xref: /illumos-gate/usr/src/uts/common/xen/io/xdb.c (revision 2952f70a)

/*
 * CDDL HEADER START
 *
 * The contents of this file are subject to the terms of the
 * Common Development and Distribution License (the "License").
 * You may not use this file except in compliance with the License.
 *
 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
 * or http://www.opensolaris.org/os/licensing.
 * See the License for the specific language governing permissions
 * and limitations under the License.
 *
 * When distributing Covered Code, include this CDDL HEADER in each
 * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
 * If applicable, add the following below this CDDL HEADER, with the
 * fields enclosed by brackets "[]" replaced with your own identifying
 * information: Portions Copyright [yyyy] [name of copyright owner]
 *
 * CDDL HEADER END
 */

/*
 * Copyright 2009 Sun Microsystems, Inc.  All rights reserved.
 * Use is subject to license terms.
 */

/*
 * Note: This is the backend part of the split PV disk driver. This driver
 * is not a nexus driver, nor is it a leaf driver(block/char/stream driver).
 * Currently, it does not create any minor node. So, although, it runs in
 * backend domain, it will not be used directly from within dom0.
 * It simply gets block I/O requests issued by frontend from a shared page
 * (blkif ring buffer - defined by Xen) between backend and frontend domain,
 * generates a buf, and push it down to underlying disk target driver via
 * ldi interface. When buf is done, this driver will generate a response
 * and put it into ring buffer to inform frontend of the status of the I/O
 * request issued by it. When a new virtual device entry is added in xenstore,
 * there will be an watch event sent from Xen to xvdi framework, who will,
 * in turn, create the devinfo node and try to attach this driver
 * (see xvdi_create_dev). When frontend peer changes its state to
 * XenbusStateClose, an event will also be sent from Xen to xvdi framework,
 * who will detach and remove this devinfo node (see i_xvdi_oestate_handler).
 * I/O requests get from ring buffer and event coming from xenstore cannot be
 * trusted. We verify them in xdb_get_buf() and xdb_check_state_transition().
 *
 * Virtual device configuration is read/written from/to the database via
 * xenbus_* interfaces. Driver also use xvdi_* to interact with hypervisor.
 * There is an on-going effort to make xvdi_* cover all xenbus_*.
 */

#include <sys/types.h>
#include <sys/conf.h>
#include <sys/ddi.h>
#include <sys/dditypes.h>
#include <sys/sunddi.h>
#include <sys/list.h>
#include <sys/dkio.h>
#include <sys/cmlb.h>
#include <sys/vtoc.h>
#include <sys/modctl.h>
#include <sys/bootconf.h>
#include <sys/promif.h>
#include <sys/sysmacros.h>
#include <public/io/xenbus.h>
#include <public/io/xs_wire.h>
#include <xen/sys/xenbus_impl.h>
#include <xen/sys/xendev.h>
#include <sys/gnttab.h>
#include <sys/scsi/generic/inquiry.h>
#include <vm/seg_kmem.h>
#include <vm/hat_i86.h>
#include <sys/gnttab.h>
#include <sys/lofi.h>
#include <io/xdf.h>
#include <xen/io/blkif_impl.h>
#include <io/xdb.h>

static xdb_t *xdb_statep;
static int xdb_debug = 0;

static void xdb_close(dev_info_t *);
static int xdb_push_response(xdb_t *, uint64_t, uint8_t, uint16_t);
static int xdb_get_request(xdb_t *, blkif_request_t *);
static void blkif_get_x86_32_req(blkif_request_t *, blkif_x86_32_request_t *);
static void blkif_get_x86_64_req(blkif_request_t *, blkif_x86_64_request_t *);
static int xdb_biodone(buf_t *);


#ifdef DEBUG
/*
 * debug aid functions
 */

static void
logva(xdb_t *vdp, uint64_t va)
{
	uint64_t *page_addrs;
	int i;

	page_addrs = vdp->page_addrs;
	for (i = 0; i < XDB_MAX_IO_PAGES(vdp); i++) {
		if (page_addrs[i] == va)
			debug_enter("VA remapping found!");
	}

	for (i = 0; i < XDB_MAX_IO_PAGES(vdp); i++) {
		if (page_addrs[i] == 0) {
			page_addrs[i] = va;
			break;
		}
	}
	ASSERT(i < XDB_MAX_IO_PAGES(vdp));
}

static void
unlogva(xdb_t *vdp, uint64_t va)
{
	uint64_t *page_addrs;
	int i;

	page_addrs = vdp->page_addrs;
	for (i = 0; i < XDB_MAX_IO_PAGES(vdp); i++) {
		if (page_addrs[i] == va) {
			page_addrs[i] = 0;
			break;
		}
	}
	ASSERT(i < XDB_MAX_IO_PAGES(vdp));
}

static void
xdb_dump_request_oe(blkif_request_t *req)
{
	int i;

	/*
	 * Exploit the public interface definitions for BLKIF_OP_READ
	 * etc..
	 */
	char *op_name[] = { "read", "write", "barrier", "flush" };

	XDB_DBPRINT(XDB_DBG_IO, (CE_NOTE, "op=%s", op_name[req->operation]));
	XDB_DBPRINT(XDB_DBG_IO, (CE_NOTE, "num of segments=%d",
	    req->nr_segments));
	XDB_DBPRINT(XDB_DBG_IO, (CE_NOTE, "handle=%d", req->handle));
	XDB_DBPRINT(XDB_DBG_IO, (CE_NOTE, "id=%llu",
	    (unsigned long long)req->id));
	XDB_DBPRINT(XDB_DBG_IO, (CE_NOTE, "start sector=%llu",
	    (unsigned long long)req->sector_number));
	for (i = 0; i < req->nr_segments; i++) {
		XDB_DBPRINT(XDB_DBG_IO, (CE_NOTE, "gref=%d, first sec=%d,"
		    "last sec=%d", req->seg[i].gref, req->seg[i].first_sect,
		    req->seg[i].last_sect));
	}
}
#endif /* DEBUG */

/*
 * Statistics.
 */
static char *xdb_stats[] = {
	"rd_reqs",
	"wr_reqs",
	"br_reqs",
	"fl_reqs",
	"oo_reqs"
};

static int
xdb_kstat_update(kstat_t *ksp, int flag)
{
	xdb_t *vdp;
	kstat_named_t *knp;

	if (flag != KSTAT_READ)
		return (EACCES);

	vdp = ksp->ks_private;
	knp = ksp->ks_data;

	/*
	 * Assignment order should match that of the names in
	 * xdb_stats.
	 */
	(knp++)->value.ui64 = vdp->xs_stat_req_reads;
	(knp++)->value.ui64 = vdp->xs_stat_req_writes;
	(knp++)->value.ui64 = vdp->xs_stat_req_barriers;
	(knp++)->value.ui64 = vdp->xs_stat_req_flushes;
	(knp++)->value.ui64 = 0; /* oo_req */

	return (0);
}

static boolean_t
xdb_kstat_init(xdb_t *vdp)
{
	int nstat = sizeof (xdb_stats) / sizeof (xdb_stats[0]);
	char **cp = xdb_stats;
	kstat_named_t *knp;

	if ((vdp->xs_kstats = kstat_create("xdb",
	    ddi_get_instance(vdp->xs_dip),
	    "req_statistics", "block", KSTAT_TYPE_NAMED,
	    nstat, 0)) == NULL)
		return (B_FALSE);

	vdp->xs_kstats->ks_private = vdp;
	vdp->xs_kstats->ks_update = xdb_kstat_update;

	knp = vdp->xs_kstats->ks_data;
	while (nstat > 0) {
		kstat_named_init(knp, *cp, KSTAT_DATA_UINT64);
		knp++;
		cp++;
		nstat--;
	}

	kstat_install(vdp->xs_kstats);

	return (B_TRUE);
}

static char *
i_pathname(dev_info_t *dip)
{
	char *path, *rv;

	path = kmem_alloc(MAXPATHLEN, KM_SLEEP);
	(void) ddi_pathname(dip, path);
	rv = strdup(path);
	kmem_free(path, MAXPATHLEN);

	return (rv);
}

static buf_t *
xdb_get_buf(xdb_t *vdp, blkif_request_t *req, xdb_request_t *xreq)
{
	buf_t *bp;
	uint8_t segs, curseg;
	int sectors;
	int i, err;
	gnttab_map_grant_ref_t mapops[BLKIF_MAX_SEGMENTS_PER_REQUEST];
	ddi_acc_handle_t acchdl;

	acchdl = vdp->xs_ring_hdl;
	bp = XDB_XREQ2BP(xreq);
	curseg = xreq->xr_curseg;
	/* init a new xdb request */
	if (req != NULL) {
		ASSERT(MUTEX_HELD(&vdp->xs_iomutex));
		boolean_t pagemapok = B_TRUE;
		uint8_t op = ddi_get8(acchdl, &req->operation);

		xreq->xr_vdp = vdp;
		xreq->xr_op = op;
		xreq->xr_id = ddi_get64(acchdl, &req->id);
		segs = xreq->xr_buf_pages = ddi_get8(acchdl, &req->nr_segments);
		if (segs == 0) {
			if (op != BLKIF_OP_FLUSH_DISKCACHE)
				cmn_err(CE_WARN, "!non-BLKIF_OP_FLUSH_DISKCACHE"
				    " is seen from domain %d with zero "
				    "length data buffer!", vdp->xs_peer);
			bioinit(bp);
			bp->b_bcount = 0;
			bp->b_lblkno = 0;
			bp->b_un.b_addr = NULL;
			return (bp);
		} else if (op == BLKIF_OP_FLUSH_DISKCACHE) {
			cmn_err(CE_WARN, "!BLKIF_OP_FLUSH_DISKCACHE"
			    " is seen from domain %d with non-zero "
			    "length data buffer!", vdp->xs_peer);
		}

		/*
		 * segs should be no bigger than BLKIF_MAX_SEGMENTS_PER_REQUEST
		 * according to the definition of blk interface by Xen
		 * we do sanity check here
		 */
		if (segs > BLKIF_MAX_SEGMENTS_PER_REQUEST)
			segs = xreq->xr_buf_pages =
			    BLKIF_MAX_SEGMENTS_PER_REQUEST;

		for (i = 0; i < segs; i++) {
			uint8_t fs, ls;

			mapops[i].host_addr =
			    (uint64_t)(uintptr_t)XDB_IOPAGE_VA(
			    vdp->xs_iopage_va, xreq->xr_idx, i);
			mapops[i].dom = vdp->xs_peer;
			mapops[i].ref = ddi_get32(acchdl, &req->seg[i].gref);
			mapops[i].flags = GNTMAP_host_map;
			if (op != BLKIF_OP_READ)
				mapops[i].flags |= GNTMAP_readonly;

			fs = ddi_get8(acchdl, &req->seg[i].first_sect);
			ls = ddi_get8(acchdl, &req->seg[i].last_sect);

			/*
			 * first_sect should be no bigger than last_sect and
			 * both of them should be no bigger than
			 * XB_LAST_SECTOR_IN_SEG according to definition
			 * of blk interface by Xen, so sanity check again
			 */
			if (fs > XB_LAST_SECTOR_IN_SEG)
				fs = XB_LAST_SECTOR_IN_SEG;
			if (ls > XB_LAST_SECTOR_IN_SEG)
				ls = XB_LAST_SECTOR_IN_SEG;
			if (fs > ls)
				fs = ls;

			xreq->xr_segs[i].fs = fs;
			xreq->xr_segs[i].ls = ls;
		}

		/* map in io pages */
		err = xen_map_gref(GNTTABOP_map_grant_ref, mapops, i, B_FALSE);
		if (err != 0)
			return (NULL);
		for (i = 0; i < segs; i++) {
			/*
			 * Although HYPERVISOR_grant_table_op() returned no
			 * error, mapping of each single page can fail. So,
			 * we have to do the check here and handle the error
			 * if needed
			 */
			if (mapops[i].status != GNTST_okay) {
				int j;
				for (j = 0; j < i; j++) {
#ifdef DEBUG
					unlogva(vdp, mapops[j].host_addr);
#endif
					xen_release_pfn(
					    xreq->xr_plist[j].p_pagenum);
				}
				pagemapok = B_FALSE;
				break;
			}
			/* record page mapping handle for unmapping later */
			xreq->xr_page_hdls[i] = mapops[i].handle;
#ifdef DEBUG
			logva(vdp, mapops[i].host_addr);
#endif
			/*
			 * Pass the MFNs down using the shadow list (xr_pplist)
			 *
			 * This is pretty ugly since we have implict knowledge
			 * of how the rootnex binds buffers.
			 * The GNTTABOP_map_grant_ref op makes us do some ugly
			 * stuff since we're not allowed to touch these PTEs
			 * from the VM.
			 *
			 * Obviously, these aren't real page_t's. The rootnex
			 * only needs p_pagenum.
			 * Also, don't use btop() here or 32 bit PAE breaks.
			 */
			xreq->xr_pplist[i] = &xreq->xr_plist[i];
			xreq->xr_plist[i].p_pagenum =
			    xen_assign_pfn(mapops[i].dev_bus_addr >> PAGESHIFT);
		}

		/*
		 * not all pages mapped in successfully, unmap those mapped-in
		 * page and return failure
		 */
		if (!pagemapok) {
			gnttab_unmap_grant_ref_t unmapop;

			for (i = 0; i < segs; i++) {
				if (mapops[i].status != GNTST_okay)
					continue;
				unmapop.host_addr =
				    (uint64_t)(uintptr_t)XDB_IOPAGE_VA(
				    vdp->xs_iopage_va, xreq->xr_idx, i);
				unmapop.dev_bus_addr = 0;
				unmapop.handle = mapops[i].handle;
				(void) HYPERVISOR_grant_table_op(
				    GNTTABOP_unmap_grant_ref, &unmapop, 1);
			}

			return (NULL);
		}
		bioinit(bp);
		bp->b_lblkno = ddi_get64(acchdl, &req->sector_number);
		bp->b_flags = B_BUSY | B_SHADOW | B_PHYS;
		bp->b_flags |= (ddi_get8(acchdl, &req->operation) ==
		    BLKIF_OP_READ) ? B_READ : (B_WRITE | B_ASYNC);
	} else {
		uint64_t blkst;
		int isread;

		/* reuse this buf */
		blkst = bp->b_lblkno + bp->b_bcount / DEV_BSIZE;
		isread = bp->b_flags & B_READ;
		bioreset(bp);
		bp->b_lblkno = blkst;
		bp->b_flags = B_BUSY | B_SHADOW | B_PHYS;
		bp->b_flags |= isread ? B_READ : (B_WRITE | B_ASYNC);
		XDB_DBPRINT(XDB_DBG_IO, (CE_NOTE, "reuse buf, xreq is %d!!",
		    xreq->xr_idx));
	}

	/* form a buf */
	bp->b_un.b_addr = XDB_IOPAGE_VA(vdp->xs_iopage_va, xreq->xr_idx,
	    curseg) + xreq->xr_segs[curseg].fs * DEV_BSIZE;
	bp->b_shadow = &xreq->xr_pplist[curseg];
	bp->b_iodone = xdb_biodone;
	sectors = 0;

	/*
	 * Run through the segments. There are XB_NUM_SECTORS_PER_SEG sectors
	 * per segment. On some OSes (e.g. Linux), there may be empty gaps
	 * between segments. (i.e. the first segment may end on sector 6 and
	 * the second segment start on sector 4).
	 *
	 * if a segments first sector is not set to 0, and this is not the
	 * first segment in our buf, end this buf now.
	 *
	 * if a segments last sector is not set to XB_LAST_SECTOR_IN_SEG, and
	 * this is not the last segment in the request, add this segment into
	 * the buf, then end this buf (updating the pointer to point to the
	 * next segment next time around).
	 */
	for (i = curseg; i < xreq->xr_buf_pages; i++) {
		if ((xreq->xr_segs[i].fs != 0) && (i != curseg)) {
			break;
		}
		sectors += (xreq->xr_segs[i].ls - xreq->xr_segs[i].fs + 1);
		if ((xreq->xr_segs[i].ls != XB_LAST_SECTOR_IN_SEG) &&
		    (i != (xreq->xr_buf_pages - 1))) {
			i++;
			break;
		}
	}
	xreq->xr_curseg = i;
	bp->b_bcount = sectors * DEV_BSIZE;
	bp->b_bufsize = bp->b_bcount;

	return (bp);
}

static xdb_request_t *
xdb_get_req(xdb_t *vdp)
{
	xdb_request_t *req;
	int idx;

	ASSERT(MUTEX_HELD(&vdp->xs_iomutex));
	ASSERT(vdp->xs_free_req != -1);
	req = &vdp->xs_req[vdp->xs_free_req];
	vdp->xs_free_req = req->xr_next;
	idx = req->xr_idx;
	bzero(req, sizeof (xdb_request_t));
	req->xr_idx = idx;
	return (req);
}

static void
xdb_free_req(xdb_request_t *req)
{
	xdb_t *vdp = req->xr_vdp;

	ASSERT(MUTEX_HELD(&vdp->xs_iomutex));
	req->xr_next = vdp->xs_free_req;
	vdp->xs_free_req = req->xr_idx;
}

static void
xdb_response(xdb_t *vdp, blkif_request_t *req, boolean_t ok)
{
	ddi_acc_handle_t acchdl = vdp->xs_ring_hdl;

	if (xdb_push_response(vdp, ddi_get64(acchdl, &req->id),
	    ddi_get8(acchdl, &req->operation), ok))
		xvdi_notify_oe(vdp->xs_dip);
}

static void
xdb_init_ioreqs(xdb_t *vdp)
{
	int i;

	ASSERT(vdp->xs_nentry);

	if (vdp->xs_req == NULL)
		vdp->xs_req = kmem_alloc(vdp->xs_nentry *
		    sizeof (xdb_request_t), KM_SLEEP);
#ifdef DEBUG
	if (vdp->page_addrs == NULL)
		vdp->page_addrs = kmem_zalloc(XDB_MAX_IO_PAGES(vdp) *
		    sizeof (uint64_t), KM_SLEEP);
#endif
	for (i = 0; i < vdp->xs_nentry; i++) {
		vdp->xs_req[i].xr_idx = i;
		vdp->xs_req[i].xr_next = i + 1;
	}
	vdp->xs_req[vdp->xs_nentry - 1].xr_next = -1;
	vdp->xs_free_req = 0;

	/* alloc va in host dom for io page mapping */
	vdp->xs_iopage_va = vmem_xalloc(heap_arena,
	    XDB_MAX_IO_PAGES(vdp) * PAGESIZE, PAGESIZE, 0, 0, 0, 0,
	    VM_SLEEP);
	for (i = 0; i < XDB_MAX_IO_PAGES(vdp); i++)
		hat_prepare_mapping(kas.a_hat,
		    vdp->xs_iopage_va + i * PAGESIZE, NULL);
}

static void
xdb_uninit_ioreqs(xdb_t *vdp)
{
	int i;

	for (i = 0; i < XDB_MAX_IO_PAGES(vdp); i++)
		hat_release_mapping(kas.a_hat,
		    vdp->xs_iopage_va + i * PAGESIZE);
	vmem_xfree(heap_arena, vdp->xs_iopage_va,
	    XDB_MAX_IO_PAGES(vdp) * PAGESIZE);
	if (vdp->xs_req != NULL) {
		kmem_free(vdp->xs_req, vdp->xs_nentry * sizeof (xdb_request_t));
		vdp->xs_req = NULL;
	}
#ifdef DEBUG
	if (vdp->page_addrs != NULL) {
		kmem_free(vdp->page_addrs, XDB_MAX_IO_PAGES(vdp) *
		    sizeof (uint64_t));
		vdp->page_addrs = NULL;
	}
#endif
}

static uint_t
xdb_intr(caddr_t arg)
{
	xdb_t		*vdp = (xdb_t *)arg;
	dev_info_t	*dip = vdp->xs_dip;
	blkif_request_t	req, *reqp = &req;
	xdb_request_t	*xreq;
	buf_t		*bp;
	uint8_t		op;
	int		ret = DDI_INTR_UNCLAIMED;

	XDB_DBPRINT(XDB_DBG_IO, (CE_NOTE,
	    "xdb@%s: I/O request received from dom %d",
	    ddi_get_name_addr(dip), vdp->xs_peer));

	mutex_enter(&vdp->xs_iomutex);

	/* shouldn't touch ring buffer if not in connected state */
	if (!vdp->xs_if_connected) {
		mutex_exit(&vdp->xs_iomutex);
		return (DDI_INTR_UNCLAIMED);
	}
	ASSERT(vdp->xs_hp_connected && vdp->xs_fe_initialised);

	/*
	 * We'll loop till there is no more request in the ring
	 * We won't stuck in this loop for ever since the size of ring buffer
	 * is limited, and frontend will stop pushing requests into it when
	 * the ring buffer is full
	 */

	/* req_event will be increased in xvdi_ring_get_request() */
	while (xdb_get_request(vdp, reqp)) {
		ret = DDI_INTR_CLAIMED;

		op = ddi_get8(vdp->xs_ring_hdl, &reqp->operation);
		if (op == BLKIF_OP_READ			||
		    op == BLKIF_OP_WRITE		||
		    op == BLKIF_OP_WRITE_BARRIER	||
		    op == BLKIF_OP_FLUSH_DISKCACHE) {
#ifdef DEBUG
			xdb_dump_request_oe(reqp);
#endif
			xreq = xdb_get_req(vdp);
			ASSERT(xreq);
			switch (op) {
			case BLKIF_OP_READ:
				vdp->xs_stat_req_reads++;
				break;
			case BLKIF_OP_WRITE_BARRIER:
				vdp->xs_stat_req_barriers++;
				/* FALLTHRU */
			case BLKIF_OP_WRITE:
				vdp->xs_stat_req_writes++;
				break;
			case BLKIF_OP_FLUSH_DISKCACHE:
				vdp->xs_stat_req_flushes++;
				break;
			}

			xreq->xr_curseg = 0; /* start from first segment */
			bp = xdb_get_buf(vdp, reqp, xreq);
			if (bp == NULL) {
				/* failed to form a buf */
				xdb_free_req(xreq);
				xdb_response(vdp, reqp, B_FALSE);
				continue;
			}
			bp->av_forw = NULL;

			XDB_DBPRINT(XDB_DBG_IO, (CE_NOTE,
			    " buf %p, blkno %lld, size %lu, addr %p",
			    (void *)bp, (longlong_t)bp->b_blkno,
			    (ulong_t)bp->b_bcount, (void *)bp->b_un.b_addr));

			/* send bp to underlying blk driver */
			if (vdp->xs_f_iobuf == NULL) {
				vdp->xs_f_iobuf = vdp->xs_l_iobuf = bp;
			} else {
				vdp->xs_l_iobuf->av_forw = bp;
				vdp->xs_l_iobuf = bp;
			}
		} else {
			xdb_response(vdp, reqp, B_FALSE);
			XDB_DBPRINT(XDB_DBG_IO, (CE_WARN, "xdb@%s: "
			    "Unsupported cmd received from dom %d",
			    ddi_get_name_addr(dip), vdp->xs_peer));
		}
	}
	/* notify our taskq to push buf to underlying blk driver */
	if (ret == DDI_INTR_CLAIMED)
		cv_broadcast(&vdp->xs_iocv);

	mutex_exit(&vdp->xs_iomutex);

	return (ret);
}

static int
xdb_biodone(buf_t *bp)
{
	int i, err, bioerr;
	uint8_t segs;
	gnttab_unmap_grant_ref_t unmapops[BLKIF_MAX_SEGMENTS_PER_REQUEST];
	xdb_request_t *xreq = XDB_BP2XREQ(bp);
	xdb_t *vdp = xreq->xr_vdp;
	buf_t *nbp;

	bioerr = geterror(bp);
	if (bioerr)
		XDB_DBPRINT(XDB_DBG_IO, (CE_WARN, "xdb@%s: I/O error %d",
		    ddi_get_name_addr(vdp->xs_dip), bioerr));

	/* check if we are done w/ this I/O request */
	if ((bioerr == 0) && (xreq->xr_curseg < xreq->xr_buf_pages)) {
		nbp = xdb_get_buf(vdp, NULL, xreq);
		if (nbp) {
			err = ldi_strategy(vdp->xs_ldi_hdl, nbp);
			if (err == 0) {
				XDB_DBPRINT(XDB_DBG_IO, (CE_NOTE,
				    "sent buf to backend ok"));
				return (DDI_SUCCESS);
			}
			bioerr = EIO;
			XDB_DBPRINT(XDB_DBG_IO, (CE_WARN, "xdb@%s: "
			    "sent buf to backend dev failed, err=%d",
			    ddi_get_name_addr(vdp->xs_dip), err));
		} else {
			bioerr = EIO;
		}
	}

	/* unmap io pages */
	segs = xreq->xr_buf_pages;
	/*
	 * segs should be no bigger than BLKIF_MAX_SEGMENTS_PER_REQUEST
	 * according to the definition of blk interface by Xen
	 */
	ASSERT(segs <= BLKIF_MAX_SEGMENTS_PER_REQUEST);
	for (i = 0; i < segs; i++) {
		unmapops[i].host_addr = (uint64_t)(uintptr_t)XDB_IOPAGE_VA(
		    vdp->xs_iopage_va, xreq->xr_idx, i);
#ifdef DEBUG
		mutex_enter(&vdp->xs_iomutex);
		unlogva(vdp, unmapops[i].host_addr);
		mutex_exit(&vdp->xs_iomutex);
#endif
		unmapops[i].dev_bus_addr = 0;
		unmapops[i].handle = xreq->xr_page_hdls[i];
	}
	err = HYPERVISOR_grant_table_op(GNTTABOP_unmap_grant_ref,
	    unmapops, segs);
	ASSERT(!err);

	/*
	 * If we have reached a barrier write or a cache flush , then we must
	 * flush all our I/Os.
	 */
	if (xreq->xr_op == BLKIF_OP_WRITE_BARRIER ||
	    xreq->xr_op == BLKIF_OP_FLUSH_DISKCACHE) {
		/*
		 * XXX At this point the write did succeed, so I don't
		 * believe we should report an error because the flush
		 * failed. However, this is a debatable point, so
		 * maybe we need to think more carefully about this.
		 * For now, just cast to void.
		 */
		(void) ldi_ioctl(vdp->xs_ldi_hdl,
		    DKIOCFLUSHWRITECACHE, 0, FKIOCTL, kcred, NULL);
	}

	mutex_enter(&vdp->xs_iomutex);

	/* send response back to frontend */
	if (vdp->xs_if_connected) {
		ASSERT(vdp->xs_hp_connected && vdp->xs_fe_initialised);
		if (xdb_push_response(vdp, xreq->xr_id, xreq->xr_op, bioerr))
			xvdi_notify_oe(vdp->xs_dip);
		XDB_DBPRINT(XDB_DBG_IO, (CE_NOTE,
		    "sent resp back to frontend, id=%llu",
		    (unsigned long long)xreq->xr_id));
	}
	/* free io resources */
	biofini(bp);
	xdb_free_req(xreq);

	vdp->xs_ionum--;
	if (!vdp->xs_if_connected && (vdp->xs_ionum == 0)) {
		/* we're closing, someone is waiting for I/O clean-up */
		cv_signal(&vdp->xs_ionumcv);
	}

	mutex_exit(&vdp->xs_iomutex);

	return (DDI_SUCCESS);
}

static int
xdb_bindto_frontend(xdb_t *vdp)
{
	int err;
	char *oename;
	grant_ref_t gref;
	evtchn_port_t evtchn;
	dev_info_t *dip = vdp->xs_dip;
	char protocol[64] = "";

	ASSERT(MUTEX_HELD(&vdp->xs_cbmutex));

	/*
	 * Switch to the XenbusStateInitialised state.  This let's the
	 * frontend know that we're about to negotiate a connection.
	 */
	(void) xvdi_switch_state(dip, XBT_NULL, XenbusStateInitialised);

	/*
	 * Gather info from frontend
	 */
	oename = xvdi_get_oename(dip);
	if (oename == NULL)
		return (DDI_FAILURE);

	err = xenbus_gather(XBT_NULL, oename,
	    XBP_RING_REF, "%lu", &gref,
	    XBP_EVENT_CHAN, "%u", &evtchn,
	    NULL);
	if (err != 0) {
		xvdi_dev_error(dip, err,
		    "Getting ring-ref and evtchn from frontend");
		return (DDI_FAILURE);
	}

	vdp->xs_blk_protocol = BLKIF_PROTOCOL_NATIVE;
	vdp->xs_nentry = BLKIF_RING_SIZE;
	vdp->xs_entrysize = sizeof (union blkif_sring_entry);

	err = xenbus_gather(XBT_NULL, oename,
	    XBP_PROTOCOL, "%63s", protocol, NULL);
	if (err)
		(void) strcpy(protocol, "unspecified, assuming native");
	else {
		/*
		 * We must check for NATIVE first, so that the fast path
		 * is taken for copying data from the guest to the host.
		 */
		if (strcmp(protocol, XEN_IO_PROTO_ABI_NATIVE) != 0) {
			if (strcmp(protocol, XEN_IO_PROTO_ABI_X86_32) == 0) {
				vdp->xs_blk_protocol = BLKIF_PROTOCOL_X86_32;
				vdp->xs_nentry = BLKIF_X86_32_RING_SIZE;
				vdp->xs_entrysize =
				    sizeof (union blkif_x86_32_sring_entry);
			} else if (strcmp(protocol, XEN_IO_PROTO_ABI_X86_64) ==
			    0) {
				vdp->xs_blk_protocol = BLKIF_PROTOCOL_X86_64;
				vdp->xs_nentry = BLKIF_X86_64_RING_SIZE;
				vdp->xs_entrysize =
				    sizeof (union blkif_x86_64_sring_entry);
			} else {
				xvdi_fatal_error(dip, err, "unknown protocol");
				return (DDI_FAILURE);
			}
		}
	}
#ifdef DEBUG
	cmn_err(CE_NOTE, "!xdb@%s: blkif protocol '%s' ",
	    ddi_get_name_addr(dip), protocol);
#endif

	/*
	 * Map and init ring.  The ring parameters must match those which
	 * have been allocated in the front end.
	 */
	if (xvdi_map_ring(dip, vdp->xs_nentry, vdp->xs_entrysize,
	    gref, &vdp->xs_ring) != DDI_SUCCESS)
		return (DDI_FAILURE);

	/*
	 * This will be removed after we use shadow I/O ring request since
	 * we don't need to access the ring itself directly, thus the access
	 * handle is not needed
	 */
	vdp->xs_ring_hdl = vdp->xs_ring->xr_acc_hdl;

	/* bind event channel */
	err = xvdi_bind_evtchn(dip, evtchn);
	if (err != DDI_SUCCESS) {
		xvdi_unmap_ring(vdp->xs_ring);
		return (DDI_FAILURE);
	}

	return (DDI_SUCCESS);
}

static void
xdb_unbindfrom_frontend(xdb_t *vdp)
{
	ASSERT(MUTEX_HELD(&vdp->xs_cbmutex));

	xvdi_free_evtchn(vdp->xs_dip);
	xvdi_unmap_ring(vdp->xs_ring);
}

/*
 * xdb_params_change() initiates a allows change to the underlying device/file
 * that the backend is accessing.  It does this by disconnecting from the
 * frontend, closing the old device, clearing a bunch of xenbus parameters,
 * and switching back to the XenbusStateInitialising state.  The frontend
 * should notice this transition to the XenbusStateInitialising state and
 * should attempt to reconnect to us (the backend).
 */
static void
xdb_params_change(xdb_t *vdp, char *params, boolean_t update_xs)
{
	xenbus_transaction_t	xbt;
	dev_info_t		*dip = vdp->xs_dip;
	char			*xsname;
	int			err;

	ASSERT(MUTEX_HELD(&vdp->xs_cbmutex));
	ASSERT(vdp->xs_params_path != NULL);

	if ((xsname = xvdi_get_xsname(dip)) == NULL)
		return;
	if (strcmp(vdp->xs_params_path, params) == 0)
		return;

	/*
	 * Close the device we're currently accessing and update the
	 * path which points to our backend device/file.
	 */
	xdb_close(dip);
	vdp->xs_fe_initialised = B_FALSE;

trans_retry:
	if ((err = xenbus_transaction_start(&xbt)) != 0) {
		xvdi_dev_error(dip, err, "params change transaction init");
		goto errout;
	}

	/*
	 * Delete all the xenbus properties that are connection dependant
	 * and go back to the initializing state so that the frontend
	 * driver can re-negotiate a connection.
	 */
	if (((err = xenbus_rm(xbt, xsname, XBP_FB)) != 0) ||
	    ((err = xenbus_rm(xbt, xsname, XBP_INFO)) != 0) ||
	    ((err = xenbus_rm(xbt, xsname, "sector-size")) != 0) ||
	    ((err = xenbus_rm(xbt, xsname, XBP_SECTORS)) != 0) ||
	    ((err = xenbus_rm(xbt, xsname, "instance")) != 0) ||
	    ((err = xenbus_rm(xbt, xsname, "node")) != 0) ||
	    (update_xs && ((err = xenbus_printf(xbt, xsname,
	    "params", "%s", params)) != 0)) ||
	    ((err = xvdi_switch_state(dip,
	    xbt, XenbusStateInitialising) > 0))) {
		(void) xenbus_transaction_end(xbt, 1);
		xvdi_dev_error(dip, err, "params change transaction setup");
		goto errout;
	}

	if ((err = xenbus_transaction_end(xbt, 0)) != 0) {
		if (err == EAGAIN) {
			/* transaction is ended, don't need to abort it */
			goto trans_retry;
		}
		xvdi_dev_error(dip, err, "params change transaction commit");
		goto errout;
	}

	/* Change the device that we plan to access */
	strfree(vdp->xs_params_path);
	vdp->xs_params_path = strdup(params);
	return;

errout:
	(void) xvdi_switch_state(dip, xbt, XenbusStateInitialising);
}

/*
 * xdb_watch_params_cb() - This callback is invoked whenever there
 * is an update to the following xenbus parameter:
 *     /local/domain/0/backend/vbd/<domU_id>/<domU_dev>/params
 *
 * This normally happens during xm block-configure operations, which
 * are used to change CD device images for HVM domUs.
 */
/*ARGSUSED*/
static void
xdb_watch_params_cb(dev_info_t *dip, const char *path, void *arg)
{
	xdb_t			*vdp = (xdb_t *)ddi_get_driver_private(dip);
	char			*xsname, *oename, *str, *str2;

	if (((xsname = xvdi_get_xsname(dip)) == NULL) ||
	    ((oename = xvdi_get_oename(dip)) == NULL)) {
		return;
	}

	mutex_enter(&vdp->xs_cbmutex);

	if (xenbus_read_str(xsname, "params", &str) != 0) {
		mutex_exit(&vdp->xs_cbmutex);
		return;
	}

	if (strcmp(vdp->xs_params_path, str) == 0) {
		/* Nothing todo */
		mutex_exit(&vdp->xs_cbmutex);
		strfree(str);
		return;
	}

	/*
	 * If the frontend isn't a cd device, doesn't support media
	 * requests, or has locked the media, then we can't change
	 * the params value.  restore the current value.
	 */
	str2 = NULL;
	if (!XDB_IS_FE_CD(vdp) ||
	    (xenbus_read_str(oename, XBP_MEDIA_REQ, &str2) != 0) ||
	    (strcmp(str2, XBV_MEDIA_REQ_LOCK) == 0)) {
		if (str2 != NULL)
			strfree(str2);
		strfree(str);

		str = i_pathname(dip);
		cmn_err(CE_NOTE,
		    "!%s: media locked, ignoring params update", str);
		strfree(str);

		mutex_exit(&vdp->xs_cbmutex);
		return;
	}

	XDB_DBPRINT(XDB_DBG_INFO, (CE_NOTE,
	    "block-configure params request: \"%s\"", str));

	xdb_params_change(vdp, str, B_FALSE);
	mutex_exit(&vdp->xs_cbmutex);
	strfree(str);
}

/*
 * xdb_watch_media_req_cb() - This callback is invoked whenever there
 * is an update to the following xenbus parameter:
 *     /local/domain/<domU_id>/device/vbd/<domU_dev>/media-req
 *
 * Media requests are only supported on CD devices and are issued by
 * the frontend.  Currently the only supported media request operaions
 * are "lock" and "eject".  A "lock" prevents the backend from changing
 * the backing device/file (via xm block-configure).  An "eject" requests
 * tells the backend device that it should disconnect from the frontend
 * and closing the backing device/file that is currently in use.
 */
/*ARGSUSED*/
static void
xdb_watch_media_req_cb(dev_info_t *dip, const char *path, void *arg)
{
	xdb_t			*vdp = (xdb_t *)ddi_get_driver_private(dip);
	char			*oename, *str;

	mutex_enter(&vdp->xs_cbmutex);

	if ((oename = xvdi_get_oename(dip)) == NULL) {
		mutex_exit(&vdp->xs_cbmutex);
		return;
	}

	if (xenbus_read_str(oename, XBP_MEDIA_REQ, &str) != 0) {
		mutex_exit(&vdp->xs_cbmutex);
		return;
	}

	if (!XDB_IS_FE_CD(vdp)) {
		xvdi_dev_error(dip, EINVAL,
		    "media-req only supported for cdrom devices");
		mutex_exit(&vdp->xs_cbmutex);
		return;
	}

	if (strcmp(str, XBV_MEDIA_REQ_EJECT) != 0) {
		mutex_exit(&vdp->xs_cbmutex);
		strfree(str);
		return;
	}
	strfree(str);

	XDB_DBPRINT(XDB_DBG_INFO, (CE_NOTE, "media eject request"));

	xdb_params_change(vdp, "", B_TRUE);
	(void) xenbus_printf(XBT_NULL, oename,
	    XBP_MEDIA_REQ, "%s", XBV_MEDIA_REQ_NONE);
	mutex_exit(&vdp->xs_cbmutex);
}

/*
 * If we're dealing with a cdrom device, let the frontend know that
 * we support media requests via XBP_MEDIA_REQ_SUP, and setup a watch
 * to handle those frontend media request changes, which modify the
 * following xenstore parameter:
 *	/local/domain/<domU_id>/device/vbd/<domU_dev>/media-req
 */
static boolean_t
xdb_media_req_init(xdb_t *vdp)
{
	dev_info_t		*dip = vdp->xs_dip;
	char			*xsname, *oename;

	ASSERT(MUTEX_HELD(&vdp->xs_cbmutex));

	if (((xsname = xvdi_get_xsname(dip)) == NULL) ||
	    ((oename = xvdi_get_oename(dip)) == NULL))
		return (B_FALSE);

	if (!XDB_IS_FE_CD(vdp))
		return (B_TRUE);

	if (xenbus_printf(XBT_NULL, xsname, XBP_MEDIA_REQ_SUP, "%d", 1) != 0)
		return (B_FALSE);

	if (xvdi_add_xb_watch_handler(dip, oename,
	    XBP_MEDIA_REQ, xdb_watch_media_req_cb, NULL) != DDI_SUCCESS) {
		xvdi_dev_error(dip, EAGAIN,
		    "Failed to register watch for cdrom media requests");
		return (B_FALSE);
	}

	return (B_TRUE);
}

/*
 * Get our params value.  Also, if we're using "params" then setup a
 * watch to handle xm block-configure operations which modify the
 * following xenstore parameter:
 *	/local/domain/0/backend/vbd/<domU_id>/<domU_dev>/params
 */
static boolean_t
xdb_params_init(xdb_t *vdp)
{
	dev_info_t		*dip = vdp->xs_dip;
	char			*str, *xsname;
	int			err;

	ASSERT(MUTEX_HELD(&vdp->xs_cbmutex));
	ASSERT(vdp->xs_params_path == NULL);

	if ((xsname = xvdi_get_xsname(dip)) == NULL)
		return (B_FALSE);

	err = xenbus_read_str(xsname, "params", &str);
	if (err != 0) {
		return (B_FALSE);
	}
	vdp->xs_params_path = str;

	if (xvdi_add_xb_watch_handler(dip, xsname, "params",
	    xdb_watch_params_cb, NULL) != DDI_SUCCESS) {
		strfree(vdp->xs_params_path);
		vdp->xs_params_path = NULL;
		return (B_FALSE);
	}

	return (B_TRUE);
}

#define	LOFI_CTRL_NODE	"/dev/lofictl"
#define	LOFI_DEV_NODE	"/devices/pseudo/lofi@0:"
#define	LOFI_MODE	(FREAD | FWRITE | FEXCL)

static int
xdb_setup_node(xdb_t *vdp, char *path)
{
	dev_info_t		*dip = vdp->xs_dip;
	char			*xsname, *str;
	ldi_handle_t		ldi_hdl;
	struct lofi_ioctl	*li;
	int			minor, err;

	ASSERT(MUTEX_HELD(&vdp->xs_cbmutex));

	if ((xsname = xvdi_get_xsname(dip)) == NULL)
		return (DDI_FAILURE);

	if ((err = xenbus_read_str(xsname, "type", &str)) != 0) {
		xvdi_dev_error(dip, err, "Getting type from backend device");
		return (DDI_FAILURE);
	}
	if (strcmp(str, "file") == 0)
		vdp->xs_type |= XDB_DEV_BE_LOFI;
	strfree(str);

	if (!XDB_IS_BE_LOFI(vdp)) {
		(void) strlcpy(path, vdp->xs_params_path, MAXPATHLEN);
		ASSERT(vdp->xs_lofi_path == NULL);
		return (DDI_SUCCESS);
	}

	do {
		err = ldi_open_by_name(LOFI_CTRL_NODE, LOFI_MODE, kcred,
		    &ldi_hdl, vdp->xs_ldi_li);
	} while (err == EBUSY);
	if (err != 0) {
		return (DDI_FAILURE);
	}

	li = kmem_zalloc(sizeof (*li), KM_SLEEP);
	(void) strlcpy(li->li_filename, vdp->xs_params_path,
	    sizeof (li->li_filename));
	err = ldi_ioctl(ldi_hdl, LOFI_MAP_FILE, (intptr_t)li,
	    LOFI_MODE | FKIOCTL, kcred, &minor);
	(void) ldi_close(ldi_hdl, LOFI_MODE, kcred);
	kmem_free(li, sizeof (*li));

	if (err != 0) {
		cmn_err(CE_WARN, "xdb@%s: Failed to create lofi dev for %s",
		    ddi_get_name_addr(dip), vdp->xs_params_path);
		return (DDI_FAILURE);
	}

	/*
	 * return '/devices/...' instead of '/dev/lofi/...' since the
	 * former is available immediately after calling ldi_ioctl
	 */
	(void) snprintf(path, MAXPATHLEN, LOFI_DEV_NODE "%d", minor);
	(void) xenbus_printf(XBT_NULL, xsname, "node", "%s", path);

	ASSERT(vdp->xs_lofi_path == NULL);
	vdp->xs_lofi_path = strdup(path);

	return (DDI_SUCCESS);
}

static void
xdb_teardown_node(xdb_t *vdp)
{
	dev_info_t *dip = vdp->xs_dip;
	ldi_handle_t ldi_hdl;
	struct lofi_ioctl *li;
	int err;

	ASSERT(MUTEX_HELD(&vdp->xs_cbmutex));

	if (!XDB_IS_BE_LOFI(vdp))
		return;

	vdp->xs_type &= ~XDB_DEV_BE_LOFI;
	ASSERT(vdp->xs_lofi_path != NULL);

	li = kmem_zalloc(sizeof (*li), KM_SLEEP);
	(void) strlcpy(li->li_filename, vdp->xs_params_path,
	    sizeof (li->li_filename));

	do {
		err = ldi_open_by_name(LOFI_CTRL_NODE, LOFI_MODE, kcred,
		    &ldi_hdl, vdp->xs_ldi_li);
	} while (err == EBUSY);

	if (err != 0) {
		kmem_free(li, sizeof (*li));
		return;
	}

	if (ldi_ioctl(ldi_hdl, LOFI_UNMAP_FILE, (intptr_t)li,
	    LOFI_MODE | FKIOCTL, kcred, NULL) != 0) {
		cmn_err(CE_WARN, "xdb@%s: Failed to delete lofi dev for %s",
		    ddi_get_name_addr(dip), li->li_filename);
	}

	(void) ldi_close(ldi_hdl, LOFI_MODE, kcred);
	kmem_free(li, sizeof (*li));

	strfree(vdp->xs_lofi_path);
	vdp->xs_lofi_path = NULL;
}

static int
xdb_open_device(xdb_t *vdp)
{
	dev_info_t *dip = vdp->xs_dip;
	uint64_t devsize;
	int blksize;
	char *nodepath;
	char *xsname;
	char *str;
	int err;

	ASSERT(MUTEX_HELD(&vdp->xs_cbmutex));

	if (strlen(vdp->xs_params_path) == 0) {
		/*
		 * it's possible to have no backing device when dealing
		 * with a pv cdrom drive that has no virtual cd associated
		 * with it.
		 */
		ASSERT(XDB_IS_FE_CD(vdp));
		ASSERT(vdp->xs_sectors == 0);
		ASSERT(vdp->xs_ldi_li == NULL);
		ASSERT(vdp->xs_ldi_hdl == NULL);
		return (DDI_SUCCESS);
	}

	/*
	 * after the hotplug scripts have "connected" the device, check to see
	 * if we're using a dynamic device.  If so, replace the params path
	 * with the dynamic one.
	 */
	xsname = xvdi_get_xsname(dip);
	err = xenbus_read_str(xsname, "dynamic-device-path", &str);
	if (err == 0) {
		strfree(vdp->xs_params_path);
		vdp->xs_params_path = str;
	}

	if (ldi_ident_from_dip(dip, &vdp->xs_ldi_li) != 0)
		return (DDI_FAILURE);

	nodepath = kmem_zalloc(MAXPATHLEN, KM_SLEEP);

	/* try to open backend device */
	if (xdb_setup_node(vdp, nodepath) != DDI_SUCCESS) {
		xvdi_dev_error(dip, ENXIO,
		    "Getting device path of backend device");
		ldi_ident_release(vdp->xs_ldi_li);
		kmem_free(nodepath, MAXPATHLEN);
		return (DDI_FAILURE);
	}

	if (ldi_open_by_name(nodepath,
	    FREAD | (XDB_IS_RO(vdp) ? 0 : FWRITE),
	    kcred, &vdp->xs_ldi_hdl, vdp->xs_ldi_li) != 0) {
		xdb_teardown_node(vdp);
		ldi_ident_release(vdp->xs_ldi_li);
		cmn_err(CE_WARN, "xdb@%s: Failed to open: %s",
		    ddi_get_name_addr(dip), nodepath);
		kmem_free(nodepath, MAXPATHLEN);
		return (DDI_FAILURE);
	}

	if (ldi_get_size(vdp->xs_ldi_hdl, &devsize) != DDI_SUCCESS) {
		(void) ldi_close(vdp->xs_ldi_hdl,
		    FREAD | (XDB_IS_RO(vdp) ? 0 : FWRITE), kcred);
		xdb_teardown_node(vdp);
		ldi_ident_release(vdp->xs_ldi_li);
		kmem_free(nodepath, MAXPATHLEN);
		return (DDI_FAILURE);
	}

	blksize = ldi_prop_get_int64(vdp->xs_ldi_hdl,
	    DDI_PROP_DONTPASS | DDI_PROP_NOTPROM,
	    "blksize", DEV_BSIZE);
	if (blksize == DEV_BSIZE)
		blksize = ldi_prop_get_int(vdp->xs_ldi_hdl,
		    LDI_DEV_T_ANY | DDI_PROP_DONTPASS |
		    DDI_PROP_NOTPROM, "device-blksize", DEV_BSIZE);

	vdp->xs_sec_size = blksize;
	vdp->xs_sectors = devsize / blksize;

	/* check if the underlying device is a CD/DVD disc */
	if (ldi_prop_get_int(vdp->xs_ldi_hdl, LDI_DEV_T_ANY | DDI_PROP_DONTPASS,
	    INQUIRY_DEVICE_TYPE, DTYPE_DIRECT) == DTYPE_RODIRECT)
		vdp->xs_type |= XDB_DEV_BE_CD;

	/* check if the underlying device is a removable disk */
	if (ldi_prop_exists(vdp->xs_ldi_hdl,
	    LDI_DEV_T_ANY | DDI_PROP_DONTPASS | DDI_PROP_NOTPROM,
	    "removable-media"))
		vdp->xs_type |= XDB_DEV_BE_RMB;

	kmem_free(nodepath, MAXPATHLEN);
	return (DDI_SUCCESS);
}

static void
xdb_close_device(xdb_t *vdp)
{
	ASSERT(MUTEX_HELD(&vdp->xs_cbmutex));

	if (strlen(vdp->xs_params_path) == 0) {
		ASSERT(XDB_IS_FE_CD(vdp));
		ASSERT(vdp->xs_sectors == 0);
		ASSERT(vdp->xs_ldi_li == NULL);
		ASSERT(vdp->xs_ldi_hdl == NULL);
		return;
	}

	(void) ldi_close(vdp->xs_ldi_hdl,
	    FREAD | (XDB_IS_RO(vdp) ? 0 : FWRITE), kcred);
	xdb_teardown_node(vdp);
	ldi_ident_release(vdp->xs_ldi_li);
	vdp->xs_type &= ~(XDB_DEV_BE_CD | XDB_DEV_BE_RMB);
	vdp->xs_sectors = 0;
	vdp->xs_ldi_li = NULL;
	vdp->xs_ldi_hdl = NULL;
}

/*
 * Kick-off connect process
 * If xs_fe_initialised == B_TRUE and xs_hp_connected == B_TRUE
 * the xs_if_connected will be changed to B_TRUE on success,
 */
static void
xdb_start_connect(xdb_t *vdp)
{
	xenbus_transaction_t	xbt;
	dev_info_t		*dip = vdp->xs_dip;
	boolean_t		fb_exists;
	int			err, instance = ddi_get_instance(dip);
	uint64_t		sectors;
	uint_t			dinfo, ssize;
	char			*xsname;

	ASSERT(MUTEX_HELD(&vdp->xs_cbmutex));

	if (((xsname = xvdi_get_xsname(dip)) == NULL) ||
	    ((vdp->xs_peer = xvdi_get_oeid(dip)) == (domid_t)-1))
		return;

	mutex_enter(&vdp->xs_iomutex);
	/*
	 * if the hotplug scripts haven't run or if the frontend is not
	 * initialized, then we can't try to connect.
	 */
	if (!vdp->xs_hp_connected || !vdp->xs_fe_initialised) {
		ASSERT(!vdp->xs_if_connected);
		mutex_exit(&vdp->xs_iomutex);
		return;
	}

	/* If we're already connected then there's nothing todo */
	if (vdp->xs_if_connected) {
		mutex_exit(&vdp->xs_iomutex);
		return;
	}
	mutex_exit(&vdp->xs_iomutex);

	/*
	 * Start connect to frontend only when backend device are ready
	 * and frontend has moved to XenbusStateInitialised, which means
	 * ready to connect.
	 */
	XDB_DBPRINT(XDB_DBG_INFO, (CE_NOTE,
	    "xdb@%s: starting connection process", ddi_get_name_addr(dip)));

	if (xdb_open_device(vdp) != DDI_SUCCESS)
		return;

	if (xdb_bindto_frontend(vdp) != DDI_SUCCESS) {
		xdb_close_device(vdp);
		return;
	}

	/* init i/o requests */
	xdb_init_ioreqs(vdp);

	if (ddi_add_intr(dip, 0, NULL, NULL, xdb_intr, (caddr_t)vdp)
	    != DDI_SUCCESS) {
		xdb_uninit_ioreqs(vdp);
		xdb_unbindfrom_frontend(vdp);
		xdb_close_device(vdp);
		return;
	}

	dinfo = 0;
	if (XDB_IS_RO(vdp))
		dinfo |= VDISK_READONLY;
	if (XDB_IS_BE_RMB(vdp))
		dinfo |= VDISK_REMOVABLE;
	if (XDB_IS_BE_CD(vdp))
		dinfo |= VDISK_CDROM;
	if (XDB_IS_FE_CD(vdp))
		dinfo |= VDISK_REMOVABLE | VDISK_CDROM;

	/*
	 * we can recieve intr any time from now on
	 * mark that we're ready to take intr
	 */
	mutex_enter(&vdp->xs_iomutex);
	ASSERT(vdp->xs_fe_initialised);
	vdp->xs_if_connected = B_TRUE;
	mutex_exit(&vdp->xs_iomutex);

trans_retry:
	/* write into xenstore the info needed by frontend */
	if ((err = xenbus_transaction_start(&xbt)) != 0) {
		xvdi_dev_error(dip, err, "connect transaction init");
		goto errout;
	}

	/* If feature-barrier isn't present in xenstore, add it.  */
	fb_exists = xenbus_exists(xsname, XBP_FB);

	ssize = (vdp->xs_sec_size == 0) ? DEV_BSIZE : vdp->xs_sec_size;
	sectors = vdp->xs_sectors;
	if (((!fb_exists &&
	    (err = xenbus_printf(xbt, xsname, XBP_FB, "%d", 1)))) ||
	    (err = xenbus_printf(xbt, xsname, XBP_INFO, "%u", dinfo)) ||
	    (err = xenbus_printf(xbt, xsname, XBP_SECTOR_SIZE, "%u", ssize)) ||
	    (err = xenbus_printf(xbt, xsname,
	    XBP_SECTORS, "%"PRIu64, sectors)) ||
	    (err = xenbus_printf(xbt, xsname, "instance", "%d", instance)) ||
	    ((err = xvdi_switch_state(dip, xbt, XenbusStateConnected)) > 0)) {
		(void) xenbus_transaction_end(xbt, 1);
		xvdi_dev_error(dip, err, "connect transaction setup");
		goto errout;
	}

	if ((err = xenbus_transaction_end(xbt, 0)) != 0) {
		if (err == EAGAIN) {
			/* transaction is ended, don't need to abort it */
			goto trans_retry;
		}
		xvdi_dev_error(dip, err, "connect transaction commit");
		goto errout;
	}

	return;

errout:
	xdb_close(dip);
}

/*
 * Disconnect from frontend and close backend device
 */
static void
xdb_close(dev_info_t *dip)
{
	xdb_t *vdp = (xdb_t *)ddi_get_driver_private(dip);

	ASSERT(MUTEX_HELD(&vdp->xs_cbmutex));
	mutex_enter(&vdp->xs_iomutex);

	/*
	 * if the hotplug scripts haven't run or if the frontend is not
	 * initialized, then we can't be connected, so there's no
	 * connection to close.
	 */
	if (!vdp->xs_hp_connected || !vdp->xs_fe_initialised) {
		ASSERT(!vdp->xs_if_connected);
		mutex_exit(&vdp->xs_iomutex);
		return;
	}

	/* if we're not connected, there's nothing to do */
	if (!vdp->xs_if_connected) {
		cv_broadcast(&vdp->xs_iocv);
		mutex_exit(&vdp->xs_iomutex);
		return;
	}

	XDB_DBPRINT(XDB_DBG_INFO, (CE_NOTE, "closing while connected"));

	vdp->xs_if_connected = B_FALSE;
	cv_broadcast(&vdp->xs_iocv);

	mutex_exit(&vdp->xs_iomutex);

	/* stop accepting I/O request from frontend */
	ddi_remove_intr(dip, 0, NULL);

	/* clear all on-going I/Os, if any */
	mutex_enter(&vdp->xs_iomutex);
	while (vdp->xs_ionum > 0)
		cv_wait(&vdp->xs_ionumcv, &vdp->xs_iomutex);
	mutex_exit(&vdp->xs_iomutex);

	/* clean up resources and close this interface */
	xdb_uninit_ioreqs(vdp);
	xdb_unbindfrom_frontend(vdp);
	xdb_close_device(vdp);
	vdp->xs_peer = (domid_t)-1;
}

static void
xdb_send_buf(void *arg)
{
	xdb_t	*vdp = (xdb_t *)arg;
	buf_t	*bp;
	int	err;

	mutex_enter(&vdp->xs_iomutex);
	while (vdp->xs_send_buf) {
		if ((bp = vdp->xs_f_iobuf) == NULL) {
			/* wait for some io to send */
			XDB_DBPRINT(XDB_DBG_IO, (CE_NOTE,
			    "send buf waiting for io"));
			cv_wait(&vdp->xs_iocv, &vdp->xs_iomutex);
			continue;
		}

		vdp->xs_f_iobuf = bp->av_forw;
		bp->av_forw = NULL;
		vdp->xs_ionum++;

		mutex_exit(&vdp->xs_iomutex);
		if (bp->b_bcount == 0) {
			/* no I/O needs to be done */
			(void) xdb_biodone(bp);
			mutex_enter(&vdp->xs_iomutex);
			continue;
		}

		err = EIO;
		if (vdp->xs_ldi_hdl != NULL)
			err = ldi_strategy(vdp->xs_ldi_hdl, bp);
		if (err != 0) {
			bp->b_flags |= B_ERROR;
			(void) xdb_biodone(bp);
			XDB_DBPRINT(XDB_DBG_IO, (CE_WARN,
			    "xdb@%s: sent buf to backend devfailed, err=%d",
			    ddi_get_name_addr(vdp->xs_dip), err));
		} else {
			XDB_DBPRINT(XDB_DBG_IO, (CE_NOTE,
			    "sent buf to backend ok"));
		}
		mutex_enter(&vdp->xs_iomutex);
	}
	XDB_DBPRINT(XDB_DBG_IO, (CE_NOTE, "send buf finishing"));
	mutex_exit(&vdp->xs_iomutex);
}

/*ARGSUSED*/
static void
xdb_hp_state_change(dev_info_t *dip, ddi_eventcookie_t id, void *arg,
    void *impl_data)
{
	xendev_hotplug_state_t state = *(xendev_hotplug_state_t *)impl_data;
	xdb_t *vdp = (xdb_t *)ddi_get_driver_private(dip);

	XDB_DBPRINT(XDB_DBG_INFO, (CE_NOTE, "xdb@%s: "
	    "hotplug status change to %d!", ddi_get_name_addr(dip), state));

	if (state != Connected)
		return;

	mutex_enter(&vdp->xs_cbmutex);

	/* If hotplug script have already run, there's nothing todo */
	if (vdp->xs_hp_connected) {
		mutex_exit(&vdp->xs_cbmutex);
		return;
	}

	vdp->xs_hp_connected = B_TRUE;
	xdb_start_connect(vdp);
	mutex_exit(&vdp->xs_cbmutex);
}

/*ARGSUSED*/
static void
xdb_oe_state_change(dev_info_t *dip, ddi_eventcookie_t id, void *arg,
    void *impl_data)
{
	XenbusState new_state = *(XenbusState *)impl_data;
	xdb_t *vdp = (xdb_t *)ddi_get_driver_private(dip);

	XDB_DBPRINT(XDB_DBG_INFO, (CE_NOTE, "xdb@%s: "
	    "otherend state change to %d!", ddi_get_name_addr(dip), new_state));

	mutex_enter(&vdp->xs_cbmutex);

	/*
	 * Now it'd really be nice if there was a well defined state
	 * transition model for xen frontend drivers, but unfortunatly
	 * there isn't.  So we're stuck with assuming that all state
	 * transitions are possible, and we'll just have to deal with
	 * them regardless of what state we're in.
	 */
	switch (new_state) {
	case XenbusStateUnknown:
	case XenbusStateInitialising:
	case XenbusStateInitWait:
		/* tear down our connection to the frontend */
		xdb_close(dip);
		vdp->xs_fe_initialised = B_FALSE;
		break;

	case XenbusStateInitialised:
		/*
		 * If we were conected, then we need to drop the connection
		 * and re-negotiate it.
		 */
		xdb_close(dip);
		vdp->xs_fe_initialised = B_TRUE;
		xdb_start_connect(vdp);
		break;

	case XenbusStateConnected:
		/* nothing todo here other than congratulate the frontend */
		break;

	case XenbusStateClosing:
		/* monkey see monkey do */
		(void) xvdi_switch_state(dip, XBT_NULL, XenbusStateClosing);
		break;

	case XenbusStateClosed:
		/* tear down our connection to the frontend */
		xdb_close(dip);
		vdp->xs_fe_initialised = B_FALSE;
		(void) xvdi_switch_state(dip, XBT_NULL, new_state);
		break;
	}

	mutex_exit(&vdp->xs_cbmutex);
}

static int
xdb_attach(dev_info_t *dip, ddi_attach_cmd_t cmd)
{
	ddi_iblock_cookie_t	ibc;
	xdb_t			*vdp;
	int			instance = ddi_get_instance(dip);
	char			*xsname, *oename;
	char			*str;

	switch (cmd) {
	case DDI_RESUME:
		return (DDI_FAILURE);
	case DDI_ATTACH:
		break;
	default:
		return (DDI_FAILURE);
	}
	/* DDI_ATTACH */

	if (((xsname = xvdi_get_xsname(dip)) == NULL) ||
	    ((oename = xvdi_get_oename(dip)) == NULL))
		return (DDI_FAILURE);

	/*
	 * Disable auto-detach.  This is necessary so that we don't get
	 * detached while we're disconnected from the front end.
	 */
	(void) ddi_prop_update_int(DDI_DEV_T_NONE, dip, DDI_NO_AUTODETACH, 1);

	if (ddi_get_iblock_cookie(dip, 0, &ibc) != DDI_SUCCESS)
		return (DDI_FAILURE);

	if (ddi_soft_state_zalloc(xdb_statep, instance) != DDI_SUCCESS)
		return (DDI_FAILURE);

	vdp = ddi_get_soft_state(xdb_statep, instance);
	vdp->xs_dip = dip;
	mutex_init(&vdp->xs_iomutex, NULL, MUTEX_DRIVER, (void *)ibc);
	mutex_init(&vdp->xs_cbmutex, NULL, MUTEX_DRIVER, (void *)ibc);
	cv_init(&vdp->xs_iocv, NULL, CV_DRIVER, NULL);
	cv_init(&vdp->xs_ionumcv, NULL, CV_DRIVER, NULL);
	ddi_set_driver_private(dip, vdp);

	if (!xdb_kstat_init(vdp))
		goto errout1;

	/* Check if the frontend device is supposed to be a cdrom */
	if (xenbus_read_str(oename, XBP_DEV_TYPE, &str) != 0)
		return (DDI_FAILURE);
	if (strcmp(str, XBV_DEV_TYPE_CD) == 0)
		vdp->xs_type |= XDB_DEV_FE_CD;
	strfree(str);

	/* Check if the frontend device is supposed to be read only */
	if (xenbus_read_str(xsname, "mode", &str) != 0)
		return (DDI_FAILURE);
	if ((strcmp(str, "r") == 0) || (strcmp(str, "ro") == 0))
		vdp->xs_type |= XDB_DEV_RO;
	strfree(str);

	mutex_enter(&vdp->xs_cbmutex);
	if (!xdb_media_req_init(vdp) || !xdb_params_init(vdp)) {
		xvdi_remove_xb_watch_handlers(dip);
		mutex_exit(&vdp->xs_cbmutex);
		goto errout2;
	}
	mutex_exit(&vdp->xs_cbmutex);

	vdp->xs_send_buf = B_TRUE;
	vdp->xs_iotaskq = ddi_taskq_create(dip, "xdb_iotask", 1,
	    TASKQ_DEFAULTPRI, 0);
	(void) ddi_taskq_dispatch(vdp->xs_iotaskq, xdb_send_buf, vdp,
	    DDI_SLEEP);

	/* Watch frontend and hotplug state change */
	if ((xvdi_add_event_handler(dip, XS_OE_STATE, xdb_oe_state_change,
	    NULL) != DDI_SUCCESS) ||
	    (xvdi_add_event_handler(dip, XS_HP_STATE, xdb_hp_state_change,
	    NULL) != DDI_SUCCESS))
		goto errout3;

	/*
	 * Kick-off hotplug script
	 */
	if (xvdi_post_event(dip, XEN_HP_ADD) != DDI_SUCCESS) {
		cmn_err(CE_WARN, "xdb@%s: failed to start hotplug script",
		    ddi_get_name_addr(dip));
		goto errout3;
	}

	/*
	 * start waiting for hotplug event and otherend state event
	 * mainly for debugging, frontend will not take any op seeing this
	 */
	(void) xvdi_switch_state(dip, XBT_NULL, XenbusStateInitWait);

	XDB_DBPRINT(XDB_DBG_INFO, (CE_NOTE, "xdb@%s: attached!",
	    ddi_get_name_addr(dip)));
	return (DDI_SUCCESS);

errout3:
	ASSERT(vdp->xs_hp_connected && vdp->xs_if_connected);

	xvdi_remove_event_handler(dip, NULL);

	/* Disconnect from the backend */
	mutex_enter(&vdp->xs_cbmutex);
	mutex_enter(&vdp->xs_iomutex);
	vdp->xs_send_buf = B_FALSE;
	cv_broadcast(&vdp->xs_iocv);
	mutex_exit(&vdp->xs_iomutex);
	mutex_exit(&vdp->xs_cbmutex);

	/* wait for all io to dtrain and destroy io taskq */
	ddi_taskq_destroy(vdp->xs_iotaskq);

	/* tear down block-configure watch */
	mutex_enter(&vdp->xs_cbmutex);
	xvdi_remove_xb_watch_handlers(dip);
	mutex_exit(&vdp->xs_cbmutex);

errout2:
	/* remove kstats */
	kstat_delete(vdp->xs_kstats);

errout1:
	/* free up driver state */
	ddi_set_driver_private(dip, NULL);
	cv_destroy(&vdp->xs_iocv);
	cv_destroy(&vdp->xs_ionumcv);
	mutex_destroy(&vdp->xs_cbmutex);
	mutex_destroy(&vdp->xs_iomutex);
	ddi_soft_state_free(xdb_statep, instance);

	return (DDI_FAILURE);
}

/*ARGSUSED*/
static int
xdb_detach(dev_info_t *dip, ddi_detach_cmd_t cmd)
{
	int instance = ddi_get_instance(dip);
	xdb_t *vdp = XDB_INST2SOFTS(instance);

	switch (cmd) {
	case DDI_SUSPEND:
		return (DDI_FAILURE);
	case DDI_DETACH:
		break;
	default:
		return (DDI_FAILURE);
	}

	/* DDI_DETACH handling */

	/* refuse to detach if we're still in use by the frontend */
	mutex_enter(&vdp->xs_iomutex);
	if (vdp->xs_if_connected) {
		mutex_exit(&vdp->xs_iomutex);
		return (DDI_FAILURE);
	}
	vdp->xs_send_buf = B_FALSE;
	cv_broadcast(&vdp->xs_iocv);
	mutex_exit(&vdp->xs_iomutex);

	xvdi_remove_event_handler(dip, NULL);
	(void) xvdi_post_event(dip, XEN_HP_REMOVE);

	ddi_taskq_destroy(vdp->xs_iotaskq);

	mutex_enter(&vdp->xs_cbmutex);
	xvdi_remove_xb_watch_handlers(dip);
	mutex_exit(&vdp->xs_cbmutex);

	cv_destroy(&vdp->xs_iocv);
	cv_destroy(&vdp->xs_ionumcv);
	mutex_destroy(&vdp->xs_cbmutex);
	mutex_destroy(&vdp->xs_iomutex);
	kstat_delete(vdp->xs_kstats);
	ddi_set_driver_private(dip, NULL);
	ddi_soft_state_free(xdb_statep, instance);

	XDB_DBPRINT(XDB_DBG_INFO, (CE_NOTE, "xdb@%s: detached!",
	    ddi_get_name_addr(dip)));
	return (DDI_SUCCESS);
}

static struct dev_ops xdb_dev_ops = {
	DEVO_REV,	/* devo_rev */
	0,		/* devo_refcnt */
	ddi_getinfo_1to1, /* devo_getinfo */
	nulldev,	/* devo_identify */
	nulldev,	/* devo_probe */
	xdb_attach,	/* devo_attach */
	xdb_detach,	/* devo_detach */
	nodev,		/* devo_reset */
	NULL,		/* devo_cb_ops */
	NULL,		/* devo_bus_ops */
	NULL,		/* power */
	ddi_quiesce_not_needed, /* quiesce */
};

/*
 * Module linkage information for the kernel.
 */
static struct modldrv modldrv = {
	&mod_driverops,			/* Type of module. */
	"vbd backend driver",		/* Name of the module */
	&xdb_dev_ops			/* driver ops */
};

static struct modlinkage xdb_modlinkage = {
	MODREV_1,
	&modldrv,
	NULL
};

int
_init(void)
{
	int rv;

	if ((rv = ddi_soft_state_init((void **)&xdb_statep,
	    sizeof (xdb_t), 0)) == 0)
		if ((rv = mod_install(&xdb_modlinkage)) != 0)
			ddi_soft_state_fini((void **)&xdb_statep);
	return (rv);
}

int
_fini(void)
{
	int rv;

	if ((rv = mod_remove(&xdb_modlinkage)) != 0)
		return (rv);
	ddi_soft_state_fini((void **)&xdb_statep);
	return (rv);
}

int
_info(struct modinfo *modinfop)
{
	return (mod_info(&xdb_modlinkage, modinfop));
}

static int
xdb_get_request(xdb_t *vdp, blkif_request_t *req)
{
	void *src = xvdi_ring_get_request(vdp->xs_ring);

	if (src == NULL)
		return (0);

	switch (vdp->xs_blk_protocol) {
	case BLKIF_PROTOCOL_NATIVE:
		(void) memcpy(req, src, sizeof (*req));
		break;
	case BLKIF_PROTOCOL_X86_32:
		blkif_get_x86_32_req(req, src);
		break;
	case BLKIF_PROTOCOL_X86_64:
		blkif_get_x86_64_req(req, src);
		break;
	default:
		cmn_err(CE_PANIC, "xdb@%s: unrecognised protocol: %d",
		    ddi_get_name_addr(vdp->xs_dip),
		    vdp->xs_blk_protocol);
	}
	return (1);
}

static int
xdb_push_response(xdb_t *vdp, uint64_t id, uint8_t op, uint16_t status)
{
	ddi_acc_handle_t acchdl = vdp->xs_ring_hdl;
	blkif_response_t *rsp = xvdi_ring_get_response(vdp->xs_ring);
	blkif_x86_32_response_t *rsp_32 = (blkif_x86_32_response_t *)rsp;
	blkif_x86_64_response_t *rsp_64 = (blkif_x86_64_response_t *)rsp;

	ASSERT(rsp);

	switch (vdp->xs_blk_protocol) {
	case BLKIF_PROTOCOL_NATIVE:
		ddi_put64(acchdl, &rsp->id, id);
		ddi_put8(acchdl, &rsp->operation, op);
		ddi_put16(acchdl, (uint16_t *)&rsp->status,
		    status == 0 ? BLKIF_RSP_OKAY : BLKIF_RSP_ERROR);
		break;
	case BLKIF_PROTOCOL_X86_32:
		ddi_put64(acchdl, &rsp_32->id, id);
		ddi_put8(acchdl, &rsp_32->operation, op);
		ddi_put16(acchdl, (uint16_t *)&rsp_32->status,
		    status == 0 ? BLKIF_RSP_OKAY : BLKIF_RSP_ERROR);
		break;
	case BLKIF_PROTOCOL_X86_64:
		ddi_put64(acchdl, &rsp_64->id, id);
		ddi_put8(acchdl, &rsp_64->operation, op);
		ddi_put16(acchdl, (uint16_t *)&rsp_64->status,
		    status == 0 ? BLKIF_RSP_OKAY : BLKIF_RSP_ERROR);
		break;
	default:
		cmn_err(CE_PANIC, "xdb@%s: unrecognised protocol: %d",
		    ddi_get_name_addr(vdp->xs_dip),
		    vdp->xs_blk_protocol);
	}

	return (xvdi_ring_push_response(vdp->xs_ring));
}

static void
blkif_get_x86_32_req(blkif_request_t *dst, blkif_x86_32_request_t *src)
{
	int i, n = BLKIF_MAX_SEGMENTS_PER_REQUEST;
	dst->operation = src->operation;
	dst->nr_segments = src->nr_segments;
	dst->handle = src->handle;
	dst->id = src->id;
	dst->sector_number = src->sector_number;
	if (n > src->nr_segments)
		n = src->nr_segments;
	for (i = 0; i < n; i++)
		dst->seg[i] = src->seg[i];
}

static void
blkif_get_x86_64_req(blkif_request_t *dst, blkif_x86_64_request_t *src)
{
	int i, n = BLKIF_MAX_SEGMENTS_PER_REQUEST;
	dst->operation = src->operation;
	dst->nr_segments = src->nr_segments;
	dst->handle = src->handle;
	dst->id = src->id;
	dst->sector_number = src->sector_number;
	if (n > src->nr_segments)
		n = src->nr_segments;
	for (i = 0; i < n; i++)
		dst->seg[i] = src->seg[i];
}