xref: /titanic_44/usr/src/uts/i86pc/io/rootnex.c (revision 1ce1951135b81c803c8dcf2f3c756009b1b0170a)
1 /*
2  * CDDL HEADER START
3  *
4  * The contents of this file are subject to the terms of the
5  * Common Development and Distribution License (the "License").
6  * You may not use this file except in compliance with the License.
7  *
8  * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
9  * or http://www.opensolaris.org/os/licensing.
10  * See the License for the specific language governing permissions
11  * and limitations under the License.
12  *
13  * When distributing Covered Code, include this CDDL HEADER in each
14  * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
15  * If applicable, add the following below this CDDL HEADER, with the
16  * fields enclosed by brackets "[]" replaced with your own identifying
17  * information: Portions Copyright [yyyy] [name of copyright owner]
18  *
19  * CDDL HEADER END
20  */
21 /*
22  * Copyright 2007 Sun Microsystems, Inc.  All rights reserved.
23  * Use is subject to license terms.
24  */
25 
26 #pragma ident	"%Z%%M%	%I%	%E% SMI"
27 
28 /*
29  * x86 root nexus driver
30  */
31 
32 #include <sys/sysmacros.h>
33 #include <sys/conf.h>
34 #include <sys/autoconf.h>
35 #include <sys/sysmacros.h>
36 #include <sys/debug.h>
37 #include <sys/psw.h>
38 #include <sys/ddidmareq.h>
39 #include <sys/promif.h>
40 #include <sys/devops.h>
41 #include <sys/kmem.h>
42 #include <sys/cmn_err.h>
43 #include <vm/seg.h>
44 #include <vm/seg_kmem.h>
45 #include <vm/seg_dev.h>
46 #include <sys/vmem.h>
47 #include <sys/mman.h>
48 #include <vm/hat.h>
49 #include <vm/as.h>
50 #include <vm/page.h>
51 #include <sys/avintr.h>
52 #include <sys/errno.h>
53 #include <sys/modctl.h>
54 #include <sys/ddi_impldefs.h>
55 #include <sys/sunddi.h>
56 #include <sys/sunndi.h>
57 #include <sys/mach_intr.h>
58 #include <sys/psm.h>
59 #include <sys/ontrap.h>
60 #include <sys/atomic.h>
61 #include <sys/sdt.h>
62 #include <sys/rootnex.h>
63 #include <vm/hat_i86.h>
64 #include <sys/ddifm.h>
65 #include <sys/ddi_isa.h>
66 
67 #ifdef __xpv
68 #include <sys/bootinfo.h>
69 #include <sys/hypervisor.h>
70 #include <sys/bootconf.h>
71 #include <vm/kboot_mmu.h>
72 #endif
73 
74 /*
75  * enable/disable extra checking of function parameters. Useful for debugging
76  * drivers.
77  */
78 #ifdef	DEBUG
79 int rootnex_alloc_check_parms = 1;
80 int rootnex_bind_check_parms = 1;
81 int rootnex_bind_check_inuse = 1;
82 int rootnex_unbind_verify_buffer = 0;
83 int rootnex_sync_check_parms = 1;
84 #else
85 int rootnex_alloc_check_parms = 0;
86 int rootnex_bind_check_parms = 0;
87 int rootnex_bind_check_inuse = 0;
88 int rootnex_unbind_verify_buffer = 0;
89 int rootnex_sync_check_parms = 0;
90 #endif
91 
92 /* Master Abort and Target Abort panic flag */
93 int rootnex_fm_ma_ta_panic_flag = 0;
94 
95 /* Semi-temporary patchables to phase in bug fixes, test drivers, etc. */
96 int rootnex_bind_fail = 1;
97 int rootnex_bind_warn = 1;
98 uint8_t *rootnex_warn_list;
99 /* bitmasks for rootnex_warn_list. Up to 8 different warnings with uint8_t */
100 #define	ROOTNEX_BIND_WARNING	(0x1 << 0)
101 
102 /*
103  * revert back to old broken behavior of always sync'ing entire copy buffer.
104  * This is useful if be have a buggy driver which doesn't correctly pass in
105  * the offset and size into ddi_dma_sync().
106  */
107 int rootnex_sync_ignore_params = 0;
108 
109 /*
110  * For the 64-bit kernel, pre-alloc enough cookies for a 256K buffer plus 1
111  * page for alignment. For the 32-bit kernel, pre-alloc enough cookies for a
112  * 64K buffer plus 1 page for alignment (we have less kernel space in a 32-bit
113  * kernel). Allocate enough windows to handle a 256K buffer w/ at least 65
114  * sgllen DMA engine, and enough copybuf buffer state pages to handle 2 pages
115  * (< 8K). We will still need to allocate the copy buffer during bind though
116  * (if we need one). These can only be modified in /etc/system before rootnex
117  * attach.
118  */
119 #if defined(__amd64)
120 int rootnex_prealloc_cookies = 65;
121 int rootnex_prealloc_windows = 4;
122 int rootnex_prealloc_copybuf = 2;
123 #else
124 int rootnex_prealloc_cookies = 33;
125 int rootnex_prealloc_windows = 4;
126 int rootnex_prealloc_copybuf = 2;
127 #endif
128 
129 /* driver global state */
130 static rootnex_state_t *rootnex_state;
131 
132 /* shortcut to rootnex counters */
133 static uint64_t *rootnex_cnt;
134 
135 /*
136  * XXX - does x86 even need these or are they left over from the SPARC days?
137  */
138 /* statically defined integer/boolean properties for the root node */
139 static rootnex_intprop_t rootnex_intprp[] = {
140 	{ "PAGESIZE",			PAGESIZE },
141 	{ "MMU_PAGESIZE",		MMU_PAGESIZE },
142 	{ "MMU_PAGEOFFSET",		MMU_PAGEOFFSET },
143 	{ DDI_RELATIVE_ADDRESSING,	1 },
144 };
145 #define	NROOT_INTPROPS	(sizeof (rootnex_intprp) / sizeof (rootnex_intprop_t))
146 
147 #ifdef __xpv
148 typedef maddr_t rootnex_addr_t;
149 #define	ROOTNEX_PADDR_TO_RBASE(xinfo, pa)	\
150 	(DOMAIN_IS_INITDOMAIN(xinfo) ? pa_to_ma(pa) : (pa))
151 #else
152 typedef paddr_t rootnex_addr_t;
153 #endif
154 
155 
156 static struct cb_ops rootnex_cb_ops = {
157 	nodev,		/* open */
158 	nodev,		/* close */
159 	nodev,		/* strategy */
160 	nodev,		/* print */
161 	nodev,		/* dump */
162 	nodev,		/* read */
163 	nodev,		/* write */
164 	nodev,		/* ioctl */
165 	nodev,		/* devmap */
166 	nodev,		/* mmap */
167 	nodev,		/* segmap */
168 	nochpoll,	/* chpoll */
169 	ddi_prop_op,	/* cb_prop_op */
170 	NULL,		/* struct streamtab */
171 	D_NEW | D_MP | D_HOTPLUG, /* compatibility flags */
172 	CB_REV,		/* Rev */
173 	nodev,		/* cb_aread */
174 	nodev		/* cb_awrite */
175 };
176 
177 static int rootnex_map(dev_info_t *dip, dev_info_t *rdip, ddi_map_req_t *mp,
178     off_t offset, off_t len, caddr_t *vaddrp);
179 static int rootnex_map_fault(dev_info_t *dip, dev_info_t *rdip,
180     struct hat *hat, struct seg *seg, caddr_t addr,
181     struct devpage *dp, pfn_t pfn, uint_t prot, uint_t lock);
182 static int rootnex_dma_map(dev_info_t *dip, dev_info_t *rdip,
183     struct ddi_dma_req *dmareq, ddi_dma_handle_t *handlep);
184 static int rootnex_dma_allochdl(dev_info_t *dip, dev_info_t *rdip,
185     ddi_dma_attr_t *attr, int (*waitfp)(caddr_t), caddr_t arg,
186     ddi_dma_handle_t *handlep);
187 static int rootnex_dma_freehdl(dev_info_t *dip, dev_info_t *rdip,
188     ddi_dma_handle_t handle);
189 static int rootnex_dma_bindhdl(dev_info_t *dip, dev_info_t *rdip,
190     ddi_dma_handle_t handle, struct ddi_dma_req *dmareq,
191     ddi_dma_cookie_t *cookiep, uint_t *ccountp);
192 static int rootnex_dma_unbindhdl(dev_info_t *dip, dev_info_t *rdip,
193     ddi_dma_handle_t handle);
194 static int rootnex_dma_sync(dev_info_t *dip, dev_info_t *rdip,
195     ddi_dma_handle_t handle, off_t off, size_t len, uint_t cache_flags);
196 static int rootnex_dma_win(dev_info_t *dip, dev_info_t *rdip,
197     ddi_dma_handle_t handle, uint_t win, off_t *offp, size_t *lenp,
198     ddi_dma_cookie_t *cookiep, uint_t *ccountp);
199 static int rootnex_dma_mctl(dev_info_t *dip, dev_info_t *rdip,
200     ddi_dma_handle_t handle, enum ddi_dma_ctlops request,
201     off_t *offp, size_t *lenp, caddr_t *objp, uint_t cache_flags);
202 static int rootnex_ctlops(dev_info_t *dip, dev_info_t *rdip,
203     ddi_ctl_enum_t ctlop, void *arg, void *result);
204 static int rootnex_fm_init(dev_info_t *dip, dev_info_t *tdip, int tcap,
205     ddi_iblock_cookie_t *ibc);
206 static int rootnex_intr_ops(dev_info_t *pdip, dev_info_t *rdip,
207     ddi_intr_op_t intr_op, ddi_intr_handle_impl_t *hdlp, void *result);
208 
209 
210 static struct bus_ops rootnex_bus_ops = {
211 	BUSO_REV,
212 	rootnex_map,
213 	NULL,
214 	NULL,
215 	NULL,
216 	rootnex_map_fault,
217 	rootnex_dma_map,
218 	rootnex_dma_allochdl,
219 	rootnex_dma_freehdl,
220 	rootnex_dma_bindhdl,
221 	rootnex_dma_unbindhdl,
222 	rootnex_dma_sync,
223 	rootnex_dma_win,
224 	rootnex_dma_mctl,
225 	rootnex_ctlops,
226 	ddi_bus_prop_op,
227 	i_ddi_rootnex_get_eventcookie,
228 	i_ddi_rootnex_add_eventcall,
229 	i_ddi_rootnex_remove_eventcall,
230 	i_ddi_rootnex_post_event,
231 	0,			/* bus_intr_ctl */
232 	0,			/* bus_config */
233 	0,			/* bus_unconfig */
234 	rootnex_fm_init,	/* bus_fm_init */
235 	NULL,			/* bus_fm_fini */
236 	NULL,			/* bus_fm_access_enter */
237 	NULL,			/* bus_fm_access_exit */
238 	NULL,			/* bus_powr */
239 	rootnex_intr_ops	/* bus_intr_op */
240 };
241 
242 static int rootnex_attach(dev_info_t *dip, ddi_attach_cmd_t cmd);
243 static int rootnex_detach(dev_info_t *dip, ddi_detach_cmd_t cmd);
244 
245 static struct dev_ops rootnex_ops = {
246 	DEVO_REV,
247 	0,
248 	ddi_no_info,
249 	nulldev,
250 	nulldev,
251 	rootnex_attach,
252 	rootnex_detach,
253 	nulldev,
254 	&rootnex_cb_ops,
255 	&rootnex_bus_ops
256 };
257 
258 static struct modldrv rootnex_modldrv = {
259 	&mod_driverops,
260 	"i86pc root nexus %I%",
261 	&rootnex_ops
262 };
263 
264 static struct modlinkage rootnex_modlinkage = {
265 	MODREV_1,
266 	(void *)&rootnex_modldrv,
267 	NULL
268 };
269 
270 
271 /*
272  *  extern hacks
273  */
274 extern struct seg_ops segdev_ops;
275 extern int ignore_hardware_nodes;	/* force flag from ddi_impl.c */
276 #ifdef	DDI_MAP_DEBUG
277 extern int ddi_map_debug_flag;
278 #define	ddi_map_debug	if (ddi_map_debug_flag) prom_printf
279 #endif
280 extern void i86_pp_map(page_t *pp, caddr_t kaddr);
281 extern void i86_va_map(caddr_t vaddr, struct as *asp, caddr_t kaddr);
282 extern int (*psm_intr_ops)(dev_info_t *, ddi_intr_handle_impl_t *,
283     psm_intr_op_t, int *);
284 extern int impl_ddi_sunbus_initchild(dev_info_t *dip);
285 extern void impl_ddi_sunbus_removechild(dev_info_t *dip);
286 
287 /*
288  * Use device arena to use for device control register mappings.
289  * Various kernel memory walkers (debugger, dtrace) need to know
290  * to avoid this address range to prevent undesired device activity.
291  */
292 extern void *device_arena_alloc(size_t size, int vm_flag);
293 extern void device_arena_free(void * vaddr, size_t size);
294 
295 
296 /*
297  *  Internal functions
298  */
299 static int rootnex_dma_init();
300 static void rootnex_add_props(dev_info_t *);
301 static int rootnex_ctl_reportdev(dev_info_t *dip);
302 static struct intrspec *rootnex_get_ispec(dev_info_t *rdip, int inum);
303 static int rootnex_map_regspec(ddi_map_req_t *mp, caddr_t *vaddrp);
304 static int rootnex_unmap_regspec(ddi_map_req_t *mp, caddr_t *vaddrp);
305 static int rootnex_map_handle(ddi_map_req_t *mp);
306 static void rootnex_clean_dmahdl(ddi_dma_impl_t *hp);
307 static int rootnex_valid_alloc_parms(ddi_dma_attr_t *attr, uint_t maxsegsize);
308 static int rootnex_valid_bind_parms(ddi_dma_req_t *dmareq,
309     ddi_dma_attr_t *attr);
310 static void rootnex_get_sgl(ddi_dma_obj_t *dmar_object, ddi_dma_cookie_t *sgl,
311     rootnex_sglinfo_t *sglinfo);
312 static int rootnex_bind_slowpath(ddi_dma_impl_t *hp, struct ddi_dma_req *dmareq,
313     rootnex_dma_t *dma, ddi_dma_attr_t *attr, int kmflag);
314 static int rootnex_setup_copybuf(ddi_dma_impl_t *hp, struct ddi_dma_req *dmareq,
315     rootnex_dma_t *dma, ddi_dma_attr_t *attr);
316 static void rootnex_teardown_copybuf(rootnex_dma_t *dma);
317 static int rootnex_setup_windows(ddi_dma_impl_t *hp, rootnex_dma_t *dma,
318     ddi_dma_attr_t *attr, int kmflag);
319 static void rootnex_teardown_windows(rootnex_dma_t *dma);
320 static void rootnex_init_win(ddi_dma_impl_t *hp, rootnex_dma_t *dma,
321     rootnex_window_t *window, ddi_dma_cookie_t *cookie, off_t cur_offset);
322 static void rootnex_setup_cookie(ddi_dma_obj_t *dmar_object,
323     rootnex_dma_t *dma, ddi_dma_cookie_t *cookie, off_t cur_offset,
324     size_t *copybuf_used, page_t **cur_pp);
325 static int rootnex_sgllen_window_boundary(ddi_dma_impl_t *hp,
326     rootnex_dma_t *dma, rootnex_window_t **windowp, ddi_dma_cookie_t *cookie,
327     ddi_dma_attr_t *attr, off_t cur_offset);
328 static int rootnex_copybuf_window_boundary(ddi_dma_impl_t *hp,
329     rootnex_dma_t *dma, rootnex_window_t **windowp,
330     ddi_dma_cookie_t *cookie, off_t cur_offset, size_t *copybuf_used);
331 static int rootnex_maxxfer_window_boundary(ddi_dma_impl_t *hp,
332     rootnex_dma_t *dma, rootnex_window_t **windowp, ddi_dma_cookie_t *cookie);
333 static int rootnex_valid_sync_parms(ddi_dma_impl_t *hp, rootnex_window_t *win,
334     off_t offset, size_t size, uint_t cache_flags);
335 static int rootnex_verify_buffer(rootnex_dma_t *dma);
336 static int rootnex_dma_check(dev_info_t *dip, const void *handle,
337     const void *comp_addr, const void *not_used);
338 
339 /*
340  * _init()
341  *
342  */
343 int
344 _init(void)
345 {
346 
347 	rootnex_state = NULL;
348 	return (mod_install(&rootnex_modlinkage));
349 }
350 
351 
352 /*
353  * _info()
354  *
355  */
356 int
357 _info(struct modinfo *modinfop)
358 {
359 	return (mod_info(&rootnex_modlinkage, modinfop));
360 }
361 
362 
363 /*
364  * _fini()
365  *
366  */
367 int
368 _fini(void)
369 {
370 	return (EBUSY);
371 }
372 
373 
374 /*
375  * rootnex_attach()
376  *
377  */
378 static int
379 rootnex_attach(dev_info_t *dip, ddi_attach_cmd_t cmd)
380 {
381 	int fmcap;
382 	int e;
383 
384 	switch (cmd) {
385 	case DDI_ATTACH:
386 		break;
387 	case DDI_RESUME:
388 		return (DDI_SUCCESS);
389 	default:
390 		return (DDI_FAILURE);
391 	}
392 
393 	/*
394 	 * We should only have one instance of rootnex. Save it away since we
395 	 * don't have an easy way to get it back later.
396 	 */
397 	ASSERT(rootnex_state == NULL);
398 	rootnex_state = kmem_zalloc(sizeof (rootnex_state_t), KM_SLEEP);
399 
400 	rootnex_state->r_dip = dip;
401 	rootnex_state->r_err_ibc = (ddi_iblock_cookie_t)ipltospl(15);
402 	rootnex_state->r_reserved_msg_printed = B_FALSE;
403 	rootnex_cnt = &rootnex_state->r_counters[0];
404 
405 	/*
406 	 * Set minimum fm capability level for i86pc platforms and then
407 	 * initialize error handling. Since we're the rootnex, we don't
408 	 * care what's returned in the fmcap field.
409 	 */
410 	ddi_system_fmcap = DDI_FM_EREPORT_CAPABLE | DDI_FM_ERRCB_CAPABLE |
411 	    DDI_FM_ACCCHK_CAPABLE | DDI_FM_DMACHK_CAPABLE;
412 	fmcap = ddi_system_fmcap;
413 	ddi_fm_init(dip, &fmcap, &rootnex_state->r_err_ibc);
414 
415 	/* initialize DMA related state */
416 	e = rootnex_dma_init();
417 	if (e != DDI_SUCCESS) {
418 		kmem_free(rootnex_state, sizeof (rootnex_state_t));
419 		return (DDI_FAILURE);
420 	}
421 
422 	/* Add static root node properties */
423 	rootnex_add_props(dip);
424 
425 	/* since we can't call ddi_report_dev() */
426 	cmn_err(CE_CONT, "?root nexus = %s\n", ddi_get_name(dip));
427 
428 	/* Initialize rootnex event handle */
429 	i_ddi_rootnex_init_events(dip);
430 
431 	return (DDI_SUCCESS);
432 }
433 
434 
435 /*
436  * rootnex_detach()
437  *
438  */
439 /*ARGSUSED*/
440 static int
441 rootnex_detach(dev_info_t *dip, ddi_detach_cmd_t cmd)
442 {
443 	switch (cmd) {
444 	case DDI_SUSPEND:
445 		break;
446 	default:
447 		return (DDI_FAILURE);
448 	}
449 
450 	return (DDI_SUCCESS);
451 }
452 
453 
454 /*
455  * rootnex_dma_init()
456  *
457  */
458 /*ARGSUSED*/
459 static int
460 rootnex_dma_init()
461 {
462 	size_t bufsize;
463 
464 
465 	/*
466 	 * size of our cookie/window/copybuf state needed in dma bind that we
467 	 * pre-alloc in dma_alloc_handle
468 	 */
469 	rootnex_state->r_prealloc_cookies = rootnex_prealloc_cookies;
470 	rootnex_state->r_prealloc_size =
471 	    (rootnex_state->r_prealloc_cookies * sizeof (ddi_dma_cookie_t)) +
472 	    (rootnex_prealloc_windows * sizeof (rootnex_window_t)) +
473 	    (rootnex_prealloc_copybuf * sizeof (rootnex_pgmap_t));
474 
475 	/*
476 	 * setup DDI DMA handle kmem cache, align each handle on 64 bytes,
477 	 * allocate 16 extra bytes for struct pointer alignment
478 	 * (p->dmai_private & dma->dp_prealloc_buffer)
479 	 */
480 	bufsize = sizeof (ddi_dma_impl_t) + sizeof (rootnex_dma_t) +
481 	    rootnex_state->r_prealloc_size + 0x10;
482 	rootnex_state->r_dmahdl_cache = kmem_cache_create("rootnex_dmahdl",
483 	    bufsize, 64, NULL, NULL, NULL, NULL, NULL, 0);
484 	if (rootnex_state->r_dmahdl_cache == NULL) {
485 		return (DDI_FAILURE);
486 	}
487 
488 	/*
489 	 * allocate array to track which major numbers we have printed warnings
490 	 * for.
491 	 */
492 	rootnex_warn_list = kmem_zalloc(devcnt * sizeof (*rootnex_warn_list),
493 	    KM_SLEEP);
494 
495 	return (DDI_SUCCESS);
496 }
497 
498 
499 /*
500  * rootnex_add_props()
501  *
502  */
503 static void
504 rootnex_add_props(dev_info_t *dip)
505 {
506 	rootnex_intprop_t *rpp;
507 	int i;
508 
509 	/* Add static integer/boolean properties to the root node */
510 	rpp = rootnex_intprp;
511 	for (i = 0; i < NROOT_INTPROPS; i++) {
512 		(void) e_ddi_prop_update_int(DDI_DEV_T_NONE, dip,
513 		    rpp[i].prop_name, rpp[i].prop_value);
514 	}
515 }
516 
517 
518 
519 /*
520  * *************************
521  *  ctlops related routines
522  * *************************
523  */
524 
525 /*
526  * rootnex_ctlops()
527  *
528  */
529 /*ARGSUSED*/
530 static int
531 rootnex_ctlops(dev_info_t *dip, dev_info_t *rdip, ddi_ctl_enum_t ctlop,
532     void *arg, void *result)
533 {
534 	int n, *ptr;
535 	struct ddi_parent_private_data *pdp;
536 
537 	switch (ctlop) {
538 	case DDI_CTLOPS_DMAPMAPC:
539 		/*
540 		 * Return 'partial' to indicate that dma mapping
541 		 * has to be done in the main MMU.
542 		 */
543 		return (DDI_DMA_PARTIAL);
544 
545 	case DDI_CTLOPS_BTOP:
546 		/*
547 		 * Convert byte count input to physical page units.
548 		 * (byte counts that are not a page-size multiple
549 		 * are rounded down)
550 		 */
551 		*(ulong_t *)result = btop(*(ulong_t *)arg);
552 		return (DDI_SUCCESS);
553 
554 	case DDI_CTLOPS_PTOB:
555 		/*
556 		 * Convert size in physical pages to bytes
557 		 */
558 		*(ulong_t *)result = ptob(*(ulong_t *)arg);
559 		return (DDI_SUCCESS);
560 
561 	case DDI_CTLOPS_BTOPR:
562 		/*
563 		 * Convert byte count input to physical page units
564 		 * (byte counts that are not a page-size multiple
565 		 * are rounded up)
566 		 */
567 		*(ulong_t *)result = btopr(*(ulong_t *)arg);
568 		return (DDI_SUCCESS);
569 
570 	case DDI_CTLOPS_INITCHILD:
571 		return (impl_ddi_sunbus_initchild(arg));
572 
573 	case DDI_CTLOPS_UNINITCHILD:
574 		impl_ddi_sunbus_removechild(arg);
575 		return (DDI_SUCCESS);
576 
577 	case DDI_CTLOPS_REPORTDEV:
578 		return (rootnex_ctl_reportdev(rdip));
579 
580 	case DDI_CTLOPS_IOMIN:
581 		/*
582 		 * Nothing to do here but reflect back..
583 		 */
584 		return (DDI_SUCCESS);
585 
586 	case DDI_CTLOPS_REGSIZE:
587 	case DDI_CTLOPS_NREGS:
588 		break;
589 
590 	case DDI_CTLOPS_SIDDEV:
591 		if (ndi_dev_is_prom_node(rdip))
592 			return (DDI_SUCCESS);
593 		if (ndi_dev_is_persistent_node(rdip))
594 			return (DDI_SUCCESS);
595 		return (DDI_FAILURE);
596 
597 	case DDI_CTLOPS_POWER:
598 		return ((*pm_platform_power)((power_req_t *)arg));
599 
600 	case DDI_CTLOPS_RESERVED0: /* Was DDI_CTLOPS_NINTRS, obsolete */
601 	case DDI_CTLOPS_RESERVED1: /* Was DDI_CTLOPS_POKE_INIT, obsolete */
602 	case DDI_CTLOPS_RESERVED2: /* Was DDI_CTLOPS_POKE_FLUSH, obsolete */
603 	case DDI_CTLOPS_RESERVED3: /* Was DDI_CTLOPS_POKE_FINI, obsolete */
604 	case DDI_CTLOPS_RESERVED4: /* Was DDI_CTLOPS_INTR_HILEVEL, obsolete */
605 	case DDI_CTLOPS_RESERVED5: /* Was DDI_CTLOPS_XLATE_INTRS, obsolete */
606 		if (!rootnex_state->r_reserved_msg_printed) {
607 			rootnex_state->r_reserved_msg_printed = B_TRUE;
608 			cmn_err(CE_WARN, "Failing ddi_ctlops call(s) for "
609 			    "1 or more reserved/obsolete operations.");
610 		}
611 		return (DDI_FAILURE);
612 
613 	default:
614 		return (DDI_FAILURE);
615 	}
616 	/*
617 	 * The rest are for "hardware" properties
618 	 */
619 	if ((pdp = ddi_get_parent_data(rdip)) == NULL)
620 		return (DDI_FAILURE);
621 
622 	if (ctlop == DDI_CTLOPS_NREGS) {
623 		ptr = (int *)result;
624 		*ptr = pdp->par_nreg;
625 	} else {
626 		off_t *size = (off_t *)result;
627 
628 		ptr = (int *)arg;
629 		n = *ptr;
630 		if (n >= pdp->par_nreg) {
631 			return (DDI_FAILURE);
632 		}
633 		*size = (off_t)pdp->par_reg[n].regspec_size;
634 	}
635 	return (DDI_SUCCESS);
636 }
637 
638 
639 /*
640  * rootnex_ctl_reportdev()
641  *
642  */
643 static int
644 rootnex_ctl_reportdev(dev_info_t *dev)
645 {
646 	int i, n, len, f_len = 0;
647 	char *buf;
648 
649 	buf = kmem_alloc(REPORTDEV_BUFSIZE, KM_SLEEP);
650 	f_len += snprintf(buf, REPORTDEV_BUFSIZE,
651 	    "%s%d at root", ddi_driver_name(dev), ddi_get_instance(dev));
652 	len = strlen(buf);
653 
654 	for (i = 0; i < sparc_pd_getnreg(dev); i++) {
655 
656 		struct regspec *rp = sparc_pd_getreg(dev, i);
657 
658 		if (i == 0)
659 			f_len += snprintf(buf + len, REPORTDEV_BUFSIZE - len,
660 			    ": ");
661 		else
662 			f_len += snprintf(buf + len, REPORTDEV_BUFSIZE - len,
663 			    " and ");
664 		len = strlen(buf);
665 
666 		switch (rp->regspec_bustype) {
667 
668 		case BTEISA:
669 			f_len += snprintf(buf + len, REPORTDEV_BUFSIZE - len,
670 			    "%s 0x%x", DEVI_EISA_NEXNAME, rp->regspec_addr);
671 			break;
672 
673 		case BTISA:
674 			f_len += snprintf(buf + len, REPORTDEV_BUFSIZE - len,
675 			    "%s 0x%x", DEVI_ISA_NEXNAME, rp->regspec_addr);
676 			break;
677 
678 		default:
679 			f_len += snprintf(buf + len, REPORTDEV_BUFSIZE - len,
680 			    "space %x offset %x",
681 			    rp->regspec_bustype, rp->regspec_addr);
682 			break;
683 		}
684 		len = strlen(buf);
685 	}
686 	for (i = 0, n = sparc_pd_getnintr(dev); i < n; i++) {
687 		int pri;
688 
689 		if (i != 0) {
690 			f_len += snprintf(buf + len, REPORTDEV_BUFSIZE - len,
691 			    ",");
692 			len = strlen(buf);
693 		}
694 		pri = INT_IPL(sparc_pd_getintr(dev, i)->intrspec_pri);
695 		f_len += snprintf(buf + len, REPORTDEV_BUFSIZE - len,
696 		    " sparc ipl %d", pri);
697 		len = strlen(buf);
698 	}
699 #ifdef DEBUG
700 	if (f_len + 1 >= REPORTDEV_BUFSIZE) {
701 		cmn_err(CE_NOTE, "next message is truncated: "
702 		    "printed length 1024, real length %d", f_len);
703 	}
704 #endif /* DEBUG */
705 	cmn_err(CE_CONT, "?%s\n", buf);
706 	kmem_free(buf, REPORTDEV_BUFSIZE);
707 	return (DDI_SUCCESS);
708 }
709 
710 
711 /*
712  * ******************
713  *  map related code
714  * ******************
715  */
716 
717 /*
718  * rootnex_map()
719  *
720  */
721 static int
722 rootnex_map(dev_info_t *dip, dev_info_t *rdip, ddi_map_req_t *mp, off_t offset,
723     off_t len, caddr_t *vaddrp)
724 {
725 	struct regspec *rp, tmp_reg;
726 	ddi_map_req_t mr = *mp;		/* Get private copy of request */
727 	int error;
728 
729 	mp = &mr;
730 
731 	switch (mp->map_op)  {
732 	case DDI_MO_MAP_LOCKED:
733 	case DDI_MO_UNMAP:
734 	case DDI_MO_MAP_HANDLE:
735 		break;
736 	default:
737 #ifdef	DDI_MAP_DEBUG
738 		cmn_err(CE_WARN, "rootnex_map: unimplemented map op %d.",
739 		    mp->map_op);
740 #endif	/* DDI_MAP_DEBUG */
741 		return (DDI_ME_UNIMPLEMENTED);
742 	}
743 
744 	if (mp->map_flags & DDI_MF_USER_MAPPING)  {
745 #ifdef	DDI_MAP_DEBUG
746 		cmn_err(CE_WARN, "rootnex_map: unimplemented map type: user.");
747 #endif	/* DDI_MAP_DEBUG */
748 		return (DDI_ME_UNIMPLEMENTED);
749 	}
750 
751 	/*
752 	 * First, if given an rnumber, convert it to a regspec...
753 	 * (Presumably, this is on behalf of a child of the root node?)
754 	 */
755 
756 	if (mp->map_type == DDI_MT_RNUMBER)  {
757 
758 		int rnumber = mp->map_obj.rnumber;
759 #ifdef	DDI_MAP_DEBUG
760 		static char *out_of_range =
761 		    "rootnex_map: Out of range rnumber <%d>, device <%s>";
762 #endif	/* DDI_MAP_DEBUG */
763 
764 		rp = i_ddi_rnumber_to_regspec(rdip, rnumber);
765 		if (rp == NULL)  {
766 #ifdef	DDI_MAP_DEBUG
767 			cmn_err(CE_WARN, out_of_range, rnumber,
768 			    ddi_get_name(rdip));
769 #endif	/* DDI_MAP_DEBUG */
770 			return (DDI_ME_RNUMBER_RANGE);
771 		}
772 
773 		/*
774 		 * Convert the given ddi_map_req_t from rnumber to regspec...
775 		 */
776 
777 		mp->map_type = DDI_MT_REGSPEC;
778 		mp->map_obj.rp = rp;
779 	}
780 
781 	/*
782 	 * Adjust offset and length correspnding to called values...
783 	 * XXX: A non-zero length means override the one in the regspec
784 	 * XXX: (regardless of what's in the parent's range?)
785 	 */
786 
787 	tmp_reg = *(mp->map_obj.rp);		/* Preserve underlying data */
788 	rp = mp->map_obj.rp = &tmp_reg;		/* Use tmp_reg in request */
789 
790 #ifdef	DDI_MAP_DEBUG
791 	cmn_err(CE_CONT, "rootnex: <%s,%s> <0x%x, 0x%x, 0x%d> offset %d len %d "
792 	    "handle 0x%x\n", ddi_get_name(dip), ddi_get_name(rdip),
793 	    rp->regspec_bustype, rp->regspec_addr, rp->regspec_size, offset,
794 	    len, mp->map_handlep);
795 #endif	/* DDI_MAP_DEBUG */
796 
797 	/*
798 	 * I/O or memory mapping:
799 	 *
800 	 *	<bustype=0, addr=x, len=x>: memory
801 	 *	<bustype=1, addr=x, len=x>: i/o
802 	 *	<bustype>1, addr=0, len=x>: x86-compatibility i/o
803 	 */
804 
805 	if (rp->regspec_bustype > 1 && rp->regspec_addr != 0) {
806 		cmn_err(CE_WARN, "<%s,%s> invalid register spec"
807 		    " <0x%x, 0x%x, 0x%x>", ddi_get_name(dip),
808 		    ddi_get_name(rdip), rp->regspec_bustype,
809 		    rp->regspec_addr, rp->regspec_size);
810 		return (DDI_ME_INVAL);
811 	}
812 
813 	if (rp->regspec_bustype > 1 && rp->regspec_addr == 0) {
814 		/*
815 		 * compatibility i/o mapping
816 		 */
817 		rp->regspec_bustype += (uint_t)offset;
818 	} else {
819 		/*
820 		 * Normal memory or i/o mapping
821 		 */
822 		rp->regspec_addr += (uint_t)offset;
823 	}
824 
825 	if (len != 0)
826 		rp->regspec_size = (uint_t)len;
827 
828 #ifdef	DDI_MAP_DEBUG
829 	cmn_err(CE_CONT, "             <%s,%s> <0x%x, 0x%x, 0x%d> offset %d "
830 	    "len %d handle 0x%x\n", ddi_get_name(dip), ddi_get_name(rdip),
831 	    rp->regspec_bustype, rp->regspec_addr, rp->regspec_size,
832 	    offset, len, mp->map_handlep);
833 #endif	/* DDI_MAP_DEBUG */
834 
835 	/*
836 	 * Apply any parent ranges at this level, if applicable.
837 	 * (This is where nexus specific regspec translation takes place.
838 	 * Use of this function is implicit agreement that translation is
839 	 * provided via ddi_apply_range.)
840 	 */
841 
842 #ifdef	DDI_MAP_DEBUG
843 	ddi_map_debug("applying range of parent <%s> to child <%s>...\n",
844 	    ddi_get_name(dip), ddi_get_name(rdip));
845 #endif	/* DDI_MAP_DEBUG */
846 
847 	if ((error = i_ddi_apply_range(dip, rdip, mp->map_obj.rp)) != 0)
848 		return (error);
849 
850 	switch (mp->map_op)  {
851 	case DDI_MO_MAP_LOCKED:
852 
853 		/*
854 		 * Set up the locked down kernel mapping to the regspec...
855 		 */
856 
857 		return (rootnex_map_regspec(mp, vaddrp));
858 
859 	case DDI_MO_UNMAP:
860 
861 		/*
862 		 * Release mapping...
863 		 */
864 
865 		return (rootnex_unmap_regspec(mp, vaddrp));
866 
867 	case DDI_MO_MAP_HANDLE:
868 
869 		return (rootnex_map_handle(mp));
870 
871 	default:
872 		return (DDI_ME_UNIMPLEMENTED);
873 	}
874 }
875 
876 
877 /*
878  * rootnex_map_fault()
879  *
880  *	fault in mappings for requestors
881  */
882 /*ARGSUSED*/
883 static int
884 rootnex_map_fault(dev_info_t *dip, dev_info_t *rdip, struct hat *hat,
885     struct seg *seg, caddr_t addr, struct devpage *dp, pfn_t pfn, uint_t prot,
886     uint_t lock)
887 {
888 
889 #ifdef	DDI_MAP_DEBUG
890 	ddi_map_debug("rootnex_map_fault: address <%x> pfn <%x>", addr, pfn);
891 	ddi_map_debug(" Seg <%s>\n",
892 	    seg->s_ops == &segdev_ops ? "segdev" :
893 	    seg == &kvseg ? "segkmem" : "NONE!");
894 #endif	/* DDI_MAP_DEBUG */
895 
896 	/*
897 	 * This is all terribly broken, but it is a start
898 	 *
899 	 * XXX	Note that this test means that segdev_ops
900 	 *	must be exported from seg_dev.c.
901 	 * XXX	What about devices with their own segment drivers?
902 	 */
903 	if (seg->s_ops == &segdev_ops) {
904 		struct segdev_data *sdp = (struct segdev_data *)seg->s_data;
905 
906 		if (hat == NULL) {
907 			/*
908 			 * This is one plausible interpretation of
909 			 * a null hat i.e. use the first hat on the
910 			 * address space hat list which by convention is
911 			 * the hat of the system MMU.  At alternative
912 			 * would be to panic .. this might well be better ..
913 			 */
914 			ASSERT(AS_READ_HELD(seg->s_as, &seg->s_as->a_lock));
915 			hat = seg->s_as->a_hat;
916 			cmn_err(CE_NOTE, "rootnex_map_fault: nil hat");
917 		}
918 		hat_devload(hat, addr, MMU_PAGESIZE, pfn, prot | sdp->hat_attr,
919 		    (lock ? HAT_LOAD_LOCK : HAT_LOAD));
920 	} else if (seg == &kvseg && dp == NULL) {
921 		hat_devload(kas.a_hat, addr, MMU_PAGESIZE, pfn, prot,
922 		    HAT_LOAD_LOCK);
923 	} else
924 		return (DDI_FAILURE);
925 	return (DDI_SUCCESS);
926 }
927 
928 
929 /*
930  * rootnex_map_regspec()
931  *     we don't support mapping of I/O cards above 4Gb
932  */
933 static int
934 rootnex_map_regspec(ddi_map_req_t *mp, caddr_t *vaddrp)
935 {
936 	rootnex_addr_t rbase;
937 	void *cvaddr;
938 	uint_t npages, pgoffset;
939 	struct regspec *rp;
940 	ddi_acc_hdl_t *hp;
941 	ddi_acc_impl_t *ap;
942 	uint_t	hat_acc_flags;
943 	paddr_t pbase;
944 
945 	rp = mp->map_obj.rp;
946 	hp = mp->map_handlep;
947 
948 #ifdef	DDI_MAP_DEBUG
949 	ddi_map_debug(
950 	    "rootnex_map_regspec: <0x%x 0x%x 0x%x> handle 0x%x\n",
951 	    rp->regspec_bustype, rp->regspec_addr,
952 	    rp->regspec_size, mp->map_handlep);
953 #endif	/* DDI_MAP_DEBUG */
954 
955 	/*
956 	 * I/O or memory mapping
957 	 *
958 	 *	<bustype=0, addr=x, len=x>: memory
959 	 *	<bustype=1, addr=x, len=x>: i/o
960 	 *	<bustype>1, addr=0, len=x>: x86-compatibility i/o
961 	 */
962 
963 	if (rp->regspec_bustype > 1 && rp->regspec_addr != 0) {
964 		cmn_err(CE_WARN, "rootnex: invalid register spec"
965 		    " <0x%x, 0x%x, 0x%x>", rp->regspec_bustype,
966 		    rp->regspec_addr, rp->regspec_size);
967 		return (DDI_FAILURE);
968 	}
969 
970 	if (rp->regspec_bustype != 0) {
971 		/*
972 		 * I/O space - needs a handle.
973 		 */
974 		if (hp == NULL) {
975 			return (DDI_FAILURE);
976 		}
977 		ap = (ddi_acc_impl_t *)hp->ah_platform_private;
978 		ap->ahi_acc_attr |= DDI_ACCATTR_IO_SPACE;
979 		impl_acc_hdl_init(hp);
980 
981 		if (mp->map_flags & DDI_MF_DEVICE_MAPPING) {
982 #ifdef  DDI_MAP_DEBUG
983 			ddi_map_debug("rootnex_map_regspec: mmap() "
984 			    "to I/O space is not supported.\n");
985 #endif  /* DDI_MAP_DEBUG */
986 			return (DDI_ME_INVAL);
987 		} else {
988 			/*
989 			 * 1275-compliant vs. compatibility i/o mapping
990 			 */
991 			*vaddrp =
992 			    (rp->regspec_bustype > 1 && rp->regspec_addr == 0) ?
993 			    ((caddr_t)(uintptr_t)rp->regspec_bustype) :
994 			    ((caddr_t)(uintptr_t)rp->regspec_addr);
995 #ifdef __xpv
996 			if (DOMAIN_IS_INITDOMAIN(xen_info)) {
997 				hp->ah_pfn = xen_assign_pfn(
998 				    mmu_btop((ulong_t)rp->regspec_addr &
999 				    MMU_PAGEMASK));
1000 			} else {
1001 				hp->ah_pfn = mmu_btop(
1002 				    (ulong_t)rp->regspec_addr & MMU_PAGEMASK);
1003 			}
1004 #else
1005 			hp->ah_pfn = mmu_btop((ulong_t)rp->regspec_addr &
1006 			    MMU_PAGEMASK);
1007 #endif
1008 			hp->ah_pnum = mmu_btopr(rp->regspec_size +
1009 			    (ulong_t)rp->regspec_addr & MMU_PAGEOFFSET);
1010 		}
1011 
1012 #ifdef	DDI_MAP_DEBUG
1013 		ddi_map_debug(
1014 	    "rootnex_map_regspec: \"Mapping\" %d bytes I/O space at 0x%x\n",
1015 		    rp->regspec_size, *vaddrp);
1016 #endif	/* DDI_MAP_DEBUG */
1017 		return (DDI_SUCCESS);
1018 	}
1019 
1020 	/*
1021 	 * Memory space
1022 	 */
1023 
1024 	if (hp != NULL) {
1025 		/*
1026 		 * hat layer ignores
1027 		 * hp->ah_acc.devacc_attr_endian_flags.
1028 		 */
1029 		switch (hp->ah_acc.devacc_attr_dataorder) {
1030 		case DDI_STRICTORDER_ACC:
1031 			hat_acc_flags = HAT_STRICTORDER;
1032 			break;
1033 		case DDI_UNORDERED_OK_ACC:
1034 			hat_acc_flags = HAT_UNORDERED_OK;
1035 			break;
1036 		case DDI_MERGING_OK_ACC:
1037 			hat_acc_flags = HAT_MERGING_OK;
1038 			break;
1039 		case DDI_LOADCACHING_OK_ACC:
1040 			hat_acc_flags = HAT_LOADCACHING_OK;
1041 			break;
1042 		case DDI_STORECACHING_OK_ACC:
1043 			hat_acc_flags = HAT_STORECACHING_OK;
1044 			break;
1045 		}
1046 		ap = (ddi_acc_impl_t *)hp->ah_platform_private;
1047 		ap->ahi_acc_attr |= DDI_ACCATTR_CPU_VADDR;
1048 		impl_acc_hdl_init(hp);
1049 		hp->ah_hat_flags = hat_acc_flags;
1050 	} else {
1051 		hat_acc_flags = HAT_STRICTORDER;
1052 	}
1053 
1054 	rbase = (rootnex_addr_t)(rp->regspec_addr & MMU_PAGEMASK);
1055 #ifdef __xpv
1056 	/*
1057 	 * If we're dom0, we're using a real device so we need to translate
1058 	 * the MA to a PA.
1059 	 */
1060 	if (DOMAIN_IS_INITDOMAIN(xen_info)) {
1061 		pbase = pfn_to_pa(xen_assign_pfn(mmu_btop(rbase)));
1062 	} else {
1063 		pbase = rbase;
1064 	}
1065 #else
1066 	pbase = rbase;
1067 #endif
1068 	pgoffset = (ulong_t)rp->regspec_addr & MMU_PAGEOFFSET;
1069 
1070 	if (rp->regspec_size == 0) {
1071 #ifdef  DDI_MAP_DEBUG
1072 		ddi_map_debug("rootnex_map_regspec: zero regspec_size\n");
1073 #endif  /* DDI_MAP_DEBUG */
1074 		return (DDI_ME_INVAL);
1075 	}
1076 
1077 	if (mp->map_flags & DDI_MF_DEVICE_MAPPING) {
1078 		/* extra cast to make gcc happy */
1079 		*vaddrp = (caddr_t)((uintptr_t)mmu_btop(pbase));
1080 	} else {
1081 		npages = mmu_btopr(rp->regspec_size + pgoffset);
1082 
1083 #ifdef	DDI_MAP_DEBUG
1084 		ddi_map_debug("rootnex_map_regspec: Mapping %d pages "
1085 		    "physical %llx", npages, pbase);
1086 #endif	/* DDI_MAP_DEBUG */
1087 
1088 		cvaddr = device_arena_alloc(ptob(npages), VM_NOSLEEP);
1089 		if (cvaddr == NULL)
1090 			return (DDI_ME_NORESOURCES);
1091 
1092 		/*
1093 		 * Now map in the pages we've allocated...
1094 		 */
1095 		hat_devload(kas.a_hat, cvaddr, mmu_ptob(npages),
1096 		    mmu_btop(pbase), mp->map_prot | hat_acc_flags,
1097 		    HAT_LOAD_LOCK);
1098 		*vaddrp = (caddr_t)cvaddr + pgoffset;
1099 
1100 		/* save away pfn and npages for FMA */
1101 		hp = mp->map_handlep;
1102 		if (hp) {
1103 			hp->ah_pfn = mmu_btop(pbase);
1104 			hp->ah_pnum = npages;
1105 		}
1106 	}
1107 
1108 #ifdef	DDI_MAP_DEBUG
1109 	ddi_map_debug("at virtual 0x%x\n", *vaddrp);
1110 #endif	/* DDI_MAP_DEBUG */
1111 	return (DDI_SUCCESS);
1112 }
1113 
1114 
1115 /*
1116  * rootnex_unmap_regspec()
1117  *
1118  */
1119 static int
1120 rootnex_unmap_regspec(ddi_map_req_t *mp, caddr_t *vaddrp)
1121 {
1122 	caddr_t addr = (caddr_t)*vaddrp;
1123 	uint_t npages, pgoffset;
1124 	struct regspec *rp;
1125 
1126 	if (mp->map_flags & DDI_MF_DEVICE_MAPPING)
1127 		return (0);
1128 
1129 	rp = mp->map_obj.rp;
1130 
1131 	if (rp->regspec_size == 0) {
1132 #ifdef  DDI_MAP_DEBUG
1133 		ddi_map_debug("rootnex_unmap_regspec: zero regspec_size\n");
1134 #endif  /* DDI_MAP_DEBUG */
1135 		return (DDI_ME_INVAL);
1136 	}
1137 
1138 	/*
1139 	 * I/O or memory mapping:
1140 	 *
1141 	 *	<bustype=0, addr=x, len=x>: memory
1142 	 *	<bustype=1, addr=x, len=x>: i/o
1143 	 *	<bustype>1, addr=0, len=x>: x86-compatibility i/o
1144 	 */
1145 	if (rp->regspec_bustype != 0) {
1146 		/*
1147 		 * This is I/O space, which requires no particular
1148 		 * processing on unmap since it isn't mapped in the
1149 		 * first place.
1150 		 */
1151 		return (DDI_SUCCESS);
1152 	}
1153 
1154 	/*
1155 	 * Memory space
1156 	 */
1157 	pgoffset = (uintptr_t)addr & MMU_PAGEOFFSET;
1158 	npages = mmu_btopr(rp->regspec_size + pgoffset);
1159 	hat_unload(kas.a_hat, addr - pgoffset, ptob(npages), HAT_UNLOAD_UNLOCK);
1160 	device_arena_free(addr - pgoffset, ptob(npages));
1161 
1162 	/*
1163 	 * Destroy the pointer - the mapping has logically gone
1164 	 */
1165 	*vaddrp = NULL;
1166 
1167 	return (DDI_SUCCESS);
1168 }
1169 
1170 
1171 /*
1172  * rootnex_map_handle()
1173  *
1174  */
1175 static int
1176 rootnex_map_handle(ddi_map_req_t *mp)
1177 {
1178 	rootnex_addr_t rbase;
1179 	ddi_acc_hdl_t *hp;
1180 	uint_t pgoffset;
1181 	struct regspec *rp;
1182 	paddr_t pbase;
1183 
1184 	rp = mp->map_obj.rp;
1185 
1186 #ifdef	DDI_MAP_DEBUG
1187 	ddi_map_debug(
1188 	    "rootnex_map_handle: <0x%x 0x%x 0x%x> handle 0x%x\n",
1189 	    rp->regspec_bustype, rp->regspec_addr,
1190 	    rp->regspec_size, mp->map_handlep);
1191 #endif	/* DDI_MAP_DEBUG */
1192 
1193 	/*
1194 	 * I/O or memory mapping:
1195 	 *
1196 	 *	<bustype=0, addr=x, len=x>: memory
1197 	 *	<bustype=1, addr=x, len=x>: i/o
1198 	 *	<bustype>1, addr=0, len=x>: x86-compatibility i/o
1199 	 */
1200 	if (rp->regspec_bustype != 0) {
1201 		/*
1202 		 * This refers to I/O space, and we don't support "mapping"
1203 		 * I/O space to a user.
1204 		 */
1205 		return (DDI_FAILURE);
1206 	}
1207 
1208 	/*
1209 	 * Set up the hat_flags for the mapping.
1210 	 */
1211 	hp = mp->map_handlep;
1212 
1213 	switch (hp->ah_acc.devacc_attr_endian_flags) {
1214 	case DDI_NEVERSWAP_ACC:
1215 		hp->ah_hat_flags = HAT_NEVERSWAP | HAT_STRICTORDER;
1216 		break;
1217 	case DDI_STRUCTURE_LE_ACC:
1218 		hp->ah_hat_flags = HAT_STRUCTURE_LE;
1219 		break;
1220 	case DDI_STRUCTURE_BE_ACC:
1221 		return (DDI_FAILURE);
1222 	default:
1223 		return (DDI_REGS_ACC_CONFLICT);
1224 	}
1225 
1226 	switch (hp->ah_acc.devacc_attr_dataorder) {
1227 	case DDI_STRICTORDER_ACC:
1228 		break;
1229 	case DDI_UNORDERED_OK_ACC:
1230 		hp->ah_hat_flags |= HAT_UNORDERED_OK;
1231 		break;
1232 	case DDI_MERGING_OK_ACC:
1233 		hp->ah_hat_flags |= HAT_MERGING_OK;
1234 		break;
1235 	case DDI_LOADCACHING_OK_ACC:
1236 		hp->ah_hat_flags |= HAT_LOADCACHING_OK;
1237 		break;
1238 	case DDI_STORECACHING_OK_ACC:
1239 		hp->ah_hat_flags |= HAT_STORECACHING_OK;
1240 		break;
1241 	default:
1242 		return (DDI_FAILURE);
1243 	}
1244 
1245 	rbase = (rootnex_addr_t)rp->regspec_addr &
1246 	    (~(rootnex_addr_t)MMU_PAGEOFFSET);
1247 	pgoffset = (ulong_t)rp->regspec_addr & MMU_PAGEOFFSET;
1248 
1249 	if (rp->regspec_size == 0)
1250 		return (DDI_ME_INVAL);
1251 
1252 #ifdef __xpv
1253 	/*
1254 	 * If we're dom0, we're using a real device so we need to translate
1255 	 * the MA to a PA.
1256 	 */
1257 	if (DOMAIN_IS_INITDOMAIN(xen_info)) {
1258 		pbase = pfn_to_pa(xen_assign_pfn(mmu_btop(rbase))) |
1259 		    (rbase & MMU_PAGEOFFSET);
1260 	} else {
1261 		pbase = rbase;
1262 	}
1263 #else
1264 	pbase = rbase;
1265 #endif
1266 
1267 	hp->ah_pfn = mmu_btop(pbase);
1268 	hp->ah_pnum = mmu_btopr(rp->regspec_size + pgoffset);
1269 
1270 	return (DDI_SUCCESS);
1271 }
1272 
1273 
1274 
1275 /*
1276  * ************************
1277  *  interrupt related code
1278  * ************************
1279  */
1280 
1281 /*
1282  * rootnex_intr_ops()
1283  *	bus_intr_op() function for interrupt support
1284  */
1285 /* ARGSUSED */
1286 static int
1287 rootnex_intr_ops(dev_info_t *pdip, dev_info_t *rdip, ddi_intr_op_t intr_op,
1288     ddi_intr_handle_impl_t *hdlp, void *result)
1289 {
1290 	struct intrspec			*ispec;
1291 	struct ddi_parent_private_data	*pdp;
1292 
1293 	DDI_INTR_NEXDBG((CE_CONT,
1294 	    "rootnex_intr_ops: pdip = %p, rdip = %p, intr_op = %x, hdlp = %p\n",
1295 	    (void *)pdip, (void *)rdip, intr_op, (void *)hdlp));
1296 
1297 	/* Process the interrupt operation */
1298 	switch (intr_op) {
1299 	case DDI_INTROP_GETCAP:
1300 		/* First check with pcplusmp */
1301 		if (psm_intr_ops == NULL)
1302 			return (DDI_FAILURE);
1303 
1304 		if ((*psm_intr_ops)(rdip, hdlp, PSM_INTR_OP_GET_CAP, result)) {
1305 			*(int *)result = 0;
1306 			return (DDI_FAILURE);
1307 		}
1308 		break;
1309 	case DDI_INTROP_SETCAP:
1310 		if (psm_intr_ops == NULL)
1311 			return (DDI_FAILURE);
1312 
1313 		if ((*psm_intr_ops)(rdip, hdlp, PSM_INTR_OP_SET_CAP, result))
1314 			return (DDI_FAILURE);
1315 		break;
1316 	case DDI_INTROP_ALLOC:
1317 		if ((ispec = rootnex_get_ispec(rdip, hdlp->ih_inum)) == NULL)
1318 			return (DDI_FAILURE);
1319 		hdlp->ih_pri = ispec->intrspec_pri;
1320 		*(int *)result = hdlp->ih_scratch1;
1321 		break;
1322 	case DDI_INTROP_FREE:
1323 		pdp = ddi_get_parent_data(rdip);
1324 		/*
1325 		 * Special case for 'pcic' driver' only.
1326 		 * If an intrspec was created for it, clean it up here
1327 		 * See detailed comments on this in the function
1328 		 * rootnex_get_ispec().
1329 		 */
1330 		if (pdp->par_intr && strcmp(ddi_get_name(rdip), "pcic") == 0) {
1331 			kmem_free(pdp->par_intr, sizeof (struct intrspec) *
1332 			    pdp->par_nintr);
1333 			/*
1334 			 * Set it to zero; so that
1335 			 * DDI framework doesn't free it again
1336 			 */
1337 			pdp->par_intr = NULL;
1338 			pdp->par_nintr = 0;
1339 		}
1340 		break;
1341 	case DDI_INTROP_GETPRI:
1342 		if ((ispec = rootnex_get_ispec(rdip, hdlp->ih_inum)) == NULL)
1343 			return (DDI_FAILURE);
1344 		*(int *)result = ispec->intrspec_pri;
1345 		break;
1346 	case DDI_INTROP_SETPRI:
1347 		/* Validate the interrupt priority passed to us */
1348 		if (*(int *)result > LOCK_LEVEL)
1349 			return (DDI_FAILURE);
1350 
1351 		/* Ensure that PSM is all initialized and ispec is ok */
1352 		if ((psm_intr_ops == NULL) ||
1353 		    ((ispec = rootnex_get_ispec(rdip, hdlp->ih_inum)) == NULL))
1354 			return (DDI_FAILURE);
1355 
1356 		/* Change the priority */
1357 		if ((*psm_intr_ops)(rdip, hdlp, PSM_INTR_OP_SET_PRI, result) ==
1358 		    PSM_FAILURE)
1359 			return (DDI_FAILURE);
1360 
1361 		/* update the ispec with the new priority */
1362 		ispec->intrspec_pri =  *(int *)result;
1363 		break;
1364 	case DDI_INTROP_ADDISR:
1365 		if ((ispec = rootnex_get_ispec(rdip, hdlp->ih_inum)) == NULL)
1366 			return (DDI_FAILURE);
1367 		ispec->intrspec_func = hdlp->ih_cb_func;
1368 		break;
1369 	case DDI_INTROP_REMISR:
1370 		if ((ispec = rootnex_get_ispec(rdip, hdlp->ih_inum)) == NULL)
1371 			return (DDI_FAILURE);
1372 		ispec->intrspec_func = (uint_t (*)()) 0;
1373 		break;
1374 	case DDI_INTROP_ENABLE:
1375 		if ((ispec = rootnex_get_ispec(rdip, hdlp->ih_inum)) == NULL)
1376 			return (DDI_FAILURE);
1377 
1378 		/* Call psmi to translate irq with the dip */
1379 		if (psm_intr_ops == NULL)
1380 			return (DDI_FAILURE);
1381 
1382 		((ihdl_plat_t *)hdlp->ih_private)->ip_ispecp = ispec;
1383 		(void) (*psm_intr_ops)(rdip, hdlp, PSM_INTR_OP_XLATE_VECTOR,
1384 		    (int *)&hdlp->ih_vector);
1385 
1386 		/* Add the interrupt handler */
1387 		if (!add_avintr((void *)hdlp, ispec->intrspec_pri,
1388 		    hdlp->ih_cb_func, DEVI(rdip)->devi_name, hdlp->ih_vector,
1389 		    hdlp->ih_cb_arg1, hdlp->ih_cb_arg2, NULL, rdip))
1390 			return (DDI_FAILURE);
1391 		break;
1392 	case DDI_INTROP_DISABLE:
1393 		if ((ispec = rootnex_get_ispec(rdip, hdlp->ih_inum)) == NULL)
1394 			return (DDI_FAILURE);
1395 
1396 		/* Call psm_ops() to translate irq with the dip */
1397 		if (psm_intr_ops == NULL)
1398 			return (DDI_FAILURE);
1399 
1400 		((ihdl_plat_t *)hdlp->ih_private)->ip_ispecp = ispec;
1401 		(void) (*psm_intr_ops)(rdip, hdlp,
1402 		    PSM_INTR_OP_XLATE_VECTOR, (int *)&hdlp->ih_vector);
1403 
1404 		/* Remove the interrupt handler */
1405 		rem_avintr((void *)hdlp, ispec->intrspec_pri,
1406 		    hdlp->ih_cb_func, hdlp->ih_vector);
1407 		break;
1408 	case DDI_INTROP_SETMASK:
1409 		if (psm_intr_ops == NULL)
1410 			return (DDI_FAILURE);
1411 
1412 		if ((*psm_intr_ops)(rdip, hdlp, PSM_INTR_OP_SET_MASK, NULL))
1413 			return (DDI_FAILURE);
1414 		break;
1415 	case DDI_INTROP_CLRMASK:
1416 		if (psm_intr_ops == NULL)
1417 			return (DDI_FAILURE);
1418 
1419 		if ((*psm_intr_ops)(rdip, hdlp, PSM_INTR_OP_CLEAR_MASK, NULL))
1420 			return (DDI_FAILURE);
1421 		break;
1422 	case DDI_INTROP_GETPENDING:
1423 		if (psm_intr_ops == NULL)
1424 			return (DDI_FAILURE);
1425 
1426 		if ((*psm_intr_ops)(rdip, hdlp, PSM_INTR_OP_GET_PENDING,
1427 		    result)) {
1428 			*(int *)result = 0;
1429 			return (DDI_FAILURE);
1430 		}
1431 		break;
1432 	case DDI_INTROP_NAVAIL:
1433 	case DDI_INTROP_NINTRS:
1434 		*(int *)result = i_ddi_get_intx_nintrs(rdip);
1435 		if (*(int *)result == 0) {
1436 			/*
1437 			 * Special case for 'pcic' driver' only. This driver
1438 			 * driver is a child of 'isa' and 'rootnex' drivers.
1439 			 *
1440 			 * See detailed comments on this in the function
1441 			 * rootnex_get_ispec().
1442 			 *
1443 			 * Children of 'pcic' send 'NINITR' request all the
1444 			 * way to rootnex driver. But, the 'pdp->par_nintr'
1445 			 * field may not initialized. So, we fake it here
1446 			 * to return 1 (a la what PCMCIA nexus does).
1447 			 */
1448 			if (strcmp(ddi_get_name(rdip), "pcic") == 0)
1449 				*(int *)result = 1;
1450 			else
1451 				return (DDI_FAILURE);
1452 		}
1453 		break;
1454 	case DDI_INTROP_SUPPORTED_TYPES:
1455 		*(int *)result = DDI_INTR_TYPE_FIXED;	/* Always ... */
1456 		break;
1457 	default:
1458 		return (DDI_FAILURE);
1459 	}
1460 
1461 	return (DDI_SUCCESS);
1462 }
1463 
1464 
1465 /*
1466  * rootnex_get_ispec()
1467  *	convert an interrupt number to an interrupt specification.
1468  *	The interrupt number determines which interrupt spec will be
1469  *	returned if more than one exists.
1470  *
1471  *	Look into the parent private data area of the 'rdip' to find out
1472  *	the interrupt specification.  First check to make sure there is
1473  *	one that matchs "inumber" and then return a pointer to it.
1474  *
1475  *	Return NULL if one could not be found.
1476  *
1477  *	NOTE: This is needed for rootnex_intr_ops()
1478  */
1479 static struct intrspec *
1480 rootnex_get_ispec(dev_info_t *rdip, int inum)
1481 {
1482 	struct ddi_parent_private_data *pdp = ddi_get_parent_data(rdip);
1483 
1484 	/*
1485 	 * Special case handling for drivers that provide their own
1486 	 * intrspec structures instead of relying on the DDI framework.
1487 	 *
1488 	 * A broken hardware driver in ON could potentially provide its
1489 	 * own intrspec structure, instead of relying on the hardware.
1490 	 * If these drivers are children of 'rootnex' then we need to
1491 	 * continue to provide backward compatibility to them here.
1492 	 *
1493 	 * Following check is a special case for 'pcic' driver which
1494 	 * was found to have broken hardwre andby provides its own intrspec.
1495 	 *
1496 	 * Verbatim comments from this driver are shown here:
1497 	 * "Don't use the ddi_add_intr since we don't have a
1498 	 * default intrspec in all cases."
1499 	 *
1500 	 * Since an 'ispec' may not be always created for it,
1501 	 * check for that and create one if so.
1502 	 *
1503 	 * NOTE: Currently 'pcic' is the only driver found to do this.
1504 	 */
1505 	if (!pdp->par_intr && strcmp(ddi_get_name(rdip), "pcic") == 0) {
1506 		pdp->par_nintr = 1;
1507 		pdp->par_intr = kmem_zalloc(sizeof (struct intrspec) *
1508 		    pdp->par_nintr, KM_SLEEP);
1509 	}
1510 
1511 	/* Validate the interrupt number */
1512 	if (inum >= pdp->par_nintr)
1513 		return (NULL);
1514 
1515 	/* Get the interrupt structure pointer and return that */
1516 	return ((struct intrspec *)&pdp->par_intr[inum]);
1517 }
1518 
1519 
1520 /*
1521  * ******************
1522  *  dma related code
1523  * ******************
1524  */
1525 
1526 /*
1527  * rootnex_dma_allochdl()
1528  *    called from ddi_dma_alloc_handle().
1529  */
1530 /*ARGSUSED*/
1531 static int
1532 rootnex_dma_allochdl(dev_info_t *dip, dev_info_t *rdip, ddi_dma_attr_t *attr,
1533     int (*waitfp)(caddr_t), caddr_t arg, ddi_dma_handle_t *handlep)
1534 {
1535 	uint64_t maxsegmentsize_ll;
1536 	uint_t maxsegmentsize;
1537 	ddi_dma_impl_t *hp;
1538 	rootnex_dma_t *dma;
1539 	uint64_t count_max;
1540 	uint64_t seg;
1541 	int kmflag;
1542 	int e;
1543 
1544 
1545 	/* convert our sleep flags */
1546 	if (waitfp == DDI_DMA_SLEEP) {
1547 		kmflag = KM_SLEEP;
1548 	} else {
1549 		kmflag = KM_NOSLEEP;
1550 	}
1551 
1552 	/*
1553 	 * We try to do only one memory allocation here. We'll do a little
1554 	 * pointer manipulation later. If the bind ends up taking more than
1555 	 * our prealloc's space, we'll have to allocate more memory in the
1556 	 * bind operation. Not great, but much better than before and the
1557 	 * best we can do with the current bind interfaces.
1558 	 */
1559 	hp = kmem_cache_alloc(rootnex_state->r_dmahdl_cache, kmflag);
1560 	if (hp == NULL) {
1561 		if (waitfp != DDI_DMA_DONTWAIT) {
1562 			ddi_set_callback(waitfp, arg,
1563 			    &rootnex_state->r_dvma_call_list_id);
1564 		}
1565 		return (DDI_DMA_NORESOURCES);
1566 	}
1567 
1568 	/* Do our pointer manipulation now, align the structures */
1569 	hp->dmai_private = (void *)(((uintptr_t)hp +
1570 	    (uintptr_t)sizeof (ddi_dma_impl_t) + 0x7) & ~0x7);
1571 	dma = (rootnex_dma_t *)hp->dmai_private;
1572 	dma->dp_prealloc_buffer = (uchar_t *)(((uintptr_t)dma +
1573 	    sizeof (rootnex_dma_t) + 0x7) & ~0x7);
1574 
1575 	/* setup the handle */
1576 	rootnex_clean_dmahdl(hp);
1577 	dma->dp_dip = rdip;
1578 	dma->dp_sglinfo.si_min_addr = attr->dma_attr_addr_lo;
1579 	dma->dp_sglinfo.si_max_addr = attr->dma_attr_addr_hi;
1580 	hp->dmai_minxfer = attr->dma_attr_minxfer;
1581 	hp->dmai_burstsizes = attr->dma_attr_burstsizes;
1582 	hp->dmai_rdip = rdip;
1583 	hp->dmai_attr = *attr;
1584 
1585 	/* we don't need to worry about the SPL since we do a tryenter */
1586 	mutex_init(&dma->dp_mutex, NULL, MUTEX_DRIVER, NULL);
1587 
1588 	/*
1589 	 * Figure out our maximum segment size. If the segment size is greater
1590 	 * than 4G, we will limit it to (4G - 1) since the max size of a dma
1591 	 * object (ddi_dma_obj_t.dmao_size) is 32 bits. dma_attr_seg and
1592 	 * dma_attr_count_max are size-1 type values.
1593 	 *
1594 	 * Maximum segment size is the largest physically contiguous chunk of
1595 	 * memory that we can return from a bind (i.e. the maximum size of a
1596 	 * single cookie).
1597 	 */
1598 
1599 	/* handle the rollover cases */
1600 	seg = attr->dma_attr_seg + 1;
1601 	if (seg < attr->dma_attr_seg) {
1602 		seg = attr->dma_attr_seg;
1603 	}
1604 	count_max = attr->dma_attr_count_max + 1;
1605 	if (count_max < attr->dma_attr_count_max) {
1606 		count_max = attr->dma_attr_count_max;
1607 	}
1608 
1609 	/*
1610 	 * granularity may or may not be a power of two. If it isn't, we can't
1611 	 * use a simple mask.
1612 	 */
1613 	if (attr->dma_attr_granular & (attr->dma_attr_granular - 1)) {
1614 		dma->dp_granularity_power_2 = B_FALSE;
1615 	} else {
1616 		dma->dp_granularity_power_2 = B_TRUE;
1617 	}
1618 
1619 	/*
1620 	 * maxxfer should be a whole multiple of granularity. If we're going to
1621 	 * break up a window because we're greater than maxxfer, we might as
1622 	 * well make sure it's maxxfer is a whole multiple so we don't have to
1623 	 * worry about triming the window later on for this case.
1624 	 */
1625 	if (attr->dma_attr_granular > 1) {
1626 		if (dma->dp_granularity_power_2) {
1627 			dma->dp_maxxfer = attr->dma_attr_maxxfer -
1628 			    (attr->dma_attr_maxxfer &
1629 			    (attr->dma_attr_granular - 1));
1630 		} else {
1631 			dma->dp_maxxfer = attr->dma_attr_maxxfer -
1632 			    (attr->dma_attr_maxxfer % attr->dma_attr_granular);
1633 		}
1634 	} else {
1635 		dma->dp_maxxfer = attr->dma_attr_maxxfer;
1636 	}
1637 
1638 	maxsegmentsize_ll = MIN(seg, dma->dp_maxxfer);
1639 	maxsegmentsize_ll = MIN(maxsegmentsize_ll, count_max);
1640 	if (maxsegmentsize_ll == 0 || (maxsegmentsize_ll > 0xFFFFFFFF)) {
1641 		maxsegmentsize = 0xFFFFFFFF;
1642 	} else {
1643 		maxsegmentsize = maxsegmentsize_ll;
1644 	}
1645 	dma->dp_sglinfo.si_max_cookie_size = maxsegmentsize;
1646 	dma->dp_sglinfo.si_segmask = attr->dma_attr_seg;
1647 
1648 	/* check the ddi_dma_attr arg to make sure it makes a little sense */
1649 	if (rootnex_alloc_check_parms) {
1650 		e = rootnex_valid_alloc_parms(attr, maxsegmentsize);
1651 		if (e != DDI_SUCCESS) {
1652 			ROOTNEX_PROF_INC(&rootnex_cnt[ROOTNEX_CNT_ALLOC_FAIL]);
1653 			(void) rootnex_dma_freehdl(dip, rdip,
1654 			    (ddi_dma_handle_t)hp);
1655 			return (e);
1656 		}
1657 	}
1658 
1659 	*handlep = (ddi_dma_handle_t)hp;
1660 
1661 	ROOTNEX_PROF_INC(&rootnex_cnt[ROOTNEX_CNT_ACTIVE_HDLS]);
1662 	DTRACE_PROBE1(rootnex__alloc__handle, uint64_t,
1663 	    rootnex_cnt[ROOTNEX_CNT_ACTIVE_HDLS]);
1664 
1665 	return (DDI_SUCCESS);
1666 }
1667 
1668 
1669 /*
1670  * rootnex_dma_freehdl()
1671  *    called from ddi_dma_free_handle().
1672  */
1673 /*ARGSUSED*/
1674 static int
1675 rootnex_dma_freehdl(dev_info_t *dip, dev_info_t *rdip, ddi_dma_handle_t handle)
1676 {
1677 	ddi_dma_impl_t *hp;
1678 	rootnex_dma_t *dma;
1679 
1680 
1681 	hp = (ddi_dma_impl_t *)handle;
1682 	dma = (rootnex_dma_t *)hp->dmai_private;
1683 
1684 	/* unbind should have been called first */
1685 	ASSERT(!dma->dp_inuse);
1686 
1687 	mutex_destroy(&dma->dp_mutex);
1688 	kmem_cache_free(rootnex_state->r_dmahdl_cache, hp);
1689 
1690 	ROOTNEX_PROF_DEC(&rootnex_cnt[ROOTNEX_CNT_ACTIVE_HDLS]);
1691 	DTRACE_PROBE1(rootnex__free__handle, uint64_t,
1692 	    rootnex_cnt[ROOTNEX_CNT_ACTIVE_HDLS]);
1693 
1694 	if (rootnex_state->r_dvma_call_list_id)
1695 		ddi_run_callback(&rootnex_state->r_dvma_call_list_id);
1696 
1697 	return (DDI_SUCCESS);
1698 }
1699 
1700 
1701 /*
1702  * rootnex_dma_bindhdl()
1703  *    called from ddi_dma_addr_bind_handle() and ddi_dma_buf_bind_handle().
1704  */
1705 /*ARGSUSED*/
1706 static int
1707 rootnex_dma_bindhdl(dev_info_t *dip, dev_info_t *rdip, ddi_dma_handle_t handle,
1708     struct ddi_dma_req *dmareq, ddi_dma_cookie_t *cookiep, uint_t *ccountp)
1709 {
1710 	rootnex_sglinfo_t *sinfo;
1711 	ddi_dma_attr_t *attr;
1712 	ddi_dma_impl_t *hp;
1713 	rootnex_dma_t *dma;
1714 	int kmflag;
1715 	int e;
1716 
1717 
1718 	hp = (ddi_dma_impl_t *)handle;
1719 	dma = (rootnex_dma_t *)hp->dmai_private;
1720 	sinfo = &dma->dp_sglinfo;
1721 	attr = &hp->dmai_attr;
1722 
1723 	hp->dmai_rflags = dmareq->dmar_flags & DMP_DDIFLAGS;
1724 
1725 	/*
1726 	 * This is useful for debugging a driver. Not as useful in a production
1727 	 * system. The only time this will fail is if you have a driver bug.
1728 	 */
1729 	if (rootnex_bind_check_inuse) {
1730 		/*
1731 		 * No one else should ever have this lock unless someone else
1732 		 * is trying to use this handle. So contention on the lock
1733 		 * is the same as inuse being set.
1734 		 */
1735 		e = mutex_tryenter(&dma->dp_mutex);
1736 		if (e == 0) {
1737 			ROOTNEX_PROF_INC(&rootnex_cnt[ROOTNEX_CNT_BIND_FAIL]);
1738 			return (DDI_DMA_INUSE);
1739 		}
1740 		if (dma->dp_inuse) {
1741 			mutex_exit(&dma->dp_mutex);
1742 			ROOTNEX_PROF_INC(&rootnex_cnt[ROOTNEX_CNT_BIND_FAIL]);
1743 			return (DDI_DMA_INUSE);
1744 		}
1745 		dma->dp_inuse = B_TRUE;
1746 		mutex_exit(&dma->dp_mutex);
1747 	}
1748 
1749 	/* check the ddi_dma_attr arg to make sure it makes a little sense */
1750 	if (rootnex_bind_check_parms) {
1751 		e = rootnex_valid_bind_parms(dmareq, attr);
1752 		if (e != DDI_SUCCESS) {
1753 			ROOTNEX_PROF_INC(&rootnex_cnt[ROOTNEX_CNT_BIND_FAIL]);
1754 			rootnex_clean_dmahdl(hp);
1755 			return (e);
1756 		}
1757 	}
1758 
1759 	/* save away the original bind info */
1760 	dma->dp_dma = dmareq->dmar_object;
1761 
1762 	/*
1763 	 * Figure out a rough estimate of what maximum number of pages this
1764 	 * buffer could use (a high estimate of course).
1765 	 */
1766 	sinfo->si_max_pages = mmu_btopr(dma->dp_dma.dmao_size) + 1;
1767 
1768 	/*
1769 	 * We'll use the pre-allocated cookies for any bind that will *always*
1770 	 * fit (more important to be consistent, we don't want to create
1771 	 * additional degenerate cases).
1772 	 */
1773 	if (sinfo->si_max_pages <= rootnex_state->r_prealloc_cookies) {
1774 		dma->dp_cookies = (ddi_dma_cookie_t *)dma->dp_prealloc_buffer;
1775 		dma->dp_need_to_free_cookie = B_FALSE;
1776 		DTRACE_PROBE2(rootnex__bind__prealloc, dev_info_t *, rdip,
1777 		    uint_t, sinfo->si_max_pages);
1778 
1779 	/*
1780 	 * For anything larger than that, we'll go ahead and allocate the
1781 	 * maximum number of pages we expect to see. Hopefuly, we won't be
1782 	 * seeing this path in the fast path for high performance devices very
1783 	 * frequently.
1784 	 *
1785 	 * a ddi bind interface that allowed the driver to provide storage to
1786 	 * the bind interface would speed this case up.
1787 	 */
1788 	} else {
1789 		/* convert the sleep flags */
1790 		if (dmareq->dmar_fp == DDI_DMA_SLEEP) {
1791 			kmflag =  KM_SLEEP;
1792 		} else {
1793 			kmflag =  KM_NOSLEEP;
1794 		}
1795 
1796 		/*
1797 		 * Save away how much memory we allocated. If we're doing a
1798 		 * nosleep, the alloc could fail...
1799 		 */
1800 		dma->dp_cookie_size = sinfo->si_max_pages *
1801 		    sizeof (ddi_dma_cookie_t);
1802 		dma->dp_cookies = kmem_alloc(dma->dp_cookie_size, kmflag);
1803 		if (dma->dp_cookies == NULL) {
1804 			ROOTNEX_PROF_INC(&rootnex_cnt[ROOTNEX_CNT_BIND_FAIL]);
1805 			rootnex_clean_dmahdl(hp);
1806 			return (DDI_DMA_NORESOURCES);
1807 		}
1808 		dma->dp_need_to_free_cookie = B_TRUE;
1809 		DTRACE_PROBE2(rootnex__bind__alloc, dev_info_t *, rdip, uint_t,
1810 		    sinfo->si_max_pages);
1811 	}
1812 	hp->dmai_cookie = dma->dp_cookies;
1813 
1814 	/*
1815 	 * Get the real sgl. rootnex_get_sgl will fill in cookie array while
1816 	 * looking at the contraints in the dma structure. It will then put some
1817 	 * additional state about the sgl in the dma struct (i.e. is the sgl
1818 	 * clean, or do we need to do some munging; how many pages need to be
1819 	 * copied, etc.)
1820 	 */
1821 	rootnex_get_sgl(&dmareq->dmar_object, dma->dp_cookies,
1822 	    &dma->dp_sglinfo);
1823 	ASSERT(sinfo->si_sgl_size <= sinfo->si_max_pages);
1824 
1825 	/* if we don't need a copy buffer, we don't need to sync */
1826 	if (sinfo->si_copybuf_req == 0) {
1827 		hp->dmai_rflags |= DMP_NOSYNC;
1828 	}
1829 
1830 	/*
1831 	 * if we don't need the copybuf and we don't need to do a partial,  we
1832 	 * hit the fast path. All the high performance devices should be trying
1833 	 * to hit this path. To hit this path, a device should be able to reach
1834 	 * all of memory, shouldn't try to bind more than it can transfer, and
1835 	 * the buffer shouldn't require more cookies than the driver/device can
1836 	 * handle [sgllen]).
1837 	 */
1838 	if ((sinfo->si_copybuf_req == 0) &&
1839 	    (sinfo->si_sgl_size <= attr->dma_attr_sgllen) &&
1840 	    (dma->dp_dma.dmao_size < dma->dp_maxxfer)) {
1841 		/*
1842 		 * If the driver supports FMA, insert the handle in the FMA DMA
1843 		 * handle cache.
1844 		 */
1845 		if (attr->dma_attr_flags & DDI_DMA_FLAGERR) {
1846 			hp->dmai_error.err_cf = rootnex_dma_check;
1847 			(void) ndi_fmc_insert(rdip, DMA_HANDLE, hp, NULL);
1848 		}
1849 
1850 		/*
1851 		 * copy out the first cookie and ccountp, set the cookie
1852 		 * pointer to the second cookie. The first cookie is passed
1853 		 * back on the stack. Additional cookies are accessed via
1854 		 * ddi_dma_nextcookie()
1855 		 */
1856 		*cookiep = dma->dp_cookies[0];
1857 		*ccountp = sinfo->si_sgl_size;
1858 		hp->dmai_cookie++;
1859 		hp->dmai_rflags &= ~DDI_DMA_PARTIAL;
1860 		hp->dmai_nwin = 1;
1861 		ROOTNEX_PROF_INC(&rootnex_cnt[ROOTNEX_CNT_ACTIVE_BINDS]);
1862 		DTRACE_PROBE3(rootnex__bind__fast, dev_info_t *, rdip, uint64_t,
1863 		    rootnex_cnt[ROOTNEX_CNT_ACTIVE_BINDS], uint_t,
1864 		    dma->dp_dma.dmao_size);
1865 		return (DDI_DMA_MAPPED);
1866 	}
1867 
1868 	/*
1869 	 * go to the slow path, we may need to alloc more memory, create
1870 	 * multiple windows, and munge up a sgl to make the device happy.
1871 	 */
1872 	e = rootnex_bind_slowpath(hp, dmareq, dma, attr, kmflag);
1873 	if ((e != DDI_DMA_MAPPED) && (e != DDI_DMA_PARTIAL_MAP)) {
1874 		if (dma->dp_need_to_free_cookie) {
1875 			kmem_free(dma->dp_cookies, dma->dp_cookie_size);
1876 		}
1877 		ROOTNEX_PROF_INC(&rootnex_cnt[ROOTNEX_CNT_BIND_FAIL]);
1878 		rootnex_clean_dmahdl(hp); /* must be after free cookie */
1879 		return (e);
1880 	}
1881 
1882 	/*
1883 	 * If the driver supports FMA, insert the handle in the FMA DMA handle
1884 	 * cache.
1885 	 */
1886 	if (attr->dma_attr_flags & DDI_DMA_FLAGERR) {
1887 		hp->dmai_error.err_cf = rootnex_dma_check;
1888 		(void) ndi_fmc_insert(rdip, DMA_HANDLE, hp, NULL);
1889 	}
1890 
1891 	/* if the first window uses the copy buffer, sync it for the device */
1892 	if ((dma->dp_window[dma->dp_current_win].wd_dosync) &&
1893 	    (hp->dmai_rflags & DDI_DMA_WRITE)) {
1894 		(void) rootnex_dma_sync(dip, rdip, handle, 0, 0,
1895 		    DDI_DMA_SYNC_FORDEV);
1896 	}
1897 
1898 	/*
1899 	 * copy out the first cookie and ccountp, set the cookie pointer to the
1900 	 * second cookie. Make sure the partial flag is set/cleared correctly.
1901 	 * If we have a partial map (i.e. multiple windows), the number of
1902 	 * cookies we return is the number of cookies in the first window.
1903 	 */
1904 	if (e == DDI_DMA_MAPPED) {
1905 		hp->dmai_rflags &= ~DDI_DMA_PARTIAL;
1906 		*ccountp = sinfo->si_sgl_size;
1907 	} else {
1908 		hp->dmai_rflags |= DDI_DMA_PARTIAL;
1909 		*ccountp = dma->dp_window[dma->dp_current_win].wd_cookie_cnt;
1910 		ASSERT(hp->dmai_nwin <= dma->dp_max_win);
1911 	}
1912 	*cookiep = dma->dp_cookies[0];
1913 	hp->dmai_cookie++;
1914 
1915 	ROOTNEX_PROF_INC(&rootnex_cnt[ROOTNEX_CNT_ACTIVE_BINDS]);
1916 	DTRACE_PROBE3(rootnex__bind__slow, dev_info_t *, rdip, uint64_t,
1917 	    rootnex_cnt[ROOTNEX_CNT_ACTIVE_BINDS], uint_t,
1918 	    dma->dp_dma.dmao_size);
1919 	return (e);
1920 }
1921 
1922 
1923 /*
1924  * rootnex_dma_unbindhdl()
1925  *    called from ddi_dma_unbind_handle()
1926  */
1927 /*ARGSUSED*/
1928 static int
1929 rootnex_dma_unbindhdl(dev_info_t *dip, dev_info_t *rdip,
1930     ddi_dma_handle_t handle)
1931 {
1932 	ddi_dma_impl_t *hp;
1933 	rootnex_dma_t *dma;
1934 	int e;
1935 
1936 
1937 	hp = (ddi_dma_impl_t *)handle;
1938 	dma = (rootnex_dma_t *)hp->dmai_private;
1939 
1940 	/* make sure the buffer wasn't free'd before calling unbind */
1941 	if (rootnex_unbind_verify_buffer) {
1942 		e = rootnex_verify_buffer(dma);
1943 		if (e != DDI_SUCCESS) {
1944 			ASSERT(0);
1945 			return (DDI_FAILURE);
1946 		}
1947 	}
1948 
1949 	/* sync the current window before unbinding the buffer */
1950 	if (dma->dp_window && dma->dp_window[dma->dp_current_win].wd_dosync &&
1951 	    (hp->dmai_rflags & DDI_DMA_READ)) {
1952 		(void) rootnex_dma_sync(dip, rdip, handle, 0, 0,
1953 		    DDI_DMA_SYNC_FORCPU);
1954 	}
1955 
1956 	/*
1957 	 * If the driver supports FMA, remove the handle in the FMA DMA handle
1958 	 * cache.
1959 	 */
1960 	if (hp->dmai_attr.dma_attr_flags & DDI_DMA_FLAGERR) {
1961 		if ((DEVI(rdip)->devi_fmhdl != NULL) &&
1962 		    (DDI_FM_DMA_ERR_CAP(DEVI(rdip)->devi_fmhdl->fh_cap))) {
1963 			(void) ndi_fmc_remove(rdip, DMA_HANDLE, hp);
1964 		}
1965 	}
1966 
1967 	/*
1968 	 * cleanup and copy buffer or window state. if we didn't use the copy
1969 	 * buffer or windows, there won't be much to do :-)
1970 	 */
1971 	rootnex_teardown_copybuf(dma);
1972 	rootnex_teardown_windows(dma);
1973 
1974 	/*
1975 	 * If we had to allocate space to for the worse case sgl (it didn't
1976 	 * fit into our pre-allocate buffer), free that up now
1977 	 */
1978 	if (dma->dp_need_to_free_cookie) {
1979 		kmem_free(dma->dp_cookies, dma->dp_cookie_size);
1980 	}
1981 
1982 	/*
1983 	 * clean up the handle so it's ready for the next bind (i.e. if the
1984 	 * handle is reused).
1985 	 */
1986 	rootnex_clean_dmahdl(hp);
1987 
1988 	if (rootnex_state->r_dvma_call_list_id)
1989 		ddi_run_callback(&rootnex_state->r_dvma_call_list_id);
1990 
1991 	ROOTNEX_PROF_DEC(&rootnex_cnt[ROOTNEX_CNT_ACTIVE_BINDS]);
1992 	DTRACE_PROBE1(rootnex__unbind, uint64_t,
1993 	    rootnex_cnt[ROOTNEX_CNT_ACTIVE_BINDS]);
1994 
1995 	return (DDI_SUCCESS);
1996 }
1997 
1998 
1999 /*
2000  * rootnex_verify_buffer()
2001  *   verify buffer wasn't free'd
2002  */
2003 static int
2004 rootnex_verify_buffer(rootnex_dma_t *dma)
2005 {
2006 	page_t **pplist;
2007 	caddr_t vaddr;
2008 	uint_t pcnt;
2009 	uint_t poff;
2010 	page_t *pp;
2011 	char b;
2012 	int i;
2013 
2014 	/* Figure out how many pages this buffer occupies */
2015 	if (dma->dp_dma.dmao_type == DMA_OTYP_PAGES) {
2016 		poff = dma->dp_dma.dmao_obj.pp_obj.pp_offset & MMU_PAGEOFFSET;
2017 	} else {
2018 		vaddr = dma->dp_dma.dmao_obj.virt_obj.v_addr;
2019 		poff = (uintptr_t)vaddr & MMU_PAGEOFFSET;
2020 	}
2021 	pcnt = mmu_btopr(dma->dp_dma.dmao_size + poff);
2022 
2023 	switch (dma->dp_dma.dmao_type) {
2024 	case DMA_OTYP_PAGES:
2025 		/*
2026 		 * for a linked list of pp's walk through them to make sure
2027 		 * they're locked and not free.
2028 		 */
2029 		pp = dma->dp_dma.dmao_obj.pp_obj.pp_pp;
2030 		for (i = 0; i < pcnt; i++) {
2031 			if (PP_ISFREE(pp) || !PAGE_LOCKED(pp)) {
2032 				return (DDI_FAILURE);
2033 			}
2034 			pp = pp->p_next;
2035 		}
2036 		break;
2037 
2038 	case DMA_OTYP_VADDR:
2039 	case DMA_OTYP_BUFVADDR:
2040 		pplist = dma->dp_dma.dmao_obj.virt_obj.v_priv;
2041 		/*
2042 		 * for an array of pp's walk through them to make sure they're
2043 		 * not free. It's possible that they may not be locked.
2044 		 */
2045 		if (pplist) {
2046 			for (i = 0; i < pcnt; i++) {
2047 				if (PP_ISFREE(pplist[i])) {
2048 					return (DDI_FAILURE);
2049 				}
2050 			}
2051 
2052 		/* For a virtual address, try to peek at each page */
2053 		} else {
2054 			if (dma->dp_sglinfo.si_asp == &kas) {
2055 				for (i = 0; i < pcnt; i++) {
2056 					if (ddi_peek8(NULL, vaddr, &b) ==
2057 					    DDI_FAILURE)
2058 						return (DDI_FAILURE);
2059 					vaddr += MMU_PAGESIZE;
2060 				}
2061 			}
2062 		}
2063 		break;
2064 
2065 	default:
2066 		ASSERT(0);
2067 		break;
2068 	}
2069 
2070 	return (DDI_SUCCESS);
2071 }
2072 
2073 
2074 /*
2075  * rootnex_clean_dmahdl()
2076  *    Clean the dma handle. This should be called on a handle alloc and an
2077  *    unbind handle. Set the handle state to the default settings.
2078  */
2079 static void
2080 rootnex_clean_dmahdl(ddi_dma_impl_t *hp)
2081 {
2082 	rootnex_dma_t *dma;
2083 
2084 
2085 	dma = (rootnex_dma_t *)hp->dmai_private;
2086 
2087 	hp->dmai_nwin = 0;
2088 	dma->dp_current_cookie = 0;
2089 	dma->dp_copybuf_size = 0;
2090 	dma->dp_window = NULL;
2091 	dma->dp_cbaddr = NULL;
2092 	dma->dp_inuse = B_FALSE;
2093 	dma->dp_need_to_free_cookie = B_FALSE;
2094 	dma->dp_need_to_free_window = B_FALSE;
2095 	dma->dp_partial_required = B_FALSE;
2096 	dma->dp_trim_required = B_FALSE;
2097 	dma->dp_sglinfo.si_copybuf_req = 0;
2098 #if !defined(__amd64)
2099 	dma->dp_cb_remaping = B_FALSE;
2100 	dma->dp_kva = NULL;
2101 #endif
2102 
2103 	/* FMA related initialization */
2104 	hp->dmai_fault = 0;
2105 	hp->dmai_fault_check = NULL;
2106 	hp->dmai_fault_notify = NULL;
2107 	hp->dmai_error.err_ena = 0;
2108 	hp->dmai_error.err_status = DDI_FM_OK;
2109 	hp->dmai_error.err_expected = DDI_FM_ERR_UNEXPECTED;
2110 	hp->dmai_error.err_ontrap = NULL;
2111 	hp->dmai_error.err_fep = NULL;
2112 	hp->dmai_error.err_cf = NULL;
2113 }
2114 
2115 
2116 /*
2117  * rootnex_valid_alloc_parms()
2118  *    Called in ddi_dma_alloc_handle path to validate its parameters.
2119  */
2120 static int
2121 rootnex_valid_alloc_parms(ddi_dma_attr_t *attr, uint_t maxsegmentsize)
2122 {
2123 	if ((attr->dma_attr_seg < MMU_PAGEOFFSET) ||
2124 	    (attr->dma_attr_count_max < MMU_PAGEOFFSET) ||
2125 	    (attr->dma_attr_granular > MMU_PAGESIZE) ||
2126 	    (attr->dma_attr_maxxfer < MMU_PAGESIZE)) {
2127 		return (DDI_DMA_BADATTR);
2128 	}
2129 
2130 	if (attr->dma_attr_addr_hi <= attr->dma_attr_addr_lo) {
2131 		return (DDI_DMA_BADATTR);
2132 	}
2133 
2134 	if ((attr->dma_attr_seg & MMU_PAGEOFFSET) != MMU_PAGEOFFSET ||
2135 	    MMU_PAGESIZE & (attr->dma_attr_granular - 1) ||
2136 	    attr->dma_attr_sgllen <= 0) {
2137 		return (DDI_DMA_BADATTR);
2138 	}
2139 
2140 	/* We should be able to DMA into every byte offset in a page */
2141 	if (maxsegmentsize < MMU_PAGESIZE) {
2142 		return (DDI_DMA_BADATTR);
2143 	}
2144 
2145 	return (DDI_SUCCESS);
2146 }
2147 
2148 
2149 /*
2150  * rootnex_valid_bind_parms()
2151  *    Called in ddi_dma_*_bind_handle path to validate its parameters.
2152  */
2153 /* ARGSUSED */
2154 static int
2155 rootnex_valid_bind_parms(ddi_dma_req_t *dmareq, ddi_dma_attr_t *attr)
2156 {
2157 #if !defined(__amd64)
2158 	/*
2159 	 * we only support up to a 2G-1 transfer size on 32-bit kernels so
2160 	 * we can track the offset for the obsoleted interfaces.
2161 	 */
2162 	if (dmareq->dmar_object.dmao_size > 0x7FFFFFFF) {
2163 		return (DDI_DMA_TOOBIG);
2164 	}
2165 #endif
2166 
2167 	return (DDI_SUCCESS);
2168 }
2169 
2170 
2171 /*
2172  * rootnex_get_sgl()
2173  *    Called in bind fastpath to get the sgl. Most of this will be replaced
2174  *    with a call to the vm layer when vm2.0 comes around...
2175  */
2176 static void
2177 rootnex_get_sgl(ddi_dma_obj_t *dmar_object, ddi_dma_cookie_t *sgl,
2178     rootnex_sglinfo_t *sglinfo)
2179 {
2180 	ddi_dma_atyp_t buftype;
2181 	rootnex_addr_t raddr;
2182 	uint64_t last_page;
2183 	uint64_t offset;
2184 	uint64_t addrhi;
2185 	uint64_t addrlo;
2186 	uint64_t maxseg;
2187 	page_t **pplist;
2188 	uint64_t paddr;
2189 	uint32_t psize;
2190 	uint32_t size;
2191 	caddr_t vaddr;
2192 	uint_t pcnt;
2193 	page_t *pp;
2194 	uint_t cnt;
2195 
2196 
2197 	/* shortcuts */
2198 	pplist = dmar_object->dmao_obj.virt_obj.v_priv;
2199 	vaddr = dmar_object->dmao_obj.virt_obj.v_addr;
2200 	maxseg = sglinfo->si_max_cookie_size;
2201 	buftype = dmar_object->dmao_type;
2202 	addrhi = sglinfo->si_max_addr;
2203 	addrlo = sglinfo->si_min_addr;
2204 	size = dmar_object->dmao_size;
2205 
2206 	pcnt = 0;
2207 	cnt = 0;
2208 
2209 	/*
2210 	 * if we were passed down a linked list of pages, i.e. pointer to
2211 	 * page_t, use this to get our physical address and buf offset.
2212 	 */
2213 	if (buftype == DMA_OTYP_PAGES) {
2214 		pp = dmar_object->dmao_obj.pp_obj.pp_pp;
2215 		ASSERT(!PP_ISFREE(pp) && PAGE_LOCKED(pp));
2216 		offset =  dmar_object->dmao_obj.pp_obj.pp_offset &
2217 		    MMU_PAGEOFFSET;
2218 		paddr = pfn_to_pa(pp->p_pagenum) + offset;
2219 		psize = MIN(size, (MMU_PAGESIZE - offset));
2220 		pp = pp->p_next;
2221 		sglinfo->si_asp = NULL;
2222 
2223 	/*
2224 	 * We weren't passed down a linked list of pages, but if we were passed
2225 	 * down an array of pages, use this to get our physical address and buf
2226 	 * offset.
2227 	 */
2228 	} else if (pplist != NULL) {
2229 		ASSERT((buftype == DMA_OTYP_VADDR) ||
2230 		    (buftype == DMA_OTYP_BUFVADDR));
2231 
2232 		offset = (uintptr_t)vaddr & MMU_PAGEOFFSET;
2233 		sglinfo->si_asp = dmar_object->dmao_obj.virt_obj.v_as;
2234 		if (sglinfo->si_asp == NULL) {
2235 			sglinfo->si_asp = &kas;
2236 		}
2237 
2238 		ASSERT(!PP_ISFREE(pplist[pcnt]));
2239 		paddr = pfn_to_pa(pplist[pcnt]->p_pagenum);
2240 		paddr += offset;
2241 		psize = MIN(size, (MMU_PAGESIZE - offset));
2242 		pcnt++;
2243 
2244 	/*
2245 	 * All we have is a virtual address, we'll need to call into the VM
2246 	 * to get the physical address.
2247 	 */
2248 	} else {
2249 		ASSERT((buftype == DMA_OTYP_VADDR) ||
2250 		    (buftype == DMA_OTYP_BUFVADDR));
2251 
2252 		offset = (uintptr_t)vaddr & MMU_PAGEOFFSET;
2253 		sglinfo->si_asp = dmar_object->dmao_obj.virt_obj.v_as;
2254 		if (sglinfo->si_asp == NULL) {
2255 			sglinfo->si_asp = &kas;
2256 		}
2257 
2258 		paddr = pfn_to_pa(hat_getpfnum(sglinfo->si_asp->a_hat, vaddr));
2259 		paddr += offset;
2260 		psize = MIN(size, (MMU_PAGESIZE - offset));
2261 		vaddr += psize;
2262 	}
2263 
2264 #ifdef __xpv
2265 	/*
2266 	 * If we're dom0, we're using a real device so we need to load
2267 	 * the cookies with MFNs instead of PFNs.
2268 	 */
2269 	raddr = ROOTNEX_PADDR_TO_RBASE(xen_info, paddr);
2270 #else
2271 	raddr = paddr;
2272 #endif
2273 
2274 	/*
2275 	 * Setup the first cookie with the physical address of the page and the
2276 	 * size of the page (which takes into account the initial offset into
2277 	 * the page.
2278 	 */
2279 	sgl[cnt].dmac_laddress = raddr;
2280 	sgl[cnt].dmac_size = psize;
2281 	sgl[cnt].dmac_type = 0;
2282 
2283 	/*
2284 	 * Save away the buffer offset into the page. We'll need this later in
2285 	 * the copy buffer code to help figure out the page index within the
2286 	 * buffer and the offset into the current page.
2287 	 */
2288 	sglinfo->si_buf_offset = offset;
2289 
2290 	/*
2291 	 * If the DMA engine can't reach the physical address, increase how
2292 	 * much copy buffer we need. We always increase by pagesize so we don't
2293 	 * have to worry about converting offsets. Set a flag in the cookies
2294 	 * dmac_type to indicate that it uses the copy buffer. If this isn't the
2295 	 * last cookie, go to the next cookie (since we separate each page which
2296 	 * uses the copy buffer in case the copy buffer is not physically
2297 	 * contiguous.
2298 	 */
2299 	if ((raddr < addrlo) || ((raddr + psize) > addrhi)) {
2300 		sglinfo->si_copybuf_req += MMU_PAGESIZE;
2301 		sgl[cnt].dmac_type = ROOTNEX_USES_COPYBUF;
2302 		if ((cnt + 1) < sglinfo->si_max_pages) {
2303 			cnt++;
2304 			sgl[cnt].dmac_laddress = 0;
2305 			sgl[cnt].dmac_size = 0;
2306 			sgl[cnt].dmac_type = 0;
2307 		}
2308 	}
2309 
2310 	/*
2311 	 * save this page's physical address so we can figure out if the next
2312 	 * page is physically contiguous. Keep decrementing size until we are
2313 	 * done with the buffer.
2314 	 */
2315 	last_page = raddr & MMU_PAGEMASK;
2316 	size -= psize;
2317 
2318 	while (size > 0) {
2319 		/* Get the size for this page (i.e. partial or full page) */
2320 		psize = MIN(size, MMU_PAGESIZE);
2321 
2322 		if (buftype == DMA_OTYP_PAGES) {
2323 			/* get the paddr from the page_t */
2324 			ASSERT(!PP_ISFREE(pp) && PAGE_LOCKED(pp));
2325 			paddr = pfn_to_pa(pp->p_pagenum);
2326 			pp = pp->p_next;
2327 		} else if (pplist != NULL) {
2328 			/* index into the array of page_t's to get the paddr */
2329 			ASSERT(!PP_ISFREE(pplist[pcnt]));
2330 			paddr = pfn_to_pa(pplist[pcnt]->p_pagenum);
2331 			pcnt++;
2332 		} else {
2333 			/* call into the VM to get the paddr */
2334 			paddr =  pfn_to_pa(hat_getpfnum(sglinfo->si_asp->a_hat,
2335 			    vaddr));
2336 			vaddr += psize;
2337 		}
2338 
2339 #ifdef __xpv
2340 		/*
2341 		 * If we're dom0, we're using a real device so we need to load
2342 		 * the cookies with MFNs instead of PFNs.
2343 		 */
2344 		raddr = ROOTNEX_PADDR_TO_RBASE(xen_info, paddr);
2345 #else
2346 		raddr = paddr;
2347 #endif
2348 
2349 		/* check to see if this page needs the copy buffer */
2350 		if ((raddr < addrlo) || ((raddr + psize) > addrhi)) {
2351 			sglinfo->si_copybuf_req += MMU_PAGESIZE;
2352 
2353 			/*
2354 			 * if there is something in the current cookie, go to
2355 			 * the next one. We only want one page in a cookie which
2356 			 * uses the copybuf since the copybuf doesn't have to
2357 			 * be physically contiguous.
2358 			 */
2359 			if (sgl[cnt].dmac_size != 0) {
2360 				cnt++;
2361 			}
2362 			sgl[cnt].dmac_laddress = raddr;
2363 			sgl[cnt].dmac_size = psize;
2364 #if defined(__amd64)
2365 			sgl[cnt].dmac_type = ROOTNEX_USES_COPYBUF;
2366 #else
2367 			/*
2368 			 * save the buf offset for 32-bit kernel. used in the
2369 			 * obsoleted interfaces.
2370 			 */
2371 			sgl[cnt].dmac_type = ROOTNEX_USES_COPYBUF |
2372 			    (dmar_object->dmao_size - size);
2373 #endif
2374 			/* if this isn't the last cookie, go to the next one */
2375 			if ((cnt + 1) < sglinfo->si_max_pages) {
2376 				cnt++;
2377 				sgl[cnt].dmac_laddress = 0;
2378 				sgl[cnt].dmac_size = 0;
2379 				sgl[cnt].dmac_type = 0;
2380 			}
2381 
2382 		/*
2383 		 * this page didn't need the copy buffer, if it's not physically
2384 		 * contiguous, or it would put us over a segment boundary, or it
2385 		 * puts us over the max cookie size, or the current sgl doesn't
2386 		 * have anything in it.
2387 		 */
2388 		} else if (((last_page + MMU_PAGESIZE) != raddr) ||
2389 		    !(raddr & sglinfo->si_segmask) ||
2390 		    ((sgl[cnt].dmac_size + psize) > maxseg) ||
2391 		    (sgl[cnt].dmac_size == 0)) {
2392 			/*
2393 			 * if we're not already in a new cookie, go to the next
2394 			 * cookie.
2395 			 */
2396 			if (sgl[cnt].dmac_size != 0) {
2397 				cnt++;
2398 			}
2399 
2400 			/* save the cookie information */
2401 			sgl[cnt].dmac_laddress = raddr;
2402 			sgl[cnt].dmac_size = psize;
2403 #if defined(__amd64)
2404 			sgl[cnt].dmac_type = 0;
2405 #else
2406 			/*
2407 			 * save the buf offset for 32-bit kernel. used in the
2408 			 * obsoleted interfaces.
2409 			 */
2410 			sgl[cnt].dmac_type = dmar_object->dmao_size - size;
2411 #endif
2412 
2413 		/*
2414 		 * this page didn't need the copy buffer, it is physically
2415 		 * contiguous with the last page, and it's <= the max cookie
2416 		 * size.
2417 		 */
2418 		} else {
2419 			sgl[cnt].dmac_size += psize;
2420 
2421 			/*
2422 			 * if this exactly ==  the maximum cookie size, and
2423 			 * it isn't the last cookie, go to the next cookie.
2424 			 */
2425 			if (((sgl[cnt].dmac_size + psize) == maxseg) &&
2426 			    ((cnt + 1) < sglinfo->si_max_pages)) {
2427 				cnt++;
2428 				sgl[cnt].dmac_laddress = 0;
2429 				sgl[cnt].dmac_size = 0;
2430 				sgl[cnt].dmac_type = 0;
2431 			}
2432 		}
2433 
2434 		/*
2435 		 * save this page's physical address so we can figure out if the
2436 		 * next page is physically contiguous. Keep decrementing size
2437 		 * until we are done with the buffer.
2438 		 */
2439 		last_page = raddr;
2440 		size -= psize;
2441 	}
2442 
2443 	/* we're done, save away how many cookies the sgl has */
2444 	if (sgl[cnt].dmac_size == 0) {
2445 		ASSERT(cnt < sglinfo->si_max_pages);
2446 		sglinfo->si_sgl_size = cnt;
2447 	} else {
2448 		sglinfo->si_sgl_size = cnt + 1;
2449 	}
2450 }
2451 
2452 
2453 /*
2454  * rootnex_bind_slowpath()
2455  *    Call in the bind path if the calling driver can't use the sgl without
2456  *    modifying it. We either need to use the copy buffer and/or we will end up
2457  *    with a partial bind.
2458  */
2459 static int
2460 rootnex_bind_slowpath(ddi_dma_impl_t *hp, struct ddi_dma_req *dmareq,
2461     rootnex_dma_t *dma, ddi_dma_attr_t *attr, int kmflag)
2462 {
2463 	rootnex_sglinfo_t *sinfo;
2464 	rootnex_window_t *window;
2465 	ddi_dma_cookie_t *cookie;
2466 	size_t copybuf_used;
2467 	size_t dmac_size;
2468 	boolean_t partial;
2469 	off_t cur_offset;
2470 	page_t *cur_pp;
2471 	major_t mnum;
2472 	int e;
2473 	int i;
2474 
2475 
2476 	sinfo = &dma->dp_sglinfo;
2477 	copybuf_used = 0;
2478 	partial = B_FALSE;
2479 
2480 	/*
2481 	 * If we're using the copybuf, set the copybuf state in dma struct.
2482 	 * Needs to be first since it sets the copy buffer size.
2483 	 */
2484 	if (sinfo->si_copybuf_req != 0) {
2485 		e = rootnex_setup_copybuf(hp, dmareq, dma, attr);
2486 		if (e != DDI_SUCCESS) {
2487 			return (e);
2488 		}
2489 	} else {
2490 		dma->dp_copybuf_size = 0;
2491 	}
2492 
2493 	/*
2494 	 * Figure out if we need to do a partial mapping. If so, figure out
2495 	 * if we need to trim the buffers when we munge the sgl.
2496 	 */
2497 	if ((dma->dp_copybuf_size < sinfo->si_copybuf_req) ||
2498 	    (dma->dp_dma.dmao_size > dma->dp_maxxfer) ||
2499 	    (attr->dma_attr_sgllen < sinfo->si_sgl_size)) {
2500 		dma->dp_partial_required = B_TRUE;
2501 		if (attr->dma_attr_granular != 1) {
2502 			dma->dp_trim_required = B_TRUE;
2503 		}
2504 	} else {
2505 		dma->dp_partial_required = B_FALSE;
2506 		dma->dp_trim_required = B_FALSE;
2507 	}
2508 
2509 	/* If we need to do a partial bind, make sure the driver supports it */
2510 	if (dma->dp_partial_required &&
2511 	    !(dmareq->dmar_flags & DDI_DMA_PARTIAL)) {
2512 
2513 		mnum = ddi_driver_major(dma->dp_dip);
2514 		/*
2515 		 * patchable which allows us to print one warning per major
2516 		 * number.
2517 		 */
2518 		if ((rootnex_bind_warn) &&
2519 		    ((rootnex_warn_list[mnum] & ROOTNEX_BIND_WARNING) == 0)) {
2520 			rootnex_warn_list[mnum] |= ROOTNEX_BIND_WARNING;
2521 			cmn_err(CE_WARN, "!%s: coding error detected, the "
2522 			    "driver is using ddi_dma_attr(9S) incorrectly. "
2523 			    "There is a small risk of data corruption in "
2524 			    "particular with large I/Os. The driver should be "
2525 			    "replaced with a corrected version for proper "
2526 			    "system operation. To disable this warning, add "
2527 			    "'set rootnex:rootnex_bind_warn=0' to "
2528 			    "/etc/system(4).", ddi_driver_name(dma->dp_dip));
2529 		}
2530 		return (DDI_DMA_TOOBIG);
2531 	}
2532 
2533 	/*
2534 	 * we might need multiple windows, setup state to handle them. In this
2535 	 * code path, we will have at least one window.
2536 	 */
2537 	e = rootnex_setup_windows(hp, dma, attr, kmflag);
2538 	if (e != DDI_SUCCESS) {
2539 		rootnex_teardown_copybuf(dma);
2540 		return (e);
2541 	}
2542 
2543 	window = &dma->dp_window[0];
2544 	cookie = &dma->dp_cookies[0];
2545 	cur_offset = 0;
2546 	rootnex_init_win(hp, dma, window, cookie, cur_offset);
2547 	if (dmareq->dmar_object.dmao_type == DMA_OTYP_PAGES) {
2548 		cur_pp = dmareq->dmar_object.dmao_obj.pp_obj.pp_pp;
2549 	}
2550 
2551 	/* loop though all the cookies we got back from get_sgl() */
2552 	for (i = 0; i < sinfo->si_sgl_size; i++) {
2553 		/*
2554 		 * If we're using the copy buffer, check this cookie and setup
2555 		 * its associated copy buffer state. If this cookie uses the
2556 		 * copy buffer, make sure we sync this window during dma_sync.
2557 		 */
2558 		if (dma->dp_copybuf_size > 0) {
2559 			rootnex_setup_cookie(&dmareq->dmar_object, dma, cookie,
2560 			    cur_offset, &copybuf_used, &cur_pp);
2561 			if (cookie->dmac_type & ROOTNEX_USES_COPYBUF) {
2562 				window->wd_dosync = B_TRUE;
2563 			}
2564 		}
2565 
2566 		/*
2567 		 * save away the cookie size, since it could be modified in
2568 		 * the windowing code.
2569 		 */
2570 		dmac_size = cookie->dmac_size;
2571 
2572 		/* if we went over max copybuf size */
2573 		if (dma->dp_copybuf_size &&
2574 		    (copybuf_used > dma->dp_copybuf_size)) {
2575 			partial = B_TRUE;
2576 			e = rootnex_copybuf_window_boundary(hp, dma, &window,
2577 			    cookie, cur_offset, &copybuf_used);
2578 			if (e != DDI_SUCCESS) {
2579 				rootnex_teardown_copybuf(dma);
2580 				rootnex_teardown_windows(dma);
2581 				return (e);
2582 			}
2583 
2584 			/*
2585 			 * if the coookie uses the copy buffer, make sure the
2586 			 * new window we just moved to is set to sync.
2587 			 */
2588 			if (cookie->dmac_type & ROOTNEX_USES_COPYBUF) {
2589 				window->wd_dosync = B_TRUE;
2590 			}
2591 			DTRACE_PROBE1(rootnex__copybuf__window, dev_info_t *,
2592 			    dma->dp_dip);
2593 
2594 		/* if the cookie cnt == max sgllen, move to the next window */
2595 		} else if (window->wd_cookie_cnt >= attr->dma_attr_sgllen) {
2596 			partial = B_TRUE;
2597 			ASSERT(window->wd_cookie_cnt == attr->dma_attr_sgllen);
2598 			e = rootnex_sgllen_window_boundary(hp, dma, &window,
2599 			    cookie, attr, cur_offset);
2600 			if (e != DDI_SUCCESS) {
2601 				rootnex_teardown_copybuf(dma);
2602 				rootnex_teardown_windows(dma);
2603 				return (e);
2604 			}
2605 
2606 			/*
2607 			 * if the coookie uses the copy buffer, make sure the
2608 			 * new window we just moved to is set to sync.
2609 			 */
2610 			if (cookie->dmac_type & ROOTNEX_USES_COPYBUF) {
2611 				window->wd_dosync = B_TRUE;
2612 			}
2613 			DTRACE_PROBE1(rootnex__sgllen__window, dev_info_t *,
2614 			    dma->dp_dip);
2615 
2616 		/* else if we will be over maxxfer */
2617 		} else if ((window->wd_size + dmac_size) >
2618 		    dma->dp_maxxfer) {
2619 			partial = B_TRUE;
2620 			e = rootnex_maxxfer_window_boundary(hp, dma, &window,
2621 			    cookie);
2622 			if (e != DDI_SUCCESS) {
2623 				rootnex_teardown_copybuf(dma);
2624 				rootnex_teardown_windows(dma);
2625 				return (e);
2626 			}
2627 
2628 			/*
2629 			 * if the coookie uses the copy buffer, make sure the
2630 			 * new window we just moved to is set to sync.
2631 			 */
2632 			if (cookie->dmac_type & ROOTNEX_USES_COPYBUF) {
2633 				window->wd_dosync = B_TRUE;
2634 			}
2635 			DTRACE_PROBE1(rootnex__maxxfer__window, dev_info_t *,
2636 			    dma->dp_dip);
2637 
2638 		/* else this cookie fits in the current window */
2639 		} else {
2640 			window->wd_cookie_cnt++;
2641 			window->wd_size += dmac_size;
2642 		}
2643 
2644 		/* track our offset into the buffer, go to the next cookie */
2645 		ASSERT(dmac_size <= dma->dp_dma.dmao_size);
2646 		ASSERT(cookie->dmac_size <= dmac_size);
2647 		cur_offset += dmac_size;
2648 		cookie++;
2649 	}
2650 
2651 	/* if we ended up with a zero sized window in the end, clean it up */
2652 	if (window->wd_size == 0) {
2653 		hp->dmai_nwin--;
2654 		window--;
2655 	}
2656 
2657 	ASSERT(window->wd_trim.tr_trim_last == B_FALSE);
2658 
2659 	if (!partial) {
2660 		return (DDI_DMA_MAPPED);
2661 	}
2662 
2663 	ASSERT(dma->dp_partial_required);
2664 	return (DDI_DMA_PARTIAL_MAP);
2665 }
2666 
2667 
2668 /*
2669  * rootnex_setup_copybuf()
2670  *    Called in bind slowpath. Figures out if we're going to use the copy
2671  *    buffer, and if we do, sets up the basic state to handle it.
2672  */
2673 static int
2674 rootnex_setup_copybuf(ddi_dma_impl_t *hp, struct ddi_dma_req *dmareq,
2675     rootnex_dma_t *dma, ddi_dma_attr_t *attr)
2676 {
2677 	rootnex_sglinfo_t *sinfo;
2678 	ddi_dma_attr_t lattr;
2679 	size_t max_copybuf;
2680 	int cansleep;
2681 	int e;
2682 #if !defined(__amd64)
2683 	int vmflag;
2684 #endif
2685 
2686 
2687 	sinfo = &dma->dp_sglinfo;
2688 
2689 	/* read this first so it's consistent through the routine  */
2690 	max_copybuf = i_ddi_copybuf_size() & MMU_PAGEMASK;
2691 
2692 	/* We need to call into the rootnex on ddi_dma_sync() */
2693 	hp->dmai_rflags &= ~DMP_NOSYNC;
2694 
2695 	/* make sure the copybuf size <= the max size */
2696 	dma->dp_copybuf_size = MIN(sinfo->si_copybuf_req, max_copybuf);
2697 	ASSERT((dma->dp_copybuf_size & MMU_PAGEOFFSET) == 0);
2698 
2699 #if !defined(__amd64)
2700 	/*
2701 	 * if we don't have kva space to copy to/from, allocate the KVA space
2702 	 * now. We only do this for the 32-bit kernel. We use seg kpm space for
2703 	 * the 64-bit kernel.
2704 	 */
2705 	if ((dmareq->dmar_object.dmao_type == DMA_OTYP_PAGES) ||
2706 	    (dmareq->dmar_object.dmao_obj.virt_obj.v_as != NULL)) {
2707 
2708 		/* convert the sleep flags */
2709 		if (dmareq->dmar_fp == DDI_DMA_SLEEP) {
2710 			vmflag = VM_SLEEP;
2711 		} else {
2712 			vmflag = VM_NOSLEEP;
2713 		}
2714 
2715 		/* allocate Kernel VA space that we can bcopy to/from */
2716 		dma->dp_kva = vmem_alloc(heap_arena, dma->dp_copybuf_size,
2717 		    vmflag);
2718 		if (dma->dp_kva == NULL) {
2719 			return (DDI_DMA_NORESOURCES);
2720 		}
2721 	}
2722 #endif
2723 
2724 	/* convert the sleep flags */
2725 	if (dmareq->dmar_fp == DDI_DMA_SLEEP) {
2726 		cansleep = 1;
2727 	} else {
2728 		cansleep = 0;
2729 	}
2730 
2731 	/*
2732 	 * Allocated the actual copy buffer. This needs to fit within the DMA
2733 	 * engines limits, so we can't use kmem_alloc...
2734 	 */
2735 	lattr = *attr;
2736 	lattr.dma_attr_align = MMU_PAGESIZE;
2737 	e = i_ddi_mem_alloc(dma->dp_dip, &lattr, dma->dp_copybuf_size, cansleep,
2738 	    0, NULL, &dma->dp_cbaddr, &dma->dp_cbsize, NULL);
2739 	if (e != DDI_SUCCESS) {
2740 #if !defined(__amd64)
2741 		if (dma->dp_kva != NULL) {
2742 			vmem_free(heap_arena, dma->dp_kva,
2743 			    dma->dp_copybuf_size);
2744 		}
2745 #endif
2746 		return (DDI_DMA_NORESOURCES);
2747 	}
2748 
2749 	DTRACE_PROBE2(rootnex__alloc__copybuf, dev_info_t *, dma->dp_dip,
2750 	    size_t, dma->dp_copybuf_size);
2751 
2752 	return (DDI_SUCCESS);
2753 }
2754 
2755 
2756 /*
2757  * rootnex_setup_windows()
2758  *    Called in bind slowpath to setup the window state. We always have windows
2759  *    in the slowpath. Even if the window count = 1.
2760  */
2761 static int
2762 rootnex_setup_windows(ddi_dma_impl_t *hp, rootnex_dma_t *dma,
2763     ddi_dma_attr_t *attr, int kmflag)
2764 {
2765 	rootnex_window_t *windowp;
2766 	rootnex_sglinfo_t *sinfo;
2767 	size_t copy_state_size;
2768 	size_t win_state_size;
2769 	size_t state_available;
2770 	size_t space_needed;
2771 	uint_t copybuf_win;
2772 	uint_t maxxfer_win;
2773 	size_t space_used;
2774 	uint_t sglwin;
2775 
2776 
2777 	sinfo = &dma->dp_sglinfo;
2778 
2779 	dma->dp_current_win = 0;
2780 	hp->dmai_nwin = 0;
2781 
2782 	/* If we don't need to do a partial, we only have one window */
2783 	if (!dma->dp_partial_required) {
2784 		dma->dp_max_win = 1;
2785 
2786 	/*
2787 	 * we need multiple windows, need to figure out the worse case number
2788 	 * of windows.
2789 	 */
2790 	} else {
2791 		/*
2792 		 * if we need windows because we need more copy buffer that
2793 		 * we allow, the worse case number of windows we could need
2794 		 * here would be (copybuf space required / copybuf space that
2795 		 * we have) plus one for remainder, and plus 2 to handle the
2796 		 * extra pages on the trim for the first and last pages of the
2797 		 * buffer (a page is the minimum window size so under the right
2798 		 * attr settings, you could have a window for each page).
2799 		 * The last page will only be hit here if the size is not a
2800 		 * multiple of the granularity (which theoretically shouldn't
2801 		 * be the case but never has been enforced, so we could have
2802 		 * broken things without it).
2803 		 */
2804 		if (sinfo->si_copybuf_req > dma->dp_copybuf_size) {
2805 			ASSERT(dma->dp_copybuf_size > 0);
2806 			copybuf_win = (sinfo->si_copybuf_req /
2807 			    dma->dp_copybuf_size) + 1 + 2;
2808 		} else {
2809 			copybuf_win = 0;
2810 		}
2811 
2812 		/*
2813 		 * if we need windows because we have more cookies than the H/W
2814 		 * can handle, the number of windows we would need here would
2815 		 * be (cookie count / cookies count H/W supports) plus one for
2816 		 * remainder, and plus 2 to handle the extra pages on the trim
2817 		 * (see above comment about trim)
2818 		 */
2819 		if (attr->dma_attr_sgllen < sinfo->si_sgl_size) {
2820 			sglwin = ((sinfo->si_sgl_size / attr->dma_attr_sgllen)
2821 			    + 1) + 2;
2822 		} else {
2823 			sglwin = 0;
2824 		}
2825 
2826 		/*
2827 		 * if we need windows because we're binding more memory than the
2828 		 * H/W can transfer at once, the number of windows we would need
2829 		 * here would be (xfer count / max xfer H/W supports) plus one
2830 		 * for remainder, and plus 2 to handle the extra pages on the
2831 		 * trim (see above comment about trim)
2832 		 */
2833 		if (dma->dp_dma.dmao_size > dma->dp_maxxfer) {
2834 			maxxfer_win = (dma->dp_dma.dmao_size /
2835 			    dma->dp_maxxfer) + 1 + 2;
2836 		} else {
2837 			maxxfer_win = 0;
2838 		}
2839 		dma->dp_max_win =  copybuf_win + sglwin + maxxfer_win;
2840 		ASSERT(dma->dp_max_win > 0);
2841 	}
2842 	win_state_size = dma->dp_max_win * sizeof (rootnex_window_t);
2843 
2844 	/*
2845 	 * Get space for window and potential copy buffer state. Before we
2846 	 * go and allocate memory, see if we can get away with using what's
2847 	 * left in the pre-allocted state or the dynamically allocated sgl.
2848 	 */
2849 	space_used = (uintptr_t)(sinfo->si_sgl_size *
2850 	    sizeof (ddi_dma_cookie_t));
2851 
2852 	/* if we dynamically allocated space for the cookies */
2853 	if (dma->dp_need_to_free_cookie) {
2854 		/* if we have more space in the pre-allocted buffer, use it */
2855 		ASSERT(space_used <= dma->dp_cookie_size);
2856 		if ((dma->dp_cookie_size - space_used) <=
2857 		    rootnex_state->r_prealloc_size) {
2858 			state_available = rootnex_state->r_prealloc_size;
2859 			windowp = (rootnex_window_t *)dma->dp_prealloc_buffer;
2860 
2861 		/*
2862 		 * else, we have more free space in the dynamically allocated
2863 		 * buffer, i.e. the buffer wasn't worse case fragmented so we
2864 		 * didn't need a lot of cookies.
2865 		 */
2866 		} else {
2867 			state_available = dma->dp_cookie_size - space_used;
2868 			windowp = (rootnex_window_t *)
2869 			    &dma->dp_cookies[sinfo->si_sgl_size];
2870 		}
2871 
2872 	/* we used the pre-alloced buffer */
2873 	} else {
2874 		ASSERT(space_used <= rootnex_state->r_prealloc_size);
2875 		state_available = rootnex_state->r_prealloc_size - space_used;
2876 		windowp = (rootnex_window_t *)
2877 		    &dma->dp_cookies[sinfo->si_sgl_size];
2878 	}
2879 
2880 	/*
2881 	 * figure out how much state we need to track the copy buffer. Add an
2882 	 * addition 8 bytes for pointer alignemnt later.
2883 	 */
2884 	if (dma->dp_copybuf_size > 0) {
2885 		copy_state_size = sinfo->si_max_pages *
2886 		    sizeof (rootnex_pgmap_t);
2887 	} else {
2888 		copy_state_size = 0;
2889 	}
2890 	/* add an additional 8 bytes for pointer alignment */
2891 	space_needed = win_state_size + copy_state_size + 0x8;
2892 
2893 	/* if we have enough space already, use it */
2894 	if (state_available >= space_needed) {
2895 		dma->dp_window = windowp;
2896 		dma->dp_need_to_free_window = B_FALSE;
2897 
2898 	/* not enough space, need to allocate more. */
2899 	} else {
2900 		dma->dp_window = kmem_alloc(space_needed, kmflag);
2901 		if (dma->dp_window == NULL) {
2902 			return (DDI_DMA_NORESOURCES);
2903 		}
2904 		dma->dp_need_to_free_window = B_TRUE;
2905 		dma->dp_window_size = space_needed;
2906 		DTRACE_PROBE2(rootnex__bind__sp__alloc, dev_info_t *,
2907 		    dma->dp_dip, size_t, space_needed);
2908 	}
2909 
2910 	/*
2911 	 * we allocate copy buffer state and window state at the same time.
2912 	 * setup our copy buffer state pointers. Make sure it's aligned.
2913 	 */
2914 	if (dma->dp_copybuf_size > 0) {
2915 		dma->dp_pgmap = (rootnex_pgmap_t *)(((uintptr_t)
2916 		    &dma->dp_window[dma->dp_max_win] + 0x7) & ~0x7);
2917 
2918 #if !defined(__amd64)
2919 		/*
2920 		 * make sure all pm_mapped, pm_vaddr, and pm_pp are set to
2921 		 * false/NULL. Should be quicker to bzero vs loop and set.
2922 		 */
2923 		bzero(dma->dp_pgmap, copy_state_size);
2924 #endif
2925 	} else {
2926 		dma->dp_pgmap = NULL;
2927 	}
2928 
2929 	return (DDI_SUCCESS);
2930 }
2931 
2932 
2933 /*
2934  * rootnex_teardown_copybuf()
2935  *    cleans up after rootnex_setup_copybuf()
2936  */
2937 static void
2938 rootnex_teardown_copybuf(rootnex_dma_t *dma)
2939 {
2940 #if !defined(__amd64)
2941 	int i;
2942 
2943 	/*
2944 	 * if we allocated kernel heap VMEM space, go through all the pages and
2945 	 * map out any of the ones that we're mapped into the kernel heap VMEM
2946 	 * arena. Then free the VMEM space.
2947 	 */
2948 	if (dma->dp_kva != NULL) {
2949 		for (i = 0; i < dma->dp_sglinfo.si_max_pages; i++) {
2950 			if (dma->dp_pgmap[i].pm_mapped) {
2951 				hat_unload(kas.a_hat, dma->dp_pgmap[i].pm_kaddr,
2952 				    MMU_PAGESIZE, HAT_UNLOAD);
2953 				dma->dp_pgmap[i].pm_mapped = B_FALSE;
2954 			}
2955 		}
2956 
2957 		vmem_free(heap_arena, dma->dp_kva, dma->dp_copybuf_size);
2958 	}
2959 
2960 #endif
2961 
2962 	/* if we allocated a copy buffer, free it */
2963 	if (dma->dp_cbaddr != NULL) {
2964 		i_ddi_mem_free(dma->dp_cbaddr, NULL);
2965 	}
2966 }
2967 
2968 
2969 /*
2970  * rootnex_teardown_windows()
2971  *    cleans up after rootnex_setup_windows()
2972  */
2973 static void
2974 rootnex_teardown_windows(rootnex_dma_t *dma)
2975 {
2976 	/*
2977 	 * if we had to allocate window state on the last bind (because we
2978 	 * didn't have enough pre-allocated space in the handle), free it.
2979 	 */
2980 	if (dma->dp_need_to_free_window) {
2981 		kmem_free(dma->dp_window, dma->dp_window_size);
2982 	}
2983 }
2984 
2985 
2986 /*
2987  * rootnex_init_win()
2988  *    Called in bind slow path during creation of a new window. Initializes
2989  *    window state to default values.
2990  */
2991 /*ARGSUSED*/
2992 static void
2993 rootnex_init_win(ddi_dma_impl_t *hp, rootnex_dma_t *dma,
2994     rootnex_window_t *window, ddi_dma_cookie_t *cookie, off_t cur_offset)
2995 {
2996 	hp->dmai_nwin++;
2997 	window->wd_dosync = B_FALSE;
2998 	window->wd_offset = cur_offset;
2999 	window->wd_size = 0;
3000 	window->wd_first_cookie = cookie;
3001 	window->wd_cookie_cnt = 0;
3002 	window->wd_trim.tr_trim_first = B_FALSE;
3003 	window->wd_trim.tr_trim_last = B_FALSE;
3004 	window->wd_trim.tr_first_copybuf_win = B_FALSE;
3005 	window->wd_trim.tr_last_copybuf_win = B_FALSE;
3006 #if !defined(__amd64)
3007 	window->wd_remap_copybuf = dma->dp_cb_remaping;
3008 #endif
3009 }
3010 
3011 
3012 /*
3013  * rootnex_setup_cookie()
3014  *    Called in the bind slow path when the sgl uses the copy buffer. If any of
3015  *    the sgl uses the copy buffer, we need to go through each cookie, figure
3016  *    out if it uses the copy buffer, and if it does, save away everything we'll
3017  *    need during sync.
3018  */
3019 static void
3020 rootnex_setup_cookie(ddi_dma_obj_t *dmar_object, rootnex_dma_t *dma,
3021     ddi_dma_cookie_t *cookie, off_t cur_offset, size_t *copybuf_used,
3022     page_t **cur_pp)
3023 {
3024 	boolean_t copybuf_sz_power_2;
3025 	rootnex_sglinfo_t *sinfo;
3026 	paddr_t paddr;
3027 	uint_t pidx;
3028 	uint_t pcnt;
3029 	off_t poff;
3030 #if defined(__amd64)
3031 	pfn_t pfn;
3032 #else
3033 	page_t **pplist;
3034 #endif
3035 
3036 	sinfo = &dma->dp_sglinfo;
3037 
3038 	/*
3039 	 * Calculate the page index relative to the start of the buffer. The
3040 	 * index to the current page for our buffer is the offset into the
3041 	 * first page of the buffer plus our current offset into the buffer
3042 	 * itself, shifted of course...
3043 	 */
3044 	pidx = (sinfo->si_buf_offset + cur_offset) >> MMU_PAGESHIFT;
3045 	ASSERT(pidx < sinfo->si_max_pages);
3046 
3047 	/* if this cookie uses the copy buffer */
3048 	if (cookie->dmac_type & ROOTNEX_USES_COPYBUF) {
3049 		/*
3050 		 * NOTE: we know that since this cookie uses the copy buffer, it
3051 		 * is <= MMU_PAGESIZE.
3052 		 */
3053 
3054 		/*
3055 		 * get the offset into the page. For the 64-bit kernel, get the
3056 		 * pfn which we'll use with seg kpm.
3057 		 */
3058 		poff = cookie->dmac_laddress & MMU_PAGEOFFSET;
3059 #if defined(__amd64)
3060 		/* mfn_to_pfn() is a NOP on i86pc */
3061 		pfn = mfn_to_pfn(cookie->dmac_laddress >> MMU_PAGESHIFT);
3062 #endif /* __amd64 */
3063 
3064 		/* figure out if the copybuf size is a power of 2 */
3065 		if (dma->dp_copybuf_size & (dma->dp_copybuf_size - 1)) {
3066 			copybuf_sz_power_2 = B_FALSE;
3067 		} else {
3068 			copybuf_sz_power_2 = B_TRUE;
3069 		}
3070 
3071 		/* This page uses the copy buffer */
3072 		dma->dp_pgmap[pidx].pm_uses_copybuf = B_TRUE;
3073 
3074 		/*
3075 		 * save the copy buffer KVA that we'll use with this page.
3076 		 * if we still fit within the copybuf, it's a simple add.
3077 		 * otherwise, we need to wrap over using & or % accordingly.
3078 		 */
3079 		if ((*copybuf_used + MMU_PAGESIZE) <= dma->dp_copybuf_size) {
3080 			dma->dp_pgmap[pidx].pm_cbaddr = dma->dp_cbaddr +
3081 			    *copybuf_used;
3082 		} else {
3083 			if (copybuf_sz_power_2) {
3084 				dma->dp_pgmap[pidx].pm_cbaddr = (caddr_t)(
3085 				    (uintptr_t)dma->dp_cbaddr +
3086 				    (*copybuf_used &
3087 				    (dma->dp_copybuf_size - 1)));
3088 			} else {
3089 				dma->dp_pgmap[pidx].pm_cbaddr = (caddr_t)(
3090 				    (uintptr_t)dma->dp_cbaddr +
3091 				    (*copybuf_used % dma->dp_copybuf_size));
3092 			}
3093 		}
3094 
3095 		/*
3096 		 * over write the cookie physical address with the address of
3097 		 * the physical address of the copy buffer page that we will
3098 		 * use.
3099 		 */
3100 		paddr = pfn_to_pa(hat_getpfnum(kas.a_hat,
3101 		    dma->dp_pgmap[pidx].pm_cbaddr)) + poff;
3102 
3103 #ifdef __xpv
3104 		/*
3105 		 * If we're dom0, we're using a real device so we need to load
3106 		 * the cookies with MAs instead of PAs.
3107 		 */
3108 		cookie->dmac_laddress = ROOTNEX_PADDR_TO_RBASE(xen_info, paddr);
3109 #else
3110 		cookie->dmac_laddress = paddr;
3111 #endif
3112 
3113 		/* if we have a kernel VA, it's easy, just save that address */
3114 		if ((dmar_object->dmao_type != DMA_OTYP_PAGES) &&
3115 		    (sinfo->si_asp == &kas)) {
3116 			/*
3117 			 * save away the page aligned virtual address of the
3118 			 * driver buffer. Offsets are handled in the sync code.
3119 			 */
3120 			dma->dp_pgmap[pidx].pm_kaddr = (caddr_t)(((uintptr_t)
3121 			    dmar_object->dmao_obj.virt_obj.v_addr + cur_offset)
3122 			    & MMU_PAGEMASK);
3123 #if !defined(__amd64)
3124 			/*
3125 			 * we didn't need to, and will never need to map this
3126 			 * page.
3127 			 */
3128 			dma->dp_pgmap[pidx].pm_mapped = B_FALSE;
3129 #endif
3130 
3131 		/* we don't have a kernel VA. We need one for the bcopy. */
3132 		} else {
3133 #if defined(__amd64)
3134 			/*
3135 			 * for the 64-bit kernel, it's easy. We use seg kpm to
3136 			 * get a Kernel VA for the corresponding pfn.
3137 			 */
3138 			dma->dp_pgmap[pidx].pm_kaddr = hat_kpm_pfn2va(pfn);
3139 #else
3140 			/*
3141 			 * for the 32-bit kernel, this is a pain. First we'll
3142 			 * save away the page_t or user VA for this page. This
3143 			 * is needed in rootnex_dma_win() when we switch to a
3144 			 * new window which requires us to re-map the copy
3145 			 * buffer.
3146 			 */
3147 			pplist = dmar_object->dmao_obj.virt_obj.v_priv;
3148 			if (dmar_object->dmao_type == DMA_OTYP_PAGES) {
3149 				dma->dp_pgmap[pidx].pm_pp = *cur_pp;
3150 				dma->dp_pgmap[pidx].pm_vaddr = NULL;
3151 			} else if (pplist != NULL) {
3152 				dma->dp_pgmap[pidx].pm_pp = pplist[pidx];
3153 				dma->dp_pgmap[pidx].pm_vaddr = NULL;
3154 			} else {
3155 				dma->dp_pgmap[pidx].pm_pp = NULL;
3156 				dma->dp_pgmap[pidx].pm_vaddr = (caddr_t)
3157 				    (((uintptr_t)
3158 				    dmar_object->dmao_obj.virt_obj.v_addr +
3159 				    cur_offset) & MMU_PAGEMASK);
3160 			}
3161 
3162 			/*
3163 			 * save away the page aligned virtual address which was
3164 			 * allocated from the kernel heap arena (taking into
3165 			 * account if we need more copy buffer than we alloced
3166 			 * and use multiple windows to handle this, i.e. &,%).
3167 			 * NOTE: there isn't and physical memory backing up this
3168 			 * virtual address space currently.
3169 			 */
3170 			if ((*copybuf_used + MMU_PAGESIZE) <=
3171 			    dma->dp_copybuf_size) {
3172 				dma->dp_pgmap[pidx].pm_kaddr = (caddr_t)
3173 				    (((uintptr_t)dma->dp_kva + *copybuf_used) &
3174 				    MMU_PAGEMASK);
3175 			} else {
3176 				if (copybuf_sz_power_2) {
3177 					dma->dp_pgmap[pidx].pm_kaddr = (caddr_t)
3178 					    (((uintptr_t)dma->dp_kva +
3179 					    (*copybuf_used &
3180 					    (dma->dp_copybuf_size - 1))) &
3181 					    MMU_PAGEMASK);
3182 				} else {
3183 					dma->dp_pgmap[pidx].pm_kaddr = (caddr_t)
3184 					    (((uintptr_t)dma->dp_kva +
3185 					    (*copybuf_used %
3186 					    dma->dp_copybuf_size)) &
3187 					    MMU_PAGEMASK);
3188 				}
3189 			}
3190 
3191 			/*
3192 			 * if we haven't used up the available copy buffer yet,
3193 			 * map the kva to the physical page.
3194 			 */
3195 			if (!dma->dp_cb_remaping && ((*copybuf_used +
3196 			    MMU_PAGESIZE) <= dma->dp_copybuf_size)) {
3197 				dma->dp_pgmap[pidx].pm_mapped = B_TRUE;
3198 				if (dma->dp_pgmap[pidx].pm_pp != NULL) {
3199 					i86_pp_map(dma->dp_pgmap[pidx].pm_pp,
3200 					    dma->dp_pgmap[pidx].pm_kaddr);
3201 				} else {
3202 					i86_va_map(dma->dp_pgmap[pidx].pm_vaddr,
3203 					    sinfo->si_asp,
3204 					    dma->dp_pgmap[pidx].pm_kaddr);
3205 				}
3206 
3207 			/*
3208 			 * we've used up the available copy buffer, this page
3209 			 * will have to be mapped during rootnex_dma_win() when
3210 			 * we switch to a new window which requires a re-map
3211 			 * the copy buffer. (32-bit kernel only)
3212 			 */
3213 			} else {
3214 				dma->dp_pgmap[pidx].pm_mapped = B_FALSE;
3215 			}
3216 #endif
3217 			/* go to the next page_t */
3218 			if (dmar_object->dmao_type == DMA_OTYP_PAGES) {
3219 				*cur_pp = (*cur_pp)->p_next;
3220 			}
3221 		}
3222 
3223 		/* add to the copy buffer count */
3224 		*copybuf_used += MMU_PAGESIZE;
3225 
3226 	/*
3227 	 * This cookie doesn't use the copy buffer. Walk through the pages this
3228 	 * cookie occupies to reflect this.
3229 	 */
3230 	} else {
3231 		/*
3232 		 * figure out how many pages the cookie occupies. We need to
3233 		 * use the original page offset of the buffer and the cookies
3234 		 * offset in the buffer to do this.
3235 		 */
3236 		poff = (sinfo->si_buf_offset + cur_offset) & MMU_PAGEOFFSET;
3237 		pcnt = mmu_btopr(cookie->dmac_size + poff);
3238 
3239 		while (pcnt > 0) {
3240 #if !defined(__amd64)
3241 			/*
3242 			 * the 32-bit kernel doesn't have seg kpm, so we need
3243 			 * to map in the driver buffer (if it didn't come down
3244 			 * with a kernel VA) on the fly. Since this page doesn't
3245 			 * use the copy buffer, it's not, or will it ever, have
3246 			 * to be mapped in.
3247 			 */
3248 			dma->dp_pgmap[pidx].pm_mapped = B_FALSE;
3249 #endif
3250 			dma->dp_pgmap[pidx].pm_uses_copybuf = B_FALSE;
3251 
3252 			/*
3253 			 * we need to update pidx and cur_pp or we'll loose
3254 			 * track of where we are.
3255 			 */
3256 			if (dmar_object->dmao_type == DMA_OTYP_PAGES) {
3257 				*cur_pp = (*cur_pp)->p_next;
3258 			}
3259 			pidx++;
3260 			pcnt--;
3261 		}
3262 	}
3263 }
3264 
3265 
3266 /*
3267  * rootnex_sgllen_window_boundary()
3268  *    Called in the bind slow path when the next cookie causes us to exceed (in
3269  *    this case == since we start at 0 and sgllen starts at 1) the maximum sgl
3270  *    length supported by the DMA H/W.
3271  */
3272 static int
3273 rootnex_sgllen_window_boundary(ddi_dma_impl_t *hp, rootnex_dma_t *dma,
3274     rootnex_window_t **windowp, ddi_dma_cookie_t *cookie, ddi_dma_attr_t *attr,
3275     off_t cur_offset)
3276 {
3277 	off_t new_offset;
3278 	size_t trim_sz;
3279 	off_t coffset;
3280 
3281 
3282 	/*
3283 	 * if we know we'll never have to trim, it's pretty easy. Just move to
3284 	 * the next window and init it. We're done.
3285 	 */
3286 	if (!dma->dp_trim_required) {
3287 		(*windowp)++;
3288 		rootnex_init_win(hp, dma, *windowp, cookie, cur_offset);
3289 		(*windowp)->wd_cookie_cnt++;
3290 		(*windowp)->wd_size = cookie->dmac_size;
3291 		return (DDI_SUCCESS);
3292 	}
3293 
3294 	/* figure out how much we need to trim from the window */
3295 	ASSERT(attr->dma_attr_granular != 0);
3296 	if (dma->dp_granularity_power_2) {
3297 		trim_sz = (*windowp)->wd_size & (attr->dma_attr_granular - 1);
3298 	} else {
3299 		trim_sz = (*windowp)->wd_size % attr->dma_attr_granular;
3300 	}
3301 
3302 	/* The window's a whole multiple of granularity. We're done */
3303 	if (trim_sz == 0) {
3304 		(*windowp)++;
3305 		rootnex_init_win(hp, dma, *windowp, cookie, cur_offset);
3306 		(*windowp)->wd_cookie_cnt++;
3307 		(*windowp)->wd_size = cookie->dmac_size;
3308 		return (DDI_SUCCESS);
3309 	}
3310 
3311 	/*
3312 	 * The window's not a whole multiple of granularity, since we know this
3313 	 * is due to the sgllen, we need to go back to the last cookie and trim
3314 	 * that one, add the left over part of the old cookie into the new
3315 	 * window, and then add in the new cookie into the new window.
3316 	 */
3317 
3318 	/*
3319 	 * make sure the driver isn't making us do something bad... Trimming and
3320 	 * sgllen == 1 don't go together.
3321 	 */
3322 	if (attr->dma_attr_sgllen == 1) {
3323 		return (DDI_DMA_NOMAPPING);
3324 	}
3325 
3326 	/*
3327 	 * first, setup the current window to account for the trim. Need to go
3328 	 * back to the last cookie for this.
3329 	 */
3330 	cookie--;
3331 	(*windowp)->wd_trim.tr_trim_last = B_TRUE;
3332 	(*windowp)->wd_trim.tr_last_cookie = cookie;
3333 	(*windowp)->wd_trim.tr_last_paddr = cookie->dmac_laddress;
3334 	ASSERT(cookie->dmac_size > trim_sz);
3335 	(*windowp)->wd_trim.tr_last_size = cookie->dmac_size - trim_sz;
3336 	(*windowp)->wd_size -= trim_sz;
3337 
3338 	/* save the buffer offsets for the next window */
3339 	coffset = cookie->dmac_size - trim_sz;
3340 	new_offset = (*windowp)->wd_offset + (*windowp)->wd_size;
3341 
3342 	/*
3343 	 * set this now in case this is the first window. all other cases are
3344 	 * set in dma_win()
3345 	 */
3346 	cookie->dmac_size = (*windowp)->wd_trim.tr_last_size;
3347 
3348 	/*
3349 	 * initialize the next window using what's left over in the previous
3350 	 * cookie.
3351 	 */
3352 	(*windowp)++;
3353 	rootnex_init_win(hp, dma, *windowp, cookie, new_offset);
3354 	(*windowp)->wd_cookie_cnt++;
3355 	(*windowp)->wd_trim.tr_trim_first = B_TRUE;
3356 	(*windowp)->wd_trim.tr_first_paddr = cookie->dmac_laddress + coffset;
3357 	(*windowp)->wd_trim.tr_first_size = trim_sz;
3358 	if (cookie->dmac_type & ROOTNEX_USES_COPYBUF) {
3359 		(*windowp)->wd_dosync = B_TRUE;
3360 	}
3361 
3362 	/*
3363 	 * now go back to the current cookie and add it to the new window. set
3364 	 * the new window size to the what was left over from the previous
3365 	 * cookie and what's in the current cookie.
3366 	 */
3367 	cookie++;
3368 	(*windowp)->wd_cookie_cnt++;
3369 	(*windowp)->wd_size = trim_sz + cookie->dmac_size;
3370 
3371 	/*
3372 	 * trim plus the next cookie could put us over maxxfer (a cookie can be
3373 	 * a max size of maxxfer). Handle that case.
3374 	 */
3375 	if ((*windowp)->wd_size > dma->dp_maxxfer) {
3376 		/*
3377 		 * maxxfer is already a whole multiple of granularity, and this
3378 		 * trim will be <= the previous trim (since a cookie can't be
3379 		 * larger than maxxfer). Make things simple here.
3380 		 */
3381 		trim_sz = (*windowp)->wd_size - dma->dp_maxxfer;
3382 		(*windowp)->wd_trim.tr_trim_last = B_TRUE;
3383 		(*windowp)->wd_trim.tr_last_cookie = cookie;
3384 		(*windowp)->wd_trim.tr_last_paddr = cookie->dmac_laddress;
3385 		(*windowp)->wd_trim.tr_last_size = cookie->dmac_size - trim_sz;
3386 		(*windowp)->wd_size -= trim_sz;
3387 		ASSERT((*windowp)->wd_size == dma->dp_maxxfer);
3388 
3389 		/* save the buffer offsets for the next window */
3390 		coffset = cookie->dmac_size - trim_sz;
3391 		new_offset = (*windowp)->wd_offset + (*windowp)->wd_size;
3392 
3393 		/* setup the next window */
3394 		(*windowp)++;
3395 		rootnex_init_win(hp, dma, *windowp, cookie, new_offset);
3396 		(*windowp)->wd_cookie_cnt++;
3397 		(*windowp)->wd_trim.tr_trim_first = B_TRUE;
3398 		(*windowp)->wd_trim.tr_first_paddr = cookie->dmac_laddress +
3399 		    coffset;
3400 		(*windowp)->wd_trim.tr_first_size = trim_sz;
3401 	}
3402 
3403 	return (DDI_SUCCESS);
3404 }
3405 
3406 
3407 /*
3408  * rootnex_copybuf_window_boundary()
3409  *    Called in bind slowpath when we get to a window boundary because we used
3410  *    up all the copy buffer that we have.
3411  */
3412 static int
3413 rootnex_copybuf_window_boundary(ddi_dma_impl_t *hp, rootnex_dma_t *dma,
3414     rootnex_window_t **windowp, ddi_dma_cookie_t *cookie, off_t cur_offset,
3415     size_t *copybuf_used)
3416 {
3417 	rootnex_sglinfo_t *sinfo;
3418 	off_t new_offset;
3419 	size_t trim_sz;
3420 	paddr_t paddr;
3421 	off_t coffset;
3422 	uint_t pidx;
3423 	off_t poff;
3424 
3425 
3426 	sinfo = &dma->dp_sglinfo;
3427 
3428 	/*
3429 	 * the copy buffer should be a whole multiple of page size. We know that
3430 	 * this cookie is <= MMU_PAGESIZE.
3431 	 */
3432 	ASSERT(cookie->dmac_size <= MMU_PAGESIZE);
3433 
3434 	/*
3435 	 * from now on, all new windows in this bind need to be re-mapped during
3436 	 * ddi_dma_getwin() (32-bit kernel only). i.e. we ran out out copybuf
3437 	 * space...
3438 	 */
3439 #if !defined(__amd64)
3440 	dma->dp_cb_remaping = B_TRUE;
3441 #endif
3442 
3443 	/* reset copybuf used */
3444 	*copybuf_used = 0;
3445 
3446 	/*
3447 	 * if we don't have to trim (since granularity is set to 1), go to the
3448 	 * next window and add the current cookie to it. We know the current
3449 	 * cookie uses the copy buffer since we're in this code path.
3450 	 */
3451 	if (!dma->dp_trim_required) {
3452 		(*windowp)++;
3453 		rootnex_init_win(hp, dma, *windowp, cookie, cur_offset);
3454 
3455 		/* Add this cookie to the new window */
3456 		(*windowp)->wd_cookie_cnt++;
3457 		(*windowp)->wd_size += cookie->dmac_size;
3458 		*copybuf_used += MMU_PAGESIZE;
3459 		return (DDI_SUCCESS);
3460 	}
3461 
3462 	/*
3463 	 * *** may need to trim, figure it out.
3464 	 */
3465 
3466 	/* figure out how much we need to trim from the window */
3467 	if (dma->dp_granularity_power_2) {
3468 		trim_sz = (*windowp)->wd_size &
3469 		    (hp->dmai_attr.dma_attr_granular - 1);
3470 	} else {
3471 		trim_sz = (*windowp)->wd_size % hp->dmai_attr.dma_attr_granular;
3472 	}
3473 
3474 	/*
3475 	 * if the window's a whole multiple of granularity, go to the next
3476 	 * window, init it, then add in the current cookie. We know the current
3477 	 * cookie uses the copy buffer since we're in this code path.
3478 	 */
3479 	if (trim_sz == 0) {
3480 		(*windowp)++;
3481 		rootnex_init_win(hp, dma, *windowp, cookie, cur_offset);
3482 
3483 		/* Add this cookie to the new window */
3484 		(*windowp)->wd_cookie_cnt++;
3485 		(*windowp)->wd_size += cookie->dmac_size;
3486 		*copybuf_used += MMU_PAGESIZE;
3487 		return (DDI_SUCCESS);
3488 	}
3489 
3490 	/*
3491 	 * *** We figured it out, we definitly need to trim
3492 	 */
3493 
3494 	/*
3495 	 * make sure the driver isn't making us do something bad...
3496 	 * Trimming and sgllen == 1 don't go together.
3497 	 */
3498 	if (hp->dmai_attr.dma_attr_sgllen == 1) {
3499 		return (DDI_DMA_NOMAPPING);
3500 	}
3501 
3502 	/*
3503 	 * first, setup the current window to account for the trim. Need to go
3504 	 * back to the last cookie for this. Some of the last cookie will be in
3505 	 * the current window, and some of the last cookie will be in the new
3506 	 * window. All of the current cookie will be in the new window.
3507 	 */
3508 	cookie--;
3509 	(*windowp)->wd_trim.tr_trim_last = B_TRUE;
3510 	(*windowp)->wd_trim.tr_last_cookie = cookie;
3511 	(*windowp)->wd_trim.tr_last_paddr = cookie->dmac_laddress;
3512 	ASSERT(cookie->dmac_size > trim_sz);
3513 	(*windowp)->wd_trim.tr_last_size = cookie->dmac_size - trim_sz;
3514 	(*windowp)->wd_size -= trim_sz;
3515 
3516 	/*
3517 	 * we're trimming the last cookie (not the current cookie). So that
3518 	 * last cookie may have or may not have been using the copy buffer (
3519 	 * we know the cookie passed in uses the copy buffer since we're in
3520 	 * this code path).
3521 	 *
3522 	 * If the last cookie doesn't use the copy buffer, nothing special to
3523 	 * do. However, if it does uses the copy buffer, it will be both the
3524 	 * last page in the current window and the first page in the next
3525 	 * window. Since we are reusing the copy buffer (and KVA space on the
3526 	 * 32-bit kernel), this page will use the end of the copy buffer in the
3527 	 * current window, and the start of the copy buffer in the next window.
3528 	 * Track that info... The cookie physical address was already set to
3529 	 * the copy buffer physical address in setup_cookie..
3530 	 */
3531 	if (cookie->dmac_type & ROOTNEX_USES_COPYBUF) {
3532 		pidx = (sinfo->si_buf_offset + (*windowp)->wd_offset +
3533 		    (*windowp)->wd_size) >> MMU_PAGESHIFT;
3534 		(*windowp)->wd_trim.tr_last_copybuf_win = B_TRUE;
3535 		(*windowp)->wd_trim.tr_last_pidx = pidx;
3536 		(*windowp)->wd_trim.tr_last_cbaddr =
3537 		    dma->dp_pgmap[pidx].pm_cbaddr;
3538 #if !defined(__amd64)
3539 		(*windowp)->wd_trim.tr_last_kaddr =
3540 		    dma->dp_pgmap[pidx].pm_kaddr;
3541 #endif
3542 	}
3543 
3544 	/* save the buffer offsets for the next window */
3545 	coffset = cookie->dmac_size - trim_sz;
3546 	new_offset = (*windowp)->wd_offset + (*windowp)->wd_size;
3547 
3548 	/*
3549 	 * set this now in case this is the first window. all other cases are
3550 	 * set in dma_win()
3551 	 */
3552 	cookie->dmac_size = (*windowp)->wd_trim.tr_last_size;
3553 
3554 	/*
3555 	 * initialize the next window using what's left over in the previous
3556 	 * cookie.
3557 	 */
3558 	(*windowp)++;
3559 	rootnex_init_win(hp, dma, *windowp, cookie, new_offset);
3560 	(*windowp)->wd_cookie_cnt++;
3561 	(*windowp)->wd_trim.tr_trim_first = B_TRUE;
3562 	(*windowp)->wd_trim.tr_first_paddr = cookie->dmac_laddress + coffset;
3563 	(*windowp)->wd_trim.tr_first_size = trim_sz;
3564 
3565 	/*
3566 	 * again, we're tracking if the last cookie uses the copy buffer.
3567 	 * read the comment above for more info on why we need to track
3568 	 * additional state.
3569 	 *
3570 	 * For the first cookie in the new window, we need reset the physical
3571 	 * address to DMA into to the start of the copy buffer plus any
3572 	 * initial page offset which may be present.
3573 	 */
3574 	if (cookie->dmac_type & ROOTNEX_USES_COPYBUF) {
3575 		(*windowp)->wd_dosync = B_TRUE;
3576 		(*windowp)->wd_trim.tr_first_copybuf_win = B_TRUE;
3577 		(*windowp)->wd_trim.tr_first_pidx = pidx;
3578 		(*windowp)->wd_trim.tr_first_cbaddr = dma->dp_cbaddr;
3579 		poff = (*windowp)->wd_trim.tr_first_paddr & MMU_PAGEOFFSET;
3580 
3581 		paddr = pfn_to_pa(hat_getpfnum(kas.a_hat, dma->dp_cbaddr)) +
3582 		    poff;
3583 #ifdef __xpv
3584 		/*
3585 		 * If we're dom0, we're using a real device so we need to load
3586 		 * the cookies with MAs instead of PAs.
3587 		 */
3588 		(*windowp)->wd_trim.tr_first_paddr =
3589 		    ROOTNEX_PADDR_TO_RBASE(xen_info, paddr);
3590 #else
3591 		(*windowp)->wd_trim.tr_first_paddr = paddr;
3592 #endif
3593 
3594 #if !defined(__amd64)
3595 		(*windowp)->wd_trim.tr_first_kaddr = dma->dp_kva;
3596 #endif
3597 		/* account for the cookie copybuf usage in the new window */
3598 		*copybuf_used += MMU_PAGESIZE;
3599 
3600 		/*
3601 		 * every piece of code has to have a hack, and here is this
3602 		 * ones :-)
3603 		 *
3604 		 * There is a complex interaction between setup_cookie and the
3605 		 * copybuf window boundary. The complexity had to be in either
3606 		 * the maxxfer window, or the copybuf window, and I chose the
3607 		 * copybuf code.
3608 		 *
3609 		 * So in this code path, we have taken the last cookie,
3610 		 * virtually broken it in half due to the trim, and it happens
3611 		 * to use the copybuf which further complicates life. At the
3612 		 * same time, we have already setup the current cookie, which
3613 		 * is now wrong. More background info: the current cookie uses
3614 		 * the copybuf, so it is only a page long max. So we need to
3615 		 * fix the current cookies copy buffer address, physical
3616 		 * address, and kva for the 32-bit kernel. We due this by
3617 		 * bumping them by page size (of course, we can't due this on
3618 		 * the physical address since the copy buffer may not be
3619 		 * physically contiguous).
3620 		 */
3621 		cookie++;
3622 		dma->dp_pgmap[pidx + 1].pm_cbaddr += MMU_PAGESIZE;
3623 		poff = cookie->dmac_laddress & MMU_PAGEOFFSET;
3624 
3625 		paddr = pfn_to_pa(hat_getpfnum(kas.a_hat,
3626 		    dma->dp_pgmap[pidx + 1].pm_cbaddr)) + poff;
3627 #ifdef __xpv
3628 		/*
3629 		 * If we're dom0, we're using a real device so we need to load
3630 		 * the cookies with MAs instead of PAs.
3631 		 */
3632 		cookie->dmac_laddress = ROOTNEX_PADDR_TO_RBASE(xen_info, paddr);
3633 #else
3634 		cookie->dmac_laddress = paddr;
3635 #endif
3636 
3637 #if !defined(__amd64)
3638 		ASSERT(dma->dp_pgmap[pidx + 1].pm_mapped == B_FALSE);
3639 		dma->dp_pgmap[pidx + 1].pm_kaddr += MMU_PAGESIZE;
3640 #endif
3641 	} else {
3642 		/* go back to the current cookie */
3643 		cookie++;
3644 	}
3645 
3646 	/*
3647 	 * add the current cookie to the new window. set the new window size to
3648 	 * the what was left over from the previous cookie and what's in the
3649 	 * current cookie.
3650 	 */
3651 	(*windowp)->wd_cookie_cnt++;
3652 	(*windowp)->wd_size = trim_sz + cookie->dmac_size;
3653 	ASSERT((*windowp)->wd_size < dma->dp_maxxfer);
3654 
3655 	/*
3656 	 * we know that the cookie passed in always uses the copy buffer. We
3657 	 * wouldn't be here if it didn't.
3658 	 */
3659 	*copybuf_used += MMU_PAGESIZE;
3660 
3661 	return (DDI_SUCCESS);
3662 }
3663 
3664 
3665 /*
3666  * rootnex_maxxfer_window_boundary()
3667  *    Called in bind slowpath when we get to a window boundary because we will
3668  *    go over maxxfer.
3669  */
3670 static int
3671 rootnex_maxxfer_window_boundary(ddi_dma_impl_t *hp, rootnex_dma_t *dma,
3672     rootnex_window_t **windowp, ddi_dma_cookie_t *cookie)
3673 {
3674 	size_t dmac_size;
3675 	off_t new_offset;
3676 	size_t trim_sz;
3677 	off_t coffset;
3678 
3679 
3680 	/*
3681 	 * calculate how much we have to trim off of the current cookie to equal
3682 	 * maxxfer. We don't have to account for granularity here since our
3683 	 * maxxfer already takes that into account.
3684 	 */
3685 	trim_sz = ((*windowp)->wd_size + cookie->dmac_size) - dma->dp_maxxfer;
3686 	ASSERT(trim_sz <= cookie->dmac_size);
3687 	ASSERT(trim_sz <= dma->dp_maxxfer);
3688 
3689 	/* save cookie size since we need it later and we might change it */
3690 	dmac_size = cookie->dmac_size;
3691 
3692 	/*
3693 	 * if we're not trimming the entire cookie, setup the current window to
3694 	 * account for the trim.
3695 	 */
3696 	if (trim_sz < cookie->dmac_size) {
3697 		(*windowp)->wd_cookie_cnt++;
3698 		(*windowp)->wd_trim.tr_trim_last = B_TRUE;
3699 		(*windowp)->wd_trim.tr_last_cookie = cookie;
3700 		(*windowp)->wd_trim.tr_last_paddr = cookie->dmac_laddress;
3701 		(*windowp)->wd_trim.tr_last_size = cookie->dmac_size - trim_sz;
3702 		(*windowp)->wd_size = dma->dp_maxxfer;
3703 
3704 		/*
3705 		 * set the adjusted cookie size now in case this is the first
3706 		 * window. All other windows are taken care of in get win
3707 		 */
3708 		cookie->dmac_size = (*windowp)->wd_trim.tr_last_size;
3709 	}
3710 
3711 	/*
3712 	 * coffset is the current offset within the cookie, new_offset is the
3713 	 * current offset with the entire buffer.
3714 	 */
3715 	coffset = dmac_size - trim_sz;
3716 	new_offset = (*windowp)->wd_offset + (*windowp)->wd_size;
3717 
3718 	/* initialize the next window */
3719 	(*windowp)++;
3720 	rootnex_init_win(hp, dma, *windowp, cookie, new_offset);
3721 	(*windowp)->wd_cookie_cnt++;
3722 	(*windowp)->wd_size = trim_sz;
3723 	if (trim_sz < dmac_size) {
3724 		(*windowp)->wd_trim.tr_trim_first = B_TRUE;
3725 		(*windowp)->wd_trim.tr_first_paddr = cookie->dmac_laddress +
3726 		    coffset;
3727 		(*windowp)->wd_trim.tr_first_size = trim_sz;
3728 	}
3729 
3730 	return (DDI_SUCCESS);
3731 }
3732 
3733 
3734 /*
3735  * rootnex_dma_sync()
3736  *    called from ddi_dma_sync() if DMP_NOSYNC is not set in hp->dmai_rflags.
3737  *    We set DMP_NOSYNC if we're not using the copy buffer. If DMP_NOSYNC
3738  *    is set, ddi_dma_sync() returns immediately passing back success.
3739  */
3740 /*ARGSUSED*/
3741 static int
3742 rootnex_dma_sync(dev_info_t *dip, dev_info_t *rdip, ddi_dma_handle_t handle,
3743     off_t off, size_t len, uint_t cache_flags)
3744 {
3745 	rootnex_sglinfo_t *sinfo;
3746 	rootnex_pgmap_t *cbpage;
3747 	rootnex_window_t *win;
3748 	ddi_dma_impl_t *hp;
3749 	rootnex_dma_t *dma;
3750 	caddr_t fromaddr;
3751 	caddr_t toaddr;
3752 	uint_t psize;
3753 	off_t offset;
3754 	uint_t pidx;
3755 	size_t size;
3756 	off_t poff;
3757 	int e;
3758 
3759 
3760 	hp = (ddi_dma_impl_t *)handle;
3761 	dma = (rootnex_dma_t *)hp->dmai_private;
3762 	sinfo = &dma->dp_sglinfo;
3763 
3764 	/*
3765 	 * if we don't have any windows, we don't need to sync. A copybuf
3766 	 * will cause us to have at least one window.
3767 	 */
3768 	if (dma->dp_window == NULL) {
3769 		return (DDI_SUCCESS);
3770 	}
3771 
3772 	/* This window may not need to be sync'd */
3773 	win = &dma->dp_window[dma->dp_current_win];
3774 	if (!win->wd_dosync) {
3775 		return (DDI_SUCCESS);
3776 	}
3777 
3778 	/* handle off and len special cases */
3779 	if ((off == 0) || (rootnex_sync_ignore_params)) {
3780 		offset = win->wd_offset;
3781 	} else {
3782 		offset = off;
3783 	}
3784 	if ((len == 0) || (rootnex_sync_ignore_params)) {
3785 		size = win->wd_size;
3786 	} else {
3787 		size = len;
3788 	}
3789 
3790 	/* check the sync args to make sure they make a little sense */
3791 	if (rootnex_sync_check_parms) {
3792 		e = rootnex_valid_sync_parms(hp, win, offset, size,
3793 		    cache_flags);
3794 		if (e != DDI_SUCCESS) {
3795 			ROOTNEX_PROF_INC(&rootnex_cnt[ROOTNEX_CNT_SYNC_FAIL]);
3796 			return (DDI_FAILURE);
3797 		}
3798 	}
3799 
3800 	/*
3801 	 * special case the first page to handle the offset into the page. The
3802 	 * offset to the current page for our buffer is the offset into the
3803 	 * first page of the buffer plus our current offset into the buffer
3804 	 * itself, masked of course.
3805 	 */
3806 	poff = (sinfo->si_buf_offset + offset) & MMU_PAGEOFFSET;
3807 	psize = MIN((MMU_PAGESIZE - poff), size);
3808 
3809 	/* go through all the pages that we want to sync */
3810 	while (size > 0) {
3811 		/*
3812 		 * Calculate the page index relative to the start of the buffer.
3813 		 * The index to the current page for our buffer is the offset
3814 		 * into the first page of the buffer plus our current offset
3815 		 * into the buffer itself, shifted of course...
3816 		 */
3817 		pidx = (sinfo->si_buf_offset + offset) >> MMU_PAGESHIFT;
3818 		ASSERT(pidx < sinfo->si_max_pages);
3819 
3820 		/*
3821 		 * if this page uses the copy buffer, we need to sync it,
3822 		 * otherwise, go on to the next page.
3823 		 */
3824 		cbpage = &dma->dp_pgmap[pidx];
3825 		ASSERT((cbpage->pm_uses_copybuf == B_TRUE) ||
3826 		    (cbpage->pm_uses_copybuf == B_FALSE));
3827 		if (cbpage->pm_uses_copybuf) {
3828 			/* cbaddr and kaddr should be page aligned */
3829 			ASSERT(((uintptr_t)cbpage->pm_cbaddr &
3830 			    MMU_PAGEOFFSET) == 0);
3831 			ASSERT(((uintptr_t)cbpage->pm_kaddr &
3832 			    MMU_PAGEOFFSET) == 0);
3833 
3834 			/*
3835 			 * if we're copying for the device, we are going to
3836 			 * copy from the drivers buffer and to the rootnex
3837 			 * allocated copy buffer.
3838 			 */
3839 			if (cache_flags == DDI_DMA_SYNC_FORDEV) {
3840 				fromaddr = cbpage->pm_kaddr + poff;
3841 				toaddr = cbpage->pm_cbaddr + poff;
3842 				DTRACE_PROBE2(rootnex__sync__dev,
3843 				    dev_info_t *, dma->dp_dip, size_t, psize);
3844 
3845 			/*
3846 			 * if we're copying for the cpu/kernel, we are going to
3847 			 * copy from the rootnex allocated copy buffer to the
3848 			 * drivers buffer.
3849 			 */
3850 			} else {
3851 				fromaddr = cbpage->pm_cbaddr + poff;
3852 				toaddr = cbpage->pm_kaddr + poff;
3853 				DTRACE_PROBE2(rootnex__sync__cpu,
3854 				    dev_info_t *, dma->dp_dip, size_t, psize);
3855 			}
3856 
3857 			bcopy(fromaddr, toaddr, psize);
3858 		}
3859 
3860 		/*
3861 		 * decrement size until we're done, update our offset into the
3862 		 * buffer, and get the next page size.
3863 		 */
3864 		size -= psize;
3865 		offset += psize;
3866 		psize = MIN(MMU_PAGESIZE, size);
3867 
3868 		/* page offset is zero for the rest of this loop */
3869 		poff = 0;
3870 	}
3871 
3872 	return (DDI_SUCCESS);
3873 }
3874 
3875 
3876 /*
3877  * rootnex_valid_sync_parms()
3878  *    checks the parameters passed to sync to verify they are correct.
3879  */
3880 static int
3881 rootnex_valid_sync_parms(ddi_dma_impl_t *hp, rootnex_window_t *win,
3882     off_t offset, size_t size, uint_t cache_flags)
3883 {
3884 	off_t woffset;
3885 
3886 
3887 	/*
3888 	 * the first part of the test to make sure the offset passed in is
3889 	 * within the window.
3890 	 */
3891 	if (offset < win->wd_offset) {
3892 		return (DDI_FAILURE);
3893 	}
3894 
3895 	/*
3896 	 * second and last part of the test to make sure the offset and length
3897 	 * passed in is within the window.
3898 	 */
3899 	woffset = offset - win->wd_offset;
3900 	if ((woffset + size) > win->wd_size) {
3901 		return (DDI_FAILURE);
3902 	}
3903 
3904 	/*
3905 	 * if we are sync'ing for the device, the DDI_DMA_WRITE flag should
3906 	 * be set too.
3907 	 */
3908 	if ((cache_flags == DDI_DMA_SYNC_FORDEV) &&
3909 	    (hp->dmai_rflags & DDI_DMA_WRITE)) {
3910 		return (DDI_SUCCESS);
3911 	}
3912 
3913 	/*
3914 	 * at this point, either DDI_DMA_SYNC_FORCPU or DDI_DMA_SYNC_FORKERNEL
3915 	 * should be set. Also DDI_DMA_READ should be set in the flags.
3916 	 */
3917 	if (((cache_flags == DDI_DMA_SYNC_FORCPU) ||
3918 	    (cache_flags == DDI_DMA_SYNC_FORKERNEL)) &&
3919 	    (hp->dmai_rflags & DDI_DMA_READ)) {
3920 		return (DDI_SUCCESS);
3921 	}
3922 
3923 	return (DDI_FAILURE);
3924 }
3925 
3926 
3927 /*
3928  * rootnex_dma_win()
3929  *    called from ddi_dma_getwin()
3930  */
3931 /*ARGSUSED*/
3932 static int
3933 rootnex_dma_win(dev_info_t *dip, dev_info_t *rdip, ddi_dma_handle_t handle,
3934     uint_t win, off_t *offp, size_t *lenp, ddi_dma_cookie_t *cookiep,
3935     uint_t *ccountp)
3936 {
3937 	rootnex_window_t *window;
3938 	rootnex_trim_t *trim;
3939 	ddi_dma_impl_t *hp;
3940 	rootnex_dma_t *dma;
3941 #if !defined(__amd64)
3942 	rootnex_sglinfo_t *sinfo;
3943 	rootnex_pgmap_t *pmap;
3944 	uint_t pidx;
3945 	uint_t pcnt;
3946 	off_t poff;
3947 	int i;
3948 #endif
3949 
3950 
3951 	hp = (ddi_dma_impl_t *)handle;
3952 	dma = (rootnex_dma_t *)hp->dmai_private;
3953 #if !defined(__amd64)
3954 	sinfo = &dma->dp_sglinfo;
3955 #endif
3956 
3957 	/* If we try and get a window which doesn't exist, return failure */
3958 	if (win >= hp->dmai_nwin) {
3959 		ROOTNEX_PROF_INC(&rootnex_cnt[ROOTNEX_CNT_GETWIN_FAIL]);
3960 		return (DDI_FAILURE);
3961 	}
3962 
3963 	/*
3964 	 * if we don't have any windows, and they're asking for the first
3965 	 * window, setup the cookie pointer to the first cookie in the bind.
3966 	 * setup our return values, then increment the cookie since we return
3967 	 * the first cookie on the stack.
3968 	 */
3969 	if (dma->dp_window == NULL) {
3970 		if (win != 0) {
3971 			ROOTNEX_PROF_INC(&rootnex_cnt[ROOTNEX_CNT_GETWIN_FAIL]);
3972 			return (DDI_FAILURE);
3973 		}
3974 		hp->dmai_cookie = dma->dp_cookies;
3975 		*offp = 0;
3976 		*lenp = dma->dp_dma.dmao_size;
3977 		*ccountp = dma->dp_sglinfo.si_sgl_size;
3978 		*cookiep = hp->dmai_cookie[0];
3979 		hp->dmai_cookie++;
3980 		return (DDI_SUCCESS);
3981 	}
3982 
3983 	/* sync the old window before moving on to the new one */
3984 	window = &dma->dp_window[dma->dp_current_win];
3985 	if ((window->wd_dosync) && (hp->dmai_rflags & DDI_DMA_READ)) {
3986 		(void) rootnex_dma_sync(dip, rdip, handle, 0, 0,
3987 		    DDI_DMA_SYNC_FORCPU);
3988 	}
3989 
3990 #if !defined(__amd64)
3991 	/*
3992 	 * before we move to the next window, if we need to re-map, unmap all
3993 	 * the pages in this window.
3994 	 */
3995 	if (dma->dp_cb_remaping) {
3996 		/*
3997 		 * If we switch to this window again, we'll need to map in
3998 		 * on the fly next time.
3999 		 */
4000 		window->wd_remap_copybuf = B_TRUE;
4001 
4002 		/*
4003 		 * calculate the page index into the buffer where this window
4004 		 * starts, and the number of pages this window takes up.
4005 		 */
4006 		pidx = (sinfo->si_buf_offset + window->wd_offset) >>
4007 		    MMU_PAGESHIFT;
4008 		poff = (sinfo->si_buf_offset + window->wd_offset) &
4009 		    MMU_PAGEOFFSET;
4010 		pcnt = mmu_btopr(window->wd_size + poff);
4011 		ASSERT((pidx + pcnt) <= sinfo->si_max_pages);
4012 
4013 		/* unmap pages which are currently mapped in this window */
4014 		for (i = 0; i < pcnt; i++) {
4015 			if (dma->dp_pgmap[pidx].pm_mapped) {
4016 				hat_unload(kas.a_hat,
4017 				    dma->dp_pgmap[pidx].pm_kaddr, MMU_PAGESIZE,
4018 				    HAT_UNLOAD);
4019 				dma->dp_pgmap[pidx].pm_mapped = B_FALSE;
4020 			}
4021 			pidx++;
4022 		}
4023 	}
4024 #endif
4025 
4026 	/*
4027 	 * Move to the new window.
4028 	 * NOTE: current_win must be set for sync to work right
4029 	 */
4030 	dma->dp_current_win = win;
4031 	window = &dma->dp_window[win];
4032 
4033 	/* if needed, adjust the first and/or last cookies for trim */
4034 	trim = &window->wd_trim;
4035 	if (trim->tr_trim_first) {
4036 		window->wd_first_cookie->dmac_laddress = trim->tr_first_paddr;
4037 		window->wd_first_cookie->dmac_size = trim->tr_first_size;
4038 #if !defined(__amd64)
4039 		window->wd_first_cookie->dmac_type =
4040 		    (window->wd_first_cookie->dmac_type &
4041 		    ROOTNEX_USES_COPYBUF) + window->wd_offset;
4042 #endif
4043 		if (trim->tr_first_copybuf_win) {
4044 			dma->dp_pgmap[trim->tr_first_pidx].pm_cbaddr =
4045 			    trim->tr_first_cbaddr;
4046 #if !defined(__amd64)
4047 			dma->dp_pgmap[trim->tr_first_pidx].pm_kaddr =
4048 			    trim->tr_first_kaddr;
4049 #endif
4050 		}
4051 	}
4052 	if (trim->tr_trim_last) {
4053 		trim->tr_last_cookie->dmac_laddress = trim->tr_last_paddr;
4054 		trim->tr_last_cookie->dmac_size = trim->tr_last_size;
4055 		if (trim->tr_last_copybuf_win) {
4056 			dma->dp_pgmap[trim->tr_last_pidx].pm_cbaddr =
4057 			    trim->tr_last_cbaddr;
4058 #if !defined(__amd64)
4059 			dma->dp_pgmap[trim->tr_last_pidx].pm_kaddr =
4060 			    trim->tr_last_kaddr;
4061 #endif
4062 		}
4063 	}
4064 
4065 	/*
4066 	 * setup the cookie pointer to the first cookie in the window. setup
4067 	 * our return values, then increment the cookie since we return the
4068 	 * first cookie on the stack.
4069 	 */
4070 	hp->dmai_cookie = window->wd_first_cookie;
4071 	*offp = window->wd_offset;
4072 	*lenp = window->wd_size;
4073 	*ccountp = window->wd_cookie_cnt;
4074 	*cookiep = hp->dmai_cookie[0];
4075 	hp->dmai_cookie++;
4076 
4077 #if !defined(__amd64)
4078 	/* re-map copybuf if required for this window */
4079 	if (dma->dp_cb_remaping) {
4080 		/*
4081 		 * calculate the page index into the buffer where this
4082 		 * window starts.
4083 		 */
4084 		pidx = (sinfo->si_buf_offset + window->wd_offset) >>
4085 		    MMU_PAGESHIFT;
4086 		ASSERT(pidx < sinfo->si_max_pages);
4087 
4088 		/*
4089 		 * the first page can get unmapped if it's shared with the
4090 		 * previous window. Even if the rest of this window is already
4091 		 * mapped in, we need to still check this one.
4092 		 */
4093 		pmap = &dma->dp_pgmap[pidx];
4094 		if ((pmap->pm_uses_copybuf) && (pmap->pm_mapped == B_FALSE)) {
4095 			if (pmap->pm_pp != NULL) {
4096 				pmap->pm_mapped = B_TRUE;
4097 				i86_pp_map(pmap->pm_pp, pmap->pm_kaddr);
4098 			} else if (pmap->pm_vaddr != NULL) {
4099 				pmap->pm_mapped = B_TRUE;
4100 				i86_va_map(pmap->pm_vaddr, sinfo->si_asp,
4101 				    pmap->pm_kaddr);
4102 			}
4103 		}
4104 		pidx++;
4105 
4106 		/* map in the rest of the pages if required */
4107 		if (window->wd_remap_copybuf) {
4108 			window->wd_remap_copybuf = B_FALSE;
4109 
4110 			/* figure out many pages this window takes up */
4111 			poff = (sinfo->si_buf_offset + window->wd_offset) &
4112 			    MMU_PAGEOFFSET;
4113 			pcnt = mmu_btopr(window->wd_size + poff);
4114 			ASSERT(((pidx - 1) + pcnt) <= sinfo->si_max_pages);
4115 
4116 			/* map pages which require it */
4117 			for (i = 1; i < pcnt; i++) {
4118 				pmap = &dma->dp_pgmap[pidx];
4119 				if (pmap->pm_uses_copybuf) {
4120 					ASSERT(pmap->pm_mapped == B_FALSE);
4121 					if (pmap->pm_pp != NULL) {
4122 						pmap->pm_mapped = B_TRUE;
4123 						i86_pp_map(pmap->pm_pp,
4124 						    pmap->pm_kaddr);
4125 					} else if (pmap->pm_vaddr != NULL) {
4126 						pmap->pm_mapped = B_TRUE;
4127 						i86_va_map(pmap->pm_vaddr,
4128 						    sinfo->si_asp,
4129 						    pmap->pm_kaddr);
4130 					}
4131 				}
4132 				pidx++;
4133 			}
4134 		}
4135 	}
4136 #endif
4137 
4138 	/* if the new window uses the copy buffer, sync it for the device */
4139 	if ((window->wd_dosync) && (hp->dmai_rflags & DDI_DMA_WRITE)) {
4140 		(void) rootnex_dma_sync(dip, rdip, handle, 0, 0,
4141 		    DDI_DMA_SYNC_FORDEV);
4142 	}
4143 
4144 	return (DDI_SUCCESS);
4145 }
4146 
4147 
4148 
4149 /*
4150  * ************************
4151  *  obsoleted dma routines
4152  * ************************
4153  */
4154 
4155 /*
4156  * rootnex_dma_map()
4157  *    called from ddi_dma_setup()
4158  */
4159 /* ARGSUSED */
4160 static int
4161 rootnex_dma_map(dev_info_t *dip, dev_info_t *rdip, struct ddi_dma_req *dmareq,
4162     ddi_dma_handle_t *handlep)
4163 {
4164 #if defined(__amd64)
4165 	/*
4166 	 * this interface is not supported in 64-bit x86 kernel. See comment in
4167 	 * rootnex_dma_mctl()
4168 	 */
4169 	return (DDI_DMA_NORESOURCES);
4170 
4171 #else /* 32-bit x86 kernel */
4172 	ddi_dma_handle_t *lhandlep;
4173 	ddi_dma_handle_t lhandle;
4174 	ddi_dma_cookie_t cookie;
4175 	ddi_dma_attr_t dma_attr;
4176 	ddi_dma_lim_t *dma_lim;
4177 	uint_t ccnt;
4178 	int e;
4179 
4180 
4181 	/*
4182 	 * if the driver is just testing to see if it's possible to do the bind,
4183 	 * we'll use local state. Otherwise, use the handle pointer passed in.
4184 	 */
4185 	if (handlep == NULL) {
4186 		lhandlep = &lhandle;
4187 	} else {
4188 		lhandlep = handlep;
4189 	}
4190 
4191 	/* convert the limit structure to a dma_attr one */
4192 	dma_lim = dmareq->dmar_limits;
4193 	dma_attr.dma_attr_version = DMA_ATTR_V0;
4194 	dma_attr.dma_attr_addr_lo = dma_lim->dlim_addr_lo;
4195 	dma_attr.dma_attr_addr_hi = dma_lim->dlim_addr_hi;
4196 	dma_attr.dma_attr_minxfer = dma_lim->dlim_minxfer;
4197 	dma_attr.dma_attr_seg = dma_lim->dlim_adreg_max;
4198 	dma_attr.dma_attr_count_max = dma_lim->dlim_ctreg_max;
4199 	dma_attr.dma_attr_granular = dma_lim->dlim_granular;
4200 	dma_attr.dma_attr_sgllen = dma_lim->dlim_sgllen;
4201 	dma_attr.dma_attr_maxxfer = dma_lim->dlim_reqsize;
4202 	dma_attr.dma_attr_burstsizes = dma_lim->dlim_burstsizes;
4203 	dma_attr.dma_attr_align = MMU_PAGESIZE;
4204 	dma_attr.dma_attr_flags = 0;
4205 
4206 	e = rootnex_dma_allochdl(dip, rdip, &dma_attr, dmareq->dmar_fp,
4207 	    dmareq->dmar_arg, lhandlep);
4208 	if (e != DDI_SUCCESS) {
4209 		return (e);
4210 	}
4211 
4212 	e = rootnex_dma_bindhdl(dip, rdip, *lhandlep, dmareq, &cookie, &ccnt);
4213 	if ((e != DDI_DMA_MAPPED) && (e != DDI_DMA_PARTIAL_MAP)) {
4214 		(void) rootnex_dma_freehdl(dip, rdip, *lhandlep);
4215 		return (e);
4216 	}
4217 
4218 	/*
4219 	 * if the driver is just testing to see if it's possible to do the bind,
4220 	 * free up the local state and return the result.
4221 	 */
4222 	if (handlep == NULL) {
4223 		(void) rootnex_dma_unbindhdl(dip, rdip, *lhandlep);
4224 		(void) rootnex_dma_freehdl(dip, rdip, *lhandlep);
4225 		if (e == DDI_DMA_MAPPED) {
4226 			return (DDI_DMA_MAPOK);
4227 		} else {
4228 			return (DDI_DMA_NOMAPPING);
4229 		}
4230 	}
4231 
4232 	return (e);
4233 #endif /* defined(__amd64) */
4234 }
4235 
4236 
4237 /*
4238  * rootnex_dma_mctl()
4239  *
4240  */
4241 /* ARGSUSED */
4242 static int
4243 rootnex_dma_mctl(dev_info_t *dip, dev_info_t *rdip, ddi_dma_handle_t handle,
4244     enum ddi_dma_ctlops request, off_t *offp, size_t *lenp, caddr_t *objpp,
4245     uint_t cache_flags)
4246 {
4247 #if defined(__amd64)
4248 	/*
4249 	 * DDI_DMA_SMEM_ALLOC & DDI_DMA_IOPB_ALLOC we're changed to have a
4250 	 * common implementation in genunix, so they no longer have x86
4251 	 * specific functionality which called into dma_ctl.
4252 	 *
4253 	 * The rest of the obsoleted interfaces were never supported in the
4254 	 * 64-bit x86 kernel. For s10, the obsoleted DDI_DMA_SEGTOC interface
4255 	 * was not ported to the x86 64-bit kernel do to serious x86 rootnex
4256 	 * implementation issues.
4257 	 *
4258 	 * If you can't use DDI_DMA_SEGTOC; DDI_DMA_NEXTSEG, DDI_DMA_FREE, and
4259 	 * DDI_DMA_NEXTWIN are useless since you can get to the cookie, so we
4260 	 * reflect that now too...
4261 	 *
4262 	 * Even though we fixed the pointer problem in DDI_DMA_SEGTOC, we are
4263 	 * not going to put this functionality into the 64-bit x86 kernel now.
4264 	 * It wasn't ported to the 64-bit kernel for s10, no reason to change
4265 	 * that in a future release.
4266 	 */
4267 	return (DDI_FAILURE);
4268 
4269 #else /* 32-bit x86 kernel */
4270 	ddi_dma_cookie_t lcookie;
4271 	ddi_dma_cookie_t *cookie;
4272 	rootnex_window_t *window;
4273 	ddi_dma_impl_t *hp;
4274 	rootnex_dma_t *dma;
4275 	uint_t nwin;
4276 	uint_t ccnt;
4277 	size_t len;
4278 	off_t off;
4279 	int e;
4280 
4281 
4282 	/*
4283 	 * DDI_DMA_SEGTOC, DDI_DMA_NEXTSEG, and DDI_DMA_NEXTWIN are a little
4284 	 * hacky since were optimizing for the current interfaces and so we can
4285 	 * cleanup the mess in genunix. Hopefully we will remove the this
4286 	 * obsoleted routines someday soon.
4287 	 */
4288 
4289 	switch (request) {
4290 
4291 	case DDI_DMA_SEGTOC: /* ddi_dma_segtocookie() */
4292 		hp = (ddi_dma_impl_t *)handle;
4293 		cookie = (ddi_dma_cookie_t *)objpp;
4294 
4295 		/*
4296 		 * convert segment to cookie. We don't distinguish between the
4297 		 * two :-)
4298 		 */
4299 		*cookie = *hp->dmai_cookie;
4300 		*lenp = cookie->dmac_size;
4301 		*offp = cookie->dmac_type & ~ROOTNEX_USES_COPYBUF;
4302 		return (DDI_SUCCESS);
4303 
4304 	case DDI_DMA_NEXTSEG: /* ddi_dma_nextseg() */
4305 		hp = (ddi_dma_impl_t *)handle;
4306 		dma = (rootnex_dma_t *)hp->dmai_private;
4307 
4308 		if ((*lenp != NULL) && ((uintptr_t)*lenp != (uintptr_t)hp)) {
4309 			return (DDI_DMA_STALE);
4310 		}
4311 
4312 		/* handle the case where we don't have any windows */
4313 		if (dma->dp_window == NULL) {
4314 			/*
4315 			 * if seg == NULL, and we don't have any windows,
4316 			 * return the first cookie in the sgl.
4317 			 */
4318 			if (*lenp == NULL) {
4319 				dma->dp_current_cookie = 0;
4320 				hp->dmai_cookie = dma->dp_cookies;
4321 				*objpp = (caddr_t)handle;
4322 				return (DDI_SUCCESS);
4323 
4324 			/* if we have more cookies, go to the next cookie */
4325 			} else {
4326 				if ((dma->dp_current_cookie + 1) >=
4327 				    dma->dp_sglinfo.si_sgl_size) {
4328 					return (DDI_DMA_DONE);
4329 				}
4330 				dma->dp_current_cookie++;
4331 				hp->dmai_cookie++;
4332 				return (DDI_SUCCESS);
4333 			}
4334 		}
4335 
4336 		/* We have one or more windows */
4337 		window = &dma->dp_window[dma->dp_current_win];
4338 
4339 		/*
4340 		 * if seg == NULL, return the first cookie in the current
4341 		 * window
4342 		 */
4343 		if (*lenp == NULL) {
4344 			dma->dp_current_cookie = 0;
4345 			hp->dmai_cookie = window->wd_first_cookie;
4346 
4347 		/*
4348 		 * go to the next cookie in the window then see if we done with
4349 		 * this window.
4350 		 */
4351 		} else {
4352 			if ((dma->dp_current_cookie + 1) >=
4353 			    window->wd_cookie_cnt) {
4354 				return (DDI_DMA_DONE);
4355 			}
4356 			dma->dp_current_cookie++;
4357 			hp->dmai_cookie++;
4358 		}
4359 		*objpp = (caddr_t)handle;
4360 		return (DDI_SUCCESS);
4361 
4362 	case DDI_DMA_NEXTWIN: /* ddi_dma_nextwin() */
4363 		hp = (ddi_dma_impl_t *)handle;
4364 		dma = (rootnex_dma_t *)hp->dmai_private;
4365 
4366 		if ((*offp != NULL) && ((uintptr_t)*offp != (uintptr_t)hp)) {
4367 			return (DDI_DMA_STALE);
4368 		}
4369 
4370 		/* if win == NULL, return the first window in the bind */
4371 		if (*offp == NULL) {
4372 			nwin = 0;
4373 
4374 		/*
4375 		 * else, go to the next window then see if we're done with all
4376 		 * the windows.
4377 		 */
4378 		} else {
4379 			nwin = dma->dp_current_win + 1;
4380 			if (nwin >= hp->dmai_nwin) {
4381 				return (DDI_DMA_DONE);
4382 			}
4383 		}
4384 
4385 		/* switch to the next window */
4386 		e = rootnex_dma_win(dip, rdip, handle, nwin, &off, &len,
4387 		    &lcookie, &ccnt);
4388 		ASSERT(e == DDI_SUCCESS);
4389 		if (e != DDI_SUCCESS) {
4390 			return (DDI_DMA_STALE);
4391 		}
4392 
4393 		/* reset the cookie back to the first cookie in the window */
4394 		if (dma->dp_window != NULL) {
4395 			window = &dma->dp_window[dma->dp_current_win];
4396 			hp->dmai_cookie = window->wd_first_cookie;
4397 		} else {
4398 			hp->dmai_cookie = dma->dp_cookies;
4399 		}
4400 
4401 		*objpp = (caddr_t)handle;
4402 		return (DDI_SUCCESS);
4403 
4404 	case DDI_DMA_FREE: /* ddi_dma_free() */
4405 		(void) rootnex_dma_unbindhdl(dip, rdip, handle);
4406 		(void) rootnex_dma_freehdl(dip, rdip, handle);
4407 		if (rootnex_state->r_dvma_call_list_id) {
4408 			ddi_run_callback(&rootnex_state->r_dvma_call_list_id);
4409 		}
4410 		return (DDI_SUCCESS);
4411 
4412 	case DDI_DMA_IOPB_ALLOC:	/* get contiguous DMA-able memory */
4413 	case DDI_DMA_SMEM_ALLOC:	/* get contiguous DMA-able memory */
4414 		/* should never get here, handled in genunix */
4415 		ASSERT(0);
4416 		return (DDI_FAILURE);
4417 
4418 	case DDI_DMA_KVADDR:
4419 	case DDI_DMA_GETERR:
4420 	case DDI_DMA_COFF:
4421 		return (DDI_FAILURE);
4422 	}
4423 
4424 	return (DDI_FAILURE);
4425 #endif /* defined(__amd64) */
4426 }
4427 
4428 
4429 /*
4430  * *********
4431  *  FMA Code
4432  * *********
4433  */
4434 
4435 /*
4436  * rootnex_fm_init()
4437  *    FMA init busop
4438  */
4439 /* ARGSUSED */
4440 static int
4441 rootnex_fm_init(dev_info_t *dip, dev_info_t *tdip, int tcap,
4442     ddi_iblock_cookie_t *ibc)
4443 {
4444 	*ibc = rootnex_state->r_err_ibc;
4445 
4446 	return (ddi_system_fmcap);
4447 }
4448 
4449 /*
4450  * rootnex_dma_check()
4451  *    Function called after a dma fault occurred to find out whether the
4452  *    fault address is associated with a driver that is able to handle faults
4453  *    and recover from faults.
4454  */
4455 /* ARGSUSED */
4456 static int
4457 rootnex_dma_check(dev_info_t *dip, const void *handle, const void *addr,
4458     const void *not_used)
4459 {
4460 	rootnex_window_t *window;
4461 	uint64_t start_addr;
4462 	uint64_t fault_addr;
4463 	ddi_dma_impl_t *hp;
4464 	rootnex_dma_t *dma;
4465 	uint64_t end_addr;
4466 	size_t csize;
4467 	int i;
4468 	int j;
4469 
4470 
4471 	/* The driver has to set DDI_DMA_FLAGERR to recover from dma faults */
4472 	hp = (ddi_dma_impl_t *)handle;
4473 	ASSERT(hp);
4474 
4475 	dma = (rootnex_dma_t *)hp->dmai_private;
4476 
4477 	/* Get the address that we need to search for */
4478 	fault_addr = *(uint64_t *)addr;
4479 
4480 	/*
4481 	 * if we don't have any windows, we can just walk through all the
4482 	 * cookies.
4483 	 */
4484 	if (dma->dp_window == NULL) {
4485 		/* for each cookie */
4486 		for (i = 0; i < dma->dp_sglinfo.si_sgl_size; i++) {
4487 			/*
4488 			 * if the faulted address is within the physical address
4489 			 * range of the cookie, return DDI_FM_NONFATAL.
4490 			 */
4491 			if ((fault_addr >= dma->dp_cookies[i].dmac_laddress) &&
4492 			    (fault_addr <= (dma->dp_cookies[i].dmac_laddress +
4493 			    dma->dp_cookies[i].dmac_size))) {
4494 				return (DDI_FM_NONFATAL);
4495 			}
4496 		}
4497 
4498 		/* fault_addr not within this DMA handle */
4499 		return (DDI_FM_UNKNOWN);
4500 	}
4501 
4502 	/* we have mutiple windows, walk through each window */
4503 	for (i = 0; i < hp->dmai_nwin; i++) {
4504 		window = &dma->dp_window[i];
4505 
4506 		/* Go through all the cookies in the window */
4507 		for (j = 0; j < window->wd_cookie_cnt; j++) {
4508 
4509 			start_addr = window->wd_first_cookie[j].dmac_laddress;
4510 			csize = window->wd_first_cookie[j].dmac_size;
4511 
4512 			/*
4513 			 * if we are trimming the first cookie in the window,
4514 			 * and this is the first cookie, adjust the start
4515 			 * address and size of the cookie to account for the
4516 			 * trim.
4517 			 */
4518 			if (window->wd_trim.tr_trim_first && (j == 0)) {
4519 				start_addr = window->wd_trim.tr_first_paddr;
4520 				csize = window->wd_trim.tr_first_size;
4521 			}
4522 
4523 			/*
4524 			 * if we are trimming the last cookie in the window,
4525 			 * and this is the last cookie, adjust the start
4526 			 * address and size of the cookie to account for the
4527 			 * trim.
4528 			 */
4529 			if (window->wd_trim.tr_trim_last &&
4530 			    (j == (window->wd_cookie_cnt - 1))) {
4531 				start_addr = window->wd_trim.tr_last_paddr;
4532 				csize = window->wd_trim.tr_last_size;
4533 			}
4534 
4535 			end_addr = start_addr + csize;
4536 
4537 			/*
4538 			 * if the faulted address is within the physical address
4539 			 * range of the cookie, return DDI_FM_NONFATAL.
4540 			 */
4541 			if ((fault_addr >= start_addr) &&
4542 			    (fault_addr <= end_addr)) {
4543 				return (DDI_FM_NONFATAL);
4544 			}
4545 		}
4546 	}
4547 
4548 	/* fault_addr not within this DMA handle */
4549 	return (DDI_FM_UNKNOWN);
4550 }
4551