xref: /freebsd/sys/dev/aic7xxx/aic79xx.seq (revision e46bab9aea20bf5c4b8b29b62df3632fcad26233)
1/*
2 * Adaptec U320 device driver firmware for Linux and FreeBSD.
3 *
4 * Copyright (c) 1994-2001 Justin T. Gibbs.
5 * Copyright (c) 2000-2002 Adaptec Inc.
6 * All rights reserved.
7 *
8 * Redistribution and use in source and binary forms, with or without
9 * modification, are permitted provided that the following conditions
10 * are met:
11 * 1. Redistributions of source code must retain the above copyright
12 *    notice, this list of conditions, and the following disclaimer,
13 *    without modification.
14 * 2. Redistributions in binary form must reproduce at minimum a disclaimer
15 *    substantially similar to the "NO WARRANTY" disclaimer below
16 *    ("Disclaimer") and any redistribution must be conditioned upon
17 *    including a substantially similar Disclaimer requirement for further
18 *    binary redistribution.
19 * 3. Neither the names of the above-listed copyright holders nor the names
20 *    of any contributors may be used to endorse or promote products derived
21 *    from this software without specific prior written permission.
22 *
23 * Alternatively, this software may be distributed under the terms of the
24 * GNU General Public License ("GPL") version 2 as published by the Free
25 * Software Foundation.
26 *
27 * NO WARRANTY
28 * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
29 * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
30 * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTIBILITY AND FITNESS FOR
31 * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
32 * HOLDERS OR CONTRIBUTORS BE LIABLE FOR SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
33 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
34 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
35 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
36 * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING
37 * IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
38 * POSSIBILITY OF SUCH DAMAGES.
39 *
40 * $FreeBSD$
41 */
42
43VERSION = "$Id: //depot/aic7xxx/aic7xxx/aic79xx.seq#95 $"
44PATCH_ARG_LIST = "struct ahd_softc *ahd"
45PREFIX = "ahd_"
46
47#include "aic79xx.reg"
48#include "scsi_message.h"
49
50restart:
51if ((ahd->bugs & AHD_INTCOLLISION_BUG) != 0) {
52	test	SEQINTCODE, 0xFF jz idle_loop;
53	SET_SEQINTCODE(NO_SEQINT)
54}
55
56idle_loop:
57
58	if ((ahd->bugs & AHD_INTCOLLISION_BUG) != 0) {
59		/*
60		 * Convert ERROR status into a sequencer
61		 * interrupt to handle the case of an
62		 * interrupt collision on the hardware
63		 * setting of HWERR.
64		 */
65		test	ERROR, 0xFF jz no_error_set;
66		SET_SEQINTCODE(SAW_HWERR)
67no_error_set:
68	}
69	SET_MODE(M_SCSI, M_SCSI)
70	test	SCSISEQ0, ENSELO|ENARBO jnz idle_loop_checkbus;
71	test	SEQ_FLAGS2, SELECTOUT_QFROZEN jnz idle_loop_checkbus;
72	cmp	WAITING_TID_HEAD[1], SCB_LIST_NULL je idle_loop_checkbus;
73	/*
74	 * ENSELO is cleared by a SELDO, so we must test for SELDO
75	 * one last time.
76	 */
77BEGIN_CRITICAL;
78	test	SSTAT0, SELDO jnz select_out;
79END_CRITICAL;
80	call	start_selection;
81idle_loop_checkbus:
82BEGIN_CRITICAL;
83	test	SSTAT0, SELDO jnz select_out;
84END_CRITICAL;
85	test	SSTAT0, SELDI jnz select_in;
86	test	SCSIPHASE, ~DATA_PHASE_MASK jz idle_loop_check_nonpackreq;
87	test	SCSISIGO, ATNO jz idle_loop_check_nonpackreq;
88	call	unexpected_nonpkt_phase_find_ctxt;
89idle_loop_check_nonpackreq:
90	test	SSTAT2, NONPACKREQ jz . + 2;
91	call	unexpected_nonpkt_phase_find_ctxt;
92	if ((ahd->bugs & AHD_FAINT_LED_BUG) != 0) {
93		and	A, FIFO0FREE|FIFO1FREE, DFFSTAT;
94		cmp	A, FIFO0FREE|FIFO1FREE jne . + 3;
95		and	SBLKCTL, ~DIAGLEDEN|DIAGLEDON;
96		jmp	. + 2;
97		or	SBLKCTL, DIAGLEDEN|DIAGLEDON;
98	}
99	call	idle_loop_gsfifo_in_scsi_mode;
100	call	idle_loop_service_fifos;
101	call	idle_loop_cchan;
102	jmp	idle_loop;
103
104BEGIN_CRITICAL;
105idle_loop_gsfifo:
106	SET_MODE(M_SCSI, M_SCSI)
107idle_loop_gsfifo_in_scsi_mode:
108	test	LQISTAT2, LQIGSAVAIL jz return;
109	/*
110	 * We have received good status for this transaction.  There may
111	 * still be data in our FIFOs draining to the host.  Complete
112	 * the SCB only if all data has transferred to the host.
113	 */
114good_status_IU_done:
115	bmov	SCBPTR, GSFIFO, 2;
116	clr	SCB_SCSI_STATUS;
117	/*
118	 * If a command completed before an attempted task management
119	 * function completed, notify the host after disabling any
120	 * pending select-outs.
121	 */
122	test	SCB_TASK_MANAGEMENT, 0xFF jz gsfifo_complete_normally;
123	test	SSTAT0, SELDO|SELINGO jnz . + 2;
124	and	SCSISEQ0, ~ENSELO;
125	SET_SEQINTCODE(TASKMGMT_CMD_CMPLT_OKAY)
126gsfifo_complete_normally:
127	or	SCB_CONTROL, STATUS_RCVD;
128
129	/*
130	 * Since this status did not consume a FIFO, we have to
131	 * be a bit more dilligent in how we check for FIFOs pertaining
132	 * to this transaction.  There are two states that a FIFO still
133	 * transferring data may be in.
134	 *
135	 * 1) Configured and draining to the host, with a FIFO handler.
136	 * 2) Pending cfg4data, fifo not empty.
137	 *
138	 * Case 1 can be detected by noticing a non-zero FIFO active
139	 * count in the SCB.  In this case, we allow the routine servicing
140	 * the FIFO to complete the SCB.
141	 *
142	 * Case 2 implies either a pending or yet to occur save data
143	 * pointers for this same context in the other FIFO.  So, if
144	 * we detect case 1, we will properly defer the post of the SCB
145	 * and achieve the desired result.  The pending cfg4data will
146	 * notice that status has been received and complete the SCB.
147	 */
148	test	SCB_FIFO_USE_COUNT, 0xFF jnz idle_loop_gsfifo_in_scsi_mode;
149	call	complete;
150END_CRITICAL;
151	jmp	idle_loop_gsfifo_in_scsi_mode;
152
153idle_loop_service_fifos:
154	SET_MODE(M_DFF0, M_DFF0)
155	test	LONGJMP_ADDR[1], INVALID_ADDR jnz idle_loop_next_fifo;
156	call	longjmp;
157idle_loop_next_fifo:
158	SET_MODE(M_DFF1, M_DFF1)
159	test	LONGJMP_ADDR[1], INVALID_ADDR jz longjmp;
160return:
161	ret;
162
163idle_loop_cchan:
164	SET_MODE(M_CCHAN, M_CCHAN)
165	test	QOFF_CTLSTA, HS_MAILBOX_ACT jz	hs_mailbox_empty;
166	mov	LOCAL_HS_MAILBOX, HS_MAILBOX;
167	or	QOFF_CTLSTA, HS_MAILBOX_ACT;
168hs_mailbox_empty:
169BEGIN_CRITICAL;
170	test	CCSCBCTL, CCARREN|CCSCBEN jz scbdma_idle;
171	test	CCSCBCTL, CCSCBDIR jnz fetch_new_scb_inprog;
172	test	CCSCBCTL, CCSCBDONE jz return;
173END_CRITICAL;
174	/* FALLTHROUGH */
175scbdma_tohost_done:
176	test	CCSCBCTL, CCARREN jz fill_qoutfifo_dmadone;
177	/*
178	 * An SCB has been succesfully uploaded to the host.
179	 * If the SCB was uploaded for some reason other than
180	 * bad SCSI status (currently only for underruns), we
181	 * queue the SCB for normal completion.  Otherwise, we
182	 * wait until any select-out activity has halted, and
183	 * then notify the host so that the transaction can be
184	 * dealt with.
185	 */
186	test	SCB_SCSI_STATUS, 0xff jnz scbdma_notify_host;
187	and	CCSCBCTL, ~(CCARREN|CCSCBEN);
188	bmov	COMPLETE_DMA_SCB_HEAD, SCB_NEXT_COMPLETE, 2;
189	bmov	SCB_NEXT_COMPLETE, COMPLETE_SCB_HEAD, 2;
190	bmov	COMPLETE_SCB_HEAD, SCBPTR, 2 ret;
191scbdma_notify_host:
192	SET_MODE(M_SCSI, M_SCSI)
193	test	SCSISEQ0, ENSELO jnz return;
194	test	SSTAT0, (SELDO|SELINGO) jnz return;
195	SET_MODE(M_CCHAN, M_CCHAN)
196	/*
197	 * Remove SCB and notify host.
198	 */
199	and	CCSCBCTL, ~(CCARREN|CCSCBEN);
200	bmov	COMPLETE_DMA_SCB_HEAD, SCB_NEXT_COMPLETE, 2;
201	SET_SEQINTCODE(BAD_SCB_STATUS)
202	ret;
203fill_qoutfifo_dmadone:
204	and	CCSCBCTL, ~(CCARREN|CCSCBEN);
205	call	qoutfifo_updated;
206	mvi	COMPLETE_SCB_DMAINPROG_HEAD[1], SCB_LIST_NULL;
207	bmov	QOUTFIFO_NEXT_ADDR, SCBHADDR, 4;
208	test	QOFF_CTLSTA, SDSCB_ROLLOVR jz return;
209	bmov	QOUTFIFO_NEXT_ADDR, SHARED_DATA_ADDR, 4;
210	xor	QOUTFIFO_ENTRY_VALID_TAG, QOUTFIFO_ENTRY_VALID_TOGGLE ret;
211
212qoutfifo_updated:
213	/*
214	 * If there are more commands waiting to be dma'ed
215	 * to the host, always coalesce.  Otherwise honor the
216	 * host's wishes.
217	 */
218	cmp	COMPLETE_DMA_SCB_HEAD[1], SCB_LIST_NULL jne coalesce_by_count;
219	cmp	COMPLETE_SCB_HEAD[1], SCB_LIST_NULL jne coalesce_by_count;
220	test	LOCAL_HS_MAILBOX, ENINT_COALESCE jz issue_cmdcmplt;
221
222	/*
223	 * If we have relatively few commands outstanding, don't
224	 * bother waiting for another command to complete.
225	 */
226	test	CMDS_PENDING[1], 0xFF jnz coalesce_by_count;
227	/* Add -1 so that jnc means <= not just < */
228	add	A, -1, INT_COALESCING_MINCMDS;
229	add	NONE, A, CMDS_PENDING;
230	jnc	issue_cmdcmplt;
231
232	/*
233	 * If coalescing, only coalesce up to the limit
234	 * provided by the host driver.
235	 */
236coalesce_by_count:
237	mov	A, INT_COALESCING_MAXCMDS;
238	add	NONE, A, INT_COALESCING_CMDCOUNT;
239	jc	issue_cmdcmplt;
240	/*
241	 * If the timer is not currently active,
242	 * fire it up.
243	 */
244	test	INTCTL, SWTMINTMASK jz return;
245	bmov	SWTIMER, INT_COALESCING_TIMER, 2;
246	mvi	CLRSEQINTSTAT, CLRSEQ_SWTMRTO;
247	or	INTCTL, SWTMINTEN|SWTIMER_START;
248	and	INTCTL, ~SWTMINTMASK ret;
249
250issue_cmdcmplt:
251	mvi	INTSTAT, CMDCMPLT;
252	clr	INT_COALESCING_CMDCOUNT;
253	or	INTCTL, SWTMINTMASK ret;
254
255BEGIN_CRITICAL;
256fetch_new_scb_inprog:
257	test	CCSCBCTL, ARRDONE jz return;
258fetch_new_scb_done:
259	and	CCSCBCTL, ~(CCARREN|CCSCBEN);
260	bmov	REG0, SCBPTR, 2;
261	clr	A;
262	add	CMDS_PENDING, 1;
263	adc	CMDS_PENDING[1], A;
264	if ((ahd->bugs & AHD_PKT_LUN_BUG) != 0) {
265		/*
266		 * "Short Luns" are not placed into outgoing LQ
267		 * packets in the correct byte order.  Use a full
268		 * sized lun field instead and fill it with the
269		 * one byte of lun information we support.
270		 */
271		mov	SCB_PKT_LUN[6], SCB_LUN;
272	}
273	/*
274	 * The FIFO use count field is shared with the
275	 * tag set by the host so that our SCB dma engine
276	 * knows the correct location to store the SCB.
277	 * Set it to zero before processing the SCB.
278	 */
279	mov	SCB_FIFO_USE_COUNT, ALLZEROS;
280	/* Update the next SCB address to download. */
281	bmov	NEXT_QUEUED_SCB_ADDR, SCB_NEXT_SCB_BUSADDR, 4;
282	mvi	SCB_NEXT[1], SCB_LIST_NULL;
283	mvi	SCB_NEXT2[1], SCB_LIST_NULL;
284	/* Increment our position in the QINFIFO. */
285	mov	NONE, SNSCB_QOFF;
286	/*
287	 * SCBs that want to send messages are always
288	 * queued independently.  This ensures that they
289	 * are at the head of the SCB list to select out
290	 * to a target and we will see the MK_MESSAGE flag.
291	 */
292	test	SCB_CONTROL, MK_MESSAGE jnz first_new_target_scb;
293	shr	SINDEX, 3, SCB_SCSIID;
294	and	SINDEX, ~0x1;
295	mvi	SINDEX[1], (WAITING_SCB_TAILS >> 8);
296	bmov	DINDEX, SINDEX, 2;
297	bmov	SCBPTR, SINDIR, 2;
298	bmov	DINDIR, REG0, 2;
299	cmp	SCBPTR[1], SCB_LIST_NULL je first_new_target_scb;
300	bmov	SCB_NEXT, REG0, 2 ret;
301first_new_target_scb:
302	cmp	WAITING_TID_HEAD[1], SCB_LIST_NULL je first_new_scb;
303	bmov	SCBPTR, WAITING_TID_TAIL, 2;
304	bmov	SCB_NEXT2, REG0, 2;
305	bmov	WAITING_TID_TAIL, REG0, 2 ret;
306first_new_scb:
307	bmov	WAITING_TID_HEAD, REG0, 2;
308	bmov	WAITING_TID_TAIL, REG0, 2 ret;
309END_CRITICAL;
310
311scbdma_idle:
312	/*
313	 * Give precedence to downloading new SCBs to execute
314	 * unless select-outs are currently frozen.
315	 */
316	test	SEQ_FLAGS2, SELECTOUT_QFROZEN jnz . + 2;
317BEGIN_CRITICAL;
318	test	QOFF_CTLSTA, NEW_SCB_AVAIL jnz fetch_new_scb;
319	cmp	COMPLETE_DMA_SCB_HEAD[1], SCB_LIST_NULL jne dma_complete_scb;
320	cmp	COMPLETE_SCB_HEAD[1], SCB_LIST_NULL je return;
321	/* FALLTHROUGH */
322fill_qoutfifo:
323	/*
324	 * Keep track of the SCBs we are dmaing just
325	 * in case the DMA fails or is aborted.
326	 */
327	mov	A, QOUTFIFO_ENTRY_VALID_TAG;
328	bmov	COMPLETE_SCB_DMAINPROG_HEAD, COMPLETE_SCB_HEAD, 2;
329	mvi	CCSCBCTL, CCSCBRESET;
330	bmov	SCBHADDR, QOUTFIFO_NEXT_ADDR, 4;
331	bmov	SCBPTR, COMPLETE_SCB_HEAD, 2;
332fill_qoutfifo_loop:
333	mov	CCSCBRAM, SCBPTR;
334	or	CCSCBRAM, A, SCBPTR[1];
335	mov	NONE, SDSCB_QOFF;
336	inc	INT_COALESCING_CMDCOUNT;
337	add	CMDS_PENDING, -1;
338	adc	CMDS_PENDING[1], -1;
339	cmp	SCB_NEXT_COMPLETE[1], SCB_LIST_NULL je fill_qoutfifo_done;
340	cmp	CCSCBADDR, CCSCBADDR_MAX je fill_qoutfifo_done;
341	test	QOFF_CTLSTA, SDSCB_ROLLOVR jnz fill_qoutfifo_done;
342	bmov	SCBPTR, SCB_NEXT_COMPLETE, 2;
343	jmp	fill_qoutfifo_loop;
344fill_qoutfifo_done:
345	mov	SCBHCNT, CCSCBADDR;
346	mvi	CCSCBCTL, CCSCBEN|CCSCBRESET;
347	bmov	COMPLETE_SCB_HEAD, SCB_NEXT_COMPLETE, 2;
348	mvi	SCB_NEXT_COMPLETE[1], SCB_LIST_NULL ret;
349
350fetch_new_scb:
351	bmov	SCBHADDR, NEXT_QUEUED_SCB_ADDR, 4;
352	mvi	CCARREN|CCSCBEN|CCSCBDIR|CCSCBRESET jmp dma_scb;
353dma_complete_scb:
354	bmov	SCBPTR, COMPLETE_DMA_SCB_HEAD, 2;
355	bmov	SCBHADDR, SCB_BUSADDR, 4;
356	mvi	CCARREN|CCSCBEN|CCSCBRESET jmp dma_scb;
357END_CRITICAL;
358
359/*
360 * Either post or fetch an SCB from host memory.  The caller
361 * is responsible for polling for transfer completion.
362 *
363 * Prerequisits: Mode == M_CCHAN
364 *		 SINDEX contains CCSCBCTL flags
365 *		 SCBHADDR set to Host SCB address
366 *		 SCBPTR set to SCB src location on "push" operations
367 */
368SET_SRC_MODE	M_CCHAN;
369SET_DST_MODE	M_CCHAN;
370dma_scb:
371	mvi	SCBHCNT, SCB_TRANSFER_SIZE;
372	mov	CCSCBCTL, SINDEX ret;
373
374BEGIN_CRITICAL;
375setjmp:
376	bmov	LONGJMP_ADDR, STACK, 2 ret;
377setjmp_inline:
378	bmov	LONGJMP_ADDR, STACK, 2;
379longjmp:
380	bmov	STACK, LONGJMP_ADDR, 2 ret;
381END_CRITICAL;
382
383/*************************** Chip Bug Work Arounds ****************************/
384/*
385 * Must disable interrupts when setting the mode pointer
386 * register as an interrupt occurring mid update will
387 * fail to store the new mode value for restoration on
388 * an iret.
389 */
390if ((ahd->bugs & AHD_SET_MODE_BUG) != 0) {
391set_mode_work_around:
392	mvi	SEQINTCTL, INTVEC1DSL;
393	mov	MODE_PTR, SINDEX;
394	clr	SEQINTCTL ret;
395
396toggle_dff_mode_work_around:
397	mvi	SEQINTCTL, INTVEC1DSL;
398	xor	MODE_PTR, MK_MODE(M_DFF1, M_DFF1);
399	clr	SEQINTCTL ret;
400}
401
402
403if ((ahd->bugs & AHD_INTCOLLISION_BUG) != 0) {
404set_seqint_work_around:
405	mov	SEQINTCODE, SINDEX;
406	mvi	SEQINTCODE, NO_SEQINT ret;
407}
408
409/************************ Packetized LongJmp Routines *************************/
410SET_SRC_MODE	M_SCSI;
411SET_DST_MODE	M_SCSI;
412start_selection:
413BEGIN_CRITICAL;
414	if ((ahd->bugs & AHD_SENT_SCB_UPDATE_BUG) != 0) {
415		/*
416		 * Razor #494
417		 * Rev A hardware fails to update LAST/CURR/NEXTSCB
418		 * correctly after a packetized selection in several
419		 * situations:
420		 *
421		 * 1) If only one command existed in the queue, the
422		 *    LAST/CURR/NEXTSCB are unchanged.
423		 *
424		 * 2) In a non QAS, protocol allowed phase change,
425		 *    the queue is shifted 1 too far.  LASTSCB is
426		 *    the last SCB that was correctly processed.
427		 *
428		 * 3) In the QAS case, if the full list of commands
429		 *    was successfully sent, NEXTSCB is NULL and neither
430		 *    CURRSCB nor LASTSCB can be trusted.  We must
431		 *    manually walk the list counting MAXCMDCNT elements
432		 *    to find the last SCB that was sent correctly.
433		 *
434		 * To simplify the workaround for this bug in SELDO
435		 * handling, we initialize LASTSCB prior to enabling
436		 * selection so we can rely on it even for case #1 above.
437		 */
438		bmov	LASTSCB, WAITING_TID_HEAD, 2;
439	}
440	bmov	CURRSCB, WAITING_TID_HEAD, 2;
441	bmov	SCBPTR, WAITING_TID_HEAD, 2;
442	shr	SELOID, 4, SCB_SCSIID;
443	/*
444	 * If we want to send a message to the device, ensure
445	 * we are selecting with atn irregardless of our packetized
446	 * agreement.  Since SPI4 only allows target reset or PPR
447	 * messages if this is a packetized connection, the change
448	 * to our negotiation table entry for this selection will
449	 * be cleared when the message is acted on.
450	 */
451	test	SCB_CONTROL, MK_MESSAGE jz . + 3;
452	mov	NEGOADDR, SELOID;
453	or	NEGCONOPTS, ENAUTOATNO;
454	or	SCSISEQ0, ENSELO ret;
455END_CRITICAL;
456
457/*
458 * Allocate a FIFO for a non-packetized transaction.
459 * In RevA hardware, both FIFOs must be free before we
460 * can allocate a FIFO for a non-packetized transaction.
461 */
462allocate_fifo_loop:
463	/*
464	 * Do whatever work is required to free a FIFO.
465	 */
466	call	idle_loop_service_fifos;
467	SET_MODE(M_SCSI, M_SCSI)
468allocate_fifo:
469	if ((ahd->bugs & AHD_NONPACKFIFO_BUG) != 0) {
470		and	A, FIFO0FREE|FIFO1FREE, DFFSTAT;
471		cmp	A, FIFO0FREE|FIFO1FREE jne allocate_fifo_loop;
472	} else {
473		test	DFFSTAT, FIFO1FREE jnz allocate_fifo1;
474		test	DFFSTAT, FIFO0FREE jz allocate_fifo_loop;
475		mvi	DFFSTAT, B_CURRFIFO_0;
476		SET_MODE(M_DFF0, M_DFF0)
477		bmov	SCBPTR, ALLOCFIFO_SCBPTR, 2 ret;
478	}
479SET_SRC_MODE	M_SCSI;
480SET_DST_MODE	M_SCSI;
481allocate_fifo1:
482	mvi	DFFSTAT, CURRFIFO_1;
483	SET_MODE(M_DFF1, M_DFF1)
484	bmov	SCBPTR, ALLOCFIFO_SCBPTR, 2 ret;
485
486/*
487 * We have been reselected as an initiator
488 * or selected as a target.
489 */
490SET_SRC_MODE	M_SCSI;
491SET_DST_MODE	M_SCSI;
492select_in:
493	if ((ahd->bugs & AHD_BUSFREEREV_BUG) != 0) {
494		/*
495		 * This exposes a window whereby a
496		 * busfree just after a selection will
497		 * be missed, but there is no other safe
498		 * way to enable busfree detection if
499		 * the busfreerev function is broken.
500		 */
501		mvi	CLRSINT1,CLRBUSFREE;
502		or	SIMODE1, ENBUSFREE;
503	}
504	or	SXFRCTL0, SPIOEN;
505	and	SAVED_SCSIID, SELID_MASK, SELID;
506	and	A, OID, IOWNID;
507	or	SAVED_SCSIID, A;
508	mvi	CLRSINT0, CLRSELDI;
509	jmp	ITloop;
510
511/*
512 * We have successfully selected out.
513 *
514 * Clear SELDO.
515 * Dequeue all SCBs sent from the waiting queue
516 * Requeue all SCBs *not* sent to the tail of the waiting queue
517 * Take Razor #494 into account for above.
518 *
519 * In Packetized Mode:
520 *	Return to the idle loop.  Our interrupt handler will take
521 *	care of any incoming L_Qs.
522 *
523 * In Non-Packetize Mode:
524 *	Continue to our normal state machine.
525 */
526SET_SRC_MODE	M_SCSI;
527SET_DST_MODE	M_SCSI;
528select_out:
529BEGIN_CRITICAL;
530	/* Clear out all SCBs that have been successfully sent. */
531	if ((ahd->bugs & AHD_SENT_SCB_UPDATE_BUG) != 0) {
532		/*
533		 * For packetized, the LQO manager clears ENSELO on
534		 * the assertion of SELDO.  If we are non-packetized,
535		 * LASTSCB and CURRSCB are accurate.
536		 */
537		test	SCSISEQ0, ENSELO jnz use_lastscb;
538
539		/*
540		 * The update is correct for LQOSTAT1 errors.  All
541		 * but LQOBUSFREE are handled by kernel interrupts.
542		 * If we see LQOBUSFREE, return to the idle loop.
543		 * Once we are out of the select_out critical section,
544		 * the kernel will cleanup the LQOBUSFREE and we will
545		 * eventually restart the selection if appropriate.
546		 */
547		test	LQOSTAT1, LQOBUSFREE jnz idle_loop;
548
549		/*
550		 * On a phase change oustside of packet boundaries,
551		 * LASTSCB points to the currently active SCB context
552		 * on the bus.
553		 */
554		test	LQOSTAT2, LQOPHACHGOUTPKT jnz use_lastscb;
555
556		/*
557		 * If the hardware has traversed the whole list, NEXTSCB
558		 * will be NULL, CURRSCB and LASTSCB cannot be trusted,
559		 * but MAXCMDCNT is accurate.  If we stop part way through
560		 * the list or only had one command to issue, NEXTSCB[1] is
561		 * not NULL and LASTSCB is the last command to go out.
562		 */
563		cmp	NEXTSCB[1], SCB_LIST_NULL jne use_lastscb;
564
565		/*
566		 * Brute force walk.
567		 */
568		bmov	SCBPTR, WAITING_TID_HEAD, 2;
569		mvi	SEQINTCTL, INTVEC1DSL;
570		mvi	MODE_PTR, MK_MODE(M_CFG, M_CFG);
571		mov	A, MAXCMDCNT;
572		mvi	MODE_PTR, MK_MODE(M_SCSI, M_SCSI);
573		clr	SEQINTCTL;
574find_lastscb_loop:
575		dec	A;
576		test	A, 0xFF jz found_last_sent_scb;
577		bmov	SCBPTR, SCB_NEXT, 2;
578		jmp	find_lastscb_loop;
579use_lastscb:
580		bmov	SCBPTR, LASTSCB, 2;
581found_last_sent_scb:
582		bmov	CURRSCB, SCBPTR, 2;
583curscb_ww_done:
584	} else {
585		bmov	SCBPTR, CURRSCB, 2;
586	}
587
588	/*
589	 * Requeue any SCBs not sent, to the tail of the waiting Q.
590	 */
591	cmp	SCB_NEXT[1], SCB_LIST_NULL je select_out_list_done;
592
593	/*
594	 * We know that neither the per-TID list nor the list of
595	 * TIDs is empty.  Use this knowledge to our advantage.
596	 */
597	bmov	REG0, SCB_NEXT, 2;
598	bmov	SCBPTR, WAITING_TID_TAIL, 2;
599	bmov	SCB_NEXT2, REG0, 2;
600	bmov	WAITING_TID_TAIL, REG0, 2;
601	jmp	select_out_inc_tid_q;
602
603select_out_list_done:
604	/*
605	 * The whole list made it.  Just clear our TID's tail pointer
606	 * unless we were queued independently due to our need to
607	 * send a message.
608	 */
609	test	SCB_CONTROL, MK_MESSAGE jnz select_out_inc_tid_q;
610	shr	DINDEX, 3, SCB_SCSIID;
611	or	DINDEX, 1;	/* Want only the second byte */
612	mvi	DINDEX[1], ((WAITING_SCB_TAILS) >> 8);
613	mvi	DINDIR, SCB_LIST_NULL;
614select_out_inc_tid_q:
615	bmov	SCBPTR, WAITING_TID_HEAD, 2;
616	bmov	WAITING_TID_HEAD, SCB_NEXT2, 2;
617	cmp	WAITING_TID_HEAD[1], SCB_LIST_NULL jne . + 2;
618	mvi	WAITING_TID_TAIL[1], SCB_LIST_NULL;
619	bmov	SCBPTR, CURRSCB, 2;
620	mvi	CLRSINT0, CLRSELDO;
621	test	LQOSTAT2, LQOPHACHGOUTPKT jnz unexpected_nonpkt_phase;
622	test	LQOSTAT1, LQOPHACHGINPKT jnz unexpected_nonpkt_phase;
623
624	/*
625	 * If this is a packetized connection, return to our
626	 * idle_loop and let our interrupt handler deal with
627	 * any connection setup/teardown issues.  The only
628	 * exceptions are the case of MK_MESSAGE and task management
629	 * SCBs.
630	 */
631	if ((ahd->bugs & AHD_LQO_ATNO_BUG) != 0) {
632		/*
633		 * In the A, the LQO manager transitions to LQOSTOP0 even if
634		 * we have selected out with ATN asserted and the target
635		 * REQs in a non-packet phase.
636		 */
637		test 	SCB_CONTROL, MK_MESSAGE jz select_out_no_message;
638		test	SCSISIGO, ATNO jnz select_out_non_packetized;
639select_out_no_message:
640	}
641	test	LQOSTAT2, LQOSTOP0 jz select_out_non_packetized;
642	test	SCB_TASK_MANAGEMENT, 0xFF jz idle_loop;
643	SET_SEQINTCODE(TASKMGMT_FUNC_COMPLETE)
644	jmp	idle_loop;
645
646select_out_non_packetized:
647	/* Non packetized request. */
648	and     SCSISEQ0, ~ENSELO;
649	if ((ahd->bugs & AHD_BUSFREEREV_BUG) != 0) {
650		/*
651		 * This exposes a window whereby a
652		 * busfree just after a selection will
653		 * be missed, but there is no other safe
654		 * way to enable busfree detection if
655		 * the busfreerev function is broken.
656		 */
657		mvi	CLRSINT1,CLRBUSFREE;
658		or	SIMODE1, ENBUSFREE;
659	}
660	mov	SAVED_SCSIID, SCB_SCSIID;
661	mov	SAVED_LUN, SCB_LUN;
662	mvi	SEQ_FLAGS, NO_CDB_SENT;
663END_CRITICAL;
664	or	SXFRCTL0, SPIOEN;
665
666	/*
667	 * As soon as we get a successful selection, the target
668	 * should go into the message out phase since we have ATN
669	 * asserted.
670	 */
671	mvi	MSG_OUT, MSG_IDENTIFYFLAG;
672
673	/*
674	 * Main loop for information transfer phases.  Wait for the
675	 * target to assert REQ before checking MSG, C/D and I/O for
676	 * the bus phase.
677	 */
678mesgin_phasemis:
679ITloop:
680	call	phase_lock;
681
682	mov	A, LASTPHASE;
683
684	test	A, ~P_DATAIN_DT	jz p_data;
685	cmp	A,P_COMMAND	je p_command;
686	cmp	A,P_MESGOUT	je p_mesgout;
687	cmp	A,P_STATUS	je p_status;
688	cmp	A,P_MESGIN	je p_mesgin;
689
690	SET_SEQINTCODE(BAD_PHASE)
691	jmp	ITloop;			/* Try reading the bus again. */
692
693/*
694 * Command phase.  Set up the DMA registers and let 'er rip.
695 */
696p_command:
697	test	SEQ_FLAGS, NOT_IDENTIFIED jz p_command_okay;
698	SET_SEQINTCODE(PROTO_VIOLATION)
699p_command_okay:
700	test	MODE_PTR, ~(MK_MODE(M_DFF1, M_DFF1))
701		jnz p_command_allocate_fifo;
702	/*
703	 * Command retry.  Free our current FIFO and
704	 * re-allocate a FIFO so transfer state is
705	 * reset.
706	 */
707SET_SRC_MODE	M_DFF1;
708SET_DST_MODE	M_DFF1;
709	mvi	DFFSXFRCTL, RSTCHN|CLRSHCNT;
710	SET_MODE(M_SCSI, M_SCSI)
711p_command_allocate_fifo:
712	bmov	ALLOCFIFO_SCBPTR, SCBPTR, 2;
713	call	allocate_fifo;
714SET_SRC_MODE	M_DFF1;
715SET_DST_MODE	M_DFF1;
716	add	NONE, -17, SCB_CDB_LEN;
717	jnc	p_command_embedded;
718p_command_from_host:
719	bmov	HADDR[0], SCB_HOST_CDB_PTR, 9;
720	mvi	SG_CACHE_PRE, LAST_SEG;
721	mvi	DFCNTRL, (PRELOADEN|SCSIEN|HDMAEN);
722	jmp	p_command_xfer;
723p_command_embedded:
724	bmov	SHCNT[0], SCB_CDB_LEN,  1;
725	bmov	DFDAT, SCB_CDB_STORE, 16;
726	mvi	DFCNTRL, SCSIEN;
727p_command_xfer:
728	and	SEQ_FLAGS, ~NO_CDB_SENT;
729	test	DFCNTRL, SCSIEN jnz .;
730	/*
731	 * DMA Channel automatically disabled.
732	 * Don't allow a data phase if the command
733	 * was not fully transferred.
734	 */
735	test	SSTAT2, SDONE jnz ITloop;
736	or	SEQ_FLAGS, NO_CDB_SENT;
737	jmp	ITloop;
738
739
740/*
741 * Status phase.  Wait for the data byte to appear, then read it
742 * and store it into the SCB.
743 */
744SET_SRC_MODE	M_SCSI;
745SET_DST_MODE	M_SCSI;
746p_status:
747	test	SEQ_FLAGS,NOT_IDENTIFIED jnz mesgin_proto_violation;
748p_status_okay:
749	mov	SCB_SCSI_STATUS, SCSIDAT;
750	or	SCB_CONTROL, STATUS_RCVD;
751	jmp	ITloop;
752
753/*
754 * Message out phase.  If MSG_OUT is MSG_IDENTIFYFLAG, build a full
755 * indentify message sequence and send it to the target.  The host may
756 * override this behavior by setting the MK_MESSAGE bit in the SCB
757 * control byte.  This will cause us to interrupt the host and allow
758 * it to handle the message phase completely on its own.  If the bit
759 * associated with this target is set, we will also interrupt the host,
760 * thereby allowing it to send a message on the next selection regardless
761 * of the transaction being sent.
762 *
763 * If MSG_OUT is == HOST_MSG, also interrupt the host and take a message.
764 * This is done to allow the host to send messages outside of an identify
765 * sequence while protecting the seqencer from testing the MK_MESSAGE bit
766 * on an SCB that might not be for the current nexus. (For example, a
767 * BDR message in responce to a bad reselection would leave us pointed to
768 * an SCB that doesn't have anything to do with the current target).
769 *
770 * Otherwise, treat MSG_OUT as a 1 byte message to send (abort, abort tag,
771 * bus device reset).
772 *
773 * When there are no messages to send, MSG_OUT should be set to MSG_NOOP,
774 * in case the target decides to put us in this phase for some strange
775 * reason.
776 */
777p_mesgout_retry:
778	/* Turn on ATN for the retry */
779	mvi	SCSISIGO, ATNO;
780p_mesgout:
781	mov	SINDEX, MSG_OUT;
782	cmp	SINDEX, MSG_IDENTIFYFLAG jne p_mesgout_from_host;
783	test	SCB_CONTROL,MK_MESSAGE	jnz host_message_loop;
784p_mesgout_identify:
785	or	SINDEX, MSG_IDENTIFYFLAG|DISCENB, SCB_LUN;
786	test	SCB_CONTROL, DISCENB jnz . + 2;
787	and	SINDEX, ~DISCENB;
788/*
789 * Send a tag message if TAG_ENB is set in the SCB control block.
790 * Use SCB_NONPACKET_TAG as the tag value.
791 */
792p_mesgout_tag:
793	test	SCB_CONTROL,TAG_ENB jz  p_mesgout_onebyte;
794	mov	SCSIDAT, SINDEX;	/* Send the identify message */
795	call	phase_lock;
796	cmp	LASTPHASE, P_MESGOUT	jne p_mesgout_done;
797	and	SCSIDAT,TAG_ENB|SCB_TAG_TYPE,SCB_CONTROL;
798	call	phase_lock;
799	cmp	LASTPHASE, P_MESGOUT	jne p_mesgout_done;
800	mov	SCBPTR jmp p_mesgout_onebyte;
801/*
802 * Interrupt the driver, and allow it to handle this message
803 * phase and any required retries.
804 */
805p_mesgout_from_host:
806	cmp	SINDEX, HOST_MSG	jne p_mesgout_onebyte;
807	jmp	host_message_loop;
808
809p_mesgout_onebyte:
810	mvi	CLRSINT1, CLRATNO;
811	mov	SCSIDAT, SINDEX;
812
813/*
814 * If the next bus phase after ATN drops is message out, it means
815 * that the target is requesting that the last message(s) be resent.
816 */
817	call	phase_lock;
818	cmp	LASTPHASE, P_MESGOUT	je p_mesgout_retry;
819
820p_mesgout_done:
821	mvi	CLRSINT1,CLRATNO;	/* Be sure to turn ATNO off */
822	mov	LAST_MSG, MSG_OUT;
823	mvi	MSG_OUT, MSG_NOOP;	/* No message left */
824	jmp	ITloop;
825
826/*
827 * Message in phase.  Bytes are read using Automatic PIO mode.
828 */
829p_mesgin:
830	/* read the 1st message byte */
831	mvi	ACCUM		call inb_first;
832
833	test	A,MSG_IDENTIFYFLAG	jnz mesgin_identify;
834	cmp	A,MSG_DISCONNECT	je mesgin_disconnect;
835	cmp	A,MSG_SAVEDATAPOINTER	je mesgin_sdptrs;
836	cmp	ALLZEROS,A		je mesgin_complete;
837	cmp	A,MSG_RESTOREPOINTERS	je mesgin_rdptrs;
838	cmp	A,MSG_IGN_WIDE_RESIDUE	je mesgin_ign_wide_residue;
839	cmp	A,MSG_NOOP		je mesgin_done;
840
841/*
842 * Pushed message loop to allow the kernel to
843 * run it's own message state engine.  To avoid an
844 * extra nop instruction after signaling the kernel,
845 * we perform the phase_lock before checking to see
846 * if we should exit the loop and skip the phase_lock
847 * in the ITloop.  Performing back to back phase_locks
848 * shouldn't hurt, but why do it twice...
849 */
850host_message_loop:
851	call	phase_lock;	/* Benign the first time through. */
852	SET_SEQINTCODE(HOST_MSG_LOOP)
853	cmp	RETURN_1, EXIT_MSG_LOOP	je ITloop;
854	cmp	RETURN_1, CONT_MSG_LOOP_WRITE	jne . + 3;
855	mov	SCSIDAT, RETURN_2;
856	jmp	host_message_loop;
857	/* Must be CONT_MSG_LOOP_READ */
858	mov	NONE, SCSIDAT;	/* ACK Byte */
859	jmp	host_message_loop;
860
861mesgin_ign_wide_residue:
862	mov	SAVED_MODE, MODE_PTR;
863	SET_MODE(M_SCSI, M_SCSI)
864	shr	NEGOADDR, 4, SAVED_SCSIID;
865	mov	A, NEGCONOPTS;
866	RESTORE_MODE(SAVED_MODE)
867	test	A, WIDEXFER jz mesgin_reject;
868	/* Pull the residue byte */
869	mvi	REG0	call inb_next;
870	cmp	REG0, 0x01 jne mesgin_reject;
871	test	SCB_RESIDUAL_SGPTR[0], SG_LIST_NULL jz . + 2;
872	test	SCB_TASK_ATTRIBUTE, SCB_XFERLEN_ODD jnz mesgin_done;
873	SET_SEQINTCODE(IGN_WIDE_RES)
874	jmp	mesgin_done;
875
876mesgin_proto_violation:
877	SET_SEQINTCODE(PROTO_VIOLATION)
878	jmp	mesgin_done;
879mesgin_reject:
880	mvi	MSG_MESSAGE_REJECT	call mk_mesg;
881mesgin_done:
882	mov	NONE,SCSIDAT;		/*dummy read from latch to ACK*/
883	jmp	ITloop;
884
885#define INDEX_DISC_LIST(scsiid, lun)					\
886	and	A, 0xC0, scsiid;					\
887	or	SCBPTR, A, lun;						\
888	clr	SCBPTR[1];						\
889	and	SINDEX, 0x30, scsiid;					\
890	shr	SINDEX, 3;	/* Multiply by 2 */			\
891	add	SINDEX, (SCB_DISCONNECTED_LISTS & 0xFF);		\
892	mvi	SINDEX[1], ((SCB_DISCONNECTED_LISTS >> 8) & 0xFF)
893
894mesgin_identify:
895	/*
896	 * Determine whether a target is using tagged or non-tagged
897	 * transactions by first looking at the transaction stored in
898	 * the per-device, disconnected array.  If there is no untagged
899	 * transaction for this target, this must be a tagged transaction.
900	 */
901	and	SAVED_LUN, MSG_IDENTIFY_LUNMASK, A;
902	INDEX_DISC_LIST(SAVED_SCSIID, SAVED_LUN);
903	bmov	DINDEX, SINDEX, 2;
904	bmov	REG0, SINDIR, 2;
905	cmp	REG0[1], SCB_LIST_NULL je snoop_tag;
906	/* Untagged.  Clear the busy table entry and setup the SCB. */
907	bmov	DINDIR, ALLONES, 2;
908	bmov	SCBPTR, REG0, 2;
909	jmp	setup_SCB;
910
911/*
912 * Here we "snoop" the bus looking for a SIMPLE QUEUE TAG message.
913 * If we get one, we use the tag returned to find the proper
914 * SCB.  After receiving the tag, look for the SCB at SCB locations tag and
915 * tag + 256.
916 */
917snoop_tag:
918	if ((ahd->flags & AHD_SEQUENCER_DEBUG) != 0) {
919		or	SEQ_FLAGS, 0x80;
920	}
921	mov	NONE, SCSIDAT;		/* ACK Identify MSG */
922	call	phase_lock;
923	if ((ahd->flags & AHD_SEQUENCER_DEBUG) != 0) {
924		or	SEQ_FLAGS, 0x1;
925	}
926	cmp	LASTPHASE, P_MESGIN	jne not_found_ITloop;
927	if ((ahd->flags & AHD_SEQUENCER_DEBUG) != 0) {
928		or	SEQ_FLAGS, 0x2;
929	}
930	cmp	SCSIBUS, MSG_SIMPLE_Q_TAG jne not_found;
931get_tag:
932	clr	SCBPTR[1];
933	mvi	SCBPTR	call inb_next;	/* tag value */
934verify_scb:
935	test	SCB_CONTROL,DISCONNECTED jz verify_other_scb;
936	mov	A, SAVED_SCSIID;
937	cmp	SCB_SCSIID, A jne verify_other_scb;
938	mov	A, SAVED_LUN;
939	cmp	SCB_LUN, A je setup_SCB_disconnected;
940verify_other_scb:
941	xor	SCBPTR[1], 1;
942	test	SCBPTR[1], 0xFF jnz verify_scb;
943	jmp	not_found;
944
945/*
946 * Ensure that the SCB the tag points to is for
947 * an SCB transaction to the reconnecting target.
948 */
949setup_SCB:
950	if ((ahd->flags & AHD_SEQUENCER_DEBUG) != 0) {
951		or	SEQ_FLAGS, 0x10;
952	}
953	test	SCB_CONTROL,DISCONNECTED jz not_found;
954setup_SCB_disconnected:
955	and	SCB_CONTROL,~DISCONNECTED;
956	clr	SEQ_FLAGS;	/* make note of IDENTIFY */
957	test	SCB_SGPTR, SG_LIST_NULL jnz . + 3;
958	bmov	ALLOCFIFO_SCBPTR, SCBPTR, 2;
959	call	allocate_fifo;
960	/* See if the host wants to send a message upon reconnection */
961	test	SCB_CONTROL, MK_MESSAGE jz mesgin_done;
962	mvi	HOST_MSG	call mk_mesg;
963	jmp	mesgin_done;
964
965not_found:
966	SET_SEQINTCODE(NO_MATCH)
967	jmp	mesgin_done;
968
969not_found_ITloop:
970	SET_SEQINTCODE(NO_MATCH)
971	jmp	ITloop;
972
973/*
974 * We received a "command complete" message.  Put the SCB on the complete
975 * queue and trigger a completion interrupt via the idle loop.  Before doing
976 * so, check to see if there
977 * is a residual or the status byte is something other than STATUS_GOOD (0).
978 * In either of these conditions, we upload the SCB back to the host so it can
979 * process this information.  In the case of a non zero status byte, we
980 * additionally interrupt the kernel driver synchronously, allowing it to
981 * decide if sense should be retrieved.  If the kernel driver wishes to request
982 * sense, it will fill the kernel SCB with a request sense command, requeue
983 * it to the QINFIFO and tell us not to post to the QOUTFIFO by setting
984 * RETURN_1 to SEND_SENSE.
985 */
986mesgin_complete:
987
988	/*
989	 * If ATN is raised, we still want to give the target a message.
990	 * Perhaps there was a parity error on this last message byte.
991	 * Either way, the target should take us to message out phase
992	 * and then attempt to complete the command again.  We should use a
993	 * critical section here to guard against a timeout triggering
994	 * for this command and setting ATN while we are still processing
995	 * the completion.
996	test	SCSISIGI, ATNI jnz mesgin_done;
997	 */
998
999	/*
1000	 * If we are identified and have successfully sent the CDB,
1001	 * any status will do.  Optimize this fast path.
1002	 */
1003	test	SCB_CONTROL, STATUS_RCVD jz mesgin_proto_violation;
1004	test	SEQ_FLAGS, NOT_IDENTIFIED|NO_CDB_SENT jz complete_accepted;
1005
1006	/*
1007	 * If the target never sent an identify message but instead went
1008	 * to mesgin to give an invalid message, let the host abort us.
1009	 */
1010	test	SEQ_FLAGS, NOT_IDENTIFIED jnz mesgin_proto_violation;
1011
1012	/*
1013	 * If we recevied good status but never successfully sent the
1014	 * cdb, abort the command.
1015	 */
1016	test	SCB_SCSI_STATUS,0xff	jnz complete_accepted;
1017	test	SEQ_FLAGS, NO_CDB_SENT jnz mesgin_proto_violation;
1018complete_accepted:
1019
1020	/*
1021	 * See if we attempted to deliver a message but the target ingnored us.
1022	 */
1023	test	SCB_CONTROL, MK_MESSAGE jz complete_nomsg;
1024	SET_SEQINTCODE(MKMSG_FAILED)
1025complete_nomsg:
1026	call	queue_scb_completion;
1027	jmp	await_busfree;
1028
1029freeze_queue:
1030	/* Cancel any pending select-out. */
1031	test	SSTAT0, SELDO|SELINGO jnz . + 2;
1032	and	SCSISEQ0, ~ENSELO;
1033	mov	ACCUM_SAVE, A;
1034	clr	A;
1035	add	QFREEZE_COUNT, 1;
1036	adc	QFREEZE_COUNT[1], A;
1037	or	SEQ_FLAGS2, SELECTOUT_QFROZEN;
1038	mov	A, ACCUM_SAVE ret;
1039
1040/*
1041 * Complete the current FIFO's SCB if data for this same
1042 * SCB is not transferring in the other FIFO.
1043 */
1044SET_SRC_MODE	M_DFF1;
1045SET_DST_MODE	M_DFF1;
1046pkt_complete_scb_if_fifos_idle:
1047	bmov	ARG_1, SCBPTR, 2;
1048	mvi	DFFSXFRCTL, CLRCHN;
1049	SET_MODE(M_SCSI, M_SCSI)
1050	bmov	SCBPTR, ARG_1, 2;
1051	test	SCB_FIFO_USE_COUNT, 0xFF jnz return;
1052queue_scb_completion:
1053	test	SCB_SCSI_STATUS,0xff	jnz bad_status;
1054	/*
1055	 * Check for residuals
1056	 */
1057	test	SCB_SGPTR, SG_LIST_NULL jnz complete;	/* No xfer */
1058	test	SCB_SGPTR, SG_FULL_RESID jnz upload_scb;/* Never xfered */
1059	test	SCB_RESIDUAL_SGPTR, SG_LIST_NULL jz upload_scb;
1060complete:
1061	bmov	SCB_NEXT_COMPLETE, COMPLETE_SCB_HEAD, 2;
1062	bmov	COMPLETE_SCB_HEAD, SCBPTR, 2 ret;
1063bad_status:
1064	cmp	SCB_SCSI_STATUS, STATUS_PKT_SENSE je upload_scb;
1065	call	freeze_queue;
1066upload_scb:
1067	/*
1068	 * Restore SCB TAG since we reuse this field
1069	 * in the sequencer.  We don't want to corrupt
1070	 * it on the host.
1071	 */
1072	bmov	SCB_TAG, SCBPTR, 2;
1073	bmov	SCB_NEXT_COMPLETE, COMPLETE_DMA_SCB_HEAD, 2;
1074	bmov	COMPLETE_DMA_SCB_HEAD, SCBPTR, 2;
1075	or	SCB_SGPTR, SG_STATUS_VALID ret;
1076
1077/*
1078 * Is it a disconnect message?  Set a flag in the SCB to remind us
1079 * and await the bus going free.  If this is an untagged transaction
1080 * store the SCB id for it in our untagged target table for lookup on
1081 * a reselction.
1082 */
1083mesgin_disconnect:
1084	/*
1085	 * If ATN is raised, we still want to give the target a message.
1086	 * Perhaps there was a parity error on this last message byte
1087	 * or we want to abort this command.  Either way, the target
1088	 * should take us to message out phase and then attempt to
1089	 * disconnect again.
1090	 * XXX - Wait for more testing.
1091	test	SCSISIGI, ATNI jnz mesgin_done;
1092	 */
1093	test	SEQ_FLAGS, NOT_IDENTIFIED|NO_CDB_SENT
1094		jnz mesgin_proto_violation;
1095	or	SCB_CONTROL,DISCONNECTED;
1096	test	SCB_CONTROL, TAG_ENB jnz await_busfree;
1097queue_disc_scb:
1098	bmov	REG0, SCBPTR, 2;
1099	INDEX_DISC_LIST(SAVED_SCSIID, SAVED_LUN);
1100	bmov	DINDEX, SINDEX, 2;
1101	bmov	DINDIR, REG0, 2;
1102	bmov	SCBPTR, REG0, 2;
1103	/* FALLTHROUGH */
1104await_busfree:
1105	and	SIMODE1, ~ENBUSFREE;
1106	if ((ahd->bugs & AHD_BUSFREEREV_BUG) == 0) {
1107		/*
1108		 * In the BUSFREEREV_BUG case, the
1109		 * busfree status was cleared at the
1110		 * beginning of the connection.
1111		 */
1112		mvi	CLRSINT1,CLRBUSFREE;
1113	}
1114	mov	NONE, SCSIDAT;		/* Ack the last byte */
1115	test	MODE_PTR, ~(MK_MODE(M_DFF1, M_DFF1))
1116		jnz await_busfree_not_m_dff;
1117SET_SRC_MODE	M_DFF1;
1118SET_DST_MODE	M_DFF1;
1119await_busfree_clrchn:
1120	mvi	DFFSXFRCTL, CLRCHN;
1121await_busfree_not_m_dff:
1122	call	clear_target_state;
1123	test	SSTAT1,REQINIT|BUSFREE	jz .;
1124	test	SSTAT1, BUSFREE jnz idle_loop;
1125	SET_SEQINTCODE(MISSED_BUSFREE)
1126
1127
1128/*
1129 * Save data pointers message:
1130 * Copying RAM values back to SCB, for Save Data Pointers message, but
1131 * only if we've actually been into a data phase to change them.  This
1132 * protects against bogus data in scratch ram and the residual counts
1133 * since they are only initialized when we go into data_in or data_out.
1134 * Ack the message as soon as possible.
1135 */
1136SET_SRC_MODE	M_DFF1;
1137SET_DST_MODE	M_DFF1;
1138mesgin_sdptrs:
1139	mov	NONE,SCSIDAT;		/*dummy read from latch to ACK*/
1140	test	SEQ_FLAGS, DPHASE	jz ITloop;
1141	call	save_pointers;
1142	jmp	ITloop;
1143
1144save_pointers:
1145	/*
1146	 * If we are asked to save our position at the end of the
1147	 * transfer, just mark us at the end rather than perform a
1148	 * full save.
1149	 */
1150	test	SCB_RESIDUAL_SGPTR[0], SG_LIST_NULL jz save_pointers_full;
1151	or	SCB_SGPTR, SG_LIST_NULL ret;
1152
1153save_pointers_full:
1154	/*
1155	 * The SCB_DATAPTR becomes the current SHADDR.
1156	 * All other information comes directly from our residual
1157	 * state.
1158	 */
1159	bmov	SCB_DATAPTR, SHADDR, 8;
1160	bmov	SCB_DATACNT, SCB_RESIDUAL_DATACNT, 8 ret;
1161
1162/*
1163 * Restore pointers message?  Data pointers are recopied from the
1164 * SCB anytime we enter a data phase for the first time, so all
1165 * we need to do is clear the DPHASE flag and let the data phase
1166 * code do the rest.  We also reset/reallocate the FIFO to make
1167 * sure we have a clean start for the next data or command phase.
1168 */
1169mesgin_rdptrs:
1170	and	SEQ_FLAGS, ~DPHASE;
1171	test	MODE_PTR, ~(MK_MODE(M_DFF1, M_DFF1)) jnz msgin_rdptrs_get_fifo;
1172	mvi	DFFSXFRCTL, RSTCHN|CLRSHCNT;
1173	SET_MODE(M_SCSI, M_SCSI)
1174msgin_rdptrs_get_fifo:
1175	call	allocate_fifo;
1176	jmp	mesgin_done;
1177
1178clear_target_state:
1179	mvi	LASTPHASE, P_BUSFREE;
1180	/* clear target specific flags */
1181	mvi	SEQ_FLAGS, NOT_IDENTIFIED|NO_CDB_SENT ret;
1182
1183phase_lock:
1184	if ((ahd->bugs & AHD_EARLY_REQ_BUG) != 0) {
1185		/*
1186		 * Don't ignore persistent REQ assertions just because
1187		 * they were asserted within the bus settle delay window.
1188		 * This allows us to tolerate devices like the GEM318
1189		 * that violate the SCSI spec.  We are careful not to
1190		 * count REQ while we are waiting for it to fall during
1191		 * an async phase due to our asserted ACK.  Each
1192		 * sequencer instruction takes ~25ns, so the REQ must
1193		 * last at least 100ns in order to be counted as a true
1194		 * REQ.
1195		 */
1196		test	SCSIPHASE, 0xFF jnz phase_locked;
1197		test	SCSISIGI, ACKI jnz phase_lock;
1198		test	SCSISIGI, REQI jz phase_lock;
1199		test	SCSIPHASE, 0xFF jnz phase_locked;
1200		test	SCSISIGI, ACKI jnz phase_lock;
1201		test	SCSISIGI, REQI jz phase_lock;
1202phase_locked:
1203	} else {
1204		test	SCSIPHASE, 0xFF jz .;
1205	}
1206	test	SSTAT1, SCSIPERR jnz phase_lock;
1207phase_lock_latch_phase:
1208	and	LASTPHASE, PHASE_MASK, SCSISIGI ret;
1209
1210/*
1211 * Functions to read data in Automatic PIO mode.
1212 *
1213 * An ACK is not sent on input from the target until SCSIDATL is read from.
1214 * So we wait until SCSIDATL is latched (the usual way), then read the data
1215 * byte directly off the bus using SCSIBUSL.  When we have pulled the ATN
1216 * line, or we just want to acknowledge the byte, then we do a dummy read
1217 * from SCISDATL.  The SCSI spec guarantees that the target will hold the
1218 * data byte on the bus until we send our ACK.
1219 *
1220 * The assumption here is that these are called in a particular sequence,
1221 * and that REQ is already set when inb_first is called.  inb_{first,next}
1222 * use the same calling convention as inb.
1223 */
1224inb_next:
1225	mov	NONE,SCSIDAT;		/*dummy read from latch to ACK*/
1226inb_next_wait:
1227	/*
1228	 * If there is a parity error, wait for the kernel to
1229	 * see the interrupt and prepare our message response
1230	 * before continuing.
1231	 */
1232	test	SCSIPHASE, 0xFF jz .;
1233	test	SSTAT1, SCSIPERR jnz inb_next_wait;
1234inb_next_check_phase:
1235	and	LASTPHASE, PHASE_MASK, SCSISIGI;
1236	cmp	LASTPHASE, P_MESGIN jne mesgin_phasemis;
1237inb_first:
1238	clr	DINDEX[1];
1239	mov	DINDEX,SINDEX;
1240	mov	DINDIR,SCSIBUS	ret;		/*read byte directly from bus*/
1241inb_last:
1242	mov	NONE,SCSIDAT ret;		/*dummy read from latch to ACK*/
1243
1244mk_mesg:
1245	mvi	SCSISIGO, ATNO;
1246	mov	MSG_OUT,SINDEX ret;
1247
1248SET_SRC_MODE	M_DFF1;
1249SET_DST_MODE	M_DFF1;
1250disable_ccsgen:
1251	test	SG_STATE, FETCH_INPROG jz disable_ccsgen_fetch_done;
1252	clr	CCSGCTL;
1253disable_ccsgen_fetch_done:
1254	clr	SG_STATE ret;
1255
1256service_fifo:
1257	/*
1258	 * Do we have any prefetch left???
1259	 */
1260	test	SG_STATE, SEGS_AVAIL jnz idle_sg_avail;
1261
1262	/*
1263	 * Can this FIFO have access to the S/G cache yet?
1264	 */
1265	test	CCSGCTL, SG_CACHE_AVAIL jz return;
1266
1267	/* Did we just finish fetching segs? */
1268	test	CCSGCTL, CCSGDONE jnz idle_sgfetch_complete;
1269
1270	/* Are we actively fetching segments? */
1271	test	CCSGCTL, CCSGENACK jnz return;
1272
1273	/*
1274	 * We fetch a "cacheline aligned" and sized amount of data
1275	 * so we don't end up referencing a non-existant page.
1276	 * Cacheline aligned is in quotes because the kernel will
1277	 * set the prefetch amount to a reasonable level if the
1278	 * cacheline size is unknown.
1279	 */
1280	bmov	SGHADDR, SCB_RESIDUAL_SGPTR, 4;
1281	mvi	SGHCNT, SG_PREFETCH_CNT;
1282	if ((ahd->bugs & AHD_REG_SLOW_SETTLE_BUG) != 0) {
1283		/*
1284		 * Need two instruction between "touches" of SGHADDR.
1285		 */
1286		nop;
1287	}
1288	and	SGHADDR[0], SG_PREFETCH_ALIGN_MASK, SCB_RESIDUAL_SGPTR;
1289	mvi	CCSGCTL, CCSGEN|CCSGRESET;
1290	or	SG_STATE, FETCH_INPROG ret;
1291idle_sgfetch_complete:
1292	/*
1293	 * Guard against SG_CACHE_AVAIL activating during sg fetch
1294	 * request in the other FIFO.
1295	 */
1296	test	SG_STATE, FETCH_INPROG jz return;
1297	clr	CCSGCTL;
1298	and	CCSGADDR, SG_PREFETCH_ADDR_MASK, SCB_RESIDUAL_SGPTR;
1299	mvi	SG_STATE, SEGS_AVAIL|LOADING_NEEDED;
1300idle_sg_avail:
1301	/* Does the hardware have space for another SG entry? */
1302	test	DFSTATUS, PRELOAD_AVAIL jz return;
1303	/*
1304	 * On the A, preloading a segment before HDMAENACK
1305	 * comes true can clobber the shaddow address of the
1306	 * first segment in the S/G FIFO.  Wait until it is
1307	 * safe to proceed.
1308	 */
1309	if ((ahd->features & AHD_NEW_DFCNTRL_OPTS) == 0) {
1310		test	DFCNTRL, HDMAENACK jz return;
1311	}
1312	if ((ahd->flags & AHD_64BIT_ADDRESSING) != 0) {
1313		bmov	HADDR, CCSGRAM, 8;
1314	} else {
1315		bmov 	HADDR, CCSGRAM, 4;
1316	}
1317	bmov	HCNT, CCSGRAM, 3;
1318	bmov	SCB_RESIDUAL_DATACNT[3], CCSGRAM, 1;
1319	if ((ahd->flags & AHD_39BIT_ADDRESSING) != 0) {
1320		and	HADDR[4], SG_HIGH_ADDR_BITS, SCB_RESIDUAL_DATACNT[3];
1321	}
1322	if ((ahd->flags & AHD_64BIT_ADDRESSING) != 0) {
1323		/* Skip 4 bytes of pad. */
1324		add	CCSGADDR, 4;
1325	}
1326sg_advance:
1327	clr	A;			/* add sizeof(struct scatter) */
1328	add	SCB_RESIDUAL_SGPTR[0],SG_SIZEOF;
1329	adc	SCB_RESIDUAL_SGPTR[1],A;
1330	adc	SCB_RESIDUAL_SGPTR[2],A;
1331	adc	SCB_RESIDUAL_SGPTR[3],A;
1332	mov	SINDEX, SCB_RESIDUAL_SGPTR[0];
1333	test	SCB_RESIDUAL_DATACNT[3], SG_LAST_SEG jz . + 3;
1334	or	SINDEX, LAST_SEG;
1335	clr	SG_STATE;
1336	mov	SG_CACHE_PRE, SINDEX;
1337	if ((ahd->features & AHD_NEW_DFCNTRL_OPTS) != 0) {
1338		/*
1339		 * Use SCSIENWRDIS so that SCSIEN is never
1340		 * modified by this operation.
1341		 */
1342		or	DFCNTRL, PRELOADEN|HDMAEN|SCSIENWRDIS;
1343	} else {
1344		or	DFCNTRL, PRELOADEN|HDMAEN;
1345	}
1346	/*
1347	 * Do we have another segment in the cache?
1348	 */
1349	add	NONE, SG_PREFETCH_CNT_LIMIT, CCSGADDR;
1350	jnc	return;
1351	and	SG_STATE, ~SEGS_AVAIL ret;
1352
1353/*
1354 * Initialize the DMA address and counter from the SCB.
1355 */
1356load_first_seg:
1357	bmov	HADDR, SCB_DATAPTR, 11;
1358	and	REG_ISR, ~SG_FULL_RESID, SCB_SGPTR[0];
1359	test	SCB_DATACNT[3], SG_LAST_SEG jz . + 2;
1360	or	REG_ISR, LAST_SEG;
1361	mov	SG_CACHE_PRE, REG_ISR;
1362	mvi	DFCNTRL, (PRELOADEN|SCSIEN|HDMAEN);
1363	/*
1364	 * Since we've are entering a data phase, we will
1365	 * rely on the SCB_RESID* fields.  Initialize the
1366	 * residual and clear the full residual flag.
1367	 */
1368	and	SCB_SGPTR[0], ~SG_FULL_RESID;
1369	bmov	SCB_RESIDUAL_DATACNT[3], SCB_DATACNT[3], 5;
1370	/* If we need more S/G elements, tell the idle loop */
1371	test	SCB_RESIDUAL_DATACNT[3], SG_LAST_SEG jnz . + 2;
1372	mvi	SG_STATE, LOADING_NEEDED ret;
1373	clr	SG_STATE ret;
1374
1375p_data_handle_xfer:
1376	call	setjmp;
1377	test	SG_STATE, LOADING_NEEDED jnz service_fifo;
1378p_data_clear_handler:
1379	or	LONGJMP_ADDR[1], INVALID_ADDR ret;
1380
1381p_data:
1382	test	SEQ_FLAGS, NOT_IDENTIFIED|NO_CDB_SENT	jz p_data_allowed;
1383	SET_SEQINTCODE(PROTO_VIOLATION)
1384p_data_allowed:
1385
1386	test	SEQ_FLAGS, DPHASE	jz data_phase_initialize;
1387
1388	/*
1389	 * If we re-enter the data phase after going through another
1390	 * phase, our transfer location has almost certainly been
1391	 * corrupted by the interveining, non-data, transfers.  Ask
1392	 * the host driver to fix us up based on the transfer residual
1393	 * unless we already know that we should be bitbucketing.
1394	 */
1395	test	SCB_RESIDUAL_SGPTR[0], SG_LIST_NULL jnz p_data_bitbucket;
1396	SET_SEQINTCODE(PDATA_REINIT)
1397	jmp	data_phase_inbounds;
1398
1399p_data_bitbucket:
1400	/*
1401	 * Turn on `Bit Bucket' mode, wait until the target takes
1402	 * us to another phase, and then notify the host.
1403	 */
1404	mov	SAVED_MODE, MODE_PTR;
1405	test	MODE_PTR, ~(MK_MODE(M_DFF1, M_DFF1))
1406		jnz bitbucket_not_m_dff;
1407	/*
1408	 * Ensure that any FIFO contents are cleared out and the
1409	 * FIFO free'd prior to starting the BITBUCKET.  BITBUCKET
1410	 * doesn't discard data already in the FIFO.
1411	 */
1412	mvi	DFFSXFRCTL, RSTCHN|CLRSHCNT;
1413	SET_MODE(M_SCSI, M_SCSI)
1414bitbucket_not_m_dff:
1415	or	SXFRCTL1,BITBUCKET;
1416	/* Wait for non-data phase. */
1417	test	SCSIPHASE, ~DATA_PHASE_MASK jz .;
1418	and	SXFRCTL1, ~BITBUCKET;
1419	RESTORE_MODE(SAVED_MODE)
1420SET_SRC_MODE	M_DFF1;
1421SET_DST_MODE	M_DFF1;
1422	SET_SEQINTCODE(DATA_OVERRUN)
1423	jmp	ITloop;
1424
1425data_phase_initialize:
1426	test	SCB_SGPTR[0], SG_LIST_NULL jnz p_data_bitbucket;
1427	call	load_first_seg;
1428data_phase_inbounds:
1429	/* We have seen a data phase at least once. */
1430	or	SEQ_FLAGS, DPHASE;
1431	mov	SAVED_MODE, MODE_PTR;
1432	test	SG_STATE, LOADING_NEEDED jz data_group_dma_loop;
1433	call	p_data_handle_xfer;
1434data_group_dma_loop:
1435	/*
1436	 * The transfer is complete if either the last segment
1437	 * completes or the target changes phase.  Both conditions
1438	 * will clear SCSIEN.
1439	 */
1440	call	idle_loop_service_fifos;
1441	call	idle_loop_cchan;
1442	call	idle_loop_gsfifo;
1443	RESTORE_MODE(SAVED_MODE)
1444	test	DFCNTRL, SCSIEN jnz data_group_dma_loop;
1445
1446data_group_dmafinish:
1447	/*
1448	 * The transfer has terminated either due to a phase
1449	 * change, and/or the completion of the last segment.
1450	 * We have two goals here.  Do as much other work
1451	 * as possible while the data fifo drains on a read
1452	 * and respond as quickly as possible to the standard
1453	 * messages (save data pointers/disconnect and command
1454	 * complete) that usually follow a data phase.
1455	 */
1456	call	calc_residual;
1457
1458	/*
1459	 * Go ahead and shut down the DMA engine now.
1460	 */
1461	test	DFCNTRL, DIRECTION jnz data_phase_finish;
1462data_group_fifoflush:
1463	if ((ahd->bugs & AHD_AUTOFLUSH_BUG) != 0) {
1464		or	DFCNTRL, FIFOFLUSH;
1465	}
1466	/*
1467	 * We have enabled the auto-ack feature.  This means
1468	 * that the controller may have already transferred
1469	 * some overrun bytes into the data FIFO and acked them
1470	 * on the bus.  The only way to detect this situation is
1471	 * to wait for LAST_SEG_DONE to come true on a completed
1472	 * transfer and then test to see if the data FIFO is
1473	 * non-empty.  We know there is more data yet to transfer
1474	 * if SG_LIST_NULL is not yet set, thus there cannot be
1475	 * an overrun.
1476	 */
1477	test	SCB_RESIDUAL_SGPTR[0], SG_LIST_NULL jz data_phase_finish;
1478	test	SG_CACHE_SHADOW, LAST_SEG_DONE jz .;
1479	test	DFSTATUS, FIFOEMP jnz data_phase_finish;
1480	/* Overrun */
1481	jmp	p_data;
1482data_phase_finish:
1483	/*
1484	 * If the target has left us in data phase, loop through
1485	 * the dma code again.  We will only loop if there is a
1486	 * data overrun.
1487	 */
1488	if ((ahd->flags & AHD_TARGETROLE) != 0) {
1489		test	SSTAT0, TARGET jnz data_phase_done;
1490	}
1491	if ((ahd->flags & AHD_INITIATORROLE) != 0) {
1492		test	SSTAT1, REQINIT jz .;
1493		test	SCSIPHASE, DATA_PHASE_MASK jnz p_data;
1494	}
1495
1496data_phase_done:
1497	/* Kill off any pending prefetch */
1498	call	disable_ccsgen;
1499	or 	LONGJMP_ADDR[1], INVALID_ADDR;
1500
1501	if ((ahd->flags & AHD_TARGETROLE) != 0) {
1502		test	SEQ_FLAGS, DPHASE_PENDING jz ITloop;
1503		/*
1504		and	SEQ_FLAGS, ~DPHASE_PENDING;
1505		 * For data-in phases, wait for any pending acks from the
1506		 * initiator before changing phase.  We only need to
1507		 * send Ignore Wide Residue messages for data-in phases.
1508		test	DFCNTRL, DIRECTION jz target_ITloop;
1509		test	SSTAT1, REQINIT	jnz .;
1510		test	SCB_TASK_ATTRIBUTE, SCB_XFERLEN_ODD jz target_ITloop;
1511		SET_MODE(M_SCSI, M_SCSI)
1512		test	NEGCONOPTS, WIDEXFER jz target_ITloop;
1513		 */
1514		/*
1515		 * Issue an Ignore Wide Residue Message.
1516		mvi	P_MESGIN|BSYO call change_phase;
1517		mvi	MSG_IGN_WIDE_RESIDUE call target_outb;
1518		mvi	1 call target_outb;
1519		jmp	target_ITloop;
1520		 */
1521	} else {
1522		jmp	ITloop;
1523	}
1524
1525/*
1526 * We assume that, even though data may still be
1527 * transferring to the host, that the SCSI side of
1528 * the DMA engine is now in a static state.  This
1529 * allows us to update our notion of where we are
1530 * in this transfer.
1531 *
1532 * If, by chance, we stopped before being able
1533 * to fetch additional segments for this transfer,
1534 * yet the last S/G was completely exhausted,
1535 * call our idle loop until it is able to load
1536 * another segment.  This will allow us to immediately
1537 * pickup on the next segment on the next data phase.
1538 *
1539 * If we happened to stop on the last segment, then
1540 * our residual information is still correct from
1541 * the idle loop and there is no need to perform
1542 * any fixups.
1543 */
1544residual_before_last_seg:
1545	test    MDFFSTAT, SHVALID	jnz sgptr_fixup;
1546	/*
1547	 * Can never happen from an interrupt as the packetized
1548	 * hardware will only interrupt us once SHVALID or
1549	 * LAST_SEG_DONE.
1550	 */
1551	call	idle_loop_service_fifos;
1552	RESTORE_MODE(SAVED_MODE)
1553	/* FALLTHROUGH */
1554calc_residual:
1555	test	SG_CACHE_SHADOW, LAST_SEG jz residual_before_last_seg;
1556	/* Record if we've consumed all S/G entries */
1557	test	MDFFSTAT, SHVALID	jz . + 2;
1558	bmov	SCB_RESIDUAL_DATACNT, SHCNT, 3 ret;
1559	or	SCB_RESIDUAL_SGPTR[0], SG_LIST_NULL ret;
1560
1561sgptr_fixup:
1562	/*
1563	 * Fixup the residual next S/G pointer.  The S/G preload
1564	 * feature of the chip allows us to load two elements
1565	 * in addition to the currently active element.  We
1566	 * store the bottom byte of the next S/G pointer in
1567	 * the SG_CACHE_PTR register so we can restore the
1568	 * correct value when the DMA completes.  If the next
1569	 * sg ptr value has advanced to the point where higher
1570	 * bytes in the address have been affected, fix them
1571	 * too.
1572	 */
1573	test	SG_CACHE_SHADOW, 0x80 jz sgptr_fixup_done;
1574	test	SCB_RESIDUAL_SGPTR[0], 0x80 jnz sgptr_fixup_done;
1575	add	SCB_RESIDUAL_SGPTR[1], -1;
1576	adc	SCB_RESIDUAL_SGPTR[2], -1;
1577	adc	SCB_RESIDUAL_SGPTR[3], -1;
1578sgptr_fixup_done:
1579	and	SCB_RESIDUAL_SGPTR[0], SG_ADDR_MASK, SG_CACHE_SHADOW;
1580	clr	SCB_RESIDUAL_DATACNT[3]; /* We are not the last seg */
1581	bmov	SCB_RESIDUAL_DATACNT, SHCNT, 3 ret;
1582
1583export timer_isr:
1584	call	issue_cmdcmplt;
1585	mvi	CLRSEQINTSTAT, CLRSEQ_SWTMRTO;
1586	if ((ahd->bugs & AHD_SET_MODE_BUG) != 0) {
1587		/*
1588		 * In H2A4, the mode pointer is not saved
1589		 * for intvec2, but is restored on iret.
1590		 * This can lead to the restoration of a
1591		 * bogus mode ptr.  Manually clear the
1592		 * intmask bits and do a normal return
1593		 * to compensate.
1594		 */
1595		and	SEQINTCTL, ~(INTMASK2|INTMASK1) ret;
1596	} else {
1597		or	SEQINTCTL, IRET ret;
1598	}
1599
1600export seq_isr:
1601	if ((ahd->features & AHD_RTI) == 0) {
1602		/*
1603		 * On RevA Silicon, if the target returns us to data-out
1604		 * after we have already trained for data-out, it is
1605		 * possible for us to transition the free running clock to
1606		 * data-valid before the required 100ns P1 setup time (8 P1
1607		 * assertions in fast-160 mode).  This will only happen if
1608		 * this L-Q is a continuation of a data transfer for which
1609		 * we have already prefetched data into our FIFO (LQ/Data
1610		 * followed by LQ/Data for the same write transaction).
1611		 * This can cause some target implementations to miss the
1612		 * first few data transfers on the bus.  We detect this
1613		 * situation by noticing that this is the first data transfer
1614		 * after an LQ (LQIWORKONLQ true), that the data transfer is
1615		 * a continuation of a transfer already setup in our FIFO
1616		 * (SAVEPTRS interrupt), and that the transaction is a write
1617		 * (DIRECTION set in DFCNTRL). The delay is performed by
1618		 * disabling SCSIEN until we see the first REQ from the
1619		 * target.
1620		 *
1621		 * First instruction in an ISR cannot be a branch on
1622		 * Rev A.  Snapshot LQISTAT2 so the status is not missed
1623		 * and deffer the test by one instruction.
1624		 */
1625		mov	REG_ISR, LQISTAT2;
1626		test	REG_ISR, LQIWORKONLQ jz main_isr;
1627		test	SEQINTSRC, SAVEPTRS  jz main_isr;
1628		test	LONGJMP_ADDR[1], INVALID_ADDR jz saveptr_active_fifo;
1629		/*
1630		 * Switch to the active FIFO after clearing the snapshot
1631		 * savepointer in the current FIFO.  We do this so that
1632		 * a pending CTXTDONE or SAVEPTR is visible in the active
1633		 * FIFO.  This status is the only way we can detect if we
1634		 * have lost the race (e.g. host paused us) and our attepts
1635		 * to disable the channel occurred after all REQs were
1636		 * already seen and acked (REQINIT never comes true).
1637		 */
1638		mvi	DFFSXFRCTL, CLRCHN;
1639		xor	MODE_PTR, MK_MODE(M_DFF1, M_DFF1);
1640		test	DFCNTRL, DIRECTION jz interrupt_return;
1641		and	DFCNTRL, ~SCSIEN;
1642snapshot_wait_data_valid:
1643		test	SEQINTSRC, (CTXTDONE|SAVEPTRS) jnz snapshot_data_valid;
1644		test	SSTAT1, REQINIT	jz snapshot_wait_data_valid;
1645snapshot_data_valid:
1646		or	DFCNTRL, SCSIEN;
1647		or	SEQINTCTL, IRET ret;
1648snapshot_saveptr:
1649		mvi	DFFSXFRCTL, CLRCHN;
1650		or	SEQINTCTL, IRET ret;
1651main_isr:
1652	}
1653	test	SEQINTSRC, CFG4DATA	jnz cfg4data_intr;
1654	test	SEQINTSRC, CFG4ISTAT	jnz cfg4istat_intr;
1655	test	SEQINTSRC, SAVEPTRS	jnz saveptr_intr;
1656	test	SEQINTSRC, CFG4ICMD	jnz cfg4icmd_intr;
1657	SET_SEQINTCODE(INVALID_SEQINT)
1658
1659/*
1660 * There are two types of save pointers interrupts:
1661 * The first is a snapshot save pointers where the current FIFO is not
1662 * active and contains a snapshot of the current poniter information.
1663 * This happens between packets in a stream for a single L_Q.  Since we
1664 * are not performing a pointer save, we can safely clear the channel
1665 * so it can be used for other transactions.  On RTI capable controllers,
1666 * where snapshots can, and are, disabled, the code to handle this type
1667 * of snapshot is not active.
1668 *
1669 * The second case is a save pointers on an active FIFO which occurs
1670 * if the target changes to a new L_Q or busfrees/QASes and the transfer
1671 * has a residual.  This should occur coincident with a ctxtdone.  We
1672 * disable the interrupt and allow our active routine to handle the
1673 * save.
1674 */
1675saveptr_intr:
1676	if ((ahd->features & AHD_RTI) == 0) {
1677		test	LONGJMP_ADDR[1], INVALID_ADDR jnz snapshot_saveptr;
1678	}
1679saveptr_active_fifo:
1680	and	SEQIMODE, ~ENSAVEPTRS;
1681	or	SEQINTCTL, IRET ret;
1682
1683cfg4data_intr:
1684	test	SCB_SGPTR[0], SG_LIST_NULL jnz pkt_handle_overrun_inc_use_count;
1685	call	load_first_seg;
1686	call	pkt_handle_xfer;
1687	inc	SCB_FIFO_USE_COUNT;
1688interrupt_return:
1689	or	SEQINTCTL, IRET ret;
1690
1691cfg4istat_intr:
1692	call	freeze_queue;
1693	add	NONE, -13, SCB_CDB_LEN;
1694	jnc	cfg4istat_have_sense_addr;
1695	test	SCB_CDB_LEN, SCB_CDB_LEN_PTR jnz cfg4istat_have_sense_addr;
1696	/*
1697	 * Host sets up address/count and enables transfer.
1698	 */
1699	SET_SEQINTCODE(CFG4ISTAT_INTR)
1700	jmp	cfg4istat_setup_handler;
1701cfg4istat_have_sense_addr:
1702	bmov	HADDR, SCB_SENSE_BUSADDR, 4;
1703	mvi	HCNT[1], (AHD_SENSE_BUFSIZE >> 8);
1704	mvi	SG_CACHE_PRE, LAST_SEG;
1705	mvi	DFCNTRL, PRELOADEN|SCSIEN|HDMAEN;
1706cfg4istat_setup_handler:
1707	/*
1708	 * Status pkt is transferring to host.
1709	 * Wait in idle loop for transfer to complete.
1710	 * If a command completed before an attempted
1711	 * task management function completed, notify the host.
1712	 */
1713	test	SCB_TASK_MANAGEMENT, 0xFF jz cfg4istat_no_taskmgmt_func;
1714	SET_SEQINTCODE(TASKMGMT_CMD_CMPLT_OKAY)
1715cfg4istat_no_taskmgmt_func:
1716	call	pkt_handle_status;
1717	or	SEQINTCTL, IRET ret;
1718
1719cfg4icmd_intr:
1720	/*
1721	 * In the case of DMAing a CDB from the host, the normal
1722	 * CDB buffer is formatted with an 8 byte address followed
1723	 * by a 1 byte count.
1724	 */
1725	bmov	HADDR[0], SCB_HOST_CDB_PTR, 9;
1726	mvi	SG_CACHE_PRE, LAST_SEG;
1727	mvi	DFCNTRL, (PRELOADEN|SCSIEN|HDMAEN);
1728	call	pkt_handle_cdb;
1729	or	SEQINTCTL, IRET ret;
1730
1731/*
1732 * See if the target has gone on in this context creating an
1733 * overrun condition.  For the write case, the hardware cannot
1734 * ack bytes until data are provided.  So, if the target begins
1735 * another  packet without changing contexts, implying we are
1736 * not sitting on a packet boundary, we are in an overrun
1737 * situation.  For the read case, the hardware will continue to
1738 * ack bytes into the FIFO, and may even ack the last overrun packet
1739 * into the FIFO.   If the FIFO should become non-empty, we are in
1740 * a read overrun case.
1741 */
1742#define check_overrun							\
1743	/* Not on a packet boundary. */					\
1744	test 	MDFFSTAT, DLZERO jz pkt_handle_overrun;			\
1745	test	DFSTATUS, FIFOEMP jz pkt_handle_overrun
1746
1747pkt_handle_xfer:
1748	test	SG_STATE, LOADING_NEEDED jz pkt_last_seg;
1749	call	setjmp;
1750	test	SEQINTSRC, SAVEPTRS jnz pkt_saveptrs;
1751	test	SCSIPHASE, ~DATA_PHASE_MASK jz . + 2;
1752	test	SCSISIGO, ATNO jnz . + 2;
1753	test	SSTAT2, NONPACKREQ jz pkt_service_fifo;
1754	/*
1755	 * Defer handling of this NONPACKREQ until we
1756	 * can be sure it pertains to this FIFO.  SAVEPTRS
1757	 * will not be asserted if the NONPACKREQ is for us,
1758	 * so we must simulate it if shaddow is valid.  If
1759	 * shaddow is not valid, keep running this FIFO until we
1760	 * have satisfied the transfer by loading segments and
1761	 * waiting for either shaddow valid or last_seg_done.
1762	 */
1763	test	MDFFSTAT, SHVALID jnz pkt_saveptrs;
1764pkt_service_fifo:
1765	test	SG_STATE, LOADING_NEEDED jnz service_fifo;
1766pkt_last_seg:
1767	call	setjmp;
1768	test	SEQINTSRC, SAVEPTRS jnz pkt_saveptrs;
1769	test	SG_CACHE_SHADOW, LAST_SEG_DONE jnz pkt_last_seg_done;
1770	test	SCSIPHASE, ~DATA_PHASE_MASK jz . + 2;
1771	test	SCSISIGO, ATNO jnz . + 2;
1772	test	SSTAT2, NONPACKREQ jz return;
1773	test	MDFFSTAT, SHVALID jz return;
1774	/* FALLTHROUGH */
1775
1776/*
1777 * Either a SAVEPTRS interrupt condition is pending for this FIFO
1778 * or we have a pending NONPACKREQ for this FIFO.  We differentiate
1779 * between the two by capturing the state of the SAVEPTRS interrupt
1780 * prior to clearing this status and executing the common code for
1781 * these two cases.
1782 */
1783pkt_saveptrs:
1784BEGIN_CRITICAL;
1785	if ((ahd->bugs & AHD_AUTOFLUSH_BUG) != 0) {
1786		or	DFCNTRL, FIFOFLUSH;
1787	}
1788	mov	REG0, SEQINTSRC;
1789	call	calc_residual;
1790	call	save_pointers;
1791	mvi	CLRSEQINTSRC, CLRSAVEPTRS;
1792	call	disable_ccsgen;
1793	or	SEQIMODE, ENSAVEPTRS;
1794	test	DFCNTRL, DIRECTION jnz pkt_saveptrs_check_status;
1795	test	DFSTATUS, FIFOEMP jnz pkt_saveptrs_check_status;
1796	/*
1797	 * Keep a handler around for this FIFO until it drains
1798	 * to the host to guarantee that we don't complete the
1799	 * command to the host before the data arrives.
1800	 */
1801pkt_saveptrs_wait_fifoemp:
1802	call	setjmp;
1803	test	DFSTATUS, FIFOEMP jz return;
1804pkt_saveptrs_check_status:
1805	or	LONGJMP_ADDR[1], INVALID_ADDR;
1806	test	REG0, SAVEPTRS jz unexpected_nonpkt_phase;
1807	dec	SCB_FIFO_USE_COUNT;
1808	test	SCB_CONTROL, STATUS_RCVD jnz pkt_complete_scb_if_fifos_idle;
1809	mvi	DFFSXFRCTL, CLRCHN ret;
1810END_CRITICAL;
1811
1812/*
1813 * LAST_SEG_DONE status has been seen in the current FIFO.
1814 * This indicates that all of the allowed data for this
1815 * command has transferred across the SCSI and host buses.
1816 * Check for overrun and see if we can complete this command.
1817 */
1818pkt_last_seg_done:
1819BEGIN_CRITICAL;
1820	/*
1821	 * Mark transfer as completed.
1822	 */
1823	or	SCB_SGPTR, SG_LIST_NULL;
1824
1825	/*
1826	 * Wait for the current context to finish to verify that
1827	 * no overrun condition has occurred.
1828	 */
1829	test	SEQINTSRC, CTXTDONE jnz pkt_ctxt_done;
1830	call	setjmp;
1831pkt_wait_ctxt_done_loop:
1832	test	SEQINTSRC, CTXTDONE jnz pkt_ctxt_done;
1833	/*
1834	 * A sufficiently large overrun or a NONPACKREQ may
1835	 * prevent CTXTDONE from ever asserting, so we must
1836	 * poll for these statuses too.
1837	 */
1838	check_overrun;
1839	test	SSTAT2, NONPACKREQ jz return;
1840	test	SEQINTSRC, CTXTDONE jz unexpected_nonpkt_phase;
1841	/* FALLTHROUGH */
1842
1843pkt_ctxt_done:
1844	check_overrun;
1845	or	LONGJMP_ADDR[1], INVALID_ADDR;
1846	/*
1847	 * If status has been received, it is safe to skip
1848	 * the check to see if another FIFO is active because
1849	 * LAST_SEG_DONE has been observed.  However, we check
1850	 * the FIFO anyway since it costs us only one extra
1851	 * instruction to leverage common code to perform the
1852	 * SCB completion.
1853	 */
1854	dec	SCB_FIFO_USE_COUNT;
1855	test	SCB_CONTROL, STATUS_RCVD jnz pkt_complete_scb_if_fifos_idle;
1856	mvi	DFFSXFRCTL, CLRCHN ret;
1857END_CRITICAL;
1858
1859/*
1860 * Must wait until CDB xfer is over before issuing the
1861 * clear channel.
1862 */
1863pkt_handle_cdb:
1864	call	setjmp;
1865	test	SG_CACHE_SHADOW, LAST_SEG_DONE jz return;
1866	or	LONGJMP_ADDR[1], INVALID_ADDR;
1867	mvi	DFFSXFRCTL, CLRCHN ret;
1868
1869/*
1870 * Watch over the status transfer.  Our host sense buffer is
1871 * large enough to take the maximum allowed status packet.
1872 * None-the-less, we must still catch and report overruns to
1873 * the host.  Additionally, properly catch unexpected non-packet
1874 * phases that are typically caused by CRC errors in status packet
1875 * transmission.
1876 */
1877pkt_handle_status:
1878	call	setjmp;
1879	test	SG_CACHE_SHADOW, LAST_SEG_DONE jnz pkt_status_check_overrun;
1880	test	SEQINTSRC, CTXTDONE jz pkt_status_check_nonpackreq;
1881	test	SG_CACHE_SHADOW, LAST_SEG_DONE jnz pkt_status_check_overrun;
1882pkt_status_IU_done:
1883	if ((ahd->bugs & AHD_AUTOFLUSH_BUG) != 0) {
1884		or	DFCNTRL, FIFOFLUSH;
1885	}
1886	test	DFSTATUS, FIFOEMP jz return;
1887BEGIN_CRITICAL;
1888	or	LONGJMP_ADDR[1], INVALID_ADDR;
1889	mvi	SCB_SCSI_STATUS, STATUS_PKT_SENSE;
1890	or	SCB_CONTROL, STATUS_RCVD;
1891	jmp	pkt_complete_scb_if_fifos_idle;
1892END_CRITICAL;
1893pkt_status_check_overrun:
1894	/*
1895	 * Status PKT overruns are uncerimoniously recovered with a
1896	 * bus reset.  If we've overrun, let the host know so that
1897	 * recovery can be performed.
1898	 *
1899	 * LAST_SEG_DONE has been observed.  If either CTXTDONE or
1900	 * a NONPACKREQ phase change have occurred and the FIFO is
1901	 * empty, there is no overrun.
1902	 */
1903	test	DFSTATUS, FIFOEMP jz pkt_status_report_overrun;
1904	test	SEQINTSRC, CTXTDONE jz . + 2;
1905	test	DFSTATUS, FIFOEMP jnz pkt_status_IU_done;
1906	test	SCSIPHASE, ~DATA_PHASE_MASK jz return;
1907	test	DFSTATUS, FIFOEMP jnz pkt_status_check_nonpackreq;
1908pkt_status_report_overrun:
1909	SET_SEQINTCODE(STATUS_OVERRUN)
1910	/* SEQUENCER RESTARTED */
1911pkt_status_check_nonpackreq:
1912	/*
1913	 * CTXTDONE may be held off if a NONPACKREQ is associated with
1914	 * the current context.  If a NONPACKREQ is observed, decide
1915	 * if it is for the current context.  If it is for the current
1916	 * context, we must defer NONPACKREQ processing until all data
1917	 * has transferred to the host.
1918	 */
1919	test	SCSIPHASE, ~DATA_PHASE_MASK jz return;
1920	test	SCSISIGO, ATNO jnz . + 2;
1921	test	SSTAT2, NONPACKREQ jz return;
1922	test	SEQINTSRC, CTXTDONE jnz pkt_status_IU_done;
1923	test	DFSTATUS, FIFOEMP jz return;
1924	/*
1925	 * The unexpected nonpkt phase handler assumes that any
1926	 * data channel use will have a FIFO reference count.  It
1927	 * turns out that the status handler doesn't need a refernce
1928	 * count since the status received flag, and thus completion
1929	 * processing, cannot be set until the handler is finished.
1930	 * We increment the count here to make the nonpkt handler
1931	 * happy.
1932	 */
1933	inc	SCB_FIFO_USE_COUNT;
1934	/* FALLTHROUGH */
1935
1936/*
1937 * Nonpackreq is a polled status.  It can come true in three situations:
1938 * we have received an L_Q, we have sent one or more L_Qs, or there is no
1939 * L_Q context associated with this REQ (REQ occurs immediately after a
1940 * (re)selection).  Routines that know that the context responsible for this
1941 * nonpackreq call directly into unexpected_nonpkt_phase.  In the case of the
1942 * top level idle loop, we exhaust all active contexts prior to determining that
1943 * we simply do not have the full I_T_L_Q for this phase.
1944 */
1945unexpected_nonpkt_phase_find_ctxt:
1946	/*
1947	 * This nonpackreq is most likely associated with one of the tags
1948	 * in a FIFO or an outgoing LQ.  Only treat it as an I_T only
1949	 * nonpackreq if we've cleared out the FIFOs and handled any
1950	 * pending SELDO.
1951	 */
1952SET_SRC_MODE	M_SCSI;
1953SET_DST_MODE	M_SCSI;
1954	and	A, FIFO1FREE|FIFO0FREE, DFFSTAT;
1955	cmp	A, FIFO1FREE|FIFO0FREE jne return;
1956	test	SSTAT0, SELDO jnz return;
1957	mvi	SCBPTR[1], SCB_LIST_NULL;
1958unexpected_nonpkt_phase:
1959	test	MODE_PTR, ~(MK_MODE(M_DFF1, M_DFF1))
1960		jnz unexpected_nonpkt_mode_cleared;
1961SET_SRC_MODE	M_DFF0;
1962SET_DST_MODE	M_DFF0;
1963	or	LONGJMP_ADDR[1], INVALID_ADDR;
1964	dec	SCB_FIFO_USE_COUNT;
1965	mvi	DFFSXFRCTL, CLRCHN;
1966unexpected_nonpkt_mode_cleared:
1967	mvi	CLRSINT2, CLRNONPACKREQ;
1968	test	SCSIPHASE, ~(MSG_IN_PHASE|MSG_OUT_PHASE) jnz illegal_phase;
1969	SET_SEQINTCODE(ENTERING_NONPACK)
1970	jmp	ITloop;
1971
1972illegal_phase:
1973	SET_SEQINTCODE(ILLEGAL_PHASE)
1974	jmp	ITloop;
1975
1976/*
1977 * We have entered an overrun situation.  If we have working
1978 * BITBUCKET, flip that on and let the hardware eat any overrun
1979 * data.  Otherwise use an overrun buffer in the host to simulate
1980 * BITBUCKET.
1981 */
1982pkt_handle_overrun_inc_use_count:
1983	inc	SCB_FIFO_USE_COUNT;
1984pkt_handle_overrun:
1985	SET_SEQINTCODE(CFG4OVERRUN)
1986	call	freeze_queue;
1987	if ((ahd->bugs & AHD_PKT_BITBUCKET_BUG) == 0) {
1988		or	DFFSXFRCTL, DFFBITBUCKET;
1989SET_SRC_MODE	M_DFF1;
1990SET_DST_MODE	M_DFF1;
1991	} else {
1992		call	load_overrun_buf;
1993		mvi	DFCNTRL, (HDMAEN|SCSIEN|PRELOADEN);
1994	}
1995	call	setjmp;
1996	if ((ahd->bugs & AHD_PKT_BITBUCKET_BUG) != 0) {
1997		test	DFSTATUS, PRELOAD_AVAIL jz overrun_load_done;
1998		call	load_overrun_buf;
1999		or	DFCNTRL, PRELOADEN;
2000overrun_load_done:
2001		test	SEQINTSRC, CTXTDONE jnz pkt_overrun_end;
2002	} else {
2003		test	DFFSXFRCTL, DFFBITBUCKET jz pkt_overrun_end;
2004	}
2005	test	SSTAT2, NONPACKREQ jz return;
2006pkt_overrun_end:
2007	or	SCB_RESIDUAL_SGPTR, SG_OVERRUN_RESID;
2008	test	SEQINTSRC, CTXTDONE jz unexpected_nonpkt_phase;
2009	dec	SCB_FIFO_USE_COUNT;
2010	or	LONGJMP_ADDR[1], INVALID_ADDR;
2011	test	SCB_CONTROL, STATUS_RCVD jnz pkt_complete_scb_if_fifos_idle;
2012	mvi	DFFSXFRCTL, CLRCHN ret;
2013
2014if ((ahd->bugs & AHD_PKT_BITBUCKET_BUG) != 0) {
2015load_overrun_buf:
2016	/*
2017	 * Load a dummy segment if preload space is available.
2018	 */
2019	mov 	HADDR[0], SHARED_DATA_ADDR;
2020	add	HADDR[1], PKT_OVERRUN_BUFOFFSET, SHARED_DATA_ADDR[1];
2021	mov	ACCUM_SAVE, A;
2022	clr	A;
2023	adc	HADDR[2], A, SHARED_DATA_ADDR[2];
2024	adc	HADDR[3], A, SHARED_DATA_ADDR[3];
2025	mov	A, ACCUM_SAVE;
2026	bmov	HADDR[4], ALLZEROS, 4;
2027	/* PKT_OVERRUN_BUFSIZE is a multiple of 256 */
2028	clr	HCNT[0];
2029	mvi	HCNT[1], ((PKT_OVERRUN_BUFSIZE >> 8) & 0xFF);
2030	clr	HCNT[2] ret;
2031}
2032