xref: /dflybsd-src/sys/dev/disk/ahci/ahci.c (revision bfc09ba0a4d805c1860f88e64d6ae9a407d3567d)
1 /*
2  * Copyright (c) 2006 David Gwynne <dlg@openbsd.org>
3  *
4  * Permission to use, copy, modify, and distribute this software for any
5  * purpose with or without fee is hereby granted, provided that the above
6  * copyright notice and this permission notice appear in all copies.
7  *
8  * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
9  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
10  * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
11  * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
12  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
13  * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
14  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
15  *
16  *
17  * Copyright (c) 2009 The DragonFly Project.  All rights reserved.
18  *
19  * This code is derived from software contributed to The DragonFly Project
20  * by Matthew Dillon <dillon@backplane.com>
21  *
22  * Redistribution and use in source and binary forms, with or without
23  * modification, are permitted provided that the following conditions
24  * are met:
25  *
26  * 1. Redistributions of source code must retain the above copyright
27  *    notice, this list of conditions and the following disclaimer.
28  * 2. Redistributions in binary form must reproduce the above copyright
29  *    notice, this list of conditions and the following disclaimer in
30  *    the documentation and/or other materials provided with the
31  *    distribution.
32  * 3. Neither the name of The DragonFly Project nor the names of its
33  *    contributors may be used to endorse or promote products derived
34  *    from this software without specific, prior written permission.
35  *
36  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
37  * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
38  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
39  * FOR A PARTICULAR PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE
40  * COPYRIGHT HOLDERS OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
41  * INCIDENTAL, SPECIAL, EXEMPLARY OR CONSEQUENTIAL DAMAGES (INCLUDING,
42  * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
43  * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED
44  * AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
45  * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT
46  * OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
47  * SUCH DAMAGE.
48  *
49  * $OpenBSD: ahci.c,v 1.147 2009/02/16 21:19:07 miod Exp $
50  */
51 
52 #include "ahci.h"
53 
54 void	ahci_port_interrupt_enable(struct ahci_port *ap);
55 
56 int	ahci_load_prdt(struct ahci_ccb *);
57 void	ahci_unload_prdt(struct ahci_ccb *);
58 static void ahci_load_prdt_callback(void *info, bus_dma_segment_t *segs,
59 				    int nsegs, int error);
60 void	ahci_start(struct ahci_ccb *);
61 int	ahci_port_softreset(struct ahci_port *ap);
62 int	ahci_port_hardreset(struct ahci_port *ap, int hard);
63 void	ahci_port_hardstop(struct ahci_port *ap);
64 
65 static void ahci_ata_cmd_timeout_unserialized(void *);
66 void	ahci_check_active_timeouts(struct ahci_port *ap);
67 
68 void	ahci_beg_exclusive_access(struct ahci_port *ap, struct ata_port *at);
69 void	ahci_end_exclusive_access(struct ahci_port *ap, struct ata_port *at);
70 void	ahci_issue_pending_commands(struct ahci_port *ap, struct ahci_ccb *ccb);
71 void	ahci_issue_saved_commands(struct ahci_port *ap, u_int32_t mask);
72 
73 int	ahci_port_read_ncq_error(struct ahci_port *, int);
74 
75 struct ahci_dmamem *ahci_dmamem_alloc(struct ahci_softc *, bus_dma_tag_t tag);
76 void	ahci_dmamem_free(struct ahci_softc *, struct ahci_dmamem *);
77 static void ahci_dmamem_saveseg(void *info, bus_dma_segment_t *segs, int nsegs, int error);
78 
79 static void ahci_dummy_done(struct ata_xfer *xa);
80 static void ahci_empty_done(struct ahci_ccb *ccb);
81 static void ahci_ata_cmd_done(struct ahci_ccb *ccb);
82 
83 /*
84  * Initialize the global AHCI hardware.  This code does not set up any of
85  * its ports.
86  */
87 int
88 ahci_init(struct ahci_softc *sc)
89 {
90 	u_int32_t	cap, pi, pleft;
91 	int		i;
92 	struct ahci_port *ap;
93 
94 	DPRINTF(AHCI_D_VERBOSE, " GHC 0x%b",
95 		ahci_read(sc, AHCI_REG_GHC), AHCI_FMT_GHC);
96 
97 	/*
98 	 * save BIOS initialised parameters, enable staggered spin up
99 	 */
100 	cap = ahci_read(sc, AHCI_REG_CAP);
101 	cap &= AHCI_REG_CAP_SMPS;
102 	cap |= AHCI_REG_CAP_SSS;
103 	pi = ahci_read(sc, AHCI_REG_PI);
104 
105 	/*
106 	 * Unconditionally reset the controller, do not conditionalize on
107 	 * trying to figure it if it was previously active or not.
108 	 *
109 	 * NOTE: On AE before HR.  The AHCI-1.1 spec has a note in section
110 	 *	 5.2.2.1 regarding this.  HR should be set to 1 only after
111 	 *	 AE is set to 1.  The reset sequence will clear HR when
112 	 *	 it completes, and will also clear AE if SAM is 0.  AE must
113 	 *	 then be set again.  When SAM is 1 the AE bit typically reads
114 	 *	 as 1 (and is read-only).
115 	 *
116 	 * NOTE: Avoid PCI[e] transaction burst by issuing dummy reads,
117 	 *	 otherwise the writes will only be separated by a few
118 	 *	 nanoseconds.
119 	 *
120 	 * NOTE BRICKS (1)
121 	 *
122 	 *	If you have a port multiplier and it does not have a device
123 	 *	in target 0, and it probes normally, but a later operation
124 	 *	mis-probes a target behind that PM, it is possible for the
125 	 *	port to brick such that only (a) a power cycle of the host
126 	 *	or (b) placing a device in target 0 will fix the problem.
127 	 *	Power cycling the PM has no effect (it works fine on another
128 	 *	host port).  This issue is unrelated to CLO.
129 	 */
130 	/*
131 	 * Wait for any prior reset sequence to complete
132 	 */
133 	if (ahci_wait_ne(sc, AHCI_REG_GHC,
134 			 AHCI_REG_GHC_HR, AHCI_REG_GHC_HR) != 0) {
135 		device_printf(sc->sc_dev, "Controller is stuck in reset\n");
136 		return (1);
137 	}
138 	ahci_write(sc, AHCI_REG_GHC, AHCI_REG_GHC_AE);
139 	ahci_os_sleep(500);
140 	ahci_read(sc, AHCI_REG_GHC);		/* flush */
141 	ahci_write(sc, AHCI_REG_GHC, AHCI_REG_GHC_AE | AHCI_REG_GHC_HR);
142 	ahci_os_sleep(500);
143 	ahci_read(sc, AHCI_REG_GHC);		/* flush */
144 	if (ahci_wait_ne(sc, AHCI_REG_GHC,
145 			 AHCI_REG_GHC_HR, AHCI_REG_GHC_HR) != 0) {
146 		device_printf(sc->sc_dev, "unable to reset controller\n");
147 		return (1);
148 	}
149 	if (ahci_read(sc, AHCI_REG_GHC) & AHCI_REG_GHC_AE) {
150 		device_printf(sc->sc_dev, "AE did not auto-clear!\n");
151 		ahci_write(sc, AHCI_REG_GHC, 0);
152 		ahci_os_sleep(500);
153 	}
154 
155 	/*
156 	 * Enable ahci (global interrupts disabled)
157 	 *
158 	 * Restore saved parameters.  Avoid pci transaction burst write
159 	 * by issuing dummy reads.
160 	 */
161 	ahci_os_sleep(500);
162 	ahci_write(sc, AHCI_REG_GHC, AHCI_REG_GHC_AE);
163 	ahci_os_sleep(500);
164 
165 	ahci_read(sc, AHCI_REG_GHC);		/* flush */
166 	ahci_write(sc, AHCI_REG_CAP, cap);
167 	ahci_write(sc, AHCI_REG_PI, pi);
168 	ahci_read(sc, AHCI_REG_GHC);		/* flush */
169 
170 	/*
171 	 * Intel hocus pocus in case the BIOS has not set the chip up
172 	 * properly for AHCI operation.
173 	 */
174 	if (pci_get_vendor(sc->sc_dev) == PCI_VENDOR_INTEL) {
175 	        if ((pci_read_config(sc->sc_dev, 0x92, 2) & 0x0F) != 0x0F)
176 			device_printf(sc->sc_dev, "Intel hocus pocus\n");
177 		pci_write_config(sc->sc_dev, 0x92,
178 			     pci_read_config(sc->sc_dev, 0x92, 2) | 0x0F, 2);
179 	}
180 
181 	/*
182 	 * This is a hack that currently does not appear to have
183 	 * a significant effect, but I noticed the port registers
184 	 * do not appear to be completely cleared after the host
185 	 * controller is reset.
186 	 *
187 	 * Use a temporary ap structure so we can call ahci_pwrite().
188 	 *
189 	 * We must be sure to stop the port
190 	 */
191 	ap = kmalloc(sizeof(*ap), M_DEVBUF, M_WAITOK | M_ZERO);
192 	ap->ap_sc = sc;
193 	pleft = pi;
194 	for (i = 0; i < AHCI_MAX_PORTS; ++i) {
195 		if (pleft == 0)
196 			break;
197 		if ((pi & (1 << i)) == 0)
198 			continue;
199 		if (bus_space_subregion(sc->sc_iot, sc->sc_ioh,
200 		    AHCI_PORT_REGION(i), AHCI_PORT_SIZE, &ap->ap_ioh) != 0) {
201 			device_printf(sc->sc_dev, "can't map port\n");
202 			return (1);
203 		}
204 		/*
205 		 * NOTE!  Setting AHCI_PREG_SCTL_DET_DISABLE on AHCI1.0 or
206 		 *	  AHCI1.1 can brick the chipset.  Not only brick it,
207 		 *	  but also crash the PC.  The bit seems unreliable
208 		 *	  on AHCI1.2 as well.
209 		 */
210 		ahci_port_stop(ap, 1);
211 		ahci_pwrite(ap, AHCI_PREG_SCTL, AHCI_PREG_SCTL_IPM_DISABLED);
212 		ahci_pwrite(ap, AHCI_PREG_SERR, -1);
213 		ahci_pwrite(ap, AHCI_PREG_IE, 0);
214 		ahci_write(ap->ap_sc, AHCI_REG_IS, 1 << i);
215 		ahci_pwrite(ap, AHCI_PREG_CMD, 0);
216 		ahci_pwrite(ap, AHCI_PREG_IS, -1);
217 		sc->sc_portmask |= (1 << i);
218 		pleft &= ~(1 << i);
219 	}
220 	sc->sc_numports = i;
221 	kfree(ap, M_DEVBUF);
222 
223 	return (0);
224 }
225 
226 /*
227  * Allocate and initialize an AHCI port.
228  */
229 int
230 ahci_port_alloc(struct ahci_softc *sc, u_int port)
231 {
232 	struct ahci_port	*ap;
233 	struct ata_port		*at;
234 	struct ahci_ccb		*ccb;
235 	u_int64_t		dva;
236 	u_int32_t		cmd;
237 	u_int32_t		data;
238 	struct ahci_cmd_hdr	*hdr;
239 	struct ahci_cmd_table	*table;
240 	int	rc = ENOMEM;
241 	int	error;
242 	int	i;
243 
244 	ap = kmalloc(sizeof(*ap), M_DEVBUF, M_WAITOK | M_ZERO);
245 	ap->ap_err_scratch = kmalloc(512, M_DEVBUF, M_WAITOK | M_ZERO);
246 
247 	ksnprintf(ap->ap_name, sizeof(ap->ap_name), "%s%d.%d",
248 		  device_get_name(sc->sc_dev),
249 		  device_get_unit(sc->sc_dev),
250 		  port);
251 	sc->sc_ports[port] = ap;
252 
253 	/*
254 	 * Allocate enough so we never have to reallocate, it makes
255 	 * it easier.
256 	 *
257 	 * ap_pmcount will be reduced by the scan if we encounter the
258 	 * port multiplier port prior to target 15.
259 	 *
260 	 * kmalloc power-of-2 allocations are guaranteed not to cross
261 	 * a page boundary.  Make sure the identify sub-structure in the
262 	 * at structure does not cross a page boundary, just in case the
263 	 * part is AHCI-1.1 and can't handle multiple DRQ blocks.
264 	 */
265 	if (ap->ap_ata[0] == NULL) {
266 		int pw2;
267 
268 		for (pw2 = 1; pw2 < sizeof(*at); pw2 <<= 1)
269 			;
270 		for (i = 0; i < AHCI_MAX_PMPORTS; ++i) {
271 			at = kmalloc(pw2, M_DEVBUF, M_INTWAIT | M_ZERO);
272 			ap->ap_ata[i] = at;
273 			at->at_ahci_port = ap;
274 			at->at_target = i;
275 			at->at_probe = ATA_PROBE_NEED_INIT;
276 			at->at_features |= ATA_PORT_F_RESCAN;
277 			ksnprintf(at->at_name, sizeof(at->at_name),
278 				  "%s.%d", ap->ap_name, i);
279 		}
280 	}
281 	if (bus_space_subregion(sc->sc_iot, sc->sc_ioh,
282 	    AHCI_PORT_REGION(port), AHCI_PORT_SIZE, &ap->ap_ioh) != 0) {
283 		device_printf(sc->sc_dev,
284 			      "unable to create register window for port %d\n",
285 			      port);
286 		goto freeport;
287 	}
288 
289 	ap->ap_sc = sc;
290 	ap->ap_num = port;
291 	ap->ap_probe = ATA_PROBE_NEED_INIT;
292 	TAILQ_INIT(&ap->ap_ccb_free);
293 	TAILQ_INIT(&ap->ap_ccb_pending);
294 	lockinit(&ap->ap_ccb_lock, "ahcipo", 0, 0);
295 
296 	/* Disable port interrupts */
297 	ahci_pwrite(ap, AHCI_PREG_IE, 0);
298 	ahci_pwrite(ap, AHCI_PREG_SERR, -1);
299 
300 	/*
301 	 * Sec 10.1.2 - deinitialise port if it is already running
302 	 */
303 	cmd = ahci_pread(ap, AHCI_PREG_CMD);
304 	if ((cmd & (AHCI_PREG_CMD_ST | AHCI_PREG_CMD_CR |
305 		    AHCI_PREG_CMD_FRE | AHCI_PREG_CMD_FR)) ||
306 	    (ahci_pread(ap, AHCI_PREG_SCTL) & AHCI_PREG_SCTL_DET)) {
307 		int r;
308 
309 		r = ahci_port_stop(ap, 1);
310 		if (r) {
311 			device_printf(sc->sc_dev,
312 				  "unable to disable %s, ignoring port %d\n",
313 				  ((r == 2) ? "CR" : "FR"), port);
314 			rc = ENXIO;
315 			goto freeport;
316 		}
317 
318 		/* Write DET to zero */
319 		ahci_pwrite(ap, AHCI_PREG_SCTL, AHCI_PREG_SCTL_IPM_DISABLED);
320 	}
321 
322 	/* Allocate RFIS */
323 	ap->ap_dmamem_rfis = ahci_dmamem_alloc(sc, sc->sc_tag_rfis);
324 	if (ap->ap_dmamem_rfis == NULL) {
325 		kprintf("%s: NORFIS\n", PORTNAME(ap));
326 		goto nomem;
327 	}
328 
329 	/* Setup RFIS base address */
330 	ap->ap_rfis = (struct ahci_rfis *) AHCI_DMA_KVA(ap->ap_dmamem_rfis);
331 	dva = AHCI_DMA_DVA(ap->ap_dmamem_rfis);
332 	ahci_pwrite(ap, AHCI_PREG_FBU, (u_int32_t)(dva >> 32));
333 	ahci_pwrite(ap, AHCI_PREG_FB, (u_int32_t)dva);
334 
335 	/* Clear SERR before starting FIS reception or ST or anything */
336 	ahci_flush_tfd(ap);
337 	ahci_pwrite(ap, AHCI_PREG_SERR, -1);
338 
339 	/* Enable FIS reception and activate port. */
340 	cmd = ahci_pread(ap, AHCI_PREG_CMD) & ~AHCI_PREG_CMD_ICC;
341 	cmd &= ~(AHCI_PREG_CMD_CLO | AHCI_PREG_CMD_PMA);
342 	cmd |= AHCI_PREG_CMD_FRE | AHCI_PREG_CMD_POD | AHCI_PREG_CMD_SUD;
343 	ahci_pwrite(ap, AHCI_PREG_CMD, cmd | AHCI_PREG_CMD_ICC_ACTIVE);
344 
345 	/* Check whether port activated.  Skip it if not. */
346 	cmd = ahci_pread(ap, AHCI_PREG_CMD) & ~AHCI_PREG_CMD_ICC;
347 	if ((cmd & AHCI_PREG_CMD_FRE) == 0) {
348 		kprintf("%s: NOT-ACTIVATED\n", PORTNAME(ap));
349 		rc = ENXIO;
350 		goto freeport;
351 	}
352 
353 	/* Allocate a CCB for each command slot */
354 	ap->ap_ccbs = kmalloc(sizeof(struct ahci_ccb) * sc->sc_ncmds, M_DEVBUF,
355 			      M_WAITOK | M_ZERO);
356 	if (ap->ap_ccbs == NULL) {
357 		device_printf(sc->sc_dev,
358 			      "unable to allocate command list for port %d\n",
359 			      port);
360 		goto freeport;
361 	}
362 
363 	/* Command List Structures and Command Tables */
364 	ap->ap_dmamem_cmd_list = ahci_dmamem_alloc(sc, sc->sc_tag_cmdh);
365 	ap->ap_dmamem_cmd_table = ahci_dmamem_alloc(sc, sc->sc_tag_cmdt);
366 	if (ap->ap_dmamem_cmd_table == NULL ||
367 	    ap->ap_dmamem_cmd_list == NULL) {
368 nomem:
369 		device_printf(sc->sc_dev,
370 			      "unable to allocate DMA memory for port %d\n",
371 			      port);
372 		goto freeport;
373 	}
374 
375 	/* Setup command list base address */
376 	dva = AHCI_DMA_DVA(ap->ap_dmamem_cmd_list);
377 	ahci_pwrite(ap, AHCI_PREG_CLBU, (u_int32_t)(dva >> 32));
378 	ahci_pwrite(ap, AHCI_PREG_CLB, (u_int32_t)dva);
379 
380 	/* Split CCB allocation into CCBs and assign to command header/table */
381 	hdr = AHCI_DMA_KVA(ap->ap_dmamem_cmd_list);
382 	table = AHCI_DMA_KVA(ap->ap_dmamem_cmd_table);
383 	for (i = 0; i < sc->sc_ncmds; i++) {
384 		ccb = &ap->ap_ccbs[i];
385 
386 		error = bus_dmamap_create(sc->sc_tag_data, BUS_DMA_ALLOCNOW,
387 					  &ccb->ccb_dmamap);
388 		if (error) {
389 			device_printf(sc->sc_dev,
390 				      "unable to create dmamap for port %d "
391 				      "ccb %d\n", port, i);
392 			goto freeport;
393 		}
394 
395 		callout_init(&ccb->ccb_timeout);
396 		ccb->ccb_slot = i;
397 		ccb->ccb_port = ap;
398 		ccb->ccb_cmd_hdr = &hdr[i];
399 		ccb->ccb_cmd_table = &table[i];
400 		dva = AHCI_DMA_DVA(ap->ap_dmamem_cmd_table) +
401 		    ccb->ccb_slot * sizeof(struct ahci_cmd_table);
402 		ccb->ccb_cmd_hdr->ctba_hi = htole32((u_int32_t)(dva >> 32));
403 		ccb->ccb_cmd_hdr->ctba_lo = htole32((u_int32_t)dva);
404 
405 		ccb->ccb_xa.fis =
406 		    (struct ata_fis_h2d *)ccb->ccb_cmd_table->cfis;
407 		ccb->ccb_xa.packetcmd = ccb->ccb_cmd_table->acmd;
408 		ccb->ccb_xa.tag = i;
409 
410 		ccb->ccb_xa.state = ATA_S_COMPLETE;
411 
412 		/*
413 		 * CCB[1] is the error CCB and is not get or put.  It is
414 		 * also used for probing.  Numerous HBAs only load the
415 		 * signature from CCB[1] so it MUST be used for the second
416 		 * FIS.
417 		 */
418 		if (i == 1)
419 			ap->ap_err_ccb = ccb;
420 		else
421 			ahci_put_ccb(ccb);
422 	}
423 
424 	/*
425 	 * Wait for ICC change to complete
426 	 */
427 	ahci_pwait_clr(ap, AHCI_PREG_CMD, AHCI_PREG_CMD_ICC);
428 
429 	/*
430 	 * Calculate the interrupt mask
431 	 */
432 	data = AHCI_PREG_IE_TFEE | AHCI_PREG_IE_HBFE |
433 	       AHCI_PREG_IE_IFE | AHCI_PREG_IE_OFE |
434 	       AHCI_PREG_IE_DPE | AHCI_PREG_IE_UFE |
435 	       AHCI_PREG_IE_PCE | AHCI_PREG_IE_PRCE |
436 	       AHCI_PREG_IE_DHRE | AHCI_PREG_IE_SDBE;
437 	if (ap->ap_sc->sc_cap & AHCI_REG_CAP_SSNTF)
438 		data |= AHCI_PREG_IE_IPME;
439 #ifdef AHCI_COALESCE
440 	if (sc->sc_ccc_ports & (1 << port)
441 		data &= ~(AHCI_PREG_IE_SDBE | AHCI_PREG_IE_DHRE);
442 #endif
443 	ap->ap_intmask = data;
444 
445 	/*
446 	 * Start the port helper thread.  The helper thread will call
447 	 * ahci_port_init() so the ports can all be started in parallel.
448 	 * A failure by ahci_port_init() does not deallocate the port
449 	 * since we still want hot-plug events.
450 	 */
451 	ahci_os_start_port(ap);
452 	return(0);
453 freeport:
454 	ahci_port_free(sc, port);
455 	return (rc);
456 }
457 
458 /*
459  * [re]initialize an idle port.  No CCBs should be active.
460  *
461  * This function is called during the initial port allocation sequence
462  * and is also called on hot-plug insertion.  We take no chances and
463  * use a portreset instead of a softreset.
464  *
465  * This function is the only way to move a failed port back to active
466  * status.
467  *
468  * Returns 0 if a device is successfully detected.
469  */
470 int
471 ahci_port_init(struct ahci_port *ap)
472 {
473 	/*
474 	 * Register [re]initialization
475 	 */
476 	if (ap->ap_sc->sc_cap & AHCI_REG_CAP_SSNTF)
477 		ahci_pwrite(ap, AHCI_PREG_SNTF, -1);
478 	ap->ap_probe = ATA_PROBE_NEED_HARD_RESET;
479 	ap->ap_pmcount = 0;
480 
481 	/*
482 	 * Cycle the port before enabling its interrupt.  This makes sure
483 	 * that the CI and SACT registers are clear.  It might not be
484 	 * necesary now that we sequence the interrupt enablement properly
485 	 * but I'm keeping it in.
486 	 */
487 	ahci_port_start(ap);
488 	ahci_port_stop(ap, 0);
489 	ahci_port_interrupt_enable(ap);
490 	return (0);
491 }
492 
493 /*
494  * Enable or re-enable interrupts on a port.
495  *
496  * This routine is called from the port initialization code or from the
497  * helper thread as the real interrupt may be forced to turn off certain
498  * interrupt sources.
499  */
500 void
501 ahci_port_interrupt_enable(struct ahci_port *ap)
502 {
503 	ahci_pwrite(ap, AHCI_PREG_IE, ap->ap_intmask);
504 }
505 
506 /*
507  * Run the port / target state machine from a main context.
508  *
509  * The state machine for the port is always run.
510  *
511  * If atx is non-NULL run the state machine for a particular target.
512  * If atx is NULL run the state machine for all targets.
513  */
514 void
515 ahci_port_state_machine(struct ahci_port *ap, int initial)
516 {
517 	struct ata_port *at;
518 	u_int32_t data;
519 	int target;
520 	int didsleep;
521 	int loop;
522 
523 	/*
524 	 * State machine for port.  Note that CAM is not yet associated
525 	 * during the initial parallel probe and the port's probe state
526 	 * will not get past ATA_PROBE_NEED_IDENT.
527 	 */
528 	{
529 		if (initial == 0 && ap->ap_probe <= ATA_PROBE_NEED_HARD_RESET) {
530 			kprintf("%s: Waiting 10 seconds on insertion\n",
531 				PORTNAME(ap));
532 			ahci_os_sleep(10000);
533 			initial = 1;
534 		}
535 		if (ap->ap_probe == ATA_PROBE_NEED_INIT)
536 			ahci_port_init(ap);
537 		if (ap->ap_probe == ATA_PROBE_NEED_HARD_RESET)
538 			ahci_port_reset(ap, NULL, 1);
539 		if (ap->ap_probe == ATA_PROBE_NEED_SOFT_RESET)
540 			ahci_port_reset(ap, NULL, 0);
541 		if (ap->ap_probe == ATA_PROBE_NEED_IDENT)
542 			ahci_cam_probe(ap, NULL);
543 	}
544 	if (ap->ap_type != ATA_PORT_T_PM) {
545 		if (ap->ap_probe == ATA_PROBE_FAILED) {
546 			ahci_cam_changed(ap, NULL, 0);
547 		} else if (ap->ap_probe >= ATA_PROBE_NEED_IDENT) {
548 			ahci_cam_changed(ap, NULL, 1);
549 		}
550 		return;
551 	}
552 
553 	/*
554 	 * Port Multiplier state machine.
555 	 *
556 	 * Get a mask of changed targets and combine with any runnable
557 	 * states already present.
558 	 */
559 	for (loop = 0; ;++loop) {
560 		if (ahci_pm_read(ap, 15, SATA_PMREG_EINFO, &data)) {
561 			kprintf("%s: PM unable to read hot-plug bitmap\n",
562 				PORTNAME(ap));
563 			break;
564 		}
565 
566 		/*
567 		 * Do at least one loop, then stop if no more state changes
568 		 * have occured.  The PM might not generate a new
569 		 * notification until we clear the entire bitmap.
570 		 */
571 		if (loop && data == 0)
572 			break;
573 
574 		/*
575 		 * New devices showing up in the bitmap require some spin-up
576 		 * time before we start probing them.  Reset didsleep.  The
577 		 * first new device we detect will sleep before probing.
578 		 *
579 		 * This only applies to devices whos change bit is set in
580 		 * the data, and does not apply to the initial boot-time
581 		 * probe.
582 		 */
583 		didsleep = 0;
584 
585 		for (target = 0; target < ap->ap_pmcount; ++target) {
586 			at = ap->ap_ata[target];
587 
588 			/*
589 			 * Check the target state for targets behind the PM
590 			 * which have changed state.  This will adjust
591 			 * at_probe and set ATA_PORT_F_RESCAN
592 			 *
593 			 * We want to wait at least 10 seconds before probing
594 			 * a newly inserted device.  If the check status
595 			 * indicates a device is present and in need of a
596 			 * hard reset, we make sure we have slept before
597 			 * continuing.
598 			 *
599 			 * We also need to wait at least 1 second for the
600 			 * PHY state to change after insertion, if we
601 			 * haven't already waited the 10 seconds.
602 			 *
603 			 * NOTE: When pm_check_good finds a good port it
604 			 *	 typically starts us in probe state
605 			 *	 NEED_HARD_RESET rather than INIT.
606 			 */
607 			if (data & (1 << target)) {
608 				if (initial == 0 && didsleep == 0)
609 					ahci_os_sleep(1000);
610 				ahci_pm_check_good(ap, target);
611 				if (initial == 0 && didsleep == 0 &&
612 				    at->at_probe <= ATA_PROBE_NEED_HARD_RESET
613 				) {
614 					didsleep = 1;
615 					kprintf("%s: Waiting 10 seconds on insertion\n", PORTNAME(ap));
616 					ahci_os_sleep(10000);
617 				}
618 			}
619 
620 			/*
621 			 * Report hot-plug events before the probe state
622 			 * really gets hot.  Only actual events are reported
623 			 * here to reduce spew.
624 			 */
625 			if (data & (1 << target)) {
626 				kprintf("%s: HOTPLUG (PM) - ", ATANAME(ap, at));
627 				switch(at->at_probe) {
628 				case ATA_PROBE_NEED_INIT:
629 				case ATA_PROBE_NEED_HARD_RESET:
630 					kprintf("Device inserted\n");
631 					break;
632 				case ATA_PROBE_FAILED:
633 					kprintf("Device removed\n");
634 					break;
635 				default:
636 					kprintf("Device probe in progress\n");
637 					break;
638 				}
639 			}
640 
641 			/*
642 			 * Run through the state machine as necessary if
643 			 * the port is not marked failed.
644 			 *
645 			 * The state machine may stop at NEED_IDENT if
646 			 * CAM is not yet attached.
647 			 *
648 			 * Acquire exclusive access to the port while we
649 			 * are doing this.  This prevents command-completion
650 			 * from queueing commands for non-polled targets
651 			 * inbetween our probe steps.  We need to do this
652 			 * because the reset probes can generate severe PHY
653 			 * and protocol errors and soft-brick the port.
654 			 */
655 			if (at->at_probe != ATA_PROBE_FAILED &&
656 			    at->at_probe != ATA_PROBE_GOOD) {
657 				ahci_beg_exclusive_access(ap, at);
658 				if (at->at_probe == ATA_PROBE_NEED_INIT)
659 					ahci_pm_port_init(ap, at);
660 				if (at->at_probe == ATA_PROBE_NEED_HARD_RESET)
661 					ahci_port_reset(ap, at, 1);
662 				if (at->at_probe == ATA_PROBE_NEED_SOFT_RESET)
663 					ahci_port_reset(ap, at, 0);
664 				if (at->at_probe == ATA_PROBE_NEED_IDENT)
665 					ahci_cam_probe(ap, at);
666 				ahci_end_exclusive_access(ap, at);
667 			}
668 
669 			/*
670 			 * Add or remove from CAM
671 			 */
672 			if (at->at_features & ATA_PORT_F_RESCAN) {
673 				at->at_features &= ~ATA_PORT_F_RESCAN;
674 				if (at->at_probe == ATA_PROBE_FAILED) {
675 					ahci_cam_changed(ap, at, 0);
676 				} else if (at->at_probe >= ATA_PROBE_NEED_IDENT) {
677 					ahci_cam_changed(ap, at, 1);
678 				}
679 			}
680 			data &= ~(1 << target);
681 		}
682 		if (data) {
683 			kprintf("%s: WARNING (PM): extra bits set in "
684 				"EINFO: %08x\n", PORTNAME(ap), data);
685 			while (target < AHCI_MAX_PMPORTS) {
686 				ahci_pm_check_good(ap, target);
687 				++target;
688 			}
689 		}
690 	}
691 }
692 
693 
694 /*
695  * De-initialize and detach a port.
696  */
697 void
698 ahci_port_free(struct ahci_softc *sc, u_int port)
699 {
700 	struct ahci_port	*ap = sc->sc_ports[port];
701 	struct ahci_ccb		*ccb;
702 	int i;
703 
704 	/*
705 	 * Ensure port is disabled and its interrupts are all flushed.
706 	 */
707 	if (ap->ap_sc) {
708 		ahci_port_stop(ap, 1);
709 		ahci_os_stop_port(ap);
710 		ahci_pwrite(ap, AHCI_PREG_CMD, 0);
711 		ahci_pwrite(ap, AHCI_PREG_IE, 0);
712 		ahci_pwrite(ap, AHCI_PREG_IS, ahci_pread(ap, AHCI_PREG_IS));
713 		ahci_write(sc, AHCI_REG_IS, 1 << port);
714 	}
715 
716 	if (ap->ap_ccbs) {
717 		while ((ccb = ahci_get_ccb(ap)) != NULL) {
718 			if (ccb->ccb_dmamap) {
719 				bus_dmamap_destroy(sc->sc_tag_data,
720 						   ccb->ccb_dmamap);
721 				ccb->ccb_dmamap = NULL;
722 			}
723 		}
724 		if ((ccb = ap->ap_err_ccb) != NULL) {
725 			if (ccb->ccb_dmamap) {
726 				bus_dmamap_destroy(sc->sc_tag_data,
727 						   ccb->ccb_dmamap);
728 				ccb->ccb_dmamap = NULL;
729 			}
730 			ap->ap_err_ccb = NULL;
731 		}
732 		kfree(ap->ap_ccbs, M_DEVBUF);
733 		ap->ap_ccbs = NULL;
734 	}
735 
736 	if (ap->ap_dmamem_cmd_list) {
737 		ahci_dmamem_free(sc, ap->ap_dmamem_cmd_list);
738 		ap->ap_dmamem_cmd_list = NULL;
739 	}
740 	if (ap->ap_dmamem_rfis) {
741 		ahci_dmamem_free(sc, ap->ap_dmamem_rfis);
742 		ap->ap_dmamem_rfis = NULL;
743 	}
744 	if (ap->ap_dmamem_cmd_table) {
745 		ahci_dmamem_free(sc, ap->ap_dmamem_cmd_table);
746 		ap->ap_dmamem_cmd_table = NULL;
747 	}
748 	if (ap->ap_ata) {
749 		for (i = 0; i < AHCI_MAX_PMPORTS; ++i) {
750 			if (ap->ap_ata[i]) {
751 				kfree(ap->ap_ata[i], M_DEVBUF);
752 				ap->ap_ata[i] = NULL;
753 			}
754 		}
755 	}
756 	if (ap->ap_err_scratch) {
757 		kfree(ap->ap_err_scratch, M_DEVBUF);
758 		ap->ap_err_scratch = NULL;
759 	}
760 
761 	/* bus_space(9) says we dont free the subregions handle */
762 
763 	kfree(ap, M_DEVBUF);
764 	sc->sc_ports[port] = NULL;
765 }
766 
767 /*
768  * Start high-level command processing on the port
769  */
770 int
771 ahci_port_start(struct ahci_port *ap)
772 {
773 	u_int32_t	r, s, is, tfd;
774 
775 	/*
776 	 * FRE must be turned on before ST.  Wait for FR to go active
777 	 * before turning on ST.  The spec doesn't seem to think this
778 	 * is necessary but waiting here avoids an on-off race in the
779 	 * ahci_port_stop() code.
780 	 */
781 	r = ahci_pread(ap, AHCI_PREG_CMD);
782 	if ((r & AHCI_PREG_CMD_FRE) == 0) {
783 		r |= AHCI_PREG_CMD_FRE;
784 		ahci_pwrite(ap, AHCI_PREG_CMD, r);
785 	}
786 	if ((ap->ap_sc->sc_flags & AHCI_F_IGN_FR) == 0) {
787 		if (ahci_pwait_set(ap, AHCI_PREG_CMD, AHCI_PREG_CMD_FR)) {
788 			kprintf("%s: Cannot start FIS reception\n",
789 				PORTNAME(ap));
790 			return (2);
791 		}
792 	}
793 
794 	/*
795 	 * Turn on ST, wait for CR to come up.
796 	 */
797 	r |= AHCI_PREG_CMD_ST;
798 	ahci_pwrite(ap, AHCI_PREG_CMD, r);
799 	if (ahci_pwait_set(ap, AHCI_PREG_CMD, AHCI_PREG_CMD_CR)) {
800 		s = ahci_pread(ap, AHCI_PREG_SERR);
801 		is = ahci_pread(ap, AHCI_PREG_IS);
802 		tfd = ahci_pread(ap, AHCI_PREG_TFD);
803 		kprintf("%s: Cannot start command DMA\n"
804 			"NCMP=%b NSERR=%b\n"
805 			"NEWIS=%b\n"
806 			"NEWTFD=%b\n",
807 			PORTNAME(ap),
808 			r, AHCI_PFMT_CMD, s, AHCI_PFMT_SERR,
809 			is, AHCI_PFMT_IS,
810 			tfd, AHCI_PFMT_TFD_STS);
811 		return (1);
812 	}
813 
814 #ifdef AHCI_COALESCE
815 	/*
816 	 * (Re-)enable coalescing on the port.
817 	 */
818 	if (ap->ap_sc->sc_ccc_ports & (1 << ap->ap_num)) {
819 		ap->ap_sc->sc_ccc_ports_cur |= (1 << ap->ap_num);
820 		ahci_write(ap->ap_sc, AHCI_REG_CCC_PORTS,
821 		    ap->ap_sc->sc_ccc_ports_cur);
822 	}
823 #endif
824 
825 	return (0);
826 }
827 
828 /*
829  * Stop high-level command processing on a port
830  *
831  * WARNING!  If the port is stopped while CR is still active our saved
832  *	     CI/SACT will race any commands completed by the command
833  *	     processor prior to being able to stop.  Thus we never call
834  *	     this function unless we intend to dispose of any remaining
835  *	     active commands.  In particular, this complicates the timeout
836  *	     code.
837  */
838 int
839 ahci_port_stop(struct ahci_port *ap, int stop_fis_rx)
840 {
841 	u_int32_t	r;
842 
843 #ifdef AHCI_COALESCE
844 	/*
845 	 * Disable coalescing on the port while it is stopped.
846 	 */
847 	if (ap->ap_sc->sc_ccc_ports & (1 << ap->ap_num)) {
848 		ap->ap_sc->sc_ccc_ports_cur &= ~(1 << ap->ap_num);
849 		ahci_write(ap->ap_sc, AHCI_REG_CCC_PORTS,
850 		    ap->ap_sc->sc_ccc_ports_cur);
851 	}
852 #endif
853 
854 	/*
855 	 * Turn off ST, then wait for CR to go off.
856 	 */
857 	r = ahci_pread(ap, AHCI_PREG_CMD) & ~AHCI_PREG_CMD_ICC;
858 	r &= ~AHCI_PREG_CMD_ST;
859 	ahci_pwrite(ap, AHCI_PREG_CMD, r);
860 
861 	if (ahci_pwait_clr(ap, AHCI_PREG_CMD, AHCI_PREG_CMD_CR)) {
862 		kprintf("%s: Port bricked, unable to stop (ST)\n",
863 			PORTNAME(ap));
864 		return (1);
865 	}
866 
867 #if 0
868 	/*
869 	 * Turn off FRE, then wait for FR to go off.  FRE cannot
870 	 * be turned off until CR transitions to 0.
871 	 */
872 	if ((r & AHCI_PREG_CMD_FR) == 0) {
873 		kprintf("%s: FR stopped, clear FRE for next start\n",
874 			PORTNAME(ap));
875 		stop_fis_rx = 2;
876 	}
877 #endif
878 	if (stop_fis_rx) {
879 		r &= ~AHCI_PREG_CMD_FRE;
880 		ahci_pwrite(ap, AHCI_PREG_CMD, r);
881 		if (ahci_pwait_clr(ap, AHCI_PREG_CMD, AHCI_PREG_CMD_FR)) {
882 			kprintf("%s: Port bricked, unable to stop (FRE)\n",
883 				PORTNAME(ap));
884 			return (2);
885 		}
886 	}
887 
888 	return (0);
889 }
890 
891 /*
892  * AHCI command list override -> forcibly clear TFD.STS.{BSY,DRQ}
893  */
894 int
895 ahci_port_clo(struct ahci_port *ap)
896 {
897 	struct ahci_softc		*sc = ap->ap_sc;
898 	u_int32_t			cmd;
899 
900 	/* Only attempt CLO if supported by controller */
901 	if ((ahci_read(sc, AHCI_REG_CAP) & AHCI_REG_CAP_SCLO) == 0)
902 		return (1);
903 
904 	/* Issue CLO */
905 	cmd = ahci_pread(ap, AHCI_PREG_CMD) & ~AHCI_PREG_CMD_ICC;
906 	ahci_pwrite(ap, AHCI_PREG_CMD, cmd | AHCI_PREG_CMD_CLO);
907 
908 	/* Wait for completion */
909 	if (ahci_pwait_clr(ap, AHCI_PREG_CMD, AHCI_PREG_CMD_CLO)) {
910 		kprintf("%s: CLO did not complete\n", PORTNAME(ap));
911 		return (1);
912 	}
913 
914 	return (0);
915 }
916 
917 /*
918  * Reset a port.
919  *
920  * If hard is 0 perform a softreset of the port.
921  * If hard is 1 perform a hard reset of the port.
922  *
923  * If at is non-NULL an indirect port via a port-multiplier is being
924  * reset, otherwise a direct port is being reset.
925  *
926  * NOTE: Indirect ports can only be soft-reset.
927  */
928 int
929 ahci_port_reset(struct ahci_port *ap, struct ata_port *at, int hard)
930 {
931 	int rc;
932 
933 	if (hard) {
934 		if (at)
935 			rc = ahci_pm_hardreset(ap, at->at_target, hard);
936 		else
937 			rc = ahci_port_hardreset(ap, hard);
938 	} else {
939 		if (at)
940 			rc = ahci_pm_softreset(ap, at->at_target);
941 		else
942 			rc = ahci_port_softreset(ap);
943 	}
944 	return(rc);
945 }
946 
947 /*
948  * AHCI soft reset, Section 10.4.1
949  *
950  * (at) will be NULL when soft-resetting a directly-attached device, and
951  * non-NULL when soft-resetting a device through a port multiplier.
952  *
953  * This function keeps port communications intact and attempts to generate
954  * a reset to the connected device using device commands.
955  */
956 int
957 ahci_port_softreset(struct ahci_port *ap)
958 {
959 	struct ahci_ccb		*ccb = NULL;
960 	struct ahci_cmd_hdr	*cmd_slot;
961 	u_int8_t		*fis;
962 	int			error;
963 
964 	error = EIO;
965 
966 	if (bootverbose) {
967 		kprintf("%s: START SOFTRESET %b\n", PORTNAME(ap),
968 			ahci_pread(ap, AHCI_PREG_CMD), AHCI_PFMT_CMD);
969 	}
970 
971 	DPRINTF(AHCI_D_VERBOSE, "%s: soft reset\n", PORTNAME(ap));
972 
973 	crit_enter();
974 	ap->ap_flags |= AP_F_IN_RESET;
975 	ap->ap_state = AP_S_NORMAL;
976 
977 	/*
978 	 * Remember port state in cmd (main to restore start/stop)
979 	 *
980 	 * Idle port.
981 	 */
982 	if (ahci_port_stop(ap, 0)) {
983 		kprintf("%s: failed to stop port, cannot softreset\n",
984 			PORTNAME(ap));
985 		goto err;
986 	}
987 
988 	/*
989 	 * Request CLO if device appears hung.
990 	 */
991 	if (ahci_pread(ap, AHCI_PREG_TFD) &
992 		   (AHCI_PREG_TFD_STS_BSY | AHCI_PREG_TFD_STS_DRQ)) {
993 		ahci_port_clo(ap);
994 	}
995 
996 	/*
997 	 * This is an attempt to clear errors so a new signature will
998 	 * be latched.  It isn't working properly.  XXX
999 	 */
1000 	ahci_flush_tfd(ap);
1001 	ahci_pwrite(ap, AHCI_PREG_SERR, -1);
1002 
1003 	/* Restart port */
1004 	if (ahci_port_start(ap)) {
1005 		kprintf("%s: failed to start port, cannot softreset\n",
1006 		        PORTNAME(ap));
1007 		goto err;
1008 	}
1009 
1010 	/* Check whether CLO worked */
1011 	if (ahci_pwait_clr(ap, AHCI_PREG_TFD,
1012 			       AHCI_PREG_TFD_STS_BSY | AHCI_PREG_TFD_STS_DRQ)) {
1013 		kprintf("%s: CLO %s, need port reset\n",
1014 			PORTNAME(ap),
1015 			(ahci_read(ap->ap_sc, AHCI_REG_CAP) & AHCI_REG_CAP_SCLO)
1016 			? "failed" : "unsupported");
1017 		error = EBUSY;
1018 		goto err;
1019 	}
1020 
1021 	/*
1022 	 * Prep first D2H command with SRST feature & clear busy/reset flags
1023 	 *
1024 	 * It is unclear which other fields in the FIS are used.  Just zero
1025 	 * everything.
1026 	 *
1027 	 * NOTE!  This CCB is used for both the first and second commands.
1028 	 *	  The second command must use CCB slot 1 to properly load
1029 	 *	  the signature.
1030 	 */
1031 	ccb = ahci_get_err_ccb(ap);
1032 	ccb->ccb_xa.complete = ahci_dummy_done;
1033 	ccb->ccb_xa.flags = ATA_F_POLL | ATA_F_EXCLUSIVE;
1034 	KKASSERT(ccb->ccb_slot == 1);
1035 	ccb->ccb_xa.at = NULL;
1036 	cmd_slot = ccb->ccb_cmd_hdr;
1037 
1038 	fis = ccb->ccb_cmd_table->cfis;
1039 	bzero(fis, sizeof(ccb->ccb_cmd_table->cfis));
1040 	fis[0] = ATA_FIS_TYPE_H2D;
1041 	fis[15] = ATA_FIS_CONTROL_SRST|ATA_FIS_CONTROL_4BIT;
1042 
1043 	cmd_slot->prdtl = 0;
1044 	cmd_slot->flags = htole16(5);	/* FIS length: 5 DWORDS */
1045 	cmd_slot->flags |= htole16(AHCI_CMD_LIST_FLAG_C); /* Clear busy on OK */
1046 	cmd_slot->flags |= htole16(AHCI_CMD_LIST_FLAG_R); /* Reset */
1047 
1048 	ccb->ccb_xa.state = ATA_S_PENDING;
1049 
1050 	if (ahci_poll(ccb, 1000, ahci_quick_timeout) != ATA_S_COMPLETE) {
1051 		kprintf("%s: First FIS failed\n", PORTNAME(ap));
1052 		goto err;
1053 	}
1054 
1055 	/*
1056 	 * WARNING!	TIME SENSITIVE SPACE!	WARNING!
1057 	 *
1058 	 * The two FISes are supposed to be back to back.  Don't issue other
1059 	 * commands or even delay if we can help it.
1060 	 */
1061 
1062 	/*
1063 	 * Prep second D2H command to read status and complete reset sequence
1064 	 * AHCI 10.4.1 and "Serial ATA Revision 2.6".  I can't find the ATA
1065 	 * Rev 2.6 and it is unclear how the second FIS should be set up
1066 	 * from the AHCI document.
1067 	 *
1068 	 * Give the device 3ms before sending the second FIS.
1069 	 *
1070 	 * It is unclear which other fields in the FIS are used.  Just zero
1071 	 * everything.
1072 	 */
1073 	ccb->ccb_xa.flags = ATA_F_POLL | ATA_F_AUTOSENSE | ATA_F_EXCLUSIVE;
1074 
1075 	bzero(fis, sizeof(ccb->ccb_cmd_table->cfis));
1076 	fis[0] = ATA_FIS_TYPE_H2D;
1077 	fis[15] = ATA_FIS_CONTROL_4BIT;
1078 
1079 	cmd_slot->prdtl = 0;
1080 	cmd_slot->flags = htole16(5);	/* FIS length: 5 DWORDS */
1081 
1082 	ccb->ccb_xa.state = ATA_S_PENDING;
1083 	if (ahci_poll(ccb, 1000, ahci_quick_timeout) != ATA_S_COMPLETE) {
1084 		kprintf("%s: Second FIS failed\n", PORTNAME(ap));
1085 		goto err;
1086 	}
1087 
1088 	if (ahci_pwait_clr(ap, AHCI_PREG_TFD,
1089 			    AHCI_PREG_TFD_STS_BSY | AHCI_PREG_TFD_STS_DRQ)) {
1090 		kprintf("%s: device didn't come ready after reset, TFD: 0x%b\n",
1091 			PORTNAME(ap),
1092 			ahci_pread(ap, AHCI_PREG_TFD), AHCI_PFMT_TFD_STS);
1093 		error = EBUSY;
1094 		goto err;
1095 	}
1096 	ahci_os_sleep(10);
1097 
1098 	/*
1099 	 * If the softreset is trying to clear a BSY condition after a
1100 	 * normal portreset we assign the port type.
1101 	 *
1102 	 * If the softreset is being run first as part of the ccb error
1103 	 * processing code then report if the device signature changed
1104 	 * unexpectedly.
1105 	 */
1106 	if (ap->ap_type == ATA_PORT_T_NONE) {
1107 		ap->ap_type = ahci_port_signature_detect(ap, NULL);
1108 	} else {
1109 		if (ahci_port_signature_detect(ap, NULL) != ap->ap_type) {
1110 			kprintf("%s: device signature unexpectedly "
1111 				"changed\n", PORTNAME(ap));
1112 			error = EBUSY; /* XXX */
1113 		}
1114 	}
1115 	error = 0;
1116 
1117 	ahci_os_sleep(3);
1118 err:
1119 	if (ccb != NULL) {
1120 		ahci_put_err_ccb(ccb);
1121 
1122 		/*
1123 		 * If the target is busy use CLO to clear the busy
1124 		 * condition.  The BSY should be cleared on the next
1125 		 * start.
1126 		 */
1127 		if (ahci_pread(ap, AHCI_PREG_TFD) &
1128 		    (AHCI_PREG_TFD_STS_BSY | AHCI_PREG_TFD_STS_DRQ)) {
1129 			ahci_port_clo(ap);
1130 		}
1131 	}
1132 
1133 	/*
1134 	 * If we failed to softreset make the port quiescent, otherwise
1135 	 * make sure the port's start/stop state matches what it was on
1136 	 * entry.
1137 	 *
1138 	 * Don't kill the port if the softreset is on a port multiplier
1139 	 * target, that would kill all the targets!
1140 	 */
1141 	if (error) {
1142 		ahci_port_hardstop(ap);
1143 		/* ap_probe set to failed */
1144 	} else {
1145 		ap->ap_probe = ATA_PROBE_NEED_IDENT;
1146 		ap->ap_pmcount = 1;
1147 		ahci_port_start(ap);
1148 	}
1149 	ap->ap_flags &= ~AP_F_IN_RESET;
1150 	crit_exit();
1151 
1152 	if (bootverbose)
1153 		kprintf("%s: END SOFTRESET\n", PORTNAME(ap));
1154 
1155 	return (error);
1156 }
1157 
1158 /*
1159  * AHCI port reset, Section 10.4.2
1160  *
1161  * This function does a hard reset of the port.  Note that the device
1162  * connected to the port could still end-up hung.
1163  */
1164 int
1165 ahci_port_hardreset(struct ahci_port *ap, int hard)
1166 {
1167 	u_int32_t cmd, r;
1168 	u_int32_t data;
1169 	int	error;
1170 	int	loop;
1171 
1172 	if (bootverbose)
1173 		kprintf("%s: START HARDRESET\n", PORTNAME(ap));
1174 	ap->ap_flags |= AP_F_IN_RESET;
1175 
1176 	/*
1177 	 * Idle the port,
1178 	 */
1179 	ahci_port_stop(ap, 0);
1180 	ap->ap_state = AP_S_NORMAL;
1181 
1182 	/*
1183 	 * The port may have been quiescent with its SUD bit cleared, so
1184 	 * set the SUD (spin up device).
1185 	 */
1186 	cmd = ahci_pread(ap, AHCI_PREG_CMD) & ~AHCI_PREG_CMD_ICC;
1187 	cmd |= AHCI_PREG_CMD_SUD;
1188 	ahci_pwrite(ap, AHCI_PREG_CMD, cmd);
1189 
1190 	/*
1191 	 * Perform device detection.
1192 	 *
1193 	 * NOTE!  AHCi_PREG_SCTL_DET_DISABLE seems to be highly unreliable
1194 	 *	  on multiple chipsets and can brick the chipset or even
1195 	 *	  the whole PC.  Never use it.
1196 	 */
1197 	ap->ap_type = ATA_PORT_T_NONE;
1198 
1199 	r = AHCI_PREG_SCTL_IPM_DISABLED;
1200 	ahci_pwrite(ap, AHCI_PREG_SCTL, r);
1201 	ahci_os_sleep(10);
1202 
1203 	/*
1204 	 * Start transmitting COMRESET.  COMRESET must be sent for at
1205 	 * least 1ms.
1206 	 */
1207 	r = AHCI_PREG_SCTL_IPM_DISABLED | AHCI_PREG_SCTL_DET_INIT;
1208 	if (AhciForceGen1 & (1 << ap->ap_num))
1209 		r |= AHCI_PREG_SCTL_SPD_GEN1;
1210 	else
1211 		r |= AHCI_PREG_SCTL_SPD_ANY;
1212 	ahci_pwrite(ap, AHCI_PREG_SCTL, r);
1213 
1214 	/*
1215 	 * Through trial and error it seems to take around 100ms
1216 	 * for the detect logic to settle down.  If this is too
1217 	 * short the softreset code will fail.
1218 	 */
1219 	ahci_os_sleep(100);
1220 
1221 	/*
1222 	 * Only SERR_DIAG_X needs to be cleared for TFD updates, but
1223 	 * since we are hard-resetting the port we might as well clear
1224 	 * the whole enchillada
1225 	 */
1226 	ahci_flush_tfd(ap);
1227 	ahci_pwrite(ap, AHCI_PREG_SERR, -1);
1228 	r &= ~AHCI_PREG_SCTL_DET_INIT;
1229 	r |= AHCI_PREG_SCTL_DET_NONE;
1230 	ahci_pwrite(ap, AHCI_PREG_SCTL, r);
1231 
1232 	/*
1233 	 * Try to determine if there is a device on the port.
1234 	 *
1235 	 * Give the device 3/10 second to at least be detected.
1236 	 * If we fail clear PRCS (phy detect) since we may cycled
1237 	 * the phy and probably caused another PRCS interrupt.
1238 	 */
1239 	loop = 300;
1240 	while (loop > 0) {
1241 		r = ahci_pread(ap, AHCI_PREG_SSTS);
1242 		if (r & AHCI_PREG_SSTS_DET)
1243 			break;
1244 		loop -= ahci_os_softsleep();
1245 	}
1246 	if (loop == 0) {
1247 		ahci_pwrite(ap, AHCI_PREG_IS, AHCI_PREG_IS_PRCS);
1248 		if (bootverbose) {
1249 			kprintf("%s: Port appears to be unplugged\n",
1250 				PORTNAME(ap));
1251 		}
1252 		error = ENODEV;
1253 		goto done;
1254 	}
1255 
1256 	/*
1257 	 * There is something on the port.  Give the device 3 seconds
1258 	 * to fully negotiate.
1259 	 */
1260 	if (ahci_pwait_eq(ap, 3000, AHCI_PREG_SSTS,
1261 			  AHCI_PREG_SSTS_DET, AHCI_PREG_SSTS_DET_DEV)) {
1262 		if (bootverbose) {
1263 			kprintf("%s: Device may be powered down\n",
1264 				PORTNAME(ap));
1265 		}
1266 		error = ENODEV;
1267 		goto pmdetect;
1268 	}
1269 
1270 	/*
1271 	 * We got something that definitely looks like a device.  Give
1272 	 * the device time to send us its first D2H FIS.  Waiting for
1273 	 * BSY to clear accomplishes this.
1274 	 *
1275 	 * NOTE that a port multiplier may or may not clear BSY here,
1276 	 * depending on what is sitting in target 0 behind it.
1277 	 */
1278 	ahci_flush_tfd(ap);
1279 
1280 	if (ahci_pwait_clr_to(ap, 3000, AHCI_PREG_TFD,
1281 			    AHCI_PREG_TFD_STS_BSY | AHCI_PREG_TFD_STS_DRQ)) {
1282 		error = EBUSY;
1283 	} else {
1284 		error = 0;
1285 	}
1286 
1287 pmdetect:
1288 	/*
1289 	 * Do the PM port probe regardless of how things turned out on
1290 	 * the BSY check.
1291 	 */
1292 	if (ap->ap_sc->sc_cap & AHCI_REG_CAP_SPM)
1293 		error = ahci_pm_port_probe(ap, error);
1294 
1295 done:
1296 	/*
1297 	 * Finish up.
1298 	 */
1299 	switch(error) {
1300 	case 0:
1301 		/*
1302 		 * All good, make sure the port is running and set the
1303 		 * probe state.  Ignore the signature junk (it's unreliable)
1304 		 * until we get to the softreset code.
1305 		 */
1306 		if (ahci_port_start(ap)) {
1307 			kprintf("%s: failed to start command DMA on port, "
1308 			        "disabling\n", PORTNAME(ap));
1309 			error = EBUSY;
1310 			goto done;
1311 		}
1312 		if (ap->ap_type == ATA_PORT_T_PM)
1313 			ap->ap_probe = ATA_PROBE_GOOD;
1314 		else
1315 			ap->ap_probe = ATA_PROBE_NEED_SOFT_RESET;
1316 		break;
1317 	case ENODEV:
1318 		/*
1319 		 * Normal device probe failure
1320 		 */
1321 		data = ahci_pread(ap, AHCI_PREG_SSTS);
1322 
1323 		switch(data & AHCI_PREG_SSTS_DET) {
1324 		case AHCI_PREG_SSTS_DET_DEV_NE:
1325 			kprintf("%s: Device not communicating\n",
1326 				PORTNAME(ap));
1327 			break;
1328 		case AHCI_PREG_SSTS_DET_PHYOFFLINE:
1329 			kprintf("%s: PHY offline\n",
1330 				PORTNAME(ap));
1331 			break;
1332 		default:
1333 			kprintf("%s: No device detected\n",
1334 				PORTNAME(ap));
1335 			break;
1336 		}
1337 		ahci_port_hardstop(ap);
1338 		break;
1339 	default:
1340 		/*
1341 		 * Abnormal probe (EBUSY)
1342 		 */
1343 		kprintf("%s: Device on port is bricked\n",
1344 			PORTNAME(ap));
1345 		ahci_port_hardstop(ap);
1346 #if 0
1347 		rc = ahci_port_reset(ap, atx, 0);
1348 		if (rc) {
1349 			kprintf("%s: Unable unbrick device\n",
1350 				PORTNAME(ap));
1351 		} else {
1352 			kprintf("%s: Successfully unbricked\n",
1353 				PORTNAME(ap));
1354 		}
1355 #endif
1356 		break;
1357 	}
1358 
1359 	/*
1360 	 * Clean up
1361 	 */
1362 	ahci_pwrite(ap, AHCI_PREG_SERR, -1);
1363 	ahci_pwrite(ap, AHCI_PREG_IS, AHCI_PREG_IS_PCS | AHCI_PREG_IS_PRCS);
1364 
1365 	ap->ap_flags &= ~AP_F_IN_RESET;
1366 
1367 	if (bootverbose)
1368 		kprintf("%s: END HARDRESET %d\n", PORTNAME(ap), error);
1369 	return (error);
1370 }
1371 
1372 /*
1373  * Hard-stop on hot-swap device removal.  See 10.10.1
1374  *
1375  * Place the port in a mode that will allow it to detect hot-swap insertions.
1376  * This is a bit imprecise because just setting-up SCTL to DET_INIT doesn't
1377  * seem to do the job.
1378  */
1379 void
1380 ahci_port_hardstop(struct ahci_port *ap)
1381 {
1382 	struct ahci_ccb *ccb;
1383 	struct ata_port *at;
1384 	u_int32_t r;
1385 	u_int32_t cmd;
1386 	int slot;
1387 	int i;
1388 
1389 	/*
1390 	 * Stop the port.  We can't modify things like SUD if the port
1391 	 * is running.
1392 	 */
1393 	ap->ap_state = AP_S_FATAL_ERROR;
1394 	ap->ap_probe = ATA_PROBE_FAILED;
1395 	ap->ap_type = ATA_PORT_T_NONE;
1396 	ahci_port_stop(ap, 0);
1397 	cmd = ahci_pread(ap, AHCI_PREG_CMD);
1398 
1399 	/*
1400 	 * Clean up AT sub-ports on SATA port.
1401 	 */
1402 	for (i = 0; ap->ap_ata && i < AHCI_MAX_PMPORTS; ++i) {
1403 		at = ap->ap_ata[i];
1404 		at->at_type = ATA_PORT_T_NONE;
1405 		at->at_probe = ATA_PROBE_FAILED;
1406 	}
1407 
1408 	/*
1409 	 * Turn off port-multiplier control bit
1410 	 */
1411 	if (cmd & AHCI_PREG_CMD_PMA) {
1412 		cmd &= ~AHCI_PREG_CMD_PMA;
1413 		ahci_pwrite(ap, AHCI_PREG_CMD, cmd);
1414 	}
1415 
1416 	/*
1417 	 * Make sure FRE is active.  There isn't anything we can do if it
1418 	 * fails so just ignore errors.
1419 	 */
1420 	if ((cmd & AHCI_PREG_CMD_FRE) == 0) {
1421 		cmd |= AHCI_PREG_CMD_FRE;
1422 		ahci_pwrite(ap, AHCI_PREG_CMD, cmd);
1423 		if ((ap->ap_sc->sc_flags & AHCI_F_IGN_FR) == 0)
1424 			ahci_pwait_set(ap, AHCI_PREG_CMD, AHCI_PREG_CMD_FR);
1425 	}
1426 
1427 	/*
1428 	 * 10.10.3 DET must be set to 0 before setting SUD to 0.
1429 	 * 10.10.1 place us in the Listen state.
1430 	 *
1431 	 * Deactivating SUD only applies if the controller supports SUD.
1432 	 */
1433 	ahci_pwrite(ap, AHCI_PREG_SCTL, AHCI_PREG_SCTL_IPM_DISABLED);
1434 	ahci_os_sleep(1);
1435 	if (cmd & AHCI_PREG_CMD_SUD) {
1436 		cmd &= ~AHCI_PREG_CMD_SUD;
1437 		ahci_pwrite(ap, AHCI_PREG_CMD, cmd);
1438 	}
1439 	ahci_os_sleep(1);
1440 
1441 	/*
1442 	 * Transition su to the spin-up state.  HVA shall send COMRESET and
1443 	 * begin initialization sequence (whatever that means).
1444 	 *
1445 	 * This only applies if the controller supports SUD.
1446 	 * NEVER use AHCI_PREG_DET_DISABLE.
1447 	 */
1448 	cmd |= AHCI_PREG_CMD_SUD;
1449 	ahci_pwrite(ap, AHCI_PREG_CMD, cmd);
1450 	ahci_os_sleep(1);
1451 
1452 	/*
1453 	 * Transition us to the Reset state.  Theoretically we send a
1454 	 * continuous stream of COMRESETs in this state.
1455 	 */
1456 	r = AHCI_PREG_SCTL_IPM_DISABLED | AHCI_PREG_SCTL_DET_INIT;
1457 	if (AhciForceGen1 & (1 << ap->ap_num)) {
1458 		kprintf("%s: Force 1.5Gbits\n", PORTNAME(ap));
1459 		r |= AHCI_PREG_SCTL_SPD_GEN1;
1460 	} else {
1461 		r |= AHCI_PREG_SCTL_SPD_ANY;
1462 	}
1463 	ahci_pwrite(ap, AHCI_PREG_SCTL, r);
1464 	ahci_os_sleep(1);
1465 
1466 	/*
1467 	 * Flush SERR_DIAG_X so the TFD can update.
1468 	 */
1469 	ahci_flush_tfd(ap);
1470 
1471 	/*
1472 	 * Clean out pending ccbs
1473 	 */
1474 	while (ap->ap_active) {
1475 		slot = ffs(ap->ap_active) - 1;
1476 		ap->ap_active &= ~(1 << slot);
1477 		ap->ap_expired &= ~(1 << slot);
1478 		--ap->ap_active_cnt;
1479 		ccb = &ap->ap_ccbs[slot];
1480 		if (ccb->ccb_xa.flags & ATA_F_TIMEOUT_RUNNING) {
1481 			callout_stop(&ccb->ccb_timeout);
1482 			ccb->ccb_xa.flags &= ~ATA_F_TIMEOUT_RUNNING;
1483 		}
1484 		ccb->ccb_xa.flags &= ~(ATA_F_TIMEOUT_DESIRED |
1485 				       ATA_F_TIMEOUT_EXPIRED);
1486 		ccb->ccb_xa.state = ATA_S_TIMEOUT;
1487 		ccb->ccb_done(ccb);
1488 		ccb->ccb_xa.complete(&ccb->ccb_xa);
1489 	}
1490 	while (ap->ap_sactive) {
1491 		slot = ffs(ap->ap_sactive) - 1;
1492 		ap->ap_sactive &= ~(1 << slot);
1493 		ap->ap_expired &= ~(1 << slot);
1494 		ccb = &ap->ap_ccbs[slot];
1495 		if (ccb->ccb_xa.flags & ATA_F_TIMEOUT_RUNNING) {
1496 			callout_stop(&ccb->ccb_timeout);
1497 			ccb->ccb_xa.flags &= ~ATA_F_TIMEOUT_RUNNING;
1498 		}
1499 		ccb->ccb_xa.flags &= ~(ATA_F_TIMEOUT_DESIRED |
1500 				       ATA_F_TIMEOUT_EXPIRED);
1501 		ccb->ccb_xa.state = ATA_S_TIMEOUT;
1502 		ccb->ccb_done(ccb);
1503 		ccb->ccb_xa.complete(&ccb->ccb_xa);
1504 	}
1505 	KKASSERT(ap->ap_active_cnt == 0);
1506 
1507 	while ((ccb = TAILQ_FIRST(&ap->ap_ccb_pending)) != NULL) {
1508 		TAILQ_REMOVE(&ap->ap_ccb_pending, ccb, ccb_entry);
1509 		ccb->ccb_xa.state = ATA_S_TIMEOUT;
1510 		ccb->ccb_xa.flags &= ~ATA_F_TIMEOUT_DESIRED;
1511 		ccb->ccb_done(ccb);
1512 		ccb->ccb_xa.complete(&ccb->ccb_xa);
1513 	}
1514 
1515 	/*
1516 	 * Leave us in COMRESET (both SUD and INIT active), the HBA should
1517 	 * hopefully send us a DIAG_X-related interrupt if it receives
1518 	 * a COMINIT, and if not that then at least a Phy transition
1519 	 * interrupt.
1520 	 *
1521 	 * If we transition INIT from 1->0 to begin the initalization
1522 	 * sequence it is unclear if that sequence will remain active
1523 	 * until the next device insertion.
1524 	 *
1525 	 * If we go back to the listen state it is unclear if the
1526 	 * device will actually send us a COMINIT, since we aren't
1527 	 * sending any COMRESET's
1528 	 */
1529 	/* NOP */
1530 }
1531 
1532 /*
1533  * We can't loop on the X bit, a continuous COMINIT received will make
1534  * it loop forever.  Just assume one event has built up and clear X
1535  * so the task file descriptor can update.
1536  */
1537 void
1538 ahci_flush_tfd(struct ahci_port *ap)
1539 {
1540 	u_int32_t r;
1541 
1542 	r = ahci_pread(ap, AHCI_PREG_SERR);
1543 	if (r & AHCI_PREG_SERR_DIAG_X)
1544 		ahci_pwrite(ap, AHCI_PREG_SERR, AHCI_PREG_SERR_DIAG_X);
1545 }
1546 
1547 /*
1548  * Figure out what type of device is connected to the port, ATAPI or
1549  * DISK.
1550  */
1551 int
1552 ahci_port_signature_detect(struct ahci_port *ap, struct ata_port *at)
1553 {
1554 	u_int32_t sig;
1555 
1556 	sig = ahci_pread(ap, AHCI_PREG_SIG);
1557 	if (bootverbose)
1558 		kprintf("%s: sig %08x\n", ATANAME(ap, at), sig);
1559 	if ((sig & 0xffff0000) == (SATA_SIGNATURE_ATAPI & 0xffff0000)) {
1560 		return(ATA_PORT_T_ATAPI);
1561 	} else if ((sig & 0xffff0000) ==
1562 		 (SATA_SIGNATURE_PORT_MULTIPLIER & 0xffff0000)) {
1563 		return(ATA_PORT_T_PM);
1564 	} else {
1565 		return(ATA_PORT_T_DISK);
1566 	}
1567 }
1568 
1569 /*
1570  * Load the DMA descriptor table for a CCB's buffer.
1571  */
1572 int
1573 ahci_load_prdt(struct ahci_ccb *ccb)
1574 {
1575 	struct ahci_port		*ap = ccb->ccb_port;
1576 	struct ahci_softc		*sc = ap->ap_sc;
1577 	struct ata_xfer			*xa = &ccb->ccb_xa;
1578 	struct ahci_prdt		*prdt = ccb->ccb_cmd_table->prdt;
1579 	bus_dmamap_t			dmap = ccb->ccb_dmamap;
1580 	struct ahci_cmd_hdr		*cmd_slot = ccb->ccb_cmd_hdr;
1581 	int				error;
1582 
1583 	if (xa->datalen == 0) {
1584 		ccb->ccb_cmd_hdr->prdtl = 0;
1585 		return (0);
1586 	}
1587 
1588 	error = bus_dmamap_load(sc->sc_tag_data, dmap,
1589 				xa->data, xa->datalen,
1590 				ahci_load_prdt_callback,
1591 				&prdt,
1592 				((xa->flags & ATA_F_NOWAIT) ?
1593 				    BUS_DMA_NOWAIT : BUS_DMA_WAITOK));
1594 	if (error != 0) {
1595 		kprintf("%s: error %d loading dmamap\n", PORTNAME(ap), error);
1596 		return (1);
1597 	}
1598 #if 0
1599 	if (xa->flags & ATA_F_PIO)
1600 		prdt->flags |= htole32(AHCI_PRDT_FLAG_INTR);
1601 #endif
1602 
1603 	cmd_slot->prdtl = htole16(prdt - ccb->ccb_cmd_table->prdt + 1);
1604 
1605 	if (xa->flags & ATA_F_READ)
1606 		bus_dmamap_sync(sc->sc_tag_data, dmap, BUS_DMASYNC_PREREAD);
1607 	if (xa->flags & ATA_F_WRITE)
1608 		bus_dmamap_sync(sc->sc_tag_data, dmap, BUS_DMASYNC_PREWRITE);
1609 
1610 	return (0);
1611 }
1612 
1613 /*
1614  * Callback from BUSDMA system to load the segment list.  The passed segment
1615  * list is a temporary structure.
1616  */
1617 static
1618 void
1619 ahci_load_prdt_callback(void *info, bus_dma_segment_t *segs, int nsegs,
1620 			int error)
1621 {
1622 	struct ahci_prdt *prd = *(void **)info;
1623 	u_int64_t addr;
1624 
1625 	KKASSERT(nsegs <= AHCI_MAX_PRDT);
1626 
1627 	while (nsegs) {
1628 		addr = segs->ds_addr;
1629 		prd->dba_hi = htole32((u_int32_t)(addr >> 32));
1630 		prd->dba_lo = htole32((u_int32_t)addr);
1631 		prd->flags = htole32(segs->ds_len - 1);
1632 		--nsegs;
1633 		if (nsegs)
1634 			++prd;
1635 		++segs;
1636 	}
1637 	*(void **)info = prd;	/* return last valid segment */
1638 }
1639 
1640 void
1641 ahci_unload_prdt(struct ahci_ccb *ccb)
1642 {
1643 	struct ahci_port		*ap = ccb->ccb_port;
1644 	struct ahci_softc		*sc = ap->ap_sc;
1645 	struct ata_xfer			*xa = &ccb->ccb_xa;
1646 	bus_dmamap_t			dmap = ccb->ccb_dmamap;
1647 
1648 	if (xa->datalen != 0) {
1649 		if (xa->flags & ATA_F_READ) {
1650 			bus_dmamap_sync(sc->sc_tag_data, dmap,
1651 					BUS_DMASYNC_POSTREAD);
1652 		}
1653 		if (xa->flags & ATA_F_WRITE) {
1654 			bus_dmamap_sync(sc->sc_tag_data, dmap,
1655 					BUS_DMASYNC_POSTWRITE);
1656 		}
1657 		bus_dmamap_unload(sc->sc_tag_data, dmap);
1658 
1659 		/*
1660 		 * prdbc is only updated by hardware for non-NCQ commands.
1661 		 */
1662 		if (ccb->ccb_xa.flags & ATA_F_NCQ) {
1663 			xa->resid = 0;
1664 		} else {
1665 			if (ccb->ccb_cmd_hdr->prdbc == 0 &&
1666 			    ccb->ccb_xa.state == ATA_S_COMPLETE) {
1667 				kprintf("%s: WARNING!  Unload prdbc resid "
1668 					"was zero! tag=%d\n",
1669 					ATANAME(ap, xa->at), ccb->ccb_slot);
1670 			}
1671 			xa->resid = xa->datalen -
1672 			    le32toh(ccb->ccb_cmd_hdr->prdbc);
1673 		}
1674 	}
1675 }
1676 
1677 /*
1678  * Start a command and poll for completion.
1679  *
1680  * timeout is in ms and only counts once the command gets on-chip.
1681  *
1682  * Returns ATA_S_* state, compare against ATA_S_COMPLETE to determine
1683  * that no error occured.
1684  *
1685  * NOTE: If the caller specifies a NULL timeout function the caller is
1686  *	 responsible for clearing hardware state on failure, but we will
1687  *	 deal with removing the ccb from any pending queue.
1688  *
1689  * NOTE: NCQ should never be used with this function.
1690  *
1691  * NOTE: If the port is in a failed state and stopped we do not try
1692  *	 to activate the ccb.
1693  */
1694 int
1695 ahci_poll(struct ahci_ccb *ccb, int timeout,
1696 	  void (*timeout_fn)(struct ahci_ccb *))
1697 {
1698 	struct ahci_port *ap = ccb->ccb_port;
1699 
1700 	if (ccb->ccb_port->ap_state == AP_S_FATAL_ERROR) {
1701 		ccb->ccb_xa.state = ATA_S_ERROR;
1702 		return(ccb->ccb_xa.state);
1703 	}
1704 	crit_enter();
1705 #if 0
1706 	kprintf("%s: Start command %02x tag=%d\n",
1707 		ATANAME(ccb->ccb_port, ccb->ccb_xa.at),
1708 		ccb->ccb_xa.fis->command, ccb->ccb_slot);
1709 #endif
1710 	ahci_start(ccb);
1711 
1712 	do {
1713 		ahci_port_intr(ap, 1);
1714 		switch(ccb->ccb_xa.state) {
1715 		case ATA_S_ONCHIP:
1716 			timeout -= ahci_os_softsleep();
1717 			break;
1718 		case ATA_S_PENDING:
1719 			ahci_os_softsleep();
1720 			ahci_check_active_timeouts(ap);
1721 			break;
1722 		default:
1723 			crit_exit();
1724 			return (ccb->ccb_xa.state);
1725 		}
1726 	} while (timeout > 0);
1727 
1728 	kprintf("%s: Poll timeout slot %d CMD: %b TFD: 0x%b SERR: %b\n",
1729 		ATANAME(ap, ccb->ccb_xa.at), ccb->ccb_slot,
1730 		ahci_pread(ap, AHCI_PREG_CMD), AHCI_PFMT_CMD,
1731 		ahci_pread(ap, AHCI_PREG_TFD), AHCI_PFMT_TFD_STS,
1732 		ahci_pread(ap, AHCI_PREG_SERR), AHCI_PFMT_SERR);
1733 
1734 	timeout_fn(ccb);
1735 
1736 	crit_exit();
1737 
1738 	return(ccb->ccb_xa.state);
1739 }
1740 
1741 /*
1742  * When polling we have to check if the currently active CCB(s)
1743  * have timed out as the callout will be deadlocked while we
1744  * hold the port lock.
1745  */
1746 void
1747 ahci_check_active_timeouts(struct ahci_port *ap)
1748 {
1749 	struct ahci_ccb *ccb;
1750 	u_int32_t mask;
1751 	int tag;
1752 
1753 	mask = ap->ap_active | ap->ap_sactive;
1754 	while (mask) {
1755 		tag = ffs(mask) - 1;
1756 		mask &= ~(1 << tag);
1757 		ccb = &ap->ap_ccbs[tag];
1758 		if (ccb->ccb_xa.flags & ATA_F_TIMEOUT_EXPIRED) {
1759 			ahci_ata_cmd_timeout(ccb);
1760 		}
1761 	}
1762 }
1763 
1764 static
1765 __inline
1766 void
1767 ahci_start_timeout(struct ahci_ccb *ccb)
1768 {
1769 	if (ccb->ccb_xa.flags & ATA_F_TIMEOUT_DESIRED) {
1770 		ccb->ccb_xa.flags |= ATA_F_TIMEOUT_RUNNING;
1771 		callout_reset(&ccb->ccb_timeout,
1772 			      (ccb->ccb_xa.timeout * hz + 999) / 1000,
1773 			      ahci_ata_cmd_timeout_unserialized, ccb);
1774 	}
1775 }
1776 
1777 void
1778 ahci_start(struct ahci_ccb *ccb)
1779 {
1780 	struct ahci_port		*ap = ccb->ccb_port;
1781 	struct ahci_softc		*sc = ap->ap_sc;
1782 
1783 	KKASSERT(ccb->ccb_xa.state == ATA_S_PENDING);
1784 
1785 	/* Zero transferred byte count before transfer */
1786 	ccb->ccb_cmd_hdr->prdbc = 0;
1787 
1788 	/* Sync command list entry and corresponding command table entry */
1789 	bus_dmamap_sync(sc->sc_tag_cmdh,
1790 			AHCI_DMA_MAP(ap->ap_dmamem_cmd_list),
1791 			BUS_DMASYNC_PREWRITE);
1792 	bus_dmamap_sync(sc->sc_tag_cmdt,
1793 			AHCI_DMA_MAP(ap->ap_dmamem_cmd_table),
1794 			BUS_DMASYNC_PREWRITE);
1795 
1796 	/* Prepare RFIS area for write by controller */
1797 	bus_dmamap_sync(sc->sc_tag_rfis,
1798 			AHCI_DMA_MAP(ap->ap_dmamem_rfis),
1799 			BUS_DMASYNC_PREREAD);
1800 
1801 	/*
1802 	 * There's no point trying to optimize this, it only shaves a few
1803 	 * nanoseconds so just queue the command and call our generic issue.
1804 	 */
1805 	ahci_issue_pending_commands(ap, ccb);
1806 }
1807 
1808 /*
1809  * While holding the port lock acquire exclusive access to the port.
1810  *
1811  * This is used when running the state machine to initialize and identify
1812  * targets over a port multiplier.  Setting exclusive access prevents
1813  * ahci_port_intr() from activating any requests sitting on the pending
1814  * queue.
1815  */
1816 void
1817 ahci_beg_exclusive_access(struct ahci_port *ap, struct ata_port *at)
1818 {
1819 	KKASSERT((ap->ap_flags & AP_F_EXCLUSIVE_ACCESS) == 0);
1820 	ap->ap_flags |= AP_F_EXCLUSIVE_ACCESS;
1821 	while (ap->ap_active || ap->ap_sactive) {
1822 		ahci_port_intr(ap, 1);
1823 		ahci_os_softsleep();
1824 	}
1825 }
1826 
1827 void
1828 ahci_end_exclusive_access(struct ahci_port *ap, struct ata_port *at)
1829 {
1830 	KKASSERT((ap->ap_flags & AP_F_EXCLUSIVE_ACCESS) != 0);
1831 	ap->ap_flags &= ~AP_F_EXCLUSIVE_ACCESS;
1832 	ahci_issue_pending_commands(ap, NULL);
1833 }
1834 
1835 #if 0
1836 
1837 static void
1838 fubar(struct ahci_ccb *ccb)
1839 {
1840 	struct ahci_port *ap = ccb->ccb_port;
1841 	struct ahci_cmd_hdr	*cmd;
1842 	struct ahci_cmd_table	*tab;
1843 	struct ahci_prdt	*prdt;
1844 	int i;
1845 
1846 	kprintf("%s: ISSUE %02x\n",
1847 		ATANAME(ap, ccb->ccb_xa.at),
1848 		ccb->ccb_xa.fis->command);
1849 	cmd = ccb->ccb_cmd_hdr;
1850 	tab = ccb->ccb_cmd_table;
1851 	prdt = ccb->ccb_cmd_table->prdt;
1852 	kprintf("cmd flags=%04x prdtl=%d prdbc=%d ctba=%08x%08x\n",
1853 		cmd->flags, cmd->prdtl, cmd->prdbc,
1854 		cmd->ctba_hi, cmd->ctba_lo);
1855 	for (i = 0; i < cmd->prdtl; ++i) {
1856 		kprintf("\t%d dba=%08x%08x res=%08x flags=%08x\n",
1857 			i, prdt->dba_hi, prdt->dba_lo, prdt->reserved,
1858 			prdt->flags);
1859 	}
1860 	kprintf("tab\n");
1861 }
1862 
1863 #endif
1864 
1865 /*
1866  * If ccb is not NULL enqueue and/or issue it.
1867  *
1868  * If ccb is NULL issue whatever we can from the queue.  However, nothing
1869  * new is issued if the exclusive access flag is set or expired ccb's are
1870  * present.
1871  *
1872  * If existing commands are still active (ap_active/ap_sactive) we can only
1873  * issue matching new commands.
1874  */
1875 void
1876 ahci_issue_pending_commands(struct ahci_port *ap, struct ahci_ccb *ccb)
1877 {
1878 	u_int32_t		mask;
1879 	int			limit;
1880 
1881 	/*
1882 	 * Enqueue the ccb.
1883 	 *
1884 	 * If just running the queue and in exclusive access mode we
1885 	 * just return.  Also in this case if there are any expired ccb's
1886 	 * we want to clear the queue so the port can be safely stopped.
1887 	 */
1888 	if (ccb) {
1889 		TAILQ_INSERT_TAIL(&ap->ap_ccb_pending, ccb, ccb_entry);
1890 	} else if ((ap->ap_flags & AP_F_EXCLUSIVE_ACCESS) || ap->ap_expired) {
1891 		return;
1892 	}
1893 
1894 	/*
1895 	 * Pull the next ccb off the queue and run it if possible.
1896 	 */
1897 	if ((ccb = TAILQ_FIRST(&ap->ap_ccb_pending)) == NULL)
1898 		return;
1899 
1900 	/*
1901 	 * Handle exclusivity requirements.
1902 	 *
1903 	 * ATA_F_EXCLUSIVE is used when we want to be the only command
1904 	 * running.
1905 	 *
1906 	 * ATA_F_AUTOSENSE is used when we want the D2H rfis loaded
1907 	 * back into the ccb on a normal (non-errored) command completion.
1908 	 * For example, for PM requests to target 15.  Because the AHCI
1909 	 * spec does not stop the command processor and has only one rfis
1910 	 * area (for non-FBSS anyway), AUTOSENSE currently implies EXCLUSIVE.
1911 	 * Otherwise multiple completions can destroy the rfis data before
1912 	 * we have a chance to copy it.
1913 	 */
1914 	if (ap->ap_active & ~ap->ap_expired) {
1915 		/*
1916 		 * There may be multiple ccb's already running,
1917 		 * if any are running and ap_run_flags sets
1918 		 * one of these flags then we know only one is
1919 		 * running.
1920 		 *
1921 		 * XXX Current AUTOSENSE code forces exclusivity
1922 		 *     to simplify the code.
1923 		 */
1924 		if (ap->ap_run_flags &
1925 		    (ATA_F_EXCLUSIVE | ATA_F_AUTOSENSE)) {
1926 			return;
1927 		}
1928 
1929 		if (ccb->ccb_xa.flags &
1930 		    (ATA_F_EXCLUSIVE | ATA_F_AUTOSENSE)) {
1931 			return;
1932 		}
1933 	}
1934 
1935 
1936 	if (ccb->ccb_xa.flags & ATA_F_NCQ) {
1937 		/*
1938 		 * The next command is a NCQ command and can be issued as
1939 		 * long as currently active commands are not standard.
1940 		 */
1941 		if (ap->ap_active) {
1942 			KKASSERT(ap->ap_active_cnt > 0);
1943 			return;
1944 		}
1945 		KKASSERT(ap->ap_active_cnt == 0);
1946 
1947 		mask = 0;
1948 		do {
1949 			TAILQ_REMOVE(&ap->ap_ccb_pending, ccb, ccb_entry);
1950 			mask |= 1 << ccb->ccb_slot;
1951 			ccb->ccb_xa.state = ATA_S_ONCHIP;
1952 			ahci_start_timeout(ccb);
1953 			ap->ap_run_flags = ccb->ccb_xa.flags;
1954 			ccb = TAILQ_FIRST(&ap->ap_ccb_pending);
1955 		} while (ccb && (ccb->ccb_xa.flags & ATA_F_NCQ) &&
1956 			 (ap->ap_run_flags &
1957 			     (ATA_F_EXCLUSIVE | ATA_F_AUTOSENSE)) == 0);
1958 
1959 		ap->ap_sactive |= mask;
1960 		ahci_pwrite(ap, AHCI_PREG_SACT, mask);
1961 		ahci_pwrite(ap, AHCI_PREG_CI, mask);
1962 	} else {
1963 		/*
1964 		 * The next command is a standard command and can be issued
1965 		 * as long as currently active commands are not NCQ.
1966 		 *
1967 		 * We limit ourself to 1 command if we have a port multiplier,
1968 		 * (at least without FBSS support), otherwise timeouts on
1969 		 * one port can race completions on other ports (see
1970 		 * ahci_ata_cmd_timeout() for more information).
1971 		 *
1972 		 * If not on a port multiplier generally allow up to 4
1973 		 * standard commands to be enqueued.  Remember that the
1974 		 * command processor will still process them sequentially.
1975 		 */
1976 		if (ap->ap_sactive)
1977 			return;
1978 		if (ap->ap_type == ATA_PORT_T_PM)
1979 			limit = 1;
1980 		else if (ap->ap_sc->sc_ncmds > 4)
1981 			limit = 4;
1982 		else
1983 			limit = 2;
1984 
1985 		while (ap->ap_active_cnt < limit && ccb &&
1986 		       (ccb->ccb_xa.flags & ATA_F_NCQ) == 0) {
1987 			TAILQ_REMOVE(&ap->ap_ccb_pending, ccb, ccb_entry);
1988 #if 0
1989 			fubar(ccb);
1990 #endif
1991 			ap->ap_active |= 1 << ccb->ccb_slot;
1992 			ap->ap_active_cnt++;
1993 			ap->ap_run_flags = ccb->ccb_xa.flags;
1994 			ccb->ccb_xa.state = ATA_S_ONCHIP;
1995 			ahci_pwrite(ap, AHCI_PREG_CI, 1 << ccb->ccb_slot);
1996 			ahci_start_timeout(ccb);
1997 			ccb = TAILQ_FIRST(&ap->ap_ccb_pending);
1998 			if (ccb && (ccb->ccb_xa.flags &
1999 				    (ATA_F_EXCLUSIVE | ATA_F_AUTOSENSE))) {
2000 				break;
2001 			}
2002 		}
2003 	}
2004 }
2005 
2006 void
2007 ahci_intr(void *arg)
2008 {
2009 	struct ahci_softc	*sc = arg;
2010 	struct ahci_port	*ap;
2011 	u_int32_t		is;
2012 	u_int32_t		ack;
2013 	int			port;
2014 
2015 	/*
2016 	 * Check if the master enable is up, and whether any interrupts are
2017 	 * pending.
2018 	 */
2019 	if ((sc->sc_flags & AHCI_F_INT_GOOD) == 0)
2020 		return;
2021 	is = ahci_read(sc, AHCI_REG_IS);
2022 	if (is == 0 || is == 0xffffffff) {
2023 		return;
2024 	}
2025 	is &= sc->sc_portmask;
2026 
2027 #ifdef AHCI_COALESCE
2028 	/* Check coalescing interrupt first */
2029 	if (is & sc->sc_ccc_mask) {
2030 		DPRINTF(AHCI_D_INTR, "%s: command coalescing interrupt\n",
2031 		    DEVNAME(sc));
2032 		is &= ~sc->sc_ccc_mask;
2033 		is |= sc->sc_ccc_ports_cur;
2034 	}
2035 #endif
2036 
2037 	/*
2038 	 * Process interrupts for each port in a non-blocking fashion.
2039 	 *
2040 	 * The global IS bit is forced on if any unmasked port interrupts
2041 	 * are pending, even if we clear.
2042 	 */
2043 	for (ack = 0; is; is &= ~(1 << port)) {
2044 		port = ffs(is) - 1;
2045 		ack |= 1 << port;
2046 
2047 		ap = sc->sc_ports[port];
2048 		if (ap == NULL)
2049 			continue;
2050 
2051 		if (ahci_os_lock_port_nb(ap) == 0) {
2052 			ahci_port_intr(ap, 0);
2053 			ahci_os_unlock_port(ap);
2054 		} else {
2055 			ahci_pwrite(ap, AHCI_PREG_IE, 0);
2056 			ahci_os_signal_port_thread(ap, AP_SIGF_PORTINT);
2057 		}
2058 	}
2059 	ahci_write(sc, AHCI_REG_IS, ack);
2060 }
2061 
2062 /*
2063  * Core called from helper thread.
2064  */
2065 void
2066 ahci_port_thread_core(struct ahci_port *ap, int mask)
2067 {
2068 	/*
2069 	 * Process any expired timedouts.
2070 	 */
2071 	ahci_os_lock_port(ap);
2072 	if (mask & AP_SIGF_TIMEOUT) {
2073 		ahci_check_active_timeouts(ap);
2074 	}
2075 
2076 	/*
2077 	 * Process port interrupts which require a higher level of
2078 	 * intervention.
2079 	 */
2080 	if (mask & AP_SIGF_PORTINT) {
2081 		ahci_port_intr(ap, 1);
2082 		ahci_port_interrupt_enable(ap);
2083 		ahci_os_unlock_port(ap);
2084 	} else if (ap->ap_probe != ATA_PROBE_FAILED) {
2085 		ahci_port_intr(ap, 1);
2086 		ahci_port_interrupt_enable(ap);
2087 		ahci_os_unlock_port(ap);
2088 	} else {
2089 		ahci_os_unlock_port(ap);
2090 	}
2091 }
2092 
2093 /*
2094  * Core per-port interrupt handler.
2095  *
2096  * If blockable is 0 we cannot call ahci_os_sleep() at all and we can only
2097  * deal with normal command completions which do not require blocking.
2098  */
2099 void
2100 ahci_port_intr(struct ahci_port *ap, int blockable)
2101 {
2102 	struct ahci_softc	*sc = ap->ap_sc;
2103 	u_int32_t		is, ci_saved, ci_masked;
2104 	int			slot;
2105 	struct ahci_ccb		*ccb = NULL;
2106 	struct ata_port		*ccb_at = NULL;
2107 	volatile u_int32_t	*active;
2108 	const u_int32_t		blockable_mask = AHCI_PREG_IS_TFES |
2109 						 AHCI_PREG_IS_IFS |
2110 						 AHCI_PREG_IS_PCS |
2111 						 AHCI_PREG_IS_PRCS |
2112 						 AHCI_PREG_IS_HBFS |
2113 						 AHCI_PREG_IS_OFS |
2114 						 AHCI_PREG_IS_UFS;
2115 
2116 	enum { NEED_NOTHING, NEED_RESTART, NEED_HOTPLUG_INSERT,
2117 	       NEED_HOTPLUG_REMOVE } need = NEED_NOTHING;
2118 
2119 	/*
2120 	 * All basic command completions are always processed.
2121 	 */
2122 	is = ahci_pread(ap, AHCI_PREG_IS);
2123 	if (is & AHCI_PREG_IS_DPS)
2124 		ahci_pwrite(ap, AHCI_PREG_IS, is & AHCI_PREG_IS_DPS);
2125 
2126 	/*
2127 	 * If we can't block then we can't handle these here.  Disable
2128 	 * the interrupts in question so we don't live-lock, the helper
2129 	 * thread will re-enable them.
2130 	 *
2131 	 * If the port is in a completely failed state we do not want
2132 	 * to drop through to failed-command-processing if blockable is 0,
2133 	 * just let the thread deal with it all.
2134 	 *
2135 	 * Otherwise we fall through and still handle DHRS and any commands
2136 	 * which completed normally.  Even if we are errored we haven't
2137 	 * stopped the port yet so CI/SACT are still good.
2138 	 */
2139 	if (blockable == 0) {
2140 		if (ap->ap_state == AP_S_FATAL_ERROR) {
2141 			ahci_pwrite(ap, AHCI_PREG_IE, 0);
2142 			ahci_os_signal_port_thread(ap, AP_SIGF_PORTINT);
2143 			return;
2144 		}
2145 		if (is & blockable_mask) {
2146 			ahci_pwrite(ap, AHCI_PREG_IE, 0);
2147 			ahci_os_signal_port_thread(ap, AP_SIGF_PORTINT);
2148 			return;
2149 		}
2150 	}
2151 
2152 	/*
2153 	 * Either NCQ or non-NCQ commands will be active, never both.
2154 	 */
2155 	if (ap->ap_sactive) {
2156 		KKASSERT(ap->ap_active == 0);
2157 		KKASSERT(ap->ap_active_cnt == 0);
2158 		ci_saved = ahci_pread(ap, AHCI_PREG_SACT);
2159 		active = &ap->ap_sactive;
2160 	} else {
2161 		ci_saved = ahci_pread(ap, AHCI_PREG_CI);
2162 		active = &ap->ap_active;
2163 	}
2164 	KKASSERT(!(ap->ap_sactive && ap->ap_active));
2165 #if 0
2166 	kprintf("CHECK act=%08x/%08x sact=%08x/%08x\n",
2167 		ap->ap_active, ahci_pread(ap, AHCI_PREG_CI),
2168 		ap->ap_sactive, ahci_pread(ap, AHCI_PREG_SACT));
2169 #endif
2170 
2171 	if (is & AHCI_PREG_IS_TFES) {
2172 		/*
2173 		 * Command failed (blockable).
2174 		 *
2175 		 * See AHCI 1.1 spec 6.2.2.1 and 6.2.2.2.
2176 		 *
2177 		 * This stops command processing.
2178 		 */
2179 		u_int32_t tfd, serr;
2180 		int	err_slot;
2181 
2182 process_error:
2183 		tfd = ahci_pread(ap, AHCI_PREG_TFD);
2184 		serr = ahci_pread(ap, AHCI_PREG_SERR);
2185 
2186 		/*
2187 		 * Load the error slot and restart command processing.
2188 		 * CLO if we need to.  The error slot may not be valid.
2189 		 * MUST BE DONE BEFORE CLEARING ST!
2190 		 *
2191 		 * Cycle ST.
2192 		 *
2193 		 * It is unclear but we may have to clear SERR to reenable
2194 		 * error processing.
2195 		 */
2196 		err_slot = AHCI_PREG_CMD_CCS(ahci_pread(ap, AHCI_PREG_CMD));
2197 		ahci_pwrite(ap, AHCI_PREG_IS, AHCI_PREG_IS_TFES |
2198 					      AHCI_PREG_IS_PSS |
2199 					      AHCI_PREG_IS_DHRS |
2200 					      AHCI_PREG_IS_SDBS);
2201 		is &= ~(AHCI_PREG_IS_TFES | AHCI_PREG_IS_PSS |
2202 			AHCI_PREG_IS_DHRS | AHCI_PREG_IS_SDBS);
2203 		ahci_pwrite(ap, AHCI_PREG_SERR, serr);
2204 		ahci_port_stop(ap, 0);
2205 		ahci_os_hardsleep(10);
2206 		if (tfd & (AHCI_PREG_TFD_STS_BSY | AHCI_PREG_TFD_STS_DRQ)) {
2207 			kprintf("%s: Issuing CLO\n", PORTNAME(ap));
2208 			ahci_port_clo(ap);
2209 		}
2210 		ahci_port_start(ap);
2211 		need = NEED_RESTART;
2212 
2213 		/*
2214 		 * ATAPI errors are fairly common from probing, just
2215 		 * report disk errors or if bootverbose is on.
2216 		 */
2217 		if (bootverbose || ap->ap_type != ATA_PORT_T_ATAPI) {
2218 			kprintf("%s: TFES slot %d ci_saved = %08x\n",
2219 				PORTNAME(ap), err_slot, ci_saved);
2220 		}
2221 
2222 		/*
2223 		 * If we got an error on an error CCB just complete it
2224 		 * with an error.  ci_saved has the mask to restart
2225 		 * (the err_ccb will be removed from it by finish_error).
2226 		 */
2227 		if (ap->ap_flags & AP_F_ERR_CCB_RESERVED) {
2228 			err_slot = ap->ap_err_ccb->ccb_slot;
2229 			goto finish_error;
2230 		}
2231 
2232 		/*
2233 		 * If NCQ commands were active get the error slot from
2234 		 * the log page.  NCQ is not supported for PM's so this
2235 		 * is a direct-attached target.
2236 		 *
2237 		 * Otherwise if no commands were active we have a problem.
2238 		 *
2239 		 * Otherwise if the error slot is bad we have a problem.
2240 		 *
2241 		 * Otherwise process the error for the slot.
2242 		 */
2243 		if (ap->ap_sactive) {
2244 			err_slot = ahci_port_read_ncq_error(ap, 0);
2245 		} else if (ap->ap_active == 0) {
2246 			kprintf("%s: TFES with no commands pending\n",
2247 				PORTNAME(ap));
2248 			err_slot = -1;
2249 		} else if (err_slot < 0 || err_slot >= ap->ap_sc->sc_ncmds) {
2250 			kprintf("%s: bad error slot %d\n",
2251 				PORTNAME(ap), err_slot);
2252 			err_slot = -1;
2253 		} else {
2254 			ccb = &ap->ap_ccbs[err_slot];
2255 
2256 			/*
2257 			 * Validate the errored ccb.  Note that ccb_at can
2258 			 * be NULL for direct-attached ccb's.
2259 			 *
2260 			 * Copy received taskfile data from the RFIS.
2261 			 */
2262 			if (ccb->ccb_xa.state == ATA_S_ONCHIP) {
2263 				ccb_at = ccb->ccb_xa.at;
2264 				memcpy(&ccb->ccb_xa.rfis, ap->ap_rfis->rfis,
2265 				       sizeof(struct ata_fis_d2h));
2266 				if (bootverbose) {
2267 					kprintf("%s: Copying rfis slot %d\n",
2268 						ATANAME(ap, ccb_at), err_slot);
2269 				}
2270 			} else {
2271 				kprintf("%s: Cannot copy rfis, CCB slot "
2272 					"%d is not on-chip (state=%d)\n",
2273 					ATANAME(ap, ccb->ccb_xa.at),
2274 					err_slot, ccb->ccb_xa.state);
2275 				err_slot = -1;
2276 			}
2277 		}
2278 
2279 		/*
2280 		 * If we could not determine the errored slot then
2281 		 * reset the port.
2282 		 */
2283 		if (err_slot < 0) {
2284 			kprintf("%s: TFES: Unable to determine errored slot\n",
2285 				PORTNAME(ap));
2286 			if (ap->ap_flags & AP_F_IN_RESET)
2287 				goto fatal;
2288 			goto failall;
2289 		}
2290 
2291 		/*
2292 		 * Finish error on slot.  We will restart ci_saved
2293 		 * commands except the errored slot which we generate
2294 		 * a failure for.
2295 		 */
2296 finish_error:
2297 		ccb = &ap->ap_ccbs[err_slot];
2298 		ci_saved &= ~(1 << err_slot);
2299 		KKASSERT(ccb->ccb_xa.state == ATA_S_ONCHIP);
2300 		ccb->ccb_xa.state = ATA_S_ERROR;
2301 	} else if (is & AHCI_PREG_IS_DHRS) {
2302 		/*
2303 		 * Command posted D2H register FIS to the rfis (non-blocking).
2304 		 *
2305 		 * A normal completion with an error may set DHRS instead
2306 		 * of TFES.  The CCS bits are only valid if ERR was set.
2307 		 * If ERR is set command processing was probably stopped.
2308 		 *
2309 		 * If ERR was not set we can only copy-back data for
2310 		 * exclusive-mode commands because otherwise we won't know
2311 		 * which tag the rfis belonged to.
2312 		 *
2313 		 * err_slot must be read from the CCS before any other port
2314 		 * action, such as stopping the port.
2315 		 *
2316 		 * WARNING!	This is not well documented in the AHCI spec.
2317 		 *		It can be found in the state machine tables
2318 		 *		but not in the explanations.
2319 		 */
2320 		u_int32_t tfd;
2321 		u_int32_t cmd;
2322 		int err_slot;
2323 
2324 		tfd = ahci_pread(ap, AHCI_PREG_TFD);
2325 		cmd = ahci_pread(ap, AHCI_PREG_CMD);
2326 
2327 		if ((tfd & AHCI_PREG_TFD_STS_ERR) &&
2328 		    (cmd & AHCI_PREG_CMD_CR) == 0) {
2329 			err_slot = AHCI_PREG_CMD_CCS(
2330 						ahci_pread(ap, AHCI_PREG_CMD));
2331 			ccb = &ap->ap_ccbs[err_slot];
2332 			kprintf("%s: DHRS tfd=%b err_slot=%d cmd=%02x\n",
2333 				PORTNAME(ap),
2334 				tfd, AHCI_PFMT_TFD_STS,
2335 				err_slot, ccb->ccb_xa.fis->command);
2336 			goto process_error;
2337 		}
2338 		/*
2339 		 * NO ELSE... copy back is in the normal command completion
2340 		 * code and only if no error occured and ATA_F_AUTOSENSE
2341 		 * was set.
2342 		 */
2343 		ahci_pwrite(ap, AHCI_PREG_IS, AHCI_PREG_IS_DHRS);
2344 	}
2345 
2346 	/*
2347 	 * Device notification to us (non-blocking)
2348 	 *
2349 	 * NOTE!  On some parts notification bits can cause an IPMS
2350 	 *	  interrupt instead of a SDBS interrupt.
2351 	 *
2352 	 * NOTE!  On some parts (e.g. VBOX, probably intel ICHx),
2353 	 *	  SDBS notifies us of the completion of a NCQ command
2354 	 *	  and DBS does not.
2355 	 */
2356 	if (is & (AHCI_PREG_IS_SDBS | AHCI_PREG_IS_IPMS)) {
2357 		u_int32_t data;
2358 
2359 		ahci_pwrite(ap, AHCI_PREG_IS,
2360 				AHCI_PREG_IS_SDBS | AHCI_PREG_IS_IPMS);
2361 		if (sc->sc_cap & AHCI_REG_CAP_SSNTF) {
2362 			data = ahci_pread(ap, AHCI_PREG_SNTF);
2363 			if (data) {
2364 				ahci_pwrite(ap, AHCI_PREG_IS,
2365 						AHCI_PREG_IS_SDBS);
2366 				kprintf("%s: NOTIFY %08x\n",
2367 					PORTNAME(ap), data);
2368 				ahci_pwrite(ap, AHCI_PREG_SERR,
2369 						AHCI_PREG_SERR_DIAG_N);
2370 				ahci_pwrite(ap, AHCI_PREG_SNTF, data);
2371 				ahci_cam_changed(ap, NULL, -1);
2372 			}
2373 		}
2374 		is &= ~(AHCI_PREG_IS_SDBS | AHCI_PREG_IS_IPMS);
2375 	}
2376 
2377 	/*
2378 	 * Spurious IFS errors (blockable).
2379 	 *
2380 	 * Spurious IFS errors can occur while we are doing a reset
2381 	 * sequence through a PM.  Try to recover if we are being asked
2382 	 * to ignore IFS errors during these periods.
2383 	 */
2384 	if ((is & AHCI_PREG_IS_IFS) && (ap->ap_flags & AP_F_IGNORE_IFS)) {
2385 		u_int32_t serr = ahci_pread(ap, AHCI_PREG_SERR);
2386 		if ((ap->ap_flags & AP_F_IFS_IGNORED) == 0) {
2387 			kprintf("%s: Ignoring IFS (XXX) (IS: %b, SERR: %b)\n",
2388 				PORTNAME(ap),
2389 				is, AHCI_PFMT_IS,
2390 				serr, AHCI_PFMT_SERR);
2391 			ap->ap_flags |= AP_F_IFS_IGNORED;
2392 		}
2393 		ap->ap_flags |= AP_F_IFS_OCCURED;
2394 		ahci_pwrite(ap, AHCI_PREG_SERR, -1);
2395 		ahci_pwrite(ap, AHCI_PREG_IS, AHCI_PREG_IS_IFS);
2396 		is &= ~AHCI_PREG_IS_IFS;
2397 		ahci_port_stop(ap, 0);
2398 		ahci_port_start(ap);
2399 		kprintf("%s: Spurious IFS error\n", PORTNAME(ap));
2400 		goto failall;
2401 		/* need = NEED_RESTART; */
2402 	}
2403 
2404 	/*
2405 	 * Port change (hot-plug) (blockable).
2406 	 *
2407 	 * A PCS interrupt will occur on hot-plug once communication is
2408 	 * established.
2409 	 *
2410 	 * A PRCS interrupt will occur on hot-unplug (and possibly also
2411 	 * on hot-plug).
2412 	 *
2413 	 * XXX We can then check the CPS (Cold Presence State) bit, if
2414 	 * supported, to determine if a device is plugged in or not and do
2415 	 * the right thing.
2416 	 *
2417 	 * WARNING:  A PCS interrupt is cleared by clearing DIAG_X, and
2418 	 *	     can also occur if an unsolicited COMINIT is received.
2419 	 *	     If this occurs command processing is automatically
2420 	 *	     stopped (CR goes inactive) and the port must be stopped
2421 	 *	     and restarted.
2422 	 */
2423 	if (is & (AHCI_PREG_IS_PCS | AHCI_PREG_IS_PRCS)) {
2424 		kprintf("%s: Transient Errors: %b\n",
2425 			PORTNAME(ap), is, AHCI_PFMT_IS);
2426 		ahci_pwrite(ap, AHCI_PREG_SERR,
2427 			(AHCI_PREG_SERR_DIAG_N | AHCI_PREG_SERR_DIAG_X));
2428 		ahci_pwrite(ap, AHCI_PREG_IS,
2429 			    is & (AHCI_PREG_IS_PCS | AHCI_PREG_IS_PRCS));
2430 		is &= ~(AHCI_PREG_IS_PCS | AHCI_PREG_IS_PRCS);
2431 		ahci_port_stop(ap, 0);
2432 		switch (ahci_pread(ap, AHCI_PREG_SSTS) & AHCI_PREG_SSTS_DET) {
2433 		case AHCI_PREG_SSTS_DET_DEV:
2434 			if (ap->ap_probe == ATA_PROBE_FAILED) {
2435 				need = NEED_HOTPLUG_INSERT;
2436 				goto fatal;
2437 			}
2438 			need = NEED_RESTART;
2439 			break;
2440 		default:
2441 			if (ap->ap_type != ATA_PROBE_FAILED) {
2442 				need = NEED_HOTPLUG_REMOVE;
2443 				goto fatal;
2444 			}
2445 			need = NEED_RESTART;
2446 			break;
2447 		}
2448 	}
2449 
2450 	/*
2451 	 * Check for remaining errors - they are fatal. (blockable)
2452 	 */
2453 	if (is & (AHCI_PREG_IS_TFES | AHCI_PREG_IS_HBFS | AHCI_PREG_IS_IFS |
2454 		  AHCI_PREG_IS_OFS | AHCI_PREG_IS_UFS)) {
2455 		u_int32_t serr;
2456 
2457 		ahci_pwrite(ap, AHCI_PREG_IS,
2458 			    is & (AHCI_PREG_IS_TFES | AHCI_PREG_IS_HBFS |
2459 				  AHCI_PREG_IS_IFS | AHCI_PREG_IS_OFS |
2460 				  AHCI_PREG_IS_UFS));
2461 		serr = ahci_pread(ap, AHCI_PREG_SERR);
2462 		kprintf("%s: Unrecoverable errors (IS: %b, SERR: %b), "
2463 			"disabling port.\n",
2464 			PORTNAME(ap),
2465 			is, AHCI_PFMT_IS,
2466 			serr, AHCI_PFMT_SERR
2467 		);
2468 		is &= ~(AHCI_PREG_IS_TFES | AHCI_PREG_IS_HBFS |
2469 			AHCI_PREG_IS_IFS | AHCI_PREG_IS_OFS |
2470 		        AHCI_PREG_IS_UFS);
2471 		/* XXX try recovery first */
2472 		goto fatal;
2473 	}
2474 
2475 	/*
2476 	 * Fail all outstanding commands if we know the port won't recover.
2477 	 *
2478 	 * We may have a ccb_at if the failed command is known and was
2479 	 * being sent to a device over a port multiplier (PM).  In this
2480 	 * case if the port itself has not completely failed we fail just
2481 	 * the commands related to that target.
2482 	 *
2483 	 * ci_saved contains the mask of active commands as of when the
2484 	 * error occured, prior to any port stops.
2485 	 */
2486 	if (ap->ap_state == AP_S_FATAL_ERROR) {
2487 fatal:
2488 		ap->ap_state = AP_S_FATAL_ERROR;
2489 		ahci_port_stop(ap, 0);
2490 failall:
2491 		kprintf("%s: Failing all commands\n", PORTNAME(ap));
2492 
2493 		/*
2494 		 * Error all the active slots not already errored.  If
2495 		 * running across a PM try to error out just the slots
2496 		 * related to the target.
2497 		 */
2498 		ci_masked = ci_saved & *active & ~ap->ap_expired;
2499 		while (ci_masked) {
2500 			slot = ffs(ci_masked) - 1;
2501 			ccb = &ap->ap_ccbs[slot];
2502 			if (ccb_at == ccb->ccb_xa.at ||
2503 			    ap->ap_state == AP_S_FATAL_ERROR) {
2504 				ccb->ccb_xa.state = ATA_S_TIMEOUT;
2505 				ap->ap_expired |= 1 << slot;
2506 				ci_saved &= ~(1 << slot);
2507 			}
2508 			ci_masked &= ~(1 << slot);
2509 		}
2510 
2511 		/*
2512 		 * Clear bits in ci_saved (cause completions to be run)
2513 		 * for all slots which are not active.
2514 		 */
2515 		ci_saved &= ~*active;
2516 
2517 		/*
2518 		 * Don't restart the port if our problems were deemed fatal.
2519 		 *
2520 		 * Also acknowlege all fatal interrupt sources to prevent
2521 		 * a livelock.
2522 		 */
2523 		if (ap->ap_state == AP_S_FATAL_ERROR) {
2524 			if (need == NEED_RESTART)
2525 				need = NEED_NOTHING;
2526 			ahci_pwrite(ap, AHCI_PREG_IS,
2527 				    AHCI_PREG_IS_TFES | AHCI_PREG_IS_HBFS |
2528 				    AHCI_PREG_IS_IFS | AHCI_PREG_IS_OFS |
2529 				    AHCI_PREG_IS_UFS);
2530 		}
2531 	}
2532 
2533 	/*
2534 	 * CCB completion (non blocking).
2535 	 *
2536 	 * CCB completion is detected by noticing its slot's bit in CI has
2537 	 * changed to zero some time after we activated it.
2538 	 * If we are polling, we may only be interested in particular slot(s).
2539 	 *
2540 	 * Any active bits not saved are completed within the restrictions
2541 	 * imposed by the caller.
2542 	 */
2543 	ci_masked = ~ci_saved & *active;
2544 	while (ci_masked) {
2545 		slot = ffs(ci_masked) - 1;
2546 		ccb = &ap->ap_ccbs[slot];
2547 		ci_masked &= ~(1 << slot);
2548 
2549 		DPRINTF(AHCI_D_INTR, "%s: slot %d is complete%s\n",
2550 		    PORTNAME(ap), slot, ccb->ccb_xa.state == ATA_S_ERROR ?
2551 		    " (error)" : "");
2552 
2553 		bus_dmamap_sync(sc->sc_tag_cmdh,
2554 				AHCI_DMA_MAP(ap->ap_dmamem_cmd_list),
2555 				BUS_DMASYNC_POSTWRITE);
2556 
2557 		bus_dmamap_sync(sc->sc_tag_cmdt,
2558 				AHCI_DMA_MAP(ap->ap_dmamem_cmd_table),
2559 				BUS_DMASYNC_POSTWRITE);
2560 
2561 		bus_dmamap_sync(sc->sc_tag_rfis,
2562 				AHCI_DMA_MAP(ap->ap_dmamem_rfis),
2563 				BUS_DMASYNC_POSTREAD);
2564 
2565 		*active &= ~(1 << ccb->ccb_slot);
2566 		if (active == &ap->ap_active) {
2567 			KKASSERT(ap->ap_active_cnt > 0);
2568 			--ap->ap_active_cnt;
2569 		}
2570 
2571 		/*
2572 		 * Complete the ccb.  If the ccb was marked expired it
2573 		 * was probably already removed from the command processor,
2574 		 * so don't take the clear ci_saved bit as meaning the
2575 		 * command actually succeeded, it didn't.
2576 		 */
2577 		if (ap->ap_expired & (1 << ccb->ccb_slot)) {
2578 			ap->ap_expired &= ~(1 << ccb->ccb_slot);
2579 			ccb->ccb_xa.state = ATA_S_TIMEOUT;
2580 			ccb->ccb_done(ccb);
2581 			ccb->ccb_xa.complete(&ccb->ccb_xa);
2582 		} else {
2583 			if (ccb->ccb_xa.state == ATA_S_ONCHIP) {
2584 				ccb->ccb_xa.state = ATA_S_COMPLETE;
2585 				if (ccb->ccb_xa.flags & ATA_F_AUTOSENSE) {
2586 					memcpy(&ccb->ccb_xa.rfis,
2587 					    ap->ap_rfis->rfis,
2588 					    sizeof(struct ata_fis_d2h));
2589 					if (ccb->ccb_xa.state == ATA_S_TIMEOUT)
2590 						ccb->ccb_xa.state = ATA_S_ERROR;
2591 				}
2592 			}
2593 			ccb->ccb_done(ccb);
2594 		}
2595 	}
2596 	ahci_issue_pending_commands(ap, NULL);
2597 
2598 	/*
2599 	 * Cleanup.  Will not be set if non-blocking.
2600 	 */
2601 	switch(need) {
2602 	case NEED_RESTART:
2603 		/*
2604 		 * A recoverable error occured and we can restart outstanding
2605 		 * commands on the port.
2606 		 */
2607 		ci_saved &= ~ap->ap_expired;
2608 		if (ci_saved) {
2609 			kprintf("%s: Restart %08x\n", PORTNAME(ap), ci_saved);
2610 			ahci_issue_saved_commands(ap, ci_saved);
2611 		}
2612 		break;
2613 	case NEED_HOTPLUG_INSERT:
2614 		/*
2615 		 * A hot-plug insertion event has occured and all
2616 		 * outstanding commands have already been revoked.
2617 		 *
2618 		 * Don't recurse if this occurs while we are
2619 		 * resetting the port.
2620 		 */
2621 		if ((ap->ap_flags & AP_F_IN_RESET) == 0) {
2622 			kprintf("%s: HOTPLUG - Device inserted\n",
2623 				PORTNAME(ap));
2624 			ap->ap_probe = ATA_PROBE_NEED_INIT;
2625 			ahci_cam_changed(ap, NULL, -1);
2626 		}
2627 		break;
2628 	case NEED_HOTPLUG_REMOVE:
2629 		/*
2630 		 * A hot-plug removal event has occured and all
2631 		 * outstanding commands have already been revoked.
2632 		 *
2633 		 * Don't recurse if this occurs while we are
2634 		 * resetting the port.
2635 		 */
2636 		if ((ap->ap_flags & AP_F_IN_RESET) == 0) {
2637 			kprintf("%s: HOTPLUG - Device removed\n",
2638 				PORTNAME(ap));
2639 			ahci_port_hardstop(ap);
2640 			/* ap_probe set to failed */
2641 			ahci_cam_changed(ap, NULL, -1);
2642 		}
2643 		break;
2644 	default:
2645 		break;
2646 	}
2647 }
2648 
2649 struct ahci_ccb *
2650 ahci_get_ccb(struct ahci_port *ap)
2651 {
2652 	struct ahci_ccb			*ccb;
2653 
2654 	lockmgr(&ap->ap_ccb_lock, LK_EXCLUSIVE);
2655 	ccb = TAILQ_FIRST(&ap->ap_ccb_free);
2656 	if (ccb != NULL) {
2657 		KKASSERT(ccb->ccb_xa.state == ATA_S_PUT);
2658 		TAILQ_REMOVE(&ap->ap_ccb_free, ccb, ccb_entry);
2659 		ccb->ccb_xa.state = ATA_S_SETUP;
2660 		ccb->ccb_xa.at = NULL;
2661 	}
2662 	lockmgr(&ap->ap_ccb_lock, LK_RELEASE);
2663 
2664 	return (ccb);
2665 }
2666 
2667 void
2668 ahci_put_ccb(struct ahci_ccb *ccb)
2669 {
2670 	struct ahci_port		*ap = ccb->ccb_port;
2671 
2672 	ccb->ccb_xa.state = ATA_S_PUT;
2673 	lockmgr(&ap->ap_ccb_lock, LK_EXCLUSIVE);
2674 	TAILQ_INSERT_TAIL(&ap->ap_ccb_free, ccb, ccb_entry);
2675 	lockmgr(&ap->ap_ccb_lock, LK_RELEASE);
2676 }
2677 
2678 struct ahci_ccb *
2679 ahci_get_err_ccb(struct ahci_port *ap)
2680 {
2681 	struct ahci_ccb *err_ccb;
2682 	u_int32_t sact;
2683 	u_int32_t ci;
2684 
2685 	/* No commands may be active on the chip. */
2686 
2687 	if (ap->ap_sc->sc_cap & AHCI_REG_CAP_SNCQ) {
2688 		sact = ahci_pread(ap, AHCI_PREG_SACT);
2689 		if (sact != 0) {
2690 			kprintf("%s: ahci_get_err_ccb but SACT %08x != 0?\n",
2691 				PORTNAME(ap), sact);
2692 		}
2693 	}
2694 	ci = ahci_pread(ap, AHCI_PREG_CI);
2695 	if (ci) {
2696 		kprintf("%s: ahci_get_err_ccb: ci not 0 (%08x)\n",
2697 			ap->ap_name, ci);
2698 	}
2699 	KKASSERT(ci == 0);
2700 	KKASSERT((ap->ap_flags & AP_F_ERR_CCB_RESERVED) == 0);
2701 	ap->ap_flags |= AP_F_ERR_CCB_RESERVED;
2702 
2703 	/* Save outstanding command state. */
2704 	ap->ap_err_saved_active = ap->ap_active;
2705 	ap->ap_err_saved_active_cnt = ap->ap_active_cnt;
2706 	ap->ap_err_saved_sactive = ap->ap_sactive;
2707 
2708 	/*
2709 	 * Pretend we have no commands outstanding, so that completions won't
2710 	 * run prematurely.
2711 	 */
2712 	ap->ap_active = ap->ap_active_cnt = ap->ap_sactive = 0;
2713 
2714 	/*
2715 	 * Grab a CCB to use for error recovery.  This should never fail, as
2716 	 * we ask atascsi to reserve one for us at init time.
2717 	 */
2718 	err_ccb = ap->ap_err_ccb;
2719 	KKASSERT(err_ccb != NULL);
2720 	err_ccb->ccb_xa.flags = 0;
2721 	err_ccb->ccb_done = ahci_empty_done;
2722 
2723 	return err_ccb;
2724 }
2725 
2726 void
2727 ahci_put_err_ccb(struct ahci_ccb *ccb)
2728 {
2729 	struct ahci_port *ap = ccb->ccb_port;
2730 	u_int32_t sact;
2731 	u_int32_t ci;
2732 
2733 	KKASSERT((ap->ap_flags & AP_F_ERR_CCB_RESERVED) != 0);
2734 
2735 	/*
2736 	 * No commands may be active on the chip
2737 	 */
2738 	if (ap->ap_sc->sc_cap & AHCI_REG_CAP_SNCQ) {
2739 		sact = ahci_pread(ap, AHCI_PREG_SACT);
2740 		if (sact) {
2741 			panic("ahci_port_err_ccb(%d) but SACT %08x != 0\n",
2742 			      ccb->ccb_slot, sact);
2743 		}
2744 	}
2745 	ci = ahci_pread(ap, AHCI_PREG_CI);
2746 	if (ci) {
2747 		panic("ahci_put_err_ccb(%d) but CI %08x != 0 "
2748 		      "(act=%08x sact=%08x)\n",
2749 		      ccb->ccb_slot, ci,
2750 		      ap->ap_active, ap->ap_sactive);
2751 	}
2752 
2753 	KKASSERT(ccb == ap->ap_err_ccb);
2754 
2755 	/* Restore outstanding command state */
2756 	ap->ap_sactive = ap->ap_err_saved_sactive;
2757 	ap->ap_active_cnt = ap->ap_err_saved_active_cnt;
2758 	ap->ap_active = ap->ap_err_saved_active;
2759 
2760 	ap->ap_flags &= ~AP_F_ERR_CCB_RESERVED;
2761 }
2762 
2763 /*
2764  * Read log page to get NCQ error.
2765  *
2766  * NOTE: NCQ not currently supported on port multipliers. XXX
2767  */
2768 int
2769 ahci_port_read_ncq_error(struct ahci_port *ap, int target)
2770 {
2771 	struct ata_log_page_10h	*log;
2772 	struct ahci_ccb		*ccb;
2773 	struct ahci_cmd_hdr	*cmd_slot;
2774 	struct ata_fis_h2d	*fis;
2775 	int			err_slot;
2776 
2777 	if (bootverbose) {
2778 		kprintf("%s: READ LOG PAGE target %d\n", PORTNAME(ap),
2779 			target);
2780 	}
2781 
2782 	/*
2783 	 * Prep error CCB for READ LOG EXT, page 10h, 1 sector.
2784 	 *
2785 	 * Getting err_ccb clears active/sactive/active_cnt, putting
2786 	 * it back restores the fields.
2787 	 */
2788 	ccb = ahci_get_err_ccb(ap);
2789 	ccb->ccb_xa.flags = ATA_F_READ | ATA_F_POLL;
2790 	ccb->ccb_xa.data = ap->ap_err_scratch;
2791 	ccb->ccb_xa.datalen = 512;
2792 	ccb->ccb_xa.complete = ahci_dummy_done;
2793 	ccb->ccb_xa.at = ap->ap_ata[target];
2794 
2795 	fis = (struct ata_fis_h2d *)ccb->ccb_cmd_table->cfis;
2796 	bzero(fis, sizeof(*fis));
2797 	fis->type = ATA_FIS_TYPE_H2D;
2798 	fis->flags = ATA_H2D_FLAGS_CMD | target;
2799 	fis->command = ATA_C_READ_LOG_EXT;
2800 	fis->lba_low = 0x10;		/* queued error log page (10h) */
2801 	fis->sector_count = 1;		/* number of sectors (1) */
2802 	fis->sector_count_exp = 0;
2803 	fis->lba_mid = 0;		/* starting offset */
2804 	fis->lba_mid_exp = 0;
2805 	fis->device = 0;
2806 
2807 	cmd_slot = ccb->ccb_cmd_hdr;
2808 	cmd_slot->flags = htole16(5);	/* FIS length: 5 DWORDS */
2809 
2810 	if (ahci_load_prdt(ccb) != 0) {
2811 		err_slot = -1;
2812 		goto err;
2813 	}
2814 
2815 	ccb->ccb_xa.state = ATA_S_PENDING;
2816 	if (ahci_poll(ccb, 1000, ahci_quick_timeout) != ATA_S_COMPLETE) {
2817 		err_slot = -1;
2818 		ahci_unload_prdt(ccb);
2819 		goto err;
2820 	}
2821 	ahci_unload_prdt(ccb);
2822 
2823 	/*
2824 	 * Success, extract failed register set and tags from the scratch
2825 	 * space.
2826 	 */
2827 	log = (struct ata_log_page_10h *)ap->ap_err_scratch;
2828 	if (log->err_regs.type & ATA_LOG_10H_TYPE_NOTQUEUED) {
2829 		/* Not queued bit was set - wasn't an NCQ error? */
2830 		kprintf("%s: read NCQ error page, but not an NCQ error?\n",
2831 			PORTNAME(ap));
2832 		err_slot = -1;
2833 	} else {
2834 		/* Copy back the log record as a D2H register FIS. */
2835 		err_slot = log->err_regs.type & ATA_LOG_10H_TYPE_TAG_MASK;
2836 
2837 		ccb = &ap->ap_ccbs[err_slot];
2838 		if (ccb->ccb_xa.state == ATA_S_ONCHIP) {
2839 			kprintf("%s: read NCQ error page slot=%d\n",
2840 				ATANAME(ap, ccb->ccb_xa.at),
2841 				err_slot);
2842 			memcpy(&ccb->ccb_xa.rfis, &log->err_regs,
2843 				sizeof(struct ata_fis_d2h));
2844 			ccb->ccb_xa.rfis.type = ATA_FIS_TYPE_D2H;
2845 			ccb->ccb_xa.rfis.flags = 0;
2846 		} else {
2847 			kprintf("%s: read NCQ error page slot=%d, "
2848 				"slot does not match any cmds\n",
2849 				ATANAME(ccb->ccb_port, ccb->ccb_xa.at),
2850 				err_slot);
2851 			err_slot = -1;
2852 		}
2853 	}
2854 err:
2855 	ahci_put_err_ccb(ccb);
2856 	kprintf("%s: DONE log page target %d err_slot=%d\n",
2857 		PORTNAME(ap), target, err_slot);
2858 	return (err_slot);
2859 }
2860 
2861 /*
2862  * Allocate memory for various structures DMAd by hardware.  The maximum
2863  * number of segments for these tags is 1 so the DMA memory will have a
2864  * single physical base address.
2865  */
2866 struct ahci_dmamem *
2867 ahci_dmamem_alloc(struct ahci_softc *sc, bus_dma_tag_t tag)
2868 {
2869 	struct ahci_dmamem *adm;
2870 	int	error;
2871 
2872 	adm = kmalloc(sizeof(*adm), M_DEVBUF, M_INTWAIT | M_ZERO);
2873 
2874 	error = bus_dmamem_alloc(tag, (void **)&adm->adm_kva,
2875 				 BUS_DMA_ZERO, &adm->adm_map);
2876 	if (error == 0) {
2877 		adm->adm_tag = tag;
2878 		error = bus_dmamap_load(tag, adm->adm_map,
2879 					adm->adm_kva,
2880 					bus_dma_tag_getmaxsize(tag),
2881 					ahci_dmamem_saveseg, &adm->adm_busaddr,
2882 					0);
2883 	}
2884 	if (error) {
2885 		if (adm->adm_map) {
2886 			bus_dmamap_destroy(tag, adm->adm_map);
2887 			adm->adm_map = NULL;
2888 			adm->adm_tag = NULL;
2889 			adm->adm_kva = NULL;
2890 		}
2891 		kfree(adm, M_DEVBUF);
2892 		adm = NULL;
2893 	}
2894 	return (adm);
2895 }
2896 
2897 static
2898 void
2899 ahci_dmamem_saveseg(void *info, bus_dma_segment_t *segs, int nsegs, int error)
2900 {
2901 	KKASSERT(error == 0);
2902 	KKASSERT(nsegs == 1);
2903 	*(bus_addr_t *)info = segs->ds_addr;
2904 }
2905 
2906 
2907 void
2908 ahci_dmamem_free(struct ahci_softc *sc, struct ahci_dmamem *adm)
2909 {
2910 	if (adm->adm_map) {
2911 		bus_dmamap_unload(adm->adm_tag, adm->adm_map);
2912 		bus_dmamap_destroy(adm->adm_tag, adm->adm_map);
2913 		adm->adm_map = NULL;
2914 		adm->adm_tag = NULL;
2915 		adm->adm_kva = NULL;
2916 	}
2917 	kfree(adm, M_DEVBUF);
2918 }
2919 
2920 u_int32_t
2921 ahci_read(struct ahci_softc *sc, bus_size_t r)
2922 {
2923 	bus_space_barrier(sc->sc_iot, sc->sc_ioh, r, 4,
2924 			  BUS_SPACE_BARRIER_READ);
2925 	return (bus_space_read_4(sc->sc_iot, sc->sc_ioh, r));
2926 }
2927 
2928 void
2929 ahci_write(struct ahci_softc *sc, bus_size_t r, u_int32_t v)
2930 {
2931 	bus_space_write_4(sc->sc_iot, sc->sc_ioh, r, v);
2932 	bus_space_barrier(sc->sc_iot, sc->sc_ioh, r, 4,
2933 			  BUS_SPACE_BARRIER_WRITE);
2934 }
2935 
2936 u_int32_t
2937 ahci_pread(struct ahci_port *ap, bus_size_t r)
2938 {
2939 	bus_space_barrier(ap->ap_sc->sc_iot, ap->ap_ioh, r, 4,
2940 			  BUS_SPACE_BARRIER_READ);
2941 	return (bus_space_read_4(ap->ap_sc->sc_iot, ap->ap_ioh, r));
2942 }
2943 
2944 void
2945 ahci_pwrite(struct ahci_port *ap, bus_size_t r, u_int32_t v)
2946 {
2947 	bus_space_write_4(ap->ap_sc->sc_iot, ap->ap_ioh, r, v);
2948 	bus_space_barrier(ap->ap_sc->sc_iot, ap->ap_ioh, r, 4,
2949 			  BUS_SPACE_BARRIER_WRITE);
2950 }
2951 
2952 /*
2953  * Wait up to (timeout) milliseconds for the masked port register to
2954  * match the target.
2955  *
2956  * Timeout is in milliseconds.
2957  */
2958 int
2959 ahci_pwait_eq(struct ahci_port *ap, int timeout,
2960 	      bus_size_t r, u_int32_t mask, u_int32_t target)
2961 {
2962 	int	t;
2963 
2964 	/*
2965 	 * Loop hard up to 100uS
2966 	 */
2967 	for (t = 0; t < 100; ++t) {
2968 		if ((ahci_pread(ap, r) & mask) == target)
2969 			return (0);
2970 		ahci_os_hardsleep(1);	/* us */
2971 	}
2972 
2973 	do {
2974 		timeout -= ahci_os_softsleep();
2975 		if ((ahci_pread(ap, r) & mask) == target)
2976 			return (0);
2977 	} while (timeout > 0);
2978 	return (1);
2979 }
2980 
2981 int
2982 ahci_wait_ne(struct ahci_softc *sc, bus_size_t r, u_int32_t mask,
2983 	     u_int32_t target)
2984 {
2985 	int	t;
2986 
2987 	/*
2988 	 * Loop hard up to 100uS
2989 	 */
2990 	for (t = 0; t < 100; ++t) {
2991 		if ((ahci_read(sc, r) & mask) != target)
2992 			return (0);
2993 		ahci_os_hardsleep(1);	/* us */
2994 	}
2995 
2996 	/*
2997 	 * And one millisecond the slow way
2998 	 */
2999 	t = 1000;
3000 	do {
3001 		t -= ahci_os_softsleep();
3002 		if ((ahci_read(sc, r) & mask) != target)
3003 			return (0);
3004 	} while (t > 0);
3005 
3006 	return (1);
3007 }
3008 
3009 
3010 /*
3011  * Acquire an ata transfer.
3012  *
3013  * Pass a NULL at for direct-attached transfers, and a non-NULL at for
3014  * targets that go through the port multiplier.
3015  */
3016 struct ata_xfer *
3017 ahci_ata_get_xfer(struct ahci_port *ap, struct ata_port *at)
3018 {
3019 	struct ahci_ccb		*ccb;
3020 
3021 	ccb = ahci_get_ccb(ap);
3022 	if (ccb == NULL) {
3023 		DPRINTF(AHCI_D_XFER, "%s: ahci_ata_get_xfer: NULL ccb\n",
3024 		    PORTNAME(ap));
3025 		return (NULL);
3026 	}
3027 
3028 	DPRINTF(AHCI_D_XFER, "%s: ahci_ata_get_xfer got slot %d\n",
3029 	    PORTNAME(ap), ccb->ccb_slot);
3030 
3031 	bzero(ccb->ccb_xa.fis, sizeof(*ccb->ccb_xa.fis));
3032 	ccb->ccb_xa.at = at;
3033 	ccb->ccb_xa.fis->type = ATA_FIS_TYPE_H2D;
3034 
3035 	return (&ccb->ccb_xa);
3036 }
3037 
3038 void
3039 ahci_ata_put_xfer(struct ata_xfer *xa)
3040 {
3041 	struct ahci_ccb			*ccb = (struct ahci_ccb *)xa;
3042 
3043 	DPRINTF(AHCI_D_XFER, "ahci_ata_put_xfer slot %d\n", ccb->ccb_slot);
3044 
3045 	ahci_put_ccb(ccb);
3046 }
3047 
3048 int
3049 ahci_ata_cmd(struct ata_xfer *xa)
3050 {
3051 	struct ahci_ccb			*ccb = (struct ahci_ccb *)xa;
3052 	struct ahci_cmd_hdr		*cmd_slot;
3053 
3054 	KKASSERT(xa->state == ATA_S_SETUP);
3055 
3056 	if (ccb->ccb_port->ap_state == AP_S_FATAL_ERROR)
3057 		goto failcmd;
3058 	ccb->ccb_done = ahci_ata_cmd_done;
3059 
3060 	cmd_slot = ccb->ccb_cmd_hdr;
3061 	cmd_slot->flags = htole16(5); /* FIS length (in DWORDs) */
3062 	if (ccb->ccb_xa.at) {
3063 		cmd_slot->flags |= htole16(ccb->ccb_xa.at->at_target <<
3064 					   AHCI_CMD_LIST_FLAG_PMP_SHIFT);
3065 	}
3066 
3067 	if (xa->flags & ATA_F_WRITE)
3068 		cmd_slot->flags |= htole16(AHCI_CMD_LIST_FLAG_W);
3069 
3070 	if (xa->flags & ATA_F_PACKET)
3071 		cmd_slot->flags |= htole16(AHCI_CMD_LIST_FLAG_A);
3072 
3073 	if (ahci_load_prdt(ccb) != 0)
3074 		goto failcmd;
3075 
3076 	xa->state = ATA_S_PENDING;
3077 
3078 	if (xa->flags & ATA_F_POLL)
3079 		return (ahci_poll(ccb, xa->timeout, ahci_ata_cmd_timeout));
3080 
3081 	crit_enter();
3082 	KKASSERT((xa->flags & ATA_F_TIMEOUT_EXPIRED) == 0);
3083 	xa->flags |= ATA_F_TIMEOUT_DESIRED;
3084 	ahci_start(ccb);
3085 	crit_exit();
3086 	return (xa->state);
3087 
3088 failcmd:
3089 	crit_enter();
3090 	xa->state = ATA_S_ERROR;
3091 	xa->complete(xa);
3092 	crit_exit();
3093 	return (ATA_S_ERROR);
3094 }
3095 
3096 void
3097 ahci_ata_cmd_done(struct ahci_ccb *ccb)
3098 {
3099 	struct ata_xfer			*xa = &ccb->ccb_xa;
3100 
3101 	/*
3102 	 * NOTE: callout does not lock port and may race us modifying
3103 	 * the flags, so make sure its stopped.
3104 	 */
3105 	if (xa->flags & ATA_F_TIMEOUT_RUNNING) {
3106 		callout_stop(&ccb->ccb_timeout);
3107 		xa->flags &= ~ATA_F_TIMEOUT_RUNNING;
3108 	}
3109 	xa->flags &= ~(ATA_F_TIMEOUT_DESIRED | ATA_F_TIMEOUT_EXPIRED);
3110 
3111 	KKASSERT(xa->state != ATA_S_ONCHIP);
3112 	ahci_unload_prdt(ccb);
3113 
3114 	if (xa->state != ATA_S_TIMEOUT)
3115 		xa->complete(xa);
3116 }
3117 
3118 /*
3119  * Timeout from callout, MPSAFE - nothing can mess with the CCB's flags
3120  * while the callout is runing.
3121  *
3122  * We can't safely get the port lock here or delay, we could block
3123  * the callout thread.
3124  */
3125 static void
3126 ahci_ata_cmd_timeout_unserialized(void *arg)
3127 {
3128 	struct ahci_ccb		*ccb = arg;
3129 	struct ahci_port	*ap = ccb->ccb_port;
3130 
3131 	ccb->ccb_xa.flags &= ~ATA_F_TIMEOUT_RUNNING;
3132 	ccb->ccb_xa.flags |= ATA_F_TIMEOUT_EXPIRED;
3133 	ahci_os_signal_port_thread(ap, AP_SIGF_TIMEOUT);
3134 }
3135 
3136 /*
3137  * Timeout code, typically called when the port command processor is running.
3138  *
3139  * We have to be very very careful here.  We cannot stop the port unless
3140  * CR is already clear or the only active commands remaining are timed-out
3141  * ones.  Otherwise stopping the port will race the command processor and
3142  * we can lose events.  While we can theoretically just restart everything
3143  * that could result in a double-issue which will not work for ATAPI commands.
3144  */
3145 void
3146 ahci_ata_cmd_timeout(struct ahci_ccb *ccb)
3147 {
3148 	struct ata_xfer		*xa = &ccb->ccb_xa;
3149 	struct ahci_port	*ap = ccb->ccb_port;
3150 	struct ata_port		*at;
3151 	int			ci_saved;
3152 	int			slot;
3153 
3154 	at = ccb->ccb_xa.at;
3155 
3156 	kprintf("%s: CMD TIMEOUT state=%d slot=%d\n"
3157 		"\tcmd-reg 0x%b\n"
3158 		"\tsactive=%08x active=%08x expired=%08x\n"
3159 		"\t   sact=%08x     ci=%08x\n"
3160 		"\t    STS=%b\n",
3161 		ATANAME(ap, at),
3162 		ccb->ccb_xa.state, ccb->ccb_slot,
3163 		ahci_pread(ap, AHCI_PREG_CMD), AHCI_PFMT_CMD,
3164 		ap->ap_sactive, ap->ap_active, ap->ap_expired,
3165 		ahci_pread(ap, AHCI_PREG_SACT),
3166 		ahci_pread(ap, AHCI_PREG_CI),
3167 		ahci_pread(ap, AHCI_PREG_TFD), AHCI_PFMT_TFD_STS
3168 	);
3169 
3170 
3171 	/*
3172 	 * NOTE: Timeout will not be running if the command was polled.
3173 	 *	 If we got here at least one of these flags should be set.
3174 	 */
3175 	KKASSERT(xa->flags & (ATA_F_POLL | ATA_F_TIMEOUT_DESIRED |
3176 			      ATA_F_TIMEOUT_RUNNING));
3177 	xa->flags &= ~(ATA_F_TIMEOUT_RUNNING | ATA_F_TIMEOUT_EXPIRED);
3178 
3179 	if (ccb->ccb_xa.state == ATA_S_PENDING) {
3180 		TAILQ_REMOVE(&ap->ap_ccb_pending, ccb, ccb_entry);
3181 		ccb->ccb_xa.state = ATA_S_TIMEOUT;
3182 		ccb->ccb_done(ccb);
3183 		xa->complete(xa);
3184 		ahci_issue_pending_commands(ap, NULL);
3185 		return;
3186 	}
3187 	if (ccb->ccb_xa.state != ATA_S_ONCHIP) {
3188 		kprintf("%s: Unexpected state during timeout: %d\n",
3189 			ATANAME(ap, at), ccb->ccb_xa.state);
3190 		return;
3191 	}
3192 
3193 	/*
3194 	 * Ok, we can only get this command off the chip if CR is inactive
3195 	 * or if the only commands running on the chip are all expired.
3196 	 * Otherwise we have to wait until the port is in a safe state.
3197 	 *
3198 	 * Do not set state here, it will cause polls to return when the
3199 	 * ccb is not yet off the chip.
3200 	 */
3201 	ap->ap_expired |= 1 << ccb->ccb_slot;
3202 
3203 	if ((ahci_pread(ap, AHCI_PREG_CMD) & AHCI_PREG_CMD_CR) &&
3204 	    (ap->ap_active | ap->ap_sactive) != ap->ap_expired) {
3205 		/*
3206 		 * If using FBSS or NCQ we can't safely stop the port
3207 		 * right now.
3208 		 */
3209 		kprintf("%s: Deferred timeout until its safe, slot %d\n",
3210 			ATANAME(ap, at), ccb->ccb_slot);
3211 		return;
3212 	}
3213 
3214 	/*
3215 	 * We can safely stop the port and process all expired ccb's,
3216 	 * which will include our current ccb.
3217 	 */
3218 	ci_saved = (ap->ap_sactive) ? ahci_pread(ap, AHCI_PREG_SACT) :
3219 				      ahci_pread(ap, AHCI_PREG_CI);
3220 	ahci_port_stop(ap, 0);
3221 
3222 	while (ap->ap_expired) {
3223 		slot = ffs(ap->ap_expired) - 1;
3224 		ap->ap_expired &= ~(1 << slot);
3225 		ci_saved &= ~(1 << slot);
3226 		ccb = &ap->ap_ccbs[slot];
3227 		ccb->ccb_xa.state = ATA_S_TIMEOUT;
3228 		if (ccb->ccb_xa.flags & ATA_F_NCQ) {
3229 			KKASSERT(ap->ap_sactive & (1 << slot));
3230 			ap->ap_sactive &= ~(1 << slot);
3231 		} else {
3232 			KKASSERT(ap->ap_active & (1 << slot));
3233 			ap->ap_active &= ~(1 << slot);
3234 			--ap->ap_active_cnt;
3235 		}
3236 		ccb->ccb_done(ccb);
3237 		ccb->ccb_xa.complete(&ccb->ccb_xa);
3238 	}
3239 	/* ccb invalid now */
3240 
3241 	/*
3242 	 * We can safely CLO the port to clear any BSY/DRQ, a case which
3243 	 * can occur with port multipliers.  This will unbrick the port
3244 	 * and allow commands to other targets behind the PM continue.
3245 	 * (FBSS).
3246 	 *
3247 	 * Finally, once the port has been restarted we can issue any
3248 	 * previously saved pending commands, and run the port interrupt
3249 	 * code to handle any completions which may have occured when
3250 	 * we saved CI.
3251 	 */
3252 	if (ahci_pread(ap, AHCI_PREG_TFD) &
3253 		   (AHCI_PREG_TFD_STS_BSY | AHCI_PREG_TFD_STS_DRQ)) {
3254 		kprintf("%s: Warning, issuing CLO after timeout\n",
3255 			ATANAME(ap, at));
3256 		ahci_port_clo(ap);
3257 	}
3258 	ahci_port_start(ap);
3259 	ahci_issue_saved_commands(ap, ci_saved & ~ap->ap_expired);
3260 	ahci_issue_pending_commands(ap, NULL);
3261 	ahci_port_intr(ap, 0);
3262 }
3263 
3264 /*
3265  * Issue a previously saved set of commands
3266  */
3267 void
3268 ahci_issue_saved_commands(struct ahci_port *ap, u_int32_t ci_saved)
3269 {
3270 	if (ci_saved) {
3271 		KKASSERT(!((ap->ap_active & ci_saved) &&
3272 			   (ap->ap_sactive & ci_saved)));
3273 		KKASSERT((ci_saved & ap->ap_expired) == 0);
3274 		if (ap->ap_sactive & ci_saved)
3275 			ahci_pwrite(ap, AHCI_PREG_SACT, ci_saved);
3276 		ahci_pwrite(ap, AHCI_PREG_CI, ci_saved);
3277 	}
3278 }
3279 
3280 /*
3281  * Used by the softreset, pmprobe, and read_ncq_error only, in very
3282  * specialized, controlled circumstances.
3283  *
3284  * Only one command may be pending.
3285  */
3286 void
3287 ahci_quick_timeout(struct ahci_ccb *ccb)
3288 {
3289 	struct ahci_port *ap = ccb->ccb_port;
3290 
3291 	switch (ccb->ccb_xa.state) {
3292 	case ATA_S_PENDING:
3293 		TAILQ_REMOVE(&ap->ap_ccb_pending, ccb, ccb_entry);
3294 		ccb->ccb_xa.state = ATA_S_TIMEOUT;
3295 		break;
3296 	case ATA_S_ONCHIP:
3297 		KKASSERT(ap->ap_active == (1 << ccb->ccb_slot) &&
3298 			 ap->ap_sactive == 0);
3299 		ahci_port_stop(ap, 0);
3300 		ahci_port_start(ap);
3301 
3302 		ccb->ccb_xa.state = ATA_S_TIMEOUT;
3303 		ap->ap_active &= ~(1 << ccb->ccb_slot);
3304 		KKASSERT(ap->ap_active_cnt > 0);
3305 		--ap->ap_active_cnt;
3306 		break;
3307 	default:
3308 		panic("%s: ahci_quick_timeout: ccb in bad state %d",
3309 		      ATANAME(ap, ccb->ccb_xa.at), ccb->ccb_xa.state);
3310 	}
3311 }
3312 
3313 static void
3314 ahci_dummy_done(struct ata_xfer *xa)
3315 {
3316 }
3317 
3318 static void
3319 ahci_empty_done(struct ahci_ccb *ccb)
3320 {
3321 }
3322