xref: /dragonfly/sys/dev/disk/ahci/ahci_cam.c (revision 9f3fc534)
1 /*
2  * Copyright (c) 2009 The DragonFly Project.  All rights reserved.
3  *
4  * This code is derived from software contributed to The DragonFly Project
5  * by Matthew Dillon <dillon@backplane.com>
6  *
7  * Redistribution and use in source and binary forms, with or without
8  * modification, are permitted provided that the following conditions
9  * are met:
10  *
11  * 1. Redistributions of source code must retain the above copyright
12  *    notice, this list of conditions and the following disclaimer.
13  * 2. Redistributions in binary form must reproduce the above copyright
14  *    notice, this list of conditions and the following disclaimer in
15  *    the documentation and/or other materials provided with the
16  *    distribution.
17  * 3. Neither the name of The DragonFly Project nor the names of its
18  *    contributors may be used to endorse or promote products derived
19  *    from this software without specific, prior written permission.
20  *
21  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
22  * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
23  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
24  * FOR A PARTICULAR PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE
25  * COPYRIGHT HOLDERS OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
26  * INCIDENTAL, SPECIAL, EXEMPLARY OR CONSEQUENTIAL DAMAGES (INCLUDING,
27  * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
28  * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED
29  * AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
30  * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT
31  * OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
32  * SUCH DAMAGE.
33  *
34  *
35  * Copyright (c) 2007 David Gwynne <dlg@openbsd.org>
36  *
37  * Permission to use, copy, modify, and distribute this software for any
38  * purpose with or without fee is hereby granted, provided that the above
39  * copyright notice and this permission notice appear in all copies.
40  *
41  * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
42  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
43  * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
44  * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
45  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
46  * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
47  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
48  *
49  * $OpenBSD: atascsi.c,v 1.64 2009/02/16 21:19:06 miod Exp $
50  * $DragonFly$
51  */
52 /*
53  * Implement each SATA port as its own SCSI bus on CAM.  This way we can
54  * implement future port multiplier features as individual devices on the
55  * bus.
56  *
57  * Much of the cdb<->xa conversion code was taken from OpenBSD, the rest
58  * was written natively for DragonFly.
59  */
60 
61 #include "ahci.h"
62 
63 const char *ScsiTypeArray[32] = {
64 	"DIRECT",
65 	"SEQUENTIAL",
66 	"PRINTER",
67 	"PROCESSOR",
68 	"WORM",
69 	"CDROM",
70 	"SCANNER",
71 	"OPTICAL",
72 	"CHANGER",
73 	"COMM",
74 	"ASC0",
75 	"ASC1",
76 	"STORARRAY",
77 	"ENCLOSURE",
78 	"RBC",
79 	"OCRW",
80 	"0x10",
81 	"OSD",
82 	"ADC",
83 	"0x13",
84 	"0x14",
85 	"0x15",
86 	"0x16",
87 	"0x17",
88 	"0x18",
89 	"0x19",
90 	"0x1A",
91 	"0x1B",
92 	"0x1C",
93 	"0x1D",
94 	"0x1E",
95 	"NODEVICE"
96 };
97 
98 static void ahci_xpt_action(struct cam_sim *sim, union ccb *ccb);
99 static void ahci_xpt_poll(struct cam_sim *sim);
100 static void ahci_xpt_scsi_disk_io(struct ahci_port *ap,
101 			struct ata_port *at, union ccb *ccb);
102 static void ahci_xpt_scsi_atapi_io(struct ahci_port *ap,
103 			struct ata_port *at, union ccb *ccb);
104 
105 static void ahci_ata_complete_disk_rw(struct ata_xfer *xa);
106 static void ahci_ata_complete_disk_synchronize_cache(struct ata_xfer *xa);
107 static void ahci_atapi_complete_cmd(struct ata_xfer *xa);
108 static void ahci_ata_dummy_sense(struct scsi_sense_data *sense_data);
109 static void ahci_ata_atapi_sense(struct ata_fis_d2h *rfis,
110 		     struct scsi_sense_data *sense_data);
111 
112 static int ahci_cam_probe_disk(struct ahci_port *ap, struct ata_port *at);
113 static int ahci_cam_probe_atapi(struct ahci_port *ap, struct ata_port *at);
114 static void ahci_ata_dummy_done(struct ata_xfer *xa);
115 static void ata_fix_identify(struct ata_identify *id);
116 static void ahci_cam_rescan(struct ahci_port *ap);
117 
118 int
119 ahci_cam_attach(struct ahci_port *ap)
120 {
121 	struct cam_devq *devq;
122 	struct cam_sim *sim;
123 	int error;
124 	int unit;
125 
126 	/*
127 	 * We want at least one ccb to be available for error processing
128 	 * so don't let CAM use more then ncmds - 1.
129 	 */
130 	unit = device_get_unit(ap->ap_sc->sc_dev);
131 	if (ap->ap_sc->sc_ncmds > 1)
132 		devq = cam_simq_alloc(ap->ap_sc->sc_ncmds - 1);
133 	else
134 		devq = cam_simq_alloc(ap->ap_sc->sc_ncmds);
135 	if (devq == NULL) {
136 		return (ENOMEM);
137 	}
138 	sim = cam_sim_alloc(ahci_xpt_action, ahci_xpt_poll, "ahci",
139 			   (void *)ap, unit, &sim_mplock, 1, 1, devq);
140 	cam_simq_release(devq);
141 	if (sim == NULL) {
142 		return (ENOMEM);
143 	}
144 	ap->ap_sim = sim;
145 	ahci_os_unlock_port(ap);
146 	error = xpt_bus_register(ap->ap_sim, ap->ap_num);
147 	ahci_os_lock_port(ap);
148 	if (error != CAM_SUCCESS) {
149 		ahci_cam_detach(ap);
150 		return (EINVAL);
151 	}
152 	ap->ap_flags |= AP_F_BUS_REGISTERED;
153 
154 	if (ap->ap_probe == ATA_PROBE_NEED_IDENT)
155 		error = ahci_cam_probe(ap, NULL);
156 	else
157 		error = 0;
158 	if (error) {
159 		ahci_cam_detach(ap);
160 		return (EIO);
161 	}
162 	ap->ap_flags |= AP_F_CAM_ATTACHED;
163 
164 	return(0);
165 }
166 
167 /*
168  * The state of the port has changed.
169  *
170  * If at is NULL the physical port has changed state.
171  * If at is non-NULL a particular target behind a PM has changed state.
172  *
173  * If found is -1 the target state must be queued to a non-interrupt context.
174  * (only works with at == NULL).
175  *
176  * If found is 0 the target was removed.
177  * If found is 1 the target was inserted.
178  */
179 void
180 ahci_cam_changed(struct ahci_port *ap, struct ata_port *atx, int found)
181 {
182 	struct cam_path *tmppath;
183 	int status;
184 	int target;
185 
186 	target = atx ? atx->at_target : CAM_TARGET_WILDCARD;
187 
188 	if (ap->ap_sim == NULL)
189 		return;
190 	if (found == CAM_TARGET_WILDCARD) {
191 		status = xpt_create_path(&tmppath, NULL,
192 					 cam_sim_path(ap->ap_sim),
193 					 target, CAM_LUN_WILDCARD);
194 		if (status != CAM_REQ_CMP)
195 			return;
196 		ahci_cam_rescan(ap);
197 	} else {
198 		status = xpt_create_path(&tmppath, NULL,
199 					 cam_sim_path(ap->ap_sim),
200 					 target,
201 					 CAM_LUN_WILDCARD);
202 		if (status != CAM_REQ_CMP)
203 			return;
204 #if 0
205 		/*
206 		 * This confuses CAM
207 		 */
208 		if (found)
209 			xpt_async(AC_FOUND_DEVICE, tmppath, NULL);
210 		else
211 			xpt_async(AC_LOST_DEVICE, tmppath, NULL);
212 #endif
213 	}
214 	xpt_free_path(tmppath);
215 }
216 
217 void
218 ahci_cam_detach(struct ahci_port *ap)
219 {
220 	int error;
221 
222 	if ((ap->ap_flags & AP_F_CAM_ATTACHED) == 0)
223 		return;
224 	get_mplock();
225 	if (ap->ap_sim) {
226 		xpt_freeze_simq(ap->ap_sim, 1);
227 	}
228 	if (ap->ap_flags & AP_F_BUS_REGISTERED) {
229 		error = xpt_bus_deregister(cam_sim_path(ap->ap_sim));
230 		KKASSERT(error == CAM_REQ_CMP);
231 		ap->ap_flags &= ~AP_F_BUS_REGISTERED;
232 	}
233 	if (ap->ap_sim) {
234 		cam_sim_free(ap->ap_sim);
235 		ap->ap_sim = NULL;
236 	}
237 	rel_mplock();
238 	ap->ap_flags &= ~AP_F_CAM_ATTACHED;
239 }
240 
241 /*
242  * Once the AHCI port has been attached we need to probe for a device or
243  * devices on the port and setup various options.
244  *
245  * If at is NULL we are probing the direct-attached device on the port,
246  * which may or may not be a port multiplier.
247  */
248 int
249 ahci_cam_probe(struct ahci_port *ap, struct ata_port *atx)
250 {
251 	struct ata_port	*at;
252 	struct ata_xfer	*xa;
253 	u_int64_t	capacity;
254 	u_int64_t	capacity_bytes;
255 	int		model_len;
256 	int		error;
257 	int		devncqdepth;
258 	int		i;
259 	const char	*wcstr;
260 	const char	*rastr;
261 	const char	*scstr;
262 	const char	*type;
263 
264 	error = EIO;
265 
266 	/*
267 	 * Delayed CAM attachment for initial probe, sim may be NULL
268 	 */
269 	if (ap->ap_sim == NULL)
270 		return(0);
271 
272 	/*
273 	 * A NULL atx indicates a probe of the directly connected device.
274 	 * A non-NULL atx indicates a device connected via a port multiplier.
275 	 * We need to preserve atx for calls to ahci_ata_get_xfer().
276 	 *
277 	 * at is always non-NULL.  For directly connected devices we supply
278 	 * an (at) pointing to target 0.
279 	 */
280 	if (atx == NULL) {
281 		at = ap->ap_ata;	/* direct attached - device 0 */
282 		if (ap->ap_type == ATA_PORT_T_PM) {
283 			kprintf("%s: Found Port Multiplier\n",
284 				ATANAME(ap, atx));
285 			return (0);
286 		}
287 		at->at_type = ap->ap_type;
288 	} else {
289 		at = atx;
290 		if (atx->at_type == ATA_PORT_T_PM) {
291 			kprintf("%s: Bogus device, reducing port count to %d\n",
292 				ATANAME(ap, atx), atx->at_target);
293 			if (ap->ap_pmcount > atx->at_target)
294 				ap->ap_pmcount = atx->at_target;
295 			goto err;
296 		}
297 	}
298 	if (ap->ap_type == ATA_PORT_T_NONE)
299 		goto err;
300 	if (at->at_type == ATA_PORT_T_NONE)
301 		goto err;
302 
303 	/*
304 	 * Issue identify, saving the result
305 	 */
306 	xa = ahci_ata_get_xfer(ap, atx);
307 	xa->complete = ahci_ata_dummy_done;
308 	xa->data = &at->at_identify;
309 	xa->datalen = sizeof(at->at_identify);
310 	xa->flags = ATA_F_READ | ATA_F_PIO | ATA_F_POLL;
311 	xa->fis->flags = ATA_H2D_FLAGS_CMD | at->at_target;
312 
313 	switch(at->at_type) {
314 	case ATA_PORT_T_DISK:
315 		xa->fis->command = ATA_C_IDENTIFY;
316 		type = "DISK";
317 		break;
318 	case ATA_PORT_T_ATAPI:
319 		xa->fis->command = ATA_C_ATAPI_IDENTIFY;
320 		xa->flags |= ATA_F_AUTOSENSE;
321 		type = "ATAPI";
322 		break;
323 	default:
324 		xa->fis->command = ATA_C_ATAPI_IDENTIFY;
325 		type = "UNKNOWN(ATAPI?)";
326 		break;
327 	}
328 	xa->fis->features = 0;
329 	xa->fis->device = 0;
330 	xa->timeout = 1000;
331 
332 	if (ahci_ata_cmd(xa) != ATA_S_COMPLETE) {
333 		kprintf("%s: Detected %s device but unable to IDENTIFY\n",
334 			ATANAME(ap, atx), type);
335 		ahci_ata_put_xfer(xa);
336 		goto err;
337 	}
338 	ahci_ata_put_xfer(xa);
339 
340 	ata_fix_identify(&at->at_identify);
341 
342 	/*
343 	 * Read capacity using SATA probe info.
344 	 */
345 	if (le16toh(at->at_identify.cmdset83) & 0x0400) {
346 		/* LBA48 feature set supported */
347 		capacity = 0;
348 		for (i = 3; i >= 0; --i) {
349 			capacity <<= 16;
350 			capacity +=
351 			    le16toh(at->at_identify.addrsecxt[i]);
352 		}
353 	} else {
354 		capacity = le16toh(at->at_identify.addrsec[1]);
355 		capacity <<= 16;
356 		capacity += le16toh(at->at_identify.addrsec[0]);
357 	}
358 	if (capacity == 0)
359 		capacity = 1024 * 1024 / 512;
360 	at->at_capacity = capacity;
361 	if (atx == NULL)
362 		ap->ap_probe = ATA_PROBE_GOOD;
363 
364 	capacity_bytes = capacity * 512;
365 
366 	/*
367 	 * Negotiate NCQ, throw away any ata_xfer's beyond the negotiated
368 	 * number of slots and limit the number of CAM ccb's to one less
369 	 * so we always have a slot available for recovery.
370 	 *
371 	 * NCQ is not used if ap_ncqdepth is 1 or the host controller does
372 	 * not support it, and in that case the driver can handle extra
373 	 * ccb's.
374 	 *
375 	 * NCQ is currently used only with direct-attached disks.  It is
376 	 * not used with port multipliers or direct-attached ATAPI devices.
377 	 *
378 	 * Remember at least one extra CCB needs to be reserved for the
379 	 * error ccb.
380 	 */
381 	if ((ap->ap_sc->sc_cap & AHCI_REG_CAP_SNCQ) &&
382 	    ap->ap_type == ATA_PORT_T_DISK &&
383 	    (le16toh(at->at_identify.satacap) & (1 << 8))) {
384 		at->at_ncqdepth = (le16toh(at->at_identify.qdepth) & 0x1F) + 1;
385 		devncqdepth = at->at_ncqdepth;
386 		if (at->at_ncqdepth > ap->ap_sc->sc_ncmds)
387 			at->at_ncqdepth = ap->ap_sc->sc_ncmds;
388 		if (at->at_ncqdepth > 1) {
389 			for (i = 0; i < ap->ap_sc->sc_ncmds; ++i) {
390 				xa = ahci_ata_get_xfer(ap, atx);
391 				if (xa->tag < at->at_ncqdepth) {
392 					xa->state = ATA_S_COMPLETE;
393 					ahci_ata_put_xfer(xa);
394 				}
395 			}
396 			if (at->at_ncqdepth >= ap->ap_sc->sc_ncmds) {
397 				cam_devq_resize(ap->ap_sim->devq,
398 						at->at_ncqdepth - 1);
399 			}
400 		}
401 	} else {
402 		devncqdepth = 0;
403 	}
404 
405 	/*
406 	 * Make the model string a bit more presentable
407 	 */
408 	for (model_len = 40; model_len; --model_len) {
409 		if (at->at_identify.model[model_len-1] == ' ')
410 			continue;
411 		if (at->at_identify.model[model_len-1] == 0)
412 			continue;
413 		break;
414 	}
415 
416 	/*
417 	 * Generate informatiive strings.
418 	 *
419 	 * NOTE: We do not automatically set write caching, lookahead,
420 	 *	 or the security state for ATAPI devices.
421 	 */
422 	if (at->at_identify.cmdset82 & ATA_IDENTIFY_WRITECACHE) {
423 		if (at->at_identify.features85 & ATA_IDENTIFY_WRITECACHE)
424 			wcstr = "enabled";
425 		else if (at->at_type == ATA_PORT_T_ATAPI)
426 			wcstr = "disabled";
427 		else
428 			wcstr = "enabling";
429 	} else {
430 		    wcstr = "notsupp";
431 	}
432 
433 	if (at->at_identify.cmdset82 & ATA_IDENTIFY_LOOKAHEAD) {
434 		if (at->at_identify.features85 & ATA_IDENTIFY_LOOKAHEAD)
435 			rastr = "enabled";
436 		else if (at->at_type == ATA_PORT_T_ATAPI)
437 			rastr = "disabled";
438 		else
439 			rastr = "enabling";
440 	} else {
441 		    rastr = "notsupp";
442 	}
443 
444 	if (at->at_identify.cmdset82 & ATA_IDENTIFY_SECURITY) {
445 		if (at->at_identify.securestatus & ATA_SECURE_FROZEN)
446 			scstr = "frozen";
447 		else if (at->at_type == ATA_PORT_T_ATAPI)
448 			scstr = "unfrozen";
449 		else if (AhciNoFeatures & (1 << ap->ap_num))
450 			scstr = "<disabled>";
451 		else
452 			scstr = "freezing";
453 	} else {
454 		    scstr = "notsupp";
455 	}
456 
457 	kprintf("%s: Found %s \"%*.*s %8.8s\" serial=\"%20.20s\"\n"
458 		"%s: tags=%d/%d satacap=%04x satafea=%04x NCQ=%s "
459 		"capacity=%lld.%02dMB\n",
460 
461 		ATANAME(ap, atx),
462 		type,
463 		model_len, model_len,
464 		at->at_identify.model,
465 		at->at_identify.firmware,
466 		at->at_identify.serial,
467 
468 		ATANAME(ap, atx),
469 		devncqdepth, ap->ap_sc->sc_ncmds,
470 		at->at_identify.satacap,
471 		at->at_identify.satafsup,
472 		(at->at_ncqdepth > 1 ? "YES" : "NO"),
473 		(long long)capacity_bytes / (1024 * 1024),
474 		(int)(capacity_bytes % (1024 * 1024)) * 100 / (1024 * 1024)
475 	);
476 	kprintf("%s: f85=%04x f86=%04x f87=%04x WC=%s RA=%s SEC=%s\n",
477 		ATANAME(ap, atx),
478 		at->at_identify.features85,
479 		at->at_identify.features86,
480 		at->at_identify.features87,
481 		wcstr,
482 		rastr,
483 		scstr
484 	);
485 
486 	/*
487 	 * Additional type-specific probing
488 	 */
489 	switch(at->at_type) {
490 	case ATA_PORT_T_DISK:
491 		error = ahci_cam_probe_disk(ap, atx);
492 		break;
493 	case ATA_PORT_T_ATAPI:
494 		error = ahci_cam_probe_atapi(ap, atx);
495 		break;
496 	default:
497 		error = EIO;
498 		break;
499 	}
500 err:
501 	if (error) {
502 		at->at_probe = ATA_PROBE_FAILED;
503 		if (atx == NULL)
504 			ap->ap_probe = at->at_probe;
505 	} else {
506 		at->at_probe = ATA_PROBE_GOOD;
507 		if (atx == NULL)
508 			ap->ap_probe = at->at_probe;
509 	}
510 	return (error);
511 }
512 
513 /*
514  * DISK-specific probe after initial ident
515  */
516 static int
517 ahci_cam_probe_disk(struct ahci_port *ap, struct ata_port *atx)
518 {
519 	struct ata_port *at;
520 	struct ata_xfer	*xa;
521 
522 	at = atx ? atx : ap->ap_ata;
523 
524 	/*
525 	 * Enable write cache if supported
526 	 *
527 	 * NOTE: "WD My Book" external disk devices have a very poor
528 	 *	 daughter board between the the ESATA and the HD.  Sending
529 	 *	 any ATA_C_SET_FEATURES commands will break the hardware port
530 	 *	 with a fatal protocol error.  However, this device also
531 	 *	 indicates that WRITECACHE is already on and READAHEAD is
532 	 *	 not supported so we avoid the issue.
533 	 */
534 	if ((at->at_identify.cmdset82 & ATA_IDENTIFY_WRITECACHE) &&
535 	    (at->at_identify.features85 & ATA_IDENTIFY_WRITECACHE) == 0) {
536 		xa = ahci_ata_get_xfer(ap, atx);
537 		xa->complete = ahci_ata_dummy_done;
538 		xa->fis->command = ATA_C_SET_FEATURES;
539 		/*xa->fis->features = ATA_SF_WRITECACHE_EN;*/
540 		xa->fis->features = ATA_SF_LOOKAHEAD_EN;
541 		xa->fis->flags = ATA_H2D_FLAGS_CMD | at->at_target;
542 		xa->fis->device = 0;
543 		xa->flags = ATA_F_READ | ATA_F_PIO | ATA_F_POLL;
544 		xa->timeout = 1000;
545 		xa->datalen = 0;
546 		if (ahci_ata_cmd(xa) == ATA_S_COMPLETE)
547 			at->at_features |= ATA_PORT_F_WCACHE;
548 		else
549 			kprintf("%s: Unable to enable write-caching\n",
550 				ATANAME(ap, atx));
551 		ahci_ata_put_xfer(xa);
552 	}
553 
554 	/*
555 	 * Enable readahead if supported
556 	 */
557 	if ((at->at_identify.cmdset82 & ATA_IDENTIFY_LOOKAHEAD) &&
558 	    (at->at_identify.features85 & ATA_IDENTIFY_LOOKAHEAD) == 0) {
559 		xa = ahci_ata_get_xfer(ap, atx);
560 		xa->complete = ahci_ata_dummy_done;
561 		xa->fis->command = ATA_C_SET_FEATURES;
562 		xa->fis->features = ATA_SF_LOOKAHEAD_EN;
563 		xa->fis->flags = ATA_H2D_FLAGS_CMD | at->at_target;
564 		xa->fis->device = 0;
565 		xa->flags = ATA_F_READ | ATA_F_PIO | ATA_F_POLL;
566 		xa->timeout = 1000;
567 		xa->datalen = 0;
568 		if (ahci_ata_cmd(xa) == ATA_S_COMPLETE)
569 			at->at_features |= ATA_PORT_F_RAHEAD;
570 		else
571 			kprintf("%s: Unable to enable read-ahead\n",
572 				ATANAME(ap, atx));
573 		ahci_ata_put_xfer(xa);
574 	}
575 
576 	/*
577 	 * FREEZE LOCK the device so malicious users can't lock it on us.
578 	 * As there is no harm in issuing this to devices that don't
579 	 * support the security feature set we just send it, and don't bother
580 	 * checking if the device sends a command abort to tell us it doesn't
581 	 * support it
582 	 */
583 	if ((at->at_identify.cmdset82 & ATA_IDENTIFY_SECURITY) &&
584 	    (at->at_identify.securestatus & ATA_SECURE_FROZEN) == 0 &&
585 	    (AhciNoFeatures & (1 << ap->ap_num)) == 0) {
586 		xa = ahci_ata_get_xfer(ap, atx);
587 		xa->complete = ahci_ata_dummy_done;
588 		xa->fis->command = ATA_C_SEC_FREEZE_LOCK;
589 		xa->fis->flags = ATA_H2D_FLAGS_CMD | at->at_target;
590 		xa->flags = ATA_F_READ | ATA_F_PIO | ATA_F_POLL;
591 		xa->timeout = 1000;
592 		xa->datalen = 0;
593 		if (ahci_ata_cmd(xa) == ATA_S_COMPLETE)
594 			at->at_features |= ATA_PORT_F_FRZLCK;
595 		else
596 			kprintf("%s: Unable to set security freeze\n",
597 				ATANAME(ap, atx));
598 		ahci_ata_put_xfer(xa);
599 	}
600 
601 	return (0);
602 }
603 
604 /*
605  * ATAPI-specific probe after initial ident
606  */
607 static int
608 ahci_cam_probe_atapi(struct ahci_port *ap, struct ata_port *atx)
609 {
610 	return(0);
611 }
612 
613 /*
614  * Fix byte ordering so buffers can be accessed as
615  * strings.
616  */
617 static void
618 ata_fix_identify(struct ata_identify *id)
619 {
620 	u_int16_t	*swap;
621 	int		i;
622 
623 	swap = (u_int16_t *)id->serial;
624 	for (i = 0; i < sizeof(id->serial) / sizeof(u_int16_t); i++)
625 		swap[i] = bswap16(swap[i]);
626 
627 	swap = (u_int16_t *)id->firmware;
628 	for (i = 0; i < sizeof(id->firmware) / sizeof(u_int16_t); i++)
629 		swap[i] = bswap16(swap[i]);
630 
631 	swap = (u_int16_t *)id->model;
632 	for (i = 0; i < sizeof(id->model) / sizeof(u_int16_t); i++)
633 		swap[i] = bswap16(swap[i]);
634 }
635 
636 /*
637  * Dummy done callback for xa.
638  */
639 static void
640 ahci_ata_dummy_done(struct ata_xfer *xa)
641 {
642 }
643 
644 /*
645  * Use an engineering request to initiate a target scan for devices
646  * behind a port multiplier.
647  *
648  * An asynchronous bus scan is used to avoid reentrancy issues.
649  */
650 static void
651 ahci_cam_rescan_callback(struct cam_periph *periph, union ccb *ccb)
652 {
653 	struct ahci_port *ap = ccb->ccb_h.sim_priv.entries[0].ptr;
654 
655 	if (ccb->ccb_h.func_code == XPT_SCAN_BUS) {
656 		ap->ap_flags &= ~AP_F_SCAN_RUNNING;
657 		if (ap->ap_flags & AP_F_SCAN_REQUESTED) {
658 			ap->ap_flags &= ~AP_F_SCAN_REQUESTED;
659 			ahci_cam_rescan(ap);
660 		}
661 		ap->ap_flags |= AP_F_SCAN_COMPLETED;
662 		wakeup(&ap->ap_flags);
663 	}
664 	xpt_free_ccb(ccb);
665 }
666 
667 static void
668 ahci_cam_rescan(struct ahci_port *ap)
669 {
670 	struct cam_path *path;
671 	union ccb *ccb;
672 	int status;
673 	int i;
674 
675 	if (ap->ap_flags & AP_F_SCAN_RUNNING) {
676 		ap->ap_flags |= AP_F_SCAN_REQUESTED;
677 		return;
678 	}
679 	ap->ap_flags |= AP_F_SCAN_RUNNING;
680 	for (i = 0; i < AHCI_MAX_PMPORTS; ++i) {
681 		ap->ap_ata[i].at_features |= ATA_PORT_F_RESCAN;
682 	}
683 
684 	status = xpt_create_path(&path, xpt_periph, cam_sim_path(ap->ap_sim),
685 				 CAM_TARGET_WILDCARD, CAM_LUN_WILDCARD);
686 	if (status != CAM_REQ_CMP)
687 		return;
688 
689 	ccb = xpt_alloc_ccb();
690 	xpt_setup_ccb(&ccb->ccb_h, path, 5);	/* 5 = low priority */
691 	ccb->ccb_h.func_code = XPT_ENG_EXEC;
692 	ccb->ccb_h.cbfcnp = ahci_cam_rescan_callback;
693 	ccb->ccb_h.sim_priv.entries[0].ptr = ap;
694 	ccb->crcn.flags = CAM_FLAG_NONE;
695 	xpt_action_async(ccb);
696 }
697 
698 static void
699 ahci_xpt_rescan(struct ahci_port *ap)
700 {
701 	struct cam_path *path;
702 	union ccb *ccb;
703 	int status;
704 
705 	status = xpt_create_path(&path, xpt_periph, cam_sim_path(ap->ap_sim),
706 				 CAM_TARGET_WILDCARD, CAM_LUN_WILDCARD);
707 	if (status != CAM_REQ_CMP)
708 		return;
709 
710 	ccb = xpt_alloc_ccb();
711 	xpt_setup_ccb(&ccb->ccb_h, path, 5);	/* 5 = low priority */
712 	ccb->ccb_h.func_code = XPT_SCAN_BUS;
713 	ccb->ccb_h.cbfcnp = ahci_cam_rescan_callback;
714 	ccb->ccb_h.sim_priv.entries[0].ptr = ap;
715 	ccb->crcn.flags = CAM_FLAG_NONE;
716 	xpt_action_async(ccb);
717 }
718 
719 /*
720  * Action function - dispatch command
721  */
722 static
723 void
724 ahci_xpt_action(struct cam_sim *sim, union ccb *ccb)
725 {
726 	struct ahci_port *ap;
727 	struct ata_port	 *at, *atx;
728 	struct ccb_hdr *ccbh;
729 	int unit;
730 
731 	/* XXX lock */
732 	ap = cam_sim_softc(sim);
733 	at = ap->ap_ata;
734 	atx = NULL;
735 	KKASSERT(ap != NULL);
736 	ccbh = &ccb->ccb_h;
737 	unit = cam_sim_unit(sim);
738 
739 	/*
740 	 * Early failure checks.  These checks do not apply to XPT_PATH_INQ,
741 	 * otherwise the bus rescan will not remove the dead devices when
742 	 * unplugging a PM.
743 	 *
744 	 * For non-wildcards we have one target (0) and one lun (0),
745 	 * unless we have a port multiplier.
746 	 *
747 	 * A wildcard target indicates only the general bus is being
748 	 * probed.
749 	 *
750 	 * Calculate at and atx.  at is always non-NULL.  atx is only
751 	 * non-NULL for direct-attached devices.  It will be NULL for
752 	 * devices behind a port multiplier.
753 	 *
754 	 * XXX What do we do with a LUN wildcard?
755 	 */
756 	if (ccbh->target_id != CAM_TARGET_WILDCARD &&
757 	    ccbh->func_code != XPT_PATH_INQ) {
758 		if (ap->ap_type == ATA_PORT_T_NONE) {
759 			ccbh->status = CAM_DEV_NOT_THERE;
760 			xpt_done(ccb);
761 			return;
762 		}
763 		if (ccbh->target_id < 0 || ccbh->target_id >= ap->ap_pmcount) {
764 			ccbh->status = CAM_DEV_NOT_THERE;
765 			xpt_done(ccb);
766 			return;
767 		}
768 		at += ccbh->target_id;
769 		if (ap->ap_type == ATA_PORT_T_PM)
770 			atx = at;
771 
772 		if (ccbh->target_lun != CAM_LUN_WILDCARD && ccbh->target_lun) {
773 			ccbh->status = CAM_DEV_NOT_THERE;
774 			xpt_done(ccb);
775 			return;
776 		}
777 	}
778 
779 	/*
780 	 * Switch on the meta XPT command
781 	 */
782 	switch(ccbh->func_code) {
783 	case XPT_ENG_EXEC:
784 		/*
785 		 * This routine is called after a port multiplier has been
786 		 * probed.
787 		 */
788 		ccbh->status = CAM_REQ_CMP;
789 		ahci_os_lock_port(ap);
790 		ahci_port_state_machine(ap, 0);
791 		ahci_os_unlock_port(ap);
792 		xpt_done(ccb);
793 		ahci_xpt_rescan(ap);
794 		break;
795 	case XPT_PATH_INQ:
796 		/*
797 		 * This command always succeeds, otherwise the bus scan
798 		 * will not detach dead devices.
799 		 */
800 		ccb->cpi.version_num = 1;
801 		ccb->cpi.hba_inquiry = 0;
802 		ccb->cpi.target_sprt = 0;
803 		ccb->cpi.hba_misc = PIM_SEQSCAN;
804 		ccb->cpi.hba_eng_cnt = 0;
805 		bzero(ccb->cpi.vuhba_flags, sizeof(ccb->cpi.vuhba_flags));
806 		ccb->cpi.max_target = AHCI_MAX_PMPORTS - 1;
807 		ccb->cpi.max_lun = 0;
808 		ccb->cpi.async_flags = 0;
809 		ccb->cpi.hpath_id = 0;
810 		ccb->cpi.initiator_id = AHCI_MAX_PMPORTS - 1;
811 		ccb->cpi.unit_number = cam_sim_unit(sim);
812 		ccb->cpi.bus_id = cam_sim_bus(sim);
813 		ccb->cpi.base_transfer_speed = 150000;
814 		ccb->cpi.transport = XPORT_SATA;
815 		ccb->cpi.transport_version = 1;
816 		ccb->cpi.protocol = PROTO_SCSI;
817 		ccb->cpi.protocol_version = SCSI_REV_2;
818 
819 		ccbh->status = CAM_REQ_CMP;
820 		if (ccbh->target_id == CAM_TARGET_WILDCARD) {
821 			ahci_os_lock_port(ap);
822 			ahci_port_state_machine(ap, 0);
823 			ahci_os_unlock_port(ap);
824 		} else {
825 			switch(ahci_pread(ap, AHCI_PREG_SSTS) &
826 			       AHCI_PREG_SSTS_SPD) {
827 			case AHCI_PREG_SSTS_SPD_GEN1:
828 				ccb->cpi.base_transfer_speed = 150000;
829 				break;
830 			case AHCI_PREG_SSTS_SPD_GEN2:
831 				ccb->cpi.base_transfer_speed = 300000;
832 				break;
833 			default:
834 				/* unknown */
835 				ccb->cpi.base_transfer_speed = 1000;
836 				break;
837 			}
838 #if 0
839 			if (ap->ap_type == ATA_PORT_T_NONE)
840 				ccbh->status = CAM_DEV_NOT_THERE;
841 #endif
842 		}
843 		xpt_done(ccb);
844 		break;
845 	case XPT_RESET_DEV:
846 		ahci_os_lock_port(ap);
847 		if (ap->ap_type == ATA_PORT_T_NONE) {
848 			ccbh->status = CAM_DEV_NOT_THERE;
849 		} else {
850 			ahci_port_reset(ap, atx, 0);
851 			ccbh->status = CAM_REQ_CMP;
852 		}
853 		ahci_os_unlock_port(ap);
854 		xpt_done(ccb);
855 		break;
856 	case XPT_RESET_BUS:
857 		ahci_os_lock_port(ap);
858 		ahci_port_reset(ap, NULL, 1);
859 		ahci_os_unlock_port(ap);
860 		ccbh->status = CAM_REQ_CMP;
861 		xpt_done(ccb);
862 		break;
863 	case XPT_SET_TRAN_SETTINGS:
864 		ccbh->status = CAM_FUNC_NOTAVAIL;
865 		xpt_done(ccb);
866 		break;
867 	case XPT_GET_TRAN_SETTINGS:
868 		ccb->cts.protocol = PROTO_SCSI;
869 		ccb->cts.protocol_version = SCSI_REV_2;
870 		ccb->cts.transport = XPORT_SATA;
871 		ccb->cts.transport_version = XPORT_VERSION_UNSPECIFIED;
872 		ccb->cts.proto_specific.valid = 0;
873 		ccb->cts.xport_specific.valid = 0;
874 		ccbh->status = CAM_REQ_CMP;
875 		xpt_done(ccb);
876 		break;
877 	case XPT_CALC_GEOMETRY:
878 		cam_calc_geometry(&ccb->ccg, 1);
879 		xpt_done(ccb);
880 		break;
881 	case XPT_SCSI_IO:
882 		/*
883 		 * Our parallel startup code might have only probed through
884 		 * to the IDENT, so do the last step if necessary.
885 		 */
886 		if (at->at_probe == ATA_PROBE_NEED_IDENT)
887 			ahci_cam_probe(ap, atx);
888 		if (at->at_probe != ATA_PROBE_GOOD) {
889 			ccbh->status = CAM_DEV_NOT_THERE;
890 			xpt_done(ccb);
891 			break;
892 		}
893 		switch(at->at_type) {
894 		case ATA_PORT_T_DISK:
895 			ahci_xpt_scsi_disk_io(ap, atx, ccb);
896 			break;
897 		case ATA_PORT_T_ATAPI:
898 			ahci_xpt_scsi_atapi_io(ap, atx, ccb);
899 			break;
900 		default:
901 			ccbh->status = CAM_REQ_INVALID;
902 			xpt_done(ccb);
903 			break;
904 		}
905 		break;
906 	default:
907 		ccbh->status = CAM_REQ_INVALID;
908 		xpt_done(ccb);
909 		break;
910 	}
911 }
912 
913 /*
914  * Poll function.
915  *
916  * Generally this function gets called heavily when interrupts might be
917  * non-operational, during a halt/reboot or panic.
918  */
919 static
920 void
921 ahci_xpt_poll(struct cam_sim *sim)
922 {
923 	struct ahci_port *ap;
924 
925 	ap = cam_sim_softc(sim);
926 	crit_enter();
927 	ahci_os_lock_port(ap);
928 	ahci_port_intr(ap, 1);
929 	ahci_os_unlock_port(ap);
930 	crit_exit();
931 }
932 
933 /*
934  * Convert the SCSI command in ccb to an ata_xfer command in xa
935  * for ATA_PORT_T_DISK operations.  Set the completion function
936  * to convert the response back, then dispatch to the OpenBSD AHCI
937  * layer.
938  *
939  * AHCI DISK commands only support a limited command set, and we
940  * fake additional commands to make it play nice with the CAM subsystem.
941  */
942 static
943 void
944 ahci_xpt_scsi_disk_io(struct ahci_port *ap, struct ata_port *atx,
945 		      union ccb *ccb)
946 {
947 	struct ccb_hdr *ccbh;
948 	struct ccb_scsiio *csio;
949 	struct ata_xfer *xa;
950 	struct ata_port	*at;
951 	struct ata_fis_h2d *fis;
952 	scsi_cdb_t cdb;
953 	union scsi_data *rdata;
954 	int rdata_len;
955 	u_int64_t capacity;
956 	u_int64_t lba;
957 	u_int32_t count;
958 
959 	ccbh = &ccb->csio.ccb_h;
960 	csio = &ccb->csio;
961 	at = atx ? atx : &ap->ap_ata[0];
962 
963 	/*
964 	 * XXX not passing NULL at for direct attach!
965 	 */
966 	xa = ahci_ata_get_xfer(ap, atx);
967 	rdata = (void *)csio->data_ptr;
968 	rdata_len = csio->dxfer_len;
969 
970 	/*
971 	 * Build the FIS or process the csio to completion.
972 	 */
973 	cdb = (void *)((ccbh->flags & CAM_CDB_POINTER) ?
974 			csio->cdb_io.cdb_ptr : csio->cdb_io.cdb_bytes);
975 
976 	switch(cdb->generic.opcode) {
977 	case REQUEST_SENSE:
978 		/*
979 		 * Auto-sense everything, so explicit sense requests
980 		 * return no-sense.
981 		 */
982 		ccbh->status = CAM_SCSI_STATUS_ERROR;
983 		break;
984 	case INQUIRY:
985 		/*
986 		 * Inquiry supported features
987 		 *
988 		 * [opcode, byte2, page_code, length, control]
989 		 */
990 		if (cdb->inquiry.byte2 & SI_EVPD) {
991 			switch(cdb->inquiry.page_code) {
992 			case SVPD_SUPPORTED_PAGE_LIST:
993 				/* XXX atascsi_disk_vpd_supported */
994 			case SVPD_UNIT_SERIAL_NUMBER:
995 				/* XXX atascsi_disk_vpd_serial */
996 			case SVPD_UNIT_DEVID:
997 				/* XXX atascsi_disk_vpd_ident */
998 			default:
999 				ccbh->status = CAM_FUNC_NOTAVAIL;
1000 				break;
1001 			}
1002 		} else {
1003 			bzero(rdata, rdata_len);
1004 			if (rdata_len < SHORT_INQUIRY_LENGTH) {
1005 				ccbh->status = CAM_CCB_LEN_ERR;
1006 				break;
1007 			}
1008 			if (rdata_len > sizeof(rdata->inquiry_data))
1009 				rdata_len = sizeof(rdata->inquiry_data);
1010 			rdata->inquiry_data.device = T_DIRECT;
1011 			rdata->inquiry_data.version = SCSI_REV_SPC2;
1012 			rdata->inquiry_data.response_format = 2;
1013 			rdata->inquiry_data.additional_length = 32;
1014 			bcopy("SATA    ", rdata->inquiry_data.vendor, 8);
1015 			bcopy(at->at_identify.model,
1016 			      rdata->inquiry_data.product,
1017 			      sizeof(rdata->inquiry_data.product));
1018 			bcopy(at->at_identify.firmware,
1019 			      rdata->inquiry_data.revision,
1020 			      sizeof(rdata->inquiry_data.revision));
1021 			ccbh->status = CAM_REQ_CMP;
1022 		}
1023 		break;
1024 	case READ_CAPACITY_16:
1025 		if (cdb->read_capacity_16.service_action != SRC16_SERVICE_ACTION) {
1026 			ccbh->status = CAM_REQ_INVALID;
1027 			break;
1028 		}
1029 		if (rdata_len < sizeof(rdata->read_capacity_data_16)) {
1030 			ccbh->status = CAM_CCB_LEN_ERR;
1031 			break;
1032 		}
1033 		/* fall through */
1034 	case READ_CAPACITY:
1035 		if (rdata_len < sizeof(rdata->read_capacity_data)) {
1036 			ccbh->status = CAM_CCB_LEN_ERR;
1037 			break;
1038 		}
1039 
1040 		capacity = at->at_capacity;
1041 
1042 		bzero(rdata, rdata_len);
1043 		if (cdb->generic.opcode == READ_CAPACITY) {
1044 			rdata_len = sizeof(rdata->read_capacity_data);
1045 			if (capacity > 0xFFFFFFFFU)
1046 				capacity = 0xFFFFFFFFU;
1047 			bzero(&rdata->read_capacity_data, rdata_len);
1048 			scsi_ulto4b((u_int32_t)capacity - 1,
1049 				    rdata->read_capacity_data.addr);
1050 			scsi_ulto4b(512, rdata->read_capacity_data.length);
1051 		} else {
1052 			rdata_len = sizeof(rdata->read_capacity_data_16);
1053 			bzero(&rdata->read_capacity_data_16, rdata_len);
1054 			scsi_u64to8b(capacity - 1,
1055 				     rdata->read_capacity_data_16.addr);
1056 			scsi_ulto4b(512, rdata->read_capacity_data_16.length);
1057 		}
1058 		ccbh->status = CAM_REQ_CMP;
1059 		break;
1060 	case SYNCHRONIZE_CACHE:
1061 		/*
1062 		 * Synchronize cache.  Specification says this can take
1063 		 * greater then 30 seconds so give it at least 45.
1064 		 */
1065 		fis = xa->fis;
1066 		fis->flags = ATA_H2D_FLAGS_CMD;
1067 		fis->command = ATA_C_FLUSH_CACHE;
1068 		fis->device = 0;
1069 		if (xa->timeout < 45000)
1070 			xa->timeout = 45000;
1071 		xa->datalen = 0;
1072 		xa->flags = ATA_F_READ;
1073 		xa->complete = ahci_ata_complete_disk_synchronize_cache;
1074 		break;
1075 	case TEST_UNIT_READY:
1076 	case START_STOP_UNIT:
1077 	case PREVENT_ALLOW:
1078 		/*
1079 		 * Just silently return success
1080 		 */
1081 		ccbh->status = CAM_REQ_CMP;
1082 		rdata_len = 0;
1083 		break;
1084 	case ATA_PASS_12:
1085 	case ATA_PASS_16:
1086 		/*
1087 		 * XXX implement pass-through
1088 		 */
1089 		ccbh->status = CAM_FUNC_NOTAVAIL;
1090 		break;
1091 	default:
1092 		switch(cdb->generic.opcode) {
1093 		case READ_6:
1094 			lba = scsi_3btoul(cdb->rw_6.addr) & 0x1FFFFF;
1095 			count = cdb->rw_6.length ? cdb->rw_6.length : 0x100;
1096 			xa->flags = ATA_F_READ;
1097 			break;
1098 		case READ_10:
1099 			lba = scsi_4btoul(cdb->rw_10.addr);
1100 			count = scsi_2btoul(cdb->rw_10.length);
1101 			xa->flags = ATA_F_READ;
1102 			break;
1103 		case READ_12:
1104 			lba = scsi_4btoul(cdb->rw_12.addr);
1105 			count = scsi_4btoul(cdb->rw_12.length);
1106 			xa->flags = ATA_F_READ;
1107 			break;
1108 		case READ_16:
1109 			lba = scsi_8btou64(cdb->rw_16.addr);
1110 			count = scsi_4btoul(cdb->rw_16.length);
1111 			xa->flags = ATA_F_READ;
1112 			break;
1113 		case WRITE_6:
1114 			lba = scsi_3btoul(cdb->rw_6.addr) & 0x1FFFFF;
1115 			count = cdb->rw_6.length ? cdb->rw_6.length : 0x100;
1116 			xa->flags = ATA_F_WRITE;
1117 			break;
1118 		case WRITE_10:
1119 			lba = scsi_4btoul(cdb->rw_10.addr);
1120 			count = scsi_2btoul(cdb->rw_10.length);
1121 			xa->flags = ATA_F_WRITE;
1122 			break;
1123 		case WRITE_12:
1124 			lba = scsi_4btoul(cdb->rw_12.addr);
1125 			count = scsi_4btoul(cdb->rw_12.length);
1126 			xa->flags = ATA_F_WRITE;
1127 			break;
1128 		case WRITE_16:
1129 			lba = scsi_8btou64(cdb->rw_16.addr);
1130 			count = scsi_4btoul(cdb->rw_16.length);
1131 			xa->flags = ATA_F_WRITE;
1132 			break;
1133 		default:
1134 			ccbh->status = CAM_REQ_INVALID;
1135 			break;
1136 		}
1137 		if (ccbh->status != CAM_REQ_INPROG)
1138 			break;
1139 
1140 		fis = xa->fis;
1141 		fis->flags = ATA_H2D_FLAGS_CMD;
1142 		fis->lba_low = (u_int8_t)lba;
1143 		fis->lba_mid = (u_int8_t)(lba >> 8);
1144 		fis->lba_high = (u_int8_t)(lba >> 16);
1145 		fis->device = ATA_H2D_DEVICE_LBA;
1146 
1147 		/*
1148 		 * NCQ only for direct-attached disks, do not currently
1149 		 * try to use NCQ with port multipliers.
1150 		 */
1151 		if (at->at_ncqdepth > 1 &&
1152 		    ap->ap_type == ATA_PORT_T_DISK &&
1153 		    (ap->ap_sc->sc_cap & AHCI_REG_CAP_SNCQ) &&
1154 		    (ccbh->flags & CAM_POLLED) == 0) {
1155 			/*
1156 			 * Use NCQ - always uses 48 bit addressing
1157 			 */
1158 			xa->flags |= ATA_F_NCQ;
1159 			fis->command = (xa->flags & ATA_F_WRITE) ?
1160 					ATA_C_WRITE_FPDMA : ATA_C_READ_FPDMA;
1161 			fis->lba_low_exp = (u_int8_t)(lba >> 24);
1162 			fis->lba_mid_exp = (u_int8_t)(lba >> 32);
1163 			fis->lba_high_exp = (u_int8_t)(lba >> 40);
1164 			fis->sector_count = xa->tag << 3;
1165 			fis->features = (u_int8_t)count;
1166 			fis->features_exp = (u_int8_t)(count >> 8);
1167 		} else if (count > 0x100 || lba > 0xFFFFFFFFU) {
1168 			/*
1169 			 * Use LBA48
1170 			 */
1171 			fis->command = (xa->flags & ATA_F_WRITE) ?
1172 					ATA_C_WRITEDMA_EXT : ATA_C_READDMA_EXT;
1173 			fis->lba_low_exp = (u_int8_t)(lba >> 24);
1174 			fis->lba_mid_exp = (u_int8_t)(lba >> 32);
1175 			fis->lba_high_exp = (u_int8_t)(lba >> 40);
1176 			fis->sector_count = (u_int8_t)count;
1177 			fis->sector_count_exp = (u_int8_t)(count >> 8);
1178 		} else {
1179 			/*
1180 			 * Use LBA
1181 			 *
1182 			 * NOTE: 256 sectors is supported, stored as 0.
1183 			 */
1184 			fis->command = (xa->flags & ATA_F_WRITE) ?
1185 					ATA_C_WRITEDMA : ATA_C_READDMA;
1186 			fis->device |= (u_int8_t)(lba >> 24) & 0x0F;
1187 			fis->sector_count = (u_int8_t)count;
1188 		}
1189 
1190 		xa->data = csio->data_ptr;
1191 		xa->datalen = csio->dxfer_len;
1192 		xa->complete = ahci_ata_complete_disk_rw;
1193 		xa->timeout = ccbh->timeout;	/* milliseconds */
1194 #if 0
1195 		if (xa->timeout > 10000)	/* XXX - debug */
1196 			xa->timeout = 10000;
1197 #endif
1198 		if (ccbh->flags & CAM_POLLED)
1199 			xa->flags |= ATA_F_POLL;
1200 		break;
1201 	}
1202 
1203 	/*
1204 	 * If the request is still in progress the xa and FIS have
1205 	 * been set up and must be dispatched.  Otherwise the request
1206 	 * is complete.
1207 	 */
1208 	if (ccbh->status == CAM_REQ_INPROG) {
1209 		KKASSERT(xa->complete != NULL);
1210 		xa->atascsi_private = ccb;
1211 		ccb->ccb_h.sim_priv.entries[0].ptr = ap;
1212 		ahci_os_lock_port(ap);
1213 		fis->flags |= at->at_target;
1214 		ahci_ata_cmd(xa);
1215 		ahci_os_unlock_port(ap);
1216 	} else {
1217 		ahci_ata_put_xfer(xa);
1218 		xpt_done(ccb);
1219 	}
1220 }
1221 
1222 /*
1223  * Convert the SCSI command in ccb to an ata_xfer command in xa
1224  * for ATA_PORT_T_ATAPI operations.  Set the completion function
1225  * to convert the response back, then dispatch to the OpenBSD AHCI
1226  * layer.
1227  */
1228 static
1229 void
1230 ahci_xpt_scsi_atapi_io(struct ahci_port *ap, struct ata_port *atx,
1231 			union ccb *ccb)
1232 {
1233 	struct ccb_hdr *ccbh;
1234 	struct ccb_scsiio *csio;
1235 	struct ata_xfer *xa;
1236 	struct ata_fis_h2d *fis;
1237 	scsi_cdb_t cdbs;
1238 	scsi_cdb_t cdbd;
1239 	int flags;
1240 	struct ata_port	*at;
1241 
1242 	ccbh = &ccb->csio.ccb_h;
1243 	csio = &ccb->csio;
1244 	at = atx ? atx : &ap->ap_ata[0];
1245 
1246 	switch (ccbh->flags & CAM_DIR_MASK) {
1247 	case CAM_DIR_IN:
1248 		flags = ATA_F_PACKET | ATA_F_READ;
1249 		break;
1250 	case CAM_DIR_OUT:
1251 		flags = ATA_F_PACKET | ATA_F_WRITE;
1252 		break;
1253 	case CAM_DIR_NONE:
1254 		flags = ATA_F_PACKET;
1255 		break;
1256 	default:
1257 		ccbh->status = CAM_REQ_INVALID;
1258 		xpt_done(ccb);
1259 		return;
1260 		/* NOT REACHED */
1261 	}
1262 
1263 	/*
1264 	 * Special handling to get the rfis back into host memory while
1265 	 * still allowing the Sili chip to run commands in parallel to
1266 	 * ATAPI devices behind a PM.
1267 	 */
1268 	flags |= ATA_F_AUTOSENSE;
1269 
1270 	/*
1271 	 * The command has to fit in the packet command buffer.
1272 	 */
1273 	if (csio->cdb_len < 6 || csio->cdb_len > 16) {
1274 		ccbh->status = CAM_CCB_LEN_ERR;
1275 		xpt_done(ccb);
1276 		return;
1277 	}
1278 
1279 	/*
1280 	 * Initialize the XA and FIS.
1281 	 *
1282 	 * XXX not passing NULL at for direct attach!
1283 	 */
1284 	xa = ahci_ata_get_xfer(ap, atx);
1285 	fis = xa->fis;
1286 
1287 	fis->flags = ATA_H2D_FLAGS_CMD | at->at_target;
1288 	fis->command = ATA_C_PACKET;
1289 	fis->device = 0;
1290 	fis->sector_count = xa->tag << 3;
1291 	fis->features = ATA_H2D_FEATURES_DMA |
1292 		    ((flags & ATA_F_WRITE) ?
1293 		    ATA_H2D_FEATURES_DIR_WRITE : ATA_H2D_FEATURES_DIR_READ);
1294 	fis->lba_mid = 0x00;
1295 	fis->lba_high = 0x20;
1296 
1297 	xa->flags = flags;
1298 	xa->data = csio->data_ptr;
1299 	xa->datalen = csio->dxfer_len;
1300 	xa->timeout = ccbh->timeout;	/* milliseconds */
1301 
1302 	if (ccbh->flags & CAM_POLLED)
1303 		xa->flags |= ATA_F_POLL;
1304 
1305 	/*
1306 	 * Copy the cdb to the packetcmd buffer in the FIS using a
1307 	 * convenient pointer in the xa.
1308 	 */
1309 	cdbs = (void *)((ccbh->flags & CAM_CDB_POINTER) ?
1310 			csio->cdb_io.cdb_ptr : csio->cdb_io.cdb_bytes);
1311 	bcopy(cdbs, xa->packetcmd, csio->cdb_len);
1312 
1313 #if 0
1314 	kprintf("opcode %d cdb_len %d dxfer_len %d\n",
1315 		cdbs->generic.opcode,
1316 		csio->cdb_len, csio->dxfer_len);
1317 #endif
1318 
1319 	/*
1320 	 * Some ATAPI commands do not actually follow the SCSI standard.
1321 	 */
1322 	cdbd = (void *)xa->packetcmd;
1323 
1324 	switch(cdbd->generic.opcode) {
1325 	case INQUIRY:
1326 		/*
1327 		 * Some ATAPI devices can't handle SI_EVPD being set
1328 		 * for a basic inquiry (page_code == 0).
1329 		 *
1330 		 * Some ATAPI devices can't handle long inquiry lengths,
1331 		 * don't ask me why.  Truncate the inquiry length.
1332 		 */
1333 		if ((cdbd->inquiry.byte2 & SI_EVPD) &&
1334 		    cdbd->inquiry.page_code == 0) {
1335 			cdbd->inquiry.byte2 &= ~SI_EVPD;
1336 		}
1337 		if (cdbd->inquiry.page_code == 0 &&
1338 		    cdbd->inquiry.length > SHORT_INQUIRY_LENGTH) {
1339 			cdbd->inquiry.length = SHORT_INQUIRY_LENGTH;
1340 		}
1341 		break;
1342 	case READ_6:
1343 	case WRITE_6:
1344 		/*
1345 		 * Convert *_6 to *_10 commands.  Most ATAPI devices
1346 		 * cannot handle the SCSI READ_6 and WRITE_6 commands.
1347 		 */
1348 		cdbd->rw_10.opcode |= 0x20;
1349 		cdbd->rw_10.byte2 = 0;
1350 		cdbd->rw_10.addr[0] = cdbs->rw_6.addr[0] & 0x1F;
1351 		cdbd->rw_10.addr[1] = cdbs->rw_6.addr[1];
1352 		cdbd->rw_10.addr[2] = cdbs->rw_6.addr[2];
1353 		cdbd->rw_10.addr[3] = 0;
1354 		cdbd->rw_10.reserved = 0;
1355 		cdbd->rw_10.length[0] = 0;
1356 		cdbd->rw_10.length[1] = cdbs->rw_6.length;
1357 		cdbd->rw_10.control = cdbs->rw_6.control;
1358 		break;
1359 	default:
1360 		break;
1361 	}
1362 
1363 	/*
1364 	 * And dispatch
1365 	 */
1366 	xa->complete = ahci_atapi_complete_cmd;
1367 	xa->atascsi_private = ccb;
1368 	ccb->ccb_h.sim_priv.entries[0].ptr = ap;
1369 	ahci_os_lock_port(ap);
1370 	ahci_ata_cmd(xa);
1371 	ahci_os_unlock_port(ap);
1372 }
1373 
1374 /*
1375  * Completion function for ATA_PORT_T_DISK cache synchronization.
1376  */
1377 static
1378 void
1379 ahci_ata_complete_disk_synchronize_cache(struct ata_xfer *xa)
1380 {
1381 	union ccb *ccb = xa->atascsi_private;
1382 	struct ccb_hdr *ccbh = &ccb->ccb_h;
1383 	struct ahci_port *ap = ccb->ccb_h.sim_priv.entries[0].ptr;
1384 
1385 	switch(xa->state) {
1386 	case ATA_S_COMPLETE:
1387 		ccbh->status = CAM_REQ_CMP;
1388 		ccb->csio.scsi_status = SCSI_STATUS_OK;
1389 		break;
1390 	case ATA_S_ERROR:
1391 		kprintf("%s: synchronize_cache: error\n",
1392 			ATANAME(ap, xa->at));
1393 		ccbh->status = CAM_SCSI_STATUS_ERROR | CAM_AUTOSNS_VALID;
1394 		ccb->csio.scsi_status = SCSI_STATUS_CHECK_COND;
1395 		ahci_ata_dummy_sense(&ccb->csio.sense_data);
1396 		break;
1397 	case ATA_S_TIMEOUT:
1398 		kprintf("%s: synchronize_cache: timeout\n",
1399 			ATANAME(ap, xa->at));
1400 		ccbh->status = CAM_CMD_TIMEOUT;
1401 		break;
1402 	default:
1403 		kprintf("%s: synchronize_cache: unknown state %d\n",
1404 			ATANAME(ap, xa->at), xa->state);
1405 		ccbh->status = CAM_REQ_CMP_ERR;
1406 		break;
1407 	}
1408 	ahci_ata_put_xfer(xa);
1409 	ahci_os_unlock_port(ap);
1410 	xpt_done(ccb);
1411 	ahci_os_lock_port(ap);
1412 }
1413 
1414 /*
1415  * Completion function for ATA_PORT_T_DISK I/O
1416  */
1417 static
1418 void
1419 ahci_ata_complete_disk_rw(struct ata_xfer *xa)
1420 {
1421 	union ccb *ccb = xa->atascsi_private;
1422 	struct ccb_hdr *ccbh = &ccb->ccb_h;
1423 	struct ahci_port *ap = ccb->ccb_h.sim_priv.entries[0].ptr;
1424 
1425 	switch(xa->state) {
1426 	case ATA_S_COMPLETE:
1427 		ccbh->status = CAM_REQ_CMP;
1428 		ccb->csio.scsi_status = SCSI_STATUS_OK;
1429 		break;
1430 	case ATA_S_ERROR:
1431 		kprintf("%s: disk_rw: error\n", ATANAME(ap, xa->at));
1432 		ccbh->status = CAM_SCSI_STATUS_ERROR | CAM_AUTOSNS_VALID;
1433 		ccb->csio.scsi_status = SCSI_STATUS_CHECK_COND;
1434 		ahci_ata_dummy_sense(&ccb->csio.sense_data);
1435 		break;
1436 	case ATA_S_TIMEOUT:
1437 		kprintf("%s: disk_rw: timeout\n", ATANAME(ap, xa->at));
1438 		ccbh->status = CAM_CMD_TIMEOUT;
1439 		ccb->csio.scsi_status = SCSI_STATUS_CHECK_COND;
1440 		ahci_ata_dummy_sense(&ccb->csio.sense_data);
1441 		break;
1442 	default:
1443 		kprintf("%s: disk_rw: unknown state %d\n",
1444 			ATANAME(ap, xa->at), xa->state);
1445 		ccbh->status = CAM_REQ_CMP_ERR;
1446 		break;
1447 	}
1448 	ccb->csio.resid = xa->resid;
1449 	ahci_ata_put_xfer(xa);
1450 	ahci_os_unlock_port(ap);
1451 	xpt_done(ccb);
1452 	ahci_os_lock_port(ap);
1453 }
1454 
1455 /*
1456  * Completion function for ATA_PORT_T_ATAPI I/O
1457  *
1458  * Sense data is returned in the rfis.
1459  */
1460 static
1461 void
1462 ahci_atapi_complete_cmd(struct ata_xfer *xa)
1463 {
1464 	union ccb *ccb = xa->atascsi_private;
1465 	struct ccb_hdr *ccbh = &ccb->ccb_h;
1466 	struct ahci_port *ap = ccb->ccb_h.sim_priv.entries[0].ptr;
1467 	scsi_cdb_t cdb;
1468 
1469 	cdb = (void *)((ccb->ccb_h.flags & CAM_CDB_POINTER) ?
1470 			ccb->csio.cdb_io.cdb_ptr : ccb->csio.cdb_io.cdb_bytes);
1471 
1472 	switch(xa->state) {
1473 	case ATA_S_COMPLETE:
1474 		ccbh->status = CAM_REQ_CMP;
1475 		ccb->csio.scsi_status = SCSI_STATUS_OK;
1476 		break;
1477 	case ATA_S_ERROR:
1478 		ccbh->status = CAM_SCSI_STATUS_ERROR;
1479 		ccb->csio.scsi_status = SCSI_STATUS_CHECK_COND;
1480 		ahci_ata_atapi_sense(&xa->rfis, &ccb->csio.sense_data);
1481 		break;
1482 	case ATA_S_TIMEOUT:
1483 		kprintf("%s: cmd %d: timeout\n",
1484 			PORTNAME(ap), cdb->generic.opcode);
1485 		ccbh->status = CAM_CMD_TIMEOUT;
1486 		ccb->csio.scsi_status = SCSI_STATUS_CHECK_COND;
1487 		ahci_ata_dummy_sense(&ccb->csio.sense_data);
1488 		break;
1489 	default:
1490 		kprintf("%s: cmd %d: unknown state %d\n",
1491 			PORTNAME(ap), cdb->generic.opcode, xa->state);
1492 		ccbh->status = CAM_REQ_CMP_ERR;
1493 		break;
1494 	}
1495 	ccb->csio.resid = xa->resid;
1496 	ahci_ata_put_xfer(xa);
1497 	ahci_os_unlock_port(ap);
1498 	xpt_done(ccb);
1499 	ahci_os_lock_port(ap);
1500 }
1501 
1502 /*
1503  * Construct dummy sense data for errors on DISKs
1504  */
1505 static
1506 void
1507 ahci_ata_dummy_sense(struct scsi_sense_data *sense_data)
1508 {
1509 	sense_data->error_code = SSD_ERRCODE_VALID | SSD_CURRENT_ERROR;
1510 	sense_data->segment = 0;
1511 	sense_data->flags = SSD_KEY_MEDIUM_ERROR;
1512 	sense_data->info[0] = 0;
1513 	sense_data->info[1] = 0;
1514 	sense_data->info[2] = 0;
1515 	sense_data->info[3] = 0;
1516 	sense_data->extra_len = 0;
1517 }
1518 
1519 /*
1520  * Construct atapi sense data for errors on ATAPI
1521  *
1522  * The ATAPI sense data is stored in the passed rfis and must be converted
1523  * to SCSI sense data.
1524  */
1525 static
1526 void
1527 ahci_ata_atapi_sense(struct ata_fis_d2h *rfis,
1528 		     struct scsi_sense_data *sense_data)
1529 {
1530 	sense_data->error_code = SSD_ERRCODE_VALID | SSD_CURRENT_ERROR;
1531 	sense_data->segment = 0;
1532 	sense_data->flags = (rfis->error & 0xF0) >> 4;
1533 	if (rfis->error & 0x04)
1534 		sense_data->flags |= SSD_KEY_ILLEGAL_REQUEST;
1535 	if (rfis->error & 0x02)
1536 		sense_data->flags |= SSD_EOM;
1537 	if (rfis->error & 0x01)
1538 		sense_data->flags |= SSD_ILI;
1539 	sense_data->info[0] = 0;
1540 	sense_data->info[1] = 0;
1541 	sense_data->info[2] = 0;
1542 	sense_data->info[3] = 0;
1543 	sense_data->extra_len = 0;
1544 }
1545