Store a pointer to our softc in the kernel's SCB structure. In the

past we stored this data in the CCB and attained the CCB via a pointer
in the SCB.  In ahc_timeout(), however, the timedout SCB may have already
been completed (inherent race), meaning that the CCB could have been recycled,
and the ahc pointer reset.

Clean up the logic in ahc_search_qinfifo that deals with the busy device
table.  For some reason it assumed that the only valid time to search
to see if additional lun entries should be checked was if lun 0 matched.
Now we properly itterate through the necessary luns.  The busy device
table is used to detect invalid reselections, so a device would have had
to perform an unexpected reselection for this to cause problems.  Further,
all luns are collapsed to a single entry unless we have external ram
with large SCBs (3940AU models) so the chance of this happening was
rather remote.

Clean up the logic for dealing with the untagged queues.  We now set a
flag in the SCB that indicates that it is on the untagged queue instead
of inferring this from the type and setup of the CCB pased into us by
CAM.

In ahc_timeout(), don't print the path of the SCB until the controller
is paused and we are sure that it has not completed yet.  This, in
conjunction with referencing the ahc pointer in the SCB rather than
the CCB in the SCB avoids panics in the case of a timedout scb completing
just before the timeout handler runs.  This turns out to be guaranteed
if interrupt delivery is failing, as we run our interrupt handler to
flush any "just missed events" when a timeout occurs.  Mention the
likelyhood of broken interrupts if a timedout SCB is completed by
our call to ahc_intr().

4 files changed, 40 insertions, 54 deletions

diff --git a/sys/dev/aic7xxx/aic7xxx.c b/sys/dev/aic7xxx/aic7xxx.c
index 2db8998..18f003a 100644
--- a/sys/dev/aic7xxx/aic7xxx.c
+++ b/sys/dev/aic7xxx/aic7xxx.c
@@ -3575,6 +3575,7 @@ ahc_alloc_scbs(struct ahc_softc *ahc)
 		 * The first entry is embedded in the scb.
 		 */
 		next_scb->sg_list_phys = physaddr + sizeof(struct ahc_dma_seg);
+		next_scb->ahc_softc = ahc;
 		next_scb->flags = SCB_FREE;
 #ifndef __linux__
 		error = ahc_dmamap_create(ahc, ahc->buffer_dmat, /*flags*/0,
@@ -4646,8 +4647,11 @@ ahc_abort_scbs(struct ahc_softc *ahc, int target, char channel,
 	struct	scb *scbp;
 	struct	scb *scbp_next;
 	u_int	active_scb;
-	int	i;
+	int	i, j;
 	int	maxtarget;
+	int	minlun;
+	int	maxlun;
+
 	int	found;
 
 	/*
@@ -4674,39 +4678,27 @@ ahc_abort_scbs(struct ahc_softc *ahc, int target, char channel,
 		maxtarget = i + 1;
 	}
 
-	for (;i < maxtarget; i++) {
-		u_int scbid;
+	if (lun == CAM_LUN_WILDCARD) {
 
-		scbid = ahc_index_busy_tcl(ahc, BUILD_TCL(i << 4, 0),
-					   /*unbusy*/FALSE);
-		scbp = ahc_lookup_scb(ahc, scbid);
-		if (scbid < ahc->scb_data->numscbs
-		 && ahc_match_scb(ahc, scbp, target, channel, lun, tag, role)) {
-			u_int minlun;
-			u_int maxlun;
-
-			if (lun == CAM_LUN_WILDCARD) {
+		/*
+		 * Unless we are using an SCB based
+		 * busy targets table, there is only
+		 * one table entry for all luns of
+		 * a target.
+		 */
+		minlun = 0;
+		maxlun = 1;
+		if ((ahc->flags & AHC_SCB_BTT) != 0)
+			maxlun = AHC_NUM_LUNS;
+	} else {
+		minlun = lun;
+		maxlun = lun + 1;
+	}
 
-				/*
-				 * Unless we are using an SCB based
-				 * busy targets table, there is only
-				 * one table entry for all luns of
-				 * a target.
-				 */
-				minlun = 0;
-				maxlun = 1;
-				if ((ahc->flags & AHC_SCB_BTT) != 0)
-					maxlun = AHC_NUM_LUNS;
-			} else {
-				minlun = lun;
-				maxlun = lun + 1;
-			}
-			while (minlun < maxlun) {
-				ahc_index_busy_tcl(ahc, BUILD_TCL(i << 4,
-						   minlun), /*unbusy*/TRUE);
-				minlun++;
-			}
-		}
+	for (;i < maxtarget; i++) {
+		for (j = minlun;j < maxlun; j++)
+			ahc_index_busy_tcl(ahc, BUILD_TCL(i << 4, j),
+					   /*unbusy*/TRUE);
 	}
 
 	/*
diff --git a/sys/dev/aic7xxx/aic7xxx.h b/sys/dev/aic7xxx/aic7xxx.h
index 86ecc7d..d5cc59d 100644
--- a/sys/dev/aic7xxx/aic7xxx.h
+++ b/sys/dev/aic7xxx/aic7xxx.h
@@ -475,6 +475,7 @@ typedef enum {
 	SCB_RECOVERY_SCB	= 0x0040,
 	SCB_NEGOTIATE		= 0x0080,
 	SCB_ABORT		= 0x1000,
+	SCB_UNTAGGEDQ		= 0x2000,
 	SCB_ACTIVE		= 0x4000,
 	SCB_TARGET_IMMEDIATE	= 0x8000
 } scb_flag;
@@ -487,6 +488,7 @@ struct scb {
 	} links;
 	LIST_ENTRY(scb)		  pending_links;
 	ahc_io_ctx_t		  io_ctx;
+	struct ahc_softc	 *ahc_softc;
 	scb_flag		  flags;
 #ifndef __linux__
 	bus_dmamap_t		  dmamap;
diff --git a/sys/dev/aic7xxx/aic7xxx_freebsd.c b/sys/dev/aic7xxx/aic7xxx_freebsd.c
index eb56508..4ca846c 100644
--- a/sys/dev/aic7xxx/aic7xxx_freebsd.c
+++ b/sys/dev/aic7xxx/aic7xxx_freebsd.c
@@ -43,7 +43,6 @@
 #endif
 
 #define ccb_scb_ptr spriv_ptr0
-#define ccb_ahc_ptr spriv_ptr1
 
 #ifdef AHC_DEBUG
 static int     ahc_debug = AHC_DEBUG;
@@ -265,14 +264,12 @@ ahc_done(struct ahc_softc *ahc, struct scb *scb)
 
 	ccb = scb->io_ctx;
 	LIST_REMOVE(scb, pending_links);
-	if (ccb->ccb_h.func_code == XPT_SCSI_IO
-	  && ((ccb->ccb_h.flags & CAM_TAG_ACTION_VALID) == 0
-	   || ccb->csio.tag_action == CAM_TAG_ACTION_NONE)
-	  && (ahc->features & AHC_SCB_BTT) == 0) {
+	if ((scb->flags & SCB_UNTAGGEDQ) != 0) {
 		struct scb_tailq *untagged_q;
 
 		untagged_q = &ahc->untagged_queues[ccb->ccb_h.target_id];
 		TAILQ_REMOVE(untagged_q, scb, links.tqe);
+		scb->flags &= ~SCB_UNTAGGEDQ;
 		ahc_run_untagged_queue(ahc, untagged_q);
 	}
 
@@ -451,7 +448,6 @@ ahc_action(struct cam_sim *sim, union ccb *ccb)
 		 * So we can find the SCB when an abort is requested
 		 */
 		ccb->ccb_h.ccb_scb_ptr = scb;
-		ccb->ccb_h.ccb_ahc_ptr = ahc;
 
 		/*
 		 * Put all the arguments for the xfer in the scb
@@ -1052,7 +1048,7 @@ ahc_execute_scb(void *arg, bus_dma_segment_t *dm_segs, int nsegments,
 
 	scb = (struct scb *)arg;
 	ccb = scb->io_ctx;
-	ahc = (struct ahc_softc *)ccb->ccb_h.ccb_ahc_ptr;
+	ahc = scb->ahc_softc;
 
 	if (error != 0) {
 		if (error == EFBIG)
@@ -1215,6 +1211,7 @@ ahc_execute_scb(void *arg, bus_dma_segment_t *dm_segs, int nsegments,
 
 		untagged_q = &(ahc->untagged_queues[ccb->ccb_h.target_id]);
 		TAILQ_INSERT_TAIL(untagged_q, scb, links.tqe);
+		scb->flags |= SCB_UNTAGGEDQ;
 		if (TAILQ_FIRST(untagged_q) != scb) {
 			ahc_unlock(ahc, &s);
 			return;
@@ -1397,7 +1394,7 @@ ahc_timeout(void *arg)
 	char	channel;
 
 	scb = (struct scb *)arg; 
-	ahc = (struct ahc_softc *)scb->io_ctx->ccb_h.ccb_ahc_ptr;
+	ahc = (struct ahc_softc *)scb->ahc_softc;
 
 	ahc_lock(ahc, &s);
 
@@ -1415,11 +1412,10 @@ ahc_timeout(void *arg)
 	/* Make sure the sequencer is in a safe location. */
 	ahc_clear_critical_section(ahc);
 
-	ahc_print_path(ahc, scb);
 	if ((scb->flags & SCB_ACTIVE) == 0) {
 		/* Previous timeout took care of me already */
-		printf("Timedout SCB %d handled by another timeout\n",
-		       scb->hscb->tag);
+		printf("%s: Timedout SCB already complete. "
+		       "Interrupts may not be functioning.\n", ahc_name(ahc));
 		unpause_sequencer(ahc);
 		ahc_unlock(ahc, &s);
 		return;
diff --git a/sys/dev/aic7xxx/aic7xxx_osm.c b/sys/dev/aic7xxx/aic7xxx_osm.c
index eb56508..4ca846c 100644
--- a/sys/dev/aic7xxx/aic7xxx_osm.c
+++ b/sys/dev/aic7xxx/aic7xxx_osm.c
@@ -43,7 +43,6 @@
 #endif
 
 #define ccb_scb_ptr spriv_ptr0
-#define ccb_ahc_ptr spriv_ptr1
 
 #ifdef AHC_DEBUG
 static int     ahc_debug = AHC_DEBUG;
@@ -265,14 +264,12 @@ ahc_done(struct ahc_softc *ahc, struct scb *scb)
 
 	ccb = scb->io_ctx;
 	LIST_REMOVE(scb, pending_links);
-	if (ccb->ccb_h.func_code == XPT_SCSI_IO
-	  && ((ccb->ccb_h.flags & CAM_TAG_ACTION_VALID) == 0
-	   || ccb->csio.tag_action == CAM_TAG_ACTION_NONE)
-	  && (ahc->features & AHC_SCB_BTT) == 0) {
+	if ((scb->flags & SCB_UNTAGGEDQ) != 0) {
 		struct scb_tailq *untagged_q;
 
 		untagged_q = &ahc->untagged_queues[ccb->ccb_h.target_id];
 		TAILQ_REMOVE(untagged_q, scb, links.tqe);
+		scb->flags &= ~SCB_UNTAGGEDQ;
 		ahc_run_untagged_queue(ahc, untagged_q);
 	}
 
@@ -451,7 +448,6 @@ ahc_action(struct cam_sim *sim, union ccb *ccb)
 		 * So we can find the SCB when an abort is requested
 		 */
 		ccb->ccb_h.ccb_scb_ptr = scb;
-		ccb->ccb_h.ccb_ahc_ptr = ahc;
 
 		/*
 		 * Put all the arguments for the xfer in the scb
@@ -1052,7 +1048,7 @@ ahc_execute_scb(void *arg, bus_dma_segment_t *dm_segs, int nsegments,
 
 	scb = (struct scb *)arg;
 	ccb = scb->io_ctx;
-	ahc = (struct ahc_softc *)ccb->ccb_h.ccb_ahc_ptr;
+	ahc = scb->ahc_softc;
 
 	if (error != 0) {
 		if (error == EFBIG)
@@ -1215,6 +1211,7 @@ ahc_execute_scb(void *arg, bus_dma_segment_t *dm_segs, int nsegments,
 
 		untagged_q = &(ahc->untagged_queues[ccb->ccb_h.target_id]);
 		TAILQ_INSERT_TAIL(untagged_q, scb, links.tqe);
+		scb->flags |= SCB_UNTAGGEDQ;
 		if (TAILQ_FIRST(untagged_q) != scb) {
 			ahc_unlock(ahc, &s);
 			return;
@@ -1397,7 +1394,7 @@ ahc_timeout(void *arg)
 	char	channel;
 
 	scb = (struct scb *)arg; 
-	ahc = (struct ahc_softc *)scb->io_ctx->ccb_h.ccb_ahc_ptr;
+	ahc = (struct ahc_softc *)scb->ahc_softc;
 
 	ahc_lock(ahc, &s);
 
@@ -1415,11 +1412,10 @@ ahc_timeout(void *arg)
 	/* Make sure the sequencer is in a safe location. */
 	ahc_clear_critical_section(ahc);
 
-	ahc_print_path(ahc, scb);
 	if ((scb->flags & SCB_ACTIVE) == 0) {
 		/* Previous timeout took care of me already */
-		printf("Timedout SCB %d handled by another timeout\n",
-		       scb->hscb->tag);
+		printf("%s: Timedout SCB already complete. "
+		       "Interrupts may not be functioning.\n", ahc_name(ahc));
 		unpause_sequencer(ahc);
 		ahc_unlock(ahc, &s);
 		return;