for possible buffer overflow problems. Replaced most sprintf()'s
with snprintf(); for others cases, added terminating NUL bytes where
appropriate, replaced constants like "16" with sizeof(), etc.
These changes include several bug fixes, but most changes are for
maintainability's sake. Any instance where it wasn't "immediately
obvious" that a buffer overflow could not occur was made safer.
Reviewed by: Bruce Evans <bde@zeta.org.au>
Reviewed by: Matthew Dillon <dillon@apollo.backplane.com>
Reviewed by: Mike Spengler <mks@networkcs.com>
insertion point into the start queue looking for entries to remove and
mark them with the 'skip' address, recording the entry furthest from the
insertion point that needs to be removed. We then go through a second
loop starting at the furthest entry to be removed and compress the start
queue. The old algorithm started at (old insert point + 1) and wrapped
through the whole queue which would end up moving the start position in
the queue out from under the nose of the scrip processor.
full condition or other error which requires us to purge the
controller's start queue of transactions for a particular device.
We were relying on the NCR CCB's program address to cause the
script engine to skip to the next entry in the queue even though
the CCB is freed (and its program address switched to the idle
loop) by this action. We now set the address in the start queue
to be the "skip" function directly.
in ddb) which I broke by changing %8[l]x to %8p. Hacked the central
printf routine to not add an "0x" prefix for %p formats if the field
width is nonzero. The tables are still horribly misformatted on
64-bit machines.
Use %p instead of %8p to print pointers when the field width isn't
important.
hidden). Now "ticks" are used, which are 4 byte, not 8 byte in size.
The size mismatch did not matter due to sufficient padding at the end
of the structure that holds time stamps (there is an unused member).
The fix suggested by Bruce Evans used "sizeof (ticks_t)", but I prefer
to use "sizeof ticks", and didn't seem to object in his last mail on
this topic.
Submitted by: bde
FreeBSD/alpha. The most significant item is to change the command
argument to ioctl functions from int to u_long. This change brings us
inline with various other BSD versions. Driver writers may like to
use (__FreeBSD_version == 300003) to detect this change.
The prototype FreeBSD/alpha machdep will follow in a couple of days
time.
"time" wasn't a atomic variable, so splfoo() protection were needed
around any access to it, unless you just wanted the seconds part.
Most uses of time.tv_sec now uses the new variable time_second instead.
gettime() changed to getmicrotime(0.
Remove a couple of unneeded splfoo() protections, the new getmicrotime()
is atomic, (until Bruce sets a breakpoint in it).
A couple of places needed random data, so use read_random() instead
of mucking about with time which isn't random.
Add a new nfs_curusec() function.
Mark a couple of bogosities involving the now disappeard time variable.
Update ffs_update() to avoid the weird "== &time" checks, by fixing the
one remaining call that passwd &time as args.
Change profiling in ncr.c to use ticks instead of time. Resolution is
the same.
Add new function "tvtohz()" to avoid the bogus "splfoo(), add time, call
hzto() which subtracts time" sequences.
Reviewed by: bde
number of tags (NCR_SCSI_DFLT_TAGS), which is 0 in the FAILSAFE case.
This should fix the incompatibility between kernel and ncrcontrol,
which is the result of FAILSAFE being defined in the kernel config
file, invisible to the build of ncrcontrol. (See kern/5133, which
should be fixed by this change.)
could cause a solid system lockup in the driver attach:
These chips do not abort an access to the internal SRAM, when
the driver set the software reset bit in the istat register. But
the chip will never acknowledge the requested PCI bus transfer
in the situation, causing an infinite wait and a lockout of other
bus-masters.
The problem has been reported for rev 0x11 of the 53c825a and
rev 0x01 of the 53c875.
Revisions 0x13 of the 53c825a and 0x03 of the 53c875 are known
to support SRAM accesses, even in the software reset state.
- Do not malloc SCRIPTS memory for those parts of the microcode that
are to be loaded into the on-chip SRAM of the 53c825a or 875 ...
- Modify ncr_chip_lookup to make adding new entries easier.
- Disable use of on-chip SRAM for the 53c825 rev 0x10 to 0x12, since
there seems to be a problem with rev 0x11, while 0x13 is known to
work. (Tested by Chuck Robey <chuckr@glue.umd.edu>).
This code will be merged into 2.2-stable after a few more days of
testing in -current.
should work with no driver changes, though not all features are currently
used.
Remove code that was conditional on NEW_SCSICONF not being defined. This
was temporary code, that at a time got excluded correctly, until the new
scsiconf became the default, and NEW_SCSICONF was no longer specified.
Add support for quirks defined in scsiconf.c. For now only the HP3724/5
needs an entry, since that drive can't be used with tags.
type mismatches. There was no problem in practice (at least on 386's).
Removed NetBSD-related TIMEOUT macro. NetBSD uses the same BSD4.4Lite
timeout interface as FreeBSD. As a concession to portability, declare
the timeout function without using the FreeBSD timeout_t typedef.
form `tv = time'. Use a new function gettime(). The current version
just forces atomicicity without fixing precision or efficiency bugs.
Simplified some related valid accesses by using the central function.
This will make a number of things easier in the future, as well as (finally!)
avoiding the Id-smashing problem which has plagued developers for so long.
Boy, I'm glad we're not using sup anymore. This update would have been
insane otherwise.
NCR driver dies when "xmcd" accesses the CD-ROM drive
Restrict cacheing of INQUIRY results to LUN 0.
Thanks to Dave Huang <khym@bga.com> for reporting the problem
and suggesting a fix, though I chose a slightly different one.
Tekram DC390W/U/F, whose config EEPROM can now be dumped, if the kernel
is built with option NCR_TEKRAM_EEPROM.
Other changes:
- add brackets to expansion of OUTB/W/L macro arguments.
- remove unused NCB structure element ns_async
- support sync. SCSI offset of 16 (instead of only 8) on 825A and 875
- correctly identify 53c810A and 53c825A chips
- preserve SCSI BIOS settings of PCI performance options
- remove (already disabled) support for NCR reset because of command timeout
- reverse order of reading of SCSI and DMA specific interrupt cause registers
- add definition of Tekram config EEPROM contents (not currently used)
I've added an installation from optical disk drive facility.
This enables FreeBSD to be installed from an optical disk, which
may be formatted in "super floppy" style or sliced into MSDOS-FS
and UFS partitions.
Note: ncr.c should be reviewed by Stefan Esser <se@freebsd.org>
and cd.c by Joerg Wunsch <joerg@freebsd.org> before bringing this
into 2.2.
Submitted-By: Shunsuke Akiyama <akiyama@kme.mei.co.jp>
This follows more closely the suggestions in the latest NCR docs, and has
been running on my system for weeks with no problem. It does improve the
quality of diagnostic messages and does allow to better understand the
sequence of events in case of an error.
This should go into 2.2 and 2.1.6.
Still no support for Ultra-SCSI and other new features, but the code
should now correctly initialize the clock pre-scaler (based on freqency
measurement results, if necessary).
Fix support of 16 targets for WIDE SCSI.
Disable bus reset in case no progress is made for too long ("ncr dead"
message), which did not work too well with scanners and other slow devices.
logic clock signal, which had been erroneously commented out by the
previous commit. This will re-enable support for sync. transfer negotiation,
which depends on one of those values.
calculate an optimum value from (constant) parameters.
This should set the SCNTL3 register of the 53c860 and 53c875 to twice
the divider it used to be, since cards based on those chips seem to use
an 80MHz clock instead of the Clock Doubler feature and a 40MHz clock.
Use new XS_SELTIMEOUT error code for selection timeouts.
aic7870.c:
Move SCB walking code to aic7xxx.c and make it work for all card types.
The flag AHC_EXTSCB is no longer needed since the SCBs are walked in
all cases now.
vm_offset_t is currently unsigned long but should probably be plain
unsigned for i386's to match the choice of minimal types to represent
for fixed-width types in Lite2. Anyway, it shouldn't be assumed
to be unsigned long.
I only fixed the type mismatches that were detected when I changed
vm_offset_t to unsigned. Only pointer type mismatches were detected.
- Do not enable tagged commands by default
- Probe only 1 LUN
- Do not negotiate sync. transfer with CDROM drives
Defining FAILSAFE will result in a driver that will tolerate
marginal hardware for the price of a slight loss of performance
It is intended for use in install kernels.
Cleanse the SCSI subsystem of its internally defined types
u_int32, u_int16, u_int8, int32, int16, int8.
Use the system defined *_t types instead.
aic7870.c:
Handle Seeprom data a little better.
that don't announce support for command queues.
SCSI_NCR_DFLT_TAGS can be specified in the kernel config file
and sets the default number of tags per disk drive.
A value of 0 means "no tags".
Minor correction in debug messages: Values from the msg_in
buffer were being printed in the msg_out trace message ...
(To be replaced by sysctl accesses some time ...)
Remove a backward jump from the NCR script, which allowed a SCSI target
to receive any number of NOP messages it desired. If a target indeed
does such a silly thing, make it fail at the next instruction, instead
of causing a timeout a few seconds later.
#includes to get prototypes.
pci now uses a different interrupt handler type for interrupts that it
dispatches and the isa interrupt handler type for the interrupts that
it handles.
and for the 53c810ap, the improved version of the 53c810.
The driver should work with all those controllers, but doesn't know
about any of their advanced features.
of NCR script labels and of command control block structure components.
This allows for easy modification of the actual virtual to physical
mapping operator used ...
Make all applicable references to physical address values use the above
macros instead of calls to vtophys().
They shouldn't affect FreeBSD, since they are within #ifdef NETBSD
directives.
Changed the HAD_ERROR return code into COMPLETE according to a comment
in "/sys/scsi/scsiconf.h"
Submitted by: Andreas Wrede <andreas@planix.com>
This seems to work fine on my 53c810, but really should be tested on
a 53c825 with at least one target set to an ID >= 8.
The script is now copied to memory mapped using vm_page_alloc_contig(),
since it has to be physically contigous. This must be changed, if the
driver is converted into a loadable module !
Two of the probe messages are suppressed, unless "bootverbose" is set.
contiguous memory in virtual space, but doesn't guarantee any particular
physical layout of pages, the script may be not contguous in physical
memory. This made the first write command fail in very rare cases.
This has been fixed by checking the region returned by malloc() for
being contiguous, but there should be a physical memory allocate
and later mapping to virtual memory instead.
A few assertions and error messages are improved.
This change forces the controller drivers to allocate a scsibus_data struct
via a call to scsi_alloc_bus(), fill in the adapter_link field, and optionally
modify any other fields of the struct. Scsi_alloc_bus() initializes all fields
to the default, so the changes in most drivers are very minimal. For drivers
that support Wide controllers, the maxtarg field will have to be updated to
allow probing of all targets (for an example, look at the aic7xxx driver).
Scsi_attachdevs() now takes a scsibus_data* as its argument instead of an
sc_link*. This allows us to expand the role of the scsibus_data struct for
other bus level configuration setings (max number of transactions, current
transaction opennings, etc for better tagged queuing support).
Reviewed by: Rodney Grimes <rgrimes>, Peter Dufault <dufault>, Julian Elischer <julian>
