pfSense

10FD still does not work.
Steve found that 100FD works with crossover. I checked manual 100FD on both sides with crossover, all works fine. That means something wrong with AutoMDIX when autonegotiaition disabled.
10FD shows links in up state, but IP does not work ping: sendto: Host is down, no DHCP, etc, after changing back on 100FD IP works without issues.

Expected solution is not appropriate.
I thought that part of errata KSZ9031 (1G PHY chip which used in SG-1000) help us on this issue.
But these changes were present in the driver code.

I'll test with (MDI/MDI-X) with cross pairs of wires on cable.
I haven't looked before, I'll look at Register 1Ch bit 6 in driver code, which is responsible for Auto MDI/MID-X.

Looked at datasheet
p.33 in the description of bit 12 of Register 0h – Basic Control, found that:

1 = Enable auto-negotiation process
0 = Disable auto-negotiation process
If enabled, auto-negotiation result overrides settings
in Reg. 0.13, 0.8 and 0.6.
>> If disabled, Auto MDI-X is also automatically disabled.
>> Use Register 1Ch to set MDI/MDI-X.

seems we need switch on this bit after turn on and off the auto-negotiation process.

I'll look at this at home later.

Testing this further I found that with the SG-1000 port set to auto it establishes a link to a switch port set to 10Mbps but always at half duplex. This is confirmed by the output of both ifconfig and etherswitchcfg as well as the link switch.

Running a packet capture on the SG-1000 interface shows it can see traffic arriving and is attempting to send traffic. However a pcap on a switch mirror port shows nothing it sends ever reaches the wire.

I checked the clocks on PHY.
GTX_CLK (which output from AM3358)

when 1Gb is set = 125MHz,
when 100Mb ~ 25MHz

when 10Mb ~ 25MHz. << Wrong value according to KSZ9031RNX datasheet. Mast be 2.5MHz

RX_CLK

when 1Gb is set = 125MHz,
when 100Mb ~ 25MHz
when 10Mb ~ 2.5MHz

So this is the issue which needed to resolve.
Checking the clock signal generated from MAC on AM335x.

Therefore receiving by SG-1000 is working on 10Mb and transmitting isn't working.

in this doc: https://www.ti.com/lit/ug/spruh73p/spruh73p.pdf
AM335x TRM

14.3.6 RGMII Interface

The CPRGMII peripheral shall be compliant to the RGMII specification document.
Features:
• Supports 1000/100/10 Mbps Speed.
• MII mode is not supported.
If RGMII is used, and a 10Mbit operation is desired, in-band mode must be used and an Ethernet PHY
that supports in-band status signaling must be selected.

I did this changes and will check later.

diff --git a/sys/arm/ti/cpsw/if_cpsw.c b/sys/arm/ti/cpsw/if_cpsw.c
index a887561c0b9..f89112babf7 100644
--- a/sys/arm/ti/cpsw/if_cpsw.c
+++ b/sys/arm/ti/cpsw/if_cpsw.c
@@ -1546,6 +1546,10 @@ cpswp_miibus_statchg(device_t dev)
        case IFM_100_TX:
                mac_control |= CPSW_SL_MACTL_IFCTL_A;
                break;
+       /* in band mode only works in 10Mbps RGMII mode */
+       case IFM_10_T:
+               /* In Band mode */
+               mac_control |= CPSW_SL_MACTL_EXT_EN;
        }
        if (sc->mii->mii_media_active & IFM_FDX)
                mac_control |= CPSW_SL_MACTL_FULLDUPLEX;
diff --git a/sys/arm/ti/cpsw/if_cpswreg.h b/sys/arm/ti/cpsw/if_cpswreg.h
index c0ee3586fc4..dac3bf1b6ae 100644
--- a/sys/arm/ti/cpsw/if_cpswreg.h
+++ b/sys/arm/ti/cpsw/if_cpswreg.h
@@ -118,6 +118,8 @@
 /* SL1 is at 0x0D80, SL2 is at 0x0DC0 */
 #define        CPSW_SL_OFFSET                  0x0D80
 #define        CPSW_SL_MACCONTROL(p)           (CPSW_SL_OFFSET + (0x40 * (p)) + 0x04)
+#define         CPSW_SL_MACTL_EXT_EN           (1 << 18) /* In Band mode */
+#define         CPSW_SL_MACTL_GIG_FORCE        (1 << 17)
 #define         CPSW_SL_MACTL_IFCTL_B          (1 << 16)
 #define         CPSW_SL_MACTL_IFCTL_A          (1 << 15)
 #define         CPSW_SL_MACTL_GIG              (1 << 7)

Steve Wheeler, thank you for the idea with switch issue.
This solution resolve issue with transmit (TX) clocking (instead of 25MHz used 2.5MHz).
And now with 10Mb configuration on ports, they work both for receive and transmits traffic.

FreeBSD pf1k.lab 11.2-RELEASE-p2 FreeBSD 11.2-RELEASE-p2 #60 da8baa0ffd8(factory-RELENG_2_4_4): Sun Aug 19 01:19:48 EDT 2018
which is 2.4.4.a.20180818.1321 still shows the issue
Dmitry suggested to try pfSense-netgate-uFW-recover-2.4.4-DEVELOPMENT-armv6-20180819-0052 I could not not try one due my OTG was broken

This looks fixed on image Current Base System 2.4.4.a.20180819.0052:

2.4.4-DEVELOPMENT][root@pfSense.localdomain]/root: ifconfig -a
cpsw0: flags=8843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST> metric 0 mtu 1500
options=8000b<RXCSUM,TXCSUM,VLAN_MTU,LINKSTATE>
ether 68:9e:19:8b:56:5d
hwaddr 68:9e:19:8b:56:5d
inet6 fe80::6a9e:19ff:fe8b:565d%cpsw0 prefixlen 64 scopeid 0x1
inet 172.21.25.195 netmask 0xffffff00 broadcast 172.21.25.255
media: Ethernet 10baseT/UTP <full-duplex>
status: active

ping 1.1.1.1
PING 1.1.1.1 (1.1.1.1): 56 data bytes
64 bytes from 1.1.1.1: icmp_seq=0 ttl=55 time=49.872 ms
64 bytes from 1.1.1.1: icmp_seq=1 ttl=55 time=48.941 ms

and different device:

ifconfig -a
cpsw0: flags=8843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST> metric 0 mtu 1500
options=8000b<RXCSUM,TXCSUM,VLAN_MTU,LINKSTATE>
ether 0c:b2:b7:af:3e:4f
hwaddr 0c:b2:b7:af:3e:4f
inet6 fe80::eb2:b7ff:feaf:3e4f%cpsw0 prefixlen 64 scopeid 0x1
inet 172.21.25.196 netmask 0xffffff00 broadcast 172.21.25.255
media: Ethernet autoselect (10baseT/UTP <half-duplex>)
status: active
nd6 options=23<P

ping 1.1.1.1
PING 1.1.1.1 (1.1.1.1): 56 data bytes
64 bytes from 1.1.1.1: icmp_seq=0 ttl=55 time=51.135 ms
^C