xref: /titanic_51/usr/src/uts/common/xen/io/xdf.c (revision 7bebe46c240b554f47faeed19186123896281967)
1 /*
2  * CDDL HEADER START
3  *
4  * The contents of this file are subject to the terms of the
5  * Common Development and Distribution License (the "License").
6  * You may not use this file except in compliance with the License.
7  *
8  * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
9  * or http://www.opensolaris.org/os/licensing.
10  * See the License for the specific language governing permissions
11  * and limitations under the License.
12  *
13  * When distributing Covered Code, include this CDDL HEADER in each
14  * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
15  * If applicable, add the following below this CDDL HEADER, with the
16  * fields enclosed by brackets "[]" replaced with your own identifying
17  * information: Portions Copyright [yyyy] [name of copyright owner]
18  *
19  * CDDL HEADER END
20  */
21 
22 /*
23  * Copyright 2008 Sun Microsystems, Inc.  All rights reserved.
24  * Use is subject to license terms.
25  */
26 
27 /*
28  * xdf.c - Xen Virtual Block Device Driver
29  * TODO:
30  *	- support alternate block size (currently only DEV_BSIZE supported)
31  *	- revalidate geometry for removable devices
32  */
33 
34 #pragma ident	"%Z%%M%	%I%	%E% SMI"
35 
36 #include <sys/ddi.h>
37 #include <sys/sunddi.h>
38 #include <sys/conf.h>
39 #include <sys/cmlb.h>
40 #include <sys/dkio.h>
41 #include <sys/promif.h>
42 #include <sys/sysmacros.h>
43 #include <sys/kstat.h>
44 #include <sys/mach_mmu.h>
45 #ifdef XPV_HVM_DRIVER
46 #include <sys/xpv_support.h>
47 #include <sys/sunndi.h>
48 #endif /* XPV_HVM_DRIVER */
49 #include <public/io/xenbus.h>
50 #include <xen/sys/xenbus_impl.h>
51 #include <xen/sys/xendev.h>
52 #include <sys/gnttab.h>
53 #include <sys/scsi/generic/inquiry.h>
54 #include <xen/io/blkif_impl.h>
55 #include <io/xdf.h>
56 
57 #define	FLUSH_DISKCACHE	0x1
58 #define	WRITE_BARRIER	0x2
59 #define	DEFAULT_FLUSH_BLOCK	156 /* block to write to cause a cache flush */
60 #define	USE_WRITE_BARRIER(vdp)				\
61 	((vdp)->xdf_feature_barrier && !(vdp)->xdf_flush_supported)
62 #define	USE_FLUSH_DISKCACHE(vdp)			\
63 	((vdp)->xdf_feature_barrier && (vdp)->xdf_flush_supported)
64 #define	IS_WRITE_BARRIER(vdp, bp)			\
65 	(!IS_READ(bp) && USE_WRITE_BARRIER(vdp) &&	\
66 	((bp)->b_un.b_addr == (vdp)->xdf_cache_flush_block))
67 #define	IS_FLUSH_DISKCACHE(bp)				\
68 	(!IS_READ(bp) && USE_FLUSH_DISKCACHE(vdp) && ((bp)->b_bcount == 0))
69 
70 static void *vbd_ss;
71 static kmem_cache_t *xdf_vreq_cache;
72 static kmem_cache_t *xdf_gs_cache;
73 static int xdf_maxphys = XB_MAXPHYS;
74 int xdfdebug = 0;
75 extern int do_polled_io;
76 diskaddr_t xdf_flush_block = DEFAULT_FLUSH_BLOCK;
77 int	xdf_barrier_flush_disable = 0;
78 
79 /*
80  * dev_ops and cb_ops entrypoints
81  */
82 static int xdf_getinfo(dev_info_t *, ddi_info_cmd_t, void *, void **);
83 static int xdf_attach(dev_info_t *, ddi_attach_cmd_t);
84 static int xdf_detach(dev_info_t *, ddi_detach_cmd_t);
85 static int xdf_reset(dev_info_t *, ddi_reset_cmd_t);
86 static int xdf_open(dev_t *, int, int, cred_t *);
87 static int xdf_close(dev_t, int, int, struct cred *);
88 static int xdf_strategy(struct buf *);
89 static int xdf_read(dev_t, struct uio *, cred_t *);
90 static int xdf_aread(dev_t, struct aio_req *, cred_t *);
91 static int xdf_write(dev_t, struct uio *, cred_t *);
92 static int xdf_awrite(dev_t, struct aio_req *, cred_t *);
93 static int xdf_dump(dev_t, caddr_t, daddr_t, int);
94 static int xdf_ioctl(dev_t, int, intptr_t, int, cred_t *, int *);
95 static uint_t xdf_intr(caddr_t);
96 static int xdf_prop_op(dev_t, dev_info_t *, ddi_prop_op_t, int, char *,
97     caddr_t, int *);
98 
99 /*
100  * misc private functions
101  */
102 static int xdf_suspend(dev_info_t *);
103 static int xdf_resume(dev_info_t *);
104 static int xdf_start_connect(xdf_t *);
105 static int xdf_start_disconnect(xdf_t *);
106 static int xdf_post_connect(xdf_t *);
107 static void xdf_post_disconnect(xdf_t *);
108 static void xdf_oe_change(dev_info_t *, ddi_eventcookie_t, void *, void *);
109 static void xdf_iostart(xdf_t *);
110 static void xdf_iofini(xdf_t *, uint64_t, int);
111 static int xdf_prepare_rreq(xdf_t *, struct buf *, blkif_request_t *);
112 static int xdf_drain_io(xdf_t *);
113 static boolean_t xdf_isopen(xdf_t *, int);
114 static int xdf_check_state_transition(xdf_t *, XenbusState);
115 static int xdf_connect(xdf_t *, boolean_t);
116 static int xdf_dmacallback(caddr_t);
117 static void xdf_timeout_handler(void *);
118 static uint_t xdf_iorestart(caddr_t);
119 static v_req_t *vreq_get(xdf_t *, buf_t *);
120 static void vreq_free(xdf_t *, v_req_t *);
121 static int vreq_setup(xdf_t *, v_req_t *);
122 static ge_slot_t *gs_get(xdf_t *, int);
123 static void gs_free(xdf_t *, ge_slot_t *);
124 static grant_ref_t gs_grant(ge_slot_t *, mfn_t);
125 static void unexpectedie(xdf_t *);
126 static void xdfmin(struct buf *);
127 static void xdf_synthetic_pgeom(dev_info_t *, cmlb_geom_t *);
128 extern int xdf_kstat_create(dev_info_t *, char *, int);
129 extern void xdf_kstat_delete(dev_info_t *);
130 
131 #if defined(XPV_HVM_DRIVER)
132 static void xdf_hvm_add(dev_info_t *);
133 static void xdf_hvm_rm(dev_info_t *);
134 static void xdf_hvm_init(void);
135 static void xdf_hvm_fini(void);
136 #endif /* XPV_HVM_DRIVER */
137 
138 static 	struct cb_ops xdf_cbops = {
139 	xdf_open,
140 	xdf_close,
141 	xdf_strategy,
142 	nodev,
143 	xdf_dump,
144 	xdf_read,
145 	xdf_write,
146 	xdf_ioctl,
147 	nodev,
148 	nodev,
149 	nodev,
150 	nochpoll,
151 	xdf_prop_op,
152 	NULL,
153 	D_MP | D_NEW | D_64BIT,
154 	CB_REV,
155 	xdf_aread,
156 	xdf_awrite
157 };
158 
159 struct dev_ops xdf_devops = {
160 	DEVO_REV,		/* devo_rev */
161 	0,			/* devo_refcnt */
162 	xdf_getinfo,		/* devo_getinfo */
163 	nulldev,		/* devo_identify */
164 	nulldev,		/* devo_probe */
165 	xdf_attach,		/* devo_attach */
166 	xdf_detach,		/* devo_detach */
167 	xdf_reset,		/* devo_reset */
168 	&xdf_cbops,		/* devo_cb_ops */
169 	(struct bus_ops *)NULL	/* devo_bus_ops */
170 };
171 
172 static struct modldrv modldrv = {
173 	&mod_driverops,		/* Type of module.  This one is a driver */
174 	"virtual block driver %I%",	/* short description */
175 	&xdf_devops		/* driver specific ops */
176 };
177 
178 static struct modlinkage xdf_modlinkage = {
179 	MODREV_1, (void *)&modldrv, NULL
180 };
181 
182 /*
183  * I/O buffer DMA attributes
184  * Make sure: one DMA window contains BLKIF_MAX_SEGMENTS_PER_REQUEST at most
185  */
186 static ddi_dma_attr_t xb_dma_attr = {
187 	DMA_ATTR_V0,
188 	(uint64_t)0,			/* lowest address */
189 	(uint64_t)0xffffffffffffffff,	/* highest usable address */
190 	(uint64_t)0xffffff,		/* DMA counter limit max */
191 	(uint64_t)XB_BSIZE,		/* alignment in bytes */
192 	XB_BSIZE - 1,			/* bitmap of burst sizes */
193 	XB_BSIZE,			/* min transfer */
194 	(uint64_t)XB_MAX_XFER, 		/* maximum transfer */
195 	(uint64_t)PAGEOFFSET,		/* 1 page segment length  */
196 	BLKIF_MAX_SEGMENTS_PER_REQUEST,	/* maximum number of segments */
197 	XB_BSIZE,			/* granularity */
198 	0,				/* flags (reserved) */
199 };
200 
201 static ddi_device_acc_attr_t xc_acc_attr = {
202 	DDI_DEVICE_ATTR_V0,
203 	DDI_NEVERSWAP_ACC,
204 	DDI_STRICTORDER_ACC
205 };
206 
207 /* callbacks from commmon label */
208 
209 int xdf_lb_rdwr(dev_info_t *, uchar_t, void *, diskaddr_t, size_t, void *);
210 int xdf_lb_getinfo(dev_info_t *, int, void *, void *);
211 
212 static cmlb_tg_ops_t xdf_lb_ops = {
213 	TG_DK_OPS_VERSION_1,
214 	xdf_lb_rdwr,
215 	xdf_lb_getinfo
216 };
217 
218 int
219 _init(void)
220 {
221 	int rc;
222 
223 	if ((rc = ddi_soft_state_init(&vbd_ss, sizeof (xdf_t), 0)) != 0)
224 		return (rc);
225 
226 	xdf_vreq_cache = kmem_cache_create("xdf_vreq_cache",
227 	    sizeof (v_req_t), 0, NULL, NULL, NULL, NULL, NULL, 0);
228 	xdf_gs_cache = kmem_cache_create("xdf_gs_cache",
229 	    sizeof (ge_slot_t), 0, NULL, NULL, NULL, NULL, NULL, 0);
230 
231 #if defined(XPV_HVM_DRIVER)
232 	xdf_hvm_init();
233 #endif /* XPV_HVM_DRIVER */
234 
235 	if ((rc = mod_install(&xdf_modlinkage)) != 0) {
236 #if defined(XPV_HVM_DRIVER)
237 		xdf_hvm_fini();
238 #endif /* XPV_HVM_DRIVER */
239 		kmem_cache_destroy(xdf_vreq_cache);
240 		kmem_cache_destroy(xdf_gs_cache);
241 		ddi_soft_state_fini(&vbd_ss);
242 		return (rc);
243 	}
244 
245 	return (rc);
246 }
247 
248 int
249 _fini(void)
250 {
251 
252 	int err;
253 	if ((err = mod_remove(&xdf_modlinkage)) != 0)
254 		return (err);
255 
256 #if defined(XPV_HVM_DRIVER)
257 	xdf_hvm_fini();
258 #endif /* XPV_HVM_DRIVER */
259 
260 	kmem_cache_destroy(xdf_vreq_cache);
261 	kmem_cache_destroy(xdf_gs_cache);
262 	ddi_soft_state_fini(&vbd_ss);
263 
264 	return (0);
265 }
266 
267 int
268 _info(struct modinfo *modinfop)
269 {
270 	return (mod_info(&xdf_modlinkage, modinfop));
271 }
272 
273 /*ARGSUSED*/
274 static int
275 xdf_getinfo(dev_info_t *dip, ddi_info_cmd_t cmd, void *arg, void **rp)
276 {
277 	int instance;
278 	xdf_t *vbdp;
279 
280 	instance = XDF_INST(getminor((dev_t)arg));
281 
282 	switch (cmd) {
283 	case DDI_INFO_DEVT2DEVINFO:
284 		if ((vbdp = ddi_get_soft_state(vbd_ss, instance)) == NULL) {
285 			*rp = NULL;
286 			return (DDI_FAILURE);
287 		}
288 		*rp = vbdp->xdf_dip;
289 		return (DDI_SUCCESS);
290 
291 	case DDI_INFO_DEVT2INSTANCE:
292 		*rp = (void *)(uintptr_t)instance;
293 		return (DDI_SUCCESS);
294 
295 	default:
296 		return (DDI_FAILURE);
297 	}
298 }
299 
300 static int
301 xdf_prop_op(dev_t dev, dev_info_t *dip, ddi_prop_op_t prop_op, int mod_flags,
302 	char *name, caddr_t valuep, int *lengthp)
303 {
304 	int instance = ddi_get_instance(dip);
305 	xdf_t *vdp;
306 	diskaddr_t p_blkcnt;
307 
308 	/*
309 	 * xdf dynamic properties are device specific and size oriented.
310 	 * Requests issued under conditions where size is valid are passed
311 	 * to ddi_prop_op_nblocks with the size information, otherwise the
312 	 * request is passed to ddi_prop_op.
313 	 */
314 	vdp = ddi_get_soft_state(vbd_ss, instance);
315 
316 	if ((dev == DDI_DEV_T_ANY) || (vdp == NULL))
317 		return (ddi_prop_op(dev, dip, prop_op, mod_flags,
318 		    name, valuep, lengthp));
319 
320 	/* do cv_wait until connected or failed */
321 	mutex_enter(&vdp->xdf_dev_lk);
322 	if (xdf_connect(vdp, B_TRUE) != XD_READY) {
323 		mutex_exit(&vdp->xdf_dev_lk);
324 		goto out;
325 	}
326 	mutex_exit(&vdp->xdf_dev_lk);
327 
328 	if (cmlb_partinfo(vdp->xdf_vd_lbl, XDF_PART(getminor(dev)), &p_blkcnt,
329 	    NULL, NULL, NULL, NULL) == 0)
330 		return (ddi_prop_op_nblocks(dev, dip, prop_op, mod_flags,
331 		    name, valuep, lengthp, (uint64_t)p_blkcnt));
332 
333 out:
334 	return (ddi_prop_op(dev, dip, prop_op, mod_flags, name, valuep,
335 	    lengthp));
336 }
337 
338 static int
339 xdf_attach(dev_info_t *devi, ddi_attach_cmd_t cmd)
340 {
341 	xdf_t *vdp;
342 	ddi_iblock_cookie_t softibc;
343 	int instance;
344 
345 	xdfdebug = ddi_prop_get_int(DDI_DEV_T_ANY, devi, DDI_PROP_NOTPROM,
346 	    "xdfdebug", 0);
347 
348 	switch (cmd) {
349 		case DDI_ATTACH:
350 			break;
351 
352 		case DDI_RESUME:
353 			return (xdf_resume(devi));
354 
355 		default:
356 			return (DDI_FAILURE);
357 	}
358 
359 	instance = ddi_get_instance(devi);
360 	if (ddi_soft_state_zalloc(vbd_ss, instance) != DDI_SUCCESS)
361 		return (DDI_FAILURE);
362 
363 	DPRINTF(DDI_DBG, ("xdf%d: attaching\n", instance));
364 	vdp = ddi_get_soft_state(vbd_ss, instance);
365 	ddi_set_driver_private(devi, vdp);
366 	vdp->xdf_dip = devi;
367 	cv_init(&vdp->xdf_dev_cv, NULL, CV_DEFAULT, NULL);
368 
369 	if (ddi_get_iblock_cookie(devi, 0, &vdp->xdf_ibc) != DDI_SUCCESS) {
370 		cmn_err(CE_WARN, "xdf@%s: failed to get iblock cookie",
371 		    ddi_get_name_addr(devi));
372 		goto errout0;
373 	}
374 	mutex_init(&vdp->xdf_dev_lk, NULL, MUTEX_DRIVER, (void *)vdp->xdf_ibc);
375 	mutex_init(&vdp->xdf_cb_lk, NULL, MUTEX_DRIVER, (void *)vdp->xdf_ibc);
376 	mutex_init(&vdp->xdf_iostat_lk, NULL, MUTEX_DRIVER,
377 	    (void *)vdp->xdf_ibc);
378 
379 	if (ddi_get_soft_iblock_cookie(devi, DDI_SOFTINT_LOW, &softibc)
380 	    != DDI_SUCCESS) {
381 		cmn_err(CE_WARN, "xdf@%s: failed to get softintr iblock cookie",
382 		    ddi_get_name_addr(devi));
383 		goto errout0;
384 	}
385 	if (ddi_add_softintr(devi, DDI_SOFTINT_LOW, &vdp->xdf_softintr_id,
386 	    &softibc, NULL, xdf_iorestart, (caddr_t)vdp) != DDI_SUCCESS) {
387 		cmn_err(CE_WARN, "xdf@%s: failed to add softintr",
388 		    ddi_get_name_addr(devi));
389 		goto errout0;
390 	}
391 
392 #if !defined(XPV_HVM_DRIVER)
393 	/* create kstat for iostat(1M) */
394 	if (xdf_kstat_create(devi, "xdf", instance) != 0) {
395 		cmn_err(CE_WARN, "xdf@%s: failed to create kstat",
396 		    ddi_get_name_addr(devi));
397 		goto errout0;
398 	}
399 #endif /* !XPV_HVM_DRIVER */
400 
401 	/* driver handles kernel-issued IOCTLs */
402 	if (ddi_prop_create(DDI_DEV_T_NONE, devi, DDI_PROP_CANSLEEP,
403 	    DDI_KERNEL_IOCTL, NULL, 0) != DDI_PROP_SUCCESS) {
404 		cmn_err(CE_WARN, "xdf@%s: cannot create DDI_KERNEL_IOCTL prop",
405 		    ddi_get_name_addr(devi));
406 		goto errout0;
407 	}
408 
409 	/*
410 	 * Initialize the physical geometry stucture.  Note that currently
411 	 * we don't know the size of the backend device so the number
412 	 * of blocks on the device will be initialized to zero.  Once
413 	 * we connect to the backend device we'll update the physical
414 	 * geometry to reflect the real size of the device.
415 	 */
416 	xdf_synthetic_pgeom(devi, &vdp->xdf_pgeom);
417 
418 	/*
419 	 * create default device minor nodes: non-removable disk
420 	 * we will adjust minor nodes after we are connected w/ backend
421 	 */
422 	cmlb_alloc_handle(&vdp->xdf_vd_lbl);
423 	if (cmlb_attach(devi, &xdf_lb_ops, DTYPE_DIRECT, 0, 1, DDI_NT_BLOCK,
424 #if defined(XPV_HVM_DRIVER)
425 	    CMLB_CREATE_ALTSLICE_VTOC_16_DTYPE_DIRECT |
426 	    CMLB_INTERNAL_MINOR_NODES,
427 #else /* !XPV_HVM_DRIVER */
428 	    CMLB_FAKE_LABEL_ONE_PARTITION,
429 #endif /* !XPV_HVM_DRIVER */
430 	    vdp->xdf_vd_lbl, NULL) != 0) {
431 		cmn_err(CE_WARN, "xdf@%s: default cmlb attach failed",
432 		    ddi_get_name_addr(devi));
433 		goto errout0;
434 	}
435 
436 	/*
437 	 * We ship with cache-enabled disks
438 	 */
439 	vdp->xdf_wce = 1;
440 
441 	mutex_enter(&vdp->xdf_cb_lk);
442 
443 	/* Watch backend XenbusState change */
444 	if (xvdi_add_event_handler(devi, XS_OE_STATE,
445 	    xdf_oe_change) != DDI_SUCCESS) {
446 		mutex_exit(&vdp->xdf_cb_lk);
447 		goto errout0;
448 	}
449 
450 	if (xdf_start_connect(vdp) != DDI_SUCCESS) {
451 		cmn_err(CE_WARN, "xdf@%s: start connection failed",
452 		    ddi_get_name_addr(devi));
453 		(void) xdf_start_disconnect(vdp);
454 		mutex_exit(&vdp->xdf_cb_lk);
455 		goto errout1;
456 	}
457 
458 	mutex_exit(&vdp->xdf_cb_lk);
459 
460 	list_create(&vdp->xdf_vreq_act, sizeof (v_req_t),
461 	    offsetof(v_req_t, v_link));
462 	list_create(&vdp->xdf_gs_act, sizeof (ge_slot_t),
463 	    offsetof(ge_slot_t, link));
464 
465 #if defined(XPV_HVM_DRIVER)
466 	xdf_hvm_add(devi);
467 
468 	(void) ddi_prop_update_int(DDI_DEV_T_NONE, devi, DDI_NO_AUTODETACH, 1);
469 #endif /* XPV_HVM_DRIVER */
470 
471 	ddi_report_dev(devi);
472 
473 	DPRINTF(DDI_DBG, ("xdf%d: attached\n", instance));
474 
475 	return (DDI_SUCCESS);
476 
477 errout1:
478 	xvdi_remove_event_handler(devi, XS_OE_STATE);
479 errout0:
480 	if (vdp->xdf_vd_lbl != NULL) {
481 		cmlb_detach(vdp->xdf_vd_lbl, NULL);
482 		cmlb_free_handle(&vdp->xdf_vd_lbl);
483 	}
484 #if !defined(XPV_HVM_DRIVER)
485 	xdf_kstat_delete(devi);
486 #endif /* !XPV_HVM_DRIVER */
487 	if (vdp->xdf_softintr_id != NULL)
488 		ddi_remove_softintr(vdp->xdf_softintr_id);
489 	if (vdp->xdf_ibc != NULL) {
490 		mutex_destroy(&vdp->xdf_cb_lk);
491 		mutex_destroy(&vdp->xdf_dev_lk);
492 	}
493 	cv_destroy(&vdp->xdf_dev_cv);
494 	ddi_soft_state_free(vbd_ss, instance);
495 	ddi_set_driver_private(devi, NULL);
496 	ddi_prop_remove_all(devi);
497 	cmn_err(CE_WARN, "xdf@%s: attach failed", ddi_get_name_addr(devi));
498 	return (DDI_FAILURE);
499 }
500 
501 static int
502 xdf_detach(dev_info_t *devi, ddi_detach_cmd_t cmd)
503 {
504 	xdf_t *vdp;
505 	int instance;
506 
507 	switch (cmd) {
508 
509 	case DDI_PM_SUSPEND:
510 		break;
511 
512 	case DDI_SUSPEND:
513 		return (xdf_suspend(devi));
514 
515 	case DDI_DETACH:
516 		break;
517 
518 	default:
519 		return (DDI_FAILURE);
520 	}
521 
522 	instance = ddi_get_instance(devi);
523 	DPRINTF(DDI_DBG, ("xdf%d: detaching\n", instance));
524 	vdp = ddi_get_soft_state(vbd_ss, instance);
525 
526 	if (vdp == NULL)
527 		return (DDI_FAILURE);
528 
529 	mutex_enter(&vdp->xdf_dev_lk);
530 	if (xdf_isopen(vdp, -1)) {
531 		mutex_exit(&vdp->xdf_dev_lk);
532 		return (DDI_FAILURE);
533 	}
534 
535 	if (vdp->xdf_status != XD_CLOSED) {
536 		mutex_exit(&vdp->xdf_dev_lk);
537 		return (DDI_FAILURE);
538 	}
539 
540 #if defined(XPV_HVM_DRIVER)
541 	xdf_hvm_rm(devi);
542 #endif /* XPV_HVM_DRIVER */
543 
544 	ASSERT(!ISDMACBON(vdp));
545 	mutex_exit(&vdp->xdf_dev_lk);
546 
547 	if (vdp->xdf_timeout_id != 0)
548 		(void) untimeout(vdp->xdf_timeout_id);
549 
550 	xvdi_remove_event_handler(devi, XS_OE_STATE);
551 
552 	/* we'll support backend running in domU later */
553 #ifdef	DOMU_BACKEND
554 	(void) xvdi_post_event(devi, XEN_HP_REMOVE);
555 #endif
556 
557 	list_destroy(&vdp->xdf_vreq_act);
558 	list_destroy(&vdp->xdf_gs_act);
559 	ddi_prop_remove_all(devi);
560 	xdf_kstat_delete(devi);
561 	ddi_remove_softintr(vdp->xdf_softintr_id);
562 	ddi_set_driver_private(devi, NULL);
563 	cv_destroy(&vdp->xdf_dev_cv);
564 	mutex_destroy(&vdp->xdf_cb_lk);
565 	mutex_destroy(&vdp->xdf_dev_lk);
566 	if (vdp->xdf_cache_flush_block != NULL)
567 		kmem_free(vdp->xdf_flush_mem, 2 * DEV_BSIZE);
568 	ddi_soft_state_free(vbd_ss, instance);
569 	return (DDI_SUCCESS);
570 }
571 
572 static int
573 xdf_suspend(dev_info_t *devi)
574 {
575 	xdf_t *vdp;
576 	int instance;
577 	enum xdf_state st;
578 
579 	instance = ddi_get_instance(devi);
580 
581 	if (xdfdebug & SUSRES_DBG)
582 		xen_printf("xdf_suspend: xdf#%d\n", instance);
583 
584 	if ((vdp = ddi_get_soft_state(vbd_ss, instance)) == NULL)
585 		return (DDI_FAILURE);
586 
587 	xvdi_suspend(devi);
588 
589 	mutex_enter(&vdp->xdf_cb_lk);
590 	mutex_enter(&vdp->xdf_dev_lk);
591 	st = vdp->xdf_status;
592 	/* change status to stop further I/O requests */
593 	if (st == XD_READY)
594 		vdp->xdf_status = XD_SUSPEND;
595 	mutex_exit(&vdp->xdf_dev_lk);
596 	mutex_exit(&vdp->xdf_cb_lk);
597 
598 	/* make sure no more I/O responses left in the ring buffer */
599 	if ((st == XD_INIT) || (st == XD_READY)) {
600 #ifdef XPV_HVM_DRIVER
601 		ec_unbind_evtchn(vdp->xdf_evtchn);
602 #else /* !XPV_HVM_DRIVER */
603 		(void) ddi_remove_intr(devi, 0, NULL);
604 #endif /* !XPV_HVM_DRIVER */
605 		(void) xdf_drain_io(vdp);
606 		/*
607 		 * no need to teardown the ring buffer here
608 		 * it will be simply re-init'ed during resume when
609 		 * we call xvdi_alloc_ring
610 		 */
611 	}
612 
613 	if (xdfdebug & SUSRES_DBG)
614 		xen_printf("xdf_suspend: SUCCESS\n");
615 
616 	return (DDI_SUCCESS);
617 }
618 
619 /*ARGSUSED*/
620 static int
621 xdf_resume(dev_info_t *devi)
622 {
623 	xdf_t *vdp;
624 	int instance;
625 
626 	instance = ddi_get_instance(devi);
627 	if (xdfdebug & SUSRES_DBG)
628 		xen_printf("xdf_resume: xdf%d\n", instance);
629 
630 	if ((vdp = ddi_get_soft_state(vbd_ss, instance)) == NULL)
631 		return (DDI_FAILURE);
632 
633 	mutex_enter(&vdp->xdf_cb_lk);
634 
635 	if (xvdi_resume(devi) != DDI_SUCCESS) {
636 		mutex_exit(&vdp->xdf_cb_lk);
637 		return (DDI_FAILURE);
638 	}
639 
640 	mutex_enter(&vdp->xdf_dev_lk);
641 	ASSERT(vdp->xdf_status != XD_READY);
642 	vdp->xdf_status = XD_UNKNOWN;
643 	mutex_exit(&vdp->xdf_dev_lk);
644 
645 	if (xdf_start_connect(vdp) != DDI_SUCCESS) {
646 		mutex_exit(&vdp->xdf_cb_lk);
647 		return (DDI_FAILURE);
648 	}
649 
650 	mutex_exit(&vdp->xdf_cb_lk);
651 
652 	if (xdfdebug & SUSRES_DBG)
653 		xen_printf("xdf_resume: done\n");
654 	return (DDI_SUCCESS);
655 }
656 
657 /*ARGSUSED*/
658 static int
659 xdf_reset(dev_info_t *devi, ddi_reset_cmd_t cmd)
660 {
661 	xdf_t *vdp;
662 	int instance;
663 
664 	instance = ddi_get_instance(devi);
665 	DPRINTF(DDI_DBG, ("xdf%d: resetting\n", instance));
666 	if ((vdp = ddi_get_soft_state(vbd_ss, instance)) == NULL)
667 		return (DDI_FAILURE);
668 
669 	/*
670 	 * wait for any outstanding I/O to complete
671 	 */
672 	(void) xdf_drain_io(vdp);
673 
674 	DPRINTF(DDI_DBG, ("xdf%d: reset complete\n", instance));
675 	return (DDI_SUCCESS);
676 }
677 
678 static int
679 xdf_open(dev_t *devp, int flag, int otyp, cred_t *credp)
680 {
681 	minor_t	minor;
682 	xdf_t	*vdp;
683 	int part;
684 	ulong_t parbit;
685 	diskaddr_t p_blkct = 0;
686 	boolean_t firstopen;
687 	boolean_t nodelay;
688 
689 	minor = getminor(*devp);
690 	if ((vdp = ddi_get_soft_state(vbd_ss, XDF_INST(minor))) == NULL)
691 		return (ENXIO);
692 
693 	nodelay = (flag & (FNDELAY | FNONBLOCK));
694 
695 	DPRINTF(DDI_DBG, ("xdf%d: opening\n", XDF_INST(minor)));
696 
697 	/* do cv_wait until connected or failed */
698 	mutex_enter(&vdp->xdf_dev_lk);
699 	if (!nodelay && (xdf_connect(vdp, B_TRUE) != XD_READY)) {
700 		mutex_exit(&vdp->xdf_dev_lk);
701 		return (ENXIO);
702 	}
703 
704 	if ((flag & FWRITE) && XD_IS_RO(vdp)) {
705 		mutex_exit(&vdp->xdf_dev_lk);
706 		return (EROFS);
707 	}
708 
709 	part = XDF_PART(minor);
710 	parbit = 1 << part;
711 	if ((vdp->xdf_vd_exclopen & parbit) ||
712 	    ((flag & FEXCL) && xdf_isopen(vdp, part))) {
713 		mutex_exit(&vdp->xdf_dev_lk);
714 		return (EBUSY);
715 	}
716 
717 	/* are we the first one to open this node? */
718 	firstopen = !xdf_isopen(vdp, -1);
719 
720 	if (otyp == OTYP_LYR)
721 		vdp->xdf_vd_lyropen[part]++;
722 
723 	vdp->xdf_vd_open[otyp] |= parbit;
724 
725 	if (flag & FEXCL)
726 		vdp->xdf_vd_exclopen |= parbit;
727 
728 	mutex_exit(&vdp->xdf_dev_lk);
729 
730 	/* force a re-validation */
731 	if (firstopen)
732 		cmlb_invalidate(vdp->xdf_vd_lbl, NULL);
733 
734 	/*
735 	 * check size
736 	 * ignore CD/DVD which contains a zero-sized s0
737 	 */
738 	if (!nodelay && !XD_IS_CD(vdp) &&
739 	    ((cmlb_partinfo(vdp->xdf_vd_lbl, part, &p_blkct,
740 	    NULL, NULL, NULL, NULL) != 0) || (p_blkct == 0))) {
741 		(void) xdf_close(*devp, flag, otyp, credp);
742 		return (ENXIO);
743 	}
744 
745 	return (0);
746 }
747 
748 /*ARGSUSED*/
749 static int
750 xdf_close(dev_t dev, int flag, int otyp, struct cred *credp)
751 {
752 	minor_t	minor;
753 	xdf_t	*vdp;
754 	int part;
755 	ulong_t parbit;
756 
757 	minor = getminor(dev);
758 	if ((vdp = ddi_get_soft_state(vbd_ss, XDF_INST(minor))) == NULL)
759 		return (ENXIO);
760 
761 	mutex_enter(&vdp->xdf_dev_lk);
762 	part = XDF_PART(minor);
763 	if (!xdf_isopen(vdp, part)) {
764 		mutex_exit(&vdp->xdf_dev_lk);
765 		return (ENXIO);
766 	}
767 	parbit = 1 << part;
768 
769 	ASSERT((vdp->xdf_vd_open[otyp] & parbit) != 0);
770 	if (otyp == OTYP_LYR) {
771 		ASSERT(vdp->xdf_vd_lyropen[part] > 0);
772 		if (--vdp->xdf_vd_lyropen[part] == 0)
773 			vdp->xdf_vd_open[otyp] &= ~parbit;
774 	} else {
775 		vdp->xdf_vd_open[otyp] &= ~parbit;
776 	}
777 	vdp->xdf_vd_exclopen &= ~parbit;
778 
779 	mutex_exit(&vdp->xdf_dev_lk);
780 	return (0);
781 }
782 
783 static int
784 xdf_strategy(struct buf *bp)
785 {
786 	xdf_t	*vdp;
787 	minor_t minor;
788 	diskaddr_t p_blkct, p_blkst;
789 	ulong_t nblks;
790 	int part;
791 
792 	minor = getminor(bp->b_edev);
793 	part = XDF_PART(minor);
794 
795 	vdp = ddi_get_soft_state(vbd_ss, XDF_INST(minor));
796 	if ((vdp == NULL) || !xdf_isopen(vdp, part)) {
797 		bioerror(bp, ENXIO);
798 		bp->b_resid = bp->b_bcount;
799 		biodone(bp);
800 		return (0);
801 	}
802 
803 	/* Check for writes to a read only device */
804 	if (!IS_READ(bp) && XD_IS_RO(vdp)) {
805 		bioerror(bp, EROFS);
806 		bp->b_resid = bp->b_bcount;
807 		biodone(bp);
808 		return (0);
809 	}
810 
811 	/* Check if this I/O is accessing a partition or the entire disk */
812 	if ((long)bp->b_private == XB_SLICE_NONE) {
813 		/* This I/O is using an absolute offset */
814 		p_blkct = vdp->xdf_xdev_nblocks;
815 		p_blkst = 0;
816 	} else {
817 		/* This I/O is using a partition relative offset */
818 		if (cmlb_partinfo(vdp->xdf_vd_lbl, part, &p_blkct,
819 		    &p_blkst, NULL, NULL, NULL)) {
820 			bioerror(bp, ENXIO);
821 			bp->b_resid = bp->b_bcount;
822 			biodone(bp);
823 			return (0);
824 		}
825 	}
826 
827 	/* check for a starting block beyond the disk or partition limit */
828 	if (bp->b_blkno > p_blkct) {
829 		DPRINTF(IO_DBG, ("xdf: block %lld exceeds VBD size %"PRIu64,
830 		    (longlong_t)bp->b_blkno, (uint64_t)p_blkct));
831 		bioerror(bp, EINVAL);
832 		bp->b_resid = bp->b_bcount;
833 		biodone(bp);
834 		return (0);
835 	}
836 
837 	/* Legacy: don't set error flag at this case */
838 	if (bp->b_blkno == p_blkct) {
839 		bp->b_resid = bp->b_bcount;
840 		biodone(bp);
841 		return (0);
842 	}
843 
844 	/* Adjust for partial transfer */
845 	nblks = bp->b_bcount >> XB_BSHIFT;
846 	if ((bp->b_blkno + nblks) > p_blkct) {
847 		bp->b_resid = ((bp->b_blkno + nblks) - p_blkct) << XB_BSHIFT;
848 		bp->b_bcount -= bp->b_resid;
849 	}
850 
851 	DPRINTF(IO_DBG, ("xdf: strategy blk %lld len %lu\n",
852 	    (longlong_t)bp->b_blkno, (ulong_t)bp->b_bcount));
853 
854 	/* Fix up the buf struct */
855 	bp->b_flags |= B_BUSY;
856 	bp->av_forw = bp->av_back = NULL; /* not tagged with a v_req */
857 	bp->b_private = (void *)(uintptr_t)p_blkst;
858 
859 	mutex_enter(&vdp->xdf_dev_lk);
860 	if (vdp->xdf_xdev_iostat != NULL)
861 		kstat_waitq_enter(KSTAT_IO_PTR(vdp->xdf_xdev_iostat));
862 	if (vdp->xdf_f_act == NULL) {
863 		vdp->xdf_f_act = vdp->xdf_l_act = bp;
864 	} else {
865 		vdp->xdf_l_act->av_forw = bp;
866 		vdp->xdf_l_act = bp;
867 	}
868 	mutex_exit(&vdp->xdf_dev_lk);
869 
870 	xdf_iostart(vdp);
871 	if (do_polled_io)
872 		(void) xdf_drain_io(vdp);
873 	return (0);
874 }
875 
876 /*ARGSUSED*/
877 static int
878 xdf_read(dev_t dev, struct uio *uiop, cred_t *credp)
879 {
880 
881 	xdf_t	*vdp;
882 	minor_t minor;
883 	diskaddr_t p_blkcnt;
884 	int part;
885 
886 	minor = getminor(dev);
887 	if ((vdp = ddi_get_soft_state(vbd_ss, XDF_INST(minor))) == NULL)
888 		return (ENXIO);
889 
890 	DPRINTF(IO_DBG, ("xdf: read offset 0x%"PRIx64"\n",
891 	    (int64_t)uiop->uio_offset));
892 
893 	part = XDF_PART(minor);
894 	if (!xdf_isopen(vdp, part))
895 		return (ENXIO);
896 
897 	if (cmlb_partinfo(vdp->xdf_vd_lbl, part, &p_blkcnt,
898 	    NULL, NULL, NULL, NULL))
899 		return (ENXIO);
900 
901 	if (U_INVAL(uiop))
902 		return (EINVAL);
903 
904 	return (physio(xdf_strategy, NULL, dev, B_READ, xdfmin, uiop));
905 }
906 
907 /*ARGSUSED*/
908 static int
909 xdf_write(dev_t dev, struct uio *uiop, cred_t *credp)
910 {
911 	xdf_t *vdp;
912 	minor_t minor;
913 	diskaddr_t p_blkcnt;
914 	int part;
915 
916 	minor = getminor(dev);
917 	if ((vdp = ddi_get_soft_state(vbd_ss, XDF_INST(minor))) == NULL)
918 		return (ENXIO);
919 
920 	DPRINTF(IO_DBG, ("xdf: write offset 0x%"PRIx64"\n",
921 	    (int64_t)uiop->uio_offset));
922 
923 	part = XDF_PART(minor);
924 	if (!xdf_isopen(vdp, part))
925 		return (ENXIO);
926 
927 	if (cmlb_partinfo(vdp->xdf_vd_lbl, part, &p_blkcnt,
928 	    NULL, NULL, NULL, NULL))
929 		return (ENXIO);
930 
931 	if (uiop->uio_loffset >= XB_DTOB(p_blkcnt))
932 		return (ENOSPC);
933 
934 	if (U_INVAL(uiop))
935 		return (EINVAL);
936 
937 	return (physio(xdf_strategy, NULL, dev, B_WRITE, minphys, uiop));
938 }
939 
940 /*ARGSUSED*/
941 static int
942 xdf_aread(dev_t dev, struct aio_req *aiop, cred_t *credp)
943 {
944 	xdf_t	*vdp;
945 	minor_t minor;
946 	struct uio *uiop = aiop->aio_uio;
947 	diskaddr_t p_blkcnt;
948 	int part;
949 
950 	minor = getminor(dev);
951 	if ((vdp = ddi_get_soft_state(vbd_ss, XDF_INST(minor))) == NULL)
952 		return (ENXIO);
953 
954 	part = XDF_PART(minor);
955 	if (!xdf_isopen(vdp, part))
956 		return (ENXIO);
957 
958 	if (cmlb_partinfo(vdp->xdf_vd_lbl, part, &p_blkcnt,
959 	    NULL, NULL, NULL, NULL))
960 		return (ENXIO);
961 
962 	if (uiop->uio_loffset >= XB_DTOB(p_blkcnt))
963 		return (ENOSPC);
964 
965 	if (U_INVAL(uiop))
966 		return (EINVAL);
967 
968 	return (aphysio(xdf_strategy, anocancel, dev, B_READ, minphys, aiop));
969 }
970 
971 /*ARGSUSED*/
972 static int
973 xdf_awrite(dev_t dev, struct aio_req *aiop, cred_t *credp)
974 {
975 	xdf_t *vdp;
976 	minor_t minor;
977 	struct uio *uiop = aiop->aio_uio;
978 	diskaddr_t p_blkcnt;
979 	int part;
980 
981 	minor = getminor(dev);
982 	if ((vdp = ddi_get_soft_state(vbd_ss, XDF_INST(minor))) == NULL)
983 		return (ENXIO);
984 
985 	part = XDF_PART(minor);
986 	if (!xdf_isopen(vdp, part))
987 		return (ENXIO);
988 
989 	if (cmlb_partinfo(vdp->xdf_vd_lbl, part, &p_blkcnt,
990 	    NULL, NULL, NULL, NULL))
991 		return (ENXIO);
992 
993 	if (uiop->uio_loffset >= XB_DTOB(p_blkcnt))
994 		return (ENOSPC);
995 
996 	if (U_INVAL(uiop))
997 		return (EINVAL);
998 
999 	return (aphysio(xdf_strategy, anocancel, dev, B_WRITE, minphys, aiop));
1000 }
1001 
1002 static int
1003 xdf_dump(dev_t dev, caddr_t addr, daddr_t blkno, int nblk)
1004 {
1005 	struct buf dumpbuf, *dbp;
1006 	xdf_t	*vdp;
1007 	minor_t minor;
1008 	int err = 0;
1009 	int part;
1010 	diskaddr_t p_blkcnt, p_blkst;
1011 
1012 	minor = getminor(dev);
1013 	if ((vdp = ddi_get_soft_state(vbd_ss, XDF_INST(minor))) == NULL)
1014 		return (ENXIO);
1015 
1016 	DPRINTF(IO_DBG, ("xdf: dump addr (0x%p) blk (%ld) nblks (%d)\n",
1017 	    addr, blkno, nblk));
1018 
1019 	part = XDF_PART(minor);
1020 	if (!xdf_isopen(vdp, part))
1021 		return (ENXIO);
1022 
1023 	if (cmlb_partinfo(vdp->xdf_vd_lbl, part, &p_blkcnt, &p_blkst,
1024 	    NULL, NULL, NULL))
1025 		return (ENXIO);
1026 
1027 	if ((blkno + nblk) > p_blkcnt) {
1028 		cmn_err(CE_WARN, "xdf: block %ld exceeds VBD size %"PRIu64,
1029 		    blkno + nblk, (uint64_t)p_blkcnt);
1030 		return (EINVAL);
1031 	}
1032 
1033 	dbp = &dumpbuf;
1034 	bioinit(dbp);
1035 	dbp->b_flags = B_BUSY;
1036 	dbp->b_un.b_addr = addr;
1037 	dbp->b_bcount = nblk << DEV_BSHIFT;
1038 	dbp->b_blkno = blkno;
1039 	dbp->b_edev = dev;
1040 	dbp->b_private = (void *)(uintptr_t)p_blkst;
1041 
1042 	mutex_enter(&vdp->xdf_dev_lk);
1043 	if (vdp->xdf_xdev_iostat != NULL)
1044 		kstat_waitq_enter(KSTAT_IO_PTR(vdp->xdf_xdev_iostat));
1045 	if (vdp->xdf_f_act == NULL) {
1046 		vdp->xdf_f_act = vdp->xdf_l_act = dbp;
1047 	} else {
1048 		vdp->xdf_l_act->av_forw = dbp;
1049 		vdp->xdf_l_act = dbp;
1050 	}
1051 	dbp->av_forw = NULL;
1052 	dbp->av_back = NULL;
1053 	mutex_exit(&vdp->xdf_dev_lk);
1054 	xdf_iostart(vdp);
1055 	err = xdf_drain_io(vdp);
1056 	biofini(dbp);
1057 	return (err);
1058 }
1059 
1060 /*ARGSUSED*/
1061 static int
1062 xdf_ioctl(dev_t dev, int cmd, intptr_t arg, int mode, cred_t *credp,
1063     int *rvalp)
1064 {
1065 	int instance;
1066 	xdf_t	*vdp;
1067 	minor_t minor;
1068 	int part;
1069 
1070 	minor = getminor(dev);
1071 	instance = XDF_INST(minor);
1072 
1073 	if ((vdp = ddi_get_soft_state(vbd_ss, instance)) == NULL)
1074 		return (ENXIO);
1075 
1076 	DPRINTF(IOCTL_DBG, ("xdf%d:ioctl: cmd %d (0x%x)\n",
1077 	    instance, cmd, cmd));
1078 
1079 	part = XDF_PART(minor);
1080 	if (!xdf_isopen(vdp, part))
1081 		return (ENXIO);
1082 
1083 	switch (cmd) {
1084 	case DKIOCGMEDIAINFO: {
1085 		struct dk_minfo	media_info;
1086 
1087 		media_info.dki_lbsize = DEV_BSIZE;
1088 		media_info.dki_capacity = vdp->xdf_pgeom.g_capacity;
1089 		media_info.dki_media_type = DK_FIXED_DISK;
1090 
1091 		if (ddi_copyout(&media_info, (void *)arg,
1092 		    sizeof (struct dk_minfo), mode)) {
1093 			return (EFAULT);
1094 		} else {
1095 			return (0);
1096 		}
1097 	}
1098 
1099 	case DKIOCINFO: {
1100 		struct dk_cinfo info;
1101 
1102 		/* controller information */
1103 		if (XD_IS_CD(vdp))
1104 			info.dki_ctype = DKC_CDROM;
1105 		else
1106 			info.dki_ctype = DKC_VBD;
1107 
1108 		info.dki_cnum = 0;
1109 		(void) strncpy((char *)(&info.dki_cname), "xdf", 8);
1110 
1111 		/* unit information */
1112 		info.dki_unit = ddi_get_instance(vdp->xdf_dip);
1113 		(void) strncpy((char *)(&info.dki_dname), "xdf", 8);
1114 		info.dki_flags = DKI_FMTVOL;
1115 		info.dki_partition = part;
1116 		info.dki_maxtransfer = maxphys / DEV_BSIZE;
1117 		info.dki_addr = 0;
1118 		info.dki_space = 0;
1119 		info.dki_prio = 0;
1120 		info.dki_vec = 0;
1121 
1122 		if (ddi_copyout(&info, (void *)arg, sizeof (info), mode))
1123 			return (EFAULT);
1124 		else
1125 			return (0);
1126 	}
1127 
1128 	case DKIOCSTATE: {
1129 		enum dkio_state	dkstate = DKIO_INSERTED;
1130 		if (ddi_copyout(&dkstate, (void *)arg, sizeof (dkstate),
1131 		    mode) != 0)
1132 			return (EFAULT);
1133 		return (0);
1134 	}
1135 
1136 	/*
1137 	 * is media removable?
1138 	 */
1139 	case DKIOCREMOVABLE: {
1140 		int i = XD_IS_RM(vdp) ? 1 : 0;
1141 		if (ddi_copyout(&i, (caddr_t)arg, sizeof (int), mode))
1142 			return (EFAULT);
1143 		return (0);
1144 	}
1145 
1146 	case DKIOCG_PHYGEOM:
1147 	case DKIOCG_VIRTGEOM:
1148 	case DKIOCGGEOM:
1149 	case DKIOCSGEOM:
1150 	case DKIOCGAPART:
1151 	case DKIOCSAPART:
1152 	case DKIOCGVTOC:
1153 	case DKIOCSVTOC:
1154 	case DKIOCPARTINFO:
1155 	case DKIOCGMBOOT:
1156 	case DKIOCSMBOOT:
1157 	case DKIOCGETEFI:
1158 	case DKIOCSETEFI:
1159 	case DKIOCPARTITION: {
1160 		int rc;
1161 
1162 		rc = cmlb_ioctl(vdp->xdf_vd_lbl, dev, cmd, arg, mode, credp,
1163 		    rvalp, NULL);
1164 		return (rc);
1165 	}
1166 
1167 	case DKIOCGETWCE:
1168 		if (ddi_copyout(&vdp->xdf_wce, (void *)arg,
1169 		    sizeof (vdp->xdf_wce), mode))
1170 			return (EFAULT);
1171 		return (0);
1172 	case DKIOCSETWCE:
1173 		if (ddi_copyin((void *)arg, &vdp->xdf_wce,
1174 		    sizeof (vdp->xdf_wce), mode))
1175 			return (EFAULT);
1176 		return (0);
1177 	case DKIOCFLUSHWRITECACHE: {
1178 		int rc;
1179 		struct dk_callback *dkc = (struct dk_callback *)arg;
1180 
1181 		if (vdp->xdf_flush_supported) {
1182 			rc = xdf_lb_rdwr(vdp->xdf_dip, TG_WRITE,
1183 			    NULL, 0, 0, (void *)dev);
1184 		} else if (vdp->xdf_feature_barrier &&
1185 		    !xdf_barrier_flush_disable) {
1186 			rc = xdf_lb_rdwr(vdp->xdf_dip, TG_WRITE,
1187 			    vdp->xdf_cache_flush_block, xdf_flush_block,
1188 			    DEV_BSIZE, (void *)dev);
1189 		} else {
1190 			return (ENOTTY);
1191 		}
1192 		if ((mode & FKIOCTL) && (dkc != NULL) &&
1193 		    (dkc->dkc_callback != NULL)) {
1194 			(*dkc->dkc_callback)(dkc->dkc_cookie, rc);
1195 			/* need to return 0 after calling callback */
1196 			rc = 0;
1197 		}
1198 		return (rc);
1199 	}
1200 
1201 	default:
1202 		return (ENOTTY);
1203 	}
1204 }
1205 
1206 /*
1207  * xdf interrupt handler
1208  */
1209 static uint_t
1210 xdf_intr(caddr_t arg)
1211 {
1212 	xdf_t *vdp = (xdf_t *)arg;
1213 	xendev_ring_t *xbr;
1214 	blkif_response_t *resp;
1215 	int bioerr;
1216 	uint64_t id;
1217 	extern int do_polled_io;
1218 	uint8_t op;
1219 	uint16_t status;
1220 	ddi_acc_handle_t acchdl;
1221 
1222 	mutex_enter(&vdp->xdf_dev_lk);
1223 
1224 	if ((xbr = vdp->xdf_xb_ring) == NULL) {
1225 		mutex_exit(&vdp->xdf_dev_lk);
1226 		return (DDI_INTR_UNCLAIMED);
1227 	}
1228 
1229 	acchdl = vdp->xdf_xb_ring_hdl;
1230 
1231 	/*
1232 	 * complete all requests which have a response
1233 	 */
1234 	while (resp = xvdi_ring_get_response(xbr)) {
1235 		id = ddi_get64(acchdl, &resp->id);
1236 		op = ddi_get8(acchdl, &resp->operation);
1237 		status = ddi_get16(acchdl, (uint16_t *)&resp->status);
1238 		DPRINTF(INTR_DBG, ("resp: op %d id %"PRIu64" status %d\n",
1239 		    op, id, status));
1240 
1241 		/*
1242 		 * XXPV - close connection to the backend and restart
1243 		 */
1244 		if (status != BLKIF_RSP_OKAY) {
1245 			DPRINTF(IO_DBG, ("xdf@%s: I/O error while %s",
1246 			    ddi_get_name_addr(vdp->xdf_dip),
1247 			    (op == BLKIF_OP_READ) ? "reading" : "writing"));
1248 			bioerr = EIO;
1249 		} else {
1250 			bioerr = 0;
1251 		}
1252 
1253 		xdf_iofini(vdp, id, bioerr);
1254 	}
1255 
1256 	mutex_exit(&vdp->xdf_dev_lk);
1257 
1258 	if (!do_polled_io)
1259 		xdf_iostart(vdp);
1260 
1261 	return (DDI_INTR_CLAIMED);
1262 }
1263 
1264 int xdf_fbrewrites;	/* how many times was our flush block rewritten */
1265 
1266 /*
1267  * Snarf new data if our flush block was re-written
1268  */
1269 static void
1270 check_fbwrite(xdf_t *vdp, buf_t *bp, daddr_t blkno)
1271 {
1272 	int nblks;
1273 	boolean_t mapin;
1274 
1275 	if (IS_WRITE_BARRIER(vdp, bp))
1276 		return; /* write was a flush write */
1277 
1278 	mapin = B_FALSE;
1279 	nblks = bp->b_bcount >> DEV_BSHIFT;
1280 	if (xdf_flush_block >= blkno && xdf_flush_block < (blkno + nblks)) {
1281 		xdf_fbrewrites++;
1282 		if (bp->b_flags & (B_PAGEIO | B_PHYS)) {
1283 			mapin = B_TRUE;
1284 			bp_mapin(bp);
1285 		}
1286 		bcopy(bp->b_un.b_addr +
1287 		    ((xdf_flush_block - blkno) << DEV_BSHIFT),
1288 		    vdp->xdf_cache_flush_block, DEV_BSIZE);
1289 		if (mapin)
1290 			bp_mapout(bp);
1291 	}
1292 }
1293 
1294 static void
1295 xdf_iofini(xdf_t *vdp, uint64_t id, int bioerr)
1296 {
1297 	ge_slot_t *gs = (ge_slot_t *)(uintptr_t)id;
1298 	v_req_t *vreq = gs->vreq;
1299 	buf_t *bp = vreq->v_buf;
1300 
1301 	gs_free(vdp, gs);
1302 	if (bioerr)
1303 		bioerror(bp, bioerr);
1304 	vreq->v_nslots--;
1305 	if (vreq->v_nslots != 0)
1306 		return;
1307 
1308 	XDF_UPDATE_IO_STAT(vdp, bp);
1309 	if (vdp->xdf_xdev_iostat != NULL)
1310 		kstat_runq_exit(KSTAT_IO_PTR(vdp->xdf_xdev_iostat));
1311 
1312 	if (IS_ERROR(bp))
1313 		bp->b_resid = bp->b_bcount;
1314 
1315 	vreq_free(vdp, vreq);
1316 	biodone(bp);
1317 }
1318 
1319 /*
1320  * return value of xdf_prepare_rreq()
1321  * used in xdf_iostart()
1322  */
1323 #define	XF_PARTIAL	0 /* rreq is full, not all I/O in buf transferred */
1324 #define	XF_COMP		1 /* no more I/O left in buf */
1325 
1326 static void
1327 xdf_iostart(xdf_t *vdp)
1328 {
1329 	xendev_ring_t *xbr;
1330 	struct buf *bp;
1331 	blkif_request_t *rreq;
1332 	int retval;
1333 	int rreqready = 0;
1334 
1335 	xbr = vdp->xdf_xb_ring;
1336 
1337 	/*
1338 	 * populate the ring request(s)
1339 	 *
1340 	 * loop until there is no buf to transfer or no free slot
1341 	 * available in I/O ring
1342 	 */
1343 	mutex_enter(&vdp->xdf_dev_lk);
1344 
1345 	for (;;) {
1346 		if (vdp->xdf_status != XD_READY)
1347 			break;
1348 
1349 		/* active buf queue empty? */
1350 		if ((bp = vdp->xdf_f_act) == NULL)
1351 			break;
1352 
1353 		/* try to grab a vreq for this bp */
1354 		if ((BP2VREQ(bp) == NULL) && (vreq_get(vdp, bp) == NULL))
1355 				break;
1356 		/* alloc DMA/GTE resources */
1357 		if (vreq_setup(vdp, BP2VREQ(bp)) != DDI_SUCCESS)
1358 			break;
1359 
1360 		/* get next blkif_request in the ring */
1361 		if ((rreq = xvdi_ring_get_request(xbr)) == NULL)
1362 			break;
1363 		bzero(rreq, sizeof (blkif_request_t));
1364 
1365 		/* populate blkif_request with this buf */
1366 		rreqready++;
1367 		retval = xdf_prepare_rreq(vdp, bp, rreq);
1368 		if (retval == XF_COMP) {
1369 			/* finish this bp, switch to next one */
1370 			if (vdp->xdf_xdev_iostat != NULL)
1371 				kstat_waitq_to_runq(
1372 				    KSTAT_IO_PTR(vdp->xdf_xdev_iostat));
1373 			vdp->xdf_f_act = bp->av_forw;
1374 			bp->av_forw = NULL;
1375 		}
1376 	}
1377 
1378 	/*
1379 	 * Send the request(s) to the backend
1380 	 */
1381 	if (rreqready) {
1382 		if (xvdi_ring_push_request(xbr)) {
1383 			DPRINTF(IO_DBG, ("xdf_iostart: "
1384 			    "sent request(s) to backend\n"));
1385 			xvdi_notify_oe(vdp->xdf_dip);
1386 		}
1387 	}
1388 
1389 	mutex_exit(&vdp->xdf_dev_lk);
1390 }
1391 
1392 /*
1393  * populate a single blkif_request_t w/ a buf
1394  */
1395 static int
1396 xdf_prepare_rreq(xdf_t *vdp, struct buf *bp, blkif_request_t *rreq)
1397 {
1398 	int		rval;
1399 	grant_ref_t	gr;
1400 	uint8_t		fsect, lsect;
1401 	size_t		bcnt;
1402 	paddr_t		dma_addr;
1403 	off_t		blk_off;
1404 	dev_info_t	*dip = vdp->xdf_dip;
1405 	blkif_vdev_t	vdev = xvdi_get_vdevnum(dip);
1406 	v_req_t		*vreq = BP2VREQ(bp);
1407 	uint64_t	blkno = vreq->v_blkno;
1408 	uint_t		ndmacs = vreq->v_ndmacs;
1409 	ddi_acc_handle_t acchdl = vdp->xdf_xb_ring_hdl;
1410 	int		seg = 0;
1411 	int		isread = IS_READ(bp);
1412 
1413 	if (isread)
1414 		ddi_put8(acchdl, &rreq->operation, BLKIF_OP_READ);
1415 	else {
1416 		switch (vreq->v_flush_diskcache) {
1417 		case FLUSH_DISKCACHE:
1418 			ddi_put8(acchdl, &rreq->operation,
1419 			    BLKIF_OP_FLUSH_DISKCACHE);
1420 			ddi_put16(acchdl, &rreq->handle, vdev);
1421 			ddi_put64(acchdl, &rreq->id,
1422 			    (uint64_t)(uintptr_t)(vreq->v_gs));
1423 			ddi_put8(acchdl, &rreq->nr_segments, 0);
1424 			return (XF_COMP);
1425 		case WRITE_BARRIER:
1426 			ddi_put8(acchdl, &rreq->operation,
1427 			    BLKIF_OP_WRITE_BARRIER);
1428 			break;
1429 		default:
1430 			if (!vdp->xdf_wce)
1431 				ddi_put8(acchdl, &rreq->operation,
1432 				    BLKIF_OP_WRITE_BARRIER);
1433 			else
1434 				ddi_put8(acchdl, &rreq->operation,
1435 				    BLKIF_OP_WRITE);
1436 			break;
1437 		}
1438 	}
1439 
1440 	ddi_put16(acchdl, &rreq->handle, vdev);
1441 	ddi_put64(acchdl, &rreq->sector_number, blkno);
1442 	ddi_put64(acchdl, &rreq->id, (uint64_t)(uintptr_t)(vreq->v_gs));
1443 
1444 	/*
1445 	 * loop until all segments are populated or no more dma cookie in buf
1446 	 */
1447 	for (;;) {
1448 	/*
1449 	 * Each segment of a blkif request can transfer up to
1450 	 * one 4K page of data.
1451 	 */
1452 		bcnt = vreq->v_dmac.dmac_size;
1453 		ASSERT(bcnt <= PAGESIZE);
1454 		ASSERT((bcnt % XB_BSIZE) == 0);
1455 		dma_addr = vreq->v_dmac.dmac_laddress;
1456 		blk_off = (uint_t)((paddr_t)XB_SEGOFFSET & dma_addr);
1457 		ASSERT((blk_off & XB_BMASK) == 0);
1458 		fsect = blk_off >> XB_BSHIFT;
1459 		lsect = fsect + (bcnt >> XB_BSHIFT) - 1;
1460 		ASSERT(fsect < XB_MAX_SEGLEN / XB_BSIZE &&
1461 		    lsect < XB_MAX_SEGLEN / XB_BSIZE);
1462 		DPRINTF(IO_DBG, ("  ""seg%d: dmacS %lu blk_off %ld\n",
1463 		    seg, vreq->v_dmac.dmac_size, blk_off));
1464 		gr = gs_grant(vreq->v_gs, PATOMA(dma_addr) >> PAGESHIFT);
1465 		ddi_put32(acchdl, &rreq->seg[seg].gref, gr);
1466 		ddi_put8(acchdl, &rreq->seg[seg].first_sect, fsect);
1467 		ddi_put8(acchdl, &rreq->seg[seg].last_sect, lsect);
1468 		DPRINTF(IO_DBG, ("  ""seg%d: fs %d ls %d gr %d dma 0x%"PRIx64
1469 		    "\n", seg, fsect, lsect, gr, dma_addr));
1470 
1471 		blkno += (bcnt >> XB_BSHIFT);
1472 		seg++;
1473 		ASSERT(seg <= BLKIF_MAX_SEGMENTS_PER_REQUEST);
1474 		if (--ndmacs) {
1475 			ddi_dma_nextcookie(vreq->v_dmahdl, &vreq->v_dmac);
1476 			continue;
1477 		}
1478 
1479 		vreq->v_status = VREQ_DMAWIN_DONE;
1480 		vreq->v_blkno = blkno;
1481 		if (vreq->v_dmaw + 1 == vreq->v_ndmaws)
1482 			/* last win */
1483 			rval = XF_COMP;
1484 		else
1485 			rval = XF_PARTIAL;
1486 		break;
1487 	}
1488 	ddi_put8(acchdl,  &rreq->nr_segments, seg);
1489 	DPRINTF(IO_DBG, ("xdf_prepare_rreq: request id=%"PRIx64" ready\n",
1490 	    rreq->id));
1491 
1492 	return (rval);
1493 }
1494 
1495 #define	XDF_QSEC	50000	/* .005 second */
1496 #define	XDF_POLLCNT	12	/* loop for 12 times before time out */
1497 
1498 static int
1499 xdf_drain_io(xdf_t *vdp)
1500 {
1501 	int pollc, rval;
1502 	xendev_ring_t *xbr;
1503 
1504 	if (xdfdebug & SUSRES_DBG)
1505 		xen_printf("xdf_drain_io: start\n");
1506 
1507 	mutex_enter(&vdp->xdf_dev_lk);
1508 
1509 	if ((vdp->xdf_status != XD_READY) && (vdp->xdf_status != XD_SUSPEND))
1510 		goto out;
1511 
1512 	rval = 0;
1513 	xbr = vdp->xdf_xb_ring;
1514 	ASSERT(xbr != NULL);
1515 
1516 	for (pollc = 0; pollc < XDF_POLLCNT; pollc++) {
1517 		if (xvdi_ring_has_unconsumed_responses(xbr)) {
1518 			mutex_exit(&vdp->xdf_dev_lk);
1519 			(void) xdf_intr((caddr_t)vdp);
1520 			mutex_enter(&vdp->xdf_dev_lk);
1521 		}
1522 		if (!xvdi_ring_has_incomp_request(xbr))
1523 			goto out;
1524 
1525 #ifndef	XPV_HVM_DRIVER
1526 		(void) HYPERVISOR_yield();
1527 #endif /* XPV_HVM_DRIVER */
1528 		/*
1529 		 * file-backed devices can be slow
1530 		 */
1531 		drv_usecwait(XDF_QSEC << pollc);
1532 	}
1533 	cmn_err(CE_WARN, "xdf_polled_io: timeout");
1534 	rval = EIO;
1535 out:
1536 	mutex_exit(&vdp->xdf_dev_lk);
1537 	if (xdfdebug & SUSRES_DBG)
1538 		xen_printf("xdf_drain_io: end, err=%d\n", rval);
1539 	return (rval);
1540 }
1541 
1542 /* ARGSUSED5 */
1543 int
1544 xdf_lb_rdwr(dev_info_t *devi, uchar_t cmd, void *bufp,
1545     diskaddr_t start, size_t reqlen, void *tg_cookie)
1546 {
1547 	xdf_t *vdp;
1548 	struct buf *bp;
1549 	int err = 0;
1550 
1551 	vdp = ddi_get_soft_state(vbd_ss, ddi_get_instance(devi));
1552 	if (vdp == NULL)
1553 		return (ENXIO);
1554 
1555 	if ((start + (reqlen >> DEV_BSHIFT)) > vdp->xdf_pgeom.g_capacity)
1556 		return (EINVAL);
1557 
1558 	bp = getrbuf(KM_SLEEP);
1559 	if (cmd == TG_READ)
1560 		bp->b_flags = B_BUSY | B_READ;
1561 	else
1562 		bp->b_flags = B_BUSY | B_WRITE;
1563 	bp->b_un.b_addr = bufp;
1564 	bp->b_bcount = reqlen;
1565 	bp->b_blkno = start;
1566 	bp->b_edev = DDI_DEV_T_NONE; /* don't have dev_t */
1567 
1568 	mutex_enter(&vdp->xdf_dev_lk);
1569 	if (vdp->xdf_xdev_iostat != NULL)
1570 		kstat_waitq_enter(KSTAT_IO_PTR(vdp->xdf_xdev_iostat));
1571 	if (vdp->xdf_f_act == NULL) {
1572 		vdp->xdf_f_act = vdp->xdf_l_act = bp;
1573 	} else {
1574 		vdp->xdf_l_act->av_forw = bp;
1575 		vdp->xdf_l_act = bp;
1576 	}
1577 	mutex_exit(&vdp->xdf_dev_lk);
1578 	xdf_iostart(vdp);
1579 	err = biowait(bp);
1580 
1581 	ASSERT(bp->b_flags & B_DONE);
1582 
1583 	freerbuf(bp);
1584 	return (err);
1585 }
1586 
1587 /*
1588  * synthetic geometry
1589  */
1590 #define	XDF_NSECTS	256
1591 #define	XDF_NHEADS	16
1592 
1593 static void
1594 xdf_synthetic_pgeom(dev_info_t *devi, cmlb_geom_t *geomp)
1595 {
1596 	xdf_t *vdp;
1597 	uint_t ncyl;
1598 
1599 	vdp = ddi_get_soft_state(vbd_ss, ddi_get_instance(devi));
1600 
1601 	ncyl = vdp->xdf_xdev_nblocks / (XDF_NHEADS * XDF_NSECTS);
1602 
1603 	geomp->g_ncyl = ncyl == 0 ? 1 : ncyl;
1604 	geomp->g_acyl = 0;
1605 	geomp->g_nhead = XDF_NHEADS;
1606 	geomp->g_secsize = XB_BSIZE;
1607 	geomp->g_nsect = XDF_NSECTS;
1608 	geomp->g_intrlv = 0;
1609 	geomp->g_rpm = 7200;
1610 	geomp->g_capacity = vdp->xdf_xdev_nblocks;
1611 }
1612 
1613 static int
1614 xdf_lb_getcap(dev_info_t *devi, diskaddr_t *capp)
1615 {
1616 	xdf_t *vdp;
1617 
1618 	vdp = ddi_get_soft_state(vbd_ss, ddi_get_instance(devi));
1619 
1620 	if (vdp == NULL)
1621 		return (ENXIO);
1622 
1623 	mutex_enter(&vdp->xdf_dev_lk);
1624 	*capp = vdp->xdf_pgeom.g_capacity;
1625 	DPRINTF(LBL_DBG, ("capacity %llu\n", *capp));
1626 	mutex_exit(&vdp->xdf_dev_lk);
1627 	return (0);
1628 }
1629 
1630 static int
1631 xdf_lb_getpgeom(dev_info_t *devi, cmlb_geom_t *geomp)
1632 {
1633 	xdf_t *vdp;
1634 
1635 	if ((vdp = ddi_get_soft_state(vbd_ss, ddi_get_instance(devi))) == NULL)
1636 		return (ENXIO);
1637 	*geomp = vdp->xdf_pgeom;
1638 	return (0);
1639 }
1640 
1641 /*
1642  * No real HBA, no geometry available from it
1643  */
1644 /*ARGSUSED*/
1645 static int
1646 xdf_lb_getvgeom(dev_info_t *devi, cmlb_geom_t *geomp)
1647 {
1648 	return (EINVAL);
1649 }
1650 
1651 static int
1652 xdf_lb_getattribute(dev_info_t *devi, tg_attribute_t *tgattributep)
1653 {
1654 	xdf_t *vdp;
1655 
1656 	if (!(vdp = ddi_get_soft_state(vbd_ss, ddi_get_instance(devi))))
1657 		return (ENXIO);
1658 
1659 	if (XD_IS_RO(vdp))
1660 		tgattributep->media_is_writable = 0;
1661 	else
1662 		tgattributep->media_is_writable = 1;
1663 	return (0);
1664 }
1665 
1666 /* ARGSUSED3 */
1667 int
1668 xdf_lb_getinfo(dev_info_t *devi, int cmd, void *arg, void *tg_cookie)
1669 {
1670 	switch (cmd) {
1671 	case TG_GETPHYGEOM:
1672 		return (xdf_lb_getpgeom(devi, (cmlb_geom_t *)arg));
1673 	case TG_GETVIRTGEOM:
1674 		return (xdf_lb_getvgeom(devi, (cmlb_geom_t *)arg));
1675 	case TG_GETCAPACITY:
1676 		return (xdf_lb_getcap(devi, (diskaddr_t *)arg));
1677 	case TG_GETBLOCKSIZE:
1678 		*(uint32_t *)arg = XB_BSIZE;
1679 		return (0);
1680 	case TG_GETATTR:
1681 		return (xdf_lb_getattribute(devi, (tg_attribute_t *)arg));
1682 	default:
1683 		return (ENOTTY);
1684 	}
1685 }
1686 
1687 /*
1688  * Kick-off connect process
1689  * Status should be XD_UNKNOWN or XD_CLOSED
1690  * On success, status will be changed to XD_INIT
1691  * On error, status won't be changed
1692  */
1693 static int
1694 xdf_start_connect(xdf_t *vdp)
1695 {
1696 	char *xsnode;
1697 	grant_ref_t gref;
1698 	xenbus_transaction_t xbt;
1699 	int rv;
1700 	dev_info_t *dip = vdp->xdf_dip;
1701 
1702 	if ((vdp->xdf_peer = xvdi_get_oeid(dip)) == (domid_t)-1)
1703 		goto errout;
1704 
1705 	if (xvdi_alloc_evtchn(dip) != DDI_SUCCESS) {
1706 		cmn_err(CE_WARN, "xdf@%s: failed to alloc event channel",
1707 		    ddi_get_name_addr(dip));
1708 		goto errout;
1709 	}
1710 	vdp->xdf_evtchn = xvdi_get_evtchn(dip);
1711 #ifdef XPV_HVM_DRIVER
1712 	ec_bind_evtchn_to_handler(vdp->xdf_evtchn, IPL_VBD, xdf_intr, vdp);
1713 #else /* !XPV_HVM_DRIVER */
1714 	if (ddi_add_intr(dip, 0, NULL, NULL, xdf_intr, (caddr_t)vdp) !=
1715 	    DDI_SUCCESS) {
1716 		cmn_err(CE_WARN, "xdf_start_connect: xdf@%s: "
1717 		    "failed to add intr handler", ddi_get_name_addr(dip));
1718 		goto errout1;
1719 	}
1720 #endif /* !XPV_HVM_DRIVER */
1721 
1722 	if (xvdi_alloc_ring(dip, BLKIF_RING_SIZE,
1723 	    sizeof (union blkif_sring_entry), &gref, &vdp->xdf_xb_ring) !=
1724 	    DDI_SUCCESS) {
1725 		cmn_err(CE_WARN, "xdf@%s: failed to alloc comm ring",
1726 		    ddi_get_name_addr(dip));
1727 		goto errout2;
1728 	}
1729 	vdp->xdf_xb_ring_hdl = vdp->xdf_xb_ring->xr_acc_hdl; /* ugly!! */
1730 
1731 	/*
1732 	 * Write into xenstore the info needed by backend
1733 	 */
1734 	if ((xsnode = xvdi_get_xsname(dip)) == NULL) {
1735 		cmn_err(CE_WARN, "xdf@%s: "
1736 		    "failed to get xenstore node path",
1737 		    ddi_get_name_addr(dip));
1738 		goto fail_trans;
1739 	}
1740 trans_retry:
1741 	if (xenbus_transaction_start(&xbt)) {
1742 		cmn_err(CE_WARN, "xdf@%s: failed to start transaction",
1743 		    ddi_get_name_addr(dip));
1744 		xvdi_fatal_error(dip, EIO, "transaction start");
1745 		goto fail_trans;
1746 	}
1747 
1748 	if (rv = xenbus_printf(xbt, xsnode, "ring-ref", "%u", gref)) {
1749 		cmn_err(CE_WARN, "xdf@%s: failed to write ring-ref",
1750 		    ddi_get_name_addr(dip));
1751 		xvdi_fatal_error(dip, rv, "writing ring-ref");
1752 		goto abort_trans;
1753 	}
1754 
1755 	if (rv = xenbus_printf(xbt, xsnode, "event-channel", "%u",
1756 	    vdp->xdf_evtchn)) {
1757 		cmn_err(CE_WARN, "xdf@%s: failed to write event-channel",
1758 		    ddi_get_name_addr(dip));
1759 		xvdi_fatal_error(dip, rv, "writing event-channel");
1760 		goto abort_trans;
1761 	}
1762 
1763 	/*
1764 	 * "protocol" is written by the domain builder in the case of PV
1765 	 * domains. However, it is not written for HVM domains, so let's
1766 	 * write it here.
1767 	 */
1768 	if (rv = xenbus_printf(xbt, xsnode, "protocol", "%s",
1769 	    XEN_IO_PROTO_ABI_NATIVE)) {
1770 		cmn_err(CE_WARN, "xdf@%s: failed to write protocol",
1771 		    ddi_get_name_addr(dip));
1772 		xvdi_fatal_error(dip, rv, "writing protocol");
1773 		goto abort_trans;
1774 	}
1775 
1776 	if ((rv = xvdi_switch_state(dip, xbt, XenbusStateInitialised)) > 0) {
1777 		cmn_err(CE_WARN, "xdf@%s: "
1778 		    "failed to switch state to XenbusStateInitialised",
1779 		    ddi_get_name_addr(dip));
1780 		xvdi_fatal_error(dip, rv, "writing state");
1781 		goto abort_trans;
1782 	}
1783 
1784 	/* kick-off connect process */
1785 	if (rv = xenbus_transaction_end(xbt, 0)) {
1786 		if (rv == EAGAIN)
1787 			goto trans_retry;
1788 		cmn_err(CE_WARN, "xdf@%s: failed to end transaction",
1789 		    ddi_get_name_addr(dip));
1790 		xvdi_fatal_error(dip, rv, "completing transaction");
1791 		goto fail_trans;
1792 	}
1793 
1794 	ASSERT(mutex_owned(&vdp->xdf_cb_lk));
1795 	mutex_enter(&vdp->xdf_dev_lk);
1796 	vdp->xdf_status = XD_INIT;
1797 	mutex_exit(&vdp->xdf_dev_lk);
1798 
1799 	return (DDI_SUCCESS);
1800 
1801 abort_trans:
1802 	(void) xenbus_transaction_end(xbt, 1);
1803 fail_trans:
1804 	xvdi_free_ring(vdp->xdf_xb_ring);
1805 errout2:
1806 #ifdef XPV_HVM_DRIVER
1807 	ec_unbind_evtchn(vdp->xdf_evtchn);
1808 #else /* !XPV_HVM_DRIVER */
1809 	(void) ddi_remove_intr(vdp->xdf_dip, 0, NULL);
1810 #endif /* !XPV_HVM_DRIVER */
1811 errout1:
1812 	xvdi_free_evtchn(dip);
1813 errout:
1814 	cmn_err(CE_WARN, "xdf@%s: fail to kick-off connecting",
1815 	    ddi_get_name_addr(dip));
1816 	return (DDI_FAILURE);
1817 }
1818 
1819 /*
1820  * Kick-off disconnect process
1821  * Status won't be changed
1822  */
1823 static int
1824 xdf_start_disconnect(xdf_t *vdp)
1825 {
1826 	if (xvdi_switch_state(vdp->xdf_dip, XBT_NULL, XenbusStateClosed) > 0) {
1827 		cmn_err(CE_WARN, "xdf@%s: fail to kick-off disconnecting",
1828 		    ddi_get_name_addr(vdp->xdf_dip));
1829 		return (DDI_FAILURE);
1830 	}
1831 
1832 	return (DDI_SUCCESS);
1833 }
1834 
1835 int
1836 xdf_get_flush_block(xdf_t *vdp)
1837 {
1838 	/*
1839 	 * Get a DEV_BSIZE aligned bufer
1840 	 */
1841 	vdp->xdf_flush_mem = kmem_alloc(DEV_BSIZE * 2, KM_SLEEP);
1842 	vdp->xdf_cache_flush_block =
1843 	    (char *)P2ROUNDUP((uintptr_t)(vdp->xdf_flush_mem), DEV_BSIZE);
1844 	if (xdf_lb_rdwr(vdp->xdf_dip, TG_READ, vdp->xdf_cache_flush_block,
1845 	    xdf_flush_block, DEV_BSIZE, NULL) != 0)
1846 		return (DDI_FAILURE);
1847 	return (DDI_SUCCESS);
1848 }
1849 
1850 /*
1851  * Finish other initialization after we've connected to backend
1852  * Status should be XD_INIT before calling this routine
1853  * On success, status should be changed to XD_READY
1854  * On error, status should stay XD_INIT
1855  */
1856 static int
1857 xdf_post_connect(xdf_t *vdp)
1858 {
1859 	int rv;
1860 	uint_t len;
1861 	char *type;
1862 	char *barrier;
1863 	dev_info_t *devi = vdp->xdf_dip;
1864 
1865 	/*
1866 	 * Determine if feature barrier is supported by backend
1867 	 */
1868 	if (xenbus_read(XBT_NULL, xvdi_get_oename(devi),
1869 	    "feature-barrier", (void **)&barrier, &len) == 0) {
1870 		vdp->xdf_feature_barrier = 1;
1871 		kmem_free(barrier, len);
1872 	} else {
1873 		cmn_err(CE_NOTE, "xdf@%s: failed to read feature-barrier",
1874 		    ddi_get_name_addr(vdp->xdf_dip));
1875 		vdp->xdf_feature_barrier = 0;
1876 	}
1877 
1878 	/* probe backend */
1879 	if (rv = xenbus_gather(XBT_NULL, xvdi_get_oename(devi),
1880 	    "sectors", "%"SCNu64, &vdp->xdf_xdev_nblocks,
1881 	    "info", "%u", &vdp->xdf_xdev_info, NULL)) {
1882 		cmn_err(CE_WARN, "xdf_post_connect: xdf@%s: "
1883 		    "cannot read backend info", ddi_get_name_addr(devi));
1884 		xvdi_fatal_error(devi, rv, "reading backend info");
1885 		return (DDI_FAILURE);
1886 	}
1887 
1888 	/*
1889 	 * Make sure that the device we're connecting isn't smaller than
1890 	 * the old connected device.
1891 	 */
1892 	if (vdp->xdf_xdev_nblocks < vdp->xdf_pgeom.g_capacity) {
1893 		cmn_err(CE_WARN, "xdf_post_connect: xdf@%s: "
1894 		    "backend disk device shrank", ddi_get_name_addr(devi));
1895 		/* XXX:  call xvdi_fatal_error() here? */
1896 		xvdi_fatal_error(devi, rv, "reading backend info");
1897 		return (DDI_FAILURE);
1898 	}
1899 
1900 	/*
1901 	 * Only update the physical geometry to reflect the new device
1902 	 * size if this is the first time we're connecting to the backend
1903 	 * device.  Once we assign a physical geometry to a device it stays
1904 	 * fixed until:
1905 	 *	- we get detach and re-attached (at which point we
1906 	 *	  automatically assign a new physical geometry).
1907 	 *	- someone calls TG_SETPHYGEOM to explicity set the
1908 	 *	  physical geometry.
1909 	 */
1910 	if (vdp->xdf_pgeom.g_capacity == 0)
1911 		xdf_synthetic_pgeom(devi, &vdp->xdf_pgeom);
1912 
1913 	/* fix disk type */
1914 	if (xenbus_read(XBT_NULL, xvdi_get_xsname(devi), "device-type",
1915 	    (void **)&type, &len) != 0) {
1916 		cmn_err(CE_WARN, "xdf_post_connect: xdf@%s: "
1917 		    "cannot read device-type", ddi_get_name_addr(devi));
1918 		xvdi_fatal_error(devi, rv, "reading device-type");
1919 		return (DDI_FAILURE);
1920 	}
1921 	if (strcmp(type, "cdrom") == 0)
1922 		vdp->xdf_xdev_info |= VDISK_CDROM;
1923 	kmem_free(type, len);
1924 
1925 	/*
1926 	 * We've created all the minor nodes via cmlb_attach() using default
1927 	 * value in xdf_attach() to make it possible to block in xdf_open(),
1928 	 * in case there's anyone (say, booting thread) ever trying to open
1929 	 * it before connected to backend. We will refresh all those minor
1930 	 * nodes w/ latest info we've got now when we are almost connected.
1931 	 *
1932 	 * Don't do this when xdf is already opened by someone (could happen
1933 	 * during resume), for that cmlb_attach() will invalid the label info
1934 	 * and confuse those who has already opened the node, which is bad.
1935 	 */
1936 	if (!xdf_isopen(vdp, -1) && (XD_IS_CD(vdp) || XD_IS_RM(vdp))) {
1937 		/* re-init cmlb w/ latest info we got from backend */
1938 		if (cmlb_attach(devi, &xdf_lb_ops,
1939 		    XD_IS_CD(vdp) ? DTYPE_RODIRECT : DTYPE_DIRECT,
1940 		    XD_IS_RM(vdp), 1, DDI_NT_BLOCK,
1941 #if defined(XPV_HVM_DRIVER)
1942 		    CMLB_CREATE_ALTSLICE_VTOC_16_DTYPE_DIRECT |
1943 		    CMLB_INTERNAL_MINOR_NODES,
1944 #else /* !XPV_HVM_DRIVER */
1945 		    CMLB_FAKE_LABEL_ONE_PARTITION,
1946 #endif /* !XPV_HVM_DRIVER */
1947 		    vdp->xdf_vd_lbl, NULL) != 0) {
1948 			cmn_err(CE_WARN, "xdf@%s: cmlb attach failed",
1949 			    ddi_get_name_addr(devi));
1950 			return (DDI_FAILURE);
1951 		}
1952 	}
1953 
1954 	/* mark vbd is ready for I/O */
1955 	ASSERT(mutex_owned(&vdp->xdf_cb_lk));
1956 	mutex_enter(&vdp->xdf_dev_lk);
1957 	vdp->xdf_status = XD_READY;
1958 	mutex_exit(&vdp->xdf_dev_lk);
1959 	/*
1960 	 * If backend has feature-barrier, see if it supports disk
1961 	 * cache flush op.
1962 	 */
1963 	vdp->xdf_flush_supported = 0;
1964 	if (vdp->xdf_feature_barrier) {
1965 		/*
1966 		 * Pretend we already know flush is supported so probe
1967 		 * will attempt the correct op.
1968 		 */
1969 		vdp->xdf_flush_supported = 1;
1970 		if (xdf_lb_rdwr(vdp->xdf_dip, TG_WRITE, NULL, 0, 0, 0) == 0) {
1971 			vdp->xdf_flush_supported = 1;
1972 		} else {
1973 			vdp->xdf_flush_supported = 0;
1974 			/*
1975 			 * If the other end does not support the cache flush op
1976 			 * then we must use a barrier-write to force disk
1977 			 * cache flushing.  Barrier writes require that a data
1978 			 * block actually be written.
1979 			 * Cache a block to barrier-write when we are
1980 			 * asked to perform a flush.
1981 			 * XXX - would it be better to just copy 1 block
1982 			 * (512 bytes) from whatever write we did last
1983 			 * and rewrite that block?
1984 			 */
1985 			if (xdf_get_flush_block(vdp) != DDI_SUCCESS)
1986 				return (DDI_FAILURE);
1987 		}
1988 	}
1989 
1990 	cmn_err(CE_CONT, "?xdf@%s: %"PRIu64" blocks", ddi_get_name_addr(devi),
1991 	    (uint64_t)vdp->xdf_xdev_nblocks);
1992 
1993 	return (DDI_SUCCESS);
1994 }
1995 
1996 /*
1997  * Finish other uninitialization after we've disconnected from backend
1998  * when status is XD_CLOSING or XD_INIT. After returns, status is XD_CLOSED
1999  */
2000 static void
2001 xdf_post_disconnect(xdf_t *vdp)
2002 {
2003 #ifdef XPV_HVM_DRIVER
2004 	ec_unbind_evtchn(vdp->xdf_evtchn);
2005 #else /* !XPV_HVM_DRIVER */
2006 	(void) ddi_remove_intr(vdp->xdf_dip, 0, NULL);
2007 #endif /* !XPV_HVM_DRIVER */
2008 	xvdi_free_evtchn(vdp->xdf_dip);
2009 	xvdi_free_ring(vdp->xdf_xb_ring);
2010 	vdp->xdf_xb_ring = NULL;
2011 	vdp->xdf_xb_ring_hdl = NULL;
2012 	vdp->xdf_peer = (domid_t)-1;
2013 
2014 	ASSERT(mutex_owned(&vdp->xdf_cb_lk));
2015 	mutex_enter(&vdp->xdf_dev_lk);
2016 	vdp->xdf_status = XD_CLOSED;
2017 	mutex_exit(&vdp->xdf_dev_lk);
2018 }
2019 
2020 /*ARGSUSED*/
2021 static void
2022 xdf_oe_change(dev_info_t *dip, ddi_eventcookie_t id, void *arg, void *impl_data)
2023 {
2024 	XenbusState new_state = *(XenbusState *)impl_data;
2025 	xdf_t *vdp = (xdf_t *)ddi_get_driver_private(dip);
2026 	boolean_t unexpect_die = B_FALSE;
2027 	int status;
2028 
2029 	DPRINTF(DDI_DBG, ("xdf@%s: otherend state change to %d!\n",
2030 	    ddi_get_name_addr(dip), new_state));
2031 
2032 	mutex_enter(&vdp->xdf_cb_lk);
2033 
2034 	if (xdf_check_state_transition(vdp, new_state) == DDI_FAILURE) {
2035 		mutex_exit(&vdp->xdf_cb_lk);
2036 		return;
2037 	}
2038 
2039 	switch (new_state) {
2040 	case XenbusStateInitialising:
2041 		ASSERT(vdp->xdf_status == XD_CLOSED);
2042 		/*
2043 		 * backend recovered from a previous failure,
2044 		 * kick-off connect process again
2045 		 */
2046 		if (xdf_start_connect(vdp) != DDI_SUCCESS) {
2047 			cmn_err(CE_WARN, "xdf@%s:"
2048 			    " failed to start reconnecting to backend",
2049 			    ddi_get_name_addr(dip));
2050 		}
2051 		break;
2052 	case XenbusStateConnected:
2053 		ASSERT(vdp->xdf_status == XD_INIT);
2054 		(void) xvdi_switch_state(dip, XBT_NULL, XenbusStateConnected);
2055 		/* finish final init after connect */
2056 		if (xdf_post_connect(vdp) != DDI_SUCCESS)
2057 			(void) xdf_start_disconnect(vdp);
2058 		break;
2059 	case XenbusStateClosing:
2060 		if (vdp->xdf_status == XD_READY) {
2061 			mutex_enter(&vdp->xdf_dev_lk);
2062 			if (xdf_isopen(vdp, -1)) {
2063 				cmn_err(CE_NOTE, "xdf@%s: hot-unplug failed, "
2064 				    "still in use", ddi_get_name_addr(dip));
2065 				mutex_exit(&vdp->xdf_dev_lk);
2066 				break;
2067 			} else {
2068 				vdp->xdf_status = XD_CLOSING;
2069 			}
2070 			mutex_exit(&vdp->xdf_dev_lk);
2071 		}
2072 		(void) xdf_start_disconnect(vdp);
2073 		break;
2074 	case XenbusStateClosed:
2075 		/* first check if BE closed unexpectedly */
2076 		mutex_enter(&vdp->xdf_dev_lk);
2077 		if (xdf_isopen(vdp, -1)) {
2078 			unexpect_die = B_TRUE;
2079 			unexpectedie(vdp);
2080 			cmn_err(CE_WARN, "xdf@%s: backend closed, "
2081 			    "reconnecting...", ddi_get_name_addr(dip));
2082 		}
2083 		mutex_exit(&vdp->xdf_dev_lk);
2084 
2085 		if (vdp->xdf_status == XD_READY) {
2086 			mutex_enter(&vdp->xdf_dev_lk);
2087 			vdp->xdf_status = XD_CLOSING;
2088 			mutex_exit(&vdp->xdf_dev_lk);
2089 
2090 #ifdef	DOMU_BACKEND
2091 			(void) xvdi_post_event(dip, XEN_HP_REMOVE);
2092 #endif
2093 
2094 			xdf_post_disconnect(vdp);
2095 			(void) xvdi_switch_state(dip, XBT_NULL,
2096 			    XenbusStateClosed);
2097 		} else if ((vdp->xdf_status == XD_INIT) ||
2098 		    (vdp->xdf_status == XD_CLOSING)) {
2099 			xdf_post_disconnect(vdp);
2100 		} else {
2101 			mutex_enter(&vdp->xdf_dev_lk);
2102 			vdp->xdf_status = XD_CLOSED;
2103 			mutex_exit(&vdp->xdf_dev_lk);
2104 		}
2105 	}
2106 
2107 	/* notify anybody waiting for oe state change */
2108 	mutex_enter(&vdp->xdf_dev_lk);
2109 	cv_broadcast(&vdp->xdf_dev_cv);
2110 	mutex_exit(&vdp->xdf_dev_lk);
2111 
2112 	status = vdp->xdf_status;
2113 	mutex_exit(&vdp->xdf_cb_lk);
2114 
2115 	if (status == XD_READY) {
2116 		xdf_iostart(vdp);
2117 	} else if ((status == XD_CLOSED) && !unexpect_die) {
2118 		/* interface is closed successfully, remove all minor nodes */
2119 		cmlb_detach(vdp->xdf_vd_lbl, NULL);
2120 		cmlb_free_handle(&vdp->xdf_vd_lbl);
2121 	}
2122 }
2123 
2124 /* check if partition is open, -1 - check all partitions on the disk */
2125 static boolean_t
2126 xdf_isopen(xdf_t *vdp, int partition)
2127 {
2128 	int i;
2129 	ulong_t parbit;
2130 	boolean_t rval = B_FALSE;
2131 
2132 	ASSERT((partition == -1) ||
2133 	    ((partition >= 0) || (partition < XDF_PEXT)));
2134 
2135 	if (partition == -1)
2136 		parbit = (ulong_t)-1;
2137 	else
2138 		parbit = 1 << partition;
2139 
2140 	for (i = 0; i < OTYPCNT; i++) {
2141 		if (vdp->xdf_vd_open[i] & parbit)
2142 			rval = B_TRUE;
2143 	}
2144 
2145 	return (rval);
2146 }
2147 
2148 /*
2149  * Xdf_check_state_transition will check the XenbusState change to see
2150  * if the change is a valid transition or not.
2151  * The new state is written by backend domain, or by running xenstore-write
2152  * to change it manually in dom0
2153  */
2154 static int
2155 xdf_check_state_transition(xdf_t *vdp, XenbusState oestate)
2156 {
2157 	int status;
2158 	int stcheck;
2159 #define	STOK	0 /* need further process */
2160 #define	STNOP	1 /* no action need taking */
2161 #define	STBUG	2 /* unexpected state change, could be a bug */
2162 
2163 	status = vdp->xdf_status;
2164 	stcheck = STOK;
2165 
2166 	switch (status) {
2167 	case XD_UNKNOWN:
2168 		if ((oestate == XenbusStateUnknown)		||
2169 		    (oestate == XenbusStateConnected))
2170 			stcheck = STBUG;
2171 		else if ((oestate == XenbusStateInitialising)	||
2172 		    (oestate == XenbusStateInitWait)		||
2173 		    (oestate == XenbusStateInitialised))
2174 			stcheck = STNOP;
2175 		break;
2176 	case XD_INIT:
2177 		if (oestate == XenbusStateUnknown)
2178 			stcheck = STBUG;
2179 		else if ((oestate == XenbusStateInitialising)	||
2180 		    (oestate == XenbusStateInitWait)		||
2181 		    (oestate == XenbusStateInitialised))
2182 			stcheck = STNOP;
2183 		break;
2184 	case XD_READY:
2185 		if ((oestate == XenbusStateUnknown)		||
2186 		    (oestate == XenbusStateInitialising)	||
2187 		    (oestate == XenbusStateInitWait)		||
2188 		    (oestate == XenbusStateInitialised))
2189 			stcheck = STBUG;
2190 		else if (oestate == XenbusStateConnected)
2191 			stcheck = STNOP;
2192 		break;
2193 	case XD_CLOSING:
2194 		if ((oestate == XenbusStateUnknown)		||
2195 		    (oestate == XenbusStateInitialising)	||
2196 		    (oestate == XenbusStateInitWait)		||
2197 		    (oestate == XenbusStateInitialised)		||
2198 		    (oestate == XenbusStateConnected))
2199 			stcheck = STBUG;
2200 		else if (oestate == XenbusStateClosing)
2201 			stcheck = STNOP;
2202 		break;
2203 	case XD_CLOSED:
2204 		if ((oestate == XenbusStateUnknown)		||
2205 		    (oestate == XenbusStateConnected))
2206 			stcheck = STBUG;
2207 		else if ((oestate == XenbusStateInitWait)	||
2208 		    (oestate == XenbusStateInitialised)		||
2209 		    (oestate == XenbusStateClosing)		||
2210 		    (oestate == XenbusStateClosed))
2211 			stcheck = STNOP;
2212 		break;
2213 	case XD_SUSPEND:
2214 	default:
2215 			stcheck = STBUG;
2216 	}
2217 
2218 	if (stcheck == STOK)
2219 		return (DDI_SUCCESS);
2220 
2221 	if (stcheck == STBUG)
2222 		cmn_err(CE_NOTE, "xdf@%s: unexpected otherend "
2223 		    "state change to %d!, when status is %d",
2224 		    ddi_get_name_addr(vdp->xdf_dip), oestate, status);
2225 
2226 	return (DDI_FAILURE);
2227 }
2228 
2229 static int
2230 xdf_connect(xdf_t *vdp, boolean_t wait)
2231 {
2232 	ASSERT(mutex_owned(&vdp->xdf_dev_lk));
2233 	while (vdp->xdf_status != XD_READY) {
2234 		if (!wait || (vdp->xdf_status > XD_READY))
2235 			break;
2236 
2237 		if (cv_wait_sig(&vdp->xdf_dev_cv, &vdp->xdf_dev_lk) == 0)
2238 			break;
2239 	}
2240 
2241 	return (vdp->xdf_status);
2242 }
2243 
2244 /*
2245  * callback func when DMA/GTE resources is available
2246  *
2247  * Note: we only register one callback function to grant table subsystem
2248  * since we only have one 'struct gnttab_free_callback' in xdf_t.
2249  */
2250 static int
2251 xdf_dmacallback(caddr_t arg)
2252 {
2253 	xdf_t *vdp = (xdf_t *)arg;
2254 	ASSERT(vdp != NULL);
2255 
2256 	DPRINTF(DMA_DBG, ("xdf@%s: DMA callback started\n",
2257 	    ddi_get_name_addr(vdp->xdf_dip)));
2258 
2259 	ddi_trigger_softintr(vdp->xdf_softintr_id);
2260 	return (DDI_DMA_CALLBACK_DONE);
2261 }
2262 
2263 static uint_t
2264 xdf_iorestart(caddr_t arg)
2265 {
2266 	xdf_t *vdp = (xdf_t *)arg;
2267 
2268 	ASSERT(vdp != NULL);
2269 
2270 	mutex_enter(&vdp->xdf_dev_lk);
2271 	ASSERT(ISDMACBON(vdp));
2272 	SETDMACBOFF(vdp);
2273 	mutex_exit(&vdp->xdf_dev_lk);
2274 
2275 	xdf_iostart(vdp);
2276 
2277 	return (DDI_INTR_CLAIMED);
2278 }
2279 
2280 static void
2281 xdf_timeout_handler(void *arg)
2282 {
2283 	xdf_t *vdp = arg;
2284 
2285 	mutex_enter(&vdp->xdf_dev_lk);
2286 	vdp->xdf_timeout_id = 0;
2287 	mutex_exit(&vdp->xdf_dev_lk);
2288 
2289 	/* new timeout thread could be re-scheduled */
2290 	xdf_iostart(vdp);
2291 }
2292 
2293 /*
2294  * Alloc a vreq for this bp
2295  * bp->av_back contains the pointer to the vreq upon return
2296  */
2297 static v_req_t *
2298 vreq_get(xdf_t *vdp, buf_t *bp)
2299 {
2300 	v_req_t *vreq = NULL;
2301 
2302 	ASSERT(BP2VREQ(bp) == NULL);
2303 
2304 	vreq = kmem_cache_alloc(xdf_vreq_cache, KM_NOSLEEP);
2305 	if (vreq == NULL) {
2306 		if (vdp->xdf_timeout_id == 0)
2307 			/* restart I/O after one second */
2308 			vdp->xdf_timeout_id =
2309 			    timeout(xdf_timeout_handler, vdp, hz);
2310 		return (NULL);
2311 	}
2312 	bzero(vreq, sizeof (v_req_t));
2313 
2314 	list_insert_head(&vdp->xdf_vreq_act, (void *)vreq);
2315 	bp->av_back = (buf_t *)vreq;
2316 	vreq->v_buf = bp;
2317 	vreq->v_status = VREQ_INIT;
2318 	/* init of other fields in vreq is up to the caller */
2319 
2320 	return (vreq);
2321 }
2322 
2323 static void
2324 vreq_free(xdf_t *vdp, v_req_t *vreq)
2325 {
2326 	buf_t *bp = vreq->v_buf;
2327 
2328 	list_remove(&vdp->xdf_vreq_act, (void *)vreq);
2329 
2330 	if (vreq->v_flush_diskcache == FLUSH_DISKCACHE)
2331 		goto done;
2332 
2333 	switch (vreq->v_status) {
2334 	case VREQ_DMAWIN_DONE:
2335 	case VREQ_GS_ALLOCED:
2336 	case VREQ_DMABUF_BOUND:
2337 		(void) ddi_dma_unbind_handle(vreq->v_dmahdl);
2338 		/*FALLTHRU*/
2339 	case VREQ_DMAMEM_ALLOCED:
2340 		if (!ALIGNED_XFER(bp)) {
2341 			ASSERT(vreq->v_abuf != NULL);
2342 			if (!IS_ERROR(bp) && IS_READ(bp))
2343 				bcopy(vreq->v_abuf, bp->b_un.b_addr,
2344 				    bp->b_bcount);
2345 			ddi_dma_mem_free(&vreq->v_align);
2346 		}
2347 		/*FALLTHRU*/
2348 	case VREQ_MEMDMAHDL_ALLOCED:
2349 		if (!ALIGNED_XFER(bp))
2350 			ddi_dma_free_handle(&vreq->v_memdmahdl);
2351 		/*FALLTHRU*/
2352 	case VREQ_DMAHDL_ALLOCED:
2353 		ddi_dma_free_handle(&vreq->v_dmahdl);
2354 		break;
2355 	default:
2356 		break;
2357 	}
2358 done:
2359 	vreq->v_buf->av_back = NULL;
2360 	kmem_cache_free(xdf_vreq_cache, vreq);
2361 }
2362 
2363 /*
2364  * Initalize the DMA and grant table resources for the buf
2365  */
2366 static int
2367 vreq_setup(xdf_t *vdp, v_req_t *vreq)
2368 {
2369 	int rc;
2370 	ddi_dma_attr_t dmaattr;
2371 	uint_t ndcs, ndws;
2372 	ddi_dma_handle_t dh;
2373 	ddi_dma_handle_t mdh;
2374 	ddi_dma_cookie_t dc;
2375 	ddi_acc_handle_t abh;
2376 	caddr_t	aba;
2377 	ge_slot_t *gs;
2378 	size_t bufsz;
2379 	off_t off;
2380 	size_t sz;
2381 	buf_t *bp = vreq->v_buf;
2382 	int dma_flags = (IS_READ(bp) ? DDI_DMA_READ : DDI_DMA_WRITE) |
2383 	    DDI_DMA_STREAMING | DDI_DMA_PARTIAL;
2384 
2385 	switch (vreq->v_status) {
2386 	case VREQ_INIT:
2387 		if (IS_FLUSH_DISKCACHE(bp)) {
2388 			if ((gs = gs_get(vdp, IS_READ(bp))) == NULL) {
2389 				DPRINTF(DMA_DBG, (
2390 				    "xdf@%s: get ge_slotfailed\n",
2391 				    ddi_get_name_addr(vdp->xdf_dip)));
2392 				return (DDI_FAILURE);
2393 			}
2394 			vreq->v_blkno = 0;
2395 			vreq->v_nslots = 1;
2396 			vreq->v_gs = gs;
2397 			vreq->v_flush_diskcache = FLUSH_DISKCACHE;
2398 			vreq->v_status = VREQ_GS_ALLOCED;
2399 			gs->vreq = vreq;
2400 			return (DDI_SUCCESS);
2401 		}
2402 
2403 		if (IS_WRITE_BARRIER(vdp, bp))
2404 			vreq->v_flush_diskcache = WRITE_BARRIER;
2405 		vreq->v_blkno = bp->b_blkno +
2406 		    (diskaddr_t)(uintptr_t)bp->b_private;
2407 		bp->b_private = NULL;
2408 		/* See if we wrote new data to our flush block */
2409 		if (!IS_READ(bp) && USE_WRITE_BARRIER(vdp))
2410 			check_fbwrite(vdp, bp, vreq->v_blkno);
2411 		vreq->v_status = VREQ_INIT_DONE;
2412 		/*FALLTHRU*/
2413 
2414 	case VREQ_INIT_DONE:
2415 		/*
2416 		 * alloc DMA handle
2417 		 */
2418 		rc = ddi_dma_alloc_handle(vdp->xdf_dip, &xb_dma_attr,
2419 		    xdf_dmacallback, (caddr_t)vdp, &dh);
2420 		if (rc != DDI_SUCCESS) {
2421 			SETDMACBON(vdp);
2422 			DPRINTF(DMA_DBG, ("xdf@%s: DMA handle alloc failed\n",
2423 			    ddi_get_name_addr(vdp->xdf_dip)));
2424 			return (DDI_FAILURE);
2425 		}
2426 
2427 		vreq->v_dmahdl = dh;
2428 		vreq->v_status = VREQ_DMAHDL_ALLOCED;
2429 		/*FALLTHRU*/
2430 
2431 	case VREQ_DMAHDL_ALLOCED:
2432 		/*
2433 		 * alloc dma handle for 512-byte aligned buf
2434 		 */
2435 		if (!ALIGNED_XFER(bp)) {
2436 			/*
2437 			 * XXPV: we need to temporarily enlarge the seg
2438 			 * boundary and s/g length to work round CR6381968
2439 			 */
2440 			dmaattr = xb_dma_attr;
2441 			dmaattr.dma_attr_seg = (uint64_t)-1;
2442 			dmaattr.dma_attr_sgllen = INT_MAX;
2443 			rc = ddi_dma_alloc_handle(vdp->xdf_dip, &dmaattr,
2444 			    xdf_dmacallback, (caddr_t)vdp, &mdh);
2445 			if (rc != DDI_SUCCESS) {
2446 				SETDMACBON(vdp);
2447 				DPRINTF(DMA_DBG, ("xdf@%s: unaligned buf DMA"
2448 				    "handle alloc failed\n",
2449 				    ddi_get_name_addr(vdp->xdf_dip)));
2450 				return (DDI_FAILURE);
2451 			}
2452 			vreq->v_memdmahdl = mdh;
2453 			vreq->v_status = VREQ_MEMDMAHDL_ALLOCED;
2454 		}
2455 		/*FALLTHRU*/
2456 
2457 	case VREQ_MEMDMAHDL_ALLOCED:
2458 		/*
2459 		 * alloc 512-byte aligned buf
2460 		 */
2461 		if (!ALIGNED_XFER(bp)) {
2462 			if (bp->b_flags & (B_PAGEIO | B_PHYS))
2463 				bp_mapin(bp);
2464 
2465 			rc = ddi_dma_mem_alloc(vreq->v_memdmahdl,
2466 			    roundup(bp->b_bcount, XB_BSIZE), &xc_acc_attr,
2467 			    DDI_DMA_STREAMING, xdf_dmacallback, (caddr_t)vdp,
2468 			    &aba, &bufsz, &abh);
2469 			if (rc != DDI_SUCCESS) {
2470 				SETDMACBON(vdp);
2471 				DPRINTF(DMA_DBG, (
2472 				    "xdf@%s: DMA mem allocation failed\n",
2473 				    ddi_get_name_addr(vdp->xdf_dip)));
2474 				return (DDI_FAILURE);
2475 			}
2476 
2477 			vreq->v_abuf = aba;
2478 			vreq->v_align = abh;
2479 			vreq->v_status = VREQ_DMAMEM_ALLOCED;
2480 
2481 			ASSERT(bufsz >= bp->b_bcount);
2482 			if (!IS_READ(bp))
2483 				bcopy(bp->b_un.b_addr, vreq->v_abuf,
2484 				    bp->b_bcount);
2485 		}
2486 		/*FALLTHRU*/
2487 
2488 	case VREQ_DMAMEM_ALLOCED:
2489 		/*
2490 		 * dma bind
2491 		 */
2492 		if (ALIGNED_XFER(bp)) {
2493 			rc = ddi_dma_buf_bind_handle(vreq->v_dmahdl, bp,
2494 			    dma_flags, xdf_dmacallback, (caddr_t)vdp,
2495 			    &dc, &ndcs);
2496 		} else {
2497 			rc = ddi_dma_addr_bind_handle(vreq->v_dmahdl,
2498 			    NULL, vreq->v_abuf, bp->b_bcount, dma_flags,
2499 			    xdf_dmacallback, (caddr_t)vdp, &dc, &ndcs);
2500 		}
2501 		if (rc == DDI_DMA_MAPPED || rc == DDI_DMA_PARTIAL_MAP) {
2502 			/* get num of dma windows */
2503 			if (rc == DDI_DMA_PARTIAL_MAP) {
2504 				rc = ddi_dma_numwin(vreq->v_dmahdl, &ndws);
2505 				ASSERT(rc == DDI_SUCCESS);
2506 			} else {
2507 				ndws = 1;
2508 			}
2509 		} else {
2510 			SETDMACBON(vdp);
2511 			DPRINTF(DMA_DBG, ("xdf@%s: DMA bind failed\n",
2512 			    ddi_get_name_addr(vdp->xdf_dip)));
2513 			return (DDI_FAILURE);
2514 		}
2515 
2516 		vreq->v_dmac = dc;
2517 		vreq->v_dmaw = 0;
2518 		vreq->v_ndmacs = ndcs;
2519 		vreq->v_ndmaws = ndws;
2520 		vreq->v_nslots = ndws;
2521 		vreq->v_status = VREQ_DMABUF_BOUND;
2522 		/*FALLTHRU*/
2523 
2524 	case VREQ_DMABUF_BOUND:
2525 		/*
2526 		 * get ge_slot, callback is set upon failure from gs_get(),
2527 		 * if not set previously
2528 		 */
2529 		if ((gs = gs_get(vdp, IS_READ(bp))) == NULL) {
2530 			DPRINTF(DMA_DBG, ("xdf@%s: get ge_slot failed\n",
2531 			    ddi_get_name_addr(vdp->xdf_dip)));
2532 			return (DDI_FAILURE);
2533 		}
2534 
2535 		vreq->v_gs = gs;
2536 		gs->vreq = vreq;
2537 		vreq->v_status = VREQ_GS_ALLOCED;
2538 		break;
2539 
2540 	case VREQ_GS_ALLOCED:
2541 		/* nothing need to be done */
2542 		break;
2543 
2544 	case VREQ_DMAWIN_DONE:
2545 		/*
2546 		 * move to the next dma window
2547 		 */
2548 		ASSERT((vreq->v_dmaw + 1) < vreq->v_ndmaws);
2549 
2550 		/* get a ge_slot for this DMA window */
2551 		if ((gs = gs_get(vdp, IS_READ(bp))) == NULL) {
2552 			DPRINTF(DMA_DBG, ("xdf@%s: get ge_slot failed\n",
2553 			    ddi_get_name_addr(vdp->xdf_dip)));
2554 			return (DDI_FAILURE);
2555 		}
2556 
2557 		vreq->v_gs = gs;
2558 		gs->vreq = vreq;
2559 		vreq->v_dmaw++;
2560 		rc = ddi_dma_getwin(vreq->v_dmahdl, vreq->v_dmaw, &off, &sz,
2561 		    &vreq->v_dmac, &vreq->v_ndmacs);
2562 		ASSERT(rc == DDI_SUCCESS);
2563 		vreq->v_status = VREQ_GS_ALLOCED;
2564 		break;
2565 
2566 	default:
2567 		return (DDI_FAILURE);
2568 	}
2569 
2570 	return (DDI_SUCCESS);
2571 }
2572 
2573 static ge_slot_t *
2574 gs_get(xdf_t *vdp, int isread)
2575 {
2576 	grant_ref_t gh;
2577 	ge_slot_t *gs;
2578 
2579 	/* try to alloc GTEs needed in this slot, first */
2580 	if (gnttab_alloc_grant_references(
2581 	    BLKIF_MAX_SEGMENTS_PER_REQUEST, &gh) == -1) {
2582 		if (vdp->xdf_gnt_callback.next == NULL) {
2583 			SETDMACBON(vdp);
2584 			gnttab_request_free_callback(
2585 			    &vdp->xdf_gnt_callback,
2586 			    (void (*)(void *))xdf_dmacallback,
2587 			    (void *)vdp,
2588 			    BLKIF_MAX_SEGMENTS_PER_REQUEST);
2589 		}
2590 		return (NULL);
2591 	}
2592 
2593 	gs = kmem_cache_alloc(xdf_gs_cache, KM_NOSLEEP);
2594 	if (gs == NULL) {
2595 		gnttab_free_grant_references(gh);
2596 		if (vdp->xdf_timeout_id == 0)
2597 			/* restart I/O after one second */
2598 			vdp->xdf_timeout_id =
2599 			    timeout(xdf_timeout_handler, vdp, hz);
2600 		return (NULL);
2601 	}
2602 
2603 	/* init gs_slot */
2604 	list_insert_head(&vdp->xdf_gs_act, (void *)gs);
2605 	gs->oeid = vdp->xdf_peer;
2606 	gs->isread = isread;
2607 	gs->ghead = gh;
2608 	gs->ngrefs = 0;
2609 
2610 	return (gs);
2611 }
2612 
2613 static void
2614 gs_free(xdf_t *vdp, ge_slot_t *gs)
2615 {
2616 	int i;
2617 	grant_ref_t *gp = gs->ge;
2618 	int ngrefs = gs->ngrefs;
2619 	boolean_t isread = gs->isread;
2620 
2621 	list_remove(&vdp->xdf_gs_act, (void *)gs);
2622 
2623 	/* release all grant table entry resources used in this slot */
2624 	for (i = 0; i < ngrefs; i++, gp++)
2625 		gnttab_end_foreign_access(*gp, !isread, 0);
2626 	gnttab_free_grant_references(gs->ghead);
2627 
2628 	kmem_cache_free(xdf_gs_cache, (void *)gs);
2629 }
2630 
2631 static grant_ref_t
2632 gs_grant(ge_slot_t *gs, mfn_t mfn)
2633 {
2634 	grant_ref_t gr = gnttab_claim_grant_reference(&gs->ghead);
2635 
2636 	ASSERT(gr != -1);
2637 	ASSERT(gs->ngrefs < BLKIF_MAX_SEGMENTS_PER_REQUEST);
2638 	gs->ge[gs->ngrefs++] = gr;
2639 	gnttab_grant_foreign_access_ref(gr, gs->oeid, mfn, !gs->isread);
2640 
2641 	return (gr);
2642 }
2643 
2644 static void
2645 unexpectedie(xdf_t *vdp)
2646 {
2647 	/* clean up I/Os in ring that have responses */
2648 	if (xvdi_ring_has_unconsumed_responses(vdp->xdf_xb_ring)) {
2649 		mutex_exit(&vdp->xdf_dev_lk);
2650 		(void) xdf_intr((caddr_t)vdp);
2651 		mutex_enter(&vdp->xdf_dev_lk);
2652 	}
2653 
2654 	/* free up all grant table entries */
2655 	while (!list_is_empty(&vdp->xdf_gs_act))
2656 		gs_free(vdp, list_head(&vdp->xdf_gs_act));
2657 
2658 	/*
2659 	 * move bp back to active list orderly
2660 	 * vreq_busy is updated in vreq_free()
2661 	 */
2662 	while (!list_is_empty(&vdp->xdf_vreq_act)) {
2663 		v_req_t *vreq = list_head(&vdp->xdf_vreq_act);
2664 		buf_t *bp = vreq->v_buf;
2665 
2666 		bp->av_back = NULL;
2667 		bp->b_resid = bp->b_bcount;
2668 		if (vdp->xdf_f_act == NULL) {
2669 			vdp->xdf_f_act = vdp->xdf_l_act = bp;
2670 		} else {
2671 			/* move to the head of list */
2672 			bp->av_forw = vdp->xdf_f_act;
2673 			vdp->xdf_f_act = bp;
2674 		}
2675 		if (vdp->xdf_xdev_iostat != NULL)
2676 			kstat_runq_back_to_waitq(
2677 			    KSTAT_IO_PTR(vdp->xdf_xdev_iostat));
2678 		vreq_free(vdp, vreq);
2679 	}
2680 }
2681 
2682 static void
2683 xdfmin(struct buf *bp)
2684 {
2685 	if (bp->b_bcount > xdf_maxphys)
2686 		bp->b_bcount = xdf_maxphys;
2687 }
2688 
2689 void
2690 xdf_kstat_delete(dev_info_t *dip)
2691 {
2692 	xdf_t	*vdp = (xdf_t *)ddi_get_driver_private(dip);
2693 	kstat_t	*kstat;
2694 
2695 	/*
2696 	 * The locking order here is xdf_iostat_lk and then xdf_dev_lk.
2697 	 * xdf_dev_lk is used to protect the xdf_xdev_iostat pointer
2698 	 * and the contents of the our kstat.  xdf_iostat_lk is used
2699 	 * to protect the allocation and freeing of the actual kstat.
2700 	 * xdf_dev_lk can't be used for this purpose because kstat
2701 	 * readers use it to access the contents of the kstat and
2702 	 * hence it can't be held when calling kstat_delete().
2703 	 */
2704 	mutex_enter(&vdp->xdf_iostat_lk);
2705 	mutex_enter(&vdp->xdf_dev_lk);
2706 
2707 	if (vdp->xdf_xdev_iostat == NULL) {
2708 		mutex_exit(&vdp->xdf_dev_lk);
2709 		mutex_exit(&vdp->xdf_iostat_lk);
2710 		return;
2711 	}
2712 
2713 	kstat = vdp->xdf_xdev_iostat;
2714 	vdp->xdf_xdev_iostat = NULL;
2715 	mutex_exit(&vdp->xdf_dev_lk);
2716 
2717 	kstat_delete(kstat);
2718 	mutex_exit(&vdp->xdf_iostat_lk);
2719 }
2720 
2721 int
2722 xdf_kstat_create(dev_info_t *dip, char *ks_module, int ks_instance)
2723 {
2724 	xdf_t	*vdp = (xdf_t *)ddi_get_driver_private(dip);
2725 
2726 	/* See comment about locking in xdf_kstat_delete(). */
2727 	mutex_enter(&vdp->xdf_iostat_lk);
2728 	mutex_enter(&vdp->xdf_dev_lk);
2729 
2730 	if (vdp->xdf_xdev_iostat != NULL) {
2731 		mutex_exit(&vdp->xdf_dev_lk);
2732 		mutex_exit(&vdp->xdf_iostat_lk);
2733 		return (-1);
2734 	}
2735 
2736 	if ((vdp->xdf_xdev_iostat = kstat_create(
2737 	    ks_module, ks_instance, NULL, "disk",
2738 	    KSTAT_TYPE_IO, 1, KSTAT_FLAG_PERSISTENT)) == NULL) {
2739 		mutex_exit(&vdp->xdf_dev_lk);
2740 		mutex_exit(&vdp->xdf_iostat_lk);
2741 		return (-1);
2742 	}
2743 
2744 	vdp->xdf_xdev_iostat->ks_lock = &vdp->xdf_dev_lk;
2745 	kstat_install(vdp->xdf_xdev_iostat);
2746 	mutex_exit(&vdp->xdf_dev_lk);
2747 	mutex_exit(&vdp->xdf_iostat_lk);
2748 
2749 	return (0);
2750 }
2751 
2752 #if defined(XPV_HVM_DRIVER)
2753 
2754 typedef struct xdf_hvm_entry {
2755 	list_node_t	xdf_he_list;
2756 	char		*xdf_he_path;
2757 	dev_info_t	*xdf_he_dip;
2758 } xdf_hvm_entry_t;
2759 
2760 static list_t xdf_hvm_list;
2761 static kmutex_t xdf_hvm_list_lock;
2762 
2763 static xdf_hvm_entry_t *
2764 i_xdf_hvm_find(char *path, dev_info_t *dip)
2765 {
2766 	xdf_hvm_entry_t	*i;
2767 
2768 	ASSERT((path != NULL) || (dip != NULL));
2769 	ASSERT(MUTEX_HELD(&xdf_hvm_list_lock));
2770 
2771 	i = list_head(&xdf_hvm_list);
2772 	while (i != NULL) {
2773 		if ((path != NULL) && strcmp(i->xdf_he_path, path) != 0) {
2774 			i = list_next(&xdf_hvm_list, i);
2775 			continue;
2776 		}
2777 		if ((dip != NULL) && (i->xdf_he_dip != dip)) {
2778 			i = list_next(&xdf_hvm_list, i);
2779 			continue;
2780 		}
2781 		break;
2782 	}
2783 	return (i);
2784 }
2785 
2786 dev_info_t *
2787 xdf_hvm_hold(char *path)
2788 {
2789 	xdf_hvm_entry_t	*i;
2790 	dev_info_t	*dip;
2791 
2792 	mutex_enter(&xdf_hvm_list_lock);
2793 	i = i_xdf_hvm_find(path, NULL);
2794 	if (i == NULL) {
2795 		mutex_exit(&xdf_hvm_list_lock);
2796 		return (B_FALSE);
2797 	}
2798 	ndi_hold_devi(dip = i->xdf_he_dip);
2799 	mutex_exit(&xdf_hvm_list_lock);
2800 	return (dip);
2801 }
2802 
2803 static void
2804 xdf_hvm_add(dev_info_t *dip)
2805 {
2806 	xdf_hvm_entry_t	*i;
2807 	char		*path;
2808 
2809 	/* figure out the path for the dip */
2810 	path = kmem_zalloc(MAXPATHLEN, KM_SLEEP);
2811 	(void) ddi_pathname(dip, path);
2812 
2813 	i = kmem_alloc(sizeof (*i), KM_SLEEP);
2814 	i->xdf_he_dip = dip;
2815 	i->xdf_he_path = i_ddi_strdup(path, KM_SLEEP);
2816 
2817 	mutex_enter(&xdf_hvm_list_lock);
2818 	ASSERT(i_xdf_hvm_find(path, NULL) == NULL);
2819 	ASSERT(i_xdf_hvm_find(NULL, dip) == NULL);
2820 	list_insert_head(&xdf_hvm_list, i);
2821 	mutex_exit(&xdf_hvm_list_lock);
2822 
2823 	kmem_free(path, MAXPATHLEN);
2824 }
2825 
2826 static void
2827 xdf_hvm_rm(dev_info_t *dip)
2828 {
2829 	xdf_hvm_entry_t	*i;
2830 
2831 	mutex_enter(&xdf_hvm_list_lock);
2832 	VERIFY((i = i_xdf_hvm_find(NULL, dip)) != NULL);
2833 	list_remove(&xdf_hvm_list, i);
2834 	mutex_exit(&xdf_hvm_list_lock);
2835 
2836 	kmem_free(i->xdf_he_path, strlen(i->xdf_he_path) + 1);
2837 	kmem_free(i, sizeof (*i));
2838 }
2839 
2840 static void
2841 xdf_hvm_init(void)
2842 {
2843 	list_create(&xdf_hvm_list, sizeof (xdf_hvm_entry_t),
2844 	    offsetof(xdf_hvm_entry_t, xdf_he_list));
2845 	mutex_init(&xdf_hvm_list_lock, NULL, MUTEX_DEFAULT, NULL);
2846 }
2847 
2848 static void
2849 xdf_hvm_fini(void)
2850 {
2851 	ASSERT(list_head(&xdf_hvm_list) == NULL);
2852 	list_destroy(&xdf_hvm_list);
2853 	mutex_destroy(&xdf_hvm_list_lock);
2854 }
2855 
2856 int
2857 xdf_hvm_connect(dev_info_t *dip)
2858 {
2859 	xdf_t	*vdp = (xdf_t *)ddi_get_driver_private(dip);
2860 	int	rv;
2861 
2862 	/* do cv_wait until connected or failed */
2863 	mutex_enter(&vdp->xdf_dev_lk);
2864 	rv = xdf_connect(vdp, B_TRUE);
2865 	mutex_exit(&vdp->xdf_dev_lk);
2866 	return ((rv == XD_READY) ? 0 : -1);
2867 }
2868 
2869 int
2870 xdf_hvm_setpgeom(dev_info_t *dip, cmlb_geom_t *geomp)
2871 {
2872 	xdf_t	*vdp = (xdf_t *)ddi_get_driver_private(dip);
2873 
2874 	/* sanity check the requested physical geometry */
2875 	mutex_enter(&vdp->xdf_dev_lk);
2876 	if ((geomp->g_secsize != XB_BSIZE) ||
2877 	    (geomp->g_capacity == 0)) {
2878 		mutex_exit(&vdp->xdf_dev_lk);
2879 		return (EINVAL);
2880 	}
2881 
2882 	/*
2883 	 * If we've already connected to the backend device then make sure
2884 	 * we're not defining a physical geometry larger than our backend
2885 	 * device.
2886 	 */
2887 	if ((vdp->xdf_xdev_nblocks != 0) &&
2888 	    (geomp->g_capacity > vdp->xdf_xdev_nblocks)) {
2889 		mutex_exit(&vdp->xdf_dev_lk);
2890 		return (EINVAL);
2891 	}
2892 
2893 	vdp->xdf_pgeom = *geomp;
2894 	mutex_exit(&vdp->xdf_dev_lk);
2895 
2896 	/* force a re-validation */
2897 	cmlb_invalidate(vdp->xdf_vd_lbl, NULL);
2898 
2899 	return (0);
2900 }
2901 
2902 #endif /* XPV_HVM_DRIVER */
2903