xref: /titanic_44/usr/src/uts/common/os/sunddi.c (revision 45ba3153cd6c019703d2e98425b7cae2b12b5f21)
1 /*
2  * CDDL HEADER START
3  *
4  * The contents of this file are subject to the terms of the
5  * Common Development and Distribution License (the "License").
6  * You may not use this file except in compliance with the License.
7  *
8  * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
9  * or http://www.opensolaris.org/os/licensing.
10  * See the License for the specific language governing permissions
11  * and limitations under the License.
12  *
13  * When distributing Covered Code, include this CDDL HEADER in each
14  * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
15  * If applicable, add the following below this CDDL HEADER, with the
16  * fields enclosed by brackets "[]" replaced with your own identifying
17  * information: Portions Copyright [yyyy] [name of copyright owner]
18  *
19  * CDDL HEADER END
20  */
21 
22 /*
23  * Copyright (c) 1990, 2010, Oracle and/or its affiliates. All rights reserved.
24  * Copyright 2014 Garrett D'Amore <garrett@damore.org>
25  */
26 
27 #include <sys/note.h>
28 #include <sys/types.h>
29 #include <sys/param.h>
30 #include <sys/systm.h>
31 #include <sys/buf.h>
32 #include <sys/uio.h>
33 #include <sys/cred.h>
34 #include <sys/poll.h>
35 #include <sys/mman.h>
36 #include <sys/kmem.h>
37 #include <sys/model.h>
38 #include <sys/file.h>
39 #include <sys/proc.h>
40 #include <sys/open.h>
41 #include <sys/user.h>
42 #include <sys/t_lock.h>
43 #include <sys/vm.h>
44 #include <sys/stat.h>
45 #include <vm/hat.h>
46 #include <vm/seg.h>
47 #include <vm/seg_vn.h>
48 #include <vm/seg_dev.h>
49 #include <vm/as.h>
50 #include <sys/cmn_err.h>
51 #include <sys/cpuvar.h>
52 #include <sys/debug.h>
53 #include <sys/autoconf.h>
54 #include <sys/sunddi.h>
55 #include <sys/esunddi.h>
56 #include <sys/sunndi.h>
57 #include <sys/kstat.h>
58 #include <sys/conf.h>
59 #include <sys/ddi_impldefs.h>	/* include implementation structure defs */
60 #include <sys/ndi_impldefs.h>	/* include prototypes */
61 #include <sys/ddi_periodic.h>
62 #include <sys/hwconf.h>
63 #include <sys/pathname.h>
64 #include <sys/modctl.h>
65 #include <sys/epm.h>
66 #include <sys/devctl.h>
67 #include <sys/callb.h>
68 #include <sys/cladm.h>
69 #include <sys/sysevent.h>
70 #include <sys/dacf_impl.h>
71 #include <sys/ddidevmap.h>
72 #include <sys/bootconf.h>
73 #include <sys/disp.h>
74 #include <sys/atomic.h>
75 #include <sys/promif.h>
76 #include <sys/instance.h>
77 #include <sys/sysevent/eventdefs.h>
78 #include <sys/task.h>
79 #include <sys/project.h>
80 #include <sys/taskq.h>
81 #include <sys/devpolicy.h>
82 #include <sys/ctype.h>
83 #include <net/if.h>
84 #include <sys/rctl.h>
85 #include <sys/zone.h>
86 #include <sys/clock_impl.h>
87 #include <sys/ddi.h>
88 #include <sys/modhash.h>
89 #include <sys/sunldi_impl.h>
90 #include <sys/fs/dv_node.h>
91 #include <sys/fs/snode.h>
92 
93 extern	pri_t	minclsyspri;
94 
95 extern	rctl_hndl_t rc_project_locked_mem;
96 extern	rctl_hndl_t rc_zone_locked_mem;
97 
98 #ifdef DEBUG
99 static int sunddi_debug = 0;
100 #endif /* DEBUG */
101 
102 /* ddi_umem_unlock miscellaneous */
103 
104 static	void	i_ddi_umem_unlock_thread_start(void);
105 
106 static	kmutex_t	ddi_umem_unlock_mutex; /* unlock list mutex */
107 static	kcondvar_t	ddi_umem_unlock_cv; /* unlock list block/unblock */
108 static	kthread_t	*ddi_umem_unlock_thread;
109 /*
110  * The ddi_umem_unlock FIFO list.  NULL head pointer indicates empty list.
111  */
112 static	struct	ddi_umem_cookie *ddi_umem_unlock_head = NULL;
113 static	struct	ddi_umem_cookie *ddi_umem_unlock_tail = NULL;
114 
115 /*
116  * DDI(Sun) Function and flag definitions:
117  */
118 
119 #if defined(__x86)
120 /*
121  * Used to indicate which entries were chosen from a range.
122  */
123 char	*chosen_reg = "chosen-reg";
124 #endif
125 
126 /*
127  * Function used to ring system console bell
128  */
129 void (*ddi_console_bell_func)(clock_t duration);
130 
131 /*
132  * Creating register mappings and handling interrupts:
133  */
134 
135 /*
136  * Generic ddi_map: Call parent to fulfill request...
137  */
138 
139 int
140 ddi_map(dev_info_t *dp, ddi_map_req_t *mp, off_t offset,
141     off_t len, caddr_t *addrp)
142 {
143 	dev_info_t *pdip;
144 
145 	ASSERT(dp);
146 	pdip = (dev_info_t *)DEVI(dp)->devi_parent;
147 	return ((DEVI(pdip)->devi_ops->devo_bus_ops->bus_map)(pdip,
148 	    dp, mp, offset, len, addrp));
149 }
150 
151 /*
152  * ddi_apply_range: (Called by nexi only.)
153  * Apply ranges in parent node dp, to child regspec rp...
154  */
155 
156 int
157 ddi_apply_range(dev_info_t *dp, dev_info_t *rdip, struct regspec *rp)
158 {
159 	return (i_ddi_apply_range(dp, rdip, rp));
160 }
161 
162 int
163 ddi_map_regs(dev_info_t *dip, uint_t rnumber, caddr_t *kaddrp, off_t offset,
164     off_t len)
165 {
166 	ddi_map_req_t mr;
167 #if defined(__x86)
168 	struct {
169 		int	bus;
170 		int	addr;
171 		int	size;
172 	} reg, *reglist;
173 	uint_t	length;
174 	int	rc;
175 
176 	/*
177 	 * get the 'registers' or the 'reg' property.
178 	 * We look up the reg property as an array of
179 	 * int's.
180 	 */
181 	rc = ddi_prop_lookup_int_array(DDI_DEV_T_ANY, dip,
182 	    DDI_PROP_DONTPASS, "registers", (int **)&reglist, &length);
183 	if (rc != DDI_PROP_SUCCESS)
184 		rc = ddi_prop_lookup_int_array(DDI_DEV_T_ANY, dip,
185 		    DDI_PROP_DONTPASS, "reg", (int **)&reglist, &length);
186 	if (rc == DDI_PROP_SUCCESS) {
187 		/*
188 		 * point to the required entry.
189 		 */
190 		reg = reglist[rnumber];
191 		reg.addr += offset;
192 		if (len != 0)
193 			reg.size = len;
194 		/*
195 		 * make a new property containing ONLY the required tuple.
196 		 */
197 		if (ddi_prop_update_int_array(DDI_DEV_T_NONE, dip,
198 		    chosen_reg, (int *)&reg, (sizeof (reg)/sizeof (int)))
199 		    != DDI_PROP_SUCCESS) {
200 			cmn_err(CE_WARN, "%s%d: cannot create '%s' "
201 			    "property", DEVI(dip)->devi_name,
202 			    DEVI(dip)->devi_instance, chosen_reg);
203 		}
204 		/*
205 		 * free the memory allocated by
206 		 * ddi_prop_lookup_int_array ().
207 		 */
208 		ddi_prop_free((void *)reglist);
209 	}
210 #endif
211 	mr.map_op = DDI_MO_MAP_LOCKED;
212 	mr.map_type = DDI_MT_RNUMBER;
213 	mr.map_obj.rnumber = rnumber;
214 	mr.map_prot = PROT_READ | PROT_WRITE;
215 	mr.map_flags = DDI_MF_KERNEL_MAPPING;
216 	mr.map_handlep = NULL;
217 	mr.map_vers = DDI_MAP_VERSION;
218 
219 	/*
220 	 * Call my parent to map in my regs.
221 	 */
222 
223 	return (ddi_map(dip, &mr, offset, len, kaddrp));
224 }
225 
226 void
227 ddi_unmap_regs(dev_info_t *dip, uint_t rnumber, caddr_t *kaddrp, off_t offset,
228     off_t len)
229 {
230 	ddi_map_req_t mr;
231 
232 	mr.map_op = DDI_MO_UNMAP;
233 	mr.map_type = DDI_MT_RNUMBER;
234 	mr.map_flags = DDI_MF_KERNEL_MAPPING;
235 	mr.map_prot = PROT_READ | PROT_WRITE;	/* who cares? */
236 	mr.map_obj.rnumber = rnumber;
237 	mr.map_handlep = NULL;
238 	mr.map_vers = DDI_MAP_VERSION;
239 
240 	/*
241 	 * Call my parent to unmap my regs.
242 	 */
243 
244 	(void) ddi_map(dip, &mr, offset, len, kaddrp);
245 	*kaddrp = (caddr_t)0;
246 #if defined(__x86)
247 	(void) ddi_prop_remove(DDI_DEV_T_NONE, dip, chosen_reg);
248 #endif
249 }
250 
251 int
252 ddi_bus_map(dev_info_t *dip, dev_info_t *rdip, ddi_map_req_t *mp,
253 	off_t offset, off_t len, caddr_t *vaddrp)
254 {
255 	return (i_ddi_bus_map(dip, rdip, mp, offset, len, vaddrp));
256 }
257 
258 /*
259  * nullbusmap:	The/DDI default bus_map entry point for nexi
260  *		not conforming to the reg/range paradigm (i.e. scsi, etc.)
261  *		with no HAT/MMU layer to be programmed at this level.
262  *
263  *		If the call is to map by rnumber, return an error,
264  *		otherwise pass anything else up the tree to my parent.
265  */
266 int
267 nullbusmap(dev_info_t *dip, dev_info_t *rdip, ddi_map_req_t *mp,
268 	off_t offset, off_t len, caddr_t *vaddrp)
269 {
270 	_NOTE(ARGUNUSED(rdip))
271 	if (mp->map_type == DDI_MT_RNUMBER)
272 		return (DDI_ME_UNSUPPORTED);
273 
274 	return (ddi_map(dip, mp, offset, len, vaddrp));
275 }
276 
277 /*
278  * ddi_rnumber_to_regspec: Not for use by leaf drivers.
279  *			   Only for use by nexi using the reg/range paradigm.
280  */
281 struct regspec *
282 ddi_rnumber_to_regspec(dev_info_t *dip, int rnumber)
283 {
284 	return (i_ddi_rnumber_to_regspec(dip, rnumber));
285 }
286 
287 
288 /*
289  * Note that we allow the dip to be nil because we may be called
290  * prior even to the instantiation of the devinfo tree itself - all
291  * regular leaf and nexus drivers should always use a non-nil dip!
292  *
293  * We treat peek in a somewhat cavalier fashion .. assuming that we'll
294  * simply get a synchronous fault as soon as we touch a missing address.
295  *
296  * Poke is rather more carefully handled because we might poke to a write
297  * buffer, "succeed", then only find some time later that we got an
298  * asynchronous fault that indicated that the address we were writing to
299  * was not really backed by hardware.
300  */
301 
302 static int
303 i_ddi_peekpoke(dev_info_t *devi, ddi_ctl_enum_t cmd, size_t size,
304     void *addr, void *value_p)
305 {
306 	union {
307 		uint64_t	u64;
308 		uint32_t	u32;
309 		uint16_t	u16;
310 		uint8_t		u8;
311 	} peekpoke_value;
312 
313 	peekpoke_ctlops_t peekpoke_args;
314 	uint64_t dummy_result;
315 	int rval;
316 
317 	/* Note: size is assumed to be correct;  it is not checked. */
318 	peekpoke_args.size = size;
319 	peekpoke_args.dev_addr = (uintptr_t)addr;
320 	peekpoke_args.handle = NULL;
321 	peekpoke_args.repcount = 1;
322 	peekpoke_args.flags = 0;
323 
324 	if (cmd == DDI_CTLOPS_POKE) {
325 		switch (size) {
326 		case sizeof (uint8_t):
327 			peekpoke_value.u8 = *(uint8_t *)value_p;
328 			break;
329 		case sizeof (uint16_t):
330 			peekpoke_value.u16 = *(uint16_t *)value_p;
331 			break;
332 		case sizeof (uint32_t):
333 			peekpoke_value.u32 = *(uint32_t *)value_p;
334 			break;
335 		case sizeof (uint64_t):
336 			peekpoke_value.u64 = *(uint64_t *)value_p;
337 			break;
338 		}
339 	}
340 
341 	peekpoke_args.host_addr = (uintptr_t)&peekpoke_value.u64;
342 
343 	if (devi != NULL)
344 		rval = ddi_ctlops(devi, devi, cmd, &peekpoke_args,
345 		    &dummy_result);
346 	else
347 		rval = peekpoke_mem(cmd, &peekpoke_args);
348 
349 	/*
350 	 * A NULL value_p is permitted by ddi_peek(9F); discard the result.
351 	 */
352 	if ((cmd == DDI_CTLOPS_PEEK) & (value_p != NULL)) {
353 		switch (size) {
354 		case sizeof (uint8_t):
355 			*(uint8_t *)value_p = peekpoke_value.u8;
356 			break;
357 		case sizeof (uint16_t):
358 			*(uint16_t *)value_p = peekpoke_value.u16;
359 			break;
360 		case sizeof (uint32_t):
361 			*(uint32_t *)value_p = peekpoke_value.u32;
362 			break;
363 		case sizeof (uint64_t):
364 			*(uint64_t *)value_p = peekpoke_value.u64;
365 			break;
366 		}
367 	}
368 
369 	return (rval);
370 }
371 
372 /*
373  * Keep ddi_peek() and ddi_poke() in case 3rd parties are calling this.
374  * they shouldn't be, but the 9f manpage kind of pseudo exposes it.
375  */
376 int
377 ddi_peek(dev_info_t *devi, size_t size, void *addr, void *value_p)
378 {
379 	switch (size) {
380 	case sizeof (uint8_t):
381 	case sizeof (uint16_t):
382 	case sizeof (uint32_t):
383 	case sizeof (uint64_t):
384 		break;
385 	default:
386 		return (DDI_FAILURE);
387 	}
388 
389 	return (i_ddi_peekpoke(devi, DDI_CTLOPS_PEEK, size, addr, value_p));
390 }
391 
392 int
393 ddi_poke(dev_info_t *devi, size_t size, void *addr, void *value_p)
394 {
395 	switch (size) {
396 	case sizeof (uint8_t):
397 	case sizeof (uint16_t):
398 	case sizeof (uint32_t):
399 	case sizeof (uint64_t):
400 		break;
401 	default:
402 		return (DDI_FAILURE);
403 	}
404 
405 	return (i_ddi_peekpoke(devi, DDI_CTLOPS_POKE, size, addr, value_p));
406 }
407 
408 int
409 ddi_peek8(dev_info_t *dip, int8_t *addr, int8_t *val_p)
410 {
411 	return (i_ddi_peekpoke(dip, DDI_CTLOPS_PEEK, sizeof (*val_p), addr,
412 	    val_p));
413 }
414 
415 int
416 ddi_peek16(dev_info_t *dip, int16_t *addr, int16_t *val_p)
417 {
418 	return (i_ddi_peekpoke(dip, DDI_CTLOPS_PEEK, sizeof (*val_p), addr,
419 	    val_p));
420 }
421 
422 int
423 ddi_peek32(dev_info_t *dip, int32_t *addr, int32_t *val_p)
424 {
425 	return (i_ddi_peekpoke(dip, DDI_CTLOPS_PEEK, sizeof (*val_p), addr,
426 	    val_p));
427 }
428 
429 int
430 ddi_peek64(dev_info_t *dip, int64_t *addr, int64_t *val_p)
431 {
432 	return (i_ddi_peekpoke(dip, DDI_CTLOPS_PEEK, sizeof (*val_p), addr,
433 	    val_p));
434 }
435 
436 
437 /*
438  * We need to separate the old interfaces from the new ones and leave them
439  * in here for a while. Previous versions of the OS defined the new interfaces
440  * to the old interfaces. This way we can fix things up so that we can
441  * eventually remove these interfaces.
442  * e.g. A 3rd party module/driver using ddi_peek8 and built against S10
443  * or earlier will actually have a reference to ddi_peekc in the binary.
444  */
445 #ifdef _ILP32
446 int
447 ddi_peekc(dev_info_t *dip, int8_t *addr, int8_t *val_p)
448 {
449 	return (i_ddi_peekpoke(dip, DDI_CTLOPS_PEEK, sizeof (*val_p), addr,
450 	    val_p));
451 }
452 
453 int
454 ddi_peeks(dev_info_t *dip, int16_t *addr, int16_t *val_p)
455 {
456 	return (i_ddi_peekpoke(dip, DDI_CTLOPS_PEEK, sizeof (*val_p), addr,
457 	    val_p));
458 }
459 
460 int
461 ddi_peekl(dev_info_t *dip, int32_t *addr, int32_t *val_p)
462 {
463 	return (i_ddi_peekpoke(dip, DDI_CTLOPS_PEEK, sizeof (*val_p), addr,
464 	    val_p));
465 }
466 
467 int
468 ddi_peekd(dev_info_t *dip, int64_t *addr, int64_t *val_p)
469 {
470 	return (i_ddi_peekpoke(dip, DDI_CTLOPS_PEEK, sizeof (*val_p), addr,
471 	    val_p));
472 }
473 #endif /* _ILP32 */
474 
475 int
476 ddi_poke8(dev_info_t *dip, int8_t *addr, int8_t val)
477 {
478 	return (i_ddi_peekpoke(dip, DDI_CTLOPS_POKE, sizeof (val), addr, &val));
479 }
480 
481 int
482 ddi_poke16(dev_info_t *dip, int16_t *addr, int16_t val)
483 {
484 	return (i_ddi_peekpoke(dip, DDI_CTLOPS_POKE, sizeof (val), addr, &val));
485 }
486 
487 int
488 ddi_poke32(dev_info_t *dip, int32_t *addr, int32_t val)
489 {
490 	return (i_ddi_peekpoke(dip, DDI_CTLOPS_POKE, sizeof (val), addr, &val));
491 }
492 
493 int
494 ddi_poke64(dev_info_t *dip, int64_t *addr, int64_t val)
495 {
496 	return (i_ddi_peekpoke(dip, DDI_CTLOPS_POKE, sizeof (val), addr, &val));
497 }
498 
499 /*
500  * We need to separate the old interfaces from the new ones and leave them
501  * in here for a while. Previous versions of the OS defined the new interfaces
502  * to the old interfaces. This way we can fix things up so that we can
503  * eventually remove these interfaces.
504  * e.g. A 3rd party module/driver using ddi_poke8 and built against S10
505  * or earlier will actually have a reference to ddi_pokec in the binary.
506  */
507 #ifdef _ILP32
508 int
509 ddi_pokec(dev_info_t *dip, int8_t *addr, int8_t val)
510 {
511 	return (i_ddi_peekpoke(dip, DDI_CTLOPS_POKE, sizeof (val), addr, &val));
512 }
513 
514 int
515 ddi_pokes(dev_info_t *dip, int16_t *addr, int16_t val)
516 {
517 	return (i_ddi_peekpoke(dip, DDI_CTLOPS_POKE, sizeof (val), addr, &val));
518 }
519 
520 int
521 ddi_pokel(dev_info_t *dip, int32_t *addr, int32_t val)
522 {
523 	return (i_ddi_peekpoke(dip, DDI_CTLOPS_POKE, sizeof (val), addr, &val));
524 }
525 
526 int
527 ddi_poked(dev_info_t *dip, int64_t *addr, int64_t val)
528 {
529 	return (i_ddi_peekpoke(dip, DDI_CTLOPS_POKE, sizeof (val), addr, &val));
530 }
531 #endif /* _ILP32 */
532 
533 /*
534  * ddi_peekpokeio() is used primarily by the mem drivers for moving
535  * data to and from uio structures via peek and poke.  Note that we
536  * use "internal" routines ddi_peek and ddi_poke to make this go
537  * slightly faster, avoiding the call overhead ..
538  */
539 int
540 ddi_peekpokeio(dev_info_t *devi, struct uio *uio, enum uio_rw rw,
541     caddr_t addr, size_t len, uint_t xfersize)
542 {
543 	int64_t	ibuffer;
544 	int8_t w8;
545 	size_t sz;
546 	int o;
547 
548 	if (xfersize > sizeof (long))
549 		xfersize = sizeof (long);
550 
551 	while (len != 0) {
552 		if ((len | (uintptr_t)addr) & 1) {
553 			sz = sizeof (int8_t);
554 			if (rw == UIO_WRITE) {
555 				if ((o = uwritec(uio)) == -1)
556 					return (DDI_FAILURE);
557 				if (ddi_poke8(devi, (int8_t *)addr,
558 				    (int8_t)o) != DDI_SUCCESS)
559 					return (DDI_FAILURE);
560 			} else {
561 				if (i_ddi_peekpoke(devi, DDI_CTLOPS_PEEK, sz,
562 				    (int8_t *)addr, &w8) != DDI_SUCCESS)
563 					return (DDI_FAILURE);
564 				if (ureadc(w8, uio))
565 					return (DDI_FAILURE);
566 			}
567 		} else {
568 			switch (xfersize) {
569 			case sizeof (int64_t):
570 				if (((len | (uintptr_t)addr) &
571 				    (sizeof (int64_t) - 1)) == 0) {
572 					sz = xfersize;
573 					break;
574 				}
575 				/*FALLTHROUGH*/
576 			case sizeof (int32_t):
577 				if (((len | (uintptr_t)addr) &
578 				    (sizeof (int32_t) - 1)) == 0) {
579 					sz = xfersize;
580 					break;
581 				}
582 				/*FALLTHROUGH*/
583 			default:
584 				/*
585 				 * This still assumes that we might have an
586 				 * I/O bus out there that permits 16-bit
587 				 * transfers (and that it would be upset by
588 				 * 32-bit transfers from such locations).
589 				 */
590 				sz = sizeof (int16_t);
591 				break;
592 			}
593 
594 			if (rw == UIO_READ) {
595 				if (i_ddi_peekpoke(devi, DDI_CTLOPS_PEEK, sz,
596 				    addr, &ibuffer) != DDI_SUCCESS)
597 					return (DDI_FAILURE);
598 			}
599 
600 			if (uiomove(&ibuffer, sz, rw, uio))
601 				return (DDI_FAILURE);
602 
603 			if (rw == UIO_WRITE) {
604 				if (i_ddi_peekpoke(devi, DDI_CTLOPS_POKE, sz,
605 				    addr, &ibuffer) != DDI_SUCCESS)
606 					return (DDI_FAILURE);
607 			}
608 		}
609 		addr += sz;
610 		len -= sz;
611 	}
612 	return (DDI_SUCCESS);
613 }
614 
615 /*
616  * These routines are used by drivers that do layered ioctls
617  * On sparc, they're implemented in assembler to avoid spilling
618  * register windows in the common (copyin) case ..
619  */
620 #if !defined(__sparc)
621 int
622 ddi_copyin(const void *buf, void *kernbuf, size_t size, int flags)
623 {
624 	if (flags & FKIOCTL)
625 		return (kcopy(buf, kernbuf, size) ? -1 : 0);
626 	return (copyin(buf, kernbuf, size));
627 }
628 
629 int
630 ddi_copyout(const void *buf, void *kernbuf, size_t size, int flags)
631 {
632 	if (flags & FKIOCTL)
633 		return (kcopy(buf, kernbuf, size) ? -1 : 0);
634 	return (copyout(buf, kernbuf, size));
635 }
636 #endif	/* !__sparc */
637 
638 /*
639  * Conversions in nexus pagesize units.  We don't duplicate the
640  * 'nil dip' semantics of peek/poke because btopr/btop/ptob are DDI/DKI
641  * routines anyway.
642  */
643 unsigned long
644 ddi_btop(dev_info_t *dip, unsigned long bytes)
645 {
646 	unsigned long pages;
647 
648 	(void) ddi_ctlops(dip, dip, DDI_CTLOPS_BTOP, &bytes, &pages);
649 	return (pages);
650 }
651 
652 unsigned long
653 ddi_btopr(dev_info_t *dip, unsigned long bytes)
654 {
655 	unsigned long pages;
656 
657 	(void) ddi_ctlops(dip, dip, DDI_CTLOPS_BTOPR, &bytes, &pages);
658 	return (pages);
659 }
660 
661 unsigned long
662 ddi_ptob(dev_info_t *dip, unsigned long pages)
663 {
664 	unsigned long bytes;
665 
666 	(void) ddi_ctlops(dip, dip, DDI_CTLOPS_PTOB, &pages, &bytes);
667 	return (bytes);
668 }
669 
670 unsigned int
671 ddi_enter_critical(void)
672 {
673 	return ((uint_t)spl7());
674 }
675 
676 void
677 ddi_exit_critical(unsigned int spl)
678 {
679 	splx((int)spl);
680 }
681 
682 /*
683  * Nexus ctlops punter
684  */
685 
686 #if !defined(__sparc)
687 /*
688  * Request bus_ctl parent to handle a bus_ctl request
689  *
690  * (The sparc version is in sparc_ddi.s)
691  */
692 int
693 ddi_ctlops(dev_info_t *d, dev_info_t *r, ddi_ctl_enum_t op, void *a, void *v)
694 {
695 	int (*fp)();
696 
697 	if (!d || !r)
698 		return (DDI_FAILURE);
699 
700 	if ((d = (dev_info_t *)DEVI(d)->devi_bus_ctl) == NULL)
701 		return (DDI_FAILURE);
702 
703 	fp = DEVI(d)->devi_ops->devo_bus_ops->bus_ctl;
704 	return ((*fp)(d, r, op, a, v));
705 }
706 
707 #endif
708 
709 /*
710  * DMA/DVMA setup
711  */
712 
713 #if !defined(__sparc)
714 /*
715  * Request bus_dma_ctl parent to fiddle with a dma request.
716  *
717  * (The sparc version is in sparc_subr.s)
718  */
719 int
720 ddi_dma_mctl(dev_info_t *dip, dev_info_t *rdip,
721     ddi_dma_handle_t handle, enum ddi_dma_ctlops request,
722     off_t *offp, size_t *lenp, caddr_t *objp, uint_t flags)
723 {
724 	int (*fp)();
725 
726 	if (dip != ddi_root_node())
727 		dip = (dev_info_t *)DEVI(dip)->devi_bus_dma_ctl;
728 	fp = DEVI(dip)->devi_ops->devo_bus_ops->bus_dma_ctl;
729 	return ((*fp) (dip, rdip, handle, request, offp, lenp, objp, flags));
730 }
731 #endif
732 
733 /*
734  * For all DMA control functions, call the DMA control
735  * routine and return status.
736  *
737  * Just plain assume that the parent is to be called.
738  * If a nexus driver or a thread outside the framework
739  * of a nexus driver or a leaf driver calls these functions,
740  * it is up to them to deal with the fact that the parent's
741  * bus_dma_ctl function will be the first one called.
742  */
743 
744 #define	HD	((ddi_dma_impl_t *)h)->dmai_rdip
745 
746 /*
747  * This routine is left in place to satisfy link dependencies
748  * for any 3rd party nexus drivers that rely on it.  It is never
749  * called, though.
750  */
751 /*ARGSUSED*/
752 int
753 ddi_dma_map(dev_info_t *dip, dev_info_t *rdip,
754     struct ddi_dma_req *dmareqp, ddi_dma_handle_t *handlep)
755 {
756 	return (DDI_FAILURE);
757 }
758 
759 #if !defined(__sparc)
760 
761 /*
762  * The SPARC versions of these routines are done in assembler to
763  * save register windows, so they're in sparc_subr.s.
764  */
765 
766 int
767 ddi_dma_allochdl(dev_info_t *dip, dev_info_t *rdip, ddi_dma_attr_t *attr,
768     int (*waitfp)(caddr_t), caddr_t arg, ddi_dma_handle_t *handlep)
769 {
770 	int (*funcp)(dev_info_t *, dev_info_t *, ddi_dma_attr_t *,
771 	    int (*)(caddr_t), caddr_t, ddi_dma_handle_t *);
772 
773 	if (dip != ddi_root_node())
774 		dip = (dev_info_t *)DEVI(dip)->devi_bus_dma_allochdl;
775 
776 	funcp = DEVI(dip)->devi_ops->devo_bus_ops->bus_dma_allochdl;
777 	return ((*funcp)(dip, rdip, attr, waitfp, arg, handlep));
778 }
779 
780 int
781 ddi_dma_freehdl(dev_info_t *dip, dev_info_t *rdip, ddi_dma_handle_t handlep)
782 {
783 	int (*funcp)(dev_info_t *, dev_info_t *, ddi_dma_handle_t);
784 
785 	if (dip != ddi_root_node())
786 		dip = (dev_info_t *)DEVI(dip)->devi_bus_dma_allochdl;
787 
788 	funcp = DEVI(dip)->devi_ops->devo_bus_ops->bus_dma_freehdl;
789 	return ((*funcp)(dip, rdip, handlep));
790 }
791 
792 int
793 ddi_dma_bindhdl(dev_info_t *dip, dev_info_t *rdip,
794     ddi_dma_handle_t handle, struct ddi_dma_req *dmareq,
795     ddi_dma_cookie_t *cp, uint_t *ccountp)
796 {
797 	int (*funcp)(dev_info_t *, dev_info_t *, ddi_dma_handle_t,
798 	    struct ddi_dma_req *, ddi_dma_cookie_t *, uint_t *);
799 
800 	if (dip != ddi_root_node())
801 		dip = (dev_info_t *)DEVI(dip)->devi_bus_dma_bindhdl;
802 
803 	funcp = DEVI(dip)->devi_ops->devo_bus_ops->bus_dma_bindhdl;
804 	return ((*funcp)(dip, rdip, handle, dmareq, cp, ccountp));
805 }
806 
807 int
808 ddi_dma_unbindhdl(dev_info_t *dip, dev_info_t *rdip,
809     ddi_dma_handle_t handle)
810 {
811 	int (*funcp)(dev_info_t *, dev_info_t *, ddi_dma_handle_t);
812 
813 	if (dip != ddi_root_node())
814 		dip = (dev_info_t *)DEVI(dip)->devi_bus_dma_unbindhdl;
815 
816 	funcp = DEVI(dip)->devi_ops->devo_bus_ops->bus_dma_unbindhdl;
817 	return ((*funcp)(dip, rdip, handle));
818 }
819 
820 
821 int
822 ddi_dma_flush(dev_info_t *dip, dev_info_t *rdip,
823     ddi_dma_handle_t handle, off_t off, size_t len,
824     uint_t cache_flags)
825 {
826 	int (*funcp)(dev_info_t *, dev_info_t *, ddi_dma_handle_t,
827 	    off_t, size_t, uint_t);
828 
829 	if (dip != ddi_root_node())
830 		dip = (dev_info_t *)DEVI(dip)->devi_bus_dma_flush;
831 
832 	funcp = DEVI(dip)->devi_ops->devo_bus_ops->bus_dma_flush;
833 	return ((*funcp)(dip, rdip, handle, off, len, cache_flags));
834 }
835 
836 int
837 ddi_dma_win(dev_info_t *dip, dev_info_t *rdip,
838     ddi_dma_handle_t handle, uint_t win, off_t *offp,
839     size_t *lenp, ddi_dma_cookie_t *cookiep, uint_t *ccountp)
840 {
841 	int (*funcp)(dev_info_t *, dev_info_t *, ddi_dma_handle_t,
842 	    uint_t, off_t *, size_t *, ddi_dma_cookie_t *, uint_t *);
843 
844 	if (dip != ddi_root_node())
845 		dip = (dev_info_t *)DEVI(dip)->devi_bus_dma_win;
846 
847 	funcp = DEVI(dip)->devi_ops->devo_bus_ops->bus_dma_win;
848 	return ((*funcp)(dip, rdip, handle, win, offp, lenp,
849 	    cookiep, ccountp));
850 }
851 
852 int
853 ddi_dma_sync(ddi_dma_handle_t h, off_t o, size_t l, uint_t whom)
854 {
855 	ddi_dma_impl_t *hp = (ddi_dma_impl_t *)h;
856 	dev_info_t *dip, *rdip;
857 	int (*funcp)(dev_info_t *, dev_info_t *, ddi_dma_handle_t, off_t,
858 	    size_t, uint_t);
859 
860 	/*
861 	 * the DMA nexus driver will set DMP_NOSYNC if the
862 	 * platform does not require any sync operation. For
863 	 * example if the memory is uncached or consistent
864 	 * and without any I/O write buffers involved.
865 	 */
866 	if ((hp->dmai_rflags & DMP_NOSYNC) == DMP_NOSYNC)
867 		return (DDI_SUCCESS);
868 
869 	dip = rdip = hp->dmai_rdip;
870 	if (dip != ddi_root_node())
871 		dip = (dev_info_t *)DEVI(dip)->devi_bus_dma_flush;
872 	funcp = DEVI(dip)->devi_ops->devo_bus_ops->bus_dma_flush;
873 	return ((*funcp)(dip, rdip, h, o, l, whom));
874 }
875 
876 int
877 ddi_dma_unbind_handle(ddi_dma_handle_t h)
878 {
879 	ddi_dma_impl_t *hp = (ddi_dma_impl_t *)h;
880 	dev_info_t *dip, *rdip;
881 	int (*funcp)(dev_info_t *, dev_info_t *, ddi_dma_handle_t);
882 
883 	dip = rdip = hp->dmai_rdip;
884 	if (dip != ddi_root_node())
885 		dip = (dev_info_t *)DEVI(dip)->devi_bus_dma_unbindhdl;
886 	funcp = DEVI(rdip)->devi_bus_dma_unbindfunc;
887 	return ((*funcp)(dip, rdip, h));
888 }
889 
890 #endif	/* !__sparc */
891 
892 /*
893  * DMA burst sizes, and transfer minimums
894  */
895 
896 int
897 ddi_dma_burstsizes(ddi_dma_handle_t handle)
898 {
899 	ddi_dma_impl_t *dimp = (ddi_dma_impl_t *)handle;
900 
901 	if (!dimp)
902 		return (0);
903 	else
904 		return (dimp->dmai_burstsizes);
905 }
906 
907 /*
908  * Given two DMA attribute structures, apply the attributes
909  * of one to the other, following the rules of attributes
910  * and the wishes of the caller.
911  *
912  * The rules of DMA attribute structures are that you cannot
913  * make things *less* restrictive as you apply one set
914  * of attributes to another.
915  *
916  */
917 void
918 ddi_dma_attr_merge(ddi_dma_attr_t *attr, ddi_dma_attr_t *mod)
919 {
920 	attr->dma_attr_addr_lo =
921 	    MAX(attr->dma_attr_addr_lo, mod->dma_attr_addr_lo);
922 	attr->dma_attr_addr_hi =
923 	    MIN(attr->dma_attr_addr_hi, mod->dma_attr_addr_hi);
924 	attr->dma_attr_count_max =
925 	    MIN(attr->dma_attr_count_max, mod->dma_attr_count_max);
926 	attr->dma_attr_align =
927 	    MAX(attr->dma_attr_align,  mod->dma_attr_align);
928 	attr->dma_attr_burstsizes =
929 	    (uint_t)(attr->dma_attr_burstsizes & mod->dma_attr_burstsizes);
930 	attr->dma_attr_minxfer =
931 	    maxbit(attr->dma_attr_minxfer, mod->dma_attr_minxfer);
932 	attr->dma_attr_maxxfer =
933 	    MIN(attr->dma_attr_maxxfer, mod->dma_attr_maxxfer);
934 	attr->dma_attr_seg = MIN(attr->dma_attr_seg, mod->dma_attr_seg);
935 	attr->dma_attr_sgllen = MIN((uint_t)attr->dma_attr_sgllen,
936 	    (uint_t)mod->dma_attr_sgllen);
937 	attr->dma_attr_granular =
938 	    MAX(attr->dma_attr_granular, mod->dma_attr_granular);
939 }
940 
941 /*
942  * mmap/segmap interface:
943  */
944 
945 /*
946  * ddi_segmap:		setup the default segment driver. Calls the drivers
947  *			XXmmap routine to validate the range to be mapped.
948  *			Return ENXIO of the range is not valid.  Create
949  *			a seg_dev segment that contains all of the
950  *			necessary information and will reference the
951  *			default segment driver routines. It returns zero
952  *			on success or non-zero on failure.
953  */
954 int
955 ddi_segmap(dev_t dev, off_t offset, struct as *asp, caddr_t *addrp, off_t len,
956     uint_t prot, uint_t maxprot, uint_t flags, cred_t *credp)
957 {
958 	extern int spec_segmap(dev_t, off_t, struct as *, caddr_t *,
959 	    off_t, uint_t, uint_t, uint_t, struct cred *);
960 
961 	return (spec_segmap(dev, offset, asp, addrp, len,
962 	    prot, maxprot, flags, credp));
963 }
964 
965 /*
966  * ddi_map_fault:	Resolve mappings at fault time.  Used by segment
967  *			drivers. Allows each successive parent to resolve
968  *			address translations and add its mappings to the
969  *			mapping list supplied in the page structure. It
970  *			returns zero on success	or non-zero on failure.
971  */
972 
973 int
974 ddi_map_fault(dev_info_t *dip, struct hat *hat, struct seg *seg,
975     caddr_t addr, struct devpage *dp, pfn_t pfn, uint_t prot, uint_t lock)
976 {
977 	return (i_ddi_map_fault(dip, dip, hat, seg, addr, dp, pfn, prot, lock));
978 }
979 
980 /*
981  * ddi_device_mapping_check:	Called from ddi_segmap_setup.
982  *	Invokes platform specific DDI to determine whether attributes specified
983  *	in attr(9s) are	valid for the region of memory that will be made
984  *	available for direct access to user process via the mmap(2) system call.
985  */
986 int
987 ddi_device_mapping_check(dev_t dev, ddi_device_acc_attr_t *accattrp,
988     uint_t rnumber, uint_t *hat_flags)
989 {
990 	ddi_acc_handle_t handle;
991 	ddi_map_req_t mr;
992 	ddi_acc_hdl_t *hp;
993 	int result;
994 	dev_info_t *dip;
995 
996 	/*
997 	 * we use e_ddi_hold_devi_by_dev to search for the devi.  We
998 	 * release it immediately since it should already be held by
999 	 * a devfs vnode.
1000 	 */
1001 	if ((dip =
1002 	    e_ddi_hold_devi_by_dev(dev, E_DDI_HOLD_DEVI_NOATTACH)) == NULL)
1003 		return (-1);
1004 	ddi_release_devi(dip);		/* for e_ddi_hold_devi_by_dev() */
1005 
1006 	/*
1007 	 * Allocate and initialize the common elements of data
1008 	 * access handle.
1009 	 */
1010 	handle = impl_acc_hdl_alloc(KM_SLEEP, NULL);
1011 	if (handle == NULL)
1012 		return (-1);
1013 
1014 	hp = impl_acc_hdl_get(handle);
1015 	hp->ah_vers = VERS_ACCHDL;
1016 	hp->ah_dip = dip;
1017 	hp->ah_rnumber = rnumber;
1018 	hp->ah_offset = 0;
1019 	hp->ah_len = 0;
1020 	hp->ah_acc = *accattrp;
1021 
1022 	/*
1023 	 * Set up the mapping request and call to parent.
1024 	 */
1025 	mr.map_op = DDI_MO_MAP_HANDLE;
1026 	mr.map_type = DDI_MT_RNUMBER;
1027 	mr.map_obj.rnumber = rnumber;
1028 	mr.map_prot = PROT_READ | PROT_WRITE;
1029 	mr.map_flags = DDI_MF_KERNEL_MAPPING;
1030 	mr.map_handlep = hp;
1031 	mr.map_vers = DDI_MAP_VERSION;
1032 	result = ddi_map(dip, &mr, 0, 0, NULL);
1033 
1034 	/*
1035 	 * Region must be mappable, pick up flags from the framework.
1036 	 */
1037 	*hat_flags = hp->ah_hat_flags;
1038 
1039 	impl_acc_hdl_free(handle);
1040 
1041 	/*
1042 	 * check for end result.
1043 	 */
1044 	if (result != DDI_SUCCESS)
1045 		return (-1);
1046 	return (0);
1047 }
1048 
1049 
1050 /*
1051  * Property functions:	 See also, ddipropdefs.h.
1052  *
1053  * These functions are the framework for the property functions,
1054  * i.e. they support software defined properties.  All implementation
1055  * specific property handling (i.e.: self-identifying devices and
1056  * PROM defined properties are handled in the implementation specific
1057  * functions (defined in ddi_implfuncs.h).
1058  */
1059 
1060 /*
1061  * nopropop:	Shouldn't be called, right?
1062  */
1063 int
1064 nopropop(dev_t dev, dev_info_t *dip, ddi_prop_op_t prop_op, int mod_flags,
1065     char *name, caddr_t valuep, int *lengthp)
1066 {
1067 	_NOTE(ARGUNUSED(dev, dip, prop_op, mod_flags, name, valuep, lengthp))
1068 	return (DDI_PROP_NOT_FOUND);
1069 }
1070 
1071 #ifdef	DDI_PROP_DEBUG
1072 int ddi_prop_debug_flag = 0;
1073 
1074 int
1075 ddi_prop_debug(int enable)
1076 {
1077 	int prev = ddi_prop_debug_flag;
1078 
1079 	if ((enable != 0) || (prev != 0))
1080 		printf("ddi_prop_debug: debugging %s\n",
1081 		    enable ? "enabled" : "disabled");
1082 	ddi_prop_debug_flag = enable;
1083 	return (prev);
1084 }
1085 
1086 #endif	/* DDI_PROP_DEBUG */
1087 
1088 /*
1089  * Search a property list for a match, if found return pointer
1090  * to matching prop struct, else return NULL.
1091  */
1092 
1093 ddi_prop_t *
1094 i_ddi_prop_search(dev_t dev, char *name, uint_t flags, ddi_prop_t **list_head)
1095 {
1096 	ddi_prop_t	*propp;
1097 
1098 	/*
1099 	 * find the property in child's devinfo:
1100 	 * Search order defined by this search function is first matching
1101 	 * property with input dev == DDI_DEV_T_ANY matching any dev or
1102 	 * dev == propp->prop_dev, name == propp->name, and the correct
1103 	 * data type as specified in the flags.  If a DDI_DEV_T_NONE dev
1104 	 * value made it this far then it implies a DDI_DEV_T_ANY search.
1105 	 */
1106 	if (dev == DDI_DEV_T_NONE)
1107 		dev = DDI_DEV_T_ANY;
1108 
1109 	for (propp = *list_head; propp != NULL; propp = propp->prop_next)  {
1110 
1111 		if (!DDI_STRSAME(propp->prop_name, name))
1112 			continue;
1113 
1114 		if ((dev != DDI_DEV_T_ANY) && (propp->prop_dev != dev))
1115 			continue;
1116 
1117 		if (((propp->prop_flags & flags) & DDI_PROP_TYPE_MASK) == 0)
1118 			continue;
1119 
1120 		return (propp);
1121 	}
1122 
1123 	return ((ddi_prop_t *)0);
1124 }
1125 
1126 /*
1127  * Search for property within devnames structures
1128  */
1129 ddi_prop_t *
1130 i_ddi_search_global_prop(dev_t dev, char *name, uint_t flags)
1131 {
1132 	major_t		major;
1133 	struct devnames	*dnp;
1134 	ddi_prop_t	*propp;
1135 
1136 	/*
1137 	 * Valid dev_t value is needed to index into the
1138 	 * correct devnames entry, therefore a dev_t
1139 	 * value of DDI_DEV_T_ANY is not appropriate.
1140 	 */
1141 	ASSERT(dev != DDI_DEV_T_ANY);
1142 	if (dev == DDI_DEV_T_ANY) {
1143 		return ((ddi_prop_t *)0);
1144 	}
1145 
1146 	major = getmajor(dev);
1147 	dnp = &(devnamesp[major]);
1148 
1149 	if (dnp->dn_global_prop_ptr == NULL)
1150 		return ((ddi_prop_t *)0);
1151 
1152 	LOCK_DEV_OPS(&dnp->dn_lock);
1153 
1154 	for (propp = dnp->dn_global_prop_ptr->prop_list;
1155 	    propp != NULL;
1156 	    propp = (ddi_prop_t *)propp->prop_next) {
1157 
1158 		if (!DDI_STRSAME(propp->prop_name, name))
1159 			continue;
1160 
1161 		if ((!(flags & DDI_PROP_ROOTNEX_GLOBAL)) &&
1162 		    (!(flags & LDI_DEV_T_ANY)) && (propp->prop_dev != dev))
1163 			continue;
1164 
1165 		if (((propp->prop_flags & flags) & DDI_PROP_TYPE_MASK) == 0)
1166 			continue;
1167 
1168 		/* Property found, return it */
1169 		UNLOCK_DEV_OPS(&dnp->dn_lock);
1170 		return (propp);
1171 	}
1172 
1173 	UNLOCK_DEV_OPS(&dnp->dn_lock);
1174 	return ((ddi_prop_t *)0);
1175 }
1176 
1177 static char prop_no_mem_msg[] = "can't allocate memory for ddi property <%s>";
1178 
1179 /*
1180  * ddi_prop_search_global:
1181  *	Search the global property list within devnames
1182  *	for the named property.  Return the encoded value.
1183  */
1184 static int
1185 i_ddi_prop_search_global(dev_t dev, uint_t flags, char *name,
1186     void *valuep, uint_t *lengthp)
1187 {
1188 	ddi_prop_t	*propp;
1189 	caddr_t		buffer;
1190 
1191 	propp =  i_ddi_search_global_prop(dev, name, flags);
1192 
1193 	/* Property NOT found, bail */
1194 	if (propp == (ddi_prop_t *)0)
1195 		return (DDI_PROP_NOT_FOUND);
1196 
1197 	if (propp->prop_flags & DDI_PROP_UNDEF_IT)
1198 		return (DDI_PROP_UNDEFINED);
1199 
1200 	if ((buffer = kmem_alloc(propp->prop_len,
1201 	    (flags & DDI_PROP_CANSLEEP) ? KM_SLEEP : KM_NOSLEEP)) == NULL) {
1202 		cmn_err(CE_CONT, prop_no_mem_msg, name);
1203 		return (DDI_PROP_NO_MEMORY);
1204 	}
1205 
1206 	/*
1207 	 * Return the encoded data
1208 	 */
1209 	*(caddr_t *)valuep = buffer;
1210 	*lengthp = propp->prop_len;
1211 	bcopy(propp->prop_val, buffer, propp->prop_len);
1212 
1213 	return (DDI_PROP_SUCCESS);
1214 }
1215 
1216 /*
1217  * ddi_prop_search_common:	Lookup and return the encoded value
1218  */
1219 int
1220 ddi_prop_search_common(dev_t dev, dev_info_t *dip, ddi_prop_op_t prop_op,
1221     uint_t flags, char *name, void *valuep, uint_t *lengthp)
1222 {
1223 	ddi_prop_t	*propp;
1224 	int		i;
1225 	caddr_t		buffer;
1226 	caddr_t		prealloc = NULL;
1227 	int		plength = 0;
1228 	dev_info_t	*pdip;
1229 	int		(*bop)();
1230 
1231 	/*CONSTANTCONDITION*/
1232 	while (1)  {
1233 
1234 		mutex_enter(&(DEVI(dip)->devi_lock));
1235 
1236 
1237 		/*
1238 		 * find the property in child's devinfo:
1239 		 * Search order is:
1240 		 *	1. driver defined properties
1241 		 *	2. system defined properties
1242 		 *	3. driver global properties
1243 		 *	4. boot defined properties
1244 		 */
1245 
1246 		propp = i_ddi_prop_search(dev, name, flags,
1247 		    &(DEVI(dip)->devi_drv_prop_ptr));
1248 		if (propp == NULL)  {
1249 			propp = i_ddi_prop_search(dev, name, flags,
1250 			    &(DEVI(dip)->devi_sys_prop_ptr));
1251 		}
1252 		if ((propp == NULL) && DEVI(dip)->devi_global_prop_list) {
1253 			propp = i_ddi_prop_search(dev, name, flags,
1254 			    &DEVI(dip)->devi_global_prop_list->prop_list);
1255 		}
1256 
1257 		if (propp == NULL)  {
1258 			propp = i_ddi_prop_search(dev, name, flags,
1259 			    &(DEVI(dip)->devi_hw_prop_ptr));
1260 		}
1261 
1262 		/*
1263 		 * Software property found?
1264 		 */
1265 		if (propp != (ddi_prop_t *)0)	{
1266 
1267 			/*
1268 			 * If explicit undefine, return now.
1269 			 */
1270 			if (propp->prop_flags & DDI_PROP_UNDEF_IT) {
1271 				mutex_exit(&(DEVI(dip)->devi_lock));
1272 				if (prealloc)
1273 					kmem_free(prealloc, plength);
1274 				return (DDI_PROP_UNDEFINED);
1275 			}
1276 
1277 			/*
1278 			 * If we only want to know if it exists, return now
1279 			 */
1280 			if (prop_op == PROP_EXISTS) {
1281 				mutex_exit(&(DEVI(dip)->devi_lock));
1282 				ASSERT(prealloc == NULL);
1283 				return (DDI_PROP_SUCCESS);
1284 			}
1285 
1286 			/*
1287 			 * If length only request or prop length == 0,
1288 			 * service request and return now.
1289 			 */
1290 			if ((prop_op == PROP_LEN) ||(propp->prop_len == 0)) {
1291 				*lengthp = propp->prop_len;
1292 
1293 				/*
1294 				 * if prop_op is PROP_LEN_AND_VAL_ALLOC
1295 				 * that means prop_len is 0, so set valuep
1296 				 * also to NULL
1297 				 */
1298 				if (prop_op == PROP_LEN_AND_VAL_ALLOC)
1299 					*(caddr_t *)valuep = NULL;
1300 
1301 				mutex_exit(&(DEVI(dip)->devi_lock));
1302 				if (prealloc)
1303 					kmem_free(prealloc, plength);
1304 				return (DDI_PROP_SUCCESS);
1305 			}
1306 
1307 			/*
1308 			 * If LEN_AND_VAL_ALLOC and the request can sleep,
1309 			 * drop the mutex, allocate the buffer, and go
1310 			 * through the loop again.  If we already allocated
1311 			 * the buffer, and the size of the property changed,
1312 			 * keep trying...
1313 			 */
1314 			if ((prop_op == PROP_LEN_AND_VAL_ALLOC) &&
1315 			    (flags & DDI_PROP_CANSLEEP))  {
1316 				if (prealloc && (propp->prop_len != plength)) {
1317 					kmem_free(prealloc, plength);
1318 					prealloc = NULL;
1319 				}
1320 				if (prealloc == NULL)  {
1321 					plength = propp->prop_len;
1322 					mutex_exit(&(DEVI(dip)->devi_lock));
1323 					prealloc = kmem_alloc(plength,
1324 					    KM_SLEEP);
1325 					continue;
1326 				}
1327 			}
1328 
1329 			/*
1330 			 * Allocate buffer, if required.  Either way,
1331 			 * set `buffer' variable.
1332 			 */
1333 			i = *lengthp;			/* Get callers length */
1334 			*lengthp = propp->prop_len;	/* Set callers length */
1335 
1336 			switch (prop_op) {
1337 
1338 			case PROP_LEN_AND_VAL_ALLOC:
1339 
1340 				if (prealloc == NULL) {
1341 					buffer = kmem_alloc(propp->prop_len,
1342 					    KM_NOSLEEP);
1343 				} else {
1344 					buffer = prealloc;
1345 				}
1346 
1347 				if (buffer == NULL)  {
1348 					mutex_exit(&(DEVI(dip)->devi_lock));
1349 					cmn_err(CE_CONT, prop_no_mem_msg, name);
1350 					return (DDI_PROP_NO_MEMORY);
1351 				}
1352 				/* Set callers buf ptr */
1353 				*(caddr_t *)valuep = buffer;
1354 				break;
1355 
1356 			case PROP_LEN_AND_VAL_BUF:
1357 
1358 				if (propp->prop_len > (i)) {
1359 					mutex_exit(&(DEVI(dip)->devi_lock));
1360 					return (DDI_PROP_BUF_TOO_SMALL);
1361 				}
1362 
1363 				buffer = valuep;  /* Get callers buf ptr */
1364 				break;
1365 
1366 			default:
1367 				break;
1368 			}
1369 
1370 			/*
1371 			 * Do the copy.
1372 			 */
1373 			bcopy(propp->prop_val, buffer, propp->prop_len);
1374 			mutex_exit(&(DEVI(dip)->devi_lock));
1375 			return (DDI_PROP_SUCCESS);
1376 		}
1377 
1378 		mutex_exit(&(DEVI(dip)->devi_lock));
1379 		if (prealloc)
1380 			kmem_free(prealloc, plength);
1381 		prealloc = NULL;
1382 
1383 		/*
1384 		 * Prop not found, call parent bus_ops to deal with possible
1385 		 * h/w layer (possible PROM defined props, etc.) and to
1386 		 * possibly ascend the hierarchy, if allowed by flags.
1387 		 */
1388 		pdip = (dev_info_t *)DEVI(dip)->devi_parent;
1389 
1390 		/*
1391 		 * One last call for the root driver PROM props?
1392 		 */
1393 		if (dip == ddi_root_node())  {
1394 			return (ddi_bus_prop_op(dev, dip, dip, prop_op,
1395 			    flags, name, valuep, (int *)lengthp));
1396 		}
1397 
1398 		/*
1399 		 * We may have been called to check for properties
1400 		 * within a single devinfo node that has no parent -
1401 		 * see make_prop()
1402 		 */
1403 		if (pdip == NULL) {
1404 			ASSERT((flags &
1405 			    (DDI_PROP_DONTPASS | DDI_PROP_NOTPROM)) ==
1406 			    (DDI_PROP_DONTPASS | DDI_PROP_NOTPROM));
1407 			return (DDI_PROP_NOT_FOUND);
1408 		}
1409 
1410 		/*
1411 		 * Instead of recursing, we do iterative calls up the tree.
1412 		 * As a bit of optimization, skip the bus_op level if the
1413 		 * node is a s/w node and if the parent's bus_prop_op function
1414 		 * is `ddi_bus_prop_op', because we know that in this case,
1415 		 * this function does nothing.
1416 		 *
1417 		 * 4225415: If the parent isn't attached, or the child
1418 		 * hasn't been named by the parent yet, use the default
1419 		 * ddi_bus_prop_op as a proxy for the parent.  This
1420 		 * allows property lookups in any child/parent state to
1421 		 * include 'prom' and inherited properties, even when
1422 		 * there are no drivers attached to the child or parent.
1423 		 */
1424 
1425 		bop = ddi_bus_prop_op;
1426 		if (i_ddi_devi_attached(pdip) &&
1427 		    (i_ddi_node_state(dip) >= DS_INITIALIZED))
1428 			bop = DEVI(pdip)->devi_ops->devo_bus_ops->bus_prop_op;
1429 
1430 		i = DDI_PROP_NOT_FOUND;
1431 
1432 		if ((bop != ddi_bus_prop_op) || ndi_dev_is_prom_node(dip)) {
1433 			i = (*bop)(dev, pdip, dip, prop_op,
1434 			    flags | DDI_PROP_DONTPASS,
1435 			    name, valuep, lengthp);
1436 		}
1437 
1438 		if ((flags & DDI_PROP_DONTPASS) ||
1439 		    (i != DDI_PROP_NOT_FOUND))
1440 			return (i);
1441 
1442 		dip = pdip;
1443 	}
1444 	/*NOTREACHED*/
1445 }
1446 
1447 
1448 /*
1449  * ddi_prop_op: The basic property operator for drivers.
1450  *
1451  * In ddi_prop_op, the type of valuep is interpreted based on prop_op:
1452  *
1453  *	prop_op			valuep
1454  *	------			------
1455  *
1456  *	PROP_LEN		<unused>
1457  *
1458  *	PROP_LEN_AND_VAL_BUF	Pointer to callers buffer
1459  *
1460  *	PROP_LEN_AND_VAL_ALLOC	Address of callers pointer (will be set to
1461  *				address of allocated buffer, if successful)
1462  */
1463 int
1464 ddi_prop_op(dev_t dev, dev_info_t *dip, ddi_prop_op_t prop_op, int mod_flags,
1465     char *name, caddr_t valuep, int *lengthp)
1466 {
1467 	int	i;
1468 
1469 	ASSERT((mod_flags & DDI_PROP_TYPE_MASK) == 0);
1470 
1471 	/*
1472 	 * If this was originally an LDI prop lookup then we bail here.
1473 	 * The reason is that the LDI property lookup interfaces first call
1474 	 * a drivers prop_op() entry point to allow it to override
1475 	 * properties.  But if we've made it here, then the driver hasn't
1476 	 * overriden any properties.  We don't want to continue with the
1477 	 * property search here because we don't have any type inforamtion.
1478 	 * When we return failure, the LDI interfaces will then proceed to
1479 	 * call the typed property interfaces to look up the property.
1480 	 */
1481 	if (mod_flags & DDI_PROP_DYNAMIC)
1482 		return (DDI_PROP_NOT_FOUND);
1483 
1484 	/*
1485 	 * check for pre-typed property consumer asking for typed property:
1486 	 * see e_ddi_getprop_int64.
1487 	 */
1488 	if (mod_flags & DDI_PROP_CONSUMER_TYPED)
1489 		mod_flags |= DDI_PROP_TYPE_INT64;
1490 	mod_flags |= DDI_PROP_TYPE_ANY;
1491 
1492 	i = ddi_prop_search_common(dev, dip, prop_op,
1493 	    mod_flags, name, valuep, (uint_t *)lengthp);
1494 	if (i == DDI_PROP_FOUND_1275)
1495 		return (DDI_PROP_SUCCESS);
1496 	return (i);
1497 }
1498 
1499 /*
1500  * ddi_prop_op_nblocks_blksize: The basic property operator for drivers that
1501  * maintain size in number of blksize blocks.  Provides a dynamic property
1502  * implementation for size oriented properties based on nblocks64 and blksize
1503  * values passed in by the driver.  Fallback to ddi_prop_op if the nblocks64
1504  * is too large.  This interface should not be used with a nblocks64 that
1505  * represents the driver's idea of how to represent unknown, if nblocks is
1506  * unknown use ddi_prop_op.
1507  */
1508 int
1509 ddi_prop_op_nblocks_blksize(dev_t dev, dev_info_t *dip, ddi_prop_op_t prop_op,
1510     int mod_flags, char *name, caddr_t valuep, int *lengthp,
1511     uint64_t nblocks64, uint_t blksize)
1512 {
1513 	uint64_t size64;
1514 	int	blkshift;
1515 
1516 	/* convert block size to shift value */
1517 	ASSERT(BIT_ONLYONESET(blksize));
1518 	blkshift = highbit(blksize) - 1;
1519 
1520 	/*
1521 	 * There is no point in supporting nblocks64 values that don't have
1522 	 * an accurate uint64_t byte count representation.
1523 	 */
1524 	if (nblocks64 >= (UINT64_MAX >> blkshift))
1525 		return (ddi_prop_op(dev, dip, prop_op, mod_flags,
1526 		    name, valuep, lengthp));
1527 
1528 	size64 = nblocks64 << blkshift;
1529 	return (ddi_prop_op_size_blksize(dev, dip, prop_op, mod_flags,
1530 	    name, valuep, lengthp, size64, blksize));
1531 }
1532 
1533 /*
1534  * ddi_prop_op_nblocks: ddi_prop_op_nblocks_blksize with DEV_BSIZE blksize.
1535  */
1536 int
1537 ddi_prop_op_nblocks(dev_t dev, dev_info_t *dip, ddi_prop_op_t prop_op,
1538     int mod_flags, char *name, caddr_t valuep, int *lengthp, uint64_t nblocks64)
1539 {
1540 	return (ddi_prop_op_nblocks_blksize(dev, dip, prop_op,
1541 	    mod_flags, name, valuep, lengthp, nblocks64, DEV_BSIZE));
1542 }
1543 
1544 /*
1545  * ddi_prop_op_size_blksize: The basic property operator for block drivers that
1546  * maintain size in bytes. Provides a of dynamic property implementation for
1547  * size oriented properties based on size64 value and blksize passed in by the
1548  * driver.  Fallback to ddi_prop_op if the size64 is too large. This interface
1549  * should not be used with a size64 that represents the driver's idea of how
1550  * to represent unknown, if size is unknown use ddi_prop_op.
1551  *
1552  * NOTE: the legacy "nblocks"/"size" properties are treated as 32-bit unsigned
1553  * integers. While the most likely interface to request them ([bc]devi_size)
1554  * is declared int (signed) there is no enforcement of this, which means we
1555  * can't enforce limitations here without risking regression.
1556  */
1557 int
1558 ddi_prop_op_size_blksize(dev_t dev, dev_info_t *dip, ddi_prop_op_t prop_op,
1559     int mod_flags, char *name, caddr_t valuep, int *lengthp, uint64_t size64,
1560     uint_t blksize)
1561 {
1562 	uint64_t nblocks64;
1563 	int	callers_length;
1564 	caddr_t	buffer;
1565 	int	blkshift;
1566 
1567 	/*
1568 	 * This is a kludge to support capture of size(9P) pure dynamic
1569 	 * properties in snapshots for non-cmlb code (without exposing
1570 	 * i_ddi_prop_dyn changes). When everyone uses cmlb, this code
1571 	 * should be removed.
1572 	 */
1573 	if (i_ddi_prop_dyn_driver_get(dip) == NULL) {
1574 		static i_ddi_prop_dyn_t prop_dyn_size[] = {
1575 		    {"Size",		DDI_PROP_TYPE_INT64,	S_IFCHR},
1576 		    {"Nblocks",		DDI_PROP_TYPE_INT64,	S_IFBLK},
1577 		    {NULL}
1578 		};
1579 		i_ddi_prop_dyn_driver_set(dip, prop_dyn_size);
1580 	}
1581 
1582 	/* convert block size to shift value */
1583 	ASSERT(BIT_ONLYONESET(blksize));
1584 	blkshift = highbit(blksize) - 1;
1585 
1586 	/* compute DEV_BSIZE nblocks value */
1587 	nblocks64 = size64 >> blkshift;
1588 
1589 	/* get callers length, establish length of our dynamic properties */
1590 	callers_length = *lengthp;
1591 
1592 	if (strcmp(name, "Nblocks") == 0)
1593 		*lengthp = sizeof (uint64_t);
1594 	else if (strcmp(name, "Size") == 0)
1595 		*lengthp = sizeof (uint64_t);
1596 	else if ((strcmp(name, "nblocks") == 0) && (nblocks64 < UINT_MAX))
1597 		*lengthp = sizeof (uint32_t);
1598 	else if ((strcmp(name, "size") == 0) && (size64 < UINT_MAX))
1599 		*lengthp = sizeof (uint32_t);
1600 	else if ((strcmp(name, "blksize") == 0) && (blksize < UINT_MAX))
1601 		*lengthp = sizeof (uint32_t);
1602 	else {
1603 		/* fallback to ddi_prop_op */
1604 		return (ddi_prop_op(dev, dip, prop_op, mod_flags,
1605 		    name, valuep, lengthp));
1606 	}
1607 
1608 	/* service request for the length of the property */
1609 	if (prop_op == PROP_LEN)
1610 		return (DDI_PROP_SUCCESS);
1611 
1612 	switch (prop_op) {
1613 	case PROP_LEN_AND_VAL_ALLOC:
1614 		if ((buffer = kmem_alloc(*lengthp,
1615 		    (mod_flags & DDI_PROP_CANSLEEP) ?
1616 		    KM_SLEEP : KM_NOSLEEP)) == NULL)
1617 			return (DDI_PROP_NO_MEMORY);
1618 
1619 		*(caddr_t *)valuep = buffer;	/* set callers buf ptr */
1620 		break;
1621 
1622 	case PROP_LEN_AND_VAL_BUF:
1623 		/* the length of the property and the request must match */
1624 		if (callers_length != *lengthp)
1625 			return (DDI_PROP_INVAL_ARG);
1626 
1627 		buffer = valuep;		/* get callers buf ptr */
1628 		break;
1629 
1630 	default:
1631 		return (DDI_PROP_INVAL_ARG);
1632 	}
1633 
1634 	/* transfer the value into the buffer */
1635 	if (strcmp(name, "Nblocks") == 0)
1636 		*((uint64_t *)buffer) = nblocks64;
1637 	else if (strcmp(name, "Size") == 0)
1638 		*((uint64_t *)buffer) = size64;
1639 	else if (strcmp(name, "nblocks") == 0)
1640 		*((uint32_t *)buffer) = (uint32_t)nblocks64;
1641 	else if (strcmp(name, "size") == 0)
1642 		*((uint32_t *)buffer) = (uint32_t)size64;
1643 	else if (strcmp(name, "blksize") == 0)
1644 		*((uint32_t *)buffer) = (uint32_t)blksize;
1645 	return (DDI_PROP_SUCCESS);
1646 }
1647 
1648 /*
1649  * ddi_prop_op_size: ddi_prop_op_size_blksize with DEV_BSIZE block size.
1650  */
1651 int
1652 ddi_prop_op_size(dev_t dev, dev_info_t *dip, ddi_prop_op_t prop_op,
1653     int mod_flags, char *name, caddr_t valuep, int *lengthp, uint64_t size64)
1654 {
1655 	return (ddi_prop_op_size_blksize(dev, dip, prop_op,
1656 	    mod_flags, name, valuep, lengthp, size64, DEV_BSIZE));
1657 }
1658 
1659 /*
1660  * Variable length props...
1661  */
1662 
1663 /*
1664  * ddi_getlongprop:	Get variable length property len+val into a buffer
1665  *		allocated by property provider via kmem_alloc. Requester
1666  *		is responsible for freeing returned property via kmem_free.
1667  *
1668  *	Arguments:
1669  *
1670  *	dev_t:	Input:	dev_t of property.
1671  *	dip:	Input:	dev_info_t pointer of child.
1672  *	flags:	Input:	Possible flag modifiers are:
1673  *		DDI_PROP_DONTPASS:	Don't pass to parent if prop not found.
1674  *		DDI_PROP_CANSLEEP:	Memory allocation may sleep.
1675  *	name:	Input:	name of property.
1676  *	valuep:	Output:	Addr of callers buffer pointer.
1677  *	lengthp:Output:	*lengthp will contain prop length on exit.
1678  *
1679  *	Possible Returns:
1680  *
1681  *		DDI_PROP_SUCCESS:	Prop found and returned.
1682  *		DDI_PROP_NOT_FOUND:	Prop not found
1683  *		DDI_PROP_UNDEFINED:	Prop explicitly undefined.
1684  *		DDI_PROP_NO_MEMORY:	Prop found, but unable to alloc mem.
1685  */
1686 
1687 int
1688 ddi_getlongprop(dev_t dev, dev_info_t *dip, int flags,
1689     char *name, caddr_t valuep, int *lengthp)
1690 {
1691 	return (ddi_prop_op(dev, dip, PROP_LEN_AND_VAL_ALLOC,
1692 	    flags, name, valuep, lengthp));
1693 }
1694 
1695 /*
1696  *
1697  * ddi_getlongprop_buf:		Get long prop into pre-allocated callers
1698  *				buffer. (no memory allocation by provider).
1699  *
1700  *	dev_t:	Input:	dev_t of property.
1701  *	dip:	Input:	dev_info_t pointer of child.
1702  *	flags:	Input:	DDI_PROP_DONTPASS or NULL
1703  *	name:	Input:	name of property
1704  *	valuep:	Input:	ptr to callers buffer.
1705  *	lengthp:I/O:	ptr to length of callers buffer on entry,
1706  *			actual length of property on exit.
1707  *
1708  *	Possible returns:
1709  *
1710  *		DDI_PROP_SUCCESS	Prop found and returned
1711  *		DDI_PROP_NOT_FOUND	Prop not found
1712  *		DDI_PROP_UNDEFINED	Prop explicitly undefined.
1713  *		DDI_PROP_BUF_TOO_SMALL	Prop found, callers buf too small,
1714  *					no value returned, but actual prop
1715  *					length returned in *lengthp
1716  *
1717  */
1718 
1719 int
1720 ddi_getlongprop_buf(dev_t dev, dev_info_t *dip, int flags,
1721     char *name, caddr_t valuep, int *lengthp)
1722 {
1723 	return (ddi_prop_op(dev, dip, PROP_LEN_AND_VAL_BUF,
1724 	    flags, name, valuep, lengthp));
1725 }
1726 
1727 /*
1728  * Integer/boolean sized props.
1729  *
1730  * Call is value only... returns found boolean or int sized prop value or
1731  * defvalue if prop not found or is wrong length or is explicitly undefined.
1732  * Only flag is DDI_PROP_DONTPASS...
1733  *
1734  * By convention, this interface returns boolean (0) sized properties
1735  * as value (int)1.
1736  *
1737  * This never returns an error, if property not found or specifically
1738  * undefined, the input `defvalue' is returned.
1739  */
1740 
1741 int
1742 ddi_getprop(dev_t dev, dev_info_t *dip, int flags, char *name, int defvalue)
1743 {
1744 	int	propvalue = defvalue;
1745 	int	proplength = sizeof (int);
1746 	int	error;
1747 
1748 	error = ddi_prop_op(dev, dip, PROP_LEN_AND_VAL_BUF,
1749 	    flags, name, (caddr_t)&propvalue, &proplength);
1750 
1751 	if ((error == DDI_PROP_SUCCESS) && (proplength == 0))
1752 		propvalue = 1;
1753 
1754 	return (propvalue);
1755 }
1756 
1757 /*
1758  * Get prop length interface: flags are 0 or DDI_PROP_DONTPASS
1759  * if returns DDI_PROP_SUCCESS, length returned in *lengthp.
1760  */
1761 
1762 int
1763 ddi_getproplen(dev_t dev, dev_info_t *dip, int flags, char *name, int *lengthp)
1764 {
1765 	return (ddi_prop_op(dev, dip, PROP_LEN, flags, name, NULL, lengthp));
1766 }
1767 
1768 /*
1769  * Allocate a struct prop_driver_data, along with 'size' bytes
1770  * for decoded property data.  This structure is freed by
1771  * calling ddi_prop_free(9F).
1772  */
1773 static void *
1774 ddi_prop_decode_alloc(size_t size, void (*prop_free)(struct prop_driver_data *))
1775 {
1776 	struct prop_driver_data *pdd;
1777 
1778 	/*
1779 	 * Allocate a structure with enough memory to store the decoded data.
1780 	 */
1781 	pdd = kmem_zalloc(sizeof (struct prop_driver_data) + size, KM_SLEEP);
1782 	pdd->pdd_size = (sizeof (struct prop_driver_data) + size);
1783 	pdd->pdd_prop_free = prop_free;
1784 
1785 	/*
1786 	 * Return a pointer to the location to put the decoded data.
1787 	 */
1788 	return ((void *)((caddr_t)pdd + sizeof (struct prop_driver_data)));
1789 }
1790 
1791 /*
1792  * Allocated the memory needed to store the encoded data in the property
1793  * handle.
1794  */
1795 static int
1796 ddi_prop_encode_alloc(prop_handle_t *ph, size_t size)
1797 {
1798 	/*
1799 	 * If size is zero, then set data to NULL and size to 0.  This
1800 	 * is a boolean property.
1801 	 */
1802 	if (size == 0) {
1803 		ph->ph_size = 0;
1804 		ph->ph_data = NULL;
1805 		ph->ph_cur_pos = NULL;
1806 		ph->ph_save_pos = NULL;
1807 	} else {
1808 		if (ph->ph_flags == DDI_PROP_DONTSLEEP) {
1809 			ph->ph_data = kmem_zalloc(size, KM_NOSLEEP);
1810 			if (ph->ph_data == NULL)
1811 				return (DDI_PROP_NO_MEMORY);
1812 		} else
1813 			ph->ph_data = kmem_zalloc(size, KM_SLEEP);
1814 		ph->ph_size = size;
1815 		ph->ph_cur_pos = ph->ph_data;
1816 		ph->ph_save_pos = ph->ph_data;
1817 	}
1818 	return (DDI_PROP_SUCCESS);
1819 }
1820 
1821 /*
1822  * Free the space allocated by the lookup routines.  Each lookup routine
1823  * returns a pointer to the decoded data to the driver.  The driver then
1824  * passes this pointer back to us.  This data actually lives in a struct
1825  * prop_driver_data.  We use negative indexing to find the beginning of
1826  * the structure and then free the entire structure using the size and
1827  * the free routine stored in the structure.
1828  */
1829 void
1830 ddi_prop_free(void *datap)
1831 {
1832 	struct prop_driver_data *pdd;
1833 
1834 	/*
1835 	 * Get the structure
1836 	 */
1837 	pdd = (struct prop_driver_data *)
1838 	    ((caddr_t)datap - sizeof (struct prop_driver_data));
1839 	/*
1840 	 * Call the free routine to free it
1841 	 */
1842 	(*pdd->pdd_prop_free)(pdd);
1843 }
1844 
1845 /*
1846  * Free the data associated with an array of ints,
1847  * allocated with ddi_prop_decode_alloc().
1848  */
1849 static void
1850 ddi_prop_free_ints(struct prop_driver_data *pdd)
1851 {
1852 	kmem_free(pdd, pdd->pdd_size);
1853 }
1854 
1855 /*
1856  * Free a single string property or a single string contained within
1857  * the argv style return value of an array of strings.
1858  */
1859 static void
1860 ddi_prop_free_string(struct prop_driver_data *pdd)
1861 {
1862 	kmem_free(pdd, pdd->pdd_size);
1863 
1864 }
1865 
1866 /*
1867  * Free an array of strings.
1868  */
1869 static void
1870 ddi_prop_free_strings(struct prop_driver_data *pdd)
1871 {
1872 	kmem_free(pdd, pdd->pdd_size);
1873 }
1874 
1875 /*
1876  * Free the data associated with an array of bytes.
1877  */
1878 static void
1879 ddi_prop_free_bytes(struct prop_driver_data *pdd)
1880 {
1881 	kmem_free(pdd, pdd->pdd_size);
1882 }
1883 
1884 /*
1885  * Reset the current location pointer in the property handle to the
1886  * beginning of the data.
1887  */
1888 void
1889 ddi_prop_reset_pos(prop_handle_t *ph)
1890 {
1891 	ph->ph_cur_pos = ph->ph_data;
1892 	ph->ph_save_pos = ph->ph_data;
1893 }
1894 
1895 /*
1896  * Restore the current location pointer in the property handle to the
1897  * saved position.
1898  */
1899 void
1900 ddi_prop_save_pos(prop_handle_t *ph)
1901 {
1902 	ph->ph_save_pos = ph->ph_cur_pos;
1903 }
1904 
1905 /*
1906  * Save the location that the current location pointer is pointing to..
1907  */
1908 void
1909 ddi_prop_restore_pos(prop_handle_t *ph)
1910 {
1911 	ph->ph_cur_pos = ph->ph_save_pos;
1912 }
1913 
1914 /*
1915  * Property encode/decode functions
1916  */
1917 
1918 /*
1919  * Decode a single integer property
1920  */
1921 static int
1922 ddi_prop_fm_decode_int(prop_handle_t *ph, void *data, uint_t *nelements)
1923 {
1924 	int	i;
1925 	int	tmp;
1926 
1927 	/*
1928 	 * If there is nothing to decode return an error
1929 	 */
1930 	if (ph->ph_size == 0)
1931 		return (DDI_PROP_END_OF_DATA);
1932 
1933 	/*
1934 	 * Decode the property as a single integer and return it
1935 	 * in data if we were able to decode it.
1936 	 */
1937 	i = DDI_PROP_INT(ph, DDI_PROP_CMD_DECODE, &tmp);
1938 	if (i < DDI_PROP_RESULT_OK) {
1939 		switch (i) {
1940 		case DDI_PROP_RESULT_EOF:
1941 			return (DDI_PROP_END_OF_DATA);
1942 
1943 		case DDI_PROP_RESULT_ERROR:
1944 			return (DDI_PROP_CANNOT_DECODE);
1945 		}
1946 	}
1947 
1948 	*(int *)data = tmp;
1949 	*nelements = 1;
1950 	return (DDI_PROP_SUCCESS);
1951 }
1952 
1953 /*
1954  * Decode a single 64 bit integer property
1955  */
1956 static int
1957 ddi_prop_fm_decode_int64(prop_handle_t *ph, void *data, uint_t *nelements)
1958 {
1959 	int	i;
1960 	int64_t	tmp;
1961 
1962 	/*
1963 	 * If there is nothing to decode return an error
1964 	 */
1965 	if (ph->ph_size == 0)
1966 		return (DDI_PROP_END_OF_DATA);
1967 
1968 	/*
1969 	 * Decode the property as a single integer and return it
1970 	 * in data if we were able to decode it.
1971 	 */
1972 	i = DDI_PROP_INT64(ph, DDI_PROP_CMD_DECODE, &tmp);
1973 	if (i < DDI_PROP_RESULT_OK) {
1974 		switch (i) {
1975 		case DDI_PROP_RESULT_EOF:
1976 			return (DDI_PROP_END_OF_DATA);
1977 
1978 		case DDI_PROP_RESULT_ERROR:
1979 			return (DDI_PROP_CANNOT_DECODE);
1980 		}
1981 	}
1982 
1983 	*(int64_t *)data = tmp;
1984 	*nelements = 1;
1985 	return (DDI_PROP_SUCCESS);
1986 }
1987 
1988 /*
1989  * Decode an array of integers property
1990  */
1991 static int
1992 ddi_prop_fm_decode_ints(prop_handle_t *ph, void *data, uint_t *nelements)
1993 {
1994 	int	i;
1995 	int	cnt = 0;
1996 	int	*tmp;
1997 	int	*intp;
1998 	int	n;
1999 
2000 	/*
2001 	 * Figure out how many array elements there are by going through the
2002 	 * data without decoding it first and counting.
2003 	 */
2004 	for (;;) {
2005 		i = DDI_PROP_INT(ph, DDI_PROP_CMD_SKIP, NULL);
2006 		if (i < 0)
2007 			break;
2008 		cnt++;
2009 	}
2010 
2011 	/*
2012 	 * If there are no elements return an error
2013 	 */
2014 	if (cnt == 0)
2015 		return (DDI_PROP_END_OF_DATA);
2016 
2017 	/*
2018 	 * If we cannot skip through the data, we cannot decode it
2019 	 */
2020 	if (i == DDI_PROP_RESULT_ERROR)
2021 		return (DDI_PROP_CANNOT_DECODE);
2022 
2023 	/*
2024 	 * Reset the data pointer to the beginning of the encoded data
2025 	 */
2026 	ddi_prop_reset_pos(ph);
2027 
2028 	/*
2029 	 * Allocated memory to store the decoded value in.
2030 	 */
2031 	intp = ddi_prop_decode_alloc((cnt * sizeof (int)),
2032 	    ddi_prop_free_ints);
2033 
2034 	/*
2035 	 * Decode each element and place it in the space we just allocated
2036 	 */
2037 	tmp = intp;
2038 	for (n = 0; n < cnt; n++, tmp++) {
2039 		i = DDI_PROP_INT(ph, DDI_PROP_CMD_DECODE, tmp);
2040 		if (i < DDI_PROP_RESULT_OK) {
2041 			/*
2042 			 * Free the space we just allocated
2043 			 * and return an error.
2044 			 */
2045 			ddi_prop_free(intp);
2046 			switch (i) {
2047 			case DDI_PROP_RESULT_EOF:
2048 				return (DDI_PROP_END_OF_DATA);
2049 
2050 			case DDI_PROP_RESULT_ERROR:
2051 				return (DDI_PROP_CANNOT_DECODE);
2052 			}
2053 		}
2054 	}
2055 
2056 	*nelements = cnt;
2057 	*(int **)data = intp;
2058 
2059 	return (DDI_PROP_SUCCESS);
2060 }
2061 
2062 /*
2063  * Decode a 64 bit integer array property
2064  */
2065 static int
2066 ddi_prop_fm_decode_int64_array(prop_handle_t *ph, void *data, uint_t *nelements)
2067 {
2068 	int	i;
2069 	int	n;
2070 	int	cnt = 0;
2071 	int64_t	*tmp;
2072 	int64_t	*intp;
2073 
2074 	/*
2075 	 * Count the number of array elements by going
2076 	 * through the data without decoding it.
2077 	 */
2078 	for (;;) {
2079 		i = DDI_PROP_INT64(ph, DDI_PROP_CMD_SKIP, NULL);
2080 		if (i < 0)
2081 			break;
2082 		cnt++;
2083 	}
2084 
2085 	/*
2086 	 * If there are no elements return an error
2087 	 */
2088 	if (cnt == 0)
2089 		return (DDI_PROP_END_OF_DATA);
2090 
2091 	/*
2092 	 * If we cannot skip through the data, we cannot decode it
2093 	 */
2094 	if (i == DDI_PROP_RESULT_ERROR)
2095 		return (DDI_PROP_CANNOT_DECODE);
2096 
2097 	/*
2098 	 * Reset the data pointer to the beginning of the encoded data
2099 	 */
2100 	ddi_prop_reset_pos(ph);
2101 
2102 	/*
2103 	 * Allocate memory to store the decoded value.
2104 	 */
2105 	intp = ddi_prop_decode_alloc((cnt * sizeof (int64_t)),
2106 	    ddi_prop_free_ints);
2107 
2108 	/*
2109 	 * Decode each element and place it in the space allocated
2110 	 */
2111 	tmp = intp;
2112 	for (n = 0; n < cnt; n++, tmp++) {
2113 		i = DDI_PROP_INT64(ph, DDI_PROP_CMD_DECODE, tmp);
2114 		if (i < DDI_PROP_RESULT_OK) {
2115 			/*
2116 			 * Free the space we just allocated
2117 			 * and return an error.
2118 			 */
2119 			ddi_prop_free(intp);
2120 			switch (i) {
2121 			case DDI_PROP_RESULT_EOF:
2122 				return (DDI_PROP_END_OF_DATA);
2123 
2124 			case DDI_PROP_RESULT_ERROR:
2125 				return (DDI_PROP_CANNOT_DECODE);
2126 			}
2127 		}
2128 	}
2129 
2130 	*nelements = cnt;
2131 	*(int64_t **)data = intp;
2132 
2133 	return (DDI_PROP_SUCCESS);
2134 }
2135 
2136 /*
2137  * Encode an array of integers property (Can be one element)
2138  */
2139 int
2140 ddi_prop_fm_encode_ints(prop_handle_t *ph, void *data, uint_t nelements)
2141 {
2142 	int	i;
2143 	int	*tmp;
2144 	int	cnt;
2145 	int	size;
2146 
2147 	/*
2148 	 * If there is no data, we cannot do anything
2149 	 */
2150 	if (nelements == 0)
2151 		return (DDI_PROP_CANNOT_ENCODE);
2152 
2153 	/*
2154 	 * Get the size of an encoded int.
2155 	 */
2156 	size = DDI_PROP_INT(ph, DDI_PROP_CMD_GET_ESIZE, NULL);
2157 
2158 	if (size < DDI_PROP_RESULT_OK) {
2159 		switch (size) {
2160 		case DDI_PROP_RESULT_EOF:
2161 			return (DDI_PROP_END_OF_DATA);
2162 
2163 		case DDI_PROP_RESULT_ERROR:
2164 			return (DDI_PROP_CANNOT_ENCODE);
2165 		}
2166 	}
2167 
2168 	/*
2169 	 * Allocate space in the handle to store the encoded int.
2170 	 */
2171 	if (ddi_prop_encode_alloc(ph, size * nelements) !=
2172 	    DDI_PROP_SUCCESS)
2173 		return (DDI_PROP_NO_MEMORY);
2174 
2175 	/*
2176 	 * Encode the array of ints.
2177 	 */
2178 	tmp = (int *)data;
2179 	for (cnt = 0; cnt < nelements; cnt++, tmp++) {
2180 		i = DDI_PROP_INT(ph, DDI_PROP_CMD_ENCODE, tmp);
2181 		if (i < DDI_PROP_RESULT_OK) {
2182 			switch (i) {
2183 			case DDI_PROP_RESULT_EOF:
2184 				return (DDI_PROP_END_OF_DATA);
2185 
2186 			case DDI_PROP_RESULT_ERROR:
2187 				return (DDI_PROP_CANNOT_ENCODE);
2188 			}
2189 		}
2190 	}
2191 
2192 	return (DDI_PROP_SUCCESS);
2193 }
2194 
2195 
2196 /*
2197  * Encode a 64 bit integer array property
2198  */
2199 int
2200 ddi_prop_fm_encode_int64(prop_handle_t *ph, void *data, uint_t nelements)
2201 {
2202 	int i;
2203 	int cnt;
2204 	int size;
2205 	int64_t *tmp;
2206 
2207 	/*
2208 	 * If there is no data, we cannot do anything
2209 	 */
2210 	if (nelements == 0)
2211 		return (DDI_PROP_CANNOT_ENCODE);
2212 
2213 	/*
2214 	 * Get the size of an encoded 64 bit int.
2215 	 */
2216 	size = DDI_PROP_INT64(ph, DDI_PROP_CMD_GET_ESIZE, NULL);
2217 
2218 	if (size < DDI_PROP_RESULT_OK) {
2219 		switch (size) {
2220 		case DDI_PROP_RESULT_EOF:
2221 			return (DDI_PROP_END_OF_DATA);
2222 
2223 		case DDI_PROP_RESULT_ERROR:
2224 			return (DDI_PROP_CANNOT_ENCODE);
2225 		}
2226 	}
2227 
2228 	/*
2229 	 * Allocate space in the handle to store the encoded int.
2230 	 */
2231 	if (ddi_prop_encode_alloc(ph, size * nelements) !=
2232 	    DDI_PROP_SUCCESS)
2233 		return (DDI_PROP_NO_MEMORY);
2234 
2235 	/*
2236 	 * Encode the array of ints.
2237 	 */
2238 	tmp = (int64_t *)data;
2239 	for (cnt = 0; cnt < nelements; cnt++, tmp++) {
2240 		i = DDI_PROP_INT64(ph, DDI_PROP_CMD_ENCODE, tmp);
2241 		if (i < DDI_PROP_RESULT_OK) {
2242 			switch (i) {
2243 			case DDI_PROP_RESULT_EOF:
2244 				return (DDI_PROP_END_OF_DATA);
2245 
2246 			case DDI_PROP_RESULT_ERROR:
2247 				return (DDI_PROP_CANNOT_ENCODE);
2248 			}
2249 		}
2250 	}
2251 
2252 	return (DDI_PROP_SUCCESS);
2253 }
2254 
2255 /*
2256  * Decode a single string property
2257  */
2258 static int
2259 ddi_prop_fm_decode_string(prop_handle_t *ph, void *data, uint_t *nelements)
2260 {
2261 	char		*tmp;
2262 	char		*str;
2263 	int		i;
2264 	int		size;
2265 
2266 	/*
2267 	 * If there is nothing to decode return an error
2268 	 */
2269 	if (ph->ph_size == 0)
2270 		return (DDI_PROP_END_OF_DATA);
2271 
2272 	/*
2273 	 * Get the decoded size of the encoded string.
2274 	 */
2275 	size = DDI_PROP_STR(ph, DDI_PROP_CMD_GET_DSIZE, NULL);
2276 	if (size < DDI_PROP_RESULT_OK) {
2277 		switch (size) {
2278 		case DDI_PROP_RESULT_EOF:
2279 			return (DDI_PROP_END_OF_DATA);
2280 
2281 		case DDI_PROP_RESULT_ERROR:
2282 			return (DDI_PROP_CANNOT_DECODE);
2283 		}
2284 	}
2285 
2286 	/*
2287 	 * Allocated memory to store the decoded value in.
2288 	 */
2289 	str = ddi_prop_decode_alloc((size_t)size, ddi_prop_free_string);
2290 
2291 	ddi_prop_reset_pos(ph);
2292 
2293 	/*
2294 	 * Decode the str and place it in the space we just allocated
2295 	 */
2296 	tmp = str;
2297 	i = DDI_PROP_STR(ph, DDI_PROP_CMD_DECODE, tmp);
2298 	if (i < DDI_PROP_RESULT_OK) {
2299 		/*
2300 		 * Free the space we just allocated
2301 		 * and return an error.
2302 		 */
2303 		ddi_prop_free(str);
2304 		switch (i) {
2305 		case DDI_PROP_RESULT_EOF:
2306 			return (DDI_PROP_END_OF_DATA);
2307 
2308 		case DDI_PROP_RESULT_ERROR:
2309 			return (DDI_PROP_CANNOT_DECODE);
2310 		}
2311 	}
2312 
2313 	*(char **)data = str;
2314 	*nelements = 1;
2315 
2316 	return (DDI_PROP_SUCCESS);
2317 }
2318 
2319 /*
2320  * Decode an array of strings.
2321  */
2322 int
2323 ddi_prop_fm_decode_strings(prop_handle_t *ph, void *data, uint_t *nelements)
2324 {
2325 	int		cnt = 0;
2326 	char		**strs;
2327 	char		**tmp;
2328 	char		*ptr;
2329 	int		i;
2330 	int		n;
2331 	int		size;
2332 	size_t		nbytes;
2333 
2334 	/*
2335 	 * Figure out how many array elements there are by going through the
2336 	 * data without decoding it first and counting.
2337 	 */
2338 	for (;;) {
2339 		i = DDI_PROP_STR(ph, DDI_PROP_CMD_SKIP, NULL);
2340 		if (i < 0)
2341 			break;
2342 		cnt++;
2343 	}
2344 
2345 	/*
2346 	 * If there are no elements return an error
2347 	 */
2348 	if (cnt == 0)
2349 		return (DDI_PROP_END_OF_DATA);
2350 
2351 	/*
2352 	 * If we cannot skip through the data, we cannot decode it
2353 	 */
2354 	if (i == DDI_PROP_RESULT_ERROR)
2355 		return (DDI_PROP_CANNOT_DECODE);
2356 
2357 	/*
2358 	 * Reset the data pointer to the beginning of the encoded data
2359 	 */
2360 	ddi_prop_reset_pos(ph);
2361 
2362 	/*
2363 	 * Figure out how much memory we need for the sum total
2364 	 */
2365 	nbytes = (cnt + 1) * sizeof (char *);
2366 
2367 	for (n = 0; n < cnt; n++) {
2368 		/*
2369 		 * Get the decoded size of the current encoded string.
2370 		 */
2371 		size = DDI_PROP_STR(ph, DDI_PROP_CMD_GET_DSIZE, NULL);
2372 		if (size < DDI_PROP_RESULT_OK) {
2373 			switch (size) {
2374 			case DDI_PROP_RESULT_EOF:
2375 				return (DDI_PROP_END_OF_DATA);
2376 
2377 			case DDI_PROP_RESULT_ERROR:
2378 				return (DDI_PROP_CANNOT_DECODE);
2379 			}
2380 		}
2381 
2382 		nbytes += size;
2383 	}
2384 
2385 	/*
2386 	 * Allocate memory in which to store the decoded strings.
2387 	 */
2388 	strs = ddi_prop_decode_alloc(nbytes, ddi_prop_free_strings);
2389 
2390 	/*
2391 	 * Set up pointers for each string by figuring out yet
2392 	 * again how long each string is.
2393 	 */
2394 	ddi_prop_reset_pos(ph);
2395 	ptr = (caddr_t)strs + ((cnt + 1) * sizeof (char *));
2396 	for (tmp = strs, n = 0; n < cnt; n++, tmp++) {
2397 		/*
2398 		 * Get the decoded size of the current encoded string.
2399 		 */
2400 		size = DDI_PROP_STR(ph, DDI_PROP_CMD_GET_DSIZE, NULL);
2401 		if (size < DDI_PROP_RESULT_OK) {
2402 			ddi_prop_free(strs);
2403 			switch (size) {
2404 			case DDI_PROP_RESULT_EOF:
2405 				return (DDI_PROP_END_OF_DATA);
2406 
2407 			case DDI_PROP_RESULT_ERROR:
2408 				return (DDI_PROP_CANNOT_DECODE);
2409 			}
2410 		}
2411 
2412 		*tmp = ptr;
2413 		ptr += size;
2414 	}
2415 
2416 	/*
2417 	 * String array is terminated by a NULL
2418 	 */
2419 	*tmp = NULL;
2420 
2421 	/*
2422 	 * Finally, we can decode each string
2423 	 */
2424 	ddi_prop_reset_pos(ph);
2425 	for (tmp = strs, n = 0; n < cnt; n++, tmp++) {
2426 		i = DDI_PROP_STR(ph, DDI_PROP_CMD_DECODE, *tmp);
2427 		if (i < DDI_PROP_RESULT_OK) {
2428 			/*
2429 			 * Free the space we just allocated
2430 			 * and return an error
2431 			 */
2432 			ddi_prop_free(strs);
2433 			switch (i) {
2434 			case DDI_PROP_RESULT_EOF:
2435 				return (DDI_PROP_END_OF_DATA);
2436 
2437 			case DDI_PROP_RESULT_ERROR:
2438 				return (DDI_PROP_CANNOT_DECODE);
2439 			}
2440 		}
2441 	}
2442 
2443 	*(char ***)data = strs;
2444 	*nelements = cnt;
2445 
2446 	return (DDI_PROP_SUCCESS);
2447 }
2448 
2449 /*
2450  * Encode a string.
2451  */
2452 int
2453 ddi_prop_fm_encode_string(prop_handle_t *ph, void *data, uint_t nelements)
2454 {
2455 	char		**tmp;
2456 	int		size;
2457 	int		i;
2458 
2459 	/*
2460 	 * If there is no data, we cannot do anything
2461 	 */
2462 	if (nelements == 0)
2463 		return (DDI_PROP_CANNOT_ENCODE);
2464 
2465 	/*
2466 	 * Get the size of the encoded string.
2467 	 */
2468 	tmp = (char **)data;
2469 	size = DDI_PROP_STR(ph, DDI_PROP_CMD_GET_ESIZE, *tmp);
2470 	if (size < DDI_PROP_RESULT_OK) {
2471 		switch (size) {
2472 		case DDI_PROP_RESULT_EOF:
2473 			return (DDI_PROP_END_OF_DATA);
2474 
2475 		case DDI_PROP_RESULT_ERROR:
2476 			return (DDI_PROP_CANNOT_ENCODE);
2477 		}
2478 	}
2479 
2480 	/*
2481 	 * Allocate space in the handle to store the encoded string.
2482 	 */
2483 	if (ddi_prop_encode_alloc(ph, size) != DDI_PROP_SUCCESS)
2484 		return (DDI_PROP_NO_MEMORY);
2485 
2486 	ddi_prop_reset_pos(ph);
2487 
2488 	/*
2489 	 * Encode the string.
2490 	 */
2491 	tmp = (char **)data;
2492 	i = DDI_PROP_STR(ph, DDI_PROP_CMD_ENCODE, *tmp);
2493 	if (i < DDI_PROP_RESULT_OK) {
2494 		switch (i) {
2495 		case DDI_PROP_RESULT_EOF:
2496 			return (DDI_PROP_END_OF_DATA);
2497 
2498 		case DDI_PROP_RESULT_ERROR:
2499 			return (DDI_PROP_CANNOT_ENCODE);
2500 		}
2501 	}
2502 
2503 	return (DDI_PROP_SUCCESS);
2504 }
2505 
2506 
2507 /*
2508  * Encode an array of strings.
2509  */
2510 int
2511 ddi_prop_fm_encode_strings(prop_handle_t *ph, void *data, uint_t nelements)
2512 {
2513 	int		cnt = 0;
2514 	char		**tmp;
2515 	int		size;
2516 	uint_t		total_size;
2517 	int		i;
2518 
2519 	/*
2520 	 * If there is no data, we cannot do anything
2521 	 */
2522 	if (nelements == 0)
2523 		return (DDI_PROP_CANNOT_ENCODE);
2524 
2525 	/*
2526 	 * Get the total size required to encode all the strings.
2527 	 */
2528 	total_size = 0;
2529 	tmp = (char **)data;
2530 	for (cnt = 0; cnt < nelements; cnt++, tmp++) {
2531 		size = DDI_PROP_STR(ph, DDI_PROP_CMD_GET_ESIZE, *tmp);
2532 		if (size < DDI_PROP_RESULT_OK) {
2533 			switch (size) {
2534 			case DDI_PROP_RESULT_EOF:
2535 				return (DDI_PROP_END_OF_DATA);
2536 
2537 			case DDI_PROP_RESULT_ERROR:
2538 				return (DDI_PROP_CANNOT_ENCODE);
2539 			}
2540 		}
2541 		total_size += (uint_t)size;
2542 	}
2543 
2544 	/*
2545 	 * Allocate space in the handle to store the encoded strings.
2546 	 */
2547 	if (ddi_prop_encode_alloc(ph, total_size) != DDI_PROP_SUCCESS)
2548 		return (DDI_PROP_NO_MEMORY);
2549 
2550 	ddi_prop_reset_pos(ph);
2551 
2552 	/*
2553 	 * Encode the array of strings.
2554 	 */
2555 	tmp = (char **)data;
2556 	for (cnt = 0; cnt < nelements; cnt++, tmp++) {
2557 		i = DDI_PROP_STR(ph, DDI_PROP_CMD_ENCODE, *tmp);
2558 		if (i < DDI_PROP_RESULT_OK) {
2559 			switch (i) {
2560 			case DDI_PROP_RESULT_EOF:
2561 				return (DDI_PROP_END_OF_DATA);
2562 
2563 			case DDI_PROP_RESULT_ERROR:
2564 				return (DDI_PROP_CANNOT_ENCODE);
2565 			}
2566 		}
2567 	}
2568 
2569 	return (DDI_PROP_SUCCESS);
2570 }
2571 
2572 
2573 /*
2574  * Decode an array of bytes.
2575  */
2576 static int
2577 ddi_prop_fm_decode_bytes(prop_handle_t *ph, void *data, uint_t *nelements)
2578 {
2579 	uchar_t		*tmp;
2580 	int		nbytes;
2581 	int		i;
2582 
2583 	/*
2584 	 * If there are no elements return an error
2585 	 */
2586 	if (ph->ph_size == 0)
2587 		return (DDI_PROP_END_OF_DATA);
2588 
2589 	/*
2590 	 * Get the size of the encoded array of bytes.
2591 	 */
2592 	nbytes = DDI_PROP_BYTES(ph, DDI_PROP_CMD_GET_DSIZE,
2593 	    data, ph->ph_size);
2594 	if (nbytes < DDI_PROP_RESULT_OK) {
2595 		switch (nbytes) {
2596 		case DDI_PROP_RESULT_EOF:
2597 			return (DDI_PROP_END_OF_DATA);
2598 
2599 		case DDI_PROP_RESULT_ERROR:
2600 			return (DDI_PROP_CANNOT_DECODE);
2601 		}
2602 	}
2603 
2604 	/*
2605 	 * Allocated memory to store the decoded value in.
2606 	 */
2607 	tmp = ddi_prop_decode_alloc(nbytes, ddi_prop_free_bytes);
2608 
2609 	/*
2610 	 * Decode each element and place it in the space we just allocated
2611 	 */
2612 	i = DDI_PROP_BYTES(ph, DDI_PROP_CMD_DECODE, tmp, nbytes);
2613 	if (i < DDI_PROP_RESULT_OK) {
2614 		/*
2615 		 * Free the space we just allocated
2616 		 * and return an error
2617 		 */
2618 		ddi_prop_free(tmp);
2619 		switch (i) {
2620 		case DDI_PROP_RESULT_EOF:
2621 			return (DDI_PROP_END_OF_DATA);
2622 
2623 		case DDI_PROP_RESULT_ERROR:
2624 			return (DDI_PROP_CANNOT_DECODE);
2625 		}
2626 	}
2627 
2628 	*(uchar_t **)data = tmp;
2629 	*nelements = nbytes;
2630 
2631 	return (DDI_PROP_SUCCESS);
2632 }
2633 
2634 /*
2635  * Encode an array of bytes.
2636  */
2637 int
2638 ddi_prop_fm_encode_bytes(prop_handle_t *ph, void *data, uint_t nelements)
2639 {
2640 	int		size;
2641 	int		i;
2642 
2643 	/*
2644 	 * If there are no elements, then this is a boolean property,
2645 	 * so just create a property handle with no data and return.
2646 	 */
2647 	if (nelements == 0) {
2648 		(void) ddi_prop_encode_alloc(ph, 0);
2649 		return (DDI_PROP_SUCCESS);
2650 	}
2651 
2652 	/*
2653 	 * Get the size of the encoded array of bytes.
2654 	 */
2655 	size = DDI_PROP_BYTES(ph, DDI_PROP_CMD_GET_ESIZE, (uchar_t *)data,
2656 	    nelements);
2657 	if (size < DDI_PROP_RESULT_OK) {
2658 		switch (size) {
2659 		case DDI_PROP_RESULT_EOF:
2660 			return (DDI_PROP_END_OF_DATA);
2661 
2662 		case DDI_PROP_RESULT_ERROR:
2663 			return (DDI_PROP_CANNOT_DECODE);
2664 		}
2665 	}
2666 
2667 	/*
2668 	 * Allocate space in the handle to store the encoded bytes.
2669 	 */
2670 	if (ddi_prop_encode_alloc(ph, (uint_t)size) != DDI_PROP_SUCCESS)
2671 		return (DDI_PROP_NO_MEMORY);
2672 
2673 	/*
2674 	 * Encode the array of bytes.
2675 	 */
2676 	i = DDI_PROP_BYTES(ph, DDI_PROP_CMD_ENCODE, (uchar_t *)data,
2677 	    nelements);
2678 	if (i < DDI_PROP_RESULT_OK) {
2679 		switch (i) {
2680 		case DDI_PROP_RESULT_EOF:
2681 			return (DDI_PROP_END_OF_DATA);
2682 
2683 		case DDI_PROP_RESULT_ERROR:
2684 			return (DDI_PROP_CANNOT_ENCODE);
2685 		}
2686 	}
2687 
2688 	return (DDI_PROP_SUCCESS);
2689 }
2690 
2691 /*
2692  * OBP 1275 integer, string and byte operators.
2693  *
2694  * DDI_PROP_CMD_DECODE:
2695  *
2696  *	DDI_PROP_RESULT_ERROR:		cannot decode the data
2697  *	DDI_PROP_RESULT_EOF:		end of data
2698  *	DDI_PROP_OK:			data was decoded
2699  *
2700  * DDI_PROP_CMD_ENCODE:
2701  *
2702  *	DDI_PROP_RESULT_ERROR:		cannot encode the data
2703  *	DDI_PROP_RESULT_EOF:		end of data
2704  *	DDI_PROP_OK:			data was encoded
2705  *
2706  * DDI_PROP_CMD_SKIP:
2707  *
2708  *	DDI_PROP_RESULT_ERROR:		cannot skip the data
2709  *	DDI_PROP_RESULT_EOF:		end of data
2710  *	DDI_PROP_OK:			data was skipped
2711  *
2712  * DDI_PROP_CMD_GET_ESIZE:
2713  *
2714  *	DDI_PROP_RESULT_ERROR:		cannot get encoded size
2715  *	DDI_PROP_RESULT_EOF:		end of data
2716  *	> 0:				the encoded size
2717  *
2718  * DDI_PROP_CMD_GET_DSIZE:
2719  *
2720  *	DDI_PROP_RESULT_ERROR:		cannot get decoded size
2721  *	DDI_PROP_RESULT_EOF:		end of data
2722  *	> 0:				the decoded size
2723  */
2724 
2725 /*
2726  * OBP 1275 integer operator
2727  *
2728  * OBP properties are a byte stream of data, so integers may not be
2729  * properly aligned.  Therefore we need to copy them one byte at a time.
2730  */
2731 int
2732 ddi_prop_1275_int(prop_handle_t *ph, uint_t cmd, int *data)
2733 {
2734 	int	i;
2735 
2736 	switch (cmd) {
2737 	case DDI_PROP_CMD_DECODE:
2738 		/*
2739 		 * Check that there is encoded data
2740 		 */
2741 		if (ph->ph_cur_pos == NULL || ph->ph_size == 0)
2742 			return (DDI_PROP_RESULT_ERROR);
2743 		if (ph->ph_flags & PH_FROM_PROM) {
2744 			i = MIN(ph->ph_size, PROP_1275_INT_SIZE);
2745 			if ((int *)ph->ph_cur_pos > ((int *)ph->ph_data +
2746 			    ph->ph_size - i))
2747 				return (DDI_PROP_RESULT_ERROR);
2748 		} else {
2749 			if (ph->ph_size < sizeof (int) ||
2750 			    ((int *)ph->ph_cur_pos > ((int *)ph->ph_data +
2751 			    ph->ph_size - sizeof (int))))
2752 				return (DDI_PROP_RESULT_ERROR);
2753 		}
2754 
2755 		/*
2756 		 * Copy the integer, using the implementation-specific
2757 		 * copy function if the property is coming from the PROM.
2758 		 */
2759 		if (ph->ph_flags & PH_FROM_PROM) {
2760 			*data = impl_ddi_prop_int_from_prom(
2761 			    (uchar_t *)ph->ph_cur_pos,
2762 			    (ph->ph_size < PROP_1275_INT_SIZE) ?
2763 			    ph->ph_size : PROP_1275_INT_SIZE);
2764 		} else {
2765 			bcopy(ph->ph_cur_pos, data, sizeof (int));
2766 		}
2767 
2768 		/*
2769 		 * Move the current location to the start of the next
2770 		 * bit of undecoded data.
2771 		 */
2772 		ph->ph_cur_pos = (uchar_t *)ph->ph_cur_pos +
2773 		    PROP_1275_INT_SIZE;
2774 		return (DDI_PROP_RESULT_OK);
2775 
2776 	case DDI_PROP_CMD_ENCODE:
2777 		/*
2778 		 * Check that there is room to encoded the data
2779 		 */
2780 		if (ph->ph_cur_pos == NULL || ph->ph_size == 0 ||
2781 		    ph->ph_size < PROP_1275_INT_SIZE ||
2782 		    ((int *)ph->ph_cur_pos > ((int *)ph->ph_data +
2783 		    ph->ph_size - sizeof (int))))
2784 			return (DDI_PROP_RESULT_ERROR);
2785 
2786 		/*
2787 		 * Encode the integer into the byte stream one byte at a
2788 		 * time.
2789 		 */
2790 		bcopy(data, ph->ph_cur_pos, sizeof (int));
2791 
2792 		/*
2793 		 * Move the current location to the start of the next bit of
2794 		 * space where we can store encoded data.
2795 		 */
2796 		ph->ph_cur_pos = (uchar_t *)ph->ph_cur_pos + PROP_1275_INT_SIZE;
2797 		return (DDI_PROP_RESULT_OK);
2798 
2799 	case DDI_PROP_CMD_SKIP:
2800 		/*
2801 		 * Check that there is encoded data
2802 		 */
2803 		if (ph->ph_cur_pos == NULL || ph->ph_size == 0 ||
2804 		    ph->ph_size < PROP_1275_INT_SIZE)
2805 			return (DDI_PROP_RESULT_ERROR);
2806 
2807 
2808 		if ((caddr_t)ph->ph_cur_pos ==
2809 		    (caddr_t)ph->ph_data + ph->ph_size) {
2810 			return (DDI_PROP_RESULT_EOF);
2811 		} else if ((caddr_t)ph->ph_cur_pos >
2812 		    (caddr_t)ph->ph_data + ph->ph_size) {
2813 			return (DDI_PROP_RESULT_EOF);
2814 		}
2815 
2816 		/*
2817 		 * Move the current location to the start of the next bit of
2818 		 * undecoded data.
2819 		 */
2820 		ph->ph_cur_pos = (uchar_t *)ph->ph_cur_pos + PROP_1275_INT_SIZE;
2821 		return (DDI_PROP_RESULT_OK);
2822 
2823 	case DDI_PROP_CMD_GET_ESIZE:
2824 		/*
2825 		 * Return the size of an encoded integer on OBP
2826 		 */
2827 		return (PROP_1275_INT_SIZE);
2828 
2829 	case DDI_PROP_CMD_GET_DSIZE:
2830 		/*
2831 		 * Return the size of a decoded integer on the system.
2832 		 */
2833 		return (sizeof (int));
2834 
2835 	default:
2836 #ifdef DEBUG
2837 		panic("ddi_prop_1275_int: %x impossible", cmd);
2838 		/*NOTREACHED*/
2839 #else
2840 		return (DDI_PROP_RESULT_ERROR);
2841 #endif	/* DEBUG */
2842 	}
2843 }
2844 
2845 /*
2846  * 64 bit integer operator.
2847  *
2848  * This is an extension, defined by Sun, to the 1275 integer
2849  * operator.  This routine handles the encoding/decoding of
2850  * 64 bit integer properties.
2851  */
2852 int
2853 ddi_prop_int64_op(prop_handle_t *ph, uint_t cmd, int64_t *data)
2854 {
2855 
2856 	switch (cmd) {
2857 	case DDI_PROP_CMD_DECODE:
2858 		/*
2859 		 * Check that there is encoded data
2860 		 */
2861 		if (ph->ph_cur_pos == NULL || ph->ph_size == 0)
2862 			return (DDI_PROP_RESULT_ERROR);
2863 		if (ph->ph_flags & PH_FROM_PROM) {
2864 			return (DDI_PROP_RESULT_ERROR);
2865 		} else {
2866 			if (ph->ph_size < sizeof (int64_t) ||
2867 			    ((int64_t *)ph->ph_cur_pos >
2868 			    ((int64_t *)ph->ph_data +
2869 			    ph->ph_size - sizeof (int64_t))))
2870 				return (DDI_PROP_RESULT_ERROR);
2871 		}
2872 		/*
2873 		 * Copy the integer, using the implementation-specific
2874 		 * copy function if the property is coming from the PROM.
2875 		 */
2876 		if (ph->ph_flags & PH_FROM_PROM) {
2877 			return (DDI_PROP_RESULT_ERROR);
2878 		} else {
2879 			bcopy(ph->ph_cur_pos, data, sizeof (int64_t));
2880 		}
2881 
2882 		/*
2883 		 * Move the current location to the start of the next
2884 		 * bit of undecoded data.
2885 		 */
2886 		ph->ph_cur_pos = (uchar_t *)ph->ph_cur_pos +
2887 		    sizeof (int64_t);
2888 			return (DDI_PROP_RESULT_OK);
2889 
2890 	case DDI_PROP_CMD_ENCODE:
2891 		/*
2892 		 * Check that there is room to encoded the data
2893 		 */
2894 		if (ph->ph_cur_pos == NULL || ph->ph_size == 0 ||
2895 		    ph->ph_size < sizeof (int64_t) ||
2896 		    ((int64_t *)ph->ph_cur_pos > ((int64_t *)ph->ph_data +
2897 		    ph->ph_size - sizeof (int64_t))))
2898 			return (DDI_PROP_RESULT_ERROR);
2899 
2900 		/*
2901 		 * Encode the integer into the byte stream one byte at a
2902 		 * time.
2903 		 */
2904 		bcopy(data, ph->ph_cur_pos, sizeof (int64_t));
2905 
2906 		/*
2907 		 * Move the current location to the start of the next bit of
2908 		 * space where we can store encoded data.
2909 		 */
2910 		ph->ph_cur_pos = (uchar_t *)ph->ph_cur_pos +
2911 		    sizeof (int64_t);
2912 		return (DDI_PROP_RESULT_OK);
2913 
2914 	case DDI_PROP_CMD_SKIP:
2915 		/*
2916 		 * Check that there is encoded data
2917 		 */
2918 		if (ph->ph_cur_pos == NULL || ph->ph_size == 0 ||
2919 		    ph->ph_size < sizeof (int64_t))
2920 			return (DDI_PROP_RESULT_ERROR);
2921 
2922 		if ((caddr_t)ph->ph_cur_pos ==
2923 		    (caddr_t)ph->ph_data + ph->ph_size) {
2924 			return (DDI_PROP_RESULT_EOF);
2925 		} else if ((caddr_t)ph->ph_cur_pos >
2926 		    (caddr_t)ph->ph_data + ph->ph_size) {
2927 			return (DDI_PROP_RESULT_EOF);
2928 		}
2929 
2930 		/*
2931 		 * Move the current location to the start of
2932 		 * the next bit of undecoded data.
2933 		 */
2934 		ph->ph_cur_pos = (uchar_t *)ph->ph_cur_pos +
2935 		    sizeof (int64_t);
2936 			return (DDI_PROP_RESULT_OK);
2937 
2938 	case DDI_PROP_CMD_GET_ESIZE:
2939 		/*
2940 		 * Return the size of an encoded integer on OBP
2941 		 */
2942 		return (sizeof (int64_t));
2943 
2944 	case DDI_PROP_CMD_GET_DSIZE:
2945 		/*
2946 		 * Return the size of a decoded integer on the system.
2947 		 */
2948 		return (sizeof (int64_t));
2949 
2950 	default:
2951 #ifdef DEBUG
2952 		panic("ddi_prop_int64_op: %x impossible", cmd);
2953 		/*NOTREACHED*/
2954 #else
2955 		return (DDI_PROP_RESULT_ERROR);
2956 #endif  /* DEBUG */
2957 	}
2958 }
2959 
2960 /*
2961  * OBP 1275 string operator.
2962  *
2963  * OBP strings are NULL terminated.
2964  */
2965 int
2966 ddi_prop_1275_string(prop_handle_t *ph, uint_t cmd, char *data)
2967 {
2968 	int	n;
2969 	char	*p;
2970 	char	*end;
2971 
2972 	switch (cmd) {
2973 	case DDI_PROP_CMD_DECODE:
2974 		/*
2975 		 * Check that there is encoded data
2976 		 */
2977 		if (ph->ph_cur_pos == NULL || ph->ph_size == 0) {
2978 			return (DDI_PROP_RESULT_ERROR);
2979 		}
2980 
2981 		/*
2982 		 * Match DDI_PROP_CMD_GET_DSIZE logic for when to stop and
2983 		 * how to NULL terminate result.
2984 		 */
2985 		p = (char *)ph->ph_cur_pos;
2986 		end = (char *)ph->ph_data + ph->ph_size;
2987 		if (p >= end)
2988 			return (DDI_PROP_RESULT_EOF);
2989 
2990 		while (p < end) {
2991 			*data++ = *p;
2992 			if (*p++ == 0) {	/* NULL from OBP */
2993 				ph->ph_cur_pos = p;
2994 				return (DDI_PROP_RESULT_OK);
2995 			}
2996 		}
2997 
2998 		/*
2999 		 * If OBP did not NULL terminate string, which happens
3000 		 * (at least) for 'true'/'false' boolean values, account for
3001 		 * the space and store null termination on decode.
3002 		 */
3003 		ph->ph_cur_pos = p;
3004 		*data = 0;
3005 		return (DDI_PROP_RESULT_OK);
3006 
3007 	case DDI_PROP_CMD_ENCODE:
3008 		/*
3009 		 * Check that there is room to encoded the data
3010 		 */
3011 		if (ph->ph_cur_pos == NULL || ph->ph_size == 0) {
3012 			return (DDI_PROP_RESULT_ERROR);
3013 		}
3014 
3015 		n = strlen(data) + 1;
3016 		if ((char *)ph->ph_cur_pos > ((char *)ph->ph_data +
3017 		    ph->ph_size - n)) {
3018 			return (DDI_PROP_RESULT_ERROR);
3019 		}
3020 
3021 		/*
3022 		 * Copy the NULL terminated string
3023 		 */
3024 		bcopy(data, ph->ph_cur_pos, n);
3025 
3026 		/*
3027 		 * Move the current location to the start of the next bit of
3028 		 * space where we can store encoded data.
3029 		 */
3030 		ph->ph_cur_pos = (char *)ph->ph_cur_pos + n;
3031 		return (DDI_PROP_RESULT_OK);
3032 
3033 	case DDI_PROP_CMD_SKIP:
3034 		/*
3035 		 * Check that there is encoded data
3036 		 */
3037 		if (ph->ph_cur_pos == NULL || ph->ph_size == 0) {
3038 			return (DDI_PROP_RESULT_ERROR);
3039 		}
3040 
3041 		/*
3042 		 * Return the string length plus one for the NULL
3043 		 * We know the size of the property, we need to
3044 		 * ensure that the string is properly formatted,
3045 		 * since we may be looking up random OBP data.
3046 		 */
3047 		p = (char *)ph->ph_cur_pos;
3048 		end = (char *)ph->ph_data + ph->ph_size;
3049 		if (p >= end)
3050 			return (DDI_PROP_RESULT_EOF);
3051 
3052 		while (p < end) {
3053 			if (*p++ == 0) {	/* NULL from OBP */
3054 				ph->ph_cur_pos = p;
3055 				return (DDI_PROP_RESULT_OK);
3056 			}
3057 		}
3058 
3059 		/*
3060 		 * Accommodate the fact that OBP does not always NULL
3061 		 * terminate strings.
3062 		 */
3063 		ph->ph_cur_pos = p;
3064 		return (DDI_PROP_RESULT_OK);
3065 
3066 	case DDI_PROP_CMD_GET_ESIZE:
3067 		/*
3068 		 * Return the size of the encoded string on OBP.
3069 		 */
3070 		return (strlen(data) + 1);
3071 
3072 	case DDI_PROP_CMD_GET_DSIZE:
3073 		/*
3074 		 * Return the string length plus one for the NULL.
3075 		 * We know the size of the property, we need to
3076 		 * ensure that the string is properly formatted,
3077 		 * since we may be looking up random OBP data.
3078 		 */
3079 		p = (char *)ph->ph_cur_pos;
3080 		end = (char *)ph->ph_data + ph->ph_size;
3081 		if (p >= end)
3082 			return (DDI_PROP_RESULT_EOF);
3083 
3084 		for (n = 0; p < end; n++) {
3085 			if (*p++ == 0) {	/* NULL from OBP */
3086 				ph->ph_cur_pos = p;
3087 				return (n + 1);
3088 			}
3089 		}
3090 
3091 		/*
3092 		 * If OBP did not NULL terminate string, which happens for
3093 		 * 'true'/'false' boolean values, account for the space
3094 		 * to store null termination here.
3095 		 */
3096 		ph->ph_cur_pos = p;
3097 		return (n + 1);
3098 
3099 	default:
3100 #ifdef DEBUG
3101 		panic("ddi_prop_1275_string: %x impossible", cmd);
3102 		/*NOTREACHED*/
3103 #else
3104 		return (DDI_PROP_RESULT_ERROR);
3105 #endif	/* DEBUG */
3106 	}
3107 }
3108 
3109 /*
3110  * OBP 1275 byte operator
3111  *
3112  * Caller must specify the number of bytes to get.  OBP encodes bytes
3113  * as a byte so there is a 1-to-1 translation.
3114  */
3115 int
3116 ddi_prop_1275_bytes(prop_handle_t *ph, uint_t cmd, uchar_t *data,
3117 	uint_t nelements)
3118 {
3119 	switch (cmd) {
3120 	case DDI_PROP_CMD_DECODE:
3121 		/*
3122 		 * Check that there is encoded data
3123 		 */
3124 		if (ph->ph_cur_pos == NULL || ph->ph_size == 0 ||
3125 		    ph->ph_size < nelements ||
3126 		    ((char *)ph->ph_cur_pos > ((char *)ph->ph_data +
3127 		    ph->ph_size - nelements)))
3128 			return (DDI_PROP_RESULT_ERROR);
3129 
3130 		/*
3131 		 * Copy out the bytes
3132 		 */
3133 		bcopy(ph->ph_cur_pos, data, nelements);
3134 
3135 		/*
3136 		 * Move the current location
3137 		 */
3138 		ph->ph_cur_pos = (char *)ph->ph_cur_pos + nelements;
3139 		return (DDI_PROP_RESULT_OK);
3140 
3141 	case DDI_PROP_CMD_ENCODE:
3142 		/*
3143 		 * Check that there is room to encode the data
3144 		 */
3145 		if (ph->ph_cur_pos == NULL || ph->ph_size == 0 ||
3146 		    ph->ph_size < nelements ||
3147 		    ((char *)ph->ph_cur_pos > ((char *)ph->ph_data +
3148 		    ph->ph_size - nelements)))
3149 			return (DDI_PROP_RESULT_ERROR);
3150 
3151 		/*
3152 		 * Copy in the bytes
3153 		 */
3154 		bcopy(data, ph->ph_cur_pos, nelements);
3155 
3156 		/*
3157 		 * Move the current location to the start of the next bit of
3158 		 * space where we can store encoded data.
3159 		 */
3160 		ph->ph_cur_pos = (char *)ph->ph_cur_pos + nelements;
3161 		return (DDI_PROP_RESULT_OK);
3162 
3163 	case DDI_PROP_CMD_SKIP:
3164 		/*
3165 		 * Check that there is encoded data
3166 		 */
3167 		if (ph->ph_cur_pos == NULL || ph->ph_size == 0 ||
3168 		    ph->ph_size < nelements)
3169 			return (DDI_PROP_RESULT_ERROR);
3170 
3171 		if ((char *)ph->ph_cur_pos > ((char *)ph->ph_data +
3172 		    ph->ph_size - nelements))
3173 			return (DDI_PROP_RESULT_EOF);
3174 
3175 		/*
3176 		 * Move the current location
3177 		 */
3178 		ph->ph_cur_pos = (char *)ph->ph_cur_pos + nelements;
3179 		return (DDI_PROP_RESULT_OK);
3180 
3181 	case DDI_PROP_CMD_GET_ESIZE:
3182 		/*
3183 		 * The size in bytes of the encoded size is the
3184 		 * same as the decoded size provided by the caller.
3185 		 */
3186 		return (nelements);
3187 
3188 	case DDI_PROP_CMD_GET_DSIZE:
3189 		/*
3190 		 * Just return the number of bytes specified by the caller.
3191 		 */
3192 		return (nelements);
3193 
3194 	default:
3195 #ifdef DEBUG
3196 		panic("ddi_prop_1275_bytes: %x impossible", cmd);
3197 		/*NOTREACHED*/
3198 #else
3199 		return (DDI_PROP_RESULT_ERROR);
3200 #endif	/* DEBUG */
3201 	}
3202 }
3203 
3204 /*
3205  * Used for properties that come from the OBP, hardware configuration files,
3206  * or that are created by calls to ddi_prop_update(9F).
3207  */
3208 static struct prop_handle_ops prop_1275_ops = {
3209 	ddi_prop_1275_int,
3210 	ddi_prop_1275_string,
3211 	ddi_prop_1275_bytes,
3212 	ddi_prop_int64_op
3213 };
3214 
3215 
3216 /*
3217  * Interface to create/modify a managed property on child's behalf...
3218  * Flags interpreted are:
3219  *	DDI_PROP_CANSLEEP:	Allow memory allocation to sleep.
3220  *	DDI_PROP_SYSTEM_DEF:	Manipulate system list rather than driver list.
3221  *
3222  * Use same dev_t when modifying or undefining a property.
3223  * Search for properties with DDI_DEV_T_ANY to match first named
3224  * property on the list.
3225  *
3226  * Properties are stored LIFO and subsequently will match the first
3227  * `matching' instance.
3228  */
3229 
3230 /*
3231  * ddi_prop_add:	Add a software defined property
3232  */
3233 
3234 /*
3235  * define to get a new ddi_prop_t.
3236  * km_flags are KM_SLEEP or KM_NOSLEEP.
3237  */
3238 
3239 #define	DDI_NEW_PROP_T(km_flags)	\
3240 	(kmem_zalloc(sizeof (ddi_prop_t), km_flags))
3241 
3242 static int
3243 ddi_prop_add(dev_t dev, dev_info_t *dip, int flags,
3244     char *name, caddr_t value, int length)
3245 {
3246 	ddi_prop_t	*new_propp, *propp;
3247 	ddi_prop_t	**list_head = &(DEVI(dip)->devi_drv_prop_ptr);
3248 	int		km_flags = KM_NOSLEEP;
3249 	int		name_buf_len;
3250 
3251 	/*
3252 	 * If dev_t is DDI_DEV_T_ANY or name's length is zero return error.
3253 	 */
3254 
3255 	if (dev == DDI_DEV_T_ANY || name == (char *)0 || strlen(name) == 0)
3256 		return (DDI_PROP_INVAL_ARG);
3257 
3258 	if (flags & DDI_PROP_CANSLEEP)
3259 		km_flags = KM_SLEEP;
3260 
3261 	if (flags & DDI_PROP_SYSTEM_DEF)
3262 		list_head = &(DEVI(dip)->devi_sys_prop_ptr);
3263 	else if (flags & DDI_PROP_HW_DEF)
3264 		list_head = &(DEVI(dip)->devi_hw_prop_ptr);
3265 
3266 	if ((new_propp = DDI_NEW_PROP_T(km_flags)) == NULL)  {
3267 		cmn_err(CE_CONT, prop_no_mem_msg, name);
3268 		return (DDI_PROP_NO_MEMORY);
3269 	}
3270 
3271 	/*
3272 	 * If dev is major number 0, then we need to do a ddi_name_to_major
3273 	 * to get the real major number for the device.  This needs to be
3274 	 * done because some drivers need to call ddi_prop_create in their
3275 	 * attach routines but they don't have a dev.  By creating the dev
3276 	 * ourself if the major number is 0, drivers will not have to know what
3277 	 * their major number.	They can just create a dev with major number
3278 	 * 0 and pass it in.  For device 0, we will be doing a little extra
3279 	 * work by recreating the same dev that we already have, but its the
3280 	 * price you pay :-).
3281 	 *
3282 	 * This fixes bug #1098060.
3283 	 */
3284 	if (getmajor(dev) == DDI_MAJOR_T_UNKNOWN) {
3285 		new_propp->prop_dev =
3286 		    makedevice(ddi_name_to_major(DEVI(dip)->devi_binding_name),
3287 		    getminor(dev));
3288 	} else
3289 		new_propp->prop_dev = dev;
3290 
3291 	/*
3292 	 * Allocate space for property name and copy it in...
3293 	 */
3294 
3295 	name_buf_len = strlen(name) + 1;
3296 	new_propp->prop_name = kmem_alloc(name_buf_len, km_flags);
3297 	if (new_propp->prop_name == 0)	{
3298 		kmem_free(new_propp, sizeof (ddi_prop_t));
3299 		cmn_err(CE_CONT, prop_no_mem_msg, name);
3300 		return (DDI_PROP_NO_MEMORY);
3301 	}
3302 	bcopy(name, new_propp->prop_name, name_buf_len);
3303 
3304 	/*
3305 	 * Set the property type
3306 	 */
3307 	new_propp->prop_flags = flags & DDI_PROP_TYPE_MASK;
3308 
3309 	/*
3310 	 * Set length and value ONLY if not an explicit property undefine:
3311 	 * NOTE: value and length are zero for explicit undefines.
3312 	 */
3313 
3314 	if (flags & DDI_PROP_UNDEF_IT) {
3315 		new_propp->prop_flags |= DDI_PROP_UNDEF_IT;
3316 	} else {
3317 		if ((new_propp->prop_len = length) != 0) {
3318 			new_propp->prop_val = kmem_alloc(length, km_flags);
3319 			if (new_propp->prop_val == 0)  {
3320 				kmem_free(new_propp->prop_name, name_buf_len);
3321 				kmem_free(new_propp, sizeof (ddi_prop_t));
3322 				cmn_err(CE_CONT, prop_no_mem_msg, name);
3323 				return (DDI_PROP_NO_MEMORY);
3324 			}
3325 			bcopy(value, new_propp->prop_val, length);
3326 		}
3327 	}
3328 
3329 	/*
3330 	 * Link property into beginning of list. (Properties are LIFO order.)
3331 	 */
3332 
3333 	mutex_enter(&(DEVI(dip)->devi_lock));
3334 	propp = *list_head;
3335 	new_propp->prop_next = propp;
3336 	*list_head = new_propp;
3337 	mutex_exit(&(DEVI(dip)->devi_lock));
3338 	return (DDI_PROP_SUCCESS);
3339 }
3340 
3341 
3342 /*
3343  * ddi_prop_change:	Modify a software managed property value
3344  *
3345  *			Set new length and value if found.
3346  *			returns DDI_PROP_INVAL_ARG if dev is DDI_DEV_T_ANY or
3347  *			input name is the NULL string.
3348  *			returns DDI_PROP_NO_MEMORY if unable to allocate memory
3349  *
3350  *			Note: an undef can be modified to be a define,
3351  *			(you can't go the other way.)
3352  */
3353 
3354 static int
3355 ddi_prop_change(dev_t dev, dev_info_t *dip, int flags,
3356     char *name, caddr_t value, int length)
3357 {
3358 	ddi_prop_t	*propp;
3359 	ddi_prop_t	**ppropp;
3360 	caddr_t		p = NULL;
3361 
3362 	if ((dev == DDI_DEV_T_ANY) || (name == NULL) || (strlen(name) == 0))
3363 		return (DDI_PROP_INVAL_ARG);
3364 
3365 	/*
3366 	 * Preallocate buffer, even if we don't need it...
3367 	 */
3368 	if (length != 0)  {
3369 		p = kmem_alloc(length, (flags & DDI_PROP_CANSLEEP) ?
3370 		    KM_SLEEP : KM_NOSLEEP);
3371 		if (p == NULL)	{
3372 			cmn_err(CE_CONT, prop_no_mem_msg, name);
3373 			return (DDI_PROP_NO_MEMORY);
3374 		}
3375 	}
3376 
3377 	/*
3378 	 * If the dev_t value contains DDI_MAJOR_T_UNKNOWN for the major
3379 	 * number, a real dev_t value should be created based upon the dip's
3380 	 * binding driver.  See ddi_prop_add...
3381 	 */
3382 	if (getmajor(dev) == DDI_MAJOR_T_UNKNOWN)
3383 		dev = makedevice(
3384 		    ddi_name_to_major(DEVI(dip)->devi_binding_name),
3385 		    getminor(dev));
3386 
3387 	/*
3388 	 * Check to see if the property exists.  If so we modify it.
3389 	 * Else we create it by calling ddi_prop_add().
3390 	 */
3391 	mutex_enter(&(DEVI(dip)->devi_lock));
3392 	ppropp = &DEVI(dip)->devi_drv_prop_ptr;
3393 	if (flags & DDI_PROP_SYSTEM_DEF)
3394 		ppropp = &DEVI(dip)->devi_sys_prop_ptr;
3395 	else if (flags & DDI_PROP_HW_DEF)
3396 		ppropp = &DEVI(dip)->devi_hw_prop_ptr;
3397 
3398 	if ((propp = i_ddi_prop_search(dev, name, flags, ppropp)) != NULL) {
3399 		/*
3400 		 * Need to reallocate buffer?  If so, do it
3401 		 * carefully (reuse same space if new prop
3402 		 * is same size and non-NULL sized).
3403 		 */
3404 		if (length != 0)
3405 			bcopy(value, p, length);
3406 
3407 		if (propp->prop_len != 0)
3408 			kmem_free(propp->prop_val, propp->prop_len);
3409 
3410 		propp->prop_len = length;
3411 		propp->prop_val = p;
3412 		propp->prop_flags &= ~DDI_PROP_UNDEF_IT;
3413 		mutex_exit(&(DEVI(dip)->devi_lock));
3414 		return (DDI_PROP_SUCCESS);
3415 	}
3416 
3417 	mutex_exit(&(DEVI(dip)->devi_lock));
3418 	if (length != 0)
3419 		kmem_free(p, length);
3420 
3421 	return (ddi_prop_add(dev, dip, flags, name, value, length));
3422 }
3423 
3424 /*
3425  * Common update routine used to update and encode a property.	Creates
3426  * a property handle, calls the property encode routine, figures out if
3427  * the property already exists and updates if it does.	Otherwise it
3428  * creates if it does not exist.
3429  */
3430 int
3431 ddi_prop_update_common(dev_t match_dev, dev_info_t *dip, int flags,
3432     char *name, void *data, uint_t nelements,
3433     int (*prop_create)(prop_handle_t *, void *data, uint_t nelements))
3434 {
3435 	prop_handle_t	ph;
3436 	int		rval;
3437 	uint_t		ourflags;
3438 
3439 	/*
3440 	 * If dev_t is DDI_DEV_T_ANY or name's length is zero,
3441 	 * return error.
3442 	 */
3443 	if (match_dev == DDI_DEV_T_ANY || name == NULL || strlen(name) == 0)
3444 		return (DDI_PROP_INVAL_ARG);
3445 
3446 	/*
3447 	 * Create the handle
3448 	 */
3449 	ph.ph_data = NULL;
3450 	ph.ph_cur_pos = NULL;
3451 	ph.ph_save_pos = NULL;
3452 	ph.ph_size = 0;
3453 	ph.ph_ops = &prop_1275_ops;
3454 
3455 	/*
3456 	 * ourflags:
3457 	 * For compatibility with the old interfaces.  The old interfaces
3458 	 * didn't sleep by default and slept when the flag was set.  These
3459 	 * interfaces to the opposite.	So the old interfaces now set the
3460 	 * DDI_PROP_DONTSLEEP flag by default which tells us not to sleep.
3461 	 *
3462 	 * ph.ph_flags:
3463 	 * Blocked data or unblocked data allocation
3464 	 * for ph.ph_data in ddi_prop_encode_alloc()
3465 	 */
3466 	if (flags & DDI_PROP_DONTSLEEP) {
3467 		ourflags = flags;
3468 		ph.ph_flags = DDI_PROP_DONTSLEEP;
3469 	} else {
3470 		ourflags = flags | DDI_PROP_CANSLEEP;
3471 		ph.ph_flags = DDI_PROP_CANSLEEP;
3472 	}
3473 
3474 	/*
3475 	 * Encode the data and store it in the property handle by
3476 	 * calling the prop_encode routine.
3477 	 */
3478 	if ((rval = (*prop_create)(&ph, data, nelements)) !=
3479 	    DDI_PROP_SUCCESS) {
3480 		if (rval == DDI_PROP_NO_MEMORY)
3481 			cmn_err(CE_CONT, prop_no_mem_msg, name);
3482 		if (ph.ph_size != 0)
3483 			kmem_free(ph.ph_data, ph.ph_size);
3484 		return (rval);
3485 	}
3486 
3487 	/*
3488 	 * The old interfaces use a stacking approach to creating
3489 	 * properties.	If we are being called from the old interfaces,
3490 	 * the DDI_PROP_STACK_CREATE flag will be set, so we just do a
3491 	 * create without checking.
3492 	 */
3493 	if (flags & DDI_PROP_STACK_CREATE) {
3494 		rval = ddi_prop_add(match_dev, dip,
3495 		    ourflags, name, ph.ph_data, ph.ph_size);
3496 	} else {
3497 		rval = ddi_prop_change(match_dev, dip,
3498 		    ourflags, name, ph.ph_data, ph.ph_size);
3499 	}
3500 
3501 	/*
3502 	 * Free the encoded data allocated in the prop_encode routine.
3503 	 */
3504 	if (ph.ph_size != 0)
3505 		kmem_free(ph.ph_data, ph.ph_size);
3506 
3507 	return (rval);
3508 }
3509 
3510 
3511 /*
3512  * ddi_prop_create:	Define a managed property:
3513  *			See above for details.
3514  */
3515 
3516 int
3517 ddi_prop_create(dev_t dev, dev_info_t *dip, int flag,
3518     char *name, caddr_t value, int length)
3519 {
3520 	if (!(flag & DDI_PROP_CANSLEEP)) {
3521 		flag |= DDI_PROP_DONTSLEEP;
3522 #ifdef DDI_PROP_DEBUG
3523 		if (length != 0)
3524 			cmn_err(CE_NOTE, "!ddi_prop_create: interface obsolete,"
3525 			    "use ddi_prop_update (prop = %s, node = %s%d)",
3526 			    name, ddi_driver_name(dip), ddi_get_instance(dip));
3527 #endif /* DDI_PROP_DEBUG */
3528 	}
3529 	flag &= ~DDI_PROP_SYSTEM_DEF;
3530 	flag |= DDI_PROP_STACK_CREATE | DDI_PROP_TYPE_ANY;
3531 	return (ddi_prop_update_common(dev, dip, flag, name,
3532 	    value, length, ddi_prop_fm_encode_bytes));
3533 }
3534 
3535 int
3536 e_ddi_prop_create(dev_t dev, dev_info_t *dip, int flag,
3537     char *name, caddr_t value, int length)
3538 {
3539 	if (!(flag & DDI_PROP_CANSLEEP))
3540 		flag |= DDI_PROP_DONTSLEEP;
3541 	flag |= DDI_PROP_SYSTEM_DEF | DDI_PROP_STACK_CREATE | DDI_PROP_TYPE_ANY;
3542 	return (ddi_prop_update_common(dev, dip, flag,
3543 	    name, value, length, ddi_prop_fm_encode_bytes));
3544 }
3545 
3546 int
3547 ddi_prop_modify(dev_t dev, dev_info_t *dip, int flag,
3548     char *name, caddr_t value, int length)
3549 {
3550 	ASSERT((flag & DDI_PROP_TYPE_MASK) == 0);
3551 
3552 	/*
3553 	 * If dev_t is DDI_DEV_T_ANY or name's length is zero,
3554 	 * return error.
3555 	 */
3556 	if (dev == DDI_DEV_T_ANY || name == NULL || strlen(name) == 0)
3557 		return (DDI_PROP_INVAL_ARG);
3558 
3559 	if (!(flag & DDI_PROP_CANSLEEP))
3560 		flag |= DDI_PROP_DONTSLEEP;
3561 	flag &= ~DDI_PROP_SYSTEM_DEF;
3562 	if (ddi_prop_exists(dev, dip, (flag | DDI_PROP_NOTPROM), name) == 0)
3563 		return (DDI_PROP_NOT_FOUND);
3564 
3565 	return (ddi_prop_update_common(dev, dip,
3566 	    (flag | DDI_PROP_TYPE_BYTE), name,
3567 	    value, length, ddi_prop_fm_encode_bytes));
3568 }
3569 
3570 int
3571 e_ddi_prop_modify(dev_t dev, dev_info_t *dip, int flag,
3572     char *name, caddr_t value, int length)
3573 {
3574 	ASSERT((flag & DDI_PROP_TYPE_MASK) == 0);
3575 
3576 	/*
3577 	 * If dev_t is DDI_DEV_T_ANY or name's length is zero,
3578 	 * return error.
3579 	 */
3580 	if (dev == DDI_DEV_T_ANY || name == NULL || strlen(name) == 0)
3581 		return (DDI_PROP_INVAL_ARG);
3582 
3583 	if (ddi_prop_exists(dev, dip, (flag | DDI_PROP_SYSTEM_DEF), name) == 0)
3584 		return (DDI_PROP_NOT_FOUND);
3585 
3586 	if (!(flag & DDI_PROP_CANSLEEP))
3587 		flag |= DDI_PROP_DONTSLEEP;
3588 	return (ddi_prop_update_common(dev, dip,
3589 	    (flag | DDI_PROP_SYSTEM_DEF | DDI_PROP_TYPE_BYTE),
3590 	    name, value, length, ddi_prop_fm_encode_bytes));
3591 }
3592 
3593 
3594 /*
3595  * Common lookup routine used to lookup and decode a property.
3596  * Creates a property handle, searches for the raw encoded data,
3597  * fills in the handle, and calls the property decode functions
3598  * passed in.
3599  *
3600  * This routine is not static because ddi_bus_prop_op() which lives in
3601  * ddi_impl.c calls it.  No driver should be calling this routine.
3602  */
3603 int
3604 ddi_prop_lookup_common(dev_t match_dev, dev_info_t *dip,
3605     uint_t flags, char *name, void *data, uint_t *nelements,
3606     int (*prop_decoder)(prop_handle_t *, void *data, uint_t *nelements))
3607 {
3608 	int		rval;
3609 	uint_t		ourflags;
3610 	prop_handle_t	ph;
3611 
3612 	if ((match_dev == DDI_DEV_T_NONE) ||
3613 	    (name == NULL) || (strlen(name) == 0))
3614 		return (DDI_PROP_INVAL_ARG);
3615 
3616 	ourflags = (flags & DDI_PROP_DONTSLEEP) ? flags :
3617 	    flags | DDI_PROP_CANSLEEP;
3618 
3619 	/*
3620 	 * Get the encoded data
3621 	 */
3622 	bzero(&ph, sizeof (prop_handle_t));
3623 
3624 	if ((flags & DDI_UNBND_DLPI2) || (flags & DDI_PROP_ROOTNEX_GLOBAL)) {
3625 		/*
3626 		 * For rootnex and unbound dlpi style-2 devices, index into
3627 		 * the devnames' array and search the global
3628 		 * property list.
3629 		 */
3630 		ourflags &= ~DDI_UNBND_DLPI2;
3631 		rval = i_ddi_prop_search_global(match_dev,
3632 		    ourflags, name, &ph.ph_data, &ph.ph_size);
3633 	} else {
3634 		rval = ddi_prop_search_common(match_dev, dip,
3635 		    PROP_LEN_AND_VAL_ALLOC, ourflags, name,
3636 		    &ph.ph_data, &ph.ph_size);
3637 
3638 	}
3639 
3640 	if (rval != DDI_PROP_SUCCESS && rval != DDI_PROP_FOUND_1275) {
3641 		ASSERT(ph.ph_data == NULL);
3642 		ASSERT(ph.ph_size == 0);
3643 		return (rval);
3644 	}
3645 
3646 	/*
3647 	 * If the encoded data came from a OBP or software
3648 	 * use the 1275 OBP decode/encode routines.
3649 	 */
3650 	ph.ph_cur_pos = ph.ph_data;
3651 	ph.ph_save_pos = ph.ph_data;
3652 	ph.ph_ops = &prop_1275_ops;
3653 	ph.ph_flags = (rval == DDI_PROP_FOUND_1275) ? PH_FROM_PROM : 0;
3654 
3655 	rval = (*prop_decoder)(&ph, data, nelements);
3656 
3657 	/*
3658 	 * Free the encoded data
3659 	 */
3660 	if (ph.ph_size != 0)
3661 		kmem_free(ph.ph_data, ph.ph_size);
3662 
3663 	return (rval);
3664 }
3665 
3666 /*
3667  * Lookup and return an array of composite properties.  The driver must
3668  * provide the decode routine.
3669  */
3670 int
3671 ddi_prop_lookup(dev_t match_dev, dev_info_t *dip,
3672     uint_t flags, char *name, void *data, uint_t *nelements,
3673     int (*prop_decoder)(prop_handle_t *, void *data, uint_t *nelements))
3674 {
3675 	return (ddi_prop_lookup_common(match_dev, dip,
3676 	    (flags | DDI_PROP_TYPE_COMPOSITE), name,
3677 	    data, nelements, prop_decoder));
3678 }
3679 
3680 /*
3681  * Return 1 if a property exists (no type checking done).
3682  * Return 0 if it does not exist.
3683  */
3684 int
3685 ddi_prop_exists(dev_t match_dev, dev_info_t *dip, uint_t flags, char *name)
3686 {
3687 	int	i;
3688 	uint_t	x = 0;
3689 
3690 	i = ddi_prop_search_common(match_dev, dip, PROP_EXISTS,
3691 	    flags | DDI_PROP_TYPE_MASK, name, NULL, &x);
3692 	return (i == DDI_PROP_SUCCESS || i == DDI_PROP_FOUND_1275);
3693 }
3694 
3695 
3696 /*
3697  * Update an array of composite properties.  The driver must
3698  * provide the encode routine.
3699  */
3700 int
3701 ddi_prop_update(dev_t match_dev, dev_info_t *dip,
3702     char *name, void *data, uint_t nelements,
3703     int (*prop_create)(prop_handle_t *, void *data, uint_t nelements))
3704 {
3705 	return (ddi_prop_update_common(match_dev, dip, DDI_PROP_TYPE_COMPOSITE,
3706 	    name, data, nelements, prop_create));
3707 }
3708 
3709 /*
3710  * Get a single integer or boolean property and return it.
3711  * If the property does not exists, or cannot be decoded,
3712  * then return the defvalue passed in.
3713  *
3714  * This routine always succeeds.
3715  */
3716 int
3717 ddi_prop_get_int(dev_t match_dev, dev_info_t *dip, uint_t flags,
3718     char *name, int defvalue)
3719 {
3720 	int	data;
3721 	uint_t	nelements;
3722 	int	rval;
3723 
3724 	if (flags & ~(DDI_PROP_DONTPASS | DDI_PROP_NOTPROM |
3725 	    LDI_DEV_T_ANY | DDI_UNBND_DLPI2 | DDI_PROP_ROOTNEX_GLOBAL)) {
3726 #ifdef DEBUG
3727 		if (dip != NULL) {
3728 			cmn_err(CE_WARN, "ddi_prop_get_int: invalid flag"
3729 			    " 0x%x (prop = %s, node = %s%d)", flags,
3730 			    name, ddi_driver_name(dip), ddi_get_instance(dip));
3731 		}
3732 #endif /* DEBUG */
3733 		flags &= DDI_PROP_DONTPASS | DDI_PROP_NOTPROM |
3734 		    LDI_DEV_T_ANY | DDI_UNBND_DLPI2;
3735 	}
3736 
3737 	if ((rval = ddi_prop_lookup_common(match_dev, dip,
3738 	    (flags | DDI_PROP_TYPE_INT), name, &data, &nelements,
3739 	    ddi_prop_fm_decode_int)) != DDI_PROP_SUCCESS) {
3740 		if (rval == DDI_PROP_END_OF_DATA)
3741 			data = 1;
3742 		else
3743 			data = defvalue;
3744 	}
3745 	return (data);
3746 }
3747 
3748 /*
3749  * Get a single 64 bit integer or boolean property and return it.
3750  * If the property does not exists, or cannot be decoded,
3751  * then return the defvalue passed in.
3752  *
3753  * This routine always succeeds.
3754  */
3755 int64_t
3756 ddi_prop_get_int64(dev_t match_dev, dev_info_t *dip, uint_t flags,
3757     char *name, int64_t defvalue)
3758 {
3759 	int64_t	data;
3760 	uint_t	nelements;
3761 	int	rval;
3762 
3763 	if (flags & ~(DDI_PROP_DONTPASS | DDI_PROP_NOTPROM |
3764 	    LDI_DEV_T_ANY | DDI_UNBND_DLPI2 | DDI_PROP_ROOTNEX_GLOBAL)) {
3765 #ifdef DEBUG
3766 		if (dip != NULL) {
3767 			cmn_err(CE_WARN, "ddi_prop_get_int64: invalid flag"
3768 			    " 0x%x (prop = %s, node = %s%d)", flags,
3769 			    name, ddi_driver_name(dip), ddi_get_instance(dip));
3770 		}
3771 #endif /* DEBUG */
3772 		return (DDI_PROP_INVAL_ARG);
3773 	}
3774 
3775 	if ((rval = ddi_prop_lookup_common(match_dev, dip,
3776 	    (flags | DDI_PROP_TYPE_INT64 | DDI_PROP_NOTPROM),
3777 	    name, &data, &nelements, ddi_prop_fm_decode_int64))
3778 	    != DDI_PROP_SUCCESS) {
3779 		if (rval == DDI_PROP_END_OF_DATA)
3780 			data = 1;
3781 		else
3782 			data = defvalue;
3783 	}
3784 	return (data);
3785 }
3786 
3787 /*
3788  * Get an array of integer property
3789  */
3790 int
3791 ddi_prop_lookup_int_array(dev_t match_dev, dev_info_t *dip, uint_t flags,
3792     char *name, int **data, uint_t *nelements)
3793 {
3794 	if (flags & ~(DDI_PROP_DONTPASS | DDI_PROP_NOTPROM |
3795 	    LDI_DEV_T_ANY | DDI_UNBND_DLPI2 | DDI_PROP_ROOTNEX_GLOBAL)) {
3796 #ifdef DEBUG
3797 		if (dip != NULL) {
3798 			cmn_err(CE_WARN, "ddi_prop_lookup_int_array: "
3799 			    "invalid flag 0x%x (prop = %s, node = %s%d)",
3800 			    flags, name, ddi_driver_name(dip),
3801 			    ddi_get_instance(dip));
3802 		}
3803 #endif /* DEBUG */
3804 		flags &= DDI_PROP_DONTPASS | DDI_PROP_NOTPROM |
3805 		    LDI_DEV_T_ANY | DDI_UNBND_DLPI2;
3806 	}
3807 
3808 	return (ddi_prop_lookup_common(match_dev, dip,
3809 	    (flags | DDI_PROP_TYPE_INT), name, data,
3810 	    nelements, ddi_prop_fm_decode_ints));
3811 }
3812 
3813 /*
3814  * Get an array of 64 bit integer properties
3815  */
3816 int
3817 ddi_prop_lookup_int64_array(dev_t match_dev, dev_info_t *dip, uint_t flags,
3818     char *name, int64_t **data, uint_t *nelements)
3819 {
3820 	if (flags & ~(DDI_PROP_DONTPASS | DDI_PROP_NOTPROM |
3821 	    LDI_DEV_T_ANY | DDI_UNBND_DLPI2 | DDI_PROP_ROOTNEX_GLOBAL)) {
3822 #ifdef DEBUG
3823 		if (dip != NULL) {
3824 			cmn_err(CE_WARN, "ddi_prop_lookup_int64_array: "
3825 			    "invalid flag 0x%x (prop = %s, node = %s%d)",
3826 			    flags, name, ddi_driver_name(dip),
3827 			    ddi_get_instance(dip));
3828 		}
3829 #endif /* DEBUG */
3830 		return (DDI_PROP_INVAL_ARG);
3831 	}
3832 
3833 	return (ddi_prop_lookup_common(match_dev, dip,
3834 	    (flags | DDI_PROP_TYPE_INT64 | DDI_PROP_NOTPROM),
3835 	    name, data, nelements, ddi_prop_fm_decode_int64_array));
3836 }
3837 
3838 /*
3839  * Update a single integer property.  If the property exists on the drivers
3840  * property list it updates, else it creates it.
3841  */
3842 int
3843 ddi_prop_update_int(dev_t match_dev, dev_info_t *dip,
3844     char *name, int data)
3845 {
3846 	return (ddi_prop_update_common(match_dev, dip, DDI_PROP_TYPE_INT,
3847 	    name, &data, 1, ddi_prop_fm_encode_ints));
3848 }
3849 
3850 /*
3851  * Update a single 64 bit integer property.
3852  * Update the driver property list if it exists, else create it.
3853  */
3854 int
3855 ddi_prop_update_int64(dev_t match_dev, dev_info_t *dip,
3856     char *name, int64_t data)
3857 {
3858 	return (ddi_prop_update_common(match_dev, dip, DDI_PROP_TYPE_INT64,
3859 	    name, &data, 1, ddi_prop_fm_encode_int64));
3860 }
3861 
3862 int
3863 e_ddi_prop_update_int(dev_t match_dev, dev_info_t *dip,
3864     char *name, int data)
3865 {
3866 	return (ddi_prop_update_common(match_dev, dip,
3867 	    DDI_PROP_SYSTEM_DEF | DDI_PROP_TYPE_INT,
3868 	    name, &data, 1, ddi_prop_fm_encode_ints));
3869 }
3870 
3871 int
3872 e_ddi_prop_update_int64(dev_t match_dev, dev_info_t *dip,
3873     char *name, int64_t data)
3874 {
3875 	return (ddi_prop_update_common(match_dev, dip,
3876 	    DDI_PROP_SYSTEM_DEF | DDI_PROP_TYPE_INT64,
3877 	    name, &data, 1, ddi_prop_fm_encode_int64));
3878 }
3879 
3880 /*
3881  * Update an array of integer property.  If the property exists on the drivers
3882  * property list it updates, else it creates it.
3883  */
3884 int
3885 ddi_prop_update_int_array(dev_t match_dev, dev_info_t *dip,
3886     char *name, int *data, uint_t nelements)
3887 {
3888 	return (ddi_prop_update_common(match_dev, dip, DDI_PROP_TYPE_INT,
3889 	    name, data, nelements, ddi_prop_fm_encode_ints));
3890 }
3891 
3892 /*
3893  * Update an array of 64 bit integer properties.
3894  * Update the driver property list if it exists, else create it.
3895  */
3896 int
3897 ddi_prop_update_int64_array(dev_t match_dev, dev_info_t *dip,
3898     char *name, int64_t *data, uint_t nelements)
3899 {
3900 	return (ddi_prop_update_common(match_dev, dip, DDI_PROP_TYPE_INT64,
3901 	    name, data, nelements, ddi_prop_fm_encode_int64));
3902 }
3903 
3904 int
3905 e_ddi_prop_update_int64_array(dev_t match_dev, dev_info_t *dip,
3906     char *name, int64_t *data, uint_t nelements)
3907 {
3908 	return (ddi_prop_update_common(match_dev, dip,
3909 	    DDI_PROP_SYSTEM_DEF | DDI_PROP_TYPE_INT64,
3910 	    name, data, nelements, ddi_prop_fm_encode_int64));
3911 }
3912 
3913 int
3914 e_ddi_prop_update_int_array(dev_t match_dev, dev_info_t *dip,
3915     char *name, int *data, uint_t nelements)
3916 {
3917 	return (ddi_prop_update_common(match_dev, dip,
3918 	    DDI_PROP_SYSTEM_DEF | DDI_PROP_TYPE_INT,
3919 	    name, data, nelements, ddi_prop_fm_encode_ints));
3920 }
3921 
3922 /*
3923  * Get a single string property.
3924  */
3925 int
3926 ddi_prop_lookup_string(dev_t match_dev, dev_info_t *dip, uint_t flags,
3927     char *name, char **data)
3928 {
3929 	uint_t x;
3930 
3931 	if (flags & ~(DDI_PROP_DONTPASS | DDI_PROP_NOTPROM |
3932 	    LDI_DEV_T_ANY | DDI_UNBND_DLPI2 | DDI_PROP_ROOTNEX_GLOBAL)) {
3933 #ifdef DEBUG
3934 		if (dip != NULL) {
3935 			cmn_err(CE_WARN, "%s: invalid flag 0x%x "
3936 			    "(prop = %s, node = %s%d); invalid bits ignored",
3937 			    "ddi_prop_lookup_string", flags, name,
3938 			    ddi_driver_name(dip), ddi_get_instance(dip));
3939 		}
3940 #endif /* DEBUG */
3941 		flags &= DDI_PROP_DONTPASS | DDI_PROP_NOTPROM |
3942 		    LDI_DEV_T_ANY | DDI_UNBND_DLPI2;
3943 	}
3944 
3945 	return (ddi_prop_lookup_common(match_dev, dip,
3946 	    (flags | DDI_PROP_TYPE_STRING), name, data,
3947 	    &x, ddi_prop_fm_decode_string));
3948 }
3949 
3950 /*
3951  * Get an array of strings property.
3952  */
3953 int
3954 ddi_prop_lookup_string_array(dev_t match_dev, dev_info_t *dip, uint_t flags,
3955     char *name, char ***data, uint_t *nelements)
3956 {
3957 	if (flags & ~(DDI_PROP_DONTPASS | DDI_PROP_NOTPROM |
3958 	    LDI_DEV_T_ANY | DDI_UNBND_DLPI2 | DDI_PROP_ROOTNEX_GLOBAL)) {
3959 #ifdef DEBUG
3960 		if (dip != NULL) {
3961 			cmn_err(CE_WARN, "ddi_prop_lookup_string_array: "
3962 			    "invalid flag 0x%x (prop = %s, node = %s%d)",
3963 			    flags, name, ddi_driver_name(dip),
3964 			    ddi_get_instance(dip));
3965 		}
3966 #endif /* DEBUG */
3967 		flags &= DDI_PROP_DONTPASS | DDI_PROP_NOTPROM |
3968 		    LDI_DEV_T_ANY | DDI_UNBND_DLPI2;
3969 	}
3970 
3971 	return (ddi_prop_lookup_common(match_dev, dip,
3972 	    (flags | DDI_PROP_TYPE_STRING), name, data,
3973 	    nelements, ddi_prop_fm_decode_strings));
3974 }
3975 
3976 /*
3977  * Update a single string property.
3978  */
3979 int
3980 ddi_prop_update_string(dev_t match_dev, dev_info_t *dip,
3981     char *name, char *data)
3982 {
3983 	return (ddi_prop_update_common(match_dev, dip,
3984 	    DDI_PROP_TYPE_STRING, name, &data, 1,
3985 	    ddi_prop_fm_encode_string));
3986 }
3987 
3988 int
3989 e_ddi_prop_update_string(dev_t match_dev, dev_info_t *dip,
3990     char *name, char *data)
3991 {
3992 	return (ddi_prop_update_common(match_dev, dip,
3993 	    DDI_PROP_SYSTEM_DEF | DDI_PROP_TYPE_STRING,
3994 	    name, &data, 1, ddi_prop_fm_encode_string));
3995 }
3996 
3997 
3998 /*
3999  * Update an array of strings property.
4000  */
4001 int
4002 ddi_prop_update_string_array(dev_t match_dev, dev_info_t *dip,
4003     char *name, char **data, uint_t nelements)
4004 {
4005 	return (ddi_prop_update_common(match_dev, dip,
4006 	    DDI_PROP_TYPE_STRING, name, data, nelements,
4007 	    ddi_prop_fm_encode_strings));
4008 }
4009 
4010 int
4011 e_ddi_prop_update_string_array(dev_t match_dev, dev_info_t *dip,
4012     char *name, char **data, uint_t nelements)
4013 {
4014 	return (ddi_prop_update_common(match_dev, dip,
4015 	    DDI_PROP_SYSTEM_DEF | DDI_PROP_TYPE_STRING,
4016 	    name, data, nelements,
4017 	    ddi_prop_fm_encode_strings));
4018 }
4019 
4020 
4021 /*
4022  * Get an array of bytes property.
4023  */
4024 int
4025 ddi_prop_lookup_byte_array(dev_t match_dev, dev_info_t *dip, uint_t flags,
4026     char *name, uchar_t **data, uint_t *nelements)
4027 {
4028 	if (flags & ~(DDI_PROP_DONTPASS | DDI_PROP_NOTPROM |
4029 	    LDI_DEV_T_ANY | DDI_UNBND_DLPI2 | DDI_PROP_ROOTNEX_GLOBAL)) {
4030 #ifdef DEBUG
4031 		if (dip != NULL) {
4032 			cmn_err(CE_WARN, "ddi_prop_lookup_byte_array: "
4033 			    " invalid flag 0x%x (prop = %s, node = %s%d)",
4034 			    flags, name, ddi_driver_name(dip),
4035 			    ddi_get_instance(dip));
4036 		}
4037 #endif /* DEBUG */
4038 		flags &= DDI_PROP_DONTPASS | DDI_PROP_NOTPROM |
4039 		    LDI_DEV_T_ANY | DDI_UNBND_DLPI2;
4040 	}
4041 
4042 	return (ddi_prop_lookup_common(match_dev, dip,
4043 	    (flags | DDI_PROP_TYPE_BYTE), name, data,
4044 	    nelements, ddi_prop_fm_decode_bytes));
4045 }
4046 
4047 /*
4048  * Update an array of bytes property.
4049  */
4050 int
4051 ddi_prop_update_byte_array(dev_t match_dev, dev_info_t *dip,
4052     char *name, uchar_t *data, uint_t nelements)
4053 {
4054 	if (nelements == 0)
4055 		return (DDI_PROP_INVAL_ARG);
4056 
4057 	return (ddi_prop_update_common(match_dev, dip, DDI_PROP_TYPE_BYTE,
4058 	    name, data, nelements, ddi_prop_fm_encode_bytes));
4059 }
4060 
4061 
4062 int
4063 e_ddi_prop_update_byte_array(dev_t match_dev, dev_info_t *dip,
4064     char *name, uchar_t *data, uint_t nelements)
4065 {
4066 	if (nelements == 0)
4067 		return (DDI_PROP_INVAL_ARG);
4068 
4069 	return (ddi_prop_update_common(match_dev, dip,
4070 	    DDI_PROP_SYSTEM_DEF | DDI_PROP_TYPE_BYTE,
4071 	    name, data, nelements, ddi_prop_fm_encode_bytes));
4072 }
4073 
4074 
4075 /*
4076  * ddi_prop_remove_common:	Undefine a managed property:
4077  *			Input dev_t must match dev_t when defined.
4078  *			Returns DDI_PROP_NOT_FOUND, possibly.
4079  *			DDI_PROP_INVAL_ARG is also possible if dev is
4080  *			DDI_DEV_T_ANY or incoming name is the NULL string.
4081  */
4082 int
4083 ddi_prop_remove_common(dev_t dev, dev_info_t *dip, char *name, int flag)
4084 {
4085 	ddi_prop_t	**list_head = &(DEVI(dip)->devi_drv_prop_ptr);
4086 	ddi_prop_t	*propp;
4087 	ddi_prop_t	*lastpropp = NULL;
4088 
4089 	if ((dev == DDI_DEV_T_ANY) || (name == (char *)0) ||
4090 	    (strlen(name) == 0)) {
4091 		return (DDI_PROP_INVAL_ARG);
4092 	}
4093 
4094 	if (flag & DDI_PROP_SYSTEM_DEF)
4095 		list_head = &(DEVI(dip)->devi_sys_prop_ptr);
4096 	else if (flag & DDI_PROP_HW_DEF)
4097 		list_head = &(DEVI(dip)->devi_hw_prop_ptr);
4098 
4099 	mutex_enter(&(DEVI(dip)->devi_lock));
4100 
4101 	for (propp = *list_head; propp != NULL; propp = propp->prop_next)  {
4102 		if (DDI_STRSAME(propp->prop_name, name) &&
4103 		    (dev == propp->prop_dev)) {
4104 			/*
4105 			 * Unlink this propp allowing for it to
4106 			 * be first in the list:
4107 			 */
4108 
4109 			if (lastpropp == NULL)
4110 				*list_head = propp->prop_next;
4111 			else
4112 				lastpropp->prop_next = propp->prop_next;
4113 
4114 			mutex_exit(&(DEVI(dip)->devi_lock));
4115 
4116 			/*
4117 			 * Free memory and return...
4118 			 */
4119 			kmem_free(propp->prop_name,
4120 			    strlen(propp->prop_name) + 1);
4121 			if (propp->prop_len != 0)
4122 				kmem_free(propp->prop_val, propp->prop_len);
4123 			kmem_free(propp, sizeof (ddi_prop_t));
4124 			return (DDI_PROP_SUCCESS);
4125 		}
4126 		lastpropp = propp;
4127 	}
4128 	mutex_exit(&(DEVI(dip)->devi_lock));
4129 	return (DDI_PROP_NOT_FOUND);
4130 }
4131 
4132 int
4133 ddi_prop_remove(dev_t dev, dev_info_t *dip, char *name)
4134 {
4135 	return (ddi_prop_remove_common(dev, dip, name, 0));
4136 }
4137 
4138 int
4139 e_ddi_prop_remove(dev_t dev, dev_info_t *dip, char *name)
4140 {
4141 	return (ddi_prop_remove_common(dev, dip, name, DDI_PROP_SYSTEM_DEF));
4142 }
4143 
4144 /*
4145  * e_ddi_prop_list_delete: remove a list of properties
4146  *	Note that the caller needs to provide the required protection
4147  *	(eg. devi_lock if these properties are still attached to a devi)
4148  */
4149 void
4150 e_ddi_prop_list_delete(ddi_prop_t *props)
4151 {
4152 	i_ddi_prop_list_delete(props);
4153 }
4154 
4155 /*
4156  * ddi_prop_remove_all_common:
4157  *	Used before unloading a driver to remove
4158  *	all properties. (undefines all dev_t's props.)
4159  *	Also removes `explicitly undefined' props.
4160  *	No errors possible.
4161  */
4162 void
4163 ddi_prop_remove_all_common(dev_info_t *dip, int flag)
4164 {
4165 	ddi_prop_t	**list_head;
4166 
4167 	mutex_enter(&(DEVI(dip)->devi_lock));
4168 	if (flag & DDI_PROP_SYSTEM_DEF) {
4169 		list_head = &(DEVI(dip)->devi_sys_prop_ptr);
4170 	} else if (flag & DDI_PROP_HW_DEF) {
4171 		list_head = &(DEVI(dip)->devi_hw_prop_ptr);
4172 	} else {
4173 		list_head = &(DEVI(dip)->devi_drv_prop_ptr);
4174 	}
4175 	i_ddi_prop_list_delete(*list_head);
4176 	*list_head = NULL;
4177 	mutex_exit(&(DEVI(dip)->devi_lock));
4178 }
4179 
4180 
4181 /*
4182  * ddi_prop_remove_all:		Remove all driver prop definitions.
4183  */
4184 
4185 void
4186 ddi_prop_remove_all(dev_info_t *dip)
4187 {
4188 	i_ddi_prop_dyn_driver_set(dip, NULL);
4189 	ddi_prop_remove_all_common(dip, 0);
4190 }
4191 
4192 /*
4193  * e_ddi_prop_remove_all:	Remove all system prop definitions.
4194  */
4195 
4196 void
4197 e_ddi_prop_remove_all(dev_info_t *dip)
4198 {
4199 	ddi_prop_remove_all_common(dip, (int)DDI_PROP_SYSTEM_DEF);
4200 }
4201 
4202 
4203 /*
4204  * ddi_prop_undefine:	Explicitly undefine a property.  Property
4205  *			searches which match this property return
4206  *			the error code DDI_PROP_UNDEFINED.
4207  *
4208  *			Use ddi_prop_remove to negate effect of
4209  *			ddi_prop_undefine
4210  *
4211  *			See above for error returns.
4212  */
4213 
4214 int
4215 ddi_prop_undefine(dev_t dev, dev_info_t *dip, int flag, char *name)
4216 {
4217 	if (!(flag & DDI_PROP_CANSLEEP))
4218 		flag |= DDI_PROP_DONTSLEEP;
4219 	flag |= DDI_PROP_STACK_CREATE | DDI_PROP_UNDEF_IT | DDI_PROP_TYPE_ANY;
4220 	return (ddi_prop_update_common(dev, dip, flag,
4221 	    name, NULL, 0, ddi_prop_fm_encode_bytes));
4222 }
4223 
4224 int
4225 e_ddi_prop_undefine(dev_t dev, dev_info_t *dip, int flag, char *name)
4226 {
4227 	if (!(flag & DDI_PROP_CANSLEEP))
4228 		flag |= DDI_PROP_DONTSLEEP;
4229 	flag |= DDI_PROP_SYSTEM_DEF | DDI_PROP_STACK_CREATE |
4230 	    DDI_PROP_UNDEF_IT | DDI_PROP_TYPE_ANY;
4231 	return (ddi_prop_update_common(dev, dip, flag,
4232 	    name, NULL, 0, ddi_prop_fm_encode_bytes));
4233 }
4234 
4235 /*
4236  * Support for gathering dynamic properties in devinfo snapshot.
4237  */
4238 void
4239 i_ddi_prop_dyn_driver_set(dev_info_t *dip, i_ddi_prop_dyn_t *dp)
4240 {
4241 	DEVI(dip)->devi_prop_dyn_driver = dp;
4242 }
4243 
4244 i_ddi_prop_dyn_t *
4245 i_ddi_prop_dyn_driver_get(dev_info_t *dip)
4246 {
4247 	return (DEVI(dip)->devi_prop_dyn_driver);
4248 }
4249 
4250 void
4251 i_ddi_prop_dyn_parent_set(dev_info_t *dip, i_ddi_prop_dyn_t *dp)
4252 {
4253 	DEVI(dip)->devi_prop_dyn_parent = dp;
4254 }
4255 
4256 i_ddi_prop_dyn_t *
4257 i_ddi_prop_dyn_parent_get(dev_info_t *dip)
4258 {
4259 	return (DEVI(dip)->devi_prop_dyn_parent);
4260 }
4261 
4262 void
4263 i_ddi_prop_dyn_cache_invalidate(dev_info_t *dip, i_ddi_prop_dyn_t *dp)
4264 {
4265 	/* for now we invalidate the entire cached snapshot */
4266 	if (dip && dp)
4267 		i_ddi_di_cache_invalidate();
4268 }
4269 
4270 /* ARGSUSED */
4271 void
4272 ddi_prop_cache_invalidate(dev_t dev, dev_info_t *dip, char *name, int flags)
4273 {
4274 	/* for now we invalidate the entire cached snapshot */
4275 	i_ddi_di_cache_invalidate();
4276 }
4277 
4278 
4279 /*
4280  * Code to search hardware layer (PROM), if it exists, on behalf of child.
4281  *
4282  * if input dip != child_dip, then call is on behalf of child
4283  * to search PROM, do it via ddi_prop_search_common() and ascend only
4284  * if allowed.
4285  *
4286  * if input dip == ch_dip (child_dip), call is on behalf of root driver,
4287  * to search for PROM defined props only.
4288  *
4289  * Note that the PROM search is done only if the requested dev
4290  * is either DDI_DEV_T_ANY or DDI_DEV_T_NONE. PROM properties
4291  * have no associated dev, thus are automatically associated with
4292  * DDI_DEV_T_NONE.
4293  *
4294  * Modifying flag DDI_PROP_NOTPROM inhibits the search in the h/w layer.
4295  *
4296  * Returns DDI_PROP_FOUND_1275 if found to indicate to framework
4297  * that the property resides in the prom.
4298  */
4299 int
4300 impl_ddi_bus_prop_op(dev_t dev, dev_info_t *dip, dev_info_t *ch_dip,
4301     ddi_prop_op_t prop_op, int mod_flags,
4302     char *name, caddr_t valuep, int *lengthp)
4303 {
4304 	int	len;
4305 	caddr_t buffer;
4306 
4307 	/*
4308 	 * If requested dev is DDI_DEV_T_NONE or DDI_DEV_T_ANY, then
4309 	 * look in caller's PROM if it's a self identifying device...
4310 	 *
4311 	 * Note that this is very similar to ddi_prop_op, but we
4312 	 * search the PROM instead of the s/w defined properties,
4313 	 * and we are called on by the parent driver to do this for
4314 	 * the child.
4315 	 */
4316 
4317 	if (((dev == DDI_DEV_T_NONE) || (dev == DDI_DEV_T_ANY)) &&
4318 	    ndi_dev_is_prom_node(ch_dip) &&
4319 	    ((mod_flags & DDI_PROP_NOTPROM) == 0)) {
4320 		len = prom_getproplen((pnode_t)DEVI(ch_dip)->devi_nodeid, name);
4321 		if (len == -1) {
4322 			return (DDI_PROP_NOT_FOUND);
4323 		}
4324 
4325 		/*
4326 		 * If exists only request, we're done
4327 		 */
4328 		if (prop_op == PROP_EXISTS) {
4329 			return (DDI_PROP_FOUND_1275);
4330 		}
4331 
4332 		/*
4333 		 * If length only request or prop length == 0, get out
4334 		 */
4335 		if ((prop_op == PROP_LEN) || (len == 0)) {
4336 			*lengthp = len;
4337 			return (DDI_PROP_FOUND_1275);
4338 		}
4339 
4340 		/*
4341 		 * Allocate buffer if required... (either way `buffer'
4342 		 * is receiving address).
4343 		 */
4344 
4345 		switch (prop_op) {
4346 
4347 		case PROP_LEN_AND_VAL_ALLOC:
4348 
4349 			buffer = kmem_alloc((size_t)len,
4350 			    mod_flags & DDI_PROP_CANSLEEP ?
4351 			    KM_SLEEP : KM_NOSLEEP);
4352 			if (buffer == NULL) {
4353 				return (DDI_PROP_NO_MEMORY);
4354 			}
4355 			*(caddr_t *)valuep = buffer;
4356 			break;
4357 
4358 		case PROP_LEN_AND_VAL_BUF:
4359 
4360 			if (len > (*lengthp)) {
4361 				*lengthp = len;
4362 				return (DDI_PROP_BUF_TOO_SMALL);
4363 			}
4364 
4365 			buffer = valuep;
4366 			break;
4367 
4368 		default:
4369 			break;
4370 		}
4371 
4372 		/*
4373 		 * Call the PROM function to do the copy.
4374 		 */
4375 		(void) prom_getprop((pnode_t)DEVI(ch_dip)->devi_nodeid,
4376 		    name, buffer);
4377 
4378 		*lengthp = len; /* return the actual length to the caller */
4379 		(void) impl_fix_props(dip, ch_dip, name, len, buffer);
4380 		return (DDI_PROP_FOUND_1275);
4381 	}
4382 
4383 	return (DDI_PROP_NOT_FOUND);
4384 }
4385 
4386 /*
4387  * The ddi_bus_prop_op default bus nexus prop op function.
4388  *
4389  * Code to search hardware layer (PROM), if it exists,
4390  * on behalf of child, then, if appropriate, ascend and check
4391  * my own software defined properties...
4392  */
4393 int
4394 ddi_bus_prop_op(dev_t dev, dev_info_t *dip, dev_info_t *ch_dip,
4395     ddi_prop_op_t prop_op, int mod_flags,
4396     char *name, caddr_t valuep, int *lengthp)
4397 {
4398 	int	error;
4399 
4400 	error = impl_ddi_bus_prop_op(dev, dip, ch_dip, prop_op, mod_flags,
4401 	    name, valuep, lengthp);
4402 
4403 	if (error == DDI_PROP_SUCCESS || error == DDI_PROP_FOUND_1275 ||
4404 	    error == DDI_PROP_BUF_TOO_SMALL)
4405 		return (error);
4406 
4407 	if (error == DDI_PROP_NO_MEMORY) {
4408 		cmn_err(CE_CONT, prop_no_mem_msg, name);
4409 		return (DDI_PROP_NO_MEMORY);
4410 	}
4411 
4412 	/*
4413 	 * Check the 'options' node as a last resort
4414 	 */
4415 	if ((mod_flags & DDI_PROP_DONTPASS) != 0)
4416 		return (DDI_PROP_NOT_FOUND);
4417 
4418 	if (ch_dip == ddi_root_node())	{
4419 		/*
4420 		 * As a last resort, when we've reached
4421 		 * the top and still haven't found the
4422 		 * property, see if the desired property
4423 		 * is attached to the options node.
4424 		 *
4425 		 * The options dip is attached right after boot.
4426 		 */
4427 		ASSERT(options_dip != NULL);
4428 		/*
4429 		 * Force the "don't pass" flag to *just* see
4430 		 * what the options node has to offer.
4431 		 */
4432 		return (ddi_prop_search_common(dev, options_dip, prop_op,
4433 		    mod_flags|DDI_PROP_DONTPASS, name, valuep,
4434 		    (uint_t *)lengthp));
4435 	}
4436 
4437 	/*
4438 	 * Otherwise, continue search with parent's s/w defined properties...
4439 	 * NOTE: Using `dip' in following call increments the level.
4440 	 */
4441 
4442 	return (ddi_prop_search_common(dev, dip, prop_op, mod_flags,
4443 	    name, valuep, (uint_t *)lengthp));
4444 }
4445 
4446 /*
4447  * External property functions used by other parts of the kernel...
4448  */
4449 
4450 /*
4451  * e_ddi_getlongprop: See comments for ddi_get_longprop.
4452  */
4453 
4454 int
4455 e_ddi_getlongprop(dev_t dev, vtype_t type, char *name, int flags,
4456     caddr_t valuep, int *lengthp)
4457 {
4458 	_NOTE(ARGUNUSED(type))
4459 	dev_info_t *devi;
4460 	ddi_prop_op_t prop_op = PROP_LEN_AND_VAL_ALLOC;
4461 	int error;
4462 
4463 	if ((devi = e_ddi_hold_devi_by_dev(dev, 0)) == NULL)
4464 		return (DDI_PROP_NOT_FOUND);
4465 
4466 	error = cdev_prop_op(dev, devi, prop_op, flags, name, valuep, lengthp);
4467 	ddi_release_devi(devi);
4468 	return (error);
4469 }
4470 
4471 /*
4472  * e_ddi_getlongprop_buf:	See comments for ddi_getlongprop_buf.
4473  */
4474 
4475 int
4476 e_ddi_getlongprop_buf(dev_t dev, vtype_t type, char *name, int flags,
4477     caddr_t valuep, int *lengthp)
4478 {
4479 	_NOTE(ARGUNUSED(type))
4480 	dev_info_t *devi;
4481 	ddi_prop_op_t prop_op = PROP_LEN_AND_VAL_BUF;
4482 	int error;
4483 
4484 	if ((devi = e_ddi_hold_devi_by_dev(dev, 0)) == NULL)
4485 		return (DDI_PROP_NOT_FOUND);
4486 
4487 	error = cdev_prop_op(dev, devi, prop_op, flags, name, valuep, lengthp);
4488 	ddi_release_devi(devi);
4489 	return (error);
4490 }
4491 
4492 /*
4493  * e_ddi_getprop:	See comments for ddi_getprop.
4494  */
4495 int
4496 e_ddi_getprop(dev_t dev, vtype_t type, char *name, int flags, int defvalue)
4497 {
4498 	_NOTE(ARGUNUSED(type))
4499 	dev_info_t *devi;
4500 	ddi_prop_op_t prop_op = PROP_LEN_AND_VAL_BUF;
4501 	int	propvalue = defvalue;
4502 	int	proplength = sizeof (int);
4503 	int	error;
4504 
4505 	if ((devi = e_ddi_hold_devi_by_dev(dev, 0)) == NULL)
4506 		return (defvalue);
4507 
4508 	error = cdev_prop_op(dev, devi, prop_op,
4509 	    flags, name, (caddr_t)&propvalue, &proplength);
4510 	ddi_release_devi(devi);
4511 
4512 	if ((error == DDI_PROP_SUCCESS) && (proplength == 0))
4513 		propvalue = 1;
4514 
4515 	return (propvalue);
4516 }
4517 
4518 /*
4519  * e_ddi_getprop_int64:
4520  *
4521  * This is a typed interfaces, but predates typed properties. With the
4522  * introduction of typed properties the framework tries to ensure
4523  * consistent use of typed interfaces. This is why TYPE_INT64 is not
4524  * part of TYPE_ANY.  E_ddi_getprop_int64 is a special case where a
4525  * typed interface invokes legacy (non-typed) interfaces:
4526  * cdev_prop_op(), prop_op(9E), ddi_prop_op(9F)).  In this case the
4527  * fact that TYPE_INT64 is not part of TYPE_ANY matters.  To support
4528  * this type of lookup as a single operation we invoke the legacy
4529  * non-typed interfaces with the special CONSUMER_TYPED bit set. The
4530  * framework ddi_prop_op(9F) implementation is expected to check for
4531  * CONSUMER_TYPED and, if set, expand type bits beyond TYPE_ANY
4532  * (currently TYPE_INT64).
4533  */
4534 int64_t
4535 e_ddi_getprop_int64(dev_t dev, vtype_t type, char *name,
4536     int flags, int64_t defvalue)
4537 {
4538 	_NOTE(ARGUNUSED(type))
4539 	dev_info_t	*devi;
4540 	ddi_prop_op_t	prop_op = PROP_LEN_AND_VAL_BUF;
4541 	int64_t		propvalue = defvalue;
4542 	int		proplength = sizeof (propvalue);
4543 	int		error;
4544 
4545 	if ((devi = e_ddi_hold_devi_by_dev(dev, 0)) == NULL)
4546 		return (defvalue);
4547 
4548 	error = cdev_prop_op(dev, devi, prop_op, flags |
4549 	    DDI_PROP_CONSUMER_TYPED, name, (caddr_t)&propvalue, &proplength);
4550 	ddi_release_devi(devi);
4551 
4552 	if ((error == DDI_PROP_SUCCESS) && (proplength == 0))
4553 		propvalue = 1;
4554 
4555 	return (propvalue);
4556 }
4557 
4558 /*
4559  * e_ddi_getproplen:	See comments for ddi_getproplen.
4560  */
4561 int
4562 e_ddi_getproplen(dev_t dev, vtype_t type, char *name, int flags, int *lengthp)
4563 {
4564 	_NOTE(ARGUNUSED(type))
4565 	dev_info_t *devi;
4566 	ddi_prop_op_t prop_op = PROP_LEN;
4567 	int error;
4568 
4569 	if ((devi = e_ddi_hold_devi_by_dev(dev, 0)) == NULL)
4570 		return (DDI_PROP_NOT_FOUND);
4571 
4572 	error = cdev_prop_op(dev, devi, prop_op, flags, name, NULL, lengthp);
4573 	ddi_release_devi(devi);
4574 	return (error);
4575 }
4576 
4577 /*
4578  * Routines to get at elements of the dev_info structure
4579  */
4580 
4581 /*
4582  * ddi_binding_name: Return the driver binding name of the devinfo node
4583  *		This is the name the OS used to bind the node to a driver.
4584  */
4585 char *
4586 ddi_binding_name(dev_info_t *dip)
4587 {
4588 	return (DEVI(dip)->devi_binding_name);
4589 }
4590 
4591 /*
4592  * ddi_driver_major: Return the major number of the driver that
4593  *	the supplied devinfo is bound to.  If not yet bound,
4594  *	DDI_MAJOR_T_NONE.
4595  *
4596  * When used by the driver bound to 'devi', this
4597  * function will reliably return the driver major number.
4598  * Other ways of determining the driver major number, such as
4599  *	major = ddi_name_to_major(ddi_get_name(devi));
4600  *	major = ddi_name_to_major(ddi_binding_name(devi));
4601  * can return a different result as the driver/alias binding
4602  * can change dynamically, and thus should be avoided.
4603  */
4604 major_t
4605 ddi_driver_major(dev_info_t *devi)
4606 {
4607 	return (DEVI(devi)->devi_major);
4608 }
4609 
4610 /*
4611  * ddi_driver_name: Return the normalized driver name. this is the
4612  *		actual driver name
4613  */
4614 const char *
4615 ddi_driver_name(dev_info_t *devi)
4616 {
4617 	major_t major;
4618 
4619 	if ((major = ddi_driver_major(devi)) != DDI_MAJOR_T_NONE)
4620 		return (ddi_major_to_name(major));
4621 
4622 	return (ddi_node_name(devi));
4623 }
4624 
4625 /*
4626  * i_ddi_set_binding_name:	Set binding name.
4627  *
4628  *	Set the binding name to the given name.
4629  *	This routine is for use by the ddi implementation, not by drivers.
4630  */
4631 void
4632 i_ddi_set_binding_name(dev_info_t *dip, char *name)
4633 {
4634 	DEVI(dip)->devi_binding_name = name;
4635 
4636 }
4637 
4638 /*
4639  * ddi_get_name: A synonym of ddi_binding_name() ... returns a name
4640  * the implementation has used to bind the node to a driver.
4641  */
4642 char *
4643 ddi_get_name(dev_info_t *dip)
4644 {
4645 	return (DEVI(dip)->devi_binding_name);
4646 }
4647 
4648 /*
4649  * ddi_node_name: Return the name property of the devinfo node
4650  *		This may differ from ddi_binding_name if the node name
4651  *		does not define a binding to a driver (i.e. generic names).
4652  */
4653 char *
4654 ddi_node_name(dev_info_t *dip)
4655 {
4656 	return (DEVI(dip)->devi_node_name);
4657 }
4658 
4659 
4660 /*
4661  * ddi_get_nodeid:	Get nodeid stored in dev_info structure.
4662  */
4663 int
4664 ddi_get_nodeid(dev_info_t *dip)
4665 {
4666 	return (DEVI(dip)->devi_nodeid);
4667 }
4668 
4669 int
4670 ddi_get_instance(dev_info_t *dip)
4671 {
4672 	return (DEVI(dip)->devi_instance);
4673 }
4674 
4675 struct dev_ops *
4676 ddi_get_driver(dev_info_t *dip)
4677 {
4678 	return (DEVI(dip)->devi_ops);
4679 }
4680 
4681 void
4682 ddi_set_driver(dev_info_t *dip, struct dev_ops *devo)
4683 {
4684 	DEVI(dip)->devi_ops = devo;
4685 }
4686 
4687 /*
4688  * ddi_set_driver_private/ddi_get_driver_private:
4689  * Get/set device driver private data in devinfo.
4690  */
4691 void
4692 ddi_set_driver_private(dev_info_t *dip, void *data)
4693 {
4694 	DEVI(dip)->devi_driver_data = data;
4695 }
4696 
4697 void *
4698 ddi_get_driver_private(dev_info_t *dip)
4699 {
4700 	return (DEVI(dip)->devi_driver_data);
4701 }
4702 
4703 /*
4704  * ddi_get_parent, ddi_get_child, ddi_get_next_sibling
4705  */
4706 
4707 dev_info_t *
4708 ddi_get_parent(dev_info_t *dip)
4709 {
4710 	return ((dev_info_t *)DEVI(dip)->devi_parent);
4711 }
4712 
4713 dev_info_t *
4714 ddi_get_child(dev_info_t *dip)
4715 {
4716 	return ((dev_info_t *)DEVI(dip)->devi_child);
4717 }
4718 
4719 dev_info_t *
4720 ddi_get_next_sibling(dev_info_t *dip)
4721 {
4722 	return ((dev_info_t *)DEVI(dip)->devi_sibling);
4723 }
4724 
4725 dev_info_t *
4726 ddi_get_next(dev_info_t *dip)
4727 {
4728 	return ((dev_info_t *)DEVI(dip)->devi_next);
4729 }
4730 
4731 void
4732 ddi_set_next(dev_info_t *dip, dev_info_t *nextdip)
4733 {
4734 	DEVI(dip)->devi_next = DEVI(nextdip);
4735 }
4736 
4737 /*
4738  * ddi_root_node:		Return root node of devinfo tree
4739  */
4740 
4741 dev_info_t *
4742 ddi_root_node(void)
4743 {
4744 	extern dev_info_t *top_devinfo;
4745 
4746 	return (top_devinfo);
4747 }
4748 
4749 /*
4750  * Miscellaneous functions:
4751  */
4752 
4753 /*
4754  * Implementation specific hooks
4755  */
4756 
4757 void
4758 ddi_report_dev(dev_info_t *d)
4759 {
4760 	char *b;
4761 
4762 	(void) ddi_ctlops(d, d, DDI_CTLOPS_REPORTDEV, (void *)0, (void *)0);
4763 
4764 	/*
4765 	 * If this devinfo node has cb_ops, it's implicitly accessible from
4766 	 * userland, so we print its full name together with the instance
4767 	 * number 'abbreviation' that the driver may use internally.
4768 	 */
4769 	if (DEVI(d)->devi_ops->devo_cb_ops != (struct cb_ops *)0 &&
4770 	    (b = kmem_zalloc(MAXPATHLEN, KM_NOSLEEP))) {
4771 		cmn_err(CE_CONT, "?%s%d is %s\n",
4772 		    ddi_driver_name(d), ddi_get_instance(d),
4773 		    ddi_pathname(d, b));
4774 		kmem_free(b, MAXPATHLEN);
4775 	}
4776 }
4777 
4778 /*
4779  * ddi_ctlops() is described in the assembler not to buy a new register
4780  * window when it's called and can reduce cost in climbing the device tree
4781  * without using the tail call optimization.
4782  */
4783 int
4784 ddi_dev_regsize(dev_info_t *dev, uint_t rnumber, off_t *result)
4785 {
4786 	int ret;
4787 
4788 	ret = ddi_ctlops(dev, dev, DDI_CTLOPS_REGSIZE,
4789 	    (void *)&rnumber, (void *)result);
4790 
4791 	return (ret == DDI_SUCCESS ? DDI_SUCCESS : DDI_FAILURE);
4792 }
4793 
4794 int
4795 ddi_dev_nregs(dev_info_t *dev, int *result)
4796 {
4797 	return (ddi_ctlops(dev, dev, DDI_CTLOPS_NREGS, 0, (void *)result));
4798 }
4799 
4800 int
4801 ddi_dev_is_sid(dev_info_t *d)
4802 {
4803 	return (ddi_ctlops(d, d, DDI_CTLOPS_SIDDEV, (void *)0, (void *)0));
4804 }
4805 
4806 int
4807 ddi_slaveonly(dev_info_t *d)
4808 {
4809 	return (ddi_ctlops(d, d, DDI_CTLOPS_SLAVEONLY, (void *)0, (void *)0));
4810 }
4811 
4812 int
4813 ddi_dev_affinity(dev_info_t *a, dev_info_t *b)
4814 {
4815 	return (ddi_ctlops(a, a, DDI_CTLOPS_AFFINITY, (void *)b, (void *)0));
4816 }
4817 
4818 int
4819 ddi_streams_driver(dev_info_t *dip)
4820 {
4821 	if (i_ddi_devi_attached(dip) &&
4822 	    (DEVI(dip)->devi_ops->devo_cb_ops != NULL) &&
4823 	    (DEVI(dip)->devi_ops->devo_cb_ops->cb_str != NULL))
4824 		return (DDI_SUCCESS);
4825 	return (DDI_FAILURE);
4826 }
4827 
4828 /*
4829  * callback free list
4830  */
4831 
4832 static int ncallbacks;
4833 static int nc_low = 170;
4834 static int nc_med = 512;
4835 static int nc_high = 2048;
4836 static struct ddi_callback *callbackq;
4837 static struct ddi_callback *callbackqfree;
4838 
4839 /*
4840  * set/run callback lists
4841  */
4842 struct	cbstats	{
4843 	kstat_named_t	cb_asked;
4844 	kstat_named_t	cb_new;
4845 	kstat_named_t	cb_run;
4846 	kstat_named_t	cb_delete;
4847 	kstat_named_t	cb_maxreq;
4848 	kstat_named_t	cb_maxlist;
4849 	kstat_named_t	cb_alloc;
4850 	kstat_named_t	cb_runouts;
4851 	kstat_named_t	cb_L2;
4852 	kstat_named_t	cb_grow;
4853 } cbstats = {
4854 	{"asked",	KSTAT_DATA_UINT32},
4855 	{"new",		KSTAT_DATA_UINT32},
4856 	{"run",		KSTAT_DATA_UINT32},
4857 	{"delete",	KSTAT_DATA_UINT32},
4858 	{"maxreq",	KSTAT_DATA_UINT32},
4859 	{"maxlist",	KSTAT_DATA_UINT32},
4860 	{"alloc",	KSTAT_DATA_UINT32},
4861 	{"runouts",	KSTAT_DATA_UINT32},
4862 	{"L2",		KSTAT_DATA_UINT32},
4863 	{"grow",	KSTAT_DATA_UINT32},
4864 };
4865 
4866 #define	nc_asked	cb_asked.value.ui32
4867 #define	nc_new		cb_new.value.ui32
4868 #define	nc_run		cb_run.value.ui32
4869 #define	nc_delete	cb_delete.value.ui32
4870 #define	nc_maxreq	cb_maxreq.value.ui32
4871 #define	nc_maxlist	cb_maxlist.value.ui32
4872 #define	nc_alloc	cb_alloc.value.ui32
4873 #define	nc_runouts	cb_runouts.value.ui32
4874 #define	nc_L2		cb_L2.value.ui32
4875 #define	nc_grow		cb_grow.value.ui32
4876 
4877 static kmutex_t ddi_callback_mutex;
4878 
4879 /*
4880  * callbacks are handled using a L1/L2 cache. The L1 cache
4881  * comes out of kmem_cache_alloc and can expand/shrink dynamically. If
4882  * we can't get callbacks from the L1 cache [because pageout is doing
4883  * I/O at the time freemem is 0], we allocate callbacks out of the
4884  * L2 cache. The L2 cache is static and depends on the memory size.
4885  * [We might also count the number of devices at probe time and
4886  * allocate one structure per device and adjust for deferred attach]
4887  */
4888 void
4889 impl_ddi_callback_init(void)
4890 {
4891 	int	i;
4892 	uint_t	physmegs;
4893 	kstat_t	*ksp;
4894 
4895 	physmegs = physmem >> (20 - PAGESHIFT);
4896 	if (physmegs < 48) {
4897 		ncallbacks = nc_low;
4898 	} else if (physmegs < 128) {
4899 		ncallbacks = nc_med;
4900 	} else {
4901 		ncallbacks = nc_high;
4902 	}
4903 
4904 	/*
4905 	 * init free list
4906 	 */
4907 	callbackq = kmem_zalloc(
4908 	    ncallbacks * sizeof (struct ddi_callback), KM_SLEEP);
4909 	for (i = 0; i < ncallbacks-1; i++)
4910 		callbackq[i].c_nfree = &callbackq[i+1];
4911 	callbackqfree = callbackq;
4912 
4913 	/* init kstats */
4914 	if (ksp = kstat_create("unix", 0, "cbstats", "misc", KSTAT_TYPE_NAMED,
4915 	    sizeof (cbstats) / sizeof (kstat_named_t), KSTAT_FLAG_VIRTUAL)) {
4916 		ksp->ks_data = (void *) &cbstats;
4917 		kstat_install(ksp);
4918 	}
4919 
4920 }
4921 
4922 static void
4923 callback_insert(int (*funcp)(caddr_t), caddr_t arg, uintptr_t *listid,
4924 	int count)
4925 {
4926 	struct ddi_callback *list, *marker, *new;
4927 	size_t size = sizeof (struct ddi_callback);
4928 
4929 	list = marker = (struct ddi_callback *)*listid;
4930 	while (list != NULL) {
4931 		if (list->c_call == funcp && list->c_arg == arg) {
4932 			list->c_count += count;
4933 			return;
4934 		}
4935 		marker = list;
4936 		list = list->c_nlist;
4937 	}
4938 	new = kmem_alloc(size, KM_NOSLEEP);
4939 	if (new == NULL) {
4940 		new = callbackqfree;
4941 		if (new == NULL) {
4942 			new = kmem_alloc_tryhard(sizeof (struct ddi_callback),
4943 			    &size, KM_NOSLEEP | KM_PANIC);
4944 			cbstats.nc_grow++;
4945 		} else {
4946 			callbackqfree = new->c_nfree;
4947 			cbstats.nc_L2++;
4948 		}
4949 	}
4950 	if (marker != NULL) {
4951 		marker->c_nlist = new;
4952 	} else {
4953 		*listid = (uintptr_t)new;
4954 	}
4955 	new->c_size = size;
4956 	new->c_nlist = NULL;
4957 	new->c_call = funcp;
4958 	new->c_arg = arg;
4959 	new->c_count = count;
4960 	cbstats.nc_new++;
4961 	cbstats.nc_alloc++;
4962 	if (cbstats.nc_alloc > cbstats.nc_maxlist)
4963 		cbstats.nc_maxlist = cbstats.nc_alloc;
4964 }
4965 
4966 void
4967 ddi_set_callback(int (*funcp)(caddr_t), caddr_t arg, uintptr_t *listid)
4968 {
4969 	mutex_enter(&ddi_callback_mutex);
4970 	cbstats.nc_asked++;
4971 	if ((cbstats.nc_asked - cbstats.nc_run) > cbstats.nc_maxreq)
4972 		cbstats.nc_maxreq = (cbstats.nc_asked - cbstats.nc_run);
4973 	(void) callback_insert(funcp, arg, listid, 1);
4974 	mutex_exit(&ddi_callback_mutex);
4975 }
4976 
4977 static void
4978 real_callback_run(void *Queue)
4979 {
4980 	int (*funcp)(caddr_t);
4981 	caddr_t arg;
4982 	int count, rval;
4983 	uintptr_t *listid;
4984 	struct ddi_callback *list, *marker;
4985 	int check_pending = 1;
4986 	int pending = 0;
4987 
4988 	do {
4989 		mutex_enter(&ddi_callback_mutex);
4990 		listid = Queue;
4991 		list = (struct ddi_callback *)*listid;
4992 		if (list == NULL) {
4993 			mutex_exit(&ddi_callback_mutex);
4994 			return;
4995 		}
4996 		if (check_pending) {
4997 			marker = list;
4998 			while (marker != NULL) {
4999 				pending += marker->c_count;
5000 				marker = marker->c_nlist;
5001 			}
5002 			check_pending = 0;
5003 		}
5004 		ASSERT(pending > 0);
5005 		ASSERT(list->c_count > 0);
5006 		funcp = list->c_call;
5007 		arg = list->c_arg;
5008 		count = list->c_count;
5009 		*(uintptr_t *)Queue = (uintptr_t)list->c_nlist;
5010 		if (list >= &callbackq[0] &&
5011 		    list <= &callbackq[ncallbacks-1]) {
5012 			list->c_nfree = callbackqfree;
5013 			callbackqfree = list;
5014 		} else
5015 			kmem_free(list, list->c_size);
5016 
5017 		cbstats.nc_delete++;
5018 		cbstats.nc_alloc--;
5019 		mutex_exit(&ddi_callback_mutex);
5020 
5021 		do {
5022 			if ((rval = (*funcp)(arg)) == 0) {
5023 				pending -= count;
5024 				mutex_enter(&ddi_callback_mutex);
5025 				(void) callback_insert(funcp, arg, listid,
5026 				    count);
5027 				cbstats.nc_runouts++;
5028 			} else {
5029 				pending--;
5030 				mutex_enter(&ddi_callback_mutex);
5031 				cbstats.nc_run++;
5032 			}
5033 			mutex_exit(&ddi_callback_mutex);
5034 		} while (rval != 0 && (--count > 0));
5035 	} while (pending > 0);
5036 }
5037 
5038 void
5039 ddi_run_callback(uintptr_t *listid)
5040 {
5041 	softcall(real_callback_run, listid);
5042 }
5043 
5044 /*
5045  * ddi_periodic_t
5046  * ddi_periodic_add(void (*func)(void *), void *arg, hrtime_t interval,
5047  *     int level)
5048  *
5049  * INTERFACE LEVEL
5050  *      Solaris DDI specific (Solaris DDI)
5051  *
5052  * PARAMETERS
5053  *      func: the callback function
5054  *
5055  *            The callback function will be invoked. The function is invoked
5056  *            in kernel context if the argument level passed is the zero.
5057  *            Otherwise it's invoked in interrupt context at the specified
5058  *            level.
5059  *
5060  *       arg: the argument passed to the callback function
5061  *
5062  *  interval: interval time
5063  *
5064  *    level : callback interrupt level
5065  *
5066  *            If the value is the zero, the callback function is invoked
5067  *            in kernel context. If the value is more than the zero, but
5068  *            less than or equal to ten, the callback function is invoked in
5069  *            interrupt context at the specified interrupt level, which may
5070  *            be used for real time applications.
5071  *
5072  *            This value must be in range of 0-10, which can be a numeric
5073  *            number or a pre-defined macro (DDI_IPL_0, ... , DDI_IPL_10).
5074  *
5075  * DESCRIPTION
5076  *      ddi_periodic_add(9F) schedules the specified function to be
5077  *      periodically invoked in the interval time.
5078  *
5079  *      As well as timeout(9F), the exact time interval over which the function
5080  *      takes effect cannot be guaranteed, but the value given is a close
5081  *      approximation.
5082  *
5083  *      Drivers waiting on behalf of processes with real-time constraints must
5084  *      pass non-zero value with the level argument to ddi_periodic_add(9F).
5085  *
5086  * RETURN VALUES
5087  *      ddi_periodic_add(9F) returns a non-zero opaque value (ddi_periodic_t),
5088  *      which must be used for ddi_periodic_delete(9F) to specify the request.
5089  *
5090  * CONTEXT
5091  *      ddi_periodic_add(9F) can be called in user or kernel context, but
5092  *      it cannot be called in interrupt context, which is different from
5093  *      timeout(9F).
5094  */
5095 ddi_periodic_t
5096 ddi_periodic_add(void (*func)(void *), void *arg, hrtime_t interval, int level)
5097 {
5098 	/*
5099 	 * Sanity check of the argument level.
5100 	 */
5101 	if (level < DDI_IPL_0 || level > DDI_IPL_10)
5102 		cmn_err(CE_PANIC,
5103 		    "ddi_periodic_add: invalid interrupt level (%d).", level);
5104 
5105 	/*
5106 	 * Sanity check of the context. ddi_periodic_add() cannot be
5107 	 * called in either interrupt context or high interrupt context.
5108 	 */
5109 	if (servicing_interrupt())
5110 		cmn_err(CE_PANIC,
5111 		    "ddi_periodic_add: called in (high) interrupt context.");
5112 
5113 	return ((ddi_periodic_t)i_timeout(func, arg, interval, level));
5114 }
5115 
5116 /*
5117  * void
5118  * ddi_periodic_delete(ddi_periodic_t req)
5119  *
5120  * INTERFACE LEVEL
5121  *     Solaris DDI specific (Solaris DDI)
5122  *
5123  * PARAMETERS
5124  *     req: ddi_periodic_t opaque value ddi_periodic_add(9F) returned
5125  *     previously.
5126  *
5127  * DESCRIPTION
5128  *     ddi_periodic_delete(9F) cancels the ddi_periodic_add(9F) request
5129  *     previously requested.
5130  *
5131  *     ddi_periodic_delete(9F) will not return until the pending request
5132  *     is canceled or executed.
5133  *
5134  *     As well as untimeout(9F), calling ddi_periodic_delete(9F) for a
5135  *     timeout which is either running on another CPU, or has already
5136  *     completed causes no problems. However, unlike untimeout(9F), there is
5137  *     no restrictions on the lock which might be held across the call to
5138  *     ddi_periodic_delete(9F).
5139  *
5140  *     Drivers should be structured with the understanding that the arrival of
5141  *     both an interrupt and a timeout for that interrupt can occasionally
5142  *     occur, in either order.
5143  *
5144  * CONTEXT
5145  *     ddi_periodic_delete(9F) can be called in user or kernel context, but
5146  *     it cannot be called in interrupt context, which is different from
5147  *     untimeout(9F).
5148  */
5149 void
5150 ddi_periodic_delete(ddi_periodic_t req)
5151 {
5152 	/*
5153 	 * Sanity check of the context. ddi_periodic_delete() cannot be
5154 	 * called in either interrupt context or high interrupt context.
5155 	 */
5156 	if (servicing_interrupt())
5157 		cmn_err(CE_PANIC,
5158 		    "ddi_periodic_delete: called in (high) interrupt context.");
5159 
5160 	i_untimeout((timeout_t)req);
5161 }
5162 
5163 dev_info_t *
5164 nodevinfo(dev_t dev, int otyp)
5165 {
5166 	_NOTE(ARGUNUSED(dev, otyp))
5167 	return ((dev_info_t *)0);
5168 }
5169 
5170 /*
5171  * A driver should support its own getinfo(9E) entry point. This function
5172  * is provided as a convenience for ON drivers that don't expect their
5173  * getinfo(9E) entry point to be called. A driver that uses this must not
5174  * call ddi_create_minor_node.
5175  */
5176 int
5177 ddi_no_info(dev_info_t *dip, ddi_info_cmd_t infocmd, void *arg, void **result)
5178 {
5179 	_NOTE(ARGUNUSED(dip, infocmd, arg, result))
5180 	return (DDI_FAILURE);
5181 }
5182 
5183 /*
5184  * A driver should support its own getinfo(9E) entry point. This function
5185  * is provided as a convenience for ON drivers that where the minor number
5186  * is the instance. Drivers that do not have 1:1 mapping must implement
5187  * their own getinfo(9E) function.
5188  */
5189 int
5190 ddi_getinfo_1to1(dev_info_t *dip, ddi_info_cmd_t infocmd,
5191     void *arg, void **result)
5192 {
5193 	_NOTE(ARGUNUSED(dip))
5194 	int	instance;
5195 
5196 	if (infocmd != DDI_INFO_DEVT2INSTANCE)
5197 		return (DDI_FAILURE);
5198 
5199 	instance = getminor((dev_t)(uintptr_t)arg);
5200 	*result = (void *)(uintptr_t)instance;
5201 	return (DDI_SUCCESS);
5202 }
5203 
5204 int
5205 ddifail(dev_info_t *devi, ddi_attach_cmd_t cmd)
5206 {
5207 	_NOTE(ARGUNUSED(devi, cmd))
5208 	return (DDI_FAILURE);
5209 }
5210 
5211 int
5212 ddi_no_dma_map(dev_info_t *dip, dev_info_t *rdip,
5213     struct ddi_dma_req *dmareqp, ddi_dma_handle_t *handlep)
5214 {
5215 	_NOTE(ARGUNUSED(dip, rdip, dmareqp, handlep))
5216 	return (DDI_DMA_NOMAPPING);
5217 }
5218 
5219 int
5220 ddi_no_dma_allochdl(dev_info_t *dip, dev_info_t *rdip, ddi_dma_attr_t *attr,
5221     int (*waitfp)(caddr_t), caddr_t arg, ddi_dma_handle_t *handlep)
5222 {
5223 	_NOTE(ARGUNUSED(dip, rdip, attr, waitfp, arg, handlep))
5224 	return (DDI_DMA_BADATTR);
5225 }
5226 
5227 int
5228 ddi_no_dma_freehdl(dev_info_t *dip, dev_info_t *rdip,
5229     ddi_dma_handle_t handle)
5230 {
5231 	_NOTE(ARGUNUSED(dip, rdip, handle))
5232 	return (DDI_FAILURE);
5233 }
5234 
5235 int
5236 ddi_no_dma_bindhdl(dev_info_t *dip, dev_info_t *rdip,
5237     ddi_dma_handle_t handle, struct ddi_dma_req *dmareq,
5238     ddi_dma_cookie_t *cp, uint_t *ccountp)
5239 {
5240 	_NOTE(ARGUNUSED(dip, rdip, handle, dmareq, cp, ccountp))
5241 	return (DDI_DMA_NOMAPPING);
5242 }
5243 
5244 int
5245 ddi_no_dma_unbindhdl(dev_info_t *dip, dev_info_t *rdip,
5246     ddi_dma_handle_t handle)
5247 {
5248 	_NOTE(ARGUNUSED(dip, rdip, handle))
5249 	return (DDI_FAILURE);
5250 }
5251 
5252 int
5253 ddi_no_dma_flush(dev_info_t *dip, dev_info_t *rdip,
5254     ddi_dma_handle_t handle, off_t off, size_t len,
5255     uint_t cache_flags)
5256 {
5257 	_NOTE(ARGUNUSED(dip, rdip, handle, off, len, cache_flags))
5258 	return (DDI_FAILURE);
5259 }
5260 
5261 int
5262 ddi_no_dma_win(dev_info_t *dip, dev_info_t *rdip,
5263     ddi_dma_handle_t handle, uint_t win, off_t *offp,
5264     size_t *lenp, ddi_dma_cookie_t *cookiep, uint_t *ccountp)
5265 {
5266 	_NOTE(ARGUNUSED(dip, rdip, handle, win, offp, lenp, cookiep, ccountp))
5267 	return (DDI_FAILURE);
5268 }
5269 
5270 int
5271 ddi_no_dma_mctl(dev_info_t *dip, dev_info_t *rdip,
5272     ddi_dma_handle_t handle, enum ddi_dma_ctlops request,
5273     off_t *offp, size_t *lenp, caddr_t *objp, uint_t flags)
5274 {
5275 	_NOTE(ARGUNUSED(dip, rdip, handle, request, offp, lenp, objp, flags))
5276 	return (DDI_FAILURE);
5277 }
5278 
5279 void
5280 ddivoid(void)
5281 {}
5282 
5283 int
5284 nochpoll(dev_t dev, short events, int anyyet, short *reventsp,
5285     struct pollhead **pollhdrp)
5286 {
5287 	_NOTE(ARGUNUSED(dev, events, anyyet, reventsp, pollhdrp))
5288 	return (ENXIO);
5289 }
5290 
5291 cred_t *
5292 ddi_get_cred(void)
5293 {
5294 	return (CRED());
5295 }
5296 
5297 clock_t
5298 ddi_get_lbolt(void)
5299 {
5300 	return ((clock_t)lbolt_hybrid());
5301 }
5302 
5303 int64_t
5304 ddi_get_lbolt64(void)
5305 {
5306 	return (lbolt_hybrid());
5307 }
5308 
5309 time_t
5310 ddi_get_time(void)
5311 {
5312 	time_t	now;
5313 
5314 	if ((now = gethrestime_sec()) == 0) {
5315 		timestruc_t ts;
5316 		mutex_enter(&tod_lock);
5317 		ts = tod_get();
5318 		mutex_exit(&tod_lock);
5319 		return (ts.tv_sec);
5320 	} else {
5321 		return (now);
5322 	}
5323 }
5324 
5325 pid_t
5326 ddi_get_pid(void)
5327 {
5328 	return (ttoproc(curthread)->p_pid);
5329 }
5330 
5331 kt_did_t
5332 ddi_get_kt_did(void)
5333 {
5334 	return (curthread->t_did);
5335 }
5336 
5337 /*
5338  * This function returns B_TRUE if the caller can reasonably expect that a call
5339  * to cv_wait_sig(9F), cv_timedwait_sig(9F), or qwait_sig(9F) could be awakened
5340  * by user-level signal.  If it returns B_FALSE, then the caller should use
5341  * other means to make certain that the wait will not hang "forever."
5342  *
5343  * It does not check the signal mask, nor for reception of any particular
5344  * signal.
5345  *
5346  * Currently, a thread can receive a signal if it's not a kernel thread and it
5347  * is not in the middle of exit(2) tear-down.  Threads that are in that
5348  * tear-down effectively convert cv_wait_sig to cv_wait, cv_timedwait_sig to
5349  * cv_timedwait, and qwait_sig to qwait.
5350  */
5351 boolean_t
5352 ddi_can_receive_sig(void)
5353 {
5354 	proc_t *pp;
5355 
5356 	if (curthread->t_proc_flag & TP_LWPEXIT)
5357 		return (B_FALSE);
5358 	if ((pp = ttoproc(curthread)) == NULL)
5359 		return (B_FALSE);
5360 	return (pp->p_as != &kas);
5361 }
5362 
5363 /*
5364  * Swap bytes in 16-bit [half-]words
5365  */
5366 void
5367 swab(void *src, void *dst, size_t nbytes)
5368 {
5369 	uchar_t *pf = (uchar_t *)src;
5370 	uchar_t *pt = (uchar_t *)dst;
5371 	uchar_t tmp;
5372 	int nshorts;
5373 
5374 	nshorts = nbytes >> 1;
5375 
5376 	while (--nshorts >= 0) {
5377 		tmp = *pf++;
5378 		*pt++ = *pf++;
5379 		*pt++ = tmp;
5380 	}
5381 }
5382 
5383 static void
5384 ddi_append_minor_node(dev_info_t *ddip, struct ddi_minor_data *dmdp)
5385 {
5386 	int			circ;
5387 	struct ddi_minor_data	*dp;
5388 
5389 	ndi_devi_enter(ddip, &circ);
5390 	if ((dp = DEVI(ddip)->devi_minor) == (struct ddi_minor_data *)NULL) {
5391 		DEVI(ddip)->devi_minor = dmdp;
5392 	} else {
5393 		while (dp->next != (struct ddi_minor_data *)NULL)
5394 			dp = dp->next;
5395 		dp->next = dmdp;
5396 	}
5397 	ndi_devi_exit(ddip, circ);
5398 }
5399 
5400 /*
5401  * Part of the obsolete SunCluster DDI Hooks.
5402  * Keep for binary compatibility
5403  */
5404 minor_t
5405 ddi_getiminor(dev_t dev)
5406 {
5407 	return (getminor(dev));
5408 }
5409 
5410 static int
5411 i_log_devfs_minor_create(dev_info_t *dip, char *minor_name)
5412 {
5413 	int se_flag;
5414 	int kmem_flag;
5415 	int se_err;
5416 	char *pathname, *class_name;
5417 	sysevent_t *ev = NULL;
5418 	sysevent_id_t eid;
5419 	sysevent_value_t se_val;
5420 	sysevent_attr_list_t *ev_attr_list = NULL;
5421 
5422 	/* determine interrupt context */
5423 	se_flag = (servicing_interrupt()) ? SE_NOSLEEP : SE_SLEEP;
5424 	kmem_flag = (se_flag == SE_SLEEP) ? KM_SLEEP : KM_NOSLEEP;
5425 
5426 	i_ddi_di_cache_invalidate();
5427 
5428 #ifdef DEBUG
5429 	if ((se_flag == SE_NOSLEEP) && sunddi_debug) {
5430 		cmn_err(CE_CONT, "ddi_create_minor_node: called from "
5431 		    "interrupt level by driver %s",
5432 		    ddi_driver_name(dip));
5433 	}
5434 #endif /* DEBUG */
5435 
5436 	ev = sysevent_alloc(EC_DEVFS, ESC_DEVFS_MINOR_CREATE, EP_DDI, se_flag);
5437 	if (ev == NULL) {
5438 		goto fail;
5439 	}
5440 
5441 	pathname = kmem_alloc(MAXPATHLEN, kmem_flag);
5442 	if (pathname == NULL) {
5443 		sysevent_free(ev);
5444 		goto fail;
5445 	}
5446 
5447 	(void) ddi_pathname(dip, pathname);
5448 	ASSERT(strlen(pathname));
5449 	se_val.value_type = SE_DATA_TYPE_STRING;
5450 	se_val.value.sv_string = pathname;
5451 	if (sysevent_add_attr(&ev_attr_list, DEVFS_PATHNAME,
5452 	    &se_val, se_flag) != 0) {
5453 		kmem_free(pathname, MAXPATHLEN);
5454 		sysevent_free(ev);
5455 		goto fail;
5456 	}
5457 	kmem_free(pathname, MAXPATHLEN);
5458 
5459 	/* add the device class attribute */
5460 	if ((class_name = i_ddi_devi_class(dip)) != NULL) {
5461 		se_val.value_type = SE_DATA_TYPE_STRING;
5462 		se_val.value.sv_string = class_name;
5463 		if (sysevent_add_attr(&ev_attr_list,
5464 		    DEVFS_DEVI_CLASS, &se_val, SE_SLEEP) != 0) {
5465 			sysevent_free_attr(ev_attr_list);
5466 			goto fail;
5467 		}
5468 	}
5469 
5470 	/*
5471 	 * allow for NULL minor names
5472 	 */
5473 	if (minor_name != NULL) {
5474 		se_val.value.sv_string = minor_name;
5475 		if (sysevent_add_attr(&ev_attr_list, DEVFS_MINOR_NAME,
5476 		    &se_val, se_flag) != 0) {
5477 			sysevent_free_attr(ev_attr_list);
5478 			sysevent_free(ev);
5479 			goto fail;
5480 		}
5481 	}
5482 
5483 	if (sysevent_attach_attributes(ev, ev_attr_list) != 0) {
5484 		sysevent_free_attr(ev_attr_list);
5485 		sysevent_free(ev);
5486 		goto fail;
5487 	}
5488 
5489 	if ((se_err = log_sysevent(ev, se_flag, &eid)) != 0) {
5490 		if (se_err == SE_NO_TRANSPORT) {
5491 			cmn_err(CE_WARN, "/devices or /dev may not be current "
5492 			    "for driver %s (%s). Run devfsadm -i %s",
5493 			    ddi_driver_name(dip), "syseventd not responding",
5494 			    ddi_driver_name(dip));
5495 		} else {
5496 			sysevent_free(ev);
5497 			goto fail;
5498 		}
5499 	}
5500 
5501 	sysevent_free(ev);
5502 	return (DDI_SUCCESS);
5503 fail:
5504 	cmn_err(CE_WARN, "/devices or /dev may not be current "
5505 	    "for driver %s. Run devfsadm -i %s",
5506 	    ddi_driver_name(dip), ddi_driver_name(dip));
5507 	return (DDI_SUCCESS);
5508 }
5509 
5510 /*
5511  * failing to remove a minor node is not of interest
5512  * therefore we do not generate an error message
5513  */
5514 static int
5515 i_log_devfs_minor_remove(dev_info_t *dip, char *minor_name)
5516 {
5517 	char *pathname, *class_name;
5518 	sysevent_t *ev;
5519 	sysevent_id_t eid;
5520 	sysevent_value_t se_val;
5521 	sysevent_attr_list_t *ev_attr_list = NULL;
5522 
5523 	/*
5524 	 * only log ddi_remove_minor_node() calls outside the scope
5525 	 * of attach/detach reconfigurations and when the dip is
5526 	 * still initialized.
5527 	 */
5528 	if (DEVI_IS_ATTACHING(dip) || DEVI_IS_DETACHING(dip) ||
5529 	    (i_ddi_node_state(dip) < DS_INITIALIZED)) {
5530 		return (DDI_SUCCESS);
5531 	}
5532 
5533 	i_ddi_di_cache_invalidate();
5534 
5535 	ev = sysevent_alloc(EC_DEVFS, ESC_DEVFS_MINOR_REMOVE, EP_DDI, SE_SLEEP);
5536 	if (ev == NULL) {
5537 		return (DDI_SUCCESS);
5538 	}
5539 
5540 	pathname = kmem_alloc(MAXPATHLEN, KM_SLEEP);
5541 	if (pathname == NULL) {
5542 		sysevent_free(ev);
5543 		return (DDI_SUCCESS);
5544 	}
5545 
5546 	(void) ddi_pathname(dip, pathname);
5547 	ASSERT(strlen(pathname));
5548 	se_val.value_type = SE_DATA_TYPE_STRING;
5549 	se_val.value.sv_string = pathname;
5550 	if (sysevent_add_attr(&ev_attr_list, DEVFS_PATHNAME,
5551 	    &se_val, SE_SLEEP) != 0) {
5552 		kmem_free(pathname, MAXPATHLEN);
5553 		sysevent_free(ev);
5554 		return (DDI_SUCCESS);
5555 	}
5556 
5557 	kmem_free(pathname, MAXPATHLEN);
5558 
5559 	/*
5560 	 * allow for NULL minor names
5561 	 */
5562 	if (minor_name != NULL) {
5563 		se_val.value.sv_string = minor_name;
5564 		if (sysevent_add_attr(&ev_attr_list, DEVFS_MINOR_NAME,
5565 		    &se_val, SE_SLEEP) != 0) {
5566 			sysevent_free_attr(ev_attr_list);
5567 			goto fail;
5568 		}
5569 	}
5570 
5571 	if ((class_name = i_ddi_devi_class(dip)) != NULL) {
5572 		/* add the device class, driver name and instance attributes */
5573 
5574 		se_val.value_type = SE_DATA_TYPE_STRING;
5575 		se_val.value.sv_string = class_name;
5576 		if (sysevent_add_attr(&ev_attr_list,
5577 		    DEVFS_DEVI_CLASS, &se_val, SE_SLEEP) != 0) {
5578 			sysevent_free_attr(ev_attr_list);
5579 			goto fail;
5580 		}
5581 
5582 		se_val.value_type = SE_DATA_TYPE_STRING;
5583 		se_val.value.sv_string = (char *)ddi_driver_name(dip);
5584 		if (sysevent_add_attr(&ev_attr_list,
5585 		    DEVFS_DRIVER_NAME, &se_val, SE_SLEEP) != 0) {
5586 			sysevent_free_attr(ev_attr_list);
5587 			goto fail;
5588 		}
5589 
5590 		se_val.value_type = SE_DATA_TYPE_INT32;
5591 		se_val.value.sv_int32 = ddi_get_instance(dip);
5592 		if (sysevent_add_attr(&ev_attr_list,
5593 		    DEVFS_INSTANCE, &se_val, SE_SLEEP) != 0) {
5594 			sysevent_free_attr(ev_attr_list);
5595 			goto fail;
5596 		}
5597 
5598 	}
5599 
5600 	if (sysevent_attach_attributes(ev, ev_attr_list) != 0) {
5601 		sysevent_free_attr(ev_attr_list);
5602 	} else {
5603 		(void) log_sysevent(ev, SE_SLEEP, &eid);
5604 	}
5605 fail:
5606 	sysevent_free(ev);
5607 	return (DDI_SUCCESS);
5608 }
5609 
5610 /*
5611  * Derive the device class of the node.
5612  * Device class names aren't defined yet. Until this is done we use
5613  * devfs event subclass names as device class names.
5614  */
5615 static int
5616 derive_devi_class(dev_info_t *dip, char *node_type, int flag)
5617 {
5618 	int rv = DDI_SUCCESS;
5619 
5620 	if (i_ddi_devi_class(dip) == NULL) {
5621 		if (strncmp(node_type, DDI_NT_BLOCK,
5622 		    sizeof (DDI_NT_BLOCK) - 1) == 0 &&
5623 		    (node_type[sizeof (DDI_NT_BLOCK) - 1] == '\0' ||
5624 		    node_type[sizeof (DDI_NT_BLOCK) - 1] == ':') &&
5625 		    strcmp(node_type, DDI_NT_FD) != 0) {
5626 
5627 			rv = i_ddi_set_devi_class(dip, ESC_DISK, flag);
5628 
5629 		} else if (strncmp(node_type, DDI_NT_NET,
5630 		    sizeof (DDI_NT_NET) - 1) == 0 &&
5631 		    (node_type[sizeof (DDI_NT_NET) - 1] == '\0' ||
5632 		    node_type[sizeof (DDI_NT_NET) - 1] == ':')) {
5633 
5634 			rv = i_ddi_set_devi_class(dip, ESC_NETWORK, flag);
5635 
5636 		} else if (strncmp(node_type, DDI_NT_PRINTER,
5637 		    sizeof (DDI_NT_PRINTER) - 1) == 0 &&
5638 		    (node_type[sizeof (DDI_NT_PRINTER) - 1] == '\0' ||
5639 		    node_type[sizeof (DDI_NT_PRINTER) - 1] == ':')) {
5640 
5641 			rv = i_ddi_set_devi_class(dip, ESC_PRINTER, flag);
5642 
5643 		} else if (strncmp(node_type, DDI_PSEUDO,
5644 		    sizeof (DDI_PSEUDO) -1) == 0 &&
5645 		    (strncmp(ESC_LOFI, ddi_node_name(dip),
5646 		    sizeof (ESC_LOFI) -1) == 0)) {
5647 			rv = i_ddi_set_devi_class(dip, ESC_LOFI, flag);
5648 		}
5649 	}
5650 
5651 	return (rv);
5652 }
5653 
5654 /*
5655  * Check compliance with PSARC 2003/375:
5656  *
5657  * The name must contain only characters a-z, A-Z, 0-9 or _ and it must not
5658  * exceed IFNAMSIZ (16) characters in length.
5659  */
5660 static boolean_t
5661 verify_name(char *name)
5662 {
5663 	size_t	len = strlen(name);
5664 	char	*cp;
5665 
5666 	if (len == 0 || len > IFNAMSIZ)
5667 		return (B_FALSE);
5668 
5669 	for (cp = name; *cp != '\0'; cp++) {
5670 		if (!isalnum(*cp) && *cp != '_')
5671 			return (B_FALSE);
5672 	}
5673 
5674 	return (B_TRUE);
5675 }
5676 
5677 /*
5678  * ddi_create_minor_common:	Create a  ddi_minor_data structure and
5679  *				attach it to the given devinfo node.
5680  */
5681 
5682 int
5683 ddi_create_minor_common(dev_info_t *dip, char *name, int spec_type,
5684     minor_t minor_num, char *node_type, int flag, ddi_minor_type mtype,
5685     const char *read_priv, const char *write_priv, mode_t priv_mode)
5686 {
5687 	struct ddi_minor_data *dmdp;
5688 	major_t major;
5689 
5690 	if (spec_type != S_IFCHR && spec_type != S_IFBLK)
5691 		return (DDI_FAILURE);
5692 
5693 	if (name == NULL)
5694 		return (DDI_FAILURE);
5695 
5696 	/*
5697 	 * Log a message if the minor number the driver is creating
5698 	 * is not expressible on the on-disk filesystem (currently
5699 	 * this is limited to 18 bits both by UFS). The device can
5700 	 * be opened via devfs, but not by device special files created
5701 	 * via mknod().
5702 	 */
5703 	if (minor_num > L_MAXMIN32) {
5704 		cmn_err(CE_WARN,
5705 		    "%s%d:%s minor 0x%x too big for 32-bit applications",
5706 		    ddi_driver_name(dip), ddi_get_instance(dip),
5707 		    name, minor_num);
5708 		return (DDI_FAILURE);
5709 	}
5710 
5711 	/* dip must be bound and attached */
5712 	major = ddi_driver_major(dip);
5713 	ASSERT(major != DDI_MAJOR_T_NONE);
5714 
5715 	/*
5716 	 * Default node_type to DDI_PSEUDO and issue notice in debug mode
5717 	 */
5718 	if (node_type == NULL) {
5719 		node_type = DDI_PSEUDO;
5720 		NDI_CONFIG_DEBUG((CE_NOTE, "!illegal node_type NULL for %s%d "
5721 		    " minor node %s; default to DDI_PSEUDO",
5722 		    ddi_driver_name(dip), ddi_get_instance(dip), name));
5723 	}
5724 
5725 	/*
5726 	 * If the driver is a network driver, ensure that the name falls within
5727 	 * the interface naming constraints specified by PSARC/2003/375.
5728 	 */
5729 	if (strcmp(node_type, DDI_NT_NET) == 0) {
5730 		if (!verify_name(name))
5731 			return (DDI_FAILURE);
5732 
5733 		if (mtype == DDM_MINOR) {
5734 			struct devnames *dnp = &devnamesp[major];
5735 
5736 			/* Mark driver as a network driver */
5737 			LOCK_DEV_OPS(&dnp->dn_lock);
5738 			dnp->dn_flags |= DN_NETWORK_DRIVER;
5739 
5740 			/*
5741 			 * If this minor node is created during the device
5742 			 * attachment, this is a physical network device.
5743 			 * Mark the driver as a physical network driver.
5744 			 */
5745 			if (DEVI_IS_ATTACHING(dip))
5746 				dnp->dn_flags |= DN_NETWORK_PHYSDRIVER;
5747 			UNLOCK_DEV_OPS(&dnp->dn_lock);
5748 		}
5749 	}
5750 
5751 	if (mtype == DDM_MINOR) {
5752 		if (derive_devi_class(dip,  node_type, KM_NOSLEEP) !=
5753 		    DDI_SUCCESS)
5754 			return (DDI_FAILURE);
5755 	}
5756 
5757 	/*
5758 	 * Take care of minor number information for the node.
5759 	 */
5760 
5761 	if ((dmdp = kmem_zalloc(sizeof (struct ddi_minor_data),
5762 	    KM_NOSLEEP)) == NULL) {
5763 		return (DDI_FAILURE);
5764 	}
5765 	if ((dmdp->ddm_name = i_ddi_strdup(name, KM_NOSLEEP)) == NULL) {
5766 		kmem_free(dmdp, sizeof (struct ddi_minor_data));
5767 		return (DDI_FAILURE);
5768 	}
5769 	dmdp->dip = dip;
5770 	dmdp->ddm_dev = makedevice(major, minor_num);
5771 	dmdp->ddm_spec_type = spec_type;
5772 	dmdp->ddm_node_type = node_type;
5773 	dmdp->type = mtype;
5774 	if (flag & CLONE_DEV) {
5775 		dmdp->type = DDM_ALIAS;
5776 		dmdp->ddm_dev = makedevice(ddi_driver_major(clone_dip), major);
5777 	}
5778 	if (flag & PRIVONLY_DEV) {
5779 		dmdp->ddm_flags |= DM_NO_FSPERM;
5780 	}
5781 	if (read_priv || write_priv) {
5782 		dmdp->ddm_node_priv =
5783 		    devpolicy_priv_by_name(read_priv, write_priv);
5784 	}
5785 	dmdp->ddm_priv_mode = priv_mode;
5786 
5787 	ddi_append_minor_node(dip, dmdp);
5788 
5789 	/*
5790 	 * only log ddi_create_minor_node() calls which occur
5791 	 * outside the scope of attach(9e)/detach(9e) reconfigurations
5792 	 */
5793 	if (!(DEVI_IS_ATTACHING(dip) || DEVI_IS_DETACHING(dip)) &&
5794 	    mtype != DDM_INTERNAL_PATH) {
5795 		(void) i_log_devfs_minor_create(dip, name);
5796 	}
5797 
5798 	/*
5799 	 * Check if any dacf rules match the creation of this minor node
5800 	 */
5801 	dacfc_match_create_minor(name, node_type, dip, dmdp, flag);
5802 	return (DDI_SUCCESS);
5803 }
5804 
5805 int
5806 ddi_create_minor_node(dev_info_t *dip, char *name, int spec_type,
5807     minor_t minor_num, char *node_type, int flag)
5808 {
5809 	return (ddi_create_minor_common(dip, name, spec_type, minor_num,
5810 	    node_type, flag, DDM_MINOR, NULL, NULL, 0));
5811 }
5812 
5813 int
5814 ddi_create_priv_minor_node(dev_info_t *dip, char *name, int spec_type,
5815     minor_t minor_num, char *node_type, int flag,
5816     const char *rdpriv, const char *wrpriv, mode_t priv_mode)
5817 {
5818 	return (ddi_create_minor_common(dip, name, spec_type, minor_num,
5819 	    node_type, flag, DDM_MINOR, rdpriv, wrpriv, priv_mode));
5820 }
5821 
5822 int
5823 ddi_create_default_minor_node(dev_info_t *dip, char *name, int spec_type,
5824     minor_t minor_num, char *node_type, int flag)
5825 {
5826 	return (ddi_create_minor_common(dip, name, spec_type, minor_num,
5827 	    node_type, flag, DDM_DEFAULT, NULL, NULL, 0));
5828 }
5829 
5830 /*
5831  * Internal (non-ddi) routine for drivers to export names known
5832  * to the kernel (especially ddi_pathname_to_dev_t and friends)
5833  * but not exported externally to /dev
5834  */
5835 int
5836 ddi_create_internal_pathname(dev_info_t *dip, char *name, int spec_type,
5837     minor_t minor_num)
5838 {
5839 	return (ddi_create_minor_common(dip, name, spec_type, minor_num,
5840 	    "internal", 0, DDM_INTERNAL_PATH, NULL, NULL, 0));
5841 }
5842 
5843 void
5844 ddi_remove_minor_node(dev_info_t *dip, char *name)
5845 {
5846 	int			circ;
5847 	struct ddi_minor_data	*dmdp, *dmdp1;
5848 	struct ddi_minor_data	**dmdp_prev;
5849 
5850 	ndi_devi_enter(dip, &circ);
5851 	dmdp_prev = &DEVI(dip)->devi_minor;
5852 	dmdp = DEVI(dip)->devi_minor;
5853 	while (dmdp != NULL) {
5854 		dmdp1 = dmdp->next;
5855 		if ((name == NULL || (dmdp->ddm_name != NULL &&
5856 		    strcmp(name, dmdp->ddm_name) == 0))) {
5857 			if (dmdp->ddm_name != NULL) {
5858 				if (dmdp->type != DDM_INTERNAL_PATH)
5859 					(void) i_log_devfs_minor_remove(dip,
5860 					    dmdp->ddm_name);
5861 				kmem_free(dmdp->ddm_name,
5862 				    strlen(dmdp->ddm_name) + 1);
5863 			}
5864 			/*
5865 			 * Release device privilege, if any.
5866 			 * Release dacf client data associated with this minor
5867 			 * node by storing NULL.
5868 			 */
5869 			if (dmdp->ddm_node_priv)
5870 				dpfree(dmdp->ddm_node_priv);
5871 			dacf_store_info((dacf_infohdl_t)dmdp, NULL);
5872 			kmem_free(dmdp, sizeof (struct ddi_minor_data));
5873 			*dmdp_prev = dmdp1;
5874 			/*
5875 			 * OK, we found it, so get out now -- if we drive on,
5876 			 * we will strcmp against garbage.  See 1139209.
5877 			 */
5878 			if (name != NULL)
5879 				break;
5880 		} else {
5881 			dmdp_prev = &dmdp->next;
5882 		}
5883 		dmdp = dmdp1;
5884 	}
5885 	ndi_devi_exit(dip, circ);
5886 }
5887 
5888 
5889 int
5890 ddi_in_panic()
5891 {
5892 	return (panicstr != NULL);
5893 }
5894 
5895 
5896 /*
5897  * Find first bit set in a mask (returned counting from 1 up)
5898  */
5899 
5900 int
5901 ddi_ffs(long mask)
5902 {
5903 	return (ffs(mask));
5904 }
5905 
5906 /*
5907  * Find last bit set. Take mask and clear
5908  * all but the most significant bit, and
5909  * then let ffs do the rest of the work.
5910  *
5911  * Algorithm courtesy of Steve Chessin.
5912  */
5913 
5914 int
5915 ddi_fls(long mask)
5916 {
5917 	while (mask) {
5918 		long nx;
5919 
5920 		if ((nx = (mask & (mask - 1))) == 0)
5921 			break;
5922 		mask = nx;
5923 	}
5924 	return (ffs(mask));
5925 }
5926 
5927 /*
5928  * The ddi_soft_state_* routines comprise generic storage management utilities
5929  * for driver soft state structures (in "the old days," this was done with
5930  * statically sized array - big systems and dynamic loading and unloading
5931  * make heap allocation more attractive).
5932  */
5933 
5934 /*
5935  * Allocate a set of pointers to 'n_items' objects of size 'size'
5936  * bytes.  Each pointer is initialized to nil.
5937  *
5938  * The 'size' and 'n_items' values are stashed in the opaque
5939  * handle returned to the caller.
5940  *
5941  * This implementation interprets 'set of pointers' to mean 'array
5942  * of pointers' but note that nothing in the interface definition
5943  * precludes an implementation that uses, for example, a linked list.
5944  * However there should be a small efficiency gain from using an array
5945  * at lookup time.
5946  *
5947  * NOTE	As an optimization, we make our growable array allocations in
5948  *	powers of two (bytes), since that's how much kmem_alloc (currently)
5949  *	gives us anyway.  It should save us some free/realloc's ..
5950  *
5951  *	As a further optimization, we make the growable array start out
5952  *	with MIN_N_ITEMS in it.
5953  */
5954 
5955 #define	MIN_N_ITEMS	8	/* 8 void *'s == 32 bytes */
5956 
5957 int
5958 ddi_soft_state_init(void **state_p, size_t size, size_t n_items)
5959 {
5960 	i_ddi_soft_state	*ss;
5961 
5962 	if (state_p == NULL || size == 0)
5963 		return (EINVAL);
5964 
5965 	ss = kmem_zalloc(sizeof (*ss), KM_SLEEP);
5966 	mutex_init(&ss->lock, NULL, MUTEX_DRIVER, NULL);
5967 	ss->size = size;
5968 
5969 	if (n_items < MIN_N_ITEMS)
5970 		ss->n_items = MIN_N_ITEMS;
5971 	else {
5972 		int bitlog;
5973 
5974 		if ((bitlog = ddi_fls(n_items)) == ddi_ffs(n_items))
5975 			bitlog--;
5976 		ss->n_items = 1 << bitlog;
5977 	}
5978 
5979 	ASSERT(ss->n_items >= n_items);
5980 
5981 	ss->array = kmem_zalloc(ss->n_items * sizeof (void *), KM_SLEEP);
5982 
5983 	*state_p = ss;
5984 	return (0);
5985 }
5986 
5987 /*
5988  * Allocate a state structure of size 'size' to be associated
5989  * with item 'item'.
5990  *
5991  * In this implementation, the array is extended to
5992  * allow the requested offset, if needed.
5993  */
5994 int
5995 ddi_soft_state_zalloc(void *state, int item)
5996 {
5997 	i_ddi_soft_state	*ss = (i_ddi_soft_state *)state;
5998 	void			**array;
5999 	void			*new_element;
6000 
6001 	if ((state == NULL) || (item < 0))
6002 		return (DDI_FAILURE);
6003 
6004 	mutex_enter(&ss->lock);
6005 	if (ss->size == 0) {
6006 		mutex_exit(&ss->lock);
6007 		cmn_err(CE_WARN, "ddi_soft_state_zalloc: bad handle: %s",
6008 		    mod_containing_pc(caller()));
6009 		return (DDI_FAILURE);
6010 	}
6011 
6012 	array = ss->array;	/* NULL if ss->n_items == 0 */
6013 	ASSERT(ss->n_items != 0 && array != NULL);
6014 
6015 	/*
6016 	 * refuse to tread on an existing element
6017 	 */
6018 	if (item < ss->n_items && array[item] != NULL) {
6019 		mutex_exit(&ss->lock);
6020 		return (DDI_FAILURE);
6021 	}
6022 
6023 	/*
6024 	 * Allocate a new element to plug in
6025 	 */
6026 	new_element = kmem_zalloc(ss->size, KM_SLEEP);
6027 
6028 	/*
6029 	 * Check if the array is big enough, if not, grow it.
6030 	 */
6031 	if (item >= ss->n_items) {
6032 		void			**new_array;
6033 		size_t			new_n_items;
6034 		struct i_ddi_soft_state	*dirty;
6035 
6036 		/*
6037 		 * Allocate a new array of the right length, copy
6038 		 * all the old pointers to the new array, then
6039 		 * if it exists at all, put the old array on the
6040 		 * dirty list.
6041 		 *
6042 		 * Note that we can't kmem_free() the old array.
6043 		 *
6044 		 * Why -- well the 'get' operation is 'mutex-free', so we
6045 		 * can't easily catch a suspended thread that is just about
6046 		 * to dereference the array we just grew out of.  So we
6047 		 * cons up a header and put it on a list of 'dirty'
6048 		 * pointer arrays.  (Dirty in the sense that there may
6049 		 * be suspended threads somewhere that are in the middle
6050 		 * of referencing them).  Fortunately, we -can- garbage
6051 		 * collect it all at ddi_soft_state_fini time.
6052 		 */
6053 		new_n_items = ss->n_items;
6054 		while (new_n_items < (1 + item))
6055 			new_n_items <<= 1;	/* double array size .. */
6056 
6057 		ASSERT(new_n_items >= (1 + item));	/* sanity check! */
6058 
6059 		new_array = kmem_zalloc(new_n_items * sizeof (void *),
6060 		    KM_SLEEP);
6061 		/*
6062 		 * Copy the pointers into the new array
6063 		 */
6064 		bcopy(array, new_array, ss->n_items * sizeof (void *));
6065 
6066 		/*
6067 		 * Save the old array on the dirty list
6068 		 */
6069 		dirty = kmem_zalloc(sizeof (*dirty), KM_SLEEP);
6070 		dirty->array = ss->array;
6071 		dirty->n_items = ss->n_items;
6072 		dirty->next = ss->next;
6073 		ss->next = dirty;
6074 
6075 		ss->array = (array = new_array);
6076 		ss->n_items = new_n_items;
6077 	}
6078 
6079 	ASSERT(array != NULL && item < ss->n_items && array[item] == NULL);
6080 
6081 	array[item] = new_element;
6082 
6083 	mutex_exit(&ss->lock);
6084 	return (DDI_SUCCESS);
6085 }
6086 
6087 /*
6088  * Fetch a pointer to the allocated soft state structure.
6089  *
6090  * This is designed to be cheap.
6091  *
6092  * There's an argument that there should be more checking for
6093  * nil pointers and out of bounds on the array.. but we do a lot
6094  * of that in the alloc/free routines.
6095  *
6096  * An array has the convenience that we don't need to lock read-access
6097  * to it c.f. a linked list.  However our "expanding array" strategy
6098  * means that we should hold a readers lock on the i_ddi_soft_state
6099  * structure.
6100  *
6101  * However, from a performance viewpoint, we need to do it without
6102  * any locks at all -- this also makes it a leaf routine.  The algorithm
6103  * is 'lock-free' because we only discard the pointer arrays at
6104  * ddi_soft_state_fini() time.
6105  */
6106 void *
6107 ddi_get_soft_state(void *state, int item)
6108 {
6109 	i_ddi_soft_state	*ss = (i_ddi_soft_state *)state;
6110 
6111 	ASSERT((ss != NULL) && (item >= 0));
6112 
6113 	if (item < ss->n_items && ss->array != NULL)
6114 		return (ss->array[item]);
6115 	return (NULL);
6116 }
6117 
6118 /*
6119  * Free the state structure corresponding to 'item.'   Freeing an
6120  * element that has either gone or was never allocated is not
6121  * considered an error.  Note that we free the state structure, but
6122  * we don't shrink our pointer array, or discard 'dirty' arrays,
6123  * since even a few pointers don't really waste too much memory.
6124  *
6125  * Passing an item number that is out of bounds, or a null pointer will
6126  * provoke an error message.
6127  */
6128 void
6129 ddi_soft_state_free(void *state, int item)
6130 {
6131 	i_ddi_soft_state	*ss = (i_ddi_soft_state *)state;
6132 	void			**array;
6133 	void			*element;
6134 	static char		msg[] = "ddi_soft_state_free:";
6135 
6136 	if (ss == NULL) {
6137 		cmn_err(CE_WARN, "%s null handle: %s",
6138 		    msg, mod_containing_pc(caller()));
6139 		return;
6140 	}
6141 
6142 	element = NULL;
6143 
6144 	mutex_enter(&ss->lock);
6145 
6146 	if ((array = ss->array) == NULL || ss->size == 0) {
6147 		cmn_err(CE_WARN, "%s bad handle: %s",
6148 		    msg, mod_containing_pc(caller()));
6149 	} else if (item < 0 || item >= ss->n_items) {
6150 		cmn_err(CE_WARN, "%s item %d not in range [0..%lu]: %s",
6151 		    msg, item, ss->n_items - 1, mod_containing_pc(caller()));
6152 	} else if (array[item] != NULL) {
6153 		element = array[item];
6154 		array[item] = NULL;
6155 	}
6156 
6157 	mutex_exit(&ss->lock);
6158 
6159 	if (element)
6160 		kmem_free(element, ss->size);
6161 }
6162 
6163 /*
6164  * Free the entire set of pointers, and any
6165  * soft state structures contained therein.
6166  *
6167  * Note that we don't grab the ss->lock mutex, even though
6168  * we're inspecting the various fields of the data structure.
6169  *
6170  * There is an implicit assumption that this routine will
6171  * never run concurrently with any of the above on this
6172  * particular state structure i.e. by the time the driver
6173  * calls this routine, there should be no other threads
6174  * running in the driver.
6175  */
6176 void
6177 ddi_soft_state_fini(void **state_p)
6178 {
6179 	i_ddi_soft_state	*ss, *dirty;
6180 	int			item;
6181 	static char		msg[] = "ddi_soft_state_fini:";
6182 
6183 	if (state_p == NULL ||
6184 	    (ss = (i_ddi_soft_state *)(*state_p)) == NULL) {
6185 		cmn_err(CE_WARN, "%s null handle: %s",
6186 		    msg, mod_containing_pc(caller()));
6187 		return;
6188 	}
6189 
6190 	if (ss->size == 0) {
6191 		cmn_err(CE_WARN, "%s bad handle: %s",
6192 		    msg, mod_containing_pc(caller()));
6193 		return;
6194 	}
6195 
6196 	if (ss->n_items > 0) {
6197 		for (item = 0; item < ss->n_items; item++)
6198 			ddi_soft_state_free(ss, item);
6199 		kmem_free(ss->array, ss->n_items * sizeof (void *));
6200 	}
6201 
6202 	/*
6203 	 * Now delete any dirty arrays from previous 'grow' operations
6204 	 */
6205 	for (dirty = ss->next; dirty; dirty = ss->next) {
6206 		ss->next = dirty->next;
6207 		kmem_free(dirty->array, dirty->n_items * sizeof (void *));
6208 		kmem_free(dirty, sizeof (*dirty));
6209 	}
6210 
6211 	mutex_destroy(&ss->lock);
6212 	kmem_free(ss, sizeof (*ss));
6213 
6214 	*state_p = NULL;
6215 }
6216 
6217 #define	SS_N_ITEMS_PER_HASH	16
6218 #define	SS_MIN_HASH_SZ		16
6219 #define	SS_MAX_HASH_SZ		4096
6220 
6221 int
6222 ddi_soft_state_bystr_init(ddi_soft_state_bystr **state_p, size_t size,
6223     int n_items)
6224 {
6225 	i_ddi_soft_state_bystr	*sss;
6226 	int			hash_sz;
6227 
6228 	ASSERT(state_p && size && n_items);
6229 	if ((state_p == NULL) || (size == 0) || (n_items == 0))
6230 		return (EINVAL);
6231 
6232 	/* current implementation is based on hash, convert n_items to hash */
6233 	hash_sz = n_items / SS_N_ITEMS_PER_HASH;
6234 	if (hash_sz < SS_MIN_HASH_SZ)
6235 		hash_sz = SS_MIN_HASH_SZ;
6236 	else if (hash_sz > SS_MAX_HASH_SZ)
6237 		hash_sz = SS_MAX_HASH_SZ;
6238 
6239 	/* allocate soft_state pool */
6240 	sss = kmem_zalloc(sizeof (*sss), KM_SLEEP);
6241 	sss->ss_size = size;
6242 	sss->ss_mod_hash = mod_hash_create_strhash("soft_state_bystr",
6243 	    hash_sz, mod_hash_null_valdtor);
6244 	*state_p = (ddi_soft_state_bystr *)sss;
6245 	return (0);
6246 }
6247 
6248 int
6249 ddi_soft_state_bystr_zalloc(ddi_soft_state_bystr *state, const char *str)
6250 {
6251 	i_ddi_soft_state_bystr	*sss = (i_ddi_soft_state_bystr *)state;
6252 	void			*sso;
6253 	char			*dup_str;
6254 
6255 	ASSERT(sss && str && sss->ss_mod_hash);
6256 	if ((sss == NULL) || (str == NULL) || (sss->ss_mod_hash == NULL))
6257 		return (DDI_FAILURE);
6258 	sso = kmem_zalloc(sss->ss_size, KM_SLEEP);
6259 	dup_str = i_ddi_strdup((char *)str, KM_SLEEP);
6260 	if (mod_hash_insert(sss->ss_mod_hash,
6261 	    (mod_hash_key_t)dup_str, (mod_hash_val_t)sso) == 0)
6262 		return (DDI_SUCCESS);
6263 
6264 	/*
6265 	 * The only error from an strhash insert is caused by a duplicate key.
6266 	 * We refuse to tread on an existing elements, so free and fail.
6267 	 */
6268 	kmem_free(dup_str, strlen(dup_str) + 1);
6269 	kmem_free(sso, sss->ss_size);
6270 	return (DDI_FAILURE);
6271 }
6272 
6273 void *
6274 ddi_soft_state_bystr_get(ddi_soft_state_bystr *state, const char *str)
6275 {
6276 	i_ddi_soft_state_bystr	*sss = (i_ddi_soft_state_bystr *)state;
6277 	void			*sso;
6278 
6279 	ASSERT(sss && str && sss->ss_mod_hash);
6280 	if ((sss == NULL) || (str == NULL) || (sss->ss_mod_hash == NULL))
6281 		return (NULL);
6282 
6283 	if (mod_hash_find(sss->ss_mod_hash,
6284 	    (mod_hash_key_t)str, (mod_hash_val_t *)&sso) == 0)
6285 		return (sso);
6286 	return (NULL);
6287 }
6288 
6289 void
6290 ddi_soft_state_bystr_free(ddi_soft_state_bystr *state, const char *str)
6291 {
6292 	i_ddi_soft_state_bystr	*sss = (i_ddi_soft_state_bystr *)state;
6293 	void			*sso;
6294 
6295 	ASSERT(sss && str && sss->ss_mod_hash);
6296 	if ((sss == NULL) || (str == NULL) || (sss->ss_mod_hash == NULL))
6297 		return;
6298 
6299 	(void) mod_hash_remove(sss->ss_mod_hash,
6300 	    (mod_hash_key_t)str, (mod_hash_val_t *)&sso);
6301 	kmem_free(sso, sss->ss_size);
6302 }
6303 
6304 void
6305 ddi_soft_state_bystr_fini(ddi_soft_state_bystr **state_p)
6306 {
6307 	i_ddi_soft_state_bystr	*sss;
6308 
6309 	ASSERT(state_p);
6310 	if (state_p == NULL)
6311 		return;
6312 
6313 	sss = (i_ddi_soft_state_bystr *)(*state_p);
6314 	if (sss == NULL)
6315 		return;
6316 
6317 	ASSERT(sss->ss_mod_hash);
6318 	if (sss->ss_mod_hash) {
6319 		mod_hash_destroy_strhash(sss->ss_mod_hash);
6320 		sss->ss_mod_hash = NULL;
6321 	}
6322 
6323 	kmem_free(sss, sizeof (*sss));
6324 	*state_p = NULL;
6325 }
6326 
6327 /*
6328  * The ddi_strid_* routines provide string-to-index management utilities.
6329  */
6330 /* allocate and initialize an strid set */
6331 int
6332 ddi_strid_init(ddi_strid **strid_p, int n_items)
6333 {
6334 	i_ddi_strid	*ss;
6335 	int		hash_sz;
6336 
6337 	if (strid_p == NULL)
6338 		return (DDI_FAILURE);
6339 
6340 	/* current implementation is based on hash, convert n_items to hash */
6341 	hash_sz = n_items / SS_N_ITEMS_PER_HASH;
6342 	if (hash_sz < SS_MIN_HASH_SZ)
6343 		hash_sz = SS_MIN_HASH_SZ;
6344 	else if (hash_sz > SS_MAX_HASH_SZ)
6345 		hash_sz = SS_MAX_HASH_SZ;
6346 
6347 	ss = kmem_alloc(sizeof (*ss), KM_SLEEP);
6348 	ss->strid_chunksz = n_items;
6349 	ss->strid_spacesz = n_items;
6350 	ss->strid_space = id_space_create("strid", 1, n_items);
6351 	ss->strid_bystr = mod_hash_create_strhash("strid_bystr", hash_sz,
6352 	    mod_hash_null_valdtor);
6353 	ss->strid_byid = mod_hash_create_idhash("strid_byid", hash_sz,
6354 	    mod_hash_null_valdtor);
6355 	*strid_p = (ddi_strid *)ss;
6356 	return (DDI_SUCCESS);
6357 }
6358 
6359 /* allocate an id mapping within the specified set for str, return id */
6360 static id_t
6361 i_ddi_strid_alloc(ddi_strid *strid, char *str)
6362 {
6363 	i_ddi_strid	*ss = (i_ddi_strid *)strid;
6364 	id_t		id;
6365 	char		*s;
6366 
6367 	ASSERT(ss && str);
6368 	if ((ss == NULL) || (str == NULL))
6369 		return (0);
6370 
6371 	/*
6372 	 * Allocate an id using VM_FIRSTFIT in order to keep allocated id
6373 	 * range as compressed as possible.  This is important to minimize
6374 	 * the amount of space used when the id is used as a ddi_soft_state
6375 	 * index by the caller.
6376 	 *
6377 	 * If the id list is exhausted, increase the size of the list
6378 	 * by the chuck size specified in ddi_strid_init and reattempt
6379 	 * the allocation
6380 	 */
6381 	if ((id = id_allocff_nosleep(ss->strid_space)) == (id_t)-1) {
6382 		id_space_extend(ss->strid_space, ss->strid_spacesz,
6383 		    ss->strid_spacesz + ss->strid_chunksz);
6384 		ss->strid_spacesz += ss->strid_chunksz;
6385 		if ((id = id_allocff_nosleep(ss->strid_space)) == (id_t)-1)
6386 			return (0);
6387 	}
6388 
6389 	/*
6390 	 * NOTE: since we create and destroy in unison we can save space by
6391 	 * using bystr key as the byid value.  This means destroy must occur
6392 	 * in (byid, bystr) order.
6393 	 */
6394 	s = i_ddi_strdup(str, KM_SLEEP);
6395 	if (mod_hash_insert(ss->strid_bystr, (mod_hash_key_t)s,
6396 	    (mod_hash_val_t)(intptr_t)id) != 0) {
6397 		ddi_strid_free(strid, id);
6398 		return (0);
6399 	}
6400 	if (mod_hash_insert(ss->strid_byid, (mod_hash_key_t)(intptr_t)id,
6401 	    (mod_hash_val_t)s) != 0) {
6402 		ddi_strid_free(strid, id);
6403 		return (0);
6404 	}
6405 
6406 	/* NOTE: s if freed on mod_hash_destroy by mod_hash_strval_dtor */
6407 	return (id);
6408 }
6409 
6410 /* allocate an id mapping within the specified set for str, return id */
6411 id_t
6412 ddi_strid_alloc(ddi_strid *strid, char *str)
6413 {
6414 	return (i_ddi_strid_alloc(strid, str));
6415 }
6416 
6417 /* return the id within the specified strid given the str */
6418 id_t
6419 ddi_strid_str2id(ddi_strid *strid, char *str)
6420 {
6421 	i_ddi_strid	*ss = (i_ddi_strid *)strid;
6422 	id_t		id = 0;
6423 	mod_hash_val_t	hv;
6424 
6425 	ASSERT(ss && str);
6426 	if (ss && str && (mod_hash_find(ss->strid_bystr,
6427 	    (mod_hash_key_t)str, &hv) == 0))
6428 		id = (int)(intptr_t)hv;
6429 	return (id);
6430 }
6431 
6432 /* return str within the specified strid given the id */
6433 char *
6434 ddi_strid_id2str(ddi_strid *strid, id_t id)
6435 {
6436 	i_ddi_strid	*ss = (i_ddi_strid *)strid;
6437 	char		*str = NULL;
6438 	mod_hash_val_t	hv;
6439 
6440 	ASSERT(ss && id > 0);
6441 	if (ss && (id > 0) && (mod_hash_find(ss->strid_byid,
6442 	    (mod_hash_key_t)(uintptr_t)id, &hv) == 0))
6443 		str = (char *)hv;
6444 	return (str);
6445 }
6446 
6447 /* free the id mapping within the specified strid */
6448 void
6449 ddi_strid_free(ddi_strid *strid, id_t id)
6450 {
6451 	i_ddi_strid	*ss = (i_ddi_strid *)strid;
6452 	char		*str;
6453 
6454 	ASSERT(ss && id > 0);
6455 	if ((ss == NULL) || (id <= 0))
6456 		return;
6457 
6458 	/* bystr key is byid value: destroy order must be (byid, bystr) */
6459 	str = ddi_strid_id2str(strid, id);
6460 	(void) mod_hash_destroy(ss->strid_byid, (mod_hash_key_t)(uintptr_t)id);
6461 	id_free(ss->strid_space, id);
6462 
6463 	if (str)
6464 		(void) mod_hash_destroy(ss->strid_bystr, (mod_hash_key_t)str);
6465 }
6466 
6467 /* destroy the strid set */
6468 void
6469 ddi_strid_fini(ddi_strid **strid_p)
6470 {
6471 	i_ddi_strid	*ss;
6472 
6473 	ASSERT(strid_p);
6474 	if (strid_p == NULL)
6475 		return;
6476 
6477 	ss = (i_ddi_strid *)(*strid_p);
6478 	if (ss == NULL)
6479 		return;
6480 
6481 	/* bystr key is byid value: destroy order must be (byid, bystr) */
6482 	if (ss->strid_byid)
6483 		mod_hash_destroy_hash(ss->strid_byid);
6484 	if (ss->strid_byid)
6485 		mod_hash_destroy_hash(ss->strid_bystr);
6486 	if (ss->strid_space)
6487 		id_space_destroy(ss->strid_space);
6488 	kmem_free(ss, sizeof (*ss));
6489 	*strid_p = NULL;
6490 }
6491 
6492 /*
6493  * This sets the devi_addr entry in the dev_info structure 'dip' to 'name'.
6494  * Storage is double buffered to prevent updates during devi_addr use -
6495  * double buffering is adaquate for reliable ddi_deviname() consumption.
6496  * The double buffer is not freed until dev_info structure destruction
6497  * (by i_ddi_free_node).
6498  */
6499 void
6500 ddi_set_name_addr(dev_info_t *dip, char *name)
6501 {
6502 	char	*buf = DEVI(dip)->devi_addr_buf;
6503 	char	*newaddr;
6504 
6505 	if (buf == NULL) {
6506 		buf = kmem_zalloc(2 * MAXNAMELEN, KM_SLEEP);
6507 		DEVI(dip)->devi_addr_buf = buf;
6508 	}
6509 
6510 	if (name) {
6511 		ASSERT(strlen(name) < MAXNAMELEN);
6512 		newaddr = (DEVI(dip)->devi_addr == buf) ?
6513 		    (buf + MAXNAMELEN) : buf;
6514 		(void) strlcpy(newaddr, name, MAXNAMELEN);
6515 	} else
6516 		newaddr = NULL;
6517 
6518 	DEVI(dip)->devi_addr = newaddr;
6519 }
6520 
6521 char *
6522 ddi_get_name_addr(dev_info_t *dip)
6523 {
6524 	return (DEVI(dip)->devi_addr);
6525 }
6526 
6527 void
6528 ddi_set_parent_data(dev_info_t *dip, void *pd)
6529 {
6530 	DEVI(dip)->devi_parent_data = pd;
6531 }
6532 
6533 void *
6534 ddi_get_parent_data(dev_info_t *dip)
6535 {
6536 	return (DEVI(dip)->devi_parent_data);
6537 }
6538 
6539 /*
6540  * ddi_name_to_major: returns the major number of a named module,
6541  * derived from the current driver alias binding.
6542  *
6543  * Caveat: drivers should avoid the use of this function, in particular
6544  * together with ddi_get_name/ddi_binding name, as per
6545  *	major = ddi_name_to_major(ddi_get_name(devi));
6546  * ddi_name_to_major() relies on the state of the device/alias binding,
6547  * which can and does change dynamically as aliases are administered
6548  * over time.  An attached device instance cannot rely on the major
6549  * number returned by ddi_name_to_major() to match its own major number.
6550  *
6551  * For driver use, ddi_driver_major() reliably returns the major number
6552  * for the module to which the device was bound at attach time over
6553  * the life of the instance.
6554  *	major = ddi_driver_major(dev_info_t *)
6555  */
6556 major_t
6557 ddi_name_to_major(char *name)
6558 {
6559 	return (mod_name_to_major(name));
6560 }
6561 
6562 /*
6563  * ddi_major_to_name: Returns the module name bound to a major number.
6564  */
6565 char *
6566 ddi_major_to_name(major_t major)
6567 {
6568 	return (mod_major_to_name(major));
6569 }
6570 
6571 /*
6572  * Return the name of the devinfo node pointed at by 'dip' in the buffer
6573  * pointed at by 'name.'  A devinfo node is named as a result of calling
6574  * ddi_initchild().
6575  *
6576  * Note: the driver must be held before calling this function!
6577  */
6578 char *
6579 ddi_deviname(dev_info_t *dip, char *name)
6580 {
6581 	char *addrname;
6582 	char none = '\0';
6583 
6584 	if (dip == ddi_root_node()) {
6585 		*name = '\0';
6586 		return (name);
6587 	}
6588 
6589 	if (i_ddi_node_state(dip) < DS_BOUND) {
6590 		addrname = &none;
6591 	} else {
6592 		/*
6593 		 * Use ddi_get_name_addr() without checking state so we get
6594 		 * a unit-address if we are called after ddi_set_name_addr()
6595 		 * by nexus DDI_CTL_INITCHILD code, but before completing
6596 		 * node promotion to DS_INITIALIZED.  We currently have
6597 		 * two situations where we are called in this state:
6598 		 *   o  For framework processing of a path-oriented alias.
6599 		 *   o  If a SCSA nexus driver calls ddi_devid_register()
6600 		 *	from it's tran_tgt_init(9E) implementation.
6601 		 */
6602 		addrname = ddi_get_name_addr(dip);
6603 		if (addrname == NULL)
6604 			addrname = &none;
6605 	}
6606 
6607 	if (*addrname == '\0') {
6608 		(void) sprintf(name, "/%s", ddi_node_name(dip));
6609 	} else {
6610 		(void) sprintf(name, "/%s@%s", ddi_node_name(dip), addrname);
6611 	}
6612 
6613 	return (name);
6614 }
6615 
6616 /*
6617  * Spits out the name of device node, typically name@addr, for a given node,
6618  * using the driver name, not the nodename.
6619  *
6620  * Used by match_parent. Not to be used elsewhere.
6621  */
6622 char *
6623 i_ddi_parname(dev_info_t *dip, char *name)
6624 {
6625 	char *addrname;
6626 
6627 	if (dip == ddi_root_node()) {
6628 		*name = '\0';
6629 		return (name);
6630 	}
6631 
6632 	ASSERT(i_ddi_node_state(dip) >= DS_INITIALIZED);
6633 
6634 	if (*(addrname = ddi_get_name_addr(dip)) == '\0')
6635 		(void) sprintf(name, "%s", ddi_binding_name(dip));
6636 	else
6637 		(void) sprintf(name, "%s@%s", ddi_binding_name(dip), addrname);
6638 	return (name);
6639 }
6640 
6641 static char *
6642 pathname_work(dev_info_t *dip, char *path)
6643 {
6644 	char *bp;
6645 
6646 	if (dip == ddi_root_node()) {
6647 		*path = '\0';
6648 		return (path);
6649 	}
6650 	(void) pathname_work(ddi_get_parent(dip), path);
6651 	bp = path + strlen(path);
6652 	(void) ddi_deviname(dip, bp);
6653 	return (path);
6654 }
6655 
6656 char *
6657 ddi_pathname(dev_info_t *dip, char *path)
6658 {
6659 	return (pathname_work(dip, path));
6660 }
6661 
6662 char *
6663 ddi_pathname_minor(struct ddi_minor_data *dmdp, char *path)
6664 {
6665 	if (dmdp->dip == NULL)
6666 		*path = '\0';
6667 	else {
6668 		(void) ddi_pathname(dmdp->dip, path);
6669 		if (dmdp->ddm_name) {
6670 			(void) strcat(path, ":");
6671 			(void) strcat(path, dmdp->ddm_name);
6672 		}
6673 	}
6674 	return (path);
6675 }
6676 
6677 static char *
6678 pathname_work_obp(dev_info_t *dip, char *path)
6679 {
6680 	char *bp;
6681 	char *obp_path;
6682 
6683 	/*
6684 	 * look up the "obp-path" property, return the path if it exists
6685 	 */
6686 	if (ddi_prop_lookup_string(DDI_DEV_T_ANY, dip, DDI_PROP_DONTPASS,
6687 	    "obp-path", &obp_path) == DDI_PROP_SUCCESS) {
6688 		(void) strcpy(path, obp_path);
6689 		ddi_prop_free(obp_path);
6690 		return (path);
6691 	}
6692 
6693 	/*
6694 	 * stop at root, no obp path
6695 	 */
6696 	if (dip == ddi_root_node()) {
6697 		return (NULL);
6698 	}
6699 
6700 	obp_path = pathname_work_obp(ddi_get_parent(dip), path);
6701 	if (obp_path == NULL)
6702 		return (NULL);
6703 
6704 	/*
6705 	 * append our component to parent's obp path
6706 	 */
6707 	bp = path + strlen(path);
6708 	if (*(bp - 1) != '/')
6709 		(void) strcat(bp++, "/");
6710 	(void) ddi_deviname(dip, bp);
6711 	return (path);
6712 }
6713 
6714 /*
6715  * return the 'obp-path' based path for the given node, or NULL if the node
6716  * does not have a different obp path. NOTE: Unlike ddi_pathname, this
6717  * function can't be called from interrupt context (since we need to
6718  * lookup a string property).
6719  */
6720 char *
6721 ddi_pathname_obp(dev_info_t *dip, char *path)
6722 {
6723 	ASSERT(!servicing_interrupt());
6724 	if (dip == NULL || path == NULL)
6725 		return (NULL);
6726 
6727 	/* split work into a separate function to aid debugging */
6728 	return (pathname_work_obp(dip, path));
6729 }
6730 
6731 int
6732 ddi_pathname_obp_set(dev_info_t *dip, char *component)
6733 {
6734 	dev_info_t *pdip;
6735 	char *obp_path = NULL;
6736 	int rc = DDI_FAILURE;
6737 
6738 	if (dip == NULL)
6739 		return (DDI_FAILURE);
6740 
6741 	obp_path = kmem_zalloc(MAXPATHLEN, KM_SLEEP);
6742 
6743 	pdip = ddi_get_parent(dip);
6744 
6745 	if (ddi_pathname_obp(pdip, obp_path) == NULL) {
6746 		(void) ddi_pathname(pdip, obp_path);
6747 	}
6748 
6749 	if (component) {
6750 		(void) strncat(obp_path, "/", MAXPATHLEN);
6751 		(void) strncat(obp_path, component, MAXPATHLEN);
6752 	}
6753 	rc = ndi_prop_update_string(DDI_DEV_T_NONE, dip, "obp-path",
6754 	    obp_path);
6755 
6756 	if (obp_path)
6757 		kmem_free(obp_path, MAXPATHLEN);
6758 
6759 	return (rc);
6760 }
6761 
6762 /*
6763  * Given a dev_t, return the pathname of the corresponding device in the
6764  * buffer pointed at by "path."  The buffer is assumed to be large enough
6765  * to hold the pathname of the device (MAXPATHLEN).
6766  *
6767  * The pathname of a device is the pathname of the devinfo node to which
6768  * the device "belongs," concatenated with the character ':' and the name
6769  * of the minor node corresponding to the dev_t.  If spec_type is 0 then
6770  * just the pathname of the devinfo node is returned without driving attach
6771  * of that node.  For a non-zero spec_type, an attach is performed and a
6772  * search of the minor list occurs.
6773  *
6774  * It is possible that the path associated with the dev_t is not
6775  * currently available in the devinfo tree.  In order to have a
6776  * dev_t, a device must have been discovered before, which means
6777  * that the path is always in the instance tree.  The one exception
6778  * to this is if the dev_t is associated with a pseudo driver, in
6779  * which case the device must exist on the pseudo branch of the
6780  * devinfo tree as a result of parsing .conf files.
6781  */
6782 int
6783 ddi_dev_pathname(dev_t devt, int spec_type, char *path)
6784 {
6785 	int		circ;
6786 	major_t		major = getmajor(devt);
6787 	int		instance;
6788 	dev_info_t	*dip;
6789 	char		*minorname;
6790 	char		*drvname;
6791 
6792 	if (major >= devcnt)
6793 		goto fail;
6794 	if (major == clone_major) {
6795 		/* clone has no minor nodes, manufacture the path here */
6796 		if ((drvname = ddi_major_to_name(getminor(devt))) == NULL)
6797 			goto fail;
6798 
6799 		(void) snprintf(path, MAXPATHLEN, "%s:%s", CLONE_PATH, drvname);
6800 		return (DDI_SUCCESS);
6801 	}
6802 
6803 	/* extract instance from devt (getinfo(9E) DDI_INFO_DEVT2INSTANCE). */
6804 	if ((instance = dev_to_instance(devt)) == -1)
6805 		goto fail;
6806 
6807 	/* reconstruct the path given the major/instance */
6808 	if (e_ddi_majorinstance_to_path(major, instance, path) != DDI_SUCCESS)
6809 		goto fail;
6810 
6811 	/* if spec_type given we must drive attach and search minor nodes */
6812 	if ((spec_type == S_IFCHR) || (spec_type == S_IFBLK)) {
6813 		/* attach the path so we can search minors */
6814 		if ((dip = e_ddi_hold_devi_by_path(path, 0)) == NULL)
6815 			goto fail;
6816 
6817 		/* Add minorname to path. */
6818 		ndi_devi_enter(dip, &circ);
6819 		minorname = i_ddi_devtspectype_to_minorname(dip,
6820 		    devt, spec_type);
6821 		if (minorname) {
6822 			(void) strcat(path, ":");
6823 			(void) strcat(path, minorname);
6824 		}
6825 		ndi_devi_exit(dip, circ);
6826 		ddi_release_devi(dip);
6827 		if (minorname == NULL)
6828 			goto fail;
6829 	}
6830 	ASSERT(strlen(path) < MAXPATHLEN);
6831 	return (DDI_SUCCESS);
6832 
6833 fail:	*path = 0;
6834 	return (DDI_FAILURE);
6835 }
6836 
6837 /*
6838  * Given a major number and an instance, return the path.
6839  * This interface does NOT drive attach.
6840  */
6841 int
6842 e_ddi_majorinstance_to_path(major_t major, int instance, char *path)
6843 {
6844 	struct devnames *dnp;
6845 	dev_info_t	*dip;
6846 
6847 	if ((major >= devcnt) || (instance == -1)) {
6848 		*path = 0;
6849 		return (DDI_FAILURE);
6850 	}
6851 
6852 	/* look for the major/instance in the instance tree */
6853 	if (e_ddi_instance_majorinstance_to_path(major, instance,
6854 	    path) == DDI_SUCCESS) {
6855 		ASSERT(strlen(path) < MAXPATHLEN);
6856 		return (DDI_SUCCESS);
6857 	}
6858 
6859 	/*
6860 	 * Not in instance tree, find the instance on the per driver list and
6861 	 * construct path to instance via ddi_pathname(). This is how paths
6862 	 * down the 'pseudo' branch are constructed.
6863 	 */
6864 	dnp = &(devnamesp[major]);
6865 	LOCK_DEV_OPS(&(dnp->dn_lock));
6866 	for (dip = dnp->dn_head; dip;
6867 	    dip = (dev_info_t *)DEVI(dip)->devi_next) {
6868 		/* Skip if instance does not match. */
6869 		if (DEVI(dip)->devi_instance != instance)
6870 			continue;
6871 
6872 		/*
6873 		 * An ndi_hold_devi() does not prevent DS_INITIALIZED->DS_BOUND
6874 		 * node demotion, so it is not an effective way of ensuring
6875 		 * that the ddi_pathname result has a unit-address.  Instead,
6876 		 * we reverify the node state after calling ddi_pathname().
6877 		 */
6878 		if (i_ddi_node_state(dip) >= DS_INITIALIZED) {
6879 			(void) ddi_pathname(dip, path);
6880 			if (i_ddi_node_state(dip) < DS_INITIALIZED)
6881 				continue;
6882 			UNLOCK_DEV_OPS(&(dnp->dn_lock));
6883 			ASSERT(strlen(path) < MAXPATHLEN);
6884 			return (DDI_SUCCESS);
6885 		}
6886 	}
6887 	UNLOCK_DEV_OPS(&(dnp->dn_lock));
6888 
6889 	/* can't reconstruct the path */
6890 	*path = 0;
6891 	return (DDI_FAILURE);
6892 }
6893 
6894 #define	GLD_DRIVER_PPA "SUNW,gld_v0_ppa"
6895 
6896 /*
6897  * Given the dip for a network interface return the ppa for that interface.
6898  *
6899  * In all cases except GLD v0 drivers, the ppa == instance.
6900  * In the case of GLD v0 drivers, the ppa is equal to the attach order.
6901  * So for these drivers when the attach routine calls gld_register(),
6902  * the GLD framework creates an integer property called "gld_driver_ppa"
6903  * that can be queried here.
6904  *
6905  * The only time this function is used is when a system is booting over nfs.
6906  * In this case the system has to resolve the pathname of the boot device
6907  * to it's ppa.
6908  */
6909 int
6910 i_ddi_devi_get_ppa(dev_info_t *dip)
6911 {
6912 	return (ddi_prop_get_int(DDI_DEV_T_ANY, dip,
6913 	    DDI_PROP_DONTPASS | DDI_PROP_NOTPROM,
6914 	    GLD_DRIVER_PPA, ddi_get_instance(dip)));
6915 }
6916 
6917 /*
6918  * i_ddi_devi_set_ppa() should only be called from gld_register()
6919  * and only for GLD v0 drivers
6920  */
6921 void
6922 i_ddi_devi_set_ppa(dev_info_t *dip, int ppa)
6923 {
6924 	(void) e_ddi_prop_update_int(DDI_DEV_T_NONE, dip, GLD_DRIVER_PPA, ppa);
6925 }
6926 
6927 
6928 /*
6929  * Private DDI Console bell functions.
6930  */
6931 void
6932 ddi_ring_console_bell(clock_t duration)
6933 {
6934 	if (ddi_console_bell_func != NULL)
6935 		(*ddi_console_bell_func)(duration);
6936 }
6937 
6938 void
6939 ddi_set_console_bell(void (*bellfunc)(clock_t duration))
6940 {
6941 	ddi_console_bell_func = bellfunc;
6942 }
6943 
6944 int
6945 ddi_dma_alloc_handle(dev_info_t *dip, ddi_dma_attr_t *attr,
6946 	int (*waitfp)(caddr_t), caddr_t arg, ddi_dma_handle_t *handlep)
6947 {
6948 	int (*funcp)() = ddi_dma_allochdl;
6949 	ddi_dma_attr_t dma_attr;
6950 	struct bus_ops *bop;
6951 
6952 	if (attr == (ddi_dma_attr_t *)0)
6953 		return (DDI_DMA_BADATTR);
6954 
6955 	dma_attr = *attr;
6956 
6957 	bop = DEVI(dip)->devi_ops->devo_bus_ops;
6958 	if (bop && bop->bus_dma_allochdl)
6959 		funcp = bop->bus_dma_allochdl;
6960 
6961 	return ((*funcp)(dip, dip, &dma_attr, waitfp, arg, handlep));
6962 }
6963 
6964 void
6965 ddi_dma_free_handle(ddi_dma_handle_t *handlep)
6966 {
6967 	ddi_dma_handle_t h = *handlep;
6968 	(void) ddi_dma_freehdl(HD, HD, h);
6969 }
6970 
6971 static uintptr_t dma_mem_list_id = 0;
6972 
6973 
6974 int
6975 ddi_dma_mem_alloc(ddi_dma_handle_t handle, size_t length,
6976 	ddi_device_acc_attr_t *accattrp, uint_t flags,
6977 	int (*waitfp)(caddr_t), caddr_t arg, caddr_t *kaddrp,
6978 	size_t *real_length, ddi_acc_handle_t *handlep)
6979 {
6980 	ddi_dma_impl_t *hp = (ddi_dma_impl_t *)handle;
6981 	dev_info_t *dip = hp->dmai_rdip;
6982 	ddi_acc_hdl_t *ap;
6983 	ddi_dma_attr_t *attrp = &hp->dmai_attr;
6984 	uint_t sleepflag, xfermodes;
6985 	int (*fp)(caddr_t);
6986 	int rval;
6987 
6988 	if (waitfp == DDI_DMA_SLEEP)
6989 		fp = (int (*)())KM_SLEEP;
6990 	else if (waitfp == DDI_DMA_DONTWAIT)
6991 		fp = (int (*)())KM_NOSLEEP;
6992 	else
6993 		fp = waitfp;
6994 	*handlep = impl_acc_hdl_alloc(fp, arg);
6995 	if (*handlep == NULL)
6996 		return (DDI_FAILURE);
6997 
6998 	/* check if the cache attributes are supported */
6999 	if (i_ddi_check_cache_attr(flags) == B_FALSE)
7000 		return (DDI_FAILURE);
7001 
7002 	/*
7003 	 * Transfer the meaningful bits to xfermodes.
7004 	 * Double-check if the 3rd party driver correctly sets the bits.
7005 	 * If not, set DDI_DMA_STREAMING to keep compatibility.
7006 	 */
7007 	xfermodes = flags & (DDI_DMA_CONSISTENT | DDI_DMA_STREAMING);
7008 	if (xfermodes == 0) {
7009 		xfermodes = DDI_DMA_STREAMING;
7010 	}
7011 
7012 	/*
7013 	 * initialize the common elements of data access handle
7014 	 */
7015 	ap = impl_acc_hdl_get(*handlep);
7016 	ap->ah_vers = VERS_ACCHDL;
7017 	ap->ah_dip = dip;
7018 	ap->ah_offset = 0;
7019 	ap->ah_len = 0;
7020 	ap->ah_xfermodes = flags;
7021 	ap->ah_acc = *accattrp;
7022 
7023 	sleepflag = ((waitfp == DDI_DMA_SLEEP) ? 1 : 0);
7024 	if (xfermodes == DDI_DMA_CONSISTENT) {
7025 		rval = i_ddi_mem_alloc(dip, attrp, length, sleepflag,
7026 		    flags, accattrp, kaddrp, NULL, ap);
7027 		*real_length = length;
7028 	} else {
7029 		rval = i_ddi_mem_alloc(dip, attrp, length, sleepflag,
7030 		    flags, accattrp, kaddrp, real_length, ap);
7031 	}
7032 	if (rval == DDI_SUCCESS) {
7033 		ap->ah_len = (off_t)(*real_length);
7034 		ap->ah_addr = *kaddrp;
7035 	} else {
7036 		impl_acc_hdl_free(*handlep);
7037 		*handlep = (ddi_acc_handle_t)NULL;
7038 		if (waitfp != DDI_DMA_SLEEP && waitfp != DDI_DMA_DONTWAIT) {
7039 			ddi_set_callback(waitfp, arg, &dma_mem_list_id);
7040 		}
7041 		rval = DDI_FAILURE;
7042 	}
7043 	return (rval);
7044 }
7045 
7046 void
7047 ddi_dma_mem_free(ddi_acc_handle_t *handlep)
7048 {
7049 	ddi_acc_hdl_t *ap;
7050 
7051 	ap = impl_acc_hdl_get(*handlep);
7052 	ASSERT(ap);
7053 
7054 	i_ddi_mem_free((caddr_t)ap->ah_addr, ap);
7055 
7056 	/*
7057 	 * free the handle
7058 	 */
7059 	impl_acc_hdl_free(*handlep);
7060 	*handlep = (ddi_acc_handle_t)NULL;
7061 
7062 	if (dma_mem_list_id != 0) {
7063 		ddi_run_callback(&dma_mem_list_id);
7064 	}
7065 }
7066 
7067 int
7068 ddi_dma_buf_bind_handle(ddi_dma_handle_t handle, struct buf *bp,
7069 	uint_t flags, int (*waitfp)(caddr_t), caddr_t arg,
7070 	ddi_dma_cookie_t *cookiep, uint_t *ccountp)
7071 {
7072 	ddi_dma_impl_t *hp = (ddi_dma_impl_t *)handle;
7073 	dev_info_t *dip, *rdip;
7074 	struct ddi_dma_req dmareq;
7075 	int (*funcp)();
7076 
7077 	dmareq.dmar_flags = flags;
7078 	dmareq.dmar_fp = waitfp;
7079 	dmareq.dmar_arg = arg;
7080 	dmareq.dmar_object.dmao_size = (uint_t)bp->b_bcount;
7081 
7082 	if (bp->b_flags & B_PAGEIO) {
7083 		dmareq.dmar_object.dmao_type = DMA_OTYP_PAGES;
7084 		dmareq.dmar_object.dmao_obj.pp_obj.pp_pp = bp->b_pages;
7085 		dmareq.dmar_object.dmao_obj.pp_obj.pp_offset =
7086 		    (uint_t)(((uintptr_t)bp->b_un.b_addr) & MMU_PAGEOFFSET);
7087 	} else {
7088 		dmareq.dmar_object.dmao_obj.virt_obj.v_addr = bp->b_un.b_addr;
7089 		if (bp->b_flags & B_SHADOW) {
7090 			dmareq.dmar_object.dmao_obj.virt_obj.v_priv =
7091 			    bp->b_shadow;
7092 			dmareq.dmar_object.dmao_type = DMA_OTYP_BUFVADDR;
7093 		} else {
7094 			dmareq.dmar_object.dmao_type =
7095 			    (bp->b_flags & (B_PHYS | B_REMAPPED)) ?
7096 			    DMA_OTYP_BUFVADDR : DMA_OTYP_VADDR;
7097 			dmareq.dmar_object.dmao_obj.virt_obj.v_priv = NULL;
7098 		}
7099 
7100 		/*
7101 		 * If the buffer has no proc pointer, or the proc
7102 		 * struct has the kernel address space, or the buffer has
7103 		 * been marked B_REMAPPED (meaning that it is now
7104 		 * mapped into the kernel's address space), then
7105 		 * the address space is kas (kernel address space).
7106 		 */
7107 		if ((bp->b_proc == NULL) || (bp->b_proc->p_as == &kas) ||
7108 		    (bp->b_flags & B_REMAPPED)) {
7109 			dmareq.dmar_object.dmao_obj.virt_obj.v_as = 0;
7110 		} else {
7111 			dmareq.dmar_object.dmao_obj.virt_obj.v_as =
7112 			    bp->b_proc->p_as;
7113 		}
7114 	}
7115 
7116 	dip = rdip = hp->dmai_rdip;
7117 	if (dip != ddi_root_node())
7118 		dip = (dev_info_t *)DEVI(dip)->devi_bus_dma_bindhdl;
7119 	funcp = DEVI(rdip)->devi_bus_dma_bindfunc;
7120 	return ((*funcp)(dip, rdip, handle, &dmareq, cookiep, ccountp));
7121 }
7122 
7123 int
7124 ddi_dma_addr_bind_handle(ddi_dma_handle_t handle, struct as *as,
7125 	caddr_t addr, size_t len, uint_t flags, int (*waitfp)(caddr_t),
7126 	caddr_t arg, ddi_dma_cookie_t *cookiep, uint_t *ccountp)
7127 {
7128 	ddi_dma_impl_t *hp = (ddi_dma_impl_t *)handle;
7129 	dev_info_t *dip, *rdip;
7130 	struct ddi_dma_req dmareq;
7131 	int (*funcp)();
7132 
7133 	if (len == (uint_t)0) {
7134 		return (DDI_DMA_NOMAPPING);
7135 	}
7136 	dmareq.dmar_flags = flags;
7137 	dmareq.dmar_fp = waitfp;
7138 	dmareq.dmar_arg = arg;
7139 	dmareq.dmar_object.dmao_size = len;
7140 	dmareq.dmar_object.dmao_type = DMA_OTYP_VADDR;
7141 	dmareq.dmar_object.dmao_obj.virt_obj.v_as = as;
7142 	dmareq.dmar_object.dmao_obj.virt_obj.v_addr = addr;
7143 	dmareq.dmar_object.dmao_obj.virt_obj.v_priv = NULL;
7144 
7145 	dip = rdip = hp->dmai_rdip;
7146 	if (dip != ddi_root_node())
7147 		dip = (dev_info_t *)DEVI(dip)->devi_bus_dma_bindhdl;
7148 	funcp = DEVI(rdip)->devi_bus_dma_bindfunc;
7149 	return ((*funcp)(dip, rdip, handle, &dmareq, cookiep, ccountp));
7150 }
7151 
7152 void
7153 ddi_dma_nextcookie(ddi_dma_handle_t handle, ddi_dma_cookie_t *cookiep)
7154 {
7155 	ddi_dma_impl_t *hp = (ddi_dma_impl_t *)handle;
7156 	ddi_dma_cookie_t *cp;
7157 
7158 	cp = hp->dmai_cookie;
7159 	ASSERT(cp);
7160 
7161 	cookiep->dmac_notused = cp->dmac_notused;
7162 	cookiep->dmac_type = cp->dmac_type;
7163 	cookiep->dmac_address = cp->dmac_address;
7164 	cookiep->dmac_size = cp->dmac_size;
7165 	hp->dmai_cookie++;
7166 }
7167 
7168 int
7169 ddi_dma_numwin(ddi_dma_handle_t handle, uint_t *nwinp)
7170 {
7171 	ddi_dma_impl_t *hp = (ddi_dma_impl_t *)handle;
7172 	if ((hp->dmai_rflags & DDI_DMA_PARTIAL) == 0) {
7173 		return (DDI_FAILURE);
7174 	} else {
7175 		*nwinp = hp->dmai_nwin;
7176 		return (DDI_SUCCESS);
7177 	}
7178 }
7179 
7180 int
7181 ddi_dma_getwin(ddi_dma_handle_t h, uint_t win, off_t *offp,
7182 	size_t *lenp, ddi_dma_cookie_t *cookiep, uint_t *ccountp)
7183 {
7184 	int (*funcp)() = ddi_dma_win;
7185 	struct bus_ops *bop;
7186 
7187 	bop = DEVI(HD)->devi_ops->devo_bus_ops;
7188 	if (bop && bop->bus_dma_win)
7189 		funcp = bop->bus_dma_win;
7190 
7191 	return ((*funcp)(HD, HD, h, win, offp, lenp, cookiep, ccountp));
7192 }
7193 
7194 int
7195 ddi_dma_set_sbus64(ddi_dma_handle_t h, ulong_t burstsizes)
7196 {
7197 	return (ddi_dma_mctl(HD, HD, h, DDI_DMA_SET_SBUS64, 0,
7198 	    &burstsizes, 0, 0));
7199 }
7200 
7201 int
7202 i_ddi_dma_fault_check(ddi_dma_impl_t *hp)
7203 {
7204 	return (hp->dmai_fault);
7205 }
7206 
7207 int
7208 ddi_check_dma_handle(ddi_dma_handle_t handle)
7209 {
7210 	ddi_dma_impl_t *hp = (ddi_dma_impl_t *)handle;
7211 	int (*check)(ddi_dma_impl_t *);
7212 
7213 	if ((check = hp->dmai_fault_check) == NULL)
7214 		check = i_ddi_dma_fault_check;
7215 
7216 	return (((*check)(hp) == DDI_SUCCESS) ? DDI_SUCCESS : DDI_FAILURE);
7217 }
7218 
7219 void
7220 i_ddi_dma_set_fault(ddi_dma_handle_t handle)
7221 {
7222 	ddi_dma_impl_t *hp = (ddi_dma_impl_t *)handle;
7223 	void (*notify)(ddi_dma_impl_t *);
7224 
7225 	if (!hp->dmai_fault) {
7226 		hp->dmai_fault = 1;
7227 		if ((notify = hp->dmai_fault_notify) != NULL)
7228 			(*notify)(hp);
7229 	}
7230 }
7231 
7232 void
7233 i_ddi_dma_clr_fault(ddi_dma_handle_t handle)
7234 {
7235 	ddi_dma_impl_t *hp = (ddi_dma_impl_t *)handle;
7236 	void (*notify)(ddi_dma_impl_t *);
7237 
7238 	if (hp->dmai_fault) {
7239 		hp->dmai_fault = 0;
7240 		if ((notify = hp->dmai_fault_notify) != NULL)
7241 			(*notify)(hp);
7242 	}
7243 }
7244 
7245 /*
7246  * register mapping routines.
7247  */
7248 int
7249 ddi_regs_map_setup(dev_info_t *dip, uint_t rnumber, caddr_t *addrp,
7250 	offset_t offset, offset_t len, ddi_device_acc_attr_t *accattrp,
7251 	ddi_acc_handle_t *handle)
7252 {
7253 	ddi_map_req_t mr;
7254 	ddi_acc_hdl_t *hp;
7255 	int result;
7256 
7257 	/*
7258 	 * Allocate and initialize the common elements of data access handle.
7259 	 */
7260 	*handle = impl_acc_hdl_alloc(KM_SLEEP, NULL);
7261 	hp = impl_acc_hdl_get(*handle);
7262 	hp->ah_vers = VERS_ACCHDL;
7263 	hp->ah_dip = dip;
7264 	hp->ah_rnumber = rnumber;
7265 	hp->ah_offset = offset;
7266 	hp->ah_len = len;
7267 	hp->ah_acc = *accattrp;
7268 
7269 	/*
7270 	 * Set up the mapping request and call to parent.
7271 	 */
7272 	mr.map_op = DDI_MO_MAP_LOCKED;
7273 	mr.map_type = DDI_MT_RNUMBER;
7274 	mr.map_obj.rnumber = rnumber;
7275 	mr.map_prot = PROT_READ | PROT_WRITE;
7276 	mr.map_flags = DDI_MF_KERNEL_MAPPING;
7277 	mr.map_handlep = hp;
7278 	mr.map_vers = DDI_MAP_VERSION;
7279 	result = ddi_map(dip, &mr, offset, len, addrp);
7280 
7281 	/*
7282 	 * check for end result
7283 	 */
7284 	if (result != DDI_SUCCESS) {
7285 		impl_acc_hdl_free(*handle);
7286 		*handle = (ddi_acc_handle_t)NULL;
7287 	} else {
7288 		hp->ah_addr = *addrp;
7289 	}
7290 
7291 	return (result);
7292 }
7293 
7294 void
7295 ddi_regs_map_free(ddi_acc_handle_t *handlep)
7296 {
7297 	ddi_map_req_t mr;
7298 	ddi_acc_hdl_t *hp;
7299 
7300 	hp = impl_acc_hdl_get(*handlep);
7301 	ASSERT(hp);
7302 
7303 	mr.map_op = DDI_MO_UNMAP;
7304 	mr.map_type = DDI_MT_RNUMBER;
7305 	mr.map_obj.rnumber = hp->ah_rnumber;
7306 	mr.map_prot = PROT_READ | PROT_WRITE;
7307 	mr.map_flags = DDI_MF_KERNEL_MAPPING;
7308 	mr.map_handlep = hp;
7309 	mr.map_vers = DDI_MAP_VERSION;
7310 
7311 	/*
7312 	 * Call my parent to unmap my regs.
7313 	 */
7314 	(void) ddi_map(hp->ah_dip, &mr, hp->ah_offset,
7315 	    hp->ah_len, &hp->ah_addr);
7316 	/*
7317 	 * free the handle
7318 	 */
7319 	impl_acc_hdl_free(*handlep);
7320 	*handlep = (ddi_acc_handle_t)NULL;
7321 }
7322 
7323 int
7324 ddi_device_zero(ddi_acc_handle_t handle, caddr_t dev_addr, size_t bytecount,
7325 	ssize_t dev_advcnt, uint_t dev_datasz)
7326 {
7327 	uint8_t *b;
7328 	uint16_t *w;
7329 	uint32_t *l;
7330 	uint64_t *ll;
7331 
7332 	/* check for total byte count is multiple of data transfer size */
7333 	if (bytecount != ((bytecount / dev_datasz) * dev_datasz))
7334 		return (DDI_FAILURE);
7335 
7336 	switch (dev_datasz) {
7337 	case DDI_DATA_SZ01_ACC:
7338 		for (b = (uint8_t *)dev_addr;
7339 		    bytecount != 0; bytecount -= 1, b += dev_advcnt)
7340 			ddi_put8(handle, b, 0);
7341 		break;
7342 	case DDI_DATA_SZ02_ACC:
7343 		for (w = (uint16_t *)dev_addr;
7344 		    bytecount != 0; bytecount -= 2, w += dev_advcnt)
7345 			ddi_put16(handle, w, 0);
7346 		break;
7347 	case DDI_DATA_SZ04_ACC:
7348 		for (l = (uint32_t *)dev_addr;
7349 		    bytecount != 0; bytecount -= 4, l += dev_advcnt)
7350 			ddi_put32(handle, l, 0);
7351 		break;
7352 	case DDI_DATA_SZ08_ACC:
7353 		for (ll = (uint64_t *)dev_addr;
7354 		    bytecount != 0; bytecount -= 8, ll += dev_advcnt)
7355 			ddi_put64(handle, ll, 0x0ll);
7356 		break;
7357 	default:
7358 		return (DDI_FAILURE);
7359 	}
7360 	return (DDI_SUCCESS);
7361 }
7362 
7363 int
7364 ddi_device_copy(
7365 	ddi_acc_handle_t src_handle, caddr_t src_addr, ssize_t src_advcnt,
7366 	ddi_acc_handle_t dest_handle, caddr_t dest_addr, ssize_t dest_advcnt,
7367 	size_t bytecount, uint_t dev_datasz)
7368 {
7369 	uint8_t *b_src, *b_dst;
7370 	uint16_t *w_src, *w_dst;
7371 	uint32_t *l_src, *l_dst;
7372 	uint64_t *ll_src, *ll_dst;
7373 
7374 	/* check for total byte count is multiple of data transfer size */
7375 	if (bytecount != ((bytecount / dev_datasz) * dev_datasz))
7376 		return (DDI_FAILURE);
7377 
7378 	switch (dev_datasz) {
7379 	case DDI_DATA_SZ01_ACC:
7380 		b_src = (uint8_t *)src_addr;
7381 		b_dst = (uint8_t *)dest_addr;
7382 
7383 		for (; bytecount != 0; bytecount -= 1) {
7384 			ddi_put8(dest_handle, b_dst,
7385 			    ddi_get8(src_handle, b_src));
7386 			b_dst += dest_advcnt;
7387 			b_src += src_advcnt;
7388 		}
7389 		break;
7390 	case DDI_DATA_SZ02_ACC:
7391 		w_src = (uint16_t *)src_addr;
7392 		w_dst = (uint16_t *)dest_addr;
7393 
7394 		for (; bytecount != 0; bytecount -= 2) {
7395 			ddi_put16(dest_handle, w_dst,
7396 			    ddi_get16(src_handle, w_src));
7397 			w_dst += dest_advcnt;
7398 			w_src += src_advcnt;
7399 		}
7400 		break;
7401 	case DDI_DATA_SZ04_ACC:
7402 		l_src = (uint32_t *)src_addr;
7403 		l_dst = (uint32_t *)dest_addr;
7404 
7405 		for (; bytecount != 0; bytecount -= 4) {
7406 			ddi_put32(dest_handle, l_dst,
7407 			    ddi_get32(src_handle, l_src));
7408 			l_dst += dest_advcnt;
7409 			l_src += src_advcnt;
7410 		}
7411 		break;
7412 	case DDI_DATA_SZ08_ACC:
7413 		ll_src = (uint64_t *)src_addr;
7414 		ll_dst = (uint64_t *)dest_addr;
7415 
7416 		for (; bytecount != 0; bytecount -= 8) {
7417 			ddi_put64(dest_handle, ll_dst,
7418 			    ddi_get64(src_handle, ll_src));
7419 			ll_dst += dest_advcnt;
7420 			ll_src += src_advcnt;
7421 		}
7422 		break;
7423 	default:
7424 		return (DDI_FAILURE);
7425 	}
7426 	return (DDI_SUCCESS);
7427 }
7428 
7429 #define	swap16(value)  \
7430 	((((value) & 0xff) << 8) | ((value) >> 8))
7431 
7432 #define	swap32(value)	\
7433 	(((uint32_t)swap16((uint16_t)((value) & 0xffff)) << 16) | \
7434 	(uint32_t)swap16((uint16_t)((value) >> 16)))
7435 
7436 #define	swap64(value)	\
7437 	(((uint64_t)swap32((uint32_t)((value) & 0xffffffff)) \
7438 	    << 32) | \
7439 	(uint64_t)swap32((uint32_t)((value) >> 32)))
7440 
7441 uint16_t
7442 ddi_swap16(uint16_t value)
7443 {
7444 	return (swap16(value));
7445 }
7446 
7447 uint32_t
7448 ddi_swap32(uint32_t value)
7449 {
7450 	return (swap32(value));
7451 }
7452 
7453 uint64_t
7454 ddi_swap64(uint64_t value)
7455 {
7456 	return (swap64(value));
7457 }
7458 
7459 /*
7460  * Convert a binding name to a driver name.
7461  * A binding name is the name used to determine the driver for a
7462  * device - it may be either an alias for the driver or the name
7463  * of the driver itself.
7464  */
7465 char *
7466 i_binding_to_drv_name(char *bname)
7467 {
7468 	major_t major_no;
7469 
7470 	ASSERT(bname != NULL);
7471 
7472 	if ((major_no = ddi_name_to_major(bname)) == -1)
7473 		return (NULL);
7474 	return (ddi_major_to_name(major_no));
7475 }
7476 
7477 /*
7478  * Search for minor name that has specified dev_t and spec_type.
7479  * If spec_type is zero then any dev_t match works.  Since we
7480  * are returning a pointer to the minor name string, we require the
7481  * caller to do the locking.
7482  */
7483 char *
7484 i_ddi_devtspectype_to_minorname(dev_info_t *dip, dev_t dev, int spec_type)
7485 {
7486 	struct ddi_minor_data	*dmdp;
7487 
7488 	/*
7489 	 * The did layered driver currently intentionally returns a
7490 	 * devinfo ptr for an underlying sd instance based on a did
7491 	 * dev_t. In this case it is not an error.
7492 	 *
7493 	 * The did layered driver is associated with Sun Cluster.
7494 	 */
7495 	ASSERT((ddi_driver_major(dip) == getmajor(dev)) ||
7496 	    (strcmp(ddi_major_to_name(getmajor(dev)), "did") == 0));
7497 
7498 	ASSERT(DEVI_BUSY_OWNED(dip));
7499 	for (dmdp = DEVI(dip)->devi_minor; dmdp; dmdp = dmdp->next) {
7500 		if (((dmdp->type == DDM_MINOR) ||
7501 		    (dmdp->type == DDM_INTERNAL_PATH) ||
7502 		    (dmdp->type == DDM_DEFAULT)) &&
7503 		    (dmdp->ddm_dev == dev) &&
7504 		    ((((spec_type & (S_IFCHR|S_IFBLK))) == 0) ||
7505 		    (dmdp->ddm_spec_type == spec_type)))
7506 			return (dmdp->ddm_name);
7507 	}
7508 
7509 	return (NULL);
7510 }
7511 
7512 /*
7513  * Find the devt and spectype of the specified minor_name.
7514  * Return DDI_FAILURE if minor_name not found. Since we are
7515  * returning everything via arguments we can do the locking.
7516  */
7517 int
7518 i_ddi_minorname_to_devtspectype(dev_info_t *dip, char *minor_name,
7519 	dev_t *devtp, int *spectypep)
7520 {
7521 	int			circ;
7522 	struct ddi_minor_data	*dmdp;
7523 
7524 	/* deal with clone minor nodes */
7525 	if (dip == clone_dip) {
7526 		major_t	major;
7527 		/*
7528 		 * Make sure minor_name is a STREAMS driver.
7529 		 * We load the driver but don't attach to any instances.
7530 		 */
7531 
7532 		major = ddi_name_to_major(minor_name);
7533 		if (major == DDI_MAJOR_T_NONE)
7534 			return (DDI_FAILURE);
7535 
7536 		if (ddi_hold_driver(major) == NULL)
7537 			return (DDI_FAILURE);
7538 
7539 		if (STREAMSTAB(major) == NULL) {
7540 			ddi_rele_driver(major);
7541 			return (DDI_FAILURE);
7542 		}
7543 		ddi_rele_driver(major);
7544 
7545 		if (devtp)
7546 			*devtp = makedevice(clone_major, (minor_t)major);
7547 
7548 		if (spectypep)
7549 			*spectypep = S_IFCHR;
7550 
7551 		return (DDI_SUCCESS);
7552 	}
7553 
7554 	ndi_devi_enter(dip, &circ);
7555 	for (dmdp = DEVI(dip)->devi_minor; dmdp; dmdp = dmdp->next) {
7556 		if (((dmdp->type != DDM_MINOR) &&
7557 		    (dmdp->type != DDM_INTERNAL_PATH) &&
7558 		    (dmdp->type != DDM_DEFAULT)) ||
7559 		    strcmp(minor_name, dmdp->ddm_name))
7560 			continue;
7561 
7562 		if (devtp)
7563 			*devtp = dmdp->ddm_dev;
7564 
7565 		if (spectypep)
7566 			*spectypep = dmdp->ddm_spec_type;
7567 
7568 		ndi_devi_exit(dip, circ);
7569 		return (DDI_SUCCESS);
7570 	}
7571 	ndi_devi_exit(dip, circ);
7572 
7573 	return (DDI_FAILURE);
7574 }
7575 
7576 static kmutex_t devid_gen_mutex;
7577 static short	devid_gen_number;
7578 
7579 #ifdef DEBUG
7580 
7581 static int	devid_register_corrupt = 0;
7582 static int	devid_register_corrupt_major = 0;
7583 static int	devid_register_corrupt_hint = 0;
7584 static int	devid_register_corrupt_hint_major = 0;
7585 
7586 static int devid_lyr_debug = 0;
7587 
7588 #define	DDI_DEBUG_DEVID_DEVTS(msg, ndevs, devs)		\
7589 	if (devid_lyr_debug)					\
7590 		ddi_debug_devid_devts(msg, ndevs, devs)
7591 
7592 #else
7593 
7594 #define	DDI_DEBUG_DEVID_DEVTS(msg, ndevs, devs)
7595 
7596 #endif /* DEBUG */
7597 
7598 
7599 #ifdef	DEBUG
7600 
7601 static void
7602 ddi_debug_devid_devts(char *msg, int ndevs, dev_t *devs)
7603 {
7604 	int i;
7605 
7606 	cmn_err(CE_CONT, "%s:\n", msg);
7607 	for (i = 0; i < ndevs; i++) {
7608 		cmn_err(CE_CONT, "    0x%lx\n", devs[i]);
7609 	}
7610 }
7611 
7612 static void
7613 ddi_debug_devid_paths(char *msg, int npaths, char **paths)
7614 {
7615 	int i;
7616 
7617 	cmn_err(CE_CONT, "%s:\n", msg);
7618 	for (i = 0; i < npaths; i++) {
7619 		cmn_err(CE_CONT, "    %s\n", paths[i]);
7620 	}
7621 }
7622 
7623 static void
7624 ddi_debug_devid_devts_per_path(char *path, int ndevs, dev_t *devs)
7625 {
7626 	int i;
7627 
7628 	cmn_err(CE_CONT, "dev_ts per path %s\n", path);
7629 	for (i = 0; i < ndevs; i++) {
7630 		cmn_err(CE_CONT, "    0x%lx\n", devs[i]);
7631 	}
7632 }
7633 
7634 #endif	/* DEBUG */
7635 
7636 /*
7637  * Register device id into DDI framework.
7638  * Must be called when the driver is bound.
7639  */
7640 static int
7641 i_ddi_devid_register(dev_info_t *dip, ddi_devid_t devid)
7642 {
7643 	impl_devid_t	*i_devid = (impl_devid_t *)devid;
7644 	size_t		driver_len;
7645 	const char	*driver_name;
7646 	char		*devid_str;
7647 	major_t		major;
7648 
7649 	if ((dip == NULL) ||
7650 	    ((major = ddi_driver_major(dip)) == DDI_MAJOR_T_NONE))
7651 		return (DDI_FAILURE);
7652 
7653 	/* verify that the devid is valid */
7654 	if (ddi_devid_valid(devid) != DDI_SUCCESS)
7655 		return (DDI_FAILURE);
7656 
7657 	/* Updating driver name hint in devid */
7658 	driver_name = ddi_driver_name(dip);
7659 	driver_len = strlen(driver_name);
7660 	if (driver_len > DEVID_HINT_SIZE) {
7661 		/* Pick up last four characters of driver name */
7662 		driver_name += driver_len - DEVID_HINT_SIZE;
7663 		driver_len = DEVID_HINT_SIZE;
7664 	}
7665 	bzero(i_devid->did_driver, DEVID_HINT_SIZE);
7666 	bcopy(driver_name, i_devid->did_driver, driver_len);
7667 
7668 #ifdef DEBUG
7669 	/* Corrupt the devid for testing. */
7670 	if (devid_register_corrupt)
7671 		i_devid->did_id[0] += devid_register_corrupt;
7672 	if (devid_register_corrupt_major &&
7673 	    (major == devid_register_corrupt_major))
7674 		i_devid->did_id[0] += 1;
7675 	if (devid_register_corrupt_hint)
7676 		i_devid->did_driver[0] += devid_register_corrupt_hint;
7677 	if (devid_register_corrupt_hint_major &&
7678 	    (major == devid_register_corrupt_hint_major))
7679 		i_devid->did_driver[0] += 1;
7680 #endif /* DEBUG */
7681 
7682 	/* encode the devid as a string */
7683 	if ((devid_str = ddi_devid_str_encode(devid, NULL)) == NULL)
7684 		return (DDI_FAILURE);
7685 
7686 	/* add string as a string property */
7687 	if (ndi_prop_update_string(DDI_DEV_T_NONE, dip,
7688 	    DEVID_PROP_NAME, devid_str) != DDI_SUCCESS) {
7689 		cmn_err(CE_WARN, "%s%d: devid property update failed",
7690 		    ddi_driver_name(dip), ddi_get_instance(dip));
7691 		ddi_devid_str_free(devid_str);
7692 		return (DDI_FAILURE);
7693 	}
7694 
7695 	/* keep pointer to devid string for interrupt context fma code */
7696 	if (DEVI(dip)->devi_devid_str)
7697 		ddi_devid_str_free(DEVI(dip)->devi_devid_str);
7698 	DEVI(dip)->devi_devid_str = devid_str;
7699 	return (DDI_SUCCESS);
7700 }
7701 
7702 int
7703 ddi_devid_register(dev_info_t *dip, ddi_devid_t devid)
7704 {
7705 	int rval;
7706 
7707 	rval = i_ddi_devid_register(dip, devid);
7708 	if (rval == DDI_SUCCESS) {
7709 		/*
7710 		 * Register devid in devid-to-path cache
7711 		 */
7712 		if (e_devid_cache_register(dip, devid) == DDI_SUCCESS) {
7713 			mutex_enter(&DEVI(dip)->devi_lock);
7714 			DEVI(dip)->devi_flags |= DEVI_CACHED_DEVID;
7715 			mutex_exit(&DEVI(dip)->devi_lock);
7716 		} else if (ddi_get_name_addr(dip)) {
7717 			/*
7718 			 * We only expect cache_register DDI_FAILURE when we
7719 			 * can't form the full path because of NULL devi_addr.
7720 			 */
7721 			cmn_err(CE_WARN, "%s%d: failed to cache devid",
7722 			    ddi_driver_name(dip), ddi_get_instance(dip));
7723 		}
7724 	} else {
7725 		cmn_err(CE_WARN, "%s%d: failed to register devid",
7726 		    ddi_driver_name(dip), ddi_get_instance(dip));
7727 	}
7728 	return (rval);
7729 }
7730 
7731 /*
7732  * Remove (unregister) device id from DDI framework.
7733  * Must be called when device is detached.
7734  */
7735 static void
7736 i_ddi_devid_unregister(dev_info_t *dip)
7737 {
7738 	if (DEVI(dip)->devi_devid_str) {
7739 		ddi_devid_str_free(DEVI(dip)->devi_devid_str);
7740 		DEVI(dip)->devi_devid_str = NULL;
7741 	}
7742 
7743 	/* remove the devid property */
7744 	(void) ndi_prop_remove(DDI_DEV_T_NONE, dip, DEVID_PROP_NAME);
7745 }
7746 
7747 void
7748 ddi_devid_unregister(dev_info_t *dip)
7749 {
7750 	mutex_enter(&DEVI(dip)->devi_lock);
7751 	DEVI(dip)->devi_flags &= ~DEVI_CACHED_DEVID;
7752 	mutex_exit(&DEVI(dip)->devi_lock);
7753 	e_devid_cache_unregister(dip);
7754 	i_ddi_devid_unregister(dip);
7755 }
7756 
7757 /*
7758  * Allocate and initialize a device id.
7759  */
7760 int
7761 ddi_devid_init(
7762 	dev_info_t	*dip,
7763 	ushort_t	devid_type,
7764 	ushort_t	nbytes,
7765 	void		*id,
7766 	ddi_devid_t	*ret_devid)
7767 {
7768 	impl_devid_t	*i_devid;
7769 	int		sz = sizeof (*i_devid) + nbytes - sizeof (char);
7770 	int		driver_len;
7771 	const char	*driver_name;
7772 
7773 	switch (devid_type) {
7774 	case DEVID_SCSI3_WWN:
7775 		/*FALLTHRU*/
7776 	case DEVID_SCSI_SERIAL:
7777 		/*FALLTHRU*/
7778 	case DEVID_ATA_SERIAL:
7779 		/*FALLTHRU*/
7780 	case DEVID_ENCAP:
7781 		if (nbytes == 0)
7782 			return (DDI_FAILURE);
7783 		if (id == NULL)
7784 			return (DDI_FAILURE);
7785 		break;
7786 	case DEVID_FAB:
7787 		if (nbytes != 0)
7788 			return (DDI_FAILURE);
7789 		if (id != NULL)
7790 			return (DDI_FAILURE);
7791 		nbytes = sizeof (int) +
7792 		    sizeof (struct timeval32) + sizeof (short);
7793 		sz += nbytes;
7794 		break;
7795 	default:
7796 		return (DDI_FAILURE);
7797 	}
7798 
7799 	if ((i_devid = kmem_zalloc(sz, KM_SLEEP)) == NULL)
7800 		return (DDI_FAILURE);
7801 
7802 	i_devid->did_magic_hi = DEVID_MAGIC_MSB;
7803 	i_devid->did_magic_lo = DEVID_MAGIC_LSB;
7804 	i_devid->did_rev_hi = DEVID_REV_MSB;
7805 	i_devid->did_rev_lo = DEVID_REV_LSB;
7806 	DEVID_FORMTYPE(i_devid, devid_type);
7807 	DEVID_FORMLEN(i_devid, nbytes);
7808 
7809 	/* Fill in driver name hint */
7810 	driver_name = ddi_driver_name(dip);
7811 	driver_len = strlen(driver_name);
7812 	if (driver_len > DEVID_HINT_SIZE) {
7813 		/* Pick up last four characters of driver name */
7814 		driver_name += driver_len - DEVID_HINT_SIZE;
7815 		driver_len = DEVID_HINT_SIZE;
7816 	}
7817 
7818 	bcopy(driver_name, i_devid->did_driver, driver_len);
7819 
7820 	/* Fill in id field */
7821 	if (devid_type == DEVID_FAB) {
7822 		char		*cp;
7823 		uint32_t	hostid;
7824 		struct timeval32 timestamp32;
7825 		int		i;
7826 		int		*ip;
7827 		short		gen;
7828 
7829 		/* increase the generation number */
7830 		mutex_enter(&devid_gen_mutex);
7831 		gen = devid_gen_number++;
7832 		mutex_exit(&devid_gen_mutex);
7833 
7834 		cp = i_devid->did_id;
7835 
7836 		/* Fill in host id (big-endian byte ordering) */
7837 		hostid = zone_get_hostid(NULL);
7838 		*cp++ = hibyte(hiword(hostid));
7839 		*cp++ = lobyte(hiword(hostid));
7840 		*cp++ = hibyte(loword(hostid));
7841 		*cp++ = lobyte(loword(hostid));
7842 
7843 		/*
7844 		 * Fill in timestamp (big-endian byte ordering)
7845 		 *
7846 		 * (Note that the format may have to be changed
7847 		 * before 2038 comes around, though it's arguably
7848 		 * unique enough as it is..)
7849 		 */
7850 		uniqtime32(&timestamp32);
7851 		ip = (int *)&timestamp32;
7852 		for (i = 0;
7853 		    i < sizeof (timestamp32) / sizeof (int); i++, ip++) {
7854 			int	val;
7855 			val = *ip;
7856 			*cp++ = hibyte(hiword(val));
7857 			*cp++ = lobyte(hiword(val));
7858 			*cp++ = hibyte(loword(val));
7859 			*cp++ = lobyte(loword(val));
7860 		}
7861 
7862 		/* fill in the generation number */
7863 		*cp++ = hibyte(gen);
7864 		*cp++ = lobyte(gen);
7865 	} else
7866 		bcopy(id, i_devid->did_id, nbytes);
7867 
7868 	/* return device id */
7869 	*ret_devid = (ddi_devid_t)i_devid;
7870 	return (DDI_SUCCESS);
7871 }
7872 
7873 int
7874 ddi_devid_get(dev_info_t *dip, ddi_devid_t *ret_devid)
7875 {
7876 	return (i_ddi_devi_get_devid(DDI_DEV_T_ANY, dip, ret_devid));
7877 }
7878 
7879 int
7880 i_ddi_devi_get_devid(dev_t dev, dev_info_t *dip, ddi_devid_t *ret_devid)
7881 {
7882 	char		*devidstr;
7883 
7884 	ASSERT(dev != DDI_DEV_T_NONE);
7885 
7886 	/* look up the property, devt specific first */
7887 	if (ddi_prop_lookup_string(dev, dip, DDI_PROP_DONTPASS,
7888 	    DEVID_PROP_NAME, &devidstr) != DDI_PROP_SUCCESS) {
7889 		if ((dev == DDI_DEV_T_ANY) ||
7890 		    (ddi_prop_lookup_string(DDI_DEV_T_ANY, dip,
7891 		    DDI_PROP_DONTPASS, DEVID_PROP_NAME, &devidstr) !=
7892 		    DDI_PROP_SUCCESS)) {
7893 			return (DDI_FAILURE);
7894 		}
7895 	}
7896 
7897 	/* convert to binary form */
7898 	if (ddi_devid_str_decode(devidstr, ret_devid, NULL) == -1) {
7899 		ddi_prop_free(devidstr);
7900 		return (DDI_FAILURE);
7901 	}
7902 	ddi_prop_free(devidstr);
7903 	return (DDI_SUCCESS);
7904 }
7905 
7906 /*
7907  * Return a copy of the device id for dev_t
7908  */
7909 int
7910 ddi_lyr_get_devid(dev_t dev, ddi_devid_t *ret_devid)
7911 {
7912 	dev_info_t	*dip;
7913 	int		rval;
7914 
7915 	/* get the dip */
7916 	if ((dip = e_ddi_hold_devi_by_dev(dev, 0)) == NULL)
7917 		return (DDI_FAILURE);
7918 
7919 	rval = i_ddi_devi_get_devid(dev, dip, ret_devid);
7920 
7921 	ddi_release_devi(dip);		/* e_ddi_hold_devi_by_dev() */
7922 	return (rval);
7923 }
7924 
7925 /*
7926  * Return a copy of the minor name for dev_t and spec_type
7927  */
7928 int
7929 ddi_lyr_get_minor_name(dev_t dev, int spec_type, char **minor_name)
7930 {
7931 	char		*buf;
7932 	int		circ;
7933 	dev_info_t	*dip;
7934 	char		*nm;
7935 	int		rval;
7936 
7937 	if ((dip = e_ddi_hold_devi_by_dev(dev, 0)) == NULL) {
7938 		*minor_name = NULL;
7939 		return (DDI_FAILURE);
7940 	}
7941 
7942 	/* Find the minor name and copy into max size buf */
7943 	buf = kmem_alloc(MAXNAMELEN, KM_SLEEP);
7944 	ndi_devi_enter(dip, &circ);
7945 	nm = i_ddi_devtspectype_to_minorname(dip, dev, spec_type);
7946 	if (nm)
7947 		(void) strcpy(buf, nm);
7948 	ndi_devi_exit(dip, circ);
7949 	ddi_release_devi(dip);	/* e_ddi_hold_devi_by_dev() */
7950 
7951 	if (nm) {
7952 		/* duplicate into min size buf for return result */
7953 		*minor_name = i_ddi_strdup(buf, KM_SLEEP);
7954 		rval = DDI_SUCCESS;
7955 	} else {
7956 		*minor_name = NULL;
7957 		rval = DDI_FAILURE;
7958 	}
7959 
7960 	/* free max size buf and return */
7961 	kmem_free(buf, MAXNAMELEN);
7962 	return (rval);
7963 }
7964 
7965 int
7966 ddi_lyr_devid_to_devlist(
7967 	ddi_devid_t	devid,
7968 	char		*minor_name,
7969 	int		*retndevs,
7970 	dev_t		**retdevs)
7971 {
7972 	ASSERT(ddi_devid_valid(devid) == DDI_SUCCESS);
7973 
7974 	if (e_devid_cache_to_devt_list(devid, minor_name,
7975 	    retndevs, retdevs) == DDI_SUCCESS) {
7976 		ASSERT(*retndevs > 0);
7977 		DDI_DEBUG_DEVID_DEVTS("ddi_lyr_devid_to_devlist",
7978 		    *retndevs, *retdevs);
7979 		return (DDI_SUCCESS);
7980 	}
7981 
7982 	if (e_ddi_devid_discovery(devid) == DDI_FAILURE) {
7983 		return (DDI_FAILURE);
7984 	}
7985 
7986 	if (e_devid_cache_to_devt_list(devid, minor_name,
7987 	    retndevs, retdevs) == DDI_SUCCESS) {
7988 		ASSERT(*retndevs > 0);
7989 		DDI_DEBUG_DEVID_DEVTS("ddi_lyr_devid_to_devlist",
7990 		    *retndevs, *retdevs);
7991 		return (DDI_SUCCESS);
7992 	}
7993 
7994 	return (DDI_FAILURE);
7995 }
7996 
7997 void
7998 ddi_lyr_free_devlist(dev_t *devlist, int ndevs)
7999 {
8000 	kmem_free(devlist, sizeof (dev_t) * ndevs);
8001 }
8002 
8003 /*
8004  * Note: This will need to be fixed if we ever allow processes to
8005  * have more than one data model per exec.
8006  */
8007 model_t
8008 ddi_mmap_get_model(void)
8009 {
8010 	return (get_udatamodel());
8011 }
8012 
8013 model_t
8014 ddi_model_convert_from(model_t model)
8015 {
8016 	return ((model & DDI_MODEL_MASK) & ~DDI_MODEL_NATIVE);
8017 }
8018 
8019 /*
8020  * ddi interfaces managing storage and retrieval of eventcookies.
8021  */
8022 
8023 /*
8024  * Invoke bus nexus driver's implementation of the
8025  * (*bus_remove_eventcall)() interface to remove a registered
8026  * callback handler for "event".
8027  */
8028 int
8029 ddi_remove_event_handler(ddi_callback_id_t id)
8030 {
8031 	ndi_event_callbacks_t *cb = (ndi_event_callbacks_t *)id;
8032 	dev_info_t *ddip;
8033 
8034 	ASSERT(cb);
8035 	if (!cb) {
8036 		return (DDI_FAILURE);
8037 	}
8038 
8039 	ddip = NDI_EVENT_DDIP(cb->ndi_evtcb_cookie);
8040 	return (ndi_busop_remove_eventcall(ddip, id));
8041 }
8042 
8043 /*
8044  * Invoke bus nexus driver's implementation of the
8045  * (*bus_add_eventcall)() interface to register a callback handler
8046  * for "event".
8047  */
8048 int
8049 ddi_add_event_handler(dev_info_t *dip, ddi_eventcookie_t event,
8050     void (*handler)(dev_info_t *, ddi_eventcookie_t, void *, void *),
8051     void *arg, ddi_callback_id_t *id)
8052 {
8053 	return (ndi_busop_add_eventcall(dip, dip, event, handler, arg, id));
8054 }
8055 
8056 
8057 /*
8058  * Return a handle for event "name" by calling up the device tree
8059  * hierarchy via  (*bus_get_eventcookie)() interface until claimed
8060  * by a bus nexus or top of dev_info tree is reached.
8061  */
8062 int
8063 ddi_get_eventcookie(dev_info_t *dip, char *name,
8064     ddi_eventcookie_t *event_cookiep)
8065 {
8066 	return (ndi_busop_get_eventcookie(dip, dip,
8067 	    name, event_cookiep));
8068 }
8069 
8070 /*
8071  * This procedure is provided as the general callback function when
8072  * umem_lockmemory calls as_add_callback for long term memory locking.
8073  * When as_unmap, as_setprot, or as_free encounter segments which have
8074  * locked memory, this callback will be invoked.
8075  */
8076 void
8077 umem_lock_undo(struct as *as, void *arg, uint_t event)
8078 {
8079 	_NOTE(ARGUNUSED(as, event))
8080 	struct ddi_umem_cookie *cp = (struct ddi_umem_cookie *)arg;
8081 
8082 	/*
8083 	 * Call the cleanup function.  Decrement the cookie reference
8084 	 * count, if it goes to zero, return the memory for the cookie.
8085 	 * The i_ddi_umem_unlock for this cookie may or may not have been
8086 	 * called already.  It is the responsibility of the caller of
8087 	 * umem_lockmemory to handle the case of the cleanup routine
8088 	 * being called after a ddi_umem_unlock for the cookie
8089 	 * was called.
8090 	 */
8091 
8092 	(*cp->callbacks.cbo_umem_lock_cleanup)((ddi_umem_cookie_t)cp);
8093 
8094 	/* remove the cookie if reference goes to zero */
8095 	if (atomic_dec_ulong_nv((ulong_t *)(&(cp->cook_refcnt))) == 0) {
8096 		kmem_free(cp, sizeof (struct ddi_umem_cookie));
8097 	}
8098 }
8099 
8100 /*
8101  * The following two Consolidation Private routines provide generic
8102  * interfaces to increase/decrease the amount of device-locked memory.
8103  *
8104  * To keep project_rele and project_hold consistent, i_ddi_decr_locked_memory()
8105  * must be called every time i_ddi_incr_locked_memory() is called.
8106  */
8107 int
8108 /* ARGSUSED */
8109 i_ddi_incr_locked_memory(proc_t *procp, rctl_qty_t inc)
8110 {
8111 	ASSERT(procp != NULL);
8112 	mutex_enter(&procp->p_lock);
8113 	if (rctl_incr_locked_mem(procp, NULL, inc, 1)) {
8114 		mutex_exit(&procp->p_lock);
8115 		return (ENOMEM);
8116 	}
8117 	mutex_exit(&procp->p_lock);
8118 	return (0);
8119 }
8120 
8121 /*
8122  * To keep project_rele and project_hold consistent, i_ddi_incr_locked_memory()
8123  * must be called every time i_ddi_decr_locked_memory() is called.
8124  */
8125 /* ARGSUSED */
8126 void
8127 i_ddi_decr_locked_memory(proc_t *procp, rctl_qty_t dec)
8128 {
8129 	ASSERT(procp != NULL);
8130 	mutex_enter(&procp->p_lock);
8131 	rctl_decr_locked_mem(procp, NULL, dec, 1);
8132 	mutex_exit(&procp->p_lock);
8133 }
8134 
8135 /*
8136  * The cookie->upd_max_lock_rctl flag is used to determine if we should
8137  * charge device locked memory to the max-locked-memory rctl.  Tracking
8138  * device locked memory causes the rctl locks to get hot under high-speed
8139  * I/O such as RDSv3 over IB.  If there is no max-locked-memory rctl limit,
8140  * we bypass charging the locked memory to the rctl altogether.  The cookie's
8141  * flag tells us if the rctl value should be updated when unlocking the memory,
8142  * in case the rctl gets changed after the memory was locked.  Any device
8143  * locked memory in that rare case will not be counted toward the rctl limit.
8144  *
8145  * When tracking the locked memory, the kproject_t parameter is always NULL
8146  * in the code paths:
8147  *	i_ddi_incr_locked_memory -> rctl_incr_locked_mem
8148  *	i_ddi_decr_locked_memory -> rctl_decr_locked_mem
8149  * Thus, we always use the tk_proj member to check the projp setting.
8150  */
8151 static void
8152 init_lockedmem_rctl_flag(struct ddi_umem_cookie *cookie)
8153 {
8154 	proc_t		*p;
8155 	kproject_t	*projp;
8156 	zone_t		*zonep;
8157 
8158 	ASSERT(cookie);
8159 	p = cookie->procp;
8160 	ASSERT(p);
8161 
8162 	zonep = p->p_zone;
8163 	projp = p->p_task->tk_proj;
8164 
8165 	ASSERT(zonep);
8166 	ASSERT(projp);
8167 
8168 	if (zonep->zone_locked_mem_ctl == UINT64_MAX &&
8169 	    projp->kpj_data.kpd_locked_mem_ctl == UINT64_MAX)
8170 		cookie->upd_max_lock_rctl = 0;
8171 	else
8172 		cookie->upd_max_lock_rctl = 1;
8173 }
8174 
8175 /*
8176  * This routine checks if the max-locked-memory resource ctl is
8177  * exceeded, if not increments it, grabs a hold on the project.
8178  * Returns 0 if successful otherwise returns error code
8179  */
8180 static int
8181 umem_incr_devlockmem(struct ddi_umem_cookie *cookie)
8182 {
8183 	proc_t		*procp;
8184 	int		ret;
8185 
8186 	ASSERT(cookie);
8187 	if (cookie->upd_max_lock_rctl == 0)
8188 		return (0);
8189 
8190 	procp = cookie->procp;
8191 	ASSERT(procp);
8192 
8193 	if ((ret = i_ddi_incr_locked_memory(procp,
8194 	    cookie->size)) != 0) {
8195 		return (ret);
8196 	}
8197 	return (0);
8198 }
8199 
8200 /*
8201  * Decrements the max-locked-memory resource ctl and releases
8202  * the hold on the project that was acquired during umem_incr_devlockmem
8203  */
8204 static void
8205 umem_decr_devlockmem(struct ddi_umem_cookie *cookie)
8206 {
8207 	proc_t		*proc;
8208 
8209 	if (cookie->upd_max_lock_rctl == 0)
8210 		return;
8211 
8212 	proc = (proc_t *)cookie->procp;
8213 	if (!proc)
8214 		return;
8215 
8216 	i_ddi_decr_locked_memory(proc, cookie->size);
8217 }
8218 
8219 /*
8220  * A consolidation private function which is essentially equivalent to
8221  * ddi_umem_lock but with the addition of arguments ops_vector and procp.
8222  * A call to as_add_callback is done if DDI_UMEMLOCK_LONGTERM is set, and
8223  * the ops_vector is valid.
8224  *
8225  * Lock the virtual address range in the current process and create a
8226  * ddi_umem_cookie (of type UMEM_LOCKED). This can be used to pass to
8227  * ddi_umem_iosetup to create a buf or do devmap_umem_setup/remap to export
8228  * to user space.
8229  *
8230  * Note: The resource control accounting currently uses a full charge model
8231  * in other words attempts to lock the same/overlapping areas of memory
8232  * will deduct the full size of the buffer from the projects running
8233  * counter for the device locked memory.
8234  *
8235  * addr, size should be PAGESIZE aligned
8236  *
8237  * flags - DDI_UMEMLOCK_READ, DDI_UMEMLOCK_WRITE or both
8238  *	identifies whether the locked memory will be read or written or both
8239  *      DDI_UMEMLOCK_LONGTERM  must be set when the locking will
8240  * be maintained for an indefinitely long period (essentially permanent),
8241  * rather than for what would be required for a typical I/O completion.
8242  * When DDI_UMEMLOCK_LONGTERM is set, umem_lockmemory will return EFAULT
8243  * if the memory pertains to a regular file which is mapped MAP_SHARED.
8244  * This is to prevent a deadlock if a file truncation is attempted after
8245  * after the locking is done.
8246  *
8247  * Returns 0 on success
8248  *	EINVAL - for invalid parameters
8249  *	EPERM, ENOMEM and other error codes returned by as_pagelock
8250  *	ENOMEM - is returned if the current request to lock memory exceeds
8251  *		*.max-locked-memory resource control value.
8252  *      EFAULT - memory pertains to a regular file mapped shared and
8253  *		and DDI_UMEMLOCK_LONGTERM flag is set
8254  *	EAGAIN - could not start the ddi_umem_unlock list processing thread
8255  */
8256 int
8257 umem_lockmemory(caddr_t addr, size_t len, int flags, ddi_umem_cookie_t *cookie,
8258 		struct umem_callback_ops *ops_vector,
8259 		proc_t *procp)
8260 {
8261 	int	error;
8262 	struct ddi_umem_cookie *p;
8263 	void	(*driver_callback)() = NULL;
8264 	struct as *as;
8265 	struct seg		*seg;
8266 	vnode_t			*vp;
8267 
8268 	/* Allow device drivers to not have to reference "curproc" */
8269 	if (procp == NULL)
8270 		procp = curproc;
8271 	as = procp->p_as;
8272 	*cookie = NULL;		/* in case of any error return */
8273 
8274 	/* These are the only three valid flags */
8275 	if ((flags & ~(DDI_UMEMLOCK_READ | DDI_UMEMLOCK_WRITE |
8276 	    DDI_UMEMLOCK_LONGTERM)) != 0)
8277 		return (EINVAL);
8278 
8279 	/* At least one (can be both) of the two access flags must be set */
8280 	if ((flags & (DDI_UMEMLOCK_READ | DDI_UMEMLOCK_WRITE)) == 0)
8281 		return (EINVAL);
8282 
8283 	/* addr and len must be page-aligned */
8284 	if (((uintptr_t)addr & PAGEOFFSET) != 0)
8285 		return (EINVAL);
8286 
8287 	if ((len & PAGEOFFSET) != 0)
8288 		return (EINVAL);
8289 
8290 	/*
8291 	 * For longterm locking a driver callback must be specified; if
8292 	 * not longterm then a callback is optional.
8293 	 */
8294 	if (ops_vector != NULL) {
8295 		if (ops_vector->cbo_umem_callback_version !=
8296 		    UMEM_CALLBACK_VERSION)
8297 			return (EINVAL);
8298 		else
8299 			driver_callback = ops_vector->cbo_umem_lock_cleanup;
8300 	}
8301 	if ((driver_callback == NULL) && (flags & DDI_UMEMLOCK_LONGTERM))
8302 		return (EINVAL);
8303 
8304 	/*
8305 	 * Call i_ddi_umem_unlock_thread_start if necessary.  It will
8306 	 * be called on first ddi_umem_lock or umem_lockmemory call.
8307 	 */
8308 	if (ddi_umem_unlock_thread == NULL)
8309 		i_ddi_umem_unlock_thread_start();
8310 
8311 	/* Allocate memory for the cookie */
8312 	p = kmem_zalloc(sizeof (struct ddi_umem_cookie), KM_SLEEP);
8313 
8314 	/* Convert the flags to seg_rw type */
8315 	if (flags & DDI_UMEMLOCK_WRITE) {
8316 		p->s_flags = S_WRITE;
8317 	} else {
8318 		p->s_flags = S_READ;
8319 	}
8320 
8321 	/* Store procp in cookie for later iosetup/unlock */
8322 	p->procp = (void *)procp;
8323 
8324 	/*
8325 	 * Store the struct as pointer in cookie for later use by
8326 	 * ddi_umem_unlock.  The proc->p_as will be stale if ddi_umem_unlock
8327 	 * is called after relvm is called.
8328 	 */
8329 	p->asp = as;
8330 
8331 	/*
8332 	 * The size field is needed for lockmem accounting.
8333 	 */
8334 	p->size = len;
8335 	init_lockedmem_rctl_flag(p);
8336 
8337 	if (umem_incr_devlockmem(p) != 0) {
8338 		/*
8339 		 * The requested memory cannot be locked
8340 		 */
8341 		kmem_free(p, sizeof (struct ddi_umem_cookie));
8342 		*cookie = (ddi_umem_cookie_t)NULL;
8343 		return (ENOMEM);
8344 	}
8345 
8346 	/* Lock the pages corresponding to addr, len in memory */
8347 	error = as_pagelock(as, &(p->pparray), addr, len, p->s_flags);
8348 	if (error != 0) {
8349 		umem_decr_devlockmem(p);
8350 		kmem_free(p, sizeof (struct ddi_umem_cookie));
8351 		*cookie = (ddi_umem_cookie_t)NULL;
8352 		return (error);
8353 	}
8354 
8355 	/*
8356 	 * For longterm locking the addr must pertain to a seg_vn segment or
8357 	 * or a seg_spt segment.
8358 	 * If the segment pertains to a regular file, it cannot be
8359 	 * mapped MAP_SHARED.
8360 	 * This is to prevent a deadlock if a file truncation is attempted
8361 	 * after the locking is done.
8362 	 * Doing this after as_pagelock guarantees persistence of the as; if
8363 	 * an unacceptable segment is found, the cleanup includes calling
8364 	 * as_pageunlock before returning EFAULT.
8365 	 *
8366 	 * segdev is allowed here as it is already locked.  This allows
8367 	 * for memory exported by drivers through mmap() (which is already
8368 	 * locked) to be allowed for LONGTERM.
8369 	 */
8370 	if (flags & DDI_UMEMLOCK_LONGTERM) {
8371 		extern  struct seg_ops segspt_shmops;
8372 		extern	struct seg_ops segdev_ops;
8373 		AS_LOCK_ENTER(as, &as->a_lock, RW_READER);
8374 		for (seg = as_segat(as, addr); ; seg = AS_SEGNEXT(as, seg)) {
8375 			if (seg == NULL || seg->s_base > addr + len)
8376 				break;
8377 			if (seg->s_ops == &segdev_ops)
8378 				continue;
8379 			if (((seg->s_ops != &segvn_ops) &&
8380 			    (seg->s_ops != &segspt_shmops)) ||
8381 			    ((SEGOP_GETVP(seg, addr, &vp) == 0 &&
8382 			    vp != NULL && vp->v_type == VREG) &&
8383 			    (SEGOP_GETTYPE(seg, addr) & MAP_SHARED))) {
8384 				as_pageunlock(as, p->pparray,
8385 				    addr, len, p->s_flags);
8386 				AS_LOCK_EXIT(as, &as->a_lock);
8387 				umem_decr_devlockmem(p);
8388 				kmem_free(p, sizeof (struct ddi_umem_cookie));
8389 				*cookie = (ddi_umem_cookie_t)NULL;
8390 				return (EFAULT);
8391 			}
8392 		}
8393 		AS_LOCK_EXIT(as, &as->a_lock);
8394 	}
8395 
8396 
8397 	/* Initialize the fields in the ddi_umem_cookie */
8398 	p->cvaddr = addr;
8399 	p->type = UMEM_LOCKED;
8400 	if (driver_callback != NULL) {
8401 		/* i_ddi_umem_unlock and umem_lock_undo may need the cookie */
8402 		p->cook_refcnt = 2;
8403 		p->callbacks = *ops_vector;
8404 	} else {
8405 		/* only i_ddi_umme_unlock needs the cookie */
8406 		p->cook_refcnt = 1;
8407 	}
8408 
8409 	*cookie = (ddi_umem_cookie_t)p;
8410 
8411 	/*
8412 	 * If a driver callback was specified, add an entry to the
8413 	 * as struct callback list. The as_pagelock above guarantees
8414 	 * the persistence of as.
8415 	 */
8416 	if (driver_callback) {
8417 		error = as_add_callback(as, umem_lock_undo, p, AS_ALL_EVENT,
8418 		    addr, len, KM_SLEEP);
8419 		if (error != 0) {
8420 			as_pageunlock(as, p->pparray,
8421 			    addr, len, p->s_flags);
8422 			umem_decr_devlockmem(p);
8423 			kmem_free(p, sizeof (struct ddi_umem_cookie));
8424 			*cookie = (ddi_umem_cookie_t)NULL;
8425 		}
8426 	}
8427 	return (error);
8428 }
8429 
8430 /*
8431  * Unlock the pages locked by ddi_umem_lock or umem_lockmemory and free
8432  * the cookie.  Called from i_ddi_umem_unlock_thread.
8433  */
8434 
8435 static void
8436 i_ddi_umem_unlock(struct ddi_umem_cookie *p)
8437 {
8438 	uint_t	rc;
8439 
8440 	/*
8441 	 * There is no way to determine whether a callback to
8442 	 * umem_lock_undo was registered via as_add_callback.
8443 	 * (i.e. umem_lockmemory was called with DDI_MEMLOCK_LONGTERM and
8444 	 * a valid callback function structure.)  as_delete_callback
8445 	 * is called to delete a possible registered callback.  If the
8446 	 * return from as_delete_callbacks is AS_CALLBACK_DELETED, it
8447 	 * indicates that there was a callback registered, and that is was
8448 	 * successfully deleted.  Thus, the cookie reference count
8449 	 * will never be decremented by umem_lock_undo.  Just return the
8450 	 * memory for the cookie, since both users of the cookie are done.
8451 	 * A return of AS_CALLBACK_NOTFOUND indicates a callback was
8452 	 * never registered.  A return of AS_CALLBACK_DELETE_DEFERRED
8453 	 * indicates that callback processing is taking place and, and
8454 	 * umem_lock_undo is, or will be, executing, and thus decrementing
8455 	 * the cookie reference count when it is complete.
8456 	 *
8457 	 * This needs to be done before as_pageunlock so that the
8458 	 * persistence of as is guaranteed because of the locked pages.
8459 	 *
8460 	 */
8461 	rc = as_delete_callback(p->asp, p);
8462 
8463 
8464 	/*
8465 	 * The proc->p_as will be stale if i_ddi_umem_unlock is called
8466 	 * after relvm is called so use p->asp.
8467 	 */
8468 	as_pageunlock(p->asp, p->pparray, p->cvaddr, p->size, p->s_flags);
8469 
8470 	/*
8471 	 * Now that we have unlocked the memory decrement the
8472 	 * *.max-locked-memory rctl
8473 	 */
8474 	umem_decr_devlockmem(p);
8475 
8476 	if (rc == AS_CALLBACK_DELETED) {
8477 		/* umem_lock_undo will not happen, return the cookie memory */
8478 		ASSERT(p->cook_refcnt == 2);
8479 		kmem_free(p, sizeof (struct ddi_umem_cookie));
8480 	} else {
8481 		/*
8482 		 * umem_undo_lock may happen if as_delete_callback returned
8483 		 * AS_CALLBACK_DELETE_DEFERRED.  In that case, decrement the
8484 		 * reference count, atomically, and return the cookie
8485 		 * memory if the reference count goes to zero.  The only
8486 		 * other value for rc is AS_CALLBACK_NOTFOUND.  In that
8487 		 * case, just return the cookie memory.
8488 		 */
8489 		if ((rc != AS_CALLBACK_DELETE_DEFERRED) ||
8490 		    (atomic_dec_ulong_nv((ulong_t *)(&(p->cook_refcnt)))
8491 		    == 0)) {
8492 			kmem_free(p, sizeof (struct ddi_umem_cookie));
8493 		}
8494 	}
8495 }
8496 
8497 /*
8498  * i_ddi_umem_unlock_thread - deferred ddi_umem_unlock list handler.
8499  *
8500  * Call i_ddi_umem_unlock for entries in the ddi_umem_unlock list
8501  * until it is empty.  Then, wait for more to be added.  This thread is awoken
8502  * via calls to ddi_umem_unlock.
8503  */
8504 
8505 static void
8506 i_ddi_umem_unlock_thread(void)
8507 {
8508 	struct ddi_umem_cookie	*ret_cookie;
8509 	callb_cpr_t	cprinfo;
8510 
8511 	/* process the ddi_umem_unlock list */
8512 	CALLB_CPR_INIT(&cprinfo, &ddi_umem_unlock_mutex,
8513 	    callb_generic_cpr, "unlock_thread");
8514 	for (;;) {
8515 		mutex_enter(&ddi_umem_unlock_mutex);
8516 		if (ddi_umem_unlock_head != NULL) {	/* list not empty */
8517 			ret_cookie = ddi_umem_unlock_head;
8518 			/* take if off the list */
8519 			if ((ddi_umem_unlock_head =
8520 			    ddi_umem_unlock_head->unl_forw) == NULL) {
8521 				ddi_umem_unlock_tail = NULL;
8522 			}
8523 			mutex_exit(&ddi_umem_unlock_mutex);
8524 			/* unlock the pages in this cookie */
8525 			(void) i_ddi_umem_unlock(ret_cookie);
8526 		} else {   /* list is empty, wait for next ddi_umem_unlock */
8527 			CALLB_CPR_SAFE_BEGIN(&cprinfo);
8528 			cv_wait(&ddi_umem_unlock_cv, &ddi_umem_unlock_mutex);
8529 			CALLB_CPR_SAFE_END(&cprinfo, &ddi_umem_unlock_mutex);
8530 			mutex_exit(&ddi_umem_unlock_mutex);
8531 		}
8532 	}
8533 	/* ddi_umem_unlock_thread does not exit */
8534 	/* NOTREACHED */
8535 }
8536 
8537 /*
8538  * Start the thread that will process the ddi_umem_unlock list if it is
8539  * not already started (i_ddi_umem_unlock_thread).
8540  */
8541 static void
8542 i_ddi_umem_unlock_thread_start(void)
8543 {
8544 	mutex_enter(&ddi_umem_unlock_mutex);
8545 	if (ddi_umem_unlock_thread == NULL) {
8546 		ddi_umem_unlock_thread = thread_create(NULL, 0,
8547 		    i_ddi_umem_unlock_thread, NULL, 0, &p0,
8548 		    TS_RUN, minclsyspri);
8549 	}
8550 	mutex_exit(&ddi_umem_unlock_mutex);
8551 }
8552 
8553 /*
8554  * Lock the virtual address range in the current process and create a
8555  * ddi_umem_cookie (of type UMEM_LOCKED). This can be used to pass to
8556  * ddi_umem_iosetup to create a buf or do devmap_umem_setup/remap to export
8557  * to user space.
8558  *
8559  * Note: The resource control accounting currently uses a full charge model
8560  * in other words attempts to lock the same/overlapping areas of memory
8561  * will deduct the full size of the buffer from the projects running
8562  * counter for the device locked memory. This applies to umem_lockmemory too.
8563  *
8564  * addr, size should be PAGESIZE aligned
8565  * flags - DDI_UMEMLOCK_READ, DDI_UMEMLOCK_WRITE or both
8566  *	identifies whether the locked memory will be read or written or both
8567  *
8568  * Returns 0 on success
8569  *	EINVAL - for invalid parameters
8570  *	EPERM, ENOMEM and other error codes returned by as_pagelock
8571  *	ENOMEM - is returned if the current request to lock memory exceeds
8572  *		*.max-locked-memory resource control value.
8573  *	EAGAIN - could not start the ddi_umem_unlock list processing thread
8574  */
8575 int
8576 ddi_umem_lock(caddr_t addr, size_t len, int flags, ddi_umem_cookie_t *cookie)
8577 {
8578 	int	error;
8579 	struct ddi_umem_cookie *p;
8580 
8581 	*cookie = NULL;		/* in case of any error return */
8582 
8583 	/* These are the only two valid flags */
8584 	if ((flags & ~(DDI_UMEMLOCK_READ | DDI_UMEMLOCK_WRITE)) != 0) {
8585 		return (EINVAL);
8586 	}
8587 
8588 	/* At least one of the two flags (or both) must be set */
8589 	if ((flags & (DDI_UMEMLOCK_READ | DDI_UMEMLOCK_WRITE)) == 0) {
8590 		return (EINVAL);
8591 	}
8592 
8593 	/* addr and len must be page-aligned */
8594 	if (((uintptr_t)addr & PAGEOFFSET) != 0) {
8595 		return (EINVAL);
8596 	}
8597 
8598 	if ((len & PAGEOFFSET) != 0) {
8599 		return (EINVAL);
8600 	}
8601 
8602 	/*
8603 	 * Call i_ddi_umem_unlock_thread_start if necessary.  It will
8604 	 * be called on first ddi_umem_lock or umem_lockmemory call.
8605 	 */
8606 	if (ddi_umem_unlock_thread == NULL)
8607 		i_ddi_umem_unlock_thread_start();
8608 
8609 	/* Allocate memory for the cookie */
8610 	p = kmem_zalloc(sizeof (struct ddi_umem_cookie), KM_SLEEP);
8611 
8612 	/* Convert the flags to seg_rw type */
8613 	if (flags & DDI_UMEMLOCK_WRITE) {
8614 		p->s_flags = S_WRITE;
8615 	} else {
8616 		p->s_flags = S_READ;
8617 	}
8618 
8619 	/* Store curproc in cookie for later iosetup/unlock */
8620 	p->procp = (void *)curproc;
8621 
8622 	/*
8623 	 * Store the struct as pointer in cookie for later use by
8624 	 * ddi_umem_unlock.  The proc->p_as will be stale if ddi_umem_unlock
8625 	 * is called after relvm is called.
8626 	 */
8627 	p->asp = curproc->p_as;
8628 	/*
8629 	 * The size field is needed for lockmem accounting.
8630 	 */
8631 	p->size = len;
8632 	init_lockedmem_rctl_flag(p);
8633 
8634 	if (umem_incr_devlockmem(p) != 0) {
8635 		/*
8636 		 * The requested memory cannot be locked
8637 		 */
8638 		kmem_free(p, sizeof (struct ddi_umem_cookie));
8639 		*cookie = (ddi_umem_cookie_t)NULL;
8640 		return (ENOMEM);
8641 	}
8642 
8643 	/* Lock the pages corresponding to addr, len in memory */
8644 	error = as_pagelock(((proc_t *)p->procp)->p_as, &(p->pparray),
8645 	    addr, len, p->s_flags);
8646 	if (error != 0) {
8647 		umem_decr_devlockmem(p);
8648 		kmem_free(p, sizeof (struct ddi_umem_cookie));
8649 		*cookie = (ddi_umem_cookie_t)NULL;
8650 		return (error);
8651 	}
8652 
8653 	/* Initialize the fields in the ddi_umem_cookie */
8654 	p->cvaddr = addr;
8655 	p->type = UMEM_LOCKED;
8656 	p->cook_refcnt = 1;
8657 
8658 	*cookie = (ddi_umem_cookie_t)p;
8659 	return (error);
8660 }
8661 
8662 /*
8663  * Add the cookie to the ddi_umem_unlock list.  Pages will be
8664  * unlocked by i_ddi_umem_unlock_thread.
8665  */
8666 
8667 void
8668 ddi_umem_unlock(ddi_umem_cookie_t cookie)
8669 {
8670 	struct ddi_umem_cookie	*p = (struct ddi_umem_cookie *)cookie;
8671 
8672 	ASSERT(p->type == UMEM_LOCKED);
8673 	ASSERT(CPU_ON_INTR(CPU) == 0); /* cannot be high level */
8674 	ASSERT(ddi_umem_unlock_thread != NULL);
8675 
8676 	p->unl_forw = (struct ddi_umem_cookie *)NULL;	/* end of list */
8677 	/*
8678 	 * Queue the unlock request and notify i_ddi_umem_unlock thread
8679 	 * if it's called in the interrupt context. Otherwise, unlock pages
8680 	 * immediately.
8681 	 */
8682 	if (servicing_interrupt()) {
8683 		/* queue the unlock request and notify the thread */
8684 		mutex_enter(&ddi_umem_unlock_mutex);
8685 		if (ddi_umem_unlock_head == NULL) {
8686 			ddi_umem_unlock_head = ddi_umem_unlock_tail = p;
8687 			cv_broadcast(&ddi_umem_unlock_cv);
8688 		} else {
8689 			ddi_umem_unlock_tail->unl_forw = p;
8690 			ddi_umem_unlock_tail = p;
8691 		}
8692 		mutex_exit(&ddi_umem_unlock_mutex);
8693 	} else {
8694 		/* unlock the pages right away */
8695 		(void) i_ddi_umem_unlock(p);
8696 	}
8697 }
8698 
8699 /*
8700  * Create a buf structure from a ddi_umem_cookie
8701  * cookie - is a ddi_umem_cookie for from ddi_umem_lock and ddi_umem_alloc
8702  *		(only UMEM_LOCKED & KMEM_NON_PAGEABLE types supported)
8703  * off, len - identifies the portion of the memory represented by the cookie
8704  *		that the buf points to.
8705  *	NOTE: off, len need to follow the alignment/size restrictions of the
8706  *		device (dev) that this buf will be passed to. Some devices
8707  *		will accept unrestricted alignment/size, whereas others (such as
8708  *		st) require some block-size alignment/size. It is the caller's
8709  *		responsibility to ensure that the alignment/size restrictions
8710  *		are met (we cannot assert as we do not know the restrictions)
8711  *
8712  * direction - is one of B_READ or B_WRITE and needs to be compatible with
8713  *		the flags used in ddi_umem_lock
8714  *
8715  * The following three arguments are used to initialize fields in the
8716  * buf structure and are uninterpreted by this routine.
8717  *
8718  * dev
8719  * blkno
8720  * iodone
8721  *
8722  * sleepflag - is one of DDI_UMEM_SLEEP or DDI_UMEM_NOSLEEP
8723  *
8724  * Returns a buf structure pointer on success (to be freed by freerbuf)
8725  *	NULL on any parameter error or memory alloc failure
8726  *
8727  */
8728 struct buf *
8729 ddi_umem_iosetup(ddi_umem_cookie_t cookie, off_t off, size_t len,
8730 	int direction, dev_t dev, daddr_t blkno,
8731 	int (*iodone)(struct buf *), int sleepflag)
8732 {
8733 	struct ddi_umem_cookie *p = (struct ddi_umem_cookie *)cookie;
8734 	struct buf *bp;
8735 
8736 	/*
8737 	 * check for valid cookie offset, len
8738 	 */
8739 	if ((off + len) > p->size) {
8740 		return (NULL);
8741 	}
8742 
8743 	if (len > p->size) {
8744 		return (NULL);
8745 	}
8746 
8747 	/* direction has to be one of B_READ or B_WRITE */
8748 	if ((direction != B_READ) && (direction != B_WRITE)) {
8749 		return (NULL);
8750 	}
8751 
8752 	/* These are the only two valid sleepflags */
8753 	if ((sleepflag != DDI_UMEM_SLEEP) && (sleepflag != DDI_UMEM_NOSLEEP)) {
8754 		return (NULL);
8755 	}
8756 
8757 	/*
8758 	 * Only cookies of type UMEM_LOCKED and KMEM_NON_PAGEABLE are supported
8759 	 */
8760 	if ((p->type != UMEM_LOCKED) && (p->type != KMEM_NON_PAGEABLE)) {
8761 		return (NULL);
8762 	}
8763 
8764 	/* If type is KMEM_NON_PAGEABLE procp is NULL */
8765 	ASSERT((p->type == KMEM_NON_PAGEABLE) ?
8766 	    (p->procp == NULL) : (p->procp != NULL));
8767 
8768 	bp = kmem_alloc(sizeof (struct buf), sleepflag);
8769 	if (bp == NULL) {
8770 		return (NULL);
8771 	}
8772 	bioinit(bp);
8773 
8774 	bp->b_flags = B_BUSY | B_PHYS | direction;
8775 	bp->b_edev = dev;
8776 	bp->b_lblkno = blkno;
8777 	bp->b_iodone = iodone;
8778 	bp->b_bcount = len;
8779 	bp->b_proc = (proc_t *)p->procp;
8780 	ASSERT(((uintptr_t)(p->cvaddr) & PAGEOFFSET) == 0);
8781 	bp->b_un.b_addr = (caddr_t)((uintptr_t)(p->cvaddr) + off);
8782 	if (p->pparray != NULL) {
8783 		bp->b_flags |= B_SHADOW;
8784 		ASSERT(((uintptr_t)(p->cvaddr) & PAGEOFFSET) == 0);
8785 		bp->b_shadow = p->pparray + btop(off);
8786 	}
8787 	return (bp);
8788 }
8789 
8790 /*
8791  * Fault-handling and related routines
8792  */
8793 
8794 ddi_devstate_t
8795 ddi_get_devstate(dev_info_t *dip)
8796 {
8797 	if (DEVI_IS_DEVICE_OFFLINE(dip))
8798 		return (DDI_DEVSTATE_OFFLINE);
8799 	else if (DEVI_IS_DEVICE_DOWN(dip) || DEVI_IS_BUS_DOWN(dip))
8800 		return (DDI_DEVSTATE_DOWN);
8801 	else if (DEVI_IS_BUS_QUIESCED(dip))
8802 		return (DDI_DEVSTATE_QUIESCED);
8803 	else if (DEVI_IS_DEVICE_DEGRADED(dip))
8804 		return (DDI_DEVSTATE_DEGRADED);
8805 	else
8806 		return (DDI_DEVSTATE_UP);
8807 }
8808 
8809 void
8810 ddi_dev_report_fault(dev_info_t *dip, ddi_fault_impact_t impact,
8811 	ddi_fault_location_t location, const char *message)
8812 {
8813 	struct ddi_fault_event_data fd;
8814 	ddi_eventcookie_t ec;
8815 
8816 	/*
8817 	 * Assemble all the information into a fault-event-data structure
8818 	 */
8819 	fd.f_dip = dip;
8820 	fd.f_impact = impact;
8821 	fd.f_location = location;
8822 	fd.f_message = message;
8823 	fd.f_oldstate = ddi_get_devstate(dip);
8824 
8825 	/*
8826 	 * Get eventcookie from defining parent.
8827 	 */
8828 	if (ddi_get_eventcookie(dip, DDI_DEVI_FAULT_EVENT, &ec) !=
8829 	    DDI_SUCCESS)
8830 		return;
8831 
8832 	(void) ndi_post_event(dip, dip, ec, &fd);
8833 }
8834 
8835 char *
8836 i_ddi_devi_class(dev_info_t *dip)
8837 {
8838 	return (DEVI(dip)->devi_device_class);
8839 }
8840 
8841 int
8842 i_ddi_set_devi_class(dev_info_t *dip, char *devi_class, int flag)
8843 {
8844 	struct dev_info *devi = DEVI(dip);
8845 
8846 	mutex_enter(&devi->devi_lock);
8847 
8848 	if (devi->devi_device_class)
8849 		kmem_free(devi->devi_device_class,
8850 		    strlen(devi->devi_device_class) + 1);
8851 
8852 	if ((devi->devi_device_class = i_ddi_strdup(devi_class, flag))
8853 	    != NULL) {
8854 		mutex_exit(&devi->devi_lock);
8855 		return (DDI_SUCCESS);
8856 	}
8857 
8858 	mutex_exit(&devi->devi_lock);
8859 
8860 	return (DDI_FAILURE);
8861 }
8862 
8863 
8864 /*
8865  * Task Queues DDI interfaces.
8866  */
8867 
8868 /* ARGSUSED */
8869 ddi_taskq_t *
8870 ddi_taskq_create(dev_info_t *dip, const char *name, int nthreads,
8871     pri_t pri, uint_t cflags)
8872 {
8873 	char full_name[TASKQ_NAMELEN];
8874 	const char *tq_name;
8875 	int nodeid = 0;
8876 
8877 	if (dip == NULL)
8878 		tq_name = name;
8879 	else {
8880 		nodeid = ddi_get_instance(dip);
8881 
8882 		if (name == NULL)
8883 			name = "tq";
8884 
8885 		(void) snprintf(full_name, sizeof (full_name), "%s_%s",
8886 		    ddi_driver_name(dip), name);
8887 
8888 		tq_name = full_name;
8889 	}
8890 
8891 	return ((ddi_taskq_t *)taskq_create_instance(tq_name, nodeid, nthreads,
8892 	    pri == TASKQ_DEFAULTPRI ? minclsyspri : pri,
8893 	    nthreads, INT_MAX, TASKQ_PREPOPULATE));
8894 }
8895 
8896 void
8897 ddi_taskq_destroy(ddi_taskq_t *tq)
8898 {
8899 	taskq_destroy((taskq_t *)tq);
8900 }
8901 
8902 int
8903 ddi_taskq_dispatch(ddi_taskq_t *tq, void (* func)(void *),
8904     void *arg, uint_t dflags)
8905 {
8906 	taskqid_t id = taskq_dispatch((taskq_t *)tq, func, arg,
8907 	    dflags == DDI_SLEEP ? TQ_SLEEP : TQ_NOSLEEP);
8908 
8909 	return (id != 0 ? DDI_SUCCESS : DDI_FAILURE);
8910 }
8911 
8912 void
8913 ddi_taskq_wait(ddi_taskq_t *tq)
8914 {
8915 	taskq_wait((taskq_t *)tq);
8916 }
8917 
8918 void
8919 ddi_taskq_suspend(ddi_taskq_t *tq)
8920 {
8921 	taskq_suspend((taskq_t *)tq);
8922 }
8923 
8924 boolean_t
8925 ddi_taskq_suspended(ddi_taskq_t *tq)
8926 {
8927 	return (taskq_suspended((taskq_t *)tq));
8928 }
8929 
8930 void
8931 ddi_taskq_resume(ddi_taskq_t *tq)
8932 {
8933 	taskq_resume((taskq_t *)tq);
8934 }
8935 
8936 int
8937 ddi_parse(
8938 	const char	*ifname,
8939 	char		*alnum,
8940 	uint_t		*nump)
8941 {
8942 	const char	*p;
8943 	int		l;
8944 	ulong_t		num;
8945 	boolean_t	nonum = B_TRUE;
8946 	char		c;
8947 
8948 	l = strlen(ifname);
8949 	for (p = ifname + l; p != ifname; l--) {
8950 		c = *--p;
8951 		if (!isdigit(c)) {
8952 			(void) strlcpy(alnum, ifname, l + 1);
8953 			if (ddi_strtoul(p + 1, NULL, 10, &num) != 0)
8954 				return (DDI_FAILURE);
8955 			break;
8956 		}
8957 		nonum = B_FALSE;
8958 	}
8959 	if (l == 0 || nonum)
8960 		return (DDI_FAILURE);
8961 
8962 	*nump = num;
8963 	return (DDI_SUCCESS);
8964 }
8965 
8966 /*
8967  * Default initialization function for drivers that don't need to quiesce.
8968  */
8969 /* ARGSUSED */
8970 int
8971 ddi_quiesce_not_needed(dev_info_t *dip)
8972 {
8973 	return (DDI_SUCCESS);
8974 }
8975 
8976 /*
8977  * Initialization function for drivers that should implement quiesce()
8978  * but haven't yet.
8979  */
8980 /* ARGSUSED */
8981 int
8982 ddi_quiesce_not_supported(dev_info_t *dip)
8983 {
8984 	return (DDI_FAILURE);
8985 }
8986 
8987 char *
8988 ddi_strdup(const char *str, int flag)
8989 {
8990 	int	n;
8991 	char	*ptr;
8992 
8993 	ASSERT(str != NULL);
8994 	ASSERT((flag == KM_SLEEP) || (flag == KM_NOSLEEP));
8995 
8996 	n = strlen(str);
8997 	if ((ptr = kmem_alloc(n + 1, flag)) == NULL)
8998 		return (NULL);
8999 	bcopy(str, ptr, n + 1);
9000 	return (ptr);
9001 }
9002 
9003 char *
9004 strdup(const char *str)
9005 {
9006 	return (ddi_strdup(str, KM_SLEEP));
9007 }
9008 
9009 void
9010 strfree(char *str)
9011 {
9012 	ASSERT(str != NULL);
9013 	kmem_free(str, strlen(str) + 1);
9014 }
9015 
9016 /*
9017  * Generic DDI callback interfaces.
9018  */
9019 
9020 int
9021 ddi_cb_register(dev_info_t *dip, ddi_cb_flags_t flags, ddi_cb_func_t cbfunc,
9022     void *arg1, void *arg2, ddi_cb_handle_t *ret_hdlp)
9023 {
9024 	ddi_cb_t	*cbp;
9025 
9026 	ASSERT(dip != NULL);
9027 	ASSERT(DDI_CB_FLAG_VALID(flags));
9028 	ASSERT(cbfunc != NULL);
9029 	ASSERT(ret_hdlp != NULL);
9030 
9031 	/* Sanity check the context */
9032 	ASSERT(!servicing_interrupt());
9033 	if (servicing_interrupt())
9034 		return (DDI_FAILURE);
9035 
9036 	/* Validate parameters */
9037 	if ((dip == NULL) || !DDI_CB_FLAG_VALID(flags) ||
9038 	    (cbfunc == NULL) || (ret_hdlp == NULL))
9039 		return (DDI_EINVAL);
9040 
9041 	/* Check for previous registration */
9042 	if (DEVI(dip)->devi_cb_p != NULL)
9043 		return (DDI_EALREADY);
9044 
9045 	/* Allocate and initialize callback */
9046 	cbp = kmem_zalloc(sizeof (ddi_cb_t), KM_SLEEP);
9047 	cbp->cb_dip = dip;
9048 	cbp->cb_func = cbfunc;
9049 	cbp->cb_arg1 = arg1;
9050 	cbp->cb_arg2 = arg2;
9051 	cbp->cb_flags = flags;
9052 	DEVI(dip)->devi_cb_p = cbp;
9053 
9054 	/* If adding an IRM callback, notify IRM */
9055 	if (flags & DDI_CB_FLAG_INTR)
9056 		i_ddi_irm_set_cb(dip, B_TRUE);
9057 
9058 	*ret_hdlp = (ddi_cb_handle_t)&(DEVI(dip)->devi_cb_p);
9059 	return (DDI_SUCCESS);
9060 }
9061 
9062 int
9063 ddi_cb_unregister(ddi_cb_handle_t hdl)
9064 {
9065 	ddi_cb_t	*cbp;
9066 	dev_info_t	*dip;
9067 
9068 	ASSERT(hdl != NULL);
9069 
9070 	/* Sanity check the context */
9071 	ASSERT(!servicing_interrupt());
9072 	if (servicing_interrupt())
9073 		return (DDI_FAILURE);
9074 
9075 	/* Validate parameters */
9076 	if ((hdl == NULL) || ((cbp = *(ddi_cb_t **)hdl) == NULL) ||
9077 	    ((dip = cbp->cb_dip) == NULL))
9078 		return (DDI_EINVAL);
9079 
9080 	/* If removing an IRM callback, notify IRM */
9081 	if (cbp->cb_flags & DDI_CB_FLAG_INTR)
9082 		i_ddi_irm_set_cb(dip, B_FALSE);
9083 
9084 	/* Destroy the callback */
9085 	kmem_free(cbp, sizeof (ddi_cb_t));
9086 	DEVI(dip)->devi_cb_p = NULL;
9087 
9088 	return (DDI_SUCCESS);
9089 }
9090 
9091 /*
9092  * Platform independent DR routines
9093  */
9094 
9095 static int
9096 ndi2errno(int n)
9097 {
9098 	int err = 0;
9099 
9100 	switch (n) {
9101 		case NDI_NOMEM:
9102 			err = ENOMEM;
9103 			break;
9104 		case NDI_BUSY:
9105 			err = EBUSY;
9106 			break;
9107 		case NDI_FAULT:
9108 			err = EFAULT;
9109 			break;
9110 		case NDI_FAILURE:
9111 			err = EIO;
9112 			break;
9113 		case NDI_SUCCESS:
9114 			break;
9115 		case NDI_BADHANDLE:
9116 		default:
9117 			err = EINVAL;
9118 			break;
9119 	}
9120 	return (err);
9121 }
9122 
9123 /*
9124  * Prom tree node list
9125  */
9126 struct ptnode {
9127 	pnode_t		nodeid;
9128 	struct ptnode	*next;
9129 };
9130 
9131 /*
9132  * Prom tree walk arg
9133  */
9134 struct pta {
9135 	dev_info_t	*pdip;
9136 	devi_branch_t	*bp;
9137 	uint_t		flags;
9138 	dev_info_t	*fdip;
9139 	struct ptnode	*head;
9140 };
9141 
9142 static void
9143 visit_node(pnode_t nodeid, struct pta *ap)
9144 {
9145 	struct ptnode	**nextp;
9146 	int		(*select)(pnode_t, void *, uint_t);
9147 
9148 	ASSERT(nodeid != OBP_NONODE && nodeid != OBP_BADNODE);
9149 
9150 	select = ap->bp->create.prom_branch_select;
9151 
9152 	ASSERT(select);
9153 
9154 	if (select(nodeid, ap->bp->arg, 0) == DDI_SUCCESS) {
9155 
9156 		for (nextp = &ap->head; *nextp; nextp = &(*nextp)->next)
9157 			;
9158 
9159 		*nextp = kmem_zalloc(sizeof (struct ptnode), KM_SLEEP);
9160 
9161 		(*nextp)->nodeid = nodeid;
9162 	}
9163 
9164 	if ((ap->flags & DEVI_BRANCH_CHILD) == DEVI_BRANCH_CHILD)
9165 		return;
9166 
9167 	nodeid = prom_childnode(nodeid);
9168 	while (nodeid != OBP_NONODE && nodeid != OBP_BADNODE) {
9169 		visit_node(nodeid, ap);
9170 		nodeid = prom_nextnode(nodeid);
9171 	}
9172 }
9173 
9174 /*
9175  * NOTE: The caller of this function must check for device contracts
9176  * or LDI callbacks against this dip before setting the dip offline.
9177  */
9178 static int
9179 set_infant_dip_offline(dev_info_t *dip, void *arg)
9180 {
9181 	char	*path = (char *)arg;
9182 
9183 	ASSERT(dip);
9184 	ASSERT(arg);
9185 
9186 	if (i_ddi_node_state(dip) >= DS_ATTACHED) {
9187 		(void) ddi_pathname(dip, path);
9188 		cmn_err(CE_WARN, "Attempt to set offline flag on attached "
9189 		    "node: %s", path);
9190 		return (DDI_FAILURE);
9191 	}
9192 
9193 	mutex_enter(&(DEVI(dip)->devi_lock));
9194 	if (!DEVI_IS_DEVICE_OFFLINE(dip))
9195 		DEVI_SET_DEVICE_OFFLINE(dip);
9196 	mutex_exit(&(DEVI(dip)->devi_lock));
9197 
9198 	return (DDI_SUCCESS);
9199 }
9200 
9201 typedef struct result {
9202 	char	*path;
9203 	int	result;
9204 } result_t;
9205 
9206 static int
9207 dip_set_offline(dev_info_t *dip, void *arg)
9208 {
9209 	int end;
9210 	result_t *resp = (result_t *)arg;
9211 
9212 	ASSERT(dip);
9213 	ASSERT(resp);
9214 
9215 	/*
9216 	 * We stop the walk if e_ddi_offline_notify() returns
9217 	 * failure, because this implies that one or more consumers
9218 	 * (either LDI or contract based) has blocked the offline.
9219 	 * So there is no point in conitnuing the walk
9220 	 */
9221 	if (e_ddi_offline_notify(dip) == DDI_FAILURE) {
9222 		resp->result = DDI_FAILURE;
9223 		return (DDI_WALK_TERMINATE);
9224 	}
9225 
9226 	/*
9227 	 * If set_infant_dip_offline() returns failure, it implies
9228 	 * that we failed to set a particular dip offline. This
9229 	 * does not imply that the offline as a whole should fail.
9230 	 * We want to do the best we can, so we continue the walk.
9231 	 */
9232 	if (set_infant_dip_offline(dip, resp->path) == DDI_SUCCESS)
9233 		end = DDI_SUCCESS;
9234 	else
9235 		end = DDI_FAILURE;
9236 
9237 	e_ddi_offline_finalize(dip, end);
9238 
9239 	return (DDI_WALK_CONTINUE);
9240 }
9241 
9242 /*
9243  * The call to e_ddi_offline_notify() exists for the
9244  * unlikely error case that a branch we are trying to
9245  * create already exists and has device contracts or LDI
9246  * event callbacks against it.
9247  *
9248  * We allow create to succeed for such branches only if
9249  * no constraints block the offline.
9250  */
9251 static int
9252 branch_set_offline(dev_info_t *dip, char *path)
9253 {
9254 	int		circ;
9255 	int		end;
9256 	result_t	res;
9257 
9258 
9259 	if (e_ddi_offline_notify(dip) == DDI_FAILURE) {
9260 		return (DDI_FAILURE);
9261 	}
9262 
9263 	if (set_infant_dip_offline(dip, path) == DDI_SUCCESS)
9264 		end = DDI_SUCCESS;
9265 	else
9266 		end = DDI_FAILURE;
9267 
9268 	e_ddi_offline_finalize(dip, end);
9269 
9270 	if (end == DDI_FAILURE)
9271 		return (DDI_FAILURE);
9272 
9273 	res.result = DDI_SUCCESS;
9274 	res.path = path;
9275 
9276 	ndi_devi_enter(dip, &circ);
9277 	ddi_walk_devs(ddi_get_child(dip), dip_set_offline, &res);
9278 	ndi_devi_exit(dip, circ);
9279 
9280 	return (res.result);
9281 }
9282 
9283 /*ARGSUSED*/
9284 static int
9285 create_prom_branch(void *arg, int has_changed)
9286 {
9287 	int		circ;
9288 	int		exists, rv;
9289 	pnode_t		nodeid;
9290 	struct ptnode	*tnp;
9291 	dev_info_t	*dip;
9292 	struct pta	*ap = arg;
9293 	devi_branch_t	*bp;
9294 	char		*path;
9295 
9296 	ASSERT(ap);
9297 	ASSERT(ap->fdip == NULL);
9298 	ASSERT(ap->pdip && ndi_dev_is_prom_node(ap->pdip));
9299 
9300 	bp = ap->bp;
9301 
9302 	nodeid = ddi_get_nodeid(ap->pdip);
9303 	if (nodeid == OBP_NONODE || nodeid == OBP_BADNODE) {
9304 		cmn_err(CE_WARN, "create_prom_branch: invalid "
9305 		    "nodeid: 0x%x", nodeid);
9306 		return (EINVAL);
9307 	}
9308 
9309 	ap->head = NULL;
9310 
9311 	nodeid = prom_childnode(nodeid);
9312 	while (nodeid != OBP_NONODE && nodeid != OBP_BADNODE) {
9313 		visit_node(nodeid, ap);
9314 		nodeid = prom_nextnode(nodeid);
9315 	}
9316 
9317 	if (ap->head == NULL)
9318 		return (ENODEV);
9319 
9320 	path = kmem_alloc(MAXPATHLEN, KM_SLEEP);
9321 	rv = 0;
9322 	while ((tnp = ap->head) != NULL) {
9323 		ap->head = tnp->next;
9324 
9325 		ndi_devi_enter(ap->pdip, &circ);
9326 
9327 		/*
9328 		 * Check if the branch already exists.
9329 		 */
9330 		exists = 0;
9331 		dip = e_ddi_nodeid_to_dip(tnp->nodeid);
9332 		if (dip != NULL) {
9333 			exists = 1;
9334 
9335 			/* Parent is held busy, so release hold */
9336 			ndi_rele_devi(dip);
9337 #ifdef	DEBUG
9338 			cmn_err(CE_WARN, "create_prom_branch: dip(%p) exists"
9339 			    " for nodeid 0x%x", (void *)dip, tnp->nodeid);
9340 #endif
9341 		} else {
9342 			dip = i_ddi_create_branch(ap->pdip, tnp->nodeid);
9343 		}
9344 
9345 		kmem_free(tnp, sizeof (struct ptnode));
9346 
9347 		/*
9348 		 * Hold the branch if it is not already held
9349 		 */
9350 		if (dip && !exists) {
9351 			e_ddi_branch_hold(dip);
9352 		}
9353 
9354 		ASSERT(dip == NULL || e_ddi_branch_held(dip));
9355 
9356 		/*
9357 		 * Set all dips in the newly created branch offline so that
9358 		 * only a "configure" operation can attach
9359 		 * the branch
9360 		 */
9361 		if (dip == NULL || branch_set_offline(dip, path)
9362 		    == DDI_FAILURE) {
9363 			ndi_devi_exit(ap->pdip, circ);
9364 			rv = EIO;
9365 			continue;
9366 		}
9367 
9368 		ASSERT(ddi_get_parent(dip) == ap->pdip);
9369 
9370 		ndi_devi_exit(ap->pdip, circ);
9371 
9372 		if (ap->flags & DEVI_BRANCH_CONFIGURE) {
9373 			int error = e_ddi_branch_configure(dip, &ap->fdip, 0);
9374 			if (error && rv == 0)
9375 				rv = error;
9376 		}
9377 
9378 		/*
9379 		 * Invoke devi_branch_callback() (if it exists) only for
9380 		 * newly created branches
9381 		 */
9382 		if (bp->devi_branch_callback && !exists)
9383 			bp->devi_branch_callback(dip, bp->arg, 0);
9384 	}
9385 
9386 	kmem_free(path, MAXPATHLEN);
9387 
9388 	return (rv);
9389 }
9390 
9391 static int
9392 sid_node_create(dev_info_t *pdip, devi_branch_t *bp, dev_info_t **rdipp)
9393 {
9394 	int			rv, circ, len;
9395 	int			i, flags, ret;
9396 	dev_info_t		*dip;
9397 	char			*nbuf;
9398 	char			*path;
9399 	static const char	*noname = "<none>";
9400 
9401 	ASSERT(pdip);
9402 	ASSERT(DEVI_BUSY_OWNED(pdip));
9403 
9404 	flags = 0;
9405 
9406 	/*
9407 	 * Creating the root of a branch ?
9408 	 */
9409 	if (rdipp) {
9410 		*rdipp = NULL;
9411 		flags = DEVI_BRANCH_ROOT;
9412 	}
9413 
9414 	ndi_devi_alloc_sleep(pdip, (char *)noname, DEVI_SID_NODEID, &dip);
9415 	rv = bp->create.sid_branch_create(dip, bp->arg, flags);
9416 
9417 	nbuf = kmem_alloc(OBP_MAXDRVNAME, KM_SLEEP);
9418 
9419 	if (rv == DDI_WALK_ERROR) {
9420 		cmn_err(CE_WARN, "e_ddi_branch_create: Error setting"
9421 		    " properties on devinfo node %p",  (void *)dip);
9422 		goto fail;
9423 	}
9424 
9425 	len = OBP_MAXDRVNAME;
9426 	if (ddi_getlongprop_buf(DDI_DEV_T_ANY, dip,
9427 	    DDI_PROP_DONTPASS | DDI_PROP_NOTPROM, "name", nbuf, &len)
9428 	    != DDI_PROP_SUCCESS) {
9429 		cmn_err(CE_WARN, "e_ddi_branch_create: devinfo node %p has"
9430 		    "no name property", (void *)dip);
9431 		goto fail;
9432 	}
9433 
9434 	ASSERT(i_ddi_node_state(dip) == DS_PROTO);
9435 	if (ndi_devi_set_nodename(dip, nbuf, 0) != NDI_SUCCESS) {
9436 		cmn_err(CE_WARN, "e_ddi_branch_create: cannot set name (%s)"
9437 		    " for devinfo node %p", nbuf, (void *)dip);
9438 		goto fail;
9439 	}
9440 
9441 	kmem_free(nbuf, OBP_MAXDRVNAME);
9442 
9443 	/*
9444 	 * Ignore bind failures just like boot does
9445 	 */
9446 	(void) ndi_devi_bind_driver(dip, 0);
9447 
9448 	switch (rv) {
9449 	case DDI_WALK_CONTINUE:
9450 	case DDI_WALK_PRUNESIB:
9451 		ndi_devi_enter(dip, &circ);
9452 
9453 		i = DDI_WALK_CONTINUE;
9454 		for (; i == DDI_WALK_CONTINUE; ) {
9455 			i = sid_node_create(dip, bp, NULL);
9456 		}
9457 
9458 		ASSERT(i == DDI_WALK_ERROR || i == DDI_WALK_PRUNESIB);
9459 		if (i == DDI_WALK_ERROR)
9460 			rv = i;
9461 		/*
9462 		 * If PRUNESIB stop creating siblings
9463 		 * of dip's child. Subsequent walk behavior
9464 		 * is determined by rv returned by dip.
9465 		 */
9466 
9467 		ndi_devi_exit(dip, circ);
9468 		break;
9469 	case DDI_WALK_TERMINATE:
9470 		/*
9471 		 * Don't create children and ask our parent
9472 		 * to not create siblings either.
9473 		 */
9474 		rv = DDI_WALK_PRUNESIB;
9475 		break;
9476 	case DDI_WALK_PRUNECHILD:
9477 		/*
9478 		 * Don't create children, but ask parent to continue
9479 		 * with siblings.
9480 		 */
9481 		rv = DDI_WALK_CONTINUE;
9482 		break;
9483 	default:
9484 		ASSERT(0);
9485 		break;
9486 	}
9487 
9488 	if (rdipp)
9489 		*rdipp = dip;
9490 
9491 	/*
9492 	 * Set device offline - only the "configure" op should cause an attach.
9493 	 * Note that it is safe to set the dip offline without checking
9494 	 * for either device contract or layered driver (LDI) based constraints
9495 	 * since there cannot be any contracts or LDI opens of this device.
9496 	 * This is because this node is a newly created dip with the parent busy
9497 	 * held, so no other thread can come in and attach this dip. A dip that
9498 	 * has never been attached cannot have contracts since by definition
9499 	 * a device contract (an agreement between a process and a device minor
9500 	 * node) can only be created against a device that has minor nodes
9501 	 * i.e is attached. Similarly an LDI open will only succeed if the
9502 	 * dip is attached. We assert below that the dip is not attached.
9503 	 */
9504 	ASSERT(i_ddi_node_state(dip) < DS_ATTACHED);
9505 	path = kmem_alloc(MAXPATHLEN, KM_SLEEP);
9506 	ret = set_infant_dip_offline(dip, path);
9507 	ASSERT(ret == DDI_SUCCESS);
9508 	kmem_free(path, MAXPATHLEN);
9509 
9510 	return (rv);
9511 fail:
9512 	(void) ndi_devi_free(dip);
9513 	kmem_free(nbuf, OBP_MAXDRVNAME);
9514 	return (DDI_WALK_ERROR);
9515 }
9516 
9517 static int
9518 create_sid_branch(
9519 	dev_info_t	*pdip,
9520 	devi_branch_t	*bp,
9521 	dev_info_t	**dipp,
9522 	uint_t		flags)
9523 {
9524 	int		rv = 0, state = DDI_WALK_CONTINUE;
9525 	dev_info_t	*rdip;
9526 
9527 	while (state == DDI_WALK_CONTINUE) {
9528 		int	circ;
9529 
9530 		ndi_devi_enter(pdip, &circ);
9531 
9532 		state = sid_node_create(pdip, bp, &rdip);
9533 		if (rdip == NULL) {
9534 			ndi_devi_exit(pdip, circ);
9535 			ASSERT(state == DDI_WALK_ERROR);
9536 			break;
9537 		}
9538 
9539 		e_ddi_branch_hold(rdip);
9540 
9541 		ndi_devi_exit(pdip, circ);
9542 
9543 		if (flags & DEVI_BRANCH_CONFIGURE) {
9544 			int error = e_ddi_branch_configure(rdip, dipp, 0);
9545 			if (error && rv == 0)
9546 				rv = error;
9547 		}
9548 
9549 		/*
9550 		 * devi_branch_callback() is optional
9551 		 */
9552 		if (bp->devi_branch_callback)
9553 			bp->devi_branch_callback(rdip, bp->arg, 0);
9554 	}
9555 
9556 	ASSERT(state == DDI_WALK_ERROR || state == DDI_WALK_PRUNESIB);
9557 
9558 	return (state == DDI_WALK_ERROR ? EIO : rv);
9559 }
9560 
9561 int
9562 e_ddi_branch_create(
9563 	dev_info_t	*pdip,
9564 	devi_branch_t	*bp,
9565 	dev_info_t	**dipp,
9566 	uint_t		flags)
9567 {
9568 	int prom_devi, sid_devi, error;
9569 
9570 	if (pdip == NULL || bp == NULL || bp->type == 0)
9571 		return (EINVAL);
9572 
9573 	prom_devi = (bp->type == DEVI_BRANCH_PROM) ? 1 : 0;
9574 	sid_devi = (bp->type == DEVI_BRANCH_SID) ? 1 : 0;
9575 
9576 	if (prom_devi && bp->create.prom_branch_select == NULL)
9577 		return (EINVAL);
9578 	else if (sid_devi && bp->create.sid_branch_create == NULL)
9579 		return (EINVAL);
9580 	else if (!prom_devi && !sid_devi)
9581 		return (EINVAL);
9582 
9583 	if (flags & DEVI_BRANCH_EVENT)
9584 		return (EINVAL);
9585 
9586 	if (prom_devi) {
9587 		struct pta pta = {0};
9588 
9589 		pta.pdip = pdip;
9590 		pta.bp = bp;
9591 		pta.flags = flags;
9592 
9593 		error = prom_tree_access(create_prom_branch, &pta, NULL);
9594 
9595 		if (dipp)
9596 			*dipp = pta.fdip;
9597 		else if (pta.fdip)
9598 			ndi_rele_devi(pta.fdip);
9599 	} else {
9600 		error = create_sid_branch(pdip, bp, dipp, flags);
9601 	}
9602 
9603 	return (error);
9604 }
9605 
9606 int
9607 e_ddi_branch_configure(dev_info_t *rdip, dev_info_t **dipp, uint_t flags)
9608 {
9609 	int		rv;
9610 	char		*devnm;
9611 	dev_info_t	*pdip;
9612 
9613 	if (dipp)
9614 		*dipp = NULL;
9615 
9616 	if (rdip == NULL || flags != 0 || (flags & DEVI_BRANCH_EVENT))
9617 		return (EINVAL);
9618 
9619 	pdip = ddi_get_parent(rdip);
9620 
9621 	ndi_hold_devi(pdip);
9622 
9623 	if (!e_ddi_branch_held(rdip)) {
9624 		ndi_rele_devi(pdip);
9625 		cmn_err(CE_WARN, "e_ddi_branch_configure: "
9626 		    "dip(%p) not held", (void *)rdip);
9627 		return (EINVAL);
9628 	}
9629 
9630 	if (i_ddi_node_state(rdip) < DS_INITIALIZED) {
9631 		/*
9632 		 * First attempt to bind a driver. If we fail, return
9633 		 * success (On some platforms, dips for some device
9634 		 * types (CPUs) may not have a driver)
9635 		 */
9636 		if (ndi_devi_bind_driver(rdip, 0) != NDI_SUCCESS) {
9637 			ndi_rele_devi(pdip);
9638 			return (0);
9639 		}
9640 
9641 		if (ddi_initchild(pdip, rdip) != DDI_SUCCESS) {
9642 			rv = NDI_FAILURE;
9643 			goto out;
9644 		}
9645 	}
9646 
9647 	ASSERT(i_ddi_node_state(rdip) >= DS_INITIALIZED);
9648 
9649 	devnm = kmem_alloc(MAXNAMELEN + 1, KM_SLEEP);
9650 
9651 	(void) ddi_deviname(rdip, devnm);
9652 
9653 	if ((rv = ndi_devi_config_one(pdip, devnm+1, &rdip,
9654 	    NDI_DEVI_ONLINE | NDI_CONFIG)) == NDI_SUCCESS) {
9655 		/* release hold from ndi_devi_config_one() */
9656 		ndi_rele_devi(rdip);
9657 	}
9658 
9659 	kmem_free(devnm, MAXNAMELEN + 1);
9660 out:
9661 	if (rv != NDI_SUCCESS && dipp && rdip) {
9662 		ndi_hold_devi(rdip);
9663 		*dipp = rdip;
9664 	}
9665 	ndi_rele_devi(pdip);
9666 	return (ndi2errno(rv));
9667 }
9668 
9669 void
9670 e_ddi_branch_hold(dev_info_t *rdip)
9671 {
9672 	if (e_ddi_branch_held(rdip)) {
9673 		cmn_err(CE_WARN, "e_ddi_branch_hold: branch already held");
9674 		return;
9675 	}
9676 
9677 	mutex_enter(&DEVI(rdip)->devi_lock);
9678 	if ((DEVI(rdip)->devi_flags & DEVI_BRANCH_HELD) == 0) {
9679 		DEVI(rdip)->devi_flags |= DEVI_BRANCH_HELD;
9680 		DEVI(rdip)->devi_ref++;
9681 	}
9682 	ASSERT(DEVI(rdip)->devi_ref > 0);
9683 	mutex_exit(&DEVI(rdip)->devi_lock);
9684 }
9685 
9686 int
9687 e_ddi_branch_held(dev_info_t *rdip)
9688 {
9689 	int rv = 0;
9690 
9691 	mutex_enter(&DEVI(rdip)->devi_lock);
9692 	if ((DEVI(rdip)->devi_flags & DEVI_BRANCH_HELD) &&
9693 	    DEVI(rdip)->devi_ref > 0) {
9694 		rv = 1;
9695 	}
9696 	mutex_exit(&DEVI(rdip)->devi_lock);
9697 
9698 	return (rv);
9699 }
9700 
9701 void
9702 e_ddi_branch_rele(dev_info_t *rdip)
9703 {
9704 	mutex_enter(&DEVI(rdip)->devi_lock);
9705 	DEVI(rdip)->devi_flags &= ~DEVI_BRANCH_HELD;
9706 	DEVI(rdip)->devi_ref--;
9707 	mutex_exit(&DEVI(rdip)->devi_lock);
9708 }
9709 
9710 int
9711 e_ddi_branch_unconfigure(
9712 	dev_info_t *rdip,
9713 	dev_info_t **dipp,
9714 	uint_t flags)
9715 {
9716 	int	circ, rv;
9717 	int	destroy;
9718 	char	*devnm;
9719 	uint_t	nflags;
9720 	dev_info_t *pdip;
9721 
9722 	if (dipp)
9723 		*dipp = NULL;
9724 
9725 	if (rdip == NULL)
9726 		return (EINVAL);
9727 
9728 	pdip = ddi_get_parent(rdip);
9729 
9730 	ASSERT(pdip);
9731 
9732 	/*
9733 	 * Check if caller holds pdip busy - can cause deadlocks during
9734 	 * devfs_clean()
9735 	 */
9736 	if (DEVI_BUSY_OWNED(pdip)) {
9737 		cmn_err(CE_WARN, "e_ddi_branch_unconfigure: failed: parent"
9738 		    " devinfo node(%p) is busy held", (void *)pdip);
9739 		return (EINVAL);
9740 	}
9741 
9742 	destroy = (flags & DEVI_BRANCH_DESTROY) ? 1 : 0;
9743 
9744 	devnm = kmem_alloc(MAXNAMELEN + 1, KM_SLEEP);
9745 
9746 	ndi_devi_enter(pdip, &circ);
9747 	(void) ddi_deviname(rdip, devnm);
9748 	ndi_devi_exit(pdip, circ);
9749 
9750 	/*
9751 	 * ddi_deviname() returns a component name with / prepended.
9752 	 */
9753 	(void) devfs_clean(pdip, devnm + 1, DV_CLEAN_FORCE);
9754 
9755 	ndi_devi_enter(pdip, &circ);
9756 
9757 	/*
9758 	 * Recreate device name as it may have changed state (init/uninit)
9759 	 * when parent busy lock was dropped for devfs_clean()
9760 	 */
9761 	(void) ddi_deviname(rdip, devnm);
9762 
9763 	if (!e_ddi_branch_held(rdip)) {
9764 		kmem_free(devnm, MAXNAMELEN + 1);
9765 		ndi_devi_exit(pdip, circ);
9766 		cmn_err(CE_WARN, "e_ddi_%s_branch: dip(%p) not held",
9767 		    destroy ? "destroy" : "unconfigure", (void *)rdip);
9768 		return (EINVAL);
9769 	}
9770 
9771 	/*
9772 	 * Release hold on the branch. This is ok since we are holding the
9773 	 * parent busy. If rdip is not removed, we must do a hold on the
9774 	 * branch before returning.
9775 	 */
9776 	e_ddi_branch_rele(rdip);
9777 
9778 	nflags = NDI_DEVI_OFFLINE;
9779 	if (destroy || (flags & DEVI_BRANCH_DESTROY)) {
9780 		nflags |= NDI_DEVI_REMOVE;
9781 		destroy = 1;
9782 	} else {
9783 		nflags |= NDI_UNCONFIG;		/* uninit but don't remove */
9784 	}
9785 
9786 	if (flags & DEVI_BRANCH_EVENT)
9787 		nflags |= NDI_POST_EVENT;
9788 
9789 	if (i_ddi_devi_attached(pdip) &&
9790 	    (i_ddi_node_state(rdip) >= DS_INITIALIZED)) {
9791 		rv = ndi_devi_unconfig_one(pdip, devnm+1, dipp, nflags);
9792 	} else {
9793 		rv = e_ddi_devi_unconfig(rdip, dipp, nflags);
9794 		if (rv == NDI_SUCCESS) {
9795 			ASSERT(!destroy || ddi_get_child(rdip) == NULL);
9796 			rv = ndi_devi_offline(rdip, nflags);
9797 		}
9798 	}
9799 
9800 	if (!destroy || rv != NDI_SUCCESS) {
9801 		/* The dip still exists, so do a hold */
9802 		e_ddi_branch_hold(rdip);
9803 	}
9804 out:
9805 	kmem_free(devnm, MAXNAMELEN + 1);
9806 	ndi_devi_exit(pdip, circ);
9807 	return (ndi2errno(rv));
9808 }
9809 
9810 int
9811 e_ddi_branch_destroy(dev_info_t *rdip, dev_info_t **dipp, uint_t flag)
9812 {
9813 	return (e_ddi_branch_unconfigure(rdip, dipp,
9814 	    flag|DEVI_BRANCH_DESTROY));
9815 }
9816 
9817 /*
9818  * Number of chains for hash table
9819  */
9820 #define	NUMCHAINS	17
9821 
9822 /*
9823  * Devinfo busy arg
9824  */
9825 struct devi_busy {
9826 	int dv_total;
9827 	int s_total;
9828 	mod_hash_t *dv_hash;
9829 	mod_hash_t *s_hash;
9830 	int (*callback)(dev_info_t *, void *, uint_t);
9831 	void *arg;
9832 };
9833 
9834 static int
9835 visit_dip(dev_info_t *dip, void *arg)
9836 {
9837 	uintptr_t sbusy, dvbusy, ref;
9838 	struct devi_busy *bsp = arg;
9839 
9840 	ASSERT(bsp->callback);
9841 
9842 	/*
9843 	 * A dip cannot be busy if its reference count is 0
9844 	 */
9845 	if ((ref = e_ddi_devi_holdcnt(dip)) == 0) {
9846 		return (bsp->callback(dip, bsp->arg, 0));
9847 	}
9848 
9849 	if (mod_hash_find(bsp->dv_hash, dip, (mod_hash_val_t *)&dvbusy))
9850 		dvbusy = 0;
9851 
9852 	/*
9853 	 * To catch device opens currently maintained on specfs common snodes.
9854 	 */
9855 	if (mod_hash_find(bsp->s_hash, dip, (mod_hash_val_t *)&sbusy))
9856 		sbusy = 0;
9857 
9858 #ifdef	DEBUG
9859 	if (ref < sbusy || ref < dvbusy) {
9860 		cmn_err(CE_WARN, "dip(%p): sopen = %lu, dvopen = %lu "
9861 		    "dip ref = %lu\n", (void *)dip, sbusy, dvbusy, ref);
9862 	}
9863 #endif
9864 
9865 	dvbusy = (sbusy > dvbusy) ? sbusy : dvbusy;
9866 
9867 	return (bsp->callback(dip, bsp->arg, dvbusy));
9868 }
9869 
9870 static int
9871 visit_snode(struct snode *sp, void *arg)
9872 {
9873 	uintptr_t sbusy;
9874 	dev_info_t *dip;
9875 	int count;
9876 	struct devi_busy *bsp = arg;
9877 
9878 	ASSERT(sp);
9879 
9880 	/*
9881 	 * The stable lock is held. This prevents
9882 	 * the snode and its associated dip from
9883 	 * going away.
9884 	 */
9885 	dip = NULL;
9886 	count = spec_devi_open_count(sp, &dip);
9887 
9888 	if (count <= 0)
9889 		return (DDI_WALK_CONTINUE);
9890 
9891 	ASSERT(dip);
9892 
9893 	if (mod_hash_remove(bsp->s_hash, dip, (mod_hash_val_t *)&sbusy))
9894 		sbusy = count;
9895 	else
9896 		sbusy += count;
9897 
9898 	if (mod_hash_insert(bsp->s_hash, dip, (mod_hash_val_t)sbusy)) {
9899 		cmn_err(CE_WARN, "%s: s_hash insert failed: dip=0x%p, "
9900 		    "sbusy = %lu", "e_ddi_branch_referenced",
9901 		    (void *)dip, sbusy);
9902 	}
9903 
9904 	bsp->s_total += count;
9905 
9906 	return (DDI_WALK_CONTINUE);
9907 }
9908 
9909 static void
9910 visit_dvnode(struct dv_node *dv, void *arg)
9911 {
9912 	uintptr_t dvbusy;
9913 	uint_t count;
9914 	struct vnode *vp;
9915 	struct devi_busy *bsp = arg;
9916 
9917 	ASSERT(dv && dv->dv_devi);
9918 
9919 	vp = DVTOV(dv);
9920 
9921 	mutex_enter(&vp->v_lock);
9922 	count = vp->v_count;
9923 	mutex_exit(&vp->v_lock);
9924 
9925 	if (!count)
9926 		return;
9927 
9928 	if (mod_hash_remove(bsp->dv_hash, dv->dv_devi,
9929 	    (mod_hash_val_t *)&dvbusy))
9930 		dvbusy = count;
9931 	else
9932 		dvbusy += count;
9933 
9934 	if (mod_hash_insert(bsp->dv_hash, dv->dv_devi,
9935 	    (mod_hash_val_t)dvbusy)) {
9936 		cmn_err(CE_WARN, "%s: dv_hash insert failed: dip=0x%p, "
9937 		    "dvbusy=%lu", "e_ddi_branch_referenced",
9938 		    (void *)dv->dv_devi, dvbusy);
9939 	}
9940 
9941 	bsp->dv_total += count;
9942 }
9943 
9944 /*
9945  * Returns reference count on success or -1 on failure.
9946  */
9947 int
9948 e_ddi_branch_referenced(
9949 	dev_info_t *rdip,
9950 	int (*callback)(dev_info_t *dip, void *arg, uint_t ref),
9951 	void *arg)
9952 {
9953 	int circ;
9954 	char *path;
9955 	dev_info_t *pdip;
9956 	struct devi_busy bsa = {0};
9957 
9958 	ASSERT(rdip);
9959 
9960 	path = kmem_alloc(MAXPATHLEN, KM_SLEEP);
9961 
9962 	ndi_hold_devi(rdip);
9963 
9964 	pdip = ddi_get_parent(rdip);
9965 
9966 	ASSERT(pdip);
9967 
9968 	/*
9969 	 * Check if caller holds pdip busy - can cause deadlocks during
9970 	 * devfs_walk()
9971 	 */
9972 	if (!e_ddi_branch_held(rdip) || DEVI_BUSY_OWNED(pdip)) {
9973 		cmn_err(CE_WARN, "e_ddi_branch_referenced: failed: "
9974 		    "devinfo branch(%p) not held or parent busy held",
9975 		    (void *)rdip);
9976 		ndi_rele_devi(rdip);
9977 		kmem_free(path, MAXPATHLEN);
9978 		return (-1);
9979 	}
9980 
9981 	ndi_devi_enter(pdip, &circ);
9982 	(void) ddi_pathname(rdip, path);
9983 	ndi_devi_exit(pdip, circ);
9984 
9985 	bsa.dv_hash = mod_hash_create_ptrhash("dv_node busy hash", NUMCHAINS,
9986 	    mod_hash_null_valdtor, sizeof (struct dev_info));
9987 
9988 	bsa.s_hash = mod_hash_create_ptrhash("snode busy hash", NUMCHAINS,
9989 	    mod_hash_null_valdtor, sizeof (struct snode));
9990 
9991 	if (devfs_walk(path, visit_dvnode, &bsa)) {
9992 		cmn_err(CE_WARN, "e_ddi_branch_referenced: "
9993 		    "devfs walk failed for: %s", path);
9994 		kmem_free(path, MAXPATHLEN);
9995 		bsa.s_total = bsa.dv_total = -1;
9996 		goto out;
9997 	}
9998 
9999 	kmem_free(path, MAXPATHLEN);
10000 
10001 	/*
10002 	 * Walk the snode table to detect device opens, which are currently
10003 	 * maintained on specfs common snodes.
10004 	 */
10005 	spec_snode_walk(visit_snode, &bsa);
10006 
10007 	if (callback == NULL)
10008 		goto out;
10009 
10010 	bsa.callback = callback;
10011 	bsa.arg = arg;
10012 
10013 	if (visit_dip(rdip, &bsa) == DDI_WALK_CONTINUE) {
10014 		ndi_devi_enter(rdip, &circ);
10015 		ddi_walk_devs(ddi_get_child(rdip), visit_dip, &bsa);
10016 		ndi_devi_exit(rdip, circ);
10017 	}
10018 
10019 out:
10020 	ndi_rele_devi(rdip);
10021 	mod_hash_destroy_ptrhash(bsa.s_hash);
10022 	mod_hash_destroy_ptrhash(bsa.dv_hash);
10023 	return (bsa.s_total > bsa.dv_total ? bsa.s_total : bsa.dv_total);
10024 }
10025