xref: /titanic_41/usr/src/uts/i86pc/io/rootnex.c (revision 2df1fe9ca32bb227b9158c67f5c00b54c20b10fd)
1 /*
2  * CDDL HEADER START
3  *
4  * The contents of this file are subject to the terms of the
5  * Common Development and Distribution License (the "License").
6  * You may not use this file except in compliance with the License.
7  *
8  * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
9  * or http://www.opensolaris.org/os/licensing.
10  * See the License for the specific language governing permissions
11  * and limitations under the License.
12  *
13  * When distributing Covered Code, include this CDDL HEADER in each
14  * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
15  * If applicable, add the following below this CDDL HEADER, with the
16  * fields enclosed by brackets "[]" replaced with your own identifying
17  * information: Portions Copyright [yyyy] [name of copyright owner]
18  *
19  * CDDL HEADER END
20  */
21 /*
22  * Copyright 2007 Sun Microsystems, Inc.  All rights reserved.
23  * Use is subject to license terms.
24  */
25 
26 #pragma ident	"%Z%%M%	%I%	%E% SMI"
27 
28 /*
29  * x86 root nexus driver
30  */
31 
32 #include <sys/sysmacros.h>
33 #include <sys/conf.h>
34 #include <sys/autoconf.h>
35 #include <sys/sysmacros.h>
36 #include <sys/debug.h>
37 #include <sys/psw.h>
38 #include <sys/ddidmareq.h>
39 #include <sys/promif.h>
40 #include <sys/devops.h>
41 #include <sys/kmem.h>
42 #include <sys/cmn_err.h>
43 #include <vm/seg.h>
44 #include <vm/seg_kmem.h>
45 #include <vm/seg_dev.h>
46 #include <sys/vmem.h>
47 #include <sys/mman.h>
48 #include <vm/hat.h>
49 #include <vm/as.h>
50 #include <vm/page.h>
51 #include <sys/avintr.h>
52 #include <sys/errno.h>
53 #include <sys/modctl.h>
54 #include <sys/ddi_impldefs.h>
55 #include <sys/sunddi.h>
56 #include <sys/sunndi.h>
57 #include <sys/mach_intr.h>
58 #include <sys/psm.h>
59 #include <sys/ontrap.h>
60 #include <sys/atomic.h>
61 #include <sys/sdt.h>
62 #include <sys/rootnex.h>
63 #include <vm/hat_i86.h>
64 #include <sys/ddifm.h>
65 #include <sys/ddi_isa.h>
66 
67 #ifdef __xpv
68 #include <sys/bootinfo.h>
69 #include <sys/hypervisor.h>
70 #include <sys/bootconf.h>
71 #include <vm/kboot_mmu.h>
72 #endif
73 
74 /*
75  * enable/disable extra checking of function parameters. Useful for debugging
76  * drivers.
77  */
78 #ifdef	DEBUG
79 int rootnex_alloc_check_parms = 1;
80 int rootnex_bind_check_parms = 1;
81 int rootnex_bind_check_inuse = 1;
82 int rootnex_unbind_verify_buffer = 0;
83 int rootnex_sync_check_parms = 1;
84 #else
85 int rootnex_alloc_check_parms = 0;
86 int rootnex_bind_check_parms = 0;
87 int rootnex_bind_check_inuse = 0;
88 int rootnex_unbind_verify_buffer = 0;
89 int rootnex_sync_check_parms = 0;
90 #endif
91 
92 /* Master Abort and Target Abort panic flag */
93 int rootnex_fm_ma_ta_panic_flag = 0;
94 
95 /* Semi-temporary patchables to phase in bug fixes, test drivers, etc. */
96 int rootnex_bind_fail = 1;
97 int rootnex_bind_warn = 1;
98 uint8_t *rootnex_warn_list;
99 /* bitmasks for rootnex_warn_list. Up to 8 different warnings with uint8_t */
100 #define	ROOTNEX_BIND_WARNING	(0x1 << 0)
101 
102 /*
103  * revert back to old broken behavior of always sync'ing entire copy buffer.
104  * This is useful if be have a buggy driver which doesn't correctly pass in
105  * the offset and size into ddi_dma_sync().
106  */
107 int rootnex_sync_ignore_params = 0;
108 
109 /*
110  * For the 64-bit kernel, pre-alloc enough cookies for a 256K buffer plus 1
111  * page for alignment. For the 32-bit kernel, pre-alloc enough cookies for a
112  * 64K buffer plus 1 page for alignment (we have less kernel space in a 32-bit
113  * kernel). Allocate enough windows to handle a 256K buffer w/ at least 65
114  * sgllen DMA engine, and enough copybuf buffer state pages to handle 2 pages
115  * (< 8K). We will still need to allocate the copy buffer during bind though
116  * (if we need one). These can only be modified in /etc/system before rootnex
117  * attach.
118  */
119 #if defined(__amd64)
120 int rootnex_prealloc_cookies = 65;
121 int rootnex_prealloc_windows = 4;
122 int rootnex_prealloc_copybuf = 2;
123 #else
124 int rootnex_prealloc_cookies = 33;
125 int rootnex_prealloc_windows = 4;
126 int rootnex_prealloc_copybuf = 2;
127 #endif
128 
129 /* driver global state */
130 static rootnex_state_t *rootnex_state;
131 
132 /* shortcut to rootnex counters */
133 static uint64_t *rootnex_cnt;
134 
135 /*
136  * XXX - does x86 even need these or are they left over from the SPARC days?
137  */
138 /* statically defined integer/boolean properties for the root node */
139 static rootnex_intprop_t rootnex_intprp[] = {
140 	{ "PAGESIZE",			PAGESIZE },
141 	{ "MMU_PAGESIZE",		MMU_PAGESIZE },
142 	{ "MMU_PAGEOFFSET",		MMU_PAGEOFFSET },
143 	{ DDI_RELATIVE_ADDRESSING,	1 },
144 };
145 #define	NROOT_INTPROPS	(sizeof (rootnex_intprp) / sizeof (rootnex_intprop_t))
146 
147 #ifdef __xpv
148 typedef maddr_t rootnex_addr_t;
149 #define	ROOTNEX_PADDR_TO_RBASE(xinfo, pa)	\
150 	(DOMAIN_IS_INITDOMAIN(xinfo) ? pa_to_ma(pa) : (pa))
151 #else
152 typedef paddr_t rootnex_addr_t;
153 #endif
154 
155 
156 static struct cb_ops rootnex_cb_ops = {
157 	nodev,		/* open */
158 	nodev,		/* close */
159 	nodev,		/* strategy */
160 	nodev,		/* print */
161 	nodev,		/* dump */
162 	nodev,		/* read */
163 	nodev,		/* write */
164 	nodev,		/* ioctl */
165 	nodev,		/* devmap */
166 	nodev,		/* mmap */
167 	nodev,		/* segmap */
168 	nochpoll,	/* chpoll */
169 	ddi_prop_op,	/* cb_prop_op */
170 	NULL,		/* struct streamtab */
171 	D_NEW | D_MP | D_HOTPLUG, /* compatibility flags */
172 	CB_REV,		/* Rev */
173 	nodev,		/* cb_aread */
174 	nodev		/* cb_awrite */
175 };
176 
177 static int rootnex_map(dev_info_t *dip, dev_info_t *rdip, ddi_map_req_t *mp,
178     off_t offset, off_t len, caddr_t *vaddrp);
179 static int rootnex_map_fault(dev_info_t *dip, dev_info_t *rdip,
180     struct hat *hat, struct seg *seg, caddr_t addr,
181     struct devpage *dp, pfn_t pfn, uint_t prot, uint_t lock);
182 static int rootnex_dma_map(dev_info_t *dip, dev_info_t *rdip,
183     struct ddi_dma_req *dmareq, ddi_dma_handle_t *handlep);
184 static int rootnex_dma_allochdl(dev_info_t *dip, dev_info_t *rdip,
185     ddi_dma_attr_t *attr, int (*waitfp)(caddr_t), caddr_t arg,
186     ddi_dma_handle_t *handlep);
187 static int rootnex_dma_freehdl(dev_info_t *dip, dev_info_t *rdip,
188     ddi_dma_handle_t handle);
189 static int rootnex_dma_bindhdl(dev_info_t *dip, dev_info_t *rdip,
190     ddi_dma_handle_t handle, struct ddi_dma_req *dmareq,
191     ddi_dma_cookie_t *cookiep, uint_t *ccountp);
192 static int rootnex_dma_unbindhdl(dev_info_t *dip, dev_info_t *rdip,
193     ddi_dma_handle_t handle);
194 static int rootnex_dma_sync(dev_info_t *dip, dev_info_t *rdip,
195     ddi_dma_handle_t handle, off_t off, size_t len, uint_t cache_flags);
196 static int rootnex_dma_win(dev_info_t *dip, dev_info_t *rdip,
197     ddi_dma_handle_t handle, uint_t win, off_t *offp, size_t *lenp,
198     ddi_dma_cookie_t *cookiep, uint_t *ccountp);
199 static int rootnex_dma_mctl(dev_info_t *dip, dev_info_t *rdip,
200     ddi_dma_handle_t handle, enum ddi_dma_ctlops request,
201     off_t *offp, size_t *lenp, caddr_t *objp, uint_t cache_flags);
202 static int rootnex_ctlops(dev_info_t *dip, dev_info_t *rdip,
203     ddi_ctl_enum_t ctlop, void *arg, void *result);
204 static int rootnex_fm_init(dev_info_t *dip, dev_info_t *tdip, int tcap,
205     ddi_iblock_cookie_t *ibc);
206 static int rootnex_intr_ops(dev_info_t *pdip, dev_info_t *rdip,
207     ddi_intr_op_t intr_op, ddi_intr_handle_impl_t *hdlp, void *result);
208 
209 
210 static struct bus_ops rootnex_bus_ops = {
211 	BUSO_REV,
212 	rootnex_map,
213 	NULL,
214 	NULL,
215 	NULL,
216 	rootnex_map_fault,
217 	rootnex_dma_map,
218 	rootnex_dma_allochdl,
219 	rootnex_dma_freehdl,
220 	rootnex_dma_bindhdl,
221 	rootnex_dma_unbindhdl,
222 	rootnex_dma_sync,
223 	rootnex_dma_win,
224 	rootnex_dma_mctl,
225 	rootnex_ctlops,
226 	ddi_bus_prop_op,
227 	i_ddi_rootnex_get_eventcookie,
228 	i_ddi_rootnex_add_eventcall,
229 	i_ddi_rootnex_remove_eventcall,
230 	i_ddi_rootnex_post_event,
231 	0,			/* bus_intr_ctl */
232 	0,			/* bus_config */
233 	0,			/* bus_unconfig */
234 	rootnex_fm_init,	/* bus_fm_init */
235 	NULL,			/* bus_fm_fini */
236 	NULL,			/* bus_fm_access_enter */
237 	NULL,			/* bus_fm_access_exit */
238 	NULL,			/* bus_powr */
239 	rootnex_intr_ops	/* bus_intr_op */
240 };
241 
242 static int rootnex_attach(dev_info_t *dip, ddi_attach_cmd_t cmd);
243 static int rootnex_detach(dev_info_t *dip, ddi_detach_cmd_t cmd);
244 
245 static struct dev_ops rootnex_ops = {
246 	DEVO_REV,
247 	0,
248 	ddi_no_info,
249 	nulldev,
250 	nulldev,
251 	rootnex_attach,
252 	rootnex_detach,
253 	nulldev,
254 	&rootnex_cb_ops,
255 	&rootnex_bus_ops
256 };
257 
258 static struct modldrv rootnex_modldrv = {
259 	&mod_driverops,
260 	"i86pc root nexus %I%",
261 	&rootnex_ops
262 };
263 
264 static struct modlinkage rootnex_modlinkage = {
265 	MODREV_1,
266 	(void *)&rootnex_modldrv,
267 	NULL
268 };
269 
270 
271 /*
272  *  extern hacks
273  */
274 extern struct seg_ops segdev_ops;
275 extern int ignore_hardware_nodes;	/* force flag from ddi_impl.c */
276 #ifdef	DDI_MAP_DEBUG
277 extern int ddi_map_debug_flag;
278 #define	ddi_map_debug	if (ddi_map_debug_flag) prom_printf
279 #endif
280 extern void i86_pp_map(page_t *pp, caddr_t kaddr);
281 extern void i86_va_map(caddr_t vaddr, struct as *asp, caddr_t kaddr);
282 extern int (*psm_intr_ops)(dev_info_t *, ddi_intr_handle_impl_t *,
283     psm_intr_op_t, int *);
284 extern int impl_ddi_sunbus_initchild(dev_info_t *dip);
285 extern void impl_ddi_sunbus_removechild(dev_info_t *dip);
286 
287 /*
288  * Use device arena to use for device control register mappings.
289  * Various kernel memory walkers (debugger, dtrace) need to know
290  * to avoid this address range to prevent undesired device activity.
291  */
292 extern void *device_arena_alloc(size_t size, int vm_flag);
293 extern void device_arena_free(void * vaddr, size_t size);
294 
295 
296 /*
297  *  Internal functions
298  */
299 static int rootnex_dma_init();
300 static void rootnex_add_props(dev_info_t *);
301 static int rootnex_ctl_reportdev(dev_info_t *dip);
302 static struct intrspec *rootnex_get_ispec(dev_info_t *rdip, int inum);
303 static int rootnex_map_regspec(ddi_map_req_t *mp, caddr_t *vaddrp);
304 static int rootnex_unmap_regspec(ddi_map_req_t *mp, caddr_t *vaddrp);
305 static int rootnex_map_handle(ddi_map_req_t *mp);
306 static void rootnex_clean_dmahdl(ddi_dma_impl_t *hp);
307 static int rootnex_valid_alloc_parms(ddi_dma_attr_t *attr, uint_t maxsegsize);
308 static int rootnex_valid_bind_parms(ddi_dma_req_t *dmareq,
309     ddi_dma_attr_t *attr);
310 static void rootnex_get_sgl(ddi_dma_obj_t *dmar_object, ddi_dma_cookie_t *sgl,
311     rootnex_sglinfo_t *sglinfo);
312 static int rootnex_bind_slowpath(ddi_dma_impl_t *hp, struct ddi_dma_req *dmareq,
313     rootnex_dma_t *dma, ddi_dma_attr_t *attr, int kmflag);
314 static int rootnex_setup_copybuf(ddi_dma_impl_t *hp, struct ddi_dma_req *dmareq,
315     rootnex_dma_t *dma, ddi_dma_attr_t *attr);
316 static void rootnex_teardown_copybuf(rootnex_dma_t *dma);
317 static int rootnex_setup_windows(ddi_dma_impl_t *hp, rootnex_dma_t *dma,
318     ddi_dma_attr_t *attr, int kmflag);
319 static void rootnex_teardown_windows(rootnex_dma_t *dma);
320 static void rootnex_init_win(ddi_dma_impl_t *hp, rootnex_dma_t *dma,
321     rootnex_window_t *window, ddi_dma_cookie_t *cookie, off_t cur_offset);
322 static void rootnex_setup_cookie(ddi_dma_obj_t *dmar_object,
323     rootnex_dma_t *dma, ddi_dma_cookie_t *cookie, off_t cur_offset,
324     size_t *copybuf_used, page_t **cur_pp);
325 static int rootnex_sgllen_window_boundary(ddi_dma_impl_t *hp,
326     rootnex_dma_t *dma, rootnex_window_t **windowp, ddi_dma_cookie_t *cookie,
327     ddi_dma_attr_t *attr, off_t cur_offset);
328 static int rootnex_copybuf_window_boundary(ddi_dma_impl_t *hp,
329     rootnex_dma_t *dma, rootnex_window_t **windowp,
330     ddi_dma_cookie_t *cookie, off_t cur_offset, size_t *copybuf_used);
331 static int rootnex_maxxfer_window_boundary(ddi_dma_impl_t *hp,
332     rootnex_dma_t *dma, rootnex_window_t **windowp, ddi_dma_cookie_t *cookie);
333 static int rootnex_valid_sync_parms(ddi_dma_impl_t *hp, rootnex_window_t *win,
334     off_t offset, size_t size, uint_t cache_flags);
335 static int rootnex_verify_buffer(rootnex_dma_t *dma);
336 static int rootnex_dma_check(dev_info_t *dip, const void *handle,
337     const void *comp_addr, const void *not_used);
338 
339 /*
340  * _init()
341  *
342  */
343 int
344 _init(void)
345 {
346 
347 	rootnex_state = NULL;
348 	return (mod_install(&rootnex_modlinkage));
349 }
350 
351 
352 /*
353  * _info()
354  *
355  */
356 int
357 _info(struct modinfo *modinfop)
358 {
359 	return (mod_info(&rootnex_modlinkage, modinfop));
360 }
361 
362 
363 /*
364  * _fini()
365  *
366  */
367 int
368 _fini(void)
369 {
370 	return (EBUSY);
371 }
372 
373 
374 /*
375  * rootnex_attach()
376  *
377  */
378 static int
379 rootnex_attach(dev_info_t *dip, ddi_attach_cmd_t cmd)
380 {
381 	int fmcap;
382 	int e;
383 
384 	switch (cmd) {
385 	case DDI_ATTACH:
386 		break;
387 	case DDI_RESUME:
388 		return (DDI_SUCCESS);
389 	default:
390 		return (DDI_FAILURE);
391 	}
392 
393 	/*
394 	 * We should only have one instance of rootnex. Save it away since we
395 	 * don't have an easy way to get it back later.
396 	 */
397 	ASSERT(rootnex_state == NULL);
398 	rootnex_state = kmem_zalloc(sizeof (rootnex_state_t), KM_SLEEP);
399 
400 	rootnex_state->r_dip = dip;
401 	rootnex_state->r_err_ibc = (ddi_iblock_cookie_t)ipltospl(15);
402 	rootnex_state->r_reserved_msg_printed = B_FALSE;
403 	rootnex_cnt = &rootnex_state->r_counters[0];
404 
405 	/*
406 	 * Set minimum fm capability level for i86pc platforms and then
407 	 * initialize error handling. Since we're the rootnex, we don't
408 	 * care what's returned in the fmcap field.
409 	 */
410 	ddi_system_fmcap = DDI_FM_EREPORT_CAPABLE | DDI_FM_ERRCB_CAPABLE |
411 	    DDI_FM_ACCCHK_CAPABLE | DDI_FM_DMACHK_CAPABLE;
412 	fmcap = ddi_system_fmcap;
413 	ddi_fm_init(dip, &fmcap, &rootnex_state->r_err_ibc);
414 
415 	/* initialize DMA related state */
416 	e = rootnex_dma_init();
417 	if (e != DDI_SUCCESS) {
418 		kmem_free(rootnex_state, sizeof (rootnex_state_t));
419 		return (DDI_FAILURE);
420 	}
421 
422 	/* Add static root node properties */
423 	rootnex_add_props(dip);
424 
425 	/* since we can't call ddi_report_dev() */
426 	cmn_err(CE_CONT, "?root nexus = %s\n", ddi_get_name(dip));
427 
428 	/* Initialize rootnex event handle */
429 	i_ddi_rootnex_init_events(dip);
430 
431 	return (DDI_SUCCESS);
432 }
433 
434 
435 /*
436  * rootnex_detach()
437  *
438  */
439 /*ARGSUSED*/
440 static int
441 rootnex_detach(dev_info_t *dip, ddi_detach_cmd_t cmd)
442 {
443 	switch (cmd) {
444 	case DDI_SUSPEND:
445 		break;
446 	default:
447 		return (DDI_FAILURE);
448 	}
449 
450 	return (DDI_SUCCESS);
451 }
452 
453 
454 /*
455  * rootnex_dma_init()
456  *
457  */
458 /*ARGSUSED*/
459 static int
460 rootnex_dma_init()
461 {
462 	size_t bufsize;
463 
464 
465 	/*
466 	 * size of our cookie/window/copybuf state needed in dma bind that we
467 	 * pre-alloc in dma_alloc_handle
468 	 */
469 	rootnex_state->r_prealloc_cookies = rootnex_prealloc_cookies;
470 	rootnex_state->r_prealloc_size =
471 	    (rootnex_state->r_prealloc_cookies * sizeof (ddi_dma_cookie_t)) +
472 	    (rootnex_prealloc_windows * sizeof (rootnex_window_t)) +
473 	    (rootnex_prealloc_copybuf * sizeof (rootnex_pgmap_t));
474 
475 	/*
476 	 * setup DDI DMA handle kmem cache, align each handle on 64 bytes,
477 	 * allocate 16 extra bytes for struct pointer alignment
478 	 * (p->dmai_private & dma->dp_prealloc_buffer)
479 	 */
480 	bufsize = sizeof (ddi_dma_impl_t) + sizeof (rootnex_dma_t) +
481 	    rootnex_state->r_prealloc_size + 0x10;
482 	rootnex_state->r_dmahdl_cache = kmem_cache_create("rootnex_dmahdl",
483 	    bufsize, 64, NULL, NULL, NULL, NULL, NULL, 0);
484 	if (rootnex_state->r_dmahdl_cache == NULL) {
485 		return (DDI_FAILURE);
486 	}
487 
488 	/*
489 	 * allocate array to track which major numbers we have printed warnings
490 	 * for.
491 	 */
492 	rootnex_warn_list = kmem_zalloc(devcnt * sizeof (*rootnex_warn_list),
493 	    KM_SLEEP);
494 
495 	return (DDI_SUCCESS);
496 }
497 
498 
499 /*
500  * rootnex_add_props()
501  *
502  */
503 static void
504 rootnex_add_props(dev_info_t *dip)
505 {
506 	rootnex_intprop_t *rpp;
507 	int i;
508 
509 	/* Add static integer/boolean properties to the root node */
510 	rpp = rootnex_intprp;
511 	for (i = 0; i < NROOT_INTPROPS; i++) {
512 		(void) e_ddi_prop_update_int(DDI_DEV_T_NONE, dip,
513 		    rpp[i].prop_name, rpp[i].prop_value);
514 	}
515 }
516 
517 
518 
519 /*
520  * *************************
521  *  ctlops related routines
522  * *************************
523  */
524 
525 /*
526  * rootnex_ctlops()
527  *
528  */
529 /*ARGSUSED*/
530 static int
531 rootnex_ctlops(dev_info_t *dip, dev_info_t *rdip, ddi_ctl_enum_t ctlop,
532     void *arg, void *result)
533 {
534 	int n, *ptr;
535 	struct ddi_parent_private_data *pdp;
536 
537 	switch (ctlop) {
538 	case DDI_CTLOPS_DMAPMAPC:
539 		/*
540 		 * Return 'partial' to indicate that dma mapping
541 		 * has to be done in the main MMU.
542 		 */
543 		return (DDI_DMA_PARTIAL);
544 
545 	case DDI_CTLOPS_BTOP:
546 		/*
547 		 * Convert byte count input to physical page units.
548 		 * (byte counts that are not a page-size multiple
549 		 * are rounded down)
550 		 */
551 		*(ulong_t *)result = btop(*(ulong_t *)arg);
552 		return (DDI_SUCCESS);
553 
554 	case DDI_CTLOPS_PTOB:
555 		/*
556 		 * Convert size in physical pages to bytes
557 		 */
558 		*(ulong_t *)result = ptob(*(ulong_t *)arg);
559 		return (DDI_SUCCESS);
560 
561 	case DDI_CTLOPS_BTOPR:
562 		/*
563 		 * Convert byte count input to physical page units
564 		 * (byte counts that are not a page-size multiple
565 		 * are rounded up)
566 		 */
567 		*(ulong_t *)result = btopr(*(ulong_t *)arg);
568 		return (DDI_SUCCESS);
569 
570 	case DDI_CTLOPS_INITCHILD:
571 		return (impl_ddi_sunbus_initchild(arg));
572 
573 	case DDI_CTLOPS_UNINITCHILD:
574 		impl_ddi_sunbus_removechild(arg);
575 		return (DDI_SUCCESS);
576 
577 	case DDI_CTLOPS_REPORTDEV:
578 		return (rootnex_ctl_reportdev(rdip));
579 
580 	case DDI_CTLOPS_IOMIN:
581 		/*
582 		 * Nothing to do here but reflect back..
583 		 */
584 		return (DDI_SUCCESS);
585 
586 	case DDI_CTLOPS_REGSIZE:
587 	case DDI_CTLOPS_NREGS:
588 		break;
589 
590 	case DDI_CTLOPS_SIDDEV:
591 		if (ndi_dev_is_prom_node(rdip))
592 			return (DDI_SUCCESS);
593 		if (ndi_dev_is_persistent_node(rdip))
594 			return (DDI_SUCCESS);
595 		return (DDI_FAILURE);
596 
597 	case DDI_CTLOPS_POWER:
598 		return ((*pm_platform_power)((power_req_t *)arg));
599 
600 	case DDI_CTLOPS_RESERVED0: /* Was DDI_CTLOPS_NINTRS, obsolete */
601 	case DDI_CTLOPS_RESERVED1: /* Was DDI_CTLOPS_POKE_INIT, obsolete */
602 	case DDI_CTLOPS_RESERVED2: /* Was DDI_CTLOPS_POKE_FLUSH, obsolete */
603 	case DDI_CTLOPS_RESERVED3: /* Was DDI_CTLOPS_POKE_FINI, obsolete */
604 	case DDI_CTLOPS_RESERVED4: /* Was DDI_CTLOPS_INTR_HILEVEL, obsolete */
605 	case DDI_CTLOPS_RESERVED5: /* Was DDI_CTLOPS_XLATE_INTRS, obsolete */
606 		if (!rootnex_state->r_reserved_msg_printed) {
607 			rootnex_state->r_reserved_msg_printed = B_TRUE;
608 			cmn_err(CE_WARN, "Failing ddi_ctlops call(s) for "
609 			    "1 or more reserved/obsolete operations.");
610 		}
611 		return (DDI_FAILURE);
612 
613 	default:
614 		return (DDI_FAILURE);
615 	}
616 	/*
617 	 * The rest are for "hardware" properties
618 	 */
619 	if ((pdp = ddi_get_parent_data(rdip)) == NULL)
620 		return (DDI_FAILURE);
621 
622 	if (ctlop == DDI_CTLOPS_NREGS) {
623 		ptr = (int *)result;
624 		*ptr = pdp->par_nreg;
625 	} else {
626 		off_t *size = (off_t *)result;
627 
628 		ptr = (int *)arg;
629 		n = *ptr;
630 		if (n >= pdp->par_nreg) {
631 			return (DDI_FAILURE);
632 		}
633 		*size = (off_t)pdp->par_reg[n].regspec_size;
634 	}
635 	return (DDI_SUCCESS);
636 }
637 
638 
639 /*
640  * rootnex_ctl_reportdev()
641  *
642  */
643 static int
644 rootnex_ctl_reportdev(dev_info_t *dev)
645 {
646 	int i, n, len, f_len = 0;
647 	char *buf;
648 
649 	buf = kmem_alloc(REPORTDEV_BUFSIZE, KM_SLEEP);
650 	f_len += snprintf(buf, REPORTDEV_BUFSIZE,
651 	    "%s%d at root", ddi_driver_name(dev), ddi_get_instance(dev));
652 	len = strlen(buf);
653 
654 	for (i = 0; i < sparc_pd_getnreg(dev); i++) {
655 
656 		struct regspec *rp = sparc_pd_getreg(dev, i);
657 
658 		if (i == 0)
659 			f_len += snprintf(buf + len, REPORTDEV_BUFSIZE - len,
660 			    ": ");
661 		else
662 			f_len += snprintf(buf + len, REPORTDEV_BUFSIZE - len,
663 			    " and ");
664 		len = strlen(buf);
665 
666 		switch (rp->regspec_bustype) {
667 
668 		case BTEISA:
669 			f_len += snprintf(buf + len, REPORTDEV_BUFSIZE - len,
670 			    "%s 0x%x", DEVI_EISA_NEXNAME, rp->regspec_addr);
671 			break;
672 
673 		case BTISA:
674 			f_len += snprintf(buf + len, REPORTDEV_BUFSIZE - len,
675 			    "%s 0x%x", DEVI_ISA_NEXNAME, rp->regspec_addr);
676 			break;
677 
678 		default:
679 			f_len += snprintf(buf + len, REPORTDEV_BUFSIZE - len,
680 			    "space %x offset %x",
681 			    rp->regspec_bustype, rp->regspec_addr);
682 			break;
683 		}
684 		len = strlen(buf);
685 	}
686 	for (i = 0, n = sparc_pd_getnintr(dev); i < n; i++) {
687 		int pri;
688 
689 		if (i != 0) {
690 			f_len += snprintf(buf + len, REPORTDEV_BUFSIZE - len,
691 			    ",");
692 			len = strlen(buf);
693 		}
694 		pri = INT_IPL(sparc_pd_getintr(dev, i)->intrspec_pri);
695 		f_len += snprintf(buf + len, REPORTDEV_BUFSIZE - len,
696 		    " sparc ipl %d", pri);
697 		len = strlen(buf);
698 	}
699 #ifdef DEBUG
700 	if (f_len + 1 >= REPORTDEV_BUFSIZE) {
701 		cmn_err(CE_NOTE, "next message is truncated: "
702 		    "printed length 1024, real length %d", f_len);
703 	}
704 #endif /* DEBUG */
705 	cmn_err(CE_CONT, "?%s\n", buf);
706 	kmem_free(buf, REPORTDEV_BUFSIZE);
707 	return (DDI_SUCCESS);
708 }
709 
710 
711 /*
712  * ******************
713  *  map related code
714  * ******************
715  */
716 
717 /*
718  * rootnex_map()
719  *
720  */
721 static int
722 rootnex_map(dev_info_t *dip, dev_info_t *rdip, ddi_map_req_t *mp, off_t offset,
723     off_t len, caddr_t *vaddrp)
724 {
725 	struct regspec *rp, tmp_reg;
726 	ddi_map_req_t mr = *mp;		/* Get private copy of request */
727 	int error;
728 
729 	mp = &mr;
730 
731 	switch (mp->map_op)  {
732 	case DDI_MO_MAP_LOCKED:
733 	case DDI_MO_UNMAP:
734 	case DDI_MO_MAP_HANDLE:
735 		break;
736 	default:
737 #ifdef	DDI_MAP_DEBUG
738 		cmn_err(CE_WARN, "rootnex_map: unimplemented map op %d.",
739 		    mp->map_op);
740 #endif	/* DDI_MAP_DEBUG */
741 		return (DDI_ME_UNIMPLEMENTED);
742 	}
743 
744 	if (mp->map_flags & DDI_MF_USER_MAPPING)  {
745 #ifdef	DDI_MAP_DEBUG
746 		cmn_err(CE_WARN, "rootnex_map: unimplemented map type: user.");
747 #endif	/* DDI_MAP_DEBUG */
748 		return (DDI_ME_UNIMPLEMENTED);
749 	}
750 
751 	/*
752 	 * First, if given an rnumber, convert it to a regspec...
753 	 * (Presumably, this is on behalf of a child of the root node?)
754 	 */
755 
756 	if (mp->map_type == DDI_MT_RNUMBER)  {
757 
758 		int rnumber = mp->map_obj.rnumber;
759 #ifdef	DDI_MAP_DEBUG
760 		static char *out_of_range =
761 		    "rootnex_map: Out of range rnumber <%d>, device <%s>";
762 #endif	/* DDI_MAP_DEBUG */
763 
764 		rp = i_ddi_rnumber_to_regspec(rdip, rnumber);
765 		if (rp == NULL)  {
766 #ifdef	DDI_MAP_DEBUG
767 			cmn_err(CE_WARN, out_of_range, rnumber,
768 			    ddi_get_name(rdip));
769 #endif	/* DDI_MAP_DEBUG */
770 			return (DDI_ME_RNUMBER_RANGE);
771 		}
772 
773 		/*
774 		 * Convert the given ddi_map_req_t from rnumber to regspec...
775 		 */
776 
777 		mp->map_type = DDI_MT_REGSPEC;
778 		mp->map_obj.rp = rp;
779 	}
780 
781 	/*
782 	 * Adjust offset and length correspnding to called values...
783 	 * XXX: A non-zero length means override the one in the regspec
784 	 * XXX: (regardless of what's in the parent's range?)
785 	 */
786 
787 	tmp_reg = *(mp->map_obj.rp);		/* Preserve underlying data */
788 	rp = mp->map_obj.rp = &tmp_reg;		/* Use tmp_reg in request */
789 
790 #ifdef	DDI_MAP_DEBUG
791 	cmn_err(CE_CONT, "rootnex: <%s,%s> <0x%x, 0x%x, 0x%d> offset %d len %d "
792 	    "handle 0x%x\n", ddi_get_name(dip), ddi_get_name(rdip),
793 	    rp->regspec_bustype, rp->regspec_addr, rp->regspec_size, offset,
794 	    len, mp->map_handlep);
795 #endif	/* DDI_MAP_DEBUG */
796 
797 	/*
798 	 * I/O or memory mapping:
799 	 *
800 	 *	<bustype=0, addr=x, len=x>: memory
801 	 *	<bustype=1, addr=x, len=x>: i/o
802 	 *	<bustype>1, addr=0, len=x>: x86-compatibility i/o
803 	 */
804 
805 	if (rp->regspec_bustype > 1 && rp->regspec_addr != 0) {
806 		cmn_err(CE_WARN, "<%s,%s> invalid register spec"
807 		    " <0x%x, 0x%x, 0x%x>", ddi_get_name(dip),
808 		    ddi_get_name(rdip), rp->regspec_bustype,
809 		    rp->regspec_addr, rp->regspec_size);
810 		return (DDI_ME_INVAL);
811 	}
812 
813 	if (rp->regspec_bustype > 1 && rp->regspec_addr == 0) {
814 		/*
815 		 * compatibility i/o mapping
816 		 */
817 		rp->regspec_bustype += (uint_t)offset;
818 	} else {
819 		/*
820 		 * Normal memory or i/o mapping
821 		 */
822 		rp->regspec_addr += (uint_t)offset;
823 	}
824 
825 	if (len != 0)
826 		rp->regspec_size = (uint_t)len;
827 
828 #ifdef	DDI_MAP_DEBUG
829 	cmn_err(CE_CONT, "             <%s,%s> <0x%x, 0x%x, 0x%d> offset %d "
830 	    "len %d handle 0x%x\n", ddi_get_name(dip), ddi_get_name(rdip),
831 	    rp->regspec_bustype, rp->regspec_addr, rp->regspec_size,
832 	    offset, len, mp->map_handlep);
833 #endif	/* DDI_MAP_DEBUG */
834 
835 	/*
836 	 * Apply any parent ranges at this level, if applicable.
837 	 * (This is where nexus specific regspec translation takes place.
838 	 * Use of this function is implicit agreement that translation is
839 	 * provided via ddi_apply_range.)
840 	 */
841 
842 #ifdef	DDI_MAP_DEBUG
843 	ddi_map_debug("applying range of parent <%s> to child <%s>...\n",
844 	    ddi_get_name(dip), ddi_get_name(rdip));
845 #endif	/* DDI_MAP_DEBUG */
846 
847 	if ((error = i_ddi_apply_range(dip, rdip, mp->map_obj.rp)) != 0)
848 		return (error);
849 
850 	switch (mp->map_op)  {
851 	case DDI_MO_MAP_LOCKED:
852 
853 		/*
854 		 * Set up the locked down kernel mapping to the regspec...
855 		 */
856 
857 		return (rootnex_map_regspec(mp, vaddrp));
858 
859 	case DDI_MO_UNMAP:
860 
861 		/*
862 		 * Release mapping...
863 		 */
864 
865 		return (rootnex_unmap_regspec(mp, vaddrp));
866 
867 	case DDI_MO_MAP_HANDLE:
868 
869 		return (rootnex_map_handle(mp));
870 
871 	default:
872 		return (DDI_ME_UNIMPLEMENTED);
873 	}
874 }
875 
876 
877 /*
878  * rootnex_map_fault()
879  *
880  *	fault in mappings for requestors
881  */
882 /*ARGSUSED*/
883 static int
884 rootnex_map_fault(dev_info_t *dip, dev_info_t *rdip, struct hat *hat,
885     struct seg *seg, caddr_t addr, struct devpage *dp, pfn_t pfn, uint_t prot,
886     uint_t lock)
887 {
888 
889 #ifdef	DDI_MAP_DEBUG
890 	ddi_map_debug("rootnex_map_fault: address <%x> pfn <%x>", addr, pfn);
891 	ddi_map_debug(" Seg <%s>\n",
892 	    seg->s_ops == &segdev_ops ? "segdev" :
893 	    seg == &kvseg ? "segkmem" : "NONE!");
894 #endif	/* DDI_MAP_DEBUG */
895 
896 	/*
897 	 * This is all terribly broken, but it is a start
898 	 *
899 	 * XXX	Note that this test means that segdev_ops
900 	 *	must be exported from seg_dev.c.
901 	 * XXX	What about devices with their own segment drivers?
902 	 */
903 	if (seg->s_ops == &segdev_ops) {
904 		struct segdev_data *sdp = (struct segdev_data *)seg->s_data;
905 
906 		if (hat == NULL) {
907 			/*
908 			 * This is one plausible interpretation of
909 			 * a null hat i.e. use the first hat on the
910 			 * address space hat list which by convention is
911 			 * the hat of the system MMU.  At alternative
912 			 * would be to panic .. this might well be better ..
913 			 */
914 			ASSERT(AS_READ_HELD(seg->s_as, &seg->s_as->a_lock));
915 			hat = seg->s_as->a_hat;
916 			cmn_err(CE_NOTE, "rootnex_map_fault: nil hat");
917 		}
918 		hat_devload(hat, addr, MMU_PAGESIZE, pfn, prot | sdp->hat_attr,
919 		    (lock ? HAT_LOAD_LOCK : HAT_LOAD));
920 	} else if (seg == &kvseg && dp == NULL) {
921 		hat_devload(kas.a_hat, addr, MMU_PAGESIZE, pfn, prot,
922 		    HAT_LOAD_LOCK);
923 	} else
924 		return (DDI_FAILURE);
925 	return (DDI_SUCCESS);
926 }
927 
928 
929 /*
930  * rootnex_map_regspec()
931  *     we don't support mapping of I/O cards above 4Gb
932  */
933 static int
934 rootnex_map_regspec(ddi_map_req_t *mp, caddr_t *vaddrp)
935 {
936 	rootnex_addr_t rbase;
937 	void *cvaddr;
938 	uint_t npages, pgoffset;
939 	struct regspec *rp;
940 	ddi_acc_hdl_t *hp;
941 	ddi_acc_impl_t *ap;
942 	uint_t	hat_acc_flags;
943 	paddr_t pbase;
944 
945 	rp = mp->map_obj.rp;
946 	hp = mp->map_handlep;
947 
948 #ifdef	DDI_MAP_DEBUG
949 	ddi_map_debug(
950 	    "rootnex_map_regspec: <0x%x 0x%x 0x%x> handle 0x%x\n",
951 	    rp->regspec_bustype, rp->regspec_addr,
952 	    rp->regspec_size, mp->map_handlep);
953 #endif	/* DDI_MAP_DEBUG */
954 
955 	/*
956 	 * I/O or memory mapping
957 	 *
958 	 *	<bustype=0, addr=x, len=x>: memory
959 	 *	<bustype=1, addr=x, len=x>: i/o
960 	 *	<bustype>1, addr=0, len=x>: x86-compatibility i/o
961 	 */
962 
963 	if (rp->regspec_bustype > 1 && rp->regspec_addr != 0) {
964 		cmn_err(CE_WARN, "rootnex: invalid register spec"
965 		    " <0x%x, 0x%x, 0x%x>", rp->regspec_bustype,
966 		    rp->regspec_addr, rp->regspec_size);
967 		return (DDI_FAILURE);
968 	}
969 
970 	if (rp->regspec_bustype != 0) {
971 		/*
972 		 * I/O space - needs a handle.
973 		 */
974 		if (hp == NULL) {
975 			return (DDI_FAILURE);
976 		}
977 		ap = (ddi_acc_impl_t *)hp->ah_platform_private;
978 		ap->ahi_acc_attr |= DDI_ACCATTR_IO_SPACE;
979 		impl_acc_hdl_init(hp);
980 
981 		if (mp->map_flags & DDI_MF_DEVICE_MAPPING) {
982 #ifdef  DDI_MAP_DEBUG
983 			ddi_map_debug("rootnex_map_regspec: mmap() "
984 			    "to I/O space is not supported.\n");
985 #endif  /* DDI_MAP_DEBUG */
986 			return (DDI_ME_INVAL);
987 		} else {
988 			/*
989 			 * 1275-compliant vs. compatibility i/o mapping
990 			 */
991 			*vaddrp =
992 			    (rp->regspec_bustype > 1 && rp->regspec_addr == 0) ?
993 			    ((caddr_t)(uintptr_t)rp->regspec_bustype) :
994 			    ((caddr_t)(uintptr_t)rp->regspec_addr);
995 #ifdef __xpv
996 			if (DOMAIN_IS_INITDOMAIN(xen_info)) {
997 				hp->ah_pfn = xen_assign_pfn(
998 				    mmu_btop((ulong_t)rp->regspec_addr &
999 				    MMU_PAGEMASK));
1000 			} else {
1001 				hp->ah_pfn = mmu_btop(
1002 				    (ulong_t)rp->regspec_addr & MMU_PAGEMASK);
1003 			}
1004 #else
1005 			hp->ah_pfn = mmu_btop((ulong_t)rp->regspec_addr &
1006 			    MMU_PAGEMASK);
1007 #endif
1008 			hp->ah_pnum = mmu_btopr(rp->regspec_size +
1009 			    (ulong_t)rp->regspec_addr & MMU_PAGEOFFSET);
1010 		}
1011 
1012 #ifdef	DDI_MAP_DEBUG
1013 		ddi_map_debug(
1014 	    "rootnex_map_regspec: \"Mapping\" %d bytes I/O space at 0x%x\n",
1015 		    rp->regspec_size, *vaddrp);
1016 #endif	/* DDI_MAP_DEBUG */
1017 		return (DDI_SUCCESS);
1018 	}
1019 
1020 	/*
1021 	 * Memory space
1022 	 */
1023 
1024 	if (hp != NULL) {
1025 		/*
1026 		 * hat layer ignores
1027 		 * hp->ah_acc.devacc_attr_endian_flags.
1028 		 */
1029 		switch (hp->ah_acc.devacc_attr_dataorder) {
1030 		case DDI_STRICTORDER_ACC:
1031 			hat_acc_flags = HAT_STRICTORDER;
1032 			break;
1033 		case DDI_UNORDERED_OK_ACC:
1034 			hat_acc_flags = HAT_UNORDERED_OK;
1035 			break;
1036 		case DDI_MERGING_OK_ACC:
1037 			hat_acc_flags = HAT_MERGING_OK;
1038 			break;
1039 		case DDI_LOADCACHING_OK_ACC:
1040 			hat_acc_flags = HAT_LOADCACHING_OK;
1041 			break;
1042 		case DDI_STORECACHING_OK_ACC:
1043 			hat_acc_flags = HAT_STORECACHING_OK;
1044 			break;
1045 		}
1046 		ap = (ddi_acc_impl_t *)hp->ah_platform_private;
1047 		ap->ahi_acc_attr |= DDI_ACCATTR_CPU_VADDR;
1048 		impl_acc_hdl_init(hp);
1049 		hp->ah_hat_flags = hat_acc_flags;
1050 	} else {
1051 		hat_acc_flags = HAT_STRICTORDER;
1052 	}
1053 
1054 	rbase = (rootnex_addr_t)(rp->regspec_addr & MMU_PAGEMASK);
1055 #ifdef __xpv
1056 	/*
1057 	 * If we're dom0, we're using a real device so we need to translate
1058 	 * the MA to a PA.
1059 	 */
1060 	if (DOMAIN_IS_INITDOMAIN(xen_info)) {
1061 		pbase = pfn_to_pa(xen_assign_pfn(mmu_btop(rbase)));
1062 	} else {
1063 		pbase = rbase;
1064 	}
1065 #else
1066 	pbase = rbase;
1067 #endif
1068 	pgoffset = (ulong_t)rp->regspec_addr & MMU_PAGEOFFSET;
1069 
1070 	if (rp->regspec_size == 0) {
1071 #ifdef  DDI_MAP_DEBUG
1072 		ddi_map_debug("rootnex_map_regspec: zero regspec_size\n");
1073 #endif  /* DDI_MAP_DEBUG */
1074 		return (DDI_ME_INVAL);
1075 	}
1076 
1077 	if (mp->map_flags & DDI_MF_DEVICE_MAPPING) {
1078 		/* extra cast to make gcc happy */
1079 		*vaddrp = (caddr_t)((uintptr_t)mmu_btop(pbase));
1080 	} else {
1081 		npages = mmu_btopr(rp->regspec_size + pgoffset);
1082 
1083 #ifdef	DDI_MAP_DEBUG
1084 		ddi_map_debug("rootnex_map_regspec: Mapping %d pages "
1085 		    "physical %llx", npages, pbase);
1086 #endif	/* DDI_MAP_DEBUG */
1087 
1088 		cvaddr = device_arena_alloc(ptob(npages), VM_NOSLEEP);
1089 		if (cvaddr == NULL)
1090 			return (DDI_ME_NORESOURCES);
1091 
1092 		/*
1093 		 * Now map in the pages we've allocated...
1094 		 */
1095 		hat_devload(kas.a_hat, cvaddr, mmu_ptob(npages),
1096 		    mmu_btop(pbase), mp->map_prot | hat_acc_flags,
1097 		    HAT_LOAD_LOCK);
1098 		*vaddrp = (caddr_t)cvaddr + pgoffset;
1099 
1100 		/* save away pfn and npages for FMA */
1101 		hp = mp->map_handlep;
1102 		if (hp) {
1103 			hp->ah_pfn = mmu_btop(pbase);
1104 			hp->ah_pnum = npages;
1105 		}
1106 	}
1107 
1108 #ifdef	DDI_MAP_DEBUG
1109 	ddi_map_debug("at virtual 0x%x\n", *vaddrp);
1110 #endif	/* DDI_MAP_DEBUG */
1111 	return (DDI_SUCCESS);
1112 }
1113 
1114 
1115 /*
1116  * rootnex_unmap_regspec()
1117  *
1118  */
1119 static int
1120 rootnex_unmap_regspec(ddi_map_req_t *mp, caddr_t *vaddrp)
1121 {
1122 	caddr_t addr = (caddr_t)*vaddrp;
1123 	uint_t npages, pgoffset;
1124 	struct regspec *rp;
1125 
1126 	if (mp->map_flags & DDI_MF_DEVICE_MAPPING)
1127 		return (0);
1128 
1129 	rp = mp->map_obj.rp;
1130 
1131 	if (rp->regspec_size == 0) {
1132 #ifdef  DDI_MAP_DEBUG
1133 		ddi_map_debug("rootnex_unmap_regspec: zero regspec_size\n");
1134 #endif  /* DDI_MAP_DEBUG */
1135 		return (DDI_ME_INVAL);
1136 	}
1137 
1138 	/*
1139 	 * I/O or memory mapping:
1140 	 *
1141 	 *	<bustype=0, addr=x, len=x>: memory
1142 	 *	<bustype=1, addr=x, len=x>: i/o
1143 	 *	<bustype>1, addr=0, len=x>: x86-compatibility i/o
1144 	 */
1145 	if (rp->regspec_bustype != 0) {
1146 		/*
1147 		 * This is I/O space, which requires no particular
1148 		 * processing on unmap since it isn't mapped in the
1149 		 * first place.
1150 		 */
1151 		return (DDI_SUCCESS);
1152 	}
1153 
1154 	/*
1155 	 * Memory space
1156 	 */
1157 	pgoffset = (uintptr_t)addr & MMU_PAGEOFFSET;
1158 	npages = mmu_btopr(rp->regspec_size + pgoffset);
1159 	hat_unload(kas.a_hat, addr - pgoffset, ptob(npages), HAT_UNLOAD_UNLOCK);
1160 	device_arena_free(addr - pgoffset, ptob(npages));
1161 
1162 	/*
1163 	 * Destroy the pointer - the mapping has logically gone
1164 	 */
1165 	*vaddrp = NULL;
1166 
1167 	return (DDI_SUCCESS);
1168 }
1169 
1170 
1171 /*
1172  * rootnex_map_handle()
1173  *
1174  */
1175 static int
1176 rootnex_map_handle(ddi_map_req_t *mp)
1177 {
1178 	rootnex_addr_t rbase;
1179 	ddi_acc_hdl_t *hp;
1180 	uint_t pgoffset;
1181 	struct regspec *rp;
1182 	paddr_t pbase;
1183 
1184 	rp = mp->map_obj.rp;
1185 
1186 #ifdef	DDI_MAP_DEBUG
1187 	ddi_map_debug(
1188 	    "rootnex_map_handle: <0x%x 0x%x 0x%x> handle 0x%x\n",
1189 	    rp->regspec_bustype, rp->regspec_addr,
1190 	    rp->regspec_size, mp->map_handlep);
1191 #endif	/* DDI_MAP_DEBUG */
1192 
1193 	/*
1194 	 * I/O or memory mapping:
1195 	 *
1196 	 *	<bustype=0, addr=x, len=x>: memory
1197 	 *	<bustype=1, addr=x, len=x>: i/o
1198 	 *	<bustype>1, addr=0, len=x>: x86-compatibility i/o
1199 	 */
1200 	if (rp->regspec_bustype != 0) {
1201 		/*
1202 		 * This refers to I/O space, and we don't support "mapping"
1203 		 * I/O space to a user.
1204 		 */
1205 		return (DDI_FAILURE);
1206 	}
1207 
1208 	/*
1209 	 * Set up the hat_flags for the mapping.
1210 	 */
1211 	hp = mp->map_handlep;
1212 
1213 	switch (hp->ah_acc.devacc_attr_endian_flags) {
1214 	case DDI_NEVERSWAP_ACC:
1215 		hp->ah_hat_flags = HAT_NEVERSWAP | HAT_STRICTORDER;
1216 		break;
1217 	case DDI_STRUCTURE_LE_ACC:
1218 		hp->ah_hat_flags = HAT_STRUCTURE_LE;
1219 		break;
1220 	case DDI_STRUCTURE_BE_ACC:
1221 		return (DDI_FAILURE);
1222 	default:
1223 		return (DDI_REGS_ACC_CONFLICT);
1224 	}
1225 
1226 	switch (hp->ah_acc.devacc_attr_dataorder) {
1227 	case DDI_STRICTORDER_ACC:
1228 		break;
1229 	case DDI_UNORDERED_OK_ACC:
1230 		hp->ah_hat_flags |= HAT_UNORDERED_OK;
1231 		break;
1232 	case DDI_MERGING_OK_ACC:
1233 		hp->ah_hat_flags |= HAT_MERGING_OK;
1234 		break;
1235 	case DDI_LOADCACHING_OK_ACC:
1236 		hp->ah_hat_flags |= HAT_LOADCACHING_OK;
1237 		break;
1238 	case DDI_STORECACHING_OK_ACC:
1239 		hp->ah_hat_flags |= HAT_STORECACHING_OK;
1240 		break;
1241 	default:
1242 		return (DDI_FAILURE);
1243 	}
1244 
1245 	rbase = (rootnex_addr_t)rp->regspec_addr &
1246 	    (~(rootnex_addr_t)MMU_PAGEOFFSET);
1247 	pgoffset = (ulong_t)rp->regspec_addr & MMU_PAGEOFFSET;
1248 
1249 	if (rp->regspec_size == 0)
1250 		return (DDI_ME_INVAL);
1251 
1252 #ifdef __xpv
1253 	/*
1254 	 * If we're dom0, we're using a real device so we need to translate
1255 	 * the MA to a PA.
1256 	 */
1257 	if (DOMAIN_IS_INITDOMAIN(xen_info)) {
1258 		pbase = pfn_to_pa(xen_assign_pfn(mmu_btop(rbase))) |
1259 		    (rbase & MMU_PAGEOFFSET);
1260 	} else {
1261 		pbase = rbase;
1262 	}
1263 #else
1264 	pbase = rbase;
1265 #endif
1266 
1267 	hp->ah_pfn = mmu_btop(pbase);
1268 	hp->ah_pnum = mmu_btopr(rp->regspec_size + pgoffset);
1269 
1270 	return (DDI_SUCCESS);
1271 }
1272 
1273 
1274 
1275 /*
1276  * ************************
1277  *  interrupt related code
1278  * ************************
1279  */
1280 
1281 /*
1282  * rootnex_intr_ops()
1283  *	bus_intr_op() function for interrupt support
1284  */
1285 /* ARGSUSED */
1286 static int
1287 rootnex_intr_ops(dev_info_t *pdip, dev_info_t *rdip, ddi_intr_op_t intr_op,
1288     ddi_intr_handle_impl_t *hdlp, void *result)
1289 {
1290 	struct intrspec			*ispec;
1291 	struct ddi_parent_private_data	*pdp;
1292 
1293 	DDI_INTR_NEXDBG((CE_CONT,
1294 	    "rootnex_intr_ops: pdip = %p, rdip = %p, intr_op = %x, hdlp = %p\n",
1295 	    (void *)pdip, (void *)rdip, intr_op, (void *)hdlp));
1296 
1297 	/* Process the interrupt operation */
1298 	switch (intr_op) {
1299 	case DDI_INTROP_GETCAP:
1300 		/* First check with pcplusmp */
1301 		if (psm_intr_ops == NULL)
1302 			return (DDI_FAILURE);
1303 
1304 		if ((*psm_intr_ops)(rdip, hdlp, PSM_INTR_OP_GET_CAP, result)) {
1305 			*(int *)result = 0;
1306 			return (DDI_FAILURE);
1307 		}
1308 		break;
1309 	case DDI_INTROP_SETCAP:
1310 		if (psm_intr_ops == NULL)
1311 			return (DDI_FAILURE);
1312 
1313 		if ((*psm_intr_ops)(rdip, hdlp, PSM_INTR_OP_SET_CAP, result))
1314 			return (DDI_FAILURE);
1315 		break;
1316 	case DDI_INTROP_ALLOC:
1317 		if ((ispec = rootnex_get_ispec(rdip, hdlp->ih_inum)) == NULL)
1318 			return (DDI_FAILURE);
1319 		hdlp->ih_pri = ispec->intrspec_pri;
1320 		*(int *)result = hdlp->ih_scratch1;
1321 		break;
1322 	case DDI_INTROP_FREE:
1323 		pdp = ddi_get_parent_data(rdip);
1324 		/*
1325 		 * Special case for 'pcic' driver' only.
1326 		 * If an intrspec was created for it, clean it up here
1327 		 * See detailed comments on this in the function
1328 		 * rootnex_get_ispec().
1329 		 */
1330 		if (pdp->par_intr && strcmp(ddi_get_name(rdip), "pcic") == 0) {
1331 			kmem_free(pdp->par_intr, sizeof (struct intrspec) *
1332 			    pdp->par_nintr);
1333 			/*
1334 			 * Set it to zero; so that
1335 			 * DDI framework doesn't free it again
1336 			 */
1337 			pdp->par_intr = NULL;
1338 			pdp->par_nintr = 0;
1339 		}
1340 		break;
1341 	case DDI_INTROP_GETPRI:
1342 		if ((ispec = rootnex_get_ispec(rdip, hdlp->ih_inum)) == NULL)
1343 			return (DDI_FAILURE);
1344 		*(int *)result = ispec->intrspec_pri;
1345 		break;
1346 	case DDI_INTROP_SETPRI:
1347 		/* Validate the interrupt priority passed to us */
1348 		if (*(int *)result > LOCK_LEVEL)
1349 			return (DDI_FAILURE);
1350 
1351 		/* Ensure that PSM is all initialized and ispec is ok */
1352 		if ((psm_intr_ops == NULL) ||
1353 		    ((ispec = rootnex_get_ispec(rdip, hdlp->ih_inum)) == NULL))
1354 			return (DDI_FAILURE);
1355 
1356 		/* Change the priority */
1357 		if ((*psm_intr_ops)(rdip, hdlp, PSM_INTR_OP_SET_PRI, result) ==
1358 		    PSM_FAILURE)
1359 			return (DDI_FAILURE);
1360 
1361 		/* update the ispec with the new priority */
1362 		ispec->intrspec_pri =  *(int *)result;
1363 		break;
1364 	case DDI_INTROP_ADDISR:
1365 		if ((ispec = rootnex_get_ispec(rdip, hdlp->ih_inum)) == NULL)
1366 			return (DDI_FAILURE);
1367 		ispec->intrspec_func = hdlp->ih_cb_func;
1368 		break;
1369 	case DDI_INTROP_REMISR:
1370 		if ((ispec = rootnex_get_ispec(rdip, hdlp->ih_inum)) == NULL)
1371 			return (DDI_FAILURE);
1372 		ispec->intrspec_func = (uint_t (*)()) 0;
1373 		break;
1374 	case DDI_INTROP_ENABLE:
1375 		if ((ispec = rootnex_get_ispec(rdip, hdlp->ih_inum)) == NULL)
1376 			return (DDI_FAILURE);
1377 
1378 		/* Call psmi to translate irq with the dip */
1379 		if (psm_intr_ops == NULL)
1380 			return (DDI_FAILURE);
1381 
1382 		((ihdl_plat_t *)hdlp->ih_private)->ip_ispecp = ispec;
1383 		(void) (*psm_intr_ops)(rdip, hdlp, PSM_INTR_OP_XLATE_VECTOR,
1384 		    (int *)&hdlp->ih_vector);
1385 
1386 		/* Add the interrupt handler */
1387 		if (!add_avintr((void *)hdlp, ispec->intrspec_pri,
1388 		    hdlp->ih_cb_func, DEVI(rdip)->devi_name, hdlp->ih_vector,
1389 		    hdlp->ih_cb_arg1, hdlp->ih_cb_arg2, NULL, rdip))
1390 			return (DDI_FAILURE);
1391 		break;
1392 	case DDI_INTROP_DISABLE:
1393 		if ((ispec = rootnex_get_ispec(rdip, hdlp->ih_inum)) == NULL)
1394 			return (DDI_FAILURE);
1395 
1396 		/* Call psm_ops() to translate irq with the dip */
1397 		if (psm_intr_ops == NULL)
1398 			return (DDI_FAILURE);
1399 
1400 		((ihdl_plat_t *)hdlp->ih_private)->ip_ispecp = ispec;
1401 		(void) (*psm_intr_ops)(rdip, hdlp,
1402 		    PSM_INTR_OP_XLATE_VECTOR, (int *)&hdlp->ih_vector);
1403 
1404 		/* Remove the interrupt handler */
1405 		rem_avintr((void *)hdlp, ispec->intrspec_pri,
1406 		    hdlp->ih_cb_func, hdlp->ih_vector);
1407 		break;
1408 	case DDI_INTROP_SETMASK:
1409 		if (psm_intr_ops == NULL)
1410 			return (DDI_FAILURE);
1411 
1412 		if ((*psm_intr_ops)(rdip, hdlp, PSM_INTR_OP_SET_MASK, NULL))
1413 			return (DDI_FAILURE);
1414 		break;
1415 	case DDI_INTROP_CLRMASK:
1416 		if (psm_intr_ops == NULL)
1417 			return (DDI_FAILURE);
1418 
1419 		if ((*psm_intr_ops)(rdip, hdlp, PSM_INTR_OP_CLEAR_MASK, NULL))
1420 			return (DDI_FAILURE);
1421 		break;
1422 	case DDI_INTROP_GETPENDING:
1423 		if (psm_intr_ops == NULL)
1424 			return (DDI_FAILURE);
1425 
1426 		if ((*psm_intr_ops)(rdip, hdlp, PSM_INTR_OP_GET_PENDING,
1427 		    result)) {
1428 			*(int *)result = 0;
1429 			return (DDI_FAILURE);
1430 		}
1431 		break;
1432 	case DDI_INTROP_NAVAIL:
1433 	case DDI_INTROP_NINTRS:
1434 		*(int *)result = i_ddi_get_intx_nintrs(rdip);
1435 		if (*(int *)result == 0) {
1436 			/*
1437 			 * Special case for 'pcic' driver' only. This driver
1438 			 * driver is a child of 'isa' and 'rootnex' drivers.
1439 			 *
1440 			 * See detailed comments on this in the function
1441 			 * rootnex_get_ispec().
1442 			 *
1443 			 * Children of 'pcic' send 'NINITR' request all the
1444 			 * way to rootnex driver. But, the 'pdp->par_nintr'
1445 			 * field may not initialized. So, we fake it here
1446 			 * to return 1 (a la what PCMCIA nexus does).
1447 			 */
1448 			if (strcmp(ddi_get_name(rdip), "pcic") == 0)
1449 				*(int *)result = 1;
1450 			else
1451 				return (DDI_FAILURE);
1452 		}
1453 		break;
1454 	case DDI_INTROP_SUPPORTED_TYPES:
1455 		*(int *)result = DDI_INTR_TYPE_FIXED;	/* Always ... */
1456 		break;
1457 	default:
1458 		return (DDI_FAILURE);
1459 	}
1460 
1461 	return (DDI_SUCCESS);
1462 }
1463 
1464 
1465 /*
1466  * rootnex_get_ispec()
1467  *	convert an interrupt number to an interrupt specification.
1468  *	The interrupt number determines which interrupt spec will be
1469  *	returned if more than one exists.
1470  *
1471  *	Look into the parent private data area of the 'rdip' to find out
1472  *	the interrupt specification.  First check to make sure there is
1473  *	one that matchs "inumber" and then return a pointer to it.
1474  *
1475  *	Return NULL if one could not be found.
1476  *
1477  *	NOTE: This is needed for rootnex_intr_ops()
1478  */
1479 static struct intrspec *
1480 rootnex_get_ispec(dev_info_t *rdip, int inum)
1481 {
1482 	struct ddi_parent_private_data *pdp = ddi_get_parent_data(rdip);
1483 
1484 	/*
1485 	 * Special case handling for drivers that provide their own
1486 	 * intrspec structures instead of relying on the DDI framework.
1487 	 *
1488 	 * A broken hardware driver in ON could potentially provide its
1489 	 * own intrspec structure, instead of relying on the hardware.
1490 	 * If these drivers are children of 'rootnex' then we need to
1491 	 * continue to provide backward compatibility to them here.
1492 	 *
1493 	 * Following check is a special case for 'pcic' driver which
1494 	 * was found to have broken hardwre andby provides its own intrspec.
1495 	 *
1496 	 * Verbatim comments from this driver are shown here:
1497 	 * "Don't use the ddi_add_intr since we don't have a
1498 	 * default intrspec in all cases."
1499 	 *
1500 	 * Since an 'ispec' may not be always created for it,
1501 	 * check for that and create one if so.
1502 	 *
1503 	 * NOTE: Currently 'pcic' is the only driver found to do this.
1504 	 */
1505 	if (!pdp->par_intr && strcmp(ddi_get_name(rdip), "pcic") == 0) {
1506 		pdp->par_nintr = 1;
1507 		pdp->par_intr = kmem_zalloc(sizeof (struct intrspec) *
1508 		    pdp->par_nintr, KM_SLEEP);
1509 	}
1510 
1511 	/* Validate the interrupt number */
1512 	if (inum >= pdp->par_nintr)
1513 		return (NULL);
1514 
1515 	/* Get the interrupt structure pointer and return that */
1516 	return ((struct intrspec *)&pdp->par_intr[inum]);
1517 }
1518 
1519 
1520 /*
1521  * ******************
1522  *  dma related code
1523  * ******************
1524  */
1525 
1526 /*
1527  * rootnex_dma_allochdl()
1528  *    called from ddi_dma_alloc_handle().
1529  */
1530 /*ARGSUSED*/
1531 static int
1532 rootnex_dma_allochdl(dev_info_t *dip, dev_info_t *rdip, ddi_dma_attr_t *attr,
1533     int (*waitfp)(caddr_t), caddr_t arg, ddi_dma_handle_t *handlep)
1534 {
1535 	uint64_t maxsegmentsize_ll;
1536 	uint_t maxsegmentsize;
1537 	ddi_dma_impl_t *hp;
1538 	rootnex_dma_t *dma;
1539 	uint64_t count_max;
1540 	uint64_t seg;
1541 	int kmflag;
1542 	int e;
1543 
1544 
1545 	/* convert our sleep flags */
1546 	if (waitfp == DDI_DMA_SLEEP) {
1547 		kmflag = KM_SLEEP;
1548 	} else {
1549 		kmflag = KM_NOSLEEP;
1550 	}
1551 
1552 	/*
1553 	 * We try to do only one memory allocation here. We'll do a little
1554 	 * pointer manipulation later. If the bind ends up taking more than
1555 	 * our prealloc's space, we'll have to allocate more memory in the
1556 	 * bind operation. Not great, but much better than before and the
1557 	 * best we can do with the current bind interfaces.
1558 	 */
1559 	hp = kmem_cache_alloc(rootnex_state->r_dmahdl_cache, kmflag);
1560 	if (hp == NULL) {
1561 		if (waitfp != DDI_DMA_DONTWAIT) {
1562 			ddi_set_callback(waitfp, arg,
1563 			    &rootnex_state->r_dvma_call_list_id);
1564 		}
1565 		return (DDI_DMA_NORESOURCES);
1566 	}
1567 
1568 	/* Do our pointer manipulation now, align the structures */
1569 	hp->dmai_private = (void *)(((uintptr_t)hp +
1570 	    (uintptr_t)sizeof (ddi_dma_impl_t) + 0x7) & ~0x7);
1571 	dma = (rootnex_dma_t *)hp->dmai_private;
1572 	dma->dp_prealloc_buffer = (uchar_t *)(((uintptr_t)dma +
1573 	    sizeof (rootnex_dma_t) + 0x7) & ~0x7);
1574 
1575 	/* setup the handle */
1576 	rootnex_clean_dmahdl(hp);
1577 	dma->dp_dip = rdip;
1578 	dma->dp_sglinfo.si_min_addr = attr->dma_attr_addr_lo;
1579 	dma->dp_sglinfo.si_max_addr = attr->dma_attr_addr_hi;
1580 	hp->dmai_minxfer = attr->dma_attr_minxfer;
1581 	hp->dmai_burstsizes = attr->dma_attr_burstsizes;
1582 	hp->dmai_rdip = rdip;
1583 	hp->dmai_attr = *attr;
1584 
1585 	/* we don't need to worry about the SPL since we do a tryenter */
1586 	mutex_init(&dma->dp_mutex, NULL, MUTEX_DRIVER, NULL);
1587 
1588 	/*
1589 	 * Figure out our maximum segment size. If the segment size is greater
1590 	 * than 4G, we will limit it to (4G - 1) since the max size of a dma
1591 	 * object (ddi_dma_obj_t.dmao_size) is 32 bits. dma_attr_seg and
1592 	 * dma_attr_count_max are size-1 type values.
1593 	 *
1594 	 * Maximum segment size is the largest physically contiguous chunk of
1595 	 * memory that we can return from a bind (i.e. the maximum size of a
1596 	 * single cookie).
1597 	 */
1598 
1599 	/* handle the rollover cases */
1600 	seg = attr->dma_attr_seg + 1;
1601 	if (seg < attr->dma_attr_seg) {
1602 		seg = attr->dma_attr_seg;
1603 	}
1604 	count_max = attr->dma_attr_count_max + 1;
1605 	if (count_max < attr->dma_attr_count_max) {
1606 		count_max = attr->dma_attr_count_max;
1607 	}
1608 
1609 	/*
1610 	 * granularity may or may not be a power of two. If it isn't, we can't
1611 	 * use a simple mask.
1612 	 */
1613 	if (attr->dma_attr_granular & (attr->dma_attr_granular - 1)) {
1614 		dma->dp_granularity_power_2 = B_FALSE;
1615 	} else {
1616 		dma->dp_granularity_power_2 = B_TRUE;
1617 	}
1618 
1619 	/*
1620 	 * maxxfer should be a whole multiple of granularity. If we're going to
1621 	 * break up a window because we're greater than maxxfer, we might as
1622 	 * well make sure it's maxxfer is a whole multiple so we don't have to
1623 	 * worry about triming the window later on for this case.
1624 	 */
1625 	if (attr->dma_attr_granular > 1) {
1626 		if (dma->dp_granularity_power_2) {
1627 			dma->dp_maxxfer = attr->dma_attr_maxxfer -
1628 			    (attr->dma_attr_maxxfer &
1629 			    (attr->dma_attr_granular - 1));
1630 		} else {
1631 			dma->dp_maxxfer = attr->dma_attr_maxxfer -
1632 			    (attr->dma_attr_maxxfer % attr->dma_attr_granular);
1633 		}
1634 	} else {
1635 		dma->dp_maxxfer = attr->dma_attr_maxxfer;
1636 	}
1637 
1638 	maxsegmentsize_ll = MIN(seg, dma->dp_maxxfer);
1639 	maxsegmentsize_ll = MIN(maxsegmentsize_ll, count_max);
1640 	if (maxsegmentsize_ll == 0 || (maxsegmentsize_ll > 0xFFFFFFFF)) {
1641 		maxsegmentsize = 0xFFFFFFFF;
1642 	} else {
1643 		maxsegmentsize = maxsegmentsize_ll;
1644 	}
1645 	dma->dp_sglinfo.si_max_cookie_size = maxsegmentsize;
1646 	dma->dp_sglinfo.si_segmask = attr->dma_attr_seg;
1647 
1648 	/* check the ddi_dma_attr arg to make sure it makes a little sense */
1649 	if (rootnex_alloc_check_parms) {
1650 		e = rootnex_valid_alloc_parms(attr, maxsegmentsize);
1651 		if (e != DDI_SUCCESS) {
1652 			ROOTNEX_PROF_INC(&rootnex_cnt[ROOTNEX_CNT_ALLOC_FAIL]);
1653 			(void) rootnex_dma_freehdl(dip, rdip,
1654 			    (ddi_dma_handle_t)hp);
1655 			return (e);
1656 		}
1657 	}
1658 
1659 	*handlep = (ddi_dma_handle_t)hp;
1660 
1661 	ROOTNEX_PROF_INC(&rootnex_cnt[ROOTNEX_CNT_ACTIVE_HDLS]);
1662 	DTRACE_PROBE1(rootnex__alloc__handle, uint64_t,
1663 	    rootnex_cnt[ROOTNEX_CNT_ACTIVE_HDLS]);
1664 
1665 	return (DDI_SUCCESS);
1666 }
1667 
1668 
1669 /*
1670  * rootnex_dma_freehdl()
1671  *    called from ddi_dma_free_handle().
1672  */
1673 /*ARGSUSED*/
1674 static int
1675 rootnex_dma_freehdl(dev_info_t *dip, dev_info_t *rdip, ddi_dma_handle_t handle)
1676 {
1677 	ddi_dma_impl_t *hp;
1678 	rootnex_dma_t *dma;
1679 
1680 
1681 	hp = (ddi_dma_impl_t *)handle;
1682 	dma = (rootnex_dma_t *)hp->dmai_private;
1683 
1684 	/* unbind should have been called first */
1685 	ASSERT(!dma->dp_inuse);
1686 
1687 	mutex_destroy(&dma->dp_mutex);
1688 	kmem_cache_free(rootnex_state->r_dmahdl_cache, hp);
1689 
1690 	ROOTNEX_PROF_DEC(&rootnex_cnt[ROOTNEX_CNT_ACTIVE_HDLS]);
1691 	DTRACE_PROBE1(rootnex__free__handle, uint64_t,
1692 	    rootnex_cnt[ROOTNEX_CNT_ACTIVE_HDLS]);
1693 
1694 	if (rootnex_state->r_dvma_call_list_id)
1695 		ddi_run_callback(&rootnex_state->r_dvma_call_list_id);
1696 
1697 	return (DDI_SUCCESS);
1698 }
1699 
1700 
1701 /*
1702  * rootnex_dma_bindhdl()
1703  *    called from ddi_dma_addr_bind_handle() and ddi_dma_buf_bind_handle().
1704  */
1705 /*ARGSUSED*/
1706 static int
1707 rootnex_dma_bindhdl(dev_info_t *dip, dev_info_t *rdip, ddi_dma_handle_t handle,
1708     struct ddi_dma_req *dmareq, ddi_dma_cookie_t *cookiep, uint_t *ccountp)
1709 {
1710 	rootnex_sglinfo_t *sinfo;
1711 	ddi_dma_attr_t *attr;
1712 	ddi_dma_impl_t *hp;
1713 	rootnex_dma_t *dma;
1714 	int kmflag;
1715 	int e;
1716 
1717 
1718 	hp = (ddi_dma_impl_t *)handle;
1719 	dma = (rootnex_dma_t *)hp->dmai_private;
1720 	sinfo = &dma->dp_sglinfo;
1721 	attr = &hp->dmai_attr;
1722 
1723 	hp->dmai_rflags = dmareq->dmar_flags & DMP_DDIFLAGS;
1724 
1725 	/*
1726 	 * This is useful for debugging a driver. Not as useful in a production
1727 	 * system. The only time this will fail is if you have a driver bug.
1728 	 */
1729 	if (rootnex_bind_check_inuse) {
1730 		/*
1731 		 * No one else should ever have this lock unless someone else
1732 		 * is trying to use this handle. So contention on the lock
1733 		 * is the same as inuse being set.
1734 		 */
1735 		e = mutex_tryenter(&dma->dp_mutex);
1736 		if (e == 0) {
1737 			ROOTNEX_PROF_INC(&rootnex_cnt[ROOTNEX_CNT_BIND_FAIL]);
1738 			return (DDI_DMA_INUSE);
1739 		}
1740 		if (dma->dp_inuse) {
1741 			mutex_exit(&dma->dp_mutex);
1742 			ROOTNEX_PROF_INC(&rootnex_cnt[ROOTNEX_CNT_BIND_FAIL]);
1743 			return (DDI_DMA_INUSE);
1744 		}
1745 		dma->dp_inuse = B_TRUE;
1746 		mutex_exit(&dma->dp_mutex);
1747 	}
1748 
1749 	/* check the ddi_dma_attr arg to make sure it makes a little sense */
1750 	if (rootnex_bind_check_parms) {
1751 		e = rootnex_valid_bind_parms(dmareq, attr);
1752 		if (e != DDI_SUCCESS) {
1753 			ROOTNEX_PROF_INC(&rootnex_cnt[ROOTNEX_CNT_BIND_FAIL]);
1754 			rootnex_clean_dmahdl(hp);
1755 			return (e);
1756 		}
1757 	}
1758 
1759 	/* save away the original bind info */
1760 	dma->dp_dma = dmareq->dmar_object;
1761 
1762 	/*
1763 	 * Figure out a rough estimate of what maximum number of pages this
1764 	 * buffer could use (a high estimate of course).
1765 	 */
1766 	sinfo->si_max_pages = mmu_btopr(dma->dp_dma.dmao_size) + 1;
1767 
1768 	/*
1769 	 * We'll use the pre-allocated cookies for any bind that will *always*
1770 	 * fit (more important to be consistent, we don't want to create
1771 	 * additional degenerate cases).
1772 	 */
1773 	if (sinfo->si_max_pages <= rootnex_state->r_prealloc_cookies) {
1774 		dma->dp_cookies = (ddi_dma_cookie_t *)dma->dp_prealloc_buffer;
1775 		dma->dp_need_to_free_cookie = B_FALSE;
1776 		DTRACE_PROBE2(rootnex__bind__prealloc, dev_info_t *, rdip,
1777 		    uint_t, sinfo->si_max_pages);
1778 
1779 	/*
1780 	 * For anything larger than that, we'll go ahead and allocate the
1781 	 * maximum number of pages we expect to see. Hopefuly, we won't be
1782 	 * seeing this path in the fast path for high performance devices very
1783 	 * frequently.
1784 	 *
1785 	 * a ddi bind interface that allowed the driver to provide storage to
1786 	 * the bind interface would speed this case up.
1787 	 */
1788 	} else {
1789 		/* convert the sleep flags */
1790 		if (dmareq->dmar_fp == DDI_DMA_SLEEP) {
1791 			kmflag =  KM_SLEEP;
1792 		} else {
1793 			kmflag =  KM_NOSLEEP;
1794 		}
1795 
1796 		/*
1797 		 * Save away how much memory we allocated. If we're doing a
1798 		 * nosleep, the alloc could fail...
1799 		 */
1800 		dma->dp_cookie_size = sinfo->si_max_pages *
1801 		    sizeof (ddi_dma_cookie_t);
1802 		dma->dp_cookies = kmem_alloc(dma->dp_cookie_size, kmflag);
1803 		if (dma->dp_cookies == NULL) {
1804 			ROOTNEX_PROF_INC(&rootnex_cnt[ROOTNEX_CNT_BIND_FAIL]);
1805 			rootnex_clean_dmahdl(hp);
1806 			return (DDI_DMA_NORESOURCES);
1807 		}
1808 		dma->dp_need_to_free_cookie = B_TRUE;
1809 		DTRACE_PROBE2(rootnex__bind__alloc, dev_info_t *, rdip, uint_t,
1810 		    sinfo->si_max_pages);
1811 	}
1812 	hp->dmai_cookie = dma->dp_cookies;
1813 
1814 	/*
1815 	 * Get the real sgl. rootnex_get_sgl will fill in cookie array while
1816 	 * looking at the contraints in the dma structure. It will then put some
1817 	 * additional state about the sgl in the dma struct (i.e. is the sgl
1818 	 * clean, or do we need to do some munging; how many pages need to be
1819 	 * copied, etc.)
1820 	 */
1821 	rootnex_get_sgl(&dmareq->dmar_object, dma->dp_cookies,
1822 	    &dma->dp_sglinfo);
1823 	ASSERT(sinfo->si_sgl_size <= sinfo->si_max_pages);
1824 
1825 	/* if we don't need a copy buffer, we don't need to sync */
1826 	if (sinfo->si_copybuf_req == 0) {
1827 		hp->dmai_rflags |= DMP_NOSYNC;
1828 	}
1829 
1830 	/*
1831 	 * If the driver supports FMA, insert the handle in the FMA DMA handle
1832 	 * cache.
1833 	 */
1834 	if (attr->dma_attr_flags & DDI_DMA_FLAGERR) {
1835 		hp->dmai_error.err_cf = rootnex_dma_check;
1836 		(void) ndi_fmc_insert(rdip, DMA_HANDLE, hp, NULL);
1837 	}
1838 
1839 	/*
1840 	 * if we don't need the copybuf and we don't need to do a partial,  we
1841 	 * hit the fast path. All the high performance devices should be trying
1842 	 * to hit this path. To hit this path, a device should be able to reach
1843 	 * all of memory, shouldn't try to bind more than it can transfer, and
1844 	 * the buffer shouldn't require more cookies than the driver/device can
1845 	 * handle [sgllen]).
1846 	 */
1847 	if ((sinfo->si_copybuf_req == 0) &&
1848 	    (sinfo->si_sgl_size <= attr->dma_attr_sgllen) &&
1849 	    (dma->dp_dma.dmao_size < dma->dp_maxxfer)) {
1850 		/*
1851 		 * copy out the first cookie and ccountp, set the cookie
1852 		 * pointer to the second cookie. The first cookie is passed
1853 		 * back on the stack. Additional cookies are accessed via
1854 		 * ddi_dma_nextcookie()
1855 		 */
1856 		*cookiep = dma->dp_cookies[0];
1857 		*ccountp = sinfo->si_sgl_size;
1858 		hp->dmai_cookie++;
1859 		hp->dmai_rflags &= ~DDI_DMA_PARTIAL;
1860 		hp->dmai_nwin = 1;
1861 		ROOTNEX_PROF_INC(&rootnex_cnt[ROOTNEX_CNT_ACTIVE_BINDS]);
1862 		DTRACE_PROBE3(rootnex__bind__fast, dev_info_t *, rdip, uint64_t,
1863 		    rootnex_cnt[ROOTNEX_CNT_ACTIVE_BINDS], uint_t,
1864 		    dma->dp_dma.dmao_size);
1865 		return (DDI_DMA_MAPPED);
1866 	}
1867 
1868 	/*
1869 	 * go to the slow path, we may need to alloc more memory, create
1870 	 * multiple windows, and munge up a sgl to make the device happy.
1871 	 */
1872 	e = rootnex_bind_slowpath(hp, dmareq, dma, attr, kmflag);
1873 	if ((e != DDI_DMA_MAPPED) && (e != DDI_DMA_PARTIAL_MAP)) {
1874 		if (dma->dp_need_to_free_cookie) {
1875 			kmem_free(dma->dp_cookies, dma->dp_cookie_size);
1876 		}
1877 		ROOTNEX_PROF_INC(&rootnex_cnt[ROOTNEX_CNT_BIND_FAIL]);
1878 		rootnex_clean_dmahdl(hp); /* must be after free cookie */
1879 		return (e);
1880 	}
1881 
1882 	/* if the first window uses the copy buffer, sync it for the device */
1883 	if ((dma->dp_window[dma->dp_current_win].wd_dosync) &&
1884 	    (hp->dmai_rflags & DDI_DMA_WRITE)) {
1885 		(void) rootnex_dma_sync(dip, rdip, handle, 0, 0,
1886 		    DDI_DMA_SYNC_FORDEV);
1887 	}
1888 
1889 	/*
1890 	 * copy out the first cookie and ccountp, set the cookie pointer to the
1891 	 * second cookie. Make sure the partial flag is set/cleared correctly.
1892 	 * If we have a partial map (i.e. multiple windows), the number of
1893 	 * cookies we return is the number of cookies in the first window.
1894 	 */
1895 	if (e == DDI_DMA_MAPPED) {
1896 		hp->dmai_rflags &= ~DDI_DMA_PARTIAL;
1897 		*ccountp = sinfo->si_sgl_size;
1898 	} else {
1899 		hp->dmai_rflags |= DDI_DMA_PARTIAL;
1900 		*ccountp = dma->dp_window[dma->dp_current_win].wd_cookie_cnt;
1901 		ASSERT(hp->dmai_nwin <= dma->dp_max_win);
1902 	}
1903 	*cookiep = dma->dp_cookies[0];
1904 	hp->dmai_cookie++;
1905 
1906 	ROOTNEX_PROF_INC(&rootnex_cnt[ROOTNEX_CNT_ACTIVE_BINDS]);
1907 	DTRACE_PROBE3(rootnex__bind__slow, dev_info_t *, rdip, uint64_t,
1908 	    rootnex_cnt[ROOTNEX_CNT_ACTIVE_BINDS], uint_t,
1909 	    dma->dp_dma.dmao_size);
1910 	return (e);
1911 }
1912 
1913 
1914 /*
1915  * rootnex_dma_unbindhdl()
1916  *    called from ddi_dma_unbind_handle()
1917  */
1918 /*ARGSUSED*/
1919 static int
1920 rootnex_dma_unbindhdl(dev_info_t *dip, dev_info_t *rdip,
1921     ddi_dma_handle_t handle)
1922 {
1923 	ddi_dma_impl_t *hp;
1924 	rootnex_dma_t *dma;
1925 	int e;
1926 
1927 
1928 	hp = (ddi_dma_impl_t *)handle;
1929 	dma = (rootnex_dma_t *)hp->dmai_private;
1930 
1931 	/* make sure the buffer wasn't free'd before calling unbind */
1932 	if (rootnex_unbind_verify_buffer) {
1933 		e = rootnex_verify_buffer(dma);
1934 		if (e != DDI_SUCCESS) {
1935 			ASSERT(0);
1936 			return (DDI_FAILURE);
1937 		}
1938 	}
1939 
1940 	/* sync the current window before unbinding the buffer */
1941 	if (dma->dp_window && dma->dp_window[dma->dp_current_win].wd_dosync &&
1942 	    (hp->dmai_rflags & DDI_DMA_READ)) {
1943 		(void) rootnex_dma_sync(dip, rdip, handle, 0, 0,
1944 		    DDI_DMA_SYNC_FORCPU);
1945 	}
1946 
1947 	/*
1948 	 * If the driver supports FMA, remove the handle in the FMA DMA handle
1949 	 * cache.
1950 	 */
1951 	if (hp->dmai_attr.dma_attr_flags & DDI_DMA_FLAGERR) {
1952 		if ((DEVI(rdip)->devi_fmhdl != NULL) &&
1953 		    (DDI_FM_DMA_ERR_CAP(DEVI(rdip)->devi_fmhdl->fh_cap))) {
1954 			(void) ndi_fmc_remove(rdip, DMA_HANDLE, hp);
1955 		}
1956 	}
1957 
1958 	/*
1959 	 * cleanup and copy buffer or window state. if we didn't use the copy
1960 	 * buffer or windows, there won't be much to do :-)
1961 	 */
1962 	rootnex_teardown_copybuf(dma);
1963 	rootnex_teardown_windows(dma);
1964 
1965 	/*
1966 	 * If we had to allocate space to for the worse case sgl (it didn't
1967 	 * fit into our pre-allocate buffer), free that up now
1968 	 */
1969 	if (dma->dp_need_to_free_cookie) {
1970 		kmem_free(dma->dp_cookies, dma->dp_cookie_size);
1971 	}
1972 
1973 	/*
1974 	 * clean up the handle so it's ready for the next bind (i.e. if the
1975 	 * handle is reused).
1976 	 */
1977 	rootnex_clean_dmahdl(hp);
1978 
1979 	if (rootnex_state->r_dvma_call_list_id)
1980 		ddi_run_callback(&rootnex_state->r_dvma_call_list_id);
1981 
1982 	ROOTNEX_PROF_DEC(&rootnex_cnt[ROOTNEX_CNT_ACTIVE_BINDS]);
1983 	DTRACE_PROBE1(rootnex__unbind, uint64_t,
1984 	    rootnex_cnt[ROOTNEX_CNT_ACTIVE_BINDS]);
1985 
1986 	return (DDI_SUCCESS);
1987 }
1988 
1989 
1990 /*
1991  * rootnex_verify_buffer()
1992  *   verify buffer wasn't free'd
1993  */
1994 static int
1995 rootnex_verify_buffer(rootnex_dma_t *dma)
1996 {
1997 	page_t **pplist;
1998 	caddr_t vaddr;
1999 	uint_t pcnt;
2000 	uint_t poff;
2001 	page_t *pp;
2002 	char b;
2003 	int i;
2004 
2005 	/* Figure out how many pages this buffer occupies */
2006 	if (dma->dp_dma.dmao_type == DMA_OTYP_PAGES) {
2007 		poff = dma->dp_dma.dmao_obj.pp_obj.pp_offset & MMU_PAGEOFFSET;
2008 	} else {
2009 		vaddr = dma->dp_dma.dmao_obj.virt_obj.v_addr;
2010 		poff = (uintptr_t)vaddr & MMU_PAGEOFFSET;
2011 	}
2012 	pcnt = mmu_btopr(dma->dp_dma.dmao_size + poff);
2013 
2014 	switch (dma->dp_dma.dmao_type) {
2015 	case DMA_OTYP_PAGES:
2016 		/*
2017 		 * for a linked list of pp's walk through them to make sure
2018 		 * they're locked and not free.
2019 		 */
2020 		pp = dma->dp_dma.dmao_obj.pp_obj.pp_pp;
2021 		for (i = 0; i < pcnt; i++) {
2022 			if (PP_ISFREE(pp) || !PAGE_LOCKED(pp)) {
2023 				return (DDI_FAILURE);
2024 			}
2025 			pp = pp->p_next;
2026 		}
2027 		break;
2028 
2029 	case DMA_OTYP_VADDR:
2030 	case DMA_OTYP_BUFVADDR:
2031 		pplist = dma->dp_dma.dmao_obj.virt_obj.v_priv;
2032 		/*
2033 		 * for an array of pp's walk through them to make sure they're
2034 		 * not free. It's possible that they may not be locked.
2035 		 */
2036 		if (pplist) {
2037 			for (i = 0; i < pcnt; i++) {
2038 				if (PP_ISFREE(pplist[i])) {
2039 					return (DDI_FAILURE);
2040 				}
2041 			}
2042 
2043 		/* For a virtual address, try to peek at each page */
2044 		} else {
2045 			if (dma->dp_sglinfo.si_asp == &kas) {
2046 				for (i = 0; i < pcnt; i++) {
2047 					if (ddi_peek8(NULL, vaddr, &b) ==
2048 					    DDI_FAILURE)
2049 						return (DDI_FAILURE);
2050 					vaddr += MMU_PAGESIZE;
2051 				}
2052 			}
2053 		}
2054 		break;
2055 
2056 	default:
2057 		ASSERT(0);
2058 		break;
2059 	}
2060 
2061 	return (DDI_SUCCESS);
2062 }
2063 
2064 
2065 /*
2066  * rootnex_clean_dmahdl()
2067  *    Clean the dma handle. This should be called on a handle alloc and an
2068  *    unbind handle. Set the handle state to the default settings.
2069  */
2070 static void
2071 rootnex_clean_dmahdl(ddi_dma_impl_t *hp)
2072 {
2073 	rootnex_dma_t *dma;
2074 
2075 
2076 	dma = (rootnex_dma_t *)hp->dmai_private;
2077 
2078 	hp->dmai_nwin = 0;
2079 	dma->dp_current_cookie = 0;
2080 	dma->dp_copybuf_size = 0;
2081 	dma->dp_window = NULL;
2082 	dma->dp_cbaddr = NULL;
2083 	dma->dp_inuse = B_FALSE;
2084 	dma->dp_need_to_free_cookie = B_FALSE;
2085 	dma->dp_need_to_free_window = B_FALSE;
2086 	dma->dp_partial_required = B_FALSE;
2087 	dma->dp_trim_required = B_FALSE;
2088 	dma->dp_sglinfo.si_copybuf_req = 0;
2089 #if !defined(__amd64)
2090 	dma->dp_cb_remaping = B_FALSE;
2091 	dma->dp_kva = NULL;
2092 #endif
2093 
2094 	/* FMA related initialization */
2095 	hp->dmai_fault = 0;
2096 	hp->dmai_fault_check = NULL;
2097 	hp->dmai_fault_notify = NULL;
2098 	hp->dmai_error.err_ena = 0;
2099 	hp->dmai_error.err_status = DDI_FM_OK;
2100 	hp->dmai_error.err_expected = DDI_FM_ERR_UNEXPECTED;
2101 	hp->dmai_error.err_ontrap = NULL;
2102 	hp->dmai_error.err_fep = NULL;
2103 	hp->dmai_error.err_cf = NULL;
2104 }
2105 
2106 
2107 /*
2108  * rootnex_valid_alloc_parms()
2109  *    Called in ddi_dma_alloc_handle path to validate its parameters.
2110  */
2111 static int
2112 rootnex_valid_alloc_parms(ddi_dma_attr_t *attr, uint_t maxsegmentsize)
2113 {
2114 	if ((attr->dma_attr_seg < MMU_PAGEOFFSET) ||
2115 	    (attr->dma_attr_count_max < MMU_PAGEOFFSET) ||
2116 	    (attr->dma_attr_granular > MMU_PAGESIZE) ||
2117 	    (attr->dma_attr_maxxfer < MMU_PAGESIZE)) {
2118 		return (DDI_DMA_BADATTR);
2119 	}
2120 
2121 	if (attr->dma_attr_addr_hi <= attr->dma_attr_addr_lo) {
2122 		return (DDI_DMA_BADATTR);
2123 	}
2124 
2125 	if ((attr->dma_attr_seg & MMU_PAGEOFFSET) != MMU_PAGEOFFSET ||
2126 	    MMU_PAGESIZE & (attr->dma_attr_granular - 1) ||
2127 	    attr->dma_attr_sgllen <= 0) {
2128 		return (DDI_DMA_BADATTR);
2129 	}
2130 
2131 	/* We should be able to DMA into every byte offset in a page */
2132 	if (maxsegmentsize < MMU_PAGESIZE) {
2133 		return (DDI_DMA_BADATTR);
2134 	}
2135 
2136 	return (DDI_SUCCESS);
2137 }
2138 
2139 
2140 /*
2141  * rootnex_valid_bind_parms()
2142  *    Called in ddi_dma_*_bind_handle path to validate its parameters.
2143  */
2144 /* ARGSUSED */
2145 static int
2146 rootnex_valid_bind_parms(ddi_dma_req_t *dmareq, ddi_dma_attr_t *attr)
2147 {
2148 #if !defined(__amd64)
2149 	/*
2150 	 * we only support up to a 2G-1 transfer size on 32-bit kernels so
2151 	 * we can track the offset for the obsoleted interfaces.
2152 	 */
2153 	if (dmareq->dmar_object.dmao_size > 0x7FFFFFFF) {
2154 		return (DDI_DMA_TOOBIG);
2155 	}
2156 #endif
2157 
2158 	return (DDI_SUCCESS);
2159 }
2160 
2161 
2162 /*
2163  * rootnex_get_sgl()
2164  *    Called in bind fastpath to get the sgl. Most of this will be replaced
2165  *    with a call to the vm layer when vm2.0 comes around...
2166  */
2167 static void
2168 rootnex_get_sgl(ddi_dma_obj_t *dmar_object, ddi_dma_cookie_t *sgl,
2169     rootnex_sglinfo_t *sglinfo)
2170 {
2171 	ddi_dma_atyp_t buftype;
2172 	rootnex_addr_t raddr;
2173 	uint64_t last_page;
2174 	uint64_t offset;
2175 	uint64_t addrhi;
2176 	uint64_t addrlo;
2177 	uint64_t maxseg;
2178 	page_t **pplist;
2179 	uint64_t paddr;
2180 	uint32_t psize;
2181 	uint32_t size;
2182 	caddr_t vaddr;
2183 	uint_t pcnt;
2184 	page_t *pp;
2185 	uint_t cnt;
2186 
2187 
2188 	/* shortcuts */
2189 	pplist = dmar_object->dmao_obj.virt_obj.v_priv;
2190 	vaddr = dmar_object->dmao_obj.virt_obj.v_addr;
2191 	maxseg = sglinfo->si_max_cookie_size;
2192 	buftype = dmar_object->dmao_type;
2193 	addrhi = sglinfo->si_max_addr;
2194 	addrlo = sglinfo->si_min_addr;
2195 	size = dmar_object->dmao_size;
2196 
2197 	pcnt = 0;
2198 	cnt = 0;
2199 
2200 	/*
2201 	 * if we were passed down a linked list of pages, i.e. pointer to
2202 	 * page_t, use this to get our physical address and buf offset.
2203 	 */
2204 	if (buftype == DMA_OTYP_PAGES) {
2205 		pp = dmar_object->dmao_obj.pp_obj.pp_pp;
2206 		ASSERT(!PP_ISFREE(pp) && PAGE_LOCKED(pp));
2207 		offset =  dmar_object->dmao_obj.pp_obj.pp_offset &
2208 		    MMU_PAGEOFFSET;
2209 		paddr = pfn_to_pa(pp->p_pagenum) + offset;
2210 		psize = MIN(size, (MMU_PAGESIZE - offset));
2211 		pp = pp->p_next;
2212 		sglinfo->si_asp = NULL;
2213 
2214 	/*
2215 	 * We weren't passed down a linked list of pages, but if we were passed
2216 	 * down an array of pages, use this to get our physical address and buf
2217 	 * offset.
2218 	 */
2219 	} else if (pplist != NULL) {
2220 		ASSERT((buftype == DMA_OTYP_VADDR) ||
2221 		    (buftype == DMA_OTYP_BUFVADDR));
2222 
2223 		offset = (uintptr_t)vaddr & MMU_PAGEOFFSET;
2224 		sglinfo->si_asp = dmar_object->dmao_obj.virt_obj.v_as;
2225 		if (sglinfo->si_asp == NULL) {
2226 			sglinfo->si_asp = &kas;
2227 		}
2228 
2229 		ASSERT(!PP_ISFREE(pplist[pcnt]));
2230 		paddr = pfn_to_pa(pplist[pcnt]->p_pagenum);
2231 		paddr += offset;
2232 		psize = MIN(size, (MMU_PAGESIZE - offset));
2233 		pcnt++;
2234 
2235 	/*
2236 	 * All we have is a virtual address, we'll need to call into the VM
2237 	 * to get the physical address.
2238 	 */
2239 	} else {
2240 		ASSERT((buftype == DMA_OTYP_VADDR) ||
2241 		    (buftype == DMA_OTYP_BUFVADDR));
2242 
2243 		offset = (uintptr_t)vaddr & MMU_PAGEOFFSET;
2244 		sglinfo->si_asp = dmar_object->dmao_obj.virt_obj.v_as;
2245 		if (sglinfo->si_asp == NULL) {
2246 			sglinfo->si_asp = &kas;
2247 		}
2248 
2249 		paddr = pfn_to_pa(hat_getpfnum(sglinfo->si_asp->a_hat, vaddr));
2250 		paddr += offset;
2251 		psize = MIN(size, (MMU_PAGESIZE - offset));
2252 		vaddr += psize;
2253 	}
2254 
2255 #ifdef __xpv
2256 	/*
2257 	 * If we're dom0, we're using a real device so we need to load
2258 	 * the cookies with MFNs instead of PFNs.
2259 	 */
2260 	raddr = ROOTNEX_PADDR_TO_RBASE(xen_info, paddr);
2261 #else
2262 	raddr = paddr;
2263 #endif
2264 
2265 	/*
2266 	 * Setup the first cookie with the physical address of the page and the
2267 	 * size of the page (which takes into account the initial offset into
2268 	 * the page.
2269 	 */
2270 	sgl[cnt].dmac_laddress = raddr;
2271 	sgl[cnt].dmac_size = psize;
2272 	sgl[cnt].dmac_type = 0;
2273 
2274 	/*
2275 	 * Save away the buffer offset into the page. We'll need this later in
2276 	 * the copy buffer code to help figure out the page index within the
2277 	 * buffer and the offset into the current page.
2278 	 */
2279 	sglinfo->si_buf_offset = offset;
2280 
2281 	/*
2282 	 * If the DMA engine can't reach the physical address, increase how
2283 	 * much copy buffer we need. We always increase by pagesize so we don't
2284 	 * have to worry about converting offsets. Set a flag in the cookies
2285 	 * dmac_type to indicate that it uses the copy buffer. If this isn't the
2286 	 * last cookie, go to the next cookie (since we separate each page which
2287 	 * uses the copy buffer in case the copy buffer is not physically
2288 	 * contiguous.
2289 	 */
2290 	if ((raddr < addrlo) || ((raddr + psize) > addrhi)) {
2291 		sglinfo->si_copybuf_req += MMU_PAGESIZE;
2292 		sgl[cnt].dmac_type = ROOTNEX_USES_COPYBUF;
2293 		if ((cnt + 1) < sglinfo->si_max_pages) {
2294 			cnt++;
2295 			sgl[cnt].dmac_laddress = 0;
2296 			sgl[cnt].dmac_size = 0;
2297 			sgl[cnt].dmac_type = 0;
2298 		}
2299 	}
2300 
2301 	/*
2302 	 * save this page's physical address so we can figure out if the next
2303 	 * page is physically contiguous. Keep decrementing size until we are
2304 	 * done with the buffer.
2305 	 */
2306 	last_page = raddr & MMU_PAGEMASK;
2307 	size -= psize;
2308 
2309 	while (size > 0) {
2310 		/* Get the size for this page (i.e. partial or full page) */
2311 		psize = MIN(size, MMU_PAGESIZE);
2312 
2313 		if (buftype == DMA_OTYP_PAGES) {
2314 			/* get the paddr from the page_t */
2315 			ASSERT(!PP_ISFREE(pp) && PAGE_LOCKED(pp));
2316 			paddr = pfn_to_pa(pp->p_pagenum);
2317 			pp = pp->p_next;
2318 		} else if (pplist != NULL) {
2319 			/* index into the array of page_t's to get the paddr */
2320 			ASSERT(!PP_ISFREE(pplist[pcnt]));
2321 			paddr = pfn_to_pa(pplist[pcnt]->p_pagenum);
2322 			pcnt++;
2323 		} else {
2324 			/* call into the VM to get the paddr */
2325 			paddr =  pfn_to_pa(hat_getpfnum(sglinfo->si_asp->a_hat,
2326 			    vaddr));
2327 			vaddr += psize;
2328 		}
2329 
2330 #ifdef __xpv
2331 		/*
2332 		 * If we're dom0, we're using a real device so we need to load
2333 		 * the cookies with MFNs instead of PFNs.
2334 		 */
2335 		raddr = ROOTNEX_PADDR_TO_RBASE(xen_info, paddr);
2336 #else
2337 		raddr = paddr;
2338 #endif
2339 
2340 		/* check to see if this page needs the copy buffer */
2341 		if ((raddr < addrlo) || ((raddr + psize) > addrhi)) {
2342 			sglinfo->si_copybuf_req += MMU_PAGESIZE;
2343 
2344 			/*
2345 			 * if there is something in the current cookie, go to
2346 			 * the next one. We only want one page in a cookie which
2347 			 * uses the copybuf since the copybuf doesn't have to
2348 			 * be physically contiguous.
2349 			 */
2350 			if (sgl[cnt].dmac_size != 0) {
2351 				cnt++;
2352 			}
2353 			sgl[cnt].dmac_laddress = raddr;
2354 			sgl[cnt].dmac_size = psize;
2355 #if defined(__amd64)
2356 			sgl[cnt].dmac_type = ROOTNEX_USES_COPYBUF;
2357 #else
2358 			/*
2359 			 * save the buf offset for 32-bit kernel. used in the
2360 			 * obsoleted interfaces.
2361 			 */
2362 			sgl[cnt].dmac_type = ROOTNEX_USES_COPYBUF |
2363 			    (dmar_object->dmao_size - size);
2364 #endif
2365 			/* if this isn't the last cookie, go to the next one */
2366 			if ((cnt + 1) < sglinfo->si_max_pages) {
2367 				cnt++;
2368 				sgl[cnt].dmac_laddress = 0;
2369 				sgl[cnt].dmac_size = 0;
2370 				sgl[cnt].dmac_type = 0;
2371 			}
2372 
2373 		/*
2374 		 * this page didn't need the copy buffer, if it's not physically
2375 		 * contiguous, or it would put us over a segment boundary, or it
2376 		 * puts us over the max cookie size, or the current sgl doesn't
2377 		 * have anything in it.
2378 		 */
2379 		} else if (((last_page + MMU_PAGESIZE) != raddr) ||
2380 		    !(raddr & sglinfo->si_segmask) ||
2381 		    ((sgl[cnt].dmac_size + psize) > maxseg) ||
2382 		    (sgl[cnt].dmac_size == 0)) {
2383 			/*
2384 			 * if we're not already in a new cookie, go to the next
2385 			 * cookie.
2386 			 */
2387 			if (sgl[cnt].dmac_size != 0) {
2388 				cnt++;
2389 			}
2390 
2391 			/* save the cookie information */
2392 			sgl[cnt].dmac_laddress = raddr;
2393 			sgl[cnt].dmac_size = psize;
2394 #if defined(__amd64)
2395 			sgl[cnt].dmac_type = 0;
2396 #else
2397 			/*
2398 			 * save the buf offset for 32-bit kernel. used in the
2399 			 * obsoleted interfaces.
2400 			 */
2401 			sgl[cnt].dmac_type = dmar_object->dmao_size - size;
2402 #endif
2403 
2404 		/*
2405 		 * this page didn't need the copy buffer, it is physically
2406 		 * contiguous with the last page, and it's <= the max cookie
2407 		 * size.
2408 		 */
2409 		} else {
2410 			sgl[cnt].dmac_size += psize;
2411 
2412 			/*
2413 			 * if this exactly ==  the maximum cookie size, and
2414 			 * it isn't the last cookie, go to the next cookie.
2415 			 */
2416 			if (((sgl[cnt].dmac_size + psize) == maxseg) &&
2417 			    ((cnt + 1) < sglinfo->si_max_pages)) {
2418 				cnt++;
2419 				sgl[cnt].dmac_laddress = 0;
2420 				sgl[cnt].dmac_size = 0;
2421 				sgl[cnt].dmac_type = 0;
2422 			}
2423 		}
2424 
2425 		/*
2426 		 * save this page's physical address so we can figure out if the
2427 		 * next page is physically contiguous. Keep decrementing size
2428 		 * until we are done with the buffer.
2429 		 */
2430 		last_page = raddr;
2431 		size -= psize;
2432 	}
2433 
2434 	/* we're done, save away how many cookies the sgl has */
2435 	if (sgl[cnt].dmac_size == 0) {
2436 		ASSERT(cnt < sglinfo->si_max_pages);
2437 		sglinfo->si_sgl_size = cnt;
2438 	} else {
2439 		sglinfo->si_sgl_size = cnt + 1;
2440 	}
2441 }
2442 
2443 
2444 /*
2445  * rootnex_bind_slowpath()
2446  *    Call in the bind path if the calling driver can't use the sgl without
2447  *    modifying it. We either need to use the copy buffer and/or we will end up
2448  *    with a partial bind.
2449  */
2450 static int
2451 rootnex_bind_slowpath(ddi_dma_impl_t *hp, struct ddi_dma_req *dmareq,
2452     rootnex_dma_t *dma, ddi_dma_attr_t *attr, int kmflag)
2453 {
2454 	rootnex_sglinfo_t *sinfo;
2455 	rootnex_window_t *window;
2456 	ddi_dma_cookie_t *cookie;
2457 	size_t copybuf_used;
2458 	size_t dmac_size;
2459 	boolean_t partial;
2460 	off_t cur_offset;
2461 	page_t *cur_pp;
2462 	major_t mnum;
2463 	int e;
2464 	int i;
2465 
2466 
2467 	sinfo = &dma->dp_sglinfo;
2468 	copybuf_used = 0;
2469 	partial = B_FALSE;
2470 
2471 	/*
2472 	 * If we're using the copybuf, set the copybuf state in dma struct.
2473 	 * Needs to be first since it sets the copy buffer size.
2474 	 */
2475 	if (sinfo->si_copybuf_req != 0) {
2476 		e = rootnex_setup_copybuf(hp, dmareq, dma, attr);
2477 		if (e != DDI_SUCCESS) {
2478 			return (e);
2479 		}
2480 	} else {
2481 		dma->dp_copybuf_size = 0;
2482 	}
2483 
2484 	/*
2485 	 * Figure out if we need to do a partial mapping. If so, figure out
2486 	 * if we need to trim the buffers when we munge the sgl.
2487 	 */
2488 	if ((dma->dp_copybuf_size < sinfo->si_copybuf_req) ||
2489 	    (dma->dp_dma.dmao_size > dma->dp_maxxfer) ||
2490 	    (attr->dma_attr_sgllen < sinfo->si_sgl_size)) {
2491 		dma->dp_partial_required = B_TRUE;
2492 		if (attr->dma_attr_granular != 1) {
2493 			dma->dp_trim_required = B_TRUE;
2494 		}
2495 	} else {
2496 		dma->dp_partial_required = B_FALSE;
2497 		dma->dp_trim_required = B_FALSE;
2498 	}
2499 
2500 	/* If we need to do a partial bind, make sure the driver supports it */
2501 	if (dma->dp_partial_required &&
2502 	    !(dmareq->dmar_flags & DDI_DMA_PARTIAL)) {
2503 
2504 		mnum = ddi_driver_major(dma->dp_dip);
2505 		/*
2506 		 * patchable which allows us to print one warning per major
2507 		 * number.
2508 		 */
2509 		if ((rootnex_bind_warn) &&
2510 		    ((rootnex_warn_list[mnum] & ROOTNEX_BIND_WARNING) == 0)) {
2511 			rootnex_warn_list[mnum] |= ROOTNEX_BIND_WARNING;
2512 			cmn_err(CE_WARN, "!%s: coding error detected, the "
2513 			    "driver is using ddi_dma_attr(9S) incorrectly. "
2514 			    "There is a small risk of data corruption in "
2515 			    "particular with large I/Os. The driver should be "
2516 			    "replaced with a corrected version for proper "
2517 			    "system operation. To disable this warning, add "
2518 			    "'set rootnex:rootnex_bind_warn=0' to "
2519 			    "/etc/system(4).", ddi_driver_name(dma->dp_dip));
2520 		}
2521 		return (DDI_DMA_TOOBIG);
2522 	}
2523 
2524 	/*
2525 	 * we might need multiple windows, setup state to handle them. In this
2526 	 * code path, we will have at least one window.
2527 	 */
2528 	e = rootnex_setup_windows(hp, dma, attr, kmflag);
2529 	if (e != DDI_SUCCESS) {
2530 		rootnex_teardown_copybuf(dma);
2531 		return (e);
2532 	}
2533 
2534 	window = &dma->dp_window[0];
2535 	cookie = &dma->dp_cookies[0];
2536 	cur_offset = 0;
2537 	rootnex_init_win(hp, dma, window, cookie, cur_offset);
2538 	if (dmareq->dmar_object.dmao_type == DMA_OTYP_PAGES) {
2539 		cur_pp = dmareq->dmar_object.dmao_obj.pp_obj.pp_pp;
2540 	}
2541 
2542 	/* loop though all the cookies we got back from get_sgl() */
2543 	for (i = 0; i < sinfo->si_sgl_size; i++) {
2544 		/*
2545 		 * If we're using the copy buffer, check this cookie and setup
2546 		 * its associated copy buffer state. If this cookie uses the
2547 		 * copy buffer, make sure we sync this window during dma_sync.
2548 		 */
2549 		if (dma->dp_copybuf_size > 0) {
2550 			rootnex_setup_cookie(&dmareq->dmar_object, dma, cookie,
2551 			    cur_offset, &copybuf_used, &cur_pp);
2552 			if (cookie->dmac_type & ROOTNEX_USES_COPYBUF) {
2553 				window->wd_dosync = B_TRUE;
2554 			}
2555 		}
2556 
2557 		/*
2558 		 * save away the cookie size, since it could be modified in
2559 		 * the windowing code.
2560 		 */
2561 		dmac_size = cookie->dmac_size;
2562 
2563 		/* if we went over max copybuf size */
2564 		if (dma->dp_copybuf_size &&
2565 		    (copybuf_used > dma->dp_copybuf_size)) {
2566 			partial = B_TRUE;
2567 			e = rootnex_copybuf_window_boundary(hp, dma, &window,
2568 			    cookie, cur_offset, &copybuf_used);
2569 			if (e != DDI_SUCCESS) {
2570 				rootnex_teardown_copybuf(dma);
2571 				rootnex_teardown_windows(dma);
2572 				return (e);
2573 			}
2574 
2575 			/*
2576 			 * if the coookie uses the copy buffer, make sure the
2577 			 * new window we just moved to is set to sync.
2578 			 */
2579 			if (cookie->dmac_type & ROOTNEX_USES_COPYBUF) {
2580 				window->wd_dosync = B_TRUE;
2581 			}
2582 			DTRACE_PROBE1(rootnex__copybuf__window, dev_info_t *,
2583 			    dma->dp_dip);
2584 
2585 		/* if the cookie cnt == max sgllen, move to the next window */
2586 		} else if (window->wd_cookie_cnt >= attr->dma_attr_sgllen) {
2587 			partial = B_TRUE;
2588 			ASSERT(window->wd_cookie_cnt == attr->dma_attr_sgllen);
2589 			e = rootnex_sgllen_window_boundary(hp, dma, &window,
2590 			    cookie, attr, cur_offset);
2591 			if (e != DDI_SUCCESS) {
2592 				rootnex_teardown_copybuf(dma);
2593 				rootnex_teardown_windows(dma);
2594 				return (e);
2595 			}
2596 
2597 			/*
2598 			 * if the coookie uses the copy buffer, make sure the
2599 			 * new window we just moved to is set to sync.
2600 			 */
2601 			if (cookie->dmac_type & ROOTNEX_USES_COPYBUF) {
2602 				window->wd_dosync = B_TRUE;
2603 			}
2604 			DTRACE_PROBE1(rootnex__sgllen__window, dev_info_t *,
2605 			    dma->dp_dip);
2606 
2607 		/* else if we will be over maxxfer */
2608 		} else if ((window->wd_size + dmac_size) >
2609 		    dma->dp_maxxfer) {
2610 			partial = B_TRUE;
2611 			e = rootnex_maxxfer_window_boundary(hp, dma, &window,
2612 			    cookie);
2613 			if (e != DDI_SUCCESS) {
2614 				rootnex_teardown_copybuf(dma);
2615 				rootnex_teardown_windows(dma);
2616 				return (e);
2617 			}
2618 
2619 			/*
2620 			 * if the coookie uses the copy buffer, make sure the
2621 			 * new window we just moved to is set to sync.
2622 			 */
2623 			if (cookie->dmac_type & ROOTNEX_USES_COPYBUF) {
2624 				window->wd_dosync = B_TRUE;
2625 			}
2626 			DTRACE_PROBE1(rootnex__maxxfer__window, dev_info_t *,
2627 			    dma->dp_dip);
2628 
2629 		/* else this cookie fits in the current window */
2630 		} else {
2631 			window->wd_cookie_cnt++;
2632 			window->wd_size += dmac_size;
2633 		}
2634 
2635 		/* track our offset into the buffer, go to the next cookie */
2636 		ASSERT(dmac_size <= dma->dp_dma.dmao_size);
2637 		ASSERT(cookie->dmac_size <= dmac_size);
2638 		cur_offset += dmac_size;
2639 		cookie++;
2640 	}
2641 
2642 	/* if we ended up with a zero sized window in the end, clean it up */
2643 	if (window->wd_size == 0) {
2644 		hp->dmai_nwin--;
2645 		window--;
2646 	}
2647 
2648 	ASSERT(window->wd_trim.tr_trim_last == B_FALSE);
2649 
2650 	if (!partial) {
2651 		return (DDI_DMA_MAPPED);
2652 	}
2653 
2654 	ASSERT(dma->dp_partial_required);
2655 	return (DDI_DMA_PARTIAL_MAP);
2656 }
2657 
2658 
2659 /*
2660  * rootnex_setup_copybuf()
2661  *    Called in bind slowpath. Figures out if we're going to use the copy
2662  *    buffer, and if we do, sets up the basic state to handle it.
2663  */
2664 static int
2665 rootnex_setup_copybuf(ddi_dma_impl_t *hp, struct ddi_dma_req *dmareq,
2666     rootnex_dma_t *dma, ddi_dma_attr_t *attr)
2667 {
2668 	rootnex_sglinfo_t *sinfo;
2669 	ddi_dma_attr_t lattr;
2670 	size_t max_copybuf;
2671 	int cansleep;
2672 	int e;
2673 #if !defined(__amd64)
2674 	int vmflag;
2675 #endif
2676 
2677 
2678 	sinfo = &dma->dp_sglinfo;
2679 
2680 	/* read this first so it's consistent through the routine  */
2681 	max_copybuf = i_ddi_copybuf_size() & MMU_PAGEMASK;
2682 
2683 	/* We need to call into the rootnex on ddi_dma_sync() */
2684 	hp->dmai_rflags &= ~DMP_NOSYNC;
2685 
2686 	/* make sure the copybuf size <= the max size */
2687 	dma->dp_copybuf_size = MIN(sinfo->si_copybuf_req, max_copybuf);
2688 	ASSERT((dma->dp_copybuf_size & MMU_PAGEOFFSET) == 0);
2689 
2690 #if !defined(__amd64)
2691 	/*
2692 	 * if we don't have kva space to copy to/from, allocate the KVA space
2693 	 * now. We only do this for the 32-bit kernel. We use seg kpm space for
2694 	 * the 64-bit kernel.
2695 	 */
2696 	if ((dmareq->dmar_object.dmao_type == DMA_OTYP_PAGES) ||
2697 	    (dmareq->dmar_object.dmao_obj.virt_obj.v_as != NULL)) {
2698 
2699 		/* convert the sleep flags */
2700 		if (dmareq->dmar_fp == DDI_DMA_SLEEP) {
2701 			vmflag = VM_SLEEP;
2702 		} else {
2703 			vmflag = VM_NOSLEEP;
2704 		}
2705 
2706 		/* allocate Kernel VA space that we can bcopy to/from */
2707 		dma->dp_kva = vmem_alloc(heap_arena, dma->dp_copybuf_size,
2708 		    vmflag);
2709 		if (dma->dp_kva == NULL) {
2710 			return (DDI_DMA_NORESOURCES);
2711 		}
2712 	}
2713 #endif
2714 
2715 	/* convert the sleep flags */
2716 	if (dmareq->dmar_fp == DDI_DMA_SLEEP) {
2717 		cansleep = 1;
2718 	} else {
2719 		cansleep = 0;
2720 	}
2721 
2722 	/*
2723 	 * Allocated the actual copy buffer. This needs to fit within the DMA
2724 	 * engines limits, so we can't use kmem_alloc...
2725 	 */
2726 	lattr = *attr;
2727 	lattr.dma_attr_align = MMU_PAGESIZE;
2728 	e = i_ddi_mem_alloc(dma->dp_dip, &lattr, dma->dp_copybuf_size, cansleep,
2729 	    0, NULL, &dma->dp_cbaddr, &dma->dp_cbsize, NULL);
2730 	if (e != DDI_SUCCESS) {
2731 #if !defined(__amd64)
2732 		if (dma->dp_kva != NULL) {
2733 			vmem_free(heap_arena, dma->dp_kva,
2734 			    dma->dp_copybuf_size);
2735 		}
2736 #endif
2737 		return (DDI_DMA_NORESOURCES);
2738 	}
2739 
2740 	DTRACE_PROBE2(rootnex__alloc__copybuf, dev_info_t *, dma->dp_dip,
2741 	    size_t, dma->dp_copybuf_size);
2742 
2743 	return (DDI_SUCCESS);
2744 }
2745 
2746 
2747 /*
2748  * rootnex_setup_windows()
2749  *    Called in bind slowpath to setup the window state. We always have windows
2750  *    in the slowpath. Even if the window count = 1.
2751  */
2752 static int
2753 rootnex_setup_windows(ddi_dma_impl_t *hp, rootnex_dma_t *dma,
2754     ddi_dma_attr_t *attr, int kmflag)
2755 {
2756 	rootnex_window_t *windowp;
2757 	rootnex_sglinfo_t *sinfo;
2758 	size_t copy_state_size;
2759 	size_t win_state_size;
2760 	size_t state_available;
2761 	size_t space_needed;
2762 	uint_t copybuf_win;
2763 	uint_t maxxfer_win;
2764 	size_t space_used;
2765 	uint_t sglwin;
2766 
2767 
2768 	sinfo = &dma->dp_sglinfo;
2769 
2770 	dma->dp_current_win = 0;
2771 	hp->dmai_nwin = 0;
2772 
2773 	/* If we don't need to do a partial, we only have one window */
2774 	if (!dma->dp_partial_required) {
2775 		dma->dp_max_win = 1;
2776 
2777 	/*
2778 	 * we need multiple windows, need to figure out the worse case number
2779 	 * of windows.
2780 	 */
2781 	} else {
2782 		/*
2783 		 * if we need windows because we need more copy buffer that
2784 		 * we allow, the worse case number of windows we could need
2785 		 * here would be (copybuf space required / copybuf space that
2786 		 * we have) plus one for remainder, and plus 2 to handle the
2787 		 * extra pages on the trim for the first and last pages of the
2788 		 * buffer (a page is the minimum window size so under the right
2789 		 * attr settings, you could have a window for each page).
2790 		 * The last page will only be hit here if the size is not a
2791 		 * multiple of the granularity (which theoretically shouldn't
2792 		 * be the case but never has been enforced, so we could have
2793 		 * broken things without it).
2794 		 */
2795 		if (sinfo->si_copybuf_req > dma->dp_copybuf_size) {
2796 			ASSERT(dma->dp_copybuf_size > 0);
2797 			copybuf_win = (sinfo->si_copybuf_req /
2798 			    dma->dp_copybuf_size) + 1 + 2;
2799 		} else {
2800 			copybuf_win = 0;
2801 		}
2802 
2803 		/*
2804 		 * if we need windows because we have more cookies than the H/W
2805 		 * can handle, the number of windows we would need here would
2806 		 * be (cookie count / cookies count H/W supports) plus one for
2807 		 * remainder, and plus 2 to handle the extra pages on the trim
2808 		 * (see above comment about trim)
2809 		 */
2810 		if (attr->dma_attr_sgllen < sinfo->si_sgl_size) {
2811 			sglwin = ((sinfo->si_sgl_size / attr->dma_attr_sgllen)
2812 			    + 1) + 2;
2813 		} else {
2814 			sglwin = 0;
2815 		}
2816 
2817 		/*
2818 		 * if we need windows because we're binding more memory than the
2819 		 * H/W can transfer at once, the number of windows we would need
2820 		 * here would be (xfer count / max xfer H/W supports) plus one
2821 		 * for remainder, and plus 2 to handle the extra pages on the
2822 		 * trim (see above comment about trim)
2823 		 */
2824 		if (dma->dp_dma.dmao_size > dma->dp_maxxfer) {
2825 			maxxfer_win = (dma->dp_dma.dmao_size /
2826 			    dma->dp_maxxfer) + 1 + 2;
2827 		} else {
2828 			maxxfer_win = 0;
2829 		}
2830 		dma->dp_max_win =  copybuf_win + sglwin + maxxfer_win;
2831 		ASSERT(dma->dp_max_win > 0);
2832 	}
2833 	win_state_size = dma->dp_max_win * sizeof (rootnex_window_t);
2834 
2835 	/*
2836 	 * Get space for window and potential copy buffer state. Before we
2837 	 * go and allocate memory, see if we can get away with using what's
2838 	 * left in the pre-allocted state or the dynamically allocated sgl.
2839 	 */
2840 	space_used = (uintptr_t)(sinfo->si_sgl_size *
2841 	    sizeof (ddi_dma_cookie_t));
2842 
2843 	/* if we dynamically allocated space for the cookies */
2844 	if (dma->dp_need_to_free_cookie) {
2845 		/* if we have more space in the pre-allocted buffer, use it */
2846 		ASSERT(space_used <= dma->dp_cookie_size);
2847 		if ((dma->dp_cookie_size - space_used) <=
2848 		    rootnex_state->r_prealloc_size) {
2849 			state_available = rootnex_state->r_prealloc_size;
2850 			windowp = (rootnex_window_t *)dma->dp_prealloc_buffer;
2851 
2852 		/*
2853 		 * else, we have more free space in the dynamically allocated
2854 		 * buffer, i.e. the buffer wasn't worse case fragmented so we
2855 		 * didn't need a lot of cookies.
2856 		 */
2857 		} else {
2858 			state_available = dma->dp_cookie_size - space_used;
2859 			windowp = (rootnex_window_t *)
2860 			    &dma->dp_cookies[sinfo->si_sgl_size];
2861 		}
2862 
2863 	/* we used the pre-alloced buffer */
2864 	} else {
2865 		ASSERT(space_used <= rootnex_state->r_prealloc_size);
2866 		state_available = rootnex_state->r_prealloc_size - space_used;
2867 		windowp = (rootnex_window_t *)
2868 		    &dma->dp_cookies[sinfo->si_sgl_size];
2869 	}
2870 
2871 	/*
2872 	 * figure out how much state we need to track the copy buffer. Add an
2873 	 * addition 8 bytes for pointer alignemnt later.
2874 	 */
2875 	if (dma->dp_copybuf_size > 0) {
2876 		copy_state_size = sinfo->si_max_pages *
2877 		    sizeof (rootnex_pgmap_t);
2878 	} else {
2879 		copy_state_size = 0;
2880 	}
2881 	/* add an additional 8 bytes for pointer alignment */
2882 	space_needed = win_state_size + copy_state_size + 0x8;
2883 
2884 	/* if we have enough space already, use it */
2885 	if (state_available >= space_needed) {
2886 		dma->dp_window = windowp;
2887 		dma->dp_need_to_free_window = B_FALSE;
2888 
2889 	/* not enough space, need to allocate more. */
2890 	} else {
2891 		dma->dp_window = kmem_alloc(space_needed, kmflag);
2892 		if (dma->dp_window == NULL) {
2893 			return (DDI_DMA_NORESOURCES);
2894 		}
2895 		dma->dp_need_to_free_window = B_TRUE;
2896 		dma->dp_window_size = space_needed;
2897 		DTRACE_PROBE2(rootnex__bind__sp__alloc, dev_info_t *,
2898 		    dma->dp_dip, size_t, space_needed);
2899 	}
2900 
2901 	/*
2902 	 * we allocate copy buffer state and window state at the same time.
2903 	 * setup our copy buffer state pointers. Make sure it's aligned.
2904 	 */
2905 	if (dma->dp_copybuf_size > 0) {
2906 		dma->dp_pgmap = (rootnex_pgmap_t *)(((uintptr_t)
2907 		    &dma->dp_window[dma->dp_max_win] + 0x7) & ~0x7);
2908 
2909 #if !defined(__amd64)
2910 		/*
2911 		 * make sure all pm_mapped, pm_vaddr, and pm_pp are set to
2912 		 * false/NULL. Should be quicker to bzero vs loop and set.
2913 		 */
2914 		bzero(dma->dp_pgmap, copy_state_size);
2915 #endif
2916 	} else {
2917 		dma->dp_pgmap = NULL;
2918 	}
2919 
2920 	return (DDI_SUCCESS);
2921 }
2922 
2923 
2924 /*
2925  * rootnex_teardown_copybuf()
2926  *    cleans up after rootnex_setup_copybuf()
2927  */
2928 static void
2929 rootnex_teardown_copybuf(rootnex_dma_t *dma)
2930 {
2931 #if !defined(__amd64)
2932 	int i;
2933 
2934 	/*
2935 	 * if we allocated kernel heap VMEM space, go through all the pages and
2936 	 * map out any of the ones that we're mapped into the kernel heap VMEM
2937 	 * arena. Then free the VMEM space.
2938 	 */
2939 	if (dma->dp_kva != NULL) {
2940 		for (i = 0; i < dma->dp_sglinfo.si_max_pages; i++) {
2941 			if (dma->dp_pgmap[i].pm_mapped) {
2942 				hat_unload(kas.a_hat, dma->dp_pgmap[i].pm_kaddr,
2943 				    MMU_PAGESIZE, HAT_UNLOAD);
2944 				dma->dp_pgmap[i].pm_mapped = B_FALSE;
2945 			}
2946 		}
2947 
2948 		vmem_free(heap_arena, dma->dp_kva, dma->dp_copybuf_size);
2949 	}
2950 
2951 #endif
2952 
2953 	/* if we allocated a copy buffer, free it */
2954 	if (dma->dp_cbaddr != NULL) {
2955 		i_ddi_mem_free(dma->dp_cbaddr, NULL);
2956 	}
2957 }
2958 
2959 
2960 /*
2961  * rootnex_teardown_windows()
2962  *    cleans up after rootnex_setup_windows()
2963  */
2964 static void
2965 rootnex_teardown_windows(rootnex_dma_t *dma)
2966 {
2967 	/*
2968 	 * if we had to allocate window state on the last bind (because we
2969 	 * didn't have enough pre-allocated space in the handle), free it.
2970 	 */
2971 	if (dma->dp_need_to_free_window) {
2972 		kmem_free(dma->dp_window, dma->dp_window_size);
2973 	}
2974 }
2975 
2976 
2977 /*
2978  * rootnex_init_win()
2979  *    Called in bind slow path during creation of a new window. Initializes
2980  *    window state to default values.
2981  */
2982 /*ARGSUSED*/
2983 static void
2984 rootnex_init_win(ddi_dma_impl_t *hp, rootnex_dma_t *dma,
2985     rootnex_window_t *window, ddi_dma_cookie_t *cookie, off_t cur_offset)
2986 {
2987 	hp->dmai_nwin++;
2988 	window->wd_dosync = B_FALSE;
2989 	window->wd_offset = cur_offset;
2990 	window->wd_size = 0;
2991 	window->wd_first_cookie = cookie;
2992 	window->wd_cookie_cnt = 0;
2993 	window->wd_trim.tr_trim_first = B_FALSE;
2994 	window->wd_trim.tr_trim_last = B_FALSE;
2995 	window->wd_trim.tr_first_copybuf_win = B_FALSE;
2996 	window->wd_trim.tr_last_copybuf_win = B_FALSE;
2997 #if !defined(__amd64)
2998 	window->wd_remap_copybuf = dma->dp_cb_remaping;
2999 #endif
3000 }
3001 
3002 
3003 /*
3004  * rootnex_setup_cookie()
3005  *    Called in the bind slow path when the sgl uses the copy buffer. If any of
3006  *    the sgl uses the copy buffer, we need to go through each cookie, figure
3007  *    out if it uses the copy buffer, and if it does, save away everything we'll
3008  *    need during sync.
3009  */
3010 static void
3011 rootnex_setup_cookie(ddi_dma_obj_t *dmar_object, rootnex_dma_t *dma,
3012     ddi_dma_cookie_t *cookie, off_t cur_offset, size_t *copybuf_used,
3013     page_t **cur_pp)
3014 {
3015 	boolean_t copybuf_sz_power_2;
3016 	rootnex_sglinfo_t *sinfo;
3017 	paddr_t paddr;
3018 	uint_t pidx;
3019 	uint_t pcnt;
3020 	off_t poff;
3021 #if defined(__amd64)
3022 	pfn_t pfn;
3023 #else
3024 	page_t **pplist;
3025 #endif
3026 
3027 	sinfo = &dma->dp_sglinfo;
3028 
3029 	/*
3030 	 * Calculate the page index relative to the start of the buffer. The
3031 	 * index to the current page for our buffer is the offset into the
3032 	 * first page of the buffer plus our current offset into the buffer
3033 	 * itself, shifted of course...
3034 	 */
3035 	pidx = (sinfo->si_buf_offset + cur_offset) >> MMU_PAGESHIFT;
3036 	ASSERT(pidx < sinfo->si_max_pages);
3037 
3038 	/* if this cookie uses the copy buffer */
3039 	if (cookie->dmac_type & ROOTNEX_USES_COPYBUF) {
3040 		/*
3041 		 * NOTE: we know that since this cookie uses the copy buffer, it
3042 		 * is <= MMU_PAGESIZE.
3043 		 */
3044 
3045 		/*
3046 		 * get the offset into the page. For the 64-bit kernel, get the
3047 		 * pfn which we'll use with seg kpm.
3048 		 */
3049 		poff = cookie->dmac_laddress & MMU_PAGEOFFSET;
3050 #if defined(__amd64)
3051 		/* mfn_to_pfn() is a NOP on i86pc */
3052 		pfn = mfn_to_pfn(cookie->dmac_laddress >> MMU_PAGESHIFT);
3053 #endif /* __amd64 */
3054 
3055 		/* figure out if the copybuf size is a power of 2 */
3056 		if (dma->dp_copybuf_size & (dma->dp_copybuf_size - 1)) {
3057 			copybuf_sz_power_2 = B_FALSE;
3058 		} else {
3059 			copybuf_sz_power_2 = B_TRUE;
3060 		}
3061 
3062 		/* This page uses the copy buffer */
3063 		dma->dp_pgmap[pidx].pm_uses_copybuf = B_TRUE;
3064 
3065 		/*
3066 		 * save the copy buffer KVA that we'll use with this page.
3067 		 * if we still fit within the copybuf, it's a simple add.
3068 		 * otherwise, we need to wrap over using & or % accordingly.
3069 		 */
3070 		if ((*copybuf_used + MMU_PAGESIZE) <= dma->dp_copybuf_size) {
3071 			dma->dp_pgmap[pidx].pm_cbaddr = dma->dp_cbaddr +
3072 			    *copybuf_used;
3073 		} else {
3074 			if (copybuf_sz_power_2) {
3075 				dma->dp_pgmap[pidx].pm_cbaddr = (caddr_t)(
3076 				    (uintptr_t)dma->dp_cbaddr +
3077 				    (*copybuf_used &
3078 				    (dma->dp_copybuf_size - 1)));
3079 			} else {
3080 				dma->dp_pgmap[pidx].pm_cbaddr = (caddr_t)(
3081 				    (uintptr_t)dma->dp_cbaddr +
3082 				    (*copybuf_used % dma->dp_copybuf_size));
3083 			}
3084 		}
3085 
3086 		/*
3087 		 * over write the cookie physical address with the address of
3088 		 * the physical address of the copy buffer page that we will
3089 		 * use.
3090 		 */
3091 		paddr = pfn_to_pa(hat_getpfnum(kas.a_hat,
3092 		    dma->dp_pgmap[pidx].pm_cbaddr)) + poff;
3093 
3094 #ifdef __xpv
3095 		/*
3096 		 * If we're dom0, we're using a real device so we need to load
3097 		 * the cookies with MAs instead of PAs.
3098 		 */
3099 		cookie->dmac_laddress = ROOTNEX_PADDR_TO_RBASE(xen_info, paddr);
3100 #else
3101 		cookie->dmac_laddress = paddr;
3102 #endif
3103 
3104 		/* if we have a kernel VA, it's easy, just save that address */
3105 		if ((dmar_object->dmao_type != DMA_OTYP_PAGES) &&
3106 		    (sinfo->si_asp == &kas)) {
3107 			/*
3108 			 * save away the page aligned virtual address of the
3109 			 * driver buffer. Offsets are handled in the sync code.
3110 			 */
3111 			dma->dp_pgmap[pidx].pm_kaddr = (caddr_t)(((uintptr_t)
3112 			    dmar_object->dmao_obj.virt_obj.v_addr + cur_offset)
3113 			    & MMU_PAGEMASK);
3114 #if !defined(__amd64)
3115 			/*
3116 			 * we didn't need to, and will never need to map this
3117 			 * page.
3118 			 */
3119 			dma->dp_pgmap[pidx].pm_mapped = B_FALSE;
3120 #endif
3121 
3122 		/* we don't have a kernel VA. We need one for the bcopy. */
3123 		} else {
3124 #if defined(__amd64)
3125 			/*
3126 			 * for the 64-bit kernel, it's easy. We use seg kpm to
3127 			 * get a Kernel VA for the corresponding pfn.
3128 			 */
3129 			dma->dp_pgmap[pidx].pm_kaddr = hat_kpm_pfn2va(pfn);
3130 #else
3131 			/*
3132 			 * for the 32-bit kernel, this is a pain. First we'll
3133 			 * save away the page_t or user VA for this page. This
3134 			 * is needed in rootnex_dma_win() when we switch to a
3135 			 * new window which requires us to re-map the copy
3136 			 * buffer.
3137 			 */
3138 			pplist = dmar_object->dmao_obj.virt_obj.v_priv;
3139 			if (dmar_object->dmao_type == DMA_OTYP_PAGES) {
3140 				dma->dp_pgmap[pidx].pm_pp = *cur_pp;
3141 				dma->dp_pgmap[pidx].pm_vaddr = NULL;
3142 			} else if (pplist != NULL) {
3143 				dma->dp_pgmap[pidx].pm_pp = pplist[pidx];
3144 				dma->dp_pgmap[pidx].pm_vaddr = NULL;
3145 			} else {
3146 				dma->dp_pgmap[pidx].pm_pp = NULL;
3147 				dma->dp_pgmap[pidx].pm_vaddr = (caddr_t)
3148 				    (((uintptr_t)
3149 				    dmar_object->dmao_obj.virt_obj.v_addr +
3150 				    cur_offset) & MMU_PAGEMASK);
3151 			}
3152 
3153 			/*
3154 			 * save away the page aligned virtual address which was
3155 			 * allocated from the kernel heap arena (taking into
3156 			 * account if we need more copy buffer than we alloced
3157 			 * and use multiple windows to handle this, i.e. &,%).
3158 			 * NOTE: there isn't and physical memory backing up this
3159 			 * virtual address space currently.
3160 			 */
3161 			if ((*copybuf_used + MMU_PAGESIZE) <=
3162 			    dma->dp_copybuf_size) {
3163 				dma->dp_pgmap[pidx].pm_kaddr = (caddr_t)
3164 				    (((uintptr_t)dma->dp_kva + *copybuf_used) &
3165 				    MMU_PAGEMASK);
3166 			} else {
3167 				if (copybuf_sz_power_2) {
3168 					dma->dp_pgmap[pidx].pm_kaddr = (caddr_t)
3169 					    (((uintptr_t)dma->dp_kva +
3170 					    (*copybuf_used &
3171 					    (dma->dp_copybuf_size - 1))) &
3172 					    MMU_PAGEMASK);
3173 				} else {
3174 					dma->dp_pgmap[pidx].pm_kaddr = (caddr_t)
3175 					    (((uintptr_t)dma->dp_kva +
3176 					    (*copybuf_used %
3177 					    dma->dp_copybuf_size)) &
3178 					    MMU_PAGEMASK);
3179 				}
3180 			}
3181 
3182 			/*
3183 			 * if we haven't used up the available copy buffer yet,
3184 			 * map the kva to the physical page.
3185 			 */
3186 			if (!dma->dp_cb_remaping && ((*copybuf_used +
3187 			    MMU_PAGESIZE) <= dma->dp_copybuf_size)) {
3188 				dma->dp_pgmap[pidx].pm_mapped = B_TRUE;
3189 				if (dma->dp_pgmap[pidx].pm_pp != NULL) {
3190 					i86_pp_map(dma->dp_pgmap[pidx].pm_pp,
3191 					    dma->dp_pgmap[pidx].pm_kaddr);
3192 				} else {
3193 					i86_va_map(dma->dp_pgmap[pidx].pm_vaddr,
3194 					    sinfo->si_asp,
3195 					    dma->dp_pgmap[pidx].pm_kaddr);
3196 				}
3197 
3198 			/*
3199 			 * we've used up the available copy buffer, this page
3200 			 * will have to be mapped during rootnex_dma_win() when
3201 			 * we switch to a new window which requires a re-map
3202 			 * the copy buffer. (32-bit kernel only)
3203 			 */
3204 			} else {
3205 				dma->dp_pgmap[pidx].pm_mapped = B_FALSE;
3206 			}
3207 #endif
3208 			/* go to the next page_t */
3209 			if (dmar_object->dmao_type == DMA_OTYP_PAGES) {
3210 				*cur_pp = (*cur_pp)->p_next;
3211 			}
3212 		}
3213 
3214 		/* add to the copy buffer count */
3215 		*copybuf_used += MMU_PAGESIZE;
3216 
3217 	/*
3218 	 * This cookie doesn't use the copy buffer. Walk through the pages this
3219 	 * cookie occupies to reflect this.
3220 	 */
3221 	} else {
3222 		/*
3223 		 * figure out how many pages the cookie occupies. We need to
3224 		 * use the original page offset of the buffer and the cookies
3225 		 * offset in the buffer to do this.
3226 		 */
3227 		poff = (sinfo->si_buf_offset + cur_offset) & MMU_PAGEOFFSET;
3228 		pcnt = mmu_btopr(cookie->dmac_size + poff);
3229 
3230 		while (pcnt > 0) {
3231 #if !defined(__amd64)
3232 			/*
3233 			 * the 32-bit kernel doesn't have seg kpm, so we need
3234 			 * to map in the driver buffer (if it didn't come down
3235 			 * with a kernel VA) on the fly. Since this page doesn't
3236 			 * use the copy buffer, it's not, or will it ever, have
3237 			 * to be mapped in.
3238 			 */
3239 			dma->dp_pgmap[pidx].pm_mapped = B_FALSE;
3240 #endif
3241 			dma->dp_pgmap[pidx].pm_uses_copybuf = B_FALSE;
3242 
3243 			/*
3244 			 * we need to update pidx and cur_pp or we'll loose
3245 			 * track of where we are.
3246 			 */
3247 			if (dmar_object->dmao_type == DMA_OTYP_PAGES) {
3248 				*cur_pp = (*cur_pp)->p_next;
3249 			}
3250 			pidx++;
3251 			pcnt--;
3252 		}
3253 	}
3254 }
3255 
3256 
3257 /*
3258  * rootnex_sgllen_window_boundary()
3259  *    Called in the bind slow path when the next cookie causes us to exceed (in
3260  *    this case == since we start at 0 and sgllen starts at 1) the maximum sgl
3261  *    length supported by the DMA H/W.
3262  */
3263 static int
3264 rootnex_sgllen_window_boundary(ddi_dma_impl_t *hp, rootnex_dma_t *dma,
3265     rootnex_window_t **windowp, ddi_dma_cookie_t *cookie, ddi_dma_attr_t *attr,
3266     off_t cur_offset)
3267 {
3268 	off_t new_offset;
3269 	size_t trim_sz;
3270 	off_t coffset;
3271 
3272 
3273 	/*
3274 	 * if we know we'll never have to trim, it's pretty easy. Just move to
3275 	 * the next window and init it. We're done.
3276 	 */
3277 	if (!dma->dp_trim_required) {
3278 		(*windowp)++;
3279 		rootnex_init_win(hp, dma, *windowp, cookie, cur_offset);
3280 		(*windowp)->wd_cookie_cnt++;
3281 		(*windowp)->wd_size = cookie->dmac_size;
3282 		return (DDI_SUCCESS);
3283 	}
3284 
3285 	/* figure out how much we need to trim from the window */
3286 	ASSERT(attr->dma_attr_granular != 0);
3287 	if (dma->dp_granularity_power_2) {
3288 		trim_sz = (*windowp)->wd_size & (attr->dma_attr_granular - 1);
3289 	} else {
3290 		trim_sz = (*windowp)->wd_size % attr->dma_attr_granular;
3291 	}
3292 
3293 	/* The window's a whole multiple of granularity. We're done */
3294 	if (trim_sz == 0) {
3295 		(*windowp)++;
3296 		rootnex_init_win(hp, dma, *windowp, cookie, cur_offset);
3297 		(*windowp)->wd_cookie_cnt++;
3298 		(*windowp)->wd_size = cookie->dmac_size;
3299 		return (DDI_SUCCESS);
3300 	}
3301 
3302 	/*
3303 	 * The window's not a whole multiple of granularity, since we know this
3304 	 * is due to the sgllen, we need to go back to the last cookie and trim
3305 	 * that one, add the left over part of the old cookie into the new
3306 	 * window, and then add in the new cookie into the new window.
3307 	 */
3308 
3309 	/*
3310 	 * make sure the driver isn't making us do something bad... Trimming and
3311 	 * sgllen == 1 don't go together.
3312 	 */
3313 	if (attr->dma_attr_sgllen == 1) {
3314 		return (DDI_DMA_NOMAPPING);
3315 	}
3316 
3317 	/*
3318 	 * first, setup the current window to account for the trim. Need to go
3319 	 * back to the last cookie for this.
3320 	 */
3321 	cookie--;
3322 	(*windowp)->wd_trim.tr_trim_last = B_TRUE;
3323 	(*windowp)->wd_trim.tr_last_cookie = cookie;
3324 	(*windowp)->wd_trim.tr_last_paddr = cookie->dmac_laddress;
3325 	ASSERT(cookie->dmac_size > trim_sz);
3326 	(*windowp)->wd_trim.tr_last_size = cookie->dmac_size - trim_sz;
3327 	(*windowp)->wd_size -= trim_sz;
3328 
3329 	/* save the buffer offsets for the next window */
3330 	coffset = cookie->dmac_size - trim_sz;
3331 	new_offset = (*windowp)->wd_offset + (*windowp)->wd_size;
3332 
3333 	/*
3334 	 * set this now in case this is the first window. all other cases are
3335 	 * set in dma_win()
3336 	 */
3337 	cookie->dmac_size = (*windowp)->wd_trim.tr_last_size;
3338 
3339 	/*
3340 	 * initialize the next window using what's left over in the previous
3341 	 * cookie.
3342 	 */
3343 	(*windowp)++;
3344 	rootnex_init_win(hp, dma, *windowp, cookie, new_offset);
3345 	(*windowp)->wd_cookie_cnt++;
3346 	(*windowp)->wd_trim.tr_trim_first = B_TRUE;
3347 	(*windowp)->wd_trim.tr_first_paddr = cookie->dmac_laddress + coffset;
3348 	(*windowp)->wd_trim.tr_first_size = trim_sz;
3349 	if (cookie->dmac_type & ROOTNEX_USES_COPYBUF) {
3350 		(*windowp)->wd_dosync = B_TRUE;
3351 	}
3352 
3353 	/*
3354 	 * now go back to the current cookie and add it to the new window. set
3355 	 * the new window size to the what was left over from the previous
3356 	 * cookie and what's in the current cookie.
3357 	 */
3358 	cookie++;
3359 	(*windowp)->wd_cookie_cnt++;
3360 	(*windowp)->wd_size = trim_sz + cookie->dmac_size;
3361 
3362 	/*
3363 	 * trim plus the next cookie could put us over maxxfer (a cookie can be
3364 	 * a max size of maxxfer). Handle that case.
3365 	 */
3366 	if ((*windowp)->wd_size > dma->dp_maxxfer) {
3367 		/*
3368 		 * maxxfer is already a whole multiple of granularity, and this
3369 		 * trim will be <= the previous trim (since a cookie can't be
3370 		 * larger than maxxfer). Make things simple here.
3371 		 */
3372 		trim_sz = (*windowp)->wd_size - dma->dp_maxxfer;
3373 		(*windowp)->wd_trim.tr_trim_last = B_TRUE;
3374 		(*windowp)->wd_trim.tr_last_cookie = cookie;
3375 		(*windowp)->wd_trim.tr_last_paddr = cookie->dmac_laddress;
3376 		(*windowp)->wd_trim.tr_last_size = cookie->dmac_size - trim_sz;
3377 		(*windowp)->wd_size -= trim_sz;
3378 		ASSERT((*windowp)->wd_size == dma->dp_maxxfer);
3379 
3380 		/* save the buffer offsets for the next window */
3381 		coffset = cookie->dmac_size - trim_sz;
3382 		new_offset = (*windowp)->wd_offset + (*windowp)->wd_size;
3383 
3384 		/* setup the next window */
3385 		(*windowp)++;
3386 		rootnex_init_win(hp, dma, *windowp, cookie, new_offset);
3387 		(*windowp)->wd_cookie_cnt++;
3388 		(*windowp)->wd_trim.tr_trim_first = B_TRUE;
3389 		(*windowp)->wd_trim.tr_first_paddr = cookie->dmac_laddress +
3390 		    coffset;
3391 		(*windowp)->wd_trim.tr_first_size = trim_sz;
3392 	}
3393 
3394 	return (DDI_SUCCESS);
3395 }
3396 
3397 
3398 /*
3399  * rootnex_copybuf_window_boundary()
3400  *    Called in bind slowpath when we get to a window boundary because we used
3401  *    up all the copy buffer that we have.
3402  */
3403 static int
3404 rootnex_copybuf_window_boundary(ddi_dma_impl_t *hp, rootnex_dma_t *dma,
3405     rootnex_window_t **windowp, ddi_dma_cookie_t *cookie, off_t cur_offset,
3406     size_t *copybuf_used)
3407 {
3408 	rootnex_sglinfo_t *sinfo;
3409 	off_t new_offset;
3410 	size_t trim_sz;
3411 	paddr_t paddr;
3412 	off_t coffset;
3413 	uint_t pidx;
3414 	off_t poff;
3415 
3416 
3417 	sinfo = &dma->dp_sglinfo;
3418 
3419 	/*
3420 	 * the copy buffer should be a whole multiple of page size. We know that
3421 	 * this cookie is <= MMU_PAGESIZE.
3422 	 */
3423 	ASSERT(cookie->dmac_size <= MMU_PAGESIZE);
3424 
3425 	/*
3426 	 * from now on, all new windows in this bind need to be re-mapped during
3427 	 * ddi_dma_getwin() (32-bit kernel only). i.e. we ran out out copybuf
3428 	 * space...
3429 	 */
3430 #if !defined(__amd64)
3431 	dma->dp_cb_remaping = B_TRUE;
3432 #endif
3433 
3434 	/* reset copybuf used */
3435 	*copybuf_used = 0;
3436 
3437 	/*
3438 	 * if we don't have to trim (since granularity is set to 1), go to the
3439 	 * next window and add the current cookie to it. We know the current
3440 	 * cookie uses the copy buffer since we're in this code path.
3441 	 */
3442 	if (!dma->dp_trim_required) {
3443 		(*windowp)++;
3444 		rootnex_init_win(hp, dma, *windowp, cookie, cur_offset);
3445 
3446 		/* Add this cookie to the new window */
3447 		(*windowp)->wd_cookie_cnt++;
3448 		(*windowp)->wd_size += cookie->dmac_size;
3449 		*copybuf_used += MMU_PAGESIZE;
3450 		return (DDI_SUCCESS);
3451 	}
3452 
3453 	/*
3454 	 * *** may need to trim, figure it out.
3455 	 */
3456 
3457 	/* figure out how much we need to trim from the window */
3458 	if (dma->dp_granularity_power_2) {
3459 		trim_sz = (*windowp)->wd_size &
3460 		    (hp->dmai_attr.dma_attr_granular - 1);
3461 	} else {
3462 		trim_sz = (*windowp)->wd_size % hp->dmai_attr.dma_attr_granular;
3463 	}
3464 
3465 	/*
3466 	 * if the window's a whole multiple of granularity, go to the next
3467 	 * window, init it, then add in the current cookie. We know the current
3468 	 * cookie uses the copy buffer since we're in this code path.
3469 	 */
3470 	if (trim_sz == 0) {
3471 		(*windowp)++;
3472 		rootnex_init_win(hp, dma, *windowp, cookie, cur_offset);
3473 
3474 		/* Add this cookie to the new window */
3475 		(*windowp)->wd_cookie_cnt++;
3476 		(*windowp)->wd_size += cookie->dmac_size;
3477 		*copybuf_used += MMU_PAGESIZE;
3478 		return (DDI_SUCCESS);
3479 	}
3480 
3481 	/*
3482 	 * *** We figured it out, we definitly need to trim
3483 	 */
3484 
3485 	/*
3486 	 * make sure the driver isn't making us do something bad...
3487 	 * Trimming and sgllen == 1 don't go together.
3488 	 */
3489 	if (hp->dmai_attr.dma_attr_sgllen == 1) {
3490 		return (DDI_DMA_NOMAPPING);
3491 	}
3492 
3493 	/*
3494 	 * first, setup the current window to account for the trim. Need to go
3495 	 * back to the last cookie for this. Some of the last cookie will be in
3496 	 * the current window, and some of the last cookie will be in the new
3497 	 * window. All of the current cookie will be in the new window.
3498 	 */
3499 	cookie--;
3500 	(*windowp)->wd_trim.tr_trim_last = B_TRUE;
3501 	(*windowp)->wd_trim.tr_last_cookie = cookie;
3502 	(*windowp)->wd_trim.tr_last_paddr = cookie->dmac_laddress;
3503 	ASSERT(cookie->dmac_size > trim_sz);
3504 	(*windowp)->wd_trim.tr_last_size = cookie->dmac_size - trim_sz;
3505 	(*windowp)->wd_size -= trim_sz;
3506 
3507 	/*
3508 	 * we're trimming the last cookie (not the current cookie). So that
3509 	 * last cookie may have or may not have been using the copy buffer (
3510 	 * we know the cookie passed in uses the copy buffer since we're in
3511 	 * this code path).
3512 	 *
3513 	 * If the last cookie doesn't use the copy buffer, nothing special to
3514 	 * do. However, if it does uses the copy buffer, it will be both the
3515 	 * last page in the current window and the first page in the next
3516 	 * window. Since we are reusing the copy buffer (and KVA space on the
3517 	 * 32-bit kernel), this page will use the end of the copy buffer in the
3518 	 * current window, and the start of the copy buffer in the next window.
3519 	 * Track that info... The cookie physical address was already set to
3520 	 * the copy buffer physical address in setup_cookie..
3521 	 */
3522 	if (cookie->dmac_type & ROOTNEX_USES_COPYBUF) {
3523 		pidx = (sinfo->si_buf_offset + (*windowp)->wd_offset +
3524 		    (*windowp)->wd_size) >> MMU_PAGESHIFT;
3525 		(*windowp)->wd_trim.tr_last_copybuf_win = B_TRUE;
3526 		(*windowp)->wd_trim.tr_last_pidx = pidx;
3527 		(*windowp)->wd_trim.tr_last_cbaddr =
3528 		    dma->dp_pgmap[pidx].pm_cbaddr;
3529 #if !defined(__amd64)
3530 		(*windowp)->wd_trim.tr_last_kaddr =
3531 		    dma->dp_pgmap[pidx].pm_kaddr;
3532 #endif
3533 	}
3534 
3535 	/* save the buffer offsets for the next window */
3536 	coffset = cookie->dmac_size - trim_sz;
3537 	new_offset = (*windowp)->wd_offset + (*windowp)->wd_size;
3538 
3539 	/*
3540 	 * set this now in case this is the first window. all other cases are
3541 	 * set in dma_win()
3542 	 */
3543 	cookie->dmac_size = (*windowp)->wd_trim.tr_last_size;
3544 
3545 	/*
3546 	 * initialize the next window using what's left over in the previous
3547 	 * cookie.
3548 	 */
3549 	(*windowp)++;
3550 	rootnex_init_win(hp, dma, *windowp, cookie, new_offset);
3551 	(*windowp)->wd_cookie_cnt++;
3552 	(*windowp)->wd_trim.tr_trim_first = B_TRUE;
3553 	(*windowp)->wd_trim.tr_first_paddr = cookie->dmac_laddress + coffset;
3554 	(*windowp)->wd_trim.tr_first_size = trim_sz;
3555 
3556 	/*
3557 	 * again, we're tracking if the last cookie uses the copy buffer.
3558 	 * read the comment above for more info on why we need to track
3559 	 * additional state.
3560 	 *
3561 	 * For the first cookie in the new window, we need reset the physical
3562 	 * address to DMA into to the start of the copy buffer plus any
3563 	 * initial page offset which may be present.
3564 	 */
3565 	if (cookie->dmac_type & ROOTNEX_USES_COPYBUF) {
3566 		(*windowp)->wd_dosync = B_TRUE;
3567 		(*windowp)->wd_trim.tr_first_copybuf_win = B_TRUE;
3568 		(*windowp)->wd_trim.tr_first_pidx = pidx;
3569 		(*windowp)->wd_trim.tr_first_cbaddr = dma->dp_cbaddr;
3570 		poff = (*windowp)->wd_trim.tr_first_paddr & MMU_PAGEOFFSET;
3571 
3572 		paddr = pfn_to_pa(hat_getpfnum(kas.a_hat, dma->dp_cbaddr)) +
3573 		    poff;
3574 #ifdef __xpv
3575 		/*
3576 		 * If we're dom0, we're using a real device so we need to load
3577 		 * the cookies with MAs instead of PAs.
3578 		 */
3579 		(*windowp)->wd_trim.tr_first_paddr =
3580 		    ROOTNEX_PADDR_TO_RBASE(xen_info, paddr);
3581 #else
3582 		(*windowp)->wd_trim.tr_first_paddr = paddr;
3583 #endif
3584 
3585 #if !defined(__amd64)
3586 		(*windowp)->wd_trim.tr_first_kaddr = dma->dp_kva;
3587 #endif
3588 		/* account for the cookie copybuf usage in the new window */
3589 		*copybuf_used += MMU_PAGESIZE;
3590 
3591 		/*
3592 		 * every piece of code has to have a hack, and here is this
3593 		 * ones :-)
3594 		 *
3595 		 * There is a complex interaction between setup_cookie and the
3596 		 * copybuf window boundary. The complexity had to be in either
3597 		 * the maxxfer window, or the copybuf window, and I chose the
3598 		 * copybuf code.
3599 		 *
3600 		 * So in this code path, we have taken the last cookie,
3601 		 * virtually broken it in half due to the trim, and it happens
3602 		 * to use the copybuf which further complicates life. At the
3603 		 * same time, we have already setup the current cookie, which
3604 		 * is now wrong. More background info: the current cookie uses
3605 		 * the copybuf, so it is only a page long max. So we need to
3606 		 * fix the current cookies copy buffer address, physical
3607 		 * address, and kva for the 32-bit kernel. We due this by
3608 		 * bumping them by page size (of course, we can't due this on
3609 		 * the physical address since the copy buffer may not be
3610 		 * physically contiguous).
3611 		 */
3612 		cookie++;
3613 		dma->dp_pgmap[pidx + 1].pm_cbaddr += MMU_PAGESIZE;
3614 		poff = cookie->dmac_laddress & MMU_PAGEOFFSET;
3615 
3616 		paddr = pfn_to_pa(hat_getpfnum(kas.a_hat,
3617 		    dma->dp_pgmap[pidx + 1].pm_cbaddr)) + poff;
3618 #ifdef __xpv
3619 		/*
3620 		 * If we're dom0, we're using a real device so we need to load
3621 		 * the cookies with MAs instead of PAs.
3622 		 */
3623 		cookie->dmac_laddress = ROOTNEX_PADDR_TO_RBASE(xen_info, paddr);
3624 #else
3625 		cookie->dmac_laddress = paddr;
3626 #endif
3627 
3628 #if !defined(__amd64)
3629 		ASSERT(dma->dp_pgmap[pidx + 1].pm_mapped == B_FALSE);
3630 		dma->dp_pgmap[pidx + 1].pm_kaddr += MMU_PAGESIZE;
3631 #endif
3632 	} else {
3633 		/* go back to the current cookie */
3634 		cookie++;
3635 	}
3636 
3637 	/*
3638 	 * add the current cookie to the new window. set the new window size to
3639 	 * the what was left over from the previous cookie and what's in the
3640 	 * current cookie.
3641 	 */
3642 	(*windowp)->wd_cookie_cnt++;
3643 	(*windowp)->wd_size = trim_sz + cookie->dmac_size;
3644 	ASSERT((*windowp)->wd_size < dma->dp_maxxfer);
3645 
3646 	/*
3647 	 * we know that the cookie passed in always uses the copy buffer. We
3648 	 * wouldn't be here if it didn't.
3649 	 */
3650 	*copybuf_used += MMU_PAGESIZE;
3651 
3652 	return (DDI_SUCCESS);
3653 }
3654 
3655 
3656 /*
3657  * rootnex_maxxfer_window_boundary()
3658  *    Called in bind slowpath when we get to a window boundary because we will
3659  *    go over maxxfer.
3660  */
3661 static int
3662 rootnex_maxxfer_window_boundary(ddi_dma_impl_t *hp, rootnex_dma_t *dma,
3663     rootnex_window_t **windowp, ddi_dma_cookie_t *cookie)
3664 {
3665 	size_t dmac_size;
3666 	off_t new_offset;
3667 	size_t trim_sz;
3668 	off_t coffset;
3669 
3670 
3671 	/*
3672 	 * calculate how much we have to trim off of the current cookie to equal
3673 	 * maxxfer. We don't have to account for granularity here since our
3674 	 * maxxfer already takes that into account.
3675 	 */
3676 	trim_sz = ((*windowp)->wd_size + cookie->dmac_size) - dma->dp_maxxfer;
3677 	ASSERT(trim_sz <= cookie->dmac_size);
3678 	ASSERT(trim_sz <= dma->dp_maxxfer);
3679 
3680 	/* save cookie size since we need it later and we might change it */
3681 	dmac_size = cookie->dmac_size;
3682 
3683 	/*
3684 	 * if we're not trimming the entire cookie, setup the current window to
3685 	 * account for the trim.
3686 	 */
3687 	if (trim_sz < cookie->dmac_size) {
3688 		(*windowp)->wd_cookie_cnt++;
3689 		(*windowp)->wd_trim.tr_trim_last = B_TRUE;
3690 		(*windowp)->wd_trim.tr_last_cookie = cookie;
3691 		(*windowp)->wd_trim.tr_last_paddr = cookie->dmac_laddress;
3692 		(*windowp)->wd_trim.tr_last_size = cookie->dmac_size - trim_sz;
3693 		(*windowp)->wd_size = dma->dp_maxxfer;
3694 
3695 		/*
3696 		 * set the adjusted cookie size now in case this is the first
3697 		 * window. All other windows are taken care of in get win
3698 		 */
3699 		cookie->dmac_size = (*windowp)->wd_trim.tr_last_size;
3700 	}
3701 
3702 	/*
3703 	 * coffset is the current offset within the cookie, new_offset is the
3704 	 * current offset with the entire buffer.
3705 	 */
3706 	coffset = dmac_size - trim_sz;
3707 	new_offset = (*windowp)->wd_offset + (*windowp)->wd_size;
3708 
3709 	/* initialize the next window */
3710 	(*windowp)++;
3711 	rootnex_init_win(hp, dma, *windowp, cookie, new_offset);
3712 	(*windowp)->wd_cookie_cnt++;
3713 	(*windowp)->wd_size = trim_sz;
3714 	if (trim_sz < dmac_size) {
3715 		(*windowp)->wd_trim.tr_trim_first = B_TRUE;
3716 		(*windowp)->wd_trim.tr_first_paddr = cookie->dmac_laddress +
3717 		    coffset;
3718 		(*windowp)->wd_trim.tr_first_size = trim_sz;
3719 	}
3720 
3721 	return (DDI_SUCCESS);
3722 }
3723 
3724 
3725 /*
3726  * rootnex_dma_sync()
3727  *    called from ddi_dma_sync() if DMP_NOSYNC is not set in hp->dmai_rflags.
3728  *    We set DMP_NOSYNC if we're not using the copy buffer. If DMP_NOSYNC
3729  *    is set, ddi_dma_sync() returns immediately passing back success.
3730  */
3731 /*ARGSUSED*/
3732 static int
3733 rootnex_dma_sync(dev_info_t *dip, dev_info_t *rdip, ddi_dma_handle_t handle,
3734     off_t off, size_t len, uint_t cache_flags)
3735 {
3736 	rootnex_sglinfo_t *sinfo;
3737 	rootnex_pgmap_t *cbpage;
3738 	rootnex_window_t *win;
3739 	ddi_dma_impl_t *hp;
3740 	rootnex_dma_t *dma;
3741 	caddr_t fromaddr;
3742 	caddr_t toaddr;
3743 	uint_t psize;
3744 	off_t offset;
3745 	uint_t pidx;
3746 	size_t size;
3747 	off_t poff;
3748 	int e;
3749 
3750 
3751 	hp = (ddi_dma_impl_t *)handle;
3752 	dma = (rootnex_dma_t *)hp->dmai_private;
3753 	sinfo = &dma->dp_sglinfo;
3754 
3755 	/*
3756 	 * if we don't have any windows, we don't need to sync. A copybuf
3757 	 * will cause us to have at least one window.
3758 	 */
3759 	if (dma->dp_window == NULL) {
3760 		return (DDI_SUCCESS);
3761 	}
3762 
3763 	/* This window may not need to be sync'd */
3764 	win = &dma->dp_window[dma->dp_current_win];
3765 	if (!win->wd_dosync) {
3766 		return (DDI_SUCCESS);
3767 	}
3768 
3769 	/* handle off and len special cases */
3770 	if ((off == 0) || (rootnex_sync_ignore_params)) {
3771 		offset = win->wd_offset;
3772 	} else {
3773 		offset = off;
3774 	}
3775 	if ((len == 0) || (rootnex_sync_ignore_params)) {
3776 		size = win->wd_size;
3777 	} else {
3778 		size = len;
3779 	}
3780 
3781 	/* check the sync args to make sure they make a little sense */
3782 	if (rootnex_sync_check_parms) {
3783 		e = rootnex_valid_sync_parms(hp, win, offset, size,
3784 		    cache_flags);
3785 		if (e != DDI_SUCCESS) {
3786 			ROOTNEX_PROF_INC(&rootnex_cnt[ROOTNEX_CNT_SYNC_FAIL]);
3787 			return (DDI_FAILURE);
3788 		}
3789 	}
3790 
3791 	/*
3792 	 * special case the first page to handle the offset into the page. The
3793 	 * offset to the current page for our buffer is the offset into the
3794 	 * first page of the buffer plus our current offset into the buffer
3795 	 * itself, masked of course.
3796 	 */
3797 	poff = (sinfo->si_buf_offset + offset) & MMU_PAGEOFFSET;
3798 	psize = MIN((MMU_PAGESIZE - poff), size);
3799 
3800 	/* go through all the pages that we want to sync */
3801 	while (size > 0) {
3802 		/*
3803 		 * Calculate the page index relative to the start of the buffer.
3804 		 * The index to the current page for our buffer is the offset
3805 		 * into the first page of the buffer plus our current offset
3806 		 * into the buffer itself, shifted of course...
3807 		 */
3808 		pidx = (sinfo->si_buf_offset + offset) >> MMU_PAGESHIFT;
3809 		ASSERT(pidx < sinfo->si_max_pages);
3810 
3811 		/*
3812 		 * if this page uses the copy buffer, we need to sync it,
3813 		 * otherwise, go on to the next page.
3814 		 */
3815 		cbpage = &dma->dp_pgmap[pidx];
3816 		ASSERT((cbpage->pm_uses_copybuf == B_TRUE) ||
3817 		    (cbpage->pm_uses_copybuf == B_FALSE));
3818 		if (cbpage->pm_uses_copybuf) {
3819 			/* cbaddr and kaddr should be page aligned */
3820 			ASSERT(((uintptr_t)cbpage->pm_cbaddr &
3821 			    MMU_PAGEOFFSET) == 0);
3822 			ASSERT(((uintptr_t)cbpage->pm_kaddr &
3823 			    MMU_PAGEOFFSET) == 0);
3824 
3825 			/*
3826 			 * if we're copying for the device, we are going to
3827 			 * copy from the drivers buffer and to the rootnex
3828 			 * allocated copy buffer.
3829 			 */
3830 			if (cache_flags == DDI_DMA_SYNC_FORDEV) {
3831 				fromaddr = cbpage->pm_kaddr + poff;
3832 				toaddr = cbpage->pm_cbaddr + poff;
3833 				DTRACE_PROBE2(rootnex__sync__dev,
3834 				    dev_info_t *, dma->dp_dip, size_t, psize);
3835 
3836 			/*
3837 			 * if we're copying for the cpu/kernel, we are going to
3838 			 * copy from the rootnex allocated copy buffer to the
3839 			 * drivers buffer.
3840 			 */
3841 			} else {
3842 				fromaddr = cbpage->pm_cbaddr + poff;
3843 				toaddr = cbpage->pm_kaddr + poff;
3844 				DTRACE_PROBE2(rootnex__sync__cpu,
3845 				    dev_info_t *, dma->dp_dip, size_t, psize);
3846 			}
3847 
3848 			bcopy(fromaddr, toaddr, psize);
3849 		}
3850 
3851 		/*
3852 		 * decrement size until we're done, update our offset into the
3853 		 * buffer, and get the next page size.
3854 		 */
3855 		size -= psize;
3856 		offset += psize;
3857 		psize = MIN(MMU_PAGESIZE, size);
3858 
3859 		/* page offset is zero for the rest of this loop */
3860 		poff = 0;
3861 	}
3862 
3863 	return (DDI_SUCCESS);
3864 }
3865 
3866 
3867 /*
3868  * rootnex_valid_sync_parms()
3869  *    checks the parameters passed to sync to verify they are correct.
3870  */
3871 static int
3872 rootnex_valid_sync_parms(ddi_dma_impl_t *hp, rootnex_window_t *win,
3873     off_t offset, size_t size, uint_t cache_flags)
3874 {
3875 	off_t woffset;
3876 
3877 
3878 	/*
3879 	 * the first part of the test to make sure the offset passed in is
3880 	 * within the window.
3881 	 */
3882 	if (offset < win->wd_offset) {
3883 		return (DDI_FAILURE);
3884 	}
3885 
3886 	/*
3887 	 * second and last part of the test to make sure the offset and length
3888 	 * passed in is within the window.
3889 	 */
3890 	woffset = offset - win->wd_offset;
3891 	if ((woffset + size) > win->wd_size) {
3892 		return (DDI_FAILURE);
3893 	}
3894 
3895 	/*
3896 	 * if we are sync'ing for the device, the DDI_DMA_WRITE flag should
3897 	 * be set too.
3898 	 */
3899 	if ((cache_flags == DDI_DMA_SYNC_FORDEV) &&
3900 	    (hp->dmai_rflags & DDI_DMA_WRITE)) {
3901 		return (DDI_SUCCESS);
3902 	}
3903 
3904 	/*
3905 	 * at this point, either DDI_DMA_SYNC_FORCPU or DDI_DMA_SYNC_FORKERNEL
3906 	 * should be set. Also DDI_DMA_READ should be set in the flags.
3907 	 */
3908 	if (((cache_flags == DDI_DMA_SYNC_FORCPU) ||
3909 	    (cache_flags == DDI_DMA_SYNC_FORKERNEL)) &&
3910 	    (hp->dmai_rflags & DDI_DMA_READ)) {
3911 		return (DDI_SUCCESS);
3912 	}
3913 
3914 	return (DDI_FAILURE);
3915 }
3916 
3917 
3918 /*
3919  * rootnex_dma_win()
3920  *    called from ddi_dma_getwin()
3921  */
3922 /*ARGSUSED*/
3923 static int
3924 rootnex_dma_win(dev_info_t *dip, dev_info_t *rdip, ddi_dma_handle_t handle,
3925     uint_t win, off_t *offp, size_t *lenp, ddi_dma_cookie_t *cookiep,
3926     uint_t *ccountp)
3927 {
3928 	rootnex_window_t *window;
3929 	rootnex_trim_t *trim;
3930 	ddi_dma_impl_t *hp;
3931 	rootnex_dma_t *dma;
3932 #if !defined(__amd64)
3933 	rootnex_sglinfo_t *sinfo;
3934 	rootnex_pgmap_t *pmap;
3935 	uint_t pidx;
3936 	uint_t pcnt;
3937 	off_t poff;
3938 	int i;
3939 #endif
3940 
3941 
3942 	hp = (ddi_dma_impl_t *)handle;
3943 	dma = (rootnex_dma_t *)hp->dmai_private;
3944 #if !defined(__amd64)
3945 	sinfo = &dma->dp_sglinfo;
3946 #endif
3947 
3948 	/* If we try and get a window which doesn't exist, return failure */
3949 	if (win >= hp->dmai_nwin) {
3950 		ROOTNEX_PROF_INC(&rootnex_cnt[ROOTNEX_CNT_GETWIN_FAIL]);
3951 		return (DDI_FAILURE);
3952 	}
3953 
3954 	/*
3955 	 * if we don't have any windows, and they're asking for the first
3956 	 * window, setup the cookie pointer to the first cookie in the bind.
3957 	 * setup our return values, then increment the cookie since we return
3958 	 * the first cookie on the stack.
3959 	 */
3960 	if (dma->dp_window == NULL) {
3961 		if (win != 0) {
3962 			ROOTNEX_PROF_INC(&rootnex_cnt[ROOTNEX_CNT_GETWIN_FAIL]);
3963 			return (DDI_FAILURE);
3964 		}
3965 		hp->dmai_cookie = dma->dp_cookies;
3966 		*offp = 0;
3967 		*lenp = dma->dp_dma.dmao_size;
3968 		*ccountp = dma->dp_sglinfo.si_sgl_size;
3969 		*cookiep = hp->dmai_cookie[0];
3970 		hp->dmai_cookie++;
3971 		return (DDI_SUCCESS);
3972 	}
3973 
3974 	/* sync the old window before moving on to the new one */
3975 	window = &dma->dp_window[dma->dp_current_win];
3976 	if ((window->wd_dosync) && (hp->dmai_rflags & DDI_DMA_READ)) {
3977 		(void) rootnex_dma_sync(dip, rdip, handle, 0, 0,
3978 		    DDI_DMA_SYNC_FORCPU);
3979 	}
3980 
3981 #if !defined(__amd64)
3982 	/*
3983 	 * before we move to the next window, if we need to re-map, unmap all
3984 	 * the pages in this window.
3985 	 */
3986 	if (dma->dp_cb_remaping) {
3987 		/*
3988 		 * If we switch to this window again, we'll need to map in
3989 		 * on the fly next time.
3990 		 */
3991 		window->wd_remap_copybuf = B_TRUE;
3992 
3993 		/*
3994 		 * calculate the page index into the buffer where this window
3995 		 * starts, and the number of pages this window takes up.
3996 		 */
3997 		pidx = (sinfo->si_buf_offset + window->wd_offset) >>
3998 		    MMU_PAGESHIFT;
3999 		poff = (sinfo->si_buf_offset + window->wd_offset) &
4000 		    MMU_PAGEOFFSET;
4001 		pcnt = mmu_btopr(window->wd_size + poff);
4002 		ASSERT((pidx + pcnt) <= sinfo->si_max_pages);
4003 
4004 		/* unmap pages which are currently mapped in this window */
4005 		for (i = 0; i < pcnt; i++) {
4006 			if (dma->dp_pgmap[pidx].pm_mapped) {
4007 				hat_unload(kas.a_hat,
4008 				    dma->dp_pgmap[pidx].pm_kaddr, MMU_PAGESIZE,
4009 				    HAT_UNLOAD);
4010 				dma->dp_pgmap[pidx].pm_mapped = B_FALSE;
4011 			}
4012 			pidx++;
4013 		}
4014 	}
4015 #endif
4016 
4017 	/*
4018 	 * Move to the new window.
4019 	 * NOTE: current_win must be set for sync to work right
4020 	 */
4021 	dma->dp_current_win = win;
4022 	window = &dma->dp_window[win];
4023 
4024 	/* if needed, adjust the first and/or last cookies for trim */
4025 	trim = &window->wd_trim;
4026 	if (trim->tr_trim_first) {
4027 		window->wd_first_cookie->dmac_laddress = trim->tr_first_paddr;
4028 		window->wd_first_cookie->dmac_size = trim->tr_first_size;
4029 #if !defined(__amd64)
4030 		window->wd_first_cookie->dmac_type =
4031 		    (window->wd_first_cookie->dmac_type &
4032 		    ROOTNEX_USES_COPYBUF) + window->wd_offset;
4033 #endif
4034 		if (trim->tr_first_copybuf_win) {
4035 			dma->dp_pgmap[trim->tr_first_pidx].pm_cbaddr =
4036 			    trim->tr_first_cbaddr;
4037 #if !defined(__amd64)
4038 			dma->dp_pgmap[trim->tr_first_pidx].pm_kaddr =
4039 			    trim->tr_first_kaddr;
4040 #endif
4041 		}
4042 	}
4043 	if (trim->tr_trim_last) {
4044 		trim->tr_last_cookie->dmac_laddress = trim->tr_last_paddr;
4045 		trim->tr_last_cookie->dmac_size = trim->tr_last_size;
4046 		if (trim->tr_last_copybuf_win) {
4047 			dma->dp_pgmap[trim->tr_last_pidx].pm_cbaddr =
4048 			    trim->tr_last_cbaddr;
4049 #if !defined(__amd64)
4050 			dma->dp_pgmap[trim->tr_last_pidx].pm_kaddr =
4051 			    trim->tr_last_kaddr;
4052 #endif
4053 		}
4054 	}
4055 
4056 	/*
4057 	 * setup the cookie pointer to the first cookie in the window. setup
4058 	 * our return values, then increment the cookie since we return the
4059 	 * first cookie on the stack.
4060 	 */
4061 	hp->dmai_cookie = window->wd_first_cookie;
4062 	*offp = window->wd_offset;
4063 	*lenp = window->wd_size;
4064 	*ccountp = window->wd_cookie_cnt;
4065 	*cookiep = hp->dmai_cookie[0];
4066 	hp->dmai_cookie++;
4067 
4068 #if !defined(__amd64)
4069 	/* re-map copybuf if required for this window */
4070 	if (dma->dp_cb_remaping) {
4071 		/*
4072 		 * calculate the page index into the buffer where this
4073 		 * window starts.
4074 		 */
4075 		pidx = (sinfo->si_buf_offset + window->wd_offset) >>
4076 		    MMU_PAGESHIFT;
4077 		ASSERT(pidx < sinfo->si_max_pages);
4078 
4079 		/*
4080 		 * the first page can get unmapped if it's shared with the
4081 		 * previous window. Even if the rest of this window is already
4082 		 * mapped in, we need to still check this one.
4083 		 */
4084 		pmap = &dma->dp_pgmap[pidx];
4085 		if ((pmap->pm_uses_copybuf) && (pmap->pm_mapped == B_FALSE)) {
4086 			if (pmap->pm_pp != NULL) {
4087 				pmap->pm_mapped = B_TRUE;
4088 				i86_pp_map(pmap->pm_pp, pmap->pm_kaddr);
4089 			} else if (pmap->pm_vaddr != NULL) {
4090 				pmap->pm_mapped = B_TRUE;
4091 				i86_va_map(pmap->pm_vaddr, sinfo->si_asp,
4092 				    pmap->pm_kaddr);
4093 			}
4094 		}
4095 		pidx++;
4096 
4097 		/* map in the rest of the pages if required */
4098 		if (window->wd_remap_copybuf) {
4099 			window->wd_remap_copybuf = B_FALSE;
4100 
4101 			/* figure out many pages this window takes up */
4102 			poff = (sinfo->si_buf_offset + window->wd_offset) &
4103 			    MMU_PAGEOFFSET;
4104 			pcnt = mmu_btopr(window->wd_size + poff);
4105 			ASSERT(((pidx - 1) + pcnt) <= sinfo->si_max_pages);
4106 
4107 			/* map pages which require it */
4108 			for (i = 1; i < pcnt; i++) {
4109 				pmap = &dma->dp_pgmap[pidx];
4110 				if (pmap->pm_uses_copybuf) {
4111 					ASSERT(pmap->pm_mapped == B_FALSE);
4112 					if (pmap->pm_pp != NULL) {
4113 						pmap->pm_mapped = B_TRUE;
4114 						i86_pp_map(pmap->pm_pp,
4115 						    pmap->pm_kaddr);
4116 					} else if (pmap->pm_vaddr != NULL) {
4117 						pmap->pm_mapped = B_TRUE;
4118 						i86_va_map(pmap->pm_vaddr,
4119 						    sinfo->si_asp,
4120 						    pmap->pm_kaddr);
4121 					}
4122 				}
4123 				pidx++;
4124 			}
4125 		}
4126 	}
4127 #endif
4128 
4129 	/* if the new window uses the copy buffer, sync it for the device */
4130 	if ((window->wd_dosync) && (hp->dmai_rflags & DDI_DMA_WRITE)) {
4131 		(void) rootnex_dma_sync(dip, rdip, handle, 0, 0,
4132 		    DDI_DMA_SYNC_FORDEV);
4133 	}
4134 
4135 	return (DDI_SUCCESS);
4136 }
4137 
4138 
4139 
4140 /*
4141  * ************************
4142  *  obsoleted dma routines
4143  * ************************
4144  */
4145 
4146 /*
4147  * rootnex_dma_map()
4148  *    called from ddi_dma_setup()
4149  */
4150 /* ARGSUSED */
4151 static int
4152 rootnex_dma_map(dev_info_t *dip, dev_info_t *rdip, struct ddi_dma_req *dmareq,
4153     ddi_dma_handle_t *handlep)
4154 {
4155 #if defined(__amd64)
4156 	/*
4157 	 * this interface is not supported in 64-bit x86 kernel. See comment in
4158 	 * rootnex_dma_mctl()
4159 	 */
4160 	return (DDI_DMA_NORESOURCES);
4161 
4162 #else /* 32-bit x86 kernel */
4163 	ddi_dma_handle_t *lhandlep;
4164 	ddi_dma_handle_t lhandle;
4165 	ddi_dma_cookie_t cookie;
4166 	ddi_dma_attr_t dma_attr;
4167 	ddi_dma_lim_t *dma_lim;
4168 	uint_t ccnt;
4169 	int e;
4170 
4171 
4172 	/*
4173 	 * if the driver is just testing to see if it's possible to do the bind,
4174 	 * we'll use local state. Otherwise, use the handle pointer passed in.
4175 	 */
4176 	if (handlep == NULL) {
4177 		lhandlep = &lhandle;
4178 	} else {
4179 		lhandlep = handlep;
4180 	}
4181 
4182 	/* convert the limit structure to a dma_attr one */
4183 	dma_lim = dmareq->dmar_limits;
4184 	dma_attr.dma_attr_version = DMA_ATTR_V0;
4185 	dma_attr.dma_attr_addr_lo = dma_lim->dlim_addr_lo;
4186 	dma_attr.dma_attr_addr_hi = dma_lim->dlim_addr_hi;
4187 	dma_attr.dma_attr_minxfer = dma_lim->dlim_minxfer;
4188 	dma_attr.dma_attr_seg = dma_lim->dlim_adreg_max;
4189 	dma_attr.dma_attr_count_max = dma_lim->dlim_ctreg_max;
4190 	dma_attr.dma_attr_granular = dma_lim->dlim_granular;
4191 	dma_attr.dma_attr_sgllen = dma_lim->dlim_sgllen;
4192 	dma_attr.dma_attr_maxxfer = dma_lim->dlim_reqsize;
4193 	dma_attr.dma_attr_burstsizes = dma_lim->dlim_burstsizes;
4194 	dma_attr.dma_attr_align = MMU_PAGESIZE;
4195 	dma_attr.dma_attr_flags = 0;
4196 
4197 	e = rootnex_dma_allochdl(dip, rdip, &dma_attr, dmareq->dmar_fp,
4198 	    dmareq->dmar_arg, lhandlep);
4199 	if (e != DDI_SUCCESS) {
4200 		return (e);
4201 	}
4202 
4203 	e = rootnex_dma_bindhdl(dip, rdip, *lhandlep, dmareq, &cookie, &ccnt);
4204 	if ((e != DDI_DMA_MAPPED) && (e != DDI_DMA_PARTIAL_MAP)) {
4205 		(void) rootnex_dma_freehdl(dip, rdip, *lhandlep);
4206 		return (e);
4207 	}
4208 
4209 	/*
4210 	 * if the driver is just testing to see if it's possible to do the bind,
4211 	 * free up the local state and return the result.
4212 	 */
4213 	if (handlep == NULL) {
4214 		(void) rootnex_dma_unbindhdl(dip, rdip, *lhandlep);
4215 		(void) rootnex_dma_freehdl(dip, rdip, *lhandlep);
4216 		if (e == DDI_DMA_MAPPED) {
4217 			return (DDI_DMA_MAPOK);
4218 		} else {
4219 			return (DDI_DMA_NOMAPPING);
4220 		}
4221 	}
4222 
4223 	return (e);
4224 #endif /* defined(__amd64) */
4225 }
4226 
4227 
4228 /*
4229  * rootnex_dma_mctl()
4230  *
4231  */
4232 /* ARGSUSED */
4233 static int
4234 rootnex_dma_mctl(dev_info_t *dip, dev_info_t *rdip, ddi_dma_handle_t handle,
4235     enum ddi_dma_ctlops request, off_t *offp, size_t *lenp, caddr_t *objpp,
4236     uint_t cache_flags)
4237 {
4238 #if defined(__amd64)
4239 	/*
4240 	 * DDI_DMA_SMEM_ALLOC & DDI_DMA_IOPB_ALLOC we're changed to have a
4241 	 * common implementation in genunix, so they no longer have x86
4242 	 * specific functionality which called into dma_ctl.
4243 	 *
4244 	 * The rest of the obsoleted interfaces were never supported in the
4245 	 * 64-bit x86 kernel. For s10, the obsoleted DDI_DMA_SEGTOC interface
4246 	 * was not ported to the x86 64-bit kernel do to serious x86 rootnex
4247 	 * implementation issues.
4248 	 *
4249 	 * If you can't use DDI_DMA_SEGTOC; DDI_DMA_NEXTSEG, DDI_DMA_FREE, and
4250 	 * DDI_DMA_NEXTWIN are useless since you can get to the cookie, so we
4251 	 * reflect that now too...
4252 	 *
4253 	 * Even though we fixed the pointer problem in DDI_DMA_SEGTOC, we are
4254 	 * not going to put this functionality into the 64-bit x86 kernel now.
4255 	 * It wasn't ported to the 64-bit kernel for s10, no reason to change
4256 	 * that in a future release.
4257 	 */
4258 	return (DDI_FAILURE);
4259 
4260 #else /* 32-bit x86 kernel */
4261 	ddi_dma_cookie_t lcookie;
4262 	ddi_dma_cookie_t *cookie;
4263 	rootnex_window_t *window;
4264 	ddi_dma_impl_t *hp;
4265 	rootnex_dma_t *dma;
4266 	uint_t nwin;
4267 	uint_t ccnt;
4268 	size_t len;
4269 	off_t off;
4270 	int e;
4271 
4272 
4273 	/*
4274 	 * DDI_DMA_SEGTOC, DDI_DMA_NEXTSEG, and DDI_DMA_NEXTWIN are a little
4275 	 * hacky since were optimizing for the current interfaces and so we can
4276 	 * cleanup the mess in genunix. Hopefully we will remove the this
4277 	 * obsoleted routines someday soon.
4278 	 */
4279 
4280 	switch (request) {
4281 
4282 	case DDI_DMA_SEGTOC: /* ddi_dma_segtocookie() */
4283 		hp = (ddi_dma_impl_t *)handle;
4284 		cookie = (ddi_dma_cookie_t *)objpp;
4285 
4286 		/*
4287 		 * convert segment to cookie. We don't distinguish between the
4288 		 * two :-)
4289 		 */
4290 		*cookie = *hp->dmai_cookie;
4291 		*lenp = cookie->dmac_size;
4292 		*offp = cookie->dmac_type & ~ROOTNEX_USES_COPYBUF;
4293 		return (DDI_SUCCESS);
4294 
4295 	case DDI_DMA_NEXTSEG: /* ddi_dma_nextseg() */
4296 		hp = (ddi_dma_impl_t *)handle;
4297 		dma = (rootnex_dma_t *)hp->dmai_private;
4298 
4299 		if ((*lenp != NULL) && ((uintptr_t)*lenp != (uintptr_t)hp)) {
4300 			return (DDI_DMA_STALE);
4301 		}
4302 
4303 		/* handle the case where we don't have any windows */
4304 		if (dma->dp_window == NULL) {
4305 			/*
4306 			 * if seg == NULL, and we don't have any windows,
4307 			 * return the first cookie in the sgl.
4308 			 */
4309 			if (*lenp == NULL) {
4310 				dma->dp_current_cookie = 0;
4311 				hp->dmai_cookie = dma->dp_cookies;
4312 				*objpp = (caddr_t)handle;
4313 				return (DDI_SUCCESS);
4314 
4315 			/* if we have more cookies, go to the next cookie */
4316 			} else {
4317 				if ((dma->dp_current_cookie + 1) >=
4318 				    dma->dp_sglinfo.si_sgl_size) {
4319 					return (DDI_DMA_DONE);
4320 				}
4321 				dma->dp_current_cookie++;
4322 				hp->dmai_cookie++;
4323 				return (DDI_SUCCESS);
4324 			}
4325 		}
4326 
4327 		/* We have one or more windows */
4328 		window = &dma->dp_window[dma->dp_current_win];
4329 
4330 		/*
4331 		 * if seg == NULL, return the first cookie in the current
4332 		 * window
4333 		 */
4334 		if (*lenp == NULL) {
4335 			dma->dp_current_cookie = 0;
4336 			hp->dmai_cookie = window->wd_first_cookie;
4337 
4338 		/*
4339 		 * go to the next cookie in the window then see if we done with
4340 		 * this window.
4341 		 */
4342 		} else {
4343 			if ((dma->dp_current_cookie + 1) >=
4344 			    window->wd_cookie_cnt) {
4345 				return (DDI_DMA_DONE);
4346 			}
4347 			dma->dp_current_cookie++;
4348 			hp->dmai_cookie++;
4349 		}
4350 		*objpp = (caddr_t)handle;
4351 		return (DDI_SUCCESS);
4352 
4353 	case DDI_DMA_NEXTWIN: /* ddi_dma_nextwin() */
4354 		hp = (ddi_dma_impl_t *)handle;
4355 		dma = (rootnex_dma_t *)hp->dmai_private;
4356 
4357 		if ((*offp != NULL) && ((uintptr_t)*offp != (uintptr_t)hp)) {
4358 			return (DDI_DMA_STALE);
4359 		}
4360 
4361 		/* if win == NULL, return the first window in the bind */
4362 		if (*offp == NULL) {
4363 			nwin = 0;
4364 
4365 		/*
4366 		 * else, go to the next window then see if we're done with all
4367 		 * the windows.
4368 		 */
4369 		} else {
4370 			nwin = dma->dp_current_win + 1;
4371 			if (nwin >= hp->dmai_nwin) {
4372 				return (DDI_DMA_DONE);
4373 			}
4374 		}
4375 
4376 		/* switch to the next window */
4377 		e = rootnex_dma_win(dip, rdip, handle, nwin, &off, &len,
4378 		    &lcookie, &ccnt);
4379 		ASSERT(e == DDI_SUCCESS);
4380 		if (e != DDI_SUCCESS) {
4381 			return (DDI_DMA_STALE);
4382 		}
4383 
4384 		/* reset the cookie back to the first cookie in the window */
4385 		if (dma->dp_window != NULL) {
4386 			window = &dma->dp_window[dma->dp_current_win];
4387 			hp->dmai_cookie = window->wd_first_cookie;
4388 		} else {
4389 			hp->dmai_cookie = dma->dp_cookies;
4390 		}
4391 
4392 		*objpp = (caddr_t)handle;
4393 		return (DDI_SUCCESS);
4394 
4395 	case DDI_DMA_FREE: /* ddi_dma_free() */
4396 		(void) rootnex_dma_unbindhdl(dip, rdip, handle);
4397 		(void) rootnex_dma_freehdl(dip, rdip, handle);
4398 		if (rootnex_state->r_dvma_call_list_id) {
4399 			ddi_run_callback(&rootnex_state->r_dvma_call_list_id);
4400 		}
4401 		return (DDI_SUCCESS);
4402 
4403 	case DDI_DMA_IOPB_ALLOC:	/* get contiguous DMA-able memory */
4404 	case DDI_DMA_SMEM_ALLOC:	/* get contiguous DMA-able memory */
4405 		/* should never get here, handled in genunix */
4406 		ASSERT(0);
4407 		return (DDI_FAILURE);
4408 
4409 	case DDI_DMA_KVADDR:
4410 	case DDI_DMA_GETERR:
4411 	case DDI_DMA_COFF:
4412 		return (DDI_FAILURE);
4413 	}
4414 
4415 	return (DDI_FAILURE);
4416 #endif /* defined(__amd64) */
4417 }
4418 
4419 
4420 /*
4421  * *********
4422  *  FMA Code
4423  * *********
4424  */
4425 
4426 /*
4427  * rootnex_fm_init()
4428  *    FMA init busop
4429  */
4430 /* ARGSUSED */
4431 static int
4432 rootnex_fm_init(dev_info_t *dip, dev_info_t *tdip, int tcap,
4433     ddi_iblock_cookie_t *ibc)
4434 {
4435 	*ibc = rootnex_state->r_err_ibc;
4436 
4437 	return (ddi_system_fmcap);
4438 }
4439 
4440 /*
4441  * rootnex_dma_check()
4442  *    Function called after a dma fault occurred to find out whether the
4443  *    fault address is associated with a driver that is able to handle faults
4444  *    and recover from faults.
4445  */
4446 /* ARGSUSED */
4447 static int
4448 rootnex_dma_check(dev_info_t *dip, const void *handle, const void *addr,
4449     const void *not_used)
4450 {
4451 	rootnex_window_t *window;
4452 	uint64_t start_addr;
4453 	uint64_t fault_addr;
4454 	ddi_dma_impl_t *hp;
4455 	rootnex_dma_t *dma;
4456 	uint64_t end_addr;
4457 	size_t csize;
4458 	int i;
4459 	int j;
4460 
4461 
4462 	/* The driver has to set DDI_DMA_FLAGERR to recover from dma faults */
4463 	hp = (ddi_dma_impl_t *)handle;
4464 	ASSERT(hp);
4465 
4466 	dma = (rootnex_dma_t *)hp->dmai_private;
4467 
4468 	/* Get the address that we need to search for */
4469 	fault_addr = *(uint64_t *)addr;
4470 
4471 	/*
4472 	 * if we don't have any windows, we can just walk through all the
4473 	 * cookies.
4474 	 */
4475 	if (dma->dp_window == NULL) {
4476 		/* for each cookie */
4477 		for (i = 0; i < dma->dp_sglinfo.si_sgl_size; i++) {
4478 			/*
4479 			 * if the faulted address is within the physical address
4480 			 * range of the cookie, return DDI_FM_NONFATAL.
4481 			 */
4482 			if ((fault_addr >= dma->dp_cookies[i].dmac_laddress) &&
4483 			    (fault_addr <= (dma->dp_cookies[i].dmac_laddress +
4484 			    dma->dp_cookies[i].dmac_size))) {
4485 				return (DDI_FM_NONFATAL);
4486 			}
4487 		}
4488 
4489 		/* fault_addr not within this DMA handle */
4490 		return (DDI_FM_UNKNOWN);
4491 	}
4492 
4493 	/* we have mutiple windows, walk through each window */
4494 	for (i = 0; i < hp->dmai_nwin; i++) {
4495 		window = &dma->dp_window[i];
4496 
4497 		/* Go through all the cookies in the window */
4498 		for (j = 0; j < window->wd_cookie_cnt; j++) {
4499 
4500 			start_addr = window->wd_first_cookie[j].dmac_laddress;
4501 			csize = window->wd_first_cookie[j].dmac_size;
4502 
4503 			/*
4504 			 * if we are trimming the first cookie in the window,
4505 			 * and this is the first cookie, adjust the start
4506 			 * address and size of the cookie to account for the
4507 			 * trim.
4508 			 */
4509 			if (window->wd_trim.tr_trim_first && (j == 0)) {
4510 				start_addr = window->wd_trim.tr_first_paddr;
4511 				csize = window->wd_trim.tr_first_size;
4512 			}
4513 
4514 			/*
4515 			 * if we are trimming the last cookie in the window,
4516 			 * and this is the last cookie, adjust the start
4517 			 * address and size of the cookie to account for the
4518 			 * trim.
4519 			 */
4520 			if (window->wd_trim.tr_trim_last &&
4521 			    (j == (window->wd_cookie_cnt - 1))) {
4522 				start_addr = window->wd_trim.tr_last_paddr;
4523 				csize = window->wd_trim.tr_last_size;
4524 			}
4525 
4526 			end_addr = start_addr + csize;
4527 
4528 			/*
4529 			 * if the faulted address is within the physical address
4530 			 * range of the cookie, return DDI_FM_NONFATAL.
4531 			 */
4532 			if ((fault_addr >= start_addr) &&
4533 			    (fault_addr <= end_addr)) {
4534 				return (DDI_FM_NONFATAL);
4535 			}
4536 		}
4537 	}
4538 
4539 	/* fault_addr not within this DMA handle */
4540 	return (DDI_FM_UNKNOWN);
4541 }
4542