xref: /netbsd-src/sys/arch/x86/x86/bus_dma.c (revision 47bfd0ee808ed4081131bc76192fa7efb0c9c0c3)

/*	$NetBSD: bus_dma.c,v 1.91 2024/06/04 21:42:58 riastradh Exp $	*/

/*-
 * Copyright (c) 1996, 1997, 1998, 2007, 2020 The NetBSD Foundation, Inc.
 * All rights reserved.
 *
 * This code is derived from software contributed to The NetBSD Foundation
 * by Charles M. Hannum and by Jason R. Thorpe of the Numerical Aerospace
 * Simulation Facility NASA Ames Research Center, and by Andrew Doran.
 *
 * Redistribution and use in source and binary forms, with or without
 * modification, are permitted provided that the following conditions
 * are met:
 * 1. Redistributions of source code must retain the above copyright
 *    notice, this list of conditions and the following disclaimer.
 * 2. Redistributions in binary form must reproduce the above copyright
 *    notice, this list of conditions and the following disclaimer in the
 *    documentation and/or other materials provided with the distribution.
 *
 * THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS
 * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
 * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
 * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS
 * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
 * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
 * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
 * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
 * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
 * POSSIBILITY OF SUCH DAMAGE.
 */

#include <sys/cdefs.h>
__KERNEL_RCSID(0, "$NetBSD: bus_dma.c,v 1.91 2024/06/04 21:42:58 riastradh Exp $");

/*
 * The following is included because _bus_dma_uiomove is derived from
 * uiomove() in kern_subr.c.
 */

/*
 * Copyright (c) 1982, 1986, 1991, 1993
 *	The Regents of the University of California.  All rights reserved.
 * (c) UNIX System Laboratories, Inc.
 * All or some portions of this file are derived from material licensed
 * to the University of California by American Telephone and Telegraph
 * Co. or Unix System Laboratories, Inc. and are reproduced herein with
 * the permission of UNIX System Laboratories, Inc.
 *
 * Copyright (c) 1992, 1993
 *	The Regents of the University of California.  All rights reserved.
 *
 * This software was developed by the Computer Systems Engineering group
 * at Lawrence Berkeley Laboratory under DARPA contract BG 91-66 and
 * contributed to Berkeley.
 *
 * All advertising materials mentioning features or use of this software
 * must display the following acknowledgement:
 *	This product includes software developed by the University of
 *	California, Lawrence Berkeley Laboratory.
 *
 * Redistribution and use in source and binary forms, with or without
 * modification, are permitted provided that the following conditions
 * are met:
 * 1. Redistributions of source code must retain the above copyright
 *    notice, this list of conditions and the following disclaimer.
 * 2. Redistributions in binary form must reproduce the above copyright
 *    notice, this list of conditions and the following disclaimer in the
 *    documentation and/or other materials provided with the distribution.
 * 3. Neither the name of the University nor the names of its contributors
 *    may be used to endorse or promote products derived from this software
 *    without specific prior written permission.
 *
 * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
 * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
 * SUCH DAMAGE.
 */

#include "ioapic.h"
#include "isa.h"
#include "opt_mpbios.h"

#include <sys/param.h>
#include <sys/systm.h>
#include <sys/kernel.h>
#include <sys/kmem.h>
#include <sys/malloc.h>
#include <sys/mbuf.h>
#include <sys/proc.h>
#include <sys/asan.h>
#include <sys/msan.h>

#include <sys/bus.h>
#include <machine/bus_private.h>
#if NIOAPIC > 0
#include <machine/i82093var.h>
#endif
#ifdef MPBIOS
#include <machine/mpbiosvar.h>
#endif
#include <machine/pmap_private.h>

#if NISA > 0
#include <dev/isa/isareg.h>
#include <dev/isa/isavar.h>
#endif

#include <uvm/uvm.h>

extern	paddr_t avail_end;

#define	IDTVEC(name)	__CONCAT(X,name)
typedef void (vector)(void);
extern vector *IDTVEC(intr)[];

#define	BUSDMA_BOUNCESTATS

#ifdef BUSDMA_BOUNCESTATS
#define	BUSDMA_EVCNT_DECL(name)						\
static struct evcnt bus_dma_ev_##name =					\
    EVCNT_INITIALIZER(EVCNT_TYPE_MISC, NULL, "bus_dma", #name);		\
EVCNT_ATTACH_STATIC(bus_dma_ev_##name)

#define	STAT_INCR(name)							\
    bus_dma_ev_##name.ev_count++
#define	STAT_DECR(name)							\
    bus_dma_ev_##name.ev_count--

BUSDMA_EVCNT_DECL(nbouncebufs);
BUSDMA_EVCNT_DECL(loads);
BUSDMA_EVCNT_DECL(bounces);
#else
#define STAT_INCR(x)
#define STAT_DECR(x)
#endif

static int	_bus_dmamap_create(bus_dma_tag_t, bus_size_t, int, bus_size_t,
	    bus_size_t, int, bus_dmamap_t *);
static void	_bus_dmamap_destroy(bus_dma_tag_t, bus_dmamap_t);
static int	_bus_dmamap_load(bus_dma_tag_t, bus_dmamap_t, void *,
	    bus_size_t, struct proc *, int);
static int	_bus_dmamap_load_mbuf(bus_dma_tag_t, bus_dmamap_t,
	    struct mbuf *, int);
static int	_bus_dmamap_load_uio(bus_dma_tag_t, bus_dmamap_t,
	    struct uio *, int);
static int	_bus_dmamap_load_raw(bus_dma_tag_t, bus_dmamap_t,
	    bus_dma_segment_t *, int, bus_size_t, int);
static void	_bus_dmamap_unload(bus_dma_tag_t, bus_dmamap_t);
static void	_bus_dmamap_sync(bus_dma_tag_t, bus_dmamap_t, bus_addr_t,
	    bus_size_t, int);

static int	_bus_dmamem_alloc(bus_dma_tag_t tag, bus_size_t size,
	    bus_size_t alignment, bus_size_t boundary,
	    bus_dma_segment_t *segs, int nsegs, int *rsegs, int flags);
static void	_bus_dmamem_free(bus_dma_tag_t tag, bus_dma_segment_t *segs,
	    int nsegs);
static int	_bus_dmamem_map(bus_dma_tag_t tag, bus_dma_segment_t *segs,
	    int nsegs, size_t size, void **kvap, int flags);
static void	_bus_dmamem_unmap(bus_dma_tag_t tag, void *kva, size_t size);
static paddr_t	_bus_dmamem_mmap(bus_dma_tag_t tag, bus_dma_segment_t *segs,
	    int nsegs, off_t off, int prot, int flags);

static int	_bus_dmatag_subregion(bus_dma_tag_t tag, bus_addr_t min_addr,
	    bus_addr_t max_addr, bus_dma_tag_t *newtag, int flags);
static void	_bus_dmatag_destroy(bus_dma_tag_t tag);

static int _bus_dma_uiomove(void *, struct uio *, size_t, int);
static int _bus_dma_alloc_bouncebuf(bus_dma_tag_t t, bus_dmamap_t map,
	    bus_size_t size, int flags);
static void _bus_dma_free_bouncebuf(bus_dma_tag_t t, bus_dmamap_t map);
static int _bus_dmamap_load_buffer(bus_dma_tag_t t, bus_dmamap_t map,
	    void *buf, bus_size_t buflen, struct vmspace *vm, int flags);
static int _bus_dmamap_load_busaddr(bus_dma_tag_t, bus_dmamap_t,
    bus_addr_t, bus_size_t);

#ifndef _BUS_DMAMEM_ALLOC_RANGE
static int	_bus_dmamem_alloc_range(bus_dma_tag_t tag, bus_size_t size,
	    bus_size_t alignment, bus_size_t boundary,
	    bus_dma_segment_t *segs, int nsegs, int *rsegs, int flags,
	    bus_addr_t low, bus_addr_t high);

#define _BUS_DMAMEM_ALLOC_RANGE _bus_dmamem_alloc_range

/*
 * Allocate physical memory from the given physical address range.
 * Called by DMA-safe memory allocation methods.
 */
static int
_bus_dmamem_alloc_range(bus_dma_tag_t t, bus_size_t size,
    bus_size_t alignment, bus_size_t boundary, bus_dma_segment_t *segs,
    int nsegs, int *rsegs, int flags, bus_addr_t low, bus_addr_t high)
{
	paddr_t curaddr, lastaddr;
	struct vm_page *m;
	struct pglist mlist;
	int curseg, error;
	bus_size_t uboundary;

	/* Always round the size. */
	size = round_page(size);

	KASSERTMSG(boundary >= PAGE_SIZE || boundary == 0,
	    "boundary=0x%"PRIxBUSSIZE, boundary);

	/*
	 * Allocate pages from the VM system.
	 * We accept boundaries < size, splitting in multiple segments
	 * if needed. uvm_pglistalloc does not, so compute an appropriate
	 * boundary: next power of 2 >= size
	 */

	if (boundary == 0)
		uboundary = 0;
	else {
		uboundary = boundary;
		while (uboundary < size)
			uboundary = uboundary << 1;
	}
	error = uvm_pglistalloc(size, low, high, alignment, uboundary,
	    &mlist, nsegs, (flags & BUS_DMA_NOWAIT) == 0);
	if (error)
		return (error);

	/*
	 * Compute the location, size, and number of segments actually
	 * returned by the VM code.
	 */
	m = TAILQ_FIRST(&mlist);
	curseg = 0;
	lastaddr = segs[curseg].ds_addr = VM_PAGE_TO_PHYS(m);
	segs[curseg].ds_len = PAGE_SIZE;
	m = m->pageq.queue.tqe_next;

	for (; m != NULL; m = m->pageq.queue.tqe_next) {
		curaddr = VM_PAGE_TO_PHYS(m);
		KASSERTMSG(curaddr >= low, "curaddr=%#"PRIxPADDR
		    " low=%#"PRIxBUSADDR" high=%#"PRIxBUSADDR,
		    curaddr, low, high);
		KASSERTMSG(curaddr < high, "curaddr=%#"PRIxPADDR
		    " low=%#"PRIxBUSADDR" high=%#"PRIxBUSADDR,
		    curaddr, low, high);
		if (curaddr == (lastaddr + PAGE_SIZE) &&
		    (lastaddr & boundary) == (curaddr & boundary)) {
			segs[curseg].ds_len += PAGE_SIZE;
		} else {
			curseg++;
			KASSERTMSG(curseg < nsegs, "curseg %d size %llx",
			    curseg, (long long)size);
			segs[curseg].ds_addr = curaddr;
			segs[curseg].ds_len = PAGE_SIZE;
		}
		lastaddr = curaddr;
	}

	*rsegs = curseg + 1;

	return (0);
}
#endif /* _BUS_DMAMEM_ALLOC_RANGE */

/*
 * Create a DMA map.
 */
static int
_bus_dmamap_create(bus_dma_tag_t t, bus_size_t size, int nsegments,
    bus_size_t maxsegsz, bus_size_t boundary, int flags, bus_dmamap_t *dmamp)
{
	struct x86_bus_dma_cookie *cookie;
	bus_dmamap_t map;
	int error, cookieflags;
	void *cookiestore, *mapstore;
	size_t cookiesize, mapsize;

	/*
	 * Allocate and initialize the DMA map.  The end of the map
	 * is a variable-sized array of segments, so we allocate enough
	 * room for them in one shot.
	 *
	 * Note we don't preserve the WAITOK or NOWAIT flags.  Preservation
	 * of ALLOCNOW notifies others that we've reserved these resources,
	 * and they are not to be freed.
	 *
	 * The bus_dmamap_t includes one bus_dma_segment_t, hence
	 * the (nsegments - 1).
	 */
	error = 0;
	mapsize = sizeof(struct x86_bus_dmamap) +
	    (sizeof(bus_dma_segment_t) * (nsegments - 1));
	if ((mapstore = malloc(mapsize, M_DMAMAP, M_ZERO |
	    ((flags & BUS_DMA_NOWAIT) ? M_NOWAIT : M_WAITOK))) == NULL)
		return (ENOMEM);

	map = (struct x86_bus_dmamap *)mapstore;
	map->_dm_size = size;
	map->_dm_segcnt = nsegments;
	map->_dm_maxmaxsegsz = maxsegsz;
	map->_dm_boundary = boundary;
	map->_dm_bounce_thresh = t->_bounce_thresh;
	map->_dm_flags = flags & ~(BUS_DMA_WAITOK|BUS_DMA_NOWAIT);
	map->dm_maxsegsz = maxsegsz;
	map->dm_mapsize = 0;		/* no valid mappings */
	map->dm_nsegs = 0;

	if (t->_bounce_thresh == 0 || _BUS_AVAIL_END <= t->_bounce_thresh - 1)
		map->_dm_bounce_thresh = 0;
	cookieflags = 0;

	if (t->_may_bounce != NULL) {
		error = t->_may_bounce(t, map, flags, &cookieflags);
		if (error != 0)
			goto out;
	}

	if (map->_dm_bounce_thresh != 0)
		cookieflags |= X86_DMA_MIGHT_NEED_BOUNCE;

	if ((cookieflags & X86_DMA_MIGHT_NEED_BOUNCE) == 0) {
		*dmamp = map;
		return 0;
	}

	cookiesize = sizeof(struct x86_bus_dma_cookie) +
	    (sizeof(bus_dma_segment_t) * map->_dm_segcnt);

	/*
	 * Allocate our cookie.
	 */
	if ((cookiestore = malloc(cookiesize, M_DMAMAP, M_ZERO |
	    ((flags & BUS_DMA_NOWAIT) ? M_NOWAIT : M_WAITOK))) == NULL) {
		error = ENOMEM;
		goto out;
	}
	cookie = (struct x86_bus_dma_cookie *)cookiestore;
	cookie->id_flags = cookieflags;
	map->_dm_cookie = cookie;

	error = _bus_dma_alloc_bouncebuf(t, map, size, flags);
 out:
	if (error)
		_bus_dmamap_destroy(t, map);
	else
		*dmamp = map;

	return (error);
}

/*
 * Destroy a DMA map.
 */
static void
_bus_dmamap_destroy(bus_dma_tag_t t, bus_dmamap_t map)
{
	struct x86_bus_dma_cookie *cookie = map->_dm_cookie;

	/*
	 * Free any bounce pages this map might hold.
	 */
	if (cookie != NULL) {
		if (cookie->id_flags & X86_DMA_HAS_BOUNCE)
			_bus_dma_free_bouncebuf(t, map);
		free(cookie, M_DMAMAP);
	}

	free(map, M_DMAMAP);
}

/*
 * Load a DMA map with a linear buffer.
 */
static int
_bus_dmamap_load(bus_dma_tag_t t, bus_dmamap_t map, void *buf,
    bus_size_t buflen, struct proc *p, int flags)
{
	struct x86_bus_dma_cookie *cookie = map->_dm_cookie;
	int error;
	struct vmspace *vm;

	STAT_INCR(loads);

	/*
	 * Make sure that on error condition we return "no valid mappings."
	 */
	map->dm_mapsize = 0;
	map->dm_nsegs = 0;
	KASSERTMSG(map->dm_maxsegsz <= map->_dm_maxmaxsegsz,
	    "maxsegsz=0x%"PRIxBUSSIZE", maxmaxsegsz=0x%"PRIxBUSSIZE,
	    map->dm_maxsegsz, map->_dm_maxmaxsegsz);

	if (buflen > map->_dm_size)
		return EINVAL;

	if (p != NULL) {
		vm = p->p_vmspace;
	} else {
		vm = vmspace_kernel();
	}
	error = _bus_dmamap_load_buffer(t, map, buf, buflen, vm, flags);
	if (error == 0) {
		if (cookie != NULL)
			cookie->id_flags &= ~X86_DMA_IS_BOUNCING;
		map->dm_mapsize = buflen;
		return 0;
	}

	if (cookie == NULL ||
	    (cookie->id_flags & X86_DMA_MIGHT_NEED_BOUNCE) == 0)
		return error;

	/*
	 * First attempt failed; bounce it.
	 */

	STAT_INCR(bounces);

	/*
	 * Allocate bounce pages, if necessary.
	 */
	if ((cookie->id_flags & X86_DMA_HAS_BOUNCE) == 0) {
		error = _bus_dma_alloc_bouncebuf(t, map, buflen, flags);
		if (error)
			return (error);
	}

	/*
	 * Cache a pointer to the caller's buffer and load the DMA map
	 * with the bounce buffer.
	 */
	cookie->id_origbuf = buf;
	cookie->id_origbuflen = buflen;
	cookie->id_buftype = X86_DMA_BUFTYPE_LINEAR;
	map->dm_nsegs = 0;
	error = bus_dmamap_load(t, map, cookie->id_bouncebuf, buflen,
	    p, flags);
	if (error)
		return (error);

	/* ...so _bus_dmamap_sync() knows we're bouncing */
	cookie->id_flags |= X86_DMA_IS_BOUNCING;
	return (0);
}

static int
_bus_dmamap_load_busaddr(bus_dma_tag_t t, bus_dmamap_t map,
    bus_addr_t addr, bus_size_t size)
{
	bus_dma_segment_t * const segs = map->dm_segs;
	int nseg = map->dm_nsegs;
	bus_addr_t bmask = ~(map->_dm_boundary - 1);
	bus_addr_t lastaddr = 0xdead; /* XXX gcc */
	bus_size_t sgsize;

	if (nseg > 0)
		lastaddr = segs[nseg-1].ds_addr + segs[nseg-1].ds_len;
again:
	sgsize = size;
	/*
	 * Make sure we don't cross any boundaries.
	 */
	if (map->_dm_boundary > 0) {
		bus_addr_t baddr; /* next boundary address */

		baddr = (addr + map->_dm_boundary) & bmask;
		if (sgsize > (baddr - addr))
			sgsize = (baddr - addr);
	}

	/*
	 * Insert chunk into a segment, coalescing with
	 * previous segment if possible.
	 */
	if (nseg > 0 && addr == lastaddr &&
	    segs[nseg-1].ds_len + sgsize <= map->dm_maxsegsz &&
	    (map->_dm_boundary == 0 ||
	     (segs[nseg-1].ds_addr & bmask) == (addr & bmask))) {
		/* coalesce */
		segs[nseg-1].ds_len += sgsize;
	} else if (nseg >= map->_dm_segcnt) {
		return EFBIG;
	} else {
		/* new segment */
		segs[nseg].ds_addr = addr;
		segs[nseg].ds_len = sgsize;
		nseg++;
	}

	lastaddr = addr + sgsize;
	if (map->_dm_bounce_thresh != 0 && lastaddr > map->_dm_bounce_thresh)
		return EINVAL;

	addr += sgsize;
	size -= sgsize;
	if (size > 0)
		goto again;

	map->dm_nsegs = nseg;
	return 0;
}

/*
 * Like _bus_dmamap_load(), but for mbufs.
 */
static int
_bus_dmamap_load_mbuf(bus_dma_tag_t t, bus_dmamap_t map, struct mbuf *m0,
    int flags)
{
	struct x86_bus_dma_cookie *cookie = map->_dm_cookie;
	int error;
	struct mbuf *m;

	/*
	 * Make sure on error condition we return "no valid mappings."
	 */
	map->dm_mapsize = 0;
	map->dm_nsegs = 0;
	KASSERTMSG(map->dm_maxsegsz <= map->_dm_maxmaxsegsz,
	    "maxsegsz=0x%"PRIxBUSSIZE", maxmaxsegsz=0x%"PRIxBUSSIZE,
	    map->dm_maxsegsz, map->_dm_maxmaxsegsz);

	KASSERTMSG(m0->m_flags & M_PKTHDR, "m0=%p m_flags=0x%x", m0,
	    m0->m_flags);
	if (m0->m_pkthdr.len > map->_dm_size)
		return (EINVAL);

	error = 0;
	for (m = m0; m != NULL && error == 0; m = m->m_next) {
		int offset;
		int remainbytes;
		const struct vm_page * const *pgs;
		paddr_t paddr;
		int size;

		if (m->m_len == 0)
			continue;
		switch (m->m_flags & (M_EXT|M_EXT_CLUSTER|M_EXT_PAGES)) {
		case M_EXT|M_EXT_CLUSTER:
			/* XXX KDASSERT */
			KASSERT(m->m_ext.ext_paddr != M_PADDR_INVALID);
			paddr = m->m_ext.ext_paddr +
			    (m->m_data - m->m_ext.ext_buf);
			size = m->m_len;
			error = _bus_dmamap_load_busaddr(t, map,
			    _BUS_PHYS_TO_BUS(paddr), size);
			break;

		case M_EXT|M_EXT_PAGES:
			KASSERTMSG(m->m_ext.ext_buf <= m->m_data,
			    "m=%p m_ext.ext_buf=%p m_ext.ext_size=%zu"
			    " m_data=%p",
			    m, m->m_ext.ext_buf, m->m_ext.ext_size, m->m_data);
			KASSERTMSG((m->m_data <=
				m->m_ext.ext_buf + m->m_ext.ext_size),
			    "m=%p m_ext.ext_buf=%p m_ext.ext_size=%zu"
			    " m_data=%p",
			    m, m->m_ext.ext_buf, m->m_ext.ext_size, m->m_data);

			offset = (vaddr_t)m->m_data -
			    trunc_page((vaddr_t)m->m_ext.ext_buf);
			remainbytes = m->m_len;

			/* skip uninteresting pages */
			pgs = (const struct vm_page * const *)
			    m->m_ext.ext_pgs + (offset >> PAGE_SHIFT);

			offset &= PAGE_MASK; /* offset in the first page */

			/* load each pages */
			while (remainbytes > 0) {
				const struct vm_page *pg;
				bus_addr_t busaddr;

				size = MIN(remainbytes, PAGE_SIZE - offset);

				pg = *pgs++;
				KASSERT(pg);
				busaddr = _BUS_VM_PAGE_TO_BUS(pg) + offset;

				error = _bus_dmamap_load_busaddr(t, map,
				    busaddr, size);
				if (error)
					break;
				offset = 0;
				remainbytes -= size;
			}
			break;

		case 0:
			paddr = m->m_paddr + M_BUFOFFSET(m) +
			    (m->m_data - M_BUFADDR(m));
			size = m->m_len;
			error = _bus_dmamap_load_busaddr(t, map,
			    _BUS_PHYS_TO_BUS(paddr), size);
			break;

		default:
			error = _bus_dmamap_load_buffer(t, map, m->m_data,
			    m->m_len, vmspace_kernel(), flags);
		}
	}
	if (error == 0) {
		map->dm_mapsize = m0->m_pkthdr.len;
		return 0;
	}

	map->dm_nsegs = 0;

	if (cookie == NULL ||
	    (cookie->id_flags & X86_DMA_MIGHT_NEED_BOUNCE) == 0)
		return error;

	/*
	 * First attempt failed; bounce it.
	 */

	STAT_INCR(bounces);

	/*
	 * Allocate bounce pages, if necessary.
	 */
	if ((cookie->id_flags & X86_DMA_HAS_BOUNCE) == 0) {
		error = _bus_dma_alloc_bouncebuf(t, map, m0->m_pkthdr.len,
		    flags);
		if (error)
			return (error);
	}

	/*
	 * Cache a pointer to the caller's buffer and load the DMA map
	 * with the bounce buffer.
	 */
	cookie->id_origbuf = m0;
	cookie->id_origbuflen = m0->m_pkthdr.len;	/* not really used */
	cookie->id_buftype = X86_DMA_BUFTYPE_MBUF;
	error = bus_dmamap_load(t, map, cookie->id_bouncebuf,
	    m0->m_pkthdr.len, NULL, flags);
	if (error)
		return (error);

	/* ...so _bus_dmamap_sync() knows we're bouncing */
	cookie->id_flags |= X86_DMA_IS_BOUNCING;
	return (0);
}

/*
 * Like _bus_dmamap_load(), but for uios.
 */
static int
_bus_dmamap_load_uio(bus_dma_tag_t t, bus_dmamap_t map, struct uio *uio,
    int flags)
{
	int i, error;
	bus_size_t minlen, resid;
	struct vmspace *vm;
	struct iovec *iov;
	void *addr;
	struct x86_bus_dma_cookie *cookie = map->_dm_cookie;

	/*
	 * Make sure that on error condition we return "no valid mappings."
	 */
	map->dm_mapsize = 0;
	map->dm_nsegs = 0;
	KASSERTMSG(map->dm_maxsegsz <= map->_dm_maxmaxsegsz,
	    "maxsegsz=0x%"PRIxBUSSIZE", maxmaxsegsz=0x%"PRIxBUSSIZE,
	    map->dm_maxsegsz, map->_dm_maxmaxsegsz);

	resid = uio->uio_resid;
	iov = uio->uio_iov;

	vm = uio->uio_vmspace;

	error = 0;
	for (i = 0; i < uio->uio_iovcnt && resid != 0 && error == 0; i++) {
		/*
		 * Now at the first iovec to load.  Load each iovec
		 * until we have exhausted the residual count.
		 */
		minlen = resid < iov[i].iov_len ? resid : iov[i].iov_len;
		addr = (void *)iov[i].iov_base;

		error = _bus_dmamap_load_buffer(t, map, addr, minlen,
		    vm, flags);

		resid -= minlen;
	}
	if (error == 0) {
		map->dm_mapsize = uio->uio_resid;
		return 0;
	}

	map->dm_nsegs = 0;

	if (cookie == NULL ||
	    (cookie->id_flags & X86_DMA_MIGHT_NEED_BOUNCE) == 0)
		return error;

	STAT_INCR(bounces);

	/*
	 * Allocate bounce pages, if necessary.
	 */
	if ((cookie->id_flags & X86_DMA_HAS_BOUNCE) == 0) {
		error = _bus_dma_alloc_bouncebuf(t, map, uio->uio_resid,
		    flags);
		if (error)
			return (error);
	}

	/*
	 * Cache a pointer to the caller's buffer and load the DMA map
	 * with the bounce buffer.
	 */
	cookie->id_origbuf = uio;
	cookie->id_origbuflen = uio->uio_resid;
	cookie->id_buftype = X86_DMA_BUFTYPE_UIO;
	error = bus_dmamap_load(t, map, cookie->id_bouncebuf,
	    uio->uio_resid, NULL, flags);
	if (error)
		return (error);

	/* ...so _bus_dmamap_sync() knows we're bouncing */
	cookie->id_flags |= X86_DMA_IS_BOUNCING;
	return (0);
}

/*
 * Like _bus_dmamap_load(), but for raw memory allocated with
 * bus_dmamem_alloc().
 */
static int
_bus_dmamap_load_raw(bus_dma_tag_t t, bus_dmamap_t map,
    bus_dma_segment_t *segs, int nsegs, bus_size_t size0, int flags)
{
	bus_size_t size;
	int i, error = 0;

	/*
	 * Make sure that on error condition we return "no valid mappings."
	 */
	map->dm_mapsize = 0;
	map->dm_nsegs = 0;
	KASSERTMSG(map->dm_maxsegsz <= map->_dm_maxmaxsegsz,
	    "maxsegsz=0x%"PRIxBUSSIZE", maxmaxsegsz=0x%"PRIxBUSSIZE,
	    map->dm_maxsegsz, map->_dm_maxmaxsegsz);

	if (size0 > map->_dm_size)
		return EINVAL;

	for (i = 0, size = size0; i < nsegs && size > 0; i++) {
		bus_dma_segment_t *ds = &segs[i];
		bus_size_t sgsize;

		sgsize = MIN(ds->ds_len, size);
		if (sgsize == 0)
			continue;
		error = _bus_dmamap_load_busaddr(t, map, ds->ds_addr, sgsize);
		if (error != 0)
			break;
		size -= sgsize;
	}

	if (error != 0) {
		map->dm_mapsize = 0;
		map->dm_nsegs = 0;
		return error;
	}

	/* XXX TBD bounce */

	map->dm_mapsize = size0;
	return 0;
}

/*
 * Unload a DMA map.
 */
static void
_bus_dmamap_unload(bus_dma_tag_t t, bus_dmamap_t map)
{
	struct x86_bus_dma_cookie *cookie = map->_dm_cookie;

	/*
	 * If we have bounce pages, free them, unless they're
	 * reserved for our exclusive use.
	 */
	if (cookie != NULL) {
		cookie->id_flags &= ~X86_DMA_IS_BOUNCING;
		cookie->id_buftype = X86_DMA_BUFTYPE_INVALID;
	}
	map->dm_maxsegsz = map->_dm_maxmaxsegsz;
	map->dm_mapsize = 0;
	map->dm_nsegs = 0;
}

/*
 * Synchronize a DMA map.
 *
 * Reference:
 *
 *	AMD64 Architecture Programmer's Manual, Volume 2: System
 *	Programming, 24593--Rev. 3.38--November 2021, Sec. 7.4.2 Memory
 *	Barrier Interaction with Memory Types, Table 7-3, p. 196.
 *	https://web.archive.org/web/20220625040004/https://www.amd.com/system/files/TechDocs/24593.pdf#page=256
 */
static void
_bus_dmamap_sync(bus_dma_tag_t t, bus_dmamap_t map, bus_addr_t offset,
    bus_size_t len, int ops)
{
	struct x86_bus_dma_cookie *cookie = map->_dm_cookie;

	/*
	 * Mixing PRE and POST operations is not allowed.
	 */
	if ((ops & (BUS_DMASYNC_PREREAD|BUS_DMASYNC_PREWRITE)) != 0 &&
	    (ops & (BUS_DMASYNC_POSTREAD|BUS_DMASYNC_POSTWRITE)) != 0)
		panic("%s: mix PRE and POST", __func__);

	if ((ops & (BUS_DMASYNC_PREWRITE|BUS_DMASYNC_POSTREAD)) != 0) {
		KASSERTMSG(offset < map->dm_mapsize,
		    "bad offset 0x%"PRIxBUSADDR" >= 0x%"PRIxBUSSIZE,
		    offset, map->dm_mapsize);
		KASSERTMSG(len <= map->dm_mapsize - offset,
		    "bad length 0x%"PRIxBUSADDR" + 0x%"PRIxBUSSIZE
		    " > 0x%"PRIxBUSSIZE,
		    offset, len, map->dm_mapsize);
	}

	/*
	 * BUS_DMASYNC_POSTREAD: The caller has been alerted to DMA
	 * completion by reading a register or DMA descriptor, and the
	 * caller is about to read out of the DMA memory buffer that
	 * the device just filled.
	 *
	 * => LFENCE ensures that these happen in order so that the
	 *    caller, or the bounce buffer logic here, doesn't proceed
	 *    to read any stale data from cache or speculation.  x86
	 *    never reorders loads from wp/wt/wb or uc memory, but it
	 *    may execute loads from wc/wc+ memory early, e.g. with
	 *    BUS_SPACE_MAP_PREFETCHABLE.
	 */
	if (ops & BUS_DMASYNC_POSTREAD)
		x86_lfence();

	/*
	 * If we're not bouncing, just return; nothing to do.
	 */
	if (len == 0 || cookie == NULL ||
	    (cookie->id_flags & X86_DMA_IS_BOUNCING) == 0)
		goto end;

	switch (cookie->id_buftype) {
	case X86_DMA_BUFTYPE_LINEAR:
		/*
		 * Nothing to do for pre-read.
		 */

		if (ops & BUS_DMASYNC_PREWRITE) {
			/*
			 * Copy the caller's buffer to the bounce buffer.
			 */
			memcpy((char *)cookie->id_bouncebuf + offset,
			    (char *)cookie->id_origbuf + offset, len);
		}

		if (ops & BUS_DMASYNC_POSTREAD) {
			/*
			 * Copy the bounce buffer to the caller's buffer.
			 */
			memcpy((char *)cookie->id_origbuf + offset,
			    (char *)cookie->id_bouncebuf + offset, len);
		}

		/*
		 * Nothing to do for post-write.
		 */
		break;

	case X86_DMA_BUFTYPE_MBUF:
	    {
		struct mbuf *m, *m0 = cookie->id_origbuf;
		bus_size_t minlen, moff;

		/*
		 * Nothing to do for pre-read.
		 */

		if (ops & BUS_DMASYNC_PREWRITE) {
			/*
			 * Copy the caller's buffer to the bounce buffer.
			 */
			m_copydata(m0, offset, len,
			    (char *)cookie->id_bouncebuf + offset);
		}

		if (ops & BUS_DMASYNC_POSTREAD) {
			/*
			 * Copy the bounce buffer to the caller's buffer.
			 */
			for (moff = offset, m = m0; m != NULL && len != 0;
			     m = m->m_next) {
				/* Find the beginning mbuf. */
				if (moff >= m->m_len) {
					moff -= m->m_len;
					continue;
				}

				/*
				 * Now at the first mbuf to sync; nail
				 * each one until we have exhausted the
				 * length.
				 */
				minlen = len < m->m_len - moff ?
				    len : m->m_len - moff;

				memcpy(mtod(m, char *) + moff,
				    (char *)cookie->id_bouncebuf + offset,
				    minlen);

				moff = 0;
				len -= minlen;
				offset += minlen;
			}
		}

		/*
		 * Nothing to do for post-write.
		 */
		break;
	    }
	case X86_DMA_BUFTYPE_UIO:
	    {
		struct uio *uio;

		uio = (struct uio *)cookie->id_origbuf;

		/*
		 * Nothing to do for pre-read.
		 */

		if (ops & BUS_DMASYNC_PREWRITE) {
			/*
			 * Copy the caller's buffer to the bounce buffer.
			 */
			_bus_dma_uiomove((char *)cookie->id_bouncebuf + offset,
			    uio, len, UIO_WRITE);
		}

		if (ops & BUS_DMASYNC_POSTREAD) {
			_bus_dma_uiomove((char *)cookie->id_bouncebuf + offset,
			    uio, len, UIO_READ);
		}

		/*
		 * Nothing to do for post-write.
		 */
		break;
	    }

	case X86_DMA_BUFTYPE_RAW:
		panic("%s: X86_DMA_BUFTYPE_RAW", __func__);
		break;

	case X86_DMA_BUFTYPE_INVALID:
		panic("%s: X86_DMA_BUFTYPE_INVALID", __func__);
		break;

	default:
		panic("%s: unknown buffer type %d", __func__,
		    cookie->id_buftype);
		break;
	}
end:
	/*
	 * BUS_DMASYNC_PREREAD: The caller may have previously been
	 * using a DMA memory buffer, with loads and stores, and is
	 * about to trigger DMA by writing to a register or DMA
	 * descriptor.
	 *
	 * => SFENCE ensures that the stores happen in order, in case
	 *    the latter one is non-temporal or to wc/wc+ memory and
	 *    thus may be executed early.  x86 never reorders
	 *    load;store to store;load for any memory type, so no
	 *    barrier is needed for prior loads.
	 *
	 * BUS_DMASYNC_PREWRITE: The caller has just written to a DMA
	 * memory buffer, or we just wrote to to the bounce buffer,
	 * data that the device needs to use, and the caller is about
	 * to trigger DMA by writing to a register or DMA descriptor.
	 *
	 * => SFENCE ensures that these happen in order so that any
	 *    buffered stores are visible to the device before the DMA
	 *    is triggered.  x86 never reorders (non-temporal) stores
	 *    to wp/wt/wb or uc memory, but it may reorder two stores
	 *    if one is to wc/wc+ memory, e.g. if the DMA descriptor is
	 *    mapped with BUS_SPACE_MAP_PREFETCHABLE.
	 */
	if (ops & (BUS_DMASYNC_PREREAD|BUS_DMASYNC_PREWRITE))
		x86_sfence();

	/*
	 * BUS_DMASYNC_POSTWRITE: The caller has been alerted to DMA
	 * completion by reading a register or DMA descriptor, and the
	 * caller may proceed to reuse the DMA memory buffer, with
	 * loads and stores.
	 *
	 * => No barrier is needed.  Since the DMA memory buffer is not
	 *    changing (we're sending data to the device, not receiving
	 *    data from the device), prefetched loads are safe.  x86
	 *    never reoreders load;store to store;load for any memory
	 *    type, so early execution of stores prior to witnessing
	 *    the DMA completion is not possible.
	 */
}

/*
 * Allocate memory safe for DMA.
 */
static int
_bus_dmamem_alloc(bus_dma_tag_t t, bus_size_t size, bus_size_t alignment,
    bus_size_t boundary, bus_dma_segment_t *segs, int nsegs, int *rsegs,
    int flags)
{
	bus_addr_t high;

	if (t->_bounce_alloc_hi != 0 && _BUS_AVAIL_END > t->_bounce_alloc_hi - 1)
		high = t->_bounce_alloc_hi - 1;
	else
		high = _BUS_AVAIL_END;

	return (_BUS_DMAMEM_ALLOC_RANGE(t, size, alignment, boundary,
	    segs, nsegs, rsegs, flags, t->_bounce_alloc_lo, high));
}

static int
_bus_dma_alloc_bouncebuf(bus_dma_tag_t t, bus_dmamap_t map,
    bus_size_t size, int flags)
{
	struct x86_bus_dma_cookie *cookie = map->_dm_cookie;
	int error = 0;

	KASSERT(cookie != NULL);

	cookie->id_bouncebuflen = round_page(size);
	error = _bus_dmamem_alloc(t, cookie->id_bouncebuflen,
	    PAGE_SIZE, map->_dm_boundary, cookie->id_bouncesegs,
	    map->_dm_segcnt, &cookie->id_nbouncesegs, flags);
	if (error) {
		cookie->id_bouncebuflen = 0;
		cookie->id_nbouncesegs = 0;
		return error;
	}

	error = _bus_dmamem_map(t, cookie->id_bouncesegs,
	    cookie->id_nbouncesegs, cookie->id_bouncebuflen,
	    (void **)&cookie->id_bouncebuf, flags);

	if (error) {
		_bus_dmamem_free(t, cookie->id_bouncesegs,
		    cookie->id_nbouncesegs);
		cookie->id_bouncebuflen = 0;
		cookie->id_nbouncesegs = 0;
	} else {
		cookie->id_flags |= X86_DMA_HAS_BOUNCE;
		STAT_INCR(nbouncebufs);
	}

	return (error);
}

static void
_bus_dma_free_bouncebuf(bus_dma_tag_t t, bus_dmamap_t map)
{
	struct x86_bus_dma_cookie *cookie = map->_dm_cookie;

	KASSERT(cookie != NULL);

	STAT_DECR(nbouncebufs);

	_bus_dmamem_unmap(t, cookie->id_bouncebuf, cookie->id_bouncebuflen);
	_bus_dmamem_free(t, cookie->id_bouncesegs,
	    cookie->id_nbouncesegs);
	cookie->id_bouncebuflen = 0;
	cookie->id_nbouncesegs = 0;
	cookie->id_flags &= ~X86_DMA_HAS_BOUNCE;
}


/*
 * This function does the same as uiomove, but takes an explicit
 * direction, and does not update the uio structure.
 */
static int
_bus_dma_uiomove(void *buf, struct uio *uio, size_t n, int direction)
{
	struct iovec *iov;
	int error;
	struct vmspace *vm;
	char *cp;
	size_t resid, cnt;
	int i;

	iov = uio->uio_iov;
	vm = uio->uio_vmspace;
	cp = buf;
	resid = n;

	for (i = 0; i < uio->uio_iovcnt && resid > 0; i++) {
		iov = &uio->uio_iov[i];
		if (iov->iov_len == 0)
			continue;
		cnt = MIN(resid, iov->iov_len);

		if (!VMSPACE_IS_KERNEL_P(vm)) {
			preempt_point();
		}
		if (direction == UIO_READ) {
			error = copyout_vmspace(vm, cp, iov->iov_base, cnt);
		} else {
			error = copyin_vmspace(vm, iov->iov_base, cp, cnt);
		}
		if (error)
			return (error);
		cp += cnt;
		resid -= cnt;
	}
	return (0);
}

/*
 * Common function for freeing DMA-safe memory.  May be called by
 * bus-specific DMA memory free functions.
 */
static void
_bus_dmamem_free(bus_dma_tag_t t, bus_dma_segment_t *segs, int nsegs)
{
	struct vm_page *m;
	bus_addr_t addr;
	struct pglist mlist;
	int curseg;

	/*
	 * Build a list of pages to free back to the VM system.
	 */
	TAILQ_INIT(&mlist);
	for (curseg = 0; curseg < nsegs; curseg++) {
		for (addr = segs[curseg].ds_addr;
		    addr < (segs[curseg].ds_addr + segs[curseg].ds_len);
		    addr += PAGE_SIZE) {
			m = _BUS_BUS_TO_VM_PAGE(addr);
			TAILQ_INSERT_TAIL(&mlist, m, pageq.queue);
		}
	}

	uvm_pglistfree(&mlist);
}

/*
 * Common function for mapping DMA-safe memory.  May be called by
 * bus-specific DMA memory map functions.
 * This supports BUS_DMA_NOCACHE and BUS_DMA_PREFETCHABLE.
 */
static int
_bus_dmamem_map(bus_dma_tag_t t, bus_dma_segment_t *segs, int nsegs,
    size_t size, void **kvap, int flags)
{
	vaddr_t va;
	bus_addr_t addr;
	int curseg;
	const uvm_flag_t kmflags =
	    (flags & BUS_DMA_NOWAIT) != 0 ? UVM_KMF_NOWAIT : 0;
	u_int pmapflags = PMAP_WIRED | VM_PROT_READ | VM_PROT_WRITE;

	size = round_page(size);
	KASSERTMSG(((flags & (BUS_DMA_NOCACHE|BUS_DMA_PREFETCHABLE)) !=
		(BUS_DMA_NOCACHE|BUS_DMA_PREFETCHABLE)),
	    "BUS_DMA_NOCACHE and BUS_DMA_PREFETCHABLE are mutually exclusive");
	if (flags & BUS_DMA_NOCACHE)
		pmapflags |= PMAP_NOCACHE;
	if (flags & BUS_DMA_PREFETCHABLE)
		pmapflags |= PMAP_WRITE_COMBINE;

	va = uvm_km_alloc(kernel_map, size, 0, UVM_KMF_VAONLY | kmflags);

	if (va == 0)
		return ENOMEM;

	*kvap = (void *)va;

	for (curseg = 0; curseg < nsegs; curseg++) {
		for (addr = segs[curseg].ds_addr;
		    addr < (segs[curseg].ds_addr + segs[curseg].ds_len);
		    addr += PAGE_SIZE, va += PAGE_SIZE, size -= PAGE_SIZE) {
			if (size == 0)
				panic("_bus_dmamem_map: size botch");
			_BUS_PMAP_ENTER(pmap_kernel(), va, addr,
			    VM_PROT_READ | VM_PROT_WRITE,
			    pmapflags);
		}
	}
	pmap_update(pmap_kernel());

	return 0;
}

/*
 * Common function for unmapping DMA-safe memory.  May be called by
 * bus-specific DMA memory unmapping functions.
 */

static void
_bus_dmamem_unmap(bus_dma_tag_t t, void *kva, size_t size)
{
	pt_entry_t *pte, opte;
	vaddr_t va, sva, eva;

	KASSERTMSG(((uintptr_t)kva & PGOFSET) == 0, "kva=%p", kva);

	size = round_page(size);
	sva = (vaddr_t)kva;
	eva = sva + size;

	/*
	 * mark pages cacheable again.
	 */
	for (va = sva; va < eva; va += PAGE_SIZE) {
		pte = kvtopte(va);
		opte = *pte;
		if ((opte & PTE_PCD) != 0)
			pmap_pte_clearbits(pte, PTE_PCD);
	}
	pmap_remove(pmap_kernel(), (vaddr_t)kva, (vaddr_t)kva + size);
	pmap_update(pmap_kernel());
	uvm_km_free(kernel_map, (vaddr_t)kva, size, UVM_KMF_VAONLY);
}

/*
 * Common function for mmap(2)'ing DMA-safe memory.  May be called by
 * bus-specific DMA mmap(2)'ing functions.
 */
static paddr_t
_bus_dmamem_mmap(bus_dma_tag_t t, bus_dma_segment_t *segs, int nsegs,
    off_t off, int prot, int flags)
{
	int i;

	for (i = 0; i < nsegs; i++) {
		KASSERTMSG((off & PGOFSET) == 0, "off=0x%jx", (uintmax_t)off);
		KASSERTMSG((segs[i].ds_addr & PGOFSET) == 0,
		    "segs[%u].ds_addr=%"PRIxBUSADDR, i, segs[i].ds_addr);
		KASSERTMSG((segs[i].ds_len & PGOFSET) == 0,
		    "segs[%u].ds_len=%"PRIxBUSSIZE, i, segs[i].ds_len);
		if (off >= segs[i].ds_len) {
			off -= segs[i].ds_len;
			continue;
		}

		return (x86_btop(_BUS_BUS_TO_PHYS(segs[i].ds_addr + off)));
	}

	/* Page not found. */
	return (-1);
}

/**********************************************************************
 * DMA utility functions
 **********************************************************************/

/*
 * Utility function to load a linear buffer.
 */
static int
_bus_dmamap_load_buffer(bus_dma_tag_t t, bus_dmamap_t map, void *buf,
    bus_size_t buflen, struct vmspace *vm, int flags)
{
	bus_size_t sgsize;
	bus_addr_t curaddr;
	vaddr_t vaddr = (vaddr_t)buf;
	pmap_t pmap;

	if (vm != NULL)
		pmap = vm_map_pmap(&vm->vm_map);
	else
		pmap = pmap_kernel();

	while (buflen > 0) {
		int error;

		/*
		 * Get the bus address for this segment.
		 */
		curaddr = _BUS_VIRT_TO_BUS(pmap, vaddr);

		/*
		 * Compute the segment size, and adjust counts.
		 */
		sgsize = PAGE_SIZE - ((u_long)vaddr & PGOFSET);
		if (buflen < sgsize)
			sgsize = buflen;

		/*
		 * If we're beyond the bounce threshold, notify
		 * the caller.
		 */
		if (map->_dm_bounce_thresh != 0 &&
		    curaddr + sgsize >= map->_dm_bounce_thresh)
			return (EINVAL);


		error = _bus_dmamap_load_busaddr(t, map, curaddr, sgsize);
		if (error)
			return error;

		vaddr += sgsize;
		buflen -= sgsize;
	}

	return (0);
}

static int
_bus_dmatag_subregion(bus_dma_tag_t tag, bus_addr_t min_addr,
		      bus_addr_t max_addr, bus_dma_tag_t *newtag, int flags)
{

	if ((tag->_bounce_thresh != 0   && max_addr >= tag->_bounce_thresh - 1) &&
	    (tag->_bounce_alloc_hi != 0 && max_addr >= tag->_bounce_alloc_hi - 1) &&
	    (min_addr <= tag->_bounce_alloc_lo)) {
		*newtag = tag;
		/* if the tag must be freed, add a reference */
		if (tag->_tag_needs_free)
			(tag->_tag_needs_free)++;
		return 0;
	}

	if ((*newtag = malloc(sizeof(struct x86_bus_dma_tag), M_DMAMAP,
	    (flags & BUS_DMA_NOWAIT) ? M_NOWAIT : M_WAITOK)) == NULL)
		return ENOMEM;

	**newtag = *tag;
	(*newtag)->_tag_needs_free = 1;

	if (tag->_bounce_thresh == 0 || max_addr < tag->_bounce_thresh)
		(*newtag)->_bounce_thresh = max_addr;
	if (tag->_bounce_alloc_hi == 0 || max_addr < tag->_bounce_alloc_hi)
		(*newtag)->_bounce_alloc_hi = max_addr;
	if (min_addr > tag->_bounce_alloc_lo)
		(*newtag)->_bounce_alloc_lo = min_addr;

	return 0;
}

static void
_bus_dmatag_destroy(bus_dma_tag_t tag)
{

	switch (tag->_tag_needs_free) {
	case 0:
		break;				/* not allocated with malloc */
	case 1:
		free(tag, M_DMAMAP);		/* last reference to tag */
		break;
	default:
		(tag->_tag_needs_free)--;	/* one less reference */
	}
}


void
bus_dmamap_sync(bus_dma_tag_t t, bus_dmamap_t p, bus_addr_t o, bus_size_t l,
		int ops)
{
	bus_dma_tag_t it;

	kasan_dma_sync(p, o, l, ops);
	kmsan_dma_sync(p, o, l, ops);

	if ((t->bdt_exists & BUS_DMAMAP_OVERRIDE_SYNC) == 0)
		;	/* skip override */
	else for (it = t; it != NULL; it = it->bdt_super) {
		if ((it->bdt_present & BUS_DMAMAP_OVERRIDE_SYNC) == 0)
			continue;
		(*it->bdt_ov->ov_dmamap_sync)(it->bdt_ctx, t, p, o,
		    l, ops);
		return;
	}

	_bus_dmamap_sync(t, p, o, l, ops);
}

int
bus_dmamap_create(bus_dma_tag_t t, bus_size_t size, int nsegments,
		  bus_size_t maxsegsz, bus_size_t boundary, int flags,
		  bus_dmamap_t *dmamp)
{
	bus_dma_tag_t it;

	if ((t->bdt_exists & BUS_DMAMAP_OVERRIDE_CREATE) == 0)
		;	/* skip override */
	else for (it = t; it != NULL; it = it->bdt_super) {
		if ((it->bdt_present & BUS_DMAMAP_OVERRIDE_CREATE) == 0)
			continue;
		return (*it->bdt_ov->ov_dmamap_create)(it->bdt_ctx, t, size,
		    nsegments, maxsegsz, boundary, flags, dmamp);
	}

	return _bus_dmamap_create(t, size, nsegments, maxsegsz,
	    boundary, flags, dmamp);
}

void
bus_dmamap_destroy(bus_dma_tag_t t, bus_dmamap_t dmam)
{
	bus_dma_tag_t it;

	if ((t->bdt_exists & BUS_DMAMAP_OVERRIDE_DESTROY) == 0)
		;	/* skip override */
	else for (it = t; it != NULL; it = it->bdt_super) {
		if ((it->bdt_present & BUS_DMAMAP_OVERRIDE_DESTROY) == 0)
			continue;
		(*it->bdt_ov->ov_dmamap_destroy)(it->bdt_ctx, t, dmam);
		return;
	}

	_bus_dmamap_destroy(t, dmam);
}

int
bus_dmamap_load(bus_dma_tag_t t, bus_dmamap_t dmam, void *buf,
		bus_size_t buflen, struct proc *p, int flags)
{
	bus_dma_tag_t it;

	kasan_dma_load(dmam, buf, buflen, KASAN_DMA_LINEAR);
	kmsan_dma_load(dmam, buf, buflen, KMSAN_DMA_LINEAR);

	if ((t->bdt_exists & BUS_DMAMAP_OVERRIDE_LOAD) == 0)
		;	/* skip override */
	else for (it = t; it != NULL; it = it->bdt_super) {
		if ((it->bdt_present & BUS_DMAMAP_OVERRIDE_LOAD) == 0)
			continue;
		return (*it->bdt_ov->ov_dmamap_load)(it->bdt_ctx, t, dmam,
		    buf, buflen, p, flags);
	}

	return _bus_dmamap_load(t, dmam, buf, buflen, p, flags);
}

int
bus_dmamap_load_mbuf(bus_dma_tag_t t, bus_dmamap_t dmam,
		     struct mbuf *chain, int flags)
{
	bus_dma_tag_t it;

	kasan_dma_load(dmam, chain, 0, KASAN_DMA_MBUF);
	kmsan_dma_load(dmam, chain, 0, KMSAN_DMA_MBUF);

	if ((t->bdt_exists & BUS_DMAMAP_OVERRIDE_LOAD_MBUF) == 0)
		;	/* skip override */
	else for (it = t; it != NULL; it = it->bdt_super) {
		if ((it->bdt_present & BUS_DMAMAP_OVERRIDE_LOAD_MBUF) == 0)
			continue;
		return (*it->bdt_ov->ov_dmamap_load_mbuf)(it->bdt_ctx, t, dmam,
		    chain, flags);
	}

	return _bus_dmamap_load_mbuf(t, dmam, chain, flags);
}

int
bus_dmamap_load_uio(bus_dma_tag_t t, bus_dmamap_t dmam,
		    struct uio *uio, int flags)
{
	bus_dma_tag_t it;

	kasan_dma_load(dmam, uio, 0, KASAN_DMA_UIO);
	kmsan_dma_load(dmam, uio, 0, KMSAN_DMA_UIO);

	if ((t->bdt_exists & BUS_DMAMAP_OVERRIDE_LOAD_UIO) == 0)
		;	/* skip override */
	else for (it = t; it != NULL; it = it->bdt_super) {
		if ((it->bdt_present & BUS_DMAMAP_OVERRIDE_LOAD_UIO) == 0)
			continue;
		return (*it->bdt_ov->ov_dmamap_load_uio)(it->bdt_ctx, t, dmam,
		    uio, flags);
	}

	return _bus_dmamap_load_uio(t, dmam, uio, flags);
}

int
bus_dmamap_load_raw(bus_dma_tag_t t, bus_dmamap_t dmam,
		    bus_dma_segment_t *segs, int nsegs,
		    bus_size_t size, int flags)
{
	bus_dma_tag_t it;

	kasan_dma_load(dmam, NULL, 0, KASAN_DMA_RAW);
	kmsan_dma_load(dmam, NULL, 0, KMSAN_DMA_RAW);

	if ((t->bdt_exists & BUS_DMAMAP_OVERRIDE_LOAD_RAW) == 0)
		;	/* skip override */
	else for (it = t; it != NULL; it = it->bdt_super) {
		if ((it->bdt_present & BUS_DMAMAP_OVERRIDE_LOAD_RAW) == 0)
			continue;
		return (*it->bdt_ov->ov_dmamap_load_raw)(it->bdt_ctx, t, dmam,
		    segs, nsegs, size, flags);
	}

	return _bus_dmamap_load_raw(t, dmam, segs, nsegs, size, flags);
}

void
bus_dmamap_unload(bus_dma_tag_t t, bus_dmamap_t dmam)
{
	bus_dma_tag_t it;

	if ((t->bdt_exists & BUS_DMAMAP_OVERRIDE_UNLOAD) == 0)
		;	/* skip override */
	else for (it = t; it != NULL; it = it->bdt_super) {
		if ((it->bdt_present & BUS_DMAMAP_OVERRIDE_UNLOAD) == 0)
			continue;
		(*it->bdt_ov->ov_dmamap_unload)(it->bdt_ctx, t, dmam);
		return;
	}

	_bus_dmamap_unload(t, dmam);
}

int
bus_dmamem_alloc(bus_dma_tag_t t, bus_size_t size, bus_size_t alignment,
		 bus_size_t boundary, bus_dma_segment_t *segs, int nsegs,
		 int *rsegs, int flags)
{
	bus_dma_tag_t it;

	if ((t->bdt_exists & BUS_DMAMEM_OVERRIDE_ALLOC) == 0)
		;	/* skip override */
	else for (it = t; it != NULL; it = it->bdt_super) {
		if ((it->bdt_present & BUS_DMAMEM_OVERRIDE_ALLOC) == 0)
			continue;
		return (*it->bdt_ov->ov_dmamem_alloc)(it->bdt_ctx, t, size,
		    alignment, boundary, segs, nsegs, rsegs, flags);
	}

	return _bus_dmamem_alloc(t, size, alignment, boundary, segs,
	    nsegs, rsegs, flags);
}

void
bus_dmamem_free(bus_dma_tag_t t, bus_dma_segment_t *segs, int nsegs)
{
	bus_dma_tag_t it;

	if ((t->bdt_exists & BUS_DMAMEM_OVERRIDE_FREE) == 0)
		;	/* skip override */
	else for (it = t; it != NULL; it = it->bdt_super) {
		if ((it->bdt_present & BUS_DMAMEM_OVERRIDE_FREE) == 0)
			continue;
		(*it->bdt_ov->ov_dmamem_free)(it->bdt_ctx, t, segs, nsegs);
		return;
	}

	_bus_dmamem_free(t, segs, nsegs);
}

int
bus_dmamem_map(bus_dma_tag_t t, bus_dma_segment_t *segs, int nsegs,
	       size_t size, void **kvap, int flags)
{
	bus_dma_tag_t it;

	if ((t->bdt_exists & BUS_DMAMEM_OVERRIDE_MAP) == 0)
		;	/* skip override */
	else for (it = t; it != NULL; it = it->bdt_super) {
		if ((it->bdt_present & BUS_DMAMEM_OVERRIDE_MAP) == 0)
			continue;
		return (*it->bdt_ov->ov_dmamem_map)(it->bdt_ctx, t,
		    segs, nsegs, size, kvap, flags);
	}

	return _bus_dmamem_map(t, segs, nsegs, size, kvap, flags);
}

void
bus_dmamem_unmap(bus_dma_tag_t t, void *kva, size_t size)
{
	bus_dma_tag_t it;

	if ((t->bdt_exists & BUS_DMAMEM_OVERRIDE_UNMAP) == 0)
		;	/* skip override */
	else for (it = t; it != NULL; it = it->bdt_super) {
		if ((it->bdt_present & BUS_DMAMEM_OVERRIDE_UNMAP) == 0)
			continue;
		(*it->bdt_ov->ov_dmamem_unmap)(it->bdt_ctx, t, kva, size);
		return;
	}

	_bus_dmamem_unmap(t, kva, size);
}

paddr_t
bus_dmamem_mmap(bus_dma_tag_t t, bus_dma_segment_t *segs, int nsegs,
		off_t off, int prot, int flags)
{
	bus_dma_tag_t it;

	if ((t->bdt_exists & BUS_DMAMEM_OVERRIDE_MMAP) == 0)
		;	/* skip override */
	else for (it = t; it != NULL; it = it->bdt_super) {
		if ((it->bdt_present & BUS_DMAMEM_OVERRIDE_MMAP) == 0)
			continue;
		return (*it->bdt_ov->ov_dmamem_mmap)(it->bdt_ctx, t, segs,
		    nsegs, off, prot, flags);
	}

	return _bus_dmamem_mmap(t, segs, nsegs, off, prot, flags);
}

int
bus_dmatag_subregion(bus_dma_tag_t t, bus_addr_t min_addr,
		     bus_addr_t max_addr, bus_dma_tag_t *newtag, int flags)
{
	bus_dma_tag_t it;

	if ((t->bdt_exists & BUS_DMATAG_OVERRIDE_SUBREGION) == 0)
		;	/* skip override */
	else for (it = t; it != NULL; it = it->bdt_super) {
		if ((it->bdt_present & BUS_DMATAG_OVERRIDE_SUBREGION) == 0)
			continue;
		return (*it->bdt_ov->ov_dmatag_subregion)(it->bdt_ctx, t,
		    min_addr, max_addr, newtag, flags);
	}

	return _bus_dmatag_subregion(t, min_addr, max_addr, newtag, flags);
}

void
bus_dmatag_destroy(bus_dma_tag_t t)
{
	bus_dma_tag_t it;

	if ((t->bdt_exists & BUS_DMATAG_OVERRIDE_DESTROY) == 0)
		;	/* skip override */
	else for (it = t; it != NULL; it = it->bdt_super) {
		if ((it->bdt_present & BUS_DMATAG_OVERRIDE_DESTROY) == 0)
			continue;
		(*it->bdt_ov->ov_dmatag_destroy)(it->bdt_ctx, t);
		return;
	}

	_bus_dmatag_destroy(t);
}

static const void *
bit_to_function_pointer(const struct bus_dma_overrides *ov, uint64_t bit)
{
	switch (bit) {
	case BUS_DMAMAP_OVERRIDE_CREATE:
		return ov->ov_dmamap_create;
	case BUS_DMAMAP_OVERRIDE_DESTROY:
		return ov->ov_dmamap_destroy;
	case BUS_DMAMAP_OVERRIDE_LOAD:
		return ov->ov_dmamap_load;
	case BUS_DMAMAP_OVERRIDE_LOAD_MBUF:
		return ov->ov_dmamap_load_mbuf;
	case BUS_DMAMAP_OVERRIDE_LOAD_UIO:
		return ov->ov_dmamap_load_uio;
	case BUS_DMAMAP_OVERRIDE_LOAD_RAW:
		return ov->ov_dmamap_load_raw;
	case BUS_DMAMAP_OVERRIDE_UNLOAD:
		return ov->ov_dmamap_unload;
	case BUS_DMAMAP_OVERRIDE_SYNC:
		return ov->ov_dmamap_sync;
	case BUS_DMAMEM_OVERRIDE_ALLOC:
		return ov->ov_dmamem_alloc;
	case BUS_DMAMEM_OVERRIDE_FREE:
		return ov->ov_dmamem_free;
	case BUS_DMAMEM_OVERRIDE_MAP:
		return ov->ov_dmamem_map;
	case BUS_DMAMEM_OVERRIDE_UNMAP:
		return ov->ov_dmamem_unmap;
	case BUS_DMAMEM_OVERRIDE_MMAP:
		return ov->ov_dmamem_mmap;
	case BUS_DMATAG_OVERRIDE_SUBREGION:
		return ov->ov_dmatag_subregion;
	case BUS_DMATAG_OVERRIDE_DESTROY:
		return ov->ov_dmatag_destroy;
	default:
		return NULL;
	}
}

void
bus_dma_tag_destroy(bus_dma_tag_t bdt)
{
	if (bdt->bdt_super != NULL)
		bus_dmatag_destroy(bdt->bdt_super);
	kmem_free(bdt, sizeof(struct x86_bus_dma_tag));
}

int
bus_dma_tag_create(bus_dma_tag_t obdt, const uint64_t present,
    const struct bus_dma_overrides *ov, void *ctx, bus_dma_tag_t *bdtp)
{
	uint64_t bit, bits, nbits;
	bus_dma_tag_t bdt;
	const void *fp;

	if (ov == NULL || present == 0)
		return EINVAL;

	bdt = kmem_alloc(sizeof(struct x86_bus_dma_tag), KM_SLEEP);
	*bdt = *obdt;
	/* don't let bus_dmatag_destroy free these */
	bdt->_tag_needs_free = 0;

	bdt->bdt_super = obdt;

	for (bits = present; bits != 0; bits = nbits) {
		nbits = bits & (bits - 1);
		bit = nbits ^ bits;
		if ((fp = bit_to_function_pointer(ov, bit)) == NULL) {
#ifdef DEBUG
			printf("%s: missing bit %" PRIx64 "\n", __func__, bit);
#endif
			goto einval;
		}
	}

	bdt->bdt_ov = ov;
	bdt->bdt_exists = obdt->bdt_exists | present;
	bdt->bdt_present = present;
	bdt->bdt_ctx = ctx;

	*bdtp = bdt;
	if (obdt->_tag_needs_free)
		obdt->_tag_needs_free++;

	return 0;
einval:
	kmem_free(bdt, sizeof(struct x86_bus_dma_tag));
	return EINVAL;
}