xref: /netbsd/sys/dev/microcode/aic7xxx/aic79xx.seq (revision 780e5159)
1/*	$NetBSD: aic79xx.seq,v 1.17 2022/06/27 22:41:29 andvar Exp $	*/
2
3/*
4 * Adaptec U320 device driver firmware for Linux and FreeBSD.
5 *
6 * Copyright (c) 1994-2001 Justin T. Gibbs.
7 * Copyright (c) 2000-2002 Adaptec Inc.
8 * All rights reserved.
9 *
10 * Redistribution and use in source and binary forms, with or without
11 * modification, are permitted provided that the following conditions
12 * are met:
13 * 1. Redistributions of source code must retain the above copyright
14 *    notice, this list of conditions, and the following disclaimer,
15 *    without modification.
16 * 2. Redistributions in binary form must reproduce at minimum a disclaimer
17 *    substantially similar to the "NO WARRANTY" disclaimer below
18 *    ("Disclaimer") and any redistribution must be conditioned upon
19 *    including a substantially similar Disclaimer requirement for further
20 *    binary redistribution.
21 * 3. Neither the names of the above-listed copyright holders nor the names
22 *    of any contributors may be used to endorse or promote products derived
23 *    from this software without specific prior written permission.
24 *
25 * Alternatively, this software may be distributed under the terms of the
26 * GNU General Public License ("GPL") version 2 as published by the Free
27 * Software Foundation.
28 *
29 * NO WARRANTY
30 * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
31 * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
32 * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTIBILITY AND FITNESS FOR
33 * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
34 * HOLDERS OR CONTRIBUTORS BE LIABLE FOR SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
35 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
36 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
37 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
38 * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING
39 * IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
40 * POSSIBILITY OF SUCH DAMAGES.
41 *
42 * $FreeBSD: src/sys/dev/aic7xxx/aic79xx.seq,v 1.13 2003/06/28 04:44:10 gibbs Exp $
43 */
44
45VERSION = "Id: //depot/aic7xxx/aic7xxx/aic79xx.seq#96 $"
46PATCH_ARG_LIST = "struct ahd_softc *ahd"
47PREFIX = "ahd_"
48
49#include <dev/microcode/aic7xxx/aic79xx.reg>
50#include <dev/scsipi/scsi_message.h>
51
52restart:
53if ((ahd->bugs & AHD_INTCOLLISION_BUG) != 0) {
54	test	SEQINTCODE, 0xFF jz idle_loop;
55	SET_SEQINTCODE(NO_SEQINT)
56}
57
58idle_loop:
59
60	if ((ahd->bugs & AHD_INTCOLLISION_BUG) != 0) {
61		/*
62		 * Convert ERROR status into a sequencer
63		 * interrupt to handle the case of an
64		 * interrupt collision on the hardware
65		 * setting of HWERR.
66		 */
67		test	ERROR, 0xFF jz no_error_set;
68		SET_SEQINTCODE(SAW_HWERR)
69no_error_set:
70	}
71	SET_MODE(M_SCSI, M_SCSI)
72	test	SCSISEQ0, ENSELO|ENARBO jnz idle_loop_checkbus;
73	test	SEQ_FLAGS2, SELECTOUT_QFROZEN jnz idle_loop_checkbus;
74	cmp	WAITING_TID_HEAD[1], SCB_LIST_NULL je idle_loop_checkbus;
75	/*
76	 * ENSELO is cleared by a SELDO, so we must test for SELDO
77	 * one last time.
78	 */
79BEGIN_CRITICAL;
80	test	SSTAT0, SELDO jnz select_out;
81END_CRITICAL;
82	call	start_selection;
83idle_loop_checkbus:
84BEGIN_CRITICAL;
85	test	SSTAT0, SELDO jnz select_out;
86END_CRITICAL;
87	test	SSTAT0, SELDI jnz select_in;
88	test	SCSIPHASE, ~DATA_PHASE_MASK jz idle_loop_check_nonpackreq;
89	test	SCSISIGO, ATNO jz idle_loop_check_nonpackreq;
90	call	unexpected_nonpkt_phase_find_ctxt;
91idle_loop_check_nonpackreq:
92	test	SSTAT2, NONPACKREQ jz . + 2;
93	call	unexpected_nonpkt_phase_find_ctxt;
94	if ((ahd->bugs & AHD_FAINT_LED_BUG) != 0) {
95		and	A, FIFO0FREE|FIFO1FREE, DFFSTAT;
96		cmp	A, FIFO0FREE|FIFO1FREE jne . + 3;
97		and	SBLKCTL, ~DIAGLEDEN|DIAGLEDON;
98		jmp	. + 2;
99		or	SBLKCTL, DIAGLEDEN|DIAGLEDON;
100	}
101	call	idle_loop_gsfifo_in_scsi_mode;
102	call	idle_loop_service_fifos;
103	call	idle_loop_cchan;
104	jmp	idle_loop;
105
106BEGIN_CRITICAL;
107idle_loop_gsfifo:
108	SET_MODE(M_SCSI, M_SCSI)
109idle_loop_gsfifo_in_scsi_mode:
110	test	LQISTAT2, LQIGSAVAIL jz return;
111	/*
112	 * We have received good status for this transaction.  There may
113	 * still be data in our FIFOs draining to the host.  Complete
114	 * the SCB only if all data has transferred to the host.
115	 */
116good_status_IU_done:
117	bmov	SCBPTR, GSFIFO, 2;
118	clr	SCB_SCSI_STATUS;
119	/*
120	 * If a command completed before an attempted task management
121	 * function completed, notify the host after disabling any
122	 * pending select-outs.
123	 */
124	test	SCB_TASK_MANAGEMENT, 0xFF jz gsfifo_complete_normally;
125	test	SSTAT0, SELDO|SELINGO jnz . + 2;
126	and	SCSISEQ0, ~ENSELO;
127	SET_SEQINTCODE(TASKMGMT_CMD_CMPLT_OKAY)
128gsfifo_complete_normally:
129	or	SCB_CONTROL, STATUS_RCVD;
130
131	/*
132	 * Since this status did not consume a FIFO, we have to
133	 * be a bit more diligent in how we check for FIFOs pertaining
134	 * to this transaction.  There are two states that a FIFO still
135	 * transferring data may be in.
136	 *
137	 * 1) Configured and draining to the host, with a FIFO handler.
138	 * 2) Pending cfg4data, fifo not empty.
139	 *
140	 * Case 1 can be detected by noticing a non-zero FIFO active
141	 * count in the SCB.  In this case, we allow the routine servicing
142	 * the FIFO to complete the SCB.
143	 *
144	 * Case 2 implies either a pending or yet to occur save data
145	 * pointers for this same context in the other FIFO.  So, if
146	 * we detect case 1, we will properly defer the post of the SCB
147	 * and achieve the desired result.  The pending cfg4data will
148	 * notice that status has been received and complete the SCB.
149	 */
150	test	SCB_FIFO_USE_COUNT, 0xFF jnz idle_loop_gsfifo_in_scsi_mode;
151	call	complete;
152END_CRITICAL;
153	jmp	idle_loop_gsfifo_in_scsi_mode;
154
155idle_loop_service_fifos:
156	SET_MODE(M_DFF0, M_DFF0)
157	test	LONGJMP_ADDR[1], INVALID_ADDR jnz idle_loop_next_fifo;
158	call	longjmp;
159idle_loop_next_fifo:
160	SET_MODE(M_DFF1, M_DFF1)
161	test	LONGJMP_ADDR[1], INVALID_ADDR jz longjmp;
162return:
163	ret;
164
165idle_loop_cchan:
166	SET_MODE(M_CCHAN, M_CCHAN)
167	test	QOFF_CTLSTA, HS_MAILBOX_ACT jz	hs_mailbox_empty;
168	mov	LOCAL_HS_MAILBOX, HS_MAILBOX;
169	or	QOFF_CTLSTA, HS_MAILBOX_ACT;
170hs_mailbox_empty:
171BEGIN_CRITICAL;
172	test	CCSCBCTL, CCARREN|CCSCBEN jz scbdma_idle;
173	test	CCSCBCTL, CCSCBDIR jnz fetch_new_scb_inprog;
174	test	CCSCBCTL, CCSCBDONE jz return;
175END_CRITICAL;
176	/* FALLTHROUGH */
177scbdma_tohost_done:
178	test	CCSCBCTL, CCARREN jz fill_qoutfifo_dmadone;
179	/*
180	 * An SCB has been successfully uploaded to the host.
181	 * If the SCB was uploaded for some reason other than
182	 * bad SCSI status (currently only for underruns), we
183	 * queue the SCB for normal completion.  Otherwise, we
184	 * wait until any select-out activity has halted, and
185	 * then notify the host so that the transaction can be
186	 * dealt with.
187	 */
188	test	SCB_SCSI_STATUS, 0xff jnz scbdma_notify_host;
189	and	CCSCBCTL, ~(CCARREN|CCSCBEN);
190	bmov	COMPLETE_DMA_SCB_HEAD, SCB_NEXT_COMPLETE, 2;
191	bmov	SCB_NEXT_COMPLETE, COMPLETE_SCB_HEAD, 2;
192	bmov	COMPLETE_SCB_HEAD, SCBPTR, 2 ret;
193scbdma_notify_host:
194	SET_MODE(M_SCSI, M_SCSI)
195	test	SCSISEQ0, ENSELO jnz return;
196	test	SSTAT0, (SELDO|SELINGO) jnz return;
197	SET_MODE(M_CCHAN, M_CCHAN)
198	/*
199	 * Remove SCB and notify host.
200	 */
201	and	CCSCBCTL, ~(CCARREN|CCSCBEN);
202	bmov	COMPLETE_DMA_SCB_HEAD, SCB_NEXT_COMPLETE, 2;
203	SET_SEQINTCODE(BAD_SCB_STATUS)
204	ret;
205fill_qoutfifo_dmadone:
206	and	CCSCBCTL, ~(CCARREN|CCSCBEN);
207	call	qoutfifo_updated;
208	mvi	COMPLETE_SCB_DMAINPROG_HEAD[1], SCB_LIST_NULL;
209	bmov	QOUTFIFO_NEXT_ADDR, SCBHADDR, 4;
210	test	QOFF_CTLSTA, SDSCB_ROLLOVR jz return;
211	bmov	QOUTFIFO_NEXT_ADDR, SHARED_DATA_ADDR, 4;
212	xor	QOUTFIFO_ENTRY_VALID_TAG, QOUTFIFO_ENTRY_VALID_TOGGLE ret;
213
214qoutfifo_updated:
215	/*
216	 * If there are more commands waiting to be DMA'ed
217	 * to the host, always coalesce.  Otherwise honor the
218	 * host's wishes.
219	 */
220	cmp	COMPLETE_DMA_SCB_HEAD[1], SCB_LIST_NULL jne coalesce_by_count;
221	cmp	COMPLETE_SCB_HEAD[1], SCB_LIST_NULL jne coalesce_by_count;
222	test	LOCAL_HS_MAILBOX, ENINT_COALESCE jz issue_cmdcmplt;
223
224	/*
225	 * If we have relatively few commands outstanding, don't
226	 * bother waiting for another command to complete.
227	 */
228	test	CMDS_PENDING[1], 0xFF jnz coalesce_by_count;
229	/* Add -1 so that jnc means <= not just < */
230	add	A, -1, INT_COALESCING_MINCMDS;
231	add	NONE, A, CMDS_PENDING;
232	jnc	issue_cmdcmplt;
233
234	/*
235	 * If coalescing, only coalesce up to the limit
236	 * provided by the host driver.
237	 */
238coalesce_by_count:
239	mov	A, INT_COALESCING_MAXCMDS;
240	add	NONE, A, INT_COALESCING_CMDCOUNT;
241	jc	issue_cmdcmplt;
242	/*
243	 * If the timer is not currently active,
244	 * fire it up.
245	 */
246	test	INTCTL, SWTMINTMASK jz return;
247	bmov	SWTIMER, INT_COALESCING_TIMER, 2;
248	mvi	CLRSEQINTSTAT, CLRSEQ_SWTMRTO;
249	or	INTCTL, SWTMINTEN|SWTIMER_START;
250	and	INTCTL, ~SWTMINTMASK ret;
251
252issue_cmdcmplt:
253	mvi	INTSTAT, CMDCMPLT;
254	clr	INT_COALESCING_CMDCOUNT;
255	or	INTCTL, SWTMINTMASK ret;
256
257BEGIN_CRITICAL;
258fetch_new_scb_inprog:
259	test	CCSCBCTL, ARRDONE jz return;
260fetch_new_scb_done:
261	and	CCSCBCTL, ~(CCARREN|CCSCBEN);
262	bmov	REG0, SCBPTR, 2;
263	clr	A;
264	add	CMDS_PENDING, 1;
265	adc	CMDS_PENDING[1], A;
266	if ((ahd->bugs & AHD_PKT_LUN_BUG) != 0) {
267		/*
268		 * "Short Luns" are not placed into outgoing LQ
269		 * packets in the correct byte order.  Use a full
270		 * sized lun field instead and fill it with the
271		 * one byte of lun information we support.
272		 */
273		mov	SCB_PKT_LUN[6], SCB_LUN;
274	}
275	/*
276	 * The FIFO use count field is shared with the
277	 * tag set by the host so that our SCB dma engine
278	 * knows the correct location to store the SCB.
279	 * Set it to zero before processing the SCB.
280	 */
281	clr	SCB_FIFO_USE_COUNT;
282	/* Update the next SCB address to download. */
283	bmov	NEXT_QUEUED_SCB_ADDR, SCB_NEXT_SCB_BUSADDR, 4;
284	mvi	SCB_NEXT[1], SCB_LIST_NULL;
285	mvi	SCB_NEXT2[1], SCB_LIST_NULL;
286	/* Increment our position in the QINFIFO. */
287	mov	NONE, SNSCB_QOFF;
288	/*
289	 * SCBs that want to send messages are always
290	 * queued independently.  This ensures that they
291	 * are at the head of the SCB list to select out
292	 * to a target and we will see the MK_MESSAGE flag.
293	 */
294	test	SCB_CONTROL, MK_MESSAGE jnz first_new_target_scb;
295	shr	SINDEX, 3, SCB_SCSIID;
296	and	SINDEX, ~0x1;
297	mvi	SINDEX[1], (WAITING_SCB_TAILS >> 8);
298	bmov	DINDEX, SINDEX, 2;
299	bmov	SCBPTR, SINDIR, 2;
300	bmov	DINDIR, REG0, 2;
301	cmp	SCBPTR[1], SCB_LIST_NULL je first_new_target_scb;
302	bmov	SCB_NEXT, REG0, 2 ret;
303first_new_target_scb:
304	cmp	WAITING_TID_HEAD[1], SCB_LIST_NULL je first_new_scb;
305	bmov	SCBPTR, WAITING_TID_TAIL, 2;
306	bmov	SCB_NEXT2, REG0, 2;
307	bmov	WAITING_TID_TAIL, REG0, 2 ret;
308first_new_scb:
309	bmov	WAITING_TID_HEAD, REG0, 2;
310	bmov	WAITING_TID_TAIL, REG0, 2 ret;
311END_CRITICAL;
312
313scbdma_idle:
314	/*
315	 * Give precedence to downloading new SCBs to execute
316	 * unless select-outs are currently frozen.
317	 */
318	test	SEQ_FLAGS2, SELECTOUT_QFROZEN jnz . + 2;
319BEGIN_CRITICAL;
320	test	QOFF_CTLSTA, NEW_SCB_AVAIL jnz fetch_new_scb;
321	cmp	COMPLETE_DMA_SCB_HEAD[1], SCB_LIST_NULL jne dma_complete_scb;
322	cmp	COMPLETE_SCB_HEAD[1], SCB_LIST_NULL je return;
323	/* FALLTHROUGH */
324fill_qoutfifo:
325	/*
326	 * Keep track of the SCBs we are DMA'ing just
327	 * in case the DMA fails or is aborted.
328	 */
329	mov	A, QOUTFIFO_ENTRY_VALID_TAG;
330	bmov	COMPLETE_SCB_DMAINPROG_HEAD, COMPLETE_SCB_HEAD, 2;
331	mvi	CCSCBCTL, CCSCBRESET;
332	bmov	SCBHADDR, QOUTFIFO_NEXT_ADDR, 4;
333	bmov	SCBPTR, COMPLETE_SCB_HEAD, 2;
334fill_qoutfifo_loop:
335	mov	CCSCBRAM, SCBPTR;
336	or	CCSCBRAM, A, SCBPTR[1];
337	mov	NONE, SDSCB_QOFF;
338	inc	INT_COALESCING_CMDCOUNT;
339	add	CMDS_PENDING, -1;
340	adc	CMDS_PENDING[1], -1;
341	cmp	SCB_NEXT_COMPLETE[1], SCB_LIST_NULL je fill_qoutfifo_done;
342	cmp	CCSCBADDR, CCSCBADDR_MAX je fill_qoutfifo_done;
343	test	QOFF_CTLSTA, SDSCB_ROLLOVR jnz fill_qoutfifo_done;
344	bmov	SCBPTR, SCB_NEXT_COMPLETE, 2;
345	jmp	fill_qoutfifo_loop;
346fill_qoutfifo_done:
347	mov	SCBHCNT, CCSCBADDR;
348	mvi	CCSCBCTL, CCSCBEN|CCSCBRESET;
349	bmov	COMPLETE_SCB_HEAD, SCB_NEXT_COMPLETE, 2;
350	mvi	SCB_NEXT_COMPLETE[1], SCB_LIST_NULL ret;
351
352fetch_new_scb:
353	bmov	SCBHADDR, NEXT_QUEUED_SCB_ADDR, 4;
354	mvi	CCARREN|CCSCBEN|CCSCBDIR|CCSCBRESET jmp dma_scb;
355dma_complete_scb:
356	bmov	SCBPTR, COMPLETE_DMA_SCB_HEAD, 2;
357	bmov	SCBHADDR, SCB_BUSADDR, 4;
358	mvi	CCARREN|CCSCBEN|CCSCBRESET jmp dma_scb;
359END_CRITICAL;
360
361/*
362 * Either post or fetch an SCB from host memory.  The caller
363 * is responsible for polling for transfer completion.
364 *
365 * Prerequisites: Mode == M_CCHAN
366 *		 SINDEX contains CCSCBCTL flags
367 *		 SCBHADDR set to Host SCB address
368 *		 SCBPTR set to SCB src location on "push" operations
369 */
370SET_SRC_MODE	M_CCHAN;
371SET_DST_MODE	M_CCHAN;
372dma_scb:
373	mvi	SCBHCNT, SCB_TRANSFER_SIZE;
374	mov	CCSCBCTL, SINDEX ret;
375
376BEGIN_CRITICAL;
377setjmp:
378	bmov	LONGJMP_ADDR, STACK, 2 ret;
379setjmp_inline:
380	bmov	LONGJMP_ADDR, STACK, 2;
381longjmp:
382	bmov	STACK, LONGJMP_ADDR, 2 ret;
383END_CRITICAL;
384
385/*************************** Chip Bug Work Arounds ****************************/
386/*
387 * Must disable interrupts when setting the mode pointer
388 * register as an interrupt occurring mid update will
389 * fail to store the new mode value for restoration on
390 * an iret.
391 */
392if ((ahd->bugs & AHD_SET_MODE_BUG) != 0) {
393set_mode_work_around:
394	mvi	SEQINTCTL, INTVEC1DSL;
395	mov	MODE_PTR, SINDEX;
396	clr	SEQINTCTL ret;
397
398toggle_dff_mode_work_around:
399	mvi	SEQINTCTL, INTVEC1DSL;
400	xor	MODE_PTR, MK_MODE(M_DFF1, M_DFF1);
401	clr	SEQINTCTL ret;
402}
403
404
405if ((ahd->bugs & AHD_INTCOLLISION_BUG) != 0) {
406set_seqint_work_around:
407	mov	SEQINTCODE, SINDEX;
408	mvi	SEQINTCODE, NO_SEQINT ret;
409}
410
411/************************ Packetized LongJmp Routines *************************/
412SET_SRC_MODE	M_SCSI;
413SET_DST_MODE	M_SCSI;
414start_selection:
415BEGIN_CRITICAL;
416	if ((ahd->bugs & AHD_SENT_SCB_UPDATE_BUG) != 0) {
417		/*
418		 * Razor #494
419		 * Rev A hardware fails to update LAST/CURR/NEXTSCB
420		 * correctly after a packetized selection in several
421		 * situations:
422		 *
423		 * 1) If only one command existed in the queue, the
424		 *    LAST/CURR/NEXTSCB are unchanged.
425		 *
426		 * 2) In a non QAS, protocol allowed phase change,
427		 *    the queue is shifted 1 too far.  LASTSCB is
428		 *    the last SCB that was correctly processed.
429		 *
430		 * 3) In the QAS case, if the full list of commands
431		 *    was successfully sent, NEXTSCB is NULL and neither
432		 *    CURRSCB nor LASTSCB can be trusted.  We must
433		 *    manually walk the list counting MAXCMDCNT elements
434		 *    to find the last SCB that was sent correctly.
435		 *
436		 * To simplify the workaround for this bug in SELDO
437		 * handling, we initialize LASTSCB prior to enabling
438		 * selection so we can rely on it even for case #1 above.
439		 */
440		bmov	LASTSCB, WAITING_TID_HEAD, 2;
441	}
442	bmov	CURRSCB, WAITING_TID_HEAD, 2;
443	bmov	SCBPTR, WAITING_TID_HEAD, 2;
444	shr	SELOID, 4, SCB_SCSIID;
445	/*
446	 * If we want to send a message to the device, ensure
447	 * we are selecting with atn irregardless of our packetized
448	 * agreement.  Since SPI4 only allows target reset or PPR
449	 * messages if this is a packetized connection, the change
450	 * to our negotiation table entry for this selection will
451	 * be cleared when the message is acted on.
452	 */
453	test	SCB_CONTROL, MK_MESSAGE jz . + 3;
454	mov	NEGOADDR, SELOID;
455	or	NEGCONOPTS, ENAUTOATNO;
456	or	SCSISEQ0, ENSELO ret;
457END_CRITICAL;
458
459/*
460 * Allocate a FIFO for a non-packetized transaction.
461 * In RevA hardware, both FIFOs must be free before we
462 * can allocate a FIFO for a non-packetized transaction.
463 */
464allocate_fifo_loop:
465	/*
466	 * Do whatever work is required to free a FIFO.
467	 */
468	call	idle_loop_service_fifos;
469	SET_MODE(M_SCSI, M_SCSI)
470allocate_fifo:
471	if ((ahd->bugs & AHD_NONPACKFIFO_BUG) != 0) {
472		and	A, FIFO0FREE|FIFO1FREE, DFFSTAT;
473		cmp	A, FIFO0FREE|FIFO1FREE jne allocate_fifo_loop;
474	} else {
475		test	DFFSTAT, FIFO1FREE jnz allocate_fifo1;
476		test	DFFSTAT, FIFO0FREE jz allocate_fifo_loop;
477		mvi	DFFSTAT, B_CURRFIFO_0;
478		SET_MODE(M_DFF0, M_DFF0)
479		bmov	SCBPTR, ALLOCFIFO_SCBPTR, 2 ret;
480	}
481SET_SRC_MODE	M_SCSI;
482SET_DST_MODE	M_SCSI;
483allocate_fifo1:
484	mvi	DFFSTAT, CURRFIFO_1;
485	SET_MODE(M_DFF1, M_DFF1)
486	bmov	SCBPTR, ALLOCFIFO_SCBPTR, 2 ret;
487
488/*
489 * We have been reselected as an initiator
490 * or selected as a target.
491 */
492SET_SRC_MODE	M_SCSI;
493SET_DST_MODE	M_SCSI;
494select_in:
495	if ((ahd->bugs & AHD_BUSFREEREV_BUG) != 0) {
496		/*
497		 * This exposes a window whereby a
498		 * busfree just after a selection will
499		 * be missed, but there is no other safe
500		 * way to enable busfree detection if
501		 * the busfreerev function is broken.
502		 */
503		mvi	CLRSINT1,CLRBUSFREE;
504		or	SIMODE1, ENBUSFREE;
505	}
506	or	SXFRCTL0, SPIOEN;
507	and	SAVED_SCSIID, SELID_MASK, SELID;
508	and	A, OID, IOWNID;
509	or	SAVED_SCSIID, A;
510	mvi	CLRSINT0, CLRSELDI;
511	jmp	ITloop;
512
513/*
514 * We have successfully selected out.
515 *
516 * Clear SELDO.
517 * Dequeue all SCBs sent from the waiting queue
518 * Requeue all SCBs *not* sent to the tail of the waiting queue
519 * Take Razor #494 into account for above.
520 *
521 * In Packetized Mode:
522 *	Return to the idle loop.  Our interrupt handler will take
523 *	care of any incoming L_Qs.
524 *
525 * In Non-Packetize Mode:
526 *	Continue to our normal state machine.
527 */
528SET_SRC_MODE	M_SCSI;
529SET_DST_MODE	M_SCSI;
530select_out:
531BEGIN_CRITICAL;
532	/* Clear out all SCBs that have been successfully sent. */
533	if ((ahd->bugs & AHD_SENT_SCB_UPDATE_BUG) != 0) {
534		/*
535		 * For packetized, the LQO manager clears ENSELO on
536		 * the assertion of SELDO.  If we are non-packetized,
537		 * LASTSCB and CURRSCB are accurate.
538		 */
539		test	SCSISEQ0, ENSELO jnz use_lastscb;
540
541		/*
542		 * The update is correct for LQOSTAT1 errors.  All
543		 * but LQOBUSFREE are handled by kernel interrupts.
544		 * If we see LQOBUSFREE, return to the idle loop.
545		 * Once we are out of the select_out critical section,
546		 * the kernel will cleanup the LQOBUSFREE and we will
547		 * eventually restart the selection if appropriate.
548		 */
549		test	LQOSTAT1, LQOBUSFREE jnz idle_loop;
550
551		/*
552		 * On a phase change outside of packet boundaries,
553		 * LASTSCB points to the currently active SCB context
554		 * on the bus.
555		 */
556		test	LQOSTAT2, LQOPHACHGOUTPKT jnz use_lastscb;
557
558		/*
559		 * If the hardware has traversed the whole list, NEXTSCB
560		 * will be NULL, CURRSCB and LASTSCB cannot be trusted,
561		 * but MAXCMDCNT is accurate.  If we stop part way through
562		 * the list or only had one command to issue, NEXTSCB[1] is
563		 * not NULL and LASTSCB is the last command to go out.
564		 */
565		cmp	NEXTSCB[1], SCB_LIST_NULL jne use_lastscb;
566
567		/*
568		 * Brute force walk.
569		 */
570		bmov	SCBPTR, WAITING_TID_HEAD, 2;
571		mvi	SEQINTCTL, INTVEC1DSL;
572		mvi	MODE_PTR, MK_MODE(M_CFG, M_CFG);
573		mov	A, MAXCMDCNT;
574		mvi	MODE_PTR, MK_MODE(M_SCSI, M_SCSI);
575		clr	SEQINTCTL;
576find_lastscb_loop:
577		dec	A;
578		test	A, 0xFF jz found_last_sent_scb;
579		bmov	SCBPTR, SCB_NEXT, 2;
580		jmp	find_lastscb_loop;
581use_lastscb:
582		bmov	SCBPTR, LASTSCB, 2;
583found_last_sent_scb:
584		bmov	CURRSCB, SCBPTR, 2;
585curscb_ww_done:
586	} else {
587		bmov	SCBPTR, CURRSCB, 2;
588	}
589
590	/*
591	 * Requeue any SCBs not sent, to the tail of the waiting Q.
592	 */
593	cmp	SCB_NEXT[1], SCB_LIST_NULL je select_out_list_done;
594
595	/*
596	 * We know that neither the per-TID list nor the list of
597	 * TIDs is empty.  Use this knowledge to our advantage.
598	 */
599	bmov	REG0, SCB_NEXT, 2;
600	bmov	SCBPTR, WAITING_TID_TAIL, 2;
601	bmov	SCB_NEXT2, REG0, 2;
602	bmov	WAITING_TID_TAIL, REG0, 2;
603	jmp	select_out_inc_tid_q;
604
605select_out_list_done:
606	/*
607	 * The whole list made it.  Just clear our TID's tail pointer
608	 * unless we were queued independently due to our need to
609	 * send a message.
610	 */
611	test	SCB_CONTROL, MK_MESSAGE jnz select_out_inc_tid_q;
612	shr	DINDEX, 3, SCB_SCSIID;
613	or	DINDEX, 1;	/* Want only the second byte */
614	mvi	DINDEX[1], ((WAITING_SCB_TAILS) >> 8);
615	mvi	DINDIR, SCB_LIST_NULL;
616select_out_inc_tid_q:
617	bmov	SCBPTR, WAITING_TID_HEAD, 2;
618	bmov	WAITING_TID_HEAD, SCB_NEXT2, 2;
619	cmp	WAITING_TID_HEAD[1], SCB_LIST_NULL jne . + 2;
620	mvi	WAITING_TID_TAIL[1], SCB_LIST_NULL;
621	bmov	SCBPTR, CURRSCB, 2;
622	mvi	CLRSINT0, CLRSELDO;
623	test	LQOSTAT2, LQOPHACHGOUTPKT jnz unexpected_nonpkt_phase;
624	test	LQOSTAT1, LQOPHACHGINPKT jnz unexpected_nonpkt_phase;
625
626	/*
627	 * If this is a packetized connection, return to our
628	 * idle_loop and let our interrupt handler deal with
629	 * any connection setup/teardown issues.  The only
630	 * exceptions are the case of MK_MESSAGE and task management
631	 * SCBs.
632	 */
633	if ((ahd->bugs & AHD_LQO_ATNO_BUG) != 0) {
634		/*
635		 * In the A, the LQO manager transitions to LQOSTOP0 even if
636		 * we have selected out with ATN asserted and the target
637		 * REQs in a non-packet phase.
638		 */
639		test 	SCB_CONTROL, MK_MESSAGE jz select_out_no_message;
640		test	SCSISIGO, ATNO jnz select_out_non_packetized;
641select_out_no_message:
642	}
643	test	LQOSTAT2, LQOSTOP0 jz select_out_non_packetized;
644	test	SCB_TASK_MANAGEMENT, 0xFF jz idle_loop;
645	SET_SEQINTCODE(TASKMGMT_FUNC_COMPLETE)
646	jmp	idle_loop;
647
648select_out_non_packetized:
649	/* Non packetized request. */
650	and     SCSISEQ0, ~ENSELO;
651	if ((ahd->bugs & AHD_BUSFREEREV_BUG) != 0) {
652		/*
653		 * This exposes a window whereby a
654		 * busfree just after a selection will
655		 * be missed, but there is no other safe
656		 * way to enable busfree detection if
657		 * the busfreerev function is broken.
658		 */
659		mvi	CLRSINT1,CLRBUSFREE;
660		or	SIMODE1, ENBUSFREE;
661	}
662	mov	SAVED_SCSIID, SCB_SCSIID;
663	mov	SAVED_LUN, SCB_LUN;
664	mvi	SEQ_FLAGS, NO_CDB_SENT;
665END_CRITICAL;
666	or	SXFRCTL0, SPIOEN;
667
668	/*
669	 * As soon as we get a successful selection, the target
670	 * should go into the message out phase since we have ATN
671	 * asserted.
672	 */
673	mvi	MSG_OUT, MSG_IDENTIFYFLAG;
674
675	/*
676	 * Main loop for information transfer phases.  Wait for the
677	 * target to assert REQ before checking MSG, C/D and I/O for
678	 * the bus phase.
679	 */
680mesgin_phasemis:
681ITloop:
682	call	phase_lock;
683
684	mov	A, LASTPHASE;
685
686	test	A, ~P_DATAIN_DT	jz p_data;
687	cmp	A,P_COMMAND	je p_command;
688	cmp	A,P_MESGOUT	je p_mesgout;
689	cmp	A,P_STATUS	je p_status;
690	cmp	A,P_MESGIN	je p_mesgin;
691
692	SET_SEQINTCODE(BAD_PHASE)
693	jmp	ITloop;			/* Try reading the bus again. */
694
695/*
696 * Command phase.  Set up the DMA registers and let 'er rip.
697 */
698p_command:
699	test	SEQ_FLAGS, NOT_IDENTIFIED jz p_command_okay;
700	SET_SEQINTCODE(PROTO_VIOLATION)
701p_command_okay:
702	test	MODE_PTR, ~(MK_MODE(M_DFF1, M_DFF1))
703		jnz p_command_allocate_fifo;
704	/*
705	 * Command retry.  Free our current FIFO and
706	 * re-allocate a FIFO so transfer state is
707	 * reset.
708	 */
709SET_SRC_MODE	M_DFF1;
710SET_DST_MODE	M_DFF1;
711	mvi	DFFSXFRCTL, RSTCHN|CLRSHCNT;
712	SET_MODE(M_SCSI, M_SCSI)
713p_command_allocate_fifo:
714	bmov	ALLOCFIFO_SCBPTR, SCBPTR, 2;
715	call	allocate_fifo;
716SET_SRC_MODE	M_DFF1;
717SET_DST_MODE	M_DFF1;
718	add	NONE, -17, SCB_CDB_LEN;
719	jnc	p_command_embedded;
720p_command_from_host:
721	bmov	HADDR[0], SCB_HOST_CDB_PTR, 9;
722	mvi	SG_CACHE_PRE, LAST_SEG;
723	mvi	DFCNTRL, (PRELOADEN|SCSIEN|HDMAEN);
724	jmp	p_command_xfer;
725p_command_embedded:
726	bmov	SHCNT[0], SCB_CDB_LEN,  1;
727	bmov	DFDAT, SCB_CDB_STORE, 16;
728	mvi	DFCNTRL, SCSIEN;
729p_command_xfer:
730	and	SEQ_FLAGS, ~NO_CDB_SENT;
731	test	DFCNTRL, SCSIEN jnz .;
732	/*
733	 * DMA Channel automatically disabled.
734	 * Don't allow a data phase if the command
735	 * was not fully transferred.
736	 */
737	test	SSTAT2, SDONE jnz ITloop;
738	or	SEQ_FLAGS, NO_CDB_SENT;
739	jmp	ITloop;
740
741
742/*
743 * Status phase.  Wait for the data byte to appear, then read it
744 * and store it into the SCB.
745 */
746SET_SRC_MODE	M_SCSI;
747SET_DST_MODE	M_SCSI;
748p_status:
749	test	SEQ_FLAGS,NOT_IDENTIFIED jnz mesgin_proto_violation;
750p_status_okay:
751	mov	SCB_SCSI_STATUS, SCSIDAT;
752	or	SCB_CONTROL, STATUS_RCVD;
753	jmp	ITloop;
754
755/*
756 * Message out phase.  If MSG_OUT is MSG_IDENTIFYFLAG, build a full
757 * identify message sequence and send it to the target.  The host may
758 * override this behavior by setting the MK_MESSAGE bit in the SCB
759 * control byte.  This will cause us to interrupt the host and allow
760 * it to handle the message phase completely on its own.  If the bit
761 * associated with this target is set, we will also interrupt the host,
762 * thereby allowing it to send a message on the next selection regardless
763 * of the transaction being sent.
764 *
765 * If MSG_OUT is == HOST_MSG, also interrupt the host and take a message.
766 * This is done to allow the host to send messages outside of an identify
767 * sequence while protecting the sequencer from testing the MK_MESSAGE bit
768 * on an SCB that might not be for the current nexus. (For example, a
769 * BDR message in response to a bad reselection would leave us pointed to
770 * an SCB that doesn't have anything to do with the current target).
771 *
772 * Otherwise, treat MSG_OUT as a 1 byte message to send (abort, abort tag,
773 * bus device reset).
774 *
775 * When there are no messages to send, MSG_OUT should be set to MSG_NOOP,
776 * in case the target decides to put us in this phase for some strange
777 * reason.
778 */
779p_mesgout_retry:
780	/* Turn on ATN for the retry */
781	mvi	SCSISIGO, ATNO;
782p_mesgout:
783	mov	SINDEX, MSG_OUT;
784	cmp	SINDEX, MSG_IDENTIFYFLAG jne p_mesgout_from_host;
785	test	SCB_CONTROL,MK_MESSAGE	jnz host_message_loop;
786p_mesgout_identify:
787	or	SINDEX, MSG_IDENTIFYFLAG|DISCENB, SCB_LUN;
788	test	SCB_CONTROL, DISCENB jnz . + 2;
789	and	SINDEX, ~DISCENB;
790/*
791 * Send a tag message if TAG_ENB is set in the SCB control block.
792 * Use SCB_NONPACKET_TAG as the tag value.
793 */
794p_mesgout_tag:
795	test	SCB_CONTROL,TAG_ENB jz  p_mesgout_onebyte;
796	mov	SCSIDAT, SINDEX;	/* Send the identify message */
797	call	phase_lock;
798	cmp	LASTPHASE, P_MESGOUT	jne p_mesgout_done;
799	and	SCSIDAT,TAG_ENB|SCB_TAG_TYPE,SCB_CONTROL;
800	call	phase_lock;
801	cmp	LASTPHASE, P_MESGOUT	jne p_mesgout_done;
802	mov	SCBPTR jmp p_mesgout_onebyte;
803/*
804 * Interrupt the driver, and allow it to handle this message
805 * phase and any required retries.
806 */
807p_mesgout_from_host:
808	cmp	SINDEX, HOST_MSG	jne p_mesgout_onebyte;
809	jmp	host_message_loop;
810
811p_mesgout_onebyte:
812	mvi	CLRSINT1, CLRATNO;
813	mov	SCSIDAT, SINDEX;
814
815/*
816 * If the next bus phase after ATN drops is message out, it means
817 * that the target is requesting that the last message(s) be resent.
818 */
819	call	phase_lock;
820	cmp	LASTPHASE, P_MESGOUT	je p_mesgout_retry;
821
822p_mesgout_done:
823	mvi	CLRSINT1,CLRATNO;	/* Be sure to turn ATNO off */
824	mov	LAST_MSG, MSG_OUT;
825	mvi	MSG_OUT, MSG_NOOP;	/* No message left */
826	jmp	ITloop;
827
828/*
829 * Message in phase.  Bytes are read using Automatic PIO mode.
830 */
831p_mesgin:
832	/* read the 1st message byte */
833	mvi	ACCUM		call inb_first;
834
835	test	A,MSG_IDENTIFYFLAG	jnz mesgin_identify;
836	cmp	A,MSG_DISCONNECT	je mesgin_disconnect;
837	cmp	A,MSG_SAVEDATAPOINTER	je mesgin_sdptrs;
838	cmp	ALLZEROS,A		je mesgin_complete;
839	cmp	A,MSG_RESTOREPOINTERS	je mesgin_rdptrs;
840	cmp	A,MSG_IGN_WIDE_RESIDUE	je mesgin_ign_wide_residue;
841	cmp	A,MSG_NOOP		je mesgin_done;
842
843/*
844 * Pushed message loop to allow the kernel to
845 * run its own message state engine.  To avoid an
846 * extra nop instruction after signaling the kernel,
847 * we perform the phase_lock before checking to see
848 * if we should exit the loop and skip the phase_lock
849 * in the ITloop.  Performing back to back phase_locks
850 * shouldn't hurt, but why do it twice...
851 */
852host_message_loop:
853	call	phase_lock;	/* Benign the first time through. */
854	SET_SEQINTCODE(HOST_MSG_LOOP)
855	cmp	RETURN_1, EXIT_MSG_LOOP	je ITloop;
856	cmp	RETURN_1, CONT_MSG_LOOP_WRITE	jne . + 3;
857	mov	SCSIDAT, RETURN_2;
858	jmp	host_message_loop;
859	/* Must be CONT_MSG_LOOP_READ */
860	mov	NONE, SCSIDAT;	/* ACK Byte */
861	jmp	host_message_loop;
862
863mesgin_ign_wide_residue:
864	mov	SAVED_MODE, MODE_PTR;
865	SET_MODE(M_SCSI, M_SCSI)
866	shr	NEGOADDR, 4, SAVED_SCSIID;
867	mov	A, NEGCONOPTS;
868	RESTORE_MODE(SAVED_MODE)
869	test	A, WIDEXFER jz mesgin_reject;
870	/* Pull the residue byte */
871	mvi	REG0	call inb_next;
872	cmp	REG0, 0x01 jne mesgin_reject;
873	test	SCB_RESIDUAL_SGPTR[0], SG_LIST_NULL jz . + 2;
874	test	SCB_TASK_ATTRIBUTE, SCB_XFERLEN_ODD jnz mesgin_done;
875	SET_SEQINTCODE(IGN_WIDE_RES)
876	jmp	mesgin_done;
877
878mesgin_proto_violation:
879	SET_SEQINTCODE(PROTO_VIOLATION)
880	jmp	mesgin_done;
881mesgin_reject:
882	mvi	MSG_MESSAGE_REJECT	call mk_mesg;
883mesgin_done:
884	mov	NONE,SCSIDAT;		/*dummy read from latch to ACK*/
885	jmp	ITloop;
886
887#define INDEX_DISC_LIST(scsiid, lun)					\
888	and	A, 0xC0, scsiid;					\
889	or	SCBPTR, A, lun;						\
890	clr	SCBPTR[1];						\
891	and	SINDEX, 0x30, scsiid;					\
892	shr	SINDEX, 3;	/* Multiply by 2 */			\
893	add	SINDEX, (SCB_DISCONNECTED_LISTS & 0xFF);		\
894	mvi	SINDEX[1], ((SCB_DISCONNECTED_LISTS >> 8) & 0xFF)
895
896mesgin_identify:
897	/*
898	 * Determine whether a target is using tagged or non-tagged
899	 * transactions by first looking at the transaction stored in
900	 * the per-device, disconnected array.  If there is no untagged
901	 * transaction for this target, this must be a tagged transaction.
902	 */
903	and	SAVED_LUN, MSG_IDENTIFY_LUNMASK, A;
904	INDEX_DISC_LIST(SAVED_SCSIID, SAVED_LUN);
905	bmov	DINDEX, SINDEX, 2;
906	bmov	REG0, SINDIR, 2;
907	cmp	REG0[1], SCB_LIST_NULL je snoop_tag;
908	/* Untagged.  Clear the busy table entry and setup the SCB. */
909	bmov	DINDIR, ALLONES, 2;
910	bmov	SCBPTR, REG0, 2;
911	jmp	setup_SCB;
912
913/*
914 * Here we "snoop" the bus looking for a SIMPLE QUEUE TAG message.
915 * If we get one, we use the tag returned to find the proper
916 * SCB.  After receiving the tag, look for the SCB at SCB locations tag and
917 * tag + 256.
918 */
919snoop_tag:
920	if ((ahd->flags & AHD_SEQUENCER_DEBUG) != 0) {
921		or	SEQ_FLAGS, 0x80;
922	}
923	mov	NONE, SCSIDAT;		/* ACK Identify MSG */
924	call	phase_lock;
925	if ((ahd->flags & AHD_SEQUENCER_DEBUG) != 0) {
926		or	SEQ_FLAGS, 0x1;
927	}
928	cmp	LASTPHASE, P_MESGIN	jne not_found_ITloop;
929	if ((ahd->flags & AHD_SEQUENCER_DEBUG) != 0) {
930		or	SEQ_FLAGS, 0x2;
931	}
932	cmp	SCSIBUS, MSG_SIMPLE_Q_TAG jne not_found;
933get_tag:
934	clr	SCBPTR[1];
935	mvi	SCBPTR	call inb_next;	/* tag value */
936verify_scb:
937	test	SCB_CONTROL,DISCONNECTED jz verify_other_scb;
938	mov	A, SAVED_SCSIID;
939	cmp	SCB_SCSIID, A jne verify_other_scb;
940	mov	A, SAVED_LUN;
941	cmp	SCB_LUN, A je setup_SCB_disconnected;
942verify_other_scb:
943	xor	SCBPTR[1], 1;
944	test	SCBPTR[1], 0xFF jnz verify_scb;
945	jmp	not_found;
946
947/*
948 * Ensure that the SCB the tag points to is for
949 * an SCB transaction to the reconnecting target.
950 */
951setup_SCB:
952	if ((ahd->flags & AHD_SEQUENCER_DEBUG) != 0) {
953		or	SEQ_FLAGS, 0x10;
954	}
955	test	SCB_CONTROL,DISCONNECTED jz not_found;
956setup_SCB_disconnected:
957	and	SCB_CONTROL,~DISCONNECTED;
958	clr	SEQ_FLAGS;	/* make note of IDENTIFY */
959	test	SCB_SGPTR, SG_LIST_NULL jnz . + 3;
960	bmov	ALLOCFIFO_SCBPTR, SCBPTR, 2;
961	call	allocate_fifo;
962	/* See if the host wants to send a message upon reconnection */
963	test	SCB_CONTROL, MK_MESSAGE jz mesgin_done;
964	mvi	HOST_MSG	call mk_mesg;
965	jmp	mesgin_done;
966
967not_found:
968	SET_SEQINTCODE(NO_MATCH)
969	jmp	mesgin_done;
970
971not_found_ITloop:
972	SET_SEQINTCODE(NO_MATCH)
973	jmp	ITloop;
974
975/*
976 * We received a "command complete" message.  Put the SCB on the complete
977 * queue and trigger a completion interrupt via the idle loop.  Before doing
978 * so, check to see if there
979 * is a residual or the status byte is something other than STATUS_GOOD (0).
980 * In either of these conditions, we upload the SCB back to the host so it can
981 * process this information.  In the case of a non zero status byte, we
982 * additionally interrupt the kernel driver synchronously, allowing it to
983 * decide if sense should be retrieved.  If the kernel driver wishes to request
984 * sense, it will fill the kernel SCB with a request sense command, requeue
985 * it to the QINFIFO and tell us not to post to the QOUTFIFO by setting
986 * RETURN_1 to SEND_SENSE.
987 */
988mesgin_complete:
989
990	/*
991	 * If ATN is raised, we still want to give the target a message.
992	 * Perhaps there was a parity error on this last message byte.
993	 * Either way, the target should take us to message out phase
994	 * and then attempt to complete the command again.  We should use a
995	 * critical section here to guard against a timeout triggering
996	 * for this command and setting ATN while we are still processing
997	 * the completion.
998	test	SCSISIGI, ATNI jnz mesgin_done;
999	 */
1000
1001	/*
1002	 * If we are identified and have successfully sent the CDB,
1003	 * any status will do.  Optimize this fast path.
1004	 */
1005	test	SCB_CONTROL, STATUS_RCVD jz mesgin_proto_violation;
1006	test	SEQ_FLAGS, NOT_IDENTIFIED|NO_CDB_SENT jz complete_accepted;
1007
1008	/*
1009	 * If the target never sent an identify message but instead went
1010	 * to mesgin to give an invalid message, let the host abort us.
1011	 */
1012	test	SEQ_FLAGS, NOT_IDENTIFIED jnz mesgin_proto_violation;
1013
1014	/*
1015	 * If we received good status but never successfully sent the
1016	 * cdb, abort the command.
1017	 */
1018	test	SCB_SCSI_STATUS,0xff	jnz complete_accepted;
1019	test	SEQ_FLAGS, NO_CDB_SENT jnz mesgin_proto_violation;
1020complete_accepted:
1021
1022	/*
1023	 * See if we attempted to deliver a message but the target ignored us.
1024	 */
1025	test	SCB_CONTROL, MK_MESSAGE jz complete_nomsg;
1026	SET_SEQINTCODE(MKMSG_FAILED)
1027complete_nomsg:
1028	call	queue_scb_completion;
1029	jmp	await_busfree;
1030
1031freeze_queue:
1032	/* Cancel any pending select-out. */
1033	test	SSTAT0, SELDO|SELINGO jnz . + 2;
1034	and	SCSISEQ0, ~ENSELO;
1035	mov	ACCUM_SAVE, A;
1036	clr	A;
1037	add	QFREEZE_COUNT, 1;
1038	adc	QFREEZE_COUNT[1], A;
1039	or	SEQ_FLAGS2, SELECTOUT_QFROZEN;
1040	mov	A, ACCUM_SAVE ret;
1041
1042/*
1043 * Complete the current FIFO's SCB if data for this same
1044 * SCB is not transferring in the other FIFO.
1045 */
1046SET_SRC_MODE	M_DFF1;
1047SET_DST_MODE	M_DFF1;
1048pkt_complete_scb_if_fifos_idle:
1049	bmov	ARG_1, SCBPTR, 2;
1050	mvi	DFFSXFRCTL, CLRCHN;
1051	SET_MODE(M_SCSI, M_SCSI)
1052	bmov	SCBPTR, ARG_1, 2;
1053	test	SCB_FIFO_USE_COUNT, 0xFF jnz return;
1054queue_scb_completion:
1055	test	SCB_SCSI_STATUS,0xff	jnz bad_status;
1056	/*
1057	 * Check for residuals
1058	 */
1059	test	SCB_SGPTR, SG_LIST_NULL jnz complete;	/* No xfer */
1060	test	SCB_SGPTR, SG_FULL_RESID jnz upload_scb;/* Never xfered */
1061	test	SCB_RESIDUAL_SGPTR, SG_LIST_NULL jz upload_scb;
1062complete:
1063	bmov	SCB_NEXT_COMPLETE, COMPLETE_SCB_HEAD, 2;
1064	bmov	COMPLETE_SCB_HEAD, SCBPTR, 2 ret;
1065bad_status:
1066	cmp	SCB_SCSI_STATUS, STATUS_PKT_SENSE je upload_scb;
1067	call	freeze_queue;
1068upload_scb:
1069	/*
1070	 * Restore SCB TAG since we reuse this field
1071	 * in the sequencer.  We don't want to corrupt
1072	 * it on the host.
1073	 */
1074	bmov	SCB_TAG, SCBPTR, 2;
1075	bmov	SCB_NEXT_COMPLETE, COMPLETE_DMA_SCB_HEAD, 2;
1076	bmov	COMPLETE_DMA_SCB_HEAD, SCBPTR, 2;
1077	or	SCB_SGPTR, SG_STATUS_VALID ret;
1078
1079/*
1080 * Is it a disconnect message?  Set a flag in the SCB to remind us
1081 * and await the bus going free.  If this is an untagged transaction
1082 * store the SCB id for it in our untagged target table for lookup on
1083 * a reselection.
1084 */
1085mesgin_disconnect:
1086	/*
1087	 * If ATN is raised, we still want to give the target a message.
1088	 * Perhaps there was a parity error on this last message byte
1089	 * or we want to abort this command.  Either way, the target
1090	 * should take us to message out phase and then attempt to
1091	 * disconnect again.
1092	 * XXX - Wait for more testing.
1093	test	SCSISIGI, ATNI jnz mesgin_done;
1094	 */
1095	test	SEQ_FLAGS, NOT_IDENTIFIED|NO_CDB_SENT
1096		jnz mesgin_proto_violation;
1097	or	SCB_CONTROL,DISCONNECTED;
1098	test	SCB_CONTROL, TAG_ENB jnz await_busfree;
1099queue_disc_scb:
1100	bmov	REG0, SCBPTR, 2;
1101	INDEX_DISC_LIST(SAVED_SCSIID, SAVED_LUN);
1102	bmov	DINDEX, SINDEX, 2;
1103	bmov	DINDIR, REG0, 2;
1104	bmov	SCBPTR, REG0, 2;
1105	/* FALLTHROUGH */
1106await_busfree:
1107	and	SIMODE1, ~ENBUSFREE;
1108	if ((ahd->bugs & AHD_BUSFREEREV_BUG) == 0) {
1109		/*
1110		 * In the BUSFREEREV_BUG case, the
1111		 * busfree status was cleared at the
1112		 * beginning of the connection.
1113		 */
1114		mvi	CLRSINT1,CLRBUSFREE;
1115	}
1116	mov	NONE, SCSIDAT;		/* Ack the last byte */
1117	test	MODE_PTR, ~(MK_MODE(M_DFF1, M_DFF1))
1118		jnz await_busfree_not_m_dff;
1119SET_SRC_MODE	M_DFF1;
1120SET_DST_MODE	M_DFF1;
1121await_busfree_clrchn:
1122	mvi	DFFSXFRCTL, CLRCHN;
1123await_busfree_not_m_dff:
1124	call	clear_target_state;
1125	test	SSTAT1,REQINIT|BUSFREE	jz .;
1126	test	SSTAT1, BUSFREE jnz idle_loop;
1127	SET_SEQINTCODE(MISSED_BUSFREE)
1128
1129
1130/*
1131 * Save data pointers message:
1132 * Copying RAM values back to SCB, for Save Data Pointers message, but
1133 * only if we've actually been into a data phase to change them.  This
1134 * protects against bogus data in scratch ram and the residual counts
1135 * since they are only initialized when we go into data_in or data_out.
1136 * Ack the message as soon as possible.
1137 */
1138SET_SRC_MODE	M_DFF1;
1139SET_DST_MODE	M_DFF1;
1140mesgin_sdptrs:
1141	mov	NONE,SCSIDAT;		/*dummy read from latch to ACK*/
1142	test	SEQ_FLAGS, DPHASE	jz ITloop;
1143	call	save_pointers;
1144	jmp	ITloop;
1145
1146save_pointers:
1147	/*
1148	 * If we are asked to save our position at the end of the
1149	 * transfer, just mark us at the end rather than perform a
1150	 * full save.
1151	 */
1152	test	SCB_RESIDUAL_SGPTR[0], SG_LIST_NULL jz save_pointers_full;
1153	or	SCB_SGPTR, SG_LIST_NULL ret;
1154
1155save_pointers_full:
1156	/*
1157	 * The SCB_DATAPTR becomes the current SHADDR.
1158	 * All other information comes directly from our residual
1159	 * state.
1160	 */
1161	bmov	SCB_DATAPTR, SHADDR, 8;
1162	bmov	SCB_DATACNT, SCB_RESIDUAL_DATACNT, 8 ret;
1163
1164/*
1165 * Restore pointers message?  Data pointers are recopied from the
1166 * SCB anytime we enter a data phase for the first time, so all
1167 * we need to do is clear the DPHASE flag and let the data phase
1168 * code do the rest.  We also reset/reallocate the FIFO to make
1169 * sure we have a clean start for the next data or command phase.
1170 */
1171mesgin_rdptrs:
1172	and	SEQ_FLAGS, ~DPHASE;
1173	test	MODE_PTR, ~(MK_MODE(M_DFF1, M_DFF1)) jnz msgin_rdptrs_get_fifo;
1174	mvi	DFFSXFRCTL, RSTCHN|CLRSHCNT;
1175	SET_MODE(M_SCSI, M_SCSI)
1176msgin_rdptrs_get_fifo:
1177	call	allocate_fifo;
1178	jmp	mesgin_done;
1179
1180clear_target_state:
1181	mvi	LASTPHASE, P_BUSFREE;
1182	/* clear target specific flags */
1183	mvi	SEQ_FLAGS, NOT_IDENTIFIED|NO_CDB_SENT ret;
1184
1185phase_lock:
1186	if ((ahd->bugs & AHD_EARLY_REQ_BUG) != 0) {
1187		/*
1188		 * Don't ignore persistent REQ assertions just because
1189		 * they were asserted within the bus settle delay window.
1190		 * This allows us to tolerate devices like the GEM318
1191		 * that violate the SCSI spec.  We are careful not to
1192		 * count REQ while we are waiting for it to fall during
1193		 * an async phase due to our asserted ACK.  Each
1194		 * sequencer instruction takes ~25ns, so the REQ must
1195		 * last at least 100ns in order to be counted as a true
1196		 * REQ.
1197		 */
1198		test	SCSIPHASE, 0xFF jnz phase_locked;
1199		test	SCSISIGI, ACKI jnz phase_lock;
1200		test	SCSISIGI, REQI jz phase_lock;
1201		test	SCSIPHASE, 0xFF jnz phase_locked;
1202		test	SCSISIGI, ACKI jnz phase_lock;
1203		test	SCSISIGI, REQI jz phase_lock;
1204phase_locked:
1205	} else {
1206		test	SCSIPHASE, 0xFF jz .;
1207	}
1208	test	SSTAT1, SCSIPERR jnz phase_lock;
1209phase_lock_latch_phase:
1210	and	LASTPHASE, PHASE_MASK, SCSISIGI ret;
1211
1212/*
1213 * Functions to read data in Automatic PIO mode.
1214 *
1215 * An ACK is not sent on input from the target until SCSIDATL is read from.
1216 * So we wait until SCSIDATL is latched (the usual way), then read the data
1217 * byte directly off the bus using SCSIBUSL.  When we have pulled the ATN
1218 * line, or we just want to acknowledge the byte, then we do a dummy read
1219 * from SCISDATL.  The SCSI spec guarantees that the target will hold the
1220 * data byte on the bus until we send our ACK.
1221 *
1222 * The assumption here is that these are called in a particular sequence,
1223 * and that REQ is already set when inb_first is called.  inb_{first,next}
1224 * use the same calling convention as inb.
1225 */
1226inb_next:
1227	mov	NONE,SCSIDAT;		/*dummy read from latch to ACK*/
1228inb_next_wait:
1229	/*
1230	 * If there is a parity error, wait for the kernel to
1231	 * see the interrupt and prepare our message response
1232	 * before continuing.
1233	 */
1234	test	SCSIPHASE, 0xFF jz .;
1235	test	SSTAT1, SCSIPERR jnz inb_next_wait;
1236inb_next_check_phase:
1237	and	LASTPHASE, PHASE_MASK, SCSISIGI;
1238	cmp	LASTPHASE, P_MESGIN jne mesgin_phasemis;
1239inb_first:
1240	clr	DINDEX[1];
1241	mov	DINDEX,SINDEX;
1242	mov	DINDIR,SCSIBUS	ret;		/*read byte directly from bus*/
1243inb_last:
1244	mov	NONE,SCSIDAT ret;		/*dummy read from latch to ACK*/
1245
1246mk_mesg:
1247	mvi	SCSISIGO, ATNO;
1248	mov	MSG_OUT,SINDEX ret;
1249
1250SET_SRC_MODE	M_DFF1;
1251SET_DST_MODE	M_DFF1;
1252disable_ccsgen:
1253	test	SG_STATE, FETCH_INPROG jz disable_ccsgen_fetch_done;
1254	clr	CCSGCTL;
1255disable_ccsgen_fetch_done:
1256	clr	SG_STATE ret;
1257
1258service_fifo:
1259	/*
1260	 * Do we have any prefetch left???
1261	 */
1262	test	SG_STATE, SEGS_AVAIL jnz idle_sg_avail;
1263
1264	/*
1265	 * Can this FIFO have access to the S/G cache yet?
1266	 */
1267	test	CCSGCTL, SG_CACHE_AVAIL jz return;
1268
1269	/* Did we just finish fetching segs? */
1270	test	CCSGCTL, CCSGDONE jnz idle_sgfetch_complete;
1271
1272	/* Are we actively fetching segments? */
1273	test	CCSGCTL, CCSGENACK jnz return;
1274
1275	/*
1276	 * We fetch a "cacheline aligned" and sized amount of data
1277	 * so we don't end up referencing a non-existent page.
1278	 * Cacheline aligned is in quotes because the kernel will
1279	 * set the prefetch amount to a reasonable level if the
1280	 * cacheline size is unknown.
1281	 */
1282	bmov	SGHADDR, SCB_RESIDUAL_SGPTR, 4;
1283	mvi	SGHCNT, SG_PREFETCH_CNT;
1284	if ((ahd->bugs & AHD_REG_SLOW_SETTLE_BUG) != 0) {
1285		/*
1286		 * Need two instruction between "touches" of SGHADDR.
1287		 */
1288		nop;
1289	}
1290	and	SGHADDR[0], SG_PREFETCH_ALIGN_MASK, SCB_RESIDUAL_SGPTR;
1291	mvi	CCSGCTL, CCSGEN|CCSGRESET;
1292	or	SG_STATE, FETCH_INPROG ret;
1293idle_sgfetch_complete:
1294	/*
1295	 * Guard against SG_CACHE_AVAIL activating during sg fetch
1296	 * request in the other FIFO.
1297	 */
1298	test	SG_STATE, FETCH_INPROG jz return;
1299	clr	CCSGCTL;
1300	and	CCSGADDR, SG_PREFETCH_ADDR_MASK, SCB_RESIDUAL_SGPTR;
1301	mvi	SG_STATE, SEGS_AVAIL|LOADING_NEEDED;
1302idle_sg_avail:
1303	/* Does the hardware have space for another SG entry? */
1304	test	DFSTATUS, PRELOAD_AVAIL jz return;
1305	/*
1306	 * On the A, preloading a segment before HDMAENACK
1307	 * comes true can clobber the shadow address of the
1308	 * first segment in the S/G FIFO.  Wait until it is
1309	 * safe to proceed.
1310	 */
1311	if ((ahd->features & AHD_NEW_DFCNTRL_OPTS) == 0) {
1312		test	DFCNTRL, HDMAENACK jz return;
1313	}
1314	if ((ahd->flags & AHD_64BIT_ADDRESSING) != 0) {
1315		bmov	HADDR, CCSGRAM, 8;
1316	} else {
1317		bmov 	HADDR, CCSGRAM, 4;
1318	}
1319	bmov	HCNT, CCSGRAM, 3;
1320	bmov	SCB_RESIDUAL_DATACNT[3], CCSGRAM, 1;
1321	if ((ahd->flags & AHD_39BIT_ADDRESSING) != 0) {
1322		and	HADDR[4], SG_HIGH_ADDR_BITS, SCB_RESIDUAL_DATACNT[3];
1323	}
1324	if ((ahd->flags & AHD_64BIT_ADDRESSING) != 0) {
1325		/* Skip 4 bytes of pad. */
1326		add	CCSGADDR, 4;
1327	}
1328sg_advance:
1329	clr	A;			/* add sizeof(struct scatter) */
1330	add	SCB_RESIDUAL_SGPTR[0],SG_SIZEOF;
1331	adc	SCB_RESIDUAL_SGPTR[1],A;
1332	adc	SCB_RESIDUAL_SGPTR[2],A;
1333	adc	SCB_RESIDUAL_SGPTR[3],A;
1334	mov	SINDEX, SCB_RESIDUAL_SGPTR[0];
1335	test	SCB_RESIDUAL_DATACNT[3], SG_LAST_SEG jz . + 3;
1336	or	SINDEX, LAST_SEG;
1337	clr	SG_STATE;
1338	mov	SG_CACHE_PRE, SINDEX;
1339	if ((ahd->features & AHD_NEW_DFCNTRL_OPTS) != 0) {
1340		/*
1341		 * Use SCSIENWRDIS so that SCSIEN is never
1342		 * modified by this operation.
1343		 */
1344		or	DFCNTRL, PRELOADEN|HDMAEN|SCSIENWRDIS;
1345	} else {
1346		or	DFCNTRL, PRELOADEN|HDMAEN;
1347	}
1348	/*
1349	 * Do we have another segment in the cache?
1350	 */
1351	add	NONE, SG_PREFETCH_CNT_LIMIT, CCSGADDR;
1352	jnc	return;
1353	and	SG_STATE, ~SEGS_AVAIL ret;
1354
1355/*
1356 * Initialize the DMA address and counter from the SCB.
1357 */
1358load_first_seg:
1359	bmov	HADDR, SCB_DATAPTR, 11;
1360	and	REG_ISR, ~SG_FULL_RESID, SCB_SGPTR[0];
1361	test	SCB_DATACNT[3], SG_LAST_SEG jz . + 2;
1362	or	REG_ISR, LAST_SEG;
1363	mov	SG_CACHE_PRE, REG_ISR;
1364	mvi	DFCNTRL, (PRELOADEN|SCSIEN|HDMAEN);
1365	/*
1366	 * Since we've are entering a data phase, we will
1367	 * rely on the SCB_RESID* fields.  Initialize the
1368	 * residual and clear the full residual flag.
1369	 */
1370	and	SCB_SGPTR[0], ~SG_FULL_RESID;
1371	bmov	SCB_RESIDUAL_DATACNT[3], SCB_DATACNT[3], 5;
1372	/* If we need more S/G elements, tell the idle loop */
1373	test	SCB_RESIDUAL_DATACNT[3], SG_LAST_SEG jnz . + 2;
1374	mvi	SG_STATE, LOADING_NEEDED ret;
1375	clr	SG_STATE ret;
1376
1377p_data_handle_xfer:
1378	call	setjmp;
1379	test	SG_STATE, LOADING_NEEDED jnz service_fifo;
1380p_data_clear_handler:
1381	or	LONGJMP_ADDR[1], INVALID_ADDR ret;
1382
1383p_data:
1384	test	SEQ_FLAGS, NOT_IDENTIFIED|NO_CDB_SENT	jz p_data_allowed;
1385	SET_SEQINTCODE(PROTO_VIOLATION)
1386p_data_allowed:
1387
1388	test	SEQ_FLAGS, DPHASE	jz data_phase_initialize;
1389
1390	/*
1391	 * If we re-enter the data phase after going through another
1392	 * phase, our transfer location has almost certainly been
1393	 * corrupted by the interveining, non-data, transfers.  Ask
1394	 * the host driver to fix us up based on the transfer residual
1395	 * unless we already know that we should be bitbucketing.
1396	 */
1397	test	SCB_RESIDUAL_SGPTR[0], SG_LIST_NULL jnz p_data_bitbucket;
1398	SET_SEQINTCODE(PDATA_REINIT)
1399	jmp	data_phase_inbounds;
1400
1401p_data_bitbucket:
1402	/*
1403	 * Turn on `Bit Bucket' mode, wait until the target takes
1404	 * us to another phase, and then notify the host.
1405	 */
1406	mov	SAVED_MODE, MODE_PTR;
1407	test	MODE_PTR, ~(MK_MODE(M_DFF1, M_DFF1))
1408		jnz bitbucket_not_m_dff;
1409	/*
1410	 * Ensure that any FIFO contents are cleared out and the
1411	 * FIFO free'd prior to starting the BITBUCKET.  BITBUCKET
1412	 * doesn't discard data already in the FIFO.
1413	 */
1414	mvi	DFFSXFRCTL, RSTCHN|CLRSHCNT;
1415	SET_MODE(M_SCSI, M_SCSI)
1416bitbucket_not_m_dff:
1417	or	SXFRCTL1,BITBUCKET;
1418	/* Wait for non-data phase. */
1419	test	SCSIPHASE, ~DATA_PHASE_MASK jz .;
1420	and	SXFRCTL1, ~BITBUCKET;
1421	RESTORE_MODE(SAVED_MODE)
1422SET_SRC_MODE	M_DFF1;
1423SET_DST_MODE	M_DFF1;
1424	SET_SEQINTCODE(DATA_OVERRUN)
1425	jmp	ITloop;
1426
1427data_phase_initialize:
1428	test	SCB_SGPTR[0], SG_LIST_NULL jnz p_data_bitbucket;
1429	call	load_first_seg;
1430data_phase_inbounds:
1431	/* We have seen a data phase at least once. */
1432	or	SEQ_FLAGS, DPHASE;
1433	mov	SAVED_MODE, MODE_PTR;
1434	test	SG_STATE, LOADING_NEEDED jz data_group_dma_loop;
1435	call	p_data_handle_xfer;
1436data_group_dma_loop:
1437	/*
1438	 * The transfer is complete if either the last segment
1439	 * completes or the target changes phase.  Both conditions
1440	 * will clear SCSIEN.
1441	 */
1442	call	idle_loop_service_fifos;
1443	call	idle_loop_cchan;
1444	call	idle_loop_gsfifo;
1445	RESTORE_MODE(SAVED_MODE)
1446	test	DFCNTRL, SCSIEN jnz data_group_dma_loop;
1447
1448data_group_dmafinish:
1449	/*
1450	 * The transfer has terminated either due to a phase
1451	 * change, and/or the completion of the last segment.
1452	 * We have two goals here.  Do as much other work
1453	 * as possible while the data fifo drains on a read
1454	 * and respond as quickly as possible to the standard
1455	 * messages (save data pointers/disconnect and command
1456	 * complete) that usually follow a data phase.
1457	 */
1458	call	calc_residual;
1459
1460	/*
1461	 * Go ahead and shut down the DMA engine now.
1462	 */
1463	test	DFCNTRL, DIRECTION jnz data_phase_finish;
1464data_group_fifoflush:
1465	if ((ahd->bugs & AHD_AUTOFLUSH_BUG) != 0) {
1466		or	DFCNTRL, FIFOFLUSH;
1467	}
1468	/*
1469	 * We have enabled the auto-ack feature.  This means
1470	 * that the controller may have already transferred
1471	 * some overrun bytes into the data FIFO and acked them
1472	 * on the bus.  The only way to detect this situation is
1473	 * to wait for LAST_SEG_DONE to come true on a completed
1474	 * transfer and then test to see if the data FIFO is
1475	 * non-empty.  We know there is more data yet to transfer
1476	 * if SG_LIST_NULL is not yet set, thus there cannot be
1477	 * an overrun.
1478	 */
1479	test	SCB_RESIDUAL_SGPTR[0], SG_LIST_NULL jz data_phase_finish;
1480	test	SG_CACHE_SHADOW, LAST_SEG_DONE jz .;
1481	test	DFSTATUS, FIFOEMP jnz data_phase_finish;
1482	/* Overrun */
1483	jmp	p_data;
1484data_phase_finish:
1485	/*
1486	 * If the target has left us in data phase, loop through
1487	 * the DMA code again.  We will only loop if there is a
1488	 * data overrun.
1489	 */
1490	if ((ahd->flags & AHD_TARGETROLE) != 0) {
1491		test	SSTAT0, TARGET jnz data_phase_done;
1492	}
1493	if ((ahd->flags & AHD_INITIATORROLE) != 0) {
1494		test	SSTAT1, REQINIT jz .;
1495		test	SCSIPHASE, DATA_PHASE_MASK jnz p_data;
1496	}
1497
1498data_phase_done:
1499	/* Kill off any pending prefetch */
1500	call	disable_ccsgen;
1501	or 	LONGJMP_ADDR[1], INVALID_ADDR;
1502
1503	if ((ahd->flags & AHD_TARGETROLE) != 0) {
1504		test	SEQ_FLAGS, DPHASE_PENDING jz ITloop;
1505		/*
1506		and	SEQ_FLAGS, ~DPHASE_PENDING;
1507		 * For data-in phases, wait for any pending acks from the
1508		 * initiator before changing phase.  We only need to
1509		 * send Ignore Wide Residue messages for data-in phases.
1510		test	DFCNTRL, DIRECTION jz target_ITloop;
1511		test	SSTAT1, REQINIT	jnz .;
1512		test	SCB_TASK_ATTRIBUTE, SCB_XFERLEN_ODD jz target_ITloop;
1513		SET_MODE(M_SCSI, M_SCSI)
1514		test	NEGCONOPTS, WIDEXFER jz target_ITloop;
1515		 */
1516		/*
1517		 * Issue an Ignore Wide Residue Message.
1518		mvi	P_MESGIN|BSYO call change_phase;
1519		mvi	MSG_IGN_WIDE_RESIDUE call target_outb;
1520		mvi	1 call target_outb;
1521		jmp	target_ITloop;
1522		 */
1523	} else {
1524		jmp	ITloop;
1525	}
1526
1527/*
1528 * We assume that, even though data may still be
1529 * transferring to the host, that the SCSI side of
1530 * the DMA engine is now in a static state.  This
1531 * allows us to update our notion of where we are
1532 * in this transfer.
1533 *
1534 * If, by chance, we stopped before being able
1535 * to fetch additional segments for this transfer,
1536 * yet the last S/G was completely exhausted,
1537 * call our idle loop until it is able to load
1538 * another segment.  This will allow us to immediately
1539 * pickup on the next segment on the next data phase.
1540 *
1541 * If we happened to stop on the last segment, then
1542 * our residual information is still correct from
1543 * the idle loop and there is no need to perform
1544 * any fixups.
1545 */
1546residual_before_last_seg:
1547	test    MDFFSTAT, SHVALID	jnz sgptr_fixup;
1548	/*
1549	 * Can never happen from an interrupt as the packetized
1550	 * hardware will only interrupt us once SHVALID or
1551	 * LAST_SEG_DONE.
1552	 */
1553	call	idle_loop_service_fifos;
1554	RESTORE_MODE(SAVED_MODE)
1555	/* FALLTHROUGH */
1556calc_residual:
1557	test	SG_CACHE_SHADOW, LAST_SEG jz residual_before_last_seg;
1558	/* Record if we've consumed all S/G entries */
1559	test	MDFFSTAT, SHVALID	jz . + 2;
1560	bmov	SCB_RESIDUAL_DATACNT, SHCNT, 3 ret;
1561	or	SCB_RESIDUAL_SGPTR[0], SG_LIST_NULL ret;
1562
1563sgptr_fixup:
1564	/*
1565	 * Fixup the residual next S/G pointer.  The S/G preload
1566	 * feature of the chip allows us to load two elements
1567	 * in addition to the currently active element.  We
1568	 * store the bottom byte of the next S/G pointer in
1569	 * the SG_CACHE_PTR register so we can restore the
1570	 * correct value when the DMA completes.  If the next
1571	 * sg ptr value has advanced to the point where higher
1572	 * bytes in the address have been affected, fix them
1573	 * too.
1574	 */
1575	test	SG_CACHE_SHADOW, 0x80 jz sgptr_fixup_done;
1576	test	SCB_RESIDUAL_SGPTR[0], 0x80 jnz sgptr_fixup_done;
1577	add	SCB_RESIDUAL_SGPTR[1], -1;
1578	adc	SCB_RESIDUAL_SGPTR[2], -1;
1579	adc	SCB_RESIDUAL_SGPTR[3], -1;
1580sgptr_fixup_done:
1581	and	SCB_RESIDUAL_SGPTR[0], SG_ADDR_MASK, SG_CACHE_SHADOW;
1582	clr	SCB_RESIDUAL_DATACNT[3]; /* We are not the last seg */
1583	bmov	SCB_RESIDUAL_DATACNT, SHCNT, 3 ret;
1584
1585export timer_isr:
1586	call	issue_cmdcmplt;
1587	mvi	CLRSEQINTSTAT, CLRSEQ_SWTMRTO;
1588	if ((ahd->bugs & AHD_SET_MODE_BUG) != 0) {
1589		/*
1590		 * In H2A4, the mode pointer is not saved
1591		 * for intvec2, but is restored on iret.
1592		 * This can lead to the restoration of a
1593		 * bogus mode ptr.  Manually clear the
1594		 * intmask bits and do a normal return
1595		 * to compensate.
1596		 */
1597		and	SEQINTCTL, ~(INTMASK2|INTMASK1) ret;
1598	} else {
1599		or	SEQINTCTL, IRET ret;
1600	}
1601
1602export seq_isr:
1603	if ((ahd->features & AHD_RTI) == 0) {
1604		/*
1605		 * On RevA Silicon, if the target returns us to data-out
1606		 * after we have already trained for data-out, it is
1607		 * possible for us to transition the free running clock to
1608		 * data-valid before the required 100ns P1 setup time (8 P1
1609		 * assertions in fast-160 mode).  This will only happen if
1610		 * this L-Q is a continuation of a data transfer for which
1611		 * we have already prefetched data into our FIFO (LQ/Data
1612		 * followed by LQ/Data for the same write transaction).
1613		 * This can cause some target implementations to miss the
1614		 * first few data transfers on the bus.  We detect this
1615		 * situation by noticing that this is the first data transfer
1616		 * after an LQ (LQIWORKONLQ true), that the data transfer is
1617		 * a continuation of a transfer already setup in our FIFO
1618		 * (SAVEPTRS interrupt), and that the transaction is a write
1619		 * (DIRECTION set in DFCNTRL). The delay is performed by
1620		 * disabling SCSIEN until we see the first REQ from the
1621		 * target.
1622		 *
1623		 * First instruction in an ISR cannot be a branch on
1624		 * Rev A.  Snapshot LQISTAT2 so the status is not missed
1625		 * and deffer the test by one instruction.
1626		 */
1627		mov	REG_ISR, LQISTAT2;
1628		test	REG_ISR, LQIWORKONLQ jz main_isr;
1629		test	SEQINTSRC, SAVEPTRS  jz main_isr;
1630		test	LONGJMP_ADDR[1], INVALID_ADDR jz saveptr_active_fifo;
1631		/*
1632		 * Switch to the active FIFO after clearing the snapshot
1633		 * savepointer in the current FIFO.  We do this so that
1634		 * a pending CTXTDONE or SAVEPTR is visible in the active
1635		 * FIFO.  This status is the only way we can detect if we
1636		 * have lost the race (e.g. host paused us) and our attepts
1637		 * to disable the channel occurred after all REQs were
1638		 * already seen and acked (REQINIT never comes true).
1639		 */
1640		mvi	DFFSXFRCTL, CLRCHN;
1641		xor	MODE_PTR, MK_MODE(M_DFF1, M_DFF1);
1642		test	DFCNTRL, DIRECTION jz interrupt_return;
1643		and	DFCNTRL, ~SCSIEN;
1644snapshot_wait_data_valid:
1645		test	SEQINTSRC, (CTXTDONE|SAVEPTRS) jnz snapshot_data_valid;
1646		test	SSTAT1, REQINIT	jz snapshot_wait_data_valid;
1647snapshot_data_valid:
1648		or	DFCNTRL, SCSIEN;
1649		or	SEQINTCTL, IRET ret;
1650snapshot_saveptr:
1651		mvi	DFFSXFRCTL, CLRCHN;
1652		or	SEQINTCTL, IRET ret;
1653main_isr:
1654	}
1655	test	SEQINTSRC, CFG4DATA	jnz cfg4data_intr;
1656	test	SEQINTSRC, CFG4ISTAT	jnz cfg4istat_intr;
1657	test	SEQINTSRC, SAVEPTRS	jnz saveptr_intr;
1658	test	SEQINTSRC, CFG4ICMD	jnz cfg4icmd_intr;
1659	SET_SEQINTCODE(INVALID_SEQINT)
1660
1661/*
1662 * There are two types of save pointers interrupts:
1663 * The first is a snapshot save pointers where the current FIFO is not
1664 * active and contains a snapshot of the current pointer information.
1665 * This happens between packets in a stream for a single L_Q.  Since we
1666 * are not performing a pointer save, we can safely clear the channel
1667 * so it can be used for other transactions.  On RTI capable controllers,
1668 * where snapshots can, and are, disabled, the code to handle this type
1669 * of snapshot is not active.
1670 *
1671 * The second case is a save pointers on an active FIFO which occurs
1672 * if the target changes to a new L_Q or busfrees/QASes and the transfer
1673 * has a residual.  This should occur coincident with a ctxtdone.  We
1674 * disable the interrupt and allow our active routine to handle the
1675 * save.
1676 */
1677saveptr_intr:
1678	if ((ahd->features & AHD_RTI) == 0) {
1679		test	LONGJMP_ADDR[1], INVALID_ADDR jnz snapshot_saveptr;
1680	}
1681saveptr_active_fifo:
1682	and	SEQIMODE, ~ENSAVEPTRS;
1683	or	SEQINTCTL, IRET ret;
1684
1685cfg4data_intr:
1686	test	SCB_SGPTR[0], SG_LIST_NULL jnz pkt_handle_overrun_inc_use_count;
1687	call	load_first_seg;
1688	call	pkt_handle_xfer;
1689	inc	SCB_FIFO_USE_COUNT;
1690interrupt_return:
1691	or	SEQINTCTL, IRET ret;
1692
1693cfg4istat_intr:
1694	call	freeze_queue;
1695	add	NONE, -13, SCB_CDB_LEN;
1696	jnc	cfg4istat_have_sense_addr;
1697	test	SCB_CDB_LEN, SCB_CDB_LEN_PTR jnz cfg4istat_have_sense_addr;
1698	/*
1699	 * Host sets up address/count and enables transfer.
1700	 */
1701	SET_SEQINTCODE(CFG4ISTAT_INTR)
1702	jmp	cfg4istat_setup_handler;
1703cfg4istat_have_sense_addr:
1704	bmov	HADDR, SCB_SENSE_BUSADDR, 4;
1705	mvi	HCNT[1], (AHD_SENSE_BUFSIZE >> 8);
1706	mvi	SG_CACHE_PRE, LAST_SEG;
1707	mvi	DFCNTRL, PRELOADEN|SCSIEN|HDMAEN;
1708cfg4istat_setup_handler:
1709	/*
1710	 * Status pkt is transferring to host.
1711	 * Wait in idle loop for transfer to complete.
1712	 * If a command completed before an attempted
1713	 * task management function completed, notify the host.
1714	 */
1715	test	SCB_TASK_MANAGEMENT, 0xFF jz cfg4istat_no_taskmgmt_func;
1716	SET_SEQINTCODE(TASKMGMT_CMD_CMPLT_OKAY)
1717cfg4istat_no_taskmgmt_func:
1718	call	pkt_handle_status;
1719	or	SEQINTCTL, IRET ret;
1720
1721cfg4icmd_intr:
1722	/*
1723	 * In the case of DMAing a CDB from the host, the normal
1724	 * CDB buffer is formatted with an 8 byte address followed
1725	 * by a 1 byte count.
1726	 */
1727	bmov	HADDR[0], SCB_HOST_CDB_PTR, 9;
1728	mvi	SG_CACHE_PRE, LAST_SEG;
1729	mvi	DFCNTRL, (PRELOADEN|SCSIEN|HDMAEN);
1730	call	pkt_handle_cdb;
1731	or	SEQINTCTL, IRET ret;
1732
1733/*
1734 * See if the target has gone on in this context creating an
1735 * overrun condition.  For the write case, the hardware cannot
1736 * ack bytes until data are provided.  So, if the target begins
1737 * another  packet without changing contexts, implying we are
1738 * not sitting on a packet boundary, we are in an overrun
1739 * situation.  For the read case, the hardware will continue to
1740 * ack bytes into the FIFO, and may even ack the last overrun packet
1741 * into the FIFO.   If the FIFO should become non-empty, we are in
1742 * a read overrun case.
1743 */
1744#define check_overrun							\
1745	/* Not on a packet boundary. */					\
1746	test 	MDFFSTAT, DLZERO jz pkt_handle_overrun;			\
1747	test	DFSTATUS, FIFOEMP jz pkt_handle_overrun
1748
1749pkt_handle_xfer:
1750	test	SG_STATE, LOADING_NEEDED jz pkt_last_seg;
1751	call	setjmp;
1752	test	SEQINTSRC, SAVEPTRS jnz pkt_saveptrs;
1753	test	SCSIPHASE, ~DATA_PHASE_MASK jz . + 2;
1754	test	SCSISIGO, ATNO jnz . + 2;
1755	test	SSTAT2, NONPACKREQ jz pkt_service_fifo;
1756	/*
1757	 * Defer handling of this NONPACKREQ until we
1758	 * can be sure it pertains to this FIFO.  SAVEPTRS
1759	 * will not be asserted if the NONPACKREQ is for us,
1760	 * so we must simulate it if shadow is valid.  If
1761	 * shadow is not valid, keep running this FIFO until we
1762	 * have satisfied the transfer by loading segments and
1763	 * waiting for either shadow valid or last_seg_done.
1764	 */
1765	test	MDFFSTAT, SHVALID jnz pkt_saveptrs;
1766pkt_service_fifo:
1767	test	SG_STATE, LOADING_NEEDED jnz service_fifo;
1768pkt_last_seg:
1769	call	setjmp;
1770	test	SEQINTSRC, SAVEPTRS jnz pkt_saveptrs;
1771	test	SG_CACHE_SHADOW, LAST_SEG_DONE jnz pkt_last_seg_done;
1772	test	SCSIPHASE, ~DATA_PHASE_MASK jz . + 2;
1773	test	SCSISIGO, ATNO jnz . + 2;
1774	test	SSTAT2, NONPACKREQ jz return;
1775	test	MDFFSTAT, SHVALID jz return;
1776	/* FALLTHROUGH */
1777
1778/*
1779 * Either a SAVEPTRS interrupt condition is pending for this FIFO
1780 * or we have a pending NONPACKREQ for this FIFO.  We differentiate
1781 * between the two by capturing the state of the SAVEPTRS interrupt
1782 * prior to clearing this status and executing the common code for
1783 * these two cases.
1784 */
1785pkt_saveptrs:
1786BEGIN_CRITICAL;
1787	if ((ahd->bugs & AHD_AUTOFLUSH_BUG) != 0) {
1788		or	DFCNTRL, FIFOFLUSH;
1789	}
1790	mov	REG0, SEQINTSRC;
1791	call	calc_residual;
1792	call	save_pointers;
1793	mvi	CLRSEQINTSRC, CLRSAVEPTRS;
1794	call	disable_ccsgen;
1795	or	SEQIMODE, ENSAVEPTRS;
1796	test	DFCNTRL, DIRECTION jnz pkt_saveptrs_check_status;
1797	test	DFSTATUS, FIFOEMP jnz pkt_saveptrs_check_status;
1798	/*
1799	 * Keep a handler around for this FIFO until it drains
1800	 * to the host to guarantee that we don't complete the
1801	 * command to the host before the data arrives.
1802	 */
1803pkt_saveptrs_wait_fifoemp:
1804	call	setjmp;
1805	test	DFSTATUS, FIFOEMP jz return;
1806pkt_saveptrs_check_status:
1807	or	LONGJMP_ADDR[1], INVALID_ADDR;
1808	test	REG0, SAVEPTRS jz unexpected_nonpkt_phase;
1809	dec	SCB_FIFO_USE_COUNT;
1810	test	SCB_CONTROL, STATUS_RCVD jnz pkt_complete_scb_if_fifos_idle;
1811	mvi	DFFSXFRCTL, CLRCHN ret;
1812END_CRITICAL;
1813
1814/*
1815 * LAST_SEG_DONE status has been seen in the current FIFO.
1816 * This indicates that all of the allowed data for this
1817 * command has transferred across the SCSI and host buses.
1818 * Check for overrun and see if we can complete this command.
1819 */
1820pkt_last_seg_done:
1821BEGIN_CRITICAL;
1822	/*
1823	 * Mark transfer as completed.
1824	 */
1825	or	SCB_SGPTR, SG_LIST_NULL;
1826
1827	/*
1828	 * Wait for the current context to finish to verify that
1829	 * no overrun condition has occurred.
1830	 */
1831	test	SEQINTSRC, CTXTDONE jnz pkt_ctxt_done;
1832	call	setjmp;
1833pkt_wait_ctxt_done_loop:
1834	test	SEQINTSRC, CTXTDONE jnz pkt_ctxt_done;
1835	/*
1836	 * A sufficiently large overrun or a NONPACKREQ may
1837	 * prevent CTXTDONE from ever asserting, so we must
1838	 * poll for these statuses too.
1839	 */
1840	check_overrun;
1841	test	SSTAT2, NONPACKREQ jz return;
1842	test	SEQINTSRC, CTXTDONE jz unexpected_nonpkt_phase;
1843	/* FALLTHROUGH */
1844
1845pkt_ctxt_done:
1846	check_overrun;
1847	or	LONGJMP_ADDR[1], INVALID_ADDR;
1848	/*
1849	 * If status has been received, it is safe to skip
1850	 * the check to see if another FIFO is active because
1851	 * LAST_SEG_DONE has been observed.  However, we check
1852	 * the FIFO anyway since it costs us only one extra
1853	 * instruction to leverage common code to perform the
1854	 * SCB completion.
1855	 */
1856	dec	SCB_FIFO_USE_COUNT;
1857	test	SCB_CONTROL, STATUS_RCVD jnz pkt_complete_scb_if_fifos_idle;
1858	mvi	DFFSXFRCTL, CLRCHN ret;
1859END_CRITICAL;
1860
1861/*
1862 * Must wait until CDB xfer is over before issuing the
1863 * clear channel.
1864 */
1865pkt_handle_cdb:
1866	call	setjmp;
1867	test	SG_CACHE_SHADOW, LAST_SEG_DONE jz return;
1868	or	LONGJMP_ADDR[1], INVALID_ADDR;
1869	mvi	DFFSXFRCTL, CLRCHN ret;
1870
1871/*
1872 * Watch over the status transfer.  Our host sense buffer is
1873 * large enough to take the maximum allowed status packet.
1874 * None-the-less, we must still catch and report overruns to
1875 * the host.  Additionally, properly catch unexpected non-packet
1876 * phases that are typically caused by CRC errors in status packet
1877 * transmission.
1878 */
1879pkt_handle_status:
1880	call	setjmp;
1881	test	SG_CACHE_SHADOW, LAST_SEG_DONE jnz pkt_status_check_overrun;
1882	test	SEQINTSRC, CTXTDONE jz pkt_status_check_nonpackreq;
1883	test	SG_CACHE_SHADOW, LAST_SEG_DONE jnz pkt_status_check_overrun;
1884pkt_status_IU_done:
1885	if ((ahd->bugs & AHD_AUTOFLUSH_BUG) != 0) {
1886		or	DFCNTRL, FIFOFLUSH;
1887	}
1888	test	DFSTATUS, FIFOEMP jz return;
1889BEGIN_CRITICAL;
1890	or	LONGJMP_ADDR[1], INVALID_ADDR;
1891	mvi	SCB_SCSI_STATUS, STATUS_PKT_SENSE;
1892	or	SCB_CONTROL, STATUS_RCVD;
1893	jmp	pkt_complete_scb_if_fifos_idle;
1894END_CRITICAL;
1895pkt_status_check_overrun:
1896	/*
1897	 * Status PKT overruns are unceremoniously recovered with a
1898	 * bus reset.  If we've overrun, let the host know so that
1899	 * recovery can be performed.
1900	 *
1901	 * LAST_SEG_DONE has been observed.  If either CTXTDONE or
1902	 * a NONPACKREQ phase change have occurred and the FIFO is
1903	 * empty, there is no overrun.
1904	 */
1905	test	DFSTATUS, FIFOEMP jz pkt_status_report_overrun;
1906	test	SEQINTSRC, CTXTDONE jz . + 2;
1907	test	DFSTATUS, FIFOEMP jnz pkt_status_IU_done;
1908	test	SCSIPHASE, ~DATA_PHASE_MASK jz return;
1909	test	DFSTATUS, FIFOEMP jnz pkt_status_check_nonpackreq;
1910pkt_status_report_overrun:
1911	SET_SEQINTCODE(STATUS_OVERRUN)
1912	/* SEQUENCER RESTARTED */
1913pkt_status_check_nonpackreq:
1914	/*
1915	 * CTXTDONE may be held off if a NONPACKREQ is associated with
1916	 * the current context.  If a NONPACKREQ is observed, decide
1917	 * if it is for the current context.  If it is for the current
1918	 * context, we must defer NONPACKREQ processing until all data
1919	 * has transferred to the host.
1920	 */
1921	test	SCSIPHASE, ~DATA_PHASE_MASK jz return;
1922	test	SCSISIGO, ATNO jnz . + 2;
1923	test	SSTAT2, NONPACKREQ jz return;
1924	test	SEQINTSRC, CTXTDONE jnz pkt_status_IU_done;
1925	test	DFSTATUS, FIFOEMP jz return;
1926	/*
1927	 * The unexpected nonpkt phase handler assumes that any
1928	 * data channel use will have a FIFO reference count.  It
1929	 * turns out that the status handler doesn't need a reference
1930	 * count since the status received flag, and thus completion
1931	 * processing, cannot be set until the handler is finished.
1932	 * We increment the count here to make the nonpkt handler
1933	 * happy.
1934	 */
1935	inc	SCB_FIFO_USE_COUNT;
1936	/* FALLTHROUGH */
1937
1938/*
1939 * Nonpackreq is a polled status.  It can come true in three situations:
1940 * we have received an L_Q, we have sent one or more L_Qs, or there is no
1941 * L_Q context associated with this REQ (REQ occurs immediately after a
1942 * (re)selection).  Routines that know that the context responsible for this
1943 * nonpackreq call directly into unexpected_nonpkt_phase.  In the case of the
1944 * top level idle loop, we exhaust all active contexts prior to determining that
1945 * we simply do not have the full I_T_L_Q for this phase.
1946 */
1947unexpected_nonpkt_phase_find_ctxt:
1948	/*
1949	 * This nonpackreq is most likely associated with one of the tags
1950	 * in a FIFO or an outgoing LQ.  Only treat it as an I_T only
1951	 * nonpackreq if we've cleared out the FIFOs and handled any
1952	 * pending SELDO.
1953	 */
1954SET_SRC_MODE	M_SCSI;
1955SET_DST_MODE	M_SCSI;
1956	and	A, FIFO1FREE|FIFO0FREE, DFFSTAT;
1957	cmp	A, FIFO1FREE|FIFO0FREE jne return;
1958	test	SSTAT0, SELDO jnz return;
1959	mvi	SCBPTR[1], SCB_LIST_NULL;
1960unexpected_nonpkt_phase:
1961	test	MODE_PTR, ~(MK_MODE(M_DFF1, M_DFF1))
1962		jnz unexpected_nonpkt_mode_cleared;
1963SET_SRC_MODE	M_DFF0;
1964SET_DST_MODE	M_DFF0;
1965	or	LONGJMP_ADDR[1], INVALID_ADDR;
1966	dec	SCB_FIFO_USE_COUNT;
1967	mvi	DFFSXFRCTL, CLRCHN;
1968unexpected_nonpkt_mode_cleared:
1969	mvi	CLRSINT2, CLRNONPACKREQ;
1970	test	SCSIPHASE, ~(MSG_IN_PHASE|MSG_OUT_PHASE) jnz illegal_phase;
1971	SET_SEQINTCODE(ENTERING_NONPACK)
1972	jmp	ITloop;
1973
1974illegal_phase:
1975	SET_SEQINTCODE(ILLEGAL_PHASE)
1976	jmp	ITloop;
1977
1978/*
1979 * We have entered an overrun situation.  If we have working
1980 * BITBUCKET, flip that on and let the hardware eat any overrun
1981 * data.  Otherwise use an overrun buffer in the host to simulate
1982 * BITBUCKET.
1983 */
1984pkt_handle_overrun_inc_use_count:
1985	inc	SCB_FIFO_USE_COUNT;
1986pkt_handle_overrun:
1987	SET_SEQINTCODE(CFG4OVERRUN)
1988	call	freeze_queue;
1989	if ((ahd->bugs & AHD_PKT_BITBUCKET_BUG) == 0) {
1990		or	DFFSXFRCTL, DFFBITBUCKET;
1991SET_SRC_MODE	M_DFF1;
1992SET_DST_MODE	M_DFF1;
1993	} else {
1994		call	load_overrun_buf;
1995		mvi	DFCNTRL, (HDMAEN|SCSIEN|PRELOADEN);
1996	}
1997	call	setjmp;
1998	if ((ahd->bugs & AHD_PKT_BITBUCKET_BUG) != 0) {
1999		test	DFSTATUS, PRELOAD_AVAIL jz overrun_load_done;
2000		call	load_overrun_buf;
2001		or	DFCNTRL, PRELOADEN;
2002overrun_load_done:
2003		test	SEQINTSRC, CTXTDONE jnz pkt_overrun_end;
2004	} else {
2005		test	DFFSXFRCTL, DFFBITBUCKET jz pkt_overrun_end;
2006	}
2007	test	SSTAT2, NONPACKREQ jz return;
2008pkt_overrun_end:
2009	or	SCB_RESIDUAL_SGPTR, SG_OVERRUN_RESID;
2010	test	SEQINTSRC, CTXTDONE jz unexpected_nonpkt_phase;
2011	dec	SCB_FIFO_USE_COUNT;
2012	or	LONGJMP_ADDR[1], INVALID_ADDR;
2013	test	SCB_CONTROL, STATUS_RCVD jnz pkt_complete_scb_if_fifos_idle;
2014	mvi	DFFSXFRCTL, CLRCHN ret;
2015
2016if ((ahd->bugs & AHD_PKT_BITBUCKET_BUG) != 0) {
2017load_overrun_buf:
2018	/*
2019	 * Load a dummy segment if preload space is available.
2020	 */
2021	mov 	HADDR[0], SHARED_DATA_ADDR;
2022	add	HADDR[1], PKT_OVERRUN_BUFOFFSET, SHARED_DATA_ADDR[1];
2023	mov	ACCUM_SAVE, A;
2024	clr	A;
2025	adc	HADDR[2], A, SHARED_DATA_ADDR[2];
2026	adc	HADDR[3], A, SHARED_DATA_ADDR[3];
2027	mov	A, ACCUM_SAVE;
2028	bmov	HADDR[4], ALLZEROS, 4;
2029	/* PKT_OVERRUN_BUFSIZE is a multiple of 256 */
2030	clr	HCNT[0];
2031	mvi	HCNT[1], ((PKT_OVERRUN_BUFSIZE >> 8) & 0xFF);
2032	clr	HCNT[2] ret;
2033}
2034