xref: /dragonfly/sys/dev/disk/ahci/ahci.c (revision a361ab31)
1 /*
2  * (MPSAFE)
3  *
4  * Copyright (c) 2006 David Gwynne <dlg@openbsd.org>
5  *
6  * Permission to use, copy, modify, and distribute this software for any
7  * purpose with or without fee is hereby granted, provided that the above
8  * copyright notice and this permission notice appear in all copies.
9  *
10  * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
11  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
12  * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
13  * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
14  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
15  * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
16  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
17  *
18  *
19  * Copyright (c) 2009 The DragonFly Project.  All rights reserved.
20  *
21  * This code is derived from software contributed to The DragonFly Project
22  * by Matthew Dillon <dillon@backplane.com>
23  *
24  * Redistribution and use in source and binary forms, with or without
25  * modification, are permitted provided that the following conditions
26  * are met:
27  *
28  * 1. Redistributions of source code must retain the above copyright
29  *    notice, this list of conditions and the following disclaimer.
30  * 2. Redistributions in binary form must reproduce the above copyright
31  *    notice, this list of conditions and the following disclaimer in
32  *    the documentation and/or other materials provided with the
33  *    distribution.
34  * 3. Neither the name of The DragonFly Project nor the names of its
35  *    contributors may be used to endorse or promote products derived
36  *    from this software without specific, prior written permission.
37  *
38  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
39  * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
40  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
41  * FOR A PARTICULAR PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE
42  * COPYRIGHT HOLDERS OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
43  * INCIDENTAL, SPECIAL, EXEMPLARY OR CONSEQUENTIAL DAMAGES (INCLUDING,
44  * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
45  * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED
46  * AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
47  * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT
48  * OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
49  * SUCH DAMAGE.
50  *
51  * $OpenBSD: ahci.c,v 1.147 2009/02/16 21:19:07 miod Exp $
52  */
53 
54 #include "ahci.h"
55 
56 void	ahci_port_interrupt_enable(struct ahci_port *ap);
57 
58 int	ahci_load_prdt(struct ahci_ccb *);
59 void	ahci_unload_prdt(struct ahci_ccb *);
60 static void ahci_load_prdt_callback(void *info, bus_dma_segment_t *segs,
61 				    int nsegs, int error);
62 void	ahci_start(struct ahci_ccb *);
63 int	ahci_port_softreset(struct ahci_port *ap);
64 int	ahci_port_hardreset(struct ahci_port *ap, int hard);
65 void	ahci_port_hardstop(struct ahci_port *ap);
66 
67 static void ahci_ata_cmd_timeout_unserialized(void *);
68 void	ahci_check_active_timeouts(struct ahci_port *ap);
69 
70 void	ahci_beg_exclusive_access(struct ahci_port *ap, struct ata_port *at);
71 void	ahci_end_exclusive_access(struct ahci_port *ap, struct ata_port *at);
72 void	ahci_issue_pending_commands(struct ahci_port *ap, struct ahci_ccb *ccb);
73 void	ahci_issue_saved_commands(struct ahci_port *ap, u_int32_t mask);
74 
75 int	ahci_port_read_ncq_error(struct ahci_port *, int);
76 
77 struct ahci_dmamem *ahci_dmamem_alloc(struct ahci_softc *, bus_dma_tag_t tag);
78 void	ahci_dmamem_free(struct ahci_softc *, struct ahci_dmamem *);
79 static void ahci_dmamem_saveseg(void *info, bus_dma_segment_t *segs, int nsegs, int error);
80 
81 static void ahci_dummy_done(struct ata_xfer *xa);
82 static void ahci_empty_done(struct ahci_ccb *ccb);
83 static void ahci_ata_cmd_done(struct ahci_ccb *ccb);
84 static u_int32_t ahci_pactive(struct ahci_port *ap);
85 
86 /*
87  * Initialize the global AHCI hardware.  This code does not set up any of
88  * its ports.
89  */
90 int
91 ahci_init(struct ahci_softc *sc)
92 {
93 	u_int32_t	pi, pleft;
94 	u_int32_t	bios_cap, vers;
95 	int		i;
96 	struct ahci_port *ap;
97 
98 	DPRINTF(AHCI_D_VERBOSE, " GHC 0x%pb%i",
99 		AHCI_FMT_GHC, ahci_read(sc, AHCI_REG_GHC));
100 
101 	/*
102 	 * AHCI version.
103 	 */
104 	vers = ahci_read(sc, AHCI_REG_VS);
105 
106 	/*
107 	 * save BIOS initialised parameters, enable staggered spin up
108 	 */
109 	bios_cap = ahci_read(sc, AHCI_REG_CAP);
110 	bios_cap &= AHCI_REG_CAP_SMPS | AHCI_REG_CAP_SSS;
111 
112 	pi = ahci_read(sc, AHCI_REG_PI);
113 
114 	/*
115 	 * Unconditionally reset the controller, do not conditionalize on
116 	 * trying to figure it if it was previously active or not.
117 	 *
118 	 * NOTE: On AE before HR.  The AHCI-1.1 spec has a note in section
119 	 *	 5.2.2.1 regarding this.  HR should be set to 1 only after
120 	 *	 AE is set to 1.  The reset sequence will clear HR when
121 	 *	 it completes, and will also clear AE if SAM is 0.  AE must
122 	 *	 then be set again.  When SAM is 1 the AE bit typically reads
123 	 *	 as 1 (and is read-only).
124 	 *
125 	 * NOTE: Avoid PCI[e] transaction burst by issuing dummy reads,
126 	 *	 otherwise the writes will only be separated by a few
127 	 *	 nanoseconds.
128 	 *
129 	 * NOTE BRICKS (1)
130 	 *
131 	 *	If you have a port multiplier and it does not have a device
132 	 *	in target 0, and it probes normally, but a later operation
133 	 *	mis-probes a target behind that PM, it is possible for the
134 	 *	port to brick such that only (a) a power cycle of the host
135 	 *	or (b) placing a device in target 0 will fix the problem.
136 	 *	Power cycling the PM has no effect (it works fine on another
137 	 *	host port).  This issue is unrelated to CLO.
138 	 */
139 	/*
140 	 * Wait for any prior reset sequence to complete
141 	 */
142 	if (ahci_wait_ne(sc, AHCI_REG_GHC,
143 			 AHCI_REG_GHC_HR, AHCI_REG_GHC_HR) != 0) {
144 		device_printf(sc->sc_dev, "Controller is stuck in reset\n");
145 		return (1);
146 	}
147 	ahci_write(sc, AHCI_REG_GHC, AHCI_REG_GHC_AE);
148 	ahci_os_sleep(250);
149 	ahci_read(sc, AHCI_REG_GHC);		/* flush */
150 	ahci_write(sc, AHCI_REG_GHC, AHCI_REG_GHC_AE | AHCI_REG_GHC_HR);
151 	ahci_os_sleep(250);
152 	ahci_read(sc, AHCI_REG_GHC);		/* flush */
153 	if (ahci_wait_ne(sc, AHCI_REG_GHC,
154 			 AHCI_REG_GHC_HR, AHCI_REG_GHC_HR) != 0) {
155 		device_printf(sc->sc_dev, "unable to reset controller\n");
156 		return (1);
157 	}
158 	if (ahci_read(sc, AHCI_REG_GHC) & AHCI_REG_GHC_AE) {
159 		device_printf(sc->sc_dev, "AE did not auto-clear!\n");
160 		ahci_write(sc, AHCI_REG_GHC, 0);
161 		ahci_os_sleep(250);
162 	}
163 
164 	/*
165 	 * Enable ahci (global interrupts disabled)
166 	 *
167 	 * Restore saved parameters.  Avoid pci transaction burst write
168 	 * by issuing dummy reads.
169 	 */
170 	ahci_os_sleep(10);
171 	ahci_write(sc, AHCI_REG_GHC, AHCI_REG_GHC_AE);
172 	ahci_os_sleep(10);
173 
174 	ahci_read(sc, AHCI_REG_GHC);		/* flush */
175 
176 	bios_cap |= AHCI_REG_CAP_SSS;
177 	ahci_write(sc, AHCI_REG_CAP, ahci_read(sc, AHCI_REG_CAP) | bios_cap);
178 	ahci_write(sc, AHCI_REG_PI, pi);
179 	ahci_read(sc, AHCI_REG_GHC);		/* flush */
180 
181 	/*
182 	 * Intel hocus pocus in case the BIOS has not set the chip up
183 	 * properly for AHCI operation.
184 	 */
185 	if (pci_get_vendor(sc->sc_dev) == PCI_VENDOR_INTEL) {
186 	        if ((pci_read_config(sc->sc_dev, 0x92, 2) & 0x0F) != 0x0F)
187 			device_printf(sc->sc_dev, "Intel hocus pocus\n");
188 		pci_write_config(sc->sc_dev, 0x92,
189 			     pci_read_config(sc->sc_dev, 0x92, 2) | 0x0F, 2);
190 	}
191 
192 	/*
193 	 * This is a hack that currently does not appear to have
194 	 * a significant effect, but I noticed the port registers
195 	 * do not appear to be completely cleared after the host
196 	 * controller is reset.
197 	 *
198 	 * Use a temporary ap structure so we can call ahci_pwrite().
199 	 *
200 	 * We must be sure to stop the port
201 	 */
202 	ap = kmalloc(sizeof(*ap), M_DEVBUF, M_WAITOK | M_ZERO);
203 	ap->ap_sc = sc;
204 	pleft = pi;
205 	for (i = 0; i < AHCI_MAX_PORTS; ++i) {
206 		if (pleft == 0)
207 			break;
208 		if ((pi & (1 << i)) == 0)
209 			continue;
210 		if (bus_space_subregion(sc->sc_iot, sc->sc_ioh,
211 		    AHCI_PORT_REGION(i), AHCI_PORT_SIZE, &ap->ap_ioh) != 0) {
212 			device_printf(sc->sc_dev, "can't map port\n");
213 			return (1);
214 		}
215 		/*
216 		 * NOTE!  Setting AHCI_PREG_SCTL_DET_DISABLE on AHCI1.0 or
217 		 *	  AHCI1.1 can brick the chipset.  Not only brick it,
218 		 *	  but also crash the PC.  The bit seems unreliable
219 		 *	  on AHCI1.2 as well.
220 		 */
221 		ahci_port_stop(ap, 1);
222 		ahci_pwrite(ap, AHCI_PREG_SCTL, ap->ap_sc->sc_ipm_disable);
223 		ahci_pwrite(ap, AHCI_PREG_SERR, -1);
224 		ahci_pwrite(ap, AHCI_PREG_IE, 0);
225 		ahci_write(ap->ap_sc, AHCI_REG_IS, 1 << i);
226 		ahci_pwrite(ap, AHCI_PREG_CMD, 0);
227 		ahci_pwrite(ap, AHCI_PREG_IS, -1);
228 		sc->sc_portmask |= (1 << i);
229 		pleft &= ~(1 << i);
230 	}
231 	sc->sc_numports = i;
232 	kfree(ap, M_DEVBUF);
233 
234 	return (0);
235 }
236 
237 /*
238  * Allocate and initialize an AHCI port.
239  */
240 int
241 ahci_port_alloc(struct ahci_softc *sc, u_int port)
242 {
243 	struct ahci_port	*ap;
244 	struct ata_port		*at;
245 	struct ahci_ccb		*ccb;
246 	u_int64_t		dva;
247 	u_int32_t		cmd;
248 	u_int32_t		data;
249 	struct ahci_cmd_hdr	*hdr;
250 	struct ahci_cmd_table	*table;
251 	int	rc = ENOMEM;
252 	int	error;
253 	int	i;
254 
255 	ap = kmalloc(sizeof(*ap), M_DEVBUF, M_WAITOK | M_ZERO);
256 	ap->ap_err_scratch = kmalloc(512, M_DEVBUF, M_WAITOK | M_ZERO);
257 
258 	ksnprintf(ap->ap_name, sizeof(ap->ap_name), "%s%d.%d",
259 		  device_get_name(sc->sc_dev),
260 		  device_get_unit(sc->sc_dev),
261 		  port);
262 	sc->sc_ports[port] = ap;
263 
264 	/*
265 	 * Allocate enough so we never have to reallocate, it makes
266 	 * it easier.
267 	 *
268 	 * ap_pmcount will be reduced by the scan if we encounter the
269 	 * port multiplier port prior to target 15.
270 	 *
271 	 * kmalloc power-of-2 allocations are guaranteed not to cross
272 	 * a page boundary.  Make sure the identify sub-structure in the
273 	 * at structure does not cross a page boundary, just in case the
274 	 * part is AHCI-1.1 and can't handle multiple DRQ blocks.
275 	 */
276 	if (ap->ap_ata[0] == NULL) {
277 		int pw2;
278 
279 		for (pw2 = 1; pw2 < sizeof(*at); pw2 <<= 1)
280 			;
281 		for (i = 0; i < AHCI_MAX_PMPORTS; ++i) {
282 			at = kmalloc(pw2, M_DEVBUF, M_INTWAIT | M_ZERO);
283 			ap->ap_ata[i] = at;
284 			at->at_ahci_port = ap;
285 			at->at_target = i;
286 			at->at_probe = ATA_PROBE_NEED_INIT;
287 			at->at_features |= ATA_PORT_F_RESCAN;
288 			ksnprintf(at->at_name, sizeof(at->at_name),
289 				  "%s.%d", ap->ap_name, i);
290 		}
291 	}
292 	if (bus_space_subregion(sc->sc_iot, sc->sc_ioh,
293 	    AHCI_PORT_REGION(port), AHCI_PORT_SIZE, &ap->ap_ioh) != 0) {
294 		device_printf(sc->sc_dev,
295 			      "unable to create register window for port %d\n",
296 			      port);
297 		goto freeport;
298 	}
299 
300 	ap->ap_sc = sc;
301 	ap->ap_num = port;
302 	ap->ap_probe = ATA_PROBE_NEED_INIT;
303 	ap->link_pwr_mgmt = AHCI_LINK_PWR_MGMT_NONE;
304 	ap->sysctl_tree = NULL;
305 	TAILQ_INIT(&ap->ap_ccb_free);
306 	TAILQ_INIT(&ap->ap_ccb_pending);
307 	lockinit(&ap->ap_ccb_lock, "ahcipo", 0, 0);
308 
309 	/* Disable port interrupts */
310 	ahci_pwrite(ap, AHCI_PREG_IE, 0);
311 	ahci_pwrite(ap, AHCI_PREG_SERR, -1);
312 
313 	/*
314 	 * Sec 10.1.2 - deinitialise port if it is already running
315 	 */
316 	cmd = ahci_pread(ap, AHCI_PREG_CMD);
317 
318 	if ((cmd & (AHCI_PREG_CMD_ST | AHCI_PREG_CMD_CR |
319 		    AHCI_PREG_CMD_FRE | AHCI_PREG_CMD_FR)) ||
320 	    (ahci_pread(ap, AHCI_PREG_SCTL) & AHCI_PREG_SCTL_DET)) {
321 		int r;
322 
323 		r = ahci_port_stop(ap, 1);
324 		if (r) {
325 			device_printf(sc->sc_dev,
326 				  "unable to disable %s, ignoring port %d\n",
327 				  ((r == 2) ? "CR" : "FR"), port);
328 			rc = ENXIO;
329 			goto freeport;
330 		}
331 
332 		/* Write DET to zero */
333 		ahci_pwrite(ap, AHCI_PREG_SCTL, ap->ap_sc->sc_ipm_disable);
334 	}
335 
336 	/* Allocate RFIS */
337 	ap->ap_dmamem_rfis = ahci_dmamem_alloc(sc, sc->sc_tag_rfis);
338 	if (ap->ap_dmamem_rfis == NULL) {
339 		kprintf("%s: NORFIS\n", PORTNAME(ap));
340 		goto nomem;
341 	}
342 
343 	/* Setup RFIS base address */
344 	ap->ap_rfis = (struct ahci_rfis *) AHCI_DMA_KVA(ap->ap_dmamem_rfis);
345 	bzero(ap->ap_rfis, sc->sc_rfis_size);
346 
347 	dva = AHCI_DMA_DVA(ap->ap_dmamem_rfis);
348 	ahci_pwrite(ap, AHCI_PREG_FB, (u_int32_t)dva);
349 	ahci_pwrite(ap, AHCI_PREG_FBU, (u_int32_t)(dva >> 32));
350 
351 	/* Clear SERR before starting FIS reception or ST or anything */
352 	ahci_flush_tfd(ap);
353 	ahci_pwrite(ap, AHCI_PREG_SERR, -1);
354 
355 	/*
356 	 * Power up any device sitting on the port.
357 	 *
358 	 * Don't turn on FIS reception here, it will be handled in the first
359 	 * ahci_port_start().
360 	 *
361 	 * Don't make the ICC ACTIVE here, it will be handled in port_init.
362 	 */
363 	cmd = ahci_pread(ap, AHCI_PREG_CMD) & ~AHCI_PREG_CMD_ICC;
364 	cmd &= ~(AHCI_PREG_CMD_CLO | AHCI_PREG_CMD_PMA);
365 	cmd |= AHCI_PREG_CMD_POD | AHCI_PREG_CMD_SUD;
366 #if 0
367 	/* this will be done in ahci_pm_port_probe() */
368 	if (ap->ap_sc->sc_cap & AHCI_REG_CAP_SPM)
369 		cmd |= AHCI_PREG_CMD_PMA;
370 #endif
371 
372 	ahci_pwrite(ap, AHCI_PREG_CMD, cmd);
373 
374 	/* Allocate a CCB for each command slot */
375 	ap->ap_ccbs = kmalloc(sizeof(struct ahci_ccb) * sc->sc_ncmds, M_DEVBUF,
376 			      M_WAITOK | M_ZERO);
377 	if (ap->ap_ccbs == NULL) {
378 		device_printf(sc->sc_dev,
379 			      "unable to allocate command list for port %d\n",
380 			      port);
381 		goto freeport;
382 	}
383 
384 	/* Command List Structures and Command Tables */
385 	ap->ap_dmamem_cmd_list = ahci_dmamem_alloc(sc, sc->sc_tag_cmdh);
386 	ap->ap_dmamem_cmd_table = ahci_dmamem_alloc(sc, sc->sc_tag_cmdt);
387 	if (ap->ap_dmamem_cmd_table == NULL ||
388 	    ap->ap_dmamem_cmd_list == NULL) {
389 nomem:
390 		device_printf(sc->sc_dev,
391 			      "unable to allocate DMA memory for port %d\n",
392 			      port);
393 		goto freeport;
394 	}
395 
396 	/* Setup command list base address */
397 	dva = AHCI_DMA_DVA(ap->ap_dmamem_cmd_list);
398 	ahci_pwrite(ap, AHCI_PREG_CLB, (u_int32_t)dva);
399 	ahci_pwrite(ap, AHCI_PREG_CLBU, (u_int32_t)(dva >> 32));
400 
401 	/* Split CCB allocation into CCBs and assign to command header/table */
402 	hdr = AHCI_DMA_KVA(ap->ap_dmamem_cmd_list);
403 	table = AHCI_DMA_KVA(ap->ap_dmamem_cmd_table);
404 	bzero(hdr, sc->sc_cmdlist_size);
405 
406 	for (i = 0; i < sc->sc_ncmds; i++) {
407 		ccb = &ap->ap_ccbs[i];
408 
409 		error = bus_dmamap_create(sc->sc_tag_data, BUS_DMA_ALLOCNOW,
410 					  &ccb->ccb_dmamap);
411 		if (error) {
412 			device_printf(sc->sc_dev,
413 				      "unable to create dmamap for port %d "
414 				      "ccb %d\n", port, i);
415 			goto freeport;
416 		}
417 
418 		callout_init_mp(&ccb->ccb_timeout);
419 		ccb->ccb_slot = i;
420 		ccb->ccb_port = ap;
421 		ccb->ccb_cmd_hdr = &hdr[i];
422 		ccb->ccb_cmd_table = &table[i];
423 		dva = AHCI_DMA_DVA(ap->ap_dmamem_cmd_table) +
424 		    ccb->ccb_slot * sizeof(struct ahci_cmd_table);
425 		ccb->ccb_cmd_hdr->ctba_hi = htole32((u_int32_t)(dva >> 32));
426 		ccb->ccb_cmd_hdr->ctba_lo = htole32((u_int32_t)dva);
427 
428 		ccb->ccb_xa.fis =
429 		    (struct ata_fis_h2d *)ccb->ccb_cmd_table->cfis;
430 		ccb->ccb_xa.packetcmd = ccb->ccb_cmd_table->acmd;
431 		ccb->ccb_xa.tag = i;
432 
433 		ccb->ccb_xa.state = ATA_S_COMPLETE;
434 
435 		/*
436 		 * CCB[1] is the error CCB and is not get or put.  It is
437 		 * also used for probing.  Numerous HBAs only load the
438 		 * signature from CCB[1] so it MUST be used for the second
439 		 * FIS.
440 		 */
441 		if (i == 1)
442 			ap->ap_err_ccb = ccb;
443 		else
444 			ahci_put_ccb(ccb);
445 	}
446 
447 	/*
448 	 * Wait for ICC change to complete
449 	 */
450 	ahci_pwait_clr(ap, AHCI_PREG_CMD, AHCI_PREG_CMD_ICC);
451 
452 	/*
453 	 * Calculate the interrupt mask
454 	 */
455 	data = AHCI_PREG_IE_TFEE | AHCI_PREG_IE_HBFE |
456 	       AHCI_PREG_IE_IFE | AHCI_PREG_IE_OFE |
457 	       AHCI_PREG_IE_DPE | AHCI_PREG_IE_UFE |
458 	       AHCI_PREG_IE_PCE | AHCI_PREG_IE_PRCE |
459 	       AHCI_PREG_IE_DHRE | AHCI_PREG_IE_SDBE;
460 	if (ap->ap_sc->sc_cap & AHCI_REG_CAP_SSNTF)
461 		data |= AHCI_PREG_IE_IPME;
462 #ifdef AHCI_COALESCE
463 	if (sc->sc_ccc_ports & (1 << port)
464 		data &= ~(AHCI_PREG_IE_SDBE | AHCI_PREG_IE_DHRE);
465 #endif
466 	ap->ap_intmask = data;
467 
468 	/*
469 	 * Start the port helper thread.  The helper thread will call
470 	 * ahci_port_init() so the ports can all be started in parallel.
471 	 * A failure by ahci_port_init() does not deallocate the port
472 	 * since we still want hot-plug events.
473 	 */
474 	ahci_os_start_port(ap);
475 	return(0);
476 freeport:
477 	ahci_port_free(sc, port);
478 	return (rc);
479 }
480 
481 /*
482  * [re]initialize an idle port.  No CCBs should be active.  (from port thread)
483  *
484  * This function is called during the initial port allocation sequence
485  * and is also called on hot-plug insertion.  We take no chances and
486  * use a portreset instead of a softreset.
487  *
488  * This function is the only way to move a failed port back to active
489  * status.
490  *
491  * Returns 0 if a device is successfully detected.
492  */
493 int
494 ahci_port_init(struct ahci_port *ap)
495 {
496 	u_int32_t cmd;
497 
498 	/*
499 	 * Register [re]initialization
500 	 *
501 	 * Flush the TFD and SERR and make sure the port is stopped before
502 	 * enabling its interrupt.  We no longer cycle the port start as
503 	 * the port should not be started unless a device is present.
504 	 *
505 	 * XXX should we enable FIS reception? (FRE)?
506 	 */
507 	ahci_pwrite(ap, AHCI_PREG_IE, 0);
508 	ahci_port_stop(ap, 0);
509 	if (ap->ap_sc->sc_cap & AHCI_REG_CAP_SSNTF)
510 		ahci_pwrite(ap, AHCI_PREG_SNTF, -1);
511 	ahci_flush_tfd(ap);
512 	ahci_pwrite(ap, AHCI_PREG_SERR, -1);
513 
514 	/*
515 	 * If we are being harsh try to kill the port completely.  Normally
516 	 * we would want to hold on to some of the state the BIOS may have
517 	 * set, such as SUD (spin up device).
518 	 *
519 	 * AP_F_HARSH_REINIT is cleared in the hard reset state
520 	 */
521 	if (ap->ap_flags & AP_F_HARSH_REINIT) {
522 		ahci_pwrite(ap, AHCI_PREG_SCTL, ap->ap_sc->sc_ipm_disable);
523 		ahci_pwrite(ap, AHCI_PREG_CMD, 0);
524 
525 		ahci_os_sleep(1000);
526 
527 		cmd = ahci_pread(ap, AHCI_PREG_CMD) & ~AHCI_PREG_CMD_ICC;
528 		cmd &= ~(AHCI_PREG_CMD_CLO | AHCI_PREG_CMD_PMA);
529 		cmd |= AHCI_PREG_CMD_POD | AHCI_PREG_CMD_SUD;
530 		cmd |= AHCI_PREG_CMD_ICC_ACTIVE;
531 		ahci_pwrite(ap, AHCI_PREG_CMD, cmd);
532 		ahci_pwait_clr(ap, AHCI_PREG_CMD, AHCI_PREG_CMD_ICC);
533 		ahci_os_sleep(1000);
534 	}
535 
536 	/*
537 	 * Clear any pending garbage and re-enable the interrupt before
538 	 * going to the next stage.
539 	 */
540 	ap->ap_probe = ATA_PROBE_NEED_HARD_RESET;
541 	ap->ap_pmcount = 0;
542 
543 	if (ap->ap_sc->sc_cap & AHCI_REG_CAP_SSNTF)
544 		ahci_pwrite(ap, AHCI_PREG_SNTF, -1);
545 	ahci_flush_tfd(ap);
546 	ahci_pwrite(ap, AHCI_PREG_SERR, -1);
547 	ahci_pwrite(ap, AHCI_PREG_IS, -1);
548 
549 	ahci_port_interrupt_enable(ap);
550 
551 	return (0);
552 }
553 
554 /*
555  * Enable or re-enable interrupts on a port.
556  *
557  * This routine is called from the port initialization code or from the
558  * helper thread as the real interrupt may be forced to turn off certain
559  * interrupt sources.
560  */
561 void
562 ahci_port_interrupt_enable(struct ahci_port *ap)
563 {
564 	ahci_pwrite(ap, AHCI_PREG_IE, ap->ap_intmask);
565 }
566 
567 /*
568  * Manage the agressive link power management capability.
569  */
570 void
571 ahci_port_link_pwr_mgmt(struct ahci_port *ap, int link_pwr_mgmt)
572 {
573 	u_int32_t cmd, sctl;
574 
575 	if (link_pwr_mgmt == ap->link_pwr_mgmt)
576 		return;
577 
578 	if ((ap->ap_sc->sc_cap & AHCI_REG_CAP_SALP) == 0) {
579 		kprintf("%s: link power management not supported.\n",
580 			PORTNAME(ap));
581 		return;
582 	}
583 
584 	ahci_os_lock_port(ap);
585 
586 	if (link_pwr_mgmt == AHCI_LINK_PWR_MGMT_AGGR &&
587 	    (ap->ap_sc->sc_cap & AHCI_REG_CAP_SSC)) {
588 		kprintf("%s: enabling aggressive link power management.\n",
589 			PORTNAME(ap));
590 
591 		ap->link_pwr_mgmt = link_pwr_mgmt;
592 
593 		ap->ap_intmask &= ~AHCI_PREG_IE_PRCE;
594 		ahci_port_interrupt_enable(ap);
595 
596 		sctl = ahci_pread(ap, AHCI_PREG_SCTL);
597 		sctl &= ~(AHCI_PREG_SCTL_IPM);
598 		if (ap->ap_sc->sc_cap2 & AHCI_REG_CAP2_SDS)
599 			sctl |= AHCI_PREG_SCTL_IPM_NODEVSLP;
600 		ahci_pwrite(ap, AHCI_PREG_SCTL, sctl);
601 
602 		/*
603 		 * Enable device initiated link power management for
604 		 * directly attached devices that support it.
605 		 */
606 		if (ap->ap_type != ATA_PORT_T_PM &&
607 		    (ap->ap_ata[0]->at_identify.satafsup &
608 		    SATA_FEATURE_SUP_DEVIPS)) {
609 			if (ahci_set_feature(ap, NULL, ATA_SATAFT_DEVIPS, 1))
610 				kprintf("%s: Could not enable device initiated "
611 				    "link power management.\n",
612 				    PORTNAME(ap));
613 		}
614 
615 		cmd = ahci_pread(ap, AHCI_PREG_CMD);
616 		cmd |= AHCI_PREG_CMD_ASP;
617 		cmd |= AHCI_PREG_CMD_ALPE;
618 		ahci_pwrite(ap, AHCI_PREG_CMD, cmd);
619 	} else if (link_pwr_mgmt == AHCI_LINK_PWR_MGMT_MEDIUM &&
620 	           (ap->ap_sc->sc_cap & AHCI_REG_CAP_PSC)) {
621 		kprintf("%s: enabling medium link power management.\n",
622 			PORTNAME(ap));
623 
624 		ap->link_pwr_mgmt = link_pwr_mgmt;
625 
626 		ap->ap_intmask &= ~AHCI_PREG_IE_PRCE;
627 		ahci_port_interrupt_enable(ap);
628 
629 		sctl = ahci_pread(ap, AHCI_PREG_SCTL);
630 		sctl &= ~(AHCI_PREG_SCTL_IPM);
631 		sctl |= AHCI_PREG_SCTL_IPM_NOSLUMBER;
632 		if (ap->ap_sc->sc_cap2 & AHCI_REG_CAP2_SDS)
633 			sctl |= AHCI_PREG_SCTL_IPM_NODEVSLP;
634 		ahci_pwrite(ap, AHCI_PREG_SCTL, sctl);
635 
636 		cmd = ahci_pread(ap, AHCI_PREG_CMD);
637 		cmd &= ~AHCI_PREG_CMD_ASP;
638 		cmd |= AHCI_PREG_CMD_ALPE;
639 		ahci_pwrite(ap, AHCI_PREG_CMD, cmd);
640 
641 	} else if (link_pwr_mgmt == AHCI_LINK_PWR_MGMT_NONE) {
642 		kprintf("%s: disabling link power management.\n",
643 			PORTNAME(ap));
644 
645 		/* Disable device initiated link power management */
646 		if (ap->ap_type != ATA_PORT_T_PM &&
647 		    (ap->ap_ata[0]->at_identify.satafsup &
648 		    SATA_FEATURE_SUP_DEVIPS)) {
649 			ahci_set_feature(ap, NULL, ATA_SATAFT_DEVIPS, 0);
650 		}
651 
652 		cmd = ahci_pread(ap, AHCI_PREG_CMD);
653 		cmd &= ~(AHCI_PREG_CMD_ALPE | AHCI_PREG_CMD_ASP);
654 		ahci_pwrite(ap, AHCI_PREG_CMD, cmd);
655 
656 		sctl = ahci_pread(ap, AHCI_PREG_SCTL);
657 		sctl &= ~(AHCI_PREG_SCTL_IPM);
658 		sctl |= ap->ap_sc->sc_ipm_disable;
659 		ahci_pwrite(ap, AHCI_PREG_SCTL, sctl);
660 
661 		/* let the drive come back to avoid PRCS interrupts later */
662 		ahci_os_unlock_port(ap);
663 		ahci_os_sleep(1000);
664 		ahci_os_lock_port(ap);
665 
666 		ahci_pwrite(ap, AHCI_PREG_SERR,
667 			    AHCI_PREG_SERR_DIAG_N | AHCI_PREG_SERR_DIAG_W);
668 		ahci_pwrite(ap, AHCI_PREG_IS, AHCI_PREG_IS_PRCS);
669 
670 		ap->ap_intmask |= AHCI_PREG_IE_PRCE;
671 		ahci_port_interrupt_enable(ap);
672 
673 		ap->link_pwr_mgmt = link_pwr_mgmt;
674 	} else {
675 		kprintf("%s: unsupported link power management state %d.\n",
676 			PORTNAME(ap), link_pwr_mgmt);
677 	}
678 
679 	ahci_os_unlock_port(ap);
680 }
681 
682 /*
683  * Return current link power state.
684  */
685 int
686 ahci_port_link_pwr_state(struct ahci_port *ap)
687 {
688 	uint32_t r;
689 
690 	r = ahci_pread(ap, AHCI_PREG_SSTS);
691 	switch (r & AHCI_PREG_SSTS_IPM) {
692 	case AHCI_PREG_SSTS_IPM_ACTIVE:
693 		return 1;
694 	case AHCI_PREG_SSTS_IPM_PARTIAL:
695 		return 2;
696 	case AHCI_PREG_SSTS_IPM_SLUMBER:
697 		return 3;
698 	case AHCI_PREG_SSTS_IPM_DEVSLEEP:
699 		return 4;
700 	default:
701 		return 0;
702 	}
703 }
704 
705 /*
706  * Run the port / target state machine from a main context.
707  *
708  * The state machine for the port is always run.
709  *
710  * If atx is non-NULL run the state machine for a particular target.
711  * If atx is NULL run the state machine for all targets.
712  */
713 void
714 ahci_port_state_machine(struct ahci_port *ap, int initial)
715 {
716 	struct ata_port *at;
717 	u_int32_t data;
718 	int target;
719 	int didsleep;
720 	int loop;
721 
722 	/*
723 	 * State machine for port.  Note that CAM is not yet associated
724 	 * during the initial parallel probe and the port's probe state
725 	 * will not get past ATA_PROBE_NEED_IDENT.
726 	 */
727 	{
728 		if (initial == 0 && ap->ap_probe <= ATA_PROBE_NEED_HARD_RESET) {
729 			kprintf("%s: Waiting 5 seconds on insertion\n",
730 				PORTNAME(ap));
731 			ahci_os_sleep(5000);
732 			initial = 1;
733 		}
734 		if (ap->ap_probe == ATA_PROBE_NEED_INIT)
735 			ahci_port_init(ap);
736 		if (ap->ap_probe == ATA_PROBE_NEED_HARD_RESET)
737 			ahci_port_reset(ap, NULL, 1);
738 		if (ap->ap_probe == ATA_PROBE_NEED_SOFT_RESET)
739 			ahci_port_reset(ap, NULL, 0);
740 		if (ap->ap_probe == ATA_PROBE_NEED_IDENT)
741 			ahci_cam_probe(ap, NULL);
742 	}
743 	if (ap->ap_type != ATA_PORT_T_PM) {
744 		if (ap->ap_probe == ATA_PROBE_FAILED) {
745 			ahci_cam_changed(ap, NULL, 0);
746 		} else if (ap->ap_probe >= ATA_PROBE_NEED_IDENT) {
747 			ahci_cam_changed(ap, NULL, 1);
748 		}
749 		return;
750 	}
751 
752 	/*
753 	 * Port Multiplier state machine.
754 	 *
755 	 * Get a mask of changed targets and combine with any runnable
756 	 * states already present.
757 	 */
758 	for (loop = 0; ;++loop) {
759 		if (ahci_pm_read(ap, 15, SATA_PMREG_EINFO, &data)) {
760 			kprintf("%s: PM unable to read hot-plug bitmap\n",
761 				PORTNAME(ap));
762 			break;
763 		}
764 
765 		/*
766 		 * Do at least one loop, then stop if no more state changes
767 		 * have occured.  The PM might not generate a new
768 		 * notification until we clear the entire bitmap.
769 		 */
770 		if (loop && data == 0)
771 			break;
772 
773 		/*
774 		 * New devices showing up in the bitmap require some spin-up
775 		 * time before we start probing them.  Reset didsleep.  The
776 		 * first new device we detect will sleep before probing.
777 		 *
778 		 * This only applies to devices whos change bit is set in
779 		 * the data, and does not apply to the initial boot-time
780 		 * probe.
781 		 */
782 		didsleep = 0;
783 
784 		for (target = 0; target < ap->ap_pmcount; ++target) {
785 			at = ap->ap_ata[target];
786 
787 			/*
788 			 * Check the target state for targets behind the PM
789 			 * which have changed state.  This will adjust
790 			 * at_probe and set ATA_PORT_F_RESCAN
791 			 *
792 			 * We want to wait at least 5 seconds before probing
793 			 * a newly inserted device.  If the check status
794 			 * indicates a device is present and in need of a
795 			 * hard reset, we make sure we have slept before
796 			 * continuing.
797 			 *
798 			 * We also need to wait at least 1 second for the
799 			 * PHY state to change after insertion, if we
800 			 * haven't already waited the 5 seconds.
801 			 *
802 			 * NOTE: When pm_check_good finds a good port it
803 			 *	 typically starts us in probe state
804 			 *	 NEED_HARD_RESET rather than INIT.
805 			 */
806 			if (data & (1 << target)) {
807 				if (initial == 0 && didsleep == 0)
808 					ahci_os_sleep(1000);
809 				ahci_pm_check_good(ap, target);
810 				if (initial == 0 && didsleep == 0 &&
811 				    at->at_probe <= ATA_PROBE_NEED_HARD_RESET
812 				) {
813 					didsleep = 1;
814 					kprintf("%s: Waiting 5 seconds on insertion\n", PORTNAME(ap));
815 					ahci_os_sleep(5000);
816 				}
817 			}
818 
819 			/*
820 			 * Report hot-plug events before the probe state
821 			 * really gets hot.  Only actual events are reported
822 			 * here to reduce spew.
823 			 */
824 			if (data & (1 << target)) {
825 				kprintf("%s: HOTPLUG (PM) - ", ATANAME(ap, at));
826 				switch(at->at_probe) {
827 				case ATA_PROBE_NEED_INIT:
828 				case ATA_PROBE_NEED_HARD_RESET:
829 					kprintf("Device inserted\n");
830 					break;
831 				case ATA_PROBE_FAILED:
832 					kprintf("Device removed\n");
833 					break;
834 				default:
835 					kprintf("Device probe in progress\n");
836 					break;
837 				}
838 			}
839 
840 			/*
841 			 * Run through the state machine as necessary if
842 			 * the port is not marked failed.
843 			 *
844 			 * The state machine may stop at NEED_IDENT if
845 			 * CAM is not yet attached.
846 			 *
847 			 * Acquire exclusive access to the port while we
848 			 * are doing this.  This prevents command-completion
849 			 * from queueing commands for non-polled targets
850 			 * inbetween our probe steps.  We need to do this
851 			 * because the reset probes can generate severe PHY
852 			 * and protocol errors and soft-brick the port.
853 			 */
854 			if (at->at_probe != ATA_PROBE_FAILED &&
855 			    at->at_probe != ATA_PROBE_GOOD) {
856 				ahci_beg_exclusive_access(ap, at);
857 				if (at->at_probe == ATA_PROBE_NEED_INIT)
858 					ahci_pm_port_init(ap, at);
859 				if (at->at_probe == ATA_PROBE_NEED_HARD_RESET)
860 					ahci_port_reset(ap, at, 1);
861 				if (at->at_probe == ATA_PROBE_NEED_SOFT_RESET)
862 					ahci_port_reset(ap, at, 0);
863 				if (at->at_probe == ATA_PROBE_NEED_IDENT)
864 					ahci_cam_probe(ap, at);
865 				ahci_end_exclusive_access(ap, at);
866 			}
867 
868 			/*
869 			 * Add or remove from CAM
870 			 */
871 			if (at->at_features & ATA_PORT_F_RESCAN) {
872 				at->at_features &= ~ATA_PORT_F_RESCAN;
873 				if (at->at_probe == ATA_PROBE_FAILED) {
874 					ahci_cam_changed(ap, at, 0);
875 				} else if (at->at_probe >= ATA_PROBE_NEED_IDENT) {
876 					ahci_cam_changed(ap, at, 1);
877 				}
878 			}
879 			data &= ~(1 << target);
880 		}
881 		if (data) {
882 			kprintf("%s: WARNING (PM): extra bits set in "
883 				"EINFO: %08x\n", PORTNAME(ap), data);
884 			while (target < AHCI_MAX_PMPORTS) {
885 				ahci_pm_check_good(ap, target);
886 				++target;
887 			}
888 		}
889 	}
890 }
891 
892 
893 /*
894  * De-initialize and detach a port.
895  */
896 void
897 ahci_port_free(struct ahci_softc *sc, u_int port)
898 {
899 	struct ahci_port	*ap = sc->sc_ports[port];
900 	struct ahci_ccb		*ccb;
901 	int i;
902 
903 	/*
904 	 * Ensure port is disabled and its interrupts are all flushed.
905 	 */
906 	if (ap->ap_sc) {
907 		ahci_port_stop(ap, 1);
908 		ahci_os_stop_port(ap);
909 		ahci_pwrite(ap, AHCI_PREG_CMD, 0);
910 		ahci_pwrite(ap, AHCI_PREG_IE, 0);
911 		ahci_pwrite(ap, AHCI_PREG_IS, ahci_pread(ap, AHCI_PREG_IS));
912 		ahci_write(sc, AHCI_REG_IS, 1 << port);
913 	}
914 
915 	if (ap->ap_ccbs) {
916 		while ((ccb = ahci_get_ccb(ap)) != NULL) {
917 			if (ccb->ccb_dmamap) {
918 				bus_dmamap_destroy(sc->sc_tag_data,
919 						   ccb->ccb_dmamap);
920 				ccb->ccb_dmamap = NULL;
921 			}
922 		}
923 		if ((ccb = ap->ap_err_ccb) != NULL) {
924 			if (ccb->ccb_dmamap) {
925 				bus_dmamap_destroy(sc->sc_tag_data,
926 						   ccb->ccb_dmamap);
927 				ccb->ccb_dmamap = NULL;
928 			}
929 			ap->ap_err_ccb = NULL;
930 		}
931 		kfree(ap->ap_ccbs, M_DEVBUF);
932 		ap->ap_ccbs = NULL;
933 	}
934 
935 	if (ap->ap_dmamem_cmd_list) {
936 		ahci_dmamem_free(sc, ap->ap_dmamem_cmd_list);
937 		ap->ap_dmamem_cmd_list = NULL;
938 	}
939 	if (ap->ap_dmamem_rfis) {
940 		ahci_dmamem_free(sc, ap->ap_dmamem_rfis);
941 		ap->ap_dmamem_rfis = NULL;
942 	}
943 	if (ap->ap_dmamem_cmd_table) {
944 		ahci_dmamem_free(sc, ap->ap_dmamem_cmd_table);
945 		ap->ap_dmamem_cmd_table = NULL;
946 	}
947 	if (ap->ap_ata) {
948 		for (i = 0; i < AHCI_MAX_PMPORTS; ++i) {
949 			if (ap->ap_ata[i]) {
950 				kfree(ap->ap_ata[i], M_DEVBUF);
951 				ap->ap_ata[i] = NULL;
952 			}
953 		}
954 	}
955 	if (ap->ap_err_scratch) {
956 		kfree(ap->ap_err_scratch, M_DEVBUF);
957 		ap->ap_err_scratch = NULL;
958 	}
959 
960 	/* bus_space(9) says we dont free the subregions handle */
961 
962 	kfree(ap, M_DEVBUF);
963 	sc->sc_ports[port] = NULL;
964 }
965 
966 static
967 u_int32_t
968 ahci_pactive(struct ahci_port *ap)
969 {
970 	u_int32_t mask;
971 
972 	mask = ahci_pread(ap, AHCI_PREG_CI);
973 	if (ap->ap_sc->sc_cap & AHCI_REG_CAP_SNCQ)
974 		mask |= ahci_pread(ap, AHCI_PREG_SACT);
975 	return(mask);
976 }
977 
978 /*
979  * Start high-level command processing on the port
980  */
981 int
982 ahci_port_start(struct ahci_port *ap)
983 {
984 	u_int32_t	r, s, is, tfd;
985 
986 	/*
987 	 * FRE must be turned on before ST.  Wait for FR to go active
988 	 * before turning on ST.  The spec doesn't seem to think this
989 	 * is necessary but waiting here avoids an on-off race in the
990 	 * ahci_port_stop() code.
991 	 */
992 	r = ahci_pread(ap, AHCI_PREG_CMD);
993 	if ((r & AHCI_PREG_CMD_FRE) == 0) {
994 		r |= AHCI_PREG_CMD_FRE;
995 		ahci_pwrite(ap, AHCI_PREG_CMD, r);
996 	}
997 	if ((ap->ap_sc->sc_flags & AHCI_F_IGN_FR) == 0) {
998 		if (ahci_pwait_set(ap, AHCI_PREG_CMD, AHCI_PREG_CMD_FR)) {
999 			kprintf("%s: Cannot start FIS reception\n",
1000 				PORTNAME(ap));
1001 			return (2);
1002 		}
1003 	} else {
1004 		ahci_os_sleep(10);
1005 	}
1006 
1007 	/*
1008 	 * Turn on ST, wait for CR to come up.
1009 	 */
1010 	r |= AHCI_PREG_CMD_ST;
1011 	ahci_pwrite(ap, AHCI_PREG_CMD, r);
1012 
1013 	if ((ap->ap_sc->sc_flags & AHCI_F_IGN_CR) == 0 &&
1014 	    ahci_pwait_set_to(ap, 2000, AHCI_PREG_CMD, AHCI_PREG_CMD_CR)) {
1015 		s = ahci_pread(ap, AHCI_PREG_SERR);
1016 		is = ahci_pread(ap, AHCI_PREG_IS);
1017 		tfd = ahci_pread(ap, AHCI_PREG_TFD);
1018 		kprintf("%s: Cannot start command DMA\n"
1019 			"NCMP=%pb%i NSERR=%pb%i\n"
1020 			"NEWIS=%pb%i\n"
1021 		        "NEWTFD=%pb%i\n",
1022 			PORTNAME(ap),
1023 			AHCI_PFMT_CMD, r, AHCI_PFMT_SERR, s,
1024 			AHCI_PFMT_IS, is,
1025 			AHCI_PFMT_TFD_STS, tfd);
1026 		return (1);
1027 	}
1028 
1029 #ifdef AHCI_COALESCE
1030 	/*
1031 	 * (Re-)enable coalescing on the port.
1032 	 */
1033 	if (ap->ap_sc->sc_ccc_ports & (1 << ap->ap_num)) {
1034 		ap->ap_sc->sc_ccc_ports_cur |= (1 << ap->ap_num);
1035 		ahci_write(ap->ap_sc, AHCI_REG_CCC_PORTS,
1036 		    ap->ap_sc->sc_ccc_ports_cur);
1037 	}
1038 #endif
1039 
1040 	return (0);
1041 }
1042 
1043 /*
1044  * Stop high-level command processing on a port
1045  *
1046  * WARNING!  If the port is stopped while CR is still active our saved
1047  *	     CI/SACT will race any commands completed by the command
1048  *	     processor prior to being able to stop.  Thus we never call
1049  *	     this function unless we intend to dispose of any remaining
1050  *	     active commands.  In particular, this complicates the timeout
1051  *	     code.
1052  */
1053 int
1054 ahci_port_stop(struct ahci_port *ap, int stop_fis_rx)
1055 {
1056 	u_int32_t	r;
1057 
1058 #ifdef AHCI_COALESCE
1059 	/*
1060 	 * Disable coalescing on the port while it is stopped.
1061 	 */
1062 	if (ap->ap_sc->sc_ccc_ports & (1 << ap->ap_num)) {
1063 		ap->ap_sc->sc_ccc_ports_cur &= ~(1 << ap->ap_num);
1064 		ahci_write(ap->ap_sc, AHCI_REG_CCC_PORTS,
1065 		    ap->ap_sc->sc_ccc_ports_cur);
1066 	}
1067 #endif
1068 
1069 	/*
1070 	 * Turn off ST, then wait for CR to go off.
1071 	 */
1072 	r = ahci_pread(ap, AHCI_PREG_CMD) & ~AHCI_PREG_CMD_ICC;
1073 	if (r & AHCI_PREG_CMD_ST) {
1074 		r &= ~AHCI_PREG_CMD_ST;
1075 		ahci_pwrite(ap, AHCI_PREG_CMD, r);
1076 	}
1077 
1078 	if (ahci_pwait_clr(ap, AHCI_PREG_CMD, AHCI_PREG_CMD_CR)) {
1079 		kprintf("%s: Port bricked, unable to stop (ST)\n",
1080 			PORTNAME(ap));
1081 		return (1);
1082 	}
1083 
1084 #if 0
1085 	/*
1086 	 * Turn off FRE, then wait for FR to go off.  FRE cannot
1087 	 * be turned off until CR transitions to 0.
1088 	 */
1089 	if ((r & AHCI_PREG_CMD_FR) == 0) {
1090 		kprintf("%s: FR stopped, clear FRE for next start\n",
1091 			PORTNAME(ap));
1092 		stop_fis_rx = 2;
1093 	}
1094 #endif
1095 	if (stop_fis_rx) {
1096 		r &= ~AHCI_PREG_CMD_FRE;
1097 		ahci_pwrite(ap, AHCI_PREG_CMD, r);
1098 		if (ahci_pwait_clr(ap, AHCI_PREG_CMD, AHCI_PREG_CMD_FR)) {
1099 			kprintf("%s: Port bricked, unable to stop (FRE)\n",
1100 				PORTNAME(ap));
1101 			return (2);
1102 		}
1103 	}
1104 	return (0);
1105 }
1106 
1107 /*
1108  * AHCI command list override -> forcibly clear TFD.STS.{BSY,DRQ}
1109  */
1110 int
1111 ahci_port_clo(struct ahci_port *ap)
1112 {
1113 	struct ahci_softc		*sc = ap->ap_sc;
1114 	u_int32_t			cmd;
1115 
1116 	/* Only attempt CLO if supported by controller */
1117 	if ((sc->sc_cap & AHCI_REG_CAP_SCLO) == 0)
1118 		return (1);
1119 
1120 	/* Issue CLO */
1121 	cmd = ahci_pread(ap, AHCI_PREG_CMD) & ~AHCI_PREG_CMD_ICC;
1122 	ahci_pwrite(ap, AHCI_PREG_CMD, cmd | AHCI_PREG_CMD_CLO);
1123 
1124 	/* Wait for completion */
1125 	if (ahci_pwait_clr(ap, AHCI_PREG_CMD, AHCI_PREG_CMD_CLO)) {
1126 		kprintf("%s: CLO did not complete\n", PORTNAME(ap));
1127 		return (1);
1128 	}
1129 
1130 	return (0);
1131 }
1132 
1133 /*
1134  * Reset a port.
1135  *
1136  * If hard is 0 perform a softreset of the port.
1137  * If hard is 1 perform a hard reset of the port.
1138  *
1139  * If at is non-NULL an indirect port via a port-multiplier is being
1140  * reset, otherwise a direct port is being reset.
1141  *
1142  * NOTE: Indirect ports can only be soft-reset.
1143  */
1144 int
1145 ahci_port_reset(struct ahci_port *ap, struct ata_port *at, int hard)
1146 {
1147 	int rc;
1148 
1149 	if (hard) {
1150 		if (at)
1151 			rc = ahci_pm_hardreset(ap, at->at_target, hard);
1152 		else
1153 			rc = ahci_port_hardreset(ap, hard);
1154 	} else {
1155 		if (at)
1156 			rc = ahci_pm_softreset(ap, at->at_target);
1157 		else
1158 			rc = ahci_port_softreset(ap);
1159 	}
1160 	return(rc);
1161 }
1162 
1163 /*
1164  * AHCI soft reset, Section 10.4.1
1165  *
1166  * (at) will be NULL when soft-resetting a directly-attached device, and
1167  * non-NULL when soft-resetting a device through a port multiplier.
1168  *
1169  * This function keeps port communications intact and attempts to generate
1170  * a reset to the connected device using device commands.
1171  */
1172 int
1173 ahci_port_softreset(struct ahci_port *ap)
1174 {
1175 	struct ahci_ccb		*ccb = NULL;
1176 	struct ahci_cmd_hdr	*cmd_slot;
1177 	u_int8_t		*fis;
1178 	int			error;
1179 
1180 	error = EIO;
1181 
1182 	if (bootverbose) {
1183 		kprintf("%s: START SOFTRESET %pb%i\n", PORTNAME(ap),
1184 			AHCI_PFMT_CMD, ahci_pread(ap, AHCI_PREG_CMD));
1185 	}
1186 
1187 	DPRINTF(AHCI_D_VERBOSE, "%s: soft reset\n", PORTNAME(ap));
1188 
1189 	crit_enter();
1190 	ap->ap_flags |= AP_F_IN_RESET;
1191 	ap->ap_state = AP_S_NORMAL;
1192 
1193 	/*
1194 	 * Remember port state in cmd (main to restore start/stop)
1195 	 *
1196 	 * Idle port.
1197 	 */
1198 	if (ahci_port_stop(ap, 0)) {
1199 		kprintf("%s: failed to stop port, cannot softreset\n",
1200 			PORTNAME(ap));
1201 		goto err;
1202 	}
1203 
1204 	/*
1205 	 * Request CLO if device appears hung.
1206 	 */
1207 	if (ahci_pread(ap, AHCI_PREG_TFD) &
1208 		   (AHCI_PREG_TFD_STS_BSY | AHCI_PREG_TFD_STS_DRQ)) {
1209 		ahci_port_clo(ap);
1210 	}
1211 
1212 	/*
1213 	 * This is an attempt to clear errors so a new signature will
1214 	 * be latched.  It isn't working properly.  XXX
1215 	 */
1216 	ahci_flush_tfd(ap);
1217 	ahci_pwrite(ap, AHCI_PREG_SERR, -1);
1218 
1219 	/* Restart port */
1220 	if (ahci_port_start(ap)) {
1221 		kprintf("%s: failed to start port, cannot softreset\n",
1222 		        PORTNAME(ap));
1223 		goto err;
1224 	}
1225 
1226 	/* Check whether CLO worked */
1227 	if (ahci_pwait_clr(ap, AHCI_PREG_TFD,
1228 			       AHCI_PREG_TFD_STS_BSY | AHCI_PREG_TFD_STS_DRQ)) {
1229 		kprintf("%s: CLO %s, need port reset\n",
1230 			PORTNAME(ap),
1231 			(ahci_read(ap->ap_sc, AHCI_REG_CAP) & AHCI_REG_CAP_SCLO)
1232 			? "failed" : "unsupported");
1233 		error = EBUSY;
1234 		goto err;
1235 	}
1236 
1237 	/*
1238 	 * Prep first D2H command with SRST feature & clear busy/reset flags
1239 	 *
1240 	 * It is unclear which other fields in the FIS are used.  Just zero
1241 	 * everything.
1242 	 *
1243 	 * NOTE!  This CCB is used for both the first and second commands.
1244 	 *	  The second command must use CCB slot 1 to properly load
1245 	 *	  the signature.
1246 	 */
1247 	ccb = ahci_get_err_ccb(ap);
1248 	ccb->ccb_xa.complete = ahci_dummy_done;
1249 	ccb->ccb_xa.flags = ATA_F_POLL | ATA_F_EXCLUSIVE;
1250 	KKASSERT(ccb->ccb_slot == 1);
1251 	ccb->ccb_xa.at = NULL;
1252 	cmd_slot = ccb->ccb_cmd_hdr;
1253 
1254 	fis = ccb->ccb_cmd_table->cfis;
1255 	bzero(fis, sizeof(ccb->ccb_cmd_table->cfis));
1256 	fis[0] = ATA_FIS_TYPE_H2D;
1257 	fis[15] = ATA_FIS_CONTROL_SRST|ATA_FIS_CONTROL_4BIT;
1258 
1259 	cmd_slot->prdtl = 0;
1260 	cmd_slot->flags = htole16(5);	/* FIS length: 5 DWORDS */
1261 	cmd_slot->flags |= htole16(AHCI_CMD_LIST_FLAG_C); /* Clear busy on OK */
1262 	cmd_slot->flags |= htole16(AHCI_CMD_LIST_FLAG_R); /* Reset */
1263 
1264 	ccb->ccb_xa.state = ATA_S_PENDING;
1265 
1266 	if (ahci_poll(ccb, 1000, ahci_quick_timeout) != ATA_S_COMPLETE) {
1267 		kprintf("%s: First FIS failed\n", PORTNAME(ap));
1268 		goto err;
1269 	}
1270 
1271 	/*
1272 	 * WARNING!	TIME SENSITIVE SPACE!	WARNING!
1273 	 *
1274 	 * The two FISes are supposed to be back to back.  Don't issue other
1275 	 * commands or even delay if we can help it.
1276 	 */
1277 
1278 	/*
1279 	 * Prep second D2H command to read status and complete reset sequence
1280 	 * AHCI 10.4.1 and "Serial ATA Revision 2.6".  I can't find the ATA
1281 	 * Rev 2.6 and it is unclear how the second FIS should be set up
1282 	 * from the AHCI document.
1283 	 *
1284 	 * It is unclear which other fields in the FIS are used.  Just zero
1285 	 * everything.
1286 	 */
1287 	ccb->ccb_xa.flags = ATA_F_POLL | ATA_F_AUTOSENSE | ATA_F_EXCLUSIVE;
1288 
1289 	bzero(fis, sizeof(ccb->ccb_cmd_table->cfis));
1290 	fis[0] = ATA_FIS_TYPE_H2D;
1291 	fis[15] = ATA_FIS_CONTROL_4BIT;
1292 
1293 	cmd_slot->prdtl = 0;
1294 	cmd_slot->flags = htole16(5);	/* FIS length: 5 DWORDS */
1295 
1296 	ccb->ccb_xa.state = ATA_S_PENDING;
1297 	if (ahci_poll(ccb, 1000, ahci_quick_timeout) != ATA_S_COMPLETE) {
1298 		kprintf("%s: Second FIS failed\n", PORTNAME(ap));
1299 		goto err;
1300 	}
1301 
1302 	if (ahci_pwait_clr(ap, AHCI_PREG_TFD,
1303 			    AHCI_PREG_TFD_STS_BSY | AHCI_PREG_TFD_STS_DRQ)) {
1304 		kprintf("%s: device didn't come ready after reset, "
1305 			"TFD: 0x%pb%i\n", PORTNAME(ap),
1306 			AHCI_PFMT_TFD_STS, ahci_pread(ap, AHCI_PREG_TFD));
1307 		error = EBUSY;
1308 		goto err;
1309 	}
1310 
1311 	/*
1312 	 * If the softreset is trying to clear a BSY condition after a
1313 	 * normal portreset we assign the port type.
1314 	 *
1315 	 * If the softreset is being run first as part of the ccb error
1316 	 * processing code then report if the device signature changed
1317 	 * unexpectedly.
1318 	 */
1319 	ahci_os_sleep(100);
1320 	if (ap->ap_type == ATA_PORT_T_NONE) {
1321 		ap->ap_type = ahci_port_signature_detect(ap, NULL);
1322 	} else {
1323 		if (ahci_port_signature_detect(ap, NULL) != ap->ap_type) {
1324 			kprintf("%s: device signature unexpectedly "
1325 				"changed\n", PORTNAME(ap));
1326 			error = EBUSY; /* XXX */
1327 		}
1328 	}
1329 	error = 0;
1330 
1331 	ahci_os_sleep(3);
1332 err:
1333 	if (ccb != NULL) {
1334 		ahci_put_err_ccb(ccb);
1335 
1336 		/*
1337 		 * If the target is busy use CLO to clear the busy
1338 		 * condition.  The BSY should be cleared on the next
1339 		 * start.
1340 		 */
1341 		if (ahci_pread(ap, AHCI_PREG_TFD) &
1342 		    (AHCI_PREG_TFD_STS_BSY | AHCI_PREG_TFD_STS_DRQ)) {
1343 			ahci_port_clo(ap);
1344 		}
1345 	}
1346 
1347 	/*
1348 	 * If we failed to softreset make the port quiescent, otherwise
1349 	 * make sure the port's start/stop state matches what it was on
1350 	 * entry.
1351 	 *
1352 	 * Don't kill the port if the softreset is on a port multiplier
1353 	 * target, that would kill all the targets!
1354 	 */
1355 	if (error) {
1356 		ahci_port_hardstop(ap);
1357 		/* ap_probe set to failed */
1358 	} else {
1359 		ap->ap_probe = ATA_PROBE_NEED_IDENT;
1360 		ap->ap_pmcount = 1;
1361 		ahci_port_start(ap);
1362 	}
1363 	ap->ap_flags &= ~AP_F_IN_RESET;
1364 	crit_exit();
1365 
1366 	if (bootverbose)
1367 		kprintf("%s: END SOFTRESET\n", PORTNAME(ap));
1368 
1369 	return (error);
1370 }
1371 
1372 /*
1373  * Issue just do the core COMRESET and basic device detection on a port.
1374  *
1375  * NOTE: Only called by ahci_port_hardreset().
1376  */
1377 int
1378 ahci_comreset(struct ahci_port *ap, int *pmdetectp)
1379 {
1380 	u_int32_t cmd;
1381 	u_int32_t r;
1382 	int error;
1383 	int loop;
1384 	int retries = 0;
1385 
1386 	/*
1387 	 * Idle the port.  We must cycle FRE for certain chips that silently
1388 	 * clear FR on disconnect.  Normally we do not want to cycle FRE
1389 	 * because other chipsets might react badly to that.
1390 	 */
1391 	*pmdetectp = 0;
1392 	if (ap->ap_sc->sc_flags & AHCI_F_CYCLE_FR)
1393 		ahci_port_stop(ap, 1);
1394 	else
1395 		ahci_port_stop(ap, 0);
1396 	ap->ap_state = AP_S_NORMAL;
1397 	ahci_os_sleep(10);
1398 
1399 	/*
1400 	 * FIS-based switching must be turned off when doing a hardware
1401 	 * reset, and will be turned on again during the PM probe.
1402 	 */
1403 	if (ap->ap_flags & AP_F_FBSS_ENABLED) {
1404 		ap->ap_flags &= ~AP_F_FBSS_ENABLED;
1405 		cmd = ahci_pread(ap, AHCI_PREG_FBS);
1406 		cmd &= ~AHCI_PREG_FBS_EN;
1407 		cmd |= AHCI_PREG_FBS_DEC;
1408 		ahci_pwrite(ap, AHCI_PREG_FBS, cmd);
1409 	}
1410 
1411 	/*
1412 	 * The port may have been quiescent with its SUD bit cleared, so
1413 	 * set the SUD (spin up device).  Also POD (Power up device),
1414 	 * and issue an ICC_ACTIVE request to bring up communications.
1415 	 *
1416 	 * NOTE: I do not know if SUD is a hardware pin/low-level signal
1417 	 *	 or if it is messaged.
1418 	 */
1419 	r = ap->ap_sc->sc_ipm_disable;
1420 	ahci_pwrite(ap, AHCI_PREG_SCTL, r);
1421 
1422 	cmd = ahci_pread(ap, AHCI_PREG_CMD) & ~AHCI_PREG_CMD_ICC;
1423 	cmd |= AHCI_PREG_CMD_SUD | AHCI_PREG_CMD_POD;
1424 	cmd |= AHCI_PREG_CMD_ICC_ACTIVE;
1425 	ahci_pwrite(ap, AHCI_PREG_CMD, cmd);
1426 	ahci_pwait_clr(ap, AHCI_PREG_CMD, AHCI_PREG_CMD_ICC);
1427 
1428 	/*
1429 	 * Some parts need FIS reception enabled to be able to COMINIT at
1430 	 * all, so we can't delay FRE until port-start.  Even though that
1431 	 * isn't what the spec says.
1432 	 *
1433 	 * This is typically the first enablement of FRE, but in most cases
1434 	 * we never turn it off making this a NOP for later calls.
1435 	 */
1436 	cmd |= AHCI_PREG_CMD_FRE;
1437 	ahci_pwrite(ap, AHCI_PREG_CMD, cmd);
1438 	if ((ap->ap_sc->sc_flags & AHCI_F_IGN_FR) == 0)
1439 		ahci_pwait_set(ap, AHCI_PREG_CMD, AHCI_PREG_CMD_FR);
1440 
1441 	/*
1442 	 * Make sure that all power management is disabled.
1443 	 *
1444 	 * NOTE!  AHCI_PREG_SCTL_DET_DISABLE seems to be highly unreliable
1445 	 *	  on multiple chipsets and can brick the chipset or even
1446 	 *	  the whole PC.  Never use it.
1447 	 */
1448 	ap->ap_type = ATA_PORT_T_NONE;
1449 
1450 retry:
1451 	/*
1452 	 * Give the new power management state time to settle, then clear
1453 	 * pending status.
1454 	 */
1455 	ahci_os_sleep(1000);
1456 	ahci_flush_tfd(ap);
1457 	ahci_pwrite(ap, AHCI_PREG_SERR, -1);
1458 
1459 	/*
1460 	 * Start transmitting COMRESET.  The spec says that COMRESET must
1461 	 * be sent for at least 1ms but in actual fact numerous devices
1462 	 * appear to take much longer.  Delay a whole second here.
1463 	 *
1464 	 * In addition, SATA-3 ports can take longer to train, so even
1465 	 * SATA-2 devices which would normally detect very quickly may
1466 	 * take longer when plugged into a SATA-3 port.
1467 	 */
1468 	r |= AHCI_PREG_SCTL_DET_INIT;
1469 
1470 	switch(AhciForceGen) {
1471 	case 0:
1472 		r |= AHCI_PREG_SCTL_SPD_ANY;
1473 		break;
1474 	case 1:
1475 		r |= AHCI_PREG_SCTL_SPD_GEN1;
1476 		break;
1477 	case 2:
1478 		r |= AHCI_PREG_SCTL_SPD_GEN2;
1479 		break;
1480 	case 3:
1481 		r |= AHCI_PREG_SCTL_SPD_GEN3;
1482 		break;
1483 	default:
1484 		r |= AHCI_PREG_SCTL_SPD_GEN3;
1485 		break;
1486 	}
1487 	ahci_pwrite(ap, AHCI_PREG_SCTL, r);
1488 	ahci_os_sleep(1000);
1489 
1490 	ap->ap_flags &= ~AP_F_HARSH_REINIT;
1491 
1492 	/*
1493 	 * Only SERR_DIAG_X needs to be cleared for TFD updates, but
1494 	 * since we are hard-resetting the port we might as well clear
1495 	 * the whole enchillada.  Also be sure to clear any spurious BSY
1496 	 * prior to clearing INIT.
1497 	 *
1498 	 * Wait 1 whole second after clearing INIT before checking
1499 	 * the device detection bits in an attempt to work around chipsets
1500 	 * which do not properly mask PCS/PRCS during low level init.
1501 	 */
1502 	ahci_flush_tfd(ap);
1503 	ahci_pwrite(ap, AHCI_PREG_SERR, -1);
1504 /*	ahci_port_clo(ap);*/
1505 	ahci_os_sleep(10);
1506 
1507 	r &= ~AHCI_PREG_SCTL_SPD;
1508 	r &= ~AHCI_PREG_SCTL_DET_INIT;
1509 	r |= AHCI_PREG_SCTL_DET_NONE;
1510 	ahci_pwrite(ap, AHCI_PREG_SCTL, r);
1511 	ahci_os_sleep(1000);
1512 
1513 	/*
1514 	 * Try to determine if there is a device on the port.  This operation
1515 	 * typically runs in parallel on all ports belonging to an AHCI
1516 	 * controller.
1517 	 *
1518 	 * 3/10 of a second (loop = 300) is plenty for directly attached
1519 	 * devices, but not enough for some port multipliers, particularly
1520 	 * if powered-on cold.  Since this operation runs in parallel,
1521 	 * give us 2 seconds to detect.
1522 	 *
1523 	 * NOTE: The 10-second hot-swap delay prior to the COMRESET is not
1524 	 *	 sufficient, since the first COMRESET after a cold power-on
1525 	 *	 of a port-multiplier can take extra time.
1526 	 *
1527 	 * If we fail clear PRCS (phy detect) since we may cycled
1528 	 * the phy and probably caused another PRCS interrupt.
1529 	 */
1530 	loop = 2000;
1531 	while (loop > 0) {
1532 		r = ahci_pread(ap, AHCI_PREG_SSTS);
1533 		if (r & AHCI_PREG_SSTS_DET)
1534 			break;
1535 		loop -= ahci_os_softsleep();
1536 	}
1537 	if (loop == 0) {
1538 		ahci_pwrite(ap, AHCI_PREG_IS, AHCI_PREG_IS_PRCS);
1539 		if (bootverbose) {
1540 			kprintf("%s: Port appears to be unplugged\n",
1541 				PORTNAME(ap));
1542 		}
1543 		error = ENODEV;
1544 		goto done;
1545 	}
1546 
1547 	/*
1548 	 * There is something on the port.  Regardless of what happens
1549 	 * after this tell the caller to try to detect a port multiplier.
1550 	 *
1551 	 * Give the device 3 seconds to fully negotiate.
1552 	 */
1553 	*pmdetectp = 1;
1554 
1555 	if (ahci_pwait_eq(ap, 3000, AHCI_PREG_SSTS,
1556 			  AHCI_PREG_SSTS_DET, AHCI_PREG_SSTS_DET_DEV)) {
1557 		if (bootverbose) {
1558 			kprintf("%s: Device may be powered down\n",
1559 				PORTNAME(ap));
1560 		}
1561 		error = ENODEV;
1562 		goto done;
1563 	}
1564 
1565 	/*
1566 	 * We got something that definitely looks like a device.  Give
1567 	 * the device time to send us its first D2H FIS.  Waiting for
1568 	 * BSY to clear accomplishes this.
1569 	 *
1570 	 * The target device might be hung in a BSY state depending on
1571 	 * the order things are power cycled.  We want to retry the COMRESET
1572 	 * at least once if we find the device BSY for reliable operation.
1573 	 *
1574 	 * NOTE: A port multiplier may or may not clear BSY here,
1575 	 *	 particularly if it was previously configured and now
1576 	 *	 its cable has been unplugged and plugged back in,
1577 	 *	 and also depending on what is sitting in target 0 behind it.
1578 	 *
1579 	 * NOTE: Intel SSDs seem to have compatibility problems with Intel
1580 	 *	 mobo's on cold boots and may leave BSY set.  A single
1581 	 *	 retry works around the problem.  This is definitely a bug
1582 	 *	 with the mobo and/or the SSD and does not appear to occur
1583 	 *	 with other devices connected to the same port.
1584 	 */
1585 	ahci_flush_tfd(ap);
1586 	if (ahci_pwait_clr_to(ap, 8000, AHCI_PREG_TFD,
1587 			    AHCI_PREG_TFD_STS_BSY | AHCI_PREG_TFD_STS_DRQ)) {
1588 		kprintf("%s: Device BUSY: %pb%i\n", PORTNAME(ap),
1589 			AHCI_PFMT_TFD_STS, ahci_pread(ap, AHCI_PREG_TFD));
1590 		if (retries == 0) {
1591 			kprintf("%s: Retrying\n", PORTNAME(ap));
1592 			retries = 1;
1593 			goto retry;
1594 		}
1595 		error = EBUSY;
1596 	} else {
1597 		if (retries)
1598 			kprintf("%s: Device Unbusied after retry\n",
1599 				PORTNAME(ap));
1600 		error = 0;
1601 	}
1602 
1603 done:
1604 	ahci_flush_tfd(ap);
1605 	return error;
1606 }
1607 
1608 
1609 /*
1610  * AHCI port reset, Section 10.4.2
1611  *
1612  * This function does a hard reset of the port.  Note that the device
1613  * connected to the port could still end-up hung.
1614  */
1615 int
1616 ahci_port_hardreset(struct ahci_port *ap, int hard)
1617 {
1618 	u_int32_t data;
1619 	int	error;
1620 	int	pmdetect;
1621 
1622 	if (bootverbose)
1623 		kprintf("%s: START HARDRESET\n", PORTNAME(ap));
1624 	ap->ap_flags |= AP_F_IN_RESET;
1625 
1626 	error = ahci_comreset(ap, &pmdetect);
1627 
1628 	/*
1629 	 * We may be asked to perform a port multiplier check even if the
1630 	 * comreset failed.  This typically occurs when the PM has nothing
1631 	 * in slot 0, which can cause BSY to remain set.
1632 	 *
1633 	 * If the PM detection is successful it will override (error),
1634 	 * otherwise (error) is retained.  If an error does occur it
1635 	 * is possible that a normal device has blown up on us DUE to
1636 	 * the PM detection code, so re-run the comreset and assume
1637 	 * a normal device.
1638 	 */
1639 	if (pmdetect) {
1640 		if (ap->ap_sc->sc_cap & AHCI_REG_CAP_SPM) {
1641 			error = ahci_pm_port_probe(ap, error);
1642 			if (error) {
1643 				error = ahci_comreset(ap, &pmdetect);
1644 			}
1645 		}
1646 	}
1647 
1648 	/*
1649 	 * Finish up.
1650 	 */
1651 	ahci_os_sleep(500);
1652 
1653 	switch(error) {
1654 	case 0:
1655 		/*
1656 		 * All good, make sure the port is running and set the
1657 		 * probe state.  Ignore the signature junk (it's unreliable)
1658 		 * until we get to the softreset code.
1659 		 */
1660 		if (ahci_port_start(ap)) {
1661 			kprintf("%s: failed to start command DMA on port, "
1662 			        "disabling\n", PORTNAME(ap));
1663 			error = EBUSY;
1664 			break;
1665 		}
1666 		if (ap->ap_type == ATA_PORT_T_PM)
1667 			ap->ap_probe = ATA_PROBE_GOOD;
1668 		else
1669 			ap->ap_probe = ATA_PROBE_NEED_SOFT_RESET;
1670 		break;
1671 	case ENODEV:
1672 		/*
1673 		 * Normal device probe failure
1674 		 */
1675 		data = ahci_pread(ap, AHCI_PREG_SSTS);
1676 
1677 		switch(data & AHCI_PREG_SSTS_DET) {
1678 		case AHCI_PREG_SSTS_DET_DEV_NE:
1679 			kprintf("%s: Device not communicating\n",
1680 				PORTNAME(ap));
1681 			break;
1682 		case AHCI_PREG_SSTS_DET_PHYOFFLINE:
1683 			kprintf("%s: PHY offline\n",
1684 				PORTNAME(ap));
1685 			break;
1686 		default:
1687 			kprintf("%s: No device detected\n",
1688 				PORTNAME(ap));
1689 			break;
1690 		}
1691 		ahci_port_hardstop(ap);
1692 		break;
1693 	default:
1694 		/*
1695 		 * Abnormal probe (EBUSY)
1696 		 */
1697 		kprintf("%s: Device on port is bricked\n",
1698 			PORTNAME(ap));
1699 		ahci_port_hardstop(ap);
1700 #if 0
1701 		rc = ahci_port_reset(ap, atx, 0);
1702 		if (rc) {
1703 			kprintf("%s: Unable unbrick device\n",
1704 				PORTNAME(ap));
1705 		} else {
1706 			kprintf("%s: Successfully unbricked\n",
1707 				PORTNAME(ap));
1708 		}
1709 #endif
1710 		break;
1711 	}
1712 
1713 	/*
1714 	 * Clean up
1715 	 */
1716 	ahci_pwrite(ap, AHCI_PREG_SERR, -1);
1717 	ahci_pwrite(ap, AHCI_PREG_IS, AHCI_PREG_IS_PCS | AHCI_PREG_IS_PRCS);
1718 
1719 	ap->ap_flags &= ~AP_F_IN_RESET;
1720 
1721 	if (bootverbose)
1722 		kprintf("%s: END HARDRESET %d\n", PORTNAME(ap), error);
1723 	return (error);
1724 }
1725 
1726 /*
1727  * Hard-stop on hot-swap device removal.  See 10.10.1
1728  *
1729  * Place the port in a mode that will allow it to detect hot-swap insertions.
1730  * This is a bit imprecise because just setting-up SCTL to DET_INIT doesn't
1731  * seem to do the job.
1732  *
1733  * FIS reception is left enabled but command processing is disabled.
1734  * Cycling FIS reception (FRE) can brick ports.
1735  */
1736 void
1737 ahci_port_hardstop(struct ahci_port *ap)
1738 {
1739 	struct ahci_ccb *ccb;
1740 	struct ata_port *at;
1741 	u_int32_t r;
1742 	u_int32_t cmd;
1743 	int slot;
1744 	int i;
1745 	int serial;
1746 
1747 	/*
1748 	 * Stop the port.  We can't modify things like SUD if the port
1749 	 * is running.
1750 	 */
1751 	ap->ap_state = AP_S_FATAL_ERROR;
1752 	ap->ap_probe = ATA_PROBE_FAILED;
1753 	ap->ap_type = ATA_PORT_T_NONE;
1754 	ahci_port_stop(ap, 0);
1755 	cmd = ahci_pread(ap, AHCI_PREG_CMD);
1756 	cmd &= ~(AHCI_PREG_CMD_CLO | AHCI_PREG_CMD_PMA | AHCI_PREG_CMD_ICC);
1757 	ahci_pwrite(ap, AHCI_PREG_CMD, cmd);
1758 
1759 	/*
1760 	 * Clean up AT sub-ports on SATA port.
1761 	 */
1762 	for (i = 0; ap->ap_ata && i < AHCI_MAX_PMPORTS; ++i) {
1763 		at = ap->ap_ata[i];
1764 		at->at_type = ATA_PORT_T_NONE;
1765 		at->at_probe = ATA_PROBE_FAILED;
1766 	}
1767 
1768 	/*
1769 	 * 10.10.1 place us in the Listen state.
1770 	 *
1771 	 * 10.10.3 DET must be set to 0 and found to be 0 before
1772 	 * setting SUD to 0.
1773 	 *
1774 	 * Deactivating SUD only applies if the controller supports SUD, it
1775 	 * is a bit unclear what happens w/regards to detecting hotplug
1776 	 * if it doesn't.
1777 	 *
1778 	 * NOTE: AHCI_PREG_SCTL_SPM_* bits are not implemented by the spec
1779 	 *	 and must be zero.
1780 	 */
1781 	r = ap->ap_sc->sc_ipm_disable;
1782 	ahci_pwrite(ap, AHCI_PREG_SCTL, r);
1783 	ahci_os_sleep(10);
1784 
1785 	cmd = ahci_pread(ap, AHCI_PREG_CMD);
1786 	cmd &= ~AHCI_PREG_CMD_SUD;
1787 	ahci_pwrite(ap, AHCI_PREG_CMD, cmd);
1788 	ahci_os_sleep(10);
1789 
1790 	/*
1791 	 * 10.10.1
1792 	 *
1793 	 * Transition su to the spin-up state.  HBA shall send COMRESET and
1794 	 * begin initialization sequence (whatever that means).  Presumably
1795 	 * this is edge-triggered.  Following the spin-up state the HBA
1796 	 * will automatically transition to the Normal state.
1797 	 *
1798 	 * This only applies if the controller supports SUD.
1799 	 * NEVER use AHCI_PREG_DET_DISABLE.
1800 	 */
1801 	cmd |= AHCI_PREG_CMD_POD |
1802 	       AHCI_PREG_CMD_SUD |
1803 	       AHCI_PREG_CMD_ICC_ACTIVE;
1804 	ahci_pwrite(ap, AHCI_PREG_CMD, cmd);
1805 	ahci_pwait_clr(ap, AHCI_PREG_CMD, AHCI_PREG_CMD_ICC);
1806 
1807 	/*
1808 	 * Flush SERR_DIAG_X so the TFD can update.
1809 	 */
1810 	ahci_flush_tfd(ap);
1811 
1812 	/*
1813 	 * Clean out pending ccbs
1814 	 */
1815 restart:
1816 	while (ap->ap_active) {
1817 		slot = ffs(ap->ap_active) - 1;
1818 		ap->ap_active &= ~(1 << slot);
1819 		--ap->ap_active_cnt;
1820 		ccb = &ap->ap_ccbs[slot];
1821 		if (ccb->ccb_xa.flags & ATA_F_TIMEOUT_RUNNING) {
1822 			serial = ccb->ccb_xa.serial;
1823 			callout_cancel(&ccb->ccb_timeout);
1824 			if (serial != ccb->ccb_xa.serial) {
1825 				kprintf("%s: Warning: timeout race ccb %p\n",
1826 					PORTNAME(ap), ccb);
1827 				goto restart;
1828 			}
1829 			ccb->ccb_xa.flags &= ~ATA_F_TIMEOUT_RUNNING;
1830 		}
1831 		ap->ap_expired &= ~(1 << slot);
1832 		ccb->ccb_xa.flags &= ~(ATA_F_TIMEOUT_DESIRED |
1833 				       ATA_F_TIMEOUT_EXPIRED);
1834 		ccb->ccb_xa.state = ATA_S_TIMEOUT;
1835 		ccb->ccb_done(ccb);
1836 		ccb->ccb_xa.complete(&ccb->ccb_xa);
1837 	}
1838 	while (ap->ap_sactive) {
1839 		slot = ffs(ap->ap_sactive) - 1;
1840 		ap->ap_sactive &= ~(1 << slot);
1841 		ccb = &ap->ap_ccbs[slot];
1842 		if (ccb->ccb_xa.flags & ATA_F_TIMEOUT_RUNNING) {
1843 			serial = ccb->ccb_xa.serial;
1844 			callout_cancel(&ccb->ccb_timeout);
1845 			if (serial != ccb->ccb_xa.serial) {
1846 				kprintf("%s: Warning: timeout race ccb %p\n",
1847 					PORTNAME(ap), ccb);
1848 				goto restart;
1849 			}
1850 			ccb->ccb_xa.flags &= ~ATA_F_TIMEOUT_RUNNING;
1851 		}
1852 		ap->ap_expired &= ~(1 << slot);
1853 		ccb->ccb_xa.flags &= ~(ATA_F_TIMEOUT_DESIRED |
1854 				       ATA_F_TIMEOUT_EXPIRED);
1855 		ccb->ccb_xa.state = ATA_S_TIMEOUT;
1856 		ccb->ccb_done(ccb);
1857 		ccb->ccb_xa.complete(&ccb->ccb_xa);
1858 	}
1859 	KKASSERT(ap->ap_active_cnt == 0);
1860 
1861 	while ((ccb = TAILQ_FIRST(&ap->ap_ccb_pending)) != NULL) {
1862 		TAILQ_REMOVE(&ap->ap_ccb_pending, ccb, ccb_entry);
1863 		ccb->ccb_xa.state = ATA_S_TIMEOUT;
1864 		ccb->ccb_xa.flags &= ~ATA_F_TIMEOUT_DESIRED;
1865 		ccb->ccb_done(ccb);
1866 		ccb->ccb_xa.complete(&ccb->ccb_xa);
1867 	}
1868 
1869 	/*
1870 	 * Hot-plug device detection should work at this point.  e.g. on
1871 	 * AMD chipsets Spin-Up/Normal state is sufficient for hot-plug
1872 	 * detection and entering RESET (continuous COMRESET by setting INIT)
1873 	 * will actually prevent hot-plug detection from working properly.
1874 	 *
1875 	 * There may be cases where this will fail to work, I have some
1876 	 * additional code to place the HBA in RESET (send continuous
1877 	 * COMRESET) and hopefully get DIAG.X or other events when something
1878 	 * is plugged in.  Unfortunately this isn't universal and can
1879 	 * also prevent events from generating interrupts.
1880 	 */
1881 
1882 #if 0
1883 	/*
1884 	 * Transition us to the Reset state.  Theoretically we send a
1885 	 * continuous stream of COMRESETs in this state.
1886 	 */
1887 	r |= AHCI_PREG_SCTL_DET_INIT;
1888 	if (AhciForceGen1 & (1 << ap->ap_num)) {
1889 		kprintf("%s: Force 1.5Gbits\n", PORTNAME(ap));
1890 		r |= AHCI_PREG_SCTL_SPD_GEN1;
1891 	} else {
1892 		r |= AHCI_PREG_SCTL_SPD_ANY;
1893 	}
1894 	ahci_pwrite(ap, AHCI_PREG_SCTL, r);
1895 	ahci_os_sleep(10);
1896 
1897 	/*
1898 	 * Flush SERR_DIAG_X so the TFD can update.
1899 	 */
1900 	ahci_flush_tfd(ap);
1901 #endif
1902 	/* NOP */
1903 }
1904 
1905 /*
1906  * We can't loop on the X bit, a continuous COMINIT received will make
1907  * it loop forever.  Just assume one event has built up and clear X
1908  * so the task file descriptor can update.
1909  */
1910 void
1911 ahci_flush_tfd(struct ahci_port *ap)
1912 {
1913 	u_int32_t r;
1914 
1915 	r = ahci_pread(ap, AHCI_PREG_SERR);
1916 	if (r & AHCI_PREG_SERR_DIAG_X)
1917 		ahci_pwrite(ap, AHCI_PREG_SERR, AHCI_PREG_SERR_DIAG_X);
1918 }
1919 
1920 /*
1921  * Figure out what type of device is connected to the port, ATAPI or
1922  * DISK.
1923  */
1924 int
1925 ahci_port_signature_detect(struct ahci_port *ap, struct ata_port *at)
1926 {
1927 	u_int32_t sig;
1928 
1929 	sig = ahci_pread(ap, AHCI_PREG_SIG);
1930 	if (bootverbose)
1931 		kprintf("%s: SIG %08x\n", ATANAME(ap, at), sig);
1932 	if ((sig & 0xffff0000) == (SATA_SIGNATURE_ATAPI & 0xffff0000)) {
1933 		return(ATA_PORT_T_ATAPI);
1934 	} else if ((sig & 0xffff0000) ==
1935 		 (SATA_SIGNATURE_PORT_MULTIPLIER & 0xffff0000)) {
1936 		return(ATA_PORT_T_PM);
1937 	} else {
1938 		return(ATA_PORT_T_DISK);
1939 	}
1940 }
1941 
1942 /*
1943  * Load the DMA descriptor table for a CCB's buffer.
1944  */
1945 int
1946 ahci_load_prdt(struct ahci_ccb *ccb)
1947 {
1948 	struct ahci_port		*ap = ccb->ccb_port;
1949 	struct ahci_softc		*sc = ap->ap_sc;
1950 	struct ata_xfer			*xa = &ccb->ccb_xa;
1951 	struct ahci_prdt		*prdt = ccb->ccb_cmd_table->prdt;
1952 	bus_dmamap_t			dmap = ccb->ccb_dmamap;
1953 	struct ahci_cmd_hdr		*cmd_slot = ccb->ccb_cmd_hdr;
1954 	int				error;
1955 
1956 	if (xa->datalen == 0) {
1957 		ccb->ccb_cmd_hdr->prdtl = 0;
1958 		return (0);
1959 	}
1960 
1961 	error = bus_dmamap_load(sc->sc_tag_data, dmap,
1962 				xa->data, xa->datalen,
1963 				ahci_load_prdt_callback,
1964 				&prdt,
1965 				((xa->flags & ATA_F_NOWAIT) ?
1966 				    BUS_DMA_NOWAIT : BUS_DMA_WAITOK));
1967 	if (error != 0) {
1968 		kprintf("%s: error %d loading dmamap\n", PORTNAME(ap), error);
1969 		return (1);
1970 	}
1971 #if 0
1972 	if (xa->flags & ATA_F_PIO)
1973 		prdt->flags |= htole32(AHCI_PRDT_FLAG_INTR);
1974 #endif
1975 
1976 	cmd_slot->prdtl = htole16(prdt - ccb->ccb_cmd_table->prdt + 1);
1977 
1978 	if (xa->flags & ATA_F_READ)
1979 		bus_dmamap_sync(sc->sc_tag_data, dmap, BUS_DMASYNC_PREREAD);
1980 	if (xa->flags & ATA_F_WRITE)
1981 		bus_dmamap_sync(sc->sc_tag_data, dmap, BUS_DMASYNC_PREWRITE);
1982 
1983 	return (0);
1984 }
1985 
1986 /*
1987  * Callback from BUSDMA system to load the segment list.  The passed segment
1988  * list is a temporary structure.
1989  */
1990 static
1991 void
1992 ahci_load_prdt_callback(void *info, bus_dma_segment_t *segs, int nsegs,
1993 			int error)
1994 {
1995 	struct ahci_prdt *prd = *(void **)info;
1996 	u_int64_t addr;
1997 
1998 	KKASSERT(nsegs <= AHCI_MAX_PRDT);
1999 
2000 	while (nsegs) {
2001 		addr = segs->ds_addr;
2002 		prd->dba_hi = htole32((u_int32_t)(addr >> 32));
2003 		prd->dba_lo = htole32((u_int32_t)addr);
2004 		prd->flags = htole32(segs->ds_len - 1);
2005 		--nsegs;
2006 		if (nsegs)
2007 			++prd;
2008 		++segs;
2009 	}
2010 	*(void **)info = prd;	/* return last valid segment */
2011 }
2012 
2013 void
2014 ahci_unload_prdt(struct ahci_ccb *ccb)
2015 {
2016 	struct ahci_port		*ap = ccb->ccb_port;
2017 	struct ahci_softc		*sc = ap->ap_sc;
2018 	struct ata_xfer			*xa = &ccb->ccb_xa;
2019 	bus_dmamap_t			dmap = ccb->ccb_dmamap;
2020 
2021 	if (xa->datalen != 0) {
2022 		if (xa->flags & ATA_F_READ) {
2023 			bus_dmamap_sync(sc->sc_tag_data, dmap,
2024 					BUS_DMASYNC_POSTREAD);
2025 		}
2026 		if (xa->flags & ATA_F_WRITE) {
2027 			bus_dmamap_sync(sc->sc_tag_data, dmap,
2028 					BUS_DMASYNC_POSTWRITE);
2029 		}
2030 		bus_dmamap_unload(sc->sc_tag_data, dmap);
2031 
2032 		/*
2033 		 * prdbc is only updated by hardware for non-NCQ commands.
2034 		 */
2035 		if (ccb->ccb_xa.flags & ATA_F_NCQ) {
2036 			xa->resid = 0;
2037 		} else {
2038 			if (ccb->ccb_cmd_hdr->prdbc == 0 &&
2039 			    ccb->ccb_xa.state == ATA_S_COMPLETE) {
2040 				kprintf("%s: WARNING!  Unload prdbc resid "
2041 					"was zero! tag=%d\n",
2042 					ATANAME(ap, xa->at), ccb->ccb_slot);
2043 			}
2044 			xa->resid = xa->datalen -
2045 			    le32toh(ccb->ccb_cmd_hdr->prdbc);
2046 		}
2047 	}
2048 }
2049 
2050 /*
2051  * Start a command and poll for completion.
2052  *
2053  * timeout is in ms and only counts once the command gets on-chip.
2054  *
2055  * Returns ATA_S_* state, compare against ATA_S_COMPLETE to determine
2056  * that no error occured.
2057  *
2058  * NOTE: If the caller specifies a NULL timeout function the caller is
2059  *	 responsible for clearing hardware state on failure, but we will
2060  *	 deal with removing the ccb from any pending queue.
2061  *
2062  * NOTE: NCQ should never be used with this function.
2063  *
2064  * NOTE: If the port is in a failed state and stopped we do not try
2065  *	 to activate the ccb.
2066  */
2067 int
2068 ahci_poll(struct ahci_ccb *ccb, int timeout,
2069 	  void (*timeout_fn)(struct ahci_ccb *))
2070 {
2071 	struct ahci_port *ap = ccb->ccb_port;
2072 
2073 	if (ccb->ccb_port->ap_state == AP_S_FATAL_ERROR) {
2074 		ccb->ccb_xa.state = ATA_S_ERROR;
2075 		return(ccb->ccb_xa.state);
2076 	}
2077 	crit_enter();
2078 #if 0
2079 	kprintf("%s: Start command %02x tag=%d\n",
2080 		ATANAME(ccb->ccb_port, ccb->ccb_xa.at),
2081 		ccb->ccb_xa.fis->command, ccb->ccb_slot);
2082 #endif
2083 	ahci_start(ccb);
2084 
2085 	do {
2086 		ahci_port_intr(ap, 1);
2087 		switch(ccb->ccb_xa.state) {
2088 		case ATA_S_ONCHIP:
2089 			timeout -= ahci_os_softsleep();
2090 			break;
2091 		case ATA_S_PENDING:
2092 			timeout -= ahci_os_softsleep();
2093 			ahci_check_active_timeouts(ap);
2094 			break;
2095 		default:
2096 			crit_exit();
2097 			return (ccb->ccb_xa.state);
2098 		}
2099 	} while (timeout > 0);
2100 
2101 	if ((ccb->ccb_xa.flags & ATA_F_SILENT) == 0) {
2102 		kprintf("%s: Poll timeout slot %d "
2103 			"CMD: %pb%i TFD: 0x%pb%i SERR: %pb%i\n",
2104 			ATANAME(ap, ccb->ccb_xa.at), ccb->ccb_slot,
2105 			AHCI_PFMT_CMD, ahci_pread(ap, AHCI_PREG_CMD),
2106 			AHCI_PFMT_TFD_STS, ahci_pread(ap, AHCI_PREG_TFD),
2107 			AHCI_PFMT_SERR, ahci_pread(ap, AHCI_PREG_SERR));
2108 	}
2109 
2110 	timeout_fn(ccb);
2111 
2112 	crit_exit();
2113 
2114 	return(ccb->ccb_xa.state);
2115 }
2116 
2117 /*
2118  * When polling we have to check if the currently active CCB(s)
2119  * have timed out as the callout will be deadlocked while we
2120  * hold the port lock.
2121  */
2122 void
2123 ahci_check_active_timeouts(struct ahci_port *ap)
2124 {
2125 	struct ahci_ccb *ccb;
2126 	u_int32_t mask;
2127 	int tag;
2128 
2129 	mask = ap->ap_active | ap->ap_sactive;
2130 	while (mask) {
2131 		tag = ffs(mask) - 1;
2132 		mask &= ~(1 << tag);
2133 		ccb = &ap->ap_ccbs[tag];
2134 		if (ccb->ccb_xa.flags & ATA_F_TIMEOUT_EXPIRED) {
2135 			ahci_ata_cmd_timeout(ccb);
2136 		}
2137 	}
2138 }
2139 
2140 static
2141 __inline
2142 void
2143 ahci_start_timeout(struct ahci_ccb *ccb)
2144 {
2145 	if (ccb->ccb_xa.flags & ATA_F_TIMEOUT_DESIRED) {
2146 		ccb->ccb_xa.flags |= ATA_F_TIMEOUT_RUNNING;
2147 		callout_reset(&ccb->ccb_timeout,
2148 			      (ccb->ccb_xa.timeout * hz + 999) / 1000,
2149 			      ahci_ata_cmd_timeout_unserialized, ccb);
2150 	}
2151 }
2152 
2153 void
2154 ahci_start(struct ahci_ccb *ccb)
2155 {
2156 	struct ahci_port		*ap = ccb->ccb_port;
2157 	struct ahci_softc		*sc = ap->ap_sc;
2158 
2159 	KKASSERT(ccb->ccb_xa.state == ATA_S_PENDING);
2160 
2161 	/* Zero transferred byte count before transfer */
2162 	ccb->ccb_cmd_hdr->prdbc = 0;
2163 
2164 	/* Sync command list entry and corresponding command table entry */
2165 	bus_dmamap_sync(sc->sc_tag_cmdh,
2166 			AHCI_DMA_MAP(ap->ap_dmamem_cmd_list),
2167 			BUS_DMASYNC_PREWRITE);
2168 	bus_dmamap_sync(sc->sc_tag_cmdt,
2169 			AHCI_DMA_MAP(ap->ap_dmamem_cmd_table),
2170 			BUS_DMASYNC_PREWRITE);
2171 
2172 	/* Prepare RFIS area for write by controller */
2173 	bus_dmamap_sync(sc->sc_tag_rfis,
2174 			AHCI_DMA_MAP(ap->ap_dmamem_rfis),
2175 			BUS_DMASYNC_PREREAD);
2176 
2177 	/*
2178 	 * There's no point trying to optimize this, it only shaves a few
2179 	 * nanoseconds so just queue the command and call our generic issue.
2180 	 */
2181 	ahci_issue_pending_commands(ap, ccb);
2182 }
2183 
2184 /*
2185  * While holding the port lock acquire exclusive access to the port.
2186  *
2187  * This is used when running the state machine to initialize and identify
2188  * targets over a port multiplier.  Setting exclusive access prevents
2189  * ahci_port_intr() from activating any requests sitting on the pending
2190  * queue.
2191  */
2192 void
2193 ahci_beg_exclusive_access(struct ahci_port *ap, struct ata_port *at)
2194 {
2195 	KKASSERT((ap->ap_flags & AP_F_EXCLUSIVE_ACCESS) == 0);
2196 	ap->ap_flags |= AP_F_EXCLUSIVE_ACCESS;
2197 	while (ap->ap_active || ap->ap_sactive) {
2198 		ahci_port_intr(ap, 1);
2199 		ahci_os_softsleep();
2200 	}
2201 }
2202 
2203 void
2204 ahci_end_exclusive_access(struct ahci_port *ap, struct ata_port *at)
2205 {
2206 	KKASSERT((ap->ap_flags & AP_F_EXCLUSIVE_ACCESS) != 0);
2207 	ap->ap_flags &= ~AP_F_EXCLUSIVE_ACCESS;
2208 	ahci_issue_pending_commands(ap, NULL);
2209 }
2210 
2211 /*
2212  * If ccb is not NULL enqueue and/or issue it.
2213  *
2214  * If ccb is NULL issue whatever we can from the queue.  However, nothing
2215  * new is issued if the exclusive access flag is set or expired ccb's are
2216  * present.
2217  *
2218  * If existing commands are still active (ap_active/ap_sactive) we can only
2219  * issue matching new commands.
2220  */
2221 void
2222 ahci_issue_pending_commands(struct ahci_port *ap, struct ahci_ccb *ccb)
2223 {
2224 	u_int32_t	mask;
2225 	int		limit;
2226 	struct ata_port	*ccb_at;
2227 
2228 	/*
2229 	 * Enqueue the ccb.
2230 	 *
2231 	 * If just running the queue and in exclusive access mode we
2232 	 * just return.  Also in this case if there are any expired ccb's
2233 	 * we want to clear the queue so the port can be safely stopped.
2234 	 */
2235 	if (ccb) {
2236 		TAILQ_INSERT_TAIL(&ap->ap_ccb_pending, ccb, ccb_entry);
2237 	} else if ((ap->ap_flags & AP_F_EXCLUSIVE_ACCESS) || ap->ap_expired) {
2238 		return;
2239 	}
2240 
2241 	/*
2242 	 * Pull the next ccb off the queue and run it if possible.
2243 	 *
2244 	 * The error CCB supercedes all normal queue operations and
2245 	 * implies exclusive access while the error CCB is active.
2246 	 */
2247 	if (ccb != ap->ap_err_ccb) {
2248 		if ((ccb = TAILQ_FIRST(&ap->ap_ccb_pending)) == NULL)
2249 			return;
2250 		if (ap->ap_flags & AP_F_ERR_CCB_RESERVED) {
2251 			kprintf("DELAY CCB slot %d\n", ccb->ccb_slot);
2252 			return;
2253 		}
2254 	}
2255 
2256 	/*
2257 	 * Handle exclusivity requirements.
2258 	 *
2259 	 * ATA_F_EXCLUSIVE is used when we want to be the only command
2260 	 * running.
2261 	 *
2262 	 * ATA_F_AUTOSENSE is used when we want the D2H rfis loaded
2263 	 * back into the ccb on a normal (non-errored) command completion.
2264 	 * For example, for PM requests to target 15.  Because the AHCI
2265 	 * spec does not stop the command processor and has only one rfis
2266 	 * area (for non-FBSS anyway), AUTOSENSE currently implies EXCLUSIVE.
2267 	 * Otherwise multiple completions can destroy the rfis data before
2268 	 * we have a chance to copy it.
2269 	 */
2270 	if (ap->ap_active & ~ap->ap_expired) {
2271 		/*
2272 		 * There may be multiple ccb's already running,
2273 		 * if any are running and ap_run_flags sets
2274 		 * one of these flags then we know only one is
2275 		 * running.
2276 		 *
2277 		 * XXX Current AUTOSENSE code forces exclusivity
2278 		 *     to simplify the code.
2279 		 */
2280 		if (ap->ap_run_flags &
2281 		    (ATA_F_EXCLUSIVE | ATA_F_AUTOSENSE)) {
2282 			return;
2283 		}
2284 
2285 		if (ccb->ccb_xa.flags &
2286 		    (ATA_F_EXCLUSIVE | ATA_F_AUTOSENSE)) {
2287 			return;
2288 		}
2289 	}
2290 
2291 	if (ccb->ccb_xa.flags & ATA_F_NCQ) {
2292 		/*
2293 		 * The next command is a NCQ command and can be issued as
2294 		 * long as currently active commands are not standard.
2295 		 */
2296 		if (ap->ap_active) {
2297 			KKASSERT(ap->ap_active_cnt > 0);
2298 			return;
2299 		}
2300 		KKASSERT(ap->ap_active_cnt == 0);
2301 
2302 		mask = 0;
2303 		do {
2304 			TAILQ_REMOVE(&ap->ap_ccb_pending, ccb, ccb_entry);
2305 			KKASSERT((mask & (1 << ccb->ccb_slot)) == 0);
2306 			mask |= 1 << ccb->ccb_slot;
2307 			KKASSERT(ccb->ccb_xa.state == ATA_S_PENDING);
2308 			KKASSERT(ccb == &ap->ap_ccbs[ccb->ccb_slot]);
2309 			ccb->ccb_xa.state = ATA_S_ONCHIP;
2310 			ahci_start_timeout(ccb);
2311 			ap->ap_run_flags = ccb->ccb_xa.flags;
2312 
2313 			ccb_at = ccb->ccb_xa.at;
2314 			if (ap->ap_flags & AP_F_FBSS_ENABLED) {
2315 				ap->ap_sactive |= mask;
2316 				ahci_pwrite(ap, AHCI_PREG_SACT, mask);
2317 				if (ccb_at) {
2318 					ahci_pwrite(ap, AHCI_PREG_FBS,
2319 						(ccb_at->at_target <<
2320 						 AHCI_PREG_FBS_DEV_SHIFT) |
2321 						AHCI_PREG_FBS_EN);
2322 				} else {
2323 					ahci_pwrite(ap, AHCI_PREG_FBS,
2324 						AHCI_PREG_FBS_EN);
2325 				}
2326 				ahci_pwrite(ap, AHCI_PREG_CI, mask);
2327 				mask = 0;
2328 			}
2329 			ccb = TAILQ_FIRST(&ap->ap_ccb_pending);
2330 		} while (ccb && (ccb->ccb_xa.flags & ATA_F_NCQ) &&
2331 			 (ap->ap_run_flags &
2332 			     (ATA_F_EXCLUSIVE | ATA_F_AUTOSENSE)) == 0);
2333 
2334 		KKASSERT(((ap->ap_active | ap->ap_sactive) & mask) == 0);
2335 
2336 		if (mask) {
2337 			ap->ap_sactive |= mask;
2338 			ahci_pwrite(ap, AHCI_PREG_SACT, mask);
2339 			ahci_pwrite(ap, AHCI_PREG_CI, mask);
2340 		}
2341 	} else {
2342 		/*
2343 		 * The next command is a standard command and can be issued
2344 		 * as long as currently active commands are not NCQ.
2345 		 *
2346 		 * We limit ourself to 1 command if we have a port multiplier,
2347 		 * (at least without FBSS support), otherwise timeouts on
2348 		 * one port can race completions on other ports (see
2349 		 * ahci_ata_cmd_timeout() for more information).
2350 		 *
2351 		 * If not on a port multiplier generally allow up to 4
2352 		 * standard commands to be enqueued.  Remember that the
2353 		 * command processor will still process them sequentially.
2354 		 */
2355 		if (ap->ap_sactive)
2356 			return;
2357 		if (ap->ap_type == ATA_PORT_T_PM &&
2358 		    (ap->ap_flags & AP_F_FBSS_ENABLED) == 0) {
2359 			limit = 1;
2360 		} else if (ap->ap_sc->sc_ncmds > 4) {
2361 			limit = 4;
2362 		} else {
2363 			limit = 2;
2364 		}
2365 
2366 		while (ap->ap_active_cnt < limit && ccb &&
2367 		       (ccb->ccb_xa.flags & ATA_F_NCQ) == 0) {
2368 			ccb_at = ccb->ccb_xa.at;
2369 			TAILQ_REMOVE(&ap->ap_ccb_pending, ccb, ccb_entry);
2370 			KKASSERT(((ap->ap_active | ap->ap_sactive) &
2371 				  (1 << ccb->ccb_slot)) == 0);
2372 			ap->ap_active |= 1 << ccb->ccb_slot;
2373 			ap->ap_active_cnt++;
2374 			ap->ap_run_flags = ccb->ccb_xa.flags;
2375 			ccb->ccb_xa.state = ATA_S_ONCHIP;
2376 			ahci_start_timeout(ccb);
2377 			if (ap->ap_flags & AP_F_FBSS_ENABLED) {
2378 				if (ccb_at) {
2379 					ahci_pwrite(ap, AHCI_PREG_FBS,
2380 						(ccb_at->at_target <<
2381 						 AHCI_PREG_FBS_DEV_SHIFT) |
2382 						AHCI_PREG_FBS_EN);
2383 				} else {
2384 					ahci_pwrite(ap, AHCI_PREG_FBS,
2385 						AHCI_PREG_FBS_EN);
2386 				}
2387 			}
2388 			ahci_pwrite(ap, AHCI_PREG_CI, 1 << ccb->ccb_slot);
2389 			if ((ap->ap_run_flags &
2390 			    (ATA_F_EXCLUSIVE | ATA_F_AUTOSENSE)) == 0) {
2391 				break;
2392 			}
2393 			ccb = TAILQ_FIRST(&ap->ap_ccb_pending);
2394 			if (ccb && (ccb->ccb_xa.flags &
2395 				    (ATA_F_EXCLUSIVE | ATA_F_AUTOSENSE))) {
2396 				break;
2397 			}
2398 		}
2399 	}
2400 }
2401 
2402 void
2403 ahci_intr(void *arg)
2404 {
2405 	struct ahci_softc	*sc = arg;
2406 	struct ahci_port	*ap;
2407 	u_int32_t		is;
2408 	u_int32_t		ack;
2409 	int			port;
2410 
2411 	/*
2412 	 * Check if the master enable is up, and whether any interrupts are
2413 	 * pending.
2414 	 */
2415 	if ((sc->sc_flags & AHCI_F_INT_GOOD) == 0)
2416 		return;
2417 	is = ahci_read(sc, AHCI_REG_IS);
2418 	if (is == 0 || is == 0xffffffff) {
2419 		return;
2420 	}
2421 	is &= sc->sc_portmask;
2422 
2423 #ifdef AHCI_COALESCE
2424 	/* Check coalescing interrupt first */
2425 	if (is & sc->sc_ccc_mask) {
2426 		DPRINTF(AHCI_D_INTR, "%s: command coalescing interrupt\n",
2427 		    DEVNAME(sc));
2428 		is &= ~sc->sc_ccc_mask;
2429 		is |= sc->sc_ccc_ports_cur;
2430 	}
2431 #endif
2432 
2433 	/*
2434 	 * Process interrupts for each port in a non-blocking fashion.
2435 	 *
2436 	 * The global IS bit is supposed to be forced on if any unmasked
2437 	 * port interrupt is pending, even if we clear it.
2438 	 *
2439 	 * However it would appear that it is simply latched on some parts,
2440 	 * which means we have to clear it BEFORE processing the status bits
2441 	 * to avoid races.
2442 	 */
2443 	ahci_write(sc, AHCI_REG_IS, is);
2444 	for (ack = 0; is; is &= ~(1 << port)) {
2445 		port = ffs(is) - 1;
2446 		ack |= 1 << port;
2447 
2448 		ap = sc->sc_ports[port];
2449 		if (ap == NULL)
2450 			continue;
2451 
2452 		if (ahci_os_lock_port_nb(ap) == 0) {
2453 			ahci_port_intr(ap, 0);
2454 			ahci_os_unlock_port(ap);
2455 		} else {
2456 			ahci_pwrite(ap, AHCI_PREG_IE, 0);
2457 			ahci_os_signal_port_thread(ap, AP_SIGF_PORTINT);
2458 		}
2459 	}
2460 }
2461 
2462 /*
2463  * Core called from helper thread.
2464  */
2465 void
2466 ahci_port_thread_core(struct ahci_port *ap, int mask)
2467 {
2468 	/*
2469 	 * Process any expired timedouts.
2470 	 */
2471 	ahci_os_lock_port(ap);
2472 	if (mask & AP_SIGF_TIMEOUT) {
2473 		ahci_check_active_timeouts(ap);
2474 	}
2475 
2476 	/*
2477 	 * Process port interrupts which require a higher level of
2478 	 * intervention.
2479 	 */
2480 	if (mask & AP_SIGF_PORTINT) {
2481 		ahci_port_intr(ap, 1);
2482 		ahci_port_interrupt_enable(ap);
2483 	} else if (ap->ap_probe != ATA_PROBE_FAILED) {
2484 		ahci_port_intr(ap, 1);
2485 		ahci_port_interrupt_enable(ap);
2486 	}
2487 	ahci_os_unlock_port(ap);
2488 }
2489 
2490 /*
2491  * Core per-port interrupt handler.
2492  *
2493  * If blockable is 0 we cannot call ahci_os_sleep() at all and we can only
2494  * deal with normal command completions which do not require blocking.
2495  */
2496 void
2497 ahci_port_intr(struct ahci_port *ap, int blockable)
2498 {
2499 	struct ahci_softc	*sc = ap->ap_sc;
2500 	u_int32_t		is, ci_saved, ci_masked;
2501 	int			slot;
2502 	int			stopped = 0;
2503 	struct ahci_ccb		*ccb = NULL;
2504 	struct ata_port		*ccb_at = NULL;
2505 	volatile u_int32_t	*active;
2506 	const u_int32_t		blockable_mask = AHCI_PREG_IS_TFES |
2507 						 AHCI_PREG_IS_IFS |
2508 						 AHCI_PREG_IS_PCS |
2509 						 AHCI_PREG_IS_PRCS |
2510 						 AHCI_PREG_IS_HBFS |
2511 						 AHCI_PREG_IS_OFS |
2512 						 AHCI_PREG_IS_UFS;
2513 
2514 	enum { NEED_NOTHING, NEED_REINIT, NEED_RESTART,
2515 	       NEED_HOTPLUG_INSERT, NEED_HOTPLUG_REMOVE } need = NEED_NOTHING;
2516 
2517 	/*
2518 	 * All basic command completions are always processed.
2519 	 */
2520 	is = ahci_pread(ap, AHCI_PREG_IS);
2521 	if (is & AHCI_PREG_IS_DPS)
2522 		ahci_pwrite(ap, AHCI_PREG_IS, is & AHCI_PREG_IS_DPS);
2523 
2524 	/*
2525 	 * If we can't block then we can't handle these here.  Disable
2526 	 * the interrupts in question so we don't live-lock, the helper
2527 	 * thread will re-enable them.
2528 	 *
2529 	 * If the port is in a completely failed state we do not want
2530 	 * to drop through to failed-command-processing if blockable is 0,
2531 	 * just let the thread deal with it all.
2532 	 *
2533 	 * Otherwise we fall through and still handle DHRS and any commands
2534 	 * which completed normally.  Even if we are errored we haven't
2535 	 * stopped the port yet so CI/SACT are still good.
2536 	 */
2537 	if (blockable == 0) {
2538 		if (ap->ap_state == AP_S_FATAL_ERROR) {
2539 			ahci_pwrite(ap, AHCI_PREG_IE, 0);
2540 			ahci_os_signal_port_thread(ap, AP_SIGF_PORTINT);
2541 			return;
2542 		}
2543 		if (is & blockable_mask) {
2544 			ahci_pwrite(ap, AHCI_PREG_IE, 0);
2545 			ahci_os_signal_port_thread(ap, AP_SIGF_PORTINT);
2546 			return;
2547 		}
2548 	}
2549 
2550 	/*
2551 	 * Either NCQ or non-NCQ commands will be active, never both.
2552 	 */
2553 	if (ap->ap_sactive) {
2554 		KKASSERT(ap->ap_active == 0);
2555 		KKASSERT(ap->ap_active_cnt == 0);
2556 		ci_saved = ahci_pread(ap, AHCI_PREG_SACT);
2557 		active = &ap->ap_sactive;
2558 	} else {
2559 		ci_saved = ahci_pread(ap, AHCI_PREG_CI);
2560 		active = &ap->ap_active;
2561 	}
2562 	KKASSERT(!(ap->ap_sactive && ap->ap_active));
2563 	KKASSERT((ci_saved & (ap->ap_sactive | ap->ap_active)) == ci_saved);
2564 #if 0
2565 	kprintf("CHECK act=%08x/%08x sact=%08x/%08x\n",
2566 		ap->ap_active, ahci_pread(ap, AHCI_PREG_CI),
2567 		ap->ap_sactive, ahci_pread(ap, AHCI_PREG_SACT));
2568 #endif
2569 
2570 	/*
2571 	 * Ignore AHCI_PREG_IS_PRCS when link power management is on
2572 	 */
2573 	if (ap->link_pwr_mgmt != AHCI_LINK_PWR_MGMT_NONE) {
2574 		is &= ~AHCI_PREG_IS_PRCS;
2575 		ahci_pwrite(ap, AHCI_PREG_SERR,
2576 			    AHCI_PREG_SERR_DIAG_N | AHCI_PREG_SERR_DIAG_W);
2577 	}
2578 
2579 	/*
2580 	 * Command failed (blockable).
2581 	 *
2582 	 * See AHCI 1.1 spec 6.2.2.1 and 6.2.2.2.
2583 	 *
2584 	 * This stops command processing.
2585 	 */
2586 	if (is & AHCI_PREG_IS_TFES) {
2587 		u_int32_t tfd, serr;
2588 		int	err_slot;
2589 
2590 process_error:
2591 		tfd = ahci_pread(ap, AHCI_PREG_TFD);
2592 		serr = ahci_pread(ap, AHCI_PREG_SERR);
2593 
2594 		/*
2595 		 * Load the error slot and restart command processing.
2596 		 * CLO if we need to.  The error slot may not be valid.
2597 		 * MUST BE DONE BEFORE CLEARING ST!
2598 		 *
2599 		 * Cycle ST.
2600 		 *
2601 		 * It is unclear but we may have to clear SERR to reenable
2602 		 * error processing.
2603 		 */
2604 		err_slot = AHCI_PREG_CMD_CCS(ahci_pread(ap, AHCI_PREG_CMD));
2605 		ahci_pwrite(ap, AHCI_PREG_IS, AHCI_PREG_IS_TFES |
2606 					      AHCI_PREG_IS_PSS |
2607 					      AHCI_PREG_IS_DHRS |
2608 					      AHCI_PREG_IS_SDBS);
2609 		is &= ~(AHCI_PREG_IS_TFES | AHCI_PREG_IS_PSS |
2610 			AHCI_PREG_IS_DHRS | AHCI_PREG_IS_SDBS);
2611 		ahci_pwrite(ap, AHCI_PREG_SERR, serr);
2612 		ahci_port_stop(ap, 0);
2613 		ahci_os_hardsleep(10);
2614 		if (tfd & (AHCI_PREG_TFD_STS_BSY | AHCI_PREG_TFD_STS_DRQ)) {
2615 			kprintf("%s: Issuing CLO\n", PORTNAME(ap));
2616 			ahci_port_clo(ap);
2617 		}
2618 
2619 		/*
2620 		 * We are now stopped and need a restart.  If we have to
2621 		 * process a NCQ error we will temporarily start and then
2622 		 * stop the port again, so this condition holds.
2623 		 */
2624 		stopped = 1;
2625 		need = NEED_RESTART;
2626 
2627 		/*
2628 		 * ATAPI errors are fairly common from probing, just
2629 		 * report disk errors or if bootverbose is on.
2630 		 */
2631 		if (bootverbose || ap->ap_type != ATA_PORT_T_ATAPI) {
2632 			kprintf("%s: TFES slot %d ci_saved = %08x\n",
2633 				PORTNAME(ap), err_slot, ci_saved);
2634 		}
2635 
2636 		/*
2637 		 * If we got an error on an error CCB just complete it
2638 		 * with an error.  ci_saved has the mask to restart
2639 		 * (the err_ccb will be removed from it by finish_error).
2640 		 */
2641 		if (ap->ap_flags & AP_F_ERR_CCB_RESERVED) {
2642 			err_slot = ap->ap_err_ccb->ccb_slot;
2643 			goto finish_error;
2644 		}
2645 
2646 		/*
2647 		 * If NCQ commands were active get the error slot from
2648 		 * the log page.  NCQ is not supported for PM's so this
2649 		 * is a direct-attached target.
2650 		 *
2651 		 * Otherwise if no commands were active we have a problem.
2652 		 *
2653 		 * Otherwise if the error slot is bad we have a problem.
2654 		 *
2655 		 * Otherwise process the error for the slot.
2656 		 */
2657 		if (ap->ap_sactive) {
2658 			ahci_port_start(ap);
2659 			err_slot = ahci_port_read_ncq_error(ap, 0);
2660 			ahci_port_stop(ap, 0);
2661 		} else if (ap->ap_active == 0) {
2662 			kprintf("%s: TFES with no commands pending\n",
2663 				PORTNAME(ap));
2664 			err_slot = -1;
2665 		} else if (err_slot < 0 || err_slot >= ap->ap_sc->sc_ncmds) {
2666 			kprintf("%s: bad error slot %d\n",
2667 				PORTNAME(ap), err_slot);
2668 			err_slot = -1;
2669 		} else {
2670 			ccb = &ap->ap_ccbs[err_slot];
2671 
2672 			/*
2673 			 * Validate the errored ccb.  Note that ccb_at can
2674 			 * be NULL for direct-attached ccb's.
2675 			 *
2676 			 * Copy received taskfile data from the RFIS.
2677 			 */
2678 			if (ccb->ccb_xa.state == ATA_S_ONCHIP) {
2679 				int fis_target;
2680 				uint32_t bytes;
2681 				intmax_t offset;
2682 				struct ata_fis_d2h *rfis;
2683 
2684 				ccb_at = ccb->ccb_xa.at;
2685 				if (ccb_at &&
2686 				    (ap->ap_flags & AP_F_FBSS_ENABLED))
2687 					fis_target = ccb_at->at_target;
2688 				else
2689 					fis_target = 0;
2690 
2691 				memcpy(&ccb->ccb_xa.rfis,
2692 				       ap->ap_rfis[fis_target].rfis,
2693 				       sizeof(struct ata_fis_d2h));
2694 				rfis = &ccb->ccb_xa.rfis;
2695 
2696 				offset = (intmax_t)rfis->lba_low |
2697 					((intmax_t)rfis->lba_mid << 8) |
2698 					((intmax_t)rfis->lba_high << 16) |
2699 					((intmax_t)rfis->lba_low_exp << 24) |
2700 					((intmax_t)rfis->lba_mid_exp << 32) |
2701 					((intmax_t)rfis->lba_high_exp << 40);
2702 				offset *= 512;
2703 				bytes = rfis->sector_count * 512;
2704 
2705 				/* NOTE: expect type == 0x34 */
2706 				kprintf("%s: TFES ccb=%p slot=%d RFIS-%02x "
2707 					"flg=%02x "
2708 					"st=%02x err=%02x dev=%02x "
2709 					"off=%jd/%d\n",
2710 					PORTNAME(ap),
2711 					ccb->ccb_xa.atascsi_private,
2712 					ccb->ccb_slot,
2713 					rfis->type,
2714 					rfis->flags,
2715 					rfis->status,
2716 					rfis->error,
2717 					rfis->device,
2718 					offset, bytes);
2719 			} else {
2720 				kprintf("%s: Cannot copy rfis, CCB slot "
2721 					"%d is not on-chip (state=%d)\n",
2722 					ATANAME(ap, ccb->ccb_xa.at),
2723 					err_slot, ccb->ccb_xa.state);
2724 				err_slot = -1;
2725 			}
2726 		}
2727 
2728 		/*
2729 		 * If we could not determine the errored slot then
2730 		 * reset the port.
2731 		 */
2732 		if (err_slot < 0) {
2733 			kprintf("%s: TFES: Unable to determine errored slot\n",
2734 				PORTNAME(ap));
2735 			if (ap->ap_flags & AP_F_IN_RESET)
2736 				goto fatal;
2737 			goto failall;
2738 		}
2739 
2740 		/*
2741 		 * Finish error on slot.  We will restart ci_saved
2742 		 * commands except the errored slot which we generate
2743 		 * a failure for.
2744 		 */
2745 finish_error:
2746 		ccb = &ap->ap_ccbs[err_slot];
2747 		ci_saved &= ~(1 << err_slot);
2748 		KKASSERT(ccb->ccb_xa.state == ATA_S_ONCHIP);
2749 		ccb->ccb_xa.state = ATA_S_ERROR;
2750 	} else if (is & AHCI_PREG_IS_DHRS) {
2751 		/*
2752 		 * Command posted D2H register FIS to the rfis (non-blocking).
2753 		 *
2754 		 * A normal completion with an error may set DHRS instead
2755 		 * of TFES.  The CCS bits are only valid if ERR was set.
2756 		 * If ERR is set command processing was probably stopped.
2757 		 *
2758 		 * If ERR was not set we can only copy-back data for
2759 		 * exclusive-mode commands because otherwise we won't know
2760 		 * which tag the rfis belonged to.
2761 		 *
2762 		 * err_slot must be read from the CCS before any other port
2763 		 * action, such as stopping the port.
2764 		 *
2765 		 * WARNING!	This is not well documented in the AHCI spec.
2766 		 *		It can be found in the state machine tables
2767 		 *		but not in the explanations.
2768 		 */
2769 		u_int32_t tfd;
2770 		u_int32_t cmd;
2771 		int err_slot;
2772 
2773 		tfd = ahci_pread(ap, AHCI_PREG_TFD);
2774 		cmd = ahci_pread(ap, AHCI_PREG_CMD);
2775 
2776 		ahci_pwrite(ap, AHCI_PREG_IS, AHCI_PREG_IS_DHRS);
2777 
2778 		/*
2779 		 * If command processing is turned off we can process the
2780 		 * error immediately.  Use the ST bit here instead of the
2781 		 * CR bit in case the CR bit is not implemented via the
2782 		 * F_IGN_CR quirk.
2783 		 */
2784 		if ((tfd & AHCI_PREG_TFD_STS_ERR) &&
2785 		    (cmd & AHCI_PREG_CMD_ST) == 0) {
2786 			err_slot = AHCI_PREG_CMD_CCS(
2787 						ahci_pread(ap, AHCI_PREG_CMD));
2788 			ccb = &ap->ap_ccbs[err_slot];
2789 			kprintf("%s: DHRS tfd=%pb%i err_slot=%d cmd=%02x\n",
2790 				PORTNAME(ap), AHCI_PFMT_TFD_STS, tfd,
2791 				err_slot, ccb->ccb_xa.fis->command);
2792 			goto process_error;
2793 		}
2794 		/*
2795 		 * NO ELSE... copy back is in the normal command completion
2796 		 * code and only if no error occured and ATA_F_AUTOSENSE
2797 		 * was set.
2798 		 */
2799 	}
2800 
2801 	/*
2802 	 * Device notification to us (non-blocking)
2803 	 *
2804 	 * NOTE!  On some parts notification bits can cause an IPMS
2805 	 *	  interrupt instead of a SDBS interrupt.
2806 	 *
2807 	 * NOTE!  On some parts (e.g. VBOX, probably intel ICHx),
2808 	 *	  SDBS notifies us of the completion of a NCQ command
2809 	 *	  and DBS does not.
2810 	 */
2811 	if (is & (AHCI_PREG_IS_SDBS | AHCI_PREG_IS_IPMS)) {
2812 		u_int32_t data;
2813 
2814 		ahci_pwrite(ap, AHCI_PREG_IS,
2815 				AHCI_PREG_IS_SDBS | AHCI_PREG_IS_IPMS);
2816 		if (sc->sc_cap & AHCI_REG_CAP_SSNTF) {
2817 			data = ahci_pread(ap, AHCI_PREG_SNTF);
2818 			if (data) {
2819 				ahci_pwrite(ap, AHCI_PREG_IS,
2820 						AHCI_PREG_IS_SDBS);
2821 				kprintf("%s: NOTIFY %08x\n",
2822 					PORTNAME(ap), data);
2823 				ahci_pwrite(ap, AHCI_PREG_SERR,
2824 						AHCI_PREG_SERR_DIAG_N);
2825 				ahci_pwrite(ap, AHCI_PREG_SNTF, data);
2826 				ahci_cam_changed(ap, NULL, -1);
2827 			}
2828 		}
2829 		is &= ~(AHCI_PREG_IS_SDBS | AHCI_PREG_IS_IPMS);
2830 	}
2831 
2832 	/*
2833 	 * Spurious IFS errors (blockable) - when AP_F_IGNORE_IFS is set.
2834 	 *
2835 	 * Spurious IFS errors can occur while we are doing a reset
2836 	 * sequence through a PM, probably due to an unexpected FIS
2837 	 * being received during the PM target reset sequence.  Chipsets
2838 	 * are supposed to mask these events but some do not.
2839 	 *
2840 	 * Try to recover from the condition.
2841 	 */
2842 	if ((is & AHCI_PREG_IS_IFS) && (ap->ap_flags & AP_F_IGNORE_IFS)) {
2843 		u_int32_t serr = ahci_pread(ap, AHCI_PREG_SERR);
2844 		if ((ap->ap_flags & AP_F_IFS_IGNORED) == 0) {
2845 			kprintf("%s: IFS during PM probe (ignored) "
2846 				"IS=%pb%i, SERR=%pb%i\n", PORTNAME(ap),
2847 				AHCI_PFMT_IS, is,
2848 				AHCI_PFMT_SERR, serr);
2849 			ap->ap_flags |= AP_F_IFS_IGNORED;
2850 		}
2851 
2852 		/*
2853 		 * Try to clear the error condition.  The IFS error killed
2854 		 * the port so stop it so we can restart it.
2855 		 */
2856 		ahci_pwrite(ap, AHCI_PREG_IS, AHCI_PREG_IS_IFS);
2857 		ahci_pwrite(ap, AHCI_PREG_SERR, -1);
2858 		is &= ~AHCI_PREG_IS_IFS;
2859 		need = NEED_RESTART;
2860 		goto failall;
2861 	}
2862 
2863 	/*
2864 	 * Port change (hot-plug) (blockable).
2865 	 *
2866 	 * A PRCS interrupt can occur:
2867 	 *	(1) On hot-unplug / normal-unplug (phy lost)
2868 	 *	(2) Sometimes on hot-plug too.
2869 	 *
2870 	 * A PCS interrupt can occur in a number of situations:
2871 	 *	(1) On hot-plug once communication is established
2872 	 *	(2) On hot-unplug sometimes.
2873 	 *	(3) For chipsets with badly written firmware it can occur
2874 	 *	    during INIT/RESET sequences due to the device reset.
2875 	 *	(4) For chipsets with badly written firmware it can occur
2876 	 *	    when it thinks an unsolicited COMRESET is received
2877 	 *	    during a INIT/RESET sequence, even though we actually
2878 	 *	    did request it.
2879 	 *
2880 	 * XXX We can then check the CPS (Cold Presence State) bit, if
2881 	 * supported, to determine if a device is plugged in or not and do
2882 	 * the right thing.
2883 	 *
2884 	 * PCS interrupts are cleared by clearing DIAG_X.  If this occurs
2885 	 * command processing is automatically stopped (CR goes inactive)
2886 	 * and the port must be stopped and restarted.
2887 	 *
2888 	 * WARNING: AMD parts (e.g. 880G chipset, probably others) can
2889 	 *	    generate PCS on initialization even when device is
2890 	 *	    already connected up.  It is unclear why this happens.
2891 	 *	    Depending on the state of the device detect this can
2892 	 *	    cause us to go into harsh reinit or hot-plug insertion
2893 	 *	    mode.
2894 	 *
2895 	 * WARNING: PCS errors can be repetitive (e.g. unsolicited COMRESET
2896 	 *	    continues to flow in from the device), we must clear the
2897 	 *	    interrupt in all cases and enforce a delay to prevent
2898 	 *	    a livelock and give the port time to settle down.
2899 	 *	    Only print something if we aren't in INIT/HARD-RESET.
2900 	 */
2901 	if (is & (AHCI_PREG_IS_PCS | AHCI_PREG_IS_PRCS)) {
2902 		ahci_pwrite(ap, AHCI_PREG_IS,
2903 			    is & (AHCI_PREG_IS_PCS | AHCI_PREG_IS_PRCS));
2904 		/*
2905 		 * Try to clear the error.  Because of the repetitiveness
2906 		 * of this interrupt avoid any harsh action if the port is
2907 		 * already in the init or hard-reset probe state.
2908 		 */
2909 		ahci_pwrite(ap, AHCI_PREG_SERR, -1);
2910 		/* (AHCI_PREG_SERR_DIAG_N | AHCI_PREG_SERR_DIAG_X) */
2911 
2912 		/*
2913 		 * Ignore PCS/PRCS errors during probes (but still clear the
2914 		 * interrupt to avoid a livelock).  The AMD 880/890/SB850
2915 		 * chipsets do not mask PCS/PRCS internally during reset
2916 		 * sequences.
2917 		 */
2918 		if (ap->ap_flags & AP_F_IN_RESET)
2919 			goto skip_pcs;
2920 
2921 		if (ap->ap_probe == ATA_PROBE_NEED_INIT ||
2922 		    ap->ap_probe == ATA_PROBE_NEED_HARD_RESET) {
2923 			is &= ~(AHCI_PREG_IS_PCS | AHCI_PREG_IS_PRCS);
2924 			need = NEED_NOTHING;
2925 			ahci_os_sleep(1000);
2926 			goto failall;
2927 		}
2928 		kprintf("%s: Transient Errors: %pb%i (%d)\n",
2929 			PORTNAME(ap), AHCI_PFMT_IS, is, ap->ap_probe);
2930 		is &= ~(AHCI_PREG_IS_PCS | AHCI_PREG_IS_PRCS);
2931 		ahci_os_sleep(200);
2932 
2933 		/*
2934 		 * Stop the port and figure out what to do next.
2935 		 */
2936 		ahci_port_stop(ap, 0);
2937 		stopped = 1;
2938 
2939 		switch (ahci_pread(ap, AHCI_PREG_SSTS) & AHCI_PREG_SSTS_DET) {
2940 		case AHCI_PREG_SSTS_DET_DEV:
2941 			/*
2942 			 * Device detect
2943 			 */
2944 			if (ap->ap_probe == ATA_PROBE_FAILED) {
2945 				need = NEED_HOTPLUG_INSERT;
2946 				goto fatal;
2947 			}
2948 			need = NEED_RESTART;
2949 			break;
2950 		case AHCI_PREG_SSTS_DET_DEV_NE:
2951 			/*
2952 			 * Device not communicating.  AMD parts seem to
2953 			 * like to throw this error on initialization
2954 			 * for no reason that I can fathom.
2955 			 */
2956 			kprintf("%s: Device present but not communicating, "
2957 				"attempting port restart\n",
2958 				PORTNAME(ap));
2959 			need = NEED_REINIT;
2960 			goto fatal;
2961 		default:
2962 			if (ap->ap_probe != ATA_PROBE_FAILED) {
2963 				need = NEED_HOTPLUG_REMOVE;
2964 				goto fatal;
2965 			}
2966 			need = NEED_RESTART;
2967 			break;
2968 		}
2969 skip_pcs:
2970 		;
2971 	}
2972 
2973 	/*
2974 	 * Check for remaining errors - they are fatal. (blockable)
2975 	 */
2976 	if (is & (AHCI_PREG_IS_TFES | AHCI_PREG_IS_HBFS | AHCI_PREG_IS_IFS |
2977 		  AHCI_PREG_IS_OFS | AHCI_PREG_IS_UFS)) {
2978 		u_int32_t serr;
2979 
2980 		ahci_pwrite(ap, AHCI_PREG_IS,
2981 			    is & (AHCI_PREG_IS_TFES | AHCI_PREG_IS_HBFS |
2982 				  AHCI_PREG_IS_IFS | AHCI_PREG_IS_OFS |
2983 				  AHCI_PREG_IS_UFS));
2984 		serr = ahci_pread(ap, AHCI_PREG_SERR);
2985 		kprintf("%s: Unrecoverable errors (IS: %pb%i, SERR: %pb%i), "
2986 			"disabling port.\n", PORTNAME(ap),
2987 			AHCI_PFMT_IS, is, AHCI_PFMT_SERR, serr);
2988 		is &= ~(AHCI_PREG_IS_TFES | AHCI_PREG_IS_HBFS |
2989 			AHCI_PREG_IS_IFS | AHCI_PREG_IS_OFS |
2990 		        AHCI_PREG_IS_UFS);
2991 
2992 		/*
2993 		 * Fail all commands but then what?  For now try to
2994 		 * reinitialize the port.
2995 		 */
2996 		need = NEED_REINIT;
2997 		goto fatal;
2998 	}
2999 
3000 	/*
3001 	 * Fail all outstanding commands if we know the port won't recover.
3002 	 *
3003 	 * We may have a ccb_at if the failed command is known and was
3004 	 * being sent to a device over a port multiplier (PM).  In this
3005 	 * case if the port itself has not completely failed we fail just
3006 	 * the commands related to that target.
3007 	 *
3008 	 * ci_saved contains the mask of active commands as of when the
3009 	 * error occured, prior to any port stops.
3010 	 */
3011 	if (ap->ap_state == AP_S_FATAL_ERROR) {
3012 fatal:
3013 		ap->ap_state = AP_S_FATAL_ERROR;
3014 failall:
3015 		ahci_port_stop(ap, 0);
3016 		stopped = 1;
3017 
3018 		/*
3019 		 * Error all the active slots not already errored.
3020 		 */
3021 		ci_masked = ci_saved & *active & ~ap->ap_expired;
3022 		if (ci_masked) {
3023 			kprintf("%s: Failing all commands: %08x\n",
3024 				PORTNAME(ap), ci_masked);
3025 		}
3026 
3027 		while (ci_masked) {
3028 			slot = ffs(ci_masked) - 1;
3029 			ccb = &ap->ap_ccbs[slot];
3030 			ccb->ccb_xa.state = ATA_S_TIMEOUT;
3031 			ap->ap_expired |= 1 << slot;
3032 			ci_saved &= ~(1 << slot);
3033 			ci_masked &= ~(1 << slot);
3034 		}
3035 
3036 		/*
3037 		 * Clear bits in ci_saved (cause completions to be run)
3038 		 * for all slots which are not active.
3039 		 */
3040 		ci_saved &= ~*active;
3041 
3042 		/*
3043 		 * Don't restart the port if our problems were deemed fatal.
3044 		 *
3045 		 * Also acknowlege all fatal interrupt sources to prevent
3046 		 * a livelock.
3047 		 */
3048 		if (ap->ap_state == AP_S_FATAL_ERROR) {
3049 			if (need == NEED_RESTART)
3050 				need = NEED_NOTHING;
3051 			ahci_pwrite(ap, AHCI_PREG_IS,
3052 				    AHCI_PREG_IS_TFES | AHCI_PREG_IS_HBFS |
3053 				    AHCI_PREG_IS_IFS | AHCI_PREG_IS_OFS |
3054 				    AHCI_PREG_IS_UFS);
3055 		}
3056 	}
3057 
3058 	/*
3059 	 * If we are stopped the AHCI chipset is supposed to have cleared
3060 	 * CI and SACT.  Did it?  If it didn't we try very hard to clear
3061 	 * the fields otherwise we may end up completing CCBs which are
3062 	 * actually still active.
3063 	 *
3064 	 * IFS errors on (at least) AMD chipsets create this confusion.
3065 	 */
3066 	if (stopped) {
3067 		u_int32_t mask;
3068 		if ((mask = ahci_pactive(ap)) != 0) {
3069 			kprintf("%s: chipset failed to clear "
3070 				"active cmds %08x\n",
3071 				PORTNAME(ap), mask);
3072 			ahci_port_start(ap);
3073 			ahci_port_stop(ap, 0);
3074 			if ((mask = ahci_pactive(ap)) != 0) {
3075 				kprintf("%s: unable to prod the chip into "
3076 					"clearing active cmds %08x\n",
3077 					PORTNAME(ap), mask);
3078 				/* what do we do now? */
3079 			}
3080 		}
3081 	}
3082 
3083 	/*
3084 	 * CCB completion (non blocking).
3085 	 *
3086 	 * CCB completion is detected by noticing its slot's bit in CI has
3087 	 * changed to zero some time after we activated it.
3088 	 * If we are polling, we may only be interested in particular slot(s).
3089 	 *
3090 	 * Any active bits not saved are completed within the restrictions
3091 	 * imposed by the caller.
3092 	 */
3093 	ci_masked = ~ci_saved & *active;
3094 	while (ci_masked) {
3095 		slot = ffs(ci_masked) - 1;
3096 		ccb = &ap->ap_ccbs[slot];
3097 		ci_masked &= ~(1 << slot);
3098 
3099 		DPRINTF(AHCI_D_INTR, "%s: slot %d is complete%s\n",
3100 		    PORTNAME(ap), slot, ccb->ccb_xa.state == ATA_S_ERROR ?
3101 		    " (error)" : "");
3102 
3103 		bus_dmamap_sync(sc->sc_tag_cmdh,
3104 				AHCI_DMA_MAP(ap->ap_dmamem_cmd_list),
3105 				BUS_DMASYNC_POSTWRITE);
3106 
3107 		bus_dmamap_sync(sc->sc_tag_cmdt,
3108 				AHCI_DMA_MAP(ap->ap_dmamem_cmd_table),
3109 				BUS_DMASYNC_POSTWRITE);
3110 
3111 		bus_dmamap_sync(sc->sc_tag_rfis,
3112 				AHCI_DMA_MAP(ap->ap_dmamem_rfis),
3113 				BUS_DMASYNC_POSTREAD);
3114 
3115 		*active &= ~(1 << ccb->ccb_slot);
3116 		if (active == &ap->ap_active) {
3117 			KKASSERT(ap->ap_active_cnt > 0);
3118 			--ap->ap_active_cnt;
3119 		}
3120 
3121 		/*
3122 		 * Complete the ccb.  If the ccb was marked expired it
3123 		 * was probably already removed from the command processor,
3124 		 * so don't take the clear ci_saved bit as meaning the
3125 		 * command actually succeeded, it didn't.
3126 		 */
3127 		if (ap->ap_expired & (1 << ccb->ccb_slot)) {
3128 			ap->ap_expired &= ~(1 << ccb->ccb_slot);
3129 			ccb->ccb_xa.state = ATA_S_TIMEOUT;
3130 			ccb->ccb_done(ccb);
3131 			ccb->ccb_xa.complete(&ccb->ccb_xa);
3132 		} else {
3133 			if (ccb->ccb_xa.state == ATA_S_ONCHIP) {
3134 				ccb->ccb_xa.state = ATA_S_COMPLETE;
3135 				if (ccb->ccb_xa.flags & ATA_F_AUTOSENSE) {
3136 					int fis_target;
3137 
3138 					ccb_at = ccb->ccb_xa.at;
3139 					if (ccb_at &&
3140 					    (ap->ap_flags & AP_F_FBSS_ENABLED))
3141 						fis_target = ccb_at->at_target;
3142 					else
3143 						fis_target = 0;
3144 					memcpy(&ccb->ccb_xa.rfis,
3145 					       ap->ap_rfis[fis_target].rfis,
3146 					       sizeof(struct ata_fis_d2h));
3147 					if (ccb->ccb_xa.state == ATA_S_TIMEOUT)
3148 						ccb->ccb_xa.state = ATA_S_ERROR;
3149 				}
3150 			}
3151 			ccb->ccb_done(ccb);
3152 		}
3153 	}
3154 
3155 	/*
3156 	 * Cleanup.  Will not be set if non-blocking.
3157 	 */
3158 	switch(need) {
3159 	case NEED_NOTHING:
3160 		/*
3161 		 * If operating normally and not stopped the interrupt was
3162 		 * probably just a normal completion and we may be able to
3163 		 * issue more commands.
3164 		 */
3165 		if (stopped == 0 && ap->ap_state != AP_S_FATAL_ERROR)
3166 			ahci_issue_pending_commands(ap, NULL);
3167 		break;
3168 	case NEED_RESTART:
3169 		/*
3170 		 * A recoverable error occured and we can restart outstanding
3171 		 * commands on the port.
3172 		 */
3173 		ci_saved &= ~ap->ap_expired;
3174 		if (ci_saved) {
3175 			kprintf("%s: Restart %08x\n", PORTNAME(ap), ci_saved);
3176 			ahci_issue_saved_commands(ap, ci_saved);
3177 		}
3178 
3179 		/*
3180 		 * Potentially issue new commands if not in a failed
3181 		 * state.
3182 		 */
3183 		if (ap->ap_state != AP_S_FATAL_ERROR) {
3184 			ahci_port_start(ap);
3185 			ahci_issue_pending_commands(ap, NULL);
3186 		}
3187 		break;
3188 	case NEED_REINIT:
3189 		/*
3190 		 * Something horrible happened to the port and we
3191 		 * need to reinitialize it.
3192 		 */
3193 		kprintf("%s: REINIT - Attempting to reinitialize the port "
3194 			"after it had a horrible accident\n",
3195 			PORTNAME(ap));
3196 		ap->ap_flags |= AP_F_IN_RESET;
3197 		ap->ap_flags |= AP_F_HARSH_REINIT;
3198 		ap->ap_probe = ATA_PROBE_NEED_INIT;
3199 		ahci_cam_changed(ap, NULL, -1);
3200 		break;
3201 	case NEED_HOTPLUG_INSERT:
3202 		/*
3203 		 * A hot-plug insertion event has occured and all
3204 		 * outstanding commands have already been revoked.
3205 		 *
3206 		 * Don't recurse if this occurs while we are
3207 		 * resetting the port.
3208 		 */
3209 		if ((ap->ap_flags & AP_F_IN_RESET) == 0) {
3210 			kprintf("%s: HOTPLUG - Device inserted\n",
3211 				PORTNAME(ap));
3212 			ap->ap_probe = ATA_PROBE_NEED_INIT;
3213 			ahci_cam_changed(ap, NULL, -1);
3214 		}
3215 		break;
3216 	case NEED_HOTPLUG_REMOVE:
3217 		/*
3218 		 * A hot-plug removal event has occured and all
3219 		 * outstanding commands have already been revoked.
3220 		 *
3221 		 * Don't recurse if this occurs while we are
3222 		 * resetting the port.
3223 		 */
3224 		if ((ap->ap_flags & AP_F_IN_RESET) == 0) {
3225 			kprintf("%s: HOTPLUG - Device removed\n",
3226 				PORTNAME(ap));
3227 			ahci_port_hardstop(ap);
3228 			/* ap_probe set to failed */
3229 			ahci_cam_changed(ap, NULL, -1);
3230 		}
3231 		break;
3232 	default:
3233 		break;
3234 	}
3235 }
3236 
3237 struct ahci_ccb *
3238 ahci_get_ccb(struct ahci_port *ap)
3239 {
3240 	struct ahci_ccb			*ccb;
3241 
3242 	lockmgr(&ap->ap_ccb_lock, LK_EXCLUSIVE);
3243 	ccb = TAILQ_FIRST(&ap->ap_ccb_free);
3244 	if (ccb != NULL) {
3245 		KKASSERT((ap->ap_sactive & (1 << ccb->ccb_slot)) == 0);
3246 		KKASSERT(ccb->ccb_xa.state == ATA_S_PUT);
3247 		TAILQ_REMOVE(&ap->ap_ccb_free, ccb, ccb_entry);
3248 		ccb->ccb_xa.state = ATA_S_SETUP;
3249 		ccb->ccb_xa.flags = 0;
3250 		ccb->ccb_xa.at = NULL;
3251 	}
3252 	lockmgr(&ap->ap_ccb_lock, LK_RELEASE);
3253 
3254 	return (ccb);
3255 }
3256 
3257 void
3258 ahci_put_ccb(struct ahci_ccb *ccb)
3259 {
3260 	struct ahci_port		*ap = ccb->ccb_port;
3261 
3262 	KKASSERT(ccb->ccb_xa.state != ATA_S_PUT);
3263 	KKASSERT((ap->ap_sactive & (1 << ccb->ccb_slot)) == 0);
3264 	lockmgr(&ap->ap_ccb_lock, LK_EXCLUSIVE);
3265 	ccb->ccb_xa.state = ATA_S_PUT;
3266 	++ccb->ccb_xa.serial;
3267 	TAILQ_INSERT_TAIL(&ap->ap_ccb_free, ccb, ccb_entry);
3268 	lockmgr(&ap->ap_ccb_lock, LK_RELEASE);
3269 }
3270 
3271 struct ahci_ccb *
3272 ahci_get_err_ccb(struct ahci_port *ap)
3273 {
3274 	struct ahci_ccb *err_ccb;
3275 	u_int32_t sact;
3276 	u_int32_t ci;
3277 
3278 	/* No commands may be active on the chip. */
3279 
3280 	if (ap->ap_sc->sc_cap & AHCI_REG_CAP_SNCQ) {
3281 		sact = ahci_pread(ap, AHCI_PREG_SACT);
3282 		if (sact != 0) {
3283 			kprintf("%s: ahci_get_err_ccb but SACT %08x != 0?\n",
3284 				PORTNAME(ap), sact);
3285 		}
3286 	}
3287 	ci = ahci_pread(ap, AHCI_PREG_CI);
3288 	if (ci) {
3289 		kprintf("%s: ahci_get_err_ccb: ci not 0 (%08x)\n",
3290 			ap->ap_name, ci);
3291 	}
3292 	KKASSERT(ci == 0);
3293 	KKASSERT((ap->ap_flags & AP_F_ERR_CCB_RESERVED) == 0);
3294 	ap->ap_flags |= AP_F_ERR_CCB_RESERVED;
3295 
3296 	/* Save outstanding command state. */
3297 	ap->ap_err_saved_active = ap->ap_active;
3298 	ap->ap_err_saved_active_cnt = ap->ap_active_cnt;
3299 	ap->ap_err_saved_sactive = ap->ap_sactive;
3300 
3301 	/*
3302 	 * Pretend we have no commands outstanding, so that completions won't
3303 	 * run prematurely.
3304 	 */
3305 	ap->ap_active = ap->ap_active_cnt = ap->ap_sactive = 0;
3306 
3307 	/*
3308 	 * Grab a CCB to use for error recovery.  This should never fail, as
3309 	 * we ask atascsi to reserve one for us at init time.
3310 	 */
3311 	err_ccb = ap->ap_err_ccb;
3312 	KKASSERT(err_ccb != NULL);
3313 	err_ccb->ccb_xa.flags = 0;
3314 	err_ccb->ccb_done = ahci_empty_done;
3315 
3316 	return err_ccb;
3317 }
3318 
3319 void
3320 ahci_put_err_ccb(struct ahci_ccb *ccb)
3321 {
3322 	struct ahci_port *ap = ccb->ccb_port;
3323 	u_int32_t sact;
3324 	u_int32_t ci;
3325 
3326 	KKASSERT((ap->ap_flags & AP_F_ERR_CCB_RESERVED) != 0);
3327 
3328 	/*
3329 	 * No commands may be active on the chip
3330 	 */
3331 	if (ap->ap_sc->sc_cap & AHCI_REG_CAP_SNCQ) {
3332 		sact = ahci_pread(ap, AHCI_PREG_SACT);
3333 		if (sact) {
3334 			panic("ahci_port_err_ccb(%d) but SACT %08x != 0",
3335 			      ccb->ccb_slot, sact);
3336 		}
3337 	}
3338 	ci = ahci_pread(ap, AHCI_PREG_CI);
3339 	if (ci) {
3340 		panic("ahci_put_err_ccb(%d) but CI %08x != 0 "
3341 		      "(act=%08x sact=%08x)\n",
3342 		      ccb->ccb_slot, ci,
3343 		      ap->ap_active, ap->ap_sactive);
3344 	}
3345 
3346 	KKASSERT(ccb == ap->ap_err_ccb);
3347 
3348 	/* Restore outstanding command state */
3349 	ap->ap_sactive = ap->ap_err_saved_sactive;
3350 	ap->ap_active_cnt = ap->ap_err_saved_active_cnt;
3351 	ap->ap_active = ap->ap_err_saved_active;
3352 
3353 	ap->ap_flags &= ~AP_F_ERR_CCB_RESERVED;
3354 }
3355 
3356 /*
3357  * Read log page to get NCQ error.
3358  *
3359  * NOTE: NCQ not currently supported on port multipliers. XXX
3360  */
3361 int
3362 ahci_port_read_ncq_error(struct ahci_port *ap, int target)
3363 {
3364 	struct ata_log_page_10h	*log;
3365 	struct ahci_ccb		*ccb;
3366 	struct ahci_ccb		*ccb2;
3367 	struct ahci_cmd_hdr	*cmd_slot;
3368 	struct ata_fis_h2d	*fis;
3369 	int			err_slot;
3370 
3371 	if (bootverbose) {
3372 		kprintf("%s: READ LOG PAGE target %d\n", PORTNAME(ap),
3373 			target);
3374 	}
3375 
3376 	/*
3377 	 * Prep error CCB for READ LOG EXT, page 10h, 1 sector.
3378 	 *
3379 	 * Getting err_ccb clears active/sactive/active_cnt, putting
3380 	 * it back restores the fields.
3381 	 */
3382 	ccb = ahci_get_err_ccb(ap);
3383 	ccb->ccb_xa.flags = ATA_F_READ | ATA_F_POLL;
3384 	ccb->ccb_xa.data = ap->ap_err_scratch;
3385 	ccb->ccb_xa.datalen = 512;
3386 	ccb->ccb_xa.complete = ahci_dummy_done;
3387 	ccb->ccb_xa.at = ap->ap_ata[target];
3388 
3389 	fis = (struct ata_fis_h2d *)ccb->ccb_cmd_table->cfis;
3390 	bzero(fis, sizeof(*fis));
3391 	fis->type = ATA_FIS_TYPE_H2D;
3392 	fis->flags = ATA_H2D_FLAGS_CMD | target;
3393 	fis->command = ATA_C_READ_LOG_EXT;
3394 	fis->lba_low = 0x10;		/* queued error log page (10h) */
3395 	fis->sector_count = 1;		/* number of sectors (1) */
3396 	fis->sector_count_exp = 0;
3397 	fis->lba_mid = 0;		/* starting offset */
3398 	fis->lba_mid_exp = 0;
3399 	fis->device = 0;
3400 
3401 	cmd_slot = ccb->ccb_cmd_hdr;
3402 	cmd_slot->flags = htole16(5);	/* FIS length: 5 DWORDS */
3403 
3404 	if (ahci_load_prdt(ccb) != 0) {
3405 		err_slot = -1;
3406 		goto err;
3407 	}
3408 
3409 	ccb->ccb_xa.state = ATA_S_PENDING;
3410 	if (ahci_poll(ccb, 1000, ahci_quick_timeout) != ATA_S_COMPLETE) {
3411 		err_slot = -1;
3412 		ahci_unload_prdt(ccb);
3413 		goto err;
3414 	}
3415 	ahci_unload_prdt(ccb);
3416 
3417 	/*
3418 	 * Success, extract failed register set and tags from the scratch
3419 	 * space.
3420 	 */
3421 	log = (struct ata_log_page_10h *)ap->ap_err_scratch;
3422 	if (log->err_regs.type & ATA_LOG_10H_TYPE_NOTQUEUED) {
3423 		/* Not queued bit was set - wasn't an NCQ error? */
3424 		kprintf("%s: read NCQ error page, but not an NCQ error?\n",
3425 			PORTNAME(ap));
3426 		err_slot = -1;
3427 	} else {
3428 		/* Copy back the log record as a D2H register FIS. */
3429 		err_slot = log->err_regs.type & ATA_LOG_10H_TYPE_TAG_MASK;
3430 
3431 		ccb2 = &ap->ap_ccbs[err_slot];
3432 		if (ccb2->ccb_xa.state == ATA_S_ONCHIP) {
3433 			kprintf("%s: read NCQ error page slot=%d\n",
3434 				ATANAME(ap, ccb2->ccb_xa.at),
3435 				err_slot);
3436 			memcpy(&ccb2->ccb_xa.rfis, &log->err_regs,
3437 				sizeof(struct ata_fis_d2h));
3438 			ccb2->ccb_xa.rfis.type = ATA_FIS_TYPE_D2H;
3439 			ccb2->ccb_xa.rfis.flags = 0;
3440 		} else {
3441 			kprintf("%s: read NCQ error page slot=%d, "
3442 				"slot does not match any cmds\n",
3443 				ATANAME(ccb2->ccb_port, ccb2->ccb_xa.at),
3444 				err_slot);
3445 			err_slot = -1;
3446 		}
3447 	}
3448 err:
3449 	ahci_put_err_ccb(ccb);
3450 	kprintf("%s: DONE log page target %d err_slot=%d\n",
3451 		PORTNAME(ap), target, err_slot);
3452 	return (err_slot);
3453 }
3454 
3455 /*
3456  * Allocate memory for various structures DMAd by hardware.  The maximum
3457  * number of segments for these tags is 1 so the DMA memory will have a
3458  * single physical base address.
3459  */
3460 struct ahci_dmamem *
3461 ahci_dmamem_alloc(struct ahci_softc *sc, bus_dma_tag_t tag)
3462 {
3463 	struct ahci_dmamem *adm;
3464 	int	error;
3465 
3466 	adm = kmalloc(sizeof(*adm), M_DEVBUF, M_INTWAIT | M_ZERO);
3467 
3468 	error = bus_dmamem_alloc(tag, (void **)&adm->adm_kva,
3469 				 BUS_DMA_ZERO, &adm->adm_map);
3470 	if (error == 0) {
3471 		adm->adm_tag = tag;
3472 		error = bus_dmamap_load(tag, adm->adm_map,
3473 					adm->adm_kva,
3474 					bus_dma_tag_getmaxsize(tag),
3475 					ahci_dmamem_saveseg, &adm->adm_busaddr,
3476 					0);
3477 	}
3478 	if (error) {
3479 		if (adm->adm_map) {
3480 			bus_dmamap_destroy(tag, adm->adm_map);
3481 			adm->adm_map = NULL;
3482 			adm->adm_tag = NULL;
3483 			adm->adm_kva = NULL;
3484 		}
3485 		kfree(adm, M_DEVBUF);
3486 		adm = NULL;
3487 	}
3488 	return (adm);
3489 }
3490 
3491 static
3492 void
3493 ahci_dmamem_saveseg(void *info, bus_dma_segment_t *segs, int nsegs, int error)
3494 {
3495 	KKASSERT(error == 0);
3496 	KKASSERT(nsegs == 1);
3497 	*(bus_addr_t *)info = segs->ds_addr;
3498 }
3499 
3500 
3501 void
3502 ahci_dmamem_free(struct ahci_softc *sc, struct ahci_dmamem *adm)
3503 {
3504 	if (adm->adm_map) {
3505 		bus_dmamap_unload(adm->adm_tag, adm->adm_map);
3506 		bus_dmamap_destroy(adm->adm_tag, adm->adm_map);
3507 		adm->adm_map = NULL;
3508 		adm->adm_tag = NULL;
3509 		adm->adm_kva = NULL;
3510 	}
3511 	kfree(adm, M_DEVBUF);
3512 }
3513 
3514 u_int32_t
3515 ahci_read(struct ahci_softc *sc, bus_size_t r)
3516 {
3517 	bus_space_barrier(sc->sc_iot, sc->sc_ioh, r, 4,
3518 			  BUS_SPACE_BARRIER_READ);
3519 	return (bus_space_read_4(sc->sc_iot, sc->sc_ioh, r));
3520 }
3521 
3522 void
3523 ahci_write(struct ahci_softc *sc, bus_size_t r, u_int32_t v)
3524 {
3525 	bus_space_write_4(sc->sc_iot, sc->sc_ioh, r, v);
3526 	bus_space_barrier(sc->sc_iot, sc->sc_ioh, r, 4,
3527 			  BUS_SPACE_BARRIER_WRITE);
3528 }
3529 
3530 u_int32_t
3531 ahci_pread(struct ahci_port *ap, bus_size_t r)
3532 {
3533 	bus_space_barrier(ap->ap_sc->sc_iot, ap->ap_ioh, r, 4,
3534 			  BUS_SPACE_BARRIER_READ);
3535 	return (bus_space_read_4(ap->ap_sc->sc_iot, ap->ap_ioh, r));
3536 }
3537 
3538 void
3539 ahci_pwrite(struct ahci_port *ap, bus_size_t r, u_int32_t v)
3540 {
3541 	bus_space_write_4(ap->ap_sc->sc_iot, ap->ap_ioh, r, v);
3542 	bus_space_barrier(ap->ap_sc->sc_iot, ap->ap_ioh, r, 4,
3543 			  BUS_SPACE_BARRIER_WRITE);
3544 }
3545 
3546 /*
3547  * Wait up to (timeout) milliseconds for the masked port register to
3548  * match the target.
3549  *
3550  * Timeout is in milliseconds.
3551  */
3552 int
3553 ahci_pwait_eq(struct ahci_port *ap, int timeout,
3554 	      bus_size_t r, u_int32_t mask, u_int32_t target)
3555 {
3556 	int	t;
3557 
3558 	/*
3559 	 * Loop hard up to 100uS
3560 	 */
3561 	for (t = 0; t < 100; ++t) {
3562 		if ((ahci_pread(ap, r) & mask) == target)
3563 			return (0);
3564 		ahci_os_hardsleep(1);	/* us */
3565 	}
3566 
3567 	do {
3568 		timeout -= ahci_os_softsleep();
3569 		if ((ahci_pread(ap, r) & mask) == target)
3570 			return (0);
3571 	} while (timeout > 0);
3572 	return (1);
3573 }
3574 
3575 int
3576 ahci_wait_ne(struct ahci_softc *sc, bus_size_t r, u_int32_t mask,
3577 	     u_int32_t target)
3578 {
3579 	int	t;
3580 
3581 	/*
3582 	 * Loop hard up to 100uS
3583 	 */
3584 	for (t = 0; t < 100; ++t) {
3585 		if ((ahci_read(sc, r) & mask) != target)
3586 			return (0);
3587 		ahci_os_hardsleep(1);	/* us */
3588 	}
3589 
3590 	/*
3591 	 * And one millisecond the slow way
3592 	 */
3593 	t = 1000;
3594 	do {
3595 		t -= ahci_os_softsleep();
3596 		if ((ahci_read(sc, r) & mask) != target)
3597 			return (0);
3598 	} while (t > 0);
3599 
3600 	return (1);
3601 }
3602 
3603 
3604 /*
3605  * Acquire an ata transfer.
3606  *
3607  * Pass a NULL at for direct-attached transfers, and a non-NULL at for
3608  * targets that go through the port multiplier.
3609  */
3610 struct ata_xfer *
3611 ahci_ata_get_xfer(struct ahci_port *ap, struct ata_port *at)
3612 {
3613 	struct ahci_ccb		*ccb;
3614 
3615 	ccb = ahci_get_ccb(ap);
3616 	if (ccb == NULL) {
3617 		DPRINTF(AHCI_D_XFER, "%s: ahci_ata_get_xfer: NULL ccb\n",
3618 		    PORTNAME(ap));
3619 		return (NULL);
3620 	}
3621 
3622 	DPRINTF(AHCI_D_XFER, "%s: ahci_ata_get_xfer got slot %d\n",
3623 	    PORTNAME(ap), ccb->ccb_slot);
3624 
3625 	bzero(ccb->ccb_xa.fis, sizeof(*ccb->ccb_xa.fis));
3626 	ccb->ccb_xa.at = at;
3627 	ccb->ccb_xa.fis->type = ATA_FIS_TYPE_H2D;
3628 
3629 	return (&ccb->ccb_xa);
3630 }
3631 
3632 void
3633 ahci_ata_put_xfer(struct ata_xfer *xa)
3634 {
3635 	struct ahci_ccb			*ccb = (struct ahci_ccb *)xa;
3636 
3637 	DPRINTF(AHCI_D_XFER, "ahci_ata_put_xfer slot %d\n", ccb->ccb_slot);
3638 
3639 	ahci_put_ccb(ccb);
3640 }
3641 
3642 int
3643 ahci_ata_cmd(struct ata_xfer *xa)
3644 {
3645 	struct ahci_ccb			*ccb = (struct ahci_ccb *)xa;
3646 	struct ahci_cmd_hdr		*cmd_slot;
3647 
3648 	KKASSERT(xa->state == ATA_S_SETUP);
3649 
3650 	if (ccb->ccb_port->ap_state == AP_S_FATAL_ERROR)
3651 		goto failcmd;
3652 	ccb->ccb_done = ahci_ata_cmd_done;
3653 
3654 	cmd_slot = ccb->ccb_cmd_hdr;
3655 	cmd_slot->flags = htole16(5); /* FIS length (in DWORDs) */
3656 	if (ccb->ccb_xa.at) {
3657 		cmd_slot->flags |= htole16(ccb->ccb_xa.at->at_target <<
3658 					   AHCI_CMD_LIST_FLAG_PMP_SHIFT);
3659 	}
3660 
3661 	if (xa->flags & ATA_F_WRITE)
3662 		cmd_slot->flags |= htole16(AHCI_CMD_LIST_FLAG_W);
3663 
3664 	if (xa->flags & ATA_F_PACKET)
3665 		cmd_slot->flags |= htole16(AHCI_CMD_LIST_FLAG_A);
3666 
3667 	if (ahci_load_prdt(ccb) != 0)
3668 		goto failcmd;
3669 
3670 	xa->state = ATA_S_PENDING;
3671 
3672 	if (xa->flags & ATA_F_POLL)
3673 		return (ahci_poll(ccb, xa->timeout, ahci_ata_cmd_timeout));
3674 
3675 	crit_enter();
3676 	KKASSERT((xa->flags & ATA_F_TIMEOUT_EXPIRED) == 0);
3677 	xa->flags |= ATA_F_TIMEOUT_DESIRED;
3678 	ahci_start(ccb);
3679 	crit_exit();
3680 	return (xa->state);
3681 
3682 failcmd:
3683 	crit_enter();
3684 	xa->state = ATA_S_ERROR;
3685 	xa->complete(xa);
3686 	crit_exit();
3687 	return (ATA_S_ERROR);
3688 }
3689 
3690 static void
3691 ahci_ata_cmd_done(struct ahci_ccb *ccb)
3692 {
3693 	struct ata_xfer	*xa = &ccb->ccb_xa;
3694 	int serial;
3695 
3696 	/*
3697 	 * NOTE: Callout does not lock port and may race us modifying
3698 	 *	 the flags, so make sure its stopped.
3699 	 *
3700 	 *	 A callout race can clean up the ccb.  A change in the
3701 	 *	 serial number should catch this condition.
3702 	 */
3703 	if (xa->flags & ATA_F_TIMEOUT_RUNNING) {
3704 		serial = ccb->ccb_xa.serial;
3705 		callout_cancel(&ccb->ccb_timeout);
3706 		if (serial != ccb->ccb_xa.serial) {
3707 			kprintf("%s: Warning: timeout race ccb %p\n",
3708 				PORTNAME(ccb->ccb_port), ccb);
3709 			return;
3710 		}
3711 		xa->flags &= ~ATA_F_TIMEOUT_RUNNING;
3712 	}
3713 	xa->flags &= ~(ATA_F_TIMEOUT_DESIRED | ATA_F_TIMEOUT_EXPIRED);
3714 	ccb->ccb_port->ap_expired &= ~(1 << ccb->ccb_slot);
3715 
3716 	KKASSERT(xa->state != ATA_S_ONCHIP && xa->state != ATA_S_PUT);
3717 	ahci_unload_prdt(ccb);
3718 
3719 	if (xa->state != ATA_S_TIMEOUT)
3720 		xa->complete(xa);
3721 }
3722 
3723 /*
3724  * Timeout from callout, MPSAFE - nothing can mess with the CCB's flags
3725  * while the callout is runing.
3726  *
3727  * We can't safely get the port lock here or delay, we could block
3728  * the callout thread.
3729  */
3730 static void
3731 ahci_ata_cmd_timeout_unserialized(void *arg)
3732 {
3733 	struct ahci_ccb		*ccb = arg;
3734 	struct ahci_port	*ap = ccb->ccb_port;
3735 
3736 	KKASSERT(ccb->ccb_xa.flags & ATA_F_TIMEOUT_RUNNING);
3737 	ccb->ccb_xa.flags &= ~ATA_F_TIMEOUT_RUNNING;
3738 	ccb->ccb_xa.flags |= ATA_F_TIMEOUT_EXPIRED;
3739 	ahci_os_signal_port_thread(ap, AP_SIGF_TIMEOUT);
3740 }
3741 
3742 /*
3743  * Timeout code, typically called when the port command processor is running.
3744  *
3745  * We have to be very very careful here.  We cannot stop the port unless
3746  * CR is already clear or the only active commands remaining are timed-out
3747  * ones.  Otherwise stopping the port will race the command processor and
3748  * we can lose events.  While we can theoretically just restart everything
3749  * that could result in a double-issue which will not work for ATAPI commands.
3750  */
3751 void
3752 ahci_ata_cmd_timeout(struct ahci_ccb *ccb)
3753 {
3754 	struct ata_xfer		*xa = &ccb->ccb_xa;
3755 	struct ahci_port	*ap = ccb->ccb_port;
3756 	struct ata_port		*at;
3757 	u_int32_t		ci_saved;
3758 	u_int32_t		mask;
3759 	int			slot;
3760 
3761 	at = ccb->ccb_xa.at;
3762 
3763 	kprintf("%s: CMD TIMEOUT state=%d slot=%d\n"
3764 		"\tglb-status 0x%08x\n"
3765 		"\tcmd-reg 0x%pb%i\n"
3766 		"\tport_status 0x%pb%i\n"
3767 		"\tsactive=%08x active=%08x expired=%08x\n"
3768 		"\t   sact=%08x     ci=%08x\n"
3769 		"\t    STS=%pb%i\n",
3770 		ATANAME(ap, at),
3771 		ccb->ccb_xa.state, ccb->ccb_slot,
3772 		ahci_read(ap->ap_sc, AHCI_REG_IS),
3773 		AHCI_PFMT_CMD, ahci_pread(ap, AHCI_PREG_CMD),
3774 		AHCI_PFMT_IS, ahci_pread(ap, AHCI_PREG_IS),
3775 		ap->ap_sactive, ap->ap_active, ap->ap_expired,
3776 		ahci_pread(ap, AHCI_PREG_SACT),
3777 		ahci_pread(ap, AHCI_PREG_CI),
3778 		AHCI_PFMT_TFD_STS, ahci_pread(ap, AHCI_PREG_TFD)
3779 	);
3780 
3781 
3782 	/*
3783 	 * NOTE: Timeout will not be running if the command was polled.
3784 	 *	 If we got here at least one of these flags should be set.
3785 	 */
3786 	KKASSERT(xa->flags & (ATA_F_POLL | ATA_F_TIMEOUT_DESIRED |
3787 			      ATA_F_TIMEOUT_RUNNING));
3788 	xa->flags &= ~(ATA_F_TIMEOUT_RUNNING | ATA_F_TIMEOUT_EXPIRED);
3789 
3790 	if (ccb->ccb_xa.state == ATA_S_PENDING) {
3791 		TAILQ_REMOVE(&ap->ap_ccb_pending, ccb, ccb_entry);
3792 		ccb->ccb_xa.state = ATA_S_TIMEOUT;
3793 		ccb->ccb_done(ccb);
3794 		xa->complete(xa);
3795 		ahci_issue_pending_commands(ap, NULL);
3796 		return;
3797 	}
3798 	if (ccb->ccb_xa.state != ATA_S_ONCHIP) {
3799 		kprintf("%s: Unexpected state during timeout: %d\n",
3800 			ATANAME(ap, at), ccb->ccb_xa.state);
3801 		return;
3802 	}
3803 
3804 	/*
3805 	 * Ok, we can only get this command off the chip if CR is inactive
3806 	 * or if the only commands running on the chip are all expired.
3807 	 * Otherwise we have to wait until the port is in a safe state.
3808 	 * Use the ST bit here instead of the CR bit in case the CR bit is
3809 	 * not implemented via the F_IGN_CR quirk.
3810 	 *
3811 	 * Do not set state here, it will cause polls to return when the
3812 	 * ccb is not yet off the chip.
3813 	 */
3814 	ap->ap_expired |= 1 << ccb->ccb_slot;
3815 
3816 	if ((ahci_pread(ap, AHCI_PREG_CMD) & AHCI_PREG_CMD_ST) &&
3817 	    (ap->ap_active | ap->ap_sactive) != ap->ap_expired) {
3818 		/*
3819 		 * If using FBSS or NCQ we can't safely stop the port
3820 		 * right now.
3821 		 */
3822 		kprintf("%s: Deferred timeout until its safe, slot %d\n",
3823 			ATANAME(ap, at), ccb->ccb_slot);
3824 		return;
3825 	}
3826 
3827 	/*
3828 	 * We can safely stop the port and process all expired ccb's,
3829 	 * which will include our current ccb.
3830 	 */
3831 	ci_saved = (ap->ap_sactive) ? ahci_pread(ap, AHCI_PREG_SACT) :
3832 				      ahci_pread(ap, AHCI_PREG_CI);
3833 	ahci_port_stop(ap, 0);
3834 
3835 	while (ap->ap_expired) {
3836 		slot = ffs(ap->ap_expired) - 1;
3837 		ap->ap_expired &= ~(1 << slot);
3838 		ci_saved &= ~(1 << slot);
3839 		ccb = &ap->ap_ccbs[slot];
3840 		ccb->ccb_xa.state = ATA_S_TIMEOUT;
3841 		if (ccb->ccb_xa.flags & ATA_F_NCQ) {
3842 			KKASSERT(ap->ap_sactive & (1 << slot));
3843 			ap->ap_sactive &= ~(1 << slot);
3844 		} else {
3845 			KKASSERT(ap->ap_active & (1 << slot));
3846 			ap->ap_active &= ~(1 << slot);
3847 			--ap->ap_active_cnt;
3848 		}
3849 		ccb->ccb_done(ccb);
3850 		ccb->ccb_xa.complete(&ccb->ccb_xa);
3851 	}
3852 	/* ccb invalid now */
3853 
3854 	/*
3855 	 * We can safely CLO the port to clear any BSY/DRQ, a case which
3856 	 * can occur with port multipliers.  This will unbrick the port
3857 	 * and allow commands to other targets behind the PM continue.
3858 	 * (FBSS).
3859 	 *
3860 	 * Finally, once the port has been restarted we can issue any
3861 	 * previously saved pending commands, and run the port interrupt
3862 	 * code to handle any completions which may have occured when
3863 	 * we saved CI.
3864 	 */
3865 	if (ahci_pread(ap, AHCI_PREG_TFD) &
3866 		   (AHCI_PREG_TFD_STS_BSY | AHCI_PREG_TFD_STS_DRQ)) {
3867 		kprintf("%s: Warning, issuing CLO after timeout\n",
3868 			ATANAME(ap, at));
3869 		ahci_port_clo(ap);
3870 	}
3871 	ahci_port_start(ap);
3872 
3873 	/*
3874 	 * We absolutely must make sure the chipset cleared activity on
3875 	 * all slots.  This sometimes might not happen due to races with
3876 	 * a chipset interrupt which stops the port before we can manage
3877 	 * to.  For some reason some chipsets don't clear the active
3878 	 * commands when we turn off CMD_ST after the chip has stopped
3879 	 * operations itself.
3880 	 */
3881 	if (ahci_pactive(ap) != 0) {
3882 		ahci_port_stop(ap, 0);
3883 		ahci_port_start(ap);
3884 		if ((mask = ahci_pactive(ap)) != 0) {
3885 			kprintf("%s: quick-timeout: chipset failed "
3886 				"to clear active cmds %08x\n",
3887 				PORTNAME(ap), mask);
3888 		}
3889 	}
3890 	ahci_issue_saved_commands(ap, ci_saved & ~ap->ap_expired);
3891 	ahci_issue_pending_commands(ap, NULL);
3892 	ahci_port_intr(ap, 0);
3893 }
3894 
3895 /*
3896  * Issue a previously saved set of commands
3897  */
3898 void
3899 ahci_issue_saved_commands(struct ahci_port *ap, u_int32_t ci_saved)
3900 {
3901 	if (ci_saved && (ap->ap_flags & AP_F_FBSS_ENABLED) == 0) {
3902 		KKASSERT(!((ap->ap_active & ci_saved) &&
3903 			   (ap->ap_sactive & ci_saved)));
3904 		KKASSERT((ci_saved & ap->ap_expired) == 0);
3905 		if (ap->ap_sactive & ci_saved)
3906 			ahci_pwrite(ap, AHCI_PREG_SACT, ci_saved);
3907 		ahci_pwrite(ap, AHCI_PREG_CI, ci_saved);
3908 	} else if (ci_saved) {
3909 		struct ata_port *ccb_at;
3910 		int i;
3911 		int fis_target;
3912 
3913 		for (i = 0; i < 32; ++i) {
3914 			if ((ci_saved & (1 << i)) == 0)
3915 				continue;
3916 			ccb_at = ap->ap_ccbs[i].ccb_xa.at;
3917 			if (ccb_at)
3918 				fis_target = ccb_at->at_target;
3919 			else
3920 				fis_target = 0;
3921 			ahci_pwrite(ap, AHCI_PREG_FBS,
3922 				    (fis_target <<
3923 				     AHCI_PREG_FBS_DEV_SHIFT) |
3924 				    AHCI_PREG_FBS_EN);
3925 			if (ap->ap_sactive & (1 << i))
3926 				ahci_pwrite(ap, AHCI_PREG_SACT, (1 << i));
3927 			ahci_pwrite(ap, AHCI_PREG_CI, 1 << i);
3928 		}
3929 	}
3930 }
3931 
3932 /*
3933  * Used by the softreset, pmprobe, and read_ncq_error only, in very
3934  * specialized, controlled circumstances.
3935  *
3936  * Only one command may be pending.
3937  */
3938 void
3939 ahci_quick_timeout(struct ahci_ccb *ccb)
3940 {
3941 	struct ahci_port *ap = ccb->ccb_port;
3942 	u_int32_t mask;
3943 
3944 	switch (ccb->ccb_xa.state) {
3945 	case ATA_S_PENDING:
3946 		TAILQ_REMOVE(&ap->ap_ccb_pending, ccb, ccb_entry);
3947 		ccb->ccb_xa.state = ATA_S_TIMEOUT;
3948 		break;
3949 	case ATA_S_ONCHIP:
3950 		/*
3951 		 * We have to clear the command on-chip.
3952 		 */
3953 		KKASSERT(ap->ap_active == (1 << ccb->ccb_slot) &&
3954 			 ap->ap_sactive == 0);
3955 		ahci_port_stop(ap, 0);
3956 		ahci_port_start(ap);
3957 		if (ahci_pactive(ap) != 0) {
3958 			ahci_port_stop(ap, 0);
3959 			ahci_port_start(ap);
3960 			if ((mask = ahci_pactive(ap)) != 0) {
3961 				kprintf("%s: quick-timeout: chipset failed "
3962 					"to clear active cmds %08x\n",
3963 					PORTNAME(ap), mask);
3964 			}
3965 		}
3966 
3967 		ccb->ccb_xa.state = ATA_S_TIMEOUT;
3968 		ap->ap_active &= ~(1 << ccb->ccb_slot);
3969 		KKASSERT(ap->ap_active_cnt > 0);
3970 		--ap->ap_active_cnt;
3971 		break;
3972 	default:
3973 		panic("%s: ahci_quick_timeout: ccb in bad state %d",
3974 		      ATANAME(ap, ccb->ccb_xa.at), ccb->ccb_xa.state);
3975 	}
3976 }
3977 
3978 static void
3979 ahci_dummy_done(struct ata_xfer *xa)
3980 {
3981 }
3982 
3983 static void
3984 ahci_empty_done(struct ahci_ccb *ccb)
3985 {
3986 }
3987 
3988 int
3989 ahci_set_feature(struct ahci_port *ap, struct ata_port *atx,
3990 		 int feature, int enable)
3991 {
3992 	struct ata_port *at;
3993 	struct ata_xfer *xa;
3994 	int error;
3995 
3996 	at = atx ? atx : ap->ap_ata[0];
3997 
3998 	xa = ahci_ata_get_xfer(ap, atx);
3999 
4000 	xa->fis->type = ATA_FIS_TYPE_H2D;
4001 	xa->fis->flags = ATA_H2D_FLAGS_CMD | at->at_target;
4002 	xa->fis->command = ATA_C_SET_FEATURES;
4003 	xa->fis->features = enable ? ATA_SF_SATAFT_ENA : ATA_SF_SATAFT_DIS;
4004 	xa->fis->sector_count = feature;
4005 	xa->fis->control = ATA_FIS_CONTROL_4BIT;
4006 
4007 	xa->complete = ahci_dummy_done;
4008 	xa->datalen = 0;
4009 	xa->flags = ATA_F_POLL;
4010 	xa->timeout = 1000;
4011 
4012 	if (ahci_ata_cmd(xa) == ATA_S_COMPLETE)
4013 		error = 0;
4014 	else
4015 		error = EIO;
4016 	ahci_ata_put_xfer(xa);
4017 	return(error);
4018 }
4019