aic7xxx.seq revision 6940
1# @(#)aic7xxx.seq 1.32 94/11/29 jda 2# 3# Adaptec 274x/284x/294x device driver for Linux and FreeBSD. 4# Copyright (c) 1994 The University of Calgary Department of Computer Science. 5# 6# This program is free software; you can redistribute it and/or modify 7# it under the terms of the GNU General Public License as published by 8# the Free Software Foundation; either version 2 of the License, or 9# (at your option) any later version. 10# 11# This program is distributed in the hope that it will be useful, 12# but WITHOUT ANY WARRANTY; without even the implied warranty of 13# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the 14# GNU General Public License for more details. 15# 16# You should have received a copy of the GNU General Public License 17# along with this program; if not, write to the Free Software 18# Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA. 19# 20 21# FreeBSD, Twin, Wide, 2 command per target support, tagged queuing and other 22# optimizations provided by Justin T. Gibbs (gibbs@FreeBSD.org) 23# 24# $Id: aic7xxx.seq,v 1.8 1995/02/22 01:37:52 gibbs Exp $ 25 26VERSION AIC7XXX_SEQ_VERSION 1.8 27 28SCBMASK = 0x1f 29 30SCSISEQ = 0x00 31SXFRCTL0 = 0x01 32SXFRCTL1 = 0x02 33SCSISIGI = 0x03 34SCSISIGO = 0x03 35SCSIRATE = 0x04 36SCSIID = 0x05 37SCSIDATL = 0x06 38STCNT = 0x08 39STCNT+0 = 0x08 40STCNT+1 = 0x09 41STCNT+2 = 0x0a 42SSTAT0 = 0x0b 43CLRSINT1 = 0x0c 44SSTAT1 = 0x0c 45SIMODE1 = 0x11 46SCSIBUSL = 0x12 47SHADDR = 0x14 48SELID = 0x19 49SBLKCTL = 0x1f 50SEQCTL = 0x60 51A = 0x64 # == ACCUM 52SINDEX = 0x65 53DINDEX = 0x66 54ALLZEROS = 0x6a 55NONE = 0x6a 56SINDIR = 0x6c 57DINDIR = 0x6d 58FUNCTION1 = 0x6e 59HADDR = 0x88 60HCNT = 0x8c 61HCNT+0 = 0x8c 62HCNT+1 = 0x8d 63HCNT+2 = 0x8e 64SCBPTR = 0x90 65INTSTAT = 0x91 66DFCNTRL = 0x93 67DFSTATUS = 0x94 68DFDAT = 0x99 69QINFIFO = 0x9b 70QINCNT = 0x9c 71QOUTFIFO = 0x9d 72 73SCSICONF_A = 0x5a 74SCSICONF_B = 0x5b 75 76# The two reserved bytes at SCBARRAY+1[23] are expected to be set to 77# zero, and the reserved bit in SCBARRAY+0 is used as an internal flag 78# to indicate whether or not to reload scatter-gather parameters after 79# a disconnect. We also use bits 6 & 7 to indicate whether or not to 80# initiate SDTR or WDTR repectively when starting this command. 81# 82SCBARRAY+0 = 0xa0 83 84DISCONNECTED = 0x04 85NEEDDMA = 0x08 86SG_LOAD = 0x10 87TAG_ENB = 0x20 88NEEDSDTR = 0x40 89NEEDWDTR = 0x80 90 91SCBARRAY+1 = 0xa1 92SCBARRAY+2 = 0xa2 93SCBARRAY+3 = 0xa3 94SCBARRAY+4 = 0xa4 95SCBARRAY+5 = 0xa5 96SCBARRAY+6 = 0xa6 97SCBARRAY+7 = 0xa7 98SCBARRAY+8 = 0xa8 99SCBARRAY+9 = 0xa9 100SCBARRAY+10 = 0xaa 101SCBARRAY+11 = 0xab 102SCBARRAY+12 = 0xac 103SCBARRAY+13 = 0xad 104SCBARRAY+14 = 0xae 105SCBARRAY+15 = 0xaf 106SCBARRAY+16 = 0xb0 107SCBARRAY+17 = 0xb1 108SCBARRAY+18 = 0xb2 109SCBARRAY+19 = 0xb3 110SCBARRAY+20 = 0xb4 111SCBARRAY+21 = 0xb5 112SCBARRAY+22 = 0xb6 113SCBARRAY+23 = 0xb7 114SCBARRAY+24 = 0xb8 115SCBARRAY+25 = 0xb9 116SCBARRAY+26 = 0xba 117 118BAD_PHASE = 0x01 # unknown scsi bus phase 119SEND_REJECT = 0x11 # sending a message reject 120NO_IDENT = 0x21 # no IDENTIFY after reconnect 121NO_MATCH = 0x31 # no cmd match for reconnect 122MSG_SDTR = 0x41 # SDTR message recieved 123MSG_WDTR = 0x51 # WDTR message recieved 124MSG_REJECT = 0x61 # Reject message recieved 125BAD_STATUS = 0x71 # Bad status from target 126 127# The host adapter card (at least the BIOS) uses 20-2f for SCSI 128# device information, 32-33 and 5a-5f as well. As it turns out, the 129# BIOS trashes 20-2f, writing the synchronous negotiation results 130# on top of the BIOS values, so we re-use those for our per-target 131# scratchspace (actually a value that can be copied directly into 132# SCSIRATE). The kernel driver will enable synchronous negotiation 133# for all targets that have a value other than 0 in the lower four 134# bits of the target scratch space. This should work irregardless of 135# whether the bios has been installed. NEEDWDTR and NEEDSDTR are the top 136# two bits of the SCB control byte. The kernel driver will set these 137# when a WDTR or SDTR message should be sent to the target the SCB's 138# command references. 139# 140# The high bit of DROPATN is set if ATN should be dropped before the ACK 141# when outb is called. REJBYTE contains the first byte of a MESSAGE IN 142# message, so the driver can report an intelligible error if a message is 143# rejected. 144# 145# FLAGS's high bit is true if we are currently handling a reselect; 146# its next-highest bit is true ONLY IF we've seen an IDENTIFY message 147# from the reselecting target. If we haven't had IDENTIFY, then we have 148# no idea what the lun is, and we can't select the right SCB register 149# bank, so force a kernel panic if the target attempts a data in/out or 150# command phase instead of corrupting something. 151# 152# Note that SG_NEXT occupies four bytes. 153# 154SYNCNEG = 0x20 155 156DROPATN = 0x30 157REJBYTE = 0x31 158DISC_DSB_A = 0x32 159DISC_DSB_B = 0x33 160 161MSG_LEN = 0x34 162MSG_START+0 = 0x35 163MSG_START+1 = 0x36 164MSG_START+2 = 0x37 165MSG_START+3 = 0x38 166MSG_START+4 = 0x39 167MSG_START+5 = 0x3a 168-MSG_START+0 = 0xcb # 2's complement of MSG_START+0 169 170ARG_1 = 0x4a # sdtr conversion args & return 171BUS_16_BIT = 0x01 172RETURN_1 = 0x4a 173 174SIGSTATE = 0x4b # value written to SCSISIGO 175 176# Linux users should use 0xc (12) for SG_SIZEOF 177SG_SIZEOF = 0x8 # sizeof(struct ahc_dma) 178#SG_SIZEOF = 0xc # sizeof(struct scatterlist) 179SCB_SIZEOF = 0x13 # sizeof SCB to DMA (19 bytes) 180 181SG_NOLOAD = 0x4c # load SG pointer/length? 182SG_COUNT = 0x4d # working value of SG count 183SG_NEXT = 0x4e # working value of SG pointer 184SG_NEXT+0 = 0x4e 185SG_NEXT+1 = 0x4f 186SG_NEXT+2 = 0x50 187SG_NEXT+3 = 0x51 188 189SCBCOUNT = 0x52 # the actual number of SCBs 190FLAGS = 0x53 # Device configuration flags 191TWIN_BUS = 0x01 192WIDE_BUS = 0x02 193SENSE = 0x10 194ACTIVE_MSG = 0x20 195IDENTIFY_SEEN = 0x40 196RESELECTED = 0x80 197 198ACTIVE_A = 0x54 199ACTIVE_B = 0x55 200SAVED_TCL = 0x56 201# Poll QINCNT for work - the lower bits contain 202# the number of entries in the Queue In FIFO. 203# 204start: 205 test FLAGS,SENSE jnz start_sense 206start_nosense: 207 test FLAGS,TWIN_BUS jz start2 # Are we a twin channel device? 208# For fairness, we check the other bus first, since we just finished a 209# transaction on the current channel. 210 xor SBLKCTL,0x08 # Toggle to the other bus 211 test SCSISIGI,0x4 jnz reselect # BSYI 212 xor SBLKCTL,0x08 # Toggle to the original bus 213start2: 214 test SCSISIGI,0x4 jnz reselect # BSYI 215 test QINCNT,SCBMASK jz start_nosense 216 217# We have at least one queued SCB now. Set the SCB pointer 218# from the FIFO so we see the right bank of SCB registers, 219# then set SCSI options and set the initiator and target 220# SCSI IDs. 221# 222 mov SCBPTR,QINFIFO 223 224# If the control byte of this SCB has the NEEDDMA flag set, we have 225# yet to DMA it from host memory 226 227test SCBARRAY+0,NEEDDMA jz test_busy 228 clr HCNT+2 229 clr HCNT+1 230 mvi HCNT+0,SCB_SIZEOF 231 232 mvi DINDEX,HADDR 233 mvi SCBARRAY+26 call bcopy_4 234 235 mvi DFCNTRL,0xd # HDMAEN|DIRECTION|FIFORESET 236 237# Wait for DMA from host memory to data FIFO to complete, then disable 238# DMA and wait for it to acknowledge that it's off. 239# 240scb_load1: 241 test DFSTATUS,0x8 jz scb_load1 # HDONE 242 243 clr DFCNTRL # disable DMA 244scb_load2: 245 test DFCNTRL,0x8 jnz scb_load2 # HDMAENACK 246 247# Copy the SCB from the FIFO to the SCBARRAY 248 249 mov SCBARRAY+0, DFDAT 250 mov SCBARRAY+1, DFDAT 251 mov SCBARRAY+2, DFDAT 252 mov SCBARRAY+3, DFDAT 253 mov SCBARRAY+4, DFDAT 254 mov SCBARRAY+5, DFDAT 255 mov SCBARRAY+6, DFDAT 256 mov SCBARRAY+7, DFDAT 257 mov SCBARRAY+8, DFDAT 258 mov SCBARRAY+9, DFDAT 259 mov SCBARRAY+10, DFDAT 260 mov SCBARRAY+11, DFDAT 261 mov SCBARRAY+12, DFDAT 262 mov SCBARRAY+13, DFDAT 263 mov SCBARRAY+14, DFDAT 264 mov SCBARRAY+15, DFDAT 265 mov SCBARRAY+16, DFDAT 266 mov SCBARRAY+17, DFDAT 267 mov SCBARRAY+18, DFDAT 268 269# See if there is not already an active SCB for this target. This code 270# locks out on a per target basis instead of target/lun. Although this 271# is not ideal for devices that have multiple luns active at the same 272# time, it is faster than looping through all SCB's looking for active 273# commands. It may be benificial to make findscb a more general procedure 274# to see if the added cost of the search is negligible. This code also 275# assumes that the kernel driver will clear the active flags on board 276# initialization, board reset, and a target's SELTO. 277 278test_busy: 279 test SCBARRAY+0,0x20 jnz start_scb 280 and FUNCTION1,0x70,SCBARRAY+1 281 mov A,FUNCTION1 282 test SCBARRAY+1,0x88 jz test_a # Id < 8 && A channel 283 284 test ACTIVE_B,A jnz requeue 285 or ACTIVE_B,A # Mark the current target as busy 286 jmp start_scb 287 288start_sense: 289# Clear the SENSE flag first, then do a normal start_scb 290 and FLAGS,0xef 291 jmp start_scb 292 293# Place the currently active back on the queue for later processing 294requeue: 295 mov QINFIFO, SCBPTR 296 jmp start_nosense 297 298test_a: 299 test ACTIVE_A,A jnz requeue 300 or ACTIVE_A,A # Mark the current target as busy 301 302start_scb: 303 or SCBARRAY+0,NEEDDMA 304 and SINDEX,0xf7,SBLKCTL #Clear the channel select bit 305 and A,0x08,SCBARRAY+1 #Get new channel bit 306 or SINDEX,A 307 mov SBLKCTL,SINDEX # select channel 308 mov SCBARRAY+1 call initialize 309 clr SG_NOLOAD 310 and FLAGS,0x3f # !RESELECTING 311 312# As soon as we get a successful selection, the target should go 313# into the message out phase since we have ATN asserted. Prepare 314# the message to send, locking out the device driver. If the device 315# driver hasn't beaten us with an ABORT or RESET message, then tack 316# on an SDTR negotiation if required. 317# 318# Messages are stored in scratch RAM starting with a flag byte (high bit 319# set means active message), one length byte, and then the message itself. 320# 321 mov SCBARRAY+1 call disconnect # disconnect ok? 322 323 and SINDEX,0x7,SCBARRAY+1 # lun 324 or SINDEX,A # return value from disconnect 325 or SINDEX,0x80 call mk_mesg # IDENTIFY message 326 327 mov A,SINDEX 328 test SCBARRAY+0,0xe0 jz !message # WDTR, SDTR or TAG?? 329 cmp MSG_START+0,A jne !message # did driver beat us? 330 331# Tag Message if Tag enabled in SCB control block. Use SCBPTR as the tag 332# value 333 334mk_tag: 335 mvi DINDEX, MSG_START+1 336 test SCBARRAY+0,TAG_ENB jz mk_tag_done 337 and A,0x23,SCBARRAY+0 338 mov DINDIR,A 339 mov DINDIR,SCBPTR 340 341 add MSG_LEN,-MSG_START+0,DINDEX # update message length 342 jmp !message # Can't do DTR when taged 343 344mk_tag_done: 345 346 mov DINDEX call mk_dtr # build DTR message if needed 347 348!message: 349 350# Enable selection phase as an initiator, and do automatic ATN 351# after the selection. 352# 353 mvi SCSISEQ,0x48 # ENSELO|ENAUTOATNO 354 355# Wait for successful arbitration. The AIC-7770 documentation says 356# that SELINGO indicates successful arbitration, and that it should 357# be used to look for SELDO. However, if the sequencer is paused at 358# just the right time - a parallel fsck(8) on two drives did it for 359# me - then SELINGO can flip back to false before we've seen it. This 360# makes the sequencer sit in the arbitration loop forever. This is 361# Not Good. 362# 363# Therefore, I've added a check in the arbitration loop for SELDO 364# too. This could arguably be made a critical section by disabling 365# pauses, but I don't want to make a potentially infinite loop a CS. 366# I suppose you could fold it into the select loop, too, but since 367# I've been hunting this bug for four days it's kinda like a trophy. 368# 369arbitrate: 370 test SSTAT0,0x40 jnz *select # SELDO 371 test SSTAT0,0x10 jz arbitrate # SELINGO 372 373# Wait for a successful selection. If the hardware selection 374# timer goes off, then the driver gets the interrupt, so we don't 375# need to worry about it. 376# 377select: 378 test SSTAT0,0x40 jz select # SELDO 379 jmp *select 380 381# Reselection is being initiated by a target - we've seen the BSY 382# line driven active, and we didn't do it! Enable the reselection 383# hardware, and wait for it to finish. Make a note that we've been 384# reselected, but haven't seen an IDENTIFY message from the target 385# yet. 386# 387reselect: 388 mvi SCSISEQ,0x10 # ENRSELI 389 390reselect1: 391 test SSTAT0,0x20 jz reselect1 # SELDI 392 mov SELID call initialize 393 394 and FLAGS,0x3f # reselected, no IDENTIFY 395 or FLAGS,RESELECTED 396 397# After the [re]selection, make sure that the [re]selection enable 398# bit is off. This chip is flaky enough without extra things 399# turned on. Also clear the BUSFREE bit in SSTAT1 since we'll be 400# using it shortly. 401# 402*select: 403 clr SCSISEQ 404 mvi CLRSINT1,0x8 # CLRBUSFREE 405 406# Main loop for information transfer phases. If BSY is false, then 407# we have a bus free condition, expected or not. Otherwise, wait 408# for the target to assert REQ before checking MSG, C/D and I/O 409# for the bus phase. 410# 411# We can't simply look at the values of SCSISIGI here (if we want 412# to do synchronous data transfer), because the target won't assert 413# REQ if it's already sent us some data that we haven't acknowledged 414# yet. 415# 416ITloop: 417 test SSTAT1,0x8 jnz p_busfree # BUSFREE 418 test SSTAT1,0x1 jz ITloop # REQINIT 419 420 and A,0xe0,SCSISIGI # CDI|IOI|MSGI 421 422 cmp ALLZEROS,A je p_dataout 423 cmp A,0x40 je p_datain 424 cmp A,0x80 je p_command 425 cmp A,0xc0 je p_status 426 cmp A,0xa0 je p_mesgout 427 cmp A,0xe0 je p_mesgin 428 429 mvi INTSTAT,BAD_PHASE # unknown - signal driver 430 431p_dataout: 432 mvi 0 call scsisig # !CDO|!IOO|!MSGO 433 call assert 434 call sg_load 435 436 mvi DINDEX,HADDR 437 mvi SCBARRAY+19 call bcopy_4 438 439# mvi DINDEX,HCNT # implicit since HCNT is next to HADDR 440 mvi SCBARRAY+23 call bcopy_3 441 442 mvi DINDEX,STCNT 443 mvi SCBARRAY+23 call bcopy_3 444 445 mvi 0x3d call dma # SCSIEN|SDMAEN|HDMAEN| 446 # DIRECTION|FIFORESET 447 448# After a DMA finishes, save the final transfer pointer and count 449# back into the SCB, in case a device disconnects in the middle of 450# a transfer. Use SHADDR and STCNT instead of HADDR and HCNT, since 451# it's a reflection of how many bytes were transferred on the SCSI 452# (as opposed to the host) bus. 453# 454 mvi DINDEX,SCBARRAY+23 455 mvi STCNT call bcopy_3 456 457 mvi DINDEX,SCBARRAY+19 458 mvi SHADDR call bcopy_4 459 460 call sg_advance 461 mov SCBARRAY+18,SG_COUNT # residual S/G count 462 463 jmp ITloop 464 465p_datain: 466 mvi 0x40 call scsisig # !CDO|IOO|!MSGO 467 call assert 468 call sg_load 469 470 mvi DINDEX,HADDR 471 mvi SCBARRAY+19 call bcopy_4 472 473# mvi DINDEX,HCNT # implicit since HCNT is next to HADDR 474 mvi SCBARRAY+23 call bcopy_3 475 476 mvi DINDEX,STCNT 477 mvi SCBARRAY+23 call bcopy_3 478 479 mvi 0x39 call dma # SCSIEN|SDMAEN|HDMAEN| 480 # !DIRECTION|FIFORESET 481 mvi DINDEX,SCBARRAY+23 482 mvi STCNT call bcopy_3 483 484 mvi DINDEX,SCBARRAY+19 485 mvi SHADDR call bcopy_4 486 487 call sg_advance 488 mov SCBARRAY+18,SG_COUNT # residual S/G count 489 490 jmp ITloop 491 492# Command phase. Set up the DMA registers and let 'er rip - the 493# two bytes after the SCB SCSI_cmd_length are zeroed by the driver, 494# so we can copy those three bytes directly into HCNT. 495# 496p_command: 497 mvi 0x80 call scsisig # CDO|!IOO|!MSGO 498 call assert 499 500 mvi DINDEX,HADDR 501 mvi SCBARRAY+7 call bcopy_4 502 503# mvi DINDEX,HCNT # implicit since HCNT is next to HADDR 504 mvi SCBARRAY+11 call bcopy_3 505 506 mvi DINDEX,STCNT 507 mvi SCBARRAY+11 call bcopy_3 508 509 mvi 0x3d call dma # SCSIEN|SDMAEN|HDMAEN| 510 # DIRECTION|FIFORESET 511 jmp ITloop 512 513# Status phase. Wait for the data byte to appear, then read it 514# and store it into the SCB. 515# 516p_status: 517 mvi 0xc0 call scsisig # CDO|IOO|!MSGO 518 519 mvi SCBARRAY+14 call inb 520 jmp ITloop 521 522# Message out phase. If there is no active message, but the target 523# took us into this phase anyway, build a no-op message and send it. 524# 525p_mesgout: 526 mvi 0xa0 call scsisig # CDO|!IOO|MSGO 527 mvi 0x8 call mk_mesg # build NOP message 528 529# Set up automatic PIO transfer from MSG_START. Bit 3 in 530# SXFRCTL0 (SPIOEN) is already on. 531# 532 mvi SINDEX,MSG_START+0 533 mov DINDEX,MSG_LEN 534 clr A 535 536# When target asks for a byte, drop ATN if it's the last one in 537# the message. Otherwise, keep going until the message is exhausted. 538# (We can't use outb for this since it wants the input in SINDEX.) 539# 540# Keep an eye out for a phase change, in case the target issues 541# a MESSAGE REJECT. 542# 543p_mesgout2: 544 test SSTAT0,0x2 jz p_mesgout2 # SPIORDY 545 test SSTAT1,0x10 jnz p_mesgout6 # PHASEMIS 546 547 cmp DINDEX,1 jne p_mesgout3 # last byte? 548 mvi CLRSINT1,0x40 # CLRATNO - drop ATN 549 550# Write a byte to the SCSI bus. The AIC-7770 refuses to automatically 551# send ACKs in automatic PIO or DMA mode unless you make sure that the 552# "expected" bus phase in SCSISIGO matches the actual bus phase. This 553# behaviour is completely undocumented and caused me several days of 554# grief. 555# 556# After plugging in different drives to test with and using a longer 557# SCSI cable, I found that I/O in Automatic PIO mode ceased to function, 558# especially when transferring >1 byte. It seems to be much more stable 559# if STCNT is set to one before the transfer, and SDONE (in SSTAT0) is 560# polled for transfer completion - for both output _and_ input. The 561# only theory I have is that SPIORDY doesn't drop right away when SCSIDATL 562# is accessed (like the documentation says it does), and that on a longer 563# cable run, the sequencer code was fast enough to loop back and see 564# an SPIORDY that hadn't dropped yet. 565# 566p_mesgout3: 567 call one_stcnt 568 mov SCSIDATL,SINDIR 569 570p_mesgout4: 571 test SSTAT0,0x4 jz p_mesgout4 # SDONE 572 dec DINDEX 573 inc A 574 cmp MSG_LEN,A jne p_mesgout2 575 576# If the next bus phase after ATN drops is a message out, it means 577# that the target is requesting that the last message(s) be resent. 578# 579p_mesgout5: 580 test SSTAT1,0x8 jnz p_mesgout6 # BUSFREE 581 test SSTAT1,0x1 jz p_mesgout5 # REQINIT 582 583 and A,0xe0,SCSISIGI # CDI|IOI|MSGI 584 cmp A,0xa0 jne p_mesgout6 585 mvi 0x10 call scsisig # ATNO - re-assert ATN 586 587 jmp ITloop 588 589p_mesgout6: 590 mvi CLRSINT1,0x40 # CLRATNO - in case of PHASEMIS 591 and FLAGS,0xdf # no active msg 592 jmp ITloop 593 594# Message in phase. Bytes are read using Automatic PIO mode, but not 595# using inb. This alleviates a race condition, namely that if ATN had 596# to be asserted under Automatic PIO mode, it had to beat the SCSI 597# circuitry sending an ACK to the target. This showed up under heavy 598# loads and really confused things, since ABORT commands wouldn't be 599# seen by the drive after an IDENTIFY message in until it had changed 600# to a data I/O phase. 601# 602p_mesgin: 603 mvi 0xe0 call scsisig # CDO|IOO|MSGO 604 mvi A call inb_first # read the 1st message byte 605 mvi REJBYTE,A # save it for the driver 606 607 cmp ALLZEROS,A jne p_mesgin1 608 609# We got a "command complete" message, so put the SCB pointer 610# into the Queue Out, and trigger a completion interrupt. 611# Check status for non zero return and interrupt driver if needed 612# This allows the driver to interpret errors only when they occur 613# instead of always uploading the scb. If the status is SCSI_CHECK, 614# the driver will download a new scb requesting sense, to replace 615# the old one and the sequencer code will imediately jump to start 616# working on it. If the kernel driver does not wish to request sense, 617# the sequencer program counter is incremented by 1, preventing another run 618# on the current SCB and the command is allowed to complete. We don't 619# bother to post to the QOUTFIFO in the error case since it would require 620# extra work in the kernel driver to ensure that the entry was removed 621# before the command complete code tried processing it. 622 623 test SCBARRAY+14,0xff jz status_ok # 0 Status? 624 mvi INTSTAT,BAD_STATUS # let driver know 625 test FLAGS,SENSE jz status_ok 626 jmp p_mesgin_done 627 628status_ok: 629 630# First, mark this target as free. 631 test SCBARRAY+0,0x20 jnz complete # Tagged command 632 and FUNCTION1,0x70,SCBARRAY+1 633 mov A,FUNCTION1 634 test SCBARRAY+1,0x88 jz clear_a 635 xor ACTIVE_B,A 636 jmp complete 637 638clear_a: 639 xor ACTIVE_A,A 640 641complete: 642 mov QOUTFIFO,SCBPTR 643 mvi INTSTAT,0x02 # CMDCMPLT 644 jmp p_mesgin_done 645 646# Is it an extended message? We only support the synchronous and wide data 647# transfer request messages, which will probably be in response to 648# WDTR or SDTR message outs from us. If it's not SDTR or WDTR, reject it - 649# apparently this can be done after any message in byte, according 650# to the SCSI-2 spec. 651# 652p_mesgin1: 653 cmp A,1 jne p_mesgin2 # extended message code? 654 655 mvi ARG_1 call inb_next # extended message length 656 mvi A call inb_next # extended message code 657 658 cmp A,1 je p_mesginSDTR # Syncronous negotiation message 659 cmp A,3 je p_mesginWDTR # Wide negotiation message 660 jmp p_mesginN 661 662p_mesginWDTR: 663 cmp ARG_1,2 jne p_mesginN # extended mesg length = 2 664 mvi A call inb_next # Width of bus 665 mvi INTSTAT,MSG_WDTR # let driver know 666 test RETURN_1,0x80 jz p_mesgin_done# Do we need to send WDTR? 667 668# We didn't initiate the wide negotiation, so we must respond to the request 669 and RETURN_1,0x7f # Clear the SEND_WDTR Flag 670 or FLAGS,ACTIVE_MSG 671 mvi DINDEX,MSG_START+0 672 mvi MSG_START+0 call mk_wdtr # build WDTR message 673 or SINDEX,0x10,SIGSTATE # turn on ATNO 674 call scsisig 675 jmp p_mesgin_done 676 677p_mesginSDTR: 678 cmp ARG_1,3 jne p_mesginN # extended mesg length = 3 679 mvi ARG_1 call inb_next # xfer period 680 mvi A call inb_next # REQ/ACK offset 681 mvi INTSTAT,MSG_SDTR # call driver to convert 682 683 test RETURN_1,0x80 jz p_mesgin_done# Do we need to mk_sdtr? 684 685 or FLAGS,ACTIVE_MSG 686 mvi DINDEX, MSG_START+0 687 mvi MSG_START+0 call mk_sdtr 688 or SINDEX,0x10,SIGSTATE # turn on ATNO 689 call scsisig 690 jmp p_mesgin_done 691 692# Is it a disconnect message? Set a flag in the SCB to remind us 693# and await the bus going free. 694# 695p_mesgin2: 696 cmp A,4 jne p_mesgin3 # disconnect code? 697 698 or SCBARRAY+0,0x4 # set "disconnected" bit 699 jmp p_mesgin_done 700 701# Save data pointers message? Copy working values into the SCB, 702# usually in preparation for a disconnect. 703# 704p_mesgin3: 705 cmp A,2 jne p_mesgin4 # save data pointers code? 706 707 call sg_ram2scb 708 jmp p_mesgin_done 709 710# Restore pointers message? Data pointers are recopied from the 711# SCB anyway at the start of any DMA operation, so the only thing 712# to copy is the scatter-gather values. 713# 714p_mesgin4: 715 cmp A,3 jne p_mesgin5 # restore pointers code? 716 717 call sg_scb2ram 718 jmp p_mesgin_done 719 720# Identify message? For a reconnecting target, this tells us the lun 721# that the reconnection is for - find the correct SCB and switch to it, 722# clearing the "disconnected" bit so we don't "find" it by accident later. 723# 724p_mesgin5: 725 test A,0x80 jz p_mesgin6 # identify message? 726 727 test A,0x78 jnz p_mesginN # !DiscPriv|!LUNTAR|!Reserved 728 729 and A,0x7 # lun in lower three bits 730 or SAVED_TCL,A,SELID 731 and SAVED_TCL,0xf7 732 and A,0x08,SBLKCTL # B Channel?? 733 or SAVED_TCL,A 734 call inb_last # Ack 735 736# Here we "snoop" the bus looking for a SIMPLE QUEUE TAG message. 737# If we get one, we use the tag returned to switch to the proper 738# SCB. Otherwise, we just use the findSCB method. 739p_mesgin5_loop: 740 test SSTAT1,0x8 jnz use_findSCB # BUSFREE 741 test SSTAT1,0x1 jz p_mesgin5_loop # REQINIT 742 and A,0xe0,SCSISIGI # CDI|IOI|MSGI 743 cmp A,0xe0 jne use_findSCB # Still p_mesgin? 744 mvi A call inb_first 745 cmp A,0x20 je get_tag # Simple Tag message? 746use_findSCB: 747 mov ALLZEROS call findSCB # Have to search 748 749# If a active message is present after calling findSCB, then either it 750# or the driver is trying to abort the command. Either way, something 751# untoward has happened and we should just leave it alone. 752# 753setup_SCB: 754 test FLAGS,ACTIVE_MSG jnz p_mesgin_done 755 756 and SCBARRAY+0,0xfb # clear disconnect bit in SCB 757 or FLAGS,0xc0 # make note of IDENTIFY 758 759 call sg_scb2ram # implied restore pointers 760 # required on reselect 761 jmp ITloop 762 763get_tag: 764 mvi A call inb_next 765 test A,0xf0 jnz abort_tag # Tag in range? 766 mov SCBPTR,A 767 mov A,SAVED_TCL 768 cmp SCBARRAY+1,A jne abort_tag 769 test SCBARRAY+0,TAG_ENB jz abort_tag 770 call inb_last 771 jmp setup_SCB 772 773# Message reject? Let the kernel driver handle this. If we have an 774# outstanding WDTR or SDTR negotiation, assume that it's a response from 775# the target selecting 8bit or asynchronous transfer, otherwise just ignore 776# it since we have no clue what it pertains to. 777# 778p_mesgin6: 779 cmp A,7 jne p_mesgin7 # message reject code? 780 781 mvi INTSTAT, MSG_REJECT 782 jmp p_mesgin_done 783 784# [ ADD MORE MESSAGE HANDLING HERE ] 785# 786p_mesgin7: 787 788# We have no idea what this message in is, and there's no way 789# to pass it up to the kernel, so we issue a message reject and 790# hope for the best. Since we're now using manual PIO mode to 791# read in the message, there should no longer be a race condition 792# present when we assert ATN. In any case, rejection should be a 793# rare occurrence - signal the driver when it happens. 794# 795p_mesginN: 796 or SINDEX,0x10,SIGSTATE # turn on ATNO 797 call scsisig 798 mvi INTSTAT,SEND_REJECT # let driver know 799 800 mvi 0x7 call mk_mesg # MESSAGE REJECT message 801 802p_mesgin_done: 803 call inb_last # ack & turn auto PIO back on 804 jmp ITloop 805 806abort_tag: 807 or SINDEX,0x10,SIGSTATE # turn on ATNO 808 call scsisig 809# mvi INTSTAT,ABORT_TAG # let driver know 810 mvi 0xd call mk_mesg # ABORT TAG message 811 jmp p_mesgin_done 812 813# Bus free phase. It might be useful to interrupt the device 814# driver if we aren't expecting this. For now, make sure that 815# ATN isn't being asserted and look for a new command. 816# 817p_busfree: 818 mvi CLRSINT1,0x40 # CLRATNO 819 clr SIGSTATE 820 jmp start 821 822# Instead of a generic bcopy routine that requires an argument, we unroll 823# the two cases that are actually used, and call them explicitly. This 824# not only reduces the overhead of doing a bcopy by 2/3rds, but ends up 825# saving space in the program since you don't have to put the argument 826# into the accumulator before the call. Both functions expect DINDEX to 827# contain the destination address and SINDEX to contain the source 828# address. 829bcopy_3: 830 mov DINDIR,SINDIR 831 mov DINDIR,SINDIR 832 mov DINDIR,SINDIR ret 833 834bcopy_4: 835 mov DINDIR,SINDIR 836 mov DINDIR,SINDIR 837 mov DINDIR,SINDIR 838 mov DINDIR,SINDIR ret 839 840 841# Locking the driver out, build a one-byte message passed in SINDEX 842# if there is no active message already. SINDEX is returned intact. 843# 844mk_mesg: 845 mvi SEQCTL,0x50 # PAUSEDIS|FASTMODE 846 test FLAGS,ACTIVE_MSG jnz mk_mesg1 # active message? 847 848 or FLAGS,ACTIVE_MSG # if not, there is now 849 mvi MSG_LEN,1 # length = 1 850 mov MSG_START+0,SINDEX # 1-byte message 851 852mk_mesg1: 853 mvi SEQCTL,0x10 ret # !PAUSEDIS|FASTMODE 854 855# Input byte in Automatic PIO mode. The address to store the byte 856# in should be in SINDEX. DINDEX will be used by this routine. 857# 858inb: 859 test SSTAT0,0x2 jz inb # SPIORDY 860 mov DINDEX,SINDEX 861 call one_stcnt # xfer one byte 862 mov DINDIR,SCSIDATL 863inb1: 864 test SSTAT0,0x4 jz inb1 # SDONE - wait to "finish" 865 ret 866 867# Carefully read data in Automatic PIO mode. I first tried this using 868# Manual PIO mode, but it gave me continual underrun errors, probably 869# indicating that I did something wrong, but I feel more secure leaving 870# Automatic PIO on all the time. 871# 872# According to Adaptec's documentation, an ACK is not sent on input from 873# the target until SCSIDATL is read from. So we wait until SCSIDATL is 874# latched (the usual way), then read the data byte directly off the bus 875# using SCSIBUSL. When we have pulled the ATN line, or we just want to 876# acknowledge the byte, then we do a dummy read from SCISDATL. The SCSI 877# spec guarantees that the target will hold the data byte on the bus until 878# we send our ACK. 879# 880# The assumption here is that these are called in a particular sequence, 881# and that REQ is already set when inb_first is called. inb_{first,next} 882# use the same calling convention as inb. 883# 884inb_first: 885 mov DINDEX,SINDEX 886 mov DINDIR,SCSIBUSL ret # read byte directly from bus 887 888inb_next: 889 mov DINDEX,SINDEX # save SINDEX 890 891 call one_stcnt # xfer one byte 892 mov NONE,SCSIDATL # dummy read from latch to ACK 893inb_next1: 894 test SSTAT0,0x4 jz inb_next1 # SDONE 895inb_next2: 896 test SSTAT0,0x2 jz inb_next2 # SPIORDY - wait for next byte 897 mov DINDIR,SCSIBUSL ret # read byte directly from bus 898 899inb_last: 900 call one_stcnt # ACK with dummy read 901 mov NONE,SCSIDATL 902inb_last1: 903 test SSTAT0,0x4 jz inb_last1 # wait for completion 904 ret 905 906# Output byte in Automatic PIO mode. The byte to output should be 907# in SINDEX. If DROPATN's high bit is set, then ATN will be dropped 908# before the byte is output. 909# 910outb: 911 test SSTAT0,0x2 jz outb # SPIORDY 912 call one_stcnt # xfer one byte 913 914 test DROPATN,0x80 jz outb1 915 mvi CLRSINT1,0x40 # CLRATNO 916 clr DROPATN 917outb1: 918 mov SCSIDATL,SINDEX 919outb2: 920 test SSTAT0,0x4 jz outb2 # SDONE 921 ret 922 923# Write the value "1" into the STCNT registers, for Automatic PIO 924# transfers. 925# 926one_stcnt: 927 clr STCNT+2 928 clr STCNT+1 929 mvi STCNT+0,1 ret 930 931# DMA data transfer. HADDR and HCNT must be loaded first, and 932# SINDEX should contain the value to load DFCNTRL with - 0x3d for 933# host->scsi, or 0x39 for scsi->host. The SCSI channel is cleared 934# during initialization. 935# 936dma: 937 mov DFCNTRL,SINDEX 938dma1: 939dma2: 940 test SSTAT0,0x1 jnz dma3 # DMADONE 941 test SSTAT1,0x10 jz dma1 # PHASEMIS, ie. underrun 942 943# We will be "done" DMAing when the transfer count goes to zero, or 944# the target changes the phase (in light of this, it makes sense that 945# the DMA circuitry doesn't ACK when PHASEMIS is active). If we are 946# doing a SCSI->Host transfer, the data FIFO should be flushed auto- 947# magically on STCNT=0 or a phase change, so just wait for FIFO empty 948# status. 949# 950dma3: 951 test SINDEX,0x4 jnz dma5 # DIRECTION 952dma4: 953 test DFSTATUS,0x1 jz dma4 # !FIFOEMP 954 955# Now shut the DMA enables off, and copy STCNT (ie. the underrun 956# amount, if any) to the SCB registers; SG_COUNT will get copied to 957# the SCB's residual S/G count field after sg_advance is called. Make 958# sure that the DMA enables are actually off first lest we get an ILLSADDR. 959# 960dma5: 961 clr DFCNTRL # disable DMA 962dma6: 963 test DFCNTRL,0x38 jnz dma6 # SCSIENACK|SDMAENACK|HDMAENACK 964 965 mvi DINDEX,SCBARRAY+15 966 mvi STCNT call bcopy_3 967 968 ret 969 970# Common SCSI initialization for selection and reselection. Expects 971# the target SCSI ID to be in the upper four bits of SINDEX, and A's 972# contents are stomped on return. 973# 974initialize: 975 and SINDEX,0xf0 # Get target ID 976 and A,0x0f,SCSIID 977 or SINDEX,A 978 mov SCSIID,SINDEX 979 980# Esundry initialization. 981# 982 clr DROPATN 983 clr SIGSTATE 984 985# Turn on Automatic PIO mode now, before we expect to see a REQ 986# from the target. It shouldn't hurt anything to leave it on. Set 987# CLRCHN here before the target has entered a data transfer mode - 988# with synchronous SCSI, if you do it later, you blow away some 989# data in the SCSI FIFO that the target has already sent to you. 990# 991 mvi SXFRCTL0,0x8a # DFON|SPIOEN|CLRCHN 992 993# Initialize scatter-gather pointers by setting up the working copy 994# in scratch RAM. 995# 996 call sg_scb2ram 997 998# Initialize SCSIRATE with the appropriate value for this target. 999# 1000 call ndx_dtr 1001 mov SCSIRATE,SINDIR ret 1002 1003# Assert that if we've been reselected, then we've seen an IDENTIFY 1004# message. 1005# 1006assert: 1007 test FLAGS,RESELECTED jz assert1 # reselected? 1008 test FLAGS,IDENTIFY_SEEN jnz assert1 # seen IDENTIFY? 1009 1010 mvi INTSTAT,NO_IDENT # no - cause a kernel panic 1011 1012assert1: 1013 ret 1014 1015# Find out if disconnection is ok from the information the BIOS has left 1016# us. The tcl from SCBARRAY+1 should be in SINDEX; A will 1017# contain either 0x40 (disconnection ok) or 0x00 (disconnection not ok) 1018# on exit. 1019# 1020# To allow for wide or twin busses, we check the upper bit of the target ID 1021# and the channel ID and look at the appropriate disconnect register. 1022# 1023disconnect: 1024 and FUNCTION1,0x70,SINDEX # strip off extra just in case 1025 mov A,FUNCTION1 1026 test SINDEX, 0x88 jz disconnect_a 1027 1028 test DISC_DSB_B,A jz disconnect1 # bit nonzero if DISabled 1029 clr A ret 1030 1031disconnect_a: 1032 test DISC_DSB_A,A jz disconnect1 # bit nonzero if DISabled 1033 clr A ret 1034 1035disconnect1: 1036 mvi A,0x40 ret 1037 1038# Locate the SCB matching the target ID/channel/lun in SAVED_TCL and switch 1039# the SCB to it. Have the kernel print a warning message if it can't be 1040# found, and generate an ABORT message to the target. SINDEX should be 1041# cleared on call. 1042# 1043findSCB: 1044 mov A,SAVED_TCL 1045 mov SCBPTR,SINDEX # switch to new SCB 1046 cmp SCBARRAY+1,A jne findSCB1 # target ID/channel/lun match? 1047 test SCBARRAY+0,0x4 jz findSCB1 # should be disconnected 1048 ret 1049 1050findSCB1: 1051 inc SINDEX 1052 mov A,SCBCOUNT 1053 cmp SINDEX,A jne findSCB 1054 1055 mvi INTSTAT,NO_MATCH # not found - signal kernel 1056 mvi 0x6 call mk_mesg # ABORT message 1057 1058 or SINDEX,0x10,SIGSTATE # assert ATNO 1059 call scsisig 1060 ret 1061 1062# Make a working copy of the scatter-gather parameters in the SCB. 1063# 1064sg_scb2ram: 1065 mov SG_COUNT,SCBARRAY+2 1066 1067 mvi DINDEX,SG_NEXT 1068 mvi SCBARRAY+3 call bcopy_4 1069 1070 mvi SG_NOLOAD,0x80 1071 test SCBARRAY+0,0x10 jnz sg_scb2ram1 # don't reload s/g? 1072 clr SG_NOLOAD 1073 1074sg_scb2ram1: 1075 ret 1076 1077# Copying RAM values back to SCB, for Save Data Pointers message. 1078# 1079sg_ram2scb: 1080 mov SCBARRAY+2,SG_COUNT 1081 1082 mvi DINDEX,SCBARRAY+3 1083 mvi SG_NEXT call bcopy_4 1084 1085 and SCBARRAY+0,0xef,SCBARRAY+0 1086 test SG_NOLOAD,0x80 jz sg_ram2scb1 # reload s/g? 1087 or SCBARRAY+0,SG_LOAD 1088 1089sg_ram2scb1: 1090 ret 1091 1092# Load a struct scatter if needed and set up the data address and 1093# length. If the working value of the SG count is nonzero, then 1094# we need to load a new set of values. 1095# 1096# This, like the above DMA, assumes a little-endian host data storage. 1097# 1098sg_load: 1099 test SG_COUNT,0xff jz sg_load3 # SG being used? 1100 test SG_NOLOAD,0x80 jnz sg_load3 # don't reload s/g? 1101 1102 clr HCNT+2 1103 clr HCNT+1 1104 mvi HCNT+0,SG_SIZEOF 1105 1106 mvi DINDEX,HADDR 1107 mvi SG_NEXT call bcopy_4 1108 1109 mvi DFCNTRL,0xd # HDMAEN|DIRECTION|FIFORESET 1110 1111# Wait for DMA from host memory to data FIFO to complete, then disable 1112# DMA and wait for it to acknowledge that it's off. 1113# 1114sg_load1: 1115 test DFSTATUS,0x8 jz sg_load1 # HDONE 1116 1117 clr DFCNTRL # disable DMA 1118sg_load2: 1119 test DFCNTRL,0x8 jnz sg_load2 # HDMAENACK 1120 1121# Copy data from FIFO into SCB data pointer and data count. This assumes 1122# that the struct scatterlist has this structure (this and sizeof(struct 1123# scatterlist) == 12 are asserted in aic7xxx.c): 1124# 1125# struct scatterlist { 1126# char *address; /* four bytes, little-endian order */ 1127# ... /* four bytes, ignored */ 1128# unsigned short length; /* two bytes, little-endian order */ 1129# } 1130# 1131 1132# Not in FreeBSD. the scatter list is only 8 bytes. 1133# 1134# struct ahc_dma_seg { 1135# physaddr addr; /* four bytes, little-endian order */ 1136# long len; /* four bytes, little endian order */ 1137# }; 1138# 1139 1140 mov SCBARRAY+19,DFDAT # new data address 1141 mov SCBARRAY+20,DFDAT 1142 mov SCBARRAY+21,DFDAT 1143 mov SCBARRAY+22,DFDAT 1144 1145# For Linux, we must throw away four bytes since there is a 32bit gap 1146# in the middle of a struct scatterlist 1147# mov NONE,DFDAT 1148# mov NONE,DFDAT 1149# mov NONE,DFDAT 1150# mov NONE,DFDAT 1151 1152 mov SCBARRAY+23,DFDAT 1153 mov SCBARRAY+24,DFDAT 1154 mov SCBARRAY+25,DFDAT #Only support 24 bit length. 1155 1156sg_load3: 1157 ret 1158 1159# Advance the scatter-gather pointers only IF NEEDED. If SG is enabled, 1160# and the SCSI transfer count is zero (note that this should be called 1161# right after a DMA finishes), then move the working copies of the SG 1162# pointer/length along. If the SCSI transfer count is not zero, then 1163# presumably the target is disconnecting - do not reload the SG values 1164# next time. 1165# 1166sg_advance: 1167 test SG_COUNT,0xff jz sg_advance2 # s/g enabled? 1168 1169 test STCNT+0,0xff jnz sg_advance1 # SCSI transfer count nonzero? 1170 test STCNT+1,0xff jnz sg_advance1 1171 test STCNT+2,0xff jnz sg_advance1 1172 1173 clr SG_NOLOAD # reload s/g next time 1174 dec SG_COUNT # one less segment to go 1175 1176 clr A # add sizeof(struct scatter) 1177 add SG_NEXT+0,SG_SIZEOF,SG_NEXT+0 1178 adc SG_NEXT+1,A,SG_NEXT+1 1179 adc SG_NEXT+2,A,SG_NEXT+2 1180 adc SG_NEXT+3,A,SG_NEXT+3 ret 1181 1182sg_advance1: 1183 mvi SG_NOLOAD,0x80 # don't reload s/g next time 1184sg_advance2: 1185 ret 1186 1187# Add the array base SYNCNEG to the target offset (the target address 1188# is in SCSIID), and return the result in SINDEX. The accumulator 1189# contains the 3->8 decoding of the target ID on return. 1190# 1191ndx_dtr: 1192 shr A,SCSIID,4 1193 test SBLKCTL,0x08 jz ndx_dtr_2 1194 or A,0x08 # Channel B entries add 8 1195ndx_dtr_2: 1196 add SINDEX,SYNCNEG,A 1197 1198 and FUNCTION1,0x70,SCSIID # 3-bit target address decode 1199 mov A,FUNCTION1 ret 1200 1201# If we need to negotiate transfer parameters, build the WDTR or SDTR message 1202# starting at the address passed in SINDEX. DINDEX is modified on return. 1203# The SCSI-II spec requires that Wide negotiation occur first and you can 1204# only negotiat one or the other at a time otherwise in the event of a message 1205# reject, you wouldn't be able to tell which message was the culpret. 1206# 1207mk_dtr: 1208 mov DINDEX,SINDEX # save SINDEX 1209 1210 test SCBARRAY+0,NEEDWDTR jnz mk_wdtr_16bit 1211 jmp mk_sdtr 1212 1213mk_wdtr_16bit: 1214 mvi ARG_1,BUS_16_BIT 1215mk_wdtr: 1216 mvi DINDIR,1 # extended message 1217 mvi DINDIR,2 # extended message length = 2 1218 mvi DINDIR,3 # WDTR code 1219 mov DINDIR,ARG_1 # bus width 1220 1221 add MSG_LEN,-MSG_START+0,DINDEX ret # update message length 1222 1223mk_sdtr: 1224 mvi DINDIR,1 # extended message 1225 mvi DINDIR,3 # extended message length = 3 1226 mvi DINDIR,1 # SDTR code 1227 call sdtr_to_rate 1228 mov DINDIR,RETURN_1 # REQ/ACK transfer period 1229 and DINDIR,0xf,SINDIR # Sync Offset 1230 1231 add MSG_LEN,-MSG_START+0,DINDEX ret # update message length 1232 1233# Set SCSI bus control signal state. This also saves the last-written 1234# value into a location where the higher-level driver can read it - if 1235# it has to send an ABORT or RESET message, then it needs to know this 1236# so it can assert ATN without upsetting SCSISIGO. The new value is 1237# expected in SINDEX. Change the actual state last to avoid contention 1238# from the driver. 1239# 1240scsisig: 1241 mov SIGSTATE,SINDEX 1242 mov SCSISIGO,SINDEX ret 1243 1244sdtr_to_rate: 1245 call ndx_dtr # index scratch space for target 1246 shr A,SINDIR,0x4 1247 dec SINDEX #Preserve SINDEX 1248 and A,0x7 1249 clr RETURN_1 1250sdtr_to_rate_loop: 1251 test A,0x0f jz sdtr_to_rate_done 1252 add RETURN_1,0x18 1253 dec A 1254 jmp sdtr_to_rate_loop 1255sdtr_to_rate_done: 1256 shr RETURN_1,0x2 1257 add RETURN_1,0x18 ret 1258