- remove the code to bring down the PHY in bnx_stop(), it's wrong

  (ifm_data isn't updated) and lead to a panic in mii_phy_setmedia(),
  or reading past the end mii_media_table[].
- make sure the dma_map matches the mbuf in the rx structures. We would
  sync/unload the wrong map, leading to a DIAGNOSTIC panic, or eventually
  leaking memory when bounce buffers are needed.

From NetBSD

ok marco@, brad@

1 files changed, 10 insertions, 24 deletions

diff --git a/sys/dev/pci/if_bnx.c b/sys/dev/pci/if_bnx.c
index dcc054180f2..a9818205cce 100644
--- a/sys/dev/pci/if_bnx.c
+++ b/sys/dev/pci/if_bnx.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: if_bnx.c,v 1.43 2007/01/30 03:21:10 krw Exp $	*/
+/*	$NetBSD: if_bnx.c,v 1.2 2007/02/15 19:24:47 bouyer Exp $	*/
 
 /*-
  * Copyright (c) 2006 Broadcom Corporation
@@ -2904,9 +2904,7 @@ void
 bnx_stop(struct bnx_softc *sc)
 {
 	struct ifnet		*ifp = &sc->arpcom.ac_if;
-	struct ifmedia_entry	*ifm;
 	struct mii_data		*mii = NULL;
-	int			mtmp, itmp;
 
 	DBPRINT(sc, BNX_VERBOSE_RESET, "Entering %s()\n", __FUNCTION__);
 
@@ -2932,26 +2930,6 @@ bnx_stop(struct bnx_softc *sc)
 	/* Free TX buffers. */
 	bnx_free_tx_chain(sc);
 
-	/*
-	 * Isolate/power down the PHY, but leave the media selection
-	 * unchanged so that things will be put back to normal when
-	 * we bring the interface back up.
-	 */
-
-	itmp = ifp->if_flags;
-	ifp->if_flags |= IFF_UP;
-	/*
-	 * If we are called from bnx_detach(), mii is already NULL.
-	 */
-	if (mii != NULL) {
-		ifm = mii->mii_media.ifm_cur;
-		mtmp = ifm->ifm_media;
-		ifm->ifm_media = IFM_ETHER|IFM_NONE;
-		mii_mediachg(mii);
-		ifm->ifm_media = mtmp;
-	}
-
-	ifp->if_flags = itmp;
 	ifp->if_timer = 0;
 
 	sc->bnx_link = 0;
@@ -3265,6 +3243,7 @@ bnx_get_buf(struct bnx_softc *sc, struct mbuf *m, u_int16_t *prod,
 #ifdef BNX_DEBUG
 	u_int16_t debug_chain_prod =	*chain_prod;
 #endif
+	u_int16_t first_chain_prod;
 
 	DBPRINT(sc, (BNX_VERBOSE_RESET | BNX_VERBOSE_RECV), "Entering %s()\n", 
 	    __FUNCTION__);
@@ -3324,6 +3303,7 @@ bnx_get_buf(struct bnx_softc *sc, struct mbuf *m, u_int16_t *prod,
 
 	/* Map the mbuf cluster into device memory. */
 	map = sc->rx_mbuf_map[*chain_prod];
+	first_chain_prod = *chain_prod;
 	if (bus_dmamap_load_mbuf(sc->bnx_dmatag, map, m_new, BUS_DMA_NOWAIT)) {
 		BNX_PRINTF(sc, "%s(%d): Error mapping mbuf into RX chain!\n",
 		    __FILE__, __LINE__);
@@ -3373,8 +3353,14 @@ bnx_get_buf(struct bnx_softc *sc, struct mbuf *m, u_int16_t *prod,
 
 	rxbd->rx_bd_flags |= htole32(RX_BD_FLAGS_END);
 
-	/* Save the mbuf and update our counter. */
+	/*
+	 * Save the mbuf, ajust the map pointer (swap map for first and
+	 * last rx_bd entry to that rx_mbuf_ptr and rx_mbuf_map matches)
+	 * and update counter.
+	 */
 	sc->rx_mbuf_ptr[*chain_prod] = m_new;
+	sc->rx_mbuf_map[first_chain_prod] = sc->rx_mbuf_map[*chain_prod];
+	sc->rx_mbuf_map[*chain_prod] = map;
 	sc->free_rx_bd -= map->dm_nsegs;
 
 	DBRUN(BNX_VERBOSE_RECV, bnx_dump_rx_mbuf_chain(sc, debug_chain_prod,