MFC r311305 (by asomers):
Always null-terminate ccb_pathinq.(sim_vid|hba_vid|dev_name)

The sim_vid, hba_vid, and dev_name fields of struct ccb_pathinq are
fixed-length strings. AFAICT the only place they're read is in
sbin/camcontrol/camcontrol.c, which assumes they'll be null-terminated.
However, the kernel doesn't null-terminate them. A bunch of copy-pasted code
uses strncpy to write them, and doesn't guarantee null-termination. For at
least 4 drivers (mpr, mps, ciss, and hyperv), the hba_vid field actually
overflows. You can see the result by doing "camcontrol negotiate da0 -v".

This change null-terminates those fields everywhere they're set in the
kernel. It also shortens a few strings to ensure they'll fit within the
16-character field.

PR: 215474
Reported by: Coverity
CID: 1009997 1010000 1010001 1010002 1010003 1010004 1010005
CID: 1331519 1010006 1215097 1010007 1288967 1010008 1306000
CID: 1211924 1010009 1010010 1010011 1010012 1010013 1010014
CID: 1147190 1010017 1010016 1010018 1216435 1010020 1010021
CID: 1010022 1009666 1018185 1010023 1010025 1010026 1010027
CID: 1010028 1010029 1010030 1010031 1010033 1018186 1018187
CID: 1010035 1010036 1010042 1010041 1010040 1010039

Copy head (r256279) to stable/10 as part of the 10.0-RELEASE cycle.

Approved by: re (implicit)
Sponsored by: The FreeBSD Foundation

- Merge from NetBSD:
When issuing a non-DMA command, make sure to set the "remaining length of
command to be transferred via DMA" (sc_cmdlen) to zero up-front, otherwise
we might get confused on command competition interrupt (no DMA active but
still data left to transfer).
- Implement handling of MSG_IGN_WIDE_RESIDUE which some targets produce, as
just rejecting these leads to a resend and disconnect loop.
Reported and tested by: mjacob

MFC after: 3 days

Fix build:

- Use %ll instead of %q for explicit long long casts;
- Use %j instead of %q in XFS and cast to intmax_t.

Tested with: make universe

s/timout/timeout

Freeze the device queue if a request didn't complete without error and
isn't already frozen.

- Use device_t rather than the NetBSDish struct device.
- Move esp_devclass to ncr53c9x.c in order to allow different bus front-ends
to use it.
- Use KOBJMETHOD_END.
- Remove the gl_clear_latched_intr hook as it's not needed for any of the
chips nor the front-ends supported in FreeBSD and likely never will be.
- Correct the DMA constraints used in the SBus front-end, the LSI64854 isn't
limited to 32-bit DMA.
- The ESP200 also only supports up to 64k transfers.
- Don't let the DMA and SBus front-end supply a maximum transfer size larger
than MAXPHYS as that's the maximum the upper layers use and we otherwise
just waste resources unnecessarily.
- Initialize the ECB callout and don't zero the handle when returning ECBs
to the free list so that ncr53c9x_callout() actually is called with the
driver lock held.
- On detach the driver lock should be held across cam_sim_free() according
to isp(4) and a panic received.
- Check the return value of NCRDMA_SETUP(), i.e. bus_dmamap_load(9), and try
to handle failures gracefully.
- In ncr53c9x_action() replace N calls to xpt_done() in a switch with just
one at the end.
- On XPT_PATH_INQ report "NCR" rather than "Sun" as the vendor as the former
is somewhat more correct as well as the maximum supported transfer size via
maxio in order to take advantage of controllers that that can handle more
than DFLTPHYS.
- Print the number of MESSAGE (EXTENDED) rejected.
- Fix the path encoded in the multiple inclusion protection of ncr53c9xvar.h.
- Correct the DMA constraints used in the LSI64854 core to not exceed the
maximum supported transfer size and include the boundary so we don't need
to check on every setup of a DMA transfer.
- Let the bus DMA map callbacks do nothing in case of an error.
- Correctly handle > 64k transfers for FAS366 in the LSI64854. A new feature
flag NCR_F_LARGEXFER was introduced so we just need to check for this one
and not for individual controllers supporting large transfers in several
places.
- Let the LSI64854 core load transfer buffers using BUS_DMA_NOWAIT as the
NCR53C9x core can't handle EINPROGRESS. Due to lack of bounce buffers
support, sparc64 doesn't actually use EINPROGRESS and likely never will,
as an example for writing additional front-ends for the NCR53C9x core it
makes sense to set BUS_DMA_NOWAIT anyway though.
- Some minor cleanup.

Merge from NetBSD:
- Remove clause 3 and 4 from TNF licenses.
- Fix memset usage.
- Various cleanup.
- Kill caddr_t.

Merge from r225950:

Set the sense residual properly.

Reviewed by: ken

Correct spelling in comments.

Submitted by: brucec

o Move the MODULE_DEPEND() for cam(4) from the esp_sbus.c front-end to
the ncr53c9x.c core where it actually belongs so future front-ends
don't need to add it.
o Use the correct OFW property when looking for the initiator ID of the
SBus device.
o Don't specify an alignment when creating the parent DMA tag for
SUNW,fas; their DMA engine doesn't require an alignment constraint
and it's no inherited by the child DMA tags anyway (which probably
is a bug though).
o Drop the superfluous sc_maxsync and use sc_minsync instead. The
former apparently was added due to a confusion with the maximum
frequency used in cam(4), which basically corresponds to the
inverse of minimum sync period.
o Merge ncr53c9x.c from NetBSD:
1.116: NCRDMA_SETUP() should be called before NCR_SET_COUNT() and
NCRCMD_DMA command in ncr53c9x_select().
1.125: free allocated resources on detach.
o Static'ize ncr53c9x_action(), ncr53c9x_init() and ncr53c9x_reset()
as these are not required outside of ncr53c9x.c.
o In ncr53c9x_attach() don't leak the device mutex in case attaching
fails.
o Register an asynchronous notification handler so in case cam(4)
reports a lost device we can cancel outstanding commands and
restore the default parameters for the target in question.
o For FAS366 correctly support 16-bit target IDs and let it know
that we use 32-bit transfers.
o Overhaul the negotiation of transfer settings. This includes
distinguishing between current and goal transfer settings of the
target so we can renegotiate their goal settings when necessary
and correcting the order in which tagged, wide and synchronous
transfers are negotiated.
o If we are requesting sense, force a renegotiation if we are
currently using anything different from asynchronous at 8 bit
as the target might have lost our transfer negotiations.
o In case of an XPT_RESET_BUS just directly call ncr53c9x_init()
instead of issuing a NCRCMD_RSTSCSI, which in turn will issue an
interrupt that is treated as an unexpected SCSI bus reset by
ncr53c9x_intr() and thus calls ncr53c9x_init(). Remove the now
no longer used ncr53c9x_scsi_reset().
o Correct an off-by-one error when setting cpi->max_lun.
o In replace printf(9) with device_printf(9) calls where appropriate
and in ncr53c9x_action() remove some unnecessarily verbose messages.
o In ncr53c9x_sched() use TAILQ_FOREACH() instead of reimplementing
it and consolidate two tagging-related target info checks into one.
o In ncr53c9x_done() set the CAM status to CAM_SCSI_STATUS_ERROR when
appropriate, respect CAM_DIS_AUTOSENSE and teach it to return SCSI
status information.
o In ncr53c9x_dequeue() ensure the tags are cleared.
o Use ulmin() instead of min() where appropriate.
o In ncr53c9x_msgout() consistently use the reset label.
o When we're interrupted during a data phase and the DMA engine is
still active, don't panic but reset the core and the DMA engine as
this should be sufficient. Also, the typical problem for triggering
this was the lack of renegotiation when requesting sense.
o Correctly handle DEVICE RESETs.
o Adapt the locking of esp(4) to MPSAFE cam(4). This includes moving
the calls of lsi64854_attach() to the bus front-ends so it can pass
the esp(4) mutex to bus_dma_tag_create(9).
o Change the LSI64854 driver to not create a DMA tag and map for the
Ethernet channel as le(4) will handle these on its own as well as
sync and unload the DMA maps for the SCSI and parallel port channel
after a DMA transfer.
o Cam(4)'ify some NetBSD-centric comments.
o Use bus_{read,write}_*(9) instead of bus_space_{read,write}_*(9)
and take advantage of rman_get_rid(9) in order to save some softc
members.

Reviewed by: scottl
MFC after: 1 month

o Fix style(9) bugs and similar nits.
o Merge ncr53c9x.c from NetBSD:
1.115: fix variable shadowing
1.118: __inline -> inline
1.121: fix empty if

Prepare for future integration between CAM and newbus. xpt_bus_register
now takes a device_t to be the parent of the bus that is being created.
Most SIMs have been updated with a reasonable argument, but a few exceptions
just pass NULL for now. This argument isn't used yet and the newbus
integration likely won't be ready until after 7.0-RELEASE.

Remove Giant from CAM. Drivers (SIMs) now register a mutex that CAM will
use to synchornize and protect all data objects that are used for that
SIM. Drivers that are not yet MPSAFE register Giant and operate as
usual. RIght now, no drivers are MPSAFE, though a few will be changed
in the coming week as this work settles down.

The driver API has changed, so all CAM drivers will need to be recompiled.
The userland API has not changed, so tools like camcontrol do not need to
be recompiled.

2nd and final commit that moves us to CAM_NEW_TRAN_CODE
as the default.

Reviewed by multitudes.

The first of 3 major steps to move the CAM layer forward to using
the CAM_NEW_TRAN_CODE that has been in the tree for some years now.

This first step consists solely of adding to or correcting
CAM_NEW_TRAN_CODE pieces in the kernel source tree such
that a both a GENERIC (at least on i386) and a LINT build
with CAM_NEW_TRAN_CODE as an option will compile correctly
and run (at least with some the h/w I have).

After a short settle time, the other pieces (making
CAM_NEW_TRAN_CODE the default and updating libcam
and camcontrol) will be brought in.

This will be an incompatible change in that the size of structures
related to XPT_PATH_INQ and XPT_{GET,SET}_TRAN_SETTINGS change
in both size and content. However, basic system operation and
basic system utilities work well enough with this change.

Reviewed by: freebsd-scsi and specific stakeholders

Fix -Wundef from compiling the amd64 LINT.

- Try to not leak resources in the attach functions of the esp(4) SBus
front-end and the LSI64854 and NCR53C9x code in case one of these
functions fails. Add detach functions to these parts and make esp(4)
detachable.
- Revert rev. 1.7 of esp_sbus.c, since rev. 1.34 of sbus.c the clockfreq
IVAR defaults to the per-child values.
- Merge ncr53c9x.c rev. 1.111 from NetBSD (partial):
On reset, clear state flags and the msgout queue.
In NetBSD code to notify the upper layer (i.e. CAM in FreeBSD) on reset
was also added with this revision. This is believed to be not necessary
in FreeBSD and was not merged.
This makes ncr53c9x.c to be in sync with NetBSD up to rev. 1.114.
- Conditionalize the LSI64854 support on sbus(4) only instead of sbus(4)
and esp(4) as it's also required for the 'dma', 'espdma' and 'ledma'
busses/devices as well as the 'SUNW,bpp' device (printer port) which
all hang off of sbus(4).
- Add a driver for the 'dma', 'espdma' and 'ledma' (pseudo-)busses/
devices. These busses and devices actually represent the LSI64854 DMA
engines for the ESP SCSI and LANCE Ethernet controllers found on the
SBus of Ultra 1 and SBus add-on cards. With 'espdma' and 'ledma' the
'esp' and 'le' devices hang off of the respective DMA bus instead of
directly from the SBus. The 'dma' devices are either also used in this
manner or on some add-on cards also as a companion device to an 'esp'
device which also hangs off directly from the SBus. With the latter
variant it's a bit tricky to glue the DMA engine to the core logic of
the respective 'esp' device. With rev. 1.35 of sbus.c we are however
guaranteed that such a 'dma' device is probed before the respective
'esp' device which simplifies things a lot. [1]
- In the esp(4) SBus front-end read the part-unique ID code of Fast-SCSI
capable chips the right way. This fixes erroneously detecting some
chips as FAS366 when in fact they are not. Add explicit checks for the
FAS100A, FAS216 and FAS236 variants instead treating all of these as
ESP200. That way we can correctly set the respective Fast-SCSI config
bits instead of driving them out of specs. This includes adding the
FAS100A and FAS236 variants to the NCR53C9x core code. We probably
still subsume some chip variants as ESP200 while in fact they are
another variant which however shouldn't really matter as this will
only happen when these chips are driven at 25MHz or less which implies
not being able to run Fast-SCSI. [3]
- Add a workaround to the NCR53C9x interrupt handler which ignores the
stray interrupt generated by FAS100A when doing path inquiry during
boot and which otherwiese would trigger a panic.
- Add support for the 'esp' devices hanging off of a 'dma' or 'espdma'
busses or which are companions of 'dma' devices to esp(4). In case of
the variants that hang off of a DMA device this is a bit hackish as
esp(4) then directly uses the softc of the respective parent to talk
to the DMA engine. It might make sense to add an interface for this
in order to implement this in a cleaner way however it's not yet clear
how the requirements for the LANCE Ethernet controllers are and the
hack works for now. [2]
This effectively adds support for the onboard SCSI controller in
Ultra 1 as well as most of the ESP-based SBus add-on cards to esp(4).
With this the code for supporting the Performance Technologies SBS430
SBus SCSI add-on cards is also largely in place the remaining bits
were however omitted as it's unclear from the NetBSD how to couple
the DMA engine and the core logic together for these cards.

Obtained from: OpenBSD [1]
Obtained from: NetBSD [2]
Clue from: BSD/OS [3]
Reviewed by: scottl (earlier version)
Tested with: FSBE/S add-on card (FAS236), SSHA add-on card (ESP100A),
Ultra 1 (onboard FAS100A), Ultra 2 (onboard FAS366)

Apply a torniquet to the problem of the drive unexpectedly disconnecting
during a data phase. Before, we would try to recover the autosense, but
the DMA engine would still be active with interrupted transfer, and we'd
quickly spiral out of control and cause massive data corruption. For now,
just reset the chip and cancel everything. The better solution is to
cancel the DMA operation, but there is no clear way to do that right now.
The data corruption problem is severe enough to warrant this fix in the
interim. Thanks to Kris Kenneway to sacrificing countless filesystems to
this bug.

MFC After: 3 days

If we get interrupted during a data phase and the DMA engine is still
pumping data despite our scsi data counters being at 0, something has
gone massively wrong. The consequence of happily ignoring this is more
DMA phase errors and a disk full of spammed sectors. Instead, panic on
the first occurance to hopefully limit the damage.

MFC After: 3 days

Merge some style and minor changes from NetBSD:
- ncr53c9x.c:
1.108: Remove unreachable break after return and goto statements.
1.109: avoid strong words; use 'screw' instead
1.110: Fix some typos. From Tom Cosgrove via jmc@openbsd.
1.114: nuke trailing whitespace

1.107 was already merged, 1.112 and 1.113 are not relevant for FreeBSD.
1.111 is a functional change and will be merged later.

- ncr53c9xreg.h:
1.12: DMA, not dma nor Dma.
1.13: Fix some typos. From Tom Cosgrove via jmc@openbsd.
1.14: nuke trailing whitespace

- ncr53c9xvar.h:
1.43: Fix some typos. From Tom Cosgrove via jmc@openbsd.
1.44: Constify.

1.42 and 1.46 were already merged, 1.45 is not relevant for FreeBSD.

The existing locking in the esp driver appears to be fairly adequate, so
set the interrupt handler to be INTR_MPSAFE now that xpt_done() can be
called without Giant. Giant is still on the top half of the driver and
the timeout handlers.

Start each of the license/copyright comments with /*-, minor shuffle of lines

Add some style(9) touch ups; style(9) states that new code should follow
these conventions and, well, this is a new driver.

Tested on: i386, sparc64
Reviewed by: scottl

Pass the correct argument to ncr53c9x_timeout()

Get rid of UMA zones and instead allocate all ecb's up front and track them
in a TAILQ. Re-arrange some of the ecb elements so that they can stay
stable through alloc/free cycles while the rest get bzero'd.

- Use the tag_id from the ecb rather than fro the ccb. The latter is only
for target mode.

- Honor the ccb flags for tag_action when deciding whether to do a tagged
or untagged transaction.

- Re-arrange autosense completion so that it works correctly in failure
cases.

- Turn on the PI_TAG_ABLE flag so that CAM will send us tagged transactions.

This enables tagged queueing in the driver.

When autosense is retrieved, tell CAM about it instead of juust pretending
that the command succeeded. Sheesh! This makes CDROMs no longer cause an
instant panic at boot. Thanks to Jake Burkholder for providing a remote
test setup.
Also make device resets work, thanks to another typo.

Make the XPT_CALC_GEOMETRY op dependent on the sc_extended_geometry flag
that is set in the bus front-end.

Port the NetBSD esp(4) driver. This only includes the sbus front-end, so
its primary use is for the FEPS/FAS366 SCSI found in Sun Ultra 1e and 2
machines. Once the pci front-end is ported, this driver can replace the
amd(4) driver.

The code as-is is fairly stable. I've disabled tagged-queueing until I can
figure out a corruption bug related to it. I'm importing it now so that
people with these machines can (finally) stop netbooting and report bugs
before 5.3.