common/io/devinfo.c

/*
 * CDDL HEADER START
 *
 * The contents of this file are subject to the terms of the
 * Common Development and Distribution License (the "License").
 * You may not use this file except in compliance with the License.
 *
 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
 * or http://www.opensolaris.org/os/licensing.
 * See the License for the specific language governing permissions
 * and limitations under the License.
 *
 * When distributing Covered Code, include this CDDL HEADER in each
 * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
 * If applicable, add the following below this CDDL HEADER, with the
 * fields enclosed by brackets "[]" replaced with your own identifying
 * information: Portions Copyright [yyyy] [name of copyright owner]
 *
 * CDDL HEADER END
 */

/*
 * Copyright 2008 Sun Microsystems, Inc.  All rights reserved.
 * Use is subject to license terms.
 */

/*
 * driver for accessing kernel devinfo tree.
 */
#include <sys/types.h>
#include <sys/pathname.h>
#include <sys/debug.h>
#include <sys/autoconf.h>
#include <sys/vmsystm.h>
#include <sys/conf.h>
#include <sys/file.h>
#include <sys/kmem.h>
#include <sys/modctl.h>
#include <sys/stat.h>
#include <sys/ddi.h>
#include <sys/sunddi.h>
#include <sys/sunldi_impl.h>
#include <sys/sunndi.h>
#include <sys/esunddi.h>
#include <sys/sunmdi.h>
#include <sys/ddi_impldefs.h>
#include <sys/ndi_impldefs.h>
#include <sys/mdi_impldefs.h>
#include <sys/devinfo_impl.h>
#include <sys/thread.h>
#include <sys/modhash.h>
#include <sys/bitmap.h>
#include <util/qsort.h>
#include <sys/disp.h>
#include <sys/kobj.h>
#include <sys/crc32.h>


#ifdef DEBUG
static int di_debug;
#define	dcmn_err(args) if (di_debug >= 1) cmn_err args
#define	dcmn_err2(args) if (di_debug >= 2) cmn_err args
#define	dcmn_err3(args) if (di_debug >= 3) cmn_err args
#else
#define	dcmn_err(args) /* nothing */
#define	dcmn_err2(args) /* nothing */
#define	dcmn_err3(args) /* nothing */
#endif

/*
 * We partition the space of devinfo minor nodes equally between the full and
 * unprivileged versions of the driver.  The even-numbered minor nodes are the
 * full version, while the odd-numbered ones are the read-only version.
 */
static int di_max_opens = 32;

static int di_prop_dyn = 1;		/* enable dynamic property support */

#define	DI_FULL_PARENT		0
#define	DI_READONLY_PARENT	1
#define	DI_NODE_SPECIES		2
#define	DI_UNPRIVILEGED_NODE(x)	(((x) % 2) != 0)

#define	IOC_IDLE	0	/* snapshot ioctl states */
#define	IOC_SNAP	1	/* snapshot in progress */
#define	IOC_DONE	2	/* snapshot done, but not copied out */
#define	IOC_COPY	3	/* copyout in progress */

/*
 * Keep max alignment so we can move snapshot to different platforms.
 *
 * NOTE: Most callers should rely on the di_checkmem return value
 * being aligned, and reestablish *off_p with aligned value, instead
 * of trying to align size of their allocations: this approach will
 * minimize memory use.
 */
#define	DI_ALIGN(addr)	((addr + 7l) & ~7l)

/*
 * To avoid wasting memory, make a linked list of memory chunks.
 * Size of each chunk is buf_size.
 */
struct di_mem {
	struct di_mem	*next;		/* link to next chunk */
	char		*buf;		/* contiguous kernel memory */
	size_t		buf_size;	/* size of buf in bytes */
	devmap_cookie_t	cook;		/* cookie from ddi_umem_alloc */
};

/*
 * This is a stack for walking the tree without using recursion.
 * When the devinfo tree height is above some small size, one
 * gets watchdog resets on sun4m.
 */
struct di_stack {
	void		*offset[MAX_TREE_DEPTH];
	struct dev_info *dip[MAX_TREE_DEPTH];
	int		circ[MAX_TREE_DEPTH];
	int		depth;	/* depth of current node to be copied */
};

#define	TOP_OFFSET(stack)	\
	((di_off_t *)(stack)->offset[(stack)->depth - 1])
#define	TOP_NODE(stack)		\
	((stack)->dip[(stack)->depth - 1])
#define	PARENT_OFFSET(stack)	\
	((di_off_t *)(stack)->offset[(stack)->depth - 2])
#define	EMPTY_STACK(stack)	((stack)->depth == 0)
#define	POP_STACK(stack)	{ \
	ndi_devi_exit((dev_info_t *)TOP_NODE(stack), \
		(stack)->circ[(stack)->depth - 1]); \
	((stack)->depth--); \
}
#define	PUSH_STACK(stack, node, off_p)	{ \
	ASSERT(node != NULL); \
	ndi_devi_enter((dev_info_t *)node, &(stack)->circ[(stack)->depth]); \
	(stack)->dip[(stack)->depth] = (node); \
	(stack)->offset[(stack)->depth] = (void *)(off_p); \
	((stack)->depth)++; \
}

#define	DI_ALL_PTR(s)	DI_ALL(di_mem_addr((s), 0))

/*
 * With devfs, the device tree has no global locks. The device tree is
 * dynamic and dips may come and go if they are not locked locally. Under
 * these conditions, pointers are no longer reliable as unique IDs.
 * Specifically, these pointers cannot be used as keys for hash tables
 * as the same devinfo structure may be freed in one part of the tree only
 * to be allocated as the structure for a different device in another
 * part of the tree. This can happen if DR and the snapshot are
 * happening concurrently.
 * The following data structures act as keys for devinfo nodes and
 * pathinfo nodes.
 */

enum di_ktype {
	DI_DKEY = 1,
	DI_PKEY = 2
};

struct di_dkey {
	dev_info_t	*dk_dip;
	major_t		dk_major;
	int		dk_inst;
	pnode_t		dk_nodeid;
};

struct di_pkey {
	mdi_pathinfo_t	*pk_pip;
	char		*pk_path_addr;
	dev_info_t	*pk_client;
	dev_info_t	*pk_phci;
};

struct di_key {
	enum di_ktype	k_type;
	union {
		struct di_dkey dkey;
		struct di_pkey pkey;
	} k_u;
};


struct i_lnode;

typedef struct i_link {
	/*
	 * If a di_link struct representing this i_link struct makes it
	 * into the snapshot, then self will point to the offset of
	 * the di_link struct in the snapshot
	 */
	di_off_t	self;

	int		spec_type;	/* block or char access type */
	struct i_lnode	*src_lnode;	/* src i_lnode */
	struct i_lnode	*tgt_lnode;	/* tgt i_lnode */
	struct i_link	*src_link_next;	/* next src i_link /w same i_lnode */
	struct i_link	*tgt_link_next;	/* next tgt i_link /w same i_lnode */
} i_link_t;

typedef struct i_lnode {
	/*
	 * If a di_lnode struct representing this i_lnode struct makes it
	 * into the snapshot, then self will point to the offset of
	 * the di_lnode struct in the snapshot
	 */
	di_off_t	self;

	/*
	 * used for hashing and comparing i_lnodes
	 */
	int		modid;

	/*
	 * public information describing a link endpoint
	 */
	struct di_node	*di_node;	/* di_node in snapshot */
	dev_t		devt;		/* devt */

	/*
	 * i_link ptr to links coming into this i_lnode node
	 * (this i_lnode is the target of these i_links)
	 */
	i_link_t	*link_in;

	/*
	 * i_link ptr to links going out of this i_lnode node
	 * (this i_lnode is the source of these i_links)
	 */
	i_link_t	*link_out;
} i_lnode_t;

/*
 * Soft state associated with each instance of driver open.
 */
static struct di_state {
	di_off_t	mem_size;	/* total # bytes in memlist */
	struct di_mem	*memlist;	/* head of memlist */
	uint_t		command;	/* command from ioctl */
	int		di_iocstate;	/* snapshot ioctl state	*/
	mod_hash_t	*reg_dip_hash;
	mod_hash_t	*reg_pip_hash;
	int		lnode_count;
	int		link_count;

	mod_hash_t	*lnode_hash;
	mod_hash_t	*link_hash;
} **di_states;

static kmutex_t di_lock;	/* serialize instance assignment */

typedef enum {
	DI_QUIET = 0,	/* DI_QUIET must always be 0 */
	DI_ERR,
	DI_INFO,
	DI_TRACE,
	DI_TRACE1,
	DI_TRACE2
} di_cache_debug_t;

static uint_t	di_chunk = 32;		/* I/O chunk size in pages */

#define	DI_CACHE_LOCK(c)	(mutex_enter(&(c).cache_lock))
#define	DI_CACHE_UNLOCK(c)	(mutex_exit(&(c).cache_lock))
#define	DI_CACHE_LOCKED(c)	(mutex_owned(&(c).cache_lock))

/*
 * Check that whole device tree is being configured as a pre-condition for
 * cleaning up /etc/devices files.
 */
#define	DEVICES_FILES_CLEANABLE(st)	\
	(((st)->command & DINFOSUBTREE) && ((st)->command & DINFOFORCE) && \
	strcmp(DI_ALL_PTR(st)->root_path, "/") == 0)

#define	CACHE_DEBUG(args)	\
	{ if (di_cache_debug != DI_QUIET) di_cache_print args; }

typedef struct phci_walk_arg {
	di_off_t	off;
	struct di_state	*st;
} phci_walk_arg_t;

static int di_open(dev_t *, int, int, cred_t *);
static int di_ioctl(dev_t, int, intptr_t, int, cred_t *, int *);
static int di_close(dev_t, int, int, cred_t *);
static int di_info(dev_info_t *, ddi_info_cmd_t, void *, void **);
static int di_attach(dev_info_t *, ddi_attach_cmd_t);
static int di_detach(dev_info_t *, ddi_detach_cmd_t);

static di_off_t di_copyformat(di_off_t, struct di_state *, intptr_t, int);
static di_off_t di_snapshot_and_clean(struct di_state *);
static di_off_t di_copydevnm(di_off_t *, struct di_state *);
static di_off_t di_copytree(struct dev_info *, di_off_t *, struct di_state *);
static di_off_t di_copynode(struct dev_info *, struct di_stack *,
    struct di_state *);
static di_off_t di_getmdata(struct ddi_minor_data *, di_off_t *, di_off_t,
    struct di_state *);
static di_off_t di_getppdata(struct dev_info *, di_off_t *, struct di_state *);
static di_off_t di_getdpdata(struct dev_info *, di_off_t *, struct di_state *);
static di_off_t di_getprop(int, struct ddi_prop **, di_off_t *,
    struct di_state *, struct dev_info *);
static void di_allocmem(struct di_state *, size_t);
static void di_freemem(struct di_state *);
static void di_copymem(struct di_state *st, caddr_t buf, size_t bufsiz);
static di_off_t di_checkmem(struct di_state *, di_off_t, size_t);
static void *di_mem_addr(struct di_state *, di_off_t);
static int di_setstate(struct di_state *, int);
static void di_register_dip(struct di_state *, dev_info_t *, di_off_t);
static void di_register_pip(struct di_state *, mdi_pathinfo_t *, di_off_t);
static di_off_t di_getpath_data(dev_info_t *, di_off_t *, di_off_t,
    struct di_state *, int);
static di_off_t di_getlink_data(di_off_t, struct di_state *);
static int di_dip_find(struct di_state *st, dev_info_t *node, di_off_t *off_p);

static int cache_args_valid(struct di_state *st, int *error);
static int snapshot_is_cacheable(struct di_state *st);
static int di_cache_lookup(struct di_state *st);
static int di_cache_update(struct di_state *st);
static void di_cache_print(di_cache_debug_t msglevel, char *fmt, ...);
static int build_vhci_list(dev_info_t *vh_devinfo, void *arg);
static int build_phci_list(dev_info_t *ph_devinfo, void *arg);

extern int modrootloaded;
extern void mdi_walk_vhcis(int (*)(dev_info_t *, void *), void *);
extern void mdi_vhci_walk_phcis(dev_info_t *,
	int (*)(dev_info_t *, void *), void *);


static struct cb_ops di_cb_ops = {
	di_open,		/* open */
	di_close,		/* close */
	nodev,			/* strategy */
	nodev,			/* print */
	nodev,			/* dump */
	nodev,			/* read */
	nodev,			/* write */
	di_ioctl,		/* ioctl */
	nodev,			/* devmap */
	nodev,			/* mmap */
	nodev,			/* segmap */
	nochpoll,		/* poll */
	ddi_prop_op,		/* prop_op */
	NULL,			/* streamtab  */
	D_NEW | D_MP		/* Driver compatibility flag */
};

static struct dev_ops di_ops = {
	DEVO_REV,		/* devo_rev, */
	0,			/* refcnt  */
	di_info,		/* info */
	nulldev,		/* identify */
	nulldev,		/* probe */
	di_attach,		/* attach */
	di_detach,		/* detach */
	nodev,			/* reset */
	&di_cb_ops,		/* driver operations */
	NULL			/* bus operations */
};

/*
 * Module linkage information for the kernel.
 */
static struct modldrv modldrv = {
	&mod_driverops,
	"DEVINFO Driver",
	&di_ops
};

static struct modlinkage modlinkage = {
	MODREV_1,
	&modldrv,
	NULL
};

int
_init(void)
{
	int	error;

	mutex_init(&di_lock, NULL, MUTEX_DRIVER, NULL);

	error = mod_install(&modlinkage);
	if (error != 0) {
		mutex_destroy(&di_lock);
		return (error);
	}

	return (0);
}

int
_info(struct modinfo *modinfop)
{
	return (mod_info(&modlinkage, modinfop));
}

int
_fini(void)
{
	int	error;

	error = mod_remove(&modlinkage);
	if (error != 0) {
		return (error);
	}

	mutex_destroy(&di_lock);
	return (0);
}

static dev_info_t *di_dip;

/*ARGSUSED*/
static int
di_info(dev_info_t *dip, ddi_info_cmd_t infocmd, void *arg, void **result)
{
	int	error = DDI_FAILURE;

	switch (infocmd) {
	case DDI_INFO_DEVT2DEVINFO:
		*result = (void *)di_dip;
		error = DDI_SUCCESS;
		break;
	case DDI_INFO_DEVT2INSTANCE:
		/*
		 * All dev_t's map to the same, single instance.
		 */
		*result = (void *)0;
		error = DDI_SUCCESS;
		break;
	default:
		break;
	}

	return (error);
}

static int
di_attach(dev_info_t *dip, ddi_attach_cmd_t cmd)
{
	int	error = DDI_FAILURE;

	switch (cmd) {
	case DDI_ATTACH:
		di_states = kmem_zalloc(
		    di_max_opens * sizeof (struct di_state *), KM_SLEEP);

		if (ddi_create_minor_node(dip, "devinfo", S_IFCHR,
		    DI_FULL_PARENT, DDI_PSEUDO, NULL) == DDI_FAILURE ||
		    ddi_create_minor_node(dip, "devinfo,ro", S_IFCHR,
		    DI_READONLY_PARENT, DDI_PSEUDO, NULL) == DDI_FAILURE) {
			kmem_free(di_states,
			    di_max_opens * sizeof (struct di_state *));
			ddi_remove_minor_node(dip, NULL);
			error = DDI_FAILURE;
		} else {
			di_dip = dip;
			ddi_report_dev(dip);

			error = DDI_SUCCESS;
		}
		break;
	default:
		error = DDI_FAILURE;
		break;
	}

	return (error);
}

static int
di_detach(dev_info_t *dip, ddi_detach_cmd_t cmd)
{
	int	error = DDI_FAILURE;

	switch (cmd) {
	case DDI_DETACH:
		ddi_remove_minor_node(dip, NULL);
		di_dip = NULL;
		kmem_free(di_states, di_max_opens * sizeof (struct di_state *));

		error = DDI_SUCCESS;
		break;
	default:
		error = DDI_FAILURE;
		break;
	}

	return (error);
}

/*
 * Allow multiple opens by tweaking the dev_t such that it looks like each
 * open is getting a different minor device.  Each minor gets a separate
 * entry in the di_states[] table.  Based on the original minor number, we
 * discriminate opens of the full and read-only nodes.  If all of the instances
 * of the selected minor node are currently open, we return EAGAIN.
 */
/*ARGSUSED*/
static int
di_open(dev_t *devp, int flag, int otyp, cred_t *credp)
{
	int	m;
	minor_t	minor_parent = getminor(*devp);

	if (minor_parent != DI_FULL_PARENT &&
	    minor_parent != DI_READONLY_PARENT)
		return (ENXIO);

	mutex_enter(&di_lock);

	for (m = minor_parent; m < di_max_opens; m += DI_NODE_SPECIES) {
		if (di_states[m] != NULL)
			continue;

		di_states[m] = kmem_zalloc(sizeof (struct di_state), KM_SLEEP);
		break;	/* It's ours. */
	}

	if (m >= di_max_opens) {
		/*
		 * maximum open instance for device reached
		 */
		mutex_exit(&di_lock);
		dcmn_err((CE_WARN, "devinfo: maximum devinfo open reached"));
		return (EAGAIN);
	}
	mutex_exit(&di_lock);

	ASSERT(m < di_max_opens);
	*devp = makedevice(getmajor(*devp), (minor_t)(m + DI_NODE_SPECIES));

	dcmn_err((CE_CONT, "di_open: thread = %p, assigned minor = %d\n",
	    (void *)curthread, m + DI_NODE_SPECIES));

	return (0);
}

/*ARGSUSED*/
static int
di_close(dev_t dev, int flag, int otype, cred_t *cred_p)
{
	struct di_state	*st;
	int		m = (int)getminor(dev) - DI_NODE_SPECIES;

	if (m < 0) {
		cmn_err(CE_WARN, "closing non-existent devinfo minor %d",
		    m + DI_NODE_SPECIES);
		return (ENXIO);
	}

	st = di_states[m];
	ASSERT(m < di_max_opens && st != NULL);

	di_freemem(st);
	kmem_free(st, sizeof (struct di_state));

	/*
	 * empty slot in state table
	 */
	mutex_enter(&di_lock);
	di_states[m] = NULL;
	dcmn_err((CE_CONT, "di_close: thread = %p, assigned minor = %d\n",
	    (void *)curthread, m + DI_NODE_SPECIES));
	mutex_exit(&di_lock);

	return (0);
}


/*ARGSUSED*/
static int
di_ioctl(dev_t dev, int cmd, intptr_t arg, int mode, cred_t *credp, int *rvalp)
{
	int		rv, error;
	di_off_t	off;
	struct di_all	*all;
	struct di_state	*st;
	int		m = (int)getminor(dev) - DI_NODE_SPECIES;
	major_t		i;
	char		*drv_name;
	size_t		map_size, size;
	struct di_mem	*dcp;
	int		ndi_flags;

	if (m < 0 || m >= di_max_opens) {
		return (ENXIO);
	}

	st = di_states[m];
	ASSERT(st != NULL);

	dcmn_err2((CE_CONT, "di_ioctl: mode = %x, cmd = %x\n", mode, cmd));

	switch (cmd) {
	case DINFOIDENT:
		/*
		 * This is called from di_init to verify that the driver
		 * opened is indeed devinfo. The purpose is to guard against
		 * sending ioctl to an unknown driver in case of an
		 * unresolved major number conflict during bfu.
		 */
		*rvalp = DI_MAGIC;
		return (0);

	case DINFOLODRV:
		/*
		 * Hold an installed driver and return the result
		 */
		if (DI_UNPRIVILEGED_NODE(m)) {
			/*
			 * Only the fully enabled instances may issue
			 * DINFOLDDRV.
			 */
			return (EACCES);
		}

		drv_name = kmem_alloc(MAXNAMELEN, KM_SLEEP);
		if (ddi_copyin((void *)arg, drv_name, MAXNAMELEN, mode) != 0) {
			kmem_free(drv_name, MAXNAMELEN);
			return (EFAULT);
		}

		/*
		 * Some 3rd party driver's _init() walks the device tree,
		 * so we load the driver module before configuring driver.
		 */
		i = ddi_name_to_major(drv_name);
		if (ddi_hold_driver(i) == NULL) {
			kmem_free(drv_name, MAXNAMELEN);
			return (ENXIO);
		}

		ndi_flags = NDI_DEVI_PERSIST | NDI_CONFIG | NDI_NO_EVENT;

		/*
		 * i_ddi_load_drvconf() below will trigger a reprobe
		 * via reset_nexus_flags(). NDI_DRV_CONF_REPROBE isn't
		 * needed here.
		 */
		modunload_disable();
		(void) i_ddi_load_drvconf(i);
		(void) ndi_devi_config_driver(ddi_root_node(), ndi_flags, i);
		kmem_free(drv_name, MAXNAMELEN);
		ddi_rele_driver(i);
		rv = i_ddi_devs_attached(i);
		modunload_enable();

		i_ddi_di_cache_invalidate(KM_SLEEP);

		return ((rv == DDI_SUCCESS)? 0 : ENXIO);

	case DINFOUSRLD:
		/*
		 * The case for copying snapshot to userland
		 */
		if (di_setstate(st, IOC_COPY) == -1)
			return (EBUSY);

		map_size = DI_ALL_PTR(st)->map_size;
		if (map_size == 0) {
			(void) di_setstate(st, IOC_DONE);
			return (EFAULT);
		}

		/*
		 * copyout the snapshot
		 */
		map_size = (map_size + PAGEOFFSET) & PAGEMASK;

		/*
		 * Return the map size, so caller may do a sanity
		 * check against the return value of snapshot ioctl()
		 */
		*rvalp = (int)map_size;

		/*
		 * Copy one chunk at a time
		 */
		off = 0;
		dcp = st->memlist;
		while (map_size) {
			size = dcp->buf_size;
			if (map_size <= size) {
				size = map_size;
			}

			if (ddi_copyout(di_mem_addr(st, off),
			    (void *)(arg + off), size, mode) != 0) {
				(void) di_setstate(st, IOC_DONE);
				return (EFAULT);
			}

			map_size -= size;
			off += size;
			dcp = dcp->next;
		}

		di_freemem(st);
		(void) di_setstate(st, IOC_IDLE);
		return (0);

	default:
		if ((cmd & ~DIIOC_MASK) != DIIOC) {
			/*
			 * Invalid ioctl command
			 */
			return (ENOTTY);
		}
		/*
		 * take a snapshot
		 */
		st->command = cmd & DIIOC_MASK;
		/*FALLTHROUGH*/
	}

	/*
	 * Obtain enough memory to hold header + rootpath.  We prevent kernel
	 * memory exhaustion by freeing any previously allocated snapshot and
	 * refusing the operation; otherwise we would be allowing ioctl(),
	 * ioctl(), ioctl(), ..., panic.
	 */
	if (di_setstate(st, IOC_SNAP) == -1)
		return (EBUSY);

	/*
	 * Initial memlist always holds di_all and the root_path - and
	 * is at least a page and size.
	 */
	size = sizeof (struct di_all) +
	    sizeof (((struct dinfo_io *)(NULL))->root_path);
	if (size < PAGESIZE)
		size = PAGESIZE;
	off = di_checkmem(st, 0, size);
	all = DI_ALL_PTR(st);
	off += sizeof (struct di_all);		/* real length of di_all */

	all->devcnt = devcnt;
	all->command = st->command;
	all->version = DI_SNAPSHOT_VERSION;
	all->top_vhci_devinfo = 0;		/* filled by build_vhci_list. */

	/*
	 * Note the endianness in case we need to transport snapshot
	 * over the network.
	 */
#if defined(_LITTLE_ENDIAN)
	all->endianness = DI_LITTLE_ENDIAN;
#else
	all->endianness = DI_BIG_ENDIAN;
#endif

	/* Copyin ioctl args, store in the snapshot. */
	if (copyinstr((void *)arg, all->root_path,
	    sizeof (((struct dinfo_io *)(NULL))->root_path), &size) != 0) {
		di_freemem(st);
		(void) di_setstate(st, IOC_IDLE);
		return (EFAULT);
	}
	off += size;				/* real length of root_path */

	if ((st->command & DINFOCLEANUP) && !DEVICES_FILES_CLEANABLE(st)) {
		di_freemem(st);
		(void) di_setstate(st, IOC_IDLE);
		return (EINVAL);
	}

	error = 0;
	if ((st->command & DINFOCACHE) && !cache_args_valid(st, &error)) {
		di_freemem(st);
		(void) di_setstate(st, IOC_IDLE);
		return (error);
	}

	/*
	 * Only the fully enabled version may force load drivers or read
	 * the parent private data from a driver.
	 */
	if ((st->command & (DINFOPRIVDATA | DINFOFORCE)) != 0 &&
	    DI_UNPRIVILEGED_NODE(m)) {
		di_freemem(st);
		(void) di_setstate(st, IOC_IDLE);
		return (EACCES);
	}

	/* Do we need private data? */
	if (st->command & DINFOPRIVDATA) {
		arg += sizeof (((struct dinfo_io *)(NULL))->root_path);

#ifdef _MULTI_DATAMODEL
		switch (ddi_model_convert_from(mode & FMODELS)) {
		case DDI_MODEL_ILP32: {
			/*
			 * Cannot copy private data from 64-bit kernel
			 * to 32-bit app
			 */
			di_freemem(st);
			(void) di_setstate(st, IOC_IDLE);
			return (EINVAL);
		}
		case DDI_MODEL_NONE:
			if ((off = di_copyformat(off, st, arg, mode)) == 0) {
				di_freemem(st);
				(void) di_setstate(st, IOC_IDLE);
				return (EFAULT);
			}
			break;
		}
#else /* !_MULTI_DATAMODEL */
		if ((off = di_copyformat(off, st, arg, mode)) == 0) {
			di_freemem(st);
			(void) di_setstate(st, IOC_IDLE);
			return (EFAULT);
		}
#endif /* _MULTI_DATAMODEL */
	}

	all->top_devinfo = DI_ALIGN(off);

	/*
	 * For cache lookups we reallocate memory from scratch,
	 * so the value of "all" is no longer valid.
	 */
	all = NULL;

	if (st->command & DINFOCACHE) {
		*rvalp = di_cache_lookup(st);
	} else if (snapshot_is_cacheable(st)) {
		DI_CACHE_LOCK(di_cache);
		*rvalp = di_cache_update(st);
		DI_CACHE_UNLOCK(di_cache);
	} else
		*rvalp = di_snapshot_and_clean(st);

	if (*rvalp) {
		DI_ALL_PTR(st)->map_size = *rvalp;
		(void) di_setstate(st, IOC_DONE);
	} else {
		di_freemem(st);
		(void) di_setstate(st, IOC_IDLE);
	}

	return (0);
}

/*
 * Get a chunk of memory >= size, for the snapshot
 */
static void
di_allocmem(struct di_state *st, size_t size)
{
	struct di_mem	*mem = kmem_zalloc(sizeof (struct di_mem), KM_SLEEP);

	/*
	 * Round up size to nearest power of 2. If it is less
	 * than st->mem_size, set it to st->mem_size (i.e.,
	 * the mem_size is doubled every time) to reduce the
	 * number of memory allocations.
	 */
	size_t tmp = 1;
	while (tmp < size) {
		tmp <<= 1;
	}
	size = (tmp > st->mem_size) ? tmp : st->mem_size;

	mem->buf = ddi_umem_alloc(size, DDI_UMEM_SLEEP, &mem->cook);
	mem->buf_size = size;

	dcmn_err2((CE_CONT, "di_allocmem: mem_size=%x\n", st->mem_size));

	if (st->mem_size == 0) {	/* first chunk */
		st->memlist = mem;
	} else {
		/*
		 * locate end of linked list and add a chunk at the end
		 */
		struct di_mem *dcp = st->memlist;
		while (dcp->next != NULL) {
			dcp = dcp->next;
		}

		dcp->next = mem;
	}

	st->mem_size += size;
}

/*
 * Copy upto bufsiz bytes of the memlist to buf
 */
static void
di_copymem(struct di_state *st, caddr_t buf, size_t bufsiz)
{
	struct di_mem	*dcp;
	size_t		copysz;

	if (st->mem_size == 0) {
		ASSERT(st->memlist == NULL);
		return;
	}

	copysz = 0;
	for (dcp = st->memlist; dcp; dcp = dcp->next) {

		ASSERT(bufsiz > 0);

		if (bufsiz <= dcp->buf_size)
			copysz = bufsiz;
		else
			copysz = dcp->buf_size;

		bcopy(dcp->buf, buf, copysz);

		buf += copysz;
		bufsiz -= copysz;

		if (bufsiz == 0)
			break;
	}
}

/*
 * Free all memory for the snapshot
 */
static void
di_freemem(struct di_state *st)
{
	struct di_mem	*dcp, *tmp;

	dcmn_err2((CE_CONT, "di_freemem\n"));

	if (st->mem_size) {
		dcp = st->memlist;
		while (dcp) {	/* traverse the linked list */
			tmp = dcp;
			dcp = dcp->next;
			ddi_umem_free(tmp->cook);
			kmem_free(tmp, sizeof (struct di_mem));
		}
		st->mem_size = 0;
		st->memlist = NULL;
	}

	ASSERT(st->mem_size == 0);
	ASSERT(st->memlist == NULL);
}

/*
 * Copies cached data to the di_state structure.
 * Returns:
 *	- size of data copied, on SUCCESS
 *	- 0 on failure
 */
static int
di_cache2mem(struct di_cache *cache, struct di_state *st)
{
	caddr_t	pa;

	ASSERT(st->mem_size == 0);
	ASSERT(st->memlist == NULL);
	ASSERT(!servicing_interrupt());
	ASSERT(DI_CACHE_LOCKED(*cache));

	if (cache->cache_size == 0) {
		ASSERT(cache->cache_data == NULL);
		CACHE_DEBUG((DI_ERR, "Empty cache. Skipping copy"));
		return (0);
	}

	ASSERT(cache->cache_data);

	di_allocmem(st, cache->cache_size);

	pa = di_mem_addr(st, 0);

	ASSERT(pa);

	/*
	 * Verify that di_allocmem() allocates contiguous memory,
	 * so that it is safe to do straight bcopy()
	 */
	ASSERT(st->memlist != NULL);
	ASSERT(st->memlist->next == NULL);
	bcopy(cache->cache_data, pa, cache->cache_size);

	return (cache->cache_size);
}

/*
 * Copies a snapshot from di_state to the cache
 * Returns:
 *	- 0 on failure
 *	- size of copied data on success
 */
static size_t
di_mem2cache(struct di_state *st, struct di_cache *cache)
{
	size_t	map_size;

	ASSERT(cache->cache_size == 0);
	ASSERT(cache->cache_data == NULL);
	ASSERT(!servicing_interrupt());
	ASSERT(DI_CACHE_LOCKED(*cache));

	if (st->mem_size == 0) {
		ASSERT(st->memlist == NULL);
		CACHE_DEBUG((DI_ERR, "Empty memlist. Skipping copy"));
		return (0);
	}

	ASSERT(st->memlist);

	/*
	 * The size of the memory list may be much larger than the
	 * size of valid data (map_size). Cache only the valid data
	 */
	map_size = DI_ALL_PTR(st)->map_size;
	if (map_size == 0 || map_size < sizeof (struct di_all) ||
	    map_size > st->mem_size) {
		CACHE_DEBUG((DI_ERR, "cannot cache: bad size: 0x%x", map_size));
		return (0);
	}

	cache->cache_data = kmem_alloc(map_size, KM_SLEEP);
	cache->cache_size = map_size;
	di_copymem(st, cache->cache_data, cache->cache_size);

	return (map_size);
}

/*
 * Make sure there is at least "size" bytes memory left before
 * going on. Otherwise, start on a new chunk.
 */
static di_off_t
di_checkmem(struct di_state *st, di_off_t off, size_t size)
{
	dcmn_err3((CE_CONT, "di_checkmem: off=%x size=%x\n",
	    off, (int)size));

	/*
	 * di_checkmem() shouldn't be called with a size of zero.
	 * But in case it is, we want to make sure we return a valid
	 * offset within the memlist and not an offset that points us
	 * at the end of the memlist.
	 */
	if (size == 0) {
		dcmn_err((CE_WARN, "di_checkmem: invalid zero size used"));
		size = 1;
	}

	off = DI_ALIGN(off);
	if ((st->mem_size - off) < size) {
		off = st->mem_size;
		di_allocmem(st, size);
	}

	/* verify that return value is aligned */
	ASSERT(off == DI_ALIGN(off));
	return (off);
}

/*
 * Copy the private data format from ioctl arg.
 * On success, the ending offset is returned. On error 0 is returned.
 */
static di_off_t
di_copyformat(di_off_t off, struct di_state *st, intptr_t arg, int mode)
{
	di_off_t		size;
	struct di_priv_data	*priv;
	struct di_all		*all = DI_ALL_PTR(st);

	dcmn_err2((CE_CONT, "di_copyformat: off=%x, arg=%p mode=%x\n",
	    off, (void *)arg, mode));

	/*
	 * Copyin data and check version.
	 * We only handle private data version 0.
	 */
	priv = kmem_alloc(sizeof (struct di_priv_data), KM_SLEEP);
	if ((ddi_copyin((void *)arg, priv, sizeof (struct di_priv_data),
	    mode) != 0) || (priv->version != DI_PRIVDATA_VERSION_0)) {
		kmem_free(priv, sizeof (struct di_priv_data));
		return (0);
	}

	/*
	 * Save di_priv_data copied from userland in snapshot.
	 */
	all->pd_version = priv->version;
	all->n_ppdata = priv->n_parent;
	all->n_dpdata = priv->n_driver;

	/*
	 * copyin private data format, modify offset accordingly
	 */
	if (all->n_ppdata) {	/* parent private data format */
		/*