/*
 * CDDL HEADER START
 *
 * The contents of this file are subject to the terms of the
 * Common Development and Distribution License, Version 1.0 only
 * (the "License").  You may not use this file except in compliance
 * with the License.
 *
 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
 * or http://www.opensolaris.org/os/licensing.
 * See the License for the specific language governing permissions
 * and limitations under the License.
 *
 * When distributing Covered Code, include this CDDL HEADER in each
 * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
 * If applicable, add the following below this CDDL HEADER, with the
 * fields enclosed by brackets "[]" replaced with your own identifying
 * information: Portions Copyright [yyyy] [name of copyright owner]
 *
 * CDDL HEADER END
 */
/*
 * Copyright 2005 Sun Microsystems, Inc.  All rights reserved.
 * Use is subject to license terms.
 */

/*
 * hci1394_q.c
 *    This code decouples some of the OpenHCI async descriptor logic/structures
 *    from the async processing.  The goal was to combine as much of the
 *    duplicate code as possible for the different type of async transfers
 *    without going too overboard.
 *
 *    There are two parts to the Q, the descriptor buffer and the data buffer.
 *    For the most part, data to be transmitted and data which is received go
 *    in the data buffers.  The information of where to get the data and put
 *    the data reside in the descriptor buffers. There are exceptions to this.
 */


#include <sys/types.h>
#include <sys/conf.h>
#include <sys/ddi.h>
#include <sys/modctl.h>
#include <sys/stat.h>
#include <sys/sunddi.h>
#include <sys/cmn_err.h>
#include <sys/kmem.h>
#include <sys/note.h>

#include <sys/1394/adapters/hci1394.h>


static int hci1394_q_reserve(hci1394_q_buf_t *qbuf, uint_t size,
    uint32_t *io_addr);
static void hci1394_q_unreserve(hci1394_q_buf_t *qbuf);
static void hci1394_q_buf_setup(hci1394_q_buf_t *qbuf);
static void hci1394_q_reset(hci1394_q_handle_t q_handle);
static void hci1394_q_next_buf(hci1394_q_buf_t *qbuf);

static void hci1394_q_at_write_OLI(hci1394_q_handle_t q_handle,
    hci1394_q_buf_t *qbuf, hci1394_q_cmd_t *cmd, hci1394_basic_pkt_t *hdr,
    uint_t hdrsize);
static void hci1394_q_at_write_OMI(hci1394_q_handle_t q_handle,
    hci1394_q_buf_t *qbuf, hci1394_q_cmd_t *cmd, hci1394_basic_pkt_t *hdr,
    uint_t hdrsize);
static void hci1394_q_at_write_OL(hci1394_q_handle_t q_handle,
    hci1394_q_buf_t *qbuf, hci1394_q_cmd_t *cmd, uint32_t io_addr,
    uint_t datasize);
static void hci1394_q_at_rep_put8(hci1394_q_buf_t *qbuf, hci1394_q_cmd_t *cmd,
    uint8_t *data, uint_t datasize);
static void hci1394_q_at_copy_from_mblk(hci1394_q_buf_t *qbuf,
    hci1394_q_cmd_t *cmd, h1394_mblk_t *mblk);

static void hci1394_q_ar_write_IM(hci1394_q_handle_t q_handle,
    hci1394_q_buf_t *qbuf, uint32_t io_addr, uint_t datasize);

_NOTE(SCHEME_PROTECTS_DATA("unique", msgb))

/*
 * hci1394_q_init()
 *    Initialize a Q.  A Q consists of a descriptor buffer and a data buffer and
 *    can be either an AT or AR Q. hci1394_q_init() returns a handle which
 *    should be used for the reset of the hci1394_q_* calls.
 */
int
hci1394_q_init(hci1394_drvinfo_t *drvinfo,
    hci1394_ohci_handle_t ohci_handle, hci1394_q_info_t *qinfo,
    hci1394_q_handle_t *q_handle)
{
        hci1394_q_buf_t *desc;
        hci1394_q_buf_t *data;
        hci1394_buf_parms_t parms;
        hci1394_q_t *q;
        int status;
        int index;


        ASSERT(drvinfo != NULL);
        ASSERT(qinfo != NULL);
        ASSERT(q_handle != NULL);

        /*
         * allocate the memory to track this Q.  Initialize the internal Q
         * structure.
         */
        q = kmem_alloc(sizeof (hci1394_q_t), KM_SLEEP);
        q->q_drvinfo = drvinfo;
        q->q_info = *qinfo;
        q->q_ohci = ohci_handle;
        mutex_init(&q->q_mutex, NULL, MUTEX_DRIVER, drvinfo->di_iblock_cookie);
        desc = &q->q_desc;
        data = &q->q_data;

        /*
         * Allocate the Descriptor buffer.
         *
         * XXX - Only want 1 cookie for now. Change this to OHCI_MAX_COOKIE
         * after we have tested the multiple cookie code on x86.
         */
        parms.bp_length = qinfo->qi_desc_size;
        parms.bp_max_cookies = 1;
        parms.bp_alignment = 16;
        status = hci1394_buf_alloc(drvinfo, &parms, &desc->qb_buf,
            &desc->qb_buf_handle);
        if (status != DDI_SUCCESS) {
                mutex_destroy(&q->q_mutex);
                kmem_free(q, sizeof (hci1394_q_t));
                *q_handle = NULL;
                return (DDI_FAILURE);
        }

        /* Copy in buffer cookies into our local cookie array */
        desc->qb_cookie[0] = desc->qb_buf.bi_cookie;
        for (index = 1; index < desc->qb_buf.bi_cookie_count; index++) {
                ddi_dma_nextcookie(desc->qb_buf.bi_dma_handle,
                    &desc->qb_buf.bi_cookie);
                desc->qb_cookie[index] = desc->qb_buf.bi_cookie;
        }

        /*
         * Allocate the Data buffer.
         *
         * XXX - Only want 1 cookie for now. Change this to OHCI_MAX_COOKIE
         * after we have tested the multiple cookie code on x86.
         */
        parms.bp_length = qinfo->qi_data_size;
        parms.bp_max_cookies = 1;
        parms.bp_alignment = 16;
        status = hci1394_buf_alloc(drvinfo, &parms, &data->qb_buf,
            &data->qb_buf_handle);
        if (status != DDI_SUCCESS) {
                /* Free the allocated Descriptor buffer */
                hci1394_buf_free(&desc->qb_buf_handle);

                mutex_destroy(&q->q_mutex);
                kmem_free(q, sizeof (hci1394_q_t));
                *q_handle = NULL;
                return (DDI_FAILURE);
        }

        /*
         * We must have at least 2 ARQ data buffers, If we only have one, we
         * will artificially create 2. We must have 2 so that we always have a
         * descriptor with free data space to write AR data to. When one is
         * empty, it will take us a bit to get a new descriptor back into the
         * chain.
         */
        if ((qinfo->qi_mode == HCI1394_ARQ) &&
            (data->qb_buf.bi_cookie_count == 1)) {
                data->qb_buf.bi_cookie_count = 2;
                data->qb_cookie[0] = data->qb_buf.bi_cookie;
                data->qb_cookie[0].dmac_size /= 2;
                data->qb_cookie[1] = data->qb_cookie[0];
                data->qb_cookie[1].dmac_laddress =
                    data->qb_cookie[0].dmac_laddress +
                    data->qb_cookie[0].dmac_size;
                data->qb_cookie[1].dmac_address =
                    data->qb_cookie[0].dmac_address +
                    data->qb_cookie[0].dmac_size;

        /* We have more than 1 cookie or we are an AT Q */
        } else {
                /* Copy in buffer cookies into our local cookie array */
                data->qb_cookie[0] = data->qb_buf.bi_cookie;
                for (index = 1; index < data->qb_buf.bi_cookie_count; index++) {
                        ddi_dma_nextcookie(data->qb_buf.bi_dma_handle,
                            &data->qb_buf.bi_cookie);
                        data->qb_cookie[index] = data->qb_buf.bi_cookie;
                }
        }

        /* The top and bottom of the Q are only set once */
        desc->qb_ptrs.qp_top = desc->qb_buf.bi_kaddr;
        desc->qb_ptrs.qp_bottom = desc->qb_buf.bi_kaddr +
            desc->qb_buf.bi_real_length - 1;
        data->qb_ptrs.qp_top = data->qb_buf.bi_kaddr;
        data->qb_ptrs.qp_bottom = data->qb_buf.bi_kaddr +
            data->qb_buf.bi_real_length - 1;

        /*
         * reset the Q pointers to their original settings.  Setup IM
         * descriptors if this is an AR Q.
         */
        hci1394_q_reset(q);

        /* if this is an AT Q, create a queued list for the AT descriptors */
        if (qinfo->qi_mode == HCI1394_ATQ) {
                hci1394_tlist_init(drvinfo, NULL, &q->q_queued_list);
        }

        *q_handle = q;

        return (DDI_SUCCESS);
}


/*
 * hci1394_q_fini()
 *    Cleanup after a successful hci1394_q_init(). Notice that a pointer to the
 *    handle is used for the parameter.  fini() will set your handle to NULL
 *    before returning.
 */
void
hci1394_q_fini(hci1394_q_handle_t *q_handle)
{
        hci1394_q_t *q;

        ASSERT(q_handle != NULL);

        q = *q_handle;
        if (q->q_info.qi_mode == HCI1394_ATQ) {
                hci1394_tlist_fini(&q->q_queued_list);
        }
        mutex_destroy(&q->q_mutex);
        hci1394_buf_free(&q->q_desc.qb_buf_handle);
        hci1394_buf_free(&q->q_data.qb_buf_handle);
        kmem_free(q, sizeof (hci1394_q_t));
        *q_handle = NULL;
}


/*
 * hci1394_q_buf_setup()
 *    Initialization of buffer pointers which are present in both the descriptor
 *    buffer and data buffer (No reason to duplicate the code)
 */
static void
hci1394_q_buf_setup(hci1394_q_buf_t *qbuf)
{
        ASSERT(qbuf != NULL);

        /* start with the first cookie */
        qbuf->qb_ptrs.qp_current_buf = 0;
        qbuf->qb_ptrs.qp_begin = qbuf->qb_ptrs.qp_top;
        qbuf->qb_ptrs.qp_end = qbuf->qb_ptrs.qp_begin +
            qbuf->qb_cookie[qbuf->qb_ptrs.qp_current_buf].dmac_size - 1;
        qbuf->qb_ptrs.qp_current = qbuf->qb_ptrs.qp_begin;
        qbuf->qb_ptrs.qp_offset = 0;

        /*
         * The free_buf and free pointer will change everytime an ACK (of some
         * type) is processed.  Free is the last byte in the last cookie.
         */
        qbuf->qb_ptrs.qp_free_buf = qbuf->qb_buf.bi_cookie_count - 1;
        qbuf->qb_ptrs.qp_free = qbuf->qb_ptrs.qp_bottom;

        /*
         * Start with no space to write descriptors.  We first need to call
         * hci1394_q_reserve() before calling hci1394_q_at_write_O*().
         */
        qbuf->qb_ptrs.qp_resv_size = 0;
}


/*
 * hci1394_q_reset()
 *    Resets the buffers to an initial state.  This should be called during
 *    attach and resume.
 */
static void
hci1394_q_reset(hci1394_q_handle_t q_handle)
{
        hci1394_q_buf_t *desc;
        hci1394_q_buf_t *data;
        int index;

        ASSERT(q_handle != NULL);

        mutex_enter(&q_handle->q_mutex);
        desc = &q_handle->q_desc;
        data = &q_handle->q_data;

        hci1394_q_buf_setup(desc);
        hci1394_q_buf_setup(data);

        /* DMA starts off stopped, no previous descriptor to link from */
        q_handle->q_dma_running = B_FALSE;
        q_handle->q_block_cnt = 0;
        q_handle->q_previous = NULL;

        /* If this is an AR Q, setup IM's for the data buffers that we have */
        if (q_handle->q_info.qi_mode == HCI1394_ARQ) {
                /*
                 * This points to where to find the first IM descriptor.  Since
                 * we just reset the pointers in hci1394_q_buf_setup(), the
                 * first IM we write below will be found at the top of the Q.
                 */
                q_handle->q_head = desc->qb_ptrs.qp_top;

                for (index = 0; index < data->qb_buf.bi_cookie_count; index++) {
                        hci1394_q_ar_write_IM(q_handle, desc,
                            data->qb_cookie[index].dmac_address,
                            data->qb_cookie[index].dmac_size);
                }

                /*
                 * The space left in the current IM is the size of the buffer.
                 * The current buffer is the first buffer added to the AR Q.
                 */
                q_handle->q_space_left = data->qb_cookie[0].dmac_size;
        }

        mutex_exit(&q_handle->q_mutex);
}


/*
 * hci1394_q_resume()
 *    This is called during a resume (after a successful suspend). Currently
 *    we only call reset.  Since this is not a time critical function, we will
 *    leave this as a separate function to increase readability.
 */
void
hci1394_q_resume(hci1394_q_handle_t q_handle)
{
        ASSERT(q_handle != NULL);
        hci1394_q_reset(q_handle);
}


/*
 * hci1394_q_stop()
 *    This call informs us that a DMA engine has been stopped.  It does not
 *    perform the actual stop. We need to know this so that when we add a
 *    new descriptor, we do a start instead of a wake.
 */
void
hci1394_q_stop(hci1394_q_handle_t q_handle)
{
        ASSERT(q_handle != NULL);
        mutex_enter(&q_handle->q_mutex);
        q_handle->q_dma_running = B_FALSE;
        mutex_exit(&q_handle->q_mutex);
}


/*
 * hci1394_q_reserve()
 *    Reserve space in the AT descriptor or data buffer. This ensures that we
 *    can get a contiguous buffer. Descriptors have to be in a contiguous
 *    buffer. Data does not have to be in a contiguous buffer but we do this to
 *    reduce complexity. For systems with small page sizes (e.g. x86), this
 *    could result in inefficient use of the data buffers when sending large
 *    data blocks (this only applies to non-physical block write ATREQs and
 *    block read ATRESP). Since it looks like most protocols that use large data
 *    blocks (like SPB-2), use physical transfers to do this (due to their
 *    efficiency), this will probably not be a real world problem.  If it turns
 *    out to be a problem, the options are to force a single cookie for the data
 *    buffer, allow multiple cookies and have a larger data space, or change the
 *    data code to use a OMI, OM, OL descriptor sequence (instead of OMI, OL).
 */
static int
hci1394_q_reserve(hci1394_q_buf_t *qbuf, uint_t size, uint32_t *io_addr)
{
        uint_t aligned_size;


        ASSERT(qbuf != NULL);

        /* Save backup of pointers in case we have to unreserve */
        qbuf->qb_backup_ptrs = qbuf->qb_ptrs;

        /*
         * Make sure all alloc's are quadlet aligned. The data doesn't have to
         * be, so we will force it to be.
         */
        aligned_size = HCI1394_ALIGN_QUAD(size);

        /*
         * if the free pointer is in the current buffer and the free pointer
         * is below the current pointer (i.e. has not wrapped around)
         */
        if ((qbuf->qb_ptrs.qp_current_buf == qbuf->qb_ptrs.qp_free_buf) &&
            (qbuf->qb_ptrs.qp_free >= qbuf->qb_ptrs.qp_current)) {
                /*
                 * The free pointer is in this buffer below the current pointer.
                 * Check to see if we have enough free space left.
                 */
                if ((qbuf->qb_ptrs.qp_current + aligned_size) <=
                    qbuf->qb_ptrs.qp_free) {
                        /* Setup up our reserved size, return the IO address */
                        qbuf->qb_ptrs.qp_resv_size = aligned_size;
                        *io_addr = (uint32_t)(qbuf->qb_cookie[
                            qbuf->qb_ptrs.qp_current_buf].dmac_address +
                            qbuf->qb_ptrs.qp_offset);

                /*
                 * The free pointer is in this buffer below the current pointer.
                 * We do not have enough free space for the alloc. Return
                 * failure.
                 */
                } else {
                        qbuf->qb_ptrs.qp_resv_size = 0;
                        return (DDI_FAILURE);
                }

        /*
         * If there is not enough room to fit in the current buffer (not
         * including wrap around), we will go to the next buffer and check
         * there. If we only have one buffer (i.e. one cookie), we will end up
         * staying at the current buffer and wrapping the address back to the
         * top.
         */
        } else if ((qbuf->qb_ptrs.qp_current + aligned_size) >
            qbuf->qb_ptrs.qp_end) {
                /* Go to the next buffer (or the top of ours for one cookie) */
                hci1394_q_next_buf(qbuf);

                /* If the free pointer is in the new current buffer */
                if (qbuf->qb_ptrs.qp_current_buf == qbuf->qb_ptrs.qp_free_buf) {
                        /*
                         * The free pointer is in this buffer. If we do not have
                         * enough free space for the alloc. Return failure.
                         */
                        if ((qbuf->qb_ptrs.qp_current + aligned_size) >
                            qbuf->qb_ptrs.qp_free) {
                                qbuf->qb_ptrs.qp_resv_size = 0;
                                return (DDI_FAILURE);
                        /*
                         * The free pointer is in this buffer. We have enough
                         * free space left.
                         */
                        } else {
                                /*
                                 * Setup up our reserved size, return the IO
                                 * address
                                 */
                                qbuf->qb_ptrs.qp_resv_size = aligned_size;
                                *io_addr = (uint32_t)(qbuf->qb_cookie[
                                    qbuf->qb_ptrs.qp_current_buf].dmac_address +
                                    qbuf->qb_ptrs.qp_offset);
                        }

                /*
                 * We switched buffers and the free pointer is still in another
                 * buffer. We have sufficient space in this buffer for the alloc
                 * after changing buffers.
                 */
                } else {
                        /* Setup up our reserved size, return the IO address */
                        qbuf->qb_ptrs.qp_resv_size = aligned_size;
                        *io_addr = (uint32_t)(qbuf->qb_cookie[
                            qbuf->qb_ptrs.qp_current_buf].dmac_address +
                            qbuf->qb_ptrs.qp_offset);
                }
        /*
         * The free pointer is in another buffer. We have sufficient space in
         * this buffer for the alloc.
         */
        } else {
                /* Setup up our reserved size, return the IO address */
                qbuf->qb_ptrs.qp_resv_size = aligned_size;
                *io_addr = (uint32_t)(qbuf->qb_cookie[
                    qbuf->qb_ptrs.qp_current_buf].dmac_address +
                    qbuf->qb_ptrs.qp_offset);
        }

        return (DDI_SUCCESS);
}

/*
 * hci1394_q_unreserve()
 *    Set the buffer pointer to what they were before hci1394_reserve().  This
 *    will be called when we encounter errors during hci1394_q_at*().
 */
static void
hci1394_q_unreserve(hci1394_q_buf_t *qbuf)
{
        ASSERT(qbuf != NULL);

        /* Go back to pointer setting before the reserve */
        qbuf->qb_ptrs = qbuf->qb_backup_ptrs;
}


/*
 * hci1394_q_next_buf()
 *    Set our current buffer to the next cookie.  If we only have one cookie, we
 *    will go back to the top of our buffer.
 */
void
hci1394_q_next_buf(hci1394_q_buf_t *qbuf)
{
        ASSERT(qbuf != NULL);

        /*
         * go to the next cookie, if we are >= the cookie count, go back to the
         * first cookie.
         */
        qbuf->qb_ptrs.qp_current_buf++;
        if (qbuf->qb_ptrs.qp_current_buf >= qbuf->qb_buf.bi_cookie_count) {
                qbuf->qb_ptrs.qp_current_buf = 0;
        }

        /* adjust the begin, end, current, and offset pointers */
        qbuf->qb_ptrs.qp_begin = qbuf->qb_ptrs.qp_end + 1;
        if (qbuf->qb_ptrs.qp_begin > qbuf->qb_ptrs.qp_bottom) {
                qbuf->qb_ptrs.qp_begin = qbuf->qb_ptrs.qp_top;
        }
        qbuf->qb_ptrs.qp_end = qbuf->qb_ptrs.qp_begin +
            qbuf->qb_cookie[qbuf->qb_ptrs.qp_current_buf].dmac_size - 1;
        qbuf->qb_ptrs.qp_current = qbuf->qb_ptrs.qp_begin;
        qbuf->qb_ptrs.qp_offset = 0;
}


/*
 * hci1394_q_at()
 *    Place an AT command that does NOT need the data buffer into the DMA chain.
 *    Some examples of this are quadlet read/write, PHY packets, ATREQ Block
 *    Read, and ATRESP block write. result is only valid on failure.
 */
int
hci1394_q_at(hci1394_q_handle_t q_handle, hci1394_q_cmd_t *cmd,
    hci1394_basic_pkt_t *hdr, uint_t hdrsize, int *result)
{
        int status;
        uint32_t ioaddr;


        ASSERT(q_handle != NULL);
        ASSERT(cmd != NULL);
        ASSERT(hdr != NULL);

        mutex_enter(&q_handle->q_mutex);

        /*
         * Check the HAL state and generation when the AT Q is locked.  This
         * will make sure that we get all the commands when we flush the Q's
         * during a reset or shutdown.
         */
        if ((hci1394_state(q_handle->q_drvinfo) != HCI1394_NORMAL) ||
            (hci1394_ohci_current_busgen(q_handle->q_ohci) !=
            cmd->qc_generation)) {
                *result = H1394_STATUS_INVALID_BUSGEN;
                mutex_exit(&q_handle->q_mutex);
                return (DDI_FAILURE);
        }

        /* save away the argument to pass up when this command completes */
        cmd->qc_node.tln_addr = cmd;

        /* we have not written any 16 byte blocks to the descriptor yet */
        q_handle->q_block_cnt = 0;

        /* Reserve space for an OLI in the descriptor buffer */
        status = hci1394_q_reserve(&q_handle->q_desc,
            sizeof (hci1394_desc_imm_t), &ioaddr);
        if (status != DDI_SUCCESS) {
                *result = H1394_STATUS_NOMORE_SPACE;
                mutex_exit(&q_handle->q_mutex);
                return (DDI_FAILURE);
        }

        /* write the OLI to the descriptor buffer */
        hci1394_q_at_write_OLI(q_handle, &q_handle->q_desc, cmd, hdr, hdrsize);

        /* Add the AT command to the queued list */
        hci1394_tlist_add(q_handle->q_queued_list, &cmd->qc_node);

        mutex_exit(&q_handle->q_mutex);

        return (DDI_SUCCESS);
}


/*
 * XXX - NOTE: POSSIBLE FUTURE OPTIMIZATION
 *    ATREQ Block read and write's that go through software are not very
 *    efficient (one of the reasons to use physical space). A copy is forced
 *    on all block reads due to the design of OpenHCI. Writes do not have this
 *    same restriction.  This design forces a copy for writes too (we always
 *    copy into a data buffer before sending). There are many reasons for this
 *    including complexity reduction.  There is a data size threshold where a
 *    copy is more expensive than mapping the data buffer address (or worse
 *    case a big enough difference where it pays to do it). However, we move
 *    block data around in mblks which means that our data may be scattered
 *    over many buffers.  This adds to the complexity of mapping and setting
 *    up the OpenHCI descriptors.
 *
 *    If someone really needs a speedup on block write ATREQs, my recommendation
 *    would be to add an additional command type at the target interface for a
 *    fast block write.  The target driver would pass a mapped io addr to use.
 *    A function like "hci1394_q_at_with_ioaddr()" could be created which would
 *    be almost an exact copy of hci1394_q_at_with_data() without the
 *    hci1394_q_reserve() and hci1394_q_at_rep_put8() for the data buffer.
 */


/*
 * hci1394_q_at_with_data()
 *    Place an AT command that does need the data buffer into the DMA chain.
 *    The data is passed as a pointer to a kernel virtual address. An example of
 *    this is the lock operations. result is only valid on failure.
 */
int
hci1394_q_at_with_data(hci1394_q_handle_t q_handle, hci1394_q_cmd_t *cmd,
    hci1394_basic_pkt_t *hdr, uint_t hdrsize, uint8_t *data, uint_t datasize,
    int *result)
{
        uint32_t desc_ioaddr;
        uint32_t data_ioaddr;
        int status;


        ASSERT(q_handle != NULL);
        ASSERT(cmd != NULL);
        ASSERT(hdr != NULL);
        ASSERT(data != NULL);

        mutex_enter(&q_handle->q_mutex);

        /*
         * Check the HAL state and generation when the AT Q is locked.  This
         * will make sure that we get all the commands when we flush the Q's
         * during a reset or shutdown.
         */
        if ((hci1394_state(q_handle->q_drvinfo) != HCI1394_NORMAL) ||
            (hci1394_ohci_current_busgen(q_handle->q_ohci) !=
            cmd->qc_generation)) {
                *result = H1394_STATUS_INVALID_BUSGEN;
                mutex_exit(&q_handle->q_mutex);
                return (DDI_FAILURE);
        }

        /* save away the argument to pass up when this command completes */
        cmd->qc_node.tln_addr = cmd;

        /* we have not written any 16 byte blocks to the descriptor yet */
        q_handle->q_block_cnt = 0;

        /* Reserve space for an OMI and OL in the descriptor buffer */
        status = hci1394_q_reserve(&q_handle->q_desc,
            (sizeof (hci1394_desc_imm_t) + sizeof (hci1394_desc_t)),
            &desc_ioaddr);
        if (status != DDI_SUCCESS) {
                *result = H1394_STATUS_NOMORE_SPACE;
                mutex_exit(&q_handle->q_mutex);
                return (DDI_FAILURE);
        }

        /* allocate space for data in the data buffer */
        status = hci1394_q_reserve(&q_handle->q_data, datasize, &data_ioaddr);
        if (status != DDI_SUCCESS) {
                *result = H1394_STATUS_NOMORE_SPACE;
                hci1394_q_unreserve(&q_handle->q_desc);
                mutex_exit(&q_handle->q_mutex);
                return (DDI_FAILURE);
        }

        /* Copy data into data buffer */
        hci1394_q_at_rep_put8(&q_handle->q_data, cmd, data, datasize);

        /* write the OMI to the descriptor buffer */
        hci1394_q_at_write_OMI(q_handle, &q_handle->q_desc, cmd, hdr, hdrsize);

        /* write the OL to the descriptor buffer */
        hci1394_q_at_write_OL(q_handle, &q_handle->q_desc, cmd, data_ioaddr,
            datasize);

        /* Add the AT command to the queued list */
        hci1394_tlist_add(q_handle->q_queued_list, &cmd->qc_node);

        mutex_exit(&q_handle->q_mutex);

        return (DDI_SUCCESS);
}


/*
 * hci1394_q_at_with_mblk()
 *    Place an AT command that does need the data buffer into the DMA chain.
 *    The data is passed in mblk_t(s). Examples of this are a block write
 *    ATREQ and a block read ATRESP. The services layer and the hal use a
 *    private structure (h1394_mblk_t) to keep track of how much of the mblk
 *    to send since we may have to break the transfer up into smaller blocks.
 *    (i.e. a 1MByte block write would go out in 2KByte chunks. result is only
 *    valid on failure.
 */
int
hci1394_q_at_with_mblk(hci1394_q_handle_t q_handle, hci1394_q_cmd_t *cmd,
    hci1394_basic_pkt_t *hdr, uint_t hdrsize, h1394_mblk_t *mblk, int *result)
{
        uint32_t desc_ioaddr;
        uint32_t data_ioaddr;
        int status;


        ASSERT(q_handle != NULL);
        ASSERT(cmd != NULL);
        ASSERT(hdr != NULL);
        ASSERT(mblk != NULL);

        mutex_enter(&q_handle->q_mutex);

        /*
         * Check the HAL state and generation when the AT Q is locked.  This
         * will make sure that we get all the commands when we flush the Q's
         * during a reset or shutdown.
         */
        if ((hci1394_state(q_handle->q_drvinfo) != HCI1394_NORMAL) ||
            (hci1394_ohci_current_busgen(q_handle->q_ohci) !=
            cmd->qc_generation)) {
                *result = H1394_STATUS_INVALID_BUSGEN;
                mutex_exit(&q_handle->q_mutex);
                return (DDI_FAILURE);
        }

        /* save away the argument to pass up when this command completes */
        cmd->qc_node.tln_addr = cmd;

        /* we have not written any 16 byte blocks to the descriptor yet */
        q_handle->q_block_cnt = 0;

        /* Reserve space for an OMI and OL in the descriptor buffer */
        status = hci1394_q_reserve(&q_handle->q_desc,
            (sizeof (hci1394_desc_imm_t) + sizeof (hci1394_desc_t)),
            &desc_ioaddr);
        if (status != DDI_SUCCESS) {
                *result = H1394_STATUS_NOMORE_SPACE;
                mutex_exit(&q_handle->q_mutex);
                return (DDI_FAILURE);
        }

        /* Reserve space for data in the data buffer */
        status = hci1394_q_reserve(&q_handle->q_data, mblk->length,
            &data_ioaddr);
        if (status != DDI_SUCCESS) {
                *result = H1394_STATUS_NOMORE_SPACE;
                hci1394_q_unreserve(&q_handle->q_desc);
                mutex_exit(&q_handle->q_mutex);
                return (DDI_FAILURE);
        }

        /* Copy mblk data into data buffer */
        hci1394_q_at_copy_from_mblk(&q_handle->q_data, cmd, mblk);

        /* write the OMI to the descriptor buffer */
        hci1394_q_at_write_OMI(q_handle, &q_handle->q_desc, cmd, hdr, hdrsize);

        /* write the OL to the descriptor buffer */
        hci1394_q_at_write_OL(q_handle, &q_handle->q_desc, cmd, data_ioaddr,
            mblk->length);

        /* Add the AT command to the queued list */
        hci1394_tlist_add(q_handle->q_queued_list, &cmd->qc_node);

        mutex_exit(&q_handle->q_mutex);

        return (DDI_SUCCESS);
}


/*
 * hci1394_q_at_next()
 *    Return the next completed AT command in cmd.  If flush_q is true, we will
 *    return the command regardless if it finished or not.  We will flush
 *    during bus reset processing, shutdown, and detach.
 */
void
hci1394_q_at_next(hci1394_q_handle_t q_handle, boolean_t flush_q,
    hci1394_q_cmd_t **cmd)
{
        hci1394_q_buf_t *desc;
        hci1394_q_buf_t *data;
        hci1394_tlist_node_t *node;
        uint32_t cmd_status;


        ASSERT(q_handle != NULL);
        ASSERT(cmd != NULL);

        mutex_enter(&q_handle->q_mutex);

        desc = &q_handle->q_desc;
        data = &q_handle->q_data;

        /* Sync descriptor buffer */
        (void) ddi_dma_sync(desc->qb_buf.bi_dma_handle, 0,
            desc->qb_buf.bi_length, DDI_DMA_SYNC_FORKERNEL);

        /* Look at the top cmd on the queued list (without removing it) */
        hci1394_tlist_peek(q_handle->q_queued_list, &node);
        if (node == NULL) {
                /* There are no more commands left on the queued list */
                *cmd = NULL;
                mutex_exit(&q_handle->q_mutex);
                return;
        }

        /*
         * There is a command on the list, read its status and timestamp when
         * it was sent
         */
        *cmd = (hci1394_q_cmd_t *)node->tln_addr;
        cmd_status = ddi_get32(desc->qb_buf.bi_handle, (*cmd)->qc_status_addr);
        (*cmd)->qc_timestamp = cmd_status & DESC_ST_TIMESTAMP_MASK;
        cmd_status = HCI1394_DESC_EVT_GET(cmd_status);

        /*
         * If we are flushing the q (e.g. due to a bus reset), we will return
         * the command regardless of its completion status. If we are not
         * flushing the Q and we do not have status on the command (e.g. status
         * = 0), we are done with this Q for now.
         */
        if (flush_q == B_FALSE) {
                if (cmd_status == 0) {
                        *cmd = NULL;
                        mutex_exit(&q_handle->q_mutex);
                        return;
                }
        }

        /*
         * The command completed, remove it from the queued list. There is not
         * a race condition to delete the node in the list here.  This is the
         * only place the node will be deleted so we do not need to check the
         * return status.
         */
        (void) hci1394_tlist_delete(q_handle->q_queued_list, node);

        /*
         * Free the space used by the command in the descriptor and data
         * buffers.
         */
        desc->qb_ptrs.qp_free_buf = (*cmd)->qc_descriptor_buf;
        desc->qb_ptrs.qp_free = (*cmd)->qc_descriptor_end;
        if ((*cmd)->qc_data_used == B_TRUE) {
                data->qb_ptrs.qp_free_buf = (*cmd)->qc_data_buf;
                data->qb_ptrs.qp_free = (*cmd)->qc_data_end;
        }

        /* return command status */
        (*cmd)->qc_status = cmd_status;

        mutex_exit(&q_handle->q_mutex);
}


/*
 * hci1394_q_at_write_OMI()
 *    Write an OMI descriptor into the AT descriptor buffer passed in as qbuf.
 *    Buffer state information is stored in cmd.  Use the hdr and hdr size for
 *    the additional information attached to an immediate descriptor.
 */
void
hci1394_q_at_write_OMI(hci1394_q_handle_t q_handle, hci1394_q_buf_t *qbuf,
    hci1394_q_cmd_t *cmd, hci1394_basic_pkt_t *hdr, uint_t hdrsize)
{
        hci1394_desc_imm_t *desc;
        uint32_t data;


        ASSERT(qbuf != NULL);
        ASSERT(cmd != NULL);
        ASSERT(hdr != NULL);
        ASSERT(MUTEX_HELD(&q_handle->q_mutex));

        /* The only valid "header" sizes for an OMI are 8 bytes or 16 bytes */
        ASSERT((hdrsize == 8) || (hdrsize == 16));

        /* Make sure enough room for OMI */
        ASSERT(qbuf->qb_ptrs.qp_resv_size >= sizeof (hci1394_desc_imm_t));

        /* Store the offset of the top of this descriptor block */
        qbuf->qb_ptrs.qp_offset = (uint32_t)(qbuf->qb_ptrs.qp_current -
            qbuf->qb_ptrs.qp_begin);

        /* Setup OpenHCI OMI Header */
        desc = (hci1394_desc_imm_t *)qbuf->qb_ptrs.qp_current;
        data = DESC_AT_OMI | (hdrsize & DESC_HDR_REQCOUNT_MASK);
        ddi_put32(qbuf->qb_buf.bi_handle, &desc->hdr, data);
        ddi_put32(qbuf->qb_buf.bi_handle, &desc->data_addr, 0);
        ddi_put32(qbuf->qb_buf.bi_handle, &desc->branch, 0);
        ddi_put32(qbuf->qb_buf.bi_handle, &desc->status, cmd->qc_timestamp);

        /*
         * Copy in 1394 header. Size is in bytes, convert it to a 32-bit word
         * count.
         */
        ddi_rep_put32(qbuf->qb_buf.bi_handle, &hdr->q1, &desc->q1,
            hdrsize >> 2, DDI_DEV_AUTOINCR);

        /*
         * We wrote 2 16 byte blocks in the descriptor buffer, update the count
         * accordingly.  Update the reserved size and current pointer.
         */
        q_handle->q_block_cnt += 2;
        qbuf->qb_ptrs.qp_resv_size -= sizeof (hci1394_desc_imm_t);
        qbuf->qb_ptrs.qp_current += sizeof (hci1394_desc_imm_t);
}


/*
 * hci1394_q_at_write_OLI()
 *    Write an OLI descriptor into the AT descriptor buffer passed in as qbuf.
 *    Buffer state information is stored in cmd.  Use the hdr and hdr size for
 *    the additional information attached to an immediate descriptor.
 */
void
hci1394_q_at_write_OLI(hci1394_q_handle_t q_handle, hci1394_q_buf_t *qbuf,
    hci1394_q_cmd_t *cmd, hci1394_basic_pkt_t *hdr, uint_t hdrsize)
{
        hci1394_desc_imm_t *desc;
        uint32_t data;
        uint32_t command_ptr;
        uint32_t tcode;


        ASSERT(qbuf != NULL);
        ASSERT(cmd != NULL);
        ASSERT(hdr != NULL);
        ASSERT(MUTEX_HELD(&q_handle->q_mutex));

        /* The only valid "header" sizes for an OLI are 8, 12, 16 bytes */
        ASSERT((hdrsize == 8) || (hdrsize == 12) || (hdrsize == 16));

        /* make sure enough room for 1 OLI */
        ASSERT(qbuf->qb_ptrs.qp_resv_size >= sizeof (hci1394_desc_imm_t));

        /* Store the offset of the top of this descriptor block */
        qbuf->qb_ptrs.qp_offset = (uint32_t)(qbuf->qb_ptrs.qp_current -
            qbuf->qb_ptrs.qp_begin);

        /* Setup OpenHCI OLI Header */
        desc = (hci1394_desc_imm_t *)qbuf->qb_ptrs.qp_current;
        data = DESC_AT_OLI | (hdrsize & DESC_HDR_REQCOUNT_MASK);
        ddi_put32(qbuf->qb_buf.bi_handle, &desc->hdr, data);
        ddi_put32(qbuf->qb_buf.bi_handle, &desc->data_addr, 0);
        ddi_put32(qbuf->qb_buf.bi_handle, &desc->branch, 0);
        ddi_put32(qbuf->qb_buf.bi_handle, &desc->status, cmd->qc_timestamp);

        /* Setup 1394 Header */
        tcode = (hdr->q1 & DESC_PKT_TCODE_MASK) >> DESC_PKT_TCODE_SHIFT;
        if ((tcode == IEEE1394_TCODE_WRITE_QUADLET) ||
            (tcode == IEEE1394_TCODE_READ_QUADLET_RESP)) {
                /*
                 * if the tcode = a quadlet write, move the last quadlet as
                 * 8-bit data.  All data is treated as 8-bit data (even quadlet
                 * reads and writes). Therefore, target drivers MUST take that
                 * into consideration when accessing device registers.
                 */
                ddi_rep_put32(qbuf->qb_buf.bi_handle, &hdr->q1, &desc->q1, 3,
                    DDI_DEV_AUTOINCR);
                ddi_rep_put8(qbuf->qb_buf.bi_handle, (uint8_t *)&hdr->q4,
                    (uint8_t *)&desc->q4, 4, DDI_DEV_AUTOINCR);
        } else {
                ddi_rep_put32(qbuf->qb_buf.bi_handle, &hdr->q1, &desc->q1,
                    hdrsize >> 2, DDI_DEV_AUTOINCR);
        }

        /*
         * We wrote 2 16 byte blocks in the descriptor buffer, update the count
         * accordingly.
         */
        q_handle->q_block_cnt += 2;

        /*
         * Sync buffer in case DMA engine currently running. This must be done
         * before writing the command pointer in the previous descriptor.
         */
        (void) ddi_dma_sync(qbuf->qb_buf.bi_dma_handle, 0,
            qbuf->qb_buf.bi_length, DDI_DMA_SYNC_FORDEV);

        /* save away the status address for quick access in at_next() */
        cmd->qc_status_addr = &desc->status;

        /*
         * Setup the command pointer.  This tells the HW where to get the
         * descriptor we just setup.  This includes the IO address along with
         * a 4 bit 16 byte block count
         */
        command_ptr = (uint32_t)((qbuf->qb_cookie[qbuf->qb_ptrs.qp_current_buf
            ].dmac_address + qbuf->qb_ptrs.qp_offset) | (q_handle->q_block_cnt &
            DESC_Z_MASK));

        /*
         * if we previously setup a descriptor, add this new descriptor into
         * the previous descriptor's "next" pointer.
         */
        if (q_handle->q_previous != NULL) {
                ddi_put32(qbuf->qb_buf.bi_handle, &q_handle->q_previous->branch,
                    command_ptr);
                /* Sync buffer again, this gets the command pointer */
                (void) ddi_dma_sync(qbuf->qb_buf.bi_dma_handle, 0,
                    qbuf->qb_buf.bi_length, DDI_DMA_SYNC_FORDEV);
        }

        /*
         * this is now the previous descriptor.  Update the current pointer,
         * clear the block count and reserved size since this is the end of
         * this command.
         */
        q_handle->q_previous = (hci1394_desc_t *)desc;
        qbuf->qb_ptrs.qp_current += sizeof (hci1394_desc_imm_t);
        q_handle->q_block_cnt = 0;
        qbuf->qb_ptrs.qp_resv_size = 0;

        /* save away cleanup info when we are done with the command */
        cmd->qc_descriptor_buf = qbuf->qb_ptrs.qp_current_buf;
        cmd->qc_descriptor_end = qbuf->qb_ptrs.qp_current - 1;

        /* If the DMA is not running, start it */
        if (q_handle->q_dma_running == B_FALSE) {
                q_handle->q_info.qi_start(q_handle->q_info.qi_callback_arg,
                    command_ptr);
                q_handle->q_dma_running = B_TRUE;
        /* the DMA is running, wake it up */
        } else {
                q_handle->q_info.qi_wake(q_handle->q_info.qi_callback_arg);
        }
}


/*
 * hci1394_q_at_write_OL()
 *    Write an OL descriptor into the AT descriptor buffer passed in as qbuf.
 *    Buffer state information is stored in cmd.  The IO address of the data
 *    buffer is passed in io_addr.  Size is the size of the data to be
 *    transferred.
 */
void
hci1394_q_at_write_OL(hci1394_q_handle_t q_handle, hci1394_q_buf_t *qbuf,
    hci1394_q_cmd_t *cmd, uint32_t io_addr, uint_t size)
{
        hci1394_desc_t *desc;
        uint32_t data;
        uint32_t command_ptr;


        ASSERT(q_handle != NULL);
        ASSERT(qbuf != NULL);
        ASSERT(cmd != NULL);
        ASSERT(MUTEX_HELD(&q_handle->q_mutex));

        /* make sure enough room for OL */
        ASSERT(qbuf->qb_ptrs.qp_resv_size >= sizeof (hci1394_desc_t));

        /* Setup OpenHCI OL Header */
        desc = (hci1394_desc_t *)qbuf->qb_ptrs.qp_current;
        data = DESC_AT_OL | (size & DESC_HDR_REQCOUNT_MASK);
        ddi_put32(qbuf->qb_buf.bi_handle, &desc->hdr, data);
        ddi_put32(qbuf->qb_buf.bi_handle, &desc->data_addr, io_addr);
        ddi_put32(qbuf->qb_buf.bi_handle, &desc->branch, 0);
        ddi_put32(qbuf->qb_buf.bi_handle, &desc->status, 0);

        /*
         * We wrote 1 16 byte block in the descriptor buffer, update the count
         * accordingly.
         */
        q_handle->q_block_cnt++;

        /*
         * Sync buffer in case DMA engine currently running. This must be done
         * before writing the command pointer in the previous descriptor.
         */
        (void) ddi_dma_sync(qbuf->qb_buf.bi_dma_handle, 0,
            qbuf->qb_buf.bi_length, DDI_DMA_SYNC_FORDEV);

        /* save away the status address for quick access in at_next() */
        cmd->qc_status_addr = &desc->status;

        /*
         * Setup the command pointer.  This tells the HW where to get the
         * descriptor we just setup.  This includes the IO address along with
         * a 4 bit 16 byte block count
         */
        command_ptr = (uint32_t)((qbuf->qb_cookie[qbuf->qb_ptrs.qp_current_buf
            ].dmac_address + qbuf->qb_ptrs.qp_offset) | (q_handle->q_block_cnt &
            DESC_Z_MASK));

        /*
         * if we previously setup a descriptor, add this new descriptor into
         * the previous descriptor's "next" pointer.
         */
        if (q_handle->q_previous != NULL) {
                ddi_put32(qbuf->qb_buf.bi_handle, &q_handle->q_previous->branch,
                    command_ptr);
                /* Sync buffer again, this gets the command pointer */
                (void) ddi_dma_sync(qbuf->qb_buf.bi_dma_handle, 0,
                    qbuf->qb_buf.bi_length, DDI_DMA_SYNC_FORDEV);
        }

        /*
         * this is now the previous descriptor.  Update the current pointer,
         * clear the block count and reserved size since this is the end of
         * this command.
         */
        q_handle->q_previous = desc;
        qbuf->qb_ptrs.qp_current += sizeof (hci1394_desc_t);
        q_handle->q_block_cnt = 0;
        qbuf->qb_ptrs.qp_resv_size = 0;

        /* save away cleanup info when we are done with the command */
        cmd->qc_descriptor_buf = qbuf->qb_ptrs.qp_current_buf;
        cmd->qc_descriptor_end = qbuf->qb_ptrs.qp_current - 1;

        /* If the DMA is not running, start it */
        if (q_handle->q_dma_running == B_FALSE) {
                q_handle->q_info.qi_start(q_handle->q_info.qi_callback_arg,
                    command_ptr);
                q_handle->q_dma_running = B_TRUE;
        /* the DMA is running, wake it up */
        } else {
                q_handle->q_info.qi_wake(q_handle->q_info.qi_callback_arg);
        }
}


/*
 * hci1394_q_at_rep_put8()
 *    Copy a byte stream from a kernel virtual address (data) to a IO mapped
 *    data buffer (qbuf).  Copy datasize bytes.  State information for the
 *    data buffer is kept in cmd.
 */
void
hci1394_q_at_rep_put8(hci1394_q_buf_t *qbuf, hci1394_q_cmd_t *cmd,
    uint8_t *data, uint_t datasize)
{
        ASSERT(qbuf != NULL);
        ASSERT(cmd != NULL);
        ASSERT(data != NULL);

        /* Make sure enough room for data */
        ASSERT(qbuf->qb_ptrs.qp_resv_size >= datasize);

        /* Copy in data into the data buffer */
        ddi_rep_put8(qbuf->qb_buf.bi_handle, data,
            (uint8_t *)qbuf->qb_ptrs.qp_current, datasize, DDI_DEV_AUTOINCR);

        /* Update the current pointer, offset, and reserved size */
        qbuf->qb_ptrs.qp_current += datasize;
        qbuf->qb_ptrs.qp_offset = (uint32_t)(qbuf->qb_ptrs.qp_current -
            qbuf->qb_ptrs.qp_begin);
        qbuf->qb_ptrs.qp_resv_size -= datasize;

        /* save away cleanup info when we are done with the command */
        cmd->qc_data_used = B_TRUE;
        cmd->qc_data_buf = qbuf->qb_ptrs.qp_current_buf;
        cmd->qc_data_end = qbuf->qb_ptrs.qp_current - 1;

        /* Sync data buffer */
        (void) ddi_dma_sync(qbuf->qb_buf.bi_dma_handle, 0,
            qbuf->qb_buf.bi_length, DDI_DMA_SYNC_FORDEV);
}


/*
 * hci1394_q_at_copy_from_mblk()
 *    Copy a byte stream from a mblk(s) to a IO mapped data buffer (qbuf).
 *    Copy mblk->length bytes. The services layer and the hal use a private
 *    structure (h1394_mblk_t) to keep track of how much of the mblk to send
 *    since we may have to break the transfer up into smaller blocks. (i.e. a
 *    1MByte block write would go out in 2KByte chunks. State information for
 *    the data buffer is kept in cmd.
 */
static void
hci1394_q_at_copy_from_mblk(hci1394_q_buf_t *qbuf, hci1394_q_cmd_t *cmd,
    h1394_mblk_t *mblk)
{
        uint_t bytes_left;
        uint_t length;


        ASSERT(qbuf != NULL);
        ASSERT(cmd != NULL);
        ASSERT(mblk != NULL);

        /* We return these variables to the Services Layer when we are done */
        mblk->next_offset = mblk->curr_offset;
        mblk->next_mblk = mblk->curr_mblk;
        bytes_left = mblk->length;

        /* do while there are bytes left to copy */
        do {
                /*
                 * If the entire data portion of the current block transfer is
                 * contained within a single mblk.
                 */
                if ((mblk->next_offset + bytes_left) <=
                    (mblk->next_mblk->b_wptr)) {
                        /* Copy the data into the data Q */
                        hci1394_q_at_rep_put8(qbuf, cmd,
                            (uint8_t *)mblk->next_offset, bytes_left);

                        /* increment the mblk offset */
                        mblk->next_offset += bytes_left;

                        /* we have no more bytes to put into the buffer */
                        bytes_left = 0;

                        /*
                         * If our offset is at the end of data in this mblk, go
                         * to the next mblk.
                         */
                        if (mblk->next_offset >= mblk->next_mblk->b_wptr) {
                                mblk->next_mblk = mblk->next_mblk->b_cont;
                                if (mblk->next_mblk != NULL) {
                                        mblk->next_offset =
                                            mblk->next_mblk->b_rptr;
                                }
                        }

                /*
                 * The data portion of the current block transfer is spread
                 * across two or more mblk's
                 */
                } else {
                        /*
                         * Figure out how much data is in this mblk.
                         */
                        length = mblk->next_mblk->b_wptr - mblk->next_offset;

                        /* Copy the data into the atreq data Q */
                        hci1394_q_at_rep_put8(qbuf, cmd,
                            (uint8_t *)mblk->next_offset, length);

                        /* update the bytes left count, go to the next mblk */
                        bytes_left = bytes_left - length;
                        mblk->next_mblk = mblk->next_mblk->b_cont;
                        ASSERT(mblk->next_mblk != NULL);
                        mblk->next_offset = mblk->next_mblk->b_rptr;
                }
        } while (bytes_left > 0);
}


/*
 * hci1394_q_ar_next()
 *    Return an address to the next received AR packet.  If there are no more
 *    AR packets in the buffer, q_addr will be set to NULL.
 */
void
hci1394_q_ar_next(hci1394_q_handle_t q_handle, uint32_t **q_addr)
{
        hci1394_desc_t *desc;
        hci1394_q_buf_t *descb;
        hci1394_q_buf_t *datab;
        uint32_t residual_count;


        ASSERT(q_handle != NULL);
        ASSERT(q_addr != NULL);

        descb = &q_handle->q_desc;
        datab = &q_handle->q_data;

        /* Sync Descriptor buffer */
        (void) ddi_dma_sync(descb->qb_buf.bi_dma_handle, 0,
            descb->qb_buf.bi_length, DDI_DMA_SYNC_FORKERNEL);

        /*
         * Check residual in current IM count vs q_space_left to see if we have
         * received any more responses
         */
        desc = (hci1394_desc_t *)q_handle->q_head;
        residual_count = ddi_get32(descb->qb_buf.bi_handle, &desc->status);
        residual_count &= DESC_ST_RESCOUNT_MASK;
        if (residual_count >= q_handle->q_space_left) {
                /* No new packets received */
                *q_addr = NULL;
                return;
        }

        /* Sync Data Q */
        (void) ddi_dma_sync(datab->qb_buf.bi_dma_handle, 0,
            datab->qb_buf.bi_length, DDI_DMA_SYNC_FORKERNEL);

        /*
         * We have a new packet, return the address of the start of the
         * packet.
         */
        *q_addr = (uint32_t *)datab->qb_ptrs.qp_current;
}


/*
 * hci1394_q_ar_free()
 *    Free the space used by the AR packet at the top of the data buffer. AR
 *    packets are processed in the order that they are received.  This will
 *    free the oldest received packet which has not yet been freed.  size is
 *    how much space the packet takes up.
 */
void
hci1394_q_ar_free(hci1394_q_handle_t q_handle, uint_t size)
{
        hci1394_q_buf_t *descb;
        hci1394_q_buf_t *datab;


        ASSERT(q_handle != NULL);

        descb = &q_handle->q_desc;
        datab = &q_handle->q_data;

        /*
         * Packet is in multiple buffers. Theoretically a buffer could be broken
         * in more than two buffers for an ARRESP.  Since the buffers should be
         * in at least 4K increments this will not happen since the max packet
         * size is 2KBytes.
         */
        if ((datab->qb_ptrs.qp_current + size) > datab->qb_ptrs.qp_end) {
                /* Add IM descriptor for used buffer back into Q */
                hci1394_q_ar_write_IM(q_handle, descb,
                    datab->qb_cookie[datab->qb_ptrs.qp_current_buf
                    ].dmac_address,
                    datab->qb_cookie[datab->qb_ptrs.qp_current_buf].dmac_size);

                /* Go to the next buffer */
                hci1394_q_next_buf(datab);

                /* Update next buffers pointers for partial packet */
                size -= q_handle->q_space_left;
                datab->qb_ptrs.qp_current += size;
                q_handle->q_space_left =
                    datab->qb_cookie[datab->qb_ptrs.qp_current_buf].dmac_size -
                    size;

                /* Change the head pointer to the next IM descriptor */
                q_handle->q_head += sizeof (hci1394_desc_t);
                if ((q_handle->q_head + sizeof (hci1394_desc_t)) >
                    (descb->qb_ptrs.qp_bottom + 1)) {
                        q_handle->q_head = descb->qb_ptrs.qp_top;
                }

        /* Packet is only in one buffer */
        } else {
                q_handle->q_space_left -= size;
                datab->qb_ptrs.qp_current += size;
        }
}


/*
 * hci1394_q_ar_get32()
 *    Read a quadlet of data regardless if it is in the current buffer or has
 *    wrapped to the top buffer.  If the address passed to this routine is
 *    passed the bottom of the data buffer, this routine will automatically
 *    wrap back to the top of the Q and look in the correct offset from the
 *    top. Copy the data into the kernel virtual address provided.
 */
uint32_t
hci1394_q_ar_get32(hci1394_q_handle_t q_handle, uint32_t *addr)
{
        hci1394_q_buf_t *data;
        uintptr_t new_addr;
        uint32_t data32;


        ASSERT(q_handle != NULL);
        ASSERT(addr != NULL);

        data = &q_handle->q_data;

        /*
         * if the data has wrapped to the top of the buffer, adjust the address.
         */
        if ((uintptr_t)addr > (uintptr_t)data->qb_ptrs.qp_bottom) {
                new_addr = (uintptr_t)data->qb_ptrs.qp_top + ((uintptr_t)addr -
                    ((uintptr_t)data->qb_ptrs.qp_bottom + (uintptr_t)1));
                data32 = ddi_get32(data->qb_buf.bi_handle,
                    (uint32_t *)new_addr);

        /* data is before end of buffer */
        } else {
                data32 = ddi_get32(data->qb_buf.bi_handle, addr);
        }

        return (data32);
}


/*
 * hci1394_q_ar_rep_get8()
 *    Read a byte stream of data regardless if it is contiguous or has partially
 *    or fully wrapped to the top buffer.  If the address passed to this routine
 *    is passed the bottom of the data buffer, or address + size is past the
 *    bottom of the data buffer. this routine will automatically wrap back to
 *    the top of the Q and look in the correct offset from the top. Copy the
 *    data into the kernel virtual address provided.
 */
void
hci1394_q_ar_rep_get8(hci1394_q_handle_t q_handle, uint8_t *dest,
    uint8_t *q_addr, uint_t size)
{
        hci1394_q_buf_t *data;
        uintptr_t new_addr;
        uint_t new_size;
        uintptr_t new_dest;


        ASSERT(q_handle != NULL);
        ASSERT(dest != NULL);
        ASSERT(q_addr != NULL);

        data = &q_handle->q_data;

        /*
         * There are three cases:
         *   1) All of the data has wrapped.
         *   2) Some of the data has not wrapped and some has wrapped.
         *   3) None of the data has wrapped.
         */

        /* All of the data has wrapped, just adjust the starting address */
        if ((uintptr_t)q_addr > (uintptr_t)data->qb_ptrs.qp_bottom) {
                new_addr = (uintptr_t)data->qb_ptrs.qp_top +
                    ((uintptr_t)q_addr - ((uintptr_t)data->qb_ptrs.qp_bottom +
                    (uintptr_t)1));
                ddi_rep_get8(data->qb_buf.bi_handle, dest, (uint8_t *)new_addr,
                    size, DDI_DEV_AUTOINCR);

        /*
         * Some of the data has wrapped. Copy the data that hasn't wrapped,
         * adjust the address, then copy the rest.
         */
        } else if (((uintptr_t)q_addr + (uintptr_t)size) >
            ((uintptr_t)data->qb_ptrs.qp_bottom + (uintptr_t)1)) {
                /* Copy first half */
                new_size = (uint_t)(((uintptr_t)data->qb_ptrs.qp_bottom +
                    (uintptr_t)1) - (uintptr_t)q_addr);
                ddi_rep_get8(data->qb_buf.bi_handle, dest, q_addr, new_size,
                    DDI_DEV_AUTOINCR);

                /* copy second half */
                new_dest = (uintptr_t)dest + (uintptr_t)new_size;
                new_size = size - new_size;
                new_addr = (uintptr_t)data->qb_ptrs.qp_top;
                ddi_rep_get8(data->qb_buf.bi_handle, (uint8_t *)new_dest,
                    (uint8_t *)new_addr, new_size, DDI_DEV_AUTOINCR);

        /* None of the data has wrapped */
        } else {
                ddi_rep_get8(data->qb_buf.bi_handle, dest, q_addr, size,
                    DDI_DEV_AUTOINCR);
        }
}


/*
 * hci1394_q_ar_copy_to_mblk()
 *    Read a byte stream of data regardless if it is contiguous or has partially
 *    or fully wrapped to the top buffer.  If the address passed to this routine
 *    is passed the bottom of the data buffer, or address + size is passed the
 *    bottom of the data buffer. this routine will automatically wrap back to
 *    the top of the Q and look in the correct offset from the top. Copy the
 *    data into the mblk provided. The services layer and the hal use a private
 *    structure (h1394_mblk_t) to keep track of how much of the mblk to receive
 *    into since we may have to break the transfer up into smaller blocks.
 *    (i.e. a 1MByte block read would go out in 2KByte requests.
 */
void
hci1394_q_ar_copy_to_mblk(hci1394_q_handle_t q_handle, uint8_t *addr,
    h1394_mblk_t *mblk)
{
        uint8_t *new_addr;
        uint_t bytes_left;
        uint_t length;


        ASSERT(q_handle != NULL);
        ASSERT(addr != NULL);
        ASSERT(mblk != NULL);

        /* We return these variables to the Services Layer when we are done */
        mblk->next_offset = mblk->curr_offset;
        mblk->next_mblk = mblk->curr_mblk;
        bytes_left = mblk->length;

        /* the address we copy from will change as we change mblks */
        new_addr = addr;

        /* do while there are bytes left to copy */
        do {
                /*
                 * If the entire data portion of the current block transfer is
                 * contained within a single mblk.
                 */
                if ((mblk->next_offset + bytes_left) <=
                    (mblk->next_mblk->b_datap->db_lim)) {
                        /* Copy the data into the mblk */
                        hci1394_q_ar_rep_get8(q_handle,
                            (uint8_t *)mblk->next_offset, new_addr, bytes_left);

                        /* increment the offset */
                        mblk->next_offset += bytes_left;
                        mblk->next_mblk->b_wptr = mblk->next_offset;

                        /* we have no more bytes to put into the buffer */
                        bytes_left = 0;

                        /*
                         * If our offset is at the end of data in this mblk, go
                         * to the next mblk.
                         */
                        if (mblk->next_offset >=
                            mblk->next_mblk->b_datap->db_lim) {
                                mblk->next_mblk = mblk->next_mblk->b_cont;
                                if (mblk->next_mblk != NULL) {
                                        mblk->next_offset =
                                            mblk->next_mblk->b_wptr;
                                }
                        }

                /*
                 * The data portion of the current block transfer is spread
                 * across two or more mblk's
                 */
                } else {
                        /* Figure out how much data is in this mblk */
                        length = mblk->next_mblk->b_datap->db_lim -
                            mblk->next_offset;

                        /* Copy the data into the mblk */
                        hci1394_q_ar_rep_get8(q_handle,
                            (uint8_t *)mblk->next_offset, new_addr, length);
                        mblk->next_mblk->b_wptr =
                            mblk->next_mblk->b_datap->db_lim;

                        /*
                         * update the bytes left and address to copy from, go
                         * to the next mblk.
                         */
                        bytes_left = bytes_left - length;
                        new_addr = (uint8_t *)((uintptr_t)new_addr +
                            (uintptr_t)length);
                        mblk->next_mblk = mblk->next_mblk->b_cont;
                        ASSERT(mblk->next_mblk != NULL);
                        mblk->next_offset = mblk->next_mblk->b_wptr;
                }
        } while (bytes_left > 0);
}


/*
 * hci1394_q_ar_write_IM()
 *    Write an IM descriptor into the AR descriptor buffer passed in as qbuf.
 *    The IO address of the data buffer is passed in io_addr.  datasize is the
 *    size of the data data buffer to receive into.
 */
void
hci1394_q_ar_write_IM(hci1394_q_handle_t q_handle, hci1394_q_buf_t *qbuf,
    uint32_t io_addr, uint_t datasize)
{
        hci1394_desc_t *desc;
        uint32_t data;
        uint32_t command_ptr;


        ASSERT(q_handle != NULL);
        ASSERT(qbuf != NULL);

        /* Make sure enough room for IM */
        if ((qbuf->qb_ptrs.qp_current + sizeof (hci1394_desc_t)) >
            (qbuf->qb_ptrs.qp_bottom + 1)) {
                hci1394_q_next_buf(qbuf);
        } else {
                /* Store the offset of the top of this descriptor block */
                qbuf->qb_ptrs.qp_offset = (uint32_t)(qbuf->qb_ptrs.qp_current -
                    qbuf->qb_ptrs.qp_begin);
        }

        /* Setup OpenHCI IM Header */
        desc = (hci1394_desc_t *)qbuf->qb_ptrs.qp_current;
        data = DESC_AR_IM | (datasize & DESC_HDR_REQCOUNT_MASK);
        ddi_put32(qbuf->qb_buf.bi_handle, &desc->hdr, data);
        ddi_put32(qbuf->qb_buf.bi_handle, &desc->data_addr, io_addr);
        ddi_put32(qbuf->qb_buf.bi_handle, &desc->branch, 0);
        ddi_put32(qbuf->qb_buf.bi_handle, &desc->status, datasize &
            DESC_ST_RESCOUNT_MASK);

        /*
         * Sync buffer in case DMA engine currently running. This must be done
         * before writing the command pointer in the previous descriptor.
         */
        (void) ddi_dma_sync(qbuf->qb_buf.bi_dma_handle, 0,
            qbuf->qb_buf.bi_length, DDI_DMA_SYNC_FORDEV);

        /*
         * Setup the command pointer.  This tells the HW where to get the
         * descriptor we just setup.  This includes the IO address along with
         * a 4 bit 16 byte block count.  We only wrote 1 16 byte block.
         */
        command_ptr = (uint32_t)((qbuf->qb_cookie[qbuf->qb_ptrs.qp_current_buf
            ].dmac_address + qbuf->qb_ptrs.qp_offset) | 1);

        /*
         * if we previously setup a descriptor, add this new descriptor into
         * the previous descriptor's "next" pointer.
         */
        if (q_handle->q_previous != NULL) {
                ddi_put32(qbuf->qb_buf.bi_handle,
                    &q_handle->q_previous->branch, command_ptr);
                /* Sync buffer again, this gets the command pointer */
                (void) ddi_dma_sync(qbuf->qb_buf.bi_dma_handle, 0,
                    qbuf->qb_buf.bi_length, DDI_DMA_SYNC_FORDEV);
        }

        /* this is the new previous descriptor.  Update the current pointer */
        q_handle->q_previous = desc;
        qbuf->qb_ptrs.qp_current += sizeof (hci1394_desc_t);

        /* If the DMA is not running, start it */
        if (q_handle->q_dma_running == B_FALSE) {
                q_handle->q_info.qi_start(q_handle->q_info.qi_callback_arg,
                    command_ptr);
                q_handle->q_dma_running = B_TRUE;
        /* the DMA is running, wake it up */
        } else {
                q_handle->q_info.qi_wake(q_handle->q_info.qi_callback_arg);
        }
}