Loading...
iokit/Kernel/IOMemoryDescriptor.cpp xnu-124.13 xnu-517
--- xnu/xnu-124.13/iokit/Kernel/IOMemoryDescriptor.cpp
+++ xnu/xnu-517/iokit/Kernel/IOMemoryDescriptor.cpp
@@ -3,19 +3,22 @@
  *
  * @APPLE_LICENSE_HEADER_START@
  * 
- * The contents of this file constitute Original Code as defined in and
- * are subject to the Apple Public Source License Version 1.1 (the
- * "License").  You may not use this file except in compliance with the
- * License.  Please obtain a copy of the License at
- * http://www.apple.com/publicsource and read it before using this file.
+ * Copyright (c) 1999-2003 Apple Computer, Inc.  All Rights Reserved.
  * 
- * This Original Code and all software distributed under the License are
- * distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY KIND, EITHER
+ * This file contains Original Code and/or Modifications of Original Code
+ * as defined in and that are subject to the Apple Public Source License
+ * Version 2.0 (the 'License'). You may not use this file except in
+ * compliance with the License. Please obtain a copy of the License at
+ * http://www.opensource.apple.com/apsl/ and read it before using this
+ * file.
+ * 
+ * The Original Code and all software distributed under the License are
+ * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER
  * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,
  * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY,
- * FITNESS FOR A PARTICULAR PURPOSE OR NON-INFRINGEMENT.  Please see the
- * License for the specific language governing rights and limitations
- * under the License.
+ * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT.
+ * Please see the License for the specific language governing rights and
+ * limitations under the License.
  * 
  * @APPLE_LICENSE_HEADER_END@
  */
@@ -25,44 +28,161 @@
  * HISTORY
  *
  */
+// 45678901234567890123456789012345678901234567890123456789012345678901234567890
+#include <sys/cdefs.h>
 
 #include <IOKit/assert.h>
 #include <IOKit/system.h>
 #include <IOKit/IOLib.h>
 #include <IOKit/IOMemoryDescriptor.h>
+#include <IOKit/IOMapper.h>
+#include <IOKit/IOKitKeysPrivate.h>
 
 #include <IOKit/IOKitDebug.h>
 
 #include <libkern/c++/OSContainers.h>
+#include <libkern/c++/OSDictionary.h>
+#include <libkern/c++/OSArray.h>
+#include <libkern/c++/OSSymbol.h>
+#include <libkern/c++/OSNumber.h>
 #include <sys/cdefs.h>
 
 __BEGIN_DECLS
 #include <vm/pmap.h>
-void pmap_enter(pmap_t pmap, vm_offset_t va, vm_offset_t pa,
-                vm_prot_t prot, boolean_t wired);
+#include <mach/memory_object_types.h>
+#include <device/device_port.h>
+
+#ifndef i386
+struct phys_entry      *pmap_find_physentry(ppnum_t pa);
+#endif
+extern ppnum_t pmap_find_phys(pmap_t pmap, addr64_t va);
 void ipc_port_release_send(ipc_port_t port);
-vm_offset_t vm_map_get_phys_page(vm_map_t map, vm_offset_t offset);
+
+/* Copy between a physical page and a virtual address in the given vm_map */
+kern_return_t copypv(addr64_t source, addr64_t sink, unsigned int size, int which);
+
+memory_object_t
+device_pager_setup(
+	memory_object_t	pager,
+	int		device_handle,
+	vm_size_t	size,
+	int		flags);
+void
+device_pager_deallocate(
+        memory_object_t);
+kern_return_t
+device_pager_populate_object(
+	memory_object_t		pager,
+	vm_object_offset_t	offset,
+	ppnum_t			phys_addr,
+	vm_size_t		size);
+kern_return_t
+memory_object_iopl_request(
+	ipc_port_t		port,
+	memory_object_offset_t	offset,
+	vm_size_t		*upl_size,
+	upl_t			*upl_ptr,
+	upl_page_info_array_t	user_page_list,
+	unsigned int		*page_list_count,
+	int			*flags);
+
+/*
+ *	Page fault handling based on vm_map (or entries therein)
+ */
+extern kern_return_t vm_fault(
+		vm_map_t	map,
+		vm_offset_t	vaddr,
+		vm_prot_t	fault_type,
+		boolean_t	change_wiring,
+		int             interruptible,
+		pmap_t		caller_pmap,
+		vm_offset_t	caller_pmap_addr);
+
+unsigned int  IOTranslateCacheBits(struct phys_entry *pp);
+
+vm_map_t IOPageableMapForAddress( vm_address_t address );
+
+typedef kern_return_t (*IOIteratePageableMapsCallback)(vm_map_t map, void * ref);
+
+kern_return_t IOIteratePageableMaps(vm_size_t size,
+                    IOIteratePageableMapsCallback callback, void * ref);
 __END_DECLS
 
+#define kIOMaximumMappedIOByteCount	(512*1024*1024)
+
+static IOMapper * gIOSystemMapper;
+static ppnum_t	  gIOMaximumMappedIOPageCount = atop_32(kIOMaximumMappedIOByteCount);
+
 /* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * */
 
-OSDefineMetaClass( IOMemoryDescriptor, OSObject )
-OSDefineAbstractStructors( IOMemoryDescriptor, OSObject )
+OSDefineMetaClassAndAbstractStructors( IOMemoryDescriptor, OSObject )
 
 #define super IOMemoryDescriptor
 
 OSDefineMetaClassAndStructors(IOGeneralMemoryDescriptor, IOMemoryDescriptor)
 
-extern "C" vm_map_t IOPageableMapForAddress( vm_address_t address );
-
 /* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * */
 
-inline vm_map_t IOGeneralMemoryDescriptor::getMapForTask( task_t task, vm_address_t address )
-{
-    if( (task == kernel_task) && (kIOMemoryRequiresWire & _flags))
-        return( IOPageableMapForAddress( address ) );
+static IORecursiveLock * gIOMemoryLock;
+
+#define LOCK	IORecursiveLockLock( gIOMemoryLock)
+#define UNLOCK	IORecursiveLockUnlock( gIOMemoryLock)
+#define SLEEP	IORecursiveLockSleep( gIOMemoryLock, (void *)this, THREAD_UNINT)
+#define WAKEUP	\
+    IORecursiveLockWakeup( gIOMemoryLock, (void *)this, /* one-thread */ false)
+
+/* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * */
+
+#define next_page(a) ( trunc_page_32(a) + PAGE_SIZE )
+
+
+extern "C" {
+
+kern_return_t device_data_action(
+               int                     device_handle, 
+               ipc_port_t              device_pager,
+               vm_prot_t               protection, 
+               vm_object_offset_t      offset, 
+               vm_size_t               size)
+{
+    struct ExpansionData {
+        void *				devicePager;
+        unsigned int			pagerContig:1;
+        unsigned int			unused:31;
+	IOMemoryDescriptor *		memory;
+    };
+    kern_return_t	 kr;
+    ExpansionData *      ref = (ExpansionData *) device_handle;
+    IOMemoryDescriptor * memDesc;
+
+    LOCK;
+    memDesc = ref->memory;
+    if( memDesc)
+	kr = memDesc->handleFault( device_pager, 0, 0,
+                offset, size, kIOMapDefaultCache /*?*/);
     else
-        return( get_task_map( task ));
+	kr = KERN_ABORTED;
+    UNLOCK;
+
+    return( kr );
+}
+
+kern_return_t device_close(
+               int     device_handle)
+{
+    struct ExpansionData {
+        void *				devicePager;
+        unsigned int			pagerContig:1;
+        unsigned int			unused:31;
+	IOMemoryDescriptor *		memory;
+    };
+    ExpansionData *   ref = (ExpansionData *) device_handle;
+
+    IODelete( ref, ExpansionData, 1 );
+
+    return( kIOReturnSuccess );
+}
+
 }
 
 /* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * */
@@ -76,13 +196,23 @@
  */
 IOMemoryDescriptor *
 IOMemoryDescriptor::withAddress(void *      address,
-                                IOByteCount   withLength,
-                                IODirection withDirection)
+                                IOByteCount   length,
+                                IODirection direction)
+{
+    return IOMemoryDescriptor::
+        withAddress((vm_address_t) address, length, direction, kernel_task);
+}
+
+IOMemoryDescriptor *
+IOMemoryDescriptor::withAddress(vm_address_t address,
+                                IOByteCount  length,
+                                IODirection  direction,
+                                task_t       task)
 {
     IOGeneralMemoryDescriptor * that = new IOGeneralMemoryDescriptor;
     if (that)
     {
-	if (that->initWithAddress(address, withLength, withDirection))
+	if (that->initWithAddress(address, length, direction, task))
 	    return that;
 
         that->release();
@@ -91,30 +221,37 @@
 }
 
 IOMemoryDescriptor *
-IOMemoryDescriptor::withAddress(vm_address_t address,
-                                IOByteCount  withLength,
-                                IODirection  withDirection,
-                                task_t       withTask)
+IOMemoryDescriptor::withPhysicalAddress(
+				IOPhysicalAddress	address,
+				IOByteCount		length,
+				IODirection      	direction )
+{
+    IOGeneralMemoryDescriptor *self = new IOGeneralMemoryDescriptor;
+    if (self
+    && !self->initWithPhysicalAddress(address, length, direction)) {
+        self->release();
+        return 0;
+    }
+
+    return self;
+}
+
+IOMemoryDescriptor *
+IOMemoryDescriptor::withRanges(	IOVirtualRange * ranges,
+				UInt32           withCount,
+				IODirection      direction,
+				task_t           task,
+				bool             asReference)
 {
     IOGeneralMemoryDescriptor * that = new IOGeneralMemoryDescriptor;
     if (that)
     {
-	if (that->initWithAddress(address, withLength, withDirection, withTask))
+	if (that->initWithRanges(ranges, withCount, direction, task, asReference))
 	    return that;
 
         that->release();
     }
     return 0;
-}
-
-IOMemoryDescriptor *
-IOMemoryDescriptor::withPhysicalAddress(
-				IOPhysicalAddress	address,
-				IOByteCount		withLength,
-				IODirection      	withDirection )
-{
-    return( IOMemoryDescriptor::withAddress( address, withLength,
-					withDirection, (task_t) 0  ));
 }
 
 
@@ -127,33 +264,48 @@
  * Passing the ranges as a reference will avoid an extra allocation.
  */
 IOMemoryDescriptor *
-IOMemoryDescriptor::withRanges(	IOVirtualRange * ranges,
-				UInt32           withCount,
-				IODirection      withDirection,
-				task_t           withTask,
-				bool             asReference = false)
+IOMemoryDescriptor::withOptions(void *		buffers,
+                                UInt32		count,
+                                UInt32		offset,
+                                task_t		task,
+                                IOOptionBits	opts,
+                                IOMapper *	mapper)
+{
+    IOGeneralMemoryDescriptor *self = new IOGeneralMemoryDescriptor;
+
+    if (self
+    && !self->initWithOptions(buffers, count, offset, task, opts, mapper))
+    {
+        self->release();
+        return 0;
+    }
+
+    return self;
+}
+
+// Can't leave abstract but this should never be used directly,
+bool IOMemoryDescriptor::initWithOptions(void *		buffers,
+                                         UInt32		count,
+                                         UInt32		offset,
+                                         task_t		task,
+                                         IOOptionBits	options,
+                                         IOMapper *	mapper)
+{
+    // @@@ gvdl: Should I panic?
+    panic("IOMD::initWithOptions called\n");
+    return 0;
+}
+
+IOMemoryDescriptor *
+IOMemoryDescriptor::withPhysicalRanges(	IOPhysicalRange * ranges,
+                                        UInt32          withCount,
+                                        IODirection     direction,
+                                        bool            asReference)
 {
     IOGeneralMemoryDescriptor * that = new IOGeneralMemoryDescriptor;
     if (that)
     {
-	if (that->initWithRanges(ranges, withCount, withDirection, withTask, asReference))
-	    return that;
-
-        that->release();
-    }
-    return 0;
-}
-
-IOMemoryDescriptor *
-IOMemoryDescriptor::withPhysicalRanges(	IOPhysicalRange * ranges,
-                                        UInt32          withCount,
-                                        IODirection     withDirection,
-                                        bool            asReference = false)
-{
-    IOGeneralMemoryDescriptor * that = new IOGeneralMemoryDescriptor;
-    if (that)
-    {
-	if (that->initWithPhysicalRanges(ranges, withCount, withDirection, asReference))
+	if (that->initWithPhysicalRanges(ranges, withCount, direction, asReference))
 	    return that;
 
         that->release();
@@ -165,15 +317,15 @@
 IOMemoryDescriptor::withSubRange(IOMemoryDescriptor *	of,
 				IOByteCount		offset,
 				IOByteCount		length,
-				IODirection		withDirection)
-{
-    IOSubMemoryDescriptor * that = new IOSubMemoryDescriptor;
-
-    if (that && !that->initSubRange(of, offset, length, withDirection)) {
-        that->release();
-	that = 0;
-    }
-    return that;
+				IODirection		direction)
+{
+    IOSubMemoryDescriptor *self = new IOSubMemoryDescriptor;
+
+    if (self && !self->initSubRange(of, offset, length, direction)) {
+        self->release();
+	self = 0;
+    }
+    return self;
 }
 
 /*
@@ -223,29 +375,123 @@
     return initWithPhysicalRanges( &_singleRange.p, 1, withDirection, true);
 }
 
+bool
+IOGeneralMemoryDescriptor::initWithPhysicalRanges(
+                                IOPhysicalRange * ranges,
+                                UInt32            count,
+                                IODirection       direction,
+                                bool              reference)
+{
+    IOOptionBits mdOpts = direction | kIOMemoryTypePhysical;
+
+    if (reference)
+        mdOpts |= kIOMemoryAsReference;
+
+    return initWithOptions(ranges, count, 0, 0, mdOpts, /* mapper */ 0);
+}
+
+bool
+IOGeneralMemoryDescriptor::initWithRanges(
+                                   IOVirtualRange * ranges,
+                                   UInt32           count,
+                                   IODirection      direction,
+                                   task_t           task,
+                                   bool             reference)
+{
+    IOOptionBits mdOpts = direction;
+
+    if (reference)
+        mdOpts |= kIOMemoryAsReference;
+
+    if (task) {
+        mdOpts |= kIOMemoryTypeVirtual;
+        if (task == kernel_task)
+            mdOpts |= kIOMemoryAutoPrepare;
+    }
+    else
+        mdOpts |= kIOMemoryTypePhysical;
+
+    // @@@ gvdl: Need to remove this
+    // Auto-prepare if this is a kernel memory descriptor as very few
+    // clients bother to prepare() kernel memory.
+    // But it has been enforced so what are you going to do?
+    
+    return initWithOptions(ranges, count, 0, task, mdOpts, /* mapper */ 0);
+}
+
 /*
- * initWithRanges:
+ * initWithOptions:
  *
- * Initialize an IOMemoryDescriptor. The buffer is made up of several
- * virtual address ranges, from a given task
+ *  IOMemoryDescriptor. The buffer is made up of several virtual address ranges,
+ * from a given task or several physical ranges or finally an UPL from the ubc
+ * system.
  *
  * Passing the ranges as a reference will avoid an extra allocation.
  *
- * An IOMemoryDescriptor can be re-used by calling initWithAddress or
- * initWithRanges again on an existing instance -- note this behavior
- * is not commonly supported in other I/O Kit classes, although it is
- * supported here.
+ * An IOMemoryDescriptor can be re-used by calling initWithOptions again on an
+ * existing instance -- note this behavior is not commonly supported in other
+ * I/O Kit classes, although it is supported here.
  */
+
+enum ioPLBlockFlags {
+    kIOPLOnDevice  = 0x00000001,
+    kIOPLExternUPL = 0x00000002,
+};
+
+struct ioPLBlock {
+    upl_t fIOPL;
+    vm_address_t fIOMDOffset;	// The offset of this iopl in descriptor
+    vm_offset_t fPageInfo;	// Pointer to page list or index into it
+    ppnum_t fMappedBase;	// Page number of first page in this iopl
+    unsigned int fPageOffset;	// Offset within first page of iopl
+    unsigned int fFlags;	// Flags
+};
+
+struct ioGMDData {
+    IOMapper *fMapper;
+    unsigned int fPageCnt;
+    upl_page_info_t fPageList[0];	// @@@ gvdl need to get rid of this
+                                        //  should be able to use upl directly
+    ioPLBlock fBlocks[0];
+};
+
+#define getDataP(osd)	((ioGMDData *) (osd)->getBytesNoCopy())
+#define getIOPLList(d)	((ioPLBlock *) &(d->fPageList[d->fPageCnt]))
+#define getNumIOPL(d,len)	\
+    ((len - ((char *) getIOPLList(d) - (char *) d)) / sizeof(ioPLBlock))
+#define getPageList(d)	(&(d->fPageList[0]))
+#define computeDataSize(p, u) \
+    (sizeof(ioGMDData) + p * sizeof(upl_page_info_t) + u * sizeof(ioPLBlock))
+
 bool
-IOGeneralMemoryDescriptor::initWithRanges(
-                                   IOVirtualRange * ranges,
-                                   UInt32           withCount,
-                                   IODirection      withDirection,
-                                   task_t           withTask,
-                                   bool             asReference = false)
-{
-    assert(ranges);
-    assert(withCount);
+IOGeneralMemoryDescriptor::initWithOptions(void *	buffers,
+                                           UInt32	count,
+                                           UInt32	offset,
+                                           task_t	task,
+                                           IOOptionBits	options,
+                                           IOMapper *	mapper)
+{
+
+    switch (options & kIOMemoryTypeMask) {
+    case kIOMemoryTypeVirtual:
+        assert(task);
+        if (!task)
+            return false;
+        else
+            break;
+
+    case kIOMemoryTypePhysical:		// Neither Physical nor UPL should have a task
+	mapper = kIOMapperNone;
+    case kIOMemoryTypeUPL:
+        assert(!task);
+        break;
+    default:
+panic("IOGMD::iWO(): bad type");	// @@@ gvdl: for testing
+        return false;	/* bad argument */
+    }
+
+    assert(buffers);
+    assert(count);
 
     /*
      * We can check the _initialized  instance variable before having ever set
@@ -253,19 +499,11 @@
      * variables are zeroed on an object's allocation.
      */
 
-    if (_initialized == false)
-    {
-        if (super::init() == false)  return false;
-        _initialized = true;
-    }
-    else
-    {
+    if (_initialized) {
         /*
          * An existing memory descriptor is being retargeted to point to
          * somewhere else.  Clean up our present state.
          */
-
-        assert(_wireCount == 0);
 
         while (_wireCount)
             complete();
@@ -274,54 +512,173 @@
         if (_ranges.v && _rangesIsAllocated)
             IODelete(_ranges.v, IOVirtualRange, _rangesCount);
     }
-
-    /*
-     * Initialize the memory descriptor.
-     */
-
-    _ranges.v              = 0;
-    _rangesCount           = withCount;
-    _rangesIsAllocated     = asReference ? false : true;
-    _direction             = withDirection;
-    _length                = 0;
-    _task                  = withTask;
+    else {
+        if (!super::init())
+            return false;
+        _initialized = true;
+    }
+
+    // Grab the appropriate mapper
+    if (mapper == kIOMapperNone)
+        mapper = 0;	// No Mapper
+    else if (!mapper) {
+        IOMapper::checkForSystemMapper();
+        gIOSystemMapper = mapper = IOMapper::gSystem;
+    }
+
+    _flags		   = options;
+    _task                  = task;
+
+    // DEPRECATED variable initialisation
+    _direction             = (IODirection) (_flags & kIOMemoryDirectionMask);
     _position              = 0;
-    _positionAtIndex       = 0;
-    _positionAtOffset      = 0;
     _kernPtrAligned        = 0;
     _cachedPhysicalAddress = 0;
     _cachedVirtualAddress  = 0;
-    _flags		   = 0;
-
-    if (withTask && (withTask != kernel_task))
-        _flags |= kIOMemoryRequiresWire;
-
-    if (asReference)
-        _ranges.v = ranges;
-    else
-    {
-        _ranges.v = IONew(IOVirtualRange, withCount);
-        if (_ranges.v == 0)  return false;
-        bcopy(/* from */ ranges, _ranges.v, withCount * sizeof(IOVirtualRange));
-    } 
-
-    for (unsigned index = 0; index < _rangesCount; index++)
-    {
-        _length += _ranges.v[index].length;
+
+    if ( (options & kIOMemoryTypeMask) == kIOMemoryTypeUPL) {
+
+        ioGMDData *dataP;
+        unsigned int dataSize = computeDataSize(/* pages */ 0, /* upls */ 1);
+
+        if (!_memoryEntries) {
+            _memoryEntries = OSData::withCapacity(dataSize);
+            if (!_memoryEntries)
+                return false;
+        }
+        else if (!_memoryEntries->initWithCapacity(dataSize))
+            return false;
+
+        _memoryEntries->appendBytes(0, sizeof(ioGMDData));
+        dataP = getDataP(_memoryEntries);
+        dataP->fMapper = mapper;
+        dataP->fPageCnt = 0;
+
+        _wireCount++;	// UPLs start out life wired
+
+        _length    = count;
+        _pages    += atop_32(offset + count + PAGE_MASK) - atop_32(offset);
+
+        ioPLBlock iopl;
+        upl_page_info_t *pageList = UPL_GET_INTERNAL_PAGE_LIST((upl_t) buffers);
+
+        iopl.fIOPL = (upl_t) buffers;
+        // Set the flag kIOPLOnDevice convieniently equal to 1
+        iopl.fFlags  = pageList->device | kIOPLExternUPL;
+        iopl.fIOMDOffset = 0;
+        if (!pageList->device) {
+            // @@@ gvdl: Ask JoeS are the pages contiguious with the list?
+            // or there a chance that we may be inserting 0 phys_addrs?
+            // Pre-compute the offset into the UPL's page list
+            pageList = &pageList[atop_32(offset)];
+            offset &= PAGE_MASK;
+            if (mapper) {
+                iopl.fMappedBase = mapper->iovmAlloc(_pages);
+                mapper->iovmInsert(iopl.fMappedBase, 0, pageList, _pages);
+            }
+	    else
+		iopl.fMappedBase = 0;
+        }
+	else
+	    iopl.fMappedBase = 0;
+        iopl.fPageInfo = (vm_address_t) pageList;
+        iopl.fPageOffset = offset;
+
+        _memoryEntries->appendBytes(&iopl, sizeof(iopl));
+    }
+    else {	/* kIOMemoryTypeVirtual | kIOMemoryTypePhysical */
+        IOVirtualRange *ranges = (IOVirtualRange *) buffers;
+
+        /*
+         * Initialize the memory descriptor.
+         */
+
+        _length			= 0;
+        _pages			= 0;
+        for (unsigned ind = 0; ind < count; ind++) {
+            IOVirtualRange cur = ranges[ind];
+    
+            _length += cur.length;
+            _pages += atop_32(cur.address + cur.length + PAGE_MASK)
+                   -  atop_32(cur.address);
+        }
+
+        _ranges.v		= 0;
+        _rangesIsAllocated	= !(options & kIOMemoryAsReference);
+        _rangesCount		= count;
+
+        if (options & kIOMemoryAsReference)
+            _ranges.v = ranges;
+        else {
+            _ranges.v = IONew(IOVirtualRange, count);
+            if (!_ranges.v)
+                return false;
+            bcopy(/* from */ ranges, _ranges.v,
+                  count * sizeof(IOVirtualRange));
+        } 
+
+        // Auto-prepare memory at creation time.
+        // Implied completion when descriptor is free-ed
+        if ( (options & kIOMemoryTypeMask) == kIOMemoryTypePhysical)
+            _wireCount++;	// Physical MDs are start out wired
+        else { /* kIOMemoryTypeVirtual */
+            ioGMDData *dataP;
+            unsigned int dataSize =
+                computeDataSize(_pages, /* upls */ _rangesCount * 2);
+
+            if (!_memoryEntries) {
+                _memoryEntries = OSData::withCapacity(dataSize);
+                if (!_memoryEntries)
+                    return false;
+            }
+            else if (!_memoryEntries->initWithCapacity(dataSize))
+                return false;
+    
+            _memoryEntries->appendBytes(0, sizeof(ioGMDData));
+            dataP = getDataP(_memoryEntries);
+            dataP->fMapper = mapper;
+            dataP->fPageCnt = _pages;
+
+	    if (kIOMemoryPersistent & _flags)
+	    {
+		kern_return_t error;
+		ipc_port_t sharedMem;
+	    
+		vm_size_t size = _pages << PAGE_SHIFT;
+		vm_address_t startPage;
+	
+		startPage = trunc_page_32(_ranges.v[0].address);
+	
+		vm_map_t theMap = ((_task == kernel_task) && (kIOMemoryBufferPageable & _flags)) 
+				? IOPageableMapForAddress(startPage)
+				: get_task_map(_task);
+	
+		vm_size_t actualSize = size;
+		error = mach_make_memory_entry( theMap,
+			    &actualSize, startPage,
+			    VM_PROT_READ | VM_PROT_WRITE, &sharedMem,
+			    NULL );
+	
+		if (KERN_SUCCESS == error) {
+		    if (actualSize == round_page_32(size)) {
+			_memEntry = (void *) sharedMem;
+		    } else {
+#if IOASSERT
+			IOLog("mach_make_memory_entry_64 (%08x) size (%08lx:%08x)\n",
+				    startPage, (UInt32)actualSize, size);
+#endif    
+			ipc_port_release_send( sharedMem );
+		    }
+		}
+	    }
+
+            if ((_flags & kIOMemoryAutoPrepare)
+             && prepare() != kIOReturnSuccess)
+                return false;
+        }
     }
 
     return true;
-}
-
-bool
-IOGeneralMemoryDescriptor::initWithPhysicalRanges(	IOPhysicalRange * ranges,
-                                        	UInt32           withCount,
-                                        	IODirection      withDirection,
-                                        	bool             asReference = false)
-{
-#warning assuming virtual, physical addresses same size
-    return( initWithRanges( (IOVirtualRange *) ranges,
-			withCount, withDirection, (task_t) 0, asReference ));
 }
 
 /*
@@ -331,97 +688,41 @@
  */
 void IOGeneralMemoryDescriptor::free()
 {
+    LOCK;
+    if( reserved)
+	reserved->memory = 0;
+    UNLOCK;
+
     while (_wireCount)
         complete();
+    if (_memoryEntries)
+        _memoryEntries->release();
+
     if (_kernPtrAligned)
         unmapFromKernel();
     if (_ranges.v && _rangesIsAllocated)
         IODelete(_ranges.v, IOVirtualRange, _rangesCount);
-    if( _memEntry)
+
+    if (reserved && reserved->devicePager)
+	device_pager_deallocate( (memory_object_t) reserved->devicePager );
+
+    // memEntry holds a ref on the device pager which owns reserved
+    // (ExpansionData) so no reserved access after this point
+    if (_memEntry)
         ipc_port_release_send( (ipc_port_t) _memEntry );
+
     super::free();
 }
 
-void IOGeneralMemoryDescriptor::unmapFromKernel()
-{
-    kern_return_t krtn;
-    vm_offset_t off;
-    // Pull the shared pages out of the task map
-    // Do we need to unwire it first?
-    for ( off = 0; off < _kernSize; off += page_size )
-    {
-	pmap_change_wiring(
-			kernel_pmap,
-			_kernPtrAligned + off,
-			FALSE);
-
-	pmap_remove(
-			kernel_pmap,
-			_kernPtrAligned + off,
-			_kernPtrAligned + off + page_size);
-    }
-    // Free the former shmem area in the task
-    krtn = vm_deallocate(kernel_map,
-			_kernPtrAligned,
-			_kernSize );
-    assert(krtn == KERN_SUCCESS);
-    _kernPtrAligned = 0;
-}
-
-void IOGeneralMemoryDescriptor::mapIntoKernel(unsigned rangeIndex)
-{
-    kern_return_t krtn;
-    vm_offset_t off;
-
-    if (_kernPtrAligned)
-    {
-        if (_kernPtrAtIndex == rangeIndex)  return;
-        unmapFromKernel();
-        assert(_kernPtrAligned == 0);
-    }
- 
-    vm_offset_t srcAlign = trunc_page(_ranges.v[rangeIndex].address);
-
-    _kernSize = trunc_page(_ranges.v[rangeIndex].address +
-                           _ranges.v[rangeIndex].length  +
-                           page_size - 1) - srcAlign;
-
-    /* Find some memory of the same size in kernel task.  We use vm_allocate()
-    to do this. vm_allocate inserts the found memory object in the
-    target task's map as a side effect. */
-    krtn = vm_allocate( kernel_map,
-	    &_kernPtrAligned,
-	    _kernSize,
-	    VM_FLAGS_ANYWHERE|VM_MAKE_TAG(VM_MEMORY_IOKIT) );  // Find first fit
-    assert(krtn == KERN_SUCCESS);
-    if(krtn)  return;
-
-    /* For each page in the area allocated from the kernel map,
-	    find the physical address of the page.
-	    Enter the page in the target task's pmap, at the
-	    appropriate target task virtual address. */
-    for ( off = 0; off < _kernSize; off += page_size )
-    {
-	vm_offset_t kern_phys_addr, phys_addr;
-	if( _task)
-	    phys_addr = pmap_extract( get_task_pmap(_task), srcAlign + off );
-	else
-	    phys_addr = srcAlign + off;
-        assert(phys_addr);
-	if(phys_addr == 0)  return;
-
-	// Check original state.
-	kern_phys_addr = pmap_extract( kernel_pmap, _kernPtrAligned + off );
-	// Set virtual page to point to the right physical one
-	pmap_enter(
-	    kernel_pmap,
-	    _kernPtrAligned + off,
-	    phys_addr,
-	    VM_PROT_READ|VM_PROT_WRITE,
-	    TRUE);
-    }
-    _kernPtrAtIndex = rangeIndex;
-}
+/* DEPRECATED */ void IOGeneralMemoryDescriptor::unmapFromKernel()
+/* DEPRECATED */ {
+                    panic("IOGMD::unmapFromKernel deprecated");
+/* DEPRECATED */ }
+/* DEPRECATED */ 
+/* DEPRECATED */ void IOGeneralMemoryDescriptor::mapIntoKernel(unsigned rangeIndex)
+/* DEPRECATED */ {
+                    panic("IOGMD::mapIntoKernel deprecated");
+/* DEPRECATED */ }
 
 /*
  * getDirection:
@@ -443,8 +744,7 @@
     return _length;
 }
 
-void IOMemoryDescriptor::setTag(
-	IOOptionBits		tag )
+void IOMemoryDescriptor::setTag( IOOptionBits tag )
 {
     _tag = tag;    
 }
@@ -454,317 +754,568 @@
     return( _tag);
 }
 
-/*
- * setPosition
- *
- * Set the logical start position inside the client buffer.
- *
- * It is convention that the position reflect the actual byte count that
- * is successfully transferred into or out of the buffer, before the I/O
- * request is "completed" (ie. sent back to its originator).
- */
-
-void IOGeneralMemoryDescriptor::setPosition(IOByteCount position)
-{
-    assert(position <= _length);
-
-    if (position >= _length)
+// @@@ gvdl: who is using this API?  Seems like a wierd thing to implement.
+IOPhysicalAddress IOMemoryDescriptor::getSourceSegment( IOByteCount   offset,
+                                                        IOByteCount * length )
+{
+    IOPhysicalAddress physAddr = 0;
+
+    if( prepare() == kIOReturnSuccess) {
+        physAddr = getPhysicalSegment( offset, length );
+        complete();
+    }
+
+    return( physAddr );
+}
+
+IOByteCount IOMemoryDescriptor::readBytes
+                (IOByteCount offset, void *bytes, IOByteCount length)
+{
+    addr64_t dstAddr = (addr64_t) (UInt32) bytes;
+    IOByteCount remaining;
+
+    // Assert that this entire I/O is withing the available range
+    assert(offset < _length);
+    assert(offset + length <= _length);
+    if (offset >= _length) {
+IOLog("IOGMD(%p): rB = o%lx, l%lx\n", this, offset, length);	// @@@ gvdl
+        return 0;
+    }
+
+    remaining = length = min(length, _length - offset);
+    while (remaining) {	// (process another target segment?)
+        addr64_t	srcAddr64;
+        IOByteCount	srcLen;
+
+        srcAddr64 = getPhysicalSegment64(offset, &srcLen);
+        if (!srcAddr64)
+            break;
+
+        // Clip segment length to remaining
+        if (srcLen > remaining)
+            srcLen = remaining;
+
+        copypv(srcAddr64, dstAddr, srcLen,
+                            cppvPsrc | cppvNoRefSrc | cppvFsnk | cppvKmap);
+
+        dstAddr   += srcLen;
+        offset    += srcLen;
+        remaining -= srcLen;
+    }
+
+    assert(!remaining);
+
+    return length - remaining;
+}
+
+IOByteCount IOMemoryDescriptor::writeBytes
+                (IOByteCount offset, const void *bytes, IOByteCount length)
+{
+    addr64_t srcAddr = (addr64_t) (UInt32) bytes;
+    IOByteCount remaining;
+
+    // Assert that this entire I/O is withing the available range
+    assert(offset < _length);
+    assert(offset + length <= _length);
+
+    assert( !(kIOMemoryPreparedReadOnly & _flags) );
+
+    if ( (kIOMemoryPreparedReadOnly & _flags) || offset >= _length) {
+IOLog("IOGMD(%p): wB = o%lx, l%lx\n", this, offset, length);	// @@@ gvdl
+        return 0;
+    }
+
+    remaining = length = min(length, _length - offset);
+    while (remaining) {	// (process another target segment?)
+        addr64_t    dstAddr64;
+        IOByteCount dstLen;
+
+        dstAddr64 = getPhysicalSegment64(offset, &dstLen);
+        if (!dstAddr64)
+            break;
+
+        // Clip segment length to remaining
+        if (dstLen > remaining)
+            dstLen = remaining;
+
+        copypv(srcAddr, (addr64_t) dstAddr64, dstLen,
+                            cppvPsnk | cppvFsnk | cppvNoRefSrc | cppvNoModSnk | cppvKmap);
+
+        srcAddr   += dstLen;
+        offset    += dstLen;
+        remaining -= dstLen;
+    }
+
+    assert(!remaining);
+
+    return length - remaining;
+}
+
+// osfmk/device/iokit_rpc.c
+extern "C" unsigned int IODefaultCacheBits(addr64_t pa);
+
+/* DEPRECATED */ void IOGeneralMemoryDescriptor::setPosition(IOByteCount position)
+/* DEPRECATED */ {
+                    panic("IOGMD::setPosition deprecated");
+/* DEPRECATED */ }
+
+IOPhysicalAddress IOGeneralMemoryDescriptor::getPhysicalSegment
+                        (IOByteCount offset, IOByteCount *lengthOfSegment)
+{
+    IOPhysicalAddress address = 0;
+    IOPhysicalLength  length  = 0;
+
+//  assert(offset <= _length);
+    if (offset < _length) // (within bounds?)
     {
-        _position         = _length;
-        _positionAtIndex  = _rangesCount;          /* careful: out-of-bounds */
-        _positionAtOffset = 0;
-        return;
-    }
-
-    if (position < _position)
+        if ( (_flags & kIOMemoryTypeMask) == kIOMemoryTypePhysical) {
+            unsigned int ind;
+
+            // Physical address based memory descriptor
+
+            // Find offset within descriptor and make it relative
+            // to the current _range.
+            for (ind = 0 ; offset >= _ranges.p[ind].length; ind++ )
+                offset -= _ranges.p[ind].length;
+    
+            IOPhysicalRange cur = _ranges.p[ind];
+            address = cur.address + offset;
+            length  = cur.length  - offset;
+
+            // see how far we can coalesce ranges
+            for (++ind; ind < _rangesCount; ind++) {
+                cur =  _ranges.p[ind];
+        
+                if (address + length != cur.address)
+                    break;
+    
+                length += cur.length;
+            }
+
+            // @@@ gvdl: should assert(address);
+            // but can't as NVidia GeForce creates a bogus physical mem
+            {
+                assert(address || /*nvidia*/(!_ranges.p[0].address && 1 == _rangesCount));
+            }
+            assert(length);
+        }
+        else do {
+            // We need wiring & we are wired.
+            assert(_wireCount);
+
+            if (!_wireCount)
+	    {
+		panic("IOGMD: not wired for getPhysicalSegment()");
+                continue;
+	    }
+
+            assert(_memoryEntries);
+
+            ioGMDData * dataP = getDataP(_memoryEntries);
+            const ioPLBlock *ioplList = getIOPLList(dataP);
+            UInt ind, numIOPLs = getNumIOPL(dataP, _memoryEntries->getLength());
+            upl_page_info_t *pageList = getPageList(dataP);
+
+            assert(numIOPLs > 0);
+
+            // Scan through iopl info blocks looking for block containing offset
+            for (ind = 1; ind < numIOPLs; ind++) {
+                if (offset < ioplList[ind].fIOMDOffset)
+                    break;
+            }
+
+            // Go back to actual range as search goes past it
+            ioPLBlock ioplInfo = ioplList[ind - 1];
+
+            if (ind < numIOPLs)
+                length = ioplList[ind].fIOMDOffset;
+            else
+                length = _length;
+            length -= offset;			// Remainder within iopl
+
+            // Subtract offset till this iopl in total list
+            offset -= ioplInfo.fIOMDOffset;
+
+            // This is a mapped IOPL so we just need to compute an offset
+            // relative to the mapped base.
+            if (ioplInfo.fMappedBase) {
+                offset += (ioplInfo.fPageOffset & PAGE_MASK);
+                address = ptoa_32(ioplInfo.fMappedBase) + offset;
+                continue;
+            }
+
+            // Currently the offset is rebased into the current iopl.
+            // Now add the iopl 1st page offset.
+            offset += ioplInfo.fPageOffset;
+
+            // For external UPLs the fPageInfo field points directly to
+            // the upl's upl_page_info_t array.
+            if (ioplInfo.fFlags & kIOPLExternUPL)
+                pageList = (upl_page_info_t *) ioplInfo.fPageInfo;
+            else
+                pageList = &pageList[ioplInfo.fPageInfo];
+
+            // Check for direct device non-paged memory
+            if ( ioplInfo.fFlags & kIOPLOnDevice ) {
+                address = ptoa_32(pageList->phys_addr) + offset;
+                continue;
+            }
+
+            // Now we need compute the index into the pageList
+            ind = atop_32(offset);
+            offset &= PAGE_MASK;
+
+            IOPhysicalAddress pageAddr = pageList[ind].phys_addr;
+            address = ptoa_32(pageAddr) + offset;
+
+            // Check for the remaining data in this upl being longer than the
+            // remainder on the current page.  This should be checked for
+            // contiguous pages
+            if (length > PAGE_SIZE - offset) {
+                // See if the next page is contiguous.  Stop looking when we hit
+                // the end of this upl, which is indicated by the
+                // contigLength >= length.
+                IOByteCount contigLength = PAGE_SIZE - offset;
+
+                // Look for contiguous segment
+                while (contigLength < length
+                &&     ++pageAddr == pageList[++ind].phys_addr) {
+                    contigLength += PAGE_SIZE;
+                }
+                if (length > contigLength)
+                    length = contigLength;
+            }
+    
+            assert(address);
+            assert(length);
+
+        } while (0);
+
+        if (!address)
+            length = 0;
+    }
+
+    if (lengthOfSegment)
+        *lengthOfSegment = length;
+
+    return address;
+}
+
+addr64_t IOMemoryDescriptor::getPhysicalSegment64
+                        (IOByteCount offset, IOByteCount *lengthOfSegment)
+{
+    IOPhysicalAddress phys32;
+    IOByteCount	      length;
+    addr64_t 	      phys64;
+
+    phys32 = getPhysicalSegment(offset, lengthOfSegment);
+    if (!phys32)
+	return 0;
+
+    if (gIOSystemMapper)
     {
-	_positionAtOffset = position;
-	_positionAtIndex  = 0;
+	IOByteCount origLen;
+
+	phys64 = gIOSystemMapper->mapAddr(phys32);
+	origLen = *lengthOfSegment;
+	length = page_size - (phys64 & (page_size - 1));
+	while ((length < origLen)
+	    && ((phys64 + length) == gIOSystemMapper->mapAddr(phys32 + length)))
+	    length += page_size;
+	if (length > origLen)
+	    length = origLen;
+
+	*lengthOfSegment = length;
     }
     else
+	phys64 = (addr64_t) phys32;
+
+    return phys64;
+}
+
+IOPhysicalAddress IOGeneralMemoryDescriptor::getSourceSegment
+                            (IOByteCount offset, IOByteCount *lengthOfSegment)
+{
+    IOPhysicalAddress address = 0;
+    IOPhysicalLength  length  = 0;
+
+    assert(offset <= _length);
+
+    if ( (_flags & kIOMemoryTypeMask) == kIOMemoryTypeUPL)
+	return super::getSourceSegment( offset, lengthOfSegment );
+
+    if ( offset < _length ) // (within bounds?)
     {
-	_positionAtOffset += (position - _position);
-    }
-    _position = position;
-
-    while (_positionAtOffset >= _ranges.v[_positionAtIndex].length)
+        unsigned rangesIndex = 0;
+
+        for ( ; offset >= _ranges.v[rangesIndex].length; rangesIndex++ )
+        {
+            offset -= _ranges.v[rangesIndex].length; // (make offset relative)
+        }
+
+        address = _ranges.v[rangesIndex].address + offset;
+        length  = _ranges.v[rangesIndex].length  - offset;
+
+        for ( ++rangesIndex; rangesIndex < _rangesCount; rangesIndex++ )
+        {
+            if ( address + length != _ranges.v[rangesIndex].address )  break;
+
+            length += _ranges.v[rangesIndex].length; // (coalesce ranges)
+        }
+
+        assert(address);
+        if ( address == 0 )  length = 0;
+    }
+
+    if ( lengthOfSegment )  *lengthOfSegment = length;
+
+    return address;
+}
+
+/* DEPRECATED */ /* USE INSTEAD: map(), readBytes(), writeBytes() */
+/* DEPRECATED */ void * IOGeneralMemoryDescriptor::getVirtualSegment(IOByteCount offset,
+/* DEPRECATED */ 							IOByteCount * lengthOfSegment)
+/* DEPRECATED */ {
+                    if (_task == kernel_task)
+                        return (void *) getSourceSegment(offset, lengthOfSegment);
+                    else
+                        panic("IOGMD::getVirtualSegment deprecated");
+
+                    return 0;
+/* DEPRECATED */ }
+/* DEPRECATED */ /* USE INSTEAD: map(), readBytes(), writeBytes() */
+
+#ifdef __ppc__
+extern vm_offset_t		static_memory_end;
+#define io_kernel_static_end	static_memory_end
+#else
+extern vm_offset_t		first_avail;
+#define io_kernel_static_end	first_avail
+#endif
+
+static kern_return_t
+io_get_kernel_static_upl(
+	vm_map_t		map,
+	vm_address_t		offset,
+	vm_size_t		*upl_size,
+	upl_t			*upl,
+	upl_page_info_array_t	page_list,
+	unsigned int		*count,
+	int			*flags,
+	int             	force_data_sync)
+{
+    unsigned int pageCount, page;
+    ppnum_t phys;
+
+    pageCount = atop_32(*upl_size);
+    if (pageCount > *count)
+	pageCount = *count;
+
+    *upl = NULL;
+
+    for (page = 0; page < pageCount; page++)
     {
-        _positionAtOffset -= _ranges.v[_positionAtIndex].length;
-        _positionAtIndex++;
-    }
-}
-
-/*
- * readBytes:
- *
- * Copy data from the memory descriptor's buffer into the specified buffer,
- * relative to the current position.   The memory descriptor's position is
- * advanced based on the number of bytes copied.
- */
-
-IOByteCount IOGeneralMemoryDescriptor::readBytes(IOByteCount offset,
-					void * bytes, IOByteCount withLength)
-{
-    IOByteCount bytesLeft;
-    void *    segment;
-    IOByteCount segmentLength;
-
-    if( offset != _position)
-	setPosition( offset );
-
-    withLength = min(withLength, _length - _position);
-    bytesLeft  = withLength;
-
-#if 0
-    while (bytesLeft && (_position < _length))
+	phys = pmap_find_phys(kernel_pmap, ((addr64_t)offset) + ptoa_64(page));
+	if (!phys)
+	    break;
+	page_list[page].phys_addr = phys;
+	page_list[page].pageout	  = 0;
+	page_list[page].absent	  = 0;
+	page_list[page].dirty	  = 0;
+	page_list[page].precious  = 0;
+	page_list[page].device	  = 0;
+    }
+
+    return ((page >= pageCount) ? kIOReturnSuccess : kIOReturnVMError);
+}
+
+IOReturn IOGeneralMemoryDescriptor::wireVirtual(IODirection forDirection)
+{
+    IOReturn error = kIOReturnNoMemory;
+    ioGMDData *dataP;
+    ppnum_t mapBase = 0;
+    IOMapper *mapper;
+    ipc_port_t sharedMem = (ipc_port_t) _memEntry;
+
+    assert(!_wireCount);
+
+    if (_pages >= gIOMaximumMappedIOPageCount)
+	return kIOReturnNoResources;
+
+    dataP = getDataP(_memoryEntries);
+    mapper = dataP->fMapper;
+    if (mapper && _pages)
+        mapBase = mapper->iovmAlloc(_pages);
+
+    // Note that appendBytes(NULL) zeros the data up to the
+    // desired length.
+    _memoryEntries->appendBytes(0, dataP->fPageCnt * sizeof(upl_page_info_t));
+    dataP = 0;	// May no longer be valid so lets not get tempted.
+
+    if (forDirection == kIODirectionNone)
+        forDirection = _direction;
+
+    int uplFlags;    // This Mem Desc's default flags for upl creation
+    switch (forDirection)
     {
-	/* Compute the relative length to the end of this virtual segment. */
-        segmentLength = min(_ranges.v[_positionAtIndex].length - _positionAtOffset, bytesLeft);
-
-	/* Compute the relative address of this virtual segment. */
-        segment = (void *)(_ranges.v[_positionAtIndex].address + _positionAtOffset);
-
-	if (KERN_SUCCESS != vm_map_read_user(getMapForTask(_task, segment),
-		/* from */ (vm_offset_t) segment, /* to */ (vm_offset_t) bytes,
-		/* size */ segmentLength))
+    case kIODirectionOut:
+        // Pages do not need to be marked as dirty on commit
+        uplFlags = UPL_COPYOUT_FROM;
+        _flags |= kIOMemoryPreparedReadOnly;
+        break;
+
+    case kIODirectionIn:
+    default:
+        uplFlags = 0;	// i.e. ~UPL_COPYOUT_FROM
+        break;
+    }
+    uplFlags |= UPL_SET_IO_WIRE | UPL_SET_LITE;
+
+    //
+    // Check user read/write access to the data buffer.
+    //
+    unsigned int pageIndex = 0;
+    IOByteCount mdOffset = 0;
+    vm_map_t curMap;
+    if (_task == kernel_task && (kIOMemoryBufferPageable & _flags))
+        curMap = 0;
+    else
+        { curMap = get_task_map(_task); }
+
+    for (UInt range = 0; range < _rangesCount; range++) {
+        ioPLBlock iopl;
+        IOVirtualRange curRange = _ranges.v[range];
+        vm_address_t startPage;
+        IOByteCount numBytes;
+
+        startPage = trunc_page_32(curRange.address);
+        iopl.fPageOffset = (short) curRange.address & PAGE_MASK;
+	if (mapper)
+	    iopl.fMappedBase = mapBase + pageIndex;
+	else
+	    iopl.fMappedBase = 0;
+        numBytes = iopl.fPageOffset + curRange.length;
+
+        while (numBytes) {
+            dataP = getDataP(_memoryEntries);
+            vm_map_t theMap =
+                (curMap)? curMap 
+                        : IOPageableMapForAddress(startPage);
+            upl_page_info_array_t pageInfo = getPageList(dataP);
+            int ioplFlags = uplFlags;
+            upl_page_list_ptr_t baseInfo = &pageInfo[pageIndex];
+
+            vm_size_t ioplSize = round_page_32(numBytes);
+            unsigned int numPageInfo = atop_32(ioplSize);
+
+	    if ((theMap == kernel_map) && (startPage < io_kernel_static_end))
+	    {
+		error = io_get_kernel_static_upl(theMap, 
+				    startPage,
+				    &ioplSize,
+				    &iopl.fIOPL,
+				    baseInfo,
+				    &numPageInfo,
+				    &ioplFlags,
+				    false);
+
+	    } else if (sharedMem && (kIOMemoryPersistent & _flags)) {
+
+		error = memory_object_iopl_request(sharedMem, 
+				    ptoa_32(pageIndex),
+				    &ioplSize,
+				    &iopl.fIOPL,
+				    baseInfo,
+				    &numPageInfo,
+				    &ioplFlags);
+
+	    } else {
+		error = vm_map_get_upl(theMap, 
+				    startPage,
+				    &ioplSize,
+				    &iopl.fIOPL,
+				    baseInfo,
+				    &numPageInfo,
+				    &ioplFlags,
+				    false);
+	    }
+
+            assert(ioplSize);
+            if (error != KERN_SUCCESS)
+                goto abortExit;
+
+            error = kIOReturnNoMemory;
+
+            if (baseInfo->device) {
+                numPageInfo = 1;
+                iopl.fFlags  = kIOPLOnDevice;
+                // Don't translate device memory at all 
+		if (mapper && mapBase) {
+		    mapper->iovmFree(mapBase, _pages);
+		    mapBase = 0;
+		    iopl.fMappedBase = 0;
+		}
+            }
+            else {
+                iopl.fFlags = 0;
+                if (mapper)
+                    mapper->iovmInsert(mapBase, pageIndex,
+                                       baseInfo, numPageInfo);
+            }
+
+            iopl.fIOMDOffset = mdOffset;
+            iopl.fPageInfo = pageIndex;
+
+	    if ((_flags & kIOMemoryAutoPrepare) && iopl.fIOPL)
+	    {
+		kernel_upl_commit(iopl.fIOPL, 0, 0);
+		iopl.fIOPL = 0;
+	    }
+
+            if (!_memoryEntries->appendBytes(&iopl, sizeof(iopl))) {
+                // Clean up partial created and unsaved iopl
+		if (iopl.fIOPL)
+		    kernel_upl_abort(iopl.fIOPL, 0);
+                goto abortExit;
+            }
+
+            // Check for a multiple iopl's in one virtual range
+            pageIndex += numPageInfo;
+            mdOffset -= iopl.fPageOffset;
+            if (ioplSize < numBytes) {
+                numBytes -= ioplSize;
+                startPage += ioplSize;
+                mdOffset += ioplSize;
+                iopl.fPageOffset = 0;
+		if (mapper)
+		    iopl.fMappedBase = mapBase + pageIndex;
+            }
+            else {
+                mdOffset += numBytes;
+                break;
+            }
+        }
+    }
+
+    return kIOReturnSuccess;
+
+abortExit:
+    {
+        dataP = getDataP(_memoryEntries);
+        UInt done = getNumIOPL(dataP, _memoryEntries->getLength());
+        ioPLBlock *ioplList = getIOPLList(dataP);
+    
+        for (UInt range = 0; range < done; range++)
 	{
-	    assert( false );
-            bytesLeft = withLength;
-	    break;
+	    if (ioplList[range].fIOPL)
+		kernel_upl_abort(ioplList[range].fIOPL, 0);
 	}
-        bytesLeft -= segmentLength;
-	offset += segmentLength;
-	setPosition(offset);
-    }
-#else
-    while (bytesLeft && (segment = getVirtualSegment(offset, &segmentLength)))
-    {
-        segmentLength = min(segmentLength, bytesLeft);
-        bcopy(/* from */ segment, /* to */ bytes, /* size */ segmentLength);
-        bytesLeft -= segmentLength;
-	offset += segmentLength;
-        bytes = (void *) (((UInt32) bytes) + segmentLength);
-    }
-#endif
-
-    return withLength - bytesLeft;
-}
-
-/*
- * writeBytes:
- *
- * Copy data to the memory descriptor's buffer from the specified buffer,
- * relative to the current position.  The memory descriptor's position is
- * advanced based on the number of bytes copied.
- */
-IOByteCount IOGeneralMemoryDescriptor::writeBytes(IOByteCount offset,
-				const void* bytes,IOByteCount withLength)
-{
-    IOByteCount bytesLeft;
-    void *    segment;
-    IOByteCount segmentLength;
-
-    if( offset != _position)
-	setPosition( offset );
-
-    withLength = min(withLength, _length - _position);
-    bytesLeft  = withLength;
-
-#if 0
-    while (bytesLeft && (_position < _length))
-    {
-	assert(_position <= _length);
-
-	/* Compute the relative length to the end of this virtual segment. */
-        segmentLength = min(_ranges.v[_positionAtIndex].length - _positionAtOffset, bytesLeft);
-
-	/* Compute the relative address of this virtual segment. */
-        segment = (void *)(_ranges.v[_positionAtIndex].address + _positionAtOffset);
-
-	if (KERN_SUCCESS != vm_map_write_user(getMapForTask(_task, segment),
-		/* from */ (vm_offset_t) bytes, 
-	        /* to */ (vm_offset_t) segment,
-		/* size */ segmentLength))
-	{
-	    assert( false );
-            bytesLeft = withLength;
-	    break;
-	}
-        bytesLeft -= segmentLength;
-	offset += segmentLength;
-	setPosition(offset);
-    }
-#else
-    while (bytesLeft && (segment = getVirtualSegment(offset, &segmentLength)))
-    {
-        segmentLength = min(segmentLength, bytesLeft);
-        bcopy(/* from */ bytes, /* to */ segment, /* size */ segmentLength);
-        // Flush cache in case we're copying code around, eg. handling a code page fault
-        IOFlushProcessorCache(kernel_task, (vm_offset_t) segment, segmentLength );
-        
-        bytesLeft -= segmentLength;
-        offset += segmentLength;
-        bytes = (void *) (((UInt32) bytes) + segmentLength);
-    }
-#endif
-
-    return withLength - bytesLeft;
-}
-
-/*
- * getPhysicalSegment:
- *
- * Get the physical address of the buffer, relative to the current position.
- * If the current position is at the end of the buffer, a zero is returned.
- */
-IOPhysicalAddress
-IOGeneralMemoryDescriptor::getPhysicalSegment(IOByteCount offset,
-						IOByteCount * lengthOfSegment)
-{
-    vm_address_t      virtualAddress;
-    IOByteCount       virtualLength;
-    pmap_t            virtualPMap;
-    IOPhysicalAddress physicalAddress;
-    IOPhysicalLength  physicalLength;
-
-    if( kIOMemoryRequiresWire & _flags)
-        assert( _wireCount );
-
-    if ((0 == _task) && (1 == _rangesCount))
-    {
-	assert(offset <= _length);
-	if (offset >= _length)
-	{
-	    physicalAddress = 0;
-	    physicalLength  = 0;
-	}
-	else
-	{
-	    physicalLength = _length - offset;
-	    physicalAddress = offset + _ranges.v[0].address;
-	}
-
-	if (lengthOfSegment)
-	    *lengthOfSegment = physicalLength;
-	return physicalAddress;
-    }
-
-    if( offset != _position)
-	setPosition( offset );
-
-    assert(_position <= _length);
-
-    /* Fail gracefully if the position is at (or past) the end-of-buffer. */
-    if (_position >= _length)
-    {
-        *lengthOfSegment = 0;
-        return 0;
-    }
-
-    /* Prepare to compute the largest contiguous physical length possible. */
-
-    virtualAddress  = _ranges.v[_positionAtIndex].address + _positionAtOffset;
-    virtualLength   = _ranges.v[_positionAtIndex].length  - _positionAtOffset;
-    vm_address_t      virtualPage  = trunc_page(virtualAddress);
-    if( _task)
-	virtualPMap     = get_task_pmap(_task);
-    else
-	virtualPMap	= 0;
-
-    physicalAddress = (virtualAddress == _cachedVirtualAddress) ?
-                        _cachedPhysicalAddress :              /* optimization */
-			virtualPMap ?
-                        	pmap_extract(virtualPMap, virtualAddress) :
-				virtualAddress;
-    physicalLength  = trunc_page(physicalAddress) + page_size - physicalAddress;
-
-    if (!physicalAddress && _task)
-    {
-	physicalAddress =
-	    vm_map_get_phys_page(get_task_map(_task), virtualPage);
-	physicalAddress += virtualAddress - virtualPage;
-    }
-
-    if (physicalAddress == 0)     /* memory must be wired in order to proceed */
-    {
-        assert(physicalAddress);
-        *lengthOfSegment = 0;
-        return 0;
-    }
-
-    /* Compute the largest contiguous physical length possible, within range. */
-    IOPhysicalAddress physicalPage = trunc_page(physicalAddress);
-
-    while (physicalLength < virtualLength)
-    {
-        physicalPage          += page_size;
-        virtualPage           += page_size;
-        _cachedVirtualAddress  = virtualPage;
-        _cachedPhysicalAddress = virtualPMap ?
-                        		pmap_extract(virtualPMap, virtualPage) :
-					virtualPage;
-	if (!_cachedPhysicalAddress && _task)
-	{
-	    _cachedPhysicalAddress =
-		vm_map_get_phys_page(get_task_map(_task), virtualPage);
-	}
-
-        if (_cachedPhysicalAddress != physicalPage)  break;
-
-        physicalLength += page_size;
-    }
-
-    /* Clip contiguous physical length at the end of this range. */
-    if (physicalLength > virtualLength)
-        physicalLength = virtualLength;
-
-    if( lengthOfSegment)
-	*lengthOfSegment = physicalLength;
-
-    return physicalAddress;
-}
-
-
-/*
- * getVirtualSegment:
- *
- * Get the virtual address of the buffer, relative to the current position.
- * If the memory wasn't mapped into the caller's address space, it will be
- * mapped in now.   If the current position is at the end of the buffer, a
- * null is returned.
- */
-void * IOGeneralMemoryDescriptor::getVirtualSegment(IOByteCount offset,
-							IOByteCount * lengthOfSegment)
-{
-    if( offset != _position)
-	setPosition( offset );
-
-    assert(_position <= _length);
-
-    /* Fail gracefully if the position is at (or past) the end-of-buffer. */
-    if (_position >= _length)
-    {
-        *lengthOfSegment = 0;
-        return 0;
-    }
-
-    /* Compute the relative length to the end of this virtual segment. */
-    *lengthOfSegment = _ranges.v[_positionAtIndex].length - _positionAtOffset;
-
-    /* Compute the relative address of this virtual segment. */
-    if (_task == kernel_task)
-        return (void *)(_ranges.v[_positionAtIndex].address + _positionAtOffset);
-    else
-    {
-	vm_offset_t off;
-
-        mapIntoKernel(_positionAtIndex);
-
-	off  = _ranges.v[_kernPtrAtIndex].address;
-	off -= trunc_page(off);
-
-	return (void *) (_kernPtrAligned + off + _positionAtOffset);
-    }
+
+        if (mapper && mapBase)
+            mapper->iovmFree(mapBase, _pages);
+    }
+
+    return error;
 }
 
 /*
@@ -776,137 +1327,19 @@
  * the memory after the I/O transfer finishes.  This method needn't
  * called for non-pageable memory.
  */
-IOReturn IOGeneralMemoryDescriptor::prepare(
-		IODirection forDirection = kIODirectionNone)
-{
-    UInt rangeIndex = 0;
-
-    if((_wireCount == 0) && (kIOMemoryRequiresWire & _flags)) {
-        kern_return_t rc;
-
-        if(forDirection == kIODirectionNone)
-            forDirection = _direction;
-
-        vm_prot_t access = VM_PROT_DEFAULT;    // Could be cleverer using direction
-
-        //
-        // Check user read/write access to the data buffer.
-        //
-
-        for (rangeIndex = 0; rangeIndex < _rangesCount; rangeIndex++)
-        {
-            vm_offset_t checkBase = trunc_page(_ranges.v[rangeIndex].address);
-            vm_size_t   checkSize = round_page(_ranges.v[rangeIndex].length );
-
-            while (checkSize)
-            {
-                vm_region_basic_info_data_t regionInfo;
-                mach_msg_type_number_t      regionInfoSize = sizeof(regionInfo);
-                vm_size_t                   regionSize;
-
-                if ( (vm_region(
-                          /* map         */ getMapForTask(_task, checkBase),
-                          /* address     */ &checkBase,
-                          /* size        */ &regionSize,
-                          /* flavor      */ VM_REGION_BASIC_INFO,
-                          /* info        */ (vm_region_info_t) &regionInfo,
-                          /* info size   */ &regionInfoSize,
-                          /* object name */ 0 ) != KERN_SUCCESS             ) ||
-                     ( (forDirection & kIODirectionIn ) &&
-                                   !(regionInfo.protection & VM_PROT_WRITE) ) ||
-                     ( (forDirection & kIODirectionOut) && 
-                                   !(regionInfo.protection & VM_PROT_READ ) ) )
-                {
-                    return kIOReturnVMError;
-                }
-
-                assert((regionSize & PAGE_MASK) == 0);
-
-                regionSize = min(regionSize, checkSize);
-                checkSize -= regionSize;
-                checkBase += regionSize;
-            } // (for each vm region)
-        } // (for each io range)
-
-        for (rangeIndex = 0; rangeIndex < _rangesCount; rangeIndex++) {
-
-            vm_offset_t srcAlign = trunc_page(_ranges.v[rangeIndex].address);
-            IOByteCount srcAlignEnd = trunc_page(_ranges.v[rangeIndex].address +
-                                _ranges.v[rangeIndex].length  +
-                                page_size - 1);
-
-	    vm_map_t taskVMMap = getMapForTask(_task, srcAlign);
-
-            rc = vm_map_wire(taskVMMap, srcAlign, srcAlignEnd, access, FALSE);
-	    if (KERN_SUCCESS != rc) {
-		IOLog("IOMemoryDescriptor::prepare vm_map_wire failed: %d\n", rc);
-		goto abortExit;
-	    }
-
-	    // If this I/O is for a user land task then protect ourselves
-	    // against COW and other vm_shenanigans
-	    if (_task && _task != kernel_task) {
-		// setup a data object to hold the 'named' memory regions
-		// @@@ gvdl: If we fail to allocate an OSData we will just
-		// hope for the best for the time being.  Lets not fail a
-		// prepare at this late stage in product release.
-		if (!_memoryEntries)
-		    _memoryEntries = OSData::withCapacity(16);
-		if (_memoryEntries) {
-		    vm_object_offset_t desiredSize = srcAlignEnd - srcAlign;
-		    vm_object_offset_t entryStart = srcAlign;
-		    ipc_port_t memHandle;
-
-		    do {
-			vm_object_offset_t actualSize = desiredSize;
-
-			rc = mach_make_memory_entry_64
-			    (taskVMMap, &actualSize, entryStart,
-			    forDirection, &memHandle, NULL);
-			if (KERN_SUCCESS != rc) {
-			    IOLog("IOMemoryDescriptor::prepare mach_make_memory_entry_64 failed: %d\n", rc);
-			    goto abortExit;
-			}
-
-			_memoryEntries->
-			    appendBytes(&memHandle, sizeof(memHandle));
-			desiredSize -= actualSize;
-			entryStart += actualSize;
-		    } while (desiredSize);
-		}
-	    }
-        }
-    }
+IOReturn IOGeneralMemoryDescriptor::prepare(IODirection forDirection)
+{
+    IOReturn error = kIOReturnSuccess;
+
+    if (!_wireCount && (_flags & kIOMemoryTypeMask) == kIOMemoryTypeVirtual) {
+        error = wireVirtual(forDirection);
+        if (error)
+            return error;
+    }
+
     _wireCount++;
+
     return kIOReturnSuccess;
-
-abortExit:
-    UInt doneIndex;
-
-
-    for(doneIndex = 0; doneIndex < rangeIndex; doneIndex++) {
-	vm_offset_t srcAlign = trunc_page(_ranges.v[doneIndex].address);
-	IOByteCount srcAlignEnd = trunc_page(_ranges.v[doneIndex].address +
-			    _ranges.v[doneIndex].length  +
-			    page_size - 1);
-
-	vm_map_unwire(getMapForTask(_task, srcAlign), srcAlign,
-			    srcAlignEnd, FALSE);
-    }
-
-    if (_memoryEntries) {
-	ipc_port_t *handles, *handlesEnd;
-
-	handles = (ipc_port_t *) _memoryEntries->getBytesNoCopy();
-	handlesEnd = (ipc_port_t *)
-	    ((vm_address_t) handles + _memoryEntries->getLength());
-	while (handles < handlesEnd)
-	    ipc_port_release_send(*handles++);
-	_memoryEntries->release();
-	_memoryEntries = 0;
-    }
-
-    return kIOReturnVMError;
 }
 
 /*
@@ -918,52 +1351,36 @@
  * before and after an I/O transfer involving pageable memory.
  */
  
-IOReturn IOGeneralMemoryDescriptor::complete(
-		IODirection forDirection = kIODirectionNone)
+IOReturn IOGeneralMemoryDescriptor::complete(IODirection /* forDirection */)
 {
     assert(_wireCount);
 
-    if(0 == _wireCount)
+    if (!_wireCount)
         return kIOReturnSuccess;
 
     _wireCount--;
-    if((_wireCount == 0) && (kIOMemoryRequiresWire & _flags)) {
-        UInt rangeIndex;
-        kern_return_t rc;
-
-        if(forDirection == kIODirectionNone)
-            forDirection = _direction;
-
-        for(rangeIndex = 0; rangeIndex < _rangesCount; rangeIndex++) {
-
-            vm_offset_t srcAlign = trunc_page(_ranges.v[rangeIndex].address);
-            IOByteCount srcAlignEnd = trunc_page(_ranges.v[rangeIndex].address +
-                                _ranges.v[rangeIndex].length  +
-                                page_size - 1);
-
-            if(forDirection == kIODirectionIn)
-                pmap_modify_pages(get_task_pmap(_task), srcAlign, srcAlignEnd);
-
-            rc = vm_map_unwire(getMapForTask(_task, srcAlign), srcAlign,
-                                  srcAlignEnd, FALSE);
-            if(rc != KERN_SUCCESS)
-                IOLog("IOMemoryDescriptor::complete: vm_map_unwire failed: %d\n", rc);
+    if (!_wireCount) {
+        if ((_flags & kIOMemoryTypeMask) == kIOMemoryTypePhysical) {
+            /* kIOMemoryTypePhysical */
+            // DO NOTHING
         }
-
-	if (_memoryEntries) {
-	    ipc_port_t *handles, *handlesEnd;
-
-	    handles = (ipc_port_t *) _memoryEntries->getBytesNoCopy();
-	    handlesEnd = (ipc_port_t *)
-			((vm_address_t) handles + _memoryEntries->getLength());
-	    while (handles < handlesEnd)
-		ipc_port_release_send(*handles++);
-
-	    _memoryEntries->release();
-	    _memoryEntries = 0;
-	}
-
-	_cachedVirtualAddress = 0;
+        else {
+            ioGMDData * dataP = getDataP(_memoryEntries);
+            ioPLBlock *ioplList = getIOPLList(dataP);
+	    UInt count = getNumIOPL(dataP, _memoryEntries->getLength());
+
+            if (dataP->fMapper && _pages && ioplList[0].fMappedBase)
+                dataP->fMapper->iovmFree(ioplList[0].fMappedBase, _pages);
+
+            // Only complete iopls that we created which are for TypeVirtual
+            if ( (_flags & kIOMemoryTypeMask) == kIOMemoryTypeVirtual) {
+                for (UInt ind = 0; ind < count; ind++)
+		    if (ioplList[ind].fIOPL)
+			kernel_upl_commit(ioplList[ind].fIOPL, 0, 0);
+            }
+
+            (void) _memoryEntries->initWithBytes(dataP, sizeof(ioGMDData)); // == setLength()
+        }
     }
     return kIOReturnSuccess;
 }
@@ -972,10 +1389,11 @@
 	vm_map_t		addressMap,
 	IOVirtualAddress *	atAddress,
 	IOOptionBits		options,
-	IOByteCount		sourceOffset = 0,
-	IOByteCount		length = 0 )
+	IOByteCount		sourceOffset,
+	IOByteCount		length )
 {
     kern_return_t kr;
+    ipc_port_t sharedMem = (ipc_port_t) _memEntry;
 
     // mapping source == dest? (could be much better)
     if( _task && (addressMap == get_task_map(_task)) && (options & kIOMapAnywhere)
@@ -985,53 +1403,113 @@
 	    return( kIOReturnSuccess );
     }
 
-     if( _task && _memEntry && (_flags & kIOMemoryRequiresWire)) {
-
-        do {
-
-            if( (1 != _rangesCount)
-             || (kIOMapDefaultCache != (options & kIOMapCacheMask)) ) {
-                kr = kIOReturnUnsupported;
-                continue;
+    if( 0 == sharedMem) {
+
+        vm_size_t size = _pages << PAGE_SHIFT;
+
+        if( _task) {
+#ifndef i386
+            vm_size_t actualSize = size;
+            kr = mach_make_memory_entry( get_task_map(_task),
+                        &actualSize, _ranges.v[0].address,
+                        VM_PROT_READ | VM_PROT_WRITE, &sharedMem,
+                        NULL );
+
+            if( (KERN_SUCCESS == kr) && (actualSize != round_page_32(size))) {
+#if IOASSERT
+                IOLog("mach_make_memory_entry_64 (%08x) size (%08lx:%08x)\n",
+                            _ranges.v[0].address, (UInt32)actualSize, size);
+#endif
+                kr = kIOReturnVMError;
+                ipc_port_release_send( sharedMem );
             }
 
-            if( 0 == length)
-                length = getLength();
-            if( (sourceOffset + length) > _ranges.v[0].length) {
-                kr = kIOReturnBadArgument;
-                continue;
+            if( KERN_SUCCESS != kr)
+#endif /* i386 */
+                sharedMem = MACH_PORT_NULL;
+
+        } else do {
+
+            memory_object_t 	pager;
+	    unsigned int    	flags = 0;
+    	    addr64_t		pa;
+    	    IOPhysicalLength	segLen;
+
+	    pa = getPhysicalSegment64( sourceOffset, &segLen );
+
+            if( !reserved) {
+                reserved = IONew( ExpansionData, 1 );
+                if( !reserved)
+                    continue;
             }
-
-            ipc_port_t sharedMem = (ipc_port_t) _memEntry;
-            vm_prot_t prot = VM_PROT_READ
-                            | ((options & kIOMapReadOnly) ? 0 : VM_PROT_WRITE);
-
-            // vm_map looks for addresses above here, even when VM_FLAGS_ANYWHERE
-            if( options & kIOMapAnywhere)
-                *atAddress = 0;
-
-            if( 0 == sharedMem)
-                kr = kIOReturnVMError;
-            else
-                kr = KERN_SUCCESS;
-
-            if( KERN_SUCCESS == kr)
-                kr = vm_map( addressMap,
-                             atAddress,
-                             length, 0 /* mask */, 
-                             (( options & kIOMapAnywhere ) ? VM_FLAGS_ANYWHERE : VM_FLAGS_FIXED)
-                             | VM_MAKE_TAG(VM_MEMORY_IOKIT), 
-                             sharedMem, sourceOffset,
-                             false, // copy
-                             prot, // cur
-                             prot, // max
-                             VM_INHERIT_NONE);
-        
+            reserved->pagerContig = (1 == _rangesCount);
+	    reserved->memory = this;
+
+	    /*What cache mode do we need*/
+            switch(options & kIOMapCacheMask ) {
+
+		case kIOMapDefaultCache:
+		default:
+		    flags = IODefaultCacheBits(pa);
+		    break;
+	
+		case kIOMapInhibitCache:
+		    flags = DEVICE_PAGER_CACHE_INHIB | 
+				    DEVICE_PAGER_COHERENT | DEVICE_PAGER_GUARDED;
+		    break;
+	
+		case kIOMapWriteThruCache:
+		    flags = DEVICE_PAGER_WRITE_THROUGH |
+				    DEVICE_PAGER_COHERENT | DEVICE_PAGER_GUARDED;
+		    break;
+
+		case kIOMapCopybackCache:
+		    flags = DEVICE_PAGER_COHERENT;
+		    break;
+
+		case kIOMapWriteCombineCache:
+		    flags = DEVICE_PAGER_CACHE_INHIB |
+				    DEVICE_PAGER_COHERENT;
+		    break;
+            }
+
+	    flags |= reserved->pagerContig ? DEVICE_PAGER_CONTIGUOUS : 0;
+
+            pager = device_pager_setup( (memory_object_t) 0, (int) reserved, 
+								size, flags);
+            assert( pager );
+
+            if( pager) {
+                kr = mach_memory_object_memory_entry_64( (host_t) 1, false /*internal*/, 
+                            size, VM_PROT_READ | VM_PROT_WRITE, pager, &sharedMem );
+
+                assert( KERN_SUCCESS == kr );
+                if( KERN_SUCCESS != kr) {
+		    device_pager_deallocate( pager );
+                    pager = MACH_PORT_NULL;
+                    sharedMem = MACH_PORT_NULL;
+                }
+            }
+	    if( pager && sharedMem)
+		reserved->devicePager    = pager;
+	    else {
+		IODelete( reserved, ExpansionData, 1 );
+		reserved = 0;
+	    }
+
         } while( false );
 
-    } else
-        kr = super::doMap( addressMap, atAddress,
+        _memEntry = (void *) sharedMem;
+    }
+
+#ifndef i386
+    if( 0 == sharedMem)
+      kr = kIOReturnVMError;
+    else
+#endif
+      kr = super::doMap( addressMap, atAddress,
                            options, sourceOffset, length );
+
     return( kr );
 }
 
@@ -1041,7 +1519,7 @@
 	IOByteCount		length )
 {
     // could be much better
-    if( _task && (addressMap == getMapForTask(_task, _ranges.v[0].address)) && (1 == _rangesCount)
+    if( _task && (addressMap == get_task_map(_task)) && (1 == _rangesCount)
 	 && (logical == _ranges.v[0].address)
 	 && (length <= _ranges.v[0].length) )
 	    return( kIOReturnSuccess );
@@ -1060,15 +1538,11 @@
 
 /* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * */
 
-static IORecursiveLock * gIOMemoryLock;
-
-#define LOCK	IORecursiveLockLock( gIOMemoryLock)
-#define UNLOCK	IORecursiveLockUnlock( gIOMemoryLock)
-
-/* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * */
-
-OSDefineMetaClass( IOMemoryMap, OSObject )
-OSDefineAbstractStructors( IOMemoryMap, OSObject )
+OSDefineMetaClassAndAbstractStructors( IOMemoryMap, OSObject )
+
+/* inline function implementation */
+IOPhysicalAddress IOMemoryMap::getPhysicalAddress()
+    { return( getPhysicalSegment( 0, 0 )); }
 
 /* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * */
 
@@ -1085,8 +1559,11 @@
     vm_map_t		addressMap;
     IOOptionBits	options;
 
+protected:
+    virtual void taggedRelease(const void *tag = 0) const;
+    virtual void free();
+
 public:
-    virtual void free();
 
     // IOMemoryMap methods
     virtual IOVirtualAddress 	getVirtualAddress();
@@ -1102,7 +1579,7 @@
 	       					   IOByteCount * length);
 
     // for IOMemoryDescriptor use
-    _IOMemoryMap * isCompatible(
+    _IOMemoryMap * copyCompatible(
 		IOMemoryDescriptor *	owner,
                 task_t			intoTask,
                 IOVirtualAddress	toAddress,
@@ -1110,13 +1587,13 @@
                 IOByteCount		offset,
                 IOByteCount		length );
 
-    bool init(
+    bool initCompatible(
 	IOMemoryDescriptor *	memory,
 	IOMemoryMap *		superMap,
         IOByteCount		offset,
         IOByteCount		length );
 
-    bool init(
+    bool initWithDescriptor(
 	IOMemoryDescriptor *	memory,
 	task_t			intoTask,
 	IOVirtualAddress	toAddress,
@@ -1137,7 +1614,7 @@
 
 /* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * */
 
-bool _IOMemoryMap::init(
+bool _IOMemoryMap::initCompatible(
 	IOMemoryDescriptor *	_memory,
 	IOMemoryMap *		_superMap,
         IOByteCount		_offset,
@@ -1167,7 +1644,7 @@
     return( true );
 }
 
-bool _IOMemoryMap::init(
+bool _IOMemoryMap::initWithDescriptor(
         IOMemoryDescriptor *	_memory,
         task_t			intoTask,
         IOVirtualAddress	toAddress,
@@ -1186,7 +1663,7 @@
     addressMap  = get_task_map(intoTask);
     if( !addressMap)
 	return( false);
-    kernel_vm_map_reference(addressMap);
+    vm_map_reference(addressMap);
 
     _memory->retain();
     memory	= _memory;
@@ -1216,98 +1693,298 @@
     return( ok );
 }
 
+struct IOMemoryDescriptorMapAllocRef
+{
+    ipc_port_t		sharedMem;
+    vm_size_t		size;
+    vm_offset_t		mapped;
+    IOByteCount		sourceOffset;
+    IOOptionBits	options;
+};
+
+static kern_return_t IOMemoryDescriptorMapAlloc(vm_map_t map, void * _ref)
+{
+    IOMemoryDescriptorMapAllocRef * ref = (IOMemoryDescriptorMapAllocRef *)_ref;
+    IOReturn			    err;
+
+    do {
+        if( ref->sharedMem) {
+            vm_prot_t prot = VM_PROT_READ
+                            | ((ref->options & kIOMapReadOnly) ? 0 : VM_PROT_WRITE);
+
+            // set memory entry cache
+            vm_prot_t memEntryCacheMode = prot | MAP_MEM_ONLY;
+            switch (ref->options & kIOMapCacheMask)
+            {
+		case kIOMapInhibitCache:
+                    SET_MAP_MEM(MAP_MEM_IO, memEntryCacheMode);
+                    break;
+	
+		case kIOMapWriteThruCache:
+                    SET_MAP_MEM(MAP_MEM_WTHRU, memEntryCacheMode);
+                    break;
+
+		case kIOMapWriteCombineCache:
+                    SET_MAP_MEM(MAP_MEM_WCOMB, memEntryCacheMode);
+                    break;
+
+		case kIOMapCopybackCache:
+                    SET_MAP_MEM(MAP_MEM_COPYBACK, memEntryCacheMode);
+                    break;
+
+		case kIOMapDefaultCache:
+		default:
+                    SET_MAP_MEM(MAP_MEM_NOOP, memEntryCacheMode);
+                    break;
+            }
+
+            vm_size_t unused = 0;
+
+            err = mach_make_memory_entry( NULL /*unused*/, &unused, 0 /*unused*/, 
+                                            memEntryCacheMode, NULL, ref->sharedMem );
+            if (KERN_SUCCESS != err)
+                IOLog("MAP_MEM_ONLY failed %d\n", err);
+
+            err = vm_map( map,
+                            &ref->mapped,
+                            ref->size, 0 /* mask */, 
+                            (( ref->options & kIOMapAnywhere ) ? VM_FLAGS_ANYWHERE : VM_FLAGS_FIXED)
+                            | VM_MAKE_TAG(VM_MEMORY_IOKIT), 
+                            ref->sharedMem, ref->sourceOffset,
+                            false, // copy
+                            prot, // cur
+                            prot, // max
+                            VM_INHERIT_NONE);
+
+            if( KERN_SUCCESS != err) {
+                ref->mapped = 0;
+                continue;
+            }
+    
+        } else {
+    
+            err = vm_allocate( map, &ref->mapped, ref->size,
+                            ((ref->options & kIOMapAnywhere) ? VM_FLAGS_ANYWHERE : VM_FLAGS_FIXED)
+                            | VM_MAKE_TAG(VM_MEMORY_IOKIT) );
+    
+            if( KERN_SUCCESS != err) {
+                ref->mapped = 0;
+                continue;
+            }
+    
+            // we have to make sure that these guys don't get copied if we fork.
+            err = vm_inherit( map, ref->mapped, ref->size, VM_INHERIT_NONE);
+            assert( KERN_SUCCESS == err );
+        }
+
+    } while( false );
+
+    return( err );
+}
+
+
 IOReturn IOMemoryDescriptor::doMap(
 	vm_map_t		addressMap,
 	IOVirtualAddress *	atAddress,
 	IOOptionBits		options,
-	IOByteCount		sourceOffset = 0,
-	IOByteCount		length = 0 )
+	IOByteCount		sourceOffset,
+	IOByteCount		length )
 {
     IOReturn		err = kIOReturnSuccess;
-    vm_size_t		ourSize;
-    vm_size_t		bytes;
-    vm_offset_t		mapped;
+    memory_object_t	pager;
     vm_address_t	logical;
     IOByteCount		pageOffset;
+    IOPhysicalAddress	sourceAddr;
+    IOMemoryDescriptorMapAllocRef	ref;
+
+    ref.sharedMem	= (ipc_port_t) _memEntry;
+    ref.sourceOffset	= sourceOffset;
+    ref.options		= options;
+
+    do {
+
+        if( 0 == length)
+            length = getLength();
+
+        sourceAddr = getSourceSegment( sourceOffset, NULL );
+        assert( sourceAddr );
+        pageOffset = sourceAddr - trunc_page_32( sourceAddr );
+
+        ref.size = round_page_32( length + pageOffset );
+
+        logical = *atAddress;
+        if( options & kIOMapAnywhere) 
+            // vm_map looks for addresses above here, even when VM_FLAGS_ANYWHERE
+            ref.mapped = 0;
+        else {
+            ref.mapped = trunc_page_32( logical );
+            if( (logical - ref.mapped) != pageOffset) {
+                err = kIOReturnVMError;
+                continue;
+            }
+        }
+
+        if( ref.sharedMem && (addressMap == kernel_map) && (kIOMemoryBufferPageable & _flags))
+            err = IOIteratePageableMaps( ref.size, &IOMemoryDescriptorMapAlloc, &ref );
+        else
+            err = IOMemoryDescriptorMapAlloc( addressMap, &ref );
+
+        if( err != KERN_SUCCESS)
+            continue;
+
+        if( reserved)
+            pager = (memory_object_t) reserved->devicePager;
+        else
+            pager = MACH_PORT_NULL;
+
+        if( !ref.sharedMem || pager )
+            err = handleFault( pager, addressMap, ref.mapped, sourceOffset, length, options );
+
+    } while( false );
+
+    if( err != KERN_SUCCESS) {
+        if( ref.mapped)
+            doUnmap( addressMap, ref.mapped, ref.size );
+        *atAddress = NULL;
+    } else
+        *atAddress = ref.mapped + pageOffset;
+
+    return( err );
+}
+
+enum {
+    kIOMemoryRedirected	= 0x00010000
+};
+
+IOReturn IOMemoryDescriptor::handleFault(
+        void *			_pager,
+	vm_map_t		addressMap,
+	IOVirtualAddress	address,
+	IOByteCount		sourceOffset,
+	IOByteCount		length,
+        IOOptionBits		options )
+{
+    IOReturn		err = kIOReturnSuccess;
+    memory_object_t	pager = (memory_object_t) _pager;
+    vm_size_t		size;
+    vm_size_t		bytes;
+    vm_size_t		page;
+    IOByteCount		pageOffset;
+    IOByteCount		pagerOffset;
     IOPhysicalLength	segLen;
-    IOPhysicalAddress	physAddr;
-
-    if( 0 == length)
-	length = getLength();
-
-    physAddr = getPhysicalSegment( sourceOffset, &segLen );
+    addr64_t		physAddr;
+
+    if( !addressMap) {
+
+        if( kIOMemoryRedirected & _flags) {
+#ifdef DEBUG
+            IOLog("sleep mem redirect %p, %lx\n", this, sourceOffset);
+#endif
+            do {
+	    	SLEEP;
+            } while( kIOMemoryRedirected & _flags );
+        }
+
+        return( kIOReturnSuccess );
+    }
+
+    physAddr = getPhysicalSegment64( sourceOffset, &segLen );
     assert( physAddr );
-
-    pageOffset = physAddr - trunc_page( physAddr );
-    ourSize = length + pageOffset;
+    pageOffset = physAddr - trunc_page_64( physAddr );
+    pagerOffset = sourceOffset;
+
+    size = length + pageOffset;
     physAddr -= pageOffset;
 
-    logical = *atAddress;
-    if( 0 == (options & kIOMapAnywhere)) {
-        mapped = trunc_page( logical );
-	if( (logical - mapped) != pageOffset)
-	    err = kIOReturnVMError;
-    }
-    if( kIOReturnSuccess == err)
-        err = vm_allocate( addressMap, &mapped, ourSize,
-			   ((options & kIOMapAnywhere) ? VM_FLAGS_ANYWHERE : VM_FLAGS_FIXED)
-                           | VM_MAKE_TAG(VM_MEMORY_IOKIT) );
-
-    if( err) {
-#ifdef DEBUG
-        kprintf("IOMemoryDescriptor::doMap: vm_allocate() "
-		"returned %08x\n", err);
-#endif
-        return( err);
-    }
-
-    // we have to make sure that these guys don't get copied if we fork.
-    err = vm_inherit( addressMap, mapped, ourSize, VM_INHERIT_NONE);
-    if( err != KERN_SUCCESS) {
-        doUnmap( addressMap, mapped, ourSize);	// back out
-        return( err);
-    }
-
-    logical = mapped;
-    *atAddress = mapped + pageOffset;
-
     segLen += pageOffset;
-    bytes = ourSize;
+    bytes = size;
     do {
 	// in the middle of the loop only map whole pages
 	if( segLen >= bytes)
 	    segLen = bytes;
-	else if( segLen != trunc_page( segLen))
+	else if( segLen != trunc_page_32( segLen))
 	    err = kIOReturnVMError;
-        if( physAddr != trunc_page( physAddr))
+        if( physAddr != trunc_page_64( physAddr))
 	    err = kIOReturnBadArgument;
 
 #ifdef DEBUG
 	if( kIOLogMapping & gIOKitDebug)
-	    kprintf("_IOMemoryMap::map(%x) %08x->%08x:%08x\n",
-                addressMap, mapped + pageOffset, physAddr + pageOffset,
+	    IOLog("_IOMemoryMap::map(%p) %08lx->%08qx:%08lx\n",
+                addressMap, address + pageOffset, physAddr + pageOffset,
 		segLen - pageOffset);
 #endif
 
-	if( kIOReturnSuccess == err)
-            err = IOMapPages( addressMap, mapped, physAddr, segLen, options );
+
+
+
+
+#ifdef i386  
+	/* i386 doesn't support faulting on device memory yet */
+	if( addressMap && (kIOReturnSuccess == err))
+            err = IOMapPages( addressMap, address, (IOPhysicalAddress) physAddr, segLen, options );
+        assert( KERN_SUCCESS == err );
 	if( err)
 	    break;
-
+#endif
+
+        if( pager) {
+            if( reserved && reserved->pagerContig) {
+                IOPhysicalLength	allLen;
+                addr64_t		allPhys;
+
+                allPhys = getPhysicalSegment64( 0, &allLen );
+                assert( allPhys );
+                err = device_pager_populate_object( pager, 0, allPhys >> PAGE_SHIFT, round_page_32(allLen) );
+
+            } else {
+
+	    for( page = 0;
+                     (page < segLen) && (KERN_SUCCESS == err);
+                     page += page_size) {
+                        err = device_pager_populate_object(pager, pagerOffset,
+                        	(ppnum_t)((physAddr + page) >> PAGE_SHIFT), page_size);
+			pagerOffset += page_size;
+                }
+            }
+            assert( KERN_SUCCESS == err );
+            if( err)
+                break;
+        }
+#ifndef i386
+	/*  *** ALERT *** */
+	/*  *** Temporary Workaround *** */
+
+	/* This call to vm_fault causes an early pmap level resolution	*/
+	/* of the mappings created above.  Need for this is in absolute	*/
+	/* violation of the basic tenet that the pmap layer is a cache.	*/
+	/* Further, it implies a serious I/O architectural violation on	*/
+	/* the part of some user of the mapping.  As of this writing, 	*/
+	/* the call to vm_fault is needed because the NVIDIA driver 	*/
+	/* makes a call to pmap_extract.  The NVIDIA driver needs to be	*/
+	/* fixed as soon as possible.  The NVIDIA driver should not 	*/
+	/* need to query for this info as it should know from the doMap	*/
+	/* call where the physical memory is mapped.  When a query is 	*/
+	/* necessary to find a physical mapping, it should be done 	*/
+	/* through an iokit call which includes the mapped memory 	*/
+	/* handle.  This is required for machine architecture independence.*/
+
+	if(!(kIOMemoryRedirected & _flags)) {
+		vm_fault(addressMap, address, 3, FALSE, FALSE, NULL, 0);
+	}
+
+	/*  *** Temporary Workaround *** */
+	/*  *** ALERT *** */
+#endif
 	sourceOffset += segLen - pageOffset;
-	mapped += segLen;
+	address += segLen;
 	bytes -= segLen;
 	pageOffset = 0;
 
     } while( bytes
-	&& (physAddr = getPhysicalSegment( sourceOffset, &segLen )));
+	&& (physAddr = getPhysicalSegment64( sourceOffset, &segLen )));
 
     if( bytes)
         err = kIOReturnBadArgument;
-    if( err)
-	doUnmap( addressMap, logical, ourSize );
-    else
-        mapped = true;
 
     return( err );
 }
@@ -1325,9 +2002,14 @@
                 addressMap, logical, length );
 #endif
 
-    if( (addressMap == kernel_map) || (addressMap == get_task_map(current_task())))
+    if( true /* && (addressMap == kernel_map) || (addressMap == get_task_map(current_task()))*/) {
+
+        if( _memEntry && (addressMap == kernel_map) && (kIOMemoryBufferPageable & _flags))
+            addressMap = IOPageableMapForAddress( logical );
+
         err = vm_deallocate( addressMap, logical, length );
-    else
+
+    } else
         err = kIOReturnSuccess;
 
     return( err );
@@ -1349,6 +2031,13 @@
             iter->release();
         }
     } while( false );
+
+    if( redirect)
+        _flags |= kIOMemoryRedirected;
+    else {
+        _flags &= ~kIOMemoryRedirected;
+        WAKEUP;
+    }
 
     UNLOCK;
 
@@ -1364,7 +2053,6 @@
 
 IOReturn IOSubMemoryDescriptor::redirect( task_t safeTask, bool redirect )
 {
-// temporary binary compatibility   IOMemoryDescriptor::redirect( safeTask, redirect );
     return( _parent->redirect( safeTask, redirect ));
 }
 
@@ -1380,16 +2068,17 @@
         if( logical && addressMap
         && (get_task_map( safeTask) != addressMap)
         && (0 == (options & kIOMapStatic))) {
-    
+
             IOUnmapPages( addressMap, logical, length );
             if( !redirect) {
                 err = vm_deallocate( addressMap, logical, length );
                 err = memory->doMap( addressMap, &logical,
-                                     (options & ~kIOMapAnywhere) /*| kIOMapReserve*/ );
+                                     (options & ~kIOMapAnywhere) /*| kIOMapReserve*/,
+                                     offset, length );
             } else
                 err = kIOReturnSuccess;
 #ifdef DEBUG
-            IOLog("IOMemoryMap::redirect(%d, %x) %x from %lx\n", redirect, err, logical, addressMap);
+            IOLog("IOMemoryMap::redirect(%d, %p) %x:%lx from %p\n", redirect, this, logical, length, addressMap);
 #endif
         }
         UNLOCK;
@@ -1430,6 +2119,17 @@
     }
     addressTask	= 0;
     logical	= 0;
+    UNLOCK;
+}
+
+// Overload the release mechanism.  All mappings must be a member
+// of a memory descriptors _mappings set.  This means that we
+// always have 2 references on a mapping.  When either of these mappings
+// are released we need to free ourselves.
+void _IOMemoryMap::taggedRelease(const void *tag) const
+{
+    LOCK;
+    super::taggedRelease(tag, 2);
     UNLOCK;
 }
 
@@ -1478,7 +2178,7 @@
     return( memory );
 }
 
-_IOMemoryMap * _IOMemoryMap::isCompatible(
+_IOMemoryMap * _IOMemoryMap::copyCompatible(
 		IOMemoryDescriptor *	owner,
                 task_t			task,
                 IOVirtualAddress	toAddress,
@@ -1488,9 +2188,12 @@
 {
     _IOMemoryMap * mapping;
 
-    if( (!task) || (task != getAddressTask()))
+    if( (!task) || (!addressMap) || (addressMap != get_task_map(task)))
 	return( 0 );
-    if( (options ^ _options) & (kIOMapCacheMask | kIOMapReadOnly))
+    if( (options ^ _options) & kIOMapReadOnly)
+	return( 0 );
+    if( (kIOMapDefaultCache != (_options & kIOMapCacheMask)) 
+     && ((options ^ _options) & kIOMapCacheMask))
 	return( 0 );
 
     if( (0 == (_options & kIOMapAnywhere)) && (logical != toAddress))
@@ -1511,7 +2214,7 @@
     } else {
         mapping = new _IOMemoryMap;
         if( mapping
-        && !mapping->init( owner, this, _offset, _length )) {
+        && !mapping->initCompatible( owner, this, _offset, _length )) {
             mapping->release();
             mapping = 0;
         }
@@ -1543,6 +2246,9 @@
 {
     if( 0 == gIOMemoryLock)
 	gIOMemoryLock = IORecursiveLockAlloc();
+
+    IORegistryEntry::getRegistryRoot()->setProperty(kIOMaximumMappedIOByteCountKey,
+						    ptoa_64(gIOMaximumMappedIOPageCount), 64);
 }
 
 void IOMemoryDescriptor::free( void )
@@ -1556,7 +2262,7 @@
 IOMemoryMap * IOMemoryDescriptor::setMapping(
 	task_t			intoTask,
 	IOVirtualAddress	mapAddress,
-	IOOptionBits		options = 0 )
+	IOOptionBits		options )
 {
     _IOMemoryMap *		map;
 
@@ -1565,7 +2271,7 @@
     LOCK;
 
     if( map
-     && !map->init( this, intoTask, mapAddress,
+     && !map->initWithDescriptor( this, intoTask, mapAddress,
                     options | kIOMapStatic, 0, getLength() )) {
 	map->release();
 	map = 0;
@@ -1579,7 +2285,7 @@
 }
 
 IOMemoryMap * IOMemoryDescriptor::map( 
-	IOOptionBits		options = 0 )
+	IOOptionBits		options )
 {
 
     return( makeMapping( this, kernel_task, 0,
@@ -1591,8 +2297,8 @@
 	task_t			intoTask,
 	IOVirtualAddress	toAddress,
 	IOOptionBits		options,
-	IOByteCount		offset = 0,
-	IOByteCount		length = 0 )
+	IOByteCount		offset,
+	IOByteCount		length )
 {
     if( 0 == length)
 	length = getLength();
@@ -1619,7 +2325,7 @@
 
             while( (mapping = (_IOMemoryMap *) iter->getNextObject())) {
 
-		if( (mapping = mapping->isCompatible( 
+		if( (mapping = mapping->copyCompatible( 
 					owner, intoTask, toAddress,
 					options | kIOMapReference,
 					offset, length )))
@@ -1638,10 +2344,11 @@
 
         mapping = new _IOMemoryMap;
 	if( mapping
-	&& !mapping->init( owner, intoTask, toAddress, options,
+	&& !mapping->initWithDescriptor( owner, intoTask, toAddress, options,
 			   offset, length )) {
-
+#ifdef DEBUG
 	    IOLog("Didn't make map %08lx : %08lx\n", offset, length );
+#endif
 	    mapping->release();
             mapping = 0;
 	}
@@ -1661,19 +2368,16 @@
     if( mapping) {
         if( 0 == _mappings)
             _mappings = OSSet::withCapacity(1);
-	if( _mappings && _mappings->setObject( mapping ))
-	    mapping->release(); 	/* really */
+	if( _mappings )
+	    _mappings->setObject( mapping );
     }
 }
 
 void IOMemoryDescriptor::removeMapping(
 	IOMemoryMap * mapping )
 {
-    if( _mappings) {
-        mapping->retain();
-        mapping->retain();
+    if( _mappings)
         _mappings->removeObject( mapping);
-    }
 }
 
 /* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * */
@@ -1687,22 +2391,38 @@
 
 bool IOSubMemoryDescriptor::initSubRange( IOMemoryDescriptor * parent,
 					IOByteCount offset, IOByteCount length,
-					IODirection withDirection )
-{
-    if( !super::init())
-	return( false );
-
+					IODirection direction )
+{
     if( !parent)
 	return( false);
 
     if( (offset + length) > parent->getLength())
 	return( false);
+
+    /*
+     * We can check the _parent instance variable before having ever set it
+     * to an initial value because I/O Kit guarantees that all our instance
+     * variables are zeroed on an object's allocation.
+     */
+
+    if( !_parent) {
+	if( !super::init())
+	    return( false );
+    } else {
+	/*
+	 * An existing memory descriptor is being retargeted to
+	 * point to somewhere else.  Clean up our present state.
+	 */
+
+	_parent->release();
+	_parent = 0;
+    }
 
     parent->retain();
     _parent	= parent;
     _start	= offset;
     _length	= length;
-    _direction  = withDirection;
+    _direction  = direction;
     _tag	= parent->getTag();
 
     return( true );
@@ -1739,6 +2459,28 @@
     return( address );
 }
 
+IOPhysicalAddress IOSubMemoryDescriptor::getSourceSegment( IOByteCount offset,
+						      	   IOByteCount * length )
+{
+    IOPhysicalAddress	address;
+    IOByteCount		actualLength;
+
+    assert(offset <= _length);
+
+    if( length)
+        *length = 0;
+
+    if( offset >= _length)
+        return( 0 );
+
+    address = _parent->getSourceSegment( offset + _start, &actualLength );
+
+    if( address && length)
+	*length = min( _length - offset, actualLength );
+
+    return( address );
+}
+
 void * IOSubMemoryDescriptor::getVirtualSegment(IOByteCount offset,
 					IOByteCount * lengthOfSegment)
 {
@@ -1746,7 +2488,7 @@
 }
 
 IOByteCount IOSubMemoryDescriptor::readBytes(IOByteCount offset,
-					void * bytes, IOByteCount withLength)
+					void * bytes, IOByteCount length)
 {
     IOByteCount	byteCount;
 
@@ -1757,14 +2499,14 @@
 
     LOCK;
     byteCount = _parent->readBytes( _start + offset, bytes,
-				min(withLength, _length - offset) );
+				min(length, _length - offset) );
     UNLOCK;
 
     return( byteCount );
 }
 
 IOByteCount IOSubMemoryDescriptor::writeBytes(IOByteCount offset,
-				const void* bytes, IOByteCount withLength)
+				const void* bytes, IOByteCount length)
 {
     IOByteCount	byteCount;
 
@@ -1775,14 +2517,14 @@
 
     LOCK;
     byteCount = _parent->writeBytes( _start + offset, bytes,
-				min(withLength, _length - offset) );
+				min(length, _length - offset) );
     UNLOCK;
 
     return( byteCount );
 }
 
 IOReturn IOSubMemoryDescriptor::prepare(
-		IODirection forDirection = kIODirectionNone)
+		IODirection forDirection)
 {
     IOReturn	err;
 
@@ -1794,7 +2536,7 @@
 }
 
 IOReturn IOSubMemoryDescriptor::complete(
-		IODirection forDirection = kIODirectionNone)
+		IODirection forDirection)
 {
     IOReturn	err;
 
@@ -1822,6 +2564,12 @@
 					_start + offset, length );
 
     if( !mapping)
+        mapping = (IOMemoryMap *) _parent->makeMapping(
+					_parent, intoTask,
+					toAddress,
+					options, _start + offset, length );
+
+    if( !mapping)
 	mapping = super::makeMapping( owner, intoTask, toAddress, options,
 					offset, length );
 
@@ -1832,17 +2580,17 @@
 
 bool
 IOSubMemoryDescriptor::initWithAddress(void *      address,
-                                    IOByteCount   withLength,
-                                    IODirection withDirection)
+                                    IOByteCount   length,
+                                    IODirection direction)
 {
     return( false );
 }
 
 bool
 IOSubMemoryDescriptor::initWithAddress(vm_address_t address,
-                                    IOByteCount    withLength,
-                                    IODirection  withDirection,
-                                    task_t       withTask)
+                                    IOByteCount    length,
+                                    IODirection  direction,
+                                    task_t       task)
 {
     return( false );
 }
@@ -1850,8 +2598,8 @@
 bool
 IOSubMemoryDescriptor::initWithPhysicalAddress(
 				 IOPhysicalAddress	address,
-				 IOByteCount		withLength,
-				 IODirection      	withDirection )
+				 IOByteCount		length,
+				 IODirection      	direction )
 {
     return( false );
 }
@@ -1860,9 +2608,9 @@
 IOSubMemoryDescriptor::initWithRanges(
                                    	IOVirtualRange * ranges,
                                    	UInt32           withCount,
-                                   	IODirection      withDirection,
-                                   	task_t           withTask,
-                                  	bool             asReference = false)
+                                   	IODirection      direction,
+                                   	task_t           task,
+                                  	bool             asReference)
 {
     return( false );
 }
@@ -1870,17 +2618,150 @@
 bool
 IOSubMemoryDescriptor::initWithPhysicalRanges(	IOPhysicalRange * ranges,
                                         	UInt32           withCount,
-                                        	IODirection      withDirection,
-                                        	bool             asReference = false)
+                                        	IODirection      direction,
+                                        	bool             asReference)
 {
     return( false );
 }
 
 /* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * */
 
-OSMetaClassDefineReservedUnused(IOMemoryDescriptor, 0);
-OSMetaClassDefineReservedUnused(IOMemoryDescriptor, 1);
-OSMetaClassDefineReservedUnused(IOMemoryDescriptor, 2);
+bool IOGeneralMemoryDescriptor::serialize(OSSerialize * s) const
+{
+    OSSymbol const *keys[2];
+    OSObject *values[2];
+    IOVirtualRange *vcopy;
+    unsigned int index, nRanges;
+    bool result;
+
+    if (s == NULL) return false;
+    if (s->previouslySerialized(this)) return true;
+
+    // Pretend we are an array.
+    if (!s->addXMLStartTag(this, "array")) return false;
+
+    nRanges = _rangesCount;
+    vcopy = (IOVirtualRange *) IOMalloc(sizeof(IOVirtualRange) * nRanges);
+    if (vcopy == 0) return false;
+
+    keys[0] = OSSymbol::withCString("address");
+    keys[1] = OSSymbol::withCString("length");
+
+    result = false;
+    values[0] = values[1] = 0;
+
+    // From this point on we can go to bail.
+
+    // Copy the volatile data so we don't have to allocate memory
+    // while the lock is held.
+    LOCK;
+    if (nRanges == _rangesCount) {
+        for (index = 0; index < nRanges; index++) {
+            vcopy[index] = _ranges.v[index];
+        }
+    } else {
+	// The descriptor changed out from under us.  Give up.
+        UNLOCK;
+	result = false;
+        goto bail;
+    }
+    UNLOCK;
+
+    for (index = 0; index < nRanges; index++)
+    {
+	values[0] = OSNumber::withNumber(_ranges.v[index].address, sizeof(_ranges.v[index].address) * 8);
+	if (values[0] == 0) {
+	  result = false;
+	  goto bail;
+	}
+	values[1] = OSNumber::withNumber(_ranges.v[index].length, sizeof(_ranges.v[index].length) * 8);
+	if (values[1] == 0) {
+	  result = false;
+	  goto bail;
+	}
+        OSDictionary *dict = OSDictionary::withObjects((const OSObject **)values, (const OSSymbol **)keys, 2);
+	if (dict == 0) {
+	  result = false;
+	  goto bail;
+	}
+	values[0]->release();
+	values[1]->release();
+	values[0] = values[1] = 0;
+
+	result = dict->serialize(s);
+	dict->release();
+	if (!result) {
+	  goto bail;
+	}
+    }
+    result = s->addXMLEndTag("array");
+
+ bail:
+    if (values[0])
+      values[0]->release();
+    if (values[1])
+      values[1]->release();
+    if (keys[0])
+      keys[0]->release();
+    if (keys[1])
+      keys[1]->release();
+    if (vcopy)
+        IOFree(vcopy, sizeof(IOVirtualRange) * nRanges);
+    return result;
+}
+
+bool IOSubMemoryDescriptor::serialize(OSSerialize * s) const
+{
+    if (!s) {
+	return (false);
+    }
+    if (s->previouslySerialized(this)) return true;
+
+    // Pretend we are a dictionary.
+    // We must duplicate the functionality of OSDictionary here
+    // because otherwise object references will not work;
+    // they are based on the value of the object passed to
+    // previouslySerialized and addXMLStartTag.
+
+    if (!s->addXMLStartTag(this, "dict")) return false;
+
+    char const *keys[3] = {"offset", "length", "parent"};
+
+    OSObject *values[3];
+    values[0] = OSNumber::withNumber(_start, sizeof(_start) * 8);
+    if (values[0] == 0)
+	return false;
+    values[1] = OSNumber::withNumber(_length, sizeof(_length) * 8);
+    if (values[1] == 0) {
+	values[0]->release();
+	return false;
+    }
+    values[2] = _parent;
+
+    bool result = true;
+    for (int i=0; i<3; i++) {
+        if (!s->addString("<key>") ||
+	    !s->addString(keys[i]) ||
+	    !s->addXMLEndTag("key") ||
+	    !values[i]->serialize(s)) {
+	  result = false;
+	  break;
+        }
+    }
+    values[0]->release();
+    values[1]->release();
+    if (!result) {
+      return false;
+    }
+
+    return s->addXMLEndTag("dict");
+}
+
+/* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * */
+
+OSMetaClassDefineReservedUsed(IOMemoryDescriptor, 0);
+OSMetaClassDefineReservedUsed(IOMemoryDescriptor, 1);
+OSMetaClassDefineReservedUsed(IOMemoryDescriptor, 2);
 OSMetaClassDefineReservedUnused(IOMemoryDescriptor, 3);
 OSMetaClassDefineReservedUnused(IOMemoryDescriptor, 4);
 OSMetaClassDefineReservedUnused(IOMemoryDescriptor, 5);
@@ -1894,3 +2775,7 @@
 OSMetaClassDefineReservedUnused(IOMemoryDescriptor, 13);
 OSMetaClassDefineReservedUnused(IOMemoryDescriptor, 14);
 OSMetaClassDefineReservedUnused(IOMemoryDescriptor, 15);
+
+/* ex-inline function implementation */
+IOPhysicalAddress IOMemoryDescriptor::getPhysicalAddress()
+        { return( getPhysicalSegment( 0, 0 )); }