MFC r311305 (by asomers):
Always null-terminate ccb_pathinq.(sim_vid|hba_vid|dev_name)

The sim_vid, hba_vid, and dev_name fields of struct ccb_pathinq are
fixed-length strings. AFAICT the only place they're read is in
sbin/camcontrol/camcontrol.c, which assumes they'll be null-terminated.
However, the kernel doesn't null-terminate them. A bunch of copy-pasted code
uses strncpy to write them, and doesn't guarantee null-termination. For at
least 4 drivers (mpr, mps, ciss, and hyperv), the hba_vid field actually
overflows. You can see the result by doing "camcontrol negotiate da0 -v".

This change null-terminates those fields everywhere they're set in the
kernel. It also shortens a few strings to ensure they'll fit within the
16-character field.

PR: 215474
Reported by: Coverity
CID: 1009997 1010000 1010001 1010002 1010003 1010004 1010005
CID: 1331519 1010006 1215097 1010007 1288967 1010008 1306000
CID: 1211924 1010009 1010010 1010011 1010012 1010013 1010014
CID: 1147190 1010017 1010016 1010018 1216435 1010020 1010021
CID: 1010022 1009666 1018185 1010023 1010025 1010026 1010027
CID: 1010028 1010029 1010030 1010031 1010033 1018186 1018187
CID: 1010035 1010036 1010042 1010041 1010040 1010039

Copy head@r302406 to stable/11 as part of the 11.0-RELEASE cycle.
Prune svn:mergeinfo from the new branch, as nothing has been merged
here.

Additional commits post-branch will follow.

Approved by: re (implicit)
Sponsored by: The FreeBSD Foundation

Reform the busdma API so that new types may be added without modifying
every architecture's busdma_machdep.c. It is done by unifying the
bus_dmamap_load_buffer() routines so that they may be called from MI
code. The MD busdma is then given a chance to do any final processing
in the complete() callback.

The cam changes unify the bus_dmamap_load* handling in cam drivers.

The arm and mips implementations are updated to track virtual
addresses for sync(). Previously this was done in a type specific
way. Now it is done in a generic way by recording the list of
virtuals in the map.

Submitted by: jeff (sponsored by EMC/Isilon)
Reviewed by: kan (previous version), scottl,
mjacob (isp(4), no objections for target mode changes)
Discussed with: ian (arm changes)
Tested by: marius (sparc64), mips (jmallet), isci(4) on x86 (jharris),
amd64 (Fabian Keil <freebsd-listen@fabiankeil.de>)

In sys/dev/aic7xxx/aic79xx_osm.c, function ahd_attach(), initialize the
'path' variable to NULL, to avoid using it uninitialized in certain
cases.

Found by: clang
MFC after: 1 week

Fix an issue that caused the kernel to panic inside CTL when trying
to attach to target capable HBAs that implement the old immediate
notify (XPT_IMMED_NOTIFY) and notify acknowledge (XPT_NOTIFY_ACK)
CCBs. The new API has been in place since SVN change 196008 in
2009.

The solution is two-fold: fix CTL to handle the responses from the
HBAs, and convert the HBA drivers in question to use the new API.

These drivers have not been tested with CTL, so how well they will
interoperate with CTL is unknown.

scsi_target.c: Update the userland target example code to use the
new immediate notify API.

scsi_ctl.c: Detect when an immediate notify CCB is returned
with CAM_REQ_INVALID or CAM_PROVIDE_FAIL status,
and just free it.

Fix a duplicate assignment.

aic79xx.c,
aic79xx_osm.c: Update the aic79xx driver to use the new API.
Target mode is not enabled on for this driver, so
the changes will have no practical effect.

aic7xxx.c,
aic7xxx_osm.c: Update the aic7xxx driver to use the new API.

sbp_targ.c: Update the firewire target code to work with the
new API.

mpt_cam.c: Update the mpt(4) driver to work with the new API.
Target mode is only enabled for Fibre Channel
mpt(4) devices.

MFC after: 3 days

Document the usfs driver and the NO_SYSCTL_DESCR option, and update the comment for umass.
Don't include the sysctl description variables in aic7xxx when NO_SYSCTL_DESCR is used.

Approved by: rrs (mentor)

Add sysctls in ahd(4) in order to keep track of different classes of
errors. So far 3 different classes are present (correctable,
uncorrectable and fatal) but more can be added easilly.

Obtained from: Sandvine Incorporated
Reviewed by: emase, gibbs
Sponsored by: Sandvine Incorporated
MFC: 2 weeks

Make ddb command registration dynamic so modules can extend
the command set (only so long as the module is present):
o add db_command_register and db_command_unregister to add and remove
commands, respectively
o replace linker sets with SYSINIT's (and SYSUINIT's) that register
commands
o expose 3 list heads: db_cmd_table, db_show_table, and db_show_all_table
for registering top-level commands, show operands, and show all operands,
respectively

While here also:
o sort command lists
o add DB_ALIAS, DB_SHOW_ALIAS, and DB_SHOW_ALL_ALIAS to add aliases
for existing commands
o add "show all trace" as an alias for "show alltrace"
o add "show all locks" as an alias for "show alllocks"

Submitted by: Guillaume Ballet <gballet@gmail.com> (original version)
Reviewed by: jhb
MFC after: 1 month

Only print sense data diagnostics if debugging is enabled with the
AHD_SHOW_SENSE flag.

Remove superfluous setting of the transport_version field of our
path inquiry response - a likely holdover from the port of this code
from the aic7xxx driver.

Advertise to CAM the ability of 790X controllers to negotiate information
unit transfers (packetized/U320 protocol) and QAS.

Prepare for future integration between CAM and newbus. xpt_bus_register
now takes a device_t to be the parent of the bus that is being created.
Most SIMs have been updated with a reasonable argument, but a few exceptions
just pass NULL for now. This argument isn't used yet and the newbus
integration likely won't be ready until after 7.0-RELEASE.

Basic MPSAFE locking for the AHC and AHD drivers.

Remove Giant from CAM. Drivers (SIMs) now register a mutex that CAM will
use to synchornize and protect all data objects that are used for that
SIM. Drivers that are not yet MPSAFE register Giant and operate as
usual. RIght now, no drivers are MPSAFE, though a few will be changed
in the coming week as this work settles down.

The driver API has changed, so all CAM drivers will need to be recompiled.
The userland API has not changed, so tools like camcontrol do not need to
be recompiled.

o break newbus api: add a new argument of type driver_filter_t to
bus_setup_intr()

o add an int return code to all fast handlers

o retire INTR_FAST/IH_FAST

For more info: http://docs.freebsd.org/cgi/getmsg.cgi?fetch=465712+0+current/freebsd-current

Reviewed by: many
Approved by: re@

2nd and final commit that moves us to CAM_NEW_TRAN_CODE
as the default.

Reviewed by multitudes.

Clean up the way we handle auxiliary commands for a given ddb command
table. Previously, the ddb code knew of each linker set of auxiliary
commands and which explicit command list they were tied to. These changes
add a simple command_table struct that contains both the static list of
commands and the pointers for any auxiliary linker set of additional
commands. This also makes it possible for other arbitrary command tables
to be defined in other parts of the kernel w/o having to edit ddb itself.

The DB_SET macro has also been trimmed down to just creating an entry in
a linker set. A new DB_FUNC macro does what the old DB_SET did which is
to not only add an entry to the linker set but also to include a function
prototype for the function being added. With these changes, it's now also
possible to create aliases for ddb functions using DB_SET() directly if
desired.

Fix -Wundef.

Correct bug that caused the completed "recovery" scb to have its
timer reset rather than the timer of an SCB still pending on the
controller after recovery completed. This should correct timeout
loops seen in the field.

MF5S: Explicitly initialize timedout_scb lists, use SCB_TAG for all access
to the hardware_scb->tag field, limit max lun reported to CAM to 63,
return after a panic to silence a warning.

Start each of the license/copyright comments with /*-, minor shuffle of lines

Add an ISA attachement to the aic7xxx driver to handle 284X controllers.
The ISA probe uses an identify routine to probe all slot locations from
1 to 14 that do not conflict with other allocated resources. This required
making aic7770.c part of the driver core when compiled as a module.

aic7xxx.c:
aic79xx.c:
aic_osm_lib.c:
Use aic_scb_timer_start() consistently to start the watchdog timer.
This removes a few places that verbatum copied the code in
aic_scb_timer_start().

During recovery processing, allow commands to still be queued to
the controller. The only requirement we have is that our recovery
command be queued first - something the code already guaranteed.
The only other change required to make this work is to prevent
timers from being started for these newly queued commands.

Approved by: re

Correct a very rare case where command ordering could be compromised
by a transaction performing a driver handled message sequence (an
scb with the MK_MESSAGE flag set).

SCBs that perform host managed messaging must always be
at the head of their per-target selection queue so that
the firmware knows to manually assert ATN if the current
negotiation agreement is packetized. In the past we
guaranteed this by queuing these SCBs separarately in
the execution queue. This exposes the system to potential
command reordering in two cases:

1) Another SCB for the same ITL nexus is queued that does
not have the MK_MESSAGE flag set. This SCB will be
queued to the per-target list which can be serviced
before the MK_MESSAGE scb that preceeded it.

2) If the target cannot accept all of the commands in the
per-target selection queue in one selection, the remainder
is queued to the tail of the selection queues so as to
effect round-robin scheduling. This could allow the
MK_MESSAGE scb to be sent to the target before the
requeued commands.

This commit changes the firmware policy to defer queuing
MK_MESSAGE SCBs into the selection queues until this can
be done without affecting order. This means that the
target's selection queue is either empty, or the last
SCB on the execution queue is also a MK_MESSAGE SCB.
During any wait, the firmware halts the download of new
SCBs so only a single "holding location" is required.

Luckily, MK_MESSAGE SCBs are rare and typically occur only
during CAM's bus probe where only one command is outstanding
at a time. However, during some recovery scenarios, the
reordering *could* occur.

aic79xx.c:
Update ahd_search_qinfifo() and helper routines to
search for pending MK_MESSAGE scbs and properly
restitch the execution queue if either the MK_MESSAGE
SCB is being aborted, or the MK_MESSAGE SCB can be
queued due to the execution queue draining due to
aborts.

Enable LQOBUSFREE status to assert an interrupt.
This should be redundant since a BUSFREE interrupt
should always occur along with an LQOBUSFREE event,
but on the Rev A, this doesn't seem to be guaranteed.

When a PPR request is rejected when a previously
existing packetized agreement is in place, assume
that the target has been reset without our knowledge
and revert to async/narrow transfers. This corrects
two issues: the stale ENATNO setting that was used
to send the PPR is cleared so the firmware is not
confused by a future packetized selection with
ATN asserted but no MK_MESSAGE flag in the SCB and
it speeds up recovery by aborting any pending
packetized transactions that by definition are now
dead.

When re-queueing SCBs after a failed negotiation
attempt, ensure command ordering by freezing the
device queue first.

Traverse the list of pending SCBs rather than the
whole SCB array on the controller when pushing
MK_MESSAGE flag changes out to the controller.
The original code was optimized for the aic7xxx
controllers where there are fewer controller slots
then pending SCBs and the firmware picks SCB
slots. For the U320 controller, the hope is
that we have fewer pending SCBs then the 512
slots on the controller.

Enhance some diagnostics.

Factor out some common code.

aic79xx.h:
Add prototype for new ahd_done_with_status() that is
used to factor out some commone code.

aic79xx.reg:
Add definisions for the pending MK_MESSAGE SCB.

aic79xx.seq:
Defer MK_MESSAGE SCB queing to the execution queue
so as to preserve command ordering. Re-arrange some
of the selection processing code so the above change
had no performance impact on the common code path.

Close a few critical section holes.

When entering a non-packetized phase, manually enable
busfree interrupts, since the controller hardware
does not do this automatically.

aic79xx_inline.h:
Enhance logging for queued SCBs.

aic79xx_osm.c:
Add new a new DDB ahd command, ahd_dump, which
invokes the ahd_dump_card_state() routine on the
unit specified with the ahd_sunit DDB command.

aic79xx_pci.c:
Turn on the BUSFREEREV bug for the Rev B. controller.
This is required to close the busfree during non-packetized
phase hole.

Do a pass over all modules in the kernel and make them return EOPNOTSUPP
for unknown events.

A number of modules return EINVAL in this instance, and I have left
those alone for now and instead taught MOD_QUIESCE to accept this
as "didn't do anything".

ahc_eisa.c:
ahc_pci.c:
ahd_pci.c:
aic7xxx.c:
aic79xx.c:
aic_osm_lib.c:
aic_osm_lib.h:
Use common OSM routines from aic_osm_lib for bus dma operations,
delay routines, accessing CCBs, byte swapping, etc.

aic7xxx_pci.c:
Provide a better description for the 2915/30LP on attach.

aic7xxx.c:
aic79xx.c:
aic7770.c:
aic79xx_pci.c:
aic7xxx_pci.c:
aic7xxx_93cx6.c:
Move FBSDID behind an ifdef so that these core files will
still compile under other OSes.

aic79xx.h:
aic79xx_pci.c:
aic79xx.seq:
To speed up non-packetized CDB delivery in Rev B, all CDB
acks are "released" to the output sync as soon as the
command phase starts. There is only one problem with this
approach. If the target changes phase before all data are
sent, we have left over acks that can go out on the bus in
a data phase. Due to other chip contraints, this only
happens if the target goes to data-in, but if the acks go
out before we can test SDONE, we'll think that the transfer
has completed successfully. Work around this by taking
advantage of the 400ns or 800ns dead time between command
phase and the REQ of the new phase. If the transfer has
completed successfully, SCSIEN should fall *long* before we
see a phase change. We thus treat any phasemiss that
occurs before SCSIEN falls as an incomplete transfer.

aic79xx.h:
Add the AHD_FAST_CDB_DELIVERY feature.

aic79xx_pci.c:
Set AHD_FAST_CDB_DELIVERY for all Rev. B parts.

aic79xx.seq:
Test for PHASEMIS in the command phase for
all AHD_FAST_CDB_DELIVERY controlelrs.

ahd_pci.c:
ahc_pci.c:
aic7xxx.h:
aic79xx.h:
Move definition of controller BAR offsets to core header files.

aic7xxx.c:
aic79xx.c:
In the softc free routine, leave removal of a softc from the
global list of softcs to the OSM (the caller of this routine).
This allows us to avoid holding the softc list_lock during device
destruction where we may have to sleep waiting for our recovery
thread to halt.

ahc_pci.c:
Use ahc_pci_test_register access to validate I/O mapped in
addition to the tests already performed for memory mapped
access.

Remove unused ahc_power_state_change() function. The PCI
layer in both 4.X and 5.X now offer this functionality.

ahd_pci.c:
Remove reduntant definition of controller BAR offsets. These
are also defined in aic79xx.h.

Remove unused ahd_power_state_change() function. The PCI
layer in both 4.X and 5.X now offer this functionality.

aic7xxx.c:
aic79xx.c:
aic79xx.h:
aic7xxx.h:
aic7xxx_osm.c:
aic79xx_osm.c:
Move timeout handling to the driver cores. In the case
of the aic79xx driver, the algorithm has been enhanced
to try target resets before performing a bus reset. For
the aic7xxx driver, the algorithm is unchanged. Although
the drivers do not currently sleep during recovery (recovery
is timeout driven), the cores do expect all processing to
be performed via a recovery thread. Our timeout handlers
are now little stubs that wakeup the recovery thread.

aic79xx.c:
aic79xx.h:
aic79xx_inline.h:
Change shared_data allocation to use a map_node so
that the sentinel hscb can use this map node in
ahd_swap_with_next_hscb. This routine now swaps
the hscb_map pointer in additon to the hscb
contents so that any sync operations occur on
the correct map.

physaddr -> busaddr

Pointed out by: Jason Thorpe <thorpej@wasabisystems.com>

aic79xx.c:
Make more use of the in/out/w/l/q macros for accessing
byte registers in the chip.

Correct some issues in the ahd_flush_qoutfifo() routine.
o Run the qoutfifo only once the command channel
DMA engine has been halted. This closes a window
where we might have missed some entries.
o Change ahd_run_data_fifo() to not loop to completion.
If we happen to start on the wrong FIFO and the other
FIFO has a snapshot savepointers, we might deadlock.
This required our delay between FIFO tests to be
moved to the ahd_flush_qoutfifo() routine.
o Update/add comments.
o Remove spurious test for COMPLETE_DMA list being empty
when completing transactions from the GSFIFO with
residuals. The SCB must be put on the COMPLETE_DMA
scb list unconditionally.
o When halting command channel DMA activity, we must
disable the DMA channel in all cases but an update
of the QOUTFIFO. The latter case is required so
that the sequencer will update its position in the
QOUTFIFO. Previously, we left the channel enabled
for all "push" DMAs. This left us vulnerable to
the sequencer handling an SCB push long after that
SCB was already processed manually by this routine.
o Correct the polarity of tests involving
ahd_scb_active_in_fifo(). This routine returns
non-zero for true.

Return to processing bad status completions through
the qoutfifo. This reduces the time that the sequencer
is kept paused when handling transactions with bad
status or underruns.

When waiting for the controller to quiece selections,
add a delay to our loop. Otherwise we may fail to wait
long enough for the sequencer to comply.

On H2A4 hardware, use the slow slewrate for non-paced
transfers. This mirrors what the Adaptec Windows
drivers do.

On the Rev B. only slow down the CRC timing for
older U160 devices that might need the slower timing.
We define "older" as devices that do not support
packetized protocol.

Wait up to 5000 * 5us for the SEEPROM to become unbusy.
Write ops seem to take much longer than read ops.

aic79xx.seq:
For controllers with the FAINT_LED bug, turn the diagnostic
led feature on during selection and reselection. This covers
the non-packetized case. The LED will be disabled for
non-packetized transfers once we return to the top level idle
loop. Add more comments about the busy LED workaround.

Extend a critical section around the entire
command channel idle loop process. Previously
the portion of this handler that directly manipulated
the linked list of completed SCBs was not protected.
This is the likely cause of the recent reports of
commands being completed twice by the driver.

Extend critical sections across the test for,
and the longjump to, longjump routines. This
prevents the firmware from trying to jump to
a longjmp handler that was just cleared by the
host.

Improve the locations of several critical section
begin and end points. Typically these changes
remove instructions that did not need to be
inside a critical section.

Close the "busfree after selection, but before busfree
interrupts can be enabled" race to just a single sequencer
instruction. We now test the BSY line explicitly before
clearing the busfree status and enabling the busfree
interrupt.

Close a race condition in the processing of HS_MAILBOX
updates. We now clear the "updated" status before the
copy. This ensures that we don't accidentally clear
the status incorrectly when the host sneaks in an update
just after our last copy, but before we clear the status.
This race has never been observed.

Don't re-enable SCSIEN if we lose the race to disable SCSIEN
in our interrupt handler's workaround for the RevA data-valid
too early issue.

aic79xx_inline.h:
Add comments indicating that the order in which bytes are
read or written in ahd_inw and ahd_outw is important. This
allows us to use these inlines when accessing registers with
side-effects.

aic79xx_pci.c:
The 29320 and the 29320B are 7902 not 7901 based products.
Correct the driver banner.

aic7xxx.h:
Enable the use of the auto-access pause feature
on the aic7870 and aic7880. It was disabled due
to an oversight.

aic7xxx.reg:
Move TARG_IMMEDIATE_SCB to alias LAST_MSG to
avoid leaving garbage in MWI_RESIDUAL. This
prevents spurious overflows whn operating target
mode on controllers that require the MWI_RESIDUAL
work-around.

aic7xxx.seq:
AHC_TMODE_WIDEODD_BUG is a bug, not a softc flag.
Reference the correct softc field when testing
for its presence.

Set the NOT_IDENTIFIED and NO_CDB_SENT bits
in SEQ_FLAGS to indicate that the nexus is
invalid in await busfree.

aic7xxx_93cx6.c:
Add support for the C56/C66 versions of the EWEN and EWDS
commands.

aic7xxx.c:
aic7xxx_pci.c:
Move test for the validity of left over BIOS data
to ahc_test_register_access(). This guarantees that
any left over CHIPRST value is not clobbered by our
register access test and lost to the test that was
in ahc_reset.

Use __FBSDID().
Also some minor style cleanups.

Merge common XPT_CALC_GEOMETRY functions into a single convenience function.
Devices below may experience a change in geometry.

* Due to a bug, aic(4) never used extended geometry. Changes all drives
>1G to now use extended translation.
* sbp(4) drives exactly 1 GB in size now no longer use extended geometry.
* umass(4) drives exactly 1 GB in size now no longer use extended geometry.

For all other controllers in this commit, this should be a no-op.

Looked over by: scottl

Sync perforce IDs.

Bring back bus_dmasync_op_t. It is now a typedef to an int, though the
BUS_DMASYNC_ definitions remain as before. The does not change the ABI,
and reverts the API to be a bit more compatible and flexible. This has
survived a full 'make universe'.

Approved by: re (bmah)

Correct spelling errors.

Switch to handling bad SCSI status as a sequencer interrupt
instead of having the kernel proccess these failures via
the completion queue. This is done because:

o The old scheme required us to pause the sequencer and clear
critical sections for each SCB. It seems that these pause
actions, if coincident with a sequencer FIFO interrupt, would
result in a FIFO interrupt getting lost or directing to the
wrong FIFO. This caused hangs when the driver was stressed
under high "queue full" loads.
o The completion code assumed that it was always called with
the sequencer running. This may not be the case in timeout
processing where completions occur manually via
ahd_pause_and_flushwork().
o With this scheme, the extra expense of clearing critical
sections is avoided since the sequencer will only self pause
once all pending selections have cleared and it is not in
a critical section.

aic79xx.c
Add code to handle the new BAD_SCB_STATUS sequencer
interrupt code. This just redirects the SCB through
the already existing ahd_complete_scb() code path.
Remove code in ahd_handle_scsi_status() that paused
the sequencer, made sure that no selections where
pending, and cleared critical sections. Bad
status SCBs are now only processed when all of these
conditions are true.

aic79xx.reg:
Add the BAD_SCB_STATUS sequencer interrupt code.

aic79xx.seq:
When completing an SCB upload to the host, if
we are doing this because the SCB contains non-zero
SCSI status, defer completing the SCB until there
are no pending selection events. When completing
these SCBs, use the new BAD_SCB_STATUS sequencer
interrupt. For all other uploaded SCBs (currently
only for underruns), the SCB is completed via the
normal done queue. Additionally, keep the SCB that
is currently being uploaded on the COMPLETE_DMA_SCB
list until the dma is completed, not just until the
DMA is started. This ensures that the DMA is restarted
properly should the host disable the DMA transfer for
some reason.

In our RevA workaround for Maxtor drives, guard against
the host pausing us while trying to pause I/O until the
first data-valid REQ by clearing the current snapshot
so that we can tell if the transfer has completed prior
to us noticing the REQINIT status.

In cfg4data_intr, shave off an instruction before getting
the data path running by adding an entrypoint to the
overrun handler to also increment the FIFO use count.

In the overrun handler, be sure to clear our LONGJMP
address in both exit paths.

Perform a few sequencer optimizations.

aic79xx.c:
Print the full path from the SCB when a packetized
status overrun occurs.

Remove references to LONGJMP_SCB which is being
removed from firmware usage.

Print the new SCB_FIFO_USE_COUNT field in the
per-SCB section of ahd_dump_card_state(). The
SCB_TAG field is now re-used by the sequencer,
so it no longer makes sense to reference this
field in the kernel driver.

aic79xx.h:
Re-arrange fields in the hardware SCB from largest
size type to smallest. This makes it easier to
move fields without changing field alignment.

The hardware scb tag field is now down near the
"spare" portion of the SCB to facilitate reuse
by the sequencer.

aic79xx.reg:
Remove LONGJMP_ADDR.

Rearrange SCB fields to match aic79xx.h.
Add SCB_FIFO_USE_COUNT as the first byte
of the SCB_TAG field.

aic79xx.seq:
Add a per-SCB "Fifos in use count" field and use
it to determine when it is safe (all data posted)
to deliver status back to the host. The old method
involved polling one or both FIFOs to verify that
the current task did not have pending data. This
makes running down the GSFIFO very cheap, so we
will empty the GSFIFO in one idle loop pass in
all cases.

Use this simplification of the completion process
to prune down the data FIFO teardown sequencer for
packetized transfers. Much more code is now shared
between the data residual and transfer complete cases.

Correct some issues in the packetized status handler.
It used to be possible to CLRCHN our FIFO before status
had fully transferred to the host. We also failed to
handle NONPACKREQ phases that could occur should a CRC
error occur during transmission of the status data packet.

Correct a few big endian issues:

aic79xx.c:
aic79xx_inline.h:
aic79xx_pci.c:
aic79xx_osm.c:
o Always get the SCB's tag via the SCB_GET_TAG acccessor
o Add missing use of byte swapping macros when touching
hscb fields.
o Don't double swap SEEPROM data when it is printed.
Correct a big-endian bug. We cannot assign a
o When assigning a 32bit LE variable to a 64bit LE
variable, we must be explict about how the words
of the 64bit LE variable are initialized. Cast to
(uint32_t*) to do this.

aic79xx.c:
In ahd_clear_critical_section(), hit CRLSCSIINT
after restoring the interrupt masks to avoid what
appears to be a glitch on SCSIINT. Any real SCSIINT
status will be persistent and will immidiately
reset SCSIINT. This clear should only get rid of
spurious SCSIINTs.

This glitch was the cause of the "Unexpected PKT busfree"
status that occurred under high queue full loads

Call ahd_fini_scbdata() after shutdown so that
any ahd_chip_init() routine that might access
SCB data will not access free'd memory.

Reset the bus on an IOERR since the chip doesn't
seem to reset to the new voltage level without
this.

Change offset calculation for scatter gather maps
so that the calculation is correct if an integral
multiple of sg lists does not fit in the allocation
size.

Adjust bus dma tag for data buffers based on 39BIT
addressing flag in our softc.

Use the QFREEZE count to simplify ahd_pause_and_flushworkd().
We can thus rely on the sequencer eventually clearing ENSELO.

In ahd_abort_scbs(), fix a bug that could potentially
corrupt sequencer state. The saved SCB was being
restored in the SCSI mode instead of the saved mode.
It turns out that the SCB did not need to be saved at all
as the scbptr is already restored by all subroutines
called during this function that modify that register.

aic79xx.c:
aic79xx.h:
aic79xx_pci.c:
Add support for parsing the seeprom vital product
data. The VPD data are currently unused.

aic79xx.h:
aic79xx.seq:
aic79xx_pci.c:
Add a firmware workaround to make the LED blink
brighter during packetized operations on the H2A.

aic79xx_inline.h:
The host does not use timer interrupts, so don't
gate our decision on whether or not to unpause
the sequencer on whether or not a timer interrupt
is pending.

I deserve a big pointy hat for having missed all those references
to bus_dmasync_op_t in my last commit.

Compile with PAE.

aic79xx.c:
Clear the LQICRC_NLQ status should it pop up after we have
already handled the SCSIPERR. During some streaming operations
this status can be delayed until the stream ends. Without this
change, the driver would complain about a "Missing case in
ahd_handle_scsiint".

In the LQOBUSFREE handler...

Don't return the LQOMGR back to the idle state until after
we have cleaned up ENSELO and any status related to this
selection. The last thing we need is the LQO manager starting
another select-out before we have updated the execution queue.
It is not clear whether the LQOMGR would, or would not
start a new selection early.

Make sure ENSELO is off prior to clearing SELDO by flushing
device writes.

Move assignment of the next target SCB pointer inside of
an if to make the code clearer. The effect is the same.

Dump card state in both "Unexpected PKT busfree" paths.

In ahd_reset(), set the chip to SCSI mode before reading SXFRCTL1.
That register only exists in the SCSI mode. Also set the mode
explicitly to the SCSI mode after chip reset due to paranoia.
Re-arrange code so that SXFRCTL1 is restored as quickly after the
chip reset as possible.

S/G structurs must be 8byte aligned. Make this official by saying
so in our DMA tag.

Disable CIO bus stretch on MDFFSTAT if SHVALID is about to come
true. This can cause a CIO bus lockup if a PCI or PCI-X error
occurs while the stretch is occurring - the host cannot service
the PCI-X error since the CIO bus is locked out and SHVALID will
never resolve. The stretch was added in the Rev B to simplify the
wait for SHVALID to resolve, but the code to do this in the open
source sequencer is so simple it was never removed.

Consistently use MAX_OFFSET for the user max syncrate set from
non-volatile storage. This ensures that the offset does not
conflict with AH?_OFFSET_UNKNOWN.

Have ahd_pause_and_flushwork set the mode to ensure that it has
access to the registers it checks. Also modify the checking of
intstat so that the check against 0xFF can actually succeed if
the INT_PEND mask is something other than 0xFF. Although there
are no cardbus U320 controllers, this check may be needed to
recover from a hot-plug PCI removal that occurs without informing
the driver.

Fix a typo. sg_prefetch_cnt -> sg_prefetch_align. This fixes
an infinite loop at card initialization if the cacheline size is 0.

aic79xx.h:
Add AHD_EARLY_REQ_BUG bug flag.

Fix spelling errors.

Include the CDB's length just after the CDB pointer in the DMA'ed
CDB case.

Change AH?_OFFSET_UNKNOWN to 0xFF. This is a value that the
curr->offset can never be, unlike '0' which we previously used.
This fixes code that only checks for a non-zero offset to
determine if a sync negotiation is required since it will fire
in the unknown case even if the goal is async.

aic79xx.reg:
Add comments for LQISTAT bits indicating their names in the 7902
data book. We use slightly different and more descriptive names
in the firmware.

Fix spelling errors.

Include the CDB's length just after the CDB pointer in the DMA'ed
CDB case.

aic79xx.seq:
Update comments regarding rundown of the GSFIFO to reflect reality.

Fix spelling errors.

Since we use an 8byte address and 1 byte length, shorten the size
of a block move for the legacy DMA'ed CDB case from 11 to 9 bytes.

Remove code that, assuming the abort pending feature worked, would
set MK_MESSAGE in the SCB's control byte on completion to catch
invalid reselections. Since we don't see interrupts for completed
selections, this status update could occur prior to us noticing the
SELDO. The "select-out" queue logic will get confused by the
MK_MESSAGE bit being set as this is used to catch packatized
connections where we select-out with ATN. Since the abort pending
feature doesn't work on any released controllers yet, this code was
never executed.

Add support for the AHD_EARLY_REQ_BUG. Don't ignore persistent REQ
assertions just because they were asserted within the bus settle delay
window. This allows us to tolerate devices like the GEM318 that
violate the SCSI spec.

Remove unintentional settnig of SG_CACHE_AVAIL. Writing this bit
should have no effect, but who knows...

On the Rev A, we must wait for HDMAENACK before loading additional
segments to avoid clobbering the address of the first segment in
the S/G FIFO. This resolves data-corruption issues with certain
IBM (now Hitachi) and Fujitsu U320 drives.

Rearrange calc_residual to avoid an extra jmp instruction.

On RevA Silicon, if the target returns us to data-out after we
have already trained for data-out, it is possible for us to
transition the free running clock to data-valid before the required
100ns P1 setup time (8 P1 assertions in fast-160 mode). This will
only happen if this L-Q is a continuation of a data transfer for
which we have already prefetched data into our FIFO (LQ/Data
followed by LQ/Data for the same write transaction). This can
cause some target implementations to miss the first few data
transfers on the bus. We detect this situation by noticing that
this is the first data transfer after an LQ (LQIWORKONLQ true),
that the data transfer is a continuation of a transfer already
setup in our FIFO (SAVEPTRS interrupt), and that the transaction
is a write (DIRECTION set in DFCNTRL). The delay is performed by
disabling SCSIEN until we see the first REQ from the target.

Only compile in snapshot savepointers handler for RevA silicon
where it is enabled.

Handle the cfg4icmd packetized interrupt. We just need to load
the address and count, start the DMA, and CLRCHN once the transfer
is complete.

Fix an oversight in the overrun handler for packetized status
operations. We need to wait for either CTXTDONE or an overrun
when checking for an overrun. The previous code did not wait
and thus could decide that no overrun had occurred even though
an overrun will occur on the next data-valid req. Add some
comment to this section for clarity.

Use LAST_SEG_DONE instead of LASTSDONE for testing transfer
completion in the packetized status case. LASTSDONE may come up
more quickly since it only records completion on the SCSI side,
but since LAST_SEG_DONE is used everywhere else (and needs to be),
this is less confusing.

Add a missing invalidation of the longjmp address in the non-pack
handler. This code needs additional review.

aic79xx_inline.h:
Fix spelling error.

aic79xx_osm.c:
Set the cdb length for CDBs dma'ed from host memory.

Add a comment indicating that, should CAM start supporting cdbs
larger than 16bytes, the driver could store the CDB in the status
buffer.

aic79xx_pci.c:
Add a table entry for the 39320A.

Added a missing comma to an error string table.

Fix spelling errors.

aic79xx.c:
Implement the SCB_SILENT flag. This is useful for
hushing up the driver during DV or other operations
that we expect to cause transmission errors. The
messages will still print if the SHOW_MASKED_ERRORS
debug option is enabled.

Save and restore the NEGOADDR address when setting
new transfer settings. The sequencer performs lookups
in the negotiation table too and it expects NEGOADDR
to remain consistent across pause/unpause sessions.

Consistently use "offset" instead of "period" to determine
if we are running sync or not.

Add a SHOW_MESSAGES diagnostic for when we assert ATN
during message processing.

Print out IU, QAS, and RTI features when showing transfer options.

Limit the syncrate after all option conformance
changes have taken place in ahd_devlimited_syncrate.
Changes in options may change the final syncrate we
accept.

Keep a copy of the hs_mailbox in our softc so that
we can perform read/modify/write operations on the
hs_mailbox without having to pause the sequencer to
read the last written value. Use the ENINT_COALESS
flag in the hs_mailbox to toggle interrupt coalessing.

Add entrypoints for enabling interrupt coalessing and
setting both a timeout (how long to wait for commands
to be coalessed) and a maximum commands to coaless value.
Add a statistics timer that decides when to enable or
disable interrupt coalessing based on load.

Add a routine, ahd_reset_cmds_pending() which is used
to update the CMDS_PENDING sequencer variable whenever
error recovery compeltes SCBs without notifying the
sequencer. Since ahd_reset_cmds_pending is called
during ahd_unpause() only if we've aborted SCBs, its
call to ahd_flush_qoutfifo should not cause recursion
through ahd_run_qoutfifo(). A panic has been added to
ensure that this recursion does not occur.

In ahd_search_qinfifo, update the CMDS_PENDING sequencer
variable directly. ahd_search_qinififo can be called
in situations where using ahd_reset_cmds_pending() might
cause recursion. Since we can safely determine the
exact number to reduce CMDS_PENDING by in this scenario
without running the qoutfifo, the manual update is sufficient.

Clean up diagnostics.
Add ahd_flush_qoutfifo() which will run the qoutfifo
as well as complete any commands sitting on the
sequencer's COMPLETE_SCB lists or the good status FIFO.
Use this routine in several places that did similar
things in an add-hoc, but incomplete, fashion. A call
to this routine was also added to ahd_abort_scbs() to
close a race.

In ahd_pause_and_flushwork() only return once selections
are safely disabled. Flush all completed commands via
ahd_flush_qoutfifo().

Remove "Now packetized" diagnostic now that this
information is incorperated into the actual negotiation
messages that are displayed.

When forcing renegotiation, don't clober the current
ppr_options. Much of the driver uses this information
to determine if we are currently packetized or not.

Remove some stray spaces at column 1 in ahd_set_tags.

When complaining about getting a host message loop
request with no pending messages, print out the
SCB_CONTROL register down on the card.

Modify the ahd_sent_msg() routine to handle a search
for an outgoing identify message. Use this to detect
a msg reject on an identify message which typically
indicates that the target thought we were packetized.
Force a renegotiation in this case.

In ahd_search_qinfifo(), wait more effectively for SCB
DMA activities to cease. We also disable SCB fetch
operations since we are about to change the qinfifo
and any fetch in progress will likely be invalidated.

In ahd_qinfifo_count(), fix the qinfifo empty case.

In ahd_dump_card_state(), print out CCSCBCTL in the
correct mode.

If we are a narrow controller, don't set the current
width to unknown when forcing a future negotiation.
This just confuses the code into attempting a wide
negotiation on a narrow bus.

Add support for task management function completions.

Modify ahd_handle_devreset so that it can handle
lun resets in addition to target resets. Use
ahd_handle_devreset for lun and target reset task
management functions.

Handle the abort task TMF race case better. We now
wait until any current selections are over and then
set the TMF back to zero. This should cause the sequencer
to ignore the abort TMF completion should it occur.

Correct a bug in the illegal phase handler that
caused us to drop down to narrow when handling the
unexpected command phase case after 3rd party
reset of a packetized device.

Indicate the features, bugs, and flags set in the softc
that are used to control firmware patch download when
booting verbose.

aic79xx.h:
Add coalessing and HS_MAILBOX fields.

Add per-softc variables for the stats "daemon".

Add a debug option for interrupt coalessing activities.

Add two new softc flags:
o AHD_UPDATE_PEND_CMDS
Run ahd_reset_cmds_pending() on the next unpause.

o AHD_RUNNING_QOUTFIFO
Used to catch recursion through ahd_run_qoutfifo().

aic79xx.reg:
Correct register addresses related to the software timer
and the DFDBCTL register.

Add constants paramaterizing the software timer.

Add scratch ram locations for storing interrupt coalessing
tunables.

Break INTMASK in SEQITNCTL out into INTMASK1 and INTMASK2.
In at least the REV A, these are writable bits. We make
use of that for a swtimer workaround in the sequencer.

Since HS_MAILBOX autoclears, provide a sequencer variable
to store its contents.

Add SEQINT codes for handling task management completions.

aic79xx.seq:
Correct ignore wide residue processing check for
a wide negotiation being in effect. We must be
in the SCSI register window in order to access the
negotiation table.

Use the software timer and a commands completed count to
implement interrupt coalessing. The command complete is
deferred until either the maximum command threshold or a
the expiration of a command deferral timer. If we have
more SCBs to complete to the host (sitting in COMPLETE_SCB
lists), always try to coaless them up to our coalessing limit.
If coalessing is enabled, but we have fewer commands oustanting
than the host's min coalessing limit, complete the command
immediately.

Add code to track the number of commands outstanding.
Commands are outstanding from the time they are placed
into the execution queue until the DMA to post completion
is setup.

Add a workaround for intvec_2 interrupts on the H2A4.
In H2A4, the mode pointer is not saved for intvec2, but
is restored on iret. This can lead to the restoration
of a bogus mode ptr. Manually clear the intmask bits and
do a normal return to compensate. We use intvec_2 to
track interrupt coalessing timeouts.

Since we cannot disable the swtimer's countdown, simply
mask its interrupt once we no longer care about it firing.

In idle_loop_cchan, update LOCAL_HS_MAILBOX everytime
we are notified of an HS_MAILBOX update via the
HS_MAILBOX_ACT bit in QOFF_CTLSTA. We have to use a
local copy of persistant portions of the HS_MAILBOX as
the mailbox auto-clears on any read.

Move the test for the cfg4istat interrupt up an instruction
to hopefully close a race between the next outgoing selection
and our disabling of selections.

Add a missing ret to the last instruction in load_overrun_buf.

Add notifications to the host of task management
completions as well as the completions for commands
that completed successfully before their corresponding
TMF could be sent.

Hold a critical section during select-out processing
until we have a fully identified connection. This
removes a race condition with the legacy abort handler.

Correct a few spelling errors in some comments.

aic79xx_inline.h:
Call ahd_reset_cmds_pending() in ahd_unpause if required.

Update cmdcmplt interrupt statistics in our interrupt
handler.

Allow callers to ahd_send_scb() to set the task management
function.

aic79xx_pci.c:
Disable SERR and pause the controller prior to performing
our mmapped I/O test. The U320 controllers do not support
"auto-access-pause".

aic79xx_osm.c:
Set the task management function now that
ahd_send_scb() doesn't do it for us. We
also perform a lun reset in response to BDR
requests to packetized devices.

Synchronize perforce Id tags

Approved by: re (blanket)

Revisit the printf format fixes for alpha. intmax_t doesn't exist in
RELENG_4, so cast to u_long in order to stay compatible.

Approved by: re (blanket)

Fix printf format problems that were stopping LINT on alpha

Submitted by: jmallett, many others
Approved by: re

Enable card interrupts in our OSM rather than in the core.
This ensures that we don't enter our interrupt handler until
all OSM components it might reference have been fully initialized
during attach.

Remove vestiges of untagged queue handling.

Add hints to ahd_get_scb() so it knows what type of SCB collision
management to perform for each new transaction.

Properly disable/enable IU_REQ with changes in tagged queuing and
disconnection settings passed in by CAM.

Hook up the ahd driver.

Enter the ahd driver which supports the Adaptec AIC7902 Ultra320, PCI-X
SCSI Controller chip.