xref: /titanic_41/usr/src/uts/i86pc/io/rootnex.c (revision ea394cb00fd96864e34d2841b4a22357b621c78f)
1 /*
2  * CDDL HEADER START
3  *
4  * The contents of this file are subject to the terms of the
5  * Common Development and Distribution License (the "License").
6  * You may not use this file except in compliance with the License.
7  *
8  * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
9  * or http://www.opensolaris.org/os/licensing.
10  * See the License for the specific language governing permissions
11  * and limitations under the License.
12  *
13  * When distributing Covered Code, include this CDDL HEADER in each
14  * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
15  * If applicable, add the following below this CDDL HEADER, with the
16  * fields enclosed by brackets "[]" replaced with your own identifying
17  * information: Portions Copyright [yyyy] [name of copyright owner]
18  *
19  * CDDL HEADER END
20  */
21 /*
22  * Copyright 2010 Sun Microsystems, Inc.  All rights reserved.
23  * Use is subject to license terms.
24  */
25 
26 /*
27  * x86 root nexus driver
28  */
29 
30 #include <sys/sysmacros.h>
31 #include <sys/conf.h>
32 #include <sys/autoconf.h>
33 #include <sys/sysmacros.h>
34 #include <sys/debug.h>
35 #include <sys/psw.h>
36 #include <sys/ddidmareq.h>
37 #include <sys/promif.h>
38 #include <sys/devops.h>
39 #include <sys/kmem.h>
40 #include <sys/cmn_err.h>
41 #include <vm/seg.h>
42 #include <vm/seg_kmem.h>
43 #include <vm/seg_dev.h>
44 #include <sys/vmem.h>
45 #include <sys/mman.h>
46 #include <vm/hat.h>
47 #include <vm/as.h>
48 #include <vm/page.h>
49 #include <sys/avintr.h>
50 #include <sys/errno.h>
51 #include <sys/modctl.h>
52 #include <sys/ddi_impldefs.h>
53 #include <sys/sunddi.h>
54 #include <sys/sunndi.h>
55 #include <sys/mach_intr.h>
56 #include <sys/psm.h>
57 #include <sys/ontrap.h>
58 #include <sys/atomic.h>
59 #include <sys/sdt.h>
60 #include <sys/rootnex.h>
61 #include <vm/hat_i86.h>
62 #include <sys/ddifm.h>
63 #include <sys/ddi_isa.h>
64 
65 #ifdef __xpv
66 #include <sys/bootinfo.h>
67 #include <sys/hypervisor.h>
68 #include <sys/bootconf.h>
69 #include <vm/kboot_mmu.h>
70 #endif
71 
72 #if defined(__amd64) && !defined(__xpv)
73 #include <sys/immu.h>
74 #endif
75 
76 
77 /*
78  * enable/disable extra checking of function parameters. Useful for debugging
79  * drivers.
80  */
81 #ifdef	DEBUG
82 int rootnex_alloc_check_parms = 1;
83 int rootnex_bind_check_parms = 1;
84 int rootnex_bind_check_inuse = 1;
85 int rootnex_unbind_verify_buffer = 0;
86 int rootnex_sync_check_parms = 1;
87 #else
88 int rootnex_alloc_check_parms = 0;
89 int rootnex_bind_check_parms = 0;
90 int rootnex_bind_check_inuse = 0;
91 int rootnex_unbind_verify_buffer = 0;
92 int rootnex_sync_check_parms = 0;
93 #endif
94 
95 boolean_t rootnex_dmar_not_setup;
96 
97 /* Master Abort and Target Abort panic flag */
98 int rootnex_fm_ma_ta_panic_flag = 0;
99 
100 /* Semi-temporary patchables to phase in bug fixes, test drivers, etc. */
101 int rootnex_bind_fail = 1;
102 int rootnex_bind_warn = 1;
103 uint8_t *rootnex_warn_list;
104 /* bitmasks for rootnex_warn_list. Up to 8 different warnings with uint8_t */
105 #define	ROOTNEX_BIND_WARNING	(0x1 << 0)
106 
107 /*
108  * revert back to old broken behavior of always sync'ing entire copy buffer.
109  * This is useful if be have a buggy driver which doesn't correctly pass in
110  * the offset and size into ddi_dma_sync().
111  */
112 int rootnex_sync_ignore_params = 0;
113 
114 /*
115  * For the 64-bit kernel, pre-alloc enough cookies for a 256K buffer plus 1
116  * page for alignment. For the 32-bit kernel, pre-alloc enough cookies for a
117  * 64K buffer plus 1 page for alignment (we have less kernel space in a 32-bit
118  * kernel). Allocate enough windows to handle a 256K buffer w/ at least 65
119  * sgllen DMA engine, and enough copybuf buffer state pages to handle 2 pages
120  * (< 8K). We will still need to allocate the copy buffer during bind though
121  * (if we need one). These can only be modified in /etc/system before rootnex
122  * attach.
123  */
124 #if defined(__amd64)
125 int rootnex_prealloc_cookies = 65;
126 int rootnex_prealloc_windows = 4;
127 int rootnex_prealloc_copybuf = 2;
128 #else
129 int rootnex_prealloc_cookies = 33;
130 int rootnex_prealloc_windows = 4;
131 int rootnex_prealloc_copybuf = 2;
132 #endif
133 
134 /* driver global state */
135 static rootnex_state_t *rootnex_state;
136 
137 /* shortcut to rootnex counters */
138 static uint64_t *rootnex_cnt;
139 
140 /*
141  * XXX - does x86 even need these or are they left over from the SPARC days?
142  */
143 /* statically defined integer/boolean properties for the root node */
144 static rootnex_intprop_t rootnex_intprp[] = {
145 	{ "PAGESIZE",			PAGESIZE },
146 	{ "MMU_PAGESIZE",		MMU_PAGESIZE },
147 	{ "MMU_PAGEOFFSET",		MMU_PAGEOFFSET },
148 	{ DDI_RELATIVE_ADDRESSING,	1 },
149 };
150 #define	NROOT_INTPROPS	(sizeof (rootnex_intprp) / sizeof (rootnex_intprop_t))
151 
152 #ifdef __xpv
153 typedef maddr_t rootnex_addr_t;
154 #define	ROOTNEX_PADDR_TO_RBASE(xinfo, pa)	\
155 	(DOMAIN_IS_INITDOMAIN(xinfo) ? pa_to_ma(pa) : (pa))
156 #else
157 typedef paddr_t rootnex_addr_t;
158 #endif
159 
160 #if !defined(__xpv)
161 char _depends_on[] = "mach/pcplusmp misc/iommulib misc/acpica";
162 #endif
163 
164 static struct cb_ops rootnex_cb_ops = {
165 	nodev,		/* open */
166 	nodev,		/* close */
167 	nodev,		/* strategy */
168 	nodev,		/* print */
169 	nodev,		/* dump */
170 	nodev,		/* read */
171 	nodev,		/* write */
172 	nodev,		/* ioctl */
173 	nodev,		/* devmap */
174 	nodev,		/* mmap */
175 	nodev,		/* segmap */
176 	nochpoll,	/* chpoll */
177 	ddi_prop_op,	/* cb_prop_op */
178 	NULL,		/* struct streamtab */
179 	D_NEW | D_MP | D_HOTPLUG, /* compatibility flags */
180 	CB_REV,		/* Rev */
181 	nodev,		/* cb_aread */
182 	nodev		/* cb_awrite */
183 };
184 
185 static int rootnex_map(dev_info_t *dip, dev_info_t *rdip, ddi_map_req_t *mp,
186     off_t offset, off_t len, caddr_t *vaddrp);
187 static int rootnex_map_fault(dev_info_t *dip, dev_info_t *rdip,
188     struct hat *hat, struct seg *seg, caddr_t addr,
189     struct devpage *dp, pfn_t pfn, uint_t prot, uint_t lock);
190 static int rootnex_dma_map(dev_info_t *dip, dev_info_t *rdip,
191     struct ddi_dma_req *dmareq, ddi_dma_handle_t *handlep);
192 static int rootnex_dma_allochdl(dev_info_t *dip, dev_info_t *rdip,
193     ddi_dma_attr_t *attr, int (*waitfp)(caddr_t), caddr_t arg,
194     ddi_dma_handle_t *handlep);
195 static int rootnex_dma_freehdl(dev_info_t *dip, dev_info_t *rdip,
196     ddi_dma_handle_t handle);
197 static int rootnex_dma_bindhdl(dev_info_t *dip, dev_info_t *rdip,
198     ddi_dma_handle_t handle, struct ddi_dma_req *dmareq,
199     ddi_dma_cookie_t *cookiep, uint_t *ccountp);
200 static int rootnex_dma_unbindhdl(dev_info_t *dip, dev_info_t *rdip,
201     ddi_dma_handle_t handle);
202 static int rootnex_dma_sync(dev_info_t *dip, dev_info_t *rdip,
203     ddi_dma_handle_t handle, off_t off, size_t len, uint_t cache_flags);
204 static int rootnex_dma_win(dev_info_t *dip, dev_info_t *rdip,
205     ddi_dma_handle_t handle, uint_t win, off_t *offp, size_t *lenp,
206     ddi_dma_cookie_t *cookiep, uint_t *ccountp);
207 static int rootnex_dma_mctl(dev_info_t *dip, dev_info_t *rdip,
208     ddi_dma_handle_t handle, enum ddi_dma_ctlops request,
209     off_t *offp, size_t *lenp, caddr_t *objp, uint_t cache_flags);
210 static int rootnex_ctlops(dev_info_t *dip, dev_info_t *rdip,
211     ddi_ctl_enum_t ctlop, void *arg, void *result);
212 static int rootnex_fm_init(dev_info_t *dip, dev_info_t *tdip, int tcap,
213     ddi_iblock_cookie_t *ibc);
214 static int rootnex_intr_ops(dev_info_t *pdip, dev_info_t *rdip,
215     ddi_intr_op_t intr_op, ddi_intr_handle_impl_t *hdlp, void *result);
216 
217 static int rootnex_coredma_allochdl(dev_info_t *dip, dev_info_t *rdip,
218     ddi_dma_attr_t *attr, int (*waitfp)(caddr_t), caddr_t arg,
219     ddi_dma_handle_t *handlep);
220 static int rootnex_coredma_freehdl(dev_info_t *dip, dev_info_t *rdip,
221     ddi_dma_handle_t handle);
222 static int rootnex_coredma_bindhdl(dev_info_t *dip, dev_info_t *rdip,
223     ddi_dma_handle_t handle, struct ddi_dma_req *dmareq,
224     ddi_dma_cookie_t *cookiep, uint_t *ccountp);
225 static int rootnex_coredma_unbindhdl(dev_info_t *dip, dev_info_t *rdip,
226     ddi_dma_handle_t handle);
227 #if defined(__amd64) && !defined(__xpv)
228 static void rootnex_coredma_reset_cookies(dev_info_t *dip,
229     ddi_dma_handle_t handle);
230 static int rootnex_coredma_get_cookies(dev_info_t *dip, ddi_dma_handle_t handle,
231     ddi_dma_cookie_t **cookiepp, uint_t *ccountp);
232 static int rootnex_coredma_set_cookies(dev_info_t *dip, ddi_dma_handle_t handle,
233     ddi_dma_cookie_t *cookiep, uint_t ccount);
234 static int rootnex_coredma_clear_cookies(dev_info_t *dip,
235     ddi_dma_handle_t handle);
236 static int rootnex_coredma_get_sleep_flags(ddi_dma_handle_t handle);
237 #endif
238 static int rootnex_coredma_sync(dev_info_t *dip, dev_info_t *rdip,
239     ddi_dma_handle_t handle, off_t off, size_t len, uint_t cache_flags);
240 static int rootnex_coredma_win(dev_info_t *dip, dev_info_t *rdip,
241     ddi_dma_handle_t handle, uint_t win, off_t *offp, size_t *lenp,
242     ddi_dma_cookie_t *cookiep, uint_t *ccountp);
243 
244 static struct bus_ops rootnex_bus_ops = {
245 	BUSO_REV,
246 	rootnex_map,
247 	NULL,
248 	NULL,
249 	NULL,
250 	rootnex_map_fault,
251 	rootnex_dma_map,
252 	rootnex_dma_allochdl,
253 	rootnex_dma_freehdl,
254 	rootnex_dma_bindhdl,
255 	rootnex_dma_unbindhdl,
256 	rootnex_dma_sync,
257 	rootnex_dma_win,
258 	rootnex_dma_mctl,
259 	rootnex_ctlops,
260 	ddi_bus_prop_op,
261 	i_ddi_rootnex_get_eventcookie,
262 	i_ddi_rootnex_add_eventcall,
263 	i_ddi_rootnex_remove_eventcall,
264 	i_ddi_rootnex_post_event,
265 	0,			/* bus_intr_ctl */
266 	0,			/* bus_config */
267 	0,			/* bus_unconfig */
268 	rootnex_fm_init,	/* bus_fm_init */
269 	NULL,			/* bus_fm_fini */
270 	NULL,			/* bus_fm_access_enter */
271 	NULL,			/* bus_fm_access_exit */
272 	NULL,			/* bus_powr */
273 	rootnex_intr_ops	/* bus_intr_op */
274 };
275 
276 static int rootnex_attach(dev_info_t *dip, ddi_attach_cmd_t cmd);
277 static int rootnex_detach(dev_info_t *dip, ddi_detach_cmd_t cmd);
278 static int rootnex_quiesce(dev_info_t *dip);
279 
280 static struct dev_ops rootnex_ops = {
281 	DEVO_REV,
282 	0,
283 	ddi_no_info,
284 	nulldev,
285 	nulldev,
286 	rootnex_attach,
287 	rootnex_detach,
288 	nulldev,
289 	&rootnex_cb_ops,
290 	&rootnex_bus_ops,
291 	NULL,
292 	rootnex_quiesce,		/* quiesce */
293 };
294 
295 static struct modldrv rootnex_modldrv = {
296 	&mod_driverops,
297 	"i86pc root nexus",
298 	&rootnex_ops
299 };
300 
301 static struct modlinkage rootnex_modlinkage = {
302 	MODREV_1,
303 	(void *)&rootnex_modldrv,
304 	NULL
305 };
306 
307 #if defined(__amd64) && !defined(__xpv)
308 static iommulib_nexops_t iommulib_nexops = {
309 	IOMMU_NEXOPS_VERSION,
310 	"Rootnex IOMMU ops Vers 1.1",
311 	NULL,
312 	rootnex_coredma_allochdl,
313 	rootnex_coredma_freehdl,
314 	rootnex_coredma_bindhdl,
315 	rootnex_coredma_unbindhdl,
316 	rootnex_coredma_reset_cookies,
317 	rootnex_coredma_get_cookies,
318 	rootnex_coredma_set_cookies,
319 	rootnex_coredma_clear_cookies,
320 	rootnex_coredma_get_sleep_flags,
321 	rootnex_coredma_sync,
322 	rootnex_coredma_win,
323 	rootnex_dma_map,
324 	rootnex_dma_mctl
325 };
326 #endif
327 
328 /*
329  *  extern hacks
330  */
331 extern struct seg_ops segdev_ops;
332 extern int ignore_hardware_nodes;	/* force flag from ddi_impl.c */
333 #ifdef	DDI_MAP_DEBUG
334 extern int ddi_map_debug_flag;
335 #define	ddi_map_debug	if (ddi_map_debug_flag) prom_printf
336 #endif
337 extern void i86_pp_map(page_t *pp, caddr_t kaddr);
338 extern void i86_va_map(caddr_t vaddr, struct as *asp, caddr_t kaddr);
339 extern int (*psm_intr_ops)(dev_info_t *, ddi_intr_handle_impl_t *,
340     psm_intr_op_t, int *);
341 extern int impl_ddi_sunbus_initchild(dev_info_t *dip);
342 extern void impl_ddi_sunbus_removechild(dev_info_t *dip);
343 
344 /*
345  * Use device arena to use for device control register mappings.
346  * Various kernel memory walkers (debugger, dtrace) need to know
347  * to avoid this address range to prevent undesired device activity.
348  */
349 extern void *device_arena_alloc(size_t size, int vm_flag);
350 extern void device_arena_free(void * vaddr, size_t size);
351 
352 
353 /*
354  *  Internal functions
355  */
356 static int rootnex_dma_init();
357 static void rootnex_add_props(dev_info_t *);
358 static int rootnex_ctl_reportdev(dev_info_t *dip);
359 static struct intrspec *rootnex_get_ispec(dev_info_t *rdip, int inum);
360 static int rootnex_map_regspec(ddi_map_req_t *mp, caddr_t *vaddrp);
361 static int rootnex_unmap_regspec(ddi_map_req_t *mp, caddr_t *vaddrp);
362 static int rootnex_map_handle(ddi_map_req_t *mp);
363 static void rootnex_clean_dmahdl(ddi_dma_impl_t *hp);
364 static int rootnex_valid_alloc_parms(ddi_dma_attr_t *attr, uint_t maxsegsize);
365 static int rootnex_valid_bind_parms(ddi_dma_req_t *dmareq,
366     ddi_dma_attr_t *attr);
367 static void rootnex_get_sgl(ddi_dma_obj_t *dmar_object, ddi_dma_cookie_t *sgl,
368     rootnex_sglinfo_t *sglinfo);
369 static int rootnex_bind_slowpath(ddi_dma_impl_t *hp, struct ddi_dma_req *dmareq,
370     rootnex_dma_t *dma, ddi_dma_attr_t *attr, int kmflag);
371 static int rootnex_setup_copybuf(ddi_dma_impl_t *hp, struct ddi_dma_req *dmareq,
372     rootnex_dma_t *dma, ddi_dma_attr_t *attr);
373 static void rootnex_teardown_copybuf(rootnex_dma_t *dma);
374 static int rootnex_setup_windows(ddi_dma_impl_t *hp, rootnex_dma_t *dma,
375     ddi_dma_attr_t *attr, int kmflag);
376 static void rootnex_teardown_windows(rootnex_dma_t *dma);
377 static void rootnex_init_win(ddi_dma_impl_t *hp, rootnex_dma_t *dma,
378     rootnex_window_t *window, ddi_dma_cookie_t *cookie, off_t cur_offset);
379 static void rootnex_setup_cookie(ddi_dma_obj_t *dmar_object,
380     rootnex_dma_t *dma, ddi_dma_cookie_t *cookie, off_t cur_offset,
381     size_t *copybuf_used, page_t **cur_pp);
382 static int rootnex_sgllen_window_boundary(ddi_dma_impl_t *hp,
383     rootnex_dma_t *dma, rootnex_window_t **windowp, ddi_dma_cookie_t *cookie,
384     ddi_dma_attr_t *attr, off_t cur_offset);
385 static int rootnex_copybuf_window_boundary(ddi_dma_impl_t *hp,
386     rootnex_dma_t *dma, rootnex_window_t **windowp,
387     ddi_dma_cookie_t *cookie, off_t cur_offset, size_t *copybuf_used);
388 static int rootnex_maxxfer_window_boundary(ddi_dma_impl_t *hp,
389     rootnex_dma_t *dma, rootnex_window_t **windowp, ddi_dma_cookie_t *cookie);
390 static int rootnex_valid_sync_parms(ddi_dma_impl_t *hp, rootnex_window_t *win,
391     off_t offset, size_t size, uint_t cache_flags);
392 static int rootnex_verify_buffer(rootnex_dma_t *dma);
393 static int rootnex_dma_check(dev_info_t *dip, const void *handle,
394     const void *comp_addr, const void *not_used);
395 static boolean_t rootnex_need_bounce_seg(ddi_dma_obj_t *dmar_object,
396     rootnex_sglinfo_t *sglinfo);
397 
398 /*
399  * _init()
400  *
401  */
402 int
403 _init(void)
404 {
405 
406 	rootnex_state = NULL;
407 	return (mod_install(&rootnex_modlinkage));
408 }
409 
410 
411 /*
412  * _info()
413  *
414  */
415 int
416 _info(struct modinfo *modinfop)
417 {
418 	return (mod_info(&rootnex_modlinkage, modinfop));
419 }
420 
421 
422 /*
423  * _fini()
424  *
425  */
426 int
427 _fini(void)
428 {
429 	return (EBUSY);
430 }
431 
432 
433 /*
434  * rootnex_attach()
435  *
436  */
437 static int
438 rootnex_attach(dev_info_t *dip, ddi_attach_cmd_t cmd)
439 {
440 	int fmcap;
441 	int e;
442 
443 	switch (cmd) {
444 	case DDI_ATTACH:
445 		break;
446 	case DDI_RESUME:
447 #if defined(__amd64) && !defined(__xpv)
448 		return (immu_unquiesce());
449 #else
450 		return (DDI_SUCCESS);
451 #endif
452 	default:
453 		return (DDI_FAILURE);
454 	}
455 
456 	/*
457 	 * We should only have one instance of rootnex. Save it away since we
458 	 * don't have an easy way to get it back later.
459 	 */
460 	ASSERT(rootnex_state == NULL);
461 	rootnex_state = kmem_zalloc(sizeof (rootnex_state_t), KM_SLEEP);
462 
463 	rootnex_state->r_dip = dip;
464 	rootnex_state->r_err_ibc = (ddi_iblock_cookie_t)ipltospl(15);
465 	rootnex_state->r_reserved_msg_printed = B_FALSE;
466 	rootnex_cnt = &rootnex_state->r_counters[0];
467 
468 	/*
469 	 * Set minimum fm capability level for i86pc platforms and then
470 	 * initialize error handling. Since we're the rootnex, we don't
471 	 * care what's returned in the fmcap field.
472 	 */
473 	ddi_system_fmcap = DDI_FM_EREPORT_CAPABLE | DDI_FM_ERRCB_CAPABLE |
474 	    DDI_FM_ACCCHK_CAPABLE | DDI_FM_DMACHK_CAPABLE;
475 	fmcap = ddi_system_fmcap;
476 	ddi_fm_init(dip, &fmcap, &rootnex_state->r_err_ibc);
477 
478 	/* initialize DMA related state */
479 	e = rootnex_dma_init();
480 	if (e != DDI_SUCCESS) {
481 		kmem_free(rootnex_state, sizeof (rootnex_state_t));
482 		return (DDI_FAILURE);
483 	}
484 
485 	/* Add static root node properties */
486 	rootnex_add_props(dip);
487 
488 	/* since we can't call ddi_report_dev() */
489 	cmn_err(CE_CONT, "?root nexus = %s\n", ddi_get_name(dip));
490 
491 	/* Initialize rootnex event handle */
492 	i_ddi_rootnex_init_events(dip);
493 
494 #if defined(__amd64) && !defined(__xpv)
495 	e = iommulib_nexus_register(dip, &iommulib_nexops,
496 	    &rootnex_state->r_iommulib_handle);
497 
498 	ASSERT(e == DDI_SUCCESS);
499 #endif
500 
501 	return (DDI_SUCCESS);
502 }
503 
504 
505 /*
506  * rootnex_detach()
507  *
508  */
509 /*ARGSUSED*/
510 static int
511 rootnex_detach(dev_info_t *dip, ddi_detach_cmd_t cmd)
512 {
513 	switch (cmd) {
514 	case DDI_SUSPEND:
515 #if defined(__amd64) && !defined(__xpv)
516 		return (immu_quiesce());
517 #else
518 		return (DDI_SUCCESS);
519 #endif
520 	default:
521 		return (DDI_FAILURE);
522 	}
523 	/*NOTREACHED*/
524 
525 }
526 
527 
528 /*
529  * rootnex_dma_init()
530  *
531  */
532 /*ARGSUSED*/
533 static int
534 rootnex_dma_init()
535 {
536 	size_t bufsize;
537 
538 
539 	/*
540 	 * size of our cookie/window/copybuf state needed in dma bind that we
541 	 * pre-alloc in dma_alloc_handle
542 	 */
543 	rootnex_state->r_prealloc_cookies = rootnex_prealloc_cookies;
544 	rootnex_state->r_prealloc_size =
545 	    (rootnex_state->r_prealloc_cookies * sizeof (ddi_dma_cookie_t)) +
546 	    (rootnex_prealloc_windows * sizeof (rootnex_window_t)) +
547 	    (rootnex_prealloc_copybuf * sizeof (rootnex_pgmap_t));
548 
549 	/*
550 	 * setup DDI DMA handle kmem cache, align each handle on 64 bytes,
551 	 * allocate 16 extra bytes for struct pointer alignment
552 	 * (p->dmai_private & dma->dp_prealloc_buffer)
553 	 */
554 	bufsize = sizeof (ddi_dma_impl_t) + sizeof (rootnex_dma_t) +
555 	    rootnex_state->r_prealloc_size + 0x10;
556 	rootnex_state->r_dmahdl_cache = kmem_cache_create("rootnex_dmahdl",
557 	    bufsize, 64, NULL, NULL, NULL, NULL, NULL, 0);
558 	if (rootnex_state->r_dmahdl_cache == NULL) {
559 		return (DDI_FAILURE);
560 	}
561 
562 	/*
563 	 * allocate array to track which major numbers we have printed warnings
564 	 * for.
565 	 */
566 	rootnex_warn_list = kmem_zalloc(devcnt * sizeof (*rootnex_warn_list),
567 	    KM_SLEEP);
568 
569 	return (DDI_SUCCESS);
570 }
571 
572 
573 /*
574  * rootnex_add_props()
575  *
576  */
577 static void
578 rootnex_add_props(dev_info_t *dip)
579 {
580 	rootnex_intprop_t *rpp;
581 	int i;
582 
583 	/* Add static integer/boolean properties to the root node */
584 	rpp = rootnex_intprp;
585 	for (i = 0; i < NROOT_INTPROPS; i++) {
586 		(void) e_ddi_prop_update_int(DDI_DEV_T_NONE, dip,
587 		    rpp[i].prop_name, rpp[i].prop_value);
588 	}
589 }
590 
591 
592 
593 /*
594  * *************************
595  *  ctlops related routines
596  * *************************
597  */
598 
599 /*
600  * rootnex_ctlops()
601  *
602  */
603 /*ARGSUSED*/
604 static int
605 rootnex_ctlops(dev_info_t *dip, dev_info_t *rdip, ddi_ctl_enum_t ctlop,
606     void *arg, void *result)
607 {
608 	int n, *ptr;
609 	struct ddi_parent_private_data *pdp;
610 
611 	switch (ctlop) {
612 	case DDI_CTLOPS_DMAPMAPC:
613 		/*
614 		 * Return 'partial' to indicate that dma mapping
615 		 * has to be done in the main MMU.
616 		 */
617 		return (DDI_DMA_PARTIAL);
618 
619 	case DDI_CTLOPS_BTOP:
620 		/*
621 		 * Convert byte count input to physical page units.
622 		 * (byte counts that are not a page-size multiple
623 		 * are rounded down)
624 		 */
625 		*(ulong_t *)result = btop(*(ulong_t *)arg);
626 		return (DDI_SUCCESS);
627 
628 	case DDI_CTLOPS_PTOB:
629 		/*
630 		 * Convert size in physical pages to bytes
631 		 */
632 		*(ulong_t *)result = ptob(*(ulong_t *)arg);
633 		return (DDI_SUCCESS);
634 
635 	case DDI_CTLOPS_BTOPR:
636 		/*
637 		 * Convert byte count input to physical page units
638 		 * (byte counts that are not a page-size multiple
639 		 * are rounded up)
640 		 */
641 		*(ulong_t *)result = btopr(*(ulong_t *)arg);
642 		return (DDI_SUCCESS);
643 
644 	case DDI_CTLOPS_INITCHILD:
645 		return (impl_ddi_sunbus_initchild(arg));
646 
647 	case DDI_CTLOPS_UNINITCHILD:
648 		impl_ddi_sunbus_removechild(arg);
649 		return (DDI_SUCCESS);
650 
651 	case DDI_CTLOPS_REPORTDEV:
652 		return (rootnex_ctl_reportdev(rdip));
653 
654 	case DDI_CTLOPS_IOMIN:
655 		/*
656 		 * Nothing to do here but reflect back..
657 		 */
658 		return (DDI_SUCCESS);
659 
660 	case DDI_CTLOPS_REGSIZE:
661 	case DDI_CTLOPS_NREGS:
662 		break;
663 
664 	case DDI_CTLOPS_SIDDEV:
665 		if (ndi_dev_is_prom_node(rdip))
666 			return (DDI_SUCCESS);
667 		if (ndi_dev_is_persistent_node(rdip))
668 			return (DDI_SUCCESS);
669 		return (DDI_FAILURE);
670 
671 	case DDI_CTLOPS_POWER:
672 		return ((*pm_platform_power)((power_req_t *)arg));
673 
674 	case DDI_CTLOPS_RESERVED0: /* Was DDI_CTLOPS_NINTRS, obsolete */
675 	case DDI_CTLOPS_RESERVED1: /* Was DDI_CTLOPS_POKE_INIT, obsolete */
676 	case DDI_CTLOPS_RESERVED2: /* Was DDI_CTLOPS_POKE_FLUSH, obsolete */
677 	case DDI_CTLOPS_RESERVED3: /* Was DDI_CTLOPS_POKE_FINI, obsolete */
678 	case DDI_CTLOPS_RESERVED4: /* Was DDI_CTLOPS_INTR_HILEVEL, obsolete */
679 	case DDI_CTLOPS_RESERVED5: /* Was DDI_CTLOPS_XLATE_INTRS, obsolete */
680 		if (!rootnex_state->r_reserved_msg_printed) {
681 			rootnex_state->r_reserved_msg_printed = B_TRUE;
682 			cmn_err(CE_WARN, "Failing ddi_ctlops call(s) for "
683 			    "1 or more reserved/obsolete operations.");
684 		}
685 		return (DDI_FAILURE);
686 
687 	default:
688 		return (DDI_FAILURE);
689 	}
690 	/*
691 	 * The rest are for "hardware" properties
692 	 */
693 	if ((pdp = ddi_get_parent_data(rdip)) == NULL)
694 		return (DDI_FAILURE);
695 
696 	if (ctlop == DDI_CTLOPS_NREGS) {
697 		ptr = (int *)result;
698 		*ptr = pdp->par_nreg;
699 	} else {
700 		off_t *size = (off_t *)result;
701 
702 		ptr = (int *)arg;
703 		n = *ptr;
704 		if (n >= pdp->par_nreg) {
705 			return (DDI_FAILURE);
706 		}
707 		*size = (off_t)pdp->par_reg[n].regspec_size;
708 	}
709 	return (DDI_SUCCESS);
710 }
711 
712 
713 /*
714  * rootnex_ctl_reportdev()
715  *
716  */
717 static int
718 rootnex_ctl_reportdev(dev_info_t *dev)
719 {
720 	int i, n, len, f_len = 0;
721 	char *buf;
722 
723 	buf = kmem_alloc(REPORTDEV_BUFSIZE, KM_SLEEP);
724 	f_len += snprintf(buf, REPORTDEV_BUFSIZE,
725 	    "%s%d at root", ddi_driver_name(dev), ddi_get_instance(dev));
726 	len = strlen(buf);
727 
728 	for (i = 0; i < sparc_pd_getnreg(dev); i++) {
729 
730 		struct regspec *rp = sparc_pd_getreg(dev, i);
731 
732 		if (i == 0)
733 			f_len += snprintf(buf + len, REPORTDEV_BUFSIZE - len,
734 			    ": ");
735 		else
736 			f_len += snprintf(buf + len, REPORTDEV_BUFSIZE - len,
737 			    " and ");
738 		len = strlen(buf);
739 
740 		switch (rp->regspec_bustype) {
741 
742 		case BTEISA:
743 			f_len += snprintf(buf + len, REPORTDEV_BUFSIZE - len,
744 			    "%s 0x%x", DEVI_EISA_NEXNAME, rp->regspec_addr);
745 			break;
746 
747 		case BTISA:
748 			f_len += snprintf(buf + len, REPORTDEV_BUFSIZE - len,
749 			    "%s 0x%x", DEVI_ISA_NEXNAME, rp->regspec_addr);
750 			break;
751 
752 		default:
753 			f_len += snprintf(buf + len, REPORTDEV_BUFSIZE - len,
754 			    "space %x offset %x",
755 			    rp->regspec_bustype, rp->regspec_addr);
756 			break;
757 		}
758 		len = strlen(buf);
759 	}
760 	for (i = 0, n = sparc_pd_getnintr(dev); i < n; i++) {
761 		int pri;
762 
763 		if (i != 0) {
764 			f_len += snprintf(buf + len, REPORTDEV_BUFSIZE - len,
765 			    ",");
766 			len = strlen(buf);
767 		}
768 		pri = INT_IPL(sparc_pd_getintr(dev, i)->intrspec_pri);
769 		f_len += snprintf(buf + len, REPORTDEV_BUFSIZE - len,
770 		    " sparc ipl %d", pri);
771 		len = strlen(buf);
772 	}
773 #ifdef DEBUG
774 	if (f_len + 1 >= REPORTDEV_BUFSIZE) {
775 		cmn_err(CE_NOTE, "next message is truncated: "
776 		    "printed length 1024, real length %d", f_len);
777 	}
778 #endif /* DEBUG */
779 	cmn_err(CE_CONT, "?%s\n", buf);
780 	kmem_free(buf, REPORTDEV_BUFSIZE);
781 	return (DDI_SUCCESS);
782 }
783 
784 
785 /*
786  * ******************
787  *  map related code
788  * ******************
789  */
790 
791 /*
792  * rootnex_map()
793  *
794  */
795 static int
796 rootnex_map(dev_info_t *dip, dev_info_t *rdip, ddi_map_req_t *mp, off_t offset,
797     off_t len, caddr_t *vaddrp)
798 {
799 	struct regspec *rp, tmp_reg;
800 	ddi_map_req_t mr = *mp;		/* Get private copy of request */
801 	int error;
802 
803 	mp = &mr;
804 
805 	switch (mp->map_op)  {
806 	case DDI_MO_MAP_LOCKED:
807 	case DDI_MO_UNMAP:
808 	case DDI_MO_MAP_HANDLE:
809 		break;
810 	default:
811 #ifdef	DDI_MAP_DEBUG
812 		cmn_err(CE_WARN, "rootnex_map: unimplemented map op %d.",
813 		    mp->map_op);
814 #endif	/* DDI_MAP_DEBUG */
815 		return (DDI_ME_UNIMPLEMENTED);
816 	}
817 
818 	if (mp->map_flags & DDI_MF_USER_MAPPING)  {
819 #ifdef	DDI_MAP_DEBUG
820 		cmn_err(CE_WARN, "rootnex_map: unimplemented map type: user.");
821 #endif	/* DDI_MAP_DEBUG */
822 		return (DDI_ME_UNIMPLEMENTED);
823 	}
824 
825 	/*
826 	 * First, if given an rnumber, convert it to a regspec...
827 	 * (Presumably, this is on behalf of a child of the root node?)
828 	 */
829 
830 	if (mp->map_type == DDI_MT_RNUMBER)  {
831 
832 		int rnumber = mp->map_obj.rnumber;
833 #ifdef	DDI_MAP_DEBUG
834 		static char *out_of_range =
835 		    "rootnex_map: Out of range rnumber <%d>, device <%s>";
836 #endif	/* DDI_MAP_DEBUG */
837 
838 		rp = i_ddi_rnumber_to_regspec(rdip, rnumber);
839 		if (rp == NULL)  {
840 #ifdef	DDI_MAP_DEBUG
841 			cmn_err(CE_WARN, out_of_range, rnumber,
842 			    ddi_get_name(rdip));
843 #endif	/* DDI_MAP_DEBUG */
844 			return (DDI_ME_RNUMBER_RANGE);
845 		}
846 
847 		/*
848 		 * Convert the given ddi_map_req_t from rnumber to regspec...
849 		 */
850 
851 		mp->map_type = DDI_MT_REGSPEC;
852 		mp->map_obj.rp = rp;
853 	}
854 
855 	/*
856 	 * Adjust offset and length correspnding to called values...
857 	 * XXX: A non-zero length means override the one in the regspec
858 	 * XXX: (regardless of what's in the parent's range?)
859 	 */
860 
861 	tmp_reg = *(mp->map_obj.rp);		/* Preserve underlying data */
862 	rp = mp->map_obj.rp = &tmp_reg;		/* Use tmp_reg in request */
863 
864 #ifdef	DDI_MAP_DEBUG
865 	cmn_err(CE_CONT, "rootnex: <%s,%s> <0x%x, 0x%x, 0x%d> offset %d len %d "
866 	    "handle 0x%x\n", ddi_get_name(dip), ddi_get_name(rdip),
867 	    rp->regspec_bustype, rp->regspec_addr, rp->regspec_size, offset,
868 	    len, mp->map_handlep);
869 #endif	/* DDI_MAP_DEBUG */
870 
871 	/*
872 	 * I/O or memory mapping:
873 	 *
874 	 *	<bustype=0, addr=x, len=x>: memory
875 	 *	<bustype=1, addr=x, len=x>: i/o
876 	 *	<bustype>1, addr=0, len=x>: x86-compatibility i/o
877 	 */
878 
879 	if (rp->regspec_bustype > 1 && rp->regspec_addr != 0) {
880 		cmn_err(CE_WARN, "<%s,%s> invalid register spec"
881 		    " <0x%x, 0x%x, 0x%x>", ddi_get_name(dip),
882 		    ddi_get_name(rdip), rp->regspec_bustype,
883 		    rp->regspec_addr, rp->regspec_size);
884 		return (DDI_ME_INVAL);
885 	}
886 
887 	if (rp->regspec_bustype > 1 && rp->regspec_addr == 0) {
888 		/*
889 		 * compatibility i/o mapping
890 		 */
891 		rp->regspec_bustype += (uint_t)offset;
892 	} else {
893 		/*
894 		 * Normal memory or i/o mapping
895 		 */
896 		rp->regspec_addr += (uint_t)offset;
897 	}
898 
899 	if (len != 0)
900 		rp->regspec_size = (uint_t)len;
901 
902 #ifdef	DDI_MAP_DEBUG
903 	cmn_err(CE_CONT, "             <%s,%s> <0x%x, 0x%x, 0x%d> offset %d "
904 	    "len %d handle 0x%x\n", ddi_get_name(dip), ddi_get_name(rdip),
905 	    rp->regspec_bustype, rp->regspec_addr, rp->regspec_size,
906 	    offset, len, mp->map_handlep);
907 #endif	/* DDI_MAP_DEBUG */
908 
909 	/*
910 	 * Apply any parent ranges at this level, if applicable.
911 	 * (This is where nexus specific regspec translation takes place.
912 	 * Use of this function is implicit agreement that translation is
913 	 * provided via ddi_apply_range.)
914 	 */
915 
916 #ifdef	DDI_MAP_DEBUG
917 	ddi_map_debug("applying range of parent <%s> to child <%s>...\n",
918 	    ddi_get_name(dip), ddi_get_name(rdip));
919 #endif	/* DDI_MAP_DEBUG */
920 
921 	if ((error = i_ddi_apply_range(dip, rdip, mp->map_obj.rp)) != 0)
922 		return (error);
923 
924 	switch (mp->map_op)  {
925 	case DDI_MO_MAP_LOCKED:
926 
927 		/*
928 		 * Set up the locked down kernel mapping to the regspec...
929 		 */
930 
931 		return (rootnex_map_regspec(mp, vaddrp));
932 
933 	case DDI_MO_UNMAP:
934 
935 		/*
936 		 * Release mapping...
937 		 */
938 
939 		return (rootnex_unmap_regspec(mp, vaddrp));
940 
941 	case DDI_MO_MAP_HANDLE:
942 
943 		return (rootnex_map_handle(mp));
944 
945 	default:
946 		return (DDI_ME_UNIMPLEMENTED);
947 	}
948 }
949 
950 
951 /*
952  * rootnex_map_fault()
953  *
954  *	fault in mappings for requestors
955  */
956 /*ARGSUSED*/
957 static int
958 rootnex_map_fault(dev_info_t *dip, dev_info_t *rdip, struct hat *hat,
959     struct seg *seg, caddr_t addr, struct devpage *dp, pfn_t pfn, uint_t prot,
960     uint_t lock)
961 {
962 
963 #ifdef	DDI_MAP_DEBUG
964 	ddi_map_debug("rootnex_map_fault: address <%x> pfn <%x>", addr, pfn);
965 	ddi_map_debug(" Seg <%s>\n",
966 	    seg->s_ops == &segdev_ops ? "segdev" :
967 	    seg == &kvseg ? "segkmem" : "NONE!");
968 #endif	/* DDI_MAP_DEBUG */
969 
970 	/*
971 	 * This is all terribly broken, but it is a start
972 	 *
973 	 * XXX	Note that this test means that segdev_ops
974 	 *	must be exported from seg_dev.c.
975 	 * XXX	What about devices with their own segment drivers?
976 	 */
977 	if (seg->s_ops == &segdev_ops) {
978 		struct segdev_data *sdp = (struct segdev_data *)seg->s_data;
979 
980 		if (hat == NULL) {
981 			/*
982 			 * This is one plausible interpretation of
983 			 * a null hat i.e. use the first hat on the
984 			 * address space hat list which by convention is
985 			 * the hat of the system MMU.  At alternative
986 			 * would be to panic .. this might well be better ..
987 			 */
988 			ASSERT(AS_READ_HELD(seg->s_as, &seg->s_as->a_lock));
989 			hat = seg->s_as->a_hat;
990 			cmn_err(CE_NOTE, "rootnex_map_fault: nil hat");
991 		}
992 		hat_devload(hat, addr, MMU_PAGESIZE, pfn, prot | sdp->hat_attr,
993 		    (lock ? HAT_LOAD_LOCK : HAT_LOAD));
994 	} else if (seg == &kvseg && dp == NULL) {
995 		hat_devload(kas.a_hat, addr, MMU_PAGESIZE, pfn, prot,
996 		    HAT_LOAD_LOCK);
997 	} else
998 		return (DDI_FAILURE);
999 	return (DDI_SUCCESS);
1000 }
1001 
1002 
1003 /*
1004  * rootnex_map_regspec()
1005  *     we don't support mapping of I/O cards above 4Gb
1006  */
1007 static int
1008 rootnex_map_regspec(ddi_map_req_t *mp, caddr_t *vaddrp)
1009 {
1010 	rootnex_addr_t rbase;
1011 	void *cvaddr;
1012 	uint_t npages, pgoffset;
1013 	struct regspec *rp;
1014 	ddi_acc_hdl_t *hp;
1015 	ddi_acc_impl_t *ap;
1016 	uint_t	hat_acc_flags;
1017 	paddr_t pbase;
1018 
1019 	rp = mp->map_obj.rp;
1020 	hp = mp->map_handlep;
1021 
1022 #ifdef	DDI_MAP_DEBUG
1023 	ddi_map_debug(
1024 	    "rootnex_map_regspec: <0x%x 0x%x 0x%x> handle 0x%x\n",
1025 	    rp->regspec_bustype, rp->regspec_addr,
1026 	    rp->regspec_size, mp->map_handlep);
1027 #endif	/* DDI_MAP_DEBUG */
1028 
1029 	/*
1030 	 * I/O or memory mapping
1031 	 *
1032 	 *	<bustype=0, addr=x, len=x>: memory
1033 	 *	<bustype=1, addr=x, len=x>: i/o
1034 	 *	<bustype>1, addr=0, len=x>: x86-compatibility i/o
1035 	 */
1036 
1037 	if (rp->regspec_bustype > 1 && rp->regspec_addr != 0) {
1038 		cmn_err(CE_WARN, "rootnex: invalid register spec"
1039 		    " <0x%x, 0x%x, 0x%x>", rp->regspec_bustype,
1040 		    rp->regspec_addr, rp->regspec_size);
1041 		return (DDI_FAILURE);
1042 	}
1043 
1044 	if (rp->regspec_bustype != 0) {
1045 		/*
1046 		 * I/O space - needs a handle.
1047 		 */
1048 		if (hp == NULL) {
1049 			return (DDI_FAILURE);
1050 		}
1051 		ap = (ddi_acc_impl_t *)hp->ah_platform_private;
1052 		ap->ahi_acc_attr |= DDI_ACCATTR_IO_SPACE;
1053 		impl_acc_hdl_init(hp);
1054 
1055 		if (mp->map_flags & DDI_MF_DEVICE_MAPPING) {
1056 #ifdef  DDI_MAP_DEBUG
1057 			ddi_map_debug("rootnex_map_regspec: mmap() "
1058 			    "to I/O space is not supported.\n");
1059 #endif  /* DDI_MAP_DEBUG */
1060 			return (DDI_ME_INVAL);
1061 		} else {
1062 			/*
1063 			 * 1275-compliant vs. compatibility i/o mapping
1064 			 */
1065 			*vaddrp =
1066 			    (rp->regspec_bustype > 1 && rp->regspec_addr == 0) ?
1067 			    ((caddr_t)(uintptr_t)rp->regspec_bustype) :
1068 			    ((caddr_t)(uintptr_t)rp->regspec_addr);
1069 #ifdef __xpv
1070 			if (DOMAIN_IS_INITDOMAIN(xen_info)) {
1071 				hp->ah_pfn = xen_assign_pfn(
1072 				    mmu_btop((ulong_t)rp->regspec_addr &
1073 				    MMU_PAGEMASK));
1074 			} else {
1075 				hp->ah_pfn = mmu_btop(
1076 				    (ulong_t)rp->regspec_addr & MMU_PAGEMASK);
1077 			}
1078 #else
1079 			hp->ah_pfn = mmu_btop((ulong_t)rp->regspec_addr &
1080 			    MMU_PAGEMASK);
1081 #endif
1082 			hp->ah_pnum = mmu_btopr(rp->regspec_size +
1083 			    (ulong_t)rp->regspec_addr & MMU_PAGEOFFSET);
1084 		}
1085 
1086 #ifdef	DDI_MAP_DEBUG
1087 		ddi_map_debug(
1088 	    "rootnex_map_regspec: \"Mapping\" %d bytes I/O space at 0x%x\n",
1089 		    rp->regspec_size, *vaddrp);
1090 #endif	/* DDI_MAP_DEBUG */
1091 		return (DDI_SUCCESS);
1092 	}
1093 
1094 	/*
1095 	 * Memory space
1096 	 */
1097 
1098 	if (hp != NULL) {
1099 		/*
1100 		 * hat layer ignores
1101 		 * hp->ah_acc.devacc_attr_endian_flags.
1102 		 */
1103 		switch (hp->ah_acc.devacc_attr_dataorder) {
1104 		case DDI_STRICTORDER_ACC:
1105 			hat_acc_flags = HAT_STRICTORDER;
1106 			break;
1107 		case DDI_UNORDERED_OK_ACC:
1108 			hat_acc_flags = HAT_UNORDERED_OK;
1109 			break;
1110 		case DDI_MERGING_OK_ACC:
1111 			hat_acc_flags = HAT_MERGING_OK;
1112 			break;
1113 		case DDI_LOADCACHING_OK_ACC:
1114 			hat_acc_flags = HAT_LOADCACHING_OK;
1115 			break;
1116 		case DDI_STORECACHING_OK_ACC:
1117 			hat_acc_flags = HAT_STORECACHING_OK;
1118 			break;
1119 		}
1120 		ap = (ddi_acc_impl_t *)hp->ah_platform_private;
1121 		ap->ahi_acc_attr |= DDI_ACCATTR_CPU_VADDR;
1122 		impl_acc_hdl_init(hp);
1123 		hp->ah_hat_flags = hat_acc_flags;
1124 	} else {
1125 		hat_acc_flags = HAT_STRICTORDER;
1126 	}
1127 
1128 	rbase = (rootnex_addr_t)(rp->regspec_addr & MMU_PAGEMASK);
1129 #ifdef __xpv
1130 	/*
1131 	 * If we're dom0, we're using a real device so we need to translate
1132 	 * the MA to a PA.
1133 	 */
1134 	if (DOMAIN_IS_INITDOMAIN(xen_info)) {
1135 		pbase = pfn_to_pa(xen_assign_pfn(mmu_btop(rbase)));
1136 	} else {
1137 		pbase = rbase;
1138 	}
1139 #else
1140 	pbase = rbase;
1141 #endif
1142 	pgoffset = (ulong_t)rp->regspec_addr & MMU_PAGEOFFSET;
1143 
1144 	if (rp->regspec_size == 0) {
1145 #ifdef  DDI_MAP_DEBUG
1146 		ddi_map_debug("rootnex_map_regspec: zero regspec_size\n");
1147 #endif  /* DDI_MAP_DEBUG */
1148 		return (DDI_ME_INVAL);
1149 	}
1150 
1151 	if (mp->map_flags & DDI_MF_DEVICE_MAPPING) {
1152 		/* extra cast to make gcc happy */
1153 		*vaddrp = (caddr_t)((uintptr_t)mmu_btop(pbase));
1154 	} else {
1155 		npages = mmu_btopr(rp->regspec_size + pgoffset);
1156 
1157 #ifdef	DDI_MAP_DEBUG
1158 		ddi_map_debug("rootnex_map_regspec: Mapping %d pages "
1159 		    "physical %llx", npages, pbase);
1160 #endif	/* DDI_MAP_DEBUG */
1161 
1162 		cvaddr = device_arena_alloc(ptob(npages), VM_NOSLEEP);
1163 		if (cvaddr == NULL)
1164 			return (DDI_ME_NORESOURCES);
1165 
1166 		/*
1167 		 * Now map in the pages we've allocated...
1168 		 */
1169 		hat_devload(kas.a_hat, cvaddr, mmu_ptob(npages),
1170 		    mmu_btop(pbase), mp->map_prot | hat_acc_flags,
1171 		    HAT_LOAD_LOCK);
1172 		*vaddrp = (caddr_t)cvaddr + pgoffset;
1173 
1174 		/* save away pfn and npages for FMA */
1175 		hp = mp->map_handlep;
1176 		if (hp) {
1177 			hp->ah_pfn = mmu_btop(pbase);
1178 			hp->ah_pnum = npages;
1179 		}
1180 	}
1181 
1182 #ifdef	DDI_MAP_DEBUG
1183 	ddi_map_debug("at virtual 0x%x\n", *vaddrp);
1184 #endif	/* DDI_MAP_DEBUG */
1185 	return (DDI_SUCCESS);
1186 }
1187 
1188 
1189 /*
1190  * rootnex_unmap_regspec()
1191  *
1192  */
1193 static int
1194 rootnex_unmap_regspec(ddi_map_req_t *mp, caddr_t *vaddrp)
1195 {
1196 	caddr_t addr = (caddr_t)*vaddrp;
1197 	uint_t npages, pgoffset;
1198 	struct regspec *rp;
1199 
1200 	if (mp->map_flags & DDI_MF_DEVICE_MAPPING)
1201 		return (0);
1202 
1203 	rp = mp->map_obj.rp;
1204 
1205 	if (rp->regspec_size == 0) {
1206 #ifdef  DDI_MAP_DEBUG
1207 		ddi_map_debug("rootnex_unmap_regspec: zero regspec_size\n");
1208 #endif  /* DDI_MAP_DEBUG */
1209 		return (DDI_ME_INVAL);
1210 	}
1211 
1212 	/*
1213 	 * I/O or memory mapping:
1214 	 *
1215 	 *	<bustype=0, addr=x, len=x>: memory
1216 	 *	<bustype=1, addr=x, len=x>: i/o
1217 	 *	<bustype>1, addr=0, len=x>: x86-compatibility i/o
1218 	 */
1219 	if (rp->regspec_bustype != 0) {
1220 		/*
1221 		 * This is I/O space, which requires no particular
1222 		 * processing on unmap since it isn't mapped in the
1223 		 * first place.
1224 		 */
1225 		return (DDI_SUCCESS);
1226 	}
1227 
1228 	/*
1229 	 * Memory space
1230 	 */
1231 	pgoffset = (uintptr_t)addr & MMU_PAGEOFFSET;
1232 	npages = mmu_btopr(rp->regspec_size + pgoffset);
1233 	hat_unload(kas.a_hat, addr - pgoffset, ptob(npages), HAT_UNLOAD_UNLOCK);
1234 	device_arena_free(addr - pgoffset, ptob(npages));
1235 
1236 	/*
1237 	 * Destroy the pointer - the mapping has logically gone
1238 	 */
1239 	*vaddrp = NULL;
1240 
1241 	return (DDI_SUCCESS);
1242 }
1243 
1244 
1245 /*
1246  * rootnex_map_handle()
1247  *
1248  */
1249 static int
1250 rootnex_map_handle(ddi_map_req_t *mp)
1251 {
1252 	rootnex_addr_t rbase;
1253 	ddi_acc_hdl_t *hp;
1254 	uint_t pgoffset;
1255 	struct regspec *rp;
1256 	paddr_t pbase;
1257 
1258 	rp = mp->map_obj.rp;
1259 
1260 #ifdef	DDI_MAP_DEBUG
1261 	ddi_map_debug(
1262 	    "rootnex_map_handle: <0x%x 0x%x 0x%x> handle 0x%x\n",
1263 	    rp->regspec_bustype, rp->regspec_addr,
1264 	    rp->regspec_size, mp->map_handlep);
1265 #endif	/* DDI_MAP_DEBUG */
1266 
1267 	/*
1268 	 * I/O or memory mapping:
1269 	 *
1270 	 *	<bustype=0, addr=x, len=x>: memory
1271 	 *	<bustype=1, addr=x, len=x>: i/o
1272 	 *	<bustype>1, addr=0, len=x>: x86-compatibility i/o
1273 	 */
1274 	if (rp->regspec_bustype != 0) {
1275 		/*
1276 		 * This refers to I/O space, and we don't support "mapping"
1277 		 * I/O space to a user.
1278 		 */
1279 		return (DDI_FAILURE);
1280 	}
1281 
1282 	/*
1283 	 * Set up the hat_flags for the mapping.
1284 	 */
1285 	hp = mp->map_handlep;
1286 
1287 	switch (hp->ah_acc.devacc_attr_endian_flags) {
1288 	case DDI_NEVERSWAP_ACC:
1289 		hp->ah_hat_flags = HAT_NEVERSWAP | HAT_STRICTORDER;
1290 		break;
1291 	case DDI_STRUCTURE_LE_ACC:
1292 		hp->ah_hat_flags = HAT_STRUCTURE_LE;
1293 		break;
1294 	case DDI_STRUCTURE_BE_ACC:
1295 		return (DDI_FAILURE);
1296 	default:
1297 		return (DDI_REGS_ACC_CONFLICT);
1298 	}
1299 
1300 	switch (hp->ah_acc.devacc_attr_dataorder) {
1301 	case DDI_STRICTORDER_ACC:
1302 		break;
1303 	case DDI_UNORDERED_OK_ACC:
1304 		hp->ah_hat_flags |= HAT_UNORDERED_OK;
1305 		break;
1306 	case DDI_MERGING_OK_ACC:
1307 		hp->ah_hat_flags |= HAT_MERGING_OK;
1308 		break;
1309 	case DDI_LOADCACHING_OK_ACC:
1310 		hp->ah_hat_flags |= HAT_LOADCACHING_OK;
1311 		break;
1312 	case DDI_STORECACHING_OK_ACC:
1313 		hp->ah_hat_flags |= HAT_STORECACHING_OK;
1314 		break;
1315 	default:
1316 		return (DDI_FAILURE);
1317 	}
1318 
1319 	rbase = (rootnex_addr_t)rp->regspec_addr &
1320 	    (~(rootnex_addr_t)MMU_PAGEOFFSET);
1321 	pgoffset = (ulong_t)rp->regspec_addr & MMU_PAGEOFFSET;
1322 
1323 	if (rp->regspec_size == 0)
1324 		return (DDI_ME_INVAL);
1325 
1326 #ifdef __xpv
1327 	/*
1328 	 * If we're dom0, we're using a real device so we need to translate
1329 	 * the MA to a PA.
1330 	 */
1331 	if (DOMAIN_IS_INITDOMAIN(xen_info)) {
1332 		pbase = pfn_to_pa(xen_assign_pfn(mmu_btop(rbase))) |
1333 		    (rbase & MMU_PAGEOFFSET);
1334 	} else {
1335 		pbase = rbase;
1336 	}
1337 #else
1338 	pbase = rbase;
1339 #endif
1340 
1341 	hp->ah_pfn = mmu_btop(pbase);
1342 	hp->ah_pnum = mmu_btopr(rp->regspec_size + pgoffset);
1343 
1344 	return (DDI_SUCCESS);
1345 }
1346 
1347 
1348 
1349 /*
1350  * ************************
1351  *  interrupt related code
1352  * ************************
1353  */
1354 
1355 /*
1356  * rootnex_intr_ops()
1357  *	bus_intr_op() function for interrupt support
1358  */
1359 /* ARGSUSED */
1360 static int
1361 rootnex_intr_ops(dev_info_t *pdip, dev_info_t *rdip, ddi_intr_op_t intr_op,
1362     ddi_intr_handle_impl_t *hdlp, void *result)
1363 {
1364 	struct intrspec			*ispec;
1365 	struct ddi_parent_private_data	*pdp;
1366 
1367 	DDI_INTR_NEXDBG((CE_CONT,
1368 	    "rootnex_intr_ops: pdip = %p, rdip = %p, intr_op = %x, hdlp = %p\n",
1369 	    (void *)pdip, (void *)rdip, intr_op, (void *)hdlp));
1370 
1371 	/* Process the interrupt operation */
1372 	switch (intr_op) {
1373 	case DDI_INTROP_GETCAP:
1374 		/* First check with pcplusmp */
1375 		if (psm_intr_ops == NULL)
1376 			return (DDI_FAILURE);
1377 
1378 		if ((*psm_intr_ops)(rdip, hdlp, PSM_INTR_OP_GET_CAP, result)) {
1379 			*(int *)result = 0;
1380 			return (DDI_FAILURE);
1381 		}
1382 		break;
1383 	case DDI_INTROP_SETCAP:
1384 		if (psm_intr_ops == NULL)
1385 			return (DDI_FAILURE);
1386 
1387 		if ((*psm_intr_ops)(rdip, hdlp, PSM_INTR_OP_SET_CAP, result))
1388 			return (DDI_FAILURE);
1389 		break;
1390 	case DDI_INTROP_ALLOC:
1391 		if ((ispec = rootnex_get_ispec(rdip, hdlp->ih_inum)) == NULL)
1392 			return (DDI_FAILURE);
1393 		hdlp->ih_pri = ispec->intrspec_pri;
1394 		*(int *)result = hdlp->ih_scratch1;
1395 		break;
1396 	case DDI_INTROP_FREE:
1397 		pdp = ddi_get_parent_data(rdip);
1398 		/*
1399 		 * Special case for 'pcic' driver' only.
1400 		 * If an intrspec was created for it, clean it up here
1401 		 * See detailed comments on this in the function
1402 		 * rootnex_get_ispec().
1403 		 */
1404 		if (pdp->par_intr && strcmp(ddi_get_name(rdip), "pcic") == 0) {
1405 			kmem_free(pdp->par_intr, sizeof (struct intrspec) *
1406 			    pdp->par_nintr);
1407 			/*
1408 			 * Set it to zero; so that
1409 			 * DDI framework doesn't free it again
1410 			 */
1411 			pdp->par_intr = NULL;
1412 			pdp->par_nintr = 0;
1413 		}
1414 		break;
1415 	case DDI_INTROP_GETPRI:
1416 		if ((ispec = rootnex_get_ispec(rdip, hdlp->ih_inum)) == NULL)
1417 			return (DDI_FAILURE);
1418 		*(int *)result = ispec->intrspec_pri;
1419 		break;
1420 	case DDI_INTROP_SETPRI:
1421 		/* Validate the interrupt priority passed to us */
1422 		if (*(int *)result > LOCK_LEVEL)
1423 			return (DDI_FAILURE);
1424 
1425 		/* Ensure that PSM is all initialized and ispec is ok */
1426 		if ((psm_intr_ops == NULL) ||
1427 		    ((ispec = rootnex_get_ispec(rdip, hdlp->ih_inum)) == NULL))
1428 			return (DDI_FAILURE);
1429 
1430 		/* Change the priority */
1431 		if ((*psm_intr_ops)(rdip, hdlp, PSM_INTR_OP_SET_PRI, result) ==
1432 		    PSM_FAILURE)
1433 			return (DDI_FAILURE);
1434 
1435 		/* update the ispec with the new priority */
1436 		ispec->intrspec_pri =  *(int *)result;
1437 		break;
1438 	case DDI_INTROP_ADDISR:
1439 		if ((ispec = rootnex_get_ispec(rdip, hdlp->ih_inum)) == NULL)
1440 			return (DDI_FAILURE);
1441 		ispec->intrspec_func = hdlp->ih_cb_func;
1442 		break;
1443 	case DDI_INTROP_REMISR:
1444 		if ((ispec = rootnex_get_ispec(rdip, hdlp->ih_inum)) == NULL)
1445 			return (DDI_FAILURE);
1446 		ispec->intrspec_func = (uint_t (*)()) 0;
1447 		break;
1448 	case DDI_INTROP_ENABLE:
1449 		if ((ispec = rootnex_get_ispec(rdip, hdlp->ih_inum)) == NULL)
1450 			return (DDI_FAILURE);
1451 
1452 		/* Call psmi to translate irq with the dip */
1453 		if (psm_intr_ops == NULL)
1454 			return (DDI_FAILURE);
1455 
1456 		((ihdl_plat_t *)hdlp->ih_private)->ip_ispecp = ispec;
1457 		if ((*psm_intr_ops)(rdip, hdlp, PSM_INTR_OP_XLATE_VECTOR,
1458 		    (int *)&hdlp->ih_vector) == PSM_FAILURE)
1459 			return (DDI_FAILURE);
1460 
1461 		/* Add the interrupt handler */
1462 		if (!add_avintr((void *)hdlp, ispec->intrspec_pri,
1463 		    hdlp->ih_cb_func, DEVI(rdip)->devi_name, hdlp->ih_vector,
1464 		    hdlp->ih_cb_arg1, hdlp->ih_cb_arg2, NULL, rdip))
1465 			return (DDI_FAILURE);
1466 		break;
1467 	case DDI_INTROP_DISABLE:
1468 		if ((ispec = rootnex_get_ispec(rdip, hdlp->ih_inum)) == NULL)
1469 			return (DDI_FAILURE);
1470 
1471 		/* Call psm_ops() to translate irq with the dip */
1472 		if (psm_intr_ops == NULL)
1473 			return (DDI_FAILURE);
1474 
1475 		((ihdl_plat_t *)hdlp->ih_private)->ip_ispecp = ispec;
1476 		(void) (*psm_intr_ops)(rdip, hdlp,
1477 		    PSM_INTR_OP_XLATE_VECTOR, (int *)&hdlp->ih_vector);
1478 
1479 		/* Remove the interrupt handler */
1480 		rem_avintr((void *)hdlp, ispec->intrspec_pri,
1481 		    hdlp->ih_cb_func, hdlp->ih_vector);
1482 		break;
1483 	case DDI_INTROP_SETMASK:
1484 		if (psm_intr_ops == NULL)
1485 			return (DDI_FAILURE);
1486 
1487 		if ((*psm_intr_ops)(rdip, hdlp, PSM_INTR_OP_SET_MASK, NULL))
1488 			return (DDI_FAILURE);
1489 		break;
1490 	case DDI_INTROP_CLRMASK:
1491 		if (psm_intr_ops == NULL)
1492 			return (DDI_FAILURE);
1493 
1494 		if ((*psm_intr_ops)(rdip, hdlp, PSM_INTR_OP_CLEAR_MASK, NULL))
1495 			return (DDI_FAILURE);
1496 		break;
1497 	case DDI_INTROP_GETPENDING:
1498 		if (psm_intr_ops == NULL)
1499 			return (DDI_FAILURE);
1500 
1501 		if ((*psm_intr_ops)(rdip, hdlp, PSM_INTR_OP_GET_PENDING,
1502 		    result)) {
1503 			*(int *)result = 0;
1504 			return (DDI_FAILURE);
1505 		}
1506 		break;
1507 	case DDI_INTROP_NAVAIL:
1508 	case DDI_INTROP_NINTRS:
1509 		*(int *)result = i_ddi_get_intx_nintrs(rdip);
1510 		if (*(int *)result == 0) {
1511 			/*
1512 			 * Special case for 'pcic' driver' only. This driver
1513 			 * driver is a child of 'isa' and 'rootnex' drivers.
1514 			 *
1515 			 * See detailed comments on this in the function
1516 			 * rootnex_get_ispec().
1517 			 *
1518 			 * Children of 'pcic' send 'NINITR' request all the
1519 			 * way to rootnex driver. But, the 'pdp->par_nintr'
1520 			 * field may not initialized. So, we fake it here
1521 			 * to return 1 (a la what PCMCIA nexus does).
1522 			 */
1523 			if (strcmp(ddi_get_name(rdip), "pcic") == 0)
1524 				*(int *)result = 1;
1525 			else
1526 				return (DDI_FAILURE);
1527 		}
1528 		break;
1529 	case DDI_INTROP_SUPPORTED_TYPES:
1530 		*(int *)result = DDI_INTR_TYPE_FIXED;	/* Always ... */
1531 		break;
1532 	default:
1533 		return (DDI_FAILURE);
1534 	}
1535 
1536 	return (DDI_SUCCESS);
1537 }
1538 
1539 
1540 /*
1541  * rootnex_get_ispec()
1542  *	convert an interrupt number to an interrupt specification.
1543  *	The interrupt number determines which interrupt spec will be
1544  *	returned if more than one exists.
1545  *
1546  *	Look into the parent private data area of the 'rdip' to find out
1547  *	the interrupt specification.  First check to make sure there is
1548  *	one that matchs "inumber" and then return a pointer to it.
1549  *
1550  *	Return NULL if one could not be found.
1551  *
1552  *	NOTE: This is needed for rootnex_intr_ops()
1553  */
1554 static struct intrspec *
1555 rootnex_get_ispec(dev_info_t *rdip, int inum)
1556 {
1557 	struct ddi_parent_private_data *pdp = ddi_get_parent_data(rdip);
1558 
1559 	/*
1560 	 * Special case handling for drivers that provide their own
1561 	 * intrspec structures instead of relying on the DDI framework.
1562 	 *
1563 	 * A broken hardware driver in ON could potentially provide its
1564 	 * own intrspec structure, instead of relying on the hardware.
1565 	 * If these drivers are children of 'rootnex' then we need to
1566 	 * continue to provide backward compatibility to them here.
1567 	 *
1568 	 * Following check is a special case for 'pcic' driver which
1569 	 * was found to have broken hardwre andby provides its own intrspec.
1570 	 *
1571 	 * Verbatim comments from this driver are shown here:
1572 	 * "Don't use the ddi_add_intr since we don't have a
1573 	 * default intrspec in all cases."
1574 	 *
1575 	 * Since an 'ispec' may not be always created for it,
1576 	 * check for that and create one if so.
1577 	 *
1578 	 * NOTE: Currently 'pcic' is the only driver found to do this.
1579 	 */
1580 	if (!pdp->par_intr && strcmp(ddi_get_name(rdip), "pcic") == 0) {
1581 		pdp->par_nintr = 1;
1582 		pdp->par_intr = kmem_zalloc(sizeof (struct intrspec) *
1583 		    pdp->par_nintr, KM_SLEEP);
1584 	}
1585 
1586 	/* Validate the interrupt number */
1587 	if (inum >= pdp->par_nintr)
1588 		return (NULL);
1589 
1590 	/* Get the interrupt structure pointer and return that */
1591 	return ((struct intrspec *)&pdp->par_intr[inum]);
1592 }
1593 
1594 
1595 /*
1596  * ******************
1597  *  dma related code
1598  * ******************
1599  */
1600 
1601 /*ARGSUSED*/
1602 static int
1603 rootnex_coredma_allochdl(dev_info_t *dip, dev_info_t *rdip,
1604     ddi_dma_attr_t *attr, int (*waitfp)(caddr_t), caddr_t arg,
1605     ddi_dma_handle_t *handlep)
1606 {
1607 	uint64_t maxsegmentsize_ll;
1608 	uint_t maxsegmentsize;
1609 	ddi_dma_impl_t *hp;
1610 	rootnex_dma_t *dma;
1611 	uint64_t count_max;
1612 	uint64_t seg;
1613 	int kmflag;
1614 	int e;
1615 
1616 
1617 	/* convert our sleep flags */
1618 	if (waitfp == DDI_DMA_SLEEP) {
1619 		kmflag = KM_SLEEP;
1620 	} else {
1621 		kmflag = KM_NOSLEEP;
1622 	}
1623 
1624 	/*
1625 	 * We try to do only one memory allocation here. We'll do a little
1626 	 * pointer manipulation later. If the bind ends up taking more than
1627 	 * our prealloc's space, we'll have to allocate more memory in the
1628 	 * bind operation. Not great, but much better than before and the
1629 	 * best we can do with the current bind interfaces.
1630 	 */
1631 	hp = kmem_cache_alloc(rootnex_state->r_dmahdl_cache, kmflag);
1632 	if (hp == NULL) {
1633 		if (waitfp != DDI_DMA_DONTWAIT) {
1634 			ddi_set_callback(waitfp, arg,
1635 			    &rootnex_state->r_dvma_call_list_id);
1636 		}
1637 		return (DDI_DMA_NORESOURCES);
1638 	}
1639 
1640 	/* Do our pointer manipulation now, align the structures */
1641 	hp->dmai_private = (void *)(((uintptr_t)hp +
1642 	    (uintptr_t)sizeof (ddi_dma_impl_t) + 0x7) & ~0x7);
1643 	dma = (rootnex_dma_t *)hp->dmai_private;
1644 	dma->dp_prealloc_buffer = (uchar_t *)(((uintptr_t)dma +
1645 	    sizeof (rootnex_dma_t) + 0x7) & ~0x7);
1646 
1647 	/* setup the handle */
1648 	rootnex_clean_dmahdl(hp);
1649 	dma->dp_dip = rdip;
1650 	dma->dp_sglinfo.si_min_addr = attr->dma_attr_addr_lo;
1651 	dma->dp_sglinfo.si_max_addr = attr->dma_attr_addr_hi;
1652 	hp->dmai_minxfer = attr->dma_attr_minxfer;
1653 	hp->dmai_burstsizes = attr->dma_attr_burstsizes;
1654 	hp->dmai_rdip = rdip;
1655 	hp->dmai_attr = *attr;
1656 
1657 	/* we don't need to worry about the SPL since we do a tryenter */
1658 	mutex_init(&dma->dp_mutex, NULL, MUTEX_DRIVER, NULL);
1659 
1660 	/*
1661 	 * Figure out our maximum segment size. If the segment size is greater
1662 	 * than 4G, we will limit it to (4G - 1) since the max size of a dma
1663 	 * object (ddi_dma_obj_t.dmao_size) is 32 bits. dma_attr_seg and
1664 	 * dma_attr_count_max are size-1 type values.
1665 	 *
1666 	 * Maximum segment size is the largest physically contiguous chunk of
1667 	 * memory that we can return from a bind (i.e. the maximum size of a
1668 	 * single cookie).
1669 	 */
1670 
1671 	/* handle the rollover cases */
1672 	seg = attr->dma_attr_seg + 1;
1673 	if (seg < attr->dma_attr_seg) {
1674 		seg = attr->dma_attr_seg;
1675 	}
1676 	count_max = attr->dma_attr_count_max + 1;
1677 	if (count_max < attr->dma_attr_count_max) {
1678 		count_max = attr->dma_attr_count_max;
1679 	}
1680 
1681 	/*
1682 	 * granularity may or may not be a power of two. If it isn't, we can't
1683 	 * use a simple mask.
1684 	 */
1685 	if (attr->dma_attr_granular & (attr->dma_attr_granular - 1)) {
1686 		dma->dp_granularity_power_2 = B_FALSE;
1687 	} else {
1688 		dma->dp_granularity_power_2 = B_TRUE;
1689 	}
1690 
1691 	/*
1692 	 * maxxfer should be a whole multiple of granularity. If we're going to
1693 	 * break up a window because we're greater than maxxfer, we might as
1694 	 * well make sure it's maxxfer is a whole multiple so we don't have to
1695 	 * worry about triming the window later on for this case.
1696 	 */
1697 	if (attr->dma_attr_granular > 1) {
1698 		if (dma->dp_granularity_power_2) {
1699 			dma->dp_maxxfer = attr->dma_attr_maxxfer -
1700 			    (attr->dma_attr_maxxfer &
1701 			    (attr->dma_attr_granular - 1));
1702 		} else {
1703 			dma->dp_maxxfer = attr->dma_attr_maxxfer -
1704 			    (attr->dma_attr_maxxfer % attr->dma_attr_granular);
1705 		}
1706 	} else {
1707 		dma->dp_maxxfer = attr->dma_attr_maxxfer;
1708 	}
1709 
1710 	maxsegmentsize_ll = MIN(seg, dma->dp_maxxfer);
1711 	maxsegmentsize_ll = MIN(maxsegmentsize_ll, count_max);
1712 	if (maxsegmentsize_ll == 0 || (maxsegmentsize_ll > 0xFFFFFFFF)) {
1713 		maxsegmentsize = 0xFFFFFFFF;
1714 	} else {
1715 		maxsegmentsize = maxsegmentsize_ll;
1716 	}
1717 	dma->dp_sglinfo.si_max_cookie_size = maxsegmentsize;
1718 	dma->dp_sglinfo.si_segmask = attr->dma_attr_seg;
1719 	dma->dp_sglinfo.si_flags = attr->dma_attr_flags;
1720 
1721 	/* check the ddi_dma_attr arg to make sure it makes a little sense */
1722 	if (rootnex_alloc_check_parms) {
1723 		e = rootnex_valid_alloc_parms(attr, maxsegmentsize);
1724 		if (e != DDI_SUCCESS) {
1725 			ROOTNEX_PROF_INC(&rootnex_cnt[ROOTNEX_CNT_ALLOC_FAIL]);
1726 			(void) rootnex_dma_freehdl(dip, rdip,
1727 			    (ddi_dma_handle_t)hp);
1728 			return (e);
1729 		}
1730 	}
1731 
1732 	*handlep = (ddi_dma_handle_t)hp;
1733 
1734 	ROOTNEX_DPROF_INC(&rootnex_cnt[ROOTNEX_CNT_ACTIVE_HDLS]);
1735 	ROOTNEX_DPROBE1(rootnex__alloc__handle, uint64_t,
1736 	    rootnex_cnt[ROOTNEX_CNT_ACTIVE_HDLS]);
1737 
1738 	return (DDI_SUCCESS);
1739 }
1740 
1741 
1742 /*
1743  * rootnex_dma_allochdl()
1744  *    called from ddi_dma_alloc_handle().
1745  */
1746 static int
1747 rootnex_dma_allochdl(dev_info_t *dip, dev_info_t *rdip, ddi_dma_attr_t *attr,
1748     int (*waitfp)(caddr_t), caddr_t arg, ddi_dma_handle_t *handlep)
1749 {
1750 #if defined(__amd64) && !defined(__xpv)
1751 	uint_t error = ENOTSUP;
1752 	int retval;
1753 
1754 	retval = iommulib_nex_open(rdip, &error);
1755 
1756 	if (retval != DDI_SUCCESS && error == ENOTSUP) {
1757 		/* No IOMMU */
1758 		return (rootnex_coredma_allochdl(dip, rdip, attr, waitfp, arg,
1759 		    handlep));
1760 	} else if (retval != DDI_SUCCESS) {
1761 		return (DDI_FAILURE);
1762 	}
1763 
1764 	ASSERT(IOMMU_USED(rdip));
1765 
1766 	/* has an IOMMU */
1767 	return (iommulib_nexdma_allochdl(dip, rdip, attr,
1768 	    waitfp, arg, handlep));
1769 #else
1770 	return (rootnex_coredma_allochdl(dip, rdip, attr, waitfp, arg,
1771 	    handlep));
1772 #endif
1773 }
1774 
1775 /*ARGSUSED*/
1776 static int
1777 rootnex_coredma_freehdl(dev_info_t *dip, dev_info_t *rdip,
1778     ddi_dma_handle_t handle)
1779 {
1780 	ddi_dma_impl_t *hp;
1781 	rootnex_dma_t *dma;
1782 
1783 
1784 	hp = (ddi_dma_impl_t *)handle;
1785 	dma = (rootnex_dma_t *)hp->dmai_private;
1786 
1787 	/* unbind should have been called first */
1788 	ASSERT(!dma->dp_inuse);
1789 
1790 	mutex_destroy(&dma->dp_mutex);
1791 	kmem_cache_free(rootnex_state->r_dmahdl_cache, hp);
1792 
1793 	ROOTNEX_DPROF_DEC(&rootnex_cnt[ROOTNEX_CNT_ACTIVE_HDLS]);
1794 	ROOTNEX_DPROBE1(rootnex__free__handle, uint64_t,
1795 	    rootnex_cnt[ROOTNEX_CNT_ACTIVE_HDLS]);
1796 
1797 	if (rootnex_state->r_dvma_call_list_id)
1798 		ddi_run_callback(&rootnex_state->r_dvma_call_list_id);
1799 
1800 	return (DDI_SUCCESS);
1801 }
1802 
1803 /*
1804  * rootnex_dma_freehdl()
1805  *    called from ddi_dma_free_handle().
1806  */
1807 static int
1808 rootnex_dma_freehdl(dev_info_t *dip, dev_info_t *rdip, ddi_dma_handle_t handle)
1809 {
1810 #if defined(__amd64) && !defined(__xpv)
1811 	if (IOMMU_USED(rdip)) {
1812 		return (iommulib_nexdma_freehdl(dip, rdip, handle));
1813 	}
1814 #endif
1815 	return (rootnex_coredma_freehdl(dip, rdip, handle));
1816 }
1817 
1818 /*ARGSUSED*/
1819 static int
1820 rootnex_coredma_bindhdl(dev_info_t *dip, dev_info_t *rdip,
1821     ddi_dma_handle_t handle, struct ddi_dma_req *dmareq,
1822     ddi_dma_cookie_t *cookiep, uint_t *ccountp)
1823 {
1824 	rootnex_sglinfo_t *sinfo;
1825 	ddi_dma_attr_t *attr;
1826 	ddi_dma_impl_t *hp;
1827 	rootnex_dma_t *dma;
1828 	int kmflag;
1829 	int e;
1830 
1831 	hp = (ddi_dma_impl_t *)handle;
1832 	dma = (rootnex_dma_t *)hp->dmai_private;
1833 	sinfo = &dma->dp_sglinfo;
1834 	attr = &hp->dmai_attr;
1835 
1836 	if (dmareq->dmar_fp == DDI_DMA_SLEEP) {
1837 		dma->dp_sleep_flags = KM_SLEEP;
1838 	} else {
1839 		dma->dp_sleep_flags = KM_NOSLEEP;
1840 	}
1841 
1842 	hp->dmai_rflags = dmareq->dmar_flags & DMP_DDIFLAGS;
1843 
1844 	/*
1845 	 * This is useful for debugging a driver. Not as useful in a production
1846 	 * system. The only time this will fail is if you have a driver bug.
1847 	 */
1848 	if (rootnex_bind_check_inuse) {
1849 		/*
1850 		 * No one else should ever have this lock unless someone else
1851 		 * is trying to use this handle. So contention on the lock
1852 		 * is the same as inuse being set.
1853 		 */
1854 		e = mutex_tryenter(&dma->dp_mutex);
1855 		if (e == 0) {
1856 			ROOTNEX_PROF_INC(&rootnex_cnt[ROOTNEX_CNT_BIND_FAIL]);
1857 			return (DDI_DMA_INUSE);
1858 		}
1859 		if (dma->dp_inuse) {
1860 			mutex_exit(&dma->dp_mutex);
1861 			ROOTNEX_PROF_INC(&rootnex_cnt[ROOTNEX_CNT_BIND_FAIL]);
1862 			return (DDI_DMA_INUSE);
1863 		}
1864 		dma->dp_inuse = B_TRUE;
1865 		mutex_exit(&dma->dp_mutex);
1866 	}
1867 
1868 	/* check the ddi_dma_attr arg to make sure it makes a little sense */
1869 	if (rootnex_bind_check_parms) {
1870 		e = rootnex_valid_bind_parms(dmareq, attr);
1871 		if (e != DDI_SUCCESS) {
1872 			ROOTNEX_PROF_INC(&rootnex_cnt[ROOTNEX_CNT_BIND_FAIL]);
1873 			rootnex_clean_dmahdl(hp);
1874 			return (e);
1875 		}
1876 	}
1877 
1878 	/* save away the original bind info */
1879 	dma->dp_dma = dmareq->dmar_object;
1880 
1881 #if defined(__amd64) && !defined(__xpv)
1882 	e = immu_map_sgl(hp, dmareq, rootnex_prealloc_cookies, rdip);
1883 	switch (e) {
1884 	case DDI_DMA_MAPPED:
1885 		goto out;
1886 	case DDI_DMA_USE_PHYSICAL:
1887 		break;
1888 	case DDI_DMA_PARTIAL:
1889 		ddi_err(DER_PANIC, rdip, "Partial DVMA map");
1890 		e = DDI_DMA_NORESOURCES;
1891 		/*FALLTHROUGH*/
1892 	default:
1893 		ddi_err(DER_MODE, rdip, "DVMA map failed");
1894 		ROOTNEX_PROF_INC(&rootnex_cnt[ROOTNEX_CNT_BIND_FAIL]);
1895 		rootnex_clean_dmahdl(hp);
1896 		return (e);
1897 	}
1898 #endif
1899 
1900 	/*
1901 	 * Figure out a rough estimate of what maximum number of pages this
1902 	 * buffer could use (a high estimate of course).
1903 	 */
1904 	sinfo->si_max_pages = mmu_btopr(dma->dp_dma.dmao_size) + 1;
1905 
1906 	/*
1907 	 * We'll use the pre-allocated cookies for any bind that will *always*
1908 	 * fit (more important to be consistent, we don't want to create
1909 	 * additional degenerate cases).
1910 	 */
1911 	if (sinfo->si_max_pages <= rootnex_state->r_prealloc_cookies) {
1912 		dma->dp_cookies = (ddi_dma_cookie_t *)dma->dp_prealloc_buffer;
1913 		dma->dp_need_to_free_cookie = B_FALSE;
1914 		DTRACE_PROBE2(rootnex__bind__prealloc, dev_info_t *, rdip,
1915 		    uint_t, sinfo->si_max_pages);
1916 
1917 	/*
1918 	 * For anything larger than that, we'll go ahead and allocate the
1919 	 * maximum number of pages we expect to see. Hopefuly, we won't be
1920 	 * seeing this path in the fast path for high performance devices very
1921 	 * frequently.
1922 	 *
1923 	 * a ddi bind interface that allowed the driver to provide storage to
1924 	 * the bind interface would speed this case up.
1925 	 */
1926 	} else {
1927 		/* convert the sleep flags */
1928 		if (dmareq->dmar_fp == DDI_DMA_SLEEP) {
1929 			kmflag =  KM_SLEEP;
1930 		} else {
1931 			kmflag =  KM_NOSLEEP;
1932 		}
1933 
1934 		/*
1935 		 * Save away how much memory we allocated. If we're doing a
1936 		 * nosleep, the alloc could fail...
1937 		 */
1938 		dma->dp_cookie_size = sinfo->si_max_pages *
1939 		    sizeof (ddi_dma_cookie_t);
1940 		dma->dp_cookies = kmem_alloc(dma->dp_cookie_size, kmflag);
1941 		if (dma->dp_cookies == NULL) {
1942 			ROOTNEX_PROF_INC(&rootnex_cnt[ROOTNEX_CNT_BIND_FAIL]);
1943 			rootnex_clean_dmahdl(hp);
1944 			return (DDI_DMA_NORESOURCES);
1945 		}
1946 		dma->dp_need_to_free_cookie = B_TRUE;
1947 		DTRACE_PROBE2(rootnex__bind__alloc, dev_info_t *, rdip, uint_t,
1948 		    sinfo->si_max_pages);
1949 	}
1950 	hp->dmai_cookie = dma->dp_cookies;
1951 
1952 	/*
1953 	 * Get the real sgl. rootnex_get_sgl will fill in cookie array while
1954 	 * looking at the constraints in the dma structure. It will then put
1955 	 * some additional state about the sgl in the dma struct (i.e. is
1956 	 * the sgl clean, or do we need to do some munging; how many pages
1957 	 * need to be copied, etc.)
1958 	 */
1959 	rootnex_get_sgl(&dmareq->dmar_object, dma->dp_cookies,
1960 	    &dma->dp_sglinfo);
1961 
1962 out:
1963 	ASSERT(sinfo->si_sgl_size <= sinfo->si_max_pages);
1964 	/* if we don't need a copy buffer, we don't need to sync */
1965 	if (sinfo->si_copybuf_req == 0) {
1966 		hp->dmai_rflags |= DMP_NOSYNC;
1967 	}
1968 
1969 	/*
1970 	 * if we don't need the copybuf and we don't need to do a partial,  we
1971 	 * hit the fast path. All the high performance devices should be trying
1972 	 * to hit this path. To hit this path, a device should be able to reach
1973 	 * all of memory, shouldn't try to bind more than it can transfer, and
1974 	 * the buffer shouldn't require more cookies than the driver/device can
1975 	 * handle [sgllen]).
1976 	 */
1977 	if ((sinfo->si_copybuf_req == 0) &&
1978 	    (sinfo->si_sgl_size <= attr->dma_attr_sgllen) &&
1979 	    (dma->dp_dma.dmao_size < dma->dp_maxxfer)) {
1980 		/*
1981 		 * If the driver supports FMA, insert the handle in the FMA DMA
1982 		 * handle cache.
1983 		 */
1984 		if (attr->dma_attr_flags & DDI_DMA_FLAGERR) {
1985 			hp->dmai_error.err_cf = rootnex_dma_check;
1986 			(void) ndi_fmc_insert(rdip, DMA_HANDLE, hp, NULL);
1987 		}
1988 
1989 		/*
1990 		 * copy out the first cookie and ccountp, set the cookie
1991 		 * pointer to the second cookie. The first cookie is passed
1992 		 * back on the stack. Additional cookies are accessed via
1993 		 * ddi_dma_nextcookie()
1994 		 */
1995 		*cookiep = dma->dp_cookies[0];
1996 		*ccountp = sinfo->si_sgl_size;
1997 		hp->dmai_cookie++;
1998 		hp->dmai_rflags &= ~DDI_DMA_PARTIAL;
1999 		ROOTNEX_PROF_INC(&rootnex_cnt[ROOTNEX_CNT_ACTIVE_BINDS]);
2000 		DTRACE_PROBE3(rootnex__bind__fast, dev_info_t *, rdip,
2001 		    uint64_t, rootnex_cnt[ROOTNEX_CNT_ACTIVE_BINDS],
2002 		    uint_t, dma->dp_dma.dmao_size);
2003 
2004 
2005 		return (DDI_DMA_MAPPED);
2006 	}
2007 
2008 	/*
2009 	 * go to the slow path, we may need to alloc more memory, create
2010 	 * multiple windows, and munge up a sgl to make the device happy.
2011 	 */
2012 	e = rootnex_bind_slowpath(hp, dmareq, dma, attr, kmflag);
2013 	if ((e != DDI_DMA_MAPPED) && (e != DDI_DMA_PARTIAL_MAP)) {
2014 		if (dma->dp_need_to_free_cookie) {
2015 			kmem_free(dma->dp_cookies, dma->dp_cookie_size);
2016 		}
2017 		ROOTNEX_PROF_INC(&rootnex_cnt[ROOTNEX_CNT_BIND_FAIL]);
2018 		rootnex_clean_dmahdl(hp); /* must be after free cookie */
2019 		return (e);
2020 	}
2021 
2022 	/*
2023 	 * If the driver supports FMA, insert the handle in the FMA DMA handle
2024 	 * cache.
2025 	 */
2026 	if (attr->dma_attr_flags & DDI_DMA_FLAGERR) {
2027 		hp->dmai_error.err_cf = rootnex_dma_check;
2028 		(void) ndi_fmc_insert(rdip, DMA_HANDLE, hp, NULL);
2029 	}
2030 
2031 	/* if the first window uses the copy buffer, sync it for the device */
2032 	if ((dma->dp_window[dma->dp_current_win].wd_dosync) &&
2033 	    (hp->dmai_rflags & DDI_DMA_WRITE)) {
2034 		(void) rootnex_coredma_sync(dip, rdip, handle, 0, 0,
2035 		    DDI_DMA_SYNC_FORDEV);
2036 	}
2037 
2038 	/*
2039 	 * copy out the first cookie and ccountp, set the cookie pointer to the
2040 	 * second cookie. Make sure the partial flag is set/cleared correctly.
2041 	 * If we have a partial map (i.e. multiple windows), the number of
2042 	 * cookies we return is the number of cookies in the first window.
2043 	 */
2044 	if (e == DDI_DMA_MAPPED) {
2045 		hp->dmai_rflags &= ~DDI_DMA_PARTIAL;
2046 		*ccountp = sinfo->si_sgl_size;
2047 		hp->dmai_nwin = 1;
2048 	} else {
2049 		hp->dmai_rflags |= DDI_DMA_PARTIAL;
2050 		*ccountp = dma->dp_window[dma->dp_current_win].wd_cookie_cnt;
2051 		ASSERT(hp->dmai_nwin <= dma->dp_max_win);
2052 	}
2053 	*cookiep = dma->dp_cookies[0];
2054 	hp->dmai_cookie++;
2055 
2056 	ROOTNEX_DPROF_INC(&rootnex_cnt[ROOTNEX_CNT_ACTIVE_BINDS]);
2057 	ROOTNEX_DPROBE3(rootnex__bind__slow, dev_info_t *, rdip, uint64_t,
2058 	    rootnex_cnt[ROOTNEX_CNT_ACTIVE_BINDS], uint_t,
2059 	    dma->dp_dma.dmao_size);
2060 	return (e);
2061 }
2062 
2063 /*
2064  * rootnex_dma_bindhdl()
2065  *    called from ddi_dma_addr_bind_handle() and ddi_dma_buf_bind_handle().
2066  */
2067 static int
2068 rootnex_dma_bindhdl(dev_info_t *dip, dev_info_t *rdip,
2069     ddi_dma_handle_t handle, struct ddi_dma_req *dmareq,
2070     ddi_dma_cookie_t *cookiep, uint_t *ccountp)
2071 {
2072 #if defined(__amd64) && !defined(__xpv)
2073 	if (IOMMU_USED(rdip)) {
2074 		return (iommulib_nexdma_bindhdl(dip, rdip, handle, dmareq,
2075 		    cookiep, ccountp));
2076 	}
2077 #endif
2078 	return (rootnex_coredma_bindhdl(dip, rdip, handle, dmareq,
2079 	    cookiep, ccountp));
2080 }
2081 
2082 
2083 
2084 /*ARGSUSED*/
2085 static int
2086 rootnex_coredma_unbindhdl(dev_info_t *dip, dev_info_t *rdip,
2087     ddi_dma_handle_t handle)
2088 {
2089 	ddi_dma_impl_t *hp;
2090 	rootnex_dma_t *dma;
2091 	int e;
2092 
2093 	hp = (ddi_dma_impl_t *)handle;
2094 	dma = (rootnex_dma_t *)hp->dmai_private;
2095 
2096 	/* make sure the buffer wasn't free'd before calling unbind */
2097 	if (rootnex_unbind_verify_buffer) {
2098 		e = rootnex_verify_buffer(dma);
2099 		if (e != DDI_SUCCESS) {
2100 			ASSERT(0);
2101 			return (DDI_FAILURE);
2102 		}
2103 	}
2104 
2105 	/* sync the current window before unbinding the buffer */
2106 	if (dma->dp_window && dma->dp_window[dma->dp_current_win].wd_dosync &&
2107 	    (hp->dmai_rflags & DDI_DMA_READ)) {
2108 		(void) rootnex_coredma_sync(dip, rdip, handle, 0, 0,
2109 		    DDI_DMA_SYNC_FORCPU);
2110 	}
2111 
2112 	/*
2113 	 * If the driver supports FMA, remove the handle in the FMA DMA handle
2114 	 * cache.
2115 	 */
2116 	if (hp->dmai_attr.dma_attr_flags & DDI_DMA_FLAGERR) {
2117 		if ((DEVI(rdip)->devi_fmhdl != NULL) &&
2118 		    (DDI_FM_DMA_ERR_CAP(DEVI(rdip)->devi_fmhdl->fh_cap))) {
2119 			(void) ndi_fmc_remove(rdip, DMA_HANDLE, hp);
2120 		}
2121 	}
2122 
2123 	/*
2124 	 * cleanup and copy buffer or window state. if we didn't use the copy
2125 	 * buffer or windows, there won't be much to do :-)
2126 	 */
2127 	rootnex_teardown_copybuf(dma);
2128 	rootnex_teardown_windows(dma);
2129 
2130 #if defined(__amd64) && !defined(__xpv)
2131 	/*
2132 	 * Clean up the page tables and free the dvma
2133 	 */
2134 	e = immu_unmap_sgl(hp, rdip);
2135 	if (e != DDI_DMA_USE_PHYSICAL && e != DDI_SUCCESS) {
2136 		return (e);
2137 	}
2138 #endif
2139 
2140 	/*
2141 	 * If we had to allocate space to for the worse case sgl (it didn't
2142 	 * fit into our pre-allocate buffer), free that up now
2143 	 */
2144 	if (dma->dp_need_to_free_cookie) {
2145 		kmem_free(dma->dp_cookies, dma->dp_cookie_size);
2146 	}
2147 
2148 	/*
2149 	 * clean up the handle so it's ready for the next bind (i.e. if the
2150 	 * handle is reused).
2151 	 */
2152 	rootnex_clean_dmahdl(hp);
2153 
2154 	if (rootnex_state->r_dvma_call_list_id)
2155 		ddi_run_callback(&rootnex_state->r_dvma_call_list_id);
2156 
2157 	ROOTNEX_DPROF_DEC(&rootnex_cnt[ROOTNEX_CNT_ACTIVE_BINDS]);
2158 	ROOTNEX_DPROBE1(rootnex__unbind, uint64_t,
2159 	    rootnex_cnt[ROOTNEX_CNT_ACTIVE_BINDS]);
2160 
2161 	return (DDI_SUCCESS);
2162 }
2163 
2164 /*
2165  * rootnex_dma_unbindhdl()
2166  *    called from ddi_dma_unbind_handle()
2167  */
2168 /*ARGSUSED*/
2169 static int
2170 rootnex_dma_unbindhdl(dev_info_t *dip, dev_info_t *rdip,
2171     ddi_dma_handle_t handle)
2172 {
2173 #if defined(__amd64) && !defined(__xpv)
2174 	if (IOMMU_USED(rdip)) {
2175 		return (iommulib_nexdma_unbindhdl(dip, rdip, handle));
2176 	}
2177 #endif
2178 	return (rootnex_coredma_unbindhdl(dip, rdip, handle));
2179 }
2180 
2181 #if defined(__amd64) && !defined(__xpv)
2182 
2183 static int
2184 rootnex_coredma_get_sleep_flags(ddi_dma_handle_t handle)
2185 {
2186 	ddi_dma_impl_t *hp = (ddi_dma_impl_t *)handle;
2187 	rootnex_dma_t *dma = (rootnex_dma_t *)hp->dmai_private;
2188 
2189 	if (dma->dp_sleep_flags != KM_SLEEP &&
2190 	    dma->dp_sleep_flags != KM_NOSLEEP)
2191 		cmn_err(CE_PANIC, "kmem sleep flags not set in DMA handle");
2192 	return (dma->dp_sleep_flags);
2193 }
2194 /*ARGSUSED*/
2195 static void
2196 rootnex_coredma_reset_cookies(dev_info_t *dip, ddi_dma_handle_t handle)
2197 {
2198 	ddi_dma_impl_t *hp = (ddi_dma_impl_t *)handle;
2199 	rootnex_dma_t *dma = (rootnex_dma_t *)hp->dmai_private;
2200 	rootnex_window_t *window;
2201 
2202 	if (dma->dp_window) {
2203 		window = &dma->dp_window[dma->dp_current_win];
2204 		hp->dmai_cookie = window->wd_first_cookie;
2205 	} else {
2206 		hp->dmai_cookie = dma->dp_cookies;
2207 	}
2208 	hp->dmai_cookie++;
2209 }
2210 
2211 /*ARGSUSED*/
2212 static int
2213 rootnex_coredma_get_cookies(dev_info_t *dip, ddi_dma_handle_t handle,
2214     ddi_dma_cookie_t **cookiepp, uint_t *ccountp)
2215 {
2216 	int i;
2217 	int km_flags;
2218 	ddi_dma_impl_t *hp = (ddi_dma_impl_t *)handle;
2219 	rootnex_dma_t *dma = (rootnex_dma_t *)hp->dmai_private;
2220 	rootnex_window_t *window;
2221 	ddi_dma_cookie_t *cp;
2222 	ddi_dma_cookie_t *cookie;
2223 
2224 	ASSERT(*cookiepp == NULL);
2225 	ASSERT(*ccountp == 0);
2226 
2227 	if (dma->dp_window) {
2228 		window = &dma->dp_window[dma->dp_current_win];
2229 		cp = window->wd_first_cookie;
2230 		*ccountp = window->wd_cookie_cnt;
2231 	} else {
2232 		cp = dma->dp_cookies;
2233 		*ccountp = dma->dp_sglinfo.si_sgl_size;
2234 	}
2235 
2236 	km_flags = rootnex_coredma_get_sleep_flags(handle);
2237 	cookie = kmem_zalloc(sizeof (ddi_dma_cookie_t) * (*ccountp), km_flags);
2238 	if (cookie == NULL) {
2239 		return (DDI_DMA_NORESOURCES);
2240 	}
2241 
2242 	for (i = 0; i < *ccountp; i++) {
2243 		cookie[i].dmac_notused = cp[i].dmac_notused;
2244 		cookie[i].dmac_type = cp[i].dmac_type;
2245 		cookie[i].dmac_address = cp[i].dmac_address;
2246 		cookie[i].dmac_size = cp[i].dmac_size;
2247 	}
2248 
2249 	*cookiepp = cookie;
2250 
2251 	return (DDI_SUCCESS);
2252 }
2253 
2254 /*ARGSUSED*/
2255 static int
2256 rootnex_coredma_set_cookies(dev_info_t *dip, ddi_dma_handle_t handle,
2257     ddi_dma_cookie_t *cookiep, uint_t ccount)
2258 {
2259 	ddi_dma_impl_t *hp = (ddi_dma_impl_t *)handle;
2260 	rootnex_dma_t *dma = (rootnex_dma_t *)hp->dmai_private;
2261 	rootnex_window_t *window;
2262 	ddi_dma_cookie_t *cur_cookiep;
2263 
2264 	ASSERT(cookiep);
2265 	ASSERT(ccount != 0);
2266 	ASSERT(dma->dp_need_to_switch_cookies == B_FALSE);
2267 
2268 	if (dma->dp_window) {
2269 		window = &dma->dp_window[dma->dp_current_win];
2270 		dma->dp_saved_cookies = window->wd_first_cookie;
2271 		window->wd_first_cookie = cookiep;
2272 		ASSERT(ccount == window->wd_cookie_cnt);
2273 		cur_cookiep = (hp->dmai_cookie - dma->dp_saved_cookies)
2274 		    + window->wd_first_cookie;
2275 	} else {
2276 		dma->dp_saved_cookies = dma->dp_cookies;
2277 		dma->dp_cookies = cookiep;
2278 		ASSERT(ccount == dma->dp_sglinfo.si_sgl_size);
2279 		cur_cookiep = (hp->dmai_cookie - dma->dp_saved_cookies)
2280 		    + dma->dp_cookies;
2281 	}
2282 
2283 	dma->dp_need_to_switch_cookies = B_TRUE;
2284 	hp->dmai_cookie = cur_cookiep;
2285 
2286 	return (DDI_SUCCESS);
2287 }
2288 
2289 /*ARGSUSED*/
2290 static int
2291 rootnex_coredma_clear_cookies(dev_info_t *dip, ddi_dma_handle_t handle)
2292 {
2293 	ddi_dma_impl_t *hp = (ddi_dma_impl_t *)handle;
2294 	rootnex_dma_t *dma = (rootnex_dma_t *)hp->dmai_private;
2295 	rootnex_window_t *window;
2296 	ddi_dma_cookie_t *cur_cookiep;
2297 	ddi_dma_cookie_t *cookie_array;
2298 	uint_t ccount;
2299 
2300 	/* check if cookies have not been switched */
2301 	if (dma->dp_need_to_switch_cookies == B_FALSE)
2302 		return (DDI_SUCCESS);
2303 
2304 	ASSERT(dma->dp_saved_cookies);
2305 
2306 	if (dma->dp_window) {
2307 		window = &dma->dp_window[dma->dp_current_win];
2308 		cookie_array = window->wd_first_cookie;
2309 		window->wd_first_cookie = dma->dp_saved_cookies;
2310 		dma->dp_saved_cookies = NULL;
2311 		ccount = window->wd_cookie_cnt;
2312 		cur_cookiep = (hp->dmai_cookie - cookie_array)
2313 		    + window->wd_first_cookie;
2314 	} else {
2315 		cookie_array = dma->dp_cookies;
2316 		dma->dp_cookies = dma->dp_saved_cookies;
2317 		dma->dp_saved_cookies = NULL;
2318 		ccount = dma->dp_sglinfo.si_sgl_size;
2319 		cur_cookiep = (hp->dmai_cookie - cookie_array)
2320 		    + dma->dp_cookies;
2321 	}
2322 
2323 	kmem_free(cookie_array, sizeof (ddi_dma_cookie_t) * ccount);
2324 
2325 	hp->dmai_cookie = cur_cookiep;
2326 
2327 	dma->dp_need_to_switch_cookies = B_FALSE;
2328 
2329 	return (DDI_SUCCESS);
2330 }
2331 
2332 #endif
2333 
2334 /*
2335  * rootnex_verify_buffer()
2336  *   verify buffer wasn't free'd
2337  */
2338 static int
2339 rootnex_verify_buffer(rootnex_dma_t *dma)
2340 {
2341 	page_t **pplist;
2342 	caddr_t vaddr;
2343 	uint_t pcnt;
2344 	uint_t poff;
2345 	page_t *pp;
2346 	char b;
2347 	int i;
2348 
2349 	/* Figure out how many pages this buffer occupies */
2350 	if (dma->dp_dma.dmao_type == DMA_OTYP_PAGES) {
2351 		poff = dma->dp_dma.dmao_obj.pp_obj.pp_offset & MMU_PAGEOFFSET;
2352 	} else {
2353 		vaddr = dma->dp_dma.dmao_obj.virt_obj.v_addr;
2354 		poff = (uintptr_t)vaddr & MMU_PAGEOFFSET;
2355 	}
2356 	pcnt = mmu_btopr(dma->dp_dma.dmao_size + poff);
2357 
2358 	switch (dma->dp_dma.dmao_type) {
2359 	case DMA_OTYP_PAGES:
2360 		/*
2361 		 * for a linked list of pp's walk through them to make sure
2362 		 * they're locked and not free.
2363 		 */
2364 		pp = dma->dp_dma.dmao_obj.pp_obj.pp_pp;
2365 		for (i = 0; i < pcnt; i++) {
2366 			if (PP_ISFREE(pp) || !PAGE_LOCKED(pp)) {
2367 				return (DDI_FAILURE);
2368 			}
2369 			pp = pp->p_next;
2370 		}
2371 		break;
2372 
2373 	case DMA_OTYP_VADDR:
2374 	case DMA_OTYP_BUFVADDR:
2375 		pplist = dma->dp_dma.dmao_obj.virt_obj.v_priv;
2376 		/*
2377 		 * for an array of pp's walk through them to make sure they're
2378 		 * not free. It's possible that they may not be locked.
2379 		 */
2380 		if (pplist) {
2381 			for (i = 0; i < pcnt; i++) {
2382 				if (PP_ISFREE(pplist[i])) {
2383 					return (DDI_FAILURE);
2384 				}
2385 			}
2386 
2387 		/* For a virtual address, try to peek at each page */
2388 		} else {
2389 			if (dma->dp_sglinfo.si_asp == &kas) {
2390 				for (i = 0; i < pcnt; i++) {
2391 					if (ddi_peek8(NULL, vaddr, &b) ==
2392 					    DDI_FAILURE)
2393 						return (DDI_FAILURE);
2394 					vaddr += MMU_PAGESIZE;
2395 				}
2396 			}
2397 		}
2398 		break;
2399 
2400 	default:
2401 		ASSERT(0);
2402 		break;
2403 	}
2404 
2405 	return (DDI_SUCCESS);
2406 }
2407 
2408 
2409 /*
2410  * rootnex_clean_dmahdl()
2411  *    Clean the dma handle. This should be called on a handle alloc and an
2412  *    unbind handle. Set the handle state to the default settings.
2413  */
2414 static void
2415 rootnex_clean_dmahdl(ddi_dma_impl_t *hp)
2416 {
2417 	rootnex_dma_t *dma;
2418 
2419 
2420 	dma = (rootnex_dma_t *)hp->dmai_private;
2421 
2422 	hp->dmai_nwin = 0;
2423 	dma->dp_current_cookie = 0;
2424 	dma->dp_copybuf_size = 0;
2425 	dma->dp_window = NULL;
2426 	dma->dp_cbaddr = NULL;
2427 	dma->dp_inuse = B_FALSE;
2428 	dma->dp_need_to_free_cookie = B_FALSE;
2429 	dma->dp_need_to_switch_cookies = B_FALSE;
2430 	dma->dp_saved_cookies = NULL;
2431 	dma->dp_sleep_flags = KM_PANIC;
2432 	dma->dp_need_to_free_window = B_FALSE;
2433 	dma->dp_partial_required = B_FALSE;
2434 	dma->dp_trim_required = B_FALSE;
2435 	dma->dp_sglinfo.si_copybuf_req = 0;
2436 #if !defined(__amd64)
2437 	dma->dp_cb_remaping = B_FALSE;
2438 	dma->dp_kva = NULL;
2439 #endif
2440 
2441 	/* FMA related initialization */
2442 	hp->dmai_fault = 0;
2443 	hp->dmai_fault_check = NULL;
2444 	hp->dmai_fault_notify = NULL;
2445 	hp->dmai_error.err_ena = 0;
2446 	hp->dmai_error.err_status = DDI_FM_OK;
2447 	hp->dmai_error.err_expected = DDI_FM_ERR_UNEXPECTED;
2448 	hp->dmai_error.err_ontrap = NULL;
2449 	hp->dmai_error.err_fep = NULL;
2450 	hp->dmai_error.err_cf = NULL;
2451 }
2452 
2453 
2454 /*
2455  * rootnex_valid_alloc_parms()
2456  *    Called in ddi_dma_alloc_handle path to validate its parameters.
2457  */
2458 static int
2459 rootnex_valid_alloc_parms(ddi_dma_attr_t *attr, uint_t maxsegmentsize)
2460 {
2461 	if ((attr->dma_attr_seg < MMU_PAGEOFFSET) ||
2462 	    (attr->dma_attr_count_max < MMU_PAGEOFFSET) ||
2463 	    (attr->dma_attr_granular > MMU_PAGESIZE) ||
2464 	    (attr->dma_attr_maxxfer < MMU_PAGESIZE)) {
2465 		return (DDI_DMA_BADATTR);
2466 	}
2467 
2468 	if (attr->dma_attr_addr_hi <= attr->dma_attr_addr_lo) {
2469 		return (DDI_DMA_BADATTR);
2470 	}
2471 
2472 	if ((attr->dma_attr_seg & MMU_PAGEOFFSET) != MMU_PAGEOFFSET ||
2473 	    MMU_PAGESIZE & (attr->dma_attr_granular - 1) ||
2474 	    attr->dma_attr_sgllen <= 0) {
2475 		return (DDI_DMA_BADATTR);
2476 	}
2477 
2478 	/* We should be able to DMA into every byte offset in a page */
2479 	if (maxsegmentsize < MMU_PAGESIZE) {
2480 		return (DDI_DMA_BADATTR);
2481 	}
2482 
2483 	/* if we're bouncing on seg, seg must be <= addr_hi */
2484 	if ((attr->dma_attr_flags & _DDI_DMA_BOUNCE_ON_SEG) &&
2485 	    (attr->dma_attr_seg > attr->dma_attr_addr_hi)) {
2486 		return (DDI_DMA_BADATTR);
2487 	}
2488 	return (DDI_SUCCESS);
2489 }
2490 
2491 /*
2492  * rootnex_valid_bind_parms()
2493  *    Called in ddi_dma_*_bind_handle path to validate its parameters.
2494  */
2495 /* ARGSUSED */
2496 static int
2497 rootnex_valid_bind_parms(ddi_dma_req_t *dmareq, ddi_dma_attr_t *attr)
2498 {
2499 #if !defined(__amd64)
2500 	/*
2501 	 * we only support up to a 2G-1 transfer size on 32-bit kernels so
2502 	 * we can track the offset for the obsoleted interfaces.
2503 	 */
2504 	if (dmareq->dmar_object.dmao_size > 0x7FFFFFFF) {
2505 		return (DDI_DMA_TOOBIG);
2506 	}
2507 #endif
2508 
2509 	return (DDI_SUCCESS);
2510 }
2511 
2512 
2513 /*
2514  * rootnex_need_bounce_seg()
2515  *    check to see if the buffer lives on both side of the seg.
2516  */
2517 static boolean_t
2518 rootnex_need_bounce_seg(ddi_dma_obj_t *dmar_object, rootnex_sglinfo_t *sglinfo)
2519 {
2520 	ddi_dma_atyp_t buftype;
2521 	rootnex_addr_t raddr;
2522 	boolean_t lower_addr;
2523 	boolean_t upper_addr;
2524 	uint64_t offset;
2525 	page_t **pplist;
2526 	uint64_t paddr;
2527 	uint32_t psize;
2528 	uint32_t size;
2529 	caddr_t vaddr;
2530 	uint_t pcnt;
2531 	page_t *pp;
2532 
2533 
2534 	/* shortcuts */
2535 	pplist = dmar_object->dmao_obj.virt_obj.v_priv;
2536 	vaddr = dmar_object->dmao_obj.virt_obj.v_addr;
2537 	buftype = dmar_object->dmao_type;
2538 	size = dmar_object->dmao_size;
2539 
2540 	lower_addr = B_FALSE;
2541 	upper_addr = B_FALSE;
2542 	pcnt = 0;
2543 
2544 	/*
2545 	 * Process the first page to handle the initial offset of the buffer.
2546 	 * We'll use the base address we get later when we loop through all
2547 	 * the pages.
2548 	 */
2549 	if (buftype == DMA_OTYP_PAGES) {
2550 		pp = dmar_object->dmao_obj.pp_obj.pp_pp;
2551 		offset =  dmar_object->dmao_obj.pp_obj.pp_offset &
2552 		    MMU_PAGEOFFSET;
2553 		paddr = pfn_to_pa(pp->p_pagenum) + offset;
2554 		psize = MIN(size, (MMU_PAGESIZE - offset));
2555 		pp = pp->p_next;
2556 		sglinfo->si_asp = NULL;
2557 	} else if (pplist != NULL) {
2558 		offset = (uintptr_t)vaddr & MMU_PAGEOFFSET;
2559 		sglinfo->si_asp = dmar_object->dmao_obj.virt_obj.v_as;
2560 		if (sglinfo->si_asp == NULL) {
2561 			sglinfo->si_asp = &kas;
2562 		}
2563 		paddr = pfn_to_pa(pplist[pcnt]->p_pagenum);
2564 		paddr += offset;
2565 		psize = MIN(size, (MMU_PAGESIZE - offset));
2566 		pcnt++;
2567 	} else {
2568 		offset = (uintptr_t)vaddr & MMU_PAGEOFFSET;
2569 		sglinfo->si_asp = dmar_object->dmao_obj.virt_obj.v_as;
2570 		if (sglinfo->si_asp == NULL) {
2571 			sglinfo->si_asp = &kas;
2572 		}
2573 		paddr = pfn_to_pa(hat_getpfnum(sglinfo->si_asp->a_hat, vaddr));
2574 		paddr += offset;
2575 		psize = MIN(size, (MMU_PAGESIZE - offset));
2576 		vaddr += psize;
2577 	}
2578 
2579 #ifdef __xpv
2580 	/*
2581 	 * If we're dom0, we're using a real device so we need to load
2582 	 * the cookies with MFNs instead of PFNs.
2583 	 */
2584 	raddr = ROOTNEX_PADDR_TO_RBASE(xen_info, paddr);
2585 #else
2586 	raddr = paddr;
2587 #endif
2588 
2589 	if ((raddr + psize) > sglinfo->si_segmask) {
2590 		upper_addr = B_TRUE;
2591 	} else {
2592 		lower_addr = B_TRUE;
2593 	}
2594 	size -= psize;
2595 
2596 	/*
2597 	 * Walk through the rest of the pages in the buffer. Track to see
2598 	 * if we have pages on both sides of the segment boundary.
2599 	 */
2600 	while (size > 0) {
2601 		/* partial or full page */
2602 		psize = MIN(size, MMU_PAGESIZE);
2603 
2604 		if (buftype == DMA_OTYP_PAGES) {
2605 			/* get the paddr from the page_t */
2606 			ASSERT(!PP_ISFREE(pp) && PAGE_LOCKED(pp));
2607 			paddr = pfn_to_pa(pp->p_pagenum);
2608 			pp = pp->p_next;
2609 		} else if (pplist != NULL) {
2610 			/* index into the array of page_t's to get the paddr */
2611 			ASSERT(!PP_ISFREE(pplist[pcnt]));
2612 			paddr = pfn_to_pa(pplist[pcnt]->p_pagenum);
2613 			pcnt++;
2614 		} else {
2615 			/* call into the VM to get the paddr */
2616 			paddr =  pfn_to_pa(hat_getpfnum(sglinfo->si_asp->a_hat,
2617 			    vaddr));
2618 			vaddr += psize;
2619 		}
2620 
2621 #ifdef __xpv
2622 		/*
2623 		 * If we're dom0, we're using a real device so we need to load
2624 		 * the cookies with MFNs instead of PFNs.
2625 		 */
2626 		raddr = ROOTNEX_PADDR_TO_RBASE(xen_info, paddr);
2627 #else
2628 		raddr = paddr;
2629 #endif
2630 
2631 		if ((raddr + psize) > sglinfo->si_segmask) {
2632 			upper_addr = B_TRUE;
2633 		} else {
2634 			lower_addr = B_TRUE;
2635 		}
2636 		/*
2637 		 * if the buffer lives both above and below the segment
2638 		 * boundary, or the current page is the page immediately
2639 		 * after the segment, we will use a copy/bounce buffer for
2640 		 * all pages > seg.
2641 		 */
2642 		if ((lower_addr && upper_addr) ||
2643 		    (raddr == (sglinfo->si_segmask + 1))) {
2644 			return (B_TRUE);
2645 		}
2646 
2647 		size -= psize;
2648 	}
2649 
2650 	return (B_FALSE);
2651 }
2652 
2653 
2654 /*
2655  * rootnex_get_sgl()
2656  *    Called in bind fastpath to get the sgl. Most of this will be replaced
2657  *    with a call to the vm layer when vm2.0 comes around...
2658  */
2659 static void
2660 rootnex_get_sgl(ddi_dma_obj_t *dmar_object, ddi_dma_cookie_t *sgl,
2661     rootnex_sglinfo_t *sglinfo)
2662 {
2663 	ddi_dma_atyp_t buftype;
2664 	rootnex_addr_t raddr;
2665 	uint64_t last_page;
2666 	uint64_t offset;
2667 	uint64_t addrhi;
2668 	uint64_t addrlo;
2669 	uint64_t maxseg;
2670 	page_t **pplist;
2671 	uint64_t paddr;
2672 	uint32_t psize;
2673 	uint32_t size;
2674 	caddr_t vaddr;
2675 	uint_t pcnt;
2676 	page_t *pp;
2677 	uint_t cnt;
2678 
2679 
2680 	/* shortcuts */
2681 	pplist = dmar_object->dmao_obj.virt_obj.v_priv;
2682 	vaddr = dmar_object->dmao_obj.virt_obj.v_addr;
2683 	maxseg = sglinfo->si_max_cookie_size;
2684 	buftype = dmar_object->dmao_type;
2685 	addrhi = sglinfo->si_max_addr;
2686 	addrlo = sglinfo->si_min_addr;
2687 	size = dmar_object->dmao_size;
2688 
2689 	pcnt = 0;
2690 	cnt = 0;
2691 
2692 
2693 	/*
2694 	 * check to see if we need to use the copy buffer for pages over
2695 	 * the segment attr.
2696 	 */
2697 	sglinfo->si_bounce_on_seg = B_FALSE;
2698 	if (sglinfo->si_flags & _DDI_DMA_BOUNCE_ON_SEG) {
2699 		sglinfo->si_bounce_on_seg = rootnex_need_bounce_seg(
2700 		    dmar_object, sglinfo);
2701 	}
2702 
2703 	/*
2704 	 * if we were passed down a linked list of pages, i.e. pointer to
2705 	 * page_t, use this to get our physical address and buf offset.
2706 	 */
2707 	if (buftype == DMA_OTYP_PAGES) {
2708 		pp = dmar_object->dmao_obj.pp_obj.pp_pp;
2709 		ASSERT(!PP_ISFREE(pp) && PAGE_LOCKED(pp));
2710 		offset =  dmar_object->dmao_obj.pp_obj.pp_offset &
2711 		    MMU_PAGEOFFSET;
2712 		paddr = pfn_to_pa(pp->p_pagenum) + offset;
2713 		psize = MIN(size, (MMU_PAGESIZE - offset));
2714 		pp = pp->p_next;
2715 		sglinfo->si_asp = NULL;
2716 
2717 	/*
2718 	 * We weren't passed down a linked list of pages, but if we were passed
2719 	 * down an array of pages, use this to get our physical address and buf
2720 	 * offset.
2721 	 */
2722 	} else if (pplist != NULL) {
2723 		ASSERT((buftype == DMA_OTYP_VADDR) ||
2724 		    (buftype == DMA_OTYP_BUFVADDR));
2725 
2726 		offset = (uintptr_t)vaddr & MMU_PAGEOFFSET;
2727 		sglinfo->si_asp = dmar_object->dmao_obj.virt_obj.v_as;
2728 		if (sglinfo->si_asp == NULL) {
2729 			sglinfo->si_asp = &kas;
2730 		}
2731 
2732 		ASSERT(!PP_ISFREE(pplist[pcnt]));
2733 		paddr = pfn_to_pa(pplist[pcnt]->p_pagenum);
2734 		paddr += offset;
2735 		psize = MIN(size, (MMU_PAGESIZE - offset));
2736 		pcnt++;
2737 
2738 	/*
2739 	 * All we have is a virtual address, we'll need to call into the VM
2740 	 * to get the physical address.
2741 	 */
2742 	} else {
2743 		ASSERT((buftype == DMA_OTYP_VADDR) ||
2744 		    (buftype == DMA_OTYP_BUFVADDR));
2745 
2746 		offset = (uintptr_t)vaddr & MMU_PAGEOFFSET;
2747 		sglinfo->si_asp = dmar_object->dmao_obj.virt_obj.v_as;
2748 		if (sglinfo->si_asp == NULL) {
2749 			sglinfo->si_asp = &kas;
2750 		}
2751 
2752 		paddr = pfn_to_pa(hat_getpfnum(sglinfo->si_asp->a_hat, vaddr));
2753 		paddr += offset;
2754 		psize = MIN(size, (MMU_PAGESIZE - offset));
2755 		vaddr += psize;
2756 	}
2757 
2758 #ifdef __xpv
2759 	/*
2760 	 * If we're dom0, we're using a real device so we need to load
2761 	 * the cookies with MFNs instead of PFNs.
2762 	 */
2763 	raddr = ROOTNEX_PADDR_TO_RBASE(xen_info, paddr);
2764 #else
2765 	raddr = paddr;
2766 #endif
2767 
2768 	/*
2769 	 * Setup the first cookie with the physical address of the page and the
2770 	 * size of the page (which takes into account the initial offset into
2771 	 * the page.
2772 	 */
2773 	sgl[cnt].dmac_laddress = raddr;
2774 	sgl[cnt].dmac_size = psize;
2775 	sgl[cnt].dmac_type = 0;
2776 
2777 	/*
2778 	 * Save away the buffer offset into the page. We'll need this later in
2779 	 * the copy buffer code to help figure out the page index within the
2780 	 * buffer and the offset into the current page.
2781 	 */
2782 	sglinfo->si_buf_offset = offset;
2783 
2784 	/*
2785 	 * If we are using the copy buffer for anything over the segment
2786 	 * boundary, and this page is over the segment boundary.
2787 	 *   OR
2788 	 * if the DMA engine can't reach the physical address.
2789 	 */
2790 	if (((sglinfo->si_bounce_on_seg) &&
2791 	    ((raddr + psize) > sglinfo->si_segmask)) ||
2792 	    ((raddr < addrlo) || ((raddr + psize) > addrhi))) {
2793 		/*
2794 		 * Increase how much copy buffer we use. We always increase by
2795 		 * pagesize so we don't have to worry about converting offsets.
2796 		 * Set a flag in the cookies dmac_type to indicate that it uses
2797 		 * the copy buffer. If this isn't the last cookie, go to the
2798 		 * next cookie (since we separate each page which uses the copy
2799 		 * buffer in case the copy buffer is not physically contiguous.
2800 		 */
2801 		sglinfo->si_copybuf_req += MMU_PAGESIZE;
2802 		sgl[cnt].dmac_type = ROOTNEX_USES_COPYBUF;
2803 		if ((cnt + 1) < sglinfo->si_max_pages) {
2804 			cnt++;
2805 			sgl[cnt].dmac_laddress = 0;
2806 			sgl[cnt].dmac_size = 0;
2807 			sgl[cnt].dmac_type = 0;
2808 		}
2809 	}
2810 
2811 	/*
2812 	 * save this page's physical address so we can figure out if the next
2813 	 * page is physically contiguous. Keep decrementing size until we are
2814 	 * done with the buffer.
2815 	 */
2816 	last_page = raddr & MMU_PAGEMASK;
2817 	size -= psize;
2818 
2819 	while (size > 0) {
2820 		/* Get the size for this page (i.e. partial or full page) */
2821 		psize = MIN(size, MMU_PAGESIZE);
2822 
2823 		if (buftype == DMA_OTYP_PAGES) {
2824 			/* get the paddr from the page_t */
2825 			ASSERT(!PP_ISFREE(pp) && PAGE_LOCKED(pp));
2826 			paddr = pfn_to_pa(pp->p_pagenum);
2827 			pp = pp->p_next;
2828 		} else if (pplist != NULL) {
2829 			/* index into the array of page_t's to get the paddr */
2830 			ASSERT(!PP_ISFREE(pplist[pcnt]));
2831 			paddr = pfn_to_pa(pplist[pcnt]->p_pagenum);
2832 			pcnt++;
2833 		} else {
2834 			/* call into the VM to get the paddr */
2835 			paddr =  pfn_to_pa(hat_getpfnum(sglinfo->si_asp->a_hat,
2836 			    vaddr));
2837 			vaddr += psize;
2838 		}
2839 
2840 #ifdef __xpv
2841 		/*
2842 		 * If we're dom0, we're using a real device so we need to load
2843 		 * the cookies with MFNs instead of PFNs.
2844 		 */
2845 		raddr = ROOTNEX_PADDR_TO_RBASE(xen_info, paddr);
2846 #else
2847 		raddr = paddr;
2848 #endif
2849 
2850 		/*
2851 		 * If we are using the copy buffer for anything over the
2852 		 * segment boundary, and this page is over the segment
2853 		 * boundary.
2854 		 *   OR
2855 		 * if the DMA engine can't reach the physical address.
2856 		 */
2857 		if (((sglinfo->si_bounce_on_seg) &&
2858 		    ((raddr + psize) > sglinfo->si_segmask)) ||
2859 		    ((raddr < addrlo) || ((raddr + psize) > addrhi))) {
2860 
2861 			sglinfo->si_copybuf_req += MMU_PAGESIZE;
2862 
2863 			/*
2864 			 * if there is something in the current cookie, go to
2865 			 * the next one. We only want one page in a cookie which
2866 			 * uses the copybuf since the copybuf doesn't have to
2867 			 * be physically contiguous.
2868 			 */
2869 			if (sgl[cnt].dmac_size != 0) {
2870 				cnt++;
2871 			}
2872 			sgl[cnt].dmac_laddress = raddr;
2873 			sgl[cnt].dmac_size = psize;
2874 #if defined(__amd64)
2875 			sgl[cnt].dmac_type = ROOTNEX_USES_COPYBUF;
2876 #else
2877 			/*
2878 			 * save the buf offset for 32-bit kernel. used in the
2879 			 * obsoleted interfaces.
2880 			 */
2881 			sgl[cnt].dmac_type = ROOTNEX_USES_COPYBUF |
2882 			    (dmar_object->dmao_size - size);
2883 #endif
2884 			/* if this isn't the last cookie, go to the next one */
2885 			if ((cnt + 1) < sglinfo->si_max_pages) {
2886 				cnt++;
2887 				sgl[cnt].dmac_laddress = 0;
2888 				sgl[cnt].dmac_size = 0;
2889 				sgl[cnt].dmac_type = 0;
2890 			}
2891 
2892 		/*
2893 		 * this page didn't need the copy buffer, if it's not physically
2894 		 * contiguous, or it would put us over a segment boundary, or it
2895 		 * puts us over the max cookie size, or the current sgl doesn't
2896 		 * have anything in it.
2897 		 */
2898 		} else if (((last_page + MMU_PAGESIZE) != raddr) ||
2899 		    !(raddr & sglinfo->si_segmask) ||
2900 		    ((sgl[cnt].dmac_size + psize) > maxseg) ||
2901 		    (sgl[cnt].dmac_size == 0)) {
2902 			/*
2903 			 * if we're not already in a new cookie, go to the next
2904 			 * cookie.
2905 			 */
2906 			if (sgl[cnt].dmac_size != 0) {
2907 				cnt++;
2908 			}
2909 
2910 			/* save the cookie information */
2911 			sgl[cnt].dmac_laddress = raddr;
2912 			sgl[cnt].dmac_size = psize;
2913 #if defined(__amd64)
2914 			sgl[cnt].dmac_type = 0;
2915 #else
2916 			/*
2917 			 * save the buf offset for 32-bit kernel. used in the
2918 			 * obsoleted interfaces.
2919 			 */
2920 			sgl[cnt].dmac_type = dmar_object->dmao_size - size;
2921 #endif
2922 
2923 		/*
2924 		 * this page didn't need the copy buffer, it is physically
2925 		 * contiguous with the last page, and it's <= the max cookie
2926 		 * size.
2927 		 */
2928 		} else {
2929 			sgl[cnt].dmac_size += psize;
2930 
2931 			/*
2932 			 * if this exactly ==  the maximum cookie size, and
2933 			 * it isn't the last cookie, go to the next cookie.
2934 			 */
2935 			if (((sgl[cnt].dmac_size + psize) == maxseg) &&
2936 			    ((cnt + 1) < sglinfo->si_max_pages)) {
2937 				cnt++;
2938 				sgl[cnt].dmac_laddress = 0;
2939 				sgl[cnt].dmac_size = 0;
2940 				sgl[cnt].dmac_type = 0;
2941 			}
2942 		}
2943 
2944 		/*
2945 		 * save this page's physical address so we can figure out if the
2946 		 * next page is physically contiguous. Keep decrementing size
2947 		 * until we are done with the buffer.
2948 		 */
2949 		last_page = raddr;
2950 		size -= psize;
2951 	}
2952 
2953 	/* we're done, save away how many cookies the sgl has */
2954 	if (sgl[cnt].dmac_size == 0) {
2955 		ASSERT(cnt < sglinfo->si_max_pages);
2956 		sglinfo->si_sgl_size = cnt;
2957 	} else {
2958 		sglinfo->si_sgl_size = cnt + 1;
2959 	}
2960 }
2961 
2962 /*
2963  * rootnex_bind_slowpath()
2964  *    Call in the bind path if the calling driver can't use the sgl without
2965  *    modifying it. We either need to use the copy buffer and/or we will end up
2966  *    with a partial bind.
2967  */
2968 static int
2969 rootnex_bind_slowpath(ddi_dma_impl_t *hp, struct ddi_dma_req *dmareq,
2970     rootnex_dma_t *dma, ddi_dma_attr_t *attr, int kmflag)
2971 {
2972 	rootnex_sglinfo_t *sinfo;
2973 	rootnex_window_t *window;
2974 	ddi_dma_cookie_t *cookie;
2975 	size_t copybuf_used;
2976 	size_t dmac_size;
2977 	boolean_t partial;
2978 	off_t cur_offset;
2979 	page_t *cur_pp;
2980 	major_t mnum;
2981 	int e;
2982 	int i;
2983 
2984 
2985 	sinfo = &dma->dp_sglinfo;
2986 	copybuf_used = 0;
2987 	partial = B_FALSE;
2988 
2989 	/*
2990 	 * If we're using the copybuf, set the copybuf state in dma struct.
2991 	 * Needs to be first since it sets the copy buffer size.
2992 	 */
2993 	if (sinfo->si_copybuf_req != 0) {
2994 		e = rootnex_setup_copybuf(hp, dmareq, dma, attr);
2995 		if (e != DDI_SUCCESS) {
2996 			return (e);
2997 		}
2998 	} else {
2999 		dma->dp_copybuf_size = 0;
3000 	}
3001 
3002 	/*
3003 	 * Figure out if we need to do a partial mapping. If so, figure out
3004 	 * if we need to trim the buffers when we munge the sgl.
3005 	 */
3006 	if ((dma->dp_copybuf_size < sinfo->si_copybuf_req) ||
3007 	    (dma->dp_dma.dmao_size > dma->dp_maxxfer) ||
3008 	    (attr->dma_attr_sgllen < sinfo->si_sgl_size)) {
3009 		dma->dp_partial_required = B_TRUE;
3010 		if (attr->dma_attr_granular != 1) {
3011 			dma->dp_trim_required = B_TRUE;
3012 		}
3013 	} else {
3014 		dma->dp_partial_required = B_FALSE;
3015 		dma->dp_trim_required = B_FALSE;
3016 	}
3017 
3018 	/* If we need to do a partial bind, make sure the driver supports it */
3019 	if (dma->dp_partial_required &&
3020 	    !(dmareq->dmar_flags & DDI_DMA_PARTIAL)) {
3021 
3022 		mnum = ddi_driver_major(dma->dp_dip);
3023 		/*
3024 		 * patchable which allows us to print one warning per major
3025 		 * number.
3026 		 */
3027 		if ((rootnex_bind_warn) &&
3028 		    ((rootnex_warn_list[mnum] & ROOTNEX_BIND_WARNING) == 0)) {
3029 			rootnex_warn_list[mnum] |= ROOTNEX_BIND_WARNING;
3030 			cmn_err(CE_WARN, "!%s: coding error detected, the "
3031 			    "driver is using ddi_dma_attr(9S) incorrectly. "
3032 			    "There is a small risk of data corruption in "
3033 			    "particular with large I/Os. The driver should be "
3034 			    "replaced with a corrected version for proper "
3035 			    "system operation. To disable this warning, add "
3036 			    "'set rootnex:rootnex_bind_warn=0' to "
3037 			    "/etc/system(4).", ddi_driver_name(dma->dp_dip));
3038 		}
3039 		return (DDI_DMA_TOOBIG);
3040 	}
3041 
3042 	/*
3043 	 * we might need multiple windows, setup state to handle them. In this
3044 	 * code path, we will have at least one window.
3045 	 */
3046 	e = rootnex_setup_windows(hp, dma, attr, kmflag);
3047 	if (e != DDI_SUCCESS) {
3048 		rootnex_teardown_copybuf(dma);
3049 		return (e);
3050 	}
3051 
3052 	window = &dma->dp_window[0];
3053 	cookie = &dma->dp_cookies[0];
3054 	cur_offset = 0;
3055 	rootnex_init_win(hp, dma, window, cookie, cur_offset);
3056 	if (dmareq->dmar_object.dmao_type == DMA_OTYP_PAGES) {
3057 		cur_pp = dmareq->dmar_object.dmao_obj.pp_obj.pp_pp;
3058 	}
3059 
3060 	/* loop though all the cookies we got back from get_sgl() */
3061 	for (i = 0; i < sinfo->si_sgl_size; i++) {
3062 		/*
3063 		 * If we're using the copy buffer, check this cookie and setup
3064 		 * its associated copy buffer state. If this cookie uses the
3065 		 * copy buffer, make sure we sync this window during dma_sync.
3066 		 */
3067 		if (dma->dp_copybuf_size > 0) {
3068 			rootnex_setup_cookie(&dmareq->dmar_object, dma, cookie,
3069 			    cur_offset, &copybuf_used, &cur_pp);
3070 			if (cookie->dmac_type & ROOTNEX_USES_COPYBUF) {
3071 				window->wd_dosync = B_TRUE;
3072 			}
3073 		}
3074 
3075 		/*
3076 		 * save away the cookie size, since it could be modified in
3077 		 * the windowing code.
3078 		 */
3079 		dmac_size = cookie->dmac_size;
3080 
3081 		/* if we went over max copybuf size */
3082 		if (dma->dp_copybuf_size &&
3083 		    (copybuf_used > dma->dp_copybuf_size)) {
3084 			partial = B_TRUE;
3085 			e = rootnex_copybuf_window_boundary(hp, dma, &window,
3086 			    cookie, cur_offset, &copybuf_used);
3087 			if (e != DDI_SUCCESS) {
3088 				rootnex_teardown_copybuf(dma);
3089 				rootnex_teardown_windows(dma);
3090 				return (e);
3091 			}
3092 
3093 			/*
3094 			 * if the coookie uses the copy buffer, make sure the
3095 			 * new window we just moved to is set to sync.
3096 			 */
3097 			if (cookie->dmac_type & ROOTNEX_USES_COPYBUF) {
3098 				window->wd_dosync = B_TRUE;
3099 			}
3100 			DTRACE_PROBE1(rootnex__copybuf__window, dev_info_t *,
3101 			    dma->dp_dip);
3102 
3103 		/* if the cookie cnt == max sgllen, move to the next window */
3104 		} else if (window->wd_cookie_cnt >= attr->dma_attr_sgllen) {
3105 			partial = B_TRUE;
3106 			ASSERT(window->wd_cookie_cnt == attr->dma_attr_sgllen);
3107 			e = rootnex_sgllen_window_boundary(hp, dma, &window,
3108 			    cookie, attr, cur_offset);
3109 			if (e != DDI_SUCCESS) {
3110 				rootnex_teardown_copybuf(dma);
3111 				rootnex_teardown_windows(dma);
3112 				return (e);
3113 			}
3114 
3115 			/*
3116 			 * if the coookie uses the copy buffer, make sure the
3117 			 * new window we just moved to is set to sync.
3118 			 */
3119 			if (cookie->dmac_type & ROOTNEX_USES_COPYBUF) {
3120 				window->wd_dosync = B_TRUE;
3121 			}
3122 			DTRACE_PROBE1(rootnex__sgllen__window, dev_info_t *,
3123 			    dma->dp_dip);
3124 
3125 		/* else if we will be over maxxfer */
3126 		} else if ((window->wd_size + dmac_size) >
3127 		    dma->dp_maxxfer) {
3128 			partial = B_TRUE;
3129 			e = rootnex_maxxfer_window_boundary(hp, dma, &window,
3130 			    cookie);
3131 			if (e != DDI_SUCCESS) {
3132 				rootnex_teardown_copybuf(dma);
3133 				rootnex_teardown_windows(dma);
3134 				return (e);
3135 			}
3136 
3137 			/*
3138 			 * if the coookie uses the copy buffer, make sure the
3139 			 * new window we just moved to is set to sync.
3140 			 */
3141 			if (cookie->dmac_type & ROOTNEX_USES_COPYBUF) {
3142 				window->wd_dosync = B_TRUE;
3143 			}
3144 			DTRACE_PROBE1(rootnex__maxxfer__window, dev_info_t *,
3145 			    dma->dp_dip);
3146 
3147 		/* else this cookie fits in the current window */
3148 		} else {
3149 			window->wd_cookie_cnt++;
3150 			window->wd_size += dmac_size;
3151 		}
3152 
3153 		/* track our offset into the buffer, go to the next cookie */
3154 		ASSERT(dmac_size <= dma->dp_dma.dmao_size);
3155 		ASSERT(cookie->dmac_size <= dmac_size);
3156 		cur_offset += dmac_size;
3157 		cookie++;
3158 	}
3159 
3160 	/* if we ended up with a zero sized window in the end, clean it up */
3161 	if (window->wd_size == 0) {
3162 		hp->dmai_nwin--;
3163 		window--;
3164 	}
3165 
3166 	ASSERT(window->wd_trim.tr_trim_last == B_FALSE);
3167 
3168 	if (!partial) {
3169 		return (DDI_DMA_MAPPED);
3170 	}
3171 
3172 	ASSERT(dma->dp_partial_required);
3173 	return (DDI_DMA_PARTIAL_MAP);
3174 }
3175 
3176 
3177 /*
3178  * rootnex_setup_copybuf()
3179  *    Called in bind slowpath. Figures out if we're going to use the copy
3180  *    buffer, and if we do, sets up the basic state to handle it.
3181  */
3182 static int
3183 rootnex_setup_copybuf(ddi_dma_impl_t *hp, struct ddi_dma_req *dmareq,
3184     rootnex_dma_t *dma, ddi_dma_attr_t *attr)
3185 {
3186 	rootnex_sglinfo_t *sinfo;
3187 	ddi_dma_attr_t lattr;
3188 	size_t max_copybuf;
3189 	int cansleep;
3190 	int e;
3191 #if !defined(__amd64)
3192 	int vmflag;
3193 #endif
3194 
3195 
3196 	sinfo = &dma->dp_sglinfo;
3197 
3198 	/* read this first so it's consistent through the routine  */
3199 	max_copybuf = i_ddi_copybuf_size() & MMU_PAGEMASK;
3200 
3201 	/* We need to call into the rootnex on ddi_dma_sync() */
3202 	hp->dmai_rflags &= ~DMP_NOSYNC;
3203 
3204 	/* make sure the copybuf size <= the max size */
3205 	dma->dp_copybuf_size = MIN(sinfo->si_copybuf_req, max_copybuf);
3206 	ASSERT((dma->dp_copybuf_size & MMU_PAGEOFFSET) == 0);
3207 
3208 #if !defined(__amd64)
3209 	/*
3210 	 * if we don't have kva space to copy to/from, allocate the KVA space
3211 	 * now. We only do this for the 32-bit kernel. We use seg kpm space for
3212 	 * the 64-bit kernel.
3213 	 */
3214 	if ((dmareq->dmar_object.dmao_type == DMA_OTYP_PAGES) ||
3215 	    (dmareq->dmar_object.dmao_obj.virt_obj.v_as != NULL)) {
3216 
3217 		/* convert the sleep flags */
3218 		if (dmareq->dmar_fp == DDI_DMA_SLEEP) {
3219 			vmflag = VM_SLEEP;
3220 		} else {
3221 			vmflag = VM_NOSLEEP;
3222 		}
3223 
3224 		/* allocate Kernel VA space that we can bcopy to/from */
3225 		dma->dp_kva = vmem_alloc(heap_arena, dma->dp_copybuf_size,
3226 		    vmflag);
3227 		if (dma->dp_kva == NULL) {
3228 			return (DDI_DMA_NORESOURCES);
3229 		}
3230 	}
3231 #endif
3232 
3233 	/* convert the sleep flags */
3234 	if (dmareq->dmar_fp == DDI_DMA_SLEEP) {
3235 		cansleep = 1;
3236 	} else {
3237 		cansleep = 0;
3238 	}
3239 
3240 	/*
3241 	 * Allocate the actual copy buffer. This needs to fit within the DMA
3242 	 * engine limits, so we can't use kmem_alloc... We don't need
3243 	 * contiguous memory (sgllen) since we will be forcing windows on
3244 	 * sgllen anyway.
3245 	 */
3246 	lattr = *attr;
3247 	lattr.dma_attr_align = MMU_PAGESIZE;
3248 	/*
3249 	 * this should be < 0 to indicate no limit, but due to a bug in
3250 	 * the rootnex, we'll set it to the maximum positive int.
3251 	 */
3252 	lattr.dma_attr_sgllen = 0x7fffffff;
3253 	/*
3254 	 * if we're using the copy buffer because of seg, use that for our
3255 	 * upper address limit.
3256 	 */
3257 	if (sinfo->si_bounce_on_seg) {
3258 		lattr.dma_attr_addr_hi = lattr.dma_attr_seg;
3259 	}
3260 	e = i_ddi_mem_alloc(dma->dp_dip, &lattr, dma->dp_copybuf_size, cansleep,
3261 	    0, NULL, &dma->dp_cbaddr, &dma->dp_cbsize, NULL);
3262 	if (e != DDI_SUCCESS) {
3263 #if !defined(__amd64)
3264 		if (dma->dp_kva != NULL) {
3265 			vmem_free(heap_arena, dma->dp_kva,
3266 			    dma->dp_copybuf_size);
3267 		}
3268 #endif
3269 		return (DDI_DMA_NORESOURCES);
3270 	}
3271 
3272 	DTRACE_PROBE2(rootnex__alloc__copybuf, dev_info_t *, dma->dp_dip,
3273 	    size_t, dma->dp_copybuf_size);
3274 
3275 	return (DDI_SUCCESS);
3276 }
3277 
3278 
3279 /*
3280  * rootnex_setup_windows()
3281  *    Called in bind slowpath to setup the window state. We always have windows
3282  *    in the slowpath. Even if the window count = 1.
3283  */
3284 static int
3285 rootnex_setup_windows(ddi_dma_impl_t *hp, rootnex_dma_t *dma,
3286     ddi_dma_attr_t *attr, int kmflag)
3287 {
3288 	rootnex_window_t *windowp;
3289 	rootnex_sglinfo_t *sinfo;
3290 	size_t copy_state_size;
3291 	size_t win_state_size;
3292 	size_t state_available;
3293 	size_t space_needed;
3294 	uint_t copybuf_win;
3295 	uint_t maxxfer_win;
3296 	size_t space_used;
3297 	uint_t sglwin;
3298 
3299 
3300 	sinfo = &dma->dp_sglinfo;
3301 
3302 	dma->dp_current_win = 0;
3303 	hp->dmai_nwin = 0;
3304 
3305 	/* If we don't need to do a partial, we only have one window */
3306 	if (!dma->dp_partial_required) {
3307 		dma->dp_max_win = 1;
3308 
3309 	/*
3310 	 * we need multiple windows, need to figure out the worse case number
3311 	 * of windows.
3312 	 */
3313 	} else {
3314 		/*
3315 		 * if we need windows because we need more copy buffer that
3316 		 * we allow, the worse case number of windows we could need
3317 		 * here would be (copybuf space required / copybuf space that
3318 		 * we have) plus one for remainder, and plus 2 to handle the
3319 		 * extra pages on the trim for the first and last pages of the
3320 		 * buffer (a page is the minimum window size so under the right
3321 		 * attr settings, you could have a window for each page).
3322 		 * The last page will only be hit here if the size is not a
3323 		 * multiple of the granularity (which theoretically shouldn't
3324 		 * be the case but never has been enforced, so we could have
3325 		 * broken things without it).
3326 		 */
3327 		if (sinfo->si_copybuf_req > dma->dp_copybuf_size) {
3328 			ASSERT(dma->dp_copybuf_size > 0);
3329 			copybuf_win = (sinfo->si_copybuf_req /
3330 			    dma->dp_copybuf_size) + 1 + 2;
3331 		} else {
3332 			copybuf_win = 0;
3333 		}
3334 
3335 		/*
3336 		 * if we need windows because we have more cookies than the H/W
3337 		 * can handle, the number of windows we would need here would
3338 		 * be (cookie count / cookies count H/W supports) plus one for
3339 		 * remainder, and plus 2 to handle the extra pages on the trim
3340 		 * (see above comment about trim)
3341 		 */
3342 		if (attr->dma_attr_sgllen < sinfo->si_sgl_size) {
3343 			sglwin = ((sinfo->si_sgl_size / attr->dma_attr_sgllen)
3344 			    + 1) + 2;
3345 		} else {
3346 			sglwin = 0;
3347 		}
3348 
3349 		/*
3350 		 * if we need windows because we're binding more memory than the
3351 		 * H/W can transfer at once, the number of windows we would need
3352 		 * here would be (xfer count / max xfer H/W supports) plus one
3353 		 * for remainder, and plus 2 to handle the extra pages on the
3354 		 * trim (see above comment about trim)
3355 		 */
3356 		if (dma->dp_dma.dmao_size > dma->dp_maxxfer) {
3357 			maxxfer_win = (dma->dp_dma.dmao_size /
3358 			    dma->dp_maxxfer) + 1 + 2;
3359 		} else {
3360 			maxxfer_win = 0;
3361 		}
3362 		dma->dp_max_win =  copybuf_win + sglwin + maxxfer_win;
3363 		ASSERT(dma->dp_max_win > 0);
3364 	}
3365 	win_state_size = dma->dp_max_win * sizeof (rootnex_window_t);
3366 
3367 	/*
3368 	 * Get space for window and potential copy buffer state. Before we
3369 	 * go and allocate memory, see if we can get away with using what's
3370 	 * left in the pre-allocted state or the dynamically allocated sgl.
3371 	 */
3372 	space_used = (uintptr_t)(sinfo->si_sgl_size *
3373 	    sizeof (ddi_dma_cookie_t));
3374 
3375 	/* if we dynamically allocated space for the cookies */
3376 	if (dma->dp_need_to_free_cookie) {
3377 		/* if we have more space in the pre-allocted buffer, use it */
3378 		ASSERT(space_used <= dma->dp_cookie_size);
3379 		if ((dma->dp_cookie_size - space_used) <=
3380 		    rootnex_state->r_prealloc_size) {
3381 			state_available = rootnex_state->r_prealloc_size;
3382 			windowp = (rootnex_window_t *)dma->dp_prealloc_buffer;
3383 
3384 		/*
3385 		 * else, we have more free space in the dynamically allocated
3386 		 * buffer, i.e. the buffer wasn't worse case fragmented so we
3387 		 * didn't need a lot of cookies.
3388 		 */
3389 		} else {
3390 			state_available = dma->dp_cookie_size - space_used;
3391 			windowp = (rootnex_window_t *)
3392 			    &dma->dp_cookies[sinfo->si_sgl_size];
3393 		}
3394 
3395 	/* we used the pre-alloced buffer */
3396 	} else {
3397 		ASSERT(space_used <= rootnex_state->r_prealloc_size);
3398 		state_available = rootnex_state->r_prealloc_size - space_used;
3399 		windowp = (rootnex_window_t *)
3400 		    &dma->dp_cookies[sinfo->si_sgl_size];
3401 	}
3402 
3403 	/*
3404 	 * figure out how much state we need to track the copy buffer. Add an
3405 	 * addition 8 bytes for pointer alignemnt later.
3406 	 */
3407 	if (dma->dp_copybuf_size > 0) {
3408 		copy_state_size = sinfo->si_max_pages *
3409 		    sizeof (rootnex_pgmap_t);
3410 	} else {
3411 		copy_state_size = 0;
3412 	}
3413 	/* add an additional 8 bytes for pointer alignment */
3414 	space_needed = win_state_size + copy_state_size + 0x8;
3415 
3416 	/* if we have enough space already, use it */
3417 	if (state_available >= space_needed) {
3418 		dma->dp_window = windowp;
3419 		dma->dp_need_to_free_window = B_FALSE;
3420 
3421 	/* not enough space, need to allocate more. */
3422 	} else {
3423 		dma->dp_window = kmem_alloc(space_needed, kmflag);
3424 		if (dma->dp_window == NULL) {
3425 			return (DDI_DMA_NORESOURCES);
3426 		}
3427 		dma->dp_need_to_free_window = B_TRUE;
3428 		dma->dp_window_size = space_needed;
3429 		DTRACE_PROBE2(rootnex__bind__sp__alloc, dev_info_t *,
3430 		    dma->dp_dip, size_t, space_needed);
3431 	}
3432 
3433 	/*
3434 	 * we allocate copy buffer state and window state at the same time.
3435 	 * setup our copy buffer state pointers. Make sure it's aligned.
3436 	 */
3437 	if (dma->dp_copybuf_size > 0) {
3438 		dma->dp_pgmap = (rootnex_pgmap_t *)(((uintptr_t)
3439 		    &dma->dp_window[dma->dp_max_win] + 0x7) & ~0x7);
3440 
3441 #if !defined(__amd64)
3442 		/*
3443 		 * make sure all pm_mapped, pm_vaddr, and pm_pp are set to
3444 		 * false/NULL. Should be quicker to bzero vs loop and set.
3445 		 */
3446 		bzero(dma->dp_pgmap, copy_state_size);
3447 #endif
3448 	} else {
3449 		dma->dp_pgmap = NULL;
3450 	}
3451 
3452 	return (DDI_SUCCESS);
3453 }
3454 
3455 
3456 /*
3457  * rootnex_teardown_copybuf()
3458  *    cleans up after rootnex_setup_copybuf()
3459  */
3460 static void
3461 rootnex_teardown_copybuf(rootnex_dma_t *dma)
3462 {
3463 #if !defined(__amd64)
3464 	int i;
3465 
3466 	/*
3467 	 * if we allocated kernel heap VMEM space, go through all the pages and
3468 	 * map out any of the ones that we're mapped into the kernel heap VMEM
3469 	 * arena. Then free the VMEM space.
3470 	 */
3471 	if (dma->dp_kva != NULL) {
3472 		for (i = 0; i < dma->dp_sglinfo.si_max_pages; i++) {
3473 			if (dma->dp_pgmap[i].pm_mapped) {
3474 				hat_unload(kas.a_hat, dma->dp_pgmap[i].pm_kaddr,
3475 				    MMU_PAGESIZE, HAT_UNLOAD);
3476 				dma->dp_pgmap[i].pm_mapped = B_FALSE;
3477 			}
3478 		}
3479 
3480 		vmem_free(heap_arena, dma->dp_kva, dma->dp_copybuf_size);
3481 	}
3482 
3483 #endif
3484 
3485 	/* if we allocated a copy buffer, free it */
3486 	if (dma->dp_cbaddr != NULL) {
3487 		i_ddi_mem_free(dma->dp_cbaddr, NULL);
3488 	}
3489 }
3490 
3491 
3492 /*
3493  * rootnex_teardown_windows()
3494  *    cleans up after rootnex_setup_windows()
3495  */
3496 static void
3497 rootnex_teardown_windows(rootnex_dma_t *dma)
3498 {
3499 	/*
3500 	 * if we had to allocate window state on the last bind (because we
3501 	 * didn't have enough pre-allocated space in the handle), free it.
3502 	 */
3503 	if (dma->dp_need_to_free_window) {
3504 		kmem_free(dma->dp_window, dma->dp_window_size);
3505 	}
3506 }
3507 
3508 
3509 /*
3510  * rootnex_init_win()
3511  *    Called in bind slow path during creation of a new window. Initializes
3512  *    window state to default values.
3513  */
3514 /*ARGSUSED*/
3515 static void
3516 rootnex_init_win(ddi_dma_impl_t *hp, rootnex_dma_t *dma,
3517     rootnex_window_t *window, ddi_dma_cookie_t *cookie, off_t cur_offset)
3518 {
3519 	hp->dmai_nwin++;
3520 	window->wd_dosync = B_FALSE;
3521 	window->wd_offset = cur_offset;
3522 	window->wd_size = 0;
3523 	window->wd_first_cookie = cookie;
3524 	window->wd_cookie_cnt = 0;
3525 	window->wd_trim.tr_trim_first = B_FALSE;
3526 	window->wd_trim.tr_trim_last = B_FALSE;
3527 	window->wd_trim.tr_first_copybuf_win = B_FALSE;
3528 	window->wd_trim.tr_last_copybuf_win = B_FALSE;
3529 #if !defined(__amd64)
3530 	window->wd_remap_copybuf = dma->dp_cb_remaping;
3531 #endif
3532 }
3533 
3534 
3535 /*
3536  * rootnex_setup_cookie()
3537  *    Called in the bind slow path when the sgl uses the copy buffer. If any of
3538  *    the sgl uses the copy buffer, we need to go through each cookie, figure
3539  *    out if it uses the copy buffer, and if it does, save away everything we'll
3540  *    need during sync.
3541  */
3542 static void
3543 rootnex_setup_cookie(ddi_dma_obj_t *dmar_object, rootnex_dma_t *dma,
3544     ddi_dma_cookie_t *cookie, off_t cur_offset, size_t *copybuf_used,
3545     page_t **cur_pp)
3546 {
3547 	boolean_t copybuf_sz_power_2;
3548 	rootnex_sglinfo_t *sinfo;
3549 	paddr_t paddr;
3550 	uint_t pidx;
3551 	uint_t pcnt;
3552 	off_t poff;
3553 #if defined(__amd64)
3554 	pfn_t pfn;
3555 #else
3556 	page_t **pplist;
3557 #endif
3558 
3559 	sinfo = &dma->dp_sglinfo;
3560 
3561 	/*
3562 	 * Calculate the page index relative to the start of the buffer. The
3563 	 * index to the current page for our buffer is the offset into the
3564 	 * first page of the buffer plus our current offset into the buffer
3565 	 * itself, shifted of course...
3566 	 */
3567 	pidx = (sinfo->si_buf_offset + cur_offset) >> MMU_PAGESHIFT;
3568 	ASSERT(pidx < sinfo->si_max_pages);
3569 
3570 	/* if this cookie uses the copy buffer */
3571 	if (cookie->dmac_type & ROOTNEX_USES_COPYBUF) {
3572 		/*
3573 		 * NOTE: we know that since this cookie uses the copy buffer, it
3574 		 * is <= MMU_PAGESIZE.
3575 		 */
3576 
3577 		/*
3578 		 * get the offset into the page. For the 64-bit kernel, get the
3579 		 * pfn which we'll use with seg kpm.
3580 		 */
3581 		poff = cookie->dmac_laddress & MMU_PAGEOFFSET;
3582 #if defined(__amd64)
3583 		/* mfn_to_pfn() is a NOP on i86pc */
3584 		pfn = mfn_to_pfn(cookie->dmac_laddress >> MMU_PAGESHIFT);
3585 #endif /* __amd64 */
3586 
3587 		/* figure out if the copybuf size is a power of 2 */
3588 		if (dma->dp_copybuf_size & (dma->dp_copybuf_size - 1)) {
3589 			copybuf_sz_power_2 = B_FALSE;
3590 		} else {
3591 			copybuf_sz_power_2 = B_TRUE;
3592 		}
3593 
3594 		/* This page uses the copy buffer */
3595 		dma->dp_pgmap[pidx].pm_uses_copybuf = B_TRUE;
3596 
3597 		/*
3598 		 * save the copy buffer KVA that we'll use with this page.
3599 		 * if we still fit within the copybuf, it's a simple add.
3600 		 * otherwise, we need to wrap over using & or % accordingly.
3601 		 */
3602 		if ((*copybuf_used + MMU_PAGESIZE) <= dma->dp_copybuf_size) {
3603 			dma->dp_pgmap[pidx].pm_cbaddr = dma->dp_cbaddr +
3604 			    *copybuf_used;
3605 		} else {
3606 			if (copybuf_sz_power_2) {
3607 				dma->dp_pgmap[pidx].pm_cbaddr = (caddr_t)(
3608 				    (uintptr_t)dma->dp_cbaddr +
3609 				    (*copybuf_used &
3610 				    (dma->dp_copybuf_size - 1)));
3611 			} else {
3612 				dma->dp_pgmap[pidx].pm_cbaddr = (caddr_t)(
3613 				    (uintptr_t)dma->dp_cbaddr +
3614 				    (*copybuf_used % dma->dp_copybuf_size));
3615 			}
3616 		}
3617 
3618 		/*
3619 		 * over write the cookie physical address with the address of
3620 		 * the physical address of the copy buffer page that we will
3621 		 * use.
3622 		 */
3623 		paddr = pfn_to_pa(hat_getpfnum(kas.a_hat,
3624 		    dma->dp_pgmap[pidx].pm_cbaddr)) + poff;
3625 
3626 #ifdef __xpv
3627 		/*
3628 		 * If we're dom0, we're using a real device so we need to load
3629 		 * the cookies with MAs instead of PAs.
3630 		 */
3631 		cookie->dmac_laddress = ROOTNEX_PADDR_TO_RBASE(xen_info, paddr);
3632 #else
3633 		cookie->dmac_laddress = paddr;
3634 #endif
3635 
3636 		/* if we have a kernel VA, it's easy, just save that address */
3637 		if ((dmar_object->dmao_type != DMA_OTYP_PAGES) &&
3638 		    (sinfo->si_asp == &kas)) {
3639 			/*
3640 			 * save away the page aligned virtual address of the
3641 			 * driver buffer. Offsets are handled in the sync code.
3642 			 */
3643 			dma->dp_pgmap[pidx].pm_kaddr = (caddr_t)(((uintptr_t)
3644 			    dmar_object->dmao_obj.virt_obj.v_addr + cur_offset)
3645 			    & MMU_PAGEMASK);
3646 #if !defined(__amd64)
3647 			/*
3648 			 * we didn't need to, and will never need to map this
3649 			 * page.
3650 			 */
3651 			dma->dp_pgmap[pidx].pm_mapped = B_FALSE;
3652 #endif
3653 
3654 		/* we don't have a kernel VA. We need one for the bcopy. */
3655 		} else {
3656 #if defined(__amd64)
3657 			/*
3658 			 * for the 64-bit kernel, it's easy. We use seg kpm to
3659 			 * get a Kernel VA for the corresponding pfn.
3660 			 */
3661 			dma->dp_pgmap[pidx].pm_kaddr = hat_kpm_pfn2va(pfn);
3662 #else
3663 			/*
3664 			 * for the 32-bit kernel, this is a pain. First we'll
3665 			 * save away the page_t or user VA for this page. This
3666 			 * is needed in rootnex_dma_win() when we switch to a
3667 			 * new window which requires us to re-map the copy
3668 			 * buffer.
3669 			 */
3670 			pplist = dmar_object->dmao_obj.virt_obj.v_priv;
3671 			if (dmar_object->dmao_type == DMA_OTYP_PAGES) {
3672 				dma->dp_pgmap[pidx].pm_pp = *cur_pp;
3673 				dma->dp_pgmap[pidx].pm_vaddr = NULL;
3674 			} else if (pplist != NULL) {
3675 				dma->dp_pgmap[pidx].pm_pp = pplist[pidx];
3676 				dma->dp_pgmap[pidx].pm_vaddr = NULL;
3677 			} else {
3678 				dma->dp_pgmap[pidx].pm_pp = NULL;
3679 				dma->dp_pgmap[pidx].pm_vaddr = (caddr_t)
3680 				    (((uintptr_t)
3681 				    dmar_object->dmao_obj.virt_obj.v_addr +
3682 				    cur_offset) & MMU_PAGEMASK);
3683 			}
3684 
3685 			/*
3686 			 * save away the page aligned virtual address which was
3687 			 * allocated from the kernel heap arena (taking into
3688 			 * account if we need more copy buffer than we alloced
3689 			 * and use multiple windows to handle this, i.e. &,%).
3690 			 * NOTE: there isn't and physical memory backing up this
3691 			 * virtual address space currently.
3692 			 */
3693 			if ((*copybuf_used + MMU_PAGESIZE) <=
3694 			    dma->dp_copybuf_size) {
3695 				dma->dp_pgmap[pidx].pm_kaddr = (caddr_t)
3696 				    (((uintptr_t)dma->dp_kva + *copybuf_used) &
3697 				    MMU_PAGEMASK);
3698 			} else {
3699 				if (copybuf_sz_power_2) {
3700 					dma->dp_pgmap[pidx].pm_kaddr = (caddr_t)
3701 					    (((uintptr_t)dma->dp_kva +
3702 					    (*copybuf_used &
3703 					    (dma->dp_copybuf_size - 1))) &
3704 					    MMU_PAGEMASK);
3705 				} else {
3706 					dma->dp_pgmap[pidx].pm_kaddr = (caddr_t)
3707 					    (((uintptr_t)dma->dp_kva +
3708 					    (*copybuf_used %
3709 					    dma->dp_copybuf_size)) &
3710 					    MMU_PAGEMASK);
3711 				}
3712 			}
3713 
3714 			/*
3715 			 * if we haven't used up the available copy buffer yet,
3716 			 * map the kva to the physical page.
3717 			 */
3718 			if (!dma->dp_cb_remaping && ((*copybuf_used +
3719 			    MMU_PAGESIZE) <= dma->dp_copybuf_size)) {
3720 				dma->dp_pgmap[pidx].pm_mapped = B_TRUE;
3721 				if (dma->dp_pgmap[pidx].pm_pp != NULL) {
3722 					i86_pp_map(dma->dp_pgmap[pidx].pm_pp,
3723 					    dma->dp_pgmap[pidx].pm_kaddr);
3724 				} else {
3725 					i86_va_map(dma->dp_pgmap[pidx].pm_vaddr,
3726 					    sinfo->si_asp,
3727 					    dma->dp_pgmap[pidx].pm_kaddr);
3728 				}
3729 
3730 			/*
3731 			 * we've used up the available copy buffer, this page
3732 			 * will have to be mapped during rootnex_dma_win() when
3733 			 * we switch to a new window which requires a re-map
3734 			 * the copy buffer. (32-bit kernel only)
3735 			 */
3736 			} else {
3737 				dma->dp_pgmap[pidx].pm_mapped = B_FALSE;
3738 			}
3739 #endif
3740 			/* go to the next page_t */
3741 			if (dmar_object->dmao_type == DMA_OTYP_PAGES) {
3742 				*cur_pp = (*cur_pp)->p_next;
3743 			}
3744 		}
3745 
3746 		/* add to the copy buffer count */
3747 		*copybuf_used += MMU_PAGESIZE;
3748 
3749 	/*
3750 	 * This cookie doesn't use the copy buffer. Walk through the pages this
3751 	 * cookie occupies to reflect this.
3752 	 */
3753 	} else {
3754 		/*
3755 		 * figure out how many pages the cookie occupies. We need to
3756 		 * use the original page offset of the buffer and the cookies
3757 		 * offset in the buffer to do this.
3758 		 */
3759 		poff = (sinfo->si_buf_offset + cur_offset) & MMU_PAGEOFFSET;
3760 		pcnt = mmu_btopr(cookie->dmac_size + poff);
3761 
3762 		while (pcnt > 0) {
3763 #if !defined(__amd64)
3764 			/*
3765 			 * the 32-bit kernel doesn't have seg kpm, so we need
3766 			 * to map in the driver buffer (if it didn't come down
3767 			 * with a kernel VA) on the fly. Since this page doesn't
3768 			 * use the copy buffer, it's not, or will it ever, have
3769 			 * to be mapped in.
3770 			 */
3771 			dma->dp_pgmap[pidx].pm_mapped = B_FALSE;
3772 #endif
3773 			dma->dp_pgmap[pidx].pm_uses_copybuf = B_FALSE;
3774 
3775 			/*
3776 			 * we need to update pidx and cur_pp or we'll loose
3777 			 * track of where we are.
3778 			 */
3779 			if (dmar_object->dmao_type == DMA_OTYP_PAGES) {
3780 				*cur_pp = (*cur_pp)->p_next;
3781 			}
3782 			pidx++;
3783 			pcnt--;
3784 		}
3785 	}
3786 }
3787 
3788 
3789 /*
3790  * rootnex_sgllen_window_boundary()
3791  *    Called in the bind slow path when the next cookie causes us to exceed (in
3792  *    this case == since we start at 0 and sgllen starts at 1) the maximum sgl
3793  *    length supported by the DMA H/W.
3794  */
3795 static int
3796 rootnex_sgllen_window_boundary(ddi_dma_impl_t *hp, rootnex_dma_t *dma,
3797     rootnex_window_t **windowp, ddi_dma_cookie_t *cookie, ddi_dma_attr_t *attr,
3798     off_t cur_offset)
3799 {
3800 	off_t new_offset;
3801 	size_t trim_sz;
3802 	off_t coffset;
3803 
3804 
3805 	/*
3806 	 * if we know we'll never have to trim, it's pretty easy. Just move to
3807 	 * the next window and init it. We're done.
3808 	 */
3809 	if (!dma->dp_trim_required) {
3810 		(*windowp)++;
3811 		rootnex_init_win(hp, dma, *windowp, cookie, cur_offset);
3812 		(*windowp)->wd_cookie_cnt++;
3813 		(*windowp)->wd_size = cookie->dmac_size;
3814 		return (DDI_SUCCESS);
3815 	}
3816 
3817 	/* figure out how much we need to trim from the window */
3818 	ASSERT(attr->dma_attr_granular != 0);
3819 	if (dma->dp_granularity_power_2) {
3820 		trim_sz = (*windowp)->wd_size & (attr->dma_attr_granular - 1);
3821 	} else {
3822 		trim_sz = (*windowp)->wd_size % attr->dma_attr_granular;
3823 	}
3824 
3825 	/* The window's a whole multiple of granularity. We're done */
3826 	if (trim_sz == 0) {
3827 		(*windowp)++;
3828 		rootnex_init_win(hp, dma, *windowp, cookie, cur_offset);
3829 		(*windowp)->wd_cookie_cnt++;
3830 		(*windowp)->wd_size = cookie->dmac_size;
3831 		return (DDI_SUCCESS);
3832 	}
3833 
3834 	/*
3835 	 * The window's not a whole multiple of granularity, since we know this
3836 	 * is due to the sgllen, we need to go back to the last cookie and trim
3837 	 * that one, add the left over part of the old cookie into the new
3838 	 * window, and then add in the new cookie into the new window.
3839 	 */
3840 
3841 	/*
3842 	 * make sure the driver isn't making us do something bad... Trimming and
3843 	 * sgllen == 1 don't go together.
3844 	 */
3845 	if (attr->dma_attr_sgllen == 1) {
3846 		return (DDI_DMA_NOMAPPING);
3847 	}
3848 
3849 	/*
3850 	 * first, setup the current window to account for the trim. Need to go
3851 	 * back to the last cookie for this.
3852 	 */
3853 	cookie--;
3854 	(*windowp)->wd_trim.tr_trim_last = B_TRUE;
3855 	(*windowp)->wd_trim.tr_last_cookie = cookie;
3856 	(*windowp)->wd_trim.tr_last_paddr = cookie->dmac_laddress;
3857 	ASSERT(cookie->dmac_size > trim_sz);
3858 	(*windowp)->wd_trim.tr_last_size = cookie->dmac_size - trim_sz;
3859 	(*windowp)->wd_size -= trim_sz;
3860 
3861 	/* save the buffer offsets for the next window */
3862 	coffset = cookie->dmac_size - trim_sz;
3863 	new_offset = (*windowp)->wd_offset + (*windowp)->wd_size;
3864 
3865 	/*
3866 	 * set this now in case this is the first window. all other cases are
3867 	 * set in dma_win()
3868 	 */
3869 	cookie->dmac_size = (*windowp)->wd_trim.tr_last_size;
3870 
3871 	/*
3872 	 * initialize the next window using what's left over in the previous
3873 	 * cookie.
3874 	 */
3875 	(*windowp)++;
3876 	rootnex_init_win(hp, dma, *windowp, cookie, new_offset);
3877 	(*windowp)->wd_cookie_cnt++;
3878 	(*windowp)->wd_trim.tr_trim_first = B_TRUE;
3879 	(*windowp)->wd_trim.tr_first_paddr = cookie->dmac_laddress + coffset;
3880 	(*windowp)->wd_trim.tr_first_size = trim_sz;
3881 	if (cookie->dmac_type & ROOTNEX_USES_COPYBUF) {
3882 		(*windowp)->wd_dosync = B_TRUE;
3883 	}
3884 
3885 	/*
3886 	 * now go back to the current cookie and add it to the new window. set
3887 	 * the new window size to the what was left over from the previous
3888 	 * cookie and what's in the current cookie.
3889 	 */
3890 	cookie++;
3891 	(*windowp)->wd_cookie_cnt++;
3892 	(*windowp)->wd_size = trim_sz + cookie->dmac_size;
3893 
3894 	/*
3895 	 * trim plus the next cookie could put us over maxxfer (a cookie can be
3896 	 * a max size of maxxfer). Handle that case.
3897 	 */
3898 	if ((*windowp)->wd_size > dma->dp_maxxfer) {
3899 		/*
3900 		 * maxxfer is already a whole multiple of granularity, and this
3901 		 * trim will be <= the previous trim (since a cookie can't be
3902 		 * larger than maxxfer). Make things simple here.
3903 		 */
3904 		trim_sz = (*windowp)->wd_size - dma->dp_maxxfer;
3905 		(*windowp)->wd_trim.tr_trim_last = B_TRUE;
3906 		(*windowp)->wd_trim.tr_last_cookie = cookie;
3907 		(*windowp)->wd_trim.tr_last_paddr = cookie->dmac_laddress;
3908 		(*windowp)->wd_trim.tr_last_size = cookie->dmac_size - trim_sz;
3909 		(*windowp)->wd_size -= trim_sz;
3910 		ASSERT((*windowp)->wd_size == dma->dp_maxxfer);
3911 
3912 		/* save the buffer offsets for the next window */
3913 		coffset = cookie->dmac_size - trim_sz;
3914 		new_offset = (*windowp)->wd_offset + (*windowp)->wd_size;
3915 
3916 		/* setup the next window */
3917 		(*windowp)++;
3918 		rootnex_init_win(hp, dma, *windowp, cookie, new_offset);
3919 		(*windowp)->wd_cookie_cnt++;
3920 		(*windowp)->wd_trim.tr_trim_first = B_TRUE;
3921 		(*windowp)->wd_trim.tr_first_paddr = cookie->dmac_laddress +
3922 		    coffset;
3923 		(*windowp)->wd_trim.tr_first_size = trim_sz;
3924 	}
3925 
3926 	return (DDI_SUCCESS);
3927 }
3928 
3929 
3930 /*
3931  * rootnex_copybuf_window_boundary()
3932  *    Called in bind slowpath when we get to a window boundary because we used
3933  *    up all the copy buffer that we have.
3934  */
3935 static int
3936 rootnex_copybuf_window_boundary(ddi_dma_impl_t *hp, rootnex_dma_t *dma,
3937     rootnex_window_t **windowp, ddi_dma_cookie_t *cookie, off_t cur_offset,
3938     size_t *copybuf_used)
3939 {
3940 	rootnex_sglinfo_t *sinfo;
3941 	off_t new_offset;
3942 	size_t trim_sz;
3943 	paddr_t paddr;
3944 	off_t coffset;
3945 	uint_t pidx;
3946 	off_t poff;
3947 
3948 
3949 	sinfo = &dma->dp_sglinfo;
3950 
3951 	/*
3952 	 * the copy buffer should be a whole multiple of page size. We know that
3953 	 * this cookie is <= MMU_PAGESIZE.
3954 	 */
3955 	ASSERT(cookie->dmac_size <= MMU_PAGESIZE);
3956 
3957 	/*
3958 	 * from now on, all new windows in this bind need to be re-mapped during
3959 	 * ddi_dma_getwin() (32-bit kernel only). i.e. we ran out out copybuf
3960 	 * space...
3961 	 */
3962 #if !defined(__amd64)
3963 	dma->dp_cb_remaping = B_TRUE;
3964 #endif
3965 
3966 	/* reset copybuf used */
3967 	*copybuf_used = 0;
3968 
3969 	/*
3970 	 * if we don't have to trim (since granularity is set to 1), go to the
3971 	 * next window and add the current cookie to it. We know the current
3972 	 * cookie uses the copy buffer since we're in this code path.
3973 	 */
3974 	if (!dma->dp_trim_required) {
3975 		(*windowp)++;
3976 		rootnex_init_win(hp, dma, *windowp, cookie, cur_offset);
3977 
3978 		/* Add this cookie to the new window */
3979 		(*windowp)->wd_cookie_cnt++;
3980 		(*windowp)->wd_size += cookie->dmac_size;
3981 		*copybuf_used += MMU_PAGESIZE;
3982 		return (DDI_SUCCESS);
3983 	}
3984 
3985 	/*
3986 	 * *** may need to trim, figure it out.
3987 	 */
3988 
3989 	/* figure out how much we need to trim from the window */
3990 	if (dma->dp_granularity_power_2) {
3991 		trim_sz = (*windowp)->wd_size &
3992 		    (hp->dmai_attr.dma_attr_granular - 1);
3993 	} else {
3994 		trim_sz = (*windowp)->wd_size % hp->dmai_attr.dma_attr_granular;
3995 	}
3996 
3997 	/*
3998 	 * if the window's a whole multiple of granularity, go to the next
3999 	 * window, init it, then add in the current cookie. We know the current
4000 	 * cookie uses the copy buffer since we're in this code path.
4001 	 */
4002 	if (trim_sz == 0) {
4003 		(*windowp)++;
4004 		rootnex_init_win(hp, dma, *windowp, cookie, cur_offset);
4005 
4006 		/* Add this cookie to the new window */
4007 		(*windowp)->wd_cookie_cnt++;
4008 		(*windowp)->wd_size += cookie->dmac_size;
4009 		*copybuf_used += MMU_PAGESIZE;
4010 		return (DDI_SUCCESS);
4011 	}
4012 
4013 	/*
4014 	 * *** We figured it out, we definitly need to trim
4015 	 */
4016 
4017 	/*
4018 	 * make sure the driver isn't making us do something bad...
4019 	 * Trimming and sgllen == 1 don't go together.
4020 	 */
4021 	if (hp->dmai_attr.dma_attr_sgllen == 1) {
4022 		return (DDI_DMA_NOMAPPING);
4023 	}
4024 
4025 	/*
4026 	 * first, setup the current window to account for the trim. Need to go
4027 	 * back to the last cookie for this. Some of the last cookie will be in
4028 	 * the current window, and some of the last cookie will be in the new
4029 	 * window. All of the current cookie will be in the new window.
4030 	 */
4031 	cookie--;
4032 	(*windowp)->wd_trim.tr_trim_last = B_TRUE;
4033 	(*windowp)->wd_trim.tr_last_cookie = cookie;
4034 	(*windowp)->wd_trim.tr_last_paddr = cookie->dmac_laddress;
4035 	ASSERT(cookie->dmac_size > trim_sz);
4036 	(*windowp)->wd_trim.tr_last_size = cookie->dmac_size - trim_sz;
4037 	(*windowp)->wd_size -= trim_sz;
4038 
4039 	/*
4040 	 * we're trimming the last cookie (not the current cookie). So that
4041 	 * last cookie may have or may not have been using the copy buffer (
4042 	 * we know the cookie passed in uses the copy buffer since we're in
4043 	 * this code path).
4044 	 *
4045 	 * If the last cookie doesn't use the copy buffer, nothing special to
4046 	 * do. However, if it does uses the copy buffer, it will be both the
4047 	 * last page in the current window and the first page in the next
4048 	 * window. Since we are reusing the copy buffer (and KVA space on the
4049 	 * 32-bit kernel), this page will use the end of the copy buffer in the
4050 	 * current window, and the start of the copy buffer in the next window.
4051 	 * Track that info... The cookie physical address was already set to
4052 	 * the copy buffer physical address in setup_cookie..
4053 	 */
4054 	if (cookie->dmac_type & ROOTNEX_USES_COPYBUF) {
4055 		pidx = (sinfo->si_buf_offset + (*windowp)->wd_offset +
4056 		    (*windowp)->wd_size) >> MMU_PAGESHIFT;
4057 		(*windowp)->wd_trim.tr_last_copybuf_win = B_TRUE;
4058 		(*windowp)->wd_trim.tr_last_pidx = pidx;
4059 		(*windowp)->wd_trim.tr_last_cbaddr =
4060 		    dma->dp_pgmap[pidx].pm_cbaddr;
4061 #if !defined(__amd64)
4062 		(*windowp)->wd_trim.tr_last_kaddr =
4063 		    dma->dp_pgmap[pidx].pm_kaddr;
4064 #endif
4065 	}
4066 
4067 	/* save the buffer offsets for the next window */
4068 	coffset = cookie->dmac_size - trim_sz;
4069 	new_offset = (*windowp)->wd_offset + (*windowp)->wd_size;
4070 
4071 	/*
4072 	 * set this now in case this is the first window. all other cases are
4073 	 * set in dma_win()
4074 	 */
4075 	cookie->dmac_size = (*windowp)->wd_trim.tr_last_size;
4076 
4077 	/*
4078 	 * initialize the next window using what's left over in the previous
4079 	 * cookie.
4080 	 */
4081 	(*windowp)++;
4082 	rootnex_init_win(hp, dma, *windowp, cookie, new_offset);
4083 	(*windowp)->wd_cookie_cnt++;
4084 	(*windowp)->wd_trim.tr_trim_first = B_TRUE;
4085 	(*windowp)->wd_trim.tr_first_paddr = cookie->dmac_laddress + coffset;
4086 	(*windowp)->wd_trim.tr_first_size = trim_sz;
4087 
4088 	/*
4089 	 * again, we're tracking if the last cookie uses the copy buffer.
4090 	 * read the comment above for more info on why we need to track
4091 	 * additional state.
4092 	 *
4093 	 * For the first cookie in the new window, we need reset the physical
4094 	 * address to DMA into to the start of the copy buffer plus any
4095 	 * initial page offset which may be present.
4096 	 */
4097 	if (cookie->dmac_type & ROOTNEX_USES_COPYBUF) {
4098 		(*windowp)->wd_dosync = B_TRUE;
4099 		(*windowp)->wd_trim.tr_first_copybuf_win = B_TRUE;
4100 		(*windowp)->wd_trim.tr_first_pidx = pidx;
4101 		(*windowp)->wd_trim.tr_first_cbaddr = dma->dp_cbaddr;
4102 		poff = (*windowp)->wd_trim.tr_first_paddr & MMU_PAGEOFFSET;
4103 
4104 		paddr = pfn_to_pa(hat_getpfnum(kas.a_hat, dma->dp_cbaddr)) +
4105 		    poff;
4106 #ifdef __xpv
4107 		/*
4108 		 * If we're dom0, we're using a real device so we need to load
4109 		 * the cookies with MAs instead of PAs.
4110 		 */
4111 		(*windowp)->wd_trim.tr_first_paddr =
4112 		    ROOTNEX_PADDR_TO_RBASE(xen_info, paddr);
4113 #else
4114 		(*windowp)->wd_trim.tr_first_paddr = paddr;
4115 #endif
4116 
4117 #if !defined(__amd64)
4118 		(*windowp)->wd_trim.tr_first_kaddr = dma->dp_kva;
4119 #endif
4120 		/* account for the cookie copybuf usage in the new window */
4121 		*copybuf_used += MMU_PAGESIZE;
4122 
4123 		/*
4124 		 * every piece of code has to have a hack, and here is this
4125 		 * ones :-)
4126 		 *
4127 		 * There is a complex interaction between setup_cookie and the
4128 		 * copybuf window boundary. The complexity had to be in either
4129 		 * the maxxfer window, or the copybuf window, and I chose the
4130 		 * copybuf code.
4131 		 *
4132 		 * So in this code path, we have taken the last cookie,
4133 		 * virtually broken it in half due to the trim, and it happens
4134 		 * to use the copybuf which further complicates life. At the
4135 		 * same time, we have already setup the current cookie, which
4136 		 * is now wrong. More background info: the current cookie uses
4137 		 * the copybuf, so it is only a page long max. So we need to
4138 		 * fix the current cookies copy buffer address, physical
4139 		 * address, and kva for the 32-bit kernel. We due this by
4140 		 * bumping them by page size (of course, we can't due this on
4141 		 * the physical address since the copy buffer may not be
4142 		 * physically contiguous).
4143 		 */
4144 		cookie++;
4145 		dma->dp_pgmap[pidx + 1].pm_cbaddr += MMU_PAGESIZE;
4146 		poff = cookie->dmac_laddress & MMU_PAGEOFFSET;
4147 
4148 		paddr = pfn_to_pa(hat_getpfnum(kas.a_hat,
4149 		    dma->dp_pgmap[pidx + 1].pm_cbaddr)) + poff;
4150 #ifdef __xpv
4151 		/*
4152 		 * If we're dom0, we're using a real device so we need to load
4153 		 * the cookies with MAs instead of PAs.
4154 		 */
4155 		cookie->dmac_laddress = ROOTNEX_PADDR_TO_RBASE(xen_info, paddr);
4156 #else
4157 		cookie->dmac_laddress = paddr;
4158 #endif
4159 
4160 #if !defined(__amd64)
4161 		ASSERT(dma->dp_pgmap[pidx + 1].pm_mapped == B_FALSE);
4162 		dma->dp_pgmap[pidx + 1].pm_kaddr += MMU_PAGESIZE;
4163 #endif
4164 	} else {
4165 		/* go back to the current cookie */
4166 		cookie++;
4167 	}
4168 
4169 	/*
4170 	 * add the current cookie to the new window. set the new window size to
4171 	 * the what was left over from the previous cookie and what's in the
4172 	 * current cookie.
4173 	 */
4174 	(*windowp)->wd_cookie_cnt++;
4175 	(*windowp)->wd_size = trim_sz + cookie->dmac_size;
4176 	ASSERT((*windowp)->wd_size < dma->dp_maxxfer);
4177 
4178 	/*
4179 	 * we know that the cookie passed in always uses the copy buffer. We
4180 	 * wouldn't be here if it didn't.
4181 	 */
4182 	*copybuf_used += MMU_PAGESIZE;
4183 
4184 	return (DDI_SUCCESS);
4185 }
4186 
4187 
4188 /*
4189  * rootnex_maxxfer_window_boundary()
4190  *    Called in bind slowpath when we get to a window boundary because we will
4191  *    go over maxxfer.
4192  */
4193 static int
4194 rootnex_maxxfer_window_boundary(ddi_dma_impl_t *hp, rootnex_dma_t *dma,
4195     rootnex_window_t **windowp, ddi_dma_cookie_t *cookie)
4196 {
4197 	size_t dmac_size;
4198 	off_t new_offset;
4199 	size_t trim_sz;
4200 	off_t coffset;
4201 
4202 
4203 	/*
4204 	 * calculate how much we have to trim off of the current cookie to equal
4205 	 * maxxfer. We don't have to account for granularity here since our
4206 	 * maxxfer already takes that into account.
4207 	 */
4208 	trim_sz = ((*windowp)->wd_size + cookie->dmac_size) - dma->dp_maxxfer;
4209 	ASSERT(trim_sz <= cookie->dmac_size);
4210 	ASSERT(trim_sz <= dma->dp_maxxfer);
4211 
4212 	/* save cookie size since we need it later and we might change it */
4213 	dmac_size = cookie->dmac_size;
4214 
4215 	/*
4216 	 * if we're not trimming the entire cookie, setup the current window to
4217 	 * account for the trim.
4218 	 */
4219 	if (trim_sz < cookie->dmac_size) {
4220 		(*windowp)->wd_cookie_cnt++;
4221 		(*windowp)->wd_trim.tr_trim_last = B_TRUE;
4222 		(*windowp)->wd_trim.tr_last_cookie = cookie;
4223 		(*windowp)->wd_trim.tr_last_paddr = cookie->dmac_laddress;
4224 		(*windowp)->wd_trim.tr_last_size = cookie->dmac_size - trim_sz;
4225 		(*windowp)->wd_size = dma->dp_maxxfer;
4226 
4227 		/*
4228 		 * set the adjusted cookie size now in case this is the first
4229 		 * window. All other windows are taken care of in get win
4230 		 */
4231 		cookie->dmac_size = (*windowp)->wd_trim.tr_last_size;
4232 	}
4233 
4234 	/*
4235 	 * coffset is the current offset within the cookie, new_offset is the
4236 	 * current offset with the entire buffer.
4237 	 */
4238 	coffset = dmac_size - trim_sz;
4239 	new_offset = (*windowp)->wd_offset + (*windowp)->wd_size;
4240 
4241 	/* initialize the next window */
4242 	(*windowp)++;
4243 	rootnex_init_win(hp, dma, *windowp, cookie, new_offset);
4244 	(*windowp)->wd_cookie_cnt++;
4245 	(*windowp)->wd_size = trim_sz;
4246 	if (trim_sz < dmac_size) {
4247 		(*windowp)->wd_trim.tr_trim_first = B_TRUE;
4248 		(*windowp)->wd_trim.tr_first_paddr = cookie->dmac_laddress +
4249 		    coffset;
4250 		(*windowp)->wd_trim.tr_first_size = trim_sz;
4251 	}
4252 
4253 	return (DDI_SUCCESS);
4254 }
4255 
4256 
4257 /*ARGSUSED*/
4258 static int
4259 rootnex_coredma_sync(dev_info_t *dip, dev_info_t *rdip, ddi_dma_handle_t handle,
4260     off_t off, size_t len, uint_t cache_flags)
4261 {
4262 	rootnex_sglinfo_t *sinfo;
4263 	rootnex_pgmap_t *cbpage;
4264 	rootnex_window_t *win;
4265 	ddi_dma_impl_t *hp;
4266 	rootnex_dma_t *dma;
4267 	caddr_t fromaddr;
4268 	caddr_t toaddr;
4269 	uint_t psize;
4270 	off_t offset;
4271 	uint_t pidx;
4272 	size_t size;
4273 	off_t poff;
4274 	int e;
4275 
4276 
4277 	hp = (ddi_dma_impl_t *)handle;
4278 	dma = (rootnex_dma_t *)hp->dmai_private;
4279 	sinfo = &dma->dp_sglinfo;
4280 
4281 	/*
4282 	 * if we don't have any windows, we don't need to sync. A copybuf
4283 	 * will cause us to have at least one window.
4284 	 */
4285 	if (dma->dp_window == NULL) {
4286 		return (DDI_SUCCESS);
4287 	}
4288 
4289 	/* This window may not need to be sync'd */
4290 	win = &dma->dp_window[dma->dp_current_win];
4291 	if (!win->wd_dosync) {
4292 		return (DDI_SUCCESS);
4293 	}
4294 
4295 	/* handle off and len special cases */
4296 	if ((off == 0) || (rootnex_sync_ignore_params)) {
4297 		offset = win->wd_offset;
4298 	} else {
4299 		offset = off;
4300 	}
4301 	if ((len == 0) || (rootnex_sync_ignore_params)) {
4302 		size = win->wd_size;
4303 	} else {
4304 		size = len;
4305 	}
4306 
4307 	/* check the sync args to make sure they make a little sense */
4308 	if (rootnex_sync_check_parms) {
4309 		e = rootnex_valid_sync_parms(hp, win, offset, size,
4310 		    cache_flags);
4311 		if (e != DDI_SUCCESS) {
4312 			ROOTNEX_PROF_INC(&rootnex_cnt[ROOTNEX_CNT_SYNC_FAIL]);
4313 			return (DDI_FAILURE);
4314 		}
4315 	}
4316 
4317 	/*
4318 	 * special case the first page to handle the offset into the page. The
4319 	 * offset to the current page for our buffer is the offset into the
4320 	 * first page of the buffer plus our current offset into the buffer
4321 	 * itself, masked of course.
4322 	 */
4323 	poff = (sinfo->si_buf_offset + offset) & MMU_PAGEOFFSET;
4324 	psize = MIN((MMU_PAGESIZE - poff), size);
4325 
4326 	/* go through all the pages that we want to sync */
4327 	while (size > 0) {
4328 		/*
4329 		 * Calculate the page index relative to the start of the buffer.
4330 		 * The index to the current page for our buffer is the offset
4331 		 * into the first page of the buffer plus our current offset
4332 		 * into the buffer itself, shifted of course...
4333 		 */
4334 		pidx = (sinfo->si_buf_offset + offset) >> MMU_PAGESHIFT;
4335 		ASSERT(pidx < sinfo->si_max_pages);
4336 
4337 		/*
4338 		 * if this page uses the copy buffer, we need to sync it,
4339 		 * otherwise, go on to the next page.
4340 		 */
4341 		cbpage = &dma->dp_pgmap[pidx];
4342 		ASSERT((cbpage->pm_uses_copybuf == B_TRUE) ||
4343 		    (cbpage->pm_uses_copybuf == B_FALSE));
4344 		if (cbpage->pm_uses_copybuf) {
4345 			/* cbaddr and kaddr should be page aligned */
4346 			ASSERT(((uintptr_t)cbpage->pm_cbaddr &
4347 			    MMU_PAGEOFFSET) == 0);
4348 			ASSERT(((uintptr_t)cbpage->pm_kaddr &
4349 			    MMU_PAGEOFFSET) == 0);
4350 
4351 			/*
4352 			 * if we're copying for the device, we are going to
4353 			 * copy from the drivers buffer and to the rootnex
4354 			 * allocated copy buffer.
4355 			 */
4356 			if (cache_flags == DDI_DMA_SYNC_FORDEV) {
4357 				fromaddr = cbpage->pm_kaddr + poff;
4358 				toaddr = cbpage->pm_cbaddr + poff;
4359 				DTRACE_PROBE2(rootnex__sync__dev,
4360 				    dev_info_t *, dma->dp_dip, size_t, psize);
4361 
4362 			/*
4363 			 * if we're copying for the cpu/kernel, we are going to
4364 			 * copy from the rootnex allocated copy buffer to the
4365 			 * drivers buffer.
4366 			 */
4367 			} else {
4368 				fromaddr = cbpage->pm_cbaddr + poff;
4369 				toaddr = cbpage->pm_kaddr + poff;
4370 				DTRACE_PROBE2(rootnex__sync__cpu,
4371 				    dev_info_t *, dma->dp_dip, size_t, psize);
4372 			}
4373 
4374 			bcopy(fromaddr, toaddr, psize);
4375 		}
4376 
4377 		/*
4378 		 * decrement size until we're done, update our offset into the
4379 		 * buffer, and get the next page size.
4380 		 */
4381 		size -= psize;
4382 		offset += psize;
4383 		psize = MIN(MMU_PAGESIZE, size);
4384 
4385 		/* page offset is zero for the rest of this loop */
4386 		poff = 0;
4387 	}
4388 
4389 	return (DDI_SUCCESS);
4390 }
4391 
4392 /*
4393  * rootnex_dma_sync()
4394  *    called from ddi_dma_sync() if DMP_NOSYNC is not set in hp->dmai_rflags.
4395  *    We set DMP_NOSYNC if we're not using the copy buffer. If DMP_NOSYNC
4396  *    is set, ddi_dma_sync() returns immediately passing back success.
4397  */
4398 /*ARGSUSED*/
4399 static int
4400 rootnex_dma_sync(dev_info_t *dip, dev_info_t *rdip, ddi_dma_handle_t handle,
4401     off_t off, size_t len, uint_t cache_flags)
4402 {
4403 #if defined(__amd64) && !defined(__xpv)
4404 	if (IOMMU_USED(rdip)) {
4405 		return (iommulib_nexdma_sync(dip, rdip, handle, off, len,
4406 		    cache_flags));
4407 	}
4408 #endif
4409 	return (rootnex_coredma_sync(dip, rdip, handle, off, len,
4410 	    cache_flags));
4411 }
4412 
4413 /*
4414  * rootnex_valid_sync_parms()
4415  *    checks the parameters passed to sync to verify they are correct.
4416  */
4417 static int
4418 rootnex_valid_sync_parms(ddi_dma_impl_t *hp, rootnex_window_t *win,
4419     off_t offset, size_t size, uint_t cache_flags)
4420 {
4421 	off_t woffset;
4422 
4423 
4424 	/*
4425 	 * the first part of the test to make sure the offset passed in is
4426 	 * within the window.
4427 	 */
4428 	if (offset < win->wd_offset) {
4429 		return (DDI_FAILURE);
4430 	}
4431 
4432 	/*
4433 	 * second and last part of the test to make sure the offset and length
4434 	 * passed in is within the window.
4435 	 */
4436 	woffset = offset - win->wd_offset;
4437 	if ((woffset + size) > win->wd_size) {
4438 		return (DDI_FAILURE);
4439 	}
4440 
4441 	/*
4442 	 * if we are sync'ing for the device, the DDI_DMA_WRITE flag should
4443 	 * be set too.
4444 	 */
4445 	if ((cache_flags == DDI_DMA_SYNC_FORDEV) &&
4446 	    (hp->dmai_rflags & DDI_DMA_WRITE)) {
4447 		return (DDI_SUCCESS);
4448 	}
4449 
4450 	/*
4451 	 * at this point, either DDI_DMA_SYNC_FORCPU or DDI_DMA_SYNC_FORKERNEL
4452 	 * should be set. Also DDI_DMA_READ should be set in the flags.
4453 	 */
4454 	if (((cache_flags == DDI_DMA_SYNC_FORCPU) ||
4455 	    (cache_flags == DDI_DMA_SYNC_FORKERNEL)) &&
4456 	    (hp->dmai_rflags & DDI_DMA_READ)) {
4457 		return (DDI_SUCCESS);
4458 	}
4459 
4460 	return (DDI_FAILURE);
4461 }
4462 
4463 
4464 /*ARGSUSED*/
4465 static int
4466 rootnex_coredma_win(dev_info_t *dip, dev_info_t *rdip, ddi_dma_handle_t handle,
4467     uint_t win, off_t *offp, size_t *lenp, ddi_dma_cookie_t *cookiep,
4468     uint_t *ccountp)
4469 {
4470 	rootnex_window_t *window;
4471 	rootnex_trim_t *trim;
4472 	ddi_dma_impl_t *hp;
4473 	rootnex_dma_t *dma;
4474 #if !defined(__amd64)
4475 	rootnex_sglinfo_t *sinfo;
4476 	rootnex_pgmap_t *pmap;
4477 	uint_t pidx;
4478 	uint_t pcnt;
4479 	off_t poff;
4480 	int i;
4481 #endif
4482 
4483 
4484 	hp = (ddi_dma_impl_t *)handle;
4485 	dma = (rootnex_dma_t *)hp->dmai_private;
4486 #if !defined(__amd64)
4487 	sinfo = &dma->dp_sglinfo;
4488 #endif
4489 
4490 	/* If we try and get a window which doesn't exist, return failure */
4491 	if (win >= hp->dmai_nwin) {
4492 		ROOTNEX_PROF_INC(&rootnex_cnt[ROOTNEX_CNT_GETWIN_FAIL]);
4493 		return (DDI_FAILURE);
4494 	}
4495 
4496 	/*
4497 	 * if we don't have any windows, and they're asking for the first
4498 	 * window, setup the cookie pointer to the first cookie in the bind.
4499 	 * setup our return values, then increment the cookie since we return
4500 	 * the first cookie on the stack.
4501 	 */
4502 	if (dma->dp_window == NULL) {
4503 		if (win != 0) {
4504 			ROOTNEX_PROF_INC(&rootnex_cnt[ROOTNEX_CNT_GETWIN_FAIL]);
4505 			return (DDI_FAILURE);
4506 		}
4507 		hp->dmai_cookie = dma->dp_cookies;
4508 		*offp = 0;
4509 		*lenp = dma->dp_dma.dmao_size;
4510 		*ccountp = dma->dp_sglinfo.si_sgl_size;
4511 		*cookiep = hp->dmai_cookie[0];
4512 		hp->dmai_cookie++;
4513 		return (DDI_SUCCESS);
4514 	}
4515 
4516 	/* sync the old window before moving on to the new one */
4517 	window = &dma->dp_window[dma->dp_current_win];
4518 	if ((window->wd_dosync) && (hp->dmai_rflags & DDI_DMA_READ)) {
4519 		(void) rootnex_coredma_sync(dip, rdip, handle, 0, 0,
4520 		    DDI_DMA_SYNC_FORCPU);
4521 	}
4522 
4523 #if !defined(__amd64)
4524 	/*
4525 	 * before we move to the next window, if we need to re-map, unmap all
4526 	 * the pages in this window.
4527 	 */
4528 	if (dma->dp_cb_remaping) {
4529 		/*
4530 		 * If we switch to this window again, we'll need to map in
4531 		 * on the fly next time.
4532 		 */
4533 		window->wd_remap_copybuf = B_TRUE;
4534 
4535 		/*
4536 		 * calculate the page index into the buffer where this window
4537 		 * starts, and the number of pages this window takes up.
4538 		 */
4539 		pidx = (sinfo->si_buf_offset + window->wd_offset) >>
4540 		    MMU_PAGESHIFT;
4541 		poff = (sinfo->si_buf_offset + window->wd_offset) &
4542 		    MMU_PAGEOFFSET;
4543 		pcnt = mmu_btopr(window->wd_size + poff);
4544 		ASSERT((pidx + pcnt) <= sinfo->si_max_pages);
4545 
4546 		/* unmap pages which are currently mapped in this window */
4547 		for (i = 0; i < pcnt; i++) {
4548 			if (dma->dp_pgmap[pidx].pm_mapped) {
4549 				hat_unload(kas.a_hat,
4550 				    dma->dp_pgmap[pidx].pm_kaddr, MMU_PAGESIZE,
4551 				    HAT_UNLOAD);
4552 				dma->dp_pgmap[pidx].pm_mapped = B_FALSE;
4553 			}
4554 			pidx++;
4555 		}
4556 	}
4557 #endif
4558 
4559 	/*
4560 	 * Move to the new window.
4561 	 * NOTE: current_win must be set for sync to work right
4562 	 */
4563 	dma->dp_current_win = win;
4564 	window = &dma->dp_window[win];
4565 
4566 	/* if needed, adjust the first and/or last cookies for trim */
4567 	trim = &window->wd_trim;
4568 	if (trim->tr_trim_first) {
4569 		window->wd_first_cookie->dmac_laddress = trim->tr_first_paddr;
4570 		window->wd_first_cookie->dmac_size = trim->tr_first_size;
4571 #if !defined(__amd64)
4572 		window->wd_first_cookie->dmac_type =
4573 		    (window->wd_first_cookie->dmac_type &
4574 		    ROOTNEX_USES_COPYBUF) + window->wd_offset;
4575 #endif
4576 		if (trim->tr_first_copybuf_win) {
4577 			dma->dp_pgmap[trim->tr_first_pidx].pm_cbaddr =
4578 			    trim->tr_first_cbaddr;
4579 #if !defined(__amd64)
4580 			dma->dp_pgmap[trim->tr_first_pidx].pm_kaddr =
4581 			    trim->tr_first_kaddr;
4582 #endif
4583 		}
4584 	}
4585 	if (trim->tr_trim_last) {
4586 		trim->tr_last_cookie->dmac_laddress = trim->tr_last_paddr;
4587 		trim->tr_last_cookie->dmac_size = trim->tr_last_size;
4588 		if (trim->tr_last_copybuf_win) {
4589 			dma->dp_pgmap[trim->tr_last_pidx].pm_cbaddr =
4590 			    trim->tr_last_cbaddr;
4591 #if !defined(__amd64)
4592 			dma->dp_pgmap[trim->tr_last_pidx].pm_kaddr =
4593 			    trim->tr_last_kaddr;
4594 #endif
4595 		}
4596 	}
4597 
4598 	/*
4599 	 * setup the cookie pointer to the first cookie in the window. setup
4600 	 * our return values, then increment the cookie since we return the
4601 	 * first cookie on the stack.
4602 	 */
4603 	hp->dmai_cookie = window->wd_first_cookie;
4604 	*offp = window->wd_offset;
4605 	*lenp = window->wd_size;
4606 	*ccountp = window->wd_cookie_cnt;
4607 	*cookiep = hp->dmai_cookie[0];
4608 	hp->dmai_cookie++;
4609 
4610 #if !defined(__amd64)
4611 	/* re-map copybuf if required for this window */
4612 	if (dma->dp_cb_remaping) {
4613 		/*
4614 		 * calculate the page index into the buffer where this
4615 		 * window starts.
4616 		 */
4617 		pidx = (sinfo->si_buf_offset + window->wd_offset) >>
4618 		    MMU_PAGESHIFT;
4619 		ASSERT(pidx < sinfo->si_max_pages);
4620 
4621 		/*
4622 		 * the first page can get unmapped if it's shared with the
4623 		 * previous window. Even if the rest of this window is already
4624 		 * mapped in, we need to still check this one.
4625 		 */
4626 		pmap = &dma->dp_pgmap[pidx];
4627 		if ((pmap->pm_uses_copybuf) && (pmap->pm_mapped == B_FALSE)) {
4628 			if (pmap->pm_pp != NULL) {
4629 				pmap->pm_mapped = B_TRUE;
4630 				i86_pp_map(pmap->pm_pp, pmap->pm_kaddr);
4631 			} else if (pmap->pm_vaddr != NULL) {
4632 				pmap->pm_mapped = B_TRUE;
4633 				i86_va_map(pmap->pm_vaddr, sinfo->si_asp,
4634 				    pmap->pm_kaddr);
4635 			}
4636 		}
4637 		pidx++;
4638 
4639 		/* map in the rest of the pages if required */
4640 		if (window->wd_remap_copybuf) {
4641 			window->wd_remap_copybuf = B_FALSE;
4642 
4643 			/* figure out many pages this window takes up */
4644 			poff = (sinfo->si_buf_offset + window->wd_offset) &
4645 			    MMU_PAGEOFFSET;
4646 			pcnt = mmu_btopr(window->wd_size + poff);
4647 			ASSERT(((pidx - 1) + pcnt) <= sinfo->si_max_pages);
4648 
4649 			/* map pages which require it */
4650 			for (i = 1; i < pcnt; i++) {
4651 				pmap = &dma->dp_pgmap[pidx];
4652 				if (pmap->pm_uses_copybuf) {
4653 					ASSERT(pmap->pm_mapped == B_FALSE);
4654 					if (pmap->pm_pp != NULL) {
4655 						pmap->pm_mapped = B_TRUE;
4656 						i86_pp_map(pmap->pm_pp,
4657 						    pmap->pm_kaddr);
4658 					} else if (pmap->pm_vaddr != NULL) {
4659 						pmap->pm_mapped = B_TRUE;
4660 						i86_va_map(pmap->pm_vaddr,
4661 						    sinfo->si_asp,
4662 						    pmap->pm_kaddr);
4663 					}
4664 				}
4665 				pidx++;
4666 			}
4667 		}
4668 	}
4669 #endif
4670 
4671 	/* if the new window uses the copy buffer, sync it for the device */
4672 	if ((window->wd_dosync) && (hp->dmai_rflags & DDI_DMA_WRITE)) {
4673 		(void) rootnex_coredma_sync(dip, rdip, handle, 0, 0,
4674 		    DDI_DMA_SYNC_FORDEV);
4675 	}
4676 
4677 	return (DDI_SUCCESS);
4678 }
4679 
4680 /*
4681  * rootnex_dma_win()
4682  *    called from ddi_dma_getwin()
4683  */
4684 /*ARGSUSED*/
4685 static int
4686 rootnex_dma_win(dev_info_t *dip, dev_info_t *rdip, ddi_dma_handle_t handle,
4687     uint_t win, off_t *offp, size_t *lenp, ddi_dma_cookie_t *cookiep,
4688     uint_t *ccountp)
4689 {
4690 #if defined(__amd64) && !defined(__xpv)
4691 	if (IOMMU_USED(rdip)) {
4692 		return (iommulib_nexdma_win(dip, rdip, handle, win, offp, lenp,
4693 		    cookiep, ccountp));
4694 	}
4695 #endif
4696 
4697 	return (rootnex_coredma_win(dip, rdip, handle, win, offp, lenp,
4698 	    cookiep, ccountp));
4699 }
4700 
4701 /*
4702  * ************************
4703  *  obsoleted dma routines
4704  * ************************
4705  */
4706 
4707 /*
4708  * rootnex_dma_map()
4709  *    called from ddi_dma_setup()
4710  * NO IOMMU in 32 bit mode. The below routines doesn't work in 64 bit mode.
4711  */
4712 /* ARGSUSED */
4713 static int
4714 rootnex_dma_map(dev_info_t *dip, dev_info_t *rdip,
4715     struct ddi_dma_req *dmareq, ddi_dma_handle_t *handlep)
4716 {
4717 #if defined(__amd64)
4718 	/*
4719 	 * this interface is not supported in 64-bit x86 kernel. See comment in
4720 	 * rootnex_dma_mctl()
4721 	 */
4722 	return (DDI_DMA_NORESOURCES);
4723 
4724 #else /* 32-bit x86 kernel */
4725 	ddi_dma_handle_t *lhandlep;
4726 	ddi_dma_handle_t lhandle;
4727 	ddi_dma_cookie_t cookie;
4728 	ddi_dma_attr_t dma_attr;
4729 	ddi_dma_lim_t *dma_lim;
4730 	uint_t ccnt;
4731 	int e;
4732 
4733 
4734 	/*
4735 	 * if the driver is just testing to see if it's possible to do the bind,
4736 	 * we'll use local state. Otherwise, use the handle pointer passed in.
4737 	 */
4738 	if (handlep == NULL) {
4739 		lhandlep = &lhandle;
4740 	} else {
4741 		lhandlep = handlep;
4742 	}
4743 
4744 	/* convert the limit structure to a dma_attr one */
4745 	dma_lim = dmareq->dmar_limits;
4746 	dma_attr.dma_attr_version = DMA_ATTR_V0;
4747 	dma_attr.dma_attr_addr_lo = dma_lim->dlim_addr_lo;
4748 	dma_attr.dma_attr_addr_hi = dma_lim->dlim_addr_hi;
4749 	dma_attr.dma_attr_minxfer = dma_lim->dlim_minxfer;
4750 	dma_attr.dma_attr_seg = dma_lim->dlim_adreg_max;
4751 	dma_attr.dma_attr_count_max = dma_lim->dlim_ctreg_max;
4752 	dma_attr.dma_attr_granular = dma_lim->dlim_granular;
4753 	dma_attr.dma_attr_sgllen = dma_lim->dlim_sgllen;
4754 	dma_attr.dma_attr_maxxfer = dma_lim->dlim_reqsize;
4755 	dma_attr.dma_attr_burstsizes = dma_lim->dlim_burstsizes;
4756 	dma_attr.dma_attr_align = MMU_PAGESIZE;
4757 	dma_attr.dma_attr_flags = 0;
4758 
4759 	e = rootnex_dma_allochdl(dip, rdip, &dma_attr, dmareq->dmar_fp,
4760 	    dmareq->dmar_arg, lhandlep);
4761 	if (e != DDI_SUCCESS) {
4762 		return (e);
4763 	}
4764 
4765 	e = rootnex_dma_bindhdl(dip, rdip, *lhandlep, dmareq, &cookie, &ccnt);
4766 	if ((e != DDI_DMA_MAPPED) && (e != DDI_DMA_PARTIAL_MAP)) {
4767 		(void) rootnex_dma_freehdl(dip, rdip, *lhandlep);
4768 		return (e);
4769 	}
4770 
4771 	/*
4772 	 * if the driver is just testing to see if it's possible to do the bind,
4773 	 * free up the local state and return the result.
4774 	 */
4775 	if (handlep == NULL) {
4776 		(void) rootnex_dma_unbindhdl(dip, rdip, *lhandlep);
4777 		(void) rootnex_dma_freehdl(dip, rdip, *lhandlep);
4778 		if (e == DDI_DMA_MAPPED) {
4779 			return (DDI_DMA_MAPOK);
4780 		} else {
4781 			return (DDI_DMA_NOMAPPING);
4782 		}
4783 	}
4784 
4785 	return (e);
4786 #endif /* defined(__amd64) */
4787 }
4788 
4789 /*
4790  * rootnex_dma_mctl()
4791  *
4792  * No IOMMU in 32 bit mode. The below routine doesn't work in 64 bit mode.
4793  */
4794 /* ARGSUSED */
4795 static int
4796 rootnex_dma_mctl(dev_info_t *dip, dev_info_t *rdip, ddi_dma_handle_t handle,
4797     enum ddi_dma_ctlops request, off_t *offp, size_t *lenp, caddr_t *objpp,
4798     uint_t cache_flags)
4799 {
4800 #if defined(__amd64)
4801 	/*
4802 	 * DDI_DMA_SMEM_ALLOC & DDI_DMA_IOPB_ALLOC we're changed to have a
4803 	 * common implementation in genunix, so they no longer have x86
4804 	 * specific functionality which called into dma_ctl.
4805 	 *
4806 	 * The rest of the obsoleted interfaces were never supported in the
4807 	 * 64-bit x86 kernel. For s10, the obsoleted DDI_DMA_SEGTOC interface
4808 	 * was not ported to the x86 64-bit kernel do to serious x86 rootnex
4809 	 * implementation issues.
4810 	 *
4811 	 * If you can't use DDI_DMA_SEGTOC; DDI_DMA_NEXTSEG, DDI_DMA_FREE, and
4812 	 * DDI_DMA_NEXTWIN are useless since you can get to the cookie, so we
4813 	 * reflect that now too...
4814 	 *
4815 	 * Even though we fixed the pointer problem in DDI_DMA_SEGTOC, we are
4816 	 * not going to put this functionality into the 64-bit x86 kernel now.
4817 	 * It wasn't ported to the 64-bit kernel for s10, no reason to change
4818 	 * that in a future release.
4819 	 */
4820 	return (DDI_FAILURE);
4821 
4822 #else /* 32-bit x86 kernel */
4823 	ddi_dma_cookie_t lcookie;
4824 	ddi_dma_cookie_t *cookie;
4825 	rootnex_window_t *window;
4826 	ddi_dma_impl_t *hp;
4827 	rootnex_dma_t *dma;
4828 	uint_t nwin;
4829 	uint_t ccnt;
4830 	size_t len;
4831 	off_t off;
4832 	int e;
4833 
4834 
4835 	/*
4836 	 * DDI_DMA_SEGTOC, DDI_DMA_NEXTSEG, and DDI_DMA_NEXTWIN are a little
4837 	 * hacky since were optimizing for the current interfaces and so we can
4838 	 * cleanup the mess in genunix. Hopefully we will remove the this
4839 	 * obsoleted routines someday soon.
4840 	 */
4841 
4842 	switch (request) {
4843 
4844 	case DDI_DMA_SEGTOC: /* ddi_dma_segtocookie() */
4845 		hp = (ddi_dma_impl_t *)handle;
4846 		cookie = (ddi_dma_cookie_t *)objpp;
4847 
4848 		/*
4849 		 * convert segment to cookie. We don't distinguish between the
4850 		 * two :-)
4851 		 */
4852 		*cookie = *hp->dmai_cookie;
4853 		*lenp = cookie->dmac_size;
4854 		*offp = cookie->dmac_type & ~ROOTNEX_USES_COPYBUF;
4855 		return (DDI_SUCCESS);
4856 
4857 	case DDI_DMA_NEXTSEG: /* ddi_dma_nextseg() */
4858 		hp = (ddi_dma_impl_t *)handle;
4859 		dma = (rootnex_dma_t *)hp->dmai_private;
4860 
4861 		if ((*lenp != NULL) && ((uintptr_t)*lenp != (uintptr_t)hp)) {
4862 			return (DDI_DMA_STALE);
4863 		}
4864 
4865 		/* handle the case where we don't have any windows */
4866 		if (dma->dp_window == NULL) {
4867 			/*
4868 			 * if seg == NULL, and we don't have any windows,
4869 			 * return the first cookie in the sgl.
4870 			 */
4871 			if (*lenp == NULL) {
4872 				dma->dp_current_cookie = 0;
4873 				hp->dmai_cookie = dma->dp_cookies;
4874 				*objpp = (caddr_t)handle;
4875 				return (DDI_SUCCESS);
4876 
4877 			/* if we have more cookies, go to the next cookie */
4878 			} else {
4879 				if ((dma->dp_current_cookie + 1) >=
4880 				    dma->dp_sglinfo.si_sgl_size) {
4881 					return (DDI_DMA_DONE);
4882 				}
4883 				dma->dp_current_cookie++;
4884 				hp->dmai_cookie++;
4885 				return (DDI_SUCCESS);
4886 			}
4887 		}
4888 
4889 		/* We have one or more windows */
4890 		window = &dma->dp_window[dma->dp_current_win];
4891 
4892 		/*
4893 		 * if seg == NULL, return the first cookie in the current
4894 		 * window
4895 		 */
4896 		if (*lenp == NULL) {
4897 			dma->dp_current_cookie = 0;
4898 			hp->dmai_cookie = window->wd_first_cookie;
4899 
4900 		/*
4901 		 * go to the next cookie in the window then see if we done with
4902 		 * this window.
4903 		 */
4904 		} else {
4905 			if ((dma->dp_current_cookie + 1) >=
4906 			    window->wd_cookie_cnt) {
4907 				return (DDI_DMA_DONE);
4908 			}
4909 			dma->dp_current_cookie++;
4910 			hp->dmai_cookie++;
4911 		}
4912 		*objpp = (caddr_t)handle;
4913 		return (DDI_SUCCESS);
4914 
4915 	case DDI_DMA_NEXTWIN: /* ddi_dma_nextwin() */
4916 		hp = (ddi_dma_impl_t *)handle;
4917 		dma = (rootnex_dma_t *)hp->dmai_private;
4918 
4919 		if ((*offp != NULL) && ((uintptr_t)*offp != (uintptr_t)hp)) {
4920 			return (DDI_DMA_STALE);
4921 		}
4922 
4923 		/* if win == NULL, return the first window in the bind */
4924 		if (*offp == NULL) {
4925 			nwin = 0;
4926 
4927 		/*
4928 		 * else, go to the next window then see if we're done with all
4929 		 * the windows.
4930 		 */
4931 		} else {
4932 			nwin = dma->dp_current_win + 1;
4933 			if (nwin >= hp->dmai_nwin) {
4934 				return (DDI_DMA_DONE);
4935 			}
4936 		}
4937 
4938 		/* switch to the next window */
4939 		e = rootnex_dma_win(dip, rdip, handle, nwin, &off, &len,
4940 		    &lcookie, &ccnt);
4941 		ASSERT(e == DDI_SUCCESS);
4942 		if (e != DDI_SUCCESS) {
4943 			return (DDI_DMA_STALE);
4944 		}
4945 
4946 		/* reset the cookie back to the first cookie in the window */
4947 		if (dma->dp_window != NULL) {
4948 			window = &dma->dp_window[dma->dp_current_win];
4949 			hp->dmai_cookie = window->wd_first_cookie;
4950 		} else {
4951 			hp->dmai_cookie = dma->dp_cookies;
4952 		}
4953 
4954 		*objpp = (caddr_t)handle;
4955 		return (DDI_SUCCESS);
4956 
4957 	case DDI_DMA_FREE: /* ddi_dma_free() */
4958 		(void) rootnex_dma_unbindhdl(dip, rdip, handle);
4959 		(void) rootnex_dma_freehdl(dip, rdip, handle);
4960 		if (rootnex_state->r_dvma_call_list_id) {
4961 			ddi_run_callback(&rootnex_state->r_dvma_call_list_id);
4962 		}
4963 		return (DDI_SUCCESS);
4964 
4965 	case DDI_DMA_IOPB_ALLOC:	/* get contiguous DMA-able memory */
4966 	case DDI_DMA_SMEM_ALLOC:	/* get contiguous DMA-able memory */
4967 		/* should never get here, handled in genunix */
4968 		ASSERT(0);
4969 		return (DDI_FAILURE);
4970 
4971 	case DDI_DMA_KVADDR:
4972 	case DDI_DMA_GETERR:
4973 	case DDI_DMA_COFF:
4974 		return (DDI_FAILURE);
4975 	}
4976 
4977 	return (DDI_FAILURE);
4978 #endif /* defined(__amd64) */
4979 }
4980 
4981 /*
4982  * *********
4983  *  FMA Code
4984  * *********
4985  */
4986 
4987 /*
4988  * rootnex_fm_init()
4989  *    FMA init busop
4990  */
4991 /* ARGSUSED */
4992 static int
4993 rootnex_fm_init(dev_info_t *dip, dev_info_t *tdip, int tcap,
4994     ddi_iblock_cookie_t *ibc)
4995 {
4996 	*ibc = rootnex_state->r_err_ibc;
4997 
4998 	return (ddi_system_fmcap);
4999 }
5000 
5001 /*
5002  * rootnex_dma_check()
5003  *    Function called after a dma fault occurred to find out whether the
5004  *    fault address is associated with a driver that is able to handle faults
5005  *    and recover from faults.
5006  */
5007 /* ARGSUSED */
5008 static int
5009 rootnex_dma_check(dev_info_t *dip, const void *handle, const void *addr,
5010     const void *not_used)
5011 {
5012 	rootnex_window_t *window;
5013 	uint64_t start_addr;
5014 	uint64_t fault_addr;
5015 	ddi_dma_impl_t *hp;
5016 	rootnex_dma_t *dma;
5017 	uint64_t end_addr;
5018 	size_t csize;
5019 	int i;
5020 	int j;
5021 
5022 
5023 	/* The driver has to set DDI_DMA_FLAGERR to recover from dma faults */
5024 	hp = (ddi_dma_impl_t *)handle;
5025 	ASSERT(hp);
5026 
5027 	dma = (rootnex_dma_t *)hp->dmai_private;
5028 
5029 	/* Get the address that we need to search for */
5030 	fault_addr = *(uint64_t *)addr;
5031 
5032 	/*
5033 	 * if we don't have any windows, we can just walk through all the
5034 	 * cookies.
5035 	 */
5036 	if (dma->dp_window == NULL) {
5037 		/* for each cookie */
5038 		for (i = 0; i < dma->dp_sglinfo.si_sgl_size; i++) {
5039 			/*
5040 			 * if the faulted address is within the physical address
5041 			 * range of the cookie, return DDI_FM_NONFATAL.
5042 			 */
5043 			if ((fault_addr >= dma->dp_cookies[i].dmac_laddress) &&
5044 			    (fault_addr <= (dma->dp_cookies[i].dmac_laddress +
5045 			    dma->dp_cookies[i].dmac_size))) {
5046 				return (DDI_FM_NONFATAL);
5047 			}
5048 		}
5049 
5050 		/* fault_addr not within this DMA handle */
5051 		return (DDI_FM_UNKNOWN);
5052 	}
5053 
5054 	/* we have mutiple windows, walk through each window */
5055 	for (i = 0; i < hp->dmai_nwin; i++) {
5056 		window = &dma->dp_window[i];
5057 
5058 		/* Go through all the cookies in the window */
5059 		for (j = 0; j < window->wd_cookie_cnt; j++) {
5060 
5061 			start_addr = window->wd_first_cookie[j].dmac_laddress;
5062 			csize = window->wd_first_cookie[j].dmac_size;
5063 
5064 			/*
5065 			 * if we are trimming the first cookie in the window,
5066 			 * and this is the first cookie, adjust the start
5067 			 * address and size of the cookie to account for the
5068 			 * trim.
5069 			 */
5070 			if (window->wd_trim.tr_trim_first && (j == 0)) {
5071 				start_addr = window->wd_trim.tr_first_paddr;
5072 				csize = window->wd_trim.tr_first_size;
5073 			}
5074 
5075 			/*
5076 			 * if we are trimming the last cookie in the window,
5077 			 * and this is the last cookie, adjust the start
5078 			 * address and size of the cookie to account for the
5079 			 * trim.
5080 			 */
5081 			if (window->wd_trim.tr_trim_last &&
5082 			    (j == (window->wd_cookie_cnt - 1))) {
5083 				start_addr = window->wd_trim.tr_last_paddr;
5084 				csize = window->wd_trim.tr_last_size;
5085 			}
5086 
5087 			end_addr = start_addr + csize;
5088 
5089 			/*
5090 			 * if the faulted address is within the physical
5091 			 * address of the cookie, return DDI_FM_NONFATAL.
5092 			 */
5093 			if ((fault_addr >= start_addr) &&
5094 			    (fault_addr <= end_addr)) {
5095 				return (DDI_FM_NONFATAL);
5096 			}
5097 		}
5098 	}
5099 
5100 	/* fault_addr not within this DMA handle */
5101 	return (DDI_FM_UNKNOWN);
5102 }
5103 
5104 /*ARGSUSED*/
5105 static int
5106 rootnex_quiesce(dev_info_t *dip)
5107 {
5108 #if defined(__amd64) && !defined(__xpv)
5109 	return (immu_quiesce());
5110 #else
5111 	return (DDI_SUCCESS);
5112 #endif
5113 }
5114 
5115 #if defined(__xpv)
5116 void
5117 immu_init(void)
5118 {
5119 	;
5120 }
5121 
5122 void
5123 immu_startup(void)
5124 {
5125 	;
5126 }
5127 /*ARGSUSED*/
5128 void
5129 immu_physmem_update(uint64_t addr, uint64_t size)
5130 {
5131 	;
5132 }
5133 #endif
5134