bge(4) on BCM 5752 A02 panic due to media autoselect

[David Christensen]

> Recently one of my colleagues found that BCM 5752 A02 on Dell Latitude
> D820 would get "panic: invalid ife->ifm_data (0xa) in 
> mii_phy_setmedia".
>  After some investigation I have found that removing BCMR_ANEG from
> mii_capabilities in ukphy.c would work around the problem, 
> and it turns
> out that without explicitly specifying media type, the code 
> will finally
> get to pass the "intentionally invalid index" to mii_phy_setmedia and
> trigger an assertion fail.
> 
> I have not tested the situation in -STABLE yet, but it was 
> said to work
> there, though.  Is there anyone can shed some light to me about how to
> debug the issue?  Thanks in advance!
> 
> PS. During the debugging I have found that the attached patch can make
> "bge0: firmware handshake timeout" issue disappear from the said chip.
> Because I do not have Broadcom specification at hand I would 
> like to see
> if there is someone to give appropriate review for it.

Try the attached patch instead and let me know if it works.  When
FastBoot
is enabled on supported Broadcom controllers it allows the controller to
skip rereading firmware after a reset, allowing the driver to complete 
its initialization more quickly.  The Linux driver specifically disables
FastBoot because it performs some read/write tests to controller memory,
potentially corrupting the firmware, so FastBoot is disabled to insure
an
error free firmware reload.  We don't do the same test so the same
change
isn't necessary.  The patch happens to work because the bge driver
doesn't
perform firmware synchronization correctly, and the firmware initializes
too fast for the driver.

Dave
-------------- next part --------------
Index: if_bge.c
===================================================================
RCS file: /home/ncvs/src/sys/dev/bge/if_bge.c,v
retrieving revision 1.140
diff -p -u -r1.140 if_bge.c
--- if_bge.c	24 Aug 2006 14:41:16 -0000	1.140
+++ if_bge.c	30 Aug 2006 18:50:19 -0000
@@ -2326,6 +2326,12 @@ bge_reset(struct bge_softc *sc)
 		}
 	}
 
+	/*
+	 * Write the magic number to the firmware mailbox at 0xb50
+         * so that the driver can synchronize with the firmware.
+	 */
+	bge_writemem_ind(sc, BGE_SOFTWARE_GENCOMM, BGE_MAGIC_NUMBER);
+
 	/* Issue global reset */
 	bge_writereg_ind(sc, BGE_MISC_CFG, reset);
 
@@ -2362,11 +2368,6 @@ bge_reset(struct bge_softc *sc)
 		CSR_WRITE_4(sc, BGE_MARB_MODE, BGE_MARBMODE_ENABLE);
 
 	/*
-	 * Prevent PXE restart: write a magic number to the
-	 * general communications memory at 0xB50.
-	 */
-	bge_writemem_ind(sc, BGE_SOFTWARE_GENCOMM, BGE_MAGIC_NUMBER);
-	/*
 	 * Poll the value location we just wrote until
 	 * we see the 1's complement of the magic number.
 	 * This indicates that the firmware initialization
Index: if_bgereg.h
===================================================================
RCS file: /home/ncvs/src/sys/dev/bge/if_bgereg.h,v
retrieving revision 1.52
diff -p -u -r1.52 if_bgereg.h
--- if_bgereg.h	23 Aug 2006 11:32:54 -0000	1.52
+++ if_bgereg.h	30 Aug 2006 18:50:20 -0000
@@ -1768,10 +1768,11 @@
 	} while(0)
 
 /*
- * This magic number is used to prevent PXE restart when we
- * issue a software reset. We write this magic number to the
- * firmware mailbox at 0xB50 in order to prevent the PXE boot
- * code from running.
+ * This magic number is written to the firmware mailbox at 0xb50
+ * before a software reset is issued.  After the internal firmware
+ * has completed its initialization it will write the opposite of 
+ * this value, ~BGE_MAGIC_NUMBER, to the same location, allowing the
+ * driver to synchronize with the firmware.
  */
 #define BGE_MAGIC_NUMBER                0x4B657654