xref: /dflybsd-src/sys/dev/disk/ahci/ahci.c (revision 2d0700913d3c55b6181d2b703dd69aae2179ce8c)
1 /*
2  * (MPSAFE)
3  *
4  * Copyright (c) 2006 David Gwynne <dlg@openbsd.org>
5  *
6  * Permission to use, copy, modify, and distribute this software for any
7  * purpose with or without fee is hereby granted, provided that the above
8  * copyright notice and this permission notice appear in all copies.
9  *
10  * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
11  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
12  * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
13  * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
14  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
15  * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
16  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
17  *
18  *
19  * Copyright (c) 2009 The DragonFly Project.  All rights reserved.
20  *
21  * This code is derived from software contributed to The DragonFly Project
22  * by Matthew Dillon <dillon@backplane.com>
23  *
24  * Redistribution and use in source and binary forms, with or without
25  * modification, are permitted provided that the following conditions
26  * are met:
27  *
28  * 1. Redistributions of source code must retain the above copyright
29  *    notice, this list of conditions and the following disclaimer.
30  * 2. Redistributions in binary form must reproduce the above copyright
31  *    notice, this list of conditions and the following disclaimer in
32  *    the documentation and/or other materials provided with the
33  *    distribution.
34  * 3. Neither the name of The DragonFly Project nor the names of its
35  *    contributors may be used to endorse or promote products derived
36  *    from this software without specific, prior written permission.
37  *
38  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
39  * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
40  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
41  * FOR A PARTICULAR PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE
42  * COPYRIGHT HOLDERS OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
43  * INCIDENTAL, SPECIAL, EXEMPLARY OR CONSEQUENTIAL DAMAGES (INCLUDING,
44  * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
45  * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED
46  * AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
47  * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT
48  * OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
49  * SUCH DAMAGE.
50  *
51  * $OpenBSD: ahci.c,v 1.147 2009/02/16 21:19:07 miod Exp $
52  */
53 
54 #include "ahci.h"
55 
56 void	ahci_port_interrupt_enable(struct ahci_port *ap);
57 
58 int	ahci_load_prdt(struct ahci_ccb *);
59 void	ahci_unload_prdt(struct ahci_ccb *);
60 static void ahci_load_prdt_callback(void *info, bus_dma_segment_t *segs,
61 				    int nsegs, int error);
62 void	ahci_start(struct ahci_ccb *);
63 int	ahci_port_softreset(struct ahci_port *ap);
64 int	ahci_port_hardreset(struct ahci_port *ap, int hard);
65 void	ahci_port_hardstop(struct ahci_port *ap);
66 
67 static void ahci_ata_cmd_timeout_unserialized(void *);
68 void	ahci_check_active_timeouts(struct ahci_port *ap);
69 
70 void	ahci_beg_exclusive_access(struct ahci_port *ap, struct ata_port *at);
71 void	ahci_end_exclusive_access(struct ahci_port *ap, struct ata_port *at);
72 void	ahci_issue_pending_commands(struct ahci_port *ap, struct ahci_ccb *ccb);
73 void	ahci_issue_saved_commands(struct ahci_port *ap, u_int32_t mask);
74 
75 int	ahci_port_read_ncq_error(struct ahci_port *, int);
76 
77 struct ahci_dmamem *ahci_dmamem_alloc(struct ahci_softc *, bus_dma_tag_t tag);
78 void	ahci_dmamem_free(struct ahci_softc *, struct ahci_dmamem *);
79 static void ahci_dmamem_saveseg(void *info, bus_dma_segment_t *segs, int nsegs, int error);
80 
81 static void ahci_dummy_done(struct ata_xfer *xa);
82 static void ahci_empty_done(struct ahci_ccb *ccb);
83 static void ahci_ata_cmd_done(struct ahci_ccb *ccb);
84 static u_int32_t ahci_pactive(struct ahci_port *ap);
85 
86 /*
87  * Initialize the global AHCI hardware.  This code does not set up any of
88  * its ports.
89  */
90 int
91 ahci_init(struct ahci_softc *sc)
92 {
93 	u_int32_t	cap, pi, pleft;
94 	int		i;
95 	struct ahci_port *ap;
96 
97 	DPRINTF(AHCI_D_VERBOSE, " GHC 0x%b",
98 		ahci_read(sc, AHCI_REG_GHC), AHCI_FMT_GHC);
99 
100 	/*
101 	 * save BIOS initialised parameters, enable staggered spin up
102 	 */
103 	cap = ahci_read(sc, AHCI_REG_CAP);
104 	cap &= AHCI_REG_CAP_SMPS;
105 	cap |= AHCI_REG_CAP_SSS;
106 	pi = ahci_read(sc, AHCI_REG_PI);
107 
108 	/*
109 	 * Unconditionally reset the controller, do not conditionalize on
110 	 * trying to figure it if it was previously active or not.
111 	 *
112 	 * NOTE: On AE before HR.  The AHCI-1.1 spec has a note in section
113 	 *	 5.2.2.1 regarding this.  HR should be set to 1 only after
114 	 *	 AE is set to 1.  The reset sequence will clear HR when
115 	 *	 it completes, and will also clear AE if SAM is 0.  AE must
116 	 *	 then be set again.  When SAM is 1 the AE bit typically reads
117 	 *	 as 1 (and is read-only).
118 	 *
119 	 * NOTE: Avoid PCI[e] transaction burst by issuing dummy reads,
120 	 *	 otherwise the writes will only be separated by a few
121 	 *	 nanoseconds.
122 	 *
123 	 * NOTE BRICKS (1)
124 	 *
125 	 *	If you have a port multiplier and it does not have a device
126 	 *	in target 0, and it probes normally, but a later operation
127 	 *	mis-probes a target behind that PM, it is possible for the
128 	 *	port to brick such that only (a) a power cycle of the host
129 	 *	or (b) placing a device in target 0 will fix the problem.
130 	 *	Power cycling the PM has no effect (it works fine on another
131 	 *	host port).  This issue is unrelated to CLO.
132 	 */
133 	/*
134 	 * Wait for any prior reset sequence to complete
135 	 */
136 	if (ahci_wait_ne(sc, AHCI_REG_GHC,
137 			 AHCI_REG_GHC_HR, AHCI_REG_GHC_HR) != 0) {
138 		device_printf(sc->sc_dev, "Controller is stuck in reset\n");
139 		return (1);
140 	}
141 	ahci_write(sc, AHCI_REG_GHC, AHCI_REG_GHC_AE);
142 	ahci_os_sleep(500);
143 	ahci_read(sc, AHCI_REG_GHC);		/* flush */
144 	ahci_write(sc, AHCI_REG_GHC, AHCI_REG_GHC_AE | AHCI_REG_GHC_HR);
145 	ahci_os_sleep(500);
146 	ahci_read(sc, AHCI_REG_GHC);		/* flush */
147 	if (ahci_wait_ne(sc, AHCI_REG_GHC,
148 			 AHCI_REG_GHC_HR, AHCI_REG_GHC_HR) != 0) {
149 		device_printf(sc->sc_dev, "unable to reset controller\n");
150 		return (1);
151 	}
152 	if (ahci_read(sc, AHCI_REG_GHC) & AHCI_REG_GHC_AE) {
153 		device_printf(sc->sc_dev, "AE did not auto-clear!\n");
154 		ahci_write(sc, AHCI_REG_GHC, 0);
155 		ahci_os_sleep(500);
156 	}
157 
158 	/*
159 	 * Enable ahci (global interrupts disabled)
160 	 *
161 	 * Restore saved parameters.  Avoid pci transaction burst write
162 	 * by issuing dummy reads.
163 	 */
164 	ahci_os_sleep(500);
165 	ahci_write(sc, AHCI_REG_GHC, AHCI_REG_GHC_AE);
166 	ahci_os_sleep(500);
167 
168 	ahci_read(sc, AHCI_REG_GHC);		/* flush */
169 	ahci_write(sc, AHCI_REG_CAP, cap);
170 	ahci_write(sc, AHCI_REG_PI, pi);
171 	ahci_read(sc, AHCI_REG_GHC);		/* flush */
172 
173 	/*
174 	 * Intel hocus pocus in case the BIOS has not set the chip up
175 	 * properly for AHCI operation.
176 	 */
177 	if (pci_get_vendor(sc->sc_dev) == PCI_VENDOR_INTEL) {
178 	        if ((pci_read_config(sc->sc_dev, 0x92, 2) & 0x0F) != 0x0F)
179 			device_printf(sc->sc_dev, "Intel hocus pocus\n");
180 		pci_write_config(sc->sc_dev, 0x92,
181 			     pci_read_config(sc->sc_dev, 0x92, 2) | 0x0F, 2);
182 	}
183 
184 	/*
185 	 * This is a hack that currently does not appear to have
186 	 * a significant effect, but I noticed the port registers
187 	 * do not appear to be completely cleared after the host
188 	 * controller is reset.
189 	 *
190 	 * Use a temporary ap structure so we can call ahci_pwrite().
191 	 *
192 	 * We must be sure to stop the port
193 	 */
194 	ap = kmalloc(sizeof(*ap), M_DEVBUF, M_WAITOK | M_ZERO);
195 	ap->ap_sc = sc;
196 	pleft = pi;
197 	for (i = 0; i < AHCI_MAX_PORTS; ++i) {
198 		if (pleft == 0)
199 			break;
200 		if ((pi & (1 << i)) == 0)
201 			continue;
202 		if (bus_space_subregion(sc->sc_iot, sc->sc_ioh,
203 		    AHCI_PORT_REGION(i), AHCI_PORT_SIZE, &ap->ap_ioh) != 0) {
204 			device_printf(sc->sc_dev, "can't map port\n");
205 			return (1);
206 		}
207 		/*
208 		 * NOTE!  Setting AHCI_PREG_SCTL_DET_DISABLE on AHCI1.0 or
209 		 *	  AHCI1.1 can brick the chipset.  Not only brick it,
210 		 *	  but also crash the PC.  The bit seems unreliable
211 		 *	  on AHCI1.2 as well.
212 		 */
213 		ahci_port_stop(ap, 1);
214 		ahci_pwrite(ap, AHCI_PREG_SCTL, AHCI_PREG_SCTL_IPM_DISABLED);
215 		ahci_pwrite(ap, AHCI_PREG_SERR, -1);
216 		ahci_pwrite(ap, AHCI_PREG_IE, 0);
217 		ahci_write(ap->ap_sc, AHCI_REG_IS, 1 << i);
218 		ahci_pwrite(ap, AHCI_PREG_CMD, 0);
219 		ahci_pwrite(ap, AHCI_PREG_IS, -1);
220 		sc->sc_portmask |= (1 << i);
221 		pleft &= ~(1 << i);
222 	}
223 	sc->sc_numports = i;
224 	kfree(ap, M_DEVBUF);
225 
226 	return (0);
227 }
228 
229 /*
230  * Allocate and initialize an AHCI port.
231  */
232 int
233 ahci_port_alloc(struct ahci_softc *sc, u_int port)
234 {
235 	struct ahci_port	*ap;
236 	struct ata_port		*at;
237 	struct ahci_ccb		*ccb;
238 	u_int64_t		dva;
239 	u_int32_t		cmd;
240 	u_int32_t		data;
241 	struct ahci_cmd_hdr	*hdr;
242 	struct ahci_cmd_table	*table;
243 	int	rc = ENOMEM;
244 	int	error;
245 	int	i;
246 
247 	ap = kmalloc(sizeof(*ap), M_DEVBUF, M_WAITOK | M_ZERO);
248 	ap->ap_err_scratch = kmalloc(512, M_DEVBUF, M_WAITOK | M_ZERO);
249 
250 	ksnprintf(ap->ap_name, sizeof(ap->ap_name), "%s%d.%d",
251 		  device_get_name(sc->sc_dev),
252 		  device_get_unit(sc->sc_dev),
253 		  port);
254 	sc->sc_ports[port] = ap;
255 
256 	/*
257 	 * Allocate enough so we never have to reallocate, it makes
258 	 * it easier.
259 	 *
260 	 * ap_pmcount will be reduced by the scan if we encounter the
261 	 * port multiplier port prior to target 15.
262 	 *
263 	 * kmalloc power-of-2 allocations are guaranteed not to cross
264 	 * a page boundary.  Make sure the identify sub-structure in the
265 	 * at structure does not cross a page boundary, just in case the
266 	 * part is AHCI-1.1 and can't handle multiple DRQ blocks.
267 	 */
268 	if (ap->ap_ata[0] == NULL) {
269 		int pw2;
270 
271 		for (pw2 = 1; pw2 < sizeof(*at); pw2 <<= 1)
272 			;
273 		for (i = 0; i < AHCI_MAX_PMPORTS; ++i) {
274 			at = kmalloc(pw2, M_DEVBUF, M_INTWAIT | M_ZERO);
275 			ap->ap_ata[i] = at;
276 			at->at_ahci_port = ap;
277 			at->at_target = i;
278 			at->at_probe = ATA_PROBE_NEED_INIT;
279 			at->at_features |= ATA_PORT_F_RESCAN;
280 			ksnprintf(at->at_name, sizeof(at->at_name),
281 				  "%s.%d", ap->ap_name, i);
282 		}
283 	}
284 	if (bus_space_subregion(sc->sc_iot, sc->sc_ioh,
285 	    AHCI_PORT_REGION(port), AHCI_PORT_SIZE, &ap->ap_ioh) != 0) {
286 		device_printf(sc->sc_dev,
287 			      "unable to create register window for port %d\n",
288 			      port);
289 		goto freeport;
290 	}
291 
292 	ap->ap_sc = sc;
293 	ap->ap_num = port;
294 	ap->ap_probe = ATA_PROBE_NEED_INIT;
295 	ap->link_pwr_mgmt = AHCI_LINK_PWR_MGMT_NONE;
296 	ap->sysctl_tree = NULL;
297 	TAILQ_INIT(&ap->ap_ccb_free);
298 	TAILQ_INIT(&ap->ap_ccb_pending);
299 	lockinit(&ap->ap_ccb_lock, "ahcipo", 0, 0);
300 
301 	/* Disable port interrupts */
302 	ahci_pwrite(ap, AHCI_PREG_IE, 0);
303 	ahci_pwrite(ap, AHCI_PREG_SERR, -1);
304 
305 	/*
306 	 * Sec 10.1.2 - deinitialise port if it is already running
307 	 */
308 	cmd = ahci_pread(ap, AHCI_PREG_CMD);
309 	kprintf("%s: Caps %b\n", PORTNAME(ap), cmd, AHCI_PFMT_CMD);
310 
311 	if ((cmd & (AHCI_PREG_CMD_ST | AHCI_PREG_CMD_CR |
312 		    AHCI_PREG_CMD_FRE | AHCI_PREG_CMD_FR)) ||
313 	    (ahci_pread(ap, AHCI_PREG_SCTL) & AHCI_PREG_SCTL_DET)) {
314 		int r;
315 
316 		r = ahci_port_stop(ap, 1);
317 		if (r) {
318 			device_printf(sc->sc_dev,
319 				  "unable to disable %s, ignoring port %d\n",
320 				  ((r == 2) ? "CR" : "FR"), port);
321 			rc = ENXIO;
322 			goto freeport;
323 		}
324 
325 		/* Write DET to zero */
326 		ahci_pwrite(ap, AHCI_PREG_SCTL, AHCI_PREG_SCTL_IPM_DISABLED);
327 	}
328 
329 	/* Allocate RFIS */
330 	ap->ap_dmamem_rfis = ahci_dmamem_alloc(sc, sc->sc_tag_rfis);
331 	if (ap->ap_dmamem_rfis == NULL) {
332 		kprintf("%s: NORFIS\n", PORTNAME(ap));
333 		goto nomem;
334 	}
335 
336 	/* Setup RFIS base address */
337 	ap->ap_rfis = (struct ahci_rfis *) AHCI_DMA_KVA(ap->ap_dmamem_rfis);
338 	dva = AHCI_DMA_DVA(ap->ap_dmamem_rfis);
339 	ahci_pwrite(ap, AHCI_PREG_FBU, (u_int32_t)(dva >> 32));
340 	ahci_pwrite(ap, AHCI_PREG_FB, (u_int32_t)dva);
341 
342 	/* Clear SERR before starting FIS reception or ST or anything */
343 	ahci_flush_tfd(ap);
344 	ahci_pwrite(ap, AHCI_PREG_SERR, -1);
345 
346 	/* Enable FIS reception and activate port. */
347 	cmd = ahci_pread(ap, AHCI_PREG_CMD) & ~AHCI_PREG_CMD_ICC;
348 	cmd &= ~(AHCI_PREG_CMD_CLO | AHCI_PREG_CMD_PMA);
349 	cmd |= AHCI_PREG_CMD_FRE | AHCI_PREG_CMD_POD | AHCI_PREG_CMD_SUD;
350 	ahci_pwrite(ap, AHCI_PREG_CMD, cmd | AHCI_PREG_CMD_ICC_ACTIVE);
351 
352 	/* Check whether port activated.  Skip it if not. */
353 	cmd = ahci_pread(ap, AHCI_PREG_CMD) & ~AHCI_PREG_CMD_ICC;
354 	if ((cmd & AHCI_PREG_CMD_FRE) == 0) {
355 		kprintf("%s: NOT-ACTIVATED\n", PORTNAME(ap));
356 		rc = ENXIO;
357 		goto freeport;
358 	}
359 
360 	/* Allocate a CCB for each command slot */
361 	ap->ap_ccbs = kmalloc(sizeof(struct ahci_ccb) * sc->sc_ncmds, M_DEVBUF,
362 			      M_WAITOK | M_ZERO);
363 	if (ap->ap_ccbs == NULL) {
364 		device_printf(sc->sc_dev,
365 			      "unable to allocate command list for port %d\n",
366 			      port);
367 		goto freeport;
368 	}
369 
370 	/* Command List Structures and Command Tables */
371 	ap->ap_dmamem_cmd_list = ahci_dmamem_alloc(sc, sc->sc_tag_cmdh);
372 	ap->ap_dmamem_cmd_table = ahci_dmamem_alloc(sc, sc->sc_tag_cmdt);
373 	if (ap->ap_dmamem_cmd_table == NULL ||
374 	    ap->ap_dmamem_cmd_list == NULL) {
375 nomem:
376 		device_printf(sc->sc_dev,
377 			      "unable to allocate DMA memory for port %d\n",
378 			      port);
379 		goto freeport;
380 	}
381 
382 	/* Setup command list base address */
383 	dva = AHCI_DMA_DVA(ap->ap_dmamem_cmd_list);
384 	ahci_pwrite(ap, AHCI_PREG_CLBU, (u_int32_t)(dva >> 32));
385 	ahci_pwrite(ap, AHCI_PREG_CLB, (u_int32_t)dva);
386 
387 	/* Split CCB allocation into CCBs and assign to command header/table */
388 	hdr = AHCI_DMA_KVA(ap->ap_dmamem_cmd_list);
389 	table = AHCI_DMA_KVA(ap->ap_dmamem_cmd_table);
390 	for (i = 0; i < sc->sc_ncmds; i++) {
391 		ccb = &ap->ap_ccbs[i];
392 
393 		error = bus_dmamap_create(sc->sc_tag_data, BUS_DMA_ALLOCNOW,
394 					  &ccb->ccb_dmamap);
395 		if (error) {
396 			device_printf(sc->sc_dev,
397 				      "unable to create dmamap for port %d "
398 				      "ccb %d\n", port, i);
399 			goto freeport;
400 		}
401 
402 		callout_init_mp(&ccb->ccb_timeout);
403 		ccb->ccb_slot = i;
404 		ccb->ccb_port = ap;
405 		ccb->ccb_cmd_hdr = &hdr[i];
406 		ccb->ccb_cmd_table = &table[i];
407 		dva = AHCI_DMA_DVA(ap->ap_dmamem_cmd_table) +
408 		    ccb->ccb_slot * sizeof(struct ahci_cmd_table);
409 		ccb->ccb_cmd_hdr->ctba_hi = htole32((u_int32_t)(dva >> 32));
410 		ccb->ccb_cmd_hdr->ctba_lo = htole32((u_int32_t)dva);
411 
412 		ccb->ccb_xa.fis =
413 		    (struct ata_fis_h2d *)ccb->ccb_cmd_table->cfis;
414 		ccb->ccb_xa.packetcmd = ccb->ccb_cmd_table->acmd;
415 		ccb->ccb_xa.tag = i;
416 
417 		ccb->ccb_xa.state = ATA_S_COMPLETE;
418 
419 		/*
420 		 * CCB[1] is the error CCB and is not get or put.  It is
421 		 * also used for probing.  Numerous HBAs only load the
422 		 * signature from CCB[1] so it MUST be used for the second
423 		 * FIS.
424 		 */
425 		if (i == 1)
426 			ap->ap_err_ccb = ccb;
427 		else
428 			ahci_put_ccb(ccb);
429 	}
430 
431 	/*
432 	 * Wait for ICC change to complete
433 	 */
434 	ahci_pwait_clr(ap, AHCI_PREG_CMD, AHCI_PREG_CMD_ICC);
435 
436 	/*
437 	 * Calculate the interrupt mask
438 	 */
439 	data = AHCI_PREG_IE_TFEE | AHCI_PREG_IE_HBFE |
440 	       AHCI_PREG_IE_IFE | AHCI_PREG_IE_OFE |
441 	       AHCI_PREG_IE_DPE | AHCI_PREG_IE_UFE |
442 	       AHCI_PREG_IE_PCE | AHCI_PREG_IE_PRCE |
443 	       AHCI_PREG_IE_DHRE | AHCI_PREG_IE_SDBE;
444 	if (ap->ap_sc->sc_cap & AHCI_REG_CAP_SSNTF)
445 		data |= AHCI_PREG_IE_IPME;
446 #ifdef AHCI_COALESCE
447 	if (sc->sc_ccc_ports & (1 << port)
448 		data &= ~(AHCI_PREG_IE_SDBE | AHCI_PREG_IE_DHRE);
449 #endif
450 	ap->ap_intmask = data;
451 
452 	/*
453 	 * Start the port helper thread.  The helper thread will call
454 	 * ahci_port_init() so the ports can all be started in parallel.
455 	 * A failure by ahci_port_init() does not deallocate the port
456 	 * since we still want hot-plug events.
457 	 */
458 	ahci_os_start_port(ap);
459 	return(0);
460 freeport:
461 	ahci_port_free(sc, port);
462 	return (rc);
463 }
464 
465 /*
466  * [re]initialize an idle port.  No CCBs should be active.  (from port thread)
467  *
468  * This function is called during the initial port allocation sequence
469  * and is also called on hot-plug insertion.  We take no chances and
470  * use a portreset instead of a softreset.
471  *
472  * This function is the only way to move a failed port back to active
473  * status.
474  *
475  * Returns 0 if a device is successfully detected.
476  */
477 int
478 ahci_port_init(struct ahci_port *ap)
479 {
480 	u_int32_t cmd;
481 
482 	/*
483 	 * Register [re]initialization
484 	 *
485 	 * Flush the TFD and SERR and make sure the port is stopped before
486 	 * enabling its interrupt.  We no longer cycle the port start as
487 	 * the port should not be started unless a device is present.
488 	 *
489 	 * XXX should we enable FIS reception? (FRE)?
490 	 */
491 	ahci_pwrite(ap, AHCI_PREG_IE, 0);
492 	ahci_port_stop(ap, 0);
493 	if (ap->ap_sc->sc_cap & AHCI_REG_CAP_SSNTF)
494 		ahci_pwrite(ap, AHCI_PREG_SNTF, -1);
495 	ahci_flush_tfd(ap);
496 	ahci_pwrite(ap, AHCI_PREG_SERR, -1);
497 
498 	/*
499 	 * If we are being harsh try to kill the port completely.  Normally
500 	 * we would want to hold on to some of the state the BIOS may have
501 	 * set, such as SUD (spin up device).
502 	 *
503 	 * AP_F_HARSH_REINIT is cleared in the hard reset state
504 	 */
505 	if (ap->ap_flags & AP_F_HARSH_REINIT) {
506 		ahci_pwrite(ap, AHCI_PREG_SCTL, AHCI_PREG_SCTL_IPM_DISABLED);
507 		ahci_pwrite(ap, AHCI_PREG_CMD, 0);
508 
509 		ahci_os_sleep(1000);
510 
511 		cmd = ahci_pread(ap, AHCI_PREG_CMD) & ~AHCI_PREG_CMD_ICC;
512 		cmd &= ~(AHCI_PREG_CMD_CLO | AHCI_PREG_CMD_PMA);
513 		cmd |= AHCI_PREG_CMD_FRE | AHCI_PREG_CMD_POD |
514 		       AHCI_PREG_CMD_SUD;
515 		ahci_pwrite(ap, AHCI_PREG_CMD, cmd | AHCI_PREG_CMD_ICC_ACTIVE);
516 		cmd = ahci_pread(ap, AHCI_PREG_CMD) & ~AHCI_PREG_CMD_ICC;
517 		if ((cmd & AHCI_PREG_CMD_FRE) == 0) {
518 			kprintf("%s: Warning: FRE did not come up during "
519 				"harsh reinitialization\n",
520 				PORTNAME(ap));
521 		}
522 		ahci_os_sleep(1000);
523 	}
524 
525 	/*
526 	 * Clear any pending garbage and re-enable the interrupt before
527 	 * going to the next stage.
528 	 */
529 	ap->ap_probe = ATA_PROBE_NEED_HARD_RESET;
530 	ap->ap_pmcount = 0;
531 
532 	if (ap->ap_sc->sc_cap & AHCI_REG_CAP_SSNTF)
533 		ahci_pwrite(ap, AHCI_PREG_SNTF, -1);
534 	ahci_flush_tfd(ap);
535 	ahci_pwrite(ap, AHCI_PREG_SERR, -1);
536 	ahci_pwrite(ap, AHCI_PREG_IS, -1);
537 
538 	ahci_port_interrupt_enable(ap);
539 
540 	return (0);
541 }
542 
543 /*
544  * Enable or re-enable interrupts on a port.
545  *
546  * This routine is called from the port initialization code or from the
547  * helper thread as the real interrupt may be forced to turn off certain
548  * interrupt sources.
549  */
550 void
551 ahci_port_interrupt_enable(struct ahci_port *ap)
552 {
553 	ahci_pwrite(ap, AHCI_PREG_IE, ap->ap_intmask);
554 }
555 
556 /*
557  * Manage the agressive link power management capability.
558  */
559 void
560 ahci_port_link_pwr_mgmt(struct ahci_port *ap, int link_pwr_mgmt)
561 {
562 	u_int32_t cmd, sctl;
563 
564 	if (link_pwr_mgmt == ap->link_pwr_mgmt)
565 		return;
566 
567 	if ((ap->ap_sc->sc_cap & AHCI_REG_CAP_SALP) == 0) {
568 		kprintf("%s: link power management not supported.\n",
569 			PORTNAME(ap));
570 		return;
571 	}
572 
573 	ahci_os_lock_port(ap);
574 
575 	if (link_pwr_mgmt == AHCI_LINK_PWR_MGMT_AGGR &&
576 	    (ap->ap_sc->sc_cap & AHCI_REG_CAP_SSC)) {
577 		kprintf("%s: enabling aggressive link power management.\n",
578 			PORTNAME(ap));
579 
580 		ap->link_pwr_mgmt = link_pwr_mgmt;
581 
582 		ap->ap_intmask &= ~AHCI_PREG_IE_PRCE;
583 		ahci_port_interrupt_enable(ap);
584 
585 		sctl = ahci_pread(ap, AHCI_PREG_SCTL);
586 		sctl &= ~(AHCI_PREG_SCTL_IPM_DISABLED);
587 		ahci_pwrite(ap, AHCI_PREG_SCTL, sctl);
588 
589 		/*
590 		 * Enable device initiated link power management for
591 		 * directly attached devices that support it.
592 		 */
593 		if (ap->ap_type != ATA_PORT_T_PM &&
594 		    ap->ap_ata[0]->at_identify.satafsup & (1 << 3)) {
595 			if (ahci_set_feature(ap, NULL, ATA_SATAFT_DEVIPS, 1))
596 				kprintf("%s: Could not enable device initiated "
597 				    "link power management.\n",
598 				    PORTNAME(ap));
599 		}
600 
601 		cmd = ahci_pread(ap, AHCI_PREG_CMD);
602 		cmd |= AHCI_PREG_CMD_ASP;
603 		cmd |= AHCI_PREG_CMD_ALPE;
604 		ahci_pwrite(ap, AHCI_PREG_CMD, cmd);
605 
606 	} else if (link_pwr_mgmt == AHCI_LINK_PWR_MGMT_MEDIUM &&
607 	           (ap->ap_sc->sc_cap & AHCI_REG_CAP_PSC)) {
608 		kprintf("%s: enabling medium link power management.\n",
609 			PORTNAME(ap));
610 
611 		ap->link_pwr_mgmt = link_pwr_mgmt;
612 
613 		ap->ap_intmask &= ~AHCI_PREG_IE_PRCE;
614 		ahci_port_interrupt_enable(ap);
615 
616 		sctl = ahci_pread(ap, AHCI_PREG_SCTL);
617 		sctl |= AHCI_PREG_SCTL_IPM_DISABLED;
618 		sctl &= ~AHCI_PREG_SCTL_IPM_NOPARTIAL;
619 		ahci_pwrite(ap, AHCI_PREG_SCTL, sctl);
620 
621 		cmd = ahci_pread(ap, AHCI_PREG_CMD);
622 		cmd &= ~AHCI_PREG_CMD_ASP;
623 		cmd |= AHCI_PREG_CMD_ALPE;
624 		ahci_pwrite(ap, AHCI_PREG_CMD, cmd);
625 
626 	} else if (link_pwr_mgmt == AHCI_LINK_PWR_MGMT_NONE) {
627 		kprintf("%s: disabling link power management.\n",
628 			PORTNAME(ap));
629 
630 		/* Disable device initiated link power management */
631 		if (ap->ap_type != ATA_PORT_T_PM &&
632 		    ap->ap_ata[0]->at_identify.satafsup & (1 << 3))
633 			ahci_set_feature(ap, NULL, ATA_SATAFT_DEVIPS, 0);
634 
635 		cmd = ahci_pread(ap, AHCI_PREG_CMD);
636 		cmd &= ~(AHCI_PREG_CMD_ALPE | AHCI_PREG_CMD_ASP);
637 		ahci_pwrite(ap, AHCI_PREG_CMD, cmd);
638 
639 		sctl = ahci_pread(ap, AHCI_PREG_SCTL);
640 		sctl |= AHCI_PREG_SCTL_IPM_DISABLED;
641 		ahci_pwrite(ap, AHCI_PREG_SCTL, sctl);
642 
643 		/* let the drive come back to avoid PRCS interrupts later */
644 		ahci_os_unlock_port(ap);
645 		ahci_os_sleep(1000);
646 		ahci_os_lock_port(ap);
647 
648 		ahci_pwrite(ap, AHCI_PREG_SERR,
649 			    AHCI_PREG_SERR_DIAG_N | AHCI_PREG_SERR_DIAG_W);
650 		ahci_pwrite(ap, AHCI_PREG_IS, AHCI_PREG_IS_PRCS);
651 
652 		ap->ap_intmask |= AHCI_PREG_IE_PRCE;
653 		ahci_port_interrupt_enable(ap);
654 
655 		ap->link_pwr_mgmt = link_pwr_mgmt;
656 	} else {
657 		kprintf("%s: unsupported link power management state %d.\n",
658 			PORTNAME(ap), link_pwr_mgmt);
659 	}
660 
661 	ahci_os_unlock_port(ap);
662 }
663 
664 /*
665  * Return current link power state.
666  */
667 int
668 ahci_port_link_pwr_state(struct ahci_port *ap)
669 {
670 	uint32_t r;
671 
672 	r = ahci_pread(ap, AHCI_PREG_SSTS);
673 	switch (r & SATA_PM_SSTS_IPM) {
674 	case SATA_PM_SSTS_IPM_ACTIVE:
675 		return 1;
676 	case SATA_PM_SSTS_IPM_PARTIAL:
677 		return 2;
678 	case SATA_PM_SSTS_IPM_SLUMBER:
679 		return 3;
680 	default:
681 		return 0;
682 	}
683 }
684 
685 /*
686  * Run the port / target state machine from a main context.
687  *
688  * The state machine for the port is always run.
689  *
690  * If atx is non-NULL run the state machine for a particular target.
691  * If atx is NULL run the state machine for all targets.
692  */
693 void
694 ahci_port_state_machine(struct ahci_port *ap, int initial)
695 {
696 	struct ata_port *at;
697 	u_int32_t data;
698 	int target;
699 	int didsleep;
700 	int loop;
701 
702 	/*
703 	 * State machine for port.  Note that CAM is not yet associated
704 	 * during the initial parallel probe and the port's probe state
705 	 * will not get past ATA_PROBE_NEED_IDENT.
706 	 */
707 	{
708 		if (initial == 0 && ap->ap_probe <= ATA_PROBE_NEED_HARD_RESET) {
709 			kprintf("%s: Waiting 10 seconds on insertion\n",
710 				PORTNAME(ap));
711 			ahci_os_sleep(10000);
712 			initial = 1;
713 		}
714 		if (ap->ap_probe == ATA_PROBE_NEED_INIT)
715 			ahci_port_init(ap);
716 		if (ap->ap_probe == ATA_PROBE_NEED_HARD_RESET)
717 			ahci_port_reset(ap, NULL, 1);
718 		if (ap->ap_probe == ATA_PROBE_NEED_SOFT_RESET)
719 			ahci_port_reset(ap, NULL, 0);
720 		if (ap->ap_probe == ATA_PROBE_NEED_IDENT)
721 			ahci_cam_probe(ap, NULL);
722 	}
723 	if (ap->ap_type != ATA_PORT_T_PM) {
724 		if (ap->ap_probe == ATA_PROBE_FAILED) {
725 			ahci_cam_changed(ap, NULL, 0);
726 		} else if (ap->ap_probe >= ATA_PROBE_NEED_IDENT) {
727 			ahci_cam_changed(ap, NULL, 1);
728 		}
729 		return;
730 	}
731 
732 	/*
733 	 * Port Multiplier state machine.
734 	 *
735 	 * Get a mask of changed targets and combine with any runnable
736 	 * states already present.
737 	 */
738 	for (loop = 0; ;++loop) {
739 		if (ahci_pm_read(ap, 15, SATA_PMREG_EINFO, &data)) {
740 			kprintf("%s: PM unable to read hot-plug bitmap\n",
741 				PORTNAME(ap));
742 			break;
743 		}
744 
745 		/*
746 		 * Do at least one loop, then stop if no more state changes
747 		 * have occured.  The PM might not generate a new
748 		 * notification until we clear the entire bitmap.
749 		 */
750 		if (loop && data == 0)
751 			break;
752 
753 		/*
754 		 * New devices showing up in the bitmap require some spin-up
755 		 * time before we start probing them.  Reset didsleep.  The
756 		 * first new device we detect will sleep before probing.
757 		 *
758 		 * This only applies to devices whos change bit is set in
759 		 * the data, and does not apply to the initial boot-time
760 		 * probe.
761 		 */
762 		didsleep = 0;
763 
764 		for (target = 0; target < ap->ap_pmcount; ++target) {
765 			at = ap->ap_ata[target];
766 
767 			/*
768 			 * Check the target state for targets behind the PM
769 			 * which have changed state.  This will adjust
770 			 * at_probe and set ATA_PORT_F_RESCAN
771 			 *
772 			 * We want to wait at least 10 seconds before probing
773 			 * a newly inserted device.  If the check status
774 			 * indicates a device is present and in need of a
775 			 * hard reset, we make sure we have slept before
776 			 * continuing.
777 			 *
778 			 * We also need to wait at least 1 second for the
779 			 * PHY state to change after insertion, if we
780 			 * haven't already waited the 10 seconds.
781 			 *
782 			 * NOTE: When pm_check_good finds a good port it
783 			 *	 typically starts us in probe state
784 			 *	 NEED_HARD_RESET rather than INIT.
785 			 */
786 			if (data & (1 << target)) {
787 				if (initial == 0 && didsleep == 0)
788 					ahci_os_sleep(1000);
789 				ahci_pm_check_good(ap, target);
790 				if (initial == 0 && didsleep == 0 &&
791 				    at->at_probe <= ATA_PROBE_NEED_HARD_RESET
792 				) {
793 					didsleep = 1;
794 					kprintf("%s: Waiting 10 seconds on insertion\n", PORTNAME(ap));
795 					ahci_os_sleep(10000);
796 				}
797 			}
798 
799 			/*
800 			 * Report hot-plug events before the probe state
801 			 * really gets hot.  Only actual events are reported
802 			 * here to reduce spew.
803 			 */
804 			if (data & (1 << target)) {
805 				kprintf("%s: HOTPLUG (PM) - ", ATANAME(ap, at));
806 				switch(at->at_probe) {
807 				case ATA_PROBE_NEED_INIT:
808 				case ATA_PROBE_NEED_HARD_RESET:
809 					kprintf("Device inserted\n");
810 					break;
811 				case ATA_PROBE_FAILED:
812 					kprintf("Device removed\n");
813 					break;
814 				default:
815 					kprintf("Device probe in progress\n");
816 					break;
817 				}
818 			}
819 
820 			/*
821 			 * Run through the state machine as necessary if
822 			 * the port is not marked failed.
823 			 *
824 			 * The state machine may stop at NEED_IDENT if
825 			 * CAM is not yet attached.
826 			 *
827 			 * Acquire exclusive access to the port while we
828 			 * are doing this.  This prevents command-completion
829 			 * from queueing commands for non-polled targets
830 			 * inbetween our probe steps.  We need to do this
831 			 * because the reset probes can generate severe PHY
832 			 * and protocol errors and soft-brick the port.
833 			 */
834 			if (at->at_probe != ATA_PROBE_FAILED &&
835 			    at->at_probe != ATA_PROBE_GOOD) {
836 				ahci_beg_exclusive_access(ap, at);
837 				if (at->at_probe == ATA_PROBE_NEED_INIT)
838 					ahci_pm_port_init(ap, at);
839 				if (at->at_probe == ATA_PROBE_NEED_HARD_RESET)
840 					ahci_port_reset(ap, at, 1);
841 				if (at->at_probe == ATA_PROBE_NEED_SOFT_RESET)
842 					ahci_port_reset(ap, at, 0);
843 				if (at->at_probe == ATA_PROBE_NEED_IDENT)
844 					ahci_cam_probe(ap, at);
845 				ahci_end_exclusive_access(ap, at);
846 			}
847 
848 			/*
849 			 * Add or remove from CAM
850 			 */
851 			if (at->at_features & ATA_PORT_F_RESCAN) {
852 				at->at_features &= ~ATA_PORT_F_RESCAN;
853 				if (at->at_probe == ATA_PROBE_FAILED) {
854 					ahci_cam_changed(ap, at, 0);
855 				} else if (at->at_probe >= ATA_PROBE_NEED_IDENT) {
856 					ahci_cam_changed(ap, at, 1);
857 				}
858 			}
859 			data &= ~(1 << target);
860 		}
861 		if (data) {
862 			kprintf("%s: WARNING (PM): extra bits set in "
863 				"EINFO: %08x\n", PORTNAME(ap), data);
864 			while (target < AHCI_MAX_PMPORTS) {
865 				ahci_pm_check_good(ap, target);
866 				++target;
867 			}
868 		}
869 	}
870 }
871 
872 
873 /*
874  * De-initialize and detach a port.
875  */
876 void
877 ahci_port_free(struct ahci_softc *sc, u_int port)
878 {
879 	struct ahci_port	*ap = sc->sc_ports[port];
880 	struct ahci_ccb		*ccb;
881 	int i;
882 
883 	/*
884 	 * Ensure port is disabled and its interrupts are all flushed.
885 	 */
886 	if (ap->ap_sc) {
887 		ahci_port_stop(ap, 1);
888 		ahci_os_stop_port(ap);
889 		ahci_pwrite(ap, AHCI_PREG_CMD, 0);
890 		ahci_pwrite(ap, AHCI_PREG_IE, 0);
891 		ahci_pwrite(ap, AHCI_PREG_IS, ahci_pread(ap, AHCI_PREG_IS));
892 		ahci_write(sc, AHCI_REG_IS, 1 << port);
893 	}
894 
895 	if (ap->ap_ccbs) {
896 		while ((ccb = ahci_get_ccb(ap)) != NULL) {
897 			if (ccb->ccb_dmamap) {
898 				bus_dmamap_destroy(sc->sc_tag_data,
899 						   ccb->ccb_dmamap);
900 				ccb->ccb_dmamap = NULL;
901 			}
902 		}
903 		if ((ccb = ap->ap_err_ccb) != NULL) {
904 			if (ccb->ccb_dmamap) {
905 				bus_dmamap_destroy(sc->sc_tag_data,
906 						   ccb->ccb_dmamap);
907 				ccb->ccb_dmamap = NULL;
908 			}
909 			ap->ap_err_ccb = NULL;
910 		}
911 		kfree(ap->ap_ccbs, M_DEVBUF);
912 		ap->ap_ccbs = NULL;
913 	}
914 
915 	if (ap->ap_dmamem_cmd_list) {
916 		ahci_dmamem_free(sc, ap->ap_dmamem_cmd_list);
917 		ap->ap_dmamem_cmd_list = NULL;
918 	}
919 	if (ap->ap_dmamem_rfis) {
920 		ahci_dmamem_free(sc, ap->ap_dmamem_rfis);
921 		ap->ap_dmamem_rfis = NULL;
922 	}
923 	if (ap->ap_dmamem_cmd_table) {
924 		ahci_dmamem_free(sc, ap->ap_dmamem_cmd_table);
925 		ap->ap_dmamem_cmd_table = NULL;
926 	}
927 	if (ap->ap_ata) {
928 		for (i = 0; i < AHCI_MAX_PMPORTS; ++i) {
929 			if (ap->ap_ata[i]) {
930 				kfree(ap->ap_ata[i], M_DEVBUF);
931 				ap->ap_ata[i] = NULL;
932 			}
933 		}
934 	}
935 	if (ap->ap_err_scratch) {
936 		kfree(ap->ap_err_scratch, M_DEVBUF);
937 		ap->ap_err_scratch = NULL;
938 	}
939 
940 	/* bus_space(9) says we dont free the subregions handle */
941 
942 	kfree(ap, M_DEVBUF);
943 	sc->sc_ports[port] = NULL;
944 }
945 
946 static
947 u_int32_t
948 ahci_pactive(struct ahci_port *ap)
949 {
950 	u_int32_t mask;
951 
952 	mask = ahci_pread(ap, AHCI_PREG_CI);
953 	if (ap->ap_sc->sc_cap & AHCI_REG_CAP_SNCQ)
954 		mask |= ahci_pread(ap, AHCI_PREG_SACT);
955 	return(mask);
956 }
957 
958 /*
959  * Start high-level command processing on the port
960  */
961 int
962 ahci_port_start(struct ahci_port *ap)
963 {
964 	u_int32_t	r, s, is, tfd;
965 
966 	/*
967 	 * FRE must be turned on before ST.  Wait for FR to go active
968 	 * before turning on ST.  The spec doesn't seem to think this
969 	 * is necessary but waiting here avoids an on-off race in the
970 	 * ahci_port_stop() code.
971 	 */
972 	r = ahci_pread(ap, AHCI_PREG_CMD);
973 	if ((r & AHCI_PREG_CMD_FRE) == 0) {
974 		r |= AHCI_PREG_CMD_FRE;
975 		ahci_pwrite(ap, AHCI_PREG_CMD, r);
976 	}
977 	if ((ap->ap_sc->sc_flags & AHCI_F_IGN_FR) == 0) {
978 		if (ahci_pwait_set(ap, AHCI_PREG_CMD, AHCI_PREG_CMD_FR)) {
979 			kprintf("%s: Cannot start FIS reception\n",
980 				PORTNAME(ap));
981 			return (2);
982 		}
983 	} else {
984 		ahci_os_sleep(10);
985 	}
986 
987 	/*
988 	 * Turn on ST, wait for CR to come up.
989 	 */
990 	r |= AHCI_PREG_CMD_ST;
991 	ahci_pwrite(ap, AHCI_PREG_CMD, r);
992 	if (ahci_pwait_set_to(ap, 2000, AHCI_PREG_CMD, AHCI_PREG_CMD_CR)) {
993 		s = ahci_pread(ap, AHCI_PREG_SERR);
994 		is = ahci_pread(ap, AHCI_PREG_IS);
995 		tfd = ahci_pread(ap, AHCI_PREG_TFD);
996 		kprintf("%s: Cannot start command DMA\n"
997 			"NCMP=%b NSERR=%b\n"
998 			"NEWIS=%b\n"
999 			"NEWTFD=%b\n",
1000 			PORTNAME(ap),
1001 			r, AHCI_PFMT_CMD, s, AHCI_PFMT_SERR,
1002 			is, AHCI_PFMT_IS,
1003 			tfd, AHCI_PFMT_TFD_STS);
1004 		return (1);
1005 	}
1006 
1007 #ifdef AHCI_COALESCE
1008 	/*
1009 	 * (Re-)enable coalescing on the port.
1010 	 */
1011 	if (ap->ap_sc->sc_ccc_ports & (1 << ap->ap_num)) {
1012 		ap->ap_sc->sc_ccc_ports_cur |= (1 << ap->ap_num);
1013 		ahci_write(ap->ap_sc, AHCI_REG_CCC_PORTS,
1014 		    ap->ap_sc->sc_ccc_ports_cur);
1015 	}
1016 #endif
1017 
1018 	return (0);
1019 }
1020 
1021 /*
1022  * Stop high-level command processing on a port
1023  *
1024  * WARNING!  If the port is stopped while CR is still active our saved
1025  *	     CI/SACT will race any commands completed by the command
1026  *	     processor prior to being able to stop.  Thus we never call
1027  *	     this function unless we intend to dispose of any remaining
1028  *	     active commands.  In particular, this complicates the timeout
1029  *	     code.
1030  */
1031 int
1032 ahci_port_stop(struct ahci_port *ap, int stop_fis_rx)
1033 {
1034 	u_int32_t	r;
1035 
1036 #ifdef AHCI_COALESCE
1037 	/*
1038 	 * Disable coalescing on the port while it is stopped.
1039 	 */
1040 	if (ap->ap_sc->sc_ccc_ports & (1 << ap->ap_num)) {
1041 		ap->ap_sc->sc_ccc_ports_cur &= ~(1 << ap->ap_num);
1042 		ahci_write(ap->ap_sc, AHCI_REG_CCC_PORTS,
1043 		    ap->ap_sc->sc_ccc_ports_cur);
1044 	}
1045 #endif
1046 
1047 	/*
1048 	 * Turn off ST, then wait for CR to go off.
1049 	 */
1050 	r = ahci_pread(ap, AHCI_PREG_CMD) & ~AHCI_PREG_CMD_ICC;
1051 	r &= ~AHCI_PREG_CMD_ST;
1052 	ahci_pwrite(ap, AHCI_PREG_CMD, r);
1053 
1054 	if (ahci_pwait_clr(ap, AHCI_PREG_CMD, AHCI_PREG_CMD_CR)) {
1055 		kprintf("%s: Port bricked, unable to stop (ST)\n",
1056 			PORTNAME(ap));
1057 		return (1);
1058 	}
1059 
1060 #if 0
1061 	/*
1062 	 * Turn off FRE, then wait for FR to go off.  FRE cannot
1063 	 * be turned off until CR transitions to 0.
1064 	 */
1065 	if ((r & AHCI_PREG_CMD_FR) == 0) {
1066 		kprintf("%s: FR stopped, clear FRE for next start\n",
1067 			PORTNAME(ap));
1068 		stop_fis_rx = 2;
1069 	}
1070 #endif
1071 	if (stop_fis_rx) {
1072 		r &= ~AHCI_PREG_CMD_FRE;
1073 		ahci_pwrite(ap, AHCI_PREG_CMD, r);
1074 		if (ahci_pwait_clr(ap, AHCI_PREG_CMD, AHCI_PREG_CMD_FR)) {
1075 			kprintf("%s: Port bricked, unable to stop (FRE)\n",
1076 				PORTNAME(ap));
1077 			return (2);
1078 		}
1079 	}
1080 
1081 	return (0);
1082 }
1083 
1084 /*
1085  * AHCI command list override -> forcibly clear TFD.STS.{BSY,DRQ}
1086  */
1087 int
1088 ahci_port_clo(struct ahci_port *ap)
1089 {
1090 	struct ahci_softc		*sc = ap->ap_sc;
1091 	u_int32_t			cmd;
1092 
1093 	/* Only attempt CLO if supported by controller */
1094 	if ((ahci_read(sc, AHCI_REG_CAP) & AHCI_REG_CAP_SCLO) == 0)
1095 		return (1);
1096 
1097 	/* Issue CLO */
1098 	cmd = ahci_pread(ap, AHCI_PREG_CMD) & ~AHCI_PREG_CMD_ICC;
1099 	ahci_pwrite(ap, AHCI_PREG_CMD, cmd | AHCI_PREG_CMD_CLO);
1100 
1101 	/* Wait for completion */
1102 	if (ahci_pwait_clr(ap, AHCI_PREG_CMD, AHCI_PREG_CMD_CLO)) {
1103 		kprintf("%s: CLO did not complete\n", PORTNAME(ap));
1104 		return (1);
1105 	}
1106 
1107 	return (0);
1108 }
1109 
1110 /*
1111  * Reset a port.
1112  *
1113  * If hard is 0 perform a softreset of the port.
1114  * If hard is 1 perform a hard reset of the port.
1115  *
1116  * If at is non-NULL an indirect port via a port-multiplier is being
1117  * reset, otherwise a direct port is being reset.
1118  *
1119  * NOTE: Indirect ports can only be soft-reset.
1120  */
1121 int
1122 ahci_port_reset(struct ahci_port *ap, struct ata_port *at, int hard)
1123 {
1124 	int rc;
1125 
1126 	if (hard) {
1127 		if (at)
1128 			rc = ahci_pm_hardreset(ap, at->at_target, hard);
1129 		else
1130 			rc = ahci_port_hardreset(ap, hard);
1131 	} else {
1132 		if (at)
1133 			rc = ahci_pm_softreset(ap, at->at_target);
1134 		else
1135 			rc = ahci_port_softreset(ap);
1136 	}
1137 	return(rc);
1138 }
1139 
1140 /*
1141  * AHCI soft reset, Section 10.4.1
1142  *
1143  * (at) will be NULL when soft-resetting a directly-attached device, and
1144  * non-NULL when soft-resetting a device through a port multiplier.
1145  *
1146  * This function keeps port communications intact and attempts to generate
1147  * a reset to the connected device using device commands.
1148  */
1149 int
1150 ahci_port_softreset(struct ahci_port *ap)
1151 {
1152 	struct ahci_ccb		*ccb = NULL;
1153 	struct ahci_cmd_hdr	*cmd_slot;
1154 	u_int8_t		*fis;
1155 	int			error;
1156 
1157 	error = EIO;
1158 
1159 	if (bootverbose) {
1160 		kprintf("%s: START SOFTRESET %b\n", PORTNAME(ap),
1161 			ahci_pread(ap, AHCI_PREG_CMD), AHCI_PFMT_CMD);
1162 	}
1163 
1164 	DPRINTF(AHCI_D_VERBOSE, "%s: soft reset\n", PORTNAME(ap));
1165 
1166 	crit_enter();
1167 	ap->ap_flags |= AP_F_IN_RESET;
1168 	ap->ap_state = AP_S_NORMAL;
1169 
1170 	/*
1171 	 * Remember port state in cmd (main to restore start/stop)
1172 	 *
1173 	 * Idle port.
1174 	 */
1175 	if (ahci_port_stop(ap, 0)) {
1176 		kprintf("%s: failed to stop port, cannot softreset\n",
1177 			PORTNAME(ap));
1178 		goto err;
1179 	}
1180 
1181 	/*
1182 	 * Request CLO if device appears hung.
1183 	 */
1184 	if (ahci_pread(ap, AHCI_PREG_TFD) &
1185 		   (AHCI_PREG_TFD_STS_BSY | AHCI_PREG_TFD_STS_DRQ)) {
1186 		ahci_port_clo(ap);
1187 	}
1188 
1189 	/*
1190 	 * This is an attempt to clear errors so a new signature will
1191 	 * be latched.  It isn't working properly.  XXX
1192 	 */
1193 	ahci_flush_tfd(ap);
1194 	ahci_pwrite(ap, AHCI_PREG_SERR, -1);
1195 
1196 	/* Restart port */
1197 	if (ahci_port_start(ap)) {
1198 		kprintf("%s: failed to start port, cannot softreset\n",
1199 		        PORTNAME(ap));
1200 		goto err;
1201 	}
1202 
1203 	/* Check whether CLO worked */
1204 	if (ahci_pwait_clr(ap, AHCI_PREG_TFD,
1205 			       AHCI_PREG_TFD_STS_BSY | AHCI_PREG_TFD_STS_DRQ)) {
1206 		kprintf("%s: CLO %s, need port reset\n",
1207 			PORTNAME(ap),
1208 			(ahci_read(ap->ap_sc, AHCI_REG_CAP) & AHCI_REG_CAP_SCLO)
1209 			? "failed" : "unsupported");
1210 		error = EBUSY;
1211 		goto err;
1212 	}
1213 
1214 	/*
1215 	 * Prep first D2H command with SRST feature & clear busy/reset flags
1216 	 *
1217 	 * It is unclear which other fields in the FIS are used.  Just zero
1218 	 * everything.
1219 	 *
1220 	 * NOTE!  This CCB is used for both the first and second commands.
1221 	 *	  The second command must use CCB slot 1 to properly load
1222 	 *	  the signature.
1223 	 */
1224 	ccb = ahci_get_err_ccb(ap);
1225 	ccb->ccb_xa.complete = ahci_dummy_done;
1226 	ccb->ccb_xa.flags = ATA_F_POLL | ATA_F_EXCLUSIVE;
1227 	KKASSERT(ccb->ccb_slot == 1);
1228 	ccb->ccb_xa.at = NULL;
1229 	cmd_slot = ccb->ccb_cmd_hdr;
1230 
1231 	fis = ccb->ccb_cmd_table->cfis;
1232 	bzero(fis, sizeof(ccb->ccb_cmd_table->cfis));
1233 	fis[0] = ATA_FIS_TYPE_H2D;
1234 	fis[15] = ATA_FIS_CONTROL_SRST|ATA_FIS_CONTROL_4BIT;
1235 
1236 	cmd_slot->prdtl = 0;
1237 	cmd_slot->flags = htole16(5);	/* FIS length: 5 DWORDS */
1238 	cmd_slot->flags |= htole16(AHCI_CMD_LIST_FLAG_C); /* Clear busy on OK */
1239 	cmd_slot->flags |= htole16(AHCI_CMD_LIST_FLAG_R); /* Reset */
1240 
1241 	ccb->ccb_xa.state = ATA_S_PENDING;
1242 
1243 	if (ahci_poll(ccb, 1000, ahci_quick_timeout) != ATA_S_COMPLETE) {
1244 		kprintf("%s: First FIS failed\n", PORTNAME(ap));
1245 		goto err;
1246 	}
1247 
1248 	/*
1249 	 * WARNING!	TIME SENSITIVE SPACE!	WARNING!
1250 	 *
1251 	 * The two FISes are supposed to be back to back.  Don't issue other
1252 	 * commands or even delay if we can help it.
1253 	 */
1254 
1255 	/*
1256 	 * Prep second D2H command to read status and complete reset sequence
1257 	 * AHCI 10.4.1 and "Serial ATA Revision 2.6".  I can't find the ATA
1258 	 * Rev 2.6 and it is unclear how the second FIS should be set up
1259 	 * from the AHCI document.
1260 	 *
1261 	 * It is unclear which other fields in the FIS are used.  Just zero
1262 	 * everything.
1263 	 */
1264 	ccb->ccb_xa.flags = ATA_F_POLL | ATA_F_AUTOSENSE | ATA_F_EXCLUSIVE;
1265 
1266 	bzero(fis, sizeof(ccb->ccb_cmd_table->cfis));
1267 	fis[0] = ATA_FIS_TYPE_H2D;
1268 	fis[15] = ATA_FIS_CONTROL_4BIT;
1269 
1270 	cmd_slot->prdtl = 0;
1271 	cmd_slot->flags = htole16(5);	/* FIS length: 5 DWORDS */
1272 
1273 	ccb->ccb_xa.state = ATA_S_PENDING;
1274 	if (ahci_poll(ccb, 1000, ahci_quick_timeout) != ATA_S_COMPLETE) {
1275 		kprintf("%s: Second FIS failed\n", PORTNAME(ap));
1276 		goto err;
1277 	}
1278 
1279 	if (ahci_pwait_clr(ap, AHCI_PREG_TFD,
1280 			    AHCI_PREG_TFD_STS_BSY | AHCI_PREG_TFD_STS_DRQ)) {
1281 		kprintf("%s: device didn't come ready after reset, TFD: 0x%b\n",
1282 			PORTNAME(ap),
1283 			ahci_pread(ap, AHCI_PREG_TFD), AHCI_PFMT_TFD_STS);
1284 		error = EBUSY;
1285 		goto err;
1286 	}
1287 
1288 	/*
1289 	 * If the softreset is trying to clear a BSY condition after a
1290 	 * normal portreset we assign the port type.
1291 	 *
1292 	 * If the softreset is being run first as part of the ccb error
1293 	 * processing code then report if the device signature changed
1294 	 * unexpectedly.
1295 	 */
1296 	ahci_os_sleep(100);
1297 	if (ap->ap_type == ATA_PORT_T_NONE) {
1298 		ap->ap_type = ahci_port_signature_detect(ap, NULL);
1299 	} else {
1300 		if (ahci_port_signature_detect(ap, NULL) != ap->ap_type) {
1301 			kprintf("%s: device signature unexpectedly "
1302 				"changed\n", PORTNAME(ap));
1303 			error = EBUSY; /* XXX */
1304 		}
1305 	}
1306 	error = 0;
1307 
1308 	ahci_os_sleep(3);
1309 err:
1310 	if (ccb != NULL) {
1311 		ahci_put_err_ccb(ccb);
1312 
1313 		/*
1314 		 * If the target is busy use CLO to clear the busy
1315 		 * condition.  The BSY should be cleared on the next
1316 		 * start.
1317 		 */
1318 		if (ahci_pread(ap, AHCI_PREG_TFD) &
1319 		    (AHCI_PREG_TFD_STS_BSY | AHCI_PREG_TFD_STS_DRQ)) {
1320 			ahci_port_clo(ap);
1321 		}
1322 	}
1323 
1324 	/*
1325 	 * If we failed to softreset make the port quiescent, otherwise
1326 	 * make sure the port's start/stop state matches what it was on
1327 	 * entry.
1328 	 *
1329 	 * Don't kill the port if the softreset is on a port multiplier
1330 	 * target, that would kill all the targets!
1331 	 */
1332 	if (error) {
1333 		ahci_port_hardstop(ap);
1334 		/* ap_probe set to failed */
1335 	} else {
1336 		ap->ap_probe = ATA_PROBE_NEED_IDENT;
1337 		ap->ap_pmcount = 1;
1338 		ahci_port_start(ap);
1339 	}
1340 	ap->ap_flags &= ~AP_F_IN_RESET;
1341 	crit_exit();
1342 
1343 	if (bootverbose)
1344 		kprintf("%s: END SOFTRESET\n", PORTNAME(ap));
1345 
1346 	return (error);
1347 }
1348 
1349 /*
1350  * Issue just do the core COMRESET and basic device detection on a port.
1351  *
1352  * NOTE: Only called by ahci_port_hardreset().
1353  */
1354 static int
1355 ahci_comreset(struct ahci_port *ap, int *pmdetectp)
1356 {
1357 	u_int32_t cmd;
1358 	u_int32_t r;
1359 	int error;
1360 	int loop;
1361 	int retries = 0;
1362 
1363 	/*
1364 	 * Idle the port,
1365 	 */
1366 	*pmdetectp = 0;
1367 	ahci_port_stop(ap, 0);
1368 	ap->ap_state = AP_S_NORMAL;
1369 	ahci_os_sleep(10);
1370 
1371 	/*
1372 	 * The port may have been quiescent with its SUD bit cleared, so
1373 	 * set the SUD (spin up device).
1374 	 *
1375 	 * NOTE: I do not know if SUD is a hardware pin/low-level signal
1376 	 *	 or if it is messaged.
1377 	 */
1378 	cmd = ahci_pread(ap, AHCI_PREG_CMD) & ~AHCI_PREG_CMD_ICC;
1379 
1380 	cmd |= AHCI_PREG_CMD_SUD | AHCI_PREG_CMD_POD;
1381 	ahci_pwrite(ap, AHCI_PREG_CMD, cmd);
1382 	ahci_os_sleep(10);
1383 
1384 	/*
1385 	 * Make sure that all power management is disabled.
1386 	 *
1387 	 * NOTE!  AHCI_PREG_SCTL_DET_DISABLE seems to be highly unreliable
1388 	 *	  on multiple chipsets and can brick the chipset or even
1389 	 *	  the whole PC.  Never use it.
1390 	 */
1391 	ap->ap_type = ATA_PORT_T_NONE;
1392 
1393 	r = AHCI_PREG_SCTL_IPM_DISABLED |
1394 	    AHCI_PREG_SCTL_SPM_DISABLED;
1395 	ahci_pwrite(ap, AHCI_PREG_SCTL, r);
1396 
1397 retry:
1398 	/*
1399 	 * Give the new power management state time to settle, then clear
1400 	 * pending status.
1401 	 */
1402 	ahci_os_sleep(1000);
1403 	ahci_flush_tfd(ap);
1404 	ahci_pwrite(ap, AHCI_PREG_SERR, -1);
1405 
1406 	/*
1407 	 * Start transmitting COMRESET.  The spec says that COMRESET must
1408 	 * be sent for at least 1ms but in actual fact numerous devices
1409 	 * appear to take much longer.  Delay a whole second here.
1410 	 *
1411 	 * In addition, SATA-3 ports can take longer to train, so even
1412 	 * SATA-2 devices which would normally detect very quickly may
1413 	 * take longer when plugged into a SATA-3 port.
1414 	 */
1415 	r |= AHCI_PREG_SCTL_DET_INIT;
1416 	switch(AhciForceGen) {
1417 	case 0:
1418 		r |= AHCI_PREG_SCTL_SPD_ANY;
1419 		break;
1420 	case 1:
1421 		r |= AHCI_PREG_SCTL_SPD_GEN1;
1422 		break;
1423 	case 2:
1424 		r |= AHCI_PREG_SCTL_SPD_GEN2;
1425 		break;
1426 	case 3:
1427 		r |= AHCI_PREG_SCTL_SPD_GEN3;
1428 		break;
1429 	default:
1430 		r |= AHCI_PREG_SCTL_SPD_GEN3;
1431 		break;
1432 	}
1433 	ahci_pwrite(ap, AHCI_PREG_SCTL, r);
1434 	ahci_os_sleep(1000);
1435 
1436 	ap->ap_flags &= ~AP_F_HARSH_REINIT;
1437 
1438 	/*
1439 	 * Only SERR_DIAG_X needs to be cleared for TFD updates, but
1440 	 * since we are hard-resetting the port we might as well clear
1441 	 * the whole enchillada.  Also be sure to clear any spurious BSY
1442 	 * prior to clearing INIT.
1443 	 *
1444 	 * Wait 1 whole second after clearing INIT before checking
1445 	 * the device detection bits in an attempt to work around chipsets
1446 	 * which do not properly mask PCS/PRCS during low level init.
1447 	 */
1448 	ahci_flush_tfd(ap);
1449 	ahci_pwrite(ap, AHCI_PREG_SERR, -1);
1450 /*	ahci_port_clo(ap);*/
1451 	ahci_os_sleep(10);
1452 
1453 	r &= ~AHCI_PREG_SCTL_SPD;
1454 	r &= ~AHCI_PREG_SCTL_DET_INIT;
1455 	r |= AHCI_PREG_SCTL_DET_NONE;
1456 	ahci_pwrite(ap, AHCI_PREG_SCTL, r);
1457 	ahci_os_sleep(1000);
1458 
1459 	/*
1460 	 * Try to determine if there is a device on the port.
1461 	 *
1462 	 * Give the device 3/10 second to at least be detected.
1463 	 * If we fail clear PRCS (phy detect) since we may cycled
1464 	 * the phy and probably caused another PRCS interrupt.
1465 	 */
1466 	loop = 300;
1467 	while (loop > 0) {
1468 		r = ahci_pread(ap, AHCI_PREG_SSTS);
1469 		if (r & AHCI_PREG_SSTS_DET)
1470 			break;
1471 		loop -= ahci_os_softsleep();
1472 	}
1473 	if (loop == 0) {
1474 		ahci_pwrite(ap, AHCI_PREG_IS, AHCI_PREG_IS_PRCS);
1475 		if (bootverbose) {
1476 			kprintf("%s: Port appears to be unplugged\n",
1477 				PORTNAME(ap));
1478 		}
1479 		error = ENODEV;
1480 		goto done;
1481 	}
1482 
1483 	/*
1484 	 * There is something on the port.  Regardless of what happens
1485 	 * after this tell the caller to try to detect a port multiplier.
1486 	 *
1487 	 * Give the device 3 seconds to fully negotiate.
1488 	 */
1489 	*pmdetectp = 1;
1490 
1491 	if (ahci_pwait_eq(ap, 3000, AHCI_PREG_SSTS,
1492 			  AHCI_PREG_SSTS_DET, AHCI_PREG_SSTS_DET_DEV)) {
1493 		if (bootverbose) {
1494 			kprintf("%s: Device may be powered down\n",
1495 				PORTNAME(ap));
1496 		}
1497 		error = ENODEV;
1498 		goto done;
1499 	}
1500 
1501 	/*
1502 	 * We got something that definitely looks like a device.  Give
1503 	 * the device time to send us its first D2H FIS.  Waiting for
1504 	 * BSY to clear accomplishes this.
1505 	 *
1506 	 * NOTE: A port multiplier may or may not clear BSY here,
1507 	 *	 depending on what is sitting in target 0 behind it.
1508 	 *
1509 	 * NOTE: Intel SSDs seem to have compatibility problems with Intel
1510 	 *	 mobo's on cold boots and may leave BSY set.  A single
1511 	 *	 retry works around the problem.  This is definitely a bug
1512 	 *	 with the mobo and/or the SSD and does not appear to occur
1513 	 *	 with other devices connected to the same port.
1514 	 */
1515 	ahci_flush_tfd(ap);
1516 	if (ahci_pwait_clr_to(ap, 8000, AHCI_PREG_TFD,
1517 			    AHCI_PREG_TFD_STS_BSY | AHCI_PREG_TFD_STS_DRQ)) {
1518 		kprintf("%s: Device BUSY: %b\n",
1519 			PORTNAME(ap),
1520 			ahci_pread(ap, AHCI_PREG_TFD),
1521 				AHCI_PFMT_TFD_STS);
1522 		if (retries == 0) {
1523 			kprintf("%s: Retrying\n", PORTNAME(ap));
1524 			retries = 1;
1525 			goto retry;
1526 		}
1527 		error = EBUSY;
1528 	} else {
1529 		error = 0;
1530 	}
1531 
1532 done:
1533 	ahci_flush_tfd(ap);
1534 	return error;
1535 }
1536 
1537 
1538 /*
1539  * AHCI port reset, Section 10.4.2
1540  *
1541  * This function does a hard reset of the port.  Note that the device
1542  * connected to the port could still end-up hung.
1543  */
1544 int
1545 ahci_port_hardreset(struct ahci_port *ap, int hard)
1546 {
1547 	u_int32_t data;
1548 	int	error;
1549 	int	pmdetect;
1550 
1551 	if (bootverbose)
1552 		kprintf("%s: START HARDRESET\n", PORTNAME(ap));
1553 	ap->ap_flags |= AP_F_IN_RESET;
1554 
1555 	error = ahci_comreset(ap, &pmdetect);
1556 
1557 	/*
1558 	 * We may be asked to perform a port multiplier check even if the
1559 	 * comreset failed.  This typically occurs when the PM has nothing
1560 	 * in slot 0, which can cause BSY to remain set.
1561 	 *
1562 	 * If the PM detection is successful it will override (error),
1563 	 * otherwise (error) is retained.  If an error does occur it
1564 	 * is possible that a normal device has blown up on us DUE to
1565 	 * the PM detection code, so re-run the comreset and assume
1566 	 * a normal device.
1567 	 */
1568 	if (pmdetect) {
1569 		if (ap->ap_sc->sc_cap & AHCI_REG_CAP_SPM) {
1570 			error = ahci_pm_port_probe(ap, error);
1571 			if (error) {
1572 				error = ahci_comreset(ap, &pmdetect);
1573 			}
1574 		}
1575 	}
1576 
1577 	/*
1578 	 * Finish up.
1579 	 */
1580 	ahci_os_sleep(500);
1581 
1582 	switch(error) {
1583 	case 0:
1584 		/*
1585 		 * All good, make sure the port is running and set the
1586 		 * probe state.  Ignore the signature junk (it's unreliable)
1587 		 * until we get to the softreset code.
1588 		 */
1589 		if (ahci_port_start(ap)) {
1590 			kprintf("%s: failed to start command DMA on port, "
1591 			        "disabling\n", PORTNAME(ap));
1592 			error = EBUSY;
1593 			break;
1594 		}
1595 		if (ap->ap_type == ATA_PORT_T_PM)
1596 			ap->ap_probe = ATA_PROBE_GOOD;
1597 		else
1598 			ap->ap_probe = ATA_PROBE_NEED_SOFT_RESET;
1599 		break;
1600 	case ENODEV:
1601 		/*
1602 		 * Normal device probe failure
1603 		 */
1604 		data = ahci_pread(ap, AHCI_PREG_SSTS);
1605 
1606 		switch(data & AHCI_PREG_SSTS_DET) {
1607 		case AHCI_PREG_SSTS_DET_DEV_NE:
1608 			kprintf("%s: Device not communicating\n",
1609 				PORTNAME(ap));
1610 			break;
1611 		case AHCI_PREG_SSTS_DET_PHYOFFLINE:
1612 			kprintf("%s: PHY offline\n",
1613 				PORTNAME(ap));
1614 			break;
1615 		default:
1616 			kprintf("%s: No device detected\n",
1617 				PORTNAME(ap));
1618 			break;
1619 		}
1620 		ahci_port_hardstop(ap);
1621 		break;
1622 	default:
1623 		/*
1624 		 * Abnormal probe (EBUSY)
1625 		 */
1626 		kprintf("%s: Device on port is bricked\n",
1627 			PORTNAME(ap));
1628 		ahci_port_hardstop(ap);
1629 #if 0
1630 		rc = ahci_port_reset(ap, atx, 0);
1631 		if (rc) {
1632 			kprintf("%s: Unable unbrick device\n",
1633 				PORTNAME(ap));
1634 		} else {
1635 			kprintf("%s: Successfully unbricked\n",
1636 				PORTNAME(ap));
1637 		}
1638 #endif
1639 		break;
1640 	}
1641 
1642 	/*
1643 	 * Clean up
1644 	 */
1645 	ahci_pwrite(ap, AHCI_PREG_SERR, -1);
1646 	ahci_pwrite(ap, AHCI_PREG_IS, AHCI_PREG_IS_PCS | AHCI_PREG_IS_PRCS);
1647 
1648 	ap->ap_flags &= ~AP_F_IN_RESET;
1649 
1650 	if (bootverbose)
1651 		kprintf("%s: END HARDRESET %d\n", PORTNAME(ap), error);
1652 	return (error);
1653 }
1654 
1655 /*
1656  * Hard-stop on hot-swap device removal.  See 10.10.1
1657  *
1658  * Place the port in a mode that will allow it to detect hot-swap insertions.
1659  * This is a bit imprecise because just setting-up SCTL to DET_INIT doesn't
1660  * seem to do the job.
1661  *
1662  * FIS reception is left enabled but command processing is disabled.
1663  * Cycling FIS reception (FRE) can brick ports.
1664  */
1665 void
1666 ahci_port_hardstop(struct ahci_port *ap)
1667 {
1668 	struct ahci_ccb *ccb;
1669 	struct ata_port *at;
1670 	u_int32_t r;
1671 	u_int32_t cmd;
1672 	int slot;
1673 	int i;
1674 	int serial;
1675 
1676 	/*
1677 	 * Stop the port.  We can't modify things like SUD if the port
1678 	 * is running.
1679 	 */
1680 	ap->ap_state = AP_S_FATAL_ERROR;
1681 	ap->ap_probe = ATA_PROBE_FAILED;
1682 	ap->ap_type = ATA_PORT_T_NONE;
1683 	ahci_port_stop(ap, 0);
1684 	cmd = ahci_pread(ap, AHCI_PREG_CMD);
1685 	cmd &= ~(AHCI_PREG_CMD_CLO | AHCI_PREG_CMD_PMA | AHCI_PREG_CMD_ICC);
1686 	ahci_pwrite(ap, AHCI_PREG_CMD, cmd);
1687 
1688 	/*
1689 	 * Clean up AT sub-ports on SATA port.
1690 	 */
1691 	for (i = 0; ap->ap_ata && i < AHCI_MAX_PMPORTS; ++i) {
1692 		at = ap->ap_ata[i];
1693 		at->at_type = ATA_PORT_T_NONE;
1694 		at->at_probe = ATA_PROBE_FAILED;
1695 	}
1696 
1697 	/*
1698 	 * Make sure FRE is active.  There isn't anything we can do if it
1699 	 * fails so just ignore errors.
1700 	 */
1701 	if ((cmd & AHCI_PREG_CMD_FRE) == 0) {
1702 		cmd |= AHCI_PREG_CMD_FRE;
1703 		ahci_pwrite(ap, AHCI_PREG_CMD, cmd);
1704 		if ((ap->ap_sc->sc_flags & AHCI_F_IGN_FR) == 0)
1705 			ahci_pwait_set(ap, AHCI_PREG_CMD, AHCI_PREG_CMD_FR);
1706 	}
1707 
1708 	/*
1709 	 * 10.10.1 place us in the Listen state.
1710 	 *
1711 	 * 10.10.3 DET must be set to 0 and found to be 0 before
1712 	 * setting SUD to 0.
1713 	 *
1714 	 * Deactivating SUD only applies if the controller supports SUD, it
1715 	 * is a bit unclear what happens w/regards to detecting hotplug
1716 	 * if it doesn't.
1717 	 */
1718 	r = AHCI_PREG_SCTL_IPM_DISABLED |
1719 	    AHCI_PREG_SCTL_SPM_DISABLED;
1720 	ahci_pwrite(ap, AHCI_PREG_SCTL, r);
1721 	ahci_os_sleep(10);
1722 	cmd &= ~AHCI_PREG_CMD_SUD;
1723 	ahci_pwrite(ap, AHCI_PREG_CMD, cmd);
1724 	ahci_os_sleep(10);
1725 
1726 	/*
1727 	 * 10.10.1
1728 	 *
1729 	 * Transition su to the spin-up state.  HBA shall send COMRESET and
1730 	 * begin initialization sequence (whatever that means).  Presumably
1731 	 * this is edge-triggered.  Following the spin-up state the HBA
1732 	 * will automatically transition to the Normal state.
1733 	 *
1734 	 * This only applies if the controller supports SUD.
1735 	 * NEVER use AHCI_PREG_DET_DISABLE.
1736 	 */
1737 	cmd |= AHCI_PREG_CMD_POD |
1738 	       AHCI_PREG_CMD_SUD |
1739 	       AHCI_PREG_CMD_ICC_ACTIVE;
1740 	ahci_pwrite(ap, AHCI_PREG_CMD, cmd);
1741 	ahci_os_sleep(10);
1742 
1743 	/*
1744 	 * Flush SERR_DIAG_X so the TFD can update.
1745 	 */
1746 	ahci_flush_tfd(ap);
1747 
1748 	/*
1749 	 * Clean out pending ccbs
1750 	 */
1751 restart:
1752 	while (ap->ap_active) {
1753 		slot = ffs(ap->ap_active) - 1;
1754 		ap->ap_active &= ~(1 << slot);
1755 		--ap->ap_active_cnt;
1756 		ccb = &ap->ap_ccbs[slot];
1757 		if (ccb->ccb_xa.flags & ATA_F_TIMEOUT_RUNNING) {
1758 			serial = ccb->ccb_xa.serial;
1759 			callout_stop_sync(&ccb->ccb_timeout);
1760 			if (serial != ccb->ccb_xa.serial) {
1761 				kprintf("%s: Warning: timeout race ccb %p\n",
1762 					PORTNAME(ap), ccb);
1763 				goto restart;
1764 			}
1765 			ccb->ccb_xa.flags &= ~ATA_F_TIMEOUT_RUNNING;
1766 		}
1767 		ap->ap_expired &= ~(1 << slot);
1768 		ccb->ccb_xa.flags &= ~(ATA_F_TIMEOUT_DESIRED |
1769 				       ATA_F_TIMEOUT_EXPIRED);
1770 		ccb->ccb_xa.state = ATA_S_TIMEOUT;
1771 		ccb->ccb_done(ccb);
1772 		ccb->ccb_xa.complete(&ccb->ccb_xa);
1773 	}
1774 	while (ap->ap_sactive) {
1775 		slot = ffs(ap->ap_sactive) - 1;
1776 		ap->ap_sactive &= ~(1 << slot);
1777 		ccb = &ap->ap_ccbs[slot];
1778 		if (ccb->ccb_xa.flags & ATA_F_TIMEOUT_RUNNING) {
1779 			serial = ccb->ccb_xa.serial;
1780 			callout_stop_sync(&ccb->ccb_timeout);
1781 			if (serial != ccb->ccb_xa.serial) {
1782 				kprintf("%s: Warning: timeout race ccb %p\n",
1783 					PORTNAME(ap), ccb);
1784 				goto restart;
1785 			}
1786 			ccb->ccb_xa.flags &= ~ATA_F_TIMEOUT_RUNNING;
1787 		}
1788 		ap->ap_expired &= ~(1 << slot);
1789 		ccb->ccb_xa.flags &= ~(ATA_F_TIMEOUT_DESIRED |
1790 				       ATA_F_TIMEOUT_EXPIRED);
1791 		ccb->ccb_xa.state = ATA_S_TIMEOUT;
1792 		ccb->ccb_done(ccb);
1793 		ccb->ccb_xa.complete(&ccb->ccb_xa);
1794 	}
1795 	KKASSERT(ap->ap_active_cnt == 0);
1796 
1797 	while ((ccb = TAILQ_FIRST(&ap->ap_ccb_pending)) != NULL) {
1798 		TAILQ_REMOVE(&ap->ap_ccb_pending, ccb, ccb_entry);
1799 		ccb->ccb_xa.state = ATA_S_TIMEOUT;
1800 		ccb->ccb_xa.flags &= ~ATA_F_TIMEOUT_DESIRED;
1801 		ccb->ccb_done(ccb);
1802 		ccb->ccb_xa.complete(&ccb->ccb_xa);
1803 	}
1804 
1805 	/*
1806 	 * Hot-plug device detection should work at this point.  e.g. on
1807 	 * AMD chipsets Spin-Up/Normal state is sufficient for hot-plug
1808 	 * detection and entering RESET (continuous COMRESET by setting INIT)
1809 	 * will actually prevent hot-plug detection from working properly.
1810 	 *
1811 	 * There may be cases where this will fail to work, I have some
1812 	 * additional code to place the HBA in RESET (send continuous
1813 	 * COMRESET) and hopefully get DIAG.X or other events when something
1814 	 * is plugged in.  Unfortunately this isn't universal and can
1815 	 * also prevent events from generating interrupts.
1816 	 */
1817 
1818 #if 0
1819 	/*
1820 	 * Transition us to the Reset state.  Theoretically we send a
1821 	 * continuous stream of COMRESETs in this state.
1822 	 */
1823 	r |= AHCI_PREG_SCTL_DET_INIT;
1824 	if (AhciForceGen1 & (1 << ap->ap_num)) {
1825 		kprintf("%s: Force 1.5Gbits\n", PORTNAME(ap));
1826 		r |= AHCI_PREG_SCTL_SPD_GEN1;
1827 	} else {
1828 		r |= AHCI_PREG_SCTL_SPD_ANY;
1829 	}
1830 	ahci_pwrite(ap, AHCI_PREG_SCTL, r);
1831 	ahci_os_sleep(10);
1832 
1833 	/*
1834 	 * Flush SERR_DIAG_X so the TFD can update.
1835 	 */
1836 	ahci_flush_tfd(ap);
1837 #endif
1838 	/* NOP */
1839 }
1840 
1841 /*
1842  * We can't loop on the X bit, a continuous COMINIT received will make
1843  * it loop forever.  Just assume one event has built up and clear X
1844  * so the task file descriptor can update.
1845  */
1846 void
1847 ahci_flush_tfd(struct ahci_port *ap)
1848 {
1849 	u_int32_t r;
1850 
1851 	r = ahci_pread(ap, AHCI_PREG_SERR);
1852 	if (r & AHCI_PREG_SERR_DIAG_X)
1853 		ahci_pwrite(ap, AHCI_PREG_SERR, AHCI_PREG_SERR_DIAG_X);
1854 }
1855 
1856 /*
1857  * Figure out what type of device is connected to the port, ATAPI or
1858  * DISK.
1859  */
1860 int
1861 ahci_port_signature_detect(struct ahci_port *ap, struct ata_port *at)
1862 {
1863 	u_int32_t sig;
1864 
1865 	sig = ahci_pread(ap, AHCI_PREG_SIG);
1866 	if (bootverbose)
1867 		kprintf("%s: sig %08x\n", ATANAME(ap, at), sig);
1868 	if ((sig & 0xffff0000) == (SATA_SIGNATURE_ATAPI & 0xffff0000)) {
1869 		return(ATA_PORT_T_ATAPI);
1870 	} else if ((sig & 0xffff0000) ==
1871 		 (SATA_SIGNATURE_PORT_MULTIPLIER & 0xffff0000)) {
1872 		return(ATA_PORT_T_PM);
1873 	} else {
1874 		return(ATA_PORT_T_DISK);
1875 	}
1876 }
1877 
1878 /*
1879  * Load the DMA descriptor table for a CCB's buffer.
1880  */
1881 int
1882 ahci_load_prdt(struct ahci_ccb *ccb)
1883 {
1884 	struct ahci_port		*ap = ccb->ccb_port;
1885 	struct ahci_softc		*sc = ap->ap_sc;
1886 	struct ata_xfer			*xa = &ccb->ccb_xa;
1887 	struct ahci_prdt		*prdt = ccb->ccb_cmd_table->prdt;
1888 	bus_dmamap_t			dmap = ccb->ccb_dmamap;
1889 	struct ahci_cmd_hdr		*cmd_slot = ccb->ccb_cmd_hdr;
1890 	int				error;
1891 
1892 	if (xa->datalen == 0) {
1893 		ccb->ccb_cmd_hdr->prdtl = 0;
1894 		return (0);
1895 	}
1896 
1897 	error = bus_dmamap_load(sc->sc_tag_data, dmap,
1898 				xa->data, xa->datalen,
1899 				ahci_load_prdt_callback,
1900 				&prdt,
1901 				((xa->flags & ATA_F_NOWAIT) ?
1902 				    BUS_DMA_NOWAIT : BUS_DMA_WAITOK));
1903 	if (error != 0) {
1904 		kprintf("%s: error %d loading dmamap\n", PORTNAME(ap), error);
1905 		return (1);
1906 	}
1907 #if 0
1908 	if (xa->flags & ATA_F_PIO)
1909 		prdt->flags |= htole32(AHCI_PRDT_FLAG_INTR);
1910 #endif
1911 
1912 	cmd_slot->prdtl = htole16(prdt - ccb->ccb_cmd_table->prdt + 1);
1913 
1914 	if (xa->flags & ATA_F_READ)
1915 		bus_dmamap_sync(sc->sc_tag_data, dmap, BUS_DMASYNC_PREREAD);
1916 	if (xa->flags & ATA_F_WRITE)
1917 		bus_dmamap_sync(sc->sc_tag_data, dmap, BUS_DMASYNC_PREWRITE);
1918 
1919 	return (0);
1920 }
1921 
1922 /*
1923  * Callback from BUSDMA system to load the segment list.  The passed segment
1924  * list is a temporary structure.
1925  */
1926 static
1927 void
1928 ahci_load_prdt_callback(void *info, bus_dma_segment_t *segs, int nsegs,
1929 			int error)
1930 {
1931 	struct ahci_prdt *prd = *(void **)info;
1932 	u_int64_t addr;
1933 
1934 	KKASSERT(nsegs <= AHCI_MAX_PRDT);
1935 
1936 	while (nsegs) {
1937 		addr = segs->ds_addr;
1938 		prd->dba_hi = htole32((u_int32_t)(addr >> 32));
1939 		prd->dba_lo = htole32((u_int32_t)addr);
1940 		prd->flags = htole32(segs->ds_len - 1);
1941 		--nsegs;
1942 		if (nsegs)
1943 			++prd;
1944 		++segs;
1945 	}
1946 	*(void **)info = prd;	/* return last valid segment */
1947 }
1948 
1949 void
1950 ahci_unload_prdt(struct ahci_ccb *ccb)
1951 {
1952 	struct ahci_port		*ap = ccb->ccb_port;
1953 	struct ahci_softc		*sc = ap->ap_sc;
1954 	struct ata_xfer			*xa = &ccb->ccb_xa;
1955 	bus_dmamap_t			dmap = ccb->ccb_dmamap;
1956 
1957 	if (xa->datalen != 0) {
1958 		if (xa->flags & ATA_F_READ) {
1959 			bus_dmamap_sync(sc->sc_tag_data, dmap,
1960 					BUS_DMASYNC_POSTREAD);
1961 		}
1962 		if (xa->flags & ATA_F_WRITE) {
1963 			bus_dmamap_sync(sc->sc_tag_data, dmap,
1964 					BUS_DMASYNC_POSTWRITE);
1965 		}
1966 		bus_dmamap_unload(sc->sc_tag_data, dmap);
1967 
1968 		/*
1969 		 * prdbc is only updated by hardware for non-NCQ commands.
1970 		 */
1971 		if (ccb->ccb_xa.flags & ATA_F_NCQ) {
1972 			xa->resid = 0;
1973 		} else {
1974 			if (ccb->ccb_cmd_hdr->prdbc == 0 &&
1975 			    ccb->ccb_xa.state == ATA_S_COMPLETE) {
1976 				kprintf("%s: WARNING!  Unload prdbc resid "
1977 					"was zero! tag=%d\n",
1978 					ATANAME(ap, xa->at), ccb->ccb_slot);
1979 			}
1980 			xa->resid = xa->datalen -
1981 			    le32toh(ccb->ccb_cmd_hdr->prdbc);
1982 		}
1983 	}
1984 }
1985 
1986 /*
1987  * Start a command and poll for completion.
1988  *
1989  * timeout is in ms and only counts once the command gets on-chip.
1990  *
1991  * Returns ATA_S_* state, compare against ATA_S_COMPLETE to determine
1992  * that no error occured.
1993  *
1994  * NOTE: If the caller specifies a NULL timeout function the caller is
1995  *	 responsible for clearing hardware state on failure, but we will
1996  *	 deal with removing the ccb from any pending queue.
1997  *
1998  * NOTE: NCQ should never be used with this function.
1999  *
2000  * NOTE: If the port is in a failed state and stopped we do not try
2001  *	 to activate the ccb.
2002  */
2003 int
2004 ahci_poll(struct ahci_ccb *ccb, int timeout,
2005 	  void (*timeout_fn)(struct ahci_ccb *))
2006 {
2007 	struct ahci_port *ap = ccb->ccb_port;
2008 
2009 	if (ccb->ccb_port->ap_state == AP_S_FATAL_ERROR) {
2010 		ccb->ccb_xa.state = ATA_S_ERROR;
2011 		return(ccb->ccb_xa.state);
2012 	}
2013 	crit_enter();
2014 #if 0
2015 	kprintf("%s: Start command %02x tag=%d\n",
2016 		ATANAME(ccb->ccb_port, ccb->ccb_xa.at),
2017 		ccb->ccb_xa.fis->command, ccb->ccb_slot);
2018 #endif
2019 	ahci_start(ccb);
2020 
2021 	do {
2022 		ahci_port_intr(ap, 1);
2023 		switch(ccb->ccb_xa.state) {
2024 		case ATA_S_ONCHIP:
2025 			timeout -= ahci_os_softsleep();
2026 			break;
2027 		case ATA_S_PENDING:
2028 			ahci_os_softsleep();
2029 			ahci_check_active_timeouts(ap);
2030 			break;
2031 		default:
2032 			crit_exit();
2033 			return (ccb->ccb_xa.state);
2034 		}
2035 	} while (timeout > 0);
2036 
2037 	if ((ccb->ccb_xa.flags & ATA_F_SILENT) == 0) {
2038 		kprintf("%s: Poll timeout slot %d CMD: %b TFD: 0x%b SERR: %b\n",
2039 			ATANAME(ap, ccb->ccb_xa.at), ccb->ccb_slot,
2040 			ahci_pread(ap, AHCI_PREG_CMD), AHCI_PFMT_CMD,
2041 			ahci_pread(ap, AHCI_PREG_TFD), AHCI_PFMT_TFD_STS,
2042 			ahci_pread(ap, AHCI_PREG_SERR), AHCI_PFMT_SERR);
2043 	}
2044 
2045 	timeout_fn(ccb);
2046 
2047 	crit_exit();
2048 
2049 	return(ccb->ccb_xa.state);
2050 }
2051 
2052 /*
2053  * When polling we have to check if the currently active CCB(s)
2054  * have timed out as the callout will be deadlocked while we
2055  * hold the port lock.
2056  */
2057 void
2058 ahci_check_active_timeouts(struct ahci_port *ap)
2059 {
2060 	struct ahci_ccb *ccb;
2061 	u_int32_t mask;
2062 	int tag;
2063 
2064 	mask = ap->ap_active | ap->ap_sactive;
2065 	while (mask) {
2066 		tag = ffs(mask) - 1;
2067 		mask &= ~(1 << tag);
2068 		ccb = &ap->ap_ccbs[tag];
2069 		if (ccb->ccb_xa.flags & ATA_F_TIMEOUT_EXPIRED) {
2070 			ahci_ata_cmd_timeout(ccb);
2071 		}
2072 	}
2073 }
2074 
2075 static
2076 __inline
2077 void
2078 ahci_start_timeout(struct ahci_ccb *ccb)
2079 {
2080 	if (ccb->ccb_xa.flags & ATA_F_TIMEOUT_DESIRED) {
2081 		ccb->ccb_xa.flags |= ATA_F_TIMEOUT_RUNNING;
2082 		callout_reset(&ccb->ccb_timeout,
2083 			      (ccb->ccb_xa.timeout * hz + 999) / 1000,
2084 			      ahci_ata_cmd_timeout_unserialized, ccb);
2085 	}
2086 }
2087 
2088 void
2089 ahci_start(struct ahci_ccb *ccb)
2090 {
2091 	struct ahci_port		*ap = ccb->ccb_port;
2092 	struct ahci_softc		*sc = ap->ap_sc;
2093 
2094 	KKASSERT(ccb->ccb_xa.state == ATA_S_PENDING);
2095 
2096 	/* Zero transferred byte count before transfer */
2097 	ccb->ccb_cmd_hdr->prdbc = 0;
2098 
2099 	/* Sync command list entry and corresponding command table entry */
2100 	bus_dmamap_sync(sc->sc_tag_cmdh,
2101 			AHCI_DMA_MAP(ap->ap_dmamem_cmd_list),
2102 			BUS_DMASYNC_PREWRITE);
2103 	bus_dmamap_sync(sc->sc_tag_cmdt,
2104 			AHCI_DMA_MAP(ap->ap_dmamem_cmd_table),
2105 			BUS_DMASYNC_PREWRITE);
2106 
2107 	/* Prepare RFIS area for write by controller */
2108 	bus_dmamap_sync(sc->sc_tag_rfis,
2109 			AHCI_DMA_MAP(ap->ap_dmamem_rfis),
2110 			BUS_DMASYNC_PREREAD);
2111 
2112 	/*
2113 	 * There's no point trying to optimize this, it only shaves a few
2114 	 * nanoseconds so just queue the command and call our generic issue.
2115 	 */
2116 	ahci_issue_pending_commands(ap, ccb);
2117 }
2118 
2119 /*
2120  * While holding the port lock acquire exclusive access to the port.
2121  *
2122  * This is used when running the state machine to initialize and identify
2123  * targets over a port multiplier.  Setting exclusive access prevents
2124  * ahci_port_intr() from activating any requests sitting on the pending
2125  * queue.
2126  */
2127 void
2128 ahci_beg_exclusive_access(struct ahci_port *ap, struct ata_port *at)
2129 {
2130 	KKASSERT((ap->ap_flags & AP_F_EXCLUSIVE_ACCESS) == 0);
2131 	ap->ap_flags |= AP_F_EXCLUSIVE_ACCESS;
2132 	while (ap->ap_active || ap->ap_sactive) {
2133 		ahci_port_intr(ap, 1);
2134 		ahci_os_softsleep();
2135 	}
2136 }
2137 
2138 void
2139 ahci_end_exclusive_access(struct ahci_port *ap, struct ata_port *at)
2140 {
2141 	KKASSERT((ap->ap_flags & AP_F_EXCLUSIVE_ACCESS) != 0);
2142 	ap->ap_flags &= ~AP_F_EXCLUSIVE_ACCESS;
2143 	ahci_issue_pending_commands(ap, NULL);
2144 }
2145 
2146 /*
2147  * If ccb is not NULL enqueue and/or issue it.
2148  *
2149  * If ccb is NULL issue whatever we can from the queue.  However, nothing
2150  * new is issued if the exclusive access flag is set or expired ccb's are
2151  * present.
2152  *
2153  * If existing commands are still active (ap_active/ap_sactive) we can only
2154  * issue matching new commands.
2155  */
2156 void
2157 ahci_issue_pending_commands(struct ahci_port *ap, struct ahci_ccb *ccb)
2158 {
2159 	u_int32_t		mask;
2160 	int			limit;
2161 
2162 	/*
2163 	 * Enqueue the ccb.
2164 	 *
2165 	 * If just running the queue and in exclusive access mode we
2166 	 * just return.  Also in this case if there are any expired ccb's
2167 	 * we want to clear the queue so the port can be safely stopped.
2168 	 */
2169 	if (ccb) {
2170 		TAILQ_INSERT_TAIL(&ap->ap_ccb_pending, ccb, ccb_entry);
2171 	} else if ((ap->ap_flags & AP_F_EXCLUSIVE_ACCESS) || ap->ap_expired) {
2172 		return;
2173 	}
2174 
2175 	/*
2176 	 * Pull the next ccb off the queue and run it if possible.
2177 	 *
2178 	 * The error CCB supercedes all normal queue operations and
2179 	 * implies exclusive access while the error CCB is active.
2180 	 */
2181 	if (ccb != ap->ap_err_ccb) {
2182 		if ((ccb = TAILQ_FIRST(&ap->ap_ccb_pending)) == NULL)
2183 			return;
2184 		if (ap->ap_flags & AP_F_ERR_CCB_RESERVED) {
2185 			kprintf("DELAY CCB slot %d\n", ccb->ccb_slot);
2186 			return;
2187 		}
2188 	}
2189 
2190 	/*
2191 	 * Handle exclusivity requirements.
2192 	 *
2193 	 * ATA_F_EXCLUSIVE is used when we want to be the only command
2194 	 * running.
2195 	 *
2196 	 * ATA_F_AUTOSENSE is used when we want the D2H rfis loaded
2197 	 * back into the ccb on a normal (non-errored) command completion.
2198 	 * For example, for PM requests to target 15.  Because the AHCI
2199 	 * spec does not stop the command processor and has only one rfis
2200 	 * area (for non-FBSS anyway), AUTOSENSE currently implies EXCLUSIVE.
2201 	 * Otherwise multiple completions can destroy the rfis data before
2202 	 * we have a chance to copy it.
2203 	 */
2204 	if (ap->ap_active & ~ap->ap_expired) {
2205 		/*
2206 		 * There may be multiple ccb's already running,
2207 		 * if any are running and ap_run_flags sets
2208 		 * one of these flags then we know only one is
2209 		 * running.
2210 		 *
2211 		 * XXX Current AUTOSENSE code forces exclusivity
2212 		 *     to simplify the code.
2213 		 */
2214 		if (ap->ap_run_flags &
2215 		    (ATA_F_EXCLUSIVE | ATA_F_AUTOSENSE)) {
2216 			return;
2217 		}
2218 
2219 		if (ccb->ccb_xa.flags &
2220 		    (ATA_F_EXCLUSIVE | ATA_F_AUTOSENSE)) {
2221 			return;
2222 		}
2223 	}
2224 
2225 	if (ccb->ccb_xa.flags & ATA_F_NCQ) {
2226 		/*
2227 		 * The next command is a NCQ command and can be issued as
2228 		 * long as currently active commands are not standard.
2229 		 */
2230 		if (ap->ap_active) {
2231 			KKASSERT(ap->ap_active_cnt > 0);
2232 			return;
2233 		}
2234 		KKASSERT(ap->ap_active_cnt == 0);
2235 
2236 		mask = 0;
2237 		do {
2238 			TAILQ_REMOVE(&ap->ap_ccb_pending, ccb, ccb_entry);
2239 			KKASSERT((mask & (1 << ccb->ccb_slot)) == 0);
2240 			mask |= 1 << ccb->ccb_slot;
2241 			KKASSERT(ccb->ccb_xa.state == ATA_S_PENDING);
2242 			KKASSERT(ccb == &ap->ap_ccbs[ccb->ccb_slot]);
2243 			ccb->ccb_xa.state = ATA_S_ONCHIP;
2244 			ahci_start_timeout(ccb);
2245 			ap->ap_run_flags = ccb->ccb_xa.flags;
2246 			ccb = TAILQ_FIRST(&ap->ap_ccb_pending);
2247 		} while (ccb && (ccb->ccb_xa.flags & ATA_F_NCQ) &&
2248 			 (ap->ap_run_flags &
2249 			     (ATA_F_EXCLUSIVE | ATA_F_AUTOSENSE)) == 0);
2250 
2251 		KKASSERT(((ap->ap_active | ap->ap_sactive) & mask) == 0);
2252 
2253 		ap->ap_sactive |= mask;
2254 		ahci_pwrite(ap, AHCI_PREG_SACT, mask);
2255 		ahci_pwrite(ap, AHCI_PREG_CI, mask);
2256 	} else {
2257 		/*
2258 		 * The next command is a standard command and can be issued
2259 		 * as long as currently active commands are not NCQ.
2260 		 *
2261 		 * We limit ourself to 1 command if we have a port multiplier,
2262 		 * (at least without FBSS support), otherwise timeouts on
2263 		 * one port can race completions on other ports (see
2264 		 * ahci_ata_cmd_timeout() for more information).
2265 		 *
2266 		 * If not on a port multiplier generally allow up to 4
2267 		 * standard commands to be enqueued.  Remember that the
2268 		 * command processor will still process them sequentially.
2269 		 */
2270 		if (ap->ap_sactive)
2271 			return;
2272 		if (ap->ap_type == ATA_PORT_T_PM)
2273 			limit = 1;
2274 		else if (ap->ap_sc->sc_ncmds > 4)
2275 			limit = 4;
2276 		else
2277 			limit = 2;
2278 
2279 		while (ap->ap_active_cnt < limit && ccb &&
2280 		       (ccb->ccb_xa.flags & ATA_F_NCQ) == 0) {
2281 			TAILQ_REMOVE(&ap->ap_ccb_pending, ccb, ccb_entry);
2282 			KKASSERT(((ap->ap_active | ap->ap_sactive) &
2283 				  (1 << ccb->ccb_slot)) == 0);
2284 			ap->ap_active |= 1 << ccb->ccb_slot;
2285 			ap->ap_active_cnt++;
2286 			ap->ap_run_flags = ccb->ccb_xa.flags;
2287 			ccb->ccb_xa.state = ATA_S_ONCHIP;
2288 			ahci_start_timeout(ccb);
2289 			ahci_pwrite(ap, AHCI_PREG_CI, 1 << ccb->ccb_slot);
2290 			if ((ap->ap_run_flags &
2291 			    (ATA_F_EXCLUSIVE | ATA_F_AUTOSENSE)) == 0) {
2292 				break;
2293 			}
2294 			ccb = TAILQ_FIRST(&ap->ap_ccb_pending);
2295 			if (ccb && (ccb->ccb_xa.flags &
2296 				    (ATA_F_EXCLUSIVE | ATA_F_AUTOSENSE))) {
2297 				break;
2298 			}
2299 		}
2300 	}
2301 }
2302 
2303 void
2304 ahci_intr(void *arg)
2305 {
2306 	struct ahci_softc	*sc = arg;
2307 	struct ahci_port	*ap;
2308 	u_int32_t		is;
2309 	u_int32_t		ack;
2310 	int			port;
2311 
2312 	/*
2313 	 * Check if the master enable is up, and whether any interrupts are
2314 	 * pending.
2315 	 */
2316 	if ((sc->sc_flags & AHCI_F_INT_GOOD) == 0)
2317 		return;
2318 	is = ahci_read(sc, AHCI_REG_IS);
2319 	if (is == 0 || is == 0xffffffff) {
2320 		return;
2321 	}
2322 	is &= sc->sc_portmask;
2323 
2324 #ifdef AHCI_COALESCE
2325 	/* Check coalescing interrupt first */
2326 	if (is & sc->sc_ccc_mask) {
2327 		DPRINTF(AHCI_D_INTR, "%s: command coalescing interrupt\n",
2328 		    DEVNAME(sc));
2329 		is &= ~sc->sc_ccc_mask;
2330 		is |= sc->sc_ccc_ports_cur;
2331 	}
2332 #endif
2333 
2334 	/*
2335 	 * Process interrupts for each port in a non-blocking fashion.
2336 	 *
2337 	 * The global IS bit is supposed to be forced on if any unmasked
2338 	 * port interrupt is pending, even if we clear it.
2339 	 *
2340 	 * However it would appear that it is simply latched on some parts,
2341 	 * which means we have to clear it BEFORE processing the status bits
2342 	 * to avoid races.
2343 	 */
2344 	ahci_write(sc, AHCI_REG_IS, is);
2345 	for (ack = 0; is; is &= ~(1 << port)) {
2346 		port = ffs(is) - 1;
2347 		ack |= 1 << port;
2348 
2349 		ap = sc->sc_ports[port];
2350 		if (ap == NULL)
2351 			continue;
2352 
2353 		if (ahci_os_lock_port_nb(ap) == 0) {
2354 			ahci_port_intr(ap, 0);
2355 			ahci_os_unlock_port(ap);
2356 		} else {
2357 			ahci_pwrite(ap, AHCI_PREG_IE, 0);
2358 			ahci_os_signal_port_thread(ap, AP_SIGF_PORTINT);
2359 		}
2360 	}
2361 }
2362 
2363 /*
2364  * Core called from helper thread.
2365  */
2366 void
2367 ahci_port_thread_core(struct ahci_port *ap, int mask)
2368 {
2369 	/*
2370 	 * Process any expired timedouts.
2371 	 */
2372 	ahci_os_lock_port(ap);
2373 	if (mask & AP_SIGF_TIMEOUT) {
2374 		ahci_check_active_timeouts(ap);
2375 	}
2376 
2377 	/*
2378 	 * Process port interrupts which require a higher level of
2379 	 * intervention.
2380 	 */
2381 	if (mask & AP_SIGF_PORTINT) {
2382 		ahci_port_intr(ap, 1);
2383 		ahci_port_interrupt_enable(ap);
2384 	} else if (ap->ap_probe != ATA_PROBE_FAILED) {
2385 		ahci_port_intr(ap, 1);
2386 		ahci_port_interrupt_enable(ap);
2387 	}
2388 	ahci_os_unlock_port(ap);
2389 }
2390 
2391 /*
2392  * Core per-port interrupt handler.
2393  *
2394  * If blockable is 0 we cannot call ahci_os_sleep() at all and we can only
2395  * deal with normal command completions which do not require blocking.
2396  */
2397 void
2398 ahci_port_intr(struct ahci_port *ap, int blockable)
2399 {
2400 	struct ahci_softc	*sc = ap->ap_sc;
2401 	u_int32_t		is, ci_saved, ci_masked;
2402 	int			slot;
2403 	int			stopped = 0;
2404 	struct ahci_ccb		*ccb = NULL;
2405 	struct ata_port		*ccb_at = NULL;
2406 	volatile u_int32_t	*active;
2407 	const u_int32_t		blockable_mask = AHCI_PREG_IS_TFES |
2408 						 AHCI_PREG_IS_IFS |
2409 						 AHCI_PREG_IS_PCS |
2410 						 AHCI_PREG_IS_PRCS |
2411 						 AHCI_PREG_IS_HBFS |
2412 						 AHCI_PREG_IS_OFS |
2413 						 AHCI_PREG_IS_UFS;
2414 
2415 	enum { NEED_NOTHING, NEED_REINIT, NEED_RESTART,
2416 	       NEED_HOTPLUG_INSERT, NEED_HOTPLUG_REMOVE } need = NEED_NOTHING;
2417 
2418 	/*
2419 	 * All basic command completions are always processed.
2420 	 */
2421 	is = ahci_pread(ap, AHCI_PREG_IS);
2422 	if (is & AHCI_PREG_IS_DPS)
2423 		ahci_pwrite(ap, AHCI_PREG_IS, is & AHCI_PREG_IS_DPS);
2424 
2425 	/*
2426 	 * If we can't block then we can't handle these here.  Disable
2427 	 * the interrupts in question so we don't live-lock, the helper
2428 	 * thread will re-enable them.
2429 	 *
2430 	 * If the port is in a completely failed state we do not want
2431 	 * to drop through to failed-command-processing if blockable is 0,
2432 	 * just let the thread deal with it all.
2433 	 *
2434 	 * Otherwise we fall through and still handle DHRS and any commands
2435 	 * which completed normally.  Even if we are errored we haven't
2436 	 * stopped the port yet so CI/SACT are still good.
2437 	 */
2438 	if (blockable == 0) {
2439 		if (ap->ap_state == AP_S_FATAL_ERROR) {
2440 			ahci_pwrite(ap, AHCI_PREG_IE, 0);
2441 			ahci_os_signal_port_thread(ap, AP_SIGF_PORTINT);
2442 			return;
2443 		}
2444 		if (is & blockable_mask) {
2445 			ahci_pwrite(ap, AHCI_PREG_IE, 0);
2446 			ahci_os_signal_port_thread(ap, AP_SIGF_PORTINT);
2447 			return;
2448 		}
2449 	}
2450 
2451 	/*
2452 	 * Either NCQ or non-NCQ commands will be active, never both.
2453 	 */
2454 	if (ap->ap_sactive) {
2455 		KKASSERT(ap->ap_active == 0);
2456 		KKASSERT(ap->ap_active_cnt == 0);
2457 		ci_saved = ahci_pread(ap, AHCI_PREG_SACT);
2458 		active = &ap->ap_sactive;
2459 	} else {
2460 		ci_saved = ahci_pread(ap, AHCI_PREG_CI);
2461 		active = &ap->ap_active;
2462 	}
2463 	KKASSERT(!(ap->ap_sactive && ap->ap_active));
2464 	KKASSERT((ci_saved & (ap->ap_sactive | ap->ap_active)) == ci_saved);
2465 #if 0
2466 	kprintf("CHECK act=%08x/%08x sact=%08x/%08x\n",
2467 		ap->ap_active, ahci_pread(ap, AHCI_PREG_CI),
2468 		ap->ap_sactive, ahci_pread(ap, AHCI_PREG_SACT));
2469 #endif
2470 
2471 	/*
2472 	 * Ignore AHCI_PREG_IS_PRCS when link power management is on
2473 	 */
2474 	if (ap->link_pwr_mgmt != AHCI_LINK_PWR_MGMT_NONE) {
2475 		is &= ~AHCI_PREG_IS_PRCS;
2476 		ahci_pwrite(ap, AHCI_PREG_SERR,
2477 			    AHCI_PREG_SERR_DIAG_N | AHCI_PREG_SERR_DIAG_W);
2478 	}
2479 
2480 	/*
2481 	 * Command failed (blockable).
2482 	 *
2483 	 * See AHCI 1.1 spec 6.2.2.1 and 6.2.2.2.
2484 	 *
2485 	 * This stops command processing.
2486 	 */
2487 	if (is & AHCI_PREG_IS_TFES) {
2488 		u_int32_t tfd, serr;
2489 		int	err_slot;
2490 
2491 process_error:
2492 		tfd = ahci_pread(ap, AHCI_PREG_TFD);
2493 		serr = ahci_pread(ap, AHCI_PREG_SERR);
2494 
2495 		/*
2496 		 * Load the error slot and restart command processing.
2497 		 * CLO if we need to.  The error slot may not be valid.
2498 		 * MUST BE DONE BEFORE CLEARING ST!
2499 		 *
2500 		 * Cycle ST.
2501 		 *
2502 		 * It is unclear but we may have to clear SERR to reenable
2503 		 * error processing.
2504 		 */
2505 		err_slot = AHCI_PREG_CMD_CCS(ahci_pread(ap, AHCI_PREG_CMD));
2506 		ahci_pwrite(ap, AHCI_PREG_IS, AHCI_PREG_IS_TFES |
2507 					      AHCI_PREG_IS_PSS |
2508 					      AHCI_PREG_IS_DHRS |
2509 					      AHCI_PREG_IS_SDBS);
2510 		is &= ~(AHCI_PREG_IS_TFES | AHCI_PREG_IS_PSS |
2511 			AHCI_PREG_IS_DHRS | AHCI_PREG_IS_SDBS);
2512 		ahci_pwrite(ap, AHCI_PREG_SERR, serr);
2513 		ahci_port_stop(ap, 0);
2514 		ahci_os_hardsleep(10);
2515 		if (tfd & (AHCI_PREG_TFD_STS_BSY | AHCI_PREG_TFD_STS_DRQ)) {
2516 			kprintf("%s: Issuing CLO\n", PORTNAME(ap));
2517 			ahci_port_clo(ap);
2518 		}
2519 
2520 		/*
2521 		 * We are now stopped and need a restart.  If we have to
2522 		 * process a NCQ error we will temporarily start and then
2523 		 * stop the port again, so this condition holds.
2524 		 */
2525 		stopped = 1;
2526 		need = NEED_RESTART;
2527 
2528 		/*
2529 		 * ATAPI errors are fairly common from probing, just
2530 		 * report disk errors or if bootverbose is on.
2531 		 */
2532 		if (bootverbose || ap->ap_type != ATA_PORT_T_ATAPI) {
2533 			kprintf("%s: TFES slot %d ci_saved = %08x\n",
2534 				PORTNAME(ap), err_slot, ci_saved);
2535 		}
2536 
2537 		/*
2538 		 * If we got an error on an error CCB just complete it
2539 		 * with an error.  ci_saved has the mask to restart
2540 		 * (the err_ccb will be removed from it by finish_error).
2541 		 */
2542 		if (ap->ap_flags & AP_F_ERR_CCB_RESERVED) {
2543 			err_slot = ap->ap_err_ccb->ccb_slot;
2544 			goto finish_error;
2545 		}
2546 
2547 		/*
2548 		 * If NCQ commands were active get the error slot from
2549 		 * the log page.  NCQ is not supported for PM's so this
2550 		 * is a direct-attached target.
2551 		 *
2552 		 * Otherwise if no commands were active we have a problem.
2553 		 *
2554 		 * Otherwise if the error slot is bad we have a problem.
2555 		 *
2556 		 * Otherwise process the error for the slot.
2557 		 */
2558 		if (ap->ap_sactive) {
2559 			ahci_port_start(ap);
2560 			err_slot = ahci_port_read_ncq_error(ap, 0);
2561 			ahci_port_stop(ap, 0);
2562 		} else if (ap->ap_active == 0) {
2563 			kprintf("%s: TFES with no commands pending\n",
2564 				PORTNAME(ap));
2565 			err_slot = -1;
2566 		} else if (err_slot < 0 || err_slot >= ap->ap_sc->sc_ncmds) {
2567 			kprintf("%s: bad error slot %d\n",
2568 				PORTNAME(ap), err_slot);
2569 			err_slot = -1;
2570 		} else {
2571 			ccb = &ap->ap_ccbs[err_slot];
2572 
2573 			/*
2574 			 * Validate the errored ccb.  Note that ccb_at can
2575 			 * be NULL for direct-attached ccb's.
2576 			 *
2577 			 * Copy received taskfile data from the RFIS.
2578 			 */
2579 			if (ccb->ccb_xa.state == ATA_S_ONCHIP) {
2580 				ccb_at = ccb->ccb_xa.at;
2581 				memcpy(&ccb->ccb_xa.rfis, ap->ap_rfis->rfis,
2582 				       sizeof(struct ata_fis_d2h));
2583 				if (bootverbose) {
2584 					kprintf("%s: Copying rfis slot %d\n",
2585 						ATANAME(ap, ccb_at), err_slot);
2586 				}
2587 			} else {
2588 				kprintf("%s: Cannot copy rfis, CCB slot "
2589 					"%d is not on-chip (state=%d)\n",
2590 					ATANAME(ap, ccb->ccb_xa.at),
2591 					err_slot, ccb->ccb_xa.state);
2592 				err_slot = -1;
2593 			}
2594 		}
2595 
2596 		/*
2597 		 * If we could not determine the errored slot then
2598 		 * reset the port.
2599 		 */
2600 		if (err_slot < 0) {
2601 			kprintf("%s: TFES: Unable to determine errored slot\n",
2602 				PORTNAME(ap));
2603 			if (ap->ap_flags & AP_F_IN_RESET)
2604 				goto fatal;
2605 			goto failall;
2606 		}
2607 
2608 		/*
2609 		 * Finish error on slot.  We will restart ci_saved
2610 		 * commands except the errored slot which we generate
2611 		 * a failure for.
2612 		 */
2613 finish_error:
2614 		ccb = &ap->ap_ccbs[err_slot];
2615 		ci_saved &= ~(1 << err_slot);
2616 		KKASSERT(ccb->ccb_xa.state == ATA_S_ONCHIP);
2617 		ccb->ccb_xa.state = ATA_S_ERROR;
2618 	} else if (is & AHCI_PREG_IS_DHRS) {
2619 		/*
2620 		 * Command posted D2H register FIS to the rfis (non-blocking).
2621 		 *
2622 		 * A normal completion with an error may set DHRS instead
2623 		 * of TFES.  The CCS bits are only valid if ERR was set.
2624 		 * If ERR is set command processing was probably stopped.
2625 		 *
2626 		 * If ERR was not set we can only copy-back data for
2627 		 * exclusive-mode commands because otherwise we won't know
2628 		 * which tag the rfis belonged to.
2629 		 *
2630 		 * err_slot must be read from the CCS before any other port
2631 		 * action, such as stopping the port.
2632 		 *
2633 		 * WARNING!	This is not well documented in the AHCI spec.
2634 		 *		It can be found in the state machine tables
2635 		 *		but not in the explanations.
2636 		 */
2637 		u_int32_t tfd;
2638 		u_int32_t cmd;
2639 		int err_slot;
2640 
2641 		tfd = ahci_pread(ap, AHCI_PREG_TFD);
2642 		cmd = ahci_pread(ap, AHCI_PREG_CMD);
2643 
2644 		ahci_pwrite(ap, AHCI_PREG_IS, AHCI_PREG_IS_DHRS);
2645 		if ((tfd & AHCI_PREG_TFD_STS_ERR) &&
2646 		    (cmd & AHCI_PREG_CMD_CR) == 0) {
2647 			err_slot = AHCI_PREG_CMD_CCS(
2648 						ahci_pread(ap, AHCI_PREG_CMD));
2649 			ccb = &ap->ap_ccbs[err_slot];
2650 			kprintf("%s: DHRS tfd=%b err_slot=%d cmd=%02x\n",
2651 				PORTNAME(ap),
2652 				tfd, AHCI_PFMT_TFD_STS,
2653 				err_slot, ccb->ccb_xa.fis->command);
2654 			goto process_error;
2655 		}
2656 		/*
2657 		 * NO ELSE... copy back is in the normal command completion
2658 		 * code and only if no error occured and ATA_F_AUTOSENSE
2659 		 * was set.
2660 		 */
2661 	}
2662 
2663 	/*
2664 	 * Device notification to us (non-blocking)
2665 	 *
2666 	 * NOTE!  On some parts notification bits can cause an IPMS
2667 	 *	  interrupt instead of a SDBS interrupt.
2668 	 *
2669 	 * NOTE!  On some parts (e.g. VBOX, probably intel ICHx),
2670 	 *	  SDBS notifies us of the completion of a NCQ command
2671 	 *	  and DBS does not.
2672 	 */
2673 	if (is & (AHCI_PREG_IS_SDBS | AHCI_PREG_IS_IPMS)) {
2674 		u_int32_t data;
2675 
2676 		ahci_pwrite(ap, AHCI_PREG_IS,
2677 				AHCI_PREG_IS_SDBS | AHCI_PREG_IS_IPMS);
2678 		if (sc->sc_cap & AHCI_REG_CAP_SSNTF) {
2679 			data = ahci_pread(ap, AHCI_PREG_SNTF);
2680 			if (data) {
2681 				ahci_pwrite(ap, AHCI_PREG_IS,
2682 						AHCI_PREG_IS_SDBS);
2683 				kprintf("%s: NOTIFY %08x\n",
2684 					PORTNAME(ap), data);
2685 				ahci_pwrite(ap, AHCI_PREG_SERR,
2686 						AHCI_PREG_SERR_DIAG_N);
2687 				ahci_pwrite(ap, AHCI_PREG_SNTF, data);
2688 				ahci_cam_changed(ap, NULL, -1);
2689 			}
2690 		}
2691 		is &= ~(AHCI_PREG_IS_SDBS | AHCI_PREG_IS_IPMS);
2692 	}
2693 
2694 	/*
2695 	 * Spurious IFS errors (blockable) - when AP_F_IGNORE_IFS is set.
2696 	 *
2697 	 * Spurious IFS errors can occur while we are doing a reset
2698 	 * sequence through a PM, probably due to an unexpected FIS
2699 	 * being received during the PM target reset sequence.  Chipsets
2700 	 * are supposed to mask these events but some do not.
2701 	 *
2702 	 * Try to recover from the condition.
2703 	 */
2704 	if ((is & AHCI_PREG_IS_IFS) && (ap->ap_flags & AP_F_IGNORE_IFS)) {
2705 		u_int32_t serr = ahci_pread(ap, AHCI_PREG_SERR);
2706 		if ((ap->ap_flags & AP_F_IFS_IGNORED) == 0) {
2707 			kprintf("%s: IFS during PM probe (ignored) "
2708 				"IS=%b, SERR=%b\n",
2709 				PORTNAME(ap),
2710 				is, AHCI_PFMT_IS,
2711 				serr, AHCI_PFMT_SERR);
2712 			ap->ap_flags |= AP_F_IFS_IGNORED;
2713 		}
2714 
2715 		/*
2716 		 * Try to clear the error condition.  The IFS error killed
2717 		 * the port so stop it so we can restart it.
2718 		 */
2719 		ahci_pwrite(ap, AHCI_PREG_IS, AHCI_PREG_IS_IFS);
2720 		ahci_pwrite(ap, AHCI_PREG_SERR, -1);
2721 		is &= ~AHCI_PREG_IS_IFS;
2722 		need = NEED_RESTART;
2723 		goto failall;
2724 	}
2725 
2726 	/*
2727 	 * Port change (hot-plug) (blockable).
2728 	 *
2729 	 * A PRCS interrupt can occur:
2730 	 *	(1) On hot-unplug / normal-unplug (phy lost)
2731 	 *	(2) Sometimes on hot-plug too.
2732 	 *
2733 	 * A PCS interrupt can occur in a number of situations:
2734 	 *	(1) On hot-plug once communication is established
2735 	 *	(2) On hot-unplug sometimes.
2736 	 *	(3) For chipsets with badly written firmware it can occur
2737 	 *	    during INIT/RESET sequences due to the device reset.
2738 	 *	(4) For chipsets with badly written firmware it can occur
2739 	 *	    when it thinks an unsolicited COMRESET is received
2740 	 *	    during a INIT/RESET sequence, even though we actually
2741 	 *	    did request it.
2742 	 *
2743 	 * XXX We can then check the CPS (Cold Presence State) bit, if
2744 	 * supported, to determine if a device is plugged in or not and do
2745 	 * the right thing.
2746 	 *
2747 	 * PCS interrupts are cleared by clearing DIAG_X.  If this occurs
2748 	 * command processing is automatically stopped (CR goes inactive)
2749 	 * and the port must be stopped and restarted.
2750 	 *
2751 	 * WARNING: AMD parts (e.g. 880G chipset, probably others) can
2752 	 *	    generate PCS on initialization even when device is
2753 	 *	    already connected up.  It is unclear why this happens.
2754 	 *	    Depending on the state of the device detect this can
2755 	 *	    cause us to go into harsh reinit or hot-plug insertion
2756 	 *	    mode.
2757 	 *
2758 	 * WARNING: PCS errors can be repetitive (e.g. unsolicited COMRESET
2759 	 *	    continues to flow in from the device), we must clear the
2760 	 *	    interrupt in all cases and enforce a delay to prevent
2761 	 *	    a livelock and give the port time to settle down.
2762 	 *	    Only print something if we aren't in INIT/HARD-RESET.
2763 	 */
2764 	if (is & (AHCI_PREG_IS_PCS | AHCI_PREG_IS_PRCS)) {
2765 		ahci_pwrite(ap, AHCI_PREG_IS,
2766 			    is & (AHCI_PREG_IS_PCS | AHCI_PREG_IS_PRCS));
2767 		/*
2768 		 * Try to clear the error.  Because of the repetitiveness
2769 		 * of this interrupt avoid any harsh action if the port is
2770 		 * already in the init or hard-reset probe state.
2771 		 */
2772 		ahci_pwrite(ap, AHCI_PREG_SERR, -1);
2773 		/* (AHCI_PREG_SERR_DIAG_N | AHCI_PREG_SERR_DIAG_X) */
2774 
2775 		/*
2776 		 * Ignore PCS/PRCS errors during probes (but still clear the
2777 		 * interrupt to avoid a livelock).  The AMD 880/890/SB850
2778 		 * chipsets do not mask PCS/PRCS internally during reset
2779 		 * sequences.
2780 		 */
2781 		if (ap->ap_flags & AP_F_IN_RESET)
2782 			goto skip_pcs;
2783 
2784 		if (ap->ap_probe == ATA_PROBE_NEED_INIT ||
2785 		    ap->ap_probe == ATA_PROBE_NEED_HARD_RESET) {
2786 			is &= ~(AHCI_PREG_IS_PCS | AHCI_PREG_IS_PRCS);
2787 			need = NEED_NOTHING;
2788 			ahci_os_sleep(1000);
2789 			goto failall;
2790 		}
2791 		kprintf("%s: Transient Errors: %b (%d)\n",
2792 			PORTNAME(ap), is, AHCI_PFMT_IS, ap->ap_probe);
2793 		is &= ~(AHCI_PREG_IS_PCS | AHCI_PREG_IS_PRCS);
2794 		ahci_os_sleep(200);
2795 
2796 		/*
2797 		 * Stop the port and figure out what to do next.
2798 		 */
2799 		ahci_port_stop(ap, 0);
2800 		stopped = 1;
2801 
2802 		switch (ahci_pread(ap, AHCI_PREG_SSTS) & AHCI_PREG_SSTS_DET) {
2803 		case AHCI_PREG_SSTS_DET_DEV:
2804 			/*
2805 			 * Device detect
2806 			 */
2807 			if (ap->ap_probe == ATA_PROBE_FAILED) {
2808 				need = NEED_HOTPLUG_INSERT;
2809 				goto fatal;
2810 			}
2811 			need = NEED_RESTART;
2812 			break;
2813 		case AHCI_PREG_SSTS_DET_DEV_NE:
2814 			/*
2815 			 * Device not communicating.  AMD parts seem to
2816 			 * like to throw this error on initialization
2817 			 * for no reason that I can fathom.
2818 			 */
2819 			kprintf("%s: Device present but not communicating, "
2820 				"attempting port restart\n",
2821 				PORTNAME(ap));
2822 			need = NEED_REINIT;
2823 			goto fatal;
2824 		default:
2825 			if (ap->ap_probe != ATA_PROBE_FAILED) {
2826 				need = NEED_HOTPLUG_REMOVE;
2827 				goto fatal;
2828 			}
2829 			need = NEED_RESTART;
2830 			break;
2831 		}
2832 skip_pcs:
2833 		;
2834 	}
2835 
2836 	/*
2837 	 * Check for remaining errors - they are fatal. (blockable)
2838 	 */
2839 	if (is & (AHCI_PREG_IS_TFES | AHCI_PREG_IS_HBFS | AHCI_PREG_IS_IFS |
2840 		  AHCI_PREG_IS_OFS | AHCI_PREG_IS_UFS)) {
2841 		u_int32_t serr;
2842 
2843 		ahci_pwrite(ap, AHCI_PREG_IS,
2844 			    is & (AHCI_PREG_IS_TFES | AHCI_PREG_IS_HBFS |
2845 				  AHCI_PREG_IS_IFS | AHCI_PREG_IS_OFS |
2846 				  AHCI_PREG_IS_UFS));
2847 		serr = ahci_pread(ap, AHCI_PREG_SERR);
2848 		kprintf("%s: Unrecoverable errors (IS: %b, SERR: %b), "
2849 			"disabling port.\n",
2850 			PORTNAME(ap),
2851 			is, AHCI_PFMT_IS,
2852 			serr, AHCI_PFMT_SERR
2853 		);
2854 		is &= ~(AHCI_PREG_IS_TFES | AHCI_PREG_IS_HBFS |
2855 			AHCI_PREG_IS_IFS | AHCI_PREG_IS_OFS |
2856 		        AHCI_PREG_IS_UFS);
2857 
2858 		/*
2859 		 * Fail all commands but then what?  For now try to
2860 		 * reinitialize the port.
2861 		 */
2862 		need = NEED_REINIT;
2863 		goto fatal;
2864 	}
2865 
2866 	/*
2867 	 * Fail all outstanding commands if we know the port won't recover.
2868 	 *
2869 	 * We may have a ccb_at if the failed command is known and was
2870 	 * being sent to a device over a port multiplier (PM).  In this
2871 	 * case if the port itself has not completely failed we fail just
2872 	 * the commands related to that target.
2873 	 *
2874 	 * ci_saved contains the mask of active commands as of when the
2875 	 * error occured, prior to any port stops.
2876 	 */
2877 	if (ap->ap_state == AP_S_FATAL_ERROR) {
2878 fatal:
2879 		ap->ap_state = AP_S_FATAL_ERROR;
2880 failall:
2881 		ahci_port_stop(ap, 0);
2882 		stopped = 1;
2883 
2884 		/*
2885 		 * Error all the active slots not already errored.
2886 		 */
2887 		ci_masked = ci_saved & *active & ~ap->ap_expired;
2888 		if (ci_masked) {
2889 			kprintf("%s: Failing all commands: %08x\n",
2890 				PORTNAME(ap), ci_masked);
2891 		}
2892 
2893 		while (ci_masked) {
2894 			slot = ffs(ci_masked) - 1;
2895 			ccb = &ap->ap_ccbs[slot];
2896 			ccb->ccb_xa.state = ATA_S_TIMEOUT;
2897 			ap->ap_expired |= 1 << slot;
2898 			ci_saved &= ~(1 << slot);
2899 			ci_masked &= ~(1 << slot);
2900 		}
2901 
2902 		/*
2903 		 * Clear bits in ci_saved (cause completions to be run)
2904 		 * for all slots which are not active.
2905 		 */
2906 		ci_saved &= ~*active;
2907 
2908 		/*
2909 		 * Don't restart the port if our problems were deemed fatal.
2910 		 *
2911 		 * Also acknowlege all fatal interrupt sources to prevent
2912 		 * a livelock.
2913 		 */
2914 		if (ap->ap_state == AP_S_FATAL_ERROR) {
2915 			if (need == NEED_RESTART)
2916 				need = NEED_NOTHING;
2917 			ahci_pwrite(ap, AHCI_PREG_IS,
2918 				    AHCI_PREG_IS_TFES | AHCI_PREG_IS_HBFS |
2919 				    AHCI_PREG_IS_IFS | AHCI_PREG_IS_OFS |
2920 				    AHCI_PREG_IS_UFS);
2921 		}
2922 	}
2923 
2924 	/*
2925 	 * If we are stopped the AHCI chipset is supposed to have cleared
2926 	 * CI and SACT.  Did it?  If it didn't we try very hard to clear
2927 	 * the fields otherwise we may end up completing CCBs which are
2928 	 * actually still active.
2929 	 *
2930 	 * IFS errors on (at least) AMD chipsets create this confusion.
2931 	 */
2932 	if (stopped) {
2933 		u_int32_t mask;
2934 		if ((mask = ahci_pactive(ap)) != 0) {
2935 			kprintf("%s: chipset failed to clear "
2936 				"active cmds %08x\n",
2937 				PORTNAME(ap), mask);
2938 			ahci_port_start(ap);
2939 			ahci_port_stop(ap, 0);
2940 			if ((mask = ahci_pactive(ap)) != 0) {
2941 				kprintf("%s: unable to prod the chip into "
2942 					"clearing active cmds %08x\n",
2943 					PORTNAME(ap), mask);
2944 				/* what do we do now? */
2945 			}
2946 		}
2947 	}
2948 
2949 	/*
2950 	 * CCB completion (non blocking).
2951 	 *
2952 	 * CCB completion is detected by noticing its slot's bit in CI has
2953 	 * changed to zero some time after we activated it.
2954 	 * If we are polling, we may only be interested in particular slot(s).
2955 	 *
2956 	 * Any active bits not saved are completed within the restrictions
2957 	 * imposed by the caller.
2958 	 */
2959 	ci_masked = ~ci_saved & *active;
2960 	while (ci_masked) {
2961 		slot = ffs(ci_masked) - 1;
2962 		ccb = &ap->ap_ccbs[slot];
2963 		ci_masked &= ~(1 << slot);
2964 
2965 		DPRINTF(AHCI_D_INTR, "%s: slot %d is complete%s\n",
2966 		    PORTNAME(ap), slot, ccb->ccb_xa.state == ATA_S_ERROR ?
2967 		    " (error)" : "");
2968 
2969 		bus_dmamap_sync(sc->sc_tag_cmdh,
2970 				AHCI_DMA_MAP(ap->ap_dmamem_cmd_list),
2971 				BUS_DMASYNC_POSTWRITE);
2972 
2973 		bus_dmamap_sync(sc->sc_tag_cmdt,
2974 				AHCI_DMA_MAP(ap->ap_dmamem_cmd_table),
2975 				BUS_DMASYNC_POSTWRITE);
2976 
2977 		bus_dmamap_sync(sc->sc_tag_rfis,
2978 				AHCI_DMA_MAP(ap->ap_dmamem_rfis),
2979 				BUS_DMASYNC_POSTREAD);
2980 
2981 		*active &= ~(1 << ccb->ccb_slot);
2982 		if (active == &ap->ap_active) {
2983 			KKASSERT(ap->ap_active_cnt > 0);
2984 			--ap->ap_active_cnt;
2985 		}
2986 
2987 		/*
2988 		 * Complete the ccb.  If the ccb was marked expired it
2989 		 * was probably already removed from the command processor,
2990 		 * so don't take the clear ci_saved bit as meaning the
2991 		 * command actually succeeded, it didn't.
2992 		 */
2993 		if (ap->ap_expired & (1 << ccb->ccb_slot)) {
2994 			ap->ap_expired &= ~(1 << ccb->ccb_slot);
2995 			ccb->ccb_xa.state = ATA_S_TIMEOUT;
2996 			ccb->ccb_done(ccb);
2997 			ccb->ccb_xa.complete(&ccb->ccb_xa);
2998 		} else {
2999 			if (ccb->ccb_xa.state == ATA_S_ONCHIP) {
3000 				ccb->ccb_xa.state = ATA_S_COMPLETE;
3001 				if (ccb->ccb_xa.flags & ATA_F_AUTOSENSE) {
3002 					memcpy(&ccb->ccb_xa.rfis,
3003 					    ap->ap_rfis->rfis,
3004 					    sizeof(struct ata_fis_d2h));
3005 					if (ccb->ccb_xa.state == ATA_S_TIMEOUT)
3006 						ccb->ccb_xa.state = ATA_S_ERROR;
3007 				}
3008 			}
3009 			ccb->ccb_done(ccb);
3010 		}
3011 	}
3012 
3013 	/*
3014 	 * Cleanup.  Will not be set if non-blocking.
3015 	 */
3016 	switch(need) {
3017 	case NEED_NOTHING:
3018 		/*
3019 		 * If operating normally and not stopped the interrupt was
3020 		 * probably just a normal completion and we may be able to
3021 		 * issue more commands.
3022 		 */
3023 		if (stopped == 0 && ap->ap_state != AP_S_FATAL_ERROR)
3024 			ahci_issue_pending_commands(ap, NULL);
3025 		break;
3026 	case NEED_RESTART:
3027 		/*
3028 		 * A recoverable error occured and we can restart outstanding
3029 		 * commands on the port.
3030 		 */
3031 		ci_saved &= ~ap->ap_expired;
3032 		if (ci_saved) {
3033 			kprintf("%s: Restart %08x\n", PORTNAME(ap), ci_saved);
3034 			ahci_issue_saved_commands(ap, ci_saved);
3035 		}
3036 
3037 		/*
3038 		 * Potentially issue new commands if not in a failed
3039 		 * state.
3040 		 */
3041 		if (ap->ap_state != AP_S_FATAL_ERROR) {
3042 			ahci_port_start(ap);
3043 			ahci_issue_pending_commands(ap, NULL);
3044 		}
3045 		break;
3046 	case NEED_REINIT:
3047 		/*
3048 		 * Something horrible happened to the port and we
3049 		 * need to reinitialize it.
3050 		 */
3051 		kprintf("%s: REINIT - Attempting to reinitialize the port "
3052 			"after it had a horrible accident\n",
3053 			PORTNAME(ap));
3054 		ap->ap_flags |= AP_F_IN_RESET;
3055 		ap->ap_flags |= AP_F_HARSH_REINIT;
3056 		ap->ap_probe = ATA_PROBE_NEED_INIT;
3057 		ahci_cam_changed(ap, NULL, -1);
3058 		break;
3059 	case NEED_HOTPLUG_INSERT:
3060 		/*
3061 		 * A hot-plug insertion event has occured and all
3062 		 * outstanding commands have already been revoked.
3063 		 *
3064 		 * Don't recurse if this occurs while we are
3065 		 * resetting the port.
3066 		 */
3067 		if ((ap->ap_flags & AP_F_IN_RESET) == 0) {
3068 			kprintf("%s: HOTPLUG - Device inserted\n",
3069 				PORTNAME(ap));
3070 			ap->ap_probe = ATA_PROBE_NEED_INIT;
3071 			ahci_cam_changed(ap, NULL, -1);
3072 		}
3073 		break;
3074 	case NEED_HOTPLUG_REMOVE:
3075 		/*
3076 		 * A hot-plug removal event has occured and all
3077 		 * outstanding commands have already been revoked.
3078 		 *
3079 		 * Don't recurse if this occurs while we are
3080 		 * resetting the port.
3081 		 */
3082 		if ((ap->ap_flags & AP_F_IN_RESET) == 0) {
3083 			kprintf("%s: HOTPLUG - Device removed\n",
3084 				PORTNAME(ap));
3085 			ahci_port_hardstop(ap);
3086 			/* ap_probe set to failed */
3087 			ahci_cam_changed(ap, NULL, -1);
3088 		}
3089 		break;
3090 	default:
3091 		break;
3092 	}
3093 }
3094 
3095 struct ahci_ccb *
3096 ahci_get_ccb(struct ahci_port *ap)
3097 {
3098 	struct ahci_ccb			*ccb;
3099 
3100 	lockmgr(&ap->ap_ccb_lock, LK_EXCLUSIVE);
3101 	ccb = TAILQ_FIRST(&ap->ap_ccb_free);
3102 	if (ccb != NULL) {
3103 		KKASSERT((ap->ap_sactive & (1 << ccb->ccb_slot)) == 0);
3104 		KKASSERT(ccb->ccb_xa.state == ATA_S_PUT);
3105 		TAILQ_REMOVE(&ap->ap_ccb_free, ccb, ccb_entry);
3106 		ccb->ccb_xa.state = ATA_S_SETUP;
3107 		ccb->ccb_xa.flags = 0;
3108 		ccb->ccb_xa.at = NULL;
3109 	}
3110 	lockmgr(&ap->ap_ccb_lock, LK_RELEASE);
3111 
3112 	return (ccb);
3113 }
3114 
3115 void
3116 ahci_put_ccb(struct ahci_ccb *ccb)
3117 {
3118 	struct ahci_port		*ap = ccb->ccb_port;
3119 
3120 	KKASSERT(ccb->ccb_xa.state != ATA_S_PUT);
3121 	KKASSERT((ap->ap_sactive & (1 << ccb->ccb_slot)) == 0);
3122 	lockmgr(&ap->ap_ccb_lock, LK_EXCLUSIVE);
3123 	ccb->ccb_xa.state = ATA_S_PUT;
3124 	++ccb->ccb_xa.serial;
3125 	TAILQ_INSERT_TAIL(&ap->ap_ccb_free, ccb, ccb_entry);
3126 	lockmgr(&ap->ap_ccb_lock, LK_RELEASE);
3127 }
3128 
3129 struct ahci_ccb *
3130 ahci_get_err_ccb(struct ahci_port *ap)
3131 {
3132 	struct ahci_ccb *err_ccb;
3133 	u_int32_t sact;
3134 	u_int32_t ci;
3135 
3136 	/* No commands may be active on the chip. */
3137 
3138 	if (ap->ap_sc->sc_cap & AHCI_REG_CAP_SNCQ) {
3139 		sact = ahci_pread(ap, AHCI_PREG_SACT);
3140 		if (sact != 0) {
3141 			kprintf("%s: ahci_get_err_ccb but SACT %08x != 0?\n",
3142 				PORTNAME(ap), sact);
3143 		}
3144 	}
3145 	ci = ahci_pread(ap, AHCI_PREG_CI);
3146 	if (ci) {
3147 		kprintf("%s: ahci_get_err_ccb: ci not 0 (%08x)\n",
3148 			ap->ap_name, ci);
3149 	}
3150 	KKASSERT(ci == 0);
3151 	KKASSERT((ap->ap_flags & AP_F_ERR_CCB_RESERVED) == 0);
3152 	ap->ap_flags |= AP_F_ERR_CCB_RESERVED;
3153 
3154 	/* Save outstanding command state. */
3155 	ap->ap_err_saved_active = ap->ap_active;
3156 	ap->ap_err_saved_active_cnt = ap->ap_active_cnt;
3157 	ap->ap_err_saved_sactive = ap->ap_sactive;
3158 
3159 	/*
3160 	 * Pretend we have no commands outstanding, so that completions won't
3161 	 * run prematurely.
3162 	 */
3163 	ap->ap_active = ap->ap_active_cnt = ap->ap_sactive = 0;
3164 
3165 	/*
3166 	 * Grab a CCB to use for error recovery.  This should never fail, as
3167 	 * we ask atascsi to reserve one for us at init time.
3168 	 */
3169 	err_ccb = ap->ap_err_ccb;
3170 	KKASSERT(err_ccb != NULL);
3171 	err_ccb->ccb_xa.flags = 0;
3172 	err_ccb->ccb_done = ahci_empty_done;
3173 
3174 	return err_ccb;
3175 }
3176 
3177 void
3178 ahci_put_err_ccb(struct ahci_ccb *ccb)
3179 {
3180 	struct ahci_port *ap = ccb->ccb_port;
3181 	u_int32_t sact;
3182 	u_int32_t ci;
3183 
3184 	KKASSERT((ap->ap_flags & AP_F_ERR_CCB_RESERVED) != 0);
3185 
3186 	/*
3187 	 * No commands may be active on the chip
3188 	 */
3189 	if (ap->ap_sc->sc_cap & AHCI_REG_CAP_SNCQ) {
3190 		sact = ahci_pread(ap, AHCI_PREG_SACT);
3191 		if (sact) {
3192 			panic("ahci_port_err_ccb(%d) but SACT %08x != 0",
3193 			      ccb->ccb_slot, sact);
3194 		}
3195 	}
3196 	ci = ahci_pread(ap, AHCI_PREG_CI);
3197 	if (ci) {
3198 		panic("ahci_put_err_ccb(%d) but CI %08x != 0 "
3199 		      "(act=%08x sact=%08x)\n",
3200 		      ccb->ccb_slot, ci,
3201 		      ap->ap_active, ap->ap_sactive);
3202 	}
3203 
3204 	KKASSERT(ccb == ap->ap_err_ccb);
3205 
3206 	/* Restore outstanding command state */
3207 	ap->ap_sactive = ap->ap_err_saved_sactive;
3208 	ap->ap_active_cnt = ap->ap_err_saved_active_cnt;
3209 	ap->ap_active = ap->ap_err_saved_active;
3210 
3211 	ap->ap_flags &= ~AP_F_ERR_CCB_RESERVED;
3212 }
3213 
3214 /*
3215  * Read log page to get NCQ error.
3216  *
3217  * NOTE: NCQ not currently supported on port multipliers. XXX
3218  */
3219 int
3220 ahci_port_read_ncq_error(struct ahci_port *ap, int target)
3221 {
3222 	struct ata_log_page_10h	*log;
3223 	struct ahci_ccb		*ccb;
3224 	struct ahci_ccb		*ccb2;
3225 	struct ahci_cmd_hdr	*cmd_slot;
3226 	struct ata_fis_h2d	*fis;
3227 	int			err_slot;
3228 
3229 	if (bootverbose) {
3230 		kprintf("%s: READ LOG PAGE target %d\n", PORTNAME(ap),
3231 			target);
3232 	}
3233 
3234 	/*
3235 	 * Prep error CCB for READ LOG EXT, page 10h, 1 sector.
3236 	 *
3237 	 * Getting err_ccb clears active/sactive/active_cnt, putting
3238 	 * it back restores the fields.
3239 	 */
3240 	ccb = ahci_get_err_ccb(ap);
3241 	ccb->ccb_xa.flags = ATA_F_READ | ATA_F_POLL;
3242 	ccb->ccb_xa.data = ap->ap_err_scratch;
3243 	ccb->ccb_xa.datalen = 512;
3244 	ccb->ccb_xa.complete = ahci_dummy_done;
3245 	ccb->ccb_xa.at = ap->ap_ata[target];
3246 
3247 	fis = (struct ata_fis_h2d *)ccb->ccb_cmd_table->cfis;
3248 	bzero(fis, sizeof(*fis));
3249 	fis->type = ATA_FIS_TYPE_H2D;
3250 	fis->flags = ATA_H2D_FLAGS_CMD | target;
3251 	fis->command = ATA_C_READ_LOG_EXT;
3252 	fis->lba_low = 0x10;		/* queued error log page (10h) */
3253 	fis->sector_count = 1;		/* number of sectors (1) */
3254 	fis->sector_count_exp = 0;
3255 	fis->lba_mid = 0;		/* starting offset */
3256 	fis->lba_mid_exp = 0;
3257 	fis->device = 0;
3258 
3259 	cmd_slot = ccb->ccb_cmd_hdr;
3260 	cmd_slot->flags = htole16(5);	/* FIS length: 5 DWORDS */
3261 
3262 	if (ahci_load_prdt(ccb) != 0) {
3263 		err_slot = -1;
3264 		goto err;
3265 	}
3266 
3267 	ccb->ccb_xa.state = ATA_S_PENDING;
3268 	if (ahci_poll(ccb, 1000, ahci_quick_timeout) != ATA_S_COMPLETE) {
3269 		err_slot = -1;
3270 		ahci_unload_prdt(ccb);
3271 		goto err;
3272 	}
3273 	ahci_unload_prdt(ccb);
3274 
3275 	/*
3276 	 * Success, extract failed register set and tags from the scratch
3277 	 * space.
3278 	 */
3279 	log = (struct ata_log_page_10h *)ap->ap_err_scratch;
3280 	if (log->err_regs.type & ATA_LOG_10H_TYPE_NOTQUEUED) {
3281 		/* Not queued bit was set - wasn't an NCQ error? */
3282 		kprintf("%s: read NCQ error page, but not an NCQ error?\n",
3283 			PORTNAME(ap));
3284 		err_slot = -1;
3285 	} else {
3286 		/* Copy back the log record as a D2H register FIS. */
3287 		err_slot = log->err_regs.type & ATA_LOG_10H_TYPE_TAG_MASK;
3288 
3289 		ccb2 = &ap->ap_ccbs[err_slot];
3290 		if (ccb2->ccb_xa.state == ATA_S_ONCHIP) {
3291 			kprintf("%s: read NCQ error page slot=%d\n",
3292 				ATANAME(ap, ccb2->ccb_xa.at),
3293 				err_slot);
3294 			memcpy(&ccb2->ccb_xa.rfis, &log->err_regs,
3295 				sizeof(struct ata_fis_d2h));
3296 			ccb2->ccb_xa.rfis.type = ATA_FIS_TYPE_D2H;
3297 			ccb2->ccb_xa.rfis.flags = 0;
3298 		} else {
3299 			kprintf("%s: read NCQ error page slot=%d, "
3300 				"slot does not match any cmds\n",
3301 				ATANAME(ccb2->ccb_port, ccb2->ccb_xa.at),
3302 				err_slot);
3303 			err_slot = -1;
3304 		}
3305 	}
3306 err:
3307 	ahci_put_err_ccb(ccb);
3308 	kprintf("%s: DONE log page target %d err_slot=%d\n",
3309 		PORTNAME(ap), target, err_slot);
3310 	return (err_slot);
3311 }
3312 
3313 /*
3314  * Allocate memory for various structures DMAd by hardware.  The maximum
3315  * number of segments for these tags is 1 so the DMA memory will have a
3316  * single physical base address.
3317  */
3318 struct ahci_dmamem *
3319 ahci_dmamem_alloc(struct ahci_softc *sc, bus_dma_tag_t tag)
3320 {
3321 	struct ahci_dmamem *adm;
3322 	int	error;
3323 
3324 	adm = kmalloc(sizeof(*adm), M_DEVBUF, M_INTWAIT | M_ZERO);
3325 
3326 	error = bus_dmamem_alloc(tag, (void **)&adm->adm_kva,
3327 				 BUS_DMA_ZERO, &adm->adm_map);
3328 	if (error == 0) {
3329 		adm->adm_tag = tag;
3330 		error = bus_dmamap_load(tag, adm->adm_map,
3331 					adm->adm_kva,
3332 					bus_dma_tag_getmaxsize(tag),
3333 					ahci_dmamem_saveseg, &adm->adm_busaddr,
3334 					0);
3335 	}
3336 	if (error) {
3337 		if (adm->adm_map) {
3338 			bus_dmamap_destroy(tag, adm->adm_map);
3339 			adm->adm_map = NULL;
3340 			adm->adm_tag = NULL;
3341 			adm->adm_kva = NULL;
3342 		}
3343 		kfree(adm, M_DEVBUF);
3344 		adm = NULL;
3345 	}
3346 	return (adm);
3347 }
3348 
3349 static
3350 void
3351 ahci_dmamem_saveseg(void *info, bus_dma_segment_t *segs, int nsegs, int error)
3352 {
3353 	KKASSERT(error == 0);
3354 	KKASSERT(nsegs == 1);
3355 	*(bus_addr_t *)info = segs->ds_addr;
3356 }
3357 
3358 
3359 void
3360 ahci_dmamem_free(struct ahci_softc *sc, struct ahci_dmamem *adm)
3361 {
3362 	if (adm->adm_map) {
3363 		bus_dmamap_unload(adm->adm_tag, adm->adm_map);
3364 		bus_dmamap_destroy(adm->adm_tag, adm->adm_map);
3365 		adm->adm_map = NULL;
3366 		adm->adm_tag = NULL;
3367 		adm->adm_kva = NULL;
3368 	}
3369 	kfree(adm, M_DEVBUF);
3370 }
3371 
3372 u_int32_t
3373 ahci_read(struct ahci_softc *sc, bus_size_t r)
3374 {
3375 	bus_space_barrier(sc->sc_iot, sc->sc_ioh, r, 4,
3376 			  BUS_SPACE_BARRIER_READ);
3377 	return (bus_space_read_4(sc->sc_iot, sc->sc_ioh, r));
3378 }
3379 
3380 void
3381 ahci_write(struct ahci_softc *sc, bus_size_t r, u_int32_t v)
3382 {
3383 	bus_space_write_4(sc->sc_iot, sc->sc_ioh, r, v);
3384 	bus_space_barrier(sc->sc_iot, sc->sc_ioh, r, 4,
3385 			  BUS_SPACE_BARRIER_WRITE);
3386 }
3387 
3388 u_int32_t
3389 ahci_pread(struct ahci_port *ap, bus_size_t r)
3390 {
3391 	bus_space_barrier(ap->ap_sc->sc_iot, ap->ap_ioh, r, 4,
3392 			  BUS_SPACE_BARRIER_READ);
3393 	return (bus_space_read_4(ap->ap_sc->sc_iot, ap->ap_ioh, r));
3394 }
3395 
3396 void
3397 ahci_pwrite(struct ahci_port *ap, bus_size_t r, u_int32_t v)
3398 {
3399 	bus_space_write_4(ap->ap_sc->sc_iot, ap->ap_ioh, r, v);
3400 	bus_space_barrier(ap->ap_sc->sc_iot, ap->ap_ioh, r, 4,
3401 			  BUS_SPACE_BARRIER_WRITE);
3402 }
3403 
3404 /*
3405  * Wait up to (timeout) milliseconds for the masked port register to
3406  * match the target.
3407  *
3408  * Timeout is in milliseconds.
3409  */
3410 int
3411 ahci_pwait_eq(struct ahci_port *ap, int timeout,
3412 	      bus_size_t r, u_int32_t mask, u_int32_t target)
3413 {
3414 	int	t;
3415 
3416 	/*
3417 	 * Loop hard up to 100uS
3418 	 */
3419 	for (t = 0; t < 100; ++t) {
3420 		if ((ahci_pread(ap, r) & mask) == target)
3421 			return (0);
3422 		ahci_os_hardsleep(1);	/* us */
3423 	}
3424 
3425 	do {
3426 		timeout -= ahci_os_softsleep();
3427 		if ((ahci_pread(ap, r) & mask) == target)
3428 			return (0);
3429 	} while (timeout > 0);
3430 	return (1);
3431 }
3432 
3433 int
3434 ahci_wait_ne(struct ahci_softc *sc, bus_size_t r, u_int32_t mask,
3435 	     u_int32_t target)
3436 {
3437 	int	t;
3438 
3439 	/*
3440 	 * Loop hard up to 100uS
3441 	 */
3442 	for (t = 0; t < 100; ++t) {
3443 		if ((ahci_read(sc, r) & mask) != target)
3444 			return (0);
3445 		ahci_os_hardsleep(1);	/* us */
3446 	}
3447 
3448 	/*
3449 	 * And one millisecond the slow way
3450 	 */
3451 	t = 1000;
3452 	do {
3453 		t -= ahci_os_softsleep();
3454 		if ((ahci_read(sc, r) & mask) != target)
3455 			return (0);
3456 	} while (t > 0);
3457 
3458 	return (1);
3459 }
3460 
3461 
3462 /*
3463  * Acquire an ata transfer.
3464  *
3465  * Pass a NULL at for direct-attached transfers, and a non-NULL at for
3466  * targets that go through the port multiplier.
3467  */
3468 struct ata_xfer *
3469 ahci_ata_get_xfer(struct ahci_port *ap, struct ata_port *at)
3470 {
3471 	struct ahci_ccb		*ccb;
3472 
3473 	ccb = ahci_get_ccb(ap);
3474 	if (ccb == NULL) {
3475 		DPRINTF(AHCI_D_XFER, "%s: ahci_ata_get_xfer: NULL ccb\n",
3476 		    PORTNAME(ap));
3477 		return (NULL);
3478 	}
3479 
3480 	DPRINTF(AHCI_D_XFER, "%s: ahci_ata_get_xfer got slot %d\n",
3481 	    PORTNAME(ap), ccb->ccb_slot);
3482 
3483 	bzero(ccb->ccb_xa.fis, sizeof(*ccb->ccb_xa.fis));
3484 	ccb->ccb_xa.at = at;
3485 	ccb->ccb_xa.fis->type = ATA_FIS_TYPE_H2D;
3486 
3487 	return (&ccb->ccb_xa);
3488 }
3489 
3490 void
3491 ahci_ata_put_xfer(struct ata_xfer *xa)
3492 {
3493 	struct ahci_ccb			*ccb = (struct ahci_ccb *)xa;
3494 
3495 	DPRINTF(AHCI_D_XFER, "ahci_ata_put_xfer slot %d\n", ccb->ccb_slot);
3496 
3497 	ahci_put_ccb(ccb);
3498 }
3499 
3500 int
3501 ahci_ata_cmd(struct ata_xfer *xa)
3502 {
3503 	struct ahci_ccb			*ccb = (struct ahci_ccb *)xa;
3504 	struct ahci_cmd_hdr		*cmd_slot;
3505 
3506 	KKASSERT(xa->state == ATA_S_SETUP);
3507 
3508 	if (ccb->ccb_port->ap_state == AP_S_FATAL_ERROR)
3509 		goto failcmd;
3510 	ccb->ccb_done = ahci_ata_cmd_done;
3511 
3512 	cmd_slot = ccb->ccb_cmd_hdr;
3513 	cmd_slot->flags = htole16(5); /* FIS length (in DWORDs) */
3514 	if (ccb->ccb_xa.at) {
3515 		cmd_slot->flags |= htole16(ccb->ccb_xa.at->at_target <<
3516 					   AHCI_CMD_LIST_FLAG_PMP_SHIFT);
3517 	}
3518 
3519 	if (xa->flags & ATA_F_WRITE)
3520 		cmd_slot->flags |= htole16(AHCI_CMD_LIST_FLAG_W);
3521 
3522 	if (xa->flags & ATA_F_PACKET)
3523 		cmd_slot->flags |= htole16(AHCI_CMD_LIST_FLAG_A);
3524 
3525 	if (ahci_load_prdt(ccb) != 0)
3526 		goto failcmd;
3527 
3528 	xa->state = ATA_S_PENDING;
3529 
3530 	if (xa->flags & ATA_F_POLL)
3531 		return (ahci_poll(ccb, xa->timeout, ahci_ata_cmd_timeout));
3532 
3533 	crit_enter();
3534 	KKASSERT((xa->flags & ATA_F_TIMEOUT_EXPIRED) == 0);
3535 	xa->flags |= ATA_F_TIMEOUT_DESIRED;
3536 	ahci_start(ccb);
3537 	crit_exit();
3538 	return (xa->state);
3539 
3540 failcmd:
3541 	crit_enter();
3542 	xa->state = ATA_S_ERROR;
3543 	xa->complete(xa);
3544 	crit_exit();
3545 	return (ATA_S_ERROR);
3546 }
3547 
3548 void
3549 ahci_ata_cmd_done(struct ahci_ccb *ccb)
3550 {
3551 	struct ata_xfer	*xa = &ccb->ccb_xa;
3552 	int serial;
3553 
3554 	/*
3555 	 * NOTE: Callout does not lock port and may race us modifying
3556 	 *	 the flags, so make sure its stopped.
3557 	 *
3558 	 *	 A callout race can clean up the ccb.  A change in the
3559 	 *	 serial number should catch this condition.
3560 	 */
3561 	if (xa->flags & ATA_F_TIMEOUT_RUNNING) {
3562 		serial = ccb->ccb_xa.serial;
3563 		callout_stop_sync(&ccb->ccb_timeout);
3564 		if (serial != ccb->ccb_xa.serial) {
3565 			kprintf("%s: Warning: timeout race ccb %p\n",
3566 				PORTNAME(ccb->ccb_port), ccb);
3567 			return;
3568 		}
3569 		xa->flags &= ~ATA_F_TIMEOUT_RUNNING;
3570 	}
3571 	xa->flags &= ~(ATA_F_TIMEOUT_DESIRED | ATA_F_TIMEOUT_EXPIRED);
3572 	ccb->ccb_port->ap_expired &= ~(1 << ccb->ccb_slot);
3573 
3574 	KKASSERT(xa->state != ATA_S_ONCHIP && xa->state != ATA_S_PUT);
3575 	ahci_unload_prdt(ccb);
3576 
3577 	if (xa->state != ATA_S_TIMEOUT)
3578 		xa->complete(xa);
3579 }
3580 
3581 /*
3582  * Timeout from callout, MPSAFE - nothing can mess with the CCB's flags
3583  * while the callout is runing.
3584  *
3585  * We can't safely get the port lock here or delay, we could block
3586  * the callout thread.
3587  */
3588 static void
3589 ahci_ata_cmd_timeout_unserialized(void *arg)
3590 {
3591 	struct ahci_ccb		*ccb = arg;
3592 	struct ahci_port	*ap = ccb->ccb_port;
3593 
3594 	KKASSERT(ccb->ccb_xa.flags & ATA_F_TIMEOUT_RUNNING);
3595 	ccb->ccb_xa.flags &= ~ATA_F_TIMEOUT_RUNNING;
3596 	ccb->ccb_xa.flags |= ATA_F_TIMEOUT_EXPIRED;
3597 	ahci_os_signal_port_thread(ap, AP_SIGF_TIMEOUT);
3598 }
3599 
3600 /*
3601  * Timeout code, typically called when the port command processor is running.
3602  *
3603  * We have to be very very careful here.  We cannot stop the port unless
3604  * CR is already clear or the only active commands remaining are timed-out
3605  * ones.  Otherwise stopping the port will race the command processor and
3606  * we can lose events.  While we can theoretically just restart everything
3607  * that could result in a double-issue which will not work for ATAPI commands.
3608  */
3609 void
3610 ahci_ata_cmd_timeout(struct ahci_ccb *ccb)
3611 {
3612 	struct ata_xfer		*xa = &ccb->ccb_xa;
3613 	struct ahci_port	*ap = ccb->ccb_port;
3614 	struct ata_port		*at;
3615 	u_int32_t		ci_saved;
3616 	u_int32_t		mask;
3617 	int			slot;
3618 
3619 	at = ccb->ccb_xa.at;
3620 
3621 	kprintf("%s: CMD TIMEOUT state=%d slot=%d\n"
3622 		"\tglb-status 0x%08x\n"
3623 		"\tcmd-reg 0x%b\n"
3624 		"\tport_status 0x%b\n"
3625 		"\tsactive=%08x active=%08x expired=%08x\n"
3626 		"\t   sact=%08x     ci=%08x\n"
3627 		"\t    STS=%b\n",
3628 		ATANAME(ap, at),
3629 		ccb->ccb_xa.state, ccb->ccb_slot,
3630 		ahci_read(ap->ap_sc, AHCI_REG_IS),
3631 		ahci_pread(ap, AHCI_PREG_CMD), AHCI_PFMT_CMD,
3632 		ahci_pread(ap, AHCI_PREG_IS), AHCI_PFMT_IS,
3633 		ap->ap_sactive, ap->ap_active, ap->ap_expired,
3634 		ahci_pread(ap, AHCI_PREG_SACT),
3635 		ahci_pread(ap, AHCI_PREG_CI),
3636 		ahci_pread(ap, AHCI_PREG_TFD), AHCI_PFMT_TFD_STS
3637 	);
3638 
3639 
3640 	/*
3641 	 * NOTE: Timeout will not be running if the command was polled.
3642 	 *	 If we got here at least one of these flags should be set.
3643 	 */
3644 	KKASSERT(xa->flags & (ATA_F_POLL | ATA_F_TIMEOUT_DESIRED |
3645 			      ATA_F_TIMEOUT_RUNNING));
3646 	xa->flags &= ~(ATA_F_TIMEOUT_RUNNING | ATA_F_TIMEOUT_EXPIRED);
3647 
3648 	if (ccb->ccb_xa.state == ATA_S_PENDING) {
3649 		TAILQ_REMOVE(&ap->ap_ccb_pending, ccb, ccb_entry);
3650 		ccb->ccb_xa.state = ATA_S_TIMEOUT;
3651 		ccb->ccb_done(ccb);
3652 		xa->complete(xa);
3653 		ahci_issue_pending_commands(ap, NULL);
3654 		return;
3655 	}
3656 	if (ccb->ccb_xa.state != ATA_S_ONCHIP) {
3657 		kprintf("%s: Unexpected state during timeout: %d\n",
3658 			ATANAME(ap, at), ccb->ccb_xa.state);
3659 		return;
3660 	}
3661 
3662 	/*
3663 	 * Ok, we can only get this command off the chip if CR is inactive
3664 	 * or if the only commands running on the chip are all expired.
3665 	 * Otherwise we have to wait until the port is in a safe state.
3666 	 *
3667 	 * Do not set state here, it will cause polls to return when the
3668 	 * ccb is not yet off the chip.
3669 	 */
3670 	ap->ap_expired |= 1 << ccb->ccb_slot;
3671 
3672 	if ((ahci_pread(ap, AHCI_PREG_CMD) & AHCI_PREG_CMD_CR) &&
3673 	    (ap->ap_active | ap->ap_sactive) != ap->ap_expired) {
3674 		/*
3675 		 * If using FBSS or NCQ we can't safely stop the port
3676 		 * right now.
3677 		 */
3678 		kprintf("%s: Deferred timeout until its safe, slot %d\n",
3679 			ATANAME(ap, at), ccb->ccb_slot);
3680 		return;
3681 	}
3682 
3683 	/*
3684 	 * We can safely stop the port and process all expired ccb's,
3685 	 * which will include our current ccb.
3686 	 */
3687 	ci_saved = (ap->ap_sactive) ? ahci_pread(ap, AHCI_PREG_SACT) :
3688 				      ahci_pread(ap, AHCI_PREG_CI);
3689 	ahci_port_stop(ap, 0);
3690 
3691 	while (ap->ap_expired) {
3692 		slot = ffs(ap->ap_expired) - 1;
3693 		ap->ap_expired &= ~(1 << slot);
3694 		ci_saved &= ~(1 << slot);
3695 		ccb = &ap->ap_ccbs[slot];
3696 		ccb->ccb_xa.state = ATA_S_TIMEOUT;
3697 		if (ccb->ccb_xa.flags & ATA_F_NCQ) {
3698 			KKASSERT(ap->ap_sactive & (1 << slot));
3699 			ap->ap_sactive &= ~(1 << slot);
3700 		} else {
3701 			KKASSERT(ap->ap_active & (1 << slot));
3702 			ap->ap_active &= ~(1 << slot);
3703 			--ap->ap_active_cnt;
3704 		}
3705 		ccb->ccb_done(ccb);
3706 		ccb->ccb_xa.complete(&ccb->ccb_xa);
3707 	}
3708 	/* ccb invalid now */
3709 
3710 	/*
3711 	 * We can safely CLO the port to clear any BSY/DRQ, a case which
3712 	 * can occur with port multipliers.  This will unbrick the port
3713 	 * and allow commands to other targets behind the PM continue.
3714 	 * (FBSS).
3715 	 *
3716 	 * Finally, once the port has been restarted we can issue any
3717 	 * previously saved pending commands, and run the port interrupt
3718 	 * code to handle any completions which may have occured when
3719 	 * we saved CI.
3720 	 */
3721 	if (ahci_pread(ap, AHCI_PREG_TFD) &
3722 		   (AHCI_PREG_TFD_STS_BSY | AHCI_PREG_TFD_STS_DRQ)) {
3723 		kprintf("%s: Warning, issuing CLO after timeout\n",
3724 			ATANAME(ap, at));
3725 		ahci_port_clo(ap);
3726 	}
3727 	ahci_port_start(ap);
3728 
3729 	/*
3730 	 * We absolutely must make sure the chipset cleared activity on
3731 	 * all slots.  This sometimes might not happen due to races with
3732 	 * a chipset interrupt which stops the port before we can manage
3733 	 * to.  For some reason some chipsets don't clear the active
3734 	 * commands when we turn off CMD_ST after the chip has stopped
3735 	 * operations itself.
3736 	 */
3737 	if (ahci_pactive(ap) != 0) {
3738 		ahci_port_stop(ap, 0);
3739 		ahci_port_start(ap);
3740 		if ((mask = ahci_pactive(ap)) != 0) {
3741 			kprintf("%s: quick-timeout: chipset failed "
3742 				"to clear active cmds %08x\n",
3743 				PORTNAME(ap), mask);
3744 		}
3745 	}
3746 	ahci_issue_saved_commands(ap, ci_saved & ~ap->ap_expired);
3747 	ahci_issue_pending_commands(ap, NULL);
3748 	ahci_port_intr(ap, 0);
3749 }
3750 
3751 /*
3752  * Issue a previously saved set of commands
3753  */
3754 void
3755 ahci_issue_saved_commands(struct ahci_port *ap, u_int32_t ci_saved)
3756 {
3757 	if (ci_saved) {
3758 		KKASSERT(!((ap->ap_active & ci_saved) &&
3759 			   (ap->ap_sactive & ci_saved)));
3760 		KKASSERT((ci_saved & ap->ap_expired) == 0);
3761 		if (ap->ap_sactive & ci_saved)
3762 			ahci_pwrite(ap, AHCI_PREG_SACT, ci_saved);
3763 		ahci_pwrite(ap, AHCI_PREG_CI, ci_saved);
3764 	}
3765 }
3766 
3767 /*
3768  * Used by the softreset, pmprobe, and read_ncq_error only, in very
3769  * specialized, controlled circumstances.
3770  *
3771  * Only one command may be pending.
3772  */
3773 void
3774 ahci_quick_timeout(struct ahci_ccb *ccb)
3775 {
3776 	struct ahci_port *ap = ccb->ccb_port;
3777 	u_int32_t mask;
3778 
3779 	switch (ccb->ccb_xa.state) {
3780 	case ATA_S_PENDING:
3781 		TAILQ_REMOVE(&ap->ap_ccb_pending, ccb, ccb_entry);
3782 		ccb->ccb_xa.state = ATA_S_TIMEOUT;
3783 		break;
3784 	case ATA_S_ONCHIP:
3785 		/*
3786 		 * We have to clear the command on-chip.
3787 		 */
3788 		KKASSERT(ap->ap_active == (1 << ccb->ccb_slot) &&
3789 			 ap->ap_sactive == 0);
3790 		ahci_port_stop(ap, 0);
3791 		ahci_port_start(ap);
3792 		if (ahci_pactive(ap) != 0) {
3793 			ahci_port_stop(ap, 0);
3794 			ahci_port_start(ap);
3795 			if ((mask = ahci_pactive(ap)) != 0) {
3796 				kprintf("%s: quick-timeout: chipset failed "
3797 					"to clear active cmds %08x\n",
3798 					PORTNAME(ap), mask);
3799 			}
3800 		}
3801 
3802 		ccb->ccb_xa.state = ATA_S_TIMEOUT;
3803 		ap->ap_active &= ~(1 << ccb->ccb_slot);
3804 		KKASSERT(ap->ap_active_cnt > 0);
3805 		--ap->ap_active_cnt;
3806 		break;
3807 	default:
3808 		panic("%s: ahci_quick_timeout: ccb in bad state %d",
3809 		      ATANAME(ap, ccb->ccb_xa.at), ccb->ccb_xa.state);
3810 	}
3811 }
3812 
3813 static void
3814 ahci_dummy_done(struct ata_xfer *xa)
3815 {
3816 }
3817 
3818 static void
3819 ahci_empty_done(struct ahci_ccb *ccb)
3820 {
3821 }
3822 
3823 int
3824 ahci_set_feature(struct ahci_port *ap, struct ata_port *atx,
3825 		 int feature, int enable)
3826 {
3827 	struct ata_port *at;
3828 	struct ata_xfer *xa;
3829 	int error;
3830 
3831 	at = atx ? atx : ap->ap_ata[0];
3832 
3833 	xa = ahci_ata_get_xfer(ap, atx);
3834 
3835 	xa->fis->type = ATA_FIS_TYPE_H2D;
3836 	xa->fis->flags = ATA_H2D_FLAGS_CMD | at->at_target;
3837 	xa->fis->command = ATA_C_SET_FEATURES;
3838 	xa->fis->features = enable ? ATA_C_SATA_FEATURE_ENA :
3839 	                             ATA_C_SATA_FEATURE_DIS;
3840 	xa->fis->sector_count = feature;
3841 	xa->fis->control = ATA_FIS_CONTROL_4BIT;
3842 
3843 	xa->complete = ahci_dummy_done;
3844 	xa->datalen = 0;
3845 	xa->flags = ATA_F_POLL;
3846 	xa->timeout = 1000;
3847 
3848 	if (ahci_ata_cmd(xa) == ATA_S_COMPLETE)
3849 		error = 0;
3850 	else
3851 		error = EIO;
3852 	ahci_ata_put_xfer(xa);
3853 	return(error);
3854 }
3855