- Try to not leak resources in the attach functions of the esp(4) SBus

  front-end and the LSI64854 and NCR53C9x code in case one of these
  functions fails. Add detach functions to these parts and make esp(4)
  detachable.
- Revert rev. 1.7 of esp_sbus.c, since rev. 1.34 of sbus.c the clockfreq
  IVAR defaults to the per-child values.
- Merge ncr53c9x.c rev. 1.111 from NetBSD (partial):
  On reset, clear state flags and the msgout queue.
  In NetBSD code to notify the upper layer (i.e. CAM in FreeBSD) on reset
  was also added with this revision. This is believed to be not necessary
  in FreeBSD and was not merged.
  This makes ncr53c9x.c to be in sync with NetBSD up to rev. 1.114.
- Conditionalize the LSI64854 support on sbus(4) only instead of sbus(4)
  and esp(4) as it's also required for the 'dma', 'espdma' and 'ledma'
  busses/devices as well as the 'SUNW,bpp' device (printer port) which
  all hang off of sbus(4).
- Add a driver for the 'dma', 'espdma' and 'ledma' (pseudo-)busses/
  devices. These busses and devices actually represent the LSI64854 DMA
  engines for the ESP SCSI and LANCE Ethernet controllers found on the
  SBus of Ultra 1 and SBus add-on cards. With 'espdma' and 'ledma' the
  'esp' and 'le' devices hang off of the respective DMA bus instead of
  directly from the SBus. The 'dma' devices are either also used in this
  manner or on some add-on cards also as a companion device to an 'esp'
  device which also hangs off directly from the SBus. With the latter
  variant it's a bit tricky to glue the DMA engine to the core logic of
  the respective 'esp' device. With rev. 1.35 of sbus.c we are however
  guaranteed that such a 'dma' device is probed before the respective
  'esp' device which simplifies things a lot. [1]
- In the esp(4) SBus front-end read the part-unique ID code of Fast-SCSI
  capable chips the right way. This fixes erroneously detecting some
  chips as FAS366 when in fact they are not. Add explicit checks for the
  FAS100A, FAS216 and FAS236 variants instead treating all of these as
  ESP200. That way we can correctly set the respective Fast-SCSI config
  bits instead of driving them out of specs. This includes adding the
  FAS100A and FAS236 variants to the NCR53C9x core code. We probably
  still subsume some chip variants as ESP200 while in fact they are
  another variant which however shouldn't really matter as this will
  only happen when these chips are driven at 25MHz or less which implies
  not being able to run Fast-SCSI. [3]
- Add a workaround to the NCR53C9x interrupt handler which ignores the
  stray interrupt generated by FAS100A when doing path inquiry during
  boot and which otherwiese would trigger a panic.
- Add support for the 'esp' devices hanging off of a 'dma' or 'espdma'
  busses or which are companions of 'dma' devices to esp(4). In case of
  the variants that hang off of a DMA device this is a bit hackish as
  esp(4) then directly uses the softc of the respective parent to talk
  to the DMA engine. It might make sense to add an interface for this
  in order to implement this in a cleaner way however it's not yet clear
  how the requirements for the LANCE Ethernet controllers are and the
  hack works for now. [2]
  This effectively adds support for the onboard SCSI controller in
  Ultra 1 as well as most of the ESP-based SBus add-on cards to esp(4).
  With this the code for supporting the Performance Technologies SBS430
  SBus SCSI add-on cards is also largely in place the remaining bits
  were however omitted as it's unclear from the NetBSD how to couple
  the DMA engine and the core logic together for these cards.

Obtained from:	OpenBSD [1]
Obtained from:	NetBSD [2]
Clue from:	BSD/OS [3]
Reviewed by:	scottl (earlier version)
Tested with:	FSBE/S add-on card (FAS236), SSHA add-on card (ESP100A),
		Ultra 1 (onboard FAS100A), Ultra 2 (onboard FAS366)

4 files changed, 466 insertions, 127 deletions

diff --git a/sys/dev/esp/esp_sbus.c b/sys/dev/esp/esp_sbus.c
index 24a6a8f..cc92f19 100644
--- a/sys/dev/esp/esp_sbus.c
+++ b/sys/dev/esp/esp_sbus.c
@@ -109,18 +109,39 @@ struct esp_softc {
 	struct lsi64854_softc	*sc_dma;	/* pointer to my DMA */
 };
 
-static int	esp_sbus_probe(device_t);
+static devclass_t	esp_devclass;
+
+static int	esp_probe(device_t);
+static int	esp_dma_attach(device_t);
+static int	esp_dma_detach(device_t);
 static int	esp_sbus_attach(device_t);
 static int	esp_sbus_detach(device_t);
-static int	esp_sbus_suspend(device_t);
-static int	esp_sbus_resume(device_t);
+static int	esp_suspend(device_t);
+static int	esp_resume(device_t);
+
+static device_method_t esp_dma_methods[] = {
+	DEVMETHOD(device_probe,		esp_probe),
+	DEVMETHOD(device_attach,	esp_dma_attach),
+	DEVMETHOD(device_detach,	esp_dma_detach),
+	DEVMETHOD(device_suspend,	esp_suspend),
+	DEVMETHOD(device_resume,	esp_resume),
+	{0, 0}
+};
+
+static driver_t esp_dma_driver = {
+	"esp",
+	esp_dma_methods,
+	sizeof(struct esp_softc)
+};
+
+DRIVER_MODULE(esp, dma, esp_dma_driver, esp_devclass, 0, 0);
 
 static device_method_t esp_sbus_methods[] = {
-	DEVMETHOD(device_probe,		esp_sbus_probe),
+	DEVMETHOD(device_probe,		esp_probe),
 	DEVMETHOD(device_attach,	esp_sbus_attach),
 	DEVMETHOD(device_detach,	esp_sbus_detach),
-	DEVMETHOD(device_suspend,	esp_sbus_suspend),
-	DEVMETHOD(device_resume,	esp_sbus_resume),
+	DEVMETHOD(device_suspend,	esp_suspend),
+	DEVMETHOD(device_resume,	esp_resume),
 	{0, 0}
 };
 
@@ -130,7 +151,6 @@ static driver_t esp_sbus_driver = {
 	sizeof(struct esp_softc)
 };
 
-static devclass_t	esp_devclass;
 DRIVER_MODULE(esp, sbus, esp_sbus_driver, esp_devclass, 0, 0);
 
 /*
@@ -146,7 +166,7 @@ static int	esp_dma_setup(struct ncr53c9x_softc *, caddr_t *, size_t *,
 static void	esp_dma_go(struct ncr53c9x_softc *);
 static void	esp_dma_stop(struct ncr53c9x_softc *);
 static int	esp_dma_isactive(struct ncr53c9x_softc *);
-static void	espattach(struct esp_softc *, struct ncr53c9x_glue *);
+static int	espattach(struct esp_softc *, struct ncr53c9x_glue *);
 
 static struct ncr53c9x_glue esp_sbus_glue = {
 	esp_read_reg,
@@ -162,7 +182,7 @@ static struct ncr53c9x_glue esp_sbus_glue = {
 };
 
 static int
-esp_sbus_probe(device_t dev)
+esp_probe(device_t dev)
 {
 	const char *name;
 
@@ -170,6 +190,9 @@ esp_sbus_probe(device_t dev)
 	if (strcmp("SUNW,fas", name) == 0) {
 		device_set_desc(dev, "Sun FAS366 Fast-Wide SCSI");
 	        return (BUS_PROBE_DEFAULT);
+	} else if (strcmp("esp", name) == 0) {
+		device_set_desc(dev, "Sun ESP SCSI/Sun FAS Fast-SCSI");
+	        return (BUS_PROBE_DEFAULT);
 	}
 
 	return (ENXIO);
@@ -181,126 +204,291 @@ esp_sbus_attach(device_t dev)
 	struct esp_softc *esc;
 	struct ncr53c9x_softc *sc;
 	struct lsi64854_softc *lsc;
+	device_t *children;
+	const char *name;
 	phandle_t node;
-	int burst;
+	int burst, error, i, nchildren, slot;
 
 	esc = device_get_softc(dev);
 	bzero(esc, sizeof(struct esp_softc));
 	sc = &esc->sc_ncr53c9x;
 
+	lsc = NULL;
 	esc->sc_dev = dev;
+	name = ofw_bus_get_name(dev);
 	node = ofw_bus_get_node(dev);
 	if (OF_getprop(node, "initiator-id", &sc->sc_id,
 	    sizeof(sc->sc_id)) == -1)
 		sc->sc_id = 7;
-	if (OF_getprop(node, "clock-frequency", &sc->sc_freq,
-	    sizeof(sc->sc_freq)) == -1) {
-		printf("failed to query OFW for clock-frequency\n");
-		sc->sc_freq = sbus_get_clockfreq(dev);
-	}
+	sc->sc_freq = sbus_get_clockfreq(dev);
 
 #ifdef ESP_SBUS_DEBUG
 	device_printf(dev, "%s: sc_id %d, freq %d\n", __func__, sc->sc_id,
 	    sc->sc_freq);
 #endif
 
-	/*
-	 * allocate space for DMA, in SUNW,fas there are no separate
-	 * DMA devices
-	 */
-	lsc = malloc(sizeof (struct lsi64854_softc), M_DEVBUF,
-	    M_NOWAIT | M_ZERO);
-	if (lsc == NULL) {
-		device_printf(dev, "out of memory (lsi64854_softc)\n");
-		return (ENOMEM);
+	if (strcmp(name, "SUNW,fas") == 0) {
+		/*
+		 * Allocate space for DMA, in SUNW,fas there are no
+		 * separate DMA devices.
+		 */
+		lsc = malloc(sizeof (struct lsi64854_softc), M_DEVBUF,
+		    M_NOWAIT | M_ZERO);
+		if (lsc == NULL) {
+			device_printf(dev, "out of memory (lsi64854_softc)\n");
+			return (ENOMEM);
+		}
+		esc->sc_dma = lsc;
+
+		/*
+		 * SUNW,fas have 2 register spaces: DMA (lsi64854) and
+		 * SCSI core (ncr53c9x).
+		 */
+
+		/* Allocate DMA registers. */
+		lsc->sc_rid = 0;
+		if ((lsc->sc_res = bus_alloc_resource_any(dev, SYS_RES_MEMORY,
+		    &lsc->sc_rid, RF_ACTIVE)) == NULL) {
+			device_printf(dev, "cannot allocate DMA registers\n");
+			error = ENXIO;
+			goto fail_sbus_lsc;
+		}
+		lsc->sc_regt = rman_get_bustag(lsc->sc_res);
+		lsc->sc_regh = rman_get_bushandle(lsc->sc_res);
+
+		/* Create a parent DMA tag based on this bus. */
+		error = bus_dma_tag_create(
+		    NULL,			/* parent */
+		    PAGE_SIZE, 0,		/* alignment, boundary */
+		    BUS_SPACE_MAXADDR,		/* lowaddr */
+		    BUS_SPACE_MAXADDR,		/* highaddr */
+		    NULL, NULL,			/* filter, filterarg */
+		    BUS_SPACE_MAXSIZE_32BIT,	/* maxsize */
+		    0,				/* nsegments */
+		    BUS_SPACE_MAXSIZE_32BIT,	/* maxsegsize */
+		    0,				/* flags */
+		    NULL, NULL,			/* no locking */
+		    &lsc->sc_parent_dmat);
+		if (error != 0) {
+			device_printf(dev, "cannot allocate parent DMA tag\n");
+			goto fail_sbus_lres;
+		}
+		burst = sbus_get_burstsz(dev);
+
+#ifdef ESP_SBUS_DEBUG
+		printf("%s: burst 0x%x\n", __func__, burst);
+#endif
+
+		lsc->sc_burst = (burst & SBUS_BURST_32) ? 32 :
+		    (burst & SBUS_BURST_16) ? 16 : 0;
+
+		lsc->sc_channel = L64854_CHANNEL_SCSI;
+		lsc->sc_client = sc;
+		lsc->sc_dev = dev;
+
+		error = lsi64854_attach(lsc);
+		if (error != 0) {
+			device_printf(dev, "lsi64854_attach failed\n");
+			goto fail_sbus_lpdma;
+		}
+
+		/*
+		 * Allocate SCSI core registers.
+		 */
+		esc->sc_rid = 1;
+		if ((esc->sc_res = bus_alloc_resource_any(dev, SYS_RES_MEMORY,
+		    &esc->sc_rid, RF_ACTIVE)) == NULL) {
+			device_printf(dev,
+			    "cannot allocate SCSI core registers\n");
+			error = ENXIO;
+			goto fail_sbus_lsi;
+		}
+		esc->sc_regt = rman_get_bustag(esc->sc_res);
+		esc->sc_regh = rman_get_bushandle(esc->sc_res);
+	} else {
+		/*
+		 * Search accompanying DMA engine. It should have been
+		 * already attached otherwise there isn't much we can do.
+		 */
+		if (device_get_children(device_get_parent(dev), &children,
+		    &nchildren) != 0) {
+			device_printf(dev, "cannot determine siblings\n");
+			return (ENXIO);
+		}
+		slot = sbus_get_slot(dev);
+		for (i = 0; i < nchildren; i++) {
+			if (device_is_attached(children[i]) &&
+			    sbus_get_slot(children[i]) == slot &&
+			    strcmp(ofw_bus_get_name(children[i]), "dma") == 0) {
+				/* XXX hackery */
+				esc->sc_dma = (struct lsi64854_softc *)
+				    device_get_softc(children[i]);
+				break;
+			}
+		}
+		free(children, M_TEMP);
+		if (esc->sc_dma == NULL) {
+			device_printf(dev, "cannot find DMA engine\n");
+			return (ENXIO);
+		}
+		esc->sc_dma->sc_client = sc;
+
+		/*
+		 * Allocate SCSI core registers.
+		 */
+		esc->sc_rid = 0;
+		if ((esc->sc_res = bus_alloc_resource_any(dev, SYS_RES_MEMORY,
+		    &esc->sc_rid, RF_ACTIVE)) == NULL) {
+			device_printf(dev,
+			    "cannot allocate SCSI core registers\n");
+			return (ENXIO);
+		}
+		esc->sc_regt = rman_get_bustag(esc->sc_res);
+		esc->sc_regh = rman_get_bushandle(esc->sc_res);
 	}
-	esc->sc_dma = lsc;
 
-	/*
-	 * fas has 2 register spaces: DMA (lsi64854) and SCSI core (ncr53c9x)
-	 */
+	error = espattach(esc, &esp_sbus_glue);
+	if (error != 0) {
+		device_printf(dev, "espattach failed\n");
+		goto fail_sbus_eres;
+	}
+
+	return (0);
+
+ fail_sbus_eres:
+	bus_release_resource(dev, SYS_RES_MEMORY, esc->sc_rid, esc->sc_res);
+	if (strcmp(name, "SUNW,fas") != 0)
+		return (error);
+ fail_sbus_lsi:
+	lsi64854_detach(lsc);
+ fail_sbus_lpdma:
+	bus_dma_tag_destroy(lsc->sc_parent_dmat);
+ fail_sbus_lres:
+	bus_release_resource(dev, SYS_RES_MEMORY, lsc->sc_rid, lsc->sc_res);
+ fail_sbus_lsc:
+	free(lsc, M_DEVBUF);
+	return (error);
+}
+
+static int
+esp_sbus_detach(device_t dev)
+{
+	struct esp_softc *esc;
+	struct ncr53c9x_softc *sc;
+	struct lsi64854_softc *lsc;
+	int error;
+
+	esc = device_get_softc(dev);
+	sc = &esc->sc_ncr53c9x;
+	lsc = esc->sc_dma;
+
+	bus_teardown_intr(esc->sc_dev, esc->sc_irqres, esc->sc_irq);
+	error = ncr53c9x_detach(sc);
+	if (error != 0)
+		return (error);
+	bus_release_resource(esc->sc_dev, SYS_RES_IRQ, esc->sc_irqrid,
+	    esc->sc_irqres);
+	bus_release_resource(dev, SYS_RES_MEMORY, esc->sc_rid, esc->sc_res);
+	if (strcmp(ofw_bus_get_name(dev), "SUNW,fas") != 0)
+		return (0);
+	error = lsi64854_detach(lsc);
+	if (error != 0)
+		return (error);
+	bus_dma_tag_destroy(lsc->sc_parent_dmat);
+	bus_release_resource(dev, SYS_RES_MEMORY, lsc->sc_rid, lsc->sc_res);
+	free(lsc, M_DEVBUF);
+
+	return (0);
+}
+
+static int
+esp_dma_attach(device_t dev)
+{
+	struct esp_softc *esc;
+	struct ncr53c9x_softc *sc;
+	phandle_t node;
+	int error;
+
+	esc = device_get_softc(dev);
+	bzero(esc, sizeof(struct esp_softc));
+	sc = &esc->sc_ncr53c9x;
 
-	/* allocate DMA registers */
-	lsc->sc_rid = 0;
-	if ((lsc->sc_res = bus_alloc_resource_any(dev, SYS_RES_MEMORY,
-	    &lsc->sc_rid, RF_ACTIVE)) == NULL) {
-		device_printf(dev, "cannot allocate DMA registers\n");
-		free(lsc, M_DEVBUF);
+	esc->sc_dev = dev;
+	node = ofw_bus_get_node(dev);
+	if (OF_getprop(node, "initiator-id", &sc->sc_id,
+	    sizeof(sc->sc_id)) == -1)
+		sc->sc_id = 7;
+	if (OF_getprop(node, "clock-frequency", &sc->sc_freq,
+	    sizeof(sc->sc_freq)) == -1) {
+		printf("failed to query OFW for clock-frequency\n");
 		return (ENXIO);
 	}
-	lsc->sc_regt = rman_get_bustag(lsc->sc_res);
-	lsc->sc_regh = rman_get_bushandle(lsc->sc_res);
-
-	/* Create a parent DMA tag based on this bus */
-	if (bus_dma_tag_create(
-	    NULL,			/* parent */
-	    PAGE_SIZE, 0,		/* alignment, boundary */
-	    BUS_SPACE_MAXADDR,		/* lowaddr */
-	    BUS_SPACE_MAXADDR,		/* highaddr */
-	    NULL, NULL,			/* filter, filterarg */
-	    BUS_SPACE_MAXSIZE_32BIT,	/* maxsize */
-	    0,				/* nsegments */
-	    BUS_SPACE_MAXSIZE_32BIT,	/* maxsegsize */
-	    0,				/* flags */
-	    NULL, NULL,			/* no locking */
-	    &lsc->sc_parent_dmat)) {
-		device_printf(dev, "cannot allocate parent DMA tag\n");
-		free(lsc, M_DEVBUF);
-		return (ENOMEM);
-	}
-	burst = sbus_get_burstsz(dev);
 
 #ifdef ESP_SBUS_DEBUG
-	printf("%s: burst 0x%x\n", __func__, burst);
+	device_printf(dev, "%s: sc_id %d, freq %d\n", __func__, sc->sc_id,
+	    sc->sc_freq);
 #endif
 
-	lsc->sc_burst = (burst & SBUS_BURST_32) ? 32 :
-	    (burst & SBUS_BURST_16) ? 16 : 0;
-
-	lsc->sc_channel = L64854_CHANNEL_SCSI;
-	lsc->sc_client = sc;
-	lsc->sc_dev = dev;
-
-	lsi64854_attach(lsc);
+	/* XXX hackery */
+	esc->sc_dma = (struct lsi64854_softc *)
+	    device_get_softc(device_get_parent(dev));
+	esc->sc_dma->sc_client = sc;
 
 	/*
-	 * allocate SCSI core registers
+	 * Allocate SCSI core registers.
 	 */
-	esc->sc_rid = 1;
+	esc->sc_rid = 0;
 	if ((esc->sc_res = bus_alloc_resource_any(dev, SYS_RES_MEMORY,
 	    &esc->sc_rid, RF_ACTIVE)) == NULL) {
 		device_printf(dev, "cannot allocate SCSI core registers\n");
-		free(lsc, M_DEVBUF);
 		return (ENXIO);
 	}
 	esc->sc_regt = rman_get_bustag(esc->sc_res);
 	esc->sc_regh = rman_get_bushandle(esc->sc_res);
 
-	espattach(esc, &esp_sbus_glue);
+	error = espattach(esc, &esp_sbus_glue);
+	if (error != 0) {
+		device_printf(dev, "espattach failed\n");
+		goto fail_dma_eres;
+	}
 
 	return (0);
+
+ fail_dma_eres:
+	bus_release_resource(dev, SYS_RES_MEMORY, esc->sc_rid, esc->sc_res);
+	return (error);
 }
 
 static int
-esp_sbus_detach(device_t dev)
+esp_dma_detach(device_t dev)
 {
-	struct ncr53c9x_softc *sc;
 	struct esp_softc *esc;
+	struct ncr53c9x_softc *sc;
+	int error;
 
 	esc = device_get_softc(dev);
 	sc = &esc->sc_ncr53c9x;
-	return (ncr53c9x_detach(sc, 0));
+
+	bus_teardown_intr(esc->sc_dev, esc->sc_irqres, esc->sc_irq);
+	error = ncr53c9x_detach(sc);
+	if (error != 0)
+		return (error);
+	bus_release_resource(esc->sc_dev, SYS_RES_IRQ, esc->sc_irqrid,
+	    esc->sc_irqres);
+	bus_release_resource(dev, SYS_RES_MEMORY, esc->sc_rid, esc->sc_res);
+
+	return (0);
 }
 
 static int
-esp_sbus_suspend(device_t dev)
+esp_suspend(device_t dev)
 {
 
 	return (ENXIO);
 }
 
 static int
-esp_sbus_resume(device_t dev)
+esp_resume(device_t dev)
 {
 
 	return (ENXIO);
@@ -309,11 +497,19 @@ esp_sbus_resume(device_t dev)
 /*
  * Attach this instance, and then all the sub-devices
  */
-static void
+static int
 espattach(struct esp_softc *esc, struct ncr53c9x_glue *gluep)
 {
 	struct ncr53c9x_softc *sc = &esc->sc_ncr53c9x;
 	unsigned int uid = 0;
+	int error;
+
+	/*
+	 * The `ESC' DMA chip must be reset before we can access
+	 * the ESP registers.
+	 */
+	if (esc->sc_dma->sc_rev == DMAREV_ESC)
+		DMA_RESET(esc->sc_dma);
 
 	/*
 	 * Set up glue for MI code early; we use some of it here.
@@ -330,13 +526,30 @@ espattach(struct esp_softc *esc, struct ncr53c9x_glue *gluep)
 	 */
 
 	/*
+	 * Read the part-unique ID code of the SCSI chip. The contained
+	 * value is only valid if all of the following conditions are met:
+	 * - After power-up or chip reset.
+	 * - Before any value is written to this register.
+	 * - The NCRCFG2_FE bit is set.
+	 * - A (NCRCMD_NOP | NCRCMD_DMA) command has been issued.
+	 */
+	NCRCMD(sc, NCRCMD_RSTCHIP);
+	NCRCMD(sc, NCRCMD_NOP);
+	sc->sc_cfg2 = NCRCFG2_FE;
+	NCR_WRITE_REG(sc, NCR_CFG2, sc->sc_cfg2);
+	NCRCMD(sc, NCRCMD_NOP | NCRCMD_DMA);
+	uid = NCR_READ_REG(sc, NCR_UID);
+
+	/*
 	 * It is necessary to try to load the 2nd config register here,
 	 * to find out what rev the esp chip is, else the ncr53c9x_reset
 	 * will not set up the defaults correctly.
 	 */
 	sc->sc_cfg1 = sc->sc_id | NCRCFG1_PARENB;
+	NCR_WRITE_REG(sc, NCR_CFG1, sc->sc_cfg1);
+	sc->sc_cfg2 = 0;
+	NCR_WRITE_REG(sc, NCR_CFG2, sc->sc_cfg2);
 	sc->sc_cfg2 = NCRCFG2_SCSI2 | NCRCFG2_RPE;
-	sc->sc_cfg3 = NCRCFG3_CDB;
 	NCR_WRITE_REG(sc, NCR_CFG2, sc->sc_cfg2);
 
 	if ((NCR_READ_REG(sc, NCR_CFG2) & ~NCRCFG2_RSVD) !=
@@ -357,15 +570,33 @@ espattach(struct esp_softc *esc, struct ncr53c9x_glue *gluep)
 			sc->sc_cfg2 |= NCRCFG2_FE;
 			sc->sc_cfg3 = 0;
 			NCR_WRITE_REG(sc, NCR_CFG3, sc->sc_cfg3);
-			sc->sc_rev = NCR_VARIANT_ESP200;
-
-			/*
-			 * XXX spec says it's valid after power up or chip
-			 * reset.
-			 */
-			uid = NCR_READ_REG(sc, NCR_UID);
-			if (((uid & 0xf8) >> 3) == 0x0a) /* XXX */
-				sc->sc_rev = NCR_VARIANT_FAS366;
+			if (sc->sc_freq <= 25)
+				sc->sc_rev = NCR_VARIANT_ESP200;
+			else {
+				switch ((uid & 0xf8) >> 3) {
+				case 0x00:
+					sc->sc_rev = NCR_VARIANT_FAS100A;
+					break;
+				case 0x02:
+					if ((uid & 0x07) == 0x02)
+						sc->sc_rev = NCR_VARIANT_FAS216;
+					else
+						sc->sc_rev = NCR_VARIANT_FAS236;
+					break;
+				case 0x0a:
+					sc->sc_rev = NCR_VARIANT_FAS366;
+					break;
+				default:
+					/*
+					 * We could just treat unknown chips
+					 * as ESP200 but then we would most
+					 * likely drive them out of specs.
+					 */
+					device_printf(esc->sc_dev,
+					    "Unknown chip\n");
+					return (ENXIO);
+				}
+			}
 		}
 	}
 
@@ -390,10 +621,7 @@ espattach(struct esp_softc *esc, struct ncr53c9x_glue *gluep)
 	 */
 	sc->sc_minsync = 1000 / sc->sc_freq;
 
-	/* limit minsync due to unsolved performance issues */
-	sc->sc_maxsync = sc->sc_minsync;
 	sc->sc_maxoffset = 15;
-
 	sc->sc_extended_geom = 1;
 
 	/*
@@ -409,31 +637,60 @@ espattach(struct esp_softc *esc, struct ncr53c9x_glue *gluep)
 		break;
 
 	case NCR_VARIANT_ESP100A:
-		sc->sc_maxwidth = 1;
+		sc->sc_maxwidth = 0;
 		sc->sc_maxxfer = 64 * 1024;
 		/* Min clocks/byte is 5 */
 		sc->sc_minsync = ncr53c9x_cpb2stp(sc, 5);
 		break;
 
 	case NCR_VARIANT_ESP200:
+		sc->sc_maxwidth = 0;
+		sc->sc_maxxfer = 16 * 1024 * 1024;
+		/* Min clocks/byte is 5 */
+		sc->sc_minsync = ncr53c9x_cpb2stp(sc, 5);
+		break;
+
+	case NCR_VARIANT_FAS100A:
+	case NCR_VARIANT_FAS216:
+	case NCR_VARIANT_FAS236:
+		/*
+		 * The onboard SCSI chips in Sun Ultra 1 are actually
+		 * documented to be NCR53C9X which use NCRCFG3_FCLK and
+		 * NCRCFG3_FSCSI. BSD/OS however probes these chips as
+		 * FAS100A and uses NCRF9XCFG3_FCLK and NCRF9XCFG3_FSCSI
+		 * instead which seems to be correct as otherwise sync
+		 * negotiation just doesn't work. Using NCRF9XCFG3_FCLK
+		 * and NCRF9XCFG3_FSCSI with these chips in fact also
+		 * yields Fast-SCSI speed.
+		 */
+		sc->sc_features = NCR_F_FASTSCSI;
+		sc->sc_cfg3 = NCRF9XCFG3_FCLK;
+		sc->sc_cfg3_fscsi = NCRF9XCFG3_FSCSI;
+		sc->sc_maxwidth = 0;
+		sc->sc_maxxfer = 16 * 1024 * 1024;
+		break;
+
 	case NCR_VARIANT_FAS366:
 		sc->sc_maxwidth = 1;
 		sc->sc_maxxfer = 16 * 1024 * 1024;
-		/* XXX - do actually set FAST* bits */
 		break;
 	}
 
+	/* Limit minsync due to unsolved performance issues. */
+	sc->sc_maxsync = sc->sc_minsync;
+
 	/* Establish interrupt channel */
 	esc->sc_irqrid = 0;
 	if ((esc->sc_irqres = bus_alloc_resource_any(esc->sc_dev, SYS_RES_IRQ,
 	    &esc->sc_irqrid, RF_SHAREABLE|RF_ACTIVE)) == NULL) {
-		device_printf(esc->sc_dev, "Cannot allocate interrupt\n");
-		return;
+		device_printf(esc->sc_dev, "cannot allocate interrupt\n");
+		return (ENXIO);
 	}
 	if (bus_setup_intr(esc->sc_dev, esc->sc_irqres,
 	    INTR_TYPE_BIO|INTR_MPSAFE, ncr53c9x_intr, sc, &esc->sc_irq)) {
-		device_printf(esc->sc_dev, "Cannot set up interrupt\n");
-		return;
+		device_printf(esc->sc_dev, "cannot set up interrupt\n");
+		error = ENXIO;
+		goto fail_ires;
 	}
 
 	/* Turn on target selection using the `DMA' method */
@@ -442,7 +699,20 @@ espattach(struct esp_softc *esc, struct ncr53c9x_glue *gluep)
 
 	/* Do the common parts of attachment. */
 	sc->sc_dev = esc->sc_dev;
-	ncr53c9x_attach(sc);
+	error = ncr53c9x_attach(sc);
+	if (error != 0) {
+		device_printf(esc->sc_dev, "ncr53c9x_attach failed\n");
+		goto fail_intr;
+	}
+
+	return (0);
+
+ fail_intr:
+	bus_teardown_intr(esc->sc_dev, esc->sc_irqres, esc->sc_irq);
+ fail_ires:
+	bus_release_resource(esc->sc_dev, SYS_RES_IRQ, esc->sc_irqrid,
+	    esc->sc_irqres);
+	return (error);
 }
 
 /*
diff --git a/sys/dev/esp/ncr53c9x.c b/sys/dev/esp/ncr53c9x.c
index 9d587a7..010e9c6 100644
--- a/sys/dev/esp/ncr53c9x.c
+++ b/sys/dev/esp/ncr53c9x.c
@@ -25,7 +25,7 @@
  *
  */
 
-/*	$NetBSD: ncr53c9x.c,v 1.110 2003/11/02 11:07:45 wiz Exp $	*/
+/*	$NetBSD: ncr53c9x.c,v 1.114 2005/02/27 00:27:02 perry Exp $	*/
 
 /*-
  * Copyright (c) 1998, 2002 The NetBSD Foundation, Inc.
@@ -200,6 +200,8 @@ static const char *ncr53c9x_variant_names[] = {
 	"AM53C974",
 	"FAS366/HME",
 	"NCR53C90 (86C01)",
+	"FAS100A",
+	"FAS236",
 };
 
 /*
@@ -225,7 +227,7 @@ ncr53c9x_attach(struct ncr53c9x_softc *sc)
 	struct cam_sim *sim;
 	struct cam_path *path;
 	struct ncr53c9x_ecb *ecb;
-	int i;
+	int error, i;
 
 	mtx_init(&sc->sc_lock, "ncr", "ncr53c9x lock", MTX_DEF);
 
@@ -249,18 +251,36 @@ ncr53c9x_attach(struct ncr53c9x_softc *sc)
 	 * handling in the DMA engines. Note that that ncr53c9x_msgout()
 	 * can request a 1 byte DMA transfer.
 	 */
-	if (sc->sc_omess == NULL)
+	if (sc->sc_omess == NULL) {
+		sc->sc_omess_self = 1;
 		sc->sc_omess = malloc(NCR_MAX_MSG_LEN, M_DEVBUF, M_NOWAIT);
+		if (sc->sc_omess == NULL) {
+			device_printf(sc->sc_dev,
+			    "cannot allocate MSGOUT buffer\n");
+			return (ENOMEM);
+		}
+	} else
+		sc->sc_omess_self = 0;
 
-	if (sc->sc_imess == NULL)
+	if (sc->sc_imess == NULL) {
+		sc->sc_imess_self = 1;
 		sc->sc_imess = malloc(NCR_MAX_MSG_LEN + 1, M_DEVBUF, M_NOWAIT);
+		if (sc->sc_imess == NULL) {
+			device_printf(sc->sc_dev,
+			    "cannot allocate MSGIN buffer\n");
+			error = ENOMEM;
+			goto fail_omess;
+		}
+	} else
+		sc->sc_imess_self = 0;
 
 	sc->sc_tinfo = malloc(sc->sc_ntarg * sizeof(sc->sc_tinfo[0]),
 	    M_DEVBUF, M_NOWAIT | M_ZERO);
-
-	if (!sc->sc_omess || !sc->sc_imess || !sc->sc_tinfo) {
-		printf("out of memory\n");
-		return (ENOMEM);
+	if (sc->sc_tinfo == NULL) {
+		device_printf(sc->sc_dev,
+		    "cannot allocate target info buffer\n");
+		error = ENOMEM;
+		goto fail_imess;
 	}
 
 	callout_init(&sc->sc_watchdog, 0);
@@ -298,27 +318,32 @@ ncr53c9x_attach(struct ncr53c9x_softc *sc)
 	 * Register with CAM
 	 */
 	devq = cam_simq_alloc(sc->sc_ntarg);
-	if (devq == NULL)
-		return (ENOMEM);
+	if (devq == NULL) {
+		device_printf(sc->sc_dev, "cannot allocate device queue\n");
+		error = ENOMEM;
+		goto fail_tinfo;
+	}
 
 	sim = cam_sim_alloc(ncr53c9x_action, ncr53c9x_poll, "esp", sc,
 			    device_get_unit(sc->sc_dev), 1,
 			    NCR_TAG_DEPTH, devq);
 	if (sim == NULL) {
-		cam_simq_free(devq);
-		return (ENOMEM);
+		device_printf(sc->sc_dev, "cannot allocate SIM entry\n");
+		error = ENOMEM;
+		goto fail_devq;
 	}
 	if (xpt_bus_register(sim, 0) != CAM_SUCCESS) {
-		cam_sim_free(sim, TRUE);
-		return (EIO);
+		device_printf(sc->sc_dev, "cannot register bus\n");
+		error = EIO;
+		goto fail_sim;
 	}
 
 	if (xpt_create_path(&path, NULL, cam_sim_path(sim),
 			    CAM_TARGET_WILDCARD, CAM_LUN_WILDCARD)
 			    != CAM_REQ_CMP) {
-		xpt_bus_deregister(cam_sim_path(sim));
-		cam_sim_free(sim, TRUE);
-		return (EIO);
+		device_printf(sc->sc_dev, "cannot create path\n");
+		error = EIO;
+		goto fail_bus;
 	}
 
 	sc->sc_sim = sim;
@@ -335,7 +360,8 @@ ncr53c9x_attach(struct ncr53c9x_softc *sc)
 	if ((sc->ecb_array = malloc(sizeof(struct ncr53c9x_ecb) * NCR_TAG_DEPTH,
 				    M_DEVBUF, M_NOWAIT|M_ZERO)) == NULL) {
 		device_printf(sc->sc_dev, "cannot allocate ECB array\n");
-		return (ENOMEM);
+		error = ENOMEM;
+		goto fail_path;
 	}
 	for (i = 0; i < NCR_TAG_DEPTH; i++) {
 		ecb = &sc->ecb_array[i];
@@ -347,18 +373,46 @@ ncr53c9x_attach(struct ncr53c9x_softc *sc)
 	callout_reset(&sc->sc_watchdog, 60*hz, ncr53c9x_watch, sc);
 
 	return (0);
+
+fail_path:
+	xpt_free_path(path);
+fail_bus:
+	xpt_bus_deregister(cam_sim_path(sim));
+fail_sim:
+	cam_sim_free(sim, TRUE);
+fail_devq:
+	cam_simq_free(devq);
+fail_tinfo:
+	free(sc->sc_tinfo, M_DEVBUF);
+fail_imess:
+	if (sc->sc_imess_self)
+		free(sc->sc_imess, M_DEVBUF);
+fail_omess:
+	if (sc->sc_omess_self)
+		free(sc->sc_omess, M_DEVBUF);
+	return (error);
 }
 
 int
-ncr53c9x_detach(struct ncr53c9x_softc *sc, int flags)
+ncr53c9x_detach(struct ncr53c9x_softc *sc)
 {
 
-#if 0	/* don't allow detach for now */
-	free(sc->sc_imess, M_DEVBUF);
-	free(sc->sc_omess, M_DEVBUF);
-#endif
+	callout_drain(&sc->sc_watchdog);
+	mtx_lock(&sc->sc_lock);
+	ncr53c9x_init(sc, 1);
+	mtx_unlock(&sc->sc_lock);
+	xpt_free_path(sc->sc_path);
+	xpt_bus_deregister(cam_sim_path(sc->sc_sim));
+	cam_sim_free(sc->sc_sim, TRUE);
+	free(sc->ecb_array, M_DEVBUF);
+	free(sc->sc_tinfo, M_DEVBUF);
+	if (sc->sc_imess_self)
+		free(sc->sc_imess, M_DEVBUF);
+	if (sc->sc_omess_self)
+		free(sc->sc_omess, M_DEVBUF);
+	mtx_destroy(&sc->sc_lock);
 
-	return (EINVAL);
+	return (0);
 }
 
 /*
@@ -388,7 +442,9 @@ ncr53c9x_reset(struct ncr53c9x_softc *sc)
 		NCR_WRITE_REG(sc, NCR_CFG5, sc->sc_cfg5 | NCRCFG5_SINT);
 		NCR_WRITE_REG(sc, NCR_CFG4, sc->sc_cfg4);
 	case NCR_VARIANT_AM53C974:
+	case NCR_VARIANT_FAS100A:
 	case NCR_VARIANT_FAS216:
+	case NCR_VARIANT_FAS236:
 	case NCR_VARIANT_NCR53C94:
 	case NCR_VARIANT_NCR53C96:
 	case NCR_VARIANT_ESP200:
@@ -515,7 +571,10 @@ ncr53c9x_init(struct ncr53c9x_softc *sc, int doreset)
 	 */
 	ncr53c9x_reset(sc);
 
+	sc->sc_flags = 0;
+	sc->sc_msgpriq = sc->sc_msgout = sc->sc_msgoutq = 0;
 	sc->sc_phase = sc->sc_prevphase = INVALID_PHASE;
+
 	for (r = 0; r < sc->sc_ntarg; r++) {
 		struct ncr53c9x_tinfo *ti = &sc->sc_tinfo[r];
 /* XXX - config flags per target: low bits: no reselect; high bits: no synch */
@@ -1793,8 +1852,7 @@ gotit:
 						/*
 						 * target initiated negotiation
 						 */
-						if (ti->period <
-						    sc->sc_minsync)
+						if (ti->period < sc->sc_minsync)
 							ti->period =
 							    sc->sc_minsync;
 						if (ti->offset > 15)
@@ -2494,9 +2552,17 @@ again:
 			 * Arbitration won; examine the `step' register
 			 * to determine how far the selection could progress.
 			 */
-			ecb = sc->sc_nexus;
-			if (ecb == NULL)
+			if (ecb == NULL) {
+				/*
+				 * When doing path inquiry during boot
+				 * FAS100A trigger a stray interrupt which
+				 * we just ignore instead of panicing.
+				 */
+				if (sc->sc_state == NCR_IDLE &&
+				    sc->sc_espstep == 0)
+					goto out;
 				panic("ncr53c9x: no nexus");
+			}
 
 			ti = &sc->sc_tinfo[ecb->ccb->ccb_h.target_id];
 
@@ -2613,8 +2679,7 @@ again:
 		}
 		if (sc->sc_state == NCR_IDLE) {
 			device_printf(sc->sc_dev, "stray interrupt\n");
-			mtx_unlock(&sc->sc_lock);
-			return;
+			goto out;
 		}
 		break;
 
diff --git a/sys/dev/esp/ncr53c9xreg.h b/sys/dev/esp/ncr53c9xreg.h
index 647bef8..c24f807 100644
--- a/sys/dev/esp/ncr53c9xreg.h
+++ b/sys/dev/esp/ncr53c9xreg.h
@@ -173,7 +173,7 @@
 #define	 NCRESPCFG3_ADMA	0x02	/*	Alternate DMA Mode	*/
 #define	 NCRESPCFG3_T8M		0x01	/*	Threshold 8 Mode	*/
 
-/* Config #3 also different on NCR53CF9x/FAS216 */
+/* Config #3 also different on NCR53CF9x/FAS100A/FAS216/FAS236 */
 #define	NCR_F9XCFG3		0x0c	/* RW - Configuration #3	*/
 #define  NCRF9XCFG3_IDM		0x80	/*	ID Message Res Check	*/
 #define  NCRF9XCFG3_QTE		0x40	/*	Queue Tag Enable	*/
diff --git a/sys/dev/esp/ncr53c9xvar.h b/sys/dev/esp/ncr53c9xvar.h
index fc58848..79afcee 100644
--- a/sys/dev/esp/ncr53c9xvar.h
+++ b/sys/dev/esp/ncr53c9xvar.h
@@ -99,7 +99,9 @@
 #define	NCR_VARIANT_AM53C974		8
 #define	NCR_VARIANT_FAS366		9
 #define	NCR_VARIANT_NCR53C90_86C01	10
-#define	NCR_VARIANT_MAX			11
+#define	NCR_VARIANT_FAS100A		11
+#define	NCR_VARIANT_FAS236		12
+#define	NCR_VARIANT_MAX			13
 
 /* XXX Max tag depth.  Should this be defined in the register header? */
 #define NCR_TAG_DEPTH			256
@@ -333,9 +335,11 @@ struct ncr53c9x_softc {
 	u_short	sc_msgoutq;	/* What messages have been sent so far? */
 
 	u_char	*sc_omess;	/* MSGOUT buffer */
+	int	sc_omess_self;	/* MSGOUT buffer is self-allocated */
 	caddr_t	sc_omp;		/* Message pointer (for multibyte messages) */
 	size_t	sc_omlen;
 	u_char	*sc_imess;	/* MSGIN buffer */
+	int	sc_imess_self;	/* MSGIN buffer is self-allocated */
 	caddr_t	sc_imp;		/* Message pointer (for multibyte messages) */
 	size_t	sc_imlen;
 
@@ -459,7 +463,7 @@ struct ncr53c9x_softc {
 	((250 * (cpb)) / (sc)->sc_freq)
 
 int	ncr53c9x_attach(struct ncr53c9x_softc *);
-int	ncr53c9x_detach(struct ncr53c9x_softc *, int);
+int	ncr53c9x_detach(struct ncr53c9x_softc *);
 void	ncr53c9x_action(struct cam_sim *, union ccb *);
 void	ncr53c9x_reset(struct ncr53c9x_softc *);
 void	ncr53c9x_intr(void *);