma pci target abort error. 0 w2c 1-0 reserved - 0 r/o table 405: write dma mode register (offset 0x4c00) (cont.) bit field description init access www.datasheet.in programmer?s guide bcm57xx 01/29/08 broadcom corporation document 57xx-pg105-r rx risc registers page 483 rx risc r egisters the following rx risc registers are exposed to host software to provide a mechanism to download firmware binary. the information in this section is not intended to provide a comprehensive understanding of the risc architecture. rx risc m ode r egister (o ffset 0 x 5000) this register controls the operation of the rx risc and its miscellaneous functions. table 407: rx risc registers offset register 0x5000-0x5003 rx risc mode register 0x5004-0x5007 rx risc state register 0x5008-0x501b reserved 0x501c-0x501f rx risc program counter 0x5020-0x5033 reserved 0x5034-0x5037 rx risc hardware breakpoint register 0x5038-0x53ff reserved table 408: rx risc mode register fields (offset 0x5000) bit field description init access 31-15 reserved always 0. 0 r/o 14 enable register address trap halt when set, if the grc raises the trap signal to this processor, it will halt. cleared on reset and watchdog interrupt. 0rw 13 enable memory address trap halt when set, if the ma raises the trap signal to this processor, it will halt. cleared on reset and watchdog interrupt. 0rw 12 enable invalid instruction fetch halt when set, the condition that causes rx risc state bit 6 to be set, also halts the rx risc. set by reset. cleared by watchdog interrupt. 0rw 11 enable invalid data access halt when set, the condition that causes rx risc state bit 5 to be set, also halts the rx risc. set by reset. cleared by watchdog interrupt. 0rw 10 halt rx risc set by tx risc or the host to halt the rx risc. cleared on reset and watchdog interrupt. 0rw 9 flush instruction cache self-clearing bit which forces the instruction cache to flush. 0wo 8 enable instruction cache prefetch enables prefetch logic within the instruction cache. when disabled only a single cache line is read on a cache miss. cleared on reset. 0rw 7 enable watchdog enables watchdog interrupt state machine. used in conjunction with watchdog clear register, watchdog saved pc register and watchdog vector register. cleared on reset and watchdog interrupt. 0rw www.datasheet.in bcm57xx programmer?s guide 01/29/08 broadcom corporation page 484 rx risc registers document 57xx-pg105-r 6 rom fail asserted on reset. cleared by rom code after it successfully loads code from nvram. afterwards, this bit can be used by software for any purpose. 1rw 5 enable data cache enables the data cache. cleared on reset. note: firmware developers should take care to clear this bit before polling internal sram memory locations, because the rx risc processor uses a two-element lru caching algorithm, which is not affected by writes from the pci interface. 0rw 4 enable write post buffers enables absorption of multiple sw operations for sram and register writes. when this bit is disabled, only one write at a time will be absorbed by the write post buffers. cleared on reset. note: setting this bit on the bcm5705, bcm5721, and bcm5751 may cause unpredictable behavior. 0rw 3 enable page 0 instr halt when set, instruction references to the first 256 bytes of sram force the rx risc to halt and cause bit 4 in the rx risc state register to be latched. cleared on reset and watchdog interrupt. 0rw 2 enable page 0 data halt when set, data references to the first 256 bytes of sram force the rx risc to halt and cause bit 3 in the rx risc state register to be latched. cleared on reset and watchdog interrupt. 0rw 1 single-step rx risc advances the rx risc?s pc for one cycle. if halting condition still exists, the rx risc will again halt; otherwise, it will resume normal operation. 0rw 0 reset rx risc self-clearing bit which resets only the rx risc. 0 wo table 408: rx risc mode register fields (offset 0x5000) (cont.) bit field description init access www.datasheet.in programmer?s guide bcm57xx 01/29/08 broadcom corporation document 57xx-pg105-r rx risc registers page 485 rx risc s tate r egister (o ffset 0 x 5004) the rx risc state register reports the current state of the rx risc and, if halted, gives reasons for the halt. there are four categories of information; informational (read-only), informational (write-to-clear), disable-able halt conditions (write-to- clear), and non-disable-able halt conditions (write-to-clear). table 409: rx risc state fields (offset 0x5004) bit field description init access 31 blocking read a blocking data cache miss occurred, causing the rx risc to stall while data is fetched from external (to the rx risc) memory. this is intended as a debugging tool. no state is saved other than the fact that the miss occurred. 0w2c 30 ma request fifo overflow ma_req_fifo overflowed. the rx risc is halted on this condition. 0w2c 29 ma data/bytemask fifo overflow ma_datamask_fifo overflowed. the rx risc is halted on this condition. 0w2c 28 ma outstanding read fifo overflow ma_rd_fifo overflowed. the rx risc is halted on this condition. 0w2c 27 ma outstanding write fifo overflow ma_wr_fifo overflowed. the rx risc is halted on this condition. 0w2c 26-16 reserved always 0. 0 r/o 15 instruction fetch stall the processor is currently stalled due to an instruction fetch. 0r/o 14 data access stall the processor is currently stalled due to a data access. 0 r/o 13-11 reserved always 0. 0 r/o 10 rx risc halted the rx risc was explicitly halted via bit 10 in the rx risc mode register. 0r/o 9 register address trap a signal was received from the global resources block indicating that this processor accessed a register location that triggered a software trap. the grc registers are used to configure register address trapping. 0w2c 8 memory address trap a signal was received from the memory arbiter indicating that some bcm5700 block, possibly this processor, accessed a memory location that triggered a software trap. the ma registers are used to configure memory address trapping. 0w2c 7 bad memory alignment load or store instruction was executed with the least significant two address bits not valid for the width of the operation (e.g., load word or load half-word from an odd byte address). 0w2c 6 invalid instruction fetch program counter (pc) is set to invalid location in processor address space. see ?memory maps and pool configuration? on page 171 for details about unmapped areas in the cpu address space. 0w2c 5 invalid data access data reference to illegal location. see ?memory maps and pool configuration? on page 171 for details about unmapped areas in the cpu address space. 0w2c 4 page 0 instruction reference when enabled in mode register, indicates the address in the pc is within the lower 256 bytes of sram. 0w2c www.datasheet.in bcm57xx programmer?s guide 01/29/08 broadcom corporation page 486 rx risc registers document 57xx-pg105-r rx risc p rogram c ounter (o ffset 0 x 501c) the program counter register can be used to read or write the current program counter of the each cpu. reads can occur at any time, however writes can only be performed when the cpu is halted. writes will also clear any pending instruction in the decode stage of the pipeline. bits 31-2 are implemented. 1s written to bits 1-0 are ignored. rx risc h ardware b reakpoint r egister (o ffset 0 x 5034) this register is used to set a hardware breakpoint based on the risc's program counter (pc). if the pc equals the value in this register, and the hardware breakpoint is enabled, the risc is halted and the appropriate stopping condition is indicated in the risc state register. to enable the hardware breakpoint, simply write the byte address of the instruction to break on and clear the disable hardware breakpoint bit. this register is also used to indicate the progress code for the bcm57xx rom loader. 3 page 0 data reference when enabled in mode register, indicates data reference within lower 256 bytes of sram. 0w2c 2 invalid instruction invalid instruction fetched. 0 w2c 1 halt instruction executed a halt-type instruction was executed by the rx risc. 0 w2c 0 hardware breakpoint when enabled in mode register, indicates hardware breakpoint has been reached. 0w2c table 410: rx risc hardware breakpoint register (offset 0x5034) bit field description init access 31-2 hardware breakpoint word address to break on. 0 r/w 1 reserved - 0 r/o 0 disable hardware breakpoint when this bit is set, the hardware breakpoint is disabled. 1r/w table 409: rx risc state fields (offset 0x5004) (cont.) bit field description init access www.datasheet.in programmer?s guide bcm57xx 01/29/08 broadcom corporation document 57xx-pg105-r tx risc registers page 487 tx risc r egisters these registers are applicable to bcm5700, bcm5701, bcm5702, BCM5703, and bcm5704 only. the following tx risc registers are exposed to host software to provide a mechanism to download firmware binary. the information in this section is not intended to provide a comprehensive understanding of the risc architecture. the reader should refer to the bcm57xx family firmware reference manual for an understanding of the risc architecture. tx risc m ode r egister (o ffset 0 x 5400) table 411: tx risc registers offset register 0x5400-0x5403 tx risc mode register 0x5404-0x5407 tx risc state register 0x5408-0x541b reserved 0x541c-0x541f tx risc program counter 0x5420-0x57ff reserved table 412: tx risc mode register fields (offset 0x5400) bit field description init access 31-15 reserved always 0. 0 r/o 14 enable register address trap halt when set, if the grc raises the trap signal to this processor, it will halt. cleared on reset and watchdog interrupt. 0rw 13 enable memory address trap halt when set, if the ma raises the trap signal to this processor, it will halt. cleared on reset and watchdog interrupt. 0rw 12 enable invalid instruction fetch halt when set, the condition that causes tx risc state bit 6 to be set, also halts the tx risc. set by reset. cleared by watchdog interrupt. 0rw 11 enable invalid data access halt when set, the condition that causes tx risc state bit 5 to be set, also halts the tx risc. set by reset. cleared by watchdog interrupt. 0rw 10 halt tx risc set by tx risc or the host to halt the tx risc. cleared on reset and watchdog interrupt. 0rw 9 flush instruction cache self-clearing bit, which forces the instruction cache to flush. 0wo 8 enable instruction cache prefetch enables prefetch logic within the instruction cache. when disabled only a single cache line is read on a cache miss. cleared on reset. 0rw 7 enable watchdog enables watchdog interrupt state machine. used in conjunction with watchdog clear register, watchdog saved pc register and watchdog vector register. cleared on reset and watchdog interrupt. 0rw www.datasheet.in bcm57xx programmer?s guide 01/29/08 broadcom corporation page 488 tx risc registers document 57xx-pg105-r tx risc s tate r egister (o ffset 0 x 5404) the tx risc state register reports the current state of the tx risc and, if halted, gives reasons for the halt. there are four categories of information; informational (read-only), informational (write-to-clear), disable-able halt conditions (write-to- clear), and non-disable-able halt conditions (write-to-clear). 6 rom fail asserted on reset. cleared by rom code after it successfully loads code from nvram. afterwards, this bit can be used by software for any purpose. 1rw 5 enable data cache enables the data cache. cleared on reset. note: firmware developers should take care to clear this bit before polling internal sram memory locations, because the tx risc processor uses a two-element lru caching algorithm, which is not affected by writes from the pci interface. 0rw 4 enable write post buffers enables absorption of multiple sw operations for sram and register writes. when this bit is disabled, only one write at a time will be absorbed by the write post buffers. cleared on reset. 0rw 3 enable page 0 instr halt when set, instruction references to the first 256 bytes of sram force the tx risc to halt and cause bit 4 in the tx risc state register to be latched. cleared on reset and watchdog interrupt. 0rw 2 enable page 0 data halt when set, data references to the first 256 bytes of sram force the tx risc to halt and cause bit 3 in the tx risc state register to be latched. cleared on reset and watchdog interrupt. 0rw 1 single-step tx risc advances the tx risc?s pc for one cycle. if halting condition still exists, the tx risc will again halt, otherwise it will resume normal operation. 0rw 0 reset tx risc self-clearing bit which resets only the tx risc. 0 wo table 413: tx risc state fields (offset 0x5404) bit field description init access 31 blocking read a blocking data cache miss occurred, causing the tx risc to stall while data is fetched from external (to the tx risc) memory. this is intended as a debugging tool. no state is saved other than the fact that the miss occurred. 0w2c 30 ma request fifo overflow ma_req_fifo overflowed. the tx risc is halted on this condition. 0w2c 29 ma data/bytemask fifo overflow ma_datamask_fifo overflowed. the tx risc is halted on this condition. 0w2c 28 ma outstanding read fifo overflow ma_rd_fifo overflowed. the tx risc is halted on this condition. 0w2c 27 ma outstanding write fifo overflow ma_wr_fifo overflowed. the tx risc is halted on this condition. 0w2c 26-16 reserved always 0. 0 r/o table 412: tx risc mode register fields (offset 0x5400) (cont.) bit field description init access www.datasheet.in programmer?s guide bcm57xx 01/29/08 broadcom corporation document 57xx-pg105-r tx risc registers page 489 tx risc p rogram c ounter (o ffset 0 x 541c) the program counter register can be used to read or write the current program counter of the each cpu. reads can occur at any time, however, writes can only be performed when the cpu is halted. writes will also clear any pending instruction in the decode stage of the pipeline. bits 31-2 are implemented. 1s written to bits 1-0 are ignored. 15 instruction fetch stall the processor is currently stalled due to an instruction fetch. 0r/o 14 data access stall the processor is currently stalled due to a data access. 0 r/o 13-11 reserved always 0. 0 r/o 10 tx risc halted the tx risc was explicitly halted via bit 10 in the tx risc mode register. 0r/o 9 register address trap a signal was received from the global resources block indicating that this processor, accessed a register location that triggered a software trap. the grc registers are used to configure register address trapping. 0w2c 8 memory address trap a signal was received from the memory arbiter indicating that some bcm5700 block, possibly this processor, accessed a memory location that triggered a software trap. the ma registers are used to configure memory address trapping. 0w2c 7 bad memory alignment load or store instruction was executed with the least significant two address bits not valid for the width of the operation (e.g., load word or load half-word from an odd byte address). 0w2c 6 invalid instruction fetch program counter (pc) is set to invalid location in processor address space. see ?memory maps and pool configuration? on page 171 for details about unmapped areas in the cpu address space. 0w2c 5 invalid data access data reference to illegal location. see ?memory maps and pool configuration? on page 171 for details about unmapped areas in the cpu address space. 0w2c 4 page 0 instruction reference when enabled in mode register, indicates the address in the pc is within the lower 256 bytes of sram. 0w2c 3 page 0 data reference when enabled in mode register, indicates data reference within lower 256 bytes of sram. 0w2c 2 invalid instruction invalid instruction fetched. 0 w2c 1 halt instruction executed a halt-type instruction was executed by the tx risc. 0 w2c 0 hardware breakpoint when enabled in mode register, indicates hardware breakpoint has been reached. 0w2c table 413: tx risc state fields (offset 0x5404) (cont.) bit field description init access www.datasheet.in bcm57xx programmer?s guide 01/29/08 broadcom corporation page 490 low-priority mailboxes document 57xx-pg105-r l ow -p riority m ailboxes this is a 512 byte region that contains 64 registers. these mailbox registers are: ? 64 bits for the bcm5700 mac and bcm5701 mac transceivers. ? 32 bits for the rest of the bcm57xx family. these registers are called low-priority mailbox registers (or low-priority mailboxes). when a value is stored in the least significant 32 bits of these registers, an event (known as a mailbox event) is generated to the one of the rx risc or tx risc. to write 64 bits of a mailbox location, the upper 32 bits should be written to before the lower 32 bits. in the bcm5702 and later devices, the upper 32 bits are not used. for compatibility across the bcm57xx family, access only the lower 32 bits. note: the low-priority mailbox registers are for indirect register access mode only. for host standard and flat access modes, access the mailboxes via the high-priority mailboxes (see ?high-priority mailboxes? on page 370 ). table 414: low-priority mailbox structure 31 15 0 init mailbox - - 0x00 not used in the bcm5702 mac transceiver and later. 0x04 table 415: low-priority mailbox registers offset registers 0x5800-0x5807 interrupt mailbox 0 0x5808-0x580f interrupt mailbox 1 0x5810-0x5817 interrupt mailbox 2 0x5818-0x581f interrupt mailbox 3 0x5820-0x5827 general mailbox 1 0x5828-0x582f general mailbox 2 0x5830-0x5837 general mailbox 3 0x5838-0x583f general mailbox 4 0x5840-0x5847 general mailbox 5 0x5848-0x584f general mailbox 6 0x5850-0x5857 general mailbox 7 0x5858-0x585f general mailbox 8 0x5860-0x5867 reserved 0x5868-0x586f receive bd standard producer ring producer index 0x5870-0x5877 receive bd jumbo producer ring producer index 0x5878-0x587f receive bd mini producer ring producer index www.datasheet.in programmer?s guide bcm57xx 01/29/08 broadcom corporation document 57xx-pg105-r low-priority mailboxes page 491 0x5880-0x5487 receive bd return ring 1 consumer index 0x5888-0x588f receive bd return ring 2 consumer index 0x5890-0x5897 receive bd return ring 3 consumer index 0x5898-0x589f receive bd return ring 4 consumer index 0x58a0-0x58a7 receive bd return ring 5 consumer index 0x58a8-0x58af receive bd return ring 6 consumer index 0x58b0-0x58b7 receive bd return ring 7 consumer index 0x58b8-0x58bf receive bd return ring 8 consumer index 0x58c0-0x58c7 receive bd return ring 9 consumer index 0x58c8-0x58cf receive bd return ring 10 consumer index 0x58d0-0x58d7 receive bd return ring 11 consumer index 0x58d8-0x58df receive bd return ring 12 consumer index 0x58e0-0x58e7 receive bd return ring 13 consumer index 0x58e8-0x58ef receive bd return ring 14 consumer index 0x58f0-0x58f7 receive bd return ring 15 consumer index 0x58f8-0x58ff receive bd return ring 16 consumer index 0x5900-0x5907 send bd ring 1 host producer index 0x5908-0x590f send bd ring 2 host producer index 0x5910-0x5917 send bd ring 3 host producer index 0x5918-0x591f send bd ring 4 host producer index 0x5920-0x5927 send bd ring 5 host producer index 0x5928-0x592f send bd ring 6 host producer index 0x5930-0x5937 send bd ring 7 host producer index 0x5938-0x593f send bd ring 8 host producer index 0x5940-0x5947 send bd ring 9 host producer index 0x5948-0x594f send bd ring 10 host producer index 0x5950-0x5957 send bd ring 11 host producer index 0x5958-0x595f send bd ring 12 host producer index 0x5960-0x5967 send bd ring 13 host producer index 0x5968-0x596f send bd ring 14 host producer index 0x5970-0x5977 send bd ring 15 host producer index 0x5978-0x597f send bd ring 16 host producer index 0x5980-0x5987 send bd ring 1 nic producer index 0x5988-0x598f send bd ring 2 nic producer index 0x5990-0x5997 send bd ring 3 nic producer index 0x5998-0x599f send bd ring 4 nic producer index 0x59a0-0x59a7 send bd ring 5 nic producer index 0x59a8-0x59af send bd ring 6 nic producer index 0x59b0-0x59b7 send bd ring 7 nic producer index table 415: low-priority mailbox registers (cont.) offset registers www.datasheet.in bcm57xx programmer?s guide 01/29/08 broadcom corporation page 492 low-priority mailboxes document 57xx-pg105-r i nterrupt m ailbox 0 r egister (o ffset 0 x 5800) see ?interrupt mailbox 0 register (offset 0x200)? on page 372 . o ther i nterrupt m ailbox r egisters (o ffset 0 x 5808-0 x 5818) see ?other interrupt mailbox registers (offset 0x208-0x218)? on page 373 . g eneral m ailbox r egisters 1-8 (o ffset 0 x 5820-0 x 5858) see ?general mailbox registers 1-8 (offset 0x220-0x258)? on page 373 . r eceive bd s tandard p roducer r ing i ndex r egister (o ffset 0 x 5868) see ?receive bd standard producer ring index register (offset 0x268)? on page 373 . r eceive bd j umbo p roducer r ing i ndex r egister (o ffset 0 x 5870) see ?receive bd jumbo producer ring index register (offset 0x270)? on page 373 . r eceive bd m ini p roducer r ing i ndex r egister (o ffset 0 x 5878, bcm5700 and bcm5701 o nly ) see ?receive bd mini producer ring index register (offset 0x278)? on page 373 . r eceive bd r eturn r ing 1-16 c onsumer i ndices r egisters (o ffset 0 x 5880-0 x 58f8) see ?receive bd return ring 1-16 consumer indices registers (offset 0x280-0x2f8)? on page 373 . 0x59b8-0x59bf send bd ring 8 nic producer index 0x59c0-0x59c7 send bd ring 9 nic producer index 0x59c8-0x59cf send bd ring 10 nic producer index 0x59d0-0x59d7 send bd ring 11 nic producer index 0x59d8-0x59df send bd ring 12 nic producer index 0x59e0-0x59e7 send bd ring 13 nic producer index 0x59e8-0x59ef send bd ring 14 nic producer index 0x59f0-0x59f7 send bd ring 15 nic producer index 0x59f8-0x59ff send bd ring 16 nic producer index table 415: low-priority mailbox registers (cont.) offset registers www.datasheet.in programmer?s guide bcm57xx 01/29/08 broadcom corporation document 57xx-pg105-r low-priority mailboxes page 493 s end bd r ing 1-4 h ost p roducer i ndices r egisters (o ffset 0 x 5900-0 x 5918) see ?send bd ring 1-16 host producer indices registers (offset 0x300-0x378)? on page 374 . s end bd r ing 5-16 h ost p roducer i ndices r egisters (o ffset 0 x 5920-0 x 5978, bcm5700 and bcm5701 o nly ) see ?send bd ring 1-16 host producer indices registers (offset 0x300-0x378)? on page 374 . s end bd r ing 1-16 nic p roducer i ndices r egisters (o ffset 0 x 5980-0 x 59f8, bcm5700 and bcm5701 o nly ) see ?send bd ring 1-16 nic producer indices registers (offset 0x380-0x3f8)? on page 374 . www.datasheet.in bcm57xx programmer?s guide 01/29/08 broadcom corporation page 494 flow-through queues document 57xx-pg105-r f low -t hrough q ueues ftq r eset r egister (o ffset 0 x 5c00) table 416: flow-through queues registers offset registers 0x5c00-0xc403 ftq reset register 0x5c04-0x5cb7 reserved 0x5cb8-0x5cbb mac tx fifo enqueue register 0x5cbc-0x5cc7 reserved 0x5cc8-0x5ccb rxmbuf cluster free enqueue register 0x5ccc-0x5cfb reserved 0x5cfc-0x5cff rdiq ftq write/peek register table 417: ftq reset register (offset 0x5c00) bit field descriptions init access 31-18 reserved - 0 r/w 17 reserved (bcm5705, bcm5788, bcm5721, bcm5751, bcm5752, bcm5714, and bcm5715 only) -0r/w reset type 2 software queue (other devices) set this bit to reset the type 2 software queue. when set to 0, this flow through queue is ready to use. this bit is self-clearing. r/w 16 reset receive data completion ftq set this bit to reset the receive data completion flow through queue. when set to 0, this flow through queue is ready for use. this bit is self-clearing. r/w 15 reserved(bcm5705, bcm5788, bcm5721, bcm5751, bcm5752, bcm5714, and bcm5715 only) -0r/w reset receive data and receive bd initiator ftq (other devices) set this bit to reset the receive data and receive bd initiator flow through queue. when set to 0, this flow through queue is ready to use. r/w 14 reset receive list placement ftq set this bit to reset the receive list. this bit is self- clearing placement flow through queue. when set to 0, this flow through queue is ready to use. this bit is self- clearing. r/w 13 reset receive bd complete ftq set this bit to reset the receive bd complete flow through queue. when set to 0, this flow through queue is ready for use. this bit is self-clearing. r/w www.datasheet.in programmer?s guide bcm57xx 01/29/08 broadcom corporation document 57xx-pg105-r flow-through queues page 495 12 reserved (bcm5705, bcm5788, bcm5721, bcm5751, bcm5752, bcm5714, and bcm5715 only) -0r/w reset mbuf cluster free ftq (other devices) set this bit to reset the mbuf cluster free flow through queue. when set to 0, this flow through queue is ready for use. this bit is self-clearing. r/w 11 reset mac tx ftq set this bit to reset the mac tx flow through queue. when set to 0, this flow through queue is ready for use. this bit is self-clearing. r/w 10 reset host coalescing ftq set this bit to reset the host coalescing flow through queue. when set to 0, this flow through queue is ready for use. this bit is self-clearing. r/w 9 reset send data completion ftq set this bit to reset the send data completion flow through queue. when set to 0, this flow through queue is ready for use. this bit is self-clearing. r/w 8 reserved (bcm5705, bcm5788, bcm5721, bcm5751, bcm5752, bcm5714, and bcm5715 only) -0r/w reset type 1 software ftq (other devices) set this bit to reset the type 1 software flow through queue. when set to 0, this flow through queue is ready for use. this bit is self-clearing. r/w 7 reset dma high priority write ftq set this bit to reset the dma high priority write flow through queue. when set to 0, this flow through queue is ready for use. this bit is self-clearing. r/w 6 reset dma write ftq set this bit to reset the dma write flow through queue. when set to 0, this flow through queue is ready for use. this bit is self-clearing. r/w 5 reserved (bcm5705, bcm5788, bcm5721, bcm5751, bcm5752, bcm5714, and bcm5715 only) -0r/w reset send data initiator ftq (other devices) set this bit to reset the send data initiator flow through queue. when set to 0, this flow through queue is ready for use. this bit is self-clearing. r/w 4 reset send bd completion ftq set this bit to reset the send bd completion flow through queue. when set to 0, this flow through queue is ready for use. this bit is self-clearing. r/w 3 reserved (bcm5705, bcm5788, bcm5721, bcm5751, bcm5752, bcm5714, and bcm5715 only) -0r/w reset dma completion discard ftq (other devices) set this bit to reset the dma completion discard flow through queue. when set to 0, this flow through queue is ready for use. this bit is self-clearing. r/w table 417: ftq reset register (offset 0x5c00) (cont.) bit field descriptions init access www.datasheet.in bcm57xx programmer?s guide 01/29/08 broadcom corporation page 496 flow-through queues document 57xx-pg105-r mac tx fifo e nqueue r egister (o ffset 0 x 5cb8) this register is applicable to bcm5705, bcm5788, bcm5721, bcm5751, bcm5752, bcm5714, and bcm5715 only. a write to this register will add a transmit packet to the tail of the mactq ftq. the host cpu uses this register to send an asf message out. since the size of txmbuf fifo is only 64 entries and mactq is 12 bits wide: ? bits 21:16 from this register are mapped to bits 11:6 of the mactq ftq. ? bits 5:0 from this register are mapped to bits 5:0 of the mactq ftq. ? bits 31:22 and 15:6 are ignored. the txmbuf cluster for the asf message is defaulted to the uppermost three txmbufs. rxmbuf c luster f ree e nqueue r egister (o ffset 0 x 5cc8) this register is applicable to bcm5705, bcm5788, bcm5721, bcm5751, bcm5752, bcm5714, and bcm5715 only. a write to this register will free a cluster of rxmbufs. the host cpu uses this register to deallocate rxmbufs after it has processed the received asf message. 2 reset dma high priority read ftq set this bit to reset the dma high priority read flow through queue. when set to 0, this flow through queue is ready for use. this bit is self-clearing. r/w 1 reset dma read queue ftq set this bit to reset the dma read queue flow through queue. when set to 0, this flow through queue is ready for use. this bit is self-clearing. r/w 0 reserved - r/w table 418: mac tx fifo enqueue register (offset 0x5cb8) bit field description init access 31-16 head txmbuf pointer specifies the first mbuf of the txmbuf cluster for the transmit packet. 0x003d w/o 15-0 tail txmbuf pointer specifies the last mbuf of the txmbuf cluster for the transmit packet. 0x003f w/o table 419: rxmbuf cluster free enqueue register (offset 0x5cc8) bit field description init access 31-18 reserved - 0x0 w/o 17-9 head rxmbuf pointer specifies the first mbuf of the rxmbuf cluster for the received packet to be freed. 0x00 w/o 8-0 tail rxmbuf pointer specifies the last mbuf of the rxmbuf cluster for the received packet to be freed. 0x00 w/o table 417: ftq reset register (offset 0x5c00) (cont.) bit field descriptions init access www.datasheet.in programmer?s guide bcm57xx 01/29/08 broadcom corporation document 57xx-pg105-r flow-through queues page 497 rdiq ftq w rite /p eek r egister (o ffset 0 x 5cfc) this register is applicable to bcm5705, bcm5788, bcm5721, bcm5751, bcm5752, bcm5714, and bcm5715 only. the host cpu uses this register to get the rxmbuf cluster pointers if the received packet requires the attention of the cpu. this could be an asf or acpi packet. ? a write to this register will modify the head of the rdiq ftq entry. ? a read of this register will peek at the head of the rdiq ftq entry. ? when the valid bit is 1 and the pass bit is 0, the cpu can take the rxmbuf cluster pointers to access the received packet (see table 421 ). ? when the cpu writes a 1 to the skip bit, the hardware will pop the head of the queue entry (see table 421 ). table 421 shows the functional truth table for the combination of the valid, skip, and pass bits. table 420: rdiq ftq write/peek register (offset 0x5cfc) bit field description init access 31-21 reserved - 000000000 00 r/o 20 valid bit set only if the head of the rdiq entry is valid (i.e., the queue is non-empty). see table 421 . 0r/w 19 skip bit if this bit is set, the head of the rdiq entry will be popped. the read pointer will be incremented. see table 421 . 0r/w 18 pass bit this bit is 0 if the rdiq head entry is intended for the cpu. it prevents the entry to be serviced by wdma. see table 421 . 0r/w 17-9 head rxmbuf pointer specifies the first mbuf of the rxmbuf cluster for the received packet. 000000000 r/o 8-0 tail rxmbuf pointer it specifies the last mbuf of the rxmbuf cluster for the received packet. 000000000 r/o table 421: functional truth table for the combination of the valid, skip, and pass bits valid skip pass scenario 0 x x head entry invalid. 100waiting for cpu to peek the head entry. 101waiting for wdma to process the head entry. 110cpu has finished peeking the head entry, the head of rdiq will be popped in the next cycle. 111entry will be popped the next cycle. the wdma might or might not have latched the head entry. (not recommended). www.datasheet.in bcm57xx programmer?s guide 01/29/08 broadcom corporation page 498 message signaled interrupt registers document 57xx-pg105-r m essage s ignaled i nterrupt r egisters msi m ode r egister (o ffset 0 x 6000) table 422: message signaled registers offset registers 0x6000-0x6003 msi mode register 0x6004-0x6007 msi status register 0x6008-0x600b msi fifo access register 0x600c-0x63ff reserved table 423: msi mode register (offset 0x6000) bit field description init access 31-30 reserved (bcm5700 and bcm5701 only) -0r/o priority (other devices) sets the priority of the msi engine relative to the dma read engine and dma write engine. equal settings result in fair round robin arbitration. ? 00: lowest ? 01: low ? 10: high ? 11: highest 00 r/w 29-11 reserved - 0 r/o 10-8 msi_message (applicable to bcm5752 only) this register sets the msi message data bottom bits to the value programmed here. this register exists only for testing purposes and should always be programmed to zero. 000 r/w reserved (other devices) - 000 r/w 7 reserved - 0 r/o 6 msi fifo overrun attn (not applicable to bcm5752) msi fifo overrun attention enable. 0 r/w 5 msi fifo underrun attn (not applicable to bcm5752) msi fifo underrun attention enable. 0 r/w 4 pci parity error attn pci parity error attention enable. 0 r/w 3 pci master abort attn pci master abort attention enable. 0 r/w 2 pci target abort attn pci target abort attention enable. 0 r/w 1 enable this bit controls whether the msi state machine is active or not. when set to 0, it completes the current operation and cleanly halts. until it is completely halted, it remains one when read. 1r/w 0 reset when this bit is set to 1, the msi state machine is reset. this is a self-clearing bit. 0r/w www.datasheet.in programmer?s guide bcm57xx 01/29/08 broadcom corporation document 57xx-pg105-r message signaled interrupt registers page 499 msi s tatus r egister (o ffset 0 x 6004) msi fifo a ccess r egister (o ffset 0 x 6008) this register is not applicable to bcm5752. the msi fifo access register is used to give an msi request to the pci block. the actual msi data is indicated in the bottom bits. if the msi is properly enqueued into the fifo, the overflow bit remains cleared. if the fifo overflowed, the bit is set and must be written to be cleared. if the overflow bit is set when the access register is written, no msi is enqueued. table 424: msi status register (offset 0x6004) bit field description init access 31-7 reserved - 0 r/o 6 msi fifo overrun (not applicable to bcm5752) msi fifo overrun status 0 w2c 5 msi fifo underrun (not applicable to bcm5752) msi fifo underrun status 0 w2c 4 pci parity error pci parity error status 0 w2c 3 pci master abort pci master abort status 0 w2c 2 pci target abort pci target abort status 0 w2c 1 reserved - 0 r/o 0 msi_pci_req (applicable to bcm5752 only) reading this bit returns the current status of the request to pci to send an msi. if a value of 1 is read, then the request is currently asserted. writing this bit with a value of one will cause the request to be asserted. writing this bit with a value of 0 has no effect. 0r/w reserved (other devices) - 0 r/o table 425: msi fifo access register (offset 0x6008) bit field description init access 31-4 reserved always 0. 0 r/o 3 overflow no space left in fifo. 0 w2c 2-0 msi data indicates which of the (up to eight) msis to use. 0 w/o www.datasheet.in bcm57xx programmer?s guide 01/29/08 broadcom corporation page 500 dma completion registers document 57xx-pg105-r dma c ompletion r egisters dma c ompletion m ode r egister (o ffset 0 x 6400) table 426: dma completion registers offset registers 0x6400-0x6403 dma completion mode register 0x6404-0x67ff reserved table 427: msi fifo access register (offset 0x6400) bit field description init access 31-2 reserved - 0 r/o 1 enable this bit controls whether the dma completion state machine is active or not. when set to 0, it completes the current operation and cleanly halts. until it is completely halted, it remains one when read. r/w 0 reset when this bit is set to 1, the dma completion state machine is reset. this is a self-clearing bit. r/w www.datasheet.in programmer?s guide bcm57xx 01/29/08 broadcom corporation document 57xx-pg105-r general control registers page 501 g eneral c ontrol r egisters table 428: general control registers field description 0x6800-0x6803 mode control register 0x6804-0x6807 misc configuration register 0x6808-0x680b misc local control register 0x680c-0x680f timer register 0x6810-0x6813 rx-risc event register 0x6814-0x6817 rx-risc timer reference register 0x6818-0x681b rx-risc semaphore register 0x681c-0x681f remote rx-risc attention register 0x6820-0x6823 tx-risc event register 0x6824-0x6827 tx-risc timer reference register 0x6828-0x682b tx-risc semaphore register 0x682c-0x682f remote tx-risc attention register 0x6830-0x6837 memory power up register 0x6838-0x683b serial eeprom address register 0x683c-0x683f serial eeprom data register 0x6840-0x6843 serial eeprom control register 0x6844-0x6847 mdi control register 0x6848-0x684b serial eeprom delay register 0x684c-0x684f rx cpu event enable register (offset 0x684c, bcm5705, bcm5788, bcm5721, bcm5751, bcm5752, bcm5714, and bcm5715 only) 0x6850-0x68ff reserved www.datasheet.in bcm57xx programmer?s guide 01/29/08 broadcom corporation page 502 general control registers document 57xx-pg105-r m ode c ontrol r egister (o ffset 0 x 6800) table 429: mode control register (offset 0x6800) bit field description init access 31 reserved - 0 r/o 30 reserved (bcm5705, bcm5788, bcm5721, bcm5751, bcm5752, bcm5714, and bcm5715 only) -0r/o route multicast frames to risc cores (other devices) forward multicast frames to rx and tx risc processors. this bit should only be used with custom firmware. 0r/w 29 reserved (bcm5705, bcm5788, bcm5721, bcm5751, bcm5752, bcm5714, and bcm5715 only) -0r/o 4x size nic-based send rings (other devices) indicates that four nic send rings are combined to create a single ring that are four times larger than normal (512 entries vs. 128 entries). only valid if the host send bds bit is not set. 0r/w 28 interrupt on flow attention cause a host interrupt when an enabled flow attention occurs. 0r/w 27 interrupt on dma attention cause a host interrupt when an enabled dma attention occurs. 0r/w 26 interrupt on mac attention cause a host interrupt when an enabled mac attention occurs. 0r/w 25 interrupt on rx risc attention cause a host interrupt when an enabled rx risc attention occurs. 0r/w 24 reserved (bcm5705, bcm5788, bcm5721, bcm5751, bcm5752, bcm5714, and bcm5715 only) -0r/o interrupt on tx risc attention (other devices) cause a host interrupt when an enabled tx risc attention occurs. 0r/w 23 receive no pseudo- header checksum do not include the pseudoheader in the tcp or udp checksum calculations. to obtain the correct checksum, the driver must add the tcp/udp checksum field to the pseudo- header checksum. 0r/w 22 reserved 0r/o 21 nvram write enable (bcm5705, bcm5788, bcm5721, bcm5751, bcm5752, bcm5714, and bcm5715 only) the host must set this bit before attempting to update the flash or seeprom (valid for BCM5703 b0 or later, bcm5704 a2 or later, bcm5705 a1 or later, bcm5721, and bcm5751. see ?revision levels? on page 5 .) 0r/w reserved (other devices) - 0 r/o www.datasheet.in programmer?s guide bcm57xx 01/29/08 broadcom corporation document 57xx-pg105-r general control registers page 503 20 send no pseudo-header checksum do not include the pseudoheader in the tcp or udp checksum calculations. to obtain the correct checksum, the driver must seed the tcp/udp checksum field with the pseudoheader checksum. note: some bcm57xx family adapters may calculate an incorrect pseudoheader checksum if this bit is left at the default value. check the latest chip errata for affected chips and suggested workarounds. 0r/w 19-18 reserved - 00 17 host send bds use host-based bd rings instead of nic-based bd rings. 0 r/w 16 host stack up the host stack is ready to receive data from the nic. 0 r/w 15 force 32-bit pci force pci operation as if on a 32-bit pci bus. 0 r/w 14 don?t interrupt on receives never cause an interrupt on receive return ring producer updates. 0r/w 13 don?t interrupt on sends never cause an interrupt on send bd ring producer updates. 0 r/w 12 reserved - 0 11 allow bad frames the rx mac forwards illegal frames to the nic and marks them as such instead of discarding them. the frames are queued based on default class and interrupt distribution queue number as specified in ?receive list placement configuration register (offset 0x2010)? on page 431 ). 0r/w 10 reserved - 0 9 no frame cracking turn off all frame cracking functionality in both the read dma engine and the mac receive engine. on receive, the tcp/ udp checksum field is replaced by raw checksum for the whole frame except the ethernet header. on transmit, ip and tcp/udp checksum generation is always disabled when this bit is set. also, the raw checksum is calculated over the entire frame except the ethernet header and crc. 0r/w 8reserved - 0 r/o 7-6 grc_timeout_cycles (bcm5714c/bcm5714s/ bcm5715c/bcm5715s a2 and later devices only) ? 00: grc will timeout after 64k cycles ? 01: grc will timeout after 48k cycles ? 10: grc will timeout after 32k cycles ? 11: grc will timeout after 16k cycles 0r/w reserved (all other devices) -0r/0 5 word swap data word swap data when dmaing it across the pci bus. 0 r/w 4 byte swap data byte swap data when dmaing it across the pci bus. 0 r/w 3reserved - 0 r/o 2 word swap non-frame data word swap control structures (buffer descriptors, statistics) and data when dmaing them across the pci bus. 0r/w 1 byte swap non-frame data byte swap control structures (buffer descriptors, statistics) when dmaing them across the pci bus. 0r/w table 429: mode control register (offset 0x6800) (cont.) bit field description init access www.datasheet.in bcm57xx programmer?s guide 01/29/08 broadcom corporation page 504 general control registers document 57xx-pg105-r m iscellaneous c onfiguration r egister (o ffset 0 x 6804) the miscellaneous configuration register is used as an extension to the miscellaneous local control register (see ?miscellaneous local control register (offset 0x6808)? on page 507 ). there are several fields used to control several small counters associated with the free-running 32-bit timer inside the device. the prescale function is performed on the clock prior to advancing the timer register (see ?timer register (offset 0x680c)? on page 510 ) to provide a resolution as close as possible to 1 s. 0 reserved (bcm5705, bcm5788, bcm5721, bcm5751, bcm5752, bcm5714, and bcm5715 only) -0r/o update on coalescing only (other devices) when this bit is set, the nic will only generate interrupts for transmit completions when the send coalesced ticks value is exceeded. send consumer updates are still made based on the send max coalesced bds and the bd_flag_coal_now. 0r/w table 430: miscellaneous configuration register (offset 0x6804) bit field description init access 31 alternate clock enable (applicable to only a2 and later versions of bcm5704 device) the output of this bit is ored with the alternate clock control field of the pci clock control register (see table 179 on page 336 ). when this bit is: ? set, core clk = 12.5 mhz and cpu_clk = 25 mhz ? clear, core clk = 66 mhz and cpu_clk = 133 mhz 0 in full power mode, 1 in oob mode r/w 30 reserved 0r/o 29 disable grc reset on pcie block (for bcm5721?a1 and later, bcm5751?a1 and later, bcm5714?a1 and later, and bcm5715? a1 and later only) setting this bit will prevent pcie link training during a grc reset. 0r/w 29 reserved (other devices) - 0 r/o 28 wire speed enable (bcm5721, bcm5751, and bcm5752 only) when this bit is set, wire speed detection is enabled. 1 r/w id_in[5] (bcm5714 and bcm5715 only) status of id bit 5. 0 r/o reserved (other devices) - 0 r/o 27 wire speed timer disable (bcm5721, bcm5751, and bcm5752 only) when this bit is set, the wire speed timer is disabled. 0 r/w id_in[4] (bcm5714 and bcm5715 only) status of id bit 4. 0 r/o reserved 9other devices) - 0 r/o table 429: mode control register (offset 0x6800) (cont.) bit field description init access www.datasheet.in programmer?s guide bcm57xx 01/29/08 broadcom corporation document 57xx-pg105-r general control registers page 505 26 gphy power down override (bcm5705, bcm5788, bcm5721, bcm5751, bcm5752, bcm5714, and bcm5715 only) when this bit is set, the gphy will be left powered up when in the d0 uninitialized state. ? in a1, this bit can only be cleared by a hard reset. a grc or pci reset has no effect. ? in a0, this bit can be cleared by hard-reset, grc reset, or pci reset. note: see ?revision levels? on page 5 . 0r/w reserved - 0 r/o 25 ddq_dll enable disable (bcm5705, bcm5788, bcm5721, bcm5751, bcm5752, bcm5714, and bcm5715 only) when this bit is set, the handshake with the gphy to power down the dll is disabled. the iddq_dll_enable will always be 1. 0r/w revision id (bcm5704 only) when this bit is: set, the bcm5704 is revision a2 or a3 clear, the bcm5704 is revision a0, a1, or b0 xr/o reserved (other devices) - 0 r/o 24 ram power down (bcm5705, bcm5788, bcm5721, bcm5751, bcm5752, bcm5714, and bcm5715 only) when this bit is set, all of the rams are powered down. 0 r/w reserved (other devices) - 0 r/o 23 vreg standby current mode (bcm5705, bcm5788, bcm5721, bcm5751, bcm5752, bcm5714, and bcm5715 only) when this bit is set, both vreg1 and vreg2 will be put into standby current mode (which consumes < 1 ma). 0r/w asf strap (serverworks ciob-e a1 or later only) this bit reflects the value of the asf strapping option on the serverworks ciob-e, which has an integrated bcm5704. when this bit is: set, the pci function 0 controls the asf interface clear, the pci function 1 controls the asf interface xr/o reserved (other devices) - 0 r/o 22 bias iddq (bcm5705, bcm5788, bcm5721, bcm5751, bcm5752, bcm5714, and bcm5715 only) when this bit is set, the bias will be powered down. 0 r/w module id (bcm5704 a1 and later only) this bit returns 0 for pci function 0, and 1 for pci function 1. xr/o reserved (other devices) - 0 r/o table 430: miscellaneous configuration register (offset 0x6804) (cont.) bit field description init access www.datasheet.in bcm57xx programmer?s guide 01/29/08 broadcom corporation page 506 general control registers document 57xx-pg105-r 21 gphy iddq (bcm5705, bcm5788, bcm5721, bcm5751, bcm5752, bcm5714, and bcm5715 only) when this bit is set, the gphy will be powered down. 0 r/w pci power present (bcm5704 a1 and later only) when this bit is set, pci power is present. x r/o reserved (other devices) - 0 r/o 20 powerdown (bcm5704c and bcm5704s only) write 1 to power down the device. this bit is provided for the internal cpus. 0r/w device power down (bcm5705, bcm5788, bcm5721, bcm5751, bcm5752, bcm5714, and bcm5715 only) setting this bit will power down the device (power consumption is ~20 mw). this bit is cleared by pci reset. 0r/w reserved (other devices) - 0 r/o 19 vio power state (bcm5702, BCM5703c, and BCM5703s only) vio is the pci bus power 0 r/o pme en state (bcm5704c and bcm5704s only) state of pme enable for this device. 1 r/o reserved (other devices) - 0 r/o 18- 17 powerstate (bcm5704c and bcm5704s only) indicates the current power state of the device. ? 00b: d0 ? 01b: d1 ? 02b: d2 ? 03b: d3 this powerstate mirrors the pmscr register (see ?power management control/status register (offset 0x4c)? on page 318 ) power state bits and is read only to provide the internal cpus with the current power state. 00 r/o reserved - 00 r/o 16? 13 bond id (bcm5714, bcm5715, bcm5721, bcm5751, and bcm5752 only) for the: ? bcm5714 device: - 0010b = bcm5714c - 0011b = bcm5714s ? bcm5715 device: - 0110b = bcm5715c - 0111b = bcm5715s ? bcm5751 device: - 0000b = bcm5751 - 0100b = bcm5751m ? bcm5721 device, 0010b = bcm5721 ? bcm5752 device: - 0000b = bcm5752 - 0100b = bcm5752m id(3:0) r/o table 430: miscellaneous configuration register (offset 0x6804) (cont.) bit field description init access www.datasheet.in programmer?s guide bcm57xx 01/29/08 broadcom corporation document 57xx-pg105-r general control registers page 507 m iscellaneous l ocal c ontrol r egister (o ffset 0 x 6808) the miscellaneous local control register is used to control various functions within the device. all bits are set to zero (i.e. disabled) during reset. 14 bond id 1 (bcm5704 only) this bit reads as 1 for the serverworks ciob-e, and 0 for the bcm5704. xr/o 13-8 reserved - 00 r/o 7-1 timer prescaler local core clock frequency in mhz, minus 1, which should correspond to each advance of the timer. reset to all 1. example: a 66-mhz local core clock uses 65 (0x41). 1111111 r/w 0 core clock blocks reset 1 write 1 to this bit resets the core_clk blocks in the device. this is a self-clearing bit. 0r/w 1. pcie configuration cycles are non-posted transactions and require a completion to avoid a pcie bus error. drivers using configuration cycles to do a grc reset on 5751, 5721, and 5752 need to give the device enough time to send out the configuration write completion before the pcie link goes down. the driver should slow the clock down by setting bits 20 (not 19) and 12 in register 0x74 before issuing configuration cycles for a grc reset (bit 0 of register 0x6804) or setting the pwrdown bit (0x6804 bit 20). this is not required for the bcm5751, bcm5721, and bcm5752 devices with version a1 or later if pcie reset is disabled during the grc reset by setting the bit 29 of this register (0x6804) to 1. table 431: miscellaneous local control register (offset 0x6808) bit field description init access 31 enable wolink up (bcm5721 b0 and later, bcm5751 b0 and later, and bcm5752 only) when set, the chip drives the pme when the link is up. 0 r/w grc alt clock enable (bcm5704, bcm5714, and bcm5715 only) write a 1 to this bit to enable alternate clock mode. this bit is used by firmware in v-aux mode to put the chip into low-power mode. 0r/w reserved (other devices) 0 r/o 30 enable wolink down (bcm5721 b0 and later, bcm5751 b0 and later, and bcm5752 only) when set, the chip drives the pme when the link is down. 0 r/w grc alt clock select (bcm5714 a1 & later and bcm5715 a1 & later only) write a 1 to this bit to increase the cpu/core clock speed to normal speed. this bit is valid only in v-aux mode (when 0x6804[19] = 0). 0r/w reserved (other devices) 0 r/o 29 disable traffic led fix set to 1 to disable traffic led fix 0 r/w reserved - 0 r/o 28 select pci configuration (bcm5721, bcm5751, and bcm5752 only) when this bit is set, the pci mode will be controlled by bit 27. 0 r/w ext_ump_id (bcm5714 and bcm5715 only) this value is based on the strap option of pwr indicator pin. 0 r/o reserved (other devices) - 0 r/o table 430: miscellaneous configuration register (offset 0x6804) (cont.) bit field description init access www.datasheet.in bcm57xx programmer?s guide 01/29/08 broadcom corporation page 508 general control registers document 57xx-pg105-r 27 legacy pci mode select when this bit is set, the device will operate in pci legacy mode. 0 r/w int_ump_id (bcm5714 and bcm5715 only) for nic function 0, this bit will be 0 for nic function 1, this bit will be 1. 0r/o 26 reserved (bcm5700 and bcm5701 only) -0r/o pme assert (all other devices) when set, the pme status bit in the pmscr register (see ?power management control/status register (offset 0x4c)? on page 318 ) is forced high. if pme enable is also set, the pme signal will activate. this register bit is write-only and self- clearing after write. 0r/o 25 expansion rom code to mbuf3 (bcm5700, bcm5701, bcm5702, BCM5703, and bcm5704 only) set this bit to enable download of expansion rom into mbuf3. this bit must be reset if mbuf3 is used for packet buffering. 0r/w reserved (other devices) - 0 r/o 24 auto seeprom access if set, access to serial eeprom goes through the serial eeprom address and data registers. otherwise, serial eeprom control register should be used. 0r/w 23 reserved (all other devices) - 0 r/o ssram cycle deselect (bcm5700 only) if set, double cycles deselect is used. otherwise, single cycle deselect is used. 0r/w 22 ssram type (bcm5700 only) if set, zbt ssram is in use. otherwise, standard ssram is in use. 0r/w reserved (all other devices) 0 r/o 21 bank select (bcm5700 only) if reset, two banks of ssram installed. otherwise, only one bank of ssram is installed. 0r/w reserved (all other devices) 0 r/o 20-18 sram size (bcm5700 only) ? 000 = 256 kb ? 001 = 512 kb ? 010 = 1 mb ? 011 = 2 mb ? 100 = 4 mb ? 101 = 8 mb ? 110 = 16 mb ? 111 = reserved 000 r/w reserved (all other devices) ? 000 r/o 17 enable external memory (bcm5700 only) set to 1 if external memory is in use. 0 r/w reserved (all other devices) 0 r/o 16-14 gpio pins [2:0] outputs outputs which are defined by board level design. 0 r/w 13-11 gpio pins [2:0] output enables when asserted, the device drives miscellaneous pin outputs. 0 r/w 10-8 gpio pins [2:0] inputs input from bidirectional miscellaneous pin. 0 r/o table 431: miscellaneous local control register (offset 0x6808) (cont.) bit field description init access www.datasheet.in programmer?s guide bcm57xx 01/29/08 broadcom corporation document 57xx-pg105-r general control registers page 509 7 global interrupt enable (bcm5705, bcm5788, bcm5721, bcm5751, bcm5714, and bcm5715 only) when this bit is set, the interrupt to the cpu is enabled. 0 r/w gpio 3 output (applicable to bcm5752 only) gpio 3 output value 0 r/w reserved (other devices) - 0 r/o 6 gpio 3 output enable (applicable to bcm5752 only) when set to 1, the gpio 3 pin will be enabled as output pin. 0 r/w gpio2_gate_20us (bcm5714c/bcm5714s/ bcm5715c/bcm5715s a2 and later devices only) ? 0: behavior as in a1. ? 1: gpio2 output cannot drive low until perst_b has been active for 20us. 0r/w reserved (other devices) 0 r/o 5 gpio 3 input value (applicable to bcm5752 only) input value on gpio 3 0 r/o sigdet_ctrl (bcm5714s/ bcm5715s a2 and later devices only) ? 0: sigdet signal that feeds serdes link is from internal serdes block. ? 1: sigdet signal that feeds serdes link is from external sigdet pin 0r/w reserved (other devices) 0 r/o 4 linksignal_gate (bcm5714s/bcm5715s a2 and later devices only) ? 0: behavior as in a1 ? 1: link signal is gated by sigdet signal 0r/w reserved (other devices) 0 r/0 3 interrupt on attention if set, the host will be interrupted when any of the attention bits in the cpu event register are asserted. 0r/w 2 set interrupt if interrupt mailbox 0 contains a nonzero value, setting this bit does nothing. if interrupt mailbox 0 is zero, then setting this bit will cause the internal unmasked interrupt state to be asserted. the external interrupt state (inta pin) will also be asserted immediately if interrupts are not masked by the mask interrupts bit. if interrupts are masked, inta will be asserted once interrupts are unmasked, so long as interrupts are not first cleared. this bit is not operational in msi mode. 0w/o 1 clear interrupt this bit provides the same functionality as the clear interrupt bit in the miscellaneous host control register. this bit is not operational in msi mode 0w/o 0 interrupt state this bit reflects the state of the pci inta pin. this bit is not operational in msi mode. 0r/o note: the gpio pins of the bcm5704 are shared between both pci functions of the device. users writing their own drivers should ensure that the gpio is not simultaneously enabled for input on one function and output on another function, as the results are unpredictable. table 431: miscellaneous local control register (offset 0x6808) (cont.) bit field description init access www.datasheet.in bcm57xx programmer?s guide 01/29/08 broadcom corporation page 510 general control registers document 57xx-pg105-r t imer r egister (o ffset 0 x 680c) the timer register is a 32-bit free-running counter. this counter increments when the prescale counter hits the timer prescaler limit as specified by the miscellaneous configuration register (see ?miscellaneous configuration register (offset 0x6804)? on page 504 ). this counter is used by the cpu to keep track of relative time in microseconds. a write to the timer register will load the counter value written. rx-risc e vent r egister (o ffset 0 x 6810) the rx-risc uses the following event register. software events are set by writing a one to the bit. the software event, timer event, and tx-risc event are reset by writing a zero to the bit. other events are based on hardware events and cannot be affected directly by the risc processor. table 432: timer register (offset 0x680c) bit field description init access 31-0 timer value 32-bit free-running counter. 0 r/w table 433: rx-risc event register (offset 0x6810) bit field description init access 31 sw event 13 sw event 13 is set. 0 r/w 30 sw event 12 sw event 12 is set. 0 r/w 29 timer timer reference reached. 0 r/w 28 sw event 11 sw event 11 is set. 0 r/w 27 flow attn flow attention. 0 r/o 26 rx-cpu attn rx-risc needs attention. 0 r/w 25 mac attn mac needs attention. 0 r/o 24 tx-cpu attn tx-risc needs attention. 0 r/o 23 sw event 10 sw event 10 is set. 0 r/w 22 high-priority mailbox first 32 mailbox registers have been updated. 0 r/o 21 low-priority mailbox last 32 mailbox registers have been updated. 0 r/o 20 dma attn a dma channel needs attention. 0 r/o 19 sw event 9 sw event 9 is set. 0 r/w 18 high dma rd (other devices) high priority dma read ftq has stalled. 0 r/o ump_tx_rdv_evnt (bcm5714 and bcm5715 only) ump receive block has frame to process. 0 r/w 17 high dma wr (all other devices) high priority dma write ftq has stalled. 0 r/o ump_tx_rdv_evnt (bcm5714 and bcm5715 only) ump transmit block can accept frame. 0 r/w 16 sw event 8 sw event 8 is set. 0 r/w 15 host coalescing the host coalescing ftq has stalled. 0 r/o 14 sw event 7 sw event 7 is set. 0 r/w www.datasheet.in programmer?s guide bcm57xx 01/29/08 broadcom corporation document 57xx-pg105-r general control registers page 511 rx-risc t imer r eference r egister (o ffset 0 x 6814) the timer reference register allows the rx-risc to receive an event when the free-running timer register counts up to this value. rx-risc s emaphore r egister (o ffset 0 x 6818) the rx-risc semaphore register allows access to both internal risc processors to a hardware semaphore mechanism. writes to the register indicates the preference to toggle the own/not own states of a single semaphore bit. reads of this register provide a 1 if that register owns the semaphore, and a 0 otherwise. to obtain the semaphore, the normal operation is a loop containing a write 0 followed by a read. exit the loop when the read returns nonzero. to release the semaphore, the normal operation is to write 0. 13 recv data comp (post dma) receive data completion ftq has stalled. 0 r/o 12 sw event 6 sw event 6 is set. 0 r/w 11 rx sw queue event receive software queue event. 0 r/w 10 dma rd normal priority dma read ftq has stalled. 0 r/o 9 dma wr normal priority dma write ftq has stalled. 0 r/o 8 recv data init (pre dma) receive data and receive bd initiator ftq has stalled. 0 r/o 7 sw event 5 sw event 5 is set. 0 r/w 6 recv bd comp receive bd completion ftq has stalled. 0 r/o 5 sw event 4 sw event 4 is set. 0 r/w 4 recv list selector recv list selector is nonzero. 0 r/o 3 sw event 3 sw event 3 is set. 0 r/w 2 recv list placement (other devices) receive list placement ftq has stalled. 0 r/o ump_parity_evnt (bcm5714 and bcm5715 only) ump memory has detected parity error. 0 r/w 1 sw event 1 sw event 1 is set. 0 r/w 0 sw event 0 sw event 0 is set. 0 r/w table 434: rx-risc timer reference register (offset 0x6814) bit field description init access 31-0 rx-cpu timer reference rx-risc timer event when time stamp = rx-risc timer reference. reset to all 1. 0r/w table 435: rx-risc semaphore register (offset 0x6818) bit field description init access 31-1 reserved - 0 r/o 0 rx-cpu semaphore bit - 0 r/w table 433: rx-risc event register (offset 0x6810) (cont.) bit field description init access www.datasheet.in bcm57xx programmer?s guide 01/29/08 broadcom corporation page 512 general control registers document 57xx-pg105-r r emote rx-risc a ttention r egister (o ffset 0 x 681c) rx-risc uses this register to set an event for the tx-risc. reading this register returns a zero. tx-risc e vent r egister (o ffset 0 x 6820) these registers are only used on the bcm5700, bcm5701, bcm5702, BCM5703, and bcm5704. the tx-risc uses the following event register. software events are set by writing a one to the bit. the software event, timer event, and rx-risc event are reset by writing a zero to the bit. other events are based on hardware events and cannot be affected directly by the risc processor. table 436: remote rx-risc attention register (offset 0x681c) bit field description init access 31-1 reserved - 0 r/o 0 set attention writing a 1 to this bit sets the remote risc attention bit in the tx-risc event register. 0w/o table 437: tx-risc event register (offset 0x6820) bit field description init access 31 sw event 13 sw event 13 is set. 0 r/w 30 sw event 12 sw event 12 is set r/w. 0 r/w 29 timer timer reference reached. 0 r/w 28 sw event 11 sw event 11 is set. 0 r/w 27 flow attn an unmasked bit is set in the flow attention register. 0 r/o 26 tx-cpu attn tx-risc needs attention. 0 r/w 25 mac attn mac needs attention. 0 r/o 24 rx-cpu attn rx-risc needs attention. 0 r/o 23 sw event 10 sw event 10 is set. 0 r/w 22 high-priority mailbox first 32 mailbox registers have been updated. 0 r/o 21 low-priority mailbox last 32 mailbox registers have been updated. 0 r/o 20 dma attn a dma channel needs attention. 0 r/o 19 sw event 9 sw event 9 is set. 0 r/w 18 high dma rd high priority dma read ftq has stalled. 0 r/o 17 high dma wr high priority dma write ftq has stalled. 0 r/o 16 sw event 8 sw event 8 is set. 0 r/w 15 host coalescing the host coalescing ftq has stalled. 0 r/o 14 sw event 7 sw event 7 is set. 0 r/w 13 send data comp (post dma) send data completion ftq has stalled. 0 r/o 12 sw event 6 sw event 6 is set. 0 r/w 11 tx sw queue event transmit software queue event. 0 r/w 10 dma rd normal priority dma read ftq has stalled. 0 r/o 9 dma wr normal priority dma write ftq has stalled. 0 r/o 8 send data init (pre dma) send data initiator ftq is set. 0 r/o www.datasheet.in programmer?s guide bcm57xx 01/29/08 broadcom corporation document 57xx-pg105-r general control registers page 513 tx-risc t imer r eference r egister (o ffset 0 x 6824) these registers are only used on the bcm5700, bcm5701, bcm5702, BCM5703, and bcm5704. the timer reference register allows the tx-risc to receive an event when the free-running timer register counts up to this value. tx-risc s emaphore r egister (o ffset 0 x 6828) these registers are only used on the bcm5700, bcm5701, bcm5702, BCM5703, and bcm5704. the tx-risc semaphore register allow access to both internal risc processors to a hardware semaphore mechanism. writes to the register indicates the preference to toggle the own/not own states of a single semaphore bit. reads of this register provide a 1 if that register owns the semaphore, and a 0 otherwise. to obtain the semaphore, the normal operation is a loop containing a write 0 followed by a read. exit the loop when the read returns nonzero. to release the semaphore, the normal operation is to write 0. 7 sw event 5 sw event 5 is set. 0 r/w 6 send bd comp send bd completion ftq has stalled. 0 r/o 5 sw event 4 sw event 4 is set. 0 r/w 4 mac tx mac tx ftq has stalled. 0 r/o 3 sw event 3 sw event 3 is set. 0 r/w 2 sw event 2 sw event 2 is set. 0 r/w 1 sw event 1 sw event 1 is set. 0 r/w 0 sw event 0 sw event 0 is set. 0 r/w table 438: tx-risc timer reference register (offset 0x6824) bit field description init access 31-0 tx-cpu timer reference tx-risc timer event when timer register = tx-risc timer reference. reset to all 1. 0r/w table 439: tx-risc semaphore register (offset 0x6828) bit field description init access 31-1 reserved - 0 r/o 0 set attention - 0 r/w table 437: tx-risc event register (offset 0x6820) (cont.) bit field description init access www.datasheet.in bcm57xx programmer?s guide 01/29/08 broadcom corporation page 514 general control registers document 57xx-pg105-r r emote tx-risc a ttention r egister (o ffset 0 x 682c) these registers are only used on the bcm5700, bcm5701, bcm5702, BCM5703, and bcm5704. tx-risc uses this register to set an event for the rx-risc. reading this register returns zero. s erial eeprom a ddress r egister (o ffset 0 x 6838) this 32-bit register is used by the riscs in conjunction with the serial eeprom data register to read and/or write serial eeprom data. the address register specifies the address and the direction of the transfer. when the transfer is complete (for either a read or a write), the complete bit is set. to use this register pair to read the serial eeprom, set the address and ensure the read/write bit is set in the address register. loop reading the address register until the complete bit is set. when it is read the data from the data register. cle ar the complete bit by writing the bit. no other transfer will occur when the complete bit is set. the device id must be programmed to select the appropriate device (a2 must be 0 for 128k/256kx8 device). to use this register pair to write the serial eeprom, place the data into the data register. then write the address into the address register ensuring that the write bit is clear. loop reading the address register until the complete bit is set. when it is, the write is complete. clear the complete bit by writing the bit. no other transfer will occur when the complete bit is set . it is the responsibility of software to control the timing between successive read/write access to the serial eeprom. the software is responsible for handling the address rollover (page crossing) during the serial eeprom access. for the read operations, only the random read mode is supported. table 440: tx-risc attention register (offset 0x682c) bit field description init access 31-1 reserved - 0 r/o 0 set attention writing a 1 to this bit sets the tx-risc attention bit in the rx- risc event register. 0r/w table 441: serial eeprom address register (offset 0x6838) bit field description init access 31 read/write if set, the transfer is a read. 0 r/w 30 complete set when the transfer is complete. 0 w2c 29 reset reset serial eeprom hardware block. 0 r/w 28-26 device id device id (a2, a1, a0). 0 r/w 25 start access trigger the hardware state machine to access the serial ee-prom. this is a self-clearing bit. 0r/w 24-16 half clock period set the half clock period for the seeprom clock. clock period = 2 x half_clock_period x core_clk. 0r/w 15-2 seeprom address address of the word in seeprom to be read or written. 0 r/w 1-0 reserved must be 0, byte addressing not available. 0 r/o www.datasheet.in programmer?s guide bcm57xx 01/29/08 broadcom corporation document 57xx-pg105-r general control registers page 515 s erial eeprom d ata r egister (o ffset 0 x 683c) this 32-bit register holds the data to be written into the serial eeprom or read from the serial eeprom. s erial eeprom c ontrol r egister (o ffset 0 x 6840) this serial eeprom control register provides the cpu to toggle the pins to serial eeprom directly. the auto seeprom access bit of the miscellaneous local control register (see ?miscellaneous local control register (offset 0x6808)? on page 507 ) must be reset to enable the functions of this register. mdi c ontrol r egister (o ffset 0 x 6844) the control register for handling the management data interface, which used to communicate between the physical layer and management layer. table 442: serial eeprom data register (offset 0x683c) bit field description init access 31-0 data read/write data register for the seeprom interface. 00000000h r/w table 443: serial eeprom control register (offset 0x6840) bit field description init access 31-6 reserved - 0 r/o 5 data input serial eeprom data input 0 r/o 4 data output serial eeprom data output control 0 r/w 3 data output tri-state serial eeprom data output tristate output control 0 r/w 2 clock input serial eeprom clock input 0 r/o 1 clock output serial eerpom clock output control 0 r/w 0 clock output tri- state serial eeprom clock output tristate control 0 r/w table 444: mdi control register (offset 0x6844) bit field description init access 31-4 reserved - 0 r/o 3 mdi clock when enabled, controls the clock signal at the mdc pin. 0r/w 2 mdi select when set, the mdi interface is controlled by this register. 0r/w 1 mdi enable when set, the mdi data pin is enabled as an output driver. 0r/w 0 mdi data when read, returns the value at the mdio pin. when written, and the mdi enable bit is also set, the value is driven to the mdio pin. 0r/w www.datasheet.in bcm57xx programmer?s guide 01/29/08 broadcom corporation page 516 general control registers document 57xx-pg105-r s erial eeprom d elay r egister (o ffset 0 x 6848) this 32-bit r/w register specifies the delay between the eeprom access in 15 ns interval and is used for vpd access. since the requirement of back-to-back write for serial eeproms is 10ms, firmware currently programs this register to 0xa2c2a. rx cpu e vent e nable r egister (o ffset 0 x 684c) this register is applicable to bcm5705, bcm5788, bcm5721, bcm5751, bcm5752, bcm5714, and bcm5715 devices only. setting a bit in this register enables an interrupt to the cpu or the event. table 445: rx cpu event enable register (offset 0x684c) bit field description init access 31 flash - 0 r/o 30 vpd - 0 r/o 29 timer reference reached -0 r/w 28 rom - 0 r/o 27 hc module - 0 r/o 26 rx cpu module - 0 r/o 25 emac module - 0 r/o 24 memory map enable bit set by hw, cleared by sw. 0 r/w 23 reserved - 0 r/w 22 high-priority mail box - 0 r/o 21 low-priority mail box - 0 r/o 20 dma - 0 r/o 19 reserved - 0 r/w 18-17 reserved - 00 r/w 16 asf location 15 - 0 r/w 15 tpm interrupt enable - 0 r/w 14 asf location 14 - 0 r/w 13 reserved - 0 r/w 12 asf location 13 - 0 r/w 11 unused sdi - 0 r/w 10 sdc (post tcp segmentation) -0 r/o 9 sdi (pre tcp segmentation) -0 r/o 8 rdiq ftq (received an asf) -0 r/o 7 asf location 12 - 0 r/w 6 reserved - 0 r/w 5 asf location 11 - 0 r/w www.datasheet.in programmer?s guide bcm57xx 01/29/08 broadcom corporation document 57xx-pg105-r general control registers page 517 g ig s er d es prbs c ontrol r egister (0 x 6850, bcm5714 and bcm5715 o nly ) g ig s er d es prbs s tatus r egister (0 x 6854, bcm5714 and bcm5715 o nly ) grc m essage e xchange o ut r egister (0 x 6870h, bcm5714 and bcm5715 o nly ) grc m essage e xchange i n r egister (0 x 6874h, bcm5714 and bcm5715 o nly ) 4 reserved - 0 r/w 3 asf location 10 - 0 r/w 2 reserved - 0 r/w 1 asf location 9 - 0 r/w 0 asf location 8 - 0 r/w table 446: gig serdes prbs control register (0x6850, bcm5714 only) bit field description init access 5 prbs_soft_reset reset prbs 0 r/w 4 prbs_en enable prbs 0 r/w 3 prbs_inv invert prbs pattern 0 r/w 2:1 prbs_order prbs order 00 r/w 0 prbs_error_clr clear prbs error count 0 r/e table 447: gig serdes prbs status register (0x6854, bcm5714 only) bit field description init access 15 prbs_lock prbs monitor is locked 0 r 14 prbs_lost_lock prbs lost lock (sticky bit) 0 r 13:0 prbs_error_cnt error count (should be stable for pass) 0 r table 448: grc message exchange out register (0x6870h, bcm5714 only) bit field description init access 31:0 message out message out to other function rw table 449: grc message exchange in register (0x6874h, bcm5714 only) bit field description init access 31:0 message in message in from other function rw table 445: rx cpu event enable register (offset 0x684c) (cont.) bit field description init access www.datasheet.in bcm57xx programmer?s guide 01/29/08 broadcom corporation page 518 wake-on lan registers document 57xx-pg105-r w ake - on lan r egisters wol m ode r egister (o ffset 0 x 6880) note: the 0x6880 to 0x688b registers are only valid for the bcm5721, bcm5751, and bcm5752 devices. table 450: wake-on-lan registers field description 0x6880-0x6883 wol mode register 0x6884-0x6887 wol config register 0x6888-0x688b wol state machine status register table 451: wol mode register (offset 0x6880) bit field description init access 31-5 reserved - 0 r/w 4 wol_pwr_ctrl use to manually switch the power fets. 0 r/w 3-2 wol_pwr_sw_pr og control the wol voltage comparator threshold (100 mv increment). 0r/w 1 enable this bit controls whether the wol is active or not. ? when set to 0, it completes the current operation and cleanly halts. ? until it is completely halted, it remains one when read. 0r/w 0 reset when set, the entire wol state machines are reset. this bit is self-clearing. 0r/w www.datasheet.in programmer?s guide bcm57xx 01/29/08 broadcom corporation document 57xx-pg105-r wake-on lan registers page 519 wol c onfig r egister (o ffset 0 x 6884) wol s tate m achine s tatus r egister (o ffset 0 x 6888) table 452: wol config register (offset 0x6884) bit field description init access 31-17 reserved when set to 1, it indicates the main power is available. 0 r/w 16 sc_sim_mode when set to 1, it accelerate the simulations. it waits only 0.5 s. when set to 0, it is normal operation. 0r/w 15-14 sc_delay_cfg when set to 00, it accelerates the simulations for slow_clock_ctl. ? 00: waits 10 s. ? 01: waits 35 s. ? 10: waits 50 s. ? 11: waits 65 s. 0r/w 13 sd_sim_mode ? 0: normal operation mode. the total delay is sd_delay_cfg x1000. ? 1: waits 0.5 s. 0r/w 12-11 sd_delay_cfg this is the amount of the delay. ? 00: 0 ? 01: 50 s ? 10: 150 s ? 11: 250 s 0r/w 10 power_avail when set to 1, it indicates the main power is available. 0 r/w 9 phy_bypass when set to 1, it indicates that it is emulation (ikos) mode. 0r/w 8 lom_enable when set to 1, lom is enabled. 0 r/w 7-3 reserved - 0 r/w 2 wol_done 2 when set to 1, wol finishes its operations. 0 r/w 1 wol_start 1 when set to 1, wol state machines starts. 0 r/w 0 wol_10 when set to 1, wol is 10 mbit only. when set to 0, wol is 100 mbit. 0r/w table 453: wol state machine status register (offset 0x6888) bit field description init access 31-29 reserved - 0 r/o 28-24 sd_state[4:0] shutdown control state machine value 0 r/o 23-20 reserved - 0 r/o 19-16 sc_state[3:0] slow_clock control state machine value 0 r/o 15-13 reserved - 0 r/o 12-8 sw_state[4:0] setup_wol control state machine value 0 r/o 7-3 reserved - 0 r/o 2-0 wol_state[2:0] wol top control state machine value 0 r/o www.datasheet.in bcm57xx programmer?s guide 01/29/08 broadcom corporation page 520 miscellaneous tpm register document 57xx-pg105-r m iscellaneous tpm r egister this register is applicable only to bcm5752 device. m iscellaneous tpm r egister (o ffset 0 x 6890) f ast b oot p rogram c ounter r egister this register is applicable only to bcm5752 device. f ast b oot p rogram c ounter r egister (o ffset 0 x 6894) table 454: miscellaneous tpm register (offset 0x6890) bit field description init access 31-26 misc r/w reserved bits reserved r/w bits that get reset by hard reset 0 r/w 25 super airplane mode enable read/write bit that controls whether super airplane mode is enabled. 0r/w 24 misc2 bit reserved r/w bit that gets reset by power-on reset 0 r/w 23-1 misc1 bits reserved r/w bits that get reset by grc reset 0 r/w 0 tpm iddq this bit, when set, indicates that the tpm is in iddq mode. 0r/o table 455: fast boot program counter register (offset 0x6890) bit field description init access 31 fastboot enable this bit is used by the cpu to keep track of whether or not there is valid phase 1 boot code stored in the rx mbuf. if the bit is set, then rxmbuf contains valid boot code. otherwise, it is assumed that rxmbuf does not contain valid boot code. this bit is reset only by a power-on reset. the state of this bit has no effect on state machines within the device. it is used by the cpu to track boot code status. 0r/w 30-0 fastboot program counter this field is used by the cpu to keep track of the location of the phase 1 boot code in rx mbuf. these bits behave identical to bit 31 in that they have no effect on state machine operation and they are cleared only by a power-on reset. 0r/w www.datasheet.in programmer?s guide bcm57xx 01/29/08 broadcom corporation document 57xx-pg105-r asf support registers (not applicable to bcm5700) page 521 asf s upport r egisters (n ot a pplicable to bcm5700) table 456: asf support registers field description 0x6c00-0x6c03 asf control register 0x6c04-0x6c07 smbus input register 0x6c08-0x6c0b smbus output register 0x6c0c-0x6c0f watchdog timer 0x6c10-0x6c13 heartbeat timer 0x6c14-0x6c17 poll asf timer 0x6c18-0x6c1b poll legacy timer 0x6c1c-0x6c1f retransmission timer 0x6c20-0x6c23 timestamp counter 0x6c24-0x6c27 smbus driver select register 0x6c28-0x6c2f reserved 0x6c30 tpm command register 0x6c34 tpm data register 0x6c38-0x6c3f reserved 0x6c40-0x6c43 auxiliary smbus master status register 0x6c44-0x6c47 auxiliary smbus master control register 0x6c48-0x6c4b auxiliary smbus master command register 0x6c4c-0x6c4f auxiliary smbus block data register 0x6c50-0x6c53 auxiliary smbus slave address/control register 0x6c54-0x6c57 auxiliary smbus slave status register 0x6c58-0x6c5b auxiliary smbus slave data register 0x6c5c-0x6c5f reserved 0x6c60-0x6c63 smbus arp command register 0x6c64-0x6c67 smbus arp status register 0x6c68-0x6c6b udid register 0 0x6c6c-0x6c6f udid register 1 0x6c70-0x6c73 udid register 2 0x6c74-0x6c77 udid register 3 0x6c80 auxiliary smbus master control channel 1 register 0x6c84 auxiliary smbus master control channel 1 register 0x6c88 auxiliary smbus master command channel 1 register 0x6c8c auxiliary smbus block data channel 1 register 0x6c90 auxiliary smbus slave address/control channel 1 register 0x6c94 auxiliary smbus slave status channel 1 register 0x6c98 auxiliary smbus slave data channel 1 register www.datasheet.in bcm57xx programmer?s guide 01/29/08 broadcom corporation page 522 asf support registers (not applicable to bcm5700) document 57xx-pg105-r asf c ontrol r egister (o ffset 0 x 6c00) this register is not applicable to the bcm5700 mac. 0x6cc0 auxiliary smbus master status channel 2 register 0x6cc4 auxiliary smbus master control channel 2 register 0x6cc8 auxiliary smbus master command channel 2 register 0x6ccc auxiliary smbus block data channel 2 register 0x6cd0 auxiliary smbus slave address/control channel 2 register 0x6cd4 auxiliary smbus slave status channel 2 register 0x6cd8 auxiliary smbus slave data channel 2 register table 457: asf control register (offset 0x6c00) bit field description init access 31 smb early attn when set, the smb interface sets the asf_grc_attn bit as soon as slave activity is detected. when cleared, the attention bit is not set until an address match occurs. 0r/w 30 smb enable addr 0 when set, the smb interface accepts all incoming messages with an address of zero. 0r/w 29-23 nic smb address 2 second nic smb address for matching incoming messages. 0r/w 22-16 nic smb address 1 first nic smb address for matching incoming messages. 0 r/w 15 smb autoread when set, the smb_in_rdy bit in the smb input register (see ?smbus input register (offset 0x6c04)? on page 524 ) will clear automatically whenever the register is read. otherwise, the bit must be cleared by software. 0r/w 14 smb addr filter when clear, enables incoming smbus message address filtering using the addresses specified in the nic smb address 1 and nic smb address 2 fields. 0r/w 13 smb bit bang enable when set, the smbus bit-bang interface is enabled in the smbus output register. 0r/w 12 smb enable when set, the smbus block is enabled. 0 r/w table 456: asf support registers (cont.) field description www.datasheet.in programmer?s guide bcm57xx 01/29/08 broadcom corporation document 57xx-pg105-r asf support registers (not applicable to bcm5700) page 523 11-8 asf attention location controls which event bit in the event register the asf attention maps into. ? 0 = disabled ? 1 = txcpu event bit 1 ? 2 = txcpu event bit 2 ? 3 = txcpu event bit 3 ? 4 = txcpu event bit 5 ? 5 = txcpu event bit 7 ? 6 = txcpu event bit 12 ? 7 = txcpu event bit 14 ? 8 = rxcpu event bit 0 ? 9 = rxcpu event bit 1 ? 10 = rxcpu event bit 3 ? 11 = rxcpu event bit 5 ? 12 = rxcpu event bit 7 ? 13 = rxcpu event bit 12 ? 14 = rxcpu event bit 14 ? 15 = rxcpu event bit 16 0r/w 7 smb attention set for incoming slave mode message. 0 w2c 6 retransmission timer expired set when the retransmission timer has timed out. 0 w2c 5 poll legacy timer expired set when the poll legacy timer has timed out. 0 w2c 4 poll asf timer expired set when the poll asf timer has timed out. 0 w2c 3 heartbeat timer expired set when the heartbeat timer has timed out. 0 w2c 2 watchdog timer expired set when the watchdog timer has timed out. 0 w2c 1 timestamp counter enable set to enable the time stamp counter. 0 r/w 0 asf reset soft reset bit for the asf and smbus interface blocks. when set, the blocks will be reset. the bit is self clearing. 0r/w note: some versions of the bcm57xx insert the smbus address byte from smbus messages that should be filtered when the smb addr filter is enabled. broadcom recommends that customers writing their own smbus interface routines not enable the smb addr filter and perform smbus address filtering in their software. table 457: asf control register (offset 0x6c00) (cont.) bit field description init access www.datasheet.in bcm57xx programmer?s guide 01/29/08 broadcom corporation page 524 asf support registers (not applicable to bcm5700) document 57xx-pg105-r smb us i nput r egister (o ffset 0 x 6c04) this register is not applicable to the bcm5700 mac. smb us o utput r egister (o ffset 0 x 6c08) this register is not applicable to the bcm5700 mac. table 458: smbus input register (offset 0x6c04) bit field description init access 31-14 reserved. reserved for future use. 0 r/w 13-11 smb input status value is set by the smbus interface when the smb input done bit is set. the value is encoded to the following: ? 000: reception ok. ? 001: pec error during reception. ? 010: smbus input fifo overflowed during reception. ? 011: smbus stopped unexpectedly during reception. ? 100: smbus timed out during reception. 000 r/w 10 smbus in firstbyte set by the smbus interface block for the first byte received in the transfer. 0r/w 9 smbus in done set by the smbus block when the data input field has the last data byte of the transfer. 0w2c 8 smbus in ready set by the smbus interface block when the data input field is valid. 0r/w 7-0 smbus data in input data from the smbus interface. 0 r/w note: the bcm57xx uses a 5-byte internal input fifo for smbus messages that must be cleared if an error is indicated by the smb input status field. this fifo is cleared by continually reading the smbus data in field until the smbus in done bit is set, then clearing the smbus in done bit by writing a 1. table 459: smbus output register (offset 0x6c08) bit field description init access 31-29 reserved. reserved for future use. 0 r/w 28 smb clock input value value on the smb clock pin when the smbus interface is in bit-bang mode. 0r/w 27 smb clock enable when set, the smbus clock signal is driven low when the smbus interface bit-bang mode is also set. when clear, the smbus clock signal is tristated. 0r/w 26 smb data input value value on the smb data pin when the smbus interface is in bit-bang mode. 0r/w 25 smb data enable when set, the smbus data signal is driven low when the smbus interface bit-bang mode is also set. when clear, the smbus data signal is tri-stated. 0r/w 24 smb slave mode set when the smbus interface is operating in slave mode. 0r/w www.datasheet.in programmer?s guide bcm57xx 01/29/08 broadcom corporation document 57xx-pg105-r asf support registers (not applicable to bcm5700) page 525 23-20 smb output status set by smbus interface when the smb output start bit is cleared with the following encoded value that indicates the status of the preceding transfer: ? 0000: transmission ok. ? 0001: smbus was nacked on the first byte of transmission. ? 1001: smbus was nacked after the first byte of transmission. ? 0010: smbus output fifo underflowed during transmission. ? 0011: smbus stopped unexpectedly during transmission. ? 0100: smbus timed out during transmission. ? 0101: smbus master lost arbitration during the first byte of transmission. ? 1101: smbus master lost arbitration after the first byte of transmission. ? 0110: remote master acked on what should have been the last byte. 0r/w 19-14 smb read length number of bytes in the read portion of the transaction. 0 r/w 13 get receive length when set, the receive length is taken from the first byte of the read data. when cleared, the smb read length field is used. 0r/w 12 enable pec when set, the packet error check byte is enabled for the command. 0r/w 11 smb access type when set, the smbus interface will execute a read command. when cleared, the write command will be executed. 0r/w 10 smb output last set to indicate when the smb data output field contains the last byte of the command. 0r/w 9 smb output start set to indicate the start of a smbus master transaction. cleared by the smbus interface block when the transaction is complete. 0r/w 8 smb output ready set to indicate the smb data output field has valid data. cleared by the smbus interface block when the bye is transferred to the internal fifo. 0r/w 7-0 smb data output outgoing data byte for the smb transaction. 0 r/w note: the bcm57xx uses a 5-byte internal output fifo for smbus messages. when an smbus message is begun by setting the smb output start bit, the software must write the next output byte within 100 s, or an underflow may occur and invalidate the entire smbus message. table 459: smbus output register (offset 0x6c08) (cont.) bit field description init access www.datasheet.in bcm57xx programmer?s guide 01/29/08 broadcom corporation page 526 asf support registers (not applicable to bcm5700) document 57xx-pg105-r asf w atchdog t imer r egister (o ffset 0 x 6c0c) this register is not applicable to the bcm5700 mac. asf h eartbeat t imer r egister (o ffset 0 x 6c10) this register is not applicable to the bcm5700 mac. p oll asf t imer r egister (o ffset 0 x 6c14) this register is not applicable to the bcm5700 mac. table 460: asf watchdog timer register (offset 0x6c0c) bit field description init access 31-8 reserved reserved for future use. 0 r/w 7-0 watchdog timer a countdown timer which decrements at the rate of one tick per second. when the counter reaches a value of zero, the corresponding timeout bit is set in the asf control register (see ?asf control register (offset 0x6c00)? on page 522 ). the timer stops decrementing when it reaches the zero value. 0r/w table 461: asf heartbeat timer register (offset 0x6c10) bit field description init access 31-16 reserved. reserved for future use. 0 r/w 15-0 heartbeat timer a countdown timer which decrements at the rate of one tick per second. when the counter reaches a value of zero, the corresponding timeout bit is set in the asf control register (see ?asf control register (offset 0x6c00)? on page 522 ). the timer stops decrementing when it reaches the zero value. 0r/w table 462: poll asf timer register (offset 0x6c14) bit field description init access 31-8 reserved reserved for future use. 0 r/w 7-0 poll timer a countdown timer which decrements at the rate of one tick per 5 ms. when the counter reaches a value of zero, the corresponding timeout bit is set in the asf control register (see ?asf control register (offset 0x6c00)? on page 522 ). the timer stops decrementing when it reaches the zero value. 0r/w www.datasheet.in programmer?s guide bcm57xx 01/29/08 broadcom corporation document 57xx-pg105-r asf support registers (not applicable to bcm5700) page 527 p oll l egacy t imer r egister (o ffset 0 x 6c18) this register is not applicable to the bcm5700 mac. r etransmission t imer r egister (o ffset 0 x 6c1c) this register is not applicable to the bcm5700 mac. t ime s tamp c ounter r egister (o ffset 0 x 6c20) this register is not applicable to the bcm5700 mac. table 463: poll legacy timer register (offset 0x6c18) bit field description init access 31-8 reserved reserved for future use. 0 r/w 7-0 poll legacy timer a countdown timer which decrements at the rate of one tick per 250 ms. when the counter reaches a value of zero, the corresponding timeout bit is set in the asf control register (see ?asf control register (offset 0x6c00)? on page 522 ). the timer stops decrementing when it reaches the zero value. 0r/w table 464: retransmission timer register (offset 0x6c1c) bit field description init access 31-8 reserved reserved for future use. 0 r/w 7-0 poll timer a countdown timer which decrements at the rate of one tick per second. when the counter reaches a value of zero, the corresponding timeout bit is set in the asf control register (see ?asf control register (offset 0x6c00)? on page 522 ). the timer stops decrementing when it reaches the zero value. 0r/w table 465: time stamp counter register (offset 0x6c20) bit field description init access 31- 0 timestamp counter a count-up timer which increments at the rate of one tick per second. the counter starts when the time stamp counter enable bit is set in the asf control register (see ?asf control register (offset 0x6c00)? on page 522 ). 0r/w www.datasheet.in bcm57xx programmer?s guide 01/29/08 broadcom corporation page 528 asf support registers (not applicable to bcm5700) document 57xx-pg105-r smb us d river s elect r egister (o ffset 0 x 6c24) this version of the smbus driver select register applies to the bcm5705, bcm5788, bcm5721, bcm5751, bcm5752, bcm5714, and bcm5715 mac transceivers only. rest of bcm57xx family this version of the smbus driver select register applies to the bcm5701 through bcm5704 mac controllers. table 466: smbus driver select register (offset 0x6c24) bit field description init access 31- 1 reserved - r/o 0 driver select set to 1 to enable sm_data_out and sm_clk_out to use new smbus interface. 0r/w table 467: smbus driver select reg. (offset 0x6c24, rest of bcm57xx fam. (except bcm5700 mac) bit field description init access 31- 0 timestamp counter a count-up timer which increments at the rate of one tick per second. the counter starts when the timestamp counter enable bit is set in the asf control register (see ?asf control register (offset 0x6c00)? on page 522 ). 0r/w www.datasheet.in programmer?s guide bcm57xx 01/29/08 broadcom corporation document 57xx-pg105-r bcm5721, bcm5751, and bcm5752 tpm interface registers page 529 bcm5721, bcm5751, and bcm5752 tpm i nterface r egisters these registers are applicable to bcm5721, bcm5751, and bcm5752 only. tpm c ommand r egister (o ffset 0 x 6c30) this register is applicable to bcm5721, bcm5751, and bcm5752 only. tpm d ata r egister (o ffset 0 x 6c34) this register is applicable to bcm5721, bcm5751, and bcm5752 only. table 468: tpm command register (offset 0x6c30) bit field description init access 31-16 register address register address value to tpm core. it is only valid when request is asserted. firmware assigns this field based on tpm internal register mapping. 0x0 r/w 15-2 reserved - 0x0 r/w 1 write/!read ? 0: read register access. ? 1: write register access. note: wr/rd request will be asserted to the tpm core until ack is given. 0r/w 0 start/!done write 1 to start internal tpm register access. this bit is self-cleared to 0 once register access is completed and the read data (if read) is available in the data register (see ?tpm data register (offset 0x6c34)? on page 529 ). the internal processor polls this bit to determine if the previous access is finished. note: this bit is cleared by the tpm_ack signal from the tpm ip. 0w/sc table 469: tpm data register (offset 0x6c34) bit field description init access 31-0 data value data to be written or return read data. data valid only after start/!done bit is clear (see ?tpm command register (offset 0x6c30)? on page 529 ). 0x0 r/w www.datasheet.in bcm57xx programmer?s guide 01/29/08 broadcom corporation page 530 bcm5714 and bcm5715 tpm interface registers document 57xx-pg105-r bcm5714 and bcm5715 tpm i nterface r egisters these registers are applicable to bcm5714 and bcm5715 only. tpm c ommand r egister (0 x 6 c 30) tpm d ata r egister (0 x 6c34) table 470: tpm command register (0x6c30, for bcm5714 and bcm5715 only) bit field description init access 31-28 db reg addr debug register address. sw should always write 0 to this field, other values are reserved for hw debug purpose. 0r/w 27-8 warm ini warm-up timer initial value. used by the random generator. sw should always write 0 to this field, other values will cause a premature warm done (bit 7) to be set. 0r/w 7 warm done the random generator initialization is complete. it normally (depends on the warm ini value) takes 2^21 core clocks from setting load ini (bit 2) to complete the initialization. 0r/o 6 rnd vld the 32-bit random number in tpm data register (at offset 0x6c34) is ready. clear this bit by writing 1 to upd rnd (bit 5). 0r/o 5 upd rnd update the 32-bit random data. writing 1 to this bit triggers the random generator to start generating a new 32-bit random number. 0w2c 4 attn msk attention mask. writing 1 to this bit disables the attention signaling when rnd vld (bit 6) is set. 0r/w 3 div2 divide. when configured low, the random number generation is twice as fast as high. 0r/w 2 load ini load warm up timer initial value. writing 1 to this bit clears the warm done (bit 7) and the internal initialization timer starts incrementing based on the warm ini (bit 27-8) value until the warm done is set. 0w2c 1 rnd en random generator enable. 0 r/w 0 rnd rst random generator reset. 0 w2c table 471: tpm data register (0x6c34) bit field description init access 31-0 rnd32bit 32-bit random number. 0 r www.datasheet.in programmer?s guide bcm57xx 01/29/08 broadcom corporation document 57xx-pg105-r bcm5714 and bcm5715 tpm interface registers page 531 a uxiliary smb us m aster s tatus r egister (o ffset 0 x 6c40) this register is for the bcm5704, bcm5705, bcm5788, bcm5721, bcm5751, bcm5752, bcm5714, and bcm5715 only. table 472: auxiliary smbus master status register (offset 0x6c40) bit field description init access 31-8 reserved - 0 r/o 7 crc/pec error ? 0: no crc/pec error detected. ? 1: crc/pec error detected. this bit is set only by hardware and can be reset by writing a 1 to this position. note: was bit-5 on 5705 by mistake 0r/w 6 reserved - 0 r/o 5 crc/pec error for bcm5705. (please see bit-7). reserved for all other devices -0r/o 4failed ? 0: smbus attention not caused by kill bit. ? 1: source of the smbus attention is a failed bus transaction, set when kill bit in smb master control register is set. this bit is set only by hardware and can be reset by writing a one to this position. 0r/w 3 bus collision ? 0: smbus attention not caused by transaction collision. ? 1: source of smbus attention was a transaction collision. this bit is set only by hardware and can be reset by writing a 1 to this position. 0r/w 2 device error ? 0: smbus interrupt not caused by transaction error. ? 1: source of smbus interrupt was the generation of a smbus transaction error. this bit is set only by hardware and can be reset by writing a 1 to this position. transaction errors are usually caused by: illegal command field, unclaimed cycle, master device time-out. 0r/w 1 smbus attention ? 0: smbus attention not caused by master command completion. ? 1: source of smbus attention was the completion of the last master command. this bit is set only by hardware and can be reset by writing a 1 to this position. 0r/w 0master busy ? 0: smbus controller master interface is not processing a command. ? 1: indicates that the smbus controller master interface is in the process of completing a command. none of the other smbus master registers should be accessed if this bit is set. 0r/o www.datasheet.in bcm57xx programmer?s guide 01/29/08 broadcom corporation page 532 bcm5714 and bcm5715 tpm interface registers document 57xx-pg105-r a uxiliary smb us m aster c ontrol r egister ( offset 0 x 6 c 44) this register is applicable to bcm5704, bcm5705, bcm5788, bcm5721, bcm5751, bcm5752, bcm5714, and bcm5715 devices only. table 473: auxiliary smbus master control register (offset 0x6c44) bit field description init access 31-30 reserved - 0 r/o 29 smbus slave soft reset (bcm5714, bcm5721 and bcm5751 only) setting this bit will reset the smbus slave interface. 0 r/w reserved - 0 r/o 28 smbus softreset ? 0: normal operation. ? 1: resets the smbus interface. 0r/w 27-24 sm module attention selection (bcm5721, bcm5751, bcm5752, bcm5714, and bcm5715 only) this field selects which grc attention is asserted when an smbus interrupt occurs. 0r/w reserved (other devices) - 0 r/o 23-20 reserved - 0 r/o 19 sm_data pin control ? 0: drive the sm_data pin low. ? 1: no functional impact on the sm_data pin. 0r/w 18 sm_clk pin control ? 0: drive the sm_clk pin low. ? 1: no functional impact on the sm_clk pin. 0r/w 17 sm_data pin current status this bit returns the value on the sm_data pin. this allows software to read the current state of the pin. 0r/o 16 sm_clk pin current status this bit returns the value on the sm_clk pin. this allows software to read the current state of the pin. 0r/o 15-11 reserved - 0 r/o 10 slave read attention enable ? 0: smbus slave will not wait for status bit to be cleared before supplying the data. ? 1: smbus slave will stretch the clock until the status bit is cleared. 0r/w 9 bit-bang interface enable ? 0: bit-bang interface disabled. ? 1: bit-bang interface enabled. 0r/w 8 sm bus speed ? 0: 100 hz smbus interface. ? 1: 400 hz smbus interface. 0r/w 7 crc/pec enable ? 0: disable crc/pec. ? 1: enable crc/pec generation. 0r/w 6start ? 0: has no effect. always read a 0. ? 1: execution start. writing a 1 in this field initiates smbus controller master interface to execute the command programmed in the smb command port field. 0r/w 5 reserved - 0 r/o www.datasheet.in programmer?s guide bcm57xx 01/29/08 broadcom corporation document 57xx-pg105-r bcm5714 and bcm5715 tpm interface registers page 533 a uxiliary smb us m aster c ommand r egister (o ffset 0 x 6c48) this register is applicable to bcm5704, bcm5705, bcm5788, bcm5721, bcm5751, bcm5752, bcm5714, and bcm5715 devices only. 4-2 smbus command protocol select the type of command the smbus controller master interface will execute. reads and writes are determined by bit 0 of smbus master address register: ? 000: quick read or write. ? 001: byte read or write. ? 010: byte data read or write. ? 011: word data read or write. ? 100: reserved. ? 101: block read or write. ? 110: block write-block read process call. ? 111: reserved. 000 r/w 1kill ? 0: this will allow the master controller interface function to continue normally. ? 1: stop the current master transaction in process. this sets the failed status bit and asserts interrupt selected by the smb interrupt select field. 0r/w 0 interrupt enable ? 0: disable the generation of attention ? 1: enable the generation of attention on the completion of current master transaction. 0r/w table 474: auxiliary smbus master command register (offset 0x6c48) bit field description init access 31-24 smbus data 1 this register should be programmed with a value to be transmitted in the data 1 field of an smbus master interface word transaction. 0x00 r/w 23-16 smbus data 0 this register should be programmed with a value to be transmitted in the data 0 field of an smbus master interface word transaction. ? for block write commands, the count of the memory should be stored in this field. the value of this register is loaded into the block transfer count field. this register must be set to a value between 1 and 32 for block command counts. ? for block reads, count received from smbus device is stored here. 0x00 r/w 15-9 smbus address this field contains the 7-bit address of the targeted slave device. 0 r/w 8 smbus read or write ? 0: execute a write command. ? 1: execute a read command. 0r/w 7-0 smbus master command this field contains the data transmitted in the command field of smbus master transaction. 0x00 r/w table 473: auxiliary smbus master co ntrol register (offset 0x6c44) (cont.) bit field description init access www.datasheet.in bcm57xx programmer?s guide 01/29/08 broadcom corporation page 534 bcm5714 and bcm5715 tpm interface registers document 57xx-pg105-r a uxiliary smb us b lock d ata r egister (o ffset 0 x 6c4c) this register is applicable to bcm5704, bcm5705, bcm5788, bcm5721, bcm5751, bcm5752, bcm5714, and bcm5715 devices only. a uxiliary smb us s lave a ddress /c ontrol r egister (o ffset 0 x 6c50) this register is applicable to bcm5704, bcm5705, bcm5788, bcm5721, bcm5751, bcm5752, bcm5714, and bcm5715 devices only. table 475: auxiliary smbus block data register (offset 0x6c4c) bit field description init access 31-8 reserved - 0 r/w 7-0 smbus block data this register is used to transfer data into or out of the block data storage array. for block read and write commands. 0x00 r/w table 476: auxiliary smbus slave address/control register (offset 0x6c50) bit field description init access 31-8 reserved - 0 r/w 7-1 smbus slave address only meaningful if av flag is set. user also needs to program bit 0 of register 0x6c64 av_reg to mark address valid based on smbus 2.0 spec. 0r/w 0 slave enable ? 0: disable ? 1: enable slave interface. (this bit must also be set for arp offload on bcm5721, bcm5751, bcm5752, bcm5714, and bcm5715.) 0r/w www.datasheet.in programmer?s guide bcm57xx 01/29/08 broadcom corporation document 57xx-pg105-r bcm5714 and bcm5715 tpm interface registers page 535 a uxiliary smb us s lave s tatus r egister (o ffset 0 x 6c54) this register is applicable to bcm5704, bcm5705, bcm5788, bcm5721, bcm5751, bcm5752, bcm5714, and bcm5715 devices only. table 477: auxiliary smbus slave status register (offset 0x6c54) bit field description init access 31-3 reserved - 0 r/w 2 slave read requested ? 0: smbus attention not caused by slave. ? 1: source of smbus attention is slave read cycle that matched the smb slave address. this bit is only set by hardware and can be reset by writing a 1 to this position. slave interface stretches the clock until this bit is cleared. read request for arp will not trigger this bit. arp hardware will supply read data in wire speed. 0r/w 1slave cycle complete ? 0: smbus attention not caused by slave. ? 1: source of smbus attention is completion of a slave cycle that matched the smb slave address. this bit is only set by hardware and can be reset by writing a 1 to this position. completion for arp will not trigger this bit. arp status register contains that information. 0r/w 0slave busy ? 0: smbus controller slave interface is not processing data. ? 1: indicates that the smbus controller slave interface is in the process of receiving data. none of the other smbus slave registers should be accessed if this bit is set. note: this bit is also set during arp process. 0r/o www.datasheet.in bcm57xx programmer?s guide 01/29/08 broadcom corporation page 536 bcm5714 and bcm5715 tpm interface registers document 57xx-pg105-r a uxiliary smb us s lave d ata r egister (o ffset 0 x 6c58) this register is applicable to bcm5704, bcm5705, bcm5788, bcm5721, bcm5751, bcm5752, bcm5714, and bcm5715 devices only. take the following software precautions: ? the software should set receive accelerate mode bit (see bit 10 of the ?write dma mode register (offset 0x4c00)? on page 480 ) only when the pci bus speed is 33 mhz and the core clock speed is 62.5 mhz. ? the software should set the long burst mode (see bits 17-16 of the ?read dma mode register (offset 0x4800)? on page 477 ) only when the pci bus speed is 33 mhz and the core clock speed is 62.5 mhz. ? the software should set the bus-parking save mode (see bit 23 of the ?pci clock control register (offset 0x74)? on page 334 ) to 1 when the pci bus speed is 66 mhz. ? when in the rdma long burst mode (i.e., bits 17-16 = 11 of the ?read dma mode register (offset 0x4800)? on page 477 ), the difference between the producer index and consumer index should be less than or equal to 63. this boundary condition is needed to prevent pci burst reading of more than 2k bytes because pci module only looks at bit[10:0] of the request length from either dma engines. this restriction is removed in a3. ? the software should clear bit[22] of the dma read/write control register (see the ?dma read/write control register (offset 0x6c)? on page 327 ) when entering slow core clock mode. otherwise, the bcm5705 could run into a danger of asserting req for more than 16 pci clock cycles without issuing an active frame on the bus. table 478: auxiliary smbus slave data register (offset 0x6c58) bit field description init access 31-22 reserved - 0 r/w 21-16 write byte count (bcm5704, bcm5705, and bcm5788 only) indicates the number of bytes written into the fifo by the smbus master. 0r/w read byte count (bcm5721, bcm5751, bcm5752, bcm5714, and bcm5715 only) indicates the number of bytes read from the fifo by the host. 0r/w 15-14 reserved - 0 r/w 13-8 read byte count (bcm5704, bcm5705, and bcm5788 only) indicates the number of bytes read from the fifo by the host. 0r/w write byte count (bcm5721, bcm5751, bcm5752, bcm5714, and bcm5715 only) indicates the number of bytes written into the fifo by the smbus master. 0r/w 7-0 slave data - 0 r/o www.datasheet.in programmer?s guide bcm57xx 01/29/08 broadcom corporation document 57xx-pg105-r bcm5714 and bcm5715 tpm interface registers page 537 smb us a ddress r esolution p rotocol r egisters (o ffset 0 x 6ce0) this register is applicable to bcm5721, bcm5751, bcm5752, bcm5714, and bcm5715 devices only table 479: smbus arp command register (offset 0x6ce0) bit field description init access 31:17 reserved - 0x0 r/w 16 arp attention enable ? 0: no attention is asserted to the internal cpu after the arp command is completed. ? 1: attention is asserted to the internal cpu after the arp command is completed. attention stays until the cpu clears the attention source by clearing command completed bit. 0r/w 15:14 reserved - 00 r/w 13 directed reset enable ? 0: disable directed reset command capability. ? 1: enable directed reset command capability. 0r/w 12 directed get udid enable ? 0: disable directed get udid command capability. ? 1: enable directed get udid command capability. 0r/w 11 assign address enable ? 0: disable assign address command capability. ? 1: enable assign address command capability. 0r/w 10 general get udid enable ? 0: disable general get udid command capability. ? 1: enable general get udid command capability. 0r/w 9 general reset device enable ? 0: disable general reset device command capability. ? 1: enable general reset device command capability. 0r/w 8 prepare to arp enable ? 0: disable prepare to arp command capability. ? 1: enable prepare to arp command capability. 0r/w 7:3 reserved - 00000 r/w 2 arp software reset ? 0: normal operation. ? 1: reset arp state machine. 0r/w 1 psa enable ? 0: not persistent slave address enabled. ? 1: persistent slave address enabled. 0r/w 0 arp enable ? 0: disable arp hw offload. ? 1: enable arp hw offload. note: smbus slave interface has to be enabled in addition to this bit for arp to process. 0r/w www.datasheet.in bcm57xx programmer?s guide 01/29/08 broadcom corporation page 538 bcm5714 and bcm5715 tpm interface registers document 57xx-pg105-r smb us arp s tatus r egister (o ffset 0 x 6ce4) this register is applicable to bcm5721, bcm5751, bcm5752, bcm5714, and bcm5715 devices only table 480: smbus arp status register (offset 0x6ce4) bit field description init access 31:16 reserved - 0 15:14 reserved - 00 13 directed reset completion ? 0: has not received a valid direct reset command. ? 1: has received a valid direct reset command. this bit is set by hardware and a write 1 to clear. this is independent of the interrupt enable bit. 0r/w2c 12 directed get udid completion ? 0: has not received a valid direct get udid command. ? 1: has received a valid direct get udid command. this bit is set by hardware and a write 1 to clear. this is independent of the interrupt enable bit. 0r/w2c 11 assign address completion ? 0: has not received a valid assign address command. ? 1: has received a valid assign address command. this bit is set by hardware and a write 1 to clear. this is independent of the interrupt enable bit. 0r/w2c 10 general get udid completion ? 0: has not received a valid general get udid command. ? 1: has received a valid general get udid command. this bit is set by hardware and a write 1 to clear. this is independent of the interrupt enable bit. 0r/w2c 9 general reset device completion ? 0: has not received a valid general reset device command. ? 1: has received a valid general reset device command. this bit is set by hardware and a write 1 to clear. this is independent of the interrupt enable bit. 0r/w2c 8 prepare to arp completion ? 0: has not received a valid prepare to arp command. ? 1: has received a valid prepare to arp command. this bit is set by hardware and a write 1 to clear. this is independent of the interrupt enable bit. 0r/w2c 7:3 reserved - 00000 2 arp busy ? 0: arp hw is in idle state. ? 1: apr hw is in process of arp messages. this bit is only set by hardware. 0r/o 1 ar: address resolved flag ? 0: current slave address is not resolved based on the arp. ? 1: current slave address is resolved based on the arp. 0r/w 0 av: address valid flag ? 0: current slave address is not valid. ? 1: current slave address is valid. 0r/w www.datasheet.in programmer?s guide bcm57xx 01/29/08 broadcom corporation document 57xx-pg105-r bcm5714 and bcm5715 tpm interface registers page 539 udid r egister 0 (o ffset 0 x 6ce8) this register is applicable to bcm5721, bcm5751, bcm5752, bcm5714, and bcm5715 devices only udid r egister 1 (o ffset 0 x 6cec) this register is applicable to bcm5721, bcm5751, bcm5752, bcm5714, and bcm5715 devices only udid r egister 2 (o ffset 0 x 6cf0) this register is applicable to bcm5721, bcm5751, bcm5752, bcm5714, and bcm5715 devices only udid r egister 3 (o ffset 0 x 6cf4) this register is applicable to bcm5721, bcm5751, bcm5752, bcm5714, and bcm5715 devices only table 481: udid register 0 (offset 0x6ce8) bit field description init access 31:0 vendor specific id a unique number per device 0x0 r/w table 482: udid register 1 (offset 0x6cec) bit field description init access 31:16 subsystem vendor id this field may hold a value derived from any of several resources. example: as assigned by pci sig. 0x0 r/w 15:0 subsystem device id identifies a specific interface, implementation, or device. 0x0 r/w table 483: udid register 2 (offset 0x6cf0) bit field description init access 31:16 device id the device id assigned by the device manufacturer. 0x0 r/w 15:0 interface identifies the protocol layer interfaces supported over the smbus connection by the device. example: asf 0x0 r/w table 484: udid register 3 (offset 0x6cf4) bit field description init access device capability describes the device?s capabilities. 0x0 r/w version/revision the udid version number, and a silicon revision identification. 0x0 r/w vendor id the device manufacturer?s id as assigned by the sbs implementers? forum or pci sig. 0x0 r/w www.datasheet.in bcm57xx programmer?s guide 01/29/08 broadcom corporation page 540 bcm5714 and bcm5715 tpm interface registers document 57xx-pg105-r a uxiliary smb us m aster s tatus c hannel 1 r egister (o ffset 0 x 6c80) this register is applicable only to the bcm5704 mac transceiver. table 485: auxiliary smbus master status channel 1 register (offset 0x6c80, bcm5704 only) bit field description init access 31-8 reserved - 0 r/o 7 crc/pec error ? 0: no crc/pec error detected. ? 1: crc/pec error detected. this bit is only set by hardware and can be reset by writing a 1 to this position. 0r/w reserved - 0 r/o 6:5 reserved - 0 r/o 4failed ? 0: smbus attention not caused by kill bit. ? 1: source of the smbus attention is a failed bus transaction, set when kill bit in smb master control register is set. this bit is only set by hardware and can be reset by writing a one to this position. 0r/w 3 bus collision ? 0: smbus attention not caused by transaction collision. ? 1: source of smbus attention was a transaction collision.this bit is only set by hardware and can be reset by writing a 1 to this position. 0r/w 2 device error ? 0: smbus interrupt not caused by transaction error. ? 1: source of smbus interrupt was the generation of a smbus transaction error. this bit is only set by hardware and can be reset by writing a 1 to this position. transaction errors are usually caused by: illegal command field, unclaimed cycle, master device time-out. 0r/w 1 smbus attention ? 0: smbus attention not caused by master command completion. ? 1: source of smbus attention was the completion of the last master command. this bit is only set by hardware and can be reset by writing a 1 to this position. 0r/w 0master busy ? 0: smbus controller master interface is not processing a command. ? 1: indicates that the smbus controller master interface is in the process of completing a command. none of the other smbus master registers should be accessed if this bit is set. 0r/o www.datasheet.in programmer?s guide bcm57xx 01/29/08 broadcom corporation document 57xx-pg105-r bcm5714 and bcm5715 tpm interface registers page 541 a uxiliary smb us m aster c ontrol c hannel 1 r egister (o ffset 0 x 6c84) this register is applicable only to the bcm5704 mac transceiver. table 486: auxiliary smbus master control channel 1 register (offset 0x6c84, bcm5704 only) bit field description init access 31-29 reserved - 0 r/o 28 smbus softreset ? 0: normal operation ? 1: resets the smbus interface 0r/w 27-20 reserved - 0 r/o 19 sm_data pin control ? 0: drive the sm_data pin low ? 1: no functional impact on the sm_data pin 0r/w 18 sm_clk pin control ? 0: drive the sm_clk pin low ? 1: no functional impact on the sm_clk pin 0r/w 17 sm_data pin current status this bit returns the value on the sm_data pin. this allows software to read the current state of the pin. 0r/o 16 sm_clk pin current status this bit returns the value on the sm_clk pin. this allows software to read the current state of the pin. 0r/o 15-11 reserved - 0 r/o 10 slave read attention enable ? 0: smbus slave will not wait for status bit to be cleared before supplying the data. ? 1: smbus slave will stretch the clock until the status bit is cleared. 0r/w 9 bit-bang interface enable ? 0: bit-bang interface disabled ? 1: bit-bang interface enabled 0r/w 8 sm bus speed ? 0: 100 hz smbus interface ? 1: 400 hz smbus interface 0r/w 7 crc/pec enable ? 0: disable crc/pec ? 1: enable crc/pec generation 0r/w 6start ? 0: has no effect. always read a 0. ? 1: execution start. writing a 1 in this field initiates smbus controller master interface to execute the command programmed in the smb command port field. 0r/w 5 reserved - 0 r/o 4-2 smbus command protocol select the type of command the smbus controller master interface will execute. reads and writes are determined by bit 0 of smbus master address register: ? 000: quick read or write ? 001: byte read or write ? 010: byte data read or write ? 011: word data read or write ? 100: reserved ? 101: block read or write ? 110: block write-block read process call ? 111: reserved 000 r/w 1kill ? 0: this will allow the master controller interface function to continue normally. ? 1: stop the current master transaction in process. this sets the failed status bit and asserts interrupt selected by the smb interrupt select field. 0r/w www.datasheet.in bcm57xx programmer?s guide 01/29/08 broadcom corporation page 542 bcm5714 and bcm5715 tpm interface registers document 57xx-pg105-r a uxiliary smb us m aster c ommand c hannel 1 r egister (o ffset 0 x 6c88) this register is applicable only to the bcm5704 mac transceiver. a uxiliary smb us b lock d ata c hannel 1 r egister (o ffset 0 x 6c8c) this register is applicable only to the bcm5704 mac transceiver. 0 interrupt enable ? 0: disable the generation of attention. ? 1: enable the generation of attention on the completion of current master transaction. 0r/w table 487: auxiliary smbus master command channel 1 register (offset 0x6c88, bcm5704 only) bit field description init access 31-24 smbus data 1 this register should be programmed with a value to be transmitted in the data 1 field of an smbus master interface word transaction. 0x00 r/w 23-16 smbus data 0 this register should be programmed with a value to be transmitted in the data 0 field of an smbus master interface word transaction. ? for block write commands, the count of the memory should be stored in this field. the value of this register is loaded into the block transfer count field. this register must be set to a value between 1 and 32 for block command counts. ? for block reads, count received from smbus device is stored here. 0x00 r/w 15-9 smbus address this field contains the 7-bit address of the targeted slave device. 0 r/w 8 smbus read or write ? 0: execute a write command ? 1: execute a read command 0r/w 7-0 smbus master command this field contains the data transmitted in the command field of smbus master transaction. 0x00 r/w table 488: auxiliary smbus block data channel 1 register (offset 0x6c8c, bcm5704 only) bit field description init access 31-8 reserved - 0 r/w 7-0 smbus block data this register is used to transfer data into or out of the block data storage array. for block read and write commands. 0x00 r/w table 486: auxiliary smbus master control channel 1 register (offset 0x6c84, bcm5704 only) (cont.) bit field description init access www.datasheet.in programmer?s guide bcm57xx 01/29/08 broadcom corporation document 57xx-pg105-r bcm5714 and bcm5715 tpm interface registers page 543 a uxiliary smb us s lave a ddress /c ontrol c hannel 1 r egister (o ffset 0 x 6c90) this register is applicable only to the bcm5704 mac transceiver. a uxiliary smb us s lave s tatus c hannel 1 r egister (o ffset 0 x 6c94) this register is applicable only to the bcm5704 mac transceiver. table 489: auxiliary smbus slave address/control channel 1 register (offset 0x6c90, bcm5704 only) bit field description init access 31-8 reserved - 0 r/w 7-1 smbus slave address -0r/w 0 slave enable ? 0: disable. ? 1: enable slave interface. 0r/w table 490: auxiliary smbus slave status channel 1 register (offset 0x6c94, bcm5704 only) bit field description init access 31-3 reserved - 0 r/w 2 slave read requested ? 0: smbus attention not caused by slave. ? 1: source of smbus attention is slave read cycle that matched the smb slave address. this bit is only set by hardware and can be reset by writing a 1 to this position. slave interface stretches the clock until this bit is cleared. 0r/w 1slave cycle complete ? 0: smbus attention not caused by slave. ? 1: source of smbus attention is completion of a slave cycle that matched the smb slave address. this bit is only set by hardware and can be reset by writing a 1 to this position. 0r/w 0slave busy ? 0: smbus controller slave interface is not processing data. ? 1: indicates that the smbus controller slave interface is in the process of receiving data. none of the other smbus slave registers should be accessed if this bit is set. 0r/o www.datasheet.in bcm57xx programmer?s guide 01/29/08 broadcom corporation page 544 bcm5714 and bcm5715 tpm interface registers document 57xx-pg105-r a uxiliary smb us s lave d ata c hannel 1 r egister (o ffset 0 x 6c98) this register is applicable only to the bcm5704 mac transceiver. a uxiliary smb us m aster s tatus c hannel 2 r egister (o ffset 0 x 6cc0) this register is applicable only to the bcm5704 mac transceiver. table 491: auxiliary smbus slave data channel 1 register (offset 0x6c98, bcm5704 only) bit field description init access 31-22 reserved - 0 r/w 21-16 write byte count indicates the number of bytes written into the fifo by the smbus master. 0r/w 15-14 reserved - 0 r/w 13-8 read byte count indicates the number of bytes read from the fifo by the host. 0r/w 7-0 slave data - 0 r/o table 492: auxiliary smbus master status channel 2 register (offset 0x6cc0, bcm5704 only) bit field description init access 31-8 reserved - 0 r/o 7 crc/pec error ? 0: no crc/pec error detected. ? 1: crc/pec error detected. this bit is only set by hardware and can be reset by writing a 1 to this position. 0r/w reserved - 0 r/o 6:5 reserved - 0 r/o 4failed ? 0: smbus attention not caused by kill bit. ? 1: source of the smbus attention is a failed bus transaction, set when kill bit in smb master control register is set. this bit is only set by hardware and can be reset by writing a one to this position. 0r/w 3 bus collision ? 0: smbus attention not caused by transaction collision. ? 1: source of smbus attention was a transaction collision.this bit is only set by hardware and can be reset by writing a 1 to this position. 0r/w 2 device error ? 0: smbus interrupt not caused by transaction error. ? 1: source of smbus interrupt was the generation of a smbus transaction error. this bit is only set by hardware and can be reset by writing a 1 to this position. transaction errors are usually caused by illegal command field, unclaimed cycle, or master device time-out. 0r/w www.datasheet.in programmer?s guide bcm57xx 01/29/08 broadcom corporation document 57xx-pg105-r bcm5714 and bcm5715 tpm interface registers page 545 a uxiliary smb us m aster c ontrol c hannel 2 r egister (o ffset 0 x 6cc4) this register is applicable only to the bcm5704 mac transceiver. 1 smbus attention ? 0: smbus attention not caused by master command completion. ? 1: source of smbus attention was the completion of the last master command. this bit is only set by hardware and can be reset by writing a 1 to this position. 0r/w 0master busy ? 0: smbus controller master interface is not processing a command. ? 1: indicates that the smbus controller master interface is in the process of completing a command. none of the other smbus master registers should be accessed if this bit is set. 0r/o table 493: auxiliary smbus master control channel 2 register (offset 0x6cc4, bcm5704 only) bit field description init access 31-29 reserved - 0 r/o 28 smbus softreset ? 0: normal operation. ? 1: resets the smbus interface. 0r/w 27-20 reserved - 0 r/o 19 sm_data pin control ? 0: drive the sm_data pin low. ? 1: no functional impact on the sm_data pin. 0r/w 18 sm_clk pin control ? 0: drive the sm_clk pin low. ? 1: no functional impact on the sm_clk pin. 0r/w 17 sm_data pin current status this bit returns the value on the sm_data pin. this allows software to read the current state of the pin. 0r/o 16 sm_clk pin current status this bit returns the value on the sm_clk pin. this allows software to read the current state of the pin. 0r/o 15-11 reserved - 0 r/o 10 slave read attention enable ? 0: smbus slave will not wait for status bit to be cleared before supplying the data. ? 1: smbus slave will stretch the clock until the status bit is cleared 0r/w 9 bit-bang interface enable ? 0: bit-bang interface disabled. ? 1: bit-bang interface enabled. 0r/w 8 sm bus speed ? 0: 100 hz smbus interface. ? 1: 400 hz smbus interface. 0r/w 7 crc/pec enable ? 0: disable crc/pec. ? 1: enable crc/pec generation. 0r/w 6start ? 0: has no effect. always read a 0. ? 1: execution start. writing a 1 in this field initiates smbus controller master interface to execute the command programmed in the smb command port field 0r/w 5 reserved - 0 r/o table 492: auxiliary smbus master status channe l 2 register (offset 0x6cc0, bcm5704 only) (cont.) bit field description init access www.datasheet.in bcm57xx programmer?s guide 01/29/08 broadcom corporation page 546 bcm5714 and bcm5715 tpm interface registers document 57xx-pg105-r a uxiliary smb us m aster c ommand c hannel 2 r egister (o ffset 0 x 6cc8) this register is applicable only to the bcm5704 mac transceiver. 4-2 smbus command protocol select the type of command the smbus controller master interface will execute. reads and writes are determined by bit 0 of smbus master address register: ? 000: quick read or write ? 001: byte read or write ? 010: byte data read or write ? 011: word data read or write ? 100: reserved ? 101: block read or write ? 110: block write-block read process call ? 111: reserved 000 r/w 1kill ? 0: this will allow the master controller interface function to continue normally. ? 1: stop the current master transaction in process. this sets the failed status bit and asserts interrupt selected by the smb interrupt select field. 0r/w 0 interrupt enable ? 0: disable the generation of attention. ? 1: enable the generation of attention on the completion of current master transaction. 0r/w table 494: auxiliary smbus master command channel 2 register (offset 0x6cc8, bcm5704 only) bit field description init access 31-24 smbus data 1 this register should be programmed with a value to be transmitted in the data 1 field of an smbus master interface word transaction. 0x00 r/w 23-16 smbus data 0 this register should be programmed with a value to be transmitted in the data 0 field of an smbus master interface word transaction. ? for block write commands, the count of the memory should be stored in this field. the value of this register is loaded into the block transfer count field. this register must be set to a value between 1 and 32 for block command counts. ? for block reads, count received from smbus device is stored here. 0x00 r/w 15-9 smbus address this field contains the 7-bit address of the targeted slave device. 0 r/w 8 smbus read or write ? 0: execute a write command. ? 1: execute a read command. 0r/w 7-0 smbus master command this field contains the data transmitted in the command field of smbus master transaction. 0x00 r/w table 493: auxiliary smbus master control channel 2 register (offset 0x6cc4, bcm5704 only) (cont.) bit field description init access www.datasheet.in programmer?s guide bcm57xx 01/29/08 broadcom corporation document 57xx-pg105-r bcm5714 and bcm5715 tpm interface registers page 547 a uxiliary smb us b lock d ata c hannel 2 r egister (o ffset 0 x 6ccc) this register is applicable only to the bcm5704 mac transceiver. a uxiliary smb us s lave a ddress /c ontrol c hannel 2 r egister (o ffset 0 x 6cd0) this register is applicable only to the bcm5704 mac transceiver. a uxiliary smb us s lave s tatus c hannel 2 r egister (o ffset 0 x 6cd4) this register is applicable only to the bcm5704 mac transceiver. table 495: auxiliary smbus block data channel 2 register (offset 0x6ccc, bcm5704 only) bit field description init access 31-8 reserved - 0 r/w 7-0 smbus block data this register is used to transfer data into or out of the block data storage array. for block read and write commands. 0x00 r/w table 496: auxiliary smbus slave address/control channel 2 register (offset 0x6cd0, bcm5704 only) bit field description init access 31-8 reserved - 0 r/w 7-1 smbus slave address - 0 r/w 0 slave enable ? 0: disable. ? 1: enable slave interface. 0r/w table 497: auxiliary smbus slave status channel 2 register (offset 0x6cd4, bcm5704 only) bit field description init access 31-3 reserved - 0 r/w 2 slave read requested ? 0: smbus attention not caused by slave. ? 1: source of smbus attention is slave read cycle that matched the smb slave address. this bit is only set by hardware and can be reset by writing a 1 to this position. slave interface stretches the clock until this bit is cleared. 0r/w 1slave cycle complete ? 0: smbus attention not caused by slave. ? 1: source of smbus attention is completion of a slave cycle that matched the smb slave address. this bit is only set by hardware and can be reset by writing a 1 to this position. 0r/w 0slave busy ? 0: smbus controller slave interface is not processing data. ? 1: indicates that the smbus controller slave interface is in the process of receiving data. none of the other smbus slave registers should be accessed if this bit is set. 0r/o www.datasheet.in bcm57xx programmer?s guide 01/29/08 broadcom corporation page 548 bcm5714 and bcm5715 tpm interface registers document 57xx-pg105-r a uxiliary smb us s lave d ata c hannel 2 r egister (o ffset 0 x 6cd8) this register is applicable only to the bcm5704 mac transceiver. table 498: auxiliary smbus slave data channel 2 register (offset 0x6cd8, bcm5704 only) bit field description init access 31-22 reserved - 0 r/w 21-16 write byte count indicates the number of bytes written into the fifo by the smbus master. 0r/w 15-14 reserved - 0 r/w 13-8 read byte count indicates the number of bytes read from the fifo by the host. 0r/w 7-0 slave data - 0 r/o www.datasheet.in programmer?s guide bcm57xx 01/29/08 broadcom corporation document 57xx-pg105-r non-volatile memory interface registers (not applicable to bcm5700 or bcm5701) page 549 n on -v olatile m emory i nterface r egisters (n ot a pplicable to bcm5700 or bcm5701) table 499: non-volatile memory interface registers address description 0x7000 nvm command register 0x7004 reserved 0x7008 nvm write register 0x700c nvm address register 0x7010 nvm read register 0x7014 nvm config 1 register 0x7018 nvm config 2 register 0x701c nvm config 3 register 0x7020 software arbitration register 0x7024 nvm access register 0x7028 nvm write1 register 0x702c nvm arbitration watchdog timer register www.datasheet.in bcm57xx programmer?s guide 01/29/08 broadcom corporation page 550 non-volatile memory interface registers (not applicable to bcm5700 or bcm5701) document 57xx-pg105-r nvm c ommand r egister (o ffset 0 x 7000) this register is not applicable to the bcm5700 and bcm5701 mac transceivers. table 500: nvm command register (offset 0x7000) bit field description init access 31-28 policy error reports address lockout policy error violations. 0 r/o reserved (other devices) 28-20 reserved 19 wrsr (bcm5714 and bcm5715 only) the write status register command bit. setting to 1 makes the flash interface state machine generate wrsr_cmd(0x1, hard-wired) to the flash device through the spi interface to set the status register of the flash device to be written with sr_data. for sst25vf512 only. 0r/w 18 ewsr (bcm5714 and bcm5715 only) the enable write status register command bit. setting to 1 makes the flash interface state machine generate ewsr_cmd(0x50, hard- wired) to the flash device through the spi interface to set the status register of the flash device to be write-enabled. for sst25vf512 only. 0r/w 17 wrdi (bcm5714 and bcm5715 only) the write disable command bit. setting to 1 makes the flash interface state machine generate wrdi_cmd (see 0x7028) to the flash device through the spi interface to set the flash device to be write-disabled. used for the device with protection function. r/w 16 wren (bcm5714 and bcm5715 only) the write enable command bit. setting to 1 makes the flash interface state machine generate wren_cmd (see 0x7028) to the flash device through the spi interface to set the flash device to be write-enabled. used for the device with protection function. 0r/w 15-9 reserved - 0 r/o 8 last when this bit is set, the next command sequence is interpreted as the last one of a burst and any cleanup work is done. this means that the buffer is written to flash memory if needed on a write. 0 r/w 7 first this bit is passed to the see_fsm or spi_fsm if the pass_mode bit is set. 0 r/w 6 erase the erase command bit. set high to execute an erase. this bit is ignored if the wr is clear. 0 r/w 5 wr the write/not_read command bit. set to execute write or erase. 0 r/w 4 doit command from software to start the defined command. the done bit must be clear before setting this bit. this bit is self clearing and will remain set while the command is active. 0 r/w 3 done sequence completion bit that is asserted when the command requested by assertion of the doit bit has completed. the done bit will be cleared while the command is in progress. the done bit will stay asserted until doit is reasserted or the done bit is cleared by writing a 1 to the done bit. the done bit is the flsh_attn signal. 0 wtc 2-1 reserved - 0 r/o 0 reset when set, the entire nvm state machine is reset. this bit is self clearing. 0 r/w www.datasheet.in programmer?s guide bcm57xx 01/29/08 broadcom corporation document 57xx-pg105-r non-volatile memory interface registers (not applicable to bcm5700 or bcm5701) page 551 nvm s tatus r egister (0 x 7004h) nvm w rite r egister (o ffset 0 x 7008) this register is not applicable to the bcm5700 and bcm5701 mac transceivers. nvm a ddress r egister (o ffset 0 x 700c) this register is not applicable to the bcm5700 and bcm5701 mac transceivers. table 501: nvm status register (0x7004h) bit field description init access 31-13 reserved - 7-4 see_fsm state state machine values (tbd) 0 r/o 7-4 see_fsm state state machine values (tbd) 0 r/o 3-0 spi_fsm state state machine values (tbd) 0 r/o table 502: nvm write register (offset 0x7008) bit field description init access 31-0 wrdata (bcm5721, bcm5751, bcm5752, bcm5714, and bcm5715 only) 32 bits of write data are used when write commands are executed. when bitbang_mode is set, bits 0 to 3 control the drive value of the sck, cs_l, so, and si pins respectively. 0 r/w wrdata (BCM5703, bcm5704, and bcm5705 only) 32 bits of write data are used when write commands are executed. when bitbang_mode is set, bits 0 to 5 control the drive value of the scl, sda, sck, cs_l, so, and si pins respectively. when pass_mode is set bits 7:0 will be the data to be written to eeprom or flash device. 0r/w table 503: nvm address register (offset 0x700c) bit field description init access 31-24 reserved - 0 r/o 23-0 wraddr (bcm5721, bcm5751, bcm5752, bcm5714, and bcm5715 only) 24-bit address value. when bitbang_mode is set, bits 0 to 3 control the oe value of the sck, cs_l, so, and si pins respectively. note: the oe of scl, sda, and si is active high and the oe of sck, cs_l, and so is active low. 0 r/w wraddr (BCM5703, bcm5704, and bcm5705 only) 24-bit address value. when bitbang_mode is set, bits 0 to 5 control the oe value of the sc l, sda, sck, cs_l, so, and si pins respectively. 0r/w www.datasheet.in bcm57xx programmer?s guide 01/29/08 broadcom corporation page 552 non-volatile memory interface registers (not applicable to bcm5700 or bcm5701) document 57xx-pg105-r nvm r ead r egister (o ffset 0 x 7010) this register is not applicable to the bcm5700 and bcm5701 mac transceivers. nvm c onfig 1 r egister (o ffset 0 x 7014) this register is not applicable to the bcm5700 and bcm5701 mac transceivers. table 504: nvm read register (offset 0x7010) bit field description init access 31-0 rddata (bcm5721, bcm5751, bcm5752, bcm5714, and bcm5715 only) 32 bits of read data are used when read commands are executed. when bitbang_mode is set, bits 0 to 3 reflect the current input value of the sck, cs_l, so, and si pins respectively. 0 r/w (bcm5752 only) r/o (all other devices) rddata (BCM5703, bcm5704, and bcm5705 only) 32 bits of read data are used when read commands are executed. when bitbang_mode is set, bits 0 to 5 reflect the current input value of the scl, sda, sck, cs_l, so, and si pins respectively. when pass_mode is set, bits 7:0 will be the data read from eeprom or flash device. 0r/w table 505: nvm config 1 register (offset 0x7014) bit field description init access 31 compat_bypass enable the 5701 legacy seeprom interface to bypass this interface. 0 r/w 30-28 pagesize (bcnm5752 only) these bits indicate the page size of the attached flash device. they are set automatically depending on the chosen flash as indicated by the strapping option pins. page sizes are as follows: ? 000b = 256 bytes ? 001b = 512 bytes ? 010b = 1024 bytes ? 011b = 2048 bytes ? 100b = 4096 bytes ? 101b = 264 bytes ? 110b = reserved ? 111b = reserved depends on flash strapping r/w 27 address lockout enable status (bcm5752 only) this bit will be set if the address lockout feature is active; it will be clear otherwise. this bit is read only. its state can be changed only via a strapping option or bonding option. depends on address lockout enable state r/o reserved (other devices) 0r/o www.datasheet.in programmer?s guide bcm57xx 01/29/08 broadcom corporation document 57xx-pg105-r non-volatile memory interface registers (not applicable to bcm5700 or bcm5701) page 553 26 safe erase (bcm5752 only) when mimicking buffered behavior with an unbuffered flash, this bit controls whether a page erase occurs as the result of a write first or a write last. if the bit is clear, then the erase will be issued as part of the write first operation. if the bit is set, then the erase shall be issued the first step in a write last operation. clearing the bit may result in higher performance, as the erase occurs concurrent with the write more operations. setting the bit may result in improved data integrity, as the erase is not started until the flash controller is ready to write back the entire page. 1r/w reserved (other devices) 0r/o 25 flash size (bcm5721, 5751, 5752, 5714, and 5715 only) set this bit for a 1-mb device or 0 for a 512-kb device. hard_reset, grc_reset, and setting command register bit 0 will reset this bit to pin strap. pin r/w 24 protect mode (bcm5721, 5751, 5752, 5714, and 5715 only) set this bit for flash devices that implement a write protect function. hard_reset, grc_reset, and setting command register bit 0 will reset this bit to pin strap. pin r/w 23-22 reserved - 0 r/o 21-11 see_clk_div this field is a divisor used to create all 1x times for all seeprom interface i/o pin timing definitions. a value of 0 means that an scl transitions at a minimum of each core_clk rising edge. the equation to calculate the clock frequency for scl is: core_clk /((see_clk_div + 1) * 4) note: scl is four times slower than 1x time. the default value corresponds to 1.42mhz for bcm5752 and 370 khz for other devices. 16 for bcm5752 only 44 for other devices r/w 10-7 spi_clk_div this field is a divisor used to create all 1x times for all flash interface i/o pin timing definitions. a divisor of 0 means that an sck transitions at minimum of each core_clk rising edge. the equation to calculate the clock frequency for sck is: core_clk /((spi_clk_div +1) *2) note: sck is two times slower than 1x time. the default value corresponds to 6.6 mhz. 4r/w 6-4 status bits this field represents the bit offset in the status command response to interpret as the ready flag. ? 0 if flash_mode = 1 ? 7 if buffer_mode = 1 ? x otherwise r/w 3 bitbang_mode enable bit-bang mode to control pins. 0 r/w 2 pass mode enables pass-through mode to the byte level spi and see state machines. 0r/w 1 buffer_mode enable ssram buffered interface mode. pin r/w 0 flash_mode enable flash interface mode. pin r/w table 505: nvm config 1 register (offset 0x7014) (cont.) bit field description init access www.datasheet.in bcm57xx programmer?s guide 01/29/08 broadcom corporation page 554 non-volatile memory interface registers (not applicable to bcm5700 or bcm5701) document 57xx-pg105-r nvm c onfig 2 r egister (o ffset 0 x 7018) this register is not applicable to the bcm5700 and bcm5701 mac transceivers. nvm c onfig 3 r egister (o ffset 0 x 701c) this register is not applicable to the bcm5700 and bcm5701 mac transceivers. table 506: nvm config 2 register (offset 0x7018) bit field description init access 31-24 reserved - 0 r/o 23-16 status command this command is used to poll the ready status of the flash device after a command. ? 0x9f if flash_mode = 1 ? 0x57 if buffer_mode = 1 ? 0x5f if protect_mode = 1 r/w 15-8 dummy value for dummy bytes added to commands. x r/w 7-0 erase command flash device erase command. the ready status is polled after this command. ? 0x20 if flash_mode = 1 ? 0x81 if buffer_mode = 1 ? 0xd8h if protect_mode = 1 r/w table 507: nvm config 3 register (offset 0x701c) bit field description init access 31-24 read_cmd this is the flash/seeprom read command. following this command, any number of bytes may be read up to the end of the flash memory. for seeprom (flash_mode=0), this is seeprom read command. bits[26:25] are address bits a1 and a0 of seeprom. user should modify those two bits based on the value of a1 and a0 assigned to this seeprom device. ? 0xff if flash_mode = 1 ? 0x68 if buffer_mode = 1 ? 0x03 if protect_mode = 1 ? 0xa1 otherwise r/w 23-16 buffer_write_cmd if buffer mode is being used, then this command will be executed at the end of a complete write operation. 0x84 if buffer_mode = 1 r/w 15-8 write_cmd command to write one byte to the flash array or ssram buffer, depending on the value of buffer_mode. if buffer_mode is not active, then this command will poll for ready status when complete. for seeprom (flash_mode=0), this is seeprom write command. bits[10:9] are address bits a1 and a0 of seeprom. user should modify those two bits based on the value of a1 and a0 assigned to this seeprom device. ? 0x10 if flash_mode = 1 ? 0x83 if buffer_mode = 1 ? 0xa0 otherwise r/w 7-0 buffer_rd_cmd command to transfer flash value to buffer. this command is executed before the first write command to a new page after the erase command has be executed. 0x53 if buffer_mode = 1 r/w www.datasheet.in programmer?s guide bcm57xx 01/29/08 broadcom corporation document 57xx-pg105-r non-volatile memory interface registers (not applicable to bcm5700 or bcm5701) page 555 s oftware a rbitration r egister (o ffset 0 x 7020) this register is not applicable to the bcm5700 mac and bcm5701 mac transceivers. this register is used to allow multiple software entities access to nvram in a controlled fashion and with a predictable priority scheme. the input signal arb_req and output signal arb_gnt will be used to chain multiple chip core together. in the multiple core implementation, the input signal arb_req of the first core in the chain will be connected to ground, and the output signal arb_gnt will be connected to arb_req of next core. when arb_gnt is high, the arb request of next core will be masked. table 508: software arbitration register (offset 0x7020) bit field description init access 31-24 reserved - 0 r/o 23 req5 (bcm5752 only) software request bit 5. a 1 in this bit indicates that the request5 is active 0r/o 22 arb_won5 (bcm5752 only) arbitration won bit 5(see bit 8, arb_won0). 0 r/o 21 req_clr5 (bcm5752 only) write a 1 to this bit to clear the req5 bit. x wo 20 req_set5 (bcm5752 only) write a 1 to this bit to set the req5 bit. x wo 19 req4 (bcm5721, bcm5751, bcm5752, bcm5714, and bcm5715 only) software request bit 4. a 1 in this bit indicates that the request4 is active 0r/o 18 arb_won4 (bcm5721, bcm5751, bcm5752, bcm5714, and bcm5715 only) arbitration won bit 4 (see bit 8, arb_won0). 0 r/o 17 req_clr4 (bcm5721, bcm5751, bcm5752, bcm5714, and bcm5715 only) write a 1 to this bit to clear the req4 bit. x wo 16 req_set4 (bcm5721, bcm5751, bcm5752, bcm5714, and bcm5715 only) write a 1 to this bit to set the req4 bit. x wo 15 req3 software request bit 3. a 1 in this bit indicates that the request3 is active. 0 r/o 14 req2 software request bit 2. a 1 in this bit indicates that the request2 is active. 0 r/o 13 req1 software request bit 1. a 1 in this bit indicates that the request1 is active. 0 r/o 12 req0 software request bit 0. when req_set0 bit is set, this bit will be set. 0 r/o 11 arb_won3 arbitration won bit 3 (see bit 8, arb_won0). 0 r/o 10 arb_won2 arbitration won bit 2 (see bit 8, arb_won0). 0 r/o 9 arb_won1 arbitration won bit 1 (see bit 8, arb_won0). 0 r/o www.datasheet.in bcm57xx programmer?s guide 01/29/08 broadcom corporation page 556 non-volatile memory interface registers (not applicable to bcm5700 or bcm5701) document 57xx-pg105-r nvm a ccess r egister (o ffset 0 x 7024) this register is applicable for the bcm5721, bcm5751, bcm5752, bcm5714, and bcm5715 only. 8 arb_won0 when req0 arbitration is won, this bit will be read as 1. when an operation is complete, then req_clr0 must be written to clear this bit. at that point, the next high priority arb bit will be set if requested. at any time, only one of the arb_won[5:0] bits will be read as a 1. arb0 has highest priority, and arb5 has lowest priority. 0 r/o 7 req_clr3 write a 1 to this bit to clear the req3 bit. wo 6 req_clr2 write a 1 to this bit to clear the req2 bit. wo 5 req_clr1 write a 1 to this bit to clear the req1 bit. wo 4 req_clr0 write a 1 to this bit to clear the req0 bit. wo 3 req_set3 write a 1 to this bit to set the req3 bit. wo 2 req_set2 write a 1 to this bit to set the req2 bit. wo 1 req_set1 write a 1 to this bit to set the req1 bit. wo 0 req_set0 set software arbitration request bit 0. this bit is set by writing a 1. wo note: by convention, the bcm57xx bootcode has the highest priority for nvram access. it uses software request 0 followed by host driver software, which us es software request 1. when the host driver software downloads optional firmware to the bcm57xx (see ?firmware download? on page 162 ), one of the required steps is to stop the rx risc cpu. if the rx risc cpu is executing bootcode and the arb_won0 bit is set when the cpu is stopped, the host driver software must also set the req_clr0 bit to release the nvram lock held by the bootcode, otherwise, no other software is able to access nvram until the bcm57xx is reset. table 509: nvm access register (offset 0x7024) bit field description init access 31-2 reserved - 0 r/o 1 nvm access write enable when set, allows the nvram write command (see the wr bit in the table 500 on page 550 ) to be issued even if the nvram write enable bit of the mode control register (see table 429 on page 502 ) is 0. 0r/w 0 nvm access enable when clear, prevents write access to all other nvm registers, except for the software arbitration register (see table 508 on page 555 ). 0r/w table 508: software arbitration register (offset 0x7020) (cont.) bit field description init access www.datasheet.in programmer?s guide bcm57xx 01/29/08 broadcom corporation document 57xx-pg105-r non-volatile memory interface registers (not applicable to bcm5700 or bcm5701) page 557 nvm w rite 1 r egister (o ffset 0 x 7028) this register is applicable for the bcm5721, bcm5751, bcm5752, bcm5714, and bcm5715 only. nvm a rbitration w atchdog t imer r egister (o ffset 0 x 702c) this register is applicable for the bcm5721, bcm5751, bcm5752, bcm5714, and bcm5715 only. table 510: nvm write1 register (offset 0x7028) bit field description init access 31-24 reserved - 0 r/o 23-16 status register data data written to the status register for the sst25vf512. 0 r/w 15-8 write disable command flash command to be used when a flash device with a write protect function is used. this command is issued by the flash interface state machine through the spi interface to write- protect the flash. 0x4 r/w 7-0 write enable command flash command to be used when a flash device with a write protect function is used. this command is issued by the flash interface state machine through the spi interface to write- enable the flash. 0x6 r/w table 511: nvm arbitration watchdog timer register (offset 0x702c) bit field description init access 31-28 tpm arbitration lock timer (bcm5752 only) this field holds a delay in milliseconds until the tpm will be allowed to access the flash, even if the lan has not yet set req0,req1,req2,req3. 1r/w reserved - 0 r/o 27-24 tpm watchdog timer value this field is the value of the tpm watchdog timer in milliseconds. 0r/w 23-6 reserved - 0 r/o 5 tpm arbitration lock timer enable (bcm5752 only) enable arbitration lock timer to allow tpm access to flash after timeout if lan has not already requested flash access. 1r/w reserved (other devices) 0r/o 4 tpm watchdog timer enable when set, enables a watchdog timer that releases the gnt4/ req4 bits of the software arbitration register (see table 508 on page 555 ) upon expiration of watchdog timer. in case of bcm5752, the gnt5/req5 bits are also released along with gnt4/req4 bits. 0r/w 3-0 reserved - 0 r/o www.datasheet.in bcm57xx programmer?s guide 01/29/08 broadcom corporation page 558 bist registers document 57xx-pg105-r a ddress l ockout b oundary r egister (o ffset 0 x 7030) this register is applicable for the bcm5752 only. bist r egisters the below register definitions are applicable to bcm5721, bcm5751, and bcm5752 only. the below register definitions are applicable to bcm5714 and bcm5715 only. table 512: address lockout boundary register (offset 0x7030) bit field description init access 31-24 reserved - 0 r/o 23-0 address lockout boundary this register holds the physical address boundary between lan and tpm space in the flash. when the address-based lockout feature is enabled, the lan shall not be able to access flash addresses beyond this value. 0r/w table 513: bist registers (applicable to bcm5721, bcm5751, and bcm5752 only) address description 0x7400 bist control register 0x7404 bist status register table 514: bist registers (applicable to the bcm5714 and bcm5715 only) address description 0x7400 bist mode register 0x7404 bist status register 0x7408 bist control register www.datasheet.in programmer?s guide bcm57xx 01/29/08 broadcom corporation document 57xx-pg105-r bist registers page 559 bist c ontrol r egister (o ffset 0 x 7400) this register definition is applicable to bcm5721, bcm5751, and bcm5752 only. bist s tatus r egister (o ffset 0 x 7404) this register definition is applicable to bcm5721, bcm5751, and bcm5752 only. table 515: bist control register (offset 0x7400, bcm5721, bcm5751, and bcm5752 only) bit field description init access 31-6 reserved - 5 bist_sel when set, the internal bist control is selected. when clear, the external control is selected. this bit is overridden by bist external. 0 r/w 4 bih memory burn in. 0 r/w 3 bist_rm trim bit. 0 r/w 2bist_ccmtrim bit. 0 r/w 1 bist_en enable internal bist. 0 r/w 0 bist_reset bist reset. 0 r/w table 516: bist status register (offset 0x7404, bcm5721, bcm5751, and bcm5752 only) bit field description init access 31-8 reserved - 9 fb_bist_fail (bcm5752 only) status indicating flash buffer bist test has failed. 0 r/o 8 fb_bist_done (bcm5752 only) status indicating flash buffer bist test has completed. 0 r/o 7 rb_bist_fail status indicating bist test has failed. 0 r/o 6 rb_bist_done status indicating bist has completed when set (retry buffer). 0r/o 5 ms_bist_fail status indicating bist test has failed. 0 r/o 4 ms_bist_done status indicating bist has completed when set (misc_bd). 0 r/o 3 tx_bist_fail status indicating bist test has failed. 0 r/o 2 tx_bist_done status indicating bist has completed when set (txmbuf). 0 r/o 1 rx_bist_fail status indicating bist test has failed. 0 r/o 0 rx_bist_done status indicating bist has completed when set (rxmbuf). 0 r/o www.datasheet.in bcm57xx programmer?s guide 01/29/08 broadcom corporation page 560 bist registers document 57xx-pg105-r bist m ode r egister (0 x 7400h) this register definition is applicable to bcm5714 and bcm5715 only. bist s tatus r egister (0 x 7404h) this register definition is applicable to bcm5714 and bcm5715 only. table 517: bist mode register (0x7400h, bcm5714c and bcm5714s only) bit field description init access 31-2 reserved - 0 r/o 1 internal mbist mode sel - 0 r/w 0 mbist_reset_l resets mbist logic 0 r/w table 518: bist status register (0x7404h, bcm5714 and bcm5715 only) bit field description init access 31-12 reserved 0 r/o 11 ump_rxfio_mbist_fail - 0 r/o 10 ump_rxfio_mbist_done - 1 r/o 9 ump_txfio_mbist_fail - 0 r/o 8 ump_txfio_mbist_done - 1 r/o 7 isram_mbist_fail - 0 r/o 6 isram_mbist_done - 1 r/o 5 rxmbuf_mbist_fail - 0 r/o 4 rxmbuf_mbist_done - 1 r/o 3 txmbuf_mbist_fail - 0 r/o 2 tmbuf_mbist_done - 1 r/o 1 miscbd_mbist_fail - 0 r/o 0 miscbd_mbist_done - 1 r/o www.datasheet.in programmer?s guide bcm57xx 01/29/08 broadcom corporation document 57xx-pg105-r bist registers page 561 bist c ontrol r egister (0 x 7408h) this register definition is applicable to bcm5714 and bcm5715 only. table 519: bist control register (0x7408h, bcm5714 and bcm5715 only) bit field description init access 29 ump_rxfio_mbist_dmpen - 0 r/w 28 ump_rxfio _mbist_dbgen - 0 r/w 27 ump_rxfio _mbist_hold_l - 1 r/w 26 ump_rxfio_mbist_en - 0 r/w 25 ump_txfio_mbist_dmpen - 0 r/w 24 ump_txfio_mbist_dbgen - 0 r/w 23 ump_txfio _mbist_hold_l - 1 r/w 22 ump_txfio_mbist_en - 0 r/w 21 isram_mbist_dmp_en - 0 r/w 20 isram_mbist_dbg_en - 0 r/w 19 isram_mbist_hold_l - 1 r/w 18 isram_mbist_en - 0 r/w 17 rxmbuf_mbist_dmp_en - 0 r/w 16 rxmbuf_mbist_dbg_en - 0 r/w 15 rxmbuf_mbist_hold_l - 1 r/w 14 rxmbuf_rm - 0 r/w 13 rxmbuf_ccm - 0 r/w 12 rxmbuf_mbist_en - 0 r/w 11 txmbuf_mbist_dmp_en - 0 r/w 10 txmbuf_mbist_dbg_en - 0 r/w 9 txmbuf_mbist_hold_l - 1 r/w 8txmbuf_rm - 0 r/w 7 txmbuf_ccm - 0 r/w 6 txmbuf_mbist_en - 0 r/w 5 miscbd_mbist_dmp_en - 0 r/w 4 miscbd_mbist_dbg_en - 0 r/w 3 miscbd_mbist_hold_l - 1 r/w 2miscbd_rm - 0 r/w 1 miscbd_ccm - 0 r/w 0 miscbd_mbist_en - 0 r/w www.datasheet.in bcm57xx programmer?s guide 01/29/08 broadcom corporation page 562 uart registers document 57xx-pg105-r uart r egisters all registers in this section are specific to the bcm5721 and bcm5751 only. dlab is bit 7 of the line control register (lcr). it enables reading and writing of the divisor latch registers to set the baud rate of the uart. below is the summary of the uart register map. uart r eceive b uffer (dlab=0, r/o) r egister (o ffset 0 x 7800) table 520: uart register map summary dlab address description init access 0 0x7800 receive buffer register (rbr) 0x00 ro 0 0x7800 transmit holding register (thr) 0x00 wo 1 0x7800 divisor latch (low) (dll) 0x00 r/w 0 0x7804 interrupt enable register (ier) 0x00 r/w 1 0x7804 divisor latch (high) (dlh) 0x00 r/w x 0x7808 interrupt identity register (iir) 0x01 ro x 0x7808 fifo control register (fcr) 0x00 wo x 0x780c line control register (lcr) 0x00 r/w x 0x7810 modem control register (mcr) 0x00 r/w x 0x7814 line status register (lsr) 0x60 ro x 0x7818 modem status register (msr) 0x00 ro x 0x781c scratch register (scr) 0x00 r/w table 521: uart receive buffer (dlab=0) register (offset 0x7800) bit field description init access 7-0 rbr the data in this register is valid only if the data ready (dr) bit in the line status register (lsr) is set. in the non-fifo mode, the data in the rbr must be read before the next data arrives, otherwise, it is overwritten, resulting in an overrun error. in fifo mode, this register accesses the head of the receive fifo. if the receive fifo is full and this register is not read before the next data character arrives, then the data already in the fifo is preserved, but any incoming data is lost and an overrun error occurs. 0x00 r/o www.datasheet.in programmer?s guide bcm57xx 01/29/08 broadcom corporation document 57xx-pg105-r uart registers page 563 uart t ransmit h olding (dlab=0, w/o) r egister (o ffset 0 x 7800) uart d ivisor l atch (l ow ) (dlab=1) r egister (o ffset 0 x 7800) uart i nterrupt e nable (dlab=0) r egisters (o ffset 0 x 7804) uart d ivisor l atch h igh (dlab=1) r egister (o ffset 0 x 7804) table 522: uart transmit holding (dlab=0) register (offset 0x7800) bit field description init access 7-0 thr thr contains data to be transmitted on the serial output port (out). data can be written to the thr any time that the thr empty (thre) bit of the lsr is set. if fifos are not enabled and thre is set, writing a single character to the thr clears the thre. any additional writes to the thr before the shasta register specification thre is set again, causes the thr data to be overwritten. 0x00 w/o table 523: uart divisor latch (low) (dlab=1) register (offset 0x7800) bit field description init access 7-0 dll the dlh register in conjunction with the dll register forms a 16-bit, read/write, divisor latch register that contains the baud rate divisor for the uart. it is accessed by first setting the dlab bit in the line control register. the output baud rate is equal to the input clock frequency divided by 16 times the value of the baud rate divisor. baud= (clock freq) / (16 * divisor) 0x00 r/w table 524: uart interrupt enable (dlab=0) register (offset 0x7804) bit field description init access 7-4 reserved - 0w/o 3 edssi enable modem status interrupt 0 r/w 2 elsi enable receiver line status interrupt 0 r/w 1 etbei enable transmitter holding register empty interrupt 0 r/w 0 erbfi enable received data available interrupt divisor latch (high) (dlh) (dlab=1) 0 r/w table 525: uart divisor latch high (dlab=1) register (offset 0x7804) bit field description init access 7-0 dlh divisor latch (high) 0x00 r/w www.datasheet.in bcm57xx programmer?s guide 01/29/08 broadcom corporation page 564 uart registers document 57xx-pg105-r uart i nterrupt i dentity r egister (o ffset 0 x 7808, r/o) uart fifo c ontrol r egister (o ffset 0 x 7808, w/o) table 526: uart interrupt identity register (offset 0x7808) bit field description init access 7-6 ? 00: fifo disable ? 11: fifo enable 0x0 r/o 5-4 reserved - 0x0 r/o 3-0 interrupt id ? 0000: modem status changed ? 0001: no interrupt pending ? 0010: thr empty ? 0100: received data available ? 0110: receiver status ? 1100: character time out 0x1 r/o table 527: uart fifo control register (offset 0x7808) bit field description init access 7-6 rcvr trigger ? 00: 1 byte in fifo ? 01: 4 bytes in fifo ? 10: 8 bytes in fifo ? 11: 14 bytes in fifo 0w/o 5-4 reserved - 0w/o 3 - dma mode 0 w/o 2 - xmit fifo reset 0 w/o 1 - rcvr fifo reset 0 w/o 0 - fifo enable 0 w/o www.datasheet.in programmer?s guide bcm57xx 01/29/08 broadcom corporation document 57xx-pg105-r uart registers page 565 uart l ine c ontrol r egister (o ffset 0 x 780c) uart m odem c ontrol r egister (o ffset 0 x 7810) uart l ine s tatus r egister (o ffset 0 x 7814) table 528: uart line control register (offset 0x780c) bit field description init access 7 dlab divisor latch access bit 0 r/w 6 break break control. 1- sends a break signal by holding the sout line low. 0 r/w 5 stick parity not used 0 r/w 4 eps parity select bit 0 r/w 3 pen parity enable 0 r/w 2 stop number of stop bits. ? 0: 1 bit ? 1: 2 bits 0r/w 1:0 cls number of bits per character. ? 00: 5 bits ? 01: 6 bits ? 10: 7 bits ? 11: 8 bits 0r/w table 529: uart modem control register (offset 0x7810) bit field description init access 7-5 reserved - 0x00 r/w 4 loopback 1= sout is held high, while serial data output is looped back to the sin line internally. 0 r/w 3 out2 this bit is inverted to generate out2#. 0 r/w 2 out1 this bit is inverted to generate out1#. 0 r/w 1 rts this bit is inverted to generate rts#. 0 r/w 0 dtr this bit is inverted to generate dtr#. 0 r/w table 530: uart line status register (offset 0x7814) bit field description init access 7 ferr rx fifo error 0 r/o 6 temt transmitter empty 1 r/o 5 thre transmitter holding register empty 1 r/o 4 bi break interrupt 0 r/o 3 fe framing error 0 r/o 2pe parity error 0 r/o 1 oe overrun error 0 r/o 0 dr data ready 0 r/o www.datasheet.in bcm57xx programmer?s guide 01/29/08 broadcom corporation page 566 uart registers document 57xx-pg105-r uart m odem s tatus r egister (o ffset 0 x 7818) uart s cratch r egister (o ffset 0 x 781c) table 531: uart modem status register (offset 0x7818) bit field description init access 7 dcd compliment of dcd# 0 r/o 6 ri compliment of ri# 0 r/o 5 dsr compliment of dsr# 0 r/o 4 cts compliment of cts# 0 r/o 3 ddcd record dcd# change since last msr read 0 r/o 2 teri record ri# change since last msr read 0 r/o 1 ddsr record dsr# change since last msr read 0 r/o dcts record cts# change since last msr read 0 r/o table 532: uart scratch register (offset 0x781c) bit field description init access 7:0 scr scratch register 0x00 r/w www.datasheet.in programmer?s guide bcm57xx 01/29/08 broadcom corporation document 57xx-pg105-r ump registers page 567 ump r egisters all registers in this section are applicable to bcm5714c, bcm5714s, bcm5715c, and bcm5715s only. ump a ttention e nable r egister (o ffset 0 x 7800) ump a ttention s tatus r egister (o ffset 0 x 7804) table 533: ump registers (applicable to bcm5714 and bcm5715 only) address description 0x7800 ump attention enable register 0x7804 ump attention status register 0x7808 ump debug1 register 0x780c ump debug2 register 0x7810 ump command register 0x7814 ump status register 0x7818 ump frm read status register 0x781c ump frm read data register 0x7820 ump frm write control register 0x7824 ump frm write data register 0x7828 ump frame pre-fetch register 0x782c ump fifo remain register table 534: ump attention enable register (offset 0x7800, bcm5714 and bcm5715 only) bit field description init access 31:6 reserved returns zeros 0 r/w 5 txrdy_en enable tx ready event 1 r/w 4 rxrdy_en enable rx ready event 1 r/w 3 fiotx_perr_en enable parity error from fio tx buffer 0 r/w 2 fiorx_perr_en enable parity error from fio rx buffer 0 r/w 1 mactx_perr_en enable parity error from mac tx buffer 0 r/w 0 macrx_perr_en enable parity error from mac rx buffer 0 r/w table 535: ump attention status register (offset 0x7804, bcm5714 and bcm5715 only) bit field description init access 31:4 reserved returns zeros 0 r/w 3 fiotx_perr_detected parity error from fio tx buffer detected 0 w2c 2 fiorx_perr_detected parity error from fio rx buffer detected 0 w2c 1 mactx_perr_detected parity error from mac tx buffer detected 0 w2c 0 macrx_perr_detected parity error from mac rx buffer detected 0 w2c www.datasheet.in bcm57xx programmer?s guide 01/29/08 broadcom corporation page 568 ump registers document 57xx-pg105-r ump d ebug 1 r egister (o ffset 0 x 7808) ump c ommand r egister (o ffset 0 x 7810) table 536: ump debug1 register (offset 0x7808, bcm5714 and bcm5715 only) bit field description init access 31:9 reserved returns zeros 0 r/w 8 ump mac loop back en internal loop back mode 0 r/w 7:4 debug2_mux_sel mux select for ump debug vector 2 0 r/w 3:0 debug1_mux_sel mux select for ump debug vector 1 0 r/w table 537: ump command register (offset 0x7810, bcm5714 and bcm5715 only) bit field description init access 31:16 reserved returns zeros. 0 r/w 15 cfg_no_alignment if set, core does not do the 2-byte alignment required by teton. 0 r/w 14 rst_tx_state when set, this allows the tx state machine to be reset even after a byte count was programmed in. this makes it possible to throw away a frame if there is not enough tx buffer space and start all over again. 0 r/w 13 cfg_tx_drive when set, the core will generate a txdrive pulse one clock before txen and one clock after txen. 0 r/w 12:10 reserved returns zeros. 0 r/w 9 sw_pause when this bit is1, it forces the pause needed input to the mac to 1. this may be used by fw to force pause packets to be generated during times when it knows that it cannot process received packets properly. 0 r/w 8 tx_drive when this bit is 1, it enables the txd, txen, and txer pins of the ump interface to drive. when this bit is 0, the outputs float. this bit must be set to 1 for transmit data to be driven. the value of this bit has no effect on the internal fifo or mac operation. 0 r/w 7 tx_drop when this bit is set, it indicates that ump mac will drop all new tx packets. any current packet being transmitted will be completed. 1 r/w 6 tx_mac_disable when this bit is set, it disables the transmit function of the ump mac. setting this bit to 1 will reset the ump port transmitter to a known state. this bit must be set to 0 to allow transmission. 1 r/w 5 rx_mac_disable when this bit is set, it disables the receive function of the ump mac. setting this bit to 1 will reset the ump port receiver to a known state. this bit must be set to 0 to allow reception of new frames. 0 r/w 4 hdflowsel this bit enables the generation of a 3000 byte tx frame, with bad crc, as long as the rx fifo is full. when this bit is low, then the flowmode bit controls how the rx fifo is monitored. 0 r/w www.datasheet.in programmer?s guide bcm57xx 01/29/08 broadcom corporation document 57xx-pg105-r ump registers page 569 3 flowmode this bit provides a fast pause packet generation mode where the current tx packet is truncated with bad crc to allow the pause packet to be generated. if this bit is 0, then any current tx packet will complete normally before any pause packet is generated. 0 r/w 2 fc_en when this bit is 1, it indicates that flow control is enabled. if this bit is 0, no attempt will be made to prevent packet drop. when this bit is 1 and hdflowsel is 0, pause packets will be generated to attempt to prevent drop of rx packets. 0 r/w 1 tx_fifo_enabled this bit controls the current enable status of the tx side of the ump fifo block. if this bit is 1, it indicates that the tx fifo is enabled. when this bit is 0, the fifo will be reset immediately. if the transmit mac is currently transmitting a packet and does not get all the data needed for the packet, it will underrun and transmit jam for the packet and then stop. 0 r/w 0 rx_fifo_enabled this bit controls the current enable status of receive ump fifo block. if this bit is 1, it indicates that the rx fifo is enabled. when this bit is 0, the reset fifo will be reset immediately. any partial or complete packets in the fifo will be lost. this bit has no effect on the reception of frames by the rx mac. use rx_disable for that purpose. ump reset conditions: ? cpu_clk logic in ump is reset if tx_fifo_enable, rx_fifo_enable are both zero and hdflowsel is set. ? core_clk logic in ump is reset if tx_fifo_enable, rx_fifo_enable are both zero and hdflowsel is set. ? rx_clk logic in ump is reset if rx_disable and fc_en are both set. ? tx_clk logic in ump is reset if tx_disable and hdflowsel are both set. 0 r/w table 537: ump command register (offset 0x7810, bcm5714 and bcm5715 only) (cont.) bit field description init access www.datasheet.in bcm57xx programmer?s guide 01/29/08 broadcom corporation page 570 ump registers document 57xx-pg105-r ump s tatus r egister (o ffset 0 x 7814) table 538: ump status register (offset 0x7814, bcm5714 and bcm5715 only) bit field description init access 31:24 xon_trip when the rx fifo has at least xon_trip*16 bytes available, the pause needed input to the ump mac will be de- asserted. this value is the high-watermark for flow control generated by the ump mac. a value is the largest valid value that may be programmed and will de-assert the pause needed signal only when the rx fifo is empty. 0x96 r/w 23:16 xoff_trip when the rx fifo has less than xoff_trip*16 bytes remaining, the pause needed input to the ump mac will be asserted. this value is the low-watermark for flow control generated by the ump mac. if this value is 0, then the pause needed input to the ump mac will be controlled solely by the sw_pause bit. 0x48 r/w 15:6 reserved 0 r/w 5 src_addr_chg src_addr_chg when this bit is set, it indicates that the link source address has been changed since last read operation. the bit remains set until a 1 is written to this bit position. 0 w2c 4 reserved 0 r/w 3 rx_frm_drop when this bit is set, it indicates that rx packets have been dropped due to rx fifo full. this bit is cleared when a 1 is written to this bit position. 0 w2c 2 reserved 0 r/w 1 fdx this bit sets the duplex mode to be used by the ump mac. when this bit is 0, half-duplex ethernet protocol will be followed. when this bit is 1, then full-duplex operation will be enabled. 0 r/w 0 tx_idle this bit reflects the current transmit status of the ump port. it will read as 1 if there is transmit data pending in the tx fifo section or if the tx mac is currently transmitting a packet. when this bit is zero, then the transmitter is completely idle. this bit is intended to be sampled after the tx_fifo_enabled bit is cleared. after this bit reads as 0, the tx_drive output can be turned off. 0 r/w www.datasheet.in programmer?s guide bcm57xx 01/29/08 broadcom corporation document 57xx-pg105-r ump registers page 571 ump f rame r ead s tatus r egister (o ffset 0 x 7818) ump f rame r ead d ata r egister (o ffset 0 x 781c) table 539: ump frame read status register (offset 0x7818, bcm5714 and bcm5715 only) bit field description init access 31:29 rx_fifo_state 0: idle 1: ready 2: busy 3: extra_rd extra read 4: latch_ip_hdr 0 r 28:14 reserved 0 r 13:3 frm_rd_st_bcnt current rx packet length in byte count. 0 r 2 frm_rd_sta_fifo_empty when this bit is set, it indicates that rx fifo is empty and firmware or software should not read rd_dat any further until this bit clears. 1 r 1 frm_rd_sta_frm_in_pro when this bit is set, it indicates that current packet reading is in progress. cleared when all packet data has been read for a particular packet. 0 r 0 frm_rd_sta_new_frm when this bit is set, it indicates that a new packet is ready in rx fifo. always 0 when frm_in_pro bit is set. this bit maps directly to the value of the ftq2_valid event bit. 0 r table 540: ump frame read data register (offset 0x781c, bcm5714 and bcm5715 only) bit field description init access 31:0 data next 32-bit data word of a packet. for a new packet, the first two reads of this register contain dummy data. on the third read, the right two bytes contain the first two data bytes of the packet. this means that the 3rd byte of the packet is in bits 31:24 of the 4th data word read. the two dummy reads are required to discard control data for the packet. the two extra bytes in the 3rd read makes the l3 and above frame headers 32-bit aligned with the frm_rd_data register. 0 r/o www.datasheet.in bcm57xx programmer?s guide 01/29/08 broadcom corporation page 572 ump registers document 57xx-pg105-r ump f rame w rite c ontrol r egister (o ffset 0 x 7820) ump f rame w rite d ata r egister (o ffset 0 x 7824) table 541: ump frame write control register (offset 0x7820, bcm5714 and bcm5715 only) bit field description init access 31:30 tx_fifo_state 0: idle 1: wait 2: busy 3: extra_wr 0 r 29:14 reserved 0 r 13:3 frm_wr_ctrl_bcnt this register must be written with the packet length before the ump_frm_wr_dat register at offset 0x7824 is written with any data. for this value to be accepted, the sof bit must be set on the same register write. 0 r 2 frm_wr_ctrl_bcnt_rdy when this bit is set, it indicates that the bcnt field can accept another write as a request for space for another transmit frame. this bit is logically ored with the fifo_rdy bit to create the value of the ftq1_valid event bit. this bit must be 1 when the firmware writes a 1 to the new_frm bit. this bit will clear back to 0 each time a new bcnt value is written and will only set back to 1 once the new_frm bit has cleared at the end of the complete packet write. 1 r 1 frm_wr_ctrl_fifo_rdy this bit is set when the tx_fifo can accept all the data requested by a write to the bcnt value. this value will read as 1 when there is sufficient space in the tx fifo to accept all the bytes described by the latest bcnt value. this bit will clear to 0 once all the data requested in bcnt has been written to the ump_frm_wr_data register. this bit is logically ored with the bcnt_rdy bit to create the value of the ftq1_valid event bit. 0 r 0 frm_wr_ctrl_new_frm this bit must be set for the bcnt field to be accepted as the length of a new packet. this bit will clear to zero when the complete packet has been written to the ump_frm_wr_data register at offset 0x7824. 0 r table 542: ump frame write data register (offset 0x7824, bcm5714 and bcm5715 only) bit field description init access 31:0 data next 32-bit data word of a transmit packet. only the right two bytes of the first data word of each packet are valid. this means that the 3rd byte of the packet is in bits 31:24 of the 2nd data word write. this offset of 2 bytes makes the l3 and above frame headers 32 -bit aligned with the rm_wr_data register. this register must only be written when fifo_rdy bit is 1 in the ump_frm_wr_ctrl register at offset 0x7820. 0 r/w www.datasheet.in programmer?s guide bcm57xx 01/29/08 broadcom corporation document 57xx-pg105-r ump registers page 573 ump f rame p re -f etch r egister (o ffset 0 x 7828) ump fifo r emain r egister (o ffset 0 x 782c) table 543: ump frame pre-fetch register (offset 0x7828, bcm5714 and bcm5715 only) bit field description init access 31:0 data this register provides the ethernet type field of the packet when a new packet is ready to be read from the rd_data register. reading this register has no effect on the fifo status. the value of this register is invalid except before the first data is read from the rd_data register at offset 0x781c. 0 r/o table 544: ump fifo remain register (offset 0x782c, bcm5714 and bcm5715 only) bit field description init access 31:25 reserved - 0 r 24:16 rxfifo_byte_cnt bytes remaining in rx fifo r 15:9 reserved - 0 r 8:0 txfifo_byte_cnt bytes remaining in tx fifo r www.datasheet.in bcm57xx programmer?s guide 01/29/08 broadcom corporation page 574 pcie registers document 57xx-pg105-r pci e r egisters these registers are applicable to the bcm5721, bcm5751, and bcm5752 only. table 545: pcie registers address description tlp diagnostic registers (these are transact ion layer protocol hardware debug registers) 0x7c00 tlp control register 0x7c04 tlp workaround register 0x7c08 reserved 0x7c0c reserved 0x7c10 write dma request upper address diagnostic register 0x7c14 write dma request lower address diagnostic register 0x7c18 write dma length/byte enable and request diagnostic register 0x7c1c read dma request upper address diagnostic register 0x7c20 read dma request lower address diagnostic register 0x7c24 read dma length and request diagnostic register 0x7c28 msi dma request upper address diagnostic register 0x7c2c msi dma request lower address diagnostic register 0x7c30 msi dma length and request diagnostic register 0x7c34 slave request length and type diagnostic register 0x7c38 flow control inputs diagnostic register 0x7c3c xmt state machines and gated requests diagnostic register 0x7c40 address ack xfer count and arb length diagnostic register 0x7c44 dma completion header diagnostic register 0 0x7c48 dma completion header diagnostic register 1 0x7c4c dma completion header diagnostic register 2 0x7c50 dma completion misc. diagnostic register 0x7c54 dma completion misc. diagnostic register 0x7c58 dma completion misc. diagnostic register 0x7c5c split controller requested length and address ack remaining diagnostic register 0x7c60 split controller misc 0 register diagnostic register 0x7c64 split controller misc 1 register diagnostic register 0x7c68 tlp register busno, devno, funcno register 0x7c6c tlp debug register data link layer internal registers 0x7d00 data link control register 0x7d04 data link status register 0x7d08 data link attention register www.datasheet.in programmer?s guide bcm57xx 01/29/08 broadcom corporation document 57xx-pg105-r pcie registers page 575 0x7d0c data link attention mask register 0x7d10 next transmit sequence number debug register 0x7d14 acked transmit sequence number debug register 0x7d18 purged transmit sequence number debug register 0x7d1c receive sequence number debug register 0x7d20 data link replay register 0x7d24 data link ack timeout register 0x7d28 power management threshold register 0x7d2c retry buffer write pointer debug register 0x7d30 retry buffer read pointer debug register 0x7d34 retry buffer purged pointer debug register 0x7d38 retry buffer read/write debug port 0x7d3c error count threshold register 0x7d40 tlp error counter register 0x7d44 dllp error counter 0x7d48 nak received counter 0x7d4c data link test register 0x7d50 packet bist register 0x7d54-0x7dff reserved phy internal registers 0x7e00 phy mode register 0x7e04 phy/link status register 0x7e08 phy/link ltssm control register 0x7e0c phy/link training link number 0x7e10 phy/link training lane number 0x7e14 phy/link training n_fts 0x7e18 phy attention register 0x7e1c phy attention mask register 0x7e20 phy receive error counter 0x7e24 phy receive framing error counter 0x7e28 phy receive error threshold register 0x7e2c phy test control register 0x7e30 phy/serdes control override 0x7e34 phy timing parameter override 0x7e38 phy hardware diagnostic1 n tx/rx sm states 0x7e3c phy hardware diagnostic2 n ltssm states table 545: pcie registers (cont.) address description www.datasheet.in bcm57xx programmer?s guide 01/29/08 broadcom corporation page 576 pcie registers document 57xx-pg105-r tlp c ontrol r egister (o ffset 0 x 7c00) this register is applicable to the bcm5721, bcm5751, and bcm5752 only. table 546: tlp control register (offset 0x7c00, bcm5721, bcm5751, and bcm5752 only) bit field description init access 31 enable excessive current fix (b1 or higher version of bcm5721 and bcm5751 devices) enable the dos excessive current fix: ? 0 = disable fix ? 1 = enable fix note: refer to e6_5751b0_10362 in the 5751-es4xx-r errata for more details. 1r/w 30 reserved - 0 r/o 29 enable interrupt mode fix (bcm5721 and bcm5751 only) enable the interrupt mode fix: ? 0 = disable fix ? 1 = enable fix note: refer to e3_5751b0_9804 in the 5751-es-4xx-r errata for more details. 0r/w 28 reserved - 0 r/o 27 enable unexpected completion error fix enable the unexpected completion error fix: ? 0 = disable fix ? 1 = enable fix the hardware fix is to not send the unexpected completion error message when the chipset replays a completion packet because of bios not programming the chipset?s replay timer correctly. 0r/w 26 enable type1 vendor defined message fix enable the type 1 vendor defined message fix: ? 0 = disable fix ? 1 = enable fix the fix for this is to discard any type1 message with a data payload of two or more dws to prevent the data fifo from getting out of sync. 0r/w 25 data fifo protect when set, this bit enables data fifo protection. 0 r/w 24 enable address check when set, this bit enables address and type field checking in the transaction layer packet (tlp). 1r/w 23 enable tc0 check when set, this bit enabled tc0 traffic class checking in the tlp. 1r/w 22 crc swap when set, this bit enables swapping of the digest field when ecrc is enabled. 0r/w 21 disable ca error when clear, this bit enables the dma completion logic to check for a completion packet with a completer abort completion status value. 0r/w 20 disable ur error when clear, this bit enables the dma completion logic to check for a completion packet with an unsupported request value. 0r/w 19 disable rsv error when clear, this bit enables the dma completion logic to check for a completion packet with a reserved value. 0r/w 18 enable mps check when set, this bit enables the dma completion logic to check for a tlp that violates the maximum payload size requirement. 1r/w www.datasheet.in programmer?s guide bcm57xx 01/29/08 broadcom corporation document 57xx-pg105-r pcie registers page 577 tlp w orkaround r egister (o ffset 0 x 7c04) this register is applicable to bcm5721, bcm5751, and bcm5752 only. 17 disable ep error when clear, this bit enables the transaction layer to check for data poisoning. 0r/w 16 enable bytecount check when set, this bit enables the transaction layer's target to check for byte count errors on incoming target accesses. 1r/w 15-14 reserved - 0 r/w 13-11 dma read traffic class dma read traffic class. 0x0 r/w 10-8 dma write traffic class dma write traffic class. 0x0 r/w 7-6 reserved - 0x0 r/w 5-0 completion timeout programmable completion timeout in milliseconds. 0x2f r/w table 547: tlp workaround regist er (offset 0x7c04, bcm5752 only) bit field description init access 31-9 reserved ? 0 r/o 8 enable training error fix ? 0 = disabled ? 1 = enabled enable this fix to mask of the training error to avoid any false triggering of this fatal error. the false triggering may be possible as the training error bit is not well defined. 0r/w 7 enable gphy dll issue fix ? 0 = disabled ? 1 = enabled enable this fix to automatically detect the gphy dll power-down and switch to slow core clk mode to enable the access of emac registers when the gphy dll is powered down. 1r/w 6-4 reserved ? 000b r/w 3 enable ur status bit fix ? 1 = ur status bit in the device status register is set if a memory read or write occurs to an unmatched base address. ? 0 = ur status bit is not affected by writes to an unmatched base address. 0r/w 2 enable vendor defined message fix ? 1 = ur status bit in the device status register is not set for routing codes 000b, 010b, 011b, and 100b. ? 0 = ur status bit in the device status register is set for routing codes 000b, 010b, 011b, and 100b. 0r/w 1 power_state_write_mem _enable ? 1 = software can place the device in d3hot state via a memory write or a configuration write cycle. ? 0 = software can place the device in d3hot only via a configuration write. 1r/w 0 enable max payload size fix ? 1 = enable fix for 512-byte mps ? 0 = disable fix for 512-byte mps enable this fix for operating with mps larger than 128 bytes. refer to e2_5751b0_9709 in the 5751-es4xx-r errata for more details. 1r/w table 546: tlp control register (offset 0x7c00, bcm5721, bcm5751, and bcm5752 only) bit field description init access www.datasheet.in bcm57xx programmer?s guide 01/29/08 broadcom corporation page 578 pcie registers document 57xx-pg105-r w rite dma r equest u pper a ddress d iagnostic r egister (o ffset 0 x 7c10) this register is applicable to the bcm5721, bcm5751, and bcm5752 only. w rite dma r equest l ower a ddress d iagnostic r egister (o ffset 0 x 7c14) this register is applicable to the bcm5721, bcm5751, and bcm5752 only. w rite dma l ength /b yte e nable and r equest d iagnostic r egister (o ffset 0 x 7c18) this register is applicable to the bcm5721, bcm5751, and bcm5752 only. r ead dma r equest u pper a ddress d iagnostic r egister (o ffset 0 x 7c1c) this register is applicable to the bcm5721, bcm5751, and bcm5752 only. table 548: write dma request upper address diagnostic register (offset 0x7c10) bit field description init access 31-0 reg_dw_upr_addr write dma request upper address (63:32) 0 r/o table 549: write dma request lower address diagnostic register (offset 0x7c14) bit field description init access 31-0 reg_dw_lwr_addr write dma request lower address (31:0) 0 r/o table 550: write dma length/byte enable and request diagnostic register (offset 0x7c18) bit field description init access 31-16 reg_dw_lenbe_req write dma request length(15:0) 0 r/o 15-8 - write dma request byte enables(7:0) 0 r/o 7-1 - reserved 0 r/o 0 - write dma raw request 0 r/o table 551: read dma request upper address diagnostic register (offset 0x7c1c) bit field description init access 31-0 reg_dr_upr_addr read dma request upper address (63:32) 0 r/o www.datasheet.in programmer?s guide bcm57xx 01/29/08 broadcom corporation document 57xx-pg105-r pcie registers page 579 r ead dma r equest l ower a ddress d iagnostic r egister (o ffset 0 x 7c20) this register is applicable to bcm5721, bcm5751, and bcm5752 only. r ead dma l ength and r equest d iagnostic r egister (o ffset 0 x 7c24) this register is applicable to bcm5721, bcm5751, and bcm5752 only. msi dma r equest u pper a ddress d iagnostic r egister (o ffset 0 x 7c28) this register is applicable to bcm5721, bcm5751, and bcm5752 only. msi dma r equest l ower a ddress d iagnostic r egister (o ffset 0 x 7c2c) this register is applicable to bcm5721, bcm5751, and bcm5752 only. table 552: read dma request lower address diagnostic register (offset 0x7c20) bit field description init access 31-0 reg_dr_lwr_addr read dma request lower address (31:0) 0 r/o table 553: read dma length and request diagnostic register (offset 0x7c24) bit field description init access 31-16 reg_dr_len_req read dma request length(15:0) 0r/o 15-1 reserved - 0 r/o 0 - read dma raw request 0 r/o table 554: msi dma request upper address diagnostic register (offset 0x7c28) bit field description init access 31-0 reg_msi_upr_addr msi dma request upper address (63:32) 0 r/o table 555: msi dma request lower address diagnostic register (offset 0x7c2c) bit field description init access 31-0 reg_msi_lwr_addr msi dma request lower address (31:0) 0 r/o www.datasheet.in bcm57xx programmer?s guide 01/29/08 broadcom corporation page 580 pcie registers document 57xx-pg105-r msi dma l ength and r equest d iagnostic r egister (o ffset 0 x 7c30) this register is applicable to bcm5721, bcm5751, and bcm5752 only. s lave r equest l ength and t ype d iagnostic r egister (o ffset 0 x 7c34) this register is applicable to bcm5721, bcm5751, and bcm5752 only. f low c ontrol i nputs d iagnostic r egister (o ffset 0 x 7c38) this register is applicable to bcm5721, bcm5751, and bcm5752 only. table 556: msi dma length and request diagnostic register (offset 0x7c30) bit field description init access 31-16 reg_msi_len_req msi dma request length(15:0) 0 r/o 15-1 reserved - 0 r/o 0 - msi dma raw request 0 r/o table 557: slave request length and type diagnostic register (offset 0x7c34) bit field description init access 31-26 reg_slv_len_req reserved 0 r/o 25-16 - slave request length (9:0) 0 r/o 15-2 reserved - 0 r/o 1 - slave request type: 0: msg 1: target 0r/o 0 - slave raw request 0 r/o table 558: flow control inputs diagnostic register (offset 0x7c38) bit field description init access 31-27 reg_fc_input reserved 0 r/o 26 - flow control non-posted header available 0 r/o 25 - flow control posted header available 0 r/o 24 - flow control completion header available 0 r/o 23-12 - flow control posted data available 0 r/o 11-0 - flow control completion data available 0 r/o www.datasheet.in programmer?s guide bcm57xx 01/29/08 broadcom corporation document 57xx-pg105-r pcie registers page 581 xmt s tate m achines and g ated r equests d iagnostic r egister (o ffset 0 x 7c3c) this register is applicable to bcm5721, bcm5751, and bcm5752 only. a ddress ack x fer c ount and arb l ength d iagnostic r egister (o ffset 0 x 7c40) this register is applicable to bcm5721, bcm5751, and bcm5752 only. dma c ompletion h eader d iagnostic r egister 0 (o ffset 0 x 7c44) this register is applicable to bcm5721, bcm5751, and bcm5752 only. dma c ompletion h eader d iagnostic r egister 1 (o ffset 0 x 7c48) this register is applicable to bcm5721, bcm5751, and bcm5752 only. table 559: xmt state machines and gated requests diagnostic register (offset 0x7c3c) bit field description init access 31 reg_sm_r0_r3 reserved 0 r/o 30-28 - tlp transmitter data state machine 0 r/o 27-24 - tlp transmitter arbitration state machine 0 r/o 23-4 - reserved 0 r/o 3 - slave dma gated request. 0 r/o 2 - msi dma gated request 0 r/o 1 - read dma gated request 0 r/o 0 - write dma gated request 0 r/o table 560: address ack xfer count and arb length diagnostic register (offset 0x7c40) bit field description init access 31-16 - address ack transfer count 0 r/o 15-0 - arbitration length 0 r/o table 561: dma completion header diagnostic register 0 (offset 0x7c44) bit field description init access 31-0 reg_hdr0 dma completion header 0 0 r/o table 562: dma completion header diagnostic register 1 (offset 0x7c48) bit field description init access 31-0 reg_hdr0 dma completion header 1 0 r/o www.datasheet.in bcm57xx programmer?s guide 01/29/08 broadcom corporation page 582 pcie registers document 57xx-pg105-r dma c ompletion h eader d iagnostic r egister 2 (o ffset 0 x 7c4c) this register is applicable to bcm5721, bcm5751, and bcm5752 only. dma c ompletion m isc d iagnostic r egister (o ffset 0 x 7c50) this register is applicable to bcm5721, bcm5751, and bcm5752 only. dma c ompletion m isc d iagnostic r egister (o ffset 0 x 7c54) this register is applicable to bcm5721, bcm5751, and bcm5752 only. table 563: dma completion header diagnostic register 2 (offset 0x7c4c) bit field description init access 31-0 reg_hdr0 dma completion header 2 0 r/o table 564: dma completion misc. diagnostic register (offset 0x7c50) bit field description init access 31-28 reg_dma_cmpt_misc0 completion data poisoning error counter 0r/o 27-24 - completion unexpected error counter 0 r/o 23-20 - completion ca error counter 0 r/o 19-16 - completion ur error counter 0 r/o 15-12 - completion with crc error counter 0r/o 11-8 - completion with bad tlp error counter 0r/o 7-4 - not used 0 r/o 3-0 - completion state machine 0 r/o table 565: dma completion misc. diagnostic register (offset 0x7c54) bit field description init access 31-28 reg_dma_cmpt_misc0 completion malform error counter 0r/o 27-24 - frame stay too long error counter 0r/o 23-20 - frame drop too early error counter 0r/o 19-16 - type_status_mismatch error counter 0r/o 15-12 - status_malform error counter 0r/o 11-8 - completion rcb error counter 0r/o 7-4 - completion bytecount error counter 0 r/o 3-0 - completion mps error counter 0r/o www.datasheet.in programmer?s guide bcm57xx 01/29/08 broadcom corporation document 57xx-pg105-r pcie registers page 583 dma c ompletion m isc d iagnostic r egister (o ffset 0 x 7c58) this register is applicable to bcm5721, bcm5751, and bcm5752 only. s plit c ontroller r equested l ength and a ddress ack r emaining d iagnostic r egister (o ffset 0 x 7c5c) this register is applicable to bcm5721, bcm5751, and bcm5752 only. s plit c ontroller m isc 0 r egister d iagnostic r egister (o ffset 0 x 7c60) this register is applicable to bcm5721, bcm5751, and bcm5752 only. table 566: dma completion misc. diagnostic register (offset 0x7c58) bit field description init access 31-8 reg_dma_cmpt_misc0 not used 0 r/o 7-4 - completion too much data error counter 0r/o 3-0 - frame dead-time error counter 0r/o table 567: split controller requested length and address ack remaining diag. reg. (offset 0x7c5c) bit field description init access 31-27 reg_len_ack_remain reserved 0 r/o 26-16 - requested length 0 r/o 15-11 - reserved 0 r/o 10-0 - address ack remaining 0 r/o table 568: split controller misc 0 register diagnostic register (offset 0x7c60) bit field description init access 31-18 reg_splitctl_misc0 reserved 0 r/o 17 - split pending 0 r/o 16 - split pending block request 0 r/o 15-8 - initiator tag 0 r/o 7- reserved 0 r/o 6 - split controller timeout status 0 r/o 5-0 - split controller timeout counter 0 r/o www.datasheet.in bcm57xx programmer?s guide 01/29/08 broadcom corporation page 584 pcie registers document 57xx-pg105-r s plit c ontroller m isc 1 r egister d iagnostic r egister (o ffset 0 x 7c64) this register is applicable to bcm5721, bcm5751, and bcm5752 only. tlp b us , d ev , and f unc n umber r egister (o ffset 0 x 7c68, bcm5721, bcm5751, and bcm5752 o nly ) tlp d ebug r egister (o ffset 0 x 7c6c, bcm5721, and bcm5751 o nly ) table 569: split controller misc 1 register diagnostic register (offset 0x7c64) bit field description init access 31-29 reg_splitctl_misc1 reserved 0 r/o 28-26 - registered traffic class 0 r/o 25-24 - registered attribute 0 r/o 28-8 - registered requester id 0 r/o 7-0 - registered initiator tag 0 r/o table 570: tlp status register (offset 0x7c60) bit field description init access 31-17 reserved reserved 0 r/o 16 config write indicator first config write has been received 0 r/o 15-8 bus number pci bus number 0 r/o 7-3 device number pci device number 0 r/o 2-0 function number pci function number 0 r/o table 571: tlp status register (offset 0x7c60) bit field description init access 31 a4 device indication bit indicates whether the device is a4 chip 1 for a4, 0 for other versions r/o 30 b1 device indication bit indicates whether the device is b1 chip 1 for b1, 0 for other versions. r/o 29-0 reserved 0 r/o www.datasheet.in programmer?s guide bcm57xx 01/29/08 broadcom corporation document 57xx-pg105-r pcie registers page 585 d ata l ink c ontrol r egister (o ffset 0 x 7d00) this register is applicable to bcm5721, bcm5751, and bcm5752 only. this register is reset only by por. table 572: data link control register (offset 0x7d00) bit field description init access 31-25 reserved write as 0, ignore when read. 0 - 24 pme turn off message handling fix set this bit to 1 to enable the fix. refer to e22_5751b1_11211 in the 5751-es5xx-r errata for details. 0r/w 23 enable data link layer retry logic fix set to 1 to enable the fix. refer to e13_5751b1_11121 in the 5751-es5xx-r errata for details. 1 for bcm5721/ bcm5751 c0 and later chips, and otherwise 0. r/w 22 power mgmt state machine l0s lockup fix enable fix to transition out of l0s when link experiencing recovery. ? 1 = disable fix ? 0 = enable fix refer to e6_5751b1_11080 in the 5751-es5xx-r errata for details. 0r/w 21 enable flow control credit checking fix enable this bit to check mps or actually advertised credit. ? 1 = disable fix ? 0 = enable fix refer to e5_5751b1_10674 in the 5751-es5xx-r errata for details. 0r/w 20 enable l1 to l0 transition when device is configured to d3 hot enable this fix to transition back to l1 after waked up and d state is set at d3 state: ? 1 = disable fix ? 0 = enable fix refer to e2_5751b1_10453 in the 5751-es5xx-r errata for details. 0r/w 19 enable pending completion packet issue fix enable this fix to wake up from l1 and flush out pending tlp. ? 1 = disable fix ? 0 = enable fix refer to e1_5751b1_10452 in the 5751-es5xx-r errata for details. 0r/w 18 pll refsel switch control enable this fix to allow pll source clock to switch to local crystal at the absence of pcie ref clock. ? 1 = enable switch ? 0 = disable switch refer to e15_5751b1_11011 in the 5751-es5xx-r errata for details. 1r/w 17 reserved ? 0 r/w 16 power management control enable power management clock switching (allows core clk to be automatically muxed into pcie clocks). 1r/w www.datasheet.in bcm57xx programmer?s guide 01/29/08 broadcom corporation page 586 pcie registers document 57xx-pg105-r 15 power down serdes transmitter forces the serdes transmitter into the low-power state (when cleared, the transmitter power state is controlled by the power management state machine). 0r/w 14 power down serdes pll forces the serdes pll into the low-power state (when cleared, the pll power state is controlled by the power management state machine). 0r/w 13 power down serdes receiver forces the serdes receiver into the low-power state (when cleared, receiver power state is controlled by power management state machine). 0r/w 12 enable beacon enable transmission of in-band beacon signal when waking system. 1r/w 11 automatic timer threshold enable ? 1 = enable automatic calculation of ack latency and replay timeout values. ? 0 = use register values for ack latency and replay timeout. 1r/w 10 enable dllp timeout mechanism when set to 1, link is retrained if the dllp receive timer expires without receiving a valid dllp. 1r/w 9 check receive flow control credits check receive flow control credit consumption and report receive overflow errors when enabled. 1r/w 8 link enable enable the data link layer functions. 1 r/w 7-0 power management control these bits enable automatic power management functions (power up/down or clock gating): ? 7 = enable active state power management. ? 6 = enable pci-pm power management (clearing this bit does not disable pm_pme message generation). ? 5 = enable serdes transmitter power management. ? 4 = enable serdes pll power management. ? 3 = enable serdes receiver power management. ? 2 = enable transaction layer power management (clock gating). ? 1 = enable data link layer power management (clock gating). ? 0 = enable physical layer power management (clock gating). 0xff r/w table 572: data link control register (offset 0x7d00) (cont.) bit field description init access www.datasheet.in programmer?s guide bcm57xx 01/29/08 broadcom corporation document 57xx-pg105-r pcie registers page 587 d ata l ink s tatus r egister (o ffset 0 x 7d04) this register is applicable to bcm5721, bcm5751, and bcm5752 only. table 573: data link status register (offset 0x7d04) bit field description init access 31-26 reserved write as 0, ignore when read. 0 r/o 25-23 phy link state 1 1. these bits are for debug only?they will always return 0 (except data link up = 1) when read through the pcie interface. current physical layer power state. ? 000: l0 ? 001: l0s ? 010: l1 ? 011: l2 ? 100: others 100 r/o 22-19 power management state1 current state of power management substate machine (see test doc for state mapping). 1000 r/o 18-17 power management sub-state1 current state of power management substate machine (see test doc for state mapping). 00 r/o 16 data link up1 data link is up (vc0 initialized). 0 r/o 15-10 reserved write as 0, ignore when read. 0 r/o 9 flow control update timeout flow control update timeout error detected (dllp receive timer expired without receiving valid dllp). 0ro/cr 8 flow control receive overflow flow control receive overflow error detected. 0 ro/cr 7 flow control protocol error flow control protocol error detected. 0 ro/cr 6 data link protocol error data link protocol error detected (pos or neg acknowledgement received with invalid tlp sequence number). 0ro/cr 5 replay rollover replay counter rolled over (four consecutive retries without a positive acknowledgement received). 0ro/cr 4 replay timeout replay timer expired (no ack received within specified time). 0 ro/cr 3 nak received negative acknowledgement dllp was received. 0 ro/cr 2 dllp error data link layer packet error detected. 0 ro/cr 1 bad tlp sequence number tlp received with invalid sequence number. 0 ro/cr 0 tlp error transaction layer packet error detected (packet failed data link layer error checks). 0ro/cr www.datasheet.in bcm57xx programmer?s guide 01/29/08 broadcom corporation page 588 pcie registers document 57xx-pg105-r d ata l ink a ttention r egister (o ffset 0 x 7d08) this register is applicable to bcm5721, bcm5751, and bcm5752 only. d ata l ink a ttention m ask r egister (o ffset 0 x 7d0c) this register is applicable to bcm5721, bcm5751, and bcm5752 only. table 574: data link attention register (offset 0x7d08) bit field description init access 31-5 reserved write as 0, ignore when read. 0 - 4 data link layer error attention indicator asserted when any of the following bits are set in the data link status register: ? fc update timeout. ? fc receive overflow. ? fc protocol error. ? data link protocol error. ? replay rollover or replay timeout (read the ?data link status register (offset 0x7d04)? on page 587 to clear this bit). 0r/o 3 nak received counter attention indicator set when nak received counter value is greater than or equal to attention threshold. cleared when counter is read. 0r/o 2 dllp error counter attention indicator set when dllp error counter value is greater than or equal to attention threshold. cleared when counter is read. 0r/o 1 tlp bad sequence counter attention indicator set when tlp bad sequence counter value is greater than or equal to attention threshold. cleared when counter is read. 0r/o 0 tlp error counter attention indicator set when tlp error counter value is greater than or equal to attention threshold. cleared when counter is read. 0r/o table 575: data link attention mask register (offset 0x7d0c) bit field description init access 31-8 reserved write as 0, ignore when read. 0 r/o 7-5 attention mask reserved for additional attention bits. 0 r/w 4 data link layer error attention mask data link error attention bit causes assertion of data link attention output when mask bit is set to 1. 0r/w 3 nak received counter attention mask nak received counter attention bit causes assertion of data link attention output when mask bit is set to 1. 0r/w 2 dllp error counter attention mask dllp error counter attention bit causes assertion of data link attention output when mask bit is set to 1. 0r/w 1 tlp bad sequence counter attention mask tlp bad sequence counter attention bit causes assertion of data link attention output when mask bit is set to 1. 0r/w 0 tlp error counter attention mask tlp error counter attention bit causes assertion of data link attention output when mask bit is set to 1. 0r/w www.datasheet.in programmer?s guide bcm57xx 01/29/08 broadcom corporation document 57xx-pg105-r pcie registers page 589 n ext t ransmit s equence n umber d ebug r egister (o ffset 0 x 7d10) this register is applicable to bcm5721, bcm5751, and bcm5752 only. ack ed t ransmit s equence n umber d ebug r egister (o ffset 0 x 7d14) this register is applicable to bcm5721, bcm5751, and bcm5752 only. p urged t ransmit s equence n umber d ebug r egister (o ffset 0 x 7d18) this register is applicable to bcm5721, bcm5751, and bcm5752 only. r eceive s equence n umber d ebug r egister (o ffset 0 x 7d1c) this register is applicable to bcm5721, bcm5751, and bcm5752 only. table 576: next transmit sequence number debug register (offset 0x7d10) bit field description init access 31-12 reserved write as 0, ignore when read. 0 r/o 11-0 next transmit sequence number transmit sequence number for the next tlp to be sent. 0x000 r/w table 577: acked transmit sequence number debug register (offset 0x7d14) bit field description init access 31-12 reserved write as 0, ignore when read. 0 r/o 11-0 acked transmit sequence number sequence number for the last transmit tlp to be positively acknowledged. 0xfff r/w table 578: purged transmit sequence number debug register (offset 0x7d18) bit field description init access 31-12 reserved write as 0, ignore when read. 0 r/o 11-0 purged transmit sequence number sequence number for the last transmit tlp to be purged from retry buffer. 0xfff r/w table 579: receive sequence numb er debug register (offset 0x7d1c) bit field description init access 31-12 reserved write as 0, ignore when read. 0 r/o 11-0 receive sequence number receive sequence number for the last good tlp received. 0xfff r/w www.datasheet.in bcm57xx programmer?s guide 01/29/08 broadcom corporation page 590 pcie registers document 57xx-pg105-r d ata l ink r eplay r egister (o ffset 0 x 7d20) this register is applicable to bcm5721, bcm5751, and bcm5752 only. d ata l ink ack t imeout r egister (o ffset 0 x 7d24) this register is applicable to bcm5721, bcm5751, and bcm5752 only. p ower m anagement t hreshold r egister (o ffset 0 x 7d28) this register is applicable to bcm5721, bcm5751, and bcm5752 only. this register is reset by either por or grc (soft) reset. table 580: data link replay register (offset 0x7d20) bit field description init access 31-23 reserved write as 0, ignore when read. 0 r/o 22-10 replay timeout value replay timeout value in data link layer clock cycles (8 ns). 0x5cf r/w 9-0 retry buffer size physical size of retry buffer/16 bytes. 0xb0 r/w table 581: data link ack timeout register (offset 0x7d24) bit field description init access 31-11 reserved write as 0, ignore when read. 0 r/o 10-0 ack latency timeout value ack latency timeout value in data link layer clock cycles (8 ns). 0xff r/w table 582: power management threshold register (offset 0x7d28) bit field description init access 31-24 reserved write as 0, ignore when read. 0 r/o 23-20 d3c re-enter threshold minimum time in us before re-enter to l1 link state. note: refer to e1_5751b1_10452 in the 5751-es5xx-r errata for more details. ? 0x9 for bcm5721 and bcm5751. ? 0x8 for bcm5752. r/w 19-16 d3c exit threshold minimum time in us that the link must stay in l1. note: refer to e1_5751b1_10452 in the 5751-es5xx-r errata for more details. 0x2 r/w 15-8 l1 threshold idle time before entering l1 low-power state (unit = 256 ns). 0x62 r/w 7-0 l0s threshold idle time before entering l0s low-power state (unit = 16 ns). 0xfa r/w www.datasheet.in programmer?s guide bcm57xx 01/29/08 broadcom corporation document 57xx-pg105-r pcie registers page 591 r etry b uffer w rite p ointer d ebug r egister (o ffset 0 x 7d2c) this register is applicable to bcm5721, bcm5751, and bcm5752 only. r etry b uffer r ead p ointer d ebug r egister (o ffset 0 x 7d30) this register is applicable to bcm5721, bcm5751, and bcm5752 only. r etry b uffer p urged p ointer d ebug r egister (o ffset 0 x 7d34) this register is applicable to bcm5721, bcm5751, and bcm5752 only. r etry b uffer r ead /w rite d ebug p ort (o ffset 0 x 7d38) this register is applicable to bcm5721, bcm5751, and bcm5752 only. table 583: retry buffer write pointer debug register (offset 0x7d2c) bit field description init access 31-11 reserved write as 0, ignore when read. 0 r/o 10-0 retry buffer write pointer address of next dword to be written into retry buffer ram. 0r/w table 584: retry buffer read pointer debug register (offset 0x7d30) bit field description init access 31-11 reserved write as 0, ignore when read. 0 r/o 10-0 retry buffer read pointer address of next dword to be read from retry buffer ram. 0r/w table 585: retry buffer purged pointer debug register (offset 0x7d34) bit field description init access 31-11 reserved write as 0, ignore when read. 0 r/o 10-0 retry buffer purged pointer starting address of next tlp to be purged from retry buffer ram. 0r/w table 586: retry buffer read/write debug port (offset 0x7d38) bit field description init access 31-0 retry buffer data data written to this address is written into the retry buffer ram at the retry buffer write address. reads to this address will return the data stored at the retry buffer read address in the retry buffer ram. ?r/w www.datasheet.in bcm57xx programmer?s guide 01/29/08 broadcom corporation page 592 pcie registers document 57xx-pg105-r e rror c ount t hreshold r egister (o ffset 0 x 7d3c) this register is applicable to bcm5721, bcm5751, and bcm5752 only. tlp e rror c ounter r egister (o ffset 0 x 7d40) this register is applicable to bcm5721, bcm5751, and bcm5752 only. dllp e rror c ounter (o ffset 0 x 7d44) this register is applicable to bcm5721, bcm5751, and bcm5752 only. table 587: error count threshold register (offset 0x7d3c) bit field description init access 31-15 reserved write as 0, ignore when read. 0 r/o 14-12 bad sequence number count threshold attention bits are set when error count reaches threshold. threshold = 2^n. 0x7 r/w 11-8 nak received count threshold attention bits are set when error count reaches threshold. threshold = 2^n. 0xf r/w 7-4 dllp error count threshold attention bits are set when error count reaches threshold. threshold = 2^n. 0xf r/w 3-0 tlp error count threshold attention bits are set when error count reaches threshold. threshold = 2^n. 0xf r/w table 588: tlp error counter register (offset 0x7d40) bit field description init access 31-24 reserved write as 0, ignore when read. 0 r/o 23-16 tlp bad sequence number counter counts number of tlps with bad sequence number received since last read. counter freezes at max value and will be cleared to one if event occurs simultaneously to read. 0ro/cr 15-0 tlp error counter counts number of bad tlps received (includes bad lcrc, bad length or bad sequence number) since last read. counter freezes at max value and will be cleared to one if event occurs simultaneously to read. 0ro/cr table 589: dllp error counter (offset 0x7d44) bit field description init access 31-16 reserved write as 0, ignore when read. 0 r/o 15-0 dllp error counter counts number of bad dllps received (includes bad lcrc or bad length) since last read. counter freezes at max value and will be cleared to one if event occurs simultaneously to read. 0ro/cr www.datasheet.in programmer?s guide bcm57xx 01/29/08 broadcom corporation document 57xx-pg105-r pcie registers page 593 nak r eceived c ounter (o ffset 0 x 7d48) this register is applicable to bcm5721, bcm5751, and bcm5752 only. d ata l ink t est r egister (o ffset 0 x 7d4c) this register is applicable to bcm5721, bcm5751, and bcm5752 only. table 590: nak received counter (offset 0x7d48) bit field description init access 31-16 reserved write as 0, ignore when read. 0 r/o 15-0 nak received counter counts number of nak dllps received since last read. counter freezes at max value and will be cleared to one if event occurs simultaneously to counter read. 0ro/cr table 591: data link test register (offset 0x7d4c) bit field description init access 31-16 reserved write as 0, ignore when read. 0 r/o 15 store receive tlps write received tlps into retry buffer instead of transmitted tlps. 0r/w 14 disable tlps disable transmission of tlps. 0 r/w 13 disable dllps disable transmission and reception of dllps. 0 r/w 12 force phy link up force phy link input to data link layer to be up. 0 r/w 11 bypass flow control force flow control init flags to be set and available tx flow control credits to infinite. 0r/w 10 enable ram core clock margin test mode enable retry buffer ram core clock margin test mode. 0 r/w 9 enable ram overstress test mode enable retry buffer ram overstress test mode. 0 r/w 8 enable ram read margin test mode enable retry buffer ram read margin test mode. 0 r/w 7 speed up completion timer speed up completion timer and led blink rate for simulation. 0r/w 6 speed up replay timer speed up replay timer for simulation. 0 r/w 5 speed up ack latency timer speed up ack latency timer for simulation. 0 r/w 4 speed up pme service timer speed up pme service timer for simulation. 0 r/w 3 force purge purge the contents of the retry buffer. 0 w/sc 2 force retry retransmit the contents of the retry buffer. 0 w/sc 1 invert crc force entire lcrc to be inverted. 0 r/w 0 send bad crc force last bit of lcrc to be inverted. 0 r/w www.datasheet.in bcm57xx programmer?s guide 01/29/08 broadcom corporation page 594 pcie registers document 57xx-pg105-r p acket bist r egister (o ffset 0 x 7d50) this register is applicable to bcm5721, bcm5751, and bcm5752 only. phy m ode r egister (o ffset 0 x 7e00) this register is applicable to bcm5721, bcm5751, and bcm5752 only. table 592: packet bist register (offset 0x7d50) bit field description init access 31-24 reserved write as 0, ignore when read. 0 r/o 23 packet checker locked packet checker has locked to received data sequence. 0 r/o 22 receive mismatch receive data or packet length did not match pseudo- random sequence. this bit sticks high and can only be cleared by disabling the packet generator test mode or clearing the transmit start bit. 0r/o 21 enable random tlp length ? 1 = transmit random length tlps. ? 0 = transmit fixed length tlps. 1r/w 20-10 tlp length transmit tlp length is equal to this field + 3 dwords. when sending random length tlps, this field is anded with the random generator output in order to limit the maximum length. 0x1ff r/w 9 enable random ipg length ? 1 = transmit random length ipgs. ? 0 = transmit fixed length ipgs. 1r/w 8-2 ipg length transmit ipg length is equal to this field + two dwords. when sending random length ipgs, this field is anded with the random generator output in order to limit the maximum length. 0x1f r/w 1 transmit start start transmitting tlps. tlp transmission will be halted when this bit is cleared or when error condition occurs (receive data mismatch, dllp error or tlp error). 1r/w 0 enable packet generator test mode transmit continuous stream of random or fixed length tlps containing pseudorandom data, separated by random or fixed length ipgs. if tlps are looped back, received tlps are checked vs. expected length and data content. received tlps will be passed through retry buffer if the store receive tlps bit is set in the test register. 0r/w table 593: phy mode register (offset 0x7e00) bit field description init access 31-2 reserved write as 0, ignore when read. 0 r/o 1 link disable disable the logical phy layer functions. 0 r/w 0 soft reset softreset to the phylogical block. this bit will be self- cleared after four clock cycles. 0r/w www.datasheet.in programmer?s guide bcm57xx 01/29/08 broadcom corporation document 57xx-pg105-r pcie registers page 595 phy/l ink s tatus r egister (o ffset 0 x 7e04) this register is applicable to bcm5721, bcm5751, and bcm5752 only. phy/l ink ltssm c ontrol r egister (o ffset 0 x 7e08) this register is applicable to bcm5721, bcm5751, and bcm5752 only. table 594: phy/link status register (offset 0x7e04) bit field description init access 31-8 reserved - 0 r/o 7 link partner request loopback link partner requested remote loopback mode during training process. 0r/o 6 link partner disable scrambler the link partner disabled the scrambler during training process. 0r/o 5 extended synch extended synchronization from pci configuration register. if set, 4k fts ordered sets must be sent during link recovery. 0r/o 4 polarity inverted lane polarity is inverted. 0 r/o 3 link up the link training process is completed and link is ready for use. 0r/o 2 link training the link is in the training process. 0 r/o 1 receive data valid symbol synchronization is achieved and receive data is valid 0r/o 0- table 595: phy/link ltssm control register (offset 0x7e08) bit field description init access 31-8 reserved - 0 r/o 7 disablescramble disable scrambling and de-scrambling. 0 r/w 6 detectstate high layer directs ltssm to detect state if set. the bit is cleared when ltssm entered into detect state. 0r/w 5 pollingstate high layer directs ltssm to polling state if set. the bit is cleared when ltssm entered into polling state. 0r/w 4 configstate high layer directs ltssm to configuration state if set. the bit is cleared when ltssm entered into configuration state. 0r/w 3 recovstate high layer directs ltssm to recovery state if set. the bit is cleared when ltssm entered into recovery state. 0r/w 2 extlbstate high layer directs ltssm to external loopback master state if set. the bit is cleared when ltssm entered into master external loopback state. 0r/w 1 resetstate high layer directs ltssm to hot reset state if set. the bit is cleared when ltssm exited out of the hot reset state. 0r/w 0 disablestate high layer directs ltssm to disable state if set. the bit is cleared when ltssm entered into disable state. 0r/w www.datasheet.in bcm57xx programmer?s guide 01/29/08 broadcom corporation page 596 pcie registers document 57xx-pg105-r phy/l ink t raining l ink n umber (o ffset 0 x 7e0c) this register is applicable to bcm5721, bcm5751, and bcm5752 only. phy/l ink t raining l ane n umber (o ffset 0 x 7e10) this register is applicable to bcm5721, bcm5751, and bcm5752 only. phy/l ink t raining n_fts (o ffset 0 x 7e14) this register is applicable to bcm5721, bcm5751, and bcm5752 only. table 596: phy/link training link number (offset 0x7e0c) bit field description init access 31-8 reserved - 0 r/o 7-0 lane number lane number within component pad r/o table 597: phy/link training lane number (offset 0x7e10) bit field description init access 31-8 reserved - 0 r/o 7-0 lane number lane number within link pad r/o table 598: phy/link training n_fts (offset 0x7e14) bit field description init access 31-16 reserved - 0 r/o 15-8 inbound n_fts inbound maximum number of fts ordered sets to be sent when transitioning from l0s to l0 to achieve bit and framing synchronization. 0xff r/o 7-0 outbound n_fts outbound maximum number of fts ordered sets to be sent when transitioning from l0s to l0 to achieve bit and framing synchronization. 0xff r/w www.datasheet.in programmer?s guide bcm57xx 01/29/08 broadcom corporation document 57xx-pg105-r pcie registers page 597 phy a ttention r egister (o ffset 0 x 7e18) this register is applicable to bcm5721, bcm5751, and bcm5752 only. phy a ttention m ask r egister (o ffset 0 x 7e1c) this register is applicable to bcm5721, bcm5751, and bcm5752 only. table 599: phy attention register (offset 0x7e18) bit field description init access 31-8 reserved - 0 r/o 7 hot reset hot reset event. set by hot reset and cleared by explicitly writing 1. 0w2c 6 link down link down event. when link status transitions from up to down, this event bit will be set. 0w2c 5 training error ltssm training error. 0 w2c 4 buffer overrun receive elastic buffer overrun. 0 w2c 3 buffer underrun receive elastic buffer underrun. 0 w2c 2 receive framing error receive framing error. set when receive framing error count exceeds its threshold. 0w2c 1 receive disparity error receive 8b/10b running disparity error. set when 8b10b disparity count exceeds its threshold. 0w2c 0 receive code error receive 8b/10b code error. set when 8b/10b error count exceeds its threshold. 0w2c table 600: phy attention mask register (offset 0x7e1c) bit field description init access 31-8 reserved - 0 r/o 7 hot reset mask hot reset event mask bit. 0 r/w 6 link down mask link down event mask bit. 0 r/w 5 training error mask ltssm training error mask bit. 0 r/w 4 buffer overrun mask receive elastic buffer overrun mask bit. 0 r/w 3 buffer underrun mask receive elastic buffer underrun mask bit. 0 r/w 2 receive frame error mask receive frame error mask bit. 0 r/w 1 receive disparity error mask receive 8b/10b running disparity error mask bit. 0 r/w 0 receive code error mask receive 8b/10b code error mask bit. 0 r/w www.datasheet.in bcm57xx programmer?s guide 01/29/08 broadcom corporation page 598 pcie registers document 57xx-pg105-r phy r eceive e rror c ounter (o ffset 0 x 7e20) this register is applicable to bcm5721, bcm5751, and bcm5752 only. phy r eceive f raming e rror c ounter (o ffset 0 x 7e24) this register is applicable to bcm5721, bcm5751, and bcm5752 only. phy r eceive e rror t hreshold r egister (o ffset 0 x 7e28) this register is applicable to bcm5721, bcm5751, and bcm5752 only. table 601: phy receive er ror counter (offset 0x7e20) bit field description init access 31-16 disparity error count receive 8b/10b running disparity error count. 0 r2c 15-0 code error count receive 8b/10b coding error count. 0 r2c table 602: phy receive framing error counter (offset 0x7e24) bit field description init access 31-16 reserved - 0 r/o 15-0 framing error count receive framing error count. 0 r2c table 603: phy receive error threshold register (offset 0x7e28) bit field description init access 31-12 reserved - 0 r/o 11-8 frame error threshold receive frame error threshold. when the frame error count exceeds this threshold. the frame error attention bit is set. threshold=2^n, where n=bits(11:8). 0xf r/w 7-4 disparity error threshold receive 8b10b running disparity error threshold. when the running disparity error count exceed this threshold, the disparity error will be set. threshold = 2^n, where n = bits(7:4). 0xf r/w 3-0 code error threshold receive 8b10b coding error threshold. when the code error count exceeds threshold, the code error attention bit is set. threshold = 2^n, where n = bits(3:0). 0xf r/w www.datasheet.in programmer?s guide bcm57xx 01/29/08 broadcom corporation document 57xx-pg105-r pcie registers page 599 phy t est c ontrol r egister (o ffset 0 x 7e2c) this register is applicable to bcm5721, bcm5751, and bcm5752 only. table 604: phy test control register (offset 0x7e2c) bit field description init access 31-12 reserved - 0 r/o 11 enable immediate l1 exit issue enable the immediate l1 exit fix ? 0 = disable fix ? 1 = enable fix note: refer to e1_5751b0_09901 in the 5751-es4xx-r errata for details. 0r/w 10 reserved - 0 r/w 9 enable x16 slot l1 entry fix enable the x16 slot l1 entry problem fix ? 0 = disable fix ? 1 = enable fix enable this bit to avoid possible premature exit from the l1 state to recovery state. 0r/w reserved (bcm5752 only) should not be written with a value other than default value read from this bit. 0r/w 8 enable electrical ordered set not detected fix enable the electrical ordered set not detected fix ? 0 = disable fix ? 1 = enable fix the bcm5751/bcm5721 receiver fails to detect an electrical idle ordered set if it is sent after a partially completed dllp or tlp. this causes the link training state machine to see an unexpected electrical idle and transition to the recovery state instead of the l0s, l1, or l2 state. set this bit to 1 to fix the above problem. 0r/w reserved (bcm5752 only) should not be written with a value other than default value read from this bit. 0r/w 7 reserved should not be written with a value other than default value read from this bit. 0r/w 6 pcie 1.0 mode when this bit is: ? set to 1, the physical layer ltssm state machine operates in pcie 1.0 mode. ? clear, it operates in pcie 1.0a mode. 0r/w 5 pcie 1.0 scrambler when this bit is: ? set to 1, the pcie scrambler operates in pcie 1.0 mode. ? clear, it operates in pcie 1.0a mode. 0r/w 4 fast symbol lock up when this bit is: ? set to 1, the symbol boundary locks after receiving the first com symbol. ? clear, the symbol boundary locks after receiving four com symbols within a 64-symbol time. 0r/w 3 down stream lane set this bit to change the link to be a downstream lane (or upstream component). 0r/w 2 training bypass set to bypass link initialization and configuration process. 0 r/w www.datasheet.in bcm57xx programmer?s guide 01/29/08 broadcom corporation page 600 pcie registers document 57xx-pg105-r phy/s er d es c ontrol o verride r egister (o ffset 0 x 7e30) this register is applicable to bcm5721, bcm5751, and bcm5752 only. 1 external loopback force remote (external) loopback test mode. 0 r/w 0 internal loopback force internal parallel loopback test mode. 0 r/w table 605: phy/serdes control override register (offset 0x7e30) bit field description init access 31-18 reserved 0r/o 17 obsvelecidlevalue override value for the obsvelecidle signal from serdes. 0 r/w 16 obsvelecidleoverride set to override the obsvelecidle signal value from serdes with the value in bit 17 of this register. 0r/w 15 pllisupvalue override value for pllisup signal form serdes. 0 r/w 14 pllisupoverride set to override the pllisup signal value from serdes with the value in bit 15 of this register. 0r/w 13 rcvrdetvalue override value for rcvrdetected signal from serdes. 0 r/w 12 rcvrdetoverride set to override the rcvrdetected signal from serdes with the value in bit 13 of this register. 0r/w 11-10 rcvrdettimecontrol time unit of the rcvrdetectiontime: ? 2?b00: symbol time. ? 2?b01: 64 ns. ? 2?b10: 1 s. 0x0 r/w 9-0 rcvrdetectiontime time value that the phy logical layer uses for timing receiver detection sequences. 0x3ff r/w table 604: phy test control register (offset 0x7e2c) (cont.) bit field description init access www.datasheet.in programmer?s guide bcm57xx 01/29/08 broadcom corporation document 57xx-pg105-r pcie registers page 601 phy t iming p arameter o verride r egister (o ffset 0 x 7e34) this register is applicable to bcm5721, bcm5751, and bcm5752 only. phy h ardware d iagnostic 1 r egister (o ffset 0 x 7e38) this register is applicable to bcm5721, bcm5751, and bcm5752 only. table 606: phy timing parameter override register (offset 0x7e34) bit field description init access 31 ts1numoverride set to override the ts1 number to be sen out in polling active state with the value in bit (27:16) of this register from the specification defined value. 0r/w 30 txidleminoverride set to override the min time for a transmitter to stay with the value in bit (15:8) of this register from the specification defined value. 0r/w 29 txidle2idleoverride set to override the max time for electrical idle transition with the value in bit (7:0) of this register from the specification defined value. 0r/w 28 reserved - 0 r/o 27-16 n_ts1inpollingactive ts1 number needed to be sent in polling active state. 0x400 r/w 15-8 txidlemintime minimum time (in symbol time) a transmitter must be in electrical idle. 0x5 r/w 7-0 txidlesettoidletime maximum time (in symbol time) to transition to a valid electrical idle after sending an electrical idle ordered-set. 0x2 r/w table 607: phy hardware diagnostic 1 register (offset 0x7e38) bit field description init access 31-10 reserved - 0 r/o 9-4 transmit state machine state transmit state machine states: ? 9:8: tx data state ? 7:4: tx main state 0r/o 3-0 receive state machine state receive state machine states: ? 3:0: rx main state 0r/o www.datasheet.in bcm57xx programmer?s guide 01/29/08 broadcom corporation page 602 pcie registers document 57xx-pg105-r phy h ardware d iagnostic 2 r egister (o ffset 0 x 7e3c) this register is applicable to bcm5721, bcm5751, and bcm5752 only. table 608: phy hardware diagnostic 2 register (offset 0x7e3c) bit field description init access 31-0 ltssm state machine state ltssm state machine states: ? 31-28: main state. ? 27-26: detect substate. ? 25-23: polling substate. ? 22-20: configuration substate. ? 19-18: recover substate. ? 17-16: rx l0s substate. ? 15-14: rx l0s substate. ? 13-12: l1 substate. ? 11-10: l2 substate. ? 9-8: disable substate. ? 7-6: loopback substate. ? 5-4: reset substate. ? 3-0: reserved. 0r/o www.datasheet.in programmer?s guide bcm57xx 01/29/08 broadcom corporation document 57xx-pg105-r transceiver registers page 603 t ransceiver r egisters the bcm5701 and later mac controllers have an integrated 10/100/1000t phy or serdes phy or 1000base-x phy. this section describes the mii registers of the integrated 10/100/1000t and 1000base-x phy transceivers. the access to the transceiver registers is provided indirectly through the mii communication register (see ?mi communication register (offset 0x44c)? on page 388 ) of the mac. the transceiver registers are accessed with the phy_addr bit of the mii communication register set to 0x1. the integrated transceiver contains the set of registers shown in table 609 . there is no integrated phy in bcm5700 and hence the transceiver registers in this section are not applicable to the bcm5700 mac. the BCM5703s and bcm5704s support the fiber media through an integrated serdes phy whose control registers are specified in the mac registers. so the transceiver registers described in this section are also not applicable to BCM5703s and bcm5704s devices. the bcm5714s and bcm5715s devices with integrated 1000base- x phy also support the mii registers described in this section. the mii registers at offset 0x00-0x0f of 1000base-x phy are different from the mii registers 0x00-0x0f of 10/100/ 1000t phy. this section also covers the description of 1000base-x mii registers which are applicable to bcm5714s and bcm5715s devices. table 609: transceiver register map reg_addr register 00h mii control register 01h mii status register 02h phy identifier 03h phy identifier 04h auto-negotiation advertisement 05h auto-negotiation link partner base page ability 06h auto-negotiation expansion register 07h auto-negotiation next page transmit 08h auto-negotiation link partner received next page 09h 1000base-t control register 0ah 1000base-t status register 0b-0eh reserved* 0fh ieee extended status register 10h phy extended control register 11h phy extended status register 12h receive error counter 13h false carrier sense counter 14h receiver not_ok counters 15h-17h reserved* 18h auxiliary control register 19h auxiliary status summary register 1ah interrupt status register 1bh interrupt mask register www.datasheet.in bcm57xx programmer?s guide 01/29/08 broadcom corporation page 604 transceiver registers document 57xx-pg105-r 00-0fh 1000bt/100btx/10bt r egisters mii control register (phy_addr = 0x1, reg_addr = 00h) 1ch reserved* 1d-1fh test registers * reserved registers should never be read or written. table 610: mii control register (phy_addr = 0x1, reg_addr = 00h) bit field description init access 15 reset to reset the transceiver by software control, a 1 can be sent to bit 15 of the mii control register using an mii write operation. the bit clears itself after the reset process is complete and need not be cleared using a second mii write. writes to other mii control register bits have no effect until the reset process is completed, which requires approximately 2.0 s. writing a 0 to this bit has no effect. when this bit is read, it returns a one during the reset process, otherwise, it returns a 0. ? 1 = phy reset ? 0 = normal operation 0r/w sc 14 internal loopback the bcm57xx can be placed into internal loopback mode by writing a 1 to bit 14 of the mii control register. the loopback mode can be cleared by writing a 0 to bit 14 of the mii control register, or by resetting the chip. when this bit is read, it returns a 1 when the chip is in loopback mode, otherwise, it returns a 0. ? 1 = loopback mode ? 0 = normal operation 0r/w 13 speed selection (lsb) bits 6 and 13 of the mii control register can be used to manually select the speed of operation when auto- negotiation is disabled. when bit 6 is set and bit 13 is cleared, 1000base-t is selected. when bit 6 is cleared and bit 13 is set, 100base-t is selected. when both bits are cleared, 10base-t is selected. other configurations are reserved and cause unpredictable behavior in the bcm57xx. when read, these bits return the last value written. bits 6,13: ? 1 1 = reserved ? 1 0 = 1000 mbps ? 0 1 = 100 mbps ? 0 0 = 10 mbps 0r/w table 609: transceiver register map (cont.) reg_addr register www.datasheet.in programmer?s guide bcm57xx 01/29/08 broadcom corporation document 57xx-pg105-r transceiver registers page 605 12 auto-negotiation enable when bit 12 of the mii control register is set, the bcm57xx mode of operation is controlled by auto- negotiation. when this bit is cleared, the bcm57xx mode of operation is determined by the manual speed, duplex mode, and master/slave configuration bits. when this bit is read, it returns a 1 when auto- negotiation is enabled, otherwise, it returns a 0. ? 1 = auto-negotiation enabled ? 0 = auto-negotiation disabled 1r/w 11 power down when bit 11 of the mii control register is written to 1, the transceiver is placed into low-power standby mode. ? 1 = power dow ? 0 = normal operation. 0r/w 10 isolate ? 1 = electrically isolate phy from mii ? 0 = normal operation 0r/w 9 restart auto- negotiation bit 9 of the mii control register allows the auto- negotiation process to be restarted, regardless of the current state of the auto-negotiation state machine. when auto-negotiation is enabled, writing a 1 to this bit restarts the auto-negotiation process. writing a 0 to this bit has no effect. this bit is self-clearing, so it always returns 0 when read. ? 1 = restarting auto-negotiation ? 0 = auto-negotiation restart complete 0r/w sc 8 duplex mode when auto-negotiation is disabled, the duplex mode of the bcm57xx can be controlled by writing to bit 8 of the control register. setting this bit to a 1 forces the bcm57xx into full-duplex operation, and setting this bit to a 0 forces the bcm57xx into half-duplex operation. ? 1 = full-duplex ? 0 = half-duplex 1r/w 7 collision test enable ? 1 = enable the collision test mode ? 0 = disable the collision test mode 0r/w 6 speed selection (msb) see bit 13. 1 r/w 5:0 reserved write as 0, ignore on read. - r/w table 610: mii control register (phy _addr = 0x1, reg_addr = 00h) (cont.) bit field description init access www.datasheet.in bcm57xx programmer?s guide 01/29/08 broadcom corporation page 606 transceiver registers document 57xx-pg105-r mii status register (phy_addr = 0x1, reg_addr = 01h) table 611: mii status register (phy_addr = 0x1, reg_addr = 01h) bit field description init access 15 100base-t4 capable the bcm57xx is not capable of 100base-t4 operation, and returns a 0 when bit 15 of the mii status register is read. ? 1 = 100base-t4 capable ? 0 = not 100base-t4 capable 0r/o l 14 100base-x full- duplex capable the bcm57xx is capable of 100base-tx full-duplex operation, and returns a 1 when bit 14 of the mii status register is read. ? 1 = 100base-x full-duplex capable ? 0 = not 100base-x full-duplex capable 1r/o h 13 100base-x half- duplex capable the bcm57xx is capable of 100base-x half-duplex operation, and returns a 1 when bit 13 of the mii status register is read. ? 1 = 100base-x half-duplex capable ? 0 = not 100base-x half-duplex capable 1r/o h 12 10base-t full- duplex capable the bcm57xx is capable of 10base-t full-duplex operation, and returns a 1 when bit 12 of the mii status register is read. ? 1 = 10base-t full-duplex capable ? 0 = not 10base-t full-duplex capable 1r/o h 11 10base-t half- duplex capable the bcm57xx is capable of 10base-t half-duplex operation, and returns a 1 when bit 11 of the mii status register is read. ? 1 = 10base-t half-duplex capable ? 0 = not 10base-t half-duplex capable. 1r/o h 10 100base-t2 full- duplex capable the bcm57xx is not capable of 100base-t2 full- duplex operation, and returns a 0 when bit 10 of the mii status register is read. ? 1 = 100base-t2 full-duplex capable ? 0 = not 100base-t2 full-duplex capable 0r/o l 9 100base-t2 half- duplex capable the bcm57xx is not capable of 100base-t2 half- duplex operation, and returns a 0 when bit 9 of the mii status register is read. ? 1 = 100base-t2 half-duplex capable ? 0 = not 100base-t2 half-duplex capable. 0r/o l 8 extended status the bcm57xx contains the extended status register at reg_addr = 0fh, and returns a 1 when bit 8 of the mii status register is read. ? 1 = extended status information in reg 0fh ? 0 = no extended status information in reg 0fh 1r/o h 7 reserved ignore on read - r/o www.datasheet.in programmer?s guide bcm57xx 01/29/08 broadcom corporation document 57xx-pg105-r transceiver registers page 607 6 management frames preamble suppression the bcm57xx accepts mii management frames whether or not they are preceded by the preamble pattern, and returns a 1 when bit 6 of the status register is read. the preamble is still required on the first read or write. ? 1 = preamble can be suppressed ? 0 = preamble always required 1r/o h 5 auto-negotiation complete the bcm57xx returns a 1 on bit 15 of the auxiliary status summary register (see ?auxiliary status summary register (phy_addr = 0x1, reg_addr = 19h)? on page 657 ) when auto-negotiation has completed and the contents of registers 4, 5, and 6 are valid. this bit returns a 0 while auto-negotiation is in progress. ? 1 = auto-negotiation complete ? 0 = auto-negotiation in progress 0r/o 4 remote fault the bcm57xx returns a 1 on bit 4 of the mii status register when its link partner has signalled a remote fault condition. when a remote fault occurs, the bit is latched at 1 and remains so until the register is read, and the remote fault condition has been cleared. ? 1 = remote fault detected ? 0 = no remote fault detected 0r/o lh 3 auto-negotiation ability the bcm57xx is capable of performing ieee auto- negotiation, and returns a 1 when bit 3 of the mii status register is read, regardless of whether the auto- negotiation function has been disabled. ? 1 = auto-negotiation capable ? 0 = not auto-negotiation capable 1r/o h 2 link status the bcm57xx returns a 1 on bit 2 of the mii status register when the link monitor is in the link pass state, indicating that a valid link has been established. otherwise, it returns a 0. when a link failure occurs, the link status bit is latched at 0 and remains so until the bit is read, and the bcm57xx is in the link pass state. ? 1 = link is up (link pass state) ? 0 = link is down (link fail state) 0r/o ll 1 jabber detect jabber detection is performed within the phy and the result is latched into this bit. the bcm57xx returns a 1 in bit 1 of the status register when a jabber condition has been detected. the bit is cleared by the read. ? 1 = jabber condition detected ? 0 = no jabber condition detected 0r/o lh 0 extended capability the bcm57xx supports extended capability registers, and returns a 1 when bit 0 of the mii status register is read. ? 1 = extended register capabilities ? 0 = no extended register capabilities 1r/o h table 611: mii status register (phy_addr = 0x1, reg_addr = 01h) (cont.) bit field description init access www.datasheet.in bcm57xx programmer?s guide 01/29/08 broadcom corporation page 608 transceiver registers document 57xx-pg105-r phy identifier registers (phy_addr = 0x1, reg_addresses 02h and 03h) auto-negotiation advertisement register (phy_addr = 0x1, reg_addr = 04h) table 612: phy identifier registers (phy_addr = 0x1, reg_addresses 02h and 03h) bit field description init access 15:0 address = 02: id msbs 16 msbs of phy identifier 0x0020 r/o 15:0 address = 03: id lsbs (BCM5703c and BCM5703s only) 16 lsbs of phy identifier 0x616 1 r/o address = 03: id lsbs (bcm5705 only) 16 lsbs of phy identifier 0x61 1 1. the revision number ( n ) changes with each silicon revision. r/o address = 03: id lsbs (bcm5704c and bcm5704s only) 16 lsbs of phy identifier 0x619 - address = 03: id lsbs (bcm5721, and bcm5751 only) 16 lsbs of phy identifier 0x618 1 r/o table 613: auto-negotiation advertisement re gister (phy_addr = 0x1, reg_addr = 04h) bit field description init access 15 next page bit 15 of the auto-negotiation advertisement register must be written to 1 when the management software wishes to control next page exchange. when this bit is written to 0, next page exchange is controlled automatically by the bcm57xx. when this bit is 0 and the bcm57xx is advertising no 1000base-t capability, no exchange of next pages occurs. ? 1 = next page ability supported ? 0 = next page ability not supported 0r/w 14 reserved write as 0, ignore on read. 0 r/o 13 remote fault writing a 1 to bit 13 of the auto-negotiation advertisement register sends a remote fault indication to the link partner during auto-negotiation. writing a 0 to this bit clears the remote fault transmission bit. this bit returns a 1 when advertising remote fault, otherwise, it returns a 0. ? 1 = advertise remote fault detected ? 0 = advertise no remote fault detected 0r/w 12 reserved technologies bit 12 of the auto-negotiation advertisement register is reserved for future versions of the auto-negotiation standard and must always be written as 0. write as 0, ignore on read. 0r/w www.datasheet.in programmer?s guide bcm57xx 01/29/08 broadcom corporation document 57xx-pg105-r transceiver registers page 609 11 asymmetric pause when bit 11 of the auto-negotiation advertisement register is written to 1, the bcm57xx advertises that asymmetric pause is desired. when the bit is written to 0, the bcm57xx advertises that asymmetric pause is not needed. this bit returns a 1 when advertising asymmetric pause, otherwise, it returns a 0. when advertising asymmetric pause, bit 10 of the auto-negotiation advertisement register indicates the desired direction of pause operation. setting bit 10 to 1 indicates that pause frames flow toward the bcm57xx. setting bit 10 to 0 indicates that pause frames flow toward the link partner. ? 1 = advertise asymmetric pause ? 0 = advertise no asymmetric pause 0r/w 10 pause capable when bit 10 of the auto-negotiation advertisement register is written to 1, the bcm57xx advertises full-duplex pause capability. when the bit is written to 0, the bcm57xx advertises no pause capability. this bit returns a 1 when advertising pause capability, otherwise, it returns a 0. ? 1 = capable of full-duplex pause operation ? 0 = not capable of pause operation 0r/w 9 100base-t4 capability when bit 9 of the auto-negotiation advertisement register is written to 1, the bcm57xx advertises 100base-t4 capability. when the bit is written to 0, the bcm57xx advertises no 100base-t4 capability. this bit returns a 1 when advertising 100base-t4 capability, otherwise, it returns a 0. ? 1 = 100base-t4 capable ? 0 = not 100base-t4 capable 0r/w 8 100base-tx full- duplex capability when bit 8 of the auto-negotiation advertisement register is written to 1, the bcm57xx advertises 100base-tx full- duplex capability. when the bit is written to 0, the bcm57xx advertises no 100base-tx full-duplex capability. this bit returns a 1 when advertising 100base-tx full-duplex capability, otherwise, it returns a 0. ? 1 = 100base-tx full-duplex capable ? 0 = not 100base-tx full-duplex capable 1r/w 7 100base-tx half- duplex capability when bit 7 of the auto-negotiation advertisement register is written to 1, the bcm57xx advertises 100base-tx half- duplex capability. when the bit is written to 0, the bcm57xx advertises no 100base-tx half-duplex capability. this bit returns a 1 when advertising 100base-tx half-duplex capability, otherwise, it returns a 0. ? 1 = 100base-tx half-duplex capable ? 0 = not 100base-tx half-duplex capable 1r/w 6 10base-t full- duplex capability when bit 6 of the auto-negotiation advertisement register is written to 1, the bcm57xx advertises 10base-t full- duplex capability. when the bit is written to 0, the bcm57xx advertises no 10base-t full-duplex capability. this bit returns a 1 when advertising 10base-t full-duplex capability, otherwise, it returns a 0. ? 1 = 10base-t full-duplex capable ? 0 = not 10base-t full-duplex capable 1r/w table 613: auto-negotiation advertisement regist er (phy_addr = 0x1, reg_ addr = 04h) (cont.) bit field description init access www.datasheet.in bcm57xx programmer?s guide 01/29/08 broadcom corporation page 610 transceiver registers document 57xx-pg105-r auto-negotiation link partner ability register (phy_addr = 0x1, reg_addr = 05h) this register is addressed through the mii communication register (see ?mi communication register (offset 0x44c)? on page 388 ) with the phy address field = 0x1 and the register address field = 05h. this register is not applicable to the bcm5700 mac. the values contained in the auto-negotiation link partner ability register are only guaranteed to be valid once auto- negotiation has successfully completed, as indicated by bit 5 of the mii status register. 5 10base-t half- duplex capability when bit 5 of the auto-negotiation advertisement register is written to 1, the bcm57xx advertises 10base-t half- duplex capability. when the bit is written to 0, the bcm57xx advertises no 10base-t half-duplex capability. this bit returns a 1 when advertising 10base-t half-duplex capability, otherwise, it returns a 0. ? 1 = 10base-t half-duplex capable ? 0 = not 10base-t half-duplex capable 1r/w 4:0 selector field bits 4:0 of the auto-negotiation advertisement register indicate the protocol type. the value 00001 indicates that the bcm57xx belongs to the 802.3 class of phy transceivers. 00001 indicates ieee 802.3 csma/cd 00001 r/w table 614: auto-negotiation link partner ability register (phy_addr = 0x1, reg_addr = 05h) bit field description init access 15 next page the bcm57xx returns a 1 on bit 15 of the link partner ability register when the link partner wishes to transmit next page information. ? 1 = link partner has next page ability ? 0 = link partner does not have next page ability 0r/o 14 acknowledge the bcm57xxreturns a 1 on bit 14 of the link partner ability register when the link partner has acknowledged reception of the link code word, otherwise, it returns a 0. ? 1 = link partner has received link code word ? 0 = link partner has not received link code word 0r/o 13 remote fault the bcm57xx returns a 1 on bit 13 of the link partner ability register when the link partner has advertised detection of a remote fault, otherwise, it returns a 0. ? 1 = link partner has detected remote fault ? 0 = link partner has not detected remote fault 0r/o 12 reserved technologies bit 12 of the link partner ability register is reserved for future versions of the auto-negotiation standard and should be ignored when read. write as 0, ignore on read. 0r/o table 613: auto-negotiation advertisement regist er (phy_addr = 0x1, reg_ addr = 04h) (cont.) bit field description init access www.datasheet.in programmer?s guide bcm57xx 01/29/08 broadcom corporation document 57xx-pg105-r transceiver registers page 611 11 asymmetric pause the bcm57xx returns a 1 on bit 11 of the link partner ability register when the link partner has advertised asymmetric pause, otherwise, it returns a 0. ? 1 = link partner desires asymmetric pause ? 0 = link partner does not desire asymmetric pause 0r/o 10 pause capable the bcm57xx returns a 1 on bit 10 of the link partner ability register when the link partner has advertised pause capability, otherwise, it returns a 0. ? 1 = link partner is capable of pause operation ? 0 = link partner not capable of pause operation 0r/o 9 100base-t4 capability the bcm57xx returns a 1 on bit 9 of the link partner ability register when the link partner has advertised 100base-t4 capability, otherwise, it returns a 0. ? 1 = link partner is 100base-t4 capable ? 0 = link partner is not 100base-t4 capable 0r/o 8 100base-tx full- duplex capability the bcm57xx returns a 1 on bit 8 of the link partner ability register when the link partner has advertised 100base-tx full-duplex capability, otherwise, it returns a 0. ? 1 = link partner is 100base-tx full-duplex capable ? 0 = link partner is not 100base-tx full-duplex capable 0r/o 7 100base-tx half- duplex capability the bcm57xx returns a 1 on bit 7 of the link partner ability register when the link partner has advertised 100base-tx half-duplex capability, otherwise, it returns a 0. ? 1 = link partner is 100base-tx half-duplex capable ? 0 = link partner not 100base-tx half-duplex capable 0r/o 6 10base-t full- duplex capability the bcm57xx returns a 1 on bit 6 of the link partner ability register when the link partner has advertised 10base-t full- duplex capability, otherwise, it returns a 0. ? 1 = link partner is 10base-t full-duplex capable ? 0 = link partner is not 10base-t full-duplex capable 0r/o 5 10base-t half- duplex capability the bcm57xx returns a 1 on bit 5 of the link partner ability register when the link partner has advertised 10base-t half- duplex capability, otherwise, it returns a 0. ? 1 = link partner is 10base-t half-duplex capable ? 0 = link partner is not 10base-t half-duplex capable 0r/o 4:0 protocol selector field bits 4:0 of the link partner ability register return the value of the link partner?s advertised protocol selector field. link partner protocol selector field. 00000 r/o table 614: auto-negotiation link partner ability register (phy_addr = 0x1, reg_addr = 05h) (cont.) bit field description init access www.datasheet.in bcm57xx programmer?s guide 01/29/08 broadcom corporation page 612 transceiver registers document 57xx-pg105-r auto-negotiation expansion register (phy_addr = 0x1, reg_addr = 06h) table 615: auto-negotiation expansion regi ster (phy_addr = 0x1, reg_addr = 06h) bit field description init access 15:5 reserved ignore when read - r/o 4 parallel detection fault bit 4 of the auto-negotiation expansion register returns a 1 when a parallel detection fault has occurred in the auto-negotiation state machine. when a parallel detection fault occurs, this bit is latched at 1 and remains so until the register read. this bit returns a 0 when a parallel detection fault has not occurred since the last time it was read. ? 1 = parallel link fault detected. ? 0 = parallel link fault not detected. 0r/o lh 3 link partner next page ability the bcm57xx returns a 1 on bit 3 of the auto- negotiation expansion register when the link partner needs to transmit next page information, otherwise, it returns a 0. this bit is a copy of bit 15 of the auto- negotiation link partner ability register (see ?auto- negotiation link partner ability register (phy_addr = 0x1, reg_addr = 05h)? on page 610 ). ? 1 = link partner has next page capability. ? 0 = link partner does not have next page capability. 0r/o 2 next page capability the bcm57xx returns a 1 on bit 1 of the auto- negotiation expansion register when a new link code word has been received from the link partner since the last time this register was read, otherwise, it returns a 0. ? 1 = bcm57xx is next page capable. ? 0 = bcm57xx is not next page capable. 1r/o lh 1 page received the bcm57xx returns a 1 on bit 1 of the auto- negotiation expansion register when a new link code word has been received from the link partner since the last time this register was read, otherwise, it returns a 0. ? 1 = new page has been received from link partner. ? 0 = new page has not been received. 0r/o lh 0 link partner auto- negotiation ability the bcm57xx returns a 1 on bit 0 of the auto- negotiation expansion register when the link partner is known to have auto-negotiation capability. before any auto-negotiation information is exchanged, or if the link partner does not comply with ieee auto-negotiation, the bit returns a 0. ? 1 = link partner has auto-negotiation capability. ? 0 = link partner does not have auto-negotiation. 0r/o www.datasheet.in programmer?s guide bcm57xx 01/29/08 broadcom corporation document 57xx-pg105-r transceiver registers page 613 next page transmit register (phy_addr = 0x1, reg_addr = 07h) table 616: next page transmit regi ster (phy_addr = 0x1, reg_addr = 07h) bit field description init access 15 next page bit 15 of the next page transmit register must be set to 1 to indicate that more next pages are to be sent. this bit must be set to 0 to indicate that this is the last next page to be transmitted. when this bit is read, it returns the last value written. ? 1 = additional next pages follow. ? 0 = sending last next page. 0r/w 14 reserved write as 0, ignore on read. 0 r/o 13 message page bit 13 of the next page transmit register must be set to 1 to indicate that a formatted message page is being sent. this bit must be set to 0 to indicate that an unformatted page is being sent. when this bit is read, it returns the last value written. ? 1 = formatted page. ? 0 = unformatted page. 1r/w 12 acknowledge2 when this bit is set to 1, the bcm57xx indicates that it can comply with the next page request. when this bit is set to 0, the bcm57xx indicates that it cannot comply with the next page request. when this bit is read, it returns the last value written. ? 1 = complies with message. ? 0 = cannot comply with message. 0r/w 11 toggle this bit toggles between different next page exchanges to insure a functional synchronization to the link partner. toggles between exchanges of different next pages. 0r/o 10:0 message or unformatted code field these 11 bits make up the message code defined ieee 802.3 section 28, annex c when sending formatted pages. when sending unformatted next pages, these 11 bits contain an arbitrary data value. 0...01 r/w www.datasheet.in bcm57xx programmer?s guide 01/29/08 broadcom corporation page 614 transceiver registers document 57xx-pg105-r link partner received next page register (phy_addr = 0x1, reg_addr = 08h) table 617: link partner received next page register (phy_addr = 0x1, reg_addr = 08h) bit field description init access 15 next page bit 15 of the link partner received next page register returns a 1 when the link partner has indicated that more next pages are to be sent. this bit returns a 0 when the link partner has indicated that this is the last next page to be transmitted. ? 1 = additional next pages follow. ? 0 = sending last next page. 0r/o 14 acknowledge bit 14 returns a 1 to indicate that the link partner has received and acknowledged a next page. the bit returns a 0 until the link partner has acknowledged the page. ? 1 = acknowledge. ? 0 = no acknowledge. 0r/o 13 message page bit 13 of the link partner received next page register returns a 1 to indicate that the link partner has sent a formatted message page. this bit returns a 0 when the link partner has sent an unformatted page. ? 1 = formatted page. ? 0 = unformatted page. 0r/o 12 acknowledge2 bit 12 of the link partner received next page register returns a 1 when the link partner indicates that it can comply with the next page request. this bit returns a 0 when the link partner indicates that it cannot comply with the next page request. ? 1 = complies with message. ? 0 = cannot comply with message. 0r/o 11 toggle the link partner toggles this bit between different next page exchanges to insure a functional synchronization to the bcm57xx. toggles between exchanges of different next pages. 0r/o 10:0 message code field these 11 bits make up the message code defined ieee 802.3, section 28, annex c, when the link partner has sent a formatted page. when the link partner has sent unformatted next pages, these 11 bits contain an arbitrary data value. 0...0 r/o www.datasheet.in programmer?s guide bcm57xx 01/29/08 broadcom corporation document 57xx-pg105-r transceiver registers page 615 1000base-t control register (phy_addr = 0x1, reg_addr = 09h) table 618: 1000base-t control register (phy_addr = 0x1, reg_addr = 09h) bit field description init access 15:13 test mode the bcm57xx can be placed in one of four transmit test modes by writing bits 15:13 of the 1000base-t control register. the transmit test modes are defined in ieee 802.3ab. when read, these bits return the last value written. ? 1 x x = test mode 4: transmitter distortion test. ? 0 1 1 = test mode 3: slave transmit jitter test. ? 0 1 0 = test mode 2: master transmit jitter test. ? 0 0 1 = test mode 1: transmit waveform test. ? 0 0 0 = normal operation. 000 r/w 12 master/slave configuration enable when bit 12 of the 1000base-t control register is written to 1, the bcm57xx master/slave mode is configured using the manual master/slave configuration value. when the bit is written to 0, the master/slave mode is configured using the automatic resolution function. this bit returns a 1 when manual master/slave configuration is enabled, otherwise, it returns a 0. ? 1 = enable master/slave manual configuration value. ? 0 = automatic master/slave configuration. 0r/w 11 master/slave configuration value when bit 12 of the 1000base-t control register is written to 1, bit 11 of the 1000base-t control register determines the bcm57xx master/slave mode of operation. when bit 11 is set to 1, the bcm57xx is configured as master. when bit 11 is set to 0, the bcm57xx is configured as slave. when read, this bit returns the last value written. ? 1 = configure phy as master. ? 0 = configure phy as slave. 0r/w 10 repeater/dte when bit 10 of the 1000base-t control register is written to 1, the bcm57xx advertises that it is a repeater or switch device port. when the bit is written to 0, the bcm57xx advertises that it is a dte port. the advertised value is used in the automatic master/slave configuration resolution. the link partner that advertises repeater mode is configured to master if the opposing link partner advertises dte, otherwise, this bit has no effect. this bit returns a 1 when advertising repeater/switch mode, otherwise, it returns a 0. by default, the device advertises that it is a dte. ? 1 = repeater/switch device port. ? 0 = dte device. 0r/w 9 advertise 1000base-t full-duplex capability when bit 9 of the 1000base-t control register is written to 1, the bcm57xx advertises 1000base-t full- duplex capability. when bit 9 is written to 0, the bcm57xx advertises no 1000base-t full-duplex capability. this bit returns a 1 when advertising 1000base-t full-duplex capability, otherwise, it returns a 0. the default value of this bit is 1. ? 1 = advertise 1000base-t full-duplex capability. ? 0 = advertise no 1000base-t full-duplex capability. 1r/w www.datasheet.in bcm57xx programmer?s guide 01/29/08 broadcom corporation page 616 transceiver registers document 57xx-pg105-r 1000base-t status register (phy_addr = 0x1, reg_addr = 0ah) the values contained in bits 14,11, and 10 of the 1000base-t status register are only guaranteed to be valid once auto- negotiation has successfully completed, as indicated by bit 5 of the mii status register. 8 advertise 1000base-t half-duplex capability when bit 8 of the 1000base-t control register is written to 1, the bcm57xx advertises 1000base-t half-duplex capability. when bit 8 is written to 0, the bcm57xx advertises no 1000base-t half-duplex capability. this bit returns a 1 when advertising 1000base-t half-duplex capability, otherwise, it returns a 0. ? 1 = advertise 1000base-t half-duplex capability. ? 0 = advertise no 1000base-t half-duplex capability. 1r/w 7:0 reserved write as 0, ignore on read. 0....0 r/o table 619: 1000base-t status register (phy_addr = 0x1, reg_addr = 0ah) bit field description init access 15 master/slave configuration fault the bcm57xx returns a 1 on bit 15 of the 1000base-t status register when a master/slave configuration fault has occurred during auto-negotiation. when a configuration fault occurs, the bit is latched at 1 and remain so until either the register is read, auto-negotiation is restarted by writing bit 9 in the mii control register or auto-negotiation completes successfully with no master/slave configuration fault. ? 1 = master/slave configuration fault detected. ? 0 = no master/slave configuration fault detected. 0r/o lh 14 master/slave configuration resolution when the bcm57xx has been configured as master, it returns a 1 on bit 14 of the 1000base-t status register. when the bcm57xx has been configured as slave, it returns a 0. ? 1 = local transmitter is master. ? 0 = local transmitter is slave. 0r/o 13 local receiver status the bcm57xx returns a 1 on bit 13 of the 1000base-t status register when the local receiver status is ok, otherwise, it returns a 0. ? 1 = local receiver ok. ? 0 = local receiver not ok. 0r/o 12 remote receiver status the bcm57xx returns a 1 on bit 12 of the 1000base-t status register when the remote receiver status is ok, otherwise, it returns a 0. ? 1 = remote receiver ok. ? 0 = remote receiver not ok. 0r/o 11 link partner 1000base-t full- duplex capability the bcm57xx returns a 1 on bit 11 of the 1000base-t status register when the link partner has advertised 1000base-t full- duplex capability, otherwise, it returns a 0. ? 1 = link partner is 1000base-t full-duplex capable. ? 0 = link partner not 1000base-t full-duplex capable. 0r/o table 618: 1000base-t control register (phy_addr = 0x1, reg_addr = 09h) (cont.) bit field description init access www.datasheet.in programmer?s guide bcm57xx 01/29/08 broadcom corporation document 57xx-pg105-r transceiver registers page 617 ieee extended status register (phy_addr = 0x1, reg_addr = 0fh) 10 link partner 1000base-t half- duplex capability the bcm57xx returns a 1 on bit 10 of the 1000base-t status register when the link partner has advertised 1000base-t half-duplex capability, otherwise, it returns a 0. ? 1 = link partner is 1000base-t half-duplex capable. ? 0 = link partner not 1000base-t half-duplex capable. 0r/o 9:8 reserved write as 0, ignore on read. 0 r/o 7:0 idle error count the bcm57xx counts the number of idle errors received while the local receiver status is ok. bits 7 through 0 of the 1000base-t status register returns the number of idle errors counted since the last time the register was read. the counter freezes at the maximum value (ffh) to prevent overflow. the number of idle errors since last read. 0r/o table 620: ieee extended status register (phy_addr = 0x1, reg_addr = 0fh) bit field description init access 15 1000base-x full- duplex capability the bcm57xx is not capable of 1000base-x full- duplex operation, and returns a 0 when bit 15 of the ieee extended status register is read. ? 1 = 1000base-x full-duplex capable. ? 0 = not 1000base-x full-duplex capable. 0r/o l 14 1000base-x half- duplex capability the bcm57xx is not capable of 1000base-x half- duplex operation, and returns a 0 when bit 14 of the ieee extended status register is read. ? 1 = 1000base-x half-duplex capable. ? 0 = not 1000base-x half-duplex capable. 0r/o l 13 1000base-t full- duplex capability the bcm57xx is capable of 1000base-t full-duplex operation, and returns a 1 when bit 13 of the ieee extended status register is read. ? 1 = 1000base-t full-duplex capable. ? 0 = not 1000base-t full-duplex capable. 1r/o h 12 1000base-t half- duplex capability the bcm57xx is capable of 1000base-t half-duplex operation, and returns a 1 when bit 12 of the ieee extended status register is read. ? 1 = 1000base-t half-duplex capable. ? 0 = not 1000base-t half-duplex capable. 1r/o h 11:0 reserved write as 0, ignore on read. 0 r/o table 619: 1000base-t status register (p hy_addr = 0x1, reg_addr = 0ah) (cont.) bit field description init access www.datasheet.in bcm57xx programmer?s guide 01/29/08 broadcom corporation page 618 transceiver registers document 57xx-pg105-r 00 h -0f h 1000base-x r egister m ap d etailed d escription 00h: 1000-x mii control register table 621: 00h: 1000-x mii control register bit name r/w description default 15 reset r/w sc ? 1 = phy reset ? 0 = normal operation 0 14 loopback r/w ? 1 = loopback mode ? 0 = normal operation 0 13 reserved ro write as 0, ignore on read 0 12 auto-negotiation enable r/w ? 1 = auto-negotiation enabled ? 0 = auto-negotiation disabled 11 power down r/w ? 1 = low-power mode ? 0 = normal operation 10 isolate r/w ? 1 = isolate phy from mii ? 0 = normal operation 9 restart auto- negotiation r/w sc ? 1 = restart auto-negotiation process ? 0 = normal operation 0 8 duplex mode r/w ? 1 = full-duplex ? 0 = half-duplex 7 collision test r/w ? 1 = collision test mode enabled ? 0 = collision test mode disabled 0 6 reserved ro write as 1, ignore on read 1 5:0 reserved ro write as 0, ignore on read 000000 note: this register is applicable to bcm5714s and bcm5715s devices only. www.datasheet.in programmer?s guide bcm57xx 01/29/08 broadcom corporation document 57xx-pg105-r transceiver registers page 619 01h: 1000-x mii status register table 622: 01h: 1000-x mii status register bit name r/w description default 15 100base-t4 capable ro l ? 1 = 100base-t4 capable ? 0 = not 100base-t4 capable 0 14 100base-x full ro ? 1 = 100base-x full-duplex capable 0 duplex capable l ? 0 = not 100base-x full-duplex capable 13 100base-x half ro ? 1 = 100base-x half-duplex capable 0 duplex capable l ? 0 = not 100base-x half-duplex capable 12 10base-t full duplex ro ? 1 = 10base-t full-duplex capable 0 capable l ? 0 = not 10base-t full-duplex capable 11 10base-t half duplex ro ? 1 = 10base-t half-duplex capable 0 capable l ? 0 = not 10base-t half-duplex capable 10 100base-t2 full ro ? 1 = 100base-t2 full-duplex capable 0 duplex capable l ? 0 = not 100base-t2 full-duplex capable 9 100base-t2 half ro ? 1 = 100base-t2 half-duplex capable 0 duplex capable l ? 0 = not 100base-t2 half-duplex capable 8 extended status ro h ? 1 = extended status information in register 0fh ? 0 = no extended status info in register 0fh 1 7 reserved ro ignore on read 0 6 mf preamble suppression ro h ? 1 = phy accepts management frames with preamble suppressed ? 0 = phy does not accept management frames with preamble suppressed 1 5 auto-negotiation ro ? 1 = auto-negotiation complete 0 complete ? 0 = auto-negotiation in progress 4 remote fault ro lh ? 1 = remote fault detected ? 0 = no remote fault detected 0 3 auto-negotiation ro ? 1 = auto-negotiation capable 1 ability h ? 0 = not auto-negotiation capable 2 link status ro ll ? 1 = link pass ? 0 = link fail 0 1 jabber detect ro l ? 1 = jabber condition detected ? 0 = no jabber condition detected 0 0 extended ro ? 1 = extended register capabilities supported 1 capability h ? 0 = basic register set capabilities only note: this register is applicable to bcm5714s and bcm5715s devices only. www.datasheet.in bcm57xx programmer?s guide 01/29/08 broadcom corporation page 620 transceiver registers document 57xx-pg105-r 04h: 1000-x auto-negotiation advertisement register table 623: 04h: 1000-x auto-negotiation advertisement register bit name r/w description default 15 next page ro write as 0, ignore on read 0 14 reserved ro write as 0, ignore on read 0 13:12 remote fault r/w ? 00 = no remote fault ? 01 = link failure ? 10 = offline ? 11 = auto-negotiation error 00 11:9 reserved r/w write as 0, ignore on read 000 8:7 pause r/w ? 00 = no pause ? 01 = symmetric pause ? 10 = asymmetric pause toward link partner ? 11 = both symmetric pause and asymmetric pause toward local device 6 half duplex r/w ? 1 = advertise half-duplex ? 0 = do not advertise half-duplex 5 full duplex r/w ? 1 = advertise full-duplex ? 0 = do not advertise full-duplex 4:0 reserved r/w write as 0, ignore on read 00000 note: this register is applicable to bcm5714s and bcm5715s devices only. www.datasheet.in programmer?s guide bcm57xx 01/29/08 broadcom corporation document 57xx-pg105-r transceiver registers page 621 05h: 1000-x auto-negotiation link partner ability register (base page) 06h: 1000-x auto-negotiation expansion register table 624: 05h: 1000-x auto-negotiation link partner ability register (base page) bit name r/w description default 15 next page ro ? 1 = link partner is next page able ? 0 = link partner is not next page able 0 14 acknowledge ro ? 1 = link partner has received link code word ? 0 = link partner has not received link code word 0 13:12 remote fault ro ? 00 = no remote fault ? 01 = link failure ? 10 = offline ? 11 = auto-negotiation error 00 11:9 reserved ro ignore on read 000 8:7 pause ro ? 00 = no pause ? 01 = symmetric pause ? 10 = asymmetric pause toward link partner ? 11 = both symmetric pause and asymmetric pause toward local device 00 6 half duplex ro ? 1 = link partner is half-duplex capable 0 capable ? 0 = link partner is not half-duplex capable 5 full duplex ro ? 1 = link partner is full-duplex capable 0 capable ? 0 = link partner is not full-duplex capable 4:0 reserved ro ignore on read 00000 note: this register is applicable to bcm5714s and bcm5715s devices only. table 625: 06h: 1000-x auto-negotiation expansion register bit name r/w description default 15:3 reserved ro ignore on read 000h 2 next page ability ro l ? 1 = local device is next page able ? 0 = local device is not next page able 0 1 page received ro lh ? 1 = new link code word has been received ? 0 = new link code word has not been received 0 0 reserved ro ignore on read 0 note: this register is applicable to bcm5714s and bcm5715s devices only. www.datasheet.in bcm57xx programmer?s guide 01/29/08 broadcom corporation page 622 transceiver registers document 57xx-pg105-r 07h: 1000-x auto-negotiation next page transmit register 08h: 1000-x auto-negotiation link partner ability register (next page) 09h: 1000-x reserved register 0ah: 1000-x reserved register table 626: 07h: 1000-x auto-negotiation next page transmit register bit name r/w description default 15:0 reserved ro write as 0, ignore on read 0000h note: this register is applicable to bcm5714s and bcm5715s devices only. table 627: 08h: 1000-x auto-negotiation link partner ability register (next page) bit name r/w description default 15:0 reserved ro ignore on read 0000h note: this register is applicable to bcm5714s and bcm5715s devices only. table 628: 09h: 1000-x reserved register bit name r/w description default 15:0 reserved ro write as 0, ignore on read 0000h note: this register is applicable to bcm5714s and bcm5715s devices only. table 629: 0ah: 1000-x reserved register bit name r/w description default 15:0 reserved ro ignore on read 0000h note: this register is applicable to bcm5714s and bcm5715s devices only. www.datasheet.in programmer?s guide bcm57xx 01/29/08 broadcom corporation document 57xx-pg105-r transceiver registers page 623 0fh: 1000-x extended status register phy e xtended c ontrol r egister (phy_a ddr = 0 x 1, r eg _a ddr = 10 h ) table 630: 0fh: 1000-x extended status register bit name r/w description default 15 1000base-x full ro ? 1 = 1000base-x full-duplex capable 1 duplex capable h ? 0 = not 1000base-x full-duplex capable 14 1000base-x half ro ? 1 = 1000base-x half-duplex capable 1 duplex capable h ? 0 = not 1000base-x half-duplex capable 13 1000base-t full ro ? 1 = 1000base-t full-duplex capable 0 duplex capable l ? 0 = not 1000base-t full-duplex capable 12 1000base-t half ro ? 1 = 1000base-t half-duplex capable 0 duplex capable l ? 0 = not 1000base-t half-duplex capable 11:0 reserved ro ignore on read 000h note: this register is applicable to bcm5714s and bcm5715s devices only. table 631: phy extended control register (phy_addr = 0x1, reg_addr = 10h) bit field description init access 15 mac/phy interface mode the mac/phy interface is gmii. ? 1 = tbi (10-bit interface). ? 0 = gmii. 0r/w 14 disable automatic mdi crossover the automatic mdi crossover function can be disabled by writing a 1 to bit 14 of the phy extended control register. when the bit is written to 0, the bcm5701 performs the automatic mdi crossover function (see ?automatic mdi crossover? on page 68 ). ? 1 = automatic mdi crossover disabled. ? 0 = automatic mdi crossover enabled. 0r/w 13 transmit disable the transmitter can be disabled by writing a 1 to bit 13 of the phy extended control register. the transmitter outputs (trd {0...3}) are forced into a high impedance state. ? 1 = transmitter outputs disabled. ? 0 = normal operation. 0r/w 12 interrupt disable ? 1 = interrupt status output disabled. ? 0 = interrupt status output enabled. 0r/w 11 force interrupt ? 1 = force interrupt status to active. ? 0 = normal operation. 0r/w 10 bypass 4b/5b encoder/decoder the 100base-tx 4b/5b encoder/decoder can be bypassed by writing a 1 to bit 10: ? 1 = transmit and receive 5b codes over mii pins. ? 0 = normal mii. 0r/w www.datasheet.in bcm57xx programmer?s guide 01/29/08 broadcom corporation page 624 transceiver registers document 57xx-pg105-r 9 bypass scrambler/ descrambler the 100base-tx stream cipher function can be disabled by writing a 1 to bit 9 of the phy extended control register. the stream cipher function can be re-enabled by writing a 0 to this bit. ? 1 = scrambler and descrambler disabled. ? 0 = scrambler and descrambler enabled. 0r/w 8 bypass mlt3 encoder/decoder the 100base-tx mlt3 encoder and decoder can be bypassed by writing a 1 to bit 8 of the phy extended control register. nrz data is transmitted and received on the cable. the mlt3 encoder can be re-enabled by writing a 0 to this bit. ? 1 = bypass nrzi/mlt3 encoder and decoder. ? 0 = normal operation. 0r/w 7 bypass receive symbol alignment 100base-tx receive symbols alignment can be bypassed by writing a 1 to bit 7. ? 1 = 5b receive symbols not aligned. ? 0 = receive symbols aligned to 5b boundaries. 0r/w 6 reset scrambler when bit 6 of the phy extended control register is written to 1, the bcm57xx resets the scrambler to an all 1s state. this bit is self-clearing, and always returns 0 when read. ? 1 = reset scrambler to all 1s state. ? 0 = normal scrambler operation. 0r/w sc 5 enable led traffic mode when bit 5 of the phy extended control register is written to 1, the bcm57xx enables the led traffic mode. when bit 5 is written to 0, the bcm57xx disables the led traffic mode. in this mode, the traffic led will blink faster with a higher rate of traffic, and will stay on during heavy traffic. ? 1 = led traffic mode enabled. ? 0 = led traffic mode disabled. 0r/w 4 force leds on when bit 4 of the phy extended control register is written to 1, the bcm57xx forces all leds into the on state. when bit 4 is written to 0, the bcm57xx resets all leds to normal operation. ? 1 = force all leds into on state. ? 0 = normal led operation. 0r/w 3 force leds off when bit 3 of the phy extended control register is written to 1, the bcm57xx forces all leds into the off state. when bit 3 is written to 0, the bcm57xx resets all leds to normal operation. ? 1 = force all leds into off state. ? 0 = normal led operation. 0r/w 2 reserved (bcm5705, bcm5721, and bcm5751 only) - extend transmit ipg mode (other devices) when bit 2 of the phy extended control register is written to 1, the bcm57xx extends the transmit ipg to at least four nibbles in 100base-tx mode. when bit 2 is written to 0, the bcm57xx does not extend short transmit ipgs. ? 1 = extend transmit ipgs at least four nibbles in 100base- tx mode. ? 0 = do not extend short transmit ipgs. 0r/w table 631: phy extended control register (phy_addr = 0x1, reg_addr = 10h) (cont.) bit field description init access www.datasheet.in programmer?s guide bcm57xx 01/29/08 broadcom corporation document 57xx-pg105-r transceiver registers page 625 1 three link led mode for the bcm5700 mac, the following description applies: when bit 1 of the phy extended control register is written to 1, the link10 , link100 and link1000 pins each indicate link status for the corresponding speed of operation (linkled indicates 10 mbps link mode). when this bit is written to 0, the linkled pin indicates link status, the lnk100 pin indicates 100 mbps speed selection, and the lnk1000 pin indicates 1000 mbps speed selection. ? 1 = three link led mode enabled. ? 0 = link/speed led mode enabled. 1r/w for the bcm5701 device, the following description applies: when bit 1 of the phy extended control register is written to 1, the linkled , spd100led and spd1000led pins each indicate link status for the corresponding speed of operation (linkled indicates 10 mbps link mode). when this bit is written to 0, the linkled pin indicates link status, the spd100led pin indicates 100 mbps speed selection, and the spd1000led pin indicates 1000 mbps speed selection. ? 1 = three link led mode enabled. ? 0 = link/speed led mode enabled. note: in the bcm5702 mac transceiver and later, this bit is reserved. do not write to this bit because doing so will cause the mac to malfunction. 1r/w 0 gmii fifo elasticity when bit 0 of the phy extended control register is written to 1, the bcm57xx sets the gmii fifo elasticity to high latency. in this mode the bcm57xx can transmit packets up to 9 kb in length. when this bit is written to 0, the gmii fifo elasticity is set to low latency. in this mode the bcm57xx can transmit packets up to 4.5-kb in length. setting this bit to 1 adds 16 ns to the 1000base-t transmit latency. ? 1 = high latency. ? 0 = low latency. 0r/w table 631: phy extended control register (phy_addr = 0x1, reg_addr = 10h) (cont.) bit field description init access www.datasheet.in bcm57xx programmer?s guide 01/29/08 broadcom corporation page 626 transceiver registers document 57xx-pg105-r phy e xtended s tatus r egister (phy_a ddr = 0 x 1, r eg _a ddr = 11 h ) table 632: phy extended status regist er (phy_addr = 0x1, reg_addr = 11h) bit field description init access 15 auto-negotiation base page selector field mismatch (bcm5705, bcm5721, bcm5751, bcm5752, bcm5714, and bcm5715 only) ? 1 = link partner base page selector field mismatched advertised selector field since last read. ? 0 = no mismatch detected since last read. 0ro, lh s3mii fifo error (other devices) the bcm57xx returns a 1 on bit 15 of the phy extended status register whenever s3mii fifo overrun occurs. this bit set to 0 after reading this register. ? 1 = s3mii fifo overflow occurred since last read. ? 0 = no fifo error detected since last read. 0r/o 14 reserved (bcm5705, bcm5721, and bcm5751 only) wire speed down grade (other devices) when wire speed is set to a 1, if auto-negotiation is enabled and the bcm57xx is unable to establish link in five tries, then the bcm57xx automatically downgrades the speed it advertises and tries establishing a link. if wire speed is set to a 0, no speed downgrading occurs. ? 1 = auto-negotiation adv. speed down graded. ? 0 = no adv. speed down grading. 0r/o 13 mdi crossover state the bcm57xx returns a 1 on bit 13 of the phy extended status register when the bcm57xx is automatically switching the transmit and receive pairs to communicate with a remote device. this bit returns a 0 when the bcm57xx is in normal mdi mode. ? 1 = performing mdi crossover. ? 0 = normal mdi mode. 0r/o 12 interrupt status the bcm57xx returns a 1 on bit 12 of the phy extended status register when any unmasked interrupt is currently active, otherwise, it returns a 0. ? 1 = unmasked interrupt currently active. ? 0 = interrupts clear. 0r/o 11 remote receiver status the bcm57xx returns a 1 on bit 11 of the phy extended status register when the remote receiver status is ok. when the bcm57xx detects that the remote receiver is not ok, this bit is latched at 0 and remains so until the bit is read and the remote receiver status is ok. ? 1 = remote receiver ok. ? 0 = remote receiver not ok since last read. 0r/o ll www.datasheet.in programmer?s guide bcm57xx 01/29/08 broadcom corporation document 57xx-pg105-r transceiver registers page 627 10 local receiver status the bcm57xx returns a 1 on bit 10 of the phy extended status register when the local receiver status is ok. when the bcm57xx detects that the local receiver is not ok, this bit is latched at 0 and remains so until the bit is read, and the remote receiver status is ok. ? 1 = local receiver ok. ? 0 = local receiver not ok since last read. 0r/o ll 9 locked the bcm57xx returns a 1 on bit 9 of the phy extended status register when the descrambler is locked to the incoming data stream, otherwise, it returns a 0. ? 1 = descrambler locked. ? 0 = descrambler unlocked. 0r/o 8 link status the bcm57xx returns a 1 on bit 8 of the phy extended status register when the link status is good, otherwise, it returns a 0. ? 1 = link pass. ? 0 = link fail. 0r/o 7 crc error detected the bcm57xx returns a 1 on bit 7 of the phy extended status register while its link partner is signaling a remote fault condition, otherwise, it returns a 0. ? 1 = crc error detected. ? 0 = no crc error since last read. 0r/o 6 carrier extension error detected the bcm57xx returns a 1 on bit 6 of the phy extended status register if a carrier extension error has been detected since the last time this register was read, otherwise, it returns a 0. ? 1 = carrier extension error detected since last read. ? 0 = no carrier extension error since last read. 0r/o lh 5 bad ssd detected (false carrier) the bcm57xx returns a 1 on bit 5 of the phy extended status register if a bad start of stream error has been detected since the last time this register was read, otherwise, it returns a 0. ? 1 = bad ssd error detected since last read. ? 0 = no bad ssd error since last read. 0r/o lh 4 bad esd detected (premature end) the bcm57xx returns a 1 on bit 4 of the phy extended status register if a bad end of stream error has been detected since the last time this register was read, otherwise, it returns a 0. ? 1 = bad esd error detected since last read. ? 0 = no bad esd error since last read. 0r/o lh 3 receive error detected the bcm57xx returns a 1 on bit 3 of the phy extended status register if a packet was received with an invalid code since the last time this register was read, otherwise, it returns a 0. ? 1 = receive error detected since last read. ? 0 = no receive error since last read. 0r/o lh table 632: phy extended status register (phy_addr = 0x1, reg_addr = 11h) (cont.) bit field description init access www.datasheet.in bcm57xx programmer?s guide 01/29/08 broadcom corporation page 628 transceiver registers document 57xx-pg105-r r eceive e rror c ounter (phy_a ddr = 0 x 1, r eg _a ddr = 12 h ) this counter increments each time the bcm57xx family receivers a non-collision packet containing at least one receive error (freezes at the maximum value ffffh). the counter automatically clears when read. f alse c arrier s ense c ounter (phy_a ddr = 0 x 1, r eg _a ddr = 13 h ) s3mii error counter increments each time the bcm57xx fa mily detects a s3mii overrun/underrun event. false carrier sense counter increments each time the bcm57xx family detects a false carrier on the receive input. these counters freeze at the maximum value ffh. the counters automatically clear when read. 2 transmit error detected the bcm57xx returns a 1 on bit 2 of the phy extended status register if a packet was received with a transmit error code since the last time this register was read, otherwise, it returns a 0. ? 1 = transmit error code received since last read. ? 0 = no transmit error code received since last read. 0r/o lh 1 lock error detected the bcm57xx returns a 1 on bit 1 of the phy extended status register if the descrambler has lost lock since the last time this register was read, otherwise, it returns a 0. ? 1 = lock error detected since last read. ? 0 = no lock error since last read. 0r/o lh 0 mlt3 code error detected the bcm57xx returns a 1 on bit 0 of the phy extended status register if an mlt3 coding error has been detected in the receive data stream since the last time this register was read, otherwise, it returns a 0. ? 1 = mlt3 code error detected since last read. ? 0 = no mlt3 code error since last read. 0r/o lh table 633: receive error counter (phy_addr = 0x1, reg_addr = 12h) bit field description init access 15:0 receive error counter number of non-collision packets with receive errors since last read. 0000h r/w table 634: false carrier sense counter (phy_addr = 0x1, reg_addr = 13h) bit field description init access 15:8 reserved (bcm5705, bcm5721, bcm5751, and bcm5714 only) - smii fifo error counter (other devices) number of smii overrun/underrun events since last read. freezes at 0ffh. 00h r/w 7:0 false carrier sense counter number of false carrier sense events since last read. 00h r/w table 632: phy extended status register (phy_addr = 0x1, reg_addr = 11h) (cont.) bit field description init access www.datasheet.in programmer?s guide bcm57xx 01/29/08 broadcom corporation document 57xx-pg105-r transceiver registers page 629 r eceiver not_ok c ounters (phy_a ddr = 0 x 1, r eg _a ddr = 14 h ) normal operation (crc count visibility = 0) these counters increment each time the local or remote receiver enters the not_ok state (freezes at the maximum value ffh) when the crc error count visibility bit of phy test register 1 (see ?phy test register 1 (phy_addr = 0x1, reg_addr = 1eh)? on page 700 ) is clear. the counters automatically clear when read. crc error count operation (crc count visibility = 1) the crc error counter is merged into a 16-bit counter and increments each time the bcm5701 mac transceiver detects a crc error when the crc error count visibility bit of phy test register 1 (see ?phy test register 1 (phy_addr = 0x1, reg_addr = 1eh)? on page 700 ) is set. this counter freezes at the maximum value ffffh. the counter automatically clears when read. table 635: receiver not_ok counters (phy_addr = 0x1, reg_a ddr = 14h, normal operation) bit field description init access 15:8 local receiver not_ok counter number of times local receiver was not ok since last read (when phy test register 1. crc_error_count_visibility bit (see ?phy test register 1 (phy_addr = 0x1, reg_addr = 1eh)? on page 700 ) is clear). 00h r/w 7:0 remote receiver not_ok counter number of times bcm57xx detected that the remote receiver was not ok since last read (when phy test register 1. crc_error_count_visibility bit (see ?phy test register 1 (phy_addr = 0x1, reg_addr = 1eh)? on page 700 ) is clear). 00h r/w table 636: receiver not_ok counters (phy_addr = 0x1, reg_addr = 14h, crc error count operation) bit field description init access 15:0 crc error counter this register becomes a 16-bit crc error counter when phy test register 1.crc_error_count_visibility bit (see ?phy test register 1 (phy_addr = 0x1, reg_addr = 1eh)? on page 700 ) is set. 0000h r/w www.datasheet.in bcm57xx programmer?s guide 01/29/08 broadcom corporation page 630 transceiver registers document 57xx-pg105-r e xpansion r egisters (bcm5705, bcm5721, bcm5751, bcm5752, bcm5714, and bcm5715 o nly ) expansion register access data (phy_addr = 01h, reg_addr = 15h) when the ?expansion register access register (phy_addr = 0x1, reg_addr = 17h)? on page 630 is enabled, this register allows read/write access to the expansion register selected in the expansion register access register. expansion register access register (phy_addr = 0x1, reg_addr = 17h) when enabled, this register serves as an index to the expansion registers. the value of the expansion register can be read/ written through register 15h (see ?expansion register access data (phy_addr = 01h, reg_addr = 15h)? on page 630 ). these bits should be cleared when the expansion register is not accessed. table 637: expansion register access register (phy_addr = 0x1, reg_addr = 17h) bit field description init access 15:12 reserved - 0000 r/w 11:8 expansion register select ? 1111 = expansion register select ? xxxx = reserved 0h 7:0 expansion register accessed sets the expansion register number accessed when reading or writing ?expansion register access data (phy_addr = 01h, reg_addr = 15h)? on page 630 . table 638: expansion register select values expansion register register name 00h ?expansion register 00h: receive/transmit packet counter? on page 631 01h ?expansion register 01h: expansion interrupt status? on page 631 03h ?expansion register 03h: serdes control? on page 632 04h ?expansion register 04h: multicolor led selector? on page 633 05h ?expansion register 05h: multicolor led flash rate controls? on page 634 06h ?expansion register 06h: multicolor led programmable blink controls? on page 635 10h ?expansion register 10h: cable diagnostic controls? on page 636 11h ?expansion register 11h: cable diagnostic results? on page 637 12h ?expansion register 12h: cable diagnostic lengths channels 1/2? on page 638 13h ?expansion register 13h: cable diagnostic lengths channels 3/4? on page 639 www.datasheet.in programmer?s guide bcm57xx 01/29/08 broadcom corporation document 57xx-pg105-r transceiver registers page 631 expansion register 00h: receive/transmit packet counter the following expansion registers are enabled by writing to ?expansion register access register (phy_addr = 0x1, reg_addr = 17h)? on page 630 bits [11:0] = f00h, and read/write access is through register 15h. packet counter (copper only) when the packet counter mode bit field = 1, in the ?auxiliary control register (phy_addr = 0x1, reg_addr = 18h, shadow = 111, misc control)? on page 655 , the number of receive packets is counted. when the packet counter mode bit field = 0, in the ?auxiliary control register (phy_addr = 0x1, reg_addr = 18h, shadow = 111, misc control)? on page 655 , the number of transmit packets is counted. this counter is clear on read and freezes at ffffh. expansion register 01h: expansion interrupt status the following expansion registers are enabled by writing to ?expansion register access register (phy_addr = 0x1, reg_addr = 17h)? on page 630 bits [11:0] = f01h, and read/write access is through register 15h. table 639: expansion register 00h: receive/transmit packet counter bit field description init access 15:0 packet counter (copper only) returns the packet count 0000h r/w sc table 640: expansion register 01h: expansion interrupt status bit field description init access 15:8 reserved write as 00h, ignore on read. 00h ro 7 mode select change ? 1 = mode select change detected (clears on read). ? 0 = mode select change not detected. 0ro lh 6 serdes link status change ? 1 = serdes link status change detected (clears on read). ? 0 = mode select change not detected. 0ro lh 5 1000x rudi_c detected (serdes auto-negotiation code word received) (bcm5714 and bcm5715 only) ? 1 = 1000x rudi_c detected since last read ? 0 = no 1000x rudi_c detected since last read 0ro lh expansion interrupt status (other devices) ? 1 = interrupt condition detected. ? 0 = interrupt condition not detected. 0ro lh 4:1 ? 1 = interrupt condition detected. ? 0 = interrupt condition not detected. 0ro lh 0 transmit crc error (copper only) ? 1 = transmit crc error detected since last read. ? 0 = no transmit crc error detected since last read. 0ro lh www.datasheet.in bcm57xx programmer?s guide 01/29/08 broadcom corporation page 632 transceiver registers document 57xx-pg105-r mode select change this bit indicates that mode select change is detected. serdes link status change this bit indicates a serdes link status change is detected. expansion interrupt status these bits corresponds to the expansion interrupt status bits. transmit crc error (copper only) bit 0 = 1 indicates that a transmit crc error occurred since the register was last read, otherwise, it returns a 0. expansion register 03h: serdes control the following expansion registers are enabled by writing to ?expansion register access register (phy_addr = 0x1, reg_addr = 17h)? on page 630 bits [11:0] = f03h, and read/write access is through register 15h. clock pad disable this bit disables sgmii clock pads sclk. the default is to have the sclk enabled. table 641: expansion register 03h: serdes control bit field description init access 15 reserved write as 0, ignore on read. 0 ro 14:2 reserved write as 1031h, ignore on read. 1031h r/w 1 clock pad disable ? 1 = disable sgmii clock pads sclk ? 0 = enable sgmii clock pads sclk 0r/w 0 reserved write as 0, ignore on read. 0 ro www.datasheet.in programmer?s guide bcm57xx 01/29/08 broadcom corporation document 57xx-pg105-r transceiver registers page 633 expansion register 04h: multicolor led selector the following expansion registers are enabled by writing to ?expansion register access register (phy_addr = 0x1, reg_addr = 17h)? on page 630 bits [11:0] = f04h, and read/write access is through register 15h. flash now setting this bit = 1 causes a single flash to occur on multicolor[1] when multicolor[1] multicolor selector is set to 0111, and a single flash to occur on led2 when led2 multicolor selector is set to 0111. table 642: expansion register 04h: multicolor led selector bit field description init access 15:10 reserved write as 00h, ignore on read. 00h r/w 9 flash now 1 = initiate a multicolor led flash. this only works when the multicolor selector is set to 0111. 0r/w sc 8 in phase ? 1 = multicolor[1] and multicolor[2] are in phase. ? 0 = multicolor[1] and multicolor[2] are in opposite phase. note: this is only valid when multicolor led selector bits are set to 0000, 0010, 0011, 0110, 0111, 1000, 1001, 1010. 0r/w 7:4 multicolor[2] multicolor selector selects the multicolor mode for multicolor[2]. ? 0000: encoded link/activity led. ? 0001: encoded speed led. ? 0010: activity flash led. ? 0011: full-duplex led. ? 0100: forced off. ? 0101: forced on. ? 0110: alternating led (toggling between the modes at 50% duty cycle with a 320 ms period). ? 0111: flashing led (toggling between the modes with an 80 ms period). ? 1000: link led. ? 1001: activity led. ? 1010: programmable blink led. 0h r/w 3:0 multicolor[1] multicolor selector selects the multicolor mode for multicolor[1]. ? 0000: encoded link/activity led. ? 0001: encoded speed led. ? 0010: activity flash led. ? 0011: full-duplex led. ? 0100: forced off. ? 0101: forced on. ? 0110: alternating led (toggling between the modes at 50% duty cycle with a 320 ms period). ? 0111: flashing led (toggling between the modes with an 80 ms period). ? 1000: link led. ? 1001: activity led. ? 1010: programmable blink led. 0h r/w www.datasheet.in bcm57xx programmer?s guide 01/29/08 broadcom corporation page 634 transceiver registers document 57xx-pg105-r in phase when both multicolor[2:1] are set to the same mode, the outputs of multicolor[1] and multicolor[2] both toggle at the same time. this bit determines whether the leds are identical to each other or inverse from each other. when the two led pins are attached to a special multicolored led, the resulting led color alternates between off/amber (in phase) or red/green (out of phase). multicolor[2] multicolor selector bits [7:4] select the multicolor led mode for multicolor[2]. it is up to the user to determine what functions should appear on the two led pins. for example, if the user wants a different color toggling operation other than the operation mentioned above, such as red/amber, the user can put one of the multicolor selectors to the desired toggle mode and the other multicolor selector to forced on. multicolor[1] multicolor selector bits [3:0] select the multicolor led mode for multicolor[1]. it is up to the user to determine what functions should appear on the two led pins. for example, if the user wants a different color toggling operation other than the operation mentioned above, such as red/amber, the user can put one of the multicolor selectors to the desired toggle mode and the other multicolor selector to forced on. expansion register 05h: multicolor led flash rate controls the following expansion registers are enabled by writing to ?expansion register access register (phy_addr = 0x1, reg_addr = 17h)? on page 630 bits [11:0] = f05h, and read/write access is through register 15h. table 643: expansion register 05h: multicolor led flash rate controls bit field description init access 15:12 reserved write as 0h, ignore on read. 0h r/w 11:6 alternating rate determines the width and gap for multicolor led selector 0110 (alternating led mode). ? 00h = 21 ms width, 21 ms gap. ? 01h = 42 ms width, 42 ms gap. ? 02h = 63 ms width, 63 ms gap. ? ... ? 07h = 168 ms width, 168 ms gap. ? ... ? 3fh = 1.344s. 07h r/w 5:0 flash rate determines the width and minimum gap of every flash pulse for multicolor led selector 0000 (encoded link/ activity mode), 0010 (activity flash mode) and 0111 (flashing led mode). ? 00h = 21 ms width, 21 ms gap. ? 01h = 42 ms width, 42 ms gap. ? 02h = 63 ms width, 63 ms gap. ? ... ? 3fh = 1.344s. 01h r/w www.datasheet.in programmer?s guide bcm57xx 01/29/08 broadcom corporation document 57xx-pg105-r transceiver registers page 635 alternation rate setting bits [11:6] changes the width and gap of the alternating led modes. these bits are only valid when the multicolor[1] multicolor selector and or the multicolor[2] multicolor selector bits = 0110. led's duty cycle is exactly 50%. flash rate setting bits [5:0] determines the width and minimum gap of the flashing pulse. these bits are only valid when the multicolor[1] multicolor selector and/or the multicolor[2] multicolor selector bits = 0000, 0010, or 0111. the duty cycle of the flash rate is not exactly 50%. expansion register 06h: multicolor led programmable blink controls the following expansion registers are enabled by writing to ?expansion register access register (phy_addr = 0x1, reg_addr = 17h)? on page 630 bits [11:0] = f06h, and read/write access is through register 15h. blink update now setting bit 5 updates the blink rate immediately. clearing this bit causes the blink rate to be updated after the 1s interval ti mer expires. this bit is only valid when the multicolor[1] multicolor selector and or the multicolor[2] multicolor selector bits = 0000, 0010, or 0111. blink rate setting bits [4:0] determines the blink rate of the programmable blink led. these bits are only valid when the multicolor[1] multicolor selector and or the multicolor[2] multicolor selector bits = 0000, 0010, or 0111. table 644: expansion register 06h: multicolor led programmable blink controls bit field description init access 15:6 reserved write as 000h, ignore on read. 000h r/w 5 blink update now ? 1 = change to the new blink rate now. ? 0 = wait 1s before changing blink rate. controls when a change in the blink rate is actually displayed on the programmable blink led. 0r/w 4:0 blink rate programs the number of blinks per second that the programmable blink led blinks. ? 00000 = no blink. ? 00001 = one blink per second. ? 00010 = two blinks per second. ? 00011 = three blinks per second. ? ... ? 11111 = 31 blinks per second. 00000 r/w www.datasheet.in bcm57xx programmer?s guide 01/29/08 broadcom corporation page 636 transceiver registers document 57xx-pg105-r expansion register 10h: cable diagnostic controls the following expansion registers are enabled by writing to ?expansion register access register (phy_addr = 0x1, reg_addr = 17h)? on page 630 bits [11:0] = f10h, and read/write access is through register 15h. natural link setting bit 2 = 1, skips the open and shorts check when in cable diagnostic mode. cable diag begin setting bit 1 =1, begins the cable diagnostic algorithm when in cable diagnostic mode. cable diag mode setting bit 0 = 1, enables cable diagnostic mode. see ?expansion register 11h: cable diagnostic results? on page 637 , ?expansion register 12h: cable diagnostic lengths channels 1/2? on page 638 , and ?expansion register 13h: cable diagnostic lengths channels 3/4? on page 639 , for more details. table 645: expansion register 10h: cable diagnostic controls bit field description init access 15:3 reserved write as 0000h, ignore on read. 0000h r/w 2 natural link ? 1 = skips checking of open/short. ? 0 = enables checking of open/short. 0r/w 1 cable diag begin ? 1= begins cable diagnostic algorithm. ? 0 = cable diagnostic algorithm is not started. 0r/w sc 0 cable diag mode ? 1 = cable diagnostic mode enabled. ? 0 = cable diagnostic mode not enabled. 0r/w www.datasheet.in programmer?s guide bcm57xx 01/29/08 broadcom corporation document 57xx-pg105-r transceiver registers page 637 expansion register 11h: cable diagnostic results the following expansion registers are enabled by writing to ?expansion register access register (phy_addr = 0x1, reg_addr = 17h)? on page 630 bits [11:0] = f11h, and read/write access is through register 15h. packet counter bits [15:12] reflect the cable diagnostic error status of the four channels. table 646: expansion register 11h: cable diagnostic results bit field description init access 15:12 error per channel: an error has occurred. ? bit 15 = 1: error has occurred on channel 4. ? bit 15 = 0: error has not occurred on channel 4. ? bit 14 = 1: error has occurred on channel 3. ? bit 14 = 0: error has not occurred on channel 3. ? bit 13 = 1: error has occurred on channel 2. ? bit 13 = 0: error has not occurred on channel 2. ? bit 12 = 1: error has occurred on channel 1. ? bit 12 = 0: error has not occurred on channel 1. 0h ro 11:8 open/short found per channel: an open or short has been found. ? bit 11 = 1: open/short found on channel 4. ? bit 11 = 0: open/short not found on channel 4. ? bit 10 = 1: open/short found on channel 3. ? bit 10 = 0: open/short not found on channel 3. ? bit 9 = 1: open/short found on channel 2. ? bit 9 = 0: open/short not found on channel 2. ? bit 8 = 1: open/short found on channel 1. ? bit 8 = 0: open/short not found on channel 1. 0h ro 7:4 finished per channel: open/short and length checking have been completed successfully. ? bit 7 = 1: open/short/length checking completed on channel 4. ? bit 7 = 0: open/short/length checking not completed on channel 4. ? bit 6 = 1: open/short/length checking completed on channel 3. ? bit 6 = 0: open/short/length checking not completed on channel 3. ? bit 5 = 1: open/short/length checking completed on channel 2. ? bit 5 = 0: open/short/length checking not completed on channel 2. ? bit 4 = 1: open/short/length checking completed on channel 1. ? bit 4 = 0: open/short/length checking not completed on channel 1. 0h ro 3:2 reserved write as 00, ignore on read. 00 ro 1 any open/short found an open or short has been found on at least one channel. 0 ro 0 all finished all channels have completed processing. 0 ro www.datasheet.in bcm57xx programmer?s guide 01/29/08 broadcom corporation page 638 transceiver registers document 57xx-pg105-r open/short found bits [11:8] reflect the open and short status of the four channels. finished bits [7:4] reflect whether open/short and length checking have been completed successfully. all finished bit [0] reflects whether all four channels have completed cable diagnostic processing. expansion register 12h: cable diagnostic lengths channels 1/2 the following expansion registers are enabled by writing to ?expansion register access register (phy_addr = 0x1, reg_addr = 17h)? on page 630 bits [11:0] = f12h, and read/write access is through register 15h. channel 2 length when the bcm57xx detects an open or short on the cable, bits [15:8] reflect how far away the open or short is from the bcm57xx. when no open or short is detected, bits [15:8] reflect the cable length connected to channel 2 in meters. channel 1 length when the bcm57xx detects an open or short on the cable, bits [7:0] reflect how far away the open or short is from the bcm57xx. when no open or short is detected, bits [7:0] reflect the cable length connected to channel 1 in meters. table 647: expansion register 12h: cable diagnostic lengths channels1/2 bit field description init access 15:8 channel 2 length channel 2 open/short length or cable length (meters). ? 00000000 = 0m. ? 00000001 = 1m. ? 00000010 = 2m. ? ... ? 10000000 = 128m. 00h ro 7:0 channel 1 length channel 1 open/short length or cable length (meters). ? 00000000 = 0m. ? 00000001 = 1m. ? 00000010 = 2m. ? ... ? 10000000 = 128m. 00h ro www.datasheet.in programmer?s guide bcm57xx 01/29/08 broadcom corporation document 57xx-pg105-r transceiver registers page 639 expansion register 13h: cable diagnostic lengths channels 3/4 the following expansion registers are enabled by writing to ?expansion register access register (phy_addr = 0x1, reg_addr = 17h)? on page 630 bits [11:0] = f13h, and read/write access is through register 15h. channel 4 length when the bcm57xx detects an open or short on the cable, bits [15:8] reflect how far away the open or short is from the bcm57xx. when no open or short is detected, bits [15:8] reflect the cable length connected to channel 2 in meters. channel 3 length when the bcm57xx detects an open or short on the cable, bits [7:0] reflect how far away the open or short is from the bcm57xx. when no open or short is detected, bits [7:0] reflect the cable length connected to channel 2 in meters. table 648: expansion register 13h: cable diagnostic lengths channels 3/4 bit field description init access 15:8 channel 4 length channel 4 open/short length or cable length (meters). ? 00000000 = 0m. ? 00000001 = 1m. ? 00000010 = 2m. ? ... ? 10000000 = 128m. 00h ro 7:0 channel 3 length channel 3 open/short length or cable length (meters). ? 00000000 = 0m. ? 00000001 = 1m. ? 00000010 = 2m. ? ... ? 10000000 = 128m. 00h ro www.datasheet.in bcm57xx programmer?s guide 01/29/08 broadcom corporation page 640 transceiver registers document 57xx-pg105-r a uxiliary c ontrol r egister (bcm5714 a nd bcm5715 d evices o nly ) auxiliary control register (shadow register selector = 000) table 649: 18h: aux. control reg. (shadow reg. selector = 000; bcm5714 and bcm5715 only) bit field description init access 15 external loopback ? 1 = external loopback enabled ? 0 = normal operation 0r/w 14 extended packet length ? 1 = allow reception of extended length packets ? 0 = allow normal length ethernet packets only 0r/w 13:12 edgerate control (1000t) ? 00 = 4.0ns (1000t) ? 01 = 5.0ns (1000t) ? 10 = 3.0ns (1000t) ? 11 = 0.0ns (1000t) 00 r/w 11 enable sm_dsp clock ? 1 = clock is enabled. ? 0 = clock is gated off. 0 r/w 10 transmit 6db coding ? 1 = transmit using 6db coding ? 0 = transmit using 3db coding 1 r/w 9:8 receive slicing ? 00 = normal viterbi/dfe mlse ? 01 = 4d symbol by symbol slicing for 3 db option ? 10 = 3 level 1d symbol by symbol slicing ? 11 = 5 level 1d symbol by symbol slicing during ? send idle/data, 3 level else 00 r/w 7 disable partial response filter ? 1 = transmitter partial response filter disabled ? 0 = transmitter partial response filter enabled 0 r/w 6 disable inverse prf ? 1 = receiver inv. partial response filter disabled (overrides phy control and other mii register settings if disabled) ? 0 = receiver inv. partial response filter enabled 0 r/w 5:4 edgerate control (100tx) lsb or?ed ed with er pin) ? 00 = 4.0 ns (100tx) ? 01 = 5.0 ns (100tx) ? 10 = 3.0 ns (100tx) ? 11 = 0.0 ns (100tx) 00 r/w 3 diagnostic mode ? 1 = when convergence fails, hold in failed state until cleared. ? 0 = normal operation, retrain on failure 0r/w www.datasheet.in programmer?s guide bcm57xx 01/29/08 broadcom corporation document 57xx-pg105-r transceiver registers page 641 10base-t register (shadow register selector = 001) 2:0 shadow register selector (these bits are written on all writes to 18h regardless of the value) ? 000 = normal operation ? 001 = 10 base-t register ? 010 = power control register ? 011 = reserved ? 100 = misc test register 1 ? 101 = misc test register 2 ? 110 = reserved ? 111 = misc control register note: writes to the selected shadow register are done on a single cycle (no setup required). reads are selected by first writing to register 18h, shadow 7, bits 14:12. 000 r/w table 650: 18h: 10base-t register (shadow register selector = 001; bcm5714 and bcm5715 only) bit field description init access 15 manchester code error ? 1 = manchester code error (10base-t) ? 0 = no manchester code error 0 ro lh 14 eof error ? 1 = eof detection error (10base-t) ? 0 = no eof detection error 0 ro lh 13 polarity error ? 1 = channel polarity inverted ? 0 = channel polarity correct 0 ro 12 block rxdv extension (lpg) ? 1 = block rxdv for 4 additional rxc cycles for lpg ? 0 = normal operation 0 r/w 11 10bt txc invert mode ? 1 = invert txc output ? 0 = normal operation 0 r/w 10 class a/b line driver select (classb_btt) ? 1 = select class a line driver ? 0 = select class b line driver 0 r/w 9: jabber disable ? 1 = jabber function disabled ? 0 = jabber function enabled 0 r/w 8 1000base-t signal detect threshold ? 1 = low signal detect threshold ? 0 = high signal detect threshold 0 r/w 7 10base-t signal detect threshold ? 1 = low signal detect threshold ? 0 = high signal detect threshold 0 r/w 6 10base-t echo mode ? 1 = echo transmit data to receive data ? 0 = normal operation 0 r/w 5 sqe enable mode ? 1 = enable sqe ? 0 = disable sqe 0 r/w 4 10base-t no dribble ? 1 = correct 10bt dribble nibble ? 0 = normal operation 0 r/w 3 10base-t serial mode ? 1 = enable 10base-t serial mode ? 0 = normal operation 0 r/w table 649: 18h: aux. control reg. (shadow reg. selector = 000; bcm5714 and bcm5715 only) (cont.) bit field description init access www.datasheet.in bcm57xx programmer?s guide 01/29/08 broadcom corporation page 642 transceiver registers document 57xx-pg105-r power/mii control register (shadow register selector = 010) 2:0 shadow register selector writes to the selected shadow register are done on a single cycle (no setup required). reads are selected by first writing to register 18h, shadow 7, bits 14:12. 001 r/w table 651: 18h: power/mii control reg. (shadow reg. selector = 010; bcm5714 and bcm5715 only) bit field description init access 15:13 class a/b mode controls amount of class a vs. class a/b txdac operation. ? 000 = 100% class a, ? 111 = most class ab. 000 r/w 12 gigabit txdac class b mode ? 1 = low power class b operation ? 0 = normal class a operation 0 r/w 11 vreg lpwr enable voltage regulator low power enable ? 1 = forces vregd to lowest setting in 10t and 100tx modes 0 r/w 10:9 digital voltage regulator output voltage (vregd) ? 00 = 1.0v ? 01 = 1.1v ? 10 = 1.2v ? 11 = 1.3v note: this value is overridden to ?00? during 10t 100tx modes (when bit 11 is ?1?) 10 r/w 8:7 analog vreg control (vega) ? 00 = 1.0v ? 01 = 1.1v ? 10 = 1.2v ? 11= 1.3v 10 r/w 6 class a/b enable ? 1 = enable class a/b txdac operation ? 0 = normal operation 0r/w 5 super isolate ? 1 = isolate mode with no link pulses transmitted ? 0 = normal operation 0r/w 4 100tx txdac class b mode ? 1 = low power class b operation ? 0 = normal class a operation 0 r/w 3 wake on lan ? 1 = enable wake on lan operation ? 0 = normal operation 0r/w 2:0 shadow register selector writes to the selected shadow register are done on a single cycle (no setup required). reads are selected by first writing to register 18h, shadow 7, bits 14:12. 010 r/w table 650: 18h: 10base-t register (shadow register selector = 001; bcm5714 and bcm5715 only) (cont.) bit field description init access www.datasheet.in programmer?s guide bcm57xx 01/29/08 broadcom corporation document 57xx-pg105-r transceiver registers page 643 miscellaneous test register 1 (shadow register selector = 100) table 652: 18h: misc. test register 1 (shadow register selector = 100; bcm5714 and bcm5715 only) bit field description init access 15 remote loopback enable ? 1 = enable loopback from mdi (cable end) receive packet, through pcs and back to mdi transmit packet ? 0 = disable loopback 0r/w 14 tdx fix enable 1 = tdk fix (extend eop on transmit 10bt packets) 0 r/w 13 enable dedicated 10base-t dll bypass clock ? 1 = 10bt dll bypass clock generated from tpin10 in dll bypass mode ? 0 = 10bt dll bypass clock generated from inverted xtali input in dll bypass mode (baset, adc10bt, pc10bt, crs10bt, dac10_100 test modes use tpin10; register value ignored) 0r/w 12 block 10base-t restart auto-negotiation ? 1 = prevent 10bt from restarting auto-negotiation in order to break the link ? 0 = normal operation 0r/w 11 remote loopback tristate ? 1 = tristate the receive mii pins (crs, rxdv, rxd, etc.) when remote loopback is enabled ? 0 = remote loopback packets appear on mii 0r/w 10 10base-t wakeup ? 1 = enable 10bt dac 0 r/w 9 10base-t polarity bypass ? 1 = enable polarity bypass ? 0 = normal operation 0r/w 8 10base-t idle bypass ? 1 = enable idle bypass ? 0 = normal operation 0r/w 7 10base-t clock reset enable ? 1 = clock reset controlled from tpin11 ? 0 = normal operation 0r/w 6 10base-t bypass adc ? 1 = bypass 10bt adc ? 0 = normal operation 0r/w 5 10base-t bypass crs ? 1 = bypass 10bt crs ? 0 = normal operation 0r/w 4 swap rxmdix ? 1 = rx and tx operate on same pair ? 0 = normal operation 0r/w 3 10base-t halfout ? 1 = transmit 10bt at half amplitude ? 0 = normal operation 0r/w 2:0 shadow register selector writes to the selected shadow register are done on a single cycle (no setup required). reads are selected by first writing to register 18h, shadow 7, bits 14:12. 100 r/w www.datasheet.in bcm57xx programmer?s guide 01/29/08 broadcom corporation page 644 transceiver registers document 57xx-pg105-r miscellaneous test register 2 (shadow register selector = 101) miscellaneous control register (shadow register selector = 111) table 653: 18h: misc. test register 2 (shadow register selector = 101; bcm5714 and bcm5715 only) bit field description init access 15:9 reserved write as 0, ignore on read 0000000 r/w 8 disable auto encoding correction ? 0 = auto encoding correction enabled (overrides bits 6 & 7) ? 1 = auto encoding correction disabled 0r/w 7 old pcs encoding rx ? 0 = select ieee compliant pcs encoding (for pcs receive) ? 1 = select old pcs encoding (for pcs receive) 0r/w 6 old pcs encoding tx ? 0 = select ieee compliant pcs encoding (for pcs receive) ? 1 = select old pcs encoding (for pcs receive) 0r/w 5:3 spare write as 0, ignore on read 000 r/w 2:0 shadow register selector writes to the selected shadow register are done on a single cycle (no setup required). reads are selected by first writing to register 18h, shadow 7, bits 14:12. 101 r/w table 654: 18h: miscellaneous control re gister (shadow register selector = 111) bit field description init access 15 write enable bits ? 1 = write bits [8:3] ? 0 = only write bits [14:12] 0 r/w sc 14:12 shadow register read selector ? 000 = shadow register 0 read select ? 001 = shadow register 1 read select ? ... ? 111 = shadow register 7 read select 000 r/w 11 packet counter mode ? 1 = count packets received ? 0 = count packets transmitted 0 r/w 10 bypass wirespeed timer ? 1 = link fail counter will clear as soon as link is up ? 0 = link must be up for at least 2.5 seconds otherwise link fail counter will increment. note: can be set only if gphy port wirespd_timer_disable = 0. 0 r/w 9 force auto mdix mode ? 1 = auto-mdix will operate when autoneg is disabled via reg 0.12 ? 0 = auto-mdix is disabled when autoneg is disabled via reg 0.12 0 r/w 8 rgmii timing mode ? 1 = clock delayed 90 degrees ? 0 = clock and data aligned 0 r/w 7 rgmii mode ? 1 = use reduced gmii mode ? 0 = normal gmii/mii operation 0 r/w 6 rgmii rxer mode ? 1 = mux rx_er with rx_dv for rgmii mode ? 0 = mux crs with rx_dv for rgmii mode 1 r/w www.datasheet.in programmer?s guide bcm57xx 01/29/08 broadcom corporation document 57xx-pg105-r transceiver registers page 645 a uxiliary c ontrol r egister (e xcept bcm5714 a nd bcm5715 d evices ) auxiliary control register (phy_addr = 0x1, reg_addr = 18h, shadow = 000, normal) 5 rgmii out-of-band status disable ? 1 = send regular rx data during ipg ? 0 = send out-of-band status info in rgmii mode 1r/w 4 wirespeed enable ? 1 = enable wirespeed mode ? 0 = normal operation ? note: can be set only if gphy port wirespd_enable = 1. 0 r/w 3 mdio all phy select ? 1 = all phy selected during mdio writes when the phy address = 00000 ? 0 = normal operation 0 r/w 2:0 shadow register selector (reference only) writes to the selected shadow register are done on a single cycle (no setup required). reads are selected by first writing to register 18h, shadow 7, bits 14:12. 111 r/w note: to read mii register 18h, shadow register xxx : 1 write register 18h shadow register 111. bit 15 = 0. bits [14:12] = xxx (shadow register value). bits [2:0] = 111 (miscellaneous control). 2 read register 18h. data read is the value from shadow register xxx . bits [2:0] = xxx (shadow register value). to write mii register 18h, shadow register yyy : 1 write register 18h. bits [15:3] = data to write. bits [2:0] = yyy (shadow register value). table 654: 18h: miscellaneous control register (shadow register selector = 111) (cont.) bit field description init access www.datasheet.in bcm57xx programmer?s guide 01/29/08 broadcom corporation page 646 transceiver registers document 57xx-pg105-r table 655: auxiliary control register (phy_addr = 0x1, reg_addr = 18h, shadow = 000, normal) bit field description init access 15 external loopback when bit 15 is a 1, external loopback operation is enabled. a special cable must be inserted to provide a looped signal path. when the bit is 0, normal operation resumes. ? 1 = external loopback enabled. ? 0 = normal operation. 0r/w 14 extended packet length when bit 14 of the auxiliary control register is written to 1, the bcm57xx receives packets up to 25 kb in length. when the bit is written to 0, the bcm57xx only receives packets up to 4.5 kb in length. ? 1 = allow reception of extended length packets. ? 0 = allow normal length ethernet packets only. 0r/w 13:12 edge rate control (1000base-t) bits 13 and 12 of the auxiliary control register control the edge rate of the transmit dac output waveform. ? 00 = 4 ns. ? 01 = 5 ns. ? 10 = 3 ns. ? 11 = 0 ns. 00 r/w 11 reserved write as 0, ignore on read. 0 r/w 10 transmit mode bit 10 of the auxiliary control register must always be written to 1 for normal phy operation. ? 1 = normal operation. ? 0 = test mode. 1r/w 9:8 reserved write as 0, ignore on read. 0 r/w 7 disable partial response filter when bit 7 of the auxiliary control register is written to 1, the transmitter partial response filter is disabled. when the bit is written to 0, the transmitter partial response filter is enabled. ? 1 = transmitter partial response filter disabled. ? 0 = transmitter partial response filter enabled. 0r/w 6:4 reserved write as 0, ignore on read. 0 r/w 5:4 edge rate control (100base-tx) (bcm5705, bcm5721, and bcm5751 only) bits 5 and 4 of the auxiliary control register control the edge rate of the 100base-tx transmit dac output waveform: ? 00 = 4 ns. ? 01 = 5 ns. ? 10 = 3 ns. ? 11 = 0 ns. 00 r/w reserved (other devices) write as 0, ignore on read. 0 r/w 3 reserved (bcm5705 only) write as 0, ignore on read. 0 r/w diagnostic mode (other devices) when bit 3 of the auxiliary control register is written to 1, the bcm57xx enters a special mode to diagnose faults within the cable plant. see application notes for details. ? 1 = cable diagnostic mode enabled. ? 0 = normal operation. 0r/w www.datasheet.in programmer?s guide bcm57xx 01/29/08 broadcom corporation document 57xx-pg105-r transceiver registers page 647 2:0 shadow register select the auxiliary control register provides access to eight registers using a shadow technique. these three bits written define which set of 13 upper bits are used. no setup is required. register reads are determined by the previous write operation . ? 000 = normal operation. ? 001 = 10 base-t register (see ?auxiliary control register (phy_addr = 0x1, reg_addr = 18h, shadow = 001, 10base- t)? on page 648 ). ? 010 = power control register (see ?auxiliary control register (phy_addr = 0x1, reg_addr = 18h, shadow = 010, power control)? on page 651 ). ? 011 = reserved. ? 100 = misc test register 1 (see ?auxiliary control register (phy_addr = 0x1, reg_addr = 18h, shadow = 100, misc test 1)? on page 653 ). ? 101 = misc test register 2. ? 110 = reserved. ? 111 = misc control register (see ?auxiliary control register (phy_addr = 0x1, reg_addr = 18h, shadow = 111, misc control)? on page 655 ). 000 r/w table 655: auxiliary control register (phy_addr = 0x1 , reg_addr = 18h, shadow = 000, normal) (cont.) bit field description init access www.datasheet.in bcm57xx programmer?s guide 01/29/08 broadcom corporation page 648 transceiver registers document 57xx-pg105-r auxiliary control register (phy_addr = 0x1, reg_addr = 18h, shadow = 001, 10base-t) table 656: auxiliary control register (phy_addr = 0x1, reg_addr = 18h, shadow = 001, 10base-t) bit field description init access 15 manchester code error indicates that a manchester code violation was received. this bit is valid only during 10base-t operation. ? 1 = manchester code error (10base-t). ? 0 = no manchester code error. 0r/o lh 14 eof error indicates that the end of frame (eof) sequence was improperly received, or not received at all. this bit is valid only during 10base-t operation. ? 1 = eof error detected (10base-t). ? 0 = no eof error detected. 0r/o lh 13 polarity error indicates that an analog input polarity error has been detected and corrected. this bit is valid only during 10base-t operation. ? 1 = channel polarity inverted. ? 0 = channel polarity correct. 0r/o 12 block rx_dv extension (ipg) when this bit is set, blocking of rx_dv signal is extended for four additional rxc cycles to extend ipg. ? 1 = block rx_dv for four additional rxc cycles for ipg. ? 0 = normal operation. 0r/w 11 10base-t txc invert mode when set to 1, this bit causes the polarity of the 10base- t transmit clock to be inverted. writing 0 restores normal transmit clock polarity. this bit is valid only during 10base- t operation. ? 1 = invert txc output. ? 0 = normal operation. 0r/w 10 reserved write as 0, ignore on read. 0 r/o 9 jabber disable writing a 1 to bit 9 of the auxiliary control register allows the user to disable the jabber detect function defined in the ieee standard. this function shuts off the transmitter when a transmission request has exceeded a maximum time limit. writing a 0 to this bit or resetting the chip restores normal operation. reading this bit returns the value of jabber detect disable. valid for 10base-t operation only. ? 1 = jabber function disabled. ? 0 = jabber function enabled. 0r/w www.datasheet.in programmer?s guide bcm57xx 01/29/08 broadcom corporation document 57xx-pg105-r transceiver registers page 649 8:7 8?1000base-t signal detect threshold (bcm5705, bcm5721, and bcm5751 only) ? 1 = low sd threshold. ? 0 = normal sd threshold. 0r/w 7?10base-t signal detect threshold (bcm5705, bcm5721, and bcm5751 only) ? 1 = low sd threshold. ? 0 = normal sd threshold. 0r/w 8:7?hsq:lsq (other devices) extends or decreases the squelch levels for detection of incoming 10base-t data packets. the default squelch levels implemented are those defined in the ieee standard. the high- and low-squelch levels are useful for situations where the ieee-prescribed levels are inadequate. the squelch levels are used by the crs/link block to filter out noise and recognize only valid packet preambles and link integrity pulses. using low squelch levels allows the bcm57xx to operate properly over longer cable lengths. using high squelch levels can be useful in situations where there is a high level of noise present on the cables. reading these two bits returns the value of the squelch levels. ? 00 = normal squelch. ? 01 = low squelch. ? 10 = high squelch. ? 11 = reserved. 00 r/w 6 10base-t echo mode when enabled, during 10base-t half-duplex transmit operation, the transmitted data is replicated on the receive data pins and the txen signal echoes onto the rxdv pin. the txen signal also echoes onto the crs pin and the crs deassertion directly follows the txen deassertion. ? 1 = echo transmit data to receive data. ? 0 = normal operation. 0r/w 5 sqe enable mode writing a 1 to this bit enables sqe mode. writing a 0 disables it.this bit is valid only during 10base-t operation. ? 1 = enable sqe. ? 0 = disable sqe. 0r/w 4 10base-t no dribble when enabled, the phy rounds down to the nearest nibble when dribble bits are present on the 10base-t input stream. ? 1 = correct 10base-t dribble nibble. ? 0 = normal operation. 0r/w 3 reserved (bcm5705, bcm5721, and bcm5751 only) 0r/o serial mode 10base-t (other devices) when this bit is set ,10base-t serial mode is enabled in the mii side in 10base-t mode. ? 1 = enable 10base-t serial mode. ? 0 = normal operation. 0r/w table 656: auxiliary control register (phy_addr = 0x1, reg_addr = 18h, shadow = 001, 10base-t) (cont.) bit field description init access www.datasheet.in bcm57xx programmer?s guide 01/29/08 broadcom corporation page 650 transceiver registers document 57xx-pg105-r 2:0 shadow register select the auxiliary control register provides access to eight registers using a shadow technique. these three bits written define which set of 13 upper bits is used. no setup is required. register reads are determined by the previous write operation. ? 000 = normal operation (see ?auxiliary control register (phy_addr = 0x1, reg_addr = 18h, shadow = 000, normal)? on page 645 ). ? 001 = 10 base-t register. ? 010 = power control register (see ?auxiliary control register (phy_addr = 0x1, reg_addr = 18h, shadow = 010, power control)? on page 651 ). ? 011 = reserved. ? 100 = misc test register 1 (see ?auxiliary control register (phy_addr = 0x1, reg_addr = 18h, shadow = 100, misc test 1)? on page 653 ). ? 101 = misc test register 2. ? 110 = reserved. ? 111 = misc control register (see ?auxiliary control register (phy_addr = 0x1, reg_addr = 18h, shadow = 111, misc control)? on page 655 ). 000 r/w table 656: auxiliary control register (phy_addr = 0x1, reg_addr = 18h, shadow = 001, 10base-t) (cont.) bit field description init access www.datasheet.in programmer?s guide bcm57xx 01/29/08 broadcom corporation document 57xx-pg105-r transceiver registers page 651 auxiliary control register (phy_addr = 0x1, reg_addr = 18h, shadow = 010, power control) bcm5705, bcm5721, and bcm5751 mac transceivers only this version of the auxiliary control register (phy_addr = 0x1, reg_addr = 18h, shadow = 010, power control) applies to the bcm5705, bcm5721, and bcm5751 mac transceivers only. table 657: aux. reg. (phy_addr=0x1, reg_addr=18h, shadow=010, pwr cont., 5705/5721/5751 only) bit field description init access 15:6 reserved - 00eh r/w 5 super isolate n/a 0 r/w 4:3 reserved write as 1, ignore on read. 10 r/w 2:0 shadow register select the auxiliary control register provides access to eight registers using a shadow technique. these three bits written define which set of 13 upper bits is used. no setup is required. register reads are determined by the previous write operation. ? 000 = normal operation (see ?auxiliary control register (phy_addr = 0x1, reg_addr = 18h, shadow = 000, normal)? on page 645 ). ? 001 = 10 base-t register (see ?auxiliary control register (phy_addr = 0x1, reg_addr = 18h, shadow = 001, 10base-t)? on page 648 ). ? 010 = power control register. ? 011 = reserved. ? 100 = misc test register 1 (see ?auxiliary control register (phy_addr = 0x1, reg_addr = 18h, shadow = 100, misc test 1)? on page 653 ). ? 101 = misc test register 2. ? 110 = reserved. ? 111 = misc control register (see ?auxiliary control register (phy_addr = 0x1, reg_addr = 18h, shadow = 111, misc control)? on page 655 ). 000 r/w www.datasheet.in bcm57xx programmer?s guide 01/29/08 broadcom corporation page 652 transceiver registers document 57xx-pg105-r rest of bcm57xx family this version of the auxiliary control register (phy_addr = 0x1, reg_addr = 18h, shadow = 010, power control) applies to the rest of the bcm57xx family. table 658: aux. cont. (phy_addr=0x1, reg_addr=18h, shadow=010, pwr cont., other bcm57xx fam.) bit field description init access 15:14 reserved write as 1, ignore on read. 0000 r/w 13 regulator input voltage select if the regulator input supply is 3.3v, set this bit to a 1. if the regulator input supply voltage is 2.5v, then set this bit to a 0. ? 1 = regulator input voltage, regsup = 3.3v. ? 0 = regulator input voltage, regsup = 2.5v. 0r/w 12 regulator output voltage select the regulator output voltage can be set to 1.8v, 1.5v or 1.3v. bit 10 and 9 determines the regulator output voltage. ? 00 = regulator output voltage should be 1.8v. ? 01 = regulator output voltage should be 1.5v. ? 10 = regulator output voltage should be 1.3v. 00 r/w 11:6 reserved - 5 super isolate ? 1 = isolate mode with no link pulses transmitted ? 0 = normal operation 0r/w 4 reserved write as 1, ignore on read. 1 r/w 3 wake on lan writing a 1 to this bit enables the wake on lan capability of the transceiver. writing a 0 disables wake on lan. ? 1 = enable wake on lan operation. ? 0 = normal operation. 0r/w 2:0 shadow register select the auxiliary control register provides access to eight registers using a shadow technique. these three bits written define which set of 13 upper bits is used. no setup is required. register reads are determined by the previous write operation. ? 000 = normal operation (see ?auxiliary control register (phy_addr = 0x1, reg_addr = 18h, shadow = 000, normal)? on page 645 ). ? 001 = 10 base-t register (see ?auxiliary control register (phy_addr = 0x1, reg_addr = 18h, shadow = 001, 10base-t)? on page 648 ). ? 010 = power control register. ? 011 = reserved. ? 100 = misc test register 1 (see ?auxiliary control register (phy_addr = 0x1, reg_addr = 18h, shadow = 100, misc test 1)? on page 653 ). ? 101 = misc test register 2. ? 110 = reserved. ? 111 = misc control register (see ?auxiliary control register (phy_addr = 0x1, reg_addr = 18h, shadow = 111, misc control)? on page 655 ). 000 r/w www.datasheet.in programmer?s guide bcm57xx 01/29/08 broadcom corporation document 57xx-pg105-r transceiver registers page 653 auxiliary control register (phy_addr = 0x1, reg_addr = 18h, shadow = 100, misc test 1) table 659: auxiliary control register (phy_addr = 0x1, reg_addr = 18h, shadow = 100, misc test 1) bit field description init access 15 lineside [remote] loopback enable (bcm5705, bcm5721, and bcm5751 only) setting bit 15 enables lineside [remote] loopback of the copper receive packet back out through the mdi transmit path. ? 1 = enable lineside [remote] loopback from mdi (cable end) receive packet, through pcs and back to mdi transmit packet. ? 0 = disable loopback. 0r/w reserved write as 0, ignore on read. 0 r/o 14:12 reserved - 000 r/o 11 lineside [remote] loopback tri-state (bcm5705, bcm5721, and bcm5751 only) setting bit 11 tri-states the receive mii pins when the device is in lineside [remote] loopback mode. ? 1 = tri-state the receive mii pins when lineside [remote] loopback is enabled. ? 0 = lineside [remote] loopback packets appear on mii. 10:5 reserved write as 0, ignore on read. 00h r/o 4 swap rx mdix when this bit is set to 1, the transmitter and receiver operate on the same twisted-pair. this function is for use in a test mode in which the transmitter output is detected by the receiver attached to the same pair. ? 1 = rx and tx operate on same pair. ? 0 = normal operation. 0r/o 3 txhalfout setting this bit to 1 reduces the output of the transmitter to half of its normal amplitude when operating in 10 mbit or 100base-tx mode. setting it to 0 restores full amplitude operation. this function is for use in a test mode in which an unterminated output delivers a reflected signal with twice the amplitude of a terminated output. ? 1 = transmit 10base-t and 100base-t at half amplitude. ? 0 = normal operation. 0r/w www.datasheet.in bcm57xx programmer?s guide 01/29/08 broadcom corporation page 654 transceiver registers document 57xx-pg105-r 2:0 shadow register select the auxiliary control register provides access to eight registers using a shadow technique. these three bits written define which set of 13 upper bits is used. no setup is required. register reads are determined by the previous write operation. ? 000 = normal operation (see ?auxiliary control register (phy_addr = 0x1, reg_addr = 18h, shadow = 000, normal)? on page 645 ). ? 001 = 10 base-t register (see ?auxiliary control register (phy_addr = 0x1, reg_addr = 18h, shadow = 001, 10base-t)? on page 648 ). ? 010 = power control register (see ?auxiliary control register (phy_addr = 0x1, reg_addr = 18h, shadow = 010, power control)? on page 651 ). ? 011 = reserved. ? 100 = misc test register 1. ? 101 = misc test register 2. ? 110 = reserved. ? 111 = misc control register (see ?auxiliary control register (phy_addr = 0x1, reg_addr = 18h, shadow = 111, misc control)? on page 655 ). 000 r/w table 659: auxiliary control register (phy_addr = 0x1, reg_addr = 18h, shadow = 100, misc test 1) (cont.) bit field description init access www.datasheet.in programmer?s guide bcm57xx 01/29/08 broadcom corporation document 57xx-pg105-r transceiver registers page 655 auxiliary control register (phy_addr = 0x1, reg_addr = 18h, shadow = 111, misc control) table 660: auxiliary control register (phy_addr = 0x1, reg_addr = 18h, shadow = 111, misc control) bit field description init access 15 write enable (bits 11:3) (bcm5705, bcm5721, and bcm5751 only) ? 1 = write bits 14:0. ? 0 = write bits 14:12 and 2:0. 0r/w sc write enable (bits 8:3) (other devices) ? 1 = write bits 8:3. ? 0 = only write bits 14:12. 0r/w sc 14:12 shadow register read selector ? 000 = normal operation (see ?auxiliary control register (phy_addr = 0x1, reg_addr = 18h, shadow = 000, normal)? on page 645 ). ? 001 = 10 base-t register (see ?auxiliary control register (phy_addr = 0x1, reg_addr = 18h, shadow = 001, 10base-t)? on page 648 ). ? 010 = power control register (see ?auxiliary control register (phy_addr = 0x1, reg_addr = 18h, shadow = 010, power control)? on page 651 ). ? 011 = reserved. ? 100 = misc test register 1 (see ?auxiliary control register (phy_addr = 0x1, reg_addr = 18h, shadow = 100, misc test 1)? on page 653 ). ? 101 = misc test register 2. ? 110 = reserved. ? 111 = misc control register. 000 r/w 11:9 11?packet counter mode (bcm5705, bcm5721, and bcm5751 only) ? 1 = receive packet counter. ? 0 = transmit packet counter. 0r/w 10?reserved (bcm5705, bcm5721, and bcm5751 only) -0r/w 9?force auto-mdix mode (bcm5705, bcm5721, and bcm5751 only) ? 1 = auto-mdix is enabled when auto-negotiation is disabled. ? 0 = auto-mdix is disabled when auto-negotiation is disabled. 11:9?cable length 100base-tx (other devices) 3 bit cable length for 100base-tx. invalid during 100base- tx wol. 000 r/o 8 rgmii timing mode (bcm5705, bcm5721, and bcm5751 only) ? 1 = rgmii rxc delayed timing mode. ? 0 = rgmii rxc/rxd aligned timing mode. 0r/w 100base-tx high performance (other devices) ? 1 = use gigabit equivalizer for high performance 100base-tx. ? 0 = normal operation. 0r/w 7 rgmii mode n/a 0 r/w 6 rgmii rxer mode n/a 0 r/w 5 rgmii out of band status disable ? 1 = send regular data during ipg. ? 0 = send out-of-band status info in rgmii mode. 0r/w www.datasheet.in bcm57xx programmer?s guide 01/29/08 broadcom corporation page 656 transceiver registers document 57xx-pg105-r 4 reserved (bcm5705, bcm5721, and bcm5751 only) 1r/w wire speed enable ? 1 = enable wire speed mode. ? 0 = normal operation. 0r/w 3 mdio all phy select ? 1 = all phy selected during mdio writes when phy address = 00000b. ? 0 = normal operation. 0r/w 2:0 shadow register select the auxiliary control register provides access to eight registers using a shadow technique. these three bits written define which set of 13 upper bits are used. no setup is required. register reads are determined by the previous write operation. ? 000 = normal operation (see ?auxiliary control register (phy_addr = 0x1, reg_addr = 18h, shadow = 000, normal)? on page 645 ). ? 001 = 10 base-t register (see ?auxiliary control register (phy_addr = 0x1, reg_addr = 18h, shadow = 001, 10base-t)? on page 648 ). ? 010 = power control register (see ?auxiliary control register (phy_addr = 0x1, reg_addr = 18h, shadow = 010, power control)? on page 651 ). ? 011 = reserved. ? 100 = misc test register 1 (see ?auxiliary control register (phy_addr = 0x1, reg_addr = 18h, shadow = 100, misc test 1)? on page 653 ). ? 101 = misc test register 2. ? 110 = reserved. ? 111 = misc control register. 000 r/w table 660: auxiliary control register (phy_addr = 0x1, reg_addr = 18h, shadow = 111, misc control) (cont.) bit field description init access www.datasheet.in programmer?s guide bcm57xx 01/29/08 broadcom corporation document 57xx-pg105-r transceiver registers page 657 a uxiliary s tatus s ummary r egister (phy_a ddr = 0 x 1, r eg _a ddr = 19 h ) table 661: auxiliary status summary register (phy_addr = 0x1, reg_addr = 19h) bit field description init access 15 auto-negotiation complete the bcm57xx returns a 1 on bit 15 of the auxiliary status summary register when auto-negotiation is complete. this bit returns a 0 while auto-negotiation is in progress. ? 1 = auto-negotiation complete. ? 0 = auto-negotiation in progress. 0r/o 14 auto-negotiation complete acknowledge the bcm57xx returns a 1 on bit 14 of the auxiliary status summary register when the auto-negotiation state machine has entered the link good check state since the last time this register was read, otherwise, it returns a 0. ? 1 = entered auto-negotiation link good check state. ? 0 = state not entered since last read. 0r/o lh 13 auto-negotiation acknowledge detect the bcm57xx returns a 1 on bit 13 of the auxiliary status summary register when the auto-negotiation state machine has entered the acknowledge detect state since the last time this register was read, otherwise, it returns a 0. ? 1 = entered auto-negotiation acknowledge detect state. ? 0 = state not entered since last read. 0r/o lh 12 auto-negotiation ability detect the bcm57xx returns a 1 on bit 12 of the auxiliary status summary register when the auto-negotiation state machine has entered the ability detect state since the last time this register was read, otherwise, it returns a 0. ? 1 = entered auto-negotiation ability detect state. ? 0 = state not entered since last read. 0r/o lh 11 auto-negotiation next page wait the bcm57xx returns a 1 on bit 11 of the auxiliary status summary register when the auto-negotiation state machine has entered the next page wait state since the last time this register was read, otherwise, it returns a 0. ? 1 = entered auto-negotiation next page wait state. ? 0 = state not entered since last read. 0r/o lh 10:8 auto-negotiation hcd (current operating speed and duplex mode) bits 10:8 of the auxiliary status summary register report the mode of operation negotiated between the bcm57xx and its link partner. the bits return 000 until auto- negotiation has completed, as reported by bit 15 of the auxiliary status summary register. when the auto- negotiation function has been disabled, bits 10:8 report the manually selected mode of operation. ? 111 = 1000base-t full-duplex* ? 110 = 1000base-t half-duplex* ? 101 = 100base-tx full-duplex* ? 100 = 100base-t4 ? 011 = 100base-tx half-duplex* ? 010 = 10base-t full-duplex* ? 001 = 10base-t half-duplex* ? 000 = no highest common denominator or auto- negotiation not complete. 000 r/o www.datasheet.in bcm57xx programmer?s guide 01/29/08 broadcom corporation page 658 transceiver registers document 57xx-pg105-r 7 parallel detection fault bit 7 of the auxiliary status summary register returns a one when a parallel detection fault has occurred in the auto- negotiation state machine. when a parallel detection fault occurs, this bit is latched at one and remain so until the register read. this bit returns a 0 when a parallel detection fault has not occurred since the last time it was read. ? 1 = parallel link fault detected. ? 0 = parallel link fault not detected. 0r/o lh 6 remote fault the bcm57xx returns a one on bit 6 of the auxiliary status summary register when the link partner has advertised detection of a remote fault, otherwise, it returns a 0. ? 1 = link partner has detected remote fault. ? 0 = link partner has not detected remote fault. 0r/o 5 auto-negotiation page received the bcm57xx returns a one on bit 5 of the auxiliary status summary register when a new link code word has been received from the link partner since the last time this register was read, otherwise, it returns a 0. ? 1 = new page has been received from link partner. ? 0 = new page has not been received. 0r/o lh 4 link partner auto- negotiation ability the bcm57xx returns a one on bit 4 of the auxiliary status summary register when the link partner is known to have auto-negotiation capability. before any auto-negotiation information is exchanged, or if the link partner does not comply with ieee auto-negotiation, the bit returns a 0. ? 1 = link partner has auto-negotiation capability. ? 0 = link partner does not perform auto-negotiation. 0r/o 3 link partner next page ability the bcm57xx returns a one on bit 3 of the auxiliary status summary register when the link partner needs to transmit next page information, otherwise, it returns a 0. ? 1 = link partner has next page capability. ? 0 = link partner does not have next page capability. 0r/o 2 link status the bcm57xx returns a 1 on bit 2 of the auxiliary status summary register when the link status is good, otherwise, it returns a 0. ? 1 = link is up (link pass state). ? 0 = link is down (link fail state). 0r/o 1 pause resolution? receive direction when auto-negotiation has completed, the bcm57xx returns the result of the pause resolution function for full- duplex flow control on bits 1:0 of the auxiliary status summary register. when bit 1 returns a 1, the link partner can send pause frames toward the local device. these bits are only guaranteed to be valid when bit 15 of the auxiliary status summary register is 1. ? 1 = enable pause receive. ? 0 = disable pause receive. 0r/o table 661: auxiliary status summary register (phy_addr = 0x1, reg_a ddr = 19h) (cont.) bit field description init access www.datasheet.in programmer?s guide bcm57xx 01/29/08 broadcom corporation document 57xx-pg105-r transceiver registers page 659 i nterrupt s tatus r egister (phy_a ddr = 0 x 1, r eg _a ddr = 1a h ) the interrupt status output is asserted when any bit in this register is set and the corresponding bit in the interrupt mask register is cleared. 0 pause resolution? transmit direction when auto-negotiation has completed, the bcm57xx returns the result of the pause resolution function for full- duplex flow control on bits 1:0 of the auxiliary status summary register. when bit 0 returns a 1, pause frames can be transmitted by the local device to the link partner. these bits are only guaranteed to be valid when bit 15 of the auxiliary status summary register is 1. ? 1 = enable pause transmit. ? 0 = disable pause transmit. 0r/o * indicates the negotiated hcd when auto-negotiation enable = 1. indicates the manually selected speed and duplex mode when auto-negotiation enable = 0. table 662: interrupt status register (phy_addr = 0x1, reg_addr = 1ah) bit field description init access 15 signal detect/energy detect change (bcm5705, bcm5721, bcm5751, bcm5714, and bcm5715 only) the bit indicates whether the fiber sd or the copper ed has changed since the last read. ? 1 = sd or ed changed (enabled by register 1ch, shadow 00101, bit 5 =1). ? 0 = interrupt cleared. 0r/o reserved (other devices) ignore on read. 0 r/o 14 illegal pair swap the bcm57xx returns a one on bit 14 of the interrupt status register when an uncorrectable pair swap error on the twisted pair cable has been detected since the last time this register was read, otherwise, it returns a 0. ? 1 = illegal pair swap detected. ? 0 = interrupt cleared. 0r/o lh 13 mdix status change the bcm57xx returns a one on bit 13 of the interrupt status register when a link pulse or 100base-tx carrier was detected on a different pair than previously detected since the last time this register was read, otherwise, it returns a 0. ? 1 = mdix status changed since last read. ? 0 = interrupt cleared. 0r/o lh 12 exceeded high counter threshold the bcm57xx returns a one on bit 12 of the interrupt status register when one or more of the counters in registers 12-14h is above 32k, otherwise, it returns a 0. ? 1 = value in one or more counters is above 32k. ? 0 = all counters below 32k. 0r/o table 661: auxiliary status summary register (phy_addr = 0x1, reg_addr = 19h) (cont.) bit field description init access www.datasheet.in bcm57xx programmer?s guide 01/29/08 broadcom corporation page 660 transceiver registers document 57xx-pg105-r 11 exceeded low counter threshold the bcm57xx returns a one on bit 11 of the interrupt status register when one or more of the counters in registers 12-14h is above 128, otherwise, it returns a 0. ? 1 = value in one or more counters is above 128. ? 0 = all counters below 128. 0r/o 10 auto-negotiation page received the bcm57xx returns a one on bit 10 of the interrupt status register when a new link code word has been received from the link partner since the last time this register was read, otherwise, it returns a 0. ? 1 = page received since last read. ? 0 = interrupt cleared. 0r/o lh 9 hcd no link bit 9 of the interrupt status register is set to 1 by the bcm57xx when the negotiated hcd was not able to establish a link. the bit is cleared when the register is read. ? 1 = negotiated hcd, did not establish link. ? 0 = interrupt cleared. 0r/o lh 8 no hcd bit 8 of the interrupt status register is set to 1 by the bcm57xx when auto-negotiation returns no hcd. the bit is cleared when the register is read. ? 1 = auto-negotiation returned hcd = none. ? 0 = interrupt cleared. 0r/o lh 7 negotiated unsupported hcd bit 7 of the interrupt status register is set to 1 when the auto- negotiation hcd is not supported by the bcm57xx. the bcm57xx does not support 100base-t4. the bit is cleared when the register is read. ? 1 = auto-negotiation hcd not supported by bcm57xx. ? 0 = interrupt cleared. 0r/o lh 6 scrambler synchronization error he bcm57xx returns a one on bit 6 of the interrupt status register when a scrambler synchronization error has been detected since the last time this register was read, otherwise, it returns a 0. ? 1 = scrambler synchronization error occurred since last read. ? 0 = interrupt cleared. 0r/o lh 5 remote receiver status change the bcm57xx returns a one on bit 5 of the interrupt status register when the remote receiver status has changed since the last time this register was read, otherwise, it returns a 0. ? 1 = remote receiver status changed since last read. ? 0 = interrupt cleared. 0r/o lh 4 local receiver status change the bcm57xx returns a one on bit 4 of the interrupt status register when the local receiver status has changed since the last time this register was read, otherwise, it returns a 0. ? 1 = local receiver status changed since last read. ? 0 = interrupt cleared. 0r/o lh 3 duplex mode change the bcm57xx returns a one on bit 3 of the interrupt status register when the duplex mode has changed since the last time this register was read, otherwise, it returns a 0. ? 1 = duplex mode changed since last read. ? 0 = interrupt cleared. 0r/o lh table 662: interrupt status register (phy_addr = 0x1, reg_addr = 1ah) (cont.) bit field description init access www.datasheet.in programmer?s guide bcm57xx 01/29/08 broadcom corporation document 57xx-pg105-r transceiver registers page 661 i nterrupt m ask r egister (phy_a ddr = 0 x 1, r eg _a ddr = 1b h ) 2 link speed change the bcm57xx returns a one on bit 2 of the interrupt status register when the link speed has changed since the last time this register was read, otherwise, it returns a 0. ? 1 = link speed changed since last read. ? 0 = interrupt cleared. 0r/o lh 1 link status change the bcm57xx returns a one on bit 1 of the interrupt status register when the link status has changed since the last time this register was read, otherwise, it returns a 0. ? 1 = link status changed since last read. ? 0 = interrupt cleared. 0r/o lh 0 crc error the bcm57xx returns a one on bit 0 of the interrupt status register when a receive crc error has been detected since the last time this register was read, otherwise, it returns a 0. ? 1 = crc error occurred since last read. ? 0 = interrupt cleared. 0r/o lh table 663: interrupt mask register (phy_addr = 0x1, reg_addr = 1bh) bit field description init access 15:0 interrupt mask vector when bit n of the interrupt mask register is written to 1, the interrupt corresponding to the same bit in the interrupt status register is masked. the status bits still operate normally when the interrupt is masked, but do not generate an interrupt output. when the bit is written to 0, the interrupt is unmasked. ? 1 = interrupt masked, status bits operate normally. ? 0 = interrupt enabled, status bits operate normally. 11?1 r/w table 662: interrupt status register (phy_addr = 0x1, reg_addr = 1ah) (cont.) bit field description init access www.datasheet.in bcm57xx programmer?s guide 01/29/08 broadcom corporation page 662 transceiver registers document 57xx-pg105-r m isc s hadow r egisters (phy_addr = 0x1, reg_addr = 1ch; bcm5702, BCM5703, and bcm5704 o nly ) spare control register 1 (address 1ch, enable by register 1ch bits[14:10] = 00010) this version of the register is only applicable to the bcm5702, BCM5703, and bcm5704. write enable setting bit 15 to a 1 during a write to this register allows writing to bits [9:0] of this register. for reading the values of bits [9:0], perform an mdio write with bit 15 cleared and the desir ed shadow values in bits [14:10]. the next mdio read of register address 1ch will contain the desired shadow register values in bits [9:0]. shadow register selector register address 1ch bits [14:10] provides access to 4 registers using a shadow technique. the bits define which set of the lower 10 bits is used in accordance with the table descripti on for the shadow register selector. the register set shown above is that for spare control register 1, obtained when bits [14:10] = 00010. ultra low-power mode writing a 1 to bit 1 will put the bcm57xx into ultra low-power mode. there is no register access once this mode is entered. to get out of this mode, a hardware reset is required. link led mode by writing a 1 to this bit, the bcm57xx operate in an alternative link/speed led scheme as follows: link[1] and link[2] pins will function as speed indicators only, and slave pin will function as a link led. table 664: spare control register 1 (address 1ch, enable by register 1ch bits[14:10] = 00010) bit field description init access 15 write enable ? 1 = write bits [9:0]. ? 0 = read bits [9:0]. 0r/w 14:10 shadow register selector ? 00010 = spare control register 1. ? 00100 = spare control register 2. ? 00101 = spare control register 3. ? 01000 = led status register. ? 01001 = led control register. ? 01010 = auto power down register. 00010 r/w 9:2 reserved write as 00000000, ignore when read. 00h r/w 1 ultra low power mode ? 1 = ultra low-power mode enabled. ? 0 = normal mode. 0r/w 0link led mode ? 1 = alternative link led mode. ? 0 = normal link led mode. 0r/w www.datasheet.in programmer?s guide bcm57xx 01/29/08 broadcom corporation document 57xx-pg105-r transceiver registers page 663 spare control register 2 (address 1ch, shadow value 00100) this register is only applicable to the bcm5702, BCM5703, and bcm5704. write enable setting bit 15 to a 1 during a write to this register allows writing to bits [9:0] of this register. for reading the values of bits [9:0], perform an mdio write with bit 15 cleared and the desir ed shadow values in bits [14:10]. the next mdio read of register address 1ch will contain the desired shadow register values in bits [9:0]. shadow register selector register address 1ch bits [14:10] provide access to four registers using a shadow technique. the bits define which set of the lower 10 bits is used in accordance with the table description for the shadow register selector. the register set shown above is that for spare control register 1, obtained when bits [14:10] = 00010. invert tbi writing a 1 to the spare control register 2, bit 6, toggles the value latched in on the en_10b during reset as follows: ? if en_10b pin = 0 and rgmiien pin = 0 at reset, then setting bit 6 = 1 will enable tbi mode, enable rbc0/1 and tri- state rxc/txc. ? if en_10b pin = 1 and rgmiien pin = 0 at reset, then setting bit 6 = 1 will disable tbi mode, enable rxc/txc and tri- state rbc0/1. ? if en_10b pin = 0 and rgmiien pin = 1 at reset, then setting bit 6 = 1 will enable rtbi mode, enable rxc/txc and rbc0/1. table 665: spare control register 2 (address 1ch, shadow value 00100) bit field description init access 15 write enable ? 1 = write bits [9:0]. ? 0 = read bits [9:0]. 0r/w 14:10 shadow register selector ? 00010 = spare control register 1. ? 00100 = spare control register 2. ? 00101 = spare control register 3. ? 01000 = led status register. ? 01001 = led control register. ? 01010 = auto power down register. 00100 r/w 9:7 reserved write as 000, ignore when read. 000 r/w 6 invert tbi ? 1 = value latched in during power-on/reset on en_10b pin, inverted. ? 0 = value latched in during power-on/reset on en_10b pin, not inverted. 0r/w 5 reserved write as 0, ignore when read. 0 r/w 4 invert intr ? 1 = intr pin active high. ? 0 = intr pin active low. 0r/w 3:2 reserved write as 00, ignore when read. 00 r/w 1 energy detect function ? 1 = energy detect function enabled. ? 0 = energy detect function disabled. 0r/w 0 reserved write as 0, ignore when read. 0 r/w www.datasheet.in bcm57xx programmer?s guide 01/29/08 broadcom corporation page 664 transceiver registers document 57xx-pg105-r ? if en_10b pin = 1 and rgmiien pin = 1 at reset, then setting bit 6 = 1 will disable rtbi mode, enable rxc/txc and rbc0/1. invert intr when bit 4 of the spare control register 2 is written to 1, the intr pin will become an active high output. when bit 4 is written to 0, the intr pin will become an active low output. energy detect writing a 1 to bit 1 of mii register 1ch with shadow value 00100 will enable the energy detect function only when auto- negotiation is also enabled. the interrupt function will be unavailable while this bit is set. spare control register 3 (address 1ch, shadow value 00101) this register is only applicable to the bcm5702, BCM5703, and bcm5704. write enable setting bit 15 to a 1 during a write to this register allows writing to bits [9:0] of this register. for reading the values of bits [9:0], perform an mdio write with bit 15 cleared and the desir ed shadow values in bits [14:10]. the next mdio read of register address 1ch will contain the desired shadow register values in bits [9:0]. shadow register selector register address 1ch bits [14:10] provide access to 4 registers using a shadow technique. the bits define which set of the lower 10 bits is used in accordance with the table descripti on for the shadow register selector. the register set shown above is that for spare control register 1, obtained when bits [14:10] = 00010. clk125 enable writing a 0 to this bit will disable the clk125 output only when the part is in auto power down mode. this feature enables additional power savings. this feature should only be used if the 125-mhz clock is not needed by the mac or asic. table 666: spare control register 3 (address 1ch, shadow value 00101) bit field description init access 15 write enable ? 1 = write bits [9:0]. ? 0 = read bits [9:0]. 0r/w 14:10 shadow register selector ? 00010 = spare control register 1. ? 00100 = spare control register 2. ? 00101 = spare control register 3. ? 01000 = led status register. ? 01001 = led control register. ? 01010 = auto power down register. 00101 r/w 9:5 reserved write as 00000, ignore when read. 00000 r/w 4:2 reserved write as 111, ignore on read. 111 r/w 1 clk125 enable ? 1 = enables clk125 output. ? 0 = disables clk125 output. 1r/w 0 reserved write as 1, ignore on read. 1 r/w www.datasheet.in programmer?s guide bcm57xx 01/29/08 broadcom corporation document 57xx-pg105-r transceiver registers page 665 led status register (address 1ch, shadow register selector = 01000) this register is only applicable to the bcm5702, BCM5703, and bcm5704. write enable setting bit 15 to a 1 during a write to this register allows writing to bits [9:0] of this register. for reading the values of bits [9:0], perform an mdio write with bit 15 cleared and the desir ed shadow values in bits [14:10]. the next mdio read of register address 1ch will contain the desired shadow register values in bits [9:0]. shadow register selector bits [14:10] of this register should be set to 01000 to enable read/write to the spare control register, address 1ch. slave when this bit returns a 0, the device is in the slave mode. when this bit returns a 1, the device is in the master mode. table 667: led status register (address 1ch, shadow register selector = 01000) bit field description init access 15 write enable ? 1 = write bits [9:0]. ? 0 = read bits [9:0]. 0r/w 14:10 shadow register selector ? 00010 = spare control register 1. ? 00100 = spare control register 2. ? 00101 = spare control register 3. ? 01000 = led status register. ? 01001 = led control register. ? 01010 = auto power down register. 01000 r/w 9 reserved write as 0, ignore when read. 0 r/o 8 slave ? 1 = master mode. ? 0 = slave mode. 0r/o 7fdx ? 1 = hdx mode. ? 0 = fdx mode. 0r/o 6intr ? 1 = no active interrupts. ? 0 = active interrupts. 0r/o 5 link1000 ? 1 = no 1000base-t established. ? 0 = 1000base-t established. 0r/o 4 link100 ? 1 = no 100base-tx established. ? 0 = 100base-tx established. 0r/o 3link10 ? 1 = no 10base-t established. ? 0 = 10base-t established. 0r/o 2 transmit ? 1 = transmit not active. ? 0 = transmit active. 0r/o 1 receive ? 1 = receive not active. ? 0 = receive active. 0r/o 0 quality ? 1 = quality not good. ? 0 = quality good. 0r/o www.datasheet.in bcm57xx programmer?s guide 01/29/08 broadcom corporation page 666 transceiver registers document 57xx-pg105-r fdx when this bit returns a 0, the device is in the full-duplex mode. when this bit returns a 1, the device is in the half-duplex m ode. intr when this bit returns a 0, the device has active interrupts. when this bit returns a 1, the device is has no active interrupts. link1000 when this bit returns a 0, the device has established a 1000b ase-t link. when this bit returns a 1, the device has not established a link. link100 when this bit returns a 0, the device has established a 100 base-tx link. when this bit returns a 1, the device has not established a link. link10 when this bit returns a 0, the device has established a 10base-t link. when this bit returns a 1, the device has not established a link. transmit when this bit returns a 0, the device is transmitting data. when this bit returns a 1, the device is not transmitting data. receive when this bit returns a 0, the device is receiving data. when this bit returns a 1, the device is not receiving data. quality when this bit returns a 0, the device has good signal quality. when this bit returns a 1, the device does not have good signal quality. www.datasheet.in programmer?s guide bcm57xx 01/29/08 broadcom corporation document 57xx-pg105-r transceiver registers page 667 led control register (address 1ch, shadow value 01001) this register is only applicable to the bcm5702, BCM5703, and bcm5704. write enable during a write to this register, setting led control register bit 15 allows writing to bits [9:0] of this register. for reading the values of bits [9:0], perform an mdio write with bit 15 cleared and preferred shadow values in bits [14:10]. the next mdio read of register address 1ch contains the preferred shadow register values in bits [9:0]. shadow register selector led control register bits [14:10] of this register must be set to 01001 to enable read/write to the register address 1ch. activity link led enable setting led control register bit 4 drives activity/link data on receive led. activity led enable setting led control register bit 3 drives activity data on receive led. remote fault led enable setting led control register bit 2 drives remote fault on quality led. table 668: led control register (address 1ch, shadow value 01001) bit field description init access 15 write enable ? 1 = write bits [9:0]. ? 0 = read bits [9:0]. 0r/w 14:10 shadow register selector ? 00010 = spare control register 1. ? 00100 = spare control register 2. ? 00101 = spare control register 3. ? 01000 = led status register. ? 01001 = led control register. ? 01010 = auto power down register. 01001 r/w 9:5 reserved write as 0, ignore when read. 00h r/w 4 activity link led enable ? 1 = drive activity/link data on receive led. ? 0 = normal operation. 0r/w 3 activity led enable ? 1 = drive activity data on receive led. ? 0 = normal operation. 1r/w 2 remote fault led enable ? 1 = drive remote fault on quality led. ? 0 = normal operation. 0r/w 1:0 link utilization led selector ? 00 = normal operation. ? 01 = transmit data on receive led. ? 10 = receive data on receive led. ? 11 = activity data on receive led. (this mode has higher priority than the activity led enable in bit 3.) 00 r/w www.datasheet.in bcm57xx programmer?s guide 01/29/08 broadcom corporation page 668 transceiver registers document 57xx-pg105-r link utilization led selector setting led control register bits [1:0] drives link utilization on the receive led. auto power-down register (address 1ch, shadow value 01010) this register is only applicable to the bcm5702, BCM5703, and bcm5704. write enable for reading the values of bits [9:0], write to register 1ch, shadow 00010, bit 15 = 1 and the desired shadow values in bits [14:10]. the following mdio read of register address 1ch will contain the desired shadow register values in bits [9:0]. shadow register selector register address 1ch bits [14:10] provide access to four registers using a shadow technique. the bits define which set of the lower 10 bits are used in accordance with the table description for the shadow register selector. the register set shown above is that for spare control register 1, obtained when bits [14:10] = 00010. auto power-down mode enable setting this bit enables the auto power-down mode. sleep timer setting this bit changes the wake-up time leaving auto power-down mode. wakeup timer select the bcm57xx continues wake-up mode for a time based on the count stored in this register. the minimum value is 84 ms and the maximum value is 1.26s. table 669: auto power-down register (address 1ch, shadow value 01010) bit field description init access 15 write enable ? 1 = write bits [9:0]. ? 0 = read bits [9:0]. 0r/w 14:10 shadow register selector ? 00010 = spare control register 1. ? 00100 = spare control register 2. ? 00101 = spare control register 3. ? 01000 = led status register. ? 01001 = led control register. ? 01010 = auto power-down register. 01010 r/w 9:6 reserved write as 0000, ignore when read. 0000 r/w 5 auto power-down mode ? 1 = auto power-down mode enabled. ? 0 = auto power-down mode disabled. 0r/w 4 sleep timer ? 1 = sleep timer is 5.4 seconds. ? 0 = sleep timer is 2.7 seconds. 0 3:0 wakeup timer select counter for wakeup timer in units of 84 ms. 0001 www.datasheet.in programmer?s guide bcm57xx 01/29/08 broadcom corporation document 57xx-pg105-r transceiver registers page 669 m isc s hadow r egisters (phy_addr = 0x1, reg_addr = 1ch; bcm5705, bcm5721, bcm5751, bcm5752, bcm5714, and bcm5715 o nly ) spare control 1 this version of the register is only applicable to the bcm5705, bcm5721, bcm5751 and bcm5752. the following is enabled by register 1ch with the shadow value in bits [14:10] = 00010. write enable during a write to this register, setting spare control 1 register bit 15 to a 1 allows writing to bits [7:0] of this register. for reading the values of bits [9:0], perform an mdio write with bit 15 set to a 0 and preferred shadow values in bits [14:10]. the next mdio read of register address 1ch contains the preferred shadow register values in bits [9:0]. shadow register selector bits [14:10] of this register must be set to 00010 to enable read/write to the spare control 1 register address 1ch. link led mode bit 0 of mii register 1ch with shadow value 00010 selects the link led mode. when this bit is set, it enables the link led mode. the linkspd2 /linkspd1 are link/speed led and slave led is link led to indicate a link for 10base-t, 100base-tx or 1000base-t. when this bit is cleared, the linkspd2 , linkspd1 , and slave are in their normal mode. table 670: spare control 1 register (address 1ch, shadow value 00010) bit field description init access 15 write enable ? 1 = write bits [9:0]. ? 0 = read bits [9:0]. 0r/w 14:10 shadow register selector 00010 = spare control 1 register. 00010 r/w 9:1 reserved write as 00h, ignore when read. 00h r/w 0link led mode ? 1 = enable link led mode. ? linkspd[2:1] = speed. ? 00: 1000base-t link. ? 01: 100base-tx link. ? 10: 10base-t link or no link. ? slave = active low 10/100/1000base-t link. ? 0 = normal link mode. 0r/w www.datasheet.in bcm57xx programmer?s guide 01/29/08 broadcom corporation page 670 transceiver registers document 57xx-pg105-r this version of the register is applicable only to the bcm5714 and bcm5715. table 671: spare control 1 register (shadow register selector = 00010) bit field description init access 15 write enable ? 1 = write bits [9:0]. ? 0 = read bits [9:0]. 0r/w 14:10 shadow register selector shadow register selector 00010 r/w 9:7 reserved write as 00h, ignore when read. 00 r/w 6 cfc_initfilter 1 = enable cfc_initfilter signal to control clock gating of 1000t clocks. do not gate off 1000t clocks whenever cfiltercntl is initializing the filter. 0r/w 5 reserved write as 0, ignore on read 0 r/w 4 100base-fx mode copper path ? 1 = enable 100base-fx on trd pins ? 0 = normal copper operation on mdi pairs 0r/w 3 xmt crc enable ? 1 = transmit crc checker enabled ? 0 = transmit crc checker disabled 0r/w 2 bicolor link speed led mode ? 1 = enable bicolor link speed led mode linkspd[1:0] = speed ? 10 = 1000base-t ? 01 = 100base-t ? 11 = auto-negotiation, 10base-t 0r/w 1 lost token fix enable when 0, enables lost token fix reset circuits 0 r/w 0link led mode ? 1 = enable link led mode: ? linkspd[1:0] = speed ? 00 = 1000base-t ? 01 = 100base-t ? 10 = 10base-t ? 11 = auto-negotiation ? slave = active low link ? 0 = normal link/slave mode 0r/w www.datasheet.in programmer?s guide bcm57xx 01/29/08 broadcom corporation document 57xx-pg105-r transceiver registers page 671 clock alignment control this version of the register is only applicable to the bcm5705, bcm5721, bcm5751 and bcm5752. the following is enabled by register 1ch with shadow value in bits [14:10] = 00011. write enable during a write to this register, setting clock alignment register bit 15 to a 1 allows writing to bits [7:0] of this register. for reading the values of bits [9:0], perform an mdio write with bit 15 set to a 0 and preferred shadow values in bits [14:10]. the next mdio read of register address 1ch contains the preferred shadow register values in bits [9:0]. shadow register selector bits [14:10] of this register must be set to 00011 to enable read/write to the clock alignment register 1ch. gtxclk clock delay enable setting bit 9 of mii register 1ch with shadow value 00011 enables the gtxclk internal delay. when this bit is cleared, the gtxclk delay is bypassed. table 672: clock alignment control register (address 1ch, shadow value 00011) bit field description init access 15 write enable ? 1 = write bits [9:0]. ? 0 = read bits [9:0]. 0r/w 14:10 shadow register selector 00011 = clock alignment control register. 00011 r/w 9 gtxclk clock delay enable ? 1 = enable gtxclk delay. ? 0 = normal mode (bypass gtxclk delay). gtxclkdly pin r/w 8:0 reserved write as 000h, ignore when read. 000h r/w www.datasheet.in bcm57xx programmer?s guide 01/29/08 broadcom corporation page 672 transceiver registers document 57xx-pg105-r this version of the register is applicable only to bcm5714 and bcm5715. table 673: clock alignment control register (shadow register selector = 00011) bit field description init access 15 write enable ? 1 = write bits [9:0]. ? 0 = read bits [9:0]. 0r/w 14:10 shadow register selector shadow register selector 00011 r/w 9 gtxclk delay bypass disable ? 0 = bypass gtxclk delay ? 1 = do not bypass gtxclk delay 0r/w 8 gmii clock alignment strobe delay value is latched into selected gmii clock delay line on rising edge of this bit 0r/w 7 rxclk alignment strobe delay value is latched into selected rx clock delay line on rising edge of this bit 0r/w 6:4 delay value rxclk delay: reset = default delay ? 000 = +1 unit delay ... ? 111 = +8 units delay ? gmii clock delay: ? 110 = -1.0ns ? 111 = -0.5ns ? 000 = 0ns ? 001 = 0.5ns ? 010 = 1.0ns 000 r/w 3:0 delay line selector rxclk strobe: ? xx00 = std cell rxclk ? xx01 = dfse rxclk ? xx10 = dfe rxclk ? xx11 = enc rxclk ? gmii clock strobe: ? 0111 = tbi gtx_clk ? 1000 = gmii gtx_clk ? 1001 = rgmii gtx_clk ? 1010 = gmii rx_clk ? 1011 = rgmii rx_clk ? 1100 = tbi rbc0 ? 1101 = tbi rbc1 0000 r/w www.datasheet.in programmer?s guide bcm57xx 01/29/08 broadcom corporation document 57xx-pg105-r transceiver registers page 673 spare control 2 this version of the register is only applicable to the bcm5705, bcm5721, bcm5751 and bcm5752. the following is enabled by register 1ch with shadow value in bits [14:10] = 00100. write enable during a write to this register, setting spare control 2 register bit 15 allows writing to bits [9:0] of this register. for rea ding the values of bits [9:0], perform an mdio write with bit 15 cleared and preferred shadow values in bits [14:10]. the next mdio read of register address 1ch contains the preferred shadow register values in bits [9:0]. shadow register selector bits [14:10] must be set to 00100 to enable read/write to the spare control 2 register. energy detect on intr pin setting bit one of this register enables the energy detect fu nction on the intr pin. otherwise, the intr pin defaults to interrupt function. table 674: spare control 2 register (address 1ch, shadow value 00100) bit field description init access 15 write enable ? 1 = write bits [9:0]. ? 0 = read bits [9:0]. 0r/w 14:10 shadow register selector 00100 = spare control 2 register. 00100 r/w 9:5 reserved write as 00h, ignore when read. 00h r/o 4:2 reserved write as 011, ignore when read. 011 r/o 1 energy detect on intr pin ? 1 = routes energy detect to interrupt signal. use led selectors (reg 1ch shadow 01101 and 01110) and program to intr mode. ? 0 = intr pin is interrupt function. 0r/w 0 reserved write as 0, ignore when read. 0 r/o www.datasheet.in bcm57xx programmer?s guide 01/29/08 broadcom corporation page 674 transceiver registers document 57xx-pg105-r this version of the register is applicable only to bcm5714 and bcm5715. spare control 3 this version of the register is only applicable to the bcm5705, bcm5721, bcm5751 and bcm5752. the following is enabled by register 1ch with shadow value in bits [14:10] = 00101. write enable during a write to this register, setting spare control 3 register bit 15 allows writing to bits [9:0] of this register. for rea ding the values of bits [9:0], perform an mdio write with bit 15 cleared and preferred shadow register values in bits [14:10]. the next mdio read of register address 1ch contains the preferred shadow register values in bits [9:0]. table 675: spare control 2 register (shadow register selector = 00100) bit field description init access 15 write enable ? 1 = write bits [9:0]. ? 0 = read bits [9:0]. 0r/w 14:10 shadow register selector shadow register selector 00100 r/w 9:8 reserved write as 0, ignore on read - r/w 7 test on bits 23:16 ? 1 = enable bits 23:16 of test output bus 0 r/w 6 disable phy a2 ? 1 = internally disable phya2 input (consult testability document for suggested usage) 0r/w 5 enable rbc0/1 & txc/rxc tristate ? 1 = enable tristating of rbc0/1 or txc/rxc ? 0 = rbc0/1 & txc/rxc not tristated 0r/w 4:2 wirespeed retry limit ? 000: downgrade after 2 failed link attempts ? 001: downgrade after 3 failed link attempts ... ? 111: downgrade after 9 failed link attempts 011 r/w 1 energy detect on intr pin ? 1 = routes energy detect to interrupt signal. use led selectors (reg 1c shadow 01101 and 01110) to direct interrupt signal to an led output. 0r/w 0 test on bits 7:0 ? 1 = enable low byte of test output bus (consult testability document for suggested usage) (aka. testonbyte7_0) 0r/w table 676: spare control 3 register (address 1ch, shadow value 00101) bit field description init access 15 write enable ? 1 = write bits [9:0]. ? 0 = read bits [9:0]. 0r/w 14:10 shadow register selector 00101 = spare control 3 register. 00101 r/w 9:2 reserved write as 03h, ignore when read. 03h r/w 1 clk125 auto power- down ? 1 = auto power-down of clk125 is disabled. ? 0 = auto power-down of clk125 is enabled. 1r/w 0 clk125 output ? 1 = enable clk125 output. ? 0 = disable clk125 output. 1r/w www.datasheet.in programmer?s guide bcm57xx 01/29/08 broadcom corporation document 57xx-pg105-r transceiver registers page 675 shadow register selector register bits [14:10] must be set to 00101 to enable read/write to the spare control 3 register. clk125 auto power down clearing this bit enables the auto power down of the clk125 output. this feature enables additional power savings. this feature should only be used during auto power-down mode. clk125 output setting this bit enables the clk125 output; clearing this bit disables the clk125 output. this version of the register is applicable only to bcm5714 and bcm5715. 1 table 677: 1ch: spare control 3 register (shadow register selector = 00100) bit field description init access 15 write enable ? 1 = write bits [9:0]. ? 0 = read bits [9:0]. 0r/w 14:10 shadow register selector shadow register selector 00101 r/w 9 dll lock enable during auto- power down 1 = allow time for dll to lock before enabling clocks & analog components. only applicable when dll is powered down during auto-power down (r1c.5 bit 1 is low). 0r/w 8 txc/rxc disable during auto- power down ? 1 = disable txc/rxc during auto-power down when there's no energy on the cable 0r/w 7 10base-t carrier reject filter enable ? 1 = enable 10bt 15mhz carrier rejection filter 0 r/w 6 txc off enable ? 1 = gates off txc output in 1000-base t mode 0 r/w 5 sd/energy detect change mux select ? 1 = interrupt based on energy detection (top level debounced energy detect change or filtered fiber signal detect change via en_10b pin) ? 0 = normal ipphone interrupt selected 0r/w 4 low power enc disable ? 1 = disable low power enc mode 1 r/w 3 disable low power 10base-t link mode ? 1 = disable low power 10base-t link mode 1 r/w 2 sigdet deassert timer lengthen ? 1 = 100tx sigdet deassert timer = 40 us ? 0 = sigdet deassert timer = 0.25 us 1r/w 1 auto-power down dll off disable ? 1 = disable powering down of the dll during auto- power down ? 0 = enable powering down of dll during auto-power down 1r/w 0 clk125 output enable ? 1 = enable clk125 output ? 0 = disable clk125 output 1r/w www.datasheet.in bcm57xx programmer?s guide 01/29/08 broadcom corporation page 676 transceiver registers document 57xx-pg105-r led status this register is only applicable to the bcm5705, bcm5721, bcm5751, bcm5752, bcm5714, and bcm5715. the following is enabled by register 1ch with shadow value in bits [14:10] = 01000. write enable during a write to this register, setting led status register bit 15 to a 1 allows writing to bits [7:0] of this register. for r eading the values of bits [9:0], perform an mdio write with bit 15 set to a 0 and preferred shadow values in bits [14:10]. the next mdio read of register address 1ch contains the preferred shadow register values in bits [9:0]. shadow register selector bits [14:10] of this register must be set to 01000 to enable read/write to the led status register. slave indicator when led status register bit 8 returns a 0, the device is in the slave mode. when this bit returns a 1, the device is not in the slave mode. fdx indicator when led status register bit 7 returns a 0, the device is in the full-duplex mode. when this bit returns a 1, the device is not in the full-duplex mode. table 678: led status register (address 1ch, shadow value 01000) bit field description init access 15 write enable ? 1 = write bits [9:0]. ? 0 = read bits [9:0]. 0r/w 14:10 shadow register selector 01000 = led status register. 01000 r/w 9 reserved write as 0, ignore when read. 0 r/w 8slave indicator ? 1 = master mode. ? 0 = slave mode. 0r/o 7fdx indicator ? 1 = half-duplex mode. ? 0 = full-duplex mode. 0r/o 6intr indicator ? 1 = no active interrupt. ? 0 = interrupt activated. 0r/o 5 reserved write as 0, ignore when read. 0 r/o 4:3 linkspd indicator ? 11 = no link established. ? 10 = 10base-t link established. ? 01 = 100base-tx link established. ? 00 = 1000base-t link established. 00 r/o 2 transmit indicator ? 1 = no transmit activity. ? 0 = transmit activity. 0r/o 1receive indicator ? 1 = not receive activity. ? 0 = receive activity. 0r/o 0 quality indicator ? 1 = quality is not good. ? 0 = quality is good. 0r/o www.datasheet.in programmer?s guide bcm57xx 01/29/08 broadcom corporation document 57xx-pg105-r transceiver registers page 677 intr indicator when led status register bit 6 returns a 0, the device is in the interrupted mode. when this bit returns a 1, the device is not in the interrupted mode. linkspd indicator when led status register bits 4:3 return a 00, the device is in the 1000base-tx link mode. when these bits return a 01, the device is in the 100base-tx link mode. when these bits return a 10, the device is in the 10base-t link mode. when these bits return an 11, the device is not linked. transmit indicator when led status register bit 2 returns a 0, the device is in the transmitting mode. when this bit returns a 1, the device is not in the transmitting mode. receive indicator when led status register bit 1 returns a 0, the device is in the receiving mode. when this bit returns a 1, the device is not in the receiving mode. quality indicator when led status register bit 0 returns a 0, the device is in the quality good mode. when this bit returns a 1, the device is not in the quality good mode. www.datasheet.in bcm57xx programmer?s guide 01/29/08 broadcom corporation page 678 transceiver registers document 57xx-pg105-r led control this register is only applicable to the bcm5705, bcm5721, bcm5751, bcm5752, bcm5714, and bcm5715. the following is enabled by register 1ch with shadow value in bits [14:10] = 01001. write enable during a write to this register, setting led control register bit 15 allows writing to bits [9:0] of this register. for reading the values of bits [9:0], perform an mdio write with bit 15 cleared and preferred shadow values in bits [14:10]. the next mdio read of register address 1ch contains the preferred shadow register values in bits [9:0]. shadow register selector led control register bits [14:10] of this register must be set to 01001 to enable read/write to the led control register 1ch. activity/link led enable setting led control register bit 4 drives activity/link data on activity led. activity led enable setting led control register bit 3 drives activity data on activity led. otherwise, it drives receive data on activity led. table 679: led control register (address 1ch, shadow value 01001) bit field description init access 15 write enable ? 1 = write bits [9:0]. ? 0 = read bits [9:0]. 0r/w 14:10 shadow register selector 01001 = led control register. 01001 r/w 9:6 reserved write as 00000, ignore when read. 00000 r/w 5 override gbic led mode (bcm5714 and bcm5715 only) ? 1 = leds not remapped in gbic mode. ? 0 = in gbic mode leds mapped as follows: - led1: rx_loss - led2: rx - led3: tx - led4: link 0r/w reserved (other devices) write as 0, ignore when read 0 r/o 4 activity/link led enable ? 1 = drive activity/link data on activity led. ? 0 = drive activity data on activity led. note: this bit overrides bit 3 below. 0r/w 3 activity led enable ? 1 = drive activity data on activity led. ? 0 = drive receive data on activity led. 1r/w 2 remote fault led enable ? 1 = drive remote fault on quality led. ? 0 = normal operation. 0r/w 1:0 link utilization led selector ? 00 = normal activity (fixed blink rate). ? 01 = transmit activity with variable blink rate. ? 10 = receive activity with variable blink rate. ? 11 = transmit/receive activity with variable blink rate. note: this mode has higher priority than the activity led enable mode in bit 3. 00 r/w www.datasheet.in programmer?s guide bcm57xx 01/29/08 broadcom corporation document 57xx-pg105-r transceiver registers page 679 remote fault led enable setting led control register bit 2 drives remote fault on quality led. link utilization led selector these bits apply to the led programmed to the activity mo de only. in the activity led mode, the led expresses an estimated activity in terms of blink rate. the blink rate of the led increases as the activity duty cycle increases by incremen ts of 10%. for duty cycles of 0.001 to10%, the led blinks at 3 hz; for duty cycles of 10% to 20%, the led blinks at 6 hz; and for duty cycles of 90% to 96%, the led blinks at 30 hz. even though the frequency of the led blink increases, the duty cycle of the led stays at about 50%. the activity led can be programmed to display the following: ? 00 = normal activity (fixed blink rate) ? 01 = transmit activity with variable blink rate ? 10 = receive activity with variable blink rate ? 11 = transmit/receive activity with variable blink rate auto power-down this register is only applicable to the bcm5705, bcm5721, bcm5751, bcm5752, bcm5714, and bcm5715. the following is enabled by register 1ch with shadow value in bits [14:10] = 01010. table 680: auto power-down register (address 1ch, shadow value 01010) bit field description init access 15 write enable ? 1 = write bits [9:0]. ? 0 = read bits [9:0]. 0r/w 14:10 shadow register selector 01010 = auto power down register. 01010 r/w 9:6 reserved write as 0h, ignore when read. 0h r/w 5 auto power down mode ? 1 = auto power down mode enabled. ? 0 = auto power down mode disabled. 0r/w 4 sleep timer select ? 1 = sleep timer is 5.4s. ? 0 = sleep timer is 2.7s. 0r/w 3:0 wakeup timer select counter for wakeup timer in units of 84 ms. ? 0001 = 84 ms. ? 0010 = 168 ms. ? ... ? 1111 = 1.26s. 0001 r/w www.datasheet.in bcm57xx programmer?s guide 01/29/08 broadcom corporation page 680 transceiver registers document 57xx-pg105-r write enable during a write to this register, setting auto power down register bit 15 allows writing to bits [9:0] of this register. for rea ding the values of bits [9:0], perform an mdio write with bit 15 cleared and preferred shadow values in bits [14:10]. the next mdio read of register address 1ch contains the preferred shadow register values in bits [9:0]. shadow register selector register bits [14:10] must be set to 01010 to enable read/write to the auto power down register address 1ch. auto power-down mode enable setting this bit enables the auto power-down mode. sleep timer select setting this bit changes the wakeup time leaving auto power-down mode. wakeup timer select the port continues wakeup mode for a time based on the count stored in this register. the minimum value is 84 ms and the maximum value is 1.26s. this only applies when the part is in auto power-down mode. www.datasheet.in programmer?s guide bcm57xx 01/29/08 broadcom corporation document 57xx-pg105-r transceiver registers page 681 led selector 1 this register is only applicable to the bcm5705, bcm5721, bcm5751, bcm5752, bcm5714, and bcm5715. the following is enabled by register 1ch with shadow value in bits [14:10] = 01101. table 681: led selector 1 register (address 1ch, shadow value 01101) bit field description init access 15 write enable ? 1 = write bits [9:0]. ? 0 = read bits [9:0]. 0r/w 14:10 shadow register selector 01101 = led selector 1 register. 01101 r/w 9:8 reserved write as 00, ignore when read. 00 r/w 7:4 led2 selector ? 0000 = linkspd[1] ? 0001 = linkspd[2] ? 0010 = xmitled ? 0011 = activity ? 0100 = fdxled ? 0101 = slave ? 0110 = intr ? 0111 = quality ? 1000 = rcvled ? 1001 = reserved ? 1010 = multicolor[2] ? 1011 = openshort ? 1100 = energylnk ? 1101 and 1110 = off (high) ? 1111 = on (low) 0001 r/w 3:0 led1 selector ? 0000 = linkspd[1] ? 0001 = linkspd[2] ? 0010 = xmitled ? 0011 = activity ? 0100 = fdxled ? 0101 = slave ? 0110 = intr ? 0111 = quality ? 1000 = rcvled ? 1001 = reserved ? 1010 = multicolor[1] ? 1011 = openshort ? 1100 = energylnk ? 1101 and 1110 = off (high) ? 1111 = on (low) 0000 r/w www.datasheet.in bcm57xx programmer?s guide 01/29/08 broadcom corporation page 682 transceiver registers document 57xx-pg105-r write enable during a write to this register, setting led selector 1 register bit 15 to a 1 allows writing to bits [7:0] of this register. f or reading the values of bits [9:0], perform an mdio write with bit 15 set to a 0 and preferred shadow values in bits [14:10]. the next mdio read of register address 1ch contains the preferred shadow register values in bits [9:0]. shadow register selector bits [14:10] of this register must be set to 01101 to enable read/write to the led selector register 1 address 1ch. led2 selector bits [7:4] of mii register 1ch with shadow value 01101 select the led2 output mode. led1 selector bits [3:0] of mii register 1ch with shadow value 01101 select the led1 output mod. led selector 2 this register is only applicable to the bcm5705, bcm5721, bcm5751, bcm5752, bcm5714, and bcm5715. the following is enabled by register 1ch with shadow value in bits [14:10] = 01110. table 682: led selector 2 register (address 1ch, shadow value 01110) bit field description init access 15 write enable ? 1 = write bits [9:0]. ? 0 = read bits [9:0]. 0r/w 14:10 shadow register selector 01110 = led selector 2 register. 01110 r/w 9:8 reserved write as 00, ignore when read. 00 r/w 7:4 led4 selector ? 0000 = linkspd[1] ? 0001 = linkspd[2] ? 0010 = xmitled ? 0011 = activity ? 0100 = fdxled ? 0101 = slave ? 0110 = intr ? 0111 = quality ? 1000 = rcvled ? 1001 = reserved ? 1010 = multicolor[2] ? 1011 = openshort ? 1100 = energylnk ? 1101 and 1110 = off (high) ? 1111 = on (low) 0110 r/w www.datasheet.in programmer?s guide bcm57xx 01/29/08 broadcom corporation document 57xx-pg105-r transceiver registers page 683 write enable during a write to this register, setting led selector 2 register bit 15 to a 1 allows writing to bits [7:0] of this register. f or reading the values of bits [9:0], perform an mdio write with bit 15 set to a 0 and preferred shadow values in bits [14:10]. the next mdio read of register address 1ch contains the preferred shadow register values in bits [9:0]. shadow register selector bits [14:10] of this register must be set to 01110 to enable read/write to the led selector register 2 address 1ch. led4 selector bits [7:4] of mii register 1ch with shadow value 01110 select the led2 output mode. led3 selector bits [3:0] of mii register 1ch with shadow value 01110 select the led1 output mode. 3:0 led3 selector ? 0000 = linkspd[1] ? 0001 = linkspd[2] ? 0010 = xmitled ? 0011 = activity ? 0100 = fdxled ? 0101 = slave ? 0110 = intr ? 0111 = quality ? 1000 = rcvled ? 1001 = reserved ? 1010 = multicolor[1] ? 1011 = openshort ? 1100 = energylnk ? 1101 and 1110 = off (high) ? 1111 = on (low) 0011 r/w table 682: led selector 2 register (address 1ch, shadow value 01110) (cont.) bit field description init access www.datasheet.in bcm57xx programmer?s guide 01/29/08 broadcom corporation page 684 transceiver registers document 57xx-pg105-r led gpio control/status this register is only applicable to the bcm5705, bcm5721, bcm5751, bcm5752, bcm5714, and bcm5715. the following is enabled by register 1ch with shadow value in bits [14:10] = 01111. write enable during a write to this register, setting led gpio control/status register bit 15 allows writing to bits [9:0] of this register. for reading the values of bits [9:0], perform an mdio write with bit 15 cleared and preferred shadow values in bits [14:10]. the next mdio read of register address 1ch contains the preferred shadow register values in bits [9:0]. shadow register selector led gpio control/status register bits [14:10] must be set to 01111 to enable read/write to the led gpio control/status register 1ch. led i/o status led gpio control/status register bits [7:4] read back the status of the led pin. programmable led i/o control setting led gpio control/status register bits [3:0] set the led pin to disable led output. clearing led gpio control/status register bits [3:0] set the led pin to enable led output. table 683: led gpio control/status register (address 1ch, shadow value 01111) bit field description init access 15 write enable ? 1 = write bits [9:0]. ? 0 = read bits [9:0]. 0r/w 14:10 shadow register selector 01111 = led gpio control/status register. 01111 r/w 9:8 reserved write as 00, ignore when read. 00 r/w 7:4 led i/o status ? bit 7 = led4 pin status. ? bit 6 = led3 pin status. ? bit 5 = led2 pin status ? bit 4 = led1 pin status. ? 1 = led pin is an input. ? 0 = led pin is an output. 0h r/o 3:0 programmable led i/o control ? bit 3 = led4 pin control. ? bit 2 = led3 pin control. ? bit 1 = led2 pin control. ? bit 0 = led1 pin control. ? 1 = disable led output enable. ? 0 = enable led output enable. 0h r/w www.datasheet.in programmer?s guide bcm57xx 01/29/08 broadcom corporation document 57xx-pg105-r transceiver registers page 685 autodetect sgmii/media converter this register is only applicable to the bcm5705, bcm5721, bcm5751, bcm5752, bcm5714, and bcm5715. the following is enabled by register 1ch with shadow value in bits [14:10] = 11000. write enable during a write to this register, setting autodetect sgmii/media converter register bit 15 allows writing to bits [9:0] of this register. for reading the values of bits [9:0], perform an mdio write with bit 15 cleared and preferred shadow values in bits [14:10]. the next mdio read of register address 1ch contains the preferred shadow register values in bits [9:0]. shadow register selector register bits [14:10] of this register must be set to 11000 to enable read/write to the autodetect sgmii/media converter address 1ch. serdes resolution fault bit 9 of the auto-detect sgmii/media converter register indicates there is a selected field mismatch on bit 0 of the base page word. otherwise, it reads a 0. sgmii/media converter autodetect mode enable setting bit 0 of the auto-detect sgmii/media converter register enable the sgmii/media converter autodetect mode. otherwise, it is in the normal mode. table 684: autodetect sgmii/media converter register (address 1ch, shadow value 11000) bit field description init access 15 write enable ? 1 = write bits [9:0]. ? 0 = read bits [9:0]. 0r/w 14:10 shadow register selector 11000 = autodetect sgmii/media converter register. 11000 r/w 9 serdes resolution fault ? 1 = selected field mismatch. ? 0 = no mismatch or sgmii/media converter autodetect mode is disabled. 0r/o 8:3 reserved write as 00h, ignore when read. 00h r/o 2 1000t pcs transmit fifo elasticity (bcm5714 and bcm5715 only) ? 1 = support jumbo packets ? 0 = low elasticity (low latency) 1r/w reserved (other devices) write as 0, ignore when read 0 r/o 1 sgmii 10/100 rx fifo frequency lock mode (bcm5714 and bcm5715 only) ? 1 = sgmii rx fifo will assume that the serdes- recovered clock and the local clock are frequency locked. this will essentially bypass the fifo with the lowest possible latency in 10/100 speeds (useful for applications where the mac/switch and phy are using the same crystal) ? 0 = normal operation 0r/w reserved (other devices) write as 0, ignore when read 0 r/o 0 sgmii/media converter autodetect mode enable ? 1 = enable sgmii/media converter autodetect mode. ? 0 = normal operation. intf_se l[3] and rxcdly r/w www.datasheet.in bcm57xx programmer?s guide 01/29/08 broadcom corporation page 686 transceiver registers document 57xx-pg105-r 1000base-x auto-negotiation debug this register is only applicable to the bcm5705, bcm5721, bcm5751, bcm5752, bcm5714, and bcm5715. the following is enabled by register 1ch with shadow value in bits [14:10] = 11010. write enable during a write to this register, setting led 1000base-x auto-negotiation debug register bit 15 to a 1 allows writing to bits [7:0] of this register. for reading the values of bits [9:0], perform an mdio write with bit 15 set to a 0 and preferred shadow values in bits [14:10]. the next mdio read of register address 1ch contains the preferred shadow register values in bits [9:0]. shadow register selector bits [14:10] of this register must be set to 11010 to enable read/write to the 1000base-x auto-negotiation debug register. consistency mismatch bit 9 of 1000base-x auto-negotiation debug register indicates a consistency mismatch occurred since last read. table 685: 1000base-x auto-negotiation debug register (address 1ch, shadow value 11010) bit field description init access 15 write enable ? 1 = write bits [9:0]. ? 0 = read bits [9:0]. 0r/w 14:10 shadow register selector 11010 = 1000base-x auto-negotiation debug register. 11010 r/w 9 consistency mismatch ? 1 = consistency mismatch occurred since last read. ? 0 = no consistency mismatch occurred since last read. 0r/o lh 8 rudi invalid ? 1 = rudi invalid detected since last read. ? 0 = no rudi invalid detected since last read. 0r/o lh 7 comma detected ? 1 = comma detected since last read. ? 0 = no comma detected since last read. 0r/o lh 6 an_sync_status ? 1 = an_sync_status has not failed since last read. ? 0 = an_sync_status failed since last read. 0r/o lh 5 idle detect state ? 1 = idle detect state entered since last read. ? 0 = idle detect state has not been entered since last read. 0r/o lh 4 complete acknowledge state ? 1 = complete acknowledge state entered since last read. ? 0 = complete acknowledge state has not been entered since last read. 0r/o lh 3 acknowledge detect state ? 1 = acknowledge detect state entered since last read. ? 0 = acknowledge detect state has not been entered since last read. 0r/o lh 2 ability detect state ? 1 = ability detect state entered since last read. ? 0 = ability detect state has not been entered since last read. 0r/o lh 1 error state ? 1 = error state entered since last read. ? 0 = error state has not been entered since last read. 0r/o lh 0 an_enable state ? 1 = an_enable state entered since last read. ? 0 = an_enable state has not been entered since last read. 0r/o lh www.datasheet.in programmer?s guide bcm57xx 01/29/08 broadcom corporation document 57xx-pg105-r transceiver registers page 687 rudi invalid bit 8 of 1000base-x auto-negotiation debug register indicates a rudi (rx_unitdata indicate, specified in ieee 36.2.5.1.6) invalid detected since last read. comma detected bit 7 of 1000base-x auto-negotiation debug register indicates a comma was detected since last read. an_sync_status bit 6 of 1000base-x auto-negotiation debug register indicates the an_sync_status has not failed since last read. idle detect state bit 5 of 1000base-x auto-negotiation debug register indicates the idle detect state entered since last read. complete acknowledge state bit 4 of 1000base-x auto-negotiation debug register indicates the complete acknowledge state entered since last read. acknowledge detect state bit 3 of 1000base-x auto-negotiation debug register indicates the acknowledge detect state entered since last read. ability detect state bit 2 of 1000base-x auto-negotiation debug register indicates the ability detect state entered since last read. error state bit 1 of 1000base-x auto-negotiation debug register indicates the error state entered since last read. an_enable state bit 0 of 1000base-x auto-negotiation debug register indicates the an_enable state entered since last read. www.datasheet.in bcm57xx programmer?s guide 01/29/08 broadcom corporation page 688 transceiver registers document 57xx-pg105-r auxiliary 1000base-x control this register is only applicable to the bcm5705, bcm5721, bcm5751, bcm5752, bcm5714, and bcm5715. the following is enabled by register 1ch with shadow value in bits [14:10] = 11011. table 686: auxiliary 1000base-x control register (address 1ch, shadow value 11011) bit field description init access 15 write enable ? 1 = write bits [9:0]. ? 0 = read bits [9:0]. 0r/w 14:10 shadow register selector 11011 = auxiliary 1000base-x control register. 11011 r/w 9 use serdes mode counters ? 1 = use registers 12?14h for serdes data. ? 0 = normal operation. 0r/w 8 autoneg fast timers (bcm5714 and bcm5715 only) ? 1 = speed up link_timer for test vectors (1.6 us sgmii; 9.84 us ieee) ? 0 = normal operation 0r/w reserved (other devices) write as 0, ignore when read 0 r/o 7 jam false carrier mode (bcm5714 and bcm5715 only) ? 1 = send packet with txen, txer, txd=55h for duration of false carrier in sgmii/gbic half-duplex mode ? 0 = ignore false carriers in sgmii/gbic mode 1r/w reserved (other devices) write as 0, ignore when read 0 r/o 6 disable carrier extend (bcm5714 and bcm5715 only) 1 = force rxer, rxd to zeros in trr+extend state (pcs receive state) 0r/w reserved (other devices) write as 0, ignore when read 0 r/o 5 disable trrr (bcm5714 and bcm5715 only) ? 1 = bypass extend_by_1 state (pcs transmit state) ? 0 = normal operation 0r/w reserved (other devices) write as 0, ignore when read 0 r/o 4 disable remote fault sensing ? 1 = disable automatic remote fault sensing of auto- negotiation resolution error. ? 0 = normal operation. 0r/w 3 autoneg error timer enable (bcm5714 and bcm5715 only) ? 1 = enable autoneg error timer (error state entered when error timer expires in ability_detect, acknowledge_detect, or idle_detect state) ? 0 = normal operation 0r/w reserved (other devices) write as 0, ignore when read 0 r/o 2 comma detect enable ? 1 = enable comma detection. ? 0 = disable comma detection. 1r/w 1 fifo elasticity ? 1 = high elasticity to support jumbo packets (supports 10/100/1000 jumbo packets). ? 0 = low elasticity (low latency). 1r/w 0 disable crc checker ? 1 = disable crc checker. ? 0 = enable crc checker. 1r/w www.datasheet.in programmer?s guide bcm57xx 01/29/08 broadcom corporation document 57xx-pg105-r transceiver registers page 689 write enable during a write to this register, setting auxiliary 1000base-x control register 2 bit 15 to a 1 allows writing to bits [7:0] of this register. for reading the values of bits [9:0], perform an mdio write with bit 15 set to a 0 and preferred shadow values in bit s [14:10]. the next mdio read of register address 1ch contains the preferred shadow register values in bits [9:0]. shadow register selector bits [14:10] of this register must be set to 11011 to enable read/write to the auxiliary 1000base-x control register. use serdes mode counters setting bit 9 of the auxiliary 1000base-x control register enables serdes data to be presented on register 12h?14h. disable remote fault sensing setting bit 4 of the auxiliary 1000base-x control register disables automatic remote fault sensing of an auto-negotiation resolution error. comma detect enable setting bit 2 of auxiliary 1000base-x control register enables comma detection. fifo elasticity setting bit 1 of auxiliary 1000base-x control register enables 10/100/1000 mbps jumbo packet reception while in sgmii mode. in this mode, the bcm57xx can transmit packets up to 9 kb in length. when this bit is cleared, the fifo elasticity is set to low latency. in this mode, the bcm57xx can transmit packets up to 4.5 kb in length. disable crc checker setting bit 0 of auxiliary 1000base-x control register disables the crc checker. www.datasheet.in bcm57xx programmer?s guide 01/29/08 broadcom corporation page 690 transceiver registers document 57xx-pg105-r auxiliary 1000base-x status this register is only applicable to the bcm5705, bcm5721, bcm5751, bcm5752, bcm5714, and bcm5715. the following is enabled by register 1ch with shadow value in bits [14:10] = 11100. write enable during a write to this register, setting auxiliary 1000base-x status register bit 15 allows writing to bits [9:0] of this regis ter. for reading the values of bits [9:0], perform an mdio write with bit 15 cleared and preferred shadow values in bits [14:10]. the next mdio read of register address 1ch contains the preferred shadow register values in bits [9:0]. shadow register selector bits [14:10] of this register must be set to 11100 to enable read/write to the auxiliary 1000base-x status register link status change bit 9 of auxiliary 1000base-x status register indicates that the link status has changed since the last register read. table 687: auxiliary 1000base-x status register (address 1ch, shadow value 11100) bit field description init access 15 write enable ? 1 = write bits [9:0]. ? 0 = read bits [9:0]. 0r/w 14:10 shadow register selector 11100 = auxiliary 1000base-x status register. 11100 r/w 9 link status change ? 1 = link status change has occurred since last read. ? 0 = link status change has not occurred since last read. 0r/o lh 8 sgmii selector mismatch ? 1 = sgmii selector mismatch in sgmii mode. ? 0 = serdes, copper, gbic mode, or sgmii selector does not mismatch, or auto-negotiation is disabled. 0r/o 7 auto-negotiation resolution error ? 1 = auto-negotiation hcd is none (no common half- duplex or full-duplex abilities). ? 0 = sgmii mode, or auto-negotiation disabled, or no resolution error. 0r/o 6:5 link partner remote fault ? reflects 1000base-x register 05h [13:12]. ? 00 = no remote fault. ? 10 = off line. ? 01 = link fault. ? 11 = auto-negotiation error. 00 r/o 4 auto-negotiation page received ? 1 = page has been received since last read. ? 0 = page has not been received since last read. 0r/o lh 3 current operating duplex mode ? 1 = phy is operating in full-duplex mode. ? 0 = phy is operating in half-duplex mode (or auto-negotiation has not completed). 0r/o 2link status ? 1 = link is up on serdes side. ? 0 = link is down on serdes side. 0r/o 1 pause resolution?receive side ? 1 = enable pause receive. ? 0 = disable pause receive. 0r/o 0 pause resolution? transmit side ? 1 = enable pause transmit. ? 0 = disable pause transmit. 0r/o www.datasheet.in programmer?s guide bcm57xx 01/29/08 broadcom corporation document 57xx-pg105-r transceiver registers page 691 sgmii selector mismatch bit 8 of auxiliary 1000base-x status register indicates an sgmii selector mismatch in sgmii mode. auto-negotiation resolution error bit 7 of auxiliary 1000base-x status register indicates auto-negotiation hcd is none (no common half-duplex or full-duplex abilities). link partner remote fault bits 6 and 5 of auxiliary 1000base-x status register indicates the link partner remote fault status reflected from 1000base- x register 05h bits 13:12. auto-negotiation page received bit 4 of auxiliary 1000base-x status register indicates auto-negotiation page has been received since last read. current operating duplex mode bit 3 of auxiliary 1000base-x status register indicates the phy is operating in full-duplex mode. link status bit 2 of auxiliary 1000base-x status register indicates the phy link is up on the serdes side. pause resolution?receive side bit 1 of auxiliary 1000base-x status register indicates receive pause resolution. pause resolution?transmit side bit 0 of auxiliary 1000base-x status register indicates transmit pause resolution. www.datasheet.in bcm57xx programmer?s guide 01/29/08 broadcom corporation page 692 transceiver registers document 57xx-pg105-r miscellaneous 1000base-x status this register is only applicable to the bcm5705, bcm5721, bcm5751, bcm5752, bcm5714, and bcm5715. the following is enabled by register 1ch with shadow value in bits [14:10] = 11101. write enable during a write to this register, setting misc 1000base-x status register bit 15 allows writing to bits [9:0] of this register. for reading the values of bits [9:0], perform an mdio write with bit 15 cleared and preferred shadow values in bits [14:10]. the next mdio read of register address 1ch contains the preferred shadow register values in bits [9:0]. shadow register selector register bits [14:10] must be set to 11101 to enable read/write to the misc 1000base-x status register. table 688: miscellaneous 1000base-x status register (address 1ch, shadow value 11101) bit field description init access 15 write enable ? 1 = write bits [9:0]. ? 0 = read bits [9:0]. 0r/w 14:10 shadow register selector 11101 = misc 1000base-x status register. 11101 r/w 9 tx fifo error ? 1 = transmit fifo error since last read. ? 0 = no transmit fifo error since last read. 0 r/o lh 8 rx fifo error ? 1 = receive fifo error since last read. ? 0 = no receive fifo error since last read. 0 r/o lh 7 bad fifo pointer (bcm5714 and bcm5715 only) ? 1 = fifo pointer all zeros since last read ? 0 = bad fifo pointer has not occurred since 0 r/o lh reserved (other devices) write as 0, ignore when read 0 r/o 6 false carrier jammed (bcm5714 and bcm5715 only) ? 1 = false carrier jammed in sgmii/gbic mode since last read ? 0 = no false carrier jammed or mode is disabled via register 1ch shadow 27 [7] 0 r/o lh reserved (other devices) write as 0, ignore when read 0 r/o 5 false carrier detected ? 1 = false carrier detected since last read. ? 0 = no false carriers detected since last read. 0r/o lh 4 crc error detected ? 1 = crc error detected since last read. ? 0 = no crc error detected since last read or mode is disabled via register 1ch, shadow 11011, bit 0. 0r/o lh 3 transmit error detected ? 1 = transmit error code detected since last read (rx_data_error state in pcs receive). ? 0 = no transmit error code detected since last read. 0r/o lh 2 receive error detected ? 1 = receive error since last read (early_end state in pcs receive). ? 0 = no receive error since last read. 0r/o lh 1 carrier extend error detected ? 1 = carrier extend error since last read (extend_err state in pcs receive). ? 0 = no carrier extend error since last read. 0r/o lh 0 early end extension detected ? 1 = early end extension since last read (early_end_ext state in pcs receive). ? 0 = no early end extension since last read. 0r/o lh www.datasheet.in programmer?s guide bcm57xx 01/29/08 broadcom corporation document 57xx-pg105-r transceiver registers page 693 tx fifo error bit 9 of misc 1000base-x status register indicates a transmit fifo error since the last read. rx fifo error bit 8 of misc 1000base-x status register indicates a receive fifo error since the last read. false carrier detected bit 5 of misc 1000base-x status register indicates a false carrier detected since the last read. crc error detected bit 4 of misc 1000base-x status register indicates a crc error detected since the last read. transmit error detected bit 3 of misc 1000base-x status register indicates a transmit error code detected since the last read. receive error detected bit 2 of misc 1000base-x status register indicates a receive error code detected since the last read. carrier extend error detected bit 1 of misc 1000base-x status register indicates a carrier extend error since the last read. early end extension detected bit 0 of misc 1000base-x status register indicates an early end extension since the last read. www.datasheet.in bcm57xx programmer?s guide 01/29/08 broadcom corporation page 694 transceiver registers document 57xx-pg105-r autodetect medium this register is only applicable to the bcm5705, bcm5721, bcm5751, bcm5752, bcm5714, and bcm5715. the following is enabled by register 1ch with shadow value in bits [14:10] = 11110. write enable during a write to this register, setting the autodetect medium register bit 15 allows writing to bits [9:0] of this register. f or reading the values of bits [9:0], perform an mdio write with bit 15 cleared and preferred shadow values in bits [14:10]. the next mdio read of register address 1ch contains the preferred shadow register values in bits [9:0]. shadow register selector register bits [14:10] of this register must be set to 11110 to enable read/write to the autodetect medium register. table 689: autodetect medium register (address 1ch, shadow value 11110) bit field description init access 15 write enable ? 1 = write bits [9:0]. ? 0 = read bits [9:0]. 0r/w 14:10 shadow register selector 11110 = autodetect medium register. 11110 r/w 9 reserved write as 0, ignore when read 0 r/o 8 invert signal detect from pin (bcm5714 and bcm5715 only) 1 = invert serdes signal detect from pin 0 = normal operation (active high pin) 0r/w reserved (other devices) write as 0, ignore when read 0 r/o 7 serdes in-use led mode ? 1 = drive transmit led active low when serdes is selected, inactive when copper selected. ? 0 = normal transmit led operation. not intf_sel[3] r/w 6 serdes led mode ? 1 = use serdes transmit, receive, and link for leds whenever serdes mode is selected via register 1ch, shadow 11111, bits [2:1]. ? 0 = always use copper transmit, receive, and link for leds regardless of the mode selected. intf_sel[2] and not intf_sel[3] r/w 5 qualify serdes signal detect (bcm5714 and bcm5715 only) ? 1 = serdes signal detect from pin is anded with sync status ? 0 = normal operation 0r/w reserved (other devices) write as 1, ignore when read 0 r/o 4 serdes auto power down mode 1 = power down serdes when filtered signal detect is inactive. 0 = normal operation. 0r/w 3 power down inactive interface 1 = power down serdes when copper is selected; power down copper when serdes is selected. 0 = normal operation. 0r/w 2 autodetect media default 1 = serdes selected when no medium is active. 0 = copper selected when no medium is active. 0r/w 1 autodetect medium priority 1 = serdes selected when both media are active. 0 = copper selected when both media are active. 1r/w 0 autodetect medium enable 1 = enable autodetect medium. 0 = disable autodetect medium. 0r/w www.datasheet.in programmer?s guide bcm57xx 01/29/08 broadcom corporation document 57xx-pg105-r transceiver registers page 695 serdes in-use led mode bit 7 of the autodetect medium register drives the transmit led active low when serdes is selected; inactive when copper is selected. serdes led mode bit 6 of the autodetect medium register enables the use serdes transmit, receive, and link for leds whenever serdes mode is selected via register 1ch, shadow 11111, bits [2:1]. serdes auto power down mode bit 4 of the autodetect medium register enables the power down of serdes when the filtered signal detect is inactive. power down inactive interface bit 3 of the autodetect medium register enables the power down of serdes when copper is selected, and power down of copper when serdes is selected. autodetect media default bit 2 of the autodetect medium register enables the selecti on of serdes as default medium when no medium is active. clearing this bit sets copper as the default medium. autodetect media priority bit 1 of the autodetect medium register enables the selection of serdes priority when both media are active. clearing this bit sets copper as the default medium selection. autodetect media enable bit 0 of the autodetect medium register enables the autodetect media function. www.datasheet.in bcm57xx programmer?s guide 01/29/08 broadcom corporation page 696 transceiver registers document 57xx-pg105-r mode control this register is only applicable to the bcm5705, bcm5721, bcm5751, bcm5752, bcm5714, and bcm5715. the following is enabled by register 1ch with shadow value in bits [14:10] = 11111. write enable during a write to this register, setting mode control register bit 15 allows writing to bits [9:0] of this register. for readin g the values of bits [9:0], perform an mdio write with bit 15 cleared and preferred shadow values in bits [14:10]. the next mdio read of register address 1ch contains the preferred shadow register values in bits [9:0]. shadow register selector register bits [14:10] of this register must be set to 11111 to enable read/write to the mode control register address 1ch. table 690: mode control register (address 1ch, shadow value 11111) bit field description init access 15 write enable ? 1 = write bits [9:0]. ? 0 = read bits [9:0]. 0r/w 14:10 shadow register selector 11111 = mode control register. 11111 r/w 9 reserved write as 0, ignore when read. 0 r/o 8 mode select change ? 1 = interface mode select status changed since last read. ? 0 = interface mode select status did not change since last read. 0r/o lh 7 copper link ? 1 = link is good on the copper interface. ? 0 = copper link is down. 0r/o 6 serdes link ? 1 = link is good on the serdes interface. ? 0 = serdes link is down. 0r/o 5 copper energy detect ? 1 = energy detected on the copper interface. ? 0 = energy not detected on the copper interface. 0r/o 4 signal detect (serdes mode) ? 1 = filtered energy detected on the serdes interface. ? 0 = energy not detected on the serdes interface. 0r/o 3 serdes capable (bcm5714 and bcm5715 only) ? 1 = serdes capable device ? 0 = not serdes capable device 0r/o reserved (other devices) write as 1, ignore when read 0 r/o 2:1 mode select ? 00 = copper ? 01 = serdes ? 10 = sgmii ? 11 = media converter intf_sel[3:2] r/w 0 enable 1000base-x registers ? 1 = select 1000base-x registers for addresses 00h?0fh. ? 0 = select copper registers for addresses 00h?0fh. intf_sel[3:2] = 01 r/w www.datasheet.in programmer?s guide bcm57xx 01/29/08 broadcom corporation document 57xx-pg105-r transceiver registers page 697 mode select change bit 8 of the mode control register indicates that there is change in the interface mode selection. otherwise, it reads a 0. copper link bit 7 of the mode control register indicates that the link status of the copper interface is up. otherwise, it reads a 0. serdes link bit 6 of the mode control register indicates the link status of the serdes interface is up. otherwise, it reads a 0. copper energy detect bit 5 of the mode control register indicates that energy is detected in the copper interface. otherwise, it reads a 0. signal detect (serdes mode) bit 4 of the mode control register indicates that signal energy is detected in the serdes interface. otherwise, it reads a 0. mode select bits 2:1 of the mode control register select one of the four available interfaces. enable 1000base-x registers setting bit 0 of the mode control register enables the 1000base-x register set for addresses 00h?0fh. clearing bit 0 of the mode control register enables the copper register set for addresses 00h?0fh. www.datasheet.in bcm57xx programmer?s guide 01/29/08 broadcom corporation page 698 transceiver registers document 57xx-pg105-r hcd s tatus r egister (phy_a ddr = 0 x 1, r eg _a ddr = 1d h , b it 15 = 1) table 691: hcd status register (phy_addr = 0x1, reg_addr = 1dh, bit 15 = 1) bit field description init access 15 enable shadow register ? 1 = select shadow register. ? 0 = normal operation. 0r/w 14 wirespeed disable gigabit advertising (bcm5714 and bcm5715 only) 1 = disable advertising gigabit 0 = advertise gigabit based on register 9 0r/o reserved (other devices) write as 0, ignore when read 0 r/o 13 wirespeed disable 100tx (bcm5714 and bcm5715 only) ? 1 = disable advertising 100b-tx ? 0 = advertise 100b-tx based on register 4 0r/o reserved (other devices) write as 0, ignore when read 0 r/o 12 reserved (bcm5705, bcm5721, and bcm5751 only) wire speed downgrade (other devices) ? 1 = wire speed down grade occurred since last read. ? 0 = wire speed down grade cleared. 0r/o lh 11 hcd 1000base-t fdx ? 1 = gigabit full-duplex occurred since last read. ? 0 = hcd cleared. 0r/o lh 10 hcd 1000base-t ? 1 = gigabit half-duplex occurred since last read. ? 0 = hcd cleared. 0r/o 9 hcd 100base-t fdx ? 1 = 100base-tx full-duplex occurred since last read. ? 0 = hcd cleared. 0r/o lh 8 hcd 100base-t ? 1 = 100base-tx half-duplex occurred since last read. ? 0 = hcd cleared. 0r/o lh 7 hcd 10base-t fdx ? 1 = 10 base-t full-duplex occurred since last read. ? 0 = hcd cleared. 0r/o lh 6 hcd 10base-t ? 1 = 10 base-t half-duplex occurred since last read. ? 0 = hcd cleared. 5 hcd 1000base-t fdx (link never came up) ? 1 = gigabit full-duplex hcd and link never came up occurred since last read. ? 0 = hcd cleared. 0r/o lh 4 hcd 1000base-t (link never came up) ? 1 = gigabit half-duplex hcd and link never came up occurred since last read. ? 0 = hcd cleared. 0r/o lh 3 hcd 100base-t fdx (link never came up) ? 1 = 100base-tx full-duplex hcd and link never came up occurred since last read. ? 0 = hcd cleared. 0r/o lh 2 hcd 100base-t (link never came up) ? 1 = 100base-tx half-duplex hcd and link never came up occurred since last read. ? 0 = hcd cleared. 0r/o lh 1 hcd 10base-t fdx (link never came up) ? 1 = 10base-t full-duplex hcd and link never came up occurred since last read full-duplex. ? 0 = hcd cleared. 0r/o lh www.datasheet.in programmer?s guide bcm57xx 01/29/08 broadcom corporation document 57xx-pg105-r transceiver registers page 699 m aster /s lave s eed r egister (phy_a ddr = 0 x 1, r eg _a ddr = 1d h , b it 15 = 0) 0 hcd 10base-t (link never came up) ? 1 = 10base-t half-duplex hcd and link never came up occurred since last read. ? 0 = hcd cleared. 0r/o lh table 692: master/slave seed register (phy_addr = 0x1, reg_addr = 1dh, bit 15 = 0) bit name description init access 15 enable shadow register ? 1 = select shadow register. ? 0 = normal operation. 0r/w 14 master/slave speed match ? 1 = seeds match. ? 0 = seeds don't match. 0 r/o, lh 13 link partner repeater/dte bit ? 1 = link partner is a repeater/switch device port. ? 0 = link partner is a dte device port. 0r/o 12 link partner manual m/s config value ? 1 = link partner is configured as master. ? 0 = link partner is configured as slave. 0r/o 11 link partner manual m/s config enable ? 1 = link partner manual master/slave configuration enabled. ? 0 = link partner manual master/slave configuration disabled. 0r/o 10:0 local master/slave seed value returns the automatically generated master/slave random seed. 000h r/w table 691: hcd status register (phy_addr = 0x1, reg_addr = 1dh, bit 15 = 1) (cont.) bit field description init access www.datasheet.in bcm57xx programmer?s guide 01/29/08 broadcom corporation page 700 transceiver registers document 57xx-pg105-r phy t est r egister 1 (phy_a ddr = 0x1, reg_a ddr = 1eh) this version of the register is applicable to bcm5714 and bcm5715 only. table 693: phy test register 1 (phy_addr = 0x1, reg_addr = 1eh) bit name description init access 15 crc error count visibility ? 1 = receiver not_ok counters merged into one 16 bit counter to count crc errors instead (crc errors will only be counted after this bit is set) ? 0 = normal operation 0r/w 14 transmit error code visibility ? 1 = false carrier sense counter counts packets received with transmit error codes instead (errors will only be counted after this bit is set) ? 0 = normal operation 0r/w 13 counter test mode ? 1 = forces counters into test mode ? 0 = normal operation 0r/w 12 force link ? 1 = force link state machine into pass state ? 0 = normal operation 0r/w 11 force lock ? 1 = force descrambler into locked state ? 0 = normal operation 0r/w 10 scrambler test ? 1 = speed up descrambler unlock detect timer ? 0 = normal operation 0r/w 9 external link ? 1 = use tpin11 input as link status ? 0 = normal operation 0r/w 8fast timers ? 1 = timers are sped up for lsi test ? 0 = normal operation 0r/w 7 manual swap mdi state ? 1 = swap ? 0 = off 0r/w 6 receive watchdog timer disable ? 1 = watchdog timer disabled ? 0 = reset receive pmd when descrambler can't lock within 730us of link or lock loss. 0r/w 5 disable polarity encode ? 1 = disable 1000base-t polarity encoding ? 0 = normal operation 0r/w 4 enable software trim setting (main dac) ? 1 = use software trim setting ? 0 = use hardware trim setting note: 1) register setting from slice1 is used to control main dac trim. 2) register setting from slice2 is used to control hybrid dac trim. 0r/w 3:0 trim[3:0] (main dac) software trim setting note: only slice1 register setting is used. 2) bit 1 from trim pad is inverted 0r/w www.datasheet.in programmer?s guide bcm57xx 01/29/08 broadcom corporation document 57xx-pg105-r transceiver registers page 701 this version of the register is applicable to rest of the netxtreme family. phy t est r egister 2 (phy_addr = 0x1, reg_addr = 1fh) this register is applicable to the bcm5714 and bcm5715. table 694: phy test register 1 (phy_addr = 0x1, reg_addr = 1eh) bit name description init access 15 crc error count visibility ? 1 = receiver not_ok counters (see ?receiver not_ok counters (phy_addr = 0x1, reg_addr = 14h)? on page 629 ) merged into one 16-bit crc error counter. ? 0 = normal operation. 0r/w 14:8 reserved 0 r/w 7 manual swap mdi state (bcm5705, bcm5721, and bcm5751 only) ? 1 = manual swap mdi state. ? 0 = normal operation. 0r/w reserved 0 r/w 6:0 reserved write as 0, ignore when read. 0 r/w table 695: 1fh: test register 2 bit name description init access 15:13 test select auto-negotiation fsm ? 000 = arb ? 001 = rx1000 ? 010 = rx ? 011 = tx1000 ? 100 = tx ? 101 = baset link 000 r/w 12 test auto- negotiation timer ? 1 = auto-negotiation timer test mode ? 0 = normal operation 0r/w 11 test master/slave seed ? 1 = use mdio programmable master/slave seed ? 0 = normal operation 0r/w 10 writeable link partner ability ? 1 = link partner advertised ability may be overwritten by mii management ? 0 = normal operation 0r/w 9 force hcd ? 1 = force auto-negotiation hcd resolution (hcd can only be checked in register 19h bits [10:8]; hcd status register will not be updated) ? 0 = normal operation 0r/w 8 writeable link partner m/s seed ? 1 = link partner master/slave seed may be overwritten by mii management ? 0 = normal operation 0r/w 7 transmit 10b mode ? 1 = force gmii transmit into 10b mode ? 0 = use normal mode bit 0r/w 6 receive 10b mode ? 1 = force gmii receive into 10b mode ? 0 = use normal mode bit 0r/w www.datasheet.in bcm57xx programmer?s guide 01/29/08 broadcom corporation page 702 transceiver registers document 57xx-pg105-r 5 bypass transmit fifo ? 1 = transmit fifo bypassed ? 0 = normal operation 0r/w 4 same scrambler seeds ? 1 = receive scrambler uses transmit seed ? 0 = normal operation 0r/w 3 jitter test mode ? 1 = jitter test mode ? 0 = normal operation 0r/w 2 test atmp counter ? 1 = force master slave seed attempt counter into test mode ? 0 = normal mode 0r/w 1 latency measure ? 1 = send special short packet to measure receive latency on remote phy (hold high) ? 0 = normal operation 0r/w 0 disable active hybrid ? 1 = active hybrid disabled ? 0 = active hybrid enabled 0r/w table 695: 1fh: test register 2 (cont.) bit name description init access www.datasheet.in programmer?s guide bcm57xx 01/29/08 broadcom corporation document 57xx-pg105-r notes page 703 appendix a: flow control n otes developers can refer to the ieee 802.3 annex 31b specific ation for detailed information on ethernet flow control mechanisms. ? flow control frames use a well-known multicast address, defined in the 802.1d bridging specification the mac destination address is 01-80-c2-00-00-01 ? bridges and switches will not forward pause frames to downstream ports. ? a pause frame contains a request_operand that contains a pause_time field. pause_time specifies the number of quanta, which transmission should be inhibited. ? pause frames cannot inhibit mac control frames ? pause_time is a two-octet field, which represents a quanta value. the quanta value is based on bit/slot times for the connection speed. valid pause_times vary from 0 to 65535. ? the pause frame contains a mac control opcode. 00-01 is reserved for pause mac control functions. ? mac control layers will provide two indicators?paused and not paused. ? the enet source address equals the unicast address of the mac sublayer, which transmits the pause_frame. ? the receive engine will set a countdown timer, based on the value of pause_time. when the timer expires, the transmit engine may resume send operation ? a mac sublayer may transmit pause frames with pause_time = 0. the zero value will stop a pause count down, executed by the mac?s link partner. effectively, a value of zero restarts a link partner?s transmit engine, assuming the link partner was inhibited by a previous pause operation. f low c ontrol s cenario this scenario assumes that the gigabit switch has a 1:1 port mapping, between the gigabit server and client. the switch does not implement header aligned blocking, nor will it drop packets to alleviate buffer pressure. the following constraints are placed on this scenario: ? client - full-duplex connection at gigabit speed. - implements flow control. - flow control enabled. ? switch - does not drop packets. - full-duplex connection to client. ? server - gigabit connection. - either half/full-duplex connection at gigabit speed (i.e., this scenario will cover two subcases). www.datasheet.in bcm57xx programmer?s guide 01/29/08 broadcom corporation page 704 flow control scenario document 57xx-pg105-r f ile t ransfer the client begins a ftp session (see figure 109 ). the file size is very large and will take several minutes for a complete transfer, even at gigabit wire speed. figure 109: file transfer scenario: ftp session begins s peed m ismatch the client sends pause frame(s) to the switch (see figure 110 ). the client?s pipe has been saturated, and the rx buffers are almost exhausted. the client begins sending pause frames, when the rx buffer high-water mark/threshold is hit. any number of reasons can account for the rx buffer issue. the assumption will be made that the client pci bus lack bandwidth to dma packets, at wire speed, to host memory. the user may be playing a dvd, for example. figure 110: file transfer scenario: speed mismatch gigabit server switch gigabit client file transfer file gigabit server switch gigabit client pause packets www.datasheet.in programmer?s guide bcm57xx 01/29/08 broadcom corporation document 57xx-pg105-r flow control scenario page 705 s witch b uffers r un l ow the switch must wait/inhibit transmission to the client (see figure 111 ). during the pause interval, the server is still sending packets to the switch. the switch will buffer some packets, but will eventually hit an internal threshold; memory will run shor t. since dropping packets is undesirable, the switch must slow incoming packets from the server. the duplex mode of the server?s connection will dictate how the switch slows traffic. there are two options: ? jamming (half-duplex) ? pause frames (full-duplex) figure 111: file transfer scenario: speed buffers run low ingres switch client port server port mac sublayer port buffers & memory almost exhausted egres www.datasheet.in bcm57xx programmer?s guide 01/29/08 broadcom corporation page 706 flow control scenario document 57xx-pg105-r s witch b ackpressure the switch will jam ports configured with hal f-duplex link to slow frame transmission (see figure 112 ). in this case, the server connection must be half-duplex, and then the switch may apply backpressure to the port. the switch will transmit a jamming pattern, which will prevent the server from transmitting further packets. the server?s mac will detect a collision situation, and will back off for a specified interval. the switch will continue to apply backpressure to the server ingress, un til the client egress is available. the client port will be available when the pause interval expires, and no further pause packets are sent by the gigabit client. figure 112: file transfer scenario: switch backpressure s witch f low c ontrol the switch can only use ieee 802.3x flow control when the link is configured for full-duplex operation (see figure 113 ). when buffers are near exhaustion, the switch will send a pause frame to the server. the server?s mac will be inhibited for a pause_time interval. during the pause interval, the switch has the opportunity to empty the buffered packets. once the buffered packets fall below the high water mark, the switch may send another pause frame, with pause_time = 0, to terminate the server?s pause interval. the switch may also allow the server?s pause interval to expire. either way, the switch no longer will inhibit the server from sending packets. figure 113: file transfer scenario: switch flow control gigabit server switch gigabit client jamming empty buffered frames gigabit server switch gigabit client pause packets empty buffered frames www.datasheet.in programmer?s guide bcm57xx 01/29/08 broadcom corporation document 57xx-pg105-r pause control frame page 707 f ile t ransfer c omplete the client has caught up with the transmission flow of the server (see figure 114 ). the client?s rx buffers/memory is below the flow control threshold. the file is transfer is complete. this scenario was a worst-case cascade, where the pause delay propagated through the lan. the switch could absorb the client?s pause delay, without having to flow control the server. figure 114: file transfer scenario: file transfer complete p ause c ontrol f rame the minimum size frame is 512 bits or 64 bytes (see figure 115 ). mac control frames must pad zeros into the unused portion of the payload. a flow control frame contains the following fields: ? destination address field, set to 01-80-c2-00-00-01 ? source address field set to unique mac address of sender ? ll/type field set to the 802_3_mac_control value, set to 88-08 ? mac control pause opcode (00-01), pause_time, and reserved field (zeros) figure 115: pause control frame gigabit server switch gigabit client file destination address source address ll/type mac control opcode mac control parameters reserved field 6 bytes 6 bytes 2 bytes 2 bytes 64 bytes - 20 bytes - mac_ctrl_parm_len 2 bytes 42 bytes 01 80 c2 00 00 01 xx xx xx xx xx xx 88 08 00 01 00 10 00 00 00 ... delay 10 quanta (slot times) pause frame opcode pause frame opcode source address multicast address pause frame www.datasheet.in bcm57xx programmer?s guide 01/29/08 broadcom corporation page 708 reference materials document 57xx-pg105-r appendix b: pc power management r eference m aterials the acpi specification is an industry collaboration between compaq, intel ? , microsoft ? , toshiba ? , and phoenix. the fol- lowing hyperlinks are websites dedicated to the acpi specification: ? http://developer.intel.com/technology/iapc/acpi/downloads/acpica-progref.pdf ? http://www.microsoft.com/hwdev/onnow/ ? http://www.toshiba.ca/isg/newsletter/powermanagement.html ? http://www.phoenix.com/platform/acpi.html ? http://www.teleport.com/~acpi/ the apm specification was authored by intel and microsoft. the http://www.microsoft.com/hwdev/busbios/amp_12.htm website hyperlink(s) contain more information on apm. information regarding pci power management can be located at the pci special interest group?s (sig) website at http:// www.pcisig.com/ . apm the original advanced power management specification was written in 1992, by intel and microsoft. apm is primarily a bios interface and has been outdated by the newer acpi specification. new servers, workstations, and pcs do not implement power management using apm. apm is a four-layer architecture (see figure 116 ): ? layer 1 is the apm bios. the system bios provides logic for power management of the motherboard. the bios is platform specific software. the apm bios may be configured to provide some power management, independent of os control. setup and configuration modes for bios norm ally provide a mechanism to disable independent power management by bios. ? layer 2 is the apm interface. a common interface, which uses int15, calls to the apm bios. additional, 16- and 32-bit protected mode bios calls may be published by the bios vendor. ? layer 3 is the os apm driver. apm aware applications and device drivers interface with the os apm driver, not the bios directly. the apm driver is responsible for serializing access to the apm bios, via the apm interface. the os apm driver must call the apm bios once per second so the bios will not assume a system hang?watchdog type functionality. ? layer 4 is the apm aware device drivers and applications. nic vendors like broadcom provide power management capable device drivers. add-in devices, like the bcm57xx family, will have a power management capable device driver. www.datasheet.in programmer?s guide bcm57xx 01/29/08 broadcom corporation document 57xx-pg105-r apm page 709 figure 116: apm architecture apm manages system power consumption using six managed states (see figure 117 ): ? full on?system is running at full power. devices do not implement power conservation measures. ? apm enabled?system is running under full power. the system does implement power management. ? apm standby?system running at reduced power. power managed devices reduce their power consumption to low- power. the processor and/or system clock may be slowed. ? apm suspend?system is at maximum power conservation. the microprocessor stops clock. cpu core is in low-power mode. power managed devices are turned off. ? hibernation?system is completely switched off. before shutdown, memory is stored to non-volatile storage (i.e., hard drive). memory modules are turned off. ? off?no power to system. apm-aware device drivers apm-aware device drivers apm-aware device drivers ... o/s apm driver apm bios apm interface protected mode apm interface real mode operating system bios apm device system www.datasheet.in bcm57xx programmer?s guide 01/29/08 broadcom corporation page 710 apm document 57xx-pg105-r figure 117: states for power consumption management the following register interfaces were taken from the apm bios specification and are intended as a quick reference (see table 696 ). in real mode, these functions are accessed with an int15h. in protected mode, these functions are called via a protected mode entry point. the entry point is returned from a protected mode connection function call. to set up a real mode function call, the following steps are taken. note that these steps assume an x86 host cpu architec- ture. ? write signature 0x53 to the ah register ? write the function code to al register ? write the device number to bx register ? write 0x01(enable) or 0x00(disable) to cx register full on apm enabled apm_enable apm_disable apm standby standby_call resume apm suspend suspend wake_up hybernation wake_up long suspend www.datasheet.in programmer?s guide bcm57xx 01/29/08 broadcom corporation document 57xx-pg105-r apm page 711 the o/s apm driver must poll the apm bios to determine an event code. the o/s driver uses its interface connection to call function get_power_managed_event (ah = 0x0b). the apm bios will acknowledge the call with an event code in reg- ister bx. when multiple events occur, the apm bios will return all events in a time-ordered sequence. table 697 is a quick reference for event codes. table 696: function codes quick reference ah value function description 0x01 apm installation check 0x02 apm real mode interface connect 0x03 apm protected mode connect 16-bit 0x04 apm protected mode connect 32-bit 0x05 apm interface disconnect 0x06 cpu idle 0x07 cpu busy 0x08 set power state 0x09 enable/disable power management 0x0a get power status 0x0b get power managed event 0x0c get power state 0x0d enable/disable device power management 0x0e apm driver version 0x0f engage/disengage power management 0x10 get capabilities 0x11 get/set/disable/resume timer 0x12 enable/disable resume on ring indicator 0x13 enable/disable timer based requests 0x80 oem apm function www.datasheet.in bcm57xx programmer?s guide 01/29/08 broadcom corporation page 712 advanced configuration and power interface document 57xx-pg105-r a dvanced c onfiguration and p ower i nterface the advanced configuration and power interface (acpi) specification has displaced apm as the power management stan- dard. apm implements power management in bios methods; whereas, acpi moves power management under the os um- brella. acpi is an interface specification between hardware and software. acpi outlines mechanisms that both hardware and software must follow to remain compatible. the acpi 2.0 specification was written by intel, microsoft, toshiba, compaq, and phoenix technologies in july 2000. acpi can be broken into the following high-level components (see figure 118 ): ? os power management model?the ospm is responsible for making global decisions regarding power management, of the system. ? kernel?the os kernel provides the basic device driver interfaces (ddi) and runtime code for objects like synchronization, resource sharing, and scheduling. ? power managed device driver?vendor supplied software, which programs device-specific power management features. for example, the bcm57xx family needs to disabl e rx/tx risc processor clocking for d3 states. the o/s does not have the necessary runtime code or understanding of the mac?s architecture. ? acpi driver?a o/s subsystem responsible for acpi power management. the acpi driver is responsible for interpreting acpi machine language (aml). aml is typically provided by oems for value adds on their platform. ? acpi tables?the acpi tables are descriptions of hardware resources. the interfaces (i.e., registers, memory map), which acpi system software may use, are exposed through definition blocks contained within the acpi tables. the acpi tables also contain aml event handlers for acpi system events. ? acpi registers?the interfaces described in the acpi tables. ? acpi bios?the acpi bios contains the acpi tables, which describe the hardware hierarchy and resources. the bios contains firmware, which boots the pc. sleep, wake, reset, and event interfaces are contained within the acpi bios. table 697: event codes quick reference bx value event description 0x01 system standby request 0x02 system suspend request 0x03 normal resume system 0x04 critical resume system 0x05 battery low 0x06 power status change 0x07 update time 0x08 critical system suspend 0x09 user system standby request 0x0a user system suspend request 0x0b system standby resume 0x0c capabilities change 0x00d?0x0ff reserved system events 0x100?0x1ff reserved device events 0x200?0x2ff oem-defined apm events www.datasheet.in programmer?s guide bcm57xx 01/29/08 broadcom corporation document 57xx-pg105-r advanced configuration and power interface page 713 figure 118: advanced configuration and power interface (acpi) components kernel power managment model acpi driver device driver acpi registers acpi tables acpi bios hardware operating system bios system bios www.datasheet.in bcm57xx programmer?s guide 01/29/08 broadcom corporation page 714 advanced configuration and power interface document 57xx-pg105-r the os power management (ospm) is responsible for global power state transitions. a global state is a platform wide con- figuration, which directs sleep and device power management state(s). the following global states are defined in the acpi 2.0 specification (see figure 119 ): ? g0 working?the acpi 2.0 specification defines the g0 state as follows: ?the normal operating environment of an acpi machine. in this state, different devices are dynamically transitioning between their respective power states (d0, d1, d2, d3).? essentially, the ospm may throttle unused portions of the platform architecture to conserver power. the go state is synonymous with the sleep state s0. ? g1 sleeping?the g1state contains four substates (s1, s2, s3, s4). these substates are platform implementations of different sleep modes. the depth and amount of power savings depends upon the sleep state (s1-s4), which the platform implements. ? g2 soft off?the acpi 2.0 specification defines the g2 state as follows: ?a computer state where the computer consumes a minimal amount of power.? system context will not be preserved by hardware. ? g3 mechanical off?no power to system. it is safe to replace hardware. there should be zero power consumption. figure 119: os power management (ospm) global states g3 mechanical off g0 working g1 sleeping legacy g2 soft off sleep states s1,s2,s3,s4 sleep state s0 sleep state s5 www.datasheet.in programmer?s guide bcm57xx 01/29/08 broadcom corporation document 57xx-pg105-r advanced configuration and power interface page 715 the acpi sleep states are subsets of the global acpi g0-g3 states. for example, g0 working state corresponds to the s0 sleep state. the sleep states are defined in the acpi 2.0 specification (see figure 120 ): ? s0?normal working state. devices may be in any d0-d3 state. hot removal of devices possible. ? s1?low wake-latency sleep state. system context is preserved in this sleep state. ? s2 ?low wake-latency sleep state. memory context is preserved. all remaining system device context may be lost. wake event capability by devices. ? s3?low wake-latency sleep state. similar to s2 state. memory in low-power/refresh mode. only devices supporting memory are powered. ? s4?lowest power and longest wake-latency sleep state. all devices powered off. platform context saved off, before entry to s4 state. ? s5?soft off state. this is not a sleep state. no context is preserved, nor can be restored by ospm. bios does a power on reset when a wake event is detected. figure 120: acpi sleep states g0 s1 s0 s2 acpi boot s4 s3 s5 g2 g1 wake www.datasheet.in bcm57xx programmer?s guide 01/29/08 broadcom corporation page 716 advanced configuration and power interface document 57xx-pg105-r the acpi 2.0 specification defines power management behavior for device classes differently. for example, audio device states d0-d3, are not similar to modem device states. refer to appendix a of the acpi 2.0 specification for a detailed dis- cussion of device power management. table 698 (acpi 2.0 spec) shows the power management behavior for the network device class. the power management policy for the network class specifies how a network device behaves at a dx power state (see table 699 ). for example, a device, not the wire-speed of the device, needs to wake up during wol mode. a network wake up may be initiated by a magic packet or similar unique packet format. table 698: power management behavior for the network device class state implementation requirement definition d0 required device is powered on and running. device delivers full functionality. d1 optional no bus transactions allowed. no bus reception allowed. no interrupts can occur. device context may be lost. d2 optional no bus transactions allowed. no bus reception allowed. no interrupts can occur. device context may be lost d3 required no bus transactions allowed. no bus reception allowed. no interrupts can occur. device context is lost. table 699: power management policy for the network class current state next state cause/effect d0 dx ? cause: system enters sleep state s1-s4 ? effect: if wake is enabled, the lowest dx state is chosen for the network device. there is one limitation, in that the dx state must support the wakeup. d0 d3 ? cause: system initiated network shutdown ? effect: system enters sleep state. the device may provide wake capability, but it is not required. d1/d2/d3 d0 ? cause: system wakeup. ? effect: device moves to full-power operation. www.datasheet.in programmer?s guide bcm57xx 01/29/08 broadcom corporation document 57xx-pg105-r pci page 717 pci pme the pci 2.2 specification states: ?the power management event (pme) signal is an optional hardware signal.? wake capable networking devices will implement pme, so a change in system power management state can be requested. pme must be driven until system software clears the power management event. the pme signal is asynchronous to pci clocking. wake events are reported by devices when a wake_int bit is set in the pmcsr register. pme is enabled/disabled by setting a wake_en bit in the pmcsr register. the pmcsr register is not device/application specific. 3.3 v aux the pci 2.2 specification states: ?an optional 3.3 volt auxiliary power source delivers power to pci add-in cards for generation of power management events when the main power to the card has been turned off by software.? the 3.3 vaux is pin 14 on side a of a pci connector. a device will use vaux while in a low-power state, like d3. s lot p ower a 3.3v or 5.0v power supply for add-in cards. this is the main power supply for the device while in the full power d0 power management state. several pins on the pci connector provide paths to the 5.0v or 3.3v power planes on the host motherboard. refer to the pci 2.2 specification for the pci connector pin-out. the choice and use of slot power is based upon the hardware application. smi/sci intel processors support a mode call system management mode (smm). smm is completely transparent to a native os and operates in another processor address space. system bios may implement event handlers for power management in smm address space. smm mode is invoked via a system management interrupt (smi). a generated smi will cause the following actions: ? the system will enable system management memory (smram). normal ram is disabled. ? processor registers are saved off to smram. ? processor registers are initialized with smm settings. ? processor jumps to entry point in smram, where the smi handler is placed. ? power management registers are queried to determine cause of smi. ? smm handler services the appropriate request. ? a return from system management mode (rsm) instruction is issued. ? processor restores registers saved in step #2. ? normal ram is enabled. smram is disabled. www.datasheet.in bcm57xx programmer?s guide 01/29/08 broadcom corporation page 718 pci document 57xx-pg105-r the acpi specification refers to smm as a legacy mode and prefers the native o/s (i.e., microsoft windows, linux, etc.) to handle the interrupt. the essential problem with using smi, resides in moving the processor into smm mode; the native os does not have visibility into the event. to solve this design constraint, the acpi 2.0 specification defines a system control interrupt. sci will notify an os of a power management event. the sci is a shared, level triggered interrupt. figure 121 shows how a system bios would configure power management to use either smm or sci during the system post. a sci_enable will route power management events to the sci interrupt arbiter, rather than smi arbiter. figure 121: power management configuration during post the arbiter is combinational logic residing in the chipset and contains status/control registers for power management. the host chipset provides general-purpose event registers (gpe, see figure 122 ) to selectively enable/disable pm events. the gpe block also contains status registers to record the pm event?s occurrence. all the pm events are mapped into a single- level triggered sci. the sci may be routed to either a pic or apic. how the sci is routed is not important for this discussion and will depend upon the host motherboard. the sci interrupt will be serviced by an acpi os, which is the important differ- entiator. under smm mode, the os would not be notified of the pm event. with an interrupt, the os will branch to a service routine for the sci vector. the acpi driver will have an aml event routine, which will operate upon the pm event accordingly. refer to the acpi 2.0 specification for a detailed explanation of how aml and acpi tables interact. a pme signal can be routed into the gpe block, which ties networking wake-capable devices into the acpi model. smi arbiter sci_enable device events sci arbiter legacy idle/service timers sci# decoder s1 d1 d2 enb smi# thermal events user events (power button) www.datasheet.in programmer?s guide bcm57xx 01/29/08 broadcom corporation document 57xx-pg105-r pci page 719 figure 122: general purpose event block gpe_enb_0 q q set clr d gpe_status_0 gpe_enb_1 q q set clr d gpe_status_1 gpe_enb_2 q q set clr d gpe_status_2 ... sci# pme# power button thermal general purpose event block ... www.datasheet.in bcm57xx programmer?s guide 01/29/08 broadcom corporation page 720 signal sampling to determine pci configuration document 57xx-pg105-r appendix c: initialization and reset s ignal s ampling to d etermine pci c onfiguration d etermining s lot t ype the bcm57xx family samples signals frame , irdy , trdy , stop , and devsel at the rising edge of rst to determine whether the nic is in a pci or pci-x slot (see figure 123 ). the chipset drives a pci-x initialization pattern onto the bus so the nic can sample the pattern. the combination of trdy , stop , and devsel initializes the pci-x slot for a specific operating mode. the exact format and permutations of the signals may be found in table 6.2 in the pci-x v1.0 specification. figure 123: sampling signals to determine whether the nic is in a pci or pci-x slot frame pci_clk signals asseted per t able 6.2 pci-x spec irdy trdy devsel signals sampled b y bcm57xx on risin g edge of rst stop rst ... 10 clocks (min) 50 ns (max) www.datasheet.in programmer?s guide bcm57xx 01/29/08 broadcom corporation document 57xx-pg105-r signal sampling to determine pci configuration page 721 d etermining pci c lock the bcm57xx pci interface does support 66 mhz conventional pci operation. the m66en signal influences the bus frequency for all peripheral devices on the same physical bus. one legacy device may pull the speed of the entire bus down to 33 mhz. the bcm57xx family samples this signal to determine if another peripheral has requested 33-mhz operation (see figure 124 ). m66en is a sense pin on the bcm57xx family. the bcm57xx family will sample this signal after device reset. the pci chipset will also sample this signal and then scale the pci clocking accordingly. after the pci rst signal is deasserted, the bcm57xx family samples the m66en signal. the m66en and rst signals are asynchronous to the pci_clk. refer to the pci v2.2 for exact timing specifications?section 7.5.1. the 33/66 mhz_pci_66/133 mhz_pcix bit in the pci_state register (see ?pci state register (offset 0x70)? on page 332 ) reflects the current bus speed. figure 124: sampling m66en to determine 66 mhz ? start software pci operation d etermining pci m ode the bcm57xx family may operate in either 32- or 64-bit pci mode. when the bcm57xx family comes out of pci reset, the req64 signal is sampled (see figure 125 ). this signal is asserted to indicate that pci transactions are 64 bits wide. refer to section 4.3.2 in the pci v2.2 specification; the specifics for req64 setup and hold times are documented. the 32_bit_pci_bus bit in the pci state register indicates the current sampled status of req64 . figure 125: sampling req64 to determine 64-bit pci mode 6 6-mhz pci bus detected rst m66en 6 4-bit addressing detected rst req64 www.datasheet.in bcm57xx programmer?s guide 01/29/08 broadcom corporation page 722 reset intervals document 57xx-pg105-r the pci v2.2 specification states that a device should not be accessed during the 2exp25 clock cycle interval after rst is deasserted (see figure 126 ). the bcm57xx family does not target terminat e with a retry during this reset interval. pci transactions should not be initiated since the pci interface will not assert trdy and frame during the reset interval. however, access to the expansion rom after the 20 millisecond firmware initialization causes an auto-retry. r eset i ntervals after the device is reset, rom code in the device takes 20 ms to 50 ms (depending on the size of the boot firmware) to load the initial firmware code stored in the nvram. this initial firmware code then enables the pci expansion rom retry until pxe code is completely loaded from nvram to internal me mory. pxe loading process can take up to 3 or 4 seconds. expansion rom auto-retry is removed when pxe code is completely loaded, which only occurs if pxe is administratively enabled. if host software accesses the expansion rom before the loading process has completed, the device will not target terminate with a retry. figure 126: pci-specified reset interval pci specified reset interval rst 2exp25 clocks 20 ms?50 ms access to expansion rom after 20 ms?50 ms auto-retries p ci_clk www.datasheet.in programmer?s guide bcm57xx 01/29/08 broadcom corporation document 57xx-pg105-r gpio hold condition page 723 gpio h old c ondition figure 127 shows the bcm57xx gpio hold condition. the gpio pins hold their current output until the rising edge of reset. if the gpio pins were tristated before the falling edge of rst , the pins will remain tri-stated. after the rising edge of reset, the gpio pins will tri-state. figure 127: gpio hold condition bcm57xx gpio trista te rst 1 ms min power good 100 ms min bcm57xx gpio hold condition bcm57xx gpio pins tristated b cm57xx gpio output hold until rising edge of rst www.datasheet.in bcm57xx programmer?s guide 01/29/08 broadcom corporation page 724 gpio hold condition document 57xx-pg105-r appendix d: terminology table 700: terminology term definition bd buffer descriptor. deferred procedure call (dpc) the isr may schedule a o/s callback to process interrupts at a later time. dpc see deferred procedure call (dpc). expansion rom pci devices may optionally expose device specific programs to bios. for example, network devices may place pxe boot code in their expansion rom region. host coalescing a hardware block which the bcm57xx status block. the hardware will drive a line interrupt or msi. interrupt distribution queue the bcm57xx supports four interrupt distribution queues per class of service. the rules engine may place traffic into rx return rings based on rules checking. within each class of service, the traffic may further be organized in interrupt distribution queues. for example, frames with errors may be given lower data path priority over frames without errors, all within the same class of service (rx return ring). interrupt service routine (isr) a procedure where device interrupts are processed. isr see interrupt service routine (isr). pre-boot execution (pxe) an industry-standard client/server interface that allows networked computers that are not yet loaded with an operating system to be configured and booted remotely. pxe see pre-boot execution (pxe). receive bd initiator the hardware block that dma's bds when receive ring indices are written. receive data and receive bd initiator the hardware block the updates packet buffers, in host memory, after an ethernet frame is received. the hardware block will also update the bd with information like checksum and vlan tags. receive data completion the hardware block that updates the host coalescing engine after the packet buffers and bd are dmaed to host memory. receive queue placement the hardware block that routes a categorized frame to one of sixteen rx return rings. send bd initiator the hardware block that is activated when a send producer index is updated by host software. the hardware block will dma a bd from host memory. send data initiator the hardware block updates the dmas in the packet buffers from host memory. the packet buffers are dmaed after the bd has been moved to device local memory. www.datasheet.in programmer?s guide bcm57xx 01/29/08 broadcom corporation document 57xx-pg105-r gpio hold condition page 725 www.datasheet.in document 57xx-pg105-r broadcom corporation 5300 california avenue p.o. box 57013 irvine, ca 92617 phone: 949-926-5000 fax: 949-926-5203 broadcom ? corporation reserves the right to make changes without further notice to any products or data herein to improve reliability, f unction, or design. information furnished by broadcom corporation is believed to be accurate and reliable. however, broadcom corporation does not assume any liability arising out of the application or use of this information, nor the application or use of any prod uct or circuit described herein, neither does it convey any license under its patent rights nor the rights of others. bcm57xx programmer?s guide 01/29/08 www.datasheet.in |
Price & Availability of BCM5703
 |
|
|
|
|
All Rights Reserved © IC-ON-LINE 2003 - 2022 |
| [Add Bookmark] [Contact Us] [Link exchange] [Privacy policy] |
|
Mirror Sites : [www.datasheet.hk]
[www.maxim4u.com] [www.ic-on-line.cn]
[www.ic-on-line.com] [www.ic-on-line.net]
[www.alldatasheet.com.cn]
[www.gdcy.com]
[www.gdcy.net] |