xref: /dragonfly/sys/dev/disk/ahci/ahci.c (revision 0de090e1)
1 /*
2  * (MPSAFE)
3  *
4  * Copyright (c) 2006 David Gwynne <dlg@openbsd.org>
5  *
6  * Permission to use, copy, modify, and distribute this software for any
7  * purpose with or without fee is hereby granted, provided that the above
8  * copyright notice and this permission notice appear in all copies.
9  *
10  * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
11  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
12  * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
13  * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
14  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
15  * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
16  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
17  *
18  *
19  * Copyright (c) 2009 The DragonFly Project.  All rights reserved.
20  *
21  * This code is derived from software contributed to The DragonFly Project
22  * by Matthew Dillon <dillon@backplane.com>
23  *
24  * Redistribution and use in source and binary forms, with or without
25  * modification, are permitted provided that the following conditions
26  * are met:
27  *
28  * 1. Redistributions of source code must retain the above copyright
29  *    notice, this list of conditions and the following disclaimer.
30  * 2. Redistributions in binary form must reproduce the above copyright
31  *    notice, this list of conditions and the following disclaimer in
32  *    the documentation and/or other materials provided with the
33  *    distribution.
34  * 3. Neither the name of The DragonFly Project nor the names of its
35  *    contributors may be used to endorse or promote products derived
36  *    from this software without specific, prior written permission.
37  *
38  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
39  * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
40  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
41  * FOR A PARTICULAR PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE
42  * COPYRIGHT HOLDERS OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
43  * INCIDENTAL, SPECIAL, EXEMPLARY OR CONSEQUENTIAL DAMAGES (INCLUDING,
44  * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
45  * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED
46  * AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
47  * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT
48  * OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
49  * SUCH DAMAGE.
50  *
51  * $OpenBSD: ahci.c,v 1.147 2009/02/16 21:19:07 miod Exp $
52  */
53 
54 #include "ahci.h"
55 
56 void	ahci_port_interrupt_enable(struct ahci_port *ap);
57 
58 int	ahci_load_prdt(struct ahci_ccb *);
59 void	ahci_unload_prdt(struct ahci_ccb *);
60 static void ahci_load_prdt_callback(void *info, bus_dma_segment_t *segs,
61 				    int nsegs, int error);
62 void	ahci_start(struct ahci_ccb *);
63 int	ahci_port_softreset(struct ahci_port *ap);
64 int	ahci_port_hardreset(struct ahci_port *ap, int hard);
65 void	ahci_port_hardstop(struct ahci_port *ap);
66 
67 static void ahci_ata_cmd_timeout_unserialized(void *);
68 void	ahci_check_active_timeouts(struct ahci_port *ap);
69 
70 void	ahci_beg_exclusive_access(struct ahci_port *ap, struct ata_port *at);
71 void	ahci_end_exclusive_access(struct ahci_port *ap, struct ata_port *at);
72 void	ahci_issue_pending_commands(struct ahci_port *ap, struct ahci_ccb *ccb);
73 void	ahci_issue_saved_commands(struct ahci_port *ap, u_int32_t mask);
74 
75 int	ahci_port_read_ncq_error(struct ahci_port *, int);
76 
77 struct ahci_dmamem *ahci_dmamem_alloc(struct ahci_softc *, bus_dma_tag_t tag);
78 void	ahci_dmamem_free(struct ahci_softc *, struct ahci_dmamem *);
79 static void ahci_dmamem_saveseg(void *info, bus_dma_segment_t *segs, int nsegs, int error);
80 
81 static void ahci_dummy_done(struct ata_xfer *xa);
82 static void ahci_empty_done(struct ahci_ccb *ccb);
83 static void ahci_ata_cmd_done(struct ahci_ccb *ccb);
84 static u_int32_t ahci_pactive(struct ahci_port *ap);
85 
86 /*
87  * Initialize the global AHCI hardware.  This code does not set up any of
88  * its ports.
89  */
90 int
91 ahci_init(struct ahci_softc *sc)
92 {
93 	u_int32_t	pi, pleft;
94 	u_int32_t	bios_cap, vers;
95 	int		i;
96 	struct ahci_port *ap;
97 
98 	DPRINTF(AHCI_D_VERBOSE, " GHC 0x%b",
99 		ahci_read(sc, AHCI_REG_GHC), AHCI_FMT_GHC);
100 
101 	/*
102 	 * AHCI version.
103 	 */
104 	vers = ahci_read(sc, AHCI_REG_VS);
105 
106 	/*
107 	 * save BIOS initialised parameters, enable staggered spin up
108 	 */
109 	bios_cap = ahci_read(sc, AHCI_REG_CAP);
110 	bios_cap &= AHCI_REG_CAP_SMPS | AHCI_REG_CAP_SSS;
111 
112 	pi = ahci_read(sc, AHCI_REG_PI);
113 
114 	/*
115 	 * Unconditionally reset the controller, do not conditionalize on
116 	 * trying to figure it if it was previously active or not.
117 	 *
118 	 * NOTE: On AE before HR.  The AHCI-1.1 spec has a note in section
119 	 *	 5.2.2.1 regarding this.  HR should be set to 1 only after
120 	 *	 AE is set to 1.  The reset sequence will clear HR when
121 	 *	 it completes, and will also clear AE if SAM is 0.  AE must
122 	 *	 then be set again.  When SAM is 1 the AE bit typically reads
123 	 *	 as 1 (and is read-only).
124 	 *
125 	 * NOTE: Avoid PCI[e] transaction burst by issuing dummy reads,
126 	 *	 otherwise the writes will only be separated by a few
127 	 *	 nanoseconds.
128 	 *
129 	 * NOTE BRICKS (1)
130 	 *
131 	 *	If you have a port multiplier and it does not have a device
132 	 *	in target 0, and it probes normally, but a later operation
133 	 *	mis-probes a target behind that PM, it is possible for the
134 	 *	port to brick such that only (a) a power cycle of the host
135 	 *	or (b) placing a device in target 0 will fix the problem.
136 	 *	Power cycling the PM has no effect (it works fine on another
137 	 *	host port).  This issue is unrelated to CLO.
138 	 */
139 	/*
140 	 * Wait for any prior reset sequence to complete
141 	 */
142 	if (ahci_wait_ne(sc, AHCI_REG_GHC,
143 			 AHCI_REG_GHC_HR, AHCI_REG_GHC_HR) != 0) {
144 		device_printf(sc->sc_dev, "Controller is stuck in reset\n");
145 		return (1);
146 	}
147 	ahci_write(sc, AHCI_REG_GHC, AHCI_REG_GHC_AE);
148 	ahci_os_sleep(500);
149 	ahci_read(sc, AHCI_REG_GHC);		/* flush */
150 	ahci_write(sc, AHCI_REG_GHC, AHCI_REG_GHC_AE | AHCI_REG_GHC_HR);
151 	ahci_os_sleep(500);
152 	ahci_read(sc, AHCI_REG_GHC);		/* flush */
153 	if (ahci_wait_ne(sc, AHCI_REG_GHC,
154 			 AHCI_REG_GHC_HR, AHCI_REG_GHC_HR) != 0) {
155 		device_printf(sc->sc_dev, "unable to reset controller\n");
156 		return (1);
157 	}
158 	if (ahci_read(sc, AHCI_REG_GHC) & AHCI_REG_GHC_AE) {
159 		device_printf(sc->sc_dev, "AE did not auto-clear!\n");
160 		ahci_write(sc, AHCI_REG_GHC, 0);
161 		ahci_os_sleep(500);
162 	}
163 
164 	/*
165 	 * Enable ahci (global interrupts disabled)
166 	 *
167 	 * Restore saved parameters.  Avoid pci transaction burst write
168 	 * by issuing dummy reads.
169 	 */
170 	ahci_os_sleep(500);
171 	ahci_write(sc, AHCI_REG_GHC, AHCI_REG_GHC_AE);
172 	ahci_os_sleep(500);
173 
174 	ahci_read(sc, AHCI_REG_GHC);		/* flush */
175 
176 	bios_cap |= AHCI_REG_CAP_SSS;
177 	ahci_write(sc, AHCI_REG_CAP, ahci_read(sc, AHCI_REG_CAP) | bios_cap);
178 	ahci_write(sc, AHCI_REG_PI, pi);
179 	ahci_read(sc, AHCI_REG_GHC);		/* flush */
180 
181 	/*
182 	 * Intel hocus pocus in case the BIOS has not set the chip up
183 	 * properly for AHCI operation.
184 	 */
185 	if (pci_get_vendor(sc->sc_dev) == PCI_VENDOR_INTEL) {
186 	        if ((pci_read_config(sc->sc_dev, 0x92, 2) & 0x0F) != 0x0F)
187 			device_printf(sc->sc_dev, "Intel hocus pocus\n");
188 		pci_write_config(sc->sc_dev, 0x92,
189 			     pci_read_config(sc->sc_dev, 0x92, 2) | 0x0F, 2);
190 	}
191 
192 	/*
193 	 * This is a hack that currently does not appear to have
194 	 * a significant effect, but I noticed the port registers
195 	 * do not appear to be completely cleared after the host
196 	 * controller is reset.
197 	 *
198 	 * Use a temporary ap structure so we can call ahci_pwrite().
199 	 *
200 	 * We must be sure to stop the port
201 	 */
202 	ap = kmalloc(sizeof(*ap), M_DEVBUF, M_WAITOK | M_ZERO);
203 	ap->ap_sc = sc;
204 	pleft = pi;
205 	for (i = 0; i < AHCI_MAX_PORTS; ++i) {
206 		if (pleft == 0)
207 			break;
208 		if ((pi & (1 << i)) == 0)
209 			continue;
210 		if (bus_space_subregion(sc->sc_iot, sc->sc_ioh,
211 		    AHCI_PORT_REGION(i), AHCI_PORT_SIZE, &ap->ap_ioh) != 0) {
212 			device_printf(sc->sc_dev, "can't map port\n");
213 			return (1);
214 		}
215 		/*
216 		 * NOTE!  Setting AHCI_PREG_SCTL_DET_DISABLE on AHCI1.0 or
217 		 *	  AHCI1.1 can brick the chipset.  Not only brick it,
218 		 *	  but also crash the PC.  The bit seems unreliable
219 		 *	  on AHCI1.2 as well.
220 		 */
221 		ahci_port_stop(ap, 1);
222 		ahci_pwrite(ap, AHCI_PREG_SCTL, ap->ap_sc->sc_ipm_disable);
223 		ahci_pwrite(ap, AHCI_PREG_SERR, -1);
224 		ahci_pwrite(ap, AHCI_PREG_IE, 0);
225 		ahci_write(ap->ap_sc, AHCI_REG_IS, 1 << i);
226 		ahci_pwrite(ap, AHCI_PREG_CMD, 0);
227 		ahci_pwrite(ap, AHCI_PREG_IS, -1);
228 		sc->sc_portmask |= (1 << i);
229 		pleft &= ~(1 << i);
230 	}
231 	sc->sc_numports = i;
232 	kfree(ap, M_DEVBUF);
233 
234 	return (0);
235 }
236 
237 /*
238  * Allocate and initialize an AHCI port.
239  */
240 int
241 ahci_port_alloc(struct ahci_softc *sc, u_int port)
242 {
243 	struct ahci_port	*ap;
244 	struct ata_port		*at;
245 	struct ahci_ccb		*ccb;
246 	u_int64_t		dva;
247 	u_int32_t		cmd;
248 	u_int32_t		data;
249 	struct ahci_cmd_hdr	*hdr;
250 	struct ahci_cmd_table	*table;
251 	int	rc = ENOMEM;
252 	int	error;
253 	int	i;
254 
255 	ap = kmalloc(sizeof(*ap), M_DEVBUF, M_WAITOK | M_ZERO);
256 	ap->ap_err_scratch = kmalloc(512, M_DEVBUF, M_WAITOK | M_ZERO);
257 
258 	ksnprintf(ap->ap_name, sizeof(ap->ap_name), "%s%d.%d",
259 		  device_get_name(sc->sc_dev),
260 		  device_get_unit(sc->sc_dev),
261 		  port);
262 	sc->sc_ports[port] = ap;
263 
264 	/*
265 	 * Allocate enough so we never have to reallocate, it makes
266 	 * it easier.
267 	 *
268 	 * ap_pmcount will be reduced by the scan if we encounter the
269 	 * port multiplier port prior to target 15.
270 	 *
271 	 * kmalloc power-of-2 allocations are guaranteed not to cross
272 	 * a page boundary.  Make sure the identify sub-structure in the
273 	 * at structure does not cross a page boundary, just in case the
274 	 * part is AHCI-1.1 and can't handle multiple DRQ blocks.
275 	 */
276 	if (ap->ap_ata[0] == NULL) {
277 		int pw2;
278 
279 		for (pw2 = 1; pw2 < sizeof(*at); pw2 <<= 1)
280 			;
281 		for (i = 0; i < AHCI_MAX_PMPORTS; ++i) {
282 			at = kmalloc(pw2, M_DEVBUF, M_INTWAIT | M_ZERO);
283 			ap->ap_ata[i] = at;
284 			at->at_ahci_port = ap;
285 			at->at_target = i;
286 			at->at_probe = ATA_PROBE_NEED_INIT;
287 			at->at_features |= ATA_PORT_F_RESCAN;
288 			ksnprintf(at->at_name, sizeof(at->at_name),
289 				  "%s.%d", ap->ap_name, i);
290 		}
291 	}
292 	if (bus_space_subregion(sc->sc_iot, sc->sc_ioh,
293 	    AHCI_PORT_REGION(port), AHCI_PORT_SIZE, &ap->ap_ioh) != 0) {
294 		device_printf(sc->sc_dev,
295 			      "unable to create register window for port %d\n",
296 			      port);
297 		goto freeport;
298 	}
299 
300 	ap->ap_sc = sc;
301 	ap->ap_num = port;
302 	ap->ap_probe = ATA_PROBE_NEED_INIT;
303 	ap->link_pwr_mgmt = AHCI_LINK_PWR_MGMT_NONE;
304 	ap->sysctl_tree = NULL;
305 	TAILQ_INIT(&ap->ap_ccb_free);
306 	TAILQ_INIT(&ap->ap_ccb_pending);
307 	lockinit(&ap->ap_ccb_lock, "ahcipo", 0, 0);
308 
309 	/* Disable port interrupts */
310 	ahci_pwrite(ap, AHCI_PREG_IE, 0);
311 	ahci_pwrite(ap, AHCI_PREG_SERR, -1);
312 
313 	/*
314 	 * Sec 10.1.2 - deinitialise port if it is already running
315 	 */
316 	cmd = ahci_pread(ap, AHCI_PREG_CMD);
317 	kprintf("%s: Caps %b\n", PORTNAME(ap), cmd, AHCI_PFMT_CMD);
318 
319 	if ((cmd & (AHCI_PREG_CMD_ST | AHCI_PREG_CMD_CR |
320 		    AHCI_PREG_CMD_FRE | AHCI_PREG_CMD_FR)) ||
321 	    (ahci_pread(ap, AHCI_PREG_SCTL) & AHCI_PREG_SCTL_DET)) {
322 		int r;
323 
324 		r = ahci_port_stop(ap, 1);
325 		if (r) {
326 			device_printf(sc->sc_dev,
327 				  "unable to disable %s, ignoring port %d\n",
328 				  ((r == 2) ? "CR" : "FR"), port);
329 			rc = ENXIO;
330 			goto freeport;
331 		}
332 
333 		/* Write DET to zero */
334 		ahci_pwrite(ap, AHCI_PREG_SCTL, ap->ap_sc->sc_ipm_disable);
335 	}
336 
337 	/* Allocate RFIS */
338 	ap->ap_dmamem_rfis = ahci_dmamem_alloc(sc, sc->sc_tag_rfis);
339 	if (ap->ap_dmamem_rfis == NULL) {
340 		kprintf("%s: NORFIS\n", PORTNAME(ap));
341 		goto nomem;
342 	}
343 
344 	/* Setup RFIS base address */
345 	ap->ap_rfis = (struct ahci_rfis *) AHCI_DMA_KVA(ap->ap_dmamem_rfis);
346 	dva = AHCI_DMA_DVA(ap->ap_dmamem_rfis);
347 	ahci_pwrite(ap, AHCI_PREG_FBU, (u_int32_t)(dva >> 32));
348 	ahci_pwrite(ap, AHCI_PREG_FB, (u_int32_t)dva);
349 
350 	/* Clear SERR before starting FIS reception or ST or anything */
351 	ahci_flush_tfd(ap);
352 	ahci_pwrite(ap, AHCI_PREG_SERR, -1);
353 
354 	/* Enable FIS reception and activate port. */
355 	cmd = ahci_pread(ap, AHCI_PREG_CMD) & ~AHCI_PREG_CMD_ICC;
356 	cmd &= ~(AHCI_PREG_CMD_CLO | AHCI_PREG_CMD_PMA);
357 	cmd |= AHCI_PREG_CMD_FRE | AHCI_PREG_CMD_POD | AHCI_PREG_CMD_SUD;
358 	ahci_pwrite(ap, AHCI_PREG_CMD, cmd | AHCI_PREG_CMD_ICC_ACTIVE);
359 
360 	/* Check whether port activated.  Skip it if not. */
361 	cmd = ahci_pread(ap, AHCI_PREG_CMD) & ~AHCI_PREG_CMD_ICC;
362 	if ((cmd & AHCI_PREG_CMD_FRE) == 0) {
363 		kprintf("%s: NOT-ACTIVATED\n", PORTNAME(ap));
364 		rc = ENXIO;
365 		goto freeport;
366 	}
367 
368 	/* Allocate a CCB for each command slot */
369 	ap->ap_ccbs = kmalloc(sizeof(struct ahci_ccb) * sc->sc_ncmds, M_DEVBUF,
370 			      M_WAITOK | M_ZERO);
371 	if (ap->ap_ccbs == NULL) {
372 		device_printf(sc->sc_dev,
373 			      "unable to allocate command list for port %d\n",
374 			      port);
375 		goto freeport;
376 	}
377 
378 	/* Command List Structures and Command Tables */
379 	ap->ap_dmamem_cmd_list = ahci_dmamem_alloc(sc, sc->sc_tag_cmdh);
380 	ap->ap_dmamem_cmd_table = ahci_dmamem_alloc(sc, sc->sc_tag_cmdt);
381 	if (ap->ap_dmamem_cmd_table == NULL ||
382 	    ap->ap_dmamem_cmd_list == NULL) {
383 nomem:
384 		device_printf(sc->sc_dev,
385 			      "unable to allocate DMA memory for port %d\n",
386 			      port);
387 		goto freeport;
388 	}
389 
390 	/* Setup command list base address */
391 	dva = AHCI_DMA_DVA(ap->ap_dmamem_cmd_list);
392 	ahci_pwrite(ap, AHCI_PREG_CLBU, (u_int32_t)(dva >> 32));
393 	ahci_pwrite(ap, AHCI_PREG_CLB, (u_int32_t)dva);
394 
395 	/* Split CCB allocation into CCBs and assign to command header/table */
396 	hdr = AHCI_DMA_KVA(ap->ap_dmamem_cmd_list);
397 	table = AHCI_DMA_KVA(ap->ap_dmamem_cmd_table);
398 	for (i = 0; i < sc->sc_ncmds; i++) {
399 		ccb = &ap->ap_ccbs[i];
400 
401 		error = bus_dmamap_create(sc->sc_tag_data, BUS_DMA_ALLOCNOW,
402 					  &ccb->ccb_dmamap);
403 		if (error) {
404 			device_printf(sc->sc_dev,
405 				      "unable to create dmamap for port %d "
406 				      "ccb %d\n", port, i);
407 			goto freeport;
408 		}
409 
410 		callout_init_mp(&ccb->ccb_timeout);
411 		ccb->ccb_slot = i;
412 		ccb->ccb_port = ap;
413 		ccb->ccb_cmd_hdr = &hdr[i];
414 		ccb->ccb_cmd_table = &table[i];
415 		dva = AHCI_DMA_DVA(ap->ap_dmamem_cmd_table) +
416 		    ccb->ccb_slot * sizeof(struct ahci_cmd_table);
417 		ccb->ccb_cmd_hdr->ctba_hi = htole32((u_int32_t)(dva >> 32));
418 		ccb->ccb_cmd_hdr->ctba_lo = htole32((u_int32_t)dva);
419 
420 		ccb->ccb_xa.fis =
421 		    (struct ata_fis_h2d *)ccb->ccb_cmd_table->cfis;
422 		ccb->ccb_xa.packetcmd = ccb->ccb_cmd_table->acmd;
423 		ccb->ccb_xa.tag = i;
424 
425 		ccb->ccb_xa.state = ATA_S_COMPLETE;
426 
427 		/*
428 		 * CCB[1] is the error CCB and is not get or put.  It is
429 		 * also used for probing.  Numerous HBAs only load the
430 		 * signature from CCB[1] so it MUST be used for the second
431 		 * FIS.
432 		 */
433 		if (i == 1)
434 			ap->ap_err_ccb = ccb;
435 		else
436 			ahci_put_ccb(ccb);
437 	}
438 
439 	/*
440 	 * Wait for ICC change to complete
441 	 */
442 	ahci_pwait_clr(ap, AHCI_PREG_CMD, AHCI_PREG_CMD_ICC);
443 
444 	/*
445 	 * Calculate the interrupt mask
446 	 */
447 	data = AHCI_PREG_IE_TFEE | AHCI_PREG_IE_HBFE |
448 	       AHCI_PREG_IE_IFE | AHCI_PREG_IE_OFE |
449 	       AHCI_PREG_IE_DPE | AHCI_PREG_IE_UFE |
450 	       AHCI_PREG_IE_PCE | AHCI_PREG_IE_PRCE |
451 	       AHCI_PREG_IE_DHRE | AHCI_PREG_IE_SDBE;
452 	if (ap->ap_sc->sc_cap & AHCI_REG_CAP_SSNTF)
453 		data |= AHCI_PREG_IE_IPME;
454 #ifdef AHCI_COALESCE
455 	if (sc->sc_ccc_ports & (1 << port)
456 		data &= ~(AHCI_PREG_IE_SDBE | AHCI_PREG_IE_DHRE);
457 #endif
458 	ap->ap_intmask = data;
459 
460 	/*
461 	 * Start the port helper thread.  The helper thread will call
462 	 * ahci_port_init() so the ports can all be started in parallel.
463 	 * A failure by ahci_port_init() does not deallocate the port
464 	 * since we still want hot-plug events.
465 	 */
466 	ahci_os_start_port(ap);
467 	return(0);
468 freeport:
469 	ahci_port_free(sc, port);
470 	return (rc);
471 }
472 
473 /*
474  * [re]initialize an idle port.  No CCBs should be active.  (from port thread)
475  *
476  * This function is called during the initial port allocation sequence
477  * and is also called on hot-plug insertion.  We take no chances and
478  * use a portreset instead of a softreset.
479  *
480  * This function is the only way to move a failed port back to active
481  * status.
482  *
483  * Returns 0 if a device is successfully detected.
484  */
485 int
486 ahci_port_init(struct ahci_port *ap)
487 {
488 	u_int32_t cmd;
489 
490 	/*
491 	 * Register [re]initialization
492 	 *
493 	 * Flush the TFD and SERR and make sure the port is stopped before
494 	 * enabling its interrupt.  We no longer cycle the port start as
495 	 * the port should not be started unless a device is present.
496 	 *
497 	 * XXX should we enable FIS reception? (FRE)?
498 	 */
499 	ahci_pwrite(ap, AHCI_PREG_IE, 0);
500 	ahci_port_stop(ap, 0);
501 	if (ap->ap_sc->sc_cap & AHCI_REG_CAP_SSNTF)
502 		ahci_pwrite(ap, AHCI_PREG_SNTF, -1);
503 	ahci_flush_tfd(ap);
504 	ahci_pwrite(ap, AHCI_PREG_SERR, -1);
505 
506 	/*
507 	 * If we are being harsh try to kill the port completely.  Normally
508 	 * we would want to hold on to some of the state the BIOS may have
509 	 * set, such as SUD (spin up device).
510 	 *
511 	 * AP_F_HARSH_REINIT is cleared in the hard reset state
512 	 */
513 	if (ap->ap_flags & AP_F_HARSH_REINIT) {
514 		ahci_pwrite(ap, AHCI_PREG_SCTL, ap->ap_sc->sc_ipm_disable);
515 		ahci_pwrite(ap, AHCI_PREG_CMD, 0);
516 
517 		ahci_os_sleep(1000);
518 
519 		cmd = ahci_pread(ap, AHCI_PREG_CMD) & ~AHCI_PREG_CMD_ICC;
520 		cmd &= ~(AHCI_PREG_CMD_CLO | AHCI_PREG_CMD_PMA);
521 		cmd |= AHCI_PREG_CMD_FRE | AHCI_PREG_CMD_POD |
522 		       AHCI_PREG_CMD_SUD;
523 		ahci_pwrite(ap, AHCI_PREG_CMD, cmd | AHCI_PREG_CMD_ICC_ACTIVE);
524 		cmd = ahci_pread(ap, AHCI_PREG_CMD) & ~AHCI_PREG_CMD_ICC;
525 		if ((cmd & AHCI_PREG_CMD_FRE) == 0) {
526 			kprintf("%s: Warning: FRE did not come up during "
527 				"harsh reinitialization\n",
528 				PORTNAME(ap));
529 		}
530 		ahci_os_sleep(1000);
531 	}
532 
533 	/*
534 	 * Clear any pending garbage and re-enable the interrupt before
535 	 * going to the next stage.
536 	 */
537 	ap->ap_probe = ATA_PROBE_NEED_HARD_RESET;
538 	ap->ap_pmcount = 0;
539 
540 	if (ap->ap_sc->sc_cap & AHCI_REG_CAP_SSNTF)
541 		ahci_pwrite(ap, AHCI_PREG_SNTF, -1);
542 	ahci_flush_tfd(ap);
543 	ahci_pwrite(ap, AHCI_PREG_SERR, -1);
544 	ahci_pwrite(ap, AHCI_PREG_IS, -1);
545 
546 	ahci_port_interrupt_enable(ap);
547 
548 	return (0);
549 }
550 
551 /*
552  * Enable or re-enable interrupts on a port.
553  *
554  * This routine is called from the port initialization code or from the
555  * helper thread as the real interrupt may be forced to turn off certain
556  * interrupt sources.
557  */
558 void
559 ahci_port_interrupt_enable(struct ahci_port *ap)
560 {
561 	ahci_pwrite(ap, AHCI_PREG_IE, ap->ap_intmask);
562 }
563 
564 /*
565  * Manage the agressive link power management capability.
566  */
567 void
568 ahci_port_link_pwr_mgmt(struct ahci_port *ap, int link_pwr_mgmt)
569 {
570 	u_int32_t cmd, sctl;
571 
572 	if (link_pwr_mgmt == ap->link_pwr_mgmt)
573 		return;
574 
575 	if ((ap->ap_sc->sc_cap & AHCI_REG_CAP_SALP) == 0) {
576 		kprintf("%s: link power management not supported.\n",
577 			PORTNAME(ap));
578 		return;
579 	}
580 
581 	ahci_os_lock_port(ap);
582 
583 	if (link_pwr_mgmt == AHCI_LINK_PWR_MGMT_AGGR &&
584 	    (ap->ap_sc->sc_cap & AHCI_REG_CAP_SSC)) {
585 		kprintf("%s: enabling aggressive link power management.\n",
586 			PORTNAME(ap));
587 
588 		ap->link_pwr_mgmt = link_pwr_mgmt;
589 
590 		ap->ap_intmask &= ~AHCI_PREG_IE_PRCE;
591 		ahci_port_interrupt_enable(ap);
592 
593 		sctl = ahci_pread(ap, AHCI_PREG_SCTL);
594 		sctl &= ~(AHCI_PREG_SCTL_IPM);
595 		if (ap->ap_sc->sc_cap2 & AHCI_REG_CAP2_SDS)
596 			sctl |= AHCI_PREG_SCTL_IPM_NODEVSLP;
597 		ahci_pwrite(ap, AHCI_PREG_SCTL, sctl);
598 
599 		/*
600 		 * Enable device initiated link power management for
601 		 * directly attached devices that support it.
602 		 */
603 		if (ap->ap_type != ATA_PORT_T_PM &&
604 		    (ap->ap_ata[0]->at_identify.satafsup &
605 		    SATA_FEATURE_SUP_DEVIPS)) {
606 			if (ahci_set_feature(ap, NULL, ATA_SATAFT_DEVIPS, 1))
607 				kprintf("%s: Could not enable device initiated "
608 				    "link power management.\n",
609 				    PORTNAME(ap));
610 		}
611 
612 		cmd = ahci_pread(ap, AHCI_PREG_CMD);
613 		cmd |= AHCI_PREG_CMD_ASP;
614 		cmd |= AHCI_PREG_CMD_ALPE;
615 		ahci_pwrite(ap, AHCI_PREG_CMD, cmd);
616 
617 	} else if (link_pwr_mgmt == AHCI_LINK_PWR_MGMT_MEDIUM &&
618 	           (ap->ap_sc->sc_cap & AHCI_REG_CAP_PSC)) {
619 		kprintf("%s: enabling medium link power management.\n",
620 			PORTNAME(ap));
621 
622 		ap->link_pwr_mgmt = link_pwr_mgmt;
623 
624 		ap->ap_intmask &= ~AHCI_PREG_IE_PRCE;
625 		ahci_port_interrupt_enable(ap);
626 
627 		sctl = ahci_pread(ap, AHCI_PREG_SCTL);
628 		sctl &= ~(AHCI_PREG_SCTL_IPM);
629 		sctl |= AHCI_PREG_SCTL_IPM_NOSLUMBER;
630 		if (ap->ap_sc->sc_cap2 & AHCI_REG_CAP2_SDS)
631 			sctl |= AHCI_PREG_SCTL_IPM_NODEVSLP;
632 		ahci_pwrite(ap, AHCI_PREG_SCTL, sctl);
633 
634 		cmd = ahci_pread(ap, AHCI_PREG_CMD);
635 		cmd &= ~AHCI_PREG_CMD_ASP;
636 		cmd |= AHCI_PREG_CMD_ALPE;
637 		ahci_pwrite(ap, AHCI_PREG_CMD, cmd);
638 
639 	} else if (link_pwr_mgmt == AHCI_LINK_PWR_MGMT_NONE) {
640 		kprintf("%s: disabling link power management.\n",
641 			PORTNAME(ap));
642 
643 		/* Disable device initiated link power management */
644 		if (ap->ap_type != ATA_PORT_T_PM &&
645 		    (ap->ap_ata[0]->at_identify.satafsup &
646 		    SATA_FEATURE_SUP_DEVIPS)) {
647 			ahci_set_feature(ap, NULL, ATA_SATAFT_DEVIPS, 0);
648 		}
649 
650 		cmd = ahci_pread(ap, AHCI_PREG_CMD);
651 		cmd &= ~(AHCI_PREG_CMD_ALPE | AHCI_PREG_CMD_ASP);
652 		ahci_pwrite(ap, AHCI_PREG_CMD, cmd);
653 
654 		sctl = ahci_pread(ap, AHCI_PREG_SCTL);
655 		sctl &= ~(AHCI_PREG_SCTL_IPM);
656 		sctl |= ap->ap_sc->sc_ipm_disable;
657 		ahci_pwrite(ap, AHCI_PREG_SCTL, sctl);
658 
659 		/* let the drive come back to avoid PRCS interrupts later */
660 		ahci_os_unlock_port(ap);
661 		ahci_os_sleep(1000);
662 		ahci_os_lock_port(ap);
663 
664 		ahci_pwrite(ap, AHCI_PREG_SERR,
665 			    AHCI_PREG_SERR_DIAG_N | AHCI_PREG_SERR_DIAG_W);
666 		ahci_pwrite(ap, AHCI_PREG_IS, AHCI_PREG_IS_PRCS);
667 
668 		ap->ap_intmask |= AHCI_PREG_IE_PRCE;
669 		ahci_port_interrupt_enable(ap);
670 
671 		ap->link_pwr_mgmt = link_pwr_mgmt;
672 	} else {
673 		kprintf("%s: unsupported link power management state %d.\n",
674 			PORTNAME(ap), link_pwr_mgmt);
675 	}
676 
677 	ahci_os_unlock_port(ap);
678 }
679 
680 /*
681  * Return current link power state.
682  */
683 int
684 ahci_port_link_pwr_state(struct ahci_port *ap)
685 {
686 	uint32_t r;
687 
688 	r = ahci_pread(ap, AHCI_PREG_SSTS);
689 	switch (r & AHCI_PREG_SSTS_IPM) {
690 	case AHCI_PREG_SSTS_IPM_ACTIVE:
691 		return 1;
692 	case AHCI_PREG_SSTS_IPM_PARTIAL:
693 		return 2;
694 	case AHCI_PREG_SSTS_IPM_SLUMBER:
695 		return 3;
696 	case AHCI_PREG_SSTS_IPM_DEVSLEEP:
697 		return 4;
698 	default:
699 		return 0;
700 	}
701 }
702 
703 /*
704  * Run the port / target state machine from a main context.
705  *
706  * The state machine for the port is always run.
707  *
708  * If atx is non-NULL run the state machine for a particular target.
709  * If atx is NULL run the state machine for all targets.
710  */
711 void
712 ahci_port_state_machine(struct ahci_port *ap, int initial)
713 {
714 	struct ata_port *at;
715 	u_int32_t data;
716 	int target;
717 	int didsleep;
718 	int loop;
719 
720 	/*
721 	 * State machine for port.  Note that CAM is not yet associated
722 	 * during the initial parallel probe and the port's probe state
723 	 * will not get past ATA_PROBE_NEED_IDENT.
724 	 */
725 	{
726 		if (initial == 0 && ap->ap_probe <= ATA_PROBE_NEED_HARD_RESET) {
727 			kprintf("%s: Waiting 10 seconds on insertion\n",
728 				PORTNAME(ap));
729 			ahci_os_sleep(10000);
730 			initial = 1;
731 		}
732 		if (ap->ap_probe == ATA_PROBE_NEED_INIT)
733 			ahci_port_init(ap);
734 		if (ap->ap_probe == ATA_PROBE_NEED_HARD_RESET)
735 			ahci_port_reset(ap, NULL, 1);
736 		if (ap->ap_probe == ATA_PROBE_NEED_SOFT_RESET)
737 			ahci_port_reset(ap, NULL, 0);
738 		if (ap->ap_probe == ATA_PROBE_NEED_IDENT)
739 			ahci_cam_probe(ap, NULL);
740 	}
741 	if (ap->ap_type != ATA_PORT_T_PM) {
742 		if (ap->ap_probe == ATA_PROBE_FAILED) {
743 			ahci_cam_changed(ap, NULL, 0);
744 		} else if (ap->ap_probe >= ATA_PROBE_NEED_IDENT) {
745 			ahci_cam_changed(ap, NULL, 1);
746 		}
747 		return;
748 	}
749 
750 	/*
751 	 * Port Multiplier state machine.
752 	 *
753 	 * Get a mask of changed targets and combine with any runnable
754 	 * states already present.
755 	 */
756 	for (loop = 0; ;++loop) {
757 		if (ahci_pm_read(ap, 15, SATA_PMREG_EINFO, &data)) {
758 			kprintf("%s: PM unable to read hot-plug bitmap\n",
759 				PORTNAME(ap));
760 			break;
761 		}
762 
763 		/*
764 		 * Do at least one loop, then stop if no more state changes
765 		 * have occured.  The PM might not generate a new
766 		 * notification until we clear the entire bitmap.
767 		 */
768 		if (loop && data == 0)
769 			break;
770 
771 		/*
772 		 * New devices showing up in the bitmap require some spin-up
773 		 * time before we start probing them.  Reset didsleep.  The
774 		 * first new device we detect will sleep before probing.
775 		 *
776 		 * This only applies to devices whos change bit is set in
777 		 * the data, and does not apply to the initial boot-time
778 		 * probe.
779 		 */
780 		didsleep = 0;
781 
782 		for (target = 0; target < ap->ap_pmcount; ++target) {
783 			at = ap->ap_ata[target];
784 
785 			/*
786 			 * Check the target state for targets behind the PM
787 			 * which have changed state.  This will adjust
788 			 * at_probe and set ATA_PORT_F_RESCAN
789 			 *
790 			 * We want to wait at least 10 seconds before probing
791 			 * a newly inserted device.  If the check status
792 			 * indicates a device is present and in need of a
793 			 * hard reset, we make sure we have slept before
794 			 * continuing.
795 			 *
796 			 * We also need to wait at least 1 second for the
797 			 * PHY state to change after insertion, if we
798 			 * haven't already waited the 10 seconds.
799 			 *
800 			 * NOTE: When pm_check_good finds a good port it
801 			 *	 typically starts us in probe state
802 			 *	 NEED_HARD_RESET rather than INIT.
803 			 */
804 			if (data & (1 << target)) {
805 				if (initial == 0 && didsleep == 0)
806 					ahci_os_sleep(1000);
807 				ahci_pm_check_good(ap, target);
808 				if (initial == 0 && didsleep == 0 &&
809 				    at->at_probe <= ATA_PROBE_NEED_HARD_RESET
810 				) {
811 					didsleep = 1;
812 					kprintf("%s: Waiting 10 seconds on insertion\n", PORTNAME(ap));
813 					ahci_os_sleep(10000);
814 				}
815 			}
816 
817 			/*
818 			 * Report hot-plug events before the probe state
819 			 * really gets hot.  Only actual events are reported
820 			 * here to reduce spew.
821 			 */
822 			if (data & (1 << target)) {
823 				kprintf("%s: HOTPLUG (PM) - ", ATANAME(ap, at));
824 				switch(at->at_probe) {
825 				case ATA_PROBE_NEED_INIT:
826 				case ATA_PROBE_NEED_HARD_RESET:
827 					kprintf("Device inserted\n");
828 					break;
829 				case ATA_PROBE_FAILED:
830 					kprintf("Device removed\n");
831 					break;
832 				default:
833 					kprintf("Device probe in progress\n");
834 					break;
835 				}
836 			}
837 
838 			/*
839 			 * Run through the state machine as necessary if
840 			 * the port is not marked failed.
841 			 *
842 			 * The state machine may stop at NEED_IDENT if
843 			 * CAM is not yet attached.
844 			 *
845 			 * Acquire exclusive access to the port while we
846 			 * are doing this.  This prevents command-completion
847 			 * from queueing commands for non-polled targets
848 			 * inbetween our probe steps.  We need to do this
849 			 * because the reset probes can generate severe PHY
850 			 * and protocol errors and soft-brick the port.
851 			 */
852 			if (at->at_probe != ATA_PROBE_FAILED &&
853 			    at->at_probe != ATA_PROBE_GOOD) {
854 				ahci_beg_exclusive_access(ap, at);
855 				if (at->at_probe == ATA_PROBE_NEED_INIT)
856 					ahci_pm_port_init(ap, at);
857 				if (at->at_probe == ATA_PROBE_NEED_HARD_RESET)
858 					ahci_port_reset(ap, at, 1);
859 				if (at->at_probe == ATA_PROBE_NEED_SOFT_RESET)
860 					ahci_port_reset(ap, at, 0);
861 				if (at->at_probe == ATA_PROBE_NEED_IDENT)
862 					ahci_cam_probe(ap, at);
863 				ahci_end_exclusive_access(ap, at);
864 			}
865 
866 			/*
867 			 * Add or remove from CAM
868 			 */
869 			if (at->at_features & ATA_PORT_F_RESCAN) {
870 				at->at_features &= ~ATA_PORT_F_RESCAN;
871 				if (at->at_probe == ATA_PROBE_FAILED) {
872 					ahci_cam_changed(ap, at, 0);
873 				} else if (at->at_probe >= ATA_PROBE_NEED_IDENT) {
874 					ahci_cam_changed(ap, at, 1);
875 				}
876 			}
877 			data &= ~(1 << target);
878 		}
879 		if (data) {
880 			kprintf("%s: WARNING (PM): extra bits set in "
881 				"EINFO: %08x\n", PORTNAME(ap), data);
882 			while (target < AHCI_MAX_PMPORTS) {
883 				ahci_pm_check_good(ap, target);
884 				++target;
885 			}
886 		}
887 	}
888 }
889 
890 
891 /*
892  * De-initialize and detach a port.
893  */
894 void
895 ahci_port_free(struct ahci_softc *sc, u_int port)
896 {
897 	struct ahci_port	*ap = sc->sc_ports[port];
898 	struct ahci_ccb		*ccb;
899 	int i;
900 
901 	/*
902 	 * Ensure port is disabled and its interrupts are all flushed.
903 	 */
904 	if (ap->ap_sc) {
905 		ahci_port_stop(ap, 1);
906 		ahci_os_stop_port(ap);
907 		ahci_pwrite(ap, AHCI_PREG_CMD, 0);
908 		ahci_pwrite(ap, AHCI_PREG_IE, 0);
909 		ahci_pwrite(ap, AHCI_PREG_IS, ahci_pread(ap, AHCI_PREG_IS));
910 		ahci_write(sc, AHCI_REG_IS, 1 << port);
911 	}
912 
913 	if (ap->ap_ccbs) {
914 		while ((ccb = ahci_get_ccb(ap)) != NULL) {
915 			if (ccb->ccb_dmamap) {
916 				bus_dmamap_destroy(sc->sc_tag_data,
917 						   ccb->ccb_dmamap);
918 				ccb->ccb_dmamap = NULL;
919 			}
920 		}
921 		if ((ccb = ap->ap_err_ccb) != NULL) {
922 			if (ccb->ccb_dmamap) {
923 				bus_dmamap_destroy(sc->sc_tag_data,
924 						   ccb->ccb_dmamap);
925 				ccb->ccb_dmamap = NULL;
926 			}
927 			ap->ap_err_ccb = NULL;
928 		}
929 		kfree(ap->ap_ccbs, M_DEVBUF);
930 		ap->ap_ccbs = NULL;
931 	}
932 
933 	if (ap->ap_dmamem_cmd_list) {
934 		ahci_dmamem_free(sc, ap->ap_dmamem_cmd_list);
935 		ap->ap_dmamem_cmd_list = NULL;
936 	}
937 	if (ap->ap_dmamem_rfis) {
938 		ahci_dmamem_free(sc, ap->ap_dmamem_rfis);
939 		ap->ap_dmamem_rfis = NULL;
940 	}
941 	if (ap->ap_dmamem_cmd_table) {
942 		ahci_dmamem_free(sc, ap->ap_dmamem_cmd_table);
943 		ap->ap_dmamem_cmd_table = NULL;
944 	}
945 	if (ap->ap_ata) {
946 		for (i = 0; i < AHCI_MAX_PMPORTS; ++i) {
947 			if (ap->ap_ata[i]) {
948 				kfree(ap->ap_ata[i], M_DEVBUF);
949 				ap->ap_ata[i] = NULL;
950 			}
951 		}
952 	}
953 	if (ap->ap_err_scratch) {
954 		kfree(ap->ap_err_scratch, M_DEVBUF);
955 		ap->ap_err_scratch = NULL;
956 	}
957 
958 	/* bus_space(9) says we dont free the subregions handle */
959 
960 	kfree(ap, M_DEVBUF);
961 	sc->sc_ports[port] = NULL;
962 }
963 
964 static
965 u_int32_t
966 ahci_pactive(struct ahci_port *ap)
967 {
968 	u_int32_t mask;
969 
970 	mask = ahci_pread(ap, AHCI_PREG_CI);
971 	if (ap->ap_sc->sc_cap & AHCI_REG_CAP_SNCQ)
972 		mask |= ahci_pread(ap, AHCI_PREG_SACT);
973 	return(mask);
974 }
975 
976 /*
977  * Start high-level command processing on the port
978  */
979 int
980 ahci_port_start(struct ahci_port *ap)
981 {
982 	u_int32_t	r, s, is, tfd;
983 
984 	/*
985 	 * FRE must be turned on before ST.  Wait for FR to go active
986 	 * before turning on ST.  The spec doesn't seem to think this
987 	 * is necessary but waiting here avoids an on-off race in the
988 	 * ahci_port_stop() code.
989 	 */
990 	r = ahci_pread(ap, AHCI_PREG_CMD);
991 	if ((r & AHCI_PREG_CMD_FRE) == 0) {
992 		r |= AHCI_PREG_CMD_FRE;
993 		ahci_pwrite(ap, AHCI_PREG_CMD, r);
994 	}
995 	if ((ap->ap_sc->sc_flags & AHCI_F_IGN_FR) == 0) {
996 		if (ahci_pwait_set(ap, AHCI_PREG_CMD, AHCI_PREG_CMD_FR)) {
997 			kprintf("%s: Cannot start FIS reception\n",
998 				PORTNAME(ap));
999 			return (2);
1000 		}
1001 	} else {
1002 		ahci_os_sleep(10);
1003 	}
1004 
1005 	/*
1006 	 * Turn on ST, wait for CR to come up.
1007 	 */
1008 	r |= AHCI_PREG_CMD_ST;
1009 	ahci_pwrite(ap, AHCI_PREG_CMD, r);
1010 	if (ahci_pwait_set_to(ap, 2000, AHCI_PREG_CMD, AHCI_PREG_CMD_CR)) {
1011 		s = ahci_pread(ap, AHCI_PREG_SERR);
1012 		is = ahci_pread(ap, AHCI_PREG_IS);
1013 		tfd = ahci_pread(ap, AHCI_PREG_TFD);
1014 		kprintf("%s: Cannot start command DMA\n"
1015 			"NCMP=%b NSERR=%b\n"
1016 			"NEWIS=%b\n"
1017 			"NEWTFD=%b\n",
1018 			PORTNAME(ap),
1019 			r, AHCI_PFMT_CMD, s, AHCI_PFMT_SERR,
1020 			is, AHCI_PFMT_IS,
1021 			tfd, AHCI_PFMT_TFD_STS);
1022 		return (1);
1023 	}
1024 
1025 #ifdef AHCI_COALESCE
1026 	/*
1027 	 * (Re-)enable coalescing on the port.
1028 	 */
1029 	if (ap->ap_sc->sc_ccc_ports & (1 << ap->ap_num)) {
1030 		ap->ap_sc->sc_ccc_ports_cur |= (1 << ap->ap_num);
1031 		ahci_write(ap->ap_sc, AHCI_REG_CCC_PORTS,
1032 		    ap->ap_sc->sc_ccc_ports_cur);
1033 	}
1034 #endif
1035 
1036 	return (0);
1037 }
1038 
1039 /*
1040  * Stop high-level command processing on a port
1041  *
1042  * WARNING!  If the port is stopped while CR is still active our saved
1043  *	     CI/SACT will race any commands completed by the command
1044  *	     processor prior to being able to stop.  Thus we never call
1045  *	     this function unless we intend to dispose of any remaining
1046  *	     active commands.  In particular, this complicates the timeout
1047  *	     code.
1048  */
1049 int
1050 ahci_port_stop(struct ahci_port *ap, int stop_fis_rx)
1051 {
1052 	u_int32_t	r;
1053 
1054 #ifdef AHCI_COALESCE
1055 	/*
1056 	 * Disable coalescing on the port while it is stopped.
1057 	 */
1058 	if (ap->ap_sc->sc_ccc_ports & (1 << ap->ap_num)) {
1059 		ap->ap_sc->sc_ccc_ports_cur &= ~(1 << ap->ap_num);
1060 		ahci_write(ap->ap_sc, AHCI_REG_CCC_PORTS,
1061 		    ap->ap_sc->sc_ccc_ports_cur);
1062 	}
1063 #endif
1064 
1065 	/*
1066 	 * Turn off ST, then wait for CR to go off.
1067 	 */
1068 	r = ahci_pread(ap, AHCI_PREG_CMD) & ~AHCI_PREG_CMD_ICC;
1069 	r &= ~AHCI_PREG_CMD_ST;
1070 	ahci_pwrite(ap, AHCI_PREG_CMD, r);
1071 
1072 	if (ahci_pwait_clr(ap, AHCI_PREG_CMD, AHCI_PREG_CMD_CR)) {
1073 		kprintf("%s: Port bricked, unable to stop (ST)\n",
1074 			PORTNAME(ap));
1075 		return (1);
1076 	}
1077 
1078 #if 0
1079 	/*
1080 	 * Turn off FRE, then wait for FR to go off.  FRE cannot
1081 	 * be turned off until CR transitions to 0.
1082 	 */
1083 	if ((r & AHCI_PREG_CMD_FR) == 0) {
1084 		kprintf("%s: FR stopped, clear FRE for next start\n",
1085 			PORTNAME(ap));
1086 		stop_fis_rx = 2;
1087 	}
1088 #endif
1089 	if (stop_fis_rx) {
1090 		r &= ~AHCI_PREG_CMD_FRE;
1091 		ahci_pwrite(ap, AHCI_PREG_CMD, r);
1092 		if (ahci_pwait_clr(ap, AHCI_PREG_CMD, AHCI_PREG_CMD_FR)) {
1093 			kprintf("%s: Port bricked, unable to stop (FRE)\n",
1094 				PORTNAME(ap));
1095 			return (2);
1096 		}
1097 	}
1098 
1099 	return (0);
1100 }
1101 
1102 /*
1103  * AHCI command list override -> forcibly clear TFD.STS.{BSY,DRQ}
1104  */
1105 int
1106 ahci_port_clo(struct ahci_port *ap)
1107 {
1108 	struct ahci_softc		*sc = ap->ap_sc;
1109 	u_int32_t			cmd;
1110 
1111 	/* Only attempt CLO if supported by controller */
1112 	if ((ahci_read(sc, AHCI_REG_CAP) & AHCI_REG_CAP_SCLO) == 0)
1113 		return (1);
1114 
1115 	/* Issue CLO */
1116 	cmd = ahci_pread(ap, AHCI_PREG_CMD) & ~AHCI_PREG_CMD_ICC;
1117 	ahci_pwrite(ap, AHCI_PREG_CMD, cmd | AHCI_PREG_CMD_CLO);
1118 
1119 	/* Wait for completion */
1120 	if (ahci_pwait_clr(ap, AHCI_PREG_CMD, AHCI_PREG_CMD_CLO)) {
1121 		kprintf("%s: CLO did not complete\n", PORTNAME(ap));
1122 		return (1);
1123 	}
1124 
1125 	return (0);
1126 }
1127 
1128 /*
1129  * Reset a port.
1130  *
1131  * If hard is 0 perform a softreset of the port.
1132  * If hard is 1 perform a hard reset of the port.
1133  *
1134  * If at is non-NULL an indirect port via a port-multiplier is being
1135  * reset, otherwise a direct port is being reset.
1136  *
1137  * NOTE: Indirect ports can only be soft-reset.
1138  */
1139 int
1140 ahci_port_reset(struct ahci_port *ap, struct ata_port *at, int hard)
1141 {
1142 	int rc;
1143 
1144 	if (hard) {
1145 		if (at)
1146 			rc = ahci_pm_hardreset(ap, at->at_target, hard);
1147 		else
1148 			rc = ahci_port_hardreset(ap, hard);
1149 	} else {
1150 		if (at)
1151 			rc = ahci_pm_softreset(ap, at->at_target);
1152 		else
1153 			rc = ahci_port_softreset(ap);
1154 	}
1155 	return(rc);
1156 }
1157 
1158 /*
1159  * AHCI soft reset, Section 10.4.1
1160  *
1161  * (at) will be NULL when soft-resetting a directly-attached device, and
1162  * non-NULL when soft-resetting a device through a port multiplier.
1163  *
1164  * This function keeps port communications intact and attempts to generate
1165  * a reset to the connected device using device commands.
1166  */
1167 int
1168 ahci_port_softreset(struct ahci_port *ap)
1169 {
1170 	struct ahci_ccb		*ccb = NULL;
1171 	struct ahci_cmd_hdr	*cmd_slot;
1172 	u_int8_t		*fis;
1173 	int			error;
1174 
1175 	error = EIO;
1176 
1177 	if (bootverbose) {
1178 		kprintf("%s: START SOFTRESET %b\n", PORTNAME(ap),
1179 			ahci_pread(ap, AHCI_PREG_CMD), AHCI_PFMT_CMD);
1180 	}
1181 
1182 	DPRINTF(AHCI_D_VERBOSE, "%s: soft reset\n", PORTNAME(ap));
1183 
1184 	crit_enter();
1185 	ap->ap_flags |= AP_F_IN_RESET;
1186 	ap->ap_state = AP_S_NORMAL;
1187 
1188 	/*
1189 	 * Remember port state in cmd (main to restore start/stop)
1190 	 *
1191 	 * Idle port.
1192 	 */
1193 	if (ahci_port_stop(ap, 0)) {
1194 		kprintf("%s: failed to stop port, cannot softreset\n",
1195 			PORTNAME(ap));
1196 		goto err;
1197 	}
1198 
1199 	/*
1200 	 * Request CLO if device appears hung.
1201 	 */
1202 	if (ahci_pread(ap, AHCI_PREG_TFD) &
1203 		   (AHCI_PREG_TFD_STS_BSY | AHCI_PREG_TFD_STS_DRQ)) {
1204 		ahci_port_clo(ap);
1205 	}
1206 
1207 	/*
1208 	 * This is an attempt to clear errors so a new signature will
1209 	 * be latched.  It isn't working properly.  XXX
1210 	 */
1211 	ahci_flush_tfd(ap);
1212 	ahci_pwrite(ap, AHCI_PREG_SERR, -1);
1213 
1214 	/* Restart port */
1215 	if (ahci_port_start(ap)) {
1216 		kprintf("%s: failed to start port, cannot softreset\n",
1217 		        PORTNAME(ap));
1218 		goto err;
1219 	}
1220 
1221 	/* Check whether CLO worked */
1222 	if (ahci_pwait_clr(ap, AHCI_PREG_TFD,
1223 			       AHCI_PREG_TFD_STS_BSY | AHCI_PREG_TFD_STS_DRQ)) {
1224 		kprintf("%s: CLO %s, need port reset\n",
1225 			PORTNAME(ap),
1226 			(ahci_read(ap->ap_sc, AHCI_REG_CAP) & AHCI_REG_CAP_SCLO)
1227 			? "failed" : "unsupported");
1228 		error = EBUSY;
1229 		goto err;
1230 	}
1231 
1232 	/*
1233 	 * Prep first D2H command with SRST feature & clear busy/reset flags
1234 	 *
1235 	 * It is unclear which other fields in the FIS are used.  Just zero
1236 	 * everything.
1237 	 *
1238 	 * NOTE!  This CCB is used for both the first and second commands.
1239 	 *	  The second command must use CCB slot 1 to properly load
1240 	 *	  the signature.
1241 	 */
1242 	ccb = ahci_get_err_ccb(ap);
1243 	ccb->ccb_xa.complete = ahci_dummy_done;
1244 	ccb->ccb_xa.flags = ATA_F_POLL | ATA_F_EXCLUSIVE;
1245 	KKASSERT(ccb->ccb_slot == 1);
1246 	ccb->ccb_xa.at = NULL;
1247 	cmd_slot = ccb->ccb_cmd_hdr;
1248 
1249 	fis = ccb->ccb_cmd_table->cfis;
1250 	bzero(fis, sizeof(ccb->ccb_cmd_table->cfis));
1251 	fis[0] = ATA_FIS_TYPE_H2D;
1252 	fis[15] = ATA_FIS_CONTROL_SRST|ATA_FIS_CONTROL_4BIT;
1253 
1254 	cmd_slot->prdtl = 0;
1255 	cmd_slot->flags = htole16(5);	/* FIS length: 5 DWORDS */
1256 	cmd_slot->flags |= htole16(AHCI_CMD_LIST_FLAG_C); /* Clear busy on OK */
1257 	cmd_slot->flags |= htole16(AHCI_CMD_LIST_FLAG_R); /* Reset */
1258 
1259 	ccb->ccb_xa.state = ATA_S_PENDING;
1260 
1261 	if (ahci_poll(ccb, 1000, ahci_quick_timeout) != ATA_S_COMPLETE) {
1262 		kprintf("%s: First FIS failed\n", PORTNAME(ap));
1263 		goto err;
1264 	}
1265 
1266 	/*
1267 	 * WARNING!	TIME SENSITIVE SPACE!	WARNING!
1268 	 *
1269 	 * The two FISes are supposed to be back to back.  Don't issue other
1270 	 * commands or even delay if we can help it.
1271 	 */
1272 
1273 	/*
1274 	 * Prep second D2H command to read status and complete reset sequence
1275 	 * AHCI 10.4.1 and "Serial ATA Revision 2.6".  I can't find the ATA
1276 	 * Rev 2.6 and it is unclear how the second FIS should be set up
1277 	 * from the AHCI document.
1278 	 *
1279 	 * It is unclear which other fields in the FIS are used.  Just zero
1280 	 * everything.
1281 	 */
1282 	ccb->ccb_xa.flags = ATA_F_POLL | ATA_F_AUTOSENSE | ATA_F_EXCLUSIVE;
1283 
1284 	bzero(fis, sizeof(ccb->ccb_cmd_table->cfis));
1285 	fis[0] = ATA_FIS_TYPE_H2D;
1286 	fis[15] = ATA_FIS_CONTROL_4BIT;
1287 
1288 	cmd_slot->prdtl = 0;
1289 	cmd_slot->flags = htole16(5);	/* FIS length: 5 DWORDS */
1290 
1291 	ccb->ccb_xa.state = ATA_S_PENDING;
1292 	if (ahci_poll(ccb, 1000, ahci_quick_timeout) != ATA_S_COMPLETE) {
1293 		kprintf("%s: Second FIS failed\n", PORTNAME(ap));
1294 		goto err;
1295 	}
1296 
1297 	if (ahci_pwait_clr(ap, AHCI_PREG_TFD,
1298 			    AHCI_PREG_TFD_STS_BSY | AHCI_PREG_TFD_STS_DRQ)) {
1299 		kprintf("%s: device didn't come ready after reset, TFD: 0x%b\n",
1300 			PORTNAME(ap),
1301 			ahci_pread(ap, AHCI_PREG_TFD), AHCI_PFMT_TFD_STS);
1302 		error = EBUSY;
1303 		goto err;
1304 	}
1305 
1306 	/*
1307 	 * If the softreset is trying to clear a BSY condition after a
1308 	 * normal portreset we assign the port type.
1309 	 *
1310 	 * If the softreset is being run first as part of the ccb error
1311 	 * processing code then report if the device signature changed
1312 	 * unexpectedly.
1313 	 */
1314 	ahci_os_sleep(100);
1315 	if (ap->ap_type == ATA_PORT_T_NONE) {
1316 		ap->ap_type = ahci_port_signature_detect(ap, NULL);
1317 	} else {
1318 		if (ahci_port_signature_detect(ap, NULL) != ap->ap_type) {
1319 			kprintf("%s: device signature unexpectedly "
1320 				"changed\n", PORTNAME(ap));
1321 			error = EBUSY; /* XXX */
1322 		}
1323 	}
1324 	error = 0;
1325 
1326 	ahci_os_sleep(3);
1327 err:
1328 	if (ccb != NULL) {
1329 		ahci_put_err_ccb(ccb);
1330 
1331 		/*
1332 		 * If the target is busy use CLO to clear the busy
1333 		 * condition.  The BSY should be cleared on the next
1334 		 * start.
1335 		 */
1336 		if (ahci_pread(ap, AHCI_PREG_TFD) &
1337 		    (AHCI_PREG_TFD_STS_BSY | AHCI_PREG_TFD_STS_DRQ)) {
1338 			ahci_port_clo(ap);
1339 		}
1340 	}
1341 
1342 	/*
1343 	 * If we failed to softreset make the port quiescent, otherwise
1344 	 * make sure the port's start/stop state matches what it was on
1345 	 * entry.
1346 	 *
1347 	 * Don't kill the port if the softreset is on a port multiplier
1348 	 * target, that would kill all the targets!
1349 	 */
1350 	if (error) {
1351 		ahci_port_hardstop(ap);
1352 		/* ap_probe set to failed */
1353 	} else {
1354 		ap->ap_probe = ATA_PROBE_NEED_IDENT;
1355 		ap->ap_pmcount = 1;
1356 		ahci_port_start(ap);
1357 	}
1358 	ap->ap_flags &= ~AP_F_IN_RESET;
1359 	crit_exit();
1360 
1361 	if (bootverbose)
1362 		kprintf("%s: END SOFTRESET\n", PORTNAME(ap));
1363 
1364 	return (error);
1365 }
1366 
1367 /*
1368  * Issue just do the core COMRESET and basic device detection on a port.
1369  *
1370  * NOTE: Only called by ahci_port_hardreset().
1371  */
1372 static int
1373 ahci_comreset(struct ahci_port *ap, int *pmdetectp)
1374 {
1375 	u_int32_t cmd;
1376 	u_int32_t r;
1377 	int error;
1378 	int loop;
1379 	int retries = 0;
1380 
1381 	/*
1382 	 * Idle the port,
1383 	 */
1384 	*pmdetectp = 0;
1385 	ahci_port_stop(ap, 0);
1386 	ap->ap_state = AP_S_NORMAL;
1387 	ahci_os_sleep(10);
1388 
1389 	/*
1390 	 * The port may have been quiescent with its SUD bit cleared, so
1391 	 * set the SUD (spin up device).
1392 	 *
1393 	 * NOTE: I do not know if SUD is a hardware pin/low-level signal
1394 	 *	 or if it is messaged.
1395 	 */
1396 	cmd = ahci_pread(ap, AHCI_PREG_CMD) & ~AHCI_PREG_CMD_ICC;
1397 
1398 	cmd |= AHCI_PREG_CMD_SUD | AHCI_PREG_CMD_POD;
1399 	ahci_pwrite(ap, AHCI_PREG_CMD, cmd);
1400 	ahci_os_sleep(10);
1401 
1402 	/*
1403 	 * Make sure that all power management is disabled.
1404 	 *
1405 	 * NOTE!  AHCI_PREG_SCTL_DET_DISABLE seems to be highly unreliable
1406 	 *	  on multiple chipsets and can brick the chipset or even
1407 	 *	  the whole PC.  Never use it.
1408 	 */
1409 	ap->ap_type = ATA_PORT_T_NONE;
1410 
1411 	r = ap->ap_sc->sc_ipm_disable | AHCI_PREG_SCTL_SPM_DISABLED;
1412 	ahci_pwrite(ap, AHCI_PREG_SCTL, r);
1413 
1414 retry:
1415 	/*
1416 	 * Give the new power management state time to settle, then clear
1417 	 * pending status.
1418 	 */
1419 	ahci_os_sleep(1000);
1420 	ahci_flush_tfd(ap);
1421 	ahci_pwrite(ap, AHCI_PREG_SERR, -1);
1422 
1423 	/*
1424 	 * Start transmitting COMRESET.  The spec says that COMRESET must
1425 	 * be sent for at least 1ms but in actual fact numerous devices
1426 	 * appear to take much longer.  Delay a whole second here.
1427 	 *
1428 	 * In addition, SATA-3 ports can take longer to train, so even
1429 	 * SATA-2 devices which would normally detect very quickly may
1430 	 * take longer when plugged into a SATA-3 port.
1431 	 */
1432 	r |= AHCI_PREG_SCTL_DET_INIT;
1433 	switch(AhciForceGen) {
1434 	case 0:
1435 		r |= AHCI_PREG_SCTL_SPD_ANY;
1436 		break;
1437 	case 1:
1438 		r |= AHCI_PREG_SCTL_SPD_GEN1;
1439 		break;
1440 	case 2:
1441 		r |= AHCI_PREG_SCTL_SPD_GEN2;
1442 		break;
1443 	case 3:
1444 		r |= AHCI_PREG_SCTL_SPD_GEN3;
1445 		break;
1446 	default:
1447 		r |= AHCI_PREG_SCTL_SPD_GEN3;
1448 		break;
1449 	}
1450 	ahci_pwrite(ap, AHCI_PREG_SCTL, r);
1451 	ahci_os_sleep(1000);
1452 
1453 	ap->ap_flags &= ~AP_F_HARSH_REINIT;
1454 
1455 	/*
1456 	 * Only SERR_DIAG_X needs to be cleared for TFD updates, but
1457 	 * since we are hard-resetting the port we might as well clear
1458 	 * the whole enchillada.  Also be sure to clear any spurious BSY
1459 	 * prior to clearing INIT.
1460 	 *
1461 	 * Wait 1 whole second after clearing INIT before checking
1462 	 * the device detection bits in an attempt to work around chipsets
1463 	 * which do not properly mask PCS/PRCS during low level init.
1464 	 */
1465 	ahci_flush_tfd(ap);
1466 	ahci_pwrite(ap, AHCI_PREG_SERR, -1);
1467 /*	ahci_port_clo(ap);*/
1468 	ahci_os_sleep(10);
1469 
1470 	r &= ~AHCI_PREG_SCTL_SPD;
1471 	r &= ~AHCI_PREG_SCTL_DET_INIT;
1472 	r |= AHCI_PREG_SCTL_DET_NONE;
1473 	ahci_pwrite(ap, AHCI_PREG_SCTL, r);
1474 	ahci_os_sleep(1000);
1475 
1476 	/*
1477 	 * Try to determine if there is a device on the port.
1478 	 *
1479 	 * Give the device 3/10 second to at least be detected.
1480 	 * If we fail clear PRCS (phy detect) since we may cycled
1481 	 * the phy and probably caused another PRCS interrupt.
1482 	 */
1483 	loop = 300;
1484 	while (loop > 0) {
1485 		r = ahci_pread(ap, AHCI_PREG_SSTS);
1486 		if (r & AHCI_PREG_SSTS_DET)
1487 			break;
1488 		loop -= ahci_os_softsleep();
1489 	}
1490 	if (loop == 0) {
1491 		ahci_pwrite(ap, AHCI_PREG_IS, AHCI_PREG_IS_PRCS);
1492 		if (bootverbose) {
1493 			kprintf("%s: Port appears to be unplugged\n",
1494 				PORTNAME(ap));
1495 		}
1496 		error = ENODEV;
1497 		goto done;
1498 	}
1499 
1500 	/*
1501 	 * There is something on the port.  Regardless of what happens
1502 	 * after this tell the caller to try to detect a port multiplier.
1503 	 *
1504 	 * Give the device 3 seconds to fully negotiate.
1505 	 */
1506 	*pmdetectp = 1;
1507 
1508 	if (ahci_pwait_eq(ap, 3000, AHCI_PREG_SSTS,
1509 			  AHCI_PREG_SSTS_DET, AHCI_PREG_SSTS_DET_DEV)) {
1510 		if (bootverbose) {
1511 			kprintf("%s: Device may be powered down\n",
1512 				PORTNAME(ap));
1513 		}
1514 		error = ENODEV;
1515 		goto done;
1516 	}
1517 
1518 	/*
1519 	 * We got something that definitely looks like a device.  Give
1520 	 * the device time to send us its first D2H FIS.  Waiting for
1521 	 * BSY to clear accomplishes this.
1522 	 *
1523 	 * NOTE: A port multiplier may or may not clear BSY here,
1524 	 *	 depending on what is sitting in target 0 behind it.
1525 	 *
1526 	 * NOTE: Intel SSDs seem to have compatibility problems with Intel
1527 	 *	 mobo's on cold boots and may leave BSY set.  A single
1528 	 *	 retry works around the problem.  This is definitely a bug
1529 	 *	 with the mobo and/or the SSD and does not appear to occur
1530 	 *	 with other devices connected to the same port.
1531 	 */
1532 	ahci_flush_tfd(ap);
1533 	if (ahci_pwait_clr_to(ap, 8000, AHCI_PREG_TFD,
1534 			    AHCI_PREG_TFD_STS_BSY | AHCI_PREG_TFD_STS_DRQ)) {
1535 		kprintf("%s: Device BUSY: %b\n",
1536 			PORTNAME(ap),
1537 			ahci_pread(ap, AHCI_PREG_TFD),
1538 				AHCI_PFMT_TFD_STS);
1539 		if (retries == 0) {
1540 			kprintf("%s: Retrying\n", PORTNAME(ap));
1541 			retries = 1;
1542 			goto retry;
1543 		}
1544 		error = EBUSY;
1545 	} else {
1546 		error = 0;
1547 	}
1548 
1549 done:
1550 	ahci_flush_tfd(ap);
1551 	return error;
1552 }
1553 
1554 
1555 /*
1556  * AHCI port reset, Section 10.4.2
1557  *
1558  * This function does a hard reset of the port.  Note that the device
1559  * connected to the port could still end-up hung.
1560  */
1561 int
1562 ahci_port_hardreset(struct ahci_port *ap, int hard)
1563 {
1564 	u_int32_t data;
1565 	int	error;
1566 	int	pmdetect;
1567 
1568 	if (bootverbose)
1569 		kprintf("%s: START HARDRESET\n", PORTNAME(ap));
1570 	ap->ap_flags |= AP_F_IN_RESET;
1571 
1572 	error = ahci_comreset(ap, &pmdetect);
1573 
1574 	/*
1575 	 * We may be asked to perform a port multiplier check even if the
1576 	 * comreset failed.  This typically occurs when the PM has nothing
1577 	 * in slot 0, which can cause BSY to remain set.
1578 	 *
1579 	 * If the PM detection is successful it will override (error),
1580 	 * otherwise (error) is retained.  If an error does occur it
1581 	 * is possible that a normal device has blown up on us DUE to
1582 	 * the PM detection code, so re-run the comreset and assume
1583 	 * a normal device.
1584 	 */
1585 	if (pmdetect) {
1586 		if (ap->ap_sc->sc_cap & AHCI_REG_CAP_SPM) {
1587 			error = ahci_pm_port_probe(ap, error);
1588 			if (error) {
1589 				error = ahci_comreset(ap, &pmdetect);
1590 			}
1591 		}
1592 	}
1593 
1594 	/*
1595 	 * Finish up.
1596 	 */
1597 	ahci_os_sleep(500);
1598 
1599 	switch(error) {
1600 	case 0:
1601 		/*
1602 		 * All good, make sure the port is running and set the
1603 		 * probe state.  Ignore the signature junk (it's unreliable)
1604 		 * until we get to the softreset code.
1605 		 */
1606 		if (ahci_port_start(ap)) {
1607 			kprintf("%s: failed to start command DMA on port, "
1608 			        "disabling\n", PORTNAME(ap));
1609 			error = EBUSY;
1610 			break;
1611 		}
1612 		if (ap->ap_type == ATA_PORT_T_PM)
1613 			ap->ap_probe = ATA_PROBE_GOOD;
1614 		else
1615 			ap->ap_probe = ATA_PROBE_NEED_SOFT_RESET;
1616 		break;
1617 	case ENODEV:
1618 		/*
1619 		 * Normal device probe failure
1620 		 */
1621 		data = ahci_pread(ap, AHCI_PREG_SSTS);
1622 
1623 		switch(data & AHCI_PREG_SSTS_DET) {
1624 		case AHCI_PREG_SSTS_DET_DEV_NE:
1625 			kprintf("%s: Device not communicating\n",
1626 				PORTNAME(ap));
1627 			break;
1628 		case AHCI_PREG_SSTS_DET_PHYOFFLINE:
1629 			kprintf("%s: PHY offline\n",
1630 				PORTNAME(ap));
1631 			break;
1632 		default:
1633 			kprintf("%s: No device detected\n",
1634 				PORTNAME(ap));
1635 			break;
1636 		}
1637 		ahci_port_hardstop(ap);
1638 		break;
1639 	default:
1640 		/*
1641 		 * Abnormal probe (EBUSY)
1642 		 */
1643 		kprintf("%s: Device on port is bricked\n",
1644 			PORTNAME(ap));
1645 		ahci_port_hardstop(ap);
1646 #if 0
1647 		rc = ahci_port_reset(ap, atx, 0);
1648 		if (rc) {
1649 			kprintf("%s: Unable unbrick device\n",
1650 				PORTNAME(ap));
1651 		} else {
1652 			kprintf("%s: Successfully unbricked\n",
1653 				PORTNAME(ap));
1654 		}
1655 #endif
1656 		break;
1657 	}
1658 
1659 	/*
1660 	 * Clean up
1661 	 */
1662 	ahci_pwrite(ap, AHCI_PREG_SERR, -1);
1663 	ahci_pwrite(ap, AHCI_PREG_IS, AHCI_PREG_IS_PCS | AHCI_PREG_IS_PRCS);
1664 
1665 	ap->ap_flags &= ~AP_F_IN_RESET;
1666 
1667 	if (bootverbose)
1668 		kprintf("%s: END HARDRESET %d\n", PORTNAME(ap), error);
1669 	return (error);
1670 }
1671 
1672 /*
1673  * Hard-stop on hot-swap device removal.  See 10.10.1
1674  *
1675  * Place the port in a mode that will allow it to detect hot-swap insertions.
1676  * This is a bit imprecise because just setting-up SCTL to DET_INIT doesn't
1677  * seem to do the job.
1678  *
1679  * FIS reception is left enabled but command processing is disabled.
1680  * Cycling FIS reception (FRE) can brick ports.
1681  */
1682 void
1683 ahci_port_hardstop(struct ahci_port *ap)
1684 {
1685 	struct ahci_ccb *ccb;
1686 	struct ata_port *at;
1687 	u_int32_t r;
1688 	u_int32_t cmd;
1689 	int slot;
1690 	int i;
1691 	int serial;
1692 
1693 	/*
1694 	 * Stop the port.  We can't modify things like SUD if the port
1695 	 * is running.
1696 	 */
1697 	ap->ap_state = AP_S_FATAL_ERROR;
1698 	ap->ap_probe = ATA_PROBE_FAILED;
1699 	ap->ap_type = ATA_PORT_T_NONE;
1700 	ahci_port_stop(ap, 0);
1701 	cmd = ahci_pread(ap, AHCI_PREG_CMD);
1702 	cmd &= ~(AHCI_PREG_CMD_CLO | AHCI_PREG_CMD_PMA | AHCI_PREG_CMD_ICC);
1703 	ahci_pwrite(ap, AHCI_PREG_CMD, cmd);
1704 
1705 	/*
1706 	 * Clean up AT sub-ports on SATA port.
1707 	 */
1708 	for (i = 0; ap->ap_ata && i < AHCI_MAX_PMPORTS; ++i) {
1709 		at = ap->ap_ata[i];
1710 		at->at_type = ATA_PORT_T_NONE;
1711 		at->at_probe = ATA_PROBE_FAILED;
1712 	}
1713 
1714 	/*
1715 	 * Make sure FRE is active.  There isn't anything we can do if it
1716 	 * fails so just ignore errors.
1717 	 */
1718 	if ((cmd & AHCI_PREG_CMD_FRE) == 0) {
1719 		cmd |= AHCI_PREG_CMD_FRE;
1720 		ahci_pwrite(ap, AHCI_PREG_CMD, cmd);
1721 		if ((ap->ap_sc->sc_flags & AHCI_F_IGN_FR) == 0)
1722 			ahci_pwait_set(ap, AHCI_PREG_CMD, AHCI_PREG_CMD_FR);
1723 	}
1724 
1725 	/*
1726 	 * 10.10.1 place us in the Listen state.
1727 	 *
1728 	 * 10.10.3 DET must be set to 0 and found to be 0 before
1729 	 * setting SUD to 0.
1730 	 *
1731 	 * Deactivating SUD only applies if the controller supports SUD, it
1732 	 * is a bit unclear what happens w/regards to detecting hotplug
1733 	 * if it doesn't.
1734 	 */
1735 	r = ap->ap_sc->sc_ipm_disable | AHCI_PREG_SCTL_SPM_DISABLED;
1736 	ahci_pwrite(ap, AHCI_PREG_SCTL, r);
1737 	ahci_os_sleep(10);
1738 	cmd &= ~AHCI_PREG_CMD_SUD;
1739 	ahci_pwrite(ap, AHCI_PREG_CMD, cmd);
1740 	ahci_os_sleep(10);
1741 
1742 	/*
1743 	 * 10.10.1
1744 	 *
1745 	 * Transition su to the spin-up state.  HBA shall send COMRESET and
1746 	 * begin initialization sequence (whatever that means).  Presumably
1747 	 * this is edge-triggered.  Following the spin-up state the HBA
1748 	 * will automatically transition to the Normal state.
1749 	 *
1750 	 * This only applies if the controller supports SUD.
1751 	 * NEVER use AHCI_PREG_DET_DISABLE.
1752 	 */
1753 	cmd |= AHCI_PREG_CMD_POD |
1754 	       AHCI_PREG_CMD_SUD |
1755 	       AHCI_PREG_CMD_ICC_ACTIVE;
1756 	ahci_pwrite(ap, AHCI_PREG_CMD, cmd);
1757 	ahci_os_sleep(10);
1758 
1759 	/*
1760 	 * Flush SERR_DIAG_X so the TFD can update.
1761 	 */
1762 	ahci_flush_tfd(ap);
1763 
1764 	/*
1765 	 * Clean out pending ccbs
1766 	 */
1767 restart:
1768 	while (ap->ap_active) {
1769 		slot = ffs(ap->ap_active) - 1;
1770 		ap->ap_active &= ~(1 << slot);
1771 		--ap->ap_active_cnt;
1772 		ccb = &ap->ap_ccbs[slot];
1773 		if (ccb->ccb_xa.flags & ATA_F_TIMEOUT_RUNNING) {
1774 			serial = ccb->ccb_xa.serial;
1775 			callout_stop_sync(&ccb->ccb_timeout);
1776 			if (serial != ccb->ccb_xa.serial) {
1777 				kprintf("%s: Warning: timeout race ccb %p\n",
1778 					PORTNAME(ap), ccb);
1779 				goto restart;
1780 			}
1781 			ccb->ccb_xa.flags &= ~ATA_F_TIMEOUT_RUNNING;
1782 		}
1783 		ap->ap_expired &= ~(1 << slot);
1784 		ccb->ccb_xa.flags &= ~(ATA_F_TIMEOUT_DESIRED |
1785 				       ATA_F_TIMEOUT_EXPIRED);
1786 		ccb->ccb_xa.state = ATA_S_TIMEOUT;
1787 		ccb->ccb_done(ccb);
1788 		ccb->ccb_xa.complete(&ccb->ccb_xa);
1789 	}
1790 	while (ap->ap_sactive) {
1791 		slot = ffs(ap->ap_sactive) - 1;
1792 		ap->ap_sactive &= ~(1 << slot);
1793 		ccb = &ap->ap_ccbs[slot];
1794 		if (ccb->ccb_xa.flags & ATA_F_TIMEOUT_RUNNING) {
1795 			serial = ccb->ccb_xa.serial;
1796 			callout_stop_sync(&ccb->ccb_timeout);
1797 			if (serial != ccb->ccb_xa.serial) {
1798 				kprintf("%s: Warning: timeout race ccb %p\n",
1799 					PORTNAME(ap), ccb);
1800 				goto restart;
1801 			}
1802 			ccb->ccb_xa.flags &= ~ATA_F_TIMEOUT_RUNNING;
1803 		}
1804 		ap->ap_expired &= ~(1 << slot);
1805 		ccb->ccb_xa.flags &= ~(ATA_F_TIMEOUT_DESIRED |
1806 				       ATA_F_TIMEOUT_EXPIRED);
1807 		ccb->ccb_xa.state = ATA_S_TIMEOUT;
1808 		ccb->ccb_done(ccb);
1809 		ccb->ccb_xa.complete(&ccb->ccb_xa);
1810 	}
1811 	KKASSERT(ap->ap_active_cnt == 0);
1812 
1813 	while ((ccb = TAILQ_FIRST(&ap->ap_ccb_pending)) != NULL) {
1814 		TAILQ_REMOVE(&ap->ap_ccb_pending, ccb, ccb_entry);
1815 		ccb->ccb_xa.state = ATA_S_TIMEOUT;
1816 		ccb->ccb_xa.flags &= ~ATA_F_TIMEOUT_DESIRED;
1817 		ccb->ccb_done(ccb);
1818 		ccb->ccb_xa.complete(&ccb->ccb_xa);
1819 	}
1820 
1821 	/*
1822 	 * Hot-plug device detection should work at this point.  e.g. on
1823 	 * AMD chipsets Spin-Up/Normal state is sufficient for hot-plug
1824 	 * detection and entering RESET (continuous COMRESET by setting INIT)
1825 	 * will actually prevent hot-plug detection from working properly.
1826 	 *
1827 	 * There may be cases where this will fail to work, I have some
1828 	 * additional code to place the HBA in RESET (send continuous
1829 	 * COMRESET) and hopefully get DIAG.X or other events when something
1830 	 * is plugged in.  Unfortunately this isn't universal and can
1831 	 * also prevent events from generating interrupts.
1832 	 */
1833 
1834 #if 0
1835 	/*
1836 	 * Transition us to the Reset state.  Theoretically we send a
1837 	 * continuous stream of COMRESETs in this state.
1838 	 */
1839 	r |= AHCI_PREG_SCTL_DET_INIT;
1840 	if (AhciForceGen1 & (1 << ap->ap_num)) {
1841 		kprintf("%s: Force 1.5Gbits\n", PORTNAME(ap));
1842 		r |= AHCI_PREG_SCTL_SPD_GEN1;
1843 	} else {
1844 		r |= AHCI_PREG_SCTL_SPD_ANY;
1845 	}
1846 	ahci_pwrite(ap, AHCI_PREG_SCTL, r);
1847 	ahci_os_sleep(10);
1848 
1849 	/*
1850 	 * Flush SERR_DIAG_X so the TFD can update.
1851 	 */
1852 	ahci_flush_tfd(ap);
1853 #endif
1854 	/* NOP */
1855 }
1856 
1857 /*
1858  * We can't loop on the X bit, a continuous COMINIT received will make
1859  * it loop forever.  Just assume one event has built up and clear X
1860  * so the task file descriptor can update.
1861  */
1862 void
1863 ahci_flush_tfd(struct ahci_port *ap)
1864 {
1865 	u_int32_t r;
1866 
1867 	r = ahci_pread(ap, AHCI_PREG_SERR);
1868 	if (r & AHCI_PREG_SERR_DIAG_X)
1869 		ahci_pwrite(ap, AHCI_PREG_SERR, AHCI_PREG_SERR_DIAG_X);
1870 }
1871 
1872 /*
1873  * Figure out what type of device is connected to the port, ATAPI or
1874  * DISK.
1875  */
1876 int
1877 ahci_port_signature_detect(struct ahci_port *ap, struct ata_port *at)
1878 {
1879 	u_int32_t sig;
1880 
1881 	sig = ahci_pread(ap, AHCI_PREG_SIG);
1882 	if (bootverbose)
1883 		kprintf("%s: sig %08x\n", ATANAME(ap, at), sig);
1884 	if ((sig & 0xffff0000) == (SATA_SIGNATURE_ATAPI & 0xffff0000)) {
1885 		return(ATA_PORT_T_ATAPI);
1886 	} else if ((sig & 0xffff0000) ==
1887 		 (SATA_SIGNATURE_PORT_MULTIPLIER & 0xffff0000)) {
1888 		return(ATA_PORT_T_PM);
1889 	} else {
1890 		return(ATA_PORT_T_DISK);
1891 	}
1892 }
1893 
1894 /*
1895  * Load the DMA descriptor table for a CCB's buffer.
1896  */
1897 int
1898 ahci_load_prdt(struct ahci_ccb *ccb)
1899 {
1900 	struct ahci_port		*ap = ccb->ccb_port;
1901 	struct ahci_softc		*sc = ap->ap_sc;
1902 	struct ata_xfer			*xa = &ccb->ccb_xa;
1903 	struct ahci_prdt		*prdt = ccb->ccb_cmd_table->prdt;
1904 	bus_dmamap_t			dmap = ccb->ccb_dmamap;
1905 	struct ahci_cmd_hdr		*cmd_slot = ccb->ccb_cmd_hdr;
1906 	int				error;
1907 
1908 	if (xa->datalen == 0) {
1909 		ccb->ccb_cmd_hdr->prdtl = 0;
1910 		return (0);
1911 	}
1912 
1913 	error = bus_dmamap_load(sc->sc_tag_data, dmap,
1914 				xa->data, xa->datalen,
1915 				ahci_load_prdt_callback,
1916 				&prdt,
1917 				((xa->flags & ATA_F_NOWAIT) ?
1918 				    BUS_DMA_NOWAIT : BUS_DMA_WAITOK));
1919 	if (error != 0) {
1920 		kprintf("%s: error %d loading dmamap\n", PORTNAME(ap), error);
1921 		return (1);
1922 	}
1923 #if 0
1924 	if (xa->flags & ATA_F_PIO)
1925 		prdt->flags |= htole32(AHCI_PRDT_FLAG_INTR);
1926 #endif
1927 
1928 	cmd_slot->prdtl = htole16(prdt - ccb->ccb_cmd_table->prdt + 1);
1929 
1930 	if (xa->flags & ATA_F_READ)
1931 		bus_dmamap_sync(sc->sc_tag_data, dmap, BUS_DMASYNC_PREREAD);
1932 	if (xa->flags & ATA_F_WRITE)
1933 		bus_dmamap_sync(sc->sc_tag_data, dmap, BUS_DMASYNC_PREWRITE);
1934 
1935 	return (0);
1936 }
1937 
1938 /*
1939  * Callback from BUSDMA system to load the segment list.  The passed segment
1940  * list is a temporary structure.
1941  */
1942 static
1943 void
1944 ahci_load_prdt_callback(void *info, bus_dma_segment_t *segs, int nsegs,
1945 			int error)
1946 {
1947 	struct ahci_prdt *prd = *(void **)info;
1948 	u_int64_t addr;
1949 
1950 	KKASSERT(nsegs <= AHCI_MAX_PRDT);
1951 
1952 	while (nsegs) {
1953 		addr = segs->ds_addr;
1954 		prd->dba_hi = htole32((u_int32_t)(addr >> 32));
1955 		prd->dba_lo = htole32((u_int32_t)addr);
1956 		prd->flags = htole32(segs->ds_len - 1);
1957 		--nsegs;
1958 		if (nsegs)
1959 			++prd;
1960 		++segs;
1961 	}
1962 	*(void **)info = prd;	/* return last valid segment */
1963 }
1964 
1965 void
1966 ahci_unload_prdt(struct ahci_ccb *ccb)
1967 {
1968 	struct ahci_port		*ap = ccb->ccb_port;
1969 	struct ahci_softc		*sc = ap->ap_sc;
1970 	struct ata_xfer			*xa = &ccb->ccb_xa;
1971 	bus_dmamap_t			dmap = ccb->ccb_dmamap;
1972 
1973 	if (xa->datalen != 0) {
1974 		if (xa->flags & ATA_F_READ) {
1975 			bus_dmamap_sync(sc->sc_tag_data, dmap,
1976 					BUS_DMASYNC_POSTREAD);
1977 		}
1978 		if (xa->flags & ATA_F_WRITE) {
1979 			bus_dmamap_sync(sc->sc_tag_data, dmap,
1980 					BUS_DMASYNC_POSTWRITE);
1981 		}
1982 		bus_dmamap_unload(sc->sc_tag_data, dmap);
1983 
1984 		/*
1985 		 * prdbc is only updated by hardware for non-NCQ commands.
1986 		 */
1987 		if (ccb->ccb_xa.flags & ATA_F_NCQ) {
1988 			xa->resid = 0;
1989 		} else {
1990 			if (ccb->ccb_cmd_hdr->prdbc == 0 &&
1991 			    ccb->ccb_xa.state == ATA_S_COMPLETE) {
1992 				kprintf("%s: WARNING!  Unload prdbc resid "
1993 					"was zero! tag=%d\n",
1994 					ATANAME(ap, xa->at), ccb->ccb_slot);
1995 			}
1996 			xa->resid = xa->datalen -
1997 			    le32toh(ccb->ccb_cmd_hdr->prdbc);
1998 		}
1999 	}
2000 }
2001 
2002 /*
2003  * Start a command and poll for completion.
2004  *
2005  * timeout is in ms and only counts once the command gets on-chip.
2006  *
2007  * Returns ATA_S_* state, compare against ATA_S_COMPLETE to determine
2008  * that no error occured.
2009  *
2010  * NOTE: If the caller specifies a NULL timeout function the caller is
2011  *	 responsible for clearing hardware state on failure, but we will
2012  *	 deal with removing the ccb from any pending queue.
2013  *
2014  * NOTE: NCQ should never be used with this function.
2015  *
2016  * NOTE: If the port is in a failed state and stopped we do not try
2017  *	 to activate the ccb.
2018  */
2019 int
2020 ahci_poll(struct ahci_ccb *ccb, int timeout,
2021 	  void (*timeout_fn)(struct ahci_ccb *))
2022 {
2023 	struct ahci_port *ap = ccb->ccb_port;
2024 
2025 	if (ccb->ccb_port->ap_state == AP_S_FATAL_ERROR) {
2026 		ccb->ccb_xa.state = ATA_S_ERROR;
2027 		return(ccb->ccb_xa.state);
2028 	}
2029 	crit_enter();
2030 #if 0
2031 	kprintf("%s: Start command %02x tag=%d\n",
2032 		ATANAME(ccb->ccb_port, ccb->ccb_xa.at),
2033 		ccb->ccb_xa.fis->command, ccb->ccb_slot);
2034 #endif
2035 	ahci_start(ccb);
2036 
2037 	do {
2038 		ahci_port_intr(ap, 1);
2039 		switch(ccb->ccb_xa.state) {
2040 		case ATA_S_ONCHIP:
2041 			timeout -= ahci_os_softsleep();
2042 			break;
2043 		case ATA_S_PENDING:
2044 			ahci_os_softsleep();
2045 			ahci_check_active_timeouts(ap);
2046 			break;
2047 		default:
2048 			crit_exit();
2049 			return (ccb->ccb_xa.state);
2050 		}
2051 	} while (timeout > 0);
2052 
2053 	if ((ccb->ccb_xa.flags & ATA_F_SILENT) == 0) {
2054 		kprintf("%s: Poll timeout slot %d CMD: %b TFD: 0x%b SERR: %b\n",
2055 			ATANAME(ap, ccb->ccb_xa.at), ccb->ccb_slot,
2056 			ahci_pread(ap, AHCI_PREG_CMD), AHCI_PFMT_CMD,
2057 			ahci_pread(ap, AHCI_PREG_TFD), AHCI_PFMT_TFD_STS,
2058 			ahci_pread(ap, AHCI_PREG_SERR), AHCI_PFMT_SERR);
2059 	}
2060 
2061 	timeout_fn(ccb);
2062 
2063 	crit_exit();
2064 
2065 	return(ccb->ccb_xa.state);
2066 }
2067 
2068 /*
2069  * When polling we have to check if the currently active CCB(s)
2070  * have timed out as the callout will be deadlocked while we
2071  * hold the port lock.
2072  */
2073 void
2074 ahci_check_active_timeouts(struct ahci_port *ap)
2075 {
2076 	struct ahci_ccb *ccb;
2077 	u_int32_t mask;
2078 	int tag;
2079 
2080 	mask = ap->ap_active | ap->ap_sactive;
2081 	while (mask) {
2082 		tag = ffs(mask) - 1;
2083 		mask &= ~(1 << tag);
2084 		ccb = &ap->ap_ccbs[tag];
2085 		if (ccb->ccb_xa.flags & ATA_F_TIMEOUT_EXPIRED) {
2086 			ahci_ata_cmd_timeout(ccb);
2087 		}
2088 	}
2089 }
2090 
2091 static
2092 __inline
2093 void
2094 ahci_start_timeout(struct ahci_ccb *ccb)
2095 {
2096 	if (ccb->ccb_xa.flags & ATA_F_TIMEOUT_DESIRED) {
2097 		ccb->ccb_xa.flags |= ATA_F_TIMEOUT_RUNNING;
2098 		callout_reset(&ccb->ccb_timeout,
2099 			      (ccb->ccb_xa.timeout * hz + 999) / 1000,
2100 			      ahci_ata_cmd_timeout_unserialized, ccb);
2101 	}
2102 }
2103 
2104 void
2105 ahci_start(struct ahci_ccb *ccb)
2106 {
2107 	struct ahci_port		*ap = ccb->ccb_port;
2108 	struct ahci_softc		*sc = ap->ap_sc;
2109 
2110 	KKASSERT(ccb->ccb_xa.state == ATA_S_PENDING);
2111 
2112 	/* Zero transferred byte count before transfer */
2113 	ccb->ccb_cmd_hdr->prdbc = 0;
2114 
2115 	/* Sync command list entry and corresponding command table entry */
2116 	bus_dmamap_sync(sc->sc_tag_cmdh,
2117 			AHCI_DMA_MAP(ap->ap_dmamem_cmd_list),
2118 			BUS_DMASYNC_PREWRITE);
2119 	bus_dmamap_sync(sc->sc_tag_cmdt,
2120 			AHCI_DMA_MAP(ap->ap_dmamem_cmd_table),
2121 			BUS_DMASYNC_PREWRITE);
2122 
2123 	/* Prepare RFIS area for write by controller */
2124 	bus_dmamap_sync(sc->sc_tag_rfis,
2125 			AHCI_DMA_MAP(ap->ap_dmamem_rfis),
2126 			BUS_DMASYNC_PREREAD);
2127 
2128 	/*
2129 	 * There's no point trying to optimize this, it only shaves a few
2130 	 * nanoseconds so just queue the command and call our generic issue.
2131 	 */
2132 	ahci_issue_pending_commands(ap, ccb);
2133 }
2134 
2135 /*
2136  * While holding the port lock acquire exclusive access to the port.
2137  *
2138  * This is used when running the state machine to initialize and identify
2139  * targets over a port multiplier.  Setting exclusive access prevents
2140  * ahci_port_intr() from activating any requests sitting on the pending
2141  * queue.
2142  */
2143 void
2144 ahci_beg_exclusive_access(struct ahci_port *ap, struct ata_port *at)
2145 {
2146 	KKASSERT((ap->ap_flags & AP_F_EXCLUSIVE_ACCESS) == 0);
2147 	ap->ap_flags |= AP_F_EXCLUSIVE_ACCESS;
2148 	while (ap->ap_active || ap->ap_sactive) {
2149 		ahci_port_intr(ap, 1);
2150 		ahci_os_softsleep();
2151 	}
2152 }
2153 
2154 void
2155 ahci_end_exclusive_access(struct ahci_port *ap, struct ata_port *at)
2156 {
2157 	KKASSERT((ap->ap_flags & AP_F_EXCLUSIVE_ACCESS) != 0);
2158 	ap->ap_flags &= ~AP_F_EXCLUSIVE_ACCESS;
2159 	ahci_issue_pending_commands(ap, NULL);
2160 }
2161 
2162 /*
2163  * If ccb is not NULL enqueue and/or issue it.
2164  *
2165  * If ccb is NULL issue whatever we can from the queue.  However, nothing
2166  * new is issued if the exclusive access flag is set or expired ccb's are
2167  * present.
2168  *
2169  * If existing commands are still active (ap_active/ap_sactive) we can only
2170  * issue matching new commands.
2171  */
2172 void
2173 ahci_issue_pending_commands(struct ahci_port *ap, struct ahci_ccb *ccb)
2174 {
2175 	u_int32_t		mask;
2176 	int			limit;
2177 
2178 	/*
2179 	 * Enqueue the ccb.
2180 	 *
2181 	 * If just running the queue and in exclusive access mode we
2182 	 * just return.  Also in this case if there are any expired ccb's
2183 	 * we want to clear the queue so the port can be safely stopped.
2184 	 */
2185 	if (ccb) {
2186 		TAILQ_INSERT_TAIL(&ap->ap_ccb_pending, ccb, ccb_entry);
2187 	} else if ((ap->ap_flags & AP_F_EXCLUSIVE_ACCESS) || ap->ap_expired) {
2188 		return;
2189 	}
2190 
2191 	/*
2192 	 * Pull the next ccb off the queue and run it if possible.
2193 	 *
2194 	 * The error CCB supercedes all normal queue operations and
2195 	 * implies exclusive access while the error CCB is active.
2196 	 */
2197 	if (ccb != ap->ap_err_ccb) {
2198 		if ((ccb = TAILQ_FIRST(&ap->ap_ccb_pending)) == NULL)
2199 			return;
2200 		if (ap->ap_flags & AP_F_ERR_CCB_RESERVED) {
2201 			kprintf("DELAY CCB slot %d\n", ccb->ccb_slot);
2202 			return;
2203 		}
2204 	}
2205 
2206 	/*
2207 	 * Handle exclusivity requirements.
2208 	 *
2209 	 * ATA_F_EXCLUSIVE is used when we want to be the only command
2210 	 * running.
2211 	 *
2212 	 * ATA_F_AUTOSENSE is used when we want the D2H rfis loaded
2213 	 * back into the ccb on a normal (non-errored) command completion.
2214 	 * For example, for PM requests to target 15.  Because the AHCI
2215 	 * spec does not stop the command processor and has only one rfis
2216 	 * area (for non-FBSS anyway), AUTOSENSE currently implies EXCLUSIVE.
2217 	 * Otherwise multiple completions can destroy the rfis data before
2218 	 * we have a chance to copy it.
2219 	 */
2220 	if (ap->ap_active & ~ap->ap_expired) {
2221 		/*
2222 		 * There may be multiple ccb's already running,
2223 		 * if any are running and ap_run_flags sets
2224 		 * one of these flags then we know only one is
2225 		 * running.
2226 		 *
2227 		 * XXX Current AUTOSENSE code forces exclusivity
2228 		 *     to simplify the code.
2229 		 */
2230 		if (ap->ap_run_flags &
2231 		    (ATA_F_EXCLUSIVE | ATA_F_AUTOSENSE)) {
2232 			return;
2233 		}
2234 
2235 		if (ccb->ccb_xa.flags &
2236 		    (ATA_F_EXCLUSIVE | ATA_F_AUTOSENSE)) {
2237 			return;
2238 		}
2239 	}
2240 
2241 	if (ccb->ccb_xa.flags & ATA_F_NCQ) {
2242 		/*
2243 		 * The next command is a NCQ command and can be issued as
2244 		 * long as currently active commands are not standard.
2245 		 */
2246 		if (ap->ap_active) {
2247 			KKASSERT(ap->ap_active_cnt > 0);
2248 			return;
2249 		}
2250 		KKASSERT(ap->ap_active_cnt == 0);
2251 
2252 		mask = 0;
2253 		do {
2254 			TAILQ_REMOVE(&ap->ap_ccb_pending, ccb, ccb_entry);
2255 			KKASSERT((mask & (1 << ccb->ccb_slot)) == 0);
2256 			mask |= 1 << ccb->ccb_slot;
2257 			KKASSERT(ccb->ccb_xa.state == ATA_S_PENDING);
2258 			KKASSERT(ccb == &ap->ap_ccbs[ccb->ccb_slot]);
2259 			ccb->ccb_xa.state = ATA_S_ONCHIP;
2260 			ahci_start_timeout(ccb);
2261 			ap->ap_run_flags = ccb->ccb_xa.flags;
2262 			ccb = TAILQ_FIRST(&ap->ap_ccb_pending);
2263 		} while (ccb && (ccb->ccb_xa.flags & ATA_F_NCQ) &&
2264 			 (ap->ap_run_flags &
2265 			     (ATA_F_EXCLUSIVE | ATA_F_AUTOSENSE)) == 0);
2266 
2267 		KKASSERT(((ap->ap_active | ap->ap_sactive) & mask) == 0);
2268 
2269 		ap->ap_sactive |= mask;
2270 		ahci_pwrite(ap, AHCI_PREG_SACT, mask);
2271 		ahci_pwrite(ap, AHCI_PREG_CI, mask);
2272 	} else {
2273 		/*
2274 		 * The next command is a standard command and can be issued
2275 		 * as long as currently active commands are not NCQ.
2276 		 *
2277 		 * We limit ourself to 1 command if we have a port multiplier,
2278 		 * (at least without FBSS support), otherwise timeouts on
2279 		 * one port can race completions on other ports (see
2280 		 * ahci_ata_cmd_timeout() for more information).
2281 		 *
2282 		 * If not on a port multiplier generally allow up to 4
2283 		 * standard commands to be enqueued.  Remember that the
2284 		 * command processor will still process them sequentially.
2285 		 */
2286 		if (ap->ap_sactive)
2287 			return;
2288 		if (ap->ap_type == ATA_PORT_T_PM)
2289 			limit = 1;
2290 		else if (ap->ap_sc->sc_ncmds > 4)
2291 			limit = 4;
2292 		else
2293 			limit = 2;
2294 
2295 		while (ap->ap_active_cnt < limit && ccb &&
2296 		       (ccb->ccb_xa.flags & ATA_F_NCQ) == 0) {
2297 			TAILQ_REMOVE(&ap->ap_ccb_pending, ccb, ccb_entry);
2298 			KKASSERT(((ap->ap_active | ap->ap_sactive) &
2299 				  (1 << ccb->ccb_slot)) == 0);
2300 			ap->ap_active |= 1 << ccb->ccb_slot;
2301 			ap->ap_active_cnt++;
2302 			ap->ap_run_flags = ccb->ccb_xa.flags;
2303 			ccb->ccb_xa.state = ATA_S_ONCHIP;
2304 			ahci_start_timeout(ccb);
2305 			ahci_pwrite(ap, AHCI_PREG_CI, 1 << ccb->ccb_slot);
2306 			if ((ap->ap_run_flags &
2307 			    (ATA_F_EXCLUSIVE | ATA_F_AUTOSENSE)) == 0) {
2308 				break;
2309 			}
2310 			ccb = TAILQ_FIRST(&ap->ap_ccb_pending);
2311 			if (ccb && (ccb->ccb_xa.flags &
2312 				    (ATA_F_EXCLUSIVE | ATA_F_AUTOSENSE))) {
2313 				break;
2314 			}
2315 		}
2316 	}
2317 }
2318 
2319 void
2320 ahci_intr(void *arg)
2321 {
2322 	struct ahci_softc	*sc = arg;
2323 	struct ahci_port	*ap;
2324 	u_int32_t		is;
2325 	u_int32_t		ack;
2326 	int			port;
2327 
2328 	/*
2329 	 * Check if the master enable is up, and whether any interrupts are
2330 	 * pending.
2331 	 */
2332 	if ((sc->sc_flags & AHCI_F_INT_GOOD) == 0)
2333 		return;
2334 	is = ahci_read(sc, AHCI_REG_IS);
2335 	if (is == 0 || is == 0xffffffff) {
2336 		return;
2337 	}
2338 	is &= sc->sc_portmask;
2339 
2340 #ifdef AHCI_COALESCE
2341 	/* Check coalescing interrupt first */
2342 	if (is & sc->sc_ccc_mask) {
2343 		DPRINTF(AHCI_D_INTR, "%s: command coalescing interrupt\n",
2344 		    DEVNAME(sc));
2345 		is &= ~sc->sc_ccc_mask;
2346 		is |= sc->sc_ccc_ports_cur;
2347 	}
2348 #endif
2349 
2350 	/*
2351 	 * Process interrupts for each port in a non-blocking fashion.
2352 	 *
2353 	 * The global IS bit is supposed to be forced on if any unmasked
2354 	 * port interrupt is pending, even if we clear it.
2355 	 *
2356 	 * However it would appear that it is simply latched on some parts,
2357 	 * which means we have to clear it BEFORE processing the status bits
2358 	 * to avoid races.
2359 	 */
2360 	ahci_write(sc, AHCI_REG_IS, is);
2361 	for (ack = 0; is; is &= ~(1 << port)) {
2362 		port = ffs(is) - 1;
2363 		ack |= 1 << port;
2364 
2365 		ap = sc->sc_ports[port];
2366 		if (ap == NULL)
2367 			continue;
2368 
2369 		if (ahci_os_lock_port_nb(ap) == 0) {
2370 			ahci_port_intr(ap, 0);
2371 			ahci_os_unlock_port(ap);
2372 		} else {
2373 			ahci_pwrite(ap, AHCI_PREG_IE, 0);
2374 			ahci_os_signal_port_thread(ap, AP_SIGF_PORTINT);
2375 		}
2376 	}
2377 }
2378 
2379 /*
2380  * Core called from helper thread.
2381  */
2382 void
2383 ahci_port_thread_core(struct ahci_port *ap, int mask)
2384 {
2385 	/*
2386 	 * Process any expired timedouts.
2387 	 */
2388 	ahci_os_lock_port(ap);
2389 	if (mask & AP_SIGF_TIMEOUT) {
2390 		ahci_check_active_timeouts(ap);
2391 	}
2392 
2393 	/*
2394 	 * Process port interrupts which require a higher level of
2395 	 * intervention.
2396 	 */
2397 	if (mask & AP_SIGF_PORTINT) {
2398 		ahci_port_intr(ap, 1);
2399 		ahci_port_interrupt_enable(ap);
2400 	} else if (ap->ap_probe != ATA_PROBE_FAILED) {
2401 		ahci_port_intr(ap, 1);
2402 		ahci_port_interrupt_enable(ap);
2403 	}
2404 	ahci_os_unlock_port(ap);
2405 }
2406 
2407 /*
2408  * Core per-port interrupt handler.
2409  *
2410  * If blockable is 0 we cannot call ahci_os_sleep() at all and we can only
2411  * deal with normal command completions which do not require blocking.
2412  */
2413 void
2414 ahci_port_intr(struct ahci_port *ap, int blockable)
2415 {
2416 	struct ahci_softc	*sc = ap->ap_sc;
2417 	u_int32_t		is, ci_saved, ci_masked;
2418 	int			slot;
2419 	int			stopped = 0;
2420 	struct ahci_ccb		*ccb = NULL;
2421 	struct ata_port		*ccb_at = NULL;
2422 	volatile u_int32_t	*active;
2423 	const u_int32_t		blockable_mask = AHCI_PREG_IS_TFES |
2424 						 AHCI_PREG_IS_IFS |
2425 						 AHCI_PREG_IS_PCS |
2426 						 AHCI_PREG_IS_PRCS |
2427 						 AHCI_PREG_IS_HBFS |
2428 						 AHCI_PREG_IS_OFS |
2429 						 AHCI_PREG_IS_UFS;
2430 
2431 	enum { NEED_NOTHING, NEED_REINIT, NEED_RESTART,
2432 	       NEED_HOTPLUG_INSERT, NEED_HOTPLUG_REMOVE } need = NEED_NOTHING;
2433 
2434 	/*
2435 	 * All basic command completions are always processed.
2436 	 */
2437 	is = ahci_pread(ap, AHCI_PREG_IS);
2438 	if (is & AHCI_PREG_IS_DPS)
2439 		ahci_pwrite(ap, AHCI_PREG_IS, is & AHCI_PREG_IS_DPS);
2440 
2441 	/*
2442 	 * If we can't block then we can't handle these here.  Disable
2443 	 * the interrupts in question so we don't live-lock, the helper
2444 	 * thread will re-enable them.
2445 	 *
2446 	 * If the port is in a completely failed state we do not want
2447 	 * to drop through to failed-command-processing if blockable is 0,
2448 	 * just let the thread deal with it all.
2449 	 *
2450 	 * Otherwise we fall through and still handle DHRS and any commands
2451 	 * which completed normally.  Even if we are errored we haven't
2452 	 * stopped the port yet so CI/SACT are still good.
2453 	 */
2454 	if (blockable == 0) {
2455 		if (ap->ap_state == AP_S_FATAL_ERROR) {
2456 			ahci_pwrite(ap, AHCI_PREG_IE, 0);
2457 			ahci_os_signal_port_thread(ap, AP_SIGF_PORTINT);
2458 			return;
2459 		}
2460 		if (is & blockable_mask) {
2461 			ahci_pwrite(ap, AHCI_PREG_IE, 0);
2462 			ahci_os_signal_port_thread(ap, AP_SIGF_PORTINT);
2463 			return;
2464 		}
2465 	}
2466 
2467 	/*
2468 	 * Either NCQ or non-NCQ commands will be active, never both.
2469 	 */
2470 	if (ap->ap_sactive) {
2471 		KKASSERT(ap->ap_active == 0);
2472 		KKASSERT(ap->ap_active_cnt == 0);
2473 		ci_saved = ahci_pread(ap, AHCI_PREG_SACT);
2474 		active = &ap->ap_sactive;
2475 	} else {
2476 		ci_saved = ahci_pread(ap, AHCI_PREG_CI);
2477 		active = &ap->ap_active;
2478 	}
2479 	KKASSERT(!(ap->ap_sactive && ap->ap_active));
2480 	KKASSERT((ci_saved & (ap->ap_sactive | ap->ap_active)) == ci_saved);
2481 #if 0
2482 	kprintf("CHECK act=%08x/%08x sact=%08x/%08x\n",
2483 		ap->ap_active, ahci_pread(ap, AHCI_PREG_CI),
2484 		ap->ap_sactive, ahci_pread(ap, AHCI_PREG_SACT));
2485 #endif
2486 
2487 	/*
2488 	 * Ignore AHCI_PREG_IS_PRCS when link power management is on
2489 	 */
2490 	if (ap->link_pwr_mgmt != AHCI_LINK_PWR_MGMT_NONE) {
2491 		is &= ~AHCI_PREG_IS_PRCS;
2492 		ahci_pwrite(ap, AHCI_PREG_SERR,
2493 			    AHCI_PREG_SERR_DIAG_N | AHCI_PREG_SERR_DIAG_W);
2494 	}
2495 
2496 	/*
2497 	 * Command failed (blockable).
2498 	 *
2499 	 * See AHCI 1.1 spec 6.2.2.1 and 6.2.2.2.
2500 	 *
2501 	 * This stops command processing.
2502 	 */
2503 	if (is & AHCI_PREG_IS_TFES) {
2504 		u_int32_t tfd, serr;
2505 		int	err_slot;
2506 
2507 process_error:
2508 		tfd = ahci_pread(ap, AHCI_PREG_TFD);
2509 		serr = ahci_pread(ap, AHCI_PREG_SERR);
2510 
2511 		/*
2512 		 * Load the error slot and restart command processing.
2513 		 * CLO if we need to.  The error slot may not be valid.
2514 		 * MUST BE DONE BEFORE CLEARING ST!
2515 		 *
2516 		 * Cycle ST.
2517 		 *
2518 		 * It is unclear but we may have to clear SERR to reenable
2519 		 * error processing.
2520 		 */
2521 		err_slot = AHCI_PREG_CMD_CCS(ahci_pread(ap, AHCI_PREG_CMD));
2522 		ahci_pwrite(ap, AHCI_PREG_IS, AHCI_PREG_IS_TFES |
2523 					      AHCI_PREG_IS_PSS |
2524 					      AHCI_PREG_IS_DHRS |
2525 					      AHCI_PREG_IS_SDBS);
2526 		is &= ~(AHCI_PREG_IS_TFES | AHCI_PREG_IS_PSS |
2527 			AHCI_PREG_IS_DHRS | AHCI_PREG_IS_SDBS);
2528 		ahci_pwrite(ap, AHCI_PREG_SERR, serr);
2529 		ahci_port_stop(ap, 0);
2530 		ahci_os_hardsleep(10);
2531 		if (tfd & (AHCI_PREG_TFD_STS_BSY | AHCI_PREG_TFD_STS_DRQ)) {
2532 			kprintf("%s: Issuing CLO\n", PORTNAME(ap));
2533 			ahci_port_clo(ap);
2534 		}
2535 
2536 		/*
2537 		 * We are now stopped and need a restart.  If we have to
2538 		 * process a NCQ error we will temporarily start and then
2539 		 * stop the port again, so this condition holds.
2540 		 */
2541 		stopped = 1;
2542 		need = NEED_RESTART;
2543 
2544 		/*
2545 		 * ATAPI errors are fairly common from probing, just
2546 		 * report disk errors or if bootverbose is on.
2547 		 */
2548 		if (bootverbose || ap->ap_type != ATA_PORT_T_ATAPI) {
2549 			kprintf("%s: TFES slot %d ci_saved = %08x\n",
2550 				PORTNAME(ap), err_slot, ci_saved);
2551 		}
2552 
2553 		/*
2554 		 * If we got an error on an error CCB just complete it
2555 		 * with an error.  ci_saved has the mask to restart
2556 		 * (the err_ccb will be removed from it by finish_error).
2557 		 */
2558 		if (ap->ap_flags & AP_F_ERR_CCB_RESERVED) {
2559 			err_slot = ap->ap_err_ccb->ccb_slot;
2560 			goto finish_error;
2561 		}
2562 
2563 		/*
2564 		 * If NCQ commands were active get the error slot from
2565 		 * the log page.  NCQ is not supported for PM's so this
2566 		 * is a direct-attached target.
2567 		 *
2568 		 * Otherwise if no commands were active we have a problem.
2569 		 *
2570 		 * Otherwise if the error slot is bad we have a problem.
2571 		 *
2572 		 * Otherwise process the error for the slot.
2573 		 */
2574 		if (ap->ap_sactive) {
2575 			ahci_port_start(ap);
2576 			err_slot = ahci_port_read_ncq_error(ap, 0);
2577 			ahci_port_stop(ap, 0);
2578 		} else if (ap->ap_active == 0) {
2579 			kprintf("%s: TFES with no commands pending\n",
2580 				PORTNAME(ap));
2581 			err_slot = -1;
2582 		} else if (err_slot < 0 || err_slot >= ap->ap_sc->sc_ncmds) {
2583 			kprintf("%s: bad error slot %d\n",
2584 				PORTNAME(ap), err_slot);
2585 			err_slot = -1;
2586 		} else {
2587 			ccb = &ap->ap_ccbs[err_slot];
2588 
2589 			/*
2590 			 * Validate the errored ccb.  Note that ccb_at can
2591 			 * be NULL for direct-attached ccb's.
2592 			 *
2593 			 * Copy received taskfile data from the RFIS.
2594 			 */
2595 			if (ccb->ccb_xa.state == ATA_S_ONCHIP) {
2596 				ccb_at = ccb->ccb_xa.at;
2597 				memcpy(&ccb->ccb_xa.rfis, ap->ap_rfis->rfis,
2598 				       sizeof(struct ata_fis_d2h));
2599 				if (bootverbose) {
2600 					kprintf("%s: Copying rfis slot %d\n",
2601 						ATANAME(ap, ccb_at), err_slot);
2602 				}
2603 			} else {
2604 				kprintf("%s: Cannot copy rfis, CCB slot "
2605 					"%d is not on-chip (state=%d)\n",
2606 					ATANAME(ap, ccb->ccb_xa.at),
2607 					err_slot, ccb->ccb_xa.state);
2608 				err_slot = -1;
2609 			}
2610 		}
2611 
2612 		/*
2613 		 * If we could not determine the errored slot then
2614 		 * reset the port.
2615 		 */
2616 		if (err_slot < 0) {
2617 			kprintf("%s: TFES: Unable to determine errored slot\n",
2618 				PORTNAME(ap));
2619 			if (ap->ap_flags & AP_F_IN_RESET)
2620 				goto fatal;
2621 			goto failall;
2622 		}
2623 
2624 		/*
2625 		 * Finish error on slot.  We will restart ci_saved
2626 		 * commands except the errored slot which we generate
2627 		 * a failure for.
2628 		 */
2629 finish_error:
2630 		ccb = &ap->ap_ccbs[err_slot];
2631 		ci_saved &= ~(1 << err_slot);
2632 		KKASSERT(ccb->ccb_xa.state == ATA_S_ONCHIP);
2633 		ccb->ccb_xa.state = ATA_S_ERROR;
2634 	} else if (is & AHCI_PREG_IS_DHRS) {
2635 		/*
2636 		 * Command posted D2H register FIS to the rfis (non-blocking).
2637 		 *
2638 		 * A normal completion with an error may set DHRS instead
2639 		 * of TFES.  The CCS bits are only valid if ERR was set.
2640 		 * If ERR is set command processing was probably stopped.
2641 		 *
2642 		 * If ERR was not set we can only copy-back data for
2643 		 * exclusive-mode commands because otherwise we won't know
2644 		 * which tag the rfis belonged to.
2645 		 *
2646 		 * err_slot must be read from the CCS before any other port
2647 		 * action, such as stopping the port.
2648 		 *
2649 		 * WARNING!	This is not well documented in the AHCI spec.
2650 		 *		It can be found in the state machine tables
2651 		 *		but not in the explanations.
2652 		 */
2653 		u_int32_t tfd;
2654 		u_int32_t cmd;
2655 		int err_slot;
2656 
2657 		tfd = ahci_pread(ap, AHCI_PREG_TFD);
2658 		cmd = ahci_pread(ap, AHCI_PREG_CMD);
2659 
2660 		ahci_pwrite(ap, AHCI_PREG_IS, AHCI_PREG_IS_DHRS);
2661 		if ((tfd & AHCI_PREG_TFD_STS_ERR) &&
2662 		    (cmd & AHCI_PREG_CMD_CR) == 0) {
2663 			err_slot = AHCI_PREG_CMD_CCS(
2664 						ahci_pread(ap, AHCI_PREG_CMD));
2665 			ccb = &ap->ap_ccbs[err_slot];
2666 			kprintf("%s: DHRS tfd=%b err_slot=%d cmd=%02x\n",
2667 				PORTNAME(ap),
2668 				tfd, AHCI_PFMT_TFD_STS,
2669 				err_slot, ccb->ccb_xa.fis->command);
2670 			goto process_error;
2671 		}
2672 		/*
2673 		 * NO ELSE... copy back is in the normal command completion
2674 		 * code and only if no error occured and ATA_F_AUTOSENSE
2675 		 * was set.
2676 		 */
2677 	}
2678 
2679 	/*
2680 	 * Device notification to us (non-blocking)
2681 	 *
2682 	 * NOTE!  On some parts notification bits can cause an IPMS
2683 	 *	  interrupt instead of a SDBS interrupt.
2684 	 *
2685 	 * NOTE!  On some parts (e.g. VBOX, probably intel ICHx),
2686 	 *	  SDBS notifies us of the completion of a NCQ command
2687 	 *	  and DBS does not.
2688 	 */
2689 	if (is & (AHCI_PREG_IS_SDBS | AHCI_PREG_IS_IPMS)) {
2690 		u_int32_t data;
2691 
2692 		ahci_pwrite(ap, AHCI_PREG_IS,
2693 				AHCI_PREG_IS_SDBS | AHCI_PREG_IS_IPMS);
2694 		if (sc->sc_cap & AHCI_REG_CAP_SSNTF) {
2695 			data = ahci_pread(ap, AHCI_PREG_SNTF);
2696 			if (data) {
2697 				ahci_pwrite(ap, AHCI_PREG_IS,
2698 						AHCI_PREG_IS_SDBS);
2699 				kprintf("%s: NOTIFY %08x\n",
2700 					PORTNAME(ap), data);
2701 				ahci_pwrite(ap, AHCI_PREG_SERR,
2702 						AHCI_PREG_SERR_DIAG_N);
2703 				ahci_pwrite(ap, AHCI_PREG_SNTF, data);
2704 				ahci_cam_changed(ap, NULL, -1);
2705 			}
2706 		}
2707 		is &= ~(AHCI_PREG_IS_SDBS | AHCI_PREG_IS_IPMS);
2708 	}
2709 
2710 	/*
2711 	 * Spurious IFS errors (blockable) - when AP_F_IGNORE_IFS is set.
2712 	 *
2713 	 * Spurious IFS errors can occur while we are doing a reset
2714 	 * sequence through a PM, probably due to an unexpected FIS
2715 	 * being received during the PM target reset sequence.  Chipsets
2716 	 * are supposed to mask these events but some do not.
2717 	 *
2718 	 * Try to recover from the condition.
2719 	 */
2720 	if ((is & AHCI_PREG_IS_IFS) && (ap->ap_flags & AP_F_IGNORE_IFS)) {
2721 		u_int32_t serr = ahci_pread(ap, AHCI_PREG_SERR);
2722 		if ((ap->ap_flags & AP_F_IFS_IGNORED) == 0) {
2723 			kprintf("%s: IFS during PM probe (ignored) "
2724 				"IS=%b, SERR=%b\n",
2725 				PORTNAME(ap),
2726 				is, AHCI_PFMT_IS,
2727 				serr, AHCI_PFMT_SERR);
2728 			ap->ap_flags |= AP_F_IFS_IGNORED;
2729 		}
2730 
2731 		/*
2732 		 * Try to clear the error condition.  The IFS error killed
2733 		 * the port so stop it so we can restart it.
2734 		 */
2735 		ahci_pwrite(ap, AHCI_PREG_IS, AHCI_PREG_IS_IFS);
2736 		ahci_pwrite(ap, AHCI_PREG_SERR, -1);
2737 		is &= ~AHCI_PREG_IS_IFS;
2738 		need = NEED_RESTART;
2739 		goto failall;
2740 	}
2741 
2742 	/*
2743 	 * Port change (hot-plug) (blockable).
2744 	 *
2745 	 * A PRCS interrupt can occur:
2746 	 *	(1) On hot-unplug / normal-unplug (phy lost)
2747 	 *	(2) Sometimes on hot-plug too.
2748 	 *
2749 	 * A PCS interrupt can occur in a number of situations:
2750 	 *	(1) On hot-plug once communication is established
2751 	 *	(2) On hot-unplug sometimes.
2752 	 *	(3) For chipsets with badly written firmware it can occur
2753 	 *	    during INIT/RESET sequences due to the device reset.
2754 	 *	(4) For chipsets with badly written firmware it can occur
2755 	 *	    when it thinks an unsolicited COMRESET is received
2756 	 *	    during a INIT/RESET sequence, even though we actually
2757 	 *	    did request it.
2758 	 *
2759 	 * XXX We can then check the CPS (Cold Presence State) bit, if
2760 	 * supported, to determine if a device is plugged in or not and do
2761 	 * the right thing.
2762 	 *
2763 	 * PCS interrupts are cleared by clearing DIAG_X.  If this occurs
2764 	 * command processing is automatically stopped (CR goes inactive)
2765 	 * and the port must be stopped and restarted.
2766 	 *
2767 	 * WARNING: AMD parts (e.g. 880G chipset, probably others) can
2768 	 *	    generate PCS on initialization even when device is
2769 	 *	    already connected up.  It is unclear why this happens.
2770 	 *	    Depending on the state of the device detect this can
2771 	 *	    cause us to go into harsh reinit or hot-plug insertion
2772 	 *	    mode.
2773 	 *
2774 	 * WARNING: PCS errors can be repetitive (e.g. unsolicited COMRESET
2775 	 *	    continues to flow in from the device), we must clear the
2776 	 *	    interrupt in all cases and enforce a delay to prevent
2777 	 *	    a livelock and give the port time to settle down.
2778 	 *	    Only print something if we aren't in INIT/HARD-RESET.
2779 	 */
2780 	if (is & (AHCI_PREG_IS_PCS | AHCI_PREG_IS_PRCS)) {
2781 		ahci_pwrite(ap, AHCI_PREG_IS,
2782 			    is & (AHCI_PREG_IS_PCS | AHCI_PREG_IS_PRCS));
2783 		/*
2784 		 * Try to clear the error.  Because of the repetitiveness
2785 		 * of this interrupt avoid any harsh action if the port is
2786 		 * already in the init or hard-reset probe state.
2787 		 */
2788 		ahci_pwrite(ap, AHCI_PREG_SERR, -1);
2789 		/* (AHCI_PREG_SERR_DIAG_N | AHCI_PREG_SERR_DIAG_X) */
2790 
2791 		/*
2792 		 * Ignore PCS/PRCS errors during probes (but still clear the
2793 		 * interrupt to avoid a livelock).  The AMD 880/890/SB850
2794 		 * chipsets do not mask PCS/PRCS internally during reset
2795 		 * sequences.
2796 		 */
2797 		if (ap->ap_flags & AP_F_IN_RESET)
2798 			goto skip_pcs;
2799 
2800 		if (ap->ap_probe == ATA_PROBE_NEED_INIT ||
2801 		    ap->ap_probe == ATA_PROBE_NEED_HARD_RESET) {
2802 			is &= ~(AHCI_PREG_IS_PCS | AHCI_PREG_IS_PRCS);
2803 			need = NEED_NOTHING;
2804 			ahci_os_sleep(1000);
2805 			goto failall;
2806 		}
2807 		kprintf("%s: Transient Errors: %b (%d)\n",
2808 			PORTNAME(ap), is, AHCI_PFMT_IS, ap->ap_probe);
2809 		is &= ~(AHCI_PREG_IS_PCS | AHCI_PREG_IS_PRCS);
2810 		ahci_os_sleep(200);
2811 
2812 		/*
2813 		 * Stop the port and figure out what to do next.
2814 		 */
2815 		ahci_port_stop(ap, 0);
2816 		stopped = 1;
2817 
2818 		switch (ahci_pread(ap, AHCI_PREG_SSTS) & AHCI_PREG_SSTS_DET) {
2819 		case AHCI_PREG_SSTS_DET_DEV:
2820 			/*
2821 			 * Device detect
2822 			 */
2823 			if (ap->ap_probe == ATA_PROBE_FAILED) {
2824 				need = NEED_HOTPLUG_INSERT;
2825 				goto fatal;
2826 			}
2827 			need = NEED_RESTART;
2828 			break;
2829 		case AHCI_PREG_SSTS_DET_DEV_NE:
2830 			/*
2831 			 * Device not communicating.  AMD parts seem to
2832 			 * like to throw this error on initialization
2833 			 * for no reason that I can fathom.
2834 			 */
2835 			kprintf("%s: Device present but not communicating, "
2836 				"attempting port restart\n",
2837 				PORTNAME(ap));
2838 			need = NEED_REINIT;
2839 			goto fatal;
2840 		default:
2841 			if (ap->ap_probe != ATA_PROBE_FAILED) {
2842 				need = NEED_HOTPLUG_REMOVE;
2843 				goto fatal;
2844 			}
2845 			need = NEED_RESTART;
2846 			break;
2847 		}
2848 skip_pcs:
2849 		;
2850 	}
2851 
2852 	/*
2853 	 * Check for remaining errors - they are fatal. (blockable)
2854 	 */
2855 	if (is & (AHCI_PREG_IS_TFES | AHCI_PREG_IS_HBFS | AHCI_PREG_IS_IFS |
2856 		  AHCI_PREG_IS_OFS | AHCI_PREG_IS_UFS)) {
2857 		u_int32_t serr;
2858 
2859 		ahci_pwrite(ap, AHCI_PREG_IS,
2860 			    is & (AHCI_PREG_IS_TFES | AHCI_PREG_IS_HBFS |
2861 				  AHCI_PREG_IS_IFS | AHCI_PREG_IS_OFS |
2862 				  AHCI_PREG_IS_UFS));
2863 		serr = ahci_pread(ap, AHCI_PREG_SERR);
2864 		kprintf("%s: Unrecoverable errors (IS: %b, SERR: %b), "
2865 			"disabling port.\n",
2866 			PORTNAME(ap),
2867 			is, AHCI_PFMT_IS,
2868 			serr, AHCI_PFMT_SERR
2869 		);
2870 		is &= ~(AHCI_PREG_IS_TFES | AHCI_PREG_IS_HBFS |
2871 			AHCI_PREG_IS_IFS | AHCI_PREG_IS_OFS |
2872 		        AHCI_PREG_IS_UFS);
2873 
2874 		/*
2875 		 * Fail all commands but then what?  For now try to
2876 		 * reinitialize the port.
2877 		 */
2878 		need = NEED_REINIT;
2879 		goto fatal;
2880 	}
2881 
2882 	/*
2883 	 * Fail all outstanding commands if we know the port won't recover.
2884 	 *
2885 	 * We may have a ccb_at if the failed command is known and was
2886 	 * being sent to a device over a port multiplier (PM).  In this
2887 	 * case if the port itself has not completely failed we fail just
2888 	 * the commands related to that target.
2889 	 *
2890 	 * ci_saved contains the mask of active commands as of when the
2891 	 * error occured, prior to any port stops.
2892 	 */
2893 	if (ap->ap_state == AP_S_FATAL_ERROR) {
2894 fatal:
2895 		ap->ap_state = AP_S_FATAL_ERROR;
2896 failall:
2897 		ahci_port_stop(ap, 0);
2898 		stopped = 1;
2899 
2900 		/*
2901 		 * Error all the active slots not already errored.
2902 		 */
2903 		ci_masked = ci_saved & *active & ~ap->ap_expired;
2904 		if (ci_masked) {
2905 			kprintf("%s: Failing all commands: %08x\n",
2906 				PORTNAME(ap), ci_masked);
2907 		}
2908 
2909 		while (ci_masked) {
2910 			slot = ffs(ci_masked) - 1;
2911 			ccb = &ap->ap_ccbs[slot];
2912 			ccb->ccb_xa.state = ATA_S_TIMEOUT;
2913 			ap->ap_expired |= 1 << slot;
2914 			ci_saved &= ~(1 << slot);
2915 			ci_masked &= ~(1 << slot);
2916 		}
2917 
2918 		/*
2919 		 * Clear bits in ci_saved (cause completions to be run)
2920 		 * for all slots which are not active.
2921 		 */
2922 		ci_saved &= ~*active;
2923 
2924 		/*
2925 		 * Don't restart the port if our problems were deemed fatal.
2926 		 *
2927 		 * Also acknowlege all fatal interrupt sources to prevent
2928 		 * a livelock.
2929 		 */
2930 		if (ap->ap_state == AP_S_FATAL_ERROR) {
2931 			if (need == NEED_RESTART)
2932 				need = NEED_NOTHING;
2933 			ahci_pwrite(ap, AHCI_PREG_IS,
2934 				    AHCI_PREG_IS_TFES | AHCI_PREG_IS_HBFS |
2935 				    AHCI_PREG_IS_IFS | AHCI_PREG_IS_OFS |
2936 				    AHCI_PREG_IS_UFS);
2937 		}
2938 	}
2939 
2940 	/*
2941 	 * If we are stopped the AHCI chipset is supposed to have cleared
2942 	 * CI and SACT.  Did it?  If it didn't we try very hard to clear
2943 	 * the fields otherwise we may end up completing CCBs which are
2944 	 * actually still active.
2945 	 *
2946 	 * IFS errors on (at least) AMD chipsets create this confusion.
2947 	 */
2948 	if (stopped) {
2949 		u_int32_t mask;
2950 		if ((mask = ahci_pactive(ap)) != 0) {
2951 			kprintf("%s: chipset failed to clear "
2952 				"active cmds %08x\n",
2953 				PORTNAME(ap), mask);
2954 			ahci_port_start(ap);
2955 			ahci_port_stop(ap, 0);
2956 			if ((mask = ahci_pactive(ap)) != 0) {
2957 				kprintf("%s: unable to prod the chip into "
2958 					"clearing active cmds %08x\n",
2959 					PORTNAME(ap), mask);
2960 				/* what do we do now? */
2961 			}
2962 		}
2963 	}
2964 
2965 	/*
2966 	 * CCB completion (non blocking).
2967 	 *
2968 	 * CCB completion is detected by noticing its slot's bit in CI has
2969 	 * changed to zero some time after we activated it.
2970 	 * If we are polling, we may only be interested in particular slot(s).
2971 	 *
2972 	 * Any active bits not saved are completed within the restrictions
2973 	 * imposed by the caller.
2974 	 */
2975 	ci_masked = ~ci_saved & *active;
2976 	while (ci_masked) {
2977 		slot = ffs(ci_masked) - 1;
2978 		ccb = &ap->ap_ccbs[slot];
2979 		ci_masked &= ~(1 << slot);
2980 
2981 		DPRINTF(AHCI_D_INTR, "%s: slot %d is complete%s\n",
2982 		    PORTNAME(ap), slot, ccb->ccb_xa.state == ATA_S_ERROR ?
2983 		    " (error)" : "");
2984 
2985 		bus_dmamap_sync(sc->sc_tag_cmdh,
2986 				AHCI_DMA_MAP(ap->ap_dmamem_cmd_list),
2987 				BUS_DMASYNC_POSTWRITE);
2988 
2989 		bus_dmamap_sync(sc->sc_tag_cmdt,
2990 				AHCI_DMA_MAP(ap->ap_dmamem_cmd_table),
2991 				BUS_DMASYNC_POSTWRITE);
2992 
2993 		bus_dmamap_sync(sc->sc_tag_rfis,
2994 				AHCI_DMA_MAP(ap->ap_dmamem_rfis),
2995 				BUS_DMASYNC_POSTREAD);
2996 
2997 		*active &= ~(1 << ccb->ccb_slot);
2998 		if (active == &ap->ap_active) {
2999 			KKASSERT(ap->ap_active_cnt > 0);
3000 			--ap->ap_active_cnt;
3001 		}
3002 
3003 		/*
3004 		 * Complete the ccb.  If the ccb was marked expired it
3005 		 * was probably already removed from the command processor,
3006 		 * so don't take the clear ci_saved bit as meaning the
3007 		 * command actually succeeded, it didn't.
3008 		 */
3009 		if (ap->ap_expired & (1 << ccb->ccb_slot)) {
3010 			ap->ap_expired &= ~(1 << ccb->ccb_slot);
3011 			ccb->ccb_xa.state = ATA_S_TIMEOUT;
3012 			ccb->ccb_done(ccb);
3013 			ccb->ccb_xa.complete(&ccb->ccb_xa);
3014 		} else {
3015 			if (ccb->ccb_xa.state == ATA_S_ONCHIP) {
3016 				ccb->ccb_xa.state = ATA_S_COMPLETE;
3017 				if (ccb->ccb_xa.flags & ATA_F_AUTOSENSE) {
3018 					memcpy(&ccb->ccb_xa.rfis,
3019 					    ap->ap_rfis->rfis,
3020 					    sizeof(struct ata_fis_d2h));
3021 					if (ccb->ccb_xa.state == ATA_S_TIMEOUT)
3022 						ccb->ccb_xa.state = ATA_S_ERROR;
3023 				}
3024 			}
3025 			ccb->ccb_done(ccb);
3026 		}
3027 	}
3028 
3029 	/*
3030 	 * Cleanup.  Will not be set if non-blocking.
3031 	 */
3032 	switch(need) {
3033 	case NEED_NOTHING:
3034 		/*
3035 		 * If operating normally and not stopped the interrupt was
3036 		 * probably just a normal completion and we may be able to
3037 		 * issue more commands.
3038 		 */
3039 		if (stopped == 0 && ap->ap_state != AP_S_FATAL_ERROR)
3040 			ahci_issue_pending_commands(ap, NULL);
3041 		break;
3042 	case NEED_RESTART:
3043 		/*
3044 		 * A recoverable error occured and we can restart outstanding
3045 		 * commands on the port.
3046 		 */
3047 		ci_saved &= ~ap->ap_expired;
3048 		if (ci_saved) {
3049 			kprintf("%s: Restart %08x\n", PORTNAME(ap), ci_saved);
3050 			ahci_issue_saved_commands(ap, ci_saved);
3051 		}
3052 
3053 		/*
3054 		 * Potentially issue new commands if not in a failed
3055 		 * state.
3056 		 */
3057 		if (ap->ap_state != AP_S_FATAL_ERROR) {
3058 			ahci_port_start(ap);
3059 			ahci_issue_pending_commands(ap, NULL);
3060 		}
3061 		break;
3062 	case NEED_REINIT:
3063 		/*
3064 		 * Something horrible happened to the port and we
3065 		 * need to reinitialize it.
3066 		 */
3067 		kprintf("%s: REINIT - Attempting to reinitialize the port "
3068 			"after it had a horrible accident\n",
3069 			PORTNAME(ap));
3070 		ap->ap_flags |= AP_F_IN_RESET;
3071 		ap->ap_flags |= AP_F_HARSH_REINIT;
3072 		ap->ap_probe = ATA_PROBE_NEED_INIT;
3073 		ahci_cam_changed(ap, NULL, -1);
3074 		break;
3075 	case NEED_HOTPLUG_INSERT:
3076 		/*
3077 		 * A hot-plug insertion event has occured and all
3078 		 * outstanding commands have already been revoked.
3079 		 *
3080 		 * Don't recurse if this occurs while we are
3081 		 * resetting the port.
3082 		 */
3083 		if ((ap->ap_flags & AP_F_IN_RESET) == 0) {
3084 			kprintf("%s: HOTPLUG - Device inserted\n",
3085 				PORTNAME(ap));
3086 			ap->ap_probe = ATA_PROBE_NEED_INIT;
3087 			ahci_cam_changed(ap, NULL, -1);
3088 		}
3089 		break;
3090 	case NEED_HOTPLUG_REMOVE:
3091 		/*
3092 		 * A hot-plug removal event has occured and all
3093 		 * outstanding commands have already been revoked.
3094 		 *
3095 		 * Don't recurse if this occurs while we are
3096 		 * resetting the port.
3097 		 */
3098 		if ((ap->ap_flags & AP_F_IN_RESET) == 0) {
3099 			kprintf("%s: HOTPLUG - Device removed\n",
3100 				PORTNAME(ap));
3101 			ahci_port_hardstop(ap);
3102 			/* ap_probe set to failed */
3103 			ahci_cam_changed(ap, NULL, -1);
3104 		}
3105 		break;
3106 	default:
3107 		break;
3108 	}
3109 }
3110 
3111 struct ahci_ccb *
3112 ahci_get_ccb(struct ahci_port *ap)
3113 {
3114 	struct ahci_ccb			*ccb;
3115 
3116 	lockmgr(&ap->ap_ccb_lock, LK_EXCLUSIVE);
3117 	ccb = TAILQ_FIRST(&ap->ap_ccb_free);
3118 	if (ccb != NULL) {
3119 		KKASSERT((ap->ap_sactive & (1 << ccb->ccb_slot)) == 0);
3120 		KKASSERT(ccb->ccb_xa.state == ATA_S_PUT);
3121 		TAILQ_REMOVE(&ap->ap_ccb_free, ccb, ccb_entry);
3122 		ccb->ccb_xa.state = ATA_S_SETUP;
3123 		ccb->ccb_xa.flags = 0;
3124 		ccb->ccb_xa.at = NULL;
3125 	}
3126 	lockmgr(&ap->ap_ccb_lock, LK_RELEASE);
3127 
3128 	return (ccb);
3129 }
3130 
3131 void
3132 ahci_put_ccb(struct ahci_ccb *ccb)
3133 {
3134 	struct ahci_port		*ap = ccb->ccb_port;
3135 
3136 	KKASSERT(ccb->ccb_xa.state != ATA_S_PUT);
3137 	KKASSERT((ap->ap_sactive & (1 << ccb->ccb_slot)) == 0);
3138 	lockmgr(&ap->ap_ccb_lock, LK_EXCLUSIVE);
3139 	ccb->ccb_xa.state = ATA_S_PUT;
3140 	++ccb->ccb_xa.serial;
3141 	TAILQ_INSERT_TAIL(&ap->ap_ccb_free, ccb, ccb_entry);
3142 	lockmgr(&ap->ap_ccb_lock, LK_RELEASE);
3143 }
3144 
3145 struct ahci_ccb *
3146 ahci_get_err_ccb(struct ahci_port *ap)
3147 {
3148 	struct ahci_ccb *err_ccb;
3149 	u_int32_t sact;
3150 	u_int32_t ci;
3151 
3152 	/* No commands may be active on the chip. */
3153 
3154 	if (ap->ap_sc->sc_cap & AHCI_REG_CAP_SNCQ) {
3155 		sact = ahci_pread(ap, AHCI_PREG_SACT);
3156 		if (sact != 0) {
3157 			kprintf("%s: ahci_get_err_ccb but SACT %08x != 0?\n",
3158 				PORTNAME(ap), sact);
3159 		}
3160 	}
3161 	ci = ahci_pread(ap, AHCI_PREG_CI);
3162 	if (ci) {
3163 		kprintf("%s: ahci_get_err_ccb: ci not 0 (%08x)\n",
3164 			ap->ap_name, ci);
3165 	}
3166 	KKASSERT(ci == 0);
3167 	KKASSERT((ap->ap_flags & AP_F_ERR_CCB_RESERVED) == 0);
3168 	ap->ap_flags |= AP_F_ERR_CCB_RESERVED;
3169 
3170 	/* Save outstanding command state. */
3171 	ap->ap_err_saved_active = ap->ap_active;
3172 	ap->ap_err_saved_active_cnt = ap->ap_active_cnt;
3173 	ap->ap_err_saved_sactive = ap->ap_sactive;
3174 
3175 	/*
3176 	 * Pretend we have no commands outstanding, so that completions won't
3177 	 * run prematurely.
3178 	 */
3179 	ap->ap_active = ap->ap_active_cnt = ap->ap_sactive = 0;
3180 
3181 	/*
3182 	 * Grab a CCB to use for error recovery.  This should never fail, as
3183 	 * we ask atascsi to reserve one for us at init time.
3184 	 */
3185 	err_ccb = ap->ap_err_ccb;
3186 	KKASSERT(err_ccb != NULL);
3187 	err_ccb->ccb_xa.flags = 0;
3188 	err_ccb->ccb_done = ahci_empty_done;
3189 
3190 	return err_ccb;
3191 }
3192 
3193 void
3194 ahci_put_err_ccb(struct ahci_ccb *ccb)
3195 {
3196 	struct ahci_port *ap = ccb->ccb_port;
3197 	u_int32_t sact;
3198 	u_int32_t ci;
3199 
3200 	KKASSERT((ap->ap_flags & AP_F_ERR_CCB_RESERVED) != 0);
3201 
3202 	/*
3203 	 * No commands may be active on the chip
3204 	 */
3205 	if (ap->ap_sc->sc_cap & AHCI_REG_CAP_SNCQ) {
3206 		sact = ahci_pread(ap, AHCI_PREG_SACT);
3207 		if (sact) {
3208 			panic("ahci_port_err_ccb(%d) but SACT %08x != 0",
3209 			      ccb->ccb_slot, sact);
3210 		}
3211 	}
3212 	ci = ahci_pread(ap, AHCI_PREG_CI);
3213 	if (ci) {
3214 		panic("ahci_put_err_ccb(%d) but CI %08x != 0 "
3215 		      "(act=%08x sact=%08x)\n",
3216 		      ccb->ccb_slot, ci,
3217 		      ap->ap_active, ap->ap_sactive);
3218 	}
3219 
3220 	KKASSERT(ccb == ap->ap_err_ccb);
3221 
3222 	/* Restore outstanding command state */
3223 	ap->ap_sactive = ap->ap_err_saved_sactive;
3224 	ap->ap_active_cnt = ap->ap_err_saved_active_cnt;
3225 	ap->ap_active = ap->ap_err_saved_active;
3226 
3227 	ap->ap_flags &= ~AP_F_ERR_CCB_RESERVED;
3228 }
3229 
3230 /*
3231  * Read log page to get NCQ error.
3232  *
3233  * NOTE: NCQ not currently supported on port multipliers. XXX
3234  */
3235 int
3236 ahci_port_read_ncq_error(struct ahci_port *ap, int target)
3237 {
3238 	struct ata_log_page_10h	*log;
3239 	struct ahci_ccb		*ccb;
3240 	struct ahci_ccb		*ccb2;
3241 	struct ahci_cmd_hdr	*cmd_slot;
3242 	struct ata_fis_h2d	*fis;
3243 	int			err_slot;
3244 
3245 	if (bootverbose) {
3246 		kprintf("%s: READ LOG PAGE target %d\n", PORTNAME(ap),
3247 			target);
3248 	}
3249 
3250 	/*
3251 	 * Prep error CCB for READ LOG EXT, page 10h, 1 sector.
3252 	 *
3253 	 * Getting err_ccb clears active/sactive/active_cnt, putting
3254 	 * it back restores the fields.
3255 	 */
3256 	ccb = ahci_get_err_ccb(ap);
3257 	ccb->ccb_xa.flags = ATA_F_READ | ATA_F_POLL;
3258 	ccb->ccb_xa.data = ap->ap_err_scratch;
3259 	ccb->ccb_xa.datalen = 512;
3260 	ccb->ccb_xa.complete = ahci_dummy_done;
3261 	ccb->ccb_xa.at = ap->ap_ata[target];
3262 
3263 	fis = (struct ata_fis_h2d *)ccb->ccb_cmd_table->cfis;
3264 	bzero(fis, sizeof(*fis));
3265 	fis->type = ATA_FIS_TYPE_H2D;
3266 	fis->flags = ATA_H2D_FLAGS_CMD | target;
3267 	fis->command = ATA_C_READ_LOG_EXT;
3268 	fis->lba_low = 0x10;		/* queued error log page (10h) */
3269 	fis->sector_count = 1;		/* number of sectors (1) */
3270 	fis->sector_count_exp = 0;
3271 	fis->lba_mid = 0;		/* starting offset */
3272 	fis->lba_mid_exp = 0;
3273 	fis->device = 0;
3274 
3275 	cmd_slot = ccb->ccb_cmd_hdr;
3276 	cmd_slot->flags = htole16(5);	/* FIS length: 5 DWORDS */
3277 
3278 	if (ahci_load_prdt(ccb) != 0) {
3279 		err_slot = -1;
3280 		goto err;
3281 	}
3282 
3283 	ccb->ccb_xa.state = ATA_S_PENDING;
3284 	if (ahci_poll(ccb, 1000, ahci_quick_timeout) != ATA_S_COMPLETE) {
3285 		err_slot = -1;
3286 		ahci_unload_prdt(ccb);
3287 		goto err;
3288 	}
3289 	ahci_unload_prdt(ccb);
3290 
3291 	/*
3292 	 * Success, extract failed register set and tags from the scratch
3293 	 * space.
3294 	 */
3295 	log = (struct ata_log_page_10h *)ap->ap_err_scratch;
3296 	if (log->err_regs.type & ATA_LOG_10H_TYPE_NOTQUEUED) {
3297 		/* Not queued bit was set - wasn't an NCQ error? */
3298 		kprintf("%s: read NCQ error page, but not an NCQ error?\n",
3299 			PORTNAME(ap));
3300 		err_slot = -1;
3301 	} else {
3302 		/* Copy back the log record as a D2H register FIS. */
3303 		err_slot = log->err_regs.type & ATA_LOG_10H_TYPE_TAG_MASK;
3304 
3305 		ccb2 = &ap->ap_ccbs[err_slot];
3306 		if (ccb2->ccb_xa.state == ATA_S_ONCHIP) {
3307 			kprintf("%s: read NCQ error page slot=%d\n",
3308 				ATANAME(ap, ccb2->ccb_xa.at),
3309 				err_slot);
3310 			memcpy(&ccb2->ccb_xa.rfis, &log->err_regs,
3311 				sizeof(struct ata_fis_d2h));
3312 			ccb2->ccb_xa.rfis.type = ATA_FIS_TYPE_D2H;
3313 			ccb2->ccb_xa.rfis.flags = 0;
3314 		} else {
3315 			kprintf("%s: read NCQ error page slot=%d, "
3316 				"slot does not match any cmds\n",
3317 				ATANAME(ccb2->ccb_port, ccb2->ccb_xa.at),
3318 				err_slot);
3319 			err_slot = -1;
3320 		}
3321 	}
3322 err:
3323 	ahci_put_err_ccb(ccb);
3324 	kprintf("%s: DONE log page target %d err_slot=%d\n",
3325 		PORTNAME(ap), target, err_slot);
3326 	return (err_slot);
3327 }
3328 
3329 /*
3330  * Allocate memory for various structures DMAd by hardware.  The maximum
3331  * number of segments for these tags is 1 so the DMA memory will have a
3332  * single physical base address.
3333  */
3334 struct ahci_dmamem *
3335 ahci_dmamem_alloc(struct ahci_softc *sc, bus_dma_tag_t tag)
3336 {
3337 	struct ahci_dmamem *adm;
3338 	int	error;
3339 
3340 	adm = kmalloc(sizeof(*adm), M_DEVBUF, M_INTWAIT | M_ZERO);
3341 
3342 	error = bus_dmamem_alloc(tag, (void **)&adm->adm_kva,
3343 				 BUS_DMA_ZERO, &adm->adm_map);
3344 	if (error == 0) {
3345 		adm->adm_tag = tag;
3346 		error = bus_dmamap_load(tag, adm->adm_map,
3347 					adm->adm_kva,
3348 					bus_dma_tag_getmaxsize(tag),
3349 					ahci_dmamem_saveseg, &adm->adm_busaddr,
3350 					0);
3351 	}
3352 	if (error) {
3353 		if (adm->adm_map) {
3354 			bus_dmamap_destroy(tag, adm->adm_map);
3355 			adm->adm_map = NULL;
3356 			adm->adm_tag = NULL;
3357 			adm->adm_kva = NULL;
3358 		}
3359 		kfree(adm, M_DEVBUF);
3360 		adm = NULL;
3361 	}
3362 	return (adm);
3363 }
3364 
3365 static
3366 void
3367 ahci_dmamem_saveseg(void *info, bus_dma_segment_t *segs, int nsegs, int error)
3368 {
3369 	KKASSERT(error == 0);
3370 	KKASSERT(nsegs == 1);
3371 	*(bus_addr_t *)info = segs->ds_addr;
3372 }
3373 
3374 
3375 void
3376 ahci_dmamem_free(struct ahci_softc *sc, struct ahci_dmamem *adm)
3377 {
3378 	if (adm->adm_map) {
3379 		bus_dmamap_unload(adm->adm_tag, adm->adm_map);
3380 		bus_dmamap_destroy(adm->adm_tag, adm->adm_map);
3381 		adm->adm_map = NULL;
3382 		adm->adm_tag = NULL;
3383 		adm->adm_kva = NULL;
3384 	}
3385 	kfree(adm, M_DEVBUF);
3386 }
3387 
3388 u_int32_t
3389 ahci_read(struct ahci_softc *sc, bus_size_t r)
3390 {
3391 	bus_space_barrier(sc->sc_iot, sc->sc_ioh, r, 4,
3392 			  BUS_SPACE_BARRIER_READ);
3393 	return (bus_space_read_4(sc->sc_iot, sc->sc_ioh, r));
3394 }
3395 
3396 void
3397 ahci_write(struct ahci_softc *sc, bus_size_t r, u_int32_t v)
3398 {
3399 	bus_space_write_4(sc->sc_iot, sc->sc_ioh, r, v);
3400 	bus_space_barrier(sc->sc_iot, sc->sc_ioh, r, 4,
3401 			  BUS_SPACE_BARRIER_WRITE);
3402 }
3403 
3404 u_int32_t
3405 ahci_pread(struct ahci_port *ap, bus_size_t r)
3406 {
3407 	bus_space_barrier(ap->ap_sc->sc_iot, ap->ap_ioh, r, 4,
3408 			  BUS_SPACE_BARRIER_READ);
3409 	return (bus_space_read_4(ap->ap_sc->sc_iot, ap->ap_ioh, r));
3410 }
3411 
3412 void
3413 ahci_pwrite(struct ahci_port *ap, bus_size_t r, u_int32_t v)
3414 {
3415 	bus_space_write_4(ap->ap_sc->sc_iot, ap->ap_ioh, r, v);
3416 	bus_space_barrier(ap->ap_sc->sc_iot, ap->ap_ioh, r, 4,
3417 			  BUS_SPACE_BARRIER_WRITE);
3418 }
3419 
3420 /*
3421  * Wait up to (timeout) milliseconds for the masked port register to
3422  * match the target.
3423  *
3424  * Timeout is in milliseconds.
3425  */
3426 int
3427 ahci_pwait_eq(struct ahci_port *ap, int timeout,
3428 	      bus_size_t r, u_int32_t mask, u_int32_t target)
3429 {
3430 	int	t;
3431 
3432 	/*
3433 	 * Loop hard up to 100uS
3434 	 */
3435 	for (t = 0; t < 100; ++t) {
3436 		if ((ahci_pread(ap, r) & mask) == target)
3437 			return (0);
3438 		ahci_os_hardsleep(1);	/* us */
3439 	}
3440 
3441 	do {
3442 		timeout -= ahci_os_softsleep();
3443 		if ((ahci_pread(ap, r) & mask) == target)
3444 			return (0);
3445 	} while (timeout > 0);
3446 	return (1);
3447 }
3448 
3449 int
3450 ahci_wait_ne(struct ahci_softc *sc, bus_size_t r, u_int32_t mask,
3451 	     u_int32_t target)
3452 {
3453 	int	t;
3454 
3455 	/*
3456 	 * Loop hard up to 100uS
3457 	 */
3458 	for (t = 0; t < 100; ++t) {
3459 		if ((ahci_read(sc, r) & mask) != target)
3460 			return (0);
3461 		ahci_os_hardsleep(1);	/* us */
3462 	}
3463 
3464 	/*
3465 	 * And one millisecond the slow way
3466 	 */
3467 	t = 1000;
3468 	do {
3469 		t -= ahci_os_softsleep();
3470 		if ((ahci_read(sc, r) & mask) != target)
3471 			return (0);
3472 	} while (t > 0);
3473 
3474 	return (1);
3475 }
3476 
3477 
3478 /*
3479  * Acquire an ata transfer.
3480  *
3481  * Pass a NULL at for direct-attached transfers, and a non-NULL at for
3482  * targets that go through the port multiplier.
3483  */
3484 struct ata_xfer *
3485 ahci_ata_get_xfer(struct ahci_port *ap, struct ata_port *at)
3486 {
3487 	struct ahci_ccb		*ccb;
3488 
3489 	ccb = ahci_get_ccb(ap);
3490 	if (ccb == NULL) {
3491 		DPRINTF(AHCI_D_XFER, "%s: ahci_ata_get_xfer: NULL ccb\n",
3492 		    PORTNAME(ap));
3493 		return (NULL);
3494 	}
3495 
3496 	DPRINTF(AHCI_D_XFER, "%s: ahci_ata_get_xfer got slot %d\n",
3497 	    PORTNAME(ap), ccb->ccb_slot);
3498 
3499 	bzero(ccb->ccb_xa.fis, sizeof(*ccb->ccb_xa.fis));
3500 	ccb->ccb_xa.at = at;
3501 	ccb->ccb_xa.fis->type = ATA_FIS_TYPE_H2D;
3502 
3503 	return (&ccb->ccb_xa);
3504 }
3505 
3506 void
3507 ahci_ata_put_xfer(struct ata_xfer *xa)
3508 {
3509 	struct ahci_ccb			*ccb = (struct ahci_ccb *)xa;
3510 
3511 	DPRINTF(AHCI_D_XFER, "ahci_ata_put_xfer slot %d\n", ccb->ccb_slot);
3512 
3513 	ahci_put_ccb(ccb);
3514 }
3515 
3516 int
3517 ahci_ata_cmd(struct ata_xfer *xa)
3518 {
3519 	struct ahci_ccb			*ccb = (struct ahci_ccb *)xa;
3520 	struct ahci_cmd_hdr		*cmd_slot;
3521 
3522 	KKASSERT(xa->state == ATA_S_SETUP);
3523 
3524 	if (ccb->ccb_port->ap_state == AP_S_FATAL_ERROR)
3525 		goto failcmd;
3526 	ccb->ccb_done = ahci_ata_cmd_done;
3527 
3528 	cmd_slot = ccb->ccb_cmd_hdr;
3529 	cmd_slot->flags = htole16(5); /* FIS length (in DWORDs) */
3530 	if (ccb->ccb_xa.at) {
3531 		cmd_slot->flags |= htole16(ccb->ccb_xa.at->at_target <<
3532 					   AHCI_CMD_LIST_FLAG_PMP_SHIFT);
3533 	}
3534 
3535 	if (xa->flags & ATA_F_WRITE)
3536 		cmd_slot->flags |= htole16(AHCI_CMD_LIST_FLAG_W);
3537 
3538 	if (xa->flags & ATA_F_PACKET)
3539 		cmd_slot->flags |= htole16(AHCI_CMD_LIST_FLAG_A);
3540 
3541 	if (ahci_load_prdt(ccb) != 0)
3542 		goto failcmd;
3543 
3544 	xa->state = ATA_S_PENDING;
3545 
3546 	if (xa->flags & ATA_F_POLL)
3547 		return (ahci_poll(ccb, xa->timeout, ahci_ata_cmd_timeout));
3548 
3549 	crit_enter();
3550 	KKASSERT((xa->flags & ATA_F_TIMEOUT_EXPIRED) == 0);
3551 	xa->flags |= ATA_F_TIMEOUT_DESIRED;
3552 	ahci_start(ccb);
3553 	crit_exit();
3554 	return (xa->state);
3555 
3556 failcmd:
3557 	crit_enter();
3558 	xa->state = ATA_S_ERROR;
3559 	xa->complete(xa);
3560 	crit_exit();
3561 	return (ATA_S_ERROR);
3562 }
3563 
3564 void
3565 ahci_ata_cmd_done(struct ahci_ccb *ccb)
3566 {
3567 	struct ata_xfer	*xa = &ccb->ccb_xa;
3568 	int serial;
3569 
3570 	/*
3571 	 * NOTE: Callout does not lock port and may race us modifying
3572 	 *	 the flags, so make sure its stopped.
3573 	 *
3574 	 *	 A callout race can clean up the ccb.  A change in the
3575 	 *	 serial number should catch this condition.
3576 	 */
3577 	if (xa->flags & ATA_F_TIMEOUT_RUNNING) {
3578 		serial = ccb->ccb_xa.serial;
3579 		callout_stop_sync(&ccb->ccb_timeout);
3580 		if (serial != ccb->ccb_xa.serial) {
3581 			kprintf("%s: Warning: timeout race ccb %p\n",
3582 				PORTNAME(ccb->ccb_port), ccb);
3583 			return;
3584 		}
3585 		xa->flags &= ~ATA_F_TIMEOUT_RUNNING;
3586 	}
3587 	xa->flags &= ~(ATA_F_TIMEOUT_DESIRED | ATA_F_TIMEOUT_EXPIRED);
3588 	ccb->ccb_port->ap_expired &= ~(1 << ccb->ccb_slot);
3589 
3590 	KKASSERT(xa->state != ATA_S_ONCHIP && xa->state != ATA_S_PUT);
3591 	ahci_unload_prdt(ccb);
3592 
3593 	if (xa->state != ATA_S_TIMEOUT)
3594 		xa->complete(xa);
3595 }
3596 
3597 /*
3598  * Timeout from callout, MPSAFE - nothing can mess with the CCB's flags
3599  * while the callout is runing.
3600  *
3601  * We can't safely get the port lock here or delay, we could block
3602  * the callout thread.
3603  */
3604 static void
3605 ahci_ata_cmd_timeout_unserialized(void *arg)
3606 {
3607 	struct ahci_ccb		*ccb = arg;
3608 	struct ahci_port	*ap = ccb->ccb_port;
3609 
3610 	KKASSERT(ccb->ccb_xa.flags & ATA_F_TIMEOUT_RUNNING);
3611 	ccb->ccb_xa.flags &= ~ATA_F_TIMEOUT_RUNNING;
3612 	ccb->ccb_xa.flags |= ATA_F_TIMEOUT_EXPIRED;
3613 	ahci_os_signal_port_thread(ap, AP_SIGF_TIMEOUT);
3614 }
3615 
3616 /*
3617  * Timeout code, typically called when the port command processor is running.
3618  *
3619  * We have to be very very careful here.  We cannot stop the port unless
3620  * CR is already clear or the only active commands remaining are timed-out
3621  * ones.  Otherwise stopping the port will race the command processor and
3622  * we can lose events.  While we can theoretically just restart everything
3623  * that could result in a double-issue which will not work for ATAPI commands.
3624  */
3625 void
3626 ahci_ata_cmd_timeout(struct ahci_ccb *ccb)
3627 {
3628 	struct ata_xfer		*xa = &ccb->ccb_xa;
3629 	struct ahci_port	*ap = ccb->ccb_port;
3630 	struct ata_port		*at;
3631 	u_int32_t		ci_saved;
3632 	u_int32_t		mask;
3633 	int			slot;
3634 
3635 	at = ccb->ccb_xa.at;
3636 
3637 	kprintf("%s: CMD TIMEOUT state=%d slot=%d\n"
3638 		"\tglb-status 0x%08x\n"
3639 		"\tcmd-reg 0x%b\n"
3640 		"\tport_status 0x%b\n"
3641 		"\tsactive=%08x active=%08x expired=%08x\n"
3642 		"\t   sact=%08x     ci=%08x\n"
3643 		"\t    STS=%b\n",
3644 		ATANAME(ap, at),
3645 		ccb->ccb_xa.state, ccb->ccb_slot,
3646 		ahci_read(ap->ap_sc, AHCI_REG_IS),
3647 		ahci_pread(ap, AHCI_PREG_CMD), AHCI_PFMT_CMD,
3648 		ahci_pread(ap, AHCI_PREG_IS), AHCI_PFMT_IS,
3649 		ap->ap_sactive, ap->ap_active, ap->ap_expired,
3650 		ahci_pread(ap, AHCI_PREG_SACT),
3651 		ahci_pread(ap, AHCI_PREG_CI),
3652 		ahci_pread(ap, AHCI_PREG_TFD), AHCI_PFMT_TFD_STS
3653 	);
3654 
3655 
3656 	/*
3657 	 * NOTE: Timeout will not be running if the command was polled.
3658 	 *	 If we got here at least one of these flags should be set.
3659 	 */
3660 	KKASSERT(xa->flags & (ATA_F_POLL | ATA_F_TIMEOUT_DESIRED |
3661 			      ATA_F_TIMEOUT_RUNNING));
3662 	xa->flags &= ~(ATA_F_TIMEOUT_RUNNING | ATA_F_TIMEOUT_EXPIRED);
3663 
3664 	if (ccb->ccb_xa.state == ATA_S_PENDING) {
3665 		TAILQ_REMOVE(&ap->ap_ccb_pending, ccb, ccb_entry);
3666 		ccb->ccb_xa.state = ATA_S_TIMEOUT;
3667 		ccb->ccb_done(ccb);
3668 		xa->complete(xa);
3669 		ahci_issue_pending_commands(ap, NULL);
3670 		return;
3671 	}
3672 	if (ccb->ccb_xa.state != ATA_S_ONCHIP) {
3673 		kprintf("%s: Unexpected state during timeout: %d\n",
3674 			ATANAME(ap, at), ccb->ccb_xa.state);
3675 		return;
3676 	}
3677 
3678 	/*
3679 	 * Ok, we can only get this command off the chip if CR is inactive
3680 	 * or if the only commands running on the chip are all expired.
3681 	 * Otherwise we have to wait until the port is in a safe state.
3682 	 *
3683 	 * Do not set state here, it will cause polls to return when the
3684 	 * ccb is not yet off the chip.
3685 	 */
3686 	ap->ap_expired |= 1 << ccb->ccb_slot;
3687 
3688 	if ((ahci_pread(ap, AHCI_PREG_CMD) & AHCI_PREG_CMD_CR) &&
3689 	    (ap->ap_active | ap->ap_sactive) != ap->ap_expired) {
3690 		/*
3691 		 * If using FBSS or NCQ we can't safely stop the port
3692 		 * right now.
3693 		 */
3694 		kprintf("%s: Deferred timeout until its safe, slot %d\n",
3695 			ATANAME(ap, at), ccb->ccb_slot);
3696 		return;
3697 	}
3698 
3699 	/*
3700 	 * We can safely stop the port and process all expired ccb's,
3701 	 * which will include our current ccb.
3702 	 */
3703 	ci_saved = (ap->ap_sactive) ? ahci_pread(ap, AHCI_PREG_SACT) :
3704 				      ahci_pread(ap, AHCI_PREG_CI);
3705 	ahci_port_stop(ap, 0);
3706 
3707 	while (ap->ap_expired) {
3708 		slot = ffs(ap->ap_expired) - 1;
3709 		ap->ap_expired &= ~(1 << slot);
3710 		ci_saved &= ~(1 << slot);
3711 		ccb = &ap->ap_ccbs[slot];
3712 		ccb->ccb_xa.state = ATA_S_TIMEOUT;
3713 		if (ccb->ccb_xa.flags & ATA_F_NCQ) {
3714 			KKASSERT(ap->ap_sactive & (1 << slot));
3715 			ap->ap_sactive &= ~(1 << slot);
3716 		} else {
3717 			KKASSERT(ap->ap_active & (1 << slot));
3718 			ap->ap_active &= ~(1 << slot);
3719 			--ap->ap_active_cnt;
3720 		}
3721 		ccb->ccb_done(ccb);
3722 		ccb->ccb_xa.complete(&ccb->ccb_xa);
3723 	}
3724 	/* ccb invalid now */
3725 
3726 	/*
3727 	 * We can safely CLO the port to clear any BSY/DRQ, a case which
3728 	 * can occur with port multipliers.  This will unbrick the port
3729 	 * and allow commands to other targets behind the PM continue.
3730 	 * (FBSS).
3731 	 *
3732 	 * Finally, once the port has been restarted we can issue any
3733 	 * previously saved pending commands, and run the port interrupt
3734 	 * code to handle any completions which may have occured when
3735 	 * we saved CI.
3736 	 */
3737 	if (ahci_pread(ap, AHCI_PREG_TFD) &
3738 		   (AHCI_PREG_TFD_STS_BSY | AHCI_PREG_TFD_STS_DRQ)) {
3739 		kprintf("%s: Warning, issuing CLO after timeout\n",
3740 			ATANAME(ap, at));
3741 		ahci_port_clo(ap);
3742 	}
3743 	ahci_port_start(ap);
3744 
3745 	/*
3746 	 * We absolutely must make sure the chipset cleared activity on
3747 	 * all slots.  This sometimes might not happen due to races with
3748 	 * a chipset interrupt which stops the port before we can manage
3749 	 * to.  For some reason some chipsets don't clear the active
3750 	 * commands when we turn off CMD_ST after the chip has stopped
3751 	 * operations itself.
3752 	 */
3753 	if (ahci_pactive(ap) != 0) {
3754 		ahci_port_stop(ap, 0);
3755 		ahci_port_start(ap);
3756 		if ((mask = ahci_pactive(ap)) != 0) {
3757 			kprintf("%s: quick-timeout: chipset failed "
3758 				"to clear active cmds %08x\n",
3759 				PORTNAME(ap), mask);
3760 		}
3761 	}
3762 	ahci_issue_saved_commands(ap, ci_saved & ~ap->ap_expired);
3763 	ahci_issue_pending_commands(ap, NULL);
3764 	ahci_port_intr(ap, 0);
3765 }
3766 
3767 /*
3768  * Issue a previously saved set of commands
3769  */
3770 void
3771 ahci_issue_saved_commands(struct ahci_port *ap, u_int32_t ci_saved)
3772 {
3773 	if (ci_saved) {
3774 		KKASSERT(!((ap->ap_active & ci_saved) &&
3775 			   (ap->ap_sactive & ci_saved)));
3776 		KKASSERT((ci_saved & ap->ap_expired) == 0);
3777 		if (ap->ap_sactive & ci_saved)
3778 			ahci_pwrite(ap, AHCI_PREG_SACT, ci_saved);
3779 		ahci_pwrite(ap, AHCI_PREG_CI, ci_saved);
3780 	}
3781 }
3782 
3783 /*
3784  * Used by the softreset, pmprobe, and read_ncq_error only, in very
3785  * specialized, controlled circumstances.
3786  *
3787  * Only one command may be pending.
3788  */
3789 void
3790 ahci_quick_timeout(struct ahci_ccb *ccb)
3791 {
3792 	struct ahci_port *ap = ccb->ccb_port;
3793 	u_int32_t mask;
3794 
3795 	switch (ccb->ccb_xa.state) {
3796 	case ATA_S_PENDING:
3797 		TAILQ_REMOVE(&ap->ap_ccb_pending, ccb, ccb_entry);
3798 		ccb->ccb_xa.state = ATA_S_TIMEOUT;
3799 		break;
3800 	case ATA_S_ONCHIP:
3801 		/*
3802 		 * We have to clear the command on-chip.
3803 		 */
3804 		KKASSERT(ap->ap_active == (1 << ccb->ccb_slot) &&
3805 			 ap->ap_sactive == 0);
3806 		ahci_port_stop(ap, 0);
3807 		ahci_port_start(ap);
3808 		if (ahci_pactive(ap) != 0) {
3809 			ahci_port_stop(ap, 0);
3810 			ahci_port_start(ap);
3811 			if ((mask = ahci_pactive(ap)) != 0) {
3812 				kprintf("%s: quick-timeout: chipset failed "
3813 					"to clear active cmds %08x\n",
3814 					PORTNAME(ap), mask);
3815 			}
3816 		}
3817 
3818 		ccb->ccb_xa.state = ATA_S_TIMEOUT;
3819 		ap->ap_active &= ~(1 << ccb->ccb_slot);
3820 		KKASSERT(ap->ap_active_cnt > 0);
3821 		--ap->ap_active_cnt;
3822 		break;
3823 	default:
3824 		panic("%s: ahci_quick_timeout: ccb in bad state %d",
3825 		      ATANAME(ap, ccb->ccb_xa.at), ccb->ccb_xa.state);
3826 	}
3827 }
3828 
3829 static void
3830 ahci_dummy_done(struct ata_xfer *xa)
3831 {
3832 }
3833 
3834 static void
3835 ahci_empty_done(struct ahci_ccb *ccb)
3836 {
3837 }
3838 
3839 int
3840 ahci_set_feature(struct ahci_port *ap, struct ata_port *atx,
3841 		 int feature, int enable)
3842 {
3843 	struct ata_port *at;
3844 	struct ata_xfer *xa;
3845 	int error;
3846 
3847 	at = atx ? atx : ap->ap_ata[0];
3848 
3849 	xa = ahci_ata_get_xfer(ap, atx);
3850 
3851 	xa->fis->type = ATA_FIS_TYPE_H2D;
3852 	xa->fis->flags = ATA_H2D_FLAGS_CMD | at->at_target;
3853 	xa->fis->command = ATA_C_SET_FEATURES;
3854 	xa->fis->features = enable ? ATA_SF_SATAFT_ENA : ATA_SF_SATAFT_DIS;
3855 	xa->fis->sector_count = feature;
3856 	xa->fis->control = ATA_FIS_CONTROL_4BIT;
3857 
3858 	xa->complete = ahci_dummy_done;
3859 	xa->datalen = 0;
3860 	xa->flags = ATA_F_POLL;
3861 	xa->timeout = 1000;
3862 
3863 	if (ahci_ata_cmd(xa) == ATA_S_COMPLETE)
3864 		error = 0;
3865 	else
3866 		error = EIO;
3867 	ahci_ata_put_xfer(xa);
3868 	return(error);
3869 }
3870