xref: /netbsd/sys/dev/microcode/aic7xxx/aic7xxx.seq (revision 6550d01e)
1/*
2 * Adaptec 274x/284x/294x device driver firmware for Linux and FreeBSD.
3 *
4 * Copyright (c) 1994-2001 Justin T. Gibbs.
5 * Copyright (c) 2000-2001 Adaptec Inc.
6 * All rights reserved.
7 *
8 * Redistribution and use in source and binary forms, with or without
9 * modification, are permitted provided that the following conditions
10 * are met:
11 * 1. Redistributions of source code must retain the above copyright
12 *    notice, this list of conditions, and the following disclaimer,
13 *    without modification.
14 * 2. Redistributions in binary form must reproduce at minimum a disclaimer
15 *    substantially similar to the "NO WARRANTY" disclaimer below
16 *    ("Disclaimer") and any redistribution must be conditioned upon
17 *    including a substantially similar Disclaimer requirement for further
18 *    binary redistribution.
19 * 3. Neither the names of the above-listed copyright holders nor the names
20 *    of any contributors may be used to endorse or promote products derived
21 *    from this software without specific prior written permission.
22 *
23 * Alternatively, this software may be distributed under the terms of the
24 * GNU General Public License ("GPL") version 2 as published by the Free
25 * Software Foundation.
26 *
27 * NO WARRANTY
28 * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
29 * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
30 * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTIBILITY AND FITNESS FOR
31 * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
32 * HOLDERS OR CONTRIBUTORS BE LIABLE FOR SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
33 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
34 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
35 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
36 * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING
37 * IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
38 * POSSIBILITY OF SUCH DAMAGES.
39 *
40 * $FreeBSD: /repoman/r/ncvs/src/sys/dev/aic7xxx/aic7xxx.seq,v 1.123 2003/01/20 20:44:55 gibbs Exp $
41 */
42
43VERSION = "$NetBSD: aic7xxx.seq,v 1.18 2006/11/25 16:48:32 christos Exp $"
44PATCH_ARG_LIST = "struct ahc_softc *ahc"
45PREFIX = "ahc_"
46
47#include <dev/microcode/aic7xxx/aic7xxx.reg>
48#include <dev/scsipi/scsi_message.h>
49
50/*
51 * A few words on the waiting SCB list:
52 * After starting the selection hardware, we check for reconnecting targets
53 * as well as for our selection to complete just in case the reselection wins
54 * bus arbitration.  The problem with this is that we must keep track of the
55 * SCB that we've already pulled from the QINFIFO and started the selection
56 * on just in case the reselection wins so that we can retry the selection at
57 * a later time.  This problem cannot be resolved by holding a single entry
58 * in scratch ram since a reconnecting target can request sense and this will
59 * create yet another SCB waiting for selection.  The solution used here is to
60 * use byte 27 of the SCB as a psuedo-next pointer and to thread a list
61 * of SCBs that are awaiting selection.  Since 0-0xfe are valid SCB indexes,
62 * SCB_LIST_NULL is 0xff which is out of range.  An entry is also added to
63 * this list everytime a request sense occurs or after completing a non-tagged
64 * command for which a second SCB has been queued.  The sequencer will
65 * automatically consume the entries.
66 */
67
68bus_free_sel:
69	/*
70	 * Turn off the selection hardware.  We need to reset the
71	 * selection request in order to perform a new selection.
72	 */
73	and	SCSISEQ, TEMODE|ENSELI|ENRSELI|ENAUTOATNP;
74	and	SIMODE1, ~ENBUSFREE;
75poll_for_work:
76	call	clear_target_state;
77	and	SXFRCTL0, ~SPIOEN;
78	if ((ahc->features & AHC_ULTRA2) != 0) {
79		clr	SCSIBUSL;
80	}
81	test	SCSISEQ, ENSELO	jnz poll_for_selection;
82	if ((ahc->features & AHC_TWIN) != 0) {
83		xor	SBLKCTL,SELBUSB;	/* Toggle to the other bus */
84		test	SCSISEQ, ENSELO		jnz poll_for_selection;
85	}
86	cmp	WAITING_SCBH,SCB_LIST_NULL jne start_waiting;
87poll_for_work_loop:
88	if ((ahc->features & AHC_TWIN) != 0) {
89		xor	SBLKCTL,SELBUSB;	/* Toggle to the other bus */
90	}
91	test	SSTAT0, SELDO|SELDI	jnz selection;
92test_queue:
93	/* Has the driver posted any work for us? */
94BEGIN_CRITICAL;
95	if ((ahc->features & AHC_QUEUE_REGS) != 0) {
96		test	QOFF_CTLSTA, SCB_AVAIL jz poll_for_work_loop;
97	} else {
98		mov	A, QINPOS;
99		cmp	KERNEL_QINPOS, A je poll_for_work_loop;
100	}
101	mov	ARG_1, NEXT_QUEUED_SCB;
102
103	/*
104	 * We have at least one queued SCB now and we don't have any
105	 * SCBs in the list of SCBs awaiting selection.  Allocate a
106	 * card SCB for the host's SCB and get to work on it.
107	 */
108	if ((ahc->flags & AHC_PAGESCBS) != 0) {
109		mov	ALLZEROS	call	get_free_or_disc_scb;
110	} else {
111		/* In the non-paging case, the SCBID == hardware SCB index */
112		mov	SCBPTR, ARG_1;
113	}
114	or	SEQ_FLAGS2, SCB_DMA;
115END_CRITICAL;
116dma_queued_scb:
117	/*
118	 * DMA the SCB from host ram into the current SCB location.
119	 */
120	mvi	DMAPARAMS, HDMAEN|DIRECTION|FIFORESET;
121	mov	ARG_1	call dma_scb;
122	/*
123	 * Check one last time to see if this SCB was canceled
124	 * before we completed the DMA operation.  If it was,
125	 * the QINFIFO next pointer will not match our saved
126	 * value.
127	 */
128	mov	A, ARG_1;
129BEGIN_CRITICAL;
130	cmp	NEXT_QUEUED_SCB, A jne abort_qinscb;
131	if ((ahc->flags & AHC_SEQUENCER_DEBUG) != 0) {
132		cmp	SCB_TAG, A je . + 2;
133		mvi	SCB_MISMATCH call set_seqint;
134	}
135	mov	NEXT_QUEUED_SCB, SCB_NEXT;
136	mov	SCB_NEXT,WAITING_SCBH;
137	mov	WAITING_SCBH, SCBPTR;
138	if ((ahc->features & AHC_QUEUE_REGS) != 0) {
139		mov	NONE, SNSCB_QOFF;
140	} else {
141		inc	QINPOS;
142	}
143	and	SEQ_FLAGS2, ~SCB_DMA;
144END_CRITICAL;
145start_waiting:
146	/*
147	 * Start the first entry on the waiting SCB list.
148	 */
149	mov	SCBPTR, WAITING_SCBH;
150	call	start_selection;
151
152poll_for_selection:
153	/*
154	 * Twin channel devices cannot handle things like SELTO
155	 * interrupts on the "background" channel.  So, while
156	 * selecting, keep polling the current channel until
157	 * either a selection or reselection occurs.
158	 */
159	test	SSTAT0, SELDO|SELDI	jz poll_for_selection;
160
161selection:
162	/*
163	 * We aren't expecting a bus free, so interrupt
164	 * the kernel driver if it happens.
165	 */
166	mvi	CLRSINT1,CLRBUSFREE;
167	if ((ahc->features & AHC_DT) == 0) {
168		or	SIMODE1, ENBUSFREE;
169	}
170
171	/*
172	 * Guard against a bus free after (re)selection
173	 * but prior to enabling the busfree interrupt.  SELDI
174	 * and SELDO will be cleared in that case.
175	 */
176	test	SSTAT0, SELDI|SELDO	jz bus_free_sel;
177	test	SSTAT0,SELDO	jnz select_out;
178select_in:
179	if ((ahc->flags & AHC_TARGETROLE) != 0) {
180		if ((ahc->flags & AHC_INITIATORROLE) != 0) {
181			test	SSTAT0, TARGET	jz initiator_reselect;
182		}
183		mvi	CLRSINT0, CLRSELDI;
184
185		/*
186		 * We've just been selected.  Assert BSY and
187		 * setup the phase for receiving messages
188		 * from the target.
189		 */
190		mvi	SCSISIGO, P_MESGOUT|BSYO;
191
192		/*
193		 * Setup the DMA for sending the identify and
194		 * command information.
195		 */
196		mvi	SEQ_FLAGS, CMDPHASE_PENDING;
197
198		mov     A, TQINPOS;
199		if ((ahc->features & AHC_CMD_CHAN) != 0) {
200			mvi	DINDEX, CCHADDR;
201			mvi	SHARED_DATA_ADDR call set_32byte_addr;
202			mvi	CCSCBCTL, CCSCBRESET;
203		} else {
204			mvi	DINDEX, HADDR;
205			mvi	SHARED_DATA_ADDR call set_32byte_addr;
206			mvi	DFCNTRL, FIFORESET;
207		}
208
209		/* Initiator that selected us */
210		and	SAVED_SCSIID, SELID_MASK, SELID;
211		/* The Target ID we were selected at */
212		if ((ahc->features & AHC_MULTI_TID) != 0) {
213			and	A, OID, TARGIDIN;
214		} else if ((ahc->features & AHC_ULTRA2) != 0) {
215			and	A, OID, SCSIID_ULTRA2;
216		} else {
217			and	A, OID, SCSIID;
218		}
219		or	SAVED_SCSIID, A;
220		if ((ahc->features & AHC_TWIN) != 0) {
221			test 	SBLKCTL, SELBUSB jz . + 2;
222			or	SAVED_SCSIID, TWIN_CHNLB;
223		}
224		if ((ahc->features & AHC_CMD_CHAN) != 0) {
225			mov	CCSCBRAM, SAVED_SCSIID;
226		} else {
227			mov	DFDAT, SAVED_SCSIID;
228		}
229
230		/*
231		 * If ATN isn't asserted, the target isn't interested
232		 * in talking to us.  Go directly to bus free.
233		 * XXX SCSI-1 may require us to assume lun 0 if
234		 * ATN is false.
235		 */
236		test	SCSISIGI, ATNI	jz	target_busfree;
237
238		/*
239		 * Watch ATN closely now as we pull in messages from the
240		 * initiator.  We follow the guidlines from section 6.5
241		 * of the SCSI-2 spec for what messages are allowed when.
242		 */
243		call	target_inb;
244
245		/*
246		 * Our first message must be one of IDENTIFY, ABORT, or
247		 * BUS_DEVICE_RESET.
248		 */
249		test	DINDEX, MSG_IDENTIFYFLAG jz host_target_message_loop;
250		/* Store for host */
251		if ((ahc->features & AHC_CMD_CHAN) != 0) {
252			mov	CCSCBRAM, DINDEX;
253		} else {
254			mov	DFDAT, DINDEX;
255		}
256		and	SAVED_LUN, MSG_IDENTIFY_LUNMASK, DINDEX;
257
258		/* Remember for disconnection decision */
259		test	DINDEX, MSG_IDENTIFY_DISCFLAG jnz . + 2;
260		/* XXX Honor per target settings too */
261		or	SEQ_FLAGS, NO_DISCONNECT;
262
263		test	SCSISIGI, ATNI	jz	ident_messages_done;
264		call	target_inb;
265		/*
266		 * If this is a tagged request, the tagged message must
267		 * immediately follow the identify.  We test for a valid
268		 * tag message by seeing if it is >= MSG_SIMPLE_Q_TAG and
269		 * < MSG_IGN_WIDE_RESIDUE.
270		 */
271		add	A, -MSG_SIMPLE_Q_TAG, DINDEX;
272		jnc	ident_messages_done_msg_pending;
273		add	A, -MSG_IGN_WIDE_RESIDUE, DINDEX;
274		jc	ident_messages_done_msg_pending;
275
276		/* Store for host */
277		if ((ahc->features & AHC_CMD_CHAN) != 0) {
278			mov	CCSCBRAM, DINDEX;
279		} else {
280			mov	DFDAT, DINDEX;
281		}
282
283		/*
284		 * If the initiator doesn't feel like providing a tag number,
285		 * we've got a failed selection and must transition to bus
286		 * free.
287		 */
288		test	SCSISIGI, ATNI	jz	target_busfree;
289
290		/*
291		 * Store the tag for the host.
292		 */
293		call	target_inb;
294		if ((ahc->features & AHC_CMD_CHAN) != 0) {
295			mov	CCSCBRAM, DINDEX;
296		} else {
297			mov	DFDAT, DINDEX;
298		}
299		mov	INITIATOR_TAG, DINDEX;
300		or	SEQ_FLAGS, TARGET_CMD_IS_TAGGED;
301
302ident_messages_done:
303		/* Terminate the ident list */
304		if ((ahc->features & AHC_CMD_CHAN) != 0) {
305			mvi	CCSCBRAM, SCB_LIST_NULL;
306		} else {
307			mvi	DFDAT, SCB_LIST_NULL;
308		}
309		or	SEQ_FLAGS, TARG_CMD_PENDING;
310		test	SEQ_FLAGS2, TARGET_MSG_PENDING
311			jnz target_mesgout_pending;
312		test	SCSISIGI, ATNI jnz target_mesgout_continue;
313		jmp	target_ITloop;
314
315
316ident_messages_done_msg_pending:
317		or	SEQ_FLAGS2, TARGET_MSG_PENDING;
318		jmp	ident_messages_done;
319
320		/*
321		 * Pushed message loop to allow the kernel to
322		 * run it's own target mode message state engine.
323		 */
324host_target_message_loop:
325		mvi	HOST_MSG_LOOP call set_seqint;
326		cmp	RETURN_1, EXIT_MSG_LOOP	je target_ITloop;
327		test	SSTAT0, SPIORDY jz .;
328		jmp	host_target_message_loop;
329	}
330
331if ((ahc->flags & AHC_INITIATORROLE) != 0) {
332/*
333 * Reselection has been initiated by a target. Make a note that we've been
334 * reselected, but haven't seen an IDENTIFY message from the target yet.
335 */
336initiator_reselect:
337	/* XXX test for and handle ONE BIT condition */
338	or	SXFRCTL0, SPIOEN|CLRSTCNT|CLRCHN;
339	and	SAVED_SCSIID, SELID_MASK, SELID;
340	if ((ahc->features & AHC_ULTRA2) != 0) {
341		and	A, OID, SCSIID_ULTRA2;
342	} else {
343		and	A, OID, SCSIID;
344	}
345	or	SAVED_SCSIID, A;
346	if ((ahc->features & AHC_TWIN) != 0) {
347		test	SBLKCTL, SELBUSB	jz . + 2;
348		or	SAVED_SCSIID, TWIN_CHNLB;
349	}
350	mvi	CLRSINT0, CLRSELDI;
351	jmp	ITloop;
352}
353
354abort_qinscb:
355	call	add_scb_to_free_list;
356	jmp	poll_for_work_loop;
357
358start_selection:
359	/*
360	 * If bus reset interrupts have been disabled (from a previous
361	 * reset), re-enable them now.  Resets are only of interest
362	 * when we have outstanding transactions, so we can safely
363	 * defer re-enabling the interrupt until, as an initiator,
364	 * we start sending out transactions again.
365	 */
366	test	SIMODE1, ENSCSIRST	jnz . + 3;
367	mvi	CLRSINT1, CLRSCSIRSTI;
368	or	SIMODE1, ENSCSIRST;
369	if ((ahc->features & AHC_TWIN) != 0) {
370		and	SINDEX,~SELBUSB,SBLKCTL;/* Clear channel select bit */
371		test	SCB_SCSIID, TWIN_CHNLB jz . + 2;
372		or	SINDEX, SELBUSB;
373		mov	SBLKCTL,SINDEX;		/* select channel */
374	}
375initialize_scsiid:
376	if ((ahc->features & AHC_ULTRA2) != 0) {
377		mov	SCSIID_ULTRA2, SCB_SCSIID;
378	} else if ((ahc->features & AHC_TWIN) != 0) {
379		and	SCSIID, TWIN_TID|OID, SCB_SCSIID;
380	} else {
381		mov	SCSIID, SCB_SCSIID;
382	}
383	if ((ahc->flags & AHC_TARGETROLE) != 0) {
384		mov	SINDEX, SCSISEQ_TEMPLATE;
385		test	SCB_CONTROL, TARGET_SCB jz . + 2;
386		or	SINDEX, TEMODE;
387		mov	SCSISEQ, SINDEX ret;
388	} else {
389		mov	SCSISEQ, SCSISEQ_TEMPLATE ret;
390	}
391
392/*
393 * Initialize transfer settings with SCB provided settings.
394 */
395set_transfer_settings:
396	if ((ahc->features & AHC_ULTRA) != 0) {
397		test	SCB_CONTROL, ULTRAENB jz . + 2;
398		or	SXFRCTL0, FAST20;
399	}
400	/*
401	 * Initialize SCSIRATE with the appropriate value for this target.
402	 */
403	if ((ahc->features & AHC_ULTRA2) != 0) {
404		bmov	SCSIRATE, SCB_SCSIRATE, 2 ret;
405	} else {
406		mov	SCSIRATE, SCB_SCSIRATE ret;
407	}
408
409if ((ahc->flags & AHC_TARGETROLE) != 0) {
410/*
411 * We carefully toggle SPIOEN to allow us to return the
412 * message byte we receive so it can be checked prior to
413 * driving REQ on the bus for the next byte.
414 */
415target_inb:
416	/*
417	 * Drive REQ on the bus by enabling SCSI PIO.
418	 */
419	or	SXFRCTL0, SPIOEN;
420	/* Wait for the byte */
421	test	SSTAT0, SPIORDY jz .;
422	/* Prevent our read from triggering another REQ */
423	and	SXFRCTL0, ~SPIOEN;
424	/* Save latched contents */
425	mov	DINDEX, SCSIDATL ret;
426}
427
428/*
429 * After the selection, remove this SCB from the "waiting SCB"
430 * list.  This is achieved by simply moving our "next" pointer into
431 * WAITING_SCBH.  Our next pointer will be set to null the next time this
432 * SCB is used, so don't bother with it now.
433 */
434select_out:
435	/* Turn off the selection hardware */
436	and	SCSISEQ, TEMODE|ENSELI|ENRSELI|ENAUTOATNP, SCSISEQ;
437	mov	SCBPTR, WAITING_SCBH;
438	mov	WAITING_SCBH,SCB_NEXT;
439	mov	SAVED_SCSIID, SCB_SCSIID;
440	mov	SAVED_LUN, SCB_LUN;
441	call	set_transfer_settings;
442	if ((ahc->flags & AHC_TARGETROLE) != 0) {
443		test	SSTAT0, TARGET	jz initiator_select;
444
445		or	SXFRCTL0, CLRSTCNT|CLRCHN;
446
447		/*
448		 * Put tag in connonical location since not
449		 * all connections have an SCB.
450		 */
451		mov	INITIATOR_TAG, SCB_TARGET_ITAG;
452
453		/*
454		 * We've just re-selected an initiator.
455		 * Assert BSY and setup the phase for
456		 * sending our identify messages.
457		 */
458		mvi	P_MESGIN|BSYO call change_phase;
459		mvi	CLRSINT0, CLRSELDO;
460
461		/*
462		 * Start out with a simple identify message.
463		 */
464		or	SCB_LUN, MSG_IDENTIFYFLAG call target_outb;
465
466		/*
467		 * If we are the result of a tagged command, send
468		 * a simple Q tag and the tag id.
469		 */
470		test	SCB_CONTROL, TAG_ENB	jz . + 3;
471		mvi	MSG_SIMPLE_Q_TAG call target_outb;
472		mov	SCB_TARGET_ITAG call target_outb;
473target_synccmd:
474		/*
475		 * Now determine what phases the host wants us
476		 * to go through.
477		 */
478		mov	SEQ_FLAGS, SCB_TARGET_PHASES;
479
480		test	SCB_CONTROL, MK_MESSAGE	jz target_ITloop;
481		mvi	P_MESGIN|BSYO call change_phase;
482		jmp	host_target_message_loop;
483target_ITloop:
484		/*
485		 * Start honoring ATN signals now that
486		 * we properly identified ourselves.
487		 */
488		test	SCSISIGI, ATNI			jnz target_mesgout;
489		test	SEQ_FLAGS, CMDPHASE_PENDING	jnz target_cmdphase;
490		test	SEQ_FLAGS, DPHASE_PENDING	jnz target_dphase;
491		test	SEQ_FLAGS, SPHASE_PENDING	jnz target_sphase;
492
493		/*
494		 * No more work to do.  Either disconnect or not depending
495		 * on the state of NO_DISCONNECT.
496		 */
497		test	SEQ_FLAGS, NO_DISCONNECT jz target_disconnect;
498		mvi	TARG_IMMEDIATE_SCB, SCB_LIST_NULL;
499		call	complete_target_cmd;
500		if ((ahc->flags & AHC_PAGESCBS) != 0) {
501			mov	ALLZEROS	call	get_free_or_disc_scb;
502		}
503		cmp	TARG_IMMEDIATE_SCB, SCB_LIST_NULL je .;
504		mvi	DMAPARAMS, HDMAEN|DIRECTION|FIFORESET;
505		mov	TARG_IMMEDIATE_SCB call dma_scb;
506		call	set_transfer_settings;
507		or	SXFRCTL0, CLRSTCNT|CLRCHN;
508		jmp	target_synccmd;
509
510target_mesgout:
511		mvi	SCSISIGO, P_MESGOUT|BSYO;
512target_mesgout_continue:
513		call	target_inb;
514target_mesgout_pending:
515		and	SEQ_FLAGS2, ~TARGET_MSG_PENDING;
516		/* Local Processing goes here... */
517		jmp	host_target_message_loop;
518
519target_disconnect:
520		mvi	P_MESGIN|BSYO call change_phase;
521		test	SEQ_FLAGS, DPHASE	jz . + 2;
522		mvi	MSG_SAVEDATAPOINTER call target_outb;
523		mvi	MSG_DISCONNECT call target_outb;
524
525target_busfree_wait:
526		/* Wait for preceding I/O session to complete. */
527		test	SCSISIGI, ACKI jnz .;
528target_busfree:
529		and	SIMODE1, ~ENBUSFREE;
530		if ((ahc->features & AHC_ULTRA2) != 0) {
531			clr	SCSIBUSL;
532		}
533		clr	SCSISIGO;
534		mvi	LASTPHASE, P_BUSFREE;
535		call	complete_target_cmd;
536		jmp	poll_for_work;
537
538target_cmdphase:
539		/*
540		 * The target has dropped ATN (doesn't want to abort or BDR)
541		 * and we believe this selection to be valid.  If the ring
542		 * buffer for new commands is full, return busy or queue full.
543		 */
544		if ((ahc->features & AHC_HS_MAILBOX) != 0) {
545			and	A, HOST_TQINPOS, HS_MAILBOX;
546		} else {
547			mov	A, KERNEL_TQINPOS;
548		}
549		cmp	TQINPOS, A jne tqinfifo_has_space;
550		mvi	P_STATUS|BSYO call change_phase;
551		test	SEQ_FLAGS, TARGET_CMD_IS_TAGGED jz . + 3;
552		mvi	STATUS_QUEUE_FULL call target_outb;
553		jmp	target_busfree_wait;
554		mvi	STATUS_BUSY call target_outb;
555		jmp	target_busfree_wait;
556tqinfifo_has_space:
557		mvi	P_COMMAND|BSYO call change_phase;
558		call	target_inb;
559		mov	A, DINDEX;
560		/* Store for host */
561		if ((ahc->features & AHC_CMD_CHAN) != 0) {
562			mov	CCSCBRAM, A;
563		} else {
564			mov	DFDAT, A;
565		}
566
567		/*
568		 * Determine the number of bytes to read
569		 * based on the command group code via table lookup.
570		 * We reuse the first 8 bytes of the TARG_SCSIRATE
571		 * BIOS array for this table. Count is one less than
572		 * the total for the command since we've already fetched
573		 * the first byte.
574		 */
575		shr	A, CMD_GROUP_CODE_SHIFT;
576		add	SINDEX, CMDSIZE_TABLE, A;
577		mov	A, SINDIR;
578
579		test	A, 0xFF jz command_phase_done;
580		or	SXFRCTL0, SPIOEN;
581command_loop:
582		test	SSTAT0, SPIORDY jz .;
583		cmp	A, 1 jne . + 2;
584		and	SXFRCTL0, ~SPIOEN;	/* Last Byte */
585		if ((ahc->features & AHC_CMD_CHAN) != 0) {
586			mov	CCSCBRAM, SCSIDATL;
587		} else {
588			mov	DFDAT, SCSIDATL;
589		}
590		dec	A;
591		test	A, 0xFF jnz command_loop;
592
593command_phase_done:
594		and	SEQ_FLAGS, ~CMDPHASE_PENDING;
595		jmp	target_ITloop;
596
597target_dphase:
598		/*
599		 * Data phases on the bus are from the
600		 * perspective of the initiator.  The DMA
601		 * code looks at LASTPHASE to determine the
602		 * data direction of the DMA.  Toggle it for
603		 * target transfers.
604		 */
605		xor	LASTPHASE, IOI, SCB_TARGET_DATA_DIR;
606		or	SCB_TARGET_DATA_DIR, BSYO call change_phase;
607		jmp	p_data;
608
609target_sphase:
610		mvi	P_STATUS|BSYO call change_phase;
611		mvi	LASTPHASE, P_STATUS;
612		mov	SCB_SCSI_STATUS call target_outb;
613		/* XXX Watch for ATN or parity errors??? */
614		mvi	SCSISIGO, P_MESGIN|BSYO;
615		/* MSG_CMDCMPLT is 0, but we can't do an immediate of 0 */
616		mov	ALLZEROS call target_outb;
617		jmp	target_busfree_wait;
618
619complete_target_cmd:
620		test	SEQ_FLAGS, TARG_CMD_PENDING	jnz . + 2;
621		mov	SCB_TAG jmp complete_post;
622		if ((ahc->features & AHC_CMD_CHAN) != 0) {
623			/* Set the valid byte */
624			mvi	CCSCBADDR, 24;
625			mov	CCSCBRAM, ALLONES;
626			mvi	CCHCNT, 28;
627			or	CCSCBCTL, CCSCBEN|CCSCBRESET;
628			test	CCSCBCTL, CCSCBDONE jz .;
629			clr	CCSCBCTL;
630		} else {
631			/* Set the valid byte */
632			or	DFCNTRL, FIFORESET;
633			mvi	DFWADDR, 3; /* Third 64bit word or byte 24 */
634			mov	DFDAT, ALLONES;
635			mvi	28	call set_hcnt;
636			or	DFCNTRL, HDMAEN|FIFOFLUSH;
637			call	dma_finish;
638		}
639		inc	TQINPOS;
640		mvi	INTSTAT,CMDCMPLT ret;
641	}
642
643if ((ahc->flags & AHC_INITIATORROLE) != 0) {
644initiator_select:
645	or	SXFRCTL0, SPIOEN|CLRSTCNT|CLRCHN;
646	/*
647	 * As soon as we get a successful selection, the target
648	 * should go into the message out phase since we have ATN
649	 * asserted.
650	 */
651	mvi	MSG_OUT, MSG_IDENTIFYFLAG;
652	mvi	SEQ_FLAGS, NO_CDB_SENT;
653	mvi	CLRSINT0, CLRSELDO;
654
655	/*
656	 * Main loop for information transfer phases.  Wait for the
657	 * target to assert REQ before checking MSG, C/D and I/O for
658	 * the bus phase.
659	 */
660mesgin_phasemis:
661ITloop:
662	call	phase_lock;
663
664	mov	A, LASTPHASE;
665
666	test	A, ~P_DATAIN	jz p_data;
667	cmp	A,P_COMMAND	je p_command;
668	cmp	A,P_MESGOUT	je p_mesgout;
669	cmp	A,P_STATUS	je p_status;
670	cmp	A,P_MESGIN	je p_mesgin;
671
672	mvi	BAD_PHASE call set_seqint;
673	jmp	ITloop;			/* Try reading the bus again. */
674
675await_busfree:
676	and	SIMODE1, ~ENBUSFREE;
677	mov	NONE, SCSIDATL;		/* Ack the last byte */
678	if ((ahc->features & AHC_ULTRA2) != 0) {
679		clr	SCSIBUSL;	/* Prevent bit leakage durint SELTO */
680	}
681	and	SXFRCTL0, ~SPIOEN;
682	test	SSTAT1,REQINIT|BUSFREE	jz .;
683	test	SSTAT1, BUSFREE jnz poll_for_work;
684	mvi	MISSED_BUSFREE call set_seqint;
685}
686
687clear_target_state:
688	/*
689	 * We assume that the kernel driver may reset us
690	 * at any time, even in the middle of a DMA, so
691	 * clear DFCNTRL too.
692	 */
693	clr	DFCNTRL;
694	or	SXFRCTL0, CLRSTCNT|CLRCHN;
695
696	/*
697	 * We don't know the target we will connect to,
698	 * so default to narrow transfers to avoid
699	 * parity problems.
700	 */
701	if ((ahc->features & AHC_ULTRA2) != 0) {
702		bmov	SCSIRATE, ALLZEROS, 2;
703	} else {
704		clr	SCSIRATE;
705		if ((ahc->features & AHC_ULTRA) != 0) {
706			and	SXFRCTL0, ~(FAST20);
707		}
708	}
709	mvi	LASTPHASE, P_BUSFREE;
710	/* clear target specific flags */
711	mvi	SEQ_FLAGS, NOT_IDENTIFIED|NO_CDB_SENT ret;
712
713sg_advance:
714	clr	A;			/* add sizeof(struct scatter) */
715	add	SCB_RESIDUAL_SGPTR[0],SG_SIZEOF;
716	adc	SCB_RESIDUAL_SGPTR[1],A;
717	adc	SCB_RESIDUAL_SGPTR[2],A;
718	adc	SCB_RESIDUAL_SGPTR[3],A ret;
719
720if ((ahc->features & AHC_CMD_CHAN) != 0) {
721disable_ccsgen:
722	test	CCSGCTL, CCSGEN jz return;
723	test	CCSGCTL, CCSGDONE jz .;
724disable_ccsgen_fetch_done:
725	clr	CCSGCTL;
726	test	CCSGCTL, CCSGEN jnz .;
727	ret;
728idle_loop:
729	/*
730	 * Do we need any more segments for this transfer?
731	 */
732	test	SCB_RESIDUAL_DATACNT[3], SG_LAST_SEG jnz return;
733
734	/* Did we just finish fetching segs? */
735	cmp	CCSGCTL, CCSGEN|CCSGDONE je idle_sgfetch_complete;
736
737	/* Are we actively fetching segments? */
738	test	CCSGCTL, CCSGEN jnz return;
739
740	/*
741	 * Do we have any prefetch left???
742	 */
743	cmp	CCSGADDR, SG_PREFETCH_CNT jne idle_sg_avail;
744
745	/*
746	 * Need to fetch segments, but we can only do that
747	 * if the command channel is completely idle.  Make
748	 * sure we don't have an SCB prefetch going on.
749	 */
750	test	CCSCBCTL, CCSCBEN jnz return;
751
752	/*
753	 * We fetch a "cacheline aligned" and sized amount of data
754	 * so we don't end up referencing a non-existant page.
755	 * Cacheline aligned is in quotes because the kernel will
756	 * set the prefetch amount to a reasonable level if the
757	 * cacheline size is unknown.
758	 */
759	mvi	CCHCNT, SG_PREFETCH_CNT;
760	and	CCHADDR[0], SG_PREFETCH_ALIGN_MASK, SCB_RESIDUAL_SGPTR;
761	bmov	CCHADDR[1], SCB_RESIDUAL_SGPTR[1], 3;
762	mvi	CCSGCTL, CCSGEN|CCSGRESET ret;
763idle_sgfetch_complete:
764	call	disable_ccsgen_fetch_done;
765	and	CCSGADDR, SG_PREFETCH_ADDR_MASK, SCB_RESIDUAL_SGPTR;
766idle_sg_avail:
767	if ((ahc->features & AHC_ULTRA2) != 0) {
768		/* Does the hardware have space for another SG entry? */
769		test	DFSTATUS, PRELOAD_AVAIL jz return;
770		bmov 	HADDR, CCSGRAM, 7;
771		test	HCNT[0], 0x1 jz . + 2;
772		xor	DATA_COUNT_ODD, 0x1;
773		bmov	SCB_RESIDUAL_DATACNT[3], CCSGRAM, 1;
774		if ((ahc->flags & AHC_39BIT_ADDRESSING) != 0) {
775			mov	SCB_RESIDUAL_DATACNT[3] call set_hhaddr;
776		}
777		call	sg_advance;
778		mov	SINDEX, SCB_RESIDUAL_SGPTR[0];
779		test	DATA_COUNT_ODD, 0x1 jz . + 2;
780		or	SINDEX, ODD_SEG;
781		test	SCB_RESIDUAL_DATACNT[3], SG_LAST_SEG jz . + 2;
782		or	SINDEX, LAST_SEG;
783		mov	SG_CACHE_PRE, SINDEX;
784		/* Load the segment */
785		or	DFCNTRL, PRELOADEN;
786	}
787	ret;
788}
789
790if ((ahc->bugs & AHC_PCI_MWI_BUG) != 0 && ahc->pci_cachesize != 0) {
791/*
792 * Calculate the trailing portion of this S/G segment that cannot
793 * be transferred using memory write and invalidate PCI transactions.
794 * XXX Can we optimize this for PCI writes only???
795 */
796calc_mwi_residual:
797	/*
798	 * If the ending address is on a cacheline boundary,
799	 * there is no need for an extra segment.
800	 */
801	mov	A, HCNT[0];
802	add	A, A, HADDR[0];
803	and	A, CACHESIZE_MASK;
804	test	A, 0xFF jz return;
805
806	/*
807	 * If the transfer is less than a cachline,
808	 * there is no need for an extra segment.
809	 */
810	test	HCNT[1], 0xFF	jnz calc_mwi_residual_final;
811	test	HCNT[2], 0xFF	jnz calc_mwi_residual_final;
812	add	NONE, INVERTED_CACHESIZE_MASK, HCNT[0];
813	jnc	return;
814
815calc_mwi_residual_final:
816	mov	MWI_RESIDUAL, A;
817	not	A;
818	inc	A;
819	add	HCNT[0], A;
820	adc	HCNT[1], -1;
821	adc	HCNT[2], -1 ret;
822}
823
824p_data:
825	test	SEQ_FLAGS,NOT_IDENTIFIED|NO_CDB_SENT jz p_data_allowed;
826	mvi	PROTO_VIOLATION call set_seqint;
827p_data_allowed:
828	if ((ahc->features & AHC_ULTRA2) != 0) {
829		mvi	DMAPARAMS, PRELOADEN|SCSIEN|HDMAEN;
830	} else {
831		mvi	DMAPARAMS, WIDEODD|SCSIEN|SDMAEN|HDMAEN|FIFORESET;
832	}
833	test	LASTPHASE, IOI jnz . + 2;
834	or	DMAPARAMS, DIRECTION;
835	if ((ahc->features & AHC_CMD_CHAN) != 0) {
836		/* We don't have any valid S/G elements */
837		mvi	CCSGADDR, SG_PREFETCH_CNT;
838	}
839	test	SEQ_FLAGS, DPHASE	jz data_phase_initialize;
840
841	/*
842	 * If we re-enter the data phase after going through another
843	 * phase, our transfer location has almost certainly been
844	 * corrupted by the interveining, non-data, transfers.  Ask
845	 * the host driver to fix us up based on the transfer residual.
846	 */
847	mvi	PDATA_REINIT	call set_seqint;
848	jmp	data_phase_loop;
849
850data_phase_initialize:
851	/* We have seen a data phase for the first time */
852	or	SEQ_FLAGS, DPHASE;
853
854	/*
855	 * Initialize the DMA address and counter from the SCB.
856	 * Also set SCB_RESIDUAL_SGPTR, including the LAST_SEG
857	 * flag in the highest byte of the data count.  We cannot
858	 * modify the saved values in the SCB until we see a save
859	 * data pointers message.
860	 */
861	if ((ahc->flags & AHC_39BIT_ADDRESSING) != 0) {
862		/* The lowest address byte must be loaded last. */
863		mov	SCB_DATACNT[3] call set_hhaddr;
864	}
865	if ((ahc->features & AHC_CMD_CHAN) != 0) {
866		bmov	HADDR, SCB_DATAPTR, 7;
867		bmov	SCB_RESIDUAL_DATACNT[3], SCB_DATACNT[3], 5;
868	} else {
869		mvi	DINDEX, HADDR;
870		mvi	SCB_DATAPTR	call bcopy_7;
871		mvi	DINDEX, SCB_RESIDUAL_DATACNT + 3;
872		mvi	SCB_DATACNT + 3 call bcopy_5;
873	}
874	if ((ahc->bugs & AHC_PCI_MWI_BUG) != 0 && ahc->pci_cachesize != 0) {
875		call	calc_mwi_residual;
876	}
877	and	SCB_RESIDUAL_SGPTR[0], ~SG_FULL_RESID;
878	and	DATA_COUNT_ODD, 0x1, HCNT[0];
879
880	if ((ahc->features & AHC_ULTRA2) == 0) {
881		if ((ahc->features & AHC_CMD_CHAN) != 0) {
882			bmov	STCNT, HCNT, 3;
883		} else {
884			call	set_stcnt_from_hcnt;
885		}
886	}
887
888data_phase_loop:
889	/* Guard against overruns */
890	test	SCB_RESIDUAL_SGPTR[0], SG_LIST_NULL jz data_phase_inbounds;
891
892	/*
893	 * Turn on `Bit Bucket' mode, wait until the target takes
894	 * us to another phase, and then notify the host.
895	 */
896	and	DMAPARAMS, DIRECTION;
897	mov	DFCNTRL, DMAPARAMS;
898	or	SXFRCTL1,BITBUCKET;
899	if ((ahc->features & AHC_DT) == 0) {
900		test	SSTAT1,PHASEMIS	jz .;
901	} else {
902		test	SCSIPHASE, DATA_PHASE_MASK jnz .;
903	}
904	and	SXFRCTL1, ~BITBUCKET;
905	mvi	DATA_OVERRUN call set_seqint;
906	jmp	ITloop;
907
908data_phase_inbounds:
909	if ((ahc->features & AHC_ULTRA2) != 0) {
910		mov	SINDEX, SCB_RESIDUAL_SGPTR[0];
911		test	SCB_RESIDUAL_DATACNT[3], SG_LAST_SEG jz . + 2;
912		or	SINDEX, LAST_SEG;
913		test	DATA_COUNT_ODD, 0x1 jz . + 2;
914		or	SINDEX, ODD_SEG;
915		mov	SG_CACHE_PRE, SINDEX;
916		mov	DFCNTRL, DMAPARAMS;
917ultra2_dma_loop:
918		call	idle_loop;
919		/*
920		 * The transfer is complete if either the last segment
921		 * completes or the target changes phase.
922		 */
923		test	SG_CACHE_SHADOW, LAST_SEG_DONE jnz ultra2_dmafinish;
924		if ((ahc->features & AHC_DT) == 0) {
925			if ((ahc->flags & AHC_TARGETROLE) != 0) {
926				 /*
927				  * As a target, we control the phases,
928				  * so ignore PHASEMIS.
929				  */
930				test	SSTAT0, TARGET jnz ultra2_dma_loop;
931			}
932			if ((ahc->flags & AHC_INITIATORROLE) != 0) {
933				test	SSTAT1,PHASEMIS	jz ultra2_dma_loop;
934			}
935		} else {
936			test	DFCNTRL, SCSIEN jnz ultra2_dma_loop;
937		}
938
939ultra2_dmafinish:
940		/*
941		 * The transfer has terminated either due to a phase
942		 * change, and/or the completion of the last segment.
943		 * We have two goals here.  Do as much other work
944		 * as possible while the data fifo drains on a read
945		 * and respond as quickly as possible to the standard
946		 * messages (save data pointers/disconnect and command
947		 * complete) that usually follow a data phase.
948		 */
949		if ((ahc->bugs & AHC_AUTOFLUSH_BUG) != 0) {
950			/*
951			 * On chips with broken auto-flush, start
952			 * the flushing process now.  We'll poke
953			 * the chip from time to time to keep the
954			 * flush process going as we complete the
955			 * data phase.
956			 */
957			or	DFCNTRL, FIFOFLUSH;
958		}
959		/*
960		 * We assume that, even though data may still be
961		 * transferring to the host, that the SCSI side of
962		 * the DMA engine is now in a static state.  This
963		 * allows us to update our notion of where we are
964		 * in this transfer.
965		 *
966		 * If, by chance, we stopped before being able
967		 * to fetch additional segments for this transfer,
968		 * yet the last S/G was completely exhausted,
969		 * call our idle loop until it is able to load
970		 * another segment.  This will allow us to immediately
971		 * pickup on the next segment on the next data phase.
972		 *
973		 * If we happened to stop on the last segment, then
974		 * our residual information is still correct from
975		 * the idle loop and there is no need to perform
976		 * any fixups.
977		 */
978ultra2_ensure_sg:
979		test	SG_CACHE_SHADOW, LAST_SEG jz ultra2_shvalid;
980		/* Record if we've consumed all S/G entries */
981		test	SSTAT2, SHVALID	jnz residuals_correct;
982		or	SCB_RESIDUAL_SGPTR[0], SG_LIST_NULL;
983		jmp	residuals_correct;
984
985ultra2_shvalid:
986		test	SSTAT2, SHVALID	jnz sgptr_fixup;
987		call	idle_loop;
988		jmp	ultra2_ensure_sg;
989
990sgptr_fixup:
991		/*
992		 * Fixup the residual next S/G pointer.  The S/G preload
993		 * feature of the chip allows us to load two elements
994		 * in addition to the currently active element.  We
995		 * store the bottom byte of the next S/G pointer in
996		 * the SG_CACEPTR register so we can restore the
997		 * correct value when the DMA completes.  If the next
998		 * sg ptr value has advanced to the point where higher
999		 * bytes in the address have been affected, fix them
1000		 * too.
1001		 */
1002		test	SG_CACHE_SHADOW, 0x80 jz sgptr_fixup_done;
1003		test	SCB_RESIDUAL_SGPTR[0], 0x80 jnz sgptr_fixup_done;
1004		add	SCB_RESIDUAL_SGPTR[1], -1;
1005		adc	SCB_RESIDUAL_SGPTR[2], -1;
1006		adc	SCB_RESIDUAL_SGPTR[3], -1;
1007sgptr_fixup_done:
1008		and	SCB_RESIDUAL_SGPTR[0], SG_ADDR_MASK, SG_CACHE_SHADOW;
1009		clr	DATA_COUNT_ODD;
1010		test	SG_CACHE_SHADOW, ODD_SEG jz . + 2;
1011		or	DATA_COUNT_ODD, 0x1;
1012		clr	SCB_RESIDUAL_DATACNT[3]; /* We are not the last seg */
1013residuals_correct:
1014		/*
1015		 * Go ahead and shut down the DMA engine now.
1016		 * In the future, we'll want to handle end of
1017		 * transfer messages prior to doing this, but this
1018		 * requires similar restructuring for pre-ULTRA2
1019		 * controllers.
1020		 */
1021		test	DMAPARAMS, DIRECTION jnz ultra2_fifoempty;
1022ultra2_fifoflush:
1023		if ((ahc->features & AHC_DT) == 0) {
1024			if ((ahc->bugs & AHC_AUTOFLUSH_BUG) != 0) {
1025				/*
1026				 * On Rev A of the aic7890, the autoflush
1027				 * feature doesn't function correctly.
1028				 * Perform an explicit manual flush.  During
1029				 * a manual flush, the FIFOEMP bit becomes
1030				 * true every time the PCI FIFO empties
1031				 * regardless of the state of the SCSI FIFO.
1032				 * It can take up to 4 clock cycles for the
1033				 * SCSI FIFO to get data into the PCI FIFO
1034				 * and for FIFOEMP to de-assert.  Here we
1035				 * guard against this condition by making
1036				 * sure the FIFOEMP bit stays on for 5 full
1037				 * clock cycles.
1038				 */
1039				or	DFCNTRL, FIFOFLUSH;
1040				test	DFSTATUS, FIFOEMP jz ultra2_fifoflush;
1041				test	DFSTATUS, FIFOEMP jz ultra2_fifoflush;
1042				test	DFSTATUS, FIFOEMP jz ultra2_fifoflush;
1043				test	DFSTATUS, FIFOEMP jz ultra2_fifoflush;
1044			}
1045			test	DFSTATUS, FIFOEMP jz ultra2_fifoflush;
1046		} else {
1047			/*
1048			 * We enable the auto-ack feature on DT capable
1049			 * controllers.  This means that the controller may
1050			 * have already transferred some overrun bytes into
1051			 * the data FIFO and acked them on the bus.  The only
1052			 * way to detect this situation is to wait for
1053			 * LAST_SEG_DONE to come true on a completed transfer
1054			 * and then test to see if the data FIFO is non-empty.
1055			 */
1056			test	SCB_RESIDUAL_SGPTR[0], SG_LIST_NULL jz . + 4;
1057			test	SG_CACHE_SHADOW, LAST_SEG_DONE jz .;
1058			test	DFSTATUS, FIFOEMP jnz ultra2_fifoempty;
1059			/* Overrun */
1060			jmp	data_phase_loop;
1061			test	DFSTATUS, FIFOEMP jz .;
1062		}
1063ultra2_fifoempty:
1064		/* Don't clobber an inprogress host data transfer */
1065		test	DFSTATUS, MREQPEND	jnz ultra2_fifoempty;
1066ultra2_dmahalt:
1067		and     DFCNTRL, ~(SCSIEN|HDMAEN);
1068		test	DFCNTRL, SCSIEN|HDMAEN jnz .;
1069		if ((ahc->flags & AHC_39BIT_ADDRESSING) != 0) {
1070			/*
1071			 * Keep HHADDR cleared for future, 32bit addressed
1072			 * only, DMA operations.
1073			 *
1074			 * Due to bayonette style S/G handling, our residual
1075			 * data must be "fixed up" once the transfer is halted.
1076			 * Here we fixup the HSHADDR stored in the high byte
1077			 * of the residual data cnt.  By postponing the fixup,
1078			 * we can batch the clearing of HADDR with the fixup.
1079			 * If we halted on the last segment, the residual is
1080			 * already correct.   If we are not on the last
1081			 * segment, copy the high address directly from HSHADDR.
1082			 * We don't need to worry about maintaining the
1083			 * SG_LAST_SEG flag as it will always be false in the
1084			 * case where an update is required.
1085			 */
1086			or	DSCOMMAND1, HADDLDSEL0;
1087			test	SG_CACHE_SHADOW, LAST_SEG jnz . + 2;
1088			mov	SCB_RESIDUAL_DATACNT[3], SHADDR;
1089			clr	HADDR;
1090			and	DSCOMMAND1, ~HADDLDSEL0;
1091		}
1092	} else {
1093		/* If we are the last SG block, tell the hardware. */
1094		if ((ahc->bugs & AHC_PCI_MWI_BUG) != 0
1095		  && ahc->pci_cachesize != 0) {
1096			test	MWI_RESIDUAL, 0xFF jnz dma_mid_sg;
1097		}
1098		test	SCB_RESIDUAL_DATACNT[3], SG_LAST_SEG jz dma_mid_sg;
1099		if ((ahc->flags & AHC_TARGETROLE) != 0) {
1100			test	SSTAT0, TARGET jz dma_last_sg;
1101			if ((ahc->flags & AHC_TMODE_WIDEODD_BUG) != 0) {
1102				test	DMAPARAMS, DIRECTION jz dma_mid_sg;
1103			}
1104		}
1105dma_last_sg:
1106		and	DMAPARAMS, ~WIDEODD;
1107dma_mid_sg:
1108		/* Start DMA data transfer. */
1109		mov	DFCNTRL, DMAPARAMS;
1110dma_loop:
1111		if ((ahc->features & AHC_CMD_CHAN) != 0) {
1112			call	idle_loop;
1113		}
1114		test	SSTAT0,DMADONE	jnz dma_dmadone;
1115		test	SSTAT1,PHASEMIS	jz dma_loop;	/* ie. underrun */
1116dma_phasemis:
1117		/*
1118		 * We will be "done" DMAing when the transfer count goes to
1119		 * zero, or the target changes the phase (in light of this,
1120		 * it makes sense that the DMA circuitry doesn't ACK when
1121		 * PHASEMIS is active).  If we are doing a SCSI->Host transfer,
1122		 * the data FIFO should be flushed auto-magically on STCNT=0
1123		 * or a phase change, so just wait for FIFO empty status.
1124		 */
1125dma_checkfifo:
1126		test	DFCNTRL,DIRECTION	jnz dma_fifoempty;
1127dma_fifoflush:
1128		test	DFSTATUS,FIFOEMP	jz dma_fifoflush;
1129dma_fifoempty:
1130		/* Don't clobber an inprogress host data transfer */
1131		test	DFSTATUS, MREQPEND	jnz dma_fifoempty;
1132
1133		/*
1134		 * Now shut off the DMA and make sure that the DMA
1135		 * hardware has actually stopped.  Touching the DMA
1136		 * counters, etc. while a DMA is active will result
1137		 * in an ILLSADDR exception.
1138		 */
1139dma_dmadone:
1140		and	DFCNTRL, ~(SCSIEN|SDMAEN|HDMAEN);
1141dma_halt:
1142		/*
1143		 * Some revisions of the aic78XX have a problem where, if the
1144		 * data fifo is full, but the PCI input latch is not empty,
1145		 * HDMAEN cannot be cleared.  The fix used here is to drain
1146		 * the prefetched but unused data from the data fifo until
1147		 * there is space for the input latch to drain.
1148		 */
1149		if ((ahc->bugs & AHC_PCI_2_1_RETRY_BUG) != 0) {
1150			mov	NONE, DFDAT;
1151		}
1152		test	DFCNTRL, (SCSIEN|SDMAEN|HDMAEN) jnz dma_halt;
1153
1154		/* See if we have completed this last segment */
1155		test	STCNT[0], 0xff	jnz data_phase_finish;
1156		test	STCNT[1], 0xff	jnz data_phase_finish;
1157		test	STCNT[2], 0xff	jnz data_phase_finish;
1158
1159		/*
1160		 * Advance the scatter-gather pointers if needed
1161		 */
1162		if ((ahc->bugs & AHC_PCI_MWI_BUG) != 0
1163		  && ahc->pci_cachesize != 0) {
1164			test	MWI_RESIDUAL, 0xFF jz no_mwi_resid;
1165			/*
1166			 * Reload HADDR from SHADDR and setup the
1167			 * count to be the size of our residual.
1168			 */
1169			if ((ahc->features & AHC_CMD_CHAN) != 0) {
1170				bmov	HADDR, SHADDR, 4;
1171				mov	HCNT, MWI_RESIDUAL;
1172				bmov	HCNT[1], ALLZEROS, 2;
1173			} else {
1174				mvi	DINDEX, HADDR;
1175				mvi	SHADDR call bcopy_4;
1176				mov	MWI_RESIDUAL call set_hcnt;
1177			}
1178			clr	MWI_RESIDUAL;
1179			jmp	sg_load_done;
1180no_mwi_resid:
1181		}
1182		test	SCB_RESIDUAL_DATACNT[3], SG_LAST_SEG jz sg_load;
1183		or	SCB_RESIDUAL_SGPTR[0], SG_LIST_NULL;
1184		jmp	data_phase_finish;
1185sg_load:
1186		/*
1187		 * Load the next SG element's data address and length
1188		 * into the DMA engine.  If we don't have hardware
1189		 * to perform a prefetch, we'll have to fetch the
1190		 * segment from host memory first.
1191		 */
1192		if ((ahc->features & AHC_CMD_CHAN) != 0) {
1193			/* Wait for the idle loop to complete */
1194			test	CCSGCTL, CCSGEN jz . + 3;
1195			call	idle_loop;
1196			test	CCSGCTL, CCSGEN jnz . - 1;
1197			bmov 	HADDR, CCSGRAM, 7;
1198			/*
1199			 * Workaround for flaky external SCB RAM
1200			 * on certain aic7895 setups.  It seems
1201			 * unable to handle direct transfers from
1202			 * S/G ram to certain SCB locations.
1203			 */
1204			mov	SINDEX, CCSGRAM;
1205			mov	SCB_RESIDUAL_DATACNT[3], SINDEX;
1206		} else {
1207			if ((ahc->flags & AHC_39BIT_ADDRESSING) != 0) {
1208				mov	ALLZEROS call set_hhaddr;
1209			}
1210			mvi	DINDEX, HADDR;
1211			mvi	SCB_RESIDUAL_SGPTR	call bcopy_4;
1212
1213			mvi	SG_SIZEOF	call set_hcnt;
1214
1215			or	DFCNTRL, HDMAEN|DIRECTION|FIFORESET;
1216
1217			call	dma_finish;
1218
1219			mvi	DINDEX, HADDR;
1220			call	dfdat_in_7;
1221			mov	SCB_RESIDUAL_DATACNT[3], DFDAT;
1222		}
1223
1224		if ((ahc->flags & AHC_39BIT_ADDRESSING) != 0) {
1225			mov	SCB_RESIDUAL_DATACNT[3] call set_hhaddr;
1226
1227			/*
1228			 * The lowest address byte must be loaded
1229			 * last as it triggers the computation of
1230			 * some items in the PCI block.  The ULTRA2
1231			 * chips do this on PRELOAD.
1232			 */
1233			mov	HADDR, HADDR;
1234		}
1235		if ((ahc->bugs & AHC_PCI_MWI_BUG) != 0
1236		  && ahc->pci_cachesize != 0) {
1237			call calc_mwi_residual;
1238		}
1239
1240		/* Point to the new next sg in memory */
1241		call	sg_advance;
1242
1243sg_load_done:
1244		if ((ahc->features & AHC_CMD_CHAN) != 0) {
1245			bmov	STCNT, HCNT, 3;
1246		} else {
1247			call	set_stcnt_from_hcnt;
1248		}
1249		/* Track odd'ness */
1250		test	HCNT[0], 0x1 jz . + 2;
1251		xor	DATA_COUNT_ODD, 0x1;
1252
1253		if ((ahc->flags & AHC_TARGETROLE) != 0) {
1254			test	SSTAT0, TARGET jnz data_phase_loop;
1255		}
1256	}
1257data_phase_finish:
1258	/*
1259	 * If the target has left us in data phase, loop through
1260	 * the DMA code again.  In the case of ULTRA2 adapters,
1261	 * we should only loop if there is a data overrun.  For
1262	 * all other adapters, we'll loop after each S/G element
1263	 * is loaded as well as if there is an overrun.
1264	 */
1265	if ((ahc->flags & AHC_TARGETROLE) != 0) {
1266		test	SSTAT0, TARGET jnz data_phase_done;
1267	}
1268	if ((ahc->flags & AHC_INITIATORROLE) != 0) {
1269		test	SSTAT1, REQINIT jz .;
1270		if ((ahc->features & AHC_DT) == 0) {
1271			test	SSTAT1,PHASEMIS	jz data_phase_loop;
1272		} else {
1273			test	SCSIPHASE, DATA_PHASE_MASK jnz data_phase_loop;
1274		}
1275	}
1276
1277data_phase_done:
1278	/*
1279	 * After a DMA finishes, save the SG and STCNT residuals back into
1280	 * the SCB.  We use STCNT instead of HCNT, since it's a reflection
1281	 * of how many bytes were transferred on the SCSI (as opposed to the
1282	 * host) bus.
1283	 */
1284	if ((ahc->features & AHC_CMD_CHAN) != 0) {
1285		/* Kill off any pending prefetch */
1286		call	disable_ccsgen;
1287	}
1288
1289	if ((ahc->features & AHC_ULTRA2) == 0) {
1290		/*
1291		 * Clear the high address byte so that all other DMA
1292		 * operations, which use 32bit addressing, can assume
1293		 * HHADDR is 0.
1294		 */
1295		if ((ahc->flags & AHC_39BIT_ADDRESSING) != 0) {
1296			mov	ALLZEROS call set_hhaddr;
1297		}
1298	}
1299
1300	/*
1301	 * Update our residual information before the information is
1302	 * lost by some other type of SCSI I/O (e.g. PIO).  If we have
1303	 * transferred all data, no update is needed.
1304	 *
1305	 */
1306	test	SCB_RESIDUAL_SGPTR, SG_LIST_NULL jnz residual_update_done;
1307	if ((ahc->bugs & AHC_PCI_MWI_BUG) != 0
1308	  && ahc->pci_cachesize != 0) {
1309		if ((ahc->features & AHC_CMD_CHAN) != 0) {
1310			test	MWI_RESIDUAL, 0xFF jz bmov_resid;
1311		}
1312		mov	A, MWI_RESIDUAL;
1313		add	SCB_RESIDUAL_DATACNT[0], A, STCNT[0];
1314		clr	A;
1315		adc	SCB_RESIDUAL_DATACNT[1], A, STCNT[1];
1316		adc	SCB_RESIDUAL_DATACNT[2], A, STCNT[2];
1317		clr	MWI_RESIDUAL;
1318		if ((ahc->features & AHC_CMD_CHAN) != 0) {
1319			jmp	. + 2;
1320bmov_resid:
1321			bmov	SCB_RESIDUAL_DATACNT, STCNT, 3;
1322		}
1323	} else if ((ahc->features & AHC_CMD_CHAN) != 0) {
1324		bmov	SCB_RESIDUAL_DATACNT, STCNT, 3;
1325	} else {
1326		mov	SCB_RESIDUAL_DATACNT[0], STCNT[0];
1327		mov	SCB_RESIDUAL_DATACNT[1], STCNT[1];
1328		mov	SCB_RESIDUAL_DATACNT[2], STCNT[2];
1329	}
1330residual_update_done:
1331	/*
1332	 * Since we've been through a data phase, the SCB_RESID* fields
1333	 * are now initialized.  Clear the full residual flag.
1334	 */
1335	and	SCB_SGPTR[0], ~SG_FULL_RESID;
1336
1337	if ((ahc->features & AHC_ULTRA2) != 0) {
1338		/* Clear the channel in case we return to data phase later */
1339		or	SXFRCTL0, CLRSTCNT|CLRCHN;
1340		or	SXFRCTL0, CLRSTCNT|CLRCHN;
1341	}
1342
1343	if ((ahc->flags & AHC_TARGETROLE) != 0) {
1344		test	SEQ_FLAGS, DPHASE_PENDING jz ITloop;
1345		and	SEQ_FLAGS, ~DPHASE_PENDING;
1346		/*
1347		 * For data-in phases, wait for any pending acks from the
1348		 * initiator before changing phase.  We only need to
1349		 * send Ignore Wide Residue messages for data-in phases.
1350		 */
1351		test	DFCNTRL, DIRECTION jz target_ITloop;
1352		test	SSTAT1, REQINIT	jnz .;
1353		test	DATA_COUNT_ODD, 0x1 jz target_ITloop;
1354		test	SCSIRATE, WIDEXFER jz target_ITloop;
1355		/*
1356		 * Issue an Ignore Wide Residue Message.
1357		 */
1358		mvi	P_MESGIN|BSYO call change_phase;
1359		mvi	MSG_IGN_WIDE_RESIDUE call target_outb;
1360		mvi	1 call target_outb;
1361		jmp	target_ITloop;
1362	} else {
1363		jmp	ITloop;
1364	}
1365
1366if ((ahc->flags & AHC_INITIATORROLE) != 0) {
1367/*
1368 * Command phase.  Set up the DMA registers and let 'er rip.
1369 */
1370p_command:
1371	test	SEQ_FLAGS, NOT_IDENTIFIED jz p_command_okay;
1372	mvi	PROTO_VIOLATION call set_seqint;
1373p_command_okay:
1374
1375	if ((ahc->features & AHC_ULTRA2) != 0) {
1376		bmov	HCNT[0], SCB_CDB_LEN,  1;
1377		bmov	HCNT[1], ALLZEROS, 2;
1378		mvi	SG_CACHE_PRE, LAST_SEG;
1379	} else if ((ahc->features & AHC_CMD_CHAN) != 0) {
1380		bmov	STCNT[0], SCB_CDB_LEN, 1;
1381		bmov	STCNT[1], ALLZEROS, 2;
1382	} else {
1383		mov	STCNT[0], SCB_CDB_LEN;
1384		clr	STCNT[1];
1385		clr	STCNT[2];
1386	}
1387	add	NONE, -13, SCB_CDB_LEN;
1388	mvi	SCB_CDB_STORE jnc p_command_embedded;
1389p_command_from_host:
1390	if ((ahc->features & AHC_ULTRA2) != 0) {
1391		bmov	HADDR[0], SCB_CDB_PTR, 4;
1392		mvi	DFCNTRL, (PRELOADEN|SCSIEN|HDMAEN|DIRECTION);
1393	} else {
1394		if ((ahc->features & AHC_CMD_CHAN) != 0) {
1395			bmov	HADDR[0], SCB_CDB_PTR, 4;
1396			bmov	HCNT, STCNT, 3;
1397		} else {
1398			mvi	DINDEX, HADDR;
1399			mvi	SCB_CDB_PTR call bcopy_4;
1400			mov	SCB_CDB_LEN call set_hcnt;
1401		}
1402		mvi	DFCNTRL, (SCSIEN|SDMAEN|HDMAEN|DIRECTION|FIFORESET);
1403	}
1404	jmp	p_command_xfer;
1405p_command_embedded:
1406	/*
1407	 * The data fifo seems to require 4 byte aligned
1408	 * transfers from the sequencer.  Force this to
1409	 * be the case by clearing HADDR[0] even though
1410	 * we aren't going to touch host memory.
1411	 */
1412	clr	HADDR[0];
1413	if ((ahc->features & AHC_ULTRA2) != 0) {
1414		mvi	DFCNTRL, (PRELOADEN|SCSIEN|DIRECTION);
1415		bmov	DFDAT, SCB_CDB_STORE, 12;
1416	} else if ((ahc->features & AHC_CMD_CHAN) != 0) {
1417		if ((ahc->flags & AHC_SCB_BTT) != 0) {
1418			/*
1419			 * On the 7895 the data FIFO will
1420			 * get corrupted if you try to dump
1421			 * data from external SCB memory into
1422			 * the FIFO while it is enabled.  So,
1423			 * fill the fifo and then enable SCSI
1424			 * transfers.
1425			 */
1426			mvi	DFCNTRL, (DIRECTION|FIFORESET);
1427		} else {
1428			mvi	DFCNTRL, (SCSIEN|SDMAEN|DIRECTION|FIFORESET);
1429		}
1430		bmov	DFDAT, SCB_CDB_STORE, 12;
1431		if ((ahc->flags & AHC_SCB_BTT) != 0) {
1432			mvi	DFCNTRL, (SCSIEN|SDMAEN|DIRECTION|FIFOFLUSH);
1433		} else {
1434			or	DFCNTRL, FIFOFLUSH;
1435		}
1436	} else {
1437		mvi	DFCNTRL, (SCSIEN|SDMAEN|DIRECTION|FIFORESET);
1438		call	copy_to_fifo_6;
1439		call	copy_to_fifo_6;
1440		or	DFCNTRL, FIFOFLUSH;
1441	}
1442p_command_xfer:
1443	and	SEQ_FLAGS, ~NO_CDB_SENT;
1444	if ((ahc->features & AHC_DT) == 0) {
1445		test	SSTAT0, SDONE jnz . + 2;
1446		test    SSTAT1, PHASEMIS jz . - 1;
1447		/*
1448		 * Wait for our ACK to go-away on it's own
1449		 * instead of being killed by SCSIEN getting cleared.
1450		 */
1451		test	SCSISIGI, ACKI jnz .;
1452	} else {
1453		test	DFCNTRL, SCSIEN jnz .;
1454	}
1455	test	SSTAT0, SDONE jnz p_command_successful;
1456	/*
1457	 * Don't allow a data phase if the command
1458	 * was not fully transferred.
1459	 */
1460	or	SEQ_FLAGS, NO_CDB_SENT;
1461p_command_successful:
1462	and	DFCNTRL, ~(SCSIEN|SDMAEN|HDMAEN);
1463	test	DFCNTRL, (SCSIEN|SDMAEN|HDMAEN) jnz .;
1464	jmp	ITloop;
1465
1466/*
1467 * Status phase.  Wait for the data byte to appear, then read it
1468 * and store it into the SCB.
1469 */
1470p_status:
1471	test	SEQ_FLAGS, NOT_IDENTIFIED jnz mesgin_proto_violation;
1472p_status_okay:
1473	mov	SCB_SCSI_STATUS, SCSIDATL;
1474	or	SCB_CONTROL, STATUS_RCVD;
1475	jmp	ITloop;
1476
1477/*
1478 * Message out phase.  If MSG_OUT is MSG_IDENTIFYFLAG, build a full
1479 * indentify message sequence and send it to the target.  The host may
1480 * override this behavior by setting the MK_MESSAGE bit in the SCB
1481 * control byte.  This will cause us to interrupt the host and allow
1482 * it to handle the message phase completely on its own.  If the bit
1483 * associated with this target is set, we will also interrupt the host,
1484 * thereby allowing it to send a message on the next selection regardless
1485 * of the transaction being sent.
1486 *
1487 * If MSG_OUT is == HOST_MSG, also interrupt the host and take a message.
1488 * This is done to allow the host to send messages outside of an identify
1489 * sequence while protecting the seqencer from testing the MK_MESSAGE bit
1490 * on an SCB that might not be for the current nexus. (For example, a
1491 * BDR message in responce to a bad reselection would leave us pointed to
1492 * an SCB that doesn't have anything to do with the current target).
1493 *
1494 * Otherwise, treat MSG_OUT as a 1 byte message to send (abort, abort tag,
1495 * bus device reset).
1496 *
1497 * When there are no messages to send, MSG_OUT should be set to MSG_NOOP,
1498 * in case the target decides to put us in this phase for some strange
1499 * reason.
1500 */
1501p_mesgout_retry:
1502	/* Turn on ATN for the retry */
1503	if ((ahc->features & AHC_DT) == 0) {
1504		or	SCSISIGO, ATNO, LASTPHASE;
1505	} else {
1506		mvi	SCSISIGO, ATNO;
1507	}
1508p_mesgout:
1509	mov	SINDEX, MSG_OUT;
1510	cmp	SINDEX, MSG_IDENTIFYFLAG jne p_mesgout_from_host;
1511	test	SCB_CONTROL,MK_MESSAGE	jnz host_message_loop;
1512p_mesgout_identify:
1513	or	SINDEX, MSG_IDENTIFYFLAG|DISCENB, SCB_LUN;
1514	test	SCB_CONTROL, DISCENB jnz . + 2;
1515	and	SINDEX, ~DISCENB;
1516/*
1517 * Send a tag message if TAG_ENB is set in the SCB control block.
1518 * Use SCB_TAG (the position in the kernel's SCB array) as the tag value.
1519 */
1520p_mesgout_tag:
1521	test	SCB_CONTROL,TAG_ENB jz  p_mesgout_onebyte;
1522	mov	SCSIDATL, SINDEX;	/* Send the identify message */
1523	call	phase_lock;
1524	cmp	LASTPHASE, P_MESGOUT	jne p_mesgout_done;
1525	and	SCSIDATL,TAG_ENB|SCB_TAG_TYPE,SCB_CONTROL;
1526	call	phase_lock;
1527	cmp	LASTPHASE, P_MESGOUT	jne p_mesgout_done;
1528	mov	SCB_TAG	jmp p_mesgout_onebyte;
1529/*
1530 * Interrupt the driver, and allow it to handle this message
1531 * phase and any required retries.
1532 */
1533p_mesgout_from_host:
1534	cmp	SINDEX, HOST_MSG	jne p_mesgout_onebyte;
1535	jmp	host_message_loop;
1536
1537p_mesgout_onebyte:
1538	mvi	CLRSINT1, CLRATNO;
1539	mov	SCSIDATL, SINDEX;
1540
1541/*
1542 * If the next bus phase after ATN drops is message out, it means
1543 * that the target is requesting that the last message(s) be resent.
1544 */
1545	call	phase_lock;
1546	cmp	LASTPHASE, P_MESGOUT	je p_mesgout_retry;
1547
1548p_mesgout_done:
1549	mvi	CLRSINT1,CLRATNO;	/* Be sure to turn ATNO off */
1550	mov	LAST_MSG, MSG_OUT;
1551	mvi	MSG_OUT, MSG_NOOP;	/* No message left */
1552	jmp	ITloop;
1553
1554/*
1555 * Message in phase.  Bytes are read using Automatic PIO mode.
1556 */
1557p_mesgin:
1558	mvi	ACCUM		call inb_first;	/* read the 1st message byte */
1559
1560	test	A,MSG_IDENTIFYFLAG	jnz mesgin_identify;
1561	cmp	A,MSG_DISCONNECT	je mesgin_disconnect;
1562	cmp	A,MSG_SAVEDATAPOINTER	je mesgin_sdptrs;
1563	cmp	ALLZEROS,A		je mesgin_complete;
1564	cmp	A,MSG_RESTOREPOINTERS	je mesgin_rdptrs;
1565	cmp	A,MSG_IGN_WIDE_RESIDUE	je mesgin_ign_wide_residue;
1566	cmp	A,MSG_NOOP		je mesgin_done;
1567
1568/*
1569 * Pushed message loop to allow the kernel to
1570 * run it's own message state engine.  To avoid an
1571 * extra nop instruction after signaling the kernel,
1572 * we perform the phase_lock before checking to see
1573 * if we should exit the loop and skip the phase_lock
1574 * in the ITloop.  Performing back to back phase_locks
1575 * shouldn't hurt, but why do it twice...
1576 */
1577host_message_loop:
1578	mvi	HOST_MSG_LOOP call set_seqint;
1579	call	phase_lock;
1580	cmp	RETURN_1, EXIT_MSG_LOOP	je ITloop + 1;
1581	jmp	host_message_loop;
1582
1583mesgin_ign_wide_residue:
1584if ((ahc->features & AHC_WIDE) != 0) {
1585	test	SCSIRATE, WIDEXFER jz mesgin_reject;
1586	/* Pull the residue byte */
1587	mvi	ARG_1	call inb_next;
1588	cmp	ARG_1, 0x01 jne mesgin_reject;
1589	test	SCB_RESIDUAL_SGPTR[0], SG_LIST_NULL jz . + 2;
1590	test	DATA_COUNT_ODD, 0x1	jz mesgin_done;
1591	mvi	IGN_WIDE_RES call set_seqint;
1592	jmp	mesgin_done;
1593}
1594
1595mesgin_proto_violation:
1596	mvi	PROTO_VIOLATION call set_seqint;
1597	jmp	mesgin_done;
1598mesgin_reject:
1599	mvi	MSG_MESSAGE_REJECT	call mk_mesg;
1600mesgin_done:
1601	mov	NONE,SCSIDATL;		/*dummy read from latch to ACK*/
1602	jmp	ITloop;
1603
1604/*
1605 * We received a "command complete" message.  Put the SCB_TAG into the QOUTFIFO,
1606 * and trigger a completion interrupt.  Before doing so, check to see if there
1607 * is a residual or the status byte is something other than STATUS_GOOD (0).
1608 * In either of these conditions, we upload the SCB back to the host so it can
1609 * process this information.  In the case of a non zero status byte, we
1610 * additionally interrupt the kernel driver synchronously, allowing it to
1611 * decide if sense should be retrieved.  If the kernel driver wishes to request
1612 * sense, it will fill the kernel SCB with a request sense command, requeue
1613 * it to the QINFIFO and tell us not to post to the QOUTFIFO by setting
1614 * RETURN_1 to SEND_SENSE.
1615 */
1616mesgin_complete:
1617
1618	/*
1619	 * If ATN is raised, we still want to give the target a message.
1620	 * Perhaps there was a parity error on this last message byte.
1621	 * Either way, the target should take us to message out phase
1622	 * and then attempt to complete the command again.  We should use a
1623	 * critical section here to guard against a timeout triggering
1624	 * for this command and setting ATN while we are still processing
1625	 * the completion.
1626	test	SCSISIGI, ATNI jnz mesgin_done;
1627	 */
1628
1629	/*
1630	 * If we are identified and have successfully sent the CDB,
1631	 * any status will do.  Optimize this fast path.
1632	 */
1633	test	SCB_CONTROL, STATUS_RCVD jz mesgin_proto_violation;
1634	test	SEQ_FLAGS, NOT_IDENTIFIED|NO_CDB_SENT jz complete_accepted;
1635
1636	/*
1637	 * If the target never sent an identify message but instead went
1638	 * to mesgin to give an invalid message, let the host abort us.
1639	 */
1640	test	SEQ_FLAGS, NOT_IDENTIFIED jnz mesgin_proto_violation;
1641
1642	/*
1643	 * If we recevied good status but never successfully sent the
1644	 * cdb, abort the command.
1645	 */
1646	test	SCB_SCSI_STATUS,0xff	jnz complete_accepted;
1647	test	SEQ_FLAGS, NO_CDB_SENT jnz mesgin_proto_violation;
1648
1649complete_accepted:
1650	/*
1651	 * See if we attempted to deliver a message but the target ingnored us.
1652	 */
1653	test	SCB_CONTROL, MK_MESSAGE jz . + 2;
1654	mvi	MKMSG_FAILED call set_seqint;
1655
1656	/*
1657	 * Check for residuals
1658	 */
1659	test	SCB_SGPTR, SG_LIST_NULL jnz check_status;/* No xfer */
1660	test	SCB_SGPTR, SG_FULL_RESID jnz upload_scb;/* Never xfered */
1661	test	SCB_RESIDUAL_SGPTR, SG_LIST_NULL jz upload_scb;
1662check_status:
1663	test	SCB_SCSI_STATUS,0xff	jz complete;	/* Good Status? */
1664upload_scb:
1665	or	SCB_SGPTR, SG_RESID_VALID;
1666	mvi	DMAPARAMS, FIFORESET;
1667	mov	SCB_TAG		call dma_scb;
1668	test	SCB_SCSI_STATUS, 0xff	jz complete;	/* Just a residual? */
1669	mvi	BAD_STATUS call set_seqint;		/* let driver know */
1670	cmp	RETURN_1, SEND_SENSE	jne complete;
1671	call	add_scb_to_free_list;
1672	jmp	await_busfree;
1673complete:
1674	mov	SCB_TAG call complete_post;
1675	jmp	await_busfree;
1676}
1677
1678complete_post:
1679	/* Post the SCBID in SINDEX and issue an interrupt */
1680	call	add_scb_to_free_list;
1681	mov	ARG_1, SINDEX;
1682	if ((ahc->features & AHC_QUEUE_REGS) != 0) {
1683		mov	A, SDSCB_QOFF;
1684	} else {
1685		mov	A, QOUTPOS;
1686	}
1687	mvi	QOUTFIFO_OFFSET call post_byte_setup;
1688	mov	ARG_1 call post_byte;
1689	if ((ahc->features & AHC_QUEUE_REGS) == 0) {
1690		inc 	QOUTPOS;
1691	}
1692	mvi	INTSTAT,CMDCMPLT ret;
1693
1694if ((ahc->flags & AHC_INITIATORROLE) != 0) {
1695/*
1696 * Is it a disconnect message?  Set a flag in the SCB to remind us
1697 * and await the bus going free.  If this is an untagged transaction
1698 * store the SCB id for it in our untagged target table for lookup on
1699 * a reselction.
1700 */
1701mesgin_disconnect:
1702	/*
1703	 * If ATN is raised, we still want to give the target a message.
1704	 * Perhaps there was a parity error on this last message byte
1705	 * or we want to abort this command.  Either way, the target
1706	 * should take us to message out phase and then attempt to
1707	 * disconnect again.
1708	 * XXX - Wait for more testing.
1709	test	SCSISIGI, ATNI jnz mesgin_done;
1710	 */
1711	test	SEQ_FLAGS, NOT_IDENTIFIED|NO_CDB_SENT
1712		jnz mesgin_proto_violation;
1713	or	SCB_CONTROL,DISCONNECTED;
1714	if ((ahc->flags & AHC_PAGESCBS) != 0) {
1715		call	add_scb_to_disc_list;
1716	}
1717	test	SCB_CONTROL, TAG_ENB jnz await_busfree;
1718	mov	ARG_1, SCB_TAG;
1719	mov	SAVED_LUN, SCB_LUN;
1720	mov	SCB_SCSIID	call set_busy_target;
1721	jmp	await_busfree;
1722
1723/*
1724 * Save data pointers message:
1725 * Copying RAM values back to SCB, for Save Data Pointers message, but
1726 * only if we've actually been into a data phase to change them.  This
1727 * protects against bogus data in scratch ram and the residual counts
1728 * since they are only initialized when we go into data_in or data_out.
1729 * Ack the message as soon as possible.  For chips without S/G pipelining,
1730 * we can only ack the message after SHADDR has been saved.  On these
1731 * chips, SHADDR increments with every bus transaction, even PIO.
1732 */
1733mesgin_sdptrs:
1734	if ((ahc->features & AHC_ULTRA2) != 0) {
1735		mov	NONE,SCSIDATL;		/*dummy read from latch to ACK*/
1736		test	SEQ_FLAGS, DPHASE	jz ITloop;
1737	} else {
1738		test	SEQ_FLAGS, DPHASE	jz mesgin_done;
1739	}
1740
1741	/*
1742	 * If we are asked to save our position at the end of the
1743	 * transfer, just mark us at the end rather than perform a
1744	 * full save.
1745	 */
1746	test	SCB_RESIDUAL_SGPTR[0], SG_LIST_NULL jz mesgin_sdptrs_full;
1747	or	SCB_SGPTR, SG_LIST_NULL;
1748	if ((ahc->features & AHC_ULTRA2) != 0) {
1749		jmp	ITloop;
1750	} else {
1751		jmp	mesgin_done;
1752	}
1753
1754mesgin_sdptrs_full:
1755
1756	/*
1757	 * The SCB_SGPTR becomes the next one we'll download,
1758	 * and the SCB_DATAPTR becomes the current SHADDR.
1759	 * Use the residual number since STCNT is corrupted by
1760	 * any message transfer.
1761	 */
1762	if ((ahc->features & AHC_CMD_CHAN) != 0) {
1763		bmov	SCB_DATAPTR, SHADDR, 4;
1764		if ((ahc->features & AHC_ULTRA2) == 0) {
1765			mov	NONE,SCSIDATL;	/*dummy read from latch to ACK*/
1766		}
1767		bmov	SCB_DATACNT, SCB_RESIDUAL_DATACNT, 8;
1768	} else {
1769		mvi	DINDEX, SCB_DATAPTR;
1770		mvi	SHADDR call bcopy_4;
1771		mov	NONE,SCSIDATL;	/*dummy read from latch to ACK*/
1772		mvi	SCB_RESIDUAL_DATACNT call bcopy_8;
1773	}
1774	jmp	ITloop;
1775
1776/*
1777 * Restore pointers message?  Data pointers are recopied from the
1778 * SCB anytime we enter a data phase for the first time, so all
1779 * we need to do is clear the DPHASE flag and let the data phase
1780 * code do the rest.  We also reset/reallocate the FIFO to make
1781 * sure we have a clean start for the next data or command phase.
1782 */
1783mesgin_rdptrs:
1784	and	SEQ_FLAGS, ~DPHASE;		/*
1785						 * We'll reload them
1786						 * the next time through
1787						 * the dataphase.
1788						 */
1789	or	SXFRCTL0, CLRSTCNT|CLRCHN;
1790	jmp	mesgin_done;
1791
1792/*
1793 * Index into our Busy Target table.  SINDEX and DINDEX are modified
1794 * upon return.  SCBPTR may be modified by this action.
1795 */
1796set_busy_target:
1797	shr	DINDEX, 4, SINDEX;
1798	if ((ahc->flags & AHC_SCB_BTT) != 0) {
1799		mov	SCBPTR, SAVED_LUN;
1800		add	DINDEX, SCB_64_BTT;
1801	} else {
1802		add	DINDEX, BUSY_TARGETS;
1803	}
1804	mov	DINDIR, ARG_1 ret;
1805
1806/*
1807 * Identify message?  For a reconnecting target, this tells us the lun
1808 * that the reconnection is for - find the correct SCB and switch to it,
1809 * clearing the "disconnected" bit so we don't "find" it by accident later.
1810 */
1811mesgin_identify:
1812	/*
1813	 * Determine whether a target is using tagged or non-tagged
1814	 * transactions by first looking at the transaction stored in
1815	 * the busy target array.  If there is no untagged transaction
1816	 * for this target or the transaction is for a different lun, then
1817	 * this must be a tagged transaction.
1818	 */
1819	shr	SINDEX, 4, SAVED_SCSIID;
1820	and	SAVED_LUN, MSG_IDENTIFY_LUNMASK, A;
1821	if ((ahc->flags & AHC_SCB_BTT) != 0) {
1822		add	SINDEX, SCB_64_BTT;
1823		mov	SCBPTR, SAVED_LUN;
1824		if ((ahc->flags & AHC_SEQUENCER_DEBUG) != 0) {
1825			add	NONE, -SCB_64_BTT, SINDEX;
1826			jc	. + 2;
1827			mvi	INTSTAT, OUT_OF_RANGE;
1828			nop;
1829			add	NONE, -(SCB_64_BTT + 16), SINDEX;
1830			jnc	. + 2;
1831			mvi	INTSTAT, OUT_OF_RANGE;
1832			nop;
1833		}
1834	} else {
1835		add	SINDEX, BUSY_TARGETS;
1836		if ((ahc->flags & AHC_SEQUENCER_DEBUG) != 0) {
1837			add	NONE, -BUSY_TARGETS, SINDEX;
1838			jc	. + 2;
1839			mvi	INTSTAT, OUT_OF_RANGE;
1840			nop;
1841			add	NONE, -(BUSY_TARGETS + 16), SINDEX;
1842			jnc	. + 2;
1843			mvi	INTSTAT, OUT_OF_RANGE;
1844			nop;
1845		}
1846	}
1847	mov	ARG_1, SINDIR;
1848	cmp	ARG_1, SCB_LIST_NULL	je snoop_tag;
1849	if ((ahc->flags & AHC_PAGESCBS) != 0) {
1850		mov	ARG_1 call findSCB;
1851	} else {
1852		mov	SCBPTR, ARG_1;
1853	}
1854	if ((ahc->flags & AHC_SCB_BTT) != 0) {
1855		jmp setup_SCB_id_lun_okay;
1856	} else {
1857		/*
1858		 * We only allow one untagged command per-target
1859		 * at a time.  So, if the lun doesn't match, look
1860		 * for a tag message.
1861		 */
1862		mov	A, SCB_LUN;
1863		cmp	SAVED_LUN, A	je setup_SCB_id_lun_okay;
1864		if ((ahc->flags & AHC_PAGESCBS) != 0) {
1865			/*
1866			 * findSCB removes the SCB from the
1867			 * disconnected list, so we must replace
1868			 * it there should this SCB be for another
1869			 * lun.
1870			 */
1871			call	cleanup_scb;
1872		}
1873	}
1874
1875/*
1876 * Here we "snoop" the bus looking for a SIMPLE QUEUE TAG message.
1877 * If we get one, we use the tag returned to find the proper
1878 * SCB.  With SCB paging, we must search for non-tagged
1879 * transactions since the SCB may exist in any slot.  If we're not
1880 * using SCB paging, we can use the tag as the direct index to the
1881 * SCB.
1882 */
1883snoop_tag:
1884	if ((ahc->flags & AHC_SEQUENCER_DEBUG) != 0) {
1885		or	SEQ_FLAGS, 0x80;
1886	}
1887	mov	NONE,SCSIDATL;		/* ACK Identify MSG */
1888	call	phase_lock;
1889	if ((ahc->flags & AHC_SEQUENCER_DEBUG) != 0) {
1890		or	SEQ_FLAGS, 0x1;
1891	}
1892	cmp	LASTPHASE, P_MESGIN	jne not_found;
1893	if ((ahc->flags & AHC_SEQUENCER_DEBUG) != 0) {
1894		or	SEQ_FLAGS, 0x2;
1895	}
1896	cmp	SCSIBUSL,MSG_SIMPLE_Q_TAG jne not_found;
1897get_tag:
1898	if ((ahc->flags & AHC_PAGESCBS) != 0) {
1899		mvi	ARG_1	call inb_next;	/* tag value */
1900		mov	ARG_1	call findSCB;
1901	} else {
1902		mvi	ARG_1	call inb_next;	/* tag value */
1903		mov	SCBPTR, ARG_1;
1904	}
1905
1906/*
1907 * Ensure that the SCB the tag points to is for
1908 * an SCB transaction to the reconnecting target.
1909 */
1910setup_SCB:
1911	if ((ahc->flags & AHC_SEQUENCER_DEBUG) != 0) {
1912		or	SEQ_FLAGS, 0x4;
1913	}
1914	mov	A, SCB_SCSIID;
1915	cmp	SAVED_SCSIID, A	jne not_found_cleanup_scb;
1916	if ((ahc->flags & AHC_SEQUENCER_DEBUG) != 0) {
1917		or	SEQ_FLAGS, 0x8;
1918	}
1919setup_SCB_id_okay:
1920	mov	A, SCB_LUN;
1921	cmp	SAVED_LUN, A	jne not_found_cleanup_scb;
1922setup_SCB_id_lun_okay:
1923	if ((ahc->flags & AHC_SEQUENCER_DEBUG) != 0) {
1924		or	SEQ_FLAGS, 0x10;
1925	}
1926	test	SCB_CONTROL,DISCONNECTED jz not_found_cleanup_scb;
1927	and	SCB_CONTROL,~DISCONNECTED;
1928	test	SCB_CONTROL, TAG_ENB	jnz setup_SCB_tagged;
1929	if ((ahc->flags & AHC_SCB_BTT) != 0) {
1930		mov	A, SCBPTR;
1931	}
1932	mvi	ARG_1, SCB_LIST_NULL;
1933	mov	SAVED_SCSIID	call	set_busy_target;
1934	if ((ahc->flags & AHC_SCB_BTT) != 0) {
1935		mov	SCBPTR, A;
1936	}
1937setup_SCB_tagged:
1938	clr	SEQ_FLAGS;	/* make note of IDENTIFY */
1939	call	set_transfer_settings;
1940	/* See if the host wants to send a message upon reconnection */
1941	test	SCB_CONTROL, MK_MESSAGE jz mesgin_done;
1942	mvi	HOST_MSG	call mk_mesg;
1943	jmp	mesgin_done;
1944
1945not_found_cleanup_scb:
1946	if ((ahc->flags & AHC_PAGESCBS) != 0) {
1947		call	cleanup_scb;
1948	}
1949not_found:
1950	mvi	NO_MATCH call set_seqint;
1951	jmp	mesgin_done;
1952
1953mk_mesg:
1954	if ((ahc->features & AHC_DT) == 0) {
1955		or	SCSISIGO, ATNO, LASTPHASE;
1956	} else {
1957		mvi	SCSISIGO, ATNO;
1958	}
1959	mov	MSG_OUT,SINDEX ret;
1960
1961/*
1962 * Functions to read data in Automatic PIO mode.
1963 *
1964 * According to Adaptec's documentation, an ACK is not sent on input from
1965 * the target until SCSIDATL is read from.  So we wait until SCSIDATL is
1966 * latched (the usual way), then read the data byte directly off the bus
1967 * using SCSIBUSL.  When we have pulled the ATN line, or we just want to
1968 * acknowledge the byte, then we do a dummy read from SCISDATL.  The SCSI
1969 * spec guarantees that the target will hold the data byte on the bus until
1970 * we send our ACK.
1971 *
1972 * The assumption here is that these are called in a particular sequence,
1973 * and that REQ is already set when inb_first is called.  inb_{first,next}
1974 * use the same calling convention as inb.
1975 */
1976inb_next_wait_perr:
1977	mvi	PERR_DETECTED call set_seqint;
1978	jmp	inb_next_wait;
1979inb_next:
1980	mov	NONE,SCSIDATL;		/*dummy read from latch to ACK*/
1981inb_next_wait:
1982	/*
1983	 * If there is a parity error, wait for the kernel to
1984	 * see the interrupt and prepare our message response
1985	 * before continuing.
1986	 */
1987	test	SSTAT1, REQINIT	jz inb_next_wait;
1988	test	SSTAT1, SCSIPERR jnz inb_next_wait_perr;
1989inb_next_check_phase:
1990	and	LASTPHASE, PHASE_MASK, SCSISIGI;
1991	cmp	LASTPHASE, P_MESGIN jne mesgin_phasemis;
1992inb_first:
1993	mov	DINDEX,SINDEX;
1994	mov	DINDIR,SCSIBUSL	ret;		/*read byte directly from bus*/
1995inb_last:
1996	mov	NONE,SCSIDATL ret;		/*dummy read from latch to ACK*/
1997}
1998
1999if ((ahc->flags & AHC_TARGETROLE) != 0) {
2000/*
2001 * Change to a new phase.  If we are changing the state of the I/O signal,
2002 * from out to in, wait an additional data release delay before continuing.
2003 */
2004change_phase:
2005	/* Wait for preceding I/O session to complete. */
2006	test	SCSISIGI, ACKI jnz .;
2007
2008	/* Change the phase */
2009	and	DINDEX, IOI, SCSISIGI;
2010	mov	SCSISIGO, SINDEX;
2011	and	A, IOI, SINDEX;
2012
2013	/*
2014	 * If the data direction has changed, from
2015	 * out (initiator driving) to in (target driving),
2016	 * we must wait at least a data release delay plus
2017	 * the normal bus settle delay. [SCSI III SPI 10.11.0]
2018	 */
2019	cmp 	DINDEX, A je change_phase_wait;
2020	test	SINDEX, IOI jz change_phase_wait;
2021	call	change_phase_wait;
2022change_phase_wait:
2023	nop;
2024	nop;
2025	nop;
2026	nop ret;
2027
2028/*
2029 * Send a byte to an initiator in Automatic PIO mode.
2030 */
2031target_outb:
2032	or	SXFRCTL0, SPIOEN;
2033	test	SSTAT0, SPIORDY	jz .;
2034	mov	SCSIDATL, SINDEX;
2035	test	SSTAT0, SPIORDY	jz .;
2036	and	SXFRCTL0, ~SPIOEN ret;
2037}
2038
2039/*
2040 * Locate a disconnected SCB by SCBID.  Upon return, SCBPTR and SINDEX will
2041 * be set to the position of the SCB.  If the SCB cannot be found locally,
2042 * it will be paged in from host memory.  RETURN_2 stores the address of the
2043 * preceding SCB in the disconnected list which can be used to speed up
2044 * removal of the found SCB from the disconnected list.
2045 */
2046if ((ahc->flags & AHC_PAGESCBS) != 0) {
2047BEGIN_CRITICAL;
2048findSCB:
2049	mov	A, SINDEX;			/* Tag passed in SINDEX */
2050	cmp	DISCONNECTED_SCBH, SCB_LIST_NULL je findSCB_notFound;
2051	mov	SCBPTR, DISCONNECTED_SCBH;	/* Initialize SCBPTR */
2052	mvi	ARG_2, SCB_LIST_NULL;		/* Head of list */
2053	jmp	findSCB_loop;
2054findSCB_next:
2055	cmp	SCB_NEXT, SCB_LIST_NULL je findSCB_notFound;
2056	mov	ARG_2, SCBPTR;
2057	mov	SCBPTR,SCB_NEXT;
2058findSCB_loop:
2059	cmp	SCB_TAG, A	jne findSCB_next;
2060rem_scb_from_disc_list:
2061	cmp	ARG_2, SCB_LIST_NULL	je rHead;
2062	mov	DINDEX, SCB_NEXT;
2063	mov	SINDEX, SCBPTR;
2064	mov	SCBPTR, ARG_2;
2065	mov	SCB_NEXT, DINDEX;
2066	mov	SCBPTR, SINDEX ret;
2067rHead:
2068	mov	DISCONNECTED_SCBH,SCB_NEXT ret;
2069END_CRITICAL;
2070findSCB_notFound:
2071	/*
2072	 * We didn't find it.  Page in the SCB.
2073	 */
2074	mov	ARG_1, A; /* Save tag */
2075	mov	ALLZEROS call get_free_or_disc_scb;
2076	mvi	DMAPARAMS, HDMAEN|DIRECTION|FIFORESET;
2077	mov	ARG_1	jmp dma_scb;
2078}
2079
2080/*
2081 * Prepare the hardware to post a byte to host memory given an
2082 * index of (A + (256 * SINDEX)) and a base address of SHARED_DATA_ADDR.
2083 */
2084post_byte_setup:
2085	mov	ARG_2, SINDEX;
2086	if ((ahc->features & AHC_CMD_CHAN) != 0) {
2087		mvi	DINDEX, CCHADDR;
2088		mvi	SHARED_DATA_ADDR call	set_1byte_addr;
2089		mvi	CCHCNT, 1;
2090		mvi	CCSCBCTL, CCSCBRESET ret;
2091	} else {
2092		mvi	DINDEX, HADDR;
2093		mvi	SHARED_DATA_ADDR call	set_1byte_addr;
2094		mvi	1	call set_hcnt;
2095		mvi	DFCNTRL, FIFORESET ret;
2096	}
2097
2098post_byte:
2099	if ((ahc->features & AHC_CMD_CHAN) != 0) {
2100		bmov	CCSCBRAM, SINDEX, 1;
2101		or	CCSCBCTL, CCSCBEN|CCSCBRESET;
2102		test	CCSCBCTL, CCSCBDONE jz .;
2103		clr	CCSCBCTL ret;
2104	} else {
2105		mov	DFDAT, SINDEX;
2106		or	DFCNTRL, HDMAEN|FIFOFLUSH;
2107		jmp	dma_finish;
2108	}
2109
2110phase_lock_perr:
2111	mvi	PERR_DETECTED call set_seqint;
2112phase_lock:
2113	/*
2114	 * If there is a parity error, wait for the kernel to
2115	 * see the interrupt and prepare our message response
2116	 * before continuing.
2117	 */
2118	test	SSTAT1, REQINIT jz phase_lock;
2119	test	SSTAT1, SCSIPERR jnz phase_lock_perr;
2120phase_lock_latch_phase:
2121	if ((ahc->features & AHC_DT) == 0) {
2122		and	SCSISIGO, PHASE_MASK, SCSISIGI;
2123	}
2124	and	LASTPHASE, PHASE_MASK, SCSISIGI ret;
2125
2126if ((ahc->features & AHC_CMD_CHAN) == 0) {
2127set_hcnt:
2128	mov	HCNT[0], SINDEX;
2129clear_hcnt:
2130	clr	HCNT[1];
2131	clr	HCNT[2] ret;
2132
2133set_stcnt_from_hcnt:
2134	mov	STCNT[0], HCNT[0];
2135	mov	STCNT[1], HCNT[1];
2136	mov	STCNT[2], HCNT[2] ret;
2137
2138bcopy_8:
2139	mov	DINDIR, SINDIR;
2140bcopy_7:
2141	mov	DINDIR, SINDIR;
2142	mov	DINDIR, SINDIR;
2143bcopy_5:
2144	mov	DINDIR, SINDIR;
2145bcopy_4:
2146	mov	DINDIR, SINDIR;
2147bcopy_3:
2148	mov	DINDIR, SINDIR;
2149	mov	DINDIR, SINDIR;
2150	mov	DINDIR, SINDIR ret;
2151}
2152
2153if ((ahc->flags & AHC_TARGETROLE) != 0) {
2154/*
2155 * Setup addr assuming that A is an index into
2156 * an array of 32byte objects, SINDEX contains
2157 * the base address of that array, and DINDEX
2158 * contains the base address of the location
2159 * to store the indexed address.
2160 */
2161set_32byte_addr:
2162	shr	ARG_2, 3, A;
2163	shl	A, 5;
2164	jmp	set_1byte_addr;
2165}
2166
2167/*
2168 * Setup addr assuming that A is an index into
2169 * an array of 64byte objects, SINDEX contains
2170 * the base address of that array, and DINDEX
2171 * contains the base address of the location
2172 * to store the indexed address.
2173 */
2174set_64byte_addr:
2175	shr	ARG_2, 2, A;
2176	shl	A, 6;
2177
2178/*
2179 * Setup addr assuming that A + (ARG_2 * 256) is an
2180 * index into an array of 1byte objects, SINDEX contains
2181 * the base address of that array, and DINDEX contains
2182 * the base address of the location to store the computed
2183 * address.
2184 */
2185set_1byte_addr:
2186	add     DINDIR, A, SINDIR;
2187	mov     A, ARG_2;
2188	adc	DINDIR, A, SINDIR;
2189	clr	A;
2190	adc	DINDIR, A, SINDIR;
2191	adc	DINDIR, A, SINDIR ret;
2192
2193/*
2194 * Either post or fetch an SCB from host memory based on the
2195 * DIRECTION bit in DMAPARAMS. The host SCB index is in SINDEX.
2196 */
2197dma_scb:
2198	mov	A, SINDEX;
2199	if ((ahc->features & AHC_CMD_CHAN) != 0) {
2200		mvi	DINDEX, CCHADDR;
2201		mvi	HSCB_ADDR call set_64byte_addr;
2202		mov	CCSCBPTR, SCBPTR;
2203		test	DMAPARAMS, DIRECTION jz dma_scb_tohost;
2204		if ((ahc->flags & AHC_SCB_BTT) != 0) {
2205			mvi	CCHCNT, SCB_DOWNLOAD_SIZE_64;
2206		} else {
2207			mvi	CCHCNT, SCB_DOWNLOAD_SIZE;
2208		}
2209		mvi	CCSCBCTL, CCARREN|CCSCBEN|CCSCBDIR|CCSCBRESET;
2210		cmp	CCSCBCTL, CCSCBDONE|ARRDONE|CCARREN|CCSCBEN|CCSCBDIR jne .;
2211		jmp	dma_scb_finish;
2212dma_scb_tohost:
2213		mvi	CCHCNT, SCB_UPLOAD_SIZE;
2214		if ((ahc->features & AHC_ULTRA2) == 0) {
2215			mvi	CCSCBCTL, CCSCBRESET;
2216			bmov	CCSCBRAM, SCB_BASE, SCB_UPLOAD_SIZE;
2217			or	CCSCBCTL, CCSCBEN|CCSCBRESET;
2218			test	CCSCBCTL, CCSCBDONE jz .;
2219		} else if ((ahc->bugs & AHC_SCBCHAN_UPLOAD_BUG) != 0) {
2220			mvi	CCSCBCTL, CCARREN|CCSCBRESET;
2221			cmp	CCSCBCTL, ARRDONE|CCARREN jne .;
2222			mvi	CCHCNT, SCB_UPLOAD_SIZE;
2223			mvi	CCSCBCTL, CCSCBEN|CCSCBRESET;
2224			cmp	CCSCBCTL, CCSCBDONE|CCSCBEN jne .;
2225		} else {
2226			mvi	CCSCBCTL, CCARREN|CCSCBEN|CCSCBRESET;
2227			cmp	CCSCBCTL, CCSCBDONE|ARRDONE|CCARREN|CCSCBEN jne .;
2228		}
2229dma_scb_finish:
2230		clr	CCSCBCTL;
2231		test	CCSCBCTL, CCARREN|CCSCBEN jnz .;
2232		ret;
2233	} else {
2234		mvi	DINDEX, HADDR;
2235		mvi	HSCB_ADDR call set_64byte_addr;
2236		mvi	SCB_DOWNLOAD_SIZE call set_hcnt;
2237		mov	DFCNTRL, DMAPARAMS;
2238		test	DMAPARAMS, DIRECTION	jnz dma_scb_fromhost;
2239		/* Fill it with the SCB data */
2240copy_scb_tofifo:
2241		mvi	SINDEX, SCB_BASE;
2242		add	A, SCB_DOWNLOAD_SIZE, SINDEX;
2243copy_scb_tofifo_loop:
2244		call	copy_to_fifo_8;
2245		cmp	SINDEX, A jne copy_scb_tofifo_loop;
2246		or	DFCNTRL, HDMAEN|FIFOFLUSH;
2247		jmp	dma_finish;
2248dma_scb_fromhost:
2249		mvi	DINDEX, SCB_BASE;
2250		if ((ahc->bugs & AHC_PCI_2_1_RETRY_BUG) != 0) {
2251			/*
2252			 * The PCI module will only issue a PCI
2253			 * retry if the data FIFO is empty.  If the
2254			 * host disconnects in the middle of a
2255			 * transfer, we must empty the fifo of all
2256			 * available data to force the chip to
2257			 * continue the transfer.  This does not
2258			 * happen for SCSI transfers as the SCSI module
2259			 * will drain the FIFO as data are made available.
2260			 * When the hang occurs, we know that a multiple
2261			 * of 8 bytes is in the FIFO because the PCI
2262			 * module has an 8 byte input latch that only
2263			 * dumps to the FIFO when HCNT == 0 or the
2264			 * latch is full.
2265			 */
2266			clr	A;
2267			/* Wait for at least 8 bytes of data to arrive. */
2268dma_scb_hang_fifo:
2269			test	DFSTATUS, FIFOQWDEMP jnz dma_scb_hang_fifo;
2270dma_scb_hang_wait:
2271			test	DFSTATUS, MREQPEND jnz dma_scb_hang_wait;
2272			test	DFSTATUS, HDONE	jnz dma_scb_hang_dma_done;
2273			test	DFSTATUS, HDONE	jnz dma_scb_hang_dma_done;
2274			test	DFSTATUS, HDONE	jnz dma_scb_hang_dma_done;
2275			/*
2276			 * The PCI module no longer intends to perform
2277			 * a PCI transaction.  Drain the fifo.
2278			 */
2279dma_scb_hang_dma_drain_fifo:
2280			not	A, HCNT;
2281			add	A, SCB_DOWNLOAD_SIZE+SCB_BASE+1;
2282			and	A, ~0x7;
2283			mov	DINDIR,DFDAT;
2284			cmp	DINDEX, A jne . - 1;
2285			cmp	DINDEX, SCB_DOWNLOAD_SIZE+SCB_BASE
2286				je	dma_finish_nowait;
2287			/* Restore A as the lines left to transfer. */
2288			add	A, -SCB_BASE, DINDEX;
2289			shr	A, 3;
2290			jmp	dma_scb_hang_fifo;
2291dma_scb_hang_dma_done:
2292			and	DFCNTRL, ~HDMAEN;
2293			test	DFCNTRL, HDMAEN jnz .;
2294			add	SEQADDR0, A;
2295		} else {
2296			call	dma_finish;
2297		}
2298		call	dfdat_in_8;
2299		call	dfdat_in_8;
2300		call	dfdat_in_8;
2301dfdat_in_8:
2302		mov	DINDIR,DFDAT;
2303dfdat_in_7:
2304		mov	DINDIR,DFDAT;
2305		mov	DINDIR,DFDAT;
2306		mov	DINDIR,DFDAT;
2307		mov	DINDIR,DFDAT;
2308		mov	DINDIR,DFDAT;
2309dfdat_in_2:
2310		mov	DINDIR,DFDAT;
2311		mov	DINDIR,DFDAT ret;
2312	}
2313
2314copy_to_fifo_8:
2315	mov	DFDAT,SINDIR;
2316	mov	DFDAT,SINDIR;
2317copy_to_fifo_6:
2318	mov	DFDAT,SINDIR;
2319copy_to_fifo_5:
2320	mov	DFDAT,SINDIR;
2321copy_to_fifo_4:
2322	mov	DFDAT,SINDIR;
2323	mov	DFDAT,SINDIR;
2324	mov	DFDAT,SINDIR;
2325	mov	DFDAT,SINDIR ret;
2326
2327/*
2328 * Wait for DMA from host memory to data FIFO to complete, then disable
2329 * DMA and wait for it to acknowledge that it's off.
2330 */
2331dma_finish:
2332	test	DFSTATUS,HDONE	jz dma_finish;
2333dma_finish_nowait:
2334	/* Turn off DMA */
2335	and	DFCNTRL, ~HDMAEN;
2336	test	DFCNTRL, HDMAEN jnz .;
2337	ret;
2338
2339/*
2340 * Restore an SCB that failed to match an incoming reselection
2341 * to the correct/safe state.  If the SCB is for a disconnected
2342 * transaction, it must be returned to the disconnected list.
2343 * If it is not in the disconnected state, it must be free.
2344 */
2345cleanup_scb:
2346	if ((ahc->flags & AHC_PAGESCBS) != 0) {
2347		test	SCB_CONTROL,DISCONNECTED jnz add_scb_to_disc_list;
2348	}
2349add_scb_to_free_list:
2350	if ((ahc->flags & AHC_PAGESCBS) != 0) {
2351BEGIN_CRITICAL;
2352		mov	SCB_NEXT, FREE_SCBH;
2353		mvi	SCB_TAG, SCB_LIST_NULL;
2354		mov	FREE_SCBH, SCBPTR ret;
2355END_CRITICAL;
2356	} else {
2357		mvi	SCB_TAG, SCB_LIST_NULL ret;
2358	}
2359
2360if ((ahc->flags & AHC_39BIT_ADDRESSING) != 0) {
2361set_hhaddr:
2362	or	DSCOMMAND1, HADDLDSEL0;
2363	and	HADDR, SG_HIGH_ADDR_BITS, SINDEX;
2364	and	DSCOMMAND1, ~HADDLDSEL0 ret;
2365}
2366
2367if ((ahc->flags & AHC_PAGESCBS) != 0) {
2368get_free_or_disc_scb:
2369BEGIN_CRITICAL;
2370	cmp	FREE_SCBH, SCB_LIST_NULL jne dequeue_free_scb;
2371	cmp	DISCONNECTED_SCBH, SCB_LIST_NULL jne dequeue_disc_scb;
2372return_error:
2373	mvi	NO_FREE_SCB call set_seqint;
2374	mvi	SINDEX, SCB_LIST_NULL	ret;
2375dequeue_disc_scb:
2376	mov	SCBPTR, DISCONNECTED_SCBH;
2377	mov	DISCONNECTED_SCBH, SCB_NEXT;
2378END_CRITICAL;
2379	mvi	DMAPARAMS, FIFORESET;
2380	mov	SCB_TAG	jmp dma_scb;
2381BEGIN_CRITICAL;
2382dequeue_free_scb:
2383	mov	SCBPTR, FREE_SCBH;
2384	mov	FREE_SCBH, SCB_NEXT ret;
2385END_CRITICAL;
2386
2387add_scb_to_disc_list:
2388/*
2389 * Link this SCB into the DISCONNECTED list.  This list holds the
2390 * candidates for paging out an SCB if one is needed for a new command.
2391 * Modifying the disconnected list is a critical(pause dissabled) section.
2392 */
2393BEGIN_CRITICAL;
2394	mov	SCB_NEXT, DISCONNECTED_SCBH;
2395	mov	DISCONNECTED_SCBH, SCBPTR ret;
2396END_CRITICAL;
2397}
2398set_seqint:
2399	mov	INTSTAT, SINDEX;
2400	nop;
2401return:
2402	ret;
2403