It is invalid to scsi_done(xs) and then return TRY_AGAIN_LATER.

scsi_done() can release the scsi_request xs and TRY_AGAIN_LATER will
refer to it and submit it for re-execution. This was being done only
if bus_dmamap_load() failed.

Ensure the controller resources are freed before returning
TRY_AGAIN_LATER, since new resources will be allocated when the
command is executed again.

Don't bother setting xs->error before returning TRY_AGAIN_LATER as the
code returned to sets xs->error to XS_BUSY.

ok marco@

3 files changed, 13 insertions, 20 deletions

diff --git a/sys/dev/ic/aic79xx_openbsd.c b/sys/dev/ic/aic79xx_openbsd.c
index 75f439ae849..f16aaceab30 100644
--- a/sys/dev/ic/aic79xx_openbsd.c
+++ b/sys/dev/ic/aic79xx_openbsd.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: aic79xx_openbsd.c,v 1.21 2005/10/06 23:04:28 krw Exp $	*/
+/*	$OpenBSD: aic79xx_openbsd.c,v 1.22 2005/11/02 03:27:39 krw Exp $	*/
 
 /*
  * Copyright (c) 2004 Milos Urbanek, Kenneth R. Westerback & Marco Peereboom
@@ -376,7 +376,6 @@ ahd_action(struct scsi_xfer *xs)
 	if ((scb = ahd_get_scb(ahd, col_idx)) == NULL) {
 		ahd->flags |= AHD_RESOURCE_SHORTAGE;
 		ahd_unlock(ahd, &s);
-		xs->error = XS_DRIVER_STUFFUP;
 		return (TRY_AGAIN_LATER);
 	}
 	ahd_unlock(ahd, &s);
@@ -569,15 +568,14 @@ ahd_setup_data(struct ahd_softc *ahd, struct scsi_xfer *xs,
 	       struct scb *scb)
 {
 	struct hardware_scb *hscb;
-	
+	int s;
+
 	hscb = scb->hscb;
 	xs->resid = xs->status = 0;
 	xs->error = CAM_REQ_INPROG;
 	
 	hscb->cdb_len = xs->cmdlen;
 	if (hscb->cdb_len > MAX_CDB_LEN) {
-		int s;
-		
 		aic_set_transaction_status(scb, CAM_REQ_INVALID);
 		ahd_lock(ahd, &s);
 		ahd_free_scb(ahd, scb);
@@ -606,9 +604,9 @@ ahd_setup_data(struct ahd_softc *ahd, struct scsi_xfer *xs,
 			printf("%s: in ahd_setup_data(): bus_dmamap_load() "
 			    "= %d\n", ahd_name(ahd), error);
 #endif
-			xs->error = XS_BUSY;
-			xs->flags |= ITSDONE;
-			scsi_done(xs);
+			ahd_lock(ahd, &s);
+			ahd_free_scb(ahd, scb);
+			ahd_unlock(ahd, &s);
 			return (TRY_AGAIN_LATER);       /* XXX fvdl */
 		}
 		error = ahd_execute_scb(scb, scb->dmamap->dm_segs,
diff --git a/sys/dev/ic/aic7xxx_openbsd.c b/sys/dev/ic/aic7xxx_openbsd.c
index 62912bc9758..b78db6f37e5 100644
--- a/sys/dev/ic/aic7xxx_openbsd.c
+++ b/sys/dev/ic/aic7xxx_openbsd.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: aic7xxx_openbsd.c,v 1.29 2005/02/12 15:32:12 krw Exp $	*/
+/*	$OpenBSD: aic7xxx_openbsd.c,v 1.30 2005/11/02 03:27:39 krw Exp $	*/
 /*	$NetBSD: aic7xxx_osm.c,v 1.14 2003/11/02 11:07:44 wiz Exp $	*/
 
 /*
@@ -346,7 +346,6 @@ ahc_action(struct scsi_xfer *xs)
 	ahc_lock(ahc, &s);
 	if ((scb = ahc_get_scb(ahc)) == NULL) {
 		ahc_unlock(ahc, &s);
-		xs->error = XS_DRIVER_STUFFUP;
 		return (TRY_AGAIN_LATER);
 	}
 	ahc_unlock(ahc, &s);
@@ -591,15 +590,14 @@ ahc_setup_data(struct ahc_softc *ahc, struct scsi_xfer *xs,
 	       struct scb *scb)
 {
 	struct hardware_scb *hscb;
-	
+	int s;
+
 	hscb = scb->hscb;
 	xs->resid = xs->status = 0;
 	xs->error = CAM_REQ_INPROG;
 
 	hscb->cdb_len = xs->cmdlen;
 	if (hscb->cdb_len > sizeof(hscb->cdb32)) {
-		int s;
-
 		ahc_set_transaction_status(scb, CAM_REQ_INVALID);
 		ahc_lock(ahc, &s);
 		ahc_free_scb(ahc, scb);
@@ -631,9 +629,9 @@ ahc_setup_data(struct ahc_softc *ahc, struct scsi_xfer *xs,
 			       "= %d\n",
 			       ahc_name(ahc), error);
 #endif
-			xs->error = XS_BUSY;
-			xs->flags |= ITSDONE;
-			scsi_done(xs);
+			ahc_lock(ahc, &s);
+			ahc_free_scb(ahc, scb);
+			ahc_unlock(ahc, &s);
 			return (TRY_AGAIN_LATER);	/* XXX fvdl */
 }
 		error = ahc_execute_scb(scb,
diff --git a/sys/dev/ic/mpt_openbsd.c b/sys/dev/ic/mpt_openbsd.c
index 8b9975a96d1..5d66decd8a5 100644
--- a/sys/dev/ic/mpt_openbsd.c
+++ b/sys/dev/ic/mpt_openbsd.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: mpt_openbsd.c,v 1.24 2005/07/20 03:20:06 marco Exp $	*/
+/*	$OpenBSD: mpt_openbsd.c,v 1.25 2005/11/02 03:27:39 krw Exp $	*/
 /*	$NetBSD: mpt_netbsd.c,v 1.7 2003/07/14 15:47:11 lukem Exp $	*/
 
 /*
@@ -1077,13 +1077,10 @@ mpt_run_xfer(mpt_softc_t *mpt, struct scsi_xfer *xs)
 			xs->error = XS_DRIVER_STUFFUP;
 			goto out_bad;
 		default:
-			xs->error = XS_DRIVER_STUFFUP;
 			mpt_prt(mpt, "error %d loading DMA map", error);
  out_bad:
 			s = splbio();
 			mpt_free_request(mpt, req);
-			xs->flags |= ITSDONE;
-			scsi_done(xs);
 			splx(s);
 			return (TRY_AGAIN_LATER);
 		}